Merge master into haskell-updates

2022-08-27 00:14:34 +00:00 · 2022-08-27 00:14:34 +00:00 · de5a47be5f
commit de5a47be5f
parent 3aa744deb1 e683858f46
124 changed files with 3033 additions and 2692 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -816,6 +816,12 @@
    githubId = 7112447;
    name = "Andre S. Ramos";
  };
+  andrevmatos = {
+    email = "andrevmatos@gmail.com";
+    github = "andrevmatos";
+    githubId = 587021;
+    name = "André V L Matos";
+  };
  andrew-d = {
    email = "andrew@du.nham.ca";
    github = "andrew-d";
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -465,6 +465,12 @@
          guide</link> on how to migrate your Neo4j instance.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.matrix-synapse</literal> systemd unit
+          has been hardened.
+        </para>
+      </listitem>
      <listitem>
        <para>
          Matrix Synapse now requires entries in the
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -162,6 +162,8 @@ Use `configure.packages` instead.

 - Neo4j was updated from version 3 to version 4. See this [migration guide](https://neo4j.com/docs/upgrade-migration-guide/current/) on how to migrate your Neo4j instance.

+- The `services.matrix-synapse` systemd unit has been hardened.
+
 - Matrix Synapse now requires entries in the `state_group_edges` table to be unique, in order to prevent accidentally introducing duplicate information (for example, because a database backup was restored multiple times). If your Synapse database already has duplicate rows in this table, this could fail with an error and require manual remediation.

 - The `diamond` package has been update from 0.8.36 to 2.0.15. See the [upstream release notes](https://github.com/bbuchfink/diamond/releases) for more details.
--- a/nixos/modules/services/blockchain/ethereum/geth.nix
+++ b/nixos/modules/services/blockchain/ethereum/geth.nix
@ -61,6 +61,35 @@ let
        };
      };

+      authrpc = {
+        enable = lib.mkEnableOption "Go Ethereum Auth RPC API";
+        address = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = lib.mdDoc "Listen address of Go Ethereum Auth RPC API.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 8551;
+          description = lib.mdDoc "Port number of Go Ethereum Auth RPC API.";
+        };
+
+        vhosts = mkOption {
+          type = types.nullOr (types.listOf types.str);
+          default = ["localhost"];
+          description = lib.mdDoc "List of virtual hostnames from which to accept requests.";
+          example = ["localhost" "geth.example.org"];
+        };
+
+        jwtsecret = mkOption {
+          type = types.str;
+          default = "";
+          description = lib.mdDoc "Path to a JWT secret for authenticated RPC endpoint.";
+          example = "/var/run/geth/jwtsecret";
+        };
+      };
+
      metrics = {
        enable = lib.mkEnableOption "Go Ethereum prometheus metrics";
        address = mkOption {
@ -136,7 +165,10 @@ in
      cfg.package
    ]) eachGeth);

-    systemd.services = mapAttrs' (gethName: cfg: (
+    systemd.services = mapAttrs' (gethName: cfg: let
+      stateDir = "goethereum/${gethName}/${if (cfg.network == null) then "mainnet" else cfg.network}";
+      dataDir = "/var/lib/${stateDir}";
+    in (
      nameValuePair "geth-${gethName}" (mkIf cfg.enable {
      description = "Go Ethereum node (${gethName})";
      wantedBy = [ "multi-user.target" ];
@ -145,7 +177,7 @@ in
      serviceConfig = {
        DynamicUser = true;
        Restart = "always";
-        StateDirectory = "goethereum/${gethName}/${if (cfg.network == null) then "mainnet" else cfg.network}";
+        StateDirectory = stateDir;

        # Hardening measures
        PrivateTmp = "true";
@ -169,8 +201,10 @@ in
          ${if cfg.websocket.enable then ''--ws --ws.addr ${cfg.websocket.address} --ws.port ${toString cfg.websocket.port}'' else ""} \
          ${optionalString (cfg.websocket.apis != null) ''--ws.api ${lib.concatStringsSep "," cfg.websocket.apis}''} \
          ${optionalString cfg.metrics.enable ''--metrics --metrics.addr ${cfg.metrics.address} --metrics.port ${toString cfg.metrics.port}''} \
+          --authrpc.addr ${cfg.authrpc.address} --authrpc.port ${toString cfg.authrpc.port} --authrpc.vhosts ${lib.concatStringsSep "," cfg.authrpc.vhosts} \
+          ${if (cfg.authrpc.jwtsecret != "") then ''--authrpc.jwtsecret ${cfg.authrpc.jwtsecret}'' else ''--authrpc.jwtsecret ${dataDir}/geth/jwtsecret''} \
          ${lib.escapeShellArgs cfg.extraArgs} \
-          --datadir /var/lib/goethereum/${gethName}/${if (cfg.network == null) then "mainnet" else cfg.network}
+          --datadir ${dataDir}
      '';
    }))) eachGeth;

--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@ -759,6 +759,33 @@ in {
        ExecReload = "${pkgs.util-linux}/bin/kill -HUP $MAINPID";
        Restart = "on-failure";
        UMask = "0077";
+
+        # Security Hardening
+        # Refer to systemd.exec(5) for option descriptions.
+        CapabilityBoundingSet = [ "" ];
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadWritePaths = [ cfg.dataDir ];
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
      };
    };

--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@ -933,6 +933,14 @@ in
                Required group names.
              '';
            };
+            providerName = mkOption {
+              type = types.str;
+              default = "";
+              example = "My institution";
+              description = lib.mdDoc ''
+                Optional name to be displayed at login form indicating the SAML provider.
+              '';
+            };
            attribute = {
              id = mkOption {
                type = types.str;
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -451,6 +451,7 @@ let
          "Multicast"
          "AllMulticast"
          "Unmanaged"
+          "Group"
          "RequiredForOnline"
          "RequiredFamilyForOnline"
          "ActivationPolicy"
@ -463,6 +464,8 @@ let
        (assertValueOneOf "AllMulticast" boolValues)
        (assertValueOneOf "Promiscuous" boolValues)
        (assertValueOneOf "Unmanaged" boolValues)
+        (assertInt "Group")
+        (assertRange "Group" 0 2147483647)
        (assertValueOneOf "RequiredForOnline" (boolValues ++ [
          "missing"
          "off"
@ -800,10 +803,12 @@ let

      sectionDHCPServer = checkUnitConfig "DHCPServer" [
        (assertOnlyFields [
+          "ServerAddress"
          "PoolOffset"
          "PoolSize"
          "DefaultLeaseTimeSec"
          "MaxLeaseTimeSec"
+          "UplinkInterface"
          "EmitDNS"
          "DNS"
          "EmitNTP"
@ -817,10 +822,15 @@ let
          "EmitLPR"
          "LPR"
          "EmitRouter"
+          "Router"
          "EmitTimezone"
          "Timezone"
          "SendOption"
          "SendVendorOption"
+          "BindToInterface"
+          "RelayTarget"
+          "RelayAgentCircuitId"
+          "RelayAgentRemoteId"
        ])
        (assertInt "PoolOffset")
        (assertMinimum "PoolOffset" 0)
@ -834,6 +844,7 @@ let
        (assertValueOneOf "EmitLPR" boolValues)
        (assertValueOneOf "EmitRouter" boolValues)
        (assertValueOneOf "EmitTimezone" boolValues)
+        (assertValueOneOf "BindToInterface" boolValues)
      ];

      sectionIPv6SendRA = checkUnitConfig "IPv6SendRA" [
@ -842,6 +853,7 @@ let
          "OtherInformation"
          "RouterLifetimeSec"
          "RouterPreference"
+          "UplinkInterface"
          "EmitDNS"
          "DNS"
          "EmitDomains"
--- a/nixos/modules/system/boot/systemd/shutdown.nix
+++ b/nixos/modules/system/boot/systemd/shutdown.nix
@ -33,26 +33,30 @@ in {
    systemd.shutdownRamfs.contents."/shutdown".source = "${config.systemd.package}/lib/systemd/systemd-shutdown";
    systemd.shutdownRamfs.storePaths = [pkgs.runtimeShell "${pkgs.coreutils}/bin"];

+    systemd.mounts = [{
+      what = "tmpfs";
+      where = "/run/initramfs";
+      type = "tmpfs";
+    }];
+
    systemd.services.generate-shutdown-ramfs = {
      description = "Generate shutdown ramfs";
      wantedBy = [ "shutdown.target" ];
      before = [ "shutdown.target" ];
      unitConfig = {
        DefaultDependencies = false;
+        RequiresMountsFor = "/run/initramfs";
        ConditionFileIsExecutable = [
          "!/run/initramfs/shutdown"
        ];
      };

-      path = [pkgs.util-linux pkgs.makeInitrdNGTool];
-      serviceConfig.Type = "oneshot";
-      script = ''
-        mkdir -p /run/initramfs
-        if ! mountpoint -q /run/initramfs; then
-          mount -t tmpfs tmpfs /run/initramfs
-        fi
-        make-initrd-ng ${ramfsContents} /run/initramfs
-      '';
+      serviceConfig = {
+        Type = "oneshot";
+        ProtectSystem = "strict";
+        ReadWritePaths = "/run/initramfs";
+        ExecStart = "${pkgs.makeInitrdNGTool}/bin/make-initrd-ng ${ramfsContents} /run/initramfs";
+      };
    };
  };
 }
--- a/pkgs/applications/audio/famistudio/default.nix
+++ b/pkgs/applications/audio/famistudio/default.nix
@ -3,27 +3,31 @@
 , fetchzip
 , autoPatchelfHook
 , makeWrapper
-, alsa-lib
-, gtk-sharp-2_0
-, glib
-, gtk2
 , mono
 , openal
+, libGL
 }:

 stdenv.mkDerivation rec {
  pname = "famistudio";
-  version = "3.3.1";
+  version = "4.0.1";

  src = fetchzip {
    url = "https://github.com/BleuBleu/FamiStudio/releases/download/${version}/FamiStudio${lib.strings.concatStrings (lib.splitVersion version)}-LinuxAMD64.zip";
    stripRoot = false;
-    sha256 = "sha256-Bgry+cRsmC+aBff6EaeHoGBygpiZS5SmgICPU32zO+c=";
+    sha256 = "sha256-pAULW2aIaKiA61rARpL+hSoffnQO6hfqVpOcEMwD7oo=";
  };

-  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];

-  buildInputs = [ alsa-lib gtk-sharp-2_0 glib gtk2 mono openal ];
+  buildInputs = [
+    mono
+    openal
+    libGL
+  ];

  dontConfigure = true;
  dontBuild = true;
@ -36,16 +40,11 @@ stdenv.mkDerivation rec {

    makeWrapper ${mono}/bin/mono $out/bin/famistudio \
      --add-flags $out/lib/famistudio/FamiStudio.exe \
-      --prefix MONO_GAC_PREFIX : ${gtk-sharp-2_0} \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ glib gtk2 gtk-sharp-2_0 ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libGL ]}

-    # Fails to find openal32.dll on its own, needs abit of help
+    # Bundled openal lib freezes the application
    rm $out/lib/famistudio/libopenal32.so
-    cat <<EOF >$out/lib/famistudio/OpenTK.dll.config
-    <configuration>
-      <dllmap dll="openal32.dll" target="${openal}/lib/libopenal.so"/>
-    </configuration>
-    EOF
+    ln -s ${openal}/lib/libopenal.so $out/lib/famistudio/libopenal32.so

    runHook postInstall
  '';
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@ -18,13 +18,13 @@ let
 in
 pythonPackages.buildPythonApplication rec {
  pname = "picard";
-  version = "2.8.1";
+  version = "2.8.3";

  src = fetchFromGitHub {
    owner = "metabrainz";
    repo = pname;
    rev = "refs/tags/release-${version}";
-    sha256 = "sha256-KEKOouTNmmZiPyKo8xCQv6Zkreidtz2DaEbHjuwJJvY=";
+    sha256 = "sha256-KUHciIlwaKXvyCCkAzdh1vpe9cunDizrMUl0SoCpxgY=";
  };

  nativeBuildInputs = [ gettext qt5.wrapQtAppsHook qt5.qtbase ]
--- a/pkgs/applications/audio/vcv-rack/default.nix
+++ b/pkgs/applications/audio/vcv-rack/default.nix
@ -1,4 +1,5 @@
 { alsa-lib
+, cmake
 , copyDesktopItems
 , curl
 , fetchFromBitbucket
@ -23,7 +24,6 @@
 , makeDesktopItem
 , makeWrapper
 , pkg-config
-, rtaudio
 , rtmidi
 , speex
 , stdenv
@ -75,13 +75,35 @@ let
  fundamental-source = fetchFromGitHub {
    owner = "VCVRack";
    repo = "Fundamental";
-    rev = "533397cdcad5c6401ebd3937d6c1663de2473627"; # tip of branch v2
-    sha256 = "QnwOgrYxiCa/7t/u6F63Ks8C9E8k6T+hia4JZFhp1LI=";
+    rev = "03bd00b96ad19e0575939bb7a0b8b08eff22f076"; # tip of branch v2
+    sha256 = "1rd5yvdr6k03mc3r2y7wxhmiqd69jfvqmpqagxb83y1mn0zfv0pr";
+  };
+  vcv-rtaudio = stdenv.mkDerivation rec {
+    pname = "vcv-rtaudio";
+    version = "unstable-2020-01-30";
+
+    src = fetchFromGitHub {
+      owner = "VCVRack";
+      repo = "rtaudio";
+      rev = "ece277bd839603648c80c8a5f145678e13bc23f3"; # tip of master branch
+      sha256 = "11gpl0ak757ilrq4fi0brj0chmlcr1hihc32yd7qza4fxjw2yx2v";
+    };
+
+    nativeBuildInputs = [ cmake pkg-config ];
+
+    buildInputs = [ alsa-lib libjack2 libpulseaudio ];
+
+    cmakeFlags = [
+      "-DRTAUDIO_API_ALSA=ON"
+      "-DRTAUDIO_API_PULSE=ON"
+      "-DRTAUDIO_API_JACK=ON"
+      "-DRTAUDIO_API_CORE=OFF"
+    ];
  };
 in
 stdenv.mkDerivation rec {
  pname = "VCV-Rack";
-  version = "2.0.6";
+  version = "2.1.2";

  desktopItems = [
    (makeDesktopItem {
@ -101,7 +123,7 @@ stdenv.mkDerivation rec {
    owner = "VCVRack";
    repo = "Rack";
    rev = "v${version}";
-    sha256 = "vvGx8tnE7gMiboVUTywIzBB1q/IfiJ8TPnSHvmfHUQg=";
+    sha256 = "0583izk3j36mg7wm30ss2387j9dqsbbxkxrdh3993azb4q5naf02";
  };

  patches = [
@ -137,8 +159,6 @@ stdenv.mkDerivation rec {
      --replace 'zenityBin[] = "zenity"' 'zenityBin[] = "${gnome.zenity}/bin/zenity"'
  '';

-  enableParallelBuilding = true;
-
  nativeBuildInputs = [
    copyDesktopItems
    imagemagick
@ -161,9 +181,9 @@ stdenv.mkDerivation rec {
    libjack2
    libpulseaudio
    libsamplerate
-    rtaudio
    rtmidi
    speex
+    vcv-rtaudio
    zstd
  ];

--- a/pkgs/applications/blockchains/aeon/default.nix
+++ b/pkgs/applications/blockchains/aeon/default.nix
@ -4,7 +4,7 @@
 }:

 let
-  version = "0.14.1.0";
+  version = "0.14.2.2";
 in
 stdenv.mkDerivation {
  pname = "aeon";
@ -15,7 +15,7 @@ stdenv.mkDerivation {
    repo = "aeon";
    rev = "v${version}-aeon";
    fetchSubmodules = true;
-    sha256 = "sha256-yej4w/2m9YXsMobqHwzA5GBbduhaeTVvmnHUJNWX87E=";
+    sha256 = "sha256-2MptLS12CUm9eUKm+V+yYpbLVwNyZeZ5HvAFyjEc4R4=";
  };

  nativeBuildInputs = [ cmake pkg-config git doxygen graphviz ];
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@ -1,3 +1,4 @@
+# run tests by building `neovim.tests`
 { vimUtils, vim_configurable, writeText, neovim, vimPlugins
 , lib, fetchFromGitHub, neovimUtils, wrapNeovimUnstable
 , neovim-unwrapped
@ -66,6 +67,15 @@ let
    sha256 = "1ykcvyx82nhdq167kbnpgwkgjib8ii7c92y3427v986n2s5lsskc";
  };

+  # this plugin checks that it's ftplugin/vim.tex is loaded before $VIMRUNTIME/ftplugin/vim.tex
+  # the answer is store in `plugin_was_loaded_too_late` in the cwd
+  texFtplugin = pkgs.runCommandLocal "tex-ftplugin" {} ''
+    mkdir -p $out/ftplugin
+    echo 'call system("echo ". exists("b:did_ftplugin") . " > plugin_was_loaded_too_late")' > $out/ftplugin/tex.vim
+    echo ':q!' >> $out/ftplugin/tex.vim
+    echo '\documentclass{article}' > $out/main.tex
+  '';
+
  # neovim-drv must be a wrapped neovim
  runTest = neovim-drv: buildCommand:
    runCommandLocal "test-${neovim-drv.name}" ({
@ -128,6 +138,25 @@ rec {
    ${nvim_with_plug}/bin/nvim -i NONE -c 'color base16-tomorrow-night'  +quit! -e
  '';

+  nvim_with_ftplugin = neovim.override {
+    extraName = "-with-ftplugin";
+    configure.packages.plugins = with pkgs.vimPlugins; {
+      start = [
+        texFtplugin
+      ];
+    };
+  };
+
+  # regression test that ftplugin files from plugins are loaded before the ftplugin
+  # files from $VIMRUNTIME
+  run_nvim_with_ftplugin = runTest nvim_with_ftplugin ''
+    export HOME=$TMPDIR
+    ${nvim_with_ftplugin}/bin/nvim ${texFtplugin}/main.tex
+    result="$(cat plugin_was_loaded_too_late)"
+    echo $result
+    [ "$result" = 0 ]
+  '';
+

  # check that the vim-doc hook correctly generates the tag
  # we know for a fact packer has a doc folder
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@ -106,6 +106,7 @@ let
          flags = [
            "--cmd" (lib.intersperse "|" hostProviderViml)
            "--cmd" "set packpath^=${vimUtils.packDir packDirArgs}"
+            "--cmd" "set rtp^=${vimUtils.packDir packDirArgs}"
            ];
        in
        [
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -16,6 +16,7 @@
 , racket
 , clojure-lsp
 , alejandra
+, millet
 }:

 let
@ -311,6 +312,26 @@ let
        };
      };

+      azdavis.millet = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "Millet";
+          publisher = "azdavis";
+          version = "0.3.5";
+          sha256 = "sha256-lQ7EMs6nsTEgP9BESMpyoZG7QVOe7DXzfg/iZr1+DCQ=";
+        };
+        nativeBuildInputs = [ jq moreutils ];
+        postInstall = ''
+          cd "$out/$installPrefix"
+          jq '.contributes.configuration.properties."millet.server.path".default = "${millet}/bin/lang-srv"' package.json | sponge package.json
+        '';
+        meta = with lib; {
+          description = "Standard ML support for VS Code";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=azdavis.millet";
+          license = licenses.mit;
+          maintainers = with maintainers; [ smasher164 ];
+        };
+      };
+
      ms-python.vscode-pylance = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "vscode-pylance";
@ -363,8 +384,8 @@ let
        mktplcRef = {
          name = "ocaml-formatter";
          publisher = "badochov";
-          version = "1.14.0";
-          sha256 = "sha256-Iekh3vwu8iz53rPRsuu1Fx9iA/A97iMd8cPETWavnyA=";
+          version = "2.0.5";
+          sha256 = "sha256-D04EJButnam/l4aAv1yNbHlTKMb3x1yrS47+9XjpCLI=";
        };
        meta = with lib; {
          description = "VSCode Extension Formatter for OCaml language";
@ -523,15 +544,15 @@ let
        mktplcRef = {
          name = "path-intellisense";
          publisher = "christian-kohler";
-          version = "2.8.0";
-          sha256 = "sha256-VPzy9o0DeYRkNwTGphC51vzBTNgQwqKg+t7MpGPLahM=";
+          version = "2.8.1";
+          sha256 = "sha256-lTKzMphkGgOG2XWqz3TW2G9sISBc/kG7oXqcIH8l+Mg=";
        };
        meta = with lib; {
          description = "Visual Studio Code plugin that autocompletes filenames";
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=christian-kohler.path-intellisense";
          homepage = "https://github.com/ChristianKohler/PathIntellisense";
          license = licenses.mit;
-          maintainers = with maintainers; [ imgabe ];
+          maintainers = with maintainers; [ imgabe superherointj ];
        };
      };

@ -880,8 +901,8 @@ let
        mktplcRef = {
          name = "prettier-vscode";
          publisher = "esbenp";
-          version = "9.5.0";
-          sha256 = "sha256-L/jW6xAnJ8v9Qq+iyQI8usGr8BoICR+2ENAMGQ05r0A=";
+          version = "9.8.0";
+          sha256 = "sha256-+8lEuQD73w+urAv2Tw0b+q6oQ66+gLgMPe3Luln9cuY=";
        };
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/esbenp.prettier-vscode/changelog";
@ -889,7 +910,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode";
          homepage = "https://github.com/prettier/prettier-vscode";
          license = licenses.mit;
-          maintainers = with maintainers; [ datafoo ];
+          maintainers = with maintainers; [ datafoo superherointj ];
        };
      };

@ -1319,8 +1340,8 @@ let
        mktplcRef = {
          name = "elixir-ls";
          publisher = "JakeBecker";
-          version = "0.9.0";
-          sha256 = "sha256-KNfZOrVxK3/rClHPcIyPgE9CRtjkI7NLY0xZ9W+X6OM=";
+          version = "0.11.0";
+          sha256 = "sha256-okvwyD0m2r8ar85VtuBUNMUZGGrCfJ4DB9v7aSX5PjM=";
        };
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/JakeBecker.elixir-ls/changelog";
@ -1368,8 +1389,8 @@ let
        mktplcRef = {
          name = "nix-ide";
          publisher = "jnoortheen";
-          version = "0.1.20";
-          sha256 = "16mmivdssjky11gmih7zp99d41m09r0ii43n17d4i6xwivagi9a3";
+          version = "0.1.23";
+          sha256 = "sha256-64gwwajfgniVzJqgVLK9b8PfkNG5mk1W+qewKL7Dv0Q=";
        };
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";
@ -1377,7 +1398,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jnoortheen.nix-ide";
          homepage = "https://github.com/jnoortheen/vscode-nix-ide";
          license = licenses.mit;
-          maintainers = with maintainers; [ SuperSandro2000 ];
+          maintainers = with maintainers; [ superherointj SuperSandro2000 ];
        };
      };

@ -1626,6 +1647,21 @@ let
        };
      };

+      mkhl.direnv = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "direnv";
+          publisher = "mkhl";
+          version = "0.6.1";
+          sha256 = "sha256-5/Tqpn/7byl+z2ATflgKV1+rhdqj+XMEZNbGwDmGwLQ=";
+        };
+        meta = with lib; {
+          description = "direnv support for Visual Studio Code";
+          license = licenses.bsd0;
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=mkhl.direnv";
+          maintainers = with maintainers; [ nullx76 ];
+        };
+      };
+
      mskelton.one-dark-theme = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "one-dark-theme";
@ -1921,13 +1957,13 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ocamllabs.ocaml-platform";
          homepage = "https://github.com/ocamllabs/vscode-ocaml-platform";
          license = licenses.isc;
-          maintainers = with maintainers; [ ratsclub ];
+          maintainers = with maintainers; [ ratsclub superherointj ];
        };
        mktplcRef = {
          name = "ocaml-platform";
          publisher = "ocamllabs";
-          version = "1.10.4";
-          sha256 = "sha256-Qk4wD6gh/xvH6nFBonje4Stz6Y6yaIyxx1TdAXQEycM=";
+          version = "1.10.7";
+          sha256 = "sha256-BxVur+aSbFPyX+DW9tQcfJEyImkbTC6O0uOV2d76au0=";
        };
      };

@ -1975,8 +2011,8 @@ let
        mktplcRef = {
          name = "prisma";
          publisher = "Prisma";
-          version = "4.1.0";
-          sha256 = "sha256-YpdxRoeIesx4R2RIpJ8YmmHEmR3lezdN1efhhg14MzI=";
+          version = "4.2.0";
+          sha256 = "sha256-1U3JlWfIlTt0AMPsiP3vD2ZEzD2oUsYsqRRwBQeoLIA=";
        };
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/Prisma.prisma/changelog";
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@ -186,6 +186,7 @@ let
      kreversi = callPackage ./kreversi.nix {};
      krfb = callPackage ./krfb.nix {};
      kruler = callPackage ./kruler.nix {};
+      ksanecore = callPackage ./ksanecore.nix {};
      kshisen = callPackage ./kshisen.nix {};
      ksmtp = callPackage ./ksmtp {};
      kspaceduel = callPackage ./kspaceduel.nix {};
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/release-service/22.04.3/src -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/release-service/22.08.0/src -A '*.tar.xz' )
--- a/pkgs/applications/kde/filelight.nix
+++ b/pkgs/applications/kde/filelight.nix
@ -1,7 +1,7 @@
 {
  mkDerivation, lib,
  extra-cmake-modules, kdoctools,
-  kio, kparts, kxmlgui, qtbase, qtscript, solid
+  kio, kparts, kxmlgui, qtbase, qtscript, solid, qtquickcontrols2, kdeclarative
 }:

 mkDerivation {
@ -15,7 +15,7 @@ mkDerivation {
  };
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  propagatedBuildInputs = [
-    kio kparts kxmlgui qtscript solid
+    kio kparts kxmlgui qtscript solid qtquickcontrols2 kdeclarative
  ];
  outputs = [ "out" "dev" ];
 }
--- a/pkgs/applications/kde/gwenview.nix
+++ b/pkgs/applications/kde/gwenview.nix
@ -1,9 +1,9 @@
 {
  mkDerivation, lib,
  extra-cmake-modules, kdoctools,
-  exiv2, lcms2,
+  exiv2, lcms2, cfitsio,
  baloo, kactivities, kio, kipi-plugins, kitemmodels, kparts, libkdcraw, libkipi,
-  phonon, qtimageformats, qtsvg, qtx11extras, kinit
+  phonon, qtimageformats, qtsvg, qtx11extras, kinit, kpurpose, kcolorpicker, kimageannotator
 }:

 mkDerivation {
@ -17,8 +17,8 @@ mkDerivation {
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  buildInputs = [
    baloo kactivities kio kitemmodels kparts libkdcraw libkipi phonon
-    exiv2 lcms2
-    qtimageformats qtsvg qtx11extras
+    exiv2 lcms2 cfitsio
+    qtimageformats qtsvg qtx11extras kpurpose kcolorpicker kimageannotator
  ];
  propagatedUserEnvPkgs = [ kipi-plugins libkipi (lib.getBin kinit) ];
 }
--- a/pkgs/applications/kde/kate.nix
+++ b/pkgs/applications/kde/kate.nix
@ -20,9 +20,9 @@ mkDerivation {
  # kwrite defaults for anything considered text/plain. Resetting to
  # 1, which is the default.
  postPatch = ''
-    substituteInPlace kate/data/org.kde.kate.desktop \
+    substituteInPlace apps/kate/data/org.kde.kate.desktop \
      --replace InitialPreference=9 InitialPreference=1
-    substituteInPlace kwrite/data/org.kde.kwrite.desktop \
+    substituteInPlace apps/kwrite/data/org.kde.kwrite.desktop \
      --replace InitialPreference=8 InitialPreference=1
  '';

--- a/pkgs/applications/kde/kdeconnect-kde.nix
+++ b/pkgs/applications/kde/kdeconnect-kde.nix
@ -28,6 +28,7 @@
 , sshfs
 , wayland
 , wayland-scanner
+, plasma-wayland-protocols
 }:

 mkDerivation {
@ -56,6 +57,7 @@ mkDerivation {
    qtx11extras
    wayland
    wayland-scanner
+    plasma-wayland-protocols
    # otherwise buttons are blank on non-kde
    breeze-icons
  ];
--- a/pkgs/applications/kde/ksanecore.nix
+++ b/pkgs/applications/kde/ksanecore.nix
@ -0,0 +1,15 @@
+{
+  mkDerivation, lib,
+  extra-cmake-modules, qtbase,
+  ki18n, sane-backends
+}:
+
+mkDerivation {
+  pname = "ksanecore";
+  nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [ qtbase ki18n sane-backends ];
+  meta = with lib; {
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ andrevmatos ];
+  };
+}
--- a/pkgs/applications/kde/libksane.nix
+++ b/pkgs/applications/kde/libksane.nix
@ -2,7 +2,7 @@
  mkDerivation, lib,
  extra-cmake-modules, qtbase,
  ki18n, ktextwidgets, kwallet, kwidgetsaddons,
-  sane-backends
+  ksanecore, sane-backends
 }:

 mkDerivation {
@ -12,5 +12,6 @@ mkDerivation {
    maintainers = with maintainers; [ polendri ];
  };
  nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ qtbase ki18n ktextwidgets kwallet kwidgetsaddons sane-backends ];
+  buildInputs = [ qtbase ki18n ktextwidgets kwallet kwidgetsaddons ];
+  propagatedBuildInputs = [ ksanecore sane-backends ];
 }
--- a/pkgs/applications/kde/messagelib.nix
+++ b/pkgs/applications/kde/messagelib.nix
@ -5,7 +5,7 @@
  grantleetheme, karchive, kcodecs, kconfig, kconfigwidgets, kcontacts,
  kiconthemes, kidentitymanagement, kio, kjobwidgets, kldap,
  kmailtransport, kmbox, kmime, kwindowsystem, libgravatar, libkdepim, libkleo,
-  pimcommon, qca-qt5, qtwebengine, syntax-highlighting, fetchpatch
+  pimcommon, qca-qt5, qtwebengine, syntax-highlighting
 }:

 mkDerivation {
@ -14,17 +14,6 @@ mkDerivation {
    license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
    maintainers = kdepimTeam;
  };
-  patches = [
-    # fix compatibility with cmake 3.24
-    (fetchpatch {
-      url = "https://invent.kde.org/pim/messagelib/-/commit/6eaef36d42bdb05f3.patch";
-      hash = "sha256-H0ayU81HxX5moHOQ3hDW7tg824oqK1p9atrBhuvZ8K8=";
-    })
-    (fetchpatch {
-      url = "https://invent.kde.org/pim/messagelib/-/commit/3edc93673f94604c2.patch";
-      hash = "sha256-tBFWCfttjDjyQyWnKdhVfLY6QsixzqqYuvD77GVH080=";
-    })
-  ];
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  buildInputs = [
    akonadi-notes akonadi-search gpgme grantlee grantleetheme karchive kcodecs
--- a/pkgs/applications/kde/okular.nix
+++ b/pkgs/applications/kde/okular.nix
@ -5,7 +5,7 @@
  karchive, kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons,
  kdbusaddons, kdegraphics-mobipocket, kiconthemes, kjs, khtml, kio, kparts,
  kpty, kpurpose, kwallet, kwindowsystem, libkexiv2, libspectre, libzip, phonon, poppler,
-  qca-qt5, qtdeclarative, qtsvg, threadweaver, kcrash
+  qca-qt5, qtdeclarative, qtsvg, threadweaver, kcrash, qtspeech
 }:

 mkDerivation {
@ -16,7 +16,7 @@ mkDerivation {
    kcompletion kconfig kconfigwidgets kcoreaddons kdbusaddons
    kdegraphics-mobipocket kiconthemes kjs khtml kio kparts kpty kpurpose kwallet
    kwindowsystem libkexiv2 libspectre libzip phonon poppler qca-qt5
-    qtdeclarative qtsvg threadweaver kcrash
+    qtdeclarative qtsvg threadweaver kcrash qtspeech
  ] ++ lib.optional (!stdenv.isAarch64) chmlib;

  # InitialPreference values are too high and end up making okular
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@ -84,13 +84,13 @@ let
 in
 buildPythonApplication rec {
  pname = "lutris-original";
-  version = "0.5.10.1";
+  version = "0.5.11";

  src = fetchFromGitHub {
    owner = "lutris";
    repo = "lutris";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-Bf8UEGEM6M4PKoX/qKQNb9XxrxLcjKZD1vR3R2/PykI=";
+    sha256 = "sha256-D2qMKYmi5TC8jEAECcz2V0rUrmp5kjXJ5qyW6C4re3w=";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -289,6 +289,10 @@ let
      rtc_use_pipewire = true;
      # Disable PGO because the profile data requires a newer compiler version (LLVM 14 isn't sufficient):
      chrome_pgo_phase = 0;
+    } // optionalAttrs (chromiumVersionAtLeast "105") {
+      # https://bugs.chromium.org/p/chromium/issues/detail?id=1334390:
+      use_system_libwayland = false;
+      use_system_wayland_scanner = false;
    } // optionalAttrs proprietaryCodecs {
      # enable support for the H.264 codec
      proprietary_codecs = true;
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -19,9 +19,9 @@
    }
  },
  "beta": {
-    "version": "105.0.5195.37",
-    "sha256": "0ffzphr66z3g3l695b5liswpfp0577knn06mzdmwq9x1lk87cwiq",
-    "sha256bin64": "1cfkjzqwj4s5djzl2rka9kbc28i6zph0xqv1534cb68hzgwy171a",
+    "version": "105.0.5195.52",
+    "sha256": "0hkwjilzy0x28knm6nrkywnsmldhz4kgpnxka2iaghihkjzb4wfw",
+    "sha256bin64": "155w4h4py3pn337060csfia9xxbjlxvhw7s7ljb9mz6qvpijd434",
    "deps": {
      "gn": {
        "version": "2022-07-11",
@ -32,15 +32,15 @@
    }
  },
  "dev": {
-    "version": "106.0.5231.2",
-    "sha256": "0cygann80jmc2vk83kpc7kprhw75yf7qqfi1208ksyp6m94cxnp6",
-    "sha256bin64": "1p7hq5vsmwgkyjam7blm1gxa246dg5plhk2f0vbvlnycwj54cvjm",
+    "version": "106.0.5245.0",
+    "sha256": "1hpp5gcajmjf2wvgrnsrfwl879gj8w8b6asn79raqj1qf2pa7wxg",
+    "sha256bin64": "1d4v2mwpbn3h533lkh8270hmj71ag9ivh7ns03qifsqsl9jv4zdv",
    "deps": {
      "gn": {
-        "version": "2022-08-08",
+        "version": "2022-08-11",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "3d773bba0927e67eae8fdaee5e28b0f6203d3bee",
-        "sha256": "1pfv6iq04r5lbg5b6xa6d5vn6mzyqksmspris7cgq5lihwq825ld"
+        "rev": "0bcd37bd2b83f1a9ee17088037ebdfe6eab6d31a",
+        "sha256": "13zks2z65kg7fzzsysq4mswd4bhhy3h7ycdrpxfilcvixx2n2gac"
      }
    }
  },
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@ -46,10 +46,10 @@ with lib;
 # Those pieces of software we entirely ignore upstream's handling of, and just
 # make sure they're in the path if desired.
 let
-  k3sVersion = "1.24.3+k3s1";     # k3s git tag
-  k3sCommit = "990ba0e88c90f8ed8b50e0ccd375937b841b176e"; # k3s git commit at the above version
-  k3sRepoSha256 = "0slw2j7d7ccj7k9z06l5ch3nxi07jbm6xijs774hisyv25jx94rd";
-  k3sVendorSha256 = "sha256-8jWpTUE/tJf2qpFjdsV+0i8hRf6JqATwr/YbXrZa/iA=";
+  k3sVersion = "1.24.4+k3s1";     # k3s git tag
+  k3sCommit = "c3f830e9b9ed8a4d9d0e2aa663b4591b923a296e"; # k3s git commit at the above version
+  k3sRepoSha256 = "00ns6n7jxnacah8ahndhgdb160prgsqhswbb5809kkgvig7k8b27";
+  k3sVendorSha256 = "sha256-ReZvJCgxqffG2H39JlynGPUBSV5ngPkRtAoZ++OQZZI=";

  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
--- a/pkgs/applications/networking/cluster/nomad-driver-podman/default.nix
+++ b/pkgs/applications/networking/cluster/nomad-driver-podman/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "nomad-driver-podman";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-aVmXtYIquG0acVlbwNmgXUpuOgpsfMmfbnb5md9CN5w=";
+    sha256 = "sha256-33hyMKwU04ywXKv4JEhRvEbe2DWQEAQ0moy6zypXdpU=";
  };

-  vendorSha256 = "sha256-QXAXDoYN5egl5y0YV4/7yh5K0tjzjN5vRJRHyI8eU2E=";
+  vendorSha256 = "sha256-5PQIWSGSR5vizWEsResBLd//yWs99o/bj5DVpRMBwhA=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/cluster/nomad/1.2.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.2.nix
@ -4,7 +4,7 @@

 callPackage ./generic.nix {
  inherit buildGoModule;
-  version = "1.2.9";
-  sha256 = "05pd4y5aq91ac73447aqr0pk56rx5qhqzzp5cw4w06yh5iry0bmn";
-  vendorSha256 = "08nqqd3dz8bzxnh729kckvg59wnvmixmsh8g74nlxk90gq07zsn4";
+  version = "1.2.11";
+  sha256 = "sha256-mBaqTiPCPNjhdBKv4ydlNuJxGwFCcJTj4khaOJs9LQM=";
+  vendorSha256 = "sha256-2Draoydjsu15GK1QMHiZCB9ldTrAb0FwhO7MUH3s1Q8=";
 }
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -1,25 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, openssl, sqlite }:
+{ lib, stdenv, fetchFromGitHub, openssl, sqlite }:

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20220810";
+  version = "20220825";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    sha256 = "sha256-z/RAvNUss9rNuBQvxjJQl66ZMrlxvmS9at8L/vSG0XU=";
+    sha256 = "sha256-dqP30or4UvtnzUW6r0FqQxt1S6Y61Q1CljpAFGq2gSM=";
  };

-  # TODO: Remove when updating to next release.
-  patches = [
-    (fetchpatch {
-      name = "fix-platform-checks.patch";
-      url = "https://github.com/bepaald/signalbackup-tools/compare/20220810..a81baf25b6ba63da7d30d9a239e5b4bbc8d1ab4f.patch";
-      sha256 = "sha256-i7fuPBil8zB+V3wHHdcbmP79OZoTfG2ZpXPQ3m7X06c=";
-    })
-  ];
-
  postPatch = ''
    patchShebangs BUILDSCRIPT_MULTIPROC.bash44
  '';
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "evolution-ews";
-  version = "3.44.3";
+  version = "3.44.4";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "hcysooh6+FvwSORzx7bELF9WQasFpbxM/Oo04rb1vhc=";
+    sha256 = "TxgrBaE6wbezOwj7Bm6DlcqpW6fagIiGqpGxQp1tfbM=";
  };

  nativeBuildInputs = [ cmake gettext intltool pkg-config ];
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@ -46,11 +46,11 @@

 stdenv.mkDerivation rec {
  pname = "evolution";
-  version = "3.44.3";
+  version = "3.44.4";

  src = fetchurl {
    url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "U2sR9BM99vIW8nr5okgaGe164Ivi1KE7EoBhwmKjZJk=";
+    sha256 = "8LFuerrTx5RaKcMi8X2rSgjWHpm9fMkbjfNQU8XBLow=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/p2p/soulseekqt/default.nix
+++ b/pkgs/applications/networking/p2p/soulseekqt/default.nix
@ -52,6 +52,7 @@ mkDerivation rec {
  meta = with lib; {
    description = "Official Qt SoulSeek client";
    homepage = "https://www.slsknet.org";
+    mainProgram = "SoulseekQt";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
    maintainers = [ ];
--- a/pkgs/applications/office/morgen/default.nix
+++ b/pkgs/applications/office/morgen/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "morgen";
-  version = "2.5.9";
+  version = "2.5.10";

  src = fetchurl {
    url = "https://download.todesktop.com/210203cqcj00tw1/morgen-${version}.deb";
-    sha256 = "sha256-WGBn4ZLERGXNPBRDoxhsOcnRT07wEdCO6+sUq/l7Hok=";
+    sha256 = "sha256-uKHLKZtvaaklJMYqAHtu4ULwcfbut1L2h6bjZkqI91o=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@ -1,157 +1,68 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , mkDerivation
 , fetchurl
 , dpkg
 , wrapGAppsHook
 , wrapQtAppsHook
+, autoPatchelfHook
 , alsa-lib
-, atk
-, bzip2
-, cairo
-, cups
-, dbus
-, expat
-, ffmpeg
-, fontconfig
-, freetype
-, gdk-pixbuf
-, glib
-, gperftools
-, gtk2-x11
-, libpng12
 , libtool
-, libuuid
-, libxml2
-, xz
 , nspr
-, nss
-, openssl
-, pango
-, qt4
-, qtbase
-, sqlite
-, unixODBC
+, mesa
+, libtiff
+, cups
 , xorg
-, zlib
-, steam
+, steam-run
 , makeWrapper
+, useChineseVersion ? false
 }:

 stdenv.mkDerivation rec {
  pname = "wpsoffice";
-  version = "11.1.0.9615";
+  version = "11.1.0.11664";

-  src = fetchurl {
-    url = "http://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/9615/wps-office_11.1.0.9615.XA_amd64.deb";
-    sha256 = "0dpd4njpizclllps3qagipycfws935rhj9k5gmdhjfgsk0ns188w";
+  src = if useChineseVersion then fetchurl {
+    url = "https://wps-linux-personal.wpscdn.cn/wps/download/ep/Linux2019/${lib.last (lib.splitString "." version)}/wps-office_${version}_amd64.deb";
+    sha256 = "sha256-D2LhxBMHmQjVExa/63DHdws0V+EmOSlJzGq91jbuJHs=";
+  } else fetchurl {
+    url = "http://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/${lib.last (lib.splitString "." version)}/wps-office_${version}.XA_amd64.deb";
+    sha256 = "sha256-9qZGqs4nsB9mWCJTi2x+vWmMF0sEoUYgEzLI//hijfU=";
  };
+
  unpackCmd = "dpkg -x $src .";
  sourceRoot = ".";

-  postUnpack = lib.optionalString (version == "11.1.0.9505") ''
-    # distribution is missing libjsapiservice.so, so we should not let
+  postUnpack = ''
+    # distribution is missing libkappessframework.so, so we should not let
    # autoPatchelfHook fail on the following dead libraries
-    rm opt/kingsoft/wps-office/office6/{libjsetapi.so,libjswppapi.so,libjswpsapi.so}
+    rm -r opt/kingsoft/wps-office/office6/addons/pdfbatchcompression
+
+    # Remove the following libraries because they depend on qt4
+    rm -r opt/kingsoft/wps-office/office6/{librpcetapi.so,librpcwpsapi.so,librpcwppapi.so,libavdevice.so.58.10.100,libmediacoder.so}
+    rm -r opt/kingsoft/wps-office/office6/addons/wppcapturer/libwppcapturer.so
+    rm -r opt/kingsoft/wps-office/office6/addons/wppencoder/libwppencoder.so
  '';

-  nativeBuildInputs = [ dpkg wrapGAppsHook wrapQtAppsHook makeWrapper ];
+  nativeBuildInputs = [ dpkg wrapGAppsHook wrapQtAppsHook makeWrapper autoPatchelfHook ];

-  meta = with lib; {
-    description = "Office suite, formerly Kingsoft Office";
-    homepage = "https://www.wps.com/";
-    platforms = [ "x86_64-linux" ];
-    hydraPlatforms = [];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfreeRedistributable;
-    maintainers = with maintainers; [ mlatus th0rgal ];
-  };
-
-  buildInputs = with xorg; [
+  buildInputs = [
    alsa-lib
-    atk
-    bzip2
-    cairo
-    dbus.lib
-    expat
-    ffmpeg
-    fontconfig
-    freetype
-    gdk-pixbuf
-    glib
-    gperftools
-    gtk2-x11
-    libICE
-    libSM
-    libX11
-    libX11
-    libXScrnSaver
-    libXcomposite
-    libXcursor
-    libXdamage
-    libXext
-    libXfixes
-    libXi
-    libXrandr
-    libXrender
-    libXtst
-    libpng12
+    xorg.libXdamage
+    xorg.libXtst
    libtool
-    libuuid
-    libxcb
-    libxml2
-    xz
    nspr
-    nss
-    openssl
-    pango
-    qt4
-    qtbase
-    sqlite
-    unixODBC
-    zlib
+    mesa
+    libtiff
    cups.lib
  ];

-  dontPatchELF = true;
-
-  # wpsoffice uses `/build` in its own build system making nix things there
-  # references to nix own build directory
-  noAuditTmpdir = true;
-
-  unvendoredLibraries = [
-    # Have to use parts of the vendored qt4
-    #"Qt"
-    "SDL2"
-    "bz2"
-    "avcodec"
-    "avdevice"
-    "avformat"
-    "avutil"
-    "swresample"
-    "swscale"
-    "jpeg"
-    "png"
-    # File saving breaks unless we are using vendored llvmPackages_8.libcxx
-    #"c++"
-    "ssl" "crypto"
-    "nspr"
-    "nss"
-    "odbc"
-    "tcmalloc" # gperftools
-  ];
-
-  installPhase = let
-    steam-run = (steam.override {
-      extraPkgs = p: buildInputs;
-    }).run;
-  in ''
+  installPhase = ''
+    runHook preInstall
    prefix=$out/opt/kingsoft/wps-office
    mkdir -p $out
    cp -r opt $out
    cp -r usr/* $out
-    for lib in $unvendoredLibraries; do
-      rm -v "$prefix/office6/lib$lib"*.so{,.*}
-    done
    for i in wps wpp et wpspdf; do
      substituteInPlace $out/bin/$i \
        --replace /opt/kingsoft/wps-office $prefix
@ -160,17 +71,18 @@ stdenv.mkDerivation rec {
      substituteInPlace $i \
        --replace /usr/bin $out/bin
    done
-
    for i in wps wpp et wpspdf; do
      mv $out/bin/$i $out/bin/.$i-orig
      makeWrapper ${steam-run}/bin/steam-run $out/bin/$i \
        --add-flags $out/bin/.$i-orig \
        --argv0 $i
    done
+    runHook postInstall
  '';

  dontWrapQtApps = true;
  dontWrapGApps = true;
+
  postFixup = ''
    for f in "$out"/bin/*; do
      echo "Wrapping $f"
@ -179,4 +91,13 @@ stdenv.mkDerivation rec {
        "''${qtWrapperArgs[@]}"
    done
  '';
+
+  meta = with lib; {
+    description = "Office suite, formerly Kingsoft Office";
+    homepage = "https://www.wps.com";
+    platforms = [ "x86_64-linux" ];
+    hydraPlatforms = [ ];
+    license = licenses.unfreeRedistributable;
+    maintainers = with maintainers; [ mlatus th0rgal rewine ];
+  };
 }
--- a/pkgs/applications/science/logic/cvc3/default.nix
+++ b/pkgs/applications/science/logic/cvc3/default.nix
@ -16,10 +16,6 @@ stdenv.mkDerivation rec {
  # fails to configure on darwin due to gmp not found
  configureFlags = [ "LIBS=-L${gmp}/lib" "CXXFLAGS=-I${gmp.dev}/include" ];

-  # disable stackprotector on aarch64-darwin for now
-  # https://github.com/NixOS/nixpkgs/issues/127608
-  hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
-
  postPatch = ''
    sed -e "s@ /bin/bash@bash@g" -i Makefile.std
    find . -exec sed -e "s@/usr/bin/perl@${perl}/bin/perl@g" -i '{}' ';'
--- a/pkgs/applications/version-management/git-and-tools/tig/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/tig/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "tig";
-  version = "2.5.6";
+  version = "2.5.7";

  src = fetchFromGitHub {
    owner = "jonas";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "sha256-WJtva3LbzVqtcAt0kmnti3RZTPg/CBjk6JQYa2VzpSQ=";
+    sha256 = "sha256-D5NQaxkGhwyBoScI7fZxnSHC0ABmsUeRf8pZCKooV3w=";
  };

  nativeBuildInputs = [ makeWrapper autoreconfHook asciidoc xmlto docbook_xsl docbook_xml_dtd_45 findXMLCatalogs pkg-config ];
--- a/pkgs/applications/video/dmlive/default.nix
+++ b/pkgs/applications/video/dmlive/default.nix
@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, makeWrapper
+, openssl
+, Security
+, mpv
+, ffmpeg
+, nodejs
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "dmlive";
+  version = "unstable-2022-08-22";
+
+  src = fetchFromGitHub {
+    owner = "THMonster";
+    repo = pname;
+    rev = "fd4fa1859f05350658db598a50d29f59d22b55a1";
+    hash = "sha256-NVabHLxPHi7hWoztthPmVC5VRKQKglpytuUQOY1Hzrw=";
+  };
+
+  cargoHash = "sha256-TziP7n9Xgi/wHaiF/NI6noMp1iR6vRuAXxvKJwQHbTw=";
+
+  OPENSSL_NO_VENDOR = true;
+
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
+
+  postInstall = ''
+    wrapProgram "$out/bin/dmlive" --prefix PATH : "${lib.makeBinPath [ mpv ffmpeg nodejs ]}"
+  '';
+
+  meta = with lib; {
+    description = "A tool to play and record videos or live streams with danmaku";
+    homepage = "https://github.com/THMonster/dmlive";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nickcao ];
+  };
+}
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@ -26,16 +26,21 @@

 mkDerivation rec {
  pname = "haruna";
-  version = "0.8.0";
+  version = "0.9.1";

  src = fetchFromGitLab {
    owner = "multimedia";
    repo = "haruna";
    rev = "v${version}";
-    sha256 = "sha256-Lom9iQUKH3lQHrVK4dJzo+FG79xSCg0b4gY/KAevL6I=";
+    hash = "sha256-pkskrzpKDsMg7DOC335zXknEIKh9Ku2NgyeinawQtiY=";
    domain = "invent.kde.org";
  };

+  postPatch = ''
+    substituteInPlace src/application.cpp \
+      --replace '"yt-dlp"' '"${lib.getExe yt-dlp}"'
+  '';
+
  buildInputs = [
    breeze-icons
    breeze-qt5
--- a/pkgs/applications/video/makemkv/default.nix
+++ b/pkgs/applications/video/makemkv/default.nix
@ -14,21 +14,21 @@
 }:

 let
-  version = "1.16.7";
+  version = "1.17.1";
  # Using two URLs as the first one will break as soon as a new version is released
  src_bin = fetchurl {
    urls = [
      "http://www.makemkv.com/download/makemkv-bin-${version}.tar.gz"
      "http://www.makemkv.com/download/old/makemkv-bin-${version}.tar.gz"
    ];
-    sha256 = "sha256-YjsYW2MmzDZqOMdYlqE0dZ399Qq8hJRQ9BCViNexLHs=";
+    sha256 = "sha256-B4SQiwf5/Icweg+VgQW34tN/XxDA7xoSgIVOfXwGsfM=";
  };
  src_oss = fetchurl {
    urls = [
      "http://www.makemkv.com/download/makemkv-oss-${version}.tar.gz"
      "http://www.makemkv.com/download/old/makemkv-oss-${version}.tar.gz"
    ];
-    sha256 = "sha256-TL0PRP/pDg16qsbYi9RYyD0egNDaxuApmR86hiR/Rq8=";
+    sha256 = "sha256-DVcrG5N9lydct11xoUKz1VVCiuvVOmQWGlAP2nrnZv4=";
  };

 in mkDerivation {
--- a/pkgs/build-support/writers/default.nix
+++ b/pkgs/build-support/writers/default.nix
@ -237,7 +237,7 @@ let
  # makePythonWriter takes python and compatible pythonPackages and produces python script writer,
  # which validates the script with flake8 at build time. If any libraries are specified,
  # python.withPackages is used as interpreter, otherwise the "bare" python is used.
-  makePythonWriter = python: pythonPackages: name: { libraries ? [], flakeIgnore ? [] }:
+  makePythonWriter = python: pythonPackages: buildPythonPackages: name: { libraries ? [], flakeIgnore ? [] }:
  let
    ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
  in
@ -248,7 +248,7 @@ let
      else "${python.withPackages (ps: libraries)}/bin/python"
    ;
    check = optionalString python.isPy3k (writeDash "pythoncheck.sh" ''
-      exec ${pythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
+      exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
    '');
  } name;

@ -264,7 +264,7 @@ let
  #
  #   print Test.a
  # ''
-  writePyPy2 = makePythonWriter pkgs.pypy2 pkgs.pypy2Packages;
+  writePyPy2 = makePythonWriter pkgs.pypy2 pkgs.pypy2Packages buildPackages.pypy2Packages;

  # writePyPy2Bin takes the same arguments as writePyPy2 but outputs a directory (like writeScriptBin)
  writePyPy2Bin = name:
@ -282,7 +282,7 @@ let
  #   """)
  #   print(y[0]['test'])
  # ''
-  writePython3 = makePythonWriter pkgs.python3 pkgs.python3Packages;
+  writePython3 = makePythonWriter pkgs.python3 pkgs.python3Packages buildPackages.python3Packages;

  # writePython3Bin takes the same arguments as writePython3 but outputs a directory (like writeScriptBin)
  writePython3Bin = name:
@ -300,7 +300,7 @@ let
  #   """)
  #   print(y[0]['test'])
  # ''
-  writePyPy3 = makePythonWriter pkgs.pypy3 pkgs.pypy3Packages;
+  writePyPy3 = makePythonWriter pkgs.pypy3 pkgs.pypy3Packages buildPackages.pypy3Packages;

  # writePyPy3Bin takes the same arguments as writePyPy3 but outputs a directory (like writeScriptBin)
  writePyPy3Bin = name:
--- a/pkgs/data/fonts/nerdfonts/default.nix
+++ b/pkgs/data/fonts/nerdfonts/default.nix
@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
    unzip
  ];
  sourceRoot = ".";
+  unpackCmd = "unzip -o $curSrc";
  buildPhase = ''
    echo "selected fonts are ${toString selectedFonts}"
    ls *.otf *.ttf
--- a/pkgs/data/fonts/nerdfonts/shas.nix
+++ b/pkgs/data/fonts/nerdfonts/shas.nix
@ -1,52 +1,53 @@
 {
-  "3270" = "1k71zsijasn6013c58pgf52xw3h9gkqdjlsa177wlldz8qxb16xk";
-  "Agave" = "0jgm31wvmckb71qc9l0nj3sg4zq2vw67piaxr6h8zkakcl2mysha";
-  "AnonymousPro" = "0s3n8rrr9kfqd8gxjxksp7p8bc3q7qhcrpyq8090dksvmbcks6xm";
-  "Arimo" = "1k7ldfx6dmy9sigzsvi9qwms510nddw634g8xrn0vwnw6d7infk8";
-  "AurulentSansMono" = "0q35948dai8qc7gfvas8sfn5s7b64b2y4f9psz6xslrv7nw8lcaz";
-  "BigBlueTerminal" = "0ymw2m2xjsx77brm79aws26icwcf2a1d7q3p3ipsd25g4cgqcd2v";
-  "BitstreamVeraSansMono" = "1n2298g1fn8jb1fbvw74289n7nnmjddn7zxh88gnl58pwz8ra5dk";
-  "CascadiaCode" = "1q4l5a7b7ab6h1bs5pq734r9pp3fw9b59gdk1g4hyn2w61h0kdcj";
-  "CodeNewRoman" = "1mgxawj3pblaxy0y9w0hzlfgipiskmc5p028m82zh1wyaplmh2pa";
-  "Cousine" = "0jr0gxrsba3dhchp53vd67qq2pgfnvmvcwbv99l1700p539bcvy1";
-  "DaddyTimeMono" = "1n6vwykz084fxgylayizxc210f4ms2ijfws5b2hvl2kqmy2q6jk4";
-  "DejaVuSansMono" = "03qfrkzmhnn8dwgx4qhiigbz4dxs3957hydlr0j8vxl89j8c9g1z";
-  "DroidSansMono" = "187cbcn4a2whrl8dag1ix6j1v3jgv5z2jdfw1w1z9llm1znvpp7z";
-  "FantasqueSansMono" = "147h15k3ni0w6chxkrah2fk4klhdhq8y1d3nbx763h9ia3mnggv6";
-  "FiraCode" = "1rx7zrkq0584k6hrh6dx30xrnz5nq379xyw73pfd4gxaxnh9mpi1";
-  "FiraMono" = "0f2daidakhmbbd5ph6985rghjmr87k7xzmmmf9n851dxvfyndsgl";
-  "Go-Mono" = "1bzh3pgyn87j27kw7x5h02rqzhh21pm6d0zhxd5iqi5qq5mj0nvm";
-  "Gohu" = "1rlkprjg9nz1s69s4ancmxii6l907qachl116gngbj8gjv3g1x21";
-  "Hack" = "052mav170lwxkgzg3hij4zvnmfwyrddn45gn07a33gpzzicjx1bh";
-  "Hasklig" = "0vyb0z0m04pn8477d6a711vjwb3nhvpn5fxfwnz37av9jmz3i9vk";
-  "HeavyData" = "065rhq7z52dp211inw3vszwc5zrd5s0w1kmgnrh68bxc0js0xqyb";
-  "Hermit" = "1ij9pjr517jxk3dlsrzmnqivsfq5i5ai6pd8hznmrkb3360cn7sm";
-  "iA-Writer" = "0clksrxw6xcv5c1pbd8rl2rc3r15iak1qv8v6bn0j2mccjcss64z";
-  "IBMPlexMono" = "0xkfkpnkkrvjfiv624l7lpmfji107y7645w6ah47ijyg47yxkmsg";
-  "Inconsolata" = "14gbwc0k3d1j496w6pv9kry1pglswzd0armsdb0g1mqgzfdf1ci1";
-  "InconsolataGo" = "0c6yhx242d82dalyjas42qniy0jagqs47cfsfarwmzar6zg3lj5m";
-  "InconsolataLGC" = "1746nl1rz4hscfgbmd8642wq3z1wizvfjb50y3yyjsc1ixc1f0pd";
-  "Iosevka" = "1qqd4xh98vxb99rh2a2qv9gjclilhaw84pyqdpbx225qhvw9xlkb";
-  "JetBrainsMono" = "1kc8fyk1aczxkmn8dzv1gy6xfi2jywgahd8np576v2dn8kx16844";
-  "Lekton" = "0mny5j9bns9104wg2wmabdw0sl80c7i3dzp4j5mxh8jybx929d3i";
-  "LiberationMono" = "19bpm893assmmnfvlvhz8df54c9pr2kfv2b6anlr4g64hliy1c1h";
-  "Meslo" = "08zm8nqskhrqkw80wl460zbvsrvs5fp2njlcv867phpqna9hyqzh";
-  "Monofur" = "0f5khqgdxi4g0qm5n48r1sk4pd2wlk987d8yxwks2mcsqa6fraqj";
-  "Monoid" = "0m7i82jfiwqmi9lhv8lmq2n723ihn0isxi5559478qbdy5b104dd";
-  "Mononoki" = "074avnvfl260pcrli4h5bc55yqr4mgd54paf80qcnh101qsz325w";
-  "MPlus" = "03mrfhzfmmqjfl7fa81v1ih3fdr3q2k439w6pjbd2zvl806l92yq";
-  "Noto" = "1jmycnf4fflijs730vbyj258kajkxv0j42655a7hvpapym7z940z";
-  "OpenDyslexic" = "0ma62xg6cy8l4chfhqvm64zzhx3mrzdj6gxwnvx8plqy3j4dn3by";
-  "Overpass" = "1xs2z3ch7dd32zb5l1axzd78hyskimqglcjcrb7n4ic85qm55xxm";
-  "ProFont" = "0ck4rprj0w29pv3qm4n1zg6cdq76m3kaag0ka4q1qqcnhga67zr7";
-  "ProggyClean" = "0sk3gk6zj61nbv94xv6z8y67sr5blg9n079d8srv7bbw9dv96i8g";
-  "RobotoMono" = "1nhbr9zc0cz81pdj95rrb56bwdkmmbqmk429nf60j35pkcqmvk8x";
-  "ShareTechMono" = "1h79myy0my3jyrvqcrgfdsjqrwwm5fdy2nmzp3ynyi769p7z1dwr";
-  "SourceCodePro" = "06cnsdmm84kzjlwwcmhwpj7pyfqinqpmww1c13i21l611fg6hwd7";
-  "SpaceMono" = "1xmmf2gdsa3ycl3pgpr3zr919qh702wjvc5k4hsdivvs2lzfdgmk";
-  "Terminus" = "0g2ybs225fwxmvwfnanc32jc2lfnag3agmliv1vrb5mxyqzm53gj";
-  "Tinos" = "077n4k6yh4qbirfkl02zqn3057kymspr10zcbfkf4ldvifa36pjd";
-  "Ubuntu" = "1lzdrgb8vk5dwicxhvkgbain5phf88g3zgv5ya2ihh052xsl3qih";
-  "UbuntuMono" = "0wa8ri7f3g8vwd194q812qh8nzplnmhl5ak0yhgilmm44s46ad0h";
-  "VictorMono" = "18z92kwggfqwrd5m09yda55hcb4b159278lps6f9hr8icwki6v9q";
+  "3270" = "1qj7jr2m2zcnvh7hxw2yqgvgl43wmbvmgxz58gsviw3mi3p4lap8";
+  "Agave" = "0whfp33cbrjdk12rbykmacbhfwrnz5r3c70nl55jbbkdv7cd4lp4";
+  "AnonymousPro" = "0w005gr3j3gh9z4vaa5mrnsjmqppvh8vk0plf3lvprmwi3gi2qng";
+  "Arimo" = "1rm16wyndxjdwjkiqishxryiahzqsw85dib3n3kcc45fmx0k2cz0";
+  "AurulentSansMono" = "1ncrf8jnn4vksqb3gkkk8kqxm12mzwyjrjrpsg8yi7qpx26np179";
+  "BigBlueTerminal" = "03y41b8s7v0dzimm0a8x80sblc8bgbmyng86mkf3h7j25qr5na67";
+  "BitstreamVeraSansMono" = "0r487ls05nnr1qlglxyli7vdlcif6yp6i37yjr431bgaiwzgz4jd";
+  "CascadiaCode" = "0lnpc20vw64h9ynphpdg2nwg6j77whyqd0ymz9vk89clshm1wjqa";
+  "CodeNewRoman" = "0mqpwc1b8x2p1zlgngmsi92nzi2d5ikvd9i034j9kcwhwzmq7lkr";
+  "Cousine" = "0vyc8afqhb4qqn2mq4fg8p1cxhqq0n4vgwz5rkjqc3w9m7fhpzv4";
+  "DaddyTimeMono" = "15q89x999ak13z26ljjwa70akidyziqs79ilm1l8zypah75gsdl0";
+  "DejaVuSansMono" = "0nak94fhc5c6is7ajdwh1hgamsrikhwjba1q3dhdngw475mc8fqm";
+  "DroidSansMono" = "0p064jsr78x157dsjsnmzph9gmx27v99kmrhr7ziz5s9swfih3jy";
+  "FantasqueSansMono" = "11m4dj1kncbqn4igqc4bfyn3kkb779v5ssnkmdqzbi0drmb4i2ag";
+  "FiraCode" = "1in9l75kqf6cdc3zzmksakr6717b711df9a4ci2mnh4m7smzvlks";
+  "FiraMono" = "037qz3n7wjgdxylblnffvbjy2r1x7h1rddhv0fqyz3af2px19l2z";
+  "Go-Mono" = "0k1shx5iqmm6draynvgxx7nk3gb628b13xv4kgv5w1sa675kg66g";
+  "Gohu" = "0bvprgg9qmpzlpp6dnbn4k9fjizyhaiwrri96ahvf740zmn2r14s";
+  "Hack" = "166zr5xx3b879q877a81hghflg2f1ghhmv8vp1xmzhpf9jnv1y89";
+  "Hasklig" = "0gb2l453659lp0zxg93v2rkqp06l8bxwan4rq3m3gacc4rq7bprm";
+  "HeavyData" = "1yddk977n3rr6hlqvq3qhl1kikg2ww98c953wnxry7a5fgv2f2q5";
+  "Hermit" = "0m1hh2d7ydbif3401f51gssxlsl4nw3gp7s0f8c6fr53icyri5wz";
+  "iA-Writer" = "0imd9dyqvwvprn5nvvwbs9vzvf3z0ag4z2m2y7c38pq9ap0b88cs";
+  "IBMPlexMono" = "15g50k4riy8yammvfdzbzkr6lvqv44m1dssw6z1f3hazkvl2l5bn";
+  "Inconsolata" = "04sh63qlv0fwys3l3jvkabna4m2aksixmqwww3kvax8i442fp84n";
+  "InconsolataGo" = "0j8a9fbwxhwhrxgqb9sfq62kk3k4z2vw77cxmfssznqa29mpmxms";
+  "InconsolataLGC" = "1w1p0b9fgm49v6pag2lqcsz4aynzlmhz1ni7szw2yk83v3g52yxi";
+  "Iosevka" = "0as9qs5ay8qic3iwg0jqrqm4p0w4siv065iy8cd7c5m8559bfx1p";
+  "JetBrainsMono" = "1amz3113b4pxgsminl4knkkzj59q1q5xyflbq1ng6n907xh3ghpz";
+  "Lekton" = "197ak6w7r3rq8h3j7rnw7611m6l8hyrziifp80m0y0x164q8aygq";
+  "LiberationMono" = "0i1d7q389b83153b1jrb93azhm228f2kxfy8lcjm9kwxa2qwjzn1";
+  "Lilex" = "0lk4smc8i6w7jyl34kza95rk00pmkgknldnjpspn25fj6kyfn3yi";
+  "Meslo" = "0xgzg1w1ams2ha45xl6bmw3dx7762hs31hm7sz1ssxb0s3nkfpcg";
+  "Monofur" = "010mafjkkg3qj50vzlb8lrbq2qngs095rl8qnlw6wax03lwsrrw6";
+  "Monoid" = "1mhww661d3x0kgvq6c92m3vzbgbjwn3xm2rc9gqjg2w3gwvp2klr";
+  "Mononoki" = "1d9x7fifymp9jj929s8sh16vdfhmz0p34axfwwkk3wwr52bv7ina";
+  "MPlus" = "1avdf6lq2sp9pv5j99whby59g4d5pjqyvha56gs3i9q84ysyhf4d";
+  "NerdFontsSymbolsOnly" = "1ics63pw31hzmqiy67fm1ccqga7vqcqrvrplb7f63gi4z8b0r2bf";
+  "OpenDyslexic" = "0kkm6ric7ygx3mmvv019j1q35zwzmi8x883nkz5wadb3vidscz08";
+  "Overpass" = "1rihdk0nhrx64bi9hky50s088cd1qr6acx6520d5r85za8lznxsk";
+  "ProFont" = "1x3srlq2v8y24yddqnx1rn4hc5n9li8ll0q1zl68vzi7qpy6rbv8";
+  "ProggyClean" = "173dbkch5fmlxfk6wqb08z1gynsf0vsn9pmzdm1ndb7zr420h2v6";
+  "RobotoMono" = "1ip6vcihl3cgzvpvmlrvqmaw33g46vr425qg2svb33bjzlswgv22";
+  "ShareTechMono" = "1l27gzb1d576xwmpnam1axsssppv06agm7w3pb7ki4jzva5yym2x";
+  "SourceCodePro" = "1zb95b76w9x3n37qs78yhi9iwha5425v844blmlrj6j8adwh69g7";
+  "SpaceMono" = "10kxcwikdxwplr91r1lspn7x2sllbfvr5yq3mpkspq7y24rix26d";
+  "Terminus" = "1bmdfdp8cjksdmb13dc4v9h5g6rx1ixkhbrsqj4vnyjdc6sjv796";
+  "Tinos" = "0g9i72r3srl0321gj7866a3c71id5388qd76y2f8qy0hghhhyhcp";
+  "Ubuntu" = "0rz014zc4nxiv4y11h9s4dkh8kfamfdzxbnvvqpy6dnxqmdb5piw";
+  "UbuntuMono" = "0fviwmlah0f7spgf7wwbmdd0wxb3in6wiqqbx04gymk3wb4v06yj";
+  "VictorMono" = "1bi424gr6r105mlbg3q47iplaawblbfm1iyc0wls9l42gibjxzww";
 }
--- a/pkgs/data/fonts/nerdfonts/version.nix
+++ b/pkgs/data/fonts/nerdfonts/version.nix
@ -1 +1 @@
-"2.1.0"
+"2.2.0"
--- a/pkgs/data/misc/ddccontrol-db/default.nix
+++ b/pkgs/data/misc/ddccontrol-db/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "ddccontrol-db";
-  version = "20220414";
+  version = "20220720";

  src = fetchFromGitHub {
    owner = "ddccontrol";
    repo = "ddccontrol-db";
    rev = version;
-    sha256 = "sha256-HlzwtcrnPnAAa3C1AwfS6P13mfXKXlwdlDDtVLcHPCA=";
+    sha256 = "sha256-A681Q0VSBUzxpTq+Dl4/ug+d0O134+Pc1LlcVPsWxmI=";
  };

  preConfigure = ''
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@ -45,13 +45,13 @@

 stdenv.mkDerivation rec {
  pname = "evolution-data-server";
-  version = "3.44.3";
+  version = "3.44.4";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "kEOrU/NB2hAxXFUDhKazIEMBk/yNeGHdJcTpsuC+Qls=";
+    sha256 = "wMZliDjVi6RgQqS55Qo7sRKWkeTNuEteugvzMLLMsus=";
  };

  patches = [
--- a/pkgs/development/compilers/aspectj/default.nix
+++ b/pkgs/development/compilers/aspectj/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "aspectj";
-  version = "1.9.7";
+  version = "1.9.9.1";
  builder = ./builder.sh;

  src = let
    versionSnakeCase = builtins.replaceStrings ["."] ["_"] version;
  in fetchurl {
    url = "https://github.com/eclipse/org.aspectj/releases/download/V${versionSnakeCase}/aspectj-${version}.jar";
-    sha256 = "sha256-xrg88nLOcagaAsFSnnYChhlv6EKhdBqkJJTDzhUBvTo=";
+    sha256 = "sha256-kiMQuEPXoSpHUiInkfYsrfCAcSc6mX42TRIBbeIQhWs=";
  };

  inherit jre;
--- a/pkgs/development/libraries/alkimia/default.nix
+++ b/pkgs/development/libraries/alkimia/default.nix
@ -5,11 +5,11 @@

 mkDerivation rec {
  pname = "alkimia";
-  version = "8.1.0";
+  version = "8.1.1";

  src = fetchurl {
    url = "mirror://kde/stable/alkimia/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-kWgHNScHsEkM3ZymVoLv9zsAylIwKb2m/nonSaG8knw=";
+    sha256 = "sha256-lXrcY8C+VN1DPjJoo3MjvlRW5auE7OJ/c6FhapLbhtU=";
  };

  nativeBuildInputs = [ extra-cmake-modules doxygen graphviz ];
--- a/pkgs/development/libraries/bobcat/default.nix
+++ b/pkgs/development/libraries/bobcat/default.nix
@ -4,10 +4,10 @@

 stdenv.mkDerivation rec {
  pname = "bobcat";
-  version = "5.09.01";
+  version = "5.10.01";

  src = fetchFromGitLab {
-    sha256 = "sha256-kaz15mNn/bq1HUknUJqXoLYxPRPX4w340sv9be0M+kQ=";
+    sha256 = "sha256-QhjUIaPSDAvOt0ZCzQWASpG+GJaTviosGDrzrckhuhs=";
    domain = "gitlab.com";
    rev = version;
    repo = "bobcat";
--- a/pkgs/development/libraries/flatcc/default.nix
+++ b/pkgs/development/libraries/flatcc/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "flatcc";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "dvidelabs";
    repo = "flatcc";
    rev = "v${version}";
-    sha256 = "0cy79swgdbaf3zmsaqa6gz3b0fad2yqawwcnsipnpl9d8hn1linm";
+    sha256 = "sha256-0/IZ7eX6b4PTnlSSdoOH0FsORGK9hrLr1zlr/IHsJFQ=";
  };

  nativeBuildInputs = [ cmake ];
@ -26,9 +26,10 @@ stdenv.mkDerivation rec {
    "-Wno-error=stringop-overflow"
  ];

-  meta = {
+  meta = with lib; {
    description = "FlatBuffers Compiler and Library in C for C ";
    homepage = "https://github.com/dvidelabs/flatcc";
-    license = [ lib.licenses.asl20 ];
+    license = [ licenses.asl20 ];
+    maintainers = with maintainers; [ onny ];
  };
 }
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@ -26,13 +26,13 @@

 mkDerivation rec {
  pname = "mlt";
-  version = "7.0.1";
+  version = "7.8.0";

  src = fetchFromGitHub {
    owner = "mltframework";
    repo = "mlt";
    rev = "v${version}";
-    sha256 = "13c5miph9jjbz69dhy0zvbkk5zbb05dr3vraaci0d5fdbrlhyscf";
+    sha256 = "sha256-r8lvzz083WWlDtjvlsPwvOgplx2lPPkDDf3t0G9PqAQ=";
  };

  buildInputs = [
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -44,6 +44,7 @@
 , "btc-rpc-explorer"
 , "castnow"
 , "carbon-now-cli"
+, "carto"
 , "cdk8s-cli"
 , "cdktf-cli"
 , "clean-css-cli"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/ocaml-modules/pbkdf/default.nix
+++ b/pkgs/development/ocaml-modules/pbkdf/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildDunePackage
-, fetchFromGitHub
+, fetchzip
 , cstruct
 , mirage-crypto
 , alcotest
@ -10,13 +10,12 @@ buildDunePackage rec {
  pname = "pbkdf";
  version = "1.2.0";

-  src = fetchFromGitHub {
-    owner = "abeaumont";
-    repo = "ocaml-pbkdf";
-    rev = version;
+  src = fetchzip {
+    url = "https://github.com/abeaumont/ocaml-pbkdf/archive/${version}.tar.gz";
    sha256 = "sha256-dGi4Vw+7VBpK/NpJ6zdpogm+E6G/oJovXCksJBSmqjI=";
  };

+  minimalOCamlVersion = "4.07";
  propagatedBuildInputs = [ cstruct mirage-crypto ];
  checkInputs = [ alcotest ];
  doCheck = true;
--- a/pkgs/development/python-modules/accuweather/default.nix
+++ b/pkgs/development/python-modules/accuweather/default.nix
@ -3,6 +3,7 @@
 , aioresponses
 , buildPythonPackage
 , fetchFromGitHub
+, orjson
 , pytest-asyncio
 , pytest-error-for-skips
 , pytestCheckHook
@ -11,14 +12,16 @@

 buildPythonPackage rec {
  pname = "accuweather";
-  version = "0.3.0";
-  disabled = pythonOlder "3.6";
+  version = "0.4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "bieniu";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Kn2hP0mdnC4+Lk8wsTznC23CsYLYKhya+HlHox1Fo2o=";
+    hash = "sha256-NnDpSOEIqPuPLIr0Ty6yjrs9WRKyhykcdyiRPB/cHEw=";
  };

  postPatch = ''
@ -30,6 +33,7 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    aiohttp
+    orjson
  ];

  checkInputs = [
@ -39,7 +43,9 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [ "accuweather" ];
+  pythonImportsCheck = [
+    "accuweather"
+  ];

  meta = with lib; {
    description = "Python wrapper for getting weather data from AccuWeather servers";
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "adafruit-platformdetect";
-  version = "3.27.1";
+  version = "3.27.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -15,7 +15,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "Adafruit-PlatformDetect";
    inherit version;
-    hash = "sha256-HAymQ08RauE8oATYzKE+UaqMsmNK3O+VyLLd6w/jPFc=";
+    hash = "sha256-bsehvoX625Lr+5/ieYnIBUMUpkCv3mlDDCCf2UyXsMk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -7,16 +7,16 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.14";
+  version = "9.2.15";
  format = "pyproject";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Axjyqn1TtZbYdgaC6hOhIQM3FBs0a1oHNK8wLuWQLHM=";
+    hash = "sha256-CXJ9UVTrJzXumDJ6wghDbxVfZo9ZC67qBpz8B5D0DLo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aioaladdinconnect/default.nix
+++ b/pkgs/development/python-modules/aioaladdinconnect/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "aioaladdinconnect";
-  version = "0.1.42";
+  version = "0.1.43";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -15,7 +15,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "AIOAladdinConnect";
    inherit version;
-    hash = "sha256-pCpMAG6QTKjJsLecTtBNrgCtUALsNFLrurFoPnrsGyE=";
+    hash = "sha256-P0o8LhjTzhfJerunTcadvYQOZMd7WbfnKbeAEhXFP1Q=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiobiketrax/default.nix
+++ b/pkgs/development/python-modules/aiobiketrax/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "aiobiketrax";
-  version = "0.2.0";
+  version = "0.2.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "basilfx";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-zaHetU0ZG3xkYrO6qA4o+NX8V5td/E08tPEohEwMjh0=";
+    hash = "sha256-jZBs1h+01Mbwpvy3hg5/DEIU5EPKW4P/iMqp4eb4EpM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "aliyun-python-sdk-iot";
-  version = "8.41.0";
+  version = "8.42.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-t/SIEW1JMTyeOhhxx6IhLsbQa0D3aqD2hqGk8+Ka0ns=";
+    hash = "sha256-pp1objaT0Galxz91V1OoMfogYQyZ1lZC6XGFd4wSTq8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -46,16 +46,16 @@ in

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.14";
+  version = "9.2.15";
  format = "pyproject";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-lxquiow2hI0xqdPLyZTZtxIo5nR60OtJV/kf6ukGF4c=";
+    hash = "sha256-9KWk4uB7VlYsnQbDCRgnVkis0UAZfiI2xH9cAD1Dd7M=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -2,26 +2,24 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
-, nose
 , pythonOlder
 }:

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.14";
+  version = "9.2.15";
  format = "pyproject";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-kWZ5z9Tn0SAqrGP4gtGfPny+kj/2ibSdTwp+0RCx40s=";
+    hash = "sha256-K9EAyCvwgWhiZ+rkPKPGBr3lWYIIRCf0FAzPjIjrcU8=";
  };

  checkInputs = [
-    nose
    pytestCheckHook
  ];

--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "bellows";
-  version = "0.32.0";
+  version = "0.33.1";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "zigpy";
    repo = "bellows";
    rev = "refs/tags/${version}";
-    sha256 = "sha256-+kD1V0SfRm0yYi64ciwtFK7YSVXnED6fBzQcGj6KKbo=";
+    sha256 = "sha256-cpWQdsuW3CA/8HowhMoVV++rrDnjFQcgp+A5CCElj6o=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@ -1,4 +1,5 @@
 { lib
+, bluetooth-data-tools
 , bluetooth-sensor-state-data
 , buildPythonPackage
 , fetchFromGitHub
@ -11,7 +12,7 @@

 buildPythonPackage rec {
  pname = "bthome-ble";
-  version = "0.3.6";
+  version = "0.3.8";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -20,7 +21,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Y8BKBi5DZYpUtcJS6lLD+dVPhtL2xavQcPymVhdl7Zw=";
+    hash = "sha256-J5i9r2bZtiEOqkQJ6yhTWboqvgo2gsi8z6XeyxtHwSw=";
  };

  nativeBuildInputs = [
@ -28,6 +29,7 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
+    bluetooth-data-tools
    bluetooth-sensor-state-data
    sensor-state-data
    pycryptodomex
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -14,16 +14,16 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.14";
+  version = "9.2.15";
  format = "pyproject";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-802ToJGxwJSFcnl3suQMPNz0/7HnqvqxCpy9u7iU6EE=";
+    hash = "sha256-3v5te+j3I4yzxoBO8kY8VGLCrWfb1iOz9GHzun1DT0I=";
  };

  propagatedBuildInputs = [
@ -43,7 +43,7 @@ buildPythonPackage rec {
  postPatch = ''
    # Use upstream z3 implementation
    substituteInPlace setup.cfg \
-      --replace "z3-solver >= 4.8.5.0" ""
+      --replace "z3-solver == 4.10.2.0" ""
  '';

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -15,7 +15,7 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.14";
+  version = "9.2.15";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
@ -31,13 +31,13 @@ buildPythonPackage rec {
  inherit version;
  format = "pyproject";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-ueR5reEmaI9drFMQn/CBHCW7DmsTWWYi1zCNaUQ2y7g=";
+    hash = "sha256-vGIthytW0gZy0X2OXuFwdBnPuvcWkV47FeaXZY8FCVc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@ -10,6 +10,7 @@
 , black
 , magic-wormhole
 , mitmproxy
+, typer
 }:

 buildPythonPackage rec {
@ -31,7 +32,7 @@ buildPythonPackage rec {
  ];

  passthru.tests = {
-    inherit black flask magic-wormhole mitmproxy;
+    inherit black flask magic-wormhole mitmproxy typer;
  };

  meta = with lib; {
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "fastcore";
-  version = "1.5.18";
+  version = "1.5.22";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "fastai";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-Ur12ewTfJyUUzrQyTP8qydzjxnHFcJDAw9xChN+mZ1Y=";
+    sha256 = "sha256-pJGyfo+7Sz4IxurkAo+51veN+o6gHAqBor5SLXERNdo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/flask/default.nix
+++ b/pkgs/development/python-modules/flask/default.nix
@ -10,6 +10,11 @@
 , werkzeug
 , pytestCheckHook
 , pythonOlder
+  # used in passthru.tests
+, flask-limiter
+, flask-restful
+, flask-restx
+, moto
 }:

 buildPythonPackage rec {
@ -35,6 +40,10 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  passthru.tests = {
+    inherit flask-limiter flask-restful flask-restx moto;
+  };
+
  meta = with lib; {
    homepage = "https://flask.palletsprojects.com/";
    description = "The Python micro framework for building web applications";
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "peaqevcore";
-  version = "5.12.0";
+  version = "5.14.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-iriCCsmdHEZ/tZtCn+G2VDBFCv/DvBjPEO6aW7YmL3M=";
+    hash = "sha256-YDdQ/q/QyR9vgY0jteAfQg6A4oCPKjFLySt/g74+eyw=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pydeconz/default.nix
+++ b/pkgs/development/python-modules/pydeconz/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "pydeconz";
-  version = "103";
+  version = "104";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "Kane610";
    repo = "deconz";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nxM9airO1/CF4g9CeyV2WMxh22fBtu0fjz1R3X1zm+o=";
+    hash = "sha256-bG2dhWa+KnSsigmOHE4wShaS56M9z6vqrFNek3PLbic=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pymicrobot/default.nix
+++ b/pkgs/development/python-modules/pymicrobot/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "pymicrobot";
-  version = "0.0.4";
+  version = "0.0.5";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -16,7 +16,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "PyMicroBot";
    inherit version;
-    hash = "sha256-lNrohVQruFAtrzTxJ6qEZ8tVM5fgrCRAG7WXJSKMRFs=";
+    hash = "sha256-k+xefVwswTL6ww0k4D6nScjUKUOxOQloXUOZ75S+sbY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/python-gnupg/default.nix
+++ b/pkgs/development/python-modules/python-gnupg/default.nix
@ -2,13 +2,13 @@

 buildPythonPackage rec {
  pname = "python-gnupg";
-  version = "0.4.9";
+  version = "0.5.0";

  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-qqdIeVVyWRqvEntKyJhWhPNnP/grOfNwyDawBuaPxTc=";
+    sha256 = "sha256-cHWOOH/A4MS628s5T2GsvmizSXCo/tfg98iUaf4XkSo=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ b/pkgs/development/python-modules/pyunifiprotect/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "pyunifiprotect";
-  version = "4.1.3";
+  version = "4.1.7";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "briis";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-tZo8+McpnJ1gekghtgH6m5w7nmVWB8CTxz5RGHv3xtE=";
+    hash = "sha256-FaH1fNNWQAe9hLrbLf0TCfcjY6MDmHrsmo3LaEsN3W4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "pyvex";
-  version = "9.2.14";
+  version = "9.2.15";
  format = "pyproject";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-xKy/+MbJJEYWXalvYhVi/J7IAn1CSrvkeg18vM0fy4k=";
+    hash = "sha256-Yik1RTz4SQBFJxgPzp7LnPHV4EMbxGEhD2fBVcKJC7c=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/qingping-ble/default.nix
+++ b/pkgs/development/python-modules/qingping-ble/default.nix
@ -1,4 +1,5 @@
 { lib
+, bluetooth-data-tools
 , bluetooth-sensor-state-data
 , buildPythonPackage
 , fetchFromGitHub
@ -10,7 +11,7 @@

 buildPythonPackage rec {
  pname = "qingping-ble";
-  version = "0.3.0";
+  version = "0.6.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -19,7 +20,7 @@ buildPythonPackage rec {
    owner = "bluetooth-devices";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-EZH6G/dvXU1sVH3pYoJeQQkJD1xMKuqb3omCVhHTS0A=";
+    hash = "sha256-0fa5KocDyy3JL7gohbbBghXwbCzbcjK4pVM+zckboHc=";
  };

  nativeBuildInputs = [
@ -27,6 +28,7 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
+    bluetooth-data-tools
    bluetooth-sensor-state-data
    sensor-state-data
  ];
--- a/pkgs/development/python-modules/thermobeacon-ble/default.nix
+++ b/pkgs/development/python-modules/thermobeacon-ble/default.nix
@ -0,0 +1,55 @@
+{ lib
+, bluetooth-data-tools
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "thermobeacon-ble";
+  version = "0.3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "bluetooth-devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-OvSvhOcJSThKyLXHhiwEZtCrYt6+KB5iArUKjfoi2OI=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-data-tools
+    bluetooth-sensor-state-data
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=thermobeacon_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "thermobeacon_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Thermobeacon BLE devices";
+    homepage = "https://github.com/bluetooth-devices/thermobeacon-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/thermopro-ble/default.nix
+++ b/pkgs/development/python-modules/thermopro-ble/default.nix
@ -0,0 +1,55 @@
+{ lib
+, bluetooth-data-tools
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "thermopro-ble";
+  version = "0.4.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "bluetooth-devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-5KfR01qsSGF2ZNklhm7he9Hskk8pqC2GEmIcsB4HpRY=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-data-tools
+    bluetooth-sensor-state-data
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=thermopro_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "thermopro_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Thermopro BLE devices";
+    homepage = "https://github.com/bluetooth-devices/thermopro-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/time-machine/default.nix
+++ b/pkgs/development/python-modules/time-machine/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "time-machine";
-  version = "2.8.0";
+  version = "2.8.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "adamchainz";
    repo = pname;
    rev = version;
-    sha256 = "sha256-L/03H91iZTyaB8vY0FGVu9iaesISAFHLIZliHI1NixI=";
+    sha256 = "sha256-65jX6R3tZ5guouEug/mClvNqg0LE4v9OGzCL0eFyqsA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/werkzeug/default.nix
+++ b/pkgs/development/python-modules/werkzeug/default.nix
@ -9,6 +9,8 @@
 , pytest-timeout
 , pytest-xprocess
 , pytestCheckHook
+# for passthru.tests
+, moto, sentry-sdk
 }:

 buildPythonPackage rec {
@ -53,6 +55,10 @@ buildPythonPackage rec {
    "-m 'not filterwarnings'"
  ];

+  passthru.tests = {
+    inherit moto sentry-sdk;
+  };
+
  meta = with lib; {
    homepage = "https://palletsprojects.com/p/werkzeug/";
    description = "The comprehensive WSGI web application library";
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "xknx";
-  version = "1.0.0";
+  version = "1.0.1";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "XKNX";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-gJw/PtPwXo1FJcEH8SYRyQNaJoWQIfH2Mnxu52CqI8s=";
+    sha256 = "sha256-QocUkY4wbEw0RCfKxOn14889pN1s67p0pGIR1rO4H5E=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/zigpy-zigate/default.nix
+++ b/pkgs/development/python-modules/zigpy-zigate/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "zigpy-zigate";
-  version = "0.9.1";
+  version = "0.9.2";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "zigpy";
    repo = "zigpy-zigate";
    rev = "refs/tags/${version}";
-    hash = "sha256-H1R+wNUo/J5ATINHrkC4mJ8KKnBxVZUvF6X7y54aiVQ=";
+    hash = "sha256-89e9QkFxBdw5YujL73zR7jys0sCJz5r/jNaVmLxv37g=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/zigpy-znp/default.nix
+++ b/pkgs/development/python-modules/zigpy-znp/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "zigpy-znp";
-  version = "0.8.1";
+  version = "0.8.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "zigpy";
    repo = pname;
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-GKdhzmSQZ+D7o9OJZ5880mRI1mIcckW+dY5DnP7zIuo=";
+    sha256 = "sha256-90D8MP8p0zFvmxtWXxfPzLuRACeVk4vGdUYxh6cZb08=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@ -5,6 +5,7 @@
 , buildPythonPackage
 , crccheck
 , cryptography
+, freezegun
 , fetchFromGitHub
 , pycryptodome
 , pytest-aiohttp
@ -16,7 +17,7 @@

 buildPythonPackage rec {
  pname = "zigpy";
-  version = "0.49.1";
+  version = "0.50.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -25,7 +26,7 @@ buildPythonPackage rec {
    owner = "zigpy";
    repo = "zigpy";
    rev = "refs/tags/${version}";
-    sha256 = "sha256-ai0qWKgsh8kIS4juvzpE+amsnIbEOJbhGutV75yRGog=";
+    hash = "sha256-0Ha2CgJLLLZjMEEj07GL6kbKcM+x0YblVIjABiaAhXg=";
  };

  propagatedBuildInputs = [
@ -38,6 +39,7 @@ buildPythonPackage rec {
  ];

  checkInputs = [
+    freezegun
    pytest-aiohttp
    pytest-timeout
    pytestCheckHook
@ -45,13 +47,6 @@ buildPythonPackage rec {
    asynctest
  ];

-  disabledTests = [
-    # RuntimeError: coroutine 'test_remigrate_forcibly_downgraded_v4' was never awaited
-    #"test_remigrate_forcibly_downgraded_v4"
-    # RuntimeError: Event loop is closed
-    #"test_startup"
-  ];
-
  pythonImportsCheck = [
    "zigpy.application"
    "zigpy.config"
--- a/pkgs/development/tools/cbfmt/default.nix
+++ b/pkgs/development/tools/cbfmt/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cbfmt";
-  version = "0.1.1";
+  version = "0.1.4";

  src = fetchFromGitHub {
    owner = "lukas-reineke";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-cTX7eBcEZiTJm3b1d2Mwu7NdbtHjeF+dkc3YMede0cQ=";
+    sha256 = "sha256-MOvTsyfKsBSog/0SpHJO9xiIc6/hmQVN4dqqytiiCgs=";
  };

-  cargoSha256 = "sha256-vEInZplfgrM4gD5wPATl7j5iTo9pSstElfd0Lq9giJw=";
+  cargoSha256 = "sha256-Vu4bcw5WSwS2MB0sPumoQDhSdjnZyzrYF8eMPeVallA=";

  passthru.tests.version = testers.testVersion {
    package = cbfmt;
--- a/pkgs/development/tools/continuous-integration/dagger/default.nix
+++ b/pkgs/development/tools/continuous-integration/dagger/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dagger";
-  version = "0.2.30";
+  version = "0.2.31";

  src = fetchFromGitHub {
    owner = "dagger";
    repo = "dagger";
    rev = "v${version}";
-    sha256 = "sha256-D/BamTjhAopoiQoEa9rqk25sGU7ZTTkze/tIKICTx5o=";
+    sha256 = "sha256-G4SittUyh0vqpDWi9vRxTB2Be+gwluYaLCSHDoV8uMg=";
  };

-  vendorSha256 = "sha256-IOLZ15Mr+IGWIE4nvMOyjbtYBYOhDMXFYFbOp8beD5w=";
+  vendorSha256 = "sha256-kQ40tydh3CpXupqDE5DRpnj4Xb36jpHAeTRvZf5ZNus=";

  subPackages = [
    "cmd/dagger"
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@ -43,13 +43,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "github-runner";
-  version = "2.295.0";
+  version = "2.296.0";

  src = fetchFromGitHub {
    owner = "actions";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-C5tINoFkd2PRbpnlSkPL/o59B7+J+so07oVvJu1m3dk=";
+    hash = "sha256-TLBd+L4k/qtY9q0j+soxaLCfER/USZyYCqk0r8A6sSo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/eclint/default.nix
+++ b/pkgs/development/tools/eclint/default.nix
@ -0,0 +1,26 @@
+{ lib
+, buildGoModule
+, fetchFromGitLab
+}:
+
+buildGoModule
+rec {
+  pname = "eclint";
+  version = "0.3.4";
+
+  src = fetchFromGitLab {
+    owner = "greut";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-inO41C/Ompyfy4CHPK4ksNU19KIcGyPgF/ptZC0GWXg=";
+  };
+
+  vendorSha256 = "sha256-imVQnPoKOjed9XlikLWvudmlJklRrLFHKtNZoAmznZg=";
+
+  meta = with lib; {
+    homepage = "https://gitlab.com/greut/eclint";
+    description = "EditorConfig linter written in Go";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lucperkins ];
+  };
+}
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "golangci-lint";
-  version = "1.48.0";
+  version = "1.49.0";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    rev = "v${version}";
-    sha256 = "sha256-6nXn1+LsjiXjCeHhvVjyU1F6IJ8YP1Oj+5tDRhiMuUc=";
+    sha256 = "sha256-L2PtDiMtT+vcMU4uW3GYZexLtDqnHRuUts7bIh/g0YA=";
  };

-  vendorSha256 = "sha256-4ZqO4NEZfIhl/hWcB0HeRbp2jQ/WhMBpTLmP2W7X7xM=";
+  vendorSha256 = "sha256-VPkOFUwp0Bm/YyBCbfQTa+R1bjau7Ai+p/TbgNxeejc=";

  doCheck = false;

--- a/pkgs/os-specific/linux/asus-ec-sensors/default.nix
+++ b/pkgs/os-specific/linux/asus-ec-sensors/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "asus-ec-sensors-${version}-${kernel.version}";
-  version = "unstable-2021-12-16";
+  version = "unstable-2022-07-10";

  src = fetchFromGitHub {
    owner = "zeule";
    repo = "asus-ec-sensors";
-    rev = "3621741c4ecb93216d546942707a9c413e971787";
-    sha256 = "0akdga2854q3w0pyi0jywa6cxr32541ifz0ka1hgn6j4czk39kyn";
+    rev = "5fbdd1461dc88fc952e02717b8120438ce5558b3";
+    sha256 = "sha256-kBGl8i7HzdItMoM7L91OfX6y+bqDfd22WICRg0n25pI=";
  };

  hardeningDisable = [ "pic" ];
@ -30,5 +30,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2;
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ nickhu ];
+    broken = kernel.kernelOlder "5.11";
  };
 }
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@ -394,6 +394,10 @@ let
      EXT4_FS_SECURITY  = yes;
      EXT4_ENCRYPTION   = option yes;

+      NTFS_FS            = whenAtLeast "5.15" no;
+      NTFS3_LZX_XPRESS   = whenAtLeast "5.15" yes;
+      NTFS3_FS_POSIX_ACL = whenAtLeast "5.15" yes;
+
      REISERFS_FS_XATTR     = option yes;
      REISERFS_FS_POSIX_ACL = option yes;
      REISERFS_FS_SECURITY  = option yes;
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.14.290";
+  version = "4.14.291";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0zyxb99a7fa2l85vnzmvg2nry99clj20d4j38piqm921iqxak2j4";
+    sha256 = "15h76l81zn733g8dc6gsymf52nz325plhminv3m4x3klwhav34zc";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.19.255";
+  version = "4.19.256";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0hwa3g09cmllc2z01s2jqbczpznzdp3ldngx18k5c2ac7w394fbp";
+    sha256 = "0jgm7ydha9achbcq3a6q85wq1nz4qg7phx122jzk0mqb1339bpk7";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:

 buildLinux (args // rec {
-  version = "4.9.325";
+  version = "4.9.326";
  extraMeta.branch = "4.9";
  extraMeta.broken = stdenv.isAarch64;

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "04msx0x0d8v93zjr3jj0qqkgg7m4hb7rj6hk5vzrzasmgbjmb3dl";
+    sha256 = "0yw83a8nk5abjsvqrz8m2sj699c228j2f2wr5q8m95vgqzfw5wrb";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.10.137";
+  version = "5.10.138";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1j0n2r793pkvymjc70fzqwqi6h2j1wkja2kx012ydmsk2i6wssy1";
+    sha256 = "1a2vmcqzi71w88j79lxsrgyycq1l1gxp0cvh5ya4afhfisxh7819";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.15.62";
+  version = "5.15.63";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0hgiag3mvdlcr6ckfy4bdr7h4471zqi53ahfybdvdkapivg7r086";
+    sha256 = "0hbkxgadz0vcslni4r46yc202wcnxblcfvkcph1017b2b8gcvlvd";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.19.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.19.3";
+  version = "5.19.4";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "08978hjl4khc0v8nb8wvrjnc8x8csvpf7airawpb4pvg0rrdcfsi";
+    sha256 = "11xzz5glbc7p3j9mhv6dvi9iv345ykpyihm8mby8vyas12bln8d9";
  };
 } // (args.argsOverride or { }))
--- a/Show More
+++ b/Show More