Merge master into haskell-updates

2023-03-12 00:13:51 +00:00 · 2023-03-12 00:13:51 +00:00 · f2032fa12b
commit f2032fa12b
parent f2ae2be316 8b6900dc2f
138 changed files with 1278 additions and 433 deletions
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@ -71,6 +71,7 @@ The main difference between `fetchurl` and `fetchzip` is in how they store the c

 - `relative`: Similar to using `git-diff`'s `--relative` flag, only keep changes inside the specified directory, making paths relative to it.
 - `stripLen`: Remove the first `stripLen` components of pathnames in the patch.
+- `decode`: Pipe the downloaded data through this command before processing it as a patch.
 - `extraPrefix`: Prefix pathnames by this string.
 - `excludes`: Exclude files matching these patterns (applies after the above arguments).
 - `includes`: Include only files matching these patterns (applies after the above arguments).
--- a/nixos/modules/programs/java.nix
+++ b/nixos/modules/programs/java.nix
@ -8,7 +8,6 @@ with lib;
 let
  cfg = config.programs.java;
 in
-
 {

  options = {
@ -40,12 +39,35 @@ in
        type = types.package;
      };

+      binfmt = mkEnableOption (lib.mdDoc "binfmt to execute java jar's and classes");
+
    };

  };

  config = mkIf cfg.enable {

+    boot.binfmt.registrations = mkIf cfg.binfmt {
+      java-class = {
+        recognitionType = "extension";
+        magicOrExtension = "class";
+        interpreter = pkgs.writeShellScript "java-class-wrapper" ''
+          test -e ${cfg.package}/nix-support/setup-hook && source ${cfg.package}/nix-support/setup-hook
+          classpath=$(dirname "$1")
+          class=$(basename "''${1%%.class}")
+          $JAVA_HOME/bin/java -classpath "$classpath" "$class" "''${@:2}"
+        '';
+      };
+      java-jar = {
+        recognitionType = "extension";
+        magicOrExtension = "jar";
+        interpreter = pkgs.writeShellScript "java-jar-wrapper" ''
+          test -e ${cfg.package}/nix-support/setup-hook && source ${cfg.package}/nix-support/setup-hook
+          $JAVA_HOME/bin/java -jar "$@"
+        '';
+      };
+    };
+
    environment.systemPackages = [ cfg.package ];

    environment.shellInit = ''
--- a/nixos/modules/services/backup/btrbk.nix
+++ b/nixos/modules/services/backup/btrbk.nix
@ -47,7 +47,12 @@ let
    then [ "${name} ${value}" ]
    else concatLists (mapAttrsToList (genSection name) value);

-  addDefaults = settings: { backend = "btrfs-progs-sudo"; } // settings;
+  sudo_doas =
+    if config.security.sudo.enable then "sudo"
+    else if config.security.doas.enable then "doas"
+    else throw "The btrbk nixos module needs either sudo or doas enabled in the configuration";
+
+  addDefaults = settings: { backend = "btrfs-progs-${sudo_doas}"; } // settings;

  mkConfigFile = name: settings: pkgs.writeTextFile {
    name = "btrbk-${name}.conf";
@ -152,20 +157,41 @@ in
  };
  config = mkIf (sshEnabled || serviceEnabled) {
    environment.systemPackages = [ pkgs.btrbk ] ++ cfg.extraPackages;
-    security.sudo.extraRules = [
-      {
-        users = [ "btrbk" ];
-        commands = [
-          { command = "${pkgs.btrfs-progs}/bin/btrfs"; options = [ "NOPASSWD" ]; }
-          { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }
-          { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }
-          # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}
-          { command = "/run/current-system/bin/btrfs"; options = [ "NOPASSWD" ]; }
-          { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }
-          { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }
+    security.sudo = mkIf (sudo_doas == "sudo") {
+      extraRules = [
+        {
+            users = [ "btrbk" ];
+            commands = [
+            { command = "${pkgs.btrfs-progs}/bin/btrfs"; options = [ "NOPASSWD" ]; }
+            { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }
+            { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }
+            # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}
+            { command = "/run/current-system/bin/btrfs"; options = [ "NOPASSWD" ]; }
+            { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }
+            { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }
+            ];
+        }
+      ];
+    };
+    security.doas = mkIf (sudo_doas == "doas") {
+      extraRules = let
+        doasCmdNoPass = cmd: { users = [ "btrbk" ]; cmd = cmd; noPass = true; };
+      in
+        [
+            (doasCmdNoPass "${pkgs.btrfs-progs}/bin/btrfs")
+            (doasCmdNoPass "${pkgs.coreutils}/bin/mkdir")
+            (doasCmdNoPass "${pkgs.coreutils}/bin/readlink")
+            # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}
+            (doasCmdNoPass "/run/current-system/bin/btrfs")
+            (doasCmdNoPass "/run/current-system/sw/bin/mkdir")
+            (doasCmdNoPass "/run/current-system/sw/bin/readlink")
+
+            # doas matches command, not binary
+            (doasCmdNoPass "btrfs")
+            (doasCmdNoPass "mkdir")
+            (doasCmdNoPass "readlink")
        ];
-      }
-    ];
+    };
    users.users.btrbk = {
      isSystemUser = true;
      # ssh needs a home directory
@ -183,8 +209,9 @@ in
              "best-effort" = 2;
              "realtime" = 1;
            }.${cfg.ioSchedulingClass};
+            sudo_doas_flag = "--${sudo_doas}";
          in
-          ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"} ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh --sudo ${options}" ${v.key}''
+          ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"} ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options}" ${v.key}''
        )
        cfg.sshAccess;
    };
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@ -18,6 +18,12 @@ let
        fwupd = cfg.daemonSettings;
      };
    };
+
+    "fwupd/uefi_capsule.conf" = {
+      source = format.generate "uefi_capsule.conf" {
+        uefi_capsule = cfg.uefiCapsuleSettings;
+      };
+    };
  };

  originalEtc =
@ -138,6 +144,16 @@ in {
          Configurations for the fwupd daemon.
        '';
      };
+
+      uefiCapsuleSettings = mkOption {
+        type = types.submodule {
+          freeformType = format.type.nestedTypes.elemType;
+        };
+        default = {};
+        description = lib.mdDoc ''
+          UEFI capsule configurations for the fwupd daemon.
+        '';
+      };
    };
  };

--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -448,6 +448,7 @@ in
            kio-extras
          ];
          optionalPackages = [
+            ark
            elisa
            gwenview
            okular
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@ -85,18 +85,18 @@ def copy_from_profile(profile: Optional[str], generation: int, specialisation: O
    return efi_file_path


-def describe_generation(generation_dir: str) -> str:
+def describe_generation(profile: Optional[str], generation: int, specialisation: Optional[str]) -> str:
    try:
-        with open("%s/nixos-version" % generation_dir) as f:
+        with open(profile_path(profile, generation, specialisation, "nixos-version")) as f:
            nixos_version = f.read()
    except IOError:
        nixos_version = "Unknown"

-    kernel_dir = os.path.dirname(os.path.realpath("%s/kernel" % generation_dir))
+    kernel_dir = os.path.dirname(profile_path(profile, generation, specialisation, "kernel"))
    module_dir = glob.glob("%s/lib/modules/*" % kernel_dir)[0]
    kernel_version = os.path.basename(module_dir)

-    build_time = int(os.path.getctime(generation_dir))
+    build_time = int(os.path.getctime(system_dir(profile, generation, specialisation)))
    build_date = datetime.datetime.fromtimestamp(build_time).strftime('%F')

    description = "@distroName@ {}, Linux Kernel {}, Built on {}".format(
@ -131,11 +131,10 @@ def write_entry(profile: Optional[str], generation: int, specialisation: Optiona
                  "or renamed a file in `boot.initrd.secrets`", file=sys.stderr)
    entry_file = "@efiSysMountPoint@/loader/entries/%s" % (
        generation_conf_filename(profile, generation, specialisation))
-    generation_dir = os.readlink(system_dir(profile, generation, specialisation))
    tmp_path = "%s.tmp" % (entry_file)
-    kernel_params = "init=%s/init " % generation_dir
+    kernel_params = "init=%s " % profile_path(profile, generation, specialisation, "init")

-    with open("%s/kernel-params" % (generation_dir)) as params_file:
+    with open(profile_path(profile, generation, specialisation, "kernel-params")) as params_file:
        kernel_params = kernel_params + params_file.read()
    with open(tmp_path, 'w') as f:
        f.write(BOOT_ENTRY.format(title=title,
@ -143,7 +142,7 @@ def write_entry(profile: Optional[str], generation: int, specialisation: Optiona
                    kernel=kernel,
                    initrd=initrd,
                    kernel_params=kernel_params,
-                    description=describe_generation(generation_dir)))
+                    description=describe_generation(profile, generation, specialisation)))
        if machine_id is not None:
            f.write("machine-id %s\n" % machine_id)
    os.rename(tmp_path, entry_file)
@ -296,7 +295,7 @@ def main() -> None:
    remove_old_entries(gens)
    for gen in gens:
        try:
-            is_default = os.readlink(system_dir(*gen)) == args.default_config
+            is_default = os.path.dirname(profile_path(*gen, "init")) == args.default_config
            write_entry(*gen, machine_id, current=is_default)
            for specialisation in get_specialisations(*gen):
                write_entry(*specialisation, machine_id, current=is_default)
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -108,6 +108,7 @@ in {
  breitbandmessung = handleTest ./breitbandmessung.nix {};
  brscan5 = handleTest ./brscan5.nix {};
  btrbk = handleTest ./btrbk.nix {};
+  btrbk-doas = handleTest ./btrbk-doas.nix {};
  btrbk-no-timer = handleTest ./btrbk-no-timer.nix {};
  btrbk-section-order = handleTest ./btrbk-section-order.nix {};
  buildbot = handleTest ./buildbot.nix {};
@ -689,6 +690,7 @@ in {
  terminal-emulators = handleTest ./terminal-emulators.nix {};
  tiddlywiki = handleTest ./tiddlywiki.nix {};
  tigervnc = handleTest ./tigervnc.nix {};
+  timescaledb = handleTest ./timescaledb.nix {};
  timezone = handleTest ./timezone.nix {};
  tinc = handleTest ./tinc {};
  tinydns = handleTest ./tinydns.nix {};
--- a/nixos/tests/btrbk-doas.nix
+++ b/nixos/tests/btrbk-doas.nix
@ -0,0 +1,114 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+  let
+    privateKey = ''
+      -----BEGIN OPENSSH PRIVATE KEY-----
+      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+      QyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrwAAAJB+cF5HfnBe
+      RwAAAAtzc2gtZWQyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrw
+      AAAEBN75NsJZSpt63faCuaD75Unko0JjlSDxMhYHAPJk2/xXHxQHThDpD9/AMWNqQer3Tg
+      9gXMb2lTZMn0pelo8xyvAAAADXJzY2h1ZXR6QGt1cnQ=
+      -----END OPENSSH PRIVATE KEY-----
+    '';
+    publicKey = ''
+      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHxQHThDpD9/AMWNqQer3Tg9gXMb2lTZMn0pelo8xyv
+    '';
+  in
+  {
+    name = "btrbk-doas";
+    meta = with pkgs.lib; {
+      maintainers = with maintainers; [ symphorien tu-maurice ];
+    };
+
+    nodes = {
+      archive = { ... }: {
+        security.sudo.enable = false;
+        security.doas.enable = true;
+        environment.systemPackages = with pkgs; [ btrfs-progs ];
+        # note: this makes the privateKey world readable.
+        # don't do it with real ssh keys.
+        environment.etc."btrbk_key".text = privateKey;
+        services.btrbk = {
+          extraPackages = [ pkgs.lz4 ];
+          instances = {
+            remote = {
+              onCalendar = "minutely";
+              settings = {
+                ssh_identity = "/etc/btrbk_key";
+                ssh_user = "btrbk";
+                stream_compress = "lz4";
+                volume = {
+                  "ssh://main/mnt" = {
+                    target = "/mnt";
+                    snapshot_dir = "btrbk/remote";
+                    subvolume = "to_backup";
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+
+      main = { ... }: {
+        security.sudo.enable = false;
+        security.doas.enable = true;
+        environment.systemPackages = with pkgs; [ btrfs-progs ];
+        services.openssh = {
+          enable = true;
+          passwordAuthentication = false;
+          kbdInteractiveAuthentication = false;
+        };
+        services.btrbk = {
+          extraPackages = [ pkgs.lz4 ];
+          sshAccess = [
+            {
+              key = publicKey;
+              roles = [ "source" "send" "info" "delete" ];
+            }
+          ];
+          instances = {
+            local = {
+              onCalendar = "minutely";
+              settings = {
+                volume = {
+                  "/mnt" = {
+                    snapshot_dir = "btrbk/local";
+                    subvolume = "to_backup";
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      # create btrfs partition at /mnt
+      for machine in (archive, main):
+        machine.succeed("dd if=/dev/zero of=/data_fs bs=120M count=1")
+        machine.succeed("mkfs.btrfs /data_fs")
+        machine.succeed("mkdir /mnt")
+        machine.succeed("mount /data_fs /mnt")
+
+      # what to backup and where
+      main.succeed("btrfs subvolume create /mnt/to_backup")
+      main.succeed("mkdir -p /mnt/btrbk/{local,remote}")
+
+      # check that local snapshots work
+      with subtest("local"):
+          main.succeed("echo foo > /mnt/to_backup/bar")
+          main.wait_until_succeeds("cat /mnt/btrbk/local/*/bar | grep foo")
+          main.succeed("echo bar > /mnt/to_backup/bar")
+          main.succeed("cat /mnt/btrbk/local/*/bar | grep foo")
+
+      # check that btrfs send/receive works and ssh access works
+      with subtest("remote"):
+          archive.wait_until_succeeds("cat /mnt/*/bar | grep bar")
+          main.succeed("echo baz > /mnt/to_backup/bar")
+          archive.succeed("cat /mnt/*/bar | grep bar")
+    '';
+  })
--- a/nixos/tests/kea.nix
+++ b/nixos/tests/kea.nix
@ -1,3 +1,10 @@
+# This test verifies DHCPv4 interaction between a client and a router.
+# For successful DHCP allocations a dynamic update request is sent
+# towards a nameserver to allocate a name in the lan.nixos.test zone.
+# We then verify whether client and router can ping each other, and
+# that the nameserver can resolve the clients fqdn to the correct IP
+# address.
+
 import ./make-test-python.nix ({ pkgs, lib, ...}: {
  meta.maintainers = with lib.maintainers; [ hexa ];

@ -8,17 +15,17 @@ import ./make-test-python.nix ({ pkgs, lib, ...}: {
      virtualisation.vlans = [ 1 ];

      networking = {
-        useNetworkd = true;
        useDHCP = false;
        firewall.allowedUDPPorts = [ 67 ];
      };

      systemd.network = {
+        enable = true;
        networks = {
          "01-eth1" = {
            name = "eth1";
            networkConfig = {
-              Address = "10.0.0.1/30";
+              Address = "10.0.0.1/29";
            };
          };
        };
@ -45,13 +52,115 @@ import ./make-test-python.nix ({ pkgs, lib, ...}: {
          };

          subnet4 = [ {
-            subnet = "10.0.0.0/30";
+            subnet = "10.0.0.0/29";
            pools = [ {
-              pool = "10.0.0.2 - 10.0.0.2";
+              pool = "10.0.0.3 - 10.0.0.3";
            } ];
          } ];
+
+          # Enable communication between dhcp4 and a local dhcp-ddns
+          # instance.
+          # https://kea.readthedocs.io/en/kea-2.2.0/arm/dhcp4-srv.html#ddns-for-dhcpv4
+          dhcp-ddns = {
+            enable-updates = true;
+          };
+
+          ddns-send-updates = true;
+          ddns-qualifying-suffix = "lan.nixos.test.";
        };
      };
+
+      services.kea.dhcp-ddns = {
+        enable = true;
+        settings = {
+          forward-ddns = {
+            # Configure updates of a forward zone named `lan.nixos.test`
+            # hosted at the nameserver at 10.0.0.2
+            # https://kea.readthedocs.io/en/kea-2.2.0/arm/ddns.html#adding-forward-dns-servers
+            ddns-domains = [ {
+              name = "lan.nixos.test.";
+              # Use a TSIG key in production!
+              key-name = "";
+              dns-servers = [ {
+                ip-address = "10.0.0.2";
+                port = 53;
+              } ];
+            } ];
+          };
+        };
+      };
+    };
+
+    nameserver = { config, pkgs, ... }: {
+      virtualisation.vlans = [ 1 ];
+
+      networking = {
+        useDHCP = false;
+        firewall.allowedUDPPorts = [ 53 ];
+      };
+
+      systemd.network = {
+        enable = true;
+        networks = {
+          "01-eth1" = {
+            name = "eth1";
+            networkConfig = {
+              Address = "10.0.0.2/29";
+            };
+          };
+        };
+      };
+
+      services.resolved.enable = false;
+
+      # Set up an authoritative nameserver, serving the `lan.nixos.test`
+      # zone and configure an ACL that allows dynamic updates from
+      # the router's ip address.
+      # This ACL is likely insufficient for production usage. Please
+      # use TSIG keys.
+      services.knot = let
+        zone = pkgs.writeTextDir "lan.nixos.test.zone" ''
+          @ SOA ns.nixos.test nox.nixos.test 0 86400 7200 3600000 172800
+          @ NS nameserver
+          nameserver A 10.0.0.3
+          router A 10.0.0.1
+        '';
+        zonesDir = pkgs.buildEnv {
+          name = "knot-zones";
+          paths = [ zone ];
+        };
+      in {
+        enable = true;
+        extraArgs = [
+          "-v"
+        ];
+        extraConfig = ''
+          server:
+              listen: 0.0.0.0@53
+
+          log:
+            - target: syslog
+              any: debug
+
+          acl:
+            - id: dhcp_ddns
+              address: 10.0.0.1
+              action: update
+
+          template:
+            - id: default
+              storage: ${zonesDir}
+              zonefile-sync: -1
+              zonefile-load: difference-no-serial
+              journal-content: all
+
+          zone:
+            - domain: lan.nixos.test
+              file: lan.nixos.test.zone
+              acl: [dhcp_ddns]
+        '';
+      };
+
    };

    client = { config, pkgs, ... }: {
@ -70,6 +179,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...}: {
    router.wait_for_unit("kea-dhcp4-server.service")
    client.wait_for_unit("systemd-networkd-wait-online.service")
    client.wait_until_succeeds("ping -c 5 10.0.0.1")
-    router.wait_until_succeeds("ping -c 5 10.0.0.2")
+    router.wait_until_succeeds("ping -c 5 10.0.0.3")
+    nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
  '';
 })
--- a/nixos/tests/knot.nix
+++ b/nixos/tests/knot.nix
@ -31,7 +31,7 @@ let
  # DO NOT USE pkgs.writeText IN PRODUCTION. This put secrets in the nix store!
  tsigFile = pkgs.writeText "tsig.conf" ''
    key:
-      - id: slave_key
+      - id: xfr_key
        algorithm: hmac-sha256
        secret: zOYgOgnzx3TGe5J5I/0kxd7gTcxXhLYMEq3Ek3fY37s=
  '';
@ -43,7 +43,7 @@ in {


  nodes = {
-    master = { lib, ... }: {
+    primary = { lib, ... }: {
      imports = [ common ];

      # trigger sched_setaffinity syscall
@ -64,22 +64,17 @@ in {
        server:
            listen: 0.0.0.0@53
            listen: ::@53
-
-        acl:
-          - id: slave_acl
-            address: 192.168.0.2
-            key: slave_key
-            action: transfer
+            automatic-acl: true

        remote:
-          - id: slave
+          - id: secondary
            address: 192.168.0.2@53
+            key: xfr_key

        template:
          - id: default
            storage: ${knotZonesEnv}
-            notify: [slave]
-            acl: [slave_acl]
+            notify: [secondary]
            dnssec-signing: on
            # Input-only zone files
            # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3
@ -105,7 +100,7 @@ in {
      '';
    };

-    slave = { lib, ... }: {
+    secondary = { lib, ... }: {
      imports = [ common ];
      networking.interfaces.eth1 = {
        ipv4.addresses = lib.mkForce [
@ -122,21 +117,16 @@ in {
        server:
            listen: 0.0.0.0@53
            listen: ::@53
-
-        acl:
-          - id: notify_from_master
-            address: 192.168.0.1
-            action: notify
+            automatic-acl: true

        remote:
-          - id: master
+          - id: primary
            address: 192.168.0.1@53
-            key: slave_key
+            key: xfr_key

        template:
          - id: default
-            master: master
-            acl: [notify_from_master]
+            master: primary
            # zonefileless setup
            # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-2
            zonefile-sync: -1
@ -174,19 +164,19 @@ in {
  };

  testScript = { nodes, ... }: let
-    master4 = (lib.head nodes.master.config.networking.interfaces.eth1.ipv4.addresses).address;
-    master6 = (lib.head nodes.master.config.networking.interfaces.eth1.ipv6.addresses).address;
+    primary4 = (lib.head nodes.primary.config.networking.interfaces.eth1.ipv4.addresses).address;
+    primary6 = (lib.head nodes.primary.config.networking.interfaces.eth1.ipv6.addresses).address;

-    slave4 = (lib.head nodes.slave.config.networking.interfaces.eth1.ipv4.addresses).address;
-    slave6 = (lib.head nodes.slave.config.networking.interfaces.eth1.ipv6.addresses).address;
+    secondary4 = (lib.head nodes.secondary.config.networking.interfaces.eth1.ipv4.addresses).address;
+    secondary6 = (lib.head nodes.secondary.config.networking.interfaces.eth1.ipv6.addresses).address;
  in ''
    import re

    start_all()

    client.wait_for_unit("network.target")
-    master.wait_for_unit("knot.service")
-    slave.wait_for_unit("knot.service")
+    primary.wait_for_unit("knot.service")
+    secondary.wait_for_unit("knot.service")


    def test(host, query_type, query, pattern):
@ -195,7 +185,7 @@ in {
        assert re.search(pattern, out), f'Did not match "{pattern}"'


-    for host in ("${master4}", "${master6}", "${slave4}", "${slave6}"):
+    for host in ("${primary4}", "${primary6}", "${secondary4}", "${secondary6}"):
        with subtest(f"Interrogate {host}"):
            test(host, "SOA", "example.com", r"start of authority.*noc\.example\.com\.")
            test(host, "A", "example.com", r"has no [^ ]+ record")
@ -211,6 +201,6 @@ in {
            test(host, "RRSIG", "www.example.com", r"RR set signature is")
            test(host, "DNSKEY", "example.com", r"DNSSEC key is")

-    master.log(master.succeed("systemd-analyze security knot.service | grep -v '✓'"))
+    primary.log(primary.succeed("systemd-analyze security knot.service | grep -v '✓'"))
  '';
 })
--- a/nixos/tests/timescaledb.nix
+++ b/nixos/tests/timescaledb.nix
@ -0,0 +1,93 @@
+# mostly copied from ./postgresql.nix as it seemed unapproriate to
+# test additional extensions for postgresql there.
+
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+let
+  postgresql-versions = import ../../pkgs/servers/sql/postgresql pkgs;
+  test-sql = pkgs.writeText "postgresql-test" ''
+    CREATE EXTENSION timescaledb;
+    CREATE EXTENSION timescaledb_toolkit;
+
+    CREATE TABLE sth (
+      time TIMESTAMPTZ NOT NULL,
+      value DOUBLE PRECISION
+    );
+
+    SELECT create_hypertable('sth', 'time');
+
+    INSERT INTO sth (time, value) VALUES
+    ('2003-04-12 04:05:06 America/New_York', 1.0),
+    ('2003-04-12 04:05:07 America/New_York', 2.0),
+    ('2003-04-12 04:05:08 America/New_York', 3.0),
+    ('2003-04-12 04:05:09 America/New_York', 4.0),
+    ('2003-04-12 04:05:10 America/New_York', 5.0)
+    ;
+
+    WITH t AS (
+      SELECT
+        time_bucket('1 day'::interval, time) AS dt,
+        stats_agg(value) AS stats
+      FROM sth
+      GROUP BY time_bucket('1 day'::interval, time)
+    )
+    SELECT
+      average(stats)
+    FROM t;
+  '';
+  make-postgresql-test = postgresql-name: postgresql-package: makeTest {
+    name = postgresql-name;
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ typetetris ];
+    };
+
+    nodes.machine = { ... }:
+      {
+        services.postgresql = {
+          enable = true;
+          package = postgresql-package;
+          extraPlugins = with postgresql-package.pkgs; [
+            timescaledb
+            timescaledb_toolkit
+          ];
+          settings = { shared_preload_libraries = "timescaledb, timescaledb_toolkit"; };
+        };
+      };
+
+    testScript = ''
+      def check_count(statement, lines):
+          return 'test $(sudo -u postgres psql postgres -tAc "{}"|wc -l) -eq {}'.format(
+              statement, lines
+          )
+
+
+      machine.start()
+      machine.wait_for_unit("postgresql")
+
+      with subtest("Postgresql with extensions timescaledb and timescaledb_toolkit is available just after unit start"):
+          machine.succeed(
+              "sudo -u postgres psql -f ${test-sql}"
+          )
+
+      machine.fail(check_count("SELECT * FROM sth;", 3))
+      machine.succeed(check_count("SELECT * FROM sth;", 5))
+      machine.fail(check_count("SELECT * FROM sth;", 4))
+
+      machine.shutdown()
+    '';
+
+  };
+  applicablePostgresqlVersions = filterAttrs (_: value: versionAtLeast value.version "12") postgresql-versions;
+in
+mapAttrs'
+  (name: package: {
+    inherit name;
+    value = make-postgresql-test name package;
+  })
+  applicablePostgresqlVersions
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@ -24,11 +24,11 @@

 stdenv.mkDerivation rec {
  pname = "bitwig-studio";
-  version = "4.4.6";
+  version = "4.4.8";

  src = fetchurl {
    url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "sha256-VcK74JrVH81sgNeh1FDvCO1jtgkVeLpx5IqlXuzH27A=";
+    sha256 = "sha256-qdqRvCmp6Q7lcTdOIEHeQKAAOLtJxs867gapopyeHuc=";
  };

  nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@ -52,13 +52,13 @@

 mkDerivation rec {
  pname = "mixxx";
-  version = "2.3.3";
+  version = "2.3.4";

  src = fetchFromGitHub {
    owner = "mixxxdj";
    repo = "mixxx";
    rev = version;
-    sha256 = "sha256-NRtrEobdJMFgDXrEeb2t1zeVN8pQP7+pda2DSU/yNX8=";
+    sha256 = "sha256-1hOMU/Mdk1vT0GQipn/WX2fm9ddN0mPIq7kf2i2w3xQ=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
@ -116,7 +116,7 @@ mkDerivation rec {

  # mixxx installs udev rules to DATADIR instead of SYSCONFDIR
  # let's disable this and install udev rules manually via postInstall
-  # see https://github.com/mixxxdj/mixxx/blob/2.3.3/CMakeLists.txt#L1381-L1392
+  # see https://github.com/mixxxdj/mixxx/blob/2.3.4/CMakeLists.txt#L1381-L1392
  cmakeFlags = [
    "-DINSTALL_USER_UDEV_RULES=OFF"
  ];
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "mympd";
-  version = "10.2.4";
+  version = "10.2.5";

  src = fetchFromGitHub {
    owner = "jcorporation";
    repo = "myMPD";
    rev = "v${version}";
-    sha256 = "sha256-12hCIAwrLQkwiU9t9nNPBdIiHfMidfErSWOA0FPfhBQ=";
+    sha256 = "sha256-ZxGMvbm9GKhhfCNZdeIYUh2FF4c3vXtvRdu24u3Zrtg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ncspot";
-  version = "0.12.0";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "hrkfdn";
    repo = "ncspot";
    rev = "v${version}";
-    sha256 = "sha256-kqGYBaXmGeGuGJ5fcc4OQzHISU8fVuQNGwiD8nyPa/0=";
+    hash = "sha256-YWA8chp33SkMdo+XT/7qikIkgwt8pozC9wMFpY8Dv8Q=";
  };

-  cargoSha256 = "sha256-gVXH2pFtyMfYkCqda9NrqOgczvmxiWHe0zArJfnnrgE=";
+  cargoHash = "sha256-DB3r6pPtustEQG8QXM6qT1hkd7msC//46bhVP/HMxnY=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@ -5,16 +5,14 @@
 # input plugins
 , libmad, taglib, libvorbis, libogg, flac, libmpcdec, libmodplug, libsndfile
 , libcdio, cdparanoia, libcddb, faad2, ffmpeg, wildmidi, libbs2b, game-music-emu
+, libarchive, opusfile, soxr, wavpack
 # output plugins
-, alsa-lib, libpulseaudio, pipewire
+, alsa-lib, libpulseaudio, pipewire, libjack2
 # effect plugins
 , libsamplerate
 }:

 # Additional plugins that can be added:
-#  wavpack (https://www.wavpack.com/)
-#  Ogg Opus support
-#  JACK audio support
 #  ProjectM visualization plugin

 # To make MIDI work we must tell Qmmp what instrument configuration to use (and
@ -45,8 +43,9 @@ stdenv.mkDerivation rec {
      # input plugins
      libmad taglib libvorbis libogg flac libmpcdec libmodplug libsndfile
      libcdio cdparanoia libcddb faad2 ffmpeg wildmidi libbs2b game-music-emu
+      libarchive opusfile soxr wavpack
      # output plugins
-      alsa-lib libpulseaudio pipewire
+      alsa-lib libpulseaudio pipewire libjack2
      # effect plugins
      libsamplerate
    ];
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "strawberry";
-  version = "1.0.14";
+  version = "1.0.15";

  src = fetchFromGitHub {
    owner = "jonaski";
    repo = pname;
    rev = version;
-    hash = "sha256-ThfycS5yNpp6+mE33qPqEWlhSB3OIF7d/t2XvI+rF2E=";
+    hash = "sha256-P7M7UIRFr0pABNhb63pV3TqIdTP8Xox4f0BT2ii9rRE=";
  };

  # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead
--- a/pkgs/applications/audio/tageditor/default.nix
+++ b/pkgs/applications/audio/tageditor/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "tageditor";
-  version = "3.7.7";
+  version = "3.7.8";

  src = fetchFromGitHub {
    owner = "martchus";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-CjbV/Uwpe+x7LBDUDY+NRonUt549MrjGnlJ2olIrKQ4=";
+    hash = "sha256-/34KS6nxpIsKEklSRpO+AmGAdpJhapoGe24DCCodU38=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cudatext";
-  version = "1.186.2";
+  version = "1.187.0";

  src = fetchFromGitHub {
    owner = "Alexey-T";
    repo = "CudaText";
    rev = version;
-    hash = "sha256-qpxYzman93e+u0BHxdhBUyfnZOR4hjQpTuNikGDNQCA=";
+    hash = "sha256-Ri/VTJF59GCJdhbMWRAYaQifj7FjVYSACywpq8gHKXg=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@ -11,18 +11,18 @@
  },
  "ATFlatControls": {
    "owner": "Alexey-T",
-    "rev": "2023.02.05",
-    "hash": "sha256-ZOnIhUnFd+7mBEz6YIhUOQkhBbCNeTFD0tfUILuC1x4="
+    "rev": "2023.03.10",
+    "hash": "sha256-RHNWJN+P3w67UupeikHn6GrWZCOSoGCrP7BYG7myx+A="
  },
  "ATSynEdit": {
    "owner": "Alexey-T",
-    "rev": "2023.03.02",
-    "hash": "sha256-rZzcWED8c68wtejUho71kbPtLyDyOlXpS/eg8Ti0r2A="
+    "rev": "2023.03.10",
+    "hash": "sha256-NdLg/cQNy5SaC/zPb3bLplUe6FiO7ePi1++WDIvQziI="
  },
  "ATSynEdit_Cmp": {
    "owner": "Alexey-T",
-    "rev": "2022.10.18",
-    "hash": "sha256-yaS1XF0v5rkfKj9aksSc4XimKh5wpL7yLt4ElcIKAIE="
+    "rev": "2023.03.10",
+    "hash": "sha256-KfzTO0GMFkWRFxbRSdKAh4sr7cx7A2snj/UO1nsvacI="
  },
  "EControl": {
    "owner": "Alexey-T",
--- a/pkgs/applications/emulators/box64/default.nix
+++ b/pkgs/applications/emulators/box64/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , gitUpdater
 , cmake
 , python3
@ -16,24 +15,15 @@ assert withDynarec -> stdenv.hostPlatform.isAarch64;

 stdenv.mkDerivation rec {
  pname = "box64";
-  version = "0.2.0";
+  version = "0.2.2";

  src = fetchFromGitHub {
    owner = "ptitSeb";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-eMp2eSWMRJQvLRQKUirBua6Kt7ZtyebfUnKIlibkNFU=";
+    hash = "sha256-aIvL0H0k0/lz2lCLxB17RxNm0cxVozYthy0z85/FuUE=";
  };

-  patches = [
-    # Fix mmx & cppThreads tests on x86_64
-    # Remove when version > 0.2.0
-    (fetchpatch {
-      url = "https://github.com/ptitSeb/box64/commit/3819aecf078fcf47b2bc73713531361406a51895.patch";
-      hash = "sha256-11hy5Ol5FSE/kNJmXAIwNLbapldhlZGKtOLIoL6pYrg=";
-    })
-  ];
-
  nativeBuildInputs = [
    cmake
    python3
--- a/pkgs/applications/emulators/proton-caller/default.nix
+++ b/pkgs/applications/emulators/proton-caller/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "proton-caller";
-  version = "3.1.1";
+  version = "3.1.2";

  src = fetchFromGitHub {
    owner = "caverym";
    repo = pname;
    rev = version;
-    sha256 = "sha256-fN/8woLkTFD0aGILwweHhpey3cGQw2NolvpOmdkEEGA=";
+    sha256 = "sha256-srzahBMihkEP9/+7oRij5POHkCcH6QBh4kGz42Pz0nM=";
  };

-  cargoSha256 = "sha256-2zczu9MtsDDbfjbmLXCiPJrxNoNNBN0KAGeN+a53SRg=";
+  cargoHash = "sha256-LBXCcFqqscCGgtTzt/gr7Lz0ExT9kAWrXPuPuKzKt0E=";

  meta = with lib; {
    description = "Run Windows programs with Proton";
--- a/pkgs/applications/misc/dunst/default.nix
+++ b/pkgs/applications/misc/dunst/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "dunst";
-  version = "1.9.0";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "dunst-project";
    repo = "dunst";
    rev = "v${version}";
-    sha256 = "sha256-fRPhu+kpwLPvdzIpXSjXFzQTfv4xewOMv/1ZqLJw3dk=";
+    sha256 = "sha256-oCeC/rbI/sydcQ7Rv9feEzw2Gcl7mUde4OOv50dyUSg=";
  };

  nativeBuildInputs = [ perl pkg-config which systemd makeWrapper ];
--- a/pkgs/applications/misc/pe-bear/default.nix
+++ b/pkgs/applications/misc/pe-bear/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "pe-bear";
-  version = "0.6.5";
+  version = "0.6.5.2";

  src = fetchFromGitHub {
    owner = "hasherezade";
    repo = "pe-bear";
    rev = "v${version}";
-    sha256 = "sha256-qFEfrXX2Rpmo4eF1Z/dKBN/NxMovK3mDfQPxYp85eB8=";
+    sha256 = "sha256-00OebZZUUwQ1yruTKEUj+bNEKY/CuzdLEbejnnagPnY=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kluctl";
-  version = "2.19.2";
+  version = "2.19.3";

  src = fetchFromGitHub {
    owner = "kluctl";
    repo = "kluctl";
    rev = "v${version}";
-    hash = "sha256-7+hXjYaCqInhP3O8IS8IwkUTGhnmcIWRR1qqvA6UQoc=";
+    hash = "sha256-yp471eWrwnJiCAVwqnZzq1rN1Mt4d42ymVvsUtTyOsc=";
  };

-  vendorHash = "sha256-xBUrY8v4yHtWGaaRXHxQRGdZHzMGoJX2hFLL+0Vb1QY=";
+  vendorHash = "sha256-Ws0Qaw2hk8alOF/K5Wd0ZcMGr6Q3JiQIo/kHOXiGvmg=";

  ldflags = [ "-s" "-w" "-X main.version=v${version}" ];

--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "kubebuilder";
-  version = "3.9.0";
+  version = "3.9.1";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "kubebuilder";
    rev = "v${version}";
-    hash = "sha256-AT7BrLVe5sSqAnQyhrkDktxVhuh1e0o5eB8oWWVbL8Q=";
+    hash = "sha256-sX+MYMZTRJ3udCtW3yeGBlYpJV35UDQwtcgi7/pXhek=";
  };

  vendorHash = "sha256-wxKEywUs5ezeOlIRT2k3C4G0XaX6h1ORt9/G6+FzVic=";
--- a/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "kubelogin";
-  version = "1.26.0";
+  version = "1.27.0";

  src = fetchFromGitHub {
    owner = "int128";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-A8J381KNhQbWZ+68P8+1xj/lEEc/+YiJ80LqRQatdFQ=";
+    sha256 = "sha256-oBgth4lAQP4UrFIk/AErlfyyCgPrugs5wQJDFxqGum0=";
  };

  subPackages = ["."];

-  vendorSha256 = "sha256-V+O3yFxGJTcFETD2qYOurQUbME5NvRNQTr43OkxXFFE=";
+  vendorHash = "sha256-IJCbh1ryyk0r72SrVEiI7K5nIFf1+UGjTkXaNKpGsmo=";

  # Rename the binary instead of symlinking to avoid conflict with the
  # Azure version of kubelogin
--- a/pkgs/applications/networking/cluster/roxctl/default.nix
+++ b/pkgs/applications/networking/cluster/roxctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "roxctl";
-  version = "3.73.2";
+  version = "3.73.3";

  src = fetchFromGitHub {
    owner = "stackrox";
    repo = "stackrox";
    rev = version;
-    sha256 = "sha256-5MMSQy7SUFZhUycv1Kfkz46aY2tMldNZOH63wlQjq6o=";
+    sha256 = "sha256-ri4ir5mOfefB23gVk+XltXNYEz1jMoIVbJ5b0sS444k=";
  };

  vendorHash = "sha256-YRNOOn/Ei0rHLZrTtQxlBBn48pePDHllnI65Iil160k=";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -128,11 +128,11 @@
    "vendorHash": null
  },
  "azurerm": {
-    "hash": "sha256-PvlW3BB2ZATZA18nOGgxMSWzjC8YIjUY9ofw7XwnbmU=",
+    "hash": "sha256-XcqBkb+de+ikNtrDe33OZHhhv6ed2pXhbXXb7L661RI=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
    "owner": "hashicorp",
    "repo": "terraform-provider-azurerm",
-    "rev": "v3.46.0",
+    "rev": "v3.47.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -467,11 +467,11 @@
    "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
  },
  "grafana": {
-    "hash": "sha256-b6vmtr2eHm7YNhRHS96+l6BLHYHgixR8Pw7/jK0tRPI=",
+    "hash": "sha256-2Ig0ZwU9ZzsfAq5XCFMvL1NCmfnhVjoIrgl74hQypGE=",
    "homepage": "https://registry.terraform.io/providers/grafana/grafana",
    "owner": "grafana",
    "repo": "terraform-provider-grafana",
-    "rev": "v1.36.0",
+    "rev": "v1.36.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-zPO+TbJsFrgfjSaSrX5YRop/0LDDw/grNNntaIGiBU0="
  },
@ -540,11 +540,11 @@
    "vendorHash": "sha256-rxh8Me+eOKPCbfHFT3tRsbM7JU67dBqv2JOiWArI/2Y="
  },
  "huaweicloud": {
-    "hash": "sha256-x/5jt31yPTJRHSHRZqSrrjNdERWho6l71jvS7x6dR0c=",
+    "hash": "sha256-5Yw1b7tuGg8tDL1rQhqgFMTgtvc2k0n45dR5xvr7Dmo=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.45.0",
+    "rev": "v1.45.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -648,13 +648,13 @@
    "vendorHash": null
  },
  "launchdarkly": {
-    "hash": "sha256-7m5+Fu9UjmGWL4PgYCpI9vMStfmU4oQ1cx+7wAirEbQ=",
+    "hash": "sha256-zi4GzbQmvvfxQ5vL4FbVkqUcwm7Y4ET8GFeIc/LipTY=",
    "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
    "owner": "launchdarkly",
    "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.11.0",
+    "rev": "v2.12.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-j8Lit22aWeLvYrq5ao0nIdcVZDSxaAKaW+bxQ/JCSgE="
+    "vendorHash": "sha256-Fb2k493XTePXgpCY9ZoMWaCZqq3fx3A2dBRsOp1MDBc="
  },
  "libvirt": {
    "hash": "sha256-VO9fbRLz7mDYT8WORodnN4l3II2j+TdpV8cZ9M+NjTM=",
@ -820,13 +820,13 @@
    "vendorHash": null
  },
  "okta": {
-    "hash": "sha256-3Ym2Q3Y2f26ioiB3N2HZiPsrgVe4zszJDR7e0gzxOHU=",
+    "hash": "sha256-O4ZTGYM9r3XFzr2Nx/Tt2Fs7WOqQuQWfo+ZMmZyg+mo=",
    "homepage": "https://registry.terraform.io/providers/okta/okta",
    "owner": "okta",
    "repo": "terraform-provider-okta",
-    "rev": "v3.43.0",
+    "rev": "v3.44.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-7jA44ZcBGCeLrr+On8F9er+ch2qf6vbijTRtu+aHrB4="
+    "vendorHash": "sha256-KYOzbbBjE2C7+1St62rs9mlJFhpIlWQJ0reh5V5tQsk="
  },
  "oktaasa": {
    "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@ -883,11 +883,11 @@
    "vendorHash": null
  },
  "pagerduty": {
-    "hash": "sha256-9aIYGmcbDgSZqtldLBMRjD0qKJZ3USuwNBpK3bvGrFY=",
+    "hash": "sha256-FHGoaWJQ3HRtY/LNCTX+L+jgYMPKkefjpbtfzMVbPQw=",
    "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
    "owner": "PagerDuty",
    "repo": "terraform-provider-pagerduty",
-    "rev": "v2.11.1",
+    "rev": "v2.11.2",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -964,11 +964,11 @@
    "vendorHash": null
  },
  "scaleway": {
-    "hash": "sha256-4xHPQFmOAqEpqfJ6ng5z3wcuNZF8jNqu+4ZNJNxaBaI=",
+    "hash": "sha256-aWn/w7k+gxCodN7W9GBM9Ontkg6Ir2LNLYkY34ORxzI=",
    "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
    "owner": "scaleway",
    "repo": "terraform-provider-scaleway",
-    "rev": "v2.13.0",
+    "rev": "v2.13.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-kh1wv7cuWCC1rP0WBQW95pFg53gZTakqGoMIDMDSmt0="
  },
--- a/pkgs/applications/science/biology/diamond/default.nix
+++ b/pkgs/applications/science/biology/diamond/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "diamond";
-  version = "2.1.4";
+  version = "2.1.5";

  src = fetchFromGitHub {
    owner = "bbuchfink";
    repo = "diamond";
    rev = "v${version}";
-    sha256 = "sha256-Og1cxEMJ24cncNDD2dXwy58OZ/nJmGdqrMRr5Y6YmHo=";
+    sha256 = "sha256-ud11GNuDL1HDNaAzkNB/ebuPJR4wgWYy49zBr93BtSo=";
  };


--- a/pkgs/applications/version-management/gitlint/default.nix
+++ b/pkgs/applications/version-management/gitlint/default.nix
@ -7,21 +7,16 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gitlint";
-  version = "0.19.0";
+  version = "0.19.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "jorisroovers";
    repo = "gitlint";
-    rev = "v${version}";
-    sha256 = "sha256-w4v6mcjCX0V3Mj1K23ErpXdyEKQcA4vykns7UwNBEZ4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4SGkkC4LjZXTDXwK6jMOIKXR1qX76CasOwSqv8XUrjs=";
  };

-  patches = [
-    # otherwise hatch tries to run git to collect some metadata about the build
-    ./dont-try-to-use-git.diff
-  ];
-
  SETUPTOOLS_SCM_PRETEND_VERSION = version;

  # Upstream splitted the project into gitlint and gitlint-core to
@ -51,6 +46,7 @@ python3.pkgs.buildPythonApplication rec {
  meta = with lib; {
    description = "Linting for your git commit messages";
    homepage = "https://jorisroovers.com/gitlint/";
+    changelog = "https://github.com/jorisroovers/gitlint/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ ethancedwards8 fab ];
  };
--- a/pkgs/applications/version-management/gitlint/dont-try-to-use-git.diff
+++ b/pkgs/applications/version-management/gitlint/dont-try-to-use-git.diff
@ -1,14 +0,0 @@
--- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -61,10 +63,3 @@ include = [
- exclude = [
-     "/gitlint/tests", #
- ]
-
-[tool.hatch.metadata.hooks.vcs.urls]
-Homepage = "https://jorisroovers.github.io/gitlint"
-Documentation = "https://jorisroovers.github.io/gitlint"
-Source = "https://github.com/jorisroovers/gitlint/tree/main/gitlint-core"
-Changelog = "https://github.com/jorisroovers/gitlint/blob/main/CHANGELOG.md"
-'Source Commit' = "https://github.com/jorisroovers/gitlint/tree/{commit_hash}/gitlint-core"
-\ No newline at end of file
--- a/pkgs/applications/version-management/glab/default.nix
+++ b/pkgs/applications/version-management/glab/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "glab";
-  version = "1.25.3";
+  version = "1.26.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-x/VH6cRrJZ2t2iftBPC86FcgIwjRNzV11MwLG2y+Paw=";
+    hash = "sha256-k0wkHw12MyVsAudaihoymGkP4y5y98cR7LKa+hEC1Mc=";
  };

  vendorHash = "sha256-FZ1CiR8Rj/sMoCnQm6ArGQfRTlvmD14EZDmufnlTSTk=";
--- a/pkgs/applications/virtualization/colima/default.nix
+++ b/pkgs/applications/virtualization/colima/default.nix
@ -17,13 +17,13 @@

 buildGoModule rec {
  pname = "colima";
-  version = "0.5.3";
+  version = "0.5.4";

  src = fetchFromGitHub {
    owner = "abiosoft";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-uAstW+LzgT+xEJf4WNVSZsWtE50RU/rRpC7mkkFMIJU=";
+    sha256 = "sha256-oCYHQFajtZXVAVeJ8zvJABlmwmOUgisvVg9eLT7wd0M=";
    # We need the git revision
    leaveDotGit = true;
    postFetch = ''
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixpacks";
-  version = "1.4.1";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-zxgNHzKXekZnk0OsHw30u4L9U2mIT/MryZuAQ2EBEYg=";
+    sha256 = "sha256-1IJboAy0GYgkysY84+wHHOulA/aiux7pgCtxfr0CFV8=";
  };

-  cargoHash = "sha256-tsGyrU/5yp5PJ2d5HUoaw/jhGgYyDt6qBK+DvC79kmY=";
+  cargoHash = "sha256-kAou5pPOwbOZ9n8+fQJ4+Hh9x7wrY898R5XTuUEvF2o=";

  # skip test due FHS dependency
  doCheck = false;
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@ -6,6 +6,7 @@
 , pipewire ? null, pango ? null, libunwind ? null, freerdp ? null, vaapi ? null
 , libva ? null, libwebp ? null, xwayland ? null
 # beware of null defaults, as the parameters *are* supplied by callPackage by default
+, buildDemo ? false
 }:

 stdenv.mkDerivation rec {
@ -32,7 +33,7 @@ stdenv.mkDerivation rec {
    "-Dremoting=false" # TODO
    "-Dpipewire=${lib.boolToString (pipewire != null)}"
    "-Dimage-webp=${lib.boolToString (libwebp != null)}"
-    "-Ddemo-clients=false"
+    (lib.mesonBool "demo-clients" buildDemo)
    "-Dsimple-clients="
    "-Dtest-junit-xml=false"
    # TODO:
--- a/pkgs/build-support/fetchpatch/default.nix
+++ b/pkgs/build-support/fetchpatch/default.nix
@ -8,6 +8,7 @@

 { relative ? null
 , stripLen ? 0
+, decode ? "cat" # custom command to decode patch e.g. base64 -d
 , extraPrefix ? null
 , excludes ? []
 , includes ? []
@ -36,6 +37,17 @@ fetchurl ({
      exit 1
    fi

+    set +e
+    ${decode} < "$out" > "$tmpfile"
+    if [ $? -ne 0 ] || [ ! -s "$tmpfile" ]; then
+        echo 'Failed to decode patch with command "'${lib.escapeShellArg decode}'"' >&2
+        echo 'Fetched file was (limited to 128 bytes):' >&2
+        od -A x -t x1z -v -N 128 "$out" >&2
+        exit 1
+    fi
+    set -e
+    mv "$tmpfile" "$out"
+
    "${patchutils}/bin/lsdiff" \
      ${lib.optionalString (relative != null) "-p1 -i ${lib.escapeShellArg relative}/'*'"} \
      "$out" \
@ -76,5 +88,6 @@ fetchurl ({
    mv "$tmpfile" "$out"
  '' + postFetch;
 } // builtins.removeAttrs args [
-  "relative" "stripLen" "extraPrefix" "excludes" "includes" "revert" "postFetch"
+  "relative" "stripLen" "decode" "extraPrefix" "excludes" "includes" "revert"
+  "postFetch"
 ])
--- a/pkgs/build-support/fetchpatch/tests.nix
+++ b/pkgs/build-support/fetchpatch/tests.nix
@ -25,4 +25,11 @@ in
    revert = true;
    sha256 = if isFetchpatch2 then "sha256-+UKmEbr2rIAweCav/hR/7d4ZrYV84ht/domTrHtm8sM=" else "sha256-+UKmEbr2rIAweCav/hR/7d4ZrYV84ht/domTrHtm8sM=";
  };
+
+  decode = testers.invalidateFetcherByDrvHash fetchpatch {
+    name = "gcc.patch";
+    url = "https://chromium.googlesource.com/aosp/platform/external/libchrome/+/f37ae3b1a873d74182a2ac31d96742ead9c1f523^!?format=TEXT";
+    decode = "base64 -d";
+    sha256 = if isFetchpatch2 then "sha256-oMvPlmzE51ArI+EvFxONXkqmNee39106/O1ikG0Bdso=" else "sha256-SJHk8XrutqAyoIdORlhCpBCN626P+uzed7mjKz5eQYY=";
+  };
 }
--- a/pkgs/data/fonts/charis-sil/default.nix
+++ b/pkgs/data/fonts/charis-sil/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "charis-sil";
-  version = "6.101";
+  version = "6.200";

  src = fetchzip {
    url = "https://software.sil.org/downloads/r/charis/CharisSIL-${version}.zip";
-    hash = "sha256-Rf5eKQVZw7zgTv6KkJUdNdd4sSJPdvjy/GDLusvlgzE=";
+    hash = "sha256-q451lec/l13Uanmr8K/C55Cr3avRvqQUkPK/ZZ1kgHo=";
  };

  installPhase = ''
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@ -13,12 +13,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "circt";
-  version = "1.30.0";
+  version = "1.34.0";
  src = fetchFromGitHub {
    owner = "llvm";
    repo = "circt";
    rev = "firtool-${version}";
-    sha256 = "sha256-VP1QwY/gA8wxjpzbAlEV5r2Q8sTt3K2sGdKmxr6ndB8=";
+    sha256 = "sha256-QrCli0nNlvOM4taqWZ6GzK5luvXmyxaCgfDlXSRLSQA=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "luau";
-  version = "0.563";
+  version = "0.567";

  src = fetchFromGitHub {
    owner = "Roblox";
    repo = "luau";
    rev = version;
-    hash = "sha256-aGduwwguzIg3kFspIa/5nDFAC836J3B10Pg63psuWto=";
+    hash = "sha256-x1P9/TZUU/XITH1/8NtPXzM46fwk0VxHNphlWqzhoog=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -197,9 +197,9 @@ in {
      major = "3";
      minor = "12";
      patch = "0";
-      suffix = "a5";
+      suffix = "a6";
    };
-    hash = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
+    hash = "sha256-KYRAJSxLa04SDgFMFdcp6vird5MA3Mph1CLFN+ToXso=";
    inherit (darwin) configd;
    inherit passthruFun;
  };
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -3,7 +3,7 @@
 , zlib, gdbm, ncurses, readline, groff, libyaml, libffi, jemalloc, autoreconfHook, bison
 , autoconf, libiconv, libobjc, libunwind, Foundation
 , buildEnv, bundler, bundix
-, makeWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
+, makeBinaryWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
 , openssl, openssl_1_1
 } @ args:

@ -47,7 +47,7 @@ let
      , autoreconfHook, bison, autoconf
      , buildEnv, bundler, bundix
      , libiconv, libobjc, libunwind, Foundation
-      , makeWrapper, buildRubyGem, defaultGemConfig
+      , makeBinaryWrapper, buildRubyGem, defaultGemConfig
      , baseRuby ? buildPackages.ruby_3_1.override {
          useRailsExpress = false;
          docSupport = false;
@ -272,7 +272,7 @@ let
          };

          inherit (import ../../ruby-modules/with-packages {
-            inherit lib stdenv makeWrapper buildRubyGem buildEnv;
+            inherit lib stdenv makeBinaryWrapper buildRubyGem buildEnv;
            gemConfig = defaultGemConfig;
            ruby = self;
          }) withPackages buildGems gems;
--- a/pkgs/development/libraries/boca/default.nix
+++ b/pkgs/development/libraries/boca/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "BoCA";
-  version = "1.0.6a";
+  version = "1.0.7";

  src = fetchFromGitHub {
    owner = "enzo1982";
    repo = "boca";
    rev = "v${version}";
-    sha256 = "sha256-LndlwdM5NlTv73Z1lMkHuIZkVfn48P/LssBnE4X9Sgc=";
+    sha256 = "sha256-HIYUMFj5yiEC+liZLMXD9otPyoEb1sxHlECTYtYXc2I=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/g2o/default.nix
+++ b/pkgs/development/libraries/g2o/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "g2o";
-  version = "20201223";
+  version = "20230223";

  src = fetchFromGitHub {
    owner = "RainerKuemmerle";
    repo = pname;
    rev = "${version}_git";
-    sha256 = "sha256-Ik6uBz4Z4rc5+mPNdT8vlNZSBom4Tvt8Y6myBC/s0m8=";
+    sha256 = "sha256-J2Z3oRkyiinIfywBQvnq1Q8Z5WuzQXOVTZTwN8oivf0=";
  };

  # Removes a reference to gcc that is only used in a debug message
@ -20,9 +20,6 @@ mkDerivation rec {
  nativeBuildInputs = [ cmake makeWrapper ];
  buildInputs = [ eigen suitesparse blas lapack libGLU qtbase libqglviewer ];

-  # Silence noisy warning
-  CXXFLAGS = "-Wno-deprecated-copy";
-
  dontWrapQtApps = true;

  cmakeFlags = [
--- a/pkgs/development/libraries/hipsparse/default.nix
+++ b/pkgs/development/libraries/hipsparse/default.nix
@ -17,7 +17,7 @@
 # This can also use cuSPARSE as a backend instead of rocSPARSE
 stdenv.mkDerivation (finalAttrs: {
  pname = "hipsparse";
-  version = "5.4.2";
+  version = "5.4.3";

  outputs = [
    "out"
--- a/pkgs/development/libraries/httplib/default.nix
+++ b/pkgs/development/libraries/httplib/default.nix
@ -5,13 +5,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "httplib";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitHub {
    owner = "yhirose";
    repo = "cpp-httplib";
    rev = "v${version}";
-    hash = "sha256-Qr8jaZSj5xPiTF8reur09/R2jrtDk5hxHKeVTccHbZQ=";
+    hash = "sha256-F0MXuScZP2kmyCWv+DVXOB9rRk2T7hMgum7Zbs8X7QI=";
  };

  # Header-only library.
--- a/pkgs/development/libraries/libheif/default.nix
+++ b/pkgs/development/libraries/libheif/default.nix
@ -22,7 +22,7 @@

 stdenv.mkDerivation rec {
  pname = "libheif";
-  version = "1.14.2";
+  version = "1.15.1";

  outputs = [ "bin" "out" "dev" "man" ];

@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
    owner = "strukturag";
    repo = "libheif";
    rev = "v${version}";
-    sha256 = "sha256-JwPeSNUc++z6RfMe0qAuXdekzLWR/MCmsT+Ykvp9a/s=";
+    sha256 = "sha256-5908S46hEXhCYcTsqulmUnat0KOlXsnY5LI/l1l7/1Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@ -11,9 +11,9 @@
 , perl
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "liblouis";
-  version = "3.24.0";
+  version = "3.25.0";

  outputs = [ "out" "dev" "info" "doc" ]
    # configure: WARNING: cannot generate manual pages while cross compiling
@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "liblouis";
    repo = "liblouis";
-    rev = "v${version}";
-    sha256 = "sha256-QSrCQhP3t+WPyBQPLJbZEaDCjXD8Lo6IAGKHsbL2S1o=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-On5PbBgvDAeD41oGb5EKBtKvi/VXnLsVrTMX7tcwnq4=";
  };

  nativeBuildInputs = [
@ -63,7 +63,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Open-source braille translator and back-translator";
-    homepage = "https://liblouis.org/";
+    homepage = "https://liblouis.io/";
    license = with licenses; [
      lgpl21Plus # library
      gpl3Plus # tools
@ -71,4 +71,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ jtojnar ];
    platforms = platforms.unix;
  };
-}
+})
--- a/pkgs/development/libraries/migraphx/default.nix
+++ b/pkgs/development/libraries/migraphx/default.nix
@ -46,7 +46,7 @@ let
  };
 in stdenv.mkDerivation (finalAttrs: {
  pname = "migraphx";
-  version = "5.4.2";
+  version = "5.4.3";

  outputs = [
    "out"
--- a/pkgs/development/libraries/minizip-ng/default.nix
+++ b/pkgs/development/libraries/minizip-ng/default.nix
@ -14,30 +14,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "minizip-ng";
-  version = "3.0.7";
+  version = "3.0.8";

  src = fetchFromGitHub {
    owner = "zlib-ng";
    repo = finalAttrs.pname;
    rev = finalAttrs.version;
-    sha256 = "sha256-m/zSVx8vYzLA23Cusd1p/ZSGd1mV3gM6UqDnmEXqpq4=";
+    sha256 = "sha256-Vzp+5fQBJoO1pG7j8LwC2/B/cOgM/exhKyb3zHuy89Y=";
  };

-  patches = [
-    (fetchpatch {
-      name = "find-system-gtest.patch";
-      url = "https://github.com/zlib-ng/minizip-ng/commit/be23c8d3b7e2cb5ba619e60517cad277ee510fb7.patch";
-      sha256 = "sha256-azwrGj6kgTyTepGAmOlxDOFOwJKQE5J2bwUIn6sgKUY=";
-    })
-
-    # otherwise signing unit tests fail
-    (fetchpatch {
-      name = "disable-mz-signing-by-default.patch";
-      url = "https://github.com/zlib-ng/minizip-ng/commit/60649ada97581afc0bc2fffc50ce402ff1e6df5d.patch";
-      sha256 = "sha256-bHGM4H8RPYkfAjxcS1bPohR9IFOFT0Mx4Mg34UnnD+w=";
-    })
-  ];
-
  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = [ zlib bzip2 xz zstd openssl ];

--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@ -27,13 +27,13 @@

 mkDerivation rec {
  pname = "mlt";
-  version = "7.12.0";
+  version = "7.14.0";

  src = fetchFromGitHub {
    owner = "mltframework";
    repo = "mlt";
    rev = "v${version}";
-    sha256 = "sha256-Y7lbfwA0lkQB3PjYQIQaQ0BeXGcgyCmMnDqqZJ8zUaA=";
+    sha256 = "sha256-BmvgDj/zgGJNpTy5A9XPOl+9001Kc0qSFSqQ3gwZPmI=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/muparserx/default.nix
+++ b/pkgs/development/libraries/muparserx/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "muparserx";
-  version = "4.0.11";
+  version = "4.0.12";

  src = fetchFromGitHub {
    owner = "beltoforion";
    repo = "muparserx";
    rev = "v${version}";
-    sha256 = "sha256-BWzHlz1mQYsvWa53EtO05Rb4rRHJBSRguJTHLtgqpPw=";
+    sha256 = "sha256-rekPXmncNdVX6LvPQP1M2Pzs3pyiCCcLPLnPFiyWJ4s=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/presage/default.nix
+++ b/pkgs/development/libraries/presage/default.nix
@ -26,7 +26,8 @@ stdenv.mkDerivation rec {

  patches = [
    (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/community/presage/gcc6.patch";
+      name = "gcc6.patch";
+      url = "https://git.alpinelinux.org/aports/plain/community/presage/gcc6.patch?id=40e2044c9ecb36eacb3a1fd043f09548d210dc01";
      sha256 = "0243nx1ygggmsly7057vndb4pkjxg9rpay5gyqqrq9jjzjzh63dj";
    })
    ./fixed-cppunit-detection.patch
--- a/pkgs/development/libraries/qxmpp/default.nix
+++ b/pkgs/development/libraries/qxmpp/default.nix
@ -9,13 +9,13 @@

 mkDerivation rec {
  pname = "qxmpp";
-  version = "1.5.1";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "qxmpp-project";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-6iI+s+iSKK8TeocvyOxou7cF9ZXlWr5prUbPhoHOoSM=";
+    sha256 = "sha256-nwU0Iw3aLv4EyNdblTOQKcCYVYfK8i54c0piks4DoUo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/rapidjson/default.nix
+++ b/pkgs/development/libraries/rapidjson/default.nix
@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
      sha256 = "1qm62iad1xfsixv1li7qy475xc7gc04hmi2q21qdk6l69gk7mf82";
    })
    (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch";
+      name = "do-not-include-gtest-src-dir.patch";
+      url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch?id=9e5eefc7a5fcf5938a8dc8a3be8c75e9e6809909";
      hash = "sha256-BjSZEwfCXA/9V+kxQ/2JPWbc26jQn35CfN8+8NW24s4=";
    })
  ];
--- a/pkgs/development/libraries/science/math/ipopt/default.nix
+++ b/pkgs/development/libraries/science/math/ipopt/default.nix
@ -12,13 +12,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation rec {
  pname = "ipopt";
-  version = "3.14.10";
+  version = "3.14.11";

  src = fetchFromGitHub {
    owner = "coin-or";
    repo = "Ipopt";
    rev = "releases/${version}";
-    sha256 = "sha256-4SHmqalrGeqp1nBx2BQLRnRWEYw5lJk5Yao67GQw3qM=";
+    sha256 = "sha256-PzNDiTZkPORFckFJryFuvn/rsfx3wrXJ9Qde88gH5o4=";
  };

  CXXDEFS = [ "-DHAVE_RAND" "-DHAVE_CSTRING" "-DHAVE_CSTDIO" ];
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "simdjson";
-  version = "3.1.3";
+  version = "3.1.5";

  src = fetchFromGitHub {
    owner = "simdjson";
    repo = "simdjson";
    rev = "v${version}";
-    sha256 = "sha256-VDwpCPyjhkXgehcMJs6srD3PFtlC2m4jurJum6wNeVY=";
+    sha256 = "sha256-gBHgPKEeoryjMVL/EonmeY/7imcJej/Yj8ovPk/moTk=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/waffle/default.nix
+++ b/pkgs/development/libraries/waffle/default.nix
@ -17,14 +17,14 @@

 stdenv.mkDerivation rec {
  pname = "waffle";
-  version = "1.7.0";
+  version = "1.7.2";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "mesa";
    repo = "waffle";
    rev = "v${version}";
-    sha256 = "iY+dAgXutD/uDFocwd9QXjq502IOsk+3RQMA2S/CMV4=";
+    sha256 = "sha256-dwDNMLgZrILb559yGs4sNA7D+nD60972+JOy0PKfL0w=";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@ -29,7 +29,7 @@

 buildPythonPackage rec {
  pname = "datasette";
-  version = "0.64.1";
+  version = "0.64.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "simonw";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-EXYAiXqEfQVDTwc4MFTroLPEaTZ3QYTlUsuNQ72oHpA=";
+    sha256 = "sha256-AxIJUJzFEAvAV59hYDB3pb5/1rS9d7T0ltl6lVWTCrE=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/django-ipware/default.nix
+++ b/pkgs/development/python-modules/django-ipware/default.nix
@ -1,12 +1,20 @@
-{ lib, buildPythonPackage, fetchPypi, django }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, django
+, pythonOlder
+}:

 buildPythonPackage rec {
  pname = "django-ipware";
-  version = "4.0.2";
+  version = "5.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "602a58325a4808bd19197fef2676a0b2da2df40d0ecf21be414b2ff48c72ad05";
+    hash = "sha256-T6VgfuheEu5eFYvHVp/x4TT7FXloGqH/Pw7QS+Ib4VM=";
  };

  propagatedBuildInputs = [ django ];
@ -20,6 +28,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "A Django application to retrieve user's IP address";
    homepage = "https://github.com/un33k/django-ipware";
+    changelog = "https://github.com/un33k/django-ipware/blob/v${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ ];
  };
--- a/pkgs/development/python-modules/dkimpy/default.nix
+++ b/pkgs/development/python-modules/dkimpy/default.nix
@ -3,11 +3,11 @@

 buildPythonPackage rec {
  pname = "dkimpy";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-NQDukEVLfCz3ElgeA5jrRwONJ+aRSDKd9jTs2Y3YYhw=";
+    sha256 = "sha256-dVl0S1qQGWkZCPCgxlPiBrbL9jbIxtZuGggnz8jsf5E=";
 };

  nativeCheckInputs = [ pytest ];
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "holidays";
-  version = "0.20";
+  version = "0.21";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "dr-prodigy";
    repo = "python-holidays";
    rev = "refs/tags/v.${version}";
-    hash = "sha256-hz0v4g94RMA1dKOLu4BSYnK5EPNl1hIWEShFJWO0F3A=";
+    hash = "sha256-acV/m4orkOEbON7C4ThGvaQtTMpp4c8FNesC7UepJFc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/jenkins-job-builder/default.nix
+++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix
@ -9,11 +9,11 @@

 buildPythonPackage rec {
  pname = "jenkins-job-builder";
-  version = "4.1.0";
+  version = "4.3.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-5jCltdomD4u5LZrYJFUHB/sLORXYuWoeJOalAci0+XQ=";
+    sha256 = "sha256-pvka8TLMEclzJ2Iw4iLSiR1ioV3frzQStLu21+kSSHI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "peaqevcore";
-  version = "13.0.0";
+  version = "13.0.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-uQ5e85KHFaJCgpALFCYVs+nY0fZIE4UIYdNOn6VrIWM=";
+    hash = "sha256-2V0+F0S2i7paBDN8FmsT1wV4qdJ4XmkOyZ3EDfyjGks=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pydeconz/default.nix
+++ b/pkgs/development/python-modules/pydeconz/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "pydeconz";
-  version = "108";
+  version = "110";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "Kane610";
    repo = "deconz";
    rev = "refs/tags/v${version}";
-    hash = "sha256-CPFkfVwvk0AO/DoE1Nj1jLdLvuOpRzndmRK/M6SSGtk=";
+    hash = "sha256-2eHKFq+urzJS3K55O0hca0h4ElowJZD6nIkYkzyBFCM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@ -24,7 +24,7 @@

 buildPythonPackage rec {
  pname = "python-benedict";
-  version = "0.28.3";
+  version = "0.29.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -33,7 +33,7 @@ buildPythonPackage rec {
    owner = "fabiocaccamo";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-6gzmVOuJfNpNJlea4Am20HI98mgcKkwtU/28l7qg20Y=";
+    hash = "sha256-tsTd9EJkwI98ynXu/vz5hX+X55vxOkhIfeawQNn2f6Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/pkgs/development/python-modules/python-rapidjson/default.nix
@ -21,7 +21,8 @@ let
    };
    patches = [
      (fetchpatch {
-        url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch";
+        name = "do-not-include-gtest-src-dir.patch";
+        url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch?id=9e5eefc7a5fcf5938a8dc8a3be8c75e9e6809909";
        hash = "sha256-BjSZEwfCXA/9V+kxQ/2JPWbc26jQn35CfN8+8NW24s4=";
      })
    ];
--- a/pkgs/development/python-modules/unrardll/default.nix
+++ b/pkgs/development/python-modules/unrardll/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "unrardll";
-  version = "0.1.5";
+  version = "0.1.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "8bebb480b96cd49d4290d814914f39cff75cf0fa0514c4790bb32b1757227c78";
+    sha256 = "sha256-4QZ/4nu03iBO+PNpLyPZPF07QpL3iyksb8fcT3V0n3Y=";
  };

  buildInputs = [ unrar ];
--- a/pkgs/development/ruby-modules/with-packages/default.nix
+++ b/pkgs/development/ruby-modules/with-packages/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, buildEnv, buildRubyGem, ruby, gemConfig, makeWrapper }:
+{ stdenv, lib, buildEnv, buildRubyGem, ruby, gemConfig, makeBinaryWrapper }:

 /*
 Example usage:
@ -43,7 +43,7 @@ let

      wrappedRuby = stdenv.mkDerivation {
        name = "wrapped-${ruby.name}";
-        nativeBuildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeBinaryWrapper ];
        buildCommand = ''
          mkdir -p $out/bin
          for i in ${ruby}/bin/*; do
@ -54,7 +54,7 @@ let

    in stdenv.mkDerivation {
      name = "${ruby.name}-with-packages";
-      nativeBuildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeBinaryWrapper ];
      buildInputs = [ selected ruby ];

      dontUnpack = true;
--- a/pkgs/development/ruby-modules/with-packages/test.nix
+++ b/pkgs/development/ruby-modules/with-packages/test.nix
@ -15,6 +15,22 @@ let
      pkgs.ruby.gems) //
    (import ./require_exceptions.nix);

+  testWrapper = ruby: stdenv.mkDerivation {
+    name = "test-wrappedRuby-${ruby.name}";
+    buildInputs = [ ((ruby.withPackages (ps: [ ])).wrappedRuby) ];
+    buildCommand = ''
+      cat <<'EOF' > test-ruby
+      #!/usr/bin/env ruby
+      puts RUBY_VERSION
+      EOF
+
+      chmod +x test-ruby
+      patchShebangs test-ruby
+      [[ $(./test-ruby) = $(${ruby}/bin/ruby test-ruby) ]]
+      touch $out
+    '';
+  };
+
  tests = ruby:
    lib.mapAttrs (name: gem:
      let
@ -39,7 +55,7 @@ let
 in
  stdenv.mkDerivation {
    name = "test-all-ruby-gems";
-    buildInputs = builtins.foldl' (sum: ruby: sum ++ ( builtins.attrValues (tests ruby) )) [] rubyVersions;
+    buildInputs = builtins.foldl' (sum: ruby: sum ++ [ (testWrapper ruby) ] ++ ( builtins.attrValues (tests ruby) )) [] rubyVersions;
    buildCommand = ''
      touch $out
    '';
--- a/pkgs/development/tools/altair-graphql-client/default.nix
+++ b/pkgs/development/tools/altair-graphql-client/default.nix
@ -2,11 +2,11 @@

 let
  pname = "altair";
-  version = "5.0.14";
+  version = "5.0.17";

  src = fetchurl {
    url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
-    sha256 = "sha256-gd7aSBNhTO1ira76lL+1apLlXYXRfGWAbGAsJEUtEqw=";
+    sha256 = "sha256-UX7WqQt5inVldrXG3bIVmR8ucCvbHdyVLgQ/srhpCak=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "buf";
-  version = "1.15.0";
+  version = "1.15.1";

  src = fetchFromGitHub {
    owner = "bufbuild";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-63JWRyB586klWSQskBY/fDRTdXrQa15IygdZfmHpEqM=";
+    hash = "sha256-XiB8ZlbtzU66abM9zJotaMCrbYScqWmDv4ulEeQS6+g=";
  };

-  vendorHash = "sha256-XRv8AnktIPR1emRdRMmDwOh7r3kNByy0REwZbg3NYPc=";
+  vendorHash = "sha256-bQKpy5xjUItgQ79r8TrMUOjo0Ze9E25glvOv312W1k0=";

  patches = [
    # Skip a test that requires networking to be available to work.
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@ -21,7 +21,7 @@ buildDotnetModule rec {
    owner = "actions";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-bzCa3OI8/pE8K9U38RN0xWbLkjJPA4mUlsrbH1etpG4=";
+    hash = "sha256-gGIYlYM4Rf7Ils2rThsQHWIkLDt5Htg4NDuJhxvl1rU=";
    # Required to obtain HEAD's Git commit hash
    leaveDotGit = true;
  };
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl, bash }:

 let
-  version = "15.9.0";
+  version = "15.9.1";
 in
 buildGoModule rec {
  inherit version;
@ -23,7 +23,7 @@ buildGoModule rec {
    owner = "gitlab-org";
    repo = "gitlab-runner";
    rev = "v${version}";
-    sha256 = "sha256-wdeH1/1FNG1vwmSmXo7KjhxfQTmQk9lNAxVNoUKlLi4=";
+    sha256 = "sha256-J8wcTU2bilhEKwOAVgaJk743b66TLndYOxc1k+S/cBg=";
  };

  patches = [
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dbmate";
-  version = "1.16.2";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "amacneil";
    repo = "dbmate";
    rev = "v${version}";
-    sha256 = "sha256-5hjAP2+0hbYcA9G7YJyRqqp1ZC8LzFDomjeFjl4z4FY=";
+    sha256 = "sha256-zARaxjzVTi90BkwPOyfGYk3mBHRoAGMOe2LPlJB4Mvo=";
  };

-  vendorHash = "sha256-7fC1jJMY/XK+GX5t2/o/k+EjFxAlRAmiemMcWaZhL9o=";
+  vendorHash = "sha256-NZ2HVFViU8Vzwyo33cueNJwdCT4exZlB7g4WgoWKZBE=";

  doCheck = false;

--- a/pkgs/development/tools/kafkactl/default.nix
+++ b/pkgs/development/tools/kafkactl/default.nix
@ -1,21 +1,26 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:

 buildGoModule rec {
  pname = "kafkactl";
-  version = "3.0.3";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "deviceinsight";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-rz3cAA5iqhrCZhLc+RKZhudiMlfu3m6wWYNHAnUP/kg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-H6oSkPQx5bk9VBBoeGVg0Ri5LTCv96tR4Vq4guymAbQ=";
  };

  vendorHash = "sha256-Y3BPt3PsedrlCoKiKUObf6UQd+MuNiCGLpJUg94XSgA=";
+
  doCheck = false;

  meta = with lib; {
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/deviceinsight/kafkactl";
+    changelog = "https://github.com/deviceinsight/kafkactl/blob/v${version}/CHANGELOG.md";
    description = "Command Line Tool for managing Apache Kafka";
    longDescription = ''
      A command-line interface for interaction with Apache Kafka.
--- a/pkgs/development/tools/language-servers/nil/default.nix
+++ b/pkgs/development/tools/language-servers/nil/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nil";
-  version = "2023-03-01";
+  version = "2023-03-11";

  src = fetchFromGitHub {
    owner = "oxalica";
    repo = pname;
    rev = version;
-    hash = "sha256-HGd/TV8ZHVAVBx+ndrxAfS/Nz+VHOQjNWjtKkkgYkqA=";
+    hash = "sha256-5WEdrN+ABrNOdfQc2k2mf+fj+ZvZR1Dp/PtypEdlFWA=";
  };

-  cargoHash = "sha256-A6Go1OYAaoDvQtAcK5BL5Tz00iLPOft0VLH6usWtb9g=";
+  cargoHash = "sha256-ISkw0lhUKJG8nWUHcR93sLUFt5dDEyK7EORcOXEmVbE=";

  CFG_RELEASE = version;

--- a/pkgs/development/tools/marksman/default.nix
+++ b/pkgs/development/tools/marksman/default.nix
@ -8,13 +8,13 @@

 buildDotnetModule rec {
  pname = "marksman";
-  version = "2023-01-29";
+  version = "2023-03-04";

  src = fetchFromGitHub {
    owner = "artempyanykh";
    repo = "marksman";
    rev = version;
-    sha256 = "sha256-UPPO4ueu7gMR7a573M2/xT3N0QgRSNBshJAqoyXEZpc=";
+    sha256 = "sha256-jBZC2z1wtDMIssgRrKkZpl9NQ3XkRCcxo5eylwB2OBQ=";
  };

  projectFile = "Marksman/Marksman.fsproj";
--- a/pkgs/development/tools/misc/cmake-language-server/default.nix
+++ b/pkgs/development/tools/misc/cmake-language-server/default.nix
@ -11,17 +11,17 @@

 buildPythonApplication rec {
  pname = "cmake-language-server";
-  version = "unstable-2023-01-08";
+  version = "0.1.7";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "regen100";
-    repo = pname;
-    rev = "60c376a5fda29835060687569cb212350a292116";
-    hash = "sha256-vNG43sZy2wMetY5mbgxIoei5jCCj1f8vWiovWtwzbPc=";
+    repo = "cmake-language-server";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ExEAi47hxxEJeoT3FCwpRwJrf3URnI47/5FDL7fS5sY=";
  };

-  PDM_PEP517_SCM_VERSION = "2023.1";
+  PDM_PEP517_SCM_VERSION = version;

  patches = [
    # Test timeouts occasionally cause the build to fail
--- a/pkgs/development/tools/misc/cmake-language-server/disable-test-timeouts.patch
+++ b/pkgs/development/tools/misc/cmake-language-server/disable-test-timeouts.patch
@ -1,10 +1,10 @@
 diff --git a/tests/test_server.py b/tests/test_server.py
-index 2d09bb2..59a122a 100644
+index f349329..d130a2e 100644
 --- a/tests/test_server.py
 +++ b/tests/test_server.py
-@@ -26,7 +26,7 @@ from pygls.lsp.types import (
- )
- from pygls.server import LanguageServer
+@@ -27,7 +27,7 @@ from pygls.server import LanguageServer
+ 
+ from cmake_language_server.server import CMakeLanguageServer
 
 -CALL_TIMEOUT = 2
 +CALL_TIMEOUT = None
--- a/pkgs/development/tools/misc/seer/default.nix
+++ b/pkgs/development/tools/misc/seer/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "seer";
-  version = "1.14";
+  version = "1.15";

  src = fetchFromGitHub {
    owner = "epasveer";
    repo = "seer";
    rev = "v${version}";
-    sha256 = "sha256-IxFG+OhRhPRPSyGFJh559Tz2E7aMOtpphm9GbYS0dRA=";
+    sha256 = "sha256-TktCUO281Cok47qT60DMAO5uUIg1iDH1RKx+fBPezLs=";
  };

  preConfigure = ''
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "oh-my-posh";
-  version = "14.9.2";
+  version = "14.12.0";

  src = fetchFromGitHub {
    owner = "jandedobbeleer";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-9ZIMAJVVrJk8ny3TgwXHSxrg713dSbPlgQnY/b0m2Ps=";
+    hash = "sha256-brwfM/IPgwLdVwMNur4EBCsubbv/DCVhTMJbAn6mbFg=";
  };

  vendorHash = "sha256-JZ5UiL2vGsXy/xmz+NcAKYDmp5hq7bx54/OdUyQHUp0=";
--- a/pkgs/development/tools/opcr-policy/default.nix
+++ b/pkgs/development/tools/opcr-policy/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "opcr-policy";
-  version = "0.1.50";
+  version = "0.1.51";

  src = fetchFromGitHub {
    owner = "opcr-io";
    repo = "policy";
    rev = "v${version}";
-    sha256 = "sha256-u7epE09WcbXAX1W+zkCOTDECnBTIOFC3gjNowtpuYtI=";
+    sha256 = "sha256-RpjuKtxiZA6l0ZW0TsEUn2AMLjU/V2RRfQLmfa0imW4=";
  };
  vendorHash = "sha256-QoD6J+is+InumLiFdbL/y1tuWwBCdBebx6RrIZ4Irik=";

--- a/pkgs/development/tools/rust/cargo-pgx/buildPgxExtension.nix
+++ b/pkgs/development/tools/rust/cargo-pgx/buildPgxExtension.nix
@ -0,0 +1,160 @@
+# preBuildAndTest and some small other bits
+# taken from https://github.com/tcdi/pgx/blob/v0.4.5/nix/extension.nix
+# (but now heavily modified)
+# which uses MIT License with the following license file
+#
+# MIT License
+#
+# Portions Copyright 2019-2021 ZomboDB, LLC.
+# Portions Copyright 2021-2022 Technology Concepts & Design, Inc. <support@tcdi.com>.
+# All rights reserved.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+{ lib
+, cargo-pgx
+, pkg-config
+, rustPlatform
+, stdenv
+, Security
+, writeShellScriptBin
+}:
+
+# The idea behind: Use it mostly like rustPlatform.buildRustPackage and so
+# we hand most of the arguments down.
+#
+# Additional arguments are:
+#   - `postgresql` postgresql package of the version of postgresql this extension should be build for.
+#                  Needs to be the build platform variant.
+#   - `useFakeRustfmt` Whether to use a noop fake command as rustfmt. cargo-pgx tries to call rustfmt.
+#                      If the generated rust bindings aren't needed to use the extension, its a
+#                      unnecessary and heavy dependency. If you set this to true, you also
+#                      have to add `rustfmt` to `nativeBuildInputs`.
+
+{ buildAndTestSubdir ? null
+, buildType ? "release"
+, buildFeatures ? [ ]
+, cargoBuildFlags ? [ ]
+, postgresql
+# cargo-pgx calls rustfmt on generated bindings, this is not strictly necessary, so we avoid the
+# dependency here. Set to false and provide rustfmt in nativeBuildInputs, if you need it, e.g.
+# if you include the generated code in the output via postInstall.
+, useFakeRustfmt ? true
+, ...
+} @ args:
+let
+  rustfmtInNativeBuildInputs = lib.lists.any (dep: lib.getName dep == "rustfmt") (args.nativeBuildInputs or []);
+in
+
+assert lib.asserts.assertMsg ((args.installPhase or "") == "")
+  "buildPgxExtensions overwrites the installPhase, so providing one does nothing";
+assert lib.asserts.assertMsg ((args.buildPhase or "") == "")
+  "buildPgxExtensions overwrites the buildPhase, so providing one does nothing";
+assert lib.asserts.assertMsg (useFakeRustfmt -> !rustfmtInNativeBuildInputs)
+  "The parameter useFakeRustfmt is set to true, but rustfmt is included in nativeBuildInputs. Either set useFakeRustfmt to false or remove rustfmt from nativeBuildInputs.";
+assert lib.asserts.assertMsg (!useFakeRustfmt -> rustfmtInNativeBuildInputs)
+  "The parameter useFakeRustfmt is set to false, but rustfmt is not included in nativeBuildInputs. Either set useFakeRustfmt to true or add rustfmt from nativeBuildInputs.";
+
+let
+  fakeRustfmt = writeShellScriptBin "rustfmt" ''
+    exit 0
+    '';
+  maybeDebugFlag = lib.optionalString (buildType != "release") "--debug";
+  maybeEnterBuildAndTestSubdir = lib.optionalString (buildAndTestSubdir != null) ''
+    export CARGO_TARGET_DIR="$(pwd)/target"
+    pushd "${buildAndTestSubdir}"
+  '';
+  maybeLeaveBuildAndTestSubdir = lib.optionalString (buildAndTestSubdir != null) "popd";
+
+  pgxPostgresMajor = lib.versions.major postgresql.version;
+  preBuildAndTest = ''
+    export PGX_HOME=$(mktemp -d)
+    export PGDATA="$PGX_HOME/data-${pgxPostgresMajor}/"
+    cargo-pgx pgx init "--pg${pgxPostgresMajor}" ${postgresql}/bin/pg_config
+    echo "unix_socket_directories = '$(mktemp -d)'" > "$PGDATA/postgresql.conf"
+
+    # This is primarily for Mac or other Nix systems that don't use the nixbld user.
+    export USER="$(whoami)"
+    pg_ctl start
+    createuser -h localhost --superuser --createdb "$USER" || true
+    pg_ctl stop
+  '';
+
+  argsForBuildRustPackage = builtins.removeAttrs args [ "postgresql" "useFakeRustfmt" ];
+
+  # so we don't accidentally `(rustPlatform.buildRustPackage argsForBuildRustPackage) // { ... }` because
+  # we forgot parentheses
+  finalArgs = argsForBuildRustPackage // {
+    buildInputs = (args.buildInputs or [ ]) ++ lib.optionals stdenv.isDarwin [ Security ];
+
+    nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [
+      cargo-pgx
+      postgresql
+      pkg-config
+      rustPlatform.bindgenHook
+    ] ++ lib.optionals useFakeRustfmt [ fakeRustfmt ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      echo "Executing cargo-pgx buildPhase"
+      ${preBuildAndTest}
+      ${maybeEnterBuildAndTestSubdir}
+
+      NIX_PGLIBDIR="${postgresql}/lib" \
+      PGX_BUILD_FLAGS="--frozen -j $NIX_BUILD_CORES ${builtins.concatStringsSep " " cargoBuildFlags}" \
+      cargo-pgx pgx package \
+        --pg-config ${postgresql}/bin/pg_config \
+        ${maybeDebugFlag} \
+        --features "${builtins.concatStringsSep " " buildFeatures}" \
+        --out-dir "$out"
+
+      ${maybeLeaveBuildAndTestSubdir}
+
+      runHook postBuild
+    '';
+
+    preCheck = preBuildAndTest + args.preCheck or "";
+
+    installPhase = ''
+      runHook preInstall
+
+      echo "Executing buildPgxExtension install"
+
+      ${maybeEnterBuildAndTestSubdir}
+
+      cargo-pgx pgx stop all
+
+      mv $out/${postgresql}/* $out
+      rm -rf $out/nix
+
+      ${maybeLeaveBuildAndTestSubdir}
+
+      runHook postInstall
+    '';
+
+    PGX_PG_SYS_SKIP_BINDING_REWRITE = "1";
+    CARGO_BUILD_INCREMENTAL = "false";
+    RUST_BACKTRACE = "full";
+
+    checkNoDefaultFeatures = true;
+    checkFeatures = (args.checkFeatures or [ ]) ++ [ "pg_test pg${pgxPostgresMajor}" ];
+  };
+in
+rustPlatform.buildRustPackage finalArgs
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "skaffold";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "GoogleContainerTools";
    repo = "skaffold";
    rev = "v${version}";
-    sha256 = "sha256-D0KcnxfjPBGHLGs5YLdecuKL07jIhF6w/SIr/I/W1rI=";
+    sha256 = "sha256-4/FnuyesqW+9zA4TArm/7MpTzWURGG7ZjQKh3WFghZQ=";
  };

-  vendorSha256 = "sha256-yy1BVorjLEcZR6PqupBiZx2plwPJ6xlxripbyB6RLek=";
+  vendorHash = "sha256-hy0xi21Lq3MzXnBB8+8FqNZsxp4fLshnaRm4v+GyLUg=";

  subPackages = ["cmd/skaffold"];

--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "stylua";
-  version = "0.16.1";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "johnnymorganz";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-PpkJwCVZr21P1WmU2Kid+X9JwKdJs1krY6keQoMqDvc=";
+    sha256 = "sha256-Q+0B7O769blQVHC4++G+FZTKa1llmn6xkS1UDBcFLOA=";
  };

-  cargoSha256 = "sha256-oCoE+Fk2zcVlV8H+f/soAWlhXNsLTysmqLXx9yjdnFY=";
+  cargoSha256 = "sha256-lnodLMqiJsxm5rO+FMbvVhzX3z9R4eyPf+ujDCDk8ow=";

  # remove cargo config so it can find the linker on aarch64-unknown-linux-gnu
  postPatch = ''
--- a/pkgs/development/tools/xc/default.nix
+++ b/pkgs/development/tools/xc/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "xc";
-  version = "0.0.175";
+  version = "0.1.181";

  src = fetchFromGitHub {
    owner = "joerdav";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Uc9MTxl32xQ7u6N0mocDAoD9tgv/YOPCzhonsavX9Vo=";
+    sha256 = "sha256-C6qZdO6+n9BWm69y09kvnEBF45sB6bfOfmteNO2x68I=";
  };

  vendorHash = "sha256-cySflcTuAzbFZbtXmzZ98nfY8HUq1UedONTtKP4EICs=";
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.0.483";
+  version = "0.0.484";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-z6FBJ8cE8UeOP/3ojzQo3LjEJr5bBshf+4CgMmb1RTQ=";
+    hash = "sha256-2//mxYTF6lAolj5aQOXF12NOwEa/VPoen9LNxD7gYDo=";
  };

  vendorHash = "sha256-2y671bvOmkKEqbcttcCG1L1by/J8gkGZxts7kFyTIxk=";
--- a/pkgs/games/unciv/default.nix
+++ b/pkgs/games/unciv/default.nix
@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "unciv";
-  version = "4.5.2";
+  version = "4.5.5";

  src = fetchurl {
    url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-HhMccVlpIJoGW3LLqg1clw+dWcRUVHwCgtrmBcOXFSE=";
+    hash = "sha256-m7wyWxTKXrxJUtUpG2Dwg4s91TBbE0eFNAyDhS98ggo=";
  };

  dontUnpack = true;
--- a/pkgs/games/vassal/default.nix
+++ b/pkgs/games/vassal/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "VASSAL";
-  version = "3.6.13";
+  version = "3.6.14";

  src = fetchzip {
    url = "https://github.com/vassalengine/vassal/releases/download/${version}/${pname}-${version}-linux.tar.bz2";
-    sha256 = "sha256-5YswOh2jnOafctp7q8INtIqQwx1ugGm0QP9vDfal7t0=";
+    sha256 = "sha256-0/QJyntLV1DLzLJ8p4f+tCXPKl3DMf+j4/gkI+Mt+rc=";
  };

  buildInputs = [
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -4,16 +4,16 @@ let
  # comments with variant added for update script
  # ./update-zen.py zen
  zenVariant = {
-    version = "6.2.2"; #zen
-    suffix = "zen2"; #zen
-    sha256 = "0hbsd8id1f27zlxffid7pyycm5dlh6hw8y6f8dv6czd8k9v1qngs"; #zen
+    version = "6.2.5"; #zen
+    suffix = "zen1"; #zen
+    sha256 = "0ilkb8rqww30nl4sa01jy97s8gs67y96qwf9r0z0z7xy3w05s8bl"; #zen
    isLqx = false;
  };
  # ./update-zen.py lqx
  lqxVariant = {
-    version = "6.1.15"; #lqx
-    suffix = "lqx2"; #lqx
-    sha256 = "1z3bwn2pmbaa8cqld4fsxkzkdb5213n83bgb8jkm9v4943pa220i"; #lqx
+    version = "6.1.18"; #lqx
+    suffix = "lqx1"; #lqx
+    sha256 = "1gyjy01ys74apa65abgvxcj0y51vf5ixampyj3jd8lxzn4vvkih6"; #lqx
    isLqx = true;
  };
  zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@ -4,20 +4,24 @@
 }:
 let
  cdefs_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-cdefs.h";
+    name = "sys-cdefs.h";
+    url = "https://git.alpinelinux.org/aports/plain/main/libc-dev/sys-cdefs.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
    sha256 = "16l3dqnfq0f20rzbkhc38v74nqcsh9n3f343bpczqq8b1rz6vfrh";
  };
  queue_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-queue.h";
+    name = "sys-queue.h";
+    url = "http://git.alpinelinux.org/aports/plain/main/libc-dev/sys-queue.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
    sha256 = "12qm82id7zys92a1qh2l1qf2wqgq6jr4qlbjmqyfffz3s3nhfd61";
  };
  tree_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-tree.h";
+    name = "sys-tree.h";
+    url = "http://git.alpinelinux.org/aports/plain/main/libc-dev/sys-tree.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
    sha256 = "14igk6k00bnpfw660qhswagyhvr0gfqg4q55dxvaaq7ikfkrir71";
  };

  stack_chk_fail_local_c = fetchurl {
-    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?h=3.10-stable";
+    name = "__stack_chk_fail_local.c";
+    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?id=9afbe3cbbf4c30ff23c733218c3c03d7e8c6461d";
    sha256 = "1nhkzzy9pklgjcq2yg89d3l18jif331srd3z3vhy5qwxl1spv6i9";
  };

--- a/pkgs/servers/adguardhome/bins.nix
+++ b/pkgs/servers/adguardhome/bins.nix
@ -1,31 +1,31 @@
 { fetchurl, fetchzip }:
 {
 x86_64-darwin = fetchzip {
-  sha256 = "sha256-mOn0RYWmGzIeHyVwVTGPUvFyVQ8Zu57KW7UkGMWRejA=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_darwin_amd64.zip";
+  sha256 = "sha256-hGa1SrueZWGokeJb+p/6eaYv1AP1a2TUiGo+rcJBw3Y=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_darwin_amd64.zip";
 };
 aarch64-darwin = fetchzip {
-  sha256 = "sha256-urdLtEOMJ2ZeaWezihpv5UU8Li2gnmYk6+gzn9E/3Nw=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_darwin_arm64.zip";
+  sha256 = "sha256-wm8scjBaQuKJQu2OfYWDQqF2TLdPEZQEGSgaLzoGTb0=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_darwin_arm64.zip";
 };
 i686-linux = fetchurl {
-  sha256 = "sha256-yWlo7adaQcPrM4zOPq5BLw6rZPYg2Qr2T1R7H8QZuvA=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_386.tar.gz";
+  sha256 = "sha256-nie5WOeMajq8ucOwLHDXMG1FU7wBS3GTQHKCn0XjBCQ=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_386.tar.gz";
 };
 x86_64-linux = fetchurl {
-  sha256 = "sha256-pD1vs4NHWByZmEozdgpzBXDeSzbEBouyawd41Emf8QE=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_amd64.tar.gz";
+  sha256 = "sha256-Ai6QzmNrALHKxJIX5gx5GQiLlcpKRuT+ALxN0PDJQ9E=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_amd64.tar.gz";
 };
 aarch64-linux = fetchurl {
-  sha256 = "sha256-BpknO9qL4Jo31d/vRXjuU/wJWfCVvLfgh6tZLG/6ipI=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_arm64.tar.gz";
+  sha256 = "sha256-cJ7vvv4Yyo0r01eOuZI6jqc4LFmSDmVl84aJjwxkuR4=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_arm64.tar.gz";
 };
 armv6l-linux = fetchurl {
-  sha256 = "sha256-yUyRz/2hqvN8XkuzfMfG6ibYOb68WjJaqgAIAfoZH0s=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_armv6.tar.gz";
+  sha256 = "sha256-DfeSBIOO/vZQExbrqku28s8a9s22tfuojccIwe37tS4=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_armv6.tar.gz";
 };
 armv7l-linux = fetchurl {
-  sha256 = "sha256-MOvDKvq24+NFmgseZZA3zz0z6Vr/7OvO8sHpsDWvMuo=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_armv7.tar.gz";
+  sha256 = "sha256-OHoU8dP5b2jqFTfn4FCxL88HrQntcxZ5enMFr/YN1zI=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_armv7.tar.gz";
 };
 }
--- a/pkgs/servers/adguardhome/default.nix
+++ b/pkgs/servers/adguardhome/default.nix
@ -7,7 +7,7 @@ in

 stdenv.mkDerivation rec {
  pname = "adguardhome";
-  version = "0.107.25";
+  version = "0.107.26";
  src = sources.${system} or (throw "Source for ${pname} is not available for ${system}");

  installPhase = ''
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  passthru = {
    updateScript = ./update.sh;
-    schema_version = 16;
+    schema_version = 17;
    tests.adguardhome = nixosTests.adguardhome;
  };

--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
  passthru.tests = {
    inherit knot-resolver;
  } // lib.optionalAttrs stdenv.isLinux {
-    inherit (nixosTests) knot;
+    inherit (nixosTests) knot kea;
    # Some dependencies are very version-sensitive, so the might get dropped
    # or embedded after some update, even if the nixPackagers didn't intend to.
    # For non-linux I don't know a good replacement for `ldd`.
--- a/pkgs/servers/komga/default.nix
+++ b/pkgs/servers/komga/default.nix
@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "komga";
-  version = "0.162.0";
+  version = "0.163.0";

  src = fetchurl {
    url = "https://github.com/gotson/${pname}/releases/download/v${version}/${pname}-${version}.jar";
-    sha256 = "sha256-RcEAqMfpXH7PudLOROpSZw/5HrEeuBFBkllOjGdXZCU=";
+    sha256 = "sha256-dKbdzfjb+brY++uflVvuF1LaOIaYn1UqIGIjCsyLMv8=";
  };

  nativeBuildInputs = [
--- a/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
@ -9,16 +9,16 @@

 buildNpmPackage rec {
  pname = "matrix-appservice-irc";
-  version = "0.37.0";
+  version = "0.37.1";

  src = fetchFromGitHub {
    owner = "matrix-org";
    repo = "matrix-appservice-irc";
    rev = "refs/tags/${version}";
-    hash = "sha256-krF/eUyGHB4M3sQVaBh7+OaHnM/g9XVaBa8gizPkLKE=";
+    hash = "sha256-d/CA27A0txnVnSCJeS/qeK90gOu1QjQaFBk+gblEdH8=";
  };

-  npmDepsHash = "sha256-VkVpFt3cwnBkN0AGDaE5Bd6xINGL6XugZ4TBsDONWCg=";
+  npmDepsHash = "sha256-s/b/G49HlDbYsSmwRYrm4Bcv/81tHLC8Ac1IMEwGFW8=";

  nativeBuildInputs = [
    python3
--- a/pkgs/servers/monitoring/prometheus/influxdb-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/influxdb-exporter.nix
@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "influxdb_exporter";
-  version = "0.11.2";
+  version = "0.11.3";
  rev = "v${version}";

  src = fetchFromGitHub {
    inherit rev;
    owner = "prometheus";
    repo = "influxdb_exporter";
-    hash = "sha256-UIB6/0rYOrS/B7CFffg0lPaAhSbmk0KSEogjCundXAU=";
+    hash = "sha256-jb384/i76KxQEgqnebEDkH33iPLAAzKFkA8OtmExrWc=";
  };

-  vendorHash = "sha256-ueE1eE0cxr7+APvIEzR26Uprx0CXN1jfNLzGVgDmJQk=";
+  vendorHash = "sha256-pD/oWbFa6pg9miNA2z6RubsBd3+X/DWRoQuaVwjuOmI=";

  ldflags = [
    "-s"
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "pocketbase";
-  version = "0.12.3";
+  version = "0.13.2";

  src = fetchFromGitHub {
    owner = "pocketbase";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-/uqUOuNHFyah6nrQI3lRNkB2vpV9vKXJog1ck0zoruo=";
+    sha256 = "sha256-P150wEJHTC294LcRhSHF5/+w08WKBvhUZsJ9ENi1EM8=";
  };

-  vendorHash = "sha256-8NBudXcU3cjSbo6qpGZVLtbrLedzwijwrbiTgC+OMcU=";
+  vendorHash = "sha256-hvziOq5zyYwWcvqa23IzHXj/DT27MAcNVegYR38beJ4=";

  # This is the released subpackage from upstream repo
  subPackages = [ "examples/base" ];
--- a/Show More
+++ b/Show More