Merge staging-next into staging

lib/licenses.nix

@@ -337,6 +337,11 @@ in mkLicense lset) ({
     fullName = "Creative Commons Attribution 1.0";
   };
 
+  cc-by-20 = {
+    spdxId = "CC-BY-2.0";
+    fullName = "Creative Commons Attribution 2.0";
+  };
+
   cc-by-30 = {
     spdxId = "CC-BY-3.0";
     fullName = "Creative Commons Attribution 3.0";

maintainers/maintainer-list.nix

@@ -11231,6 +11231,15 @@
     githubId = 42545625;
     name = "Maas Lalani";
   };
+  mabster314 = {
+    name = "Max Haland";
+    email = "max@haland.org";
+    github = "mabster314";
+    githubId = 5741741;
+    keys = [{
+      fingerprint = "71EF 8F1F 0C24 8B4D 5CDC 1B47 74B3 D790 77EE 37A8";
+    }];
+  };
   macalinao = {
     email = "me@ianm.com";
     name = "Ian Macalinao";

nixos/modules/services/hardware/ratbagd.nix

@@ -11,6 +11,8 @@ in
   options = {
     services.ratbagd = {
       enable = mkEnableOption (lib.mdDoc "ratbagd for configuring gaming mice");
+
+      package = mkPackageOption pkgs "libratbag" { };
     };
   };
 
@@ -18,10 +20,10 @@ in
 
   config = mkIf cfg.enable {
     # Give users access to the "ratbagctl" tool
-    environment.systemPackages = [ pkgs.libratbag ];
+    environment.systemPackages = [ cfg.package ];
 
-    services.dbus.packages = [ pkgs.libratbag ];
+    services.dbus.packages = [ cfg.package ];
 
-    systemd.packages = [ pkgs.libratbag ];
+    systemd.packages = [ cfg.package ];
   };
 }

nixos/modules/services/misc/portunus.nix

@@ -37,6 +37,15 @@ in
       '';
     };
 
+    seedSettings = lib.mkOption {
+      type = with lib.types; nullOr (attrsOf (listOf (attrsOf anything)));
+      default = null;
+      description = lib.mdDoc ''
+        Seed settings for users and groups.
+        See upstream for format <https://github.com/majewsky/portunus#seeding-users-and-groups-from-static-configuration>
+      '';
+    };
+
     stateDir = mkOption {
       type = types.path;
       default = "/var/lib/portunus";
@@ -172,49 +181,53 @@ in
       "127.0.0.1" = [ cfg.domain ];
     };
 
-    services.dex = mkIf cfg.dex.enable {
+    services = {
-      enable = true;
+      dex = mkIf cfg.dex.enable {
-      settings = {
+        enable = true;
-        issuer = "https://${cfg.domain}/dex";
+        settings = {
-        web.http = "127.0.0.1:${toString cfg.dex.port}";
+          issuer = "https://${cfg.domain}/dex";
-        storage = {
+          web.http = "127.0.0.1:${toString cfg.dex.port}";
-          type = "sqlite3";
+          storage = {
-          config.file = "/var/lib/dex/dex.db";
+            type = "sqlite3";
-        };
+            config.file = "/var/lib/dex/dex.db";
-        enablePasswordDB = false;
-        connectors = [{
-          type = "ldap";
-          id = "ldap";
-          name = "LDAP";
-          config = {
-            host = "${cfg.domain}:636";
-            bindDN = "uid=${cfg.ldap.searchUserName},ou=users,${cfg.ldap.suffix}";
-            bindPW = "$DEX_SEARCH_USER_PASSWORD";
-            userSearch = {
-              baseDN = "ou=users,${cfg.ldap.suffix}";
-              filter = "(objectclass=person)";
-              username = "uid";
-              idAttr = "uid";
-              emailAttr = "mail";
-              nameAttr = "cn";
-              preferredUsernameAttr = "uid";
-            };
-            groupSearch = {
-              baseDN = "ou=groups,${cfg.ldap.suffix}";
-              filter = "(objectclass=groupOfNames)";
-              nameAttr = "cn";
-              userMatchers = [{ userAttr = "DN"; groupAttr = "member"; }];
-            };
           };
-        }];
+          enablePasswordDB = false;
+          connectors = [{
+            type = "ldap";
+            id = "ldap";
+            name = "LDAP";
+            config = {
+              host = "${cfg.domain}:636";
+              bindDN = "uid=${cfg.ldap.searchUserName},ou=users,${cfg.ldap.suffix}";
+              bindPW = "$DEX_SEARCH_USER_PASSWORD";
+              userSearch = {
+                baseDN = "ou=users,${cfg.ldap.suffix}";
+                filter = "(objectclass=person)";
+                username = "uid";
+                idAttr = "uid";
+                emailAttr = "mail";
+                nameAttr = "cn";
+                preferredUsernameAttr = "uid";
+              };
+              groupSearch = {
+                baseDN = "ou=groups,${cfg.ldap.suffix}";
+                filter = "(objectclass=groupOfNames)";
+                nameAttr = "cn";
+                userMatchers = [{ userAttr = "DN"; groupAttr = "member"; }];
+              };
+            };
+          }];
 
-        staticClients = forEach cfg.dex.oidcClients (client: {
+          staticClients = forEach cfg.dex.oidcClients (client: {
-          inherit (client) id;
+            inherit (client) id;
-          redirectURIs = [ client.callbackURL ];
+            redirectURIs = [ client.callbackURL ];
-          name = "OIDC for ${client.id}";
+            name = "OIDC for ${client.id}";
-          secretEnv = "DEX_CLIENT_${client.id}";
+            secretEnv = "DEX_CLIENT_${client.id}";
-        });
+          });
+        };
       };
+
+      portunus.seedPath = lib.mkIf (cfg.seedSettings != null) (pkgs.writeText "seed.json" (builtins.toJSON cfg.seedSettings));
     };
 
     systemd.services = {

nixos/tests/pomerium.nix

@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, lib, ... }: {
   name = "pomerium";
   meta = with lib.maintainers; {
-    maintainers = [ lukegb ];
+    maintainers = [ lukegb devusb ];
   };
 
   nodes = let base = myIP: { pkgs, lib, ... }: {
@@ -103,7 +103,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     with subtest("ui"):
         pomerium.succeed(
           # check for a string that only appears if the UI is displayed correctly
-            "chromium --no-sandbox --headless --disable-gpu --dump-dom --host-resolver-rules='MAP login.required 127.0.0.1:80' http://login.required/.pomerium | grep 'contact your administrator'"
+            "chromium --no-sandbox --headless --disable-gpu --dump-dom --host-resolver-rules='MAP login.required 127.0.0.1:80' http://login.required/.pomerium | grep 'User Details Not Available'"
         )
   '';
 })

pkgs/README.md

@@ -348,7 +348,7 @@ There are a few naming guidelines:
 
 - The `pname` and the `version` attribute _must not_ contain uppercase letters — e.g., `"mplayer" instead of `"MPlayer"`.
 
-- The `version` attribute _must_ start with a digit e.g`"0.3.1rc2".
+- The `version` attribute _must_ start with a digit e.g., `"0.3.1rc2"`.
 
 - If a package is a commit from a repository without a version assigned, then the `version` attribute _should_ be the latest upstream version preceding that commit, followed by `-unstable-` and the date of the (fetched) commit. The date _must_ be in `"YYYY-MM-DD"` format.
 

pkgs/applications/audio/ensemble-chorus/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "ensemble-chorus";
-  version = "unstable-15-02-2019";
+  version = "0-unstable-2019-02-15";
 
   src = fetchFromGitHub {
     owner = "jpcima";

pkgs/applications/misc/1password-gui/default.nix

@@ -9,43 +9,43 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.10.23" else "8.10.24-35.BETA";
+  version = if channel == "stable" then "8.10.24" else "8.10.26-1.BETA";
 
   sources = {
     stable = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-TqZ9AffyHl1mAKyZvADVGh5OXKZEGXjKSkXq7ZI/obA=";
+        hash = "sha256-vYk7WHGVOzrrep6vmA58ELa6aDsZFUw5D2StCYP0Ioc=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-vEdpqlGXc5gR9kr+iRRvRI4r48H6AWr+sDZt2kNQxB4=";
+        hash = "sha256-HuhoGG2aQ2NcbZlQfUmGUl0IvhXPO5uV7x4WKJRR7Ew=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-1vZbZdAyK/J+lMPwgeyEO5Qvj6nBd0TMkG4Y71Bgfoc=";
+        hash = "sha256-RHn1JJoRLWfqOTx0Di0nfHM7fbLs54DdWlI+PTQs1sQ=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-SGvzRGfoMrHSYOlJjsjS0ETIZelctzVbd/SyCv40+QI=";
+        hash = "sha256-ZjmgkGTY6KQ0vv7ILMMLYsK7N2YLmJGCBS6954v0JX8=";
       };
     };
     beta = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-NO8jxXvdjDn7uTyboav8UnHfc0plHDLoKQ/FHZJqpsE=";
+        hash = "sha256-dAasy1D5HXQ8Eu5cx0u9exobNMf2TIV4iCTcys/uCtQ=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-9qnODNE3kNRZyj5+2nfoz9zBmY2MqxVPo3rpLOCFAsI=";
+        hash = "sha256-sIPNv4HiU/6CLaER6deMG88zOOFwu6cm5XoB2Cr4qLQ=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-gU11xBIGOCRbQshOQ4ktYVgHe6dxJ0GnONkVnZkCiEE=";
+        hash = "sha256-Va4WgbPKrI7u+GYzVmA8Gp6NRY4EdJuoz00Pc5HsMIg=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-YcnVIgV+2MZOS+a+3lFuNMgnLaGVrOP53B/k70zRoTI=";
+        hash = "sha256-Dj96QoEcmJxV7qBkb68ovonr+XYqQdScb9GMeL8OCJo=";
       };
     };
   };

pkgs/applications/misc/diff-pdf/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "diff-pdf";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "vslavik";
     repo = "diff-pdf";
     rev = "v${version}";
-    sha256 = "sha256-jt11wssl8cH2cH3NXF+iWHxVNxPJm0I8toignBHq3q0=";
+    sha256 = "sha256-6aKF3Xqp/1BoHEiZVZJSemTjn5Qwwr3QyhsXOIjTr08=";
   };
 
   nativeBuildInputs = [ autoconf automake pkg-config ];

pkgs/applications/misc/harsh/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "harsh";
-  version = "0.8.30";
+  version = "0.8.31";
 
   src = fetchFromGitHub {
     owner = "wakatara";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-X9YCxDgxIuJyTUurDQ574nKBAUsdKHNx1T6DkcygYS4=";
+    hash = "sha256-q2kQAQu1rewCDk+UPuEHS4AJlhuC8azHk5MWP6uQ4fI=";
   };
 
-  vendorHash = "sha256-zkz7X/qj8FwtQZXGuq4Oaoe5G9a4AJE1kv3j7wwQEp4=";
+  vendorHash = "sha256-zjLXq64uC5iRm9uxUGDW5127z25gNSVV2qhVVXuYqY0=";
 
   meta = with lib; {
     description = "CLI habit tracking for geeks";

pkgs/applications/misc/oversteer/default.nix

@@ -14,7 +14,7 @@ let
       pygobject3
     ]);
 
-  version = "0.8.0";
+  version = "0.8.1";
 in stdenv.mkDerivation {
   inherit version;
 
@@ -24,7 +24,7 @@ in stdenv.mkDerivation {
     owner = "berarma";
     repo = "oversteer";
     rev = version;
-    sha256 = "sha256-fkf6sa4yYbxGOehyLzuFj5nZiPK3B1D/VVvobhKB4Uo=";
+    sha256 = "sha256-J23fgEDkfZMjVEYHaSPbU9zh5CQFjPmqMsm09VybBv8=";
   };
 
   buildInputs = [ bash gtk3 ];

pkgs/applications/misc/pydf/default.nix

@@ -18,6 +18,7 @@ python3Packages.buildPythonPackage rec {
   meta = with lib; {
     description = "colourised df(1)-clone";
     homepage = "http://kassiopeia.juls.savba.sk/~garabik/software/pydf/";
+    mainProgram = "pydf";
     license = licenses.publicDomain;
     maintainers = with maintainers; [ monsieurp ];
   };

pkgs/applications/networking/cluster/roxctl/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "4.3.3";
+  version = "4.3.4";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-G+BmcGrVxZmVHNl2VsN7nankEIB7uV/PFpQekipdT3c=";
+    sha256 = "sha256-5UMU3oKi3QhREum2YevOzwF5OOi8quPWgt+kgGjkeFQ=";
   };
 
   vendorHash = "sha256-Jzv4ozR8RJiwkgVGGq6dlV/7rbBLq8hFe/Pm4SJZCkU=";

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.54.16";
+  version = "0.54.22";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-UWldCHuRZI3pKl65VVorik9ucN0+xWyfl6r3X5m2xoI=";
+    hash = "sha256-Kxj/Op+XWKJ5C0sShnXp8zovpn0BZh7CYm8FwLHTXpI=";
   };
 
-  vendorHash = "sha256-kGHcVWO59LyFGDjh9fC++z6PSirepa5QNHDJoojT5kA=";
+  vendorHash = "sha256-Y5+XruUqya+sY3DuX/bVVT4ZVYmTBIDoFRAiRKFyX3M=";
 
   doCheck = false;
 

pkgs/applications/networking/cluster/tfupdate/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tfupdate";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "minamijoyo";
     repo = "tfupdate";
     rev = "v${version}";
-    sha256 = "sha256-HyDWye7xL0g5vDoGl8FYFXfuMKU4rxAlFawQ5ynqkmc=";
+    sha256 = "sha256-WVYWoojNRAKmFt5kTaE86TNgodTld/vZ4O2LmLcU6sA=";
   };
 
-  vendorHash = "sha256-oPqAH+i9ryb1Ps1yCkxoPgMmf4RNtFBCeE94vZAEnuo=";
+  vendorHash = "sha256-BjusVkp7gN/w2uC1ZyUDaqvXvjEN6BVYNcwNZFOLjDc=";
 
   # Tests start http servers which need to bind to local addresses:
   # panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted

pkgs/applications/networking/instant-messengers/qq/sources.nix

@@ -1,8 +1,8 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-01-19
+# Last updated: 2024-01-27
 {
-  version = "3.2.5-20979";
+  version = "3.2.5-21159";
-  urlhash = "c64ca459";
+  urlhash = "feb78c41";
-  arm64_hash = "sha256-zzLCWI/0L/6opFpTEQN2xdhqWA8i3pYI+K/0z63tOh4=";
+  arm64_hash = "sha256-3zbhFKQrO1tMSnWJllLJLaVeVpLs44WBbuuyU1LTMIU=";
-  amd64_hash = "sha256-XDQg98Bo0o7BGkMkl6vpUSvUd0wAbMa0cPVFPrIqWAY=";
+  amd64_hash = "sha256-pX99V18gjlMM6+jC9U7E5YvHDODGsrj0twt9K4rJN4Y=";
 }

pkgs/applications/networking/instant-messengers/zulip/default.nix

@@ -5,11 +5,11 @@
 
 let
   pname = "zulip";
-  version = "5.10.4";
+  version = "5.10.5";
 
   src = fetchurl {
     url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    hash = "sha256-M4h+kV4JjZ91K6OpxKc10XVohzKJEVxw8cYcVALibXA=";
+    hash = "sha256-dWTczjE6QAW26bGTIeFTuXl1JwYr3Ma+8Ab6MjeDr78=";
     name="${pname}-${version}.AppImage";
   };
 

pkgs/applications/networking/p2p/flood-for-transmission/default.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "flood-for-transmission";
-  version = "2023-11-17T12-46-13";
+  version = "2024-01-24T16-52-06";
 
   src = fetchFromGitHub {
     owner = "johman10";
     repo = pname;
     rev = version;
-    hash = "sha256-TaLWhly/4hOigWY1XP7FmgN4LbrdLb79NQ47z5JiiYE=";
+    hash = "sha256-ZV/Gk9DlYkMh8j034YGvMVN7MeOJgFARyOr9Atrs3j4=";
   };
 
-  npmDepsHash = "sha256-PCeknfS81K8ttU4hV2D841tgQsGfIVaAOVIEDXe8fVQ=";
+  npmDepsHash = "sha256-VHWM0vxFKucrmoJiwYpjw7QqhBQw9rPPQVIIevp6Wn0=";
 
   npmInstallFlags = [ "--legacy-peer-deps" ];
 

pkgs/applications/networking/sync/storj-uplink/default.nix

@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.94.2";
+  version = "1.96.2";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-q2QLsbJSVnRch4CIlGI2Thuz0OOpGURIdy1BEKxUZ1A=";
+    hash = "sha256-mQIrXDEfMMrubQyn90eu0k3isvnpaF237Tpd84HhUfU=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-UGx5pGfS7jWn7Uwjg1Gf/oQ3GbRTh5JSb38uPjxdUxc=";
+  vendorHash = "sha256-cUhdl0jqgkA89NeOdFSifR5LsTjeYifOXqBu3qCAovk=";
 
   ldflags = [ "-s" "-w" ];
 

pkgs/applications/office/activitywatch/default.nix

@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , rustPlatform
 , makeWrapper
 , pkg-config
@@ -164,6 +165,14 @@ rec {
         src = ./override-version.patch;
         version = sources.rev;
       })
+
+      # Can be removed with release 0.12.3
+      (fetchpatch {
+        name = "remove-unused-unstable-features.patch";
+        url = "https://github.com/ActivityWatch/aw-server-rust/commit/e1cd761d2f0a9309eb851b59732c2567a7ae2d3a.patch";
+        hash = "sha256-wP+3XZDkr148XY5b8RV3obuLczAFBE3FhaYPqnmmGcU=";
+        includes = [ "aw-server/src/lib.rs" ];
+      })
     ];
 
     nativeBuildInputs = [

pkgs/applications/science/misc/snakemake/default.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "snakemake";
-  version = "8.2.1";
+  version = "8.3.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-NpsDJuxH+NHvE735OCHaISPSOhYDxWiKqCb4Yk9DHf4=";
+    hash = "sha256-urC8IVfliVzyWu7zqZN5EI6d3vXz80vHPhQaKBzTEVA=";
     # https://github.com/python-versioneer/python-versioneer/issues/217
     postFetch = ''
       sed -i "$out"/snakemake/_version.py -e 's#git_refnames = ".*"#git_refnames = " (tag: v${version})"#'

pkgs/by-name/co/cosmic-icons/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "cosmic-icons";
-  version = "unstable-2023-11-28";
+  version = "unstable-2024-01-23";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
-    rev = "1e328dacc117c21000a000a3170a801f467f3c2b";
+    rev = "49a1762c958196924afcf1eae52ee910c4b4bc9f";
-    sha256 = "sha256-QmCHkqSPWfZhofh4ieJhl4yjt0R4J15+xElbszHS/4M=";
+    sha256 = "sha256-wL4f1rXWuFmeZCAAw0y+JQ3iesZcEC3XxWWrvrJ50oA=";
   };
 
   nativeBuildInputs = [ just ];

pkgs/by-name/cr/crawley/package.nix

@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "crawley";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "s0rg";
     repo = "crawley";
     rev = "v${version}";
-    hash = "sha256-IRhi6z2TQZOOw8EZkJ3/VEOBzAlg0DQjq9wSt+/c3ck=";
+    hash = "sha256-hQvmWob5zCM1dh9oIACjIndaus0gYSidrs4QZM5jtEg=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorHash = "sha256-0BUbALCBR9CGwkqz1cUnzF3xjQkkzfdS7JDDTXkGmN4=";
+  vendorHash = "sha256-u1y70ydfVG/aH1CVKOUDBmtZgTLlXXrQGt3mfGDibzs=";
 
   ldflags = [ "-w" "-s" ];
 

pkgs/by-name/hu/hugo/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.121.2";
+  version = "0.122.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YwwvxkS+oqTMZzwq6iiB/0vLHIyeReQi76B7fCgqtcY=";
+    hash = "sha256-pnsQo+nSuIlQ6KKTP1z/BZ74zEu9HjYP66hGStPc0pc=";
   };
 
-  vendorHash = "sha256-4j61PFULBXhtERDhbHW7gwEuP+KBUEdva2fjuaAVY0o=";
+  vendorHash = "sha256-aYy0TOfNIqx44UBXJhewvxi+oSAWjmi/32WvI3HJ3MM=";
 
   doCheck = false;
 

pkgs/by-name/ig/igir/package.nix

@@ -1,6 +1,11 @@
 { lib
 , buildNpmPackage
 , fetchFromGitHub
+
+# for patching bundled 7z binary from the 7zip-bin node module
+# at lib/node_modules/igir/node_modules/7zip-bin/linux/x64/7za
+, autoPatchelfHook
+, stdenv
 }:
 
 buildNpmPackage rec {
@@ -21,6 +26,14 @@ buildNpmPackage rec {
     patchShebangs scripts/update-readme-help.sh
   '';
 
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  buildInputs = [ stdenv.cc.cc.lib ];
+
+  # from lib/node_modules/igir/node_modules/@node-rs/crc32-linux-x64-musl/crc32.linux-x64-musl.node
+  # Irrelevant to our use
+  autoPatchelfIgnoreMissingDeps = [ "libc.musl-x86_64.so.1" ];
+
   meta = with lib; {
     description = "A video game ROM collection manager to help filter, sort, patch, archive, and report on collections on any OS";
     homepage = "https://igir.io";

pkgs/by-name/kp/kplex/package.nix

@@ -0,0 +1,32 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kplex";
+  version = "1.4";
+  src = fetchFromGitHub {
+    owner = "stripydog";
+    repo =  "kplex";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-sps9l238hGLJ673kewFH8fOJw0HphEkZbJ+VUIzxC+o=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m 0555 kplex $out/bin/kplex
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A multiplexer for various nmea 0183 interfaces";
+    homepage = "https://www.stripydog.com/kplex/";
+    changelog = "https://www.stripydog.com/kplex/changes.html";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ mabster314 ];
+    mainProgram = "kplex";
+  };
+})

pkgs/by-name/li/libbgcode/package.nix

@@ -36,5 +36,6 @@ stdenv.mkDerivation {
     description = "Prusa Block & Binary G-code reader / writer / converter";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ lach ];
+    platforms = platforms.unix;
   };
 }

pkgs/by-name/nr/nrr/package.nix

@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, darwin
+, pkg-config
+, libiconv
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nrr";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "ryanccn";
+    repo = "nrr";
+    rev = "v${version}";
+    hash = "sha256-jkI5t+1P7Ae6MkSnyy7Ur3Z0Vt8+hWTgf6dgL5tzhY8=";
+  };
+
+  cargoHash = "sha256-9qLeFuaKAGhtyHFHOBS6HA0wAWuk0ZJppVySpMwUGYc=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreFoundation
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.IOKit
+    libiconv
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  meta = with lib; {
+    description = "Minimal, blazing fast Node.js script runner";
+    maintainers = with maintainers; [ ryanccn ];
+    license = licenses.gpl3Only;
+    mainProgram = "nrr";
+  };
+}

pkgs/by-name/pu/pupdate/package.nix

@@ -12,13 +12,13 @@
 
 buildDotnetModule rec {
   pname = "pupdate";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "mattpannella";
     repo = "${pname}";
     rev = "${version}";
-    hash = "sha256-Lr3orYOSzFQCLduBhp2MtGbgiKtFB1CgP/iMMySSvEk=";
+    hash = "sha256-wIYqEtbQZsj9gq5KaLhd+sEnrKHBHzA9jWR+9dGDQ0s=";
   };
 
   buildInputs = [

pkgs/by-name/ve/ventoy/package.nix

@@ -1,6 +1,4 @@
 { lib
-, stdenv
-, fetchurl
 , autoPatchelfHook
 , bash
 , copyDesktopItems
@@ -9,6 +7,7 @@
 , dosfstools
 , e2fsprogs
 , exfat
+, fetchurl
 , gawk
 , gnugrep
 , gnused
@@ -19,6 +18,7 @@
 , ntfs3g
 , parted
 , procps
+, stdenv
 , util-linux
 , which
 , xfsprogs
@@ -38,7 +38,7 @@ assert defaultGuiType == "gtk3" -> withGtk3;
 assert defaultGuiType == "qt5" -> withQt5;
 
 let
-  inherit (lib) optional optionalString;
+  inherit (lib) optionals optionalString;
   inherit (libsForQt5) qtbase wrapQtAppsHook;
   arch = {
     x86_64-linux = "x86_64";
@@ -46,20 +46,16 @@ let
     aarch64-linux = "aarch64";
     mipsel-linux = "mips64el";
   }.${stdenv.hostPlatform.system}
-    or (throw "Unsupported platform ${stdenv.hostPlatform.system}");
+    or (throw "Unsupported platform: ${stdenv.hostPlatform.system}");
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ventoy";
-  version = "1.0.96";
+  version = "1.0.97";
 
-  src =
+  src = fetchurl {
-    let
+    url = "https://github.com/ventoy/Ventoy/releases/download/v${finalAttrs.version}/ventoy-${finalAttrs.version}-linux.tar.gz";
-      inherit (finalAttrs) version;
+    hash = "sha256-E2ipCCydsllY5UB+9JhDItkNO7AJBTN9S9QWeOBsEVA=";
-    in
+  };
-    fetchurl {
-      url = "https://github.com/ventoy/Ventoy/releases/download/v${version}/ventoy-${version}-linux.tar.gz";
-      hash = "sha256-eUpxfJQ0u3bpAXTUCKlMO/ViwKcBI59YFKJ3xGzSdcg=";
-    };
 
   patches = [
     ./000-nixos-sanitization.patch
@@ -78,8 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
     autoPatchelfHook
     makeWrapper
   ]
-  ++ optional (withQt5 || withGtk3) copyDesktopItems
+  ++ optionals (withQt5 || withGtk3) [ copyDesktopItems ]
-  ++ optional withQt5 wrapQtAppsHook;
+  ++ optionals withQt5 [ wrapQtAppsHook ];
 
   buildInputs = [
     bash
@@ -96,12 +92,14 @@ stdenv.mkDerivation (finalAttrs: {
     which
     xz
   ]
-  ++ optional withCryptsetup cryptsetup
+  ++ optionals withCryptsetup [ cryptsetup ]
-  ++ optional withExt4 e2fsprogs
+  ++ optionals withExt4 [ e2fsprogs ]
-  ++ optional withGtk3 gtk3
+  ++ optionals withGtk3 [ gtk3 ]
-  ++ optional withNtfs ntfs3g
+  ++ optionals withNtfs [ ntfs3g ]
-  ++ optional withXfs xfsprogs
+  ++ optionals withXfs [ xfsprogs ]
-  ++ optional withQt5 qtbase;
+  ++ optionals withQt5 [ qtbase ];
+
+  strictDeps = true;
 
   desktopItems = [
     (makeDesktopItem {
@@ -203,6 +201,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     changelog = "https://www.ventoy.net/doc_news.html";
     license = lib.licenses.gpl3Plus;
+    mainProgram = "ventoy";
     maintainers = with lib.maintainers; [ AndersonTorres ];
     platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" "mipsel-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

pkgs/by-name/wo/worker/package.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "worker";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchurl {
     url = "http://www.boomerangsworld.de/cms/worker/downloads/worker-${finalAttrs.version}.tar.gz";
-    hash = "sha256-iEfHl3eDBkLpvI/WKBEO21briu5Ikv9YA4NSVZXos44=";
+    hash = "sha256-7bnJ7w7ejK5VDkna52jCtHKD8iiNOdXCpU0wx7RtkxA=";
   };
 
   buildInputs = [ libX11 ];

pkgs/data/fonts/kode-mono/default.nix

@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kode-mono";
-  version = "1.202";
+  version = "1.204";
 
   src = fetchzip {
     url = "https://github.com/isaozler/kode-mono/releases/download/${finalAttrs.version}/kode-mono-fonts.zip";
-    hash = "sha256-wltprCA73BHAe+WrCWIsLqQ/H+vgVzclEL5voZPmbDU=";
+    hash = "sha256-0mAE06963HaBKBKBvTnt8q7QAY1FakEGUx1wAqOZVH4=";
     stripRoot = false;
   };
 

pkgs/development/compilers/rust/clippy.nix

@@ -38,6 +38,7 @@ rustPlatform.buildRustPackage {
   meta = with lib; {
     homepage = "https://rust-lang.github.io/rust-clippy/";
     description = "A bunch of lints to catch common mistakes and improve your Rust code";
+    mainProgram = "cargo-clippy";
     maintainers = with maintainers; [ basvandijk ] ++ teams.rust.members;
     license = with licenses; [ mit asl20 ];
     platforms = platforms.unix;

pkgs/development/libraries/amf-headers/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "amf-headers";
-  version = "1.4.32";
+  version = "1.4.33";
 
   src = fetchFromGitHub {
     owner = "GPUOpen-LibrariesAndSDKs";
     repo = "AMF";
     rev = "v${version}";
-    sha256 = "sha256-3CdC/9o6ur2CeVLImz2QfaZAH2+KtDdxs5zRF7W5/oo=";
+    sha256 = "sha256-oho1EonWxgBmsQiX3wPhs0jQjLFwLe49C7/SOEptYiw=";
   };
 
   installPhase = ''

pkgs/development/libraries/dbus-cplusplus/default.nix

@@ -32,6 +32,22 @@ stdenv.mkDerivation rec {
       url = "https://src.fedoraproject.org/rpms/dbus-c++/raw/9f515ace0594c8b2b9f0d41ffe71bc5b78d30eee/f/dbus-c++-template-operators.patch";
       hash = "sha256-B8S7z/YH2YEQgaRsBJBBVTx8vHQhHW7z171TZmogpL8=";
     })
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    (fetchpatch {
+      name = "0001-src-eventloop.cpp-use-portable-method-for-initializi.patch";
+      url = "https://github.com/openembedded/meta-openembedded/raw/119e75e48dbf0539b4e440417901458ffff79b38/meta-oe/recipes-core/dbus/libdbus-c++-0.9.0/0001-src-eventloop.cpp-use-portable-method-for-initializi.patch";
+      hash = "sha256-GJWvp5F26c88OCGLrFcXaqUl2FMSDCluppMrRQO3rzc=";
+    })
+    (fetchpatch {
+      name = "0002-tools-generate_proxy.cpp-avoid-possibly-undefined-ui.patch";
+      url = "https://github.com/openembedded/meta-openembedded/raw/119e75e48dbf0539b4e440417901458ffff79b38/meta-oe/recipes-core/dbus/libdbus-c++-0.9.0/0002-tools-generate_proxy.cpp-avoid-possibly-undefined-ui.patch";
+      hash = "sha256-P9JuG/6k5L6NTiAGH9JRfNcwpNVOV29RQC6fTj0fKZE=";
+    })
+    (fetchpatch {
+      name = "0003-Fixed-undefined-ssize_t-for-clang-3.8.0-on-FreeBSD.patch";
+      url = "https://github.com/openembedded/meta-openembedded/raw/119e75e48dbf0539b4e440417901458ffff79b38/meta-oe/recipes-core/dbus/libdbus-c++-0.9.0/0003-Fixed-undefined-ssize_t-for-clang-3.8.0-on-FreeBSD.patch";
+      hash = "sha256-/RCpDvaLIw0kmuBvUGbfnVEvgTKjIQWcSKWheCfgSmM=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config ];
@@ -45,8 +61,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.goibhniu ];
-    # Broken for Musl at 2023-12-28:
-    # https://github.com/NixOS/nixpkgs/issues/277198
-    broken = stdenv.hostPlatform.isMusl;
   };
 }

pkgs/development/libraries/libsolv/default.nix

@@ -16,14 +16,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.27";
+  version = "0.7.28";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "libsolv";
     rev = version;
-    sha256 = "sha256-kVExzCHfPU/o+C5TTAv1J9H7GmYwVWCsIpVkkts42js=";
+    sha256 = "sha256-cL7SDwCzXM2qJQfiu/3nfAiFbcFNn1YXD23Sl3n9nzY=";
   };
 
   cmakeFlags = [

pkgs/development/libraries/tdlib/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "tdlib";
-  version = "1.8.23";
+  version = "1.8.24";
 
   src = fetchFromGitHub {
     owner = "tdlib";
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     # The tdlib authors do not set tags for minor versions, but
     # external programs depending on tdlib constrain the minor
     # version, hence we set a specific commit with a known version.
-    rev = "27c3eaeb4964bd5f18d8488e354abde1a4383e49";
+    rev = "c5c55092dd61b9eb15d6bbfd0f02c04c593450e7";
-    hash = "sha256-TxgzZn/OF5b5FWzwnOWIozH+1d7O0RG3h+WKV10rxpE=";
+    hash = "sha256-jqS3PGg42W15QBgpL1PNU3xJdk67g8u0THN/4hW5i88=";
   };
 
   buildInputs = [ gperf openssl readline zlib ];

pkgs/development/python-modules/aiovodafone/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aiovodafone";
-  version = "0.5.3";
+  version = "0.5.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "chemelli74";
     repo = "aiovodafone";
     rev = "refs/tags/v${version}";
-    hash = "sha256-a9V5rocQmloNkg9IsxOAle8zmOIQ7jf1xPLjdsjntVw=";
+    hash = "sha256-J2VdRxCzIjRUOqQW4YzOC8RRth9tibBS9YuizveqhhI=";
   };
 
   postPatch = ''

pkgs/development/python-modules/atom/default.nix

@@ -10,16 +10,16 @@
 
 buildPythonPackage rec {
   pname = "atom";
-  version = "0.10.3";
+  version = "0.10.4";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "nucleic";
-    repo = pname;
+    repo = "atom";
     rev = "refs/tags/${version}";
-    hash = "sha256-NXjvRVYcWU9p7b8y2ICOzYe6TeMh1S70Edy/JvTG7a4=";
+    hash = "sha256-HoUKU6z+6PPBUsvI4earZG9UXN0PrugAxu/F7WUfUe8=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Memory efficient Python objects";
     homepage = "https://github.com/nucleic/atom";
+    changelog = "https://github.com/nucleic/atom/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ bhipple ];
   };

pkgs/development/python-modules/boto3-stubs/default.nix

@@ -365,14 +365,14 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.27";
+  version = "1.34.29";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/YRnjjsSNxA0EGkOaLx6YwZBE47iat7uz9Z5iUUU2Gk=";
+    hash = "sha256-48aM0PAcF9UJCq/PHHuy17lK7k46nNRa+L+d2ILvZEw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/botocore-stubs/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.34.27";
+  version = "1.34.29";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-6r4CRGoS6r0dCY4WN0MnW2HCxurrvtmb5bVNt+9sc2c=";
+    hash = "sha256-PMjbcbfYrsjG0TvITOzsGNZMsUIxHhvQYNZzy1VtkTs=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/cvelib/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "cvelib";
-  version = "1.2.1";
+  version = "1.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "RedHatProductSecurity";
     repo = "cvelib";
     rev = "tags/${version}";
-    hash = "sha256-hJPcxnc4iQzsYNNVJ9fw6yQl+5K7pdtjHT6oMmBx/Zs=";
+    hash = "sha256-PCZUAKgE80PD//4qK8ap55IN9vtx9WdpRZUAC3UdaWM=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/django-silk/default.nix

@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "django-silk";
-  version = "5.0.3";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = "django-silk";
     rev = "refs/tags/${version}";
-    hash = "sha256-91FcOqAYZK7/RCKgXjbQEPUQ2cZRFi7NzVLQF+MMDRI=";
+    hash = "sha256-QqY1bRa0v4DZ2/gDbssyhJA9Kb+5jig4hZEBVKZiowY=";
   };
 
   # "test_time_taken" tests aren't suitable for reproducible execution, but Django's

pkgs/development/python-modules/django-vite/default.nix

@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "django-vite";
-  version = "3.0.2";
+  version = "3.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "MrBin99";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Lnecxkn+E1Bce/EhP1AHH9/VrdzBiMGLv+eYld5+QKM=";
+    hash = "sha256-FH42auBm/YRfGgjL9TGQLed/p0P8POb7DOLmpUK1d9c=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/hatch-requirements-txt/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "hatch-requirements-txt";
-  version = "0.4.0";
+  version = "0.4.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "repo-helper";
     repo = "hatch-requirements-txt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qk+70o/41BLxCuz3SOXkGYSEmUZOG1oLYcFUmlarqmY=";
+    hash = "sha256-Kd3rDfTBn/t/NiSJMPkHRWD5solUF7MAN8EiZokxHrk=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pymilvus/default.nix

@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "pymilvus";
-  version = "2.3.5";
+  version = "2.3.6";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "milvus-io";
     repo = "pymilvus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OKvaJyy6v79wcE9T0v2KwOBKShhDE8g0adIWce0bESs=";
+    hash = "sha256-K7k3MTOEm9+HDwMps9C8Al0Jmp1ptJw3pN1LEBOUz0U=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/pyngo/default.nix

@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "pyngo";
-  version = "2.0.0";
+  version = "2.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "yezz123";
     repo = "pyngo";
     rev = "refs/tags/${version}";
-    hash = "sha256-jHPZjS/J1VLpsLN2wg5UJCgavoSEs4Uogo4GI6bZMuY=";
+    hash = "sha256-wvy1L21AnQ4JP5seAh6DWksQU2OcbYTXKcixpFryH4w=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pytest-django/default.nix

@@ -7,7 +7,6 @@
 , django-configurations
 , pytest
 , pytestCheckHook
-, pytest-xdist
 }:
 buildPythonPackage rec {
   pname = "pytest-django";
@@ -35,7 +34,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     django-configurations
     pytestCheckHook
-    pytest-xdist
   ];
 
   preCheck = ''

pkgs/development/python-modules/trimesh/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.0.10";
+  version = "4.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NuM7EUXl1QW0HyUPGAyeVDI5Dht4CMu/ufULKNW0bNw=";
+    hash = "sha256-ca0KytcPZaflr0eF/CRwbWSjmUzKNSbVkXLbQ1scHZ8=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/tools/analysis/codeql/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.16.0";
+  version = "2.16.1";
 
   dontConfigure = true;
   dontBuild = true;
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-1XqpERNM4rNyv9HT1jyZIqSkEDsajIJ9D0FzWcFm20c=";
+    hash = "sha256-y9tSG/SxCeyFdWF6gKuPSBgfG5H2uB/XRmQkfMBdKQU=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/build-managers/moon/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "moon";
-  version = "1.19.3";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kv43d2KDYwMpyutqf4M/Z4fo1A3lwdwOOyxOQwM5vik=";
+    hash = "sha256-J/xlLKCoh+NekPcCAyM4ZN+OL6dLcworiO3gqCetu9A=";
   };
 
-  cargoHash = "sha256-G8aT44K3HAfmOH6GltbZ91xQRqy79/bimu4cUlAZEDo=";
+  cargoHash = "sha256-TU1vWyAbbS9ScRdDgQMvY6Ov9uCv9TrzzhznyZleC0E=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";

pkgs/development/tools/continuous-integration/fly/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "7.11.0";
+  version = "7.11.1";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    hash = "sha256-lp6EXdwmgmjhFxRQXn2P4iRrtJS1QTvg4225V/6E7MI=";
+    hash = "sha256-zbE81vsO3rhXrPGL11lBqg3lryndaHEbW+CBxP6PlPA=";
   };
 
-  vendorHash = "sha256-p3EhXrRjAFG7Ayfj/ArAWO7KL3S/iR/nwFwXcDc+DSs=";
+  vendorHash = "sha256-Os76Kim+qznVtSY+GF3jgKz7Vmf7mRTcjZ6v8NnFY2U=";
 
   subPackages = [ "fly" ];
 

pkgs/development/tools/misc/runme/default.nix

@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "runme";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "stateful";
     repo = "runme";
     rev = "v${version}";
-    hash = "sha256-6V7OxWJ0EYcbaHmls0P9iJD9tQ9N4GSPzBAKVdShvXg=";
+    hash = "sha256-GTFlywVjWT2/qcmjsDUUiL4x6pzXw8h/G4kfGPkf3m8=";
   };
 
-  vendorHash = "sha256-PLDsea/o067ifiX0RKFC7gDpORLVEQ0DV6sdBzzQCTs=";
+  vendorHash = "sha256-+g6vEgA+vbGzLnotmhk0gp1IcY3zpF71TdoB8d84W6A=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/development/tools/pscale/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.177.0";
+  version = "0.178.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-nvtLUrJhxqMWi/NzKw1KYOEL+1DsWfJoLXoXQI7QP6M=";
+    sha256 = "sha256-Ttz6Ny9HYG07rp/6TkWw1E3DTRw1IkLvMBBm/gkI1j0=";
   };
 
-  vendorHash = "sha256-n6vPeeOmSB/qHBGCdZHZtf3JD/wgFYD0+VO3Ir8MtqE=";
+  vendorHash = "sha256-0xHyIe5fGld6LJmhKqTR/6toecRX/pyxEJabW47HU6Y=";
 
   ldflags = [
     "-s" "-w"

pkgs/development/tools/reindeer/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "unstable-2024-01-12";
+  version = "unstable-2024-01-25";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = pname;
-    rev = "8815ee8ac5463b7004751ff8db73d7daf0b281c4";
+    rev = "66cf0b39d0307210a95ff4cf84996a5b73da76c5";
-    sha256 = "sha256-GIIvfiCzm/dpIZB1S1wCs1/VifKzvwZ+RYXVbjNDEY4=";
+    sha256 = "sha256-F/I1eJVJEs97Rgs94KiSmRJgpNSgQiblMxrYySl5e+g=";
   };
 
-  cargoSha256 = "sha256-iAmwxOZTW5zLhufJG5U6m2h/yXck6NvmwXd2tsvBZh8=";
+  cargoSha256 = "sha256-Yv/DKW/6/XCbF0o50qPjOlU/3wNBJi/8o5uGRcS0gic=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs =

pkgs/development/tools/rust/cargo-deny/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deny";
-  version = "0.14.7";
+  version = "0.14.10";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-deny";
     rev = version;
-    hash = "sha256-Ods0uibPrvrFW9HRHm4k9xhmOmvW8zJfVjMYEX7H0UA=";
+    hash = "sha256-9DqVd0EyfHB32hufz13TXdQZsLaiQWIVgTMQfWT5v1Q=";
   };
 
-  cargoHash = "sha256-/wHXKzHl00q+8e4A9YFAGqhoCqVwkFhMtWTuzdmZIHc=";
+  cargoHash = "sha256-KCJ2csFHIWuqHWCWRvTe++vKxHUkzv9tzrtEW6MUj5s=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/development/tools/rust/cargo-semver-checks/default.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-semver-checks";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DN50syZ965MWXKg3lhEhvINeqZUtZgJNjusevf4EIUw=";
+    hash = "sha256-5QXTbsNp36jYrcSDmCXT5Nmhhr9TaWpF3QqaCKv5TTg=";
   };
 
-  cargoHash = "sha256-ulsU/QSSNqyZTjM77PQnr3HVUg2dS8SxHv2y6Lsvths=";
+  cargoHash = "sha256-uRgSNVleGzD75q16hd/AOl23DT1btWGuNgZ2IprGa7k=";
 
   nativeBuildInputs = [
     cmake

pkgs/development/tools/vsce/default.nix

@@ -12,16 +12,16 @@
 
 buildNpmPackage rec {
   pname = "vsce";
-  version = "2.22.0";
+  version = "2.23.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vscode-vsce";
     rev = "v${version}";
-    hash = "sha256-zpZ/PsqZ9yRDKTXkSrcBgSxYer7JdjNZqsseHwfzkEY=";
+    hash = "sha256-2s8hG3HNDQnuwFXZX1mCTSbKCm4n7YAzhHDaWVYTyys=";
   };
 
-  npmDepsHash = "sha256-Difk9a9TYmfwzP9SawEuaxm7iHVjdfO+FxFCE7aEMzM=";
+  npmDepsHash = "sha256-1PVUDEecFW+lFmZOZUTlgeKsLwLK9O4vFHi6gOLjBfo=";
 
   postPatch = ''
     substituteInPlace package.json --replace '"version": "0.0.0"' '"version": "${version}"'
@@ -44,5 +44,6 @@ buildNpmPackage rec {
     description = "Visual Studio Code Extension Manager";
     maintainers = with maintainers; [ aaronjheng ];
     license = licenses.mit;
+    mainProgram = "vsce";
   };
 }

pkgs/development/web/bootstrap-studio/default.nix

@@ -2,10 +2,10 @@
 
 let
   pname = "bootstrap-studio";
-  version = "6.6.0";
+  version = "6.6.1";
   src = fetchurl {
     url = "https://releases.bootstrapstudio.io/${version}/Bootstrap%20Studio.AppImage";
-    sha256 = "sha256-kXYptuLmhYJ3YiKtfIMiOs4zssJ1+v+JgDHWVtbWQ+Y=";
+    sha256 = "sha256-mMhjdAJfiDoK4b8TfawzxZHyQG2MUJHpG45MhuaCPqs=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in

pkgs/development/web/minify/default.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "minify";
-  version = "2.20.14";
+  version = "2.20.15";
 
   src = fetchFromGitHub {
     owner = "tdewolff";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-/4iIN3L3hARxpa7bQcMBQ8DF6SfqrK+rFgJn/MYoUL8=";
+    hash = "sha256-/CTQ1Ok9ODueM2cDpDTAnpu5vvvYAAVxqhF+Uu487N4=";
   };
 
-  vendorHash = "sha256-iTHUZUmT1LLS8wtPTDaay2Mx+Trv8TUox6PHwYTuY2U=";
+  vendorHash = "sha256-OrBFQl/IBzMFK3O1C1vsJdRRrq9AP6rs2KUIcyx2IlQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/games/nethack/default.nix

@@ -2,6 +2,7 @@
 , less
 , buildPackages
 , x11Mode ? false, qtMode ? false, libXaw, libXext, libXpm, bdftopcf, mkfontdir, pkg-config, qt5
+, copyDesktopItems, makeDesktopItem
 }:
 
 let
@@ -33,7 +34,7 @@ in stdenv.mkDerivation rec {
                 ++ lib.optionals x11Mode [ libXaw libXext libXpm ]
                 ++ lib.optionals qtMode [ gzip qt5.qtbase.bin qt5.qtmultimedia.bin ];
 
-  nativeBuildInputs = [ flex bison ]
+  nativeBuildInputs = [ flex bison copyDesktopItems ]
                       ++ lib.optionals x11Mode [ mkfontdir bdftopcf ]
                       ++ lib.optionals qtMode [
                            pkg-config mkfontdir qt5.qtbase.dev
@@ -144,11 +145,26 @@ in stdenv.mkDerivation rec {
     ${lib.optionalString (!(x11Mode || qtMode)) "install -Dm 555 util/dlb -t $out/libexec/nethack/"}
   '';
 
+  desktopItems = [
+    (makeDesktopItem {
+      name = "NetHack";
+      exec =
+         if x11Mode then "nethack-x11"
+         else if qtMode then "nethack-qt"
+         else "nethack";
+      icon = "nethack";
+      desktopName = "NetHack";
+      comment = "NetHack is a single player dungeon exploration game";
+      categories = [ "Game" "ActionGame" ];
+    })
+  ];
+
   meta = with lib; {
     description = "Rogue-like game";
     homepage = "http://nethack.org/";
     license = "nethack";
     platforms = if x11Mode then platforms.linux else platforms.unix;
     maintainers = with maintainers; [ abbradar ];
+    mainProgram = "nethack";
   };
 }

pkgs/games/nile/default.nix

@@ -15,14 +15,14 @@
 
 buildPythonApplication rec {
   pname = "nile";
-  version = "unstable-2023-10-02";
+  version = "unstable-2024-01-25";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "imLinguin";
     repo = "nile";
-    rev = "8f7ab2650fc730efc8960b5fcd71421d724a4108";
+    rev = "731d653f71d679cc318b411d7b3a197396ca59d4";
-    hash = "sha256-Vhjp9JX8VX0PWsvEh5eOhz7vsIEaiCyPNPOjibE8GXo=";
+    hash = "sha256-oja7xSIXZT1/0t1qep0C9tU524L4GVMrXF5WWiIXwyA=";
   };
 
   disabled = pythonOlder "3.8";

pkgs/servers/elasticmq-server-bin/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "elasticmq-server";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchurl {
     url = "https://s3-eu-west-1.amazonaws.com/softwaremill-public/${finalAttrs.pname}-${finalAttrs.version}.jar";
-    sha256 = "sha256-LjaabD9Ax0Jy1OJgEX2TWctEfsK7jlzWKAOq6RCVeqQ=";
+    sha256 = "sha256-WdwKIQFWu8R/9CQZFjVLkplRC0pbYoyb/6FjJu80NRU=";
   };
 
   # don't do anything?

pkgs/servers/http/pomerium/default.nix

@@ -122,7 +122,7 @@ buildGoModule rec {
     homepage = "https://pomerium.io";
     description = "Authenticating reverse proxy";
     license = licenses.asl20;
-    maintainers = with maintainers; [ lukegb ];
+    maintainers = with maintainers; [ lukegb devusb ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 }

pkgs/servers/monitoring/grafana/default.nix

@@ -1,8 +1,38 @@
-{ lib, buildGoModule, fetchurl, fetchFromGitHub, nixosTests, tzdata, wire }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub, removeReferencesTo
+, tzdata, wire
+, yarn, nodejs, cacert
+, jq, moreutils
+, nix-update-script, nixosTests
+}:
 
+let
+  # We need dev dependencies to run webpack, but patch away
+  # `cypress` (and @grafana/e2e which has a direct dependency on cypress).
+  # This attempts to download random blobs from the Internet in
+  # postInstall. Also, it's just a testing framework, so not worth the hassle.
+  patchAwayGrafanaE2E = ''
+    find . -name package.json | while IFS=$'\n' read -r pkg_json; do
+      <"$pkg_json" jq '. + {
+        "devDependencies": .devDependencies | del(."@grafana/e2e") | del(.cypress)
+      }' | sponge "$pkg_json"
+    done
+    rm -r packages/grafana-e2e
+  '';
+
+  # Injects a `t.Skip()` into a given test since
+  # there's apparently no other way to skip tests here.
+  skipTest = lineOffset: testCase: file:
+    let
+      jumpAndAppend = lib.concatStringsSep ";" (lib.replicate (lineOffset - 1) "n" ++ [ "a" ]);
+    in ''
+      sed -i -e '/${testCase}/{
+      ${jumpAndAppend} t.Skip();
+      }' ${file}
+    '';
+in
 buildGoModule rec {
   pname = "grafana";
-  version = "10.2.3";
+  version = "10.3.1";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" "devenv" "modowners" ];
 
@@ -10,28 +40,47 @@ buildGoModule rec {
     owner = "grafana";
     repo = "grafana";
     rev = "v${version}";
-    hash = "sha256-F61RtPEjQ4uFVcJLG04CD4//w8X7uJinxzYyoW/MosA=";
+    hash = "sha256-UPIq7BWTlT0omt/SM5+vkfOHvsdcx/ikkjcW9X8pcw0=";
   };
 
-  srcStatic = fetchurl {
+  offlineCache = stdenv.mkDerivation {
-    url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
+    name = "${pname}-${version}-yarn-offline-cache";
-    hash = "sha256-xoZgaml1SB9PEI3kTE3zRlJR5O4tog58bua2blvc8to=";
+    inherit src;
+    nativeBuildInputs = [
+      yarn nodejs cacert
+      jq moreutils
+    ];
+    postPatch = ''
+      ${patchAwayGrafanaE2E}
+    '';
+    buildPhase = ''
+      runHook preBuild
+      export HOME="$(mktemp -d)"
+      yarn config set enableTelemetry 0
+      yarn config set cacheFolder $out
+      yarn config set --json supportedArchitectures.os '[ "linux" ]'
+      yarn config set --json supportedArchitectures.cpu '["arm", "arm64", "ia32", "x64"]'
+      yarn
+      runHook postBuild
+    '';
+    dontConfigure = true;
+    dontInstall = true;
+    dontFixup = true;
+    outputHashMode = "recursive";
+    outputHash = "sha256-70eMa8E483f/Bz7iy+4Seap1EfIdjD5krnt6W9CUows=";
   };
 
-  vendorHash = "sha256-rQOnuh6t+cUqyAAnUhGgxMaW88pawnauAGQd6w0T57Q=";
+  disallowedRequisites = [ offlineCache ];
 
-  nativeBuildInputs = [ wire ];
+  vendorHash = "sha256-Gf2A22d7/8xU/ld7kveqGonVKGFCArGNansPRGhfyXM=";
 
-  postConfigure = let
+  nativeBuildInputs = [ wire yarn jq moreutils removeReferencesTo ];
-    skipTest = lineOffset: testCase: file:
+
-      let
+  postPatch = ''
-        jumpAndAppend = lib.concatStringsSep ";" (lib.replicate (lineOffset - 1) "n" ++ [ "a" ]);
+    ${patchAwayGrafanaE2E}
-      in ''
+  '';
-        sed -i -e '/${testCase}/{
+
-        ${jumpAndAppend} t.Skip();
+  postConfigure = ''
-        }' ${file}
-      '';
-  in ''
     # Generate DI code that's required to compile the package.
     # From https://github.com/grafana/grafana/blob/v8.2.3/Makefile#L33-L35
     wire gen -tags oss ./pkg/server
@@ -69,6 +118,18 @@ buildGoModule rec {
     # grafana> 2023/08/24 08:30:23 failed to copy objects, err: Post "https://storage.googleapis.com/upload/storage/v1/b/grafana-testing-repo/o?alt=json&name=test-path%2Fbuild%2FTestCopyLocalDir2194093976%2F001%2Ffile2.txt&prettyPrint=false&projection=full&uploadType=multipart": dial tcp: lookup storage.googleapis.com on [::1]:53: read udp [::1]:36436->[::1]:53: read: connection refused
     # grafana> panic: test timed out after 10m0s
     rm pkg/build/gcloud/storage/gsutil_test.go
+
+    # Setup node_modules
+    export HOME="$(mktemp -d)"
+    yarn config set enableTelemetry 0
+    yarn config set cacheFolder $offlineCache
+    yarn --immutable-cache
+  '';
+
+  postBuild = ''
+    # After having built all the Go code, run the JS builders now.
+    yarn run build
+    yarn run plugins:build-bundled
   '';
 
   ldflags = [
@@ -86,16 +147,19 @@ buildGoModule rec {
   '';
 
   postInstall = ''
-    tar -xvf $srcStatic
     mkdir -p $out/share/grafana
-    mv grafana-*/{public,conf,tools} $out/share/grafana/
+    cp -r public conf $out/share/grafana/
+  '';
 
-    cp ./conf/defaults.ini $out/share/grafana/conf/
+  postFixup = ''
+    while read line; do
+      remove-references-to -t $offlineCache "$line"
+    done < <(find $out -type f -name '*.js.map' -or -name '*.js')
   '';
 
   passthru = {
     tests = { inherit (nixosTests) grafana; };
-    updateScript = ./update.sh;
+    updateScript = nix-update-script { };
   };
 
   meta = with lib; {

pkgs/servers/monitoring/grafana/update.sh

@@ -1,40 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl common-updater-scripts jq nix nix-prefetch-scripts moreutils
-
-set -euxo pipefail
-
-FILE="$(nix-instantiate --eval -E 'with import ./. {}; (builtins.unsafeGetAttrPos "version" grafana).file' | tr -d '"')"
-replaceHash() {
-  old="${1?old hash missing}"
-  new="${2?new hash missing}"
-  awk -v OLD="$old" -v NEW="$new" '{
-    if (i=index($0, OLD)) {
-      $0 = substr($0, 1, i-1) NEW substr($0, i+length(OLD));
-    }
-    print $0;
-  }' "$FILE" | sponge "$FILE"
-}
-extractVendorHash() {
-  original="${1?original hash missing}"
-  result="$(nix-build -A grafana.goModules 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
-  [ -z "$result" ] && { echo "$original"; } || { echo "$result"; }
-}
-
-oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion grafana" | tr -d '"')"
-latest="$(curl https://api.github.com/repos/grafana/grafana/releases/latest | jq '.tag_name' -r | tr -d 'v')"
-
-targetVersion="${1:-$latest}"
-if [ ! "${oldVersion}" = "${targetVersion}" ]; then
-  update-source-version grafana "${targetVersion#v}"
-  oldStaticHash="$(nix-instantiate --eval -A grafana.srcStatic.outputHash | tr -d '"')"
-  newStaticHash="$(nix-prefetch-url "https://dl.grafana.com/oss/release/grafana-${targetVersion#v}.linux-amd64.tar.gz")"
-  newStaticHash="$(nix hash to-sri --type sha256 $newStaticHash)"
-  replaceHash "$oldStaticHash" "$newStaticHash"
-  goHash="$(nix-instantiate --eval -A grafana.vendorHash | tr -d '"')"
-  emptyHash="$(nix-instantiate --eval -A lib.fakeHash | tr -d '"')"
-  replaceHash "$goHash" "$emptyHash"
-  replaceHash "$emptyHash" "$(extractVendorHash "$goHash")"
-  nix-build -A grafana
-else
-  echo "grafana is already up-to-date"
-fi

pkgs/servers/unpackerr/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "unpackerr";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "davidnewhall";
     repo = "unpackerr";
     rev = "v${version}";
-    sha256 = "sha256-yMmn733j6k9r8I/lvVOZNL6o35eSPJZ5G8jw9xaJZRg=";
+    sha256 = "sha256-K6ZDRDtxeqtjToElix1qVgclHaEeOY0W6hOwehFNIgo=";
   };
 
-  vendorHash = "sha256-1VMeRB34JS9EwyGhPxFsRIgKaY6NyIMsa132PQKoPYY=";
+  vendorHash = "sha256-1OSZzs/hUvauRIE5lzlXPIS2EkHm4aNK1iddjKCb6zA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Cocoa WebKit ];
 

pkgs/shells/nushell/nu_scripts/default.nix

@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nu_scripts";
-  version = "unstable-2024-01-17";
+  version = "unstable-2024-01-26";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = pname;
-    rev = "e5176370f68fb028ba0b5c83c83dac8d796b9d8e";
+    rev = "302fd84fed8616d4b3259c3265c5b01554fe8d91";
-    hash = "sha256-aQpyZkVm5/ono7xxtYBTSr4xSdnq/9NJeYTfUyskS8U=";
+    hash = "sha256-XMHqjxkJo60nwjXNlS0SKWLV/Ffxz8+oImG8lG8GjkE=";
   };
 
   installPhase = ''

pkgs/test/texlive/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, buildEnv, runCommand, fetchurl, file, texlive, writeShellScript, writeText, texliveInfraOnly, texliveSmall, texliveMedium, texliveFull }:
+{ lib, stdenv, buildEnv, runCommand, fetchurl, file, texlive, writeShellScript, writeText, texliveInfraOnly, texliveConTeXt, texliveSmall, texliveMedium, texliveFull }:
 
 rec {
 
@@ -70,10 +70,26 @@ rec {
       \end{document}
     '';
   } ''
-    chktex -v -nall -w1 "$input" 2>&1 | tee "$out"
+    # chktex is supposed to return 2 when it (successfully) finds warnings, but no errors,
+    # see http://git.savannah.nongnu.org/cgit/chktex.git/commit/?id=ec0fb9b58f02a62ff0bfec98b997208e9d7a5998
+    (set +e; chktex -v -nall -w1 "$input" 2>&1; [ $? = 2 ] || exit 1; set -e)  | tee "$out"
+    # also check that the output does indeed contain "One warning printed"
     grep "One warning printed" "$out"
   '';
 
+  context = mkTeXTest {
+    name = "texlive-test-context";
+    format = "context";
+    texLive = texliveConTeXt;
+    text = ''
+      \starttext
+      \startsection[title={ConTeXt test document}]
+        This is an {\em incredibly} simple ConTeXt document.
+      \stopsection
+      \stoptext
+    '';
+  };
+
   dvipng = lib.recurseIntoAttrs {
     # https://github.com/NixOS/nixpkgs/issues/75605
     basic = runCommand "texlive-test-dvipng-basic" {
@@ -414,6 +430,12 @@ rec {
         # crossrefware: require bibtexperllibs under TEXMFROOT
         "bbl2bib" "bibdoiadd" "bibmradd" "biburl2doi" "bibzbladd" "checkcites" "ltx2crossrefxml"
 
+        # epstopdf: requires kpsewhich
+        "epstopdf" "repstopdf"
+
+        # requires kpsewhich
+        "memoize-extract.pl" "memoize-extract.py"
+
         # require other texlive binaries in PATH
         "allcm" "allec" "chkweb" "fontinst" "ht*" "installfont-tl" "kanji-config-updmap-sys" "kanji-config-updmap-user"
         "kpse*" "latexfileversion" "mkocp" "mkofm" "mtxrunjit" "pdftex-quiet" "pslatex" "rumakeindex" "texconfig"
@@ -421,7 +443,7 @@ rec {
 
         # misc luatex binaries searching for luatex in PATH
         "citeproc-lua" "context" "contextjit" "ctanbib" "digestif" "epspdf" "l3build" "luafindfont" "luaotfload-tool"
-        "luatools" "make4ht" "pmxchords" "tex4ebook" "texdoc" "texlogsieve" "xindex"
+        "luatools" "make4ht" "pmxchords" "tex4ebook" "texblend" "texdoc" "texfindpkg" "texlogsieve" "xindex"
 
         # requires full TEXMFROOT (e.g. for config)
         "mktexfmt" "mktexmf" "mktexpk" "mktextfm" "psnup" "psresize" "pstops" "tlmgr" "updmap" "webquiz"
@@ -500,6 +522,13 @@ rec {
           args=
           ignoreExitCode=
           binCount=$((binCount + 1))
+
+          # ignore non-executable files (such as context.lua)
+          if [[ ! -x "$bin" ]] ; then
+            ignoredCount=$((ignoredCount + 1))
+            continue
+          fi
+
           case "$base" in
             ${lib.concatStringsSep "|" ignored})
               ignoredCount=$((ignoredCount + 1))
@@ -572,6 +601,7 @@ rec {
         (pkg: ''
           for bin in '${pkg.outPath}'/bin/* ; do
             grep -I -q . "$bin" || continue  # ignore binary files
+            [[ -x "$bin" ]] || continue # ignore non-executable files (such as context.lua)
             scriptCount=$((scriptCount + 1))
             read -r cmdline < "$bin"
             read -r interp <<< "$cmdline"

pkgs/tools/admin/aliyun-cli/default.nix

@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.196";
+  version = "3.0.197";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aliyun";
     repo = pname;
     fetchSubmodules = true;
-    sha256 = "sha256-VywkE1G8oobDp6D4lsTUzKvJ6eAo9J2r1/+HuM6u/J8=";
+    sha256 = "sha256-YNnMwHIA77A/a1W6swb7ws4tKQjsb0JjvCMIJkfFhSc=";
   };
 
-  vendorHash = "sha256-ZcW0Ab7uPx8XUpo3tSSt2eKjUlRlbiMvrLGJK2StKf8=";
+  vendorHash = "sha256-tepSDtHln5PbYCZofKs54+GmGjKUBGtU0DYTDZ4Rox0=";
 
   subPackages = [ "main" ];
 

pkgs/tools/admin/credhub-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.24";
+  version = "2.9.25";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "sha256-9SEdMK9KECte9QEfosju0PHxlDWwbQkn4QKi/XgFVuY=";
+    sha256 = "sha256-QGsnNQvER5IaWY4Zh9sFa7eOeLnDdNDrLLpwgBALGm8=";
   };
 
   # these tests require network access that we're not going to give them

pkgs/tools/backup/zfs-replicate/default.nix

@@ -11,12 +11,12 @@
 
 buildPythonApplication rec {
   pname = "zfs_replicate";
-  version = "3.2.3";
+  version = "3.2.4";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uzA8cQTUWAGLEhISZhaU6hNe9xcsF9jPZ1ETOi1XIFc=";
+    hash = "sha256-AjpdJT8on2YyGCriQllFyMnHgg4H7acCy/ewBuBrXKs=";
   };
 
   postPatch = ''

pkgs/tools/filesystems/bashmount/default.nix

@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/jamielinux/bashmount";
     description = "A menu-driven bash script for the management of removable media with udisks";
+    mainProgram = "bashmount";
     maintainers = [ maintainers.koral ];
     license = licenses.gpl2;
     platforms = platforms.all;

pkgs/tools/filesystems/snapraid/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "snapraid";
-  version = "12.2";
+  version = "12.3";
 
   src = fetchFromGitHub {
     owner = "amadvance";
     repo = "snapraid";
     rev = "v${version}";
-    sha256 = "sha256-3wy442tv3m1CSOAj1cngTWRiqX934c/7V2YL6j30+3U=";
+    sha256 = "sha256-pkLooA3JZV/rPlE5+JeJN1QW2xAdNu7c/iFFtT4M4vc=";
   };
 
   VERSION = version;

pkgs/tools/misc/most/default.nix

@@ -2,18 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "most";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchurl {
     url = "https://www.jedsoft.org/releases/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "008537ns659pw2aag15imwjrxj73j26aqq90h285is6kz8gmv06v";
+    hash = "sha256-lFWuuPgm+oOFyFDcIr8PIs+QabPDQj+6S/LG9iJtmQM=";
   };
 
-  patches = [
-    # Upstream patch to fix parallel build failure
-    ./parallel-make.patch
-  ];
-
   outputs = [ "out" "doc" ];
 
   makeFlags = [

pkgs/tools/misc/most/parallel-make.patch

@@ -1,18 +0,0 @@
-Upstream commit c9cfad50a ("src/Makefile.in: Avoid a race condition
-when performing a parallel build")
-
---- a/src/Makefile.in
-+++ b/src/Makefile.in
-@@ -54,6 +54,12 @@ COMPILE_CMD = $(CC) -c $(ALL_CFLAGS) -DMOST_SYSTEM_INITFILE='"$(SYS_INITFILE)"'
- all: $(EXEC)
- $(EXEC): $(OBJDIR) $(CONFIG_H) slangversion $(OBJDIR)/$(EXEC)
- 	@echo $(EXEC) created in $(OBJDIR)
-+
-+# C source files include autogenrated "config.h". Make sure
-+# it's available before the compilation. Pessimistically assume
-+# any source file can depend on "config.h".
-+$(OBJS) $(OBJDIR)/chkslang.o: $(CONFIG_H)
-+
- $(OBJDIR)/$(EXEC): $(OBJS)
- 	cd $(OBJDIR); $(CC) $(OFILES) -o $(EXEC) $(LDFLAGS) $(EXECLIBS)
- #

pkgs/tools/misc/steampipe/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.21.3";
+  version = "0.21.4";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    hash = "sha256-Qbg6f8fIupAEiiT7gDRQCs3pe1lw+tO5va5PpwgATfk=";
+    hash = "sha256-cO6LlcCUn+Fovuqh82Ttymf8kFyBMCHOZrcZWvtBsKo=";
   };
 
   vendorHash = "sha256-XwFBXQw6OfxIQWYidTj+TLn0TrVTrfVry6MgiQWIoV4=";

pkgs/tools/networking/hysteria/default.nix

@@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
   pname = "hysteria";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = pname;
     rev = "app/v${version}";
-    hash = "sha256-xvnshGDQ69yXZ5BnEYAhoJOXG0uZ0lZRnp/rdnmNAkE=";
+    hash = "sha256-A8UTnvH5BYRETsjte65+M+HHO6MrqCiPthNEYwBkBYs=";
   };
 
-  vendorHash = "sha256-zjj5MhCVQbsLwZs7LcGhozXGmfzFrDipNsEswiseMYI=";
+  vendorHash = "sha256-uh/qYQBWsyazSbJIz1ykf5bap18fGSIfjVDL8zus2l0=";
   proxyVendor = true;
 
   ldflags =

pkgs/tools/networking/prettyping/default.nix

@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/denilsonsa/prettyping";
     description = "A wrapper around the standard ping tool with the objective of making the output prettier, more colorful, more compact, and easier to read";
+    mainProgram = "prettyping";
     license = with licenses; [ mit ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ qoelet ];

pkgs/tools/security/cloudfox/default.nix

@@ -5,16 +5,21 @@
 
 buildGoModule rec {
   pname = "cloudfox";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "BishopFox";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-4donwh7yG7R4+k+ydGto2CZclnM95qodQuL1Huu4GDo=";
+    hash = "sha256-zP6jrueL3CXl6+fCmx4u0FzFy8mj6WkmECPHRZyqX8A=";
   };
 
-  vendorHash = "sha256-RdcfAZVqCp+egLbgx1c/A/zk0YlBY6aeeq0Lv4cLivY=";
+  vendorHash = "sha256-qPIMmyKTmZEmxlLLftRMnBXvo22WFROYlCAAsAb7jDg=";
+
+  ldflags = [
+    "-w"
+    "-s"
+  ];
 
   # Some tests are failing because of wrong filename/path
   doCheck = false;

pkgs/tools/security/cnquery/default.nix

@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "9.14.0";
+  version = "10.0.3";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     rev = "v${version}";
-    hash = "sha256-/Lawxl+jMJKSOKi5yxc+d7Gro69rLCB7nyYPmLtNGoU=";
+    hash = "sha256-LiW9P0q4VstzkNQQUdI5xG1TmpdwQMi3EZk0gsAA5LU=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-T7pD88v2sF7w/t5O+sekn1oy/uvA6LytYptLXrd+X4c=";
+  vendorHash = "sha256-/SUdyzCbIuVCM2/K0shlJTXbCJ8FSkXtOPaJvRDt2Zk=";
 
   meta = with lib; {
     description = "cloud-native, graph-based asset inventory";

pkgs/tools/security/cnspec/default.nix

@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "10.0.2";
+  version = "10.0.3";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YdOzHMC2dP8OCDn1T+nE7k5dL3KHpLHFAGKuQAnu6l0=";
+    hash = "sha256-UiEvy0NrdxEubaupGcpVQjqNJ1fKHrj/YA8wqvW0qoY=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-7Ro2qRU+ULLLrVT0VpJkwBOQ6EQSgMLiJRRK9IMuXZs=";
+  vendorHash = "sha256-gUyQ/bnBVYYlp3a8iifafi5cvvrld6Lq80aRVRg11pY=";
 
   subPackages = [
     "apps/cnspec"

pkgs/tools/security/grype/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.74.2";
+  version = "0.74.3";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZqYyVNaVLBh/IixUB72+EVvUUiovi+pexkIVYNsNLVY=";
+    hash = "sha256-p9gyVn3VU30TGqMWCY9OZ7Tcm5JML37oKozLdiW1Tl4=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-60xkcrMwgDs8ATRdPbDUZQlBaMMleQ3x+1oX2h13tZU=";
+  vendorHash = "sha256-6ZNRAiSWo6RM8SO1Fq+rKzrRf+vNVNZElRVGfkZljPc=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/tools/text/comrak/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comrak";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "kivikakk";
     repo = pname;
     rev = version;
-    sha256 = "sha256-E7aSbqBest7NxphPOsxG2n5z6QdtTiYaFmgRmLh3cCI=";
+    sha256 = "sha256-gYEq2kfSLaGdVQxmHTZ8O55f4Iwj9FKjUmlNq5+QtXI=";
   };
 
-  cargoSha256 = "sha256-SQ+G1rdiAfQj8MwjTiCgtPD5O8+jD3PSHy+rBUJlj2g=";
+  cargoHash = "sha256-rkSq18cFSlTJsZ7DvpJbXYUsg5k86Jk6bgpdO5nP6CE=";
 
   meta = with lib; {
     description = "A CommonMark-compatible GitHub Flavored Markdown parser and formatter";

pkgs/tools/typesetting/sile/default.nix

@@ -46,11 +46,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sile";
-  version = "0.14.14";
+  version = "0.14.16";
 
   src = fetchurl {
     url = "https://github.com/sile-typesetter/sile/releases/download/v${finalAttrs.version}/sile-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-xGcbD43yfJ6Ru7mU7R+NxfK1YXnIDwcYMjB++gcNqYg=";
+    sha256 = "sha256-z5dYW33Pd9meMo9s3OcaQHAyT+AB94dvcw+gTGySOFc=";
   };
 
   configureFlags = [

pkgs/tools/typesetting/tex/auctex/default.nix

@@ -17,7 +17,7 @@ let auctex = stdenv.mkDerivation ( rec {
   buildInputs = [
     emacs
     ghostscript
-    (texliveBasic.withPackages (ps: [ ps.hypdoc ]))
+    (texliveBasic.withPackages (ps: [ ps.etoolbox ps.hypdoc ]))
   ];
 
   preConfigure = ''

pkgs/tools/typesetting/tex/blahtexml/default.nix

@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
   postPatch = lib.optionalString stdenv.cc.isClang ''
     substituteInPlace makefile \
       --replace "\$(CXX)" "\$(CXX) -std=c++98"
+  '' +
+  # fix the doc build on TeX Live 2023
+  ''
+    substituteInPlace Documentation/manual.tex \
+      --replace '\usepackage[utf8x]{inputenc}' '\usepackage[utf8]{inputenc}'
   '';
 
   outputs = [ "out" "doc" ];

pkgs/tools/typesetting/tex/texlive/UPGRADING.md

@@ -72,6 +72,13 @@ CTAN and the various mirrors) and that the build recipe continues to produce
 the same output. Should those assumptions not hold, remove the previous fixed
 hashes for the relevant package, or for all packages.
 
+### Upgrading the ConTeXt binaries
+
+The LuaMetaTeX sources required for ConTeXt are distributed separately from the
+TeX Live tarballs and must be updated manually (see `texlive.bin.context`). You
+must use the latest tarball at https://tug.org/svn/texlive/trunk/Master/source/
+whose revision number is less than or equal to that of the package `context`.
+
 ### Updating the licensing information
 
 The license of each package in texlive is automatically extracted from texlive's

pkgs/tools/typesetting/tex/texlive/bin.nix

@@ -2,8 +2,8 @@
 , texlive
 , zlib, libiconv, libpng, libX11
 , freetype, gd, libXaw, icu, ghostscript, libXpm, libXmu, libXext
-, perl, perlPackages, python3Packages, pkg-config
+, perl, perlPackages, python3Packages, pkg-config, cmake, ninja
-, libpaper, graphite2, zziplib, harfbuzz, potrace, gmp, mpfr
+, libpaper, graphite2, zziplib, harfbuzz, potrace, gmp, mpfr, mupdf
 , brotli, cairo, pixman, xorg, clisp, biber, woff2, xxHash
 , makeWrapper, shortenPerlShebang, useFixedHashes, asymptote
 , biber-ms
@@ -34,16 +34,16 @@ let
     "tex4ht" "texlive-scripts-extra" "texware" "tie" "tpic2pdftex" "ttfutils"
     "uptex" "velthuis" "vlna" "web" "xml2pmx" ];
   coreBigPackages = [ "metafont" "mflua" "metapost" "luatex" "luahbtex"
-    "xetex" ] ++ lib.optional withLuaJIT "luajittex";
+    "upmendex" "xetex" ] ++ lib.optional withLuaJIT "luajittex";
   binPackages = lib.getAttrs (corePackages ++ coreBigPackages) tlpdb;
 
   common = {
     src = fetchurl {
       urls = [
-        "http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/${year}/texlive-${year}0321-source.tar.xz"
+        "http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/${year}/texlive-${year}0313-source.tar.xz"
-              "ftp://tug.ctan.org/pub/tex/historic/systems/texlive/${year}/texlive-${year}0321-source.tar.xz"
+              "ftp://tug.ctan.org/pub/tex/historic/systems/texlive/${year}/texlive-${year}0313-source.tar.xz"
       ];
-      hash = "sha256-X/o0heUessRJBJZFD8abnXvXy55TNX2S20vNT9YXm1Y=";
+      hash = "sha256-OHiqDh7QMBwFOw4u5OmtmZxEE0X0iC55vdHI9M6eebk=";
     };
 
     prePatch = ''
@@ -141,12 +141,6 @@ core = stdenv.mkDerivation rec {
     perl
   ];
 
-  patches = [
-    # Fix implicit `int` on `main`, which results in an error when building with clang 16.
-    # This is fixed upstream and can be dropped with the 2023 release.
-    ./fix-implicit-int.patch
-  ];
-
   hardeningDisable = [ "format" ];
 
   preConfigure = ''
@@ -203,7 +197,7 @@ core = stdenv.mkDerivation rec {
 inherit (core-big) metafont mflua metapost luatex luahbtex xetex;
 luajittex = core.big.luajittex or null;
 core-big = stdenv.mkDerivation {
-  pname = "texlive-core-big.bin";
+  pname = "texlive-bin-big";
   inherit version;
 
   __structuredAttrs = true;
@@ -211,20 +205,19 @@ core-big = stdenv.mkDerivation {
   inherit (common) binToOutput src prePatch;
 
   patches = [
-    # improves reproducibility of fmt files. This patch has been proposed upstream,
+    # improves reproducibility of fmt files
-    # but they are considering some other approaches as well. This is fairly
+    # see discussion at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009196
-    # conservative so we can safely apply it until they make a decision
-    # https://mailman.ntg.nl/pipermail/dev-luatex/2022-April/006650.html
     (fetchpatch {
-      name = "reproducible_exception_strings.patch";
+      name = "lua_fixed_hash.patch";
-      url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1009196;filename=reproducible_exception_strings.patch;msg=5";
+      url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1009196;filename=lua_fixed_hash.patch;msg=45";
-      sha256 = "sha256-RNZoEeTcWnrLaltcYrhNIORh42fFdwMzBfxMRWVurbk=";
+      sha256 = "sha256-FTu1eRd3AUU7IRs2/7e7uwHuvZsrzTBPypbcEZkU7y4=";
     })
     # fixes a security-issue in luatex that allows arbitrary code execution even with shell-escape disabled, see https://tug.org/~mseven/luatex.html
+    # fixed in LuaTeX 1.17.0, remove patch when upgrading to TL 2024
     (fetchpatch {
       name = "CVE-2023-32700.patch";
-      url = "https://tug.org/~mseven/luatex-files/2022/patch";
+      url = "https://tug.org/~mseven/luatex-files/2023/patch";
-      hash = "sha256-o9ENLc1ZIIOMX6MdwpBIgrR/Jdw6tYLmAyzW8i/FUbY=";
+      hash = "sha256-AvMedFkZJAFsCJ51eQqBQM4MpzLzn+GeBrzuTzISVkk=";
       excludes = [  "build.sh" ];
       stripLen = 1;
     })
@@ -238,15 +231,12 @@ core-big = stdenv.mkDerivation {
       stripLen = 1;
       extraPrefix = "libs/luajit/LuaJIT-src/";
     })
-    # Fix implicit `int` on `main`, which results in an error when building with clang 16.
-    # This is fixed upstream and can be dropped with the 2023 release.
-    ./fix-implicit-int.patch
   ];
 
   hardeningDisable = [ "format" ];
 
   inherit (core) nativeBuildInputs depsBuildBuild;
-  buildInputs = core.buildInputs ++ [ core cairo harfbuzz icu graphite2 libX11 ];
+  buildInputs = core.buildInputs ++ [ core cairo harfbuzz icu graphite2 libX11 potrace ];
 
   /* deleting the unused packages speeds up configure by a considerable margin
      and ensures we do not rebuild existing libraries by mistake */
@@ -292,8 +282,8 @@ core-big = stdenv.mkDerivation {
 
 
 chktex = stdenv.mkDerivation {
-  pname = "texlive-chktex.bin";
+  pname = "chktex";
-  inherit version;
+  inherit (texlive.pkgs.chktex) version;
 
   inherit (common) src;
 
@@ -309,46 +299,77 @@ chktex = stdenv.mkDerivation {
   enableParallelBuilding = true;
 };
 
+# the LuaMetaTeX engine (distributed since TeX Live 2023) must be built separately
+# the sources used by TL are stored in the source TL repo
+# for details see https://wiki.contextgarden.net/Building_LuaMetaTeX_for_TeX_Live
+context = stdenv.mkDerivation rec {
+  pname = "luametatex";
+  version = "2.10.08";
+
+  src = fetchurl {
+    url = "https://tug.org/svn/texlive/trunk/Master/source/luametatex-${version}.tar.xz?revision=67034&view=co";
+    hash = "sha256-3JeOUQ63jJOZWTxFCoyWjfcrspmdmC/yqgS1JaLfTWk=";
+  };
+
+  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake ninja ];
+
+  meta = with lib; {
+    description = "The LUAMETATEX engine is a follow up on LUATEX and is again part of CONTEXT development";
+    homepage = "https://www.pragma-ade.nl/luametatex-1.htm";
+    license = licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ apfelkuchen6 xworld21 ];
+  };
+};
 
 dvisvgm = stdenv.mkDerivation {
-  pname = "texlive-dvisvgm.bin";
+  pname = "dvisvgm";
-  inherit version;
+  inherit (texlive.pkgs.dvisvgm) version;
 
   inherit (common) src;
 
   patches = [
+    # do not use deprecated NEWPDF option with Ghostscript >= 10.02.0
+    # https://github.com/mgieseki/dvisvgm/issues/245
     (fetchpatch {
-      url = "https://github.com/mgieseki/dvisvgm/commit/629544928877362d0c6d64f20695f7df3073c5eb.patch";
+      name = "dont-use-NEWPDF-with-GS-10.02.0.patch";
+      url = "https://github.com/mgieseki/dvisvgm/commit/f31cdf14d73f586e2b92b4b0891d097a90274a0b.patch";
+      hash = "sha256-Yf/GhmJYM87M0ITZ/+7q2ZvSYnac4N2/NkTkFlJ2VII=";
       stripLen = 1;
       extraPrefix = "texk/dvisvgm/dvisvgm-src/";
-      hash = "sha256-CBCbc/woaFeLw7aBG/kSVYc3a5Q56zbAB64kK6mRy4g=";
-    })
-
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/mgieseki/dvisvgm/commit/d5df85b403602c927fe56a1f692af91182a1facd.patch";
-      stripLen = 1;
-      extraPrefix = "texk/dvisvgm/dvisvgm-src/";
-      hash = "sha256-U5m9jPmfAXOQKaU+aO/h6hEAzHRPqKcdj5k8f5gU9JQ=";
-      excludes = [ "texk/dvisvgm/dvisvgm-src/src/ttf/TTFTable.hpp" ];
     })
   ];
 
+  # since we are running configure directly in texk/dvisvgm,
+  # the option --with-system-potrace is not picked up properly
+  # and dvisvgm tries to build a vendored copy of potrace
+  postPatch = ''
+    cat > texk/dvisvgm/dvisvgm-src/libs/potrace/Makefile <<EOF
+    all:
+    install:
+    EOF
+  '' +
+    # PDF handling requires mutool (from mupdf) since Ghostscript 10.01
+  ''
+    substituteInPlace texk/dvisvgm/dvisvgm-src/src/PDFHandler.cpp \
+      --replace 'Process("mutool"' "Process(\"$(PATH="$HOST_PATH" command -v mutool)\""
+  '';
+
   preConfigure = "cd texk/dvisvgm";
 
   configureFlags = common.configureFlags
     ++ [ "--with-system-kpathsea" ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ core brotli ghostscript zlib freetype woff2 potrace xxHash ];
+  buildInputs = [ core brotli ghostscript zlib freetype woff2 potrace xxHash mupdf ];
 
   enableParallelBuilding = true;
 };
 
 
 dvipng = stdenv.mkDerivation {
-  pname = "texlive-dvipng.bin";
+  pname = "dvipng";
-  inherit version;
+  inherit (texlive.pkgs.dvipng) version;
 
   inherit (common) src;
 
@@ -411,8 +432,8 @@ inherit biber;
 inherit biber-ms;
 bibtexu = bibtex8;
 bibtex8 = stdenv.mkDerivation {
-  pname = "texlive-bibtex-x.bin";
+  pname = "bibtex-x";
-  inherit version;
+  inherit (texlive.pkgs.bibtexu) version;
 
   inherit (common) src;
 
@@ -429,8 +450,8 @@ bibtex8 = stdenv.mkDerivation {
 
 
 xdvi = stdenv.mkDerivation {
-  pname = "texlive-xdvi.bin";
+  pname = "xdvi";
-  inherit version;
+  inherit (texlive.pkgs.xdvi) version;
 
   inherit (common) src;
 
@@ -453,7 +474,7 @@ xdvi = stdenv.mkDerivation {
 };
 
 xpdfopen = stdenv.mkDerivation {
-  pname = "texlive-xpdfopen.bin";
+  pname = "xpdfopen";
   inherit (texlive.pkgs.xpdfopen) version;
 
   inherit (common) src;
@@ -471,8 +492,8 @@ xpdfopen = stdenv.mkDerivation {
 {
 
 xindy = stdenv.mkDerivation {
-  pname = "texlive-xindy.bin";
+  pname = "xindy";
-  inherit version;
+  inherit (texlive.pkgs.xindy) version;
 
   inherit (common) src;
 

pkgs/tools/typesetting/tex/texlive/build-tex-env.nix

@@ -266,6 +266,9 @@ let
         target="$(readlink "$link")"
       fi
 
+      # skip non-executable files (such as context.lua)
+      if [[ ! -x "$target" ]] ; then continue ; fi
+
       rm "$link"
       makeWrapper "$target" "$link" \
         --inherit-argv0 \
@@ -370,8 +373,17 @@ let
     # generate format links (reads fmtutil.cnf to know which ones) *after* the wrappers have been generated
   ''
     texlinks --quiet "$out/bin"
+  '' +
+    # temporarily patch mtxrun.lua to generate uuid's deterministically from SOURCE_DATE_EPOCH
+  ''
+    if [[ -e "$out/bin/mtxrun" ]]; then
+      mv "$out"/bin/mtxrun.lua{,.orig}
+      substitute "$TEXMFDIST"/scripts/context/lua/mtxrun.lua "$out"/bin/mtxrun.lua \
+        --replace 'randomseed(math.initialseed)' "randomseed($SOURCE_DATE_EPOCH)"
+    fi
   '' +
   # texlive postactions (see TeXLive::TLUtils::_do_postaction_script)
+  # this step includes generating the ConTeXt file databases since TL 2023
   (lib.concatMapStrings (pkg: ''
     postaction='${pkg.postactionScript}'
     case "$postaction" in
@@ -380,9 +392,16 @@ let
       *) postInterp= ;;
     esac
     echo "postaction install script for ${pkg.pname}: ''${postInterp:+$postInterp }$postaction install $TEXMFROOT"
-    $postInterp "$TEXMFROOT/$postaction" install "$TEXMFROOT"
+    FORCE_SOURCE_DATE=1 TZ= $postInterp "$TEXMFROOT"/$postaction install "$TEXMFROOT"
   '') (lib.filter (pkg: pkg ? postactionScript) pkgList.tlpkg)) +
+  # restore the original mtxrun.lua
+  ''
+    if [[ -e "$out/bin/mtxrun" ]]; then
+      mv "$out"/bin/mtxrun.lua{.orig,}
+    fi
+  '' +
     # generate formats
+    # TODO generate ConTeXt formats (based on fmtutil.cnf?)
   ''
     # many formats still ignore SOURCE_DATE_EPOCH even when FORCE_SOURCE_DATE=1
     # libfaketime fixes non-determinism related to timestamps ignoring FORCE_SOURCE_DATE
@@ -408,21 +427,6 @@ let
   ''
     rm "$out"/bin/*-sys
   '' +
-  # TODO: a context trigger https://www.preining.info/blog/2015/06/debian-tex-live-2015-the-new-layout/
-    # http://wiki.contextgarden.net/ConTeXt_Standalone#Unix-like_platforms_.28Linux.2FMacOS_X.2FFreeBSD.2FSolaris.29
-
-  # MkIV uses its own lookup mechanism and we need to initialize
-  # caches for it.
-  # We use faketime to fix the embedded timestamps and patch the uuids
-  # with some random but constant values.
-  ''
-    if [[ -e "$out/bin/mtxrun" ]]; then
-      substitute "$TEXMFDIST"/scripts/context/lua/mtxrun.lua mtxrun.lua \
-        --replace 'cache_uuid=osuuid()' 'cache_uuid="e2402e51-133d-4c73-a278-006ea4ed734f"' \
-        --replace 'uuid=osuuid(),' 'uuid="242be807-d17e-4792-8e39-aa93326fc871",'
-      FORCE_SOURCE_DATE=1 TZ= faketime -f '@1980-01-01 00:00:00 x0.001' luatex --luaonly mtxrun.lua --generate
-    fi
-  '' +
   # Get rid of all log files. They are not needed, but take up space
   # and render the build unreproducible by their embedded timestamps
   # and other non-deterministic diagnostics.

pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix

@@ -99,14 +99,12 @@ let
       # tlpkg is not a true container but a subfolder of the run container
       urlName = pname + (lib.optionalString (tlType != "run" && tlType != "tlpkg") ".${tlType}");
       urls = map (up: "${up}/archive/${urlName}.r${toString revision}.tar.xz") mirrors;
-      # TODO switch to simpler "${name}-${tlOutputName}" (requires new fixed hashes)
+      container = runCommand "${name}-${tlOutputName}"
-      container = runCommand "texlive-${pname}${lib.optionalString (tlType != "run") ".${tlType}"}-${version}${extraVersion}"
         ({
           src = fetchurl { inherit urls sha512; };
-          # save outputName as fixed output derivations cannot change nor override outputName
+          inherit passthru;
-          passthru = passthru // { inherit tlOutputName; };
+          # save outputName, since fixed output derivations cannot change nor override outputName
-          # TODO remove tlType from derivation (requires a rebuild)
+          inherit meta stripPrefix tlOutputName;
-          inherit meta stripPrefix tlType;
         } // lib.optionalAttrs (fixedHash != null) {
           outputHash = fixedHash;
           outputHashAlgo = "sha256";
@@ -114,7 +112,7 @@ let
         })
         (''
           mkdir "$out"
-          if [[ "$tlType"  == "tlpkg" ]]; then
+          if [[ "$tlOutputName"  == "tlpkg" ]]; then
             tar -xf "$src" \
               --strip-components=1 \
               -C "$out" --anchored --exclude=tlpkg/tlpobj --keep-old-files \
@@ -154,8 +152,7 @@ let
     tlu = texliveBinaries.luatex;
   };
 
-  # TODO switch to simpler "${name}" (requires a rebuild)
+  bin = runCommand "${name}"
-  bin = runCommand "texlive-${pname}.bin-${version}"
     {
       inherit meta;
       passthru = passthru // { tlOutputName = "out"; };
@@ -168,7 +165,7 @@ let
         ++ (lib.attrVals (args.scriptExts or [ ]) extToInput);
       nativeBuildInputs = extraNativeBuildInputs;
       # absolute scripts folder
-      scriptsFolder = lib.optionalString (tex ? outPath) (tex.outPath + "/scripts/" + args.scriptsFolder or pname);
+      scriptsFolder = lib.optionals (tex ? outPath) (builtins.map (f: tex.outPath + "/scripts/" + f) (lib.toList args.scriptsFolder or pname));
       # binaries info
       inherit (args) binfiles;
       binlinks = builtins.attrNames (args.binlinks or { });
@@ -183,8 +180,7 @@ let
     '';
 
   # build man, info containers
-  # TODO switch to simpler "${name}-man" (requires a rebuild)
+  man = builtins.removeAttrs (runCommand "${name}-man"
-  man = builtins.removeAttrs (runCommand "texlive-${pname}.man-${version}${extraVersion}"
     {
       inherit meta texdoc;
       passthru = passthru // { tlOutputName = "man"; };
@@ -194,8 +190,7 @@ let
       ln -s {"$texdoc"/doc,"$out"/share}/man
     '') [ "out" ] // lib.optionalAttrs hasBinfiles { out = bin; };
 
-  # TODO switch to simpler "${name}-info" (requires a rebuild)
+  info = builtins.removeAttrs (runCommand "${name}-info"
-  info = builtins.removeAttrs (runCommand "texlive-${pname}.info-${version}${extraVersion}"
     {
       inherit meta texdoc;
       passthru = passthru // { tlOutputName = "info"; };

pkgs/tools/typesetting/tex/texlive/default.nix

@@ -43,13 +43,13 @@ let
 
   version = {
     # day of the snapshot being taken
-    year = "2023";
+    year = "2024";
-    month = "03";
+    month = "01";
-    day = "19";
+    day = "14";
     # TeX Live version
-    texliveYear = 2022;
+    texliveYear = 2023;
     # final (historic) release or snapshot
-    final = true;
+    final = false;
   };
 
   # The tarballs on CTAN mirrors for the current release are constantly
@@ -63,16 +63,23 @@ let
     "http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/${toString texliveYear}/tlnet-final"
     "ftp://tug.org/texlive/historic/${toString texliveYear}/tlnet-final"
   ] ++ [
+    # CTAN mirrors
+    "https://mirror.ctan.org/systems/texlive/tlnet"
     # daily snapshots hosted by one of the texlive release managers;
-    # used for non-final snapshots and as fallback for final snapshots that have not reached yet the historic mirrors
+    # used for packages that in the meanwhile have been updated or removed from CTAN
-    # please note that this server is not meant for large scale deployment and should be avoided on release branches
+    # and for packages that have not reached yet the historic mirrors
+    # please note that this server is not meant for large scale deployment
     # https://tug.org/pipermail/tex-live/2019-November/044456.html
+    # https://texlive.info/ MUST appear last (see tlpdbxz)
     "https://texlive.info/tlnet-archive/${year}/${month}/${day}/tlnet"
   ];
 
   tlpdbxz = fetchurl {
-    urls = map (up: "${up}/tlpkg/texlive.tlpdb.xz") mirrors;
+    urls = map (up: "${up}/tlpkg/texlive.tlpdb.xz")
-    hash = "sha256-vm7DmkH/h183pN+qt1p1wZ6peT2TcMk/ae0nCXsCoMw=";
+      # use last mirror for daily snapshots as texlive.tlpdb.xz changes every day
+      # TODO make this less hacky
+      (if version.final then mirrors else [ (lib.last mirrors) ]);
+    hash = "sha256-eUG0KVfFPkjOczCsu2GAPRQcvcPrEIGqIsJNRc+AHDs=";
   };
 
   tlpdbNix = runCommand "tlpdb.nix" {
@@ -152,12 +159,12 @@ let
   # The correctness of this collation is tested by tests.texlive.licenses
   licenses = with lib.licenses; {
     scheme-basic = [ free gfl gpl1Only gpl2 gpl2Plus knuth lgpl21 lppl1 lppl13c mit ofl publicDomain ];
-    scheme-bookpub = [ artistic2 asl20 fdl13Only free gfl gpl1Only gpl2 gpl2Plus knuth lgpl21 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain ];
+    scheme-bookpub = [ artistic2 asl20 bsd3 fdl13Only free gfl gpl1Only gpl2 gpl2Plus knuth lgpl21 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain ];
     scheme-context = [ bsd2 bsd3 cc-by-sa-40 free gfl gfsl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus knuth lgpl2 lgpl21
       lppl1 lppl13c mit ofl publicDomain x11 ];
-    scheme-full = [ artistic1-cl8 artistic2 asl20 bsd2 bsd3 bsdOriginal cc-by-10 cc-by-40 cc-by-sa-10 cc-by-sa-20
+    scheme-full = [ artistic1-cl8 artistic2 asl20 bsd2 bsd3 bsdOriginal cc-by-10 cc-by-20 cc-by-30 cc-by-40 cc-by-sa-10 cc-by-sa-20 cc-by-sa-30
-      cc-by-sa-30 cc-by-sa-40 cc0 fdl13Only free gfl gfsl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus isc knuth
+      cc-by-sa-40 cc0 fdl13Only free gfl gfsl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus isc knuth lgpl2 lgpl21 lgpl3 lppl1 lppl12 lppl13a lppl13c mit
-      lgpl2 lgpl21 lgpl3 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain x11 ];
+      ofl publicDomain x11 ];
     scheme-gust = [ artistic1-cl8 asl20 bsd2 bsd3 cc-by-40 cc-by-sa-40 cc0 fdl13Only free gfl gfsl gpl1Only gpl2
       gpl2Plus gpl3 gpl3Plus knuth lgpl2 lgpl21 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain x11 ];
     scheme-infraonly = [ gpl2 gpl2Plus lgpl21 ];
@@ -167,9 +174,8 @@ let
     scheme-minimal = [ free gpl1Only gpl2 gpl2Plus knuth lgpl21 lppl1 lppl13c mit ofl publicDomain ];
     scheme-small = [ asl20 cc-by-40 cc-by-sa-40 cc0 fdl13Only free gfl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus knuth
       lgpl2 lgpl21 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain x11 ];
-    scheme-tetex = [ artistic1-cl8 asl20 bsd2 bsd3 cc-by-40 cc-by-sa-10 cc-by-sa-20 cc-by-sa-30 cc-by-sa-40 cc0
+    scheme-tetex = [ artistic1-cl8 asl20 bsd2 bsd3 cc-by-30 cc-by-40 cc-by-sa-10 cc-by-sa-20 cc-by-sa-30 cc-by-sa-40 cc0 fdl13Only free gfl gpl1Only
-      fdl13Only free gfl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus isc knuth lgpl2 lgpl21 lgpl3 lppl1 lppl12 lppl13a
+      gpl2 gpl2Plus gpl3 gpl3Plus isc knuth lgpl2 lgpl21 lgpl3 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain x11 ];
-      lppl13c mit ofl publicDomain x11];
   };
 
   meta = {

pkgs/tools/typesetting/tex/texlive/fix-implicit-int.patch

@@ -1,22 +0,0 @@
-diff -ur a/utils/m-tx/mtx-src/prepmx.c b/utils/m-tx/mtx-src/prepmx.c
---- a/utils/m-tx/mtx-src/prepmx.c	2018-04-28 17:56:18.000000000 -0600
-+++ b/utils/m-tx/mtx-src/prepmx.c	2023-07-11 15:21:26.351024424 -0600
-@@ -769,6 +769,7 @@
- }
- 
- 
-+int
- main(int argc, Char *argv[])
- {  /* ---- Main program ------------------------ */
-   PASCAL_MAIN(argc, argv);
-diff -ur a/utils/pmx/pmx-src/libf2c/main.c b/utils/pmx/pmx-src/libf2c/main.c
---- a/utils/pmx/pmx-src/libf2c/main.c	2016-02-09 22:31:26.000000000 -0700
-+++ b/utils/pmx/pmx-src/libf2c/main.c	2023-07-11 15:49:35.043438384 -0600
-@@ -106,6 +106,7 @@
- #ifdef KR_headers
- main(argc, argv) int argc; char **argv;
- #else
-+int
- main(int argc, char **argv)
- #endif
- {

pkgs/tools/typesetting/tex/texlive/make-bin-containers.sh

@@ -30,18 +30,18 @@ for binname in $binfiles ; do
   # look for scripts
   # the explicit list of extensions avoid non-scripts such as $binname.cmd, $binname.jar, $binname.pm
   # the order is relevant: $binname.sh is preferred to other $binname.*
-  if [[ -n "$scriptsFolder" ]] ; then
+  for folder in $scriptsFolder ; do
-    for script in "$scriptsFolder/$binname"{,.sh,.lua,.pl,.py,.rb,.sno,.tcl,.texlua,.tlu}; do
+    for script in "$folder/$binname"{,.sh,.lua,.pl,.py,.rb,.sno,.tcl,.texlua,.tlu}; do
       if [[ -f "$script" ]] ; then
         sed -f patch-scripts.sed \
           -e 's/^scriptname=`basename "\$0"`$/'"scriptname='$(basename "$binname")'/" \
           -e 's/^scriptname=`basename "\$0" .sh`$'"/scriptname='$(basename "$binname" .sh)'/" \
           "$script" > "$output"
         chmod +x "$output"
-        continue 2
+        continue 3
       fi
     done
-  fi
+  done
 
   echo "error: could not find source for 'bin/$binname'" >&2
   exit 1

pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix

@@ -26,7 +26,8 @@ in lib.recursiveUpdate orig rec {
   #### overrides of texlive.tlpdb
 
   #### nonstandard script folders
-  context.scriptsFolder = "context/stubs/unix";
+  context.scriptsFolder = "context/stubs-mkiv/unix";
+  context-legacy.scriptsFolder = "context/stubs/unix";
   cyrillic-bin.scriptsFolder = "texlive-extra";
   fontinst.scriptsFolder = "texlive-extra";
   mptopdf.scriptsFolder = "context/perl";
@@ -66,7 +67,8 @@ in lib.recursiveUpdate orig rec {
   bibexport.extraBuildInputs = [ gnugrep ];
   checklistings.extraBuildInputs = [ coreutils ];
   cjk-gs-integrate.extraBuildInputs = [ ghostscript_headless ];
-  context.extraBuildInputs = [ coreutils ruby ];
+  context.extraBuildInputs = [ coreutils ];
+  context-legacy.extraBuildInputs = [ ruby ];
   cyrillic-bin.extraBuildInputs = [ coreutils gnused ];
   dtxgen.extraBuildInputs = [ coreutils getopt gnumake zip ];
   dviljk.extraBuildInputs = [ coreutils ];
@@ -89,7 +91,6 @@ in lib.recursiveUpdate orig rec {
   ps2eps.extraBuildInputs = [ ghostscript_headless ];
   pst2pdf.extraBuildInputs = [ ghostscript_headless ];
   tex4ebook.extraBuildInputs = [ html-tidy ];
-  tex4ht.extraBuildInputs = [ ruby ];
   texlive-scripts.extraBuildInputs = [ gnused ];
   texlive-scripts-extra.extraBuildInputs = [ coreutils findutils ghostscript_headless gnused ];
   thumbpdf.extraBuildInputs = [ ghostscript_headless ];
@@ -118,9 +119,24 @@ in lib.recursiveUpdate orig rec {
     clxelatex = "cluttex";
   };
 
+  context.binlinks = {
+    context = "luametatex";
+    "context.lua" = tl.context.tex + "/scripts/context/lua/context.lua";
+    mtxrun = "luametatex";
+    "mtxrun.lua" = tl.context.tex + "/scripts/context/lua/mtxrun.lua";
+  };
+
   epstopdf.binlinks.repstopdf = "epstopdf";
   pdfcrop.binlinks.rpdfcrop = "pdfcrop";
 
+  # TODO: handle symlinks in bin.core
+  ptex.binlinks = {
+    pbibtex = tl.uptex + "/bin/upbibtex";
+    pdvitype = tl.uptex + "/bin/updvitype";
+    ppltotf = tl.uptex + "/bin/uppltotf";
+    ptftopl = tl.uptex + "/bin/uptftopl";
+  };
+
   texdef.binlinks = {
     latexdef = "texdef";
   };
@@ -155,8 +171,11 @@ in lib.recursiveUpdate orig rec {
   '';
 
   context.postFixup = ''
-    sed -i '2iPATH="${lib.makeBinPath [ coreutils ]}''${PATH:+:$PATH}"' "$out"/bin/{contextjit,mtxrunjit}
+    sed -i '2iPATH="${lib.makeBinPath context.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/{contextjit,mtxrunjit}
-    sed -i '2iPATH="${lib.makeBinPath [ ruby ]}''${PATH:+:$PATH}"' "$out"/bin/texexec
+  '';
+
+  context-legacy.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath context-legacy.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/texexec
   '';
 
   cyrillic-bin.postFixup = ''
@@ -246,10 +265,6 @@ in lib.recursiveUpdate orig rec {
     sed -i '2ios.setenv("PATH","${lib.makeBinPath tex4ebook.extraBuildInputs}" .. (os.getenv("PATH") and ":" .. os.getenv("PATH") or ""))' "$out"/bin/tex4ebook
   '';
 
-  tex4ht.postFixup = ''
-    sed -i -e '2iPATH="${lib.makeBinPath tex4ht.extraBuildInputs}''${PATH:+:$PATH}"' -e 's/\\rubyCall//g;' "$out"/bin/htcontext
-  '';
-
   texlive-scripts.postFixup = ''
     sed -i '2iPATH="${lib.makeBinPath texlive-scripts.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/{fmtutil-user,mktexmf,mktexpk,mktextfm,updmap-user}
   '';
@@ -276,6 +291,11 @@ in lib.recursiveUpdate orig rec {
   '';
 
   #### other script fixes
+  # wrong $0 expectations
+  bibcop.postFixup = ''
+    substituteInPlace "$out"/bin/bibcop --replace "basename(\$0) eq 'bibcop.pl'" "basename(\$0) eq 'bibcop'"
+  '';
+
   # misc tab and python3 fixes
   ebong.postFixup = ''
     sed -Ei 's/import sre/import re/; s/file\(/open(/g; s/\t/        /g; s/print +(.*)$/print(\1)/g' "$out"/bin/ebong
@@ -293,6 +313,9 @@ in lib.recursiveUpdate orig rec {
     substituteInPlace "$out"/bin/latexindent --replace 'use FindBin;' "BEGIN { \$0 = '$scriptsFolder' . '/latexindent.pl'; }; use FindBin;"
   '';
 
+  # flag lua dependency
+  texblend.scriptExts = [ "lua" ];
+
   # Patch texlinks.sh back to 2015 version;
   # otherwise some bin/ links break, e.g. xe(la)tex.
   # add runtime dependencies to PATH
@@ -316,8 +339,8 @@ in lib.recursiveUpdate orig rec {
       --replace '[dict get $::pkgs texlive.infra localrev]' '${toString orig."texlive.infra".revision}' \
       --replace '[dict get $::pkgs tlshell localrev]' '${toString orig.tlshell.revision}'
   '';
-  #### dependency changes
 
+  #### dependency changes
   # it seems to need it to transform fonts
   xdvi.deps = (orig.xdvi.deps or []) ++  [ "metafont" ];
 
@@ -338,10 +361,6 @@ in lib.recursiveUpdate orig rec {
   # tlpdb lists license as "unknown", but the README says lppl13: http://mirrors.ctan.org/language/arabic/arabi-add/README
   arabi-add.license = [  "lppl13c" ];
 
-  # TODO: remove this when updating to texlive-2023, npp-for-context is no longer in texlive
-  # tlpdb lists license as "noinfo", but it's gpl3: https://github.com/luigiScarso/context-npp
-  npp-for-context.license = [  "gpl3Only" ];
-
   texdoc = {
     extraRevision = "-tlpdb${toString tlpdbVersion.revision}";
     extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";

pkgs/tools/virtualization/cloud-init/default.nix

@@ -17,14 +17,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cloud-init";
-  version = "23.4.1";
+  version = "23.4.2";
   namePrefix = "";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "cloud-init";
     rev = "refs/tags/${version}";
-    hash = "sha256-jdL5xDQTmz1ppVr2+fX76tiscGazw5L7Q0/uQF6+ogM=";
+    hash = "sha256-Ae6xvXZR2ikriYekZbHfXG7iL0LlT7exwaaGt5odplg=";
   };
 
   patches = [

pkgs/top-level/all-packages.nix

@@ -1912,8 +1912,6 @@ with pkgs;
 
   hyperpotamus = callPackage ../tools/misc/hyperpotamus { };
 
-  igir = callPackage ../tools/games/igir { };
-
   immich-cli = callPackage ../tools/misc/immich-cli { };
 
   inherit (callPackages ../tools/networking/ivpn/default.nix {}) ivpn ivpn-service;
@@ -2130,7 +2128,6 @@ with pkgs;
 
   veikk-linux-driver-gui = libsForQt5.callPackage ../tools/misc/veikk-linux-driver-gui { };
 
-  ventoy = callPackage ../tools/cd-dvd/ventoy { };
   ventoy-full = ventoy.override {
     withCryptsetup = true;
     withXfs = true;