Merge staging-next into staging

2024-10-07 13:09:27 +03:00 · 2024-03-02 06:01:23 +00:00 · 2024-03-02 06:01:23 +00:00 · 9a49f37e07
commit 9a49f37e07
parent 1e2a9a6cd9 9819563ca9
262 changed files with 2693 additions and 984 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -10842,6 +10842,15 @@
    githubId = 77865363;
    name = "Leonid Belyaev";
  };
+  leonm1 = {
+    github = "leonm1";
+    githubId = 32306579;
+    keys = [{
+      fingerprint = "C12D F14B DC9D 64E1 44C3  4D8A 755C DA4E 5923 416A";
+    }];
+    matrix = "@mattleon:matrix.org";
+    name = "Matt Leon";
+  };
  leshainc = {
    email = "leshainc@fomalhaut.me";
    github = "LeshaInc";
@ -11709,6 +11718,12 @@
    githubId = 1780588;
    name = "Malte Poll";
  };
+  maltejanz = {
+    email = "service.malte.j@protonmail.com";
+    github = "MalteJanz";
+    githubId = 18661391;
+    name = "Malte Janz";
+  };
  malte-v = {
    email = "nixpkgs@mal.tc";
    github = "malte-v";
@ -16589,6 +16604,11 @@
      fingerprint = "1401 1B63 393D 16C1 AA9C  C521 8526 B757 4A53 6236";
    }];
  };
+  rosehobgoblin = {
+    name = "J. L. Bowden";
+    github = "rosehobgoblin";
+    githubId = 84164410;
+  };
  rossabaker = {
    name = "Ross A. Baker";
    email = "ross@rossabaker.com";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -78,9 +78,15 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [hebbot](https://github.com/haecker-felix/hebbot), a Matrix bot to generate "This Week in X" like blog posts. Available as [services.hebbot](#opt-services.hebbot.enable).

+- [Python Matter Server](https://github.com/home-assistant-libs/python-matter-server), a
+  Matter Controller Server exposing websocket connections for use with other services, notably Home Assistant.
+  Available as [services.matter-server](#opt-services.matter-server.enable)
+
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
 The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server softwares.

+- [transfer-sh](https://github.com/dutchcoders/transfer.sh), a tool that supports easy and fast file sharing from the command-line. Available as [services.transfer-sh](#opt-services.transfer-sh.enable).
+
 - [Suwayomi Server](https://github.com/Suwayomi/Suwayomi-Server), a free and open source manga reader server that runs extensions built for [Tachiyomi](https://tachiyomi.org). Available as [services.suwayomi-server](#opt-services.suwayomi-server.enable).

 - [ping_exporter](https://github.com/czerwonk/ping_exporter), a Prometheus exporter for ICMP echo requests. Available as [services.prometheus.exporters.ping](#opt-services.prometheus.exporters.ping.enable).
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@ -609,6 +609,13 @@ let format' = format; in let
        ''}

        # Set up core system link, bootloader (sd-boot, GRUB, uboot, etc.), etc.
+
+        # NOTE: systemd-boot-builder.py calls nix-env --list-generations which
+        # clobbers $HOME/.nix-defexpr/channels/nixos This would cause a  folder
+        # /homeless-shelter to show up in the final image which  in turn breaks
+        # nix builds in the target image if sandboxing is turned off (through
+        # __noChroot for example).
+        export HOME=$TMPDIR
        NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root $mountPoint -- /nix/var/nix/profiles/system/bin/switch-to-configuration boot

        # The above scripts will generate a random machine-id and we don't want to bake a single ID into all our images
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@ -14,6 +14,25 @@ let
    types
    ;

+  inherit (hostPkgs) hostPlatform;
+
+  guestSystem =
+    if hostPlatform.isLinux
+    then hostPlatform.system
+    else
+      let
+        hostToGuest = {
+          "x86_64-darwin" = "x86_64-linux";
+          "aarch64-darwin" = "aarch64-linux";
+        };
+
+        supportedHosts = lib.concatStringsSep ", " (lib.attrNames hostToGuest);
+
+        message =
+          "NixOS Test: don't know which VM guest system to pair with VM host system: ${hostPlatform.system}. Perhaps you intended to run the tests on a Linux host, or one of the following systems that may run NixOS tests: ${supportedHosts}";
+      in
+        hostToGuest.${hostPlatform.system} or (throw message);
+
  baseOS =
    import ../eval-config.nix {
      inherit lib;
@ -27,13 +46,14 @@ let
          ({ config, ... }:
            {
              virtualisation.qemu.package = testModuleArgs.config.qemu.package;
+              virtualisation.host.pkgs = hostPkgs;
            })
          ({ options, ... }: {
            key = "nodes.nix-pkgs";
            config = optionalAttrs (!config.node.pkgsReadOnly) (
              mkIf (!options.nixpkgs.pkgs.isDefined) {
                # TODO: switch to nixpkgs.hostPlatform and make sure containers-imperative test still evaluates.
-                nixpkgs.system = hostPkgs.stdenv.hostPlatform.system;
+                nixpkgs.system = guestSystem;
              }
            );
          })
--- a/nixos/lib/testing/pkgs.nix
+++ b/nixos/lib/testing/pkgs.nix
@ -2,7 +2,11 @@
 {
  config = {
    # default pkgs for use in VMs
-    _module.args.pkgs = hostPkgs;
+    _module.args.pkgs =
+      # TODO: deprecate it everywhere; not just on darwin. Throw on darwin?
+      lib.warnIf hostPkgs.stdenv.hostPlatform.isDarwin
+        "Do not use the `pkgs` module argument in tests you want to run on darwin. It is ambiguous, and many tests are broken because of it. If you need to use a package on the VM host, use `hostPkgs`. Otherwise, use `config.node.pkgs`, or `config.nodes.<name>.nixpkgs.pkgs`."
+        hostPkgs;

    defaults = {
      # TODO: a module to set a shared pkgs, if options.nixpkgs.* is untouched by user (highestPrio) */
--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@ -41,7 +41,9 @@ in
    rawTestDerivation = hostPkgs.stdenv.mkDerivation {
      name = "vm-test-run-${config.name}";

-      requiredSystemFeatures = [ "kvm" "nixos-test" ];
+      requiredSystemFeatures = [ "nixos-test" ]
+        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
+        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];

      buildCommand = ''
        mkdir -p $out
--- a/nixos/modules/i18n/input-method/fcitx5.nix
+++ b/nixos/modules/i18n/input-method/fcitx5.nix
@ -5,7 +5,10 @@ with lib;
 let
  im = config.i18n.inputMethod;
  cfg = im.fcitx5;
-  fcitx5Package = pkgs.fcitx5-with-addons.override { inherit (cfg) addons; };
+  fcitx5Package =
+    if cfg.plasma6Support
+    then pkgs.qt6Packages.fcitx5-with-addons.override { inherit (cfg) addons; }
+    else pkgs.libsForQt5.fcitx5-with-addons.override { inherit (cfg) addons; };
  settingsFormat = pkgs.formats.ini { };
 in
 {
@ -27,6 +30,14 @@ in
          See [Using Fcitx 5 on Wayland](https://fcitx-im.org/wiki/Using_Fcitx_5_on_Wayland).
        '';
      };
+      plasma6Support = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Use qt6 versions of fcitx5 packages.
+          Required for configuring fcitx5 in KDE System Settings.
+        '';
+      };
      quickPhrase = mkOption {
        type = with types; attrsOf str;
        default = { };
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@ -208,7 +208,11 @@ in
      example = { system = "x86_64-linux"; };
      # Make sure that the final value has all fields for sake of other modules
      # referring to this.
-      apply = lib.systems.elaborate;
+      apply = inputBuildPlatform:
+        let elaborated = lib.systems.elaborate inputBuildPlatform;
+        in if lib.systems.equals elaborated cfg.hostPlatform
+          then cfg.hostPlatform  # make identical, so that `==` equality works; see https://github.com/NixOS/nixpkgs/issues/278001
+          else elaborated;
      defaultText = literalExpression
        ''config.nixpkgs.hostPlatform'';
      description = lib.mdDoc ''
--- a/nixos/modules/misc/nixpkgs/test.nix
+++ b/nixos/modules/misc/nixpkgs/test.nix
@ -12,6 +12,10 @@ let
    nixpkgs.hostPlatform = "aarch64-linux";
    nixpkgs.buildPlatform = "aarch64-darwin";
  };
+  withSameHostAndBuild = eval {
+    nixpkgs.hostPlatform = "aarch64-linux";
+    nixpkgs.buildPlatform = "aarch64-linux";
+  };
  ambiguous = {
    _file = "ambiguous.nix";
    nixpkgs.hostPlatform = "aarch64-linux";
@ -81,6 +85,8 @@ lib.recurseIntoAttrs {
    assert withHost._module.args.pkgs.stdenv.buildPlatform.system == "aarch64-linux";
    assert withHostAndBuild._module.args.pkgs.stdenv.hostPlatform.system == "aarch64-linux";
    assert withHostAndBuild._module.args.pkgs.stdenv.buildPlatform.system == "aarch64-darwin";
+    assert withSameHostAndBuild.config.nixpkgs.buildPlatform == withSameHostAndBuild.config.nixpkgs.hostPlatform;
+    assert withSameHostAndBuild._module.args.pkgs.stdenv.buildPlatform == withSameHostAndBuild._module.args.pkgs.stdenv.hostPlatform;
    assert builtins.trace (lib.head (getErrors ambiguous))
      getErrors ambiguous ==
        [''
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -585,6 +585,7 @@
  ./services/home-automation/govee2mqtt.nix
  ./services/home-automation/home-assistant.nix
  ./services/home-automation/homeassistant-satellite.nix
+  ./services/home-automation/matter-server.nix
  ./services/home-automation/zigbee2mqtt.nix
  ./services/home-automation/zwave-js.nix
  ./services/logging/SystemdJournal2Gelf.nix
@ -786,6 +787,7 @@
  ./services/misc/tiddlywiki.nix
  ./services/misc/tp-auto-kbbl.nix
  ./services/misc/tuxclocker.nix
+  ./services/misc/transfer-sh.nix
  ./services/misc/tzupdate.nix
  ./services/misc/uhub.nix
  ./services/misc/weechat.nix
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -1465,9 +1465,9 @@ in
        '';
      }
      {
-        assertion = config.security.pam.zfs.enable -> (config.boot.zfs.enabled || config.boot.zfs.enableUnstable);
+        assertion = config.security.pam.zfs.enable -> config.boot.zfs.enabled;
        message = ''
-          `security.pam.zfs.enable` requires enabling ZFS (`boot.zfs.enabled` or `boot.zfs.enableUnstable`).
+          `security.pam.zfs.enable` requires enabling ZFS (`boot.zfs.enabled`).
        '';
      }
      {
--- a/nixos/modules/services/home-automation/matter-server.nix
+++ b/nixos/modules/services/home-automation/matter-server.nix
@ -0,0 +1,125 @@
+{ lib
+, pkgs
+, config
+, ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.matter-server;
+  storageDir = "matter-server";
+  storagePath = "/var/lib/${storageDir}";
+  vendorId = "4939"; # home-assistant vendor ID
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ leonm1 ];
+
+  options.services.matter-server = with types; {
+    enable = mkEnableOption (lib.mdDoc "Matter-server");
+
+    package = mkPackageOptionMD pkgs "python-matter-server" { };
+
+    port = mkOption {
+      type = types.port;
+      default = 5580;
+      description = "Port to expose the matter-server service on.";
+    };
+
+    logLevel = mkOption {
+      type = types.enum [ "critical" "error" "warning" "info" "debug" ];
+      default = "info";
+      description = "Verbosity of logs from the matter-server";
+    };
+
+    extraArgs = mkOption {
+      type = listOf str;
+      default = [];
+      description = ''
+        Extra arguments to pass to the matter-server executable.
+        See https://github.com/home-assistant-libs/python-matter-server?tab=readme-ov-file#running-the-development-server for options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.matter-server = {
+      after = [ "network-online.target" ];
+      before = [ "home-assistant.service" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      description = "Matter Server";
+      environment.HOME = storagePath;
+      serviceConfig = {
+        ExecStart = (concatStringsSep " " [
+          "${cfg.package}/bin/matter-server"
+          "--port" (toString cfg.port)
+          "--vendorid" vendorId
+          "--storage-path" storagePath
+          "--log-level" "${cfg.logLevel}"
+          "${escapeShellArgs cfg.extraArgs}"
+        ]);
+        # Start with a clean root filesystem, and allowlist what the container
+        # is permitted to access.
+        TemporaryFileSystem = "/";
+        # Allowlist /nix/store (to allow the binary to find its dependencies)
+        # and dbus.
+        ReadOnlyPaths = "/nix/store /run/dbus";
+        # Let systemd manage `/var/lib/matter-server` for us inside the
+        # ephemeral TemporaryFileSystem.
+        StateDirectory = storageDir;
+        # `python-matter-server` writes to /data even when a storage-path is
+        # specified. This bind-mount points /data at the systemd-managed
+        # /var/lib/matter-server, so all files get dropped into the state
+        # directory.
+        BindPaths = "${storagePath}:/data";
+
+        # Hardening bits
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        DevicePolicy = "closed";
+        DynamicUser = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallFilter = concatStringsSep " " [
+          "~" # Blocklist
+          "@clock"
+          "@cpu-emulation"
+          "@debug"
+          "@module"
+          "@mount"
+          "@obsolete"
+          "@privileged"
+          "@raw-io"
+          "@reboot"
+          "@resources"
+          "@swap"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}
+
--- a/nixos/modules/services/misc/transfer-sh.nix
+++ b/nixos/modules/services/misc/transfer-sh.nix
@ -0,0 +1,102 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.transfer-sh;
+  inherit (lib)
+    mkDefault mkEnableOption mkPackageOption mkIf mkOption
+    types mapAttrs isBool getExe boolToString mdDoc optionalAttrs;
+in
+{
+  options.services.transfer-sh = {
+    enable = mkEnableOption (mdDoc "Easy and fast file sharing from the command-line");
+
+    package = mkPackageOption pkgs "transfer-sh" { };
+
+    settings = mkOption {
+      type = types.submodule { freeformType = with types; attrsOf (oneOf [ bool int str ]); };
+      default = { };
+      example = {
+        LISTENER = ":8080";
+        BASEDIR = "/var/lib/transfer.sh";
+        TLS_LISTENER_ONLY = false;
+      };
+      description = mdDoc ''
+        Additional configuration for transfer-sh, see
+        <https://github.com/dutchcoders/transfer.sh#usage-1>
+        for supported values.
+
+        For secrets use secretFile option instead.
+      '';
+    };
+
+    provider = mkOption {
+      type = types.enum [ "local" "s3" "storj" "gdrive" ];
+      default = "local";
+      description = mdDoc "Storage providers to use";
+    };
+
+    secretFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/transfer-sh.env";
+      description = mdDoc ''
+        Path to file containing environment variables.
+        Useful for passing down secrets.
+        Some variables that can be considered secrets are:
+         - AWS_ACCESS_KEY
+         - AWS_ACCESS_KEY
+         - TLS_PRIVATE_KEY
+         - HTTP_AUTH_HTPASSWD
+      '';
+    };
+  };
+
+  config =
+    let
+      localProvider = (cfg.provider == "local");
+      stateDirectory = "/var/lib/transfer.sh";
+    in
+    mkIf cfg.enable
+      {
+        services.transfer-sh.settings = {
+          LISTENER = mkDefault ":8080";
+        } // optionalAttrs localProvider {
+          BASEDIR = mkDefault stateDirectory;
+        };
+
+        systemd.services.transfer-sh = {
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+          environment = mapAttrs (_: v: if isBool v then boolToString v else toString v) cfg.settings;
+          serviceConfig = {
+            CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+            DevicePolicy = "closed";
+            DynamicUser = true;
+            ExecStart = "${getExe cfg.package} --provider ${cfg.provider}";
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            PrivateDevices = true;
+            PrivateUsers = true;
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            SystemCallArchitectures = [ "native" ];
+            SystemCallFilter = [ "@system-service" ];
+            StateDirectory = baseNameOf stateDirectory;
+          } // optionalAttrs (cfg.secretFile != null) {
+            EnvironmentFile = cfg.secretFile;
+          } // optionalAttrs localProvider {
+            ReadWritePaths = cfg.settings.BASEDIR;
+          };
+        };
+      };
+
+  meta.maintainers = with lib.maintainers; [ ocfox ];
+}
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@ -66,6 +66,13 @@ in {
      default = [];
      example = ["--ssh"];
    };
+
+    extraDaemonFlags = mkOption {
+      description = lib.mdDoc "Extra flags to pass to {command}`tailscaled`.";
+      type = types.listOf types.str;
+      default = [];
+      example = ["--no-logs-no-support"];
+    };
  };

  config = mkIf cfg.enable {
@ -80,7 +87,7 @@ in {
      ] ++ lib.optional config.networking.resolvconf.enable config.networking.resolvconf.package;
      serviceConfig.Environment = [
        "PORT=${toString cfg.port}"
-        ''"FLAGS=--tun ${lib.escapeShellArg cfg.interfaceName}"''
+        ''"FLAGS=--tun ${lib.escapeShellArg cfg.interfaceName} ${lib.concatStringsSep " " cfg.extraDaemonFlags}"''
      ] ++ (lib.optionals (cfg.permitCertUid != null) [
        "TS_PERMIT_CERT_UID=${cfg.permitCertUid}"
      ]);
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -97,6 +97,7 @@ let

      # Maintaining state across reboots.
      "systemd-random-seed.service"
+      "systemd-boot-random-seed.service"
      "systemd-backlight@.service"
      "systemd-rfkill.service"
      "systemd-rfkill.socket"
@ -667,7 +668,6 @@ in

    # Don't bother with certain units in containers.
    systemd.services.systemd-remount-fs.unitConfig.ConditionVirtualization = "!container";
-    systemd.services.systemd-random-seed.unitConfig.ConditionVirtualization = "!container";

    # Increase numeric PID range (set directly instead of copying a one-line file from systemd)
    # https://github.com/systemd/systemd/pull/12226
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -211,6 +211,7 @@ in

  imports = [
    (mkRemovedOptionModule [ "boot" "zfs" "enableLegacyCrypto" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "boot" "zfs" "enableUnstable" ] "Instead set `boot.zfs.package = pkgs.zfs_unstable;`")
  ];

  ###### interface
@ -219,9 +220,9 @@ in
    boot.zfs = {
      package = mkOption {
        type = types.package;
-        default = if cfgZfs.enableUnstable then pkgs.zfsUnstable else pkgs.zfs;
-        defaultText = literalExpression "if zfsUnstable is enabled then pkgs.zfsUnstable else pkgs.zfs";
-        description = lib.mdDoc "Configured ZFS userland tools package, use `pkgs.zfsUnstable` if you want to track the latest staging ZFS branch.";
+        default = pkgs.zfs;
+        defaultText = literalExpression "pkgs.zfs";
+        description = lib.mdDoc "Configured ZFS userland tools package, use `pkgs.zfs_unstable` if you want to track the latest staging ZFS branch.";
      };

      modulePackage = mkOption {
@ -239,19 +240,6 @@ in
        description = lib.mdDoc "True if ZFS filesystem support is enabled";
      };

-      enableUnstable = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Use the unstable zfs package. This might be an option, if the latest
-          kernel is not yet supported by a published release of ZFS. Enabling
-          this option will install a development version of ZFS on Linux. The
-          version will have already passed an extensive test suite, but it is
-          more likely to hit an undiscovered bug compared to running a released
-          version of ZFS on Linux.
-          '';
-      };
-
      allowHibernation = mkOption {
        type = types.bool;
        default = false;
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@ -1,4 +1,7 @@
-{ pkgs, lib, ... }: let
+{ config, lib, ... }: let
+
+  pkgs = config.node.pkgs;
+
  commonConfig = ./common/acme/client;

  dnsServerIP = nodes: nodes.dnsserver.networking.primaryIPAddress;
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -78,8 +78,9 @@ let
    #       it with `allowAliases = false`?
    # warnIf pkgs.config.allowAliases "nixosTests: pkgs includes aliases."
    {
+      _file = "${__curPos.file} readOnlyPkgs";
      _class = "nixosTest";
-      node.pkgs = pkgs;
+      node.pkgs = pkgs.pkgsLinux;
    };

 in {
@ -512,6 +513,7 @@ in {
  mastodon = discoverTests (import ./web-apps/mastodon { inherit handleTestOn; });
  pixelfed = discoverTests (import ./web-apps/pixelfed { inherit handleTestOn; });
  mate = handleTest ./mate.nix {};
+  matter-server = handleTest ./matter-server.nix {};
  matomo = handleTest ./matomo.nix {};
  matrix-appservice-irc = handleTest ./matrix/appservice-irc.nix {};
  matrix-conduit = handleTest ./matrix/conduit.nix {};
@ -916,6 +918,7 @@ in {
  tor = handleTest ./tor.nix {};
  traefik = handleTestOn ["aarch64-linux" "x86_64-linux"] ./traefik.nix {};
  trafficserver = handleTest ./trafficserver.nix {};
+  transfer-sh = handleTest ./transfer-sh.nix {};
  transmission = handleTest ./transmission.nix { transmission = pkgs.transmission; };
  transmission_4 = handleTest ./transmission.nix { transmission = pkgs.transmission_4; };
  # tracee requires bpf
--- a/nixos/tests/matter-server.nix
+++ b/nixos/tests/matter-server.nix
@ -0,0 +1,45 @@
+import ./make-test-python.nix ({ pkgs, lib, ...} :
+
+let
+  chipVersion = pkgs.python311Packages.home-assistant-chip-core.version;
+in
+
+{
+  name = "matter-server";
+  meta.maintainers = with lib.maintainers; [ leonm1 ];
+
+  nodes = {
+    machine = { config, ... }: {
+      services.matter-server = {
+        enable = true;
+        port = 1234;
+      };
+    };
+  };
+
+  testScript = /* python */ ''
+    start_all()
+
+    machine.wait_for_unit("matter-server.service")
+    machine.wait_for_open_port(1234)
+
+    with subtest("Check websocket server initialized"):
+        output = machine.succeed("echo \"\" | ${pkgs.websocat}/bin/websocat ws://localhost:1234/ws")
+        machine.log(output)
+
+    assert '"sdk_version": "${chipVersion}"' in output, (
+      'CHIP version \"${chipVersion}\" not present in websocket message'
+    )
+
+    assert '"fabric_id": 1' in output, (
+      "fabric_id not propagated to server"
+    )
+
+    with subtest("Check storage directory is created"):
+        machine.succeed("ls /var/lib/matter-server/chip.json")
+
+    with subtest("Check systemd hardening"):
+        _, output = machine.execute("systemd-analyze security matter-server.service | grep -v '✓'")
+        machine.log(output)
+  '';
+})
--- a/nixos/tests/qemu-vm-external-disk-image.nix
+++ b/nixos/tests/qemu-vm-external-disk-image.nix
@ -69,5 +69,8 @@ in
    os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name

    machine.succeed("findmnt --kernel --source ${rootFsDevice} --target /")
+
+    # Make sure systemd boot didn't clobber this
+    machine.succeed("[ ! -e /homeless-shelter ]")
  '';
 }
--- a/nixos/tests/transfer-sh.nix
+++ b/nixos/tests/transfer-sh.nix
@ -0,0 +1,20 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "transfer-sh";
+
+  meta = {
+    maintainers = with lib.maintainers; [ ocfox ];
+  };
+
+  nodes.machine = { pkgs, ... }: {
+    services.transfer-sh = {
+      enable = true;
+      settings.LISTENER = ":1234";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("transfer-sh.service")
+    machine.wait_for_open_port(1234)
+    machine.succeed("curl --fail http://localhost:1234/")
+  '';
+})
--- a/nixos/tests/zfs.nix
+++ b/nixos/tests/zfs.nix
@ -7,14 +7,14 @@ with import ../lib/testing-python.nix { inherit system pkgs; };

 let

-  makeZfsTest = name:
+  makeZfsTest =
    { kernelPackages
    , enableSystemdStage1 ? false
    , zfsPackage
    , extraTest ? ""
    }:
    makeTest {
-      name = "zfs-" + name;
+      name = zfsPackage.kernelModuleAttribute;
      meta = with pkgs.lib.maintainers; {
        maintainers = [ elvishjerricco ];
      };
@ -192,23 +192,23 @@ let
 in {

  # maintainer: @raitobezarius
-  series_2_1 = makeZfsTest "2.1-series" {
+  series_2_1 = makeZfsTest {
    zfsPackage = pkgs.zfs_2_1;
    kernelPackages = pkgs.linuxPackages;
  };

-  stable = makeZfsTest "stable" {
-    zfsPackage = pkgs.zfsStable;
+  series_2_2 = makeZfsTest {
+    zfsPackage = pkgs.zfs_2_2;
    kernelPackages = pkgs.linuxPackages;
  };

-  unstable = makeZfsTest "unstable" rec {
-    zfsPackage = pkgs.zfsUnstable;
+  unstable = makeZfsTest rec {
+    zfsPackage = pkgs.zfs_unstable;
    kernelPackages = zfsPackage.latestCompatibleLinuxPackages;
  };

-  unstableWithSystemdStage1 = makeZfsTest "unstable" rec {
-    zfsPackage = pkgs.zfsUnstable;
+  unstableWithSystemdStage1 = makeZfsTest rec {
+    zfsPackage = pkgs.zfs_unstable;
    kernelPackages = zfsPackage.latestCompatibleLinuxPackages;
    enableSystemdStage1 = true;
  };
--- a/pkgs/applications/audio/monkeys-audio/default.nix
+++ b/pkgs/applications/audio/monkeys-audio/default.nix
@ -5,13 +5,13 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "10.49";
+  version = "10.52";
  pname = "monkeys-audio";

  src = fetchzip {
    url = "https://monkeysaudio.com/files/MAC_${
      builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-OhTqBFNwmReMT1U11CIB7XCTohiILdd2nDFp+9nfObs=";
+    hash = "sha256-n+bQzvuCTt7dnqkPO592KKZeShmMlbp/KAXK0F2dlTg=";
    stripRoot = false;
  };
  nativeBuildInputs = [
--- a/pkgs/applications/audio/spotifywm/default.nix
+++ b/pkgs/applications/audio/spotifywm/default.nix
@ -1,39 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, spotify, xorg, makeWrapper }:
-stdenv.mkDerivation {
-  pname = "spotifywm-unstable";
-  version = "2022-10-26";
-
-  src = fetchFromGitHub {
-    owner = "dasJ";
-    repo = "spotifywm";
-    rev = "8624f539549973c124ed18753881045968881745";
-    sha256 = "sha256-AsXqcoqUXUFxTG+G+31lm45gjP6qGohEnUSUtKypew0=";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  buildInputs = [ xorg.libX11 ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{bin,lib}
-    install -Dm644 spotifywm.so $out/lib/
-    ln -sf ${spotify}/bin/spotify $out/bin/spotify
-
-    # wrap spotify to use spotifywm.so
-    wrapProgram $out/bin/spotify --set LD_PRELOAD "$out/lib/spotifywm.so"
-    # backwards compatibility for people who are using the "spotifywm" binary
-    ln -sf $out/bin/spotify $out/bin/spotifywm
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/dasJ/spotifywm";
-    description = "Wrapper around Spotify that correctly sets class name before opening the window";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ jqueiroz the-argus ];
-  };
-}
--- a/pkgs/applications/audio/surge-XT/default.nix
+++ b/pkgs/applications/audio/surge-XT/default.nix
@ -2,6 +2,7 @@
 , lib
 , fetchFromGitHub
 , cmake
+, gitMinimal
 , pkg-config
 , alsa-lib
 , freetype
@ -14,41 +15,23 @@
 , libXrandr
 }:

-let
-  juce-lv2 = stdenv.mkDerivation {
-    pname = "juce-lv2";
-    version = "unstable-2023-03-04";
-
-    # lv2 branch
-    src = fetchFromGitHub {
-      owner = "lv2-porting-project";
-      repo = "JUCE";
-      rev = "e825ad977cf4499a7bfa05b97b208236f8fd253b";
-      sha256 = "sha256-Fqp1y9BN0E9p/12ukG1oh3COhXNRWBAlFRSl0LPyiFc=";
-    };
-
-    dontConfigure = true;
-    dontBuild = true;
-
-    installPhase = ''
-      cp -r . $out
-    '';
-  };
-in
 stdenv.mkDerivation rec {
  pname = "surge-XT";
-  version = "1.2.3";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "surge-synthesizer";
    repo = "surge";
    rev = "release_xt_${version}";
+    branchName = "release-xt/${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-DGzdzoCjMGEDltEwlPvLk2tyMVRH1Ql2Iq1ypogw/m0=";
+    leaveDotGit = true;
+    sha256 = "sha256-q6qs/OhIakF+Gc8Da3pnfkUGYDUoJbvee0o8dfrRI2U=";
  };

  nativeBuildInputs = [
    cmake
+    gitMinimal
    pkg-config
  ];

@ -67,8 +50,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  cmakeFlags = [
-    "-DJUCE_SUPPORTS_LV2=ON"
-    "-DSURGE_JUCE_PATH=${juce-lv2}"
+    "-DSURGE_BUILD_LV2=TRUE"
  ];

  CXXFLAGS = [
--- a/pkgs/applications/blockchains/stellar-core/default.nix
+++ b/pkgs/applications/blockchains/stellar-core/default.nix
@ -2,6 +2,7 @@
 , automake
 , bison
 , fetchFromGitHub
+, fetchpatch
 , flex
 , git
 , lib
@ -25,6 +26,23 @@ stdenv.mkDerivation (finalAttrs: {
    fetchSubmodules = true;
  };

+  patches = [
+    # Fix gcc-13 build failure due to missing <stdexcept> include
+    #   https://github.com/stellar/medida/pull/34
+    (fetchpatch {
+      name = "gcc-13-p1.patch";
+      url = "https://github.com/stellar/medida/commit/f91354b0055de939779d392999975d611b1b1ad5.patch";
+      stripLen = 1;
+      extraPrefix = "lib/libmedida/";
+      hash = "sha256-iVeSUY5Rcy62apIKJdbcHGgxAxpQCkygf85oSjbTTXU=";
+    })
+    (fetchpatch {
+      name = "gcc-13-p2.patch";
+      url = "https://github.com/stellar/stellar-core/commit/477b3135281b629554cabaeacfcdbcdc170aa335.patch";
+      hash = "sha256-UVRcAIA5LEaCn16lWfhg19UU7b/apigzTsfPROLZtYg=";
+    })
+  ];
+
  nativeBuildInputs = [
    automake
    autoconf
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@ -22,16 +22,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "oculante";
-  version = "0.8.11";
+  version = "0.8.13";

  src = fetchFromGitHub {
    owner = "woelper";
    repo = "oculante";
    rev = version;
-    hash = "sha256-5nOXt2c7byO+JdVXADu2TyO4vtLyg8UBWerPFMGHcso=";
+    hash = "sha256-RbRvV3OkRZXc0n7qGzqbBtbU81wFc+/Ohg9pbVqdsw4=";
  };

-  cargoHash = "sha256-l1JYZxwvNnaff1PYPXniHmfNMG2Um5aPKTYuh/LCHoE=";
+  cargoHash = "sha256-qt4bHCHpiP6yOce9hquVVlLFF906ADwhss4xAP9E0fA=";

  nativeBuildInputs = [
    cmake
--- a/pkgs/applications/graphics/upscayl/default.nix
+++ b/pkgs/applications/graphics/upscayl/default.nix
@ -4,11 +4,11 @@
  lib,
 }: let
  pname = "upscayl";
-  version = "2.9.9";
+  version = "2.10.0";

  src = fetchurl {
    url = "https://github.com/upscayl/upscayl/releases/download/v${version}/upscayl-${version}-linux.AppImage";
-    hash = "sha256-EoTFvlLsXQYZldXfEHhP3/bHygm+NdeDsf+p138mM8w";
+    hash = "sha256-nRYNYNHIkbvvQZd1zRDCCsCadgRgV/yn9WfaKjt44O8=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -32,11 +32,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "calibre";
-  version = "7.5.1";
+  version = "7.6.0";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pGo9fWyeX5hpw5YOV05tWy/0YxHShStKN96LMPnqIiA=";
+    hash = "sha256-fD2kTwH692x6Nm93NrUQvmbcXiX9hHBpo4wvUvBqLAM=";
  };

  patches = [
--- a/pkgs/applications/misc/evtest-qt/default.nix
+++ b/pkgs/applications/misc/evtest-qt/default.nix
@ -1,20 +1,33 @@
-{ mkDerivation, lib, qtbase, cmake, fetchFromGitHub }:
+{ mkDerivation, lib, qtbase, cmake, fetchFromGitHub, fetchpatch, unstableGitUpdater }:

 mkDerivation rec {
  pname = "evtest-qt";
-  version = "0.2.0";
+  version = "0.2.0-unstable-2023-09-13";

  src = fetchFromGitHub {
    owner = "Grumbel";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "1wfzkgq81764qzxgk0y5vvpxcrb3icvrr4dd4mj8njrqgbwmn0mw";
+    rev = "fb087f4d3d51377790f1ff30681c48031bf23145";
+    hash = "sha256-gE47x1J13YZUVyB0b4VRyESIVCm3GbOXp2bX0TP97UU=";
+    fetchSubmodules = true;
  };

+  patches = [
+    # Fix build against gcc-13:
+    #   https://github.com/Grumbel/evtest-qt/pull/14
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/Grumbel/evtest-qt/commit/975dedcfd60853bd329f34d48ce4740add8866eb.patch";
+      hash = "sha256-gR/9oVhO4G9i7dn+CjvDAQN0KLXoX/fatpE0W3gXDc0=";
+    })
+  ];
+
  nativeBuildInputs = [ cmake ];

  buildInputs = [ qtbase ];

+  passthru.updateScript = unstableGitUpdater {};
+
  meta = with lib; {
    description = "Simple input device tester for linux with Qt GUI";
    homepage = "https://github.com/Grumbel/evtest-qt";
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@ -14,11 +14,11 @@ stdenv.mkDerivation (finalAttrs: let

 in {
  pname = "logseq";
-  version = "0.10.6";
+  version = "0.10.7";

  src = fetchurl {
    url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    hash = "sha256-OUQh+6HRnzxw8Nn/OkU+DkjPKWKpMN0xchD1vPU3KV8=";
+    hash = "sha256-EC83D7tSpoDV6h363yIdX9IrTfoMd4b0hTVdW1T0pXg=";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/misc/qlcplus/default.nix
+++ b/pkgs/applications/misc/qlcplus/default.nix
@ -29,16 +29,20 @@ mkDerivation rec {

  qmakeFlags = [ "INSTALLROOT=$(out)" ];

-  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
-
  postPatch = ''
    patchShebangs .
    sed -i -e '/unix:!macx:INSTALLROOT += \/usr/d' \
            -e "s@\$\$LIBSDIR/qt4/plugins@''${qtPluginPrefix}@" \
            -e "s@/etc/udev/rules.d@''${out}/lib/udev/rules.d@" \
      variables.pri
+
+    # Fix gcc-13 build failure by removing blanket -Werror.
+    fgrep Werror variables.pri
+    substituteInPlace variables.pri --replace-fail "QMAKE_CXXFLAGS += -Werror" ""
  '';

+  enableParallelBuilding = true;
+
  postInstall = ''
    ln -sf $out/lib/*/libqlcplus* $out/lib
  '';
--- a/pkgs/applications/misc/ttdl/default.nix
+++ b/pkgs/applications/misc/ttdl/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ttdl";
-  version = "4.2.0";
+  version = "4.2.1";

  src = fetchFromGitHub {
    owner = "VladimirMarkelov";
    repo = "ttdl";
    rev = "v${version}";
-    sha256 = "sha256-5OYOF8SvjPn/gZf/utcpv1zVvVbB1HeB1mkMiJtBjOQ=";
+    sha256 = "sha256-fspqUzF3QqFpd16J1dbcNMdqjcR3PIiRu/s+VB4KgwQ=";
  };

-  cargoHash = "sha256-MLypY7Dbr1/4hJ2UYmNOVp0nNWrq3DDTEidgkL0X0AU=";
+  cargoHash = "sha256-dvzm9lbVGGM4t6KZcHSlqwo55jssxi8HyFREMaj5I0Q=";

  meta = with lib; {
    description = "A CLI tool to manage todo lists in todo.txt format";
--- a/pkgs/applications/misc/wofi/default.nix
+++ b/pkgs/applications/misc/wofi/default.nix
@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "wofi";
-  version = "1.4";
+  version = "1.4.1";

  src = fetchFromSourcehut {
    repo = pname;
    owner = "~scoopta";
    rev = "v${version}";
-    sha256 = "sha256-zzBD1OPPlOjAUaJOlMf6k1tSai1w1ZvOwy2sSOWI7AM=";
+    sha256 = "sha256-aedoUhVfk8ljmQ23YxVmGZ00dPpRftW2dnRAgXmtV/w=";
    vc = "hg";
  };

--- a/pkgs/applications/networking/browsers/gmni/default.nix
+++ b/pkgs/applications/networking/browsers/gmni/default.nix
@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ scdoc ];
  buildInputs = [ bearssl ];

+  # Fix build on `gcc-13`:
+  #       inlined from 'xt_end_chain' at src/tofu.c:82:3,
+  #   ...-glibc-2.38-27-dev/include/bits/stdio2.h:54:10: error: '__builtin___snprintf_chk' specified bound 4 exceeds destination size 3 [-Werror=stringop-overflow]
+  #
+  # The overflow will not happen in practice, but `snprintf()` gets
+  # passed one more byte than available.
+  hardeningDisable = [ "fortify3" ];
+
  meta = with lib; {
    description = "A Gemini client";
    homepage = "https://git.sr.ht/~sircmpwn/gmni";
--- a/pkgs/applications/networking/cluster/acorn/default.nix
+++ b/pkgs/applications/networking/cluster/acorn/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "acorn";
-  version = "0.10.0";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "acorn-io";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-U4VQ8PsmJxeMYj7TlsQQOEPckECDK+ENBQLjq5VFyJ4=";
+    hash = "sha256-Zw/OqN4d5iukh9oUXjczMvNKYkcGSUoDEwfti7uzZXQ=";
  };

-  vendorHash = "sha256-FZJqE7BWGvXsFsfxnnaKUFLInBzz+bUwURq4KvSMrus=";
+  vendorHash = "sha256-d/1Rqh00THUwcMBWloevfKbScaWhVG5r/32Q4zYUaJg=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/atmos/default.nix
+++ b/pkgs/applications/networking/cluster/atmos/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "atmos";
-  version = "1.64.1";
+  version = "1.64.3";

  src = fetchFromGitHub {
    owner = "cloudposse";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-QHXBvZThLi5Gnpc7fmitkvl3JU1i/g2jz8c6U4//6mU=";
+    sha256 = "sha256-Z27wFAWstsQliDiYl93yY9LDeVcGEWcrmggGJI60hxk=";
  };

  vendorHash = "sha256-i7m9YXPlWqHtvC4Df7v5bLWt2tqeT933t2+Xit5RQxg=";
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "clusterctl";
-  version = "1.6.1";
+  version = "1.6.2";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "cluster-api";
    rev = "v${version}";
-    hash = "sha256-v87QxDx+DA5pJHmu6jNwLcs4dNEsa5fUoRcVAhMnh24=";
+    hash = "sha256-OTOM83dsf6Fk+CYkACQOmguDTYfZvN9qes3S/cFEq/8=";
  };

-  vendorHash = "sha256-1W+nkhbJRHd4AaOzO01ZUu6wFvFIG0SOCzc4dg0Zopk=";
+  vendorHash = "sha256-SwJx3KPdOugDYLLymPyrPam0uMyRWIDpQn79Sd9fhJ4=";

  subPackages = [ "cmd/clusterctl" ];

--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@ -12,16 +12,16 @@

 buildGoModule rec {
  pname = "kubebuilder";
-  version = "3.13.0";
+  version = "3.14.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "kubebuilder";
    rev = "v${version}";
-    hash = "sha256-JXI3hQVChM7czCwan1yswsrUSse/IbMzwXw0tnaBiek=";
+    hash = "sha256-em+I2YICcqljaaNQ+zOAnOZ552elmV6Ywbfla8buwaY=";
  };

-  vendorHash = "sha256-yiRxSJIIYJbkV3QAFclrDDnsBoX1t4cSRvGmwVgz/w8=";
+  vendorHash = "sha256-iBwhpVs9u5AQAvmzb69SaewdYHmmaV19Bstd0Tux9CA=";

  subPackages = ["cmd"];

--- a/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubectl-gadget";
-  version = "0.24.0";
+  version = "0.25.1";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    rev = "v${version}";
-    hash = "sha256-JC6+6PADTfxpVRowh09fXC8EO/qIsUTTba2uYxxxJ/A=";
+    hash = "sha256-RbLc8c2F2Jy9jHwcd1FgqxhC5cl82oOauo/hsZ5zaG0=";
  };

-  vendorHash = "sha256-7pwEQ1O3i4SmVSTTmOX9KPR0ePdDpf2dQgD4e6fDyzQ=";
+  vendorHash = "sha256-/1dDAcICf7+g8hxaIAUsUwR9FNqatMhgAsvXrOuvGyk=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.294";
+  version = "1.2.295";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    hash = "sha256-A/Do2UepwV8lmT8qWir7CKR8/YeVKOEoJjvVfj9+wt0=";
+    hash = "sha256-oQDP2Tsxj4c5X2pfj4i+hfnsdjUBYcyF2p61OY04Ozg=";
  };

-  vendorHash = "sha256-Fb9drtVITjka83Y8+YSa9fqSBv7O4muMGqV4w3K7+Dg=";
+  vendorHash = "sha256-6q13vMxu0iQgaXS+Z6V0jjSIhxMscw6sLANzK07gAlI=";

  proxyVendor = true;

--- a/pkgs/applications/science/misc/graphia/default.nix
+++ b/pkgs/applications/science/misc/graphia/default.nix
@ -1,47 +1,47 @@
 { stdenv
 , lib
 , cmake
+, git
 , fetchFromGitHub
 , fetchpatch
 , wrapQtAppsHook
 , qtbase
-, qtquickcontrols2
-, qtgraphicaleffects
+, qtdeclarative
+, qtsvg
+, qtwebengine
 }:

 stdenv.mkDerivation rec {
  pname = "graphia";
-  version = "3.2";
+  version = "4.2";

  src = fetchFromGitHub {
    owner = "graphia-app";
    repo = "graphia";
    rev = version;
-    sha256 = "sha256-9kohXLXF4F/qoHm8qmvPM1y9ak0Thb4xvgKJlVuOPTg=";
+    sha256 = "sha256-8+tlQbTr6BGx+/gjviuNrQQWcxC/j6dJ+PxwB4fYmqQ=";
  };

  patches = [
-    # Fix for a breakpad incompatibility with glibc>2.33
-    # https://github.com/pytorch/pytorch/issues/70297
-    # https://github.com/google/breakpad/commit/605c51ed96ad44b34c457bbca320e74e194c317e
-    ./breakpad-sigstksz.patch
-
-    # FIXME: backport patch fixing build with Qt 5.15, remove for next release
+    # Fix gcc-13 build:
    (fetchpatch {
-      url = "https://github.com/graphia-app/graphia/commit/4b51bb8d465afa7ed0b2b30cb1c5e1c6af95976f.patch";
-      hash = "sha256-GDJAFLxQlRWKvcOgqqPYV/aVTRM7+KDjW7Zp9l7SuyM=";
+      name = "gcc-13.patch";
+      url = "https://github.com/graphia-app/graphia/commit/78fb55a4d73f96e9a182de433c7da60330bd5b5e.patch";
+      hash = "sha256-waI2ur3gOKMQvqB2Qnyz7oMOMConl3jLMVKKmOmTpJs=";
    })
  ];

  nativeBuildInputs = [
    cmake
+    git # needs to define some hash as a version
    wrapQtAppsHook
  ];

  buildInputs = [
    qtbase
-    qtquickcontrols2
-    qtgraphicaleffects
+    qtdeclarative
+    qtsvg
+    qtwebengine
  ];

  meta = with lib; {
@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
    description = "A visualisation tool for the creation and analysis of graphs.";
    homepage = "https://graphia.app";
    license = licenses.gpl3Only;
+    mainProgram = "Graphia";
    maintainers = [ maintainers.bgamari ];
    platforms = platforms.all;
  };
--- a/pkgs/applications/science/physics/nnpdf/default.nix
+++ b/pkgs/applications/science/physics/nnpdf/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "nnpdf";
-  version = "4.0.8";
+  version = "4.0.9";

  src = fetchFromGitHub {
    owner = "NNPDF";
    repo = pname;
    rev = version;
-    hash = "sha256-hGCA2K/fD6UZa9WD42IDmZV1oxNgjFaXkjOZKGgGSBg=";
+    hash = "sha256-PyhkHlOlzKfDxUX91NkeZWjdEzFR4PW0Yh5Yz6ZA27g=";
  };

  postPatch = ''
--- a/pkgs/applications/version-management/git-lfs/default.nix
+++ b/pkgs/applications/version-management/git-lfs/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "git-lfs";
-  version = "3.4.1";
+  version = "3.5.0";

  src = fetchFromGitHub {
    owner = "git-lfs";
    repo = "git-lfs";
    rev = "v${version}";
-    hash = "sha256-XqxkNCC2yzUTVOi/1iDsnxtLkw4jfQuBh9UsjtZ1zVc=";
+    hash = "sha256-iBv9kUaoyH9yEoCZYGYm+gmdjb797hWftzwkRNDNu3k=";
  };

-  vendorHash = "sha256-VmPeQYWOHFqFLHKcKH3WHz50yx7GMHVIDPzqiVwwjSg=";
+  vendorHash = "sha256-N8HB2qwBxjzfNucftHxmX2W9srCx62pjmkCWzwiCj/I=";

  nativeBuildInputs = [ asciidoctor installShellFiles ];

--- a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
@ -9,6 +9,7 @@
 , cairo
 , git
 , hyprland-protocols
+, hyprlang
 , jq
 , libGL
 , libdrm
@ -31,7 +32,7 @@
 , debug ? false
 , enableXWayland ? true
 , legacyRenderer ? false
-, withSystemd ? true
+, withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 , wrapRuntimeDeps ? true
  # deprecated flags
 , nvidiaPatches ? false
@ -43,13 +44,13 @@ assert lib.assertMsg (!enableNvidiaPatches) "The option `enableNvidiaPatches` ha
 assert lib.assertMsg (!hidpiXWayland) "The option `hidpiXWayland` has been removed. Please refer https://wiki.hyprland.org/Configuring/XWayland";
 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprland" + lib.optionalString debug "-debug";
-  version = "0.35.0";
+  version = "0.36.0";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = finalAttrs.pname;
    rev = "v${finalAttrs.version}";
-    hash = "sha256-dU5m6Cd4+WQZal2ICDVf1kww/dNzo1YUWRxWeCctEig=";
+    hash = "sha256-oZe4k6jtO/0govmERGcbeyvE9EfTvXY5bnyIs6AsL9U=";
  };

  patches = [
@ -92,6 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
      cairo
      git
      hyprland-protocols
+      hyprlang
      libGL
      libdrm
      libinput
@ -116,10 +118,10 @@ stdenv.mkDerivation (finalAttrs: {

  mesonAutoFeatures = "disabled";

-  mesonFlags = builtins.concatLists [
-    (lib.optional enableXWayland "-Dxwayland=enabled")
-    (lib.optional legacyRenderer "-Dlegacy_renderer=enabled")
-    (lib.optional withSystemd "-Dsystemd=enabled")
+  mesonFlags = [
+    (lib.mesonEnable "xwayland" enableXWayland)
+    (lib.mesonEnable "legacy_renderer" legacyRenderer)
+    (lib.mesonEnable "systemd" withSystemd)
  ];

  postInstall = ''
--- a/pkgs/applications/window-managers/hyprwm/hyprland/plugins.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/plugins.nix
@ -5,7 +5,7 @@
 , hyprland
 }:
 let
-  mkHyprlandPlugin =
+  mkHyprlandPlugin = hyprland:
    args@{ pluginName, ... }:
    stdenv.mkDerivation (args // {
      pname = "${pluginName}";
@ -14,23 +14,23 @@ let
        ++ hyprland.buildInputs
        ++ (args.buildInputs or [ ]);
      meta = args.meta // {
-        description = (args.meta.description or "");
-        longDescription = (args.meta.lonqDescription or "") +
+        description = args.meta.description or "";
+        longDescription = (args.meta.longDescription or "") +
          "\n\nPlugins can be installed via a plugin entry in the Hyprland NixOS or Home Manager options.";
      };
    });

  plugins = {
    hy3 = { fetchFromGitHub, cmake, hyprland }:
-      mkHyprlandPlugin rec {
+      mkHyprlandPlugin hyprland rec {
        pluginName = "hy3";
-        version = "0.35.0";
+        version = "unstable-2024-02-23";

        src = fetchFromGitHub {
          owner = "outfoxxed";
          repo = "hy3";
-          rev = "hl${version}";
-          hash = "sha256-lFe7Lf0K5ePTh4gflnvBohOGH4ayGDtNkbg/XtoNqRo=";
+          rev = "029a2001361d2a4cbbe7447968dee5d1b1880298";
+          hash = "sha256-8LKCXwNU6wA8o6O7s9T2sLWbYNHaI1tYU4YMjHkNLZQ=";
        };

        nativeBuildInputs = [ cmake ];
@ -47,5 +47,4 @@ let
      };
  };
 in
-lib.mapAttrs (name: plugin: callPackage plugin { }) plugins
-
+(lib.mapAttrs (name: plugin: callPackage plugin { }) plugins) // { inherit mkHyprlandPlugin; }
--- a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
@ -9,8 +9,8 @@ wlroots.overrideAttrs
      domain = "gitlab.freedesktop.org";
      owner = "wlroots";
      repo = "wlroots";
-      rev = "00b869c1a96f300a8f25da95d624524895e0ddf2";
-      hash = "sha256-5HUTG0p+nCJv3cn73AmFHRZdfRV5AD5N43g8xAePSKM=";
+      rev = "0cb091f1a2d345f37d2ee445f4ffd04f7f4ec9e5";
+      hash = "sha256-Mz6hCtommq7RQfcPnxLINigO4RYSNt23HeJHC6mVmWI=";
    };

    patches = [ ]; # don't inherit old.patches
--- a/pkgs/build-support/testers/default.nix
+++ b/pkgs/build-support/testers/default.nix
@ -1,4 +1,4 @@
-{ pkgs, buildPackages, lib, callPackage, runCommand, stdenv, substituteAll, testers }:
+{ pkgs, pkgsLinux, buildPackages, lib, callPackage, runCommand, stdenv, substituteAll, testers }:
 # Documentation is in doc/builders/testers.chapter.md
 {
  # See https://nixos.org/manual/nixpkgs/unstable/#tester-testBuildFailure
@ -107,7 +107,7 @@
            (lib.setDefaultModuleLocation "the argument that was passed to pkgs.runNixOSTest" testModule)
          ];
          hostPkgs = pkgs;
-          node.pkgs = pkgs;
+          node.pkgs = pkgsLinux;
        };

  # See doc/builders/testers.chapter.md or
@ -123,7 +123,7 @@
          inherit pkgs;
          extraConfigurations = [(
            { lib, ... }: {
-              config.nixpkgs.pkgs = lib.mkDefault pkgs;
+              config.nixpkgs.pkgs = lib.mkDefault pkgsLinux;
            }
          )];
        });
--- a/pkgs/build-support/testers/test/default.nix
+++ b/pkgs/build-support/testers/test/default.nix
@ -27,11 +27,11 @@ lib.recurseIntoAttrs {

  # Check that the wiring of nixosTest is correct.
  # Correct operation of the NixOS test driver should be asserted elsewhere.
-  nixosTest-example = pkgs-with-overlay.testers.nixosTest ({ lib, pkgs, figlet, ... }: {
+  nixosTest-example = pkgs-with-overlay.testers.nixosTest ({ lib, ... }: {
    name = "nixosTest-test";
    nodes.machine = { pkgs, ... }: {
      system.nixos = dummyVersioning;
-      environment.systemPackages = [ pkgs.proof-of-overlay-hello figlet ];
+      environment.systemPackages = [ pkgs.proof-of-overlay-hello pkgs.figlet ];
    };
    testScript = ''
      machine.succeed("hello | figlet >/dev/console")
--- a/pkgs/by-name/README.md
+++ b/pkgs/by-name/README.md
@ -118,3 +118,83 @@ $ ./pkgs/test/nixpkgs-check-by-name/scripts/run-local.sh master
 ```

 See [here](../../.github/workflows/check-by-name.yml) for more info.
+
+## Recommendation for new packages with multiple versions
+
+These checks of the `pkgs/by-name` structure can cause problems in combination:
+1. New top-level packages using `callPackage` must be defined via `pkgs/by-name`.
+2. Packages in `pkgs/by-name` cannot refer to files outside their own directory.
+
+This means that outside `pkgs/by-name`, multiple already-present top-level packages can refer to some common file.
+If you open a PR to another instance of such a package, CI will fail check 1,
+but if you try to move the package to `pkgs/by-name`, it will fail check 2.
+
+This is often the case for packages with multiple versions, such as
+
+```nix
+  foo_1 = callPackage ../tools/foo/1.nix { };
+  foo_2 = callPackage ../tools/foo/2.nix { };
+```
+
+The best way to resolve this is to not use `callPackage` directly, such that check 1 doesn't trigger.
+This can be done by using `inherit` on a local package set:
+```nix
+  inherit
+    ({
+      foo_1 = callPackage ../tools/foo/1.nix { };
+      foo_2 = callPackage ../tools/foo/2.nix { };
+    })
+    foo_1
+    foo_2
+    ;
+```
+
+While this may seem pointless, this can in fact help with future package set refactorings,
+because it establishes a clear connection between related attributes.
+
+### Further possible refactorings
+
+This is not required, but the above solution also allows refactoring the definitions into a separate file:
+
+```nix
+  inherit (import ../tools/foo pkgs)
+    foo_1 foo_2;
+```
+
+```nix
+# pkgs/tools/foo/default.nix
+pkgs: {
+  foo_1 = callPackage ./1.nix { };
+  foo_2 = callPackage ./2.nix { };
+}
+```
+
+Alternatively using [`callPackages`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.customisation.callPackagesWith)
+if `callPackage` isn't used underneath and you want the same `.override` arguments for all attributes:
+
+```nix
+  inherit (callPackages ../tools/foo { })
+    foo_1 foo_2;
+```
+
+```nix
+# pkgs/tools/foo/default.nix
+{
+  stdenv
+}: {
+  foo_1 = stdenv.mkDerivation { /* ... */ };
+  foo_2 = stdenv.mkDerivation { /* ... */ };
+}
+```
+
+### Exposing the package set
+
+This is not required, but the above solution also allows exposing the package set as an attribute:
+
+```nix
+  foo-versions = import ../tools/foo pkgs;
+  # Or using callPackages
+  # foo-versions = callPackages ../tools/foo { };
+
+  inherit (foo-versions) foo_1 foo_2;
+```
--- a/pkgs/by-name/ap/apt/package.nix
+++ b/pkgs/by-name/ap/apt/package.nix
@ -33,11 +33,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "apt";
-  version = "2.7.12";
+  version = "2.7.13";

  src = fetchurl {
    url = "mirror://debian/pool/main/a/apt/apt_${finalAttrs.version}.tar.xz";
-    hash = "sha256-5G0Wa1/Ih8LZvKet1+DM2lR7lit2LhJyoIwEJrqpnK8=";
+    hash = "sha256-xCq1XpHXvuX8v3/4w1hHFMusqgNl8JHn5gT3+Ek8fjU=";
  };

  # cycle detection; lib can't be split
--- a/pkgs/development/tools/rust/cargo-bloat/default.nix
+++ b/pkgs/development/tools/rust/cargo-bloat/default.nix
@ -8,10 +8,10 @@ rustPlatform.buildRustPackage rec {
    owner = "RazrFalcon";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-lCA7C1G2xu65jn3/wzj6prWSrjQz3EqqJyMlPR/HRFs=";
+    hash = "sha256-lCA7C1G2xu65jn3/wzj6prWSrjQz3EqqJyMlPR/HRFs=";
  };

-  cargoSha256 = "sha256-fOenXn5gagFss9DRDXXsGxQlDqVXZ5LZcdM4WsXAyUU=";
+  cargoHash = "sha256-fOenXn5gagFss9DRDXXsGxQlDqVXZ5LZcdM4WsXAyUU=";

  meta = with lib; {
    description = "A tool and Cargo subcommand that helps you find out what takes most of the space in your executable";
@ -19,6 +19,6 @@ rustPlatform.buildRustPackage rec {
    license = licenses.mit;
    platforms = platforms.unix;
    maintainers = with maintainers; [ xrelkd matthiasbeyer ];
+    mainProgram = "cargo-bloat";
  };
 }
-
--- a/pkgs/by-name/co/codeium/package.nix
+++ b/pkgs/by-name/co/codeium/package.nix
@ -13,10 +13,10 @@ let
  }.${system} or throwSystem;

  hash = {
-    x86_64-linux = "sha256-3B1TEToovw4C8rLsJv0Y3OPg8ZjMZ3Y29IzIs9Wm6II=";
-    aarch64-linux = "sha256-kD0yMHoJejKpK1cX/OPQLjPB8cXBp/aXy66YDxXINRw=";
-    x86_64-darwin = "sha256-DxyxR1t4UrqTn/ORrDiOryWCQ1L0DWXmlh2Hnm7kMS4=";
-    aarch64-darwin = "sha256-Ckbg/bZxeMpt2xtrLhJXo9DJTLluuWPVdGRRwiO1ZY8=";
+    x86_64-linux = "sha256-+SdAippxuJ0LvT+w6xSvTpzCv5EPjxXJKH4mcmnxu9Y=";
+    aarch64-linux = "sha256-cX+P0WcT+0oYDAcUJJ0+SRWPQCdv4rhrBf5BdPrF1Hg=";
+    x86_64-darwin = "sha256-eQjwViY5OsFzFtKkjLbrQgGNVBBpNNJjlfu8t/F37hI=";
+    aarch64-darwin = "sha256-xfB81SLuVa1wKcIGJZFxjdCSPmPXg0vYXtkCftiXBtU=";
  }.${system} or throwSystem;

  bin = "$out/bin/codeium_language_server";
@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "codeium";
-  version = "1.6.39";
+  version = "1.8.0";
  src = fetchurl {
    name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
    url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
--- a/pkgs/by-name/co/composefs/package.nix
+++ b/pkgs/by-name/co/composefs/package.nix
@ -16,6 +16,7 @@
 , fsverity-utils
 , nix-update-script
 , testers
+, nixosTests

 , fuseSupport ? lib.meta.availableOn stdenv.hostPlatform fuse3
 , enableValgrindCheck ? false
@ -23,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "composefs";
-  version = "1.0.2";
+  version = "1.0.3";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "composefs";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ViZkmuLFV5DN1nqWKGl+yaqhYUEOztZ1zGpxjr1U/dw=";
+    hash = "sha256-YmredtZZKMjzJW/kxiTUmdgO/1iPIKzJsuJz8DeEdGM=";
  };

  strictDeps = true;
@ -69,7 +70,11 @@ stdenv.mkDerivation (finalAttrs: {

  passthru = {
    updateScript = nix-update-script { };
-    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    tests = {
+      # Broken on aarch64 unrelated to this package: https://github.com/NixOS/nixpkgs/issues/291398
+      inherit (nixosTests) activation-etc-overlay-immutable activation-etc-overlay-mutable;
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    };
  };

  meta = {
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.172.0";
+  version = "0.173.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = version;
-    hash = "sha256-DzbCtTXeoERV9ceUsZ+srATIyviJp+oNyB7EE/iHe6g=";
+    hash = "sha256-PVBt+AoYd8fMYHzBpgQ261TGlkmyooN7UKX9ooXaRYA=";
  };

-  vendorHash = "sha256-P+T+ynSkG3KEmJsrzJusCPBD1ClaVK/VIHD+2xkGswQ=";
+  vendorHash = "sha256-5bHZt+Oze7JiaY0dKjoMNDdU6wzMphgZ3W3NveRKGy0=";

  doCheck = false;

--- a/pkgs/by-name/fc/fcitx5-rose-pine/package.nix
+++ b/pkgs/by-name/fc/fcitx5-rose-pine/package.nix
@ -0,0 +1,34 @@
+{ stdenvNoCC
+, fetchFromGitHub
+, lib
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "fcitx5-rose-pine";
+  version = "0-unstable-2024-03-01";
+
+  src = fetchFromGitHub {
+    owner = "rose-pine";
+    repo = "fcitx5";
+    rev = "148de09929c2e2f948376bb23bc25d72006403bc";
+    hash = "sha256-SpQ5ylHSDF5KCwKttAlXgrte3GA1cCCy/0OKNT1a3D8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -pv $out/share/fcitx5/themes/
+    cp -rv rose-pine* $out/share/fcitx5/themes/
+
+    runHook postInstall
+  '';
+
+
+  meta = {
+    description = "Fcitx5 themes based on Rosé Pine";
+    homepage = "https://github.com/rose-pine/fcitx5";
+    maintainers = with lib.maintainers; [ rosehobgoblin ];
+    platforms = lib.platforms.all;
+    license = lib.licenses.unfree;
+  };
+}
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.123.4";
+  version = "0.123.6";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-AJ/uK2eunQgsCcXR8FcQ9TVvMXs56J0gpfXRQCX78qY=";
+    hash = "sha256-gLow1AcUROid6skLDdaJ9E3mPi99KPoOO/ZFdLBineU=";
  };

-  vendorHash = "sha256-6qNICaj+P0VRl/crbiucZ7CpBG1vwFURkvOdaH6WidU=";
+  vendorHash = "sha256-V7YRrC+6fOIjXOu7E0kIOZZt++4oFLPhmHeWmOVU3Xw=";

  doCheck = false;

--- a/pkgs/by-name/la/labwc/package.nix
+++ b/pkgs/by-name/la/labwc/package.nix
@ -1,7 +1,6 @@
 { lib
-, stdenv
-, fetchFromGitHub
 , cairo
+, fetchFromGitHub
 , gettext
 , glib
 , libdrm
@ -16,6 +15,7 @@
 , pango
 , pkg-config
 , scdoc
+, stdenv
 , wayland
 , wayland-protocols
 , wayland-scanner
@ -26,15 +26,17 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "labwc";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "labwc";
    repo = "labwc";
    rev = finalAttrs.version;
-    hash = "sha256-/z2Wo9zhuEVIpk8jHYwg2JbBqkX7tfDP2KTZ9yzj454=";
+    hash = "sha256-6l+pYEMFQT8P0j40IcujSzlKgXzR5GIyuxkAJi65RiY=";
  };

+  outputs = [ "out" "man" ];
+
  nativeBuildInputs = [
    gettext
    meson
@ -62,8 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
    xwayland
  ];

-  outputs = [ "out" "man" ];
-
  strictDeps = true;

  mesonFlags = [
@ -77,8 +77,9 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    homepage = "https://github.com/labwc/labwc";
    description = "A Wayland stacking compositor, inspired by Openbox";
-    changelog = "https://raw.githubusercontent.com/labwc/labwc/${finalAttrs.version}/NEWS.md";
-    license = lib.licenses.gpl2Plus;
+    changelog = "https://github.com/labwc/labwc/blob/${finalAttrs.src.rev}/NEWS.md";
+    license = with lib.licenses; [ gpl2Plus ];
+    mainProgram = "labwc";
    maintainers = with lib.maintainers; [ AndersonTorres ];
    inherit (wayland.meta) platforms;
  };
--- a/pkgs/by-name/li/libvpl/opengl-driver-lib.patch
+++ b/pkgs/by-name/li/libvpl/opengl-driver-lib.patch
@ -0,0 +1,19 @@
+--- a/libvpl/src/mfx_dispatcher_vpl_loader.cpp
+++ b/libvpl/src/mfx_dispatcher_vpl_loader.cpp
+@@ -548,6 +548,16 @@ mfxStatus LoaderCtxVPL::BuildListOfCandidateLibs() {
+         it++;
+     }
+
+    // fourth priority
+    searchDirList.clear();
+    searchDirList.push_back("@driverLink@/lib");
+    it = searchDirList.begin();
+    while (it != searchDirList.end()) {
+        STRING_TYPE nextDir = (*it);
+        sts                 = SearchDirForLibs(nextDir, m_libInfoList, LIB_PRIORITY_05);
+        it++;
+    }
+
+     // lowest priority: legacy MSDK installation
+     searchDirList.clear();
+     GetSearchPathsLegacy(searchDirList);
--- a/pkgs/by-name/li/libvpl/package.nix
+++ b/pkgs/by-name/li/libvpl/package.nix
@ -3,6 +3,8 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
+, substituteAll
+, addDriverRunpath
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -32,6 +34,13 @@ stdenv.mkDerivation (finalAttrs: {
      "-DBUILD_TOOLS=OFF"
  ];

+  patches = [
+    (substituteAll {
+      src = ./opengl-driver-lib.patch;
+      inherit (addDriverRunpath) driverLink;
+    })
+  ];
+
  meta = with lib; {
    description = "Intel Video Processing Library";
    homepage = "https://intel.github.io/libvpl/";
--- a/pkgs/by-name/li/live555/package.nix
+++ b/pkgs/by-name/li/live555/package.nix
@ -9,7 +9,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "live555";
-  version = "2023.11.30";
+  version = "2024.02.28";

  src = fetchurl {
    urls = [
@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
      "https://download.videolan.org/contrib/live555/live.${finalAttrs.version}.tar.gz"
      "mirror://sourceforge/slackbuildsdirectlinks/live.${finalAttrs.version}.tar.gz"
    ];
-    hash = "sha256-xue+9YtdAM2XkzAY6dU2PZ3n6bvPwlULIHqBqc8wuSU=";
+    hash = "sha256-5WjtkdqoofZIijunfomcEeWj6l4CUK9HRoYAle2jSx8=";
  };

  patches = [
--- a/pkgs/games/lgames/ltris/default.nix
+++ b/pkgs/games/lgames/ltris/default.nix
@ -1,18 +1,18 @@
 { lib
-, stdenv
-, fetchurl
 , SDL
 , SDL_mixer
 , directoryListingUpdater
+, fetchurl
+, stdenv
 }:

-stdenv.mkDerivation rec {
-  pname = "ltris";
-  version = "1.2.7";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lgames-ltris";
+  version = "1.2.8";

  src = fetchurl {
-    url = "mirror://sourceforge/lgames/${pname}-${version}.tar.gz";
-    hash = "sha256-EpHGpkLQa57hU6wKLnhVosmD6DnGGPGilN8E2ClSXLA=";
+    url = "mirror://sourceforge/lgames/ltris-${finalAttrs.version}.tar.gz";
+    hash = "sha256-2e5haaU2pqkBk82qiF/3HQgSBVPHP09UwW+TQqpGUqA=";
  };

  buildInputs = [
@ -23,17 +23,18 @@ stdenv.mkDerivation rec {
  hardeningDisable = [ "format" ];

  passthru.updateScript = directoryListingUpdater {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    url = "https://lgames.sourceforge.io/LTris/";
    extraRegex = "(?!.*-win(32|64)).*";
  };

-  meta = with lib; {
+  meta = {
    homepage = "https://lgames.sourceforge.io/LTris/";
    description = "Tetris clone from the LGames series";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ciil ];
+    license = with lib.licenses; [ gpl2Plus ];
+    mainProgram = "ltris";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
    inherit (SDL.meta) platforms;
    broken = stdenv.isDarwin;
  };
-}
+})
--- a/pkgs/by-name/lu/ludtwig/package.nix
+++ b/pkgs/by-name/lu/ludtwig/package.nix
@ -2,23 +2,24 @@

 rustPlatform.buildRustPackage rec {
  pname = "ludtwig";
-  version = "0.8.0";
+  version = "0.8.2";

  src = fetchFromGitHub {
    owner = "MalteJanz";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-WF3tEf3SuXiH35Ny4RGLzvEW7yMsFcnVTX52e5qvK5g=";
+    hash = "sha256-nNr0iis+wBd+xKJYQL7OWlQnU1DhKztsPHCq3+tX79w=";
  };

  checkType = "debug";

-  cargoHash = "sha256-AbT8Jv6v7EVPX5mIplKaBkGrVonA8YWlMvo46coFMzk=";
+  cargoHash = "sha256-Utho/foZOPz5K3WrOZjAkxvw7+J0RtbW0xvw/Txu/xk=";

  meta = with lib; {
-    description = "Linter / Formatter for Twig template files which respects HTML and your time.";
+    description = "Linter / Formatter for Twig template files which respects HTML and your time";
    homepage = "https://github.com/MalteJanz/ludtwig";
    license = licenses.mit;
-    maintainers = with maintainers; [ shyim ];
+    maintainers = with maintainers; [ shyim maltejanz ];
+    mainProgram = "ludtwig";
  };
 }
--- a/pkgs/development/tools/documentation/mdsh/default.nix
+++ b/pkgs/development/tools/documentation/mdsh/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdsh";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "zimbatm";
    repo = "mdsh";
    rev = "v${version}";
-    hash = "sha256-Y8ss/aw01zpgM6Z6fCGshP21kcdSOTVG/VqL8H3tlls=";
+    hash = "sha256-ammLbKEKXDSuZMr4DwPpcRSkKh7BzNC+4ZRCqTNNCQk=";
  };

-  cargoSha256 = "sha256-8o4gN6mqUU+o80IqlAYAD5qpZBSQ/FY5HoNbpwzTm0A=";
+  cargoHash = "sha256-wLHMccxk3ceZyGK27t5Kyal48yj9dQNgmEHjH9hR9Pc=";

  meta = with lib; {
    description = "Markdown shell pre-processor";
--- a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
@ -1 +1 @@
-2024-01-31
+2024-03-01
--- a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
@ -8,8 +8,8 @@ mkDerivation {
  pname = "nixfmt";
  version = "0.5.0";
  src = fetchzip {
-    url = "https://github.com/piegamesde/nixfmt/archive/d6930fd0c62c4d7ec9e4a814adc3d2f590d96271.tar.gz";
-    sha256 = "1ijrdzdwricv4asmy296j7gzvhambv96nlxi3qrxb4lj1by6a34m";
+    url = "https://github.com/piegamesde/nixfmt/archive/2b5ee820690bae64cb4003e46917ae43541e3e0b.tar.gz";
+    sha256 = "1i1jbc1q4gd7fpilwy6s3a583yl5l8d8rlmipygj61mpclg9ihqg";
  };
  isLibrary = true;
  isExecutable = true;
--- a/pkgs/by-name/op/opengist/package.nix
+++ b/pkgs/by-name/op/opengist/package.nix
@ -0,0 +1,70 @@
+{ lib, buildGoModule, buildNpmPackage, fetchFromGitHub, moreutils, jq, git }:
+let
+  # finalAttrs when 🥺 (buildGoModule does not support them)
+  # https://github.com/NixOS/nixpkgs/issues/273815
+  version = "1.6.1";
+  src = fetchFromGitHub {
+    owner = "thomiceli";
+    repo = "opengist";
+    rev = "v${version}";
+    hash = "sha256-rJ8oiH08kSSFNgPHKGo68Oi1i3L1SEJyHuzoxKMOZME=";
+  };
+
+  frontend = buildNpmPackage {
+    pname = "opengist-frontend";
+    inherit version src;
+
+    nativeBuildInputs = [ moreutils jq ];
+
+    # npm complains of "invalid package". shrug. we can give it a version.
+    preBuild = ''
+      jq '.version = "${version}"' package.json | sponge package.json
+    '';
+
+    # copy pasta from the Makefile upstream, seems to be a workaround of sass
+    # issues, unsure why it is not done in vite:
+    # https://github.com/thomiceli/opengist/blob/05eccfa8e728335514a40476cd8116cfd1ca61dd/Makefile#L16-L19
+    postBuild = ''
+      EMBED=1 npx postcss 'public/assets/embed-*.css' -c public/postcss.config.js --replace
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -R public $out
+    '';
+
+    npmDepsHash = "sha256-Sy321tIQOOrypk+EOGGixEzrPdhA9U8Hak+DOS+d00A=";
+  };
+in
+buildGoModule {
+  pname = "opengist";
+  inherit version src;
+  vendorHash = "sha256-IorqXJKzUTUL5zfKRipZaJtRlwVOmTwolJXFG/34Ais=";
+  tags = [
+    "fs_embed"
+  ];
+
+  # required for tests
+  nativeCheckInputs = [
+    git
+  ];
+
+  # required for tests to not try to write into $HOME and fail
+  preCheck = ''
+    export OG_OPENGIST_HOME=$(mktemp -d)
+  '';
+
+  postPatch = ''
+    cp -R ${frontend}/public/{manifest.json,assets} public/
+  '';
+
+  passthru.frontend = frontend;
+
+  meta = {
+    description = "Self-hosted pastebin powered by Git";
+    homepage = "https://github.com/thomiceli/opengist";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ lf- ];
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/applications/audio/ptcollab/default.nix
+++ b/pkgs/applications/audio/ptcollab/default.nix
@ -1,40 +1,39 @@
-{ mkDerivation
+{ stdenv
 , lib
-, stdenv
 , fetchFromGitHub
 , nix-update-script
+, libsForQt5
 , libvorbis
 , pkg-config
-, qmake
-, qtbase
-, qttools
-, qtmultimedia
 , rtmidi
 }:

-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "ptcollab";
-  version = "0.6.4.7";
+  version = "0.6.4.8";

  src = fetchFromGitHub {
    owner = "yuxshao";
    repo = "ptcollab";
-    rev = "v${version}";
-    hash = "sha256-KYNov/HbKM2d8VVO8iyWA3XWFDE9iWeKkRCNC1xlPNw=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-9u2K79QJRfYKL66e1lsRrQMEqmKTWbK+ucal3/u4rP4=";
  };

  nativeBuildInputs = [
    pkg-config
+  ] ++ (with libsForQt5; [
    qmake
    qttools
-  ];
+    wrapQtAppsHook
+  ]);

  buildInputs = [
    libvorbis
+    rtmidi
+  ] ++ (with libsForQt5; [
    qtbase
    qtmultimedia
-    rtmidi
-  ];
+  ]);

  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
    # Move appbundles to Applications before wrapping happens
@ -54,8 +53,9 @@ mkDerivation rec {
  meta = with lib; {
    description = "Experimental pxtone editor where you can collaborate with friends";
    homepage = "https://yuxshao.github.io/ptcollab/";
+    changelog = "https://github.com/yuxshao/ptcollab/releases/tag/v${finalAttrs.version}";
    license = licenses.mit;
    maintainers = with maintainers; [ OPNA2608 ];
    platforms = platforms.all;
  };
-}
+})
--- a/pkgs/by-name/rs/rsgain/package.nix
+++ b/pkgs/by-name/rs/rsgain/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
    pname = "rsgain";
-    version = "3.4";
+    version = "3.5";

    src = fetchFromGitHub {
      owner = "complexlogic";
      repo = "rsgain";
      rev = "v${version}";
-      sha256 = "sha256-AiNjsrwTF6emcwXo2TPMbs8mLavGS7NsvytAppMGKfY=";
+      sha256 = "sha256-qIRtdgfGDNbZk9TQ3GC3lYetRqjOk8QPhAb4MuFuN0U=";
    };

    cmakeFlags = ["-DCMAKE_BUILD_TYPE='Release'"];
--- a/pkgs/by-name/sp/spotifywm/package.nix
+++ b/pkgs/by-name/sp/spotifywm/package.nix
@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libX11,
+  lndir,
+  makeBinaryWrapper,
+  spotify,
+}:
+stdenv.mkDerivation {
+  pname = "spotifywm";
+  version = "0-unstable-2022-10-25";
+
+  src = fetchFromGitHub {
+    owner = "dasJ";
+    repo = "spotifywm";
+    rev = "8624f539549973c124ed18753881045968881745";
+    hash = "sha256-AsXqcoqUXUFxTG+G+31lm45gjP6qGohEnUSUtKypew0=";
+  };
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    lndir
+  ];
+
+  buildInputs = [ libX11 ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+
+    lndir -silent ${spotify} $out
+
+    install -Dm644 spotifywm.so $out/lib/spotifywm.so
+
+    wrapProgram $out/bin/spotify \
+      --suffix LD_PRELOAD : "$out/lib/spotifywm.so"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/dasJ/spotifywm";
+    description = "Wrapper around Spotify that correctly sets class name before opening the window";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ jqueiroz the-argus ];
+    mainProgram = "spotify";
+  };
+}
--- a/pkgs/by-name/ti/tippecanoe/package.nix
+++ b/pkgs/by-name/ti/tippecanoe/package.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tippecanoe";
-  version = "2.46.0";
+  version = "2.47.0";

  src = fetchFromGitHub {
    owner = "felt";
    repo = "tippecanoe";
    rev = finalAttrs.version;
-    hash = "sha256-UsQb90DKK05JByF3rh6kcvSaugEemU2Gg4c/owImNVs=";
+    hash = "sha256-tkecrbrkwYJU0eZMzU+7rJGAn+S/vnh/rw5co0x1m5M=";
  };

  buildInputs = [ sqlite zlib ];
@ -32,5 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = licenses.bsd2;
    maintainers = with maintainers; [ sikmir ];
    platforms = platforms.unix;
+    mainProgram = "tippecanoe";
  };
 })
--- a/pkgs/by-name/tr/transfer-sh/package.nix
+++ b/pkgs/by-name/tr/transfer-sh/package.nix
@ -0,0 +1,36 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, nix-update-script
+, nixosTests
+}:
+
+buildGoModule rec {
+  pname = "transfer-sh";
+  version = "1.6.1";
+
+  src = fetchFromGitHub {
+    owner = "dutchcoders";
+    repo = "transfer.sh";
+    rev = "v${version}";
+    hash = "sha256-V8E6RwzxKB6KeGPer5074e7y6XHn3ZD24PQMwTxw5lQ=";
+  };
+
+  vendorHash = "sha256-C8ZfUIGT9HiQQiJ2hk18uwGaQzNCIKp/Jiz6ePZkgDQ=";
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) transfer-sh;
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    description = "Easy and fast file sharing and pastebin server with access from the command-line";
+    homepage = "https://github.com/dutchcoders/transfer.sh";
+    changelog = "https://github.com/dutchcoders/transfer.sh/releases";
+    mainProgram = "transfer.sh";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ocfox pinpox ];
+  };
+}
--- a/pkgs/by-name/vi/virtio-win/package.nix
+++ b/pkgs/by-name/vi/virtio-win/package.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "virtio-win";
-  version = "0.1.240-1";
+  version = "0.1.248-1";

  src = fetchurl {
    url = "https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-${version}/virtio-win.iso";
-    hash = "sha256-69SCWGaPf3jgJu0nbCip0Z2D4CD/oICtaZENyGu8vMY=";
+    hash = "sha256-1bVznPKX8FONJj4wZ41aCbukcKfGvL2N/3TkQVPxZUk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/wa/waycheck/package.nix
+++ b/pkgs/by-name/wa/waycheck/package.nix
@ -12,14 +12,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "waycheck";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "serebit";
    repo = "waycheck";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-y8fuy2ed2yPRiqusMZBD7mzFBDavmdByBzEaI6P5byk=";
+    hash = "sha256-kwkdTMA15oJHz9AXEkBGeuzYdEUpNuv/xnhzoKOHCE4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@ -0,0 +1,40 @@
+{ lib, buildGraalvmNativeImage, fetchurl }:
+
+buildGraalvmNativeImage rec {
+  pname = "yamlscript";
+  version = "0.1.38";
+
+  src = fetchurl {
+    url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
+    hash = "sha256-cdRMmeJTlkEmF4jbElrXgobSU+VIvh/k9Lr9WkOSTl8=";
+  };
+
+  executable = "ys";
+
+  extraNativeImageBuildArgs = [
+    "--native-image-info"
+    "--no-fallback"
+    "--initialize-at-build-time"
+    "--enable-preview"
+    "-H:+ReportExceptionStackTraces"
+    "-H:IncludeResources=SCI_VERSION"
+    "-H:Log=registerResource:"
+    "-J-Dclojure.spec.skip-macros=true"
+    "-J-Dclojure.compiler.direct-linking=true"
+  ];
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    $out/bin/ys  -e 'say: (+ 1 2)' | fgrep 3
+  '';
+
+  meta = with lib; {
+    description = "Programming in YAML";
+    homepage = "https://github.com/yaml/yamlscript";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    license = licenses.mit;
+    mainProgram = "ys";
+    maintainers = with maintainers; [ sgo ];
+  };
+}
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@ -24,12 +24,12 @@ let
      sha256 = "189gjqzdz10xh3ybiy4ch1r98bsmkcb4hpnrmggd4y2g5kqnyx4y";
    };

-    "2.4.0" = {
-      sha256 = "sha256-g9i3TwjSJUxZuXkLwfZp4JCZRXuIRyDs7L9F9LRtF3Y=";
-    };
    "2.4.1" = {
      sha256 = "sha256-2k+UhvrUE9OversbCSaTJf20v/fnuI8hld3udDJjz34=";
    };
+    "2.4.2" = {
+      sha256 = "sha256-/APLUtEqr+h1nmMoRQogG73fibFwcaToPznoC0Pd7w8=";
+    };
  };
  # Collection of pre-built SBCL binaries for platforms that need them for
  # bootstrapping. Ideally these are to be avoided.  If CLISP (or any other
@ -96,10 +96,9 @@ stdenv.mkDerivation (self: rec {
  );
  buildInputs = lib.optionals coreCompression [ zstd ];

-  patches = [
+  patches = lib.optionals (lib.versionOlder self.version "2.4.2") [
+    # Fixed in 2.4.2
    ./search-for-binaries-in-PATH.patch
-  ] ++ lib.optionals (version == "2.4.0") [
-    ./fix-2.4.0-aarch64-darwin.patch
  ];

  # I don’t know why these are failing (on ofBorg), and I’d rather just disable
--- a/pkgs/development/libraries/CGAL/default.nix
+++ b/pkgs/development/libraries/CGAL/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "cgal";
-  version = "5.5.3";
+  version = "5.6.1";

  src = fetchurl {
    url = "https://github.com/CGAL/cgal/releases/download/v${version}/CGAL-${version}.tar.xz";
-    hash = "sha256-CgT2YmkyVjKLBbq/q7XjpbfbL1pY1S48Ug350IKN3XM=";
+    hash = "sha256-zbFefuMeBmNYnTEHp5mIo3t7FxnfPSTyBYVF0bzdWDc=";
  };

  # note: optional component libCGAL_ImageIO would need zlib and opengl;
--- a/pkgs/development/libraries/audio/vamp-plugin-sdk/default.nix
+++ b/pkgs/development/libraries/audio/vamp-plugin-sdk/default.nix
@ -8,10 +8,10 @@ stdenv.mkDerivation rec {
  version = "2.10";

  src = fetchFromGitHub {
-    owner = "c4dm";
+    owner = "vamp-plugins";
    repo = "vamp-plugin-sdk";
    rev = "vamp-plugin-sdk-v${version}";
-    sha256 = "1lhmskcyk7qqfikmasiw7wjry74gc8g5q6a3j1iya84yd7ll0cz6";
+    hash = "sha256-5jNA6WmeIOVjkEMZXB5ijxyfJT88alVndBif6dnUFdI=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/development/libraries/libime/default.nix
+++ b/pkgs/development/libraries/libime/default.nix
@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "libime";
-  version = "1.1.5";
+  version = "1.1.6";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = "libime";
    rev = version;
-    hash = "sha256-AvlQOpjrHSifUtWSTft2bywlWhwka26VcqqReqAlcv8=";
+    hash = "sha256-PhzJtAGmSkMeXMSe2uR/JKHKlZtL0e3tPDZVoRCvAis=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/libraries/nng/default.nix
+++ b/pkgs/development/libraries/nng/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "nng";
-  version = "1.7.2";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "nanomsg";
    repo = "nng";
    rev = "v${version}";
-    hash = "sha256-CG6Gw/Qrbi96koF2VxKMYPMPT2Zj9U97vNk2JdrfRro=";
+    hash = "sha256-oP7hO3wCXNPW7877wK+HpGsw7j+U0q4i8aTRVi1v0r0=";
  };

  nativeBuildInputs = [ cmake ninja ]
--- a/pkgs/development/libraries/unixODBCDrivers/default.nix
+++ b/pkgs/development/libraries/unixODBCDrivers/default.nix
@ -43,13 +43,13 @@

  mariadb = stdenv.mkDerivation rec {
    pname = "mariadb-connector-odbc";
-    version = "3.1.14";
+    version = "3.1.20";

    src = fetchFromGitHub {
      owner = "mariadb-corporation";
      repo = "mariadb-connector-odbc";
      rev = version;
-      sha256 = "0wvy6m9qfvjii3kanf2d1rhfaww32kg0d7m57643f79qb05gd6vg";
+      hash = "sha256-l+HlS7/A0shwsEXYKDhi+QCmwHaMTeKrtcvo9yYpYws=";
      # this driver only seems to build correctly when built against the mariadb-connect-c subrepo
      # (see https://github.com/NixOS/nixpkgs/issues/73258)
      fetchSubmodules = true;
--- a/pkgs/development/libraries/xcb-imdkit/default.nix
+++ b/pkgs/development/libraries/xcb-imdkit/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "xcb-imdkit";
-  version = "1.0.6";
+  version = "1.0.7";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = "xcb-imdkit";
    rev = version;
-    sha256 = "sha256-1+x4KE2xh6KWbdCBlPxDvHvcKUEj4hiW4fEPCeYfTwc=";
+    sha256 = "sha256-trfKWCMIuYV0XyCcIsNP8LCTc0MYotXvslRvp76YnKU=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/zlog/default.nix
+++ b/pkgs/development/libraries/zlog/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:

 stdenv.mkDerivation rec {
  version = "1.2.17";
@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-ckpDMRLxObpl8N539DC5u2bPpmD7jM+KugurUfta6tg=";
  };

+  patches = [
+    (fetchpatch {
+      name = "CVE-2024-22857.patch";
+      url = "https://github.com/HardySimpson/zlog/commit/c47f781a9f1e9604f5201e27d046d925d0d48ac4.patch";
+      hash = "sha256-3FAAHJ2R/OpNpErWXptjEh0x370/jzvK2VhuUuyaOjE=";
+    })
+  ];
+
  makeFlags = [ "PREFIX=${placeholder "out"}" ];

  meta = with lib; {
--- a/pkgs/development/php-packages/psalm/composer.lock
+++ b/pkgs/development/php-packages/psalm/composer.lock
@ -1192,46 +1192,47 @@
        },
        {
            "name": "symfony/console",
-            "version": "v7.0.3",
+            "version": "v6.4.4",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/console.git",
-                "reference": "c5010d50f1ee4b25cfa0201d9915cf1b14071456"
+                "reference": "0d9e4eb5ad413075624378f474c4167ea202de78"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/c5010d50f1ee4b25cfa0201d9915cf1b14071456",
-                "reference": "c5010d50f1ee4b25cfa0201d9915cf1b14071456",
+                "url": "https://api.github.com/repos/symfony/console/zipball/0d9e4eb5ad413075624378f474c4167ea202de78",
+                "reference": "0d9e4eb5ad413075624378f474c4167ea202de78",
                "shasum": ""
            },
            "require": {
-                "php": ">=8.2",
+                "php": ">=8.1",
+                "symfony/deprecation-contracts": "^2.5|^3",
                "symfony/polyfill-mbstring": "~1.0",
                "symfony/service-contracts": "^2.5|^3",
-                "symfony/string": "^6.4|^7.0"
+                "symfony/string": "^5.4|^6.0|^7.0"
            },
            "conflict": {
-                "symfony/dependency-injection": "<6.4",
-                "symfony/dotenv": "<6.4",
-                "symfony/event-dispatcher": "<6.4",
-                "symfony/lock": "<6.4",
-                "symfony/process": "<6.4"
+                "symfony/dependency-injection": "<5.4",
+                "symfony/dotenv": "<5.4",
+                "symfony/event-dispatcher": "<5.4",
+                "symfony/lock": "<5.4",
+                "symfony/process": "<5.4"
            },
            "provide": {
                "psr/log-implementation": "1.0|2.0|3.0"
            },
            "require-dev": {
                "psr/log": "^1|^2|^3",
-                "symfony/config": "^6.4|^7.0",
-                "symfony/dependency-injection": "^6.4|^7.0",
-                "symfony/event-dispatcher": "^6.4|^7.0",
+                "symfony/config": "^5.4|^6.0|^7.0",
+                "symfony/dependency-injection": "^5.4|^6.0|^7.0",
+                "symfony/event-dispatcher": "^5.4|^6.0|^7.0",
                "symfony/http-foundation": "^6.4|^7.0",
                "symfony/http-kernel": "^6.4|^7.0",
-                "symfony/lock": "^6.4|^7.0",
-                "symfony/messenger": "^6.4|^7.0",
-                "symfony/process": "^6.4|^7.0",
-                "symfony/stopwatch": "^6.4|^7.0",
-                "symfony/var-dumper": "^6.4|^7.0"
+                "symfony/lock": "^5.4|^6.0|^7.0",
+                "symfony/messenger": "^5.4|^6.0|^7.0",
+                "symfony/process": "^5.4|^6.0|^7.0",
+                "symfony/stopwatch": "^5.4|^6.0|^7.0",
+                "symfony/var-dumper": "^5.4|^6.0|^7.0"
            },
            "type": "library",
            "autoload": {
@ -1265,7 +1266,7 @@
                "terminal"
            ],
            "support": {
-                "source": "https://github.com/symfony/console/tree/v7.0.3"
+                "source": "https://github.com/symfony/console/tree/v6.4.4"
            },
            "funding": [
                {
@ -1281,24 +1282,91 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2024-01-23T15:02:46+00:00"
+            "time": "2024-02-22T20:27:10+00:00"
        },
        {
-            "name": "symfony/filesystem",
-            "version": "v7.0.3",
+            "name": "symfony/deprecation-contracts",
+            "version": "v3.4.0",
            "source": {
                "type": "git",
-                "url": "https://github.com/symfony/filesystem.git",
-                "reference": "2890e3a825bc0c0558526c04499c13f83e1b6b12"
+                "url": "https://github.com/symfony/deprecation-contracts.git",
+                "reference": "7c3aff79d10325257a001fcf92d991f24fc967cf"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/filesystem/zipball/2890e3a825bc0c0558526c04499c13f83e1b6b12",
-                "reference": "2890e3a825bc0c0558526c04499c13f83e1b6b12",
+                "url": "https://api.github.com/repos/symfony/deprecation-contracts/zipball/7c3aff79d10325257a001fcf92d991f24fc967cf",
+                "reference": "7c3aff79d10325257a001fcf92d991f24fc967cf",
                "shasum": ""
            },
            "require": {
-                "php": ">=8.2",
+                "php": ">=8.1"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "3.4-dev"
+                },
+                "thanks": {
+                    "name": "symfony/contracts",
+                    "url": "https://github.com/symfony/contracts"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "function.php"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "A generic function and convention to trigger deprecation notices",
+            "homepage": "https://symfony.com",
+            "support": {
+                "source": "https://github.com/symfony/deprecation-contracts/tree/v3.4.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2023-05-23T14:45:45+00:00"
+        },
+        {
+            "name": "symfony/filesystem",
+            "version": "v6.4.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/filesystem.git",
+                "reference": "7f3b1755eb49297a0827a7575d5d2b2fd11cc9fb"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/filesystem/zipball/7f3b1755eb49297a0827a7575d5d2b2fd11cc9fb",
+                "reference": "7f3b1755eb49297a0827a7575d5d2b2fd11cc9fb",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1",
                "symfony/polyfill-ctype": "~1.8",
                "symfony/polyfill-mbstring": "~1.8"
            },
@ -1328,7 +1396,7 @@
            "description": "Provides basic utilities for the filesystem",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/filesystem/tree/v7.0.3"
+                "source": "https://github.com/symfony/filesystem/tree/v6.4.3"
            },
            "funding": [
                {
@ -1344,7 +1412,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2024-01-23T15:02:46+00:00"
+            "time": "2024-01-23T14:51:35+00:00"
        },
        {
            "name": "symfony/polyfill-ctype",
@ -1748,20 +1816,20 @@
        },
        {
            "name": "symfony/string",
-            "version": "v7.0.3",
+            "version": "v6.4.4",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/string.git",
-                "reference": "524aac4a280b90a4420d8d6a040718d0586505ac"
+                "reference": "4e465a95bdc32f49cf4c7f07f751b843bbd6dcd9"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/string/zipball/524aac4a280b90a4420d8d6a040718d0586505ac",
-                "reference": "524aac4a280b90a4420d8d6a040718d0586505ac",
+                "url": "https://api.github.com/repos/symfony/string/zipball/4e465a95bdc32f49cf4c7f07f751b843bbd6dcd9",
+                "reference": "4e465a95bdc32f49cf4c7f07f751b843bbd6dcd9",
                "shasum": ""
            },
            "require": {
-                "php": ">=8.2",
+                "php": ">=8.1",
                "symfony/polyfill-ctype": "~1.8",
                "symfony/polyfill-intl-grapheme": "~1.0",
                "symfony/polyfill-intl-normalizer": "~1.0",
@ -1771,11 +1839,11 @@
                "symfony/translation-contracts": "<2.5"
            },
            "require-dev": {
-                "symfony/error-handler": "^6.4|^7.0",
-                "symfony/http-client": "^6.4|^7.0",
-                "symfony/intl": "^6.4|^7.0",
+                "symfony/error-handler": "^5.4|^6.0|^7.0",
+                "symfony/http-client": "^5.4|^6.0|^7.0",
+                "symfony/intl": "^6.2|^7.0",
                "symfony/translation-contracts": "^2.5|^3.0",
-                "symfony/var-exporter": "^6.4|^7.0"
+                "symfony/var-exporter": "^5.4|^6.0|^7.0"
            },
            "type": "library",
            "autoload": {
@ -1814,7 +1882,7 @@
                "utf8"
            ],
            "support": {
-                "source": "https://github.com/symfony/string/tree/v7.0.3"
+                "source": "https://github.com/symfony/string/tree/v6.4.4"
            },
            "funding": [
                {
@ -1830,7 +1898,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2024-01-29T15:41:16+00:00"
+            "time": "2024-02-01T13:16:41+00:00"
        },
        {
            "name": "webmozart/assert",
@ -4448,20 +4516,20 @@
        },
        {
            "name": "symfony/process",
-            "version": "v7.0.3",
+            "version": "v6.4.4",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/process.git",
-                "reference": "937a195147e0c27b2759ade834169ed006d0bc74"
+                "reference": "710e27879e9be3395de2b98da3f52a946039f297"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/process/zipball/937a195147e0c27b2759ade834169ed006d0bc74",
-                "reference": "937a195147e0c27b2759ade834169ed006d0bc74",
+                "url": "https://api.github.com/repos/symfony/process/zipball/710e27879e9be3395de2b98da3f52a946039f297",
+                "reference": "710e27879e9be3395de2b98da3f52a946039f297",
                "shasum": ""
            },
            "require": {
-                "php": ">=8.2"
+                "php": ">=8.1"
            },
            "type": "library",
            "autoload": {
@ -4489,7 +4557,7 @@
            "description": "Executes commands in sub-processes",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/process/tree/v7.0.3"
+                "source": "https://github.com/symfony/process/tree/v6.4.4"
            },
            "funding": [
                {
@ -4505,7 +4573,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2024-01-23T15:02:46+00:00"
+            "time": "2024-02-20T12:31:00+00:00"
        },
        {
            "name": "theseer/tokenizer",
--- a/pkgs/development/php-packages/psalm/default.nix
+++ b/pkgs/development/php-packages/psalm/default.nix
@ -17,7 +17,7 @@ php.buildComposerProject (finalAttrs: {
  # Missing `composer.lock` from the repository.
  # Issue open at https://github.com/vimeo/psalm/issues/10446
  composerLock = ./composer.lock;
-  vendorHash = "sha256-URPyV1V/8BP8fbJqyYLf+XKG786hY2BbAzUphzPyPCs=";
+  vendorHash = "sha256-AgvAaHcCYosS3yRrp9EFdqTjg6NzQRCr8ELSza9DvZ8=";

  meta = {
    changelog = "https://github.com/vimeo/psalm/releases/tag/${finalAttrs.version}";
--- a/pkgs/development/python-modules/aioairzone-cloud/default.nix
+++ b/pkgs/development/python-modules/aioairzone-cloud/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "aioairzone-cloud";
-  version = "0.3.8";
+  version = "0.4.5";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "Noltari";
    repo = "aioairzone-cloud";
    rev = "refs/tags/${version}";
-    hash = "sha256-h9WUHehTXg73qqpw+sMxoQMzOV+io2GvjwXlr4gF2ns=";
+    hash = "sha256-G+tzA4VEdpRFVouj8Uv7BJLgSTOO5eKkNntVL1bIzXY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aioautomower/default.nix
+++ b/pkgs/development/python-modules/aioautomower/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "aioautomower";
-  version = "2024.2.9";
+  version = "2024.2.10";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "Thomas55555";
    repo = "aioautomower";
    rev = "refs/tags/${version}";
-    hash = "sha256-vjg7y+9E4R1Q7h+ao/ttuRbvui4u5hESR8tImWSO04U=";
+    hash = "sha256-NRcLyuU5FFIKJALUrx5iVSihzgO6ljqaqlhbs+y2E4Q=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/aiomysensors/default.nix
+++ b/pkgs/development/python-modules/aiomysensors/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "aiomysensors";
-  version = "0.3.12";
+  version = "0.3.13";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "MartinHjelmare";
    repo = "aiomysensors";
    rev = "refs/tags/v${version}";
-    hash = "sha256-9M5WuBoezbZr7OwJaM0m2CqibziJVwqANGOhiJrqfxA=";
+    hash = "sha256-2i2QodEWOZ/nih6ap5ovWuKxILB5arusnqOiOlb4xWM=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/aiounittest/default.nix
+++ b/pkgs/development/python-modules/aiounittest/default.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , pythonAtLeast
 , setuptools
-, nose
+, pynose
 , coverage
 , wrapt
 }:
@ -13,9 +13,6 @@ buildPythonPackage rec {
  version = "1.4.2";
  pyproject = true;

-  # requires the imp module
-  disabled = pythonAtLeast "3.12";
-
  src = fetchFromGitHub {
    owner = "kwarunek";
    repo = pname;
@ -32,12 +29,12 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
-    nose
+    pynose
    coverage
  ];

  checkPhase = ''
-    nosetests
+    nosetests -e test_specific_test
  '';

  pythonImportsCheck = [ "aiounittest" ];
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -365,14 +365,14 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.34.52";
+  version = "1.34.53";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-gjxBBZ+DbWh32qocvSD4E8jxp4uf3ykLwLhTEn4Se6M=";
+    hash = "sha256-/zGbNI+nsNbkD2hTeClyZvk5A4wG0E4JGKpazy5TLCw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.34.52";
+  version = "1.34.53";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-pRtsofyprNqp6AQS83FTaQ//rX7SJ3Q8xTCAmSDSoAk=";
+    hash = "sha256-41fme2SpxtfeEOdmzSxmWJJkJXRG26bl7hwt/Ltjvlw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
+++ b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
@ -23,7 +23,7 @@

 buildPythonPackage rec {
  pname = "cyclonedx-python-lib";
-  version = "6.4.1";
+  version = "6.4.2";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -32,7 +32,7 @@ buildPythonPackage rec {
    owner = "CycloneDX";
    repo = "cyclonedx-python-lib";
    rev = "refs/tags/v${version}";
-    hash = "sha256-IhiH1Vk/Wf6cTxijxE1erkQozY+vOVd5pu6tAVUoDJM=";
+    hash = "sha256-uDppmYJiQt2Yix5vaWYqMDbPcHOEPz2pBK11lUZ54fI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/fairseq/default.nix
+++ b/pkgs/development/python-modules/fairseq/default.nix
@ -96,6 +96,7 @@ buildPythonPackage rec {
  disabledTests = [
    # this test requires xformers
    "test_xformers_single_forward_parity"
+    "test_mask_for_xformers"
    # this test requires iopath
    "test_file_io_async"
    # these tests require network access
@ -105,6 +106,8 @@ buildPythonPackage rec {
    "test_waitk_checkpoint"
    "test_sotasty_es_en_600m_checkpoint"
    "test_librispeech_s2t_conformer_s_checkpoint"
+    # TODO research failure
+    "test_multilingual_translation_latent_depth"
  ];

  disabledTestPaths = [
@ -117,6 +120,7 @@ buildPythonPackage rec {
    homepage = "https://github.com/pytorch/fairseq";
    license = licenses.mit;
    platforms = platforms.linux;
+    hydraPlatforms = [];
    maintainers = with maintainers; [ happysalada ];
  };
 }
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "huggingface-hub";
-  version = "0.21.2";
+  version = "0.21.3";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "huggingface";
    repo = "huggingface_hub";
    rev = "refs/tags/v${version}";
-    hash = "sha256-0Nr6qs9rzuBQo8SGuQ2Ai2Q+E+Gs4DT/AMrYf7dYM/E=";
+    hash = "sha256-DtKb/mR01vifclDalZiZV4/A4XpTKBcT9bCiLZkRCZY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/jaxtyping/default.nix
+++ b/pkgs/development/python-modules/jaxtyping/default.nix
@ -3,6 +3,7 @@
 , pythonOlder
 , fetchFromGitHub
 , hatchling
+, pythonRelaxDepsHook
 , numpy
 , typeguard
 , typing-extensions
@ -19,7 +20,7 @@
 let
  self = buildPythonPackage rec {
    pname = "jaxtyping";
-    version = "0.2.25";
+    version = "0.2.26";
    pyproject = true;

    disabled = pythonOlder "3.9";
@ -28,16 +29,12 @@ let
      owner = "google";
      repo = "jaxtyping";
      rev = "refs/tags/v${version}";
-      hash = "sha256-+JqpI5xrM7o73LG6oMix88Jr5aptmWYjJQcqUNo7icg=";
+      hash = "sha256-2QDTRNH2/9FPU5xrQx7yZRHwEWqj0PUNzcCuKwY4yNg=";
    };

-    postPatch = ''
-      substituteInPlace pyproject.toml \
-        --replace "typeguard>=2.13.3,<3" "typeguard"
-    '';
-
    nativeBuildInputs = [
      hatchling
+      pythonRelaxDepsHook
    ];

    propagatedBuildInputs = [
@ -46,6 +43,10 @@ let
      typing-extensions
    ];

+    pythonRelaxDeps = [
+      "typeguard"
+    ];
+
    nativeCheckInputs = [
      cloudpickle
      equinox
--- a/pkgs/development/python-modules/mmengine/default.nix
+++ b/pkgs/development/python-modules/mmengine/default.nix
@ -69,6 +69,10 @@ buildPythonPackage rec {
  disabledTestPaths = [
    # AttributeError
    "tests/test_fileio/test_backends/test_petrel_backend.py"
+    # Freezes forever?
+    "tests/test_runner/test_activation_checkpointing.py"
+    # missing dependencies
+    "tests/test_visualizer/test_vis_backend.py"
  ];

  disabledTests = [
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "openai";
-  version = "1.13.2";
+  version = "1.13.3";
  pyproject = true;

  disabled = pythonOlder "3.7.1";
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "openai";
    repo = "openai-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-3otPmMVV/Wx7k/oec5c1r6GcZGzhMSKifJB8S5nBSZw=";
+    hash = "sha256-8SHXUrPLZ7lgvB0jqZlcvKq5Zv2d2UqXjJpgiBpR8P8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/py-serializable/default.nix
+++ b/pkgs/development/python-modules/py-serializable/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "py-serializable";
-  version = "1.0.1";
+  version = "1.0.2";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "madpah";
    repo = "serializable";
    rev = "refs/tags/v${version}";
-    hash = "sha256-OsgFzT5qGyszO4jFYWIAgGY41s0ZBEMwCbWZeY189h4=";
+    hash = "sha256-RhipoPTewPaYwspTnywLr5FvFVUaFixfRQk6aUMvB4w=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyctr/default.nix
+++ b/pkgs/development/python-modules/pyctr/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "pyctr";
-  version = "0.7.4";
+  version = "0.7.5";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-1nPP+rz/8BiFHu3nGcHuqCPwyyR55LUhoBprHFTudWQ=";
+    hash = "sha256-fiDJWcypFabnUoS313f56ypDuDrLASHrkk0Em8bymmw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "pyoverkiz";
-  version = "1.13.7";
+  version = "1.13.8";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "iMicknl";
    repo = "python-overkiz-api";
    rev = "refs/tags/v${version}";
-    hash = "sha256-wH4LCfjnxAwub/BCe27osyJVUZSOMDjjxItv0aEa8Ic=";
+    hash = "sha256-tvS7aPfBTs75Rq1WGslWDMv1pOTVt7MtwpXPRJtqbuk=";
  };

  postPatch = ''
--- a/Show More
+++ b/Show More
 @ -1 +1 @@
 -01-31
 -03-01