Merge master into haskell-updates

2023-09-11 00:11:57 +00:00 · 2023-09-11 00:11:57 +00:00 · 7b90ca7dff
commit 7b90ca7dff
parent 864aa20266 d2031e8c2e
201 changed files with 2684 additions and 2023 deletions
--- a/doc/hooks/waf.section.md
+++ b/doc/hooks/waf.section.md
@ -1,50 +1,58 @@
-# waf.hook {#wafhook}
+# wafHook {#waf-hook}

 [Waf](https://waf.io) is a Python-based software building system.

-In Nixpkgs, `waf.hook` overrides the default configure, build, and install phases.
+In Nixpkgs, `wafHook` overrides the default configure, build, and install phases.

-## Variables controlling waf.hook {#variablesControllingWafHook}
+## Variables controlling wafHook {#waf-hook-variables-controlling}

-### `wafPath` {#wafPath}
+### `wafHook` Exclusive Variables {#waf-hook-exclusive-variables}
+
+The variables below are exclusive of `wafHook`.
+
+#### `wafPath` {#waf-path}

 Location of the `waf` tool. It defaults to `./waf`, to honor software projects that include it directly inside their source trees.

-If `wafPath` doesn't exist, then `waf.hook` will copy the `waf` provided from Nixpkgs to it.
+If `wafPath` doesn't exist, then `wafHook` will copy the `waf` provided from Nixpkgs to it.

-### `wafConfigureFlags` {#wafConfigureFlags}
+#### `wafFlags` {#waf-flags}

-Controls the flags passed to waf tool during configure phase.
+Controls the flags passed to waf tool during build and install phases. For settings specific to build or install phases, use `wafBuildFlags` or `wafInstallFlags` respectively.

-### `wafFlags` {#wafFlags}
-
-Controls the flags passed to waf tool during build and install phases.
-
-### `dontAddWafCrossFlags` {#dontAddWafCrossFlags}
+#### `dontAddWafCrossFlags` {#dont-add-waf-cross-flags}

 When set to `true`, don't add cross compilation flags during configure phase.

-### `dontUseWafConfigure` {#dontUseWafConfigure}
+#### `dontUseWafConfigure` {#dont-use-waf-configure}

 When set to true, don't use the predefined `wafConfigurePhase`.

-### `dontUseWafBuild` {#dontUseWafBuild}
+#### `dontUseWafBuild` {#dont-use-waf-build}

 When set to true, don't use the predefined `wafBuildPhase`.

-### `dontUseWafInstall` {#dontUseWafInstall}
+#### `dontUseWafInstall` {#dont-use-waf-install}

 When set to true, don't use the predefined `wafInstallPhase`.

-### Variables honored by waf.hook {#variablesHonoredByWafHook}
+### Similar variables {#waf-hook-similar-variables}

-The following variables commonly used by `stdenv.mkDerivation` are also honored by `waf.hook`.
+The following variables are similar to their `stdenv.mkDerivation` counterparts.
+
+| `wafHook` Variable    | `stdenv.mkDerivation` Counterpart |
+|-----------------------|-----------------------------------|
+| `wafConfigureFlags`   | `configureFlags`                  |
+| `wafConfigureTargets` | `configureTargets`                |
+| `wafBuildFlags`       | `buildFlags`                      |
+| `wafBuildTargets`     | `buildTargets`                    |
+| `wafInstallFlags`     | `installFlags`                    |
+| `wafInstallTargets`   | `installTargets`                  |
+
+### Honored variables {#waf-hook-honored-variables}
+
+The following variables commonly used by `stdenv.mkDerivation` are honored by `wafHook`.

 - `prefixKey`
- `configureTargets`
 - `enableParallelBuilding`
 - `enableParallelInstalling`
- `buildFlags`
- `buildTargets`
- `installFlags`
- `installTargets`
--- a/doc/hooks/zig.section.md
+++ b/doc/hooks/zig.section.md
@ -4,7 +4,7 @@

 In Nixpkgs, `zig.hook` overrides the default build, check and install phases.

-## Example code snippet {#example-code-snippet}
+## Example code snippet {#zig-hook-example-code-snippet}

 ```nix
 { lib
@ -27,25 +27,25 @@ stdenv.mkDerivation {
 }
 ```

-## Variables controlling zig.hook {#variables-controlling-zig-hook}
+## Variables controlling zig.hook {#zig-hook-variables-controlling}

-### `zig.hook` Exclusive Variables {#zigHookExclusiveVariables}
+### `zig.hook` Exclusive Variables {#zig-hook-exclusive-variables}

 The variables below are exclusive to `zig.hook`.

-#### `dontUseZigBuild` {#dontUseZigBuild}
+#### `dontUseZigBuild` {#dont-use-zig-build}

 Disables using `zigBuildPhase`.

-#### `dontUseZigCheck` {#dontUseZigCheck}
+#### `dontUseZigCheck` {#dont-use-zig-check}

 Disables using `zigCheckPhase`.

-#### `dontUseZigInstall` {#dontUseZigInstall}
+#### `dontUseZigInstall` {#dont-use-zig-install}

 Disables using `zigInstallPhase`.

-### Similar variables {#similarVariables}
+### Similar variables {#zig-hook-similar-variables}

 The following variables are similar to their `stdenv.mkDerivation` counterparts.

@ -55,7 +55,7 @@ The following variables are similar to their `stdenv.mkDerivation` counterparts.
 | `zigCheckFlags`     | `checkFlags`                      |
 | `zigInstallFlags`   | `installFlags`                    |

-### Variables honored by zig.hook {#variables-honored-by-zig-hook}
+### Variables honored by zig.hook {#zig-hook-variables-honored}

 The following variables commonly used by `stdenv.mkDerivation` are honored by `zig.hook`.

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -8297,6 +8297,12 @@
    githubId = 297653;
    name = "Joe Salisbury";
  };
+  johannwagner = {
+    email = "nix@wagner.digital";
+    github = "johannwagner";
+    githubId = 12380026;
+    name = "Johann Wagner";
+  };
  johanot = {
    email = "write@ownrisk.dk";
    github = "johanot";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -294,6 +294,17 @@ with lib.maintainers; {
    githubTeams = [ "flutter" ];
  };

+  flyingcircus = {
+    # Verify additions by approval of an already existing member of the team.
+    members = [
+      theuni
+      dpausp
+      leona
+    ];
+    scope = "Team for Flying Circus employees who collectively maintain packages.";
+    shortName = "Flying Circus employees";
+  };
+
  freedesktop = {
    members = [ jtojnar ];
    scope = "Maintain Freedesktop.org packages for graphical desktop.";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -8,6 +8,8 @@

 - LXD now supports virtual machine instances to complement the existing container support

+- The `nixos-rebuild` command has been given a `list-generations` subcommand. See `man nixos-rebuild` for more details.
+
 ## New Services {#sec-release-23.11-new-services}

 - [MCHPRS](https://github.com/MCHPR/MCHPRS), a multithreaded Minecraft server built for redstone. Available as [services.mchprs](#opt-services.mchprs.enable).
@ -290,3 +292,5 @@ The module update takes care of the new config syntax and the data itself (user
  ./common/auto-format-root-device.nix ];` When you use the systemd initrd, you
  can automatically format the root device by setting
  `virtualisation.fileSystems."/".autoFormat = true;`.
+
+- The `electron` packages now places its application files in `$out/libexec/electron` instead of `$out/lib/electron`. Packages using electron-builder will fail to build and need to be adjusted by changing `lib` to `libexec`.
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -5,8 +5,8 @@ let

  parentWrapperDir = dirOf wrapperDir;

-  securityWrapper = pkgs.callPackage ./wrapper.nix {
-    inherit parentWrapperDir;
+  securityWrapper = sourceProg : pkgs.callPackage ./wrapper.nix {
+    inherit sourceProg;
  };

  fileModeType =
@ -91,8 +91,7 @@ let
    , ...
    }:
    ''
-      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
-      echo -n "${source}" > "$wrapperDir/${program}.real"
+      cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"

      # Prevent races
      chmod 0000 "$wrapperDir/${program}"
@ -119,8 +118,7 @@ let
    , ...
    }:
    ''
-      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
-      echo -n "${source}" > "$wrapperDir/${program}.real"
+      cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"

      # Prevent races
      chmod 0000 "$wrapperDir/${program}"
@ -248,11 +246,13 @@ in
      export PATH="${wrapperDir}:$PATH"
    '';

-    security.apparmor.includes."nixos/security.wrappers" = ''
-      include "${pkgs.apparmorRulesFromClosure { name="security.wrappers"; } [
-        securityWrapper
+    security.apparmor.includes = lib.mapAttrs' (wrapName: wrap: lib.nameValuePair
+     "nixos/security.wrappers/${wrapName}" ''
+      include "${pkgs.apparmorRulesFromClosure { name="security.wrappers.${wrapName}"; } [
+        (securityWrapper wrap.source)
      ]}"
-    '';
+      mrpx ${wrap.source},
+    '') wrappers;

    ###### wrappers activation script
    system.activationScripts.wrappers =
--- a/nixos/modules/security/wrappers/wrapper.c
+++ b/nixos/modules/security/wrappers/wrapper.c
@ -17,6 +17,10 @@
 #include <syscall.h>
 #include <byteswap.h>

+#ifndef SOURCE_PROG
+#error SOURCE_PROG should be defined via preprocessor commandline
+#endif
+
 // aborts when false, printing the failed expression
 #define ASSERT(expr) ((expr) ? (void) 0 : assert_failure(#expr))
 // aborts when returns non-zero, printing the failed expression and errno
@ -24,10 +28,6 @@

 extern char **environ;

-// The WRAPPER_DIR macro is supplied at compile time so that it cannot
-// be changed at runtime
-static char *wrapper_dir = WRAPPER_DIR;
-
 // Wrapper debug variable name
 static char *wrapper_debug = "WRAPPER_DEBUG";

@ -151,115 +151,20 @@ static int make_caps_ambient(const char *self_path) {
    return 0;
 }

-int readlink_malloc(const char *p, char **ret) {
-    size_t l = FILENAME_MAX+1;
-    int r;
-
-    for (;;) {
-        char *c = calloc(l, sizeof(char));
-        if (!c) {
-            return -ENOMEM;
-        }
-
-        ssize_t n = readlink(p, c, l-1);
-        if (n < 0) {
-            r = -errno;
-            free(c);
-            return r;
-        }
-
-        if ((size_t) n < l-1) {
-            c[n] = 0;
-            *ret = c;
-            return 0;
-        }
-
-        free(c);
-        l *= 2;
-    }
-}
-
 int main(int argc, char **argv) {
    ASSERT(argc >= 1);
-    char *self_path = NULL;
-    int self_path_size = readlink_malloc("/proc/self/exe", &self_path);
-    if (self_path_size < 0) {
-        fprintf(stderr, "cannot readlink /proc/self/exe: %s", strerror(-self_path_size));
-    }
-
-    unsigned int ruid, euid, suid, rgid, egid, sgid;
-    MUSTSUCCEED(getresuid(&ruid, &euid, &suid));
-    MUSTSUCCEED(getresgid(&rgid, &egid, &sgid));
-
-    // If true, then we did not benefit from setuid privilege escalation,
-    // where the original uid is still in ruid and different from euid == suid.
-    int didnt_suid = (ruid == euid) && (euid == suid);
-    // If true, then we did not benefit from setgid privilege escalation
-    int didnt_sgid = (rgid == egid) && (egid == sgid);
-
-
-    // Make sure that we are being executed from the right location,
-    // i.e., `safe_wrapper_dir'.  This is to prevent someone from creating
-    // hard link `X' from some other location, along with a false
-    // `X.real' file, to allow arbitrary programs from being executed
-    // with elevated capabilities.
-    int len = strlen(wrapper_dir);
-    if (len > 0 && '/' == wrapper_dir[len - 1])
-      --len;
-    ASSERT(!strncmp(self_path, wrapper_dir, len));
-    ASSERT('/' == wrapper_dir[0]);
-    ASSERT('/' == self_path[len]);
-
-    // If we got privileges with the fs set[ug]id bit, check that the privilege we
-    // got matches the one one we expected, ie that our effective uid/gid
-    // matches the uid/gid of `self_path`. This ensures that we were executed as
-    // `self_path', and not, say, as some other setuid program.
-    // We don't check that if we did not benefit from the set[ug]id bit, as
-    // can be the case in nosuid mounts or user namespaces.
-    struct stat st;
-    ASSERT(lstat(self_path, &st) != -1);
-
-    // if the wrapper gained privilege with suid, check that we got the uid of the file owner
-    ASSERT(!((st.st_mode & S_ISUID) && !didnt_suid) || (st.st_uid == euid));
-    // if the wrapper gained privilege with sgid, check that we got the gid of the file group
-    ASSERT(!((st.st_mode & S_ISGID) && !didnt_sgid) || (st.st_gid == egid));
-    // same, but with suid instead of euid
-    ASSERT(!((st.st_mode & S_ISUID) && !didnt_suid) || (st.st_uid == suid));
-    ASSERT(!((st.st_mode & S_ISGID) && !didnt_sgid) || (st.st_gid == sgid));
-
-    // And, of course, we shouldn't be writable.
-    ASSERT(!(st.st_mode & (S_IWGRP | S_IWOTH)));
-
-    // Read the path of the real (wrapped) program from <self>.real.
-    char real_fn[PATH_MAX + 10];
-    int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);
-    ASSERT(real_fn_size < sizeof(real_fn));
-
-    int fd_self = open(real_fn, O_RDONLY);
-    ASSERT(fd_self != -1);
-
-    char source_prog[PATH_MAX];
-    len = read(fd_self, source_prog, PATH_MAX);
-    ASSERT(len != -1);
-    ASSERT(len < sizeof(source_prog));
-    ASSERT(len > 0);
-    source_prog[len] = 0;
-
-    close(fd_self);

    // Read the capabilities set on the wrapper and raise them in to
    // the ambient set so the program we're wrapping receives the
    // capabilities too!
-    if (make_caps_ambient(self_path) != 0) {
-        free(self_path);
+    if (make_caps_ambient("/proc/self/exe") != 0) {
        return 1;
    }
-    free(self_path);

-    execve(source_prog, argv, environ);
+    execve(SOURCE_PROG, argv, environ);
    
    fprintf(stderr, "%s: cannot run `%s': %s\n",
-        argv[0], source_prog, strerror(errno));
+        argv[0], SOURCE_PROG, strerror(errno));

    return 1;
 }
--- a/nixos/modules/security/wrappers/wrapper.nix
+++ b/nixos/modules/security/wrappers/wrapper.nix
@ -1,4 +1,4 @@
-{ stdenv, linuxHeaders, parentWrapperDir, debug ? false }:
+{ stdenv, linuxHeaders, sourceProg, debug ? false }:
 # For testing:
 # $ nix-build -E 'with import <nixpkgs> {}; pkgs.callPackage ./wrapper.nix { parentWrapperDir = "/run/wrappers"; debug = true; }'
 stdenv.mkDerivation {
@ -7,7 +7,7 @@ stdenv.mkDerivation {
  dontUnpack = true;
  hardeningEnable = [ "pie" ];
  CFLAGS = [
-    ''-DWRAPPER_DIR="${parentWrapperDir}"''
+    ''-DSOURCE_PROG="${sourceProg}"''
  ] ++ (if debug then [
    "-Werror" "-Og" "-g"
  ] else [
--- a/nixos/modules/services/web-apps/galene.nix
+++ b/nixos/modules/services/web-apps/galene.nix
@ -186,7 +186,7 @@ in
          ProtectSystem = "strict";
          ReadWritePaths = cfg.recordingsDir;
          RemoveIPC = true;
-          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" ];
          RestrictNamespaces = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -2814,9 +2814,8 @@ let

      systemd.services.systemd-networkd = let
        isReloadableUnitFileName = unitFileName: strings.hasSuffix ".network" unitFileName;
-        partitionedUnitFiles = lib.partition isReloadableUnitFileName unitFiles;
-        reloadableUnitFiles = partitionedUnitFiles.right;
-        nonReloadableUnitFiles = partitionedUnitFiles.wrong;
+        reloadableUnitFiles = attrsets.filterAttrs (k: v: isReloadableUnitFileName k) unitFiles;
+        nonReloadableUnitFiles = attrsets.filterAttrs (k: v: !isReloadableUnitFileName k) unitFiles;
        unitFileSources = unitFiles: map (x: x.source) (attrValues unitFiles);
      in {
        wantedBy = [ "multi-user.target" ];
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -395,7 +395,9 @@ in
      description = lib.mdDoc ''
        The amount of time which can elapse after a reboot has been triggered
        before a watchdog hardware device will automatically reboot the system.
-        Valid time units include "ms", "s", "min", "h", "d", and "w".
+        Valid time units include "ms", "s", "min", "h", "d", and "w". If left
+        `null`, systemd will use its default of `10min`; see also {command}`man
+        5 systemd-system.conf`.
      '';
    };

--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -1396,14 +1396,12 @@ in
    security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
      /run/wrappers/bin/ping {
        include <abstractions/base>
-        include <nixos/security.wrappers>
+        include <nixos/security.wrappers/ping>
        rpx /run/wrappers/wrappers.*/ping,
      }
      /run/wrappers/wrappers.*/ping {
        include <abstractions/base>
-        include <nixos/security.wrappers>
-        r /run/wrappers/wrappers.*/ping.real,
-        mrpx ${config.security.wrappers.ping.source},
+        include <nixos/security.wrappers/ping>
        capability net_raw,
        capability setpcap,
      }
--- a/nixos/modules/tasks/swraid.nix
+++ b/nixos/modules/tasks/swraid.nix
@ -2,6 +2,8 @@

  cfg = config.boot.swraid;

+  mdadm_conf = config.environment.etc."mdadm.conf";
+
 in {
  imports = [
    (lib.mkRenamedOptionModule [ "boot" "initrd" "services" "swraid" "enable" ] [ "boot" "swraid" "enable" ])
@ -36,8 +38,14 @@ in {
  };

  config = lib.mkIf cfg.enable {
+    warnings = lib.mkIf
+        ((builtins.match ".*(MAILADDR|PROGRAM).*" mdadm_conf.text) == null)
+        [ "mdadm: Neither MAILADDR nor PROGRAM has been set. This will cause the `mdmon` service to crash." ];
+
    environment.systemPackages = [ pkgs.mdadm ];

+    environment.etc."mdadm.conf".text = lib.mkAfter cfg.mdadmConf;
+
    services.udev.packages = [ pkgs.mdadm ];

    systemd.packages = [ pkgs.mdadm ];
@ -59,12 +67,10 @@ in {
        $out/bin/mdadm --version
      '';

-      extraFiles."/etc/mdadm.conf".source = pkgs.writeText "mdadm.conf" config.boot.swraid.mdadmConf;
+      extraFiles."/etc/mdadm.conf" = mdadm_conf;

      systemd = {
-        contents."/etc/mdadm.conf" = lib.mkIf (cfg.mdadmConf != "") {
-          text = cfg.mdadmConf;
-        };
+        contents."/etc/mdadm.conf".text = mdadm_conf.text;

        packages = [ pkgs.mdadm ];
        initrdBin = [ pkgs.mdadm ];
--- a/nixos/tests/systemd-initrd-swraid.nix
+++ b/nixos/tests/systemd-initrd-swraid.nix
@ -20,6 +20,9 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
        ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
      '';
    };
+    environment.etc."mdadm.conf".text = ''
+      MAILADDR test@example.com
+    '';
    boot.initrd = {
      systemd = {
        enable = true;
@ -33,7 +36,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {

  testScript = ''
    # Create RAID
-    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid0 /dev/vdb /dev/vdc")
+    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90")
    machine.succeed("mkfs.ext4 -L testraid /dev/md0")
    machine.succeed("mkdir -p /mnt && mount /dev/md0 /mnt && echo hello > /mnt/test && umount /mnt")

@ -48,5 +51,13 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
    assert "/dev/md0 on / type ext4" in machine.succeed("mount")
    assert "hello" in machine.succeed("cat /test")
    assert "md0" in machine.succeed("cat /proc/mdstat")
+
+    expected_config = """MAILADDR test@example.com
+
+    ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
+    """
+    got_config = machine.execute("cat /etc/mdadm.conf")[1]
+    assert expected_config == got_config, repr((expected_config, got_config))
+    machine.wait_for_unit("mdmonitor.service")
  '';
 })
--- a/nixos/tests/wrappers.nix
+++ b/nixos/tests/wrappers.nix
@ -21,6 +21,8 @@ in
      };
    };

+    security.apparmor.enable = true;
+
    security.wrappers = {
      suidRoot = {
        owner = "root";
@ -84,17 +86,27 @@ in
      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -g', '0')
      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -rg', '0')

+      # Test that in nonewprivs environment the wrappers simply exec their target.
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -u', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
+
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -g', '${toString usersGid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
+
      # We are only testing the permitted set, because it's easiest to look at with capsh.
      machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_CHOWN'))
      machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_SYS_ADMIN'))
      machine.succeed(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_CHOWN'))
      machine.fail(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_SYS_ADMIN'))

-      # test a few "attacks" against which the wrapper protects itself
-      machine.succeed("cp /run/wrappers/bin/suid_root_busybox{,.real} /tmp/")
-      machine.fail(cmd_as_regular("/tmp/suid_root_busybox id -u"))
-
-      machine.succeed("chmod u+s,a+w /run/wrappers/bin/suid_root_busybox")
-      machine.fail(cmd_as_regular("/run/wrappers/bin/suid_root_busybox id -u"))
+      # Test that the only user of apparmor policy includes generated by
+      # wrappers works. Ideally this'd be located in a test for the module that
+      # actually makes the apparmor policy for ping, but there's no convenient
+      # test for that one.
+      machine.succeed("ping -c 1 127.0.0.1")
    '';
 })
--- a/pkgs/applications/audio/spotify-player/default.nix
+++ b/pkgs/applications/audio/spotify-player/default.nix
@ -60,7 +60,7 @@ rustPlatform.buildRustPackage rec {
    ++ lib.optionals withSixel [ libsixel ]
    ++ lib.optionals (withAudioBackend == "alsa") [ alsa-lib ]
    ++ lib.optionals (withAudioBackend == "pulseaudio") [ libpulseaudio ]
-    ++ lib.optionals (withAudioBackend == "rodio") [ alsa-lib ]
+    ++ lib.optionals (withAudioBackend == "rodio" && stdenv.isLinux) [ alsa-lib ]
    ++ lib.optionals (withAudioBackend == "portaudio") [ portaudio ]
    ++ lib.optionals (withAudioBackend == "jackaudio") [ libjack2 ]
    ++ lib.optionals (withAudioBackend == "rodiojack") [ alsa-lib libjack2 ]
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@ -6,13 +6,13 @@

 buildDotnetModule rec {
  pname = "btcpayserver";
-  version = "1.11.3";
+  version = "1.11.4";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-fs8GAE/beiFLUNBI+r8h08a2TYSY9fYQYGvxBOtClgg=";
+    sha256 = "sha256-PJhc+Kv/iZ73DkM9KXzujTsIc071wqn/NKhuUPs/7dA=";
  };

  projectFile = "BTCPayServer/BTCPayServer.csproj";
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -56,7 +56,7 @@ stdenv.mkDerivation rec {

    yarn --offline run electron-builder --dir \
      --config electron-builder-linux-mac.json \
-      -c.electronDist=${electron}/lib/electron \
+      -c.electronDist=${electron}/libexec/electron \
      -c.electronVersion=${electron.version}

    runHook postBuild
--- a/pkgs/applications/misc/OSCAR/default.nix
+++ b/pkgs/applications/misc/OSCAR/default.nix
@ -1,13 +1,13 @@
 { lib, stdenv, mkDerivation, fetchFromGitLab, qmake, qtbase, qttools, qtserialport, libGLU }:
 mkDerivation rec {
  pname = "OSCAR";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchFromGitLab {
    owner = "pholy";
    repo = "OSCAR-code";
    rev = "v${version}";
-    sha256 = "sha256-bgETkpyL0yhCD1FfTVN0s9RNOPkDp88W/1Gdxvu+Ons=";
+    sha256 = "sha256-eaj2/ioh9dXxWv7X/IZv7m/oVcU6t7r+mK5YrrViF2w=";
  };

  buildInputs = [ qtbase qttools qtserialport libGLU ];
--- a/pkgs/applications/misc/authy/default.nix
+++ b/pkgs/applications/misc/authy/default.nix
@ -10,12 +10,12 @@
 stdenv.mkDerivation rec {
  pname = "authy";
  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/authy?channel=stable' | jq '.download_url,.version'
-  version = "2.3.0";
-  rev = "19";
+  version = "2.4.1";
+  rev = "21";

  src = fetchurl {
    url = "https://api.snapcraft.io/api/v1/snaps/download/H8ZpNgIoPyvmkgxOWw5MSzsXK1wRZiHn_${rev}.snap";
-    hash = "sha256-WN/vcY3kfF/HQZ7opyIdDevU5oDYDGjshS7XVU7yrj8=";
+    hash = "sha256-a5z6Lwdgody88f7has/f2AMg9m9fGWsJSexZM6KUGOY=";
  };

  nativeBuildInputs = [ autoPatchelfHook makeWrapper squashfsTools ];
--- a/pkgs/applications/misc/kuro/default.nix
+++ b/pkgs/applications/misc/kuro/default.nix
@ -38,7 +38,7 @@ mkYarnPackage rec {

    yarn --offline run electron-builder \
      --dir \
-      -c.electronDist=${electron}/lib/electron \
+      -c.electronDist=${electron}/libexec/electron \
      -c.electronVersion=${electron.version}

    popd
--- a/pkgs/applications/misc/nwg-look/default.nix
+++ b/pkgs/applications/misc/nwg-look/default.nix
@ -19,7 +19,7 @@ buildGoModule rec {

  src = fetchFromGitHub {
    owner = "nwg-piotr";
-    repo = pname;
+    repo = "nwg-look";
    rev = "v${version}";
    hash = "sha256-wUI58qYkVYgES87HQ4octciDlOJ10oJldbUkFgxRUd4=";
  };
--- a/pkgs/applications/misc/pot/Cargo.lock
+++ b/pkgs/applications/misc/pot/Cargo.lock
@ -65,6 +65,12 @@ dependencies = [
 "alloc-no-stdlib",
 ]

+[[package]]
+name = "allocator-api2"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
+
 [[package]]
 name = "android-tzdata"
 version = "0.1.1"
@ -257,6 +263,15 @@ dependencies = [
 "system-deps 6.1.1",
 ]

+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.1"
@ -330,6 +345,9 @@ name = "bitflags"
 version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+dependencies = [
+ "serde",
+]

 [[package]]
 name = "block"
@ -679,6 +697,12 @@ dependencies = [
 "crossbeam-utils",
 ]

+[[package]]
+name = "const-oid"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"
+
 [[package]]
 name = "const-random"
 version = "0.1.15"
@ -775,6 +799,21 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "crc"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86ec7a15cbe22e59248fc7eadb1907dab5ba09372595da4d73dd805ed4417dfe"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cace84e55f07e7301bae1c519df89cdad8cc3cd868413d3fdbdeca9ff3db484"
+
 [[package]]
 name = "crc32fast"
 version = "1.3.2"
@ -818,6 +857,16 @@ dependencies = [
 "scopeguard",
 ]

+[[package]]
+name = "crossbeam-queue"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1cfb3ea8a53f37c40dea2c7bedcbd88bdfae54f5e2175d6ecaff1c988353add"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.16"
@ -926,6 +975,17 @@ dependencies = [
 "winapi",
 ]

+[[package]]
+name = "der"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fffa369a668c8af7dbf8b5e56c9f744fbd399949ed171606040001947de40b1c"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
 [[package]]
 name = "deranged"
 version = "0.3.8"
@ -977,6 +1037,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
 "block-buffer",
+ "const-oid",
 "crypto-common",
 "subtle",
 ]
@ -1076,6 +1137,12 @@ dependencies = [
 "xcb",
 ]

+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
 [[package]]
 name = "downcast-rs"
 version = "1.2.0"
@ -1108,6 +1175,9 @@ name = "either"
 version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+dependencies = [
+ "serde",
+]

 [[package]]
 name = "embed-resource"
@ -1208,6 +1278,17 @@ dependencies = [
 "str-buf",
 ]

+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "event-listener"
 version = "2.5.3"
@ -1285,6 +1366,12 @@ dependencies = [
 "windows-sys 0.48.0",
 ]

+[[package]]
+name = "finl_unicode"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fcfdc7a0362c9f4444381a9e697c79d435fe65b52a37466fc2c1184cee9edc6"
+
 [[package]]
 name = "fixedbitset"
 version = "0.4.2"
@ -1311,7 +1398,7 @@ dependencies = [
 "futures-sink",
 "nanorand",
 "pin-project",
- "spin",
+ "spin 0.9.8",
 ]

 [[package]]
@ -1407,6 +1494,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
 dependencies = [
 "futures-core",
+ "futures-sink",
 ]

 [[package]]
@ -1426,6 +1514,17 @@ dependencies = [
 "futures-util",
 ]

+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
 [[package]]
 name = "futures-io"
 version = "0.3.28"
@ -1854,6 +1953,19 @@ name = "hashbrown"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
+dependencies = [
+ "hashbrown 0.14.0",
+]

 [[package]]
 name = "heck"
@ -1869,6 +1981,9 @@ name = "heck"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+dependencies = [
+ "unicode-segmentation",
+]

 [[package]]
 name = "hermit-abi"
@ -1882,6 +1997,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"

+[[package]]
+name = "hkdf"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437"
+dependencies = [
+ "hmac",
+]
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
@ -1891,6 +2015,15 @@ dependencies = [
 "digest",
 ]

+[[package]]
+name = "home"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5444c27eef6923071f7ebcc33e3444508466a76f7a2b93da00ed6e19f30c1ddb"
+dependencies = [
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "html5ever"
 version = "0.25.2"
@ -2181,6 +2314,15 @@ dependencies = [
 "either",
 ]

+[[package]]
+name = "itertools"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "0.4.8"
@ -2312,6 +2454,9 @@ name = "lazy_static"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+dependencies = [
+ "spin 0.5.2",
+]

 [[package]]
 name = "lebe"
@ -2388,6 +2533,23 @@ dependencies = [
 "windows-sys 0.48.0",
 ]

+[[package]]
+name = "libm"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7012b1bbb0719e1097c47611d3898568c546d597c2e74d66f6087edd5233ff4"
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afc22eff61b133b115c6e8c74e818c628d6d5e7a502afea6f64dee076dd94326"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "line-wrap"
 version = "0.1.1"
@ -2408,7 +2570,7 @@ dependencies = [
 "compact_str",
 "fraction",
 "include_dir",
- "itertools",
+ "itertools 0.10.5",
 "lingua-arabic-language-model",
 "lingua-chinese-language-model",
 "lingua-english-language-model",
@ -2993,6 +3155,23 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-bigint-dig"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151"
+dependencies = [
+ "byteorder",
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.5",
+ "smallvec",
+ "zeroize",
+]
+
 [[package]]
 name = "num-complex"
 version = "0.4.4"
@ -3042,6 +3221,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
 dependencies = [
 "autocfg",
+ "libm",
 ]

 [[package]]
@ -3300,6 +3480,12 @@ dependencies = [
 "subtle",
 ]

+[[package]]
+name = "paste"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
+
 [[package]]
 name = "pathdiff"
 version = "0.2.1"
@ -3318,6 +3504,15 @@ dependencies = [
 "sha2",
 ]

+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.0"
@ -3464,6 +3659,27 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"

+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.27"
@ -3538,6 +3754,7 @@ dependencies = [
 "tauri-plugin-fs-watch",
 "tauri-plugin-log",
 "tauri-plugin-single-instance",
+ "tauri-plugin-sql",
 "tauri-plugin-store",
 "thiserror",
 "tiny_http",
@ -3918,6 +4135,43 @@ dependencies = [
 "windows 0.37.0",
 ]

+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin 0.5.2",
+ "untrusted",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ab43bb47d23c1a631b4b680199a45255dce26fa9ab2fa902581f624ff13e6a8"
+dependencies = [
+ "byteorder",
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.23"
@ -3960,6 +4214,36 @@ dependencies = [
 "windows-sys 0.48.0",
 ]

+[[package]]
+name = "rustls"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd8d6c9f025a446bc4d18ad9632e69aec8f287aa84499ee335599fabd20c3fd8"
+dependencies = [
+ "ring",
+ "rustls-webpki",
+ "sct",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d3987094b1d07b653b7dfdc3f70ce9a1da9c51ac18c1b06b662e4f9a0e9f4b2"
+dependencies = [
+ "base64 0.21.3",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d93931baf2d282fff8d3a532bbfd7653f734643161b87e3e01e59a04439bf0d"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.14"
@ -4026,6 +4310,16 @@ dependencies = [
 "xcb",
 ]

+[[package]]
+name = "sct"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "security-framework"
 version = "2.9.2"
@ -4298,6 +4592,16 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "signature"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e1788eed21689f9cf370582dfc467ef36ed9c707f073528ddafa8d83e3b8500"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.7"
@ -4373,6 +4677,12 @@ dependencies = [
 "system-deps 5.0.0",
 ]

+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
 [[package]]
 name = "spin"
 version = "0.9.8"
@ -4382,6 +4692,229 @@ dependencies = [
 "lock_api",
 ]

+[[package]]
+name = "spki"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1e996ef02c474957d681f1b05213dfb0abab947b446a62d37770b23500184a"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlformat"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b7b278788e7be4d0d29c0f39497a0eef3fba6bbc8e70d8bf7fde46edeaa9e85"
+dependencies = [
+ "itertools 0.11.0",
+ "nom",
+ "unicode_categories",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e58421b6bc416714d5115a2ca953718f6c621a51b68e4f4922aea5a4391a721"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd4cef4251aabbae751a3710927945901ee1d97ee96d757f6880ebb9a79bfd53"
+dependencies = [
+ "ahash",
+ "atoi",
+ "byteorder",
+ "bytes",
+ "crc",
+ "crossbeam-queue",
+ "dotenvy",
+ "either",
+ "event-listener",
+ "futures-channel",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashlink",
+ "hex",
+ "indexmap 2.0.0",
+ "log",
+ "memchr",
+ "once_cell",
+ "paste",
+ "percent-encoding",
+ "rustls",
+ "rustls-pemfile",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlformat",
+ "thiserror",
+ "time 0.3.28",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "webpki-roots",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "208e3165167afd7f3881b16c1ef3f2af69fa75980897aac8874a0696516d12c2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a4a8336d278c62231d87f24e8a7a74898156e34c1c18942857be2acb29c7dfc"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck 0.4.1",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn 1.0.109",
+ "tempfile",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ca69bf415b93b60b80dc8fda3cb4ef52b2336614d8da2de5456cc942a110482"
+dependencies = [
+ "atoi",
+ "base64 0.21.3",
+ "bitflags 2.4.0",
+ "byteorder",
+ "bytes",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa 1.0.9",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.5",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "time 0.3.28",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0db2df1b8731c3651e204629dd55e52adbae0462fa1bdcbed56a2302c18181e"
+dependencies = [
+ "atoi",
+ "base64 0.21.3",
+ "bitflags 2.4.0",
+ "byteorder",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa 1.0.9",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.5",
+ "serde",
+ "serde_json",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "time 0.3.28",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4c21bf34c7cae5b283efb3ac1bcc7670df7561124dc2f8bdc0b59be40f79a2"
+dependencies = [
+ "atoi",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sqlx-core",
+ "time 0.3.28",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.0"
@ -4435,6 +4968,17 @@ dependencies = [
 "quote",
 ]

+[[package]]
+name = "stringprep"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb41d74e231a107a1b4ee36bd1214b11285b77768d2e3824aedafa988fd36ee6"
+dependencies = [
+ "finl_unicode",
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
 [[package]]
 name = "strsim"
 version = "0.10.0"
@ -4776,6 +5320,22 @@ dependencies = [
 "zbus",
 ]

+[[package]]
+name = "tauri-plugin-sql"
+version = "0.0.0"
+source = "git+https://github.com/tauri-apps/plugins-workspace?branch=v1#5b814f56e6368fdec46c4ddb04a07e0923ff995a"
+dependencies = [
+ "futures-core",
+ "log",
+ "serde",
+ "serde_json",
+ "sqlx",
+ "tauri",
+ "thiserror",
+ "time 0.3.28",
+ "tokio",
+]
+
 [[package]]
 name = "tauri-plugin-store"
 version = "0.0.0"
@ -5052,6 +5612,17 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "tokio-stream"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.8"
@ -5122,6 +5693,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
 dependencies = [
 "cfg-if",
+ "log",
 "pin-project-lite",
 "tracing-attributes",
 "tracing-core",
@ -5258,6 +5830,18 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"

+[[package]]
+name = "unicode_categories"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
 [[package]]
 name = "url"
 version = "2.4.1"
@ -5585,6 +6169,15 @@ dependencies = [
 "system-deps 6.1.1",
 ]

+[[package]]
+name = "webpki-roots"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b291546d5d9d1eab74f069c77749f2cb8504a12caa20f0f2de93ddbf6f411888"
+dependencies = [
+ "rustls-webpki",
+]
+
 [[package]]
 name = "webview2-com"
 version = "0.19.1"
@ -5629,6 +6222,12 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9193164d4de03a926d909d3bc7c30543cecb35400c02114792c2cae20d5e2dbb"

+[[package]]
+name = "whoami"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22fc3756b8a9133049b26c7f61ab35416c130e8c09b660f5b3958b446f52cc50"
+
 [[package]]
 name = "widestring"
 version = "1.0.2"
@ -6250,6 +6849,12 @@ dependencies = [
 "zvariant",
 ]

+[[package]]
+name = "zeroize"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
+
 [[package]]
 name = "zip"
 version = "0.6.6"
--- a/pkgs/applications/misc/pot/default.nix
+++ b/pkgs/applications/misc/pot/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "pot";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "pot-app";
    repo = "pot-desktop";
    rev = version;
-    hash = "sha256-8AIOAM3xEmKn++DqgXVDhCGlPMoeQPGrKtuUnPXmoeU=";
+    hash = "sha256-PvbqPGT8BTHEufYp+TUSd0tTSBnTBDIYHxaeI7FEVDE=";
  };

  sourceRoot = "${src.name}/src-tauri";
@ -66,7 +66,7 @@ stdenv.mkDerivation rec {

    dontFixup = true;
    outputHashMode = "recursive";
-    outputHash = "sha256-+/GDP3IFCidIs2/ZqQX7pZmZNQrCHNT6uy+x1CKkCmI=";
+    outputHash = "sha256-iHFzv8dMC0TT6PtMJmL0EufZ8TnbyjmsoBH3Z8U48D0=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/applications/misc/waypaper/default.nix
+++ b/pkgs/applications/misc/waypaper/default.nix
@ -8,13 +8,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "waypaper";
-  version = "1.5";
+  version = "1.9";

  src = fetchFromGitHub {
    owner = "anufrievroman";
    repo = "waypaper";
    rev = "refs/tags/${version}";
-    hash = "sha256-lK4TygR9cwEHcnrC0E5vE7Jor6afEiM9TmEgGXj+hNA=";
+    hash = "sha256-6hv+f2fbrbLodJIRHl5MYTkiZ51iZOAK42Vg73zSw/E=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "2.8.0";
+  version = "2.8.3";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = "v${version}";
-    sha256 = "sha256-/BMagPR74pANVYcmvdJZmV4tB48cEyAy0FKtBlpoLDE=";
+    hash = "sha256-sVaUItort09n2aShrE0MqOKQps44qNQv0Nox4P21xqg=";
  };

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-xiCgQqP2XF+b2JQTBFqJ3h2klc6GjqyXoNUwatO0Ul8=";
+  vendorHash = "sha256-WeDIvw9KHDL5h/MQ9H1rOZkAlUOzROGw/gwpZB2jvOg=";

  # Set target as ./cmd per cli-local
  # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
--- a/pkgs/applications/networking/cluster/helm-docs/default.nix
+++ b/pkgs/applications/networking/cluster/helm-docs/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "helm-docs";
-  version = "1.11.0";
+  version = "1.11.1";

  src = fetchFromGitHub {
    owner = "norwoodj";
    repo = "helm-docs";
    rev = "v${version}";
-    sha256 = "sha256-476ZhjRwHlNJFkHzY8qQ7WbAUUpFNSoxXLGX9esDA/E=";
+    hash = "sha256-4o3hdqaW/AtegKStMKVerE3dRr3iZxQ+Lm2Aj3aOy98=";
  };

-  vendorSha256 = "sha256-xXwunk9rmzZEtqmSo8biuXnAjPp7fqWdQ+Kt9+Di9N8=";
+  vendorHash = "sha256-6byD8FdeqdRDNUZFZ7FUUdyTuFOO8s3rb6YPGKdwLB8=";

  subPackages = [ "cmd/helm-docs" ];
  ldflags = [
--- a/pkgs/applications/networking/cluster/karmor/default.nix
+++ b/pkgs/applications/networking/cluster/karmor/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "karmor";
-  version = "0.13.15";
+  version = "0.13.16";

  src = fetchFromGitHub {
    owner = "kubearmor";
    repo = "kubearmor-client";
    rev = "v${version}";
-    hash = "sha256-irpfZFswZjowKDnHmoutTo6960jl5C3Dq+NurjOk3p8=";
+    hash = "sha256-MEP7OlmsPe5qpdFBEOzCsJqLdZ5t7bMwPE/JhP9bGTY=";
  };

-  vendorHash = "sha256-raMR27DqgT/Hjp3yAMAKLbfOjIZs0K0XsncgmIP6vxk=";
+  vendorHash = "sha256-5r5UqWRmqrLcpTeYpezGxIMj9JnPaohhd1i7VvaBVGM=";

  nativeBuildInputs = [ installShellFiles ];

@ -51,6 +51,6 @@ buildGoModule rec {
    homepage = "https://kubearmor.io";
    changelog = "https://github.com/kubearmor/kubearmor-client/releases/v${version}";
    license = licenses.asl20;
-    maintainers = with maintainers; [ urandom ];
+    maintainers = with maintainers; [ urandom kashw2 ];
  };
 }
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -24,9 +24,10 @@ buildGoModule rec {

  meta = with lib; {
    description = "Synchronize your DNS to multiple providers from a simple DSL";
-    homepage = "https://stackexchange.github.io/dnscontrol/";
+    homepage = "https://dnscontrol.org/";
    changelog = "https://github.com/StackExchange/dnscontrol/releases/tag/${src.rev}";
    license = licenses.mit;
    maintainers = with maintainers; [ mmahut SuperSandro2000 ];
+    mainProgram = "dnscontrol";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/nheko/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nheko/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , asciidoc
 , pkg-config
@ -42,6 +43,22 @@ stdenv.mkDerivation rec {
    hash = "sha256-2daXxTbpSUlig47y901JOkWRxbZGH4qrvNMepJbvS3o=";
  };

+  patches = [
+    # The 2 following patches can be removed with the next version bump.
+    # Backport of https://github.com/Nheko-Reborn/nheko/commit/e89e65dc17020772eb057414b4f0c5d6f4ad98d0.
+    (fetchpatch {
+      name = "nheko-fmt10.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/nheko/-/raw/1b0d5c9eff6409dfd82953f346546d36c288a4a9/nheko-0.11.3-fix-for-fmt-10.patch";
+      hash = "sha256-UYqAu2iXT3Bn/MxCtybiJrJLfVMOOVRchWqrGuPfapI=";
+    })
+    # https://github.com/Nheko-Reborn/nheko/pull/1552
+    (fetchpatch {
+      name = "nheko-fmt10.1.patch";
+      url = "https://github.com/Nheko-Reborn/nheko/commit/614facf93c2b5d6118beb822cc542ac53a883c37.patch";
+      hash = "sha256-rjsQNDfj3Lzbv8ow3qiNozGXQFrtYLhArS6a9JCdgBQ=";
+    })
+  ];
+
  nativeBuildInputs = [
    asciidoc
    cmake
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "signal-cli";
-  version = "0.12.0";
+  version = "0.12.1";

  # Building from source would be preferred, but is much more involved.
  src = fetchurl {
    url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}-Linux.tar.gz";
-    hash = "sha256-PMLc0o+zwtdtY2p5z5xwdcawNKddenr64vmC+dxrw+Y=";
+    hash = "sha256-pxDSAVh/zg3hCuTlSuilgD4VKe1CPSG/ZLl0TF1nc1I=";
  };

  buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://github.com/AsamK/signal-cli";
    description = "Command-line and dbus interface for communicating with the Signal messaging service";
+    changelog = "https://github.com/AsamK/signal-cli/blob/v${version}/CHANGELOG.md";
    license = licenses.gpl3;
    maintainers = with maintainers; [ ivan ];
    platforms = platforms.all;
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -8,22 +8,24 @@
 , nodejs
 , fetchYarnDeps
 , fixup_yarn_lock
-, electron
+, electron_24
 , libpulseaudio
 , pipewire
 , alsa-utils
 , which
+, testers
+, teams-for-linux
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "teams-for-linux";
-  version = "1.3.2";
+  version = "1.3.8";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = "teams-for-linux";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-2WoTbkRGH9l6cQrveyxGvO/Dy+0NV4UTDaooYn8k06s=";
+    hash = "sha256-G0UBzSXoZPLHBsM0nslPLNBZs0sUAQYJ403nPV+3Qu4=";
  };

  offlineCache = fetchYarnDeps {
@ -50,8 +52,8 @@ stdenv.mkDerivation (finalAttrs: {

    yarn --offline electron-builder \
      --dir ${if stdenv.isDarwin then "--macos" else "--linux"} ${if stdenv.hostPlatform.isAarch64 then "--arm64" else "--x64"} \
-      -c.electronDist=${electron}/lib/electron \
-      -c.electronVersion=${electron.version}
+      -c.electronDist=${electron_24}/libexec/electron \
+      -c.electronVersion=${electron_24.version}

    runHook postBuild
  '';
@ -70,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
    popd

    # Linux needs 'aplay' for notification sounds, 'libpulse' for meeting sound, and 'libpipewire' for screen sharing
-    makeWrapper '${electron}/bin/electron' "$out/bin/teams-for-linux" \
+    makeWrapper '${electron_24}/bin/electron' "$out/bin/teams-for-linux" \
      ${lib.optionalString stdenv.isLinux ''
        --prefix PATH : ${lib.makeBinPath [ alsa-utils which ]} \
        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio pipewire ]} \
@ -91,12 +93,16 @@ stdenv.mkDerivation (finalAttrs: {
  })];

  passthru.updateScript = ./update.sh;
+  passthru.tests.version = testers.testVersion rec {
+    package = teams-for-linux;
+    command = "HOME=$TMPDIR ${package.meta.mainProgram or package.pname} --version";
+  };

  meta = {
    description = "Unofficial Microsoft Teams client for Linux";
    homepage = "https://github.com/IsmaelMartinez/teams-for-linux";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ muscaln lilyinstarlight ];
+    maintainers = with lib.maintainers; [ muscaln lilyinstarlight qjoly ];
    platforms = lib.platforms.unix;
    broken = stdenv.isDarwin;
  };
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@ -23,12 +23,12 @@ assert gpgmeSupport -> sslSupport;

 stdenv.mkDerivation rec {
  pname = "mutt";
-  version = "2.2.11";
+  version = "2.2.12";
  outputs = [ "out" "doc" "info" ];

  src = fetchurl {
    url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    hash = "sha256-EjJc9m1f+KxL2H+sjbUshp3lLdJ4/DAc/VfVofn0Zcw=";
+    hash = "sha256-BDrzEvZLjlb3/Qv3f4SiBdTEmAML2VhkV2ZcR7sYzjg=";
  };

  patches = [
@ -103,6 +103,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "A small but very powerful text-based mail client";
    homepage = "http://www.mutt.org";
+    mainProgram = "mutt";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
    maintainers = with maintainers; [ rnhmjoj ];
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -25,7 +25,7 @@

 mkDerivation rec {
  pname = "nextcloud-client";
-  version = "3.9.3";
+  version = "3.9.4";

  outputs = [ "out" "dev" ];

@ -33,7 +33,7 @@ mkDerivation rec {
    owner = "nextcloud";
    repo = "desktop";
    rev = "v${version}";
-    sha256 = "sha256-9DfQZ3AFyiUKwt8IqAgjQlQ2XJtwkLEtPM5+VH+x/6c=";
+    sha256 = "sha256-h8lOstl085haesmCmzq2o0OlQrO5U/mfGngQunynIuQ=";
  };

  patches = [
--- a/pkgs/applications/networking/p2p/lokinet/default.nix
+++ b/pkgs/applications/networking/p2p/lokinet/default.nix
@ -8,13 +8,20 @@
 , nlohmann_json
 , pkg-config
 , spdlog
+, fmt_9
 , sqlite
 , systemd
 , unbound
 , zeromq
 }:
+let
+  # Upstream has received reports of incompatibilities with fmt, and other
+  # dependencies, see: https://github.com/oxen-io/lokinet/issues/2200.
+  spdlog' = spdlog.override {
+    fmt = fmt_9;
+  };

-stdenv.mkDerivation rec {
+in stdenv.mkDerivation rec {
  pname = "lokinet";
  version = "0.9.11";

@ -36,7 +43,7 @@ stdenv.mkDerivation rec {
    libuv
    libsodium
    nlohmann_json
-    spdlog
+    spdlog'
    sqlite
    systemd
    unbound
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@ -5,18 +5,20 @@

 buildGoModule rec {
  pname = "storj-uplink";
-  version = "1.86.2";
+  version = "1.87.3";

  src = fetchFromGitHub {
    owner = "storj";
    repo = "storj";
    rev = "v${version}";
-    hash = "sha256-peWcgME+OCa9feNKLtTmZIGCpNxl+EdQfYDXV2BbclI=";
+    hash = "sha256-16h7PzZVFnaHMyODLk9tSrW8OiXQlcuDobANG1ZQVxs=";
  };

  subPackages = [ "cmd/uplink" ];

-  vendorHash = "sha256-sBez/IQzRIGQdOXr4Ikxh+dT8IQxtbxau5vo9VqGJvE=";
+  vendorHash = "sha256-gskOhLdrRzbvZwuOlm04fjeSXhNr/cqVGejEPZVtuBk=";
+
+  ldflags = [ "-s" "-w" ];

  meta = with lib; {
    description = "Command-line tool for Storj";
--- a/pkgs/applications/office/appflowy/default.nix
+++ b/pkgs/applications/office/appflowy/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "appflowy";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchzip {
    url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${version}/AppFlowy_x86_64-unknown-linux-gnu_ubuntu-20.04.tar.gz";
-    sha256 = "sha256-05RQtvf6I4/sjGtMDfc5U4esxfFFeTwIuxFAkbr6p4A";
+    hash = "sha256-jIekGA+MG9tvjEyHAI3dcD7lI1JL/qPqRpVO9gRhcTw=";
    stripRoot = false;
  };

--- a/pkgs/applications/office/onlyoffice-bin/default.nix
+++ b/pkgs/applications/office/onlyoffice-bin/default.nix
@ -177,6 +177,10 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
+    longDescription = ''
+      The latest versions of OnlyOffice are currently broken on wlroots environments (e.g. Hyprland, Sway).
+      If you are using a different environment, you can get the latest version using `onlyoffice-bin_latest`.
+    '';
    homepage = "https://www.onlyoffice.com/";
    downloadPage = "https://github.com/ONLYOFFICE/DesktopEditors/releases";
    changelog = "https://github.com/ONLYOFFICE/DesktopEditors/blob/master/CHANGELOG.md";
--- a/pkgs/applications/office/onlyoffice-bin/7_4.nix
+++ b/pkgs/applications/office/onlyoffice-bin/7_4.nix
@ -0,0 +1,215 @@
+{ stdenv
+, lib
+, fetchurl
+, buildFHSEnv
+  # Alphabetic ordering below
+, alsa-lib
+, at-spi2-atk
+, atk
+, autoPatchelfHook
+, cairo
+, curl
+, dbus
+, dconf
+, dpkg
+, fontconfig
+, gcc-unwrapped
+, gdk-pixbuf
+, glib
+, glibc
+, gsettings-desktop-schemas
+, gst_all_1
+, gtk2
+, gtk3
+, libpulseaudio
+, libudev0-shim
+, libdrm
+, makeWrapper
+, mesa
+, nspr
+, nss
+, pulseaudio
+, qt5
+, wrapGAppsHook
+, xkeyboard_config
+, xorg
+}:
+let
+
+  # Note on fonts:
+  #
+  # OnlyOffice does not distribute unfree fonts, but makes it easy to pick up
+  # any fonts you install. See:
+  #
+  # * https://helpcenter.onlyoffice.com/en/installation/docs-community-install-fonts-linux.aspx
+  # * https://www.onlyoffice.com/blog/2020/04/how-to-add-new-fonts-to-onlyoffice-desktop-editors/
+  #
+  # As recommended there, you should download
+  #
+  #     arial.ttf, calibri.ttf, cour.ttf, symbol.ttf, times.ttf, wingding.ttf
+  #
+  # into `~/.local/share/fonts/`, otherwise the default template fonts, and
+  # things like bullet points, will not look as expected.
+
+  # TODO: Find out which of these fonts we'd be allowed to distribute along
+  #       with this package, or how to make this easier for users otherwise.
+
+  # Not using the `noto-fonts-cjk` package from nixpkgs, because it was
+  # reported that its `.ttc` file is not picked up by OnlyOffice, see:
+  # https://github.com/NixOS/nixpkgs/pull/116343#discussion_r593979816
+  noto-fonts-cjk = fetchurl {
+    url =
+      let
+        version = "v20201206-cjk";
+      in
+      "https://github.com/googlefonts/noto-cjk/raw/${version}/NotoSansCJKsc-Regular.otf";
+    sha256 = "sha256-aJXSVNJ+p6wMAislXUn4JQilLhimNSedbc9nAuPVxo4=";
+  };
+
+  runtimeLibs = lib.makeLibraryPath [
+    curl
+    glibc
+    gcc-unwrapped.lib
+    libudev0-shim
+    pulseaudio
+  ];
+
+  derivation = stdenv.mkDerivation rec {
+    pname = "onlyoffice-desktopeditors";
+    version = "7.4.1";
+    minor = null;
+    src = fetchurl {
+      url = "https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v${version}/onlyoffice-desktopeditors_amd64.deb";
+      sha256 = "sha256-vaBF3GJyLBldWdEruOeVpRvwGNwaRl7IKPguDLRoe8M=";
+    };
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+      dpkg
+      makeWrapper
+      wrapGAppsHook
+    ];
+
+    buildInputs = [
+      alsa-lib
+      at-spi2-atk
+      atk
+      cairo
+      dbus
+      dconf
+      fontconfig
+      gdk-pixbuf
+      glib
+      gsettings-desktop-schemas
+      gst_all_1.gst-plugins-base
+      gst_all_1.gstreamer
+      gtk2
+      gtk3
+      libpulseaudio
+      libdrm
+      nspr
+      nss
+      mesa # libgbm
+      qt5.qtbase
+      qt5.qtdeclarative
+      qt5.qtsvg
+      qt5.qtwayland
+      xorg.libX11
+      xorg.libxcb
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXi
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXScrnSaver
+      xorg.libXtst
+    ];
+
+    dontWrapQtApps = true;
+
+    unpackPhase = ''
+      dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner
+    '';
+
+    preConfigure = ''
+      cp --no-preserve=mode,ownership ${noto-fonts-cjk} opt/onlyoffice/desktopeditors/fonts/
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{bin,lib,share}
+
+      mv usr/bin/* $out/bin
+      mv usr/share/* $out/share/
+      mv opt/onlyoffice/desktopeditors $out/share
+
+      for f in $out/share/desktopeditors/asc-de-*.png; do
+        size=$(basename "$f" ".png" | cut -d"-" -f3)
+        res="''${size}x''${size}"
+        mkdir -pv "$out/share/icons/hicolor/$res/apps"
+        ln -s "$f" "$out/share/icons/hicolor/$res/apps/onlyoffice-desktopeditors.png"
+      done;
+
+      substituteInPlace $out/bin/onlyoffice-desktopeditors \
+        --replace "/opt/onlyoffice/" "$out/share/"
+
+      ln -s $out/share/desktopeditors/DesktopEditors $out/bin/DesktopEditors
+
+      runHook postInstall
+    '';
+
+    preFixup = ''
+      gappsWrapperArgs+=(
+        --prefix LD_LIBRARY_PATH : "${runtimeLibs}" \
+        --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb" \
+        --set QTCOMPOSE "${xorg.libX11.out}/share/X11/locale" \
+        --set QT_QPA_PLATFORM "xcb"
+        # the bundled version of qt does not support wayland
+      )
+    '';
+
+    passthru.updateScript = ./update.sh;
+  };
+
+in
+
+# In order to download plugins, OnlyOffice uses /usr/bin/curl so we have to wrap it.
+# Curl still needs to be in runtimeLibs because the library is used directly in other parts of the code.
+buildFHSEnv {
+  name = derivation.name;
+
+  targetPkgs = pkgs': [
+    curl
+    derivation
+  ];
+
+  runScript = "/bin/onlyoffice-desktopeditors";
+
+  extraInstallCommands = ''
+    mv $out/bin/$name $out/bin/onlyoffice-desktopeditors
+    mkdir -p $out/share
+    ln -s ${derivation}/share/icons $out/share
+    cp -r ${derivation}/share/applications $out/share
+    substituteInPlace $out/share/applications/onlyoffice-desktopeditors.desktop \
+        --replace "/usr/bin/onlyoffice-desktopeditors" "$out/bin/onlyoffice-desktopeditors"
+  '';
+
+  meta = with lib; {
+    description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
+    longDescription = ''
+      This version is broken on wlroots environments (e.g. Hyprland, Sway).
+      If you are using one of these environments, please use `onlyoffice-bin` instead.
+    '';
+    homepage = "https://www.onlyoffice.com/";
+    downloadPage = "https://github.com/ONLYOFFICE/DesktopEditors/releases";
+    changelog = "https://github.com/ONLYOFFICE/DesktopEditors/blob/master/CHANGELOG.md";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ nh2 gtrunsec ];
+  };
+}
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 # Remove gcc and python references
 , removeReferencesTo
@ -299,6 +300,12 @@ stdenv.mkDerivation {
  patches = [
    # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
    ./modtool-newmod-permissions.patch
+    # https://github.com/gnuradio/gnuradio/pull/6808
+    (fetchpatch {
+      name = "gnuradio-fmt10.1.patch";
+      url = "https://github.com/gnuradio/gnuradio/commit/9357c17721a27cc0aae3fe809af140c84e492f37.patch";
+      hash = "sha256-w3b22PTqoORyYQ3RKRG+2htQWbITzQiOdSDyuejUtHQ=";
+    })
  ];
  passthru = shared.passthru // {
    # Deps that are potentially overridden and are used inside GR plugins - the same version must
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@ -41,22 +41,24 @@
 , qtwebengine
 , rtl-sdr
 , serialdv
+, sdrplay
 , sgp4
 , soapysdr-with-plugins
 , uhd
 , wrapQtAppsHook
 , zlib
+, withSDRplay ? false
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "sdrangel";
-  version = "7.15.2";
+  version = "7.15.4";

  src = fetchFromGitHub {
    owner = "f4exb";
    repo = "sdrangel";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Yvf0LJu7YbXhW3i0fd5R2KVn2dkx484AZ0XaWhjozFE=";
+    hash = "sha256-oSFnoNmoXvdb5lpx/j3DVVhOfbsDZlGNZNcvud1w8Ks=";
  };

  nativeBuildInputs = [
@ -108,7 +110,8 @@ stdenv.mkDerivation (finalAttrs: {
    soapysdr-with-plugins
    uhd
    zlib
-  ];
+  ]
+  ++ lib.optionals withSDRplay [ sdrplay ];

  cmakeFlags = [
    "-DAPT_DIR=${aptdec}"
--- a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
+++ b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
@ -67,6 +67,12 @@ in stdenv.mkDerivation rec {
      url = "https://github.com/emsec/hal/commit/37d5c1a0eacb25de57cc552c13e74f559a5aa6e8.patch";
      hash = "sha256-a30VjDt4roJOTntisixqnH17wwCgWc4VWeh1+RgqFuY=";
    })
+    (fetchpatch {
+      name = "hal-fix-fmt-10.1-compat.patch";
+      # https://github.com/emsec/hal/pull/530
+      url = "https://github.com/emsec/hal/commit/b639a56b303141afbf6731b70b7cc7452551f024.patch";
+      hash = "sha256-a7AyDEKkqdbiHpa4OHTRuP9Yewb3Nxs/j6bwez5m0yU=";
+    })
  ];

  # make sure bundled dependencies don't get in the way - install also otherwise
@ -126,6 +132,7 @@ in stdenv.mkDerivation rec {
  '';

  meta = with lib; {
+    broken = stdenv.isDarwin;
    description = "A comprehensive reverse engineering and manipulation framework for gate-level netlists";
    homepage = "https://github.com/emsec/hal";
    license = licenses.mit;
--- a/pkgs/applications/science/electronics/openroad/0001-Disable-failing-regression-tests.patch
+++ b/pkgs/applications/science/electronics/openroad/0001-Disable-failing-regression-tests.patch
@ -0,0 +1,83 @@
+From dc32aabd50d53aece41d968649b972ee667875bb Mon Sep 17 00:00:00 2001
+From: Tobias Mayer <tobim@fastmail.fm>
+Date: Sun, 27 Aug 2023 15:08:50 +0200
+Subject: [PATCH] Disable failing regression tests
+
+---
+ src/drt/test/regression_tests.tcl | 6 +++---
+ src/odb/test/regression_tests.tcl | 4 ++--
+ src/par/test/regression_tests.tcl | 2 +-
+ src/pdn/test/regression_tests.tcl | 2 +-
+ src/rcx/test/regression_tests.tcl | 6 +++---
+ 5 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/src/drt/test/regression_tests.tcl b/src/drt/test/regression_tests.tcl
+index 11705562d..15546244a 100644
+--- a/src/drt/test/regression_tests.tcl
+++ b/src/drt/test/regression_tests.tcl
+@@ -9,6 +9,6 @@ record_tests {
+   top_level_term
+   top_level_term2
+ }
+-record_pass_fail_tests {
+-  gc_test
+-}
+#record_pass_fail_tests {
+#  gc_test
+#}
+diff --git a/src/odb/test/regression_tests.tcl b/src/odb/test/regression_tests.tcl
+index b8e4f917a..7c6a0223a 100644
+--- a/src/odb/test/regression_tests.tcl
+++ b/src/odb/test/regression_tests.tcl
+@@ -34,9 +34,9 @@ record_tests {
+ }
+ 
+ record_pass_fail_tests {
+-  cpp_tests
+  #cpp_tests
+   dump_netlists
+   dump_netlists_withfill
+-  parser_unit_test
+  #parser_unit_test
+ }
+ 
+diff --git a/src/par/test/regression_tests.tcl b/src/par/test/regression_tests.tcl
+index 9ff31fb12..63d5d0dae 100644
+--- a/src/par/test/regression_tests.tcl
+++ b/src/par/test/regression_tests.tcl
+@@ -1,4 +1,4 @@
+ record_tests {
+   read_part
+-  partition_gcd
+  #partition_gcd
+ }
+diff --git a/src/pdn/test/regression_tests.tcl b/src/pdn/test/regression_tests.tcl
+index 86c334f24..b695c490c 100644
+--- a/src/pdn/test/regression_tests.tcl
+++ b/src/pdn/test/regression_tests.tcl
+@@ -10,7 +10,7 @@ record_tests {
+   max_width
+   min_spacing
+   widthtable
+-  design_width
+  #design_width
+   offgrid
+ 
+   core_grid
+diff --git a/src/rcx/test/regression_tests.tcl b/src/rcx/test/regression_tests.tcl
+index 7070cc45f..72f348d96 100644
+--- a/src/rcx/test/regression_tests.tcl
+++ b/src/rcx/test/regression_tests.tcl
+@@ -6,6 +6,6 @@ record_tests {
+   45_gcd
+   names
+ }
+-record_pass_fail_tests {
+-  rcx_unit_test
+-}
+#record_pass_fail_tests {
+#  rcx_unit_test
+#}
+-- 
+2.41.0
+
--- a/pkgs/applications/science/electronics/openroad/0001-Fix-string-formatting-in-tests.patch
+++ b/pkgs/applications/science/electronics/openroad/0001-Fix-string-formatting-in-tests.patch
@ -1,53 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nicolas Benes <nbenes.gh@xandea.de>
-Date: Sun, 2 Apr 2023 01:24:51 +0200
-Subject: [PATCH] Fix string formatting in tests
-
-Hide the decimal point and digits after the decimal point when they are
-not needed.
-
-diff --git a/src/par/test/partition_gcd.ok b/src/par/test/partition_gcd.ok
-index 6c40c14..b9a42f6 100644
--- a/src/par/test/partition_gcd.ok
-+++ b/src/par/test/partition_gcd.ok
-@@ -9,7 +9,7 @@
- ========================================
- [INFO] Partitioning parameters**** 
- [PARAM] Number of partitions = 2
-[PARAM] UBfactor = 1.0
-+[PARAM] UBfactor = 1
- [PARAM] Vertex dimensions = 1
- [PARAM] Hyperedge dimensions = 1
- ========================================
-@@ -118,7 +118,7 @@ After Hyperedge Reduction :  num_vertices = 137, num_hyperedges = 251
- [V-Refine] Level 2 :: 207, 301, 154.65254
- [V-Refine] Level 3 :: 312, 370, 154.65254
- [V-Refine] Level 4 :: 469, 451, 154.65254
-[INFO] V-cycle refinement 1 delta cost 0.0
-+[INFO] V-cycle refinement 1 delta cost 0
- =========================================
- [STATUS] Running FC multilevel coarsening 
- =========================================
-@@ -133,7 +133,7 @@ After Hyperedge Reduction :  num_vertices = 137, num_hyperedges = 251
- [V-Refine] Level 2 :: 207, 301, 154.65254
- [V-Refine] Level 3 :: 312, 370, 154.65254
- [V-Refine] Level 4 :: 469, 451, 154.65254
-[INFO] V-cycle refinement 2 delta cost 0.0
-+[INFO] V-cycle refinement 2 delta cost 0
- [Cutcost of partition : 154.65254]
- [Vertex balance of block_0 : 0.59249  ( 327.17993 )    
- [Vertex balance of block_1 : 0.40751  ( 225.03609 )    
-diff --git a/src/pdn/test/design_width.ok b/src/pdn/test/design_width.ok
-index 381dca1..a102974 100644
--- a/src/pdn/test/design_width.ok
-+++ b/src/pdn/test/design_width.ok
-@@ -9,5 +9,5 @@
- [INFO ODB-0130]     Created 54 pins.
- [INFO ODB-0131]     Created 406 components and 1816 component-terminals.
- [INFO ODB-0133]     Created 361 nets and 1004 connections.
-[ERROR PDN-0185] Insufficient width (14.04 um) to add straps on layer M8 in grid "Core" with total strap width 6.0 um and offset 10.0 um.
-+[ERROR PDN-0185] Insufficient width (14.04 um) to add straps on layer M8 in grid "Core" with total strap width 6 um and offset 10 um.
- PDN-0185
-- 
-2.38.4
-
--- a/pkgs/applications/science/electronics/openroad/default.nix
+++ b/pkgs/applications/science/electronics/openroad/default.nix
@ -1,6 +1,7 @@
 { lib
 , mkDerivation
 , fetchFromGitHub
+, fetchpatch
 , bison
 , cmake
 , doxygen
@ -34,14 +35,14 @@

 mkDerivation rec {
  pname = "openroad";
-  version = "unstable-2023-03-31";
+  version = "unstable-2023-08-26";

  src = fetchFromGitHub {
    owner = "The-OpenROAD-Project";
    repo = "OpenROAD";
-    rev = "cd03c5cf8a8eb78c0e07fe33a56b8e9d64672efe";
+    rev = "6dba515c2aacd3fca58ef8135424884146efd95b";
    fetchSubmodules = true;
-    hash = "sha256-BWUvFCuWKWQpifErpak03J+A7ni0jZWIrCMhMdKIbD0=";
+    hash = "sha256-LAj7X+Vq0+H3tIo5zgyUuIjQwTj+2DLL18/KMJ/kf4A=";
  };

  nativeBuildInputs = [
@ -79,7 +80,16 @@ mkDerivation rec {
  ];

  patches = [
-    ./0001-Fix-string-formatting-in-tests.patch
+    # https://github.com/The-OpenROAD-Project/OpenROAD/pull/3911
+    (fetchpatch {
+      name = "openroad-fix-fmt-10.patch";
+      url = "https://github.com/The-OpenROAD-Project/OpenROAD/commit/9396f07f28e0260cd64acfc51909f6566b70e682.patch";
+      hash = "sha256-jy8K8pdhSswVz6V6otk8JAI7nndaFVMuKQ/4A3Kzwns=";
+    })
+    # Upstream is not aware of these failures
+    ./0001-Disable-failing-regression-tests.patch
+    # This is an issue we experience in the sandbox, and upstream
+    # probably wouldn't mind merging this change, but no PR was opened.
    ./0002-Ignore-warning-on-stderr.patch
  ];

@ -89,20 +99,17 @@ mkDerivation rec {

  # Enable output images from the placer.
  cmakeFlags = [
+    # Tries to download gtest 1.13 as part of the build. We currently rely on
+    # the regression tests so we can get by without building unit tests.
+    "-DENABLE_TESTS=OFF"
    "-DUSE_SYSTEM_BOOST=ON"
    "-DUSE_CIMG_LIB=ON"
    "-DOPENROAD_VERSION=${src.rev}"
-
-    # 2023-03-31: see discussion on fmt workaround in
-    # https://github.com/The-OpenROAD-Project/OpenROAD/pull/2696
-    "-DCMAKE_CXX_FLAGS=-DFMT_DEPRECATED_OSTREAM"
  ];

  # Resynthesis needs access to the Yosys binaries.
  qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ yosys ]}" ];

-  checkInputs = [ gtest ];
-
  # Upstream uses vendored package versions for some dependencies, so regression testing is prudent
  # to see if there are any breaking changes in unstable that should be vendored as well.
  doCheck = true;
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
  pname = "forgejo";
-  version = "1.20.3-0";
+  version = "1.20.4-0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "forgejo";
    repo = "forgejo";
    rev = "v${version}";
-    hash = "sha256-pMmP9JJHbaqkHHgtZf2ZgEtXsX97EV0VXiTPT7Lf4P8=";
+    hash = "sha256-guKU3VG1Wyhr5p6w0asL/CopQ5b7HiNi26Tw8WCEpwE=";
  };

  vendorHash = "sha256-dgtZjsLBwblhdge3BvdbK/mN/TeZKps9K5dJbqomtjo=";
--- a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "gitlab-container-registry";
-  version = "3.82.0";
+  version = "3.83.0";
  rev = "v${version}-gitlab";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "container-registry";
    inherit rev;
-    sha256 = "sha256-umlpGpeN7sWe8524+wjdYYJegLdc+eQqlgySLWL0a+k=";
+    sha256 = "sha256-HYyPe4x8hwtKAr0r4dGUbIyiLRQKtlWQ4Pt2mtbQmZM=";
  };

-  vendorHash = "sha256-hFGuzTM9+Zb8BmUoFG059eqM53AzOmi1DeBnF68WSoc=";
+  vendorHash = "sha256-OX8drOl8D30gYFnLzZe9i1whguXe0QFhsLpP9G9seuk=";

  patches = [
    ./Disable-inmemory-storage-driver-test.patch
--- a/pkgs/applications/virtualization/podman-desktop/default.nix
+++ b/pkgs/applications/virtualization/podman-desktop/default.nix
@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
    yarn --offline run build
    yarn --offline run electron-builder --dir \
      --config .electron-builder.config.cjs \
-      -c.electronDist=${electron}/lib/electron \
+      -c.electronDist=${electron}/libexec/electron \
      -c.electronVersion=${electron.version}

    runHook postBuild
--- a/pkgs/applications/window-managers/windowmaker/default.nix
+++ b/pkgs/applications/window-managers/windowmaker/default.nix
@ -1,43 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config
-, libX11, libXext, libXft, libXmu, libXinerama, libXrandr, libXpm
-, imagemagick, libpng, libjpeg, libexif, libtiff, giflib, libwebp }:
-
-stdenv.mkDerivation rec {
-  pname = "windowmaker";
-  version = "0.95.9";
-  srcName = "WindowMaker-${version}";
-
-  src = fetchurl {
-    url = "http://windowmaker.org/pub/source/release/${srcName}.tar.gz";
-    sha256 = "055pqvlkhipyjn7m6bb3fs4zz9rd1ynzl0mmwbhp05ihc3zmh8zj";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ libX11 libXext libXft libXmu libXinerama libXrandr libXpm
-                  imagemagick libpng libjpeg libexif libtiff giflib libwebp ];
-
-  configureFlags = [
-    "--with-x"
-    "--enable-modelock"
-    "--enable-randr"
-    "--enable-webp"
-    "--disable-magick" # Many distros reported imagemagick fails to be found
-  ];
-
-  meta = with lib; {
-    homepage = "http://windowmaker.org/";
-    description = "NeXTSTEP-like window manager";
-    longDescription = ''
-      Window Maker is an X11 window manager originally designed to
-      provide integration support for the GNUstep Desktop
-      Environment. In every way possible, it reproduces the elegant look
-      and feel of the NEXTSTEP user interface. It is fast, feature rich,
-      easy to configure, and easy to use. It is also free software, with
-      contributions being made by programmers from around the world.
-    '';
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.AndersonTorres ];
-  };
-}
--- a/pkgs/by-name/ai/airscan/package.nix
+++ b/pkgs/by-name/ai/airscan/package.nix
@ -0,0 +1,26 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "airscan";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "stapelberg";
+    repo = "airscan";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-gk0soDzrsFBh+SrWcfO/quW6JweX6MthOigTHcaq1oE=";
+  };
+
+  vendorHash = "sha256-I5JRGaff6OIwx4q7BjpFwvJiQe4kw03V8+McYPcJhho=";
+
+  meta = with lib; {
+    description = "Package to scan paper documents using the Apple AirScan (eSCL) protocol";
+    homepage = "https://github.com/stapelberg/airscan";
+    changelog = "https://github.com/stapelberg/airscan/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ johannwagner ];
+  };
+}
--- a/pkgs/applications/emulators/bochs/default.nix
+++ b/pkgs/applications/emulators/bochs/default.nix
@ -3,6 +3,7 @@
 , fetchurl
 , SDL2
 , curl
+, darwin
 , docbook_xml_dtd_45
 , docbook_xsl
 , gtk3
@ -10,13 +11,12 @@
 , libGLU
 , libX11
 , libXpm
-, libobjc
 , libtool
 , ncurses
 , pkg-config
 , readline
 , wget
-, wxGTK
+, wxGTK32
 , enableSDL2 ? true
 , enableTerm ? true
 , enableWx ? !stdenv.isDarwin
@ -49,14 +49,14 @@ stdenv.mkDerivation (finalAttrs: {
    ncurses
  ] ++ lib.optionals enableWx [
    gtk3
-    wxGTK
+    wxGTK32
  ] ++ lib.optionals enableX11 [
    libGL
    libGLU
    libX11
    libXpm
  ] ++ lib.optionals stdenv.isDarwin [
-    libobjc
+    darwin.libobjc
  ];

  configureFlags = [
@ -134,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

-  meta = with lib; {
+  meta = {
    homepage = "https://bochs.sourceforge.io/";
    description = "An open-source IA-32 (x86) PC emulator";
    longDescription = ''
@ -142,9 +142,9 @@ stdenv.mkDerivation (finalAttrs: {
      in C++, that runs on most popular platforms. It includes emulation of the
      Intel x86 CPU, common I/O devices, and a custom BIOS.
    '';
-    license = licenses.lgpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.unix;
+    license = lib.licenses.lgpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
  };
 })
 # TODO: a better way to organize the options
--- a/pkgs/by-name/tc/tcsh/package.nix
+++ b/pkgs/by-name/tc/tcsh/package.nix
--- a/pkgs/by-name/up/upiano/package.nix
+++ b/pkgs/by-name/up/upiano/package.nix
@ -0,0 +1,38 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "upiano";
+  version = "0.1.2";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "eliasdorneles";
+    repo = "upiano";
+    rev = "v${version}";
+    hash = "sha256-5WhflvUCjzW4ZJ+PLUTMbKcUnQa3ChkDjl0R5YvjBWk=";
+    forceFetchGit = true;
+    fetchLFS = true;
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pyfluidsynth
+    textual
+  ];
+
+  pythonImportsCheck = [ "upiano" ];
+
+  meta = with lib; {
+    description = "A Piano in your terminal";
+    homepage = "https://github.com/eliasdorneles/upiano";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "upiano";
+  };
+}
--- a/pkgs/applications/window-managers/windowmaker/dockapps/AlsaMixer-app.nix
+++ b/pkgs/applications/window-managers/windowmaker/dockapps/AlsaMixer-app.nix
--- a/pkgs/applications/window-managers/windowmaker/dockapps/default.nix
+++ b/pkgs/applications/window-managers/windowmaker/dockapps/default.nix
--- a/pkgs/applications/window-managers/windowmaker/dockapps/libdockapp.nix
+++ b/pkgs/applications/window-managers/windowmaker/dockapps/libdockapp.nix
--- a/pkgs/applications/window-managers/windowmaker/dockapps/wmCalClock.nix
+++ b/pkgs/applications/window-managers/windowmaker/dockapps/wmCalClock.nix
--- a/pkgs/applications/window-managers/windowmaker/dockapps/wmsm-app.nix
+++ b/pkgs/applications/window-managers/windowmaker/dockapps/wmsm-app.nix
--- a/pkgs/applications/window-managers/windowmaker/dockapps/wmsystemtray.nix
+++ b/pkgs/applications/window-managers/windowmaker/dockapps/wmsystemtray.nix
--- a/pkgs/by-name/wi/windowmaker/package.nix
+++ b/pkgs/by-name/wi/windowmaker/package.nix
@ -0,0 +1,82 @@
+{ lib
+, stdenv
+, fetchFromRepoOrCz
+, autoreconfHook
+, pkg-config
+, imagemagick
+, libX11
+, libXext
+, libXft
+, libXinerama
+, libXmu
+, libXpm
+, libXrandr
+, libXres
+, libexif
+, libjpeg
+, libpng
+, libtiff
+, giflib
+, libwebp
+, pango
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "windowmaker";
+  version = "0.96.0";
+
+  src = fetchFromRepoOrCz {
+    repo = "wmaker-crm";
+    rev = "wmaker-${finalAttrs.version}";
+    hash = "sha256-6DS5KztCNWPQL6/qJ5vlkOup2ourxSNf6LLTFYpPWi8=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    giflib
+    imagemagick
+    libX11
+    libXext
+    libXft
+    libXinerama
+    libXmu
+    libXpm
+    libXrandr
+    libXres
+    libexif
+    libjpeg
+    libpng
+    libtiff
+    libwebp
+    pango
+  ];
+
+  configureFlags = [
+    "--enable-modelock"
+    "--enable-randr"
+    "--enable-webp"
+    "--with-x"
+  ];
+
+  meta = {
+    homepage = "http://windowmaker.org/";
+    description = "NeXTSTEP-like window manager";
+    longDescription = ''
+      Window Maker is an X11 window manager originally designed to provide
+      integration support for the GNUstep Desktop Environment. In every way
+      possible, it reproduces the elegant look and feel of the NEXTSTEP user
+      interface. It is fast, feature rich, easy to configure, and easy to
+      use. It is also free software, with contributions being made by
+      programmers from around the world.
+    '';
+    changelog = "https://www.windowmaker.org/news/";
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "wmaker";
+    maintainers = [ lib.maintainers.AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/desktops/expidus/file-manager/default.nix
+++ b/pkgs/desktops/expidus/file-manager/default.nix
@ -1,17 +1,21 @@
 { lib, flutter, fetchFromGitHub }:
 flutter.buildFlutterApplication rec {
  pname = "expidus-file-manager";
-  version = "0.2.0";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "ExpidusOS";
    repo = "file-manager";
    rev = version;
-    hash = "sha256-p/bKVC1LpvVcyI3NYjQ//QL/6UutjVg649IZSmz4w9g=";
+    hash = "sha256-R6eszy4Dz8tAPRTwZzRiZWIgVMiGv5zlhFB/HcD6gqg=";
  };

+  flutterBuildFlags = [
+    "--dart-define=COMMIT_HASH=b4181b9cff18a07e958c81d8f41840d2d36a6705"
+  ];
+
  depsListFile = ./deps.json;
-  vendorHash = "sha256-7d8hsqXD7oqUN8VjQczSCyqytubDRq0os8wGnOfdSvs=";
+  vendorHash = "sha256-JFAX8Tq4vhX801WAxMrsc20tsSrwQhQduYCkeU67OTw=";

  postInstall = ''
    rm $out/bin/file_manager
--- a/pkgs/desktops/expidus/file-manager/deps.json
+++ b/pkgs/desktops/expidus/file-manager/deps.json
@ -1,7 +1,7 @@
 [
  {
    "name": "file_manager",
-    "version": "0.2.0+65656565656565",
+    "version": "0.2.1+65656565656565",
    "kind": "root",
    "source": "root",
    "dependencies": [
@ -38,7 +38,7 @@
  },
  {
    "name": "flutter_lints",
-    "version": "2.0.1",
+    "version": "2.0.2",
    "kind": "dev",
    "source": "hosted",
    "dependencies": [
@ -301,7 +301,7 @@
  },
  {
    "name": "ffi",
-    "version": "2.0.2",
+    "version": "2.1.0",
    "kind": "direct",
    "source": "hosted",
    "dependencies": []
@ -319,7 +319,7 @@
  },
  {
    "name": "plugin_platform_interface",
-    "version": "2.1.4",
+    "version": "2.1.5",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -375,7 +375,7 @@
  },
  {
    "name": "flutter_adaptive_scaffold",
-    "version": "0.1.5",
+    "version": "0.1.6",
    "kind": "direct",
    "source": "hosted",
    "dependencies": [
@ -384,7 +384,7 @@
  },
  {
    "name": "flutter_markdown",
-    "version": "0.6.15",
+    "version": "0.6.17+1",
    "kind": "direct",
    "source": "hosted",
    "dependencies": [
@ -396,7 +396,7 @@
  },
  {
    "name": "markdown",
-    "version": "7.1.0",
+    "version": "7.1.1",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -493,7 +493,7 @@
  },
  {
    "name": "sentry_flutter",
-    "version": "7.7.0",
+    "version": "7.9.0",
    "kind": "direct",
    "source": "hosted",
    "dependencies": [
@ -506,7 +506,7 @@
  },
  {
    "name": "sentry",
-    "version": "7.7.0",
+    "version": "7.9.0",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -536,7 +536,7 @@
  },
  {
    "name": "path_provider_platform_interface",
-    "version": "2.0.6",
+    "version": "2.1.0",
    "kind": "direct",
    "source": "hosted",
    "dependencies": [
@ -554,7 +554,7 @@
  },
  {
    "name": "path_provider_windows",
-    "version": "2.1.7",
+    "version": "2.2.0",
    "kind": "direct",
    "source": "hosted",
    "dependencies": [
@ -567,7 +567,7 @@
  },
  {
    "name": "permission_handler",
-    "version": "10.3.0",
+    "version": "10.4.3",
    "kind": "direct",
    "source": "hosted",
    "dependencies": [
@ -581,7 +581,7 @@
  },
  {
    "name": "permission_handler_platform_interface",
-    "version": "3.10.0",
+    "version": "3.11.3",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -592,7 +592,7 @@
  },
  {
    "name": "permission_handler_windows",
-    "version": "0.1.2",
+    "version": "0.1.3",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -602,7 +602,7 @@
  },
  {
    "name": "permission_handler_apple",
-    "version": "9.1.0",
+    "version": "9.1.4",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -612,7 +612,7 @@
  },
  {
    "name": "permission_handler_android",
-    "version": "10.2.3",
+    "version": "10.3.3",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -632,7 +632,7 @@
  },
  {
    "name": "shared_preferences",
-    "version": "2.1.2",
+    "version": "2.2.0",
    "kind": "direct",
    "source": "hosted",
    "dependencies": [
@ -647,7 +647,7 @@
  },
  {
    "name": "shared_preferences_windows",
-    "version": "2.2.0",
+    "version": "2.3.0",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -661,7 +661,7 @@
  },
  {
    "name": "shared_preferences_platform_interface",
-    "version": "2.2.0",
+    "version": "2.3.0",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -681,7 +681,7 @@
  },
  {
    "name": "shared_preferences_web",
-    "version": "2.1.0",
+    "version": "2.2.0",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -692,7 +692,7 @@
  },
  {
    "name": "shared_preferences_linux",
-    "version": "2.2.0",
+    "version": "2.3.0",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -706,7 +706,7 @@
  },
  {
    "name": "path_provider_linux",
-    "version": "2.1.11",
+    "version": "2.2.0",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -719,29 +719,17 @@
  },
  {
    "name": "xdg_directories",
-    "version": "1.0.0",
+    "version": "1.0.2",
    "kind": "direct",
    "source": "hosted",
    "dependencies": [
      "meta",
-      "path",
-      "process"
-    ]
-  },
-  {
-    "name": "process",
-    "version": "4.2.4",
-    "kind": "transitive",
-    "source": "hosted",
-    "dependencies": [
-      "file",
-      "path",
-      "platform"
+      "path"
    ]
  },
  {
    "name": "shared_preferences_foundation",
-    "version": "2.2.2",
+    "version": "2.3.2",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -751,7 +739,7 @@
  },
  {
    "name": "shared_preferences_android",
-    "version": "2.1.4",
+    "version": "2.2.0",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -860,7 +848,7 @@
  },
  {
    "name": "url_launcher",
-    "version": "6.1.11",
+    "version": "6.1.12",
    "kind": "direct",
    "source": "hosted",
    "dependencies": [
@ -876,7 +864,7 @@
  },
  {
    "name": "url_launcher_windows",
-    "version": "3.0.6",
+    "version": "3.0.7",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -886,7 +874,7 @@
  },
  {
    "name": "url_launcher_platform_interface",
-    "version": "2.1.2",
+    "version": "2.1.3",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -896,7 +884,7 @@
  },
  {
    "name": "url_launcher_web",
-    "version": "2.0.17",
+    "version": "2.0.18",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -907,7 +895,7 @@
  },
  {
    "name": "url_launcher_macos",
-    "version": "3.0.5",
+    "version": "3.0.6",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -937,7 +925,7 @@
  },
  {
    "name": "url_launcher_android",
-    "version": "6.0.35",
+    "version": "6.0.38",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -947,7 +935,7 @@
  },
  {
    "name": "path_provider",
-    "version": "2.0.15",
+    "version": "2.1.0",
    "kind": "direct",
    "source": "hosted",
    "dependencies": [
@ -961,7 +949,7 @@
  },
  {
    "name": "path_provider_foundation",
-    "version": "2.2.3",
+    "version": "2.3.0",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
@ -971,7 +959,7 @@
  },
  {
    "name": "path_provider_android",
-    "version": "2.0.27",
+    "version": "2.1.0",
    "kind": "transitive",
    "source": "hosted",
    "dependencies": [
--- a/pkgs/development/compilers/rust/1_72.nix
+++ b/pkgs/development/compilers/rust/1_72.nix
@ -57,4 +57,4 @@ import ./default.nix {
  rustcPatches = [ ];
 }

-(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildBuild" "pkgsBuildHost" "llvmPackages_16" "llvm_16"])
+(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildHost" "llvmPackages_16" "llvm_16"])
--- a/pkgs/development/compilers/rust/cargo_cross.nix
+++ b/pkgs/development/compilers/rust/cargo_cross.nix
@ -0,0 +1,14 @@
+{ runCommand, stdenv, lib, pkgsBuildBuild, makeShellWrapper, rustc, ... }:
+
+runCommand "${stdenv.targetPlatform.config}-cargo-${lib.getVersion pkgsBuildBuild.cargo}" {
+  # Use depsBuildBuild or it tries to use target-runtimeShell
+  depsBuildBuild = [ makeShellWrapper ];
+
+  inherit (pkgsBuildBuild.cargo) meta;
+} ''
+  mkdir -p $out/bin
+  ln -s ${pkgsBuildBuild.cargo}/share $out/share
+
+  makeWrapper "${pkgsBuildBuild.cargo}/bin/cargo" "$out/bin/cargo" \
+    --prefix PATH : "${rustc}/bin"
+ ''
--- a/pkgs/development/compilers/rust/default.nix
+++ b/pkgs/development/compilers/rust/default.nix
@ -15,12 +15,15 @@
 , buildPackages
 , newScope, callPackage
 , CoreFoundation, Security, SystemConfiguration
+, pkgsBuildBuild
 , makeRustPlatform
 }:

 let
  # Use `import` to make sure no packages sneak in here.
  lib' = import ../../../build-support/rust/lib { inherit lib; };
+  # Allow faster cross compiler generation by reusing Build artifacts
+  fastCross = (stdenv.buildPlatform == stdenv.hostPlatform) && (stdenv.hostPlatform != stdenv.targetPlatform);
 in
 {
  lib = lib';
@ -48,7 +51,10 @@ in
      # Like `buildRustPackages`, but may also contain prebuilt binaries to
      # break cycle. Just like `bootstrapTools` for nixpkgs as a whole,
      # nothing in the final package set should refer to this.
-      bootstrapRustPackages = self.buildRustPackages.overrideScope (_: _:
+      bootstrapRustPackages = if fastCross
+      then pkgsBuildBuild.rustPackages
+      else
+        self.buildRustPackages.overrideScope (_: _:
        lib.optionalAttrs (stdenv.buildPlatform == stdenv.hostPlatform)
          (selectRustPackage buildPackages).packages.prebuilt);
      bootRustPlatform = makeRustPlatform bootstrapRustPackages;
@ -61,7 +67,7 @@ in
        version = rustcVersion;
        sha256 = rustcSha256;
        inherit enableRustcDev;
-        inherit llvmShared llvmSharedForBuild llvmSharedForHost llvmSharedForTarget llvmPackages;
+        inherit llvmShared llvmSharedForBuild llvmSharedForHost llvmSharedForTarget llvmPackages fastCross;

        patches = rustcPatches;

@ -72,11 +78,11 @@ in
        inherit Security;
        inherit (self.buildRustPackages) rustc;
      };
-      cargo = self.callPackage ./cargo.nix {
+      cargo = if (!fastCross) then self.callPackage ./cargo.nix {
        # Use boot package set to break cycle
        rustPlatform = bootRustPlatform;
        inherit CoreFoundation Security;
-      };
+      } else self.callPackage ./cargo_cross.nix {};
      cargo-auditable = self.callPackage ./cargo-auditable.nix { };
      cargo-auditable-cargo-wrapper = self.callPackage ./cargo-auditable-cargo-wrapper.nix { };
      clippy = self.callPackage ./clippy.nix {
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@ -15,6 +15,10 @@
 , wezterm
 , firefox
 , thunderbird
+# This only builds std for target and reuses the rustc from build.
+, fastCross
+, lndir
+, makeWrapper
 }:

 let
@ -87,13 +91,13 @@ in stdenv.mkDerivation rec {
    # (build!=target): When cross-building a compiler we need to add
    # the build platform as well so rustc can compile build.rs
    # scripts.
-    ] ++ optionals (stdenv.buildPlatform != stdenv.targetPlatform) [
+    ] ++ optionals (stdenv.buildPlatform != stdenv.targetPlatform && !fastCross) [
      (rust.toRustTargetSpec stdenv.buildPlatform)

    # (host!=target): When building a cross-targeting compiler we
    # need to add the host platform as well so rustc can compile
    # build.rs scripts.
-    ] ++ optionals (stdenv.hostPlatform != stdenv.targetPlatform) [
+    ] ++ optionals (stdenv.hostPlatform != stdenv.targetPlatform && !fastCross) [
      (rust.toRustTargetSpec stdenv.hostPlatform)
    ])}"

@ -132,6 +136,37 @@ in stdenv.mkDerivation rec {
    "--set rust.jemalloc"
  ];

+  # if we already have a rust compiler for build just compile the target std
+  # library and reuse compiler
+  buildPhase = if fastCross then "
+    runHook preBuild
+
+    mkdir -p build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-{std,rustc}/${rust.toRustTargetSpec stdenv.hostPlatform}/release/
+    ln -s ${rustc}/lib/rustlib/${rust.toRustTargetSpec stdenv.hostPlatform}/libstd-*.so build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-std/${rust.toRustTargetSpec stdenv.hostPlatform}/release/libstd.so
+    ln -s ${rustc}/lib/rustlib/${rust.toRustTargetSpec stdenv.hostPlatform}/librustc_driver-*.so build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-rustc/${rust.toRustTargetSpec stdenv.hostPlatform}/release/librustc.so
+    ln -s ${rustc}/bin/rustc build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-rustc/${rust.toRustTargetSpec stdenv.hostPlatform}/release/rustc-main
+    touch build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-std/${rust.toRustTargetSpec stdenv.hostPlatform}/release/.libstd.stamp
+    touch build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-rustc/${rust.toRustTargetSpec stdenv.hostPlatform}/release/.librustc.stamp
+    python ./x.py --keep-stage=0 --stage=1 build library/std
+
+    runHook postBuild
+  " else null;
+
+  installPhase = if fastCross then ''
+    runHook preInstall
+
+    python ./x.py --keep-stage=0 --stage=1 install library/std
+    mkdir -v $out/bin $doc $man
+    makeWrapper ${rustc}/bin/rustc $out/bin/rustc --add-flags "--sysroot $out"
+    makeWrapper ${rustc}/bin/rustdoc $out/bin/rustdoc --add-flags "--sysroot $out"
+    ln -s ${rustc}/lib/rustlib/{manifest-rust-std-,}${rust.toRustTargetSpec stdenv.hostPlatform} $out/lib/rustlib/
+    echo rust-std-${rust.toRustTargetSpec stdenv.hostPlatform} >> $out/lib/rustlib/components
+    lndir ${rustc.doc} $doc
+    lndir ${rustc.man} $man
+
+    runHook postInstall
+  '' else null;
+
  # The bootstrap.py will generated a Makefile that then executes the build.
  # The BOOTSTRAP_ARGS used by this Makefile must include all flags to pass
  # to the bootstrap builder.
@ -179,7 +214,8 @@ in stdenv.mkDerivation rec {
  nativeBuildInputs = [
    file python3 rustc cmake
    which libffi removeReferencesTo pkg-config xz
-  ];
+  ]
+    ++ optionals fastCross [ lndir makeWrapper ];

  buildInputs = [ openssl ]
    ++ optionals stdenv.isDarwin [ libiconv Security ]
@ -188,7 +224,7 @@ in stdenv.mkDerivation rec {
  outputs = [ "out" "man" "doc" ];
  setOutputFlags = false;

-  postInstall = lib.optionalString enableRustcDev ''
+  postInstall = lib.optionalString (enableRustcDev && !fastCross) ''
    # install rustc-dev components. Necessary to build rls, clippy...
    python x.py dist rustc-dev
    tar xf build/dist/rustc-dev*tar.gz
--- a/pkgs/development/embedded/blisp/default.nix
+++ b/pkgs/development/embedded/blisp/default.nix
@ -5,18 +5,19 @@
 , cmake
 , libserialport
 , pkg-config
+, testers
 , IOKit
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "blisp";
-  version = "unstable-2023-06-03";
+  version = "0.0.4";

  src = fetchFromGitHub {
    owner = "pine64";
    repo = "blisp";
-    rev = "048a72408218788d519a87bcdfb23bcf9ed91a84";
-    hash = "sha256-hipJrr0D4uEN2hk8ooXeg0gv0X3w4U9ReXbC4oPEPwI=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-cN35VLbdQFA3KTZ8PxgpbsLGXqfFhw5eh3nEBRZqAm4=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
@ -31,12 +32,16 @@ stdenv.mkDerivation {
    "-DBLISP_USE_SYSTEM_LIBRARIES=ON"
  ];

+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    version = "v${finalAttrs.version}";
+  };
+
  meta = with lib; {
-    description = "ISP tool & library for Bouffalo Labs RISC-V Microcontrollers and SoCs";
+    description = "An In-System-Programming (ISP) tool & library for Bouffalo Labs RISC-V Microcontrollers and SoCs";
    license = licenses.mit;
+    mainProgram = "blisp";
    homepage = "https://github.com/pine64/blisp";
    maintainers = [ maintainers.fortuneteller2k ];
  };
-}
-# TODO: update when next stable release supports building without vendored
-# libraries
+})
--- a/pkgs/development/libraries/SDL2_ttf/default.nix
+++ b/pkgs/development/libraries/SDL2_ttf/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, pkg-config, darwin, fetchurl, SDL2, freetype, libGL }:
+{ lib, stdenv, pkg-config, darwin, fetchurl, SDL2, freetype, harfbuzz, libGL }:

 stdenv.mkDerivation rec {
  pname = "SDL2_ttf";
@ -9,11 +9,12 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-ncce2TSHUhsQeixKnKa/Q/ti9r3dXCawVea5FBiiIFM=";
  };

-  configureFlags = lib.optional stdenv.isDarwin "--disable-sdltest";
+  configureFlags = [ "--disable-harfbuzz-builtin" ]
+    ++ lib.optionals stdenv.isDarwin [ "--disable-sdltest" ];

  nativeBuildInputs = [ pkg-config ];

-  buildInputs = [ SDL2 freetype ]
+  buildInputs = [ SDL2 freetype harfbuzz ]
    ++ lib.optional (!stdenv.isDarwin) libGL
    ++ lib.optional stdenv.isDarwin darwin.libobjc;

--- a/pkgs/development/libraries/level-zero/default.nix
+++ b/pkgs/development/libraries/level-zero/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "level-zero";
-  version = "1.13.5";
+  version = "1.14.0";

  src = fetchFromGitHub {
    owner = "oneapi-src";
    repo = "level-zero";
    rev = "refs/tags/v${version}";
-    hash = "sha256-XpLbbcB8M63q+0Vj7NrERSXVIjy5KQrVZMvYijUbJhw=";
+    hash = "sha256-7hFGY255dLgDo93+Nx2we/cfEtwaiaajdVg1VTst1/U=";
  };

  nativeBuildInputs = [ cmake addOpenGLRunpath ];
--- a/pkgs/development/libraries/libcef/default.nix
+++ b/pkgs/development/libraries/libcef/default.nix
@ -66,16 +66,16 @@ let
      projectArch = "x86_64";
    };
  };
-  platforms."aarch64-linux".sha256 = "0ij7y0whlq8g1sskbhirbw3ngbp95k1in2pi9kjhb9flydjwxq8g";
-  platforms."x86_64-linux".sha256 = "0dyv1ddsakxi51a7iwmy006mx27gvjq49i45difkmjv6mw9s2fw9";
+  platforms."aarch64-linux".sha256 = "0xzgcnh45x3sqg0jndp9g08zy9bvzvmvfz8imj12j55vkm6f7kl6";
+  platforms."x86_64-linux".sha256 = "1942mwlyrz5pxlx9kcnz85rqbz8q8slkivx0001z30l7a6pizgg5";

  platformInfo = builtins.getAttr stdenv.targetPlatform.system platforms;
 in
 stdenv.mkDerivation rec {
  pname = "cef-binary";
-  version = "116.0.15";
-  gitRevision = "0b8c265";
-  chromiumVersion = "116.0.5845.111";
+  version = "116.0.20";
+  gitRevision = "d6abd3c";
+  chromiumVersion = "116.0.5845.180";

  src = fetchurl {
    url = "https://cef-builds.spotifycdn.com/cef_binary_${version}+g${gitRevision}+chromium-${chromiumVersion}_${platformInfo.platformStr}_minimal.tar.bz2";
--- a/pkgs/development/libraries/mpir/default.nix
+++ b/pkgs/development/libraries/mpir/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, m4, which, yasm, buildPackages }:
+{ lib, stdenv, fetchurl, m4, which, yasm, autoreconfHook, fetchpatch, buildPackages }:

 stdenv.mkDerivation rec {
  pname = "mpir";
@ -6,13 +6,22 @@ stdenv.mkDerivation rec {

  depsBuildBuild = [ buildPackages.stdenv.cc ];

-  nativeBuildInputs = [ m4 which yasm ];
+  nativeBuildInputs = [ m4 which yasm autoreconfHook ];

  src = fetchurl {
    url = "https://mpir.org/mpir-${version}.tar.bz2";
    sha256 = "1fvmhrqdjs925hzr2i8bszm50h00gwsh17p2kn2pi51zrxck9xjj";
  };

+  patches = [
+    # Fixes configure check failures with clang 16 due to implicit definitions of `exit`, which
+    # is an error with newer versions of clang.
+    (fetchpatch {
+      url = "https://github.com/wbhart/mpir/commit/bbc43ca6ae0bec4f64e69c9cd4c967005d6470eb.patch";
+      hash = "sha256-vW+cDK5Hq2hKEyprOJaNbj0bT2FJmMcyZHPE8GUNUWc=";
+    })
+  ];
+
  configureFlags = [ "--enable-cxx" ]
    ++ lib.optionals stdenv.isLinux [ "--enable-fat" ];

--- a/pkgs/development/libraries/open62541/default.nix
+++ b/pkgs/development/libraries/open62541/default.nix
@ -31,13 +31,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "open62541";
-  version = "1.3.6";
+  version = "1.3.7";

  src = fetchFromGitHub {
    owner = "open62541";
    repo = "open62541";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-cmD01D49pHEHN0QQtE5RXv0YZ/MPIWnubeUY6BH4DrU=";
+    hash = "sha256-XmoLmBGTMA6cejLiNU8hAVnHd35eh6lTIu9csmiR+4U=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/libraries/spdlog/default.nix
+++ b/pkgs/development/libraries/spdlog/default.nix
@ -3,10 +3,8 @@
 , fetchFromGitHub
 , fetchpatch
 , cmake
-# Although we include upstream patches that fix compilation with fmt_10, we
-# still use fmt_9 because this dependency is propagated, and many of spdlog's
-# reverse dependencies don't support fmt_10 yet.
-, fmt_9
+, fmt
+, catch2_3
 , staticBuild ? stdenv.hostPlatform.isStatic

 # tests
@ -15,29 +13,26 @@

 stdenv.mkDerivation rec {
  pname = "spdlog";
-  version = "1.11.0";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "gabime";
    repo  = "spdlog";
    rev   = "v${version}";
-    hash  = "sha256-kA2MAb4/EygjwiLEjF9EA7k8Tk//nwcKB1+HlzELakQ=";
+    hash  = "sha256-cxTaOuLXHRU8xMz9gluYz0a93O0ez2xOxbloyc1m1ns=";
  };

  patches = [
-    # Fix compatiblity with fmt 10.0. Remove with the next release
+    # Fix a broken test, remove with the next release.
    (fetchpatch {
-      url = "https://github.com/gabime/spdlog/commit/0ca574ae168820da0268b3ec7607ca7b33024d05.patch";
-      hash = "sha256-cRsQilkyUQW47PFpDwKgU/pm+tOeLvwPx32gNOPAO1U=";
-    })
-    (fetchpatch {
-      url = "https://github.com/gabime/spdlog/commit/af1785b897c9d1098d4aa7213fad232be63c19b4.patch";
-      hash = "sha256-zpfLiBeDAOsvk4vrIyXC0kvFe2WkhAhersd+fhA8DFY=";
+      url = "https://github.com/gabime/spdlog/commit/2ee8bac78e6525a8ad9a9196e65d502ce390d83a.patch";
+      hash = "sha256-L79yOkm3VY01jmxNctfneTLmOA5DEQeNNGC8LbpJiOc=";
    })
  ];

  nativeBuildInputs = [ cmake ];
-  propagatedBuildInputs = [ fmt_9 ];
+  propagatedBuildInputs = [ fmt ];
+  checkInputs = [ catch2_3 ];

  cmakeFlags = [
    "-DSPDLOG_BUILD_SHARED=${if staticBuild then "OFF" else "ON"}"
--- a/pkgs/development/libraries/wfa2-lib/default.nix
+++ b/pkgs/development/libraries/wfa2-lib/default.nix
@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, llvmPackages
+, enableOpenMP ? true
+}:
+
+stdenv.mkDerivation rec {
+  pname = "wfa2-lib";
+  version = "2.3.3";
+
+  src = fetchFromGitHub {
+    owner = "smarco";
+    repo = "WFA2-lib";
+    rev = "v${version}";
+    hash = "sha256-PLZhxKMBhKm6E/ENFZ/yWMWIwJG5voaJls2in44OGoQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals enableOpenMP [ llvmPackages.openmp ];
+
+  cmakeFlags = [ "-DOPENMP=${if enableOpenMP then "ON" else "OFF"}" ];
+
+  meta = with lib; {
+    description = "Wavefront alignment algorithm library v2";
+    homepage = "https://github.com/smarco/WFA2-lib";
+    license = licenses.mit;
+    maintainers = with maintainers; [ rs0vere ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@ -2,11 +2,11 @@

 mkDerivation (finalAttrs: {
  pname = "composer";
-  version = "2.5.8";
+  version = "2.6.2";

  src = fetchurl {
    url = "https://github.com/composer/composer/releases/download/${finalAttrs.version}/composer.phar";
-    hash = "sha256-8Hk0+tRPkEjA3IdaUGzKMcwnlNauv8GGfzsfv0jc4sU=";
+    hash = "sha256-iMhNSlP88cJ9Z2Lh1da3DVfG3J0uIxT9Cdv4a/YeGu8=";
  };

  dontUnpack = true;
--- a/pkgs/development/python-modules/aiodiscover/default.nix
+++ b/pkgs/development/python-modules/aiodiscover/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "aiodiscover";
-  version = "1.4.16";
+  version = "1.5.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "bdraco";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-umHw9DFLIsoxBNlUSuSmaRy5O270lP0tLZ8rilw0oWg=";
+    hash = "sha256-rFypv0gCj+Jskk+dlRNJ2ufj2sDud7AuJzj3cl4bB4Y=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiovodafone/default.nix
+++ b/pkgs/development/python-modules/aiovodafone/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "aiovodafone";
-  version = "0.0.8";
+  version = "0.1.0";
  format = "pyproject";

  disabled = pythonOlder "3.10";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "chemelli74";
    repo = "aiovodafone";
    rev = "refs/tags/v${version}";
-    hash = "sha256-o21zaK3dJfURFAt8fPaOd95H7tuqLnFPC01RGHBIz4M=";
+    hash = "sha256-VO+lQK+0bSQqnFiLzRMnVTpTJRjv2fZhDbIoTiMFWFI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/bleak-retry-connector/default.nix
+++ b/pkgs/development/python-modules/bleak-retry-connector/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "bleak-retry-connector";
-  version = "3.1.2";
+  version = "3.1.3";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-q+J4PUBm42jBcLbiywWwDZxUI0Gsl8GjnLPwniWp+Kw=";
+    hash = "sha256-Nd/9mUtEEhCiJSF677lsE5UhMrbWiIl3ktQ7FjtyYlQ=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "bleak";
-  version = "0.21.0";
+  version = "0.21.1";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "hbldh";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-hnXBXm0BFNNzw563Ybr76KHiqt2sFqo0dtiRHGWsu3A=";
+    hash = "sha256-T0im8zKyNLbskAEDeUUFS/daJtvttlHlttjscqP8iSk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/bluetooth-adapters/default.nix
+++ b/pkgs/development/python-modules/bluetooth-adapters/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "bluetooth-adapters";
-  version = "0.16.0";
+  version = "0.16.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-gbnsTRiT/4YumyaJ1h4VRzDAf8/oSkD3yL9mdACvWWk=";
+    hash = "sha256-GJhrL6J/L1+tqa7fN5xwE+8IFZZ9kff2g+04H5M7beY=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
+++ b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "bluetooth-auto-recovery";
-  version = "1.2.1";
+  version = "1.2.3";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-5OOIehWb7nxKs1AF9/0yjZhbc3h4MWdgAVCa7irq5YE=";
+    hash = "sha256-1ytiTIAV00Wk2zqZKRAsstVLuyzPEGBISz0g0ssC5Eo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/checkdmarc/default.nix
+++ b/pkgs/development/python-modules/checkdmarc/default.nix
@ -0,0 +1,76 @@
+{ lib
+, buildPythonPackage
+, cryptography
+, dnspython
+, expiringdict
+, fetchFromGitHub
+, hatchling
+, publicsuffixlist
+, pyleri
+, iana-etc
+, pytestCheckHook
+, pythonOlder
+, requests
+, timeout-decorator
+}:
+
+buildPythonPackage rec {
+  pname = "checkdmarc";
+  version = "4.8.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "domainaware";
+    repo = "checkdmarc";
+    # https://github.com/domainaware/checkdmarc/issues/102
+    rev = "d0364ceef3cfd41052273913369e3831cb6fe4fd";
+    hash = "sha256-OSljewDeyJtoxkCQjPU9wIsNhhxumHmeu9GHvRD4DRY=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    cryptography
+    dnspython
+    expiringdict
+    publicsuffixlist
+    pyleri
+    requests
+    timeout-decorator
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "checkdmarc"
+  ];
+
+  pytestFlagsArray = [
+    "tests.py"
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "testDMARCPctLessThan100Warning"
+    "testSPFMissingARecord"
+    "testSPFMissingMXRecord"
+    "testSplitSPFRecord"
+    "testTooManySPFDNSLookups"
+    "testTooManySPFVoidDNSLookups"
+  ];
+
+  meta = with lib; {
+    description = "A parser for SPF and DMARC DNS records";
+    homepage = "https://github.com/domainaware/checkdmarc";
+    changelog = "https://github.com/domainaware/checkdmarc/blob/${version}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
+
--- a/pkgs/development/python-modules/cson/default.nix
+++ b/pkgs/development/python-modules/cson/default.nix
@ -15,7 +15,7 @@ buildPythonPackage rec {

  propagatedBuildInputs = [ speg ];

-  pythonImportChecks = [ "cson" ];
+  pythonImportsCheck = [ "cson" ];

  meta = with lib; {
    description = "A python parser for the Coffeescript Object Notation (CSON)";
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "dbus-fast";
-  version = "2.0.0";
+  version = "2.0.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-Dzr7CSoJhO/F75Ro686lKXCOzP2AxtR6wJOp70IOvUk=";
+    hash = "sha256-gaV9IbifHlxY0d8sDvWnRBDyOnWc4gqsRHTgeyyeVQs=";
  };

  # The project can build both an optimized cython version and an unoptimized
--- a/pkgs/development/python-modules/diffsync/default.nix
+++ b/pkgs/development/python-modules/diffsync/default.nix
@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, colorama
+, fetchFromGitHub
+, packaging
+, poetry-core
+, pydantic
+, redis
+, structlog
+}:
+
+buildPythonPackage rec {
+  pname = "diffsync";
+  version = "1.8.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "networktocode";
+    repo = "diffsync";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-2OhckgJK1qimF0AcYSa8L+AkzfiN5VojWj0x6kwbgyk=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    colorama
+    packaging
+    pydantic
+    redis
+    structlog
+  ];
+
+  pythonImportsCheck = [
+    "diffsync"
+  ];
+
+  meta = with lib; {
+    description = "Utility library for comparing and synchronizing different datasets";
+    homepage = "https://github.com/networktocode/diffsync";
+    changelog = "https://github.com/networktocode/diffsync/blob/v${version}/CHANGELOG.md";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ clerie ];
+  };
+}
--- a/pkgs/development/python-modules/django-admin-datta/default.nix
+++ b/pkgs/development/python-modules/django-admin-datta/default.nix
@ -24,8 +24,8 @@ buildPythonPackage rec {
  # no tests
  doCheck = false;

-  pythonImportCheck = [
-    "admin-datta"
+  pythonImportsCheck = [
+    "admin_datta"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@ -17,15 +17,15 @@
 }:

 buildPythonPackage rec {
-  version = "0.21.5";
+  version = "0.21.6";
  pname = "dulwich";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-cJVeTiSd3abjSkY2uQ906THlWPmTsXxSVw+mFEuZMQM=";
+    hash = "sha256-MPvofotR84E8Ex4oQchtAHQ00WC9FttYa0DUfzHdBbA=";
  };

  LC_ALL = "en_US.UTF-8";
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "dvc-data";
-  version = "2.16.0";
+  version = "2.16.1";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-pLagCMHxlN26x/zP6tDRchxTwqvRyARKO5EzmuWncUo=";
+    hash = "sha256-hnKOSo/RUzGnj7JbdKOGogVN925LZQiL3uvy5+dQfPw=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "fakeredis";
-  version = "2.18.0";
+  version = "2.18.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "dsoftwareinc";
    repo = "fakeredis-py";
    rev = "refs/tags/v${version}";
-    hash = "sha256-+bJbtqBUgix4oIq49hQEk3/cNXfvXFXE/m/qR1zy8jo=";
+    hash = "sha256-XxQGkcwWesPS/N31t04FDq6w773OZnLVTWB42dY4AGA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/flask-socketio/default.nix
+++ b/pkgs/development/python-modules/flask-socketio/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "Flask-SocketIO";
-  version = "5.3.5";
+  version = "5.3.6";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -19,8 +19,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "miguelgrinberg";
    repo = "Flask-SocketIO";
-    rev = "v${version}";
-    hash = "sha256-5Di02VJM9sJndp/x5Hl9ztcItY3aXk/wBJT90OSoc2c=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-YjCe34Mvt7tvp3w5yH52lrq4bWi7aIYAUssNqxlQ8CA=";
  };

  nativeBuildInputs = [
@ -41,13 +41,15 @@ buildPythonPackage rec {
    "test_socketio.py"
  ];

-  pythonImportsCheck = [ "flask_socketio" ];
+  pythonImportsCheck = [
+    "flask_socketio"
+  ];

  meta = with lib; {
    description = "Socket.IO integration for Flask applications";
    homepage = "https://github.com/miguelgrinberg/Flask-SocketIO/";
    changelog = "https://github.com/miguelgrinberg/Flask-SocketIO/blob/v${version}/CHANGES.md";
    license = licenses.mit;
-    maintainers = [ maintainers.mic92 ];
+    maintainers = with maintainers; [ mic92 ];
  };
 }
--- a/pkgs/development/python-modules/geventhttpclient/default.nix
+++ b/pkgs/development/python-modules/geventhttpclient/default.nix
@ -8,19 +8,20 @@
 , pytestCheckHook
 , pythonOlder
 , six
+, stdenv
 , urllib3
 }:

 buildPythonPackage rec {
  pname = "geventhttpclient";
-  version = "2.0.8";
+  version = "2.0.10";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-X3gsQZZD90vk0JGMDStjlW723ceiEn8Hy7gDOnWrNm8=";
+    hash = "sha256-t8l7JlEZV6NqiU7FRlHAiJCmnhGLaXVfjnS/w3xjORs=";
  };

  propagatedBuildInputs = [
@ -36,6 +37,9 @@ buildPythonPackage rec {
    urllib3
  ];

+  # lots of: [Errno 48] Address already in use: ('127.0.0.1', 54323)
+  doCheck = !stdenv.isDarwin;
+
  __darwinAllowLocalNetworking = true;

  disabledTests = [
@ -56,6 +60,7 @@ buildPythonPackage rec {
  meta = with lib; {
    homepage = "https://github.com/geventhttpclient/geventhttpclient";
    description = "High performance, concurrent HTTP client library using gevent";
+    changelog = "https://github.com/geventhttpclient/geventhttpclient/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ koral ];
  };
--- a/pkgs/development/python-modules/greeneye-monitor/default.nix
+++ b/pkgs/development/python-modules/greeneye-monitor/default.nix
@ -4,28 +4,27 @@
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , siobrultech-protocols
 }:

 buildPythonPackage rec {
  pname = "greeneye-monitor";
-  version = "4.0.1";
+  version = "5.0";
+  format = "pyproject";

  disabled = pythonOlder "3.10";

-  format = "setuptools";
-
  src = fetchFromGitHub {
    owner = "jkeljo";
    repo = "greeneye-monitor";
    rev = "refs/tags/v${version}";
-    hash = "sha256-S/1MT9ZQ9G0F1WXqzNKhVo8vtfPLzr8WRlfYc7TU9iQ=";
+    hash = "sha256-HU+GWO08caKfQZ0tIDmJYAML4CKUM0CPukm7wD6uSEA=";
  };

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "siobrultech_protocols==" "siobrultech_protocols>="
-  '';
+  nativeBuildInputs = [
+    setuptools
+  ];

  propagatedBuildInputs = [
    aiohttp
--- a/pkgs/development/python-modules/liccheck/default.nix
+++ b/pkgs/development/python-modules/liccheck/default.nix
@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, configparser
+, fetchFromGitHub
+, pip
+, pytest-mock
+, pytestCheckHook
+, python3-openid
+, pythonOlder
+, semantic-version
+, toml
+}:
+
+buildPythonPackage rec {
+  pname = "liccheck";
+  version = "0.9.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "dhatim";
+    repo = "python-license-check";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ZgwHcZI0vsNYJWPkUnoBogVPPIuifAX9hu4fa1fHSz4=";
+  };
+
+  propagatedBuildInputs = [
+    configparser
+    semantic-version
+    toml
+  ];
+
+  nativeCheckInputs = [
+    pip
+    pytest-mock
+    pytestCheckHook
+    python3-openid
+  ];
+
+  pythonImportsCheck = [
+    "liccheck"
+  ];
+
+  meta = with lib; {
+    description = "Check python packages from requirement.txt and report issues";
+    homepage = "https://github.com/dhatim/python-license-check";
+    changelog = "https://github.com/dhatim/python-license-check/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/locationsharinglib/default.nix
+++ b/pkgs/development/python-modules/locationsharinglib/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "locationsharinglib";
-  version = "5.0.1";
+  version = "5.0.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-KT/q1UIJ/DzGqz8T08MXG9UCstAcpDydM4Tkn33pruI=";
+    hash = "sha256-ydwtcIJ2trQ6xg2r5kU/ogvjdBwUZhYhBdc6nBmSGcg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mkdocs-jupyter/default.nix
+++ b/pkgs/development/python-modules/mkdocs-jupyter/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "mkdocs-jupyter";
-  version = "0.24.1";
+  version = "0.24.2";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -23,7 +23,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "mkdocs_jupyter";
    inherit version;
-    hash = "sha256-lncDf7fpMSaPPfdZn8CCjCYSR989FXW87TILqLfR1G0=";
+    hash = "sha256-XgwQnVNdSHlyMHGbaUH00I3pWno8lb8VhmLEEvwVyy4=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/mutagen/default.nix
+++ b/pkgs/development/python-modules/mutagen/default.nix
@ -2,7 +2,6 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
-, fetchpatch

 # docs
 , python
@ -16,32 +15,26 @@

 buildPythonPackage rec {
  pname = "mutagen";
-  version = "1.46.0";
+  version = "1.47.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-bl+LqEg2uZ/mC+X7J/hL5K2Rm7trScqmroHnBYS1Xlg=";
+    hash = "sha256-cZ+t7wqXjDG0zzyVYmGzxYtpSLMgIweKIRex3gnw/Jk=";
  };

-  outputs = [ "out" "doc" ];
+  outputs = [
+    "out"
+    "doc"
+  ];

  nativeBuildInputs = [
    sphinx
    sphinx-rtd-theme
  ];

-  patches = [
-    (fetchpatch {
-      # docs: Make extlinks compatible with sphinx 6.0
-      # https://github.com/quodlibet/mutagen/pull/590
-      url = "https://github.com/quodlibet/mutagen/commit/37b4e6bddc03e1f715425c418ea84bac15116907.patch";
-      hash = "sha256-CnGfHY4RhRhOLvlRTH/NZwzCnAL3VhU6xosuh6fkqGQ=";
-    })
-  ];
-
  postInstall = ''
    ${python.pythonForBuild.interpreter} setup.py build_sphinx --build-dir=$doc
  '';
--- a/pkgs/development/python-modules/nats-py/default.nix
+++ b/pkgs/development/python-modules/nats-py/default.nix
@ -7,13 +7,14 @@
 , nats-server
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , uvloop
 }:

 buildPythonPackage rec {
  pname = "nats-py";
-  version = "2.2.0";
-  format = "setuptools";
+  version = "2.3.1";
+  format = "pyproject";

  disabled = pythonOlder "3.7";

@ -21,9 +22,18 @@ buildPythonPackage rec {
    owner = "nats-io";
    repo = "nats.py";
    rev = "refs/tags/v${version}";
-    hash = "sha256-w+YySX9RNXUttt7iLg/Efh8bNzmhIQTKMXcoPO1k4lI=";
+    hash = "sha256-vcTkQeaWBsPlPCp53VqI3inH0PkdxkKWDTW/vtrD/xw=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"--cov=nats", "--cov-report=html"' ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    aiohttp
    ed25519
@ -35,11 +45,6 @@ buildPythonPackage rec {
    uvloop
  ];

-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--cov=nats --cov-report html" ""
-  '';
-
  disabledTests = [
    # AssertionError: assert 5 == 0
    "test_pull_subscribe_limits"
--- a/pkgs/development/python-modules/onnx/default.nix
+++ b/pkgs/development/python-modules/onnx/default.nix
@ -19,7 +19,7 @@ let
  gtestStatic = gtest.override { static = true; };
 in buildPythonPackage rec {
  pname = "onnx";
-  version = "1.14.0";
+  version = "1.14.1";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -28,7 +28,7 @@ in buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-f+s25Y/jGosaSdoZY6PE3j6pENkfDcD+IQndrbtuzWg=";
+    hash = "sha256-ZVSdk6LeAiZpQrrzLxphMbc1b3rNUMpcxcXPP8s/5tE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/opcua-widgets/default.nix
+++ b/pkgs/development/python-modules/opcua-widgets/default.nix
@ -24,7 +24,7 @@ buildPythonPackage rec {
    asyncua
  ];

-  pythonImportChecks = [ "opcua-widgets" ];
+  pythonImportsCheck = [ "uawidgets" ];

  #This test is broken, when updating this package check if the test was fixed.
  doCheck = false;
--- a/pkgs/development/python-modules/plexapi/default.nix
+++ b/pkgs/development/python-modules/plexapi/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "plexapi";
-  version = "4.15.0";
+  version = "4.15.1";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "pkkid";
    repo = "python-plexapi";
    rev = "refs/tags/${version}";
-    hash = "sha256-JIfMHDMX7N9wr9BTiTh/jsnPLDS3w8Pyp7wS014PyQ0=";
+    hash = "sha256-mxVj98wbstUx/Abim7kzVVt/8kaAPVOhv4zt+PFgi3Y=";
  };

  propagatedBuildInputs = [
--- a/Show More
+++ b/Show More