Merge master into staging-next

2023-07-23 18:01:33 +00:00 · 2023-07-23 18:01:33 +00:00 · 6afe543aec
commit 6afe543aec
parent 16b32782b4 8c7af7b7c4
76 changed files with 3085 additions and 1498 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -581,6 +581,12 @@
    githubId = 1318982;
    name = "Anders Claesson";
  };
+  akechishiro = {
+    email = "akechishiro-aur+nixpkgs@lahfa.xyz";
+    github = "AkechiShiro";
+    githubId = 14914796;
+    name = "Samy Lahfa";
+  };
  a-kenji = {
    email = "aks.kenji@protonmail.com";
    github = "a-kenji";
@ -1505,6 +1511,13 @@
      fingerprint = "DD52 6BC7 767D BA28 16C0 95E5 6840 89CE 67EB B691";
    }];
  };
+  atalii = {
+    email = "taliauster@gmail.com";
+    github = "atalii";
+    githubId = 120901234;
+    name = "tali auster";
+    matrix = "@atalii:matrix.org";
+  };
  ataraxiasjel = {
    email = "nix@ataraxiadev.com";
    github = "AtaraxiaSjel";
@ -18462,12 +18475,6 @@
    github = "zfnmxt";
    githubId = 37446532;
  };
-  zgrannan = {
-    email = "zgrannan@gmail.com";
-    github = "zgrannan";
-    githubId = 1141948;
-    name = "Zack Grannan";
-  };
  zhaofengli = {
    email = "hello@zhaofeng.li";
    matrix = "@zhaofeng:zhaofeng.li";
--- a/nixos/modules/services/system/nix-daemon.nix
+++ b/nixos/modules/services/system/nix-daemon.nix
@ -168,14 +168,16 @@ in

    systemd.packages = [ nixPackage ];

-    systemd.tmpfiles =
-      if (isNixAtLeast "2.8") then {
+    systemd.tmpfiles = mkMerge [
+      (mkIf (isNixAtLeast "2.8") {
        packages = [ nixPackage ];
-      } else {
+      })
+      (mkIf (!isNixAtLeast "2.8") {
        rules = [
          "d /nix/var/nix/daemon-socket 0755 root root - -"
        ];
-      };
+      })
+    ];

    systemd.sockets.nix-daemon.wantedBy = [ "sockets.target" ];

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -203,6 +203,7 @@ in {
  couchdb = handleTest ./couchdb.nix {};
  cri-o = handleTestOn ["aarch64-linux" "x86_64-linux"] ./cri-o.nix {};
  cups-pdf = handleTest ./cups-pdf.nix {};
+  curl-impersonate = handleTest ./curl-impersonate.nix {};
  custom-ca = handleTest ./custom-ca.nix {};
  croc = handleTest ./croc.nix {};
  darling = handleTest ./darling.nix {};
--- a/nixos/tests/curl-impersonate.nix
+++ b/nixos/tests/curl-impersonate.nix
@ -0,0 +1,157 @@
+/*
+  Test suite for curl-impersonate
+
+  Abstract:
+    Uses the test suite from the curl-impersonate source repo which:
+
+    1. Performs requests with libcurl and captures the TLS client-hello
+       packets with tcpdump to compare against known-good signatures
+    2. Spins up an nghttpd2 server to test client HTTP/2 headers against
+       known-good headers
+
+    See https://github.com/lwthiker/curl-impersonate/tree/main/tests/signatures
+    for details.
+
+  Notes:
+    - We need to have our own web server running because the tests expect to be able
+      to hit domains like wikipedia.org and the sandbox has no internet
+    - We need to be able to do (verifying) TLS handshakes without internet access.
+      We do that by creating a trusted CA and issuing a cert that includes
+      all of the test domains as subject-alternative names and then spoofs the
+      hostnames in /etc/hosts.
+*/
+
+import ./make-test-python.nix ({ pkgs, lib, ... }: let
+  # Update with domains in TestImpersonate.TEST_URLS if needed from:
+  # https://github.com/lwthiker/curl-impersonate/blob/main/tests/test_impersonate.py
+  domains = [
+    "www.wikimedia.org"
+    "www.wikipedia.org"
+    "www.mozilla.org"
+    "www.apache.org"
+    "www.kernel.org"
+    "git-scm.com"
+  ];
+
+  tls-certs = let
+    # Configure CA with X.509 v3 extensions that would be trusted by curl
+    ca-cert-conf = pkgs.writeText "curl-impersonate-ca.cnf" ''
+      basicConstraints = critical, CA:TRUE
+      subjectKeyIdentifier = hash
+      authorityKeyIdentifier = keyid:always, issuer:always
+      keyUsage = critical, cRLSign, digitalSignature, keyCertSign
+    '';
+
+    # Configure leaf certificate with X.509 v3 extensions that would be trusted
+    # by curl and set subject-alternative names for test domains
+    tls-cert-conf = pkgs.writeText "curl-impersonate-tls.cnf" ''
+      basicConstraints = critical, CA:FALSE
+      subjectKeyIdentifier = hash
+      authorityKeyIdentifier = keyid:always, issuer:always
+      keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
+      extendedKeyUsage = critical, serverAuth
+      subjectAltName = @alt_names
+
+      [alt_names]
+      ${lib.concatStringsSep "\n" (lib.imap0 (idx: domain: "DNS.${toString idx} = ${domain}") domains)}
+    '';
+  in pkgs.runCommand "curl-impersonate-test-certs" {
+    nativeBuildInputs = [ pkgs.openssl ];
+  } ''
+    # create CA certificate and key
+    openssl req -newkey rsa:4096 -keyout ca-key.pem -out ca-csr.pem -nodes -subj '/CN=curl-impersonate-ca.nixos.test'
+    openssl x509 -req -sha512 -in ca-csr.pem -key ca-key.pem -out ca.pem -extfile ${ca-cert-conf} -days 36500
+    openssl x509 -in ca.pem -text
+
+    # create server certificate and key
+    openssl req -newkey rsa:4096 -keyout key.pem -out csr.pem -nodes -subj '/CN=curl-impersonate.nixos.test'
+    openssl x509 -req -sha512 -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile ${tls-cert-conf} -days 36500
+    openssl x509 -in cert.pem -text
+
+    # output CA cert and server cert and key
+    mkdir -p $out
+    cp key.pem cert.pem ca.pem $out
+  '';
+
+  # Test script
+  curl-impersonate-test = let
+    # Build miniature libcurl client used by test driver
+    minicurl = pkgs.runCommandCC "minicurl" {
+      buildInputs = [ pkgs.curl ];
+    } ''
+      mkdir -p $out/bin
+      $CC -Wall -Werror -o $out/bin/minicurl ${pkgs.curl-impersonate.src}/tests/minicurl.c `curl-config --libs`
+    '';
+  in pkgs.writeShellScript "curl-impersonate-test" ''
+    set -euxo pipefail
+
+    # Test driver requirements
+    export PATH="${with pkgs; lib.makeBinPath [
+      bash
+      coreutils
+      python3Packages.pytest
+      nghttp2
+      tcpdump
+    ]}"
+    export PYTHONPATH="${with pkgs.python3Packages; makePythonPath [
+      pyyaml
+      pytest-asyncio
+      dpkt
+    ]}"
+
+    # Prepare test root prefix
+    mkdir -p usr/{bin,lib}
+    cp -rs ${pkgs.curl-impersonate}/* ${minicurl}/* usr/
+
+    cp -r ${pkgs.curl-impersonate.src}/tests ./
+
+    # Run tests
+    cd tests
+    pytest . --install-dir ../usr --capture-interface eth1
+  '';
+in {
+  name = "curl-impersonate";
+
+  meta = with lib.maintainers; {
+    maintainers = [ lilyinstarlight ];
+  };
+
+  nodes = {
+    web = { nodes, pkgs, lib, config, ... }: {
+      networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+      services = {
+        nginx = {
+          enable = true;
+          virtualHosts."curl-impersonate.nixos.test" = {
+            default = true;
+            addSSL = true;
+            sslCertificate = "${tls-certs}/cert.pem";
+            sslCertificateKey = "${tls-certs}/key.pem";
+          };
+        };
+      };
+    };
+
+    curl = { nodes, pkgs, lib, config, ... }: {
+      networking.extraHosts = lib.concatStringsSep "\n" (map (domain: "${nodes.web.networking.primaryIPAddress}  ${domain}") domains);
+
+      security.pki.certificateFiles = [ "${tls-certs}/ca.pem" ];
+    };
+  };
+
+  testScript = { nodes, ... }: ''
+    start_all()
+
+    with subtest("Wait for network"):
+        web.wait_for_unit("network-online.target")
+        curl.wait_for_unit("network-online.target")
+
+    with subtest("Wait for web server"):
+        web.wait_for_unit("nginx.service")
+        web.wait_for_open_port(443)
+
+    with subtest("Run curl-impersonate tests"):
+        curl.succeed("${curl-impersonate-test}")
+  '';
+})
--- a/pkgs/applications/audio/famistudio/default.nix
+++ b/pkgs/applications/audio/famistudio/default.nix
@ -2,31 +2,35 @@
 , stdenv
 , fetchzip
 , autoPatchelfHook
+, dotnet-runtime
+, ffmpeg
+, libglvnd
 , makeWrapper
-, mono
 , openal
-, libGL
 }:

 stdenv.mkDerivation rec {
  pname = "famistudio";
-  version = "4.0.6";
+  version = "4.1.1";

  src = fetchzip {
    url = "https://github.com/BleuBleu/FamiStudio/releases/download/${version}/FamiStudio${lib.strings.concatStrings (lib.splitVersion version)}-LinuxAMD64.zip";
    stripRoot = false;
-    sha256 = "sha256-Se9EIQTjZQM5qqzlEB4hGVRHDFdu6GecNGpw9gYMbW4=";
+    hash = "sha256-fRNjboCfymBhr7Eg5ENnO1fchX0oTdeaJJ0SC3BKTVI=";
  };

+  strictDeps = true;
+
  nativeBuildInputs = [
    autoPatchelfHook
    makeWrapper
  ];

  buildInputs = [
-    mono
+    dotnet-runtime
+    ffmpeg
+    libglvnd
    openal
-    libGL
  ];

  dontConfigure = true;
@ -38,9 +42,10 @@ stdenv.mkDerivation rec {
    mkdir -p $out/{bin,lib/famistudio}
    mv * $out/lib/famistudio

-    makeWrapper ${mono}/bin/mono $out/bin/famistudio \
-      --add-flags $out/lib/famistudio/FamiStudio.exe \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libGL ]}
+    makeWrapper ${lib.getExe dotnet-runtime} $out/bin/famistudio \
+      --add-flags $out/lib/famistudio/FamiStudio.dll \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libglvnd ]} \
+      --prefix PATH : ${lib.makeBinPath [ ffmpeg ]}

    # Bundled openal lib freezes the application
    rm $out/lib/famistudio/libopenal32.so
--- a/pkgs/applications/audio/gnome-podcasts/Cargo.lock
+++ b/pkgs/applications/audio/gnome-podcasts/Cargo.lock
--- a/pkgs/applications/audio/gnome-podcasts/default.nix
+++ b/pkgs/applications/audio/gnome-podcasts/default.nix
@ -2,48 +2,36 @@
 , lib
 , rustPlatform
 , fetchFromGitLab
-, fetchpatch
 , cargo
 , meson
 , ninja
 , gettext
-, python3
 , pkg-config
 , rustc
 , glib
-, libhandy
-, gtk3
+, gtk4
+, libadwaita
 , appstream-glib
 , desktop-file-utils
 , dbus
 , openssl
 , sqlite
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook4
 }:

 stdenv.mkDerivation rec {
  pname = "gnome-podcasts";
-  version = "0.5.1";
+  version = "0.6.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "podcasts";
    rev = version;
-    sha256 = "00vy1qkkpn76jdpybsq9qp8s6fh1ih10j73p2x43sl97m5g8944h";
+    hash = "sha256-jnuy2UUPklfOYObSJPSqNhqqrfUP7N80pPmnw0rlB9A=";
  };

-  patches = [
-    # Fix build with meson 0.61, can be removed on next release.
-    # podcasts-gtk/resources/meson.build:5:0: ERROR: Function does not take positional arguments.
-    # podcasts-gtk/resources/meson.build:30:0: ERROR: Function does not take positional arguments.
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/World/podcasts/-/commit/6614bb62ecbec7c3b18ea7fe44beb50fe7942b27.patch";
-      sha256 = "3TVKFV9V6Ofdajgkdc+j+yxsU21C4JWSc6GjLExSM00=";
-    })
-  ];
-
  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
@ -55,21 +43,19 @@ stdenv.mkDerivation rec {
    meson
    ninja
    pkg-config
-    gettext
-    python3
    cargo
    rustPlatform.cargoSetupHook
    rustc
-    wrapGAppsHook
-    glib
+    wrapGAppsHook4
+    appstream-glib
+    desktop-file-utils
  ];

  buildInputs = [
-    appstream-glib
-    desktop-file-utils
    glib
-    gtk3
-    libhandy
+    gtk4
+    libadwaita
+    gettext
    dbus
    openssl
    sqlite
@ -82,11 +68,6 @@ stdenv.mkDerivation rec {
  # tests require network
  doCheck = false;

-  postPatch = ''
-    chmod +x scripts/compile-gschema.py # patchShebangs requires executable file
-    patchShebangs scripts/compile-gschema.py scripts/cargo.sh scripts/test.sh
-  '';
-
  meta = with lib; {
    description = "Listen to your favorite podcasts";
    homepage = "https://wiki.gnome.org/Apps/Podcasts";
--- a/pkgs/applications/audio/milkytracker/default.nix
+++ b/pkgs/applications/audio/milkytracker/default.nix
@ -1,49 +1,85 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config, makeWrapper
-, SDL2, alsa-lib, libjack2, lhasa, perl, rtmidi, zlib, zziplib }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, gitUpdater
+, alsa-lib
+, cmake
+, Cocoa
+, CoreAudio
+, Foundation
+, libjack2
+, lhasa
+, makeWrapper
+, perl
+, pkg-config
+, rtmidi
+, SDL2
+, zlib
+, zziplib
+}:

-stdenv.mkDerivation rec {
-  version = "1.03.00";
+stdenv.mkDerivation (finalAttrs: {
  pname = "milkytracker";
+  version = "1.04.00";

  src = fetchFromGitHub {
-    owner  = "milkytracker";
-    repo   = "MilkyTracker";
-    rev    = "v${version}";
-    sha256 = "025fj34gq2kmkpwcswcyx7wdxb89vm944dh685zi4bxx0hz16vvk";
+    owner = "milkytracker";
+    repo = "MilkyTracker";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ta4eV/FGBfgTppJwDam0OKQ7udtlinbWly/FPCE+Qss=";
  };

  patches = [
+    # Fix crash after querying midi ports
+    # Remove when version > 1.04.00
    (fetchpatch {
-      name = "CVE-2022-34927.patch";
-      url = "https://github.com/milkytracker/MilkyTracker/commit/3a5474f9102cbdc10fbd9e7b1b2c8d3f3f45d91b.patch";
-      hash = "sha256-YnN1Khcbct7iG7TdwxFU1XVCeKR/Zrhe+oMepvh8cRU=";
+      url = "https://github.com/milkytracker/MilkyTracker/commit/7e9171488fc47ad2de646a4536794fda21e7303d.patch";
+      hash = "sha256-CmnIwmGGnsnlRrvVAXe2zaQf1CFMB5BJPKmiwGOHgGY=";
    })
  ];

-  postPatch = ''
-    # https://github.com/milkytracker/MilkyTracker/issues/262
-    substituteInPlace CMakeLists.txt \
-      --replace 'CMAKE_CXX_STANDARD 98' 'CMAKE_CXX_STANDARD 11'
-  '';
+  strictDeps = true;

-  nativeBuildInputs = [ cmake pkg-config makeWrapper ];
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+    pkg-config
+  ];

-  buildInputs = [ SDL2 alsa-lib libjack2 lhasa perl rtmidi zlib zziplib ];
+  buildInputs = [
+    lhasa
+    libjack2
+    perl
+    rtmidi
+    SDL2
+    zlib
+    zziplib
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    Cocoa
+    CoreAudio
+    Foundation
+  ];

-  # Somehow this does not get set automatically
-  cmakeFlags = [ "-DSDL2MAIN_LIBRARY=${SDL2}/lib/libSDL2.so" ];
-
-  postInstall = ''
+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
    install -Dm644 $src/resources/milkytracker.desktop $out/share/applications/milkytracker.desktop
    install -Dm644 $src/resources/pictures/carton.png $out/share/pixmaps/milkytracker.png
    install -Dm644 $src/resources/milkytracker.appdata $out/share/appdata/milkytracker.appdata.xml
  '';

+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
  meta = with lib; {
    description = "Music tracker application, similar to Fasttracker II";
    homepage = "https://milkytracker.org/";
    license = licenses.gpl3Plus;
-    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [];
+    platforms = platforms.unix;
+    # ibtool -> real Xcode -> I can't get that, and Ofborg can't test that
+    broken = stdenv.hostPlatform.isDarwin;
+    maintainers = with maintainers; [ OPNA2608 ];
  };
-}
+})
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -966,18 +966,18 @@ self: super: {

  sniprun =
    let
-      version = "1.3.4";
+      version = "1.3.5";
      src = fetchFromGitHub {
        owner = "michaelb";
        repo = "sniprun";
        rev = "v${version}";
-        hash = "sha256-H1PmjiNyUp+fTDqnfppFii+aDh8gPD/ALHFNWVXch3w=";
+        hash = "sha256-D2nHei7mc7Yn8rgFiWFyaR87wQuryv76B25BYOpyp2I=";
      };
      sniprun-bin = rustPlatform.buildRustPackage {
        pname = "sniprun-bin";
        inherit version src;

-        cargoHash = "sha256-WXhH0zqGj/D83AoEfs0kPqW7UXIAkURTJ+/BKbuUvss=";
+        cargoHash = "sha256-TG84BeYm7K5Dn0CvMvv1gzqeX246JPks1qcwkfcsG8c=";

        nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/applications/emulators/xemu/default.nix
+++ b/pkgs/applications/emulators/xemu/default.nix
@ -12,6 +12,7 @@
 , libepoxy
 , libpcap
 , libsamplerate
+, libslirp
 , makeDesktopItem
 , mesa
 , meson
@ -27,13 +28,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xemu";
-  version = "0.7.97";
+  version = "0.7.103";

  src = fetchFromGitHub {
    owner = "xemu-project";
    repo = "xemu";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Doyn+EHZ9nlYjufHnHARLXbyDjYIEGIHuLOXFHU5f3w=";
+    hash = "sha256-yBeaRZH8YVrZATBLpUPheS2SY/rAKaRc3HKtFHKOV8E=";
    fetchSubmodules = true;
  };

@ -60,6 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
    libepoxy
    libpcap
    libsamplerate
+    libslirp
    mesa
    openssl
    vte
--- a/pkgs/applications/misc/pot/Cargo.lock
+++ b/pkgs/applications/misc/pot/Cargo.lock
--- a/pkgs/applications/misc/pot/default.nix
+++ b/pkgs/applications/misc/pot/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "pot";
-  version = "1.6.1";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "pot-app";
    repo = "pot-desktop";
    rev = version;
-    hash = "sha256-AiDQleRMuLExaVuiLvubebobDaK2YJTWjZ00F5UptuQ=";
+    hash = "sha256-v5yx8pE8+m+5CDy7X3CwitYhFQMX8Ynt8Y2k1lEZKpg=";
  };

  sourceRoot = "source/src-tauri";
@ -76,10 +76,11 @@ stdenv.mkDerivation rec {
  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "tauri-plugin-single-instance-0.0.0" = "sha256-M6uGcf4UWAU+494wAK/r2ta1c3IZ07iaURLwJJR9F3U=";
-      "tauri-plugin-autostart-0.0.0" = "sha256-9eclolp+Gb8qF/KYIRiOoCJbMJLI8LyWLQu82npI7mQ=";
+      "tauri-plugin-single-instance-0.0.0" = "sha256-Wb08d5Cpi8YhtngbnQ3ziy+zAwg5ZY+2xKejgE2oCNE=";
+      "tauri-plugin-autostart-0.0.0" = "sha256-Wb08d5Cpi8YhtngbnQ3ziy+zAwg5ZY+2xKejgE2oCNE=";
      "enigo-0.1.2" = "sha256-99VJ0WYD8jV6CYUZ1bpYJBwIE2iwOZ9SjOvyA2On12Q=";
-      "selection-0.1.0" = "sha256-85NUACRi7TjyMNKVz93G+W1EXKIVZZge/h/HtDwiW/Q=";
+      "selection-0.1.0" = "sha256-V4vixiyKqhpZeTXiFw0HKz5xr0zHd4DkC/hovJ8Y2a8=";
+      "screenshots-0.6.0" = "sha256-NHs7gqplg/eSUWYojayxeJtX7T4f8mt+akahi9LeukU=";
    };
  };

--- a/pkgs/applications/networking/clash-verge/default.nix
+++ b/pkgs/applications/networking/clash-verge/default.nix
@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "clash-verge";
-  version = "1.3.4";
+  version = "1.3.5";

  src = fetchurl {
    url = "https://github.com/zzzgydi/clash-verge/releases/download/v${version}/clash-verge_${version}_amd64.deb";
-    hash = "sha256-Jqp+bGxOuKH3BTmwnjo2RVB0c2rBVjDqZmFSw5RD/ew=";
+    hash = "sha256-dMlJ7f1wpaiJrK5Xwx+e1tsWkGG9gJUyiIjhvVCWEJQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@ -77,8 +77,8 @@ rec {

  nomad_1_5 = generic {
    buildGoModule = buildGo120Module;
-    version = "1.5.7";
-    sha256 = "sha256-IafIC1YVbJFQjC04S2rqjDgB83uSFpMajgsKxfFc/H8=";
+    version = "1.5.8";
+    sha256 = "sha256-5VAUNunQz4s1Icd+s5i8Kx6u1P0By+ikl4C5wXM1oho=";
    vendorSha256 = "sha256-y3WiQuoQn6SdwTgtPWuB6EBtsJC+YleQPzownZQNkno=";
    passthru.tests.nomad = nixosTests.nomad;
    preCheck = ''
@ -88,8 +88,8 @@ rec {

  nomad_1_6 = generic {
    buildGoModule = buildGo120Module;
-    version = "1.6.0";
-    sha256 = "sha256-979SlqBu2/kUdPB4BplhOcEq0J2sjKmFkEiLOzOAUPM=";
+    version = "1.6.1";
+    sha256 = "sha256-RsyGUaLteGiNf0PTkKLcjHTevhKb/mNx2JORpXhHJMw=";
    vendorSha256 = "sha256-Y3O7ADzZPlLWFbXSYBcI6b5MAhMD0UnkhQxO9VJMpOY=";
    passthru.tests.nomad = nixosTests.nomad;
    preCheck = ''
--- a/pkgs/applications/networking/cluster/zarf/default.nix
+++ b/pkgs/applications/networking/cluster/zarf/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "zarf";
-  version = "0.28.1";
+  version = "0.28.2";

  src = fetchFromGitHub {
    owner = "defenseunicorns";
    repo = "zarf";
    rev = "v${version}";
-    hash = "sha256-TgrYDLlbaYQwRpG4Vy9sZGWawbN4iS9YFVEjlB3JVfY=";
+    hash = "sha256-4217HkmTridDkq0c0lqkcbwqxqAceNIVFl/TEDcuxCA=";
  };

-  vendorHash = "sha256-dIQ+6aWI47zI++4skMFnyDYpQPcHEHSwUS9aXatY43g=";
+  vendorHash = "sha256-sTI/fpT/5/2ulhCuhsKpY5epJup2TxF2jpRqBI0eOWA=";
  proxyVendor = true;

  preBuild = ''
--- a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
+++ b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
@ -41,7 +41,7 @@ let
  # no stable hal release yet with recent spdlog/fmt support, remove
  # once 4.0.0 is released - see https://github.com/emsec/hal/issues/452
  spdlog' = spdlog.override {
-    fmt = fmt_8.overrideAttrs (_: rec {
+    fmt_9 = fmt_8.overrideAttrs (_: rec {
      version = "8.0.1";
      src = fetchFromGitHub {
        owner = "fmtlib";
--- a/pkgs/applications/window-managers/sway/osd.nix
+++ b/pkgs/applications/window-managers/sway/osd.nix
@ -3,14 +3,20 @@
 , fetchFromGitHub
 , pkg-config
 , wrapGAppsHook
+, cargo
+, coreutils
 , gtk-layer-shell
 , libevdev
 , libinput
 , libpulseaudio
+, meson
+, ninja
+, rustc
+, stdenv
 , udev
 }:

-rustPlatform.buildRustPackage {
+stdenv.mkDerivation rec {
  pname = "swayosd";
  version = "unstable-2023-07-18";

@ -21,11 +27,20 @@ rustPlatform.buildRustPackage {
    hash = "sha256-MJuTwEI599Y7q+0u0DMxRYaXsZfpksc2csgnK9Ghp/E=";
  };

-  cargoHash = "sha256-pExpzQwuHREhgkj+eZ8drBVsh/B3WiQBBh906O6ymFw=";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-pExpzQwuHREhgkj+eZ8drBVsh/B3WiQBBh906O6ymFw=";
+  };

  nativeBuildInputs = [
    wrapGAppsHook
    pkg-config
+    meson
+    rustc
+    cargo
+    ninja
+    rustPlatform.cargoSetupHook
  ];

  buildInputs = [
@ -36,6 +51,16 @@ rustPlatform.buildRustPackage {
    udev
  ];

+  patches = [
+    ./swayosd_systemd_paths.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace data/udev/99-swayosd.rules \
+      --replace /bin/chgrp ${coreutils}/bin/chgrp \
+      --replace /bin/chmod ${coreutils}/bin/chmod
+  '';
+
  meta = with lib; {
    description = "A GTK based on screen display for keyboard shortcuts";
    homepage = "https://github.com/ErikReider/SwayOSD";
--- a/pkgs/applications/window-managers/sway/swayosd_systemd_paths.patch
+++ b/pkgs/applications/window-managers/sway/swayosd_systemd_paths.patch
@ -0,0 +1,24 @@
+diff --git a/data/meson.build b/data/meson.build
+index fc687a5..68decdf 100644
+--- a/data/meson.build
+++ b/data/meson.build
+@@ -1,5 +1,6 @@
+ datadir = get_option('datadir')
+ sysconfdir = get_option('sysconfdir')
+libdir = get_option('libdir')
+ 
+ # LICENSE
+ install_data(
+@@ -41,11 +42,7 @@ configure_file(
+ 
+ # Systemd service unit
+ systemd = dependency('systemd', required: false)
+-if systemd.found()
+-  systemd_service_install_dir = systemd.get_variable(pkgconfig :'systemdsystemunitdir')
+-else
+-  systemd_service_install_dir = join_paths(libdir, 'systemd', 'system')
+-endif
+systemd_service_install_dir = join_paths(libdir, 'systemd', 'system')
+ 
+ configure_file(
+   configuration: conf_data,
--- a/pkgs/desktops/lomiri/default.nix
+++ b/pkgs/desktops/lomiri/default.nix
@ -12,6 +12,7 @@ let
    deviceinfo = callPackage ./development/deviceinfo { };
    geonames = callPackage ./development/geonames { };
    gmenuharness = callPackage ./development/gmenuharness { };
+    libusermetrics = callPackage ./development/libusermetrics { };
    lomiri-api = callPackage ./development/lomiri-api { };
  };
 in
--- a/pkgs/desktops/lomiri/development/libusermetrics/default.nix
+++ b/pkgs/desktops/lomiri/development/libusermetrics/default.nix
@ -0,0 +1,129 @@
+{ stdenv
+, lib
+, fetchFromGitLab
+, gitUpdater
+, testers
+, cmake
+, cmake-extras
+, dbus
+, doxygen
+, gsettings-qt
+, gtest
+, intltool
+, json-glib
+, libapparmor
+, libqtdbustest
+, pkg-config
+, qdjango
+, qtbase
+, qtdeclarative
+, qtxmlpatterns
+, ubports-click
+, wrapQtAppsHook
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libusermetrics";
+  version = "1.3.0";
+
+  src = fetchFromGitLab {
+    owner = "ubports";
+    repo = "development/core/libusermetrics";
+    rev = finalAttrs.version;
+    hash = "sha256-yO9wZcXJBKt1HZ1GKoQ1flqYuwW9PlXiWLE3bl21PSQ=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  postPatch = ''
+    substituteInPlace data/CMakeLists.txt \
+      --replace '/etc' "$out/etc"
+
+    # Tries to query QMake for QT_INSTALL_QML variable, would return broken paths into /build/qtbase-<commit> even if qmake was available
+    substituteInPlace src/modules/UserMetrics/CMakeLists.txt \
+      --replace "\''${QT_IMPORTS_DIR}/UserMetrics" '${placeholder "out"}/${qtbase.qtQmlPrefix}/UserMetrics'
+
+    substituteInPlace src/libusermetricsinput/CMakeLists.txt \
+      --replace 'RUNTIME DESTINATION bin' 'RUNTIME DESTINATION ''${CMAKE_INSTALL_BINDIR}'
+
+    substituteInPlace doc/CMakeLists.txt \
+      --replace "\''${CMAKE_INSTALL_DATAROOTDIR}/doc/libusermetrics-doc" "\''${CMAKE_INSTALL_DOCDIR}"
+  '' + lib.optionalString (!finalAttrs.doCheck) ''
+    # Only needed by tests
+    sed -i -e '/QTDBUSTEST/d' CMakeLists.txt
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    doxygen
+    intltool
+    pkg-config
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    cmake-extras
+    gsettings-qt
+    json-glib
+    libapparmor
+    qdjango
+    qtxmlpatterns
+    ubports-click
+
+    # Plugin
+    qtbase
+  ];
+
+  nativeCheckInputs = [
+    dbus
+  ];
+
+  checkInputs = [
+    gtest
+    libqtdbustest
+    qtdeclarative
+  ];
+
+  cmakeFlags = [
+    "-DGSETTINGS_LOCALINSTALL=ON"
+    "-DGSETTINGS_COMPILE=ON"
+    "-DENABLE_TESTS=${lib.boolToString finalAttrs.doCheck}"
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  checkPhase = ''
+    runHook preCheck
+
+    export QT_PLUGIN_PATH=${lib.getBin qtbase}/lib/qt-${qtbase.version}/plugins/
+    export QML2_IMPORT_PATH=${lib.getBin qtdeclarative}/lib/qt-${qtbase.version}/qml/
+    dbus-run-session --config-file=${dbus}/share/dbus-1/session.conf -- \
+      make test "''${enableParallelChecking:+-j $NIX_BUILD_CORES}"
+
+    runHook postCheck
+  '';
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = gitUpdater { };
+  };
+
+  meta = with lib; {
+    description = "Enables apps to locally store interesting numerical data for later presentation";
+    homepage = "https://gitlab.com/ubports/development/core/libusermetrics";
+    license = licenses.lgpl3Only;
+    maintainers = teams.lomiri.members;
+    platforms = platforms.linux;
+    mainProgram = "usermetricsinput";
+    pkgConfigModules = [
+      "libusermetricsinput-1"
+      "libusermetricsoutput-1"
+    ];
+  };
+})
--- a/pkgs/development/compilers/unison/default.nix
+++ b/pkgs/development/compilers/unison/default.nix
@ -1,23 +1,23 @@
 { lib, stdenv, fetchurl, autoPatchelfHook
-, ncurses5, zlib, gmp
+, ncurses6, zlib, gmp
 , makeWrapper
 , less
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "unison-code-manager";
-  milestone_id = "M4i";
+  milestone_id = "M5b";
  version = "1.0.${finalAttrs.milestone_id}-alpha";

  src = if (stdenv.isDarwin) then
    fetchurl {
      url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.milestone_id}/ucm-macos.tar.gz";
-      hash = "sha256-1Qp1SB5rCsVimZzRo1NOX8HBoMEGlIycJPm3zGTUuOw=";
+      hash = "sha256-Uknt1NrywmGs8YovlnN8TU8iaYgT1jeYP4SQCuK1u+I=";
    }
  else
    fetchurl {
      url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.milestone_id}/ucm-linux.tar.gz";
-      hash = "sha256-Qx8vO/Vaz0VdCGXwIwRQIuMlp44hxCroQ7m7Y+m7aXk=";
+      hash = "sha256-CZLGA4fFFysxHkwedC8RBLmHWwr3BM8xqps7hN3TC/g=";
    };

  # The tarball is just the prebuilt binary, in the archive root.
@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
  dontConfigure = true;

  nativeBuildInputs = [ makeWrapper ] ++ (lib.optional (!stdenv.isDarwin) autoPatchelfHook);
-  buildInputs = lib.optionals (!stdenv.isDarwin) [ ncurses5 zlib gmp ];
+  buildInputs = lib.optionals (!stdenv.isDarwin) [ ncurses6 zlib gmp ];

  installPhase = ''
    mkdir -p $out/bin
--- a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
+++ b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
@ -1,21 +1,21 @@
-{ ffmpeg_5-full
-, nv-codec-headers-11
+{ ffmpeg_6-full
+, nv-codec-headers-12
 , chromaprint
 , fetchFromGitHub
 , lib
 }:

-(ffmpeg_5-full.override {
-  nv-codec-headers = nv-codec-headers-11;
+(ffmpeg_6-full.override {
+  nv-codec-headers-11 = nv-codec-headers-12;
 }).overrideAttrs (old: rec {
  pname = "jellyfin-ffmpeg";
-  version = "5.1.2-8";
+  version = "6.0-4";

  src = fetchFromGitHub {
    owner = "jellyfin";
    repo = "jellyfin-ffmpeg";
    rev = "v${version}";
-    sha256 = "sha256-0ne9Xj9MnB5WOkPRtPX7W30qG1osHd0tyua+5RMrnQc=";
+    sha256 = "sha256-o0D/GWbSoy5onbYG29wTbpZ8z4sZ2s1WclGCXRMSekA=";
  };

  buildInputs = old.buildInputs ++ [ chromaprint ];
--- a/pkgs/development/libraries/nv-codec-headers/12_x.nix
+++ b/pkgs/development/libraries/nv-codec-headers/12_x.nix
@ -0,0 +1,27 @@
+{ stdenv
+, lib
+, fetchgit
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nv-codec-headers";
+  version = "12.0.16.0";
+
+  src = fetchgit {
+    url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
+    rev = "n${version}";
+    sha256 = "sha256-8YZU9pb0kzat0JBVEotaZUkNicQvLNIrIyPU9KTTjwg=";
+  };
+
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  meta = with lib; {
+    description = "FFmpeg version of headers for NVENC";
+    homepage = "https://git.videolan.org/?p=ffmpeg/nv-codec-headers.git";
+    license = licenses.mit;
+    maintainers = with maintainers; [ MP2E ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/libraries/qmltermwidget/default.nix
+++ b/pkgs/development/libraries/qmltermwidget/default.nix
@ -1,26 +1,35 @@
-{ lib, stdenv, fetchFromGitHub, qtbase, qtquick1, qmake, qtmultimedia, utmp, fetchpatch }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, qtbase
+, qtquick1
+, qmake
+, qtmultimedia
+, utmp
+}:

 stdenv.mkDerivation {
-  version = "2018-11-24";
-  pname = "qmltermwidget-unstable";
+  pname = "qmltermwidget";
+  version = "unstable-2022-01-09";

  src = fetchFromGitHub {
    repo = "qmltermwidget";
    owner = "Swordfish90";
-    rev = "48274c75660e28d44af7c195e79accdf1bd44963";
-    sha256 = "028nb1xp84jmakif5mmzx52q3rsjwckw27jdpahyaqw7j7i5znq6";
+    rev = "63228027e1f97c24abb907550b22ee91836929c5";
+    hash = "sha256-aVaiRpkYvuyomdkQYAgjIfi6a3wG2a6hNH1CfkA2WKQ=";
  };

-  buildInputs = [ qtbase qtquick1 qtmultimedia ]
-                ++ lib.optional stdenv.isDarwin utmp;
  nativeBuildInputs = [ qmake ];

+  buildInputs = [
+    qtbase
+    qtquick1
+    qtmultimedia
+  ] ++ lib.optional stdenv.isDarwin utmp;
+
  patches = [
-    (fetchpatch {
-      name = "fix-missing-includes.patch";
-      url = "https://github.com/Swordfish90/qmltermwidget/pull/27/commits/485f8d6d841b607ba49e55a791f7f587e4e193bc.diff";
-      sha256 = "186s8pv3642vr4lxsds919h0y2vrkl61r7wqq9mc4a5zk5vprinj";
-    })
+    # Some files are copied twice to the output which makes the build fails
+    ./do-not-copy-artifacts-twice.patch
  ];

  postPatch = ''
@ -28,7 +37,7 @@ stdenv.mkDerivation {
      --replace '$$[QT_INSTALL_QML]' "/$qtQmlPrefix/"
  '';

-  installFlags = [ "INSTALL_ROOT=$(out)" ];
+  installFlags = [ "INSTALL_ROOT=${placeholder "out"}" ];

  dontWrapQtApps = true;

--- a/pkgs/development/libraries/qmltermwidget/do-not-copy-artifacts-twice.patch
+++ b/pkgs/development/libraries/qmltermwidget/do-not-copy-artifacts-twice.patch
@ -0,0 +1,10 @@
+diff --git a/qmltermwidget.pro b/qmltermwidget.pro
+index c9594a9..aa1a804 100644
+--- a/qmltermwidget.pro
+++ b/qmltermwidget.pro
+@@ -62,4 +62,4 @@ kblayouts2.path = $$INSTALL_DIR/$$PLUGIN_IMPORT_PATH/kb-layouts/historic
+ scrollbar.files = $$PWD/src/QMLTermScrollbar.qml
+ scrollbar.path = $$INSTALL_DIR/$$PLUGIN_IMPORT_PATH
+ 
+-INSTALLS += target qmldir assets colorschemes colorschemes2 kblayouts kblayouts2 scrollbar
+INSTALLS += target qmldir assets
--- a/pkgs/development/libraries/spdlog/default.nix
+++ b/pkgs/development/libraries/spdlog/default.nix
@ -1,4 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, fmt
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+# Although we include upstream patches that fix compilation with fmt_10, we
+# still use fmt_9 because this dependency is propagated, and many of spdlog's
+# reverse dependencies don't support fmt_10 yet.
+, fmt_9
 , staticBuild ? stdenv.hostPlatform.isStatic

 # tests
@ -29,7 +37,7 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [ cmake ];
-  propagatedBuildInputs = [ fmt ];
+  propagatedBuildInputs = [ fmt_9 ];

  cmakeFlags = [
    "-DSPDLOG_BUILD_SHARED=${if staticBuild then "OFF" else "ON"}"
--- a/pkgs/development/python-modules/ansible-compat/default.nix
+++ b/pkgs/development/python-modules/ansible-compat/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "ansible-compat";
-  version = "4.1.2";
+  version = "4.1.5";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-aWFi28EiPAtHQTamFmKz/kQRXUkN6NpgaxSc7lcrAe0=";
+    hash = "sha256-WXyDahhMETH+62sOI82iNsQf7N7mRCc3Unj7aSD9LnQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, pythonRelaxDepsHook
+, fetchPypi
+, grpcio
+, protobuf
+}:
+
+buildPythonPackage rec {
+  pname = "grpcio-channelz";
+  version = "1.56.2";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-PlPGrD16Iy5vCsuVsFQ3FHd+wu0FJCFbo7isvYtVAQU=";
+  };
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+  pythonRelaxDeps = [
+    "grpcio"
+  ];
+
+  propagatedBuildInputs = [
+    grpcio
+    protobuf
+  ];
+
+  pythonImportsCheck = [ "grpc_channelz" ];
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Channel Level Live Debug Information Service for gRPC";
+    homepage = "https://pypi.org/project/grpcio-channelz";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ happysalada ];
+  };
+}
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, pythonRelaxDepsHook
+, fetchPypi
+, grpcio
+, protobuf
+}:
+
+buildPythonPackage rec {
+  pname = "grpcio-health-checking";
+  version = "1.56.2";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-XNodihNovizaBPkoSotzzuCf8+J37sjd2avPL+92s3I=";
+  };
+
+  propagatedBuildInputs = [
+    grpcio
+    protobuf
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+  pythonRelaxDeps = [
+    "grpcio"
+  ];
+
+  pythonImportsCheck = [ "grpc_health" ];
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Standard Health Checking Service for gRPC";
+    homepage = "https://pypi.org/project/grpcio-health-checking/";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ happysalada ];
+  };
+}
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonRelaxDepsHook
+, grpcio
+, protobuf
+}:
+
+buildPythonPackage rec {
+  pname = "grpcio-reflection";
+  version = "1.56.2";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-dKgXZq9jmrjxt/WVMdyBRkD0obzwEtwGzmviBbUKOUw=";
+  };
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+  pythonRelaxDeps = [
+    "grpcio"
+  ];
+
+  propagatedBuildInputs = [
+    grpcio
+    protobuf
+  ];
+
+  pythonImportsCheck = [ "grpc_reflection" ];
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Standard Protobuf Reflection Service for gRPC";
+    homepage = "https://pypi.org/project/grpcio-reflection";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ happysalada ];
+  };
+}
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@ -5,7 +5,6 @@
 , fetchFromGitHub
 , freezegun
 , tzdata
-, py
 , pyparsing
 , pydantic
 , pytest-asyncio
@ -19,16 +18,16 @@

 buildPythonPackage rec {
  pname = "ical";
-  version = "4.5.4";
+  version = "5.0.0";
  format = "setuptools";

-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = "allenporter";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-UcuJ23yzpRHDUFlwov692UyLXP/9Qb4F+IJIszo12/M=";
+    hash = "sha256-6xDbr/y9ZNT9thWMLHPi9/EXVXrUdMCVJdQAcd3G2vo=";
  };

  nativeBuildInputs = [
@ -49,7 +48,6 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    freezegun
-    py
    pytest-asyncio
    pytest-benchmark
    pytest-golden
--- a/pkgs/development/python-modules/jsonable/default.nix
+++ b/pkgs/development/python-modules/jsonable/default.nix
@ -1,8 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
 , nose
+, pytestCheckHook
 }:

 buildPythonPackage rec {
@ -16,9 +16,10 @@ buildPythonPackage rec {
    hash = "sha256-3FIzG2djSZOPDdoYeKqs3obQjgHrFtyp0sdBwZakkHA=";
  };

-  nativeCheckInputs = [ pytestCheckHook ];
-
-  checkInputs = [ nose ];
+  nativeCheckInputs = [
+    nose
+    pytestCheckHook
+  ];

  pythonImportsCheck = [ "jsonable" ];

--- a/pkgs/development/python-modules/mwtypes/default.nix
+++ b/pkgs/development/python-modules/mwtypes/default.nix
@ -2,8 +2,8 @@
 , buildPythonPackage
 , fetchPypi
 , jsonable
-, pytestCheckHook
 , nose
+, pytestCheckHook
 }:

 buildPythonPackage rec {
@ -17,9 +17,10 @@ buildPythonPackage rec {

  propagatedBuildInputs = [ jsonable ];

-  nativeCheckInputs = [ pytestCheckHook ];
-
-  checkInputs = [ nose ];
+  nativeCheckInputs = [
+    nose
+    pytestCheckHook
+  ];

  disabledTests = [
    "test_normalize_path_bad_extension"
--- a/pkgs/development/python-modules/mwxml/default.nix
+++ b/pkgs/development/python-modules/mwxml/default.nix
@ -4,8 +4,8 @@
 , jsonschema
 , mwcli
 , mwtypes
-, pytestCheckHook
 , nose
+, pytestCheckHook
 }:

 buildPythonPackage rec {
@ -23,9 +23,10 @@ buildPythonPackage rec {
    mwtypes
  ];

-  nativeCheckInputs = [ pytestCheckHook ];
-
-  checkInputs = [ nose ];
+  nativeCheckInputs = [
+    nose
+    pytestCheckHook
+  ];

  disabledTests = [
    "test_page_with_discussion"
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@ -8,18 +8,19 @@

 buildPythonPackage rec {
  pname = "mypy-boto3-s3";
-  version = "1.28.3.post2";
+  version = "1.28.8";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-wjt4ArgKA4ihRtfoAlVS8h1E40kCahj7dR2caY7XFLE=";
+    hash = "sha256-ye0X/uLA4u3rKWazeWr3s0ncxO7uVNvVmiaf25QY61U=";
  };

  propagatedBuildInputs = [
    boto3
+  ] ++ lib.optionals (pythonOlder "3.9") [
    typing-extensions
  ];

@ -33,6 +34,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Type annotations for boto3.s3";
    homepage = "https://github.com/youtype/mypy_boto3_builder";
+    changelog = "https://github.com/youtype/mypy_boto3_builder/releases/tag/${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "oci";
-  version = "2.106.0";
+  version = "2.107.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "oracle";
    repo = "oci-python-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-46+/uxCwAO9E1YBE337lsD3h2jkcBCYM7o3Vzh42tmI=";
+    hash = "sha256-GeZCA5Bg3qSL3VRWh3Dvh9+4+3RgwuRVXR8LM/eKed4=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/para/default.nix
+++ b/pkgs/development/python-modules/para/default.nix
@ -1,8 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , nose
+, pytestCheckHook
 }:

 buildPythonPackage rec {
@ -14,9 +14,10 @@ buildPythonPackage rec {
    hash = "sha256-RsMjKunY6p2IbP0IzdESiSICvthkX0C2JVWXukz+8hc=";
  };

-  nativeCheckInputs = [ pytestCheckHook ];
-
-  checkInputs = [ nose ];
+  nativeCheckInputs = [
+    nose
+    pytestCheckHook
+  ];

  pythonImportsCheck = [ "para" ];

--- a/pkgs/development/python-modules/userpath/default.nix
+++ b/pkgs/development/python-modules/userpath/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "userpath";
-  version = "1.8.0";
+  version = "1.9.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-BCM9L8/lz/kRweT7cYl1VkDhUk/4ekuCq51rh1/uV4c=";
+    hash = "sha256-heMnRUMXRHfGLVcB7UOj7xBRgkqd13aWitxBHlhkDdE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/api-linter/default.nix
+++ b/pkgs/development/tools/api-linter/default.nix
@ -0,0 +1,41 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "api-linter";
+  version = "1.54.1";
+
+  src = fetchFromGitHub {
+    owner = "googleapis";
+    repo = "api-linter";
+    rev = "v${version}";
+    hash = "sha256-Z3VhjBI1WYLs3uEONgbItkqUX8P5ZTZ84B1YC6hPgu8=";
+  };
+
+  vendorHash = "sha256-EXmS3ys5uFY+7vv22+a/82V2RjTaEMas8SFOXwSS9qY=";
+
+  subPackages = [ "cmd/api-linter" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  # reference: https://github.com/googleapis/api-linter/blob/v1.54.1/.github/workflows/release.yaml#L76
+  preBuild = ''
+    cat > cmd/api-linter/version.go <<EOF
+    package main
+    const version = "${version}"
+    EOF
+  '';
+
+  meta = with lib; {
+    description = "Linter for APIs defined in protocol buffers";
+    homepage = "https://github.com/googleapis/api-linter/";
+    changelog = "https://github.com/googleapis/api-linter/releases/tag/${src.rev}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ xrelkd ];
+  };
+}
--- a/pkgs/development/tools/build-managers/alire/default.nix
+++ b/pkgs/development/tools/build-managers/alire/default.nix
@ -0,0 +1,50 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, gprbuild
+, gnat
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "alire";
+  version = "1.2.2";
+
+  src = fetchFromGitHub {
+    owner = "alire-project";
+    repo = "alire";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-rwNiSXOIIQR1I8wwp1ROVOfEChT6SCa5c6XnTRqekDc=";
+
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ gprbuild gnat ];
+
+  # on HEAD (roughly 2c4e5a3), alire provides a dev/build.sh script. for now,
+  # just use gprbuild.
+  buildPhase = ''
+    runHook preBuild
+
+    gprbuild -j$NIX_BUILD_CORES -P alr_env
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r ./bin $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A source-based package manager for the Ada and SPARK programming languages";
+    homepage = "https://alire.ada.dev";
+    changelog = "https://github.com/alire-project/alire/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ atalii ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/development/tools/electron/binary/default.nix
+++ b/pkgs/development/tools/electron/binary/default.nix
@ -151,39 +151,39 @@ rec {
    headers = "0zvwd3gz5y3yq5jgkswnarv75j05lfaz58w37fidq5aib1hi50hn";
  };

-  electron_22-bin = mkElectron "22.3.15" {
-    armv7l-linux = "b1df49670162f4333e320e39626f50aeae8a0a44a4fd7c68ecddce997f7ac369";
-    aarch64-linux = "4e1e1ca892d7812b2bfead0757f448549907a60204f7ff275e6b912a7d7691f9";
-    x86_64-linux = "4c8a12045a7d49488a404a7e09f2fdd342a2755fe8300f3c709715a043d8944c";
-    x86_64-darwin = "5eb5eb0cc4e0253a3e5bbe0f054040b5b9ba8eb0761ff51f74a8a462a3c81f63";
-    aarch64-darwin = "1f047a4a136761d93c2ed9080dc8000aa7d48d0dbd7cd001c72834650a6d8511";
-    headers = "106j087n4z8w8y749hdi4zyc7x7a0dzhw2jmk937frm9qzivjzb1";
+  electron_22-bin = mkElectron "22.3.18" {
+    armv7l-linux = "109cd957e64c728bd1b921385250d413c9546c7ba44d191a9e6a62ea39eb093b";
+    aarch64-linux = "4857d182cffb853b0c85c96e4e99d20316f95068398b7ac5424641e1f2263465";
+    x86_64-linux = "8b65f6c6b960dd6bc52acbb0fc54f232dfa8a9d6ed0e1504ee6baf346c90598b";
+    x86_64-darwin = "d3ecd733a174b8fd16927285f9e9f3a5d401c29578619a6c12aec5c3845d0d51";
+    aarch64-darwin = "a11c41f2b1e740e77fccc1e2e299e89f370cd8153420976c1b16628733969af4";
+    headers = "0h1d2l8wq10myaxa5xjnrnyjrjm7qlj9r4g3nldcqmsy4w468v66";
  };

-  electron_23-bin = mkElectron "23.3.9" {
-    armv7l-linux = "ad1a0c91cdb22371bf9ff99f6d407106ac8298517904de84875ce84cc690086a";
-    aarch64-linux = "8d4ba11d1342898e2b7fea24e0053bc2ec81ab62ae2373ca5a458c8c482899b1";
-    x86_64-linux = "10479bacbba8af4a5ff34c856017b5afb6e27bd806014d6632f552659118a833";
-    x86_64-darwin = "e377786bbc647aa9c3cc0015225e58356e4319b3293438f5930c0b99a84cd190";
-    aarch64-darwin = "12f8ee8fe4aabf98c37cecf48d55126b66704304a56239dd9442dc0d1c21d54b";
-    headers = "0j47gh1f89znkvz9hssl043a6bzcmqy6xapvw0ysw4w9my5zaf07";
+  electron_23-bin = mkElectron "23.3.10" {
+    armv7l-linux = "dd5e4395b3851c5561058980c883c1cb5871caae521efbd53a356de7e8e58a81";
+    aarch64-linux = "be0e65b0920f7d6c2d6efbcf1a5bcfde3e677e28a9f743d003b5089b48fdbe7f";
+    x86_64-linux = "b8f1a743ae5e9e3cc42b00c77eb91343e289a4d2d77d922cc719963ac4629475";
+    x86_64-darwin = "6a8cb24879677d7997d1cba018e9630dc561d6646d79c7f282a747c85b17df7e";
+    aarch64-darwin = "f2157e56f2e94c5a6bb8a5727674fb7e3f42c6ab155f9fdc00e7dacc7df20df7";
+    headers = "04118gdcbnrw5np6r74ysqwfcn1kr5xvjm25jndmnzz8cspch6zq";
  };

-  electron_24-bin = mkElectron "24.6.1" {
-    armv7l-linux = "0e2fe8e8e97dd34809a63a5e3bc1d4ade6ba32a55bd90e5826b85970d983d314";
-    aarch64-linux = "8c17efd4f5d578f6c93ea363fd4ff6e33c03bec298826be0fc32689ddef4c161";
-    x86_64-linux = "c997469cb935fbe2e4cffe71769358375e69583d757eb2e19fae0ffc125bcac8";
-    x86_64-darwin = "dfc3a2c003a81bc7b16ee3d677430d19d6a82894672a58f1622fed32590a9751";
-    aarch64-darwin = "7f2be8bbab8d4990dd86387b98b44d1df6648988ad7835ce4d5fd592f8db1139";
-    headers = "0wc7q2vdyc22xmi4z3mxbihd6zcrh7hv3silygb4r7j8f25109l9";
+  electron_24-bin = mkElectron "24.6.4" {
+    armv7l-linux = "60a5d3936d86d78b166f0f62fc5de5de6f3250d2ae630886da297e30d2040eb4";
+    aarch64-linux = "d50662a111e72c71596f614cd022ebe928dc2eea6d5060cb8313b19862abe080";
+    x86_64-linux = "c211f38a7e5e46371a358f1db67b927fe340f8478a5fff306c4acc0ffce840f8";
+    x86_64-darwin = "17293a5148c511cd92a6b08872801bd90de01888251a7b99085818511770fc47";
+    aarch64-darwin = "61696d191710e053a1afccb4cd5ee851ad723c90929f0058b8221d1c840a316a";
+    headers = "0nwwrxsrlx6spi1nwnvi6fy451sk38zxvnwkls4c4i9f6nrfsd4f";
  };

-  electron_25-bin = mkElectron "25.2.0" {
-    armv7l-linux = "ec15f85ef5bf1a8cafdd5bbe5ceb229a1c6b2f91e42bd7482500921114413341";
-    aarch64-linux = "e58ff2c4484e80bc6253969036e772bfed8d822d66215ff68e84846cbd14c4a0";
-    x86_64-linux = "4fb341f1cbe7ef38c1eb3463919bfb515b54875f835f28ce0d8ff9119802a025";
-    x86_64-darwin = "21f69f236d89dc86ca63f24fa6b7a7ef825862250ad83d6f09973615b10360b6";
-    aarch64-darwin = "50060b0cf8cd2e8180a1bea2c94bc9988ee66cfe065abe2b42cb999707b1b3ba";
-    headers = "0fwxypcj8wav16r0fhfm8sdly94vsl8w8yg5xy892z6b3bd9x4s3";
+  electron_25-bin = mkElectron "25.3.1" {
+    armv7l-linux = "6c837332b63a973304b1eaf769bd4054ee972f4b8a74832053715959e1555a15";
+    aarch64-linux = "2ae9fd05ffe59d59586d9e8afdbb45381971d964527123506ae08e2411872b4d";
+    x86_64-linux = "36f139c779ae0c0abc7227e9e3d65f34b8dfc3a0e4d40beb18bdf31750d4ca74";
+    x86_64-darwin = "66c86c8651c4699b069fde53d5fcbf8887a2573c27e3eefc655462b27c047d07";
+    aarch64-darwin = "1cc5e9b6451757ada1c07130b9454164d4206cf92595708fb6fc9ebff030f860";
+    headers = "1vb767l9b2vgx9f03xb3iw2msli4lkswy49qc0zzdaym89b7ykrz";
  };
 }
--- a/pkgs/development/tools/language-servers/lua-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/lua-language-server/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ninja, makeWrapper, CoreFoundation, Foundation }:
+{ lib, stdenv, fetchFromGitHub, ninja, makeWrapper, CoreFoundation, Foundation, ditto }:

 stdenv.mkDerivation rec {
  pname = "lua-language-server";
@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
  buildInputs = lib.optionals stdenv.isDarwin [
    CoreFoundation
    Foundation
+    ditto
  ];

  postPatch = ''
--- a/pkgs/development/tools/ruff/Cargo.lock
+++ b/pkgs/development/tools/ruff/Cargo.lock
@ -734,7 +734,7 @@ dependencies = [

 [[package]]
 name = "flake8-to-ruff"
-version = "0.0.279"
+version = "0.0.280"
 dependencies = [
 "anyhow",
 "clap",
@ -1888,7 +1888,7 @@ dependencies = [

 [[package]]
 name = "ruff"
-version = "0.0.279"
+version = "0.0.280"
 dependencies = [
 "annotate-snippets 0.9.1",
 "anyhow",
@ -1988,7 +1988,7 @@ dependencies = [

 [[package]]
 name = "ruff_cli"
-version = "0.0.279"
+version = "0.0.280"
 dependencies = [
 "annotate-snippets 0.9.1",
 "anyhow",
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@ -10,13 +10,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "ruff";
-  version = "0.0.279";
+  version = "0.0.280";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-7f/caaCbYt+Uatd12gATSJgs5Nx/X7YZhXEESl5OtWE=";
+    hash = "sha256-Pp/yurRPUHqrCD3V93z5EGMYf4IyLFQOL9d2sNe3TKs=";
  };

  cargoLock = {
--- a/pkgs/development/tools/rust/cargo-cyclonedx/default.nix
+++ b/pkgs/development/tools/rust/cargo-cyclonedx/default.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-cyclonedx";
-  version = "0.3.7";
+  version = "0.3.8";

  src = fetchFromGitHub {
    owner = "CycloneDX";
    repo = "cyclonedx-rust-cargo";
    rev = "${pname}-${version}";
-    hash = "sha256-xr3YNjQp+XhIWIqJ1rPUyM9mbtWGExlFEj28/SB8vfE=";
+    hash = "sha256-6XW8aCXepbVnTubbM4sfRIC87uYSCEbuj+jJcPayEEU=";
  };

-  cargoHash = "sha256-NsBY+wb4IAlKOMh5BMvT734z//Wp/s0zimm04v8pqyc=";
+  cargoHash = "sha256-BG/vfa5L6Iibfon3A5TP8/K8jbJsWqc+axdvIXc7GmM=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/development/tools/rust/cargo-info/default.nix
+++ b/pkgs/development/tools/rust/cargo-info/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-info";
-  version = "0.7.3";
+  version = "0.7.6";

  src = fetchFromGitLab {
    owner = "imp";
    repo = "cargo-info";
    rev = version;
-    hash = "sha256-m8YytirD9JBwssZFO6oQ9TGqjqvu1GxHN3z8WKLiKd4=";
+    hash = "sha256-02Zkp7Vc1M5iZsG4iJL30S73T2HHg3lqrPJ9mW3FOuk=";
  };

-  cargoHash = "sha256-gI/DGPCVEi4Mg9nYLaPpeqpV7LBbxoLP0ditU6hPS1w=";
+  cargoHash = "sha256-zp7qklME28HNGomAcQgrEi7W6zQ1QCJc4FjxtnKySUE=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.1.56";
+  version = "0.1.62";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-Megf4kQ17rwvHKlREzEw7YIibtl/wol0U5bVvPuwxxI=";
+    hash = "sha256-/IIHe3OG/r/cZ4PaYZazv/aPBzyxNBCWbgkzFbJMpvc=";
  };

-  vendorHash = "sha256-EI1cyLCiUEkit80gh0BV6Ti8CX8KYuIqz2od7LDLTXg=";
+  vendorHash = "sha256-bjlNwhhhvwrw5GtWO8+1HV2IauqexKSb+O9WGX06qGA=";

  subPackages = [ "." ];

@ -25,6 +25,8 @@ buildGoModule rec {

  nativeBuildInputs = [ installShellFiles ];

+  patches = [ ./disable-auto-update.patch ];
+
  preBuild = ''
    go generate ./...
  '';
--- a/pkgs/development/web/flyctl/disable-auto-update.patch
+++ b/pkgs/development/web/flyctl/disable-auto-update.patch
@ -0,0 +1,25 @@
+From 9c76dbff982b0fd8beaffae42a6e98bc1e67f089 Mon Sep 17 00:00:00 2001
+From: Gabriel Simmer <g@gmem.ca>
+Date: Fri, 21 Jul 2023 08:16:52 +0100
+Subject: [PATCH] Disable auto update
+
+---
+ internal/config/config.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/internal/config/config.go b/internal/config/config.go
+index 1914f8e0..958baf27 100644
+--- a/internal/config/config.go
+++ b/internal/config/config.go
+@@ -141,7 +141,7 @@ func (cfg *Config) ApplyFile(path string) (err error) {
+ 		AutoUpdate   bool   `yaml:"auto_update"`
+ 	}
+ 	w.SendMetrics = true
+-	w.AutoUpdate = true
+	w.AutoUpdate = false
+ 
+ 	if err = unmarshal(path, &w); err == nil {
+ 		cfg.AccessToken = w.AccessToken
+-- 
+2.41.0
+
--- a/pkgs/misc/wiki-tui/default.nix
+++ b/pkgs/misc/wiki-tui/default.nix
@ -10,13 +10,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "wiki-tui";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "Builditluc";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-vrWjX8WB9niZnBDIlMSj/NUuJxCkP4QoOLp+xTnvSjs=";
+    hash = "sha256-WEB6tzHeP7fX+KyNOqAADKHT6IE1t8af889XcHH/48Q=";
  };

  nativeBuildInputs = [
@ -30,7 +30,7 @@ rustPlatform.buildRustPackage rec {
    Security
  ];

-  cargoHash = "sha256-m3gxmoZVEVzqach7Oep943B4DhOUzrTB+Z6J/TvdCQ8=";
+  cargoHash = "sha256-pLAUwkn4w/vwg/znBtjxc+og2yJn5uABY3Au9AYkpM4=";

  meta = with lib; {
    description = "A simple and easy to use Wikipedia Text User Interface";
--- a/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix
@ -0,0 +1,98 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bootBash
+, gnumake
+, gnused
+, gnugrep
+, gnutar
+, gawk
+, gzip
+, gcc
+, glibc
+, binutils
+, linux-headers
+, derivationWithMeta
+, bash
+, coreutils
+}:
+let
+  pname = "bash";
+  version = "5.2.15";
+
+  src = fetchurl {
+    url = "mirror://gnu/bash/bash-${version}.tar.gz";
+    sha256 = "132qng0jy600mv1fs95ylnlisx2wavkkgpb19c6kmz7lnmjhjwhk";
+  };
+in
+bootBash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gnutar
+    gawk
+    gzip
+  ];
+
+  passthru.runCommand = name: env: buildCommand:
+    derivationWithMeta ({
+      inherit name buildCommand;
+      builder = "${bash}/bin/bash";
+      args = [
+        "-e"
+        (builtins.toFile "bash-builder.sh" ''
+          export CONFIG_SHELL=$SHELL
+          bash -eux $buildCommandPath
+        '')
+      ];
+      passAsFile = [ "buildCommand" ];
+
+      SHELL = "${bash}/bin/bash";
+      PATH = lib.makeBinPath ((env.nativeBuildInputs or []) ++ [
+        bash
+        coreutils
+      ]);
+    } // (builtins.removeAttrs env [ "nativeBuildInputs" ]));
+
+  passthru.tests.get-version = result:
+    bootBash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/bash --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU Bourne-Again Shell, the de facto standard shell on Linux";
+    homepage = "https://www.gnu.org/software/bash";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd bash-${version}
+
+  # Configure
+  export CC="gcc -I${glibc}/include -I${linux-headers}/include"
+  export LIBRARY_PATH="${glibc}/lib"
+  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  export ac_cv_func_dlopen=no
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-nls \
+    --disable-net-redirections
+
+  # Build
+  make SHELL=bash
+
+  # Install
+  make install
+''
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@ -15,6 +15,12 @@ lib.makeScope

    bash_2_05 = callPackage ./bash/2.nix { tinycc = tinycc-mes; };

+    bash = callPackage ./bash {
+      bootBash = bash_2_05;
+      gcc = gcc2;
+      glibc = glibc22;
+    };
+
    binutils = callPackage ./binutils {
      bash = bash_2_05;
      gcc = gcc2;
@ -36,9 +42,16 @@ lib.makeScope

    coreutils = callPackage ./coreutils { tinycc = tinycc-mes; };

+    diffutils = callPackage ./diffutils {
+      bash = bash_2_05;
+      gcc = gcc2;
+      glibc = glibc22;
+    };
+
    gawk = callPackage ./gawk {
      bash = bash_2_05;
      tinycc = tinycc-mes;
+      gnused = gnused-mes;
    };

    gcc2 = callPackage ./gcc/2.nix {
@ -56,6 +69,7 @@ lib.makeScope

    inherit (callPackage ./glibc {
      bash = bash_2_05;
+      gnused = gnused-mes;
    }) glibc22;

    gnugrep = callPackage ./gnugrep {
@ -68,18 +82,27 @@ lib.makeScope
    gnupatch = callPackage ./gnupatch { tinycc = tinycc-mes; };

    gnused = callPackage ./gnused {
+      bash = bash_2_05;
+      gcc = gcc2;
+      glibc = glibc22;
+      gnused = gnused-mes;
+    };
+    gnused-mes = callPackage ./gnused {
      bash = bash_2_05;
      tinycc = tinycc-mes;
+      mesBootstrap = true;
    };

    gnutar = callPackage ./gnutar {
      bash = bash_2_05;
      tinycc = tinycc-mes;
+      gnused = gnused-mes;
    };

    gzip = callPackage ./gzip {
      bash = bash_2_05;
      tinycc = tinycc-mes;
+      gnused = gnused-mes;
    };

    heirloom = callPackage ./heirloom {
@ -112,15 +135,18 @@ lib.makeScope
    inherit (callPackage ./utils.nix { }) derivationWithMeta writeTextFile writeText;

    test = kaem.runCommand "minimal-bootstrap-test" {} ''
+      echo ${bash.tests.get-version}
      echo ${bash_2_05.tests.get-version}
      echo ${binutils.tests.get-version}
      echo ${binutils-mes.tests.get-version}
      echo ${bzip2.tests.get-version}
+      echo ${diffutils.tests.get-version}
      echo ${gawk.tests.get-version}
      echo ${gcc2.tests.get-version}
      echo ${gcc2-mes.tests.get-version}
      echo ${gnugrep.tests.get-version}
      echo ${gnused.tests.get-version}
+      echo ${gnused-mes.tests.get-version}
      echo ${gnutar.tests.get-version}
      echo ${gzip.tests.get-version}
      echo ${heirloom.tests.get-version}
--- a/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix
@ -0,0 +1,72 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gcc
+, glibc
+, binutils
+, linux-headers
+, gnumake
+, gnugrep
+, gnused
+, gawk
+, gnutar
+, gzip
+}:
+let
+  pname = "diffutils";
+  version = "2.8.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/diffutils/diffutils-${version}.tar.gz";
+    sha256 = "0nizs9r76aiymzasmj1jngl7s71jfzl9xfziigcls8k9n141f065";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/diff --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "Commands for showing the differences between files (diff, cmp, etc.)";
+    homepage = "https://www.gnu.org/software/diffutils/diffutils.html";
+    license = licenses.gpl3Only;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd diffutils-${version}
+
+  # Configure
+  export C_INCLUDE_PATH="${glibc}/include:${linux-headers}/include"
+  export LIBRARY_PATH="${glibc}/lib"
+  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config}
+
+  # Build
+  make
+
+  # Install
+  make install
+''
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/2.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/2.nix
@ -131,8 +131,8 @@ bash.runCommand "${pname}-${version}" {
  ${lib.optionalString mesBootstrap "ar x ${tinycc.libs}/lib/libtcc1.a"}
  ar r $out/lib/gcc-lib/${hostPlatform.config}/${version}/libgcc.a *.o
  cd ..
+  cp gcc/libgcc2.a $out/lib/libgcc2.a
  ${lib.optionalString mesBootstrap ''
-    cp gcc/libgcc2.a $out/lib/libgcc2.a
    ar x ${tinycc.libs}/lib/libtcc1.a
    ar x ${tinycc.libs}/lib/libc.a
    ar r $out/lib/gcc-lib/${hostPlatform.config}/${version}/libc.a libc.o libtcc1.o
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
@ -1,11 +1,16 @@
 { lib
+, buildPlatform
+, hostPlatform
 , fetchurl
 , bash
-, tinycc
 , gnumake
+, mesBootstrap ? false, tinycc ? null
+, gcc ? null, glibc ? null, binutils ? null, gnused ? null, linux-headers, gnugrep
 }:
+assert mesBootstrap -> tinycc != null;
+assert !mesBootstrap -> gcc != null && glibc != null && binutils != null && gnused != null;
 let
-  pname = "gnused";
+  pname = "gnused" + lib.optionalString mesBootstrap "-mes";
  # last version that can be compiled with mes-libc
  version = "4.0.9";

@ -25,8 +30,15 @@ bash.runCommand "${pname}-${version}" {
  inherit pname version;

  nativeBuildInputs = [
-    tinycc.compiler
    gnumake
+  ] ++ lib.optionals mesBootstrap [
+    tinycc.compiler
+  ] ++ lib.optionals (!mesBootstrap) [
+    gcc
+    glibc
+    binutils
+    gnused
+    gnugrep
  ];

  passthru.tests.get-version = result:
@ -43,13 +55,14 @@ bash.runCommand "${pname}-${version}" {
    mainProgram = "sed";
    platforms = platforms.unix;
  };
-} ''
+} (''
  # Unpack
  ungz --file ${src} --output sed.tar
  untar --file sed.tar
  rm sed.tar
  cd sed-${version}

+'' + lib.optionalString mesBootstrap ''
  # Configure
  cp ${makefile} Makefile
  catm config.h
@ -59,6 +72,25 @@ bash.runCommand "${pname}-${version}" {
    CC="tcc -B ${tinycc.libs}/lib" \
    LIBC=mes

+'' + lib.optionalString (!mesBootstrap) ''
+  # Configure
+  export CC="gcc -I${glibc}/include -I${linux-headers}/include"
+  export LIBRARY_PATH="${glibc}/lib"
+  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  chmod +x configure
+  ./configure \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-shared \
+    --disable-nls \
+    --disable-dependency-tracking \
+    --without-included-regex \
+    --prefix=$out
+
+  # Build
+  make
+
+'' + ''
  # Install
  make install PREFIX=$out
-''
+'')
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@ -16,13 +16,13 @@

 buildGoModule rec {
  pname = "evcc";
-  version = "0.118.8";
+  version = "0.118.9";

  src = fetchFromGitHub {
    owner = "evcc-io";
    repo = pname;
    rev = version;
-    hash = "sha256-VEXmPqvWAXS39USXqJi8wWsqFa3HphB6zYgFeMA9s2g=";
+    hash = "sha256-y92kxFCKsLZmLVvgTjYsIVo8qVA/QRMGSChMtY8Go2g=";
  };

  vendorHash = "sha256-0NTOit1nhX/zxQjHwU7ZOY1GsoIu959/KICCEWyfIQ4=";
--- a/pkgs/servers/http/trafficserver/default.nix
+++ b/pkgs/servers/http/trafficserver/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchzip
-, fetchpatch
 , makeWrapper
 , nixosTests
 , pkg-config
@ -50,22 +49,13 @@

 stdenv.mkDerivation rec {
  pname = "trafficserver";
-  version = "9.1.4";
+  version = "9.2.1";

  src = fetchzip {
    url = "mirror://apache/trafficserver/trafficserver-${version}.tar.bz2";
-    sha256 = "sha256-+iq+z+1JE6JE6OLcUwRRAe2/EISqb6Ax6pNm8GcB7bc=";
+    hash = "sha256-Uq6CmbEJfN8ajpVmIutkDy2b8fZcT4wtprcWbMkaNkQ=";
  };

-  patches = [
-    # Adds support for NixOS
-    # https://github.com/apache/trafficserver/pull/7697
-    (fetchpatch {
-      url = "https://github.com/apache/trafficserver/commit/19d3af481cf74c91fbf713fc9d2f8b138ed5fbaf.diff";
-      sha256 = "0z1ikgpp00rzrrcqh97931586yn9wbksgai9xlkcjd5cg8gq0150";
-    })
-  ];
-
  # NOTE: The upstream README indicates that flex is needed for some features,
  # but it actually seems to be unnecessary as of this commit[1]. The detection
  # logic for bison and flex is still present in the build script[2], but no
--- a/pkgs/servers/metabase/default.nix
+++ b/pkgs/servers/metabase/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "metabase";
-  version = "0.46.6";
+  version = "0.46.6.1";

  src = fetchurl {
    url = "https://downloads.metabase.com/v${version}/metabase.jar";
-    hash = "sha256-hREGkZDlTQjN012/iTM8IDHrW722N+4gVGtsVH6R5ko=";
+    hash = "sha256-EtJnv1FaI4lEu2X87tHvg/WuY0UcEa1bf3rb6vYS5cY=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/servers/monitoring/prometheus/node-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/node-exporter.nix
@ -5,14 +5,14 @@

 buildGoModule rec {
  pname = "node_exporter";
-  version = "1.6.0";
+  version = "1.6.1";
  rev = "v${version}";

  src = fetchFromGitHub {
    inherit rev;
    owner = "prometheus";
    repo = "node_exporter";
-    sha256 = "sha256-Aw1tdaiyr3wv3Ti3CFn2T80WRjEZaACwotKKJGY9I6Y=";
+    sha256 = "sha256-BCZLMSJP/63N+pZsK8er87Zem7IFGdkyruDs6UVDZSM=";
  };

  vendorHash = "sha256-hn2cMKhLl5qsm4sZErs6PXTs8yajowxw9a9vtHe5cAk=";
@ -39,6 +39,7 @@ buildGoModule rec {
  meta = with lib; {
    description = "Prometheus exporter for machine metrics";
    homepage = "https://github.com/prometheus/node_exporter";
+    changelog = "https://github.com/prometheus/node_exporter/blob/v${version}/CHANGELOG.md";
    license = licenses.asl20;
    maintainers = with maintainers; [ benley fpletz globin Frostman ];
  };
--- a/pkgs/tools/admin/azure-cli/default.nix
+++ b/pkgs/tools/admin/azure-cli/default.nix
@ -1,7 +1,7 @@
 { stdenv, lib, python3, fetchPypi, fetchFromGitHub, installShellFiles }:

 let
-  version = "2.49.0";
+  version = "2.50.0";
  srcName = "azure-cli-${version}-src";

  src = fetchFromGitHub {
@ -9,7 +9,7 @@ let
    owner = "Azure";
    repo = "azure-cli";
    rev = "azure-cli-${version}";
-    hash = "sha256-4R89RD4mDdhLdpgHQ8QT48cX+GzTLrSYPCwg0xWM8Ss=";
+    hash = "sha256-eKE/jdS5/PshCxn/4NXuW5rHh7jBsv2VQSWM3cjLHRw=";
  };

  # put packages that needs to be overridden in the py package scope
@ -270,7 +270,7 @@ py.pkgs.toPythonApplication (py.pkgs.buildAzureCliPackage {
    homepage = "https://github.com/Azure/azure-cli";
    description = "Next generation multi-platform command line experience for Azure";
    license = licenses.mit;
-    maintainers = with maintainers; [ jonringer ];
+    maintainers = with maintainers; [ akechishiro jonringer ];
  };
 })

--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@ -65,6 +65,7 @@ let
            --replace "requests[socks]~=2.25.1" "requests[socks]~=2.25" \
            --replace "cryptography>=3.2,<3.4" "cryptography" \
            --replace "msal-extensions>=0.3.1,<0.4" "msal-extensions" \
+            --replace "msal[broker]==1.22.0" "msal[broker]" \
            --replace "packaging>=20.9,<22.0" "packaging"
        '';
        nativeCheckInputs = with self; [ pytest ];
@ -117,8 +118,8 @@ let
      azure-data-tables = overrideAzureMgmtPackage super.azure-data-tables "12.4.0" "zip"
        "sha256-3V/I3pHi+JCO+kxkyn9jz4OzBoqbpCYpjeO1QTnpZlw=";

-      azure-mgmt-apimanagement = overrideAzureMgmtPackage super.azure-mgmt-apimanagement "3.0.0" "zip"
-        "sha256-kmL1TtOH6wg9ja5m0yqN81ZHMZuQK9SYzcN29QoS0VQ=";
+      azure-mgmt-apimanagement = overrideAzureMgmtPackage super.azure-mgmt-apimanagement "4.0.0" "zip"
+        "sha256-AiTjLJ28g80xnrRFLfPUevJgeaxLpuGmvkd3+FskNiw=";

      azure-mgmt-batch = overrideAzureMgmtPackage super.azure-mgmt-batch "17.0.0" "zip"
        "sha256-hkM4WVLuwxj4qgXsY8Ya7zu7/v37gKdP0Xbf2EqrsWo=";
@ -138,11 +139,11 @@ let
      azure-mgmt-policyinsights = overrideAzureMgmtPackage super.azure-mgmt-policyinsights "1.1.0b2" "zip"
        "sha256-e+I5MdbbX7WhxHCj1Ery3z2WUrJtpWGD1bhLbqReb58=";

-      azure-mgmt-rdbms = overrideAzureMgmtPackage super.azure-mgmt-rdbms "10.2.0b8" "zip"
-        "sha256-OyA0O10UMx8BKUvxTQU6/eZupuKoxFQk2kvd/qINjFU=";
+      azure-mgmt-rdbms = overrideAzureMgmtPackage super.azure-mgmt-rdbms "10.2.0b10" "zip"
+        "sha256-sM8oZdhv+5WCd4RnMtEmCikTBmzGsap5heKzSbHbRPI=";

-      azure-mgmt-recoveryservices = overrideAzureMgmtPackage super.azure-mgmt-recoveryservices "2.2.0" "zip"
-        "sha256-2rU5Mc5tcSHEaej4LeiJ/WwWjk3fZFdd7MIwqmHgRss=";
+      azure-mgmt-recoveryservices = overrideAzureMgmtPackage super.azure-mgmt-recoveryservices "2.4.0" "zip"
+        "sha256-2JeOvtNxx6Z3AY4GI9fBRKbMcYVHsbrhk8C+5t5eelk=";

      azure-mgmt-recoveryservicesbackup = overrideAzureMgmtPackage super.azure-mgmt-recoveryservicesbackup "6.0.0" "zip"
        "sha256-lIEYi/jvF9pYbnH+clUzfU0fExlY+dZojIyZRtTLQh8=";
@ -162,8 +163,8 @@ let
      azure-mgmt-containerinstance = overrideAzureMgmtPackage super.azure-mgmt-containerinstance "10.1.0" "zip"
        "sha256-eNQ3rbKFdPRIyDjtXwH5ztN4GWCYBh3rWdn3AxcEwX4=";

-      azure-mgmt-containerservice = overrideAzureMgmtPackage super.azure-mgmt-containerservice "23.0.0" "zip"
-      "sha256-V8IUTQvbUSOpsqkGfBqLo4DVIB7fryYMVx6WpfWzOnc=";
+      azure-mgmt-containerservice = overrideAzureMgmtPackage super.azure-mgmt-containerservice "24.0.0" "zip"
+      "sha256-sUp3LDVsc1DmVf4HdaXGSDeEvmAE2weSHHTxL/BwRk8=";

      azure-mgmt-cosmosdb = overrideAzureMgmtPackage super.azure-mgmt-cosmosdb "9.2.0" "zip"
        "sha256-PAaBkR77Ho2YI5I+lmazR/8vxEZWpbvM427yRu1ET0k=";
@ -272,8 +273,8 @@ let
      azure-mgmt-eventhub = overrideAzureMgmtPackage super.azure-mgmt-eventhub "10.1.0" "zip"
        "sha256-MZqhSBkwypvEefhoEWEPsBUFidWYD7qAX6edcBDDSSA=";

-      azure-mgmt-keyvault = overrideAzureMgmtPackage super.azure-mgmt-keyvault "10.2.0" "zip"
-        "sha256-QZbbdvgCbPleZnPpYTZI/Cgmeus8Kb5uyXuobnf6Ox4=";
+      azure-mgmt-keyvault = overrideAzureMgmtPackage super.azure-mgmt-keyvault "10.2.2" "zip"
+        "sha256-LG6oMTZepgT87KdJrwCpc4ZYEclUsEAHUitZrxFCkL4=";

      azure-mgmt-cdn = overrideAzureMgmtPackage super.azure-mgmt-cdn "12.0.0" "zip"
        "sha256-t8PuIYkjS0r1Gs4pJJJ8X9cz8950imQtbVBABnyMnd0=";
@ -308,8 +309,8 @@ let
      azure-mgmt-hdinsight = overrideAzureMgmtPackage super.azure-mgmt-hdinsight "9.0.0" "zip"
        "sha256-QevcacDR+B0l3TBDjBT/9DMfZmOfVYBbkYuWSer/54o=";

-      azure-multiapi-storage = overrideAzureMgmtPackage super.azure-multiapi-storage "1.1.0" "tar.gz"
-        "sha256-VvNI+mhi2nCFBAXUEL5ph3xj/cBRMf2Mo2uXIgKC+oc=";
+      azure-multiapi-storage = overrideAzureMgmtPackage super.azure-multiapi-storage "1.2.0" "tar.gz"
+        "sha256-CQuoWHeh0EMitTRsvifotrTwpWd/Q9LWWD7jZ2w9r8I=";

      azure-appconfiguration = super.azure-appconfiguration.overrideAttrs(oldAttrs: rec {
        version = "1.1.1";
@ -523,12 +524,12 @@ let
      });

      argcomplete = super.argcomplete.overridePythonAttrs(oldAttrs: rec {
-        version = "2.0.0";
+        version = "3.1.1";

        src = fetchPypi {
          inherit (oldAttrs) pname;
          inherit version;
-          hash = "sha256-Y3KteMidZiA1EBQYriU2aERbORdVz+lOpS8bnSJCWyA=";
+          hash = "sha256-bExWPxTwFECq/6Pq4TRBxdsjV7Xuxjmr58CxUzRiff8=";
        };
      });

@ -553,11 +554,11 @@ let
      });

      azure-mgmt-resource = super.azure-mgmt-resource.overridePythonAttrs(oldAttrs: rec {
-        version = "22.0.0";
+        version = "23.1.0b2";

        src = oldAttrs.src.override {
          inherit version;
-          hash = "sha256-/rXZeeGLUvLP0CO0oKM+VKb3bMaiUtyM117OLGMpjpQ=";
+          hash = "sha256-kMmiKVwjPgmsTIxxxDRNXE41jSTJkemnKhO+P/OcPZI=";
        };
      });
    };
--- a/pkgs/tools/filesystems/s3fs/default.nix
+++ b/pkgs/tools/filesystems/s3fs/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "s3fs-fuse";
-  version = "1.92";
+  version = "1.93";

  src = fetchFromGitHub {
    owner  = "s3fs-fuse";
    repo   = "s3fs-fuse";
    rev    = "v${version}";
-    sha256 = "sha256-CS6lxDIBwhcnEG6XehbyAI4vb72PmwQ7p+gC1bbJEzM=";
+    sha256 = "sha256-7rLHnQlyJDOn/RikOrrEAQ7O+4T+26vNGiTkOgNH75Q=";
  };

  buildInputs = [ curl openssl libxml2 fuse ];
@ -24,7 +24,10 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Mount an S3 bucket as filesystem through FUSE";
-    license = licenses.gpl2;
-    platforms = platforms.linux ++ platforms.darwin;
+    homepage = "https://github.com/s3fs-fuse/s3fs-fuse";
+    changelog = "https://github.com/s3fs-fuse/s3fs-fuse/raw/v${version}/ChangeLog";
+    maintainers = [ ];
+    license = licenses.gpl2Only;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/tools/misc/wit-bindgen/default.nix
+++ b/pkgs/tools/misc/wit-bindgen/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "wit-bindgen";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wit-bindgen";
    rev = "wit-bindgen-cli-${version}";
-    hash = "sha256-NUPCRIBmACWpJALsZmbRQLJ8fpcRyf0nUmNnTyiwKYc=";
+    hash = "sha256-ghWwFjpIOTM6//WQ8WySLzKzy2UlaahUjIxxwYUTQWo=";
  };

-  cargoHash = "sha256-JASKEri9ZtDtkMkhBS3fB4JWg43Le11YJvuvOF76bCo=";
+  cargoHash = "sha256-Ch/S0/ON2HVEGHJ7jDE9k5q9+/2ANtt8uGv3ze60I6M=";

  # Some tests fail because they need network access to install the `wasm32-unknown-unknown` target.
  # However, GitHub Actions ensures a proper build.
--- a/pkgs/tools/networking/curl-impersonate/curl-impersonate-0.5.2-fix-shebangs.patch
+++ b/pkgs/tools/networking/curl-impersonate/curl-impersonate-0.5.2-fix-shebangs.patch
@ -0,0 +1,13 @@
+diff --git a/Makefile.in b/Makefile.in
+index 877c54f..3e39ed1 100644
+--- a/Makefile.in
+++ b/Makefile.in
+@@ -209,6 +209,8 @@ $(NSS_VERSION).tar.gz:
+ 
+ $(nss_static_libs): $(NSS_VERSION).tar.gz
+ 	tar xf $(NSS_VERSION).tar.gz
+	sed -i -e "1s@#!/usr/bin/env bash@#!$$(type -p bash)@" $(NSS_VERSION)/nss/build.sh
+	sed -i -e "s@/usr/bin/env grep@$$(type -p grep)@" $(NSS_VERSION)/nss/coreconf/config.gypi
+ 
+ ifeq ($(host),$(build))
+ 	# Native build, use NSS' build script.
--- a/pkgs/tools/networking/curl-impersonate/default.nix
+++ b/pkgs/tools/networking/curl-impersonate/default.nix
@ -1,27 +1,186 @@
-#TODO: It should be possible to build this from source, but it's currently a lot faster to just package the binaries.
-{ lib, stdenv, fetchzip, zlib, autoPatchelfHook }:
-stdenv.mkDerivation rec {
-  pname = "curl-impersonate-bin";
-  version = "v0.5.3";
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, callPackage
+, buildGoModule
+, installShellFiles
+, symlinkJoin
+, zlib
+, sqlite
+, cmake
+, python3
+, ninja
+, perl
+, autoconf
+, automake
+, libtool
+, darwin
+, cacert
+, unzip
+, go
+, p11-kit
+, nixosTests
+}:

-  src = fetchzip {
-    url = "https://github.com/lwthiker/curl-impersonate/releases/download/${version}/curl-impersonate-${version}.x86_64-linux-gnu.tar.gz";
-    sha256 = "sha256-+cH1swAIadIrWG9anzf0dcW6qyBjcKsUHFWdv75F49g=";
-    stripRoot = false;
+let
+  makeCurlImpersonate = { name, target }: stdenv.mkDerivation rec {
+    pname = "curl-impersonate-${name}";
+    version = "0.5.4";
+
+    src = fetchFromGitHub {
+      owner = "lwthiker";
+      repo = "curl-impersonate";
+      rev = "v${version}";
+      hash = "sha256-LBGWFal2szqgURIBCLB84kHWpdpt5quvBBZu6buGj2A=";
+    };
+
+    patches = [
+      # Fix shebangs in the NSS build script
+      # (can't just patchShebangs since makefile unpacks it)
+      ./curl-impersonate-0.5.2-fix-shebangs.patch
+    ];
+
+    strictDeps = true;
+
+    nativeBuildInputs = lib.optionals stdenv.isDarwin [
+      # Must come first so that it shadows the 'libtool' command but leaves 'libtoolize'
+      darwin.cctools
+    ] ++ [
+      installShellFiles
+      cmake
+      python3
+      python3.pkgs.gyp
+      ninja
+      perl
+      autoconf
+      automake
+      libtool
+      unzip
+      go
+    ];
+
+    buildInputs = [
+      zlib
+      sqlite
+    ];
+
+    configureFlags = [
+      "--with-ca-bundle=${if stdenv.isDarwin then "/etc/ssl/cert.pem" else "/etc/ssl/certs/ca-certificates.crt"}"
+      "--with-ca-path=${cacert}/etc/ssl/certs"
+    ];
+
+    buildFlags = [ "${target}-build" ];
+    checkTarget = "${target}-checkbuild";
+    installTargets = [ "${target}-install" ];
+
+    doCheck = true;
+
+    dontUseCmakeConfigure = true;
+    dontUseNinjaBuild = true;
+    dontUseNinjaInstall = true;
+    dontUseNinjaCheck = true;
+
+    postUnpack = lib.concatStringsSep "\n" (lib.mapAttrsToList (name: dep: "ln -sT ${dep.outPath} source/${name}") (lib.filterAttrs (n: v: v ? outPath) passthru.deps));
+
+    preConfigure = ''
+      export GOCACHE=$TMPDIR/go-cache
+      export GOPATH=$TMPDIR/go
+      export GOPROXY=file://${passthru.boringssl-go-modules}
+      export GOSUMDB=off
+
+      # Need to get value of $out for this flag
+      configureFlagsArray+=("--with-libnssckbi=$out/lib")
+    '';
+
+    postInstall = ''
+      # Remove vestigial *-config script
+      rm $out/bin/curl-impersonate-${name}-config
+
+      # Patch all shebangs of installed scripts
+      patchShebangs $out/bin
+
+      # Build and install completions for each curl binary
+
+      # Patch in correct binary name and alias it to all scripts
+      perl curl-*/scripts/completion.pl --curl $out/bin/curl-impersonate-${name} --shell zsh >$TMPDIR/curl-impersonate-${name}.zsh
+      substituteInPlace $TMPDIR/curl-impersonate-${name}.zsh \
+        --replace \
+          '#compdef curl' \
+          "#compdef curl-impersonate-${name}$(find $out/bin -name 'curl_*' -printf ' %f=curl-impersonate-${name}')"
+
+      perl curl-*/scripts/completion.pl --curl $out/bin/curl-impersonate-${name} --shell fish >$TMPDIR/curl-impersonate-${name}.fish
+      substituteInPlace $TMPDIR/curl-impersonate-${name}.fish \
+        --replace \
+          '--command curl' \
+          "--command curl-impersonate-${name}$(find $out/bin -name 'curl_*' -printf ' --command %f')"
+
+      # Install zsh and fish completions
+      installShellCompletion $TMPDIR/curl-impersonate-${name}.{zsh,fish}
+    '';
+
+    preFixup = let
+      libext = stdenv.hostPlatform.extensions.sharedLibrary;
+    in ''
+      # If libnssckbi.so is needed, link libnssckbi.so without needing nss in closure
+      if grep -F nssckbi $out/lib/libcurl-impersonate-*${libext} &>/dev/null; then
+        # NOTE: "p11-kit-trust" always ends in ".so" even when on darwin
+        ln -s ${p11-kit}/lib/pkcs11/p11-kit-trust.so $out/lib/libnssckbi${libext}
+        ${lib.optionalString stdenv.isLinux "patchelf --add-needed libnssckbi${libext} $out/lib/libcurl-impersonate-*${libext}"}
+      fi
+    '';
+
+    disallowedReferences = [ go ];
+
+    passthru = {
+      deps = callPackage ./deps.nix {};
+
+      boringssl-go-modules = (buildGoModule {
+        inherit (passthru.deps."boringssl.zip") name;
+
+        src = passthru.deps."boringssl.zip";
+        vendorHash = "sha256-ISmRdumckvSu7hBXrjvs5ZApShDiGLdD3T5B0fJ1x2Q=";
+
+        nativeBuildInputs = [ unzip ];
+
+        proxyVendor = true;
+      }).go-modules;
+    };
+
+    meta = with lib; {
+      description = "A special build of curl that can impersonate Chrome & Firefox";
+      homepage = "https://github.com/lwthiker/curl-impersonate";
+      license = with licenses; [ curl mit ];
+      maintainers = with maintainers; [ deliciouslytyped lilyinstarlight ];
+      platforms = platforms.unix;
+      knownVulnerabilities = [
+        "CVE-2023-32001"  # fopen TOCTOU race condition - https://curl.se/docs/CVE-2023-32001.html
+        "CVE-2022-43551"  # HSTS bypass - https://curl.se/docs/CVE-2022-43551.html
+        "CVE-2022-42916"  # HSTS bypass - https://curl.se/docs/CVE-2022-42916.html
+      ];
+    };
  };
+in

-  nativeBuildInputs = [ autoPatchelfHook zlib ];
+symlinkJoin rec {
+  pname = "curl-impersonate";
+  inherit (passthru.curl-impersonate-ff) version meta;

-  installPhase = ''
-    mkdir -p $out/bin
-    cp * $out/bin
-  '';
+  name = "${pname}-${version}";

-  meta = with lib; {
-    description = "curl-impersonate: A special build of curl that can impersonate Chrome & Firefox ";
-    homepage = "https://github.com/lwthiker/curl-impersonate";
-    license = with licenses; [ curl mit ];
-    maintainers = with maintainers; [ deliciouslytyped ];
-    platforms = platforms.linux; #TODO I'm unsure about the restrictions here, feel free to expand the platforms it if it works elsewhere.
+  paths = [
+    passthru.curl-impersonate-ff
+    passthru.curl-impersonate-chrome
+  ];
+
+  passthru = {
+    curl-impersonate-ff = makeCurlImpersonate { name = "ff"; target = "firefox"; };
+    curl-impersonate-chrome = makeCurlImpersonate { name = "chrome"; target = "chrome"; };
+
+    updateScript = ./update.sh;
+
+    inherit (passthru.curl-impersonate-ff) src;
+
+    tests = { inherit (nixosTests) curl-impersonate; };
  };
 }
--- a/pkgs/tools/networking/curl-impersonate/deps.nix
+++ b/pkgs/tools/networking/curl-impersonate/deps.nix
@ -0,0 +1,29 @@
+# Generated by update.sh
+{ fetchurl }:
+
+{
+  "curl-7.84.0.tar.xz" = fetchurl {
+    url = "https://curl.se/download/curl-7.84.0.tar.xz";
+    hash = "sha256-LRGLQ/VHv+W66AbY1HtOWW6lslpsHwgK70n7zYF8Xbg=";
+  };
+
+  "brotli-1.0.9.tar.gz" = fetchurl {
+    url = "https://github.com/google/brotli/archive/refs/tags/v1.0.9.tar.gz";
+    hash = "sha256-+ejYHQQFumbRgVKa9CozVPg4yTkJX/mZMNpqqc32/kY=";
+  };
+
+  "nss-3.87.tar.gz" = fetchurl {
+    url = "https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_87_RTM/src/nss-3.87-with-nspr-4.35.tar.gz";
+    hash = "sha256-63DqC1jc5pqkkOnp/s0TKn1kTh2j1jHhYzdqDcwRoCI=";
+  };
+
+  "boringssl.zip" = fetchurl {
+    url = "https://github.com/google/boringssl/archive/3a667d10e94186fd503966f5638e134fe9fb4080.zip";
+    hash = "sha256-HsDIkd1x5IH49fUF07dJaabMIMsQygW+NI7GneULpA8=";
+  };
+
+  "nghttp2-1.46.0.tar.bz2" = fetchurl {
+    url = "https://github.com/nghttp2/nghttp2/releases/download/v1.46.0/nghttp2-1.46.0.tar.bz2";
+    hash = "sha256-moKXjIcAcbdp8n0riBkct3/clFpRwdaFx/YafhP8Ryk=";
+  };
+}
--- a/pkgs/tools/networking/curl-impersonate/update.sh
+++ b/pkgs/tools/networking/curl-impersonate/update.sh
@ -0,0 +1,91 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p git nix jq coreutils gnugrep gnused curl common-updater-scripts
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel || (printf 'Could not find root of nixpkgs repo\nAre we running from within the nixpkgs git repo?\n' >&2; exit 1))"
+
+stripwhitespace() {
+    sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//'
+}
+
+narhash() {
+    nix --extra-experimental-features nix-command store prefetch-file --json "$1" | jq -r .hash
+}
+
+nixeval() {
+    nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1" | jq -r .
+}
+
+vendorhash() {
+    (nix --extra-experimental-features nix-command build --no-link -f "$nixpkgs" --no-link "$1" 2>&1 >/dev/null | tail -n3 | grep -F got: | cut -d: -f2- | stripwhitespace) 2>/dev/null || true
+}
+
+findpath() {
+    path="$(nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1.meta.position" | jq -r . | cut -d: -f1)"
+    outpath="$(nix --extra-experimental-features nix-command eval --json --impure --expr "builtins.fetchGit \"$nixpkgs\"")"
+
+    if [ -n "$outpath" ]; then
+        path="${path/$(echo "$outpath" | jq -r .)/$nixpkgs}"
+    fi
+
+    echo "$path"
+}
+
+getvar() {
+    echo "$2" | grep -F "$1" | sed -e 's/:=/:/g' | cut -d: -f2- | stripwhitespace
+}
+
+attr="${UPDATE_NIX_ATTR_PATH:-curl-impersonate}"
+version="$(curl -sSL "https://api.github.com/repos/lwthiker/curl-impersonate/releases/latest" | jq -r .tag_name | sed -e 's/^v//')"
+
+pkgpath="$(findpath "$attr")"
+
+updated="$(cd "$nixpkgs" && update-source-version "$attr" "$version" --file="$pkgpath" --print-changes | jq -r length)"
+
+if [ "$updated" -eq 0 ]; then
+    echo 'update.sh: Package version not updated, nothing to do.'
+    exit 0
+fi
+
+vars="$(curl -sSL "https://github.com/lwthiker/curl-impersonate/raw/v$version/Makefile.in" | grep '^ *[^ ]*_\(VERSION\|URL\|COMMIT\) *:=')"
+
+cat >"$(dirname "$pkgpath")"/deps.nix <<EOF
+# Generated by update.sh
+{ fetchurl }:
+
+{
+  "$(getvar CURL_VERSION "$vars").tar.xz" = fetchurl {
+    url = "https://curl.se/download/$(getvar CURL_VERSION "$vars").tar.xz";
+    hash = "$(narhash "https://curl.se/download/$(getvar CURL_VERSION "$vars").tar.xz")";
+  };
+
+  "brotli-$(getvar BROTLI_VERSION "$vars").tar.gz" = fetchurl {
+    url = "https://github.com/google/brotli/archive/refs/tags/v$(getvar BROTLI_VERSION "$vars").tar.gz";
+    hash = "$(narhash "https://github.com/google/brotli/archive/refs/tags/v$(getvar BROTLI_VERSION "$vars").tar.gz")";
+  };
+
+  "$(getvar NSS_VERSION "$vars").tar.gz" = fetchurl {
+    url = "$(getvar NSS_URL "$vars")";
+    hash = "$(narhash "$(getvar NSS_URL "$vars")")";
+  };
+
+  "boringssl.zip" = fetchurl {
+    url = "https://github.com/google/boringssl/archive/$(getvar BORING_SSL_COMMIT "$vars").zip";
+    hash = "$(narhash "https://github.com/google/boringssl/archive/$(getvar BORING_SSL_COMMIT "$vars").zip")";
+  };
+
+  "$(getvar NGHTTP2_VERSION "$vars").tar.bz2" = fetchurl {
+    url = "$(getvar NGHTTP2_URL "$vars")";
+    hash = "$(narhash "$(getvar NGHTTP2_URL "$vars")")";
+  };
+}
+EOF
+
+curhash="$(nixeval "$attr.curl-impersonate-chrome.boringssl-go-modules.outputHash")"
+newhash="$(vendorhash "$attr.curl-impersonate-chrome.boringssl-go-modules")"
+
+if [ -n "$newhash" ] && [ "$curhash" != "$newhash" ]; then
+    sed -i -e "s|\"$curhash\"|\"$newhash\"|" "$pkgpath"
+else
+    echo 'update.sh: New vendorHash same as old vendorHash, nothing to do.'
+fi
--- a/pkgs/tools/networking/i2p/default.nix
+++ b/pkgs/tools/networking/i2p/default.nix
@ -13,7 +13,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "i2p";
-  version = "2.2.1";
+  version = "2.3.0";

  src = fetchurl {
    urls = map (mirror: "${mirror}/${finalAttrs.version}/i2psource_${finalAttrs.version}.tar.bz2") [
@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
      "https://files.i2p-projekt.de"
      "https://download.i2p2.no/releases"
    ];
-    sha256 = "sha256-9T80++I6h2LjeGVydRswG++ygojvtrEELU/GTGYQeE8=";
+    sha256 = "sha256-oKj7COnHLq7yLxVbnJqg6pD7Mx0rvPdvgmSfC57+X1s=";
  };

  buildInputs = [ jdk ant gettext which ];
@ -64,7 +64,21 @@ stdenv.mkDerivation (finalAttrs: {
      fromSource
      binaryBytecode # source bundles dependencies as jars
    ];
-    license = licenses.gpl2;
+    license = with licenses; [
+      asl20
+      boost
+      bsd2
+      bsd3
+      cc-by-30
+      cc0
+      epl10
+      gpl2
+      gpl3
+      lgpl21Only
+      lgpl3Only
+      mit
+      publicDomain
+    ];
    platforms = [ "x86_64-linux" "i686-linux" ];
    maintainers = with maintainers; [ joelmo ];
  };
--- a/pkgs/tools/package-management/apt/default.nix
+++ b/pkgs/tools/package-management/apt/default.nix
@ -28,11 +28,11 @@

 stdenv.mkDerivation rec {
  pname = "apt";
-  version = "2.7.1";
+  version = "2.7.2";

  src = fetchurl {
    url = "mirror://debian/pool/main/a/apt/apt_${version}.tar.xz";
-    hash = "sha256-QDwBSnBjtrNMh76nesSwIVKYupvD9NzIcIY3kofp1f0=";
+    hash = "sha256-CVySyC/O/0zALdrcJHeFm4JjyI0wFdZ5mqcuMwE1my8=";
  };

  nativeBuildInputs = [
@ -79,6 +79,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://salsa.debian.org/apt-team/apt";
    description = "Command-line package management tools used on Debian-based systems";
+    changelog = "https://salsa.debian.org/apt-team/apt/-/raw/${version}/debian/changelog";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ cstrahan ];
--- a/pkgs/tools/package-management/reuse/default.nix
+++ b/pkgs/tools/package-management/reuse/default.nix
@ -2,14 +2,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "reuse";
-  version = "1.1.2";
+  version = "2.1.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "fsfe";
    repo = "reuse-tool";
    rev = "refs/tags/v${version}";
-    hash = "sha256-J+zQrokrAX5tRU/2RPPSaFDyfsACPHHQYbK5sO99CMs=";
+    hash = "sha256-MEQiuBxe/ctHlAnmLhQY4QH62uAcHb7CGfZz+iZCRSk=";
  };

  nativeBuildInputs = with python3Packages; [
@ -22,12 +22,15 @@ python3Packages.buildPythonApplication rec {
    debian
    jinja2
    license-expression
-    setuptools
-    setuptools-scm
  ];

  nativeCheckInputs = with python3Packages; [ pytestCheckHook ];

+  disabledTestPaths = [
+    # pytest wants to execute the actual source files for some reason, which fails with ImportPathMismatchError()
+    "src/reuse"
+  ];
+
  meta = with lib; {
    description = "A tool for compliance with the REUSE Initiative recommendations";
    homepage = "https://github.com/fsfe/reuse-tool";
--- a/pkgs/tools/system/hwinfo/default.nix
+++ b/pkgs/tools/system/hwinfo/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "hwinfo";
-  version = "22.2";
+  version = "23.2";

  src = fetchFromGitHub {
    owner = "opensuse";
    repo = "hwinfo";
    rev = version;
-    hash = "sha256-Z/brrDrT2J4RAS+pm1xaBqWO7PG6cAVgRpH3G6Nn39E=";
+    hash = "sha256-YAhsnE1DJ5UlYAuhDxS/5IpfIJB6DrhCT3E0YiKENjU=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/text/markdown-pp/default.nix
+++ b/pkgs/tools/text/markdown-pp/default.nix
@ -1,26 +0,0 @@
-{ lib
-, fetchFromGitHub
-, python3
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "MarkdownPP";
-  version = "1.5.1";
-  propagatedBuildInputs = with python3.pkgs; [ pillow watchdog ];
-  checkPhase = ''
-    cd test
-    PATH=$out/bin:$PATH ${python3}/bin/${python3.executable} test.py
-  '';
-  src = fetchFromGitHub {
-    owner = "jreese";
-    repo = "markdown-pp";
-    rev = "v${version}";
-    sha256 = "180i5wn9z6vdk2k2bh8345z3g80hj7zf5s2pq0h7k9vaxqpp7avc";
-  };
-  meta = with lib; {
-    description = "Preprocessor for Markdown files to generate a table of contents and other documentation needs";
-    license = licenses.mit;
-    homepage = "https://github.com/jreese/markdown-pp";
-    maintainers = with maintainers; [ zgrannan ];
-  };
-}
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdbook";
-  version = "0.4.31";
+  version = "0.4.32";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "mdBook";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-OUhZ94bW1+tmUPm/NLlL+Ummm2rtkJTBnNZ00hsTO5I=";
+    sha256 = "sha256-+Cb4ZFkJu6z2x/HqQkVqb2J0tFuj78TAmzhp2VPiai0=";
  };

-  cargoHash = "sha256-u8764RKgC35Z18KHw4AAxETPlACrMnVyz4/Aa2HQyEw=";
+  cargoHash = "sha256-Jj5AWapZUzd/ZZQvvlSWOv2dX4AhJyHKEncIPdLL7cA=";

  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];

--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "govc";
-  version = "0.30.5";
+  version = "0.30.6";

  subPackages = [ "govc" ];

@ -10,10 +10,10 @@ buildGoModule rec {
    rev = "v${version}";
    owner = "vmware";
    repo = "govmomi";
-    sha256 = "sha256-qnoun4DiiFpGal9uLyW7Vir+zMOpbDRj2fCIWfiAyLU=";
+    sha256 = "sha256-gk8V7/4N8+KDy0lRu04xwbrnXQWxZQTkvdb2ZI3AfM8=";
  };

-  vendorHash = "sha256-jbGqQITAhyBLoDa3cKU5gK+4WGgoGSCyFtzeoXx8e7k=";
+  vendorHash = "sha256-iLmQdjN0EXJuwC3NT5FKdHhJ4KvNAvnsBGAO9bypdqg=";

  ldflags = [
    "-s"
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -351,6 +351,7 @@ mapAliases ({
  cups-kyodialog3 = cups-kyodialog; # Added 2022-11-12
  cupsBjnp = throw "'cupsBjnp' has been renamed to/replaced by 'cups-bjnp'"; # Converted to throw 2022-02-22
  cups_filters = throw "'cups_filters' has been renamed to/replaced by 'cups-filters'"; # Converted to throw 2022-02-22
+  curl-impersonate-bin = throw "'curl-impersonate-bin' has been replaced by 'curl-impersonate'"; # Added 2022-10-08
  curlcpp = throw "curlcpp has been removed, no active maintainers and no usage within nixpkgs"; # Added 2022-05-10
  curaByDagoma = throw "curaByDagoma has been removed from nixpkgs, because it was unmaintained and dependent on python2 packages"; # Added 2022-01-12
  curaLulzbot = throw "curaLulzbot has been removed due to insufficient upstream support for a modern dependency chain"; # Added 2021-10-23
@ -1051,6 +1052,7 @@ mapAliases ({
  mariadb_108 = throw "mariadb_108 has been removed from nixpkgs, please switch to another version like mariadb_1010"; # Added 2022-05-10
  mariadb_109 = throw "mariadb_109 has been removed from nixpkgs, please switch to another version like mariadb_1010"; # Added 2022-05-10
  mariadb-client = hiPrio mariadb.client; #added 2019.07.28
+  markdown-pp = throw "markdown-pp was removed from nixpkgs, because the upstream archived it on 2021-09-02"; # Added 2023-07-22
  marp = throw "marp has been removed from nixpkgs, as it's unmaintained and has security issues"; # Added 2022-06-04
  matcha = throw "matcha was renamed to matcha-gtk-theme"; # added 2020-05-09
  mathics = throw "mathics has been removed from nixpkgs, as it's unmaintained"; # Added 2020-08-15
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -234,6 +234,8 @@ with pkgs;

  align = callPackage ../tools/text/align { };

+  alire = callPackage ../development/tools/build-managers/alire { };
+
  althttpd = callPackage ../servers/althttpd { };

  amqpcat = callPackage ../development/tools/amqpcat { };
@ -3023,6 +3025,8 @@ with pkgs;

  apfsprogs = callPackage ../tools/filesystems/apfsprogs { };

+  api-linter = callPackage ../development/tools/api-linter { };
+
  apk-tools = callPackage ../tools/package-management/apk-tools {
    lua = lua5_3;
  };
@ -7013,7 +7017,8 @@ with pkgs;

  curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };

-  curl-impersonate-bin = callPackage ../tools/networking/curl-impersonate { };
+  curl-impersonate = darwin.apple_sdk_11_0.callPackage ../tools/networking/curl-impersonate { };
+  inherit (curl-impersonate) curl-impersonate-ff curl-impersonate-chrome;

  curlie = callPackage ../tools/networking/curlie { };

@ -18173,6 +18178,7 @@ with pkgs;

  lua-language-server = darwin.apple_sdk_11_0.callPackage ../development/tools/language-servers/lua-language-server {
    inherit (darwin.apple_sdk_11_0.frameworks) CoreFoundation Foundation;
+    inherit (darwin) ditto;
  };

  metals = callPackage ../development/tools/language-servers/metals { };
@ -23836,6 +23842,7 @@ with pkgs;
  nv-codec-headers = callPackage ../development/libraries/nv-codec-headers { };
  nv-codec-headers-10 = callPackage ../development/libraries/nv-codec-headers/10_x.nix { };
  nv-codec-headers-11 = callPackage ../development/libraries/nv-codec-headers/11_x.nix { };
+  nv-codec-headers-12 = callPackage ../development/libraries/nv-codec-headers/12_x.nix { };

  mkNvidiaContainerPkg = { name, containerRuntimePath, configTemplate, additionalPaths ? [] }:
    let
@ -30134,7 +30141,9 @@ with pkgs;

  cutecapture = callPackage ../applications/video/cutecapture { };

-  milkytracker = callPackage ../applications/audio/milkytracker { };
+  milkytracker = callPackage ../applications/audio/milkytracker {
+    inherit (darwin.apple_sdk.frameworks) Cocoa CoreAudio Foundation;
+  };

  ptcollab = libsForQt5.callPackage ../applications/audio/ptcollab { };

@ -33105,8 +33114,6 @@ with pkgs;

  marathonctl = callPackage ../tools/virtualization/marathonctl { };

-  markdown-pp = callPackage ../tools/text/markdown-pp { };
-
  mark = callPackage ../tools/text/mark { };

  markets = callPackage ../applications/misc/markets { };
@ -40970,9 +40977,7 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
  };

-  spdlog = callPackage ../development/libraries/spdlog {
-    fmt = fmt_9;
-  };
+  spdlog = callPackage ../development/libraries/spdlog { };

  dart = callPackage ../development/compilers/dart { };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -4515,8 +4515,14 @@ self: super: with self; {

  grpcio = callPackage ../development/python-modules/grpcio { };

+  grpcio-channelz = callPackage ../development/python-modules/grpcio-channelz { };
+
  grpcio-gcp = callPackage ../development/python-modules/grpcio-gcp { };

+  grpcio-health-checking = callPackage ../development/python-modules/grpcio-health-checking { };
+
+  grpcio-reflection = callPackage ../development/python-modules/grpcio-reflection { };
+
  grpcio-status = callPackage ../development/python-modules/grpcio-status { };

  grpcio-tools = callPackage ../development/python-modules/grpcio-tools { };