Merge master into staging-next

2024-11-11 15:27:20 +03:00 · 2023-01-25 18:01:20 +00:00 · 2023-01-25 18:01:20 +00:00 · a1c257a1c6
commit a1c257a1c6
parent 20df8d00cc 79a606608e
72 changed files with 802 additions and 633 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@ -745,6 +745,15 @@
          been fixed to allow more than one plugin in the path.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          A new option was added to the virtualisation module that
+          enables specifying explicitly named network interfaces in QEMU
+          VMs. The existing <literal>virtualisation.vlans</literal> is
+          still supported for cases where the name of the network
+          interface is irrelevant.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
 </section>
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -187,3 +187,5 @@ In addition to numerous new and upgraded packages, this release has the followin
 - `nixos-version` now accepts `--configuration-revision` to display more information about the current generation revision

 - The option `services.nomad.extraSettingsPlugins` has been fixed to allow more than one plugin in the path.
+
+- A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@ -12,7 +12,9 @@ let
  };


-  vlans = map (m: m.virtualisation.vlans) (lib.attrValues config.nodes);
+  vlans = map (m: (
+    m.virtualisation.vlans ++
+    (lib.mapAttrsToList (_: v: v.vlan) m.virtualisation.interfaces))) (lib.attrValues config.nodes);
  vms = map (m: m.system.build.vm) (lib.attrValues config.nodes);

  nodeHostNames =
--- a/nixos/lib/testing/network.nix
+++ b/nixos/lib/testing/network.nix
@ -18,24 +18,40 @@ let

  networkModule = { config, nodes, pkgs, ... }:
    let
-      interfacesNumbered = zipLists config.virtualisation.vlans (range 1 255);
-      interfaces = forEach interfacesNumbered ({ fst, snd }:
-        nameValuePair "eth${toString snd}" {
-          ipv4.addresses =
-            [{
-              address = "192.168.${toString fst}.${toString config.virtualisation.test.nodeNumber}";
+      qemu-common = import ../qemu-common.nix { inherit lib pkgs; };
+
+      # Convert legacy VLANs to named interfaces and merge with explicit interfaces.
+      vlansNumbered = forEach (zipLists config.virtualisation.vlans (range 1 255)) (v: {
+        name = "eth${toString v.snd}";
+        vlan = v.fst;
+        assignIP = true;
+      });
+      explicitInterfaces = lib.mapAttrsToList (n: v: v // { name = n; }) config.virtualisation.interfaces;
+      interfaces = vlansNumbered ++ explicitInterfaces;
+      interfacesNumbered = zipLists interfaces (range 1 255);
+
+      # Automatically assign IP addresses to requested interfaces.
+      assignIPs = lib.filter (i: i.assignIP) interfaces;
+      ipInterfaces = forEach assignIPs (i:
+        nameValuePair i.name { ipv4.addresses =
+          [ { address = "192.168.${toString i.vlan}.${toString config.virtualisation.test.nodeNumber}";
              prefixLength = 24;
            }];
        });

+      qemuOptions = lib.flatten (forEach interfacesNumbered ({ fst, snd }:
+        qemu-common.qemuNICFlags snd fst.vlan config.virtualisation.test.nodeNumber));
+      udevRules = forEach interfacesNumbered ({ fst, snd }:
+        "SUBSYSTEM==\"net\",ACTION==\"add\",ATTR{address}==\"${qemu-common.qemuNicMac fst.vlan config.virtualisation.test.nodeNumber}\",NAME=\"${fst.name}\"");
+
      networkConfig =
        {
          networking.hostName = mkDefault config.virtualisation.test.nodeName;

-          networking.interfaces = listToAttrs interfaces;
+          networking.interfaces = listToAttrs ipInterfaces;

          networking.primaryIPAddress =
-            optionalString (interfaces != [ ]) (head (head interfaces).value.ipv4.addresses).address;
+            optionalString (ipInterfaces != [ ]) (head (head ipInterfaces).value.ipv4.addresses).address;

          # Put the IP addresses of all VMs in this machine's
          # /etc/hosts file.  If a machine has multiple
@ -51,16 +67,13 @@ let
                    "${config.networking.hostName}.${config.networking.domain} " +
                  "${config.networking.hostName}\n"));

-          virtualisation.qemu.options =
-            let qemu-common = import ../qemu-common.nix { inherit lib pkgs; };
-            in
-            flip concatMap interfacesNumbered
-              ({ fst, snd }: qemu-common.qemuNICFlags snd fst config.virtualisation.test.nodeNumber);
+          virtualisation.qemu.options = qemuOptions;
+          boot.initrd.services.udev.rules = concatMapStrings (x: x + "\n") udevRules;
        };

    in
    {
-      key = "ip-address";
+      key = "network-interfaces";
      config = networkConfig // {
        # Expose the networkConfig items for tests like nixops
        # that need to recreate the network config.
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -545,7 +545,8 @@ in
    virtualisation.vlans =
      mkOption {
        type = types.listOf types.ints.unsigned;
-        default = [ 1 ];
+        default = if config.virtualisation.interfaces == {} then [ 1 ] else [ ];
+        defaultText = lib.literalExpression ''if config.virtualisation.interfaces == {} then [ 1 ] else [ ]'';
        example = [ 1 2 ];
        description =
          lib.mdDoc ''
@ -560,6 +561,35 @@ in
          '';
      };

+    virtualisation.interfaces = mkOption {
+      default = {};
+      example = {
+        enp1s0.vlan = 1;
+      };
+      description = lib.mdDoc ''
+        Network interfaces to add to the VM.
+      '';
+      type = with types; attrsOf (submodule {
+        options = {
+          vlan = mkOption {
+            type = types.ints.unsigned;
+            description = lib.mdDoc ''
+              VLAN to which the network interface is connected.
+            '';
+          };
+
+          assignIP = mkOption {
+            type = types.bool;
+            default = false;
+            description = lib.mdDoc ''
+              Automatically assign an IP address to the network interface using the same scheme as
+              virtualisation.vlans.
+            '';
+          };
+        };
+      });
+    };
+
    virtualisation.writableStore =
      mkOption {
        type = types.bool;
--- a/nixos/tests/installed-tests/fwupd.nix
+++ b/nixos/tests/installed-tests/fwupd.nix
@ -5,7 +5,7 @@ makeInstalledTest {

  testConfig = {
    services.fwupd.enable = true;
-    services.fwupd.disabledPlugins = lib.mkForce []; # don't disable test plugin
+    services.fwupd.daemonSettings.DisabledPlugins = lib.mkForce [ ]; # don't disable test plugin
    services.fwupd.enableTestRemote = true;
  };
 }
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@ -93,18 +93,19 @@ let
      name = "Static";
      nodes.router = router;
      nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
          defaultGateway = "192.168.1.1";
          defaultGateway6 = "fd00:1234:5678:1::1";
-          interfaces.eth1.ipv4.addresses = mkOverride 0 [
+          interfaces.enp1s0.ipv4.addresses = [
            { address = "192.168.1.2"; prefixLength = 24; }
            { address = "192.168.1.3"; prefixLength = 32; }
            { address = "192.168.1.10"; prefixLength = 32; }
          ];
-          interfaces.eth2.ipv4.addresses = mkOverride 0 [
+          interfaces.enp2s0.ipv4.addresses = [
            { address = "192.168.2.2"; prefixLength = 24; }
          ];
        };
@ -170,12 +171,12 @@ let
        # Disable test driver default config
        networking.interfaces = lib.mkForce {};
        networking.useNetworkd = networkd;
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
      };
      testScript = ''
        start_all()
        client.wait_for_unit("multi-user.target")
-        client.wait_until_succeeds("ip addr show dev eth1 | grep '192.168.1'")
+        client.wait_until_succeeds("ip addr show dev enp1s0 | grep '192.168.1'")
        client.shell_interact()
        client.succeed("ping -c 1 192.168.1.1")
        router.succeed("ping -c 1 192.168.1.1")
@ -187,20 +188,13 @@ let
      name = "SimpleDHCP";
      nodes.router = router;
      nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1 = {
-            ipv4.addresses = mkOverride 0 [ ];
-            ipv6.addresses = mkOverride 0 [ ];
-            useDHCP = true;
-          };
-          interfaces.eth2 = {
-            ipv4.addresses = mkOverride 0 [ ];
-            ipv6.addresses = mkOverride 0 [ ];
-            useDHCP = true;
-          };
+          interfaces.enp1s0.useDHCP = true;
+          interfaces.enp2s0.useDHCP = true;
        };
      };
      testScript = { ... }:
@ -211,10 +205,10 @@ let
          router.wait_for_unit("network-online.target")

          with subtest("Wait until we have an ip address on each interface"):
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'")
-              client.wait_until_succeeds("ip addr show dev eth2 | grep -q '192.168.2'")
-              client.wait_until_succeeds("ip addr show dev eth2 | grep -q 'fd00:1234:5678:2:'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q '192.168.1'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q 'fd00:1234:5678:1:'")
+              client.wait_until_succeeds("ip addr show dev enp2s0 | grep -q '192.168.2'")
+              client.wait_until_succeeds("ip addr show dev enp2s0 | grep -q 'fd00:1234:5678:2:'")

          with subtest("Test vlan 1"):
              client.wait_until_succeeds("ping -c 1 192.168.1.1")
@ -243,16 +237,15 @@ let
      name = "OneInterfaceDHCP";
      nodes.router = router;
      nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1 = {
-            ipv4.addresses = mkOverride 0 [ ];
+          interfaces.enp1s0 = {
            mtu = 1343;
            useDHCP = true;
          };
-          interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
        };
      };
      testScript = { ... }:
@ -264,10 +257,10 @@ let
              router.wait_for_unit("network.target")

          with subtest("Wait until we have an ip address on each interface"):
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q '192.168.1'")

          with subtest("ensure MTU is set"):
-              assert "mtu 1343" in client.succeed("ip link show dev eth1")
+              assert "mtu 1343" in client.succeed("ip link show dev enp1s0")

          with subtest("Test vlan 1"):
              client.wait_until_succeeds("ping -c 1 192.168.1.1")
@ -286,16 +279,15 @@ let
    };
    bond = let
      node = address: { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
          bonds.bond0 = {
-            interfaces = [ "eth1" "eth2" ];
+            interfaces = [ "enp1s0" "enp2s0" ];
            driverOptions.mode = "802.3ad";
          };
-          interfaces.eth1.ipv4.addresses = mkOverride 0 [ ];
-          interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
          interfaces.bond0.ipv4.addresses = mkOverride 0
            [ { inherit address; prefixLength = 30; } ];
        };
@ -326,12 +318,11 @@ let
    };
    bridge = let
      node = { address, vlan }: { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ vlan ];
+        virtualisation.interfaces.enp1s0.vlan = vlan;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1.ipv4.addresses = mkOverride 0
-            [ { inherit address; prefixLength = 24; } ];
+          interfaces.enp1s0.ipv4.addresses = [ { inherit address; prefixLength = 24; } ];
        };
      };
    in {
@ -339,11 +330,12 @@ let
      nodes.client1 = node { address = "192.168.1.2"; vlan = 1; };
      nodes.client2 = node { address = "192.168.1.3"; vlan = 2; };
      nodes.router = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          bridges.bridge.interfaces = [ "eth1" "eth2" ];
+          bridges.bridge.interfaces = [ "enp1s0" "enp2s0" ];
          interfaces.eth1.ipv4.addresses = mkOverride 0 [ ];
          interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
          interfaces.bridge.ipv4.addresses = mkOverride 0
@ -377,7 +369,7 @@ let
      nodes.router = router;
      nodes.client = { pkgs, ... }: with pkgs.lib; {
        environment.systemPackages = [ pkgs.iptables ]; # to debug firewall rules
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
@ -385,14 +377,9 @@ let
          # reverse path filtering rules for the macvlan interface seem
          # to be incorrect, causing the test to fail. Disable temporarily.
          firewall.checkReversePath = false;
-          macvlans.macvlan.interface = "eth1";
-          interfaces.eth1 = {
-            ipv4.addresses = mkOverride 0 [ ];
-            useDHCP = true;
-          };
-          interfaces.macvlan = {
-            useDHCP = true;
-          };
+          macvlans.macvlan.interface = "enp1s0";
+          interfaces.enp1s0.useDHCP = true;
+          interfaces.macvlan.useDHCP = true;
        };
      };
      testScript = { ... }:
@ -404,7 +391,7 @@ let
              router.wait_for_unit("network.target")

          with subtest("Wait until we have an ip address on each interface"):
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q '192.168.1'")
              client.wait_until_succeeds("ip addr show dev macvlan | grep -q '192.168.1'")

          with subtest("Print lots of diagnostic information"):
@ -431,23 +418,22 @@ let
    fou = {
      name = "foo-over-udp";
      nodes.machine = { ... }: {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1.ipv4.addresses = mkOverride 0
-            [ { address = "192.168.1.1"; prefixLength = 24; } ];
+          interfaces.enp1s0.ipv4.addresses = [ { address = "192.168.1.1"; prefixLength = 24; } ];
          fooOverUDP = {
            fou1 = { port = 9001; };
            fou2 = { port = 9002; protocol = 41; };
            fou3 = mkIf (!networkd)
              { port = 9003; local.address = "192.168.1.1"; };
            fou4 = mkIf (!networkd)
-              { port = 9004; local = { address = "192.168.1.1"; dev = "eth1"; }; };
+              { port = 9004; local = { address = "192.168.1.1"; dev = "enp1s0"; }; };
          };
        };
        systemd.services = {
-          fou3-fou-encap.after = optional (!networkd) "network-addresses-eth1.service";
+          fou3-fou-encap.after = optional (!networkd) "network-addresses-enp1s0.service";
        };
      };
      testScript = { ... }:
@ -470,20 +456,20 @@ let
              "gue": None,
              "family": "inet",
              "local": "192.168.1.1",
-              "dev": "eth1",
+              "dev": "enp1s0",
          } in fous, "fou4 exists"
        '';
    };
    sit = let
      node = { address4, remote, address6 }: { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
          sits.sit = {
            inherit remote;
            local = address4;
-            dev = "eth1";
+            dev = "enp1s0";
          };
          interfaces.eth1.ipv4.addresses = mkOverride 0
            [ { address = address4; prefixLength = 24; } ];
@ -685,10 +671,10 @@ let
    vlan-ping = let
        baseIP = number: "10.10.10.${number}";
        vlanIP = number: "10.1.1.${number}";
-        baseInterface = "eth1";
+        baseInterface = "enp1s0";
        vlanInterface = "vlan42";
        node = number: {pkgs, ... }: with pkgs.lib; {
-          virtualisation.vlans = [ 1 ];
+          virtualisation.interfaces.enp1s0.vlan = 1;
          networking = {
            #useNetworkd = networkd;
            useDHCP = false;
@ -785,12 +771,12 @@ let
    privacy = {
      name = "Privacy";
      nodes.router = { ... }: {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1.ipv6.addresses = singleton {
+          interfaces.enp1s0.ipv6.addresses = singleton {
            address = "fd00:1234:5678:1::1";
            prefixLength = 64;
          };
@ -812,11 +798,11 @@ let
        };
      };
      nodes.client_with_privacy = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1 = {
+          interfaces.enp1s0 = {
            tempAddress = "default";
            ipv4.addresses = mkOverride 0 [ ];
            ipv6.addresses = mkOverride 0 [ ];
@ -825,11 +811,11 @@ let
        };
      };
      nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1 = {
+          interfaces.enp1s0 = {
            tempAddress = "enabled";
            ipv4.addresses = mkOverride 0 [ ];
            ipv6.addresses = mkOverride 0 [ ];
@ -847,9 +833,9 @@ let

          with subtest("Wait until we have an ip address"):
              client_with_privacy.wait_until_succeeds(
-                  "ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'"
+                  "ip addr show dev enp1s0 | grep -q 'fd00:1234:5678:1:'"
              )
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q 'fd00:1234:5678:1:'")

          with subtest("Test vlan 1"):
              client_with_privacy.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::1")
@ -947,7 +933,7 @@ let
            ), "The IPv6 routing table has not been properly cleaned:\n{}".format(ipv6Residue)
      '';
    };
-    rename = {
+    rename = if networkd then {
      name = "RenameInterface";
      nodes.machine = { pkgs, ... }: {
        virtualisation.vlans = [ 1 ];
@ -955,22 +941,18 @@ let
          useNetworkd = networkd;
          useDHCP = false;
        };
-      } //
-      (if networkd
-       then { systemd.network.links."10-custom_name" = {
-                matchConfig.MACAddress = "52:54:00:12:01:01";
-                linkConfig.Name = "custom_name";
-              };
-            }
-       else { boot.initrd.services.udev.rules = ''
-               SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="52:54:00:12:01:01", KERNEL=="eth*", NAME="custom_name"
-              '';
-            });
+        systemd.network.links."10-custom_name" = {
+          matchConfig.MACAddress = "52:54:00:12:01:01";
+          linkConfig.Name = "custom_name";
+        };
+      };
      testScript = ''
        machine.succeed("udevadm settle")
        print(machine.succeed("ip link show dev custom_name"))
      '';
-    };
+    } else {
+      name = "RenameInterface";
+      testScript = "";
    # even with disabled networkd, systemd.network.links should work
    # (as it's handled by udev, not networkd)
    link = {
--- a/pkgs/applications/audio/cmus/default.nix
+++ b/pkgs/applications/audio/cmus/default.nix
@ -88,14 +88,6 @@ let

    #(mkFlag vtxSupport    "CONFIG_VTX=y"     libayemu)
  ];
-
-  clangGCC = runCommand "clang-gcc" {} ''
-    #! ${stdenv.shell}
-    mkdir -p $out/bin
-    ln -s ${stdenv.cc}/bin/clang $out/bin/gcc
-    ln -s ${stdenv.cc}/bin/clang++ $out/bin/g++
-  '';
-
 in

 stdenv.mkDerivation rec {
@ -111,17 +103,18 @@ stdenv.mkDerivation rec {

  patches = [ ./option-debugging.patch ];

-  configurePhase = "./configure " + lib.concatStringsSep " " ([
-    "prefix=$out"
-    "CONFIG_WAV=y"
-  ] ++ lib.concatMap (a: a.flags) opts);
-
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ ncurses ]
-    ++ lib.optional stdenv.cc.isClang clangGCC
    ++ lib.optionals stdenv.isDarwin [ libiconv CoreAudio AudioUnit VideoToolbox ]
    ++ lib.flatten (lib.concatMap (a: a.deps) opts);

+  prefixKey = "prefix=";
+
+  configureFlags = [
+    "CONFIG_WAV=y"
+    "HOSTCC=${stdenv.cc.targetPrefix}cc"
+  ] ++ lib.concatMap (a: a.flags) opts;
+
  makeFlags = [ "LD=$(CC)" ];

  meta = with lib; {
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@ -6,13 +6,13 @@

 buildDotnetModule rec {
  pname = "btcpayserver";
-  version = "1.7.3";
+  version = "1.7.5";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-wjtiircPPQgWg1GGQsesEEeOF+h1+tc591YI0l/JlwQ=";
+    sha256 = "sha256-xycNt3jzZY2a4hNv3arWLt+EfMqpFVMDHMuzOWnL7aQ=";
  };

  projectFile = "BTCPayServer/BTCPayServer.csproj";
--- a/pkgs/applications/blockchains/btcpayserver/deps.nix
+++ b/pkgs/applications/blockchains/btcpayserver/deps.nix
@ -8,15 +8,15 @@
  (fetchNuGet { pname = "AWSSDK.S3"; version = "3.3.110.10"; sha256 = "1lf1hfbx792dpa1hxgn0a0jrrvldd16hgbxx229dk2qcz5qlnc38"; })
  (fetchNuGet { pname = "BIP78.Sender"; version = "0.2.2"; sha256 = "12pm2s35c0qzc06099q2z1pxwq94rq85n74yz8fs8gwvm2ksgp4p"; })
  (fetchNuGet { pname = "BTCPayServer.Hwi"; version = "2.0.2"; sha256 = "0lh3n1qncqs4kbrmx65xs271f0d9c7irrs9qnsa9q51cbbqbljh9"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.4.14"; sha256 = "1k5m6jc585hnkkl019diz2gycfnsv2kx4g4cfs4awlpr42k8s3ph"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.Charge"; version = "1.3.18"; sha256 = "0zpqi8dpk91sqg7njxbs64m9598fmmalcc1w97v60xlhp9afjmdb"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.3.21"; sha256 = "0qq6ppr5vw4k8hjnz5xp29fc82z32vh6bc389dnr439gw7hmwkp9"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.4.18"; sha256 = "1w1h6za2mjk04njkw4hny3lx38h2m03gmvwrihj9h2rak7jf2gij"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.Charge"; version = "1.3.20"; sha256 = "0nk82hkgs67mxfxkgbav8yxxd79m0xyqaan7vay00gg33pjqdjvj"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.3.24"; sha256 = "0i0lqpxx0gy9zbssjigz0vq0way88x0slyyfijsx4sasrhrbv5qs"; })
  (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.16"; sha256 = "1g37736b4k0ncpyy2qycbk4l85fqvgwac3k98nbdj0dvhfghp1dn"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.19"; sha256 = "046vvlxlg8div4a2v6pnxz4iwji93s688jgnvav3hl6c22b9lvs0"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.Eclair"; version = "1.3.18"; sha256 = "04lp90rr61p7n39bfmia6jamgr0jjfns9987py64iazi236dl74g"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.3.20"; sha256 = "1kwyh71zzfij07r6nvcf7k2gdpjdhh90imwh6s255ws13m1fj3sn"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.4.11"; sha256 = "0zm0b45npacknir6b6a6v717kp3yz8hxv1qy2v65g2zp3ad2wij4"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.0.14"; sha256 = "1hhznv07bd1f3rn9d1rpg61ln68vqfjg7ypxif9lx4l3vfcj5j04"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.21"; sha256 = "042xwfsxd30zgwiz0w14ynb755w5sldkplxgw1fkw68lrz66x5s4"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.Eclair"; version = "1.3.20"; sha256 = "093w82mcxxxbvx66j0sp3lsfm2bkbi3igm80iz9zdghy85845kc9"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.3.23"; sha256 = "036cggc386448i05s38pnhzs7qqbix6lml7j2zn84gcgk8w741gi"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.4.14"; sha256 = "1gzqz34lgk42kf86ldi3z0k4m9x91hlkqh6d7rq93nphl57mwqar"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.0.16"; sha256 = "0l6pnjc6phsacwg145kwsakjpkd44jm1w53y0s166bwzpcdmljq0"; })
  (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins"; version = "1.4.4"; sha256 = "0rk0prmb0539ji5fd33cqy3yvw51i5i8m5hb43admr5z8960dd6l"; })
  (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins.Mvc"; version = "1.4.4"; sha256 = "1kmmj5m7s41wc1akpqw1b1j7pp4c0vn6sqxb487980ibpj6hyisl"; })
  (fetchNuGet { pname = "CsvHelper"; version = "15.0.5"; sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma"; })
@ -38,7 +38,7 @@
  (fetchNuGet { pname = "HtmlSanitizer"; version = "5.0.372"; sha256 = "1gllp58vdbql2ybwf05i2178x7p4g8zyyk64317d1pyss5217g7r"; })
  (fetchNuGet { pname = "Humanizer.Core"; version = "2.8.26"; sha256 = "1v8xd12yms4qq1md4vh6faxicmqrvahqdd7sdkyzrphab9v44nsm"; })
  (fetchNuGet { pname = "libsodium"; version = "1.0.18"; sha256 = "15qzl5k31yaaapqlijr336lh4lzz1qqxlimgxy8fdyig8jdmgszn"; })
-  (fetchNuGet { pname = "LNURL"; version = "0.0.27"; sha256 = "126rhls5yxxw4i419w59762cq3zmjccjd8x42qmb4nhqmbgybkzm"; })
+  (fetchNuGet { pname = "LNURL"; version = "0.0.28"; sha256 = "1fcrq5ib02scz6n4zvmnbvm2aahj6qwwq6wsfix90caqm2c2bq64"; })
  (fetchNuGet { pname = "MailKit"; version = "3.3.0"; sha256 = "18l0jkrc4d553kiw4vdjzzpafpvsgjs1n19kjbi8isnhzidmsl4j"; })
  (fetchNuGet { pname = "Microsoft.AspNet.SignalR.Client"; version = "2.4.3"; sha256 = "1whxcmxydcxjkw84sqk5idd406v3ia0xj2m4ia4b6wqbvkdqn7rf"; })
  (fetchNuGet { pname = "Microsoft.AspNet.WebApi.Client"; version = "5.2.9"; sha256 = "1sy1q36bm9fz3gi780w4jgysw3dwaz2f3a5gcn6jxw1gkmdasb08"; })
@ -87,9 +87,9 @@
  (fetchNuGet { pname = "Microsoft.Extensions.Caching.Abstractions"; version = "6.0.0"; sha256 = "0qn30d3pg4rx1x2k525jj4x5g1fxm2v5m0ksz2dmk1gmqalpask8"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Caching.Memory"; version = "6.0.1"; sha256 = "0ra0ldbg09r40jzvfqhpb3h42h80nafvka9hg51dja32k3mxn5gk"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "2.0.0"; sha256 = "0yssxq9di5h6xw2cayp5hj3l9b2p0jw9wcjz73rwk4586spac9s9"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "2.1.0"; sha256 = "04rjl38wlr1jjjpbzgf64jp0ql6sbzbil0brwq9mgr3hdgwd7vx2"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "3.1.10"; sha256 = "04xjhi2pmvycx4yam7i3j2l2yjzzbzvxn4i12f00r39j4kkfwqsn"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "3.1.5"; sha256 = "1i7zm8ghgxwp655anyfm910qm7rcpvrz48fxjyzw9w63hj4sv6bk"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "6.0.0"; sha256 = "1zdyai2rzngmsp3706d12qrdk315c1s3ja218fzb3nc3wd1vz0s8"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "2.0.0"; sha256 = "1ilz2yrgg9rbjyhn6a5zh9pr51nmh11z7sixb4p7vivgydj9gxwf"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "2.1.0"; sha256 = "03gzlr3z9j1xnr1k6y91zgxpz3pj27i3zsvjwj7i8jqnlqmk7pxd"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "3.1.10"; sha256 = "1pj4n3c015ils13fwky2rfv5q8xza671ixb54vr479pc7an2fah3"; })
@ -98,9 +98,9 @@
  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "2.0.0"; sha256 = "1prvdbma6r18n5agbhhabv6g357p1j70gq4m9g0vs859kf44nrgc"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "3.1.10"; sha256 = "004f9nshm5jg0g4n9f48phjx90pzmj88qbqyiimzgvwl0qkk870q"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "3.1.5"; sha256 = "0310pvrwbbqak7k4s32syryqxlkwli8w8bwlpnqmz42svh2302wv"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.EnvironmentVariables"; version = "2.1.0"; sha256 = "0xx3idb1l5y1da5zynlys5gyarijmw5pc9hgci8xdxbrcv6rzbjb"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.FileExtensions"; version = "2.1.0"; sha256 = "1lz2xwm63clbh9dfhmygbqvcp4dsrwh5jihv82dmqd5h7lqngl40"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Ini"; version = "2.1.0"; sha256 = "0bchsljywcq36si4zs2dcx2gj8x98ww93dh2bx2z6x5ilxyjnfip"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.EnvironmentVariables"; version = "6.0.0"; sha256 = "19w2vxliz1xangbach3hkx72x2pxqhc9n9c3kc3l8mhicl8w6vdl"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.FileExtensions"; version = "6.0.0"; sha256 = "02nna984iwnyyz4jjh9vs405nlj0yk1g5vz4v2x30z2c89mx5f9w"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Ini"; version = "6.0.0"; sha256 = "18qg1f7yvgvrgsq40cgc1yvpb9av84ma80k3grhvwn1cyam2img6"; })
  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "2.0.0"; sha256 = "018izzgykaqcliwarijapgki9kp2c560qv8qsxdjywr7byws5apq"; })
  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "3.1.10"; sha256 = "0if1g8gj3ngvqf4ddkjhz30p4y2yax8m5vlbrjzgixq80g3apy6d"; })
  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "6.0.0"; sha256 = "1wlhb2vygzfdjbdzy7waxblmrx0q3pdcqvpapnpmq9fcx5m8r6w1"; })
@ -113,8 +113,9 @@
  (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "6.0.0"; sha256 = "08c4fh1n8vsish1vh7h73mva34g0as4ph29s4lvps7kmjb4z64nl"; })
  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "2.0.0"; sha256 = "0d6y5isjy6jpf4w3f3w89cwh9p40glzhwvm7cwhx05wkqd8bk9w4"; })
  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "2.1.0"; sha256 = "1sxls5f5cgb0wr8cwb05skqmz074683hrhmd3hhq6m5dasnzb8n3"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Physical"; version = "2.1.0"; sha256 = "1firpsl5bk219i9gdfgiqw1zm68146h1dzx9hvawfpw9slfaa56w"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileSystemGlobbing"; version = "2.1.0"; sha256 = "1d2622qp22x1cnlwycnzjbc3sgi9jria26fk78zwzsa08npa3avv"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "6.0.0"; sha256 = "1fbqmfapxdz77drcv1ndyj2ybvd2rv4c9i9pgiykcpl4fa6dc65q"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Physical"; version = "6.0.0"; sha256 = "1ikc3kf325xig6njbi2aj5kmww4xlaq9lsrpc8v764fsm4x10474"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileSystemGlobbing"; version = "6.0.0"; sha256 = "09gyyv4fwy9ys84z3aq4lm9y09b7bd1d4l4gfdinmg0z9678f1a4"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "2.0.0"; sha256 = "056wgjcdzvz1qwb26xv6hgxq4xya56qiimhk30v8an8cgsrjk3mc"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "2.1.0"; sha256 = "04vm9mdjjzg3lpp2rzpgkpn8h5bzdl3bwcr22lshd3kp602ws4k9"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Core"; version = "6.0.9"; sha256 = "1g9jsqxaif9z5m228rci54w6cqmg07i0cm618iwa0jibsphx86fk"; })
@ -156,19 +157,18 @@
  (fetchNuGet { pname = "NBitcoin"; version = "5.0.40"; sha256 = "1rqzn84yaww4afagwg8jg1l5qdkvqyjdfcyd5widddqwxabbsjvh"; })
  (fetchNuGet { pname = "NBitcoin"; version = "6.0.8"; sha256 = "1f90zyrd35fzx0vgvd83jhd6hczd4037h2k198xiyxj04l4m3wm5"; })
  (fetchNuGet { pname = "NBitcoin"; version = "7.0.1"; sha256 = "05kqpjyp3ckb2183g9vfsdv362y5xg5j21p36zls0x3b0jgrwxw7"; })
-  (fetchNuGet { pname = "NBitcoin"; version = "7.0.18"; sha256 = "02kkgymdb80cidibrs6qpy1zjwcfbkwv9zqz9s0swf5zp7qvcakn"; })
-  (fetchNuGet { pname = "NBitcoin"; version = "7.0.23"; sha256 = "10dy58gq644561svc67pm37rlb44mymbnlfz409dhclmfhmqmd5s"; })
-  (fetchNuGet { pname = "NBitcoin.Altcoins"; version = "3.0.17"; sha256 = "1rqcfpcs3c7zqlw3fnvnyw3d3mmplg5nsaikm50lnzpl8z3cq936"; })
+  (fetchNuGet { pname = "NBitcoin"; version = "7.0.24"; sha256 = "0yc6cgwp2xr2dzjsrkawyh43whixv66nvvq6rh1pi6gi14iaqmfa"; })
+  (fetchNuGet { pname = "NBitcoin.Altcoins"; version = "3.0.18"; sha256 = "054i15qan5154iy8m13jmhnz1w5rs208i1xhlfnivwiq2v1c2qby"; })
  (fetchNuGet { pname = "NBitpayClient"; version = "1.0.0.39"; sha256 = "1sgwradg7jnb4n3chwqfkximj1qhgl3r23p0sifmaa0kql2hlira"; })
-  (fetchNuGet { pname = "NBXplorer.Client"; version = "4.2.2"; sha256 = "0a8zy9iasgmr7mqhjrbxa2shnygpp97pbg5qnk7ix50y01k9blyw"; })
+  (fetchNuGet { pname = "NBXplorer.Client"; version = "4.2.3"; sha256 = "0lf5qsf5yr5m1fx826mn47l237x5y2wkimv6klc3rvwwc7f10dmm"; })
  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.1"; sha256 = "1r1hvj5gjl466bya2bfl5aaj8rbwyf5x1msg710wf3k2llbci1xa"; })
  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.2"; sha256 = "0c27bhy9x3c2n26inq32kmp6drpm71n6mqnmcr19wrlcaihglj35"; })
-  (fetchNuGet { pname = "NicolasDorier.CommandLine"; version = "1.0.0.2"; sha256 = "08a9l18zkhcfa6f56xqylzvmqjzgxsmgkpm2r3ckvxfyml6w0qyy"; })
-  (fetchNuGet { pname = "NicolasDorier.CommandLine.Configuration"; version = "1.0.0.3"; sha256 = "0al0pd4zhjpmn8m208xjmy17cbyab68grzdvzr2lhsckwkl6b1jg"; })
+  (fetchNuGet { pname = "NicolasDorier.CommandLine"; version = "2.0.0"; sha256 = "0gywvl0gqs3crlzwgwzcqf0qsrbhk3dxjycpimxqvs1ihg4dhb1f"; })
+  (fetchNuGet { pname = "NicolasDorier.CommandLine.Configuration"; version = "2.0.0"; sha256 = "1cng096r3kb85lf5wjill4yhxx8nv9v0d6ksbn1i1vvdawwl6fkw"; })
  (fetchNuGet { pname = "NicolasDorier.RateLimits"; version = "1.2.3"; sha256 = "197cqb0yxd2hfxyikxw53m4lmxh87l9sqrr8xihg1j0knvwzgyyp"; })
-  (fetchNuGet { pname = "NicolasDorier.StandardConfiguration"; version = "1.0.0.18"; sha256 = "0lgssxafv6cqlw21fb79fm0fcln0clgsk6zadcwrnjv9vampfw7b"; })
+  (fetchNuGet { pname = "NicolasDorier.StandardConfiguration"; version = "2.0.1"; sha256 = "1jiinqj1y8vv78p766asml4bd0k5gwrpl9ksi176h0z7wsj6ilrx"; })
  (fetchNuGet { pname = "NLog"; version = "4.7.14"; sha256 = "1pjkxlf20vrh9b8r6wzay1563fdhhxslxb7acdkn5ss8gvd2m23n"; })
  (fetchNuGet { pname = "Npgsql"; version = "6.0.7"; sha256 = "0c5zyd9n3597ryzqh9qfisp3wvr7q0krbnl26w2sy33xm4hvls2c"; })
  (fetchNuGet { pname = "Npgsql.EntityFrameworkCore.PostgreSQL"; version = "6.0.7"; sha256 = "0gsvjf0vk7anmc889my8x68wpd47bsdgsk1rwbg77rrb9zsf4nxp"; })
--- a/pkgs/applications/blockchains/nbxplorer/default.nix
+++ b/pkgs/applications/blockchains/nbxplorer/default.nix
@ -6,13 +6,13 @@

 buildDotnetModule rec {
  pname = "nbxplorer";
-  version = "2.3.54";
+  version = "2.3.57";

  src = fetchFromGitHub {
    owner = "dgarage";
    repo = "NBXplorer";
    rev = "v${version}";
-    sha256 = "sha256-WINanMGAlZioD6XP0xK6H+KTlF/NRMAmhylmRV6y2uI=";
+    sha256 = "sha256-oLkkGdzjyvgIXi0HZiFPCShzbBR8cOgMf1h1Nf1U6Rk=";
  };

  projectFile = "NBXplorer/NBXplorer.csproj";
--- a/pkgs/applications/blockchains/nbxplorer/deps.nix
+++ b/pkgs/applications/blockchains/nbxplorer/deps.nix
@ -34,8 +34,8 @@
  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1"; sha256 = "1n8ap0cmljbqskxpf8fjzn7kh1vvlndsa75k01qig26mbw97k2q7"; })
  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.3.0"; sha256 = "1gxyzxam8163vk1kb6xzxjj4iwspjsz9zhgn1w9rjzciphaz0ig7"; })
-  (fetchNuGet { pname = "NBitcoin"; version = "7.0.22"; sha256 = "1911mwz23qm9qnlfsm2j6qdkj1l43gjym4di8r50zikfnyd654sx"; })
-  (fetchNuGet { pname = "NBitcoin.Altcoins"; version = "3.0.17"; sha256 = "1rqcfpcs3c7zqlw3fnvnyw3d3mmplg5nsaikm50lnzpl8z3cq936"; })
+  (fetchNuGet { pname = "NBitcoin"; version = "7.0.24"; sha256 = "0yc6cgwp2xr2dzjsrkawyh43whixv66nvvq6rh1pi6gi14iaqmfa"; })
+  (fetchNuGet { pname = "NBitcoin.Altcoins"; version = "3.0.18"; sha256 = "054i15qan5154iy8m13jmhnz1w5rs208i1xhlfnivwiq2v1c2qby"; })
  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
  (fetchNuGet { pname = "Newtonsoft.Json"; version = "10.0.3"; sha256 = "06vy67bkshclpz69kps4vgzc9h2cgg41c8vlqmdbwclfky7c4haq"; })
  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
--- a/pkgs/applications/emulators/dolphin-emu/master.nix
+++ b/pkgs/applications/emulators/dolphin-emu/master.nix
@ -141,6 +141,9 @@ stdenv.mkDerivation rec {
    "--set QT_XCB_NO_XI2 1"
  ];

+  # https://github.com/NixOS/nixpkgs/issues/201254
+  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
+
  # Use nix-provided libraries instead of submodules
  postPatch = lib.optionalString stdenv.isDarwin ''
    substituteInPlace CMakeLists.txt \
@ -187,5 +190,7 @@ stdenv.mkDerivation rec {
      xfix
      ivar
    ];
+    # Requires both LLVM and SDK bump
+    broken = stdenv.isDarwin && stdenv.isx86_64;
  };
 }
--- a/pkgs/applications/graphics/yeetgif/default.nix
+++ b/pkgs/applications/graphics/yeetgif/default.nix
@ -1,18 +1,29 @@
-{ buildGoPackage, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, fetchpatch, lib }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "yeetgif";
  version = "1.23.6";

-  goPackagePath = "github.com/sgreben/yeetgif";
-
  src = fetchFromGitHub {
    owner = "sgreben";
    repo = pname;
    rev = version;
-    sha256 = "05z1ylsra60bb4cvr383g9im94zsph1dgicqbv5p73qgs634ckk7";
+    hash = "sha256-Z05GhtEPj3PLXpjF1wK8+pNUY3oDjbwZWQsYlTX14Rc=";
  };

+  deleteVendor = true;
+  vendorHash = "sha256-LhkOMCuYO4GHezk21SlI2dP1UPmBp4bv2SdNbUQMKsI=";
+
+  patches = [
+    # Add Go Modules support
+    (fetchpatch {
+      url = "https://github.com/sgreben/yeetgif/commit/5d2067b9832898c2b1ac51bf6a5f107619038270.patch";
+      hash = "sha256-3eyqbpPyuQHjAN5mjQyZo0xY6L683T5Ytyx02II/iU4=";
+    })
+  ];
+
+  ldflags = [ "-s" "-w" ];
+
  meta = with lib; {
    description = "gif effects CLI. single binary, no dependencies. linux, osx, windows. #1 workplace productivity booster. #yeetgif #eggplant #golang";
    homepage = "https://github.com/sgreben/yeetgif";
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -12,12 +12,12 @@ let
    if extension == "zip" then fetchzip args else fetchurl args;

  pname = "1password-cli";
-  version = "2.12.0";
+  version = "2.13.0";
  sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-WCu1/5dewsjVMyFo+BaAgCOcK08Fe3ldJhDzCl8B+2M=" "zip";
-    i686-linux = fetch "linux_386" "sha256-eRNX7+IF9v3JzXxwp5WshqYOC5/uizniWOKSc3q2yL8=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-wvhWwcDufwvh8Isx4QpyyHEJ+3yU7f/0a4r5Itns68c=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-ZOU4huC1FUj0ZiqIgs+4tU8t/w5VVD/UiWGVFHS50sw=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-B9XVejPge8wxWAoxj974rLz0dfaZEAaGn2mUcPeqFIo=" "zip";
+    i686-linux = fetch "linux_386" "sha256-kLW9PmhCNDosKn1nmtzo8tBjBOaUyzqlLad332UACio=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-jbvkTlIuAm5tHzGm42kO+jykUffKwfOVSOh33i0URtM=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-kA+NjXrNcX0dKh+gNJT82vbQGKFOU8zPvGPqBtuBqOA=" "pkg";
    x86_64-darwin = aarch64-darwin;
  };
  platforms = builtins.attrNames sources;
--- a/pkgs/applications/misc/faircamp/default.nix
+++ b/pkgs/applications/misc/faircamp/default.nix
@ -13,17 +13,17 @@

 rustPlatform.buildRustPackage {
  pname = "faircamp";
-  version = "unstable-2022-10-08";
+  version = "unstable-2022-12-28";

  # TODO when switching to a stable release, use fetchFromGitea and add a
  # version test. Meanwhile, fetchgit is used to make unstableGitUpdater work.
  src = fetchgit {
    url = "https://codeberg.org/simonrepp/faircamp.git";
-    rev = "630415985127298bf82bfc210d2fc8b214758db1";
-    sha256 = "sha256-4pzDey0iV7LtHI0rbbcCjjuTaFt0CR88Vl0B1RU96v0=";
+    rev = "c77fd779cea6daecbac9a9beea65c1dc1ac56bc4";
+    sha256 = "sha256-Tl3T/IoBIhYCNDEYT6cV1UyksDkoEDydBjYM9yzT4VQ=";
  };

-  cargoHash = "sha256-GgWxxKHLGtsSGVbhli6HTfUu4TmbY4J9N7UA7AOzUkc=";
+  cargoHash = "sha256-20rtE8+LLDz97yvk0gKoUielsGZXEEOu2pfShf2WvHA=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/data/fonts/gdouros/default.nix
+++ b/pkgs/data/fonts/gdouros/default.nix
@ -1,32 +1,36 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchzip }:

 let
  fonts = {
-    aegan     = { version = "13.00"; file = "Aegean.zip";       sha256 = "sha256-1DnbfL6bKn8Upht/ZYfKIp9kuDHq7y9E+jkt2Yhr38A="; description = "Aegean"; };
-    aegyptus  = { version = "13.00"; file = "Aegyptus.zip";     sha256 = "sha256-tObgHlhaquq6Akn/HdYKNfnKHHJP42yAT7lIn5qdCzY="; description = "Egyptian Hieroglyphs, Coptic, Meroitic"; };
-    akkadian  = { version = "13.00"; file = "Akkadian.zip";     sha256 = "sha256-iHiXfxMS9FIlrRgT23MfxzCqYJMQrKuKYDShrqB74vU="; description = "Sumero-Akkadian Cuneiform"; };
-    assyrian  = { version = "13.00"; file = "Assyrian.zip";     sha256 = "sha256-YjTQjv1Vybr14Sn9pUdbGYVf4ZIjGT+cpB1qCIg1NNQ="; description = "Neo-Assyrian in Unicode with OpenType"; };
-    eemusic   = { version = "13.00"; file = "EEMusic.zip";      sha256 = "sha256-PaYBJOV+dmRV1ehY7TwDNL9dz1jPo58I3N8lWX1Vmy8="; description = "Byzantine Musical Notation in Unicode with OpenType"; };
-    maya      = { version = "13.00"; file = "Maya%20Hieroglyphs.zip"; sha256 = "sha256-9uqGo4hweV1ydI+pEp76IqmHslWvxr87rTvziQs35bQ="; description = "Maya Hieroglyphs"; };
-    symbola   = { version = "13.00"; file = "Symbola.zip";      sha256 = "sha256-C9HmforXr/Hqopb3go+bzqRFcWPv+0rz0JZsXc3mcxw="; description = "Basic Latin, Greek, Cyrillic and many Symbol blocks of Unicode"; };
-    textfonts = { version = "13.00"; file = "Textfonts.zip";    sha256 = "sha256-1bDi5mwrT2I8gx6QdhnWjXATFdNAU9nt77BiFIci6C8="; description = "Aroania, Anaktoria, Alexander, Avdira and Asea"; };
-    unidings  = { version = "13.00"; file = "Unidings.zip";     sha256 = "sha256-6lSkDb603XIrBGy4fZhY7xYDd3x0qA0PRQOlQ9Roig0="; description = "Glyphs and Icons for blocks of The Unicode Standard"; };
+    aegan     = { version = "13.00"; file = "Aegean.zip";       hash = "sha256-3HmCqCMZLN6zF1N/EirQOPnHKTGHoc4aHKoZxFYTB34="; description = "Aegean"; };
+    aegyptus  = { version = "13.00"; file = "Aegyptus.zip";     hash = "sha256-SSAK707xhpsUTq8tSBcrzNGunCYad58amtCqAWuevnY="; description = "Egyptian Hieroglyphs, Coptic, Meroitic"; };
+    akkadian  = { version = "13.00"; file = "Akkadian.zip";     hash = "sha256-wXiDYyfujAs6fklOCqXq7Ms7wP5RbPlpNVwkUy7CV4k="; description = "Sumero-Akkadian Cuneiform"; };
+    assyrian  = { version = "13.00"; file = "Assyrian.zip";     hash = "sha256-CZj1sc89OexQ0INb7pbEu5GfE/w2E5JmhjT8cosoLSg="; description = "Neo-Assyrian in Unicode with OpenType"; };
+    eemusic   = { version = "13.00"; file = "EEMusic.zip";      hash = "sha256-LxOcQOPEImw0wosxJotbOJRbe0qlK5dR+kazuhm99Kg="; description = "Byzantine Musical Notation in Unicode with OpenType"; };
+    maya      = { version = "13.00"; file = "Maya%20Hieroglyphs.zip"; hash = "sha256-PAwF1lGqm6XVf4NQCA8AFLGU40N0Xsn5Q8x9ikHJDhY="; description = "Maya Hieroglyphs"; };
+    symbola   = { version = "13.00"; file = "Symbola.zip";      hash = "sha256-TsHWmzkEyMa8JOZDyjvk7PDhm239oH/FNllizNFf398="; description = "Basic Latin, Greek, Cyrillic and many Symbol blocks of Unicode"; };
+    textfonts = { version = "13.00"; file = "Textfonts.zip";    hash = "sha256-7S3NiiyDvyYoDrLPt2z3P9bEEFOEZACv2sIHG1Tn6yI="; description = "Aroania, Anaktoria, Alexander, Avdira and Asea"; };
+    unidings  = { version = "13.00"; file = "Unidings.zip";     hash = "sha256-WUY+Ylphep6WuzqLQ3Owv+vK5Yuu/aAkn4GOFXL0uQY="; description = "Glyphs and Icons for blocks of The Unicode Standard"; };
  };

-  mkpkg = name_: {version, file, sha256, description}: fetchzip rec {
-    name = "${name_}-${version}";
-    url = "https://dn-works.com/wp-content/uploads/2020/UFAS-Fonts/${file}";
-    stripRoot = false;
-    postFetch = ''
-      mkdir -p $out/share/{fonts/opentype,doc/${name_}}
-      mv $out/*.otf                -t "$out/share/fonts/opentype"
-      mv $out/*.{odt,ods,pdf,xlsx}       -t "$out/share/doc/${name_}"  || true  # install docs if any
-      find $out -type d -empty -delete
-      shopt -s extglob dotglob
-      rm -rf $out/!(share)
-      shopt -u extglob dotglob
+  mkpkg = pname: { version, file, hash, description }: stdenvNoCC.mkDerivation rec {
+    inherit pname version;
+
+    src = fetchzip {
+      url = "https://dn-works.com/wp-content/uploads/2020/UFAS-Fonts/${file}";
+      stripRoot = false;
+      inherit hash;
+    };
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share/{fonts/opentype,doc/${pname}}
+      mv *.otf                -t "$out/share/fonts/opentype"
+      mv *.{odt,ods,pdf,xlsx}       -t "$out/share/doc/${pname}"  || true  # install docs if any
+
+      runHook postInstall
    '';
-    inherit sha256;

    meta = {
      inherit description;
@ -39,4 +43,4 @@ let
    };
  };
 in
-  lib.mapAttrs mkpkg fonts
+lib.mapAttrs mkpkg fonts
--- a/pkgs/data/fonts/hanazono/default.nix
+++ b/pkgs/data/fonts/hanazono/default.nix
@ -1,19 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-let
+stdenvNoCC.mkDerivation rec {
+  pname = "hanazono";
  version = "20170904";
-in fetchzip {
-  name = "hanazono-${version}";

-  url = "mirror://osdn/hanazono-font/68253/hanazono-${version}.zip";
+  src = fetchzip {
+    url = "mirror://osdn/hanazono-font/68253/hanazono-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-qd0q4wQnHBGLT7C+UQIiOHnxCnRCscMZcj3P5RRxD1U=";
+  };
+
+  installPhase = ''
+    runHook preInstall

-  postFetch = ''
    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.txt -d $out/share/doc/hanazono
-  '';
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    install -Dm644 *.txt -t $out/share/doc/hanazono

-  sha256 = "0qiyd1vk3w8kqmwc6xi5d390wdr4ln8xhfbx3n8r1hhad9iz14p6";
+    runHook postInstall
+  '';

  meta = with lib; {
    description = "Japanese Mincho-typeface TrueType font";
--- a/pkgs/data/fonts/iwona/default.nix
+++ b/pkgs/data/fonts/iwona/default.nix
@ -1,16 +1,18 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, texlive }:

-let
-  version = "0_995";
-in fetchzip {
-  name = "iwona-${version}";
-  url = "http://jmn.pl/pliki/Iwona-otf-${version}.zip";
+stdenvNoCC.mkDerivation {
+  pname = "iwona";
+  version = "0.995b";

-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype
-    unzip -j $downloadedFile *.otf -d $out/share/fonts/opentype
+  src = lib.head (builtins.filter (p: p.tlType == "run") texlive.iwona.pkgs);
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
  '';
-  sha256 = "1dcpn13bd31dw7ir0s722bv3nk136dy6qsab0kznjbzfqd7agswa";

  meta = with lib; {
    description = "A two-element sans-serif typeface, created by Małgorzata Budyta";
--- a/pkgs/data/fonts/kochi-substitute-naga10/default.nix
+++ b/pkgs/data/fonts/kochi-substitute-naga10/default.nix
@ -1,24 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-let version = "20030809";
-in
-fetchzip {
-  name = "kochi-substitute-naga10-${version}";
+stdenvNoCC.mkDerivation rec {
+  pname = "kochi-substitute-naga10";
+  version = "20030809";

-  url = "mirror://osdn/efont/5411/kochi-substitute-${version}.tar.bz2";
+  src = fetchzip {
+    url = "mirror://osdn/efont/5411/kochi-substitute-${version}.tar.bz2";
+    stripRoot = false;
+    hash = "sha256-dRJAxeVGYcNjLWqJJ+9Z2FW3BHrgyGRzlgM2x5YG3AM=";
+  };

-  stripRoot = false;
+  installPhase = ''
+    runHook preInstall

-  postFetch = ''
    mkdir -p $out/share/fonts/truetype
-    mv $out/*/kochi-gothic-subst.ttf $out/share/fonts/truetype/kochi-gothic-subst-naga10.ttf
-    mv $out/*/kochi-mincho-subst.ttf $out/share/fonts/truetype/kochi-mincho-subst-naga10.ttf
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
-  '';
+    mv */kochi-gothic-subst.ttf $out/share/fonts/truetype/kochi-gothic-subst-naga10.ttf
+    mv */kochi-mincho-subst.ttf $out/share/fonts/truetype/kochi-mincho-subst-naga10.ttf

-  sha256 = "sha256-SZ7ZJYuCYU0NxWHlEszbvFmyZxWeBtmPL204PjIrS64=";
+    runHook postInstall
+  '';

  meta = {
    description = "Japanese font, non-free replacement for MS Gothic and MS Mincho";
--- a/pkgs/data/fonts/liberastika/default.nix
+++ b/pkgs/data/fonts/liberastika/default.nix
@ -1,31 +1,29 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-let
+stdenvNoCC.mkDerivation rec {
+  pname = "liberastika";
  version = "1.1.5";
-in fetchzip rec {
-  name = "liberastika-${version}";

-  url = "mirror://sourceforge/project/lib-ka/liberastika-ttf-${version}.zip";
+  src = fetchzip {
+    url = "mirror://sourceforge/project/lib-ka/liberastika-ttf-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-woUpOmxhj6eEw7PKJ8EyRcs3ORj0gCZhxHP5a5dy5z0=";
+  };

-  stripRoot = false;
+  installPhase = ''
+    runHook preInstall

-  postFetch = ''
-    mkdir -p $out/share/fonts
-    install -Dm644 $out/*.ttf -t $out/share/fonts/truetype
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
  '';

-  sha256 = "sha256-1hoETOjPRUIzzM+NUR+g/Ph16jXmH2ARSlZHjgEwoeM=";
-
  meta = with lib; {
    description = "Liberation Sans fork with improved cyrillic support";
    homepage = "https://sourceforge.net/projects/lib-ka/";

    license = licenses.gpl2;
    platforms = platforms.all;
-    hydraPlatforms = [];
    maintainers = [ ];
  };
 }
--- a/pkgs/data/fonts/lohit-fonts/default.nix
+++ b/pkgs/data/fonts/lohit-fonts/default.nix
@ -1,35 +1,38 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchurl }:
 let
  fonts = {
-    assamese        = { label = "Assamese";          version = "2.91.5"; sha256 = "06cw416kgw0m6883n5ixmpniinsd747rdmacf06z83w1hqwj2js6"; };
-    bengali         = { label = "Bengali";           version = "2.91.5"; sha256 = "1j7gfmkzzyk9mivy09a9yfqxpidw52hw48dyh4qkci304mspcbvr"; };
-    devanagari      = { label = "Devanagari script"; version = "2.95.4"; sha256 = "1c17xirzx5rf7xpmkrm94jf9xrzckyagwnqn3pyag28lyj8x67m5"; };
-    gujarati        = { label = "Gujarati";          version = "2.92.4"; sha256 = "0xdgmkikz532zxj239wr73l24qnzxhra88f52146x7fsb7gpvfb1"; };
-    gurmukhi        = { label = "Gurmukhi script";   version = "2.91.2"; sha256 = "1xk1qvc0xwcmjcavj9zmy4bbphffdlv7sldmqlk30ch5fy5r0ypb"; }; # renamed from Punjabi
-    kannada         = { label = "Kannada";           version = "2.5.4" ; sha256 = "0sax56xg98p2nf0nsvba42hhz946cs7q0gidiz9zfpb6pbgwxdgg"; };
-    malayalam       = { label = "Malayalam";         version = "2.92.2"; sha256 = "18sca59fj9zvqhagbix35i4ld2n4mwv57q04pijl5gvpyfb1abs8"; };
-    marathi         = { label = "Marathi";           version = "2.94.2"; sha256 = "0cjjxxlhqmdmhr35s4ak0ma89456daik5rqrn6pdzj39098lmci7"; };
-    nepali          = { label = "Nepali";            version = "2.94.2"; sha256 = "1p7lif136xakfqkbv6p1lb56rs391b25vn4bxrjdfvsk0r0h0ry3"; };
-    odia            = { label = "Odia";              version = "2.91.2"; sha256 = "0z5rc4f9vfrfm8h2flzf5yx44x50jqdmmzifkmjwczib3hpg2ila"; }; # renamed from Oriya
-    tamil-classical = { label = "Classical Tamil";   version = "2.5.4" ; sha256 = "0svmj3dhk0195mhdwjhi3qgwa83223irb32fp12782sj9njdvyi2"; };
-    tamil           = { label = "Tamil";             version = "2.91.3"; sha256 = "0qyw9p8alyvjryyw8a25q3gfyrhby49mjb0ydgggf5ckd07kblcm"; };
-    telugu          = { label = "Telugu";            version = "2.5.5" ; sha256 = "07p41686ypmclj9d3njp01lvrgssqxa4s5hsbrqfjrnwd3rjspzr"; };
+    assamese        = { label = "Assamese";          version = "2.91.5"; hash = "sha256-Oo/hHHFg/Nu3eaZLMdBclY90lKU2AMFUclyXHxGaAgg="; };
+    bengali         = { label = "Bengali";           version = "2.91.5"; hash = "sha256-QGf94TdQS2c9+wSSDK4Mknw5ubCGTuvg0xoNaJdirBc="; };
+    devanagari      = { label = "Devanagari script"; version = "2.95.4"; hash = "sha256-6CbOCqOei5eO1zwNQZvB+fFDkqxvJnK82z+zmClhRAE="; };
+    gujarati        = { label = "Gujarati";          version = "2.92.4"; hash = "sha256-BpwibF0/HXDvXpDEek0fj73cxo2QC1hSfQ49Q/ZOZg8="; };
+    gurmukhi        = { label = "Gurmukhi script";   version = "2.91.2"; hash = "sha256-5iLFW2FEE5LBqoALi+3sUjwC0ADntsp259TP+bYwR9g="; }; # renamed from Punjabi
+    kannada         = { label = "Kannada";           version = "2.5.4" ; hash = "sha256-7y2u0tBdNYCeY7Y+aqhxXP7Qv6GglJeVO1wvM9CzyIQ="; };
+    malayalam       = { label = "Malayalam";         version = "2.92.2"; hash = "sha256-SzM38vuAlP9OMC8kUuHQylmH8TUjCeg1y/Zcu2I2bjA="; };
+    marathi         = { label = "Marathi";           version = "2.94.2"; hash = "sha256-jK1Gwcr5gqzRNkbIxs4V/OYgUlUEpU0OYzKDTkiMlqM="; };
+    nepali          = { label = "Nepali";            version = "2.94.2"; hash = "sha256-OX1ekxeSbVGOrdbZ3Jvu4nii0zkgbuij10JIzqRcFx4="; };
+    odia            = { label = "Odia";              version = "2.91.2"; hash = "sha256-3/eczBGGZj4QPs7KY0as9zk5HaBfhgz6YgU0qmwpVcA="; }; # renamed from Oriya
+    tamil-classical = { label = "Classical Tamil";   version = "2.5.4" ; hash = "sha256-6SsddTCEUHMoF7X4+i7eXimmMuktfFAl8uz95RwM+yg="; };
+    tamil           = { label = "Tamil";             version = "2.91.3"; hash = "sha256-8lcNw87o9lhQsKwCqwBSfx7rhcrH/eEqac7EsA9/w/E="; };
+    telugu          = { label = "Telugu";            version = "2.5.5" ; hash = "sha256-cZh93NfEB+5S1JeEowtBMJ0nbZsFGpbEp2WAtzxrA8A="; };
  };
  gplfonts = {
    # GPL fonts removed from later releases
-    kashmiri        = { label = "Kashmiri";          version = "2.4.3" ; sha256 = "0c6whklad9bscymrlcbxj4fdvh4cdf40vb61ykbp6mapg6dqxwhn"; };
-    konkani         = { label = "Konkani";           version = "2.4.3" ; sha256 = "0pcb5089dabac1k6ymqnbnlyk7svy2wnb5glvhsd8glycjhrcp70"; };
-    maithili        = { label = "Maithili";          version = "2.4.3" ; sha256 = "1yfwv7pcj7k4jryz0s6mb56bq7fs15g56y7pi5yd89q1f8idk6bc"; };
-    sindhi          = { label = "Sindhi";            version = "2.4.3" ; sha256 = "1iywzyy185bvfsfi5pp11c8bzrp40kni2cpwcmxqwha7c9v8brlc"; };
+    kashmiri        = { label = "Kashmiri";          version = "2.4.3" ; hash = "sha256-6T2QaWnt3+e5nr4vbk44FouqmeWKzia1lSf8S/bvqCs="; };
+    konkani         = { label = "Konkani";           version = "2.4.3" ; hash = "sha256-hVy2rxrUTPDeNnugi3Bk7z0JqGmk4/yeUsAoI/4R7A8="; };
+    maithili        = { label = "Maithili";          version = "2.4.3" ; hash = "sha256-ikDcpJqdizAYRpgoebzqxOEeodJ6C3fO2rsqGzC0HCs="; };
+    sindhi          = { label = "Sindhi";            version = "2.4.3" ; hash = "sha256-wU3B9fh+8E1bFBMnakzmajY7eNKzed9+eYL5AOxyNQI="; };
  };

-  mkpkg = license: name: {label, version, sha256}: fetchzip {
-    name = "lohit-${name}-${version}";
+  mkpkg = license: pname: {label, version, hash}: stdenvNoCC.mkDerivation {
+    inherit pname version;

-    url = "https://releases.pagure.org/lohit/lohit-${name}-ttf-${version}.tar.gz";
+    src = fetchurl {
+      url = "https://releases.pagure.org/lohit/lohit-${pname}-ttf-${version}.tar.gz";
+      inherit hash;
+    };

-    postFetch = ''
-      tar -xzf $downloadedFile --strip-components=1
+    installPhase = ''
+      runHook preInstall

      mkdir -p $out/share/fonts/truetype
      cp -v *.ttf $out/share/fonts/truetype/
@ -37,11 +40,11 @@ let
      mkdir -p $out/etc/fonts/conf.d
      cp -v *.conf $out/etc/fonts/conf.d

-      mkdir -p "$out/share/doc/lohit-${name}"
-      cp -v ChangeLog* COPYRIGHT* "$out/share/doc/lohit-${name}/"
-    '';
+      mkdir -p "$out/share/doc/lohit-${pname}"
+      cp -v ChangeLog* COPYRIGHT* "$out/share/doc/lohit-${pname}/"

-    inherit sha256;
+      runHook postInstall
+    '';

    meta = {
      inherit license;
--- a/pkgs/data/fonts/mph-2b-damase/default.nix
+++ b/pkgs/data/fonts/mph-2b-damase/default.nix
@ -1,17 +1,21 @@
-{ fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-fetchzip {
-  name = "MPH-2B-Damase-2";
+stdenvNoCC.mkDerivation rec {
+  pname = "mph-2b-damase";
+  version = "2";

-  url = "http://www.wazu.jp/downloads/damase_v.2.zip";
+  src = fetchzip {
+    url = "https://web.archive.org/web/20160322114946/http://www.wazu.jp/downloads/damase_v.2.zip";
+    hash = "sha256-4x78D+c3ZBxfhTQQ4+gyxvrsuztHF2ItXLh4uA0PxvU=";
+  };

-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
  '';

-  sha256 = "0yzf12z6fpbgycqwiz88f39iawdhjabadfa14wxar3nhl9n434ql";
-
-  meta = {
-  };
+  meta = { };
 }
--- a/pkgs/data/fonts/mplus-outline-fonts/default.nix
+++ b/pkgs/data/fonts/mplus-outline-fonts/default.nix
@ -1,16 +1,23 @@
-{ lib, fetchzip, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchurl, fetchFromGitHub }:

 let pname = "mplus-outline-fonts";
-in {
-  osdnRelease = fetchzip {
-    name = "${pname}-osdn";
-    url = "mirror://osdn/mplus-fonts/62344/mplus-TESTFLIGHT-063a.tar.xz";
-    sha256 = "sha256-+VN+aFx5hMlWwtk+FM+vL6G07+yEi9kYYsoQLSfMUZo=";
-    postFetch = ''
-      install -m444 -Dt $out/share/fonts/truetype/${pname} $out/*.ttf
-      shopt -s extglob dotglob
-      rm -rf $out/!(share)
-      shopt -u extglob dotglob
+in
+{
+  osdnRelease = stdenvNoCC.mkDerivation {
+    pname = "${pname}-osdn";
+    version = "063a";
+
+    src = fetchurl {
+      url = "mirror://osdn/mplus-fonts/62344/mplus-TESTFLIGHT-063a.tar.xz";
+      hash = "sha256-ROuXO0tq/1dN5FTbEF3cI+Z0nCKUc0vZyx4Nc05M3Xk=";
+    };
+
+    installPhase = ''
+      runHook preInstall
+
+      install -m444 -Dt $out/share/fonts/truetype/${pname} *.ttf
+
+      runHook postInstall
    '';

    meta = with lib; {
@ -22,19 +29,25 @@ in {
    };
  };

-  githubRelease = fetchFromGitHub {
-    name = "${pname}-github";
-    owner = "coz-m";
-    repo = "MPLUS_FONTS";
-    rev = "336fec4e9e7c1e61bd22b82e6364686121cf3932";
-    sha256 = "sha256-LSIyrstJOszll72mxXIC7EW4KEMTFCaQwWs59j0UScE=";
-    postFetch = ''
+  githubRelease = stdenvNoCC.mkDerivation {
+    pname = "${pname}-github";
+    version = "unstable-2022-05-19";
+
+    src = fetchFromGitHub {
+      owner = "coz-m";
+      repo = "MPLUS_FONTS";
+      rev = "336fec4e9e7c1e61bd22b82e6364686121cf3932";
+      hash = "sha256-jzDDUs1dKjqNjsMeTA2/4vm+akIisnOuE2mPQS7IDSA=";
+    };
+
+    installPhase = ''
+      runHook preInstall
+
      mkdir -p $out/share/fonts/{truetype,opentype}/${pname}
-      mv $out/fonts/ttf/* $out/share/fonts/truetype/${pname}
-      mv $out/fonts/otf/* $out/share/fonts/opentype/${pname}
-      shopt -s extglob dotglob
-      rm -rf $out/!(share)
-      shopt -u extglob dotglob
+      mv fonts/ttf/* $out/share/fonts/truetype/${pname}
+      mv fonts/otf/* $out/share/fonts/opentype/${pname}
+
+      runHook postInstall
    '';

    meta = with lib; {
--- a/pkgs/data/fonts/mro-unicode/default.nix
+++ b/pkgs/data/fonts/mro-unicode/default.nix
@ -1,13 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:

-fetchzip {
-  name = "mro-unicode-2013-05-25";
+stdenvNoCC.mkDerivation {
+  pname = "mro-unicode";
+  version = "unstable-2013-05-25";

-  url = "https://github.com/phjamr/MroUnicode/raw/f297de070f7eba721a47c850e08efc119d3bfbe8/MroUnicode-Regular.ttf";
+  src = fetchurl {
+    url = "https://github.com/phjamr/MroUnicode/raw/f297de070f7eba721a47c850e08efc119d3bfbe8/MroUnicode-Regular.ttf";
+    hash = "sha256-hcQmTuRWxaU5KEMXg/O0b1olE8YxXWz0PAlqAJknR/0=";
+  };

-  postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/MroUnicode-Regular.ttf";
+  dontUnpack = true;

-  sha256 = "1i71bjd9gdyn8ladfncbfhz6xz1h8xx8yf876j1z8lh719410c8g";
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 $src $out/share/fonts/truetype/MroUnicode-Regular.ttf
+
+    runHook postInstall
+  '';

  meta = with lib; {
    homepage = "https://github.com/phjamr/MroUnicode";
--- a/pkgs/data/fonts/nerdfonts/shas.nix
+++ b/pkgs/data/fonts/nerdfonts/shas.nix
@ -1,55 +1,55 @@
 {
-  "3270" = "1icrqgi7i7cf4jhgpdymv2mkvwh5lgx6yfbs3lrj6jxyhyv14mjj";
-  "Agave" = "0ar50csbsx0rhm3zbi3jf2c9r7wpx20lpmij1i205p53qbiihpv1";
-  "AnonymousPro" = "1is1jgxslmjy4pag137yyh99cf6dvlbkwwnaf91i73ad2w2mm2hm";
-  "Arimo" = "0a5s4flni7wggw5cc9mcc0ipcbmm786fmh2b2y7kp2d3i92sq76x";
-  "AurulentSansMono" = "10agjvrr18ddh8gmdv3ih2lxvrklc65vwsrzzi89h0f8jcas50l5";
-  "BigBlueTerminal" = "130p26r3b2m66ycd549sirvysicr3ld3l8qmrdfw9fr4jva8767s";
-  "BitstreamVeraSansMono" = "02dwhxs7agr3nbwslimryd3wq41wxsw9as0dk3czyjwrgiiwqbzh";
-  "CascadiaCode" = "1y06c8sfwy3pbxda56z7b7awrhia30f7xylj4m1wsnqql5bkwz21";
-  "CodeNewRoman" = "07y2yv9yi35lksiinpm0pxl5jjlbhffnm3mqjqr9292k0d76wrr8";
-  "Cousine" = "1cr1l25ynis1wf9rh0hdyaj4v4cvpv8ci359qjlhhpai5vspr273";
-  "DaddyTimeMono" = "1qj1fqrass97hnn2vm9wdmhyn99w5xk1swm2b1kp70bjbp4jarvh";
-  "DejaVuSansMono" = "03z80lhg128r4ivpcixcxfradn2n9hnwdk2bnbk7z5brqskh0sfy";
-  "DroidSansMono" = "17kvbcsasvfz339ld390msw8715ydfd5vvfm8rm6lyb34rv1z53s";
-  "FantasqueSansMono" = "0whjkl0dk1w4f29vw4jnzx8zwll9fl1axxnmsch9pcm3q7rwzpb5";
-  "FiraCode" = "0wn127x4i4l64v8ql32fw64k82iv9z6q0gkf5p285dcrlbjih04x";
-  "FiraMono" = "0cl4ssdylydwm4zhms2400c7idg0mf7yzsqds2qm7im744m6gkr7";
-  "FontPatcher" = "0hidpffswnz4375s61wq76djn0wilcgcmwz4b0v5gs4hz0zj0yp2";
-  "Go-Mono" = "1w9a507lnxv50x0xlj28ypijvvgcmypk6i27i367gkwsnnn6sqpp";
-  "Gohu" = "11gd9mzj6jwkxq3mxa33i0gb3s5f3dn00lnw360pamc5dyakr6l0";
-  "Hack" = "05vp3315bigfnr6p2fb884jrw489lhhpfqp764h51rldhf6674pj";
-  "Hasklig" = "081z71gfk3i1dqmy6myjygrk65bd7ln6p761i8j6sw3jx0567ml6";
-  "HeavyData" = "1fawn2xfq5js661s5wqjpfbfksg6n38r6n4x6zcgmr47g5hpnpmn";
-  "Hermit" = "0gz6vhlgpaljg41w1fddrv58jxjrngyi101vzm2gc8gp7ym4m4ad";
-  "iA-Writer" = "09m4039hzjqinx3ilzddq2msb64iz1y0ba43k2jd33b66svpi37a";
-  "IBMPlexMono" = "0vwrqy0v2swfh63ikp1lbh6cl4f2qv2q28lk2f2dd6kzzg28p6qj";
-  "Inconsolata" = "0n4nqbry3i019b9zbcawjqn5i7kf04p542sbbmnpi6vpfiv7fi5c";
-  "InconsolataGo" = "1q2dq0jrcd1f611icj1zcwp3zbdrrfxq5882d7blkrbhnlj3jywy";
-  "InconsolataLGC" = "0y29y7vk3x2jvi0ca8lxb8z2w9ww00gpsvkh5qvwxxqxhp5qjafk";
-  "Iosevka" = "1j7bb0vf0hxvi55w4q3bnqhqwn9pp2i58mj79nz0qi59sals3qbm";
-  "JetBrainsMono" = "146w91f1x4709wf52c2rh315qcgpph61cgr07ysn154hnwg5miqj";
-  "Lekton" = "1s5dmk24n119hlsj2aw99d5g564adn40vmyrqgzi3kh72zpqlixy";
-  "LiberationMono" = "06miqkf15h8ficd44rh755lw56i2nqcyxaf0vwa2zvls0v5mk2ar";
-  "Lilex" = "0zbgkj20dqnb5hmh52cmcn175zhc55bz1h1gi3ngmfi6nwgn20vz";
-  "Meslo" = "1d94ligqlngj4lwclah1w3ksvb3wg1iqjpmgblnxl36cd965pjqm";
-  "Monofur" = "1x43siij45h7yz1cw8i32kvdqx1n6zgc9qrj179ms1jl180lj1pj";
-  "Monoid" = "183qd1gpf78j2bipr4xh43kwaidlw3sfl8czzngkfdbpymssqak4";
-  "Mononoki" = "1vpdcmwb406rxgvbarhmb3fpzaj53xgg05nagr33vhpzp7d999b1";
-  "MPlus" = "1a7pb4dvh38bsdsjpbnb01pyn07rx0pwwr287i4vy1p46i39qm9m";
-  "NerdFontsSymbolsOnly" = "0zgjvggb7ipssnjcqlw230pkb4vqpl6xzq42wqk9pcgsv7wg09nv";
-  "Noto" = "17p48ig61dgzgd7fyppw65vdj1isg85w4xcxqjkaqx1225w4k8f9";
-  "OpenDyslexic" = "0ypzyhh00vgd1ws6wh23sph9ycp193y5x9aimscxir8sdbnx3sxp";
-  "Overpass" = "19k8kj9gid1m52b55s5jn8m5kslsgm16jqdifj5as2pd2bgjpwbh";
-  "ProFont" = "1wrmh6jqkbygwba7nsfq5ycw84rqp4mpr10bd50cr7p9inkddq3n";
-  "ProggyClean" = "066k2zdihv1x6vbsdalw5cyygmw27b32jvnvq774ry9bbz8yv4l1";
-  "RobotoMono" = "1glqsz3h7rxs55jf8bycvzxd2snf7jd9qgd4ra0jn8h0qkgvsfgd";
-  "ShareTechMono" = "0j3ribfylx3hnqir7i82pgyb56qlvlzp1y1c6lwvw8k15d06y7fi";
-  "SourceCodePro" = "0zdy8xr2ka9m64d69380plz3xaq08rxwdv8idzxbkhfykrp1j3cz";
-  "SpaceMono" = "1nqkqj0jxfj54wlcs6d2618b89y2fs2pg77kvfr4bc45lrqlbxzk";
-  "Terminus" = "00qyvxjv7aa90xn4bmpygwm0llzd1rr7y0szdbv7h5n7i80yx29s";
-  "Tinos" = "11ii28g1wv6ajpkbvw51vg47s3ww4lss46mh4pd0pf0fzz54gfcc";
-  "Ubuntu" = "0vc8rfpqvajj4xd3anqrnx8g54mhnz9z2h4287g21qf2n1qqagn4";
-  "UbuntuMono" = "0rzd625krvvf1c04172ck2507szm9fq6isydgqyhhkr1kwzx5pzq";
-  "VictorMono" = "09nf02zig9kvgvqqwd6dynx3cidjnlq8sa3qxqw3b313pzia8k3i";
+  "3270" = "03rf3prn4c9q5mggbdzpp3la7in1dq12anqxjpinxwla7ngdh4rv";
+  "Agave" = "177b2yljw4fxbsmjp8yrwvjzj9186f8g0s59xnz56nrl9ndx84qm";
+  "AnonymousPro" = "0qn5xa37g9y47ski5hc2vxhvfbfpl58ranpziiw733kv83pkbkq6";
+  "Arimo" = "0b69gh5qgl0v6b1cirma7l32yxj2d53w305gpfr6flral3ljq6if";
+  "AurulentSansMono" = "165hfg67061zqbs28fl66ldi910n5pnzb6n6d39wh70pclgy2g4n";
+  "BigBlueTerminal" = "1adindb4lvihya3mphmshk4vigragskyrx6ixydrp8i1f7s9sp20";
+  "BitstreamVeraSansMono" = "0mi9j69f8s48fygwb7fz9m81871nvajh895mpch7qj69xmpp9acs";
+  "CascadiaCode" = "13vlfbagjx033j97li6ypvr0zhxbm96lcz8xcn715225mslr2ib4";
+  "CodeNewRoman" = "1r4q48p315x021m0qrd1xmfgqw4xif3snlc764hq5iy10vxdv9ni";
+  "Cousine" = "18m2dlcg6dymi0xwrky4q7ynjx4bqnr5lnvbgr9cdnyf3zz9b6rj";
+  "DaddyTimeMono" = "0qq5lb4xpqggaz0bml8c2awlgwal6xvyx9nydxqgs672jq7hn1cd";
+  "DejaVuSansMono" = "1qnl6gyfyq4cyx0nyl7f39cm3mz33rfngv9kq2g7b187n4dmawaa";
+  "DroidSansMono" = "1l2cl2ryv9p7wlg6q5zsmg5wmfp27s3h47lq75d07chydyr08vii";
+  "FantasqueSansMono" = "1m2xkr7dhfa9bn9vha0s1x7sl1n8l1kdl8f4c876cwjh1mvrwkar";
+  "FiraCode" = "02gnxi9rs25i7mpzkir62w6khvijpma0j0sm3a7gfm0kfdkqzi8j";
+  "FiraMono" = "1kn5vl90xi6ba7msfgwvv9frpfr33xv8q93r62lnqs3avfk743j9";
+  "FontPatcher" = "039yiz7clkghyc6djf4zcaq6k83w2jhxcy66z4i9zmqh3km81wlr";
+  "Go-Mono" = "0bmd7r38ss754gpkndlag0gxap5ga473y778fyrrr3ccccg6d8iv";
+  "Gohu" = "0cvfdli8kzrd9n2h152432f8zr9ffvp29vsfcf98nla3ax2p0v05";
+  "Hack" = "1q3xdlpxps41pi724697mb5bc98mmql8s2lc4xh9zwddjvchd3zl";
+  "Hasklig" = "0xmg0h5bjjiqj00pv51q2babfm7j6bl1b8r1w26z95jvrpnifi1z";
+  "HeavyData" = "1rppgk2lj95kv67c9s97wkqkbrmyp5y7qm1b0a1sk49sg7l4mljp";
+  "Hermit" = "1cw8ia9b5adb7z63cag6l25sahp82gr6bsz9qqc3p12nzi5lxsk8";
+  "iA-Writer" = "01bx8j6hqpl5zmx96d6zrwn3n6ckic5zxr53wls6zdmp01wnkg72";
+  "IBMPlexMono" = "1m1qzxls16cfsxwly5r4vlwpfv477sf3gi6yj9krvkxp0d5ymz74";
+  "Inconsolata" = "1vavavjdiwrlxy9klp0cm6pvmr0nkl7dpls7ja79zgkw7yjhsifq";
+  "InconsolataGo" = "0cp76c6s2r3q8vgild0jpc94b13ypzbyvmas9gwhq1mvf24k4jp5";
+  "InconsolataLGC" = "16a59y1idqp1zgkw9wxcdgcjg6bjlxwbj3a3a00h4gwkczlp2r42";
+  "Iosevka" = "0qg88d2rqbm1x0vfyyr495dznnviga8979dg0ik5yw27fc43hrjj";
+  "JetBrainsMono" = "19ja9dksxq2dl2hi8nyflvl7skyi2wd65s4z14jcilbynxmk2z0q";
+  "Lekton" = "03378znmbss5qq75jmc0r51qwpxsiy2ng8gi164s2mjykr83gr2n";
+  "LiberationMono" = "13r13drx8r1mkbndfw6ip48sjyhf6qw0wgrwyqlgz5dcm3z9c3gx";
+  "Lilex" = "1w2iw9ksnkmwa37a30vrlwg6sxh6l19wc95f8s5mx06sa3ywfs11";
+  "Meslo" = "0fli7njkhq89ykdmdch313mzswlb23b716d0656qw8q3fbyh9dzh";
+  "Monofur" = "0lhfm5dxh4nsq0whwvpqbr2grb27pl03wi7l7vdjbf5x1iacrpfp";
+  "Monoid" = "1jrknl6yz6k6a8l9iiw2s74xkfqckn9y9vjdk49cyf2iy3fzbi30";
+  "Mononoki" = "0jw1kx7ryakx1wdgk9jf2ygrcq65wjaar5w1bggv5zlsxpxdllis";
+  "MPlus" = "1lvmv4vcs36137fv1vbw3vnyxxar8klgngn77202lhgvgi44x60a";
+  "NerdFontsSymbolsOnly" = "0sizriiwa7xh2dscz96gyr4sg04dxxi4f3sv27qk3g46vq0ciw4w";
+  "Noto" = "0dwjj3l7ryx7ysbnp5hh81n3qqqn3yf4h8jypm4ri96vf360myad";
+  "OpenDyslexic" = "1gpmzcgp6bpidi8h1l5a0n3q912swqk04mdhqwpqskj1jn77d2hb";
+  "Overpass" = "1ywp6fphy6akdfd96a37jqcjqry9w15zr0r609vf5a11n1aq3s0w";
+  "ProFont" = "0g3qa8lcp199mln5myn3yn4hdgyx3n16ajdm8a7anjfi9im2i6ns";
+  "ProggyClean" = "0q4m7kq3k0ga6i2kr6a4k59na8b7m6zvvj9zyp61375lm6wb3bv2";
+  "RobotoMono" = "0j055qjm0x4ksy19snplykm9dm9jkmn9swsis49k96mfw7wx9mfq";
+  "ShareTechMono" = "055hg15ghd1ca8wxq3sfjpck8w4x6qnzjyn3r8rslyrbhl51v9aj";
+  "SourceCodePro" = "05fs5ralnz9m6zdck9bvzf1rjgr4f5m1fr9m51cmr60wzhag9qsz";
+  "SpaceMono" = "1m3x85qzykxg5mb56d1zgl367q55ndndxzzmsrlibmybqvc1ffq9";
+  "Terminus" = "0fkqd85qfp8dk8sbyjfxirfiwlfl9a40z8jhybzzd7ys4yrzlq1c";
+  "Tinos" = "11bbg7ssf7wndxrm6kklggsfhmyaijfg4xi6cw743kcwzfvi8kd1";
+  "Ubuntu" = "14w55vh42mz5lvbpl4p1vx31hba957c5345qfpmym5majz83hx3q";
+  "UbuntuMono" = "1xybn0q1xx5sidhllna5y7584fl75qw6v5alb2p1b6933a5czg0m";
+  "VictorMono" = "02c5c9ljnmkf4awfhbjna6g86220ckv977rrc1sh6qr7q8zci6vr";
 }
--- a/pkgs/data/fonts/nerdfonts/version.nix
+++ b/pkgs/data/fonts/nerdfonts/version.nix
@ -1 +1 @@
-"2.3.0"
+"2.3.3"
--- a/pkgs/data/fonts/pretendard/default.nix
+++ b/pkgs/data/fonts/pretendard/default.nix
@ -1,21 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

 let
  version = "1.3.3";

-  mkPretendard = { pname, typeface, sha256 }:
-    fetchzip {
-      name = "${pname}-${version}";
+  mkPretendard = { pname, typeface, hash }:
+    stdenvNoCC.mkDerivation {
+      inherit pname version;

-      url = "https://github.com/orioncactus/pretendard/releases/download/v${version}/${typeface}-${version}.zip";
-      inherit sha256;
+      src = fetchzip {
+        url = "https://github.com/orioncactus/pretendard/releases/download/v${version}/${typeface}-${version}.zip";
+        stripRoot = false;
+        inherit hash;
+      };

-      stripRoot = false;
+      installPhase = ''
+        runHook preInstall

-      postFetch = ''
-        mkdir -p $out/share/fonts/
-        install -Dm644 $out/public/static/*.otf -t $out/share/fonts/opentype
-        rm -rf $out/{public,web,LICENSE.txt}
+        install -Dm644 public/static/*.otf -t $out/share/fonts/opentype
+
+        runHook postInstall
      '';

      meta = with lib; {
@ -32,18 +35,18 @@ in
  pretendard = mkPretendard {
    pname = "pretendard";
    typeface = "Pretendard";
-    sha256 = "sha256-lRHRdCAg3i3+3Y6j0dCXUgwLdeS/VeI6KNkbDKchNEY=";
+    hash = "sha256-xCEZlwTPhrNIO6WODl55wo2oin+iMYOL/rVaEybpzr0=";
  };

  pretendard-jp = mkPretendard {
    pname = "pretendard-jp";
    typeface = "PretendardJP";
-    sha256 = "sha256-VgGt/WoaaJJDAzw+gUQVgTQ+q34bdAaKUB4cA9eU0dQ=";
+    hash = "sha256-x0G7ULzkIJqZlK995+wWKHXZdWryUTRouGTa5LsJQzk=";
  };

  pretendard-std = mkPretendard {
    pname = "pretendard-std";
    typeface = "PretendardStd";
-    sha256 = "sha256-FOlZrr6CHPfUm9Q+Yoi0HLQUI7cAhQYq6P6sJGXBIWg=";
+    hash = "sha256-/I8LZhFB86/+o+IzUP+bSIq7scKPOL7k/6/Bom0ZSqg=";
  };
 }
--- a/pkgs/data/fonts/rounded-mgenplus/default.nix
+++ b/pkgs/data/fonts/rounded-mgenplus/default.nix
@ -1,17 +1,25 @@
-{ lib, fetchzip, p7zip }:
+{ lib, stdenvNoCC, fetchurl, p7zip }:

-let
+stdenvNoCC.mkDerivation rec {
  pname = "rounded-mgenplus";
  version = "20150602";
-in fetchzip rec {
-  name = "${pname}-${version}";

-  url = "https://osdn.jp/downloads/users/8/8598/${name}.7z";
-  postFetch = ''
-    ${p7zip}/bin/7z x $downloadedFile
+  src = fetchurl {
+    url = "https://osdn.jp/downloads/users/8/8598/${pname}-${version}.7z";
+    hash = "sha256-7OpnZJc9k5NiOPHAbtJGMQvsMg9j81DCvbfo0f7uJcw=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ p7zip ];
+
+  installPhase = ''
+    runHook preInstall
+
    install -m 444 -D -t $out/share/fonts/${pname} ${pname}-*.ttf
+
+    runHook postInstall
  '';
-  sha256 = "0vwdknagdrl5dqwpb1x5lxkbfgvbx8dpg7cb6yamgz71831l05v1";

  meta = with lib; {
    description = "A Japanese font based on Rounded M+ and Noto Sans Japanese";
--- a/pkgs/data/fonts/ruwudu/default.nix
+++ b/pkgs/data/fonts/ruwudu/default.nix
@ -1,19 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
  pname = "ruwudu";
  version = "2.000";

-  url = "https://software.sil.org/downloads/r/ruwudu/Ruwudu-${version}.zip";
+  src = fetchzip {
+    url = "https://software.sil.org/downloads/r/ruwudu/Ruwudu-${version}.zip";
+    hash = "sha256-FP+ZHm1fKlozAAI2PbJ4r4v5OwRxBtYMRLmRwPbqx2I=";
+  };
+
+  installPhase = ''
+    runHook preInstall

-  postFetch = ''
-    rm -rf $out/web $out/manifest.json
    mkdir -p $out/share/{doc/${pname},fonts/truetype}
-    mv $out/*.ttf $out/share/fonts/truetype/
-    mv $out/*.txt $out/documentation $out/share/doc/${pname}/
-  '';
+    mv *.ttf $out/share/fonts/truetype/
+    mv *.txt documentation $out/share/doc/${pname}/

-  sha256 = "sha256-JCvVPbAFBWHL2eEnEUSgdTZ+Vkw3wkS3aS85xQZKNQs=";
+    runHook postInstall
+  '';

  meta = with lib; {
    homepage = "https://software.sil.org/ruwudu/";
--- a/pkgs/data/fonts/sampradaya/default.nix
+++ b/pkgs/data/fonts/sampradaya/default.nix
@ -1,16 +1,26 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:

-fetchzip {
-  name = "sampradaya-2015-05-26";
+stdenvNoCC.mkDerivation rec {
+  pname = "sampradaya";
+  version = "0.5.0";

-  url = "https://bitbucket.org/OorNaattaan/sampradaya/raw/afa9f7c6ab17e14bd7dd74d0acaec2f75454dfda/Sampradaya.ttf";
+  src = fetchurl {
+    url = "https://github.com/deepestblue/sampradaya/releases/download/v${version}/Sampradaya.ttf";
+    hash = "sha256-ygKMNzHvbLR2A5HHrfY2C9ZUg0yng+JL3cyg6sBKqeQ=";
+  };

-  postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/Sampradaya.ttf";
+  dontUnpack = true;

-  sha256 = "1pqyj5r5jc7dk8yyzl7i6qq2m9zvahcjj49a66wwzdby5zyw8dqv";
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 $src $out/share/fonts/truetype/Sampradaya.ttf
+
+    runHook postInstall
+  '';

  meta = with lib; {
-    homepage = "https://bitbucket.org/OorNaattaan/sampradaya/";
+    homepage = "https://github.com/deepestblue/sampradaya";
    description = "Unicode-compliant Grantha font";
    maintainers = with maintainers; [ mathnerd314 ];
    license = licenses.ofl; # See font metadata
--- a/pkgs/data/fonts/shrikhand/default.nix
+++ b/pkgs/data/fonts/shrikhand/default.nix
@ -1,15 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:

-let
-  version = "2016-03-03";
-in fetchzip {
-  name = "shrikhand-${version}";
+stdenvNoCC.mkDerivation {
+  pname = "shrikhand";
+  version = "unstable-2016-03-03";

-  url = "https://github.com/jonpinhorn/shrikhand/raw/c11c9b0720fba977fad7cb4f339ebacdba1d1394/build/Shrikhand-Regular.ttf";
+  src = fetchurl {
+    url = "https://github.com/jonpinhorn/shrikhand/raw/c11c9b0720fba977fad7cb4f339ebacdba1d1394/build/Shrikhand-Regular.ttf";
+    hash = "sha256-wHP1Bwu5Yw3a+RwDOHrmthsnuvwyCV4l6ma5EjA6EMA=";
+  };

-  postFetch = "install -D -m644 $downloadedFile $out/share/fonts/truetype/Shrikhand-Regular.ttf";
+  dontUnpack = true;

-  sha256 = "0s54k9cs1g2yz6lwg5gakqb12vg5qkfdz3pc8mh7mib2s6q926hs";
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m644 $src $out/share/fonts/truetype/Shrikhand-Regular.ttf
+
+    runHook postInstall
+  '';

  meta = with lib; {
    homepage = "https://jonpinhorn.github.io/shrikhand/";
--- a/pkgs/data/fonts/sil-abyssinica/default.nix
+++ b/pkgs/data/fonts/sil-abyssinica/default.nix
@ -1,18 +1,22 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchzip }:

-let
+stdenvNoCC.mkDerivation rec {
+  pname = "sil-abyssinica";
  version = "2.200";
-in
-fetchzip rec {
-  name = "sil-abyssinica-${version}";
-  url = "https://software.sil.org/downloads/r/abyssinica/AbyssinicaSIL-${version}.zip";
-  sha256 = "sha256-Kvswqzw8remcu36QaVjeyk03cR4wW5BKQMDihiaxJoE=";

-  postFetch = ''
-    rm -rf $out/web
-    mkdir -p $out/share/{fonts/truetype,doc/${name}}
-    mv $out/*.ttf $out/share/fonts/truetype/
-    mv $out/*.txt $out/documentation $out/share/doc/${name}/
+  src = fetchzip {
+    url = "https://software.sil.org/downloads/r/abyssinica/AbyssinicaSIL-${version}.zip";
+    hash = "sha256-IdWMZHm9VoLVDO0//ISujxlXUxe0O6+aEcdP63YRmPg=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/{fonts/truetype,doc/${pname}-${version}}
+    mv *.ttf $out/share/fonts/truetype/
+    mv *.txt documentation $out/share/doc/${pname}-${version}/
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/data/fonts/sil-padauk/default.nix
+++ b/pkgs/data/fonts/sil-padauk/default.nix
@ -1,19 +1,23 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchzip }:

-let
+stdenvNoCC.mkDerivation rec {
+  pname = "sil-padauk";
  version = "5.001";
-in
-fetchzip rec {
-  name = "sil-padauk-${version}";
-  url = "https://software.sil.org/downloads/r/padauk/Padauk-${version}.zip";
-  sha256 = "sha256-6H9EDmXr1Ox2fgLw9sG5JrCAllK3tbjvMfLi8DTF1f0=";

-  postFetch = ''
+  src = fetchzip {
+    url = "https://software.sil.org/downloads/r/padauk/Padauk-${version}.zip";
+    hash = "sha256-rLzuDUd+idjTN0xQxblXQ9V2rQtJPN2EtWGmTRY1R7U=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/share/fonts/truetype
-    rm -rf $out/{manifest.json,web/}
-    mv $out/*.ttf $out/share/fonts/truetype/
-    mkdir -p $out/share/doc/${name}
-    mv $out/*.txt $out/documentation/ $out/share/doc/${name}/
+    mv *.ttf $out/share/fonts/truetype/
+    mkdir -p $out/share/doc/${pname}-${version}
+    mv *.txt documentation/ $out/share/doc/${pname}-${version}/
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/data/fonts/sitelen-seli-kiwen/default.nix
+++ b/pkgs/data/fonts/sitelen-seli-kiwen/default.nix
@ -1,20 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-let
-  rev = "69132c99873894746c9710707aaeb2cea2609709";
-in
-fetchzip {
+stdenvNoCC.mkDerivation {
  pname = "sitelen-seli-kiwen";
  version = "unstable-2022-06-28";

-  url = "https://raw.githubusercontent.com/kreativekorp/sitelen-seli-kiwen/${rev}/sitelenselikiwen.zip";
-  hash = "sha256-63sl/Ha2QAe8pVKCpLNs//DB0kjLdW01u6tVMrGquIU=";
-  stripRoot = false;
+  src = fetchzip {
+    url = "https://raw.githubusercontent.com/kreativekorp/sitelen-seli-kiwen/69132c99873894746c9710707aaeb2cea2609709/sitelenselikiwen.zip";
+    stripRoot = false;
+    hash = "sha256-viOLAj9Rn60bcQkkDHVuKHCE8KPnIz/L0hIJhum1SSQ=";
+  };
+
+  installPhase = ''
+    runHook preInstall

-  postFetch = ''
    mkdir -p $out/share/fonts/{opentype,truetype}
-    mv $out/*.eot $out/share/fonts/opentype/
-    mv $out/*.ttf $out/share/fonts/truetype/
+    mv *.eot $out/share/fonts/opentype/
+    mv *.ttf $out/share/fonts/truetype/
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/data/fonts/stix-otf/default.nix
+++ b/pkgs/data/fonts/stix-otf/default.nix
@ -1,24 +1,28 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-let
+stdenvNoCC.mkDerivation rec {
+  pname = "stix-otf";
  version = "1.1.1";
-in fetchzip {
-  name = "stix-otf-${version}";

-  url = "http://ftp.fi.muni.cz/pub/linux/gentoo/distfiles/STIXv${version}-word.zip";
+  src = fetchzip {
+    url = "https://sources.debian.org/src/fonts-stix/1.1.1-4.1/STIXv${version}-word.zip";
+    stripRoot = false;
+    hash = "sha256-M3STue+RPHi8JgZZupV0dVLZYKBiFutbBOlanuKkD08=";
+  };

-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 Fonts/STIX-Word/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
  '';

-  sha256 = "04d4qxq3i9fyapsmxk6d9v1xirjam8c74fyxs6n24d3gf2945zmw";
-
  meta = with lib; {
    homepage = "http://www.stixfonts.org/";
    description = "Fonts for Scientific and Technical Information eXchange";
    license = licenses.ofl;
    platforms = platforms.all;
-    maintainers = [maintainers.rycee];
+    maintainers = [ maintainers.rycee ];
  };
 }
--- a/pkgs/data/fonts/tai-languages/default.nix
+++ b/pkgs/data/fonts/tai-languages/default.nix
@ -1,24 +1,34 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:

 {
-tai-ahom = fetchzip {
-  name = "tai-ahom-2015-07-06";
+  tai-ahom = stdenvNoCC.mkDerivation rec {
+    pname = "tai-ahom";
+    version = "unstable-2015-07-06";

-  url = "https://github.com/enabling-languages/tai-languages/blob/b57a3ea4589af69bb8e87c6c4bb7cd367b52f0b7/ahom/.fonts/ttf/.original/AhomUnicode_FromMartin.ttf?raw=true";
+    src = fetchurl {
+      url = "https://github.com/enabling-languages/tai-languages/raw/b57a3ea4589af69bb8e87c6c4bb7cd367b52f0b7/ahom/.fonts/ttf/.original/AhomUnicode_FromMartin.ttf";
+      hash = "sha256-U1vcVf/VgXhvK1f2Iw2JKkd2EzJgz7KbHAwnUanX8n4=";
+    };

-  postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/AhomUnicode.ttf";
+    dontUnpack = true;

-  sha256 = "03h8ql9d5bzq4j521j0cz08ddf717bzim1nszh2aar6kn0xqnp9q";
+    installPhase = ''
+      runHook preInstall

-  meta = with lib; {
-    homepage = "https://github.com/enabling-languages/tai-languages";
-    description = "Unicode-compliant Tai Ahom font";
-    maintainers = with maintainers; [ mathnerd314 ];
-    license = licenses.ofl; # See font metadata
-    platforms = platforms.all;
+      install -Dm644 $src $out/share/fonts/truetype/AhomUnicode.ttf
+
+      runHook postInstall
+    '';
+
+    meta = with lib; {
+      homepage = "https://github.com/enabling-languages/tai-languages";
+      description = "Unicode-compliant Tai Ahom font";
+      maintainers = with maintainers; [ mathnerd314 ];
+      license = licenses.ofl; # See font metadata
+      platforms = platforms.all;
+    };
  };
-};

-# TODO: package others (Khamti Shan, Tai Aiton, Tai Phake, and/or Assam Tai)
+  # TODO: package others (Khamti Shan, Tai Aiton, Tai Phake, and/or Assam Tai)

 }
--- a/pkgs/data/fonts/ttf-envy-code-r/default.nix
+++ b/pkgs/data/fonts/ttf-envy-code-r/default.nix
@ -1,21 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-let
+stdenvNoCC.mkDerivation rec {
  pname = "ttf-envy-code-r";
  version = "PR7";
-in fetchzip {
-  name = "${pname}-0.${version}";

-  url = "http://download.damieng.com/fonts/original/EnvyCodeR-${version}.zip";
+  src = fetchzip {
+    url = "http://download.damieng.com/fonts/original/EnvyCodeR-${version}.zip";
+    hash = "sha256-pJqC/sbNjxEwbVf2CVoXMBI5zvT3DqzRlKSqFT8I2sM=";
+  };

-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.txt -d "$out/share/doc/${pname}"
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    install -Dm644 *.txt -t $out/share/doc/${pname}
+
+    runHook postInstall
  '';

-  sha256 = "0x0r07nax68cmz7490x2crzzgdg4j8fg63wppcmjqm0230bggq2z";
-
  meta = with lib; {
    homepage = "https://damieng.com/blog/tag/envy-code-r";
    description = "Free scalable coding font by DamienG";
--- a/pkgs/data/fonts/ttf-tw-moe/default.nix
+++ b/pkgs/data/fonts/ttf-tw-moe/default.nix
@ -1,19 +1,22 @@
-{ lib, fetchzip }:
-let
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "ttf-tw-moe";
  version = "2020-11-14";
-in
-fetchzip {
-  name = "ttf-tw-moe";

-  url = "https://github.com/Jiehong/TW-fonts/archive/${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/Jiehong/TW-fonts/archive/${version}.zip";
+    hash = "sha256-9gy8xO93ViIPmpg1du0DbXVCR2FowourLH8nP9d6HK0=";
+  };

-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile TW-fonts-${version}/\*.ttf -d $out/share/fonts/truetype
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
  '';

-  sha256 = "1jd3gjjfa4vadp6d499n0irz5b22z611kd7q5qgqf6s2fwbxfhiz";
-
  meta = with lib; {
    homepage = "http://www.moe.gov.tw/";
    description = "Set of KAI and SONG fonts from the Ministry of Education of Taiwan";
--- a/pkgs/data/fonts/ubuntu-font-family/default.nix
+++ b/pkgs/data/fonts/ubuntu-font-family/default.nix
@ -1,18 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
  pname = "ubuntu-font-family";
  version = "0.83";

-  url = "https://assets.ubuntu.com/v1/fad7939b-ubuntu-font-family-${version}.zip";
+  src = fetchzip {
+    url = "https://assets.ubuntu.com/v1/fad7939b-ubuntu-font-family-${version}.zip";
+    hash = "sha256-FAg1xn8Gcbwmuvqtg9SquSet4oTT9nqE+Izeq7ZMVcA=";
+  };
+
+  installPhase = ''
+    runHook preInstall

-  postFetch = ''
    mkdir -p $out/share/fonts/ubuntu
-    mv $out/*.ttf $out/share/fonts/ubuntu
-    find $out -maxdepth 1 ! -type d -exec rm {} +
-  '';
+    mv *.ttf $out/share/fonts/ubuntu

-  sha256 = "090y665h4kf2bi623532l6wiwkwnpd0xds0jr7560xwfwys1hiqh";
+    runHook postInstall
+  '';

  meta = with lib; {
    description = "Ubuntu Font Family";
--- a/pkgs/data/fonts/victor-mono/default.nix
+++ b/pkgs/data/fonts/victor-mono/default.nix
@ -1,11 +1,8 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-let
+stdenvNoCC.mkDerivation rec {
+  pname = "victor-mono";
  version = "1.5.4";
-in
-fetchzip {
-  name = "victor-mono-${version}";
-  stripRoot = false;

  # Upstream prefers we download from the website,
  # but we really insist on a more versioned resource.
@ -14,19 +11,23 @@ fetchzip {
  # so we extract it from the tagged release.
  # Both methods produce the same file, but this way
  # we can safely reason about what version it is.
-  url = "https://github.com/rubjo/victor-mono/raw/v${version}/public/VictorMonoAll.zip";
+  src = fetchzip {
+    url = "https://github.com/rubjo/victor-mono/raw/v${version}/public/VictorMonoAll.zip";
+    stripRoot = false;
+    hash = "sha256-E8j1bfYrM8yRtasiwgTvyE4EYx2LyAbmw3MXH1l+owk=";
+  };
+
+  installPhase = ''
+    runHook preInstall

-  postFetch = ''
    mkdir -p "$out/share/fonts/"

-    mv $out/OTF $out/share/fonts/opentype
-    mv $out/TTF $out/share/fonts/truetype
+    mv OTF $out/share/fonts/opentype
+    mv TTF $out/share/fonts/truetype

-    rm -r $out/{EOT,WOFF,WOFF2,LICENSE.txt}
+    runHook postInstall
  '';

-  sha256 = "sha256-1si0d2lpuXaDcSc3giVMMMbZc/eKbHKU3wmwfYHZ8o0=";
-
  meta = with lib; {
    description = "Free programming font with cursive italics and ligatures";
    homepage = "https://rubjo.github.io/victor-mono";
--- a/pkgs/development/compilers/fstar/default.nix
+++ b/pkgs/development/compilers/fstar/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, writeScript, fetchFromGitHub, z3, ocamlPackages, makeWrapper, installShellFiles }:
+{ lib, stdenv, writeScript, fetchFromGitHub, z3, ocamlPackages, makeWrapper, installShellFiles, removeReferencesTo }:

 stdenv.mkDerivation rec {
  pname = "fstar";
@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    makeWrapper
    installShellFiles
+    removeReferencesTo
  ] ++ (with ocamlPackages; [
    ocaml
    findlib
@ -55,6 +56,10 @@ stdenv.mkDerivation rec {
    mkdir -p $out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/fstarlib
  '';
  postInstall = ''
+    # Remove build artifacts
+    find $out -name _build -type d | xargs -I{} rm -rf "{}"
+    remove-references-to -t '${ocamlPackages.ocaml}' $out/bin/fstar.exe
+
    wrapProgram $out/bin/fstar.exe --prefix PATH ":" "${z3}/bin"
    installShellCompletion --bash .completion/bash/fstar.exe.bash
    installShellCompletion --fish .completion/fish/fstar.exe.fish
--- a/pkgs/development/interpreters/bqn/cbqn/default.nix
+++ b/pkgs/development/interpreters/bqn/cbqn/default.nix
@ -82,7 +82,7 @@ stdenv.mkDerivation rec {

  outputs = [
    "out"
-  ] ++ lib.optionals stdenv.isLinux [
+  ] ++ lib.optionals enableLibcbqn [
    "lib"
    "dev"
  ];
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "babashka";
-  version = "1.0.170";
+  version = "1.1.172";

  src = fetchurl {
    url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-NM1lcDi60DuBr67kOx6CVLyO8p2DUq6c2oTZEiHBFjw=";
+    sha256 = "sha256-mdcG4zKC9zX0J2S2lWCvFdFFr5sOxfOe9/iPzvEyImM=";
  };

  executable = "bb";
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "umockdev";
-  version = "0.17.13";
+  version = "0.17.15";

  outputs = [ "bin" "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "https://github.com/martinpitt/umockdev/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bG6/bmIJtqSXRuDZGkSNAntUJxurgu1woTLs8pTKE88=";
+    sha256 = "7UGO4rv7B4H0skuXKe8nCtg83czWaln/lEsFnvE2j+8=";
  };

  patches = [
--- a/pkgs/development/libraries/umockdev/hardcode-paths.patch
+++ b/pkgs/development/libraries/umockdev/hardcode-paths.patch
@ -1,8 +1,8 @@
 diff --git a/meson.build b/meson.build
-index 2ed9027..1f6bbf2 100644
+index 15d9e5d..a1906dd 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -38,6 +38,7 @@ g_ir_compiler = find_program('g-ir-compiler', required: false)
+@@ -44,6 +44,7 @@ g_ir_compiler = find_program('g-ir-compiler', required: false)
 
 conf.set('PACKAGE_NAME', meson.project_name())
 conf.set_quoted('VERSION', meson.project_version())
@ -10,7 +10,7 @@ index 2ed9027..1f6bbf2 100644
 
 # glibc versions somewhere between 2.28 and 2.34
 if cc.has_function('__fxstatat', prefix: '#include <sys/stat.h>')
-@@ -148,7 +149,7 @@ hacked_gir = custom_target('UMockdev-1.0 hacked gir',
+@@ -156,7 +157,7 @@ hacked_gir = custom_target('UMockdev-1.0 hacked gir',
 
 if g_ir_compiler.found()
 umockdev_typelib = custom_target('UMockdev-1.0 typelib',
@ -31,28 +31,28 @@ index 5269dd0..a2ec46d 100644
 }
 
 diff --git a/src/umockdev-record.vala b/src/umockdev-record.vala
-index 8434d32..68c7f8e 100644
+index bf0e644..ff5ea59 100644
 --- a/src/umockdev-record.vala
 +++ b/src/umockdev-record.vala
-@@ -435,7 +435,7 @@ main (string[] args)
+@@ -444,7 +444,7 @@ main (string[] args)
         preload = "";
     else
         preload = preload + ":";
-    Environment.set_variable("LD_PRELOAD", preload + "libumockdev-preload.so.0", true);
-+    Environment.set_variable("LD_PRELOAD", preload + Config.LIBDIR + "/libumockdev-preload.so.0", true);
+-    checked_setenv("LD_PRELOAD", preload + "libumockdev-preload.so.0");
+    checked_setenv("LD_PRELOAD", preload + Config.LIBDIR + "/libumockdev-preload.so.0");
 
     try {
         root_dir = DirUtils.make_tmp("umockdev.XXXXXX");
 diff --git a/src/umockdev-run.vala b/src/umockdev-run.vala
-index 9a1ba10..6df2522 100644
+index 7b0753e..66b778b 100644
 --- a/src/umockdev-run.vala
 +++ b/src/umockdev-run.vala
@@ -95,7 +95,7 @@ main (string[] args)
         preload = "";
     else
         preload = preload + ":";
-    Environment.set_variable ("LD_PRELOAD", preload + "libumockdev-preload.so.0", true);
-+    Environment.set_variable ("LD_PRELOAD", preload + Config.LIBDIR + "/libumockdev-preload.so.0", true);
+-    checked_setenv ("LD_PRELOAD", preload + "libumockdev-preload.so.0");
+    checked_setenv ("LD_PRELOAD", preload + Config.LIBDIR + "/libumockdev-preload.so.0");
 
     var testbed = new UMockdev.Testbed ();
 
--- a/pkgs/development/ocaml-modules/gd4o/default.nix
+++ b/pkgs/development/ocaml-modules/gd4o/default.nix
@ -12,6 +12,9 @@ stdenv.mkDerivation rec {
  buildInputs = [ ocaml findlib libjpeg libpng ];
  propagatedBuildInputs = [ gd zlib freetype ];

+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];

  preInstall = ''
    mkdir -p $OCAMLFIND_DESTDIR/stublibs
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-container";
-  version = "2.17.0";
+  version = "2.17.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-UlZJ4nh7BOw4HfFGZucU7Kom7/EuSdgZZzZ30f4wL+0=";
+    hash = "sha256-PXDUjipUG7cYqeO2ivqrqLybHzDIssvBtdZixEMqXOA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-datacatalog";
-  version = "3.11.0";
+  version = "3.11.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-wu53nKA4nmXHuJ+dr9r/A9xDYec1bkW4S8gfgiLBctw=";
+    hash = "sha256-X4h6hrEfjiroAgtG26bz70P2PsEileHmZ5Jq6iPHqCs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-securitycenter";
-  version = "1.18.0";
+  version = "1.18.2";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-gtzSB70x7oN6EiTP1U5P1dV4a4eWZNGtRFInYz7AyCA=";
+    hash = "sha256-O1jSSozVmeDRoTCtRhsBDlZ/o8g/8ccGkJCg6hp7ob8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/ha-philipsjs/default.nix
+++ b/pkgs/development/python-modules/ha-philipsjs/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "ha-philipsjs";
-  version = "2.9.0";
+  version = "3.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -20,8 +20,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "danielperna84";
    repo = pname;
-    rev = version;
-    sha256 = "sha256-B2AQoVyoG6wyE9pTWf/ASQd8iZfIrjUr078rSkoARf0=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-iJxu+TdgDHMnLuNTFj0UC8V76x3nAgGqswMLDSgmDmQ=";
  };

  propagatedBuildInputs = [
@ -43,6 +43,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python library to interact with Philips TVs with jointSPACE API";
    homepage = "https://github.com/danielperna84/ha-philipsjs";
+    changelog = "https://github.com/danielperna84/ha-philipsjs/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/sphinxext-opengraph/default.nix
+++ b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "sphinxext-opengraph";
-  version = "0.7.4";
+  version = "0.7.5";

  src = fetchFromGitHub {
    owner = "wpilibsuite";
    repo = "sphinxext-opengraph";
    rev = "refs/tags/v${version}";
-    hash = "sha256-N8448GHg/lR7z7Y4F4vO7z+wAeaboo8Cj0X+HSyToAA=";
+    hash = "sha256-fNtXj7iYX7rSaGO6JcxC+PvR8WzTFl8gYwHyRExYdfI=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@ -31,47 +31,33 @@

 let
  # FIXME: Compare revision with
-  # https://github.com/radareorg/radare2/blob/master/libr/arch/p/arm/v35arm64/Makefile#L26-L27
+  # https://github.com/radareorg/radare2/blob/master/libr/arch/p/arm/v35/Makefile#L26-L27
  arm64 = fetchFromGitHub {
    owner = "radareorg";
    repo = "vector35-arch-arm64";
-    rev = "c9e7242972837ac11fc94db05fabcb801a8269c9";
-    hash = "sha256-HFQj23GlLAyyzMGnPq40XaPv5qPDHdDlQOo0Hprc9Cs=";
+    rev = "55d73c6bbb94448a5c615933179e73ac618cf876";
+    hash = "sha256-pZxxp5xDg8mgkGEx7LaBSoKxNPyggFYA4um9YaO20LU=";
  };
  armv7 = fetchFromGitHub {
    owner = "radareorg";
    repo = "vector35-arch-armv7";
-    rev = "dde39f69ffea19fc37e681874b12cb4707bc4f30";
-
-    hash = "sha256-bnWQc0dScM9rhIdzf+iVXvMqYWq/bguEAUQPaZRgdlU=";
+    rev = "f270a6cc99644cb8e76055b6fa632b25abd26024";
+    hash = "sha256-YhfgJ7M8ys53jh1clOzj0I2yfJshXQm5zP0L9kMYsmk=";
  };
 in
 stdenv.mkDerivation rec {
  pname = "radare2";
-  version = "5.8.0";
+  version = "5.8.2";

  src = fetchFromGitHub {
    owner = "radare";
    repo = "radare2";
    rev = version;
-    hash = "sha256-9bDwtMNru7tG0L735y+Vrcg7Htk/TV9SVZn7WP4Ap4c=";
+    hash = "sha256-jwr3QPgJ6vKSk8yGxndQ69AickP8PorNDuGyJzHMpV4=";
  };

-  patches = [
-    (fetchpatch {
-      name = "CVE-2022-4843.patch";
-      url = "https://github.com/radareorg/radare2/commit/842f809d4ec6a12af2906f948657281c9ebc8a24.patch";
-      sha256 = "sha256-asEXW9Ox48w9WQhOA9tleXIvynIjsWb6ItKmFTojgbQ=";
-    })
-    (fetchpatch {
-      name = "CVE-2023-0302.patch";
-      url = "https://github.com/radareorg/radare2/commit/961f0e723903011d4f54c2396e44efa91fcc74ce.patch";
-      hash = "sha256-QinRQDIY4p3P+M3Hh9w3Dv3N/2XTaf3N0nUluHPpAvg=";
-    })
-  ];
-
  preBuild = ''
-    pushd ../libr/arch/p/arm/v35arm64
+    pushd ../libr/arch/p/arm/v35
    cp -r ${arm64} arch-arm64
    chmod -R +w arch-arm64

--- a/pkgs/development/tools/ashpd-demo/default.nix
+++ b/pkgs/development/tools/ashpd-demo/default.nix
@ -64,6 +64,10 @@ stdenv.mkDerivation rec {
    libshumate
  ];

+  # FIXME: workaround for Pipewire 0.3.64 deprecated API change, remove when fixed upstream
+  # https://gitlab.freedesktop.org/pipewire/pipewire-rs/-/issues/55
+  NIX_CFLAGS_COMPILE = [ "-DPW_ENABLE_DEPRECATED" ];
+
  passthru = {
    updateScript = nix-update-script { };
  };
--- a/pkgs/development/tools/castxml/default.nix
+++ b/pkgs/development/tools/castxml/default.nix
@ -1,14 +1,14 @@
-{ lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  libffi,
-  libxml2,
-  zlib,
-  withManual ? true,
-  withHTML ? true,
-  llvmPackages,
-  python3,
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, libffi
+, libxml2
+, zlib
+, withManual ? true
+, withHTML ? true
+, llvmPackages
+, python3
 }:

 let
--- a/pkgs/development/tools/goda/default.nix
+++ b/pkgs/development/tools/goda/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "goda";
-  version = "0.5.4";
+  version = "0.5.5";

  src = fetchFromGitHub {
    owner = "loov";
    repo = "goda";
    rev = "v${version}";
-    sha256 = "sha256-5MkErXgRJtaXbThJYjGWyvt+RAbtULTe0VoXKU3HQug=";
+    sha256 = "sha256-yKhgk/DRcifh+exxTZFti1Aac/sgpvUsNKdioLAzmX0=";
  };

  vendorSha256 = "sha256-BYYuB4ZlCWD8NILkf4qrgM4q72ZTy7Ze3ICUXdoI5Ms=";
--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@ -10,22 +10,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "just";
-  version = "1.11.0";
+  version = "1.13.0";

  src = fetchFromGitHub {
    owner = "casey";
    repo = pname;
-    rev = version;
-    hash = "sha256-TYw2YrilrEUCvyT9VvzrQnHcSnhPrNiAMRjLEk/QjgU=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-5JI3QaUuWvwI3pClZXMPU8v1lcPZ5YioMPGKl/lIjQ0=";
  };

-  cargoHash = "sha256-pgktCRxYlxo/kMdBm3/dzdU3rOXSNFY9IIE8j8Dgro0=";
+  cargoHash = "sha256-91C/5m2avsW7GKQDg/Ez9fzzFhe8ih1De1RbV/MBJbM=";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];

-  nativeCheckInputs = [ coreutils bash ];
-
  preCheck = ''
    # USER must not be empty
    export USER=just-user
@ -64,6 +62,6 @@ rustPlatform.buildRustPackage rec {
    changelog = "https://github.com/casey/just/blob/${version}/CHANGELOG.md";
    description = "A handy way to save and run project-specific commands";
    license = licenses.cc0;
-    maintainers = with maintainers; [ xrelkd jk ];
+    maintainers = with maintainers; [ xrelkd jk adamcstephens ];
  };
 }
--- a/pkgs/games/domination/default.nix
+++ b/pkgs/games/domination/default.nix
@ -26,7 +26,7 @@ let

 in stdenv.mkDerivation {
  pname = "domination";
-  version = "1.2.5";
+  version = "1.2.7";

  # The .zip releases do not contain the build.xml file
  src = fetchsvn {
@ -34,8 +34,8 @@ in stdenv.mkDerivation {
    # There are no tags in the repository.
    # Look for commits like "new version x.y.z info on website"
    # or "website update for x.y.z".
-    rev = "2212";
-    sha256 = "sha256-XuPMxGDap8x7I+U7+1C+DlkQkoV/u2FCwYyTZFWmYHM=";
+    rev = "2261";
+    sha256 = "sha256-xvlPC7M6DaF3g2O3vQDmcdp7914qOaiikY02RTgAVkM=";
  };

  nativeBuildInputs = [
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -2,61 +2,61 @@
    "4.14": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.14.303-hardened1.patch",
-            "sha256": "1ihq6kf19fribpyiisv5wdax0467pylmlmsqn88vf50ps3akc4ix",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.303-hardened1/linux-hardened-4.14.303-hardened1.patch"
+            "name": "linux-hardened-4.14.304-hardened1.patch",
+            "sha256": "099fqlfl9p57pfh5jr7cv30476q2cbhrqs6w63cy3mkwj7l4jwln",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.304-hardened1/linux-hardened-4.14.304-hardened1.patch"
        },
-        "sha256": "17pxl4fgzpz48y7nx1z8891mll64givxgch3z5an6dkr13c2xy2b",
-        "version": "4.14.303"
+        "sha256": "1ma9qpsx0nvi0szlivf8v5l3pjykqwrv4x6y5g0nn6bcwhsb5jv4",
+        "version": "4.14.304"
    },
    "4.19": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.19.270-hardened1.patch",
-            "sha256": "1xii5xchbxnswy7qhhvvivx6c6a5n7iw920yrvm2chrnp5s9mikh",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.270-hardened1/linux-hardened-4.19.270-hardened1.patch"
+            "name": "linux-hardened-4.19.271-hardened1.patch",
+            "sha256": "0xvd9n2fqmr863a4vljki2saa85dccj7mflcfwaslj9g2ygbrf93",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.271-hardened1/linux-hardened-4.19.271-hardened1.patch"
        },
-        "sha256": "14nj1skd73rn59v2ah80vgpc8fh37jvpc75wafpa4glfphx88i11",
-        "version": "4.19.270"
+        "sha256": "06lxh9skp9213n29ynx7a9cinz7wggaxjsz52kghdbwfnjf3yvb3",
+        "version": "4.19.271"
    },
    "5.10": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.10.164-hardened1.patch",
-            "sha256": "1z2qd460wnna658zi8mbz2rqjwbvkxrk03ncicqszfjbinigxp6x",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.164-hardened1/linux-hardened-5.10.164-hardened1.patch"
+            "name": "linux-hardened-5.10.165-hardened1.patch",
+            "sha256": "0gnvnywagqqdsdrbd9fbl671pzfv49mf2xqan9bk3q41mgcyyfgg",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.165-hardened1/linux-hardened-5.10.165-hardened1.patch"
        },
-        "sha256": "0y42xgpmg2mhx81d3bswhk0n3f8vdvmf4k0g8ii6cb01gflalzhc",
-        "version": "5.10.164"
+        "sha256": "03dg8yx0gdzm8zbwd1f9jn4c5jhr8qilhjzxgwm0mv8riz2fy7cp",
+        "version": "5.10.165"
    },
    "5.15": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.15.89-hardened1.patch",
-            "sha256": "0gwgdgmc9c7cpgp5vcyxwqxc5y2br3ghi6x3r11frs1kcwvqjix9",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.89-hardened1/linux-hardened-5.15.89-hardened1.patch"
+            "name": "linux-hardened-5.15.90-hardened1.patch",
+            "sha256": "1zj80v6xpgz00z1lpw5j9qdm0gp44pk7vkflrngbk8m3cwmpw5ha",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.90-hardened1/linux-hardened-5.15.90-hardened1.patch"
        },
-        "sha256": "1s1gflnzvfza5m94c9f3l42kskjadayij4q5gk9vcjq19s3incg7",
-        "version": "5.15.89"
+        "sha256": "0hiv74mxkp3v04lphnyw16akgavaz527bzhnfnpm6rv848047zg6",
+        "version": "5.15.90"
    },
    "5.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.4.229-hardened1.patch",
-            "sha256": "0cww74kkh2n7apzqbdz72d04x39wkasxj5mi7giivpp0s2f0c24a",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.229-hardened1/linux-hardened-5.4.229-hardened1.patch"
+            "name": "linux-hardened-5.4.230-hardened1.patch",
+            "sha256": "0xk80i6wddd909wzhcp7b64sbsjjqpwyjr8gknpc83zcdzv3y892",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.230-hardened1/linux-hardened-5.4.230-hardened1.patch"
        },
-        "sha256": "1bx77x4x10v38ygfiz0dcw938ybczq7f3srg11ifzvwm243r5if5",
-        "version": "5.4.229"
+        "sha256": "0bz6hfhsahymys2g9s4nzf862z0zfq4346577cpvf98hrhnd6kx7",
+        "version": "5.4.230"
    },
    "6.1": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-6.1.7-hardened1.patch",
-            "sha256": "1hp3mbl8vfd2cwpxbhmqqy77nzyk265k1rcf1rz048ivnsppw4cx",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.7-hardened1/linux-hardened-6.1.7-hardened1.patch"
+            "name": "linux-hardened-6.1.8-hardened1.patch",
+            "sha256": "1ry0cb1dsq84n6cxn8ndx47qz1g69kqlfkb16rrlgk49w81i8y8z",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.8-hardened1/linux-hardened-6.1.8-hardened1.patch"
        },
-        "sha256": "03v0pvg831qzbpc09ip1h0p4zz6js9das7vzh8xhsf77sax4ic2a",
-        "version": "6.1.7"
+        "sha256": "0vc1ggjy4wvna7g6xgbjzhk93whssj9ixcal0hkhldxsp0xba2xn",
+        "version": "6.1.8"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.14.303";
+  version = "4.14.304";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "17pxl4fgzpz48y7nx1z8891mll64givxgch3z5an6dkr13c2xy2b";
+    sha256 = "1ma9qpsx0nvi0szlivf8v5l3pjykqwrv4x6y5g0nn6bcwhsb5jv4";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.19.270";
+  version = "4.19.271";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "14nj1skd73rn59v2ah80vgpc8fh37jvpc75wafpa4glfphx88i11";
+    sha256 = "06lxh9skp9213n29ynx7a9cinz7wggaxjsz52kghdbwfnjf3yvb3";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.10.164";
+  version = "5.10.165";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0y42xgpmg2mhx81d3bswhk0n3f8vdvmf4k0g8ii6cb01gflalzhc";
+    sha256 = "03dg8yx0gdzm8zbwd1f9jn4c5jhr8qilhjzxgwm0mv8riz2fy7cp";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.15.89";
+  version = "5.15.90";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1s1gflnzvfza5m94c9f3l42kskjadayij4q5gk9vcjq19s3incg7";
+    sha256 = "0hiv74mxkp3v04lphnyw16akgavaz527bzhnfnpm6rv848047zg6";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.4.229";
+  version = "5.4.230";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1bx77x4x10v38ygfiz0dcw938ybczq7f3srg11ifzvwm243r5if5";
+    sha256 = "0bz6hfhsahymys2g9s4nzf862z0zfq4346577cpvf98hrhnd6kx7";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "6.1.7";
+  version = "6.1.8";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "03v0pvg831qzbpc09ip1h0p4zz6js9das7vzh8xhsf77sax4ic2a";
+    sha256 = "0vc1ggjy4wvna7g6xgbjzhk93whssj9ixcal0hkhldxsp0xba2xn";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "tailscale";
-  version = "1.34.2";
+  version = "1.36.0";

  src = fetchFromGitHub {
    owner = "tailscale";
    repo = "tailscale";
    rev = "v${version}";
-    sha256 = "sha256-uFr7swB7AQLvjDg+1KBCQuoLkDw454+gVe+6/iD74LM=";
+    sha256 = "sha256-hNyEABs/GdfOx6vLTVBgbOzkbFvEDYZ0y1y0a0mIsfA=";
  };
-  vendorSha256 = "sha256-//qhvzZzaAqfcj4HZIy6ZkGyfAwtRdf7ARaXI+trTe0=";
+  vendorSha256 = "sha256-Jy3kjUA8qLhcw9XLw4Xo1zhD+IWZrDNM79TsbnKpx/g=";

  nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];

--- a/pkgs/tools/compression/advancecomp/default.nix
+++ b/pkgs/tools/compression/advancecomp/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "advancecomp";
-  version = "2.4";
+  version = "2.5";

  src = fetchFromGitHub {
    owner = "amadvance";
    repo = "advancecomp";
    rev = "v${version}";
-    hash = "sha256-nl1t1XbyCDYH7jKdIRSIXfXuRCj5N+5noC86VpbpWu4=";
+    hash = "sha256-dlVTMd8sm84M8JZsCfVR/s4jXMQWmrVj7xwUVDsehQY=";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/tools/graphics/wallutils/lscollection-Add-NixOS-paths-to-DefaultWallpaperDirectories.patch
+++ b/pkgs/tools/graphics/wallutils/lscollection-Add-NixOS-paths-to-DefaultWallpaperDirectories.patch
--- a/pkgs/tools/graphics/wallutils/default.nix
+++ b/pkgs/tools/graphics/wallutils/default.nix
@ -1,45 +1,58 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
-, pkg-config
-, wayland
 , libX11
-, xbitmaps
 , libXcursor
 , libXmu
 , libXpm
 , libheif
+, pkg-config
+, wayland
+, xbitmaps
 }:

 buildGoModule rec {
  pname = "wallutils";
-  version = "5.12.4";
+  version = "5.12.5";

  src = fetchFromGitHub {
    owner = "xyproto";
    repo = "wallutils";
    rev = version;
-    sha256 = "sha256-NODG4Lw/7X1aoT+dDSWxWEbDX6EAQzzDJPwsWOLaJEM=";
+    hash = "sha256-qC+AF+NFXSrUZAYaiFPwvfZtsAGhKE4XFDOUcfXUAbM=";
  };

  vendorSha256 = null;

-  patches = [ ./lscollection-Add-NixOS-paths-to-DefaultWallpaperDirectories.patch ];
+  patches = [
+    ./000-add-nixos-dirs-to-default-wallpapers.patch
+  ];

  excludedPackages = [
    "./pkg/event/cmd" # Development tools
  ];

-  ldflags = [ "-s" "-w" ];
+  nativeBuildInputs = [
+    pkg-config
+  ];

-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ wayland libX11 xbitmaps libXcursor libXmu libXpm libheif ];
+  buildInputs = [
+    libX11
+    libXcursor
+    libXmu
+    libXpm
+    libheif
+    wayland
+    xbitmaps
+  ];
+
+  ldflags = [ "-s" "-w" ];

  preCheck =
    let skippedTests = [
-      "TestClosest" # Requiring Wayland or X.
-      "TestNewSimpleEvent" # Blocking
+      "TestClosest" # Requiring Wayland or X
      "TestEveryMinute" # Blocking
+      "TestNewSimpleEvent" # Blocking
    ]; in
    ''
      export XDG_RUNTIME_DIR=`mktemp -d`
@ -47,11 +60,12 @@ buildGoModule rec {
      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
    '';

-  meta = with lib; {
+  meta = {
    description = "Utilities for handling monitors, resolutions, and (timed) wallpapers";
    inherit (src.meta) homepage;
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.AndersonTorres ];
+    inherit (wayland.meta) platforms;
+    badPlatforms = lib.platforms.darwin;
  };
 }
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@ -30,7 +30,7 @@ in

 stdenv.mkDerivation rec {
  pname = "ipxe";
-  version = "unstable-2022-04-06";
+  version = "unstable-2023-01-25";

  nativeBuildInputs = [ gnu-efi mtools openssl perl xorriso xz ] ++ lib.optional stdenv.hostPlatform.isx86 syslinux;
  depsBuildBuild = [ buildPackages.stdenv.cc ];
@ -40,8 +40,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "ipxe";
    repo = "ipxe";
-    rev = "70995397e5bdfd3431e12971aa40630c7014785f";
-    sha256 = "SrTNEYk13JXAcJuogm9fZ7CrzJIDRc0aziGdjRNv96I=";
+    rev = "4bffe0f0d9d0e1496ae5cfb7579e813277c29b0f";
+    sha256 = "oDQBJz6KKV72DfhNEXjAZNeolufIUQwhroczCuYnGQA=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isAarch64 ''
--- a/pkgs/tools/networking/linkchecker/default.nix
+++ b/pkgs/tools/networking/linkchecker/default.nix
@ -51,7 +51,6 @@ python3.pkgs.buildPythonApplication rec {
  ] ++ lib.optionals stdenv.isDarwin [
    "tests/checker/test_content_allows_robots.py"
    "tests/checker/test_http*.py"
-    "tests/checker/test_noproxy.py"
    "tests/test_network.py"
  ];

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -2239,8 +2239,13 @@ with pkgs;
  dolphin-emu = callPackage ../applications/emulators/dolphin-emu { };

  dolphin-emu-beta = qt6Packages.callPackage ../applications/emulators/dolphin-emu/master.nix {
-    inherit (darwin.apple_sdk.frameworks) CoreBluetooth ForceFeedback IOKit OpenGL VideoToolbox;
+    inherit (darwin.apple_sdk_11_0.frameworks) CoreBluetooth ForceFeedback IOKit OpenGL VideoToolbox;
    inherit (darwin) moltenvk;
+    stdenv =
+      if stdenv.isDarwin && stdenv.isAarch64 then llvmPackages_14.stdenv
+      # https://github.com/NixOS/nixpkgs/issues/201254
+      else if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv
+      else stdenv;
  };

  dolphin-emu-primehack = qt5.callPackage ../applications/emulators/dolphin-emu/primehack.nix {