Merge master into haskell-updates

2023-11-07 00:12:32 +00:00 · 2023-11-07 00:12:32 +00:00 · 8541e5ab09
commit 8541e5ab09
parent 2ec6f63534 fe3d292f2c
225 changed files with 17331 additions and 4615 deletions
--- a/doc/builders/images/dockertools.section.md
+++ b/doc/builders/images/dockertools.section.md
@ -275,7 +275,7 @@ pullImage {
 `nix-prefetch-docker` command can be used to get required image parameters:

 ```ShellSession
-$ nix run nixpkgs.nix-prefetch-docker -c nix-prefetch-docker --image-name mysql --image-tag 5
+$ nix run nixpkgs#nix-prefetch-docker -- --image-name mysql --image-tag 5
 ```

 Since a given `imageName` may transparently refer to a manifest list of images which support multiple architectures and/or operating systems, you can supply the `--os` and `--arch` arguments to specify exactly which image you want. By default it will match the OS and architecture of the host the command is run on.
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -49,6 +49,7 @@ lua-resty-jwt,,,,,,
 lua-resty-openidc,,,,,,
 lua-resty-openssl,,,,,,
 lua-resty-session,,,,,,
+lua-rtoml,https://github.com/lblasc/lua-rtoml,,,,,lblasc
 lua-subprocess,https://github.com/0x0ade/lua-subprocess,,,,5.1,scoder12
 lua-term,,,,,,
 lua-toml,,,,,,
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -104,6 +104,8 @@

 - hardware/infiniband.nix adds infiniband subnet manager support using an [opensm](https://github.com/linux-rdma/opensm) systemd-template service, instantiated on card guids. The module also adds kernel modules and cli tooling to help administrators debug and measure performance. Available as [hardware.infiniband.enable](#opt-hardware.infiniband.enable).

+- [zwave-js](https://github.com/zwave-js/zwave-js-server), a small server wrapper around Z-Wave JS to access it via a WebSocket. Available as [services.zwave-js](#opt-services.zwave-js.enable).
+
 - [Honk](https://humungus.tedunangst.com/r/honk), a complete ActivityPub server with minimal setup and support costs.
  Available as [services.honk](#opt-services.honk.enable).

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -564,6 +564,7 @@
  ./services/home-automation/home-assistant.nix
  ./services/home-automation/homeassistant-satellite.nix
  ./services/home-automation/zigbee2mqtt.nix
+  ./services/home-automation/zwave-js.nix
  ./services/logging/SystemdJournal2Gelf.nix
  ./services/logging/awstats.nix
  ./services/logging/filebeat.nix
--- a/nixos/modules/services/backup/syncoid.nix
+++ b/nixos/modules/services/backup/syncoid.nix
@ -369,7 +369,7 @@ in
              PrivateDevices = true;
              PrivateMounts = true;
              PrivateNetwork = mkDefault false;
-              PrivateUsers = true;
+              PrivateUsers = false; # Enabling this breaks on zfs-2.2.0
              ProtectClock = true;
              ProtectControlGroups = true;
              ProtectHome = true;
--- a/nixos/modules/services/home-automation/zwave-js.nix
+++ b/nixos/modules/services/home-automation/zwave-js.nix
@ -0,0 +1,152 @@
+{config, pkgs, lib, ...}:
+
+with lib;
+
+let
+  cfg = config.services.zwave-js;
+  mergedConfigFile = "/run/zwave-js/config.json";
+  settingsFormat = pkgs.formats.json {};
+in {
+  options.services.zwave-js = {
+    enable = mkEnableOption (mdDoc "the zwave-js server on boot");
+
+    package = mkPackageOptionMD pkgs "zwave-js-server" { };
+
+    port = mkOption {
+      type = types.port;
+      default = 3000;
+      description = mdDoc ''
+        Port for the server to listen on.
+      '';
+    };
+
+    serialPort = mkOption {
+      type = types.path;
+      description = mdDoc ''
+        Serial port device path for Z-Wave controller.
+      '';
+      example = "/dev/ttyUSB0";
+    };
+
+    secretsConfigFile = mkOption {
+      type = types.path;
+      description = mdDoc ''
+        JSON file containing secret keys. A dummy example:
+
+        ```
+        {
+          "securityKeys": {
+            "S0_Legacy": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+            "S2_Unauthenticated": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
+            "S2_Authenticated": "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC",
+            "S2_AccessControl": "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
+          }
+        }
+        ```
+
+        See
+        <https://zwave-js.github.io/node-zwave-js/#/getting-started/security-s2>
+        for details. This file will be merged with the module-generated config
+        file (taking precedence).
+
+        Z-Wave keys can be generated with:
+
+          {command}`< /dev/urandom tr -dc A-F0-9 | head -c32 ;echo`
+
+
+        ::: {.warning}
+        A file in the nix store should not be used since it will be readable to
+        all users.
+        :::
+      '';
+      example = "/secrets/zwave-js-keys.json";
+    };
+
+    settings = mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        options = {
+          storage = {
+            cacheDir = mkOption {
+              type = types.path;
+              default = "/var/cache/zwave-js";
+              readOnly = true;
+              description = lib.mdDoc "Cache directory";
+            };
+          };
+        };
+      };
+      default = {};
+      description = mdDoc ''
+        Configuration settings for the generated config
+        file.
+      '';
+    };
+
+    extraFlags = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+      example = [ "--mock-driver" ];
+      description = lib.mdDoc ''
+        Extra flags to pass to command
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.zwave-js = let
+      configFile = settingsFormat.generate "zwave-js-config.json" cfg.settings;
+    in {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      description = "Z-Wave JS Server";
+      serviceConfig = {
+        ExecStartPre = ''
+          /bin/sh -c "${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${configFile} ${cfg.secretsConfigFile} > ${mergedConfigFile}"
+        '';
+        ExecStart = lib.concatStringsSep " " [
+          "${cfg.package}/bin/zwave-server"
+          "--config ${mergedConfigFile}"
+          "--port ${toString cfg.port}"
+          cfg.serialPort
+          (escapeShellArgs cfg.extraFlags)
+        ];
+        Restart = "on-failure";
+        User = "zwave-js";
+        SupplementaryGroups = [ "dialout" ];
+        CacheDirectory = "zwave-js";
+        RuntimeDirectory = "zwave-js";
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        DeviceAllow = [cfg.serialPort];
+        DevicePolicy = "closed";
+        DynamicUser = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = false;
+        NoNewPrivileges = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service @pkey"
+          "~@privileged @resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ graham33 ];
+}
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@ -899,25 +899,6 @@ in {
                      '';
                    };
                  };
-
-                  managementFrameProtection = mkOption {
-                    default = "required";
-                    type = types.enum ["disabled" "optional" "required"];
-                    apply = x:
-                      getAttr x {
-                        "disabled" = 0;
-                        "optional" = 1;
-                        "required" = 2;
-                      };
-                    description = mdDoc ''
-                      Management frame protection (MFP) authenticates management frames
-                      to prevent deauthentication (or related) attacks.
-
-                      - {var}`"disabled"`: No management frame protection
-                      - {var}`"optional"`: Use MFP if a connection allows it
-                      - {var}`"required"`: Force MFP for all clients
-                    '';
-                  };
                };

                config = let
@ -943,7 +924,8 @@ in {

                    # IEEE 802.11i (authentication) related configuration
                    # Encrypt management frames to protect against deauthentication and similar attacks
-                    ieee80211w = bssCfg.managementFrameProtection;
+                    ieee80211w = mkDefault 1;
+                    sae_require_mfp = mkDefault 1;

                    # Only allow WPA by default and disable insecure WEP
                    auth_algs = mkDefault 1;
@ -1184,14 +1166,6 @@ in {
                  assertion = (length (attrNames radioCfg.networks) > 1) -> (bssCfg.bssid != null);
                  message = ''hostapd radio ${radio} bss ${bss}: bssid must be specified manually (for now) since this radio uses multiple BSS.'';
                }
-                {
-                  assertion = auth.mode == "wpa3-sae" -> bssCfg.managementFrameProtection == 2;
-                  message = ''hostapd radio ${radio} bss ${bss}: uses WPA3-SAE which requires managementFrameProtection="required"'';
-                }
-                {
-                  assertion = auth.mode == "wpa3-sae-transition" -> bssCfg.managementFrameProtection != 0;
-                  message = ''hostapd radio ${radio} bss ${bss}: uses WPA3-SAE in transition mode with WPA2-SHA256, which requires managementFrameProtection="optional" or ="required"'';
-                }
                {
                  assertion = countWpaPasswordDefinitions <= 1;
                  message = ''hostapd radio ${radio} bss ${bss}: must use at most one WPA password option (wpaPassword, wpaPasswordFile, wpaPskFile)'';
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@ -493,6 +493,8 @@ in
    services.phpfpm.pools.mediawiki = {
      inherit user group;
      phpEnv.MEDIAWIKI_CONFIG = "${mediawikiConfig}";
+      # https://www.mediawiki.org/wiki/Compatibility
+      phpPackage = pkgs.php81;
      settings = (if (cfg.webserver == "apache") then {
        "listen.owner" = config.services.httpd.user;
        "listen.group" = config.services.httpd.group;
@ -552,24 +554,20 @@ in
            deny all;
          '';
          # MediaWiki assets (usually images)
-          "~ ^/w/resources/(assets|lib|src)" = {
-            tryFiles = "$uri =404";
-            extraConfig = ''
-              add_header Cache-Control "public";
-              expires 7d;
-            '';
-          };
+          "~ ^/w/resources/(assets|lib|src)".extraConfig = ''
+            rewrite ^/w(/.*) $1 break;
+            add_header Cache-Control "public";
+            expires 7d;
+          '';
          # Assets, scripts and styles from skins and extensions
-          "~ ^/w/(skins|extensions)/.+\\.(css|js|gif|jpg|jpeg|png|svg|wasm|ttf|woff|woff2)$" = {
-            tryFiles = "$uri =404";
-            extraConfig = ''
-              add_header Cache-Control "public";
-              expires 7d;
-            '';
-          };
+          "~ ^/w/(skins|extensions)/.+\\.(css|js|gif|jpg|jpeg|png|svg|wasm|ttf|woff|woff2)$".extraConfig = ''
+            rewrite ^/w(/.*) $1 break;
+            add_header Cache-Control "public";
+            expires 7d;
+          '';

          # Handling for Mediawiki REST API, see [[mw:API:REST_API]]
-          "/w/rest.php".tryFiles = "$uri $uri/ /rest.php?$query_string";
+          "/w/rest.php/".tryFiles = "$uri $uri/ /w/rest.php?$query_string";

          # Handling for the article path (pretty URLs)
          "/wiki/".extraConfig = ''
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -253,9 +253,6 @@ done
@setHostId@

 # Load the required kernel modules.
-mkdir -p /lib
-ln -s @modulesClosure@/lib/modules /lib/modules
-ln -s @modulesClosure@/lib/firmware /lib/firmware
 echo @extraUtils@/bin/modprobe > /proc/sys/kernel/modprobe
 for i in @kernelModules@; do
    info "loading module $(basename $i)..."
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -307,7 +307,7 @@ let
      ${pkgs.buildPackages.busybox}/bin/ash -n $target
    '';

-    inherit linkUnits udevRules extraUtils modulesClosure;
+    inherit linkUnits udevRules extraUtils;

    inherit (config.boot) resumeDevice;

@ -349,6 +349,9 @@ let
      [ { object = bootStage1;
          symlink = "/init";
        }
+        { object = "${modulesClosure}/lib";
+          symlink = "/lib";
+        }
        { object = pkgs.runCommand "initrd-kmod-blacklist-ubuntu" {
              src = "${pkgs.kmod-blacklist-ubuntu}/modprobe.conf";
              preferLocalBuild = true;
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -997,7 +997,7 @@ in
              virtualisation.memorySize is above 2047, but qemu is only able to allocate 2047MB RAM on 32bit max.
            '';
          }
-          { assertion = cfg.directBoot.initrd != options.virtualisation.directBoot.initrd.default -> cfg.directBoot.enable;
+          { assertion = cfg.directBoot.enable || cfg.directBoot.initrd == options.virtualisation.directBoot.initrd.default;
            message =
              ''
                You changed the default of `virtualisation.directBoot.initrd` but you are not
--- a/nixos/modules/virtualisation/vagrant-guest.nix
+++ b/nixos/modules/virtualisation/vagrant-guest.nix
@ -55,4 +55,5 @@ in
  };

  security.sudo.wheelNeedsPassword = false;
+  security.sudo-rs.wheelNeedsPassword = false;
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -934,4 +934,5 @@ in {
  zram-generator = handleTest ./zram-generator.nix {};
  zrepl = handleTest ./zrepl.nix {};
  zsh-history = handleTest ./zsh-history.nix {};
+  zwave-js = handleTest ./zwave-js.nix {};
 }
--- a/nixos/tests/zwave-js.nix
+++ b/nixos/tests/zwave-js.nix
@ -0,0 +1,31 @@
+import ./make-test-python.nix ({ pkgs, lib, ...} :
+
+let
+  secretsConfigFile = pkgs.writeText "secrets.json" (builtins.toJSON {
+    securityKeys = {
+      "S0_Legacy" = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+    };
+  });
+in {
+  name = "zwave-js";
+  meta.maintainers = with lib.maintainers; [ graham33 ];
+
+  nodes = {
+    machine = { config, ... }: {
+      services.zwave-js = {
+        enable = true;
+        serialPort = "/dev/null";
+        extraFlags = ["--mock-driver"];
+        inherit secretsConfigFile;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("zwave-js.service")
+    machine.wait_for_open_port(3000)
+    machine.wait_until_succeeds("journalctl --since -1m --unit zwave-js --grep 'ZwaveJS server listening'")
+  '';
+})
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "lsp-plugins";
-  version = "1.2.12";
+  version = "1.2.13";

  src = fetchurl {
    url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-a3ts+7wiEwcoLPj6KsfP9lvTNTDSr9t+qEujSgpotXo=";
+    sha256 = "sha256-eJO+1fCNzqjTdGrPlhIrHc3UimkJOydRqTq49IN+Iwo=";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/applications/blockchains/mycrypto/default.nix
+++ b/pkgs/applications/blockchains/mycrypto/default.nix
@ -49,6 +49,6 @@ in appimageTools.wrapType2 rec {
    homepage = "https://mycrypto.com";
    license = licenses.mit;
    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ oxalica ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/editors/apostrophe/default.nix
+++ b/pkgs/applications/editors/apostrophe/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitLab, meson, ninja
 , wrapGAppsHook, pkg-config, desktop-file-utils
 , appstream-glib, pythonPackages, glib, gobject-introspection
-, gtk3, webkitgtk, glib-networking, gnome, gspell, texlive
+, gtk3, webkitgtk, glib-networking, gnome, gspell, texliveMedium
 , shared-mime-info, libhandy, fira, sassc
 }:

@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
    appstream-glib wrapGAppsHook sassc gobject-introspection ];

  buildInputs = [ glib pythonEnv gtk3
-    gnome.adwaita-icon-theme webkitgtk gspell texlive
+    gnome.adwaita-icon-theme webkitgtk gspell texliveMedium
    glib-networking libhandy ];

  postPatch = ''
@ -43,7 +43,7 @@ in stdenv.mkDerivation rec {
  preFixup = ''
    gappsWrapperArgs+=(
      --prefix PYTHONPATH : "$out/lib/python${pythonEnv.pythonVersion}/site-packages/"
-      --prefix PATH : "${texlive}/bin"
+      --prefix PATH : "${texliveMedium}/bin"
      --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
    )
  '';
--- a/pkgs/applications/editors/ne/default.nix
+++ b/pkgs/applications/editors/ne/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ncurses, texinfo6, texlive, perl, ghostscript }:
+{ lib, stdenv, fetchFromGitHub, ncurses, texinfo6, texliveMedium, perl, ghostscript }:

 stdenv.mkDerivation rec {
  pname = "ne";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    substituteInPlace src/makefile --replace "-lcurses" "-lncurses"
  '';

-  nativeBuildInputs = [ texlive.combined.scheme-medium texinfo6 perl ghostscript ];
+  nativeBuildInputs = [ texliveMedium texinfo6 perl ghostscript ];
  buildInputs = [ ncurses ];

  makeFlags = [ "PREFIX=${placeholder "out"}" ];
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@ -2,7 +2,7 @@
  guile_1_8, xmodmap, which, freetype,
  libjpeg,
  sqlite,
-  tex ? null,
+  texliveSmall ? null,
  aspell ? null,
  git ? null,
  python3 ? null,
@ -23,7 +23,8 @@ let
  pname = "texmacs";
  version = "2.1.2";
  common = callPackage ./common.nix {
-    inherit tex extraFonts chineseFonts japaneseFonts koreanFonts;
+    inherit extraFonts chineseFonts japaneseFonts koreanFonts;
+    tex = texliveSmall;
  };
 in
 stdenv.mkDerivation {
@ -70,7 +71,7 @@ stdenv.mkDerivation {
      which
      ghostscriptX
      aspell
-      tex
+      texliveSmall
      git
      python3
    ])
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@ -40,6 +40,7 @@
 , python3
 , substituteAll
 , wrapGAppsHook
+, libepoxy
 , zlib
 }:
 let
@ -48,12 +49,17 @@ let
      appdirs
      beautifulsoup4
      cachecontrol
-      filelock
+    ]
+    # CacheControl requires extra runtime dependencies for FileCache
+    # https://gitlab.com/inkscape/extras/extension-manager/-/commit/9a4acde6c1c028725187ff5972e29e0dbfa99b06
+    ++ cachecontrol.optional-dependencies.filecache
+    ++ [
      numpy
      lxml
      packaging
      pillow
      scour
+      pyparsing
      pyserial
      requests
      pygobject3
@ -61,11 +67,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "inkscape";
-  version = "1.2.2";
+  version = "1.3";

  src = fetchurl {
-    url = "https://media.inkscape.org/dl/resources/file/inkscape-${version}.tar.xz";
-    sha256 = "oMf9DQPAohU15kjvMB3PgN18/B81ReUQZfvxuj7opcQ=";
+    url = "https://inkscape.org/release/inkscape-${version}/source/archive/xz/dl/inkscape-${version}.tar.xz";
+    sha256 = "sha256-v08oawJeAWm4lIzBTVGZqbTCBNdhyJTEtISWVx7HYwc=";
  };

  # Inkscape hits the ARGMAX when linking on macOS. It appears to be
@ -143,6 +149,7 @@ stdenv.mkDerivation rec {
    potrace
    python3Env
    zlib
+    libepoxy
  ] ++ lib.optionals (!stdenv.isDarwin) [
    gspell
  ] ++ lib.optionals stdenv.isDarwin [
@ -152,8 +159,9 @@ stdenv.mkDerivation rec {

  # Make sure PyXML modules can be found at run-time.
  postInstall = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -change $out/lib/libinkscape_base.dylib $out/lib/inkscape/libinkscape_base.dylib $out/bin/inkscape
-    install_name_tool -change $out/lib/libinkscape_base.dylib $out/lib/inkscape/libinkscape_base.dylib $out/bin/inkview
+    for f in $out/lib/inkscape/*.dylib; do
+      ln -s $f $out/lib/$(basename $f)
+    done
  '';

  meta = with lib; {
--- a/pkgs/applications/graphics/ipe/default.nix
+++ b/pkgs/applications/graphics/ipe/default.nix
@ -13,7 +13,7 @@
 , libspiro
 , lua5
 , qtbase
-, texlive
+, texliveSmall
 , wrapQtAppsHook
 , zlib
 , withTeXLive ? true
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
    qtbase
    zlib
  ] ++ (lib.optionals withTeXLive [
-    texlive
+    texliveSmall
  ]);

  makeFlags = [
@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    "IPE_NO_SPELLCHECK=1" # qtSpell is not yet packaged
  ];

-  qtWrapperArgs = lib.optionals withTeXLive [ "--prefix PATH : ${lib.makeBinPath [ texlive ]}" ];
+  qtWrapperArgs = lib.optionals withTeXLive [ "--prefix PATH : ${lib.makeBinPath [ texliveSmall ]}" ];

  enableParallelBuilding = true;

--- a/pkgs/applications/misc/bazecor/10-dygma.rules
+++ b/pkgs/applications/misc/bazecor/10-dygma.rules
@ -0,0 +1,4 @@
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2201", MODE="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2200", MODE="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="35ef", MODE="0666"
+KERNEL=="hidraw*", ATTRS{idVendor}=="35ef", MODE="0666"
--- a/pkgs/applications/misc/bazecor/default.nix
+++ b/pkgs/applications/misc/bazecor/default.nix
@ -0,0 +1,56 @@
+{ lib
+, appimageTools
+, fetchurl
+}:
+
+appimageTools.wrapAppImage rec {
+  pname = "bazecor";
+  version = "1.3.6";
+
+  src = appimageTools.extract {
+    inherit pname version;
+    src = fetchurl {
+      url = "https://github.com/Dygmalab/Bazecor/releases/download/v.${version}/Bazecor-${version}-x64.AppImage";
+      hash = "sha256-Mz7T/AAlyfMzdfy/ZV4AEP3ClTolwr2pPzkSCPL66/w=";
+    };
+
+    # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
+    postExtract = ''
+      substituteInPlace \
+        $out/usr/lib/bazecor/resources/app/.webpack/main/index.js \
+        --replace \
+          'checkUdev=()=>{try{if(c.default.existsSync(f))return c.default.readFileSync(f,"utf-8").trim()===l.trim()}catch(e){console.error(e)}return!1}' \
+          'checkUdev=()=>{return 1}'
+    '';
+  };
+
+  # also make sure to update the udev rules in ./10-dygma.rules; most recently
+  # taken from
+  # https://github.com/Dygmalab/Bazecor/blob/v1.3.6/src/main/utils/udev.ts#L6
+
+  extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
+    p.glib
+  ];
+
+  # Also expose the udev rules here, so it can be used as:
+  #   services.udev.packages = [ pkgs.bazecor ];
+  # to allow non-root modifications to the keyboards.
+
+  extraInstallCommands = ''
+    mv $out/bin/bazecor-* $out/bin/bazecor
+
+    mkdir -p $out/lib/udev/rules.d
+    ln -s --target-directory=$out/lib/udev/rules.d ${./10-dygma.rules}
+  '';
+
+  meta = {
+    description = "Graphical configurator for Dygma Products";
+    homepage = "https://github.com/Dygmalab/Bazecor";
+    changelog = "https://github.com/Dygmalab/Bazecor/releases/tag/v${version}";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ amesgen ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "bazecor";
+  };
+}
--- a/pkgs/applications/misc/birdtray/default.nix
+++ b/pkgs/applications/misc/birdtray/default.nix
@ -33,7 +33,7 @@ mkDerivation rec {
    description = "Mail system tray notification icon for Thunderbird";
    homepage = "https://github.com/gyunaev/birdtray";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ Flakebi oxalica ];
+    maintainers = with maintainers; [ Flakebi ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/stretchly/default.nix
+++ b/pkgs/applications/misc/stretchly/default.nix
@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
    homepage = "https://hovancik.net/stretchly";
    downloadPage = "https://hovancik.net/stretchly/downloads/";
    license = licenses.bsd2;
-    maintainers = with maintainers; [ _1000101 oxalica ];
+    maintainers = with maintainers; [ _1000101 ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/therion/default.nix
+++ b/pkgs/applications/misc/therion/default.nix
@ -10,7 +10,7 @@
 , expat
 , bwidget
 , python3
-, texlive
+, texliveTeTeX
 , survex
 , makeWrapper
 , fmt
@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
    pkg-config
    perl
    python3
-    texlive.combined.scheme-tetex
+    texliveTeTeX
    makeWrapper
    tcl.tclPackageHook
  ];
@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
  fixupPhase = ''
    runHook preFixup
    wrapProgram $out/bin/therion \
-      --prefix PATH : ${lib.makeBinPath [ survex texlive.combined.scheme-tetex ]}
+      --prefix PATH : ${lib.makeBinPath [ survex texliveTeTeX ]}
    wrapProgram $out/bin/xtherion \
      --prefix PATH : ${lib.makeBinPath [ tk ]}
    runHook postFixup
--- a/pkgs/applications/misc/yubioath-flutter/helper.nix
+++ b/pkgs/applications/misc/yubioath-flutter/helper.nix
@ -4,7 +4,7 @@
 , yubikey-manager
 , fido2
 , mss
-, zxing_cpp
+, zxing-cpp
 , pillow
 , cryptography

@ -43,7 +43,7 @@ buildPythonApplication {
    yubikey-manager
    fido2
    mss
-    zxing_cpp
+    zxing-cpp
    pillow
    cryptography
  ];
--- a/pkgs/applications/misc/zettlr/default.nix
+++ b/pkgs/applications/misc/zettlr/default.nix
@ -1,6 +1,6 @@
-{ callPackage, texlive }:
+{ callPackage, texliveMedium }:

-builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; inherit texlive; })) {
+builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; inherit texliveMedium; })) {
  zettlr = {
    version = "3.0.2";
    hash = "sha256-xwBq+kLmTth15uLiYWJOhi/YSPZVJNO6JTrKFojSDXA=";
--- a/pkgs/applications/misc/zettlr/generic.nix
+++ b/pkgs/applications/misc/zettlr/generic.nix
@ -4,7 +4,7 @@
 , appimageTools
 , lib
 , fetchurl
-, texlive
+, texliveMedium
 , pandoc
 }:

@ -23,7 +23,7 @@ appimageTools.wrapType2 rec {
  inherit name src;

  multiArch = false; # no 32bit needed
-  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ texlive pandoc ];
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ texliveMedium pandoc ];
  extraInstallCommands = ''
    mv $out/bin/{${name},${pname}}
    install -m 444 -D ${appimageContents}/Zettlr.desktop $out/share/applications/Zettlr.desktop
--- a/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "kubectl-cnpg";
-  version = "1.20.2";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "cloudnative-pg";
    repo = "cloudnative-pg";
    rev = "v${version}";
-    hash = "sha256-JkvaFhzazvuqRJ6ertwMQhp+H2zsjRGA23XbvLCIYg0=";
+    hash = "sha256-FRSypaZex55ABE+e23kvNZFTTn6Z8AEy8ag3atwMdEk=";
  };

-  vendorHash = "sha256-unOPTQeJW9rUOpZh7gTjD8IZDh4wi04oBAfDO5juJf8=";
+  vendorHash = "sha256-mirnieBrrVwRccJDgelZvSfQaAVlTsttOh3nJBN6ev0=";

  subPackages = [ "cmd/kubectl-cnpg" ];

--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.53.0";
+  version = "0.53.2";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-Y3the1+p+ZAkPxKnScNIup7cfyTtE2LU3IdghA0mOY8=";
+    hash = "sha256-nolZ660rU7WisQdufswrH5vqAedKlA3Y0AQMul/+sTo=";
  };

-  vendorHash = "sha256-5O3souGEosqLFxZpGbak4r57V39lR6X8mEPgfad3X5Q=";
+  vendorHash = "sha256-1+ebqMqtil2/KrFjRIfCx60aWu8ByIFV1my8RiUrSNo=";

  doCheck = false;

--- a/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/default.nix
@ -1,7 +1,7 @@
 { lib
 , newScope
 , pidgin
-, texlive
+, texliveBasic
 , config
 }:

@ -19,7 +19,7 @@ lib.makeScope newScope (self:
    pidgin-indicator = callPackage ./pidgin-indicator { };

    pidgin-latex = callPackage ./pidgin-latex {
-      texLive = texlive.combined.scheme-basic;
+      texLive = texliveBasic;
    };

    pidgin-msn-pecan = callPackage ./msn-pecan { };
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -1,58 +1,92 @@
-{ mkDerivation, lib, stdenv, fetchFromGitHub, pkg-config
-, boost, libtorrent-rasterbar, qtbase, qttools, qtsvg
-, debugSupport ? false
-, guiSupport ? true, dbus ? null # GUI (disable to run headless)
-, webuiSupport ? true # WebUI
-, trackerSearch ? true, python3 ? null
+{ lib
+, stdenv
+, fetchFromGitHub
+
+, boost
+, cmake
+, Cocoa
+, libtorrent-rasterbar
+, ninja
+, qtbase
+, qtsvg
+, qttools
+, wrapQtAppsHook
+
+, guiSupport ? true
+, dbus
+, qtwayland
+
+, trackerSearch ? true
+, python3
+
+, webuiSupport ? true
 }:

-assert guiSupport -> (dbus != null);
-assert trackerSearch -> (python3 != null);
-
-mkDerivation rec {
-  pname = "qbittorrent" + lib.optionalString (!guiSupport) "-nox";
-  version = "4.5.5";
+let
+  qtVersion = lib.versions.major qtbase.version;
+in
+stdenv.mkDerivation rec {
+  pname = "qbittorrent"
+    + lib.optionalString (guiSupport && qtVersion == "5") "-qt5"
+    + lib.optionalString (!guiSupport) "-nox";
+  version = "4.6.0";

  src = fetchFromGitHub {
    owner = "qbittorrent";
    repo = "qBittorrent";
    rev = "release-${version}";
-    hash = "sha256-rWv+KGw+3385GOKK4MvoSP0CepotUZELiDVFpyDf+9k=";
+    hash = "sha256-o9zMGjVCXLqdRdXzRs1kFPDMFJXQWBEtWwIfeIyFxJw=";
  };

-  enableParallelBuilding = true;
+  nativeBuildInputs = [
+    cmake
+    ninja
+    wrapQtAppsHook
+  ];

-  # NOTE: 2018-05-31: CMake is working but it is not officially supported
-  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    boost
+    libtorrent-rasterbar
+    qtbase
+    qtsvg
+    qttools
+  ] ++ lib.optionals stdenv.isDarwin [
+    Cocoa
+  ] ++ lib.optionals guiSupport [
+    dbus
+  ] ++ lib.optionals (guiSupport && stdenv.isLinux) [
+    qtwayland
+  ] ++ lib.optionals trackerSearch [
+    python3
+  ];

-  buildInputs = [ boost libtorrent-rasterbar qtbase qttools qtsvg ]
-    ++ lib.optional guiSupport dbus # D(esktop)-Bus depends on GUI support
-    ++ lib.optional trackerSearch python3;
+  cmakeFlags = lib.optionals (qtVersion == "6") [
+    "-DQT6=ON"
+  ] ++ lib.optionals (!guiSupport) [
+    "-DGUI=OFF"
+    "-DSYSTEMD=ON"
+    "-DSYSTEMD_SERVICES_INSTALL_DIR=${placeholder "out"}/lib/systemd/system"
+  ] ++ lib.optionals (!webuiSupport) [
+    "-DWEBUI=OFF"
+  ];

-  # Otherwise qm_gen.pri assumes lrelease-qt5, which does not exist.
-  QMAKE_LRELEASE = "lrelease";
-
-  configureFlags = [
-    "--with-boost-libdir=${boost.out}/lib"
-    "--with-boost=${boost.dev}" ]
-    ++ lib.optionals (!guiSupport) [ "--disable-gui" "--enable-systemd" ] # Also place qbittorrent-nox systemd service files
-    ++ lib.optional (!webuiSupport) "--disable-webui"
-    ++ lib.optional debugSupport "--enable-debug";
-
-  qtWrapperArgs = lib.optional trackerSearch "--prefix PATH : ${lib.makeBinPath [ python3 ]}";
+  qtWrapperArgs = lib.optionals trackerSearch [
+    "--prefix PATH : ${lib.makeBinPath [ python3 ]}"
+  ];

  postInstall = lib.optionalString stdenv.isDarwin ''
+    APP_NAME=qbittorrent${lib.optionalString (!guiSupport) "-nox"}
    mkdir -p $out/{Applications,bin}
-    cp -R src/${pname}.app $out/Applications
-    makeWrapper $out/{Applications/${pname}.app/Contents/MacOS,bin}/${pname}
+    cp -R $APP_NAME.app $out/Applications
+    makeWrapper $out/{Applications/$APP_NAME.app/Contents/MacOS,bin}/$APP_NAME
  '';

  meta = with lib; {
    description = "Featureful free software BitTorrent client";
-    homepage    = "https://www.qbittorrent.org/";
-    changelog   = "https://github.com/qbittorrent/qBittorrent/blob/release-${version}/Changelog";
-    license     = licenses.gpl2Plus;
-    platforms   = platforms.unix;
-    maintainers = with maintainers; [ Anton-Latukha kashw2 ];
+    homepage = "https://www.qbittorrent.org";
+    changelog = "https://github.com/qbittorrent/qBittorrent/blob/release-${version}/Changelog";
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ Anton-Latukha kashw2 paveloom ];
  };
 }
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@ -215,7 +215,7 @@ python.pkgs.buildPythonApplication rec {
    whoosh
    zipp
    zope_interface
-    zxing_cpp
+    zxing-cpp
  ]
  ++ redis.optional-dependencies.hiredis
  ++ twisted.optional-dependencies.tls
--- a/pkgs/applications/office/paperwork/paperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/paperwork-gtk.nix
@ -13,7 +13,7 @@
 , gettext
 , gobject-introspection
 , gdk-pixbuf
-, texlive
+, texliveSmall
 , imagemagick
 , perlPackages
 , writeScript
@ -21,9 +21,7 @@

 let
  documentation_deps = [
-    (texlive.combine {
-      inherit (texlive) scheme-small wrapfig gensymb;
-    })
+    (texliveSmall.withPackages (ps: with ps; [ wrapfig gensymb ]))
    xvfb-run
    imagemagick
    perlPackages.Po4a
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.65.4";
+  version = "0.65.5";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-2+1lwaO2+kq/EjJoA4EvGCMLH6iErR9KtWINLoO17+w=";
+    hash = "sha256-NdBs/WyN1WDOJ5tnIYPtQTAm4EdVJj1HXm2KIjOKC7E=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@ -8,7 +8,7 @@
 , blas-ilp64
 , hdf5-cpp
 , python3
-, texlive
+, texliveMinimal
 , armadillo
 , libxc
 , makeWrapper
@ -78,7 +78,7 @@ stdenv.mkDerivation {
    perl
    gfortran
    cmake
-    texlive.combined.scheme-minimal
+    texliveMinimal
    makeWrapper
    autoPatchelfHook
  ];
--- a/pkgs/applications/science/electronics/xyce/default.nix
+++ b/pkgs/applications/science/electronics/xyce/default.nix
@ -16,7 +16,7 @@
 , trilinos
 , withMPI ? false
  # for doc
-, texlive
+, texliveMedium
 , pandoc
 , enableDocs ? true
  # for tests
@ -81,16 +81,14 @@ stdenv.mkDerivation rec {
    gfortran
    libtool_2
  ] ++ lib.optionals enableDocs [
-    (texlive.combine {
-      inherit (texlive)
-        scheme-medium
+    (texliveMedium.withPackages (ps: with ps; [
        koma-script
        optional
        framed
        enumitem
        multirow
-        preprint;
-    })
+        preprint
+      ]))
  ];

  buildInputs = [
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng
-, libtiff, ncurses, pango, pcre2, perl, readline, tcl, texlive, texLive, tk, xz, zlib
+, libtiff, ncurses, pango, pcre2, perl, readline, tcl, texlive, texliveSmall, tk, xz, zlib
 , less, texinfo, graphviz, icu, pkg-config, bison, imake, which, jdk, blas, lapack
 , curl, Cocoa, Foundation, libobjc, libcxx, tzdata
 , withRecommendedPackages ? true
@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
    bzip2 gfortran libX11 libXmu libXt libXt libjpeg libpng libtiff ncurses
-    pango pcre2 perl readline texLive xz zlib less texinfo graphviz icu
+    pango pcre2 perl readline (texliveSmall.withPackages (ps: with ps; [ inconsolata helvetic ps.texinfo fancyvrb cm-super rsfs ])) xz zlib less texinfo graphviz icu
    bison imake which blas lapack curl tcl tk jdk tzdata
  ] ++ lib.optionals stdenv.isDarwin [ Cocoa Foundation libobjc libcxx ];

--- a/pkgs/applications/science/math/giac/default.nix
+++ b/pkgs/applications/science/math/giac/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchpatch, texlive, bison, flex, lapack, blas
+{ stdenv, lib, fetchurl, fetchpatch, texliveSmall, bison, flex, lapack, blas
 , autoreconfHook, gmp, mpfr, pari, ntl, gsl, mpfi, ecm, glpk, nauty
 , buildPackages, readline, gettext, libpng, libao, gfortran, perl
 , enableGUI ? false, libGL, libGLU, xorg, fltk
@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
  '';

  nativeBuildInputs = [
-    autoreconfHook texlive.combined.scheme-small bison flex
+    autoreconfHook texliveSmall bison flex
  ];

  # perl is only needed for patchShebangs fixup.
--- a/pkgs/applications/science/math/pari/default.nix
+++ b/pkgs/applications/science/math/pari/default.nix
@ -7,7 +7,7 @@
 , libpthreadstubs
 , perl
 , readline
-, tex
+, texliveBasic
 , withThread ? true
 }:

@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    libX11
    perl
    readline
-    tex
+    texliveBasic
  ] ++ lib.optionals withThread [
    libpthreadstubs
  ];
--- a/pkgs/applications/science/math/singular/default.nix
+++ b/pkgs/applications/science/math/singular/default.nix
@ -17,7 +17,7 @@
 # use letters instead of numbers for post-appendix chapters, and we
 # want it to match the upstream format because sage depends on it.
 , texinfo4
-, texlive
+, texliveSmall
 , enableDocs ? !stdenv.isDarwin
 , enableGfanlib ? true
 }:
@ -86,7 +86,7 @@ stdenv.mkDerivation rec {
    graphviz
    latex2html
    texinfo4
-    texlive.combined.scheme-small
+    texliveSmall
  ] ++ lib.optionals stdenv.isDarwin [ getconf ];
  depsBuildBuild = [ buildPackages.stdenv.cc ];

--- a/pkgs/applications/version-management/gitoxide/default.nix
+++ b/pkgs/applications/version-management/gitoxide/default.nix
@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitoxide";
-  version = "0.30.0";
+  version = "0.31.1";

  src = fetchFromGitHub {
    owner = "Byron";
    repo = "gitoxide";
    rev = "v${version}";
-    hash = "sha256-VJZwNLFePUNIRHEyiEr1tiLaB2tuL6Ah81LNuM/1H14=";
+    hash = "sha256-ML0sVsegrG96rBfpnD7GgOf9TWe/ojRo9UJwMFpDsKs=";
  };

-  cargoHash = "sha256-vEp0wLxmmmv33oRO7eOxOoOsV87/7DQ8db5RUfqUb88=";
+  cargoHash = "sha256-gz4VY4a4AK9laIQo2MVTabyKzMyc7jRHrYsrfOLx+Ao=";

  nativeBuildInputs = [ cmake pkg-config ];

--- a/pkgs/applications/version-management/gut/default.nix
+++ b/pkgs/applications/version-management/gut/default.nix
@ -1,21 +1,21 @@
-{ buildGoModule
+{ lib
+, buildGoModule
 , fetchFromGitHub
-, lib
 , nix-update-script
 }:

 buildGoModule rec {
  pname = "gut";
-  version = "0.2.10";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "julien040";
    repo = "gut";
    rev = version;
-    hash = "sha256-y6GhLuTqOaxAQjDgqh1ivDwGhpYY0a6ZNDdE3Pox3is=";
+    hash = "sha256-l7yjZEcpsnVisd93EqIug1n0k18m4tUmCQFXC6b63cg=";
  };

-  vendorHash = "sha256-91iyAFD/RPEkMarKKVwJ4t92qosP2Db1aQ6dmNZNDwU=";
+  vendorHash = "sha256-G9oDMHLmdv/vQfofTqKAf21xaGp+lvW+sedLmaj+A5A=";

  ldflags = [ "-s" "-w" "-X github.com/julien040/gut/src/telemetry.gutVersion=${version}" ];

@ -24,10 +24,10 @@ buildGoModule rec {

  passthru.updateScript = nix-update-script { };

-  meta = {
-    description = "An easy-to-use git client for Windows, macOS, and Linux";
-    homepage = "https://github.com/slackhq/go-audit";
-    maintainers = [ lib.maintainers.paveloom ];
-    license = [ lib.licenses.mit ];
+  meta = with lib; {
+    description = "An alternative git CLI";
+    homepage = "https://gut-cli.dev";
+    license = licenses.mit;
+    maintainers = with maintainers; [ paveloom ];
  };
 }
--- a/pkgs/applications/video/manim/default.nix
+++ b/pkgs/applications/video/manim/default.nix
@ -4,7 +4,7 @@

 , cairo
 , ffmpeg
-, texlive
+, texliveInfraOnly

 , python3
 }:
@ -21,11 +21,10 @@ let
  #   https://github.com/yihui/tinytex/blob/master/tools/pkgs-custom.txt
  #
  # these two combined add up to:
-  manim-tinytex = {
-    inherit (texlive)
+  manim-tinytex = texliveInfraOnly.withPackages (ps: with ps; [

    # tinytex
-    scheme-infraonly amsfonts amsmath atbegshi atveryend auxhook babel bibtex
+    amsfonts amsmath atbegshi atveryend auxhook babel bibtex
    bigintcalc bitset booktabs cm dehyph dvipdfmx dvips ec epstopdf-pkg etex
    etexcmds etoolbox euenc everyshi fancyvrb filehook firstaid float fontspec
    framed geometry gettitlestring glyphlist graphics graphics-cfg graphics-def
@ -41,8 +40,8 @@ let
    # manim-latex
    standalone everysel preview doublestroke ms setspace rsfs relsize ragged2e
    fundus-calligra microtype wasysym physics dvisvgm jknapltx wasy cm-super
-    babel-english gnu-freefont mathastext cbfonts-fd;
-  };
+    babel-english gnu-freefont mathastext cbfonts-fd
+  ]);

  python = python3.override {
    packageOverrides = self: super: {
@ -129,13 +128,13 @@ in python.pkgs.buildPythonApplication rec {
  makeWrapperArgs = [
    "--prefix" "PATH" ":" (lib.makeBinPath [
      ffmpeg
-      (texlive.combine manim-tinytex)
+      manim-tinytex
    ])
  ];

  nativeCheckInputs = [
    ffmpeg
-    (texlive.combine manim-tinytex)
+    manim-tinytex
  ] ++ (with python.pkgs; [
    pytest-xdist
    pytestCheckHook
--- a/pkgs/applications/video/vdr/markad/default.nix
+++ b/pkgs/applications/video/vdr/markad/default.nix
@ -19,12 +19,12 @@
 }:
 stdenv.mkDerivation rec {
  pname = "vdr-markad";
-  version = "3.3.5";
+  version = "3.3.6";

  src = fetchFromGitHub {
    repo = "vdr-plugin-markad";
    owner = "kfb77";
-    sha256 = "sha256-5D4nlGZfmPaNaLx2PoqLRqlbcukpM6DHpCtqmee+cww=";
+    sha256 = "sha256-aHhQljWE1om/mILM+TXB9uPTrUwNNc4Loiejbakj9NU=";
    rev = "V${version}";
  };

--- a/pkgs/applications/video/vdr/nopacity/default.nix
+++ b/pkgs/applications/video/vdr/nopacity/default.nix
@ -1,12 +1,12 @@
 { stdenv, lib, fetchFromGitLab, vdr, graphicsmagick }:
 stdenv.mkDerivation rec {
  pname = "vdr-skin-nopacity";
-  version = "1.1.14";
+  version = "1.1.16";

  src = fetchFromGitLab {
    repo = "SkinNopacity";
    owner = "kamel5";
-    sha256 = "sha256-zSAnjBkFR8m+LXeoYO163VkNtVpfQZR5fI5CEzUABdQ=";
+    sha256 = "sha256-5TTilBKlNsFBm5BaCoRV1LzZgpad2lOIQGyk94jGYls=";
    rev = version;
  };

--- a/pkgs/applications/video/vdr/softhddevice/default.nix
+++ b/pkgs/applications/video/vdr/softhddevice/default.nix
@ -12,12 +12,12 @@
 }:
 stdenv.mkDerivation rec {
  pname = "vdr-softhddevice";
-  version = "1.12.1";
+  version = "1.12.5";

  src = fetchFromGitHub {
    owner = "ua0lnj";
    repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-/Q+O/6kK55E+JN1khRvM7F6H/Vnp/OOD80eU4zmrBt8=";
+    sha256 = "sha256-T+jmsHZA7poxwLSFi9N8ALa0te735HQer9ByH2Wub60=";
    rev = "v${version}";
  };

--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@ -207,7 +207,7 @@ checkout_ref(){

 # Update submodules
 init_submodules(){
-    clean_git submodule update --init --recursive -j ${NIX_BUILD_CORES:-1}
+    clean_git submodule update --init --recursive -j ${NIX_BUILD_CORES:-1} --progress
 }

 clone(){
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, stdenvNoCC, lndir, runtimeShell, shellcheck, haskell }:
+{ lib, stdenv, stdenvNoCC, lndir, runtimeShell, shellcheck-minimal }:

 let
  inherit (lib)
@ -365,12 +365,12 @@ rec {
        # GHC (=> shellcheck) isn't supported on some platforms (such as risc-v)
        # but we still want to use writeShellApplication on those platforms
        let
-          shellcheckSupported = lib.meta.availableOn stdenv.buildPlatform shellcheck.compiler;
+          shellcheckSupported = lib.meta.availableOn stdenv.buildPlatform shellcheck-minimal.compiler;
          excludeOption = lib.optionalString (excludeShellChecks != [  ]) "--exclude '${lib.concatStringsSep "," excludeShellChecks}'";
          shellcheckCommand = lib.optionalString shellcheckSupported ''
            # use shellcheck which does not include docs
            # pandoc takes long to build and documentation isn't needed for just running the cli
-            ${lib.getExe (haskell.lib.compose.justStaticExecutables shellcheck.unwrapped)} ${excludeOption} "$target"
+            ${lib.getExe shellcheck-minimal} ${excludeOption} "$target"
          '';
        in
        if checkPhase == null then ''
--- a/pkgs/by-name/cl/clamtk/package.nix
+++ b/pkgs/by-name/cl/clamtk/package.nix
@ -0,0 +1,69 @@
+{ lib
+, perlPackages
+, fetchFromGitHub
+, makeWrapper
+, gobject-introspection
+, perl
+, clamav
+}:
+
+perlPackages.buildPerlPackage rec {
+  pname = "clamtk";
+  version = "6.16";
+
+  src = fetchFromGitHub {
+    owner = "dave-theunsub";
+    repo = "clamtk";
+    rev = "v${version}";
+    hash = "sha256-o6OaXOXLykTUuF/taKnEhZRV04/3nlU5aNY05ANr1Ko=";
+  };
+
+  nativeBuildInputs = [ makeWrapper gobject-introspection ];
+  buildInputs = [ perl clamav ];
+  propagatedBuildInputs = with perlPackages; [ Glib LWP LWPProtocolHttps TextCSV JSON LocaleGettext Gtk3 ];
+
+  preConfigure = "touch Makefile.PL";
+  # no tests implemented
+  doCheck = false;
+  outputs = [ "out" "man" ];
+
+  postPatch = ''
+    # Set correct nix paths in perl scripts
+    substituteInPlace lib/App.pm \
+      --replace /usr/bin/freshclam ${lib.getBin clamav}/bin/freshclam \
+      --replace /usr/bin/sigtool ${lib.getBin clamav}/bin/sigtool \
+      --replace /usr/bin/clamscan ${lib.getBin clamav}/bin/clamscan \
+      --replace /usr/bin/clamdscan ${lib.getBin clamav}/bin/clamdscan \
+      --replace /usr/share/pixmaps $out/share/pixmaps
+
+    # We want to catch the crontab wrapper on NixOS and the
+    # System crontab on non-NixOS so we don't give a full path.
+    substituteInPlace lib/Schedule.pm \
+      --replace "( -e '/usr/bin/crontab' )" "(1)" \
+      --replace /usr/bin/crontab crontab
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D lib/*.pm -t $out/lib/perl5/site_perl/ClamTk
+    install -D clamtk.desktop -t $out/share/applications
+    install -D images/* -t $out/share/pixmaps
+    install -D clamtk.1.gz -t $out/share/man/man1
+    install -D -m755 clamtk -t $out/bin
+    wrapProgram $out/bin/clamtk --prefix PERL5LIB : $PERL5LIB --set GI_TYPELIB_PATH "$GI_TYPELIB_PATH"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = ''
+      Easy to use, lightweight front-end for ClamAV (Clam Antivirus).
+    '';
+    license = licenses.gpl1Plus;
+    homepage = "https://github.com/dave-theunsub/clamtk";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jgarcia ];
+  };
+
+}
--- a/pkgs/by-name/ll/llm-ls/package.nix
+++ b/pkgs/by-name/ll/llm-ls/package.nix
@ -0,0 +1,31 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+let
+  pname = "llm-ls";
+  version = "0.4.0";
+in
+rustPlatform.buildRustPackage {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "huggingface";
+    repo = "llm-ls";
+    rev = version;
+    sha256 = "sha256-aMoT/rH6o4dHCSiSI/btdKysFfIbHvV7R5dRHIOF/Qs=";
+  };
+
+  cargoHash = "sha256-Z6BO4kDtlIrVdDk1fiwyelpu1rj7e4cibgFZRsl1pfA=";
+
+  meta = with lib; {
+    description = "LSP server leveraging LLMs for code completion (and more?)";
+    homepage = "https://github.com/huggingface/llm-ls";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jfvillablanca ];
+    platforms = platforms.all;
+    badPlatforms = platforms.darwin;
+    mainProgram = "llm-ls";
+  };
+}
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@ -10,7 +10,7 @@ let

  src = fetchurl {
    url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}.AppImage";
-    hash = "sha256-6OAGNkMyHOZI5wh92OtalnvUVFWNAS9PvkFS0e4YXhk=";
+    hash = "sha512-YUddAvsPbuuOvhJZsWDvgF/7yghABU6Av7DcKNX1bKZqE3BzMAAQADJuNuNL4+UydoTaHetXvRO8oJCbrqgtAQ==";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
@ -30,6 +30,8 @@ appimageTools.wrapType2 rec {
      --replace 'Icon=launcher' 'Icon=lunar-client'
  '';

+  passthru.updateScript = ./update.sh;
+
  meta = with lib; {
    description = "Free Minecraft client with mods, cosmetics, and performance boost.";
    homepage = "https://www.lunarclient.com/";
--- a/pkgs/by-name/lu/lunar-client/update.sh
+++ b/pkgs/by-name/lu/lunar-client/update.sh
@ -0,0 +1,12 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl yq
+set -eu -o pipefail
+
+target="$(dirname "$(readlink -f "$0")")/package.nix"
+host="https://launcherupdates.lunarclientcdn.com"
+metadata=$(curl "$host/latest-linux.yml")
+version=$(echo "$metadata" | yq .version -r)
+sha512=$(echo "$metadata" | yq .sha512 -r)
+
+sed -i "s@version = .*;@version = \"$version\";@g" "$target"
+sed -i "s@hash.* = .*;@hash = \"sha512-$sha512\";@g" "$target"
--- a/pkgs/by-name/lu/lunarvim/package.nix
+++ b/pkgs/by-name/lu/lunarvim/package.nix
@ -0,0 +1,147 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, makeWrapper
+, cargo
+, curl
+, fd
+, fzf
+, git
+, gnumake
+, gnused
+, gnutar
+, gzip
+, lua-language-server
+, neovim
+, nodejs
+, nodePackages
+, ripgrep
+, tree-sitter
+, unzip
+, nvimAlias ? false
+, viAlias ? false
+, vimAlias ? false
+, globalConfig ? ""
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  inherit nvimAlias viAlias vimAlias globalConfig;
+
+  pname = "lunarvim";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "LunarVim";
+    repo = "LunarVim";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-z1Cw3wGpFDmlrAIy7rrjlMtzcW7a6HWSjI+asEDcGPA=";
+  };
+
+  # Pull in the fix for Nerd Fonts until the next release
+  patches = [
+    (
+      fetchpatch {
+        url = "https://github.com/LunarVim/LunarVim/commit/d187cbd03fbc8bd1b59250869e0e325518bf8798.patch";
+        sha256 = "sha256-ktkQ2GiIOhbVOMjy1u5Bf8dJP4SXHdG4j9OEFa9Fm7w=";
+      }
+    )
+  ];
+
+  nativeBuildInputs = [
+    gnused
+    makeWrapper
+  ];
+
+  runtimeDeps = [
+    stdenv.cc
+    cargo
+    curl
+    fd
+    fzf
+    git
+    gnumake
+    gnutar
+    gzip
+    lua-language-server
+    neovim
+    nodejs
+    nodePackages.neovim
+    ripgrep
+    tree-sitter
+    unzip
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    mkdir -p share/lvim
+    cp init.lua utils/installer/config.example.lua share/lvim
+    cp -r lua snapshots share/lvim
+
+    mkdir bin
+    cp utils/bin/lvim.template bin/lvim
+    chmod +x bin/lvim
+
+    # LunarVim automatically copies config.example.lua, but we need to make it writable.
+    sed -i "2 i\\
+            if [ ! -f \$HOME/.config/lvim/config.lua ]; then \\
+              cp $out/share/lvim/config.example.lua \$HOME/.config/lvim/config.lua \\
+              chmod +w \$HOME/.config/lvim/config.lua \\
+            fi
+    " bin/lvim
+
+    substituteInPlace bin/lvim \
+      --replace NVIM_APPNAME_VAR lvim \
+      --replace RUNTIME_DIR_VAR \$HOME/.local/share/lvim \
+      --replace CONFIG_DIR_VAR \$HOME/.config/lvim \
+      --replace CACHE_DIR_VAR \$HOME/.cache/lvim \
+      --replace BASE_DIR_VAR $out/share/lvim \
+      --replace nvim ${neovim}/bin/nvim
+
+    # Allow language servers to be overridden by appending instead of prepending
+    # the mason.nvim path.
+    echo "lvim.builtin.mason.PATH = \"append\"" > share/lvim/global.lua
+    echo ${ lib.strings.escapeShellArg finalAttrs.globalConfig } >> share/lvim/global.lua
+    sed -i "s/add_to_path()/add_to_path(true)/" share/lvim/lua/lvim/core/mason.lua
+    sed -i "/Log:set_level/idofile(\"$out/share/lvim/global.lua\")" share/lvim/lua/lvim/config/init.lua
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r bin share $out
+
+    for iconDir in utils/desktop/*/; do
+      install -Dm444 $iconDir/lvim.svg -t $out/share/icons/hicolor/$(basename $iconDir)/apps
+    done
+
+    install -Dm444 utils/desktop/lvim.desktop -t $out/share/applications
+
+    wrapProgram $out/bin/lvim --prefix PATH : ${ lib.makeBinPath finalAttrs.runtimeDeps } \
+      --prefix LD_LIBRARY_PATH : ${stdenv.cc.cc.lib} \
+      --prefix CC : ${stdenv.cc.targetPrefix}cc
+  '' + lib.optionalString finalAttrs.nvimAlias ''
+    ln -s $out/bin/lvim $out/bin/nvim
+  '' + lib.optionalString finalAttrs.viAlias ''
+    ln -s $out/bin/lvim $out/bin/vi
+  '' + lib.optionalString finalAttrs.vimAlias ''
+    ln -s $out/bin/lvim $out/bin/vim
+  '' + ''
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "IDE layer for Neovim";
+    homepage = "https://www.lunarvim.org/";
+    changelog = "https://github.com/LunarVim/LunarVim/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    sourceProvenance = with sourceTypes; [ fromSource ];
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ prominentretail ];
+    platforms = platforms.unix;
+    mainProgram = "lvim";
+  };
+})
--- a/pkgs/by-name/nu/nuget/package.nix
+++ b/pkgs/by-name/nu/nuget/package.nix
@ -45,6 +45,6 @@ stdenv.mkDerivation (attrs: {
    license = licenses.mit;
    sourceProvenance = [ sourceTypes.binaryBytecode ];
    maintainers = [ maintainers.mdarocha ];
-    platforms = [ "x86_64-linux" ];
+    inherit (mono.meta) platforms;
  };
 })
--- a/pkgs/by-name/sx/sxhkd/package.nix
+++ b/pkgs/by-name/sx/sxhkd/package.nix
@ -29,6 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
    })
  ];

+  outputs = [ "out" "doc" "man" ];
+
  nativeBuildInputs = [
    asciidoc
  ];
@ -40,13 +42,16 @@ stdenv.mkDerivation (finalAttrs: {
    xcbutilwm
  ];

+  strictDeps = true;
+
  makeFlags = [ "PREFIX=$(out)" ];

-  meta = with lib; {
+  meta = {
    description = "Simple X hotkey daemon";
    homepage = "https://github.com/baskerville/sxhkd";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ vyp AndersonTorres ncfavier ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd2;
+    mainProgram = "sxhkd";
+    maintainers = with lib.maintainers; [ vyp AndersonTorres ncfavier ];
+    inherit (libxcb.meta) platforms;
  };
 })
--- a/pkgs/by-name/xo/xosview/package.nix
+++ b/pkgs/by-name/xo/xosview/package.nix
@ -11,11 +11,13 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchFromGitHub {
    owner = "hills";
-    repo = finalAttrs.pname;
+    repo = "xosview";
    rev = finalAttrs.version;
    hash = "sha256-9Pr7voJiCH7oBziMFRHCWxoyuGdndcdRD2POjiNT7yw=";
  };

+  outputs = [ "out" "man" ];
+
  dontConfigure = true;

  buildInputs = [
@ -28,12 +30,13 @@ stdenv.mkDerivation (finalAttrs: {
    "PLATFORM=linux"
  ];

-  meta = with lib; {
+  meta = {
    homepage = "http://www.pogo.org.uk/~mark/xosview/";
    description = "A classic system monitoring tool";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; linux;
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "xosview";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = with lib.platforms; linux;
  };
 })
-# TODO: generalize to other platforms
+
--- a/pkgs/by-name/xo/xosview2/package.nix
+++ b/pkgs/by-name/xo/xosview2/package.nix
@ -6,16 +6,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xosview2";
-  version = "2.3.2";
+  version = "2.3.3";

  src = fetchurl {
-    url = "mirror://sourceforge/xosview/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ex1GDBgx9Zzx5tOkZ2IRYskmBh/bUYpRTXHWRoE30vA=";
+    url = "mirror://sourceforge/xosview/xosview2-${finalAttrs.version}.tar.gz";
+    hash = "sha256-kEp6n9KmZ+6sTFyJr1V8Ssq9aZuh69c4U1YIiqvxIxw=";
  };

+  outputs = [ "out" "man" ];
+
  buildInputs = [ libX11 ];

-  meta = with lib; {
+  meta = {
    homepage = "https://xosview.sourceforge.net/index.html";
    description = "Lightweight graphical operating system monitor";
    longDescription = ''
@ -35,8 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
      connect to it on a network, then you can popup an xosview instance and
      monitor what is going on.
    '';
-    license = with licenses; [ gpl2 bsdOriginal ];
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.all;
+    license = with lib.licenses; [ gpl2 bsdOriginal ];
+    mainProgram = "xosview2";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (libX11.meta) platforms;
  };
 })
--- a/pkgs/by-name/zw/zwave-js-server/package.nix
+++ b/pkgs/by-name/zw/zwave-js-server/package.nix
@ -0,0 +1,36 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, nixosTests
+}:
+
+buildNpmPackage rec {
+  pname = "zwave-js-server";
+  version = "1.33.0";
+
+  src = fetchFromGitHub {
+    owner = "zwave-js";
+    repo = pname;
+    rev = version;
+    hash = "sha256-Lll3yE1v4ybJTjKO8dhPXMD/3VCn+9+fpnN7XczqaE4=";
+  };
+
+  npmDepsHash = "sha256-Re9fo+9+Z/+UGyDPlNWelH/4tLxcITPYXOCddQE9YDY=";
+
+  # For some reason the zwave-js dependency is in devDependencies
+  npmFlags = [ "--include=dev" ];
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) zwave-js;
+    };
+  };
+
+  meta = {
+    changelog = "https://github.com/zwave-js/zwave-js-server/releases/tag/${version}";
+    description = "Small server wrapper around Z-Wave JS to access it via a WebSocket";
+    license = lib.licenses.asl20;
+    homepage = "https://github.com/zwave-js/zwave-js-server";
+    maintainers = with lib.maintainers; [ graham33 ];
+  };
+}
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "27.3.2";
+  version = "27.3.4";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-an2/Aqb+5t61CkiBhwL9lA0WPxhIC+tDDjhn8alcqJQ=";
+    hash = "sha256-JsK2jzXyAACh9e3P2y0YLky2XQuR/dKyEbRpFUSnJdM=";
  };

-  npmDepsHash = "sha256-BQTM/ea/X2iqRkX510fAzouPNcV7cUmtY7J/CSUMH7o=";
+  npmDepsHash = "sha256-uchJ+1NWbo4FpNOjOO3luhIdZyQZLToZ1UCMLdGzjkY=";

  nativeBuildInputs = [
    remarshal
--- a/pkgs/data/fonts/pretendard/default.nix
+++ b/pkgs/data/fonts/pretendard/default.nix
@ -1,7 +1,7 @@
 { lib, stdenvNoCC, fetchzip }:

 let
-  version = "1.3.8";
+  version = "1.3.9";

  mkPretendard = { pname, typeface, hash }:
    stdenvNoCC.mkDerivation {
@ -35,24 +35,24 @@ in
  pretendard = mkPretendard {
    pname = "pretendard";
    typeface = "Pretendard";
-    hash = "sha256-Re4Td9uA8Qn/xv39Bo9i3gShYWQ1mRX44Vyx7/i4xwI=";
+    hash = "sha256-n7RQApffpL/8ojHcZbdxyanl9Tlc8HP8kxLFBdArUfY=";
  };

  pretendard-gov = mkPretendard {
    pname = "pretendard-gov";
    typeface = "PretendardGOV";
-    hash = "sha256-GQv/Ia91QgXZwFX+WdE7aRFUJFWhCMLFY86gu4Ii2w8=";
+    hash = "sha256-qoDUBOmrk6WPKQgnapThfKC01xWup+HN82hcoIjEe0M=";
  };

  pretendard-jp = mkPretendard {
    pname = "pretendard-jp";
    typeface = "PretendardJP";
-    hash = "sha256-7OLInF1XUQxyHyb9a0zyfCLZrdcxMTM2QeBe3lwLJ0A=";
+    hash = "sha256-1nTk1LPoRSfSDgDuGWkcs6RRIY4ZOqDBPMsxezMos6Q=";
  };

  pretendard-std = mkPretendard {
    pname = "pretendard-std";
    typeface = "PretendardStd";
-    hash = "sha256-DCR6KUAblVjhapqMn2p0nzndEJm4OCawGV3nAWZvSBs=";
+    hash = "sha256-gkYqqxSICmSIrBuPRzBaOlGGM/rJU1z7FiFvu9RhK5s=";
  };
 }
--- a/pkgs/development/compilers/asl/default.nix
+++ b/pkgs/development/compilers/asl/default.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchzip
-, tex
+, texliveMedium
 , buildDocs ? false
 }:

@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {

  outputs = [ "out" "doc" "man" ];

-  nativeBuildInputs = lib.optionals buildDocs [ tex ];
+  nativeBuildInputs = lib.optionals buildDocs [ texliveMedium ];

  postPatch = lib.optionalString (!buildDocs) ''
    substituteInPlace Makefile --replace "all: binaries docs" "all: binaries"
--- a/pkgs/development/compilers/bluespec/default.nix
+++ b/pkgs/development/compilers/bluespec/default.nix
@ -19,7 +19,7 @@
 , gmp-static
 , verilog
 , asciidoctor
-, tex
+, texliveFull
 , which
 }:

@ -88,7 +88,7 @@ in stdenv.mkDerivation rec {
    ghcWithPackages
    perl
    pkg-config
-    tex
+    texliveFull
  ];

  makeFlags = [
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@ -12,13 +12,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "gleam";
-  version = "0.31.0";
+  version = "0.32.2";

  src = fetchFromGitHub {
    owner = "gleam-lang";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-MLR7gY4NPb223NiPvTih88DQO2LvaYHsduWSH9QQa6M=";
+    hash = "sha256-1FIeH4NFyYQinqzCBZ9m2Jm6f5tLJDJxVdb4D3+fQ4w=";
  };

  nativeBuildInputs = [ git pkg-config ];
@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl ] ++
    lib.optionals stdenv.isDarwin [ Security libiconv ];

-  cargoHash = "sha256-I+5Vrpy5/9wFMB2dQYH9aqf/VonkDyIAyJmSHm5S6mk=";
+  cargoHash = "sha256-ffnDTGg+m0NUhG2BYjsXb2fWHeQmtDcBGqQDLqwZMWI=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/development/compilers/gnu-cobol/default.nix
+++ b/pkgs/development/compilers/gnu-cobol/default.nix
@ -13,7 +13,7 @@
 # docs
 , help2man
 , texinfo
-, texlive
+, texliveBasic
 # test
 , writeText
 }:
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
    libtool
    help2man
    texinfo
-    texlive.combined.scheme-basic
+    texliveBasic
  ];

  buildInputs = [
--- a/pkgs/development/compilers/mit-scheme/default.nix
+++ b/pkgs/development/compilers/mit-scheme/default.nix
@ -4,7 +4,7 @@
 , makeWrapper
 , gnum4
 , texinfo
-, texLive
+, texliveSmall
 , automake
 , autoconf
 , libtool
@ -85,7 +85,7 @@ stdenv.mkDerivation {
      $out/lib/mit-scheme${arch}-${version}
  '';

-  nativeBuildInputs = [ makeWrapper gnum4 texinfo texLive automake ghostscript autoconf libtool ];
+  nativeBuildInputs = [ makeWrapper gnum4 texinfo (texliveSmall.withPackages (ps: with ps; [ epsf ps.texinfo ])) automake ghostscript autoconf libtool ];

  # XXX: The `check' target doesn't exist.
  doCheck = false;
--- a/pkgs/development/embedded/avrdude/default.nix
+++ b/pkgs/development/embedded/avrdude/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake, bison, flex, libusb-compat-0_1, libelf
 , libftdi1, readline
 # documentation building is broken on darwin
-, docSupport ? (!stdenv.isDarwin), texlive, texinfo, texi2html, unixtools }:
+, docSupport ? (!stdenv.isDarwin), texliveMedium, texinfo, texi2html, unixtools }:

 stdenv.mkDerivation rec {
  pname = "avrdude";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake bison flex ] ++ lib.optionals docSupport [
    unixtools.more
-    texlive.combined.scheme-medium
+    texliveMedium
    texinfo
    texi2html
  ];
--- a/pkgs/development/interpreters/python/passthrufun.nix
+++ b/pkgs/development/interpreters/python/passthrufun.nix
@ -67,6 +67,8 @@
      overrides = packageOverrides;
      python = self;
    });
+  pythonOnBuildForHost_overridden =
+    pythonOnBuildForHost.override { inherit packageOverrides; self = pythonOnBuildForHost_overridden; };
 in rec {
    isPy27 = pythonVersion == "2.7";
    isPy37 = pythonVersion == "3.7";
@ -89,9 +91,10 @@ in rec {
    pythonAtLeast = lib.versionAtLeast pythonVersion;
    pythonOlder = lib.versionOlder pythonVersion;
    inherit hasDistutilsCxxPatch;
-    # TODO: rename to pythonOnBuild
+    # TODO: deprecate
    # Not done immediately because its likely used outside Nixpkgs.
-    pythonForBuild = pythonOnBuildForHost.override { inherit packageOverrides; self = pythonForBuild; };
+    pythonForBuild = pythonOnBuildForHost_overridden;
+    pythonOnBuildForHost = pythonOnBuildForHost_overridden;

    tests = callPackage ./tests.nix {
      python = self;
--- a/pkgs/development/libraries/aravis/default.nix
+++ b/pkgs/development/libraries/aravis/default.nix
@ -29,13 +29,13 @@ assert enableViewer -> wrapGAppsHook != null;

 stdenv.mkDerivation rec {
  pname = "aravis";
-  version = "0.8.28";
+  version = "0.8.30";

  src = fetchFromGitHub {
    owner = "AravisProject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-EgKZcylg3Nx320BdeEz8PVadwo2pE6a3h0vt7YT4LVA=";
+    sha256 = "sha256-1OxvLpzEKxIXiLJIUr+hCx+sxnH9Z5dBM5Lug1acCok=";
  };

  outputs = [ "bin" "dev" "out" "lib" ];
--- a/pkgs/development/libraries/cddlib/default.nix
+++ b/pkgs/development/libraries/cddlib/default.nix
@ -2,7 +2,7 @@
 , fetchFromGitHub
 , gmp
 , autoreconfHook
-, texlive
+, texliveSmall
 }:

 stdenv.mkDerivation rec {
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
  buildInputs = [gmp];
  nativeBuildInputs = [
    autoreconfHook
-    texlive.combined.scheme-small # for building the documentation
+    texliveSmall # for building the documentation
  ];
  # No actual checks yet (2018-05-05), but maybe one day.
  # Requested here: https://github.com/cddlib/cddlib/issues/25
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@ -76,13 +76,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gdal";
-  version = "3.7.2";
+  version = "3.7.3";

  src = fetchFromGitHub {
    owner = "OSGeo";
    repo = "gdal";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-/7Egbg4Cg5Gqsy+CEMVbs2NCWbdJteDNWelBsrQSUj4=";
+    hash = "sha256-+69mh1hKL1r7SNwDilaQz5UochMMWFG2lrBLYBF31JY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@ -64,6 +64,7 @@ stdenv.mkDerivation rec {
    "-DBUILD_SHARED_LIBS=ON"
  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    "-D_gRPC_PROTOBUF_PROTOC_EXECUTABLE=${buildPackages.protobuf}/bin/protoc"
+    "-D_gRPC_CPP_PLUGIN=${buildPackages.grpc}/bin/grpc_cpp_plugin"
  ]
  # The build scaffold defaults to c++14 on darwin, even when the compiler uses
  # a more recent c++ version by default [1]. However, downgrades are
--- a/pkgs/development/libraries/lib2geom/default.nix
+++ b/pkgs/development/libraries/lib2geom/default.nix
@ -15,7 +15,7 @@

 stdenv.mkDerivation rec {
  pname = "lib2geom";
-  version = "1.2.2";
+  version = "1.3";

  outputs = [ "out" "dev" ];

@ -23,16 +23,19 @@ stdenv.mkDerivation rec {
    owner = "inkscape";
    repo = "lib2geom";
    rev = "refs/tags/${version}";
-    sha256 = "sha256-xkUxcAk8KJkL482R7pvgmCT+5I8aUMm/q25pvK3ZPuY=";
+    hash = "sha256-llUpW8VRBD8RKaGfyedzsMbLRb8DIo0ePt6m2T2w7Po=";
  };

  patches = [
-    # Fixed upstream, remove when the new version releases:
-    # https://gitlab.com/inkscape/lib2geom/-/issues/49
+    # Fix compilation with Clang.
+    # https://gitlab.com/inkscape/lib2geom/-/merge_requests/102
    (fetchpatch {
-      name = "expect-double-eq-in-choose-test.patch";
-      url = "https://gitlab.com/inkscape/lib2geom/-/commit/5b7c75dd3841cb415f163f0a81f556c57d3e0a83.patch";
-      sha256 = "RMgwJkylrGFTTrqBzqs5j2LMSLsHhcE/UT1pKBZnU50=";
+      url = "https://gitlab.com/inkscape/lib2geom/-/commit/a5b5ac7d992023f8a80535ede60421e73ecd8e20.patch";
+      hash = "sha256-WJYkk3WRYVyPSvyTbKDUrYvUwFgKA9mmTiEWtYQqM4Q=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.com/inkscape/lib2geom/-/commit/23d9393af4bee17aeb66a3c13bdad5dbed982d08.patch";
+      hash = "sha256-LAaGMIXpDI/Wzv5E2LasW1Y2/G4ukhuEzDmFu3AzZOA=";
    })
  ];

@ -60,6 +63,20 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  # TODO: Update cmake hook to make it simpler to selectively disable cmake tests: #113829
+  checkPhase = let
+    disabledTests =
+      lib.optionals stdenv.isAarch64 [
+        # Broken on all platforms, test just accidentally passes on some.
+        # https://gitlab.com/inkscape/lib2geom/-/issues/63
+        "elliptical-arc-test"
+      ];
+  in ''
+    runHook preCheck
+    ctest --output-on-failure -E '^${lib.concatStringsSep "|" disabledTests}$'
+    runHook postCheck
+  '';
+
  meta = with lib; {
    description = "Easy to use 2D geometry library in C++";
    homepage = "https://gitlab.com/inkscape/lib2geom";
--- a/pkgs/development/libraries/librime/default.nix
+++ b/pkgs/development/libraries/librime/default.nix
@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
    description = "Rime Input Method Engine, the core library";
    license     = licenses.bsd3;
    maintainers = with maintainers; [ vonfry ];
-    platforms   = platforms.linux;
+    platforms   = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/development/libraries/libtorrent-rasterbar/default.nix
+++ b/pkgs/development/libraries/libtorrent-rasterbar/default.nix
@ -42,6 +42,11 @@ in stdenv.mkDerivation {
    moveToOutput "lib/${python.libPrefix}" "$python"
  '';

+  postFixup = ''
+    substituteInPlace "$dev/lib/cmake/LibtorrentRasterbar/LibtorrentRasterbarTargets-release.cmake" \
+      --replace "\''${_IMPORT_PREFIX}/lib" "$out/lib"
+  '';
+
  outputs = [ "out" "dev" "python" ];

  cmakeFlags = [
--- a/pkgs/development/libraries/nvidia-vaapi-driver/0001-hardcode-install_dir.patch
+++ b/pkgs/development/libraries/nvidia-vaapi-driver/0001-hardcode-install_dir.patch
@ -0,0 +1,34 @@
+From 4e8bd61c216969615a492043092bd8298dcd1410 Mon Sep 17 00:00:00 2001
+From: Nick Cao <nickcao@nichi.co>
+Date: Mon, 6 Nov 2023 09:33:45 -0500
+Subject: [PATCH] hardcode install_dir
+
+partially revert https://github.com/elFarto/nvidia-vaapi-driver/commit/60ab79608ae35bd929d3e1387d226547d18e6bed
+---
+ meson.build | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 990c2b2..f5e63d7 100644
+--- a/meson.build
+++ b/meson.build
+@@ -71,7 +71,6 @@ if gst_codecs_deps.found()
+ endif
+ 
+ nvidia_incdir = include_directories('nvidia-include')
+-nvidia_install_dir = libva_deps.get_variable(pkgconfig: 'driverdir')
+ 
+ shared_library(
+     'nvidia_drv_video',
+@@ -80,7 +79,7 @@ shared_library(
+     dependencies: deps,
+     include_directories: nvidia_incdir,
+     install: true,
+-    install_dir: nvidia_install_dir,
+    install_dir: get_option('libdir') / 'dri',
+     gnu_symbol_visibility: 'hidden',
+ )
+ 
+-- 
+2.42.0
+
--- a/pkgs/development/libraries/nvidia-vaapi-driver/default.nix
+++ b/pkgs/development/libraries/nvidia-vaapi-driver/default.nix
@ -14,15 +14,19 @@

 stdenv.mkDerivation rec {
  pname = "nvidia-vaapi-driver";
-  version = "0.0.10";
+  version = "0.0.11";

  src = fetchFromGitHub {
    owner = "elFarto";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-j6AIleVZCgV7CD7nP/dKz5we3sUW9pldy0QKi8xwXB0=";
+    sha256 = "sha256-mVVRpCyT374P1Vql0yPY0e5tNktHNJ8XHoixvxp3b20=";
  };

+  patches = [
+    ./0001-hardcode-install_dir.patch
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/development/libraries/physics/rivet/default.nix
+++ b/pkgs/development/libraries/physics/rivet/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, fastjet, fastjet-contrib, ghostscript, hepmc, imagemagick, less, python3, rsync, texlive, yoda, which, makeWrapper }:
+{ lib, stdenv, fetchurl, fetchpatch, fastjet, fastjet-contrib, ghostscript, hepmc, imagemagick, less, python3, rsync, texliveBasic, yoda, which, makeWrapper }:

 stdenv.mkDerivation rec {
  pname = "rivet";
@ -9,8 +9,7 @@ stdenv.mkDerivation rec {
    hash = "sha256-dbPz1BnKY4jR/S7A7afh+Q8yS5lszwWR9IpdLijczBM=";
  };

-  latex = texlive.combine { inherit (texlive)
-    scheme-basic
+  latex = texliveBasic.withPackages (ps: with ps; [
    collection-pstricks
    collection-fontsrecommended
    l3kernel
@ -24,7 +23,7 @@ stdenv.mkDerivation rec {
    xcolor
    xkeyval
    xstring
-    ;};
+  ]);

  nativeBuildInputs = [ rsync makeWrapper ];
  buildInputs = [ hepmc imagemagick python3 latex python3.pkgs.yoda ];
--- a/pkgs/development/libraries/piper-phonemize/default.nix
+++ b/pkgs/development/libraries/piper-phonemize/default.nix
@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "piper-phonemize";
-  version = "2023.9.27-2";
+  version = "2023.11.6-1";

  src = fetchFromGitHub {
    owner = "rhasspy";
    repo = "piper-phonemize";
    rev = "refs/tags/${version}";
-    hash = "sha256-Rwl8D5ZX9sGdxEch+l7pXdbf4nPCuSfGrK5x/EQ+O60=";
+    hash = "sha256-IRvuA03Z6r8Re/ocq2G/r28uwI9RU3xmmNI7S2G40rc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/science/networking/ns-3/default.nix
+++ b/pkgs/development/libraries/science/networking/ns-3/default.nix
@ -39,7 +39,7 @@
 , dia
 , tetex ? null
 , ghostscript ? null
-, texlive ? null
+, texliveMedium ? null

  # generates python bindings
 , pythonSupport ? true
@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
  # ncurses is a hidden dependency of waf when checking python
  buildInputs = lib.optionals pythonSupport [ castxml ncurses ]
    ++ lib.optionals enableDoxygen [ doxygen graphviz imagemagick ]
-    ++ lib.optionals withManual [ dia tetex ghostscript imagemagick texlive.combined.scheme-medium ]
+    ++ lib.optionals withManual [ dia tetex ghostscript imagemagick texliveMedium ]
    ++ [
    libxml2
    pythonEnv
--- a/pkgs/development/libraries/zxing-cpp/default.nix
+++ b/pkgs/development/libraries/zxing-cpp/default.nix
@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {

  passthru = {
    tests = {
-      inherit (python3.pkgs) zxing_cpp;
+      inherit (python3.pkgs) zxing-cpp;
    };
    updateScript = gitUpdater {
      rev-prefix = "v";
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@ -1384,6 +1384,35 @@ buildLuarocksPackage {
  };
 }) {};

+lua-rtoml = callPackage({ luaOlder, luarocks-build-rust-mlua, buildLuarocksPackage, lua, fetchgit }:
+buildLuarocksPackage {
+  pname = "lua-rtoml";
+  version = "0.2-0";
+
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "https://github.com/lblasc/lua-rtoml.git",
+  "rev": "e59ad00f5df8426767ddfb355f4ba6093468a168",
+  "date": "2023-11-02T14:17:41+01:00",
+  "path": "/nix/store/ynn6bvnwyqrackvyxzysxy294gh9prg1-lua-rtoml",
+  "sha256": "1y2ncdl3mpwqc1h5xm0rf9g1ns2vswgqffsj9sqrqidmg984jkr4",
+  "fetchLFS": false,
+  "fetchSubmodules": true,
+  "deepClone": false,
+  "leaveDotGit": false
+}
+ '') ["date" "path"]) ;
+
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua luarocks-build-rust-mlua ];
+
+  meta = {
+    homepage = "https://github.com/lblasc/lua-rtoml";
+    description = "Lua bindings for the Rust toml crate.";
+    maintainers = with lib.maintainers; [ lblasc ];
+    license.fullName = "MIT";
+  };
+}) {};
+
 lua-subprocess = callPackage({ lua, buildLuarocksPackage, fetchgit, luaOlder }:
 buildLuarocksPackage {
  pname = "subprocess";
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@ -402,6 +402,17 @@ with prev;
    meta.broken = luaOlder "5.1" || luaAtLeast "5.4";
  });

+  lua-rtoml = prev.lua-rtoml.overrideAttrs (oa: {
+
+    cargoDeps = rustPlatform.fetchCargoTarball {
+      src = oa.src;
+      hash = "sha256-EcP4eYsuOVeEol+kMqzsVHd8F2KoBdLzf6K0KsYToUY=";
+    };
+
+    propagatedBuildInputs = oa.propagatedBuildInputs ++ [ cargo rustPlatform.cargoSetupHook ];
+
+  });
+
  lush-nvim = prev.lush-nvim.overrideAttrs (drv: {
    doCheck = false;
  });
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@ -49,6 +49,7 @@ mapAliases {
  "@mermaid-js/mermaid-cli" = pkgs.mermaid-cli; # added 2023-10-01
  "@nerdwallet/shepherd" = pkgs.shepherd; # added 2023-09-30
  "@nestjs/cli" = pkgs.nest-cli; # Added 2023-05-06
+  "@zwave-js/server" = pkgs.zwave-js-server; # Added 2023-09-09
  alloy = pkgs.titanium-alloy; # added 2023-08-17
  antennas = pkgs.antennas; # added 2023-07-30
  inherit (pkgs) asar; # added 2023-08-26
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@ -60,5 +60,4 @@
  vscode-html-languageserver-bin = "html-languageserver";
  vscode-json-languageserver-bin = "json-languageserver";
  webtorrent-cli = "webtorrent";
-  "@zwave-js/server" = "zwave-server";
 }
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -310,5 +310,4 @@
 , "@yaegassy/coc-nginx"
 , "yalc"
 , "yarn"
-, "@zwave-js/server"
 ]
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@ -102095,205 +102095,4 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-  "@zwave-js/server" = nodeEnv.buildNodePackage {
-    name = "_at_zwave-js_slash_server";
-    packageName = "@zwave-js/server";
-    version = "1.33.0";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/@zwave-js/server/-/server-1.33.0.tgz";
-      sha512 = "jHRpbeWcDVhTWidDTmln9x+lTveJ0H1cLJxl6dWIeWQ6YnB7YzRuHFDPhY+6ewAyUrc+Eq8tl+QnhjmVuevq+A==";
-    };
-    dependencies = [
-      (sources."@alcalzone/jsonl-db-3.1.0" // {
-        dependencies = [
-          sources."fs-extra-10.1.0"
-        ];
-      })
-      (sources."@alcalzone/pak-0.9.0" // {
-        dependencies = [
-          sources."execa-5.0.1"
-          sources."fs-extra-10.1.0"
-        ];
-      })
-      sources."@alcalzone/proper-lockfile-4.1.3-0"
-      sources."@colors/colors-1.6.0"
-      sources."@dabh/diagnostics-2.0.3"
-      sources."@homebridge/ciao-1.1.7"
-      sources."@leichtgewicht/ip-codec-2.0.4"
-      sources."@serialport/binding-mock-10.2.2"
-      (sources."@serialport/bindings-cpp-12.0.1" // {
-        dependencies = [
-          sources."@serialport/parser-delimiter-11.0.0"
-          sources."@serialport/parser-readline-11.0.0"
-          sources."node-gyp-build-4.6.0"
-        ];
-      })
-      sources."@serialport/bindings-interface-1.2.2"
-      sources."@serialport/parser-byte-length-12.0.0"
-      sources."@serialport/parser-cctalk-12.0.0"
-      sources."@serialport/parser-delimiter-12.0.0"
-      sources."@serialport/parser-inter-byte-timeout-12.0.0"
-      sources."@serialport/parser-packet-length-12.0.0"
-      sources."@serialport/parser-readline-12.0.0"
-      sources."@serialport/parser-ready-12.0.0"
-      sources."@serialport/parser-regex-12.0.0"
-      sources."@serialport/parser-slip-encoder-12.0.0"
-      sources."@serialport/parser-spacepacket-12.0.0"
-      sources."@serialport/stream-12.0.0"
-      sources."@sindresorhus/is-5.6.0"
-      sources."@szmarczak/http-timer-5.0.1"
-      sources."@types/http-cache-semantics-4.0.3"
-      sources."@types/triple-beam-1.3.4"
-      sources."@zwave-js/cc-12.3.0"
-      sources."@zwave-js/config-12.3.0"
-      sources."@zwave-js/core-12.3.0"
-      sources."@zwave-js/host-12.3.0"
-      sources."@zwave-js/nvmedit-12.3.0"
-      sources."@zwave-js/serial-12.3.0"
-      sources."@zwave-js/shared-12.2.3"
-      sources."@zwave-js/testing-12.3.0"
-      sources."alcalzone-shared-4.0.8"
-      sources."ansi-colors-4.1.3"
-      sources."ansi-regex-5.0.1"
-      sources."ansi-styles-4.3.0"
-      sources."async-3.2.4"
-      sources."asynckit-0.4.0"
-      sources."axios-0.27.2"
-      sources."buffer-from-1.1.2"
-      sources."bufferutil-4.0.8"
-      sources."cacheable-lookup-7.0.0"
-      sources."cacheable-request-10.2.14"
-      sources."cliui-8.0.1"
-      (sources."color-3.2.1" // {
-        dependencies = [
-          sources."color-convert-1.9.3"
-          sources."color-name-1.1.3"
-        ];
-      })
-      sources."color-convert-2.0.1"
-      sources."color-name-1.1.4"
-      sources."color-string-1.9.1"
-      sources."colorspace-1.1.4"
-      sources."combined-stream-1.0.8"
-      sources."cross-spawn-7.0.3"
-      sources."dayjs-1.11.10"
-      sources."debug-4.3.4"
-      (sources."decompress-response-6.0.0" // {
-        dependencies = [
-          sources."mimic-response-3.1.0"
-        ];
-      })
-      sources."defer-to-connect-2.0.1"
-      sources."delayed-stream-1.0.0"
-      sources."dns-packet-5.6.1"
-      sources."emoji-regex-8.0.0"
-      sources."enabled-2.0.0"
-      sources."escalade-3.1.1"
-      sources."eventemitter3-5.0.1"
-      sources."execa-5.1.1"
-      sources."fast-deep-equal-3.1.3"
-      sources."fecha-4.2.3"
-      sources."file-stream-rotator-0.6.1"
-      sources."fn.name-1.1.0"
-      sources."follow-redirects-1.15.3"
-      sources."form-data-4.0.0"
-      sources."form-data-encoder-2.1.4"
-      sources."fs-extra-11.1.1"
-      sources."get-caller-file-2.0.5"
-      sources."get-stream-6.0.1"
-      sources."globalyzer-0.1.0"
-      sources."globrex-0.1.2"
-      sources."got-13.0.0"
-      sources."graceful-fs-4.2.11"
-      sources."http-cache-semantics-4.1.1"
-      sources."http2-wrapper-2.2.0"
-      sources."human-signals-2.1.0"
-      sources."inherits-2.0.4"
-      sources."is-arrayish-0.3.2"
-      sources."is-fullwidth-code-point-3.0.0"
-      sources."is-stream-2.0.1"
-      sources."isexe-2.0.0"
-      sources."json-buffer-3.0.1"
-      sources."json-logic-js-2.0.2"
-      sources."json5-2.2.3"
-      sources."jsonfile-6.1.0"
-      sources."keyv-4.5.4"
-      sources."kuler-2.0.0"
-      sources."logform-2.6.0"
-      sources."lowercase-keys-3.0.0"
-      sources."lru-cache-6.0.0"
-      sources."mdns-server-1.0.11"
-      sources."merge-stream-2.0.0"
-      sources."mime-db-1.52.0"
-      sources."mime-types-2.1.35"
-      sources."mimic-fn-2.1.0"
-      sources."mimic-response-4.0.0"
-      sources."minimist-1.2.8"
-      sources."moment-2.29.4"
-      sources."ms-2.1.2"
-      sources."node-addon-api-7.0.0"
-      sources."node-gyp-build-4.6.1"
-      sources."normalize-url-8.0.0"
-      sources."npm-run-path-4.0.1"
-      sources."nrf-intel-hex-1.3.0"
-      sources."object-hash-2.2.0"
-      sources."one-time-1.0.0"
-      sources."onetime-5.1.2"
-      sources."p-cancelable-3.0.0"
-      sources."p-queue-7.4.1"
-      sources."p-timeout-5.1.0"
-      sources."path-key-3.1.1"
-      sources."proper-lockfile-4.1.2"
-      sources."quick-lru-5.1.1"
-      sources."readable-stream-3.6.2"
-      sources."reflect-metadata-0.1.13"
-      sources."require-directory-2.1.1"
-      sources."resolve-alpn-1.2.1"
-      sources."responselike-3.0.0"
-      sources."retry-0.12.0"
-      sources."safe-buffer-5.2.1"
-      sources."safe-stable-stringify-2.4.3"
-      sources."semver-7.5.4"
-      sources."serialport-12.0.0"
-      sources."shebang-command-2.0.0"
-      sources."shebang-regex-3.0.0"
-      sources."signal-exit-3.0.7"
-      sources."simple-swizzle-0.2.2"
-      sources."source-map-0.6.1"
-      sources."source-map-support-0.5.21"
-      sources."stack-trace-0.0.10"
-      sources."string-width-4.2.3"
-      sources."string_decoder-1.3.0"
-      sources."strip-ansi-6.0.1"
-      sources."strip-final-newline-2.0.0"
-      sources."text-hex-1.0.0"
-      sources."tiny-glob-0.2.9"
-      sources."triple-beam-1.4.1"
-      sources."tslib-2.6.2"
-      sources."universalify-2.0.1"
-      sources."utf-8-validate-6.0.3"
-      sources."util-deprecate-1.0.2"
-      sources."which-2.0.2"
-      sources."winston-3.11.0"
-      sources."winston-daily-rotate-file-4.7.1"
-      sources."winston-transport-4.6.0"
-      sources."wrap-ansi-7.0.0"
-      sources."ws-8.14.2"
-      sources."xstate-4.38.2"
-      sources."y18n-5.0.8"
-      sources."yallist-4.0.0"
-      sources."yargs-17.7.2"
-      sources."yargs-parser-21.1.1"
-      sources."zwave-js-12.3.0"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "Full access to zwave-js driver through Websockets";
-      homepage = "https://github.com/zwave-js/zwave-js-server#readme";
-      license = "Apache-2.0";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
 }
--- a/pkgs/development/python-modules/aiocomelit/default.nix
+++ b/pkgs/development/python-modules/aiocomelit/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "aiocomelit";
-  version = "0.3.0";
+  version = "0.3.1";
  format = "pyproject";

  disabled = pythonOlder "3.10";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "chemelli74";
    repo = "aiocomelit";
    rev = "refs/tags/v${version}";
-    hash = "sha256-o8i1H4MsK21kJVbLD22PAUqj5Q9k31JfdZQYARPQICc=";
+    hash = "sha256-/nixEjCQED1R2Z+iNs+bvxa6T+bPJ0b5Hn5vMO+v46Y=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/alexapy/default.nix
+++ b/pkgs/development/python-modules/alexapy/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "alexapy";
-  version = "1.27.7";
+  version = "1.27.8";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "keatontaylor";
    repo = "alexapy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-8OktaoH15FmwWEpUS+3yv6Q7fwfTf144yvaldAp7CQU=";
+    hash = "sha256-M6cv1l6UpUJ0Wn7Swa7Cv+XsDNbzHLNrTJjU5ePL83Q=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/amqp/default.nix
+++ b/pkgs/development/python-modules/amqp/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "amqp";
-  version = "5.1.1";
+  version = "5.2.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-LBsT/swIk+lGxly9XzZCeGHP+k6iIB2Pb8oi4qNzteI=";
+    hash = "sha256-oez/QlrQY61CpIbJAoB9FIIxFIHIrZWnJpSyl1519/0=";
  };

  propagatedBuildInputs = [
@ -44,6 +44,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python client for the Advanced Message Queuing Procotol (AMQP). This is a fork of amqplib which is maintained by the Celery project";
    homepage = "https://github.com/celery/py-amqp";
+    changelog = "https://github.com/celery/py-amqp/releases/tag/v${version}";
    license = licenses.bsd3;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/blinkpy/default.nix
+++ b/pkgs/development/python-modules/blinkpy/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "blinkpy";
-  version = "0.22.2";
+  version = "0.22.3";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "fronzbot";
    repo = "blinkpy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-T6ryiWVpraaXzwHYBXjuIO8PUqUcQBcLi1+O+iNBaoc=";
+    hash = "sha256-J9eBZv/uizkZz53IX1ZfF7IeMOnBonyMD2c5DphW8BQ=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "boschshcpy";
-  version = "0.2.73";
+  version = "0.2.75";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "tschamm";
    repo = pname;
    rev = version;
-    hash = "sha256-DHH9VZWnQaLWEiZSrU4y2/jlqhvUvoKRjWpBTz01m8k=";
+    hash = "sha256-T3QTNnnkquv0IurwNtblX9CF/gLeMONEFfbJV/n/Wj4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/bpycv/default.nix
+++ b/pkgs/development/python-modules/bpycv/default.nix
@ -9,7 +9,7 @@
 , fetchPypi
 , fetchurl
 , minexr
-, opencv3
+, opencv4
 , python3Packages
 , requests
 , runCommand
@ -32,7 +32,7 @@ buildPythonPackage rec {
    minexr
    zcs
    requests
-    opencv3
+    opencv4
    boxx
  ];

--- a/pkgs/development/python-modules/camelot/default.nix
+++ b/pkgs/development/python-modules/camelot/default.nix
@ -10,15 +10,16 @@
 , pandas
 , tabulate
 , click
-, pdfminer
+, pdfminer-six
 , pypdf
-, opencv3
+, opencv4
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "camelot-py";
  version = "0.11.0";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@ -27,16 +28,18 @@ buildPythonPackage rec {
    hash = "sha256-l6fZBtaF5AWaSlSaY646UfCrcqPIJlV/hEPGWhGB3+Y=";
  };

+  nativeBuildInputs = [ setuptools ];
+
  propagatedBuildInputs = [
    charset-normalizer
    chardet
    pandas
    tabulate
    click
-    pdfminer
+    pdfminer-six
    openpyxl
    pypdf
-    opencv3
+    opencv4
  ];

  doCheck = false;
--- a/pkgs/development/python-modules/cobs/default.nix
+++ b/pkgs/development/python-modules/cobs/default.nix
@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "cobs";
-  version = "1.2.0";
+  version = "1.2.1";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-2TsQtTcNyIaJYK77cK2x9zpOYQexaRgwekru79PtuPY=";
+    hash = "sha256-Kvf4eRzeGufGuTb10MNf4p/rEN4l95wVsK8NZyl4PMA=";
  };

  checkPhase = ''
--- a/pkgs/development/python-modules/dask-histogram/default.nix
+++ b/pkgs/development/python-modules/dask-histogram/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "dask-histogram";
-  version = "2023.6.0";
+  version = "2023.10.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "dask-contrib";
    repo = "dask-histogram";
    rev = "refs/tags/${version}";
-    hash = "sha256-9b2+vrUH8lZYsEbJg+GmY5zHZ+7PyA9NV2h5VAN0J1s=";
+    hash = "sha256-ugAqNdvCROCCXURwsGLpnl/lBEAremvTI7MVa/TWt6c=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/django-crispy-forms/default.nix
+++ b/pkgs/development/python-modules/django-crispy-forms/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "django-crispy-forms";
-  version = "2.0";
+  version = "2.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "django-crispy-forms";
    repo = "django-crispy-forms";
    rev = "refs/tags/${version}";
-    hash = "sha256-oxOW7gFpjUehWGeqZZjhPwptX0Gpgj5lP0lw0zkYGuE=";
+    hash = "sha256-UQ5m0JWir20TdLgS+DVVLcMBlIEIfmzv8pkMJtaC0LA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/django-ipware/default.nix
+++ b/pkgs/development/python-modules/django-ipware/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "django-ipware";
-  version = "5.0.0";
+  version = "5.0.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-T6VgfuheEu5eFYvHVp/x4TT7FXloGqH/Pw7QS+Ib4VM=";
+    hash = "sha256-qzq3ZF5nTfaCwRRqW936UVGxt7576SEIcsMVa9g2qtQ=";
  };

  propagatedBuildInputs = [ django ];
--- a/pkgs/development/python-modules/djangorestframework-dataclasses/default.nix
+++ b/pkgs/development/python-modules/djangorestframework-dataclasses/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "djangorestframework-dataclasses";
-  version = "1.3.0";
+  version = "1.3.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "oxan";
    repo = "djangorestframework-dataclasses";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aUz+f8Q7RwQsoRpjq1AAmNtDzTA6KKxyc+MtBJEfyL8=";
+    hash = "sha256-12EdSaGpsX0qDXgJ2QWYj6qAUbsrITQjWowk+gJFwwY=";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More