Merge master into haskell-updates

2024-09-20 12:08:17 +03:00 · 2023-12-10 00:14:06 +00:00 · 2023-12-10 00:14:06 +00:00 · 35e9f7d4e6
commit 35e9f7d4e6
parent cc3d0ae21e 404c1902f2
170 changed files with 6199 additions and 4601 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -6738,6 +6738,8 @@
  };
  gm6k = {
    email = "nix@quidecco.pl";
+    github = "zeuner";
+    githubId = 2545850;
    name = "Isidor Zeuner";
  };
  gmemstr = {
@ -14668,6 +14670,11 @@
    githubId = 146413;
    name = "Tobias Poschwatta";
  };
+  poweredbypie = {
+    name = "poweredbypie";
+    github = "poweredbypie";
+    githubId = 67135060;
+  };
  PowerUser64 = {
    email = "blakelysnorth@gmail.com";
    github = "PowerUser64";
@ -16283,6 +16290,11 @@
    githubId = 5104601;
    name = "schnusch";
  };
+  Schweber = {
+    github = "Schweber";
+    githubId = 64630479;
+    name = "Schweber";
+  };
  sciencentistguy = {
    email = "jamie@quigley.xyz";
    name = "Jamie Quigley";
@ -18536,6 +18548,8 @@
  };
  tomkoid = {
    email = "tomaszierl@outlook.com";
+    github = "Tomkoid";
+    githubId = 67477750;
    name = "Tomkoid";
  };
  tomodachi94 = {
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -429,6 +429,7 @@ with lib.maintainers; {
      cleeyv
      ryantm
      lassulus
+      yayayayaka
    ];
    scope = "Maintain Jitsi.";
    shortName = "Jitsi";
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -971,6 +971,7 @@
  ./services/networking/iwd.nix
  ./services/networking/jibri/default.nix
  ./services/networking/jicofo.nix
+  ./services/networking/jigasi.nix
  ./services/networking/jitsi-videobridge.nix
  ./services/networking/jool.nix
  ./services/networking/kea.nix
--- a/nixos/modules/services/misc/tandoor-recipes.nix
+++ b/nixos/modules/services/misc/tandoor-recipes.nix
@ -12,7 +12,7 @@ let
    DEBUG_TOOLBAR = "0";
    MEDIA_ROOT = "/var/lib/tandoor-recipes";
  } // optionalAttrs (config.time.timeZone != null) {
-    TIMEZONE = config.time.timeZone;
+    TZ = config.time.timeZone;
  } // (
    lib.mapAttrs (_: toString) cfg.extraConfig
  );
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@ -74,7 +74,7 @@ let
    fi
  '';
  provisionConfDir = pkgs.runCommand "grafana-provisioning" { nativeBuildInputs = [ pkgs.xorg.lndir ]; } ''
-    mkdir -p $out/{datasources,dashboards,notifiers,alerting}
+    mkdir -p $out/{alerting,datasources,dashboards,notifiers,plugins}
    ${ln { src = datasourceFileOrDir;    dir = "datasources"; filename = "datasource"; }}
    ${ln { src = dashboardFileOrDir;     dir = "dashboards";  filename = "dashboard"; }}
    ${ln { src = notifierFileOrDir;      dir = "notifiers";   filename = "notifier"; }}
@ -1831,7 +1831,7 @@ in
        set -o errexit -o pipefail -o nounset -o errtrace
        shopt -s inherit_errexit

-        exec ${cfg.package}/bin/grafana-server -homepath ${cfg.dataDir} -config ${configFile}
+        exec ${cfg.package}/bin/grafana server -homepath ${cfg.dataDir} -config ${configFile}
      '';
      serviceConfig = {
        WorkingDirectory = cfg.dataDir;
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@ -198,6 +198,7 @@ in {
        }
      ];

+    services.netdata.configDir.".opt-out-from-anonymous-statistics" = mkIf (!cfg.enableAnalyticsReporting) (pkgs.writeText ".opt-out-from-anonymous-statistics" "");
    environment.etc."netdata/netdata.conf".source = configFile;
    environment.etc."netdata/conf.d".source = configDirectory;

--- a/nixos/modules/services/networking/jigasi.nix
+++ b/nixos/modules/services/networking/jigasi.nix
@ -0,0 +1,237 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.jigasi;
+  homeDirName = "jigasi-home";
+  stateDir = "/tmp";
+  sipCommunicatorPropertiesFile = "${stateDir}/${homeDirName}/sip-communicator.properties";
+  sipCommunicatorPropertiesFileUnsubstituted = "${pkgs.jigasi}/etc/jitsi/jigasi/sip-communicator.properties";
+in
+{
+  options.services.jigasi = with types; {
+    enable = mkEnableOption "Jitsi Gateway to SIP - component of Jitsi Meet";
+
+    xmppHost = mkOption {
+      type = str;
+      example = "localhost";
+      description = ''
+        Hostname of the XMPP server to connect to.
+      '';
+    };
+
+    xmppDomain = mkOption {
+      type = nullOr str;
+      example = "meet.example.org";
+      description = ''
+        Domain name of the XMMP server to which to connect as a component.
+
+        If null, <option>xmppHost</option> is used.
+      '';
+    };
+
+    componentPasswordFile = mkOption {
+      type = str;
+      example = "/run/keys/jigasi-component";
+      description = ''
+        Path to file containing component secret.
+      '';
+    };
+
+    userName = mkOption {
+      type = str;
+      default = "callcontrol";
+      description = ''
+        User part of the JID for XMPP user connection.
+      '';
+    };
+
+    userDomain = mkOption {
+      type = str;
+      example = "internal.meet.example.org";
+      description = ''
+        Domain part of the JID for XMPP user connection.
+      '';
+    };
+
+    userPasswordFile = mkOption {
+      type = str;
+      example = "/run/keys/jigasi-user";
+      description = ''
+        Path to file containing password for XMPP user connection.
+      '';
+    };
+
+    bridgeMuc = mkOption {
+      type = str;
+      example = "jigasibrewery@internal.meet.example.org";
+      description = ''
+        JID of the internal MUC used to communicate with Videobridges.
+      '';
+    };
+
+    defaultJvbRoomName = mkOption {
+      type = str;
+      default = "";
+      example = "siptest";
+      description = ''
+        Name of the default JVB room that will be joined if no special header is included in SIP invite.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        File containing environment variables to be passed to the jigasi service,
+        in which secret tokens can be specified securely by defining values for
+        <literal>JIGASI_SIPUSER</literal>,
+        <literal>JIGASI_SIPPWD</literal>,
+        <literal>JIGASI_SIPSERVER</literal> and
+        <literal>JIGASI_SIPPORT</literal>.
+      '';
+    };
+
+    config = mkOption {
+      type = attrsOf str;
+      default = { };
+      example = literalExample ''
+        {
+          "org.jitsi.jigasi.auth.URL" = "XMPP:jitsi-meet.example.com";
+        }
+      '';
+      description = ''
+        Contents of the <filename>sip-communicator.properties</filename> configuration file for jigasi.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.jicofo.config = {
+      "org.jitsi.jicofo.jigasi.BREWERY" = "${cfg.bridgeMuc}";
+    };
+
+    services.jigasi.config = mapAttrs (_: v: mkDefault v) {
+      "org.jitsi.jigasi.BRIDGE_MUC" = cfg.bridgeMuc;
+    };
+
+    users.groups.jitsi-meet = {};
+
+    systemd.services.jigasi = let
+      jigasiProps = {
+        "-Dnet.java.sip.communicator.SC_HOME_DIR_LOCATION" = "${stateDir}";
+        "-Dnet.java.sip.communicator.SC_HOME_DIR_NAME" = "${homeDirName}";
+        "-Djava.util.logging.config.file" = "${pkgs.jigasi}/etc/jitsi/jigasi/logging.properties";
+      };
+    in
+    {
+      description = "Jitsi Gateway to SIP";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      preStart = ''
+        [ -f "${sipCommunicatorPropertiesFile}" ] && rm -f "${sipCommunicatorPropertiesFile}"
+        mkdir -p "$(dirname ${sipCommunicatorPropertiesFile})"
+        temp="${sipCommunicatorPropertiesFile}.unsubstituted"
+
+        export DOMAIN_BASE="${cfg.xmppDomain}"
+        export JIGASI_XMPP_PASSWORD=$(cat "${cfg.userPasswordFile}")
+        export JIGASI_DEFAULT_JVB_ROOM_NAME="${cfg.defaultJvbRoomName}"
+
+        # encode the credentials to base64
+        export JIGASI_SIPPWD=$(echo -n "$JIGASI_SIPPWD" | base64 -w 0)
+        export JIGASI_XMPP_PASSWORD_BASE64=$(cat "${cfg.userPasswordFile}" | base64 -w 0)
+
+        cp "${sipCommunicatorPropertiesFileUnsubstituted}" "$temp"
+        chmod 644 "$temp"
+        cat <<EOF >>"$temp"
+        net.java.sip.communicator.impl.protocol.sip.acc1403273890647.SERVER_PORT=$JIGASI_SIPPORT
+        net.java.sip.communicator.impl.protocol.sip.acc1403273890647.PREFERRED_TRANSPORT=udp
+        EOF
+        chmod 444 "$temp"
+
+        # Replace <<$VAR_NAME>> from example config to $VAR_NAME for environment substitution
+        sed -i -E \
+          's/<<([^>]+)>>/\$\1/g' \
+          "$temp"
+
+        sed -i \
+          's|\(net\.java\.sip\.communicator\.impl\.protocol\.jabber\.acc-xmpp-1\.PASSWORD=\).*|\1\$JIGASI_XMPP_PASSWORD_BASE64|g' \
+          "$temp"
+
+        sed -i \
+          's|\(#\)\(org.jitsi.jigasi.DEFAULT_JVB_ROOM_NAME=\).*|\2\$JIGASI_DEFAULT_JVB_ROOM_NAME|g' \
+          "$temp"
+
+        ${pkgs.envsubst}/bin/envsubst \
+          -o "${sipCommunicatorPropertiesFile}" \
+          -i "$temp"
+
+        # Set the brewery room name
+        sed -i \
+          's|\(net\.java\.sip\.communicator\.impl\.protocol\.jabber\.acc-xmpp-1\.BREWERY=\).*|\1${cfg.bridgeMuc}|g' \
+          "${sipCommunicatorPropertiesFile}"
+        sed -i \
+          's|\(org\.jitsi\.jigasi\.ALLOWED_JID=\).*|\1${cfg.bridgeMuc}|g' \
+          "${sipCommunicatorPropertiesFile}"
+
+
+        # Disable certificate verification for self-signed certificates
+        sed -i \
+          's|\(# \)\(net.java.sip.communicator.service.gui.ALWAYS_TRUST_MODE_ENABLED=true\)|\2|g' \
+          "${sipCommunicatorPropertiesFile}"
+      '';
+
+      restartTriggers = [
+        config.environment.etc."jitsi/jigasi/sip-communicator.properties".source
+      ];
+      environment.JAVA_SYS_PROPS = concatStringsSep " " (mapAttrsToList (k: v: "${k}=${toString v}") jigasiProps);
+
+      script = ''
+        ${pkgs.jigasi}/bin/jigasi \
+          --host="${cfg.xmppHost}" \
+          --domain="${if cfg.xmppDomain == null then cfg.xmppHost else cfg.xmppDomain}" \
+          --secret="$(cat ${cfg.componentPasswordFile})" \
+          --user_name="${cfg.userName}" \
+          --user_domain="${cfg.userDomain}" \
+          --user_password="$(cat ${cfg.userPasswordFile})" \
+          --configdir="${stateDir}" \
+          --configdirname="${homeDirName}"
+      '';
+
+      serviceConfig = {
+        Type = "exec";
+
+        DynamicUser = true;
+        User = "jigasi";
+        Group = "jitsi-meet";
+
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHostname = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        StateDirectory = baseNameOf stateDir;
+        EnvironmentFile = cfg.environmentFile;
+      };
+    };
+
+    environment.etc."jitsi/jigasi/sip-communicator.properties".source =
+      mkDefault "${sipCommunicatorPropertiesFile}";
+    environment.etc."jitsi/jigasi/logging.properties".source =
+      mkDefault "${stateDir}/logging.properties-journal";
+  };
+
+  meta.maintainers = lib.teams.jitsi.members;
+}
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@ -35,6 +35,7 @@ let
      domain = cfg.hostName;
      muc = "conference.${cfg.hostName}";
      focus = "focus.${cfg.hostName}";
+      jigasi = "jigasi.${cfg.hostName}";
    };
    bosh = "//${cfg.hostName}/http-bind";
    websocket = "wss://${cfg.hostName}/xmpp-websocket";
@ -145,6 +146,16 @@ in
      '';
    };

+    jigasi.enable = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to enable jigasi instance and configure it to connect to Prosody.
+
+        Additional configuration is possible with <option>services.jigasi</option>.
+      '';
+    };
+
    nginx.enable = mkOption {
      type = bool;
      default = true;
@ -224,7 +235,7 @@ in
          roomDefaultPublicJids = true;
          extraConfig = ''
            storage = "memory"
-            admins = { "focus@auth.${cfg.hostName}", "jvb@auth.${cfg.hostName}" }
+            admins = { "focus@auth.${cfg.hostName}", "jvb@auth.${cfg.hostName}", "jigasi@auth.${cfg.hostName}" }
          '';
          #-- muc_room_cache_size = 1000
        }
@ -263,6 +274,9 @@ in
          Component "focus.${cfg.hostName}" "client_proxy"
            target_address = "focus@auth.${cfg.hostName}"

+          Component "jigasi.${cfg.hostName}" "client_proxy"
+            target_address = "jigasi@auth.${cfg.hostName}"
+
          Component "speakerstats.${cfg.hostName}" "speakerstats_component"
            muc_component = "conference.${cfg.hostName}"

@ -356,7 +370,10 @@ in
        ${config.services.prosody.package}/bin/prosodyctl mod_roster_command subscribe focus.${cfg.hostName} focus@auth.${cfg.hostName}
        ${config.services.prosody.package}/bin/prosodyctl register jibri auth.${cfg.hostName} "$(cat /var/lib/jitsi-meet/jibri-auth-secret)"
        ${config.services.prosody.package}/bin/prosodyctl register recorder recorder.${cfg.hostName} "$(cat /var/lib/jitsi-meet/jibri-recorder-secret)"
+      '' + optionalString cfg.jigasi.enable ''
+        ${config.services.prosody.package}/bin/prosodyctl register jigasi auth.${cfg.hostName} "$(cat /var/lib/jitsi-meet/jigasi-user-secret)"
      '';
+
      serviceConfig = {
        EnvironmentFile = [ "/var/lib/jitsi-meet/secrets-env" ];
        SupplementaryGroups = [ "jitsi-meet" ];
@ -371,13 +388,13 @@ in

    systemd.services.jitsi-meet-init-secrets = {
      wantedBy = [ "multi-user.target" ];
-      before = [ "jicofo.service" "jitsi-videobridge2.service" ] ++ (optional cfg.prosody.enable "prosody.service");
+      before = [ "jicofo.service" "jitsi-videobridge2.service" ] ++ (optional cfg.prosody.enable "prosody.service") ++ (optional cfg.jigasi.enable "jigasi.service");
      serviceConfig = {
        Type = "oneshot";
      };

      script = let
-        secrets = [ "jicofo-component-secret" "jicofo-user-secret" "jibri-auth-secret" "jibri-recorder-secret" ] ++ (optional (cfg.videobridge.passwordFile == null) "videobridge-secret");
+        secrets = [ "jicofo-component-secret" "jicofo-user-secret" "jibri-auth-secret" "jibri-recorder-secret" ] ++ (optionals cfg.jigasi.enable [ "jigasi-user-secret" "jigasi-component-secret" ]) ++ (optional (cfg.videobridge.passwordFile == null) "videobridge-secret");
      in
      ''
        cd /var/lib/jitsi-meet
@ -391,6 +408,7 @@ in

        # for easy access in prosody
        echo "JICOFO_COMPONENT_SECRET=$(cat jicofo-component-secret)" > secrets-env
+        echo "JIGASI_COMPONENT_SECRET=$(cat jigasi-component-secret)" >> secrets-env
        chown root:jitsi-meet secrets-env
        chmod 640 secrets-env
      ''
@ -592,6 +610,20 @@ in
        stripFromRoomDomain = "conference.";
      };
    };
+
+    services.jigasi = mkIf cfg.jigasi.enable {
+      enable = true;
+      xmppHost = "localhost";
+      xmppDomain = cfg.hostName;
+      userDomain = "auth.${cfg.hostName}";
+      userName = "jigasi";
+      userPasswordFile = "/var/lib/jitsi-meet/jigasi-user-secret";
+      componentPasswordFile = "/var/lib/jitsi-meet/jigasi-component-secret";
+      bridgeMuc = "jigasibrewery@internal.${cfg.hostName}";
+      config = {
+        "org.jitsi.jigasi.ALWAYS_TRUST_MODE_ENABLED" = "true";
+      };
+    };
  };

  meta.doc = ./jitsi-meet.md;
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -61,7 +61,9 @@ let
  pgsqlLocal = cfg.database.createLocally && cfg.config.dbtype == "pgsql";

  # https://github.com/nextcloud/documentation/pull/11179
-  ocmProviderIsNotAStaticDirAnymore = versionAtLeast cfg.package.version "27.1.2";
+  ocmProviderIsNotAStaticDirAnymore = versionAtLeast cfg.package.version "27.1.2"
+    || (versionOlder cfg.package.version "27.0.0"
+      && versionAtLeast cfg.package.version "26.0.8");

 in {

--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@ -27,7 +27,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
  in {
    name = "mongodb";
    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bluescreen303 offline rvl phile314 ];
+      maintainers = [ bluescreen303 offline phile314 ];
    };

    nodes = {
--- a/nixos/tests/mysql/mysql-backup.nix
+++ b/nixos/tests/mysql/mysql-backup.nix
@ -15,9 +15,6 @@ let
    name ? mkTestName package
  }: makeTest {
    name = "${name}-backup";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ rvl ];
-    };

    nodes = {
      master = { pkgs, ... }: {
--- a/pkgs/applications/audio/ladspa-sdk/default.nix
+++ b/pkgs/applications/audio/ladspa-sdk/default.nix
@ -14,6 +14,8 @@ stdenv.mkDerivation rec {

  patchPhase = ''
    sed -i 's@/usr/@$(out)/@g'  Makefile
+    substituteInPlace Makefile \
+      --replace /tmp/test.wav $NIX_BUILD_TOP/${sourceRoot}/test.wav
  '';

  makeFlags = [
--- a/pkgs/applications/audio/sonata/default.nix
+++ b/pkgs/applications/audio/sonata/default.nix
@ -72,6 +72,5 @@ in buildPythonApplication rec {
    homepage = "https://www.nongnu.org/sonata/";
    license = lib.licenses.gpl3;
    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.rvl ];
  };
 }
--- a/pkgs/applications/audio/vgmstream/default.nix
+++ b/pkgs/applications/audio/vgmstream/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "vgmstream";
-  version = "1879";
+  version = "1896";

  src = fetchFromGitHub {
    owner = "vgmstream";
    repo = "vgmstream";
    rev = "refs/tags/r${version}";
-    sha256 = "sha256-m7M9oIEym/jzuw2HAbjdF6fZsfTew1KK0g1D4SePiiE=";
+    sha256 = "sha256-1BWJgV631MxxzdUtK8f+XRb9cqfhjlwN2LgWI0VmIHE=";
  };

  passthru.updateScript = nix-update-script {
--- a/pkgs/applications/blockchains/oxen/default.nix
+++ b/pkgs/applications/blockchains/oxen/default.nix
@ -1,67 +0,0 @@
-{ stdenv, lib, fetchurl, fetchFromGitHub, cmake, pkg-config
-, boost, openssl, unbound
-, pcsclite, readline, libsodium, hidapi
-, rapidjson
-, curl, sqlite
-, trezorSupport ? true
-, libusb1
-, protobuf
-, python3
-}:
-
-stdenv.mkDerivation rec {
-  pname = "oxen";
-  version = "9.1.3";
-
-  src = fetchFromGitHub {
-    owner = "oxen-io";
-    repo = "oxen-core";
-    rev = "v${version}";
-    sha256 = "11g3wqn0syk47yfcsdql5737kpad8skwdxhifn2yaz9zy8n3xqqb";
-    fetchSubmodules = true;
-  };
-
-  # Required for static linking, the only supported install path
-  lbzmqsrc = fetchurl {
-    url = "https://github.com/zeromq/libzmq/releases/download/v4.3.3/zeromq-4.3.3.tar.gz";
-    hash = "sha512-TBjXhAhRecWx/LdTqTgTCVoSyNNJcPLhv8pkmb5snWd2nHHGi3ylT/GBsgOQBDFw6Jczwi92/x6kZJSBT3CVsQ==";
-  };
-
-  postPatch = ''
-    # remove vendored libraries
-    rm -r external/rapidjson
-    sed -i s,/lib/,/lib64/, external/loki-mq/cmake/local-libzmq//LocalLibzmq.cmake
-  '';
-
-  postInstall = ''
-    rm -R $out/lib $out/include
-  '';
-
-  nativeBuildInputs = [ cmake pkg-config ];
-
-  buildInputs = [
-    boost openssl unbound
-    pcsclite readline
-    libsodium hidapi rapidjson
-    protobuf curl sqlite
-  ] ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ];
-
-  cmakeFlags = [
-    # "-DUSE_DEVICE_TREZOR=ON"
-    # "-DBUILD_GUI_DEPS=ON"
-    "-DReadline_ROOT_DIR=${readline.dev}"
-    # It build with shared libs but doesn't install them. Fail.
-    # "-DBUILD_SHARED_LIBS=ON"
-    "-DLIBZMQ_TARBALL_URL=${lbzmqsrc}"
-  ] ++ lib.optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF";
-
-  meta = with lib; {
-    description = "Private cryptocurrency based on Monero";
-    homepage = "https://oxen.io/";
-    license = licenses.bsd3;
-    platforms = platforms.all;
-    maintainers = [ maintainers.viric ];
-    # Fails to build on gcc-10 due to boost being built with gcc-12.
-    broken = true;
-  };
-}
--- a/pkgs/applications/editors/setzer/default.nix
+++ b/pkgs/applications/editors/setzer/default.nix
@ -20,13 +20,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "setzer";
-  version = "62";
+  version = "63";

  src = fetchFromGitHub {
    owner = "cvfosammmm";
    repo = "Setzer";
    rev = "v${version}";
-    hash = "sha256-CynYWzFnsr5FoNwBlK4k8c+EE22NP0OrpEFrSiEtxUU=";
+    hash = "sha256-/DAd3Neypx/H9mPVC9VkvpdQhLRNIBoR8GXxuIdJF0Y=";
  };

  format = "other";
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "texstudio";
-  version = "4.6.3";
+  version = "4.7.1";

  src = fetchFromGitHub {
    owner = "texstudio-org";
    repo = "texstudio";
    rev = finalAttrs.version;
-    hash = "sha256-L8N7T7FFfjT801HxbQiiC0ewW7vde4S0RVmNT2CWiWY=";
+    hash = "sha256-Qpt1CiQ+vG7uT8rpuWgYdjug2iigXQDKHIhrquSny6I=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2749,8 +2749,8 @@ let
          publisher = "nvarner";
          # Please update the corresponding binary (typst-lsp) when updating
          # this extension.
-          version = "0.11.0";
-          sha256 = "sha256-fs+CBg3FwzTn608dm9EvfF2UrI2Sa5hsm0OK/WQyy6o=";
+          version = "0.12.0";
+          sha256 = "sha256-5DwpgDstKJXo9jEWORXKr3B6Hnd/YOktiaJL2RFWCSA=";
        };

        nativeBuildInputs = [ jq moreutils ];
@ -3557,8 +3557,8 @@ let
        mktplcRef = {
          name = "uiua-vscode";
          publisher = "uiua-lang";
-          version = "0.0.25";
-          sha256 = "sha256-qM+CLV8jWYkJWXZyELnR1H9pSWFifAOGqH+LgHr7nNA=";
+          version = "0.0.26";
+          sha256 = "sha256-EKWThidMgbd+a4Vw4SQo988ggVbCTnCakohvq3/mZQ0=";
        };
        meta = {
          description = "VSCode language extension for Uiua";
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1h2s90h1a4b4r9rqafd5fj95mx21xqlp3msv8fxfjd2kkfl8bdcl";
-    x86_64-darwin = "1cprq4cy01cmyqrvv5p9f09k7h5p4nj9jbk4lrlnyj1z2xvhcls1";
-    aarch64-linux = "0g9j14vnan10r014309s6mdkizjfpbd83bf1kxx2kk625n87xszc";
-    aarch64-darwin = "10rw2dy3khpxa292zygxi67amxd6s351ha8nxvav5m9xfxlgd2qn";
-    armv7l-linux = "0bw0hfhvwv7wbh2daxgxaxm34v5z5ak4nmmk45ksxc4xsmjc5v23";
+    x86_64-linux = "0153vsb62r3g3cck70n05wkxxkh9w53zhnra7hzfy4m19v8xinzm";
+    x86_64-darwin = "1xqf0s05ns1yqd6qz4633c5xgb0l0nm2n1kfvxv7wqhgf94x80fm";
+    aarch64-linux = "1hfg01w9k60lf30chvj7mrjb1m3p5czv42cf7zj97j5pkhpg2lmi";
+    aarch64-darwin = "0vzayy1akh9hzs32cyxvvfnsbg9601jrs7bsvql3728dy9wkc8w2";
+    armv7l-linux = "0cc9b47dziqizcs37yci48ymyg176lwsyh7w7b9imh1s658vgikv";
  }.${system} or throwSystem;

  sourceRoot = lib.optionalString (!stdenv.isDarwin) ".";
@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.84.2.23317";
+    version = "1.84.2.23319";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/graphics/openboard/default.nix
+++ b/pkgs/applications/graphics/openboard/default.nix
@ -1,10 +1,10 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, copyDesktopItems, makeDesktopItem, qmake
+{ stdenv, lib, fetchFromGitHub, copyDesktopItems, makeDesktopItem, qmake
 , qtbase, qtxmlpatterns, qttools, qtwebengine, libGL, fontconfig, openssl, poppler, wrapQtAppsHook
 , ffmpeg, libva, alsa-lib, SDL, x264, libvpx, libvorbis, libtheora, libogg
 , libopus, lame, fdk_aac, libass, quazip, libXext, libXfixes }:

 let
-  importer = stdenv.mkDerivation rec {
+  importer = stdenv.mkDerivation {
    pname = "openboard-importer";
    version = "unstable-2016-10-08";

@ -23,15 +23,15 @@ let
      install -Dm755 OpenBoardImporter $out/bin/OpenBoardImporter
    '';
  };
-in stdenv.mkDerivation {
+in stdenv.mkDerivation (finalAttrs: {
  pname = "openboard";
-  version = "unstable-2022-11-28";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "OpenBoard-org";
    repo = "OpenBoard";
-    rev = "9de37af2df1a7c0d88f71c94ab2db1815d082862";
-    sha256 = "sha256-TiKrSyxtF1g1bepCoFxoxGOdREXhsMrS3g8uZKSiugg=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-OSAogtZoMisyRziv63ag9w8HQaaRdz0J28jQZR7cTMM=";
  };

  postPatch = ''
@ -115,4 +115,4 @@ in stdenv.mkDerivation {
    maintainers = with maintainers; [ fufexan ];
    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/applications/misc/girara/default.nix
+++ b/pkgs/applications/misc/girara/default.nix
@ -18,7 +18,7 @@

 stdenv.mkDerivation rec {
  pname = "girara";
-  version = "0.4.0";
+  version = "0.4.1";

  outputs = [ "out" "dev" ];

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "pwmt";
    repo = "girara";
    rev = version;
-    sha256 = "sha256-dzWdiFGJ45JcH+wNwq2P3NZeWwHXAvXR1eJC85mYy7M=";
+    sha256 = "sha256-47ff7NBunVvYlCEQN/LwTRG33aButisVvdwxlh28LUM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.120.4";
+  version = "0.121.1";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-eBDlX+3Gb4bWRJ0ITwlx1c3q1RCFK2tyuKn9SALHbhI=";
+    hash = "sha256-XNOp0k2t5Tv4HKKz3ZqL/sAdiYedOACaZ/1T7t7/Q1A=";
  };

-  vendorHash = "sha256-kUKnoUQzLbi0ssxvK2viNTHLtqx8vaHLYXO8ZWU2rmw=";
+  vendorHash = "sha256-J/me67pC+YWjGIQP6q1c+vsSXFxXoLZV7AyDv3+606k=";

  doCheck = false;

--- a/pkgs/applications/misc/lttoolbox/default.nix
+++ b/pkgs/applications/misc/lttoolbox/default.nix
@ -0,0 +1,65 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoconf
+, automake
+, pkg-config
+, utf8cpp
+, libtool
+, libxml2
+, icu
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lttoolbox";
+  version = "3.7.1";
+
+  src = fetchFromGitHub {
+    owner = "apertium";
+    repo = "lttoolbox";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3lHXKtwQSrMGQEGOGr27e3kB2qKkTFZcEzeAnIm89Rg=";
+  };
+
+  patches = [
+    # can be removed once the version goes past this commit
+    # https://github.com/apertium/lttoolbox/commit/e682fe18a96d5a865cfbd3e5661dbc7b3ace1821
+    (fetchpatch {
+      url = "https://github.com/apertium/lttoolbox/commit/e682fe18a96d5a865cfbd3e5661dbc7b3ace1821.patch";
+      hash = "sha256-VeP8Mv2KYxX+eVjIRw/jHbURaWN665+fiFaoT3VxAno=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    pkg-config
+    utf8cpp
+    libtool
+  ];
+  buildInputs = [
+    libxml2
+    icu
+  ];
+  buildFlags = [
+    "CPPFLAGS=-I${utf8cpp}/include/utf8cpp"
+  ];
+  configurePhase = ''
+    ./autogen.sh --prefix $out
+  '';
+  doCheck = true;
+  checkPhase = ''
+    ${python3}/bin/python3 tests/run_tests.py
+  '';
+
+  meta = with lib; {
+    description = "Finite state compiler, processor and helper tools used by apertium";
+    homepage = "https://github.com/apertium/lttoolbox";
+    maintainers = with maintainers; [ onthestairs ];
+    changelog = "https://github.com/apertium/lttoolbox/releases/tag/v${version}";
+    license = licenses.gpl2;
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
--- a/pkgs/applications/misc/mission-center/Cargo.lock
+++ b/pkgs/applications/misc/mission-center/Cargo.lock
--- a/pkgs/applications/misc/mission-center/default.nix
+++ b/pkgs/applications/misc/mission-center/default.nix
@ -16,8 +16,8 @@
 , blueprint-compiler
 , cairo
 , cmake
+, dbus
 , desktop-file-utils
-, dmidecode
 , gdk-pixbuf
 , gettext
 , glib
@ -31,25 +31,27 @@
 , sqlite
 , udev
 , wayland
+, dmidecode
+, vulkan-loader
 }:

 let
  nvtop = fetchFromGitHub {
    owner = "Syllo";
    repo = "nvtop";
-    rev = "be47f8c560487efc6e6a419d59c69bfbdb819324";
-    hash = "sha256-MdaZYLxCuVX4LvbwBYNfHHoJWqZAy4J8NBK7Guh2whc=";
+    rev = "45a1796375cd617d16167869bb88e5e69c809468";
+    hash = "sha256-1P9pWXhgTHogO0DztxOsFKNwvTRRfDL3nzGmMANMC9w=";
  };
 in
 stdenv.mkDerivation rec {
  pname = "mission-center";
-  version = "0.3.3";
+  version = "0.4.1";

  src = fetchFromGitLab {
    owner = "mission-center-devs";
    repo = "mission-center";
    rev = "v${version}";
-    hash = "sha256-xLyCLKUk21MvswtPUKm41Hr34vTzCMVQNTaAkuhSGLc=";
+    hash = "sha256-RENB5rD+DZrmE6awWRT9PGed2bJFDEAEqHh1tBjqWrY=";
  };

  cargoDeps = symlinkJoin {
@ -58,7 +60,7 @@ stdenv.mkDerivation rec {
      (rustPlatform.importCargoLock {
        lockFile = ./Cargo.lock;
        outputHashes = {
-          "pathfinder_canvas-0.5.0" = "sha256-k2Sj69hWA0UzRfv91aG1TAygVIuOX3gmipcDbuZxxc8=";
+          "pathfinder_canvas-0.5.0" = "sha256-qEp16TVggPtvFvDuUyWsS6rH6MeO6FW0K6BnACghaCg=";
        };
      })
      (rustPlatform.importCargoLock {
@ -86,8 +88,8 @@ stdenv.mkDerivation rec {
    blueprint-compiler
    cairo
    cmake
+    dbus
    desktop-file-utils
-    dmidecode
    gdk-pixbuf
    gettext
    glib
@ -104,14 +106,23 @@ stdenv.mkDerivation rec {
  ];

  postPatch = ''
-    substituteInPlace src/main.rs \
+    substituteInPlace src/sys_info_v2/gatherer.rs \
+      --replace '"missioncenter-gatherer"' '"${placeholder "out"}/bin/missioncenter-gatherer"'
+
+    substituteInPlace src/sys_info_v2/mem_info.rs \
+      --replace '"dmidecode"' '"${dmidecode}/bin/dmidecode"'
+
+    substituteInPlace $cargoDepsCopy/gl_loader-*/src/glad.c \
      --replace "libGL.so.1" "${libGL}/lib/libGL.so.1"

+    substituteInPlace $cargoDepsCopy/ash-*/src/entry.rs \
+      --replace '"libvulkan.so.1"' '"${vulkan-loader}/lib/libvulkan.so.1"'
+
    SRC_GATHERER=$NIX_BUILD_TOP/source/src/sys_info_v2/gatherer
    SRC_GATHERER_NVTOP=$SRC_GATHERER/3rdparty/nvtop

    substituteInPlace $SRC_GATHERER_NVTOP/nvtop.json \
-      --replace "nvtop-be47f8c560487efc6e6a419d59c69bfbdb819324" "nvtop-src"
+      --replace "nvtop-45a1796375cd617d16167869bb88e5e69c809468" "nvtop-src"

    GATHERER_BUILD_DEST=$NIX_BUILD_TOP/source/build/src/sys_info_v2/gatherer/src/debug/build/native
    mkdir -p $GATHERER_BUILD_DEST
@ -128,10 +139,6 @@ stdenv.mkDerivation rec {
    patchShebangs data/hwdb/generate_hwdb.py
  '';

-  postInstall = ''
-    wrapProgram $out/bin/missioncenter --prefix PATH : $out/bin:${dmidecode}/bin
-  '';
-
  meta = with lib; {
    description = "Monitor your CPU, Memory, Disk, Network and GPU usage";
    homepage = "https://gitlab.com/mission-center-devs/mission-center";
--- a/pkgs/applications/misc/mission-center/gatherer-Cargo.lock
+++ b/pkgs/applications/misc/mission-center/gatherer-Cargo.lock
--- a/pkgs/applications/misc/rtfm/default.nix
+++ b/pkgs/applications/misc/rtfm/default.nix
@ -18,14 +18,14 @@ let
 in
 crystal.buildCrystalPackage rec {
  pname = "rtfm";
-  version = "0.2.2";
+  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "hugopl";
    repo = "rtfm";
    rev = "v${version}";
    name = "rtfm";
-    hash = "sha256-SmQq3hG94oV346dHtqTHC0xE4cWB3rspD3XXu+mSI8Q=";
+    hash = "sha256-ulv5US5EBBb0rK/Qaw8ZpHI4QwEQGlzscmAoe17946k=";
  };

  patches = [
@ -54,7 +54,7 @@ crystal.buildCrystalPackage rec {
    wrapGAppsHook4
    gobject-introspection
    gi-crystal
-    ] ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
+  ] ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];

  buildInputs = [
    webkitgtk_6_0
--- a/pkgs/applications/misc/rtfm/patches/make.patch
+++ b/pkgs/applications/misc/rtfm/patches/make.patch
@ -1,5 +1,5 @@
--- a/Makefile	2023-07-17 17:18:28.000000000 +0300
-+++ b/Makefile	2023-07-19 12:13:44.627168135 +0300
+--- a/Makefile	2023-12-07 23:37:38.984501858 +0300
+++ b/Makefile	2023-12-07 23:47:52.884456064 +0300
@@ -4,8 +4,7 @@
 all: configure .WAIT rtfm docsets
 
@ -10,16 +10,7 @@
 
 rtfm:
 	shards build --release -s rtfm
-@@ -29,13 +28,15 @@
- 	install -D -m644 data/io.github.hugopl.rtfm.gschema.xml $(DESTDIR)$(PREFIX)/share/glib-2.0/schemas/io.github.hugopl.rtfm.gschema.xml
- 	# docsets
- 	mkdir -p $(DESTDIR)$(PREFIX)/share/rtfm/docsets/
-	cp -rv data/Crystal.docset $(DESTDIR)$(PREFIX)/share/rtfm/docsets/
-	cp -rv data/Gtk4.docset $(DESTDIR)$(PREFIX)/share/rtfm/docsets/
-+	cp -r data/Crystal.docset $(DESTDIR)$(PREFIX)/share/rtfm/docsets/
-+	cp -r data/Gtk4.docset $(DESTDIR)$(PREFIX)/share/rtfm/docsets/
- 	# License
- 	install -D -m0644 LICENSE $(DESTDIR)$(PREFIX)/share/licenses/rtfm/LICENSE
+@@ -36,6 +35,8 @@
 	# Changelog
 	install -D -m0644 CHANGELOG.md $(DESTDIR)$(PREFIX)/share/doc/rtfm/CHANGELOG.md
 	gzip -9fn $(DESTDIR)$(PREFIX)/share/doc/rtfm/CHANGELOG.md
@ -27,4 +18,4 @@
 +	glib-compile-schemas $(DESTDIR)$(PREFIX)/share/glib-2.0/schemas
 
 uninstall:
- 	rm -f $(DESTDIR)$(PREFIX)/bin/rtfm
+ 	rm -f $(DESTDIR)$(PREFIX)/bin/rtfm
--- a/pkgs/applications/misc/rtfm/shards.nix
+++ b/pkgs/applications/misc/rtfm/shards.nix
@ -11,13 +11,13 @@
  };
  gio = {
    url = "https://github.com/hugopl/gio.cr.git";
-    rev = "v0.1.0";
-    sha256 = "0vj35bi64d4hni18nrl8fmms306a0gl4zlxpf3aq08lh0sbwzhd8";
+    rev = "v0.2.1";
+    sha256 = "0vl5lpvhhdi9pvyl12smag0i3dwj1jjz1zzilc8ai0wjrnbnwlxs";
  };
  gtk4 = {
    url = "https://github.com/hugopl/gtk4.cr.git";
-    rev = "v0.15.0";
-    sha256 = "100j5k4sfc2dpj3nplzjcaxw1bwy3hsy5cw93asg00kda9h8dbb1";
+    rev = "v0.16.0";
+    sha256 = "1bnnfy07246vwbjfwhziv2yw1g52pzhhrr25660fp3qcnw8q513w";
  };
  harfbuzz = {
    url = "https://github.com/hugopl/harfbuzz.cr.git";
@ -26,13 +26,13 @@
  };
  libadwaita = {
    url = "https://github.com/geopjr/libadwaita.cr.git";
-    rev = "23ce21d6400af7563ede0b53deea6d1f77436985";
-    sha256 = "09jz6r0yp4qsm47qcknzgkjxavr5j3dkxf2yjbw0jkaz1an58pfw";
+    rev = "cffabb56e911d2a90c53c2fd14d6bd08bf5ac446";
+    sha256 = "0gcq04vgxg0vff9fcalgzq9phq0y76diihkzhlfn91bdxwkx7rl3";
  };
  pango = {
    url = "https://github.com/hugopl/pango.cr.git";
-    rev = "v0.2.0";
-    sha256 = "0dl3qrhi2ybylmvzx1x5gsznp2pcdkc50waxrljxwnf5avn8ixsf";
+    rev = "v0.3.0";
+    sha256 = "1dg5bcbq11zww4xh68dq4ivnsz89yqsnxz81ggp4j9c9d6dhx0m4";
  };
  sqlite3 = {
    url = "https://github.com/crystal-lang/crystal-sqlite3.git";
--- a/pkgs/applications/misc/tandoor-recipes/common.nix
+++ b/pkgs/applications/misc/tandoor-recipes/common.nix
@ -1,15 +1,15 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "1.5.6";
+  version = "1.5.10";

  src = fetchFromGitHub {
    owner = "TandoorRecipes";
    repo = "recipes";
    rev = version;
-    hash = "sha256-3sitrTaIRKmjx+5vWOQXE0/Gu0jJ8VCpOq2cZZVLrbk=";
+    hash = "sha256-CkqNPG57e76TT/vF9lscS6m2FbXOvOfqiT/9aM2Il9E=";
  };

-  yarnHash = "sha256-mZ8beCF+3mnpgKED0fP96RBbGbKNNXqEJkGSjgrEGBc=";
+  yarnHash = "sha256-atl2XrY9LmWh2USp6K2W50/khEsnY6OqKBUS26Ln9ZM=";

  meta = with lib; {
    homepage = "https://tandoor.dev/";
--- a/pkgs/applications/misc/tandoor-recipes/default.nix
+++ b/pkgs/applications/misc/tandoor-recipes/default.nix
@ -5,28 +5,7 @@
 , fetchpatch
 }:
 let
-  python = python3.override {
-    packageOverrides = self: super: {
-      django = super.django_4;
-
-      django-crispy-forms = super.django-crispy-forms.overridePythonAttrs (_: rec {
-        version = "1.14.0";
-        format = "setuptools";
-
-        src = fetchFromGitHub {
-          owner = "django-crispy-forms";
-          repo = "django-crispy-forms";
-          rev = "refs/tags/${version}";
-          hash = "sha256-NZ2lWxsQHc7Qc4HDoWgjJTZ/bJHmjpBf3q1LVLtzA+8=";
-        };
-      });
-
-      # Tests are incompatible with Django 4
-      django-js-reverse = super.django-js-reverse.overridePythonAttrs (_: {
-        doCheck = false;
-      });
-    };
-  };
+  python = python3;

  common = callPackage ./common.nix { };

@ -44,8 +23,8 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
    ./media-root.patch
    # https://github.com/TandoorRecipes/recipes/pull/2706
    (fetchpatch {
-      url = "https://github.com/TandoorRecipes/recipes/commit/8f66f5c3ca61751a80cc133ff4c59019d6fca406.patch";
-      hash = "sha256-oF5YlPg1LEdLvKpxiSqjTmYPbrGquPlRIz6A05031gs=";
+      url = "https://github.com/TandoorRecipes/recipes/commit/702c1d67d3b2d13cf471bf9daa1d2ef0f1837dec.patch";
+      hash = "sha256-6vmtYs6b0d38Ojxxc2I7oxqpkIlyRVlhzURBOTO2VlQ=";
    })
  ];

@ -63,6 +42,7 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
    django-cleanup
    django-cors-headers
    django-crispy-forms
+    django-crispy-bootstrap4
    django-hcaptcha
    django-js-reverse
    django-oauth-toolkit
@ -145,6 +125,11 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
    pytest-factoryboy
  ];

+  # flaky
+  disabledTests = [
+    "test_search_count"
+  ];
+
  passthru = {
    inherit frontend python;

--- a/pkgs/applications/misc/tippecanoe/default.nix
+++ b/pkgs/applications/misc/tippecanoe/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tippecanoe";
-  version = "2.35.0";
+  version = "2.37.1";

  src = fetchFromGitHub {
    owner = "felt";
    repo = "tippecanoe";
    rev = finalAttrs.version;
-    hash = "sha256-l19p/Ql1gaNJpmDH46jwLgUUmJ5YTYRQi6DdayAd84Q=";
+    hash = "sha256-BS9QBNLAg1VB290Mu0/V3oYLH/XfGcvZp5dVg4WQGck=";
  };

  buildInputs = [ sqlite zlib ];
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -92,11 +92,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.60.125";
+  version = "1.61.101";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-ZctJBLEpaOzRK8BppMK7aT0kx00e7zXO+y8U38CCxKo=";
+    hash = "sha256-s+YjTZs+dT/T/MSzOAvXMHzd3pWMbLa8v9amnd2sqns=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,39 +1,39 @@
 {
  stable = {
    chromedriver = {
-      hash_darwin = "sha256-sRAU9RJANz+Sov6oaoZasMoaqM+mIZSDbag92wXsVCI=";
+      hash_darwin = "sha256-ThsKOOLNcmFTUnLirSHea9wzw+FyC3v7I/5ghbz8GAg=";
      hash_darwin_aarch64 =
-        "sha256-U+PBsfpc7PNZYedHIdPnWXA9xKpRnon5vxgKKJr69ow=";
-      hash_linux = "sha256-2o6LAo2pEsCi1exPv1nEMk2Tklhh49UyWaYoyQ7Df/Y=";
-      version = "119.0.6045.105";
+        "sha256-UVBLCo8Lkbnt882PeTMnO8lxam42mIDkEN28Ps8E0a8=";
+      hash_linux = "sha256-X8bia1BaLQm5WKn5vdShpQ4A7sPNZ8lgmeXoYj2earc=";
+      version = "120.0.6099.71";
    };
    deps = {
      gn = {
-        hash = "sha256-4jWqtsOBh96xbYk1m06G9hj2eQwW6buUXsxWsa5W6/4=";
-        rev = "991530ce394efb58fcd848195469022fa17ae126";
+        hash = "sha256-dwluGOfq05swtBM5gg4a6gY3IpFHaKKkD0TV1XW7c7k=";
+        rev = "e4702d7409069c4f12d45ea7b7f0890717ca3f4b";
        url = "https://gn.googlesource.com/gn";
-        version = "2023-09-12";
+        version = "2023-10-23";
      };
    };
-    hash = "sha256-LqAORwZRyS9ASo0U+iVi9srEKYoSBG5upjqi5F65ITg=";
-    hash_deb_amd64 = "sha256-9nZjyJnXvOO1iZea3mdsj5FYkylrWnhColZ+q+X/xcU=";
-    version = "119.0.6045.199";
+    hash = "sha256-2IYdIhe299Fn5gtmLKxqIPqTYYEpCJqbXh3Vx8zN9Uo=";
+    hash_deb_amd64 = "sha256-xHwBLIU1QoDM0swG2DzRJ7BY9ESiqOrm4SwvK0mfIZc=";
+    version = "120.0.6099.71";
  };
  ungoogled-chromium = {
    deps = {
      gn = {
-        hash = "sha256-4jWqtsOBh96xbYk1m06G9hj2eQwW6buUXsxWsa5W6/4=";
-        rev = "991530ce394efb58fcd848195469022fa17ae126";
+        hash = "sha256-dwluGOfq05swtBM5gg4a6gY3IpFHaKKkD0TV1XW7c7k=";
+        rev = "e4702d7409069c4f12d45ea7b7f0890717ca3f4b";
        url = "https://gn.googlesource.com/gn";
-        version = "2023-09-12";
+        version = "2023-10-23";
      };
      ungoogled-patches = {
-        hash = "sha256-ZcE5rmreXt4X+PuMalNRE7FakMIMOCyZQfhIhKDSxMg=";
-        rev = "119.0.6045.199-1";
+        hash = "sha256-S0Kt9M21zyjIozJuyy4kBDt07kJxXBR7SoNzdvf0iPI=";
+        rev = "120.0.6099.71-1";
      };
    };
-    hash = "sha256-LqAORwZRyS9ASo0U+iVi9srEKYoSBG5upjqi5F65ITg=";
-    hash_deb_amd64 = "sha256-9nZjyJnXvOO1iZea3mdsj5FYkylrWnhColZ+q+X/xcU=";
-    version = "119.0.6045.199";
+    hash = "sha256-2IYdIhe299Fn5gtmLKxqIPqTYYEpCJqbXh3Vx8zN9Uo=";
+    hash_deb_amd64 = "sha256-xHwBLIU1QoDM0swG2DzRJ7BY9ESiqOrm4SwvK0mfIZc=";
+    version = "120.0.6099.71";
  };
 }
--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "kaniko";
-  version = "1.18.0";
+  version = "1.19.0";

  src = fetchFromGitHub {
    owner = "GoogleContainerTools";
    repo = "kaniko";
    rev = "v${version}";
-    hash = "sha256-EMBCJc9x4oduFSHMYajc/Pf8nHwRP7qMsvJUbnDkjdk=";
+    hash = "sha256-XtEI+DJMbBRcvBqsbVCDhVZiXNKqNvmQAmTSLmWB5o4=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/openshift/default.nix
+++ b/pkgs/applications/networking/cluster/openshift/default.nix
@ -9,14 +9,14 @@
 }:
 buildGoModule rec {
  pname = "openshift";
-  version = "4.13.0";
-  gitCommit = "e561d37";
+  version = "4.14.0";
+  gitCommit = "0c63f9d";

  src = fetchFromGitHub {
    owner = "openshift";
    repo = "oc";
-    rev = "e561d37285c8bde273ce00d086bea599a9cdd3be";
-    hash = "sha256-/ar96N+MSy0DPdza3UWiyolg1EZPBR6LCku4GV+HppM=";
+    rev = "0c63f9da2694c080257111616c60005f32a5bf47";
+    hash = "sha256-viNSRwGNB0TGgw501cQuj4ajmAgvqk4vj2RmW8/DCB8=";
  };

  vendorHash = null;
@ -62,6 +62,5 @@ buildGoModule rec {
    license = licenses.asl20;
    maintainers = with maintainers; [ offline bachp moretea stehessel ];
    mainProgram = "oc";
-    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/networking/cluster/opentofu/default.nix
+++ b/pkgs/applications/networking/cluster/opentofu/default.nix
@ -14,13 +14,13 @@
 let
  package =  buildGoModule rec {
    pname = "opentofu";
-    version = "1.6.0-beta2";
+    version = "1.6.0-beta3";

    src = fetchFromGitHub {
      owner = "opentofu";
      repo = "opentofu";
      rev = "v${version}";
-      hash = "sha256-zUMRjUcFIgLgNcUp+I48dDyncI4cjup4+HMXxxJdXU4=";
+      hash = "sha256-71QJ6rhzFAE78v6RxO1nSroyjF0vrlKC3UIp9ksZolk=";
    };

    vendorHash = "sha256-kSm5RZqQRgbmPaKt5IWmuMhHwAu+oJKTX1q1lbE7hWk=";
--- a/pkgs/applications/networking/cluster/starboard/default.nix
+++ b/pkgs/applications/networking/cluster/starboard/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "starboard";
-  version = "0.15.17";
+  version = "0.15.18";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-RzwLc29f+u/m1x5R199M8XQQ5nn33ofYi3AyMCimMtA=";
+    sha256 = "sha256-tQRnqc8VL3QmFzWlf4YHhtLxVAQDkb+U+2ynqmpGffQ=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -20,7 +20,7 @@ buildGoModule rec {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorHash = "sha256-dUqcg9/kJfKWIygem0rmtgOiYOHpfWOdH4YV0mYhxeQ=";
+  vendorHash = "sha256-VOnftPcsgpmvmfjEc+vdbUOyn6t9QlVRkuxs/Ahy548=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.53.8";
+  version = "0.54.0";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-qjtyzwcpkZ1+jfwbpYGEXPLeh5+7iNNRRmn8VvZBIEo=";
+    hash = "sha256-PcQuPV0wZa+CgikI9grdsGqNwXlXnu/kM+h4KfPW7SU=";
  };

-  vendorHash = "sha256-Eu4BOi9ClzNps20OT4L/AXxKZ5zL9ipSmfDunO6CxNs=";
+  vendorHash = "sha256-OIkrDvNk4XD11j/+BdOkzbw86cYUj0Vz7pZ5/vIZopY=";

  doCheck = false;

--- a/pkgs/applications/networking/instant-messengers/webex/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webex/default.nix
@ -56,11 +56,11 @@

 stdenv.mkDerivation rec {
  pname = "webex";
-  version = "43.8.0.26955";
+  version = "43.11.0.27795";

  src = fetchurl {
-    url = "https://binaries.webex.com/WebexDesktop-Ubuntu-Gold/20230814223338/Webex_ubuntu.7z";
-    sha256 = "6c754d65fffbcbbb2ca303e1f8c1e5688da190eea3d3b67c77361abc6e2bb85b";
+    url = "https://binaries.webex.com/WebexDesktop-Ubuntu-Gold/20231108131957/Webex_ubuntu.7z";
+    sha256 = "e7a30481840a4a56c7ac38fa9efb487c722758ad9ac875432e86232d6a8e6466";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@ -6,25 +6,24 @@
 }:

 stdenv.mkDerivation rec {
-  version = "20230517";
+  version = "20231103";
  pname = "neomutt";

  src = fetchFromGitHub {
    owner  = "neomutt";
    repo   = "neomutt";
    rev    = version;
-    sha256 = "sha256-1i0STaJulJP0LWdNfLLIEKVapfkcguYRnbc+psWlVE4=";
+    sha256 = "sha256-9/XYgQjOdIwDpoJz5kNmiRBdoSod9l7Yl0u4e20KDPw=";
  };

  patches = [
    # https://github.com/neomutt/neomutt/issues/3773#issuecomment-1493295144
    ./fix-open-very-large-mailbox.patch
+    # https://github.com/neomutt/neomutt/issues/4128
    (fetchpatch {
-      # https://github.com/neomutt/neomutt/pull/3933
-      name = "disable-incorrect-tests.patch";
-      url = "https://github.com/neomutt/neomutt/compare/f624551b86cdb53224b5b48304a808ca2815111e...a9a1d99e6c0fdf367188125451300fa89d3e801a.patch";
-      hash = "sha256-Plei063T8XyXF4/7/nAb6/4OyXz72vBAXHwls9WL1vM=";
-      excludes = [".github/workflows/macos.yml"];
+      name = "fix-attr-color-copy.patch";
+      url = "https://github.com/neomutt/neomutt/commit/24f8644c28e602206a63fae53c4eb3d32426ce0c.patch";
+      hash = "sha256-8qcW9hb6yxEZICRYgl6ZhPQDrI6nZN9NH+40GhTgR0o=";
    })
  ];

--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -25,7 +25,7 @@

 mkDerivation rec {
  pname = "nextcloud-client";
-  version = "3.10.1";
+  version = "3.10.2";

  outputs = [ "out" "dev" ];

@ -33,7 +33,7 @@ mkDerivation rec {
    owner = "nextcloud";
    repo = "desktop";
    rev = "v${version}";
-    sha256 = "sha256-PtWg9IMwZU0HG2pVHdRKgPQH8i2e72Fbs+q5wCwBsfo=";
+    sha256 = "sha256-sysWDjJSlXRjtv9eiCTkXb29ZYs3YC7sr/UMMPCt5wA=";
  };

  patches = [
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@ -3,10 +3,10 @@

 stdenv.mkDerivation rec {
  pname = "homebank";
-  version = "5.7.2";
+  version = "5.7.3";
  src = fetchurl {
    url = "https://www.gethomebank.org/public/sources/homebank-${version}.tar.gz";
-    hash = "sha256-Mx1++I2Q8/NMpmEPfxjonpNUQ7GLCRqH2blL11Vjme8=";
+    hash = "sha256-ad8XKlmazWZim/mLNmnsFSy5Oni7yv3HQxYX3SXzXcU=";
  };

  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
--- a/pkgs/applications/version-management/deepgit/default.nix
+++ b/pkgs/applications/version-management/deepgit/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "deepgit";
-  version = "4.3.1";
+  version = "4.4";

  src = fetchurl {
    url = "https://www.syntevo.com/downloads/deepgit/deepgit-linux-${lib.replaceStrings [ "." ] [ "_" ] version}.tar.gz";
-    hash = "sha256-Ovd9MjgpMJvNySW/FPXYVtpLoCSQP1W1nlcNkgI7sgA=";
+    hash = "sha256-ILqwXDyW7/hZzoSxxaxv4bF5xsB/JFaOBYAJFb7xmdk=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
  pname = "forgejo";
-  version = "1.21.1-0";
+  version = "1.21.2-0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "forgejo";
    repo = "forgejo";
    rev = "v${version}";
-    hash = "sha256-e7Y1YBJq3PwYl7hf5KUa/CSI4ihbpN/TjWwltjNwXRM=";
+    hash = "sha256-kH4m958gmIYpIwYmT2kIj9FcfXdyh8no06E0WQII/6E=";
  };

  vendorHash = "sha256-+/wOEF44dSqy7ZThZyd66xyI3wVnFwZbsAd4ujyVku8=";
--- a/pkgs/applications/version-management/jujutsu/default.nix
+++ b/pkgs/applications/version-management/jujutsu/default.nix
@ -20,16 +20,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "jujutsu";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "martinvonz";
    repo = "jj";
    rev = "v${version}";
-    hash = "sha256-yEW7+0MnJlW0WeZ6UItaCDrihPLA52mLcu15tJwZx9w=";
+    hash = "sha256-9m8GmVIZgHETkemzElXOfVxaZlzJwZaT2sJcTU7vZ2g=";
  };

-  cargoHash = "sha256-xA9SDq1Kc0u8qFEPFFCic9uwE2Y/BXJzUHBCs1Czxtw=";
+  cargoHash = "sha256-g1gdFGj0nzczR2yyjCdjpCGtFlmX7yrdAQIa3sQRATg=";

  cargoBuildFlags = [ "--bin" "jj" ]; # don't install the fake editors
  useNextest = true; # nextest is the upstream integration framework
--- a/pkgs/applications/version-management/sparkleshare/default.nix
+++ b/pkgs/applications/version-management/sparkleshare/default.nix
@ -49,6 +49,9 @@ stdenv.mkDerivation rec {
  ];

  patchPhase = ''
+    # SparkleShare's default desktop file falls back to flatpak.
+    sed -ie "s_^Exec=.*_Exec=$out/bin/sparkleshare_" SparkleShare/Linux/SparkleShare.Autostart.desktop
+
    # Nix will manage the icon cache.
    echo '#!/bin/sh' >scripts/post-install.sh
  '';
--- a/pkgs/applications/video/hypnotix/default.nix
+++ b/pkgs/applications/video/hypnotix/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "hypnotix";
-  version = "4.0";
+  version = "4.2";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "hypnotix";
    rev = version;
-    hash = "sha256-0iJzlj5FRDXJdh+vWVvZaBJVNru7CfkvJtZUZYKoqPw=";
+    hash = "sha256-YmVMcNbvbkODAmEgv8Ofgo07Mew/F4xv5cBaWKsH1S4=";
  };

  patches = [
--- a/pkgs/applications/video/mpv/scripts/buildLua.nix
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@ -5,31 +5,29 @@ let
  inherit (lib) hasPrefix hasSuffix removeSuffix;
  escapedList = with lib; concatMapStringsSep " " (s: "'${escape [ "'" ] s}'");
  fileName = pathStr: lib.last (lib.splitString "/" pathStr);
-  nameFromPath = pathStr:
-    let fN = fileName pathStr; in
-    if hasSuffix ".lua" fN then
-      fN
-    else if !(hasPrefix "." fN) then
-      "${fN}.lua"
-    else
-      null
-  ;
  scriptsDir = "$out/share/mpv/scripts";
+
+  # similar to `lib.extends`, but with inverted precedence and recursive update
+  extendedBy = args: orig: self:
+    let super = args self;
+    in lib.recursiveUpdate (orig super) super
+  ;
 in
-lib.makeOverridable (
+
+lib.makeOverridable (args: stdenvNoCC.mkDerivation (extendedBy
+  (if lib.isFunction args then args else (_: args)) (
  { pname
  , extraScripts ? []
  , ... }@args:
  let
    # either passthru.scriptName, inferred from scriptPath, or from pname
    scriptName = (args.passthru or {}).scriptName or (
-      if args ? scriptPath && nameFromPath args.scriptPath != null
-      then nameFromPath args.scriptPath
+      if args ? scriptPath
+      then fileName args.scriptPath
      else "${pname}.lua"
    );
    scriptPath = args.scriptPath or "./${scriptName}";
-  in
-  stdenvNoCC.mkDerivation (lib.attrsets.recursiveUpdate {
+  in {
    dontBuild = true;
    preferLocalBuild = true;

@ -59,5 +57,5 @@ lib.makeOverridable (

    passthru = { inherit scriptName; };
    meta.platforms = lib.platforms.all;
-  } args)
-)
+  })
+))
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@ -22,7 +22,7 @@ in lib.recurseIntoAttrs
    sponsorblock = callPackage ./sponsorblock.nix { };
    thumbfast = callPackage ./thumbfast.nix { inherit buildLua; };
    thumbnail = callPackage ./thumbnail.nix { inherit buildLua; };
-    uosc = callPackage ./uosc.nix { };
+    uosc = callPackage ./uosc.nix { inherit buildLua; };
    visualizer = callPackage ./visualizer.nix { };
    vr-reversal = callPackage ./vr-reversal.nix { };
    webtorrent-mpv-hook = callPackage ./webtorrent-mpv-hook.nix { };
--- a/pkgs/applications/video/mpv/scripts/uosc.nix
+++ b/pkgs/applications/video/mpv/scripts/uosc.nix
@ -1,42 +1,50 @@
-{ stdenvNoCC, lib, fetchFromGitHub, makeFontsConf }:
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, makeFontsConf
+, buildLua
+, buildGoModule
+}:

-stdenvNoCC.mkDerivation (finalAttrs: {
+buildLua (finalAttrs: {
  pname = "uosc";
-  version = "4.7.0";
+  version = "5.1.1";
+  scriptPath = "src/uosc";

  src = fetchFromGitHub {
    owner = "tomasklaen";
    repo = "uosc";
    rev = finalAttrs.version;
-    hash = "sha256-JqlBjhwRgmXl6XfHYTwtNWZj656EDHjcdWOlCgihF5I=";
+    hash = "sha256-+4k8T1yX3IRXK3XkUShsuJSH9w1Zla7CaRENcIqX4iM=";
  };

-  postPatch = ''
-    substituteInPlace scripts/uosc.lua \
-      --replace "mp.find_config_file('scripts')" "\"$out/share/mpv/scripts\""
-  '';
+  tools = buildGoModule {
+    pname = "uosc-bin";
+    inherit (finalAttrs) version src;
+    vendorHash = "sha256-nkY0z2GiDxfNs98dpe+wZNI3dAXcuHaD/nHiZ2XnZ1Y=";
+  };

-  dontBuild = true;
+  # Patch lua script to get the path to its `ziggy` binary form the environment
+  patches = [
+    # uosc#814: Support overriding `ziggy_path` via environment variable
+    (fetchpatch {
+      url = "https://github.com/tomasklaen/uosc/commit/4fdf68a1bcb510824d66f35ecc7672a6452a44b2.patch";
+      hash = "sha256-igUqFf8e7LVIIjGxACdIWAeZxjF/yqaCL4QRXrzNQXk=";
+    })
+  ];

-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/mpv/
-    cp -r scripts $out/share/mpv
-    cp -r fonts $out/share
-
-    runHook postInstall
-  '';
-
-  passthru.scriptName = "uosc.lua";
  # the script uses custom "texture" fonts as the background for ui elements.
  # In order for mpv to find them, we need to adjust the fontconfig search path.
+  postInstall = "cp -r src/fonts $out/share";
  passthru.extraWrapperArgs = [
    "--set"
    "FONTCONFIG_FILE"
    (toString (makeFontsConf {
      fontDirectories = [ "${finalAttrs.finalPackage}/share/fonts" ];
    }))
+    "--set"
+    "MPV_UOSC_ZIGGY"
+    (lib.getExe' finalAttrs.tools "ziggy")
  ];

  meta = with lib; {
--- a/pkgs/build-support/trivial-builders/test/default.nix
+++ b/pkgs/build-support/trivial-builders/test/default.nix
@ -14,21 +14,24 @@
 { callPackage, lib, stdenv }:
 let
  inherit (lib) recurseIntoAttrs;
+  references = callPackage ./references {};
 in
 recurseIntoAttrs {
  concat = callPackage ./concat-test.nix {};
  linkFarm = callPackage ./link-farm.nix {};
  overriding = callPackage ../test-overriding.nix {};
+  # VM test not supported beyond linux yet
  references =
-    # VM test not supported beyond linux yet
    if stdenv.hostPlatform.isLinux
-    then callPackage ./references.nix {}
-    else null;
+    then references
+    else {};
  writeCBin = callPackage ./writeCBin.nix {};
  writeShellApplication = callPackage ./writeShellApplication.nix {};
  writeScriptBin = callPackage ./writeScriptBin.nix {};
  writeShellScript = callPackage ./write-shell-script.nix {};
  writeShellScriptBin = callPackage ./writeShellScriptBin.nix {};
-  writeStringReferencesToFile = callPackage ./writeStringReferencesToFile.nix {};
+  writeStringReferencesToFile = callPackage ./writeStringReferencesToFile.nix {
+    inherit (references) samples;
+  };
  writeTextFile = callPackage ./write-text-file.nix {};
 }
--- a/pkgs/build-support/trivial-builders/test/invoke-writeDirectReferencesToFile.nix
+++ b/pkgs/build-support/trivial-builders/test/invoke-writeDirectReferencesToFile.nix
@ -1,4 +0,0 @@
-{ pkgs ? import ../../../.. { config = {}; overlays = []; } }:
-pkgs.lib.mapAttrs
-  (k: v: pkgs.writeDirectReferencesToFile v)
-  (import ./sample.nix { inherit pkgs; })
--- a/pkgs/build-support/trivial-builders/test/invoke-writeReferencesToFile.nix
+++ b/pkgs/build-support/trivial-builders/test/invoke-writeReferencesToFile.nix
@ -1,4 +0,0 @@
-{ pkgs ? import ../../../.. { config = {}; overlays = []; } }:
-pkgs.lib.mapAttrs
-  (k: v: pkgs.writeReferencesToFile v)
-  (import ./sample.nix { inherit pkgs; })
--- a/pkgs/build-support/trivial-builders/test/references-test.sh
+++ b/pkgs/build-support/trivial-builders/test/references-test.sh
@ -1,62 +0,0 @@
-#!/usr/bin/env bash
-
-# -------------------------------------------------------------------------- #
-#
-#                         trivial-builders test
-#
-# -------------------------------------------------------------------------- #
-#
-#  This file can be run independently (quick):
-#
-#      $ pkgs/build-support/trivial-builders/references-test.sh
-#
-#  or in the build sandbox with a ~20s VM overhead
-#
-#      $ nix-build -A tests.trivial-builders.references
-#
-# -------------------------------------------------------------------------- #
-
-# strict bash
-set -euo pipefail
-
-# debug
-# set -x
-# PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
-
-cd "$(dirname ${BASH_SOURCE[0]})"  # nixpkgs root
-
-if [[ -z ${SAMPLE:-} ]]; then
-  echo "Running the script directly is currently not supported."
-  echo "If you need to iterate, remove the raw path, which is not returned by nix-build."
-  exit 1
-#   sample=( `nix-build --no-out-link sample.nix` )
-#   directRefs=( `nix-build --no-out-link invoke-writeDirectReferencesToFile.nix` )
-#   references=( `nix-build --no-out-link invoke-writeReferencesToFile.nix` )
-#   echo "sample: ${#sample[@]}"
-#   echo "direct: ${#directRefs[@]}"
-#   echo "indirect: ${#references[@]}"
-else
-  # Injected by Nix (to avoid evaluating in a derivation)
-  # turn them into arrays
-  sample=($SAMPLE)
-  directRefs=($DIRECT_REFS)
-  references=($REFERENCES)
-fi
-
-echo >&2 Testing direct references...
-for i in "${!sample[@]}"; do
-  echo >&2 Checking '#'$i ${sample[$i]} ${directRefs[$i]}
-  diff -U3 \
-    <(sort <${directRefs[$i]}) \
-    <(nix-store -q --references ${sample[$i]} | sort)
-done
-
-echo >&2 Testing closure...
-for i in "${!sample[@]}"; do
-  echo >&2 Checking '#'$i ${sample[$i]} ${references[$i]}
-  diff -U3 \
-    <(sort <${references[$i]}) \
-    <(nix-store -q --requisites ${sample[$i]} | sort)
-done
-
-echo 'OK!'
--- a/pkgs/build-support/trivial-builders/test/references.nix
+++ b/pkgs/build-support/trivial-builders/test/references.nix
@ -1,52 +0,0 @@
-{ lib, testers, pkgs, writeText, hello, figlet, stdenvNoCC }:
-
-# -------------------------------------------------------------------------- #
-#
-#                         trivial-builders test
-#
-# -------------------------------------------------------------------------- #
-#
-#  This file can be run independently (quick):
-#
-#      $ pkgs/build-support/trivial-builders/references-test.sh
-#
-#  or in the build sandbox with a ~20s VM overhead
-#
-#      $ nix-build -A tests.trivial-builders.references
-#
-# -------------------------------------------------------------------------- #
-
-let
-  invokeSamples = file:
-    lib.concatStringsSep " " (
-      lib.attrValues (import file { inherit pkgs; })
-    );
-in
-testers.nixosTest {
-  name = "nixpkgs-trivial-builders";
-  nodes.machine = { ... }: {
-    virtualisation.writableStore = true;
-
-    # Test runs without network, so we don't substitute and prepare our deps
-    nix.settings.substituters = lib.mkForce [];
-    environment.etc."pre-built-paths".source = writeText "pre-built-paths" (
-      builtins.toJSON [hello figlet stdenvNoCC]
-    );
-    environment.variables = {
-      SAMPLE = invokeSamples ./sample.nix;
-      REFERENCES = invokeSamples ./invoke-writeReferencesToFile.nix;
-      DIRECT_REFS = invokeSamples ./invoke-writeDirectReferencesToFile.nix;
-    };
-  };
-  testScript =
-    ''
-      machine.succeed("""
-        ${./references-test.sh} 2>/dev/console
-      """)
-    '';
-  meta = {
-    maintainers = with lib.maintainers; [
-      roberth
-    ];
-  };
-}
--- a/pkgs/build-support/trivial-builders/test/references/default.nix
+++ b/pkgs/build-support/trivial-builders/test/references/default.nix
@ -0,0 +1,124 @@
+{ lib
+, stdenvNoCC
+, testers
+, callPackage
+, writeText
+  # nativeBuildInputs
+, shellcheck-minimal
+  # Samples
+, samples ? cleanSamples (callPackage ./samples.nix { })
+  # Filter out the non-string-like attributes such as <pkg>.override added by
+  # callPackage.
+, cleanSamples ? lib.filterAttrs (n: lib.isStringLike)
+  # Test targets
+, writeDirectReferencesToFile
+, writeReferencesToFile
+}:
+
+# -------------------------------------------------------------------------- #
+#
+#                         trivial-builders test
+#
+# -------------------------------------------------------------------------- #
+#
+# Execute this build script directly (quick):
+#
+# * Classic
+#   $ NIX_PATH="nixpkgs=$PWD" nix-shell -p tests.trivial-builders.references.testScriptBin --run references-test
+#
+# * Flake-based
+#   $ nix run .#tests.trivial-builders.references.testScriptBin
+#
+# or in the build sandbox with a ~20s VM overhead:
+#
+# * Classic
+#   $ nix-build --no-out-link -A tests.trivial-builders.references
+#
+# * Flake-based
+#   $ nix build -L --no-link .#tests.trivial-builders.references
+#
+# -------------------------------------------------------------------------- #
+
+let
+  # Map each attribute to an element specification of Bash associative arrary
+  # and concatenate them with white spaces, to be used to define a
+  # one-line Bash associative array.
+  samplesToString = attrs:
+    lib.concatMapStringsSep " " (name: "[${name}]=${lib.escapeShellArg "${attrs.${name}}"}") (builtins.attrNames attrs);
+
+  references = lib.mapAttrs (n: v: writeReferencesToFile v) samples;
+  directReferences = lib.mapAttrs (n: v: writeDirectReferencesToFile v) samples;
+
+  testScriptBin = stdenvNoCC.mkDerivation (finalAttrs: {
+    name = "references-test";
+
+    src = ./references-test.sh;
+    dontUnpack = true;
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p "$out/bin"
+      substitute "$src" "$out/bin/${finalAttrs.meta.mainProgram}" \
+        --replace "@SAMPLES@" ${lib.escapeShellArg (samplesToString samples)} \
+        --replace "@REFERENCES@" ${lib.escapeShellArg (samplesToString references)} \
+        --replace "@DIRECT_REFS@" ${lib.escapeShellArg (samplesToString directReferences)}
+      runHook postInstall
+      chmod +x "$out/bin/${finalAttrs.meta.mainProgram}"
+    '';
+
+    doInstallCheck = true;
+    nativeInstallCheckInputs = [
+      shellcheck-minimal
+    ];
+    installCheckPhase = ''
+      runHook preInstallCheck
+      shellcheck "$out/bin/${finalAttrs.meta.mainProgram}"
+      runHook postInstallCheck
+    '';
+
+    passthru = {
+      inherit
+        directReferences
+        references
+        samples
+        ;
+    };
+
+    meta = with lib; {
+      mainProgram = "references-test";
+    };
+  });
+in
+testers.nixosTest {
+  name = "nixpkgs-trivial-builders";
+  nodes.machine = { ... }: {
+    virtualisation.writableStore = true;
+
+    # Test runs without network, so we don't substitute and prepare our deps
+    nix.settings.substituters = lib.mkForce [ ];
+    environment.etc."pre-built-paths".source = writeText "pre-built-paths" (
+      builtins.toJSON [ testScriptBin ]
+    );
+  };
+  testScript =
+    ''
+      machine.succeed("""
+        ${lib.getExe testScriptBin} 2>/dev/console
+      """)
+    '';
+  passthru = {
+    inherit
+      directReferences
+      references
+      samples
+      testScriptBin
+      ;
+  };
+  meta = {
+    maintainers = with lib.maintainers; [
+      roberth
+      ShamrockLee
+    ];
+  };
+}
--- a/pkgs/build-support/trivial-builders/test/references/references-test.sh
+++ b/pkgs/build-support/trivial-builders/test/references/references-test.sh
@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+# -------------------------------------------------------------------------- #
+#
+#                         trivial-builders test
+#
+# -------------------------------------------------------------------------- #
+#
+# Execute this build script directly (quick):
+#
+# * Classic
+#   $ NIX_PATH="nixpkgs=$PWD" nix-shell -p tests.trivial-builders.references.testScriptBin --run references-test
+#
+# * Flake-based
+#   $ nix run .#tests.trivial-builders.references.testScriptBin
+#
+# or in the build sandbox with a ~20s VM overhead:
+#
+# * Classic
+#   $ nix-build --no-out-link -A tests.trivial-builders.references
+#
+# * Flake-based
+#   $ nix build -L --no-link .#tests.trivial-builders.references
+#
+# -------------------------------------------------------------------------- #
+
+# strict bash
+set -euo pipefail
+
+# debug
+# set -x
+# PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
+
+cd "$(dirname "${BASH_SOURCE[0]}")"  # nixpkgs root
+
+  # Injected by Nix (to avoid evaluating in a derivation)
+  # turn them into arrays
+  # shellcheck disable=SC2206 # deliberately unquoted
+  declare -A samples=( @SAMPLES@ )
+  # shellcheck disable=SC2206 # deliberately unquoted
+  declare -A directRefs=( @DIRECT_REFS@ )
+  # shellcheck disable=SC2206 # deliberately unquoted
+  declare -A references=( @REFERENCES@ )
+
+echo >&2 Testing direct references...
+for i in "${!samples[@]}"; do
+  echo >&2 Checking "$i" "${samples[$i]}" "${directRefs[$i]}"
+  diff -U3 \
+    <(sort <"${directRefs[$i]}") \
+    <(nix-store -q --references "${samples[$i]}" | sort)
+done
+
+echo >&2 Testing closure...
+for i in "${!samples[@]}"; do
+  echo >&2 Checking "$i" "${samples[$i]}" "${references[$i]}"
+  diff -U3 \
+    <(sort <"${references[$i]}") \
+    <(nix-store -q --requisites "${samples[$i]}" | sort)
+done
+
+echo 'OK!'
--- a/pkgs/build-support/trivial-builders/test/references/samples.nix
+++ b/pkgs/build-support/trivial-builders/test/references/samples.nix
@ -0,0 +1,30 @@
+{ lib
+, runCommand
+, writeText
+, emptyFile
+, emptyDirectory
+, figlet
+, hello
+, zlib
+}:
+{
+  inherit
+    figlet
+    hello
+    zlib
+    ;
+  zlib-dev = zlib.dev;
+  norefs = writeText "hi" "hello";
+  norefsDup = writeText "hi" "hello";
+  helloRef = writeText "hi" "hello ${hello}";
+  helloRefDup = writeText "hi" "hello ${hello}";
+  path = ./samples.nix;
+  pathLike.outPath = ./samples.nix;
+  helloFigletRef = writeText "hi" "hello ${hello} ${figlet}";
+  selfRef = runCommand "self-ref-1" { } "echo $out >$out";
+  selfRef2 = runCommand "self-ref-2" { } ''echo "${figlet}, $out" >$out'';
+  inherit
+    emptyFile
+    emptyDirectory
+    ;
+}
--- a/pkgs/build-support/trivial-builders/test/sample.nix
+++ b/pkgs/build-support/trivial-builders/test/sample.nix
@ -1,29 +0,0 @@
-{ pkgs ? import ../../../.. { config = { }; overlays = [ ]; } }:
-let
-  inherit (pkgs)
-    figlet
-    zlib
-    hello
-    writeText
-    runCommand
-    ;
-in
-{
-  hello = hello;
-  figlet = figlet;
-  zlib = zlib;
-  zlib-dev = zlib.dev;
-  norefs = writeText "hi" "hello";
-  norefsDup = writeText "hi" "hello";
-  helloRef = writeText "hi" "hello ${hello}";
-  helloRefDup = writeText "hi" "hello ${hello}";
-  path = ./invoke-writeReferencesToFile.nix;
-  pathLike.outPath = ./invoke-writeReferencesToFile.nix;
-  helloFigletRef = writeText "hi" "hello ${hello} ${figlet}";
-  selfRef = runCommand "self-ref-1" {} "echo $out >$out";
-  selfRef2 = runCommand "self-ref-2" {} ''echo "${figlet}, $out" >$out'';
-  inherit (pkgs)
-    emptyFile
-    emptyDirectory
-  ;
-}
--- a/pkgs/build-support/trivial-builders/test/writeStringReferencesToFile.nix
+++ b/pkgs/build-support/trivial-builders/test/writeStringReferencesToFile.nix
@ -1,14 +1,13 @@
-{ callPackage, lib, pkgs, runCommand, writeText, writeStringReferencesToFile }:
+{ callPackage, lib, pkgs, runCommand, samples, writeText, writeStringReferencesToFile }:
 let
-  sample = import ./sample.nix { inherit pkgs; };
-  samplePaths = lib.unique (lib.attrValues sample);
+  samplePaths = lib.unique (lib.attrValues samples);
  stri = x: "${x}";
  sampleText = writeText "sample-text" (lib.concatStringsSep "\n" (lib.unique (map stri samplePaths)));
  stringReferencesText =
    writeStringReferencesToFile
      ((lib.concatMapStringsSep "fillertext"
        stri
-        (lib.attrValues sample)) + ''
+        (lib.attrValues samples)) + ''
        STORE=${builtins.storeDir};\nsystemctl start bar-foo.service
      '');
 in
--- a/pkgs/by-name/ae/aeron-cpp/aeron-all.patch
+++ b/pkgs/by-name/ae/aeron-cpp/aeron-all.patch
@ -0,0 +1,11 @@
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -323,7 +323,7 @@ if (BUILD_AERON_ARCHIVE_API)
+         "${CMAKE_CURRENT_SOURCE_DIR}}/aeron-archive/src/main/java/*.java")
+ 
+     add_custom_command(OUTPUT ${AERON_ALL_JAR}
+-        COMMAND ${CMAKE_COMMAND} -E env JAVA_HOME=$ENV{JAVA_HOME} BUILD_JAVA_HOME=$ENV{BUILD_JAVA_HOME} BUILD_JAVA_VERSION=$ENV{BUILD_JAVA_VERSION} ${GRADLE_WRAPPER} :aeron-all:clean :aeron-all:assemble --no-daemon -x javadoc --console=plain -q
+        COMMAND ln --symbolic  ${CMAKE_CURRENT_SOURCE_DIR}/aeron-all.jar ${AERON_ALL_JAR}
+         DEPENDS ${AERON_ALL_SOURCES}
+         WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+         COMMENT "Generating aeron-all jar")
--- a/pkgs/by-name/ae/aeron-cpp/aeron-archive-sbe.patch
+++ b/pkgs/by-name/ae/aeron-cpp/aeron-archive-sbe.patch
@ -0,0 +1,11 @@
+--- a/aeron-archive/src/main/cpp/CMakeLists.txt
+++ b/aeron-archive/src/main/cpp/CMakeLists.txt
+@@ -59,7 +59,7 @@ set(GENERATED_CODECS
+     ${ARCHIVE_CODEC_TARGET_DIR}/aeron_archive_client/RecordingSignalEvent.h)
+ 
+ add_custom_command(OUTPUT ${GENERATED_CODECS}
+-    COMMAND ${CMAKE_COMMAND} -E env JAVA_HOME=$ENV{JAVA_HOME} BUILD_JAVA_HOME=$ENV{BUILD_JAVA_HOME} BUILD_JAVA_VERSION=$ENV{BUILD_JAVA_VERSION} ${GRADLE_WRAPPER} -Dcodec.target.dir=${ARCHIVE_CODEC_TARGET_DIR} :aeron-archive:generateCppCodecs --no-daemon --console=plain -q
+    COMMAND ${CMAKE_COMMAND} -E env JAVA_HOME=$ENV{JAVA_HOME} BUILD_JAVA_HOME=$ENV{BUILD_JAVA_HOME} BUILD_JAVA_VERSION=$ENV{BUILD_JAVA_VERSION} java -cp sbe.jar -Dsbe.output.dir=${ARCHIVE_CODEC_TARGET_DIR} -Dsbe.target.language=Cpp -Dsbe.target.namespace=aeron.archive.client uk.co.real_logic.sbe.SbeTool ${ARCHIVE_CODEC_SCHEMA_DIR}/aeron-archive-codecs.xml
+     DEPENDS ${CODEC_SCHEMA} aeron-all-jar
+     WORKING_DIRECTORY ${ARCHIVE_CODEC_WORKING_DIR}
+     COMMENT "Generating C++ Archive codecs")
--- a/pkgs/by-name/ae/aeron-cpp/package.nix
+++ b/pkgs/by-name/ae/aeron-cpp/package.nix
@ -0,0 +1,134 @@
+{
+  autoPatchelfHook,
+  cmake,
+  fetchFromGitHub,
+  fetchMavenArtifact,
+  jdk11,
+  lib,
+  libbsd,
+  libuuid,
+  makeWrapper,
+  patchelf,
+  stdenv,
+  zlib
+}:
+
+let
+  version = "1.42.1";
+
+  aeronAll = fetchMavenArtifact {
+    artifactId = "aeron-all";
+    groupId = "io.aeron";
+    inherit version;
+    hash = "sha512-pjX+JopK6onDwElMIroj+ZXrKwdPj5H2uPg08XgNlrK1rAkHo9MUT8weBGbuFVFDLeqOZrHj0bt1wJ9XgYY5aA==";
+  };
+
+  sbeAll_1_29_0 = fetchMavenArtifact {
+    groupId = "uk.co.real-logic";
+    version = "1.29.0";
+    artifactId = "sbe-all";
+    hash = "sha512-exklKS9MgOH369lyuv+5vAWRHt+Iwg/FmsWy8PsSMjenvjs8I2KA1VTa00pIXkw/YNqbUDBIWvS07b4mS8YdPQ==";
+  };
+
+  sbeAll = sbeAll_1_29_0;
+
+in
+
+stdenv.mkDerivation {
+  pname = "aeron-cpp";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "real-logic";
+    repo = "aeron";
+    rev = version;
+    hash = "sha256-ODJeJ4XLazPeNLdzaoclPnE59NpxFUqZu3Aw3iTVQT8=";
+  };
+
+  patches = [
+    ./aeron-all.patch
+    # Use pre-built aeron-all.jar from Maven repo, avoiding Gradle
+
+    ./aeron-archive-sbe.patch
+    # Use SBE tool to generate C++ codecs, avoiding Gradle
+  ];
+
+  buildInputs = [
+    jdk11
+    libbsd
+    libuuid
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    cmake
+    makeWrapper
+    patchelf
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    mkdir --parents cppbuild/Release
+    (
+      cd cppbuild/Release
+      cmake \
+        -G "CodeBlocks - Unix Makefiles" \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DAERON_TESTS=OFF \
+        -DAERON_SYSTEM_TESTS=OFF \
+        -DAERON_BUILD_SAMPLES=OFF \
+        -DCMAKE_INSTALL_PREFIX:PATH=../../install \
+        ../..
+    )
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    ln --symbolic  "${aeronAll.jar}" ./aeron-all.jar
+    ln --symbolic  "${sbeAll.jar}" ./sbe.jar
+    mkdir --parents aeron-all/build/libs
+    (
+      cd cppbuild/Release
+
+      make -j $NIX_BUILD_CORES \
+        aeron \
+        aeron_archive_client \
+        aeron_client_shared \
+        aeron_driver \
+        aeron_client \
+        aeron_driver_static \
+        aeronmd
+
+      make -j $NIX_BUILD_CORES install
+    )
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir --parents "$out"
+    cp --archive --verbose --target-directory="$out" install/*
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Aeron Messaging C++ Library";
+    homepage = "https://aeron.io/";
+    license = licenses.asl20;
+    mainProgram = "aeronmd";
+    maintainers = [ maintainers.vaci ];
+    sourceProvenance = [
+      sourceTypes.fromSource
+      sourceTypes.binaryBytecode
+    ];
+  };
+}
+
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "bruno";
-  version = "1.3.1";
+  version = "1.4.0";

  src = fetchurl {
    url = "https://github.com/usebruno/bruno/releases/download/v${version}/bruno_${version}_amd64_linux.deb";
-    hash = "sha256-vZNl5qdK8hztfGaQCL6RnWlL8hPJaL/GBh7AOT5D3Js=";
+    hash = "sha256-yCYI2c9M19d1+BpnM7YJLkZk8Vdix+YSWCa5qsCMBxw=";
  };

  nativeBuildInputs = [ autoPatchelfHook dpkg wrapGAppsHook ];
--- a/pkgs/by-name/co/convco/package.nix
+++ b/pkgs/by-name/co/convco/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "convco";
-  version = "0.4.3";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "convco";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-qf04mtxBqZy9kpFsqz8lVtyUzNtCYE8cNiVJVQ+sCn0=";
+    hash = "sha256-x01fkicoAH8NaJJqIF5jjbZ53TitnXBCdKEbr8xVCyE=";
  };

-  cargoHash = "sha256-A1z8ccdsaBC9gY4rD/0NnuQHm7x4eVlMPBvkMKGHK54=";
+  cargoHash = "sha256-j2xuaAkycWp5sCAmVJLYfqH1ZGxIGU/a/97WpGyQcvU=";

  nativeBuildInputs = [ cmake pkg-config ];

--- a/pkgs/by-name/de/debianutils/package.nix
+++ b/pkgs/by-name/de/debianutils/package.nix
@ -8,14 +8,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "debianutils";
-  version = "5.14";
+  version = "5.15";

  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "debian";
    repo = "debianutils";
    rev = "debian/${finalAttrs.version}";
-    hash = "sha256-gbqtBFWq6KtmGLvGkmhpSHkpoDglfAT1KjDoZ4Y0SbI=";
+    hash = "sha256-o9HPiJCKcTJSoVDCjUcYPkqa6wnAuvCFOFhPdPSKS3A=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fr/framework-system-tools/Cargo.lock
+++ b/pkgs/by-name/fr/framework-system-tools/Cargo.lock
--- a/pkgs/by-name/fr/framework-system-tools/package.nix
+++ b/pkgs/by-name/fr/framework-system-tools/package.nix
@ -1,45 +0,0 @@
-{ lib
-, fetchFromGitHub
-, rustPlatform
-, pkg-config
-, udev
-}:
-
-let
-  rev = "491a587342a5d79366a25d803b7065169314279c";
-in rustPlatform.buildRustPackage {
-  pname = "framework-system-tools";
-  version = "unstable-2023-11-14";
-
-  src = fetchFromGitHub {
-    owner = "FrameworkComputer";
-    repo = "framework-system";
-    inherit rev;
-    hash = "sha256-qDtW4DvY19enCfkOBRaako9ngAkmSreoNWlL4QE2FAk=";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    udev
-  ];
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "smbios-lib-0.9.1" = "sha256-3L8JaA75j9Aaqg1z9lVs61m6CvXDeQprEFRq+UDCHQo=";
-      "uefi-0.20.0" = "sha256-/3WNHuc27N89M7s+WT64SHyFOp7YRyzz6B+neh1vejY=";
-    };
-  };
-
-  meta = with lib; {
-    description = "Rust libraries and tools to interact with the framework system.";
-    homepage = "https://github.com/FrameworkComputer/framework-system";
-    mainProgram = "framework_tool";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ kloenk leona ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
--- a/pkgs/by-name/fr/framework-tool/package.nix
+++ b/pkgs/by-name/fr/framework-tool/package.nix
@ -1,6 +1,6 @@
 { lib, rustPlatform, fetchFromGitHub, pkg-config, udev }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
  pname = "framework-tool";

  # Latest stable version 0.1.0 has an ssh:// git URL in Cargo.lock,
@ -31,7 +31,7 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/FrameworkComputer/framework-system";
    license = licenses.bsd3;
    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ nickcao ];
+    maintainers = with maintainers; [ nickcao leona kloenk ];
    mainProgram = "framework_tool";
  };
 }
--- a/pkgs/by-name/hd/hdrop/package.nix
+++ b/pkgs/by-name/hd/hdrop/package.nix
@ -0,0 +1,52 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, makeWrapper
+, scdoc
+, coreutils
+, util-linux
+, jq
+, libnotify
+, withHyprland ? true
+, hyprland
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "hdrop";
+  version = "0.2.4";
+
+  src = fetchFromGitHub {
+    owner = "Schweber";
+    repo = "hdrop";
+    rev = "v${version}";
+    hash = "sha256-VsM1wPl8edAnZUvYw3IeOHw/XQ2pvbLt0v3G0B8+iSA=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    scdoc
+  ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    wrapProgram $out/bin/hdrop --prefix PATH ':' \
+      "${lib.makeBinPath ([
+        coreutils
+        util-linux
+        jq
+        libnotify
+      ]
+      ++ lib.optional withHyprland hyprland)}"
+  '';
+
+  meta = with lib; {
+    description = "Emulate 'tdrop' in Hyprland (run, show and hide specific programs per keybind)";
+    homepage = "https://github.com/Schweber/hdrop";
+    changelog = "https://github.com/Schweber/hdrop/releases/tag/v${version}";
+    license = licenses.agpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ Schweber ];
+    mainProgram = "hdrop";
+  };
+}
--- a/pkgs/by-name/i3/i3bar-river/package.nix
+++ b/pkgs/by-name/i3/i3bar-river/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "i3bar-river";
-  version = "0.1.5";
+  version = "0.1.6";

  src = fetchFromGitHub {
    owner = "MaxVerevkin";
    repo = "i3bar-river";
    rev = "v${version}";
-    hash = "sha256-AXa+K+njXkrJeqABD04WHpmvAzAL1Mw11ZhCfFNJxhY=";
+    hash = "sha256-wtyC8cGK408KZYpWniW2y4XI1ScTSBZJJlUt6b2Z5KA=";
  };

-  cargoHash = "sha256-tNuv+D75wox3HlUZSJJ67KEBKmGJXBkXHfvDsNHeM6A=";
+  cargoHash = "sha256-PdSMDsV3yFy3kSNS6OBxFdrZsIn70gXOTd2AhyU4a9o=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ pango ];
--- a/pkgs/by-name/no/nomnatong/package.nix
+++ b/pkgs/by-name/no/nomnatong/package.nix
@ -0,0 +1,51 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, python3Packages
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "nomnatong";
+  version = "5.07";
+
+  src = fetchFromGitHub {
+    owner = "nomfoundation";
+    repo = "font";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-31sqjOIrJByfTx4Ez6KvQDApCeVYMQnGeiM9INMR3zI=";
+  };
+
+  nativeBuildInputs = [
+    python3Packages.afdko
+    python3Packages.fonttools
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  buildPhase = ''
+    runHook preBuild
+
+    makeotf -r -f font.pfa -omitMacNames -ff features.txt -mf FontMenuNameDB -ga -ci UnicodeVariationSequences.txt
+    otf2ttf NomNaTong-Regular.otf
+    sfntedit -d DSIG NomNaTong-Regular.otf
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 NomNaTong-Regular.otf -t $out/share/fonts/opentype/
+    install -Dm444 NomNaTong-Regular.ttf -t $out/share/fonts/truetype/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "http://nomfoundation.org/nom-tools/Nom-Font";
+    description = "The Hán-Nôm Coded Character Set and Nom Na Tong Regular Reference Font";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ eclairevoyant ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/st/steamguard-cli/package.nix
+++ b/pkgs/by-name/st/steamguard-cli/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "steamguard-cli";
-  version = "0.12.3";
+  version = "0.12.5";

  src = fetchFromGitHub {
    owner = "dyc3";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-qfyo63u6gBkGNxVBmFsz9YXs6duRU/VnFly40C13vI8=";
+    hash = "sha256-YjJhCEg87xuUFjHD6cBN4dhQhx/c4F/XewyMYeA06+U=";
  };

-  cargoHash = "sha256-B8/WCSHC905wDxYGLYVMT0QxgMiGR0/VMVzOlyTKPss=";
+  cargoHash = "sha256-Z1KWU7Z9iGs5yjuWilMSYhfIilSW8ng+pq5ENfunINo=";

  nativeBuildInputs = [ installShellFiles ];
  postInstall = ''
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@ -17,13 +17,13 @@
 assert lib.elem lineEditingLibrary [ "isocline" "readline" ];
 stdenv.mkDerivation (finalAttrs: {
  pname = "trealla";
-  version = "2.30.7";
+  version = "2.31.6";

  src = fetchFromGitHub {
    owner = "trealla-prolog";
    repo = "trealla";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-W0hcIeWbgORWBYuNbVJRA8NNnuBEG8HMLeVBxXtd2VQ=";
+    hash = "sha256-gptWmATDwcSOUE5YYLEi6r/gVIVk0+nCeynxhD1ra/c=";
  };

  postPatch = ''
--- a/pkgs/by-name/ui/uiua/package.nix
+++ b/pkgs/by-name/ui/uiua/package.nix
@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "uiua";
-  version = "0.5.1";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "uiua-lang";
    repo = "uiua";
    rev = version;
-    hash = "sha256-xDHr3U+Lc/C2L7jER2VqJvvw9mxCkDzO+K8tzC4Fw2A=";
+    hash = "sha256-/yeLsuwEKw6+jBKd7CAnR9RuVaKwXjVpcvO3v0FaAck=";
  };

-  cargoHash = "sha256-9xjTXQJVGIvdx+SfJGPVa5Ax9wvS4Fms7blxAVrt6IY=";
+  cargoHash = "sha256-4tR1n96s91EFZLO4RIBpNKLjOSbGrBIApJrS60RBuQQ=";

  nativeBuildInputs = lib.optionals stdenv.isDarwin [
    rustPlatform.bindgenHook
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "uxn";
-  version = "unstable-2023-11-12";
+  version = "unstable-2023-12-05";

  src = fetchFromSourcehut {
    owner = "~rabbits";
    repo = "uxn";
-    rev = "86c46be310032bc6588bdc813fae1bc235fac60b";
-    hash = "sha256-qyFIJORrjONwyasDvO3COUcE4VJAjZEa3QJDQ+rhwqY=";
+    rev = "14bf95ba390f9cb84c23ed084b69787efe253e06";
+    hash = "sha256-oQAt9jDO0FZm6+6bBt/nDimkbiKsvuhsxnFcsNWvop8=";
  };

  outputs = [ "out" "projects" ];
--- a/pkgs/by-name/vi/vimix-cursors/package.nix
+++ b/pkgs/by-name/vi/vimix-cursors/package.nix
@ -0,0 +1,55 @@
+{ lib
+, fetchFromGitHub
+, stdenvNoCC
+, inkscape
+, python3Packages
+, xcursorgen
+}:
+stdenvNoCC.mkDerivation {
+  pname = "vimix-cursors";
+  version = "2020-02-24-unstable-2021-09-18";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = "vimix-cursors";
+    rev = "9bc292f40904e0a33780eda5c5d92eb9a1154e9c";
+    hash = "sha256-zW7nJjmB3e+tjEwgiCrdEe5yzJuGBNdefDdyWvgYIUU=";
+  };
+
+  nativeBuildInputs = [
+    inkscape
+    python3Packages.cairosvg
+    xcursorgen
+  ];
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    HOME="$NIX_BUILD_ROOT" ./build.sh
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -dm 755 $out/share/icons
+    for color in "" "-white"; do
+      cp -pr "dist$color/"  "$out/share/icons/Vimix$color-cursors"
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An X cursor theme inspired by Materia design";
+    homepage = "https://github.com/vinceliuice/Vimix-cursors";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ambroisie ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/Cargo.lock
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/Cargo.lock
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@ -0,0 +1,61 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, mesa
+, libglvnd
+, libxkbcommon
+, pipewire
+, wayland
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "xdg-desktop-portal-cosmic";
+  version = "unstable-2023-12-07";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "23b3e5a1b9fa76e30266f29949d54e97c2fadf6e";
+    hash = "sha256-AqwJ3bV8Xz0MpY/ZmWgE9vNJIACX5SVeIYbSewyG/Bs=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "smithay-client-toolkit-0.18.0" = "sha256-2WbDKlSGiyVmi7blNBr2Aih9FfF2dq/bny57hoA4BrE=";
+      "cosmic-protocols-0.1.0" = "sha256-AEgvF7i/OWPdEMi8WUaAg99igBwE/AexhAXHxyeJMdc=";
+      "ashpd-0.7.0" = "sha256-jBuxKJ2ADBvkJPPv4gzmFlZFybrfZBkCjerzeKe2Tt4=";
+      "libspa-0.7.2" = "sha256-QWOcNWzEyxfTdjUIB33s9dpWJ7Fsfmb5jd70CXOP/bw=";
+    };
+  };
+
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [ rustPlatform.bindgenHook pkg-config ];
+  buildInputs = [ libglvnd libxkbcommon mesa pipewire wayland ];
+
+  # Force linking to libEGL, which is always dlopen()ed, and to
+  # libwayland-client, which is always dlopen()ed except by the
+  # obscure winit backend.
+  RUSTFLAGS = map (a: "-C link-arg=${a}") [
+    "-Wl,--push-state,--no-as-needed"
+    "-lEGL"
+    "-lwayland-client"
+    "-Wl,--pop-state"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share/{dbus-1/services,xdg-desktop-portal/portals}
+    cp data/*.service $out/share/dbus-1/services/
+    cp data/cosmic.portal $out/share/xdg-desktop-portal/portals/
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/xdg-desktop-portal-cosmic";
+    description = "XDG Desktop Portal for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/xo/xorriso/package.nix
+++ b/pkgs/by-name/xo/xorriso/package.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xorriso";
-  version = "1.5.7";
+  version = "1.5.7-unstable-2023-12-06";

  src = fetchurl {
-    url = "https://www.gnu.org/software/xorriso/xorriso-${finalAttrs.version}.tar.gz";
-    hash = "sha256-hnV3w4f2tKmjIk60Qd7Y+xY432y8Bg+NGh5dAPMY9QI=";
+    url = "https://web.archive.org/web/20231206123448/https://www.gnu.org/software/xorriso/xorriso-1.5.7.tar.gz";
+    hash = "sha256-B7lV3n3e1aF7yJsLxwi8C8m3sBmUUePpCV9KfWRuTm0=";
  };

  buildInputs = [
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@ -3,12 +3,12 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20231201183121";
+    version = "20231208065009";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      hash = "sha256-BOq4hT8K+m/bdAj6f1TbT3BvAn05bH3EdphcaWqFYFk=";
+      hash = "sha256-Z5yUtkumr/JuKzq47QdPuHSJOSxD2XsK9sYE1hUhoyY=";
    };
    vendorHash = "sha256-6167kRAC5m5FlBr7uk+qKUcjWsb45P5Vvovyb6hHSVQ=";
    meta = with lib; {
--- a/pkgs/desktops/gnome/misc/pomodoro/default.nix
+++ b/pkgs/desktops/gnome/misc/pomodoro/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-pomodoro";
-  version = "0.24.0";
+  version = "0.24.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    hash = "sha256-Yn0lDCFpc8o25iiPib1n1NEBeodNAdTzRWcnLbXUA5g=";
+    hash = "sha256-Ml3znMz1Q9593rMgfAST8k9QglxMG9ocFD7W8kaFWCw=";
  };

  patches = [
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ b/pkgs/development/compilers/llvm/17/default.nix
@ -25,7 +25,7 @@
  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
  # }
-, officialRelease ? { version = "17.0.2"; sha256 = "08w6mksm7mkws3hhhsy5gg881b4whr6abrshmh6q4c32qlni94nn"; }
+, officialRelease ? { version = "17.0.6"; sha256 = "sha256-8MEDLLhocshmxoEBRSKlJ/GzJ8nfuzQ8qn0X/vLA+ag="; }
  # i.e.:
  # {
  #   version = /* i.e. "15.0.0" */;
--- a/pkgs/development/interpreters/wamr/default.nix
+++ b/pkgs/development/interpreters/wamr/default.nix
@ -6,18 +6,24 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "wamr";
-  version = "1.2.3";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasm-micro-runtime";
    rev = "WAMR-${finalAttrs.version}";
-    hash = "sha256-bnia0ORC0YajO7I3XDMdpjlktDqOiXDlGcf12N1G+eg=";
+    hash = "sha256-h+IwCdufimmkVk2XUAFtDcV+5dJWohRc1kmh3zgDKIg=";
  };

  nativeBuildInputs = [ cmake ];

-  sourceRoot = "${finalAttrs.src.name}/product-mini/platforms/linux";
+  sourceRoot = let
+    platform = if stdenv.isLinux then
+        "linux"
+      else if stdenv.isDarwin then
+        "darwin"
+      else throw "unsupported platform";
+  in "${finalAttrs.src.name}/product-mini/platforms/${platform}";

  meta = with lib; {
    description = "WebAssembly Micro Runtime";
--- a/pkgs/development/libraries/clucene-core/default.nix
+++ b/pkgs/development/libraries/clucene-core/default.nix
@ -1,35 +0,0 @@
-{lib, stdenv, fetchurl}:
-
-stdenv.mkDerivation rec {
-  pname = "clucene-core";
-  version = "0.9.21b";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/clucene/clucene-core-${version}.tar.bz2";
-    sha256 = "202ee45af747f18642ae0a088d7c4553521714a511a1a9ec99b8144cf9928317";
-  };
-
-  patches = [ ./gcc6.patch ];
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-std=c++11"
-  ];
-
-  meta = with lib; {
-    broken = stdenv.isDarwin;
-    description = "Core library for full-featured text search engine";
-    longDescription = ''
-      CLucene is a high-performance, scalable, cross platform, full-featured,
-      open-source indexing and searching API. Specifically, CLucene is the guts
-      of a search engine, the hard stuff. You write the easy stuff: the UI and
-      the process of selecting and parsing your data files to pump them into
-      the search engine yourself, and any specialized queries to pull it back
-      for display or further processing.
-
-      CLucene is a port of the very popular Java Lucene text search engine API.
-    '';
-    homepage = "https://clucene.sourceforge.net";
-    platforms = platforms.unix;
-    license = with licenses; [ asl20 lgpl2 ];
-  };
-}
--- a/pkgs/development/libraries/clucene-core/gcc6.patch
+++ b/pkgs/development/libraries/clucene-core/gcc6.patch
@ -1,146 +0,0 @@
-https://bugzilla.redhat.com/show_bug.cgi?id=998477
-
-diff -up clucene-core-0.9.21b/src/CLucene/debug/lucenebase.h.gcc48 clucene-core-0.9.21b/src/CLucene/debug/lucenebase.h
--- clucene-core-0.9.21b/src/CLucene/debug/lucenebase.h.gcc48	2008-10-23 12:44:35.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/debug/lucenebase.h	2013-08-27 13:17:35.754234297 -0500
-@@ -58,7 +58,7 @@ public:
- 		__cl_refcount--;
- 		return __cl_refcount;
- 	}
-    virtual ~LuceneBase(){};
-+    virtual ~LuceneBase() throw(CLuceneError&) {};
- };
- 
- class LuceneVoidBase{
-diff -up clucene-core-0.9.21b/src/CLucene/index/CompoundFile.cpp.gcc48 clucene-core-0.9.21b/src/CLucene/index/CompoundFile.cpp
--- clucene-core-0.9.21b/src/CLucene/index/CompoundFile.cpp.gcc48	2013-08-27 13:17:35.754234297 -0500
-+++ clucene-core-0.9.21b/src/CLucene/index/CompoundFile.cpp	2013-08-27 13:18:02.844949386 -0500
-@@ -94,7 +94,7 @@ CompoundFileReader::CompoundFileReader(D
-    )
- }
- 
-CompoundFileReader::~CompoundFileReader(){
-+CompoundFileReader::~CompoundFileReader() throw(CLuceneError&) {
- 	close();
- }
- 
-diff -up clucene-core-0.9.21b/src/CLucene/index/CompoundFile.h.gcc48 clucene-core-0.9.21b/src/CLucene/index/CompoundFile.h
--- clucene-core-0.9.21b/src/CLucene/index/CompoundFile.h.gcc48	2008-10-23 12:44:37.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/index/CompoundFile.h	2013-08-27 13:17:35.755234286 -0500
-@@ -95,7 +95,7 @@ protected:
- 
- public:
- 	CompoundFileReader(CL_NS(store)::Directory* dir, char* name);
-	~CompoundFileReader();
-+	~CompoundFileReader() throw(CLuceneError&);
- 	CL_NS(store)::Directory* getDirectory();
- 	const char* getName() const;
- 
-diff -up clucene-core-0.9.21b/src/CLucene/index/Term.cpp.gcc48 clucene-core-0.9.21b/src/CLucene/index/Term.cpp
--- clucene-core-0.9.21b/src/CLucene/index/Term.cpp.gcc48	2008-10-23 12:44:37.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/index/Term.cpp	2013-08-27 13:17:35.755234286 -0500
-@@ -81,7 +81,7 @@ Term::Term(const TCHAR* fld, const TCHAR
-     set(fld,txt);
- }
- 
-Term::~Term(){
-+Term::~Term() throw (CLuceneError&) {
- //Func - Destructor.
- //Pre  - true
- //Post - The instance has been destroyed. field and text have been deleted if pre(intrn) is false
-diff -up clucene-core-0.9.21b/src/CLucene/index/Term.h.gcc48 clucene-core-0.9.21b/src/CLucene/index/Term.h
--- clucene-core-0.9.21b/src/CLucene/index/Term.h.gcc48	2008-10-23 12:44:37.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/index/Term.h	2013-08-27 13:17:35.755234286 -0500
-@@ -68,7 +68,7 @@ class Term:LUCENE_REFBASE {
- 	Term(const TCHAR* fld, const TCHAR* txt);
- 	
- 	///Destructor.
-	~Term();
-+	~Term() throw(CLuceneError&);
- 
- 	///Returns the field of this term, an interned string. The field indicates
- 	///the part of a document which this term came from. 
-diff -up clucene-core-0.9.21b/src/CLucene/store/Directory.h.gcc48 clucene-core-0.9.21b/src/CLucene/store/Directory.h
--- clucene-core-0.9.21b/src/CLucene/store/Directory.h.gcc48	2008-10-23 12:44:36.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/store/Directory.h	2013-08-27 13:17:35.756234276 -0500
-@@ -41,7 +41,7 @@ CL_NS_DEF(store)
- 	public:
- 		DEFINE_MUTEX(THIS_LOCK)
- 	   
-		virtual ~Directory(){ };
-+		virtual ~Directory() throw(CLuceneError&) { };
- 
- 		// Returns an null terminated array of strings, one for each file in the directory. 
- 		char** list() const{
-diff -up clucene-core-0.9.21b/src/CLucene/store/FSDirectory.cpp.gcc48 clucene-core-0.9.21b/src/CLucene/store/FSDirectory.cpp
--- clucene-core-0.9.21b/src/CLucene/store/FSDirectory.cpp.gcc48	2008-10-23 13:01:52.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/store/FSDirectory.cpp	2013-08-27 13:17:35.756234276 -0500
-@@ -368,7 +368,7 @@ void FSDirectory::FSIndexInput::readInte
-       strcat(buffer,name);
-   }
- 
-  FSDirectory::~FSDirectory(){
-+  FSDirectory::~FSDirectory() throw(CLuceneError&) {
-   }
- 
-   void FSDirectory::list(vector<string>* names) const{ //todo: fix this, ugly!!!
-diff -up clucene-core-0.9.21b/src/CLucene/store/FSDirectory.h.gcc48 clucene-core-0.9.21b/src/CLucene/store/FSDirectory.h
--- clucene-core-0.9.21b/src/CLucene/store/FSDirectory.h.gcc48	2008-10-23 13:00:43.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/store/FSDirectory.h	2013-08-27 13:17:35.756234276 -0500
-@@ -155,7 +155,7 @@
- 	  ///Destructor - only call this if you are sure the directory
- 	  ///is not being used anymore. Otherwise use the ref-counting
- 	  ///facilities of _CLDECDELETE
-		~FSDirectory();
-+		~FSDirectory() throw(CLuceneError&);
- 
- 		/// Get a list of strings, one for each file in the directory. 
- 		void list(vector<string>* names) const;
-diff -up clucene-core-0.9.21b/src/CLucene/store/RAMDirectory.cpp.gcc48 clucene-core-0.9.21b/src/CLucene/store/RAMDirectory.cpp
--- clucene-core-0.9.21b/src/CLucene/store/RAMDirectory.cpp.gcc48	2008-10-23 12:44:36.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/store/RAMDirectory.cpp	2013-08-27 13:17:35.757234265 -0500
-@@ -219,7 +219,7 @@ CL_NS_DEF(store)
-   {
-   }
-   
-  RAMDirectory::~RAMDirectory(){
-+  RAMDirectory::~RAMDirectory() throw(CLuceneError&) {
-    //todo: should call close directory?
-   }
- 
-diff -up clucene-core-0.9.21b/src/CLucene/store/RAMDirectory.h.gcc48 clucene-core-0.9.21b/src/CLucene/store/RAMDirectory.h
--- clucene-core-0.9.21b/src/CLucene/store/RAMDirectory.h.gcc48	2008-10-23 12:44:36.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/store/RAMDirectory.h	2013-08-27 13:17:35.757234265 -0500
-@@ -131,7 +131,7 @@ CL_NS_DEF(store)
- 	  ///Destructor - only call this if you are sure the directory
- 	  ///is not being used anymore. Otherwise use the ref-counting
- 	  ///facilities of dir->close
-		virtual ~RAMDirectory();
-+		virtual ~RAMDirectory() throw(CLuceneError&);
- 		RAMDirectory(Directory* dir);
- 		
- 	  /**
-diff -up clucene-core-0.9.21b/src/CLucene/store/TransactionalRAMDirectory.cpp.gcc48 clucene-core-0.9.21b/src/CLucene/store/TransactionalRAMDirectory.cpp
--- clucene-core-0.9.21b/src/CLucene/store/TransactionalRAMDirectory.cpp.gcc48	2008-10-23 12:44:36.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/store/TransactionalRAMDirectory.cpp	2013-08-27 13:17:35.757234265 -0500
-@@ -16,7 +16,7 @@ CL_NS_USE(util)
-   {
-     transOpen = false;
-   }
-  TransactionalRAMDirectory::~TransactionalRAMDirectory(){
-+  TransactionalRAMDirectory::~TransactionalRAMDirectory() throw(CLuceneError&) {
-   }
- 
-   bool TransactionalRAMDirectory::archiveOrigFileIfNecessary(const char* name) {
-diff -up clucene-core-0.9.21b/src/CLucene/store/TransactionalRAMDirectory.h.gcc48 clucene-core-0.9.21b/src/CLucene/store/TransactionalRAMDirectory.h
--- clucene-core-0.9.21b/src/CLucene/store/TransactionalRAMDirectory.h.gcc48	2008-10-23 12:44:36.000000000 -0500
-+++ clucene-core-0.9.21b/src/CLucene/store/TransactionalRAMDirectory.h	2013-08-27 13:17:35.757234265 -0500
-@@ -44,7 +44,7 @@ CL_NS_DEF(store)
- 
-   public:
-     TransactionalRAMDirectory();
-    virtual ~TransactionalRAMDirectory();
-+    virtual ~TransactionalRAMDirectory() throw(CLuceneError&);
- 
-     bool transIsOpen() const;
-     void transStart();
--- a/pkgs/development/libraries/glfw/3.x.nix
+++ b/pkgs/development/libraries/glfw/3.x.nix
@ -19,21 +19,22 @@ stdenv.mkDerivation rec {
  # Fix linkage issues on X11 (https://github.com/NixOS/nixpkgs/issues/142583)
  patches = lib.optional (!waylandSupport) ./x11.patch;

-  propagatedBuildInputs = [ (if stdenv.isDarwin then OpenGL else libGL) ];
+  propagatedBuildInputs =
+    lib.optionals stdenv.isDarwin [ OpenGL ]
+    ++ lib.optionals stdenv.isLinux [ libGL ];

  nativeBuildInputs = [ cmake ]
    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames
    ++ lib.optional waylandSupport extra-cmake-modules;

  buildInputs =
-    if waylandSupport
-    then [ wayland wayland-protocols libxkbcommon ]
-    else [ libX11 libXrandr libXinerama libXcursor libXi libXext ]
-         ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa Kernel ];
+    lib.optionals stdenv.isDarwin [ Carbon Cocoa Kernel ]
+    ++ lib.optionals (stdenv.isLinux && waylandSupport) [ wayland wayland-protocols libxkbcommon ]
+    ++ lib.optionals (stdenv.isLinux && !waylandSupport) [ libX11 libXrandr libXinerama libXcursor libXi libXext ];

  cmakeFlags = [
    "-DBUILD_SHARED_LIBS=ON"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
+  ] ++ lib.optionals (!stdenv.isDarwin && !stdenv.hostPlatform.isWindows) [
    "-DCMAKE_C_FLAGS=-D_GLFW_GLX_LIBRARY='\"${lib.getLib libGL}/lib/libGL.so.1\"'"
  ] ++ lib.optionals waylandSupport [
    "-DGLFW_USE_WAYLAND=ON"
@ -50,6 +51,6 @@ stdenv.mkDerivation rec {
    homepage = "https://www.glfw.org/";
    license = licenses.zlib;
    maintainers = with maintainers; [ marcweber twey ];
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
  };
 }
--- a/pkgs/development/libraries/libdatachannel/default.nix
+++ b/pkgs/development/libraries/libdatachannel/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "libdatachannel";
-  version = "0.19.3";
+  version = "0.19.4";

  src = fetchFromGitHub {
    owner = "paullouisageneau";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Cx+AfoeLOcqlrEVNuvMPJaY6K7ufu07p9XdjNwtPYf0=";
+    hash = "sha256-XtD46tEV6RU1xbQgGA/nP6zWMgnZkOffVPdl8t/hIiA=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/paho-mqtt-cpp/default.nix
+++ b/pkgs/development/libraries/paho-mqtt-cpp/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "paho.mqtt.cpp";
-  version = "1.3.0";
+  version = "1.3.2";

  src = fetchFromGitHub {
    owner = "eclipse";
    repo = "paho.mqtt.cpp";
    rev = "v${version}";
-    hash = "sha256-QV6r4GzSVghgVQtF8OQ1a23PtCdjg7PeuGRBdA+WbE0=";
+    hash = "sha256-c2umToT4w+L7bgzp1bCEcb0ECHvxKZ2t6JI5SmUySPo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/xdg-desktop-portal/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal/default.nix
@ -117,6 +117,12 @@ stdenv.mkDerivation (finalAttrs: {
  preCheck = ''
    # For test_trash_file
    export HOME=$(mktemp -d)
+
+    # Upstream disables a few tests in CI upstream as they are known to
+    # be flaky. Let's disable those downstream as hydra exhibits similar
+    # flakes:
+    #   https://github.com/NixOS/nixpkgs/pull/270085#issuecomment-1840053951
+    export TEST_IN_CI=1
  '';

  passthru = {
--- a/pkgs/development/misc/datafusion/default.nix
+++ b/pkgs/development/misc/datafusion/default.nix
@ -7,19 +7,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "datafusion-cli";
-  version = "32.0.0";
+  version = "33.0.0";

  src = fetchFromGitHub {
    name = "datafusion-cli-source";
    owner = "apache";
    repo = "arrow-datafusion";
    rev = version;
-    sha256 = "sha256-QJOv2neEOxLvWoGuS3QyBqGOBi1KJQ8feK6LOrHBL8g=";
+    sha256 = "sha256-ywyzvk50Fr9TSaCrqd14lSi1PJ9ggA1YQ/X0aFGFk1M=";
  };

  sourceRoot = "${src.name}/datafusion-cli";

-  cargoHash = "sha256-NYdxDFUBOBC3nTZB8STdZfOz3Dw0htFCqE0qBRMzQvw=";
+  cargoHash = "sha256-0a/O9nNi3JLufQxG+5EgCXtV0y03X7R6UY+f/tVGB90=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Security
--- a/pkgs/development/python-modules/aioresponses/default.nix
+++ b/pkgs/development/python-modules/aioresponses/default.nix
@ -49,6 +49,5 @@ buildPythonPackage rec {
    description = "A helper to mock/fake web requests in python aiohttp package";
    homepage = "https://github.com/pnuckowski/aioresponses";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ rvl ];
  };
 }
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "boschshcpy";
-  version = "0.2.79";
+  version = "0.2.83";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "tschamm";
    repo = pname;
    rev = version;
-    hash = "sha256-boz4CiAmB9guhM9irW3m2ZRlt4mmcopWD+/3Y6O/Mxk=";
+    hash = "sha256-tpncBgKUf2jRmvcHgi2fudTGdCEv0AhHUWD1sPO98/I=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/bugwarrior/default.nix
+++ b/pkgs/development/python-modules/bugwarrior/default.nix
@ -23,7 +23,7 @@ buildPythonPackage rec {
  doCheck = false;

  meta = with lib; {
-    homepage = "https://github.com/ralphbean/bugwarrior";
+    homepage = "https://github.com/GothenburgBitFactory/bugwarrior";
    description = "Sync github, bitbucket, bugzilla, and trac issues with taskwarrior";
    license = licenses.gpl3Plus;
    platforms = platforms.all;
--- a/pkgs/development/python-modules/cld2-cffi/default.nix
+++ b/pkgs/development/python-modules/cld2-cffi/default.nix
@ -22,6 +22,5 @@ buildPythonPackage rec {
    description = "CFFI bindings around Google Chromium's embedded compact language detection library (CLD2)";
    homepage = "https://github.com/GregBowyer/cld2-cffi";
    license = licenses.asl20;
-    maintainers = with maintainers; [ rvl ];
  };
 }
--- a/pkgs/development/python-modules/cobs/default.nix
+++ b/pkgs/development/python-modules/cobs/default.nix
@ -38,6 +38,6 @@ buildPythonPackage rec {
    '';
    homepage = "https://github.com/cmcqueen/cobs-python/";
    license = licenses.mit;
-    maintainers = [ teams.ororatech ];
+    maintainers = teams.ororatech.members;
  };
 }
--- a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
+++ b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
@ -23,7 +23,7 @@

 buildPythonPackage rec {
  pname = "cyclonedx-python-lib";
-  version = "5.1.1";
+  version = "5.2.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -32,7 +32,7 @@ buildPythonPackage rec {
    owner = "CycloneDX";
    repo = "cyclonedx-python-lib";
    rev = "refs/tags/v${version}";
-    hash = "sha256-M3aR3lCNtPIve1o16QLSnxrULhtXkuOXNYtOv2FmPMQ=";
+    hash = "sha256-xgHS2QRzzn6pSremZ8gO4SZxD3qSea9oKDJv4Tk6+VQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/dronecan/default.nix
+++ b/pkgs/development/python-modules/dronecan/default.nix
@ -31,6 +31,6 @@ buildPythonPackage rec {
    '';
    homepage = "https://dronecan.github.io/";
    license = licenses.mit;
-    maintainers = [ teams.ororatech ];
+    maintainers = teams.ororatech.members;
  };
 }
--- a/pkgs/development/python-modules/guppy3/default.nix
+++ b/pkgs/development/python-modules/guppy3/default.nix
@ -7,15 +7,15 @@

 buildPythonPackage rec {
  pname = "guppy3";
-  version = "3.1.4";
+  version = "3.1.4.post1";
  format = "setuptools";
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "zhuyifei1999";
    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-RMWIP4tVSCCEQpr0kZvsN1HwL6rBcLuubfBl175eSNg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-HHy57P6WEHZKygAbdjEh6XAApFlQueiYGr02eSQMWfc=";
  };

  propagatedBuildInputs = [ tkinter ];
--- a/Show More
+++ b/Show More