Merge staging-next into staging

2022-12-15 00:03:02 +00:00 · 2022-12-15 00:03:02 +00:00 · 9e23ec4f1c
commit 9e23ec4f1c
parent 1656ba237b 58a71457f7
89 changed files with 773 additions and 599 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -53,9 +53,9 @@ In addition to writing properly formatted commit messages, it's important to inc

 Package version upgrades usually allow for simpler commit messages, including attribute name, old and new version, as well as a reference to the relevant release notes/changelog. Every once in a while a package upgrade requires more extensive changes, and that subsequently warrants a more verbose message.

-We prefer not to use the "squash merge" feature in nixpkgs: in order to keep as much information as possible in the commit history, we expect pull requests to consist of self-contained commits as described above.
-This means that, after addressing review comments and before the PR is merged, you will sometimes need to rewrite your branch's history and then force-push it with `git push --force-with-lease`.
-Useful commands to be comfortable with are `git commit --amend`, `git commit --fixup` and `git rebase -i` (and don't forget that git lets you define aliases!).
+Pull requests should not be squash merged in order to keep complete commit messages and GPG signatures intact and must not be when the change doesn't make sense as a single commit.
+This means that, when addressing review comments in order to keep the pull request in an always mergeable status, you will sometimes need to rewrite your branch's history and then force-push it with `git push --force-with-lease`.
+Useful git commands that can help a lot with this are `git commit --patch --amend` and `git rebase --interactive @~3`. For more details consult the git man pages.

 ## Rebasing between branches (i.e. from master to staging)

--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@ -95,16 +95,6 @@
          <literal>true</literal>, or configure your firewall.
        </para>
      </listitem>
-      <listitem>
-        <para>
-          The
-          <link linkend="opt-services.avahi.openFirewall">services.avahi.openFirewall</link>
-          module option default value has been changed from
-          <literal>true</literal> to <literal>false</literal>. You will
-          need to explicitely set this option to
-          <literal>true</literal>, or configure your firewall.
-        </para>
-      </listitem>
      <listitem>
        <para>
          The
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -33,8 +33,6 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The [services.snapserver.openFirewall](#opt-services.snapserver.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitely set this option to `true`, or configure your firewall.

- The [services.avahi.openFirewall](#opt-services.avahi.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitely set this option to `true`, or configure your firewall.
-
 - The [services.tmate-ssh-server.openFirewall](#opt-services.tmate-ssh-server.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitely set this option to `true`, or configure your firewall.

 - The [services.unifi-video.openFirewall](#opt-services.unifi-video.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitely set this option to `true`, or configure your firewall.
--- a/nixos/modules/profiles/base.nix
+++ b/nixos/modules/profiles/base.nix
@ -42,6 +42,7 @@
    pkgs.smartmontools # for diagnosing hard disks
    pkgs.pciutils
    pkgs.usbutils
+    pkgs.nvme-cli

    # Tools to create / manipulate filesystems.
    pkgs.ntfsprogs # for resizing NTFS partitions
--- a/nixos/modules/services/desktops/pipewire/wireplumber.nix
+++ b/nixos/modules/services/desktops/pipewire/wireplumber.nix
@ -32,6 +32,10 @@ in
        assertion = !config.services.pipewire.media-session.enable;
        message = "WirePlumber and pipewire-media-session can't be enabled at the same time.";
      }
+      {
+        assertion = !config.hardware.bluetooth.hsphfpd.enable;
+        message = "Using Wireplumber conflicts with hsphfpd, as it provides the same functionality. `hardware.bluetooth.hsphfpd.enable` needs be set to false";
+      }
    ];

    environment.systemPackages = [ cfg.package ];
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@ -103,16 +103,17 @@ in

    openFirewall = mkOption {
      type = types.bool;
-      default = false;
+      default = true;
      description = lib.mdDoc ''
        Whether to open the firewall for UDP port 5353.
+        Disabling this setting also disables discovering of network devices.
      '';
    };

    allowPointToPoint = mkOption {
      type = types.bool;
      default = false;
-      description= lib.mdDoc ''
+      description = lib.mdDoc ''
        Whether to use POINTTOPOINT interfaces. Might make mDNS unreliable due to usually large
        latencies with such links and opens a potential security hole by allowing mDNS access from Internet
        connections.
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@ -174,6 +174,8 @@ in
        };
      };

+      package = mkPackageOption pkgs "transmission" {};
+
      downloadDirPermissions = mkOption {
        type = with types; nullOr str;
        default = null;
@ -287,7 +289,7 @@ in
          install -D -m 600 -o '${cfg.user}' -g '${cfg.group}' /dev/stdin \
           '${cfg.home}/${settingsDir}/settings.json'
        '')];
-        ExecStart="${pkgs.transmission}/bin/transmission-daemon -f -g ${cfg.home}/${settingsDir} ${escapeShellArgs cfg.extraFlags}";
+        ExecStart="${cfg.package}/bin/transmission-daemon -f -g ${cfg.home}/${settingsDir} ${escapeShellArgs cfg.extraFlags}";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        User = cfg.user;
        Group = cfg.group;
@ -385,7 +387,7 @@ in
    };

    # It's useful to have transmission in path, e.g. for remote control
-    environment.systemPackages = [ pkgs.transmission ];
+    environment.systemPackages = [ cfg.package ];

    users.users = optionalAttrs (cfg.user == "transmission") ({
      transmission = {
@ -457,7 +459,7 @@ in
    ];

    security.apparmor.policies."bin.transmission-daemon".profile = ''
-      include "${pkgs.transmission.apparmor}/bin.transmission-daemon"
+      include "${cfg.package.apparmor}/bin.transmission-daemon"
    '';
    security.apparmor.includes."local/bin.transmission-daemon" = ''
      r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},
--- a/pkgs/applications/emulators/box64/default.nix
+++ b/pkgs/applications/emulators/box64/default.nix
@ -1,21 +1,32 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
+, gitUpdater
 , cmake
 , python3
 }:

 stdenv.mkDerivation rec {
  pname = "box64";
-  version = "0.1.8";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "ptitSeb";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-6k8Enbafnj19ATtgmw8W7LxtRpM3Ousj1bpZbbtq8TM=";
+    hash = "sha256-eMp2eSWMRJQvLRQKUirBua6Kt7ZtyebfUnKIlibkNFU=";
  };

+  patches = [
+    # Fix mmx & cppThreads tests on x86_64
+    # Remove when version > 0.2.0
+    (fetchpatch {
+      url = "https://github.com/ptitSeb/box64/commit/3819aecf078fcf47b2bc73713531361406a51895.patch";
+      hash = "sha256-11hy5Ol5FSE/kNJmXAIwNLbapldhlZGKtOLIoL6pYrg=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    python3
@ -56,6 +67,10 @@ stdenv.mkDerivation rec {
    runHook postInstallCheck
  '';

+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
  meta = with lib; {
    homepage = "https://box86.org/";
    description = "Lets you run x86_64 Linux programs on non-x86_64 Linux systems";
--- a/pkgs/applications/emulators/proton-caller/default.nix
+++ b/pkgs/applications/emulators/proton-caller/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "proton-caller";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "caverym";
    repo = pname;
    rev = version;
-    sha256 = "sha256-eyHFKAGx8du4osoGDsMFzVE/TC/ZMPsx6mrWUPDCLJ4=";
+    sha256 = "sha256-fN/8woLkTFD0aGILwweHhpey3cGQw2NolvpOmdkEEGA=";
  };

-  cargoSha256 = "sha256-/4+r5rvRUqQL8EVIg/22ZytXyE4+SV4UEcXiEw4795U=";
+  cargoSha256 = "sha256-2zczu9MtsDDbfjbmLXCiPJrxNoNNBN0KAGeN+a53SRg=";

  meta = with lib; {
    description = "Run Windows programs with Proton";
--- a/pkgs/applications/misc/bottles/default.nix
+++ b/pkgs/applications/misc/bottles/default.nix
@ -28,17 +28,18 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "bottles-unwrapped";
-  version = "2022.11.14";
+  version = "2022.12.14";

  src = fetchFromGitHub {
    owner = "bottlesdevs";
    repo = "bottles";
    rev = version;
-    sha256 = "sha256-bigrJtqx9iZURYojwxlGe7xSGWS13wSaGcrTTROP9J8=";
+    sha256 = "sha256-G2FQy+mea/+2RjK/WjLeX+7TP+HU6fCUFYuprFGKEyw=";
  };

  patches = [ ./vulkan_icd.patch ];

+  # https://github.com/bottlesdevs/Bottles/wiki/Packaging
  nativeBuildInputs = [
    blueprint-compiler
    meson
@ -58,6 +59,7 @@ python3Packages.buildPythonApplication rec {
  ];

  propagatedBuildInputs = with python3Packages; [
+    pycurl
    pyyaml
    requests
    pygobject3
--- a/pkgs/applications/misc/heimer/default.nix
+++ b/pkgs/applications/misc/heimer/default.nix
@ -1,23 +1,36 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake, qttools, qtbase }:
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, qttools
+, qtbase
+}:

 mkDerivation rec {
  pname = "heimer";
-  version = "3.6.2";
+  version = "3.6.3";

  src = fetchFromGitHub {
    owner = "juzzlin";
    repo = pname;
    rev = version;
-    sha256 = "sha256-NAjl7eRmMkRrVhlza87ErllEa1QfPZ8GRI1aljY6itI=";
+    hash = "sha256-G0prFxKXHiRtV6uVp1Ckym0/rOFxrOHrEI5K9hkWjfU=";
  };

-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ qttools qtbase ];
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    qttools
+    qtbase
+  ];

  meta = with lib; {
    description = "Simple cross-platform mind map and note-taking tool written in Qt";
    homepage = "https://github.com/juzzlin/Heimer";
-    license = licenses.gpl3;
+    changelog = "https://github.com/juzzlin/Heimer/blob/${version}/CHANGELOG";
+    license = licenses.gpl3Plus;
    maintainers  = with maintainers; [ dtzWill ];
    platforms = platforms.linux;
  };
--- a/pkgs/applications/misc/todoist/default.nix
+++ b/pkgs/applications/misc/todoist/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "todoist";
-  version = "0.16.0";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "sachaos";
    repo = "todoist";
    rev = "v${version}";
-    sha256 = "sha256-cfhwbL7RaeD5LWxlfqnHfPPPkC5AA3Z034p+hlFBWtg=";
+    sha256 = "sha256-lnx02fFzf8oaJ9T7MV+Gx4EpA4h7TVJK91o9+GU/Yvs=";
  };

  vendorSha256 = "sha256-ly+OcRo8tGeNX4FnqNVaqjPx/A1FALOnScxs04lIOiU=";
--- a/pkgs/applications/misc/tut/default.nix
+++ b/pkgs/applications/misc/tut/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "tut";
-  version = "1.0.24";
+  version = "1.0.25";

  src = fetchFromGitHub {
    owner = "RasmusLindroth";
    repo = pname;
    rev = version;
-    sha256 = "sha256-UkgZOBNEeeYkcdp8beePrFmFLa7UWGbQ4dynl8QwnK8=";
+    sha256 = "sha256-wSCT8GaBMBzxtPsspc+kS4mMVayMEBBSzXZB3dQ3Nj8=";
  };

-  vendorSha256 = "sha256-af+uO3NEkMt+aZoOa8NWccgtLD0Kggr2ZZwfIxoP3EU=";
+  vendorSha256 = "sha256-dyt7JDHsmbdMccIHVaG6N1lAwcM5xKeYoZ2Giwfkgqc=";

  meta = with lib; {
    description = "A TUI for Mastodon with vim inspired keys";
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@ -1,11 +1,11 @@
 {
-  "packageVersion": "107.0.1-2",
+  "packageVersion": "108.0-1",
  "source": {
-    "rev": "107.0.1-2",
-    "sha256": "1s009nbsqihmhnaa20j9g1qyifl3kgsbpgxc8ms5ahx3j97hbpk5"
+    "rev": "108.0-1",
+    "sha256": "1gfqxlcgf7qxgisbj565ndrfhkk68py2jpwrx7k2j7zpszkb2f4m"
  },
  "firefox": {
-    "version": "107.0.1",
-    "sha512": "e57e4bfcecbcc6dbe73f23577a14a2998c8c3f3d602f85ea06f99e0974e78481b9f7bdb019cb4e9733e59f56be1407edd64a2adb7b284bb4a87b46b1e2295dea"
+    "version": "108.0",
+    "sha512": "fa800f62cca395a51b9a04373a27be48fc3860208e34ecf74d908127638d1eb8c41cf9898be6896777d408127d5c4b7104d9ee89c97da923b2dc6ea32186187e"
  }
 }
--- a/pkgs/applications/networking/cluster/acorn/default.nix
+++ b/pkgs/applications/networking/cluster/acorn/default.nix
@ -0,0 +1,33 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "acorn";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "acorn-io";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-IzjCYVQ9RhuAmgloue421F43ARviaHW7mTkLhLW/VPM=";
+  };
+
+  vendorHash = "sha256-z2ya/CgH9AcxHe73Yt9XWbJqH4OrZWt0bRDsna5hYeo=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/acorn-io/acorn/pkg/version.Tag=v${version}"
+    "-X github.com/acorn-io/acorn/pkg/config.AcornDNSEndpointDefault=https://alpha-dns.acrn.io/v1"
+  ];
+
+  # integration tests require network and kubernetes master
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://docs.acorn.io";
+    changelog = "https://github.com/acorn-io/${pname}/releases/tag/v${version}";
+    description = "A simple application deployment framework for Kubernetes";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ urandom ];
+  };
+}
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.10.2";
+  version = "3.10.3";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-ly48zSsi+dV4te68LX8NtaJ9eLC46sSakExR2a+3b5U=";
+    sha256 = "sha256-SUPa6bbops2rrzzzYM5fH0l4DT7/rIkOqc396lTesao=";
  };
  vendorSha256 = "sha256-vyHT/N5lat/vqM2jK4Q+jJOtZpS52YCYGcJqfa5e0KM=";

--- a/pkgs/applications/networking/cluster/sonobuoy/default.nix
+++ b/pkgs/applications/networking/cluster/sonobuoy/default.nix
@ -5,7 +5,7 @@ let rev = "5b97033257d0276c7b0d1b20412667a69d79261e";
 in
 buildGoModule rec {
  pname = "sonobuoy";
-  version = "0.56.12"; # Do not forget to update `rev` above
+  version = "0.56.13"; # Do not forget to update `rev` above

  ldflags =
    let t = "github.com/vmware-tanzu/sonobuoy";
@ -20,7 +20,7 @@ buildGoModule rec {
    owner = "vmware-tanzu";
    repo = "sonobuoy";
    rev = "v${version}";
-    sha256 = "sha256-i+fg5tPkpnNl1Oef1KPmhHC+5t4y9vvfRpw9DHbsf4w=";
+    sha256 = "sha256-T0G0S8bj0QO1/eC/XMwiJ0ZcJC6KYB6gmj/bq2yYgAE=";
  };

  vendorSha256 = "sha256-SRR4TmNHbMOOMv6AXv/Qpn2KUQh+ZsFlzc5DpdyPLEU=";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -268,13 +268,13 @@
    "vendorHash": "sha256-UJHDX/vx3n/RTuQ50Y6TAhpEEFk9yBoaz8yK02E8Fhw="
  },
  "consul": {
-    "hash": "sha256-DS27LGhXDYVr+c0wIZe5PjssK8l8Aq4zzh3I+G4WCU8=",
+    "hash": "sha256-UaTvFxwbLf9krUdsslFP6MXzpacnj/AKXiyUe7iSRCs=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/consul",
    "owner": "hashicorp",
    "repo": "terraform-provider-consul",
-    "rev": "v2.16.2",
+    "rev": "v2.17.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9fTmD3VFU12htHeYk64CM23g8ihT2+02DmzTXfZF2Rw="
+    "vendorHash": "sha256-v1RHxXYTvpyWzyph6qg3GW75OPYc5qYQ/yyDI8WkbNc="
  },
  "ct": {
    "hash": "sha256-poEyXP6VfKYKuTCxQxkiWBuc7/1S2J7RolrrPb6nvUI=",
@ -498,11 +498,11 @@
    "vendorHash": "sha256-/dsiIxgW4BxSpRtnD77NqtkxEEAXH1Aj5hDCRSdiDYg="
  },
  "helm": {
-    "hash": "sha256-s8ZOzTG3qux+4Yh1wj3ArjB1uJ32bdGhxY9iSL5LOK8=",
+    "hash": "sha256-MSBCn4AriAWys2FIYJIGamcaLGx0gtO5IiB/WxcN2rg=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/helm",
    "owner": "hashicorp",
    "repo": "terraform-provider-helm",
-    "rev": "v2.7.1",
+    "rev": "v2.8.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1095,11 +1095,11 @@
    "vendorHash": "sha256-2wPmLpjhG6QgG+BUCO0oIzHjBOWIOYuptgdtSIm9TZw="
  },
  "tencentcloud": {
-    "hash": "sha256-jel9zn2i/xt7Up4o8Tf5S5Z63zRbQszt9IY5xjcQhLo=",
+    "hash": "sha256-mN52iD0HdsfzPxo9hLFlKxiwIm7641cnjUYk8XyRP0s=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.79.1",
+    "rev": "v1.79.2",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.42.3";
+  version = "0.42.4";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-CK2+leFJuNQqX1t34LLTJ6eVEUFdZSb/0E3XTf3S9gQ=";
+    sha256 = "sha256-PaCI39Z2WaHZ6IYRxFNZvG9c40pWzNbwoHrJFXLOqMk=";
  };

-  vendorSha256 = "sha256-Qc0FnNxyErtieVvEj/eKPW5PpvYFwiYtv+ReJTVFAPA=";
+  vendorSha256 = "sha256-ByFn2j2m5dON0No6mt1QiYm4vMRSymS5Tezaws9B9c4=";

  doCheck = false;

--- a/pkgs/applications/networking/remote/remmina/default.nix
+++ b/pkgs/applications/networking/remote/remmina/default.nix
@ -7,12 +7,11 @@
 , openssl, gsettings-desktop-schemas, json-glib, libsodium, webkitgtk_4_1, harfbuzz
 # The themes here are soft dependencies; only icons are missing without them.
 , gnome
+, withKf5Wallet ? true, libsForQt5
 , withLibsecret ? true
 , withVte ? true
 }:

-with lib;
-
 stdenv.mkDerivation rec {
  pname = "remmina";
  version = "1.4.28";
@ -25,6 +24,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ cmake ninja pkg-config wrapGAppsHook ];
+
  buildInputs = [
    gsettings-desktop-schemas
    glib gtk3 gettext libxkbfile libX11
@ -36,13 +36,15 @@ stdenv.mkDerivation rec {
    libepoxy at-spi2-core
    openssl gnome.adwaita-icon-theme json-glib libsodium webkitgtk_4_1
    harfbuzz python3
-  ] ++ optionals withLibsecret [ libsecret ]
-    ++ optionals withVte [ vte ];
+  ] ++ lib.optionals withLibsecret [ libsecret ]
+    ++ lib.optionals withKf5Wallet [ libsForQt5.kwallet ]
+    ++ lib.optionals withVte [ vte ];

  cmakeFlags = [
    "-DWITH_VTE=${if withVte then "ON" else "OFF"}"
    "-DWITH_TELEPATHY=OFF"
    "-DWITH_AVAHI=OFF"
+    "-DWITH_KF5WALLET=${if withKf5Wallet then "ON" else "OFF"}"
    "-DWITH_LIBSECRET=${if withLibsecret then "ON" else "OFF"}"
    "-DFREERDP_LIBRARY=${freerdp}/lib/libfreerdp2.so"
    "-DFREERDP_CLIENT_LIBRARY=${freerdp}/lib/libfreerdp-client2.so"
@ -50,13 +52,15 @@ stdenv.mkDerivation rec {
    "-DWINPR_INCLUDE_DIR=${freerdp}/include/winpr2"
  ];

+  dontWrapQtApps = true;
+
  preFixup = ''
    gappsWrapperArgs+=(
      --prefix LD_LIBRARY_PATH : "${libX11.out}/lib"
    )
  '';

-  meta = {
+  meta = with lib; {
    license = licenses.gpl2Plus;
    homepage = "https://gitlab.com/Remmina/Remmina";
    description = "Remote desktop client written in GTK";
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@ -5,10 +5,12 @@ let
  _build = "484";
  version = "${_version}-${_build}";

-  swtSystem = if stdenv.hostPlatform.system == "i686-linux" then "linux"
-  else if stdenv.hostPlatform.system == "x86_64-linux" then "linux64"
-  else if stdenv.hostPlatform.system == "x86_64-darwin" then "macos64"
-  else throw "Unsupported system: ${stdenv.hostPlatform.system}";
+  swtSystem =
+    if stdenv.hostPlatform.system == "i686-linux" then "linux"
+    else if stdenv.hostPlatform.system == "x86_64-linux" then "linux64"
+    else if stdenv.hostPlatform.system == "aarch64-linux" then "linux-arm64"
+    else if stdenv.hostPlatform.system == "x86_64-darwin" then "macos64"
+    else throw "Unsupported system: ${stdenv.hostPlatform.system}";

  desktopItem = makeDesktopItem {
    name = "jameica";
@ -26,7 +28,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ ant jdk wrapGAppsHook makeWrapper ];
  buildInputs = lib.optionals stdenv.isLinux [ gtk2 glib xorg.libXtst ]
-                ++ lib.optional stdenv.isDarwin Cocoa;
+    ++ lib.optional stdenv.isDarwin Cocoa;

  src = fetchFromGitHub {
    owner = "willuhn";
@ -79,7 +81,7 @@ stdenv.mkDerivation rec {
      binaryBytecode # source bundles dependencies as jars
    ];
    license = licenses.gpl2Plus;
-    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ];
    maintainers = with maintainers; [ flokli r3dl3g ];
  };
 }
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@ -1,148 +1,44 @@
-{ fetchurl, lib, stdenv, mkDerivation, dpkg, which
-, makeWrapper
-, alsa-lib
-, desktop-file-utils
-, dbus
-, libcap
-, fontconfig
-, freetype
-, gcc
+{ lib
+, fetchurl
+, appimageTools
 , gconf
-, glib
-, icu
-, libxml2
-, libxslt
-, orc
-, nss
-, nspr
-, qtbase
-, qtsvg
-, qtdeclarative
-, qtwebchannel
-, qtquickcontrols
-, qtwebkit
-, qtwebengine
-, sqlite
-, xorg
-, zlib
-# The provided wrapper does this, but since we don't use it
-# we emulate the behavior.  The downside is that this
-# will leave entries on your system after uninstalling mendeley.
-# (they can be removed by running '$out/bin/install-mendeley-link-handler.sh -u')
-, autorunLinkHandler ? true
-# Update script
-, writeScript
-, runtimeShell
+, imagemagick
 }:

 let
-  arch32 = "i686-linux";
+  name = "mendeley";
+  version = "2.80.1";

-  arch = if stdenv.hostPlatform.system == arch32
-    then "i386"
-    else "amd64";
-
-  shortVersion = "1.19.5-stable";
-
-  version = "${shortVersion}_${arch}";
-
-  url = "http://desktop-download.mendeley.com/download/apt/pool/main/m/mendeleydesktop/mendeleydesktop_${version}.deb";
-  sha256 = if stdenv.hostPlatform.system == arch32
-    then "01x83a44qlxi937b128y8y0px0q4w37g72z652lc42kv50dhyy3f"
-    else "1cagqq0xziznaj97z30bqfhrwjv3a4h83ckhwigq35nhk1ggq1ry";
-
-  deps = [
-    qtbase
-    qtsvg
-    qtdeclarative
-    qtwebchannel
-    qtquickcontrols
-    qtwebkit
-    qtwebengine
-    alsa-lib
-    dbus
-    freetype
-    fontconfig
-    gcc.cc
-    gconf
-    glib
-    icu
-    libcap
-    libxml2
-    libxslt
-    nspr
-    nss
-    orc
-    sqlite
-    xorg.libX11
-    xorg.xcbutilkeysyms
-    xorg.libxcb
-    xorg.libXcomposite
-    xorg.libXext
-    xorg.libXrender
-    xorg.libXi
-    xorg.libXcursor
-    xorg.libXtst
-    xorg.libXrandr
-    xorg.xcbutilimage
-    zlib
-  ];
-
-in
-
-mkDerivation {
-  pname = "mendeley";
-  inherit version;
+  executableName = "${name}-reference-manager";

  src = fetchurl {
-    url = url;
-    sha256 = sha256;
+    url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-2.80.1-x86_64.AppImage";
+    sha256 = "sha256-uqmu7Yf4tXDlNGkeEZut4m339S6ZNKhAmej+epKLB/8=";
  };

-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ dpkg which ] ++ deps;
+  appimageContents = appimageTools.extractType2 {
+    inherit name src;
+  };
+in appimageTools.wrapType2 rec {
+  inherit name src;

-  propagatedUserEnvPkgs = [ gconf ];
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/${executableName}
+    install -m 444 -D ${appimageContents}/${executableName}.desktop $out/share/applications/${executableName}.desktop
+    ${imagemagick}/bin/convert ${appimageContents}/${executableName}.png -resize 512x512 ${name}_512.png
+    install -m 444 -D ${name}_512.png $out/share/icons/hicolor/512x512/apps/${executableName}.png

-  dontUnpack = true;
-
-  dontWrapQtApps = true;
-
-  installPhase = ''
-    dpkg-deb -x $src $out
-    mv $out/opt/mendeleydesktop/{bin,lib,share} $out
-
-    interpreter=$(patchelf --print-interpreter $(readlink -f $(which patchelf)))
-    patchelf --set-interpreter $interpreter \
-             --set-rpath ${lib.makeLibraryPath deps}:$out/lib \
-             $out/bin/mendeleydesktop
-
-    wrapQtApp $out/bin/mendeleydesktop \
-      --add-flags "--unix-distro-build" \
-      ${lib.optionalString autorunLinkHandler # ignore errors installing the link handler
-      ''--run "$out/bin/install-mendeley-link-handler.sh $out/bin/mendeleydesktop ||:"''}
-
-    # Remove bundled qt bits
-    rm -rf $out/lib/qt
-    rm $out/bin/qt* $out/bin/Qt*
-
-    # Patch up link handler script
-    wrapProgram $out/bin/install-mendeley-link-handler.sh \
-      --prefix PATH ':' ${lib.makeBinPath [ which gconf desktop-file-utils ] }
+    substituteInPlace $out/share/applications/${executableName}.desktop \
+      --replace 'Exec=AppRun' 'Exec=${executableName}'
  '';

-  dontStrip = true;
-  dontPatchELF = true;
-
-  updateScript = import ./update.nix { inherit writeScript runtimeShell; };
-
  meta = with lib; {
    homepage = "https://www.mendeley.com";
    description = "A reference manager and academic social network";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
-    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers  = with maintainers; [ dtzWill ];
+    platforms = [ "x86_64-linux" ];
+    maintainers  = with maintainers; [ dtzWill atila ];
  };

 }
--- a/pkgs/applications/video/losslesscut-bin/appimage.nix
+++ b/pkgs/applications/video/losslesscut-bin/appimage.nix
@ -1,44 +0,0 @@
-{ appimageTools, lib, fetchurl, version, sha256 }:
-
-let
-  pname = "losslesscut";
-  nameRepo = "lossless-cut";
-  nameCamel = "LosslessCut";
-  name = "${pname}-${version}";
-  nameSource = "${nameCamel}-linux-x86_64.AppImage";
-  nameExecutable = "losslesscut";
-  owner = "mifi";
-  src = fetchurl {
-    url = "https://github.com/${owner}/${nameRepo}/releases/download/v${version}/${nameSource}";
-    name = nameSource;
-    inherit sha256;
-  };
-  extracted = appimageTools.extractType2 {
-    inherit name src;
-  };
-in appimageTools.wrapType2 {
-  inherit name src;
-
-  profile = ''
-    export LC_ALL=C.UTF-8
-  '';
-
-  extraPkgs = ps: appimageTools.defaultFhsEnvArgs.multiPkgs ps;
-
-  extraInstallCommands = ''
-    mv $out/bin/{${name},${nameExecutable}}
-    (
-      mkdir -p $out/share
-      cd ${extracted}/usr
-      find share -mindepth 1 -type d -exec mkdir -p $out/{} \;
-      find share -mindepth 1 -type f,l -exec ln -s $PWD/{} $out/{} \;
-    )
-    ln -s ${extracted}/${nameExecutable}.png $out/share/icons/${nameExecutable}.png
-    mkdir $out/share/applications
-    cp ${extracted}/${nameExecutable}.desktop $out/share/applications
-    substituteInPlace $out/share/applications/${nameExecutable}.desktop \
-        --replace AppRun ${nameExecutable}
-  '';
-
-  meta.platforms = with lib.platforms; [ "x86_64-linux" ];
-}
--- a/pkgs/applications/video/losslesscut-bin/build-from-appimage.nix
+++ b/pkgs/applications/video/losslesscut-bin/build-from-appimage.nix
@ -0,0 +1,58 @@
+{ lib
+, appimageTools
+, fetchurl
+, makeWrapper
+, gtk3
+, gsettings-desktop-schemas
+, pname
+, version
+, hash
+, metaCommon ? { }
+}:
+
+let
+  pname = "losslesscut";
+
+  src = fetchurl {
+    url = "https://github.com/mifi/lossless-cut/releases/download/v${version}/LosslessCut-linux-x86_64.AppImage";
+    inherit hash;
+  };
+
+  extracted = appimageTools.extractType2 {
+    inherit pname version src;
+  };
+in
+(appimageTools.wrapType2 {
+  inherit pname version src;
+
+  profile = ''
+    export LC_ALL=C.UTF-8
+  '';
+
+  extraPkgs = ps: appimageTools.defaultFhsEnvArgs.multiPkgs ps;
+
+  extraInstallCommands = ''
+    mv $out/bin/{${pname}-${version},losslesscut}
+    (
+      mkdir -p $out/share
+      cd ${extracted}/usr
+      find share -mindepth 1 -type d -exec mkdir -p $out/{} \;
+      find share -mindepth 1 -type f,l -exec ln -s $PWD/{} $out/{} \;
+    )
+    ln -s ${extracted}/losslesscut.png $out/share/icons/losslesscut.png
+    mkdir $out/share/applications
+    cp ${extracted}/losslesscut.desktop $out/share/applications
+    substituteInPlace $out/share/applications/losslesscut.desktop \
+      --replace AppRun losslesscut
+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram "$out/bin/losslesscut" \
+      --add-flags "--disable-seccomp-filter-sandbox"
+  '';
+
+  meta = metaCommon // {
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "losslesscut";
+  };
+}) // {
+  inherit pname version;
+}
--- a/pkgs/applications/video/losslesscut-bin/build-from-dmg.nix
+++ b/pkgs/applications/video/losslesscut-bin/build-from-dmg.nix
@ -0,0 +1,37 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, undmg
+, pname
+, version
+, hash
+, isAarch64
+, metaCommon ? { }
+}:
+
+let
+  pname = "losslesscut";
+  src = fetchurl {
+    url = "https://github.com/mifi/lossless-cut/releases/download/v${version}/LosslessCut-mac-${if isAarch64 then "arm64" else "x64"}.dmg";
+    inherit hash;
+  };
+in
+stdenvNoCC.mkDerivation {
+  inherit pname version src;
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = "LosslessCut.app";
+
+  installPhase = ''
+    mkdir -p "$out/Applications/LosslessCut.app"
+    cp -R . "$out/Applications/LosslessCut.app"
+    mkdir -p "$out/bin"
+    ln -s "$out/Applications/LosslessCut.app/Contents/MacOS/LosslessCut" "$out/bin/losslesscut"
+  '';
+
+  meta = metaCommon // (with lib; {
+    platforms = singleton (if isAarch64 then "aarch64-darwin" else "x86_64-darwin");
+    mainProgram = "losslesscut";
+  });
+}
--- a/pkgs/applications/video/losslesscut-bin/build-from-windows.nix
+++ b/pkgs/applications/video/losslesscut-bin/build-from-windows.nix
@ -0,0 +1,37 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, p7zip
+, pname
+, version
+, hash
+, metaCommon ? { }
+}:
+
+stdenvNoCC.mkDerivation {
+  inherit pname version;
+
+  src = fetchurl {
+    url = "https://github.com/mifi/lossless-cut/releases/download/v${version}/LosslessCut-win-x64.7z";
+    inherit hash;
+  };
+
+  nativeBuildInputs = [ p7zip ];
+
+  unpackPhase = ''
+    7z x $src -oLosslessCut-win-x64
+  '';
+
+  sourceRoot = "LosslessCut-win-x64";
+
+  installPhase = ''
+    mkdir -p $out/bin $out/libexec
+    (cd .. && mv LosslessCut-win-x64 $out/libexec)
+    ln -s "$out/libexec/LosslessCut-win-x64/LosslessCut.exe" "$out/bin/LosslessCut.exe"
+  '';
+
+  meta = metaCommon // (with lib; {
+    platforms = platforms.windows;
+    mainProgram = "LosslessCut.exe";
+  });
+}
--- a/pkgs/applications/video/losslesscut-bin/default.nix
+++ b/pkgs/applications/video/losslesscut-bin/default.nix
@ -1,24 +1,54 @@
-{ callPackage, stdenvNoCC, lib }:
+{ lib
+, callPackage
+, buildPackages
+, hostPlatform
+}:
+
 let
-  version = "3.46.2";
-  appimage = callPackage ./appimage.nix { inherit version; sha256 = "sha256-p+HscYsChR90JHdYjurY4OOHgveGXbJomz1klBCsF2Q="; };
-  dmg = callPackage ./dmg.nix { inherit version; sha256 = "sha256-350MHWwyjCdvIv6W6lX6Hr6PLDiAwO/e+KW0yKi/Yoc="; };
-  windows = callPackage ./windows.nix { inherit version; sha256 = "sha256-48ifhvIWSPmmnBnW8tP7NeWPIWJYWNqGP925O50CAwQ="; };
-in (
-  if stdenvNoCC.isDarwin then dmg
-  else if stdenvNoCC.isCygwin then windows
-  else appimage
-).overrideAttrs
-(oldAttrs: {
-  meta = with lib; {
+  pname = "losslesscut";
+  version = "3.48.2";
+  metaCommon = with lib; {
    description = "The swiss army knife of lossless video/audio editing";
    homepage = "https://mifi.no/losslesscut/";
    license = licenses.gpl2Only;
    maintainers = with maintainers; [ ShamrockLee ];
-  } // oldAttrs.meta // {
-    platforms =
-      appimage.meta.platforms
-      ++ dmg.meta.platforms
-      ++ windows.meta.platforms;
  };
-})
+  x86_64-appimage = callPackage ./build-from-appimage.nix {
+    inherit pname version metaCommon;
+    hash = "sha256-5T5+eBVbyOI89YA9NMLWweHagD09RB3P03HFvaDAOZ8=";
+    inherit (buildPackages) makeWrapper;
+  };
+  x86_64-dmg = callPackage ./build-from-dmg.nix {
+    inherit pname version metaCommon;
+    hash = "sha256-PzjE0oJOuPG0S+mA7pgNU3MRgaE2jAPxWEN9J4PfqMQ=";
+    isAarch64 = false;
+  };
+  aarch64-dmg = callPackage ./build-from-dmg.nix {
+    inherit pname version metaCommon;
+    hash = "sha256-927CSczgFJcbBJm2cYXucFRidkGAtcowoLMlm2GTafc=";
+    isAarch64 = true;
+  };
+  x86_64-windows = callPackage ./build-from-windows.nix {
+    inherit pname version metaCommon;
+    hash = "sha256-+isxkGKxW7H+IjuA5G4yXuvDmX+4UlsD8sXwoHxgLM8=";
+  };
+in
+(
+  if hostPlatform.system == "aarch64-darwin" then aarch64-dmg
+  else if hostPlatform.isDarwin then x86_64-dmg
+  else if hostPlatform.isCygwin then x86_64-windows
+  else x86_64-appimage
+).overrideAttrs
+  (oldAttrs: {
+    passthru = (oldAttrs.passthru or { }) // {
+      inherit x86_64-appimage x86_64-dmg aarch64-dmg x86_64-windows;
+    };
+    meta = oldAttrs.meta // {
+      platforms = lib.unique (
+        x86_64-appimage.meta.platforms
+          ++ x86_64-dmg.meta.platforms
+          ++ aarch64-dmg.meta.platforms
+          ++ x86_64-windows.meta.platforms
+      );
+    };
+  })
--- a/pkgs/applications/video/losslesscut-bin/dmg.nix
+++ b/pkgs/applications/video/losslesscut-bin/dmg.nix
@ -1,31 +0,0 @@
-{ stdenvNoCC, lib, fetchurl, undmg, version , sha256 }:
-
-let
-  pname = "losslesscut";
-  nameRepo = "lossless-cut";
-  nameCamel = "LosslessCut";
-  nameSource = "${nameCamel}-mac-x64.dmg";
-  nameApp = nameCamel + ".app";
-  owner = "mifi";
-  src = fetchurl {
-    url = "https://github.com/${owner}/${nameRepo}/releases/download/v${version}/${nameSource}";
-    name = nameSource;
-    inherit sha256;
-  };
-in stdenvNoCC.mkDerivation {
-  inherit pname version src;
-
-  nativeBuildInputs = [ undmg ];
-
-  unpackPhase = ''
-    undmg ${src}
-  '';
-  sourceRoot = nameApp;
-
-  installPhase = ''
-    mkdir -p $out/Applications/${nameApp}
-    cp -R . $out/Applications/${nameApp}
-  '';
-
-  meta.platforms = lib.platforms.darwin;
-}
--- a/pkgs/applications/video/losslesscut-bin/windows.nix
+++ b/pkgs/applications/video/losslesscut-bin/windows.nix
@ -1,46 +0,0 @@
-{ stdenvNoCC
-, lib
-, fetchurl
-, p7zip
-, version
-, sha256
-, useMklink ? false
-, customSymlinkCommand ? null
-}:
-let
-  pname = "losslesscut";
-  nameRepo = "lossless-cut";
-  nameCamel = "LosslessCut";
-  nameSourceBase = "${nameCamel}-win-x64";
-  nameSource = "${nameSourceBase}.7z";
-  nameExecutable = "${nameCamel}.exe";
-  owner = "mifi";
-  getSymlinkCommand = if (customSymlinkCommand != null) then customSymlinkCommand
-    else if useMklink then (targetPath: linkPath: "mklink ${targetPath} ${linkPath}")
-    else (targetPath: linkPath: "ln -s ${targetPath} ${linkPath}");
-in stdenvNoCC.mkDerivation {
-  inherit pname version sha256;
-
-  src = fetchurl {
-    name = nameSource;
-    url = "https://github.com/${owner}/${nameRepo}/releases/download/v${version}/${nameSource}";
-    inherit sha256;
-  };
-
-  nativeBuildInputs = [ p7zip ];
-
-  unpackPhase = ''
-    7z x $src -o${nameSourceBase}
-  '';
-
-  sourceRoot = nameSourceBase;
-
-  installPhase = ''
-    mkdir -p $out/bin $out/libexec
-    cd ..
-    mv ${nameSourceBase} $out/libexec
-
-  '' + (getSymlinkCommand "${nameSourceBase}/${nameExecutable}" "$out/bin/${nameExecutable}");
-
-  meta.platforms = lib.platforms.windows;
-}
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@ -47,14 +47,14 @@
 , wayland-protocols
 }:

-let self = stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mutter";
  version = "43.2";

  outputs = [ "out" "dev" "man" "devdoc" ];

  src = fetchurl {
-    url = "mirror://gnome/sources/mutter/${lib.versions.major version}/${pname}-${version}.tar.xz";
+    url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
    sha256 = "/S63B63DM8wnevhoXlzzkTXhxNeYofnQXojkU9w+u4Q=";
  };

@ -65,16 +65,6 @@ let self = stdenv.mkDerivation rec {
      url = "https://gitlab.gnome.org/GNOME/mutter/-/commit/285a5a4d54ca83b136b787ce5ebf1d774f9499d5.patch";
      sha256 = "/npUE3idMSTVlFptsDpZmGWjZ/d2gqruVlJKq4eF4xU=";
    })
-
-    # Revert clutter optimization causing issues on X11
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2667
-    # Will be replaced with a proper fix in 43.2
-    # https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6054
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/mutter/-/commit/7e7a639cc5132cf3355e861235f325540fe56548.patch";
-      sha256 = "NYoKCRh5o1Q15c11a79Hk5tGKq/jOa+e6GpgBjPEepo=";
-      revert = true;
-    })
  ];

  mesonFlags = [
@ -160,12 +150,12 @@ let self = stdenv.mkDerivation rec {
  separateDebugInfo = true;

  passthru = {
-    libdir = "${self}/lib/mutter-11";
+    libdir = "${finalAttrs.finalPackage}/lib/mutter-11";

    tests = {
      libdirExists = runCommand "mutter-libdir-exists" {} ''
-        if [[ ! -d ${self.libdir} ]]; then
-          echo "passthru.libdir should contain a directory, “${self.libdir}” is not one."
+        if [[ ! -d ${finalAttrs.finalPackage.libdir} ]]; then
+          echo "passthru.libdir should contain a directory, “${finalAttrs.finalPackage.libdir}” is not one."
          exit 1
        fi
        touch $out
@ -173,8 +163,8 @@ let self = stdenv.mkDerivation rec {
    };

    updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "gnome.${pname}";
+      packageName = "mutter";
+      attrPath = "gnome.mutter";
    };
  };

@ -185,5 +175,4 @@ let self = stdenv.mkDerivation rec {
    maintainers = teams.gnome.members;
    platforms = platforms.linux;
  };
-};
-in self
+})
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@ -13,8 +13,8 @@
 , libevent
 , nixosTests
 , gtk3Support ? false
-, gtk3 ? null
-, qt5 ? null
+, gtk3
+, qt5
 , qt5Support ? false
 , withLibdnssdCompat ? false
 , python ? null
--- a/pkgs/development/libraries/cpp-jwt/default.nix
+++ b/pkgs/development/libraries/cpp-jwt/default.nix
@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, cmake, openssl, gtest, nlohmann_json }:
+
+stdenv.mkDerivation rec {
+  pname = "cpp-jwt";
+  version = "1.4";
+
+  src = fetchFromGitHub {
+    owner = "arun11299";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-5hVsFanTCT/uLLXrnb2kMvmL6qs9RXVkvxdWaT6m4mk=";
+  };
+
+  cmakeFlags = [
+    "-DCPP_JWT_USE_VENDORED_NLOHMANN_JSON=OFF"
+    "-DCPP_JWT_BUILD_EXAMPLES=OFF"
+  ];
+
+  nativeBuildInputs = [ cmake gtest ];
+
+  buildInputs = [ openssl nlohmann_json ];
+
+  doCheck = true;
+
+  meta = {
+    description = "JSON Web Token library for C++";
+    homepage = "https://github.com/arun11299/cpp-jwt";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fpletz ];
+  };
+}
--- a/pkgs/development/libraries/intel-media-driver/32bit.patch
+++ b/pkgs/development/libraries/intel-media-driver/32bit.patch
@ -1,49 +0,0 @@
-diff --git a/media_driver/linux/common/ddi/media_libva_util.cpp b/media_driver/linux/common/ddi/media_libva_util.cpp
-index 25b4cb0b5..49254c2f0 100755
--- a/media_driver/linux/common/ddi/media_libva_util.cpp
-+++ b/media_driver/linux/common/ddi/media_libva_util.cpp
-@@ -34,6 +34,7 @@
- #include <fcntl.h>
- #include <dlfcn.h>
- #include <errno.h>
-+#include "inttypes.h"
- 
- #include "media_libva_util.h"
- #include "mos_utilities.h"
-@@ -91,7 +92,7 @@ void DdiMediaUtil_MediaPrintFps()
-         int64_t diff  = (tv2.tv_sec - tv1.tv_sec)*1000000 + tv2.tv_usec - tv1.tv_usec;
-         float fps     = frameCountFps / (diff / 1000000.0);
-         DDI_NORMALMESSAGE("FPS:%6.4f, Interval:%11lu.", fps,((uint64_t)tv2.tv_sec)*1000 + (tv2.tv_usec/1000));
-        sprintf(temp,"FPS:%6.4f, Interval:%11lu\n", fps,((uint64_t)tv2.tv_sec)*1000 + (tv2.tv_usec/1000));
-+        sprintf(temp,"FPS:%6.4f, Interval:%" PRIu64"\n", fps,((uint64_t)tv2.tv_sec)*1000 + (tv2.tv_usec/1000));
- 
-         MOS_ZeroMemory(fpsFileName,LENGTH_OF_FPS_FILE_NAME);
-         sprintf(fpsFileName, FPS_FILE_NAME);
-diff --git a/media_softlet/linux/common/ddi/media_libva_util_next.cpp b/media_softlet/linux/common/ddi/media_libva_util_next.cpp
-index 66fab63de..38b1fae28 100644
--- a/media_softlet/linux/common/ddi/media_libva_util_next.cpp
-+++ b/media_softlet/linux/common/ddi/media_libva_util_next.cpp
-@@ -24,6 +24,7 @@
- //! \brief    libva util next implementaion.
- //!
- #include <sys/time.h>
-+#include "inttypes.h"
- #include "media_libva_util_next.h"
- #include "mos_utilities.h"
- #include "mos_os.h"
-@@ -2196,7 +2197,7 @@ void MediaLibvaUtilNext::MediaPrintFps()
-         int64_t diff  = (tv2.tv_sec - m_tv1.tv_sec)*1000000 + tv2.tv_usec - m_tv1.tv_usec;
-         float fps     = m_frameCountFps / (diff / 1000000.0);
-         DDI_NORMALMESSAGE("FPS:%6.4f, Interval:%11lu.", fps,((uint64_t)tv2.tv_sec)*1000 + (tv2.tv_usec/1000));
-        sprintf(temp,"FPS:%6.4f, Interval:%11lu\n", fps,((uint64_t)tv2.tv_sec)*1000 + (tv2.tv_usec/1000));
-+        sprintf(temp,"FPS:%6.4f, Interval:%" PRIu64"\n", fps,((uint64_t)tv2.tv_sec)*1000 + (tv2.tv_usec/1000));
- 
-         MOS_ZeroMemory(fpsFileName,LENGTH_OF_FPS_FILE_NAME);
-         sprintf(fpsFileName, FPS_FILE_NAME);
-@@ -2213,4 +2214,4 @@ void MediaLibvaUtilNext::MediaPrintFps()
-     pthread_mutex_unlock(&m_fpsMutex);
-     return;
- }
-#endif
-\ No newline at end of file
-+#endif
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@ -16,7 +16,7 @@

 stdenv.mkDerivation rec {
  pname = "intel-media-driver";
-  version = "22.6.3";
+  version = "22.6.4";

  outputs = [ "out" "dev" ];

@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
    owner = "intel";
    repo = "media-driver";
    rev = "intel-media-${version}";
-    sha256 = "sha256-lQg+L64DW2ZIBeJRimNkba7EL+SM4jSnX9PWIx4j2AY=";
+    sha256 = "sha256-0Il51cWqgJwtsnsltHey5Sp+7RYUpqo4GtTRzrzw09A=";
  };

  patches = [
@ -33,9 +33,6 @@ stdenv.mkDerivation rec {
      url = "https://salsa.debian.org/multimedia-team/intel-media-driver-non-free/-/raw/master/debian/patches/0002-Remove-settings-based-on-ARCH.patch";
      sha256 = "sha256-f4M0CPtAVf5l2ZwfgTaoPw7sPuAP/Uxhm5JSHEGhKT0=";
    })
-    # fix compilation on 32bit
-    # https://github.com/intel/media-driver/pull/1557
-    ./32bit.patch
  ];

  cmakeFlags = [
@ -43,6 +40,7 @@ stdenv.mkDerivation rec {
    "-DLIBVA_DRIVERS_PATH=${placeholder "out"}/lib/dri"
    # Works only on hosts with suitable CPUs.
    "-DMEDIA_RUN_TEST_SUITE=OFF"
+    "-DMEDIA_BUILD_FATAL_WARNINGS=OFF"
  ];

  NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.hostPlatform.system == "i686-linux") "-D_FILE_OFFSET_BITS=64";
--- a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
+++ b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
@ -8,13 +8,13 @@
  nv-codec-headers = nv-codec-headers-11;
 }).overrideAttrs (old: rec {
  pname = "jellyfin-ffmpeg";
-  version = "5.1.2-4";
+  version = "5.1.2-5";

  src = fetchFromGitHub {
    owner = "jellyfin";
    repo = "jellyfin-ffmpeg";
    rev = "v${version}";
-    sha256 = "sha256-yzaS50sPgyRRLnvzaOiKOEaHKL3Yuf89KsHyPebjoL8=";
+    sha256 = "sha256-2mSixlrTgAVD2ZRGoi1+UEbhba7QEVvKmigwC9dLk2g=";
  };

  configureFlags = old.configureFlags ++ [
--- a/pkgs/development/libraries/libpg_query/default.nix
+++ b/pkgs/development/libraries/libpg_query/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libpg_query";
-  version = "13-2.2.0";
+  version = "14-3.0.0";

  src = fetchFromGitHub {
    owner = "pganalyze";
    repo = "libpg_query";
    rev = version;
-    sha256 = "sha256-gEkcv/j8ySUYmM9lx1hRF/SmuQMYVHwZAIYOaCQWAFs=";
+    sha256 = "sha256-rICN8fkPcYw32N6TdpbrszGUoRzwQdfRSW6A0AC8toM=";
  };

  nativeBuildInputs = [ which ];
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@ -144,7 +144,7 @@ stdenv.mkDerivation rec {
      --replace   /bin/false ${coreutils}/bin/false
  '';

-  postConfigure = lib.optionalString (!stdenv.hostPlatform.isMusl) ''
+  postConfigure = lib.optionalString doCheck ''
    # Unpacked by meson
    chmod +x subprojects/mocklibc-1.0/bin/mocklibc
    patchShebangs subprojects/mocklibc-1.0/bin/mocklibc
--- a/pkgs/development/libraries/rapidfuzz-cpp/default.nix
+++ b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
@ -7,19 +7,15 @@

 stdenv.mkDerivation rec {
  pname = "rapidfuzz-cpp";
-  version = "1.10.1";
+  version = "1.10.4";

  src = fetchFromGitHub {
    owner = "maxbachmann";
    repo = "rapidfuzz-cpp";
    rev = "v${version}";
-    hash = "sha256-c9ESzsDcoUw5XAEZDHdG8jazjI5Oyqic1gaT0qGQsbI=";
+    hash = "sha256-I7MdeLs+J5a57ypgUJIW0/pSFPzK4nZA4ZrVRdKX7J4=";
  };

-  patches = [
-    ./dont-fetch-project-options.patch
-  ];
-
  nativeBuildInputs = [
    cmake
  ];
--- a/pkgs/development/libraries/rapidfuzz-cpp/dont-fetch-project-options.patch
+++ b/pkgs/development/libraries/rapidfuzz-cpp/dont-fetch-project-options.patch
@ -1,58 +0,0 @@
-diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index 5ba4464..ad72319 100644
--- a/test/CMakeLists.txt
-+++ b/test/CMakeLists.txt
-@@ -12,39 +12,10 @@ else()
-     FetchContent_MakeAvailable(Catch2)
- endif()
- 
-# include aminya & jason turner's C++ best practices recommended cmake project utilities
-include(FetchContent)
-FetchContent_Declare(_project_options URL https://github.com/aminya/project_options/archive/refs/tags/v0.20.0.zip)
-FetchContent_MakeAvailable(_project_options)
-include(${_project_options_SOURCE_DIR}/Index.cmake)
-
-project_options(
-        # ENABLE_CACHE
-        # ENABLE_CONAN
-        WARNINGS_AS_ERRORS
-        # ENABLE_CPPCHECK
-        # ENABLE_CLANG_TIDY
-        # ENABLE_INCLUDE_WHAT_YOU_USE
-        # ENABLE_COVERAGE
-        # ENABLE_PCH
-        # PCH_HEADERS <Eigen/Dense> <fmt/core.h> <vector> <utility> <string> <string_view>
-        # ENABLE_DOXYGEN
-        # ENABLE_IPO
-        # ENABLE_USER_LINKER
-        # ENABLE_BUILD_WITH_TIME_TRACE
-        # ENABLE_UNITY
-        # ENABLE_SANITIZER_ADDRESS
-        # ENABLE_SANITIZER_LEAK
-        # ENABLE_SANITIZER_UNDEFINED_BEHAVIOR
-        # ENABLE_SANITIZER_THREAD
-        # ENABLE_SANITIZER_MEMORY
-        # CLANG_WARNINGS "-Weverything"
-)
-
- function(rapidfuzz_add_test test)
-     add_executable(test_${test} tests-${test}.cpp)
-     target_link_libraries(test_${test} ${PROJECT_NAME})
-    target_link_libraries(test_${test} Catch2::Catch2WithMain project_warnings)
-+    target_link_libraries(test_${test} Catch2::Catch2WithMain)
-     add_test(NAME ${test} COMMAND test_${test})
- endfunction()
- 
-diff --git a/test/distance/CMakeLists.txt b/test/distance/CMakeLists.txt
-index 2a70054..7a43c88 100644
--- a/test/distance/CMakeLists.txt
-+++ b/test/distance/CMakeLists.txt
-@@ -1,7 +1,7 @@
- function(rapidfuzz_add_test test)
-     add_executable(test_${test} tests-${test}.cpp)
-     target_link_libraries(test_${test} ${PROJECT_NAME})
-    target_link_libraries(test_${test} Catch2::Catch2WithMain project_warnings)
-+    target_link_libraries(test_${test} Catch2::Catch2WithMain)
-     add_test(NAME ${test} COMMAND test_${test})
- endfunction()
- 
--- a/pkgs/development/ocaml-modules/batteries/default.nix
+++ b/pkgs/development/ocaml-modules/batteries/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, ocaml, findlib, ocamlbuild, qtest, qcheck, num, ounit
+{ stdenv, lib, fetchFromGitHub, ocaml, findlib, ocamlbuild, qtest, qcheck, num, camlp-streams
 , doCheck ? lib.versionAtLeast ocaml.version "4.08" && !stdenv.isAarch64
 }:

@ -8,18 +8,18 @@ else

 stdenv.mkDerivation rec {
  pname = "ocaml${ocaml.version}-batteries";
-  version = "3.5.1";
+  version = "3.6.0";

  src = fetchFromGitHub {
    owner = "ocaml-batteries-team";
    repo = "batteries-included";
    rev = "v${version}";
-    sha256 = "sha256-lLlpsg1v7mYFJ61rTdLV2v8/McK1R4HDTTuyka48aBw=";
+    hash = "sha256-D/0h0/70V8jmzHIUR6i2sT2Jz9/+tfR2dQgp4Bxtimc=";
  };

  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
-  checkInputs = [ qtest ounit qcheck ];
-  propagatedBuildInputs = [ num ];
+  checkInputs = [ qtest qcheck ];
+  propagatedBuildInputs = [ camlp-streams num ];

  strictDeps = !doCheck;

@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
  createFindlibDestdir = true;

  meta = {
-    homepage = "http://batteries.forge.ocamlcore.org/";
+    homepage = "https://ocaml-batteries-team.github.io/batteries-included/hdoc2/";
    description = "OCaml Batteries Included";
    longDescription = ''
      A community-driven effort to standardize on an consistent, documented,
--- a/pkgs/development/python-modules/add-trailing-comma/default.nix
+++ b/pkgs/development/python-modules/add-trailing-comma/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "add-trailing-comma";
-  version = "2.3.0";
+  version = "2.4.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "asottile";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-NEXPIkPeH6ZAm1uzqc8iRWnlLbhKmvGQGGraLu989sw=";
+    sha256 = "sha256-/dA3OwBBMjykSYaIbvhJZj9Z8/0+mfL5pW4GqgMgops=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "aioesphomeapi";
-  version = "13.0.1";
+  version = "13.0.2";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "esphome";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-33iaM5+5OV9TAk3SAZWzJfwQbeDSPQiVLBPAAOyyFm0=";
+    hash = "sha256-z1QFAKvkJuOH2utYertORca5PpW43VS3YB2mhjBsh+A=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "aioshelly";
-  version = "5.1.1";
+  version = "5.2.0";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "home-assistant-libs";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-6HUykGN0zx97K4372dU1RPncajJt2n20zp2FhrJG1sM=";
+    hash = "sha256-pa7ijfT/VbXNxwf9RITWxhUVUbimuBEjlU3xnDm3Zzk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/nltk/default.nix
+++ b/pkgs/development/python-modules/nltk/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "nltk";
-  version = "3.7";
+  version = "3.8";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-1lB9ZGDOx21wr+pCQqImp1QvhcZpF3ucf1YrfPGwVQI=";
+    hash = "sha256-dLMIJqN9eNU0JxBbvQN92IAlG+Jp/KZO5TCDikbtVfw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/numcodecs/default.nix
+++ b/pkgs/development/python-modules/numcodecs/default.nix
@ -9,7 +9,6 @@
 , msgpack
 , pytestCheckHook
 , python
-, gcc8
 }:

 buildPythonPackage rec {
@ -25,7 +24,6 @@ buildPythonPackage rec {
  nativeBuildInputs = [
    setuptools-scm
    cython
-    gcc8
  ];

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/openrazer/common.nix
+++ b/pkgs/development/python-modules/openrazer/common.nix
@ -1,13 +1,15 @@
 { lib
 , fetchFromGitHub
 }: rec {
-  version = "3.3.0";
+  version = "3.5.1";
+
  src = fetchFromGitHub {
    owner = "openrazer";
    repo = "openrazer";
    rev = "v${version}";
-    sha256 = "1lw2cpj2xzwcsn5igrqj3f6m2v5n6zp1xa9vv3j9f9r2fbb48jcl";
+    sha256 = "sha256-6YU2tl17LpDZe9pQ1a+B2SGIhqGdwME3Db6umVz7RLc=";
  };
+
  meta = with lib; {
    homepage = "https://openrazer.github.io/";
    license = licenses.gpl2Only;
--- a/pkgs/development/python-modules/openrazer/daemon.nix
+++ b/pkgs/development/python-modules/openrazer/daemon.nix
@ -16,13 +16,21 @@
 let
  common = import ./common.nix { inherit lib fetchFromGitHub; };
 in
-buildPythonPackage (common // rec {
+buildPythonPackage (common // {
  pname = "openrazer_daemon";

  disabled = !isPy3k;

  outputs = [ "out" "man" ];

+  prePatch = ''
+    cd daemon
+  '';
+
+  postPatch = ''
+    substituteInPlace openrazer_daemon/daemon.py --replace "plugdev" "openrazer"
+  '';
+
  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];

  propagatedBuildInputs = [
@ -35,18 +43,13 @@ buildPythonPackage (common // rec {
    setproctitle
  ];

-  prePatch = ''
-    cd daemon
-  '';
-
-  postPatch = ''
-    substituteInPlace openrazer_daemon/daemon.py --replace "plugdev" "openrazer"
-  '';
-
  postBuild = ''
    DESTDIR="$out" PREFIX="" make install manpages
  '';

+  # no tests run
+  doCheck = false;
+
  meta = common.meta // {
    description = "An entirely open source user-space daemon that allows you to manage your Razer peripherals on GNU/Linux";
  };
--- a/pkgs/development/python-modules/openrazer/pylib.nix
+++ b/pkgs/development/python-modules/openrazer/pylib.nix
@ -9,7 +9,7 @@
 let
  common = import ./common.nix { inherit lib fetchFromGitHub; };
 in
-buildPythonPackage (common // rec {
+buildPythonPackage (common // {
  pname = "openrazer";

  sourceRoot = "source/pylib";
@ -20,6 +20,9 @@ buildPythonPackage (common // rec {
    openrazer-daemon
  ];

+  # no tests run
+  doCheck = false;
+
  meta = common.meta // {
    description = "An entirely open source Python library that allows you to manage your Razer peripherals on GNU/Linux";
  };
--- a/pkgs/development/python-modules/param/default.nix
+++ b/pkgs/development/python-modules/param/default.nix
@ -2,17 +2,21 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "param";
-  version = "1.12.2";
+  version = "1.12.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "holoviz";
    repo = pname;
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-NrMsIDcpZc/R2j8VuXitbnIlhP3NtLxU/OkygXqYok8=";
+    hash = "sha256-XVHYx0M/BLjNNneObxygPHtid65ti7nctKsUMF21fmw=";
  };

  checkInputs = [
@ -32,6 +36,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Declarative Python programming using Parameters";
    homepage = "https://github.com/pyviz/param";
+    changelog = "https://github.com/holoviz/param/releases/tag/v${version}";
    license = licenses.bsd3;
    maintainers = with maintainers; [ costrouc ];
  };
--- a/pkgs/development/python-modules/patiencediff/default.nix
+++ b/pkgs/development/python-modules/patiencediff/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "patiencediff";
-  version = "0.2.10";
+  version = "0.2.11";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "breezy-team";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-AlJ61Sp6HSy6nJ6trVF2OD9ziSIW241peRXcda3xWnQ=";
+    hash = "sha256-JUcqODJo4F+gIa9kznWyUW65MGkSrVRlOWvjBNQip3A=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pglast";
-  version = "3.17";
+  version = "4.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-C2SWuX6Lt4R62rkNJ9qOoVK50j+TUkhoGUw+seWjTQw=";
+    hash = "sha256-GmDM+90joF3+IHjUibeNZX54z6jR8rCC+R/fcJ03dHM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/phik/default.nix
+++ b/pkgs/development/python-modules/phik/default.nix
@ -20,15 +20,15 @@

 buildPythonPackage rec {
  pname = "phik";
-  version = "0.12.2";
+  version = "0.12.3";
  disabled = !isPy3k;
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "KaveIO";
    repo = "PhiK";
-    rev = "v${version}";
-    hash = "sha256-nr3804MLIBPFw/PlJ9B8xKFFGI5LDp8m2gLtJB7YcEE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9o3EDhgmne2J1QfzjjNQc1mUcyCzoVrCnWXqjWkiZU0=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/pyotp/default.nix
+++ b/pkgs/development/python-modules/pyotp/default.nix
@ -1,18 +1,30 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27 }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, unittestCheckHook
+}:

 buildPythonPackage rec {
  pname = "pyotp";
-  version = "2.7.0";
-  disabled = isPy27;
+  version = "2.8.0";
+  disabled = pythonOlder "3.7";
+
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-zpifq6Dfd9wDK0XlHGzKQrzyCJbI09HnzXWaU9x9bLU=";
+    hash = "sha256-wvXhfZ2pLY7B995jMasIEWuRFa26vLpuII1G/EmpjFo=";
  };

+  checkInputs = [
+    unittestCheckHook
+  ];
+
  pythonImportsCheck = [ "pyotp" ];

  meta = with lib; {
+    changelog = "https://github.com/pyauth/pyotp/blob/v${version}/Changes.rst";
    description = "Python One Time Password Library";
    homepage = "https://github.com/pyauth/pyotp";
    license = licenses.mit;
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@ -114,6 +114,7 @@ buildPythonPackage rec {
    "tests/unit_tests_old/test_footer.py"
    "tests/unit_tests_old/test_internal_api.py"
    "tests/unit_tests_old/test_keras.py"
+    "tests/unit_tests_old/test_logging.py"
    "tests/unit_tests_old/test_metric_internal.py"
    "tests/unit_tests_old/test_public_api.py"
    "tests/unit_tests_old/test_report_api.py"
--- a/pkgs/development/quickemu/default.nix
+++ b/pkgs/development/quickemu/default.nix
@ -50,13 +50,13 @@ in

 stdenv.mkDerivation rec {
  pname = "quickemu";
-  version = "4.4";
+  version = "4.5";

  src = fetchFromGitHub {
    owner = "quickemu-project";
    repo = "quickemu";
    rev = version;
-    hash = "sha256-82ojq1WTcgkVh+DQup2ymmqa6d6+LVR2p5cqEHA3hSM=";
+    hash = "sha256-31f4BIIYCh2acbueUtGZShKnlhctd1FfKkFqsNiUqrI=";
  };

  postPatch = ''
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@ -49,7 +49,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "github-runner";
-  version = "2.299.1";
+  version = "2.300.0";

  inherit sdkSource;

@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
    owner = "actions";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-o6N7GDfSEWX6QaEga5hQpbpDcBh7Alcy9mK3QlODTbs=";
+    hash = "sha256-pEBudX285qMz0W8Sog0ph2CA5UclBItQ+ixaBi6dl8I=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/continuous-integration/github-runner/patches/use-get-directory-for-diag.patch
+++ b/pkgs/development/tools/continuous-integration/github-runner/patches/use-get-directory-for-diag.patch
@ -1,17 +1,17 @@
 diff --git a/src/Runner.Common/HostContext.cs b/src/Runner.Common/HostContext.cs
-index d4ea48c..15c1800 100644
+index 9e43464..a953694 100644
 --- a/src/Runner.Common/HostContext.cs
 +++ b/src/Runner.Common/HostContext.cs
-@@ -109,7 +109,7 @@ namespace GitHub.Runner.Common
+@@ -119,7 +119,7 @@ namespace GitHub.Runner.Common
                 }
 
                 // this should give us _diag folder under runner root directory
 -                string diagLogDirectory = Path.Combine(new DirectoryInfo(Path.GetDirectoryName(Assembly.GetEntryAssembly().Location)).Parent.FullName, Constants.Path.DiagDirectory);
 +                string diagLogDirectory = GetDirectory(WellKnownDirectory.Diag);
-                 _traceManager = new TraceManager(new HostTraceListener(diagLogDirectory, hostType, logPageSize, logRetentionDays), this.SecretMasker);
+                 _traceManager = new TraceManager(new HostTraceListener(diagLogDirectory, hostType, logPageSize, logRetentionDays), stdoutTraceListener, this.SecretMasker);
             }
             else
-@@ -272,7 +272,10 @@ namespace GitHub.Runner.Common
+@@ -297,7 +297,10 @@ namespace GitHub.Runner.Common
                     throw new NotSupportedException($"Unexpected well known directory: '{directory}'");
             }
 
--- a/pkgs/development/tools/gopls/default.nix
+++ b/pkgs/development/tools/gopls/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "gopls";
-  version = "0.10.1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "tools";
    rev = "gopls/v${version}";
-    sha256 = "sha256-9WDqd8Xgiov/OFAFl5yZmon4o3grbOxzZs3wnNu7pbg=";
+    sha256 = "sha256-49TDAxFx4kSwCn1YGQgMn3xLG3RHCCttMzqUfm4OPtE=";
  };

  modRoot = "gopls";
-  vendorSha256 = "sha256-EZ/XPta2vQfemywoC2kbTamJ43K4tr4I7mwVzrTbRkA=";
+  vendorSha256 = "sha256-1/stMvxsCs2OPMN7KGbZ61s2qGT5Yg7kHVHsWi6ekcY=";

  doCheck = false;

--- a/pkgs/development/tools/goresym/default.nix
+++ b/pkgs/development/tools/goresym/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "goresym";
-  version = "1.8";
+  version = "2.0";

  src = fetchFromGitHub {
    owner = "mandiant";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-GFr3ppZJsGwi3dyrlpIjYrdJ2QYp2i01SX+EKEAmDE8=";
+    sha256 = "sha256-ju0xk0oA8eBJ2kUTrv5KgzOTXf5gRJUSSs16B/6NEyU=";
  };

  subPackages = [ "." ];
--- a/pkgs/development/tools/kubernetes-controller-tools/default.nix
+++ b/pkgs/development/tools/kubernetes-controller-tools/default.nix
@ -11,8 +11,16 @@ buildGoModule rec {
    sha256 = "sha256-244o+QZ0BGVe8t8AWf1wU6VHgYyzkATpr5ZTbZezk10=";
  };

+  patches = [ ./version.patch ];
+
  vendorSha256 = "sha256-sVdSKu6TDGIDV2o+kuCvGCItbFe9MwlM2Qjiz8n2rZU=";

+  ldflags = [
+    "-s"
+    "-w"
+    "-X sigs.k8s.io/controller-tools/pkg/version.version=v${version}"
+  ];
+
  doCheck = false;

  subPackages = [
--- a/pkgs/development/tools/kubernetes-controller-tools/version.patch
+++ b/pkgs/development/tools/kubernetes-controller-tools/version.patch
@ -0,0 +1,23 @@
+diff --git a/pkg/version/version.go b/pkg/version/version.go
+index 09c8efcf..b9ec798a 100644
+--- a/pkg/version/version.go
+++ b/pkg/version/version.go
+@@ -20,14 +20,12 @@ import (
+ 	"runtime/debug"
+ )
+ 
+var version string
+
+ // Version returns the version of the main module
+ func Version() string {
+-	info, ok := debug.ReadBuildInfo()
+-	if !ok || info == nil || info.Main.Version == "" {
+-		// binary has not been built with module support or doesn't contain a version.
+-		return "(unknown)"
+-	}
+-	return info.Main.Version
+	_ = debug.ReadBuildInfo
+	return version
+ }
+ 
+ // Print prints the main module version on stdout.
--- a/pkgs/development/tools/misc/pwninit/default.nix
+++ b/pkgs/development/tools/misc/pwninit/default.nix
@ -10,20 +10,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "pwninit";
-  version = "3.2.0";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = "io12";
    repo = "pwninit";
    rev = version;
-    sha256 = "sha256-XKDYJH2SG3TkwL+FN6rXDap8la07icR0GPFiYcnOHeI=";
+    sha256 = "sha256-Tskbwavr+MFa8wmwaFGe7o4/6ZpZqczzwOnqFR66mmM=";
  };

  buildInputs = [ openssl xz ] ++ lib.optionals stdenv.isDarwin [ Security ];
  nativeBuildInputs = [ pkg-config ];
  doCheck = false; # there are no tests to run

-  cargoSha256 = "sha256-2HCHiU309hbdwohUKVT3TEfGvOfxQWtEGj7FIS8OS7s=";
+  cargoSha256 = "sha256-LPypmFeF9NZOX1ogpIqc++Pun7pInKzpxYiGUvSUcso=";

  meta = {
    description = "Automate starting binary exploit challenges";
--- a/pkgs/development/tools/pscale/default.nix
+++ b/pkgs/development/tools/pscale/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "pscale";
-  version = "0.124.0";
+  version = "0.125.0";

  src = fetchFromGitHub {
    owner = "planetscale";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-bNMUUohiMa/fSP1HjrB0UR3kWh+HNqqqpLcraw6UNjs=";
+    sha256 = "sha256-B765hV5hs5FfpzkRwQY9szu6l8ImDTUoEl77IcgRngA=";
  };

-  vendorSha256 = "sha256-cd4oAS81zUMImCkFsTIcgYJDB2pvMWYRnTPFkznSr+I=";
+  vendorSha256 = "sha256-YOytSBJDktWIwN1vhD1imIZVTg6t+Lmfg4cFtE3lys4=";

  ldflags = [
    "-s" "-w"
--- a/pkgs/development/tools/regclient/default.nix
+++ b/pkgs/development/tools/regclient/default.nix
@ -33,7 +33,6 @@ buildGoModule rec {
    );

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "Docker and OCI Registry Client in Go and tooling using those libraries";
    homepage = "https://github.com/regclient/regclient";
    license = licenses.asl20;
--- a/pkgs/development/tools/rgp/default.nix
+++ b/pkgs/development/tools/rgp/default.nix
@ -19,15 +19,15 @@
 }:

 let
-  buildNum = "2022-08-01-115";
+  buildNum = "2022-12-12-1037";
 in
 stdenv.mkDerivation rec {
  pname = "rgp";
-  version = "1.13.1";
+  version = "1.14";

  src = fetchurl {
    url = "https://gpuopen.com/download/radeon-developer-tool-suite/RadeonDeveloperToolSuite-${buildNum}.tgz";
-    hash = "sha256-e88vk+ZtDPB/1HrDKXbzkDaMESNE+qIW7ERwrqe+ZN8=";
+    hash = "sha256-T13SOy+77lLxmlcczXEFZAnyx9Lm52G/WiCcC1Py4HA=";
  };

  nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@ -12,14 +12,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "rust-analyzer-unwrapped";
-  version = "2022-12-05";
-  cargoSha256 = "sha256-lD52qI6LX5ORBWknCC4gAWQG8FPlNhOj6xQo1eXpO30=";
+  version = "2022-12-12";
+  cargoSha256 = "sha256-YTakd4qRwXUoxzFWXCj8l9nA3wjJtfVmKbhX9XlaEbE=";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "rust-analyzer";
    rev = version;
-    sha256 = "sha256-2Syd2jVpY0UIfsYlmzvWICZTDVRG4UchcbRlNhuJSpM=";
+    sha256 = "sha256-QLKX/JhK+jRE61teK+Cr4f2KuAzgYuawStxOgJymqRg=";
  };

  auditable = true; # TODO: remove when this is the default
--- a/pkgs/development/web/shopify-themekit/default.nix
+++ b/pkgs/development/web/shopify-themekit/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "shopify-themekit";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "Shopify";
    repo = "themekit";
    rev = "v${version}";
-    sha256 = "sha256-7uUKyaLzeiioW0TsEu82lJU0DoM1suwVcmacY1X0SEM=";
+    sha256 = "sha256-HtgA+R6THZ49WYtGlHS1EzekjuuGgPe657Y6ewraD4o=";
  };

  vendorSha256 = "sha256-8QpkYj0fQb4plzvk6yCrZho8rq9VBiLft/EO3cczciI=";
--- a/pkgs/games/prismlauncher/default.nix
+++ b/pkgs/games/prismlauncher/default.nix
@ -34,13 +34,13 @@ in

 stdenv.mkDerivation rec {
  pname = "prismlauncher";
-  version = "5.2";
+  version = "6.0";

  src = fetchFromGitHub {
    owner = "PrismLauncher";
    repo = "PrismLauncher";
    rev = version;
-    sha256 = "sha256-sKAhcbDoRbWf/DuwcBmDjb+VSMM0K2C33gu1K9AlPoQ=";
+    sha256 = "sha256-Kwj1GvlT12jRcf84WMSnD4xkgGL3X9AVqdGDCxMmS4E=";
  };

  nativeBuildInputs = [ extra-cmake-modules cmake file jdk wrapQtAppsHook ];
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@ -257,6 +257,32 @@ in rec {
    '';
  };

+  fuzzback = mkTmuxPlugin {
+    pluginName = "fuzzback";
+    version = "unstable-2022-11-21";
+    src = fetchFromGitHub {
+      owner = "roosta";
+      repo = "tmux-fuzzback";
+      rev = "bfd9cf0ef1c35488f0080f0c5ca4fddfdd7e18ec";
+      sha256 = "w788xDBkfiLdUVv1oJi0YikFPqVk6LiN6PDfHu8on5E=";
+    };
+    nativeBuildInputs = [ pkgs.makeWrapper ];
+    postInstall = ''
+      for f in fuzzback.sh preview.sh supported.sh; do
+        chmod +x $target/scripts/$f
+        wrapProgram $target/scripts/$f \
+          --prefix PATH : ${with pkgs; lib.makeBinPath [ coreutils fzf gawk gnused ]}
+      done
+    '';
+    meta = {
+      homepage = "https://github.com/roosta/tmux-fuzzback";
+      description = "Fuzzy search for terminal scrollback";
+      license = lib.licenses.mit;
+      platforms = lib.platforms.unix;
+      maintainers = with lib.maintainers; [ deejayem ];
+    };
+  };
+
  fzf-tmux-url = mkTmuxPlugin {
    pluginName = "fzf-tmux-url";
    rtpFilePath = "fzf-url.tmux";
--- a/pkgs/os-specific/linux/below/default.nix
+++ b/pkgs/os-specific/linux/below/default.nix
@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, clang
+, pkgconfig
+, elfutils
+, rustfmt
+, zlib
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "below";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "facebookincubator";
+    repo = "below";
+    rev = "v${version}";
+    sha256 = "sha256-d5a/M2XEw2E2iydopzedqZ/XfQU7KQyTC5NrPTeeNLg=";
+  };
+
+  cargoSha256 = "sha256-EoRCmEe9SAySZCm+QhaR4ngik4Arnm4SZjgDM5fSRmk=";
+
+  # bpf code compilation
+  hardeningDisable = [ "stackprotector" ];
+
+  nativeBuildInputs = [ clang pkgconfig rustfmt ];
+  buildInputs = [ elfutils zlib ];
+
+  # needs /sys/fs/cgroup
+  doCheck = false;
+
+  meta = with lib; {
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ globin ];
+    description = "A time traveling resource monitor for modern Linux systems";
+    license = licenses.asl20;
+    homepage = "https://github.com/facebookincubator/below";
+  };
+}
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2022-05-07";
+  version = "${kernel.version}-unstable-2022-12-07";

  src = fetchFromGitHub {
    owner = "morrownr";
    repo = "8821cu-20210118";
-    rev = "14aac4269afe5d21d1cc0032bdc1426128f83734";
-    hash = "sha256-TLakNRhHvYAbK0slKsFgSjqJdxVStzZhi1EEajmr7hg=";
+    rev = "7b8c45a270454f05e2dbf3beeb4afcf817db65da";
+    hash = "sha256-Dg+At0iHvi4pl8umhQyml1bODhkeK8YWYpEckqqzNcQ=";
  };

  hardeningDisable = [ "pic" ];
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "consul";
-  version = "1.14.2";
+  version = "1.14.3";
  rev = "v${version}";

  # Note: Currently only release tags are supported, because they have the Consul UI
@ -17,7 +17,7 @@ buildGoModule rec {
    owner = "hashicorp";
    repo = pname;
    inherit rev;
-    sha256 = "sha256-fSEQZ+F3b8l1F/80A4hDPHE7kZMPARQXt/PJg/m4Srw=";
+    sha256 = "sha256-zTsFLBd+7G+8HT8EGLSQaMhFfh/7s1tfu2gZtIMbkDs=";
  };

  passthru.tests.consul = nixosTests.consul;
@ -26,7 +26,7 @@ buildGoModule rec {
  # has a split module structure in one repo
  subPackages = ["." "connect/certgen"];

-  vendorSha256 = "sha256-4tidE6LKYhi8ilM08Rn3F5snhxebdgOOeSrIIkXZ384=";
+  vendorSha256 = "sha256-tekrveDmUq6qYafRMm7knxp9+FevaDbu4DZusO6KDtA=";

  doCheck = false;

--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2022.12.5";
+  version = "2022.12.6";
  components = {
    "3_day_blinds" = ps: with ps; [
    ];
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -188,7 +188,7 @@ let
  extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.12.5";
+  hassVersion = "2022.12.6";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@ -206,7 +206,7 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = version;
-    hash = "sha256-TWePQ++C0ISl61Qq+XPnWuZWbwrCnOuviAuDT1D5KuI=";
+    hash = "sha256-9dukY04sh35kj5vUbNmqnN+MPGqJT/YUuHC64pHzWjw=";
  };

  # leave this in, so users don't have to constantly update their downstream patch handling
--- a/pkgs/servers/imaginary/default.nix
+++ b/pkgs/servers/imaginary/default.nix
@ -0,0 +1,33 @@
+{ lib, buildGoModule, fetchFromGitHub, pkg-config, vips }:
+
+buildGoModule rec {
+  pname = "imaginary";
+  version = "1.2.4";
+
+  src = fetchFromGitHub {
+    owner = "h2non";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-oEkFoZMaNNJPMisqpIneeLK/sA23gaTWJ4nqtDHkrwA=";
+  };
+
+  vendorHash = "sha256-BluY6Fz4yAKJ/A9aFuPPsgQN9N/5yd8g8rDfIZeYz5U=";
+
+  buildInputs = [ vips ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=${version}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://fly.io/docs/app-guides/run-a-global-image-service";
+    changelog = "https://github.com/h2non/${pname}/releases/tag/v${version}";
+    description = "Fast, simple, scalable, Docker-ready HTTP microservice for high-level image processing";
+    license = licenses.mit;
+    maintainers = with maintainers; [ urandom ];
+  };
+}
--- a/pkgs/servers/ma1sd/default.nix
+++ b/pkgs/servers/ma1sd/default.nix
@ -1,25 +1,41 @@
-{ lib, stdenv, fetchFromGitHub, jre, git, gradle_6, perl, makeWrapper }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, jre
+, git
+, gradle
+, perl
+, makeWrapper
+}:

 let
  pname = "ma1sd";
-  version = "2.4.0";
-  rev = version;
+  version = "2.5.0";

  src = fetchFromGitHub {
-    inherit rev;
    owner = "ma1uta";
    repo = "ma1sd";
-    hash = "sha256-8UnhrGa8KKmMAAkzUXztMkxgYOX8MU1ioXuEStGi4Vc=";
+    rev = version;
+    hash = "sha256-K3kaujAhWsRQuTMW3SZOnE7Rmu8+tDXaxpLrb45OI4A=";
  };

+  patches = [
+    # https://github.com/ma1uta/ma1sd/pull/122
+    (fetchpatch {
+      name = "java-16-compatibility.patch";
+      url = "https://github.com/ma1uta/ma1sd/commit/be2e2e97ce21741ca6a2e29a06f5748f45dd414e.patch";
+      hash = "sha256-dvCeK/0InNJtUG9CWrsg7BE0FGWtXuHo3TU0iFFUmIk=";
+    })
+  ];

  deps = stdenv.mkDerivation {
    pname = "${pname}-deps";
-    inherit src version;
-    nativeBuildInputs = [ gradle_6 perl git ];
+    inherit src version patches;
+    nativeBuildInputs = [ gradle perl git ];

    buildPhase = ''
-      export MA1SD_BUILD_VERSION=${rev}
+      export MA1SD_BUILD_VERSION=${version}
      export GRADLE_USER_HOME=$(mktemp -d);
      gradle --no-daemon build -x test
    '';
@ -35,21 +51,26 @@ let

    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
-    outputHash = "0x2wmmhjgnb6p72d3kvnv2vg52l0c4151rs4jrazs9rvxjfc88dr";
+    outputHash = "sha256-Px8FLnREBC6pADcEPn/GfhrtGnmZqjXIX7l1xPjiCvQ=";
  };

 in
 stdenv.mkDerivation {
-  inherit pname src version;
-  nativeBuildInputs = [ gradle_6 perl makeWrapper ];
+  inherit pname src version patches;
+  nativeBuildInputs = [ gradle perl makeWrapper ];
  buildInputs = [ jre ];

+  postPatch = ''
+    substituteInPlace build.gradle \
+      --replace 'gradlePluginPortal()' "" \
+      --replace 'mavenCentral()' "mavenLocal(); maven { url '${deps}' }"
+  '';
+
  buildPhase = ''
    runHook preBuild
-    export MA1SD_BUILD_VERSION=${rev}
+    export MA1SD_BUILD_VERSION=${version}
    export GRADLE_USER_HOME=$(mktemp -d)

-    sed -ie "s#jcenter()#mavenLocal(); maven { url '${deps}' }#g" build.gradle
    gradle --offline --no-daemon build -x test
    runHook postBuild
  '';
@ -64,6 +85,7 @@ stdenv.mkDerivation {
  meta = with lib; {
    description = "a federated matrix identity server; fork of mxisd";
    homepage = "https://github.com/ma1uta/ma1sd";
+    changelog = "https://github.com/ma1uta/ma1sd/releases/tag/${version}";
    sourceProvenance = with sourceTypes; [
      fromSource
      binaryBytecode  # deps
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "telegraf";
-  version = "1.24.4";
+  version = "1.25.0";

  excludedPackages = "test";

@ -12,10 +12,10 @@ buildGoModule rec {
    owner = "influxdata";
    repo = "telegraf";
    rev = "v${version}";
-    sha256 = "sha256-GlbkCT85gbQehN2SgWY0WNSQ1FbpgZKBpqm6ImlWASk=";
+    sha256 = "sha256-p+2nsJT3WHYmJ1toIwFi/a/I0//OaUoJIHmQcFHHJ/A=";
  };

-  vendorSha256 = "sha256-sBCUs9m04bdkeAIRCJ2Esw68JJIsyVNcoZ3W1WrNKJ4=";
+  vendorSha256 = "sha256-xNio3bMFopMgDwdQdtFmkp3F0iWYHVqu9T42S5KNMU8=";
  proxyVendor = true;

  ldflags = [
--- a/pkgs/servers/web-apps/healthchecks/default.nix
+++ b/pkgs/servers/web-apps/healthchecks/default.nix
@ -13,14 +13,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
  pname = "healthchecks";
-  version = "2.4.1";
+  version = "2.5";
  format = "other";

  src = fetchFromGitHub {
    owner = "healthchecks";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-K2zA0ZkAPMgm+IofNiCf+mVTF/RIoorTupWLOowT29g=";
+    sha256 = "sha256-luwFY1iBtFL+Ye7nP68eIgqlpvMUKnxwdNxkBI7pX/c=";
  };

  propagatedBuildInputs = with py.pkgs; [
--- a/pkgs/shells/dash/default.nix
+++ b/pkgs/shells/dash/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , buildPackages
 , autoreconfHook
+, pkg-config
 , fetchurl
 , fetchpatch
 , libedit
@ -37,12 +38,16 @@ stdenv.mkDerivation rec {

  strictDeps = true;
  # configure.ac patched; remove on next release
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ]
+    ++ lib.optionals stdenv.hostPlatform.isStatic [ pkg-config ];

  depsBuildBuild = [ buildPackages.stdenv.cc ];
  buildInputs = [ libedit ];

  configureFlags = [ "--with-libedit" ];
+  preConfigure = lib.optional stdenv.hostPlatform.isStatic ''
+    export LIBS="$(pkg-config --libs --static libedit)"
+  '';

  enableParallelBuilding = true;

--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@ -1,23 +1,23 @@
-{ buildGoModule
+{ lib
+, buildGoModule
 , fetchFromGitHub
 , installShellFiles
-, lib
 , qovery-cli
 , testers
 }:

 buildGoModule rec {
  pname = "qovery-cli";
-  version = "0.46.4";
+  version = "0.46.7";

  src = fetchFromGitHub {
    owner = "Qovery";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-ROUMFpAgUmcKt7QG+Lfd3OipJQK8DLezvCxvev1yNlo=";
+    hash = "sha256-cMoT0vbWTcuMI7MMDGQ8+G7FqTuaJl4+rp22Uy4e83g=";
  };

-  vendorSha256 = "sha256-4TY7/prMbvw5zVPJRoMLg7Omrxvh1HPGsdz1wqPn4uU=";
+  vendorHash = "sha256-4TY7/prMbvw5zVPJRoMLg7Omrxvh1HPGsdz1wqPn4uU=";

  nativeBuildInputs = [ installShellFiles ];

@ -36,6 +36,7 @@ buildGoModule rec {
  meta = with lib; {
    description = "Qovery Command Line Interface";
    homepage = "https://github.com/Qovery/qovery-cli";
+    changelog = "https://github.com/Qovery/qovery-cli/releases/tag/v${version}";
    license = with licenses; [ asl20 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/tools/backup/bupstash/default.nix
+++ b/pkgs/tools/backup/bupstash/default.nix
@ -1,16 +1,16 @@
 { stdenv, lib, fetchFromGitHub, installShellFiles, rustPlatform, ronn, pkg-config, libsodium }:
 rustPlatform.buildRustPackage rec {
  pname = "bupstash";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "andrewchambers";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-9yWQQ8uzDkN3Pi2OiEn+oEazc3nH53dF2GswBCu8d3c=";
+    sha256 = "sha256-Ekjxna3u+71s1q7jjXp7PxYUQIfbp2E+jAqKGuszU6g=";
  };

-  cargoSha256 = "sha256-JAclSUFuQk768cgDEvG1rxux2xBGHl1d/NAoxw161YU=";
+  cargoSha256 = "sha256-hkGmE7WseEjMxmmPyR8C4osbdbpIt8qG9sfVGuC4d84=";

  nativeBuildInputs = [ ronn pkg-config installShellFiles ];
  buildInputs = [ libsodium ];
--- a/pkgs/tools/filesystems/mergerfs/default.nix
+++ b/pkgs/tools/filesystems/mergerfs/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "mergerfs";
-  version = "2.33.5";
+  version = "2.34.1";

  src = fetchFromGitHub {
    owner = "trapexit";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Hj124GzJV5WNGJHvgelem5B/Ru+F/ILzsX2X8gs7Jww=";
+    sha256 = "sha256-67LkMbs3JGpkwMHGWJf03yy8aGfSVb64TF4DPLlLMgY=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/filesystems/tar2ext4/default.nix
+++ b/pkgs/tools/filesystems/tar2ext4/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "tar2ext4";
-  version = "0.9.5";
+  version = "0.9.6";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "hcsshim";
    rev = "v${version}";
-    sha256 = "sha256-p64BQlxwXU9+6MbT2Aw9EcW82t2i3E6mKfOWoEEFf9g=";
+    sha256 = "sha256-sBcagAFjmnLfPFYwOhWIt6bnEXyOKYobvMI2rQf4S5A=";
  };

  sourceRoot = "source/cmd/tar2ext4";
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "minio-client";
-  version = "2022-12-02T23-48-47Z";
+  version = "2022-12-13T00-23-28Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "mc";
    rev = "RELEASE.${version}";
-    sha256 = "sha256-6OPc56QN5va0S1iFbwA+qlF+AXUFxb//MYb55eRMsF0=";
+    sha256 = "sha256-wRkpc1S9booT9jVrDdmuj1eQInXafax2ZGvHgcuoiTA=";
  };

-  vendorSha256 = "sha256-janS8S3ezloT0M92dGe3x4WZb1cN8hmreVin6sjtPU4=";
+  vendorSha256 = "sha256-D3d+aSEe1d1Tw0//L8MGuZHt5GjURTn3Vni9l4BafEI=";

  subPackages = [ "." ];

--- a/pkgs/tools/networking/pritunl-client/default.nix
+++ b/pkgs/tools/networking/pritunl-client/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "pritunl-client";
-  version = "1.3.3370.14";
+  version = "1.3.3373.6";

  src = fetchFromGitHub {
    owner = "pritunl";
    repo = "pritunl-client-electron";
    rev = version;
-    sha256 = "sha256-/HXnD2P2fsNxWXMe5U7SUgxzOaHokktTogYIdiH8Kk8=";
+    sha256 = "sha256-Ttg6SNDcNIQlbNnKQY32hmsrgLhzHkeQfwlmCHe0bI0=";
  };

  modRoot = "cli";
--- a/pkgs/tools/security/sbctl/default.nix
+++ b/pkgs/tools/security/sbctl/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "sbctl";
-  version = "0.9";
+  version = "0.10";

  src = fetchFromGitHub {
    owner = "Foxboron";
    repo = pname;
    rev = version;
-    hash = "sha256-mntb3EMB+QTnFU476Dq6T6rAAv0JeYbvWJ/pbL3a4RE=";
+    hash = "sha256-rjqfWOJRG+9GbNNeRafkNx7Khm/vtGeMlfKkz0qFXJY=";
  };

-  vendorSha256 = "sha256-k6AIYigjxbitH0hH+vwRt2urhNYTToIF0eSsIWbzslI=";
+  vendorSha256 = "sha256-3wT/pWKIdEpkLUpOmpKhLA9AyO36LqZBAwamzOUGhFY=";

  ldflags = [ "-s" "-w" "-X github.com/foxboron/sbctl.DatabasePath=${databasePath}" ];

--- a/pkgs/tools/video/wtwitch/default.nix
+++ b/pkgs/tools/video/wtwitch/default.nix
@ -0,0 +1,73 @@
+{ bash
+, coreutils-prefixed
+, curl
+, fetchFromGitHub
+, gnused
+, gnugrep
+, installShellFiles
+, jq
+, lib
+, makeWrapper
+, mplayer
+, mpv
+, ncurses
+, procps
+, scdoc
+, stdenv
+, streamlink
+, sudo
+, vlc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "wtwitch";
+  version = "2.6.0";
+
+  src = fetchFromGitHub {
+    owner = "krathalan";
+    repo = pname;
+    rev = version;
+    hash = "sha256-KkuXZOquihY3IRVp4FM+AdN3kYi0MqmrXFuNmydTpio=";
+  };
+
+  # hardcode SCRIPT_NAME because #150841
+  postPatch = ''
+    substituteInPlace src/wtwitch --replace 'readonly SCRIPT_NAME="''${0##*/}"' 'readonly SCRIPT_NAME="wtwitch"'
+  '';
+
+  buildPhase = ''
+    scdoc < src/wtwitch.1.scd > wtwitch.1
+  '';
+
+  nativeBuildInputs = [ scdoc installShellFiles makeWrapper ];
+
+  installPhase = ''
+    installManPage wtwitch.1
+    installShellCompletion --cmd wtwitch \
+      --bash src/wtwitch-completion.bash \
+      --zsh src/_wtwitch
+    install -Dm755 src/wtwitch $out/bin/wtwitch
+    wrapProgram $out/bin/wtwitch \
+      --set-default LANG en_US.UTF-8 \
+      --prefix PATH : ${lib.makeBinPath (lib.optionals stdenv.isLinux [ vlc ] ++ [
+        bash
+        coreutils-prefixed
+        curl
+        gnused
+        gnugrep
+        jq
+        mplayer
+        mpv
+        procps
+        streamlink
+      ])}
+  '';
+
+  meta = with lib; {
+    description = "Terminal user interface for Twitch";
+    homepage = "https://github.com/krathalan/wtwitch";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ urandom ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "govc";
-  version = "0.29.0";
+  version = "0.30.0";

  subPackages = [ "govc" ];

@ -10,7 +10,7 @@ buildGoModule rec {
    rev = "v${version}";
    owner = "vmware";
    repo = "govmomi";
-    sha256 = "sha256-SVQyl1uI3wGBBDhz2VLm0uJj+aREqNot7K+iGRHGmhI=";
+    sha256 = "sha256-BMkty2H42fAILw/zRiAWE5cOX9WCZIs0503QODLHqxo=";
  };

  vendorSha256 = "sha256-jbGqQITAhyBLoDa3cKU5gK+4WGgoGSCyFtzeoXx8e7k=";
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1502,6 +1502,8 @@ with pkgs;
    wine = wineWowPackages.staging;
  };

+  wtwitch = callPackage ../tools/video/wtwitch {};
+
  wwcd = callPackage ../tools/misc/wwcd { };

  writedisk = callPackage ../tools/misc/writedisk { };
@ -18772,6 +18774,8 @@ with pkgs;
    boost = boost169; # fatal error: 'boost/asio/stream_socket_service.hpp' file not found
  };

+  cpp-jwt = callPackage ../development/libraries/cpp-jwt { };
+
  ubus = callPackage ../development/libraries/ubus { };

  uci = callPackage ../development/libraries/uci { };
@ -23933,6 +23937,8 @@ with pkgs;

  inspircdMinimal = inspircd.override { extraModules = []; };

+  imaginary = callPackage ../servers/imaginary {};
+
  imgproxy = callPackage ../servers/imgproxy { };

  irccat = callPackage ../servers/irc/irccat { };
@ -24999,6 +25005,8 @@ with pkgs;

  b43FirmwareCutter = callPackage ../os-specific/linux/firmware/b43-firmware-cutter { };

+  below = callPackage ../os-specific/linux/below { };
+
  bt-fw-converter = callPackage ../os-specific/linux/firmware/bt-fw-converter { };

  brillo = callPackage ../os-specific/linux/brillo { };
@ -27416,6 +27424,8 @@ with pkgs;
      requests requests-toolbelt setuptools sqlalchemy fusepy;
  };

+  acorn = callPackage ../applications/networking/cluster/acorn {};
+
  adobe-reader = pkgsi686Linux.callPackage ../applications/misc/adobe-reader { };

  adl = callPackage ../applications/video/adl { };