Merge remote-tracking branch 'origin/master' into staging-next

2023-03-06 08:21:14 +01:00 · 2023-03-06 08:21:14 +01:00 · b04848e5fe
commit b04848e5fe
parent 38e74f86e5 21eda9bc80
75 changed files with 1087 additions and 667 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -12308,6 +12308,12 @@
    githubId = 314564;
    name = "Ryan Lahfa";
  };
+  ralismark = {
+    email = "nixpkgs@ralismark.xyz";
+    github = "ralismark";
+    githubId = 13449732;
+    name = "Temmie";
+  };
  raphaelr = {
    email = "raphael-git@tapesoftware.net";
    matrix = "@raphi:tapesoftware.net";
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@ -61,9 +61,9 @@ with lib;
      pinentry = super.pinentry.override { enabledFlavors = [ "curses" "tty" "emacs" ]; withLibsecret = false; };
      qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
      qrencode = super.qrencode.overrideAttrs (_: { doCheck = false; });
-      qt5 = super.qt5.overrideScope' (self': super': {
+      qt5 = super.qt5.overrideScope' (const (super': {
        qtbase = super'.qtbase.override { withGtk3 = false; };
-      });
+      }));
      stoken = super.stoken.override { withGTK3 = false; };
      # translateManpages -> perlPackages.po4a -> texlive-combined-basic -> texlive-core-big -> libX11
      util-linux = super.util-linux.override { translateManpages = false; };
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@ -461,7 +461,7 @@ let

          ${ipPreMove} link add dev "${name}" type wireguard
          ${optionalString (values.interfaceNamespace != null && values.interfaceNamespace != values.socketNamespace) ''${ipPreMove} link set "${name}" netns "${ns}"''}
-          ${optionalString (values.mtu != null) ''${ipPreMove} link set "${name}" mtu ${toString values.mtu}''}
+          ${optionalString (values.mtu != null) ''${ipPostMove} link set "${name}" mtu ${toString values.mtu}''}

          ${concatMapStringsSep "\n" (ip:
            ''${ipPostMove} address add "${ip}" dev "${name}"''
--- a/nixos/modules/services/web-apps/dolibarr.nix
+++ b/nixos/modules/services/web-apps/dolibarr.nix
@ -5,7 +5,7 @@ let
  package = pkgs.dolibarr.override { inherit (cfg) stateDir; };

  cfg = config.services.dolibarr;
-  vhostCfg = lib.optionalAttr (cfg.nginx != null) config.services.nginx.virtualHosts."${cfg.domain}";
+  vhostCfg = lib.optionalAttrs (cfg.nginx != null) config.services.nginx.virtualHosts."${cfg.domain}";

  mkConfigFile = filename: settings:
    let
--- a/nixos/tests/systemd-initrd-simple.nix
+++ b/nixos/tests/systemd-initrd-simple.nix
@ -6,9 +6,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
      enable = true;
      emergencyAccess = true;
    };
-    fileSystems = lib.mkVMOverride {
-      "/".autoResize = true;
-    };
+    virtualisation.fileSystems."/".autoResize = true;
  };

  testScript = ''
--- a/nixos/tests/wireguard/namespaces.nix
+++ b/nixos/tests/wireguard/namespaces.nix
@ -39,6 +39,7 @@ import ../make-test-python.nix ({ pkgs, lib, kernelPackages ? null, ... } : {
        preSetup = ''
          ip netns add ${interfaceNamespace}
        '';
+        mtu = 1280;
        inherit interfaceNamespace;
      };
    };
--- a/pkgs/applications/blockchains/monero-cli/default.nix
+++ b/pkgs/applications/blockchains/monero-cli/default.nix
@ -6,16 +6,32 @@
 , trezorSupport ? true, libusb1, protobuf, python3
 }:

+let
+  # submodules
+  supercop = fetchFromGitHub {
+    owner = "monero-project";
+    repo = "supercop";
+    rev = "633500ad8c8759995049ccd022107d1fa8a1bbc9";
+    sha256 = "26UmESotSWnQ21VbAYEappLpkEMyl0jiuCaezRYd/sE=";
+  };
+  trezor-common = fetchFromGitHub {
+    owner = "trezor";
+    repo = "trezor-common";
+    rev = "bff7fdfe436c727982cc553bdfb29a9021b423b0";
+    sha256 = "VNypeEz9AV0ts8X3vINwYMOgO8VpNmyUPC4iY3OOuZI=";
+  };
+
+in
+
 stdenv.mkDerivation rec {
  pname = "monero-cli";
-  version = "0.18.1.2";
+  version = "0.18.2.0";

  src = fetchFromGitHub {
    owner = "monero-project";
    repo = "monero";
    rev = "v${version}";
-    sha256 = "sha256-yV1ysoesEcjL+JX6hkmcrBDmazOWBvYK6EjshxJzcAw=";
-    fetchSubmodules = true;
+    sha256 = "n2e5U3p0eG2atPYV86H2UAURwsIkeSOBm8iwYsDVAoc=";
  };

  patches = [
@ -23,8 +39,10 @@ stdenv.mkDerivation rec {
  ];

  postPatch = ''
-    # remove vendored libraries
-    rm -r external/{miniupnp,randomx,rapidjson}
+    # manually install submodules
+    rmdir external/{supercop,trezor-common}
+    ln -sf ${supercop} external/supercop
+    ln -sf ${trezor-common} external/trezor-common
    # export patched source for monero-gui
    cp -r . $source
  '';
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "monero-gui";
-  version = "0.18.1.2";
+  version = "0.18.2.0";

  src = fetchFromGitHub {
    owner = "monero-project";
    repo = "monero-gui";
    rev = "v${version}";
-    sha256 = "sha256-GBILqNkYQUkil1qvYnJTkHwgK3dzKR9I9GVbbLy/0UU=";
+    sha256 = "Bm6OpK1jjdWVqdp6HpirqP6+3GcMSZfZ/e70wcu+rQc=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
@ -1,7 +1,10 @@
 { lib, pkgs }:

-self: with self; {
-
+self:
+let
+  inherit (pkgs) callPackage;
+in
+{
  agda-input = callPackage ./manual-packages/agda-input { };

  agda2-mode = callPackage ./manual-packages/agda2-mode { };
@ -84,8 +87,8 @@ self: with self; {
  sunrise-commander = callPackage ./manual-packages/sunrise-commander { };

  # camelCase aliases for some of the kebab-case expressions above
-  colorThemeSolarized = color-theme-solarized;
-  emacsSessionManagement = session-management-for-emacs;
-  rectMark = rect-mark;
-  sunriseCommander = sunrise-commander;
+  colorThemeSolarized = self.color-theme-solarized;
+  emacsSessionManagement = self.session-management-for-emacs;
+  rectMark = self.rect-mark;
+  sunriseCommander = self.sunrise-commander;
 }
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@ -425,6 +425,18 @@ let

        rtags-xref = dontConfigure super.rtags;

+        rime = super.rime.overrideAttrs (old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.librime ];
+          preBuild = (old.preBuild or "") + ''
+            make lib
+            mkdir -p /build/rime-lib
+            cp *.so /build/rime-lib
+          '';
+          postInstall = (old.postInstall or "") + ''
+            install -m444 -t $out/share/emacs/site-lisp/elpa/rime-* /build/rime-lib/*.so
+          '';
+        });
+
        shm = super.shm.overrideAttrs (attrs: {
          propagatedUserEnvPkgs = [ pkgs.haskellPackages.structured-haskell-mode ];
        });
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -39,6 +39,7 @@
 , statix
 , stylish-haskell
 , tabnine
+, taskwarrior
 , tmux
 , tup
 , vim
@ -894,6 +895,10 @@ self: super: {
      };
    });

+  taskwarrior = buildVimPluginFrom2Nix {
+    inherit (taskwarrior) version pname;
+    src = "${taskwarrior.src}/scripts/vim";
+  };
  telescope-cheat-nvim = super.telescope-cheat-nvim.overrideAttrs (old: {
    dependencies = with self; [ sqlite-lua telescope-nvim ];
  });
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@ -31,13 +31,13 @@

 stdenv.mkDerivation rec {
  pname = "cemu";
-  version = "2.0-26";
+  version = "2.0-28";

  src = fetchFromGitHub {
    owner = "cemu-project";
    repo = "Cemu";
    rev = "v${version}";
-    hash = "sha256-+y+PJE2biRvuxIwrFVMjmkZyD8/zhHVMw6vzNKlsOZE=";
+    hash = "sha256-qKrj3XPtFVy0/KH18D0oCeVUQQmIdkYJYrCKD82c/+s=";
  };

  patches = [
--- a/pkgs/applications/graphics/rnote/default.nix
+++ b/pkgs/applications/graphics/rnote/default.nix
@ -23,19 +23,19 @@

 stdenv.mkDerivation rec {
  pname = "rnote";
-  version = "0.5.14";
+  version = "0.5.16";

  src = fetchFromGitHub {
    owner = "flxzt";
    repo = "rnote";
    rev = "v${version}";
-    hash = "sha256-55hB8UyK+EPJ6/Yj5yNK6endNU9Ux/kZmQNjcrYq6KU=";
+    hash = "sha256-blpANUfFam46Vyyc3vaB7vX07CRMtdMZR2n7FOLGgaU=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-NPRImc0nVhYgq9JfGoSM1mT1Z6KQjVWgoLIagOUCM5M=";
+    hash = "sha256-vVU/OVwtIPRw1Ohe5EIqovhyd4oYOR7CPISz8Zo74r0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/fead/default.nix
+++ b/pkgs/applications/misc/fead/default.nix
@ -0,0 +1,37 @@
+{ lib, stdenv, fetchFromSourcehut, python3, help2man }:
+
+stdenv.mkDerivation rec {
+  pname = "fead";
+  version = "0.1.3";
+
+  src = fetchFromSourcehut {
+    owner = "~cnx";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-cW0GxyvC9url2QAAWD0M2pR4gBiPA3eeAaw77TwMV/0=";
+  };
+
+  nativeBuildInputs = [ help2man ];
+  buildInputs = [ python3 ];
+
+  # Needed for man page generation in build phase
+  postPatch = ''
+    patchShebangs src/fead.py
+  '';
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  # Already done in postPatch phase
+  dontPatchShebangs = true;
+
+  # The package has no tests.
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Advert generator from web feeds";
+    homepage = "https://git.sr.ht/~cnx/fead";
+    license = licenses.agpl3Plus;
+    changelog = "https://git.sr.ht/~cnx/fead/refs/${version}";
+    maintainers = with maintainers; [ McSinyx ];
+  };
+}
--- a/pkgs/applications/misc/limesctl/default.nix
+++ b/pkgs/applications/misc/limesctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "limesctl";
-  version = "3.1.3";
+  version = "3.2.0";

  src = fetchFromGitHub {
    owner = "sapcc";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-fi36jsQr/Mn1FyOlle/WSpREQgZU6+h4IJzd3ZfItvI=";
+    sha256 = "sha256-/9focZIm6tVnkAGIZYTJ9uewXKLv/x74LEMUZbXInb0=";
  };

-  vendorSha256 = "sha256-gcIPASIk4Zq8y+KppYNRkf/9guCsYv9XskFANrqOCts=";
+  vendorHash = "sha256-Zc8X29tsSsM/tkSYvplF1LxBS76eSs+cm5Li3OE/3o8=";

  subPackages = [ "." ];

--- a/pkgs/applications/misc/taskwarrior/default.nix
+++ b/pkgs/applications/misc/taskwarrior/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, libuuid, gnutls, python3, xdg-utils }:
+{ lib, stdenv, fetchFromGitHub, cmake, libuuid, gnutls, python3, xdg-utils, installShellFiles }:

 stdenv.mkDerivation rec {
  pname = "taskwarrior";
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
      --replace "xdg-open" "${lib.getBin xdg-utils}/bin/xdg-open"
  '';

-  nativeBuildInputs = [ cmake libuuid gnutls python3 ];
+  nativeBuildInputs = [ cmake libuuid gnutls python3 installShellFiles ];

  doCheck = true;
  preCheck = ''
@ -26,10 +26,17 @@ stdenv.mkDerivation rec {
  checkTarget = "test";

  postInstall = ''
-    mkdir -p "$out/share/bash-completion/completions"
-    ln -s "../../doc/task/scripts/bash/task.sh" "$out/share/bash-completion/completions/task.bash"
-    mkdir -p "$out/share/fish/vendor_completions.d"
-    ln -s "../../../share/doc/task/scripts/fish/task.fish" "$out/share/fish/vendor_completions.d/"
+    # ZSH is installed automatically from some reason, only bash and fish need
+    # manual installation
+    installShellCompletion --cmd task \
+      --bash $out/share/doc/task/scripts/bash/task.sh \
+      --fish $out/share/doc/task/scripts/fish/task.fish
+    rm -r $out/share/doc/task/scripts/bash
+    rm -r $out/share/doc/task/scripts/fish
+    # Install vim and neovim plugin
+    mkdir -p $out/share/vim-plugins $out/share/nvim/site
+    mv $out/share/doc/task/scripts/vim $out/share/vim-plugins/task
+    ln -s $out/share/vim-plugins/task $out/share/nvim/site/task
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
@ -1,51 +1,55 @@
-{ stdenv, lib, fetchurl, autoPatchelfHook, dpkg, awscli, unzip }:
-let
-  ver = "1.2.331.0";
-  source = {
-    url = rec {
-      "x86_64-linux" = "https://s3.amazonaws.com/session-manager-downloads/plugin/${ver}/ubuntu_64bit/session-manager-plugin.deb";
-      "aarch64-linux" = "https://s3.amazonaws.com/session-manager-downloads/plugin/${ver}/ubuntu_arm64/session-manager-plugin.deb";
-      "x86_64-darwin" = "https://s3.amazonaws.com/session-manager-downloads/plugin/${ver}/mac/sessionmanager-bundle.zip";
-      "aarch64-darwin" = x86_64-darwin;
-    }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-    sha256 = rec {
-      "x86_64-linux" = "sha256-xWnY89dslkGhRTh9llRFkuUqYIjHQNt+TLnkPQr3u1Q=";
-      "aarch64-linux" = "sha256-QE6+EjLoydTPuLitG6fALXAtvIkfyoFuWij8Z2HT6+Q=";
-      "x86_64-darwin" = "0gr6frdn9jvxnkymkcpvgkqw4z2sac9jdf5qj4hzakq1zkfviazf";
-      "aarch64-darwin" = x86_64-darwin;
-    }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-  archivePath = if stdenv.isDarwin then "sessionmanager-bundle" else "usr/local/sessionmanagerplugin";
-in
-stdenv.mkDerivation rec {
+{ stdenv
+, lib
+, fetchFromGitHub
+, buildGo120Package
+}:
+
+buildGo120Package rec {
  pname = "ssm-session-manager-plugin";
-  version = ver;
+  version = "1.2.398.0";

-  src = fetchurl source;
+  goPackagePath = "github.com/aws/session-manager-plugin";

-  nativeBuildInputs = lib.optionals stdenv.isLinux [
-    autoPatchelfHook
-    dpkg
-  ] ++ lib.optionals stdenv.isDarwin [
-    unzip
-  ];
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "session-manager-plugin";
+    rev = version;
+    sha256 = "ufNnr/sxOHUDUsGXwxp1yloVAI6DMtuEdjcQZ2XaHRg=";
+  };

-  unpackPhase = if stdenv.isDarwin then "unzip $src" else "dpkg-deb -x $src .";
+  postPatch = ''
+    mv vendor{,-old}
+    mv vendor-old/src vendor
+    rm -r vendor-old
+  '';
+
+  preBuild = ''
+    pushd go/src/${lib.escapeShellArg goPackagePath}
+    echo -n ${lib.escapeShellArg version} > VERSION
+    go run src/version/versiongenerator/version-gen.go
+    popd
+  '';
+
+  doCheck = true;
+  checkFlags = "-skip TestSetSessionHandlers";
+
+  preCheck = ''
+    if ! [[ $(go/bin/sessionmanagerplugin-main --version) = ${lib.escapeShellArg version} ]]; then
+      echo 'wrong version'
+      exit 1
+    fi
+  '';

  installPhase = ''
    runHook preInstall
-
-    install -m755 -D ${archivePath}/bin/session-manager-plugin $out/bin/session-manager-plugin
-
+    install -Dm555 go/bin/sessionmanagerplugin-main "$out/bin/session-manager-plugin"
    runHook postInstall
  '';

  meta = with lib; {
    homepage = "https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html";
    description = "Amazon SSM Session Manager Plugin";
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [ mbaillie ];
+    license = licenses.asl20;
+    maintainers = with maintainers; [ amarshall mbaillie ];
  };
 }
--- a/pkgs/applications/networking/cluster/temporal/default.nix
+++ b/pkgs/applications/networking/cluster/temporal/default.nix
@ -25,6 +25,9 @@ buildGoModule rec {
  installPhase = ''
    runHook preInstall

+    mkdir -p $out/share
+    cp -r ./schema $out/share/
+
    install -Dm755 "$GOPATH/bin/server" -T $out/bin/temporal-server
    install -Dm755 "$GOPATH/bin/cassandra" -T $out/bin/temporal-cassandra-tool
    install -Dm755 "$GOPATH/bin/sql" -T $out/bin/temporal-sql-tool
--- a/pkgs/applications/networking/coreth/default.nix
+++ b/pkgs/applications/networking/coreth/default.nix
@ -6,19 +6,19 @@

 buildGoModule rec {
  pname = "coreth";
-  version = "0.11.7";
+  version = "0.11.8";

  src = fetchFromGitHub {
    owner = "ava-labs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-PMjgEZ7D1peoW5ubOB/QrnmKVZs4/ToIBKH9zBT1J10=";
+    hash = "sha256-O6dTbhnZPWd7BKMwaPfUOPwcvwzQoHUKR9Zj7uKqtGM=";
  };

  # go mod vendor has a bug, see: golang/go#57529
  proxyVendor = true;

-  vendorHash = "sha256-Ne3+NJsEJKjvkLShJxiiOq/UoORF7ggv/j7ltPgrSfQ=";
+  vendorHash = "sha256-nJA83SfMv+5xKKyJTtaSRsro1XR+3sNiszBeXRRY5NA=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dnscontrol";
-  version = "3.26.0";
+  version = "3.27.1";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-wkPBMFsPLJFfilKuA3bGNn7NtC+wsnXZf+qkVpF2fWc=";
+    sha256 = "sha256-WXYmV4QE0OPv1reYX+YrmqGdnRUDHXBt60NIUDLTDLk=";
  };

-  vendorHash = "sha256-U7RQPrvByTADC2/8O0cvcf0nmDgIeVkuyRGV0fpSCPk=";
+  vendorHash = "sha256-FxKmFDx5ckLm8uJB9ouYSwjX+Pu20In6ertGzhhlEwA=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/networking/pcloud/default.nix
+++ b/pkgs/applications/networking/pcloud/default.nix
@ -38,12 +38,12 @@

 let
  pname = "pcloud";
-  version = "1.10.1";
-  code = "XZwHPTVZ7J1WFU374k8BqSWO2519y4aGFdAV";
+  version = "1.11.0";
+  code = "XZspqgVZxM1CCER1we0esiDGuAxshjRSY77X";
  # Archive link's codes: https://www.pcloud.com/release-notes/linux.html
  src = fetchzip {
    url = "https://api.pcloud.com/getpubzip?code=${code}&filename=${pname}-${version}.zip";
-    hash = "sha256-Mum1SL/EZ7iFK9e3o+T0CxkAQ0FkjSBy2FEUDonxtTI=";
+    hash = "sha256-EXJ+5LwVF5lTXc5zlppRQLCm0EZwqG3ndfK4LIjmWwc=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/video/obs-studio/plugins/obs-hyperion/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-hyperion/default.nix
@ -3,35 +3,28 @@

 stdenv.mkDerivation rec {
  pname = "obs-hyperion";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "hyperion-project";
    repo = "hyperion-obs-plugin";
    rev = version;
-    sha256 = "sha256-pfWfJWuIoa+74u5J76/GE+OuHkksbwOAPfsR9OGX3L4=";
+    sha256 = "sha256-UAfjafoZhhhHRSo+eUBLhHaCmn2GYFcYyRb9wHIp/9I=";
  };

-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ obs-studio libGL qtbase ];
+  nativeBuildInputs = [ cmake flatbuffers pkg-config ];
+  buildInputs = [ obs-studio flatbuffers libGL qtbase ];

  dontWrapQtApps = true;

  cmakeFlags = [
    "-DOBS_SOURCE=${obs-studio.src}"
    "-DGLOBAL_INSTALLATION=ON"
+    "-DUSE_SYSTEM_FLATBUFFERS_LIBS=ON"
  ];

  preConfigure = ''
-    # https://github.com/hyperion-project/hyperion-obs-plugin/issues/7
    rm -rf external/flatbuffers
-    cp -r ${flatbuffers.src} external/flatbuffers
-    chmod -R a+w external
-  '';
-
-  postInstall = ''
-    # Remove flatbuffers install
-    rm -rf $out/bin $out/lib/{libflatbuffers.a,cmake,pkgconfig} $out/include
  '';

  meta = with lib; {
--- a/pkgs/applications/virtualization/lkl/lkl-defconfig-enable-nftables
+++ b/pkgs/applications/virtualization/lkl/lkl-defconfig-enable-nftables
@ -198,6 +198,7 @@ CONFIG_NFT_BRIDGE_META=y
 CONFIG_NFT_BRIDGE_REJECT=y
 CONFIG_NFT_COMPAT=y
 CONFIG_NFT_CONNLIMIT=y
+CONFIG_NFT_COUNTER=y
 CONFIG_NFT_CT=y
 CONFIG_NFT_DUP_IPV4=y
 CONFIG_NFT_DUP_IPV6=y
--- a/pkgs/applications/window-managers/hikari/default.nix
+++ b/pkgs/applications/window-managers/hikari/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "hikari";
-  version = "2.3.2";
+  version = "2.3.3";

  src = fetchzip {
    url = "https://hikari.acmelabs.space/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-At4b6mkArKe6knNWouLdZ9v8XhfHaUW+aB+CHyEBg8o=";
+    sha256 = "sha256-5Ug0U3ESC5F/gj7bahnLYkeY/weSCj0QASwdFuWwdMI=";
  };

  nativeBuildInputs = [ pkg-config bmake ];
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "19.0.1";
+  version = "20.0.0";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-nkW9sp7AdaClNTuyC97S0bS6vgVeJQBphfoVOaexnBs=";
+    hash = "sha256-JXlv9/P5tBAnRVNCBavG5AtM11Q6mikTN+Qu+u3pLP0=";
  };

-  npmDepsHash = "sha256-LWFHlVGYvOJzdCT2Y86VSzsf/fLJ3B9cJAkBkZyUrMM=";
+  npmDepsHash = "sha256-fecGkN6MEdBP8UokBY/w0TnPOC93KsAISEg3VW0bvHU=";

  nativeBuildInputs = [
    remarshal
@ -127,7 +127,8 @@ buildNpmPackage rec {
  meta = with lib; {
    homepage = "https://typeof.net/Iosevka/";
    downloadPage = "https://github.com/be5invis/Iosevka/releases";
-    description = ''
+    description = "Versatile typeface for code, from code.";
+    longDescription = ''
      Iosevka is an open-source, sans-serif + slab-serif, monospace +
      quasi‑proportional typeface family, designed for writing code, using in
      terminals, and preparing technical documents.
--- a/pkgs/data/fonts/lxgw-neoxihei/default.nix
+++ b/pkgs/data/fonts/lxgw-neoxihei/default.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lxgw-neoxihei";
-  version = "1.006";
+  version = "1.007";

  src = fetchurl {
    url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-n7TTunWOHGWLxvs75r5My1il0KELOZbAgTGqtMpQ+mQ=";
+    hash = "sha256-ChYpRCw8DAo8bo6fJ+5LyF+FGmER+4nY2aEx1GIROdU=";
  };

  dontUnpack = true;
--- a/pkgs/development/compilers/intel-graphics-compiler/default.nix
+++ b/pkgs/development/compilers/intel-graphics-compiler/default.nix
@ -19,8 +19,8 @@ let
  vc_intrinsics_src = fetchFromGitHub {
    owner = "intel";
    repo = "vc-intrinsics";
-    rev = "v0.7.1";
-    sha256 = "sha256-bpi4hLpov1CbFy4jr9Eytc5O4ismYw0J+KgXyZtQYks=";
+    rev = "v0.11.0";
+    sha256 = "sha256-74JBW7qU8huSqwqgxNbvbGj1DlJJThgGhb3owBYmhvI=";
  };

  llvmPkgs = llvmPackages_11 // {
@ -33,13 +33,13 @@ in

 stdenv.mkDerivation rec {
  pname = "intel-graphics-compiler";
-  version = "1.0.12504.5";
+  version = "1.0.12812.26";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "intel-graphics-compiler";
    rev = "igc-${version}";
-    sha256 = "sha256-Ok+cXMTBABrHHM4Vc2yzlou48YHoQnaB3We8mGZhSwI=";
+    sha256 = "sha256-KpaDaDYVp40H7OscDGUpzEMgIOIk397ANi+8sDk4Wow=";
  };

  nativeBuildInputs = [ cmake bison flex python3 ];
--- a/pkgs/development/compilers/mlkit/default.nix
+++ b/pkgs/development/compilers/mlkit/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "mlkit";
-  version = "4.7.2";
+  version = "4.7.3";

  src = fetchFromGitHub {
    owner = "melsman";
    repo = "mlkit";
    rev = "v${version}";
-    sha256 = "sha256-KENOWWyDduIoK7sym9vHKAojRZAR5lYVOtz8I4Z65R0=";
+    sha256 = "sha256-sJY2w1+hv5KrRunf6Dfwc+eY6X9HYghVyAlWLlHvv+E=";
  };

  nativeBuildInputs = [ autoreconfHook mlton ];
--- a/pkgs/development/libraries/gvm-libs/default.nix
+++ b/pkgs/development/libraries/gvm-libs/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , cmake
+, doxygen
 , fetchFromGitHub
 , glib
 , glib-networking
@ -14,6 +15,7 @@
 , libuuid
 , libxcrypt
 , libxml2
+, paho-mqtt-c
 , pkg-config
 , zlib
 , freeradius
@ -21,17 +23,18 @@

 stdenv.mkDerivation rec {
  pname = "gvm-libs";
-  version = "21.4.4";
+  version = "22.4.4";

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-Ps8J9JuLKcrowl9wgZ3Wm7JTXyiejQPDr4OV/IvDy+I=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qsEIjoaq+iBl6iTdSXrxf7LYin/qiGtJ/LaD4bONbI0=";
  };

  nativeBuildInputs = [
    cmake
+    doxygen
    pkg-config
  ];

@ -49,6 +52,7 @@ stdenv.mkDerivation rec {
    libuuid
    libxcrypt
    libxml2
+    paho-mqtt-c
    zlib
  ];

@ -59,6 +63,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Libraries module for the Greenbone Vulnerability Management Solution";
    homepage = "https://github.com/greenbone/gvm-libs";
+    changelog = "https://github.com/greenbone/gvm-libs/releases/tag/v${version}";
    license = with licenses; [ gpl2Plus ];
    maintainers = with maintainers; [ fab ];
    platforms = platforms.linux;
--- a/pkgs/development/libraries/level-zero/default.nix
+++ b/pkgs/development/libraries/level-zero/default.nix
@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    homepage = "https://www.oneapi.io/";
    description = "oneAPI Level Zero Specification Headers and Loader";
+    homepage = "https://github.com/oneapi-src/level-zero";
    license = licenses.mit;
    maintainers = [ maintainers.ziguana ];
  };
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -3,6 +3,7 @@
 , withZlib ? false, zlib
 , enableSSL2 ? false
 , enableSSL3 ? false
+, enableKTLS ? stdenv.isLinux
 , static ? stdenv.hostPlatform.isStatic
 # Used to avoid cross compiling perl, for example, in darwin bootstrap tools.
 # This will cause c_rehash to refer to perl via the environment, but otherwise
@ -134,7 +135,7 @@ let
      ++ lib.optional enableSSL3 "enable-ssl3"
      # We select KTLS here instead of the configure-time detection (which we patch out).
      # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it.
-      ++ lib.optional (stdenv.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls"
+      ++ lib.optional (lib.versionAtLeast version "3.0.0" && enableKTLS) "enable-ktls"
      ++ lib.optional (lib.versionAtLeast version "1.1.1" && stdenv.hostPlatform.isAarch64) "no-afalgeng"
      # OpenSSL needs a specific `no-shared` configure flag.
      # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "simdjson";
-  version = "3.1.2";
+  version = "3.1.3";

  src = fetchFromGitHub {
    owner = "simdjson";
    repo = "simdjson";
    rev = "v${version}";
-    sha256 = "sha256-Yc4P54cn7cvP+ythlmOMIkDz7PuutJXsgkGhNUcoxvc=";
+    sha256 = "sha256-VDwpCPyjhkXgehcMJs6srD3PFtlC2m4jurJum6wNeVY=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/nim-packages/asciigraph/default.nix
+++ b/pkgs/development/nim-packages/asciigraph/default.nix
@ -0,0 +1,22 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "asciigraph";
+  version = "unstable-2021-03-02";
+
+  src = fetchFromGitHub {
+    owner = "Yardanico";
+    repo = "asciigraph";
+    rev = "9f51fc4e94d0960ab63fa6ea274518159720aa69";
+    hash = "sha256-JMBAW8hkE2wuXkRt4aHqFPoz1HX1J4SslvcaQXfpDNk";
+  };
+
+  doCheck = true;
+
+  meta = with lib;
+    src.meta // {
+      description = "Console ascii line graphs in pure Nim";
+      license = [ licenses.mit ];
+      maintainers = with maintainers; [ sikmir ];
+    };
+}
--- a/pkgs/development/nim-packages/illwill/default.nix
+++ b/pkgs/development/nim-packages/illwill/default.nix
@ -0,0 +1,20 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "illwill";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "johnnovak";
+    repo = "illwill";
+    rev = "v${version}";
+    hash = "sha256-9YBkad5iUKRb375caAuoYkfp5G6KQDhX/yXQ7vLu/CA=";
+  };
+
+  meta = with lib;
+    src.meta // {
+      description = "A curses inspired simple cross-platform console library for Nim";
+      license = [ licenses.wtfpl ];
+      maintainers = with maintainers; [ sikmir ];
+    };
+}
--- a/pkgs/development/nim-packages/parsetoml/default.nix
+++ b/pkgs/development/nim-packages/parsetoml/default.nix
@ -0,0 +1,22 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "parsetoml";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "NimParsers";
+    repo = "parsetoml";
+    rev = "v${version}";
+    hash = "sha256-jtqn59x2ZRRgrPir6u/frsDHnl4kvTJWpbejxti8aHY=";
+  };
+
+  doCheck = true;
+
+  meta = with lib;
+    src.meta // {
+      description = "A Nim library to parse TOML files";
+      license = [ licenses.mit ];
+      maintainers = with maintainers; [ sikmir ];
+    };
+}
--- a/pkgs/development/ocaml-modules/fiber/default.nix
+++ b/pkgs/development/ocaml-modules/fiber/default.nix
@ -1,22 +1,23 @@
-{ lib, buildDunePackage, dune_3, stdune, dyn }:
+{ lib, buildDunePackage, fetchFromGitHub, stdune, dyn }:

 buildDunePackage rec {
  pname = "fiber";
-  inherit (dune_3) src version;
+  version = "unstable-2023-02-28";
+
+  src = fetchFromGitHub {
+    owner = "ocaml-dune";
+    repo = "fiber";
+    rev = "5563b588c1313f128eafa74d66f0626c9128d34d";
+    hash = "sha256-18GfGXpu+uiIiCuLhIx5z5jRkem1nNWaQB6Ms0AE9sE=";
+  };

  duneVersion = "3";

-  dontAddPrefix = true;
-
  buildInputs = [ stdune dyn ];

-  preBuild = ''
-    rm -r vendor/csexp
-  '';
-
  meta = with lib; {
    description = "Structured concurrency library";
-    inherit (dune_3.meta) homepage;
+    homepage = "https://github.com/ocaml-dune/fiber";
    maintainers = with lib.maintainers; [ ];
    license = licenses.mit;
  };
--- a/pkgs/development/ocaml-modules/sedlex/default.nix
+++ b/pkgs/development/ocaml-modules/sedlex/default.nix
@ -6,13 +6,19 @@
 , gen
 , ppxlib
 , uchar
+, ppx_expect
 }:

 let param =
-  if lib.versionAtLeast ppxlib.version "0.26.0" then {
-    version = "3.0";
-    sha256 = "sha256-+4ggynMznVfjviMBjXil8CXdMByq4kSmDz6P2PyEETA=";
-  } else {
+  if lib.versionAtLeast ppxlib.version "0.26.0" then
+    if lib.versionAtLeast ocaml.version "4.14" then {
+      version = "3.1";
+      sha256 = "sha256-qG8Wxd/ATwoogeKJDyt5gkGhP5Wvc0j0mMqcoVDkeq4=";
+    } else {
+      version = "3.0";
+      sha256 = "sha256-+4ggynMznVfjviMBjXil8CXdMByq4kSmDz6P2PyEETA=";
+    }
+  else {
    version = "2.5";
    sha256 = "sha256:062a5dvrzvb81l3a9phljrhxfw9nlb61q341q0a6xn65hll3z2wy";
  }
@ -34,6 +40,7 @@ let
    url = "${baseUrl}/ucd/PropList.txt";
    sha256 = "sha256-4FwKKBHRE9rkq9gyiEGZo+qNGH7huHLYJAp4ipZUC/0=";
  };
+  atLeast31 = lib.versionAtLeast param.version "3.1";
 in
 buildDunePackage rec {
  pname = "sedlex";
@ -49,7 +56,10 @@ buildDunePackage rec {
  };

  propagatedBuildInputs = [
-    gen uchar ppxlib
+    gen
+    ppxlib
+  ] ++ lib.optionals (!atLeast31) [
+    uchar
  ];

  preBuild = ''
@ -59,6 +69,10 @@ buildDunePackage rec {
    ln -s ${PropList} src/generator/data/PropList.txt
  '';

+  checkInputs = lib.optionals atLeast31 [
+    ppx_expect
+  ];
+
  doCheck = true;

  dontStrip = true;
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "bthome-ble";
-  version = "2.7.0";
+  version = "2.8.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-wt/TA8bymjYgYSb63Viqf6ToUE1ffa2a3SEVFuTHh94=";
+    hash = "sha256-SdYS/S3wBmIl/f+0H67PcMRX7GiJqAkysvlENshB1yY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/drf-spectacular-sidecar/default.nix
+++ b/pkgs/development/python-modules/drf-spectacular-sidecar/default.nix
@ -6,13 +6,14 @@

 buildPythonPackage rec {
  pname = "drf-spectacular-sidecar";
-  version = "2022.11.1";
+  version = "2023.3.1";
+  format = "setuptools";

  src = fetchFromGitHub {
    owner = "tfranzel";
    repo = "drf-spectacular-sidecar";
    rev = version;
-    hash = "sha256-ztUdV+Bhi3zx5UiwnpiQM/RglUH1n9J48Beuq2GPWdg=";
+    hash = "sha256-UTH6t/znN4nYnqDhtFFxXoBXX8Zo19pJE9iDsvw7bGE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dtlssocket/default.nix
+++ b/pkgs/development/python-modules/dtlssocket/default.nix
@ -3,21 +3,25 @@
 , fetchPypi
 , autoconf
 , cython
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "dtlssocket";
-  version = "0.1.12";
+  version = "0.1.14";
+
+  format = "pyproject";

  src = fetchPypi {
    pname = "DTLSSocket";
    inherit version;
-    sha256 = "909a8f52f1890ec9e92fd46ef609daa8875c2a1c262c0b61200e73c6c2dd5099";
+    hash = "sha256-BLNfdKDKUvc+BJnhLqx7VzJg0opvrdaXhNLCigLH02k=";
  };

  nativeBuildInputs = [
    autoconf
    cython
+    setuptools
  ];

  # no tests on PyPI, no tags on GitLab
--- a/pkgs/development/python-modules/evaluate/default.nix
+++ b/pkgs/development/python-modules/evaluate/default.nix
@ -0,0 +1,70 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pythonRelaxDepsHook
+, pytestCheckHook
+, datasets
+, dill
+, fsspec
+, huggingface-hub
+, importlib-metadata
+, multiprocess
+, numpy
+, packaging
+, pandas
+, requests
+, responses
+, tqdm
+, xxhash
+}:
+
+buildPythonPackage rec {
+  pname = "evaluate";
+  version = "0.4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "huggingface";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-O3W2m12R94iY3F7xgkIiiIyqI6vqiZPXn4jAqEDjVCw=";
+  };
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+  pythonRelaxDeps = [ "responses" ];
+
+  propagatedBuildInputs = [
+    datasets
+    numpy
+    dill
+    pandas
+    requests
+    tqdm
+    xxhash
+    multiprocess
+    fsspec
+    huggingface-hub
+    packaging
+    responses
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
+
+  # most tests require internet access.
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "evaluate"
+  ];
+
+  meta = with lib; {
+    homepage = "https://huggingface.co/docs/evaluate/index";
+    description = "Easily evaluate machine learning models and datasets";
+    changelog = "https://github.com/huggingface/evaluate/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
--- a/pkgs/development/python-modules/fastai/default.nix
+++ b/pkgs/development/python-modules/fastai/default.nix
@ -18,13 +18,14 @@

 buildPythonPackage rec {
  pname = "fastai";
-  version = "2.7.10";
+  version = "2.7.11";
  format = "setuptools";
-  disabled = pythonOlder "3.6";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-zO9qGFrjpjfvybzZ/qjki3X0VNDrrTtt9CbyL64gA50=";
+    hash = "sha256-xrOhdmrCWvsPtCFDsnUxiSd7ox+Pgpmte5LyNPCHRYU=";
  };

  propagatedBuildInputs = [
@ -47,6 +48,7 @@ buildPythonPackage rec {
  meta = with lib; {
    homepage = "https://github.com/fastai/fastai";
    description = "The fastai deep learning library";
+    changelog = "https://github.com/fastai/fastai/blob/${version}/CHANGELOG.md";
    license = licenses.asl20;
    maintainers = with maintainers; [ rxiao ];
  };
--- a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
+++ b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-error-reporting";
-  version = "1.8.2";
+  version = "1.9.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-bwl1gWLux5LJMZIS/tJFMhHs1LcaDVCTgNrke6ASiBI=";
+    hash = "sha256-5URk8yZy5ld17p7UXf5y+kciM2bH8NmgEvJ1SqwYJ9o=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/nuitka/default.nix
+++ b/pkgs/development/python-modules/nuitka/default.nix
@ -12,13 +12,13 @@
 buildPythonPackage rec {
  pname = "nuitka";
  version = "1.1.5";
+  format = "setuptools";

-  # Latest version is not yet on PyPi
  src = fetchFromGitHub {
    owner = "Nuitka";
    repo = "Nuitka";
    rev = version;
-    sha256 = "0wgcl860acbxnq8q9hck147yhxz8pcbqhv9glracfnrsd2qkpgpp";
+    hash = "sha256-8eWOcxATVS866nlN39b2VU1CuXAfcn0yQsDweHS2yDU=";
  };

  nativeCheckInputs = [ vmprof pyqt4 ];
--- a/pkgs/development/python-modules/unrpa/default.nix
+++ b/pkgs/development/python-modules/unrpa/default.nix
@ -1,22 +1,34 @@
-{ lib, buildPythonPackage, fetchPypi, uncompyle6, isPy27 }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, uncompyle6
+, pythonOlder
+}:

 buildPythonPackage rec {
  pname = "unrpa";
  version = "2.3.0";
+  format = "setuptools";

-  disabled = isPy27;
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
    sha256 = "0yl4qdwp3in170ks98qnldqz3r2iyzil5g1775ccg98qkh95s724";
  };

-  propagatedBuildInputs = [ uncompyle6 ];
+  passthru.optional-dependencies = {
+    ZiX = [ uncompyle6 ];
+  };

  pythonImportsCheck = [ "unrpa" ];

+  # upstream has no unit tests
+  doCheck = false;
+
  meta = with lib; {
    homepage = "https://github.com/Lattyware/unrpa";
+    changelog = "https://github.com/Lattyware/unrpa/releases/tag/${version}";
    description = "A program to extract files from the RPA archive format";
    license = licenses.gpl3;
    maintainers = with maintainers; [ leo60228 ];
--- a/pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix
@ -0,0 +1,24 @@
+{ lib, fetchFromGitea, buildGoModule }:
+
+buildGoModule rec {
+  pname = "gitea-actions-runner";
+  version = "unstable-2023-02-08";
+
+  src = fetchFromGitea {
+    domain = "gitea.com";
+    owner = "gitea";
+    repo = "act_runner";
+    rev = "990cf93c7136669408eb1832cd05df3ad4dd81b3";
+    sha256 = "1ysp7g199dzh1zpxxhki88pn96qghln7a5g8zfjip9173q1rgiyb";
+  };
+
+  vendorSha256 = "0a3q7rsk37dc6v3vnqaywkimaqvyjmkrwljhcjcnswsdfcgng62b";
+
+  meta = with lib; {
+    mainProgram = "act_runner";
+    maintainers = with maintainers; [ techknowlogick ];
+    license = licenses.mit;
+    homepage = "https://gitea.com/gitea/act_runner";
+    description = "A runner for Gitea based on act";
+  };
+}
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, darwin }:
+{ lib, stdenv, fetchurl, ocaml, findlib, darwin, ocaml-lsp }:

 if lib.versionOlder ocaml.version "4.08"
 then throw "dune 3 is not available for OCaml ${ocaml.version}"
@ -6,17 +6,17 @@ else

 stdenv.mkDerivation rec {
  pname = "dune";
-  version = "3.6.2";
+  version = "3.7.0";

  src = fetchurl {
    url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    sha256 = "sha256-ttSrhI77BKoqMl0AFdMu1EFO1xMOx6oS+YFY7/RFzzw=";
+    sha256 = "sha256-4tY3ydCAMY/t9ecdKin7NnYk+CrEom6D3ys6A1UFKLg=";
  };

  nativeBuildInputs = [ ocaml findlib ];

  buildInputs = lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.Foundation
+    darwin.apple_sdk.frameworks.CoreServices
  ];

  strictDeps = true;
@ -29,6 +29,10 @@ stdenv.mkDerivation rec {

  installFlags = [ "PREFIX=${placeholder "out"}" "LIBDIR=$(OCAMLFIND_DESTDIR)" ];

+  passthru.tests = {
+    inherit ocaml-lsp;
+  };
+
  meta = {
    homepage = "https://dune.build/";
    description = "A composable build system";
--- a/pkgs/development/tools/sq/default.nix
+++ b/pkgs/development/tools/sq/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "sq";
-  version = "0.20.0";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = "neilotoole";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-mJp4lb4pzjdjodHk2zLAEePn+oIPI/vTtU0YOIbmWDY=";
+    sha256 = "sha256-KPH1IsvYQvyUsi4qxWKLpCQNrPCnulCqQLPK5iadm3I=";
  };

-  vendorSha256 = "sha256-8kk+KCanbnsizGRjF3qcxCBxC7Sx0zfptQFTETZp89E=";
+  vendorHash = "sha256-AL4ghkeTIkXZXpGeBnWIx3hY6uO2bO7eVcH6DR/5jQc=";

  proxyVendor = true;

@ -23,7 +23,7 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X=github.com/neilotoole/sq/cli/buildinfo.Version=${version}"
+    "-X=github.com/neilotoole/sq/cli/buildinfo.Version=v${version}"
  ];

  postInstall = ''
@ -34,7 +34,10 @@ buildGoModule rec {
  '';

  passthru.tests = {
-    version = testers.testVersion { package = sq; };
+    version = testers.testVersion {
+      package = sq;
+      version = "v${version}";
+    };
  };

  meta = with lib; {
--- a/pkgs/development/tools/toast/default.nix
+++ b/pkgs/development/tools/toast/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "toast";
-  version = "0.46.0";
+  version = "0.46.1";

  src = fetchFromGitHub {
    owner = "stepchowfun";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-rDT7ZpixE77imy/HVwLET+O0uCZ+wFhXGqcWq46Ud2w=";
+    sha256 = "sha256-3ng1nVl5eqpa3YWqT/RYZo9sBl6Zkyc8NabG1GpjapQ=";
  };

-  cargoHash = "sha256-B5H8YkYlcF/Z6SlsW5lWwHZ9tYfOb54Pu1KNVY3eXP8=";
+  cargoHash = "sha256-22DtD0PeuDK1Gwy28ZD02LJYgOYuowf+pDQjHXiT6+A=";

  checkFlags = [ "--skip=format::tests::code_str_display" ]; # fails

--- a/pkgs/games/naev/default.nix
+++ b/pkgs/games/naev/default.nix
@ -1,42 +1,83 @@
-{ lib, fetchurl, stdenv, SDL, openal, SDL_mixer, libxml2, pkg-config, libvorbis
-, libpng, libGLU, libGL, makeWrapper, zlib, freetype }:
+{ lib
+, SDL2
+, SDL2_image
+, enet
+, fetchFromGitHub
+, freetype
+, glpk
+, intltool
+, libpng
+, libunibreak
+, libvorbis
+, libwebp
+, libxml2
+, luajit
+, meson
+, ninja
+, openal
+, openblas
+, pcre2
+, physfs
+, pkg-config
+, python3
+, stdenv
+, suitesparse
+}:

-let
+stdenv.mkDerivation rec {
  pname = "naev";
-  version = "0.5.0";
-  name = "${pname}-${version}";
-in
-stdenv.mkDerivation {
-  inherit name;
+  version = "0.10.4";

-  srcData = fetchurl {
-    url = "mirror://sourceforge/naev/ndata-${version}";
-    sha256 = "0l05xxbbys3j5h6anvann2vylhp6hnxnzwpcaydaff8fpbbyi6r6";
+  src = fetchFromGitHub {
+    owner = "naev";
+    repo = "naev";
+    rev = "v${version}";
+    sha256 = "sha256-2cMRmKeoF6x5+95GoDgsoZG9QQo7qATrw/X+335l6FE=";
+    fetchSubmodules = true;
  };

-  src = fetchurl {
-    url = "mirror://sourceforge/naev/${name}.tar.bz2";
-    sha256 = "0gahi91lmpra0wvxsz49zwwb28q9w2v1s3y7r70252hq6v80kanb";
-  };
+  buildInputs = [
+    SDL2
+    SDL2_image
+    enet
+    freetype
+    glpk
+    intltool
+    libpng
+    libunibreak
+    libvorbis
+    libwebp
+    libxml2
+    luajit
+    openal
+    openblas
+    pcre2
+    physfs
+    suitesparse
+  ];

-  buildInputs = [ SDL SDL_mixer openal libxml2 libvorbis libpng libGLU libGL zlib freetype ];
+  nativeBuildInputs = [
+    (python3.withPackages (ps: with ps; [ pyyaml mutagen ]))
+    meson
+    ninja
+    pkg-config
+  ];

-  nativeBuildInputs = [ pkg-config makeWrapper ];
+  mesonFlags = [
+    "-Ddocs_c=disabled"
+    "-Ddocs_lua=disabled"
+    "-Dluajit=enabled"
+  ];

-  env.NIX_CFLAGS_COMPILE = "-include ${zlib.dev}/include/zlib.h";
-
-  postInstall = ''
-    mkdir -p $out/share/naev
-    cp -v $srcData $out/share/naev/ndata
-    wrapProgram $out/bin/naev --add-flags $out/share/naev/ndata
+  postPatch = ''
+    patchShebangs --build dat/outfits/bioship/generate.py utils/build/*.py utils/*.py
  '';

  meta = {
    description = "2D action/rpg space game";
    homepage = "http://www.naev.org";
    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [viric];
+    maintainers = with lib.maintainers; [ ralismark ];
    platforms = lib.platforms.linux;
-    hydraPlatforms = [];
  };
 }
--- a/pkgs/os-specific/linux/bolt/default.nix
+++ b/pkgs/os-specific/linux/bolt/default.nix
@ -21,14 +21,14 @@

 stdenv.mkDerivation rec {
  pname = "bolt";
-  version = "0.9.2";
+  version = "0.9.5";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "bolt";
    repo = "bolt";
    rev = version;
-    sha256 = "eXjj7oD5HOW/AG2uxDa0tSleKmbouFd2fwlL2HHFiMA=";
+    sha256 = "sha256-j1UO8lkVoS56hwPQXH8aIr1UegM6PdtaBXKZn50GP60=";
  };

  patches = [
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-compute-runtime";
-  version = "22.43.24595.41";
+  version = "22.49.25018.24";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "compute-runtime";
    rev = version;
-    sha256 = "sha256-AdAQX8wurZjXHf3z8IPxnW57CDOwwYlgJ09dNNDhUYQ=";
+    sha256 = "sha256-/onHHIG5jWFObC8pSjpFMadjwaAN6vMNjAsj8/D3qNw=";
  };

  patches = [
--- a/pkgs/servers/komga/default.nix
+++ b/pkgs/servers/komga/default.nix
@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "komga";
-  version = "0.161.0";
+  version = "0.162.0";

  src = fetchurl {
    url = "https://github.com/gotson/${pname}/releases/download/v${version}/${pname}-${version}.jar";
-    sha256 = "sha256-TZ/TxX9OgDGx8zD2mI8cTDPZSqBjkYN3Uy+W9MXbJOI=";
+    sha256 = "sha256-RcEAqMfpXH7PudLOROpSZw/5HrEeuBFBkllOjGdXZCU=";
  };

  nativeBuildInputs = [
--- a/pkgs/servers/mattermost/default.nix
+++ b/pkgs/servers/mattermost/default.nix
@ -7,21 +7,21 @@

 buildGoModule rec {
  pname = "mattermost";
-  version = "7.7.1";
+  version = "7.8.1";

  src = fetchFromGitHub {
    owner = "mattermost";
    repo = "mattermost-server";
    rev = "v${version}";
-    sha256 = "sha256-py1Ck/BGNGIlyVZXJPb9bYHLU8FTrBEIQwVkHvgHRLY";
+    sha256 = "sha256-6aJkJCJmQHvSn5SHIPXj0nNLBuEez9BCYYMMlv3iZqQ=";
  };

  webapp = fetchurl {
    url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-    sha256 = "sha256-4FrvKQdGKfwJM7Oc43kg1Iq4o/OT2/kl89bTKBO4EdQ";
+    sha256 = "sha256-KmzjhAkv1TpOlHtZnN/ifkQnzDqk1rN+fl4JStZRbXQ=";
  };

-  vendorSha256 = "sha256-qJSddirC0VVFgKsttmNFZ1AzGR7jo07jXzrt7+DswXs=";
+  vendorSha256 = "sha256-VvGLYOESyoBpFmIibHWxazliHcscMxf3KcQ46NQ4syk=";

  subPackages = [ "cmd/mattermost" ];

--- a/pkgs/servers/monitoring/prometheus/pihole-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/pihole-exporter.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pihole-exporter";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "eko";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-LtiJpXucD9Ok1tFFCQ5/V6FhYxbgBWDPF6S49FzWPes=";
+    sha256 = "sha256-ZHeAp2++faqoxt+2uvtea2+xPST2sonuBJAhI6GZg1Y=";
  };

-  vendorSha256 = "sha256-GCHCWnP3YPC1Dg8Tu0GF5ITDMVRoBv28QVpk6JGN5nQ=";
+  vendorHash = "sha256-Wn4W7e8v/njvODA0znqtZsMRfcH6L6r5biAOwfyKUAU=";

  meta = with lib; {
    description = "Prometheus exporter for PI-Hole's Raspberry PI ad blocker";
--- a/pkgs/servers/nosql/janusgraph/default.nix
+++ b/pkgs/servers/nosql/janusgraph/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "janusgraph";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchzip {
    url = "https://github.com/JanusGraph/janusgraph/releases/download/v${version}/janusgraph-${version}.zip";
-    sha256 = "sha256-8TMYk8gGyL71zcFk0Lgo7Isvm4k3eh/H6PjfVePpkI4=";
+    sha256 = "sha256-KpGvDfQExU6pHheqmcOFoAhHdF4P+GBQu779h+/L5mE=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/servers/web-apps/dolibarr/default.nix
+++ b/pkgs/servers/web-apps/dolibarr/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "dolibarr";
-  version = "16.0.3";
+  version = "16.0.4";

  src = fetchFromGitHub {
    owner = "Dolibarr";
    repo = "dolibarr";
    rev = version;
-    sha256 = "sha256-Zkjmm2DAaAGQc1IigMYDpE5b+YaYU8oFMHZSqBEBsRw=";
+    sha256 = "sha256-H0f12pEsRxq6cYrcCjjQF1b5PFQEPBfYhZ5YnBfIbHk=";
  };

  dontBuild = true;
--- a/pkgs/servers/web-apps/freshrss/default.nix
+++ b/pkgs/servers/web-apps/freshrss/default.nix
@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "FreshRSS";
-  version = "1.20.2";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "FreshRSS";
    repo = "FreshRSS";
    rev = version;
-    hash = "sha256-l1SOaQA4C8yXbrfi7pEE1PpUO4DVmLTTDUSACCSQ5LE=";
+    hash = "sha256-0+fMZ5ps0CkBbS+fcxlYrrkQi28tmrKTyl3kPuofqyI=";
  };

  passthru.tests = {
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@ -20,6 +20,7 @@
 , librsvg
 , libvpx
 , libwebp
+, lz4
 , nv-codec-headers-10
 , nvidia_x11 ? null
 , pam
@ -68,11 +69,11 @@ let
  '';
 in buildPythonApplication rec {
  pname = "xpra";
-  version = "4.3.3";
+  version = "4.4.3";

  src = fetchurl {
    url = "https://xpra.org/src/${pname}-${version}.tar.xz";
-    hash = "sha256-J6zzkho0A1faCVzS/0wDlbgLtJmyPrnBkEcR7kDld7A=";
+    hash = "sha256-j7tHT486ylyWAmR34BBWw9+HbDPnYMvHU88HV+Cs1w8=";
  };

  patches = [
@ -122,6 +123,7 @@ in buildPythonApplication rec {
    librsvg
    libvpx
    libwebp
+    lz4
    pam
    pango
    x264
--- a/pkgs/tools/X11/xpra/fix-122159.patch
+++ b/pkgs/tools/X11/xpra/fix-122159.patch
@ -1,16 +1,16 @@
 diff --git a/xpra/scripts/main.py b/xpra/scripts/main.py
-index 6def9e0ad..031f8aba9 100755
+index 031a41f9e..6232ba830 100755
 --- a/xpra/scripts/main.py
 +++ b/xpra/scripts/main.py
-@@ -364,11 +364,7 @@ def run_mode(script_file, cmdline, error_cb, options, args, mode, defaults):
-         "shadow",
-         ) and not display_is_remote:
-         if use_systemd_run(options.systemd_run):
-            #make sure we run via the same interpreter,
-            #inject it into the command line if we have to:
-             argv = list(cmdline)
-            if argv[0].find("python")<0:
-                argv.insert(0, "python%i.%i" % (sys.version_info.major, sys.version_info.minor))
-             return systemd_run_wrap(mode, argv, options.systemd_run_args)
+@@ -377,11 +377,7 @@ def run_mode(script_file, cmdline, error_cb, options, args, mode, defaults):
+         "seamless", "desktop", "shadow", "expand",
+         "upgrade", "upgrade-seamless", "upgrade-desktop",
+         ) and not display_is_remote and use_systemd_run(options.systemd_run):
+-        #make sure we run via the same interpreter,
+-        #inject it into the command line if we have to:
+         argv = list(cmdline)
+-        if argv[0].find("python")<0:
+-            argv.insert(0, "python%i.%i" % (sys.version_info.major, sys.version_info.minor))
+         return systemd_run_wrap(mode, argv, options.systemd_run_args)
     configure_env(options.env)
     configure_logging(options, mode)
--- a/pkgs/tools/X11/xpra/fix-paths.patch
+++ b/pkgs/tools/X11/xpra/fix-paths.patch
@ -1,26 +1,3 @@
-diff --git a/setup.py b/setup.py
-index fc67abb50a..c29db3a6d2 100755
--- a/setup.py
-+++ b/setup.py
-@@ -2348,17 +2348,7 @@ if v4l2_ENABLED:
-             break
-     constants_pxi = "xpra/codecs/v4l2/constants.pxi"
-     if not os.path.exists(videodev2_h) or should_rebuild(videodev2_h, constants_pxi):
-        ENABLE_DEVICE_CAPS = 0
-        if os.path.exists(videodev2_h):
-            try:
-                with subprocess.Popen("cpp -fpreprocessed %s | grep -q device_caps" % videodev2_h,
-                                     shell=True) as proc:
-                    ENABLE_DEVICE_CAPS = proc.wait()==0
-            except OSError:
-                with open(videodev2_h) as f:
-                    hdata = f.read()
-                ENABLE_DEVICE_CAPS = int(hdata.find("device_caps")>=0)
-                print("failed to detect device caps, assuming off")
-+        ENABLE_DEVICE_CAPS = 1
-         with open(constants_pxi, "wb") as f:
-             f.write(b"DEF ENABLE_DEVICE_CAPS=%i" % ENABLE_DEVICE_CAPS)
-     add_cython_ext("xpra.codecs.v4l2.pusher",
 diff --git a/xpra/x11/fakeXinerama.py b/xpra/x11/fakeXinerama.py
 index d5c1c8bb10..88c77e8142 100755
 --- a/xpra/x11/fakeXinerama.py
--- a/pkgs/tools/admin/bubblewrap/default.nix
+++ b/pkgs/tools/admin/bubblewrap/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "bubblewrap";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "bubblewrap";
    rev = "v${version}";
-    hash = "sha256-ddxEtBw6JcSsZCN5uKyuBMVkWwSoThfxrcvHZGZzFr4=";
+    hash = "sha256-UiZfp1bX/Eul5x31oBln5P9KMT2oFwawQqDs9udZUxY=";
  };

  postPatch = ''
@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
  doCheck = false;

  meta = with lib; {
+    changelog = "https://github.com/containers/bubblewrap/releases/tag/${src.rev}";
    description = "Unprivileged sandboxing tool";
    homepage = "https://github.com/containers/bubblewrap";
    license = licenses.lgpl2Plus;
--- a/pkgs/tools/admin/cdist/default.nix
+++ b/pkgs/tools/admin/cdist/default.nix
@ -0,0 +1,64 @@
+{ lib
+, buildPythonApplication
+, fetchFromGitea
+, pythonImportsCheckHook
+, sphinxHook
+, sphinx-rtd-theme
+}:
+
+buildPythonApplication rec {
+  pname = "cdist";
+  version = "7.0.0";
+  outputs = [ "out" "man" "doc" ];
+
+  src = fetchFromGitea {
+    domain = "code.ungleich.ch";
+    owner = "ungleich-public";
+    repo = "cdist";
+    rev = version;
+    hash = "sha256-lIx0RtGQJdY2e00azI9yS6TV+5pCegpKOOD0dQmgMqA=";
+  };
+
+  nativeBuildInputs = [
+    pythonImportsCheckHook
+    sphinxHook
+    sphinx-rtd-theme
+  ];
+
+  sphinxRoot = "docs/src";
+
+  # "make man" creates symlinks in docs/src needed by sphinxHook.
+  postPatch = ''
+    echo "VERSION = '$version'" > cdist/version.py
+
+    make man
+  '';
+
+  preConfigure = ''
+    export HOME=/tmp
+  '';
+
+  # Test suite requires either non-chrooted environment or root.
+  #
+  # When "machine_type" explorer figures out that it is running inside
+  # chroot, it assumes that it has enough privileges to escape it.
+  doCheck = false;
+
+  pythonImportsCheck = [ "cdist" ];
+
+  postInstall = ''
+    mkdir -p $out/share
+    mv docs/dist/man $out/share
+  '';
+
+  meta = with lib; {
+    description = "Minimalistic configuration management system";
+    homepage = "https://www.sdi.st";
+    changelog = "https://code.ungleich.ch/ungleich-public/cdist/src/tag/${version}/docs/changelog";
+
+    # Mostly. There are still couple types that are gpl3-only.
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ kaction ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/tools/admin/drawterm/default.nix
+++ b/pkgs/tools/admin/drawterm/default.nix
@ -6,12 +6,12 @@

 stdenv.mkDerivation rec {
  pname = "drawterm";
-  version = "unstable-2021-10-02";
+  version = "unstable-2023-03-05";

  src = fetchgit {
    url = "git://git.9front.org/plan9front/drawterm";
-    rev = "c6f547e1a46ebbf7a290427fe3a0b66932d671a0";
-    sha256 = "09v2vk5s23q0islfz273pqy696zhzh3gqi25hadr54lif0511wsl";
+    rev = "ed9cff5a4c39322744c4708699c9ae6651b7c9ab";
+    sha256 = "LM6UnggoxKC3e6xOlHYk9VFF99Abbdmp37nuUML8RgI=";
  };

  buildInputs = [
--- a/pkgs/tools/backup/autorestic/default.nix
+++ b/pkgs/tools/backup/autorestic/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "autorestic";
-  version = "1.7.5";
+  version = "1.7.6";

  src = fetchFromGitHub {
    owner = "cupcakearmy";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-gf2sqMI8dG7+sVSqe2f5oG7vqQ9UDKAqPUS+MPVB7SI=";
+    sha256 = "sha256-jlCCARbZSAHK0ojlTdtUl7fo+MAtuQYo64lZeKyQ9ho=";
  };

-  vendorHash = "sha256-eB24vCElnnk3EMKniCblmeRsFk0BQ0wFeBf0B8OPanE=";
+  vendorHash = "sha256-K3+5DRXcx56sJ4XHikVtmoxmpJbBeAgPkN9KtHVgvYA=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/backup/borgmatic/default.nix
+++ b/pkgs/tools/backup/borgmatic/default.nix
@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "borgmatic";
-  version = "1.7.6";
+  version = "1.7.8";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "sha256-TNh0laNAyHkIZLC51hzchSIDvsHst2aPxoRdI6Mdr84=";
+    sha256 = "sha256-+lYyCPKgaWZPUkIGjgmBES6vg1ZbgZ5b6WKmpqAcyhM=";
  };

  nativeCheckInputs = with python3Packages; [ flexmock pytestCheckHook pytest-cov ];
--- a/pkgs/tools/filesystems/bindfs/default.nix
+++ b/pkgs/tools/filesystems/bindfs/default.nix
@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, fuse, pkg-config }:

 stdenv.mkDerivation rec {
-  version = "1.17.1";
+  version = "1.17.2";
  pname = "bindfs";

  src = fetchurl {
    url    = "https://bindfs.org/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-7bSYkUTSj3Wv/E9bGAdPuXpY1u41rWkZrHXraky/41I=";
+    sha256 = "sha256-XyxQpwuNWMAluB+/Nk+tQy0VSTZjDOACPMiLqo1codA=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@ -21,11 +21,11 @@ buildPythonPackage rec {
  # The websites yt-dlp deals with are a very moving target. That means that
  # downloads break constantly. Because of that, updates should always be backported
  # to the latest stable release.
-  version = "2023.3.3";
+  version = "2023.3.4";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-d/017Y9ZtYDP9RYbE9137pklYZpzVTt8A+srCt6nH7c=";
+    sha256 = "sha256-Jl1dqXp2wV19mkCIpnt4rNXc9vjP2CV8UvWB/5lv9RU=";
  };

  propagatedBuildInputs = [ brotli certifi mutagen pycryptodomex websockets ];
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@ -1,7 +1,8 @@
 { lib, stdenv, callPackage, fetchFromGitHub, autoreconfHook, pkg-config, makeWrapper
 , CoreFoundation, IOKit, libossp_uuid
 , nixosTests
-, curl, jemalloc, libuv, zlib
+, netdata-go-plugins
+, bash, curl, jemalloc, libuv, zlib
 , libcap, libuuid, lm_sensors, protobuf
 , withCups ? false, cups
 , withDBengine ? true, lz4
@ -14,9 +15,7 @@
 , withDebug ? false
 }:

-let
-  go-d-plugin = callPackage ./go.d.plugin.nix {};
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  # Don't forget to update go.d.plugin.nix as well
  version = "1.38.1";
  pname = "netdata";
@ -32,7 +31,8 @@ in stdenv.mkDerivation rec {
  strictDeps = true;

  nativeBuildInputs = [ autoreconfHook pkg-config makeWrapper protobuf ];
-  buildInputs = [ curl jemalloc libuv zlib ]
+  # bash is only used to rewrite shebangs
+  buildInputs = [ bash curl jemalloc libuv zlib ]
    ++ lib.optionals stdenv.isDarwin [ CoreFoundation IOKit libossp_uuid ]
    ++ lib.optionals (!stdenv.isDarwin) [ libcap libuuid ]
    ++ lib.optionals withCups [ cups ]
@ -65,13 +65,14 @@ in stdenv.mkDerivation rec {
  # to bootstrap tools:
  #   https://github.com/NixOS/nixpkgs/pull/175719
  # We pick zlib.dev as a simple canary package with pkg-config input.
-  disallowedReferences = [ zlib.dev ];
+  disallowedReferences = if withDebug then [] else [ zlib.dev ];

+  donStrip = withDebug;
  env.NIX_CFLAGS_COMPILE = lib.optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";

  postInstall = ''
-    ln -s ${go-d-plugin}/lib/netdata/conf.d/* $out/lib/netdata/conf.d
-    ln -s ${go-d-plugin}/bin/godplugin $out/libexec/netdata/plugins.d/go.d.plugin
+    ln -s ${netdata-go-plugins}/lib/netdata/conf.d/* $out/lib/netdata/conf.d
+    ln -s ${netdata-go-plugins}/bin/godplugin $out/libexec/netdata/plugins.d/go.d.plugin
  '' + lib.optionalString (!stdenv.isDarwin) ''
    # rename this plugin so netdata will look for setuid wrapper
    mv $out/libexec/netdata/plugins.d/apps.plugin \
--- a/pkgs/tools/system/netdata/go.d.plugin.nix
+++ b/pkgs/tools/system/netdata/go.d.plugin.nix
@ -1,16 +1,16 @@
-{ lib, fetchFromGitHub, buildGo119Module }:
-buildGo119Module rec {
-  pname = "netdata-go.d.plugin";
-  version = "0.50.0";
+{ lib, fetchFromGitHub, buildGoModule }:
+buildGoModule rec {
+  pname = "netdata-go-plugins";
+  version = "0.51.2";

  src = fetchFromGitHub {
    owner = "netdata";
    repo = "go.d.plugin";
    rev = "v${version}";
-    sha256 = "5kDc6zszVuFTDkNMuHBRwrfDnH+AdD6ULzmywtvL8iA=";
+    sha256 = "sha256-u87kTNM1oAmJRtm/iEESjVvQ9qEpFCGqRT8M+iVEwlI=";
  };

-  vendorSha256 = "sha256-Wv6xqzpQxlZCrVnS+g9t1qiYCkm3NfXfW8XDYA9Txxs=";
+  vendorSha256 = "sha256-QB+Sf7biNPD8/3y9pFxOJZXtc6BaBcQsUGP7y9Wukwg=";

  doCheck = false;

--- a/pkgs/tools/system/ttop/default.nix
+++ b/pkgs/tools/system/ttop/default.nix
@ -0,0 +1,24 @@
+{ lib, nimPackages, fetchFromGitHub }:
+
+nimPackages.buildNimPackage rec {
+  pname = "ttop";
+  version = "0.8.6";
+  nimBinOnly = true;
+
+  src = fetchFromGitHub {
+    owner = "inv2004";
+    repo = "ttop";
+    rev = "v${version}";
+    hash = "sha256-2TuDaStWRsO02l8WhYLWX7vqsC0ne2adxrzqrFF9BfQ=";
+  };
+
+  buildInputs = with nimPackages; [ asciigraph illwill parsetoml zippy ];
+
+  meta = with lib;
+    src.meta // {
+      description = "Top-like system monitoring tool";
+      license = licenses.mit;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ sikmir ];
+    };
+}
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -5945,6 +5945,8 @@ with pkgs;

  cdi2iso = callPackage ../tools/cd-dvd/cdi2iso { };

+  cdist = python3Packages.callPackage ../tools/admin/cdist { };
+
  cdimgtools = callPackage ../tools/cd-dvd/cdimgtools { };

  cdpr = callPackage ../tools/networking/cdpr { };
@ -7430,6 +7432,8 @@ with pkgs;

  fdk-aac-encoder = callPackage ../applications/audio/fdkaac { };

+  fead = callPackage ../applications/misc/fead { };
+
  feedgnuplot = callPackage ../tools/graphics/feedgnuplot { };

  fbcat = callPackage ../tools/misc/fbcat { };
@ -7747,6 +7751,8 @@ with pkgs;

  gitea = callPackage ../applications/version-management/gitea { };

+  gitea-actions-runner = callPackage ../development/tools/continuous-integration/gitea-actions-runner { };
+
  forgejo = callPackage ../applications/version-management/forgejo {};

  gokart = callPackage ../development/tools/gokart { };
@ -9294,6 +9300,8 @@ with pkgs;
  netdata = callPackage ../tools/system/netdata {
    inherit (darwin.apple_sdk.frameworks) CoreFoundation IOKit;
  };
+  # Exposed here so the bots can auto-upgrade it
+  netdata-go-plugins = callPackage ../tools/system/netdata/go.d.plugin.nix {};

  netsurf = recurseIntoAttrs (callPackage ../applications/networking/browsers/netsurf { });
  netsurf-browser = netsurf.browser;
@ -12900,6 +12908,8 @@ with pkgs;
  };
  ttfautohint-nox = ttfautohint.override { enableGUI = false; };

+  ttop = callPackage ../tools/system/ttop { };
+
  tty-clock = callPackage ../tools/misc/tty-clock { };

  tty-share = callPackage ../applications/misc/tty-share { };
@ -13030,7 +13040,7 @@ with pkgs;

  unrtf = callPackage ../tools/text/unrtf { };

-  unrpa = with python38Packages; toPythonApplication unrpa;
+  unrpa = with python3Packages; toPythonApplication unrpa;

  untex = callPackage ../tools/text/untex { };

@ -30582,9 +30592,7 @@ with pkgs;

  wbg = callPackage ../applications/misc/wbg { };

-  hikari = callPackage ../applications/window-managers/hikari {
-    wlroots = wlroots_0_14;
-  };
+  hikari = callPackage ../applications/window-managers/hikari { };

  i3 = callPackage ../applications/window-managers/i3 {
    xcb-util-cursor = if stdenv.isDarwin then xcb-util-cursor-HEAD else xcb-util-cursor;
--- a/pkgs/top-level/nim-packages.nix
+++ b/pkgs/top-level/nim-packages.nix
@ -11,6 +11,8 @@ lib.makeScope newScope (self:
      };
    fetchNimble = callPackage ../development/nim-packages/fetch-nimble { };

+    asciigraph = callPackage ../development/nim-packages/asciigraph { };
+
    astpatternmatching =
      callPackage ../development/nim-packages/astpatternmatching { };

@ -39,6 +41,8 @@ lib.makeScope newScope (self:

    hts-nim = callPackage ../development/nim-packages/hts-nim { };

+    illwill = callPackage ../development/nim-packages/illwill { };
+
    jester = callPackage ../development/nim-packages/jester { };

    jsonschema = callPackage ../development/nim-packages/jsonschema { };
@ -65,6 +69,8 @@ lib.makeScope newScope (self:

    packedjson = callPackage ../development/nim-packages/packedjson { };

+    parsetoml = callPackage ../development/nim-packages/parsetoml { };
+
    pixie = callPackage ../development/nim-packages/pixie { };

    redis = callPackage ../development/nim-packages/redis { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -3170,6 +3170,8 @@ self: super: with self; {

  et_xmlfile = callPackage ../development/python-modules/et_xmlfile { };

+  evaluate = callPackage ../development/python-modules/evaluate { };
+
  ev3dev2 = callPackage ../development/python-modules/ev3dev2 { };

  evdev = callPackage ../development/python-modules/evdev { };