Merge master into staging-next

.github/workflows/check-maintainers-sorted.yaml

@@ -1,7 +1,7 @@
 name: "Check that maintainer list is sorted"
 
 on:
-  pull_request:
+  pull_request_target:
     paths:
       - 'maintainers/maintainer-list.nix'
 permissions:
@@ -13,6 +13,9 @@ jobs:
     if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@v3
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
       - uses: cachix/install-nix-action@v19
         with:
           # explicitly enable sandbox

maintainers/maintainer-list.nix

@@ -9168,6 +9168,11 @@
     githubId = 115218;
     name = "Felix Richter";
   };
+  MakiseKurisu = {
+    github = "MakiseKurisu";
+    githubId = 2321672;
+    name = "Makise Kurisu";
+  };
   malbarbo = {
     email = "malbarbo@gmail.com";
     github = "malbarbo";

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -130,6 +130,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `llvmPackages_rocm.llvm` will not contain `clang` or `compiler-rt`. `llvmPackages_rocm.clang` will not contain `llvm`. `llvmPackages_rocm.clangNoCompilerRt` has been removed in favor of using `llvmPackages_rocm.clang-unwrapped`.
 
+- `services.xserver.desktopManager.plasma5.excludePackages` has been moved to `environment.plasma5.excludePackages`, for consistency with other Desktop Environments
+
 - The EC2 image module previously detected and automatically mounted ext3-formatted instance store devices and partitions in stage-1 (initramfs), storing `/tmp` on the first discovered device. This behaviour, which only catered to very specific use cases and could not be disabled, has been removed. Users relying on this should provide their own implementation, and probably use ext4 and perform the mount in stage-2.
 
 - `teleport` has been upgraded from major version 10 to major version 12. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and release notes for versions [11](https://goteleport.com/docs/changelog/#1100) and [12](https://goteleport.com/docs/changelog/#1201). Note that Teleport does not officially support upgrades across more than one major version at a time. If you're running Teleport server components, it is recommended to first upgrade to an intermediate 11.x version by setting `services.teleport.package = pkgs.teleport_11`. Afterwards, this option can be removed to upgrade to the default version (12).
@@ -230,6 +232,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `mastodon` now supports connection to a remote `PostgreSQL` database.
 
+- `nextcloud` has an option to enable SSE-C in S3.
+
 - `services.peertube` now requires you to specify the secret file `secrets.secretsFile`. It can be generated by running `openssl rand -hex 32`.
   Before upgrading, read the release notes for PeerTube:
     - [Release v5.0.0](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.0.0)
@@ -247,6 +251,11 @@ In addition to numerous new and upgraded packages, this release has the followin
     [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
     can be directly written as attribute-set in Nix within this option.
 
+- `hardware.video.hidpi` now provides defaults that are consistent with `fontconfig`'s documentation:
+  - antialiasing and font hinting are disabled, as they have no visible effects at high pixel densities;
+  - subpixel order isn't set: it was irrelevant with the above disabled, and the module *cannot* know the correct
+    setting for the user's screen.
+
 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.
 
 - `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion.

nixos/modules/config/console.nix

@@ -21,7 +21,7 @@ let
   # Sadly, systemd-vconsole-setup doesn't support binary keymaps.
   vconsoleConf = pkgs.writeText "vconsole.conf" ''
     KEYMAP=${cfg.keyMap}
-    FONT=${cfg.font}
+    ${optionalString (cfg.font != null) "FONT=${cfg.font}"}
   '';
 
   consoleEnv = kbd: pkgs.buildEnv {
@@ -45,7 +45,7 @@ in
     };
 
     font = mkOption {
-      type = with types; either str path;
+      type = with types; nullOr (either str path);
       default = "Lat2-Terminus16";
       example = "LatArCyrHeb-16";
       description = mdDoc ''
@@ -53,6 +53,13 @@ in
         whatever the {command}`setfont` program considers the
         default font.
         Can be either a font name or a path to a PSF font file.
+
+        Use `null` to let the kernel choose a built-in font.
+        The default is 8x16, and, as of Linux 5.3, Terminus 32 bold for display
+        resolutions of 2560x1080 and higher.
+        These fonts cover the [IBM437][] character set.
+
+        [IBM437]: https://en.wikipedia.org/wiki/Code_page_437
       '';
     };
 
@@ -151,7 +158,7 @@ in
           printf "\033%%${if isUnicode then "G" else "@"}" >> /dev/console
           loadkmap < ${optimizedKeymap}
 
-          ${optionalString cfg.earlySetup ''
+          ${optionalString (cfg.earlySetup && cfg.font != null) ''
             setfont -C /dev/console $extraUtils/share/consolefonts/font.psf
           ''}
         '');
@@ -168,7 +175,7 @@ in
           "${config.boot.initrd.systemd.package.kbd}/bin/setfont"
           "${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
           "${config.boot.initrd.systemd.package.kbd.gzip}/bin/gzip" # Fonts and keyboard layouts are compressed
-        ] ++ optionals (hasPrefix builtins.storeDir cfg.font) [
+        ] ++ optionals (cfg.font != null && hasPrefix builtins.storeDir cfg.font) [
           "${cfg.font}"
         ] ++ optionals (hasPrefix builtins.storeDir cfg.keyMap) [
           "${cfg.keyMap}"
@@ -195,7 +202,7 @@ in
         ];
       })
 
-      (mkIf (cfg.earlySetup && !config.boot.initrd.systemd.enable) {
+      (mkIf (cfg.earlySetup && cfg.font != null && !config.boot.initrd.systemd.enable) {
         boot.initrd.extraUtilsCommands = ''
           mkdir -p $out/share/consolefonts
           ${if substring 0 1 cfg.font == "/" then ''

nixos/modules/hardware/video/hidpi.nix

@@ -12,11 +12,12 @@ with lib;
     boot.loader.systemd-boot.consoleMode = mkDefault "1";
 
 
-    # Grayscale anti-aliasing for fonts
+    # Disable font anti-aliasing, hinting, and sub-pixel rendering by default
-    fonts.fontconfig.antialias = mkDefault true;
+    # See recommendations in fonts/fontconfig.nix
-    fonts.fontconfig.subpixel = {
+    fonts.fontconfig = {
-      rgba = mkDefault "none";
+      antialias = mkDefault false;
-      lcdfilter = mkDefault "none";
+      hinting.enable = mkDefault false;
+      subpixel.lcdfilter = mkDefault "none";
     };
 
     # TODO Find reasonable defaults X11 & wayland

nixos/modules/services/mail/roundcube.nix

@@ -132,6 +132,8 @@ in
       $config['plugins'] = [${concatMapStringsSep "," (p: "'${p}'") cfg.plugins}];
       $config['des_key'] = file_get_contents('/var/lib/roundcube/des_key');
       $config['mime_types'] = '${pkgs.nginx}/conf/mime.types';
+      # Roundcube uses PHP-FPM which has `PrivateTmp = true;`
+      $config['temp_dir'] = '/tmp';
       $config['enable_spellcheck'] = ${if cfg.dicts == [] then "false" else "true"};
       # by default, spellchecking uses a third-party cloud services
       $config['spellcheck_engine'] = 'pspell';

nixos/modules/services/matrix/synapse.md

@@ -27,10 +27,7 @@ please refer to the
 { pkgs, lib, config, ... }:
 let
   fqdn = "${config.networking.hostName}.${config.networking.domain}";
-  clientConfig = {
+  clientConfig."m.homeserver".base_url = "https://${fqdn}";
-    "m.homeserver".base_url = "https://${fqdn}";
-    "m.identity_server" = {};
-  };
   serverConfig."m.server" = "${fqdn}:443";
   mkWellKnown = data: ''
     add_header Content-Type application/json;

nixos/modules/services/web-apps/nextcloud.nix

@@ -514,6 +514,27 @@ in {
               `http://hostname.domain/bucket` instead.
             '';
           };
+          sseCKeyFile = mkOption {
+            type = types.nullOr types.path;
+            default = null;
+            example = "/var/nextcloud-objectstore-s3-sse-c-key";
+            description = lib.mdDoc ''
+              If provided this is the full path to a file that contains the key
+              to enable [server-side encryption with customer-provided keys][1]
+              (SSE-C).
+
+              The file must contain a random 32-byte key encoded as a base64
+              string, e.g. generated with the command
+
+              ```
+              openssl rand 32 | base64
+              ```
+
+              Must be readable by user `nextcloud`.
+
+              [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html
+            '';
+          };
         };
       };
     };
@@ -773,6 +794,7 @@ in {
                 'use_ssl' => ${boolToString s3.useSsl},
                 ${optionalString (s3.region != null) "'region' => '${s3.region}',"}
                 'use_path_style' => ${boolToString s3.usePathStyle},
+                ${optionalString (s3.sseCKeyFile != null) "'sse_c_key' => nix_read_secret('${s3.sseCKeyFile}'),"}
               ],
             ]
           '';

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -81,88 +81,90 @@ let
 in
 
 {
-  options.services.xserver.desktopManager.plasma5 = {
+  options = {
-    enable = mkOption {
+    services.xserver.desktopManager.plasma5 = {
-      type = types.bool;
+      enable = mkOption {
-      default = false;
+        type = types.bool;
-      description = lib.mdDoc "Enable the Plasma 5 (KDE 5) desktop environment.";
+        default = false;
-    };
+        description = lib.mdDoc "Enable the Plasma 5 (KDE 5) desktop environment.";
+      };
 
-    phononBackend = mkOption {
+      phononBackend = mkOption {
-      type = types.enum [ "gstreamer" "vlc" ];
+        type = types.enum [ "gstreamer" "vlc" ];
-      default = "vlc";
+        default = "vlc";
-      example = "gstreamer";
+        example = "gstreamer";
-      description = lib.mdDoc "Phonon audio backend to install.";
+        description = lib.mdDoc "Phonon audio backend to install.";
-    };
+      };
 
-    useQtScaling = mkOption {
+      useQtScaling = mkOption {
-      type = types.bool;
+        type = types.bool;
-      default = false;
+        default = false;
-      description = lib.mdDoc "Enable HiDPI scaling in Qt.";
+        description = lib.mdDoc "Enable HiDPI scaling in Qt.";
-    };
+      };
 
-    runUsingSystemd = mkOption {
+      runUsingSystemd = mkOption {
-      description = lib.mdDoc "Use systemd to manage the Plasma session";
+        description = lib.mdDoc "Use systemd to manage the Plasma session";
-      type = types.bool;
+        type = types.bool;
-      default = true;
+        default = true;
-    };
+      };
 
-    excludePackages = mkOption {
+      notoPackage = mkPackageOptionMD pkgs "Noto fonts" {
-      description = lib.mdDoc "List of default packages to exclude from the configuration";
+        default = [ "noto-fonts" ];
-      type = types.listOf types.package;
+        example = "noto-fonts-lgc-plus";
-      default = [];
+      };
-      example = literalExpression "[ pkgs.plasma5Packages.oxygen ]";
-    };
 
-    notoPackage = mkPackageOptionMD pkgs "Noto fonts" {
+      # Internally allows configuring kdeglobals globally
-      default = [ "noto-fonts" ];
+      kdeglobals = mkOption {
-      example = "noto-fonts-lgc-plus";
+        internal = true;
-    };
+        default = {};
+        type = kdeConfigurationType;
+      };
 
-    # Internally allows configuring kdeglobals globally
+      # Internally allows configuring kwin globally
-    kdeglobals = mkOption {
+      kwinrc = mkOption {
-      internal = true;
+        internal = true;
-      default = {};
+        default = {};
-      type = kdeConfigurationType;
+        type = kdeConfigurationType;
-    };
+      };
 
-    # Internally allows configuring kwin globally
+      mobile.enable = mkOption {
-    kwinrc = mkOption {
+        type = types.bool;
-      internal = true;
+        default = false;
-      default = {};
+        description = lib.mdDoc ''
-      type = kdeConfigurationType;
+          Enable support for running the Plasma Mobile shell.
-    };
+        '';
+      };
 
-    mobile.enable = mkOption {
+      mobile.installRecommendedSoftware = mkOption {
-      type = types.bool;
+        type = types.bool;
-      default = false;
+        default = true;
-      description = lib.mdDoc ''
+        description = lib.mdDoc ''
-        Enable support for running the Plasma Mobile shell.
+          Installs software recommended for use with Plasma Mobile, but which
-      '';
+          is not strictly required for Plasma Mobile to run.
-    };
+        '';
+      };
 
-    mobile.installRecommendedSoftware = mkOption {
+      bigscreen.enable = mkOption {
-      type = types.bool;
+        type = types.bool;
-      default = true;
+        default = false;
-      description = lib.mdDoc ''
+        description = lib.mdDoc ''
-        Installs software recommended for use with Plasma Mobile, but which
+          Enable support for running the Plasma Bigscreen session.
-        is not strictly required for Plasma Mobile to run.
+        '';
-      '';
+      };
-    };
-
-    bigscreen.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = lib.mdDoc ''
-        Enable support for running the Plasma Bigscreen session.
-      '';
     };
+    environment.plasma5.excludePackages = mkOption {
+        description = lib.mdDoc "List of default packages to exclude from the configuration";
+        type = types.listOf types.package;
+        default = [];
+        example = literalExpression "[ pkgs.plasma5Packages.oxygen ]";
+      };
   };
 
   imports = [
     (mkRemovedOptionModule [ "services" "xserver" "desktopManager" "plasma5" "enableQt4Support" ] "Phonon no longer supports Qt 4.")
     (mkRemovedOptionModule [ "services" "xserver" "desktopManager" "plasma5" "supportDDC" ] "DDC/CI is no longer supported upstream.")
     (mkRenamedOptionModule [ "services" "xserver" "desktopManager" "kde5" ] [ "services" "xserver" "desktopManager" "plasma5" ])
+    (mkRenamedOptionModule [ "services" "xserver" "desktopManager" "plasma5" "excludePackages" ] [ "environment" "plasma5" "excludePackages" ])
   ];
 
   config = mkMerge [
@@ -284,7 +286,7 @@ in
           ];
         in
         requiredPackages
-        ++ utils.removePackagesByName optionalPackages cfg.excludePackages
+        ++ utils.removePackagesByName optionalPackages config.environment.plasma5.excludePackages
 
         # Phonon audio backend
         ++ lib.optional (cfg.phononBackend == "gstreamer") libsForQt5.phonon-backend-gstreamer
@@ -438,7 +440,7 @@ in
             khelpcenter
             print-manager
           ];
-      in requiredPackages ++ utils.removePackagesByName optionalPackages cfg.excludePackages;
+      in requiredPackages ++ utils.removePackagesByName optionalPackages config.environment.plasma5.excludePackages;
 
       systemd.user.services = {
         plasma-run-with-systemd = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2501,8 +2501,8 @@ let
         mktplcRef = {
           publisher = "shd101wyy";
           name = "markdown-preview-enhanced";
-          version = "0.6.3";
+          version = "0.6.8";
-          sha256 = "dCWERQ5rHnmYLtYl12gJ+dXLnpMu55WnmF1VfdP0x34=";
+          sha256 = "9NRaHgtyiZJ0ic6h1B01MWzYhDABAl3Jm2IUPogYWr0=";
         };
         meta = {
           description = "Provides a live preview of markdown using either markdown-it or pandoc";

pkgs/applications/graphics/ImageMagick/default.nix

@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-2";
+  version = "7.1.1-3";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-5B8grg05n+MkHZU76QBsrrU5Z3VZRGMRHX35HXtTbe8=";
+    hash = "sha256-UYmWNP+2FdBtBUqQtYGtIdw/XN8OKO0r5g4zgzPgbP8=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

pkgs/applications/kde/akonadi-contacts.nix

@@ -16,10 +16,10 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     qtwebengine
-    grantlee grantleetheme
+    grantlee
     kcmutils kdbusaddons ki18n kiconthemes kio kitemmodels ktextwidgets prison
     akonadi-mime kcontacts kmime libkleo
   ];
-  propagatedBuildInputs = [ akonadi ];
+  propagatedBuildInputs = [ akonadi grantleetheme ];
   outputs = [ "out" "dev" ];
 }

pkgs/applications/kde/grantleetheme/default.nix

@@ -10,7 +10,7 @@ mkDerivation {
     license = with lib.licenses; [ gpl2Plus lgpl21Plus fdl12Plus ];
     maintainers = kdepimTeam;
   };
-  output = [ "out" "dev" ];
+  outputs = [ "out" "dev" ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     grantlee ki18n kiconthemes knewstuff kservice kxmlgui qtbase

pkgs/applications/misc/authenticator/default.nix

@@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitLab
 , appstream-glib
-, clang
 , desktop-file-utils
 , meson
 , ninja
@@ -14,7 +13,6 @@
 , gst_all_1
 , gtk4
 , libadwaita
-, libclang
 , openssl
 , pipewire
 , sqlite
@@ -24,20 +22,20 @@
 
 stdenv.mkDerivation rec {
   pname = "authenticator";
-  version = "4.1.6";
+  version = "4.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "Authenticator";
     rev = version;
-    hash = "sha256-fv7Np3haRCJABlJocKuu+1jevHYrdo+VyiQBpRmHs2g=";
+    hash = "sha256-Nv4QE6gyh42Na/stAgTIapV8GQuUHCdL6IEO//J8dV8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-8GddlDM1lU365GXdrKNhO331/y1p3Om5uZfVLy8TBGI=";
+    hash = "sha256-IS9jdr19VvgX6M1OqM6rjE8veujZcwBuOTuDm5mDXso=";
   };
 
   nativeBuildInputs = [
@@ -80,5 +78,8 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ austinbutler ];
     platforms = lib.platforms.linux;
+    # Fails to build on aarch64 with error
+    # "a label can only be part of a statement and a declaration is not a statement"
+    broken = stdenv.isLinux && stdenv.isAarch64;
   };
 }

pkgs/applications/misc/geoipupdate/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "geoipupdate";
-  version = "4.10.0";
+  version = "4.11.1";
 
   src = fetchFromGitHub {
     owner = "maxmind";
     repo = "geoipupdate";
     rev = "v${version}";
-    sha256 = "sha256-Djr0IjRxf4kKOsL0KMTAkRjW/zo0+r63TBCjet2ZhNw=";
+    sha256 = "sha256-85xPXqvRfc6zip3tPcxFsE+niPmnnPqi9gLF+ioqbV8=";
   };
 
-  vendorSha256 = "sha256-upyblOmT1UC1epOI5H92G/nzcCuGNyh3dbIApUg2Idk=";
+  vendorHash = "sha256-cPdQ7AIYUacoq885K8XBF+zChUPwbZ7YI4aDCIBOvMY=";
 
   ldflags = [ "-X main.version=${version}" ];
 

pkgs/applications/misc/pgmodeler/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgmodeler";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "pgmodeler";
     repo = "pgmodeler";
     rev = "v${version}";
-    sha256 = "sha256-SlAYl2x1qdBBwLboO59h1uifF7Q71oX3JyhWwUogdb0=";
+    sha256 = "sha256-yvVgBfJLjEynsqxQisDfOM99C8/QM0F44RIHAmxh4uU=";
   };
 
   nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];

pkgs/applications/networking/flexget/default.nix

@@ -1,19 +1,33 @@
 { lib
-, python3Packages
+, python3
 , fetchFromGitHub
 }:
 
-python3Packages.buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (old: rec {
+        version = "1.4.47";
+        src = self.fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          hash = "sha256-lfwC9/wfMZmqpHqKdXQ3E0z2GOnZlMhO/9U/Uww4WG8=";
+        };
+      });
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.5.31";
+  version = "3.5.33";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
   src = fetchFromGitHub {
-    owner = "flexget";
+    owner = "Flexget";
-    repo = "flexget";
+    repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-v6N1isaTVPwV/LC/a2lzrboLI6V/4W586RE5esfR500=";
+    hash = "sha256-LzDXNl2IQ3+j9uP+nE6JS8E+pO0n9zwmA7wrMeKR6Ms=";
   };
 
   postPatch = ''
@@ -28,7 +42,7 @@ python3Packages.buildPythonApplication rec {
   # ~400 failures
   doCheck = false;
 
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python.pkgs; [
     # See https://github.com/Flexget/Flexget/blob/master/requirements.txt
     apscheduler
     beautifulsoup4

pkgs/applications/networking/p2p/freenet/default.nix

@@ -1,61 +1,118 @@
-{ lib, stdenv, fetchurl, jdk, bash, coreutils, substituteAll, nixosTests, jna }:
+{ lib, stdenv, fetchurl, fetchFromGitHub, jdk, gradle, bash, coreutils
+, substituteAll, nixosTests, perl, fetchpatch, writeText }:
 
 let
-  version = "build01494";
+  version = "01497";
+
   freenet_ext = fetchurl {
-    url = "https://github.com/freenet/fred/releases/download/${version}/freenet-ext.jar";
+    url = "https://github.com/freenet/fred/releases/download/build01495/freenet-ext.jar";
     sha256 = "sha256-MvKz1r7t9UE36i+aPr72dmbXafCWawjNF/19tZuk158=";
   };
-  bcprov = fetchurl {
+
-    url = "https://github.com/freenet/fred/releases/download/${version}/bcprov-jdk15on-1.59.jar";
-    sha256 = "sha256-HDHkTjMdJeRtKTs+juLQcCimfbAR50yyRDKFrtHVnIU=";
-  };
   seednodes = fetchurl {
     url = "https://downloads.freenetproject.org/alpha/opennet/seednodes.fref";
     sha256 = "08awwr8n80b4cdzzb3y8hf2fzkr1f2ly4nlq779d6pvi5jymqdvv";
   };
 
-  freenet-jars = stdenv.mkDerivation {
+  patches = [
-    pname = "freenet-jars";
+    # gradle 7 support
-    inherit version;
+    (fetchpatch {
+      url = "https://github.com/freenet/fred/pull/827.patch";
+      sha256 = "sha256-T1zymxRTADVhhwp2TyB+BC/J4gZsT/CUuMrT4COlpTY=";
+    })
+  ];
 
-    src = fetchurl {
+in stdenv.mkDerivation rec {
-      url = "https://github.com/freenet/fred/releases/download/${version}/freenet.jar";
+  pname = "freenet";
-      sha256 = "sha256-1Pjc8Ob4EN7N05QkGTMKBn7z3myTDaQ98N48nNSLstg=";
+  inherit version patches;
-    };
 
-    dontUnpack = true;
+  src = fetchFromGitHub {
-
+    owner = "freenet";
-    installPhase = ''
+    repo = "fred";
-      mkdir -p $out/share/freenet
+    rev = "refs/tags/build${version}";
-      ln -s ${bcprov} $out/share/freenet/bcprov.jar
+    hash = "sha256-pywNPekofF/QotNVF28McojqK7c1Zzucds5rWV0R7BQ=";
-      ln -s ${freenet_ext} $out/share/freenet/freenet-ext.jar
-      ln -s ${jna}/share/java/jna-platform.jar $out/share/freenet/jna_platform.jar
-      ln -s ${jna}/share/java/jna.jar $out/share/freenet/jna.jar
-      ln -s $src $out/share/freenet/freenet.jar
-    '';
   };
 
-in stdenv.mkDerivation {
+  postPatch = ''
-  pname = "freenet";
+    rm gradle/verification-{keyring.keys,metadata.xml}
-  inherit version;
+  '';
 
-  src = substituteAll {
+  nativeBuildInputs = [ gradle jdk ];
+
+  wrapper = substituteAll {
     src = ./freenetWrapper;
     inherit bash coreutils jdk seednodes;
-    freenet = freenet-jars;
   };
 
-  dontUnpack = true;
+  # https://github.com/freenet/fred/blob/next/build-offline.sh
+  # fake build to pre-download deps into fixed-output derivation
+  deps = stdenv.mkDerivation {
+    pname = "${pname}-deps";
+    inherit src version patches;
 
-  passthru.tests = { inherit (nixosTests) freenet; };
+    nativeBuildInputs = [ gradle perl ];
+    buildPhase = ''
+      export GRADLE_USER_HOME=$(mktemp -d)
+      gradle --no-daemon build
+    '';
+    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
+    installPhase = ''
+      find $GRADLE_USER_HOME/caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
+        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/''${\($5 =~ s/okio-jvm/okio/r)}" #e' \
+        | sh
+    '';
+    # Don't move info to share/
+    forceShare = [ "dummy" ];
+    outputHashMode = "recursive";
+    # Downloaded jars differ by platform
+    outputHash = "sha256-CZf5M3lI7Lz9Pl8U/lNoQ6V6Jxbmkxau8L273XFFS2E=";
+    outputHashAlgo = "sha256";
+  };
+
+  # Point to our local deps repo
+  gradleInit = writeText "init.gradle" ''
+    gradle.projectsLoaded {
+      rootProject.allprojects {
+        buildscript {
+          repositories {
+            clear()
+            maven { url '${deps}/'; metadataSources {mavenPom(); artifact()} }
+          }
+        }
+        repositories {
+          clear()
+          maven { url '${deps}/'; metadataSources {mavenPom(); artifact()} }
+        }
+      }
+    }
+
+    settingsEvaluated { settings ->
+      settings.pluginManagement {
+        repositories {
+          maven { url '${deps}/'; metadataSources {mavenPom(); artifact()} }
+        }
+      }
+    }
+  '';
+
+  buildPhase = ''
+    gradle jar -Dorg.gradle.java.home=${jdk} --offline --no-daemon --info --init-script $gradleInit
+  '';
 
   installPhase = ''
+    runHook preInstall
+    install -Dm444 build/libs/freenet.jar $out/share/freenet/freenet.jar
+    ln -s ${freenet_ext} $out/share/freenet/freenet-ext.jar
     mkdir -p $out/bin
-    install -Dm555 $src $out/bin/freenet
+    install -Dm555 ${wrapper} $out/bin/freenet
-    ln -s ${freenet-jars}/share $out/share
+    substituteInPlace $out/bin/freenet \
+      --subst-var-by outFreenet $out
+    ln -s ${deps} $out/deps
+    runHook postInstall
   '';
 
+  passthru.tests = { inherit (nixosTests) freenet; };
+
   meta = {
     description = "Decentralised and censorship-resistant network";
     homepage = "https://freenetproject.org/";

pkgs/applications/networking/p2p/freenet/freenetWrapper

@@ -1,7 +1,8 @@
 #! @bash@/bin/bash
 set -eo pipefail
 PATH=@coreutils@/bin:$PATH
-export CLASSPATH=@freenet@/share/freenet/bcprov.jar:@freenet@/share/freenet/freenet-ext.jar:@freenet@/share/freenet/jna_platform.jar:@freenet@/share/freenet/jna.jar:@freenet@/share/freenet/freenet.jar
+export CLASSPATH=$(find @outFreenet@/deps/ -name "*.jar"|grep -v bcprov-jdk15on-1.48.jar|tr $'\n' :)
+CLASSPATH=$CLASSPATH:@outFreenet@/share/freenet/freenet-ext.jar:@outFreenet@/share/freenet/freenet.jar
 
 export FREENET_HOME="$HOME/.local/share/freenet"
 if [ -n "$XDG_DATA_HOME" ] ; then

pkgs/applications/networking/pjsip/default.nix

@@ -7,10 +7,13 @@
 , swig
 , alsa-lib
 , AppKit
+, CoreFoundation
+, Security
 , python3
 , pythonSupport ? true
+, pjsip
+, runCommand
 }:
-
 stdenv.mkDerivation rec {
   pname = "pjsip";
   version = "2.13";
@@ -41,21 +44,23 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl libsamplerate ]
     ++ lib.optional stdenv.isLinux alsa-lib
-    ++ lib.optional stdenv.isDarwin AppKit;
+    ++ lib.optionals stdenv.isDarwin [ AppKit CoreFoundation Security ];
 
   preConfigure = ''
     export LD=$CC
   '';
 
+  NIX_CFLAGS_LINK = lib.optionalString stdenv.isDarwin "-headerpad_max_install_names";
+
   postBuild = lib.optionalString pythonSupport ''
     make -C pjsip-apps/src/swig/python
   '';
 
+  configureFlags = [ "--enable-shared" ];
+
   outputs = [ "out" ]
     ++ lib.optional pythonSupport "py";
 
-  configureFlags = [ "--enable-shared" ];
-
   postInstall = ''
     mkdir -p $out/bin
     cp pjsip-apps/bin/pjsua-* $out/bin/pjsua
@@ -65,13 +70,44 @@ stdenv.mkDerivation rec {
     (cd pjsip-apps/src/swig/python && \
       python setup.py install --prefix=$py
     )
+  '' + lib.optionalString stdenv.isDarwin ''
+    # On MacOS relative paths are used to refer to libraries. All libraries use
+    # a relative path like ../lib/*.dylib or ../../lib/*.dylib. We need to
+    # rewrite these to use absolute ones.
+
+    # First, find all libraries (and their symlinks) in our outputs to define
+    # the install_name_tool -change arguments we should pass.
+    readarray -t libraries < <(
+      for outputName in $(getAllOutputNames); do
+        find "''${!outputName}" \( -name '*.dylib*' -o -name '*.so*' \)
+      done
+    )
+
+    # Determine the install_name_tool -change arguments that are going to be
+    # applied to all libraries.
+    change_args=()
+    for lib in "''${libraries[@]}"; do
+      lib_name="$(basename $lib)"
+      change_args+=(-change ../lib/$lib_name $lib)
+      change_args+=(-change ../../lib/$lib_name $lib)
+    done
+
+    # Rewrite id and library refences for all non-symlinked libraries.
+    for lib in "''${libraries[@]}"; do
+      if [ -f "$lib" ]; then
+        install_name_tool -id $lib "''${change_args[@]}" $lib
+      fi
+    done
   '';
 
   # We need the libgcc_s.so.1 loadable (for pthread_cancel to work)
   dontPatchELF = true;
 
+  passthru.tests.python-pjsua2 = runCommand "python-pjsua2" { } ''
+    ${(python3.withPackages (pkgs: [ pkgs.pjsua2 ])).interpreter} -c "import pjsua2" > $out
+  '';
+
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "A multimedia communication library written in C, implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE";
     homepage = "https://pjsip.org/";
     license = licenses.gpl2Plus;

pkgs/applications/plasma-mobile/default.nix

@@ -75,7 +75,7 @@ let
       plasma-settings = callPackage ./plasma-settings.nix {};
       plasmatube = callPackage ./plasmatube {};
       qmlkonsole = callPackage ./qmlkonsole.nix {};
-      spacebar = callPackage ./spacebar.nix { inherit srcs; };
+      spacebar = callPackage ./spacebar.nix {};
       tokodon = callPackage ./tokodon.nix {};
     };
 

pkgs/applications/plasma-mobile/spacebar.nix

@@ -1,7 +1,5 @@
 { lib
 , mkDerivation
-, gcc12Stdenv
-, srcs
 
 , cmake
 , extra-cmake-modules
@@ -17,17 +15,14 @@
 , knotifications
 , kpeople
 , libphonenumber
-, libqofono
 , modemmanager-qt
 , protobuf
 , qcoro
 , qtquickcontrols2
 }:
 
-# Workaround for AArch64 still using GCC9.
+mkDerivation {
-gcc12Stdenv.mkDerivation rec {
   pname = "spacebar";
-  inherit (srcs.spacebar) version src;
 
   nativeBuildInputs = [
     cmake

pkgs/applications/radio/quisk/default.nix

@@ -1,5 +1,5 @@
 { lib, python39Packages, fetchPypi
-, fftw, alsa-lib, pulseaudio, pyusb, wxPython_4_0 }:
+, fftw, alsa-lib, pulseaudio, pyusb, wxPython_4_2 }:
 
 python39Packages.buildPythonApplication rec {
   pname = "quisk";
@@ -12,7 +12,7 @@ python39Packages.buildPythonApplication rec {
 
   buildInputs = [ fftw alsa-lib pulseaudio ];
 
-  propagatedBuildInputs = [ pyusb wxPython_4_0 ];
+  propagatedBuildInputs = [ pyusb wxPython_4_2 ];
 
   doCheck = false;
 

pkgs/applications/radio/sdrangel/default.nix

@@ -24,14 +24,20 @@
 , libbladeRF
 , mbelib
 , mkDerivation
+, ninja
 , ocl-icd
 , opencv3
 , pkg-config
 , qtcharts
+, qtdeclarative
+, qtgraphicaleffects
 , qtlocation
 , qtmultimedia
+, qtquickcontrols
+, qtquickcontrols2
 , qtserialport
 , qtspeech
+, qttools
 , qtwebsockets
 , qtwebengine
 , rtl-sdr
@@ -39,6 +45,7 @@
 , sgp4
 , soapysdr-with-plugins
 , uhd
+, zlib
 }:
 
 mkDerivation rec {
@@ -49,10 +56,10 @@ mkDerivation rec {
     owner = "f4exb";
     repo = "sdrangel";
     rev = "v${version}";
-    sha256 = "sha256-hsYt7zGG6CSWeQ9A3GPt65efjZGPu33O5pIhnZjFgmY=";
+    hash = "sha256-hsYt7zGG6CSWeQ9A3GPt65efjZGPu33O5pIhnZjFgmY=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake ninja pkg-config ];
 
   buildInputs = [
     airspy
@@ -78,10 +85,15 @@ mkDerivation rec {
     mbelib
     opencv3
     qtcharts
+    qtdeclarative
+    qtgraphicaleffects
     qtlocation
     qtmultimedia
+    qtquickcontrols
+    qtquickcontrols2
     qtserialport
     qtspeech
+    qttools
     qtwebsockets
     qtwebengine
     rtl-sdr
@@ -89,11 +101,12 @@ mkDerivation rec {
     sgp4
     soapysdr-with-plugins
     uhd
+    zlib
   ];
 
   cmakeFlags = [
     "-DAPT_DIR=${aptdec}"
-    "-DDAB_LIB=${dab_lib}"
+    "-DDAB_INCLUDE_DIR:PATH=${dab_lib}/include/dab_lib"
     "-DLIBSERIALDV_INCLUDE_DIR:PATH=${serialdv}/include/serialdv"
     "-DLIMESUITE_INCLUDE_DIR:PATH=${limesuite}/include"
     "-DLIMESUITE_LIBRARY:FILEPATH=${limesuite}/lib/libLimeSuite${stdenv.hostPlatform.extensions.sharedLibrary}"

pkgs/applications/science/math/sage/patches/numpy-1.24-upgrade.patch

@@ -0,0 +1,58 @@
+diff --git a/src/sage/misc/persist.pyx b/src/sage/misc/persist.pyx
+index 3ac5f1cc2b..cb1f327c19 100644
+--- a/src/sage/misc/persist.pyx
++++ b/src/sage/misc/persist.pyx
+@@ -157,7 +157,7 @@ def load(*filename, compress=True, verbose=True, **kwargs):
+         ....:     _ = f.write(code)
+         sage: load(t)
+         sage: hello
+-        <fortran object>
++        <fortran ...>
+     """
+     import sage.repl.load
+     if len(filename) != 1:
+diff --git a/src/sage/plot/complex_plot.pyx b/src/sage/plot/complex_plot.pyx
+index 6f0aeab87a..b77c69b2f7 100644
+--- a/src/sage/plot/complex_plot.pyx
++++ b/src/sage/plot/complex_plot.pyx
+@@ -461,6 +461,8 @@ def complex_to_rgb(z_values, contoured=False, tiled=False,
+             rgb[i, j, 2] = b
+ 
+     sig_off()
++    nan_indices = np.isnan(rgb).any(-1)     # Mask for undefined points
++    rgb[nan_indices] = 1                    # Make nan_indices white
+     return rgb
+ 
+ 
+diff --git a/src/sage/plot/histogram.py b/src/sage/plot/histogram.py
+index 3bc2b76b58..388c2d1391 100644
+--- a/src/sage/plot/histogram.py
++++ b/src/sage/plot/histogram.py
+@@ -87,13 +87,8 @@ class Histogram(GraphicPrimitive):
+ 
+         TESTS::
+ 
+-            sage: h = histogram([10,3,5], normed=True)[0]
+-            doctest:warning...:
+-            DeprecationWarning: the 'normed' option is deprecated. Use 'density' instead.
+-            See https://trac.sagemath.org/25260 for details.
++            sage: h = histogram([10,3,5], density=True)[0]
+             sage: h.get_minmax_data()
+-            doctest:warning ...
+-            ...VisibleDeprecationWarning: Passing `normed=True` on non-uniform bins has always been broken, and computes neither the probability density function nor the probability mass function. The result is only correct if the bins are uniform, when density=True will produce the same result anyway. The argument will be removed in a future version of numpy.
+             {'xmax': 10.0, 'xmin': 3.0, 'ymax': 0.476190476190..., 'ymin': 0}
+         """
+         import numpy
+diff --git a/src/sage/repl/ipython_extension.py b/src/sage/repl/ipython_extension.py
+index 798671aab4..cad6a47ca8 100644
+--- a/src/sage/repl/ipython_extension.py
++++ b/src/sage/repl/ipython_extension.py
+@@ -405,7 +405,7 @@ class SageMagics(Magics):
+             ....: C END FILE FIB1.F
+             ....: ''')
+             sage: fib
+-            <fortran object>
++            <fortran ...>
+             sage: from numpy import array
+             sage: a = array(range(10), dtype=float)
+             sage: fib(a, 10)

pkgs/applications/science/math/sage/sage-src.nix

@@ -127,6 +127,23 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-9BhQLFB3wUhiXRQsK9L+I62lSjvTfrqMNi7QUIQvH4U=";
     })
 
+    # https://github.com/sagemath/sage/pull/35235
+    (fetchpatch {
+      name = "ipython-8.11-upgrade.patch";
+      url = "https://github.com/sagemath/sage/commit/23471e2d242c4de8789d7b1fc8b07a4b1d1e595a.diff";
+      sha256 = "sha256-wvH4BvDiaBv7jbOP8LvOE5Vs16Kcwz/C9jLpEMohzLQ=";
+    })
+
+    # positively reviewed
+    (fetchpatch {
+      name = "matplotlib-3.7.0-upgrade.patch";
+      url = "https://github.com/sagemath/sage/pull/35177.diff";
+      sha256 = "sha256-YdPnMsjXBm9ZRm6a8hH8rSynkrABjLoIzqwp3F/rKAw=";
+    })
+
+    # rebased from https://github.com/sagemath/sage/pull/34994, merged in sage 10.0.beta2
+    ./patches/numpy-1.24-upgrade.patch
+
     # temporarily paper over https://github.com/jupyter-widgets/ipywidgets/issues/3669
     ./patches/ipywidgets-on_submit-deprecationwarning.patch
 

pkgs/applications/science/math/sage/sagelib.nix

@@ -22,6 +22,7 @@
 , gsl
 , iml
 , jinja2
+, libpng
 , lcalc
 , lrcalc
 , gap
@@ -99,6 +100,7 @@ buildPythonPackage rec {
     gd
     readline
     iml
+    libpng
   ];
 
   propagatedBuildInputs = [

pkgs/applications/version-management/sublime-merge/default.nix

@@ -9,8 +9,8 @@ in {
   } {};
 
   sublime-merge-dev = common {
-    buildVersion = "2082";
+    buildVersion = "2085";
-    x64sha256 = "Gl1BrLTSDLRTgrYQW/99o0XRjSIxvnNYRIViZEidcsM=";
+    x64sha256 = "40yI6EtP2l22aPP50an3ycvdEcAqJphhGhYYoOPyHw0=";
     dev = true;
   } {};
 }

pkgs/desktops/plasma-5/kpipewire.nix

@@ -19,10 +19,10 @@ mkDerivation {
     ki18n
     kcoreaddons
     plasma-wayland-protocols
-    libepoxy
     ffmpeg
     mesa
     pipewire
     wayland
   ];
+  propagatedBuildInputs = [ libepoxy ];
 }

pkgs/development/beam-modules/erlang-ls/default.nix

@@ -56,6 +56,7 @@ rebar3Relx {
     description = "The Erlang Language Server";
     platforms = platforms.unix;
     license = licenses.asl20;
+    mainProgram = "erlang_ls";
   };
   passthru.updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell

pkgs/development/compilers/nim/default.nix

@@ -86,12 +86,12 @@ in {
 
   nim-unwrapped = stdenv.mkDerivation rec {
     pname = "nim-unwrapped";
-    version = "1.6.10";
+    version = "1.6.12";
     strictDeps = true;
 
     src = fetchurl {
       url = "https://nim-lang.org/download/nim-${version}.tar.xz";
-      hash = "sha256-E9dwL4tXCHur6M0FHBO8VqMXFBi6hntJxrvQmynST+o=";
+      hash = "sha256-rO8LCrdzYE1Nc5S2hRntt0+zD0aRIpSyi8J+DHtLTcI=";
     };
 
     buildInputs = [ boehmgc openssl pcre readline sqlite ];
@@ -153,14 +153,14 @@ in {
 
   nimble-unwrapped = stdenv.mkDerivation rec {
     pname = "nimble-unwrapped";
-    version = "0.13.1";
+    version = "0.14.2";
     strictDeps = true;
 
     src = fetchFromGitHub {
       owner = "nim-lang";
       repo = "nimble";
       rev = "v${version}";
-      sha256 = "1idb4r0kjbqv16r6bgmxlr13w2vgq5332hmnc8pjbxiyfwm075x8";
+      hash = "sha256-8b5yKvEl7c7wA/8cpdaN2CSvawQJzuRce6mULj3z/mI=";
     };
 
     depsBuildBuild = [ nim-unwrapped ];

pkgs/development/libraries/alembic/default.nix

@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec
 {
   pname = "alembic";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "alembic";
     repo = "alembic";
     rev = version;
-    sha256 = "sha256-8dQhOQN0t2Y2kC2wOpQUqbu6Woy4DUmiLqXjf1D+mxE=";
+    sha256 = "sha256-wJVx0rwK0Qk07jlP0DyEAZUrAD+47qcVXSnTh5ngZG8=";
   };
 
   # note: out is unused (but required for outputDoc anyway)

pkgs/development/libraries/grantlee/5/default.nix

@@ -2,14 +2,14 @@
 
 mkDerivation rec {
   pname = "grantlee";
-  version = "5.2.0";
+  version = "5.3.1";
   grantleePluginPrefix = "lib/grantlee/${lib.versions.majorMinor version}";
 
   src = fetchFromGitHub {
     owner = "steveire";
     repo = "grantlee";
     rev = "v${version}";
-    sha256 = "sha256-mAbgzdBdIW1wOTQNBePQuyTgkKdpn1c+zR3H7mXHvgk=";
+    sha256 = "sha256-enP7b6A7Ndew2LJH569fN3IgPu2/KL5rCmU/jmKb9sY=";
   };
 
   buildInputs = [ qtbase qtscript ];

pkgs/development/libraries/grantlee/5/grantlee-no-canonicalize-filepath.patch

@@ -9,7 +9,7 @@ Index: grantlee-5.1.0/templates/lib/templateloader.cpp
 -    if (file.exists()
 -        && !fi.canonicalFilePath().contains(
 -            QDir(d->m_templateDirs.at(i)).canonicalPath()))
--      return Template();
+-      return {};
      ++i;
    }
 

pkgs/development/libraries/hunspell/dictionaries.nix

@@ -828,14 +828,14 @@ rec {
   th_TH = th-th;
   th-th = mkDict {
     pname = "hunspell-dict-th-th";
-    version = "experimental-2021-12-20";
+    version = "experimental-2023-03-01";
     dictFileName = "th_TH";
     readmeFile = "README.md";
     src = fetchFromGitHub {
       owner = "SyafiqHadzir";
       repo = "Hunspell-TH";
-      rev = "f119e58e5f6954965d6abd683e7d4c4b9be2684f";
+      rev = "9c09f1b7c0eb4d04b9f6f427901686c5c3d9fa54";
-      sha256 = "sha256-hwqKvuLxbtzxfyQ5YhC/sdb3QQwxCfzgDOHeatxDjxM=";
+      sha256 = "1wszpnbgj31k72x1vvcfkzcpmxsncdpqsi3zagah7swilpi7cqm4";
     };
     meta = with lib; {
       description = "Hunspell dictionary for Central Thai (Thailand)";

pkgs/development/libraries/kde-frameworks/kiconthemes/default.nix

@@ -1,5 +1,5 @@
 {
-  mkDerivation,
+  mkDerivation, fetchpatch,
   extra-cmake-modules,
   breeze-icons, karchive, kcoreaddons, kconfigwidgets, ki18n, kitemviews,
   qtbase, qtsvg, qttools,
@@ -9,6 +9,12 @@ mkDerivation {
   pname = "kiconthemes";
   patches = [
     ./default-theme-breeze.patch
+
+    # fix compile error
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/kiconthemes/-/commit/d5d04e3c3fa92fbfd95eced39c3e272b8980563d.patch";
+      hash = "sha256-8YGWJg7+LrPpezW8ubObcFovI5DCVn3gbdH7KDdEeQw=";
+    })
   ];
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [

pkgs/development/libraries/kirigami-addons/default.nix

@@ -12,14 +12,14 @@
 
 mkDerivation rec {
   pname = "kirigami-addons";
-  version = "0.6";
+  version = "0.7.2";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "libraries";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RUu/0O/YRVRsRYeASfW8UQ/Ql2VbLOdVySVo9/hAmLw=";
+    sha256 = "sha256-2s9ShwYd2hOb18WRA2nLst6Q4UBHvFL+g7Grpjclz9I=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/ktextaddons/default.nix

@@ -0,0 +1,20 @@
+{ lib, mkDerivation, fetchurl, cmake, extra-cmake-modules, karchive, kconfigwidgets, kcoreaddons, ki18n, kxmlgui, qtkeychain }:
+mkDerivation rec {
+  pname = "ktextaddons";
+  version = "1.1.0";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-BV1tHCD6kGI5Zj8PRZcEanLi1O7huS+qUijjtePDvik=";
+  };
+
+  nativeBuildInputs = [ cmake extra-cmake-modules ];
+  buildInputs = [ karchive kconfigwidgets kcoreaddons ki18n kxmlgui qtkeychain ];
+
+  meta = with lib; {
+    description = "Various text handling addons for KDE applications";
+    homepage = "https://invent.kde.org/libraries/ktextaddons/";
+    license = licenses.gpl2Plus;
+    maintainers = [];
+  };
+}

pkgs/development/libraries/nco/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nco";
-  version = "5.1.4";
+  version = "5.1.5";
 
   src = fetchFromGitHub {
     owner = "nco";
     repo = "nco";
     rev = version;
-    sha256 = "sha256-M2GP92SIs4B92Re8McGKIIjQJ+qXAr/TwDtFKcH/zsk=";
+    sha256 = "sha256-L1aAACWDVrPdl8IHSpch3l8EhdjAxOcUAZchKMYKWqY=";
   };
 
   nativeBuildInputs = [ flex which antlr2 ];

pkgs/development/libraries/openmpi/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, gfortran, perl, libnl
+{ lib, stdenv, fetchurl, gfortran, perl, libnl
 , rdma-core, zlib, numactl, libevent, hwloc, targetPackages, symlinkJoin
 , libpsm2, libfabric, pmix, ucx
 
@@ -25,21 +25,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "openmpi";
-  version = "4.1.4";
+  version = "4.1.5";
 
   src = with lib.versions; fetchurl {
     url = "https://www.open-mpi.org/software/ompi/v${major version}.${minor version}/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "03ckngrff1cl0l81vfvrfhp99rbgk7s0633kr1l468yibwbjx4cj";
+    sha256 = "sha256-pkCYa8JXOJ3TeYhv2uYmTIz6VryYtxzjrj372M5h2+M=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "RDMA-osc-perform-CAS-in-shared-memory-if-possible.patch";
-      url = "https://github.com/open-mpi/ompi/pull/10513/commits/0512c135a77a0278e5288e0e119dce24c95ebed4.patch";
-      sha256 = "sha256-K1Gc+hBUkTPY1WqLP6JWo623EUhkoL4ONrqPVDNfFuE=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs ./
 

pkgs/development/libraries/wxsqlite3/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wxsqlite3";
-  version = "4.9.2";
+  version = "4.9.3";
 
   src = fetchFromGitHub {
     owner = "utelle";
     repo = "wxsqlite3";
     rev = "v${version}";
-    hash = "sha256-LYQky0tIzZrxroa4korlE+RK2MJTVLgw3T2kGZOyY2s=";
+    hash = "sha256-HdsPCdZF1wMTGYFaXzq+f4bUFjgCAklsKhhdyMKaxp8=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/development/ocaml-modules/lwd/default.nix

@@ -0,0 +1,24 @@
+{ lib, fetchurl, buildDunePackage, seq }:
+
+buildDunePackage rec {
+  pname = "lwd";
+  version = "0.3";
+
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
+  src = fetchurl {
+    url =
+      "https://github.com/let-def/lwd/releases/download/v${version}/lwd-${version}.tbz";
+    sha256 = "sha256-H/vyW2tn2OBuWwcmPs8NcINXgFe93MSxRd8dzeoXARI=";
+  };
+
+  propagatedBuildInputs = [ seq ];
+
+  meta = with lib; {
+    description = "Lightweight reactive documents";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/let-def/lwd";
+  };
+}

pkgs/development/ocaml-modules/lwd/nottui-lwt.nix

@@ -0,0 +1,19 @@
+{ lib, fetchurl, buildDunePackage, lwd, lwt, nottui }:
+
+buildDunePackage {
+  pname = "nottui-lwt";
+
+  inherit (lwd) version src;
+
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
+  propagatedBuildInputs = [ lwt nottui ];
+
+  meta = with lib; {
+    description = "Run Nottui UIs in Lwt";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/let-def/lwd";
+  };
+}

pkgs/development/ocaml-modules/lwd/nottui-pretty.nix

@@ -0,0 +1,19 @@
+{ lib, fetchurl, buildDunePackage, lwd, nottui }:
+
+buildDunePackage {
+  pname = "nottui-pretty";
+
+  inherit (lwd) version src;
+
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
+  propagatedBuildInputs = [ nottui ];
+
+  meta = with lib; {
+    description = "A pretty-printer based on PPrint rendering UIs";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/let-def/lwd";
+  };
+}

pkgs/development/ocaml-modules/lwd/nottui.nix

@@ -0,0 +1,19 @@
+{ lib, fetchurl, buildDunePackage, lwd, notty }:
+
+buildDunePackage {
+  pname = "nottui";
+
+  inherit (lwd) version src;
+
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
+  propagatedBuildInputs = [ lwd notty ];
+
+  meta = with lib; {
+    description = "UI toolkit for the terminal built on top of Notty and Lwd";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/let-def/lwd";
+  };
+}

pkgs/development/ocaml-modules/lwd/tyxml-lwd.nix

@@ -0,0 +1,20 @@
+{ lib, fetchurl, buildDunePackage, js_of_ocaml, js_of_ocaml-ppx, lwd, tyxml }:
+
+buildDunePackage {
+  pname = "tyxml-lwd";
+
+  inherit (lwd) version src;
+
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
+  buildInputs = [ js_of_ocaml-ppx ];
+  propagatedBuildInputs = [ js_of_ocaml lwd tyxml ];
+
+  meta = with lib; {
+    description = "Make reactive webpages in Js_of_ocaml using Tyxml and Lwd";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/let-def/lwd";
+  };
+}

pkgs/development/python-modules/mypy/default.nix

@@ -53,8 +53,9 @@ buildPythonPackage rec {
     })
     (fetchpatch {
       # https://github.com/python/mypy/pull/14787
-      url = "https://github.com/AlexWaygood/mypy/commit/8e459eab40ac0fae9740e985ee4aeb348cde28c5.patch";
+      url = "https://github.com/python/mypy/commit/243f584d43e6eb316920f3155067ce7c1b65d473.patch";
-      hash = "sha256-R7DU6MFnaeHPobUb8ADhssTKDwdPBXBhDN2mxrrQ51M=";
+      hash = "sha256-uuh3S5ZyuJeTXyMvav2uSEao2qq23xMjK8rJjkY8RCY=";
+      includes = [ "mypyc/build.py" ];
     })
   ];
 

pkgs/development/python-modules/pyvista/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pyvista";
-  version = "0.38.4";
+  version = "0.38.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-lOubi5di7K/Q/N/VMPMqC5hr3q69PR+4EgL+zde9j78=";
+    hash = "sha256-2EH9S67xj3Z2wHWAvBt7alZPZj5/K5787cQnE53lzA0=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/rpy2/default.nix

@@ -24,13 +24,13 @@
 }:
 
 buildPythonPackage rec {
-    version = "3.5.9";
+    version = "3.5.10";
     pname = "rpy2";
 
     disabled = isPyPy;
     src = fetchPypi {
       inherit version pname;
-      hash = "sha256-iaDX40Bld5VVjg22v52PE5VCi6EYr5AjUV3ako5pRPA=";
+      hash = "sha256-+B8K+wHjxvUVwJVzvFhcDhx+OF7IFBXOCmImjGBex/w=";
     };
 
     patches = [

pkgs/development/python-modules/xml2rfc/default.nix

@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "xml2rfc";
-  version = "3.16.0";
+  version = "3.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "ietf-tools";
     repo = "xml2rfc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-H2m6WZTIu2xLIz3ysOZcicIibPj8mErrxYM2+F07aS0=";
+    hash = "sha256-xG0MCAOA5LmyX5LgJVOKfZS7xM7sJHs9L4kZP2lmlnY=";
   };
 
   postPatch = ''

pkgs/development/tools/analysis/checkstyle/default.nix

@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "10.8.1";
+  version = "10.9.2";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-xVtouHBS5zR62WsPSn2mPlxce4Hn6JZLDwg2saCOrL0=";
+    sha256 = "sha256-XsWzSg/bwP+O454oQSVDrvmjWKVZpLyfGB47olqRSUY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/tools/analysis/kcov/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , zlib
@@ -10,8 +9,7 @@
 , python3
 , libiberty
 , libopcodes
-, runCommand
+, runCommandCC
-, gcc
 , rustc
 }:
 
@@ -19,25 +17,15 @@ let
   self =
     stdenv.mkDerivation rec {
       pname = "kcov";
-      version = "38";
+      version = "41";
 
       src = fetchFromGitHub {
         owner = "SimonKagstrom";
         repo = "kcov";
         rev = "v${version}";
-        sha256 = "sha256-6LoIo2/yMUz8qIpwJVcA3qZjjF+8KEM1MyHuyHsQD38=";
+        sha256 = "sha256-Kit4Yn5Qeg3uAc6+RxwlVEhDKN6at+Uc7V38yhDPrAY=";
       };
 
-      patches = [
-        # Pull upstream patch for binutils-2/39 support:
-        #   https://github.com/SimonKagstrom/kcov/pull/383
-        (fetchpatch {
-          name = "binutils-2.39.patch";
-          url = "https://github.com/SimonKagstrom/kcov/commit/fd1a4fd2f02cee49afd74e427e38c61b89154582.patch";
-          hash = "sha256-licQkC8qDg2i6No3j0yKEU6i+Owi4lhrnfGvETkzz7w=";
-        })
-      ];
-
       preConfigure = "patchShebangs src/bin-to-c-source.py";
       nativeBuildInputs = [ cmake pkg-config python3 ];
 
@@ -46,25 +34,25 @@ let
       strictDeps = true;
 
       passthru.tests = {
-        works-on-c = runCommand "works-on-c" {} ''
+        works-on-c = runCommandCC "works-on-c" { } ''
           set -ex
           cat - > a.c <<EOF
           int main() {}
           EOF
-          ${gcc}/bin/gcc a.c -o a.out
+          $CC a.c -o a.out
           ${self}/bin/kcov /tmp/kcov ./a.out
           test -e /tmp/kcov/index.html
           touch $out
           set +x
         '';
 
-        works-on-rust = runCommand "works-on-rust" {} ''
+        works-on-rust = runCommandCC "works-on-rust" { nativeBuildInputs = [ rustc ]; } ''
           set -ex
           cat - > a.rs <<EOF
           fn main() {}
           EOF
           # Put gcc in the path so that `cc` is found
-          PATH=${gcc}/bin:$PATH ${rustc}/bin/rustc a.rs -o a.out
+          rustc a.rs -o a.out
           ${self}/bin/kcov /tmp/kcov ./a.out
           test -e /tmp/kcov/index.html
           touch $out

pkgs/development/tools/continuous-integration/buildkite-agent/default.nix

@@ -3,16 +3,16 @@
   nixosTests }:
 buildGoModule rec {
   pname = "buildkite-agent";
-  version = "3.44.0";
+  version = "3.45.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     rev = "v${version}";
-    sha256 = "sha256-iN6Q+HXaZgUt8kXDGG5e1hY0/g/JYSHQ768YYRwZsuw=";
+    sha256 = "sha256-T1B9eo0LVN5FMI76TJQ4yxIXOfqT9wHNO5DHfVaWHBA=";
   };
 
-  vendorHash = "sha256-I+tjSBfAvRyE0bjVRloAkb5Jftb6dxoq8lNSgWHAcVk=";
+  vendorHash = "sha256-kxqwGJBm5cT0ay29TlAqq3cFWheLqMwX/MtHpaHohBc=";
 
   postPatch = ''
     substituteInPlace bootstrap/shell/shell.go --replace /bin/bash ${bash}/bin/bash

pkgs/development/tools/datree/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "datree";
-  version = "1.8.39";
+  version = "1.8.42";
 
   src = fetchFromGitHub {
     owner = "datreeio";
     repo = "datree";
     rev = "refs/tags/${version}";
-    hash = "sha256-kTN1c16AIXnnSi1lN378u/kmuC1axZT2LAOH+LGLVbA=";
+    hash = "sha256-8oA0AgmEARlX8q1FjeFFOSMN9hing/4z3zqfqzhMyfs=";
   };
 
-  vendorHash = "sha256-mkVguYzjNGgFUdATjGfenCx3h97LS3SEOkYo3CuP9fA=";
+  vendorHash = "sha256-MrVIpr2iwddW3yUeBuDfeg+Xo9Iarr/fp4Rc4WGYGeU=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/development/tools/misc/patchelf/unstable.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "patchelf";
-  version = "unstable-2023-03-07";
+  version = "unstable-2023-03-18";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "patchelf";
-    rev = "ea2fca765c440fff1ff74e1463444dea7b819db2";
+    rev = "265b31ae22c6e1d20b01295aaa7bcf28fd31a5cf";
-    sha256 = "sha256-IH80NcLhwjGpIXEjHuV+NgaSC+Y/PXquxZ/C8Bl+CLk=";
+    sha256 = "sha256-+iGvdjXvhk5mN8jp3u+M9fICKFqbtyZCx+WjQszaB1o=";
   };
 
   # Drop test that fails on musl (?)

pkgs/os-specific/linux/ch9344/default.nix

@@ -0,0 +1,48 @@
+{ stdenv, lib, fetchzip, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "ch9344";
+  version = "1.9";
+
+  src = fetchzip {
+    name = "CH9344SER_LINUX.zip";
+    url = "https://www.wch.cn/downloads/file/386.html#CH9344SER_LINUX.zip";
+    hash = "sha256-g55ftAfjKKlUFzGhI1a/O7Eqbz6rkGf1vWuEJjBZxBE=";
+  };
+
+  patches = lib.optionals (lib.versionAtLeast kernel.modDirVersion "6.1") [
+    # https://github.com/torvalds/linux/commit/a8c11c1520347be74b02312d10ef686b01b525f1
+    ./fix-incompatible-pointer-types.patch
+  ];
+
+  sourceRoot = "${src.name}/driver";
+  hardeningDisable = [ "pic" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  preBuild = ''
+    substituteInPlace Makefile --replace "KERNELDIR :=" "KERNELDIR ?="
+  '';
+
+  makeFlags = [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D ch9344.ko $out/lib/modules/${kernel.modDirVersion}/usb/serial/ch9344.ko
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "http://www.wch-ic.com/";
+    downloadPage = "https://www.wch.cn/downloads/CH9344SER_LINUX_ZIP.html";
+    description = "WCH CH9344/CH348 UART driver";
+    longDescription = ''
+      A kernel module for WinChipHead CH9344/CH348 USB To Multi Serial Ports controller.
+    '';
+    # Archive contains no license.
+    license = licenses.unfree;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ MakiseKurisu ];
+  };
+}

pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch

@@ -0,0 +1,22 @@
+diff --git a/ch9344.c b/ch9344.c
+index 1e37293..a16af82 100644
+--- a/ch9344.c
++++ b/ch9344.c
+@@ -79,7 +79,7 @@ static DEFINE_IDR(ch9344_minors);
+ static DEFINE_MUTEX(ch9344_minors_lock);
+ 
+ static void ch9344_tty_set_termios(struct tty_struct *tty,
+-                                   struct ktermios *termios_old);
++                                   const struct ktermios *termios_old);
+ 
+ static int ch9344_get_portnum(int index);
+ 
+@@ -1597,7 +1597,7 @@ u8 cal_recv_tmt(__le32 bd)
+ }
+ 
+ static void ch9344_tty_set_termios(struct tty_struct *tty,
+-                                   struct ktermios *termios_old)
++                                   const struct ktermios *termios_old)
+ {
+     struct ch9344 *ch9344 = tty->driver_data;
+     struct ktermios *termios = &tty->termios;

pkgs/os-specific/linux/kernel/common-config.nix

@@ -283,6 +283,15 @@ let
       DRM_SIMPLEDRM = whenAtLeast "5.14" no;
     };
 
+    fonts = {
+      FONTS = yes;
+      # Default fonts enabled if FONTS is not set
+      FONT_8x8 = yes;
+      FONT_8x16 = yes;
+      # High DPI font
+      FONT_TER16x32 = whenAtLeast "5.0" yes;
+    };
+
     video = {
       DRM_LEGACY = no;
       NOUVEAU_LEGACY_CTX_SUPPORT = whenBetween "5.2" "6.3" no;

pkgs/servers/komga/default.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "0.163.0";
+  version = "0.164.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/v${version}/${pname}-${version}.jar";
-    sha256 = "sha256-dKbdzfjb+brY++uflVvuF1LaOIaYn1UqIGIjCsyLMv8=";
+    sha256 = "sha256-p0pBnRn++XblmOS1WdHm5VVYvg0fPz/B3QCepOvBfYk=";
   };
 
   nativeBuildInputs = [

pkgs/servers/monitoring/cockpit/default.nix

@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "cockpit";
-  version = "284";
+  version = "287";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
-    rev = "80a7c7cfed9157915067666fe95b298896f2aea8";
+    rev = "refs/tags/${version}";
-    sha256 = "sha256-iAIW6nVUk1FJD2dQvDMREPVqrq0JkExJ7lVio//ALts=";
+    sha256 = "sha256-tIZOI3jiMRaGHMXS1mA1Tom9ij3L/VuxDUJdnEc7SSc=";
     fetchSubmodules = true;
   };
 
@@ -88,23 +88,25 @@ stdenv.mkDerivation rec {
     udev
   ];
 
-  patches = [
+  postPatch = ''
     # Instead of requiring Internet access to do an npm install to generate the package-lock.json
     # it copies the package-lock.json already present in the node_modules folder fetched as a git
     # submodule.
-    ./nerf-node-modules.patch
+    echo "#!/bin/sh" > test/node_modules
 
-    # sysconfdir is $(prefix)/etc by default and it breaks the configuration file loading feature
+    substituteInPlace src/tls/cockpit-certificate-helper.in \
-    # changing sysconfdir to /etc breaks the build in this part of the makefile because it tries
+      --replace 'COCKPIT_CONFIG="@sysconfdir@/cockpit"' 'COCKPIT_CONFIG=/etc/cockpit'
-    # to write to /etc inside the sandbox
+
-    # this patch redirects it to write to $out/etc instead of /etc
+    substituteInPlace src/tls/cockpit-certificate-ensure.c \
-    ./fix-makefiles.patch
+      --replace '#define COCKPIT_SELFSIGNED_PATH      PACKAGE_SYSCONF_DIR COCKPIT_SELFSIGNED_FILENAME' '#define COCKPIT_SELFSIGNED_PATH      "/etc" COCKPIT_SELFSIGNED_FILENAME'
-  ];
+
+    substituteInPlace src/common/cockpitconf.c \
+      --replace 'const char *cockpit_config_dirs[] = { PACKAGE_SYSCONF_DIR' 'const char *cockpit_config_dirs[] = { "/etc"'
 
-  postPatch = ''
     # instruct users with problems to create a nixpkgs issue instead of nagging upstream directly
     substituteInPlace configure.ac \
       --replace 'devel@lists.cockpit-project.org' 'https://github.com/NixOS/nixpkgs/issues/new?assignees=&labels=0.kind%3A+bug&template=bug_report.md&title=cockpit%25'
+
     patchShebangs \
       test/common/pixel-tests \
       test/common/run-tests \
@@ -114,7 +116,7 @@ stdenv.mkDerivation rec {
       tools/make-compile-commands \
       tools/node-modules \
       tools/termschutz \
-      tools/webpack-make
+      tools/webpack-make.js
 
     for f in node_modules/.bin/*; do
       patchShebangs $(realpath $f)
@@ -145,7 +147,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-prefix-only=yes"
-    "--sysconfdir=/etc"
     "--disable-pcp" # TODO: figure out how to package its dependency
     "--with-default-session-path=/run/wrappers/bin:/run/current-system/sw/bin"
   ];
@@ -158,7 +159,6 @@ stdenv.mkDerivation rec {
   '';
 
   postBuild = ''
-    find | grep cockpit-bridge
     chmod +x \
       src/systemd/update-motd \
       src/tls/cockpit-certificate-helper \
@@ -215,7 +215,10 @@ stdenv.mkDerivation rec {
     npm run stylelint
   '';
 
-  passthru.tests = { inherit (nixosTests) cockpit; };
+  passthru = {
+    tests = { inherit (nixosTests) cockpit; };
+    updateScript = ./update.sh;
+  };
 
   meta = with lib; {
     description = "Web-based graphical interface for servers";

pkgs/servers/monitoring/cockpit/fix-makefiles.patch

@@ -1,34 +0,0 @@
-diff --git a/src/systemd/Makefile.am b/src/systemd/Makefile.am
-index f28ea41df..684b82006 100644
---- a/src/systemd/Makefile.am
-+++ b/src/systemd/Makefile.am
-@@ -23,10 +23,10 @@ dist_motd_SCRIPTS = src/systemd/update-motd
- 
- # Automake: 'Variables using ... ‘sysconf’ ... are installed by install-exec.'
- install-exec-hook::
--	mkdir -p $(DESTDIR)$(sysconfdir)/motd.d
--	ln -sTfr $(DESTDIR)/run/cockpit/motd $(DESTDIR)$(sysconfdir)/motd.d/cockpit
--	mkdir -p $(DESTDIR)$(sysconfdir)/issue.d
--	ln -sTfr $(DESTDIR)/run/cockpit/motd $(DESTDIR)$(sysconfdir)/issue.d/cockpit.issue
-+	mkdir -p $(DESTDIR)$(prefix)$(sysconfdir)/motd.d
-+	ln -sTfr $(DESTDIR)$(prefix)/run/cockpit/motd $(DESTDIR)$(prefix)$(sysconfdir)/motd.d/cockpit
-+	mkdir -p $(DESTDIR)$(prefix)$(sysconfdir)/issue.d
-+	ln -sTfr $(DESTDIR)$(prefix)/run/cockpit/motd $(DESTDIR)$(prefix)$(sysconfdir)/issue.d/cockpit.issue
- 
- tempconfdir = $(prefix)/lib/tmpfiles.d
- nodist_tempconf_DATA = src/systemd/cockpit-tempfiles.conf
-diff --git a/src/ws/Makefile-ws.am b/src/ws/Makefile-ws.am
-index ed4e4363e..77a35b0e5 100644
---- a/src/ws/Makefile-ws.am
-+++ b/src/ws/Makefile-ws.am
-@@ -169,8 +169,8 @@ install-tests::
- 	$(INSTALL_DATA) mock-pam-conv-mod.so $(DESTDIR)$(pamdir)/
- 
- install-exec-hook::
--	mkdir -p $(DESTDIR)$(sysconfdir)/cockpit/ws-certs.d $(DESTDIR)$(sysconfdir)/cockpit/machines.d
--	chmod 755 $(DESTDIR)$(sysconfdir)/cockpit/ws-certs.d $(DESTDIR)$(sysconfdir)/cockpit/machines.d
-+	mkdir -p $(DESTDIR)$(prefix)$(sysconfdir)/cockpit/ws-certs.d $(DESTDIR)$(prefix)$(sysconfdir)/cockpit/machines.d
-+	chmod 755 $(DESTDIR)$(prefix)$(sysconfdir)/cockpit/ws-certs.d $(DESTDIR)$(prefix)$(sysconfdir)/cockpit/machines.d
- 
- dist_check_DATA += \
- 	src/ws/mock-combined.crt \

pkgs/servers/monitoring/cockpit/nerf-node-modules.patch

@@ -1,12 +0,0 @@
-diff --git a/tools/node-modules b/tools/node-modules
-index 518875d..72b51e0 100755
---- a/tools/node-modules
-+++ b/tools/node-modules
-@@ -7,6 +7,7 @@ V="${V-0}" # default to friendly messages
- 
- set -eu
- cd "${0%/*}/.."
-+exit 0
- . tools/git-utils.sh
- 
- cmd_remove() {

pkgs/servers/monitoring/cockpit/update.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+set -eu -o pipefail
+
+version="$(curl --silent "https://api.github.com/repos/cockpit-project/cockpit/releases" | jq '.[0].tag_name' --raw-output)"
+
+update-source-version cockpit "$version"

pkgs/servers/onlyoffice-documentserver/default.nix

@@ -15,11 +15,11 @@ let
   # var/www/onlyoffice/documentserver/server/DocService/docservice
   onlyoffice-documentserver = stdenv.mkDerivation rec {
     pname = "onlyoffice-documentserver";
-    version = "7.3.2";
+    version = "7.3.3";
 
     src = fetchurl {
       url = "https://github.com/ONLYOFFICE/DocumentServer/releases/download/v${lib.concatStringsSep "." (lib.take 3 (lib.splitVersion version))}/onlyoffice-documentserver_amd64.deb";
-      sha256 = "sha256-BXKf5M10/ICxSDXJDmJB+T3HSsVXzSs5gu1AApUra3I=";
+      sha256 = "sha256-WeDXIDrjICGDVnpkdGLyA9plW50Kz3bHXU48DdHReHM=";
     };
 
     preferLocalBuild = true;

pkgs/servers/zoneminder/default.nix

@@ -57,13 +57,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "zoneminder";
-  version = "1.36.32";
+  version = "1.36.33";
 
   src = fetchFromGitHub {
     owner  = "ZoneMinder";
     repo   = "zoneminder";
     rev    = version;
-    sha256 = "sha256-8iRoGpkpZVOOr0wSY9iey2x4gPfKTfUNtt5TCHCCRIQ=";
+    sha256 = "sha256-KUhFZrF7BuLB2Z3LnTcHEEZVA6iosam6YsOd8KWvx7E=";
     fetchSubmodules = true;
   };
 
@@ -116,6 +116,12 @@ in stdenv.mkDerivation rec {
         --replace "'ffmpeg " "'${ffmpeg}/bin/ffmpeg "
     done
 
+    for f in scripts/ZoneMinder/lib/ZoneMinder/Event.pm \
+             scripts/ZoneMinder/lib/ZoneMinder/Storage.pm ; do
+      substituteInPlace $f \
+        --replace '/bin/rm' "${coreutils}/bin/rm"
+    done
+
     substituteInPlace web/includes/functions.php \
       --replace "'date " "'${coreutils}/bin/date " \
       --subst-var-by srcHash "`basename $out`"

pkgs/tools/admin/pulumi-packages/default.nix

@@ -7,6 +7,7 @@ in
   pulumi-aws-native = callPackage' ./pulumi-aws-native.nix { };
   pulumi-azure-native = callPackage' ./pulumi-azure-native.nix { };
   pulumi-command = callPackage' ./pulumi-command.nix { };
+  pulumi-language-go = callPackage ./pulumi-language-go.nix { };
   pulumi-language-nodejs = callPackage ./pulumi-language-nodejs.nix { };
   pulumi-language-python = callPackage ./pulumi-language-python.nix { };
   pulumi-random = callPackage' ./pulumi-random.nix { };

pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix

@@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, pulumi
+}:
+buildGoModule rec {
+  pname = "pulumi-language-go";
+  inherit (pulumi) version src;
+
+  sourceRoot = "${src.name}/sdk";
+
+  vendorHash = pulumi.sdkVendorHash;
+
+  subPackages = [
+    "go/pulumi-language-go"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+  ];
+  meta = with lib; {
+    description = "Golang language host plugin for Pulumi";
+    homepage = "https://github.com/pulumi/pulumi/tree/master/sdk/go";
+    license = licenses.asl20;
+  };
+}

pkgs/tools/games/steamtinkerlaunch/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "steamtinkerlaunch";
-  version = "12.0";
+  version = "12.12";
 
   src = fetchFromGitHub {
     owner = "sonic2kk";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cEGERh0INc/xetQhALqc+lp/HNDoy3JdTZr/nHlthYc=";
+    hash = "sha256-oigHNfg5rHxRabwUs66ye+chJzivmCIw8mg/GaJLPkg=";
   };
 
   # hardcode PROGCMD because #150841

pkgs/tools/misc/archi/default.nix

@@ -5,6 +5,8 @@
 , makeWrapper
 , jdk
 , libsecret
+, webkitgtk
+, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -31,6 +33,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     makeWrapper
+    wrapGAppsHook
   ] ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
 
   installPhase =
@@ -43,6 +46,7 @@ stdenv.mkDerivation rec {
 
         install -D -m755 Archi $out/libexec/Archi
         makeWrapper $out/libexec/Archi $out/bin/Archi \
+          --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ webkitgtk ])} \
           --prefix PATH : ${jdk}/bin
       ''
     else

pkgs/tools/misc/qmake2cmake/default.nix

@@ -3,18 +3,19 @@
 , fetchgit
 , packaging
 , portalocker
+, pyparsing
 , sympy
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "qmake2cmake";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchgit {
     url = "https://codereview.qt-project.org/qt/qmake2cmake";
     rev = "v${version}";
-    hash = "sha256-Ibi7tIaMI44POfoRfKsgTMR3u+Li5UzeHBUNylnc9dw=";
+    hash = "sha256-HzbygFmnKq3E2eEdWCFa4z9Qszfck7dJm2Z5s+il4I0=";
   };
 
   patches = [
@@ -24,6 +25,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     packaging
     portalocker
+    pyparsing
     sympy
   ];
 

pkgs/tools/misc/steampipe/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-7UisJORLGGt3Uk7/MOOTHMdotjHgD+tZ0pWzzRbM6Ag=";
+    sha256 = "sha256-CWZ+zsWaI5JULmcJRZggewqArfYpB1G7jyjRPD4WNug=";
   };
 
   vendorHash = "sha256-XrEdaNLG46BwMEF/vhAk9+A6vH4mpbtH7vWXd01Y7ME=";

pkgs/tools/misc/tagref/default.nix

@@ -1,16 +1,16 @@
 { lib, fetchFromGitHub, rustPlatform }:
 rustPlatform.buildRustPackage rec {
   pname = "tagref";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "stepchowfun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PZ5ymYXn19PnvimofODh6su9zHdVoa3T7RCWPSO1Z6w=";
+    sha256 = "sha256-tAkRTHstXoGrSDX5h7xOpHHDOdCqdYu3AXoda84ha4g=";
   };
 
-  cargoSha256 = "sha256-6siqfAWFoOomqcRvW+iku28FbyKCHiDzMVIUwWP8hJM=";
+  cargoHash = "sha256-3pD4hocvnfQziGtDvgc4QxnCEHlmsCFK32PI1zEh9z0=";
 
   meta = with lib; {
     description = "Tagref helps you refer to other locations in your codebase.";

pkgs/tools/misc/tmux-mem-cpu-load/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tmux-mem-cpu-load";
-  version = "3.6.0";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "thewtex";
     repo = "tmux-mem-cpu-load";
     rev = "v${version}";
-    sha256 = "sha256-1smhlp30y0qihm+d9RcCKY1CFbPm5gzago+OIQQT5jE=";
+    sha256 = "sha256-DqUfThAdfwXaZ/2KCw5+68l0vxRd4Ie3lwgz/A/6l5U=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/tools/networking/miniupnpd/default.nix

@@ -1,10 +1,10 @@
-{ stdenv, lib, fetchurl, iptables, libuuid, openssl, pkg-config
+{ stdenv, lib, fetchurl, iptables-legacy, libuuid, openssl, pkg-config
 , which, iproute2, gnused, coreutils, gawk, makeWrapper
 , nixosTests
 }:
 
 let
-  scriptBinEnv = lib.makeBinPath [ which iproute2 iptables gnused coreutils gawk ];
+  scriptBinEnv = lib.makeBinPath [ which iproute2 iptables-legacy gnused coreutils gawk ];
 in
 stdenv.mkDerivation rec {
   pname = "miniupnpd";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "0crv975qqppnj27jba96yysq2911y49vjd74sp9vnjb54z0d9pyi";
   };
 
-  buildInputs = [ iptables libuuid openssl ];
+  buildInputs = [ iptables-legacy libuuid openssl ];
   nativeBuildInputs= [ pkg-config makeWrapper ];
 
 
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests = {
     bittorrent-integration = nixosTests.bittorrent;
+    inherit (nixosTests) upnp;
   };
 
   meta = with lib; {

pkgs/tools/networking/ooniprobe-cli/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ooniprobe-cli";
-  version = "3.17.0";
+  version = "3.17.1";
 
   src = fetchFromGitHub {
     owner = "ooni";
     repo = "probe-cli";
     rev = "v${version}";
-    hash = "sha256-xOWGRDK9HyKU/WrLSLgmKpF82UTxxgIMOL1zCQDjtpU=";
+    hash = "sha256-2BsgSsIIQPzqTfoAunBkwrshZd22aI/AXFfz2tk3/78=";
   };
 
   vendorHash = "sha256-r8kyL9gpdDesY8Mbm4lONAhWC4We26Z9uG7QMt1JT9c=";

pkgs/tools/networking/v2raya/default.nix

@@ -10,13 +10,13 @@
 }:
 let
   pname = "v2raya";
-  version = "2.0.0";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "v2rayA";
     repo = "v2rayA";
     rev = "v${version}";
-    sha256 = "sha256-1fWcrMd+TSrlS1H0z7XwVCQzZAa8DAFtlekEZNRMAPA=";
+    sha256 = "sha256-C7N23s/GA66gQ5SVXtXcM9lXIjScR3pLYCrf0w2nHfY=";
   };
 
   web = mkYarnPackage {
@@ -45,7 +45,7 @@ buildGoModule {
   inherit pname version;
 
   src = "${src}/service";
-  vendorSha256 = "sha256-Ud4pwS0lz7zSTowg3gXNllfDyj8fu33H1L20szxPcOA=";
+  vendorSha256 = "sha256-vnhqI9G/p+SLLA4sre2wfmg1RKIYZmzeL0pSTbHb+Ck=";
 
   ldflags = [
     "-s"

pkgs/tools/package-management/dpkg/default.nix

@@ -1,20 +1,22 @@
-{ lib, stdenv, fetchurl, perl, zlib, bzip2, xz, zstd
+{ lib, stdenv, fetchgit, perl, gnutar, zlib, bzip2, xz, zstd
-, makeWrapper, coreutils, autoreconfHook, pkg-config
+, libmd, makeWrapper, coreutils, autoreconfHook, pkg-config
 }:
 
 stdenv.mkDerivation rec {
   pname = "dpkg";
-  version = "1.21.1ubuntu2.1";
+  version = "1.21.21ubuntu1";
 
-  src = fetchurl {
+  src = fetchgit {
-    url = "mirror://ubuntu/pool/main/d/dpkg/dpkg_${version}.tar.xz";
+    url = "https://git.launchpad.net/ubuntu/+source/dpkg";
-    sha256 = "sha256-YvVQbQn2MhOIOE43VO0H1QsKIYCsjNAFzKMoFeSrqZk=";
+    rev = "applied/${version}";
+    hash = "sha256-ZrJdf4oEvNeSMVHB8/TJgz5+YqLhih70ktLdnDurhUc=";
   };
 
   configureFlags = [
     "--disable-dselect"
     "--with-admindir=/var/lib/dpkg"
     "PERL_LIBDIR=$(out)/${perl.libPrefix}"
+    "TAR=${gnutar}/bin/tar"
     (lib.optionalString stdenv.isDarwin "--disable-linker-optimisations")
     (lib.optionalString stdenv.isDarwin "--disable-start-stop-daemon")
   ];
@@ -53,7 +55,7 @@ stdenv.mkDerivation rec {
        --replace '"diff"' \"${coreutils}/bin/diff\"
   '';
 
-  buildInputs = [ perl zlib bzip2 xz zstd ];
+  buildInputs = [ perl zlib bzip2 xz zstd libmd ];
   nativeBuildInputs = [ makeWrapper perl autoreconfHook pkg-config ];
 
   postInstall =

pkgs/tools/system/netdata/default.nix

@@ -107,6 +107,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     wrapProgram $out/bin/netdata-claim.sh --prefix PATH : ${lib.makeBinPath [ openssl ]}
+    wrapProgram $out/libexec/netdata/plugins.d/cgroup-network-helper.sh --prefix PATH : ${lib.makeBinPath [ bash ]}
   '';
 
   enableParallelBuild = true;

pkgs/tools/system/nsc/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "nsc";
-  version = "2.7.8";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cgp/kkHgH5JIWMgrUHHHyuKedbJ3n6L9xBglXCcMYms=";
+    hash = "sha256-8TBg5ByR4d/AvJOiADW068W40wN7ggRT8LbZFfHeqz4=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule rec {
     "-X main.builtBy=nixpkgs"
   ];
 
-  vendorHash = "sha256-l9Fl0j8Fa/hiV/2ebmIlnFtekYLwDg3eMpY7lLBreGg=";
+  vendorHash = "sha256-Yywurr+RM96qJGH/WvuLDtf6bLzw9C5hG2d0ID9w1pQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/system/skeema/default.nix

@@ -17,28 +17,38 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" ];
 
-  preCheck = ''
+  preCheck =
-    # Disable tests requiring network access to gitlab.com
+    let
-    buildFlagsArray+=("-run" "[^(Test(ParseDir(Symlinks|))|DirRelPath)]")
+      skippedTests = [
+        # Tests requiring network access to gitlab.com
+        "TestDirRelPath"
+        "TestParseDirSymlinks"
 
-    # Fix tests expecting /usr/bin/printf and /bin/echo
+        # Flaky tests
-    substituteInPlace skeema_cmd_test.go \
+        "TestShellOutTimeout"
-      --replace /usr/bin/printf "${coreutils}/bin/printf"
+      ];
+    in
+    ''
+      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
 
-    substituteInPlace internal/fs/dir_test.go \
+      # Fix tests expecting /usr/bin/printf and /bin/echo
-      --replace /bin/echo "${coreutils}/bin/echo" \
+      substituteInPlace skeema_cmd_test.go \
-      --replace /usr/bin/printf "${coreutils}/bin/printf"
+        --replace /usr/bin/printf "${coreutils}/bin/printf"
 
-    substituteInPlace internal/applier/ddlstatement_test.go \
+      substituteInPlace internal/fs/dir_test.go \
-      --replace /bin/echo "${coreutils}/bin/echo"
+        --replace /bin/echo "${coreutils}/bin/echo" \
+        --replace /usr/bin/printf "${coreutils}/bin/printf"
 
-    substituteInPlace internal/util/shellout_unix_test.go \
+      substituteInPlace internal/applier/ddlstatement_test.go \
-      --replace /bin/echo "${coreutils}/bin/echo" \
+        --replace /bin/echo "${coreutils}/bin/echo"
-      --replace /usr/bin/printf "${coreutils}/bin/printf"
 
-    substituteInPlace internal/util/shellout_unix.go \
+      substituteInPlace internal/util/shellout_unix_test.go \
-      --replace /bin/sh "${runtimeShell}"
+        --replace /bin/echo "${coreutils}/bin/echo" \
-  '';
+        --replace /usr/bin/printf "${coreutils}/bin/printf"
+
+      substituteInPlace internal/util/shellout_unix.go \
+        --replace /bin/sh "${runtimeShell}"
+    '';
 
   passthru.tests.version = testers.testVersion {
     package = skeema;

pkgs/tools/text/crowdin-cli/default.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "crowdin-cli";
-  version = "3.10.0";
+  version = "3.10.1";
 
   src = fetchurl {
     url = "https://github.com/crowdin/${pname}/releases/download/${version}/${pname}.zip";
-    sha256 = "sha256-4OEwee7izd2gxv7HMq5ziu88sj78QRtGH4bgooZXLow=";
+    sha256 = "sha256-kHi8rLtIHrAfu/r2vvhzIrscqNaDW1Q1F+kTEn4AicQ=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper unzip ];

pkgs/tools/text/d2/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-aReYFw6mlPhf11bhLII5CrMG1G9d0hhPsFVrZxmt72o=";
+    hash = "sha256-nny6scwuSIFQA+G4k3WfuH9n83kMmnwmfPJMKDCIUBo=";
   };
 
-  vendorHash = "sha256-+Z8nzna5KedWzmhBKGSpsbE8ooaC9sPk6Bh5zkrzwrQ=";
+  vendorHash = "sha256-h2OGd/Ql4BTX0tt91lQBvmm41h2kzPgQXawJnrkxn8Y=";
 
   ldflags = [
     "-s"

pkgs/top-level/all-packages.nix

@@ -2811,7 +2811,18 @@ with pkgs;
 
   audiowaveform = callPackage ../tools/audio/audiowaveform { };
 
-  authenticator = callPackage ../applications/misc/authenticator { };
+  authenticator = callPackage ../applications/misc/authenticator rec {
+    # Remove when GTK is upgraded past 4.8
+    # https://github.com/NixOS/nixpkgs/issues/216770
+    gtk4 = pkgs.gtk4.overrideAttrs (_: rec {
+      version = "4.9.4";
+      src = fetchurl {
+        url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
+        sha256 = "sha256-kaOv1YQB1OXYHjCwjuPxE6R2j/EBQDNqcqMmx3JyvjA=";
+      };
+    });
+    wrapGAppsHook4 = wrapGAppsHook.override { gtk3 = gtk4; };
+   };
 
   autoflake = with python3.pkgs; toPythonApplication autoflake;
 
@@ -20891,6 +20902,8 @@ with pkgs;
 
   kronosnet = callPackage ../development/libraries/kronosnet { };
 
+  ktextaddons = libsForQt5.callPackage ../development/libraries/ktextaddons {};
+
   l-smash = callPackage ../development/libraries/l-smash {
     stdenv = gccStdenv;
   };
@@ -24700,10 +24713,7 @@ with pkgs;
 
   directx-headers = callPackage ../development/libraries/directx-headers { };
 
-  directx-shader-compiler = callPackage ../tools/graphics/directx-shader-compiler {
+  directx-shader-compiler = callPackage ../tools/graphics/directx-shader-compiler { };
-    # https://github.com/NixOS/nixpkgs/issues/216294
-    stdenv = if stdenv.cc.isGNU && stdenv.isi686 then gcc11Stdenv else stdenv;
-  };
 
   dkimproxy = callPackage ../servers/mail/dkimproxy { };
 
@@ -38567,8 +38577,8 @@ with pkgs;
 
   physlock = callPackage ../misc/screensavers/physlock { };
 
-  pjsip = callPackage ../applications/networking/pjsip {
+  pjsip = darwin.apple_sdk_11_0.callPackage ../applications/networking/pjsip {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
+    inherit (darwin.apple_sdk_11_0.frameworks) AppKit CoreFoundation Security;
   };
 
   pounce = callPackage ../servers/pounce { };

pkgs/top-level/linux-kernels.nix

@@ -308,6 +308,8 @@ in {
 
     bbswitch = callPackage ../os-specific/linux/bbswitch {};
 
+    ch9344 = callPackage ../os-specific/linux/ch9344 { };
+
     chipsec = callPackage ../tools/security/chipsec {
       inherit kernel;
       withDriver = true;

pkgs/top-level/ocaml-packages.nix

@@ -787,6 +787,8 @@ let
       inherit (pkgs) file;
     };
 
+    lwd = callPackage ../development/ocaml-modules/lwd { };
+
     lwt = callPackage ../development/ocaml-modules/lwt { };
 
     lwt-canceler = callPackage ../development/ocaml-modules/lwt-canceler { };
@@ -984,6 +986,12 @@ let
 
     note = callPackage ../development/ocaml-modules/note { };
 
+    nottui = callPackage ../development/ocaml-modules/lwd/nottui.nix { };
+
+    nottui-lwt = callPackage ../development/ocaml-modules/lwd/nottui-lwt.nix { };
+
+    nottui-pretty = callPackage ../development/ocaml-modules/lwd/nottui-pretty.nix { };
+
     notty = callPackage ../development/ocaml-modules/notty { };
 
     npy = callPackage ../development/ocaml-modules/npy {
@@ -1296,6 +1304,8 @@ let
 
     tyxml = callPackage ../development/ocaml-modules/tyxml { };
 
+    tyxml-lwd = callPackage ../development/ocaml-modules/lwd/tyxml-lwd.nix { };
+
     ulex = callPackage ../development/ocaml-modules/ulex { };
 
     tls = callPackage ../development/ocaml-modules/tls { };