Merge master into staging-next

2023-06-12 18:01:15 +00:00 · 2023-06-12 18:01:15 +00:00 · a69b4c6b89
commit a69b4c6b89
parent d0fbe5588d 0eeebd64de
69 changed files with 10513 additions and 10375 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -995,7 +995,7 @@ and in this case the `python3` interpreter is automatically used.
 ### Interpreters {#interpreters}

 Versions 2.7, 3.8, 3.9, 3.10 and 3.11 of the CPython interpreter are available
-as respectively `python27`, python38`, `python39`, `python310` and `python311`.
+as respectively `python27`, `python38`, `python39`, `python310` and `python311`.
 The aliases `python2` and `python3` correspond to respectively `python27` and
 `python310`. The attribute `python` maps to `python2`. The PyPy interpreters
 compatible with Python 2.7 and 3 are available as `pypy27` and `pypy3`, with
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -9220,6 +9220,12 @@
      fingerprint = "74F5 E5CC 19D3 B5CB 608F  6124 68FF 81E6 A785 0F49";
    }];
  };
+  liyangau = {
+    email = "d@aufomm.com";
+    github = "liyangau";
+    githubId = 71299093;
+    name = "Li Yang";
+  };
  lizelive = {
    email = "nixpkgs@lize.live";
    github = "lizelive";
@ -17853,6 +17859,12 @@
    githubId = 2189609;
    name = "Zhaofeng Li";
  };
+  zi3m5f = {
+    name = "zi3m5f";
+    email = "k7n3o3a6f@mozmail.com";
+    github = "zi3m5f";
+    githubId = 113244000;
+  };
  ziguana = {
    name = "Zig Uana";
    email = "git@ziguana.dev";
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@ -648,7 +648,7 @@ in
        '';
        description = lib.mdDoc ''
          Configuration for Nix, see
-          <https://nixos.org/manual/nix/stable/#sec-conf-file> or
+          <https://nixos.org/manual/nix/stable/command-ref/conf-file.html> or
          {manpage}`nix.conf(5)` for available options.
          The value declared here will be translated directly to the key-value pairs Nix expects.

--- a/nixos/modules/services/web-apps/lemmy.nix
+++ b/nixos/modules/services/web-apps/lemmy.nix
@ -25,6 +25,7 @@ in
    };

    caddy.enable = mkEnableOption (lib.mdDoc "exposing lemmy with the caddy reverse proxy");
+    nginx.enable = mkEnableOption (lib.mdDoc "exposing lemmy with the nginx reverse proxy");

    database.createLocally = mkEnableOption (lib.mdDoc "creation of database on the instance");

@ -140,6 +141,41 @@ in
        };
      };

+      services.nginx = mkIf cfg.nginx.enable {
+        enable = mkDefault true;
+        virtualHosts."${cfg.settings.hostname}".locations = let
+          ui = "http://127.0.0.1:${toString cfg.ui.port}";
+          backend = "http://127.0.0.1:${toString cfg.settings.port}";
+        in {
+          "~ ^/(api|pictrs|feeds|nodeinfo|.well-known)" = {
+            # backend requests
+            proxyPass = backend;
+            proxyWebsockets = true;
+            recommendedProxySettings = true;
+          };
+          "/" = {
+            # mixed frontend and backend requests, based on the request headers
+            proxyPass = "$proxpass";
+            recommendedProxySettings = true;
+            extraConfig = ''
+              set $proxpass "${ui}";
+              if ($http_accept = "application/activity+json") {
+                set $proxpass "${backend}";
+              }
+              if ($http_accept = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"") {
+                set $proxpass "${backend}";
+              }
+              if ($request_method = POST) {
+                set $proxpass "${backend}";
+              }
+
+              # Cuts off the trailing slash on URLs to make them valid
+              rewrite ^(.+)/+$ $1 permanent;
+            '';
+          };
+        };
+      };
+
      assertions = [{
        assertion = cfg.database.createLocally -> cfg.settings.database.host == "localhost" || cfg.settings.database.host == "/run/postgresql";
        message = "if you want to create the database locally, you need to use a local database";
--- a/nixos/modules/system/boot/systemd/nspawn.nix
+++ b/nixos/modules/system/boot/systemd/nspawn.nix
@ -11,7 +11,7 @@ let
    (assertOnlyFields [
      "Boot" "ProcessTwo" "Parameters" "Environment" "User" "WorkingDirectory"
      "PivotRoot" "Capability" "DropCapability" "NoNewPrivileges" "KillSignal"
-      "Personality" "MachineId" "PrivateUsers" "NotifyReady" "SystemCallFilter"
+      "Personality" "MachineID" "PrivateUsers" "NotifyReady" "SystemCallFilter"
      "LimitCPU" "LimitFSIZE" "LimitDATA" "LimitSTACK" "LimitCORE" "LimitRSS"
      "LimitNOFILE" "LimitAS" "LimitNPROC" "LimitMEMLOCK" "LimitLOCKS"
      "LimitSIGPENDING" "LimitMSGQUEUE" "LimitNICE" "LimitRTPRIO" "LimitRTTIME"
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -744,6 +744,7 @@ in {
  systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
  systemd-no-tainted = handleTest ./systemd-no-tainted.nix {};
  systemd-nspawn = handleTest ./systemd-nspawn.nix {};
+  systemd-nspawn-configfile = handleTest ./systemd-nspawn-configfile.nix {};
  systemd-oomd = handleTest ./systemd-oomd.nix {};
  systemd-portabled = handleTest ./systemd-portabled.nix {};
  systemd-repart = handleTest ./systemd-repart.nix {};
--- a/nixos/tests/systemd-nspawn-configfile.nix
+++ b/nixos/tests/systemd-nspawn-configfile.nix
@ -0,0 +1,128 @@
+import ./make-test-python.nix ({ lib, ... }:
+let
+  execOptions = [
+    "Boot"
+    "ProcessTwo"
+    "Parameters"
+    "Environment"
+    "User"
+    "WorkingDirectory"
+    "PivotRoot"
+    "Capability"
+    "DropCapability"
+    "NoNewPrivileges"
+    "KillSignal"
+    "Personality"
+    "MachineID"
+    "PrivateUsers"
+    "NotifyReady"
+    "SystemCallFilter"
+    "LimitCPU"
+    "LimitFSIZE"
+    "LimitDATA"
+    "LimitSTACK"
+    "LimitCORE"
+    "LimitRSS"
+    "LimitNOFILE"
+    "LimitAS"
+    "LimitNPROC"
+    "LimitMEMLOCK"
+    "LimitLOCKS"
+    "LimitSIGPENDING"
+    "LimitMSGQUEUE"
+    "LimitNICE"
+    "LimitRTPRIO"
+    "LimitRTTIME"
+    "OOMScoreAdjust"
+    "CPUAffinity"
+    "Hostname"
+    "ResolvConf"
+    "Timezone"
+    "LinkJournal"
+    "Ephemeral"
+    "AmbientCapability"
+  ];
+
+  filesOptions = [
+    "ReadOnly"
+    "Volatile"
+    "Bind"
+    "BindReadOnly"
+    "TemporaryFileSystem"
+    "Overlay"
+    "OverlayReadOnly"
+    "PrivateUsersChown"
+    "BindUser"
+    "Inaccessible"
+    "PrivateUsersOwnership"
+  ];
+
+  networkOptions = [
+    "Private"
+    "VirtualEthernet"
+    "VirtualEthernetExtra"
+    "Interface"
+    "MACVLAN"
+    "IPVLAN"
+    "Bridge"
+    "Zone"
+    "Port"
+  ];
+
+  optionsToConfig = opts: builtins.listToAttrs (map (n: lib.nameValuePair n "testdata") opts);
+
+  grepForOptions = opts: ''node.succeed(
+    "for o in ${builtins.concatStringsSep " " opts} ; do grep --quiet $o ${configFile} || exit 1 ; done"
+  )'';
+
+  unitName = "options-test";
+  configFile = "/etc/systemd/nspawn/${unitName}.nspawn";
+
+in
+{
+  name = "systemd-nspawn-configfile";
+
+  nodes = {
+    node = { pkgs, ... }: {
+      systemd.nspawn."${unitName}" = {
+        enable = true;
+
+        execConfig = optionsToConfig execOptions // {
+          Boot = true;
+          ProcessTwo = true;
+          NotifyReady = true;
+        };
+
+        filesConfig = optionsToConfig filesOptions // {
+          ReadOnly = true;
+          Volatile = "state";
+          PrivateUsersChown = true;
+          PrivateUsersOwnership = "auto";
+        };
+
+        networkConfig = optionsToConfig networkOptions // {
+          Private = true;
+          VirtualEthernet = true;
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    node.wait_for_file("${configFile}")
+
+    with subtest("Test for presence of all specified options in config file"):
+      ${grepForOptions execOptions}
+      ${grepForOptions filesOptions}
+      ${grepForOptions networkOptions}
+
+    with subtest("Test for absence of misspelled option 'MachineId' (instead of 'MachineID')"):
+      node.fail("grep --quiet MachineId ${configFile}")
+  '';
+
+  meta.maintainers = [
+    lib.maintainers.zi3m5f
+  ];
+})
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@ -1,7 +1,5 @@
-{ pname ? "emacs"
+{ pname
 , version
-, versionModifier ? ""
-, name ? "emacs-${version}${versionModifier}"
 , variant
 , src
 , patches ? _: [ ]
@ -74,7 +72,11 @@
 , WebKit

 # Boolean flags
-, nativeComp ? true
+, nativeComp ? null
+, withNativeCompilation ?
+  if nativeComp != null
+  then lib.warn "nativeComp option is deprecated and will be removed; use withNativeCompilation instead" nativeComp
+  else true
 , noGui ? false
 , srcRepo ? true
 , withAcl ? false
@ -96,7 +98,7 @@
 , withWebP ? lib.versionAtLeast version "29"
 , withX ? !(stdenv.isDarwin || noGui || withPgtk)
 , withXinput2 ? withX && lib.versionAtLeast version "29"
-, withXwidgets ? false
+, withXwidgets ? !noGui && (withGTK3 || withPgtk)

 # Options
 , siteStart ? ./site-start.el
@ -120,7 +122,7 @@ assert withGconf -> withX;
 assert withGpm -> stdenv.isLinux;
 assert withNS -> stdenv.isDarwin && !(withX || variant == "macport");
 assert withPgtk -> withGTK3 && !withX;
-assert withXwidgets -> withGTK3;
+assert withXwidgets -> !noGui && (withGTK3 || withPgtk);

 let
  libGccJitLibraryPaths = [
@ -134,7 +136,7 @@ let
           then llvmPackages_6.stdenv
           else stdenv) mkDerivation;
 in
-mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
+mkDerivation (finalAttrs: (lib.optionalAttrs withNativeCompilation {
  env = {
    NATIVE_FULL_AOT = "1";
    LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
@ -142,6 +144,7 @@ mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
 } // {
  pname = pname
          + (if noGui then "-nox"
+             else if variant == "macport" then "-macport"
             else if withPgtk then "-pgtk"
             else if withGTK3 then "-gtk3"
             else if withGTK2 then "-gtk2"
@ -150,7 +153,7 @@ mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {

  inherit src;

-  patches = patches fetchpatch ++ lib.optionals nativeComp [
+  patches = patches fetchpatch ++ lib.optionals withNativeCompilation [
    (substituteAll {
      src = if lib.versionOlder finalAttrs.version "29"
            then ./native-comp-driver-options-28.patch
@ -242,8 +245,7 @@ mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
    motif
  ] ++ lib.optionals (withX && withXwidgets) [
    glib-networking
-    webkitgtk
-  ] ++ lib.optionals nativeComp [
+  ] ++ lib.optionals withNativeCompilation [
    libgccjit
  ] ++ lib.optionals withImageMagick [
    imagemagick
@ -266,7 +268,6 @@ mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
  ] ++ lib.optionals withX [
    Xaw3d
    cairo
-
    giflib
    libXaw
    libXpm
@ -274,6 +275,8 @@ mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
    libpng
    librsvg
    libtiff
+  ] ++ lib.optionals withXwidgets [
+    webkitgtk
  ] ++ lib.optionals stdenv.isDarwin [
    sigtool
  ] ++ lib.optionals withNS [
@ -325,7 +328,7 @@ mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
  ]
  ++ (lib.optional stdenv.isDarwin (lib.withFeature withNS "ns"))
  ++ lib.optional (!withToolkitScrollBars) "--without-toolkit-scroll-bars"
-  ++ lib.optional nativeComp "--with-native-compilation"
+  ++ lib.optional withNativeCompilation "--with-native-compilation"
  ++ lib.optional withImageMagick "--with-imagemagick"
  ++ lib.optional withTreeSitter "--with-tree-sitter"
  ++ lib.optional withXinput2 "--with-xinput2"
@ -356,9 +359,9 @@ mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
  '' + lib.optionalString withNS ''
    mkdir -p $out/Applications
    mv nextstep/Emacs.app $out/Applications
-  '' + lib.optionalString (nativeComp && (withNS || variant == "macport")) ''
+  '' + lib.optionalString (withNativeCompilation && (withNS || variant == "macport")) ''
    ln -snf $out/lib/emacs/*/native-lisp $out/Applications/Emacs.app/Contents/native-lisp
-  '' + lib.optionalString nativeComp ''
+  '' + lib.optionalString withNativeCompilation ''
    echo "Generating native-compiled trampolines..."
    # precompile trampolines in parallel, but avoid spawning one process per trampoline.
    # 1000 is a rough lower bound on the number of trampolines compiled.
@ -379,8 +382,8 @@ mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
  '';

  passthru = {
-    inherit nativeComp;
-    treeSitter = withTreeSitter;
+    inherit withNativeCompilation;
+    inherit withTreeSitter;
    pkgs = recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
    tests = { inherit (nixosTests) emacs-daemon; };
  };
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@ -9,8 +9,11 @@
 , python3Packages
 , writeText
 , wrapNeovimUnstable
+, runCommand
 }:
 let
+  inherit (vimUtils) toVimPlugin;
+
   /* returns everything needed for the caller to wrap its own neovim:
   - the generated content of the future init.vim
   - the arguments to wrap neovim with
@ -193,14 +196,43 @@ let
    in
        lib.concatStringsSep ";" hostProviderLua;

+  buildNeovimPlugin = callPackage ./build-neovim-plugin.nix {
+    inherit (vimUtils) toVimPlugin;
+    inherit lua;
+  };
+
+  grammarToPlugin = grammar:
+    let
+      name = lib.pipe grammar [
+        lib.getName
+
+        # added in buildGrammar
+        (lib.removeSuffix "-grammar")
+
+        # grammars from tree-sitter.builtGrammars
+        (lib.removePrefix "tree-sitter-")
+        (lib.replaceStrings [ "-" ] [ "_" ])
+      ];
+    in
+
+    toVimPlugin (runCommand "vimplugin-treesitter-grammar-${name}"
+      {
+        meta = {
+          platforms = lib.platforms.all;
+        } // grammar.meta;
+      }
+      ''
+        mkdir -p $out/parser
+        ln -s ${grammar}/parser $out/parser/${name}.so
+      '');
+
 in
 {
  inherit makeNeovimConfig;
  inherit generateProviderRc;
  inherit legacyWrapper;
+  inherit grammarToPlugin;

-  buildNeovimPluginFrom2Nix = callPackage ./build-neovim-plugin.nix {
-    inherit (vimUtils) toVimPlugin;
-    inherit lua;
-  };
+  inherit buildNeovimPlugin;
+  buildNeovimPluginFrom2Nix = lib.warn "buildNeovimPluginFrom2Nix was renamed to buildNeovimPlugin" buildNeovimPlugin;
 }
--- a/pkgs/applications/editors/vim/plugins/default.nix
+++ b/pkgs/applications/editors/vim/plugins/default.nix
@ -15,7 +15,7 @@ let

  plugins = callPackage ./generated.nix {
    inherit buildVimPluginFrom2Nix;
-    inherit (neovimUtils) buildNeovimPluginFrom2Nix;
+    inherit (neovimUtils) buildNeovimPlugin;
  };

  # TL;DR
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -1,5 +1,5 @@
 # GENERATED by ./pkgs/applications/editors/vim/plugins/update.py. Do not edit!
-{ lib, buildVimPluginFrom2Nix, buildNeovimPluginFrom2Nix, fetchFromGitHub, fetchgit }:
+{ lib, buildVimPluginFrom2Nix, buildNeovimPlugin, fetchFromGitHub, fetchgit }:

 final: prev:
 {
@ -3598,7 +3598,7 @@ final: prev:
    meta.homepage = "https://github.com/ruifm/gitlinker.nvim/";
  };

-  gitsigns-nvim = buildNeovimPluginFrom2Nix {
+  gitsigns-nvim = buildNeovimPlugin {
    pname = "gitsigns.nvim";
    version = "2023-06-07";
    src = fetchFromGitHub {
@ -3861,7 +3861,7 @@ final: prev:
    meta.homepage = "https://github.com/ThePrimeagen/harpoon/";
  };

-  haskell-tools-nvim = buildNeovimPluginFrom2Nix {
+  haskell-tools-nvim = buildNeovimPlugin {
    pname = "haskell-tools.nvim";
    version = "2023-06-05";
    src = fetchFromGitHub {
@ -5013,7 +5013,7 @@ final: prev:
    meta.homepage = "https://github.com/alvarosevilla95/luatab.nvim/";
  };

-  lush-nvim = buildNeovimPluginFrom2Nix {
+  lush-nvim = buildNeovimPlugin {
    pname = "lush.nvim";
    version = "2023-06-08";
    src = fetchFromGitHub {
@ -6369,7 +6369,7 @@ final: prev:
    meta.homepage = "https://github.com/roxma/nvim-cm-racer/";
  };

-  nvim-cmp = buildNeovimPluginFrom2Nix {
+  nvim-cmp = buildNeovimPlugin {
    pname = "nvim-cmp";
    version = "2023-06-10";
    src = fetchFromGitHub {
@ -7605,7 +7605,7 @@ final: prev:
    meta.homepage = "https://github.com/nvim-treesitter/playground/";
  };

-  plenary-nvim = buildNeovimPluginFrom2Nix {
+  plenary-nvim = buildNeovimPlugin {
    pname = "plenary.nvim";
    version = "2023-06-10";
    src = fetchFromGitHub {
@ -7943,7 +7943,7 @@ final: prev:
    meta.homepage = "https://github.com/filipdutescu/renamer.nvim/";
  };

-  rest-nvim = buildNeovimPluginFrom2Nix {
+  rest-nvim = buildNeovimPlugin {
    pname = "rest.nvim";
    version = "2023-06-07";
    src = fetchFromGitHub {
@ -9016,7 +9016,7 @@ final: prev:
    meta.homepage = "https://github.com/gbrlsnchs/telescope-lsp-handlers.nvim/";
  };

-  telescope-manix = buildNeovimPluginFrom2Nix {
+  telescope-manix = buildNeovimPlugin {
    pname = "telescope-manix";
    version = "2023-06-05";
    src = fetchFromGitHub {
@ -9149,7 +9149,7 @@ final: prev:
    meta.homepage = "https://github.com/jvgrootveld/telescope-zoxide/";
  };

-  telescope-nvim = buildNeovimPluginFrom2Nix {
+  telescope-nvim = buildNeovimPlugin {
    pname = "telescope.nvim";
    version = "2023-06-10";
    src = fetchFromGitHub {
--- a/pkgs/applications/editors/vim/plugins/get-plugins.nix
+++ b/pkgs/applications/editors/vim/plugins/get-plugins.nix
@ -1,10 +1,10 @@
 with import <localpkgs> {};
 let
  inherit (vimUtils.override {inherit vim;}) buildVimPluginFrom2Nix;
-  inherit (neovimUtils) buildNeovimPluginFrom2Nix;
+  inherit (neovimUtils) buildNeovimPlugin;

  generated = callPackage <localpkgs/pkgs/applications/editors/vim/plugins/generated.nix> {
-    inherit buildNeovimPluginFrom2Nix buildVimPluginFrom2Nix;
+    inherit buildNeovimPlugin buildVimPluginFrom2Nix;
  } {} {};
  hasChecksum = value:
    lib.isAttrs value && lib.hasAttrByPath ["src" "outputHash"] value;
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
@ -1,8 +1,9 @@
-{ lib, callPackage, tree-sitter, neovim, runCommand }:
+{ lib, callPackage, tree-sitter, neovim, neovimUtils, runCommand }:

 self: super:

 let
+  inherit (neovimUtils) grammarToPlugin;
  generatedGrammars = callPackage ./generated.nix {
    inherit (tree-sitter) buildGrammar;
  };
@ -27,31 +28,6 @@ let
      })
    generatedDerivations;

-  grammarToPlugin = grammar:
-    let
-      name = lib.pipe grammar [
-        lib.getName
-
-        # added in buildGrammar
-        (lib.removeSuffix "-grammar")
-
-        # grammars from tree-sitter.builtGrammars
-        (lib.removePrefix "tree-sitter-")
-        (lib.replaceStrings [ "-" ] [ "_" ])
-      ];
-    in
-
-    runCommand "nvim-treesitter-grammar-${name}"
-      {
-        meta = {
-          platforms = lib.platforms.all;
-        } // grammar.meta;
-      }
-      ''
-        mkdir -p $out/parser
-        ln -s ${grammar}/parser $out/parser/${name}.so
-      '';
-
  allGrammars = lib.attrValues generatedDerivations;

  # Usage:
--- a/pkgs/applications/editors/vim/plugins/update.py
+++ b/pkgs/applications/editors/vim/plugins/update.py
@ -74,7 +74,7 @@ class VimEditor(pluginupdate.Editor):
        with open(outfile, "w+") as f:
            f.write(HEADER)
            f.write(textwrap.dedent("""
-                { lib, buildVimPluginFrom2Nix, buildNeovimPluginFrom2Nix, fetchFromGitHub, fetchgit }:
+                { lib, buildVimPluginFrom2Nix, buildNeovimPlugin, fetchFromGitHub, fetchgit }:

                final: prev:
                {
@ -103,7 +103,7 @@ class VimEditor(pluginupdate.Editor):
  }};

 """.format(
-        buildFn="buildNeovimPluginFrom2Nix" if isNeovim else "buildVimPluginFrom2Nix", plugin=plugin, src_nix=src_nix, repo=repo)
+        buildFn="buildNeovimPlugin" if isNeovim else "buildVimPluginFrom2Nix", plugin=plugin, src_nix=src_nix, repo=repo)
        log.debug(content)
        return content

--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -45,9 +45,9 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "114.0.5735.90",
-    "sha256": "1n16fp0zf38n7i8zb86ilx8g62xjnahf7q0c3zwj6n8pnqh8c6h7",
-    "sha256bin64": "1dgz21ycc41nxz8y5fqz73ll96vvlrf8vxfn65vy654jw7dsdpw6",
+    "version": "114.0.5735.106",
+    "sha256": "0jihf4gv7n2kkp78n42ha4ick8mzixb4xrfdk84iqazmifrb066z",
+    "sha256bin64": "1zlw9gjb2fmjf1d952adqg07cyq60yck0aarz20lcvv2jzb7s46i",
    "deps": {
      "gn": {
        "version": "2023-04-19",
@ -56,8 +56,8 @@
        "sha256": "01xrh9m9m6x8lz0vxwdw2mrhrvnw93zpg09hwdhqakj06agf4jjk"
      },
      "ungoogled-patches": {
-        "rev": "114.0.5735.90-1",
-        "sha256": "1g4wjpxvzrdmm5cnc94s1j13hh2n6cq6vdw1hy53lr7nqkpsj1jb"
+        "rev": "114.0.5735.106-1",
+        "sha256": "1aac1711mbr3jwxbnjkl5kxvb64bhwnw0ls1wj7w7pmka5gmardv"
      }
    }
  }
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles, stdenv }:

 let
-  version = "2.0.0-rc.3";
-  sha256 = "1ag3w97kzgqkpkw2lipv9x7wccr69zq47giffliya4sayj1y371y";
-  manifestsSha256 = "0gg6n5d3a7sypms540k4ycnrbg6nqlwymphszwbcjahdsjcmi40p";
+  version = "2.0.0-rc.5";
+  sha256 = "1akxmnbldsm7h4wf40jxsn56njdd5srkr6a3gsi223anl9c43gpx";
+  manifestsSha256 = "1vra1vqw38r17fdkcj5a5rmifpdzi29z5qggzy4h9bqsqhxy488f";

  manifests = fetchzip {
    url =
@ -23,7 +23,7 @@ in buildGoModule rec {
    inherit sha256;
  };

-  vendorSha256 = "sha256-PFutjxDYwe9C52L3MfjFz9CJHbh77ADICaKXlKCuwuo=";
+  vendorSha256 = "sha256-kw1V2eFoqrTB+1dBQYqOopr7+AMY1OB80vM8UN4rsso=";

  postUnpack = ''
    cp -r ${manifests} source/cmd/flux/manifests
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.45.18";
+  version = "0.46.3";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-J4edaMLvL9Bs1bwF+m0LMGiGmEKa7Xcb3SgOiDldTyY=";
+    hash = "sha256-2SC1HPmAQYUNrLMvtp87EaZ/K1dYD5LHhH+jB0si+Hs=";
  };

  vendorHash = "sha256-5Umoqi2D6iUk2Ut7YB/nmkOyA6Rx2qFhy/ZbfqoX5qA=";
@ -38,6 +38,6 @@ buildGoModule rec {
    changelog = "https://github.com/gruntwork-io/terragrunt/releases/tag/v${version}";
    description = "A thin wrapper for Terraform that supports locking for Terraform state and enforces best practices";
    license = licenses.mit;
-    maintainers = with maintainers; [ jk ];
+    maintainers = with maintainers; [ jk qjoly ];
  };
 }
--- a/pkgs/applications/networking/deck/default.nix
+++ b/pkgs/applications/networking/deck/default.nix
@ -0,0 +1,39 @@
+{ buildGoModule, lib, installShellFiles, fetchFromGitHub }:
+let
+  short_hash = "7447a09";
+in buildGoModule rec {
+  pname = "deck";
+  version = "1.22.0";
+
+  src = fetchFromGitHub {
+    owner = "Kong";
+    repo = "deck";
+    rev = "v${version}";
+    hash = "sha256-BCx4bw+FrnH291sp52Dz+dc6cYtoLAt8fmdF6YbmgOE=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s -w -X github.com/kong/deck/cmd.VERSION=${version}"
+    "-X github.com/kong/deck/cmd.COMMIT=${short_hash}"
+  ];
+
+  vendorSha256 = "sha256-rir8z1IwQenTvihHWaA7dx6Nn45M82ulCNRJuQlUhEM=";
+
+  postInstall = ''
+    installShellCompletion --cmd deck \
+      --bash <($out/bin/deck completion bash) \
+      --fish <($out/bin/deck completion fish) \
+      --zsh <($out/bin/deck completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "A configuration management and drift detection tool for Kong";
+    homepage = "https://github.com/Kong/deck";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ liyangau ];
+  };
+}
--- a/pkgs/applications/networking/soju/default.nix
+++ b/pkgs/applications/networking/soju/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "soju";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromSourcehut {
    owner = "~emersion";
    repo = "soju";
    rev = "v${version}";
-    hash = "sha256-e3yA8gXuLxRzJIQQIjhajIOWVtikd+gNVxbhzfy56b0=";
+    hash = "sha256-Icz6oIXLnLe75zuB8Q862I1ado5GpGZBJezrH7F7EJs=";
  };

  vendorHash = "sha256-iT/QMm6RM6kvw69Az+aLTtBuaCX7ELAiYlj5wXAtBd4=";
--- a/pkgs/applications/office/timeular/default.nix
+++ b/pkgs/applications/office/timeular/default.nix
@ -5,12 +5,12 @@
 }:

 let
-  version = "5.8.7";
+  version = "5.9.0";
  pname = "timeular";

  src = fetchurl {
    url = "https://s3.amazonaws.com/timeular-desktop-packages/linux/production/Timeular-${version}.AppImage";
-    sha256 = "sha256-IQb++L6bQCZ22sIC5fjBFlL2PPNUpbzOpl1yQIib0H0=";
+    sha256 = "sha256-RbP//rrKgvChIbBVwC8ElMUe+XsGMgHxowSdw6tRWNI=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/build-support/emacs/generic.nix
+++ b/pkgs/build-support/emacs/generic.nix
@ -2,32 +2,25 @@

 { lib, stdenv, emacs, texinfo, writeText, gcc, ... }:

-with lib;
-
 { pname
 , version ? null
-
 , buildInputs ? []
 , packageRequires ? []
-
 , meta ? {}
-
 , ...
 }@args:

 let
-
  defaultMeta = {
    broken = false;
    platforms = emacs.meta.platforms;
-  } // optionalAttrs ((args.src.meta.homepage or "") != "") {
+  } // lib.optionalAttrs ((args.src.meta.homepage or "") != "") {
    homepage = args.src.meta.homepage;
  };
-
 in

 stdenv.mkDerivation ({
-  name = "emacs-${pname}${optionalString (version != null) "-${version}"}";
+  name = "emacs-${pname}${lib.optionalString (version != null) "-${version}"}";

  unpackCmd = ''
    case "$curSrc" in
@ -68,7 +61,7 @@ stdenv.mkDerivation ({
  meta = defaultMeta // meta;
 }

-// lib.optionalAttrs (emacs.nativeComp or false) {
+// lib.optionalAttrs (emacs.withNativeCompilation or false) {

  LIBRARY_PATH = "${lib.getLib stdenv.cc.libc}/lib";

@ -90,6 +83,4 @@ stdenv.mkDerivation ({
  '';
 }

-// removeAttrs args [ "buildInputs" "packageRequires"
-                      "meta"
-                    ])
+// removeAttrs args [ "buildInputs" "packageRequires" "meta" ])
--- a/pkgs/build-support/emacs/wrapper.nix
+++ b/pkgs/build-support/emacs/wrapper.nix
@ -32,34 +32,25 @@ in customEmacsPackages.withPackages (epkgs: [ epkgs.evil epkgs.magit ])

 */

-{ lib, lndir, makeWrapper, runCommand, gcc }: self:
-
-with lib;
-
+{ lib, lndir, makeWrapper, runCommand, gcc }:
+self:
 let
-
  inherit (self) emacs;
-
-  nativeComp = emacs.nativeComp or false;
-
-  treeSitter = emacs.treeSitter or false;
-
+  withNativeCompilation = emacs.withNativeCompilation or false;
+  withTreeSitter = emacs.withTreeSitter or false;
 in
-
 packagesFun: # packages explicitly requested by the user
-
 let
  explicitRequires =
    if lib.isFunction packagesFun
    then packagesFun self
    else packagesFun;
 in
-
 runCommand
-  (appendToName "with-packages" emacs).name
+  (lib.appendToName "with-packages" emacs).name
  {
-    nativeBuildInputs = [ emacs lndir makeWrapper ];
    inherit emacs explicitRequires;
+    nativeBuildInputs = [ emacs lndir makeWrapper ];

    preferLocalBuild = true;
    allowSubstitutes = false;
@ -69,8 +60,8 @@ runCommand
    deps = runCommand "emacs-packages-deps"
      ({
        inherit explicitRequires lndir emacs;
-        nativeBuildInputs = lib.optional nativeComp gcc;
-      } // lib.optionalAttrs nativeComp {
+        nativeBuildInputs = lib.optional withNativeCompilation gcc;
+      } // lib.optionalAttrs withNativeCompilation {
        inherit (emacs) LIBRARY_PATH;
      })
      ''
@ -110,10 +101,10 @@ runCommand
        }
        mkdir -p $out/bin
        mkdir -p $out/share/emacs/site-lisp
-        ${optionalString nativeComp ''
+        ${lib.optionalString withNativeCompilation ''
          mkdir -p $out/share/emacs/native-lisp
        ''}
-        ${optionalString treeSitter ''
+        ${lib.optionalString withTreeSitter ''
          mkdir -p $out/lib
        ''}

@ -137,10 +128,10 @@ runCommand
        linkEmacsPackage() {
          linkPath "$1" "bin" "bin"
          linkPath "$1" "share/emacs/site-lisp" "share/emacs/site-lisp"
-          ${optionalString nativeComp ''
+          ${lib.optionalString withNativeCompilation ''
            linkPath "$1" "share/emacs/native-lisp" "share/emacs/native-lisp"
          ''}
-          ${optionalString treeSitter ''
+          ${lib.optionalString withTreeSitter ''
            linkPath "$1" "lib" "lib"
          ''}
        }
@ -171,10 +162,10 @@ runCommand
          (load-file "$emacs/share/emacs/site-lisp/site-start.el"))
        (add-to-list 'load-path "$out/share/emacs/site-lisp")
        (add-to-list 'exec-path "$out/bin")
-        ${optionalString nativeComp ''
+        ${lib.optionalString withNativeCompilation ''
          (add-to-list 'native-comp-eln-load-path "$out/share/emacs/native-lisp/")
        ''}
-        ${optionalString treeSitter ''
+        ${lib.optionalString withTreeSitter ''
          (add-to-list 'treesit-extra-load-path "$out/lib/")
        ''}
        EOF
@ -189,7 +180,7 @@ runCommand
        # Byte-compiling improves start-up time only slightly, but costs nothing.
        $emacs/bin/emacs --batch -f batch-byte-compile "$siteStart" "$subdirs"

-        ${optionalString nativeComp ''
+        ${lib.optionalString withNativeCompilation ''
          $emacs/bin/emacs --batch \
            --eval "(add-to-list 'native-comp-eln-load-path \"$out/share/emacs/native-lisp/\")" \
            -f batch-native-compile "$siteStart" "$subdirs"
--- a/pkgs/development/interpreters/wamr/default.nix
+++ b/pkgs/development/interpreters/wamr/default.nix
@ -4,14 +4,14 @@
 , cmake
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "wamr";
  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasm-micro-runtime";
-    rev = "WAMR-${version}";
+    rev = "WAMR-${finalAttrs.version}";
    hash = "sha256-jpT42up9HAVJpo03cFrffQQk2JiHEAEepBGlU4RUfNU=";
  };

@ -28,4 +28,4 @@ stdenv.mkDerivation rec {
    # more platforms.
    broken = !stdenv.isLinux;
  };
-}
+})
--- a/pkgs/development/libraries/boost/1.68.nix
+++ b/pkgs/development/libraries/boost/1.68.nix
@ -1,11 +0,0 @@
-{ callPackage, fetchurl, fetchpatch, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "1.68.0";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2";
-    # SHA256 from http://www.boost.org/users/history/version_1_68_0.html
-    sha256 = "7f6130bc3cf65f56a618888ce9d5ea704fa10b462be126ad053e80e553d6d8b7";
-  };
-})
--- a/pkgs/development/libraries/boost/1.69.nix
+++ b/pkgs/development/libraries/boost/1.69.nix
@ -1,13 +0,0 @@
-{ callPackage, fetchurl, fetchpatch, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "1.69.0";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2";
-    # SHA256 from http://www.boost.org/users/history/version_1_69_0.html
-    sha256 = "8f32d4617390d1c2d16f26a27ab60d97807b35440d45891fa340fc2648b04406";
-  };
-
-  patches = [ ./pthread-stack-min-fix.patch ];
-})
--- a/pkgs/development/libraries/boost/1.70.nix
+++ b/pkgs/development/libraries/boost/1.70.nix
@ -1,13 +0,0 @@
-{ callPackage, fetchurl, fetchpatch, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "1.70.0";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2";
-    # SHA256 from http://www.boost.org/users/history/version_1_70_0.html
-    sha256 = "430ae8354789de4fd19ee52f3b1f739e1fba576f0aded0897c3c2bc00fb38778";
-  };
-
-  patches = [ ./pthread-stack-min-fix.patch ];
-})
--- a/pkgs/development/libraries/boost/1.72.nix
+++ b/pkgs/development/libraries/boost/1.72.nix
@ -1,17 +0,0 @@
-{ callPackage, fetchurl, fetchpatch, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "1.72.0";
-
-  src = fetchurl {
-    urls = [
-      "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
-      "https://boostorg.jfrog.io/artifactory/main/release/${version}/source/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
-    ];
-    # SHA256 from http://www.boost.org/users/history/version_1_72_0.html
-    sha256 = "59c9b274bc451cf91a9ba1dd2c7fdcaf5d60b1b3aa83f2c9fa143417cc660722";
-  };
-
-  patches = [ ./pthread-stack-min-fix.patch ];
-})
-
--- a/pkgs/development/libraries/boost/1.73.nix
+++ b/pkgs/development/libraries/boost/1.73.nix
@ -1,15 +0,0 @@
-{ callPackage, fetchurl, fetchpatch, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "1.73.0";
-
-  src = fetchurl {
-    urls = [
-      "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
-      "https://boostorg.jfrog.io/artifactory/main/release/${version}/source/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
-    ];
-    # SHA256 from http://www.boost.org/users/history/version_1_73_0.html
-    sha256 = "4eb3b8d442b426dc35346235c8733b5ae35ba431690e38c6a8263dce9fcbb402";
-  };
-})
-
--- a/pkgs/development/libraries/boost/1.74.nix
+++ b/pkgs/development/libraries/boost/1.74.nix
@ -1,15 +0,0 @@
-{ callPackage, fetchurl, fetchpatch, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "1.74.0";
-
-  src = fetchurl {
-    urls = [
-      "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
-      "https://boostorg.jfrog.io/artifactory/main/release/${version}/source/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
-    ];
-    # SHA256 from http://www.boost.org/users/history/version_1_74_0.html
-    sha256 = "83bfc1507731a0906e387fc28b7ef5417d591429e51e788417fe9ff025e116b1";
-  };
-})
-
--- a/pkgs/development/libraries/boost/cmake-paths.patch
+++ b/pkgs/development/libraries/boost/cmake-paths.patch
@ -1,21 +0,0 @@
-diff --git a/tools/boost_install/boost-install.jam b/tools/boost_install/boost-install.jam
-index ad19f7b55..ec6bf57ff 100644
--- a/tools/boost_install/boost-install.jam
-+++ b/tools/boost_install/boost-install.jam
-@@ -587,6 +587,7 @@ rule generate-cmake-config- ( target : sources * : properties * )
-         "# Compute the include and library directories relative to this file."
-         ""
-         "get_filename_component(_BOOST_CMAKEDIR \"${CMAKE_CURRENT_LIST_DIR}/../\" ABSOLUTE)"
-+        "get_filename_component(_BOOST_REAL_CMAKEDIR \"${CMAKE_CURRENT_LIST_DIR}/../\" ABSOLUTE)"
-         : true ;
- 
-     if [ path.is-rooted $(cmakedir) ]
-@@ -607,6 +608,8 @@ rule generate-cmake-config- ( target : sources * : properties * )
-             "  unset(_BOOST_CMAKEDIR_ORIGINAL)"
-             "endif()"
-             ""
-+	    "# Assume that the installer actually did know where the libs were to be installed"
-+            "get_filename_component(_BOOST_CMAKEDIR \"$(cmakedir-native)\" REALPATH)"
-             : true ;
-     }
- 
--- a/pkgs/development/libraries/boost/default.nix
+++ b/pkgs/development/libraries/boost/default.nix
@ -16,12 +16,6 @@ let
      }
    );
 in {
-  boost168 = makeBoost ./1.68.nix;
-  boost169 = makeBoost ./1.69.nix;
-  boost170 = makeBoost ./1.70.nix;
-  boost172 = makeBoost ./1.72.nix;
-  boost173 = makeBoost ./1.73.nix;
-  boost174 = makeBoost ./1.74.nix;
  boost175 = makeBoost ./1.75.nix;
  boost177 = makeBoost ./1.77.nix;
  boost178 = makeBoost ./1.78.nix;
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@ -31,9 +31,6 @@ assert enableShared || enableStatic;

 assert enableNumpy -> enablePython;

-# Boost <1.69 can't be built on linux with clang >8, because pth was removed
-assert with lib; (stdenv.isLinux && toolset == "clang" && versionAtLeast stdenv.cc.version "8.0.0") -> versionAtLeast version "1.69";
-
 let

  variant = lib.concatStringsSep ","
@ -107,22 +104,7 @@ stdenv.mkDerivation {

  patches = patches
  ++ lib.optional stdenv.isDarwin ./darwin-no-system-python.patch
-  # Fix boost-context segmentation faults on ppc64 due to ABI violation
-  ++ lib.optional (lib.versionOlder version "1.71") (fetchpatch {
-    url = "https://github.com/boostorg/context/commit/2354eca9b776a6739112833f64754108cc0d1dc5.patch";
-    sha256 = "067m4bjpmcanqvg28djax9a10avmdwhlpfx6gn73kbqqq70dnz29";
-    stripLen = 1;
-    extraPrefix = "libs/context/";
-  })
-  ++ lib.optional (lib.versionOlder version "1.70") (fetchpatch {
-    # support for Mips64n64 appeared in boost-context 1.70
-    url = "https://github.com/boostorg/context/commit/e3f744a1862164062d579d1972272d67bdaa9c39.patch";
-    sha256 = "sha256-qjQy1b4jDsIRrI+UYtcguhvChrMbGWO0UlEzEJHYzRI=";
-    stripLen = 1;
-    extraPrefix = "libs/context/";
-  })
-  ++ lib.optional (lib.versionAtLeast version "1.70" && lib.versionOlder version "1.73") ./cmake-paths.patch
-  ++ lib.optional (lib.versionAtLeast version "1.73") ./cmake-paths-173.patch
+  ++ [ ./cmake-paths-173.patch ]
  ++ lib.optional (version == "1.77.0") (fetchpatch {
    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch";
    relative = "include";
@ -134,7 +116,6 @@ stdenv.mkDerivation {
    description = "Collection of C++ libraries";
    license = licenses.boost;
    platforms = platforms.unix ++ platforms.windows;
-    badPlatforms = optionals (versionOlder version "1.73") platforms.riscv;
    maintainers = with maintainers; [ hjones2199 ];

    broken =
--- a/pkgs/development/libraries/boost/pthread-stack-min-fix.patch
+++ b/pkgs/development/libraries/boost/pthread-stack-min-fix.patch
@ -1,15 +0,0 @@
-Taken from https://github.com/conan-io/conan-center-index/pull/361/files
-
-diff --git a/include/boost/thread/pthread/thread_data.hpp b/include/boost/thread/pthread/thread_data.hpp
-index aefbeb4..bc9b136 100644
--- a/boost/thread/pthread/thread_data.hpp
-+++ b/boost/thread/pthread/thread_data.hpp
-@@ -57,7 +57,7 @@ namespace boost
- #else
-           std::size_t page_size = ::sysconf( _SC_PAGESIZE);
- #endif
-#if PTHREAD_STACK_MIN > 0
-+#ifdef PTHREAD_STACK_MIN
-           if (size<PTHREAD_STACK_MIN) size=PTHREAD_STACK_MIN;
- #endif
-           size = ((size+page_size-1)/page_size)*page_size;
--- a/pkgs/development/libraries/composable_kernel/default.nix
+++ b/pkgs/development/libraries/composable_kernel/default.nix
@ -13,9 +13,7 @@
 , gpuTargets ? [ ] # gpuTargets = [ "gfx803" "gfx900" "gfx1030" ... ]
 }:

-let
-  # This is now over 3GB, to allow hydra caching we separate it
-  ck = stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "composable_kernel";
  version = "unstable-2023-01-16";

@ -85,32 +83,4 @@ let
    maintainers = teams.rocm.members;
    platforms = platforms.linux;
  };
-  });
-
-in stdenv.mkDerivation {
-  inherit (ck) pname version outputs src passthru requiredSystemFeatures meta;
-
-  dontUnpack = true;
-  dontPatch = true;
-  dontConfigure = true;
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -an ${ck}/* $out
-  '' + lib.optionalString buildTests ''
-    cp -a ${ck.test} $test
-  '' + lib.optionalString buildExamples ''
-    cp -a ${ck.example} $example
-  '' + ''
-    runHook postInstall
-  '';
-
-  # Fix paths
-  preFixup = ''
-    substituteInPlace $out/lib/cmake/composable_kernel/*.cmake \
-      --replace "${ck}" "$out"
-  '';
-}
+})
--- a/pkgs/development/python-modules/bitarray/default.nix
+++ b/pkgs/development/python-modules/bitarray/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "bitarray";
-  version = "2.7.4";
+  version = "2.7.5";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-FD1PZeH0WlM+E1Ib4dxVengjF+z3ZSDqvVqQOybssYc=";
+    hash = "sha256-TYAfMaiPVEtGxwfb/AldQn+B0Cv/z8FzKjNZcCVQuHs=";
  };

  checkPhase = ''
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@ -116,6 +116,7 @@ buildPythonPackage rec {
    pkg-config
    pybind11
    setuptools-scm
+    numpy
  ];

  buildInputs = [
--- a/pkgs/development/python-modules/nlpcloud/default.nix
+++ b/pkgs/development/python-modules/nlpcloud/default.nix
@ -6,12 +6,12 @@

 buildPythonPackage rec {
  pname = "nlpcloud";
-  version = "1.0.41";
+  version = "1.0.42";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-LtwN1fF/lfvXrB30P0VvuVGnsG8p1ZAalDCYL/a9uGE=";
+    hash = "sha256-XT3aadYrdYZk8EEkUTdFtTMR1LociO0jQo/QCFcJcWw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "peaqevcore";
-  version = "18.1.7";
+  version = "18.1.11";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-inu0lTY2JQhlFEgJOejMhcHJhYvH6OzYo8qmAy9xBFo=";
+    hash = "sha256-SdnPF2J9AorzSjObkjObIqvejZYSQbjStkKEbiTAOIo=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "0.10.0.20230608";
+  version = "0.10.0.20230611";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-hMtOGJMX0VGquGxQUX/KSIALT0bORZaBEyoZSDLLBlc=";
+    hash = "sha256-z5mh/8sFulky9LX0LPwBuYWebjsqWc0EsPjDZMuTCX8=";
  };

  passthru.optional-dependencies = {
--- a/pkgs/development/python-modules/pynvim/default.nix
+++ b/pkgs/development/python-modules/pynvim/default.nix
@ -26,7 +26,7 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    msgpack
-  ] ++ lib.optional (!isPyPy) [
+  ] ++ lib.optionals (!isPyPy) [
    greenlet
  ];

@ -42,6 +42,6 @@ buildPythonPackage rec {
    homepage = "https://github.com/neovim/pynvim";
    changelog = "https://github.com/neovim/pynvim/releases/tag/${version}";
    license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ figsoda ];
  };
 }
--- a/pkgs/development/python-modules/structlog/default.nix
+++ b/pkgs/development/python-modules/structlog/default.nix
@ -1,47 +1,45 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
-, pytestCheckHook
-, pytest-asyncio
-, pretend
 , freezegun
 , hatch-fancy-pypi-readme
 , hatch-vcs
 , hatchling
+, pretend
+, pytest-asyncio
+, pytestCheckHook
+, pythonAtLeast
+, pythonOlder
 , simplejson
 , typing-extensions
-, pythonAtLeast
 }:

 buildPythonPackage rec {
  pname = "structlog";
-  version = "22.3.0";
+  version = "23.1.0";
  format = "pyproject";

+  disabled = pythonOlder "3.7";
+
  src = fetchFromGitHub {
    owner = "hynek";
    repo = "structlog";
    rev = "refs/tags/${version}";
-    hash = "sha256-+r+M+uTXdNBWQf0TGQuZgsCXg2CBKwH8ZE2+uAe0Dzg=";
+    hash = "sha256-0zHvBMiZB4cGntdYXA7C9V9+FfnDB6sHGuFRYAo/LJw=";
  };

+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
  nativeBuildInputs = [
    hatch-fancy-pypi-readme
    hatch-vcs
    hatchling
  ];

-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
    typing-extensions
  ];

-  pythonImportsCheck = [
-    "structlog"
-  ];
-
  nativeCheckInputs = [
    freezegun
    pretend
@ -50,9 +48,14 @@ buildPythonPackage rec {
    simplejson
  ];

+  pythonImportsCheck = [
+    "structlog"
+  ];
+
  meta = with lib; {
    description = "Painless structural logging";
    homepage = "https://github.com/hynek/structlog";
+    changelog = "https://github.com/hynek/structlog/blob/${version}/CHANGELOG.md";
    license = licenses.asl20;
    maintainers = with maintainers; [ ];
  };
--- a/pkgs/development/python-modules/types-ujson/default.nix
+++ b/pkgs/development/python-modules/types-ujson/default.nix
@ -5,12 +5,12 @@

 buildPythonPackage rec {
  pname = "types-ujson";
-  version = "5.7.0.5";
+  version = "5.8.0.0";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-f/Kmd2BI5q1qvH6+39Qq4bbABVEq/7rkTK8/selrXRI=";
+    hash = "sha256-KFao0Ig0db7IDBrHcsAG6mkSFcxV3tIWR7XIfIYknLs=";
  };

  doCheck = false;
--- a/pkgs/development/tools/argc/default.nix
+++ b/pkgs/development/tools/argc/default.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "argc";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "sigoden";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-TMBXcLicrqdykGZJjtEyobHvqK6CR6CaJoiBntj1i4o=";
+    hash = "sha256-3e15knnM9CQn/nIh4H1Kd91qyE1KJ18jO0gk7UWz08Y=";
  };

-  cargoHash = "sha256-K18oD6TT0pmF0ctEO4yJlA0koeRtiMFjz/8FLb7gwo0=";
+  cargoHash = "sha256-NnK3SNBZNvXoSJhMu7Gg9HjAmAws8eD051iSZEfhfIw=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:

 stdenv.mkDerivation rec {
-  version = "0.107.0";
+  version = "0.108.0";
  pname = "jbang";

  src = fetchzip {
    url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-ca5/pgp2io4TYA8DtUUJZe/9d1KPgX3DV5pTyTKBe5M=";
+    sha256 = "sha256-RPWWCAys9hPjIOW8qhkLxXwtwSBRa6LpbM6B8uS5dFw=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/misc/topiary/default.nix
+++ b/pkgs/development/tools/misc/topiary/default.nix
@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, nix-update-script
 }:

 rustPlatform.buildRustPackage rec {
@ -42,6 +43,8 @@ rustPlatform.buildRustPackage rec {
    install -Dm444 languages/* -t $out/share/languages
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "A uniform formatter for simple languages, as part of the Tree-sitter ecosystem";
    homepage = "https://github.com/tweag/topiary";
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "oh-my-posh";
-  version = "16.9.1";
+  version = "17.0.0";

  src = fetchFromGitHub {
    owner = "jandedobbeleer";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-oOpTjo0+3nTmQXgB5eGsQnklLdZdizy4HNx5enJ8Hb8=";
+    hash = "sha256-WgU74VH+mQenEWGpLgC42fEUPn0PMelMPWVBoig4QRE=";
  };

-  vendorHash = "sha256-nODeIR5TU7tcmoQI7ZqCDxuESmx23Mj1WsFTcCB/htQ=";
+  vendorHash = "sha256-0uz2Cz8W/MWihanRnbXGJozMBqQ+rYvUN/xQMCOSr4w=";

  sourceRoot = "source/src";

--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@ -13,14 +13,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "rust-analyzer-unwrapped";
-  version = "2023-05-29";
-  cargoSha256 = "sha256-Qsr+cpggftYR9JL1y3ZgmuNSNsyBeQVVr+pt3R9/gm8=";
+  version = "2023-06-05";
+  cargoSha256 = "sha256-2mQ9DoY5grywiRE3dxSuziaw7adIHe8mRgzcFXVnIEg=";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "rust-analyzer";
    rev = version;
-    sha256 = "sha256-8fOFw6B9lDUt4slKAGHj6Bipi5or7nNQvOB9vvN2R9U=";
+    sha256 = "sha256-IHfvZ8cbn/rgueO7ZvFUHWPPvXEM/rrK1YATwucHVbM=";
  };

  cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@ -6,7 +6,7 @@

 stdenvNoCC.mkDerivation rec {
  pname = "raycast";
-  version = "1.53.0";
+  version = "1.53.2";

  src = fetchurl {
    # https://github.com/NixOS/nixpkgs/pull/223495
@ -17,7 +17,7 @@ stdenvNoCC.mkDerivation rec {
    # to host GitHub Actions to periodically check for updates
    # and re-release the `.dmg` file to Internet Archive (https://archive.org/details/raycast)
    url = "https://archive.org/download/raycast/raycast-${version}.dmg";
-    sha256 = "sha256-IkLbfuzkgO/E8U8PjZ6NQ28WEVeBumKYbbKpK/LPwNY=";
+    sha256 = "sha256-e2UGS1LSBj0xZu0gWlb8SiXhx1sZzcZDOGPhg6ziI9c=";
  };

  dontPatch = true;
--- a/pkgs/os-specific/linux/cannelloni/default.nix
+++ b/pkgs/os-specific/linux/cannelloni/default.nix
@ -1,4 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, cmake, lksctp-tools, sctpSupport ? true }:
+{ lib, stdenv, fetchFromGitHub, cmake, lksctp-tools, sctpSupport ? true }:
+
 stdenv.mkDerivation (finalAttrs: {
  pname = "cannelloni";
  version = "1.1.0";
@ -8,10 +9,14 @@ stdenv.mkDerivation (finalAttrs: {
    rev = "v${finalAttrs.version}";
    hash = "sha256-pAXHo9NCXMFKYcIJogytBiPkQE0nK6chU5TKiDNCKA8=";
  };
-  buildInputs = [ cmake ] ++ lib.optionals sctpSupport [ lksctp-tools ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = lib.optionals sctpSupport [ lksctp-tools ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DSCTP_SUPPORT=${lib.boolToString sctpSupport}"
  ];

--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@ -86,13 +86,13 @@ buildPythonApplication rec {

  doCheck = !stdenv.isDarwin;

-  checkPhase = ''
+  checkPhase = let testFlags = lib.optionalString (!stdenv.isAarch64) "-j $NIX_BUILD_CORES"; in ''
    runHook preCheck

    # remove src module, so tests use the installed module instead
    rm -rf ./synapse

-    PYTHONPATH=".:$PYTHONPATH" ${python3.interpreter} -m twisted.trial -j $NIX_BUILD_CORES tests
+    PYTHONPATH=".:$PYTHONPATH" ${python3.interpreter} -m twisted.trial ${testFlags} tests

    runHook postCheck
  '';
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@ -52,8 +52,8 @@ in {
  '';

  nextcloud25 = generic {
-    version = "25.0.6";
-    sha256 = "sha256-fYtO3CZ5oNpaIs+S+emMrxqYNlck0AC43fxdiomsjDg=";
+    version = "25.0.7";
+    sha256 = "sha256-LpAUcSXW1riFpW3PnAC774tKE1PNE6ypVRXZlnZvNF8=";
  };

  nextcloud26 = generic {
--- a/pkgs/shells/nushell/plugins/query.nix
+++ b/pkgs/shells/nushell/plugins/query.nix
@ -4,15 +4,16 @@
 , nushell
 , IOKit
 , CoreFoundation
+, nix-update-script
 }:

 rustPlatform.buildRustPackage {
  pname = "nushell_plugin_query";
-  version = "0.80.0";
+  version = "0.81.0";

  src = nushell.src;

-  cargoHash = "sha256-k4UjHNf5L9RmYuB66gcoyCmhd1MvtAxTOxRh24sv0sk=";
+  cargoHash = "sha256-iQ7xr7NY/OQ5pVq2DFmdl/6F2NlUh3NBA9dk+e4gzRE=";

  buildInputs = lib.optionals stdenv.isDarwin [ IOKit CoreFoundation ];

@ -21,6 +22,10 @@ rustPlatform.buildRustPackage {
  # compilation fails with a missing symbol
  doCheck = false;

+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
  meta = with lib; {
    description = "A Nushell plugin to query JSON, XML, and various web data";
    homepage = "https://github.com/nushell/nushell/tree/main/crates/nu_plugin_query";
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "syft";
-  version = "0.82.0";
+  version = "0.83.0";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Pdo/hRcHU0R7bcjFgCGB9cRGA9/OULNkj//VG8cowj0=";
+    hash = "sha256-H0DBz6HsEML4JXY601pssNtq1q3Z0t00JpVAo1izijM=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -22,7 +22,7 @@ buildGoModule rec {
  };
  # hash mismatch with darwin
  proxyVendor = true;
-  vendorHash = "sha256-d3Nf/9IyPYbODJ3jL0CHa4Jl2GEoe0VdlR3Br80uYiQ=";
+  vendorHash = "sha256-7nTbXq6HgD1oBxyQbuAxbiLP8IuXsDQLIoJ1l55ACwA=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/misc/fclones/default.nix
+++ b/pkgs/tools/misc/fclones/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fclones";
-  version = "0.31.1";
+  version = "0.32.1";

  src = fetchFromGitHub {
    owner = "pkolaczk";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-7XixwONEgALMEQlF+SAzx8SO79GrNE8YBX2bDcslVdE=";
+    hash = "sha256-aNTmx94fWuwwlMckjZMOoU1hqSW+yUTKjobvRTxJX4s=";
  };

-  cargoHash = "sha256-hsidW0T8a6Bj8g+ybm3XX0Ddha+z4/DzHBSQD1jRa3A=";
+  cargoHash = "sha256-MGqQImBEH210IVvjyh/aceQr001T1cMHQfyQI1ZyVw8=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk_11_0.frameworks.AppKit
--- a/pkgs/tools/misc/fclones/gui.nix
+++ b/pkgs/tools/misc/fclones/gui.nix
@ -12,14 +12,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "fclones-gui";
-  version = "0.1.0";
+  version = "0.1.2";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-rMeXUNpoEzqsDmlTmnHsFkas3zFgdCH0WSeP83RtT+c=";
+    hash = "sha256-ge2l414kYHK3y4V837GTQ5sSxVRlU8ZYyGdBj4+vUL8=";
  };

-  cargoHash = "sha256-2oeyTMYg0PyTpSMLaub3nZGeoK5U6BlC8OReBwRi3DA=";
+  cargoHash = "sha256-rDAUA75KCWlhf13bCucV5w9WAJ+Uw+s8sUCCeWBYJeA=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/tools/misc/lerpn/default.nix
+++ b/pkgs/tools/misc/lerpn/default.nix
@ -0,0 +1,33 @@
+{ python3
+, lib
+, fetchFromGitea
+}:
+
+python3.pkgs.buildPythonApplication {
+  pname = "lerpn";
+  version = "unstable-2023-06-09";
+
+  src = fetchFromGitea {
+    domain = "gitea.alexisvl.rocks";
+    owner = "alexisvl";
+    repo = "lerpn";
+    rev = "b65e56cfbbb38f8200e7b0c18b3a585ae768c6e2";
+    hash = "sha256-4xqBHcOWHAvQtXS9CJWTGTdE4SGHxjghZY+/KPUgX70=";
+  };
+
+  checkPhase = ''
+    runHook preCheck
+    patchShebangs test
+
+    substituteInPlace test --replace "#raise TestFailedException()" "sys.exit(1)"
+    ./test
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://gitea.alexisvl.rocks/alexisvl/lerpn";
+    description = "Curses RPN calculator written in straight Python";
+    maintainers = with maintainers; [ ckie ];
+    license = licenses.gpl3Plus;
+  };
+}
--- a/pkgs/tools/misc/parallel/default.nix
+++ b/pkgs/tools/misc/parallel/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "parallel";
-  version = "20230422";
+  version = "20230522";

  src = fetchurl {
    url = "mirror://gnu/parallel/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-kQZZPQncTeDglLexQ5CjCdj8sdJxBKU4FNFpN9y648I=";
+    sha256 = "sha256-GvRrdgUCOxQ2C7lohF3mQT2yS/D5UfXgII0jgDy2QgI=";
  };

  outputs = [ "out" "man" "doc" ];
--- a/pkgs/tools/networking/keepalived/default.nix
+++ b/pkgs/tools/networking/keepalived/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "keepalived";
-  version = "2.2.7";
+  version = "2.2.8";

  src = fetchFromGitHub {
    owner = "acassen";
    repo = "keepalived";
    rev = "v${version}";
-    sha256 = "sha256-erpYC4klkgvZ9D+4qM/qIHajsyOGKRbX7lhs6lfWFTQ=";
+    sha256 = "sha256-QkebGQCYE4ccUvcxKG3qQ4wqC+RzxGHim8kgHQbIr5Q=";
  };

  buildInputs = [
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
  '';

  # AOT native-comp, mostly copied from pkgs/build-support/emacs/generic.nix
-  postInstall = lib.optionalString (emacs.nativeComp or false) ''
+  postInstall = lib.optionalString (emacs.withNativeCompilation or false) ''
    mkdir -p $out/share/emacs/native-lisp
    export EMACSLOADPATH=$out/share/emacs/site-lisp/mu4e:
    export EMACSNATIVELOADPATH=$out/share/emacs/native-lisp:
--- a/pkgs/tools/system/bottom/default.nix
+++ b/pkgs/tools/system/bottom/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "bottom";
-  version = "0.9.1";
+  version = "0.9.2";

  src = fetchFromGitHub {
    owner = "ClementTsang";
    repo = pname;
    rev = version;
-    sha256 = "sha256-i1Vd2SA7Xb62gTVY6FdKzNe6ItfYrLXfgo0+VRm+Wdc=";
+    hash = "sha256-QHr4FvoXIqsAE7wE/eFKH18ivagVpZkQbGO7qR0dev8=";
  };

-  cargoHash = "sha256-umBBUbkgVIj9d2eYEJCHjoo0AjH9K2R6C+cps+PkZcA=";
+  cargoHash = "sha256-KsM28vcu/C8orB+TSDGu4nGSpxX1mnEP2Yg7Fu4uh5Q=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/text/mdbook-toc/default.nix
+++ b/pkgs/tools/text/mdbook-toc/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdbook-toc";
-  version = "0.9.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "badboy";
    repo = pname;
    rev = version;
-    sha256 = "sha256-7JpMBQqglLn33HwMBuIR5Hc0ISmzLPjQXGJVRwwl4OU=";
+    sha256 = "sha256-3lAi9ZNtwhA2OtIR4tN2wiztp3pnRxtaGG0MwGEk0u0=";
  };

-  cargoSha256 = "sha256-Vj9DSjJtkexKly8IWlGEQkVrjSHcK1/2i+2g2Ht0eUo=";
+  cargoHash = "sha256-l3ETQ/ARBZmU1wMCK6F/4g6tlxHsEV9D5LO1wue1Jps=";

  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];

--- a/pkgs/tools/typesetting/tex/texlive/UPGRADING.md
+++ b/pkgs/tools/typesetting/tex/texlive/UPGRADING.md
@ -45,24 +45,39 @@ in Nixpkgs matches the one that generated from `texlive.tlpdb.xz`.

 ### Build packages locally and generate fix hashes

-To save disk space and prevent unnecessary rebuilds, texlive packages are built
-as fixed-output derivations whose hashes are contained in `fixedHashes.nix`.
-
-Updating the list of fixed hashes requires a local build of *all* packages,
-which is a resource-intensive process:
+To prevent unnecessary rebuilds, texlive packages are built as fixed-output
+derivations whose hashes are contained in `fixed-hashes.nix`.

+Updating the list of fixed hashes requires a local build of all new packages,
+which is a resource-intensive process. First build the hashes for the new
+packages. Consider tweaking the `-j` option to maximise core usage.

 ```bash
-# move fixedHashes away, otherwise build will fail on updated packages
-mv fixedHashes.nix fixedHashes-old.nix
-# start with empty fixedHashes
-echo '{}' > fixedHashes.nix
-
-nix-build ../../../../.. -Q --no-out-link -A texlive.scheme-full.pkgs | ./fixHashes.awk > ./fixedHashes-new.nix
-
-mv fixedHashes-new.nix fixedHashes.nix
+nix-build generate-fixed-hashes.nix -A newHashes -j 8
 ```

+Then build the Nix expression containing all the hashes, old and new. This step
+cannot be parallelized because it relies on 'import from derivation'.
+
+```bash
+nix-build generate-fixed-hashes.nix -A fixedHashesNix
+```
+
+Finally, copy the result to `fixed-hashes.nix`.
+
+**Warning.** The expression `fixedHashesNix` reuses the *previous* fixed hashes
+when possible. This is based on two assumptions: that `.tar.xz` archives with
+the same names remain identical in time (which is the intended behaviour of
+CTAN and the various mirrors) and that the build recipe continues to produce
+the same output. Should those assumptions not hold, remove the previous fixed
+hashes for the relevant package, or for all packages.
+
 ### Commit changes

-Commit the updated `tlpdb.nix` and `fixedHashes.nix` to the repository.
+Commit the updated `tlpdb.nix` and `fixed-hashes.nix` to the repository with
+a message like
+
+> texlive: 2022-final -> 2023.20230401
+
+Please make sure to follow the [CONTRIBUTING](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md)
+guidelines.
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@ -5,7 +5,7 @@
 , perl, perlPackages, python3Packages, pkg-config
 , libpaper, graphite2, zziplib, harfbuzz, potrace, gmp, mpfr
 , brotli, cairo, pixman, xorg, clisp, biber, woff2, xxHash
-, makeWrapper, shortenPerlShebang
+, makeWrapper, shortenPerlShebang, useFixedHashes
 }:

 # Useful resource covering build options:
@ -17,6 +17,10 @@ let
  year = toString ((import ./tlpdb.nix)."00texlive.config").year;
  version = year; # keep names simple for now

+  # detect and stop redundant rebuilds that may occur when building new fixed hashes
+  assertFixedHash = name: src:
+    if ! useFixedHashes || src ? outputHash then src else throw "The TeX Live package '${src.pname}' must have a fixed hash before building '${name}'.";
+
  common = {
    src = fetchurl {
      urls = [
@ -369,7 +373,7 @@ latexindent = perlPackages.buildPerlPackage rec {
  pname = "latexindent";
  inherit (src) version;

-  src = lib.head (builtins.filter (p: p.tlType == "run") texlive.latexindent.pkgs);
+  src = assertFixedHash pname (lib.head (builtins.filter (p: p.tlType == "run") texlive.latexindent.pkgs));

  outputs = [ "out" ];

@ -401,7 +405,7 @@ pygmentex = python3Packages.buildPythonApplication rec {
  inherit (src) version;
  format = "other";

-  src = lib.head (builtins.filter (p: p.tlType == "run") texlive.pygmentex.pkgs);
+  src = assertFixedHash pname (lib.head (builtins.filter (p: p.tlType == "run") texlive.pygmentex.pkgs));

  propagatedBuildInputs = with python3Packages; [ pygments chardet ];

@ -437,7 +441,7 @@ pygmentex = python3Packages.buildPythonApplication rec {
 texlinks = stdenv.mkDerivation rec {
  name = "texlinks";

-  src = lib.head (builtins.filter (p: p.tlType == "run") texlive.texlive-scripts-extra.pkgs);
+  src = assertFixedHash name (lib.head (builtins.filter (p: p.tlType == "run") texlive.texlive-scripts-extra.pkgs));

  dontBuild = true;
  doCheck = false;
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@ -16,11 +16,9 @@ let
    harfbuzz = harfbuzz.override {
      withIcu = true; withGraphite2 = true;
    };
+    inherit useFixedHashes;
  };

-  # map: name -> fixed-output hash
-  fixedHashes = lib.optionalAttrs useFixedHashes (import ./fixedHashes.nix);
-
  # function for creating a working environment from a set of TL packages
  combine = import ./combine.nix {
    inherit bin combinePkgs buildEnv lib makeWrapper writeText runCommand
@ -59,7 +57,8 @@ let
      };

      texdoc = orig.texdoc // {
-        version = orig.texdoc.version + "-tlpdb-" + (toString tlpdbVersion.revision);
+        extraRevision = ".tlpdb${toString tlpdbVersion.revision}";
+        extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";

        # build Data.tlpdb.lua (part of the 'tlType == "run"' package)
        postUnpack = ''
@ -155,13 +154,24 @@ let
    xzcat "$tlpdbxz" | sed -rn -f "$tl2nix" | uniq > "$out"
  '';

+  # map: name -> fixed-output hash
+  fixedHashes = lib.optionalAttrs useFixedHashes (import ./fixed-hashes.nix);
+
+  # NOTE: the fixed naming scheme must match generated-fixed-hashes.nix
+  # name for the URL
+  mkURLName = { pname, tlType, ... }: pname + lib.optionalString (tlType != "run" && tlType != "tlpkg") ".${tlType}";
+  # name + revision for the fixed output hashes
+  mkFixedName = { tlType, revision, extraRevision ? "", ... }@attrs: mkURLName attrs + (lib.optionalString (tlType == "tlpkg") ".tlpkg") + ".r${toString revision}${extraRevision}";
+  # name + version for the derivation
+  mkTLName = { tlType, version, extraVersion ? "", ... }@attrs: mkURLName attrs + (lib.optionalString (tlType == "tlpkg") ".tlpkg") + "-${version}${extraVersion}";
+
  # create a derivation that contains an unpacked upstream TL package
-  mkPkg = { pname, tlType, revision, version, sha512, postUnpack ? "", stripPrefix ? 1, ... }@args:
+  mkPkg = { pname, tlType, revision, version, sha512, extraRevision ? "", postUnpack ? "", stripPrefix ? 1, ... }@args:
    let
      # the basename used by upstream (without ".tar.xz" suffix)
-      urlName = pname + lib.optionalString (tlType != "run" && tlType != "tlpkg") ".${tlType}";
-      tlName = urlName + lib.optionalString (tlType == "tlpkg") ".tlpkg" + "-${version}";
-      fixedHash = fixedHashes.${tlName} or null; # be graceful about missing hashes
+      urlName = mkURLName args;
+      tlName = mkTLName args;
+      fixedHash = fixedHashes.${mkFixedName args} or null; # be graceful about missing hashes

      urls = args.urls or (if args ? url then [ args.url ] else
        map (up: "${up}/archive/${urlName}.r${toString revision}.tar.xz") (args.urlPrefixes or urlPrefixes));
@ -172,7 +182,7 @@ let
          inherit stripPrefix tlType;
          # metadata for texlive.combine
          passthru = {
-            inherit pname tlType version;
+            inherit pname tlType revision version extraRevision;
          } // lib.optionalAttrs (tlType == "run" && args ? deps) {
            tlDeps = map (n: tl.${n}) args.deps;
          } // lib.optionalAttrs (tlType == "run") {
@ -218,9 +228,13 @@ let
      operator = { pkg, ... }: pkgListToSets (pkg.tlDeps or []);
    });

-  assertions =
-    lib.assertMsg (tlpdbVersion.year == version.texliveYear) "TeX Live year in texlive does not match tlpdb.nix, refusing to evaluate" &&
-    lib.assertMsg (tlpdbVersion.frozen == version.final) "TeX Live final status in texlive does not match tlpdb.nix, refusing to evaluate";
+  assertions = with lib;
+    assertMsg (tlpdbVersion.year == version.texliveYear) "TeX Live year in texlive does not match tlpdb.nix, refusing to evaluate" &&
+    assertMsg (tlpdbVersion.frozen == version.final) "TeX Live final status in texlive does not match tlpdb.nix, refusing to evaluate" &&
+    (!useFixedHashes ||
+      (let all = concatLists (catAttrs "pkgs" (attrValues tl));
+         fods = filter (p: isDerivation p && p.tlType != "bin") all;
+      in builtins.all (p: assertMsg (p ? outputHash) "The TeX Live package '${p.pname + lib.optionalString (p.tlType != "run") ("." + p.tlType)}' does not have a fixed output hash. Please read UPGRADING.md on how to build a new 'fixed-hashes.nix'.") fods));

 in
  tl // {
--- a/pkgs/tools/typesetting/tex/texlive/fixHashes.awk
+++ b/pkgs/tools/typesetting/tex/texlive/fixHashes.awk
@ -1,24 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i "gawk -f" -p gawk
-
-BEGIN {
-  print "{"
-}
-
-/-texlive-/ && !/\.bin/ {
-  if (match($0, /-texlive-([^\/]*)/, m) == 0) {
-    print "No match for \""$0"\"" > "/dev/stderr"
-    exit 1
-  }
-  cmd="nix-hash --type sha256 --base32 "$0
-  if (( cmd | getline hash ) <= 0) {
-    print "Error executing nix-hash" > "/dev/stderr"
-    exit 1
-  }
-  close(cmd)
-  printf("\"%s\"=\"%s\";\n", m[1], hash)
-}
-
-END {
-  print "}"
-}
--- a/pkgs/tools/typesetting/tex/texlive/fixed-hashes.nix
+++ b/pkgs/tools/typesetting/tex/texlive/fixed-hashes.nix
--- a/pkgs/tools/typesetting/tex/texlive/fixedHashes.nix
+++ b/pkgs/tools/typesetting/tex/texlive/fixedHashes.nix
--- a/pkgs/tools/typesetting/tex/texlive/generate-fixed-hashes.nix
+++ b/pkgs/tools/typesetting/tex/texlive/generate-fixed-hashes.nix
@ -0,0 +1,41 @@
+with import ../../../../.. { };
+
+with lib; let
+  # NOTE: the fixed naming scheme must match default.nix
+  # name for the URL
+  mkURLName = { pname, tlType, ... }: pname + lib.optionalString (tlType != "run" && tlType != "tlpkg") ".${tlType}";
+  # name + revision for the fixed output hashes
+  mkFixedName = { tlType, revision, extraRevision ? "", ... }@attrs: mkURLName attrs + (lib.optionalString (tlType == "tlpkg") ".tlpkg") + ".r${toString revision}${extraRevision}";
+
+  uniqueByName = fods: catAttrs "fod" (genericClosure {
+    startSet = map (fod: { key = fod.name; inherit fod; }) fods;
+    operator = _: [ ];
+  });
+
+  # ugly hack to extract combine from collection-latexextra, since it is masked by texlive.combine
+  combine = lib.findFirst (p: (lib.head p.pkgs).pname == "combine") { pkgs = []; } (lib.head texlive.collection-latexextra.pkgs).tlDeps;
+  all = concatLists (map (p: p.pkgs or []) (attrValues (removeAttrs texlive [ "bin" "combine" "combined" "tlpdb" ]))) ++ combine.pkgs;
+
+  # fixed hashes only for run, doc, source, tlpkg types
+  fods = sort (a: b: a.name < b.name) (uniqueByName (filter (p: isDerivation p && p.tlType != "bin") all));
+
+  computeHash = fod: runCommand "${fod.name}-fixed-hash"
+    { buildInputs = [ nix ]; inherit fod; }
+    ''echo -n "$(nix-hash --base32 --type sha256 "$fod")" >"$out"'';
+
+  hash = fod: fod.outputHash or (builtins.readFile (computeHash fod));
+  hashLine = fod: ''
+    "${mkFixedName fod}"="${hash fod}";
+  '';
+in
+{
+  # fixedHashesNix uses 'import from derivation' which does not parallelize well
+  # you should build newHashes first, before evaluating (and building) fixedHashesNix
+  newHashes = map computeHash (filter (fod: ! fod ? outputHash) fods);
+
+  fixedHashesNix = writeText "fixed-hashes.nix"
+  ''
+    {
+    ${lib.concatMapStrings hashLine fods}}
+  '';
+}
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -4605,6 +4605,8 @@ with pkgs;

  dduper = callPackage ../tools/filesystems/dduper { };

+  deck = callPackage ../applications/networking/deck { };
+
  dedup = callPackage ../tools/backup/dedup { };

  deheader = callPackage ../development/tools/misc/deheader { };
@ -9729,6 +9731,8 @@ with pkgs;

  lemmy-help = callPackage ../tools/misc/lemmy-help { };

+  lerpn = callPackage ../tools/misc/lerpn { };
+
  lethe = callPackage ../tools/security/lethe {
    inherit (darwin.apple_sdk.frameworks) Security;
  };