Merge staging-next into staging

2025-01-07 14:00:59 +03:00 · 2023-06-17 18:01:42 +00:00 · 2023-06-17 18:01:42 +00:00 · b3fcbe4087
commit b3fcbe4087
parent a8f53b0d71 859d7e12c2
103 changed files with 2668 additions and 2436 deletions
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@ -22,7 +22,7 @@ For new packages please briefly describe the package or provide a link to its ho
  - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages
 - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
 - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
- [23.11 Release Notes (or backporting 23.05 Release notes)](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#generating-2305-release-notes)
+- [23.11 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) (or backporting [23.05 Release notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2305.section.md))
  - [ ] (Package updates) Added a release notes entry if the change is major or breaking
  - [ ] (Module updates) Added a release notes entry if the change is significant
  - [ ] (Module addition) Added a release notes entry if adding a new NixOS module
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -161,19 +161,6 @@ Anything that does not cause user or downstream dependency regressions can be ba
 - Services which require a client to be up-to-date regardless. (E.g. `spotify`, `steam`, or `discord`)
 - Security critical applications (E.g. `firefox`)

-## Generating 23.11 Release Notes
-<!--
-note: title unchanged even though we don't need regeneration because extant
-PRs will link here. definitely change the title for 23.11 though.
-->
-
-Documentation in nixpkgs is transitioning to a markdown-centric workflow. In the past release notes required a translation step to convert from markdown to a compatible docbook document, but this is no longer necessary.
-
-Steps for updating 23.11 Release notes:
-
-1. Edit `nixos/doc/manual/release-notes/rl-2311.section.md` with the desired changes
-2. Commit changes to `rl-2311.section.md`.
-
 ## Reviewing contributions

 See the nixpkgs manual for more details on how to [Review contributions](https://nixos.org/nixpkgs/manual/#chap-reviewing-contributions).
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -61,3 +61,17 @@
 - A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.

 - `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts.<name>.listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details.
+
+## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
+
+- The `qemu-vm.nix` module by default now identifies block devices via
+  persistent names available in `/dev/disk/by-*`. Because the rootDevice is
+  identfied by its filesystem label, it needs to be formatted before the VM is
+  started. The functionality of automatically formatting the rootDevice in the
+  initrd is removed from the QEMU module. However, for tests that depend on
+  this functionality, a test utility for the scripted initrd is added
+  (`nixos/tests/common/auto-format-root-device.nix`). To use this in a NixOS
+  test, import the module, e.g. `imports = [
+  ./common/auto-format-root-device.nix ];` When you use the systemd initrd, you
+  can automatically format the root device by setting
+  `virtualisation.fileSystems."/".autoFormat = true;`.
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@ -573,6 +573,7 @@ let format' = format; in let
        # In this throwaway resource, we only have /dev/vda, but the actual VM may refer to another disk for bootloader, e.g. /dev/vdb
        # Use this option to create a symlink from vda to any arbitrary device you want.
        ${optionalString (config.boot.loader.grub.device != "/dev/vda") ''
+            mkdir -p $(dirname ${config.boot.loader.grub.device})
            ln -s /dev/vda ${config.boot.loader.grub.device}
        ''}

--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@ -514,7 +514,11 @@ class Machine:
        return "".join(output_buffer)

    def execute(
-        self, command: str, check_return: bool = True, timeout: Optional[int] = 900
+        self,
+        command: str,
+        check_return: bool = True,
+        check_output: bool = True,
+        timeout: Optional[int] = 900,
    ) -> Tuple[int, str]:
        self.run_callbacks()
        self.connect()
@ -535,6 +539,9 @@ class Machine:
        assert self.shell
        self.shell.send(out_command.encode())

+        if not check_output:
+            return (-2, "")
+
        # Get the output
        output = base64.b64decode(self._next_newline_closed_block_from_shell())

--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@ -60,6 +60,7 @@ in {
        config.networking.resolvconf.package # for configuring DNS in some configs
        pkgs.procps     # for collecting running services (opt-in feature)
        pkgs.glibc      # for `getent` to look up user shells
+        pkgs.kmod       # required to pass tailscale's v6nat check
      ];
      serviceConfig.Environment = [
        "PORT=${toString cfg.port}"
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -81,25 +81,6 @@ let

  drivesCmdLine = drives: concatStringsSep "\\\n    " (imap1 driveCmdline drives);

-
-  # Creates a device name from a 1-based a numerical index, e.g.
-  # * `driveDeviceName 1` -> `/dev/vda`
-  # * `driveDeviceName 2` -> `/dev/vdb`
-  driveDeviceName = idx:
-    let letter = elemAt lowerChars (idx - 1);
-    in if cfg.qemu.diskInterface == "scsi" then
-      "/dev/sd${letter}"
-    else
-      "/dev/vd${letter}";
-
-  lookupDriveDeviceName = driveName: driveList:
-    (findSingle (drive: drive.name == driveName)
-      (throw "Drive ${driveName} not found")
-      (throw "Multiple drives named ${driveName}") driveList).device;
-
-  addDeviceNames =
-    imap1 (idx: drive: drive // { device = driveDeviceName idx; });
-
  # Shell script to start the VM.
  startVM =
    ''
@ -109,25 +90,41 @@ let

      set -e

+      # Create an empty ext4 filesystem image. A filesystem image does not
+      # contain a partition table but just a filesystem.
+      createEmptyFilesystemImage() {
+        local name=$1
+        local size=$2
+        local temp=$(mktemp)
+        ${qemu}/bin/qemu-img create -f raw "$temp" "$size"
+        ${pkgs.e2fsprogs}/bin/mkfs.ext4 -L ${rootFilesystemLabel} "$temp"
+        ${qemu}/bin/qemu-img convert -f raw -O qcow2 "$temp" "$name"
+        rm "$temp"
+      }
+
      NIX_DISK_IMAGE=$(readlink -f "''${NIX_DISK_IMAGE:-${toString config.virtualisation.diskImage}}") || test -z "$NIX_DISK_IMAGE"

      if test -n "$NIX_DISK_IMAGE" && ! test -e "$NIX_DISK_IMAGE"; then
          echo "Disk image do not exist, creating the virtualisation disk image..."
-          # If we are using a bootloader and default filesystems layout.
-          # We have to reuse the system image layout as a backing image format (CoW)
-          # So we can write on the top of it.

-          # If we are not using the default FS layout, potentially, we are interested into
-          # performing operations in postDeviceCommands or at early boot on the raw device.
-          # We can still boot through QEMU direct kernel boot feature.
+          ${if (cfg.useBootLoader && cfg.useDefaultFilesystems) then ''
+            # Create a writable qcow2 image using the systemImage as a backing
+            # image.

-          # CoW prevent size to be attributed to an image.
-          # FIXME: raise this issue to upstream.
-          ${qemu}/bin/qemu-img create \
-          ${concatStringsSep " \\\n" ([ "-f qcow2" ]
-          ++ optional (cfg.useBootLoader && cfg.useDefaultFilesystems) "-F qcow2 -b ${systemImage}/nixos.qcow2"
-          ++ optional (!(cfg.useBootLoader && cfg.useDefaultFilesystems)) "-o size=${toString config.virtualisation.diskSize}M"
-          ++ [ ''"$NIX_DISK_IMAGE"'' ])}
+            # CoW prevent size to be attributed to an image.
+            # FIXME: raise this issue to upstream.
+            ${qemu}/bin/qemu-img create \
+              -f qcow2 \
+              -b ${systemImage}/nixos.qcow2 \
+              -F qcow2 \
+              "$NIX_DISK_IMAGE"
+          '' else if cfg.useDefaultFilesystems then ''
+            createEmptyFilesystemImage "$NIX_DISK_IMAGE" "${toString cfg.diskSize}M"
+          '' else ''
+            # Create an empty disk image without a filesystem.
+            ${qemu}/bin/qemu-img create -f qcow2 "$NIX_DISK_IMAGE" "${toString cfg.diskSize}M"
+          ''
+          }
          echo "Virtualisation disk image created."
      fi

@ -148,6 +145,7 @@ let
              ${pkgs.erofs-utils}/bin/mkfs.erofs \
                --force-uid=0 \
                --force-gid=0 \
+                -L ${nixStoreFilesystemLabel} \
                -U eb176051-bd15-49b7-9e6b-462e0b467019 \
                -T 0 \
                --exclude-regex="$(
@ -218,6 +216,19 @@ let

  regInfo = pkgs.closureInfo { rootPaths = config.virtualisation.additionalPaths; };

+  # Use well-defined and persistent filesystem labels to identify block devices.
+  rootFilesystemLabel = "nixos";
+  espFilesystemLabel = "ESP"; # Hard-coded by make-disk-image.nix
+  nixStoreFilesystemLabel = "nix-store";
+
+  # The root drive is a raw disk which does not necessarily contain a
+  # filesystem or partition table. It thus cannot be identified via the typical
+  # persistent naming schemes (e.g. /dev/disk/by-{label, uuid, partlabel,
+  # partuuid}. Instead, supply a well-defined and persistent serial attribute
+  # via QEMU. Inside the running system, the disk can then be identified via
+  # the /dev/disk/by-id scheme.
+  rootDriveSerialAttr = "root";
+
  # System image is akin to a complete NixOS install with
  # a boot partition and root partition.
  systemImage = import ../../lib/make-disk-image.nix {
@ -225,6 +236,7 @@ let
    additionalPaths = [ regInfo ];
    format = "qcow2";
    onlyNixStore = false;
+    label = rootFilesystemLabel;
    partitionTableType = selectPartitionTableLayout { inherit (cfg) useDefaultFilesystems useEFIBoot; };
    # Bootloader should be installed on the system image only if we are booting through bootloaders.
    # Though, if a user is not using our default filesystems, it is possible to not have any ESP
@ -247,6 +259,7 @@ let
    additionalPaths = [ regInfo ];
    format = "qcow2";
    onlyNixStore = true;
+    label = nixStoreFilesystemLabel;
    partitionTableType = "none";
    installBootLoader = false;
    touchEFIVars = false;
@ -255,28 +268,6 @@ let
    copyChannel = false;
  };

-  bootConfiguration =
-    if cfg.useDefaultFilesystems
-    then
-      if cfg.useBootLoader
-      then
-        if cfg.useEFIBoot then "efi_bootloading_with_default_fs"
-        else "legacy_bootloading_with_default_fs"
-      else
-        if cfg.directBoot.enable then "direct_boot_with_default_fs"
-        else "custom"
-    else
-      "custom";
-  suggestedRootDevice = {
-    "efi_bootloading_with_default_fs" = "${cfg.bootLoaderDevice}2";
-    "legacy_bootloading_with_default_fs" = "${cfg.bootLoaderDevice}1";
-    "direct_boot_with_default_fs" = cfg.bootLoaderDevice;
-    # This will enforce a NixOS module type checking error
-    # to ask explicitly the user to set a rootDevice.
-    # As it will look like `rootDevice = lib.mkDefault null;` after
-    # all "computations".
-    "custom" = null;
-  }.${bootConfiguration};
 in

 {
@ -343,44 +334,39 @@ in
    virtualisation.bootLoaderDevice =
      mkOption {
        type = types.path;
-        default = lookupDriveDeviceName "root" cfg.qemu.drives;
-        defaultText = literalExpression ''lookupDriveDeviceName "root" cfg.qemu.drives'';
-        example = "/dev/vda";
+        default = "/dev/disk/by-id/virtio-${rootDriveSerialAttr}";
+        defaultText = literalExpression ''/dev/disk/by-id/virtio-${rootDriveSerialAttr}'';
+        example = "/dev/disk/by-id/virtio-boot-loader-device";
        description =
          lib.mdDoc ''
-            The disk to be used for the boot filesystem.
-            By default, it is the same disk as the root filesystem.
+            The path (inside th VM) to the device to boot from when legacy booting.
          '';
        };

    virtualisation.bootPartition =
      mkOption {
        type = types.nullOr types.path;
-        default = if cfg.useEFIBoot then "${cfg.bootLoaderDevice}1" else null;
-        defaultText = literalExpression ''if cfg.useEFIBoot then "''${cfg.bootLoaderDevice}1" else null'';
-        example = "/dev/vda1";
+        default = if cfg.useEFIBoot then "/dev/disk/by-label/${espFilesystemLabel}" else null;
+        defaultText = literalExpression ''if cfg.useEFIBoot then "/dev/disk/by-label/${espFilesystemLabel}" else null'';
+        example = "/dev/disk/by-label/esp";
        description =
          lib.mdDoc ''
-            The boot partition to be used to mount /boot filesystem.
-            In legacy boots, this should be null.
-            By default, in EFI boot, it is the first partition of the boot device.
+            The path (inside the VM) to the device containing the EFI System Partition (ESP).
+
+            If you are *not* booting from a UEFI firmware, this value is, by
+            default, `null`. The ESP is mounted under `/boot`.
          '';
      };

    virtualisation.rootDevice =
      mkOption {
        type = types.nullOr types.path;
-        example = "/dev/vda2";
+        default = "/dev/disk/by-label/${rootFilesystemLabel}";
+        defaultText = literalExpression ''/dev/disk/by-label/${rootFilesystemLabel}'';
+        example = "/dev/disk/by-label/nixos";
        description =
          lib.mdDoc ''
-            The disk or partition to be used for the root filesystem.
-            By default (read the source code for more details):
-
-            - under EFI with a bootloader: 2nd partition of the boot disk
-            - in legacy boot with a bootloader: 1st partition of the boot disk
-            - in direct boot (i.e. without a bootloader): whole disk
-
-            In case you are not using a default boot device or a default filesystem, you have to set explicitly your root device.
+            The path (inside the VM) to the device containing the root filesystem.
          '';
      };

@ -711,7 +697,6 @@ in
        mkOption {
          type = types.listOf (types.submodule driveOpts);
          description = lib.mdDoc "Drives passed to qemu.";
-          apply = addDeviceNames;
        };

      diskInterface =
@ -975,29 +960,11 @@ in
    # FIXME: make a sense of this mess wrt to multiple ESP present in the system, probably use boot.efiSysMountpoint?
    boot.loader.grub.device = mkVMOverride (if cfg.useEFIBoot then "nodev" else cfg.bootLoaderDevice);
    boot.loader.grub.gfxmodeBios = with cfg.resolution; "${toString x}x${toString y}";
-    virtualisation.rootDevice = mkDefault suggestedRootDevice;

    boot.initrd.kernelModules = optionals (cfg.useNixStoreImage && !cfg.writableStore) [ "erofs" ];

    boot.loader.supportsInitrdSecrets = mkIf (!cfg.useBootLoader) (mkVMOverride false);

-    boot.initrd.extraUtilsCommands = lib.mkIf (cfg.useDefaultFilesystems && !config.boot.initrd.systemd.enable)
-      ''
-        # We need mke2fs in the initrd.
-        copy_bin_and_libs ${pkgs.e2fsprogs}/bin/mke2fs
-      '';
-
-    boot.initrd.postDeviceCommands = lib.mkIf (cfg.useDefaultFilesystems && !config.boot.initrd.systemd.enable)
-      ''
-        # If the disk image appears to be empty, run mke2fs to
-        # initialise.
-        FSTYPE=$(blkid -o value -s TYPE ${cfg.rootDevice} || true)
-        PARTTYPE=$(blkid -o value -s PTTYPE ${cfg.rootDevice} || true)
-        if test -z "$FSTYPE" -a -z "$PARTTYPE"; then
-            mke2fs -t ext4 ${cfg.rootDevice}
-        fi
-      '';
-
    boot.initrd.postMountCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
      ''
        # Mark this as a NixOS machine.
@ -1112,6 +1079,7 @@ in
        driveExtraOpts.cache = "writeback";
        driveExtraOpts.werror = "report";
        deviceExtraOpts.bootindex = "1";
+        deviceExtraOpts.serial = rootDriveSerialAttr;
      }])
      (mkIf cfg.useNixStoreImage [{
        name = "nix-store";
@ -1154,7 +1122,6 @@ in
        } else {
          device = cfg.rootDevice;
          fsType = "ext4";
-          autoFormat = true;
        });
        "/tmp" = lib.mkIf config.boot.tmp.useTmpfs {
          device = "tmpfs";
@ -1164,7 +1131,7 @@ in
          options = [ "mode=1777" "strictatime" "nosuid" "nodev" "size=${toString config.boot.tmp.tmpfsSize}" ];
        };
        "/nix/${if cfg.writableStore then ".ro-store" else "store"}" = lib.mkIf cfg.useNixStoreImage {
-          device = "${lookupDriveDeviceName "nix-store" cfg.qemu.drives}";
+          device = "/dev/disk/by-label/${nixStoreFilesystemLabel}";
          neededForBoot = true;
          options = [ "ro" ];
        };
@ -1174,7 +1141,7 @@ in
          neededForBoot = true;
        };
        "/boot" = lib.mkIf (cfg.useBootLoader && cfg.bootPartition != null) {
-          device = cfg.bootPartition; # 1 for e.g. `vda1`, as created in `systemImage`
+          device = cfg.bootPartition;
          fsType = "vfat";
          noCheck = true; # fsck fails on a r/o filesystem
        };
--- a/nixos/tests/common/auto-format-root-device.nix
+++ b/nixos/tests/common/auto-format-root-device.nix
@ -0,0 +1,29 @@
+# This is a test utility that automatically formats
+# `config.virtualisation.rootDevice` in the initrd.
+# Note that when you are using
+# `boot.initrd.systemd.enable = true`, you can use
+# `virtualisation.fileSystems."/".autoFormat = true;`
+# instead.
+
+{ config, pkgs, ... }:
+
+let
+  rootDevice = config.virtualisation.rootDevice;
+in
+{
+
+  boot.initrd.extraUtilsCommands = ''
+    # We need mke2fs in the initrd.
+    copy_bin_and_libs ${pkgs.e2fsprogs}/bin/mke2fs
+  '';
+
+  boot.initrd.postDeviceCommands = ''
+    # If the disk image appears to be empty, run mke2fs to
+    # initialise.
+    FSTYPE=$(blkid -o value -s TYPE ${rootDevice} || true)
+    PARTTYPE=$(blkid -o value -s PTTYPE ${rootDevice} || true)
+    if test -z "$FSTYPE" -a -z "$PARTTYPE"; then
+        mke2fs -t ext4 ${rootDevice}
+    fi
+  '';
+}
--- a/nixos/tests/fsck.nix
+++ b/nixos/tests/fsck.nix
@ -21,13 +21,17 @@ import ./make-test-python.nix {
    boot.initrd.systemd.enable = systemdStage1;
  };

-  testScript = ''
+  testScript =  { nodes, ...}:
+  let
+    rootDevice = nodes.machine.virtualisation.rootDevice;
+  in
+  ''
    machine.wait_for_unit("default.target")

    with subtest("root fs is fsckd"):
        machine.succeed("journalctl -b | grep '${if systemdStage1
-          then "fsck.*vda.*clean"
-          else "fsck.ext4.*/dev/vda"}'")
+          then "fsck.*${builtins.baseNameOf rootDevice}.*clean"
+          else "fsck.ext4.*${rootDevice}"}'")

    with subtest("mnt fs is fsckd"):
        machine.succeed("journalctl -b | grep 'fsck.*vdb.*clean'")
--- a/nixos/tests/hibernate.nix
+++ b/nixos/tests/hibernate.nix
@ -50,6 +50,7 @@ in makeTest {
      imports = [
        ../modules/profiles/installation-device.nix
        ../modules/profiles/base.nix
+        ./common/auto-format-root-device.nix
      ];

      nix.settings = {
--- a/nixos/tests/initrd-luks-empty-passphrase.nix
+++ b/nixos/tests/initrd-luks-empty-passphrase.nix
@ -14,6 +14,8 @@ in {
  name = "initrd-luks-empty-passphrase";

  nodes.machine = { pkgs, ... }: {
+    imports = lib.optionals (!systemdStage1) [ ./common/auto-format-root-device.nix ];
+
    virtualisation = {
      emptyDiskImages = [ 512 ];
      useBootLoader = true;
@ -23,6 +25,7 @@ in {
      # the new root device is /dev/vdb
      # an empty 512MiB drive, containing no Nix store.
      mountHostNixStore = true;
+      fileSystems."/".autoFormat = lib.mkIf systemdStage1 true;
    };

    boot.loader.systemd-boot.enable = true;
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@ -298,8 +298,13 @@ let
            ../modules/profiles/installation-device.nix
            ../modules/profiles/base.nix
            extraInstallerConfig
+            ./common/auto-format-root-device.nix
          ];

+          # In systemdStage1, also automatically format the device backing the
+          # root filesystem.
+          virtualisation.fileSystems."/".autoFormat = systemdStage1;
+
          # builds stuff in the VM, needs more juice
          virtualisation.diskSize = 8 * 1024;
          virtualisation.cores = 8;
--- a/nixos/tests/kexec.nix
+++ b/nixos/tests/kexec.nix
@ -8,10 +8,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
    node1 = { ... }: {
      virtualisation.vlans = [ ];
      virtualisation.memorySize = 4 * 1024;
-      virtualisation.useBootLoader = true;
-      virtualisation.useEFIBoot = true;
-      boot.loader.systemd-boot.enable = true;
-      boot.loader.efi.canTouchEfiVariables = true;
    };

    node2 = { modulesPath, ... }: {
@ -19,6 +15,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
      environment.systemPackages = [ pkgs.hello ];
      imports = [
        "${modulesPath}/installer/netboot/netboot-minimal.nix"
+        "${modulesPath}/testing/test-instrumentation.nix"
+        "${modulesPath}/profiles/qemu-guest.nix"
      ];
    };
  };
@ -39,7 +37,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
    # Kexec node1 to the toplevel of node2 via the kexec-boot script
    node1.succeed('touch /run/foo')
    node1.fail('hello')
-    node1.execute('${nodes.node2.config.system.build.kexecTree}/kexec-boot', check_return=False)
+    node1.execute('${nodes.node2.system.build.kexecTree}/kexec-boot', check_output=False)
+    node1.connected = False
+    node1.connect()
+    node1.wait_for_unit("multi-user.target")
    node1.succeed('! test -e /run/foo')
    node1.succeed('hello')
    node1.succeed('[ "$(hostname)" = "node2" ]')
--- a/nixos/tests/luks.nix
+++ b/nixos/tests/luks.nix
@ -2,6 +2,8 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
  name = "luks";

  nodes.machine = { pkgs, ... }: {
+    imports = [ ./common/auto-format-root-device.nix ];
+
    # Use systemd-boot
    virtualisation = {
      emptyDiskImages = [ 512 512 ];
--- a/nixos/tests/systemd-initrd-luks-fido2.nix
+++ b/nixos/tests/systemd-initrd-luks-fido2.nix
@ -26,6 +26,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
        };
      };
      virtualisation.rootDevice = "/dev/mapper/cryptroot";
+      virtualisation.fileSystems."/".autoFormat = true;
    };
  };

--- a/nixos/tests/systemd-initrd-luks-keyfile.nix
+++ b/nixos/tests/systemd-initrd-luks-keyfile.nix
@ -34,6 +34,7 @@ in {
        };
      };
      virtualisation.rootDevice = "/dev/mapper/cryptroot";
+      virtualisation.fileSystems."/".autoFormat = true;
      boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
    };
  };
--- a/nixos/tests/systemd-initrd-luks-password.nix
+++ b/nixos/tests/systemd-initrd-luks-password.nix
@ -25,6 +25,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
        cryptroot2.device = "/dev/vdc";
      };
      virtualisation.rootDevice = "/dev/mapper/cryptroot";
+      virtualisation.fileSystems."/".autoFormat = true;
      # test mounting device unlocked in initrd after switching root
      virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
    };
--- a/nixos/tests/systemd-initrd-luks-tpm2.nix
+++ b/nixos/tests/systemd-initrd-luks-tpm2.nix
@ -28,6 +28,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
        };
      };
      virtualisation.rootDevice = "/dev/mapper/cryptroot";
+      virtualisation.fileSystems."/".autoFormat = true;
    };
  };

--- a/nixos/tests/systemd-initrd-networkd-ssh.nix
+++ b/nixos/tests/systemd-initrd-networkd-ssh.nix
@ -17,6 +17,7 @@ import ./make-test-python.nix ({ lib, ... }: {

      specialisation.encrypted-root.configuration = {
        virtualisation.rootDevice = "/dev/mapper/root";
+        virtualisation.fileSystems."/".autoFormat = true;
        boot.initrd.luks.devices = lib.mkVMOverride {
          root.device = "/dev/vdb";
        };
--- a/pkgs/applications/audio/subtitlr/default.nix
+++ b/pkgs/applications/audio/subtitlr/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "Subtitlr";
-  version = "0.1.1";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "yoanbernabeu";
    repo = pname;
    rev = version;
-    hash = "sha256-1EjOpWVTp7CqwqSJAhqicvY2crzw1n7Id+TIwYrSQAs=";
+    hash = "sha256-PbeQzNkFj4eSg/zhk8bXij36DvJ9+g22kF5TqdX5O04=";
  };

  vendorHash = "sha256-ZgJCk9vbbQ0dcYSdKm0Cbw2AmwjpMvGb5zJkgbD+xig=";
--- a/pkgs/applications/editors/imhex/default.nix
+++ b/pkgs/applications/editors/imhex/default.nix
@ -18,17 +18,17 @@
 , fmt_8
 , nlohmann_json
 , yara
+, rsync
 }:

 let
-  # when bumping the version, check if imhex has gotten support for the capstone version in nixpkgs
-  version = "1.27.1";
+  version = "1.29.0";

  patterns_src = fetchFromGitHub {
    owner = "WerWolv";
    repo = "ImHex-Patterns";
    rev = "ImHex-v${version}";
-    hash = "sha256-7Aaj+W+zXjHO8A2gmWtp5Pa/i5Uk8lXzX2WHjPIPRZI=";
+    hash = "sha256-lTTXu9RxoD582lXWI789gNcWvJmxmBIlBRIiyY3DseM=";
  };

 in
@ -41,10 +41,10 @@ stdenv.mkDerivation rec {
    owner = "WerWolv";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-meOx8SkufXbXuBIVefr/mO9fsUi3zeQmqmf86+aDMaI=";
+    hash = "sha256-dghyv7rpqGs5dt51ziAaeb/Ba7rGEcJ54AYKRJ2xXuk=";
  };

-  nativeBuildInputs = [ cmake llvm python3 perl pkg-config ];
+  nativeBuildInputs = [ cmake llvm python3 perl pkg-config rsync ];

  buildInputs = [
    capstone
@ -63,8 +63,7 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DIMHEX_OFFLINE_BUILD=ON"
-    # see comment at the top about our version of capstone
-    "-DUSE_SYSTEM_CAPSTONE=OFF"
+    "-DUSE_SYSTEM_CAPSTONE=ON"
    "-DUSE_SYSTEM_CURL=ON"
    "-DUSE_SYSTEM_FMT=ON"
    "-DUSE_SYSTEM_LLVM=ON"
@ -72,11 +71,10 @@ stdenv.mkDerivation rec {
    "-DUSE_SYSTEM_YARA=ON"
  ];

+  # rsync is used here so we can not copy the _schema.json files
  postInstall = ''
    mkdir -p $out/share/imhex
-    for d in ${patterns_src}/{constants,encodings,includes,magic,patterns}; do
-      cp -r $d $out/share/imhex/
-    done
+    rsync -av --exclude="*_schema.json" ${patterns_src}/{constants,encodings,includes,magic,patterns} $out/share/imhex
  '';

  meta = with lib; {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -173,24 +173,24 @@ final: prev:

  LazyVim = buildVimPluginFrom2Nix {
    pname = "LazyVim";
-    version = "2023-06-16";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "LazyVim";
      repo = "LazyVim";
-      rev = "b95644448ec1186f2a2f060025578c449964d7a9";
-      sha256 = "18m9yj6zxpbvd3107sahppmp4vf5pdrvhhhbn647ighyva1j3fcq";
+      rev = "b37616c20385520c2a06faca1a2f8954b015af5d";
+      sha256 = "19qgvrpgx82k3zr7bcxldb9zibfmc2d9v2l0vf5v3j8ga4l2dgw0";
    };
    meta.homepage = "https://github.com/LazyVim/LazyVim/";
  };

  LeaderF = buildVimPluginFrom2Nix {
    pname = "LeaderF";
-    version = "2023-06-15";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "Yggdroot";
      repo = "LeaderF";
-      rev = "4c5335184b8c9a707b1651da07413895a8c9bc15";
-      sha256 = "0a4m7p722qb3fbiwzl9wa6j10amxk3z9q5zkih21pixmfzqp1894";
+      rev = "fc8f161eb278acda29c87d87175278c2939db3c6";
+      sha256 = "15diwcfi5xmzn3y97mbp1yar00lw2lc8imm5gdq6wyx99wdcvc5d";
    };
    meta.homepage = "https://github.com/Yggdroot/LeaderF/";
  };
@ -305,12 +305,12 @@ final: prev:

  SchemaStore-nvim = buildVimPluginFrom2Nix {
    pname = "SchemaStore.nvim";
-    version = "2023-06-14";
+    version = "2023-06-16";
    src = fetchFromGitHub {
      owner = "b0o";
      repo = "SchemaStore.nvim";
-      rev = "f0c276e019f50d039d2556454040769474dde02a";
-      sha256 = "1l9lm3nra1cmmcss45mn6zjglbdzy5dr6zp9721fddyvxci5js1s";
+      rev = "335569380e25ef49b4837195f295f144012e3c87";
+      sha256 = "1njwf0ln1lx2ac58visnzqim42qv4wc87i3yxk462bbpi2kgg4w8";
    };
    meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
  };
@ -365,12 +365,12 @@ final: prev:

  SpaceVim = buildVimPluginFrom2Nix {
    pname = "SpaceVim";
-    version = "2023-06-16";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "SpaceVim";
      repo = "SpaceVim";
-      rev = "f0e17187207ab0d07917e4858df0aea6421efd95";
-      sha256 = "0g68x9c27w38h8vxi1y640iyn5wdf128222jryslkqbxp01c43xg";
+      rev = "9111a210a3dfb011af44a2dcc10010718ebde346";
+      sha256 = "0qigjnp4zlpwsk7jprdmji0s5pk034l6swmcvhnh5s5aabk0ng5s";
    };
    meta.homepage = "https://github.com/SpaceVim/SpaceVim/";
  };
@ -486,12 +486,12 @@ final: prev:

  aerial-nvim = buildVimPluginFrom2Nix {
    pname = "aerial.nvim";
-    version = "2023-06-16";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "stevearc";
      repo = "aerial.nvim";
-      rev = "87f91339901cc64f0a35a26463030a1988ed10dc";
-      sha256 = "09x29nnglmw71h1r335yhl2f90lf9scgxczd0xiazys3mmh9s8hi";
+      rev = "c30fb2c9bd09592351eed676f4c20e7a6411020e";
+      sha256 = "07nkrlaar7j8bgby6bij50kxi17ha5jzl4bwvwkgrrlj08v96if3";
      fetchSubmodules = true;
    };
    meta.homepage = "https://github.com/stevearc/aerial.nvim/";
@ -2961,12 +2961,12 @@ final: prev:

  edgy-nvim = buildVimPluginFrom2Nix {
    pname = "edgy.nvim";
-    version = "2023-06-16";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "folke";
      repo = "edgy.nvim";
-      rev = "e92cb54c2260537dcbd265bd4fc29122dde6ea44";
-      sha256 = "0ia2ra62r7pwj5mvr8an2cq02an5ykfqna9kv7db0lm2bfbvf8xa";
+      rev = "4ccdcbbf15222b0d2cc83e3826191f190bb92717";
+      sha256 = "1qpdiqk5zvfi6q2a7gcisvjazfc6wz46f9dk663w1dvp433rs19v";
    };
    meta.homepage = "https://github.com/folke/edgy.nvim/";
  };
@ -3324,12 +3324,12 @@ final: prev:

  friendly-snippets = buildVimPluginFrom2Nix {
    pname = "friendly-snippets";
-    version = "2023-06-15";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "rafamadriz";
      repo = "friendly-snippets";
-      rev = "9ec817dedd4474f16fc170910da9a2f5a8b262b6";
-      sha256 = "0bcrpa8c008qf183z7iafycqx8v83qwcj6ighaanasdfr9sbqc8y";
+      rev = "70b727d3454cceb3a818b1746be09786568b7e33";
+      sha256 = "13winfmabdpxwgig519qr11znjngdlmbgbmksyrilxangaw3zgjf";
    };
    meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
  };
@ -4475,12 +4475,12 @@ final: prev:

  lazy-nvim = buildVimPluginFrom2Nix {
    pname = "lazy.nvim";
-    version = "2023-06-12";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "folke";
      repo = "lazy.nvim";
-      rev = "10d4371745f88837c78c8daab00c5be6e48abea4";
-      sha256 = "0xnm2lwpvmwg3b87aj5k5lnqld8gywm887mlg84bikkz03spfg91";
+      rev = "67af46a7f53e06322753cdd8cfd524bbb8ca30a2";
+      sha256 = "1cfiwkx2bn6sl5anbi1qa7l7ihjzdcwg1p6g9a3ckzs9krqy24vm";
    };
    meta.homepage = "https://github.com/folke/lazy.nvim/";
  };
@ -5027,12 +5027,12 @@ final: prev:

  lush-nvim = buildNeovimPlugin {
    pname = "lush.nvim";
-    version = "2023-06-08";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "rktjmp";
      repo = "lush.nvim";
-      rev = "25cf75a5347d664783fce3d16f7fee3f58f37e1d";
-      sha256 = "117frxw7gwac21y3xbkc1ykwb5d4cj0fsax78m7bl668b6dvxah7";
+      rev = "789a2fbd98f3572f315958a0e8a711eb88d360d8";
+      sha256 = "03pqcm49c5g51ldmimbwh0yvcbbb1c6g6vwnmqn2aix0g2cxc11b";
    };
    meta.homepage = "https://github.com/rktjmp/lush.nvim/";
  };
@ -5579,12 +5579,12 @@ final: prev:

  neoconf-nvim = buildVimPluginFrom2Nix {
    pname = "neoconf.nvim";
-    version = "2023-06-16";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "folke";
      repo = "neoconf.nvim";
-      rev = "ce304a275e7f2d1547279332ff99e18e93e771a4";
-      sha256 = "1zdf5np3hpf865fs5yl6i3f1vrxp5adazrm3k18hmyi0b5n6r826";
+      rev = "0c18ac0b77296795b03be06681e23c9656319d36";
+      sha256 = "0k08py8vlldfgg7x2lz7p3w0355dz7x9g4dynivvjl39xfkvj5w4";
    };
    meta.homepage = "https://github.com/folke/neoconf.nvim/";
  };
@ -6131,12 +6131,12 @@ final: prev:

  nlsp-settings-nvim = buildVimPluginFrom2Nix {
    pname = "nlsp-settings.nvim";
-    version = "2023-06-15";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "tamago324";
      repo = "nlsp-settings.nvim";
-      rev = "eebfdd820976f10af4a7ce7f380da4e3fe76bebe";
-      sha256 = "15jyb4556h7ik6qghyi92byb7pm7i1d946b98wmfv334d0ccbg17";
+      rev = "36f5c99a6150918a89b85c262adcbd1c70cb582d";
+      sha256 = "1j2yd5485a2hxyl9lcbs3i4jwzm1gk2xy90836mibsaqnydb54h7";
    };
    meta.homepage = "https://github.com/tamago324/nlsp-settings.nvim/";
  };
@ -6743,12 +6743,12 @@ final: prev:

  nvim-lspconfig = buildVimPluginFrom2Nix {
    pname = "nvim-lspconfig";
-    version = "2023-06-14";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "neovim";
      repo = "nvim-lspconfig";
-      rev = "295c646488d5baa63c6c4da68fe61171b9257375";
-      sha256 = "1j1g8ws9maxwp5dklflmz3j202shy7fpzqd3rm09ngs90n31xfva";
+      rev = "80861dc087982a6ed8ba91ec4836adce619f5a8a";
+      sha256 = "03n3zh5gizia6ryafj88c0n6rpwzqhfa7b3gwrr66z25c0sqqxv3";
    };
    meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
  };
@ -7059,8 +7059,8 @@ final: prev:
    src = fetchFromGitHub {
      owner = "nvim-treesitter";
      repo = "nvim-treesitter";
-      rev = "150a4c9fa4743b9af7b95f68746778394ce2ac93";
-      sha256 = "1rpqsqzj4ns2jhi7lsqkk7hq7728lajwpv2kk0sv1qqw6l4gg10f";
+      rev = "1b9f704eb8664508749a1164d4086e47f9afa77f";
+      sha256 = "1njqygdlvi930qpn0igf8y8bz15ci5kyncmnnir2235xp8bcn8i3";
    };
    meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
  };
@ -7294,12 +7294,12 @@ final: prev:

  oil-nvim = buildVimPluginFrom2Nix {
    pname = "oil.nvim";
-    version = "2023-06-14";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "stevearc";
      repo = "oil.nvim";
-      rev = "59dc12a978bb92b8900b6871955208efc6cda966";
-      sha256 = "1q9cnak16r87g9f2xsn3r571v45a8ypx09nnliys24q2gwvfsn0r";
+      rev = "6f8bf067c09e96d6bff548b5e6addb6d9c25a678";
+      sha256 = "0j7y2i84535c85na1z7l0ph0li0r668vxbdqrf1ib78dnv9nfnxf";
      fetchSubmodules = true;
    };
    meta.homepage = "https://github.com/stevearc/oil.nvim/";
@ -9428,12 +9428,12 @@ final: prev:

  tokyonight-nvim = buildVimPluginFrom2Nix {
    pname = "tokyonight.nvim";
-    version = "2023-05-30";
+    version = "2023-06-17";
    src = fetchFromGitHub {
      owner = "folke";
      repo = "tokyonight.nvim";
-      rev = "161114bd39b990995e08dbf941f6821afbdcd666";
-      sha256 = "1wbgi4zwlsgw13bqbnvgn1f8bilfbgyjqlhw1jpcdrfz3xrymji0";
+      rev = "18259404c962736c70c0f670b71c976c4a5ac2bb";
+      sha256 = "0x8406ziys9hs54x1ahdrvxy23ms8wgh377pfp72sf1knpicxa35";
    };
    meta.homepage = "https://github.com/folke/tokyonight.nvim/";
  };
@ -9636,8 +9636,8 @@ final: prev:
    src = fetchFromGitHub {
      owner = "unisonweb";
      repo = "unison";
-      rev = "97fff2fba9b0d2bb27f51f6e871394774f376b05";
-      sha256 = "0ka0s4ymjw4w8vfv0g3qqashg9lgpbsb0pcb8cgiw5v3j0adsf5j";
+      rev = "1f3a1ac6917da3c0868dd3d0ca52176a3ea2d399";
+      sha256 = "1frkhq5n60ycm0jyca4ak4gg6scpklp2r6bipbyxim1qv8ryf1ym";
    };
    meta.homepage = "https://github.com/unisonweb/unison/";
  };
@ -13449,6 +13449,18 @@ final: prev:
    meta.homepage = "https://github.com/tpope/vim-sensible/";
  };

+  vim-sentence-chopper = buildVimPluginFrom2Nix {
+    pname = "vim-sentence-chopper";
+    version = "2023-02-15";
+    src = fetchFromGitHub {
+      owner = "Konfekt";
+      repo = "vim-sentence-chopper";
+      rev = "39f50c65a46909e8c4c808310fa4187a8e3c1b38";
+      sha256 = "11kcja7gpi7ri7j8241ay6py75a6va72qv0bl2w235vx0l3zv486";
+    };
+    meta.homepage = "https://github.com/Konfekt/vim-sentence-chopper/";
+  };
+
  vim-sexp = buildVimPluginFrom2Nix {
    pname = "vim-sexp";
    version = "2021-03-08";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -1133,6 +1133,7 @@ https://github.com/thinca/vim-scouter/,,
 https://github.com/tpope/vim-scriptease/,,
 https://github.com/inside/vim-search-pulse/,,
 https://github.com/tpope/vim-sensible/,,
+https://github.com/Konfekt/vim-sentence-chopper/,HEAD,
 https://github.com/guns/vim-sexp/,,
 https://github.com/tpope/vim-sexp-mappings-for-regular-people/,,
 https://github.com/itspriddle/vim-shellcheck/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -651,8 +651,8 @@ let
        mktplcRef = {
          name = "ruff";
          publisher = "charliermarsh";
-          version = "2023.16.0";
-          sha256 = "sha256-MCRfG2CmGXLX15Qv/cxuH8VE1lJLPs4tXlCNnFqm5lc=";
+          version = "2023.22.0";
+          sha256 = "sha256-RhEDf/EbUD5YdHDyoZwr68OfOgKfkSXJFsKcLHC5bcc=";
        };
        meta = {
          license = lib.licenses.mit;
@ -1463,8 +1463,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "codespaces";
-          version = "1.14.7";
-          sha256 = "pcZGMxTVnMeD6rnNV0d9Wysk6MrYiYcJ+byuH9VR0ds=";
+          version = "1.14.8";
+          sha256 = "sha256-kCgnOODT1KDi9PMWs3CATXESWoHnDRhCIZhEUSkm14o=";
        };
        meta = { license = lib.licenses.unfree; };
      };
@ -1473,8 +1473,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "copilot";
-          version = "1.86.82";
-          sha256 = "isaqjrAmu/08gnNKQPeMV4Xc8u0Hx8gB2c78WE54kYQ=";
+          version = "1.89.156";
+          sha256 = "sha256-BJnYd9D3bWrZI8UETnAua8ngVjZJ7EXB1UrZAjVnx1E=";
        };
        meta = {
          description = "GitHub Copilot uses OpenAI Codex to suggest code and entire functions in real-time right from your editor.";
@ -1489,8 +1489,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "copilot-chat";
-          version = "0.1.2023060101";
-          sha256 = "sha256-g3UIcy2TpD3m8EamxneUXYAV/bbCPvPhOWdcuXPkK9g=";
+          version = "0.3.2023061502";
+          sha256 = "sha256-sUoKwlPDMz+iQbmIsD2JhyDwmUQzOyCHXaXCUaizQ7k=";
        };
        meta = {
          description = "GitHub Copilot Chat is a companion extension to GitHub Copilot that houses experimental chat features";
@ -1543,8 +1543,8 @@ let
          # the VSCode Marketplace and use a calver scheme. We should avoid
          # using preview versions, because they can require insider versions
          # of VS Code
-          version = "0.64.0";
-          sha256 = "tgQD3o5uMbWofVx7FPyWT1yaeu2e4aPxterN4yXA33U=";
+          version = "0.66.0";
+          sha256 = "sha256-rhAFNX+/BoKkQeFlVdoHzA8UmZeQofq7+UPooWleYVw=";
        };
        meta = { license = lib.licenses.mit; };
      };
@ -2197,8 +2197,8 @@ let
        mktplcRef = {
          name = "direnv";
          publisher = "mkhl";
-          version = "0.12.0";
-          sha256 = "sha256-UMGTWAiPAxSjy5ALUkijD0GE9TW37TZ3UvMmgFBNYsU=";
+          version = "0.13.0";
+          sha256 = "sha256-KdLJ7QTi9jz+JbbQuhXqyE3WV9oF+wyC/9ZJ/XTFOYc=";
        };
        meta = {
          description = "direnv support for Visual Studio Code";
@ -3029,8 +3029,8 @@ let
        mktplcRef = {
          name = "code-spell-checker";
          publisher = "streetsidesoftware";
-          version = "2.20.4";
-          sha256 = "sha256-GOXKXZPEynyqRUUY0pdNwt+141kJleg74IbCP4/34R8=";
+          version = "2.20.5";
+          sha256 = "sha256-IR/mwEmiSPN/ZRiazclRSOie9RAjdNM0zXexVzImOs8=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
--- a/pkgs/applications/emulators/xemu/default.nix
+++ b/pkgs/applications/emulators/xemu/default.nix
@ -27,13 +27,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xemu";
-  version = "0.7.92";
+  version = "0.7.95";

  src = fetchFromGitHub {
    owner = "xemu-project";
    repo = "xemu";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-wRGoeud4EY2N/seG0Kd7CJt1IkDdJMJwFwpQNoLOl2g=";
+    hash = "sha256-JZEDVmW1Q+nAFv8oVaYl7w41Mvm+L/t8PamkkE1FaIk=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/file-managers/felix-fm/Cargo.lock
+++ b/pkgs/applications/file-managers/felix-fm/Cargo.lock
@ -317,7 +317,7 @@ checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"

 [[package]]
 name = "felix"
-version = "2.3.0"
+version = "2.4.0"
 dependencies = [
 "chrono",
 "content_inspector",
--- a/pkgs/applications/file-managers/felix-fm/default.nix
+++ b/pkgs/applications/file-managers/felix-fm/default.nix
@ -9,13 +9,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "felix";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "kyoheiu";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-+8tYllK8UYW7hdA4qoH8Eiu6SbXvjRe4BFfEbwabuIY=";
+    sha256 = "sha256-yaAjw0Ayg0FuR5GVpmjwA7P1KfWFkXP0YsjNLhSl1FI=";
  };

  cargoLock = {
--- a/pkgs/applications/finance/denaro/default.nix
+++ b/pkgs/applications/finance/denaro/default.nix
@ -15,13 +15,13 @@

 buildDotnetModule rec {
  pname = "denaro";
-  version = "2023.5.0";
+  version = "2023.6.0";

  src = fetchFromGitHub {
    owner = "NickvisionApps";
    repo = "Denaro";
    rev = version;
-    hash = "sha256-kYN4Qm4xxOUkMi3twyVkT9PBnauDp7aenYy0YXzwKNA=";
+    hash = "sha256-oLEk3xHDkz98wOMwqr+lLtsFmOJdyPYK1YAutegic7U=";
  };

  dotnet-sdk = dotnetCorePackages.sdk_7_0;
--- a/pkgs/applications/finance/denaro/deps.nix
+++ b/pkgs/applications/finance/denaro/deps.nix
@ -4,6 +4,7 @@
 { fetchNuGet }: [
  (fetchNuGet { pname = "Cake.Tool"; version = "3.0.0"; sha256 = "0gjacqdgnh1d40sm9vrdb8vr6jv3vyh6j265gj1aaf9af2569637"; })
  (fetchNuGet { pname = "Docnet.Core"; version = "2.3.1"; sha256 = "03b39x0vlymdknwgwhsmnpw4gj3njmbl9pd57ls3rhfn9r832d44"; })
+  (fetchNuGet { pname = "GetText.NET"; version = "1.8.7"; sha256 = "0djn5sc7p33ayjmxmxs4hqagh51bg70wqs6mwbhlhsrc67bvgj9a"; })
  (fetchNuGet { pname = "GirCore.Adw-1"; version = "0.3.0"; sha256 = "1bsjqxck58dff9hnw21cp3xk1afly8721sfsbnxcr5i39hlrbl37"; })
  (fetchNuGet { pname = "GirCore.Cairo-1.0"; version = "0.3.0"; sha256 = "1zb8ilgywpwgjrzrbdvzvy70f46fb05iy49592mkjg2lv24q5l3y"; })
  (fetchNuGet { pname = "GirCore.FreeType2-2.0"; version = "0.3.0"; sha256 = "1bc78409bdhfqqbirwr1lkzxl27adndv05q5fcm5sivmlzr7fbkm"; })
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@ -5,21 +5,15 @@

 stdenv.mkDerivation rec {
  pname = "feh";
-  version = "3.9";
+  version = "3.10";

  src = fetchFromGitHub {
    owner = "derf";
    repo = pname;
    rev = version;
-    sha256 = "sha256-rgNC4M1TJ5EPeWmVHVzgaxTGLY7CYQf7uOsOn5bkwKE=";
+    hash = "sha256-9NJ6zgQHcFJPmRlqJuCMXcKjLvDPUG+QvKGTJlWvWK4=";
  };

-  postPatch = ''
-    substituteInPlace test/feh.t \
-      --replace "WARNING:" "WARNING: While loading" \
-      --replace "Does not look like an image \(magic bytes missing\)" "Unknown error \(15\)"
-  '';
-
  outputs = [ "out" "man" "doc" ];

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/graphics/rnote/Cargo.lock
+++ b/pkgs/applications/graphics/rnote/Cargo.lock
--- a/pkgs/applications/graphics/rnote/default.nix
+++ b/pkgs/applications/graphics/rnote/default.nix
@ -25,19 +25,19 @@

 stdenv.mkDerivation rec {
  pname = "rnote";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "flxzt";
    repo = "rnote";
    rev = "v${version}";
-    hash = "sha256-47mWlUXp62fMh5c13enFjmuMxzrmEZlwJFsZhYCB1Vs=";
+    hash = "sha256-PkC2w14xM+5ai/RuF0rCUpUCxX3hFNB+fq2RkebPKGQ=";
  };

  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "ink-stroke-modeler-rs-0.1.0" = "sha256-DrbFolHGL3ywk2p6Ly3x0vbjqxy1mXld+5CPrNlJfQM=";
+      "ink-stroke-modeler-rs-0.1.0" = "sha256-1abfrPehOGc/ye/iFIwYPd6HJX6P8OP2vGBSJfeo+c8=";
      "librsvg-2.56.0" = "sha256-4poP7xsoylmnKaUWuJ0tnlgEMpw9iJrM3dvt4IaFi7w=";
      "piet-0.6.2" = "sha256-If0qiZkgXeLvsrECItV9/HmhTk1H52xmVO7cUsD9dcU=";
    };
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
  pname = "process-compose";
-  version = "0.45.0";
+  version = "0.51.0";

  src = fetchFromGitHub {
    owner = "F1bonacc1";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-VNt+47EN+7EoChJjpg7B5ziu54Xt7egjfOye1IZPEvw=";
+    hash = "sha256-WPggJ86rWL8OIVXsDBT6P2AslT8rhDY4IIZdSPz6waE=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/applications/networking/avalanchego/default.nix
+++ b/pkgs/applications/networking/avalanchego/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "avalanchego";
-  version = "1.10.2";
+  version = "1.10.3";

  src = fetchFromGitHub {
    owner = "ava-labs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-rQ7WGsDCGR2yrMpNTP3yxnRFEGkCpkFIknxuARYd7TM=";
+    hash = "sha256-i6oAh/mDug2tuPoCa1pJEBd6jVPz2CxWlX6FCowxBwU=";
  };

-  vendorHash = "sha256-v8+ASwvXhUT9cz78aWDyWpgHOSoecLCLFMGfjTtRlJQ=";
+  vendorHash = "sha256-kXbKxNptKFfZ2iPkd+cPZNRPIMnNCWNrJXq6itJXG44=";
  # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
  proxyVendor = true;

--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -238,6 +238,19 @@ buildStdenv.mkDerivation ({
      hash = "sha256-fLUYaJwhrC/wF24HkuWn2PHqz7LlAaIZ1HYjRDB2w9A=";
    })
  ]
+  ++ lib.optional (lib.versionOlder version "109") [
+    # cherry-pick bindgen change to fix build with clang 16
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/community/firefox-esr/bindgen.patch?id=4c4b0c01c808657fffc5b796c56108c57301b28f";
+      hash = "sha256-lTvgT358M4M2vedZ+A6xSKsBYhSN+McdmEeR9t75MLU=";
+    })
+  ]
+  ++ lib.optional (lib.versionOlder version "111") [
+    # cherry-pick mp4parse change fixing build with Rust 1.70+
+    # original change: https://github.com/mozilla/mp4parse-rust/commit/8b5b652d38e007e736bb442ccd5aa5ed699db100
+    # vendored to update checksums
+    ./mp4parse-rust-170.patch
+  ]
  ++ lib.optional (lib.versionOlder version "111") ./env_var_for_system_dir-ff86.patch
  ++ lib.optional (lib.versionAtLeast version "111") ./env_var_for_system_dir-ff111.patch
  ++ lib.optional (lib.versionAtLeast version "96") ./no-buildconfig-ffx96.patch
--- a/pkgs/applications/networking/browsers/firefox/mp4parse-rust-170.patch
+++ b/pkgs/applications/networking/browsers/firefox/mp4parse-rust-170.patch
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.12.0";
+  version = "3.12.1";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-Fu1d1wpiD7u8lLMAe8WuOxJxDjY85vK8MPHz0iBr5Ps=";
+    sha256 = "sha256-vhBxs/EjJ+X3jT1799VqC4NF8To5N5nfcsE/Jc5mYM8=";
  };
-  vendorHash = "sha256-PvuuvM/ReDPI1hBQu4DsKdXXoD2C5BLvxU5Ld3h4hTE=";
+  vendorHash = "sha256-kNdrfNcUQ6EMbYNV+ZRi+ylwbLZsVyKMdPVH/r3yhgM=";

  subPackages = [ "cmd/helm" ];
  ldflags = [
--- a/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubectl-gadget";
-  version = "0.16.1";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    rev = "v${version}";
-    hash = "sha256-+eD+EHTZ0hCw4TzeZodXIsHg8dLUf7BFyw2Y0aEuSlA=";
+    hash = "sha256-7G6yot4VctwBf9MfcwXZLlon1NdaXQn7LSvkVf9y5kA=";
  };

-  vendorHash = "sha256-IbqE0aI7utYuu1XpQijEFVu/IpUDK6CQLu7g8GUR4e8=";
+  vendorHash = "sha256-RwUL8Mh9K2OIKzpKNtj6pHsFmSH0uZpouyMMeP22JQs=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "tektoncd-cli";
-  version = "0.31.0";
+  version = "0.31.1";

  src = fetchFromGitHub {
    owner = "tektoncd";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-LJEdeYVwcmxd7DU/HI0TpWtZ1xUJz4WEnjEfvx5HsZQ=";
+    sha256 = "sha256-SneGlXEthl/x6n+IlMN6y/ZubgHlfseoV0PS9sGcrTM=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.240";
+  version = "1.2.241";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    hash = "sha256-xqL/p+SMYX1fnalb33063McMyFS3AK8CdiRkO8tYEyI=";
+    hash = "sha256-KEcHKMWe6t2TWbpQecpEDEdldi+9b0E5t+g+Zkhhqtw=";
  };

-  vendorHash = "sha256-fp+AbmkCieJuy+cY2eOf1qtZdm3IdH7X73CEEVVr8G4=";
+  vendorHash = "sha256-iP1j11bWs5Laa1f3VEt/w+NMSWhHD8Kf4cwAZiy9sRc=";

  proxyVendor = true;

--- a/pkgs/applications/networking/firewalld/default.nix
+++ b/pkgs/applications/networking/firewalld/default.nix
@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "firewalld";
-  version = "1.3.2";
+  version = "1.3.3";

  src = fetchFromGitHub {
    owner = "firewalld";
    repo = "firewalld";
    rev = "v${version}";
-    sha256 = "sha256-xQQRhrbO1m80cgtO3JD4Nq42lh4HGA+a+yZvFYvbyaQ=";
+    sha256 = "sha256-PZ+ZaHRZsfW/VNXQXdr/a+UAGJeDUBytre5bH1WDSzY=";
  };

  patches = [
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "teams-for-linux";
-  version = "1.1.2";
+  version = "1.1.6";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Teij0TAYinaf908qCkvrFRMAMRwzrc8fXmgOHI0qniI=";
+    sha256 = "sha256-UDCMQqDN7MZ5tHZJts00IryMpRr07TPSGwxFdcq0fdI=";
  };

  offlineCache = fetchYarnDeps {
--- a/pkgs/applications/networking/mailreaders/notmuch/muchsync.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/muchsync.nix
@ -2,14 +2,14 @@
 , notmuch, openssl, pkg-config, sqlite, xapian, zlib
 }:
 stdenv.mkDerivation rec {
-  version = "6";
+  version = "7";
  pname = "muchsync";
  passthru = {
    inherit version;
  };
  src = fetchurl {
    url = "http://www.muchsync.org/src/${pname}-${version}.tar.gz";
-    sha256 = "Cz3jtNiF7bn4h6B9y8i1luf+8gOMYeaCz6VaE/pM6eg=";
+    hash = "sha256-+D4vb80O9IE0df3cjTkoVoZlTaX0FWWh6ams14Gjvqw=";
  };
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ notmuch openssl sqlite xapian zlib ];
--- a/pkgs/applications/office/trilium/desktop.nix
+++ b/pkgs/applications/office/trilium/desktop.nix
@ -6,13 +6,13 @@

 let
  pname = "trilium-desktop";
-  version = "0.59.4";
+  version = "0.60.3";

  linuxSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-  linuxSource.sha256 = "0vv58bcwx62slrc6f7ra61m71nqh6pb2rg4h99f8krj2h56zhrij";
+  linuxSource.sha256 = "0hfrww1r4s2rga8wzwhcfk60jy4b4xwglgflbc5jbxk3jalvk73x";

  darwinSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-mac-x64-${version}.zip";
-  darwinSource.sha256 = "18jdz32i0blh3hrdyh558fmqncjrnv1j1g3hwjcph8hi90pqycdr";
+  darwinSource.sha256 = "0scwq4fmllhjmcj0621rlaaniib3nabfwjmsxdfc5hfnlhjzq7qs";

  meta = metaCommon // {
    mainProgram = "trilium";
--- a/pkgs/applications/office/trilium/server.nix
+++ b/pkgs/applications/office/trilium/server.nix
@ -3,8 +3,8 @@

 let
  serverSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-  serverSource.sha256 = "1ys9vnxrxhy52accqxkmvf63kqwaf3ba6ysk3a8wfn2rwxa766g8";
-  version = "0.59.4";
+  serverSource.sha256 = "16xlbhjsd0xqaph14wk05qri256d7jga7fz0fwl4rw0li8r9qyd7";
+  version = "0.60.3";
 in stdenv.mkDerivation rec {
  pname = "trilium-server";
  inherit version;
--- a/pkgs/applications/radio/freedv/default.nix
+++ b/pkgs/applications/radio/freedv/default.nix
@ -25,13 +25,13 @@

 stdenv.mkDerivation rec {
  pname = "freedv";
-  version = "1.8.10.1";
+  version = "1.8.11";

  src = fetchFromGitHub {
    owner = "drowe67";
    repo = "freedv-gui";
    rev = "v${version}";
-    hash = "sha256-m8Myo/5jt+rnV8cAR2p20aAHnbatTkIXGSVhLebAP9g=";
+    hash = "sha256-uI81dz0rU2/UnLvoQffuFOB3NGaTK0MJmCWGvGQKw24=";
  };

  postPatch = lib.optionalString stdenv.isDarwin ''
--- a/pkgs/applications/virtualization/ecs-agent/default.nix
+++ b/pkgs/applications/virtualization/ecs-agent/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "amazon-ecs-agent";
-  version = "1.71.2";
+  version = "1.72.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "aws";
    repo = pname;
-    hash = "sha256-RCLBQgqbpNVqKiXP/gKP1iOn23A/poFUjFH8KxYbPCc=";
+    hash = "sha256-GKIT1PfgnIPqZp21gA4eimhzT77HNd5wM2Ynt2ekvWU=";
  };

  vendorHash = null;
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "24.1.1";
+  version = "24.1.3";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1gn59969vxl83jv3zzcbfsl54gph693p0bz70dkqfh0vxby5dl7y";
-  iosevka-aile = "0vqlbbnc5ybcbxn48svcf689mqhwf4slv72b8vvcjjvpyppmrdf9";
-  iosevka-curly = "1w86x4ixsh493idm8ab0awk15h01d98w8dcvqa6vmc2d98bm0zhr";
-  iosevka-curly-slab = "0bcq5zmgvfdz0bc73hrvnbn3rk5s10ryy35g655whqqx2wn8rk5a";
-  iosevka-etoile = "0s3295m5gflg9kq7lz49b1vb5ssdg31mkcvzq0w6c1v43sr9c3j7";
-  iosevka-slab = "0qydc6s9y896lfs867w7pqq352qwxbkspxz880fanpg66a4mb78f";
-  iosevka-ss01 = "135bjfpjvyqbylf1a0mbx6zfhxdipbfxn6kvdzbylcvaxmlkbmk7";
-  iosevka-ss02 = "00czg6i97qdp4460yis2khhsk6p8pws3d4s9cw3s23kaxbh3cafl";
-  iosevka-ss03 = "1wpifmkrf8vxsg1fz7mkafskhcdbiwm0j34qcyc8hxyy9g5xy0pf";
-  iosevka-ss04 = "0wrzzx5jwlmkw0alv55gikr0qwl2aqia3jpixbr2pmp8qj78asai";
-  iosevka-ss05 = "01sxgqhmxs9zra5gjcqkj8rkflr1p83jlnhqc4davd4h4pgdwqsx";
-  iosevka-ss06 = "1nzjnnqz6p0by2vl0f052m7dqvfcjx62clfdybc3k2b6vd8p91pz";
-  iosevka-ss07 = "1ib52g4gnj950b24y550wilip4311slsq001smf06bk64v0xyzb9";
-  iosevka-ss08 = "1kv22lnm8k9s8d39swny9ci8ybqbplqmgvfb4sh9gq8ikwbada7c";
-  iosevka-ss09 = "1q0yablkn1v94w204flkxpwf4zgzzrch1vk0x4ijcyw7bjwv2wlb";
-  iosevka-ss10 = "0s6fgq1mwfd56fx9iggisa87warpy8kwlnzrp52wadc6wml6pwp1";
-  iosevka-ss11 = "0iry12x9wmv8w6b00r0g0vnxjc4y40i6b68ml85qwp9xwrrbg4qg";
-  iosevka-ss12 = "1ry8b32l6bzas8h1lx7ymvf5c5hyz5sppqf4ygdxy6hcc6bqcmpf";
-  iosevka-ss13 = "1id288j7d8ppxcvgd0ylrc3rncnypg094ai8s539gxhlcfni0xn7";
-  iosevka-ss14 = "0ggfswcdy0kl7y6b1pqi0fx1lppljrd7g5mk94zylqg0p1qz8jg2";
-  iosevka-ss15 = "11zm07lna8pipzdm2xlxsq3ps7c85vv913wwbm01l0h7g5n6cr4h";
-  iosevka-ss16 = "13ggwcpdh6cx07hwi801n00mmm440xxr6lylgg013sbf7iasry18";
-  iosevka-ss17 = "0c5ixksqzshafg627fgsq5pwn79bmxg4n5q983halvwfwl0bnzbn";
-  iosevka-ss18 = "09qfm54rqixd5alzpx6kdsy1w9693ciij3f3kr1150b4rnd6ilc7";
-  sgr-iosevka = "0ab0dpryalq62j1zbayx8cjzl4bhr9gzm8x8yk4kbvqaf6rzjf4h";
-  sgr-iosevka-aile = "15hd88zbx76qc1imwxpgi5xnn7bg18fsvi3mhva9xsssqlah7lws";
-  sgr-iosevka-curly = "0a9jm2brda6x0g3rpvms4whb33cmk7fs9fphx1nf2lr2ydlhbz81";
-  sgr-iosevka-curly-slab = "00yvzbs5dri7hrazgfppb1zw0d72krhh789kkad00nhyx9ijls5z";
-  sgr-iosevka-etoile = "1i7ahs88xbfzyzhbg1vkp9r6mzfabpgnbihzbdbc9xffhd9m8b69";
-  sgr-iosevka-fixed = "05dy6b64ssar4lm6aw6bn6l43ljx8zca93q8b0hrgjgp5rf83hia";
-  sgr-iosevka-fixed-curly = "1nl2pm785n0rc3jyadclavy56c3k64yaplgsr3yyj5ic2clfg896";
-  sgr-iosevka-fixed-curly-slab = "1gkhxwvwqszfiqphfbb1ijlyqbihrwj1n6n67wzkll464wj4il6k";
-  sgr-iosevka-fixed-slab = "005y0zixp3g00i12jq3x6ahgfjbbxp9wz65mmbxdrggih34ws5r1";
-  sgr-iosevka-fixed-ss01 = "0z48q8ry6xyz9b0bbfy65qi6plffv4920wy473inidymj3lmy18s";
-  sgr-iosevka-fixed-ss02 = "0srq607x6nmhn9b0b7j33gfn57x6n32zl3prxzkvsc9z1dmg8nm8";
-  sgr-iosevka-fixed-ss03 = "1sxn9jkmhk7qp42lli075m05lz38a1rjnxkg5j3qdrxdha2alqsf";
-  sgr-iosevka-fixed-ss04 = "0h89vl5qym80g48idp81ii6ag3542s042r0hyda5ddkxw2alm38j";
-  sgr-iosevka-fixed-ss05 = "0b5c6sagz0z7sxsk16dwf8kvmxzjzn9n0aps2f665ap9nf2bvqny";
-  sgr-iosevka-fixed-ss06 = "11k1jk7z5ri1q49jj5ds5blbwrvvqk0fskc1jwjxx0jw5qhm1qxs";
-  sgr-iosevka-fixed-ss07 = "0yfh7726z2xa6lrlm4nc04syqh32im1ck8c191sv2340c708vg2d";
-  sgr-iosevka-fixed-ss08 = "0g9iig16jn39x46xz5h97k1rg07alpx272fv4aqpkibx7d4kpk4a";
-  sgr-iosevka-fixed-ss09 = "03fjsfyhgaxmnc0b2qz6a3pk7w0cpdfdqiqamqcxz6iqfbaqlk6l";
-  sgr-iosevka-fixed-ss10 = "1jz8qq259h6k2bqqhpq161sqgpcnqxm56rrk0kjcw6vgrschbiqg";
-  sgr-iosevka-fixed-ss11 = "14zj34cpkwb63gni23ls5icrkzxq16h09ggdgismxbbrymirw1yb";
-  sgr-iosevka-fixed-ss12 = "15hfkabmxb53f9ljwknxyr91h1awdmaa24kxq1hmbgwz7g4az7yr";
-  sgr-iosevka-fixed-ss13 = "1xiwaqjbhkj1hxqsp99c5skynzhanbp5mhlw04n006ay1kq9zjxs";
-  sgr-iosevka-fixed-ss14 = "0zapvxk4d8dn0jadm8ilvaqzlasc9g79v18y807zadcadhf7xmz3";
-  sgr-iosevka-fixed-ss15 = "19r7kdgpn1vqmhaj5dxhccfxyzpdcaxgdmic2nzhjcjkxg09mvs7";
-  sgr-iosevka-fixed-ss16 = "1na9bmgw29q62lbc5fjlbkjivncq71w3n6c02prcmpyn0xnlpqzc";
-  sgr-iosevka-fixed-ss17 = "1zabrx1bxr0pb1cbdp9vdzahjvwpignyp5qb466qiy8l6pyhx1sh";
-  sgr-iosevka-fixed-ss18 = "037srmxnq5jzgj2yf6l04msyvzp54sklxkjda2ibifywrac7fkk4";
-  sgr-iosevka-slab = "1fwjscd1r7f8k43m55svcyz38y4qlr329nmr2ji5h9cg08shi1gf";
-  sgr-iosevka-ss01 = "19c4cdpm8a543cj4wfakvhfmnbqvr5hp3c284w01z40wzx35zc2y";
-  sgr-iosevka-ss02 = "0rd79vrfgrmml9y6dc8k1b6flihhc1fgrab2rja4640qjn7ak8sj";
-  sgr-iosevka-ss03 = "18clr1swv0zkvwza46a3rl0z95cnvh7knidwk87wi1a4i5144dbp";
-  sgr-iosevka-ss04 = "1b02b0dvqpiw02b8g82pgk6a7ywj4wml00hkc26j5k0vmw7dxbvj";
-  sgr-iosevka-ss05 = "1z92ki8hq29qgnfpy65vnbrfhb17vb4wxa7ga0051vdyc6kbkip0";
-  sgr-iosevka-ss06 = "08nbrrvxdlf82112x9vd157sqvppkbfz21wzisyva6kzjips4d1v";
-  sgr-iosevka-ss07 = "13ghjry05y87z2i9kkrwf46gjzbhmhx32vqf8cbjnwr2scb3d2sd";
-  sgr-iosevka-ss08 = "09m9wraz90lc64jdyc8wjdmqdcll44v9j4yr2hw494c27883bk73";
-  sgr-iosevka-ss09 = "1ada6dykasd7mb8haari9bwzl75bfp2y0c177vk2lc869f845l5l";
-  sgr-iosevka-ss10 = "15c4h8plvy9mmjz8rv8jjhlby3g0x674il01gc54q70sv4g1lj2h";
-  sgr-iosevka-ss11 = "1d1hrxj7vv8lhxsqjfn9wz12wsnhv5accc06dpra3sraqajilxga";
-  sgr-iosevka-ss12 = "0s75j0wrg2j52v0irlamsqf46izri58wls1fjs3p6ckjasn0jlb7";
-  sgr-iosevka-ss13 = "1nq6bjf6v87vni7s63nayx6dr01r219gxni0md4xbsqf7in31ncm";
-  sgr-iosevka-ss14 = "09kphmfr1yxa7whlzni1nbmyhrcpnbaqqzmbr1n18dahlq8wf4hv";
-  sgr-iosevka-ss15 = "0nnap51bhhbbdljxpcsbg7kzjb6a6psdfr06jf8z969q56288gmr";
-  sgr-iosevka-ss16 = "0rdvsrqfkj6wbmmxf0xgc9pjlc43n6y433ziflgv71r7zp25rbch";
-  sgr-iosevka-ss17 = "1ylndvsyq78n0wp3dnpj6ili7jagfa2hbr019dnnm485mw2lf34a";
-  sgr-iosevka-ss18 = "0mkc63kz9xqxqzzygbz4r462dlrcm0s2x975r33q1knz1fag43gm";
-  sgr-iosevka-term = "1f7aammqiwjvf49r7aa6ivbm539imb2vh51mqml9kagxyaz134bb";
-  sgr-iosevka-term-curly = "031i5rjwczghxcsks17hbwzhyfkalydfj255f7f15pq3mphj2svq";
-  sgr-iosevka-term-curly-slab = "1srjdhp667nbjrraxqqc3653zmw8ji33nnsvfqxmrs7jy1w16mic";
-  sgr-iosevka-term-slab = "0grhsha5f88h7326wy7fh9frk9xx28zbsk75rz6xxlh4qb3lqqx3";
-  sgr-iosevka-term-ss01 = "1c68h9zav5j76ylvw5yddscs6xk5i9fck8b7zphhqljyd5pk3i89";
-  sgr-iosevka-term-ss02 = "0kccl4i7wykaf4c234jh8qd1rxkc920533wn163xfpmb820c1lnw";
-  sgr-iosevka-term-ss03 = "1gl89w29mwir92s1zcvnvqg7apr1cr1fp56si1xk8i2smg9al540";
-  sgr-iosevka-term-ss04 = "093wxxw6v3sbds77izlsshn0yr8slchns2j858vjw2cm5nv14ps3";
-  sgr-iosevka-term-ss05 = "1b29jabdb2ca0yrs54x1ahx5fqz51va5khd3mlwqrbrjbz5hzfdb";
-  sgr-iosevka-term-ss06 = "1i4nrs5vh02xs1gh8i2c89gpzskxgrbfvgvna18d909mxqkwcj23";
-  sgr-iosevka-term-ss07 = "04xsxb7gch3srq86p23yvbn2l4pqg35fvg0ydsnnx7zxck711yh0";
-  sgr-iosevka-term-ss08 = "19zcyqb45fyxiwzpf6fcnbmsp1sxw6axxyl21ffc2qnamkbnh0cq";
-  sgr-iosevka-term-ss09 = "0z2li5gmyp4l8s5fwbcayg4fmdm6ilxa13mwm29nnrq3qfxs7jf5";
-  sgr-iosevka-term-ss10 = "08hl6ivvy5yycd8nrqk3q0c1lciw1dacsdccq6p3wnhraj4jvgpg";
-  sgr-iosevka-term-ss11 = "1mzkvqs0pszaizhlbs81ryspjq8mxnriqsg7ci5f1a5wfv5x4m0w";
-  sgr-iosevka-term-ss12 = "0nwb0jv6pq5dqzm9i0wy2ixqhwkc46z6735swy4kl08s6ywnby3f";
-  sgr-iosevka-term-ss13 = "0k2dbrn64i52rbv0rv9j41d20iqvmbsggmi75vnmvmyahm00agmn";
-  sgr-iosevka-term-ss14 = "0niq6iy6snd52l2qv248r5i4kbb0jrfnmscmc8hla04r43pfw9yi";
-  sgr-iosevka-term-ss15 = "05j96kmc0n88v1c0ygiypma4ddxnbvxmjj2yp6h76xzyhxvdl69l";
-  sgr-iosevka-term-ss16 = "1x9ipw7m42yhd33dxm5qzzqimszklcav26rqdmzam8m6slg6cwg9";
-  sgr-iosevka-term-ss17 = "0y9nw69jp8mnmbxhly16d8dnwpjgpgllimr7icqlbc9dr2nzzhm9";
-  sgr-iosevka-term-ss18 = "0sh3vhv3p42fgx4z5gg9b3v4nynnjxnn5fjzyiv044957djs4rvb";
+  iosevka = "1vn8czdz257p18g85gv7gbhwgvmg9g55i5v9ppxrgf58rv9gk7i3";
+  iosevka-aile = "0nr1wmpkagz0b5mh673pq0ngdcyxcqm8mmmyp9d3c5dxdlp83whw";
+  iosevka-curly = "07biw37b406mdna4cyd3p2l6zfmdd42hjlljdjhsd8s2cjs1iiv9";
+  iosevka-curly-slab = "0xx9m8nfmpdqmxqfj95vppcp0rgyvj1v2v0ra4803jhx2ss8zavj";
+  iosevka-etoile = "1b9rgrgrgka7my31xvphhx8dj9v08bjhhcqyfg773xzdl96804bj";
+  iosevka-slab = "112nhk507j15n44ib66zpblkyw4vgrmb5n08mkiqy6l57f56izly";
+  iosevka-ss01 = "1avbcjadqglzv69whqbsvsx9nqx4sjvxz3svdjy8ayhm1ik3aaj9";
+  iosevka-ss02 = "19dwcv4gsaky7pf6bvglmpxcln524za303ch0q5z3wqapfypayw6";
+  iosevka-ss03 = "09r9sckj02y5k738ph9lg14kf56lgh91d0lm6bp3mvnnsj0xrb1p";
+  iosevka-ss04 = "1qwmw7sa07zrn9vndhifikh5b1ldpyj5xg6iylb65pz5x1ljzma4";
+  iosevka-ss05 = "13l2rdngm0hgwidr74jvvjw3blh24gqlqnj98zv6x3pix4bc1rfi";
+  iosevka-ss06 = "0wjd08yk4d12zd70njk2v7d66152q946vs1fwkjv0c5rxqj3dbpd";
+  iosevka-ss07 = "0j7s2ir6gvqjibi5wvsyn48hj8vkkbdybg7hlg1dcp7pxknffm2z";
+  iosevka-ss08 = "1z7yb5jwi6vs96mlw52gb0m623vj2jrrj0pm4kqwbyqjln676jgd";
+  iosevka-ss09 = "0jy2vjv2zdm73i45a9a5l3ni7l2xc3j2xspj9pcv8f389a69l88j";
+  iosevka-ss10 = "1ff93nb57839mygpa3cm97np3sv688sn1jk8bwgxclnj89v5f5pj";
+  iosevka-ss11 = "1lhf2hn9z8wn9kjwzbdw94m0fzn4bg1siqary9vbcimm44w6b1l3";
+  iosevka-ss12 = "190x4wc1yv95d25v8zf1ylfyfg09hyin35zz4vn3chg9fn7q4kpw";
+  iosevka-ss13 = "08zkgc4hfcgz5csmjp5ysqhpqkdgq8kf0w3mrsv4c2m59n4g21s0";
+  iosevka-ss14 = "0sy8ssf1agcwp5rcm4qcds7i3bkih6i943kz57zvq4ndv7nd877v";
+  iosevka-ss15 = "0qmc3x3m93svxpsarhky9w761ss46viwlwm8ldnlisqpff2pfb57";
+  iosevka-ss16 = "0zxwjgl293vxwd4my1csfwgspad095zkf1ry0f0nvbv1dp659n3p";
+  iosevka-ss17 = "1yp9h55ck93z4d5qdxk2pm9710dwzsd7mxrmfrqimlg2nr677lpb";
+  iosevka-ss18 = "1qk859a5f9saj9xs3bq38h2ahzr3x9bj1rcyazrycg67nbgggjb3";
+  sgr-iosevka = "0b6djhyhlicvimkrygy0311grwkwndwm725ff6gc8hpycckvhgxa";
+  sgr-iosevka-aile = "12mm7awgz9j07a1cr5i4an1lnqr56sw51bp9yz2lwg6kb20sjkdl";
+  sgr-iosevka-curly = "1z0rrjn6cjv543kam01qh1z06jk698g9yk375h3svc4rnm5pbvld";
+  sgr-iosevka-curly-slab = "0yz18fv6hm36p1p6hjasqk1chsn3yfsvqa6ki3nqdpkjmdp012xy";
+  sgr-iosevka-etoile = "1jbljizhzqn7a5pdjdcc3d9dzl3r5y77jafxv1ki51lgcw55f569";
+  sgr-iosevka-fixed = "0an2f869v5b4wpj8r17i4m81y2bzmi9b99v9zx8sd3r4q5dcfq1b";
+  sgr-iosevka-fixed-curly = "0ihxv4c6qj47d97dj4jxcrl63pl86y5ll1a3agmhxg162kqyxgqd";
+  sgr-iosevka-fixed-curly-slab = "1rpycmf0dgpwgp4g26wf2sqhi4fi3kkkv8s9gs1idk3zsdv9m6b3";
+  sgr-iosevka-fixed-slab = "0c4c5yjmcfpmc043rf8bl16qhw1rjvvz1njkrrj5a7nwmx9llnhs";
+  sgr-iosevka-fixed-ss01 = "1jp6icrfvis81rhvlxxmy0xhkpmcbw88s5cb5kl7ff6qfhgil48j";
+  sgr-iosevka-fixed-ss02 = "0c7cbyz6ngn7m4zb9llagqfwcg4hvy6kjdw2pmr4hdzir927x4ar";
+  sgr-iosevka-fixed-ss03 = "0i56kdi6xkp178x6q3pg9q7vc88z6v7vhlp9ch4h6ckij2k32ywi";
+  sgr-iosevka-fixed-ss04 = "0gyqppbv7kfw5dibdkgk4icjyhl9jrmrpr8gpb367g1qbksp4wvv";
+  sgr-iosevka-fixed-ss05 = "1g9c9zmwds2y310zximqkfs5y2gi4rpw8201bllxnhh1gks36r1d";
+  sgr-iosevka-fixed-ss06 = "1hmbdv5dyinrm0a398wxm27893waxlbws4b0h7by075ic7kndx95";
+  sgr-iosevka-fixed-ss07 = "0z6h3zdgf2v2rzv58qb70dmjajx8hj6zaabln29rszk8hq6149q5";
+  sgr-iosevka-fixed-ss08 = "0n7qh7s3lgq7n6q5i18mrd1n5g9hx4plsa8ydyr8qwkjy1jp64v3";
+  sgr-iosevka-fixed-ss09 = "1jyn4kjydj3z71hfdfinfwx0mrsx9fngap43gm1jvy4r9k59sqxy";
+  sgr-iosevka-fixed-ss10 = "1jwz1bfsamdsn64x9l273q0irb3xrqlgmh2w52dzrr640m80f6f1";
+  sgr-iosevka-fixed-ss11 = "0j3rfxj45gw0dwgipi8gilx4bd55990d1rzy6is081246b47avg5";
+  sgr-iosevka-fixed-ss12 = "1y79bs9cll387f01djdg2rl1p9b477x9i2q9rwqc3zafamv68abf";
+  sgr-iosevka-fixed-ss13 = "0zyddk9fcdpryy1fya4z0s54bg0wa1va2aqi1di2cfvz2mz8k5ba";
+  sgr-iosevka-fixed-ss14 = "0qr2af8kwh0mxmnjbfy8mf58sbsz98y0qmprxzpngychrins3aan";
+  sgr-iosevka-fixed-ss15 = "0rv8w6iinn4nc8pwg20nngjndkm12ypkbww391vy4jxaqvi154nw";
+  sgr-iosevka-fixed-ss16 = "19q5y2c4sxkd0bynmwv3xgfad7lyw5ixhpzv3yjlbvzs65hp4wx1";
+  sgr-iosevka-fixed-ss17 = "1jzpywjmgaknr4i3ylrql085zmhny4fcjjf4s5arbjndxp45a7jb";
+  sgr-iosevka-fixed-ss18 = "1qk6p649nlym6qhj6rmmdn68jia2ki5b38jxl3gawhrzmk237as5";
+  sgr-iosevka-slab = "04myif7mkxhsvrs1igzr6fsbbl5rl2zmz68j3fc1rxb7j0a2d2g8";
+  sgr-iosevka-ss01 = "1v0i82kwq18pwcnkcr6rcm4qbs6k9b4l86vqk7mxnwsrhn96h89n";
+  sgr-iosevka-ss02 = "005hf2439996x8x3dms559q1bvf0nzyc6alv7n96xcxqv0x80a8z";
+  sgr-iosevka-ss03 = "0b9gvy5xdkzz0i0h99y1n08w4a29di91jqwc07qvsrz9643iwdc7";
+  sgr-iosevka-ss04 = "09mzibrq8bsls2q4ib7vrbxra6gzwja5ay74ra00rnw73626nq4j";
+  sgr-iosevka-ss05 = "0x2v9aisq64sgbssd7544gvwc22c5gqq8nbibz38mrv8ligm69rp";
+  sgr-iosevka-ss06 = "17lfkczf6jiic1i099xq4r92zxyax0rl6vbh10gn8nv8sj2qg4cz";
+  sgr-iosevka-ss07 = "0l6bdl7k6q2i82asg3745sg41f65gm340cg6h55wqbzdj433i7gk";
+  sgr-iosevka-ss08 = "1ql1fl8mmn46is7j68g9px245pjfpzzi6pa7vqg1l7j2q8v6y76p";
+  sgr-iosevka-ss09 = "0ri8pcd107k5sdzvrrfw5iprbv6pggwv52vp5sysx5ax5vin7m5k";
+  sgr-iosevka-ss10 = "061asrv6dp8vj48q0b0zrl8l34yhgy1d5fga9q4gzwsxy4nvx9nl";
+  sgr-iosevka-ss11 = "0708j7yn7bb18c2hb002v1dmv3gji9l3xgvgr1l2xfkfhhpwpdw7";
+  sgr-iosevka-ss12 = "1sxyrc2j3jrmnl0vlqccan4j1nbzzc004ddafk30bn2shswr9ai0";
+  sgr-iosevka-ss13 = "0w1s9hgv3imbvaxjjq5gbp1yvnhb0f12hj8m8mil2m9wq5r4zj00";
+  sgr-iosevka-ss14 = "0ckcvsmxmx8hq9n90kqvh7dc471h7lph1p6yml601nrkaf7axznp";
+  sgr-iosevka-ss15 = "186br4kfqpk65532g83g4557s2pkyw390z7h8wxvzh5yp2brargy";
+  sgr-iosevka-ss16 = "0mpxxz61bzgm9f8v4gfyqsnhf72d8vv63azqf4dvwxgzk0753xw7";
+  sgr-iosevka-ss17 = "05hi63gkwr0582hmyjk57cfw74hkl6g7kwnnr54vsbb7chgxdz8b";
+  sgr-iosevka-ss18 = "0nrxkihwk52j2s6pyiszr7fs3mcs77d59q5q13hvnismj8w59l3y";
+  sgr-iosevka-term = "022cj2wsbandasqbciaajzakdzx09ks421jc4xxlgms3n3pb13hj";
+  sgr-iosevka-term-curly = "0xvbbsgj3gy6mz0l2mlinknk21cd087h7ca1m4spc5cd9vmfk68f";
+  sgr-iosevka-term-curly-slab = "14b3xi82d1wbpsxp8wm89ri7vzp0d573rlqczjzdnz46a4mjhswy";
+  sgr-iosevka-term-slab = "128bz2w9ys62vah8jggyqkybas0dyg8qi0qskfivzghrc75zwafi";
+  sgr-iosevka-term-ss01 = "1y2dxz4jqzdv01p2b1gxis8vx48z1i59ky7qdkpn6n1n3vs8bfyi";
+  sgr-iosevka-term-ss02 = "07mdzpv32rpdwwzzs7sj4sw47jypxvr1vry3wqnkzbw3fcl2qykw";
+  sgr-iosevka-term-ss03 = "12viva2ykwv9i5pyidq3vds58d88s862c4y3wbp9xhnqlc83fi1y";
+  sgr-iosevka-term-ss04 = "14i25wpzrbz677shm897rc9gnf2g9rpxih3a51hbp6484hssrr4k";
+  sgr-iosevka-term-ss05 = "0bx04sls7gyl356lrm5syb9syd3dh36lrdp1fa34walbg31vzgaq";
+  sgr-iosevka-term-ss06 = "1xl3f0mldwvcnbxc5vylb9w5adzxbxbsrc87472zjynzf409c2vg";
+  sgr-iosevka-term-ss07 = "17b0v7cg6a7l02df0rpwdg67d9frv3sal6xpi1rd9iqjvvnpr2yn";
+  sgr-iosevka-term-ss08 = "023rfyzib3cg8fkb10b38dwpn3fh120b889r84d7gclxqfylw6gc";
+  sgr-iosevka-term-ss09 = "0hrrvg1lsbrlws8xfzqqkh2rzhjp0x7r3lgvi37zk4nj66nl5i4j";
+  sgr-iosevka-term-ss10 = "0s5cq5wd4w48jrg1slhdfvn1wq8rkcp5dbgv1kz75jkdrgf0vhh8";
+  sgr-iosevka-term-ss11 = "0w3nkaxcwc5alapbwdr8xdf1bkzdkaxg0pywrjgb1pq9czjmzalq";
+  sgr-iosevka-term-ss12 = "0i3scgcqrwil45zx0apra4spla96j1b4dfmxisq6mfxpqplf8hvm";
+  sgr-iosevka-term-ss13 = "17q8r47rf7292phj0gwnq6v0fkvh8x9wb04g1g7bfyxl69815iz3";
+  sgr-iosevka-term-ss14 = "0xsr5vbaca5q22qagxf1c8zg6dll8rz3msrkgs4b4z0f1bw8j3zf";
+  sgr-iosevka-term-ss15 = "1w1xikxjhgf968a9bkl8j2ks8pjdc6skk8vb045rx9l7w65cvl43";
+  sgr-iosevka-term-ss16 = "05j9r7n9m0lz6x6nprhmcwglld3fxwwwcxrrna81hbh1sim29c8x";
+  sgr-iosevka-term-ss17 = "0vraskgyp4ab7jav2qgj3lpnm5mjxr1ybd0l72zpy9hw3f8p6snz";
+  sgr-iosevka-term-ss18 = "1qm28bvqi091ywmqrrklqajv9dajmcfsfdvl5hd13z5y1kadvllw";
 }
--- a/pkgs/desktops/xfce/core/tumbler/default.nix
+++ b/pkgs/desktops/xfce/core/tumbler/default.nix
@ -4,6 +4,7 @@
 , gdk-pixbuf
 , glib
 , freetype
+, libgepub
 , libgsf
 , poppler
 , gst_all_1
@ -26,6 +27,7 @@ mkXfceDerivation {
    gdk-pixbuf
    glib
    gst_all_1.gst-plugins-base
+    libgepub # optional EPUB thumbnailer support
    libgsf
    poppler # technically the glib binding
  ];
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "belle-sip";
-  version = "5.2.53";
+  version = "5.2.64";

  src = fetchFromGitLab {
    domain = "gitlab.linphone.org";
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    group = "BC";
    repo = pname;
    rev = version;
-    sha256 = "sha256-uZrsDoLIq9jusM5kGXMjspWvFgRq2TF/CLMvTuDSEgM=";
+    sha256 = "sha256-5GTKunm6q5nTlfsA5vZZ0MCaSiit+JIdWHcb2t+MLEA=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/java/lombok/default.nix
+++ b/pkgs/development/libraries/java/lombok/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "lombok";
-  version = "1.18.26";
+  version = "1.18.28";

  src = fetchurl {
    url = "https://projectlombok.org/downloads/lombok-${version}.jar";
-    sha256 = "sha256-KvH6g2hIdhtuUUQOxii0ncOAgOmHG7NScB+4yDWAh88=";
+    sha256 = "sha256-t3TcT8pUMiXYtejBY360E8Q2Oy5hPpUiJ3b3kqjOwOA=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/libraries/libgepub/default.nix
+++ b/pkgs/development/libraries/libgepub/default.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "libgepub";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "IQpMeJXC6E8BpWglArpej6PqiWrzFw+yWS/OHdpW4C4=";
+    sha256 = "o+SzGiMmWdJqVLkSGziCw9c5fDz0SuXGS4ZwCYC8f2A=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/memtrace/default.nix
+++ b/pkgs/development/ocaml-modules/memtrace/default.nix
@ -3,13 +3,13 @@

 buildDunePackage rec {
  pname = "memtrace";
-  version = "0.2.2";
+  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "janestreet";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-y/Xz04CMFfRIzrDzGot16zEQsBMNc4J5s/q0VERcj04=";
+    hash = "sha256-dWkTrN8ZgNUz7BW7Aut8mfx8o4n8f6UZaDv/7rbbwNs=";
  };

  minimalOCamlVersion = "4.11";
--- a/pkgs/development/python-modules/browser-cookie3/default.nix
+++ b/pkgs/development/python-modules/browser-cookie3/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "browser-cookie3";
-  version = "0.18.0";
+  version = "0.19.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-bSP6likSwEbxN4S9qbJmPcs8joc5e10FiqVL9gE7ni8=";
+    hash = "sha256-CtVPtMhX6pBW4rM+Hq68lfM6EocJX6fgXuROEfYshL0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cupy/default.nix
+++ b/pkgs/development/python-modules/cupy/default.nix
@ -17,13 +17,13 @@ let
  inherit (cudaPackages) cudatoolkit cudnn cutensor nccl;
 in buildPythonPackage rec {
  pname = "cupy";
-  version = "12.0.0";
+  version = "12.1.0";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Yd2773PVDWBr1Qh1cGRfPJHskXbCVmeEwdSG1qNARUU=";
+    hash = "sha256-9tMZic2y2WWB2hKCLiixAvKeJUQnGVwgF+rDJ4abcyA=";
  };

  # See https://docs.cupy.dev/en/v10.2.0/reference/environment.html. Seting both
--- a/pkgs/development/python-modules/dacite/default.nix
+++ b/pkgs/development/python-modules/dacite/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "dacite";
-  version = "1.8.0";
+  version = "1.8.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "konradhalas";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-aQwQHFWaXwTaA6GQgDcWT6ivE9YtWtHCTOtxDi503+M=";
+    hash = "sha256-lvObQ+jyBH2s4GOwyDXEAYmG7ZGQN9WDqL8ftNItPCQ=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/dask-jobqueue/default.nix
+++ b/pkgs/development/python-modules/dask-jobqueue/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "dask-jobqueue";
-  version = "0.8.1";
+  version = "0.8.2";
  format = "setuptools";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Fv0bZGoHOtPedd3hKg3+UpuDbyGjvbzuKoi+8k6REqc=";
+    hash = "sha256-01QHoFoFNDR8XZWK50m5+FNb7FKYV9ATtuVknN5DkUo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/napari-npe2/default.nix
+++ b/pkgs/development/python-modules/napari-npe2/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "napari-npe2";
-  version = "0.6.2";
+  version = "0.7.0";

  format = "pyproject";

@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "napari";
    repo = "npe2";
    rev = "refs/tags/v${version}";
-    hash = "sha256-f4mSsURcf2xvvO/mrsLVpUt+ws73QHk2Ng/NwCR5Q48=";
+    hash = "sha256-6kHyz7jMZO3385XaNJ4zFBoQiU1SIRyYZsUeMH5EBXo=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "0.10.0.20230614";
+  version = "0.10.0.20230617";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-8tB95lcW4IQBeU5cY0YFfLKW3a0g1SQH9sJbn0cduho=";
+    hash = "sha256-Ncq/VuUCNR8TZvYSiXBG93xanQcw0FQGrHOBtIc1y2k=";
  };

  passthru.optional-dependencies = {
--- a/pkgs/development/python-modules/pyemby/default.nix
+++ b/pkgs/development/python-modules/pyemby/default.nix
@ -7,13 +7,13 @@

 buildPythonPackage rec {
  pname = "pyemby";
-  version = "1.8";
+  version = "1.9";

  src = fetchFromGitHub {
    owner = "mezz64";
    repo = pname;
    rev = version;
-    hash = "sha256-EpmXdyKtfb/M8rTv6YrfNCpDmKei2AD5DBcdVvqCVWw=";
+    hash = "sha256-4mOQLfPbRzZzpNLvekJHVKiqdGGKPhW6BpKkyRfk2Pc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyopengl-accelerate/default.nix
+++ b/pkgs/development/python-modules/pyopengl-accelerate/default.nix
@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "pyopengl-accelerate";
-  version = "3.1.6";
+  version = "3.1.7";
  disabled = pythonAtLeast "3.10"; # fails to compile

  src = fetchPypi {
    pname = "PyOpenGL-accelerate";
    inherit version;
-    hash = "sha256-rYowAlbsolIoJh3hb3QeUaMPNPHhsc9oNZ9cYtvNzcM=";
+    hash = "sha256-KxI2ISc6k59/0uwidUHjmfm11OgV1prgvbG2xwopNoA=";
  };

  meta = {
--- a/pkgs/development/python-modules/rapt-ble/default.nix
+++ b/pkgs/development/python-modules/rapt-ble/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "rapt-ble";
-  version = "0.1.1";
+  version = "0.1.2";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "sairon";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-BLpe4AxxvFeOfcBSPtLwPIJZnNIBEdd6JpuQb9upO34=";
+    hash = "sha256-ozZwVgTV/xYl1nXLiybcPs6DQKocNdbxTEYDfYyQuvY=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "reolink-aio";
-  version = "0.6.0";
+  version = "0.7.0";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "starkillerOG";
    repo = "reolink_aio";
    rev = "refs/tags/${version}";
-    hash = "sha256-fDtZEcHv13f9WtNZKoT8/I+Hz145n7SmQz0t9CVqE3g=";
+    hash = "sha256-4+gJcW5wi1MH3OskcfWyDNaT4FKJO5boHaxdORZUwPs=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "sphinxcontrib-katex";
-  version = "0.9.5";
+  version = "0.9.6";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ZNNi5qIKRyuPbXfFGhkAIvRFzuhsXcY73apIqOp8dJQ=";
+    hash = "sha256-BVwXqOB80tPkL7ZT91kq2UrMQ2WQqyJkswXDhh9Xhqc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/tablib/default.nix
+++ b/pkgs/development/python-modules/tablib/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "tablib";
-  version = "3.4.0";
+  version = "3.5.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-d+qX+vb5Kn4ZjAW9DGkPPLpXuD6kWmNrcvlny2/m8WA=";
+    hash = "sha256-9mYd/EXh1PUfqKYjn5yDSTgIWaW/qnMoBkXwRtbJbjM=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/time-machine/default.nix
+++ b/pkgs/development/python-modules/time-machine/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "time-machine";
-  version = "2.9.0";
+  version = "2.10.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "adamchainz";
    repo = pname;
    rev = version;
-    hash = "sha256-mE9unzVh0QXSl93hHH43o8AshDEzrl2NXsBJ2fph5is=";
+    hash = "sha256-4nIKJKZR3H1jaubGTxW1U5pBWTv3lzKiuXgDvGYeUsY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/xknxproject/default.nix
+++ b/pkgs/development/python-modules/xknxproject/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "xknxproject";
-  version = "3.1.1";
+  version = "3.2.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "XKNX";
    repo = "xknxproject";
    rev = "refs/tags/${version}";
-    hash = "sha256-4FZJsw/x7yYPyAc26YTMWMzJuSGC3fkh3PunfUXmEUw=";
+    hash = "sha256-ZLBvhuLXEOgqS7tRwP/e1Dv1/EMqxqXgpAZtLQGIt/o=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/benthos/default.nix
+++ b/pkgs/development/tools/benthos/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "benthos";
-  version = "4.16.0";
+  version = "4.17.0";

  src = fetchFromGitHub {
    owner = "benthosdev";
    repo = "benthos";
    rev = "refs/tags/v${version}";
-    hash = "sha256-3cT+UBbjqCwglcGpAGpyxwD7MW5e/0w/BkSlS8E91vQ=";
+    hash = "sha256-d7HxPfHCNTVTOB4I/9lbiqYAO2srLp7v8v97zXXLKBw=";
  };

  vendorHash = "sha256-1G1KxD+9aEnkaNsqPAVo+M+jslQcX4zZMQiKpN2PLRY=";
--- a/pkgs/development/tools/fastddsgen/default.nix
+++ b/pkgs/development/tools/fastddsgen/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, runtimeShell, writeText, fetchFromGitHub, gradle_7, openjdk17, git, perl, cmake }:
 let
  pname = "fastddsgen";
-  version = "2.4.0";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "eProsima";
    repo = "Fast-DDS-Gen";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-CSlimEShTxjr6II9YSuNFc/pdbMmqVMCQA0ZJ9rl5j8=";
+    hash = "sha256-tnSZ0jyR6iPjyA3vpdZXOza/QI2ro92BOtjKp/NDriM=";
  };

  gradle = gradle_7;
--- a/pkgs/development/tools/gotestfmt/default.nix
+++ b/pkgs/development/tools/gotestfmt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gotestfmt";
-  version = "2.4.1";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "gotesttools";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Rb/nIsHISzvqd+jJU4TNrHbailvgGEq4y0JuM9IdA3w=";
+    hash = "sha256-7mLn2axlHoXau9JtLhk1zwzhxkFGHgYPo7igI+IAsP4=";
  };

  vendorHash = null;
--- a/pkgs/development/tools/misc/ccache/default.nix
+++ b/pkgs/development/tools/misc/ccache/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ccache";
-  version = "4.8.1";
+  version = "4.8.2";

  src = fetchFromGitHub {
    owner = "ccache";
    repo = "ccache";
    rev = "refs/tags/v${finalAttrs.version}";
-    sha256 = "sha256-v0XYIaUKgdCYNSlwLNA3+oBEh6IDo8f5GPNsmYzzYRM=";
+    sha256 = "sha256-wft9T0XzTJhN/85kV+pIAUqTvcIBClbj+nHPQK0ncVE=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@ -6,11 +6,11 @@ else

 stdenv.mkDerivation rec {
  pname = "dune";
-  version = "3.8.1";
+  version = "3.8.2";

  src = fetchurl {
    url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    sha256 = "sha256-lBOl1uudeWigRj3rudnxvnMCU0WAm4J5eNDBTbds+RQ=";
+    sha256 = "sha256-Wm7HkBKGFra0ZhZCf6nI8roNbvWkBb+P28b4LcDZNf0=";
  };

  nativeBuildInputs = [ ocaml findlib ];
--- a/pkgs/development/tools/picotool/default.nix
+++ b/pkgs/development/tools/picotool/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "picotool";
-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchFromGitHub {
    owner = "raspberrypi";
    repo = pname;
    rev = version;
-    sha256 = "sha256-KP5Cq6pYKQI5dV6S4lLapu9EcwAgLgYpK0qreNDZink=";
+    sha256 = "sha256-OcQJeiva6X2rUyh1rJ+w4O2dWxaR7MwMfbHlnWuBVb8=";
  };

  buildInputs = [ libusb1 pico-sdk ];
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-zigbuild";
-  version = "0.16.10";
+  version = "0.16.11";

  src = fetchFromGitHub {
    owner = "messense";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-d7RA6sOM5zHAhM51pBc0ahblVaT/+fzLUPtbGcxIqfA=";
+    sha256 = "sha256-1Y/M/xT4Fwn2xJ1XDI82onz5UcGJsivYTXdESx13ehE=";
  };

-  cargoSha256 = "sha256-Frs4BvD562RUSwyjlmJIihqFTtPjYTdpUlDGXKkg/9U=";
+  cargoSha256 = "sha256-XWNyhwxegy1V+buJz4ffxfF3r2SVcXid8PbKQpljQ2o=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/development/tools/rust/cbindgen/default.nix
+++ b/pkgs/development/tools/rust/cbindgen/default.nix
@ -1,21 +1,29 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, python3Packages, Security }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, cmake
+, python3Packages
+, Security
+}:

 rustPlatform.buildRustPackage rec {
  pname = "rust-cbindgen";
-  version = "0.24.3";
+  version = "0.24.6";

  src = fetchFromGitHub {
-    owner = "eqrion";
+    owner = "mozilla";
    repo = "cbindgen";
    rev = "v${version}";
-    hash = "sha256-v5g6/ul6mJtzC4O4WlNopPtFUSbx2Jv79mZL72mucws=";
+    hash = "sha256-RHh97hwWmjV6hw+fX+fOtixX/DGedTf9cx+PYPW6/wI=";
  };

-  cargoSha256 = "sha256-j3/2cFjSDkx0TXCaxYSCLrBbAHrJfJ6hwBcXlDedwh8=";
+  cargoSha256 = "sha256-7G/16arXYwt7Nrs1isWyrPubm8GMi8NsjLjWAD8x6aM=";

  buildInputs = lib.optional stdenv.isDarwin Security;

  nativeCheckInputs = [
+    cmake
    python3Packages.cython
  ];

@ -34,8 +42,9 @@ rustPlatform.buildRustPackage rec {
  ];

  meta = with lib; {
+    changelog = "https://github.com/mozilla/cbindgen/blob/v${version}/CHANGES";
    description = "A project for generating C bindings from Rust code";
-    homepage = "https://github.com/eqrion/cbindgen";
+    homepage = "https://github.com/mozilla/cbindgen";
    license = licenses.mpl20;
    maintainers = with maintainers; [ hexa ];
  };
--- a/pkgs/development/tools/twitch-cli/application-name.patch
+++ b/pkgs/development/tools/twitch-cli/application-name.patch
@ -0,0 +1,13 @@
+diff --git a/cmd/root.go b/cmd/root.go
+index 3d85c19..cbbe40c 100644
+--- a/cmd/root.go
+++ b/cmd/root.go
+@@ -16,7 +16,7 @@ import (
+ var cfgFile string
+ 
+ var rootCmd = &cobra.Command{
+-	Use:   "twitch",
+	Use:   "twitch-cli",
+ 	Short: "A simple CLI tool for the New Twitch API and Webhook products.",
+ }
+ 
--- a/pkgs/development/tools/twitch-cli/default.nix
+++ b/pkgs/development/tools/twitch-cli/default.nix
@ -0,0 +1,49 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, testers
+, twitch-cli
+}:
+
+buildGoModule rec {
+  pname = "twitch-cli";
+  version = "1.1.19";
+
+  src = fetchFromGitHub {
+    owner = "twitchdev";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-osR7+oQ0QBIk/OrMb4Txhb31zELi+eoM47GsWgF/PAg=";
+  };
+
+  patches = [
+    ./application-name.patch
+  ];
+
+  vendorHash = "sha256-OhcRMXY8s+XciF+gV3cZ8fxtzo9+I76tBPZ0xG8ddHU=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.buildVersion=${version}"
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  __darwinAllowLocalNetworking = true;
+
+  passthru.tests.version = testers.testVersion {
+    package = twitch-cli;
+    command = "HOME=$(mktemp -d) ${pname} version";
+    version = "${pname}/${version}";
+  };
+
+  meta = with lib; {
+    description = "The official Twitch CLI to make developing on Twitch easier";
+    homepage = "https://github.com/twitchdev/twitch-cli";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ benediktbroich ];
+  };
+}
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.1.23";
+  version = "0.1.36";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-ekVqY5rM/CeewZ0wnlSjWusPEQzdeVwIGdfnicMe3k8";
+    hash = "sha256-zB+zmOXkbITm+CFB1dg3ELlrN+VDNy3t56hzCyXp0YU=";
  };

-  vendorHash = "sha256-7KLEfK2eZLEtOHqQxhpdQCeKVfn+rUu3i699Zk06J/U=";
+  vendorHash = "sha256-g4S0zHSNCaOl2kYwaR074KYSBChYWvZVfWBK/nHI9t8=";

  subPackages = [ "." ];

--- a/pkgs/games/jazz2/game.nix
+++ b/pkgs/games/jazz2/game.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "jazz2";
-  version = "1.9.1";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "deathkiller";
    repo = "jazz2-native";
    rev = version;
-    sha256 = "75CGpFEdk+vFrlGC20Ciniw6CHBmP43TsCQmb4r70DI=";
+    sha256 = "IJhMxnOUam6MdT5f0JBThf/sV4WxA++gpBMB2cGqJ14=";
  };

  patches = [ ./nocontent.patch ];
--- a/pkgs/games/osu-lazer/bin.nix
+++ b/pkgs/games/osu-lazer/bin.nix
@ -7,21 +7,21 @@

 let
  pname = "osu-lazer-bin";
-  version = "2023.614.1";
+  version = "2023.617.0";
  name = "${pname}-${version}";

  osu-lazer-bin-src = {
    aarch64-darwin = {
      url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-      sha256 = "sha256-769a4mwBmA2aN03k/1TCXVIxJEwtXk9HRV/vDhTIZt4=";
+      sha256 = "sha256-aO1yd2ha0/Adfm2GDg5atRCucPNZahxXW1Nb6tgnby0=";
    };
    x86_64-darwin = {
      url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-      sha256 = "sha256-mIPTWveiiyPN0P2WEtqnu4cq8hti1hw7RKUQ+YKDAVg=";
+      sha256 = "sha256-lGNcIS3QVrlur2z5cpoAxKK2a3KED9mWjtiCYycosQM=";
    };
    x86_64-linux = {
      url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-      sha256 = "sha256-UVq60UrV8yl2fWizk8smRLQzBtj30oaKSJkgeze7OfE=";
+      sha256 = "sha256-g/jBY7L06PrIHQ/2W52Itr+BkKIXEaYIHzyVMZHcrkk=";
    };
  }.${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported.");

--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@ -17,13 +17,13 @@

 buildDotnetModule rec {
  pname = "osu-lazer";
-  version = "2023.614.1";
+  version = "2023.617.0";

  src = fetchFromGitHub {
    owner = "ppy";
    repo = "osu";
    rev = version;
-    sha256 = "sha256-CL9fEIg8Wt9BTM+hisXl8k9VWWbF/dlT0bOBeVeAoNE=";
+    sha256 = "sha256-Bnbf8H+ThDOQPUIRd27iMtVqZditBxm8E5IZF+q1Cog=";
  };

  projectFile = "osu.Desktop/osu.Desktop.csproj";
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@ -9,13 +9,13 @@

 buildDotnetModule rec {
  pname = "jackett";
-  version = "0.21.128";
+  version = "0.21.241";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha512-22OiSh/jStVsA7ghjM+P+eVkViBFyhzNwhZbEIhWRlmpOaIC3NUSwMTKuZlq5I6J8Zc6gVW6kCOaKZoAWWWYfA==";
+    hash = "sha512-3FFcc6t+6aljVa0sDb+F6cM8FeGsv+rQ70Rgyf1kZaBCqIFoAK23bVB7TYnTR+yBLAhV6v6CDZaZ/rqrh6blqg==";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/servers/jackett/deps.nix
+++ b/pkgs/servers/jackett/deps.nix
@ -175,7 +175,7 @@
  (fetchNuGet { pname = "Newtonsoft.Json"; version = "10.0.1"; sha256 = "15ncqic3p2rzs8q8ppi0irl2miq75kilw4lh8yfgjq96id0ds3hv"; })
  (fetchNuGet { pname = "Newtonsoft.Json"; version = "11.0.2"; sha256 = "1784xi44f4k8v1fr696hsccmwpy94bz7kixxqlri98zhcxn406b2"; })
  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.2"; sha256 = "1p9splg1min274dpz7xdfgzrwkyfd3xlkygwpr1xgjvvyjvs6b0i"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; })
  (fetchNuGet { pname = "Newtonsoft.Json"; version = "9.0.1"; sha256 = "0mcy0i7pnfpqm4pcaiyzzji4g0c8i3a5gjz28rrr28110np8304r"; })
  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.1"; sha256 = "1r1hvj5gjl466bya2bfl5aaj8rbwyf5x1msg710wf3k2llbci1xa"; })
  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.2"; sha256 = "0c27bhy9x3c2n26inq32kmp6drpm71n6mqnmcr19wrlcaihglj35"; })
--- a/pkgs/servers/jicofo/default.nix
+++ b/pkgs/servers/jicofo/default.nix
@ -2,10 +2,10 @@

 let
  pname = "jicofo";
-  version = "1.0-987";
+  version = "1.0-1038";
  src = fetchurl {
    url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "VK4Ck+OU6xv/Lma4YpXduPThej2wopbs+OkBC2SOkJU=";
+    sha256 = "9VO3bKOoHtl/q6gEmwi8Lc4GXgJSyFJ7jxKfaKQ549c=";
  };
 in
 stdenv.mkDerivation {
--- a/pkgs/servers/metabase/default.nix
+++ b/pkgs/servers/metabase/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "metabase";
-  version = "0.46.4";
+  version = "0.46.5";

  src = fetchurl {
    url = "https://downloads.metabase.com/v${version}/metabase.jar";
-    hash = "sha256-sWmX1k581t7Owjt2ksE0xno0q8sDW9WgSLmjjadf5QY=";
+    hash = "sha256-5F8BQ42hun+qUk6/X1dSTlhRGXBEPq9h0IfJHA77OOw=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/servers/misc/gobgpd/default.nix
+++ b/pkgs/servers/misc/gobgpd/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "gobgpd";
-  version = "3.14.0";
+  version = "3.15.0";

  src = fetchFromGitHub {
    owner = "osrg";
    repo = "gobgp";
    rev = "refs/tags/v${version}";
-    hash = "sha256-R64Mm8fWZ8VZgsKcnc+ZqAk0V3L+TkpxTmSkx6+KVs0=";
+    hash = "sha256-s4kZepphr3QMUFpxdJW5exZKfUPVTisFTRN81tZnQUY=";
  };

  vendorHash = "sha256-Z7vYpDQIKc4elVBLiGtxF3D9pec4QNvWFLpux/29t1Y=";
--- a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "artifactory_exporter";
-  version = "1.13.1";
+  version = "1.13.2";
  rev = "v${version}";

  src = fetchFromGitHub {
    owner = "peimanja";
    repo = pname;
    rev = rev;
-    hash = "sha256-TXLIuTY5COHlhyp8xL9X02DbK2ku9AKnW5a4FYdzMic=";
+    hash = "sha256-m5ToXry1LgjWSTU9bjOtsgfVF8wKiKuTwCIC7jNGSKY=";
  };

-  vendorHash = "sha256-Gin134G4NPK8M2E2RrgH62ieiuCw15jwm9SJg03w9ts=";
+  vendorHash = "sha256-ikWxTHmqHFWAReKMf6LFza/bhkcfxa4euXUixKPvcpQ=";

  subPackages = [ "." ];

--- a/pkgs/servers/monitoring/prometheus/exportarr/default.nix
+++ b/pkgs/servers/monitoring/prometheus/exportarr/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "exportarr";
-  version = "1.4.0";
+  version = "1.5.3";

  src = fetchFromGitHub {
    owner = "onedr0p";
    repo = "exportarr";
    rev = "v${version}";
-    hash = "sha256-7ev6twbavAhSZWJZCwjpbEz2STRYifLrPCFyel+Ml5A=";
+    hash = "sha256-pjT4zzYONiHMv0YORHHvsBjBUsFQQ7yKNvUqnvgi2Pk=";
  };

-  vendorHash = "sha256-3JObDCeRjhws6U4DRky7BVEleCmxadLmPnTp8PX6S7A=";
+  vendorHash = "sha256-tSdGWtVHtas+3uvQiZhBreY2hODopZepApOVoFsERws=";

  subPackages = [ "cmd/exportarr" ];

--- a/pkgs/servers/spicedb/default.nix
+++ b/pkgs/servers/spicedb/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "spicedb";
-  version = "1.21.0";
+  version = "1.22.0";

  src = fetchFromGitHub {
    owner = "authzed";
    repo = "spicedb";
    rev = "v${version}";
-    hash = "sha256-d/py2tOvcada7hHmllVtxZ2af6GFioW95+eRTepXG7w=";
+    hash = "sha256-Q8NqWV9s4DrN3lEGkAYYm59HCIo6dIpQQHbzepKao+o=";
  };

-  vendorHash = "sha256-/0EOmnQyD3kOrRmItIgzyK+O7ZOYpUedXdgQjS894uQ=";
+  vendorHash = "sha256-61TnfP62a5bUtBLxDe1FpF28hcPGzyuO5D/JNTqAfx8=";

  subPackages = [ "cmd/spicedb" ];

--- a/pkgs/tools/admin/meshcentral/default.nix
+++ b/pkgs/tools/admin/meshcentral/default.nix
@ -1,11 +1,11 @@
 { lib, fetchpatch, fetchzip, yarn2nix-moretea, nodejs_18, jq, dos2unix }:

 yarn2nix-moretea.mkYarnPackage {
-  version = "1.1.5";
+  version = "1.1.6";

  src = fetchzip {
-    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.5.tgz";
-    sha256 = "1djdqfcmfk35q7hfbdn4rnh4di2lk1gk7icfasjmihrgpnsxrrir";
+    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.6.tgz";
+    sha256 = "03f2jyjrxmmr28949m3niwb437akyp6kg6h1m2jkaxfg5yj4hs4v";
  };

  patches = [ ./fix-js-include-paths.patch ];
--- a/pkgs/tools/admin/meshcentral/package.json
+++ b/pkgs/tools/admin/meshcentral/package.json
@ -1,6 +1,6 @@
 {
  "name": "meshcentral",
-  "version": "1.1.5",
+  "version": "1.1.6",
  "keywords": [
    "Remote Device Management",
    "Remote Device Monitoring",
--- a/pkgs/tools/admin/meshcentral/yarn.lock
+++ b/pkgs/tools/admin/meshcentral/yarn.lock
--- a/pkgs/tools/admin/meshcentral/yarn.nix
+++ b/pkgs/tools/admin/meshcentral/yarn.nix
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "syft";
-  version = "0.83.0";
+  version = "0.83.1";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-H0DBz6HsEML4JXY601pssNtq1q3Z0t00JpVAo1izijM=";
+    hash = "sha256-GZLkz2aadUiSD+v69vLq5BDgn0MSnHVkeGeAFLNDWgM=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -22,7 +22,7 @@ buildGoModule rec {
  };
  # hash mismatch with darwin
  proxyVendor = true;
-  vendorHash = "sha256-7nTbXq6HgD1oBxyQbuAxbiLP8IuXsDQLIoJ1l55ACwA=";
+  vendorHash = "sha256-hv+0qLzGd31CTDGd3STszSUO2BOMRfppyewbJKzGDTg=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/graphics/svg2pdf/default.nix
+++ b/pkgs/tools/graphics/svg2pdf/default.nix
@ -6,14 +6,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "svg2pdf";
-  version = "0.4.1";
+  version = "0.5.0";
  # This cargo package is usually a library, hence it does not track a
  # Cargo.lock by default so we use fetchCrate
  src = fetchCrate {
    inherit version pname;
-    sha256 = "sha256-0sjJIHD+x9P7FPLNwTXYcetbU4Ck5K4pFGF5cMI3+rk=";
+    sha256 = "sha256-4n7aBVjXiVU7O7sOKN5eBrKZNYsKk8eDPdna9o7piJo=";
  };
-  cargoSha256 = "sha256-vjDV604HDwlaxwq5iQbGOKXmLTRgx1oZ824HXBSiouw=";
+  cargoHash = "sha256-5EEZoYvobbNOknwZWn71EDQSNPmYoegHoZW1Or8Xv2c=";
  buildFeatures = [ "cli" ];

  doCheck = true;
--- a/pkgs/tools/misc/asdf-vm/default.nix
+++ b/pkgs/tools/misc/asdf-vm/default.nix
@ -37,13 +37,13 @@ ${asdfReshimFile}
  '';
 in stdenv.mkDerivation rec {
  pname = "asdf-vm";
-  version = "0.11.3";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "asdf-vm";
    repo = "asdf";
    rev = "v${version}";
-    sha256 = "sha256-4y0XamKIZ7kftrsSb87qLizTBO6b2fdAyPauslwzo8c=";
+    sha256 = "sha256-9U8B6KRn27RrMqWXAUTTy+hrOgMv5Ii4YGsOZeX5Bl0=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "strongswan";
-  version = "5.9.10"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
+  version = "5.9.11"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!

  src = fetchFromGitHub {
    owner = "strongswan";
    repo = "strongswan";
    rev = version;
-    hash = "sha256-vYM3RVS6/yDNbY6X8lZT0GK0dczjw8hs3NplFEzq0fg=";
+    hash = "sha256-DjVmDUEEJnf5kaia1f+Yow9g4+l3itOmoXR8/vVSssU=";
  };

  dontPatchELF = true;
--- a/pkgs/tools/security/firefox_decrypt/default.nix
+++ b/pkgs/tools/security/firefox_decrypt/default.nix
@ -1,40 +1,30 @@
 { lib
 , fetchFromGitHub
-, stdenvNoCC
+, buildPythonApplication
+, setuptools
 , nss
-, wrapPython
 , nix-update-script
 }:

-stdenvNoCC.mkDerivation rec {
+buildPythonApplication rec {
  pname = "firefox_decrypt";
-  version = "unstable-2022-12-21";
+  version = "unstable-2023-05-14";
+
+  format = "pyproject";

  src = fetchFromGitHub {
    owner = "unode";
    repo = pname;
-    rev = "84bb368cc2f8d2055a8374ab1a40c403e0486859";
-    sha256 = "sha256-dyQTf6fgsQEmp++DeXl85nvyezm0Lq9onyfIdhQoGgI=";
+    rev = "ac857efde75d86dd6bd5dfca25d4a0f73b75009f";
+    sha256 = "sha256-34QS98nmrL98nzoZgeFSng8TJJc9BU1+Tzh2b+dsuCc=";
  };

-  nativeBuildInputs = [ wrapPython ];
-
-  buildInputs = [ nss ];
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm 0755 firefox_decrypt.py "$out/bin/firefox_decrypt"
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [
+    setuptools
+  ];

  makeWrapperArgs = [ "--prefix" "LD_LIBRARY_PATH" ":" (lib.makeLibraryPath [ nss ]) ];

-  postFixup = ''
-    wrapPythonPrograms
-  '';
-
  passthru.updateScript = nix-update-script {
    extraArgs = [ "--version=branch" ];
  };
--- a/pkgs/tools/security/mx-takeover/default.nix
+++ b/pkgs/tools/security/mx-takeover/default.nix
@ -0,0 +1,31 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "mx-takeover";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "musana";
+    repo = "mx-takeover";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-yDQd2FEVFFsUu3wKxp26VDhGjnuXmAtxpWoKjV6ZrHA=";
+  };
+
+  vendorHash = "sha256-mJ8pVsgRM6lhEa8jtCxFhavkf7XFlBqEN9l1r0/GTvM=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = with lib; {
+    description = "Tool to work with DNS MX records";
+    homepage = "https://github.com/musana/mx-takeover";
+    changelog = "https://github.com/musana/mx-takeover/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/Show More
+++ b/Show More