Merge master into haskell-updates

2024-09-30 17:49:58 +03:00 · 2023-10-10 00:11:52 +00:00 · 2023-10-10 00:11:52 +00:00 · 41108e36e4
commit 41108e36e4
parent f8a575d071 8a0223ec08
187 changed files with 9252 additions and 2096 deletions
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@ -817,7 +817,7 @@ $ cargo test
 ## Using community maintained Rust toolchains {#using-community-maintained-rust-toolchains}

 ::: {.note}
-Note: The following projects cannot be used within nixpkgs since [IFD](#ssec-import-from-derivation) is disallowed.
+The following projects cannot be used within Nixpkgs since [Import From Derivation](https://nixos.org/manual/nix/unstable/language/import-from-derivation) (IFD) is disallowed in Nixpkgs.
 To package things that require Rust nightly, `RUSTC_BOOTSTRAP = true;` can sometimes be used as a hack.
 :::

--- a/lib/fileset/README.md
+++ b/lib/fileset/README.md
@ -176,7 +176,7 @@ File sets do not support Nix store paths in strings such as `"/nix/store/...-sou

 Arguments:
 - (+) Such paths are usually produced by derivations, which means `toSource` would either:
-  - Require IFD if `builtins.path` is used as the underlying primitive
+  - Require [Import From Derivation](https://nixos.org/manual/nix/unstable/language/import-from-derivation) (IFD) if `builtins.path` is used as the underlying primitive
  - Require importing the entire `root` into the store such that derivations can be used to do the filtering
 - (+) The convenient path coercion like `union ./foo ./bar` wouldn't work for absolute paths, requiring more verbose alternate interfaces:
  - `let root = "/nix/store/...-source"; in union "${root}/foo" "${root}/bar"`
--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -854,7 +854,7 @@ rec {
    assert (lib.isBool flag);
    mesonOption feature (if flag then "enabled" else "disabled");

-  /* Create an --{enable,disable}-<feat> string that can be passed to
+  /* Create an --{enable,disable}-<feature> string that can be passed to
     standard GNU Autoconf scripts.

     Example:
@ -863,11 +863,12 @@ rec {
       enableFeature false "shared"
       => "--disable-shared"
  */
-  enableFeature = enable: feat:
-    assert isString feat; # e.g. passing openssl instead of "openssl"
-    "--${if enable then "enable" else "disable"}-${feat}";
+  enableFeature = flag: feature:
+    assert lib.isBool flag;
+    assert lib.isString feature; # e.g. passing openssl instead of "openssl"
+    "--${if flag then "enable" else "disable"}-${feature}";

-  /* Create an --{enable-<feat>=<value>,disable-<feat>} string that can be passed to
+  /* Create an --{enable-<feature>=<value>,disable-<feature>} string that can be passed to
     standard GNU Autoconf scripts.

     Example:
@ -876,9 +877,10 @@ rec {
       enableFeatureAs false "shared" (throw "ignored")
       => "--disable-shared"
  */
-  enableFeatureAs = enable: feat: value: enableFeature enable feat + optionalString enable "=${value}";
+  enableFeatureAs = flag: feature: value:
+    enableFeature flag feature + optionalString flag "=${value}";

-  /* Create an --{with,without}-<feat> string that can be passed to
+  /* Create an --{with,without}-<feature> string that can be passed to
     standard GNU Autoconf scripts.

     Example:
@ -887,11 +889,11 @@ rec {
       withFeature false "shared"
       => "--without-shared"
  */
-  withFeature = with_: feat:
-    assert isString feat; # e.g. passing openssl instead of "openssl"
-    "--${if with_ then "with" else "without"}-${feat}";
+  withFeature = flag: feature:
+    assert isString feature; # e.g. passing openssl instead of "openssl"
+    "--${if flag then "with" else "without"}-${feature}";

-  /* Create an --{with-<feat>=<value>,without-<feat>} string that can be passed to
+  /* Create an --{with-<feature>=<value>,without-<feature>} string that can be passed to
     standard GNU Autoconf scripts.

     Example:
@ -900,7 +902,8 @@ rec {
       withFeatureAs false "shared" (throw "ignored")
       => "--without-shared"
  */
-  withFeatureAs = with_: feat: value: withFeature with_ feat + optionalString with_ "=${value}";
+  withFeatureAs = flag: feature: value:
+    withFeature flag feature + optionalString flag "=${value}";

  /* Create a fixed width string with additional prefix to match
     required width.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -829,6 +829,12 @@
    githubId = 5892756;
    name = "Alec Snyder";
  };
+  allusive = {
+    email = "jasper@allusive.dev";
+    name = "Allusive";
+    github = "allusive-dev";
+    githubId = 99632976;
+  };
  almac = {
    email = "alma.cemerlic@gmail.com";
    github = "a1mac";
@ -6799,6 +6805,12 @@
    githubId = 33523827;
    name = "Harrison Thorne";
  };
+  haruki7049 = {
+    email = "tontonkirikiri@gmail.com";
+    github = "haruki7049";
+    githubId = 64677724;
+    name = "haruki7049";
+  };
  harvidsen = {
    email = "harvidsen@gmail.com";
    github = "harvidsen";
@ -16095,6 +16107,12 @@
      fingerprint = "B234 EFD4 2B42 FE81 EE4D  7627 F72C 4A88 7F9A 24CA";
    }];
  };
+  sironheart = {
+    email = "git@beisenherz.dev";
+    github = "Sironheart";
+    githubId = 13799656;
+    name = "Steffen Beisenherz";
+  };
  sirseruju = {
    email = "sir.seruju@yandex.ru";
    github = "SirSeruju";
@ -18650,6 +18668,12 @@
      fingerprint = "F844 80B2 0CA9 D6CC C7F5  2479 A776 D2AD 099E 8BC0";
    }];
  };
+  wexder = {
+    email = "wexder19@gmail.com";
+    github = "wexder";
+    githubId = 24979302;
+    name = "Vladimír Zahradník";
+  };
  wheelsandmetal = {
    email = "jakob@schmutz.co.uk";
    github = "wheelsandmetal";
@ -19091,7 +19115,7 @@
    ];
  };
  yayayayaka = {
-    email = "nixpkgs@uwu.is";
+    email = "github@uwu.is";
    matrix = "@yaya:uwu.is";
    github = "yayayayaka";
    githubId = 73759599;
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -91,6 +91,8 @@

 - [ZITADEL](https://zitadel.com), a turnkey identity and access management platform. Available as [services.zitadel](#opt-services.zitadel.enable).

+- [netclient](https://github.com/gravitl/netclient), an automated WireGuard® Management Client. Available as [services.netclient](#opt-services.netclient.enable).
+
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}

 - `network-online.target` has been fixed to no longer time out for systems with `networking.useDHCP = true` and `networking.useNetworkd = true`.
@ -183,6 +185,8 @@

 - `odoo` now defaults to 16, updated from 15.

+- `varnish` was upgraded from 7.2.x to 7.4.x, see https://varnish-cache.org/docs/7.3/whats-new/upgrading-7.3.html and https://varnish-cache.org/docs/7.4/whats-new/upgrading-7.4.html for upgrade notes. The current LTS version is still offered as `varnish60`.
+
 - `util-linux` is now supported on Darwin and is no longer an alias to `unixtools`. Use the `unixtools.util-linux` package for access to the Apple variants of the utilities.

 - `services.keyd` changed API. Now you can create multiple configuration files.
@ -329,6 +333,8 @@ The module update takes care of the new config syntax and the data itself (user

 - `programs.gnupg.agent.pinentryFlavor` is now set in `/etc/gnupg/gpg-agent.conf`, and will no longer take precedence over a `pinentry-program` set in `~/.gnupg/gpg-agent.conf`.

+- `programs.gnupg` now has the option `agent.settings` to set verbatim config values in `/etc/gnupg/gpg-agent.conf`.
+
 - `dockerTools.buildImage`, `dockerTools.buildLayeredImage` and `dockerTools.streamLayeredImage` now use `lib.makeOverridable` to allow `dockerTools`-based images to be customized more efficiently at the nix-level.

 - `services.influxdb2` now supports doing an automatic initial setup and provisioning of users, organizations, buckets and authentication tokens, see [#249502](https://github.com/NixOS/nixpkgs/pull/249502) for more details.
--- a/nixos/modules/misc/locate.nix
+++ b/nixos/modules/misc/locate.nix
@ -4,14 +4,15 @@ with lib;

 let
  cfg = config.services.locate;
-  isMLocate = hasPrefix "mlocate" cfg.locate.name;
-  isPLocate = hasPrefix "plocate" cfg.locate.name;
+  isMLocate = hasPrefix "mlocate" cfg.package.name;
+  isPLocate = hasPrefix "plocate" cfg.package.name;
  isMorPLocate = isMLocate || isPLocate;
-  isFindutils = hasPrefix "findutils" cfg.locate.name;
+  isFindutils = hasPrefix "findutils" cfg.package.name;
 in
 {
  imports = [
    (mkRenamedOptionModule [ "services" "locate" "period" ] [ "services" "locate" "interval" ])
+    (mkRenamedOptionModule [ "services" "locate" "locate" ] [ "services" "locate" "package" ])
    (mkRemovedOptionModule [ "services" "locate" "includeStore" ] "Use services.locate.prunePaths")
  ];

@ -25,10 +26,10 @@ in
      '';
    };

-    locate = mkOption {
+    package = mkOption {
      type = package;
      default = pkgs.findutils.locate;
-      defaultText = literalExpression "pkgs.findutils";
+      defaultText = literalExpression "pkgs.findutils.locate";
      example = literalExpression "pkgs.mlocate";
      description = lib.mdDoc ''
        The locate implementation to use
@ -218,11 +219,11 @@ in
        };
        mlocate = mkIf isMLocate {
          group = "mlocate";
-          source = "${cfg.locate}/bin/locate";
+          source = "${cfg.package}/bin/locate";
        };
        plocate = mkIf isPLocate {
          group = "plocate";
-          source = "${cfg.locate}/bin/plocate";
+          source = "${cfg.package}/bin/plocate";
        };
      in
      mkIf isMorPLocate {
@ -230,7 +231,7 @@ in
        plocate = mkIf isPLocate (mkMerge [ common plocate ]);
      };

-    environment.systemPackages = [ cfg.locate ];
+    environment.systemPackages = [ cfg.package ];

    environment.variables.LOCATE_PATH = cfg.output;

@ -268,13 +269,13 @@ in
            args = concatLists (map toFlags [ "pruneFS" "pruneNames" "prunePaths" ]);
          in
          ''
-            exec ${cfg.locate}/bin/updatedb \
+            exec ${cfg.package}/bin/updatedb \
              --output ${toString cfg.output} ${concatStringsSep " " args} \
              --prune-bind-mounts ${if cfg.pruneBindMounts then "yes" else "no"} \
              ${concatStringsSep " " cfg.extraFlags}
          ''
        else ''
-          exec ${cfg.locate}/bin/updatedb \
+          exec ${cfg.package}/bin/updatedb \
            ${optionalString (cfg.localuser != null && !isMorPLocate) "--localuser=${cfg.localuser}"} \
            --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags}
        '';
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -985,6 +985,7 @@
  ./services/networking/ndppd.nix
  ./services/networking/nebula.nix
  ./services/networking/netbird.nix
+  ./services/networking/netclient.nix
  ./services/networking/networkd-dispatcher.nix
  ./services/networking/networkmanager.nix
  ./services/networking/nextdns.nix
@ -1082,6 +1083,7 @@
  ./services/networking/thelounge.nix
  ./services/networking/tinc.nix
  ./services/networking/tinydns.nix
+  ./services/networking/tinyproxy.nix
  ./services/networking/tmate-ssh-server.nix
  ./services/networking/tox-bootstrapd.nix
  ./services/networking/tox-node.nix
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@ -6,6 +6,10 @@ let

  cfg = config.programs.gnupg;

+  agentSettingsFormat = pkgs.formats.keyValue {
+    mkKeyValue = lib.generators.mkKeyValueDefault { } " ";
+  };
+
  xserverCfg = config.services.xserver;

  defaultPinentryFlavor =
@ -82,6 +86,18 @@ in
      '';
    };

+    agent.settings = mkOption {
+      type = agentSettingsFormat.type;
+      default = { };
+      example = {
+        default-cache-ttl = 600;
+      };
+      description = lib.mdDoc ''
+        Configuration for /etc/gnupg/gpg-agent.conf.
+        See {manpage}`gpg-agent(1)` for supported options.
+      '';
+    };
+
    dirmngr.enable = mkOption {
      type = types.bool;
      default = false;
@ -92,10 +108,13 @@ in
  };

  config = mkIf cfg.agent.enable {
-    environment.etc."gnupg/gpg-agent.conf".text =
-      lib.optionalString (cfg.agent.pinentryFlavor != null) ''
-      pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
-    '';
+    programs.gnupg.agent.settings = {
+      pinentry-program = lib.mkIf (cfg.agent.pinentryFlavor != null)
+        "${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry";
+    };
+
+    environment.etc."gnupg/gpg-agent.conf".source =
+      agentSettingsFormat.generate "gpg-agent.conf" cfg.agent.settings;

    # This overrides the systemd user unit shipped with the gnupg package
    systemd.user.services.gpg-agent = {
--- a/nixos/modules/programs/wayland/sway.nix
+++ b/nixos/modules/programs/wayland/sway.nix
@ -42,6 +42,11 @@ in {
      <https://github.com/swaywm/sway/wiki> and
      "man 5 sway" for more information'');

+    enableRealtime = mkEnableOption (lib.mdDoc ''
+      add CAP_SYS_NICE capability on `sway` binary for realtime scheduling
+      privileges. This may improve latency and reduce stuttering, specially in
+      high load scenarios'') // { default = true; };
+
    package = mkOption {
      type = with types; nullOr package;
      default = defaultSwayPackage;
@ -149,6 +154,14 @@ in {
            "sway/config".source = mkOptionDefault "${cfg.package}/etc/sway/config";
          };
        };
+        security.wrappers = mkIf (cfg.enableRealtime && cfg.package != null) {
+          sway = {
+            owner = "root";
+            group = "root";
+            source = "${cfg.package}/bin/sway";
+            capabilities = "cap_sys_nice+ep";
+          };
+        };
        # To make a Sway session available if a display manager like SDDM is enabled:
        services.xserver.displayManager.sessionPackages = optionals (cfg.package != null) [ cfg.package ]; }
      (import ./wayland-session.nix { inherit lib pkgs; })
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@ -106,7 +106,7 @@ in
      identMap = mkOption {
        type = types.lines;
        default = "";
-        example = literalExample ''
+        example = ''
          map-name-0 system-username-0 database-username-0
          map-name-1 system-username-1 database-username-1
        '';
--- a/nixos/modules/services/networking/connman.nix
+++ b/nixos/modules/services/networking/connman.nix
@ -1,55 +1,59 @@
 { config, lib, pkgs, ... }:

-with pkgs;
-with lib;
-
 let
  cfg = config.services.connman;
  configFile = pkgs.writeText "connman.conf" ''
    [General]
-    NetworkInterfaceBlacklist=${concatStringsSep "," cfg.networkInterfaceBlacklist}
+    NetworkInterfaceBlacklist=${lib.concatStringsSep "," cfg.networkInterfaceBlacklist}

    ${cfg.extraConfig}
  '';
  enableIwd = cfg.wifi.backend == "iwd";
 in {
+  meta.maintainers = with lib.maintainers; [ AndersonTorres ];

  imports = [
-    (mkRenamedOptionModule [ "networking" "connman" ] [ "services" "connman" ])
+    (lib.mkRenamedOptionModule [ "networking" "connman" ] [ "services" "connman" ])
  ];

  ###### interface

  options = {
-
    services.connman = {
-
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
        default = false;
        description = lib.mdDoc ''
          Whether to use ConnMan for managing your network connections.
        '';
      };

-      enableVPN = mkOption {
-        type = types.bool;
+      package = lib.mkOption {
+        type = lib.types.package;
+        description = lib.mdDoc "The connman package / build flavor";
+        default = pkgs.connman;
+        defaultText = lib.literalExpression "pkgs.connman";
+        example = lib.literalExpression "pkgs.connmanFull";
+      };
+
+      enableVPN = lib.mkOption {
+        type = lib.types.bool;
        default = true;
        description = lib.mdDoc ''
          Whether to enable ConnMan VPN service.
        '';
      };

-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
        default = "";
        description = lib.mdDoc ''
          Configuration lines appended to the generated connman configuration file.
        '';
      };

-      networkInterfaceBlacklist = mkOption {
-        type = with types; listOf str;
+      networkInterfaceBlacklist = lib.mkOption {
+        type = with lib.types; listOf str;
        default = [ "vmnet" "vboxnet" "virbr" "ifb" "ve" ];
        description = lib.mdDoc ''
          Default blacklisted interfaces, this includes NixOS containers interfaces (ve).
@ -57,8 +61,8 @@ in {
      };

      wifi = {
-        backend = mkOption {
-          type = types.enum [ "wpa_supplicant" "iwd" ];
+        backend = lib.mkOption {
+          type = lib.types.enum [ "wpa_supplicant" "iwd" ];
          default = "wpa_supplicant";
          description = lib.mdDoc ''
            Specify the Wi-Fi backend used.
@ -67,31 +71,20 @@ in {
        };
      };

-      extraFlags = mkOption {
-        type = with types; listOf str;
+      extraFlags = lib.mkOption {
+        type = with lib.types; listOf str;
        default = [ ];
        example = [ "--nodnsproxy" ];
        description = lib.mdDoc ''
          Extra flags to pass to connmand
        '';
      };
-
-      package = mkOption {
-        type = types.package;
-        description = lib.mdDoc "The connman package / build flavor";
-        default = connman;
-        defaultText = literalExpression "pkgs.connman";
-        example = literalExpression "pkgs.connmanFull";
-      };
-
    };
-
  };

  ###### implementation

-  config = mkIf cfg.enable {
-
+  config = lib.mkIf cfg.enable {
    assertions = [{
      assertion = !config.networking.useDHCP;
      message = "You can not use services.connman with networking.useDHCP";
@ -107,8 +100,8 @@ in {
    systemd.services.connman = {
      description = "Connection service";
      wantedBy = [ "multi-user.target" ];
-      after = [ "syslog.target" ] ++ optional enableIwd "iwd.service";
-      requires = optional enableIwd "iwd.service";
+      after = [ "syslog.target" ] ++ lib.optional enableIwd "iwd.service";
+      requires = lib.optional enableIwd "iwd.service";
      serviceConfig = {
        Type = "dbus";
        BusName = "net.connman";
@ -117,13 +110,13 @@ in {
          "${cfg.package}/sbin/connmand"
          "--config=${configFile}"
          "--nodaemon"
-        ] ++ optional enableIwd "--wifi=iwd_agent"
+        ] ++ lib.optional enableIwd "--wifi=iwd_agent"
          ++ cfg.extraFlags);
        StandardOutput = "null";
      };
    };

-    systemd.services.connman-vpn = mkIf cfg.enableVPN {
+    systemd.services.connman-vpn = lib.mkIf cfg.enableVPN {
      description = "ConnMan VPN service";
      wantedBy = [ "multi-user.target" ];
      after = [ "syslog.target" ];
@ -136,7 +129,7 @@ in {
      };
    };

-    systemd.services.net-connman-vpn = mkIf cfg.enableVPN {
+    systemd.services.net-connman-vpn = lib.mkIf cfg.enableVPN {
      description = "D-BUS Service";
      serviceConfig = {
        Name = "net.connman.vpn";
@ -150,9 +143,9 @@ in {
    networking = {
      useDHCP = false;
      wireless = {
-        enable = mkIf (!enableIwd) true;
+        enable = lib.mkIf (!enableIwd) true;
        dbusControlled = true;
-        iwd = mkIf enableIwd {
+        iwd = lib.mkIf enableIwd {
          enable = true;
        };
      };
--- a/nixos/modules/services/networking/netclient.nix
+++ b/nixos/modules/services/networking/netclient.nix
@ -0,0 +1,27 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.netclient;
+in
+{
+  meta.maintainers = with lib.maintainers; [ wexder ];
+
+  options.services.netclient = {
+    enable = lib.mkEnableOption (lib.mdDoc "Netclient Daemon");
+    package = lib.mkPackageOptionMD pkgs "netclient" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    systemd.services.netclient = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      description = "Netclient Daemon";
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${lib.getExe cfg.package} daemon";
+        Restart = "on-failure";
+        RestartSec = "15s";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/networking/tinyproxy.nix
+++ b/nixos/modules/services/networking/tinyproxy.nix
@ -0,0 +1,103 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.tinyproxy;
+  mkValueStringTinyproxy = with lib; v:
+        if true  ==         v then "yes"
+        else if false ==    v then "no"
+        else generators.mkValueStringDefault {} v;
+  mkKeyValueTinyproxy = {
+    mkValueString ? mkValueStringDefault {}
+  }: sep: k: v:
+    if null     ==  v then ""
+    else "${lib.strings.escape [sep] k}${sep}${mkValueString v}";
+
+  settingsFormat = (pkgs.formats.keyValue {
+      mkKeyValue = mkKeyValueTinyproxy {
+        mkValueString = mkValueStringTinyproxy;
+      } " ";
+      listsAsDuplicateKeys= true;
+  });
+  configFile = settingsFormat.generate "tinyproxy.conf" cfg.settings;
+
+in
+{
+
+  options = {
+    services.tinyproxy = {
+      enable = mkEnableOption (lib.mdDoc "Tinyproxy daemon");
+      package = mkPackageOptionMD pkgs "tinyproxy" {};
+      settings = mkOption {
+        description = lib.mdDoc "Configuration for [tinyproxy](https://tinyproxy.github.io/).";
+        default = { };
+        example = literalExpression ''{
+          Port 8888;
+          Listen 127.0.0.1;
+          Timeout 600;
+          Allow 127.0.0.1;
+          Anonymous = ['"Host"' '"Authorization"'];
+          ReversePath = '"/example/" "http://www.example.com/"';
+        }'';
+        type = types.submodule ({name, ...}: {
+          freeformType = settingsFormat.type;
+          options = {
+            Listen = mkOption {
+              type = types.str;
+              default = "127.0.0.1";
+              description = lib.mdDoc ''
+              Specify which address to listen to.
+              '';
+            };
+            Port = mkOption {
+              type = types.int;
+              default = 8888;
+              description = lib.mdDoc ''
+              Specify which port to listen to.
+              '';
+            };
+            Anonymous = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              description = lib.mdDoc ''
+              If an `Anonymous` keyword is present, then anonymous proxying is enabled. The headers listed with `Anonymous` are allowed through, while all others are denied. If no Anonymous keyword is present, then all headers are allowed through. You must include quotes around the headers.
+              '';
+            };
+            Filter = mkOption {
+              type = types.nullOr types.path;
+              default = null;
+              description = lib.mdDoc ''
+              Tinyproxy supports filtering of web sites based on URLs or domains. This option specifies the location of the file containing the filter rules, one rule per line.
+              '';
+            };
+          };
+        });
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    systemd.services.tinyproxy = {
+      description = "TinyProxy daemon";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        User = "tinyproxy";
+        Group = "tinyproxy";
+        Type = "simple";
+        ExecStart = "${getExe pkgs.tinyproxy} -d -c ${configFile}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
+        KillSignal = "SIGINT";
+        TimeoutStopSec = "30s";
+        Restart = "on-failure";
+      };
+    };
+
+    users.users.tinyproxy = {
+        group = "tinyproxy";
+        isSystemUser = true;
+    };
+    users.groups.tinyproxy = {};
+  };
+  meta.maintainers = with maintainers; [ tcheronneau ];
+}
--- a/nixos/modules/virtualisation/oci-containers.nix
+++ b/nixos/modules/virtualisation/oci-containers.nix
@ -66,6 +66,17 @@ let
          '';
        };

+        labels = mkOption {
+          type = with types; attrsOf str;
+          default = {};
+          description = lib.mdDoc "Labels to attach to the container at runtime.";
+          example = literalExpression ''
+            {
+              "traefik.https.routers.example.rule" = "Host(`example.container`)";
+            }
+          '';
+        };
+
        entrypoint = mkOption {
          type = with types; nullOr str;
          description = lib.mdDoc "Override the default entrypoint of the image.";
@ -277,6 +288,7 @@ let
      ++ map (p: "-p ${escapeShellArg p}") container.ports
      ++ optional (container.user != null) "-u ${escapeShellArg container.user}"
      ++ map (v: "-v ${escapeShellArg v}") container.volumes
+      ++ (mapAttrsToList (k: v: "-l ${escapeShellArg k}=${escapeShellArg v}") container.labels)
      ++ optional (container.workdir != null) "-w ${escapeShellArg container.workdir}"
      ++ map escapeShellArg container.extraOptions
      ++ [container.image]
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -819,6 +819,7 @@ in {
  timezone = handleTest ./timezone.nix {};
  tinc = handleTest ./tinc {};
  tinydns = handleTest ./tinydns.nix {};
+  tinyproxy = handleTest ./tinyproxy.nix {};
  tinywl = handleTest ./tinywl.nix {};
  tmate-ssh-server = handleTest ./tmate-ssh-server.nix { };
  tomcat = handleTest ./tomcat.nix {};
@ -855,8 +856,7 @@ in {
  uwsgi = handleTest ./uwsgi.nix {};
  v2ray = handleTest ./v2ray.nix {};
  varnish60 = handleTest ./varnish.nix { package = pkgs.varnish60; };
-  varnish72 = handleTest ./varnish.nix { package = pkgs.varnish72; };
-  varnish73 = handleTest ./varnish.nix { package = pkgs.varnish73; };
+  varnish74 = handleTest ./varnish.nix { package = pkgs.varnish74; };
  vault = handleTest ./vault.nix {};
  vault-agent = handleTest ./vault-agent.nix {};
  vault-dev = handleTest ./vault-dev.nix {};
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@ -50,6 +50,20 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
        machine.wait_for_window("io.elementary.wingpanel")
        machine.wait_until_succeeds("pgrep plank")
        machine.wait_for_window("plank")
+        machine.wait_until_succeeds("pgrep -f gsd-media-keys")
+        machine.wait_for_unit("bamfdaemon.service", "${user.name}")
+        machine.wait_for_unit("io.elementary.files.xdg-desktop-portal.service", "${user.name}")
+
+    with subtest("Open elementary videos"):
+        machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.videos >&2 &'")
+        machine.sleep(2)
+        machine.wait_for_window("io.elementary.videos")
+        machine.wait_for_text("No Videos Open")
+
+    with subtest("Open elementary calendar"):
+        machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.calendar >&2 &'")
+        machine.sleep(2)
+        machine.wait_for_window("io.elementary.calendar")

    with subtest("Open system settings"):
        machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.switchboard >&2 &'")
@ -63,7 +77,9 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :

    with subtest("Check if gala has ever coredumped"):
        machine.fail("coredumpctl --json=short | grep gala")
-        machine.sleep(20)
+        # So you can see the dock in the below screenshot.
+        machine.succeed("su - ${user.name} -c 'DISPLAY=:0 xdotool mousemove 450 1000 >&2 &'")
+        machine.sleep(10)
        machine.screenshot("screen")
  '';
 })
--- a/nixos/tests/tinyproxy.nix
+++ b/nixos/tests/tinyproxy.nix
@ -0,0 +1,20 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "tinyproxy";
+
+  nodes.machine = { config, pkgs, ... }: {
+    services.tinyproxy = {
+      enable = true;
+      settings = {
+        Listen = "127.0.0.1";
+        Port = 8080;
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("tinyproxy.service")
+    machine.wait_for_open_port(8080)
+
+    machine.succeed('curl -s http://localhost:8080 |grep -i tinyproxy')
+  '';
+})
--- a/pkgs/README.md
+++ b/pkgs/README.md
@ -368,19 +368,11 @@ See the Nixpkgs manual for more details on [standard meta-attributes](https://ni

 ### Import From Derivation

-Import From Derivation (IFD) is disallowed in Nixpkgs for performance reasons:
-[Hydra] evaluates the entire package set, and sequential builds during evaluation would increase evaluation times to become impractical.
-
-[Hydra]: https://github.com/NixOS/hydra
+[Import From Derivation](https://nixos.org/manual/nix/unstable/language/import-from-derivation) (IFD) is disallowed in Nixpkgs for performance reasons:
+[Hydra](https://github.com/NixOS/hydra) evaluates the entire package set, and sequential builds during evaluation would increase evaluation times to become impractical.

 Import From Derivation can be worked around in some cases by committing generated intermediate files to version control and reading those instead.

-<!-- TODO: remove the following and link to Nix manual once https://github.com/NixOS/nix/pull/7332 is merged -->
-
-See also [NixOS Wiki: Import From Derivation].
-
-[NixOS Wiki: Import From Derivation]: https://nixos.wiki/wiki/Import_From_Derivation
-
 ## Sources

 ### Fetching Sources
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "ft2-clone";
-  version = "1.71";
+  version = "1.72.1";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "ft2-clone";
    rev = "v${version}";
-    hash = "sha256-c2gFq+TgTMI+Eld0z8hryLew3XkrQ7XAfq2s+zdEkBQ=";
+    hash = "sha256-dGoldr0JvXri4XfSn/DKeJw/wsBaj+AKoKWdbEgo8lg=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@ -14,14 +14,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "gpodder";
-  version = "3.11.1";
+  version = "3.11.3";
  format = "other";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    sha256 = "Ns03MFhd4ZLtyeQTLTgLWY2Ot6gmrksFMOZm8jFaLIg=";
+    sha256 = "p8BgpvMK1kP4VnRfmcvSMbXmWs5DmWBZ6te7L9b+UJQ=";
  };

  patches = [
@ -63,6 +63,7 @@ python3Packages.buildPythonApplication rec {
    eyeD3
    podcastparser
    html5lib
+    mutagen
  ];

  makeFlags = [
--- a/pkgs/applications/audio/noson/default.nix
+++ b/pkgs/applications/audio/noson/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "noson";
-  version = "5.4.1";
+  version = "5.6.0";

  src = fetchFromGitHub {
    owner = "janbar";
    repo = "noson-app";
    rev = finalAttrs.version;
-    hash = "sha256-7RrBfkUCRVzUGl+OT3OuoMlu4D3Sa7RpBefFgmfX1Fs=";
+    hash = "sha256-ZOAnH7pdhlTbqHOM0kiCWcHYJvnskigWdz3N9WjtM0M=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/glow/default.nix
+++ b/pkgs/applications/editors/glow/default.nix
@ -3,19 +3,28 @@
 , fetchFromGitHub
 , installShellFiles
 , stdenv
+, fetchpatch
 }:
+
 buildGoModule rec {
  pname = "glow";
-  version = "1.5.0";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "glow";
    rev = "v${version}";
-    sha256 = "sha256-CI0S9XJtJQClpQvI6iSb5rcHafEUwr2V6+Fq560lRfM=";
+    hash = "sha256-12UziCf3BO1z+W02slNCCvXhIkvZuVgXk++BdHG3gDI=";
  };

-  vendorHash = "sha256-2QrHBbhJ04r/vPK2m8J2KZSFrREDCc18tlKd7evghBc=";
+  vendorHash = "sha256-xxFC87t12bZKea9Snscul+xx8IGFAcoIr9Z8wxHL7nM=";
+
+  # Remove whenever a release with it is available
+  patches = [(fetchpatch {
+    url = "https://github.com/charmbracelet/glow/commit/f0734709f0be19a34e648caaf63340938a50caa2.patch";
+    name = "go-1-17-patch";
+    hash = "sha256-vpMiVb/7SFT9xcSpVGQriEjkexh1F/ljpfpIswdBx2Y=";
+  })];

  doCheck = false;

--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -14,19 +14,19 @@

 stdenv.mkDerivation rec {
  pname = "drawio";
-  version = "21.7.5";
+  version = "22.0.2";

  src = fetchFromGitHub {
    owner = "jgraph";
    repo = "drawio-desktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-hf1sektdnW4c3dySun8sQ9vBrAqTocrLFAIYkemNC3I=";
+    hash = "sha256-L+tbNCokVoiS2KkaPVBjG7H/8cqz1e8dlXC5H8BkPvU=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = src + "/yarn.lock";
-    hash = "sha256-FVZq/voCjnRSBLtQtJkJbErGvprEHq+U/VZ9rEwbJsI=";
+    hash = "sha256-d8AquOKdrPQHBhRG9o1GB18LpwlwQK6ZaM1gLAcjilM=";
  };

  nativeBuildInputs = [
@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
      comment = "draw.io desktop";
      mimeTypes = [ "application/vnd.jgraph.mxfile" "application/vnd.visio" ];
      categories = [ "Graphics" ];
-      startupWMClass = "drawio";
+      startupWMClass = "draw.io";
    })
  ];

--- a/pkgs/applications/graphics/oculante/Cargo.lock
+++ b/pkgs/applications/graphics/oculante/Cargo.lock
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@ -21,13 +21,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "oculante";
-  version = "0.7.6";
+  version = "0.7.7";

  src = fetchFromGitHub {
    owner = "woelper";
    repo = pname;
    rev = version;
-    hash = "sha256-nUq/Fwftfg7H+HlMZO2JMfGBeCOs6nEAcsbrbowPC4A=";
+    hash = "sha256-uDSZ7qwDC/eR0aZN372ju21PBGuBiiYmlx/26Ta3luE=";
  };

  cargoLock = {
--- a/pkgs/applications/logging/humioctl/default.nix
+++ b/pkgs/applications/logging/humioctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "humioctl";
-  version = "0.31.1";
+  version = "0.32.3";

  src = fetchFromGitHub {
    owner = "humio";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-L5Ttos0TL8m62Y69riwnGmB1cOVF6XIH7jMVU8NuFKI=";
+    hash = "sha256-MaBJL/3TZYmXjwt5/WmBBTXVhlJ6oyCgm+Lb8id6J3c=";
  };

-  vendorHash = "sha256-GTPEHw3QsID9K6DcYNZRyDJzTqfDV9lHP2Trvd2aC8Y=";
+  vendorHash = "sha256-FAy0LNmesEDgS3JTz5DPd8vkR5CHHhAbms++N8TQApA=";

  ldflags = [ "-s" "-w" "-X main.version=${version}" ];

--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@ -2,13 +2,13 @@

 let
  pname = "anytype";
-  version = "0.35.2";
+  version = "0.35.4";
  name = "Anytype-${version}";
  nameExecutable = pname;
  src = fetchurl {
    url = "https://anytype-release.fra1.cdn.digitaloceanspaces.com/Anytype-${version}.AppImage";
    name = "Anytype-${version}.AppImage";
-    sha256 = "RLkAC9rNGHdbX/EfDTfpbBBKaY+BqdFuCMm99mkjOjw=";
+    sha256 = "sha256-heS+3ucxv4WTiqegdmjpv8aWuC+3knxC00SDDg4R8iU=";
  };
  appimageContents = appimageTools.extractType2 { inherit name src; };
 in
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gpxsee";
-  version = "13.7";
+  version = "13.9";

  src = fetchFromGitHub {
    owner = "tumic0";
    repo = "GPXSee";
    rev = finalAttrs.version;
-    hash = "sha256-Y3JcWkg0K724i/5Leyi8r26uKpq/aDwghJBG8xfxpd4=";
+    hash = "sha256-vzbZN+0lDSmvZnQCuvNJCYHTYKqErFhW4RI5Mfbgr6o=";
  };

  buildInputs = [
--- a/pkgs/applications/misc/lunatask/default.nix
+++ b/pkgs/applications/misc/lunatask/default.nix
@ -1,12 +1,12 @@
 { lib, appimageTools, fetchurl }:

 let
-  version = "1.7.6";
+  version = "1.7.7";
  pname = "lunatask";

  src = fetchurl {
    url = "https://lunatask.app/download/Lunatask-${version}.AppImage";
-    sha256 = "sha256-WmnwFrE9mYDE39DeYnq8+i2KZ7V2F+rRwJvn6delLyc=";
+    sha256 = "sha256-3WiJR+gwudeLs6Mn75SJP4BZ6utwxvvRLOHe/W+1Pfs=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/misc/pdfstudio/common.nix
+++ b/pkgs/applications/misc/pdfstudio/common.nix
@ -5,6 +5,7 @@
 , version
 , desktopName
 , longDescription
+, broken ? false
 , buildFHSEnv
 , extraBuildInputs ? [ ]
 , jdk
@ -85,6 +86,7 @@ buildFHSEnv {
  '';

  meta = with lib; {
+    inherit broken;
    homepage = "https://www.qoppa.com/${pname}/";
    description = "An easy to use, full-featured PDF editing software";
    longDescription = longDescription;
--- a/pkgs/applications/misc/pdfstudio/default.nix
+++ b/pkgs/applications/misc/pdfstudio/default.nix
@ -40,6 +40,10 @@ in
      sha256 = "sha256-QXNsH1T+ItV3s9r8CnwgRUo1mhVbe8LkEun9gUmlVQg=";
    };
    jdk = jdk17;
+
+    # Bad hash, got sha256-afRhx9VCVRFUJoUnqs1bzF0yXpz3yEgLiFjMRB9xvsk=
+    # Likely unstable.
+    broken = true;
  };

  pdfstudio2021 = callPackage ./common.nix rec {
--- a/pkgs/applications/misc/xchm/default.nix
+++ b/pkgs/applications/misc/xchm/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "xchm";
-  version = "1.35";
+  version = "1.36";

  src = fetchFromGitHub {
    owner = "rzvncj";
    repo = "xCHM";
    rev = version;
-    sha256 = "sha256-ZJvlllhF7KPz+v6KEVPyJjiz+4LHM2Br/oqI54a2Ews=";
+    sha256 = "sha256-+RbFE/jOD8sofHMCFgTIfgokrXYqDbCSSnN6SdEZ/b0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "glooctl";
-  version = "1.15.7";
+  version = "1.15.9";

  src = fetchFromGitHub {
    owner = "solo-io";
    repo = "gloo";
    rev = "v${version}";
-    hash = "sha256-sGJfQ9sALQPxne+Q1Rf8PhCHBHupbWrIShk1dqFEPhk=";
+    hash = "sha256-P3NC1/ZujqSO2C4ToNLpxgbxqACXYYsAFQh1Xbbu7x4=";
  };

  vendorHash = "sha256-KaBq1VCGWv3K50DDelS0hOQkXnK1ufBiXBtbPQFzwMY=";
--- a/pkgs/applications/networking/cluster/kubecfg/default.nix
+++ b/pkgs/applications/networking/cluster/kubecfg/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "kubecfg";
-  version = "0.34.0";
+  version = "0.34.1";

  src = fetchFromGitHub {
    owner = "kubecfg";
    repo = "kubecfg";
    rev = "v${version}";
-    hash = "sha256-OoqmFv2cRUU/mDtDcXugx+NKwpePQzRD231YBT4xQmA=";
+    hash = "sha256-UGxtL8X1wEyo7jYmPw0GTvuzzQCBA3WTIowMnYSyfvM=";
  };

-  vendorHash = "sha256-0+I0EeCguo1RPwKlnqmxgwvRfuW1CKD58PhftZDLfSg=";
+  vendorHash = "sha256-AbEEHG+LJB5fOm8koVQllKohtb0lqD6Kln3GCwlkb/0=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubectl-gadget";
-  version = "0.20.0";
+  version = "0.21.0";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    rev = "v${version}";
-    hash = "sha256-cwzxjK278xMqXwMQLhRhXWR2HhCKYOBMAiM4Y1B7Etk=";
+    hash = "sha256-e93rQRIF3CmXjQhpACxBp4WnPtQ5IJnm7H5BcHGqH0c=";
  };

-  vendorHash = "sha256-lBOZe74SWMv+z3quIx8NEK6lqygiQAbiU4AvzuXcOKg=";
+  vendorHash = "sha256-YkOw4HpbX6e6uIAUa7zQPah/ifRfB4ICi90AxleKNNE=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubeseal";
-  version = "0.24.0";
+  version = "0.24.1";

  src = fetchFromGitHub {
    owner = "bitnami-labs";
    repo = "sealed-secrets";
    rev = "v${version}";
-    sha256 = "sha256-7v0r5xwxlTUASkhVRbUUD+/wjvyurylqaRPmspLY/IM=";
+    sha256 = "sha256-L5j7+2m2zKRQ/zpmwq1OimPM6I1KmmPBzNcK+s1NIDs=";
  };

-  vendorHash = "sha256-77KUQlOCIRxuyL/vkxK+F+WEyzDFAYaBNq+JuAmkQvY=";
+  vendorHash = "sha256-+x5wohzPYzff3jpqsvnDqElrBW867WLrl4RaLlRjkUk=";

  subPackages = [ "cmd/kubeseal" ];

--- a/pkgs/applications/networking/cluster/kubevpn/default.nix
+++ b/pkgs/applications/networking/cluster/kubevpn/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubevpn";
-  version = "1.2.0";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner  = "KubeNetworks";
    repo   = "kubevpn";
    rev    = "v${version}";
-    sha256 = "sha256-C/GXcINuAtDdSN5CdoN62zeYlT9L6cXDTDR9S3eMP4w=";
+    sha256 = "sha256-fXRzo68d65FISW+m/BTmwOXlJiCmMm9Az1qsGGsbPIA=";
  };

-  vendorHash = "sha256-24mw5ku0pQX2QNQPA9E+wowS3y0J+oKiIxuyVGcgBro=";
+  vendorHash = "sha256-EcHHSOAr93M2kPhEaZSpvpZCq4pi1NCedo9hw1Mn0a4=";

  # TODO investigate why some config tests are failing
  doCheck = false;
--- a/pkgs/applications/networking/cluster/rke/default.nix
+++ b/pkgs/applications/networking/cluster/rke/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "rke";
-  version = "1.4.8";
+  version = "1.4.10";

  src = fetchFromGitHub {
    owner = "rancher";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-tc3XZyn1jdjkxWXG6qjsE2udpoq+RhhIWHXGmUQyO0Y=";
+    hash = "sha256-rr6CN5ik4vuLNqzNPvISfRfOjTcD48pSre2K6xr6xSk=";
  };

-  vendorHash = "sha256-MFXNwEEXtsEwB0Hcx8gn/Pz9dZM1zUUKhNYp5BlRUEk=";
+  vendorHash = "sha256-3bivFrn2xDyILD1ugSr7IehhNq4vkqShFQI3sbeY0iY=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.52.0";
+  version = "0.52.1";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-7Qd3Eat133pRthoYZzL9UYmL/cqgCRRWKGuZj9kqfFo=";
+    hash = "sha256-t1GAcOZAYdfrI0lsyKUEBbnJaGzuFP0+Mz3Yrv4Bmik=";
  };

  vendorHash = "sha256-NSrZVLQ3Qbnp94qCV7NbrEav/7LCRbTov+B2vzbuvdM=";
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@ -3,16 +3,16 @@

 buildGoModule rec {
  pname = "discordo";
-  version = "unstable-2023-04-07";
+  version = "unstable-2023-09-16";

  src = fetchFromGitHub {
    owner = "ayn2op";
    repo = pname;
-    rev = "f8c58057945b1ded2f78dc0956ea25aa281a0b31";
-    hash = "sha256-FUSPQK4rB0J89s+I7yhF8SQ/Q9uygQSCF9o6ltYxOk4=";
+    rev = "d3cdbe480392dbab6ddc099d7d880378f6a13f26";
+    hash = "sha256-noCwPhp5/wYt28TM1vvsXb0ewRMV/cMzu/zUD2b0YV4=";
  };

-  vendorHash = "sha256-fLhyyIChqh+eEzht3CSLPfx6glw0YhiTb9PsbWJafWQ=";
+  vendorHash = "sha256-5Y+SP374Bd8F2ABKEKRhTcGNhsFM77N5oC5wRN6AzKk=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/gnmic/default.nix
+++ b/pkgs/applications/networking/gnmic/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "gnmic";
-  version = "0.32.0";
+  version = "0.33.0";

  src = fetchFromGitHub {
    owner = "openconfig";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-aEAbIh1BH8R05SpSMSXL2IrudjIki72k7NGvjjKkxZw=";
+    hash = "sha256-7jykosmVG+oJ6/27x+VtlVVxq/OQIctcjB1Wjs1DcRU=";
  };

-  vendorHash = "sha256-hIG3kG2e9Y2hnHJ+96cPLgnlp5ParsLgWQY0HZTDggY=";
+  vendorHash = "sha256-VjeOSnCAdG+RlIg9uIyyQ8wKUqyX5uc2RXG75q84vm4=";

  ldflags = [
    "-s" "-w"
--- a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
@ -4,11 +4,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "rocketchat-desktop";
-  version = "3.9.8";
+  version = "3.9.9";

  src = fetchurl {
    url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat-${version}-linux-amd64.deb";
-    hash = "sha256-sx4WRAeitbBrz6jFvD0WF/EzR7cx4tOPoczbJ+tkw1s=";
+    hash = "sha256-50mVmE+q2VYJXIv2iD6ppS83We0aJRT9vje+zpJcdq0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -7,7 +7,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.96.0.207";
+  version = "8.105.0.208";

  rpath = lib.makeLibraryPath [
    alsa-lib
@ -68,7 +68,7 @@ let
          "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
          "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
        ];
-        sha256 = "sha256-tkOPYFkmc4nzO8Rgat9/VNuzzIW10qSEzbXhjkZV83k=";
+        sha256 = "sha256-P1H9BSXHDmrE8x2kq4Mw5A7r2jVZGSHJh84Hn5EX2lk=";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/ktailctl/default.nix
+++ b/pkgs/applications/networking/ktailctl/default.nix
@ -0,0 +1,83 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, buildGo121Module
+, cmake
+, extra-cmake-modules
+, git
+, go_1_21
+, wrapQtAppsHook
+, qtbase
+, qtquickcontrols2
+, kconfig
+, kcoreaddons
+, kguiaddons
+, ki18n
+, kirigami2
+, kirigami-addons
+, knotifications
+}:
+
+let
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "f-koehler";
+    repo = "KTailctl";
+    rev = "v${version}";
+    hash = "sha256-nY6DEHkDVWIlvc64smXb9KshrhNgNLKiilYydbMKCqc=";
+  };
+
+  goDeps = (buildGo121Module {
+    pname = "tailwrap";
+    inherit src version;
+    modRoot = "tailwrap";
+    vendorHash = "sha256-Y9xhoTf3vCtiNi5qOPg020EQmASo58BZI3rAoUEC8qE=";
+  }).goModules;
+in stdenv.mkDerivation {
+  pname = "ktailctl";
+  inherit version src;
+
+  postPatch = ''
+    cp -r --reflink=auto ${goDeps} tailwrap/vendor
+  '';
+
+  # needed for go build to work
+  preBuild = ''
+    export HOME=$TMPDIR
+  '';
+
+  cmakeFlags = [
+    # actually just disables Go vendoring updates
+    "-DKTAILCTL_FLATPAK_BUILD=ON"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    git
+    go_1_21
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+    qtquickcontrols2
+    kconfig
+    kcoreaddons
+    kguiaddons
+    ki18n
+    kirigami2
+    kirigami-addons
+    knotifications
+  ];
+
+  meta = with lib; {
+    description = "A GUI to monitor and manage Tailscale on your Linux desktop";
+    homepage = "https://github.com/f-koehler/KTailctl";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ k900 ];
+    mainProgram = "ktailctl";
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/networking/kubo/default.nix
+++ b/pkgs/applications/networking/kubo/default.nix
@ -1,4 +1,8 @@
-{ lib, buildGoModule, fetchurl, nixosTests, openssl, pkg-config }:
+{ lib
+, buildGoModule
+, fetchurl
+, nixosTests
+}:

 buildGoModule rec {
  pname = "kubo";
@ -7,7 +11,7 @@ buildGoModule rec {

  passthru.repoVersion = "14"; # Also update kubo-migrator when changing the repo version

-  # Kubo makes changes to it's source tarball that don't match the git source.
+  # Kubo makes changes to its source tarball that don't match the git source.
  src = fetchurl {
    url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
    hash = "sha256-TX5ZM8Kyj3LZ12Ro7MsHRd+P5XLk/mU7DUxZaopSEV0=";
--- a/pkgs/applications/networking/sync/celeste/default.nix
+++ b/pkgs/applications/networking/sync/celeste/default.nix
@ -1,6 +1,5 @@
 { lib
 , stdenv
-, rust
 , rustPlatform
 , fetchFromGitHub
 , substituteAll
@ -22,23 +21,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "celeste";
-  version = "0.5.8";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "hwittenborn";
    repo = "celeste";
    rev = "v${version}";
-    hash = "sha256-U/6aqQig+uuWj/B9CODnV6chxY+KfMH7DqnPtSTDSA0=";
+    hash = "sha256-fqPAQCbuPnFyn3wioWDETmcXu53808nvnlEzcdUevI4=";
  };

-  cargoHash = "sha256-69LK/oicfmSPbUGGzWV9kvXkHqMvEzCG8xCu61MxSdk=";
-
-  patches = [
-    (substituteAll {
-      src = ./target-dir.patch;
-      rustTarget = rust.toRustTarget stdenv.hostPlatform;
-    })
-  ];
+  cargoHash = "sha256-mVl7CsCX7HMlGC2EIKEfHnPNjmrexjsrpDK/Uq/GwpY=";

  postPatch = ''
    pushd $cargoDepsCopy/librclone-sys
@ -61,14 +53,6 @@ rustPlatform.buildRustPackage rec {
    cargo update --offline
  '';

-  # We need to build celeste-tray first because celeste/src/launch.rs reads that file at build time.
-  # Upstream does the same: https://github.com/hwittenborn/celeste/blob/765dfa2/justfile#L1-L3
-  cargoBuildFlags = [ "--bin" "celeste-tray" ];
-  postConfigure = ''
-    cargoBuildHook
-    cargoBuildFlags=
-  '';
-
  RUSTC_BOOTSTRAP = 1;

  nativeBuildInputs = [
--- a/pkgs/applications/networking/sync/celeste/target-dir.patch
+++ b/pkgs/applications/networking/sync/celeste/target-dir.patch
@ -1,16 +0,0 @@
-diff --git a/celeste/src/launch.rs b/celeste/src/launch.rs
-index 5227170..e3cf189 100644
--- a/celeste/src/launch.rs
-+++ b/celeste/src/launch.rs
-@@ -172,10 +172,7 @@ impl TrayApp {
-         perms.set_mode(0o755);
-         file.set_permissions(perms).unwrap();
- 
-        #[cfg(debug_assertions)]
-        let tray_file = include_bytes!("../../target/debug/celeste-tray");
-        #[cfg(not(debug_assertions))]
-        let tray_file = include_bytes!("../../target/release/celeste-tray");
-+        let tray_file = include_bytes!(concat!("../../target/@rustTarget@/", env!("cargoBuildType"), "/celeste-tray"));
- 
-         file.write_all(tray_file).unwrap();
-         drop(file);
--- a/pkgs/applications/science/chemistry/cp2k/default.nix
+++ b/pkgs/applications/science/chemistry/cp2k/default.nix
@ -1,15 +1,57 @@
-{ lib, stdenv, fetchFromGitHub, mpiCheckPhaseHook, python3, gfortran, blas, lapack
-, fftw, libint, libvori, libxc, mpi, gsl, scalapack, openssh, makeWrapper
-, libxsmm, spglib, which, pkg-config, plumed, zlib
+{ lib
+, stdenv
+, fetchFromGitHub
+, mpiCheckPhaseHook
+, python3
+, gfortran
+, blas
+, lapack
+, fftw
+, libint
+, libvori
+, libxc
+, mpi
+, gsl
+, scalapack
+, openssh
+, makeWrapper
+, libxsmm
+, spglib
+, which
+, pkg-config
+, plumed
+, zlib
+, hdf5-fortran
+, sirius
+, libvdwxc
+, spla
+, spfft
 , enableElpa ? false
 , elpa
-} :
+, gpuBackend ? "none"
+, cudaPackages
+# gpuVersion needs to be set for both CUDA as well as ROCM hardware.
+# gpuArch is only required for the ROCM stack.
+# Change to a value suitable for your target GPU.
+# For AMD values see https://github.com/cp2k/cp2k/blob/master/INSTALL.md#2v-rocmhip-support-for-amd-gpu
+# and for Nvidia see https://github.com/cp2k/cp2k/blob/master/INSTALL.md#2i-cuda-optional-improved-performance-on-gpu-systems
+, gpuVersion ? "Mi100"
+, gpuArch ? "gfx908"
+, rocm-core
+, hip
+, hipblas
+, hipfft
+, rocblas
+}:
+
+assert builtins.elem gpuBackend [ "none" "cuda" "rocm" ];

 let
  cp2kVersion = "psmp";
  arch = "Linux-x86-64-gfortran";

-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
  pname = "cp2k";
  version = "2023.2";

@ -36,7 +78,16 @@ in stdenv.mkDerivation rec {
    lapack
    plumed
    zlib
-  ] ++ lib.optional enableElpa elpa;
+    hdf5-fortran
+    sirius
+    spla
+    spfft
+    libvdwxc
+  ]
+  ++ lib.optional enableElpa elpa
+  ++ lib.optional (gpuBackend == "cuda") cudaPackages.cudatoolkit
+  ++ lib.optional (gpuBackend == "rocm") [hip rocm-core hipblas hipfft rocblas]
+  ;

  propagatedBuildInputs = [ mpi ];
  propagatedUserEnvPkgs = [ mpi ];
@ -46,7 +97,7 @@ in stdenv.mkDerivation rec {
    "VERSION=${cp2kVersion}"
  ];

-  doCheck = true;
+  doCheck = gpuBackend == "none";

  enableParallelBuilding = true;

@ -64,25 +115,46 @@ in stdenv.mkDerivation rec {
    FC         = mpif90
    LD         = mpif90
    AR         = ar -r
+    ${lib.strings.optionalString (gpuBackend == "cuda") ''
+    OFFLOAD_CC = nvcc
+    OFFLOAD_FLAGS = -O3 -g -w --std=c++11
+    OFFLOAD_TARGET = cuda
+    GPUVER = ${gpuVersion}
+    CXX = mpicxx
+    CXXFLAGS = -std=c++11 -fopenmp
+    ''}
+    ${lib.strings.optionalString (gpuBackend == "rocm") ''
+    GPUVER = ${gpuVersion}
+    OFFLOAD_CC = hipcc
+    OFFLOAD_FLAGS = -fopenmp -m64 -pthread -fPIC -D__GRID_HIP -O2 --offload-arch=${gpuArch} --rocm-path=${rocm-core}
+    OFFLOAD_TARGET = hip
+    CXX = mpicxx
+    CXXFLAGS = -std=c++11 -fopenmp -D__HIP_PLATFORM_AMD__
+    ''}
    DFLAGS     = -D__FFTW3 -D__LIBXC -D__LIBINT -D__parallel -D__SCALAPACK \
                 -D__MPI_VERSION=3 -D__F2008 -D__LIBXSMM -D__SPGLIB \
                 -D__MAX_CONTR=4 -D__LIBVORI ${lib.optionalString enableElpa "-D__ELPA"} \
-                 -D__PLUMED2
-    CFLAGS    = -fopenmp
+                 -D__PLUMED2 -D__HDF5 -D__GSL -D__SIRIUS -D__LIBVDWXC -D__SPFFT -D__SPLA \
+                 ${lib.strings.optionalString (gpuBackend == "cuda") "-D__OFFLOAD_CUDA -D__DBCSR_ACC"} \
+                 ${lib.strings.optionalString (gpuBackend == "rocm") "-D__OFFLOAD_HIP -D__DBCSR_ACC -D__NO_OFFLOAD_PW"}
+    CFLAGS    = -fopenmp -I${lib.getDev hdf5-fortran}/include -I${lib.getDev gsl}/include
    FCFLAGS    = \$(DFLAGS) -O2 -ffree-form -ffree-line-length-none \
                 -ftree-vectorize -funroll-loops -msse2 \
                 -std=f2008 \
                 -fopenmp -ftree-vectorize -funroll-loops \
-                 -I${lib.getDev libxc}/include -I${lib.getDev libxsmm}/include \
-                 -I${libint}/include ${lib.optionalString enableElpa "$(pkg-config --variable=fcflags elpa)"}
+                 -I${lib.getDev libint}/include ${lib.optionalString enableElpa "$(pkg-config --variable=fcflags elpa)"} \
+                 -I${lib.getDev sirius}/include/sirius \
+                 -I${lib.getDev libxc}/include -I${lib.getDev libxsmm}/include
    LIBS       = -lfftw3 -lfftw3_threads \
                 -lscalapack -lblas -llapack \
                 -lxcf03 -lxc -lxsmmf -lxsmm -lsymspg \
                 -lint2 -lstdc++ -lvori \
                 -lgomp -lpthread -lm \
                 -fopenmp ${lib.optionalString enableElpa "$(pkg-config --libs elpa)"} \
-                 -lz -ldl -lstdc++ ${lib.optionalString (mpi.pname == "openmpi") "$(mpicxx --showme:link)"} \
-                 -lplumed
+                 -lz -ldl ${lib.optionalString (mpi.pname == "openmpi") "$(mpicxx --showme:link)"} \
+                 -lplumed -lhdf5_fortran -lhdf5_hl -lhdf5 -lgsl -lsirius -lspla -lspfft -lvdwxc \
+                 ${lib.strings.optionalString (gpuBackend == "cuda") "-lcudart -lnvrtc -lcuda -lcublas"} \
+                 ${lib.strings.optionalString (gpuBackend == "rocm") "-lamdhip64 -lhipfft -lhipblas -lrocblas"}
    LDFLAGS    = \$(FCFLAGS) \$(LIBS)
    include ${plumed}/lib/plumed/src/lib/Plumed.inc
    EOF
--- a/pkgs/applications/science/logic/dafny/default.nix
+++ b/pkgs/applications/science/logic/dafny/default.nix
@ -8,28 +8,36 @@

 buildDotnetModule rec {
  pname = "Dafny";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitHub {
    owner = "dafny-lang";
    repo = "dafny";
    rev = "v${version}";
-    sha256 = "sha256-RSGaOgGf3m94t3SKnvSPqz0VHhWr6NmIMtGsmOynMaM=";
+    hash = "sha256-bnKaaqh1/921SRwnwqgYb31SJ8vguEBtzywPTz79S6I=";
  };

-  postPatch = ''
-    cp ${writeScript "fake-gradlew-for-dafny" ''
-      mkdir -p build/libs/
-      javac $(find -name "*.java" | grep "^./src/main") -d classes
-      jar cf build/libs/DafnyRuntime-${version}.jar -C classes dafny
-    ''} Source/DafnyRuntime/DafnyRuntimeJava/gradlew
+  postPatch =
+    # This version number seems to be hardcoded and didn't get updated with the
+    # version bump from 4.2.0 to 4.3.0.
+    let dafnyRuntimeJarVersion = "4.2.0";
+    in ''
+      cp ${
+        writeScript "fake-gradlew-for-dafny" ''
+          mkdir -p build/libs/
+          javac $(find -name "*.java" | grep "^./src/main") -d classes
+          jar cf build/libs/DafnyRuntime-${dafnyRuntimeJarVersion}.jar -C classes dafny
+        ''} Source/DafnyRuntime/DafnyRuntimeJava/gradlew

-    # Needed to fix
-    # "error NETSDK1129: The 'Publish' target is not supported without specifying a target framework. The current project targets multiple frameworks, you must specify the framework for the published application."
-    substituteInPlace Source/DafnyRuntime/DafnyRuntime.csproj \
-      --replace TargetFrameworks TargetFramework \
-      --replace "netstandard2.0;net452" net6.0
-  '';
+      # Needed to fix
+      # "error NETSDK1129: The 'Publish' target is not supported without
+      # specifying a target framework. The current project targets multiple
+      # frameworks, you must specify the framework for the published
+      # application."
+      substituteInPlace Source/DafnyRuntime/DafnyRuntime.csproj \
+        --replace TargetFrameworks TargetFramework \
+        --replace "netstandard2.0;net452" net6.0
+    '';

  buildInputs = [ jdk11 ];
  nugetDeps = ./deps.nix;
--- a/pkgs/applications/terminal-emulators/roxterm/default.nix
+++ b/pkgs/applications/terminal-emulators/roxterm/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "roxterm";
-  version = "3.12.1";
+  version = "3.14.1";

  src = fetchFromGitHub {
    owner = "realh";
    repo = "roxterm";
    rev = version;
-    sha256 = "sha256-jVcf/nrEq8dM8rw40ZhXGJjt3DQLroCePtIAdAsVIfs=";
+    sha256 = "sha256-IHJ30qXNVv9tUdePskHl1hd5kPivBb2kH1oOstBr/9s=";
  };

  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook libxslt ];
--- a/pkgs/applications/video/kodi/addons/keymap/default.nix
+++ b/pkgs/applications/video/kodi/addons/keymap/default.nix
@ -3,11 +3,11 @@
 buildKodiAddon rec {
  pname = "keymap";
  namespace = "script.keymap";
-  version = "1.1.4";
+  version = "1.1.5";

  src = fetchzip {
    url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-eWzMqsE8H0wUvPyd3wvjiaXEg4+sgkQ3CQYjE0VS+9g=";
+    sha256 = "sha256-wSztipTEGIqw1icsz+ziNxYuRZOFt3C66T1Ifap/ta0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/video/media-downloader/default.nix
+++ b/pkgs/applications/video/media-downloader/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "media-downloader";
-  version = "3.3.0";
+  version = "3.4.0";

  src = fetchFromGitHub {
    owner = "mhogomchungu";
    repo = "media-downloader";
    rev = finalAttrs.version;
-    hash = "sha256-UmNaosunkNUTm4rsf4q29H+0cJAccUDx+ulcS2octIo=";
+    hash = "sha256-FTfkVD2uBfCBbP7fjjfG21bOGDVd2j6bhPLHGPm3xh4=";
  };

  nativeBuildInputs = [
@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  meta = {
-    description = "A Qt/C++ GUI front end to youtube-dl";
+    description = "A Qt/C++ GUI front end for yt-dlp and others";
    homepage = "https://github.com/mhogomchungu/media-downloader";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ zendo ];
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -106,12 +106,6 @@ rec {
          url = "https://github.com/moby/moby/pull/43136.patch";
          hash = "sha256-1WZfpVnnqFwLMYqaHLploOodls0gHF8OCp7MrM26iX8=";
        })
-      ] ++ lib.optionals (lib.versionOlder version "23.0.5") [
-        (fetchpatch {
-          name = "fix-issue-with-go-1.20.6.patch";
-          url = "https://github.com/moby/moby/pull/45972.patch";
-          hash = "sha256-zxFh/bI6+INOYSg6QFs0S9rdl9Z21KUIZFmzpNVjpSA=";
-        })
      ];

      postPatch = ''
@ -190,14 +184,6 @@ rec {
      glibc.static
    ];

-    patches = lib.optionals (lib.versionOlder version "23.0.5") [
-      (fetchpatch {
-        name = "fix-issue-with-go-1.20.6.patch";
-        url = "https://github.com/docker/cli/pull/4441.patch";
-        hash = "sha256-F4ueSbdBk1w8OqC4Dgh8+4Ql4zTjehaM368ET7k6Yx8=";
-      })
-    ];
-
    postPatch = ''
      patchShebangs man scripts/build/
      substituteInPlace ./scripts/build/.variables --replace "set -eu" ""
@ -283,15 +269,15 @@ rec {
  # Get revisions from
  # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
  docker_20_10 = callPackage dockerGen rec {
-    version = "20.10.25";
+    version = "20.10.26";
    cliRev = "v${version}";
-    cliHash = "sha256-Wi/NHn8erqvKEVEJqkc99cO/sfPHptwMT44Savcuw2M=";
+    cliHash = "sha256-EPhsng0kLnweVbC8ZnH0NK1/yHlYSA5Sred4rWJX/Gs=";
    mobyRev = "v${version}";
-    mobyHash = "sha256-trJjQMYF/Uog7nvUlELyUYbsTPGz8Rn21v1/V5xhu+A=";
-    runcRev = "v1.1.5";
-    runcHash = "sha256-r5as3hb0zt+XPfxAPeH+YIc/n6IRlscPOZMGfhVE5C4=";
-    containerdRev = "v1.6.20";
-    containerdHash = "sha256-Nd3S6hmvA8LBFUN4XaQJMApbmwGIp6GTnFQimnYagZg=";
+    mobyHash = "sha256-IJ7m2mQnsLiom0EuZLpuLY6fYEko7rEy35igJv1AY04=";
+    runcRev = "v1.1.8";
+    runcHash = "sha256-rDJYEc64KW4Qa3Eg2oUjJqIKrg6THb5hxQFFbvb9Zp4=";
+    containerdRev = "v1.6.22";
+    containerdHash = "sha256-In7OkK3xm7Cz3H1jzG9b4tsZbmo44QCq8pNU+PPy8dY=";
    tiniRev = "v0.19.0";
    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
  };
--- a/pkgs/applications/virtualization/docker/distribution.nix
+++ b/pkgs/applications/virtualization/docker/distribution.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  pname = "distribution";
-  version = "2.8.2";
+  version = "2.8.3";
  rev = "v${version}";

  goPackagePath = "github.com/docker/distribution";
@ -11,7 +11,7 @@ buildGoPackage rec {
    owner = "docker";
    repo = "distribution";
    inherit rev;
-    sha256 = "sha256-aBAUyM+MtRZAA6Jxu4cFyRIo5OU+7IdLKdQqgm0AFPI=";
+    sha256 = "sha256-6/clOTkI1JnDjb+crcHmjbQlaqffP/sntGqUB2ftajU=";
  };

  meta = with lib; {
--- a/pkgs/applications/window-managers/picom/picom-allusive.nix
+++ b/pkgs/applications/window-managers/picom/picom-allusive.nix
@ -0,0 +1,24 @@
+{ picom, lib, fetchFromGitHub }:
+
+picom.overrideAttrs (oldAttrs: rec {
+  pname = "picom-allusive";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "allusive-dev";
+    repo = "picom-allusive";
+    rev = version;
+    hash = "sha256-lk4Ll0mi9h3BAqwgOzFQw4WYKnSW9XTl3PjoK2E4WKg=";
+  };
+
+  postInstall = ''
+    chmod +x $out/bin/picom-trans
+  '' + (lib.optionalString (oldAttrs ? postInstall) oldAttrs.postInstall);
+
+  meta = {
+    description = "A fork of picom featuring improved animations and other features";
+    homepage = "https://github.com/allusive-dev/picom-allusive";
+    license = with lib.licenses; [ mit mpl20 ];
+    maintainers = with lib.maintainers; [ allusive ];
+  };
+})
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@ -44,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
    # Use /run/current-system/sw/share and /etc instead of /nix/store
    # references:
    ./sway-config-nixos-paths.patch
+    # Drop ambient capabilities after getting SCHED_RR
+    ./drop_ambient_capabilities.patch
  ];

  strictDeps = true;
--- a/pkgs/applications/window-managers/sway/drop_ambient_capabilities.patch
+++ b/pkgs/applications/window-managers/sway/drop_ambient_capabilities.patch
@ -0,0 +1,41 @@
+From e7d9098e81289ae99d07ec3eac1fec1d303b8fe4 Mon Sep 17 00:00:00 2001
+From: Thiago Kenji Okada <thiagokokada@gmail.com>
+Date: Thu, 5 Oct 2023 15:23:35 +0100
+Subject: [PATCH] drop ambient capabilities
+
+Within NixOS the only possibility to gain cap_sys_nice is using the
+security.wrapper infrastructure. However to pass the capabilities to the
+wrapped program, they are raised to the ambient set. To fix this we make
+sure to drop the ambient capabilities during sway startup and realtime
+setup. Otherwise all programs started by sway also gain cap_sys_nice,
+which is not something we want.
+
+Co-authored-by: Rouven Czerwinski <rouven@czerwinskis.de>
+---
+ sway/realtime.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sway/realtime.c b/sway/realtime.c
+index 11154af0..06f872a8 100644
+--- a/sway/realtime.c
+++ b/sway/realtime.c
+@@ -3,6 +3,7 @@
+ #include <unistd.h>
+ #include <pthread.h>
+ #include "sway/server.h"
+#include "sys/prctl.h"
+ #include "log.h"
+ 
+ static void child_fork_callback(void) {
+@@ -10,6 +11,8 @@ static void child_fork_callback(void) {
+ 
+ 	param.sched_priority = 0;
+ 
+	prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
+
+ 	int ret = pthread_setschedparam(pthread_self(), SCHED_OTHER, &param);
+ 	if (ret != 0) {
+ 		sway_log(SWAY_ERROR, "Failed to reset scheduler policy on fork");
+-- 
+2.42.0
+
--- a/pkgs/build-support/php/hooks/composer-repository-hook.sh
+++ b/pkgs/build-support/php/hooks/composer-repository-hook.sh
@ -17,6 +17,7 @@ composerRepositoryConfigureHook() {
    fi

    if [[ ! -f "composer.lock" ]]; then
+        COMPOSER_ROOT_VERSION="${version}" \
        composer \
            --no-ansi \
            --no-install \
--- a/pkgs/by-name/README.md
+++ b/pkgs/by-name/README.md
@ -3,6 +3,10 @@
 The structure of this directory maps almost directly to top-level package attributes.
 This is the recommended way to add new top-level packages to Nixpkgs [when possible](#limitations).

+Packages found in the named-based structure do not need to be explicitly added to the
+`top-level/all-packages.nix` file unless they require overriding the default value
+of an implicit attribute (see below).
+
 ## Example

 The top-level package `pkgs.some-package` may be declared by setting up this file structure:
--- a/pkgs/development/libraries/cimg/default.nix
+++ b/pkgs/development/libraries/cimg/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cimg";
-  version = "3.2.6";
+  version = "3.3.1";

  src = fetchFromGitHub {
    owner = "GreycLab";
    repo = "CImg";
    rev = "v.${finalAttrs.version}";
-    hash = "sha256-HEqjvL16Ca3Al3I6VK50CU6zHFj9Nn/SAXXCfRU4rgo=";
+    hash = "sha256-Y3UPfBH+Sa1f529J1JXx8Ul0zi3b1mkOvo1tbxBSYRk=";
  };

  outputs = [ "out" "doc" ];
--- a/pkgs/tools/networking/connman/connman-gtk/default.nix
+++ b/pkgs/tools/networking/connman/connman-gtk/default.nix
--- a/pkgs/tools/networking/connman/connman-ncurses/default.nix
+++ b/pkgs/tools/networking/connman/connman-ncurses/default.nix
--- a/pkgs/tools/networking/connman/connman-notify/default.nix
+++ b/pkgs/tools/networking/connman/connman-notify/default.nix
--- a/pkgs/tools/networking/connman/connman/create-libppp-compat.h.patch
+++ b/pkgs/tools/networking/connman/connman/create-libppp-compat.h.patch
--- a/pkgs/by-name/co/connman/package.nix
+++ b/pkgs/by-name/co/connman/package.nix
@ -0,0 +1,176 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, autoreconfHook
+, dbus
+, file
+, glib
+, gnutls
+, iptables
+, libmnl
+, libnftnl # for nftables
+, nixosTests
+, openconnect
+, openvpn
+, pkg-config
+, polkit
+, ppp
+, pptp
+, readline
+, vpnc
+, dnsType ? "internal" # or "systemd-resolved"
+, enableBluetooth ? true
+, enableClient ? true
+, enableDatafiles ? true
+, enableDundee ? true
+, enableEthernet ? true
+, enableGadget ? true
+, enableHh2serialGps ? false
+, enableIospm ? false
+, enableL2tp ? false
+, enableLoopback ? true
+, enableNeard ? true
+, enableNetworkManager ? null
+, enableNetworkManagerCompatibility ?
+  if enableNetworkManager == null
+  then false
+  else lib.warn "enableNetworkManager option is deprecated; use enableNetworkManagerCompatibility instead" enableNetworkManager
+, enableOfono ? true
+, enableOpenconnect ? true
+, enableOpenvpn ? true
+, enablePacrunner ? true
+, enablePolkit ? true
+, enablePptp ? true
+, enableStats ? true
+, enableTist ? false
+, enableTools ? true
+, enableVpnc ? true
+, enableWifi ? true
+, enableWireguard ? true
+, enableWispr ? true
+, firewallType ? "iptables" # or "nftables"
+}:
+
+let
+  inherit (lib)
+    enableFeature
+    enableFeatureAs
+    optionals
+    withFeatureAs;
+in
+assert lib.asserts.assertOneOf "firewallType" firewallType [ "iptables" "nftables" ];
+assert lib.asserts.assertOneOf "dnsType" dnsType [ "internal" "systemd-resolved" ];
+stdenv.mkDerivation (finalAttrs: {
+  pname = "connman";
+  version = "1.42";
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/network/connman/connman-${finalAttrs.version}.tar.xz";
+    hash = "sha256-o+a65G/Age8una48qk92Sd6JLD3mIsICg6wMqBQjwqo=";
+  };
+
+  patches = [
+    # simply the middle section of upstream commit a48864a2e5d2a725dfc6eef567108bc13b43857f
+    # dist tarball is broken, hence this patch as a workaround
+    ./create-libppp-compat.h.patch
+  ] ++ optionals stdenv.hostPlatform.isMusl [
+    # Fix Musl build by avoiding a Glibc-only API.
+    (fetchurl {
+      url = "https://git.alpinelinux.org/aports/plain/community/connman/libresolv.patch?id=e393ea84386878cbde3cccadd36a30396e357d1e";
+      hash = "sha256-7Q1bp8rD/gGVYUqnIXqjr9vypR8jlC926p3KYWl9kLw=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    file
+    pkg-config
+  ];
+
+  buildInputs = [
+    glib
+    dbus
+    libmnl
+    gnutls
+    readline
+  ]
+  ++ optionals (firewallType == "iptables") [ iptables ]
+  ++ optionals (firewallType == "nftables") [ libnftnl ]
+  ++ optionals (enableOpenconnect) [ openconnect ]
+  ++ optionals (enablePolkit) [ polkit ]
+  ++ optionals (enablePptp) [ pptp ppp ]
+  ;
+
+  postPatch = ''
+    sed -i "s@/usr/bin/file@file@g" ./configure
+  '';
+
+  configureFlags = [
+    # directories flags
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+  ] ++ [
+    # production build flags
+    (enableFeature false "maintainer-mode")
+    (enableFeatureAs true "session-policy-local" "builtin")
+    # for building and running tests
+    # (enableFeature true "tests") # installs the tests, we don't want that
+    (enableFeature true "tools")
+    (enableFeature enableLoopback "loopback")
+    (enableFeature enableEthernet "ethernet")
+    (enableFeature enableWireguard "wireguard")
+    (enableFeature enableGadget "gadget")
+    (enableFeature enableWifi "wifi")
+    # enable IWD support for wifi as it doesn't require any new dependencies and
+    # it's easier for the NixOS module to use only one connman package when IWD
+    # is requested
+    (enableFeature enableWifi "iwd")
+    (enableFeature enableBluetooth "bluetooth")
+    (enableFeature enableOfono "ofono")
+    (enableFeature enableDundee "dundee")
+    (enableFeature enablePacrunner "pacrunner")
+    (enableFeature enableNeard "neard")
+    (enableFeature enableWispr "wispr")
+    (enableFeature enableTools "tools")
+    (enableFeature enableStats "stats")
+    (enableFeature enableClient "client")
+    (enableFeature enableDatafiles "datafiles")
+    (enableFeature enablePolkit "polkit")
+    (enableFeature enablePptp "pptp")
+    (enableFeature enableWireguard "wireguard")
+    (enableFeature enableNetworkManagerCompatibility "nmcompat")
+    (enableFeature enableHh2serialGps "hh2serial-gps")
+    (enableFeature enableL2tp "l2tp")
+    (enableFeature enableIospm "iospm")
+    (enableFeature enableTist "tist")
+  ] ++ [
+    (enableFeatureAs enableOpenconnect "openconnect" "builtin")
+    (enableFeatureAs enableOpenvpn "openvpn" "builtin")
+    (enableFeatureAs enableVpnc "vpnc" "builtin")
+  ] ++ [
+    (withFeatureAs true "dbusconfdir" "${placeholder "out"}/share")
+    (withFeatureAs true "dbusdatadir" "${placeholder "out"}/share")
+    (withFeatureAs true "tmpfilesdir" "${placeholder "out"}/tmpfiles.d")
+    (withFeatureAs true "systemdunitdir" "${placeholder "out"}/systemd/system")
+    (withFeatureAs true "dns-backend" "${dnsType}")
+    (withFeatureAs true "firewall" "${firewallType}")
+    (withFeatureAs enableOpenconnect "openconnect" "${openconnect}/sbin/openconnect")
+    (withFeatureAs enableOpenvpn "openvpn" "${openvpn}/sbin/openvpn")
+    (withFeatureAs enableVpnc "vpnc" "${vpnc}/sbin/vpnc")
+    (withFeatureAs enablePptp "pptp" "${pptp}/sbin/pptp")
+  ];
+
+  doCheck = true;
+
+  passthru.tests.connman = nixosTests.connman;
+
+  meta = {
+    description = "A daemon for managing internet connections";
+    homepage = "https://git.kernel.org/pub/scm/network/connman/connman.git/about/";
+    license = lib.licenses.gpl2Only;
+    mainProgram = "connmanctl";
+    maintainers = with lib.maintainers; [ eclairevoyant AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/tools/networking/connman/connman_dmenu/default.nix
+++ b/pkgs/tools/networking/connman/connman_dmenu/default.nix
--- a/pkgs/by-name/co/costa/package.nix
+++ b/pkgs/by-name/co/costa/package.nix
@ -0,0 +1,40 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, mpi
+, scalapack
+, llvmPackages
+}:
+
+stdenv.mkDerivation rec {
+  pname = "COSTA";
+  version = "2.2.2";
+
+  src = fetchFromGitHub {
+    owner = "eth-cscs";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-jiAyZXC7wiuEnOLsQFFLxhN3AsGXN09q/gHC2Hrb2gg=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ scalapack ] ++ lib.optional stdenv.isDarwin llvmPackages.openmp;
+
+  propagatedBuildInputs = [ mpi ];
+
+  cmakeFlags = [
+    "-DCOSTA_SCALAPACK=CUSTOM"
+    "-DSCALAPACK_ROOT=${scalapack}"
+  ];
+
+
+  meta = with lib; {
+    description = "Distributed Communication-Optimal Shuffle and Transpose Algorithm";
+    homepage = "https://github.com/eth-cscs/COSTA";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.sheepforce ];
+  };
+}
--- a/pkgs/by-name/eu/eudev/package.nix
+++ b/pkgs/by-name/eu/eudev/package.nix
@ -0,0 +1,85 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, gperf
+, kmod
+, pkg-config
+, util-linux
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "eudev";
+  version = "3.2.14";
+
+  src = fetchFromGitHub {
+    owner = "eudev-project";
+    repo = "eudev";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-v/szzqrBedQPRGYkZ0lV9rslCH//uqGp4PHEF0/51Lg=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    gperf
+    pkg-config
+  ];
+
+  buildInputs = [
+    kmod
+    util-linux
+  ];
+
+  configureFlags = [
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+  ];
+
+  makeFlags = [
+    "hwdb_bin=/var/lib/udev/hwdb.bin"
+    "udevrulesdir=/etc/udev/rules.d"
+  ];
+
+  preInstall = ''
+    # Disable install-exec-hook target, as it conflicts with our move-sbin
+    # setup-hook
+
+    sed -i 's;$(MAKE) $(AM_MAKEFLAGS) install-exec-hook;$(MAKE) $(AM_MAKEFLAGS);g' src/udev/Makefile
+  '';
+
+  installFlags = [
+    "localstatedir=$(TMPDIR)/var"
+    "sysconfdir=$(out)/etc"
+    "udevconfdir=$(out)/etc/udev"
+    "udevhwdbbin=$(out)/var/lib/udev/hwdb.bin"
+    "udevhwdbdir=$(out)/var/lib/udev/hwdb.d"
+    "udevrulesdir=$(out)/var/lib/udev/rules.d"
+  ];
+
+  meta = {
+    homepage = "https://github.com/eudev-project/eudev";
+    description = "A fork of udev with the aim of isolating it from init";
+    longDescription = ''
+      eudev is a standalone dynamic and persistent device naming support (aka
+      userspace devfs) daemon that runs independently from the init
+      system. eudev strives to remain init system and linux distribution
+      neutral. It is currently used as the devfs manager for more than a dozen
+      different linux distributions.
+
+      This git repo is a fork of systemd repository with the aim of isolating
+      udev from any particular flavor of system initialization. In this case,
+      the isolation is from systemd.
+
+      This is a project started by Gentoo developers and testing was initially
+      being done mostly on OpenRC. We welcome contribution from others using a
+      variety of system initializations to ensure eudev remains system
+      initialization and distribution neutral. On 2021-08-20 Gentoo decided to
+      abandon eudev and a new project was established on 2021-09-14 by Alpine,
+      Devuan and Gentoo contributors.
+    '';
+    changelog = "https://github.com/eudev-project/eudev/releases/tag/${finalAttrs.src.rev}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ raskin AndersonTorres ];
+    inherit (kmod.meta) platforms;
+  };
+})
--- a/pkgs/tools/graphics/gmic/default.nix
+++ b/pkgs/tools/graphics/gmic/default.nix
@ -26,7 +26,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gmic";
-  version = "3.2.6";
+  version = "3.3.1";

  outputs = [ "out" "lib" "dev" "man" ];

@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "GreycLab";
    repo = "gmic";
    rev = "v.${finalAttrs.version}";
-    hash = "sha256-kaI5rcAz3Cw/xzWgJhMRu/cQwVrvLRAPiB5BhzPMOHY=";
+    hash = "sha256-HagGabJ1jkg5SkMlr0Y5rGFw64jPW8QLuR0I2idM1N0=";
  };

  # TODO: build this from source
--- a/pkgs/by-name/ic/icewm/package.nix
+++ b/pkgs/by-name/ic/icewm/package.nix
@ -41,13 +41,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "icewm";
-  version = "3.4.2";
+  version = "3.4.3";

  src = fetchFromGitHub {
    owner = "ice-wm";
    repo = "icewm";
    rev = finalAttrs.version;
-    hash = "sha256-s1gupU5AOQOMqz8YRMIBc2Oe7DMnlGgXitcq7CFWwSE=";
+    hash = "sha256-SgSbcWNib2BXyTOBDI1J2TzXhnXoRH0GK3rJvyLID7w=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ne/netclient/package.nix
+++ b/pkgs/by-name/ne/netclient/package.nix
@ -0,0 +1,34 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, libX11
+, stdenv
+, darwin
+}:
+
+buildGoModule rec {
+  pname = "netclient";
+  version = "0.21.0";
+
+  src = fetchFromGitHub {
+    owner = "gravitl";
+    repo = "netclient";
+    rev = "v${version}";
+    hash = "sha256-68/BmVoAFaIg4vgjzhedSBqm6H9VDu3M7JemfPEcpjQ=";
+  };
+
+  vendorHash = "sha256-CsW4tW6+INw93A7uXtHeVnxRrE5unHXhm2SOmQkJwYA=";
+
+  buildInputs = lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa
+    ++ lib.optional stdenv.isLinux libX11;
+
+  hardeningEnabled = [ "pie" ];
+
+  meta = with lib; {
+    description = "Automated WireGuard® Management Client";
+    homepage = "https://netmaker.io";
+    changelog = "https://github.com/gravitl/netclient/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ wexder ];
+  };
+}
--- a/pkgs/by-name/nf/nfft/package.nix
+++ b/pkgs/by-name/nf/nfft/package.nix
@ -0,0 +1,52 @@
+{ autoconf
+, automake
+, cunit
+, fetchFromGitHub
+, fftw
+, lib
+, libtool
+, llvmPackages
+, stdenv
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nfft";
+  version = "3.5.3";
+
+  src = fetchFromGitHub {
+    owner = "NFFT";
+    repo = "nfft";
+    rev = finalAttrs.version;
+    hash = "sha256-HR8ME9PVC+RAv1GIgV2vK6eLU8Wk28+rSzbutThBv3w=";
+  };
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    cunit
+    libtool
+  ];
+
+  preConfigure = ''
+    bash bootstrap.sh
+  '';
+
+  configureFlags = [
+    "--enable-all"
+    "--enable-openmp"
+    "--enable-portable-binary"
+  ];
+
+  buildInputs = lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
+
+  propagatedBuildInputs = [ fftw ];
+
+  doCheck = true;
+
+  meta = {
+    description = "Nonequispaced fast Fourier transform";
+    homepage = "https://www-user.tu-chemnitz.de/~potts/nfft/";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ hmenke ];
+  };
+})
--- a/pkgs/by-name/si/sirius/package.nix
+++ b/pkgs/by-name/si/sirius/package.nix
@ -0,0 +1,117 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkg-config
+, mpi
+, mpiCheckPhaseHook
+, openssh
+, gfortran
+, blas
+, lapack
+, gsl
+, libxc
+, hdf5
+, spglib
+, spfft
+, spla
+, costa
+, scalapack
+, boost
+, eigen
+, libvdwxc
+, llvmPackages
+, gpuBackend ? "none"
+, cudaPackages
+, hip
+, rocblas
+}:
+
+assert builtins.elem gpuBackend [ "none" "cuda" "rocm" ];
+
+stdenv.mkDerivation rec {
+  pname = "SIRIUS";
+  version = "7.4.3";
+
+  src = fetchFromGitHub {
+    owner = "electronic-structure";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-s4rO+dePvtvn41wxCvbqgQGrEckWmfng7sPX2M8OPB0=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/gpu/acc_blas_api.hpp \
+      --replace '#include <rocblas.h>' '#include <rocblas/rocblas.h>'
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    gfortran
+    pkg-config
+  ];
+
+  buildInputs = [
+    blas
+    lapack
+    gsl
+    libxc
+    hdf5
+    spglib
+    spfft
+    spla
+    costa
+    scalapack
+    boost
+    eigen
+    libvdwxc
+  ]
+  ++ lib.optional (gpuBackend == "cuda") cudaPackages.cudatoolkit
+  ++ lib.optionals (gpuBackend == "rocm") [ hip rocblas ]
+  ++ lib.optional stdenv.isDarwin llvmPackages.openmp
+  ;
+
+  propagatedBuildInputs = [ mpi ];
+
+  cmakeFlags = [
+    "-DUSE_SCALAPACK=ON"
+    "-DBUILD_TESTING=ON"
+    "-DUSE_VDWXC=ON"
+    "-DCREATE_FORTRAN_BINDINGS=ON"
+    "-DUSE_OPENMP=ON"
+    "-DBUILD_TESTING=ON"
+  ]
+  ++ lib.optionals (gpuBackend == "cuda") [
+    "-DUSE_CUDA=ON"
+    "-DCUDA_TOOLKIT_ROOT_DIR=${cudaPackages.cudatoolkit}"
+  ]
+  ++ lib.optionals (gpuBackend == "rocm") [
+    "-DUSE_ROCM=ON"
+    "-DHIP_ROOT_DIR=${hip}"
+  ];
+
+  doCheck = true;
+
+  # Can not run parallel checks generally as it requires exactly multiples of 4 MPI ranks
+  checkPhase = ''
+    runHook preCheck
+
+    ctest --output-on-failure --label-exclude integration_test
+    ctest --output-on-failure -L cpu_serial
+
+    runHook postCheck
+  '';
+
+  nativeCheckInputs = [
+    mpiCheckPhaseHook
+    openssh
+  ];
+
+  meta = with lib; {
+    description = "Domain specific library for electronic structure calculations";
+    homepage = "https://github.com/electronic-structure/SIRIUS";
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.sheepforce ];
+  };
+}
--- a/pkgs/by-name/sp/spfft/package.nix
+++ b/pkgs/by-name/sp/spfft/package.nix
@ -0,0 +1,67 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fftw
+, cmake
+, mpi
+, gfortran
+, llvmPackages
+, gpuBackend ? "none"
+, cudaPackages
+, hip
+, rocfft
+, hipfft
+}:
+
+assert builtins.elem gpuBackend [ "none" "cuda" "rocm" ];
+
+stdenv.mkDerivation rec {
+  pname = "SpFFT";
+  version = "1.0.6";
+
+  src = fetchFromGitHub {
+    owner = "eth-cscs";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-70fPbIYbW50CoMdRS93hZKSbMEIQvZGFNE+eiRvuw0o=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gfortran
+  ];
+
+  buildInputs = [
+    fftw
+  ]
+  ++ lib.optional (gpuBackend == "cuda") cudaPackages.cudatoolkit
+  ++ lib.optionals (gpuBackend == "rocm") [ hip rocfft hipfft ]
+  ++ lib.optional stdenv.isDarwin llvmPackages.openmp
+  ;
+
+  propagatedBuildInputs = [ mpi ];
+
+  cmakeFlags = [
+    "-DSPFFT_OMP=ON"
+    "-DSPFFT_MPI=ON"
+    "-DSPFFT_SINGLE_PRECISION=OFF"
+    "-DSPFFT_FORTRAN=ON"
+    # Required due to broken CMake files
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ]
+  ++ lib.optional (gpuBackend == "cuda") "-DSPFFT_GPU_BACKEND=CUDA"
+  ++ lib.optionals (gpuBackend == "rocm") [
+    "-DSPFFT_GPU_BACKEND=ROCM"
+    "-DHIP_ROOT_DIR=${hip}"
+  ];
+
+
+  meta = with lib; {
+    description = "Sparse 3D FFT library with MPI, OpenMP, CUDA and ROCm support";
+    homepage = "https://github.com/eth-cscs/SpFFT";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.sheepforce ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/sp/spla/package.nix
+++ b/pkgs/by-name/sp/spla/package.nix
@ -0,0 +1,66 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, mpi
+, blas
+, gfortran
+, llvmPackages
+, gpuBackend ? "none"
+, cudaPackages
+, hip
+, rocblas
+}:
+
+assert builtins.elem gpuBackend [ "none" "cuda" "rocm" ];
+
+stdenv.mkDerivation rec {
+  pname = "spla";
+  version = "1.5.5";
+
+  src = fetchFromGitHub {
+    owner = "eth-cscs";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-71QpwTsRogH+6Bik9DKwezl9SqwoLxQt4SZ7zw5X6DE=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/gpu_util/gpu_blas_api.hpp \
+      --replace '#include <rocblas.h>' '#include <rocblas/rocblas.h>'
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    gfortran
+  ];
+
+  buildInputs = [
+    blas
+  ]
+  ++ lib.optional (gpuBackend == "cuda") cudaPackages.cudatoolkit
+  ++ lib.optionals (gpuBackend == "rocm") [ hip rocblas rocblas ]
+  ++ lib.optional stdenv.isDarwin llvmPackages.openmp
+  ;
+
+  propagatedBuildInputs = [ mpi ];
+
+  cmakeFlags = [
+    "-DSPLA_OMP=ON"
+    "-DSPLA_FORTRAN=ON"
+    "-DSPLA_INSTALL=ON"
+    # Required due to broken CMake files
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ]
+  ++ lib.optional (gpuBackend == "cuda") "-DSPLA_GPU_BACKEND=CUDA"
+  ++ lib.optional (gpuBackend == "rocm") [ "-DSPLA_GPU_BACKEND=ROCM" ]
+  ;
+
+  meta = with lib; {
+    description = "Specialized Parallel Linear Algebra, providing distributed GEMM functionality for specific matrix distributions with optional GPU acceleration";
+    homepage = "https://github.com/eth-cscs/spla";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.sheepforce ];#
+  };
+}
--- a/pkgs/by-name/wa/waycheck/package.nix
+++ b/pkgs/by-name/wa/waycheck/package.nix
@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, qt6
+, wayland
+, glib
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "waycheck";
+  version = "0.1.3";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "serebit";
+    repo = "waycheck";
+    rev = "v${version}";
+    hash = "sha256-DbXc1Q/ZIqlIMocFld3fOmUp44rU3fEzazHKSDdqMNs=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    glib
+    wayland
+    qt6.qtwayland
+  ];
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  preInstall = ''
+    substituteInPlace ../scripts/mesonPostInstall.sh \
+      --replace "update-desktop-database -q" "update-desktop-database $out/share/applications"
+  '';
+
+  meta = with lib; {
+    description = "Simple GUI that displays the protocols implemented by a Wayland compositor";
+    homepage = "https://gitlab.freedesktop.org/serebit/waycheck";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ julienmalka ];
+    mainProgram = "waycheck";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "27.1.0";
+  version = "27.2.0";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1myr4w5k8fffyhm1h83vdp81zwxj9k6lcx78h3hw7wy1bgqlm3zs";
-  iosevka-aile = "15zyvl999agk28wjzh618x51h2vxdnifc757dwyx1pd734r9wi6g";
-  iosevka-curly = "196df0dd7k5rvslm4392jkfr8yxrs73i68nyacy85wf55k5g6m1y";
-  iosevka-curly-slab = "06xb4ziaq23qby6prglrn03nb9w3w52jqb15y4j8h4ybmgagvkmy";
-  iosevka-etoile = "1sbcdl0vg9d8cfq6wlb70kzl8bx9xj3bbm4rn3cig1b59z0w8ym1";
-  iosevka-slab = "0bpm891vg85lxqb8cwcmcp4rm2f1wrad5dkb03m1qq1c0b6b6jjf";
-  iosevka-ss01 = "0qwgy6wm3vxkv9vaj2wbxaaxc2ckxqng7kiay50lc9xcchv80x35";
-  iosevka-ss02 = "035yv4spyzbl4a93f8y6pr3aicw60f45haszzfkh779mj5h1dkj6";
-  iosevka-ss03 = "1ai3si44x62wkdyc6vc3wkg8p8j3xkyqnjnggck0cnhvbivwbhsl";
-  iosevka-ss04 = "1gyarinnnqz0a1aqigr70msvylf0dzpjbh7bp507iww8y03fzz15";
-  iosevka-ss05 = "04qrc22jx2j991xbfslfgs2h6mv4glmc54v1f6rsvjyi7skdxxxv";
-  iosevka-ss06 = "0mpi34sw1k06h24a7xrywhr998ch6sdvzb94jnlh18aq63nib6jc";
-  iosevka-ss07 = "0s79kv0dpj4ahci8zrrlnbyn46x2b9jq6gs1ji9xwfcll5bd3mbr";
-  iosevka-ss08 = "0l8y6f6m27msarhm10x11zg7fmcb04s5iby25q7bz4w6yd1c6wgl";
-  iosevka-ss09 = "093mv3d4al8clrdhdnklxygrx6gr2x7ha8qgwqm4460ma5b730ip";
-  iosevka-ss10 = "117ym1mr85y2pf8gnpfanysy8f5na1rvjpjarjzmngxagnq2afjc";
-  iosevka-ss11 = "1fmsqaf7ipl47c1h6b95fj28lq00qj1p6m1y4jnkrz00sxaxc127";
-  iosevka-ss12 = "1k79gdknyh6l3nyw77qznn9mlpr2i4zbjg9hl3pl0xarx3fzpmzj";
-  iosevka-ss13 = "1v8bgmlba3ccdhp53xmhv88zdw2pd14n0dxm7nac3mazd2z5m3yv";
-  iosevka-ss14 = "0h4ig5fjfgqn790pvnnc1zb07hd2dfn2353ripx9mdrzxaj0vnld";
-  iosevka-ss15 = "1l0p1k31xmqz460ra822ji3q120h607fjbbq93kr7xmliw0asw0d";
-  iosevka-ss16 = "1ywasxgnc8lw032799b6r0sx2csld3h5w1kjy72ck5ca1xfwq63n";
-  iosevka-ss17 = "11c23zrdf4i7vzgl82jnizxq2w9lilq66wv8pay61fyab5sw1m6f";
-  iosevka-ss18 = "0v3nccwcaqmcbkdrdpa3304jlz9vffwwny4gd6mq2rph66x2bmc3";
-  sgr-iosevka = "0ypw8nv1p7xp4y8ydgrj4h82y1rlnwd13q99p2sy5jar8wz9p4p5";
-  sgr-iosevka-aile = "1iycylvc59nkxddclwyj3kxfz34akrim2gibazbl9rp1m3slfpfs";
-  sgr-iosevka-curly = "107av6c3kisivx8b2xk3v9by0nhgc81ksg2fv90r6844q5w7fg3h";
-  sgr-iosevka-curly-slab = "18wvn3vgr1vdpd576c8hx0f7r9zgrcl9n4mpm3ghnrlnsy0gix10";
-  sgr-iosevka-etoile = "1d8hxi9v6svbzg6bbadwdg5883yx9vq0yidck9mq5ip20wcvj8ih";
-  sgr-iosevka-fixed = "01q7myzgagsi7d7ylm3iqq2wxcfci0dvz3ls9rwsj4pmnsslp9nm";
-  sgr-iosevka-fixed-curly = "147zn65ijx3j3fbbxhnf6byzr9p5p07nig9jdf5lgc9d7w0cp1am";
-  sgr-iosevka-fixed-curly-slab = "1gi9yinsa82cfsr9b1ik6jxwil46gg9zq98s2wbhq8kh7cs42zxd";
-  sgr-iosevka-fixed-slab = "1922l2g045icrrlyjm1w64kl9jvjlgb9100v7pc67q297943gzr7";
-  sgr-iosevka-fixed-ss01 = "1a0wgyvjqgwnd3q08w80g5zy0ll0i9dip7vkk5r1jjszbp479603";
-  sgr-iosevka-fixed-ss02 = "0nm8jcblzrx6s8kpp9bpza1np174rvm2n4d36mqyw8si4pc849vl";
-  sgr-iosevka-fixed-ss03 = "1c47427rg61751knpywyzfd4vgvsd8xjwhj0fc0qk33cdpz1cr3d";
-  sgr-iosevka-fixed-ss04 = "0g1yrgqzs5d3l7w45rjnmkfs31i8rmrw4fxpfi07i2hcnywaqgkh";
-  sgr-iosevka-fixed-ss05 = "1s9h0v552y7llxshph1kvj7kq7iav4qdf1cvjnjlryng02vdcs5v";
-  sgr-iosevka-fixed-ss06 = "1wj72dy96l23cb3qqqgki77pn50ik0jbqs1hwnppg8srqyamhqhn";
-  sgr-iosevka-fixed-ss07 = "16vl6amnrg8dwhy5snw5iwq7r0nil2v2v4jzd1wdddl6hccvhrdk";
-  sgr-iosevka-fixed-ss08 = "193wclg9v843s9x5vzpajr16icqbbrg8rlkfx2ihzh9aa1g55bv3";
-  sgr-iosevka-fixed-ss09 = "1pvkapfl7h33lfn3izi3lqgfhjp3rbf16m2y6ya45k0km7hgz8bq";
-  sgr-iosevka-fixed-ss10 = "13fymx8hq2v62r9vsj3zj2sn6ggxl8mv2r97qs6gmvgsd43fxsig";
-  sgr-iosevka-fixed-ss11 = "03qcpd8ivky9nymqdgxwgd7dcls1dcx06cd13sh3xr15l7vdb9d4";
-  sgr-iosevka-fixed-ss12 = "1vph7ih2wk22156zpy26yqpc9gk013n618kkm2an9304b8wd7cih";
-  sgr-iosevka-fixed-ss13 = "01f0d2r8wn1487xxsdk7ad5am81061vs9dhjs49h30jwmpd00mvp";
-  sgr-iosevka-fixed-ss14 = "05b9lk47dbnflycbpc1j0jzhwv4lp2f1yw367fpqkcqcfcnxs228";
-  sgr-iosevka-fixed-ss15 = "0k4ackysj8xi19akc3x8y1d9pbbvd176ypdf8w1gaj1fwqkz5832";
-  sgr-iosevka-fixed-ss16 = "0zymvh0d8457rdds6l69azrn8i9va89c4jqf608bsssgmy3l0y9s";
-  sgr-iosevka-fixed-ss17 = "0v9zx2kzkmqkc1s3x3f7sk4yqifd2bavpvc3561zijj63v9skg6m";
-  sgr-iosevka-fixed-ss18 = "0phm4nnl7pv9hvcz17xywypblg5zillg3qc46bfjrq16jssb9qpc";
-  sgr-iosevka-slab = "1z28ziqdnq8mvnnnrn0pwc7rb9fk56pkr9vv7p3l22baxwanh3jf";
-  sgr-iosevka-ss01 = "1g7nw05kyfsv51nkhhzxlw3g7qj8vqbp51rzp8mxwcv99vccw4ka";
-  sgr-iosevka-ss02 = "08gqr21xw3x1p1c14g498wa5zrxr1hhg5m4fg2xvd1ivxayd49zd";
-  sgr-iosevka-ss03 = "1rhj048lwcxqvz26r6adrixz5rajwpvbfkylyfb7pcr66l3n94dw";
-  sgr-iosevka-ss04 = "0sz49v8zzxhzh2ydpnmfr7ppqahggmxyvnx9mg6875071xppmh04";
-  sgr-iosevka-ss05 = "1p0m3gibykrhawvn00hs9lkdjdh1c539mly9jw1zpn48arphg43q";
-  sgr-iosevka-ss06 = "0d2jl1wfwh1w568s2m093vc3x5yfkl1sa9qwjsplwpw1wvsaa158";
-  sgr-iosevka-ss07 = "0f5kwq4714xb90hh435vn34ls8qp1j88lzh3ywj3cpjxzp9bba6h";
-  sgr-iosevka-ss08 = "1rd290bgymfsmkpvrifbx3nyf3b2gds2z7m2wx4a98zx5hpp6ls8";
-  sgr-iosevka-ss09 = "12g5caxxhnkqxmdm7ijv6ygsmfj0ddng3s7p8k3wi1af68834py9";
-  sgr-iosevka-ss10 = "1naj802hd06jm8zmfkx6cf6dkmi01pkrqmapfbnwk1pfkbvmrbmr";
-  sgr-iosevka-ss11 = "1cqa1n1axzskbb0s4vwz803lwzpzqzpz7ysfdmxgyv1pga42i5n9";
-  sgr-iosevka-ss12 = "02zmbivyys7r0iv53gqbsabdljcngls1603cf5f7z8shzdblrl6w";
-  sgr-iosevka-ss13 = "0jq656hbsviwx8amw3s5wrzpnwybm1cspkgm9xd98f4ml6gr56xc";
-  sgr-iosevka-ss14 = "031kfakyczs4ih53ahm18py63y3qjfiqp4qsvzhnp1clniymhr7m";
-  sgr-iosevka-ss15 = "04vafylka6wyjjrvgzslq80ixci8g2d12mfb1ybbxgvxwjg4pzik";
-  sgr-iosevka-ss16 = "1vcgip8hccw8xkzjfc84vvm4n44f7idxq8xrh5p8ib22gc06xywz";
-  sgr-iosevka-ss17 = "023ia9bhdzkhc0alaxfbfpa8yf8bvknx8lh1423m1c5mi39w7syp";
-  sgr-iosevka-ss18 = "1gdv9pnzgjx8c2sr5sab8cvgjzffw175m7kkf3naiak3i75c7jwy";
-  sgr-iosevka-term = "14w59fhcixj2c5vqf6f4wc9sqw3mmkyk1ccbnp9xjax78s244m1l";
-  sgr-iosevka-term-curly = "0z72k13gsz9ml2xjiy43jz9vi95xkhmjwsxsdzh20vcwlqq66g37";
-  sgr-iosevka-term-curly-slab = "0v4h0q4bgdz6xq1b2vw1hsr9gva0fb75aw7b1pbglb3rq6fyp4vg";
-  sgr-iosevka-term-slab = "06mipknr1458h3y5bz0dp054q04w2r8s4cal6k5ycszay6dczdxi";
-  sgr-iosevka-term-ss01 = "1b0qihkhws3lwzqfax980cz7y9ffffpd6haq18cvrgr75ncg5gjq";
-  sgr-iosevka-term-ss02 = "122q689n4wkl0xf1gshq3zg1dwnphc9aa2ywm3dfj6mp490hdqcf";
-  sgr-iosevka-term-ss03 = "0i79mdn2k2c5j1pi1f0mklwljavlk0wqm31haxfy9ijavzjlqcm4";
-  sgr-iosevka-term-ss04 = "0i27l711cjgraxqak3j6qb7ybh3yxzg3mrd62ffyi75wxllmzl6m";
-  sgr-iosevka-term-ss05 = "03h94k8lbxn2xxb8zcc4h30rgqhxiwxib59r56bl9hkjwi1gdlf9";
-  sgr-iosevka-term-ss06 = "0370xwf0iylarvib1k8pvxbkxkipjjp8gwc3nwc7dww95gb3aivy";
-  sgr-iosevka-term-ss07 = "1l8jwchfw1pllyq1lnifbv7pj51c20g20bx8lgz5x15d5f8ncwc3";
-  sgr-iosevka-term-ss08 = "1nz0l8krcwmd0236gb2w5z9kx1br8c909dw81aw9lhn085q654rm";
-  sgr-iosevka-term-ss09 = "0f0ag0zlrgiiwr3xhl9zm1vh83zrcxvkdc8blrxxcy4sphayl2c2";
-  sgr-iosevka-term-ss10 = "0dc6vjrsq8waq0s3f4rdqvlflvr6i3k7hgwx1lqs4kim3ia31naz";
-  sgr-iosevka-term-ss11 = "0yiq6v327xplrdfhfhk16xybk47514708dccsrs7cc4dczbcxpyb";
-  sgr-iosevka-term-ss12 = "0xf6psll8fzdyq5m6zw2b7iva2vfvc79hlkwbdm4gx513brq2d8b";
-  sgr-iosevka-term-ss13 = "15xbid484nvjlha5lhjajybzx590yskbf0639xmkpfsjm3nvkslj";
-  sgr-iosevka-term-ss14 = "1z6471b6c9j19i1cvnsvjsqiaskbff5ifijvqlc01y3xxqv8d7hq";
-  sgr-iosevka-term-ss15 = "00frjympyfawylvf377r16flsx3kgg3qgsixrl82f1p4m4jrg83j";
-  sgr-iosevka-term-ss16 = "0wrjcawdkdnxhgapzgfzyhsjv6qz524cykb8j8b1dl146ii7ni6j";
-  sgr-iosevka-term-ss17 = "1b06givsr24hv3710faszlvn40cbvc04n4yx2f9yga2xzmibr8rk";
-  sgr-iosevka-term-ss18 = "0lqkayq0am28rc7433b965zzqjimcd68vhwy5m8p4ayrkfz0hbm8";
+  iosevka = "1jn883s4vvpfih31yxap2hg6xya9jfjnqa8f7iqkqyxxqrnx7zzm";
+  iosevka-aile = "1p2s5nslifmdbjbqqlk02kl0rvpmr5pkq71hr9xim2dqb11kmcdl";
+  iosevka-curly = "0rs7jmgpl1ki7b9i3l78fn63xbgd02wraixqb1yjc3lmxi9jbhxn";
+  iosevka-curly-slab = "09rf82w41fbw7pm1ak9vv1i9450h2ia7x434gn9czx01wnb3s2zb";
+  iosevka-etoile = "1621a74z378rz4l1gn9dr7fqqvnd1g7ipr5bw13qhwl5ljf170xs";
+  iosevka-slab = "06x3hbi05bzlaci7hr3wk8j92zn97i41bw8xjnj8sh63mla36w9p";
+  iosevka-ss01 = "1plp7lk9yzizfz9c5k4m51ynvp0zkz7r7vgx416rkwb3yh23fjpv";
+  iosevka-ss02 = "0zpl9a8nccnrywaxj61glj4x7ai1fas9x463xqpy38w686n0jjyn";
+  iosevka-ss03 = "1xrxvsj2ja9miwvgq7p6kxysn8858gk8qh2pp1bw1n67vppvhkp9";
+  iosevka-ss04 = "1y0ac2dq8xmrbw84nar2jsxbyf9nck8fxh3dbl8vhvpnbwan150w";
+  iosevka-ss05 = "1z722m5chr8jq24i7czph1qgkasah7y7i4wv2wv0n2j89mc2fbc2";
+  iosevka-ss06 = "1fzsj9389cah6zp23vlr375j107jxfabqxaa7iv1hjbw3fa2vmdk";
+  iosevka-ss07 = "18psmz6kfhdmpac408w1fsqfarahn60bypm8ci8y3gd8bk8js13c";
+  iosevka-ss08 = "0hjlrly98hd4w5l6cm361h4cyvkdrlf3bp1g6f438aip0bj2y94w";
+  iosevka-ss09 = "13jdlmamfbxnkqii6bkh0xm71fgqdvgnqs88dnq8pjyqhbl32sca";
+  iosevka-ss10 = "15ak510q6di9hsy2p8k7gkp5d1kzgrmk2m55zh90w5irbr5fmbjp";
+  iosevka-ss11 = "0x42pjik0iy2v11iq8i83wa88f6b6qymc3v2sih28rjhijxl7lsm";
+  iosevka-ss12 = "15s7imcm4w61555crah1pxzc9yn3zffkj13zk8zidgk6v7jzb6rs";
+  iosevka-ss13 = "1q3d3fyjsk6iwq1w6dv9rc7ivk021i3v2px574dfbqlswvb2sg86";
+  iosevka-ss14 = "0r1fkrcqcccx4zz9qgzgq9si8xcbn7y1f2821cjs6cbfaxmrkwmc";
+  iosevka-ss15 = "0vgwgkfnch5rn7kc9rblg1km4pzqwsglb31zqnx3rxhszm66j9q6";
+  iosevka-ss16 = "009whnydn5rb6dj06scnc3722y8sddsv4jl42r70x2zzra14qdgk";
+  iosevka-ss17 = "01j1gqrmlx3b6rlv6sg3kv9j39s2dwqvj35h4v0v7min2vn1hydj";
+  iosevka-ss18 = "1pbwqgrkv560237marp5msq1y93llxvjrpixka15a79a7lmpd36i";
+  sgr-iosevka = "0p31qdby1znrsz4hplrq81ngv1l2pxbn9x26hcpjxrbgv2mmvhfq";
+  sgr-iosevka-aile = "00zapw8mk0z40jw69ynvdzhpd67rvi9lp509hf3vb7x3cq1ka1wz";
+  sgr-iosevka-curly = "1rgxkc2ps8pmp3mgi2b51lv4j5cc5q7m6iizw8gbfl36qmzlfdlh";
+  sgr-iosevka-curly-slab = "1fdxr0mkb40fa0605i8b8h51pg8p3cskjsggil9gp1376wzhr42q";
+  sgr-iosevka-etoile = "1r91042avgn0f0p2rf09pam4wfjndkj7wml9vs082kc40aqgh9m5";
+  sgr-iosevka-fixed = "13b5nkyxpm9izj0dmwc97lqbfvbxqyjg3677hpi6ywl3c6m1h542";
+  sgr-iosevka-fixed-curly = "06r0lzcrhf9897yi9h6xh5n1mfb8j4v21nz81igs616w7gjlz0dk";
+  sgr-iosevka-fixed-curly-slab = "1l9qaialwq2xygznylbwkizbqwghzl4625d845f8kwyl9krd92na";
+  sgr-iosevka-fixed-slab = "199s1cdn22rjirrh1f9xhqbh77namriw077g11hykr4ibwy6sc6n";
+  sgr-iosevka-fixed-ss01 = "1y51qk0pfq9r8hpcgmcykrvddl8rw5rjfysrbsjvf6zi59z5rk02";
+  sgr-iosevka-fixed-ss02 = "12x3qrw6baxfwbj2wgawf9qpbk8nv7ccd9grqgw7b4qmy5j31n39";
+  sgr-iosevka-fixed-ss03 = "1sf8xybh8l76dbm8vgk0y4lgdm5lb5pb4kgnipygqj9z0kasj07d";
+  sgr-iosevka-fixed-ss04 = "0pbpqnv6kdnnl4yix3ysfrnxg3ainsl9m0pnkb1i21q5sav20ph5";
+  sgr-iosevka-fixed-ss05 = "1vgfiqxwfg3m68dlk4s1x5ms293nbwgdq34y80hysp8pfzl7d07z";
+  sgr-iosevka-fixed-ss06 = "17f3rxsh2nla6a8fhim88vxqj1kzafvcfbara1iwzsw3fw9gz2ai";
+  sgr-iosevka-fixed-ss07 = "1j3r197jx51b7l5cpm2g5b7mzq53wp05f8ra3cz04r69qc0dj8i5";
+  sgr-iosevka-fixed-ss08 = "1gj784bi4wy0282xbq3f24sqlm7b2s1gz2f8sna4bd5bgci8avb7";
+  sgr-iosevka-fixed-ss09 = "0hhqvghq0mxbjzfhfcjgij94b40129vhg6x4slgk579kdfmr21y4";
+  sgr-iosevka-fixed-ss10 = "044dam3cg2s29j0zbq03ypyyskws31dfvyyp01smds7njf8f2w39";
+  sgr-iosevka-fixed-ss11 = "1xxmcai145rfjhlx4n5hcs7kdz298pxn9b3if85cpmdd9qhdmy48";
+  sgr-iosevka-fixed-ss12 = "13rbsql91z2ndbx121j1yb3m10a2fwil0jilhfjj17rn0kh0a5qi";
+  sgr-iosevka-fixed-ss13 = "19y6x2jln772afqy7y2k97kzpin73y5wq72fh7c9n9cmh1n24628";
+  sgr-iosevka-fixed-ss14 = "0ndm0yk95a10qv95c9d5qhjx4vzc28wkahlxjadndxh82hn8zlqm";
+  sgr-iosevka-fixed-ss15 = "107lwn4d01hry6jyk2blxdy7gx80ka6wrgxs80l5czx4jsk6kr66";
+  sgr-iosevka-fixed-ss16 = "0ka5rp7svqp5hs2zdf0bq5lfhgfmqij93f53q1a0snispx1qnsn6";
+  sgr-iosevka-fixed-ss17 = "18kvws3r66b1lqqpyphpf1nk6qdv6pv9c36zf0kpi7hpfcp1dvaa";
+  sgr-iosevka-fixed-ss18 = "1s9gzh2ghs66rjjz7317x163072gy2fxbqmvhghngd7bpvbajdd6";
+  sgr-iosevka-slab = "0b78y7pikcrlilzn2xlvg5f7liqp0zvzcknx9l47nh32sqn11f5j";
+  sgr-iosevka-ss01 = "1nrj6dl3znakj3h0fvd37k71gcp2l0yfgqggdn6ms4cyyrq16z38";
+  sgr-iosevka-ss02 = "0mhn1jx2ibllp8h05lm9ms8wh960yyncblx4pkj95sswm5kdv8vv";
+  sgr-iosevka-ss03 = "0xxanqcpqh5fvhfad6cyk89yr2nza9lpig6dralizi8b1vxl7bnl";
+  sgr-iosevka-ss04 = "1566hvq2lwnh6p7v55j8khi56y61cg88g7vnb306a0rakg5jv17y";
+  sgr-iosevka-ss05 = "111pwbwp8fkiph6mrzblbx1nzdnzv9d6aphmkxlmrf1cs19jv71k";
+  sgr-iosevka-ss06 = "0p57cqqfhyhri2r1ss8pcd2hdn4pvp0dwr8ls1iws5gaj2s5zbjx";
+  sgr-iosevka-ss07 = "0clchkildx4vmk4xpd3xjx0xbihfkn61pcha00md4qf471ysnpmp";
+  sgr-iosevka-ss08 = "17ici8in0sh2zy1ya9319k9qqjzg5nl7ky6mbb2skpgmh85figfp";
+  sgr-iosevka-ss09 = "0fcwxcvzpc9l5dvmkqxf1g32xr4fk5rr389d6s3qbkdxdlc2vx63";
+  sgr-iosevka-ss10 = "1d59vw8caj9nlpmfijwpgkbb6kxphgdrw2hd5ldcvxs0ny0r8fcd";
+  sgr-iosevka-ss11 = "0d60zpdq7n73cn0lgnwhddxzw3x0i2cpqwpc1k78s8r8h36qmd05";
+  sgr-iosevka-ss12 = "15sc20f2kf6i0wlcfy60ss2j6dyg6figd18g22zmm7msz2lda1b0";
+  sgr-iosevka-ss13 = "0qi8ala5dm3r9gljwf5i84624h6arasd9mhww8nk3822cx8c8jd0";
+  sgr-iosevka-ss14 = "0i9p2rz8ppwl6x9d2j4gry7l386nbv4g2jrrna6bwgk4nh12izg0";
+  sgr-iosevka-ss15 = "0d4s197v96ka5c4b63kisiy8j694vskspc5vry4bgj4pbl7vl6lg";
+  sgr-iosevka-ss16 = "1a02r483ihfnlzx0kir6p84q6bscrs798i5qaw7qiz3zi8kxdrgb";
+  sgr-iosevka-ss17 = "1hi7dikls7x5zn79waki77bcp4w5hzx12mqmh0zx77aah3ghcax1";
+  sgr-iosevka-ss18 = "1mkjyn5mjnlwrxfhxr1f3ja2fd6lbv54fxx0xy9zm1banz0pp3y1";
+  sgr-iosevka-term = "0cmycg6vygxi3c1pdqddmh8mqpcrnkmn9y5c8xjzd1lygm41668q";
+  sgr-iosevka-term-curly = "1q7r3qclmkniin8hx8digwk1rfgfcm4jz6mvjay5sfi5wa6g9fd0";
+  sgr-iosevka-term-curly-slab = "07bf92s5zf9vny3560dr8zwxdg1jpdvz5ksmqcm74ib1024yk17r";
+  sgr-iosevka-term-slab = "1am42m5jggfy0fv3580rsksklaiq8827da1s20ngiyxfzcgbgwf3";
+  sgr-iosevka-term-ss01 = "09igqk8b4hmgmh1q1idvcjpz0vj15yzrsmcqhyrs1ygxyl2d6g5v";
+  sgr-iosevka-term-ss02 = "143czw61bilpim4lqqzp9d2gz4igijyl2p87iy3f5pvh75qzk8fx";
+  sgr-iosevka-term-ss03 = "02s7dsjxsm6dgp2rcz6n9dyi6priz9k5q5wd1rajfs6rgb01j1h7";
+  sgr-iosevka-term-ss04 = "10paacm4gb0823pqacj1ps8s79k6zbayrqqqnhvklkqki2iiay4g";
+  sgr-iosevka-term-ss05 = "0nn49fgxciwpfddcksb5krhvyqbr2zfx2zq1m5nswb70nzwwk8sj";
+  sgr-iosevka-term-ss06 = "1r6xlbf9si5ycg96av2pjjak82qgj1sqdq634wkl41x4mj39zkjl";
+  sgr-iosevka-term-ss07 = "1sfjv2ggqrgxjqykgycia62xa2g523yf61gix9dp79gyg6ga25nr";
+  sgr-iosevka-term-ss08 = "0rk66nzjc4d7bjx9sfgnlzsx52mdrdmgl4xri6jd0ad3543j43bh";
+  sgr-iosevka-term-ss09 = "0y12s0ynb5fda8kprwlbw6a9kkb7fwjfna2axgz5rxlz0ja14gs1";
+  sgr-iosevka-term-ss10 = "0hy31v083cd9lcb7xfvh6lj4nvzlqkbm8lni092sp21iv43xpp4f";
+  sgr-iosevka-term-ss11 = "0wb1c4l8327vsnkpj34grplw1v1mlr3wdavi7i0z5383qx4l3cn0";
+  sgr-iosevka-term-ss12 = "0x8zgm1yl37ij1hq6bcdf0whfbyv4gdkqk94yi3xm74a744pzsvx";
+  sgr-iosevka-term-ss13 = "1ia9q4gn9a6mr0n4vb6d8mnnp9s6l5v5y4fgi6ip0g49n0n8fw4r";
+  sgr-iosevka-term-ss14 = "0ipfjn23jaz6xjb0v2pbirrvi18czir6nijh79kxrrs1k83mc4yq";
+  sgr-iosevka-term-ss15 = "0pdlsd8qsp80y5rgp3vrhl1wjbj4b3bgqyavz1ayqccg939dvzqv";
+  sgr-iosevka-term-ss16 = "0bz3i0cnijq84skhsjgy0p6p6ww364gnkrny1hgcw7w21d69n2x5";
+  sgr-iosevka-term-ss17 = "1sfpaqviv1gqz4c29kmrm1v3zbr3615w90w96s5yxh2lr6zqxi7v";
+  sgr-iosevka-term-ss18 = "02f7i400qk9pbyid4dr6p690sqphz52pvgprqp54q1lw07jksqa6";
 }
--- a/pkgs/data/fonts/last-resort/default.nix
+++ b/pkgs/data/fonts/last-resort/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "last-resort";
-  version = "15.000";
+  version = "15.100";

  src = fetchurl {
    url = "https://github.com/unicode-org/last-resort-font/releases/download/${version}/LastResortHE-Regular.ttf";
-    hash = "sha256-Qyo/tuBvBHnG/LW8sUAy62xpeqlXfyfwjUCbr4vJEag=";
+    hash = "sha256-dPk6j7Orh1bg6GyzwsB4P9oQvepvl51YF4abpyhOVso=";
  };

  dontUnpack = true;
--- a/pkgs/data/themes/yaru/default.nix
+++ b/pkgs/data/themes/yaru/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "yaru";
-  version = "23.04.4";
+  version = "23.10.0";

  src = fetchFromGitHub {
    owner = "ubuntu";
    repo = "yaru";
    rev = version;
-    hash = "sha256-8MtRYNJJVhZzE5Ds1HSk+Ej3FUD/z2hGZAsuCeGzWb4=";
+    hash = "sha256-+Szk77QeoM4PwusxKflTh83h16qz6Es6UwDXpbydJUE=";
  };

  nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];
--- a/pkgs/desktops/gnome/misc/pomodoro/default.nix
+++ b/pkgs/desktops/gnome/misc/pomodoro/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-pomodoro";
-  version = "0.23.1";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    hash = "sha256-0ZUTRrth5AfzI1E4JsuchbYeFwAbl9/XGBSYQ+AnNvM=";
+    hash = "sha256-Yn0lDCFpc8o25iiPib1n1NEBeodNAdTzRWcnLbXUA5g=";
  };

  patches = [
--- a/pkgs/development/compilers/gnostic/default.nix
+++ b/pkgs/development/compilers/gnostic/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "gnostic";
-  version = "0.6.8";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "google";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-+/KZmwVV3pnbv3JNwNk9Q2gcTyDxV1tgsDzW5IYnnds=";
+    hash = "sha256-Wpe+rK4XMfMZYhR1xTEr0nsEjRGkSDA7aiLeBbGcRpA=";
  };

-  vendorHash = "sha256-OoI1/OPBgAy4AysPPSCXGmf0S4opzxO7ZrwBsQYImwU=";
+  vendorHash = "sha256-Wyv5czvD3IwE236vlAdq8I/DnhPXxdbwZtUhun+97x4=";

  # some tests are broken and others require network access
  doCheck = false;
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -195,25 +195,22 @@ let
        if parsed.cpu.significantByte.name == "littleEndian" then "arm" else "armeb"
      else if isx86_32 then "i386"
      else parsed.cpu.name;
-    # Python doesn't distinguish musl and glibc and always prefixes with "gnu"
-    gnuAbiName = replaceStrings [ "musl" ] [ "gnu" ] parsed.abi.name;
-    pythonAbiName =
-      # python's build doesn't support every gnu<extension>, and doesn't
-      # differentiate between musl and glibc, so we list those supported in
-      # here:
+
+    pythonAbiName = let
+      # python's build doesn't match the nixpkgs abi in some cases.
      # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L724
-      # Note: this is an approximation, as it doesn't take into account the CPU
-      # family, or the nixpkgs abi naming conventions.
-      if elem gnuAbiName [
-        "gnux32"
-        "gnueabihf"
-        "gnueabi"
-        "gnuabin32"
-        "gnuabi64"
-        "gnuspe"
-      ]
-      then gnuAbiName
-      else "gnu";
+      nixpkgsPythonAbiMappings = {
+        "gnuabielfv2" = "gnu";
+        "muslabielfv2" = "musl";
+      };
+      pythonAbi = nixpkgsPythonAbiMappings.${parsed.abi.name} or parsed.abi.name;
+    in
+      # Python <3.11 doesn't distinguish musl and glibc and always prefixes with "gnu"
+      if lib.versionOlder version "3.11" then
+        replaceStrings [ "musl" ] [ "gnu" ] pythonAbi
+      else
+        pythonAbi;
+
    multiarch =
      if isDarwin then "darwin"
      else if isWindows then ""
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "armadillo";
-  version = "12.6.0";
+  version = "12.6.4";

  src = fetchurl {
    url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    hash = "sha256-tBAqOEeRrxbZ5fuzBvEf41ar+8oKfXynq7yaipRmECo=";
+    hash = "sha256-638kP/wy8YMkvH+peNA1hjfnNXyng2vsVbTrVul0k4A=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "enchant";
-  version = "2.6.0";
+  version = "2.6.1";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-M1fqk6F0T/vNcwIjzINmE11A/1mIGuBZHVHT7o/5rm8=";
+    hash = "sha256-8k4SRpE3rh0DFAu5AypHpZR8NvTR4vErkpBhAF6xUnk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/hax11/default.nix
+++ b/pkgs/development/libraries/hax11/default.nix
@ -9,13 +9,13 @@

 multiStdenv.mkDerivation (finalAttrs: {
  pname = "hax11";
-  version = "unstable-2022-12-10";
+  version = "unstable-2023-09-25";

  src = fetchFromGitHub {
    owner = "CyberShadow";
    repo = "hax11";
-    rev = "dce456f2b209f1be18d91064be257b66b69b7d9f";
-    hash = "sha256-e3jYvbglQ5Nzoz/B+WEkCw48Tu+i73t+PNq51mjzmjY=";
+    rev = "2ea9d469785bbe0338729c4deeb902a259fd7b10";
+    hash = "sha256-bYuIngZ76m5IgbbTFTZ8LJmpHl4nHS272Ci1B9eJIws=";
  };

  outputs = [ "out" "doc" ];
--- a/pkgs/development/libraries/httplib/default.nix
+++ b/pkgs/development/libraries/httplib/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "httplib";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "yhirose";
    repo = "cpp-httplib";
    rev = "v${version}";
-    hash = "sha256-NtjgK/8XApEs4iSo9DzyK4Cc/FQJRAEwCwJbD24FP34=";
+    hash = "sha256-JBs2FvcdAvxysYhzakP0wU/mUCWfKZ8dk5ROWL5sej0=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/kde-frameworks/kio/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/kio/default.nix
@ -26,6 +26,7 @@ mkDerivation {
    kded
  ];
  outputs = [ "out" "dev" ];
+  separateDebugInfo = true;
  patches = [
    ./0001-Remove-impure-smbd-search-path.patch

@ -35,4 +36,7 @@ mkDerivation {
      hash = "sha256-4NxI2mD/TdthvrzgatCAlM6VN3N38i3IJUHh0Bs8Fjk=";
    })
 ];
+  meta = {
+    homepage = "https://api.kde.org/frameworks/kio/html/";
+  };
 }
--- a/pkgs/development/libraries/libayatana-common/default.nix
+++ b/pkgs/development/libraries/libayatana-common/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libayatana-common";
-  version = "0.9.8";
+  version = "0.9.9";

  src = fetchFromGitHub {
    owner = "AyatanaIndicators";
    repo = "libayatana-common";
    rev = finalAttrs.version;
-    hash = "sha256-5cHFjBQ3NgNaoprPrFytnrwBRL7gDG7QZLWomgGBJMg=";
+    hash = "sha256-IBLJPgi+dKZKbR0Yjr2aNjCdpY+PE1k9QLSsk++6Wqo=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/libcef/default.nix
+++ b/pkgs/development/libraries/libcef/default.nix
@ -66,16 +66,16 @@ let
      projectArch = "x86_64";
    };
  };
-  platforms."aarch64-linux".sha256 = "0c034h0hcsff4qmibizjn2ik5pq1jb4p6f0a4k6nrkank9m0x7ap";
-  platforms."x86_64-linux".sha256 = "02pj4dgfswpaglxkmbd9970znixlv82wna4xxhwjh7i5ps24a0n6";
+  platforms."aarch64-linux".sha256 = "12sp58nxa3nv800badv62vpvc30hyb0ykywdaxgv9y8pswp9lq0z";
+  platforms."x86_64-linux".sha256 = "0vzzwq1k6bv9d209yg3samvfnfwj7s58y9r3p3pd98wxa9iyzf4j";

  platformInfo = builtins.getAttr stdenv.targetPlatform.system platforms;
 in
 stdenv.mkDerivation rec {
  pname = "cef-binary";
-  version = "117.1.5";
-  gitRevision = "f1b94ea";
-  chromiumVersion = "117.0.5938.132";
+  version = "117.2.4";
+  gitRevision = "5053a95";
+  chromiumVersion = "117.0.5938.150";

  src = fetchurl {
    url = "https://cef-builds.spotifycdn.com/cef_binary_${version}+g${gitRevision}+chromium-${chromiumVersion}_${platformInfo.platformStr}_minimal.tar.bz2";
--- a/pkgs/development/libraries/science/chemistry/tblite/python.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/python.nix
@ -47,12 +47,5 @@ buildPythonPackage {

  format = "other";
  pythonImportsCheck = [ "tblite" "tblite.interface" ];
-  configurePhase = ''
-    runHook preConfigure
-
-    meson setup build -Dpython=true --prefix=$out
-    cd build
-
-    runHook postConfigure
-  '';
+  mesonFlags = [ "-Dpython=true" ];
 }
--- a/pkgs/development/php-packages/meminfo/default.nix
+++ b/pkgs/development/php-packages/meminfo/default.nix
@ -0,0 +1,22 @@
+{ buildPecl, lib, fetchFromGitHub }:
+
+buildPecl rec {
+  version = "unstable-2022-03-25";
+  pname = "meminfo";
+
+  src = fetchFromGitHub {
+    owner = "BitOne";
+    repo = "php-meminfo";
+    rev = "0ab7f5aea96c4dafce27c7e215b4907db2a2f493";
+    hash = "sha256-MO+B+ZNg6OAnxkOtdA15o+G41XbsG1N1WBz7thMCjck=";
+  };
+
+  sourceRoot = "${src.name}/extension";
+
+  meta = {
+    description = "PHP extension to get insight about memory usage";
+    homepage = "https://github.com/BitOne/php-meminfo";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@ -1,32 +1,20 @@
-{ mkDerivation, fetchurl, makeWrapper, lib, php }:
+{ fetchFromGitHub, lib, php }:

-let
+php.buildComposerProject (finalAttrs: {
  pname = "phpstan";
  version = "1.10.37";
-in
-mkDerivation {
-  inherit pname version;

-  src = fetchurl {
-    url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "sha256-i1h3N11MsKhHx/RJxAthnUbjacA5yZJF6bzmQnmEKzg=";
+  src = fetchFromGitHub {
+    owner = "phpstan";
+    repo = "phpstan-src";
+    rev = finalAttrs.version;
+    hash = "sha256-y55bfwE3H/oDCwDq3wrClyX8dhk0p6vEl/CMhqN6LkA=";
  };

-  dontUnpack = true;
+  vendorHash = "sha256-hjCfrmpn2rYgApenZkHX8fXqPXukh7BVKENkvwIk8Dk=";

-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    install -D $src $out/libexec/phpstan/phpstan.phar
-    makeWrapper ${php}/bin/php $out/bin/phpstan \
-      --add-flags "$out/libexec/phpstan/phpstan.phar"
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    changelog = "https://github.com/phpstan/phpstan/releases/tag/${version}";
+  meta = {
+    changelog = "https://github.com/phpstan/phpstan/releases/tag/${finalAttrs.version}";
    description = "PHP Static Analysis Tool";
    longDescription = ''
      PHPStan focuses on finding errors in your code without actually
@ -35,8 +23,8 @@ mkDerivation {
      sense that the correctness of each line of the code can be checked
      before you run the actual line.
    '';
-    license = licenses.mit;
+    license = lib.licenses.mit;
    homepage = "https://github.com/phpstan/phpstan";
-    maintainers = teams.php.members;
+    maintainers = lib.teams.php.members;
  };
-}
+})
--- a/pkgs/development/php-packages/psalm/composer.lock
+++ b/pkgs/development/php-packages/psalm/composer.lock
--- a/pkgs/development/php-packages/psalm/default.nix
+++ b/pkgs/development/php-packages/psalm/default.nix
@ -1,35 +1,25 @@
-{ mkDerivation, fetchurl, makeWrapper, lib, php }:
+{ lib, fetchgit, php }:

-let
+php.buildComposerProject (finalAttrs: {
  pname = "psalm";
  version = "5.15.0";
-in
-mkDerivation {
-  inherit pname version;

-  src = fetchurl {
-    url = "https://github.com/vimeo/psalm/releases/download/${version}/psalm.phar";
-    sha256 = "sha256-eAvogKsnvXMNUZHh44RPHpd0iMqEY9fzqJvXPT7SE1A=";
+  src = fetchgit {
+    url = "https://github.com/vimeo/psalm.git";
+    rev = finalAttrs.version;
+    hash = "sha256-rRExT82+IwgVo7pL3rrTjW/qj/MJf4m4L3PywaeSHYU=";
  };

-  dontUnpack = true;
+  # TODO: Open a PR against https://github.com/vimeo/psalm
+  # Missing `composer.lock` from the repository.
+  composerLock = ./composer.lock;
+  vendorHash = "sha256-Vho1ri/Qm2SYeXB9ZoXvH1vB/eSBwHnAT/pI4jjUYhU=";

-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    install -D $src $out/libexec/psalm/psalm.phar
-    makeWrapper ${php}/bin/php $out/bin/psalm \
-      --add-flags "$out/libexec/psalm/psalm.phar"
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    changelog = "https://github.com/vimeo/psalm/releases/tag/${version}";
+  meta = {
+    changelog = "https://github.com/vimeo/psalm/releases/tag/${finalAttrs.version}";
    description = "A static analysis tool for finding errors in PHP applications";
-    license = licenses.mit;
    homepage = "https://github.com/vimeo/psalm";
-    maintainers = teams.php.members;
+    license = lib.licenses.mit;
+    maintainers = lib.teams.php.members;
  };
-}
+})
--- a/pkgs/development/python-modules/deep_merge/default.nix
+++ b/pkgs/development/python-modules/deep_merge/default.nix
@ -1,24 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, nose }:
-
-buildPythonPackage rec {
-  pname = "deep_merge";
-  version = "0.0.4";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "tUQV+Qk0xC4zQRTihky01OczWzStOW41rYYQyWBlpH4=";
-  };
-
-  nativeCheckInputs = [
-    nose
-  ];
-
-  doCheck = false;
-
-  meta = with lib; {
-    description = "This library contains a simple utility for deep-merging dictionaries and the data structures they contain";
-    homepage = "https://github.com/halfak/deep_merge";
-    license = licenses.mit;
-    maintainers = [ maintainers.anhdle14 ];
-  };
-}
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "hahomematic";
-  version = "2023.10.4";
+  version = "2023.10.6";
  format = "pyproject";

  disabled = pythonOlder "3.11";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "danielperna84";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-SDkwKJVymWpl65TGVWpZL0KQhMdnjTLyOR+G3nyRWw0=";
+    hash = "sha256-uNf98q4x1usoYWvbDKt2yuTObyUjGgy7aK+VRrpM8wI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/mando/default.nix
+++ b/pkgs/development/python-modules/mando/default.nix
@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+# Python deps
+, six
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "mando";
+  version = "0.7.1";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rubik";
+    repo = "mando";
+    rev = "v${version}";
+    hash = "sha256-Ylrrfo57jqGuWEqCa5RyTT9AagBpUvAfviHkyJPFv08=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  propagatedBuildInputs = [
+    six
+  ];
+
+  pythonImportsCheck = [
+    "mando"
+  ];
+
+  meta = with lib; {
+    description = "Create Python CLI apps with little to no effort at all";
+    homepage = "https://mando.readthedocs.org";
+    changelog = "https://github.com/rubik/mando/blob/v${version}/CHANGELOG";
+    license = licenses.mit;
+    maintainers = with maintainers; [ t4ccer ];
+  };
+}
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "meshtastic";
-  version = "2.2.8";
+  version = "2.2.9";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = "meshtastic";
    repo = "Meshtastic-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-2VkxKeoRgBCmA59XZT8wlrzvnJ6k2Q2ZLM72TB1atEw=";
+    hash = "sha256-VHL5wxq9Ckczur5jmmsYzOnQhLwCXftR8rmBGQ80gOo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pypiserver/default.nix
+++ b/pkgs/development/python-modules/pypiserver/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "pypiserver";
-  version = "1.5.2";
+  version = "2.0.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-jub+iVL/YeGaG9Vzqyyfc4qFi0cR+7xrzuXNHL5W4p4=";
+    hash = "sha256-Eh/3URt7pcJhoDDLRP8iHyjlPsE5E9M/0Hixqi5YNdg=";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More