Merge staging-next into staging

2024-09-22 13:08:39 +03:00 · 2023-09-10 12:02:00 +00:00 · 2023-09-10 12:02:00 +00:00 · 0c33553927
commit 0c33553927
parent 620366f1f3 86c023d5a5
70 changed files with 1302 additions and 1432 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -8297,6 +8297,12 @@
    githubId = 297653;
    name = "Joe Salisbury";
  };
+  johannwagner = {
+    email = "nix@wagner.digital";
+    github = "johannwagner";
+    githubId = 12380026;
+    name = "Johann Wagner";
+  };
  johanot = {
    email = "write@ownrisk.dk";
    github = "johanot";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -294,6 +294,17 @@ with lib.maintainers; {
    githubTeams = [ "flutter" ];
  };

+  flyingcircus = {
+    # Verify additions by approval of an already existing member of the team.
+    members = [
+      theuni
+      dpausp
+      leona
+    ];
+    scope = "Team for Flying Circus employees who collectively maintain packages.";
+    shortName = "Flying Circus employees";
+  };
+
  freedesktop = {
    members = [ jtojnar ];
    scope = "Maintain Freedesktop.org packages for graphical desktop.";
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -5,8 +5,8 @@ let

  parentWrapperDir = dirOf wrapperDir;

-  securityWrapper = pkgs.callPackage ./wrapper.nix {
-    inherit parentWrapperDir;
+  securityWrapper = sourceProg : pkgs.callPackage ./wrapper.nix {
+    inherit sourceProg;
  };

  fileModeType =
@ -91,8 +91,7 @@ let
    , ...
    }:
    ''
-      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
-      echo -n "${source}" > "$wrapperDir/${program}.real"
+      cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"

      # Prevent races
      chmod 0000 "$wrapperDir/${program}"
@ -119,8 +118,7 @@ let
    , ...
    }:
    ''
-      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
-      echo -n "${source}" > "$wrapperDir/${program}.real"
+      cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"

      # Prevent races
      chmod 0000 "$wrapperDir/${program}"
@ -248,11 +246,13 @@ in
      export PATH="${wrapperDir}:$PATH"
    '';

-    security.apparmor.includes."nixos/security.wrappers" = ''
-      include "${pkgs.apparmorRulesFromClosure { name="security.wrappers"; } [
-        securityWrapper
+    security.apparmor.includes = lib.mapAttrs' (wrapName: wrap: lib.nameValuePair
+     "nixos/security.wrappers/${wrapName}" ''
+      include "${pkgs.apparmorRulesFromClosure { name="security.wrappers.${wrapName}"; } [
+        (securityWrapper wrap.source)
      ]}"
-    '';
+      mrpx ${wrap.source},
+    '') wrappers;

    ###### wrappers activation script
    system.activationScripts.wrappers =
--- a/nixos/modules/security/wrappers/wrapper.c
+++ b/nixos/modules/security/wrappers/wrapper.c
@ -17,6 +17,10 @@
 #include <syscall.h>
 #include <byteswap.h>

+#ifndef SOURCE_PROG
+#error SOURCE_PROG should be defined via preprocessor commandline
+#endif
+
 // aborts when false, printing the failed expression
 #define ASSERT(expr) ((expr) ? (void) 0 : assert_failure(#expr))
 // aborts when returns non-zero, printing the failed expression and errno
@ -24,10 +28,6 @@

 extern char **environ;

-// The WRAPPER_DIR macro is supplied at compile time so that it cannot
-// be changed at runtime
-static char *wrapper_dir = WRAPPER_DIR;
-
 // Wrapper debug variable name
 static char *wrapper_debug = "WRAPPER_DEBUG";

@ -151,115 +151,20 @@ static int make_caps_ambient(const char *self_path) {
    return 0;
 }

-int readlink_malloc(const char *p, char **ret) {
-    size_t l = FILENAME_MAX+1;
-    int r;
-
-    for (;;) {
-        char *c = calloc(l, sizeof(char));
-        if (!c) {
-            return -ENOMEM;
-        }
-
-        ssize_t n = readlink(p, c, l-1);
-        if (n < 0) {
-            r = -errno;
-            free(c);
-            return r;
-        }
-
-        if ((size_t) n < l-1) {
-            c[n] = 0;
-            *ret = c;
-            return 0;
-        }
-
-        free(c);
-        l *= 2;
-    }
-}
-
 int main(int argc, char **argv) {
    ASSERT(argc >= 1);
-    char *self_path = NULL;
-    int self_path_size = readlink_malloc("/proc/self/exe", &self_path);
-    if (self_path_size < 0) {
-        fprintf(stderr, "cannot readlink /proc/self/exe: %s", strerror(-self_path_size));
-    }
-
-    unsigned int ruid, euid, suid, rgid, egid, sgid;
-    MUSTSUCCEED(getresuid(&ruid, &euid, &suid));
-    MUSTSUCCEED(getresgid(&rgid, &egid, &sgid));
-
-    // If true, then we did not benefit from setuid privilege escalation,
-    // where the original uid is still in ruid and different from euid == suid.
-    int didnt_suid = (ruid == euid) && (euid == suid);
-    // If true, then we did not benefit from setgid privilege escalation
-    int didnt_sgid = (rgid == egid) && (egid == sgid);
-
-
-    // Make sure that we are being executed from the right location,
-    // i.e., `safe_wrapper_dir'.  This is to prevent someone from creating
-    // hard link `X' from some other location, along with a false
-    // `X.real' file, to allow arbitrary programs from being executed
-    // with elevated capabilities.
-    int len = strlen(wrapper_dir);
-    if (len > 0 && '/' == wrapper_dir[len - 1])
-      --len;
-    ASSERT(!strncmp(self_path, wrapper_dir, len));
-    ASSERT('/' == wrapper_dir[0]);
-    ASSERT('/' == self_path[len]);
-
-    // If we got privileges with the fs set[ug]id bit, check that the privilege we
-    // got matches the one one we expected, ie that our effective uid/gid
-    // matches the uid/gid of `self_path`. This ensures that we were executed as
-    // `self_path', and not, say, as some other setuid program.
-    // We don't check that if we did not benefit from the set[ug]id bit, as
-    // can be the case in nosuid mounts or user namespaces.
-    struct stat st;
-    ASSERT(lstat(self_path, &st) != -1);
-
-    // if the wrapper gained privilege with suid, check that we got the uid of the file owner
-    ASSERT(!((st.st_mode & S_ISUID) && !didnt_suid) || (st.st_uid == euid));
-    // if the wrapper gained privilege with sgid, check that we got the gid of the file group
-    ASSERT(!((st.st_mode & S_ISGID) && !didnt_sgid) || (st.st_gid == egid));
-    // same, but with suid instead of euid
-    ASSERT(!((st.st_mode & S_ISUID) && !didnt_suid) || (st.st_uid == suid));
-    ASSERT(!((st.st_mode & S_ISGID) && !didnt_sgid) || (st.st_gid == sgid));
-
-    // And, of course, we shouldn't be writable.
-    ASSERT(!(st.st_mode & (S_IWGRP | S_IWOTH)));
-
-    // Read the path of the real (wrapped) program from <self>.real.
-    char real_fn[PATH_MAX + 10];
-    int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);
-    ASSERT(real_fn_size < sizeof(real_fn));
-
-    int fd_self = open(real_fn, O_RDONLY);
-    ASSERT(fd_self != -1);
-
-    char source_prog[PATH_MAX];
-    len = read(fd_self, source_prog, PATH_MAX);
-    ASSERT(len != -1);
-    ASSERT(len < sizeof(source_prog));
-    ASSERT(len > 0);
-    source_prog[len] = 0;
-
-    close(fd_self);

    // Read the capabilities set on the wrapper and raise them in to
    // the ambient set so the program we're wrapping receives the
    // capabilities too!
-    if (make_caps_ambient(self_path) != 0) {
-        free(self_path);
+    if (make_caps_ambient("/proc/self/exe") != 0) {
        return 1;
    }
-    free(self_path);

-    execve(source_prog, argv, environ);
+    execve(SOURCE_PROG, argv, environ);
    
    fprintf(stderr, "%s: cannot run `%s': %s\n",
-        argv[0], source_prog, strerror(errno));
+        argv[0], SOURCE_PROG, strerror(errno));

    return 1;
 }
--- a/nixos/modules/security/wrappers/wrapper.nix
+++ b/nixos/modules/security/wrappers/wrapper.nix
@ -1,4 +1,4 @@
-{ stdenv, linuxHeaders, parentWrapperDir, debug ? false }:
+{ stdenv, linuxHeaders, sourceProg, debug ? false }:
 # For testing:
 # $ nix-build -E 'with import <nixpkgs> {}; pkgs.callPackage ./wrapper.nix { parentWrapperDir = "/run/wrappers"; debug = true; }'
 stdenv.mkDerivation {
@ -7,7 +7,7 @@ stdenv.mkDerivation {
  dontUnpack = true;
  hardeningEnable = [ "pie" ];
  CFLAGS = [
-    ''-DWRAPPER_DIR="${parentWrapperDir}"''
+    ''-DSOURCE_PROG="${sourceProg}"''
  ] ++ (if debug then [
    "-Werror" "-Og" "-g"
  ] else [
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -2814,9 +2814,8 @@ let

      systemd.services.systemd-networkd = let
        isReloadableUnitFileName = unitFileName: strings.hasSuffix ".network" unitFileName;
-        partitionedUnitFiles = lib.partition isReloadableUnitFileName unitFiles;
-        reloadableUnitFiles = partitionedUnitFiles.right;
-        nonReloadableUnitFiles = partitionedUnitFiles.wrong;
+        reloadableUnitFiles = attrsets.filterAttrs (k: v: isReloadableUnitFileName k) unitFiles;
+        nonReloadableUnitFiles = attrsets.filterAttrs (k: v: !isReloadableUnitFileName k) unitFiles;
        unitFileSources = unitFiles: map (x: x.source) (attrValues unitFiles);
      in {
        wantedBy = [ "multi-user.target" ];
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -1396,14 +1396,12 @@ in
    security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
      /run/wrappers/bin/ping {
        include <abstractions/base>
-        include <nixos/security.wrappers>
+        include <nixos/security.wrappers/ping>
        rpx /run/wrappers/wrappers.*/ping,
      }
      /run/wrappers/wrappers.*/ping {
        include <abstractions/base>
-        include <nixos/security.wrappers>
-        r /run/wrappers/wrappers.*/ping.real,
-        mrpx ${config.security.wrappers.ping.source},
+        include <nixos/security.wrappers/ping>
        capability net_raw,
        capability setpcap,
      }
--- a/nixos/tests/wrappers.nix
+++ b/nixos/tests/wrappers.nix
@ -21,6 +21,8 @@ in
      };
    };

+    security.apparmor.enable = true;
+
    security.wrappers = {
      suidRoot = {
        owner = "root";
@ -84,17 +86,27 @@ in
      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -g', '0')
      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -rg', '0')

+      # Test that in nonewprivs environment the wrappers simply exec their target.
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -u', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
+
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -g', '${toString usersGid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
+
      # We are only testing the permitted set, because it's easiest to look at with capsh.
      machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_CHOWN'))
      machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_SYS_ADMIN'))
      machine.succeed(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_CHOWN'))
      machine.fail(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_SYS_ADMIN'))

-      # test a few "attacks" against which the wrapper protects itself
-      machine.succeed("cp /run/wrappers/bin/suid_root_busybox{,.real} /tmp/")
-      machine.fail(cmd_as_regular("/tmp/suid_root_busybox id -u"))
-
-      machine.succeed("chmod u+s,a+w /run/wrappers/bin/suid_root_busybox")
-      machine.fail(cmd_as_regular("/run/wrappers/bin/suid_root_busybox id -u"))
+      # Test that the only user of apparmor policy includes generated by
+      # wrappers works. Ideally this'd be located in a test for the module that
+      # actually makes the apparmor policy for ping, but there's no convenient
+      # test for that one.
+      machine.succeed("ping -c 1 127.0.0.1")
    '';
 })
--- a/pkgs/applications/misc/pot/Cargo.lock
+++ b/pkgs/applications/misc/pot/Cargo.lock
@ -65,6 +65,12 @@ dependencies = [
 "alloc-no-stdlib",
 ]

+[[package]]
+name = "allocator-api2"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
+
 [[package]]
 name = "android-tzdata"
 version = "0.1.1"
@ -257,6 +263,15 @@ dependencies = [
 "system-deps 6.1.1",
 ]

+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.1"
@ -330,6 +345,9 @@ name = "bitflags"
 version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+dependencies = [
+ "serde",
+]

 [[package]]
 name = "block"
@ -679,6 +697,12 @@ dependencies = [
 "crossbeam-utils",
 ]

+[[package]]
+name = "const-oid"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"
+
 [[package]]
 name = "const-random"
 version = "0.1.15"
@ -775,6 +799,21 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "crc"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86ec7a15cbe22e59248fc7eadb1907dab5ba09372595da4d73dd805ed4417dfe"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cace84e55f07e7301bae1c519df89cdad8cc3cd868413d3fdbdeca9ff3db484"
+
 [[package]]
 name = "crc32fast"
 version = "1.3.2"
@ -818,6 +857,16 @@ dependencies = [
 "scopeguard",
 ]

+[[package]]
+name = "crossbeam-queue"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1cfb3ea8a53f37c40dea2c7bedcbd88bdfae54f5e2175d6ecaff1c988353add"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.16"
@ -926,6 +975,17 @@ dependencies = [
 "winapi",
 ]

+[[package]]
+name = "der"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fffa369a668c8af7dbf8b5e56c9f744fbd399949ed171606040001947de40b1c"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
 [[package]]
 name = "deranged"
 version = "0.3.8"
@ -977,6 +1037,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
 "block-buffer",
+ "const-oid",
 "crypto-common",
 "subtle",
 ]
@ -1076,6 +1137,12 @@ dependencies = [
 "xcb",
 ]

+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
 [[package]]
 name = "downcast-rs"
 version = "1.2.0"
@ -1108,6 +1175,9 @@ name = "either"
 version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+dependencies = [
+ "serde",
+]

 [[package]]
 name = "embed-resource"
@ -1208,6 +1278,17 @@ dependencies = [
 "str-buf",
 ]

+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "event-listener"
 version = "2.5.3"
@ -1285,6 +1366,12 @@ dependencies = [
 "windows-sys 0.48.0",
 ]

+[[package]]
+name = "finl_unicode"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fcfdc7a0362c9f4444381a9e697c79d435fe65b52a37466fc2c1184cee9edc6"
+
 [[package]]
 name = "fixedbitset"
 version = "0.4.2"
@ -1311,7 +1398,7 @@ dependencies = [
 "futures-sink",
 "nanorand",
 "pin-project",
- "spin",
+ "spin 0.9.8",
 ]

 [[package]]
@ -1407,6 +1494,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
 dependencies = [
 "futures-core",
+ "futures-sink",
 ]

 [[package]]
@ -1426,6 +1514,17 @@ dependencies = [
 "futures-util",
 ]

+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
 [[package]]
 name = "futures-io"
 version = "0.3.28"
@ -1854,6 +1953,19 @@ name = "hashbrown"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
+dependencies = [
+ "hashbrown 0.14.0",
+]

 [[package]]
 name = "heck"
@ -1869,6 +1981,9 @@ name = "heck"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+dependencies = [
+ "unicode-segmentation",
+]

 [[package]]
 name = "hermit-abi"
@ -1882,6 +1997,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"

+[[package]]
+name = "hkdf"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437"
+dependencies = [
+ "hmac",
+]
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
@ -1891,6 +2015,15 @@ dependencies = [
 "digest",
 ]

+[[package]]
+name = "home"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5444c27eef6923071f7ebcc33e3444508466a76f7a2b93da00ed6e19f30c1ddb"
+dependencies = [
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "html5ever"
 version = "0.25.2"
@ -2181,6 +2314,15 @@ dependencies = [
 "either",
 ]

+[[package]]
+name = "itertools"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "0.4.8"
@ -2312,6 +2454,9 @@ name = "lazy_static"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+dependencies = [
+ "spin 0.5.2",
+]

 [[package]]
 name = "lebe"
@ -2388,6 +2533,23 @@ dependencies = [
 "windows-sys 0.48.0",
 ]

+[[package]]
+name = "libm"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7012b1bbb0719e1097c47611d3898568c546d597c2e74d66f6087edd5233ff4"
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afc22eff61b133b115c6e8c74e818c628d6d5e7a502afea6f64dee076dd94326"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "line-wrap"
 version = "0.1.1"
@ -2408,7 +2570,7 @@ dependencies = [
 "compact_str",
 "fraction",
 "include_dir",
- "itertools",
+ "itertools 0.10.5",
 "lingua-arabic-language-model",
 "lingua-chinese-language-model",
 "lingua-english-language-model",
@ -2993,6 +3155,23 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-bigint-dig"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151"
+dependencies = [
+ "byteorder",
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.5",
+ "smallvec",
+ "zeroize",
+]
+
 [[package]]
 name = "num-complex"
 version = "0.4.4"
@ -3042,6 +3221,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
 dependencies = [
 "autocfg",
+ "libm",
 ]

 [[package]]
@ -3300,6 +3480,12 @@ dependencies = [
 "subtle",
 ]

+[[package]]
+name = "paste"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
+
 [[package]]
 name = "pathdiff"
 version = "0.2.1"
@ -3318,6 +3504,15 @@ dependencies = [
 "sha2",
 ]

+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.0"
@ -3464,6 +3659,27 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"

+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.27"
@ -3538,6 +3754,7 @@ dependencies = [
 "tauri-plugin-fs-watch",
 "tauri-plugin-log",
 "tauri-plugin-single-instance",
+ "tauri-plugin-sql",
 "tauri-plugin-store",
 "thiserror",
 "tiny_http",
@ -3918,6 +4135,43 @@ dependencies = [
 "windows 0.37.0",
 ]

+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin 0.5.2",
+ "untrusted",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ab43bb47d23c1a631b4b680199a45255dce26fa9ab2fa902581f624ff13e6a8"
+dependencies = [
+ "byteorder",
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.23"
@ -3960,6 +4214,36 @@ dependencies = [
 "windows-sys 0.48.0",
 ]

+[[package]]
+name = "rustls"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd8d6c9f025a446bc4d18ad9632e69aec8f287aa84499ee335599fabd20c3fd8"
+dependencies = [
+ "ring",
+ "rustls-webpki",
+ "sct",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d3987094b1d07b653b7dfdc3f70ce9a1da9c51ac18c1b06b662e4f9a0e9f4b2"
+dependencies = [
+ "base64 0.21.3",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d93931baf2d282fff8d3a532bbfd7653f734643161b87e3e01e59a04439bf0d"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.14"
@ -4026,6 +4310,16 @@ dependencies = [
 "xcb",
 ]

+[[package]]
+name = "sct"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "security-framework"
 version = "2.9.2"
@ -4298,6 +4592,16 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "signature"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e1788eed21689f9cf370582dfc467ef36ed9c707f073528ddafa8d83e3b8500"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.7"
@ -4373,6 +4677,12 @@ dependencies = [
 "system-deps 5.0.0",
 ]

+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
 [[package]]
 name = "spin"
 version = "0.9.8"
@ -4382,6 +4692,229 @@ dependencies = [
 "lock_api",
 ]

+[[package]]
+name = "spki"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1e996ef02c474957d681f1b05213dfb0abab947b446a62d37770b23500184a"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlformat"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b7b278788e7be4d0d29c0f39497a0eef3fba6bbc8e70d8bf7fde46edeaa9e85"
+dependencies = [
+ "itertools 0.11.0",
+ "nom",
+ "unicode_categories",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e58421b6bc416714d5115a2ca953718f6c621a51b68e4f4922aea5a4391a721"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd4cef4251aabbae751a3710927945901ee1d97ee96d757f6880ebb9a79bfd53"
+dependencies = [
+ "ahash",
+ "atoi",
+ "byteorder",
+ "bytes",
+ "crc",
+ "crossbeam-queue",
+ "dotenvy",
+ "either",
+ "event-listener",
+ "futures-channel",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashlink",
+ "hex",
+ "indexmap 2.0.0",
+ "log",
+ "memchr",
+ "once_cell",
+ "paste",
+ "percent-encoding",
+ "rustls",
+ "rustls-pemfile",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlformat",
+ "thiserror",
+ "time 0.3.28",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "webpki-roots",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "208e3165167afd7f3881b16c1ef3f2af69fa75980897aac8874a0696516d12c2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a4a8336d278c62231d87f24e8a7a74898156e34c1c18942857be2acb29c7dfc"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck 0.4.1",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn 1.0.109",
+ "tempfile",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ca69bf415b93b60b80dc8fda3cb4ef52b2336614d8da2de5456cc942a110482"
+dependencies = [
+ "atoi",
+ "base64 0.21.3",
+ "bitflags 2.4.0",
+ "byteorder",
+ "bytes",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa 1.0.9",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.5",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "time 0.3.28",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0db2df1b8731c3651e204629dd55e52adbae0462fa1bdcbed56a2302c18181e"
+dependencies = [
+ "atoi",
+ "base64 0.21.3",
+ "bitflags 2.4.0",
+ "byteorder",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa 1.0.9",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.5",
+ "serde",
+ "serde_json",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "time 0.3.28",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4c21bf34c7cae5b283efb3ac1bcc7670df7561124dc2f8bdc0b59be40f79a2"
+dependencies = [
+ "atoi",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sqlx-core",
+ "time 0.3.28",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.0"
@ -4435,6 +4968,17 @@ dependencies = [
 "quote",
 ]

+[[package]]
+name = "stringprep"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb41d74e231a107a1b4ee36bd1214b11285b77768d2e3824aedafa988fd36ee6"
+dependencies = [
+ "finl_unicode",
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
 [[package]]
 name = "strsim"
 version = "0.10.0"
@ -4776,6 +5320,22 @@ dependencies = [
 "zbus",
 ]

+[[package]]
+name = "tauri-plugin-sql"
+version = "0.0.0"
+source = "git+https://github.com/tauri-apps/plugins-workspace?branch=v1#5b814f56e6368fdec46c4ddb04a07e0923ff995a"
+dependencies = [
+ "futures-core",
+ "log",
+ "serde",
+ "serde_json",
+ "sqlx",
+ "tauri",
+ "thiserror",
+ "time 0.3.28",
+ "tokio",
+]
+
 [[package]]
 name = "tauri-plugin-store"
 version = "0.0.0"
@ -5052,6 +5612,17 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "tokio-stream"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.8"
@ -5122,6 +5693,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
 dependencies = [
 "cfg-if",
+ "log",
 "pin-project-lite",
 "tracing-attributes",
 "tracing-core",
@ -5258,6 +5830,18 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"

+[[package]]
+name = "unicode_categories"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
 [[package]]
 name = "url"
 version = "2.4.1"
@ -5585,6 +6169,15 @@ dependencies = [
 "system-deps 6.1.1",
 ]

+[[package]]
+name = "webpki-roots"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b291546d5d9d1eab74f069c77749f2cb8504a12caa20f0f2de93ddbf6f411888"
+dependencies = [
+ "rustls-webpki",
+]
+
 [[package]]
 name = "webview2-com"
 version = "0.19.1"
@ -5629,6 +6222,12 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9193164d4de03a926d909d3bc7c30543cecb35400c02114792c2cae20d5e2dbb"

+[[package]]
+name = "whoami"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22fc3756b8a9133049b26c7f61ab35416c130e8c09b660f5b3958b446f52cc50"
+
 [[package]]
 name = "widestring"
 version = "1.0.2"
@ -6250,6 +6849,12 @@ dependencies = [
 "zvariant",
 ]

+[[package]]
+name = "zeroize"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
+
 [[package]]
 name = "zip"
 version = "0.6.6"
--- a/pkgs/applications/misc/pot/default.nix
+++ b/pkgs/applications/misc/pot/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "pot";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "pot-app";
    repo = "pot-desktop";
    rev = version;
-    hash = "sha256-8AIOAM3xEmKn++DqgXVDhCGlPMoeQPGrKtuUnPXmoeU=";
+    hash = "sha256-PvbqPGT8BTHEufYp+TUSd0tTSBnTBDIYHxaeI7FEVDE=";
  };

  sourceRoot = "${src.name}/src-tauri";
@ -66,7 +66,7 @@ stdenv.mkDerivation rec {

    dontFixup = true;
    outputHashMode = "recursive";
-    outputHash = "sha256-+/GDP3IFCidIs2/ZqQX7pZmZNQrCHNT6uy+x1CKkCmI=";
+    outputHash = "sha256-iHFzv8dMC0TT6PtMJmL0EufZ8TnbyjmsoBH3Z8U48D0=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -24,9 +24,10 @@ buildGoModule rec {

  meta = with lib; {
    description = "Synchronize your DNS to multiple providers from a simple DSL";
-    homepage = "https://stackexchange.github.io/dnscontrol/";
+    homepage = "https://dnscontrol.org/";
    changelog = "https://github.com/StackExchange/dnscontrol/releases/tag/${src.rev}";
    license = licenses.mit;
    maintainers = with maintainers; [ mmahut SuperSandro2000 ];
+    mainProgram = "dnscontrol";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/nheko/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nheko/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , asciidoc
 , pkg-config
@ -42,6 +43,22 @@ stdenv.mkDerivation rec {
    hash = "sha256-2daXxTbpSUlig47y901JOkWRxbZGH4qrvNMepJbvS3o=";
  };

+  patches = [
+    # The 2 following patches can be removed with the next version bump.
+    # Backport of https://github.com/Nheko-Reborn/nheko/commit/e89e65dc17020772eb057414b4f0c5d6f4ad98d0.
+    (fetchpatch {
+      name = "nheko-fmt10.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/nheko/-/raw/1b0d5c9eff6409dfd82953f346546d36c288a4a9/nheko-0.11.3-fix-for-fmt-10.patch";
+      hash = "sha256-UYqAu2iXT3Bn/MxCtybiJrJLfVMOOVRchWqrGuPfapI=";
+    })
+    # https://github.com/Nheko-Reborn/nheko/pull/1552
+    (fetchpatch {
+      name = "nheko-fmt10.1.patch";
+      url = "https://github.com/Nheko-Reborn/nheko/commit/614facf93c2b5d6118beb822cc542ac53a883c37.patch";
+      hash = "sha256-rjsQNDfj3Lzbv8ow3qiNozGXQFrtYLhArS6a9JCdgBQ=";
+    })
+  ];
+
  nativeBuildInputs = [
    asciidoc
    cmake
--- a/pkgs/applications/networking/p2p/lokinet/default.nix
+++ b/pkgs/applications/networking/p2p/lokinet/default.nix
@ -8,13 +8,20 @@
 , nlohmann_json
 , pkg-config
 , spdlog
+, fmt_9
 , sqlite
 , systemd
 , unbound
 , zeromq
 }:
+let
+  # Upstream has received reports of incompatibilities with fmt, and other
+  # dependencies, see: https://github.com/oxen-io/lokinet/issues/2200.
+  spdlog' = spdlog.override {
+    fmt = fmt_9;
+  };

-stdenv.mkDerivation rec {
+in stdenv.mkDerivation rec {
  pname = "lokinet";
  version = "0.9.11";

@ -36,7 +43,7 @@ stdenv.mkDerivation rec {
    libuv
    libsodium
    nlohmann_json
-    spdlog
+    spdlog'
    sqlite
    systemd
    unbound
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 # Remove gcc and python references
 , removeReferencesTo
@ -299,6 +300,12 @@ stdenv.mkDerivation {
  patches = [
    # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
    ./modtool-newmod-permissions.patch
+    # https://github.com/gnuradio/gnuradio/pull/6808
+    (fetchpatch {
+      name = "gnuradio-fmt10.1.patch";
+      url = "https://github.com/gnuradio/gnuradio/commit/9357c17721a27cc0aae3fe809af140c84e492f37.patch";
+      hash = "sha256-w3b22PTqoORyYQ3RKRG+2htQWbITzQiOdSDyuejUtHQ=";
+    })
  ];
  passthru = shared.passthru // {
    # Deps that are potentially overridden and are used inside GR plugins - the same version must
--- a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
+++ b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
@ -67,6 +67,12 @@ in stdenv.mkDerivation rec {
      url = "https://github.com/emsec/hal/commit/37d5c1a0eacb25de57cc552c13e74f559a5aa6e8.patch";
      hash = "sha256-a30VjDt4roJOTntisixqnH17wwCgWc4VWeh1+RgqFuY=";
    })
+    (fetchpatch {
+      name = "hal-fix-fmt-10.1-compat.patch";
+      # https://github.com/emsec/hal/pull/530
+      url = "https://github.com/emsec/hal/commit/b639a56b303141afbf6731b70b7cc7452551f024.patch";
+      hash = "sha256-a7AyDEKkqdbiHpa4OHTRuP9Yewb3Nxs/j6bwez5m0yU=";
+    })
  ];

  # make sure bundled dependencies don't get in the way - install also otherwise
@ -126,6 +132,7 @@ in stdenv.mkDerivation rec {
  '';

  meta = with lib; {
+    broken = stdenv.isDarwin;
    description = "A comprehensive reverse engineering and manipulation framework for gate-level netlists";
    homepage = "https://github.com/emsec/hal";
    license = licenses.mit;
--- a/pkgs/applications/science/electronics/openroad/0001-Disable-failing-regression-tests.patch
+++ b/pkgs/applications/science/electronics/openroad/0001-Disable-failing-regression-tests.patch
@ -0,0 +1,83 @@
+From dc32aabd50d53aece41d968649b972ee667875bb Mon Sep 17 00:00:00 2001
+From: Tobias Mayer <tobim@fastmail.fm>
+Date: Sun, 27 Aug 2023 15:08:50 +0200
+Subject: [PATCH] Disable failing regression tests
+
+---
+ src/drt/test/regression_tests.tcl | 6 +++---
+ src/odb/test/regression_tests.tcl | 4 ++--
+ src/par/test/regression_tests.tcl | 2 +-
+ src/pdn/test/regression_tests.tcl | 2 +-
+ src/rcx/test/regression_tests.tcl | 6 +++---
+ 5 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/src/drt/test/regression_tests.tcl b/src/drt/test/regression_tests.tcl
+index 11705562d..15546244a 100644
+--- a/src/drt/test/regression_tests.tcl
+++ b/src/drt/test/regression_tests.tcl
+@@ -9,6 +9,6 @@ record_tests {
+   top_level_term
+   top_level_term2
+ }
+-record_pass_fail_tests {
+-  gc_test
+-}
+#record_pass_fail_tests {
+#  gc_test
+#}
+diff --git a/src/odb/test/regression_tests.tcl b/src/odb/test/regression_tests.tcl
+index b8e4f917a..7c6a0223a 100644
+--- a/src/odb/test/regression_tests.tcl
+++ b/src/odb/test/regression_tests.tcl
+@@ -34,9 +34,9 @@ record_tests {
+ }
+ 
+ record_pass_fail_tests {
+-  cpp_tests
+  #cpp_tests
+   dump_netlists
+   dump_netlists_withfill
+-  parser_unit_test
+  #parser_unit_test
+ }
+ 
+diff --git a/src/par/test/regression_tests.tcl b/src/par/test/regression_tests.tcl
+index 9ff31fb12..63d5d0dae 100644
+--- a/src/par/test/regression_tests.tcl
+++ b/src/par/test/regression_tests.tcl
+@@ -1,4 +1,4 @@
+ record_tests {
+   read_part
+-  partition_gcd
+  #partition_gcd
+ }
+diff --git a/src/pdn/test/regression_tests.tcl b/src/pdn/test/regression_tests.tcl
+index 86c334f24..b695c490c 100644
+--- a/src/pdn/test/regression_tests.tcl
+++ b/src/pdn/test/regression_tests.tcl
+@@ -10,7 +10,7 @@ record_tests {
+   max_width
+   min_spacing
+   widthtable
+-  design_width
+  #design_width
+   offgrid
+ 
+   core_grid
+diff --git a/src/rcx/test/regression_tests.tcl b/src/rcx/test/regression_tests.tcl
+index 7070cc45f..72f348d96 100644
+--- a/src/rcx/test/regression_tests.tcl
+++ b/src/rcx/test/regression_tests.tcl
+@@ -6,6 +6,6 @@ record_tests {
+   45_gcd
+   names
+ }
+-record_pass_fail_tests {
+-  rcx_unit_test
+-}
+#record_pass_fail_tests {
+#  rcx_unit_test
+#}
+-- 
+2.41.0
+
--- a/pkgs/applications/science/electronics/openroad/0001-Fix-string-formatting-in-tests.patch
+++ b/pkgs/applications/science/electronics/openroad/0001-Fix-string-formatting-in-tests.patch
@ -1,53 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nicolas Benes <nbenes.gh@xandea.de>
-Date: Sun, 2 Apr 2023 01:24:51 +0200
-Subject: [PATCH] Fix string formatting in tests
-
-Hide the decimal point and digits after the decimal point when they are
-not needed.
-
-diff --git a/src/par/test/partition_gcd.ok b/src/par/test/partition_gcd.ok
-index 6c40c14..b9a42f6 100644
--- a/src/par/test/partition_gcd.ok
-+++ b/src/par/test/partition_gcd.ok
-@@ -9,7 +9,7 @@
- ========================================
- [INFO] Partitioning parameters**** 
- [PARAM] Number of partitions = 2
-[PARAM] UBfactor = 1.0
-+[PARAM] UBfactor = 1
- [PARAM] Vertex dimensions = 1
- [PARAM] Hyperedge dimensions = 1
- ========================================
-@@ -118,7 +118,7 @@ After Hyperedge Reduction :  num_vertices = 137, num_hyperedges = 251
- [V-Refine] Level 2 :: 207, 301, 154.65254
- [V-Refine] Level 3 :: 312, 370, 154.65254
- [V-Refine] Level 4 :: 469, 451, 154.65254
-[INFO] V-cycle refinement 1 delta cost 0.0
-+[INFO] V-cycle refinement 1 delta cost 0
- =========================================
- [STATUS] Running FC multilevel coarsening 
- =========================================
-@@ -133,7 +133,7 @@ After Hyperedge Reduction :  num_vertices = 137, num_hyperedges = 251
- [V-Refine] Level 2 :: 207, 301, 154.65254
- [V-Refine] Level 3 :: 312, 370, 154.65254
- [V-Refine] Level 4 :: 469, 451, 154.65254
-[INFO] V-cycle refinement 2 delta cost 0.0
-+[INFO] V-cycle refinement 2 delta cost 0
- [Cutcost of partition : 154.65254]
- [Vertex balance of block_0 : 0.59249  ( 327.17993 )    
- [Vertex balance of block_1 : 0.40751  ( 225.03609 )    
-diff --git a/src/pdn/test/design_width.ok b/src/pdn/test/design_width.ok
-index 381dca1..a102974 100644
--- a/src/pdn/test/design_width.ok
-+++ b/src/pdn/test/design_width.ok
-@@ -9,5 +9,5 @@
- [INFO ODB-0130]     Created 54 pins.
- [INFO ODB-0131]     Created 406 components and 1816 component-terminals.
- [INFO ODB-0133]     Created 361 nets and 1004 connections.
-[ERROR PDN-0185] Insufficient width (14.04 um) to add straps on layer M8 in grid "Core" with total strap width 6.0 um and offset 10.0 um.
-+[ERROR PDN-0185] Insufficient width (14.04 um) to add straps on layer M8 in grid "Core" with total strap width 6 um and offset 10 um.
- PDN-0185
-- 
-2.38.4
-
--- a/pkgs/applications/science/electronics/openroad/default.nix
+++ b/pkgs/applications/science/electronics/openroad/default.nix
@ -1,6 +1,7 @@
 { lib
 , mkDerivation
 , fetchFromGitHub
+, fetchpatch
 , bison
 , cmake
 , doxygen
@ -34,14 +35,14 @@

 mkDerivation rec {
  pname = "openroad";
-  version = "unstable-2023-03-31";
+  version = "unstable-2023-08-26";

  src = fetchFromGitHub {
    owner = "The-OpenROAD-Project";
    repo = "OpenROAD";
-    rev = "cd03c5cf8a8eb78c0e07fe33a56b8e9d64672efe";
+    rev = "6dba515c2aacd3fca58ef8135424884146efd95b";
    fetchSubmodules = true;
-    hash = "sha256-BWUvFCuWKWQpifErpak03J+A7ni0jZWIrCMhMdKIbD0=";
+    hash = "sha256-LAj7X+Vq0+H3tIo5zgyUuIjQwTj+2DLL18/KMJ/kf4A=";
  };

  nativeBuildInputs = [
@ -79,7 +80,16 @@ mkDerivation rec {
  ];

  patches = [
-    ./0001-Fix-string-formatting-in-tests.patch
+    # https://github.com/The-OpenROAD-Project/OpenROAD/pull/3911
+    (fetchpatch {
+      name = "openroad-fix-fmt-10.patch";
+      url = "https://github.com/The-OpenROAD-Project/OpenROAD/commit/9396f07f28e0260cd64acfc51909f6566b70e682.patch";
+      hash = "sha256-jy8K8pdhSswVz6V6otk8JAI7nndaFVMuKQ/4A3Kzwns=";
+    })
+    # Upstream is not aware of these failures
+    ./0001-Disable-failing-regression-tests.patch
+    # This is an issue we experience in the sandbox, and upstream
+    # probably wouldn't mind merging this change, but no PR was opened.
    ./0002-Ignore-warning-on-stderr.patch
  ];

@ -89,20 +99,17 @@ mkDerivation rec {

  # Enable output images from the placer.
  cmakeFlags = [
+    # Tries to download gtest 1.13 as part of the build. We currently rely on
+    # the regression tests so we can get by without building unit tests.
+    "-DENABLE_TESTS=OFF"
    "-DUSE_SYSTEM_BOOST=ON"
    "-DUSE_CIMG_LIB=ON"
    "-DOPENROAD_VERSION=${src.rev}"
-
-    # 2023-03-31: see discussion on fmt workaround in
-    # https://github.com/The-OpenROAD-Project/OpenROAD/pull/2696
-    "-DCMAKE_CXX_FLAGS=-DFMT_DEPRECATED_OSTREAM"
  ];

  # Resynthesis needs access to the Yosys binaries.
  qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ yosys ]}" ];

-  checkInputs = [ gtest ];
-
  # Upstream uses vendored package versions for some dependencies, so regression testing is prudent
  # to see if there are any breaking changes in unstable that should be vendored as well.
  doCheck = true;
--- a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "gitlab-container-registry";
-  version = "3.82.0";
+  version = "3.83.0";
  rev = "v${version}-gitlab";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "container-registry";
    inherit rev;
-    sha256 = "sha256-umlpGpeN7sWe8524+wjdYYJegLdc+eQqlgySLWL0a+k=";
+    sha256 = "sha256-HYyPe4x8hwtKAr0r4dGUbIyiLRQKtlWQ4Pt2mtbQmZM=";
  };

-  vendorHash = "sha256-hFGuzTM9+Zb8BmUoFG059eqM53AzOmi1DeBnF68WSoc=";
+  vendorHash = "sha256-OX8drOl8D30gYFnLzZe9i1whguXe0QFhsLpP9G9seuk=";

  patches = [
    ./Disable-inmemory-storage-driver-test.patch
--- a/pkgs/by-name/ai/airscan/package.nix
+++ b/pkgs/by-name/ai/airscan/package.nix
@ -0,0 +1,26 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "airscan";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "stapelberg";
+    repo = "airscan";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-gk0soDzrsFBh+SrWcfO/quW6JweX6MthOigTHcaq1oE=";
+  };
+
+  vendorHash = "sha256-I5JRGaff6OIwx4q7BjpFwvJiQe4kw03V8+McYPcJhho=";
+
+  meta = with lib; {
+    description = "Package to scan paper documents using the Apple AirScan (eSCL) protocol";
+    homepage = "https://github.com/stapelberg/airscan";
+    changelog = "https://github.com/stapelberg/airscan/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ johannwagner ];
+  };
+}
--- a/pkgs/development/libraries/mpir/default.nix
+++ b/pkgs/development/libraries/mpir/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, m4, which, yasm, buildPackages }:
+{ lib, stdenv, fetchurl, m4, which, yasm, autoreconfHook, fetchpatch, buildPackages }:

 stdenv.mkDerivation rec {
  pname = "mpir";
@ -6,13 +6,22 @@ stdenv.mkDerivation rec {

  depsBuildBuild = [ buildPackages.stdenv.cc ];

-  nativeBuildInputs = [ m4 which yasm ];
+  nativeBuildInputs = [ m4 which yasm autoreconfHook ];

  src = fetchurl {
    url = "https://mpir.org/mpir-${version}.tar.bz2";
    sha256 = "1fvmhrqdjs925hzr2i8bszm50h00gwsh17p2kn2pi51zrxck9xjj";
  };

+  patches = [
+    # Fixes configure check failures with clang 16 due to implicit definitions of `exit`, which
+    # is an error with newer versions of clang.
+    (fetchpatch {
+      url = "https://github.com/wbhart/mpir/commit/bbc43ca6ae0bec4f64e69c9cd4c967005d6470eb.patch";
+      hash = "sha256-vW+cDK5Hq2hKEyprOJaNbj0bT2FJmMcyZHPE8GUNUWc=";
+    })
+  ];
+
  configureFlags = [ "--enable-cxx" ]
    ++ lib.optionals stdenv.isLinux [ "--enable-fat" ];

--- a/pkgs/development/libraries/spdlog/default.nix
+++ b/pkgs/development/libraries/spdlog/default.nix
@ -3,10 +3,8 @@
 , fetchFromGitHub
 , fetchpatch
 , cmake
-# Although we include upstream patches that fix compilation with fmt_10, we
-# still use fmt_9 because this dependency is propagated, and many of spdlog's
-# reverse dependencies don't support fmt_10 yet.
-, fmt_9
+, fmt
+, catch2_3
 , staticBuild ? stdenv.hostPlatform.isStatic

 # tests
@ -15,29 +13,26 @@

 stdenv.mkDerivation rec {
  pname = "spdlog";
-  version = "1.11.0";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "gabime";
    repo  = "spdlog";
    rev   = "v${version}";
-    hash  = "sha256-kA2MAb4/EygjwiLEjF9EA7k8Tk//nwcKB1+HlzELakQ=";
+    hash  = "sha256-cxTaOuLXHRU8xMz9gluYz0a93O0ez2xOxbloyc1m1ns=";
  };

  patches = [
-    # Fix compatiblity with fmt 10.0. Remove with the next release
+    # Fix a broken test, remove with the next release.
    (fetchpatch {
-      url = "https://github.com/gabime/spdlog/commit/0ca574ae168820da0268b3ec7607ca7b33024d05.patch";
-      hash = "sha256-cRsQilkyUQW47PFpDwKgU/pm+tOeLvwPx32gNOPAO1U=";
-    })
-    (fetchpatch {
-      url = "https://github.com/gabime/spdlog/commit/af1785b897c9d1098d4aa7213fad232be63c19b4.patch";
-      hash = "sha256-zpfLiBeDAOsvk4vrIyXC0kvFe2WkhAhersd+fhA8DFY=";
+      url = "https://github.com/gabime/spdlog/commit/2ee8bac78e6525a8ad9a9196e65d502ce390d83a.patch";
+      hash = "sha256-L79yOkm3VY01jmxNctfneTLmOA5DEQeNNGC8LbpJiOc=";
    })
  ];

  nativeBuildInputs = [ cmake ];
-  propagatedBuildInputs = [ fmt_9 ];
+  propagatedBuildInputs = [ fmt ];
+  checkInputs = [ catch2_3 ];

  cmakeFlags = [
    "-DSPDLOG_BUILD_SHARED=${if staticBuild then "OFF" else "ON"}"
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@ -2,11 +2,11 @@

 mkDerivation (finalAttrs: {
  pname = "composer";
-  version = "2.5.8";
+  version = "2.6.2";

  src = fetchurl {
    url = "https://github.com/composer/composer/releases/download/${finalAttrs.version}/composer.phar";
-    hash = "sha256-8Hk0+tRPkEjA3IdaUGzKMcwnlNauv8GGfzsfv0jc4sU=";
+    hash = "sha256-iMhNSlP88cJ9Z2Lh1da3DVfG3J0uIxT9Cdv4a/YeGu8=";
  };

  dontUnpack = true;
--- a/pkgs/development/python-modules/aiodiscover/default.nix
+++ b/pkgs/development/python-modules/aiodiscover/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "aiodiscover";
-  version = "1.4.16";
+  version = "1.5.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "bdraco";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-umHw9DFLIsoxBNlUSuSmaRy5O270lP0tLZ8rilw0oWg=";
+    hash = "sha256-rFypv0gCj+Jskk+dlRNJ2ufj2sDud7AuJzj3cl4bB4Y=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "bleak";
-  version = "0.21.0";
+  version = "0.21.1";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "hbldh";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-hnXBXm0BFNNzw563Ybr76KHiqt2sFqo0dtiRHGWsu3A=";
+    hash = "sha256-T0im8zKyNLbskAEDeUUFS/daJtvttlHlttjscqP8iSk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
+++ b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "bluetooth-auto-recovery";
-  version = "1.2.1";
+  version = "1.2.3";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-5OOIehWb7nxKs1AF9/0yjZhbc3h4MWdgAVCa7irq5YE=";
+    hash = "sha256-1ytiTIAV00Wk2zqZKRAsstVLuyzPEGBISz0g0ssC5Eo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/checkdmarc/default.nix
+++ b/pkgs/development/python-modules/checkdmarc/default.nix
@ -0,0 +1,76 @@
+{ lib
+, buildPythonPackage
+, cryptography
+, dnspython
+, expiringdict
+, fetchFromGitHub
+, hatchling
+, publicsuffixlist
+, pyleri
+, iana-etc
+, pytestCheckHook
+, pythonOlder
+, requests
+, timeout-decorator
+}:
+
+buildPythonPackage rec {
+  pname = "checkdmarc";
+  version = "4.8.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "domainaware";
+    repo = "checkdmarc";
+    # https://github.com/domainaware/checkdmarc/issues/102
+    rev = "d0364ceef3cfd41052273913369e3831cb6fe4fd";
+    hash = "sha256-OSljewDeyJtoxkCQjPU9wIsNhhxumHmeu9GHvRD4DRY=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    cryptography
+    dnspython
+    expiringdict
+    publicsuffixlist
+    pyleri
+    requests
+    timeout-decorator
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "checkdmarc"
+  ];
+
+  pytestFlagsArray = [
+    "tests.py"
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "testDMARCPctLessThan100Warning"
+    "testSPFMissingARecord"
+    "testSPFMissingMXRecord"
+    "testSplitSPFRecord"
+    "testTooManySPFDNSLookups"
+    "testTooManySPFVoidDNSLookups"
+  ];
+
+  meta = with lib; {
+    description = "A parser for SPF and DMARC DNS records";
+    homepage = "https://github.com/domainaware/checkdmarc";
+    changelog = "https://github.com/domainaware/checkdmarc/blob/${version}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
+
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@ -17,15 +17,15 @@
 }:

 buildPythonPackage rec {
-  version = "0.21.5";
+  version = "0.21.6";
  pname = "dulwich";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-cJVeTiSd3abjSkY2uQ906THlWPmTsXxSVw+mFEuZMQM=";
+    hash = "sha256-MPvofotR84E8Ex4oQchtAHQ00WC9FttYa0DUfzHdBbA=";
  };

  LC_ALL = "en_US.UTF-8";
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "fakeredis";
-  version = "2.18.0";
+  version = "2.18.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "dsoftwareinc";
    repo = "fakeredis-py";
    rev = "refs/tags/v${version}";
-    hash = "sha256-+bJbtqBUgix4oIq49hQEk3/cNXfvXFXE/m/qR1zy8jo=";
+    hash = "sha256-XxQGkcwWesPS/N31t04FDq6w773OZnLVTWB42dY4AGA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/flask-socketio/default.nix
+++ b/pkgs/development/python-modules/flask-socketio/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "Flask-SocketIO";
-  version = "5.3.5";
+  version = "5.3.6";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -19,8 +19,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "miguelgrinberg";
    repo = "Flask-SocketIO";
-    rev = "v${version}";
-    hash = "sha256-5Di02VJM9sJndp/x5Hl9ztcItY3aXk/wBJT90OSoc2c=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-YjCe34Mvt7tvp3w5yH52lrq4bWi7aIYAUssNqxlQ8CA=";
  };

  nativeBuildInputs = [
@ -41,13 +41,15 @@ buildPythonPackage rec {
    "test_socketio.py"
  ];

-  pythonImportsCheck = [ "flask_socketio" ];
+  pythonImportsCheck = [
+    "flask_socketio"
+  ];

  meta = with lib; {
    description = "Socket.IO integration for Flask applications";
    homepage = "https://github.com/miguelgrinberg/Flask-SocketIO/";
    changelog = "https://github.com/miguelgrinberg/Flask-SocketIO/blob/v${version}/CHANGES.md";
    license = licenses.mit;
-    maintainers = [ maintainers.mic92 ];
+    maintainers = with maintainers; [ mic92 ];
  };
 }
--- a/pkgs/development/python-modules/liccheck/default.nix
+++ b/pkgs/development/python-modules/liccheck/default.nix
@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, configparser
+, fetchFromGitHub
+, pip
+, pytest-mock
+, pytestCheckHook
+, python3-openid
+, pythonOlder
+, semantic-version
+, toml
+}:
+
+buildPythonPackage rec {
+  pname = "liccheck";
+  version = "0.9.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "dhatim";
+    repo = "python-license-check";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ZgwHcZI0vsNYJWPkUnoBogVPPIuifAX9hu4fa1fHSz4=";
+  };
+
+  propagatedBuildInputs = [
+    configparser
+    semantic-version
+    toml
+  ];
+
+  nativeCheckInputs = [
+    pip
+    pytest-mock
+    pytestCheckHook
+    python3-openid
+  ];
+
+  pythonImportsCheck = [
+    "liccheck"
+  ];
+
+  meta = with lib; {
+    description = "Check python packages from requirement.txt and report issues";
+    homepage = "https://github.com/dhatim/python-license-check";
+    changelog = "https://github.com/dhatim/python-license-check/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/plexapi/default.nix
+++ b/pkgs/development/python-modules/plexapi/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "plexapi";
-  version = "4.15.0";
+  version = "4.15.1";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "pkkid";
    repo = "python-plexapi";
    rev = "refs/tags/${version}";
-    hash = "sha256-JIfMHDMX7N9wr9BTiTh/jsnPLDS3w8Pyp7wS014PyQ0=";
+    hash = "sha256-mxVj98wbstUx/Abim7kzVVt/8kaAPVOhv4zt+PFgi3Y=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pulsectl-asyncio/default.nix
+++ b/pkgs/development/python-modules/pulsectl-asyncio/default.nix
@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pulsectl
+, pythonOlder
+, setuptools
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "pulsectl-asyncio";
+  version = "1.1.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "mhthies";
+    repo = "pulsectl-asyncio";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Uc8iUo9THWNPRRsvJxfw++41cnKrANe/Fk6e8bgLSkc=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    pulsectl
+  ];
+
+  # Tests require a running pulseaudio instance
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pulsectl_asyncio"
+  ];
+
+  meta = with lib; {
+    description = "Python bindings library for PulseAudio";
+    homepage = "https://github.com/mhthies/pulsectl-asyncio";
+    changelog = "https://github.com/mhthies/pulsectl-asyncio/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pyleri/default.nix
+++ b/pkgs/development/python-modules/pyleri/default.nix
@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, unittestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pyleri";
+  version = "1.4.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "cesbit";
+    repo = "pyleri";
+    rev = "refs/tags/${version}";
+    hash = "sha256-52Q2iTrXFNbDzXL0FM+Gypipvo5ciNqAtZa5sKOwQRc=";
+  };
+
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pyleri"
+  ];
+
+  meta = with lib; {
+    description = "Module to parse SiriDB";
+    homepage = "https://github.com/cesbit/pyleri";
+    changelog = "https://github.com/cesbit/pyleri/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pymodbus/default.nix
+++ b/pkgs/development/python-modules/pymodbus/default.nix
@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "pymodbus";
-  version = "3.5.1";
+  version = "3.5.2";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "pymodbus-dev";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-YFA9msaPOPDbQPkDbT8Rl7jWafUX8eFnV4JimSg+mmc=";
+    hash = "sha256-FOmR9yqLagqcsAVxqHxziEcnZ5M9QpL2qIp8x2gS2PU=";
  };

  passthru.optional-dependencies = {
@ -59,7 +59,14 @@ buildPythonPackage rec {
    popd
  '';

-  pythonImportsCheck = [ "pymodbus" ];
+  pythonImportsCheck = [
+    "pymodbus"
+  ];
+
+  disabledTests = [
+    # Tests often hang
+    "test_connected"
+  ];

  meta = with lib; {
    description = "Python implementation of the Modbus protocol";
--- a/pkgs/development/python-modules/python-socketio/default.nix
+++ b/pkgs/development/python-modules/python-socketio/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "python-socketio";
-  version = "5.8.0";
+  version = "5.9.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "miguelgrinberg";
    repo = "python-socketio";
    rev = "v${version}";
-    hash = "sha256-3Do3Ql48cmhvrFe14ZYvWH0xi3T8hJ2LP0FyyWin580=";
+    hash = "sha256-1lyTZwkRpGRbeBqt6Thv5o+bUzkD1sC3T9T1GbWMEkI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pywaze/default.nix
+++ b/pkgs/development/python-modules/pywaze/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pywaze";
-  version = "0.3.0";
+  version = "0.4.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "eifinger";
    repo = "pywaze";
    rev = "refs/tags/v${version}";
-    hash = "sha256-z/6eSgERHKV/5vjbRWcyrxAMNDIHvM3GUoo3xf+AhNY=";
+    hash = "sha256-m3erAODTBR0LrZIKzP2Kw5dSaFKP7ehnrO9z5ILvUw8=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pyweatherflowrest/default.nix
+++ b/pkgs/development/python-modules/pyweatherflowrest/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "pyweatherflowrest";
-  version = "1.0.10";
+  version = "1.0.11";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "briis";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-7eNhvpaikzdQBrzjXw67JGqoynvfmz4poruharTkuG0=";
+    hash = "sha256-l1V3HgzqnnoY6sWHwfgBtcIR782RwKhekY2qOLrUMNY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/sseclient-py/default.nix
+++ b/pkgs/development/python-modules/sseclient-py/default.nix
@ -1,24 +1,40 @@
-{ buildPythonPackage, fetchFromGitHub, lib, python }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+}:

 buildPythonPackage rec {
  pname = "sseclient-py";
-  version = "1.7.2";
+  version = "1.8.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "mpetazzoni";
    repo = "sseclient";
    rev = "sseclient-py-${version}";
-    sha256 = "096spyv50jir81xiwkg9l88ycp1897d3443r6gi1by8nkp4chvix";
+    hash = "sha256-rNiJqR7/e+Rhi6kVBY8gZJZczqSUsyszotXkb4OKfWk=";
  };

-  # based on tox.ini
-  checkPhase = ''
-    ${python.interpreter} tests/unittests.py
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "sseclient"
+  ];
+
+  pytestFlagsArray = [
+    "tests/unittests.py"
+  ];

  meta = with lib; {
    description = "Pure-Python Server Side Events (SSE) client";
    homepage = "https://github.com/mpetazzoni/sseclient";
+    changelog = "https://github.com/mpetazzoni/sseclient/releases/tag/sseclient-py-${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ jamiemagee ];
  };
--- a/pkgs/development/python-modules/truststore/default.nix
+++ b/pkgs/development/python-modules/truststore/default.nix
@ -1,24 +1,27 @@
 { lib
+, aiohttp
 , buildPythonPackage
 , fetchFromGitHub
 , flit-core
-, aiohttp
 , httpx
 , pyopenssl
+, pythonOlder
 , requests
 , trustme
 }:

 buildPythonPackage rec {
  pname = "truststore";
-  version = "0.7.0";
+  version = "0.8.0";
  format = "pyproject";

+  disabled = pythonOlder "3.10";
+
  src = fetchFromGitHub {
    owner = "sethmlarson";
    repo = pname;
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-Q3HSHcqoG2DEXujL05lj3GLNu4jJ61i7VFxMou8c0cE=";
+    hash = "sha256-K11nHzpckNR8pqmgLOo/yCJ2cNQnqPHgjMDPQkpeRkQ=";
  };

  nativeBuildInputs = [
@ -36,10 +39,14 @@ buildPythonPackage rec {
  # tests requires networking
  doCheck = false;

+  pythonImportsCheck = [
+    "truststore"
+  ];
+
  meta = with lib; {
    homepage = "https://github.com/sethmlarson/truststore";
    description = "Verify certificates using native system trust stores";
-    changelog = "https://github.com/sethmlarson/truststore/releases/tag/v${version}";
+    changelog = "https://github.com/sethmlarson/truststore/blob/v${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ anthonyroussel ];
  };
--- a/pkgs/development/python-modules/weasyprint/default.nix
+++ b/pkgs/development/python-modules/weasyprint/default.nix
@ -79,9 +79,9 @@ buildPythonPackage rec {

  FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";

-  # Fontconfig error: Cannot load default config file: No such file: (null)
+  # Set env variable explicitly for Darwin, but allow overriding when invoking directly
  makeWrapperArgs = [
-    "--set FONTCONFIG_FILE ${FONTCONFIG_FILE}"
+    "--set-default FONTCONFIG_FILE ${FONTCONFIG_FILE}"
  ];

  postPatch = ''
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "yalexs-ble";
-  version = "2.2.3";
+  version = "2.3.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "bdraco";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-Z8pPN9cO/8jv66yrG2EKRDXNjKPbYarOOB5t9ObMzek=";
+    hash = "sha256-QL8S5fDNi6msyaV14E6tgN0C/nvXqV0+Mx+4AY0um4o=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/ypy-websocket/default.nix
+++ b/pkgs/development/python-modules/ypy-websocket/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "ypy-websocket";
-  version = "0.12.2";
+  version = "0.12.3";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "y-crdt";
    repo = "ypy-websocket";
    rev = "refs/tags/v${version}";
-    hash = "sha256-3ANuIwRxUoFo5SSdTvBhTHExrYR7timu7XkE0t+UyWk=";
+    hash = "sha256-gBLRjqsI2xx2z8qfaix4Gsm1rlNcjZ5g1PNVW7N4Q5k=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "zeroconf";
-  version = "0.102.0";
+  version = "0.103.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "jstasiak";
    repo = "python-zeroconf";
    rev = "refs/tags/${version}";
-    hash = "sha256-Z4RswQDA05wXXyg8CeIiuh9I1EXTyXh6Z88r7soGFTo=";
+    hash = "sha256-15nOSQOM1c9zISsTwY2pdRLIp2/sLnBmb/5LMoWHyfo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/build-managers/bear/default.nix
+++ b/pkgs/development/tools/build-managers/bear/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "bear";
-  version = "3.1.2";
+  version = "3.1.3";

  src = fetchFromGitHub {
    owner = "rizsotto";
    repo = pname;
    rev = version;
-    sha256 = "sha256-x46BS+By5Zj5xeYRD45eXRDCAOqwpkkivVyJPnhkAMc=";
+    hash = "sha256-1nZPzgLWcmaRkOUXdm16IW2Nw/p1w8GBGEfZX/v+En0=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
@ -44,15 +44,10 @@ stdenv.mkDerivation rec {
  patches = [
    # Default libexec would be set to /nix/store/*-bear//nix/store/*-bear/libexec/...
    ./no-double-relative.patch
-
-    # Fix compatiblity with fmt 10.0. Remove with the next release
-    (fetchpatch {
-      url = "https://github.com/rizsotto/Bear/commit/46a032fa0fc8131779ece13f26735ec84be891e8.patch";
-      hash = "sha256-zYKwQ5PLSTJ1hROGnTfP8xPoM0cBw6abAZLx6GxmdfI=";
-    })
  ];

  meta = with lib; {
+    broken = stdenv.isDarwin;
    description = "Tool that generates a compilation database for clang tooling";
    longDescription = ''
      Note: the bear command is very useful to generate compilation commands
--- a/pkgs/development/tools/language-servers/vhdl-ls/Cargo.lock
+++ b/pkgs/development/tools/language-servers/vhdl-ls/Cargo.lock
--- a/pkgs/development/tools/language-servers/vhdl-ls/default.nix
+++ b/pkgs/development/tools/language-servers/vhdl-ls/default.nix
@ -5,25 +5,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "vhdl-ls";
-  version = "0.65.0";
+  version = "0.66.0";

  src = fetchFromGitHub {
    owner = "VHDL-LS";
    repo = "rust_hdl";
    rev = "v${version}";
-    hash = "sha256-B+jzTrV5Kk4VOgr+5l0F5+cXzfb0aErKaiH50vIdLq4=";
+    hash = "sha256-tVeGfPm5WdZjARp7n4WD3YQzMUWA3M3TJo2oVivtkiA=";
  };

-  # No Cargo.lock upstream, see:
-  # https://github.com/VHDL-LS/rust_hdl/issues/166
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-  };
+  cargoHash = "sha256-bXz216QvTpBuUNAi5sF0Lga+1ubjlokqPglUyAVXThg=";
+
  postPatch = ''
-    ln -s ${./Cargo.lock} Cargo.lock
-  ''
-  # Also make it look up vhdl_libraries in an expected location
-  + ''
    substituteInPlace vhdl_lang/src/config.rs \
      --replace /usr/lib $out/lib
  '';
--- a/pkgs/games/quakespasm/default.nix
+++ b/pkgs/games/quakespasm/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "quakespasm";
-  version = "0.95.1";
+  version = "0.96.0";

  src = fetchurl {
    url = "mirror://sourceforge/quakespasm/quakespasm-${version}.tar.gz";
-    sha256 = "sha256-hBmEV3s65yQysMiq4zEP4swfCgCCiT5dzZdhg7bSNOI=";
+    sha256 = "sha256-Sa4lLALB3xpMGVjpKnzGl1OBEJcLOHDcFGEFsO0wwOw=";
  };

  sourceRoot = "${pname}-${version}/Quake";
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -2,71 +2,71 @@
    "4.14": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.14.323-hardened1.patch",
-            "sha256": "0id59byd331mz8ga02gbs3g1q0y4n2wz6mi9s0dmp1yjagjd9m70",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.323-hardened1/linux-hardened-4.14.323-hardened1.patch"
+            "name": "linux-hardened-4.14.325-hardened1.patch",
+            "sha256": "1mc1pyjjksg2f4189wyas55ax8czzhai2i3jc6n7l9jmfwj7xr9q",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.325-hardened1/linux-hardened-4.14.325-hardened1.patch"
        },
-        "sha256": "1g2fh0mn1sv0kq2hh3pynmx2fjai7hdwhf4fnaspl7j5n88902kg",
-        "version": "4.14.323"
+        "sha256": "117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav",
+        "version": "4.14.325"
    },
    "4.19": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.19.292-hardened1.patch",
-            "sha256": "1na729sricp347jqp3y2j4yxxg84haa62mwmj9zq0pa1k6f037ph",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.292-hardened1/linux-hardened-4.19.292-hardened1.patch"
+            "name": "linux-hardened-4.19.294-hardened1.patch",
+            "sha256": "1s70vz8rai1z440rmwzipwpq7wa7p2bvri43zmkbisrfggm1lz2r",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.294-hardened1/linux-hardened-4.19.294-hardened1.patch"
        },
-        "sha256": "0dr12v4jqmzxcqdghqqjny5zp3g4dx9lxqrl9d4fxz23s79ji5rl",
-        "version": "4.19.292"
+        "sha256": "03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc",
+        "version": "4.19.294"
    },
    "5.10": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.10.191-hardened1.patch",
-            "sha256": "02949v0qrr4b76g9rl1z8lkdfv3mc1pfb4h14z9bd0dqg5shlz0j",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.191-hardened1/linux-hardened-5.10.191-hardened1.patch"
+            "name": "linux-hardened-5.10.194-hardened1.patch",
+            "sha256": "1ba8ridhjz9y8ap1wgp7z41jmwzx8j0bxkyp1zjfls1z7mqq4vpf",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.194-hardened1/linux-hardened-5.10.194-hardened1.patch"
        },
-        "sha256": "1hk2x5dgvfq9v6161v25wz5qpzgyvqbx34xbm7ww8z4ish76cm6b",
-        "version": "5.10.191"
+        "sha256": "15fr7krhpmqz0xqjg78m2xvfllbni3xh8xyhxh9ni31ppd3mw394",
+        "version": "5.10.194"
    },
    "5.15": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.15.127-hardened1.patch",
-            "sha256": "13z0x45jig81f3vhb5w3lvb554b78888grp7w60sqgglx7bckspb",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.127-hardened1/linux-hardened-5.15.127-hardened1.patch"
+            "name": "linux-hardened-5.15.130-hardened1.patch",
+            "sha256": "12wm6kyg63rg1lk1w9208vpcm71cjy236rjp9gf8mfx7iraqssl7",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.130-hardened1/linux-hardened-5.15.130-hardened1.patch"
        },
-        "sha256": "09lgj9hs1cjxg84hb7avras4rlsx18igr69mx433l9hv6issbl5d",
-        "version": "5.15.127"
+        "sha256": "0qix62jsn3z9yccakac7fvqnip19zi05qn0w5wkgb7rj0x0lwimb",
+        "version": "5.15.130"
    },
    "5.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.4.254-hardened1.patch",
-            "sha256": "0yh5kb23lp89qnk90lz73j101bg20npr7clx0y8zmg6dihls764z",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.254-hardened1/linux-hardened-5.4.254-hardened1.patch"
+            "name": "linux-hardened-5.4.256-hardened1.patch",
+            "sha256": "1rsp30g5xry5y95mz0i6walkcxj6abyrsaq3fwhz0ka6nq6g7w82",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.256-hardened1/linux-hardened-5.4.256-hardened1.patch"
        },
-        "sha256": "1iyrm2xql15ifhy2b939ywrrc44yd41b79sjjim4vqxmc6lqsq2i",
-        "version": "5.4.254"
+        "sha256": "0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967",
+        "version": "5.4.256"
    },
    "6.1": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-6.1.47-hardened1.patch",
-            "sha256": "0wgsjb05m9f0fgv4vj0m0ll9bx22z894qlpwb45b33mq66fvbgwn",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.47-hardened1/linux-hardened-6.1.47-hardened1.patch"
+            "name": "linux-hardened-6.1.51-hardened1.patch",
+            "sha256": "0nbf7j3hwlsvh8f4mmc9w2gqdcj8lyx1hxrz91y2hwlqlqjx7w4p",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.51-hardened1/linux-hardened-6.1.51-hardened1.patch"
        },
-        "sha256": "1azwvlzyp1s2adm17ic0jfmv3ph70wqzycb8s96z9987y1m8pmck",
-        "version": "6.1.47"
+        "sha256": "0fqhmb6v28rssd44z7jw57mwvvskpl4kabjylck0pg54irnl9c2q",
+        "version": "6.1.51"
    },
    "6.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-6.4.12-hardened1.patch",
-            "sha256": "0xkcvyy2ii5wfdw8h21svcsz3s3q0qk4yx7dxzbrisap10d79l51",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.12-hardened1/linux-hardened-6.4.12-hardened1.patch"
+            "name": "linux-hardened-6.4.14-hardened1.patch",
+            "sha256": "1cw0zyjxbfprb2m2kjrpz8s56axbzhnwj8hg9b0486nsqz5s66bs",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.14-hardened1/linux-hardened-6.4.14-hardened1.patch"
        },
-        "sha256": "0x56b4hslm730ghvggz41fjkbzlnxp6k8857dn7iy27yavlipafc",
-        "version": "6.4.12"
+        "sha256": "1rjh0jrn5qvxwzmyg478n08vckkld8r52nkc102ppqvsfhiy7skm",
+        "version": "6.4.14"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.15.130";
+  version = "5.15.131";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0qix62jsn3z9yccakac7fvqnip19zi05qn0w5wkgb7rj0x0lwimb";
+    sha256 = "0sacnbw48lblnqaj56nybh588sq4k84gwf0r5zinzyrryj8k6z4r";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "6.1.51";
+  version = "6.1.52";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0fqhmb6v28rssd44z7jw57mwvvskpl4kabjylck0pg54irnl9c2q";
+    sha256 = "0lis73mxnl7hxz8lyja6sfgmbym944l3k1h7dab6b4mw1nckfxsn";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-6.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.4.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "6.4.14";
+  version = "6.4.15";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1rjh0jrn5qvxwzmyg478n08vckkld8r52nkc102ppqvsfhiy7skm";
+    sha256 = "1phlx375ln5pslw5vjqm029cdv6pzf4ang10xlrf90x5sb4fgy93";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-6.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.5.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "6.5.1";
+  version = "6.5.2";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
--- a/pkgs/servers/gerbera/default.nix
+++ b/pkgs/servers/gerbera/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkg-config
 , nixosTests
@ -74,6 +75,16 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-j5J0u0zIjHY2kP5P8IzN2h+QQSCwsel/iTspad6V48s=";
  };

+  patches = [
+    # Can be removed on the next bump, see:
+    # https://github.com/gerbera/gerbera/pull/2840.
+    (fetchpatch {
+      name = "gerbera-fmt10.patch";
+      url = "https://github.com/gerbera/gerbera/commit/37957aac0aea776e6f843af2358916f81056a405.patch";
+      hash = "sha256-U7dyFGEbelVZeHYX/4fLOC0k+9pUKZ8qP/LIVXWCMcU=";
+    })
+  ];
+
  postPatch = lib.optionalString enableMysql ''
    substituteInPlace cmake/FindMySQL.cmake \
      --replace /usr/include/mysql ${lib.getDev libmysqlclient}/include/mariadb \
--- a/pkgs/servers/xandikos/default.nix
+++ b/pkgs/servers/xandikos/default.nix
@ -6,34 +6,37 @@

 python3Packages.buildPythonApplication rec {
  pname = "xandikos";
-  version = "0.2.8";
+  version = "0.2.10";
+  format = "pyproject";
+
+  disabled = python3Packages.pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "jelmer";
    repo = "xandikos";
    rev = "v${version}";
-    sha256 = "sha256-KDDk0QSOjwivJFz3vLk+g4vZMlSuX2FiOgHJfDJkpwg=";
+    hash = "sha256-SqU/K3b8OML3PvFmP7L5R3Ub9vbW66xRpf79mgFZPfc=";
  };

+  nativeBuildInputs = with python3Packages; [
+    setuptools
+    wheel
+  ];
+
  propagatedBuildInputs = with python3Packages; [
    aiohttp
+    aiohttp-openmetrics
    dulwich
    defusedxml
    icalendar
    jinja2
    multidict
-    prometheus-client
+    vobject
  ];

  passthru.tests.xandikos = nixosTests.xandikos;

  nativeCheckInputs = with python3Packages; [ pytestCheckHook ];
-  disabledTests = [
-    # these tests are failing due to the following error:
-    # TypeError: expected str, bytes or os.PathLike object, not int
-    "test_iter_with_etag"
-    "test_iter_with_etag_missing_uid"
-  ];

  meta = with lib; {
    description = "Lightweight CalDAV/CardDAV server";
--- a/pkgs/tools/backup/discordchatexporter-cli/default.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/default.nix
@ -1,5 +1,6 @@
 { lib
 , buildDotnetModule
+, dotnetCorePackages
 , fetchFromGitHub
 , testers
 , discordchatexporter-cli
@ -7,17 +8,19 @@

 buildDotnetModule rec {
  pname = "discordchatexporter-cli";
-  version = "2.36.1";
+  version = "2.40.4";

  src = fetchFromGitHub {
    owner = "tyrrrz";
    repo = "discordchatexporter";
    rev = version;
-    sha256 = "svBVXny8ZsZnXG5cDPDKlR2dNhPzPOW4VGaOZkLrRNA=";
+    hash = "sha256-XmUTGVOU67fSX0mZg2f5j8pb6ID7amzJpD4F7u6f3GM=";
  };

  projectFile = "DiscordChatExporter.Cli/DiscordChatExporter.Cli.csproj";
  nugetDeps = ./deps.nix;
+  dotnet-sdk = dotnetCorePackages.sdk_7_0;
+  dotnet-runtime = dotnetCorePackages.runtime_7_0;

  postFixup = ''
    ln -s $out/bin/DiscordChatExporter.Cli $out/bin/discordchatexporter-cli
@ -36,7 +39,8 @@ buildDotnetModule rec {
    homepage = "https://github.com/Tyrrrz/DiscordChatExporter";
    license = licenses.gpl3Plus;
    changelog = "https://github.com/Tyrrrz/DiscordChatExporter/blob/${version}/Changelog.md";
-    maintainers = [ maintainers.ivar ];
+    maintainers = with maintainers; [ eclairevoyant ivar ];
    platforms = [ "x86_64-linux" ];
+    mainProgram = "discordchatexporter-cli";
  };
 }
--- a/pkgs/tools/backup/discordchatexporter-cli/deps.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/deps.nix
@ -3,14 +3,19 @@

 { fetchNuGet }: [
  (fetchNuGet { pname = "AdvancedStringBuilder"; version = "0.1.0"; sha256 = "1lpv5sggdxza0bmcqmzf5r4i340f0m7nr5073lac18naj5697q5g"; })
-  (fetchNuGet { pname = "CliFx"; version = "2.3.0"; sha256 = "0dxxd5hm7gnc1lhq7k266nkcl84w0844r3cdxdcksvcc786f43vp"; })
-  (fetchNuGet { pname = "DotnetRuntimeBootstrapper"; version = "2.3.1"; sha256 = "0zsicyizachdam64mjm1brh5a3nzf7j8nalyhwnw26wk3v3rgmc9"; })
-  (fetchNuGet { pname = "Gress"; version = "2.0.1"; sha256 = "00xhyfkrlc38nbl6aymr7zwxc3kj0rxvx5gwk6fkfrvi1pzgq0wc"; })
+  (fetchNuGet { pname = "AngleSharp"; version = "1.0.4"; sha256 = "1b4qd0z27fdkgy5l8fqcbpzwm29gmmjm2h0mqb9ac94rv6ynq510"; })
+  (fetchNuGet { pname = "AsyncKeyedLock"; version = "6.2.1"; sha256 = "0281mj9ppz6q454li6xyllb1hdfkl59bh3psbj4z6l9xjbhnjhz0"; })
+  (fetchNuGet { pname = "CliFx"; version = "2.3.4"; sha256 = "14nj8w3j0hbsr5cghj39jx2sh5cg3wsvl517dk8whva5kgy3q1mf"; })
+  (fetchNuGet { pname = "Deorcify"; version = "1.0.2"; sha256 = "0nwxyrl4rd5x621i2hs5fl3w7fxpm13lkdssxr9fd5042px2gqbm"; })
+  (fetchNuGet { pname = "DotnetRuntimeBootstrapper"; version = "2.5.1"; sha256 = "192795akjmdxvp8p52g256rg0nzriipfsr8j808h69j6himhp4d7"; })
+  (fetchNuGet { pname = "Gress"; version = "2.1.1"; sha256 = "1svz1flhyl26h3xjch0acjjinympgf6bhj5vpb188njfih3ip4ck"; })
  (fetchNuGet { pname = "JsonExtensions"; version = "1.2.0"; sha256 = "0g54hibabbqqfhxjlnxwv1rxagpali5agvnpymp2w3dk8h6q66xy"; })
-  (fetchNuGet { pname = "MiniRazor.CodeGen"; version = "2.2.2"; sha256 = "11mxv1p7ahjzpf3sgacfx6szv1xwwk33vpz1r6wb2nch5dx93vdx"; })
-  (fetchNuGet { pname = "MiniRazor.Runtime"; version = "2.2.2"; sha256 = "1bjnqx06gzc13kpbhyndzfrvwgmxi7j0nbaxm7cmb1g7zq06vzrb"; })
-  (fetchNuGet { pname = "Polly"; version = "7.2.3"; sha256 = "1iws4jd5iqj5nlfp16fg9p5vfqqas1si0cgh8xcj64y433a933cv"; })
-  (fetchNuGet { pname = "Spectre.Console"; version = "0.44.0"; sha256 = "0f4q52rmib0q3vg7ij6z73mnymyas7c7wrm8dfdhrkdzn53zwl6p"; })
+  (fetchNuGet { pname = "Polly"; version = "7.2.4"; sha256 = "0lvhi2a18p6ay780lbw18656297s9i45cvpp4dr9k5lhg7fwl2y1"; })
+  (fetchNuGet { pname = "RazorBlade"; version = "0.4.3"; sha256 = "1wnp7dd1ir9w1ipp424h4f3z832b6i1dx1cljyf1ry9lrb3i91is"; })
+  (fetchNuGet { pname = "Spectre.Console"; version = "0.47.0"; sha256 = "0gc9ana660an7d76w9qd8l62lv66dc69vr5lslr896b1313ywakp"; })
  (fetchNuGet { pname = "Superpower"; version = "3.0.0"; sha256 = "0p6riay4732j1fahc081dzgs9q4z3n2fpxrin4zfpj6q2226dhz4"; })
-  (fetchNuGet { pname = "WebMarkupMin.Core"; version = "2.12.0"; sha256 = "1v4dcrpz2icm73w1pfrcjanx0x4j1khi65pyf1xd712lfpm7gpyd"; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.5"; sha256 = "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h"; })
+  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "7.0.0"; sha256 = "0sn6hxdjm7bw3xgsmg041ccchsa4sp02aa27cislw3x61dbr68kq"; })
+  (fetchNuGet { pname = "WebMarkupMin.Core"; version = "2.14.0"; sha256 = "0c41zw1bwz6ybxagq5vr26cx7najd17rrdbqjpn8mabynq380ayr"; })
+  (fetchNuGet { pname = "YoutubeExplode"; version = "6.3.1"; sha256 = "1rkj7rjm8vl4lygfqbil5cgj271wvnhcdpcybb74m6mlf7w7dg1q"; })
 ]
--- a/pkgs/tools/misc/github-copilot-cli/default.nix
+++ b/pkgs/tools/misc/github-copilot-cli/default.nix
@ -20,7 +20,7 @@ buildNpmPackage rec {
  meta = with lib; {
    description = "A CLI experience for letting GitHub Copilot help you on the command line";
    homepage = "https://githubnext.com/projects/copilot-cli/";
-    license = licenses.free;
+    license = licenses.unfree; # upstream has no license
    maintainers = [ maintainers.malo ];
    platforms = platforms.all;
  };
--- a/pkgs/tools/misc/tgpt/default.nix
+++ b/pkgs/tools/misc/tgpt/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "tgpt";
-  version = "1.7.6";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "aandrew-me";
    repo = "tgpt";
    rev = "refs/tags/v${version}";
-    hash = "sha256-XPHWD9R6XdUU7gsI3rQ55DZx06Kaqgdkw08x+VsGc1g=";
+    hash = "sha256-fVDwKNj4XHMWP30f4ASKQ3m5stlQJ/6zOCwVhUfP39c=";
  };

  vendorHash = "sha256-2I5JJWxM6aZx0eZu7taUTL11Y/5HIrXYC5aezrTbbsM=";
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "exploitdb";
-  version = "2023-09-08";
+  version = "2023-09-09";

  src = fetchFromGitLab {
    owner = "exploit-database";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-5KH6B205WBJLyIAifWB7uA/LPy6dJC/xaryD6XsZCyc=";
+    hash = "sha256-AO8iuQZMipt7Va9FUmdT0wCcZhuKNU44jFL7MpVN3AM=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"

-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.32"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.33"
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@ -1,9 +1,9 @@
 GIT
  remote: https://github.com/rapid7/metasploit-framework
-  revision: d644909dcaa8814f9d8ef53d18bf7fa63d197897
-  ref: refs/tags/6.3.32
+  revision: 61956404cadf364417ec02b4cb7025b50a866565
+  ref: refs/tags/6.3.33
  specs:
-    metasploit-framework (6.3.32)
+    metasploit-framework (6.3.33)
      actionpack (~> 7.0)
      activerecord (~> 7.0)
      activesupport (~> 7.0)
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@ -15,13 +15,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "metasploit-framework";
-  version = "6.3.32";
+  version = "6.3.33";

  src = fetchFromGitHub {
    owner = "rapid7";
    repo = "metasploit-framework";
    rev = version;
-    sha256 = "sha256-3aiHBaYxrpe/KSF2LiafcANIgWvZEp1kgRXry3/uWvY=";
+    sha256 = "sha256-S/uazRDWK1AqLT2QTKiluRmcwy82PZitezQMw1Kb9no=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@ -654,12 +654,12 @@
    platforms = [];
    source = {
      fetchSubmodules = false;
-      rev = "d644909dcaa8814f9d8ef53d18bf7fa63d197897";
-      sha256 = "1xjsxrzwpsqmh5j9s4nrdf0lh0vhkwk2wxi156zrgbiilq2qga6x";
+      rev = "61956404cadf364417ec02b4cb7025b50a866565";
+      sha256 = "0ypnkd9c631lgfnrhg9n5z1rq6drlnl4r41x5lm50ayn236rmysb";
      type = "git";
      url = "https://github.com/rapid7/metasploit-framework";
    };
-    version = "6.3.32";
+    version = "6.3.33";
  };
  metasploit-model = {
    groups = ["default"];
--- a/pkgs/tools/security/sn0int/default.nix
+++ b/pkgs/tools/security/sn0int/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "sn0int";
-  version = "0.25.0";
+  version = "0.26.0";

  src = fetchFromGitHub {
    owner = "kpcyrd";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-+LplLeczLS+9EG0tZsiEs162/65zMCZfDDEq0iYQrGY=";
+    hash = "sha256-ze4OFKUuc/t6tXgmoWFFDjpAQraSY6RIekkcDBctPJo=";
  };

-  cargoHash = "sha256-FpoRO2g+R+Fo146kM0W8b1LHTEBHbGXURoX5jJk7lqY=";
+  cargoHash = "sha256-PAKmoifqB1YC02fVF2SRbXAAGrMcB+Wlvr3FwuqmPVU=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/tools/security/steamguard-cli/default.nix
+++ b/pkgs/tools/security/steamguard-cli/default.nix
@ -0,0 +1,28 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "steamguard-cli";
+  version = "0.12.0";
+
+  src = fetchFromGitHub {
+    owner = "dyc3";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-WCEMZTi9/EI8JaUM5w2xJkx0x3DoaByORgVqw1TPcgI=";
+  };
+
+  cargoHash = "sha256-FVjL0tFndJNsL5oZSSqBvMtCEPqzf5xZGd8NaV5nmr4=";
+
+  meta = with lib; {
+    changelog = "https://github.com/dyc3/steamguard-cli/releases/tag/v${version}";
+    description = "A linux utility for generating 2FA codes for Steam and managing Steam trade confirmations.";
+    homepage = "https://github.com/dyc3/steamguard-cli";
+    license = with licenses; [ gpl3Only ];
+    mainProgram = "steamguard";
+    maintainers = with maintainers; [ surfaceflinger ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "trufflehog";
-  version = "3.54.3";
+  version = "3.54.4";

  src = fetchFromGitHub {
    owner = "trufflesecurity";
    repo = "trufflehog";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nd0Qog4bwtAlXtDIXdE/mTSEBbBBUWT4FJkyl32PCVI=";
+    hash = "sha256-VWFGM4kRPrcdRwrzKrlbHl+eCpvnpYB2MD1ziPYJwjA=";
  };

  vendorHash = "sha256-zYvKhhwN5TtJQxkkcY5U9LtTdMb97ucfksxpTMKH/Zc=";
--- a/pkgs/tools/video/svt-av1/default.nix
+++ b/pkgs/tools/video/svt-av1/default.nix
@ -43,7 +43,5 @@ stdenv.mkDerivation (finalAttrs: {
    license = with licenses; [ aom bsd3 ];
    maintainers = with maintainers; [ Madouura ];
    platforms = platforms.unix;
-    # error: use of undeclared identifier 'kCVPixelFormatType_444YpCbCr16BiPlanarVideoRange'
-    broken = stdenv.isAarch64 && stdenv.isDarwin;
  };
 })
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -38586,6 +38586,8 @@ with pkgs;

  steamback = python311.pkgs.callPackage ../tools/games/steamback { };

+  steamguard-cli = callPackage ../tools/security/steamguard-cli { };
+
  protontricks = python3Packages.callPackage ../tools/package-management/protontricks {
    inherit winetricks steam-run yad;
  };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1901,6 +1901,8 @@ self: super: with self; {

  check-manifest = callPackage ../development/python-modules/check-manifest { };

+  checkdmarc = callPackage ../development/python-modules/checkdmarc { };
+
  cheetah3 = callPackage ../development/python-modules/cheetah3 { };

  cheroot = callPackage ../development/python-modules/cheroot { };
@ -6124,6 +6126,8 @@ self: super: with self; {
    inherit (self) python libxml2;
  })).py;

+  liccheck = callPackage ../development/python-modules/liccheck { };
+
  license-expression = callPackage ../development/python-modules/license-expression { };

  lief = (toPythonModule (pkgs.lief.override {
@ -8688,6 +8692,8 @@ self: super: with self; {

  pulp = callPackage ../development/python-modules/pulp { };

+  pulsectl-asyncio = callPackage ../development/python-modules/pulsectl-asyncio { };
+
  pulsectl = callPackage ../development/python-modules/pulsectl { };

  pure-cdb = callPackage ../development/python-modules/pure-cdb { };
@ -9356,6 +9362,8 @@ self: super: with self; {

  pyld = callPackage ../development/python-modules/pyld { };

+  pyleri = callPackage ../development/python-modules/pyleri { };
+
  pylev = callPackage ../development/python-modules/pylev { };

  pylgnetcast = callPackage ../development/python-modules/pylgnetcast { };