Merge master into staging-next

maintainers/maintainer-list.nix

@@ -4453,6 +4453,12 @@
     githubId = 103082;
     name = "Ed Brindley";
   };
+  elesiuta = {
+    email = "elesiuta@gmail.com";
+    github = "elesiuta";
+    githubId = 8146662;
+    name = "Eric Lesiuta";
+  };
   eliandoran = {
     email = "contact@eliandoran.me";
     name = "Elian Doran";
@@ -6528,6 +6534,11 @@
     github = "icewind1991";
     githubId = 1283854;
   };
+  icyrockcom = {
+    github = "icyrockcom";
+    githubId = 785140;
+    name = "icyrock";
+  };
   icy-thought = {
     name = "Icy-Thought";
     email = "gilganyx@pm.me";
@@ -6691,6 +6702,12 @@
     githubId = 55066419;
     name = "Emily Lange";
   };
+  indexyz = {
+    email = "indexyz@pm.me";
+    github = "5aaee9";
+    githubId = 7685264;
+    name = "Indexyz";
+  };
   ineol = {
     email = "leo.stefanesco@gmail.com";
     github = "ineol";
@@ -15514,6 +15531,12 @@
     githubId = 3268082;
     name = "Thibaut Marty";
   };
+  thielema = {
+    name = "Henning Thielemann";
+    email = "nix@henning-thielemann.de";
+    github = "thielema";
+    githubId = 898989;
+  };
   thled = {
     name = "Thomas Le Duc";
     email = "dev@tleduc.de";

maintainers/scripts/haskell/mark-broken.sh

@@ -32,8 +32,6 @@ EOF
 sort -iu "$tmpfile" >> "$broken_config"
 clear="env -u HOME -u NIXPKGS_CONFIG"
 $clear maintainers/scripts/haskell/regenerate-hackage-packages.sh
-$clear maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
-$clear maintainers/scripts/haskell/regenerate-hackage-packages.sh
 evalline=$(maintainers/scripts/haskell/hydra-report.hs eval-info)
 
 if [[ "${1:-}" == "--do-commit" ]]; then

maintainers/scripts/haskell/regenerate-hackage-packages.sh

@@ -1,22 +1,69 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -i bash -p coreutils haskellPackages.cabal2nix-unstable git nix -I nixpkgs=.
 
-# This script is used to regenerate nixpkgs' Haskell package set, using the
-# tool hackage2nix from the nixos/cabal2nix repo. hackage2nix looks at the
-# config files in pkgs/development/haskell-modules/configuration-hackage2nix
-# and generates a Nix expression for package version specified there, using the
-# Cabal files from the Hackage database (available under all-cabal-hashes) and
-# its companion tool cabal2nix.
-#
-# Related scripts are update-hackage.sh, for updating the snapshot of the
-# Hackage database used by hackage2nix, and update-cabal2nix-unstable.sh,
-# for updating the version of hackage2nix used to perform this task.
-#
-# Note that this script doesn't gcroot anything, so it may be broken by an
-# unfortunately timed nix-store --gc.
-
 set -euo pipefail
 
+self=$0
+
+print_help () {
+cat <<END_HELP
+Usage: $self [options]
+
+Options:
+   --do-commit    Commit changes to this file.
+   -f | --fast    Do not update the transitive-broken.yaml file.
+   -h | --help    Show this help.
+
+This script is used to regenerate nixpkgs' Haskell package set, using the
+tool hackage2nix from the nixos/cabal2nix repo. hackage2nix looks at the
+config files in pkgs/development/haskell-modules/configuration-hackage2nix
+and generates a Nix expression for package version specified there, using the
+Cabal files from the Hackage database (available under all-cabal-hashes) and
+its companion tool cabal2nix.
+
+Unless --fast is used, it will then use the generated nix expression by
+running regenerate-transitive-broken-packages.sh which updates the transitive-broken.yaml
+file. Then it re-runs hackage2nix.
+
+Related scripts are update-hackage.sh, for updating the snapshot of the
+Hackage database used by hackage2nix, and update-cabal2nix-unstable.sh,
+for updating the version of hackage2nix used to perform this task.
+
+Note that this script doesn't gcroot anything, so it may be broken by an
+unfortunately timed nix-store --gc.
+
+END_HELP
+}
+
+DO_COMMIT=0
+REGENERATE_TRANSITIVE=1
+
+options=$(getopt -o "fh" -l "help,fast,do-commit" -- "$@")
+
+eval set -- "$options"
+
+while true; do
+   case "$1" in
+      --do-commit)
+         DO_COMMIT=1
+         ;;
+      -f|--fast)
+         REGENERATE_TRANSITIVE=0
+         ;;
+      -h|--help)
+         print_help
+         exit 0
+         ;;
+      --)
+         break;;
+      *)
+         print_help
+         exit 1
+         ;;
+   esac
+   shift
+done
+
 HACKAGE2NIX="${HACKAGE2NIX:-hackage2nix}"
 
 # To prevent hackage2nix fails because of encoding.
@@ -25,14 +72,7 @@ export LC_ALL=C.UTF-8
 
 config_dir=pkgs/development/haskell-modules/configuration-hackage2nix
 
-echo "Obtaining Hackage data"
-extraction_derivation='with import ./. {}; runCommandLocal "unpacked-cabal-hashes" { } "tar xf ${all-cabal-hashes} --strip-components=1 --one-top-level=$out"'
-unpacked_hackage="$(nix-build -E "$extraction_derivation" --no-out-link)"
-
-echo "Generating compiler configuration"
-compiler_config="$(nix-build -A haskellPackages.cabal2nix-unstable.compilerConfig --no-out-link)"
-
-echo "Starting hackage2nix to regenerate pkgs/development/haskell-modules/hackage-packages.nix ..."
+run_hackage2nix() {
 "$HACKAGE2NIX" \
    --hackage "$unpacked_hackage" \
    --preferred-versions <(for n in "$unpacked_hackage"/*/preferred-versions; do cat "$n"; echo; done) \
@@ -42,8 +82,33 @@ echo "Starting hackage2nix to regenerate pkgs/development/haskell-modules/hackag
    --config "$config_dir/stackage.yaml" \
    --config "$config_dir/broken.yaml" \
    --config "$config_dir/transitive-broken.yaml"
+}
 
-if [[ "${1:-}" == "--do-commit" ]]; then
+echo "Obtaining Hackage data …"
+extraction_derivation='with import ./. {}; runCommandLocal "unpacked-cabal-hashes" { } "tar xf ${all-cabal-hashes} --strip-components=1 --one-top-level=$out"'
+unpacked_hackage="$(nix-build -E "$extraction_derivation" --no-out-link)"
+
+echo "Generating compiler configuration …"
+compiler_config="$(nix-build -A haskellPackages.cabal2nix-unstable.compilerConfig --no-out-link)"
+
+echo "Running hackage2nix to regenerate pkgs/development/haskell-modules/hackage-packages.nix …"
+run_hackage2nix
+
+if [[ "$REGENERATE_TRANSITIVE" -eq 1 ]]; then
+
+echo "Regenerating transitive-broken.yaml … (pass --fast to $self to skip this step)"
+
+maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
+
+echo "Running hackage2nix again to reflect changes in transitive-broken.yaml …"
+
+run_hackage2nix
+
+fi
+
+
+if [[ "$DO_COMMIT" -eq 1 ]]; then
+git add pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
 git add pkgs/development/haskell-modules/hackage-packages.nix
 git commit -F - << EOF
 haskellPackages: regenerate package set based on current config

maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh

@@ -11,5 +11,4 @@ cat > $config_file << EOF
 dont-distribute-packages:
 EOF
 
-echo "Regenerating list of transitive broken packages ..."
 nix-instantiate --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort -i >> $config_file

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -117,6 +117,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [woodpecker-server](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable).
 
+- [lldap](https://github.com/lldap/lldap), a lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication. Available as [services.lldap](#opt-services.lldap.enable).
+
 - [ReGreet](https://github.com/rharish101/ReGreet), a clean and customizable greeter for greetd. Available as [programs.regreet](#opt-programs.regreet.enable).
 
 - [v4l2-relayd](https://git.launchpad.net/v4l2-relayd), a streaming relay for v4l2loopback using gstreamer. Available as [services.v4l2-relayd](#opt-services.v4l2-relayd.instances._name_.enable).

nixos/modules/module-list.nix

@@ -396,6 +396,7 @@
   ./services/databases/hbase-standalone.nix
   ./services/databases/influxdb.nix
   ./services/databases/influxdb2.nix
+  ./services/databases/lldap.nix
   ./services/databases/memcached.nix
   ./services/databases/monetdb.nix
   ./services/databases/mongodb.nix
@@ -960,6 +961,7 @@
   ./services/networking/pdns-recursor.nix
   ./services/networking/pdnsd.nix
   ./services/networking/peroxide.nix
+  ./services/networking/picosnitch.nix
   ./services/networking/pixiecore.nix
   ./services/networking/pleroma.nix
   ./services/networking/polipo.nix

nixos/modules/services/databases/lldap.nix

@@ -0,0 +1,121 @@
+{ config, lib, pkgs, utils, ... }:
+
+let
+  cfg = config.services.lldap;
+  format = pkgs.formats.toml { };
+in
+{
+  options.services.lldap = with lib; {
+    enable = mkEnableOption (mdDoc "lldap");
+
+    package = mkPackageOptionMD pkgs "lldap" { };
+
+    environment = mkOption {
+      type = with types; attrsOf str;
+      default = { };
+      example = {
+        LLDAP_JWT_SECRET_FILE = "/run/lldap/jwt_secret";
+        LLDAP_LDAP_USER_PASS_FILE = "/run/lldap/user_password";
+      };
+      description = lib.mdDoc ''
+        Environment variables passed to the service.
+        Any config option name prefixed with `LLDAP_` takes priority over the one in the configuration file.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = lib.mdDoc ''
+        Environment file as defined in {manpage}`systemd.exec(5)` passed to the service.
+      '';
+    };
+
+    settings = mkOption {
+      description = mdDoc ''
+        Free-form settings written directly to the `lldap_config.toml` file.
+        Refer to <https://github.com/lldap/lldap/blob/main/lldap_config.docker_template.toml> for supported values.
+      '';
+
+      default = { };
+
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          ldap_host = mkOption {
+            type = types.str;
+            description = mdDoc "The host address that the LDAP server will be bound to.";
+            default = "::";
+          };
+
+          ldap_port = mkOption {
+            type = types.port;
+            description = mdDoc "The port on which to have the LDAP server.";
+            default = 3890;
+          };
+
+          http_host = mkOption {
+            type = types.str;
+            description = mdDoc "The host address that the HTTP server will be bound to.";
+            default = "::";
+          };
+
+          http_port = mkOption {
+            type = types.port;
+            description = mdDoc "The port on which to have the HTTP server, for user login and administration.";
+            default = 17170;
+          };
+
+          http_url = mkOption {
+            type = types.str;
+            description = mdDoc "The public URL of the server, for password reset links.";
+            default = "http://localhost";
+          };
+
+          ldap_base_dn = mkOption {
+            type = types.str;
+            description = mdDoc "Base DN for LDAP.";
+            example = "dc=example,dc=com";
+          };
+
+          ldap_user_dn = mkOption {
+            type = types.str;
+            description = mdDoc "Admin username";
+            default = "admin";
+          };
+
+          ldap_user_email = mkOption {
+            type = types.str;
+            description = mdDoc "Admin email.";
+            default = "admin@example.com";
+          };
+
+          database_url = mkOption {
+            type = types.str;
+            description = mdDoc "Database URL.";
+            default = "sqlite://./users.db?mode=rwc";
+            example = "postgres://postgres-user:password@postgres-server/my-database";
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.lldap = {
+      description = "Lightweight LDAP server (lldap)";
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} run --config-file ${format.generate "lldap_config.toml" cfg.settings}";
+        StateDirectory = "lldap";
+        WorkingDirectory = "%S/lldap";
+        User = "lldap";
+        Group = "lldap";
+        DynamicUser = true;
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+      };
+      inherit (cfg) environment;
+    };
+  };
+}

nixos/modules/services/networking/picosnitch.nix

@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.picosnitch;
+in
+{
+  options.services.picosnitch = {
+    enable = mkEnableOption (lib.mdDoc "picosnitch daemon");
+  };
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.picosnitch ];
+    systemd.services.picosnitch = {
+      description = "picosnitch";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+        RestartSec = 5;
+        ExecStart = "${pkgs.picosnitch}/bin/picosnitch start-no-daemon";
+        PIDFile = "/run/picosnitch/picosnitch.pid";
+      };
+    };
+  };
+}

nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix

@@ -225,20 +225,22 @@ in {
       irrespective of the value of this option (even when set to no).
     '';
 
-    childless = mkEnumParam [ "allow" "force" "never" ] "allow" ''
-      Use childless IKE_SA initiation (RFC 6023) for IKEv2.  Acceptable values
-      are `allow` (the default), `force` and
-      `never`. If set to `allow`, responders
+    childless = mkEnumParam [ "allow" "prefer" "force" "never" ] "allow" ''
+      Use childless IKE_SA initiation (_allow_, _prefer_, _force_ or _never_).
+
+      Use childless IKE_SA initiation (RFC 6023) for IKEv2, with the first
+      CHILD_SA created with a separate CREATE_CHILD_SA exchange (e.g. to use an
+      independent DH exchange for all CHILD_SAs).  Acceptable values are `allow`
+      (the default), `prefer`, `force` and `never`. If set to `allow`, responders
       will accept childless IKE_SAs (as indicated via notify in the IKE_SA_INIT
-      response) while initiators continue to create regular IKE_SAs with the
-      first CHILD_SA created during IKE_AUTH, unless the IKE_SA is initiated
-      explicitly without any children (which will fail if the responder does not
-      support or has disabled this extension).  If set to
-      `force`, only childless initiation is accepted and the
-      first CHILD_SA is created with a separate CREATE_CHILD_SA exchange
-      (e.g. to use an independent DH exchange for all CHILD_SAs). Finally,
-      setting the option to `never` disables support for
-      childless IKE_SAs as responder.
+      response) while initiators continue to create regular IKE_SAs with the first
+      CHILD_SA created during IKE_AUTH, unless the IKE_SA is initiated explicitly
+      without any children (which will fail if the responder does not support or
+      has disabled this extension). The effect of `prefer` is the same as `allow`
+      on responders, but as initiator a childless IKE_SA is initiated if the
+      responder supports it. If set to `force`, only childless initiation is
+      accepted in either role.  Finally, setting the option to `never` disables
+      support for childless IKE_SAs as responder.
     '';
 
     send_certreq = mkYesNoParam yes ''
@@ -357,11 +359,22 @@ in {
     if_id_in = mkStrParam "0" ''
       XFRM interface ID set on inbound policies/SA, can be overridden by child
       config, see there for details.
+
+      The special value `%unique` allocates a unique interface ID per IKE_SA,
+      which is inherited by all its CHILD_SAs (unless overridden there), beyond
+      that the value `%unique-dir` assigns a different unique interface ID for
+      each direction (in/out).
+
     '';
 
     if_id_out = mkStrParam "0" ''
       XFRM interface ID set on outbound policies/SA, can be overridden by child
       config, see there for details.
+
+      The special value `%unique` allocates a unique interface ID per IKE_SA,
+      which is inherited by all its CHILD_SAs (unless overridden there), beyond
+      that the value `%unique-dir` assigns a different unique interface ID for
+      each direction (in/out).
     '';
 
     mediation = mkYesNoParam no ''
@@ -985,12 +998,14 @@ in {
         protection.
       '';
 
-      hw_offload = mkEnumParam ["yes" "no" "auto"] "no" ''
+      hw_offload = mkEnumParam ["yes" "no" "auto" "crypto" "packet"] "no" ''
         Enable hardware offload for this CHILD_SA, if supported by the IPsec
-        implementation. The value `yes` enforces offloading
-        and the installation will fail if it's not supported by either kernel or
-        device. The value `auto` enables offloading, if it's
-        supported, but the installation does not fail otherwise.
+        implementation. The values `crypto` or `packet` enforce crypto or full
+        packet offloading and the installation will fail if the selected mode is not
+        supported by either kernel or device. On Linux, `packet` also offloads
+        policies, including trap policies. The value `auto` enables full packet
+        or crypto offloading, if either is supported, but the installation does not
+        fail otherwise.
       '';
 
       copy_df = mkYesNoParam yes ''

nixos/tests/all-tests.nix

@@ -379,6 +379,7 @@ in {
   limesurvey = handleTest ./limesurvey.nix {};
   listmonk = handleTest ./listmonk.nix {};
   litestream = handleTest ./litestream.nix {};
+  lldap = handleTest ./lldap.nix {};
   locate = handleTest ./locate.nix {};
   login = handleTest ./login.nix {};
   logrotate = handleTest ./logrotate.nix {};

nixos/tests/lldap.nix

@@ -0,0 +1,26 @@
+import ./make-test-python.nix ({ ... }: {
+  name = "lldap";
+
+  nodes.machine = { pkgs, ... }: {
+    services.lldap = {
+      enable = true;
+      settings = {
+        verbose = true;
+        ldap_base_dn = "dc=example,dc=com";
+      };
+    };
+    environment.systemPackages = [ pkgs.openldap ];
+  };
+
+  testScript = ''
+    machine.wait_for_unit("lldap.service")
+    machine.wait_for_open_port(3890)
+    machine.wait_for_open_port(17170)
+
+    machine.succeed("curl --location --fail http://localhost:17170/")
+
+    print(
+      machine.succeed('ldapsearch -H ldap://localhost:3890 -D uid=admin,ou=people,dc=example,dc=com -b "ou=people,dc=example,dc=com" -w password')
+    )
+  '';
+})

pkgs/applications/audio/amberol/default.nix

@@ -19,20 +19,20 @@
 
 stdenv.mkDerivation rec {
   pname = "amberol";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = pname;
     rev = version;
-    hash = "sha256-pvvpiZHp3Gj3rtjvlnfmC2E0mcmh0/poxidhJC8j4Cg=";
+    hash = "sha256-edYLdsXlk+3YGyG6bxR8E8q1bzaXWk04v/NxfaxcNhI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-eb4vVgSAvR2LYVmZmdOIoXxJqFz6q78PIoQPVrOIffc=";
+    hash = "sha256-bhB1hFFLYf+TH3pDCyx/hJqPxBdoPjtPBluK9yygpTk=";
   };
 
   postPatch = ''

pkgs/applications/audio/gtkcord4/default.nix

@@ -13,19 +13,18 @@
 , pango
 , pkg-config
 , sound-theme-freedesktop
-, withLibadwaita ? false
 , wrapGAppsHook4
 }:
 
 buildGoModule rec {
   pname = "gtkcord4";
-  version = "0.0.9";
+  version = "0.0.10";
 
   src = fetchFromGitHub {
     owner = "diamondburned";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-55mS+hrhLLRkhgih5lvdM9Xka+WKg2iliFm6TYF6n3w=";
+    hash = "sha256-WrKZRRJAbEzcCRcFUTa7PxahQ3YADhfWaKlB4uJjVk0=";
   };
 
   nativeBuildInputs = [
@@ -49,24 +48,21 @@ buildGoModule rec {
     gst_all_1.gstreamer
     libcanberra-gtk3
     sound-theme-freedesktop
-  ] ++ lib.optionals withLibadwaita [
     libadwaita
   ];
 
-  tags = lib.optionals withLibadwaita [ "libadwaita" ];
-
   postInstall = ''
     install -D -m 444 -t $out/share/applications nix/xyz.diamondb.gtkcord4.desktop
     install -D -m 444 internal/icons/svg/logo.svg $out/share/icons/hicolor/scalable/apps/gtkcord4.svg
     install -D -m 444 internal/icons/png/logo.png $out/share/icons/hicolor/256x256/apps/gtkcord4.png
   '';
 
-  vendorHash = "sha256-IQpokMeo46vZIdVA1F7JILXCN9bUqTMOCa/SQ0JSjaM=";
+  vendorHash = "sha256-8Xnu3WjaaWMRkqmnQCxSc/SD65XFMIY0xamWDx4jZbw=";
 
   meta = with lib; {
     description = "GTK4 Discord client in Go, attempt #4.";
     homepage = "https://github.com/diamondburned/gtkcord4";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ hmenke urandom ];
+    maintainers = with maintainers; [ hmenke urandom aleksana ];
   };
 }

pkgs/applications/emulators/86box/default.nix

@@ -0,0 +1,74 @@
+{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, makeWrapper, freetype, SDL2
+, glib, pcre2, openal, rtmidi, fluidsynth, jack2, alsa-lib, qt5, libvncserver
+, discord-gamesdk, libpcap
+
+, enableDynarec ? with stdenv.hostPlatform; isx86 || isAarch
+, enableNewDynarec ? enableDynarec && stdenv.hostPlatform.isAarch
+, enableVncRenderer ? false
+, unfreeEnableDiscord ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "86Box";
+  version = "3.11";
+
+  src = fetchFromGitHub {
+    owner = "86Box";
+    repo = "86Box";
+    rev = "v${version}";
+    hash = "sha256-n3Q/NUiaC6/EZyBUn6jUomnQCqr8tvYKPI5JrRRFScI=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+    qt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    freetype
+    SDL2
+    glib
+    openal
+    rtmidi
+    pcre2
+    jack2
+    libpcap
+    qt5.qtbase
+    qt5.qttools
+  ] ++ lib.optional stdenv.isLinux alsa-lib
+    ++ lib.optional enableVncRenderer libvncserver;
+
+  cmakeFlags = lib.optional stdenv.isDarwin "-DCMAKE_MACOSX_BUNDLE=OFF"
+    ++ lib.optional enableNewDynarec "-DNEW_DYNAREC=ON"
+    ++ lib.optional enableVncRenderer "-DVNC=ON"
+    ++ lib.optional (!enableDynarec) "-DDYNAREC=OFF"
+    ++ lib.optional (!unfreeEnableDiscord) "-DDISCORD=OFF";
+
+  # Some libraries are loaded dynamically, but QLibrary doesn't seem to search
+  # the runpath, so use a wrapper instead.
+  postFixup = let
+    libPath = lib.makeLibraryPath ([
+      libpcap
+      fluidsynth
+    ] ++ lib.optional unfreeEnableDiscord discord-gamesdk);
+    libPathVar = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+  in
+  ''
+    wrapProgram $out/bin/86Box \
+      "''${qtWrapperArgs[@]}" \
+      --prefix ${libPathVar} : "${libPath}"
+  '';
+
+  # Do not wrap twice.
+  dontWrapQtApps = true;
+
+  meta = with lib; {
+    description = "Emulator of x86-based machines based on PCem.";
+    homepage = "https://86box.net/";
+    license = with licenses; [ gpl2Only ] ++ optional unfreeEnableDiscord unfree;
+    maintainers = [ maintainers.jchw ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/emulators/mgba/default.nix

@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mgba";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "mgba-emu";
     repo = "mgba";
     rev = finalAttrs.version;
-    hash = "sha256-oWrgYrN7s5tdGJ/GhA2ZaKDVqZq9411fHSoYnLKWDl8=";
+    hash = "sha256-+AwIYhnqp984Banwb7zmB5yzenExfLLU1oGJSxeTl/M=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/blender/blender-numpy.patch

@@ -0,0 +1,14 @@
+diff --git a/release/scripts/addons/io_scene_gltf2/blender/imp/gltf2_blender_mesh.py b/release/scripts/addons/io_scene_gltf2/blender/imp/gltf2_blender_mesh.py
+index 41dd4d03..a97f9d38 100755
+--- a/release/scripts/addons/io_scene_gltf2/blender/imp/gltf2_blender_mesh.py
++++ b/release/scripts/addons/io_scene_gltf2/blender/imp/gltf2_blender_mesh.py
+@@ -572,7 +572,7 @@ def set_poly_smoothing(gltf, pymesh, mesh, vert_normals, loop_vidxs):
+     # Try to guess which polys should be flat based on the fact that all the
+     # loop normals for a flat poly are = the poly's normal.
+ 
+-    poly_smooths = np.empty(num_polys, dtype=np.bool)
++    poly_smooths = np.empty(num_polys, dtype=np.bool_)
+ 
+     poly_normals = np.empty(num_polys * 3, dtype=np.float32)
+     mesh.polygons.foreach_get('normal', poly_normals)
+

pkgs/applications/misc/blender/default.nix

@@ -34,7 +34,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-JHxMEignDJAQ9HIcmFy1tiirUKvPnyZ4Ywc3FC7rkcM=";
   };
 
-  patches = lib.optional stdenv.isDarwin ./darwin.patch;
+  patches = [
+    # remove with 3.5.X
+    ./blender-numpy.patch
+  ] ++ lib.optional stdenv.isDarwin ./darwin.patch;
 
   nativeBuildInputs = [ cmake makeWrapper python310Packages.wrapPython llvmPackages.llvm.dev ]
     ++ lib.optionals cudaSupport [ addOpenGLRunpath ];

pkgs/applications/misc/etesync-dav/default.nix

@@ -1,5 +1,7 @@
 { lib
 , stdenv
+, fetchpatch
+, nixosTests
 , python3
 , radicale3
 }:
@@ -47,6 +49,14 @@ in python.pkgs.buildPythonApplication rec {
     hash = "sha256-pOLug5MnVdKaw5wedABewomID9LU0hZPCf4kZKKU1yA=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "add-missing-comma-in-setup.py.patch";
+      url = "https://github.com/etesync/etesync-dav/commit/040cb7b57205e70515019fb356e508a6414da11e.patch";
+      hash = "sha256-87IpIQ87rgpinvbRwUlWd0xeegn0zfVSiDFYNUqPerg=";
+    })
+  ];
+
   propagatedBuildInputs = with python.pkgs; [
     appdirs
     etebase
@@ -57,10 +67,15 @@ in python.pkgs.buildPythonApplication rec {
     setuptools
     (python.pkgs.toPythonModule (radicale3.override { python3 = python; }))
     requests
+    types-setuptools
   ] ++ requests.optional-dependencies.socks;
 
   doCheck = false;
 
+  passthru.tests = {
+    inherit (nixosTests) etesync-dav;
+  };
+
   meta = with lib; {
     homepage = "https://www.etesync.com/";
     description = "Secure, end-to-end encrypted, and privacy respecting sync for contacts, calendars and tasks";

pkgs/applications/misc/wthrr/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wthrr";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "tobealive";
     repo = "wthrr-the-weathercrab";
     rev = "v${version}";
-    hash = "sha256-u8d3bX0jRe8N7LIhENMVI9MyR5HF2a8kyuMYw8s+PSc=";
+    hash = "sha256-iyla63CbsYavPRbkrnqr3gyULyWbvUKc3evKaB/W9jU=";
   };
 
-  cargoHash = "sha256-mrPydD45L51OSrVPYpXLli1rPlmUpKMcPWql1XrZu1Y=";
+  cargoHash = "sha256-izJ0TT69QnnOTLOGi1bqvy0AHJw1mMI/io5twa2Y4x0=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/networking/cluster/kubectl-ktop/default.nix

@@ -0,0 +1,36 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubectl-ktop";
+  version = "0.3.5";
+
+  src = fetchFromGitHub {
+    owner = "vladimirvivien";
+    repo = "ktop";
+    rev = "v${version}";
+    sha256 = "sha256-nkIRVt2kqsE9QBYvvHmupohnzH+OBcwWwV16rMePw4I=";
+  };
+
+  vendorSha256 = "sha256-IiAMmHOq69WMT2B1q9ZV2fGDnLr7AbRm1P7ACSde2FE=";
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/vladimirvivien/ktop/buildinfo.Version=v${version}"
+    "-X github.com/vladimirvivien/ktop/buildinfo.GitSHA=${src.rev}"
+  ];
+
+  postInstall = ''
+    ln -s $out/bin/ktop $out/bin/kubectl-ktop
+  '';
+
+  meta = with lib; {
+    description = "A top-like tool for your Kubernetes clusters";
+    homepage = "https://github.com/vladimirvivien/ktop";
+    changelog = "https://github.com/vladimirvivien/ktop/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = [ maintainers.ivankovnatsky ];
+  };
+}

pkgs/applications/networking/cluster/roxctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "3.74.1";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-MKc0/eRyAA7xeKKI8ssBXppGKjkqo7/AlRLmNp8juFM=";
+    sha256 = "sha256-HDhR85plO3UDYPZ/uBiGfNXm1txKQoA4KbYMCvQ2pwY=";
   };
 
-  vendorHash = "sha256-8s+Fx62HkCX4JO5ixSvx4k1xm0N1N2z/28uVwlUnxqg=";
+  vendorHash = "sha256-kv5kNFFw57ZuNgwNMucmCPIwaAhpzT0hs2K1B65WxpU=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/protonmail-bridge/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protonmail-bridge";
-  version = "3.1.0";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "ProtonMail";
     repo = "proton-bridge";
     rev = "v${version}";
-    hash = "sha256-jCoTFpxEHk0ITEzJ3RaVeUpzX4E7tuI9ZBKwabtOT6w=";
+    hash = "sha256-/+kl1ywaYf+kDsSbyJVeb5AxOetY9ANCNqE4YDL1/ek=";
   };
 
-  vendorHash = "sha256-zWcqEAeHbBUVRLPw37NgWOoiq/CXCcP/geP3lfo4TWg=";
+  vendorHash = "sha256-206Y5Dl/E7OXQS8GVLQneCh7voGN9a9dUe6kAw8xN5E=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/office/qownnotes/default.nix

@@ -17,14 +17,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "23.4.6";
+  version = "23.4.7";
 in
 stdenv.mkDerivation {
   inherit pname appname version;
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
-    sha256 = "sha256-lfQkY/B+mv+hUeAfmZkZ2BHq7MjR0MUVNPjk5QCGisE=";
+    sha256 = "sha256-E9ap7TcICVwalPfScPEcn4lgNkDI2sPtdIgwRQkcOd0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/math/rofi-calc/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rofi-calc";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sfUcBSUYf/+neBAhEd5LAtMOfIbdXM/ieUOztjk8Pwg=";
+    sha256 = "sha256-SGDORHX+lk6PS5/sPAmKZLfZD99/A7XvDPDnuAygDAM=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/networking/sumo/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sumo";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "eclipse";
     repo = "sumo";
     rev = "v${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "sha256-0aUm7sgBLTPNSJuH6/xsTDZKUzAI87wPI2G3WSi5SGA=";
+    sha256 = "sha256-Br5ugEyGu3zLeylCvoVE92zOCpB5cuXLv1dGLpM3FwI=";
     fetchSubmodules = true;
   };
 

pkgs/applications/version-management/fnc/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fnc";
-  version = "0.13";
+  version = "0.15";
 
   src = fetchurl {
     url = "https://fnc.bsdbox.org/tarball/${version}/fnc-${version}.tar.gz";
-    sha256 = "126aklsjfqmrj0f9p1g6sdlqhwnbfhyn0lq2c9pidfnhppa7sz95";
+    sha256 = "sha256-8up844ekIOMcPlfB2DJzR/GgJY9s/sBeYpG+YtdauvU=";
   };
 
   buildInputs = [ libiconv ncurses zlib ];

pkgs/data/misc/hackage/pin.json

@@ -1,6 +1,6 @@
 {
-  "commit": "67ecaa60725908a5bc562294a2c0e03e30858aa7",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/67ecaa60725908a5bc562294a2c0e03e30858aa7.tar.gz",
-  "sha256": "0yf0dliq65j5achg3iqz0hkf25jjkgxarsdsr5vl2r5h41n39qg3",
-  "msg": "Update from Hackage at 2023-04-18T09:14:41Z"
+  "commit": "835ef6db789d6459876c083419d61e068de15dd3",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/835ef6db789d6459876c083419d61e068de15dd3.tar.gz",
+  "sha256": "11506nwsd15b3jhdydr54j0jk5pzj3qhs92c167xv0f0czw5pj8a",
+  "msg": "Update from Hackage at 2023-04-22T18:19:29Z"
 }

pkgs/desktops/gnome/core/gnome-shell/default.nix

@@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gnome-shell";
-  version = "44.0";
+  version = "44.1";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "MxCtwd1OIQmY1Z84cbwx9+BJFUKNnO2IwqZrKwXWwAo=";
+    sha256 = "C/vkOU0mdiUVTQjQFGe9vZnoFXUS/I30XVwC3bdVHKY=";
   };
 
   patches = [
@@ -104,14 +104,6 @@ stdenv.mkDerivation rec {
       url = "https://src.fedoraproject.org/rpms/gnome-shell/raw/9a647c460b651aaec0b8a21f046cc289c1999416/f/0001-gdm-Work-around-failing-fingerprint-auth.patch";
       sha256 = "pFvZli3TilUt6YwdZztpB8Xq7O60XfuWUuPMMVSpqLw=";
     })
-
-    # Logout/reboot/poweroff timeout leaves the session in a broken state
-    # https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6506
-    # Should be part of 44.1
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/5766d4111ac065b37417bedcc1b998ab6bee5514.patch";
-      sha256 = "d9oEzRnVbaFeCaBFhfLnW/Z8FzyQ7J8L7eAQe91133k=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -194,13 +186,6 @@ stdenv.mkDerivation rec {
     # We can generate it ourselves.
     rm -f man/gnome-shell.1
     rm data/theme/gnome-shell.css
-
-    # Build fails with -Dgtk_doc=true
-    # https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6486
-    # element include: XInclude error : could not load xxx, and no fallback was found
-    substituteInPlace docs/reference/shell/shell-docs.sgml \
-      --replace '<xi:include href="xml/shell-embedded-window.xml"/>' ' ' \
-      --replace '<xi:include href="xml/shell-gtk-embed.xml"/>' ' '
   '';
 
   postInstall = ''

pkgs/desktops/gnome/core/mutter/43/default.nix

@@ -45,6 +45,7 @@
 , libcap_ng
 , egl-wayland
 , graphene
+, wayland
 , wayland-protocols
 }:
 
@@ -129,6 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
     libsysprof-capture
     xkeyboard_config
     xwayland
+    wayland
     wayland-protocols
   ];
 

pkgs/desktops/gnome/core/mutter/default.nix

@@ -60,18 +60,19 @@
 , libcap_ng
 , egl-wayland
 , graphene
+, wayland
 , wayland-protocols
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mutter";
-  version = "44.0";
+  version = "44.1";
 
   outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    sha256 = "chSwfhNYnvfB31U8ftEaAnmOQ62mwiiRP056Zm7vusQ=";
+    sha256 = "lzrq+rQvBvk0oJlPyEh4lYzbTSdmpMhnpczcVH3VcFY=";
   };
 
   mesonFlags = [
@@ -134,6 +135,7 @@ stdenv.mkDerivation (finalAttrs: {
     sysprof # for D-Bus interfaces
     libsysprof-capture
     xwayland
+    wayland
     wayland-protocols
   ] ++ [
     # X11 client

pkgs/development/haskell-modules/configuration-common.nix

@@ -61,15 +61,15 @@ self: super: {
           # not solvable short of recompiling GHC. Instead of adding
           # allowInconsistentDependencies for all reverse dependencies of hspec-core,
           # just upgrade to an hspec version without the offending dependency.
-          hspec-core = cself.hspec-core_2_10_10;
-          hspec-discover = cself.hspec-discover_2_10_10;
-          hspec = cself.hspec_2_10_10;
+          hspec-core = cself.hspec-core_2_11_0;
+          hspec-discover = cself.hspec-discover_2_11_0;
+          hspec = cself.hspec_2_11_0;
 
           # hspec-discover and hspec-core depend on hspec-meta for testing which
           # we need to avoid since it depends on ghc as well. Since hspec*_2_10*
           # are overridden to take the versioned attributes as inputs, we need
           # to make sure to override the versioned attribute with this fix.
-          hspec-discover_2_10_10 = dontCheck csuper.hspec-discover_2_10_10;
+          hspec-discover_2_11_0 = dontCheck csuper.hspec-discover_2_11_0;
 
           # Prevent dependency on doctest which causes an inconsistent dependency
           # due to depending on ghc which depends on directory etc.
@@ -415,11 +415,14 @@ self: super: {
   # 2022-01-29: Tests require package to be in ghc-db.
   aeson-schemas = dontCheck super.aeson-schemas;
 
-  # matterhorn-50200.17.0 won't work with brick >= 0.71, brick-skylighting >= 1.0
-  matterhorn = doJailbreak (super.matterhorn.overrideScope (self: super: {
-    brick = self.brick_0_70_1;
-    brick-skylighting = self.brick-skylighting_0_3;
-  }));
+  # 2023-04-20: Restrictive bytestring bound in tests.
+  storablevector = doJailbreak super.storablevector;
+
+  # 2023-04-20: Pretends to need brick 1.6 but the commit history here
+  # https://github.com/matterhorn-chat/matterhorn/commits/master/matterhorn.cabal
+  # makes very clear that 1.4 is equally fine.
+  # Generally a slightly packaging hostile bound practice.
+  matterhorn = doJailbreak super.matterhorn;
 
   # 2020-06-05: HACK: does not pass own build suite - `dontCheck`
   # 2022-11-24: jailbreak as it has too strict bounds on a bunch of things
@@ -627,6 +630,10 @@ self: super: {
     })
   ] (dontCheck super.snappy);
 
+  # 2023-04-22: omfort-fftw 0.0.0.1 contains fixes to the tests. We can drop
+  # this override as soon as stackage advances.
+  comfort-fftw = doDistribute super.comfort-fftw_0_0_0_1;
+
   # https://github.com/vincenthz/hs-crypto-pubkey/issues/20
   crypto-pubkey = dontCheck super.crypto-pubkey;
 
@@ -998,12 +1005,12 @@ self: super: {
     testHaskellDepends = drv.testHaskellDepends or [] ++ [ self.hspec-meta_2_10_5 ];
     testToolDepends = drv.testToolDepends or [] ++ [ pkgs.git ];
   }) (super.sensei.override {
-    hspec = self.hspec_2_10_10;
+    hspec = self.hspec_2_11_0;
     hspec-wai = self.hspec-wai.override {
-      hspec = self.hspec_2_10_10;
+      hspec = self.hspec_2_11_0;
     };
     hspec-contrib = self.hspec-contrib.override {
-      hspec-core = self.hspec-core_2_10_10;
+      hspec-core = self.hspec-core_2_11_0;
     };
     fsnotify = self.fsnotify_0_4_1_0;
   });
@@ -1667,16 +1674,16 @@ self: super: {
   servant-openapi3 = dontCheck super.servant-openapi3;
 
   # Give hspec 2.10.* correct dependency versions without overrideScope
-  hspec_2_10_10 = doDistribute (super.hspec_2_10_10.override {
-    hspec-discover = self.hspec-discover_2_10_10;
-    hspec-core = self.hspec-core_2_10_10;
+  hspec_2_11_0 = doDistribute (super.hspec_2_11_0.override {
+    hspec-discover = self.hspec-discover_2_11_0;
+    hspec-core = self.hspec-core_2_11_0;
   });
-  hspec-discover_2_10_10 = doDistribute (super.hspec-discover_2_10_10.override {
+  hspec-discover_2_11_0 = doDistribute (super.hspec-discover_2_11_0.override {
     hspec-meta = self.hspec-meta_2_10_5;
   });
-  # Need to disable tests to prevent an infinite recursion if hspec-core_2_10_10
+  # Need to disable tests to prevent an infinite recursion if hspec-core_2_11_0
   # is overlayed to hspec-core.
-  hspec-core_2_10_10 = doDistribute (dontCheck (super.hspec-core_2_10_10.override {
+  hspec-core_2_11_0 = doDistribute (dontCheck (super.hspec-core_2_11_0.override {
     hspec-meta = self.hspec-meta_2_10_5;
   }));
 
@@ -2618,4 +2625,11 @@ self: super: {
   # compatability with other gi- packages.
   # Take another look when gi-webkit2 updates as it may have become compatible with libsoup-3
   gi-soup = assert versions.major self.gi-webkit2.version == "4"; self.gi-soup_2_4_28;
+
+  llvm-ffi = super.llvm-ffi.override {
+    LLVM = pkgs.llvmPackages_13.libllvm;
+  };
+
+  # libfuse3 fails to mount fuse file systems within the build environment
+  libfuse3 = dontCheck super.libfuse3;
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super

pkgs/development/haskell-modules/configuration-ghc-9.4.x.nix

@@ -107,14 +107,6 @@ in {
   base-orphans = dontCheck (doDistribute super.base-orphans);
   generically = addBuildDepend self.base-orphans super.generically;
 
-  # Note: Any compilation fixes need to be done on the versioned attributes,
-  # since those are used for the internal dependencies between the versioned
-  # hspec packages in configuration-common.nix.
-  hspec = self.hspec_2_10_10;
-  hspec-core = self.hspec-core_2_10_10;
-  hspec-meta = self.hspec-meta_2_10_5;
-  hspec-discover = self.hspec-discover_2_10_10;
-
   # the dontHaddock is due to a GHC panic. might be this bug, not sure.
   # https://gitlab.haskell.org/ghc/ghc/-/issues/21619
   #
@@ -225,4 +217,6 @@ in {
   # failing during the Setup.hs phase: https://github.com/gtk2hs/gtk2hs/issues/323.
   gtk2hs-buildtools = appendPatch ./patches/gtk2hs-buildtools-fix-ghc-9.4.x.patch super.gtk2hs-buildtools;
 
+  # Pending text-2.0 support https://github.com/gtk2hs/gtk2hs/issues/327
+  gtk = doJailbreak super.gtk;
 }

pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix

@@ -9,6 +9,11 @@ let
     overrideCabal (old: {
       jailbreak = assert old.revision or "0" == toString rev; true;
     });
+  checkAgainAfter = pkg: ver: msg: act:
+    if builtins.compareVersions pkg.version ver <= 0 then act
+    else
+      builtins.throw "Check if '${msg}' was resolved in ${pkg.pname} ${pkg.version} and update or remove this";
+  jailbreakForCurrentVersion = p: v: checkAgainAfter p v "bad bounds" (doJailbreak p);
 in
 
 self: super: {
@@ -61,37 +66,47 @@ self: super: {
   inspection-testing = doDistribute self.inspection-testing_0_5_0_1; # allows base >= 4.18
   OneTuple = doDistribute (dontCheck super.OneTuple_0_4_1_1); # allows base >= 4.18
   primitive = doDistribute (dontCheck self.primitive_0_7_4_0); # allows base >= 4.18
+  http-api-data = doDistribute self.http-api-data_0_5_1; # allows base >= 4.18
+  attoparsec-iso8601 = doDistribute self.attoparsec-iso8601_1_1_0_0; # for http-api-data-0.5.1
   tagged = doDistribute self.tagged_0_8_7; # allows template-haskell-2.20
   some = doDistribute self.some_1_0_5;
   tasty-inspection-testing = doDistribute self.tasty-inspection-testing_0_2;
   th-abstraction = doDistribute self.th-abstraction_0_5_0_0;
   th-desugar = doDistribute self.th-desugar_1_15;
-  # Too strict bounds on ghc-prim and template-haskell
-  aeson = doDistribute (doJailbreak self.aeson_2_1_2_1);
-  # Too strict bounds on ghc-prim
+  turtle = doDistribute self.turtle_1_6_1;
+  aeson = doDistribute self.aeson_2_1_2_1;
   memory = doDistribute self.memory_0_18_0;
 
   ghc-lib = doDistribute self.ghc-lib_9_6_1_20230312;
   ghc-lib-parser = doDistribute self.ghc-lib-parser_9_6_1_20230312;
   ghc-lib-parser-ex = doDistribute self.ghc-lib-parser-ex_9_6_0_0;
 
+  # allows mtl, template-haskell, text and transformers
+  hedgehog = doDistribute self.hedgehog_1_2;
+  # allows base >= 4.18
+  tasty-hedgehog = doDistribute self.tasty-hedgehog_1_4_0_1;
+
+  # v0.1.6 forbids base >= 4.18
+  singleton-bool = doDistribute super.singleton-bool_0_1_7;
+
   #
   # Too strict bounds without upstream fix
   #
 
   # Forbids transformers >= 0.6
   quickcheck-classes-base = doJailbreak super.quickcheck-classes-base;
-  # Forbids base >= 4.18
-  singleton-bool = doJailbreak super.singleton-bool;
-  # Forbids base >= 4.18
-  unliftio-core = doJailbreak super.unliftio-core;
   # Forbids mtl >= 2.3
   ChasingBottoms = doJailbreak super.ChasingBottoms;
   # Forbids base >= 4.18
   cabal-install-solver = doJailbreak super.cabal-install-solver;
   cabal-install = doJailbreak super.cabal-install;
-  # Forbids base >= 4.18
-  lukko = doJailbreak super.lukko;
+
+  # Forbids base >= 4.18, fix proposed: https://github.com/sjakobi/newtype-generics/pull/25
+  newtype-generics = jailbreakForCurrentVersion super.newtype-generics "0.6.2";
+  # Forbids base >= 4.18, fix proposed: https://github.com/well-typed/cborg/pull/312
+  cborg = jailbreakForCurrentVersion super.cborg "0.2.8.0";
+  cborg-json = jailbreakForCurrentVersion super.cborg-json "0.2.5.0";
+  serialise = jailbreakForCurrentVersion super.serialise "0.2.6.0";
 
   #
   # Too strict bounds, waiting on Hackage release in nixpkgs
@@ -122,6 +137,18 @@ self: super: {
       })
     ] (super.foundation);
 
+  # Add support for time 1.10
+  # https://github.com/vincenthz/hs-hourglass/pull/56
+  hourglass = appendPatches [
+      (pkgs.fetchpatch {
+        name = "hourglass-pr-56.patch";
+        url =
+          "https://github.com/vincenthz/hs-hourglass/commit/cfc2a4b01f9993b1b51432f0a95fa6730d9a558a.patch";
+        sha256 = "sha256-gntZf7RkaR4qzrhjrXSC69jE44SknPDBmfs4z9rVa5Q=";
+      })
+    ] (super.hourglass);
+
+
   # Test suite doesn't compile with base-4.18 / GHC 9.6
   # https://github.com/dreixel/syb/issues/40
   syb = dontCheck super.syb;
@@ -146,7 +173,6 @@ self: super: {
   rebase = doJailbreak super.rebase_1_20;
   rerebase = doJailbreak super.rerebase_1_20;
   hiedb = dontCheck super.hiedb;
-  lucid = doJailbreak (dontCheck super.lucid);
   retrie = dontCheck (super.retrie);
 
   ghc-exactprint = unmarkBroken (addBuildDepends (with self.ghc-exactprint.scope; [

pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml

@@ -129,7 +129,6 @@ broken-packages:
   - alpino-tools
   - alsa
   - alsa-midi
-  - alsa-seq
   - altcomposition
   - alternative-extra
   - alternative-io
@@ -411,6 +410,7 @@ broken-packages:
   - biscuit-haskell
   - bisect-binary
   - bishbosh
+  - bitcoind-rpc # dependency missing in job https://hydra.nixos.org/build/217579845 at 2023-04-29
   - bitcoin-hs
   - bitcoin-keys
   - bitcoin-rpc
@@ -981,7 +981,6 @@ broken-packages:
   - curryrs
   - curves
   - custom-prelude
-  - cutter
   - cut-the-crap
   - CV
   - d3js
@@ -1118,6 +1117,7 @@ broken-packages:
   - derp-lib
   - describe
   - descriptive
+  - desktop-portal # test failure in job https://hydra.nixos.org/build/217585702 at 2023-04-29
   - deterministic-game-engine
   - detrospector
   - deunicode
@@ -1208,7 +1208,6 @@ broken-packages:
   - docopt
   - docrecords
   - doctest-discover-configurator
-  - doctest-extract
   - doctest-prop
   - docusign-example
   - docvim
@@ -1373,7 +1372,6 @@ broken-packages:
   - epoll
   - epubname
   - Eq
-  - equal-files
   - EqualitySolver
   - equational-reasoning-induction
   - equeue
@@ -1648,6 +1646,7 @@ broken-packages:
   - ftphs
   - full-sessions
   - funbot-client
+  - funcons-lambda-cbv-mp # failure building executable 'lambda-cbv' in job https://hydra.nixos.org/build/217559083 at 2023-04-29
   - functional-arrow
   - function-instances-algebra
   - functor-combinators
@@ -1902,7 +1901,6 @@ broken-packages:
   - grm
   - GroteTrap
   - groundhog
-  - group-by-date
   - groups-generic
   - group-theory
   - group-with
@@ -2686,7 +2684,6 @@ broken-packages:
   - ieee-utils
   - iexcloud
   - ifcxt
-  - iff
   - if-instance
   - IFS
   - ig
@@ -3080,7 +3077,6 @@ broken-packages:
   - lhslatex
   - LibClang
   - libexpect
-  - libfuse3
   - libGenI
   - libhbb
   - libinfluxdb
@@ -3156,7 +3152,7 @@ broken-packages:
   - ll-picosat
   - llsd
   - llvm-base
-  - llvm-ffi
+  - llvm-extra # dependency missing in job https://hydra.nixos.org/build/217586045 at 2023-04-29
   - llvm-general-pure
   - llvm-hs
   - llvm-ht
@@ -3287,7 +3283,6 @@ broken-packages:
   - MazesOfMonad
   - MBot
   - mbox-tools
-  - mbox-utility
   - mbug
   - mcl
   - mcm
@@ -3354,6 +3349,7 @@ broken-packages:
   - microsoft-translator
   - mida
   - midi-simple
+  - midisurface # dependency missing in job https://hydra.nixos.org/build/217805409 at 2023-04-29
   - midi-utils
   - mighty-metropolis # test failure in job https://hydra.nixos.org/build/214599789 at 2023-04-07
   - migrant-postgresql-simple
@@ -4600,6 +4596,7 @@ broken-packages:
   - rustls
   - rws
   - RxHaskell
+  - rzk # failure in compileBuildDriverPhase in job https://hydra.nixos.org/build/217574605 at 2023-04-29
   - rz-pipe
   - SableCC2Hs
   - safe-buffer-monad
@@ -5086,7 +5083,6 @@ broken-packages:
   - stooq-api
   - storable
   - storable-static-array
-  - storablevector
   - stp
   - str
   - Strafunski-ATermLib
@@ -5096,6 +5092,7 @@ broken-packages:
   - stratux-types
   - stream
   - streamdeck
+  - streamed # dependency missing in job https://hydra.nixos.org/build/217576821 at 2023-04-29
   - stream-fusion
   - streaming-benchmarks
   - streaming-brotli
@@ -5209,6 +5206,7 @@ broken-packages:
   - sync-mht
   - syntax-trees
   - syntax-trees-fork-bairyn
+  - synthesizer # dependency missing in job https://hydra.nixos.org/build/217577245 at 2023-04-29
   - Sysmon
   - system-canonicalpath
   - system-command
@@ -5229,7 +5227,6 @@ broken-packages:
   - tabloid
   - tabs
   - tag-bits
-  - tagchup
   - tagged-exception-core
   - tagged-timers
   - taggy-lens
@@ -5335,7 +5332,6 @@ broken-packages:
   - text-offset
   - text-position
   - text-register-machine
-  - text-time
   - text-trie
   - textual
   - text-utf7
@@ -5405,6 +5401,7 @@ broken-packages:
   - time-quote
   - time-recurrence
   - time-series
+  - timeseries # dependency missing in job https://hydra.nixos.org/build/217565262 at 2023-04-29
   - time-series-lib
   - timeutils
   - time-w3c
@@ -5524,6 +5521,7 @@ broken-packages:
   - twilio
   - twiml
   - twine
+  - twirl # dependency missing in job https://hydra.nixos.org/build/217564808 at 2023-04-29
   - twirp
   - twisty
   - twitchapi

pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml

@@ -49,6 +49,10 @@ default-package-overrides:
   # 2023-04-13: latest version requires ghc-events >= 0.19 but it's not on LTS yet
   - eventlog2html < 0.10
 
+  # 2023-04-22: For dhall < 1.42 compatibility
+  - dhall-nixpkgs == 1.0.9
+  - dhall-nix == 1.1.25
+
 extra-packages:
   - Cabal == 2.2.*                      # required for jailbreak-cabal etc.
   - Cabal == 2.4.*                      # required for cabal-install etc.
@@ -433,6 +437,120 @@ package-maintainers:
     - rhine-gloss
     - simple-affine-space
     - time-domain
+  thielema:
+    - accelerate-arithmetic
+    - accelerate-fftw
+    - accelerate-fourier
+    - accelerate-utility
+    - align-audio
+    - alsa-core
+    - alsa-pcm
+    - alsa-seq
+    - apportionment
+    - audacity
+    - battleship-combinatorics
+    - bibtex
+    - board-games
+    - buffer-pipe
+    - cabal-flatpak
+    - calendar-recycling
+    - checksum
+    - check-pvp
+    - combinatorial
+    - comfort-graph
+    - comfort-array
+    - comfort-array-shape
+    - comfort-fftw
+    - comfort-glpk
+    - concurrent-split
+    - cutter
+    - data-accessor
+    - data-accessor-mtl
+    - data-accessor-template
+    - data-accessor-transformers
+    - data-ref
+    - doctest-exitcode-stdio
+    - doctest-extract
+    - doctest-lib
+    - dsp
+    - enumset
+    - equal-files
+    - event-list
+    - explicit-exception
+    - fixed-length
+    - fftw-ffi
+    - gnuplot
+    - group-by-date
+    - guarded-allocation
+    - iff
+    - interpolation
+    - jack
+    - latex
+    - lazyio
+    - markov-chain
+    - midi
+    - midi-alsa
+    - midi-music-box
+    - mbox-utility
+    - med-module
+    - monoid-transformer
+    - non-empty
+    - non-negative
+    - numeric-prelude
+    - numeric-quest
+    - pathtype
+    - pooled-io
+    - probability
+    - quickcheck-transformer
+    - reactive-midyim
+    - reactive-balsa
+    - reactive-jack
+    - sample-frame
+    - sample-frame-np
+    - set-cover
+    - shell-utility
+    - sound-collage
+    - sox
+    - soxlib
+    - split-record
+    - spreadsheet
+    - stm-split
+    - storable-record
+    - storable-tuple
+    - storablevector
+    - synthesizer-core
+    - synthesizer-dimensional
+    - synthesizer-alsa
+    - synthesizer-midi
+    - tagchup
+    - tfp
+    - unicode
+    - unique-logic
+    - unique-logic-tf
+    - unsafe
+    - utility-ht
+    - wuerfelschlange
+    - xml-basic
+    - youtube
+    - prelude-compat
+    - fft
+    - carray
+    - lapack-ffi-tools
+    - netlib-ffi
+    - blas-ffi
+    - lapack-ffi
+    - netlib-carray
+    - blas-carray
+    - lapack-carray
+    - netlib-comfort-array
+    - blas-comfort-array
+    - lapack-comfort-array
+    - lapack
+    - lapack-hmatrix
+    - hmm-lapack
+    - magico
+    - resistor-cube
+    - linear-circuit
   utdemir:
     - nix-tree
   zowoq:
@@ -523,6 +641,7 @@ unsupported-platforms:
   spade:                                        [ platforms.darwin ] # depends on sdl2-mixer, which doesn't work on darwin
   synthesizer-alsa:                             [ platforms.darwin ]
   taffybar:                                     [ platforms.darwin ]
+  twirl:                                        [ platforms.darwin ] # depends on sdl2-mixer
   emanote:                                      [ x86_64-darwin ] # Depends on stork which is broken on macOS sdk < 10.14
   termonad:                                     [ platforms.darwin ]
   tokyotyrant-haskell:                          [ platforms.darwin ]
@@ -533,6 +652,7 @@ unsupported-platforms:
   VulkanMemoryAllocator:                        [ i686-linux, armv7l-linux, platforms.darwin ]
   vulkan-utils:                                 [ platforms.darwin ]
   webkit2gtk3-javascriptcore:                   [ platforms.darwin ]
+  wiringPi:                                     [ aarch64-darwin ]
   xattr:                                        [ platforms.darwin ]
   xgboost-haskell:                              [ aarch64-linux, armv7l-linux ]
   xmobar:                                       [ platforms.darwin ]
@@ -578,13 +698,15 @@ supported-platforms:
   keid-sound-openal:                            [ x86_64-linux ] # geomancy (only x86), vulkan (no i686, no darwin, …)
   keid-ui-dearimgui:                            [ x86_64-linux ] # geomancy (only x86), vulkan (no i686, no darwin, …)
   kqueue:                                       [ platforms.netbsd, platforms.freebsd, platforms.openbsd, platforms.darwin ]
+  libfuse3:                                     [ platforms.linux ]
   linux-evdev:                                  [ platforms.linux ]
   linux-file-extents:                           [ platforms.linux ]
   linux-inotify:                                [ platforms.linux ]
   linux-mount:                                  [ platforms.linux ]
   linux-namespaces:                             [ platforms.linux ]
   lxc:                                          [ platforms.linux ]
-  midi-alsa:                                    [ platforms.linux ]
+  midi-alsa:                                    [ platforms.linux ] # alsa-core only supported on linux
+  midisurface:                                  [ platforms.linux ] # alsa-core only supported on linux
   OrderedBits:                                  [ platforms.x86 ] # lacks implementations for non-x86: https://github.com/choener/OrderedBits/blob/401cbbe933b1635aa33e8e9b29a4a570b0a8f044/lib/Data/Bits/Ordered.hs#L316
   password:                                     [ platforms.x86 ] # uses scrypt, which requries x86
   password-instances:                           [ platforms.x86 ] # uses scrypt, which requries x86
@@ -593,6 +715,7 @@ supported-platforms:
   scat:                                         [ platforms.x86 ] # uses scrypt, which requries x86
   scrypt:                                       [ platforms.x86 ] # https://github.com/informatikr/scrypt/issues/8
   seqalign:                                     [ platforms.x86 ] # x86 intrinsics
+  streamed:                                     [ platforms.linux] # alsa-core only supported on linux
   swisstable:                                   [ platforms.x86_64 ] # Needs AVX2
   tasty-papi:                                   [ platforms.linux ] # limited by pkgs.papi
   udev:                                         [ platforms.linux ]

pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml

@@ -467,7 +467,6 @@ dont-distribute-packages:
  - algorithmic-composition-basic
  - algorithmic-composition-frequency-shift
  - algorithmic-composition-overtones
- - align-audio
  - alms
  - alpha
  - alsa-gui
@@ -698,7 +697,6 @@ dont-distribute-packages:
  - attoparsec-iteratee
  - attoparsec-text-enumerator
  - atuin
- - audacity
  - audiovisual
  - aura
  - authoring
@@ -762,7 +760,6 @@ dont-distribute-packages:
  - batching
  - battlenet-yesod
  - battleplace-api
- - battleship-combinatorics
  - battleships
  - bayes-stack
  - bbi
@@ -812,13 +809,13 @@ dont-distribute-packages:
  - bitcoin-block
  - bitcoin-tx
  - bitcoin-types
+ - bitcoind-regtest
  - bitfield
  - bitly-cli
  - bitmaps
  - bittorrent
  - bla
  - blakesum-demo
- - blas-comfort-array
  - blastxml
  - blatex
  - blaze-builder-enumerator
@@ -1029,10 +1026,6 @@ dont-distribute-packages:
  - columbia
  - columnar
  - comark
- - comfort-array
- - comfort-array-shape
- - comfort-fftw
- - comfort-glpk
  - commsec
  - commsec-keyexchange
  - comonad-random
@@ -2269,7 +2262,6 @@ dont-distribute-packages:
  - hslua-objectorientation_2_3_0
  - hslua-packaging_2_3_0
  - hslua_2_3_0
- - hsndfile-storablevector
  - hspec-expectations-pretty
  - hspec-pg-transact
  - hspec-setup
@@ -2563,7 +2555,6 @@ dont-distribute-packages:
  - language-qux
  - language-spelling
  - lapack
- - lapack-comfort-array
  - lapack-hmatrix
  - large-anon
  - lat
@@ -2650,12 +2641,10 @@ dont-distribute-packages:
  - llvm-data-interop
  - llvm-dsl
  - llvm-extension
- - llvm-extra
  - llvm-general
  - llvm-general-quote
  - llvm-hs-pretty
  - llvm-pretty-bc-parser
- - llvm-tf
  - llvm-tools
  - lmonad-yesod
  - lnd-client
@@ -2769,9 +2758,7 @@ dont-distribute-packages:
  - metronome
  - micro-gateway
  - microformats2-types
- - midi-alsa
  - midimory
- - midisurface
  - mighttpd
  - minecraft-data
  - minesweeper
@@ -2910,7 +2897,6 @@ dont-distribute-packages:
  - net-spider-rpl
  - net-spider-rpl-cli
  - netcore
- - netlib-comfort-array
  - netlines
  - netstring-enumerator
  - nettle-frp
@@ -3208,6 +3194,7 @@ dont-distribute-packages:
  - prolog-graph-lib
  - prologue
  - prolude
+ - proof-assistant-bot
  - propane
  - proplang
  - prosidyc
@@ -3260,6 +3247,7 @@ dont-distribute-packages:
  - quickcheck-relaxng
  - quickcheck-state-machine
  - quickcheck-state-machine-distributed
+ - quickcheck-state-machine_0_7_2
  - quicktest
  - quipper
  - quipper-algorithms
@@ -3702,9 +3690,7 @@ dont-distribute-packages:
  - solr
  - sonic-visualiser
  - souffle-dsl
- - sound-collage
  - source-code-server
- - soxlib
  - sparkle
  - sparrow
  - sparsebit
@@ -3722,7 +3708,6 @@ dont-distribute-packages:
  - spice
  - spike
  - splines
- - split-record
  - sprinkles
  - sproxy
  - sproxy-web
@@ -3767,14 +3752,12 @@ dont-distribute-packages:
  - stm-actor
  - stm-supply
  - stmcontrol
- - storablevector-carray
  - storablevector-streamfusion
  - stratum-tool
  - stratux
  - stratux-demo
  - stratux-http
  - stratux-websockets
- - streamed
  - streaming-fft
  - streaming-process
  - strelka
@@ -3852,13 +3835,7 @@ dont-distribute-packages:
  - syntax-pretty
  - syntax-printer
  - syntaxnet-haskell
- - synthesizer
- - synthesizer-alsa
- - synthesizer-core
- - synthesizer-dimensional
- - synthesizer-filter
  - synthesizer-llvm
- - synthesizer-midi
  - sys-process
  - systemstats
  - t3-client
@@ -3924,7 +3901,6 @@ dont-distribute-packages:
  - time-io-access
  - time-warp
  - timeprint
- - timeseries
  - timezone-unix
  - tinkoff-invest-sdk
  - tintin

pkgs/development/haskell-modules/configuration-nix.nix

@@ -177,6 +177,15 @@ self: super: builtins.intersectAttrs super {
   ### END HASKELL-LANGUAGE-SERVER SECTION ###
   ###########################################
 
+  audacity = enableCabalFlag "buildExamples" (overrideCabal (drv: {
+      executableHaskellDepends = [self.optparse-applicative self.soxlib];
+    }) super.audacity);
+  # 2023-04-27: Deactivating examples for now because they cause a non-trivial build failure.
+  # med-module = enableCabalFlag "buildExamples" super.med-module;
+  spreadsheet = enableCabalFlag "buildExamples" (overrideCabal (drv: {
+      executableHaskellDepends = [self.optparse-applicative self.shell-utility];
+    }) super.spreadsheet);
+
   # fix errors caused by hardening flags
   epanet-haskell = disableHardening ["format"] super.epanet-haskell;
 
@@ -252,14 +261,24 @@ self: super: builtins.intersectAttrs super {
   heist = addTestToolDepend pkgs.pandoc super.heist;
 
   # https://github.com/NixOS/cabal2nix/issues/136 and https://github.com/NixOS/cabal2nix/issues/216
-  gio = disableHardening ["fortify"] (addPkgconfigDepend pkgs.glib (addBuildTool self.buildHaskellPackages.gtk2hs-buildtools super.gio));
+  gio = lib.pipe super.gio
+    [ (disableHardening ["fortify"])
+      (addBuildTool self.buildHaskellPackages.gtk2hs-buildtools)
+      (addPkgconfigDepends (with pkgs; [ glib pcre2 util-linux pcre ]
+                                       ++ (if pkgs.stdenv.isLinux then [libselinux libsepol] else [])))
+    ];
   glib = disableHardening ["fortify"] (addPkgconfigDepend pkgs.glib (addBuildTool self.buildHaskellPackages.gtk2hs-buildtools super.glib));
   gtk3 = disableHardening ["fortify"] (super.gtk3.override { inherit (pkgs) gtk3; });
-  gtk = let gtk1 = addBuildTool self.buildHaskellPackages.gtk2hs-buildtools super.gtk;
-            gtk2 = addPkgconfigDepend pkgs.gtk2 gtk1;
-            gtk3 = disableHardening ["fortify"] gtk1;
-            gtk4 = if pkgs.stdenv.isDarwin then appendConfigureFlag "-fhave-quartz-gtk" gtk3 else gtk4;
-        in gtk3;
+  gtk = lib.pipe super.gtk (
+    [ (disableHardening ["fortify"])
+      (addBuildTool self.buildHaskellPackages.gtk2hs-buildtools)
+      (addPkgconfigDepends (with pkgs; [ gtk2 pcre2 util-linux pcre fribidi
+                                         libthai libdatrie xorg.libXdmcp libdeflate
+                                        ]
+                                       ++ (if pkgs.stdenv.isLinux then [libselinux libsepol] else [])))
+    ] ++
+    ( if pkgs.stdenv.isDarwin then [(appendConfigureFlag "-fhave-quartz-gtk")] else [] )
+  );
   gtksourceview2 = addPkgconfigDepend pkgs.gtk2 super.gtksourceview2;
   gtk-traymanager = addPkgconfigDepend pkgs.gtk3 super.gtk-traymanager;
 

pkgs/development/interpreters/erlang/25.nix

@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "25.3";
-  sha256 = "UOBrDaXpvpeM79VN0PxVQ1XsYI+OYWBbaBfYE5lZXgE=";
+  version = "25.3.1";
+  sha256 = "dMMw4UbZMsmb3t0S2X2EpbTKZPKTaWWbSP4OUGWnC4c=";
 }

pkgs/development/libraries/freeglut/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freeglut";
-  version = "3.2.2";
+  version = "3.4.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/freeglut/freeglut-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-xZRKCC3wu6lrV1bd2x910M1yzie1OVxsHd6Fwv8pelA=";
+    sha256 = "sha256-PAvLkV2bGAqX7a69ARt6HeVFg6g4ZE3NQrsOoMbz6uw=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/freetds/default.nix

@@ -8,11 +8,11 @@ assert odbcSupport -> unixODBC != null;
 
 stdenv.mkDerivation rec {
   pname = "freetds";
-  version = "1.3.17";
+  version = "1.3.18";
 
   src = fetchurl {
     url    = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-+AzAGg71u+M+fLs3Au2SSqteJaxuzNk8lJ6H3+98WYQ=";
+    sha256 = "sha256-HYVh1XxxmRoo9GgTQ3hcI6aj61TVvNI4l9B+OCX/LVY=";
   };
 
   buildInputs = [

pkgs/development/libraries/level-zero/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "level-zero";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "level-zero";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4eDLtlVhJW3SCvDlVWcvAImiHoW02IgLfZ57gocexEQ=";
+    hash = "sha256-hCipWbhVsYYqfGXO6CFDPmxiFO7Dc0I/nCnj6lRS2go=";
   };
 
   nativeBuildInputs = [ cmake addOpenGLRunpath ];

pkgs/development/libraries/libfabric/default.nix

@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfabric";
-  version = "1.17.1";
+  version = "1.18.0";
 
   enableParallelBuilding = true;
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "ofiwg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZHNx1EV+JMfpoP0p6VHaIjFp81N2g0nGJ6v/PqFmu6M=";
+    sha256 = "sha256-30ADIUbpzwyxMJtPyLDwXYGJF4c1ZiSJH2mBBtgfE18=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];

pkgs/development/libraries/mathgl/default.nix

@@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, fetchurl
+, cmake
+, zlib
+, libpng
+, libGL
+}:
+stdenv.mkDerivation rec {
+  pname = "mathgl";
+  version = "8.0.1";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/mathgl/mathgl-${version}.tar.gz";
+    sha256 = "sha256-yoS/lIDDntMRLpIMFs49jyiYaY9iiW86V3FBKGIqVao=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    zlib
+    libpng
+    libGL
+  ];
+
+  meta = with lib; {
+    description = "A library for scientific data visualization";
+    homepage = "https://mathgl.sourceforge.net/";
+    license = with licenses; [ gpl3 lgpl3 ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.GabrielDougherty ];
+  };
+}

pkgs/development/libraries/science/math/scs/default.nix

@@ -4,13 +4,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "scs";
-  version = "3.2.0";
+  version = "3.2.3";
 
   src = fetchFromGitHub {
     owner = "cvxgrp";
     repo = "scs";
     rev = version;
-    sha256 = "sha256-ewn7AGNqTXY3bp5itHTfAQ2Es2ZAIbuRFM5U600Px50=";
+    sha256 = "sha256-0g0r3DNgkPZgag0qtz79Wk3Cre1I2yaabFi3OgUzgfc=";
   };
 
   # Actually link and add libgfortran to the rpath

pkgs/development/libraries/tracker/default.nix

@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {
     # https://gitlab.gnome.org/GNOME/tracker/-/issues/397
     !stdenv.isAarch64
     # https://gitlab.gnome.org/GNOME/tracker/-/issues/398
-    && !stdenv.isi686;
+    && !stdenv.is32bit;
 
   postPatch = ''
     chmod +x \

pkgs/development/python-modules/accelerate/default.nix

@@ -53,6 +53,9 @@ buildPythonPackage rec {
     # try to download data:
     "FeatureExamplesTests"
     "test_infer_auto_device_map_on_t0pp"
+    # known failure with Torch>2.0; see https://github.com/huggingface/accelerate/pull/1339:
+    # (remove for next release)
+    "test_gradient_sync_cpu_multi"
   ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [
     # usual aarch64-linux RuntimeError: DataLoader worker (pid(s) <...>) exited unexpectedly
     "CheckpointTest"

pkgs/development/python-modules/datetime/default.nix

@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, pytz
+, zope_interface
+}:
+
+buildPythonPackage rec {
+  pname = "datetime";
+  version = "5.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "zopefoundation";
+    repo = "datetime";
+    rev = "refs/tags/${version}";
+    hash = "sha256-5H7s2y/2zsQC3Azs1yakotO8ZVLCRV8yPahbX09C5L8=";
+  };
+
+  propagatedBuildInputs = [
+    pytz
+    zope_interface
+  ];
+
+  pythonImportsCheck = [
+    "DateTime"
+  ];
+
+  meta = with lib; {
+    description = "DateTime data type, as known from Zope";
+    homepage = "https://github.com/zopefoundation/DateTime";
+    changelog = "https://github.com/zopefoundation/DateTime/releases/tag/${version}";
+    license = licenses.zpl21;
+    maintainers = with maintainers; [ icyrockcom ];
+  };
+}
+

pkgs/development/python-modules/eiswarnung/default.nix

@@ -25,6 +25,13 @@ buildPythonPackage rec {
     hash = "sha256-PVFAy34+UfNQNdzVdfvNiySrCTaKGuepnTINZYkOsuo=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"0.0.0"' '"${version}"' \
+      --replace 'addopts = "--cov"' "" \
+      --replace 'pytz = "^2022.7.1"' 'pytz = "*"'
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -41,12 +48,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace '"0.0.0"' '"${version}"' \
-      --replace 'addopts = "--cov"' ""
-  '';
-
   pythonImportsCheck = [
     "eiswarnung"
   ];

pkgs/development/python-modules/neo4j/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "neo4j";
-  version = "5.7.0";
+  version = "5.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "neo4j";
     repo = "neo4j-python-driver";
     rev = "refs/tags/${version}";
-    hash = "sha256-LVdzbmNhCSsDpb0inmgIqHugyu9ncrjpucEwV2l+cAM=";
+    hash = "sha256-11fa6scRcC+bQxEccCgxSJaMjwkUVs4DQj1NSaXlpb8=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/watchfiles/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "watchfiles";
-  version = "0.18.1";
+  version = "0.19.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,13 +26,13 @@ buildPythonPackage rec {
     owner = "samuelcolvin";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-XEhu6M1hFi3/gAKZcei7KJSrIhhlZhlvZvbfyA6VLR4=";
+    hash = "sha256-NmmeoaIfFMNKCcjH6tPnkpflkN35bKlT76MqF9W8LBc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-IWONA3o+2emJ7cKEw5xYSMdWzGuUSwn1B70zUDzj7Cw=";
+    hash = "sha256-9ruk3PMcWNLOIGth5fo91/miyF17lgERWL3F4y4as18=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [

pkgs/development/r-modules/wrapper-radian.nix

@@ -12,8 +12,7 @@ runCommand (radian.name + "-wrapper") {
   preferLocalBuild = true;
   allowSubstitutes = false;
 
-  buildInputs = [ radian ] ++ recommendedPackages ++ packages
-    ++ lib.optional wrapR R;
+  buildInputs = [ R radian ] ++ recommendedPackages ++ packages;
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -27,7 +26,8 @@ runCommand (radian.name + "-wrapper") {
   };
 } (''
   makeWrapper "${radian}/bin/radian" "$out/bin/radian" \
-    --prefix "R_LIBS_SITE" ":" "$R_LIBS_SITE"
+    --prefix "R_LIBS_SITE" ":" "$R_LIBS_SITE" \
+    --set "R_HOME" "${R}/lib/R"
 '' + lib.optionalString wrapR ''
   cd ${R}/bin
   for exe in *; do

pkgs/development/tools/continuous-integration/drone/default.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "drone.io${lib.optionalString (!enableUnfree) "-oss"}";
-  version = "2.16.0";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "harness";
     repo = "drone";
     rev = "v${version}";
-    sha256 = "sha256-bNvXAcFMPK8C/QN7VTdnicewRfaEtyJ45MhQSTNYp3U=";
+    sha256 = "sha256-b+kttHGH6KVsq9MR0bni7Gh1ZCIPkFzCvhoBdiC5Mk8=";
   };
 
-  vendorSha256 = "sha256-9EKXMy9g3kTpHer27ouuFDjh7zSEeBcpI8nH1VkMA9M=";
+  vendorHash = "sha256-I4GQ/KRM8vFOaMrGdSWll5PAk8ivFXdje7GTGYRPECw=";
 
   tags = lib.optionals (!enableUnfree) [ "oss" "nolimit" ];
 

pkgs/development/tools/deadnix/default.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deadnix";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "astro";
     repo = "deadnix";
     rev = "v${version}";
-    sha256 = "sha256-vP+NGqZfGbdk/BE5OVYDQQ9ZtwuJitnBHaPmg1X6el8=";
+    sha256 = "sha256-IcxupBqG3/h13sHgNYcO/oHKYfnK1LYd8Ehercz/Z/w=";
   };
 
-  cargoSha256 = "sha256-jmxaowzbejimpRdwuX3q3HDbZsv5qWpQ3gApAGdR8o0=";
+  cargoSha256 = "sha256-8l4V9AWrBBnEsdZ0Vs4ruPdu+WQVo2ZbJBmhmo23s2g=";
 
   meta = with lib; {
     description = "Find and remove unused code in .nix source files";

pkgs/development/tools/misc/strace-analyzer/default.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "strace-analyzer";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "wookietreiber";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ICUXedWg7ZT2Uzk7ZLpFqoEXiG4AzvkwCndR2aHKjVI=";
+    sha256 = "sha256-wx0/Jb2uaS1qdRQymfE00IEOyfgLtD4lXYasaJgcoxo=";
   };
 
-  cargoSha256 = "sha256-p/HYG/KaHtvgvAd+eg1fKmDnLoWCL+XiT66jRBU2xRE=";
+  cargoHash = "sha256-3OS3LEEk58+IJDQrgwo+BJq6hblojk22QxDtZY5ofA4=";
 
   nativeCheckInputs = [ strace ];
 

pkgs/development/tools/symfony-cli/default.nix

@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.5.2";
+  version = "5.5.4";
   vendorHash = "sha256-hDr/ByBCjKE+B698IXzDFq1ovS6Nfs4O32aF7HKmrcY=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    sha256 = "sha256-Bo9oT6POywVYfZwXFfSGMZTf4XhSm0hgG2cQg6W1A2U=";
+    sha256 = "sha256-9ywxYOvI3D2aRHk9MEVZ4zWgfGsRDz3wbMO006VJPL0=";
   };
 
   ldflags = [

pkgs/development/tools/unityhub/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/unityhub-amd64-${version}.deb";
-    sha256 = "sha256-/P6gPLSRGfwEN801cyNrZTpHyZKO+4tU6cFvLz8ERuo=";
+    sha256 = "sha256-I1qtrD94IpMut0a6JUHErHaksoZ+z8/dDG8U68Y5zJE=";
   };
 
   nativeBuildInputs = [
@@ -119,6 +119,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Official Unity3D app to download and manage Unity Projects and installations";
     homepage = "https://unity3d.com/";

pkgs/development/tools/unityhub/update.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl common-updater-scripts
+# set -euo pipefail
+
+new_version="$(curl https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/dists/stable/main/binary-amd64/Packages --silent | sed -nE "s/^Version: ([0-9]+\.[0-9]+\.[0-9]+)$/\1/p" | sort -V | tail -n 1)"
+old_version="$(sed -nE 's/^\s*version = "([0-9]+\.[0-9]+\.[0-9]+)";$/\1/p' ./default.nix)"
+
+if [[ "$new_version" == "$old_version" ]]; then
+    echo "Up to date"
+    exit 0
+fi
+
+update-source-version unityhub "$new_version"

pkgs/development/web/deno/default.nix

@@ -12,15 +12,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.32.5";
+  version = "1.33.1";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-H2qa83To6kG4rvpCwjxmsgPnuUHj6chK4UUultY4/OU=";
+    hash = "sha256-GQouxU48raJUXzV6IT0LSyb7z5LuICdVKD0OHqPFtGo=";
   };
-  cargoHash = "sha256-FgqpHn5WMoLjUQfiow7BuyvCu7ypuO4wWm/B4kr40MI=";
+  cargoHash = "sha256-PRlNp3dF9RLxmbmzD3fdso8PD/NEQIrtywHOsKcUHAA=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds

pkgs/development/web/deno/librusty_v8.nix

@@ -11,11 +11,11 @@ let
   };
 in
 fetch_librusty_v8 {
-  version = "0.68.0";
+  version = "0.71.0";
   shas = {
-    x86_64-linux = "sha256-yq7YPD2TM6Uw0EvCqIsZ/lbE1RLgIg7a42qDVrr5fX4=";
-    aarch64-linux = "sha256-uZFm3hAeyEUUXqRJFLM3OBVfglH3AecjFKVgeJZu3L0=";
-    x86_64-darwin = "sha256-YkxoggK0I4rT/KNJ30StDPLUc02Mdjwal3JH+s/YTQo=";
-    aarch64-darwin = "sha256-aXE7W3sSzbhvC661BYTTHyHlihmVVtFSv85nSjGOLkU=";
+    x86_64-linux = "sha256-52usT7MsLme3o3tjxcRJ0U3iX0fKtnvEvyKJeuL1Bvc=";
+    aarch64-linux = "sha256-E7CjpBO1cV5wFtLTIPPltGAyX1OEPjfhnVUQ4u3Mzxs=";
+    x86_64-darwin = "sha256-+Vj0SgvenrCuHPSYKFoxXTyfWDFbnUgHtWibNnXwbVk=";
+    aarch64-darwin = "sha256-p7BaC2nkZ+BGRPSXogpHshBblDe3ZDMGV93gA4sqpUc=";
   };
 }

pkgs/os-specific/linux/mbpfan/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "mbpfan";
-  version = "2.3.0";
+  version = "2.4.0";
   src = fetchFromGitHub {
     owner = "dgraziotin";
     repo = "mbpfan";
     rev = "v${version}";
-    sha256 = "sha256-jIYg9b0c/7mMRS5WF+mOH6t9SCWEP32lsdbCgpWpg24=";
+    sha256 = "sha256-F9IWUcILOuLn5K4zRSU5jn+1Wk1xy0CONSI6JTXU2pA=";
   };
   installPhase = ''
     mkdir -p $out/bin $out/etc

pkgs/servers/home-automation/evcc/default.nix

@@ -16,16 +16,16 @@
 
 buildGoModule rec {
   pname = "evcc";
-  version = "0.116.4";
+  version = "0.116.6";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = pname;
     rev = version;
-    hash = "sha256-zNTDqokPjPtgBXEy81c1gl2WsbBf9FehJ5y75cYVlQ8=";
+    hash = "sha256-i/6/kLgpCgrFhIsLhufHAcBa+VRAVXn9ichoNdnDLfY=";
   };
 
-  vendorHash = "sha256-lu6/tRf9o0n13lVsT9OBxc6Ytz3IVEE16vLZ+pZ4Czk=";
+  vendorHash = "sha256-K6d6C5m+hzKzpWYsYZHwNXBf5vET6SP/dtA+xTfQVgk=";
 
   npmDeps = fetchNpmDeps {
     inherit src;

pkgs/servers/http/apache-httpd/2.4.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-httpd";
-  version = "2.4.56";
+  version = "2.4.57";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "sha256-2NRfE5i6hO3QW7M8p1k6wpibF8ucegyv5UQtQa/bLXw=";
+    sha256 = "sha256-28y4Su6V4JXt+7geXrkmzNJOatpV3Ng8rssmLlz5TSo=";
   };
 
   # FIXME: -dev depends on -doc

pkgs/servers/ldap/lldap/default.nix

@@ -0,0 +1,68 @@
+{ fetchFromGitHub
+, fetchzip
+, lib
+, lldap
+, nixosTests
+, rustPlatform
+}:
+
+let
+  # We cannot build the wasm frontend from source, as the
+  # wasm32-unknown-unknown rustc target isn't available in nixpkgs yet.
+  # Tracking issue: https://github.com/NixOS/nixpkgs/issues/89426
+  frontend = fetchzip {
+    url = "https://github.com/lldap/lldap/releases/download/v${lldap.version}/amd64-lldap.tar.gz";
+    hash = "sha256-/Ml4L5Gxpnmt1pLSiLNuxtzQYjTCatsVe/hE+Btl8BI=";
+    name = "lldap-frontend-${lldap.version}";
+    postFetch = ''
+      mv $out $TMPDIR/extracted
+      mv $TMPDIR/extracted/app $out
+    '';
+  };
+in
+rustPlatform.buildRustPackage rec {
+  pname = "lldap";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "lldap";
+    repo = "lldap";
+    rev = "v${version}";
+    hash = "sha256-FAUTykFh2eGVpx6LrCjV9xWbBPH8pCgAJv3vOXFMFZ4=";
+  };
+
+  # `Cargo.lock` has git dependencies, meaning can't use `cargoHash`
+  cargoLock = {
+    # 0.4.3 has been tagged before the actual Cargo.lock bump, resulting in an inconsitent lock file.
+    # To work around this, the Cargo.lock below is from the commit right after the tag:
+    # https://github.com/lldap/lldap/commit/7b4188a376baabda48d88fdca3a10756da48adda
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "lber-0.4.1" = "sha256-2rGTpg8puIAXggX9rEbXPdirfetNOHWfFc80xqzPMT4=";
+      "opaque-ke-0.6.1" = "sha256-99gaDv7eIcYChmvOKQ4yXuaGVzo2Q6BcgSQOzsLF+fM=";
+      "yew_form-0.1.8" = "sha256-1n9C7NiFfTjbmc9B5bDEnz7ZpYJo9ZT8/dioRXJ65hc=";
+    };
+  };
+
+  patches = [
+    ./static-frontend-path.patch
+  ];
+
+  postPatch = ''
+    ln -s --force ${./Cargo.lock} Cargo.lock
+    substituteInPlace server/src/infra/tcp_server.rs --subst-var-by frontend '${frontend}'
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) lldap;
+  };
+
+  meta = with lib; {
+    description = "A lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication";
+    homepage = "https://github.com/lldap/lldap";
+    changelog = "https://github.com/lldap/lldap/blob/v${version}/CHANGELOG.md";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ indeednotjames ];
+  };
+}

pkgs/servers/ldap/lldap/static-frontend-path.patch

@@ -0,0 +1,43 @@
+diff --git a/server/src/infra/tcp_server.rs b/server/src/infra/tcp_server.rs
+index 43f65ea..e289f2a 100644
+--- a/server/src/infra/tcp_server.rs
++++ b/server/src/infra/tcp_server.rs
+@@ -26,7 +26,7 @@ use std::sync::RwLock;
+ use tracing::info;
+ 
+ async fn index() -> actix_web::Result<NamedFile> {
+-    let path = PathBuf::from(r"app/index.html");
++    let path = PathBuf::from(r"@frontend@/index.html");
+     Ok(NamedFile::open(path)?)
+ }
+ 
+@@ -68,12 +68,12 @@ pub(crate) fn error_to_http_response(error: TcpError) -> HttpResponse {
+ }
+ 
+ async fn wasm_handler() -> actix_web::Result<impl Responder> {
+-    Ok(actix_files::NamedFile::open_async("./app/pkg/lldap_app_bg.wasm").await?)
++    Ok(actix_files::NamedFile::open_async("@frontend@/pkg/lldap_app_bg.wasm").await?)
+ }
+ 
+ async fn wasm_handler_compressed() -> actix_web::Result<impl Responder> {
+     Ok(
+-        actix_files::NamedFile::open_async("./app/pkg/lldap_app_bg.wasm.gz")
++        actix_files::NamedFile::open_async("@frontend@/pkg/lldap_app_bg.wasm.gz")
+             .await?
+             .customize()
+             .insert_header(header::ContentEncoding::Gzip)
+@@ -118,11 +118,11 @@ fn http_config<Backend>(
+     )
+     .service(web::resource("/pkg/lldap_app_bg.wasm").route(web::route().to(wasm_handler)))
+     // Serve the /pkg path with the compiled WASM app.
+-    .service(Files::new("/pkg", "./app/pkg"))
++    .service(Files::new("/pkg", "@frontend@/pkg"))
+     // Serve static files
+-    .service(Files::new("/static", "./app/static"))
++    .service(Files::new("/static", "@frontend@/static"))
+     // Serve static fonts
+-    .service(Files::new("/static/fonts", "./app/static/fonts"))
++    .service(Files::new("/static/fonts", "@frontend@/static/fonts"))
+     // Default to serve index.html for unknown routes, to support routing.
+     .default_service(web::route().guard(guard::Get()).to(index));
+ }

pkgs/servers/mail/spf-engine/default.nix

@@ -2,11 +2,12 @@
 
 buildPythonApplication rec {
   pname = "spf-engine";
-  version = "2.9.3";
+  version = "3.0.4";
+  format = "flit";
 
   src = fetchurl {
     url = "https://launchpad.net/${pname}/${lib.versions.majorMinor version}/${version}/+download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-w0Nb+L/Os3KPApENoylxCVaCD4FvgmvpfVvwCkt2IDE=";
+    sha256 = "sha256-Gcw7enNIb/TrZEYa0Z04ezHUmfMmc1J+aEH6FlXbhTo=";
   };
 
   propagatedBuildInputs = [ pyspf dnspython authres pymilter ];
@@ -17,10 +18,6 @@ buildPythonApplication rec {
     "spf_engine.policyd_spf"
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py --replace "'/etc'" "'$out/etc'"
-  '';
-
   meta = with lib; {
     homepage = "https://launchpad.net/spf-engine/";
     description = "Postfix policy engine for Sender Policy Framework (SPF) checking";

pkgs/servers/memos/default.nix

@@ -0,0 +1,53 @@
+{ fetchFromGitHub, buildGoModule, jq, buildNpmPackage, lib, makeWrapper }:
+
+let
+  version = "0.12.2";
+  src = fetchFromGitHub {
+    owner = "usememos";
+    repo = "memos";
+    rev = "v${version}";
+    sha256 = "vAY++SHUMBw+jyuu6KFNt62kE5FM8ysGheQwBSOYos8=";
+  };
+
+  frontend = buildNpmPackage {
+    pname = "memos-web";
+    inherit version;
+
+    src = "${src}/web";
+
+    npmDepsHash = "sha256-vgO5HWbV/oR1GenK9q5a1bhlTSJqtF4HBcQTZ3DqZq8=";
+
+    postPatch = ''
+      cp ${./package-lock.json} package-lock.json
+    '';
+
+    installPhase = ''
+      cp -r dist $out
+    '';
+  };
+in
+buildGoModule rec {
+  pname = "memos";
+  inherit version src;
+
+  # check will unable to access network in sandbox
+  doCheck = false;
+  vendorSha256 = "sha256-P4OnICBiTAs/uaQgoYNKK50yj/PYntyH/bLihdPv88s=";
+
+  # Inject frontend assets into go embed
+  prePatch = ''
+    rm -rf server/dist
+    cp -r ${frontend} server/dist
+  '';
+
+  passthru = {
+    updateScript = ./update.sh;
+  };
+
+  meta = with lib; {
+    homepage = "https://usememos.com";
+    description = "A lightweight, self-hosted memo hub";
+    maintainers = with maintainers; [ indexyz ];
+    license = licenses.mit;
+  };
+}

pkgs/servers/memos/update.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix wget nix-prefetch-github moreutils jq prefetch-npm-deps nodejs
+
+set -euo pipefail
+
+TARGET_VERSION_REMOTE=$(curl -s https://api.github.com/repos/usememos/memos/releases/latest | jq -r ".tag_name")
+TARGET_VERSION=${TARGET_VERSION_REMOTE#v}
+
+if [[ "$UPDATE_NIX_OLD_VERSION" == "$TARGET_VERSION" ]]; then
+  echo "memos is up-to-date: ${UPDATE_NIX_OLD_VERSION}"
+  exit 0
+fi
+
+extractVendorHash() {
+  original="${1?original hash missing}"
+  result="$(nix-build -A memos.go-modules 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
+  [ -z "$result" ] && { echo "$original"; } || { echo "$result"; }
+}
+
+replaceHash() {
+  old="${1?old hash missing}"
+  new="${2?new hash missing}"
+  awk -v OLD="$old" -v NEW="$new" '{
+    if (i=index($0, OLD)) {
+      $0 = substr($0, 1, i-1) NEW substr($0, i+length(OLD));
+    }
+    print $0;
+  }' ./pkgs/servers/memos/default.nix | sponge ./pkgs/servers/memos/default.nix
+}
+
+# change version number
+sed -e "s/version =.*;/version = \"$TARGET_VERSION\";/g" \
+    -i ./pkgs/servers/memos/default.nix
+
+# update hash
+SRC_HASH="$(nix-instantiate --eval -A memos.src.outputHash | tr -d '"')"
+NEW_HASH="$(nix-prefetch-github usememos memos --rev v$TARGET_VERSION | jq -r .sha256)"
+
+replaceHash "$SRC_HASH" "$NEW_HASH"
+
+GO_HASH="$(nix-instantiate --eval -A memos.vendorSha256 | tr -d '"')"
+EMPTY_HASH="$(nix-instantiate --eval -A lib.fakeSha256 | tr -d '"')"
+replaceHash "$GO_HASH" "$EMPTY_HASH"
+replaceHash "$EMPTY_HASH" "$(extractVendorHash "$GO_HASH")"
+
+# update src yarn lock
+SRC_FILE_BASE="https://raw.githubusercontent.com/usememos/memos/v$TARGET_VERSION"
+
+trap 'rm -rf ./pkgs/servers/memos/package.json' EXIT
+pushd ./pkgs/servers/memos
+wget -q "$SRC_FILE_BASE/web/package.json"
+npm install --package-lock-only
+NPM_HASH=$(prefetch-npm-deps ./package-lock.json)
+popd
+
+sed -i -E -e "s#npmDepsHash = \".*\"#npmDepsHash = \"$NPM_HASH\"#" ./pkgs/servers/memos/default.nix

pkgs/servers/nosql/influxdb2/cli.nix

@@ -5,13 +5,13 @@
 }:
 
 let
-  version = "2.7.1";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     owner = "influxdata";
     repo = "influx-cli";
     rev = "v${version}";
-    sha256 = "sha256-CRSfbUzyWzBmaks69Iax8IBxsWt3k48A+bfx7bLw6h4=";
+    sha256 = "sha256-hRv7f2NeURsgLQ1zNgAhZvTjS0ei4+5lqokIu0iN+aI=";
   };
 
 in buildGoModule {
@@ -19,7 +19,7 @@ in buildGoModule {
   version = version;
   inherit src;
 
-  vendorHash = "sha256-UyAxato4NDejyomQpp15URxxYGtqmQPFdtzSuiQMJW8=";
+  vendorHash = "sha256-QNhL5RPkNLTXoQ0NqcZuKec3ZBc3CDTc/XTWvjy55wk=";
   subPackages = [ "cmd/influx" ];
 
   ldflags = [ "-X main.commit=v${version}" "-X main.version=${version}" ];

pkgs/servers/pocketbase/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-SxtKAu+ZLMMoOYqKrg/tARw2GCNDbsceWjsHm0iXwbU=";
+    sha256 = "sha256-2O7M9K3NLa86tzezs+HL49ja+hhcKCmj5KdxpUjzm5Q=";
   };
 
-  vendorHash = "sha256-OknAntETXDJVl2i5ie1VwsbGmcbRWA+MJomaCIgdKDo=";
+  vendorHash = "sha256-KV7FmJQZj5QFPUZZjjOw9RTanq4MQtFi8qM90Pq1xTs=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];

pkgs/tools/admin/pulumi-bin/data.nix

@@ -1,44 +1,44 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.62.0";
+  version = "3.65.1";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.62.0-linux-x64.tar.gz";
-        sha256 = "1xr55za8d1hqs97gg7wjyggv052dg041qjrqn34fkgnlzfd4mzpx";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.65.1-linux-x64.tar.gz";
+        sha256 = "0xih9xvaf28l1w9r2icf57x3yiizvqnf5rwrw2k6bhazrf9jisq0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.1.0-linux-amd64.tar.gz";
-        sha256 = "07crb0rs2cflq0g2y1gnri9pfazawhbr58lis31qm7qk4d00r1j6";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.1.1-linux-amd64.tar.gz";
+        sha256 = "0x9lwf9yw378s56d58wz9fancy1cnm7jmpzsh3bbdjq44m2zz4zl";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v4.3.0-linux-amd64.tar.gz";
-        sha256 = "0n01d1n5xnxz9z4djcl32lv2szz7jsr3hjdfl7ajnmss0zmc5jwk";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v4.4.0-linux-amd64.tar.gz";
+        sha256 = "0xkwnp978w36c298q5wx73x00ppvw0mnpr8z418zhy073ws2yqh1";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.35.0-linux-amd64.tar.gz";
-        sha256 = "0zxzjw04lp7ayjh781098fnvpjzmdga9r7gxsyvilb34n3p0jwzd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.36.0-linux-amd64.tar.gz";
+        sha256 = "0yglxb5xlji4nb47ldx0zc3viyk7r2w0hlvqk1f4lrl9v2bd4p1i";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v3.2.1-linux-amd64.tar.gz";
-        sha256 = "0bwc506j7azz34smkydlpxr55yznxp3qnp7zw7cd9j3gv6z73r2v";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v3.4.0-linux-amd64.tar.gz";
+        sha256 = "0s7p5vpplnapsmdxpypkxyw67xga68ibccx4gwx8s98dlg5yx46z";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.18.0-linux-amd64.tar.gz";
         sha256 = "1lz34a178hsix18rpwv9kr8w0f2vyglbf27c23lm57r98860i5rx";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.35.0-linux-amd64.tar.gz";
-        sha256 = "1sl0987dyzlb7nw5n4cbxzapz8722irk3x8mhqvpi4409zjwsh5v";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.39.0-linux-amd64.tar.gz";
+        sha256 = "109drzf3w7z1ml9khi3l79y74fdj7gc2aa4cj0whz0w3w1m7wdhf";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.39.0-linux-amd64.tar.gz";
-        sha256 = "09zy6x7si84fqv9nhxd5s2169nwqp8l2rzqk6h9yghx2x7zgg8w1";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.42.0-linux-amd64.tar.gz";
+        sha256 = "17y1cz6vnjb89f52p5riysr5zm9sk8ph4kaxw2f5zwr9sfk58da6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.36.0-linux-amd64.tar.gz";
-        sha256 = "193yv9ygxw7zr9j1q5h9p9pp992kf251kplgd1n1frb08pzxikvw";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.37.0-linux-amd64.tar.gz";
+        sha256 = "0j5b9zn0vb89s28xfzxbjwqwgcsyq56plhawhrhfhp4gyl61ca9p";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.7.0-linux-amd64.tar.gz";
@@ -61,44 +61,44 @@
         sha256 = "0zknpam1li0slymr381825rssnpcd0m2wvakqnaihzxlh4m6arvi";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.1.2-linux-amd64.tar.gz";
-        sha256 = "02axpxakd6vjsnkgn14vfai8p20ifl38rhwq66499lccpwikc7zv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.2.0-linux-amd64.tar.gz";
+        sha256 = "0qz6gch44mw0g33jsg2gqlb93ih64vqrbg804h8flrifni7asf5w";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-linux-amd64.tar.gz";
         sha256 = "0hnardid0kbzy65dmn7vz8ddy5hq78nf2871zz6srf2hfyiv7qa4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v7.2.0-linux-amd64.tar.gz";
-        sha256 = "184y56wh035xjm1bphjcb67cfnpjrniwzq40m1aahhwm1l74x3gx";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v7.3.0-linux-amd64.tar.gz";
+        sha256 = "1g0xdwnpl075ksrfpp2jch9sgd959am3j0mbzqj10g8l5zimcach";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.53.0-linux-amd64.tar.gz";
-        sha256 = "0rv8rvskm0cqida6hrqg8basc2m8kcx7pazlyxz5r86nj4wascb3";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.55.0-linux-amd64.tar.gz";
+        sha256 = "1lzlfp73wma8bjn3bkk96g2j5l775d8npf9yix1h0g45fw99bggs";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v5.7.0-linux-amd64.tar.gz";
-        sha256 = "0zz88ff478w3lp3branpdkzw2gla29xdz7zjbiaqwj5gpc0njp12";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v5.8.0-linux-amd64.tar.gz";
+        sha256 = "01b8mnszd2wqszk9pi9kf4hmvwzd5z86322jdbbzh228cjggyyn2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.9.0-linux-amd64.tar.gz";
-        sha256 = "094vc026li9s76y05p778siikq0dg6lgqdnx4cby4qqipfwvnf7m";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.10.0-linux-amd64.tar.gz";
+        sha256 = "058zdfjanzkc4a12n6knjh4994c1bnd0nsjbmxnz8sk393srmpz8";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.29.0-linux-amd64.tar.gz";
-        sha256 = "14k9vsi4phsc0wiwp0fzq6jc02bkd78symcn89z4gsli2xrfkdxv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.30.0-linux-amd64.tar.gz";
+        sha256 = "1h9f3j3n0354zja9i4cr20azxqz5khl6a041ffjsasxvgiapzckc";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.10.3-linux-amd64.tar.gz";
-        sha256 = "1gd5p5sckjmzbdb94kadaddzbl1j1lw254jhq63mgnh6v2wwij17";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.11.1-linux-amd64.tar.gz";
+        sha256 = "1m8j6xyhiyjzcv8gp9n157zzjgn274wf09mjlk1ixpqp9shwmngw";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.24.3-linux-amd64.tar.gz";
-        sha256 = "0lzc4fj89xp2f1dx3rm44mvaqnby1r181yy145gcmkky1jqi95rd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.25.0-linux-amd64.tar.gz";
+        sha256 = "15sz8ag2lvrvn84ls83bal0j7x1mmc3gsazpksp0as1z3dz9xqmz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.12.0-linux-amd64.tar.gz";
-        sha256 = "0hanfcw21n7d2m6zzj98mgfq3kdc70xp7bqc4lilmh6f90dhcrhy";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.0.0-linux-amd64.tar.gz";
+        sha256 = "0kjj2437innfcir1v8s10bwnczinc9026az2ww6z3594bgqy5jwm";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.4.1-linux-amd64.tar.gz";
@@ -117,16 +117,16 @@
         sha256 = "0yrzdbcvg16a2v7hc6rq4cmavimkj4hjxd3kfkw8gd2cbi4kcmwf";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.12.1-linux-amd64.tar.gz";
-        sha256 = "19g6n7afv1rkca9j0388v5ypn458pawzfhlcwgvkn6aj4c5fbawr";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.13.0-linux-amd64.tar.gz";
+        sha256 = "0kk9pkc931fds1fxsk4bbc3jq1gjsvv972gyizjq3b5rhvp3mmmg";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.21.0-linux-amd64.tar.gz";
-        sha256 = "1v6hhz59xnnvx24b0p0yhh4a387n0kws6bdilnamld3hrr8c5x1b";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.23.0-linux-amd64.tar.gz";
+        sha256 = "1zwrvm98917ci6835njpbnzmh82bjzj597jmvqyzaznc62060iia";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.28.0-linux-amd64.tar.gz";
-        sha256 = "1dh691s2cfbv34bs98p48m8fva9yr0ivkwyxnz5w5nk02l2fnakk";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.30.0-linux-amd64.tar.gz";
+        sha256 = "173c0mn62mgcqr1b8ckr2r4v94dlr8c14ka728p8zxh9hxkf9ysx";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.13.0-linux-amd64.tar.gz";
@@ -141,8 +141,8 @@
         sha256 = "1n0brv4m8xjyd3lk1rgwbj7c5bpa1m6lr95ipzj3nk8338mb420n";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.10.0-linux-amd64.tar.gz";
-        sha256 = "15rxgydf34vlabsmgz7i47l5wp27vl22vsmglxl0nnycrhl15j2a";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.11.0-linux-amd64.tar.gz";
+        sha256 = "0d6aw10x2lksn940818hnil4fhmswkhpxkz7v0inc5iz3lclpjni";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.5.0-linux-amd64.tar.gz";
@@ -163,40 +163,40 @@
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.62.0-darwin-x64.tar.gz";
-        sha256 = "07ibkl29wmwln1mh55i088x21p0snbrgr7jk615y6bdbwvb8y1ym";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.65.1-darwin-x64.tar.gz";
+        sha256 = "030rmn0mcvlrd7lzbb0qfzsffqp50w4z39zqrpn38cwmsvbz3nic";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.1.0-darwin-amd64.tar.gz";
-        sha256 = "02j4wqzjpi3bxy96gngdyv04c6rff3v11pd073fpcwly5v7hc951";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.1.1-darwin-amd64.tar.gz";
+        sha256 = "0jhvbnx6kq2wvqqn1gd82fkk2r9qz173iaf6l6nbjsdqwajj8fky";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v4.3.0-darwin-amd64.tar.gz";
-        sha256 = "1i07ysdy09ps0l40qz7acj69b6l30q3y4l4cabg3wbrzwxzsa0ki";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v4.4.0-darwin-amd64.tar.gz";
+        sha256 = "0m0gf5h3x1hzc0gpqfqzbmma36b2zx0c08j7w1m3dwji8ffv1bf7";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.35.0-darwin-amd64.tar.gz";
-        sha256 = "1k5lriwzszwil38s8aphfv335ym9wcf7l42hn4wicf5ky42d8c6h";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.36.0-darwin-amd64.tar.gz";
+        sha256 = "1dm36p04xzlx2d2sdnx55298srn8kwg16a0q7a21vz4x60x0qdj7";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v3.2.1-darwin-amd64.tar.gz";
-        sha256 = "1v6q08vkjfdj2jhv83qvmcgb5vr2xx8zrq3wyqa98l81bi6i36vz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v3.4.0-darwin-amd64.tar.gz";
+        sha256 = "03w0zkybb5iw8hhf8jv5538dwl1yam5v10q9w97w88haxcj8jzp8";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.18.0-darwin-amd64.tar.gz";
         sha256 = "1hlvacv7nwizbijzqfxv996jms2vjak46pnp2mixr05zlmf0p890";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.35.0-darwin-amd64.tar.gz";
-        sha256 = "0zz5wv4gvjzgr8mhr3zp2mkrmsg56ifajg5qjh1i1i0x5sv99rsn";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.39.0-darwin-amd64.tar.gz";
+        sha256 = "0wk5l1bz31xrj2y58kwyd67lplnjjjmri3mmxnw0dhxqygh190hh";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.39.0-darwin-amd64.tar.gz";
-        sha256 = "002pw2c6bx7jpqm4kvv86ra5hrs0dzj6cn0pa73gzw4b2sdpy33n";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.42.0-darwin-amd64.tar.gz";
+        sha256 = "0773lvpjn8z1c0q263j94shpzqf31jg3hsr5ngrc9669k08d0sb7";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.36.0-darwin-amd64.tar.gz";
-        sha256 = "0xfkqn9x4dgaj4z94v31jdncqqdg46iw64y0g1sm2bm8g57a8zxv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.37.0-darwin-amd64.tar.gz";
+        sha256 = "190dj6xkd013d988xhywivylzjl4jlq301hdp73ckl5wccdr8j31";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.7.0-darwin-amd64.tar.gz";
@@ -219,44 +219,44 @@
         sha256 = "0vpa47dbqv4bw2i2ayxzh9xlph6y0l1sjrb203f55l312z5y2g22";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.1.2-darwin-amd64.tar.gz";
-        sha256 = "0sn4fzvlxpadsbdb56nc7b46sfi967xn3wsp2jd045g0lhkbz7fn";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.2.0-darwin-amd64.tar.gz";
+        sha256 = "01g2kwr28mdcyrhdsfsiylmpavsx5ngkpnpai7s1l6pwdsc32ayd";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-darwin-amd64.tar.gz";
         sha256 = "1m5lh59h7nck1flzxs9m4n0ag0klk3jmnpf7hc509vffxs89xnjq";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v7.2.0-darwin-amd64.tar.gz";
-        sha256 = "1033h9k8ffyyprd5cvk8l93d1bvhfa91cb866vxz6v1ldgwjrqrf";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v7.3.0-darwin-amd64.tar.gz";
+        sha256 = "1fwbjar3kl4j91qz87ggci75245vy3rilq78idnx0y46k9383qs1";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.53.0-darwin-amd64.tar.gz";
-        sha256 = "1dz3kxdcbagxspjvhimk8ly93fyih0i145z9870jdw9z4m1cl9f2";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.55.0-darwin-amd64.tar.gz";
+        sha256 = "02fxrb0q83f9ylyyhaqb7hgmsl5j40x50ikkkil9j96dmzhgfjz3";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v5.7.0-darwin-amd64.tar.gz";
-        sha256 = "0nwblnw3a9ya7841iph7cd0nnwg95wbmjx2w7qc9052c2mawvl9q";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v5.8.0-darwin-amd64.tar.gz";
+        sha256 = "1hixsfi8wfz93d1gk0gxw8j74nhmfm8avzdi73irh6cm1ycgbqvx";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.9.0-darwin-amd64.tar.gz";
-        sha256 = "12imy2q8bl255cmc26swa6kflcb08gkh7mnvwxss8nzj0a6rl8vw";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.10.0-darwin-amd64.tar.gz";
+        sha256 = "1xnbsxmqsm8dan0y63ghbx9hg1labcgfcflikgzlaqacgyccmakd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.29.0-darwin-amd64.tar.gz";
-        sha256 = "0np10lxwingxxy4m9j2h7nh9yiwzb79fj10cq8iqjdi1m852nl1f";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.30.0-darwin-amd64.tar.gz";
+        sha256 = "003sf9a6pc4yxw379k4izj2gvmbmksga419j6splrdjhnhsr7mgy";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.10.3-darwin-amd64.tar.gz";
-        sha256 = "09xi66s68h5966hv4vczc4z72awyaqncbkdcg03q3jjawg3lz32y";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.11.1-darwin-amd64.tar.gz";
+        sha256 = "1q0dprfnqsdb81ndh83hmz1iargkbkxn6v159nj9393zm0rjd3nv";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.24.3-darwin-amd64.tar.gz";
-        sha256 = "0fnwx6qsa5j62hq2rjfw5zdsvhasjnzl9a4lal57j0y033p1hqdb";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.25.0-darwin-amd64.tar.gz";
+        sha256 = "1kwdyzzpx0b9j0yr955vmksahdnr3wdwjcfvkcyljpclg8n0bwbd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.12.0-darwin-amd64.tar.gz";
-        sha256 = "0y78a6sc81mnbr7djj4nmyra5n3bmqnm9jic0552mqikw59jsikw";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.0.0-darwin-amd64.tar.gz";
+        sha256 = "0jnw5v2450ncsh1hyzgd9glm4rj55a363bblb3h2j0sas1f7kain";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.4.1-darwin-amd64.tar.gz";
@@ -275,16 +275,16 @@
         sha256 = "0q9hjfyn4r14fplxx597kjy8g3jpcps4bp7gsyy4ri8fipldjnf3";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.12.1-darwin-amd64.tar.gz";
-        sha256 = "1iyybcphd7j6zy29ka1cxd98cbzczdfc70fy0rjg8a07zh6qsrnr";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.13.0-darwin-amd64.tar.gz";
+        sha256 = "034v6ri540q0lqd6llc69wj7p29hapm802f68y0k6r7w21avy5vh";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.21.0-darwin-amd64.tar.gz";
-        sha256 = "18f6abks19vcmagd4kpd9c0lh7vv9g10dswxshpkrfpik6xn9hnp";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.23.0-darwin-amd64.tar.gz";
+        sha256 = "0sslxyw845hjh1kn98nygj4qc5xylma6lwssbla3mvki363zjd2g";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.28.0-darwin-amd64.tar.gz";
-        sha256 = "09xphk2i4w9rpzqs6k8x388xbzfi15vbl9k7n59nnd6q30z3yb5v";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.30.0-darwin-amd64.tar.gz";
+        sha256 = "0rsv7cg8l4g5cra81amrhlns8139y45i3cnz5chca7yjzlmj5iyv";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.13.0-darwin-amd64.tar.gz";
@@ -299,8 +299,8 @@
         sha256 = "1cr0zbfrid4xsyjmabppzg7f867vmhpjf29s4qrb3g9vg0k4fibk";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.10.0-darwin-amd64.tar.gz";
-        sha256 = "0f5h47q7cg6w9a17x369vn4fx97a6akwwr4ilgfq6bf8050r0cil";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.11.0-darwin-amd64.tar.gz";
+        sha256 = "1m5pgah9q31kc4d3m5s74qqlax00r2x8i8y07pmb8g3fjr9hvk1s";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.5.0-darwin-amd64.tar.gz";
@@ -321,40 +321,40 @@
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.62.0-linux-arm64.tar.gz";
-        sha256 = "0g1g5dldmcl6rkr0dz9whdzkq8p6b7w83jmk0m0ms9paqv76lvw6";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.65.1-linux-arm64.tar.gz";
+        sha256 = "1d0jfrkx8cvl6q0kny3nlyc9kgbi7b7l2flq16r3lw29g8wj7faw";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.1.0-linux-arm64.tar.gz";
-        sha256 = "1g4zb6hx5541xxshgdiwgryv0rw5kq5z3h0xk7p7h6lb5f14a278";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.1.1-linux-arm64.tar.gz";
+        sha256 = "0fglnwzwl4yafk163g2w35gz186zj59mblyc949wsdy3lsjs8y30";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v4.3.0-linux-arm64.tar.gz";
-        sha256 = "1h92d4n9n4ia7y8lnah9fpfkz6yzyxa6dh69kv2cjk17m57x6h0v";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v4.4.0-linux-arm64.tar.gz";
+        sha256 = "1xgqqjzxcjmbw4ba65rkx0504dwibc61b70dnz4pdmalmynqx86r";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.35.0-linux-arm64.tar.gz";
-        sha256 = "1g6gzcyrskhv6873nhnz4190fylljyishm8qsf3g79zk55bdikj6";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.36.0-linux-arm64.tar.gz";
+        sha256 = "0ns2sm0jnjg8g4hrfyw7ihddccbzrvjjah5czi4x6c9dzi8kmv27";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v3.2.1-linux-arm64.tar.gz";
-        sha256 = "1g8819p3n6r0ydmnf54qb0iyd8nn3jjhi4cj40fmlkk4biazafdi";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v3.4.0-linux-arm64.tar.gz";
+        sha256 = "0fgly0wm5dqcxcqpwr3mayn45mhk9kjg6b1n6lz9l2c59qq5g5vx";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.18.0-linux-arm64.tar.gz";
         sha256 = "0s6ifpr0y0wyik9zdf9ydmky2w0501bcafpswmrar6hvblgbgiib";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.35.0-linux-arm64.tar.gz";
-        sha256 = "1y4pfa8ld4pa2205p21k4khzi8yh3bqfq880536hw85lvpgn90gq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.39.0-linux-arm64.tar.gz";
+        sha256 = "0nwpxvz6s4fx20g417qfw6ib1a49ggbk0yq9qgg3c0sdr26c3s8w";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.39.0-linux-arm64.tar.gz";
-        sha256 = "084pjdam68z4kasf4nl2bva5q8nwa0ah89rn2xz239by3y0bia4b";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.42.0-linux-arm64.tar.gz";
+        sha256 = "1nnv38x3000shmh2l399fjwvabq2znjz9r3f0qs4xw7h23g15laq";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.36.0-linux-arm64.tar.gz";
-        sha256 = "1pppk7i4hr1r1wsig2hrda5rjn6z07fw95k6fmihsynk8q8v7nj1";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.37.0-linux-arm64.tar.gz";
+        sha256 = "18znzz7wpic7h1w6z1d9p5qhgp6zvjvih0bv85hspxpb8ay3j0qb";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.7.0-linux-arm64.tar.gz";
@@ -377,44 +377,44 @@
         sha256 = "1dq6nbvh1py951s2ips23fh4dg50r67d9g91r94ahagzb75pj5ml";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.1.2-linux-arm64.tar.gz";
-        sha256 = "1h9kpbbbfh8q5j9mym8j48nk54sfxyprsi8gdivk4sx27lx81fkh";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.2.0-linux-arm64.tar.gz";
+        sha256 = "0q6pig7dzb0smcbib4lpfl3fl0xhlvfpg7244ylz5jn6bdr8b3bb";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-linux-arm64.tar.gz";
         sha256 = "111pia2f5xwkwaqs6p90ri29l5b3ivmahsa1bji4fwyyjyp22h4r";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v7.2.0-linux-arm64.tar.gz";
-        sha256 = "0cwv7cjd96yj0c86dng4k2yybrw1dk68qhrijcszm3vj91ch4nmi";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v7.3.0-linux-arm64.tar.gz";
+        sha256 = "1l1lw8iz0gqb0cvhl74dmyr17hfd8l9aaj3hb67bw8d7l6z326xz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.53.0-linux-arm64.tar.gz";
-        sha256 = "1lbwp85x9608acz3wx91y68lr73h5bkh1vglji9x7p76rg3nkh2k";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.55.0-linux-arm64.tar.gz";
+        sha256 = "148ia31q6kbkz3y2yxq8sm05014gzk4m4vy1rhp90mzlxbr2ki10";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v5.7.0-linux-arm64.tar.gz";
-        sha256 = "124r9dkpsw87hqj24iwzml9dnm2c5vwqymmxbxa22p6cf82l6p79";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v5.8.0-linux-arm64.tar.gz";
+        sha256 = "1wmv0ank1dl750hwlw3rw0npfqy7xjq29zs8brm747p1s0s92446";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.9.0-linux-arm64.tar.gz";
-        sha256 = "0yjy3i95jsdqwmb7qgixlnhzsr6hiv14jcsydjk9j821zw4xrwpr";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.10.0-linux-arm64.tar.gz";
+        sha256 = "0j9y1qwhjlyshyhjhkvmv6hpsvr4lphd8n08b36hamiszbq2hd49";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.29.0-linux-arm64.tar.gz";
-        sha256 = "1nmrz4gfb3wnqyy638y4l4xkr66angjkj5z6n2aj27jhpsgyxy0n";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.30.0-linux-arm64.tar.gz";
+        sha256 = "184m9cpbxl2wp781x4mpana078rzdqnhq5g2wqg1skwnlmg0g378";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.10.3-linux-arm64.tar.gz";
-        sha256 = "0g4s4myx9qyzzpcnq2h1lm0kajwfww2m4nfvnxhlpnhc51yn2j60";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.11.1-linux-arm64.tar.gz";
+        sha256 = "0fr2nccdi3yv8p26jn97nxy303fxqbl6dl4kpv2q9x1r1yp8ayvf";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.24.3-linux-arm64.tar.gz";
-        sha256 = "0ww83x60znn33wnh5f4y23sm847xwvfnbn704kbw3wz61p8hx39b";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.25.0-linux-arm64.tar.gz";
+        sha256 = "1i4hhxag2kdmi3yx0qajxzrjzdybpjdsjc318v2v2xc39nyi51mi";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.12.0-linux-arm64.tar.gz";
-        sha256 = "087hbcb5y7l3gmr7x2y5kzp1ykdj0samm7vbn5iy2y2rpwirszpw";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.0.0-linux-arm64.tar.gz";
+        sha256 = "0b4p8n9sdda4gxlv6zwaz29lhxynvbalqsw0lfnrbf9zlcvbfyxs";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.4.1-linux-arm64.tar.gz";
@@ -433,16 +433,16 @@
         sha256 = "0hj4a0llq088xcfp85k6nn8ssffj51lvhqp05sg8x3kbg6n0dapy";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.12.1-linux-arm64.tar.gz";
-        sha256 = "0agw84w6rqyfkdkmmk7sbd13bj5wskl501qfa51syligdmiixf7j";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.13.0-linux-arm64.tar.gz";
+        sha256 = "13jmz3wc54fzpyc0hih9bj9k8angy94y1w525m7m1j053vma1an3";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.21.0-linux-arm64.tar.gz";
-        sha256 = "1hjk5rxklbm607ayp6mqb8x810n09prs20cwj9j19kxynabpdqc1";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.23.0-linux-arm64.tar.gz";
+        sha256 = "1ks120b0fch872743w3dh3hhkzwl23sv9f6kjv7znx2njncla37k";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.28.0-linux-arm64.tar.gz";
-        sha256 = "0wgn9snib1z8q9f7ssfxrjr5yldwjd3iwhng21800c1ljgva2429";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.30.0-linux-arm64.tar.gz";
+        sha256 = "0ba24psajjxh55pxazzzqvisfkli7kgbj6fvr72fzf4cafi856cf";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.13.0-linux-arm64.tar.gz";
@@ -457,8 +457,8 @@
         sha256 = "0wc2j439pi1s5j6ncmdj0670svis5ljfgn1q49lh37pgn88m7m75";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.10.0-linux-arm64.tar.gz";
-        sha256 = "1f5rn3kf6qp4y1vajx68xqx16hybfcxfddfwrf79344qpm57d1pw";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.11.0-linux-arm64.tar.gz";
+        sha256 = "1p8xjjsfy9hkww6p66jzr5q5nn07ng25y6yjzb3xvcfsrbkzylsm";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.5.0-linux-arm64.tar.gz";
@@ -479,40 +479,40 @@
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.62.0-darwin-arm64.tar.gz";
-        sha256 = "1y96acwg1axdm045zy87k3bsfngs4lp41sy9srzwvqfwxp2vbsz3";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.65.1-darwin-arm64.tar.gz";
+        sha256 = "0xcqcnmvxhddfx67ydgwqj64xw5aa6csmlw8fhhlk18f38ndnfl1";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.1.0-darwin-arm64.tar.gz";
-        sha256 = "0sj5f6ckfd2y3l680k9r5n67zy5r2nrli7fc5v0zakawwf886wdz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.1.1-darwin-arm64.tar.gz";
+        sha256 = "17ck2d3xwzin7y20i521naizljbg4kdxpdmq17n02v3w7ajga392";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v4.3.0-darwin-arm64.tar.gz";
-        sha256 = "0da555h07fzmrg25sw33744cwh678rb231i0w7arpws2r3qdjjwv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v4.4.0-darwin-arm64.tar.gz";
+        sha256 = "019ndq1vw0f3970hq459xlr5g3bar90s8598lvk0w3qbsl129ydv";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.35.0-darwin-arm64.tar.gz";
-        sha256 = "1w7c8dzyzq73chkz7986gn6nqyk7qmfghbx9k2aa0fw803gqqnfs";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.36.0-darwin-arm64.tar.gz";
+        sha256 = "0qgxj052xcnl7y09rdma4c003fms07jqnzgq7y0076lkvf6q5xrf";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v3.2.1-darwin-arm64.tar.gz";
-        sha256 = "1yv20fxzck3rs577p5avwsbcac8d001w43r08rh7s0q7r10mmq8k";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v3.4.0-darwin-arm64.tar.gz";
+        sha256 = "1a2xsgq7jswq4ms7xfsh53z924c4509072gvwnnqjgawayz011yw";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.18.0-darwin-arm64.tar.gz";
         sha256 = "1p1xyhll66vil1hmszamjn6lspiygxdrzfkrmwknh1z9r14nvhcw";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.35.0-darwin-arm64.tar.gz";
-        sha256 = "13wps5ih64rlif7ps0w7cm2q21fng27b6lp0r55v5j8rada43xn5";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.39.0-darwin-arm64.tar.gz";
+        sha256 = "0xnj9dldf8h4db26gnqz0mvsf1zz4skjxinvq5kxldd0x6mi90x9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.39.0-darwin-arm64.tar.gz";
-        sha256 = "1df0g7kdn518jfgbwm38wsf47ll41lsgmbdq5zcah29whvv5zhyv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.42.0-darwin-arm64.tar.gz";
+        sha256 = "0kkfrfa445q2177lyncqrjny3ymw2zzlfgbsgfqqfq2602l42s3f";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.36.0-darwin-arm64.tar.gz";
-        sha256 = "17pzqyiw8gxqi5rjyqk74cjywpna8x1y0hbfzbd5547myxqc0949";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.37.0-darwin-arm64.tar.gz";
+        sha256 = "1v9fsds91d6cbw9c5i52687ipk8s87ma323i5b7v2zwiw343v9av";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.7.0-darwin-arm64.tar.gz";
@@ -535,44 +535,44 @@
         sha256 = "1h5pahqhgj8kvagv8wgv1sf4cxk8vs8sinw5q0mlnwa5z0z5hgwj";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.1.2-darwin-arm64.tar.gz";
-        sha256 = "1j2vhl06c3zl9gbgqbbkypdzf18rsn087365l4hq7l2y0mhps8kg";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.2.0-darwin-arm64.tar.gz";
+        sha256 = "19n8h72jsph5pwvxayg5zah31nr486bdq4siagcfscqm3kqdymg8";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-darwin-arm64.tar.gz";
         sha256 = "12bzicm43l7yvh02v5fx3z8v46l9i7a9f677735xi5rjbmd2an4c";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v7.2.0-darwin-arm64.tar.gz";
-        sha256 = "0074d9q6zby1rki65byl3rndblcq614jmyda5qbc6dmcjb0paqhx";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v7.3.0-darwin-arm64.tar.gz";
+        sha256 = "0rzdvq4n4zvjcg5q4a076r9mbmbqfzmihiinppiczsqwik1mb8bz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.53.0-darwin-arm64.tar.gz";
-        sha256 = "116v7hmwhpr4bhjr4p7837jmbkrb67phml9rq0sgvhp2v73rp5d4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.55.0-darwin-arm64.tar.gz";
+        sha256 = "0gslaph3ygr3rwxhpj01mjjlmmfyw0h3dwjvrzmqfcw71fvc1zcb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v5.7.0-darwin-arm64.tar.gz";
-        sha256 = "0lgc0kjq4p34rg7lv1p4pm8kngd7y60ks2xqv59xr50q9hlc3mg0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v5.8.0-darwin-arm64.tar.gz";
+        sha256 = "14x99rw3wgapfd2cm0x5v3ga3kngbh7ngacpb6bbsxymzdg1xk2d";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.9.0-darwin-arm64.tar.gz";
-        sha256 = "1lkj6zjzhg7s06p75wia14jjsfqs2wza08m4bbcpc4s99b4p6274";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.10.0-darwin-arm64.tar.gz";
+        sha256 = "0gyi1w005153bnvl68bdxkkjdprgvng51mp9qjcv6ba262mdg589";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.29.0-darwin-arm64.tar.gz";
-        sha256 = "0pny34hf9g8n748hdfczf4ik6f01xmp7rmp8ix8rqjhlr7nj8spn";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.30.0-darwin-arm64.tar.gz";
+        sha256 = "1jq6bvy7qw2lzq561pwi7sxc5ld568as0bzka5vw1787ygmy1mp9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.10.3-darwin-arm64.tar.gz";
-        sha256 = "0yi1y22s1mhdrv6kwg94c5yr57jpp456illnaa1kwb3x7rkha9ff";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.11.1-darwin-arm64.tar.gz";
+        sha256 = "0sf6y7qqcj4l0nd3mdhvhmbkhp9iy3m6fh9pfqgxgwxljmj2iwmw";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.24.3-darwin-arm64.tar.gz";
-        sha256 = "18pi5bd7n6kq8ddn8djmn80m0n943p4w827ak5ifw04wb0b23a1x";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.25.0-darwin-arm64.tar.gz";
+        sha256 = "13py1s02hkvp2z7691i5w8bcyxasg2y5c0lzm7dimzr7h1zrj8cy";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.12.0-darwin-arm64.tar.gz";
-        sha256 = "1wcslax3iih2ripcla3rqcyc4qxy7qcs5gix9n811b6dx20ppdqv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.0.0-darwin-arm64.tar.gz";
+        sha256 = "0xl9ij25sryhjgpv9p2ljpldfwmdzx2p40j9z05a6qfmkrx4yn8m";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.4.1-darwin-arm64.tar.gz";
@@ -591,16 +591,16 @@
         sha256 = "1fhll8bgamlv4kljngydmnhbc90bz3figg10qy3qa9kgqkrxm041";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.12.1-darwin-arm64.tar.gz";
-        sha256 = "1avgkbqqxiwnbxkih8j0h435g18893wmkzbdm0zgzq47w57vjxcx";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.13.0-darwin-arm64.tar.gz";
+        sha256 = "08dk4pywrqgylwr1b7sny9lsk35hjlis9dbhpkw91fdwa4r6055x";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.21.0-darwin-arm64.tar.gz";
-        sha256 = "048j1iv3389a9alyyv95yhj9gv02wf9blx3l1v3k0w6wy4cdrhwd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.23.0-darwin-arm64.tar.gz";
+        sha256 = "065q5246f69qhmva4hdg1321971xgmp9vhi2q5rr3dz9cb8dbgv7";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.28.0-darwin-arm64.tar.gz";
-        sha256 = "1290ps5syhk8m7dbzl8mran61z5m2bqmak5s28jflcsarqjp062b";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.30.0-darwin-arm64.tar.gz";
+        sha256 = "19nxb45qh4ic4c4bss445f1862vxrxs412kps3qm4220n2vbngps";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.13.0-darwin-arm64.tar.gz";
@@ -615,8 +615,8 @@
         sha256 = "0sxdpvx2hwd1sgaz34ddpa676n0g081ymrldr881cb5lfh01zbji";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.10.0-darwin-arm64.tar.gz";
-        sha256 = "1fwijm81ghprg8kzkfknd4psa5538rdjx5c2hrx9n98s9q0mvk14";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.11.0-darwin-arm64.tar.gz";
+        sha256 = "06n5hbwa69xf30hhynd87r2n80lxnzshffvrdn3i790dbvl034z2";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.5.0-darwin-arm64.tar.gz";

pkgs/tools/audio/spotdl/default.nix

@@ -4,9 +4,22 @@
 , ffmpeg
 }:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      ytmusicapi = super.ytmusicapi.overridePythonAttrs (old: rec {
+        version = "0.25.1";
+        src = self.fetchPypi {
+          inherit (old) pname;
+          inherit version;
+          hash = "sha256-uc/fgDetSYaCRzff0SzfbRhs3TaKrfE2h6roWkkj8yQ=";
+        };
+      });
+    };
+  };
+in python.pkgs.buildPythonApplication rec {
   pname = "spotdl";
-  version = "4.0.7";
+  version = "4.1.8";
 
   format = "pyproject";
 
@@ -14,17 +27,17 @@ python3.pkgs.buildPythonApplication rec {
     owner = "spotDL";
     repo = "spotify-downloader";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+hkdrPi3INs16SeAl+iXOE9KFDzG/TYXB3CDd8Tigwk=";
+    hash = "sha256-iE5d9enSbONqVxKW7H7N+1TmBp6nVGtiQvxJxV7R/1o=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
+  nativeBuildInputs = with python.pkgs; [
     poetry-core
     pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python.pkgs; [
     spotipy
     ytmusicapi
     pytube
@@ -41,9 +54,11 @@ python3.pkgs.buildPythonApplication rec {
     platformdirs
     pykakasi
     syncedlyrics
+    typing-extensions
+    setuptools # for pkg_resources
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python.pkgs; [
     pytestCheckHook
     pytest-mock
     pytest-vcr

pkgs/tools/backup/rustic-rs/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rustic-rs";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "rustic-rs";
     repo = "rustic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DL6IpWUGZT5kqnJVFehjMZAmBp2shUZSA5KvJDa9FFY=";
+    hash = "sha256-OZ80foq6DQZoJuJsQT4hxAHvzYn+uJbqG29wiZ7mPi8=";
   };
 
-  cargoHash = "sha256-K4bj0jE+PuOL2mEeVEI84On17Jyw7PKtNPQzDKMvY+c=";
+  cargoHash = "sha256-xdSAdw6YY6mYZDBKkH20wfB1oNiKecC7XhRKLUaHsTQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/games/ukmm/default.nix

@@ -0,0 +1,77 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, cmake
+, pkg-config
+, wrapGAppsHook
+, atk
+, glib
+, gtk3-x11
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ukmm";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "NiceneNerd";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-TvRaaAVJPqvTTqs+d5d4y1KmDTvE41uP5AykLtHxD9w=";
+  };
+
+  cargoLock = {
+      lockFile = ./Cargo.lock;
+      outputHashes = {
+        "catppuccin-egui-1.0.2" = "sha256-+ILfvDgZxe/QPJuVqIbRjaHNovpRAX+ym2QZ96glb4w=";
+        "ecolor-0.20.0" = "sha256-uTDkNRWsA1nM8Qhb0X2LjVDRuaW31vWxR8kDLL27BVE=";
+        "egui-notify-0.4.0" = "sha256-jybtUnv9xqzulZ5nfg+T1u8iTOsPjKGVVQ7JhwbvPdU=";
+        "egui_commonmark-0.6.0" = "sha256-hsVbtL2F+jifnzN6FgcDAVtLd1bVxTs0twn0SMvq9eU=";
+        "egui_dock-0.2.1" = "sha256-gGIO0boXKxLu0ABDH/uJhEZEoE/ql8E65LRmr0Xhv3s=";
+        "junction-0.2.0" = "sha256-6+pPp5wG1NoIj16Z+OvO4Pvy0jnQibn/A9cTaHAEVq4=";
+        "msbt-0.1.1" = "sha256-PtBs60xgYrwS7yPnRzXpExwYUD3azIaqObRnnJEL5dE=";
+        "msyt-1.2.1" = "sha256-aw5whCoQBhO0u9Fx2rTO1sRuPdGnAAlmPWv5q8CbQcI=";
+      };
+  };
+
+  RUSTC_BOOTSTRAP = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    atk
+    glib
+    gtk3-x11
+  ];
+
+  cargoTestFlags = [
+    "--all"
+  ];
+
+  checkFlags = [
+    # Requires a game dump of Breath of the Wild
+    "--skip=gui::tasks::tests::remerge"
+    "--skip=pack::tests::pack_mod"
+    "--skip=project::tests::project_from_mod"
+    "--skip=tests::read_meta"
+    "--skip=unpack::tests::read_mod"
+    "--skip=unpack::tests::unpack_mod"
+    "--skip=unpack::tests::unzip_mod"
+
+    # Requires Clear Camera mod
+    "--skip=bnp::test_convert"
+  ];
+
+  meta = with lib; {
+    description = "A new mod manager for The Legend of Zelda: Breath of the Wild";
+    homepage = "https://github.com/NiceneNerd/ukmm";
+    changelog = "https://github.com/NiceneNerd/ukmm/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ kira-bruneau ];
+    platforms = platforms.linux;
+  };
+}

pkgs/tools/misc/pspg/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.7.5";
+  version = "5.7.6";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-5XHT3Z40PUPO0c6bghDX547E6uEhBLZ6uRhJObVQazo=";
+    sha256 = "sha256-ztgvzt+fWPpb2Ero0ruJXGXLTDTbnjsYy9zUoyElqrE=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];

pkgs/tools/networking/cloudflare-warp/default.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cloudflare-warp";
-  version = "2023.1.133";
+  version = "2023.3.398";
 
   src = fetchurl {
-    url = "https://pkg.cloudflareclient.com/uploads/cloudflare_warp_2023_1_133_1_amd64_734c1ff709.deb";
-    sha256 = "sha256-Yo1JnbXi9vbYYAkmwk4S7JZZE45SV4p4dB55Rt+w+LA=";
+    url = "https://pkg.cloudflareclient.com/uploads/cloudflare_warp_2023_3_398_1_amd64_002e48d521.deb";
+    hash = "sha256-1var+/G3WwICRLXsMHke277tmPYRPFW8Yf9b1Ex9OmU=";
   };
 
   nativeBuildInputs = [

pkgs/tools/networking/netbird/default.nix

@@ -30,13 +30,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HtkMwy+8Af69vOz9VYMozOzW/W7CFSXlWR0vLlmYCeY=";
+    sha256 = "sha256-GSLEuelm6BEVF6NApYFJHa9bediRGoi5JotWPzDi+hg=";
   };
 
   vendorHash = "sha256-lag/usfAvpZhWeVe1wB3SJJsTCLcBeh04RvkE803OqQ=";

pkgs/tools/networking/picosnitch/default.nix

@@ -0,0 +1,38 @@
+{ lib
+, python3
+, bcc
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "picosnitch";
+  version = "0.12.0";
+
+  src = python3.pkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "b87654b4b92e28cf5418388ba1d3165b9fa9b17ba91af2a1a942f059128f68bc";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    setuptools
+    bcc
+    psutil
+    dbus-python
+    requests
+    pandas
+    plotly
+    dash
+  ];
+
+  patches = [ ./picosnitch.patch ];
+
+  pythonImportsCheck = [ "picosnitch" ];
+
+  meta = with lib; {
+    description = "Monitor network traffic per executable with hashing";
+    homepage = "https://github.com/elesiuta/picosnitch";
+    changelog = "https://github.com/elesiuta/picosnitch/releases";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.elesiuta ];
+    platforms = platforms.linux;
+  };
+}

pkgs/tools/networking/picosnitch/picosnitch.patch

@@ -0,0 +1,111 @@
+diff --git a/picosnitch.py b/picosnitch.py
+index a3dbb07..2b74f3e 100755
+--- a/picosnitch.py
++++ b/picosnitch.py
+@@ -1356,7 +1356,7 @@ def ui_loop(stdscr: curses.window, splash: str, con: sqlite3.Connection) -> int:
+             update_query = False
+         if execute_query:
+             try:
+-                with open("/run/picosnitch.pid", "r") as f:
++                with open("/run/picosnitch/picosnitch.pid", "r") as f:
+                     run_status = "pid: " + f.read().strip()
+             except Exception:
+                 run_status = "not running"
+@@ -1603,7 +1603,7 @@ def ui_dash():
+         return cmdline
+     def serve_layout():
+         try:
+-            with open("/run/picosnitch.pid", "r") as f:
++            with open("/run/picosnitch/picosnitch.pid", "r") as f:
+                 run_status = "pid: " + f.read().strip()
+         except Exception:
+             run_status = "not running"
+@@ -1771,7 +1771,7 @@ def main():
+     # master copy of the snitch dictionary, all subprocesses only receive a static copy of it from this point in time
+     snitch = read_snitch()
+     # start picosnitch process monitor
+-    with open("/run/picosnitch.pid", "r") as f:
++    with open("/run/picosnitch/picosnitch.pid", "r") as f:
+         assert int(f.read().strip()) == os.getpid()
+     if __name__ == "__main__" or sys.argv[1] == "start-no-daemon":
+         sys.exit(main_process(snitch))
+@@ -1818,7 +1818,7 @@ def start_picosnitch():
+     RestartSec=5
+     Environment="SUDO_UID={os.getenv("SUDO_UID")}" "SUDO_USER={os.getenv("SUDO_USER")}" "DBUS_SESSION_BUS_ADDRESS={os.getenv("DBUS_SESSION_BUS_ADDRESS")}" "PYTHON_USER_SITE={site.USER_SITE}"
+     ExecStart={sys.executable} "{os.path.abspath(__file__)}" start-no-daemon
+-    PIDFile=/run/picosnitch.pid
++    PIDFile=/run/picosnitch/picosnitch.pid
+ 
+     [Install]
+     WantedBy=multi-user.target
+@@ -1832,12 +1832,12 @@ def start_picosnitch():
+                 subprocess.Popen(["bash", "-c", f'let i=0; rm {BASE_PATH}/dash; while [[ ! -f {BASE_PATH}/dash || "$i" -gt 30 ]]; do let i++; sleep 1; done; rm {BASE_PATH}/dash && /usr/bin/env python3 -m webbrowser -t http://{os.getenv("HOST", "localhost")}:{os.getenv("PORT", "5100")}'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+         if os.getuid() != 0:
+             args = ["sudo", "-E", sys.executable, os.path.abspath(__file__), sys.argv[1]]
+-            os.execvp("sudo", args)
++            assert sys.argv[1] not in ["start", "stop", "restart", "start-no-daemon"], "picosnitch requires root privileges to run"
+         with open("/proc/self/status", "r") as f:
+             proc_status = f.read()
+             capeff = int(proc_status[proc_status.find("CapEff:")+8:].splitlines()[0].strip(), base=16)
+             cap_sys_admin = 2**21
+-            assert capeff & cap_sys_admin, "Missing capability CAP_SYS_ADMIN"
++            assert sys.argv[1] not in ["start", "stop", "restart", "start-no-daemon"] or (capeff & cap_sys_admin), "Missing capability CAP_SYS_ADMIN"
+         assert importlib.util.find_spec("bcc"), "Requires BCC https://github.com/iovisor/bcc/blob/master/INSTALL.md"
+         tmp_snitch = read_snitch()
+         con = sqlite3.connect(os.path.join(BASE_PATH, "snitch.db"))
+@@ -1883,8 +1883,8 @@ def start_picosnitch():
+             except Exception as e:
+                 print("Warning: %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno), file=sys.stderr)
+         if sys.argv[1] in ["start", "stop", "restart"]:
+-            if os.path.exists("/usr/lib/systemd/system/picosnitch.service"):
+-                print("Found /usr/lib/systemd/system/picosnitch.service but you are not using systemctl")
++            if os.path.exists("/usr/lib/systemd/system/picosnitch.service") or os.path.exists("/etc/systemd/system/picosnitch.service"):
++                print("Found picosnitch.service but you are not using systemctl")
+                 if sys.stdin.isatty():
+                     confirm = input(f"Did you intend to run `systemctl {sys.argv[1]} picosnitch` (y/N)? ")
+                     if confirm.lower().startswith("y"):
+@@ -1893,15 +1893,15 @@ def start_picosnitch():
+         class PicoDaemon(Daemon):
+             def run(self):
+                 main()
+-        daemon = PicoDaemon("/run/picosnitch.pid")
++        daemon = PicoDaemon("/run/picosnitch/picosnitch.pid")
+         if sys.argv[1] == "start":
+-            print("starting picosnitch daemon")
++            print("starting picosnitch daemon, WARNING: built in daemon mode is not supported on Nix, use picosnitch start-no-daemon or systemctl instead")
+             daemon.start()
+         elif sys.argv[1] == "stop":
+-            print("stopping picosnitch daemon")
++            print("stopping picosnitch daemon, WARNING: built in daemon mode is not supported on Nix, use picosnitch start-no-daemon or systemctl instead")
+             daemon.stop()
+         elif sys.argv[1] == "restart":
+-            print("restarting picosnitch daemon")
++            print("restarting picosnitch daemon, WARNING: built in daemon mode is not supported on Nix, use picosnitch start-no-daemon or systemctl instead")
+             daemon.restart()
+         elif sys.argv[1] == "status":
+             daemon.status()
+@@ -1912,11 +1912,12 @@ def start_picosnitch():
+             print("Wrote /usr/lib/systemd/system/picosnitch.service\nYou can now run picosnitch using systemctl")
+             return 0
+         elif sys.argv[1] == "start-no-daemon":
+-            assert not os.path.exists("/run/picosnitch.pid")
++            assert not os.path.exists("/run/picosnitch/picosnitch.pid")
+             def delpid():
+-                os.remove("/run/picosnitch.pid")
++                os.remove("/run/picosnitch/picosnitch.pid")
+             atexit.register(delpid)
+-            with open("/run/picosnitch.pid", "w") as f:
++            os.makedirs("/run/picosnitch", exist_ok=True)
++            with open("/run/picosnitch/picosnitch.pid", "w") as f:
+                 f.write(str(os.getpid()) + "\n")
+             print("starting picosnitch in simple mode")
+             print(f"using config and log files from: {BASE_PATH}")
+@@ -1927,7 +1928,7 @@ def start_picosnitch():
+             assert dash.__version__ and pandas.__version__ and plotly.__version__
+             print(f"serving web gui on http://{os.getenv('HOST', 'localhost')}:{os.getenv('PORT', '5100')}")
+             args = ["bash", "-c", f"sudo -i -u {os.getenv('SUDO_USER')} touch {BASE_PATH}/dash; nohup {sys.executable} \"{os.path.abspath(__file__)}\" start-dash > /dev/null 2>&1 &"]
+-            os.execvp("bash", args)
++            return ui_dash()
+         elif sys.argv[1] == "start-dash":
+             return ui_dash()
+         elif sys.argv[1] == "view":

pkgs/tools/networking/strongswan/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "strongswan";
-  version = "5.9.8"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
+  version = "5.9.10"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
 
   src = fetchFromGitHub {
     owner = "strongswan";
     repo = "strongswan";
     rev = version;
-    sha256 = "sha256-RRvMQhDVoXF3Uok/Huq20RhqSsMnAsXHKOWfrXypDOk=";
+    hash = "sha256-vYM3RVS6/yDNbY6X8lZT0GK0dczjw8hs3NplFEzq0fg=";
   };
 
   dontPatchELF = true;

pkgs/tools/security/duo-unix/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "duo-unix";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchurl {
     url    = "https://dl.duosecurity.com/duo_unix-${version}.tar.gz";
-    sha256 = "sha256-D5D3SJdKxv5iccNypfshcvrnHdk2D+h8c1Gnm87lzgY=";
+    sha256 = "sha256-Oi8SPfPaGS3ITgRONt60PLy3B9QICeDDyIsP+iBpQmk=";
   };
 
   buildInputs = [ pam openssl zlib ];

pkgs/tools/security/pinentry-rofi/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pinentry-rofi";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "plattfot";
     repo = pname;
     rev = version;
-    sha256 = "sha256-EzbeMAhdn9SuSmE+aMHeyuje3s74isIKRDTrFO3bX04=";
+    sha256 = "sha256-H9Y7oPLpDuKtIy80HLS8/iXpOq8ZKiy8ZIH2NwguetY=";
   };
 
   nativeBuildInputs = [

pkgs/tools/system/systeroid/default.nix

@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "systeroid";
-  version = "0.3.2";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-V3b6jrxxgapiqtvcEeLRIB2S3CXDOi+sWm+cO0zOpkA=";
+    sha256 = "sha256-1qZ0vryWFGoIC3gdgJv6HolqCV8fogAZnjGHYnbP8Es=";
   };
 
   postPatch = ''
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"/usr/share/doc/kernel-doc-*/Documentation/*",' '"${linux-doc}/share/doc/linux-doc/*",'
   '';
 
-  cargoHash = "sha256-K2fWQ4X6/PypYyw2cDXl9bol16PvJHqnEcF5N3BEIdo=";
+  cargoHash = "sha256-aWkWufHZaAmebdDdrgrIbQrSSzj/RgymQ4hOkGtY2Zc=";
 
   buildInputs = [
     xorg.libxcb

pkgs/tools/text/vale/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.24.4";
+  version = "2.25.2";
 
   subPackages = [ "cmd/vale" ];
   outputs = [ "out" "data" ];
@@ -11,10 +11,10 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    hash = "sha256-gX37n1h/O7CqgXgWBndBHLtIeUWJaIJVJLyIb3Sd9YY=";
+    hash = "sha256-2v/ibr50rEuo5/KCBTlqv1iaPLYmAEnV0Nol2nqawA0=";
   };
 
-  vendorHash = "sha256-ZgBt4BgZWViNqYCuqb/Wt1zVjFM9h1UsmsYox7kMJ1A=";
+  vendorHash = "sha256-KB1mRWDYejc38tUv316MiGfmq2riNnpEMIUpjgfSasU=";
 
   postInstall = ''
     mkdir -p $data/share/vale

pkgs/top-level/all-packages.nix

@@ -1594,6 +1594,8 @@ with pkgs;
 
   metapixel = callPackage ../tools/graphics/metapixel { };
 
+  memos = callPackage ../servers/memos { };
+
   midimonster = callPackage ../tools/audio/midimonster { };
 
   midi-trigger = callPackage ../applications/audio/midi-trigger { };
@@ -1684,6 +1686,8 @@ with pkgs;
 
   ttchat = callPackage ../tools/misc/ttchat { };
 
+  ukmm = callPackage ../tools/games/ukmm { };
+
   unflac = callPackage ../tools/audio/unflac { };
 
   veikk-linux-driver-gui = libsForQt5.callPackage ../tools/misc/veikk-linux-driver-gui { };
@@ -2143,6 +2147,8 @@ with pkgs;
 
   ### APPLICATIONS/EMULATORS
 
+  _86Box = callPackage ../applications/emulators/86box { };
+
   atari800 = callPackage ../applications/emulators/atari800 { };
 
   ataripp = callPackage ../applications/emulators/atari++ { };
@@ -22611,6 +22617,8 @@ with pkgs;
 
   marisa = callPackage ../development/libraries/marisa { };
 
+  mathgl = callPackage ../development/libraries/mathgl { };
+
   matio = callPackage ../development/libraries/matio { };
 
   matterhorn = haskell.lib.compose.justStaticExecutables haskellPackages.matterhorn;
@@ -25267,6 +25275,8 @@ with pkgs;
 
   livepeer = callPackage ../servers/livepeer { };
 
+  lldap = callPackage ../servers/ldap/lldap { };
+
   lwan = callPackage ../servers/http/lwan { };
 
   labelImg = callPackage ../applications/science/machine-learning/labelimg { };
@@ -31624,6 +31634,8 @@ with pkgs;
 
   kubectl-images = callPackage ../applications/networking/cluster/kubectl-images { };
 
+  kubectl-ktop = callPackage ../applications/networking/cluster/kubectl-ktop { };
+
   kubectl-node-shell = callPackage ../applications/networking/cluster/kubectl-node-shell { };
 
   kubectl-tree = callPackage ../applications/networking/cluster/kubectl-tree { };
@@ -33087,6 +33099,8 @@ with pkgs;
 
   picoloop = callPackage ../applications/audio/picoloop { };
 
+  picosnitch = callPackage ../tools/networking/picosnitch { };
+
   pidgin = callPackage ../applications/networking/instant-messengers/pidgin {
     withOpenssl = config.pidgin.openssl or true;
     withGnutls = config.pidgin.gnutls or false;

pkgs/top-level/python-packages.nix

@@ -2318,6 +2318,8 @@ self: super: with self; {
 
   dateparser = callPackage ../development/python-modules/dateparser { };
 
+  datetime = callPackage ../development/python-modules/datetime { };
+
   dateutils = callPackage ../development/python-modules/dateutils { };
 
   datrie = callPackage ../development/python-modules/datrie { };