Merge master into haskell-updates

doc/default.nix

@@ -23,6 +23,7 @@ let
       { name = "sources"; description = "source filtering functions"; }
       { name = "cli"; description = "command-line serialization functions"; }
       { name = "gvariant"; description = "GVariant formatted string serialization functions"; }
+      { name = "customisation"; description = "Functions to customise (derivation-related) functions, derivatons, or attribute sets"; }
     ];
   };
 

lib/customisation.nix

@@ -13,16 +13,7 @@ rec {
      scenarios (e.g. in ~/.config/nixpkgs/config.nix).  For instance,
      if you want to "patch" the derivation returned by a package
      function in Nixpkgs to build another version than what the
-     function itself provides, you can do something like this:
-
-       mySed = overrideDerivation pkgs.gnused (oldAttrs: {
-         name = "sed-4.2.2-pre";
-         src = fetchurl {
-           url = ftp://alpha.gnu.org/gnu/sed/sed-4.2.2-pre.tar.bz2;
-           hash = "sha256-MxBJRcM2rYzQYwJ5XKxhXTQByvSg5jZc5cSHEZoB2IY=";
-         };
-         patches = [];
-       });
+     function itself provides.
 
      For another application, see build-support/vm, where this
      function is used to build arbitrary derivations inside a QEMU
@@ -35,6 +26,19 @@ rec {
 
      You should in general prefer `drv.overrideAttrs` over this function;
      see the nixpkgs manual for more information on overriding.
+
+     Example:
+       mySed = overrideDerivation pkgs.gnused (oldAttrs: {
+         name = "sed-4.2.2-pre";
+         src = fetchurl {
+           url = ftp://alpha.gnu.org/gnu/sed/sed-4.2.2-pre.tar.bz2;
+           hash = "sha256-MxBJRcM2rYzQYwJ5XKxhXTQByvSg5jZc5cSHEZoB2IY=";
+         };
+         patches = [];
+       });
+
+     Type:
+       overrideDerivation :: Derivation -> ( Derivation -> AttrSet ) -> Derivation
   */
   overrideDerivation = drv: f:
     let
@@ -55,6 +59,10 @@ rec {
      injects `override` attribute which can be used to override arguments of
      the function.
 
+     Please refer to  documentation on [`<pkg>.overrideDerivation`](#sec-pkg-overrideDerivation) to learn about `overrideDerivation` and caveats
+     related to its use.
+
+     Example:
        nix-repl> x = {a, b}: { result = a + b; }
 
        nix-repl> y = lib.makeOverridable x { a = 1; b = 2; }
@@ -65,9 +73,8 @@ rec {
        nix-repl> y.override { a = 10; }
        { override = «lambda»; overrideDerivation = «lambda»; result = 12; }
 
-     Please refer to "Nixpkgs Contributors Guide" section
-     "<pkg>.overrideDerivation" to learn about `overrideDerivation` and caveats
-     related to its use.
+     Type:
+       makeOverridable :: (AttrSet -> a) -> AttrSet -> a
   */
   makeOverridable = f: lib.setFunctionArgs
     (origArgs: let
@@ -105,20 +112,29 @@ rec {
     `autoArgs`.  This function is intended to be partially
     parameterised, e.g.,
 
+      ```nix
       callPackage = callPackageWith pkgs;
       pkgs = {
         libfoo = callPackage ./foo.nix { };
         libbar = callPackage ./bar.nix { };
       };
+      ```
 
     If the `libbar` function expects an argument named `libfoo`, it is
     automatically passed as an argument.  Overrides or missing
     arguments can be supplied in `args`, e.g.
 
+      ```nix
       libbar = callPackage ./bar.nix {
         libfoo = null;
         enableX11 = true;
       };
+      ```
+
+    <!-- TODO: Apply "Example:" tag to the examples above -->
+
+    Type:
+      callPackageWith :: AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a
   */
   callPackageWith = autoArgs: fn: args:
     let
@@ -129,7 +145,7 @@ rec {
       # This includes automatic ones and ones passed explicitly
       allArgs = builtins.intersectAttrs fargs autoArgs // args;
 
-      # A list of argument names that the function requires, but
+      # a list of argument names that the function requires, but
       # wouldn't be passed to it
       missingArgs = lib.attrNames
         # Filter out arguments that have a default value
@@ -176,7 +192,11 @@ rec {
 
   /* Like callPackage, but for a function that returns an attribute
      set of derivations. The override function is added to the
-     individual attributes. */
+     individual attributes.
+
+     Type:
+       callPackagesWith :: AttrSet -> ((AttrSet -> AttrSet) | Path) -> AttrSet -> AttrSet
+  */
   callPackagesWith = autoArgs: fn: args:
     let
       f = if lib.isFunction fn then fn else import fn;
@@ -193,7 +213,11 @@ rec {
 
 
   /* Add attributes to each output of a derivation without changing
-     the derivation itself and check a given condition when evaluating. */
+     the derivation itself and check a given condition when evaluating.
+
+     Type:
+       extendDerivation :: Bool -> Any -> Derivation -> Derivation
+  */
   extendDerivation = condition: passthru: drv:
     let
       outputs = drv.outputs or [ "out" ];
@@ -227,7 +251,11 @@ rec {
   /* Strip a derivation of all non-essential attributes, returning
      only those needed by hydra-eval-jobs. Also strictly evaluate the
      result to ensure that there are no thunks kept alive to prevent
-     garbage collection. */
+     garbage collection.
+
+     Type:
+       hydraJob :: (Derivation | Null) -> (Derivation | Null)
+  */
   hydraJob = drv:
     let
       outputs = drv.outputs or ["out"];
@@ -265,7 +293,11 @@ rec {
      called with the overridden packages. The package sets may be
      hierarchical: the packages in the set are called with the scope
      provided by `newScope` and the set provides a `newScope` attribute
-     which can form the parent scope for later package sets. */
+     which can form the parent scope for later package sets.
+
+     Type:
+       makeScope :: (AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a) -> (AttrSet -> AttrSet) -> AttrSet
+  */
   makeScope = newScope: f:
     let self = f self // {
           newScope = scope: newScope (self // scope);
@@ -287,7 +319,25 @@ rec {
     { inherit otherSplices keep extra f; };
 
   /* Like makeScope, but aims to support cross compilation. It's still ugly, but
-     hopefully it helps a little bit. */
+     hopefully it helps a little bit.
+
+     Type:
+       makeScopeWithSplicing' ::
+         { splicePackages :: Splice -> AttrSet
+         , newScope :: AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a
+         }
+         -> { otherSplices :: Splice, keep :: AttrSet -> AttrSet, extra :: AttrSet -> AttrSet }
+         -> AttrSet
+
+       Splice ::
+         { pkgsBuildBuild :: AttrSet
+         , pkgsBuildHost :: AttrSet
+         , pkgsBuildTarget :: AttrSet
+         , pkgsHostHost :: AttrSet
+         , pkgsHostTarget :: AttrSet
+         , pkgsTargetTarget :: AttrSet
+         }
+  */
   makeScopeWithSplicing' =
     { splicePackages
     , newScope

lib/fileset/default.nix

@@ -6,6 +6,7 @@ let
     _coerceMany
     _toSourceFilter
     _unionMany
+    _fileFilter
     _printFileset
     _intersection
     ;
@@ -41,6 +42,7 @@ let
     ;
 
   inherit (lib.trivial)
+    isFunction
     pipe
     ;
 
@@ -278,6 +280,55 @@ If a directory does not recursively contain any file, it is omitted from the sto
         _unionMany
       ];
 
+  /*
+    Filter a file set to only contain files matching some predicate.
+
+    Type:
+      fileFilter ::
+        ({
+          name :: String,
+          type :: String,
+          ...
+        } -> Bool)
+        -> FileSet
+        -> FileSet
+
+    Example:
+      # Include all regular `default.nix` files in the current directory
+      fileFilter (file: file.name == "default.nix") ./.
+
+      # Include all non-Nix files from the current directory
+      fileFilter (file: ! hasSuffix ".nix" file.name) ./.
+
+      # Include all files that start with a "." in the current directory
+      fileFilter (file: hasPrefix "." file.name) ./.
+
+      # Include all regular files (not symlinks or others) in the current directory
+      fileFilter (file: file.type == "regular")
+  */
+  fileFilter =
+    /*
+      The predicate function to call on all files contained in given file set.
+      A file is included in the resulting file set if this function returns true for it.
+
+      This function is called with an attribute set containing these attributes:
+
+      - `name` (String): The name of the file
+
+      - `type` (String, one of `"regular"`, `"symlink"` or `"unknown"`): The type of the file.
+        This matches result of calling [`builtins.readFileType`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-readFileType) on the file's path.
+
+      Other attributes may be added in the future.
+    */
+    predicate:
+    # The file set to filter based on the predicate function
+    fileset:
+    if ! isFunction predicate then
+      throw "lib.fileset.fileFilter: Expected the first argument to be a function, but it's a ${typeOf predicate} instead."
+    else
+      _fileFilter predicate
+        (_coerce "lib.fileset.fileFilter: second argument" fileset);
+
   /*
     The file set containing all files that are in both of two given file sets.
     See also [Intersection (set theory)](https://en.wikipedia.org/wiki/Intersection_(set_theory)).

lib/fileset/internal.nix

@@ -638,4 +638,30 @@ rec {
     else
       # In all other cases it's the rhs
       rhs;
+
+  _fileFilter = predicate: fileset:
+    let
+      recurse = path: tree:
+        mapAttrs (name: subtree:
+          if isAttrs subtree || subtree == "directory" then
+            recurse (path + "/${name}") subtree
+          else if
+            predicate {
+              inherit name;
+              type = subtree;
+              # To ensure forwards compatibility with more arguments being added in the future,
+              # adding an attribute which can't be deconstructed :)
+              "lib.fileset.fileFilter: The predicate function passed as the first argument must be able to handle extra attributes for future compatibility. If you're using `{ name, file }:`, use `{ name, file, ... }:` instead." = null;
+            }
+          then
+            subtree
+          else
+            null
+        ) (_directoryEntries path tree);
+    in
+    if fileset._internalIsEmptyWithoutBase then
+      _emptyWithoutBase
+    else
+      _create fileset._internalBase
+        (recurse fileset._internalBase fileset._internalTree);
 }

lib/fileset/tests.sh

@@ -678,6 +678,73 @@ tree=(
 checkFileset 'intersection (unions [ ./a/b ./c/d ./c/e ]) (unions [ ./a ./c/d/f ./c/e ])'
 
 
+## File filter
+
+# The predicate is not called when there's no files
+tree=()
+checkFileset 'fileFilter (file: abort "this is not needed") ./.'
+checkFileset 'fileFilter (file: abort "this is not needed") _emptyWithoutBase'
+
+# The predicate must be able to handle extra attributes
+touch a
+expectFailure 'toSource { root = ./.; fileset = fileFilter ({ name, type }: true) ./.; }' 'called with unexpected argument '\''"lib.fileset.fileFilter: The predicate function passed as the first argument must be able to handle extra attributes for future compatibility. If you'\''re using `\{ name, file \}:`, use `\{ name, file, ... \}:` instead."'\'
+rm -rf -- *
+
+# .name is the name, and it works correctly, even recursively
+tree=(
+    [a]=1
+    [b]=0
+    [c/a]=1
+    [c/b]=0
+    [d/c/a]=1
+    [d/c/b]=0
+)
+checkFileset 'fileFilter (file: file.name == "a") ./.'
+tree=(
+    [a]=0
+    [b]=1
+    [c/a]=0
+    [c/b]=1
+    [d/c/a]=0
+    [d/c/b]=1
+)
+checkFileset 'fileFilter (file: file.name != "a") ./.'
+
+# `.type` is the file type
+mkdir d
+touch d/a
+ln -s d/b d/b
+mkfifo d/c
+expectEqual \
+    'toSource { root = ./.; fileset = fileFilter (file: file.type == "regular") ./.; }' \
+    'toSource { root = ./.; fileset = ./d/a; }'
+expectEqual \
+    'toSource { root = ./.; fileset = fileFilter (file: file.type == "symlink") ./.; }' \
+    'toSource { root = ./.; fileset = ./d/b; }'
+expectEqual \
+    'toSource { root = ./.; fileset = fileFilter (file: file.type == "unknown") ./.; }' \
+    'toSource { root = ./.; fileset = ./d/c; }'
+expectEqual \
+    'toSource { root = ./.; fileset = fileFilter (file: file.type != "regular") ./.; }' \
+    'toSource { root = ./.; fileset = union ./d/b ./d/c; }'
+expectEqual \
+    'toSource { root = ./.; fileset = fileFilter (file: file.type != "symlink") ./.; }' \
+    'toSource { root = ./.; fileset = union ./d/a ./d/c; }'
+expectEqual \
+    'toSource { root = ./.; fileset = fileFilter (file: file.type != "unknown") ./.; }' \
+    'toSource { root = ./.; fileset = union ./d/a ./d/b; }'
+rm -rf -- *
+
+# It's lazy
+tree=(
+    [b]=1
+    [c/a]=1
+)
+# Note that union evaluates the first argument first if necessary, that's why we can use ./c/a here
+checkFileset 'union ./c/a (fileFilter (file: assert file.name != "a"; true) ./.)'
+# but here we need to use ./c
+checkFileset 'union (fileFilter (file: assert file.name != "a"; true) ./.) ./c'
+
 ## Tracing
 
 # The second trace argument is returned

maintainers/team-list.nix

@@ -407,7 +407,6 @@ with lib.maintainers; {
   home-assistant = {
     members = [
       fab
-      globin
       hexa
       mic92
     ];
@@ -742,7 +741,6 @@ with lib.maintainers; {
       aanderse
       drupol
       etu
-      globin
       ma27
       talyz
     ];

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -107,6 +107,8 @@
 
 - [NNCP](http://www.nncpgo.org/). Added nncp-daemon and nncp-caller services. Configuration is set with [programs.nncp.settings](#opt-programs.nncp.settings) and the daemons are enabled at [services.nncp](#opt-services.nncp.caller.enable).
 
+- [FastNetMon Advanced](https://fastnetmon.com/product-overview/), a commercial high performance DDoS detector / sensor. Available as [services.fastnetmon-advanced](#opt-services.fastnetmon-advanced.enable).
+
 - [tuxedo-rs](https://github.com/AaronErhardt/tuxedo-rs), Rust utilities for interacting with hardware from TUXEDO Computers.
 
 - [audiobookshelf](https://github.com/advplyr/audiobookshelf/), a self-hosted audiobook and podcast server. Available as [services.audiobookshelf](#opt-services.audiobookshelf.enable).
@@ -363,6 +365,8 @@
 
 - `services.outline` can now be configured to use local filesystem storage instead of S3 storage using [services.outline.storage.storageType](#opt-services.outline.storage.storageType).
 
+- `paperwork` was updated to version 2.2. Documents scanned with this version will not be visible to previous versions if you downgrade. See the [upstream announcement](https://forum.openpaper.work/t/paperwork-2-2-testing-phase/316#important-switch-from-jpeg-to-png-for-new-pages-2) for details and workarounds.
+
 - `buildGoModule` `go-modules` attrs have been renamed to `goModules`.
 
 - The `fonts.fonts` and `fonts.enableDefaultFonts` options have been renamed to `fonts.packages` and `fonts.enableDefaultPackages` respectively.

nixos/lib/qemu-common.nix

@@ -40,6 +40,7 @@ rec {
       otherHostGuestMatrix = {
         aarch64-darwin = {
           aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -machine virt,gic-version=2,accel=hvf:tcg -cpu max";
+          inherit (otherHostGuestMatrix.x86_64-darwin) x86_64-linux;
         };
         x86_64-darwin = {
           x86_64-linux = "${qemuPkg}/bin/qemu-system-x86_64 -machine type=q35,accel=hvf:tcg -cpu max";

nixos/modules/hardware/video/nvidia.nix

@@ -269,9 +269,9 @@ in {
         services.udev.extraRules =
         ''
           # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
-          KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 255'"
-          KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'for i in $$(cat /proc/driver/nvidia/gpus/*/information | grep Minor | cut -d \  -f 4); do mknod -m 666 /dev/nvidia$${i} c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) $${i}; done'"
-          KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 254'"
+          KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c 195 255'"
+          KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'for i in $$(cat /proc/driver/nvidia/gpus/*/information | grep Minor | cut -d \  -f 4); do mknod -m 666 /dev/nvidia$${i} c 195 $${i}; done'"
+          KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c 195 254'"
           KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
           KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 1'"
         '';

nixos/modules/module-list.nix

@@ -907,6 +907,7 @@
   ./services/networking/eternal-terminal.nix
   ./services/networking/expressvpn.nix
   ./services/networking/fakeroute.nix
+  ./services/networking/fastnetmon-advanced.nix
   ./services/networking/ferm.nix
   ./services/networking/firefox-syncserver.nix
   ./services/networking/fireqos.nix

nixos/modules/services/misc/forgejo.nix

@@ -632,6 +632,8 @@ in
       };
     };
 
+    services.openssh.settings.AcceptEnv = mkIf (!cfg.settings.START_SSH_SERVER or false) "GIT_PROTOCOL";
+
     users.users = mkIf (cfg.user == "forgejo") {
       forgejo = {
         home = cfg.stateDir;

nixos/modules/services/networking/fastnetmon-advanced.nix

@@ -0,0 +1,222 @@
+{ config, lib, pkgs, ... }:
+
+let
+  # Background information: FastNetMon requires a MongoDB to start. This is because
+  # it uses MongoDB to store its configuration. That is, in a normal setup there is
+  # one collection with one document.
+  # To provide declarative configuration in our NixOS module, this database is
+  # completely emptied and replaced on each boot by the fastnetmon-setup service
+  # using the configuration backup functionality.
+
+  cfg = config.services.fastnetmon-advanced;
+  settingsFormat = pkgs.formats.yaml { };
+
+  # obtain the default configs by starting up ferretdb and fcli in a derivation
+  default_configs = pkgs.runCommand "default-configs" {
+    nativeBuildInputs = [
+      pkgs.ferretdb
+      pkgs.fastnetmon-advanced # for fcli
+      pkgs.proot
+    ];
+  } ''
+    mkdir ferretdb fastnetmon $out
+    FERRETDB_TELEMETRY="disable" FERRETDB_HANDLER="sqlite" FERRETDB_STATE_DIR="$PWD/ferretdb" FERRETDB_SQLITE_URL="file:$PWD/ferretdb/" ferretdb &
+
+    cat << EOF > fastnetmon/fastnetmon.conf
+    ${builtins.toJSON {
+      mongodb_username = "";
+    }}
+    EOF
+    proot -b fastnetmon:/etc/fastnetmon -0 fcli create_configuration
+    proot -b fastnetmon:/etc/fastnetmon -0 fcli set bgp default
+    proot -b fastnetmon:/etc/fastnetmon -0 fcli export_configuration backup.tar
+    tar -C $out --no-same-owner -xvf backup.tar
+  '';
+
+  # merge the user configs into the default configs
+  config_tar = pkgs.runCommand "fastnetmon-config.tar" {
+    nativeBuildInputs = with pkgs; [ jq ];
+  } ''
+    jq -s add ${default_configs}/main.json ${pkgs.writeText "main-add.json" (builtins.toJSON cfg.settings)} > main.json
+    mkdir hostgroup
+    ${lib.concatImapStringsSep "\n" (pos: hostgroup: ''
+      jq -s add ${default_configs}/hostgroup/0.json ${pkgs.writeText "hostgroup-${toString (pos - 1)}-add.json" (builtins.toJSON hostgroup)} > hostgroup/${toString (pos - 1)}.json
+    '') hostgroups}
+    mkdir bgp
+    ${lib.concatImapStringsSep "\n" (pos: bgp: ''
+      jq -s add ${default_configs}/bgp/0.json ${pkgs.writeText "bgp-${toString (pos - 1)}-add.json" (builtins.toJSON bgp)} > bgp/${toString (pos - 1)}.json
+    '') bgpPeers}
+    tar -cf $out main.json ${lib.concatImapStringsSep " " (pos: _: "hostgroup/${toString (pos - 1)}.json") hostgroups} ${lib.concatImapStringsSep " " (pos: _: "bgp/${toString (pos - 1)}.json") bgpPeers}
+  '';
+
+  hostgroups = lib.mapAttrsToList (name: hostgroup: { inherit name; } // hostgroup) cfg.hostgroups;
+  bgpPeers = lib.mapAttrsToList (name: bgpPeer: { inherit name; } // bgpPeer) cfg.bgpPeers;
+
+in {
+  options.services.fastnetmon-advanced = with lib; {
+    enable = mkEnableOption "the fastnetmon-advanced DDoS Protection daemon";
+
+    settings = mkOption {
+      description = ''
+        Extra configuration options to declaratively load into FastNetMon Advanced.
+
+        See the [FastNetMon Advanced Configuration options reference](https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-configuration-options/) for more details.
+      '';
+      type = settingsFormat.type;
+      default = {};
+      example = literalExpression ''
+        {
+          networks_list = [ "192.0.2.0/24" ];
+          gobgp = true;
+          gobgp_flow_spec_announces = true;
+        }
+      '';
+    };
+    hostgroups = mkOption {
+      description = "Hostgroups to declaratively load into FastNetMon Advanced";
+      type = types.attrsOf settingsFormat.type;
+      default = {};
+    };
+    bgpPeers = mkOption {
+      description = "BGP Peers to declaratively load into FastNetMon Advanced";
+      type = types.attrsOf settingsFormat.type;
+      default = {};
+    };
+
+    enableAdvancedTrafficPersistence = mkOption {
+      description = "Store historical flow data in clickhouse";
+      type = types.bool;
+      default = false;
+    };
+
+    traffic_db.settings = mkOption {
+      type = settingsFormat.type;
+      description = "Additional settings for /etc/fastnetmon/traffic_db.conf";
+    };
+  };
+
+  config = lib.mkMerge [ (lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      fastnetmon-advanced # for fcli
+    ];
+
+    environment.etc."fastnetmon/license.lic".source = "/var/lib/fastnetmon/license.lic";
+    environment.etc."fastnetmon/gobgpd.conf".source = "/run/fastnetmon/gobgpd.conf";
+    environment.etc."fastnetmon/fastnetmon.conf".source = pkgs.writeText "fastnetmon.conf" (builtins.toJSON {
+      mongodb_username = "";
+    });
+
+    services.ferretdb.enable = true;
+
+    systemd.services.fastnetmon-setup = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "ferretdb.service" ];
+      path = with pkgs; [ fastnetmon-advanced config.systemd.package ];
+      script = ''
+        fcli create_configuration
+        fcli delete hostgroup global
+        fcli import_configuration ${config_tar}
+        systemctl --no-block try-restart fastnetmon
+      '';
+      serviceConfig.Type = "oneshot";
+    };
+
+    systemd.services.fastnetmon = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "ferretdb.service" "fastnetmon-setup.service" "polkit.service" ];
+      path = with pkgs; [ iproute2 ];
+      unitConfig = {
+        # Disable logic which shuts service when we do too many restarts
+        # We do restarts from sudo fcli commit and it's expected that we may have many restarts
+        # Details: https://github.com/systemd/systemd/issues/2416
+        StartLimitInterval = 0;
+      };
+      serviceConfig = {
+        ExecStart = "${pkgs.fastnetmon-advanced}/bin/fastnetmon --log_to_console";
+
+        LimitNOFILE = 65535;
+        # Restart service when it fails due to any reasons, we need to keep processing traffic no matter what happened
+        Restart= "on-failure";
+        RestartSec= "5s";
+
+        DynamicUser = true;
+        CacheDirectory = "fastnetmon";
+        RuntimeDirectory = "fastnetmon"; # for gobgpd config
+        StateDirectory = "fastnetmon"; # for license file
+      };
+    };
+
+    security.polkit.enable = true;
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        if (action.id == "org.freedesktop.systemd1.manage-units" &&
+          subject.isInGroup("fastnetmon")) {
+          if (action.lookup("unit") == "gobgp.service") {
+            var verb = action.lookup("verb");
+            if (verb == "start" || verb == "stop" || verb == "restart") {
+              return polkit.Result.YES;
+            }
+          }
+        }
+      });
+    '';
+
+    # We don't use the existing gobgp NixOS module and package, because the gobgp
+    # version might not be compatible with fastnetmon. Also, the service name
+    # _must_ be 'gobgp' and not 'gobgpd', so that fastnetmon can reload the config.
+    systemd.services.gobgp = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      description = "GoBGP Routing Daemon";
+      unitConfig = {
+        ConditionPathExists = "/run/fastnetmon/gobgpd.conf";
+      };
+      serviceConfig = {
+        Type = "notify";
+        ExecStartPre = "${pkgs.fastnetmon-advanced}/bin/fnm-gobgpd -f /run/fastnetmon/gobgpd.conf -d";
+        SupplementaryGroups = [ "fastnetmon" ];
+        ExecStart = "${pkgs.fastnetmon-advanced}/bin/fnm-gobgpd -f /run/fastnetmon/gobgpd.conf --sdnotify";
+        ExecReload = "${pkgs.fastnetmon-advanced}/bin/fnm-gobgpd -r";
+        DynamicUser = true;
+        AmbientCapabilities = "cap_net_bind_service";
+      };
+    };
+  })
+
+  (lib.mkIf (cfg.enable && cfg.enableAdvancedTrafficPersistence) {
+    ## Advanced Traffic persistence
+    ## https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-traffic-persistency/
+
+    services.clickhouse.enable = true;
+
+    services.fastnetmon-advanced.settings.traffic_db = true;
+
+    services.fastnetmon-advanced.traffic_db.settings = {
+      clickhouse_batch_size = lib.mkDefault 1000;
+      clickhouse_batch_delay = lib.mkDefault 1;
+      traffic_db_host = lib.mkDefault "127.0.0.1";
+      traffic_db_port = lib.mkDefault 8100;
+      clickhouse_host = lib.mkDefault "127.0.0.1";
+      clickhouse_port = lib.mkDefault 9000;
+      clickhouse_user = lib.mkDefault "default";
+      clickhouse_password = lib.mkDefault "";
+    };
+    environment.etc."fastnetmon/traffic_db.conf".text = builtins.toJSON cfg.traffic_db.settings;
+
+    systemd.services.traffic_db = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.fastnetmon-advanced}/bin/traffic_db";
+        # Restart service when it fails due to any reasons, we need to keep processing traffic no matter what happened
+        Restart= "on-failure";
+        RestartSec= "5s";
+
+        DynamicUser = true;
+      };
+    };
+
+  }) ];
+
+  meta.maintainers = lib.teams.wdz.members;
+}

nixos/modules/services/networking/wpa_supplicant.nix

@@ -530,5 +530,5 @@ in {
     '';
   };
 
-  meta.maintainers = with lib.maintainers; [ globin rnhmjoj ];
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
 }

nixos/modules/services/web-apps/akkoma.nix

@@ -282,11 +282,11 @@ let
         AKKOMA_CONFIG_PATH="$RUNTIME_DIRECTORY/config.exs" \
         ERL_EPMD_ADDRESS="${cfg.dist.address}" \
         ERL_EPMD_PORT="${toString cfg.dist.epmdPort}" \
-        ERL_FLAGS="${concatStringsSep " " [
-          "-kernel inet_dist_use_interface '${erlAddr cfg.dist.address}'"
-          "-kernel inet_dist_listen_min ${toString cfg.dist.portMin}"
-          "-kernel inet_dist_listen_max ${toString cfg.dist.portMax}"
-        ]}" \
+        ERL_FLAGS=${lib.escapeShellArg (lib.escapeShellArgs ([
+          "-kernel" "inet_dist_use_interface" (erlAddr cfg.dist.address)
+          "-kernel" "inet_dist_listen_min" (toString cfg.dist.portMin)
+          "-kernel" "inet_dist_listen_max" (toString cfg.dist.portMax)
+        ] ++ cfg.dist.extraFlags))} \
         RELEASE_COOKIE="$(<"$RUNTIME_DIRECTORY/cookie")" \
         RELEASE_NAME="akkoma" \
           exec "${cfg.package}/bin/$(basename "$0")" "$@"
@@ -553,6 +553,13 @@ in {
           description = mdDoc "TCP port to bind Erlang Port Mapper Daemon to.";
         };
 
+        extraFlags = mkOption {
+          type = with types; listOf str;
+          default = [ ];
+          description = mdDoc "Extra flags to pass to Erlang";
+          example = [ "+sbwt" "none" "+sbwtdcpu" "none" "+sbwtdio" "none" ];
+        };
+
         portMin = mkOption {
           type = types.port;
           default = 49152;

nixos/modules/virtualisation/qemu-vm.nix

@@ -690,8 +690,8 @@ in
       package =
         mkOption {
           type = types.package;
-          default = hostPkgs.qemu_kvm;
-          defaultText = literalExpression "config.virtualisation.host.pkgs.qemu_kvm";
+          default = if hostPkgs.stdenv.hostPlatform.qemuArch == pkgs.stdenv.hostPlatform.qemuArch then hostPkgs.qemu_kvm else hostPkgs.qemu;
+          defaultText = literalExpression "if hostPkgs.stdenv.hostPlatform.qemuArch == pkgs.stdenv.hostPlatform.qemuArch then config.virtualisation.host.pkgs.qemu_kvm else config.virtualisation.host.pkgs.qemu";
           example = literalExpression "pkgs.qemu_test";
           description = lib.mdDoc "QEMU package to use.";
         };

nixos/release-combined.nix

@@ -97,7 +97,6 @@ in rec {
         (onSystems ["x86_64-linux"] "nixos.tests.installer.simpleUefiSystemdBoot")
         (onSystems ["x86_64-linux"] "nixos.tests.installer.simple")
         (onSystems ["x86_64-linux"] "nixos.tests.installer.swraid")
-        (onSystems ["x86_64-linux"] "nixos.tests.nixos-rebuild-install-bootloader")
         (onSystems ["x86_64-linux"] "nixos.tests.nixos-rebuild-specialisations")
         (onFullSupported "nixos.tests.ipv6")
         (onFullSupported "nixos.tests.keymap.azerty")

nixos/tests/all-tests.nix

@@ -248,6 +248,7 @@ in {
   ec2-nixops = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-nixops or {};
   ecryptfs = handleTest ./ecryptfs.nix {};
   fscrypt = handleTest ./fscrypt.nix {};
+  fastnetmon-advanced = runTest ./fastnetmon-advanced.nix;
   ejabberd = handleTest ./xmpp/ejabberd.nix {};
   elk = handleTestOn ["x86_64-linux"] ./elk.nix {};
   emacs-daemon = handleTest ./emacs-daemon.nix {};

nixos/tests/fastnetmon-advanced.nix

@@ -0,0 +1,65 @@
+{ pkgs, lib, ... }:
+
+{
+  name = "fastnetmon-advanced";
+  meta.maintainers = lib.teams.wdz.members;
+
+  nodes = {
+    bird = { ... }: {
+      networking.firewall.allowedTCPPorts = [ 179 ];
+      services.bird2 = {
+        enable = true;
+        config = ''
+          router id 192.168.1.1;
+
+          protocol bgp fnm {
+            local 192.168.1.1 as 64513;
+            neighbor 192.168.1.2 as 64514;
+            multihop;
+            ipv4 {
+              import all;
+              export none;
+            };
+          }
+        '';
+      };
+    };
+    fnm = { ... }: {
+      networking.firewall.allowedTCPPorts = [ 179 ];
+      services.fastnetmon-advanced = {
+        enable = true;
+        settings = {
+          networks_list = [ "172.23.42.0/24" ];
+          gobgp = true;
+          gobgp_flow_spec_announces = true;
+        };
+        bgpPeers = {
+          bird = {
+            local_asn = 64514;
+            remote_asn = 64513;
+            local_address = "192.168.1.2";
+            remote_address = "192.168.1.1";
+
+            description = "Bird";
+            ipv4_unicast = true;
+            multihop = true;
+            active = true;
+          };
+        };
+      };
+    };
+  };
+
+  testScript = { nodes, ... }: ''
+    start_all()
+    fnm.wait_for_unit("fastnetmon.service")
+    bird.wait_for_unit("bird2.service")
+
+    fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "BGP daemon restarted correctly"')
+    fnm.wait_until_succeeds("journalctl -eu gobgp.service | grep BGP_FSM_OPENCONFIRM")
+    bird.wait_until_succeeds("birdc show protocol fnm | grep Estab")
+    fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "API server listening"')
+    fnm.succeed("fcli set blackhole 172.23.42.123")
+    bird.succeed("birdc show route | grep 172.23.42.123")
+  '';
+}

nixos/tests/forgejo.nix

@@ -37,7 +37,7 @@ let
           settings."repository.signing".SIGNING_KEY = signingPrivateKeyId;
           settings.actions.ENABLED = true;
         };
-        environment.systemPackages = [ config.services.forgejo.package pkgs.gnupg pkgs.jq ];
+        environment.systemPackages = [ config.services.forgejo.package pkgs.gnupg pkgs.jq pkgs.file ];
         services.openssh.enable = true;
 
         specialisation.runner = {
@@ -53,6 +53,14 @@ let
             tokenFile = "/var/lib/forgejo/runner_token";
           };
         };
+        specialisation.dump = {
+          inheritParentConfig = true;
+          configuration.services.forgejo.dump = {
+            enable = true;
+            type = "tar.zst";
+            file = "dump.tar.zst";
+          };
+        };
       };
       client1 = { config, pkgs, ... }: {
         environment.systemPackages = [ pkgs.git ];
@@ -66,8 +74,10 @@ let
       let
         inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
         serverSystem = nodes.server.system.build.toplevel;
+        dumpFile = with nodes.server.specialisation.dump.configuration.services.forgejo.dump; "${backupDir}/${file}";
       in
       ''
+        import json
         GIT_SSH_COMMAND = "ssh -i $HOME/.ssh/privk -o StrictHostKeyChecking=no"
         REPO = "forgejo@server:test/repo"
         PRIVK = "${snakeOilPrivateKey}"
@@ -137,6 +147,11 @@ let
         client2.succeed(f"GIT_SSH_COMMAND='{GIT_SSH_COMMAND}' git clone {REPO}")
         client2.succeed('test "$(cat repo/testfile | xargs echo -n)" = "hello world"')
 
+        with subtest("Testing git protocol version=2 over ssh"):
+            git_protocol = client2.succeed(f"GIT_SSH_COMMAND='{GIT_SSH_COMMAND}' GIT_TRACE2_EVENT=true git -C repo fetch |& grep negotiated-version")
+            version = json.loads(git_protocol).get("value")
+            assert version == "2", f"git did not negotiate protocol version 2, but version {version} instead."
+
         server.wait_until_succeeds(
             'test "$(curl http://localhost:3000/api/v1/repos/test/repo/commits '
             + '-H "Accept: application/json" | jq length)" = "1"',
@@ -150,6 +165,12 @@ let
             server.succeed("${serverSystem}/specialisation/runner/bin/switch-to-configuration test")
             server.wait_for_unit("gitea-runner-test.service")
             server.succeed("journalctl -o cat -u gitea-runner-test.service | grep -q 'Runner registered successfully'")
+
+        with subtest("Testing backup service"):
+            server.succeed("${serverSystem}/specialisation/dump/bin/switch-to-configuration test")
+            server.systemctl("start forgejo-dump")
+            assert "Zstandard compressed data" in server.succeed("file ${dumpFile}")
+            server.copy_from_vm("${dumpFile}")
       '';
   });
 in

nixos/tests/installer.nix

@@ -69,8 +69,8 @@ let
   # disk, and then reboot from the hard disk.  It's parameterized with
   # a test script fragment `createPartitions', which must create
   # partitions and filesystems.
-  testScriptFun = { bootLoader, createPartitions, grubDevice, grubUseEfi
-                  , grubIdentifier, preBootCommands, postBootCommands, extraConfig
+  testScriptFun = { bootLoader, createPartitions, grubDevice, grubUseEfi, grubIdentifier
+                  , postInstallCommands, preBootCommands, postBootCommands, extraConfig
                   , testSpecialisationConfig, testFlakeSwitch
                   }:
     let iface = "virtio";
@@ -153,6 +153,8 @@ let
               """
           )
 
+      ${postInstallCommands}
+
       with subtest("Shutdown system after installation"):
           machine.succeed("umount -R /mnt")
           machine.succeed("sync")
@@ -368,7 +370,9 @@ let
 
 
   makeInstallerTest = name:
-    { createPartitions, preBootCommands ? "", postBootCommands ? "", extraConfig ? ""
+    { createPartitions
+    , postInstallCommands ? "", preBootCommands ? "", postBootCommands ? ""
+    , extraConfig ? ""
     , extraInstallerConfig ? {}
     , bootLoader ? "grub" # either "grub" or "systemd-boot"
     , grubDevice ? "/dev/vda", grubIdentifier ? "uuid", grubUseEfi ? false
@@ -479,7 +483,7 @@ let
       };
 
       testScript = testScriptFun {
-        inherit bootLoader createPartitions preBootCommands postBootCommands
+        inherit bootLoader createPartitions postInstallCommands preBootCommands postBootCommands
                 grubDevice grubIdentifier grubUseEfi extraConfig
                 testSpecialisationConfig testFlakeSwitch;
       };
@@ -682,20 +686,32 @@ in {
     createPartitions = ''
       machine.succeed(
           "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
-          + " mkpart primary linux-swap 1M 1024M"
-          + " mkpart primary 1024M -1s",
+          + " mkpart primary 1M 100MB"  # bpool
+          + " mkpart primary linux-swap 100M 1024M"
+          + " mkpart primary 1024M -1s", # rpool
           "udevadm settle",
-          "mkswap /dev/vda1 -L swap",
+          "mkswap /dev/vda2 -L swap",
           "swapon -L swap",
-          "zpool create rpool /dev/vda2",
+          "zpool create rpool /dev/vda3",
           "zfs create -o mountpoint=legacy rpool/root",
           "mount -t zfs rpool/root /mnt",
           "zfs create -o mountpoint=legacy rpool/root/usr",
           "mkdir /mnt/usr",
           "mount -t zfs rpool/root/usr /mnt/usr",
+          "zpool create -o compatibility=grub2 bpool /dev/vda1",
+          "zfs create -o mountpoint=legacy bpool/boot",
+          "mkdir /mnt/boot",
+          "mount -t zfs bpool/boot /mnt/boot",
           "udevadm settle",
       )
     '';
+
+    # umount & export bpool before shutdown
+    # this is a fix for "cannot import 'bpool': pool was previously in use from another system."
+    postInstallCommands = ''
+      machine.succeed("umount /mnt/boot")
+      machine.succeed("zpool export bpool")
+    '';
   };
 
   # Create two physical LVM partitions combined into one volume group

nixos/tests/openssh.nix

@@ -22,7 +22,7 @@ in {
         ];
       };
 
-    server_lazy =
+    server-lazy =
       { ... }:
 
       {
@@ -34,7 +34,7 @@ in {
         ];
       };
 
-    server_localhost_only =
+    server-localhost-only =
       { ... }:
 
       {
@@ -43,7 +43,7 @@ in {
         };
       };
 
-    server_localhost_only_lazy =
+    server-localhost-only-lazy =
       { ... }:
 
       {
@@ -52,7 +52,7 @@ in {
         };
       };
 
-    server_match_rule =
+    server-match-rule =
       { ... }:
 
       {
@@ -119,11 +119,11 @@ in {
         )
 
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'echo hello world' >&2",
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server-lazy 'echo hello world' >&2",
             timeout=30
         )
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'ulimit -l' | grep 1024",
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server-lazy 'ulimit -l' | grep 1024",
             timeout=30
         )
 
@@ -137,7 +137,7 @@ in {
             timeout=30
         )
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server_lazy true",
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-lazy true",
             timeout=30
         )
 

pkgs/applications/audio/pavucontrol/default.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
 
     license = lib.licenses.gpl2Plus;
 
-    maintainers = with maintainers; [ abbradar globin ];
+    maintainers = with maintainers; [ abbradar ];
     platforms = platforms.linux;
     mainProgram = "pavucontrol";
   };

pkgs/applications/audio/spotify/linux.nix

@@ -2,7 +2,7 @@
 , glib, pango, cairo, atk, gdk-pixbuf, gtk3, cups, nspr, nss_latest, libpng, libnotify
 , libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg_4, curlWithGnuTls, zlib, gnome
 , at-spi2-atk, at-spi2-core, libpulseaudio, libdrm, mesa, libxkbcommon
-, pname, meta, harfbuzz
+, pname, meta, harfbuzz, libayatana-appindicator, libdbusmenu
   # High-DPI support: Spotify's --force-device-scale-factor argument
   # not added if `null`, otherwise, should be a number.
 , deviceScaleFactor ? null
@@ -14,14 +14,14 @@ let
   # If an update breaks things, one of those might have valuable info:
   # https://aur.archlinux.org/packages/spotify/
   # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.2.13.661.ga588f749";
+  version = "1.2.22.982.g794acc0a";
   # To get the latest stable revision:
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
   # To get general information:
   # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
   # More examples of api usage:
   # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "68";
+  rev = "70";
 
   deps = [
     alsa-lib
@@ -40,6 +40,8 @@ let
     glib
     gtk3
     harfbuzz
+    libayatana-appindicator
+    libdbusmenu
     libdrm
     libgcrypt
     libnotify
@@ -84,7 +86,7 @@ stdenv.mkDerivation {
   # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
   src = fetchurl {
     url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    hash = "sha512-THGSRx0sGOVEB6bOHWHiy1G0Acq0hUa94tG/v+i5DA+CluI58pqj8gYQ61k/ACLJXTUyM8SA92C8DK1Go18X8w==";
+    hash = "sha512-oxDUZqyMLxCbUBb1A+BBznByQ1rZAJcEIkaSUQ93/k1DX3rTaBHzEXmBtJhmN6L8L3fw1pa9GvE7eDaD8+jeGg==";
   };
 
   nativeBuildInputs = [ wrapGAppsHook makeShellWrapper squashfsTools ];

pkgs/applications/blockchains/btcpayserver/default.nix

@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.11.6";
+  version = "1.11.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PORzTbvB9HriilaBCsC6R323RFvsI55WgSojJJ6uoIs=";
+    sha256 = "sha256-6DhVsN8VZmQ1lU7imXInL1y4Fu+JFr4R1nFthMHrQQ8=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";

pkgs/applications/blockchains/btcpayserver/deps.nix

@@ -2,8 +2,8 @@
 # Please dont edit it manually, your changes might get overwritten!
 
 { fetchNuGet }: [
-  (fetchNuGet { pname = "AngleSharp"; version = "0.14.0"; sha256 = "1zgwhh1fp2mmaplvpgm86rpmslix3wqfxf0d3hxx1gxwfgr6wxm6"; })
-  (fetchNuGet { pname = "AngleSharp.Css"; version = "0.14.2"; sha256 = "1d34a8ab5dri4wlw07jvk7b1z0d0zizwihwpdfva3sxhb4279ahd"; })
+  (fetchNuGet { pname = "AngleSharp"; version = "0.17.1"; sha256 = "038idg33ydy72362qplsd7y8ldifi9zg02dhjli6wy4p47hyqcph"; })
+  (fetchNuGet { pname = "AngleSharp.Css"; version = "0.17.0"; sha256 = "0q5vfj4l24kz1djigl0fva0dv64j2f90x3g1db59vbiz8vvfjz5i"; })
   (fetchNuGet { pname = "AWSSDK.Core"; version = "3.3.104.14"; sha256 = "157694kb63z1szbsv861515fvjv7amrjrfmgbm3idpyw31afk650"; })
   (fetchNuGet { pname = "AWSSDK.S3"; version = "3.3.110.10"; sha256 = "1lf1hfbx792dpa1hxgn0a0jrrvldd16hgbxx229dk2qcz5qlnc38"; })
   (fetchNuGet { pname = "BIP78.Sender"; version = "0.2.2"; sha256 = "12pm2s35c0qzc06099q2z1pxwq94rq85n74yz8fs8gwvm2ksgp4p"; })
@@ -20,7 +20,7 @@
   (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins.Mvc"; version = "1.4.4"; sha256 = "1kmmj5m7s41wc1akpqw1b1j7pp4c0vn6sqxb487980ibpj6hyisl"; })
   (fetchNuGet { pname = "CsvHelper"; version = "15.0.5"; sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma"; })
   (fetchNuGet { pname = "Dapper"; version = "2.0.123"; sha256 = "15hxrchfgiqnmgf8fqhrf4pb4c8l9igg5qnkw9yk3rkagcqfkk91"; })
-  (fetchNuGet { pname = "DigitalRuby.ExchangeSharp"; version = "1.0.2"; sha256 = "1l6g61l18jqnc0h8rpsilfjjnyapm4ld8wcsr8bp0hp34p6wpidm"; })
+  (fetchNuGet { pname = "DigitalRuby.ExchangeSharp"; version = "1.0.4"; sha256 = "1hkdls4wjrxq6df1zq9saa6hn5hynalq3gxb486w59j7i9f3g7d8"; })
   (fetchNuGet { pname = "Fido2"; version = "2.0.2"; sha256 = "1wqlk48apm7h637da7sav0r1a8yz2yy2gxhifpvydjqk1n3qybz4"; })
   (fetchNuGet { pname = "Fido2.AspNet"; version = "2.0.2"; sha256 = "0x2k1wyd0p7cy4ir15m2bxiggckl98znc65b4vq75ckjyd6dm1a1"; })
   (fetchNuGet { pname = "Fido2.Models"; version = "2.0.2"; sha256 = "1vk4h9sv2dhdr0jvh2a7yk6v9rhxk9y8hxz4mkal8vd9psajz5cg"; })
@@ -34,7 +34,7 @@
   (fetchNuGet { pname = "Google.Apis.Core"; version = "1.38.0"; sha256 = "012gslhnx65vqfyzjnqx4bqk9kb8bwbx966q2f9fdgrfcn26gj9j"; })
   (fetchNuGet { pname = "Google.Apis.Storage.v1"; version = "1.38.0.1470"; sha256 = "0mfrz7fmpfbjvp4zfpjasmnfbgxgxrrjkf8xgp9p6h9g8qh2f2h2"; })
   (fetchNuGet { pname = "Google.Cloud.Storage.V1"; version = "2.3.0"; sha256 = "01jhrd6m6md8m28chzg2dkdfd4yris79j1xi7r1ydm1cfjhmlj64"; })
-  (fetchNuGet { pname = "HtmlSanitizer"; version = "5.0.372"; sha256 = "1gllp58vdbql2ybwf05i2178x7p4g8zyyk64317d1pyss5217g7r"; })
+  (fetchNuGet { pname = "HtmlSanitizer"; version = "8.0.723"; sha256 = "1x621v4ypgd1zrmq7zd7j9wcrc30f6rm9qh0i1sm4yfqd983yf4g"; })
   (fetchNuGet { pname = "Humanizer.Core"; version = "2.8.26"; sha256 = "1v8xd12yms4qq1md4vh6faxicmqrvahqdd7sdkyzrphab9v44nsm"; })
   (fetchNuGet { pname = "libsodium"; version = "1.0.18"; sha256 = "15qzl5k31yaaapqlijr336lh4lzz1qqxlimgxy8fdyig8jdmgszn"; })
   (fetchNuGet { pname = "LNURL"; version = "0.0.34"; sha256 = "1sbkqsln7wq5fsbw63wdha8kqwxgd95j0iblv4kxa1shyg3c5d9x"; })
@@ -145,12 +145,11 @@
   (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "6.6.0"; sha256 = "0h5vbsd5x9cf7nqyrwn7d7y1axhf1zz0jr9prvi4xpxawa3kajyj"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.0.0"; sha256 = "1fk2fk2639i7nzy58m9dvpdnzql4vb8yl8vr19r2fp8lmj9w2jr0"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.1.2"; sha256 = "1507hnpr9my3z4w1r6xk5n0s1j3y6a2c2cnynj76za7cphxi1141"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
   (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
-  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "6.0.0"; sha256 = "0c6pcj088g1yd1vs529q3ybgsd2vjlk5y1ic6dkmbhvrp5jibl9p"; })
+  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "7.0.0"; sha256 = "1bh77misznh19m1swqm3dsbji499b8xh9gk6w74sgbkarf6ni8lb"; })
   (fetchNuGet { pname = "MimeKit"; version = "3.3.0"; sha256 = "0rslxmwlv6w2fssv0mz2v6qi6zg1v0lmly6hvh258xqdfxrhn0y8"; })
   (fetchNuGet { pname = "MySqlConnector"; version = "2.1.2"; sha256 = "12wgwns172vjldp1cvcq212zizpw18za7z3438rdh40zkq55s5yz"; })
   (fetchNuGet { pname = "NBitcoin"; version = "5.0.40"; sha256 = "1rqzn84yaww4afagwg8jg1l5qdkvqyjdfcyd5widddqwxabbsjvh"; })
@@ -170,7 +169,7 @@
   (fetchNuGet { pname = "NicolasDorier.CommandLine.Configuration"; version = "2.0.0"; sha256 = "1cng096r3kb85lf5wjill4yhxx8nv9v0d6ksbn1i1vvdawwl6fkw"; })
   (fetchNuGet { pname = "NicolasDorier.RateLimits"; version = "1.2.3"; sha256 = "197cqb0yxd2hfxyikxw53m4lmxh87l9sqrr8xihg1j0knvwzgyyp"; })
   (fetchNuGet { pname = "NicolasDorier.StandardConfiguration"; version = "2.0.1"; sha256 = "1jiinqj1y8vv78p766asml4bd0k5gwrpl9ksi176h0z7wsj6ilrx"; })
-  (fetchNuGet { pname = "NLog"; version = "4.7.14"; sha256 = "1pjkxlf20vrh9b8r6wzay1563fdhhxslxb7acdkn5ss8gvd2m23n"; })
+  (fetchNuGet { pname = "NLog"; version = "5.1.3"; sha256 = "0r09pd9cax95gn5bxskfhmalfd5qi3xx5j14znvryd1vn2vy6fln"; })
   (fetchNuGet { pname = "Npgsql"; version = "6.0.7"; sha256 = "0c5zyd9n3597ryzqh9qfisp3wvr7q0krbnl26w2sy33xm4hvls2c"; })
   (fetchNuGet { pname = "Npgsql.EntityFrameworkCore.PostgreSQL"; version = "6.0.7"; sha256 = "0gsvjf0vk7anmc889my8x68wpd47bsdgsk1rwbg77rrb9zsf4nxp"; })
   (fetchNuGet { pname = "NSec.Cryptography"; version = "20.2.0"; sha256 = "19slji51v8s8i4836nqqg7qb3i3p4ahqahz0fbb3gwpp67pn6izx"; })
@@ -248,7 +247,7 @@
   (fetchNuGet { pname = "Serilog.Sinks.Console"; version = "3.1.1"; sha256 = "0j99as641y1k6havwwkhyr0n08vibiblmfjj6nz051mz8g3864fn"; })
   (fetchNuGet { pname = "Serilog.Sinks.Debug"; version = "1.0.1"; sha256 = "0969mb254kr59bgkq01ybyzca89z3f4n9ng5mdj8m53d5653zf22"; })
   (fetchNuGet { pname = "Serilog.Sinks.File"; version = "4.1.0"; sha256 = "1ry7p9hf1zlnai1j5zjhjp4dqm2agsbpq6cvxgpf5l8m26x6mgca"; })
-  (fetchNuGet { pname = "SocketIOClient"; version = "3.0.6"; sha256 = "0yvvwyg05sjlam8841kxy1qv6bc7a1kykdk5jdy2jvw89d40k31d"; })
+  (fetchNuGet { pname = "SocketIOClient"; version = "3.0.8"; sha256 = "1k3csni1zyy55rdzcyivppqmyxvrmm31bqm6gffc25v959jp73wv"; })
   (fetchNuGet { pname = "SQLitePCLRaw.bundle_e_sqlite3"; version = "2.0.6"; sha256 = "1ip0a653dx5cqybxg27zyz5ps31f2yz50g3jvz3vx39isx79gax3"; })
   (fetchNuGet { pname = "SQLitePCLRaw.core"; version = "2.0.6"; sha256 = "1w4iyg0v1v1z2m7akq7rv8lsgixp2m08732vr14vgpqs918bsy1i"; })
   (fetchNuGet { pname = "SQLitePCLRaw.lib.e_sqlite3"; version = "2.0.6"; sha256 = "16378rh1lcqxynf5qj0kh8mrsb0jp37qqwg4285kqc5pknvh1bx3"; })
@@ -265,7 +264,8 @@
   (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "5.0.0"; sha256 = "1kvcllagxz2q92g81zkz81djkn2lid25ayjfgjalncyc68i15p0r"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "6.0.0"; sha256 = "1js98kmjn47ivcvkjqdmyipzknb9xbndssczm8gq224pbaj1p88c"; })
-  (fetchNuGet { pname = "System.Configuration.ConfigurationManager"; version = "6.0.0"; sha256 = "0sqapr697jbb4ljkq46msg0xx1qpmc31ivva6llyz2wzq3mpmxbw"; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "7.0.0"; sha256 = "1n9122cy6v3qhsisc9lzwa1m1j62b8pi2678nsmnlyvfpk0zdagm"; })
+  (fetchNuGet { pname = "System.Configuration.ConfigurationManager"; version = "7.0.0"; sha256 = "149d9kmakzkbw69cip1ny0wjlgcvnhrr7vz5pavpsip36k2mw02a"; })
   (fetchNuGet { pname = "System.Console"; version = "4.3.0"; sha256 = "1flr7a9x920mr5cjsqmsy9wgnv3lvd0h1g521pdr1lkb2qycy7ay"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "0gmjghrqmlgzxivd2xl50ncbglb7ljzb66rlx8ws6dv8jm0d5siz"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
@@ -274,7 +274,7 @@
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "0in3pic3s2ddyibi8cvgl102zmvp9r9mchh82ns9f0ms4basylw1"; })
   (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; sha256 = "1d2r76v1x610x61ahfpigda89gd13qydz6vbwzhpqlyvq8jj6394"; })
   (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
-  (fetchNuGet { pname = "System.Drawing.Common"; version = "6.0.0"; sha256 = "02n8rzm58dac2np8b3xw8ychbvylja4nh6938l5k2fhyn40imlgz"; })
+  (fetchNuGet { pname = "System.Drawing.Common"; version = "7.0.0"; sha256 = "0jwyv5zjxzr4bm4vhmz394gsxqa02q6pxdqd2hwy1f116f0l30dp"; })
   (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.0.11"; sha256 = "1pla2dx8gkidf7xkciig6nifdsb494axjvzvann8g2lp3dbqasm9"; })
   (fetchNuGet { pname = "System.Formats.Asn1"; version = "6.0.0"; sha256 = "1vvr7hs4qzjqb37r0w1mxq7xql2b17la63jwvmgv65s1hj00g8r9"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
@@ -312,7 +312,6 @@
   (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; sha256 = "191p63zy5rpqx7dnrb3h7prvgixmk168fhvvkkvhlazncf8r3nc2"; })
   (fetchNuGet { pname = "System.Private.Uri"; version = "4.0.1"; sha256 = "0k57qhawjysm4cpbfpc49kl4av7lji310kjcamkl23bwgij5ld9j"; })
   (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
-  (fetchNuGet { pname = "System.Reactive"; version = "5.0.0"; sha256 = "1lafmpnadhiwxyd543kraxa3jfdpm6ipblxrjlibym9b1ykpr5ik"; })
   (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; sha256 = "1js89429pfw79mxvbzp8p3q93il6rdff332hddhzi5wqglc4gml9"; })
   (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
   (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.0.1"; sha256 = "0ydqcsvh6smi41gyaakglnv252625hf29f7kywy2c70nhii2ylqp"; })
@@ -347,7 +346,6 @@
   (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.0.0"; sha256 = "0glmvarf3jz5xh22iy3w9v3wyragcm4hfdr17v90vs7vcrm7fgp6"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; sha256 = "0q18r1sh4vn7bvqgd6dmqlw5v28flbpj349mkdish2vjyvmnb2ii"; })
   (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
-  (fetchNuGet { pname = "System.Security.AccessControl"; version = "6.0.0"; sha256 = "0a678bzj8yxxiffyzy60z2w1nczzpi8v97igr4ip3byd2q89dv58"; })
   (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; sha256 = "0jvfn7j22l3mm28qjy3rcw287y9h65ha4m940waaxah07jnbzrhn"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv"; })
@@ -357,22 +355,22 @@
   (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "6.0.0"; sha256 = "1q80znpwkv5wrzgx0qnzxqaa5k1s72fnk3g1yng62l7y14d8ki64"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "6.0.0"; sha256 = "05kd3a8w7658hjxq9vvszxip30a479fjmfq4bq1r95nrsvs4hbss"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "7.0.0"; sha256 = "15s9s6hsj9bz0nzw41mxbqdjgjd71w2djqbv0aj413gfi9amybk9"; })
   (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h"; })
-  (fetchNuGet { pname = "System.Security.Permissions"; version = "6.0.0"; sha256 = "0jsl4xdrkqi11iwmisi1r2f2qn5pbvl79mzq877gndw6ans2zhzw"; })
+  (fetchNuGet { pname = "System.Security.Permissions"; version = "7.0.0"; sha256 = "0wkm6bj4abknzj41ygkziifx8mzhj4bix92wjvj6lihaw1gniq8c"; })
   (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
   (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; sha256 = "1dyqv0hijg265dwxg6l7aiv74102d6xjiwplh2ar1ly6xfaa4iiw"; })
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
-  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.0"; sha256 = "19x38911pawq4mrxrm04l2bnxwxxlzq8v8rj4cbxnfjj8pnd3vj3"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "6.0.0"; sha256 = "0gm2kiz2ndm9xyzxgi0jhazgwslcs427waxgfa30m7yqll1kcrww"; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; sha256 = "08nsfrpiwsg9x5ml4xyl3zyvjfdi4mvbqf93kjdh11j4fwkznizs"; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
   (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "4.4.0"; sha256 = "05qp3yivh6gz0vva0v3wjlj3g1b45d5jmz362f2y8ah6yb3rx088"; })
   (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "6.0.0"; sha256 = "06n9ql3fmhpjl32g3492sj181zjml5dlcc5l76xq2h38c4f87sai"; })
+  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "7.0.0"; sha256 = "1151hbyrcf8kyg1jz8k9awpbic98lwz9x129rg7zk1wrs6vjlpxl"; })
   (fetchNuGet { pname = "System.Text.Json"; version = "6.0.0"; sha256 = "1si2my1g0q0qv1hiqnji4xh9wd05qavxnzj9dwgs23iqvgjky0gl"; })
-  (fetchNuGet { pname = "System.Text.Json"; version = "6.0.2"; sha256 = "1lz6gx1r4if8sbx6yp9h0mi0g9ffr40x0cg518l0z2aiqgil3fk0"; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "7.0.2"; sha256 = "1i6yinxvbwdk5g5z9y8l4a5hj2gw3h9ijlz2f1c1ngyprnwz2ivf"; })
   (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.0"; sha256 = "1bgq51k7fwld0njylfn7qc5fmwrk2137gdq7djqdsw347paa9c2l"; })
   (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; sha256 = "19x946h926bzvbsgj28csn46gak2crv2skpwsx80hbgazmkgb1ls"; })
   (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
@@ -385,7 +383,7 @@
   (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; sha256 = "027s1f4sbx0y1xqw2irqn6x161lzj8qwvnh2gn78ciiczdv10vf1"; })
   (fetchNuGet { pname = "System.Threading.Timer"; version = "4.0.1"; sha256 = "15n54f1f8nn3mjcjrlzdg6q3520571y012mx7v991x2fvp73lmg6"; })
   (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; sha256 = "1nx773nsx6z5whv8kaa1wjh037id2f1cxhb69pvgv12hd2b6qs56"; })
-  (fetchNuGet { pname = "System.Windows.Extensions"; version = "6.0.0"; sha256 = "1wy9pq9vn1bqg5qnv53iqrbx04yzdmjw4x5yyi09y3459vaa1sip"; })
+  (fetchNuGet { pname = "System.Windows.Extensions"; version = "7.0.0"; sha256 = "11r9f0v7qp365bdpq5ax023yra4qvygljz18dlqs650d44iay669"; })
   (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
   (fetchNuGet { pname = "TwentyTwenty.Storage"; version = "2.12.1"; sha256 = "0m41dxzc3hh0f4j1k4q915pvcq6zr0hv1pj6b3sayrn8vjhk64qb"; })

pkgs/applications/blockchains/polkadot/default.nix

@@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot-sdk";
     rev = "polkadot-v${version}";
-    hash = "sha256-B9egLeXZ6xGJ5g5+A9KXYGdesN5Gkrr2qQJe/7hwB5I=";
+    hash = "sha256-Xgu1BlSGDAj79TKSM9vCbzBT4quOMBd6evImkkKycH4=";
 
     # the build process of polkadot requires a .git folder in order to determine
     # the git commit hash that is being built and add it to the version string.
@@ -41,13 +41,14 @@ rustPlatform.buildRustPackage rec {
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "ark-secret-scalar-0.0.2" = "sha256-Nbf77KSsAjDKiFIP5kgzl23fRB+68x1EirNuZlS7jeM=";
-      "common-0.1.0" = "sha256-3OKBPpk0exdlV0N9rJRVIncSrkwdI8bkYL2QNsJl+sY=";
+      "ark-secret-scalar-0.0.2" = "sha256-Tcrz2tT561ICAJzMgarSTOnaUEPeTFKZzE7rkdL3eUQ=";
+      "common-0.1.0" = "sha256-dnZKDx3Rw5cd4ejcilo3Opsn/1XK9yWGxhceuwvBE0o=";
       "fflonk-0.1.0" = "sha256-MNvlePHQdY8DiOq6w7Hc1pgn7G58GDTeghCKHJdUy7E=";
-      "sub-tokens-0.1.0" = "sha256-GvhgZhOIX39zF+TbQWtTCgahDec4lQjH+NqamLFLUxM=";
     };
   };
 
+  buildType = "production";
+
   cargoBuildFlags = [ "-p" "polkadot" ];
 
   # NOTE: tests currently fail to compile due to an issue with cargo-auditable
@@ -61,9 +62,9 @@ rustPlatform.buildRustPackage rec {
     rustc-wasm32.llvmPackages.lld
   ];
 
-  buildInputs = [
-    rust-jemalloc-sys-unprefixed
-  ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
+  # NOTE: jemalloc is used by default on Linux with unprefixed enabled
+  buildInputs = lib.optionals stdenv.isLinux [ rust-jemalloc-sys-unprefixed ] ++
+    lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
   # NOTE: we need to force lld otherwise rust-lld is not found for wasm32 target
   CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_LINKER = "lld";

pkgs/applications/emulators/blink/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, lib }:
+{ stdenv, fetchFromGitHub, fetchpatch, lib }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "blink";
@@ -11,6 +11,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-W7yL7Ut3MRygJhFGr+GIj/CK57MkuDTcenft8IvH7jU=";
   };
 
+  # Drop after next release
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/jart/blink/commit/b31fed832b10d32eadaec885fb20dacbb0eb6986.patch";
+      hash = "sha256-DfZxW/H58qXAjkQz31YS4SPMz7152ZzNHK7wHopgnQA=";
+    })
+  ];
+
   # 'make check' requires internet connection
   doCheck = true;
   checkTarget = "test";

pkgs/applications/emulators/xemu/default.nix

@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xemu";
-  version = "0.7.111";
+  version = "0.7.116";
 
   src = fetchFromGitHub {
     owner = "xemu-project";
     repo = "xemu";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-j7VNNKGm8mFEz+8779ylw1Yjd+jDuoL19Sw52kJll4s=";
+    hash = "sha256-/fUTQYi6EDG4wUFc17nuBUt/F1zBdhk/MEizwTo5I8Q=";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/moonlight-embedded/default.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     description = "Open source implementation of NVIDIA's GameStream";
     homepage = "https://github.com/moonlight-stream/moonlight-embedded";
     license = licenses.gpl3Plus;
-    maintainers = [ maintainers.globin ];
+    maintainers = [];
     platforms = platforms.linux;
   };
 }

pkgs/applications/misc/moonlight-qt/darwin.diff

@@ -25,7 +25,7 @@
      CONFIG += soundio discord-rpc
  }
  macx {
--    LIBS += -lssl -lcrypto -lavcodec.59 -lavutil.57 -lopus -framework SDL2 -framework SDL2_ttf
+-    LIBS += -lssl -lcrypto -lavcodec.60 -lavutil.58 -lopus -framework SDL2 -framework SDL2_ttf
      LIBS += -lobjc -framework VideoToolbox -framework AVFoundation -framework CoreVideo -framework CoreGraphics -framework CoreMedia -framework AppKit -framework Metal
  
      # For libsoundio

pkgs/applications/misc/moonlight-qt/default.nix

@@ -25,13 +25,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "moonlight-qt";
-  version = "4.3.1";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "moonlight-stream";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Utpv9VdX5vuUWDSGc3YcF8tHbvUZpPeXEDP4NKts+vI=";
+    sha256 = "sha256-rJCTISXN098A8CB34HM12WgdiSMNA31NO2x7u+iSwBM=";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/ola/default.nix

@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     broken = stdenv.isDarwin;
     description = "A framework for controlling entertainment lighting equipment";
     homepage = "https://www.openlighting.org/ola/";
-    maintainers = with maintainers; [ globin ];
+    maintainers = with maintainers; [ ];
     license = with licenses; [ lgpl21 gpl2Plus ];
     platforms = platforms.all;
   };

pkgs/applications/misc/privacyidea/default.nix

@@ -257,7 +257,7 @@ python3'.pkgs.buildPythonPackage rec {
     description = "Multi factor authentication system (2FA, MFA, OTP Server)";
     license = licenses.agpl3Plus;
     homepage = "http://www.privacyidea.org";
-    maintainers = with maintainers; [ globin ma27 ];
+    maintainers = with maintainers; [ ma27 ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/misc/qlcplus/default.nix

@@ -45,7 +45,7 @@ mkDerivation rec {
 
   meta = with lib; {
     description = "A free and cross-platform software to control DMX or analog lighting systems like moving heads, dimmers, scanners etc";
-    maintainers = [ maintainers.globin ];
+    maintainers = [ ];
     license = licenses.asl20;
     platforms = platforms.all;
     homepage = "https://www.qlcplus.org/";

pkgs/applications/misc/redshift/default.nix

@@ -117,7 +117,7 @@ rec {
       license = licenses.gpl3Plus;
       homepage = "http://jonls.dk/redshift";
       platforms = platforms.unix;
-      maintainers = with maintainers; [ globin yana ];
+      maintainers = with maintainers; [ yana ];
     };
   };
 

pkgs/applications/misc/wttrbar/default.nix

@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wttrbar";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "bjesus";
     repo = "wttrbar";
     rev = version;
-    hash = "sha256-7Y1t/A4k4dgf1Y0OEGPVI3bklXJ/Wuc/IRLSknW/tL8=";
+    hash = "sha256-Qe1Is13RXUIT5JkfuLK3Lj5gxKxVbfA4FCNgkqSTMNE=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk_11_0.frameworks.Security ];
 
-  cargoHash = "sha256-ErS0QgI3CbhwgvkUPlR06twKt3Swb+8hlSJv7DO3S70=";
+  cargoHash = "sha256-IK6ciz+XtNsC4QsAop7Pf5qjiTCUQa30xnHWW4PobnA=";
 
   meta = {
     description = "A simple but detailed weather indicator for Waybar using wttr.in";

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -1,18 +1,17 @@
 { stdenv, lib, fetchurl, fetchzip, python3
 , wrapQtAppsHook, glib-networking
 , asciidoc, docbook_xml_dtd_45, docbook_xsl, libxml2
-, libxslt, gst_all_1 ? null
+, libxslt
 , withPdfReader      ? true
-, withMediaPlayback  ? true
-, backend            ? "webengine"
 , pipewireSupport    ? stdenv.isLinux
 , pipewire
 , qtwayland
 , qtbase
 , qtwebengine
-, wrapGAppsHook
 , enableWideVine ? false
 , widevine-cdm
+, enableVulkan ? stdenv.isLinux
+, vulkan-loader
 }:
 
 let
@@ -29,12 +28,6 @@ let
   version = "3.0.2";
 in
 
-assert withMediaPlayback -> gst_all_1 != null;
-assert lib.assertMsg (backend != "webkit") ''
-  Support for the QtWebKit backend has been removed.
-  Please remove the `backend = "webkit"` option from your qutebrowser override.
-'';
-
 python3.pkgs.buildPythonApplication {
   inherit pname version;
   src = fetchurl {
@@ -48,13 +41,10 @@ python3.pkgs.buildPythonApplication {
   buildInputs = [
     qtbase
     glib-networking
-  ] ++ lib.optionals withMediaPlayback (with gst_all_1; [
-    gst-plugins-base gst-plugins-good
-    gst-plugins-bad gst-plugins-ugly gst-libav
-  ]);
+  ];
 
   nativeBuildInputs = [
-    wrapQtAppsHook wrapGAppsHook asciidoc
+    wrapQtAppsHook asciidoc
     docbook_xml_dtd_45 docbook_xsl libxml2 libxslt
     python3.pkgs.pygments
   ];
@@ -74,7 +64,6 @@ python3.pkgs.buildPythonApplication {
     ./fix-restart.patch
   ];
 
-  dontWrapGApps = true;
   dontWrapQtApps = true;
 
   postPatch = ''
@@ -112,9 +101,16 @@ python3.pkgs.buildPythonApplication {
   in
     ''
     makeWrapperArgs+=(
-      "''${gappsWrapperArgs[@]}"
+      # Force the app to use QT_PLUGIN_PATH values from wrapper
+      --unset QT_PLUGIN_PATH
       "''${qtWrapperArgs[@]}"
+      # avoid persistant warning on starup
+      --set QT_STYLE_OVERRIDE Fusion
       ${lib.optionalString pipewireSupport ''--prefix LD_LIBRARY_PATH : ${libPath}''}
+      ${lib.optionalString (enableVulkan) ''
+        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [vulkan-loader]}
+        --set-default QSG_RHI_BACKEND vulkan
+      ''}
       ${lib.optionalString enableWideVine ''--add-flags "--qt-flag widevine-path=${widevine-cdm}/share/google/chrome/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so"''}
     )
   '';

pkgs/applications/networking/cluster/helmfile/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "helmfile";
-  version = "0.157.0";
+  version = "0.158.0";
 
   src = fetchFromGitHub {
     owner = "helmfile";
     repo = "helmfile";
     rev = "v${version}";
-    sha256 = "sha256-M0XhkmYdmKpaA1gTXGgI7XNqIAuerV2NqfUI7sIgIiw=";
+    sha256 = "sha256-768rlhkh8scQbzLvWyjyQSba4zCY/ydYreve+HmcFgw=";
   };
 
-  vendorHash = "sha256-RRnziHhM3pxoi5dZSZI5bkGWIp3Nx0TU3mVsOoU/CCM=";
+  vendorHash = "sha256-ip01Uj720Sa11ni+8//U1PkHgiY6ttftvMHdxZgfKLk=";
 
   doCheck = false;
 

pkgs/applications/networking/cluster/nixops/default.nix

@@ -28,7 +28,7 @@ let
                 meta = old.meta // {
                   homepage = "https://github.com/NixOS/nixops";
                   description = "NixOS cloud provisioning and deployment tool";
-                  maintainers = with lib.maintainers; [ adisbladis aminechikhaoui eelco rob domenkozar ];
+                  maintainers = with lib.maintainers; [ adisbladis aminechikhaoui roberth ];
                   platforms = lib.platforms.unix;
                   license = lib.licenses.lgpl3;
                   mainProgram = "nixops";

pkgs/applications/networking/cluster/ocm/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ocm";
-  version = "0.1.69";
+  version = "0.1.70";
 
   src = fetchFromGitHub {
     owner = "openshift-online";
     repo = "ocm-cli";
     rev = "v${version}";
-    sha256 = "sha256-JKR58is8SzNmEQ8x1om1anReLIbNCHJkkzZQ1SiQ5J4=";
+    sha256 = "sha256-J/CN1cxEcKiEt8WMg79nA4y0gp18vSDEsBqvYuQVaIk=";
   };
 
   vendorHash = "sha256-3HLTuWf4mK3r92s2mPE2yl/rrPxgcsB9EmrxkiJsMaE=";

pkgs/applications/networking/cluster/werf/default.nix

@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.263";
+  version = "1.2.267";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    hash = "sha256-eWiUn6v7XZZH7rudvCMLa3rUBmMsiSUKcwoDCFxRlFE=";
+    hash = "sha256-OlTlyo/JbmXyoMBSDnKHvjGN6NMRrk0kQT63R34gtOs=";
   };
 
   vendorHash = "sha256-0bxM0Y4K6wxg6Ka1A9MusptiSMshTUWJItXoVDpo7lI=";

pkgs/applications/networking/errbot/default.nix

@@ -64,7 +64,7 @@ python3.pkgs.buildPythonApplication rec {
     changelog = "https://github.com/errbotio/errbot/blob/${version}/CHANGES.rst";
     description = "Chatbot designed to be simple to extend with plugins written in Python";
     homepage = "http://errbot.io/";
-    maintainers = with maintainers; [ globin ];
+    maintainers = with maintainers; [ ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     # flaky on darwin, "RuntimeError: can't start new thread"

pkgs/applications/networking/instant-messengers/armcord/default.nix

@@ -46,11 +46,11 @@ stdenv.mkDerivation rec {
     in
       {
         x86_64-linux = fetchurl {
-          url = "${base}/v${version}/ArmCord_${builtins.head (lib.splitString "-" version)}_amd64.deb";
+          url = "${base}/v${version}/ArmCord_${version}_amd64.deb";
           hash = "sha256-6zlYm4xuYpG+Bgsq5S+B/Zt9TRB2GZnueKAg2ywYLE4=";
         };
         aarch64-linux = fetchurl {
-          url = "${base}/v${version}/ArmCord_${builtins.head (lib.splitString "-" version)}_arm64.deb";
+          url = "${base}/v${version}/ArmCord_${version}_arm64.deb";
           hash = "sha256-HJu1lRa3zOTohsPMe23puHxg1VMWNR2aOjDQJqc4TqE=";
         };
       }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

pkgs/applications/networking/instant-messengers/cinny/default.nix

@@ -1,23 +1,46 @@
-{ lib, buildNpmPackage, fetchFromGitHub, writeText, jq, conf ? { } }:
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, writeText
+, jq
+, python3
+, pkg-config
+, pixman
+, cairo
+, pango
+, stdenv
+, darwin
+, conf ? { }
+}:
 
 let
   configOverrides = writeText "cinny-config-overrides.json" (builtins.toJSON conf);
 in
 buildNpmPackage rec {
   pname = "cinny";
-  version = "2.2.6";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny";
     rev = "v${version}";
-    hash = "sha256-Da/gbq9piKvkIMiamoafcRrqxF7128GXoswk2C43An8=";
+    hash = "sha256-BFovEmT4RgdzlSYi1p0324PW7+2rvw3n5+jKWTV2FF4=";
   };
 
-  npmDepsHash = "sha256-3wgB/dQmLtwxbRsk+OUcyfx98vpCvhvseEOCrJIFohY=";
+  npmDepsHash = "sha256-E+VBs66chBeiK40DZZ1hWTTISKaBN1RA+Uyr1iHqfus=";
 
   nativeBuildInputs = [
     jq
+    python3
+    pkg-config
+  ];
+
+  buildInputs = [
+    pixman
+    cairo
+    pango
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreText
   ];
 
   installPhase = ''
@@ -32,7 +55,7 @@ buildNpmPackage rec {
   meta = with lib; {
     description = "Yet another Matrix client for the web";
     homepage = "https://cinny.in/";
-    maintainers = with maintainers; [ abbe ];
+    maintainers = with maintainers; [ abbe ashkitten ];
     license = licenses.agpl3Only;
     platforms = platforms.all;
   };

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -50,7 +50,7 @@ let
   # find where to edit them.
   versions.aarch64-darwin = "5.16.2.23409";
   versions.x86_64-darwin = "5.16.2.23409";
-  versions.x86_64-linux = "5.16.2.8828";
+  versions.x86_64-linux = "5.16.5.303";
 
   srcs = {
     aarch64-darwin = fetchurl {
@@ -64,7 +64,7 @@ let
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-eRvgNrMe/NyOnsMJ8L659C3Cl4xZ5Ij1u4qoHehj4y8=";
+      hash = "sha256-M+76HzqhPVxsP0nZOG4Oe8lnRJ9MJ2mE4+1hGvRkSUg=";
     };
   };
 

pkgs/applications/networking/irc/weechat/default.nix

@@ -36,16 +36,19 @@ let
   in
     assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
     stdenv.mkDerivation rec {
-      version = "4.0.5";
+      version = "4.1.0";
       pname = "weechat";
 
       hardeningEnable = [ "pie" ];
 
       src = fetchurl {
         url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-        hash = "sha256-PXLmGwVjHavcKDIxdo+TioVUSyfjH6v+E8V7TfXF47s=";
+        hash = "sha256-AwSC5bjw9pxr/Upja2+m12tkqeweF58auqNbGrONHhA=";
       };
 
+      # Why is this needed? https://github.com/weechat/weechat/issues/2031
+      patches = lib.optional gettext.gettextNeedsLdflags ./gettext-intl.patch;
+
       outputs = [ "out" "man" ] ++ map (p: p.name) enabledPlugins;
 
       cmakeFlags = with lib; [

pkgs/applications/networking/irc/weechat/gettext-intl.patch

@@ -0,0 +1,12 @@
+diff --git a/cmake/FindGettext.cmake b/cmake/FindGettext.cmake
+index 358734688..ffcbf7ef4 100644
+--- a/cmake/FindGettext.cmake
++++ b/cmake/FindGettext.cmake
+@@ -42,6 +42,7 @@ find_path(LIBINTL_INCLUDE
+ )
+ 
+ set(CMAKE_REQUIRED_INCLUDES ${LIBINTL_INCLUDE})
++set(CMAKE_REQUIRED_FLAGS "-lintl")
+ 
+ check_include_files(libintl.h HAVE_LIBINTL_H)
+ 

pkgs/applications/networking/ndppd/default.nix

@@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/DanielAdolfsson/ndppd";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fadenb globin ];
+    maintainers = with maintainers; [ fadenb ];
   };
 }

pkgs/applications/networking/sync/wdt/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "wdt";
-  version = "unstable-2022-12-19";
+  version = "unstable-2023-07-11";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "wdt";
-    rev = "6a122f24deb4f2ff6c6f97b6a803301a7f7b666c";
-    sha256 = "sha256-fH4Inqy7DfMJbW1FYWanScLATu8cZA1n+Vas8ee3xwA=";
+    rev = "3b52ef573129fb799319630bd438717761111f57";
+    sha256 = "sha256-TwHWeTVzUo42t1erD7lMT4vdXiV3/9Hy1sPnrvJpQE8=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/office/paperwork/openpaperwork-core.nix

@@ -1,8 +1,15 @@
-{ buildPythonPackage, lib, fetchFromGitLab
+{ buildPythonPackage
+, lib
+, fetchFromGitLab
 
-, isPy3k, isPyPy
+, isPy3k
+, isPyPy
 
-, distro, setuptools, psutil
+, distro
+, setuptools
+, psutil
+, certifi
+, setuptools-scm
 
 , pkgs
 }:
@@ -10,6 +17,7 @@
 buildPythonPackage rec {
   pname = "openpaperwork-core";
   inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  format = "pyproject";
 
   sourceRoot = "${src.name}/openpaperwork-core";
 
@@ -17,23 +25,33 @@ buildPythonPackage rec {
   disabled = !isPy3k && !isPyPy;
 
   patchPhase = ''
-    echo 'version = "${version}"' > src/openpaperwork_core/_version.py
     chmod a+w -R ..
     patchShebangs ../tools
   '';
 
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   propagatedBuildInputs = [
     distro
     setuptools
     psutil
+    certifi
   ];
 
-  nativeBuildInputs = [ pkgs.gettext pkgs.which ];
+  nativeBuildInputs = [
+    pkgs.gettext
+    pkgs.which
+    setuptools-scm
+  ];
 
   preBuild = ''
     make l10n_compile
   '';
 
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
   meta = {
     description = "Backend part of Paperwork (Python API, no UI)";
     homepage = "https://openpaper.work/";

pkgs/applications/office/paperwork/openpaperwork-gtk.nix

@@ -9,6 +9,7 @@
 , pillow
 , pygobject3
 , distro
+, setuptools-scm
 
 , pkgs
 }:
@@ -16,6 +17,7 @@
 buildPythonPackage rec {
   pname = "openpaperwork-gtk";
   inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  format = "pyproject";
 
   sourceRoot = "${src.name}/openpaperwork-gtk";
 
@@ -23,12 +25,18 @@ buildPythonPackage rec {
   disabled = !isPy3k && !isPyPy;
 
   patchPhase = ''
-    echo 'version = "${version}"' > src/openpaperwork_gtk/_version.py
     chmod a+w -R ..
     patchShebangs ../tools
   '';
 
-  nativeBuildInputs = [ pkgs.gettext pkgs.which ];
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    pkgs.gettext
+    pkgs.which
+    setuptools-scm
+  ];
+
   preBuild = ''
     make l10n_compile
   '';

pkgs/applications/office/paperwork/paperwork-backend.nix

@@ -1,6 +1,5 @@
 { buildPythonPackage
 , lib
-, fetchpatch
 , fetchFromGitLab
 , pyenchant
 , scikit-learn
@@ -8,7 +7,6 @@
 , pycountry
 , whoosh
 , termcolor
-, levenshtein
 , pygobject3
 , pyocr
 , natsort
@@ -24,34 +22,30 @@
 , shared-mime-info
 , libreoffice
 , unittestCheckHook
+, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "paperwork-backend";
   inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  format = "pyproject";
 
   sourceRoot = "${src.name}/paperwork-backend";
 
   patches = [
     # disables a flaky test https://gitlab.gnome.org/World/OpenPaperwork/paperwork/-/issues/1035#note_1493700
     ./flaky_test.patch
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/World/OpenPaperwork/paperwork/-/commit/0f5cf0fe7ef223000e02c28e4c7576f74a778fe6.patch";
-      hash = "sha256-NIK3j2TdydfeK3/udS/Pc+tJa/pPkfAmSPPeaYuaCq4=";
-    })
   ];
 
   patchFlags = [ "-p2" ];
 
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace python-Levenshtein Levenshtein
-
-    echo 'version = "${version}"' > src/paperwork_backend/_version.py
     chmod a+w -R ..
     patchShebangs ../tools
   '';
 
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   propagatedBuildInputs = [
     distro
     gtk3
@@ -63,7 +57,6 @@ buildPythonPackage rec {
     pygobject3
     pyocr
     pypillowfight
-    levenshtein
     poppler_gi
     scikit-learn
     termcolor
@@ -74,6 +67,7 @@ buildPythonPackage rec {
     gettext
     shared-mime-info
     which
+    setuptools-scm
   ];
 
   preBuild = ''

pkgs/applications/office/paperwork/paperwork-gtk.nix

@@ -34,6 +34,7 @@ in
 python3Packages.buildPythonApplication rec {
   inherit src version;
   pname = "paperwork";
+  format = "pyproject";
 
   sample_docs = sample_documents // {
     # a trick for the update script
@@ -43,21 +44,13 @@ python3Packages.buildPythonApplication rec {
 
   sourceRoot = "${src.name}/paperwork-gtk";
 
-  # Patch out a few paths that assume that we're using the FHS:
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace python-Levenshtein Levenshtein
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
+  postPatch = ''
     chmod a+w -R ..
     patchShebangs ../tools
 
     export HOME=$(mktemp -d)
-
-    cat - ../AUTHORS.py > src/paperwork_gtk/_version.py <<EOF
-    # -*- coding: utf-8 -*-
-    version = "${version}"
-    authors_code=""
-    EOF
   '';
 
   preBuild = ''
@@ -93,6 +86,7 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     wrapGAppsHook
     gobject-introspection
+    python3Packages.setuptools-scm
     (lib.getBin gettext)
     which
     gdk-pixbuf # for the setup hook

pkgs/applications/office/paperwork/paperwork-shell.nix

@@ -9,9 +9,11 @@
 , openpaperwork-gtk
 , paperwork-backend
 , fabulous
+, rich
 , getkey
 , psutil
 , shared-mime-info
+, setuptools-scm
 
 , pkgs
 }:
@@ -19,6 +21,7 @@
 buildPythonPackage rec {
   pname = "paperwork-shell";
   inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  format = "pyproject";
 
   sourceRoot = "${src.name}/paperwork-shell";
 
@@ -26,10 +29,10 @@ buildPythonPackage rec {
   disabled = !isPy3k && !isPyPy;
 
   patchPhase = ''
-    echo 'version = "${version}"' > src/paperwork_shell/_version.py
     chmod a+w -R ..
     patchShebangs ../tools
   '';
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   propagatedBuildInputs = [
     openpaperwork-core
@@ -37,6 +40,7 @@ buildPythonPackage rec {
     fabulous
     getkey
     psutil
+    rich
   ];
 
   nativeCheckInputs = [
@@ -44,7 +48,12 @@ buildPythonPackage rec {
     openpaperwork-gtk
   ];
 
-  nativeBuildInputs = [ pkgs.gettext pkgs.which ];
+  nativeBuildInputs = [
+    pkgs.gettext
+    pkgs.which
+    setuptools-scm
+  ];
+
   preBuild = ''
     make l10n_compile
   '';

pkgs/applications/office/paperwork/src.nix

@@ -1,13 +1,13 @@
 {fetchFromGitLab}:
 rec {
-  version = "2.1.2";
+  version = "2.2.1";
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     repo = "paperwork";
     group = "World";
     owner = "OpenPaperwork";
     rev = version;
-    sha256 = "/5k+zUtTE+Dr879xbHDCAYrqlEJLsbkcRSG3GbA/PCg=";
+    sha256 = "sha256-OFVj9INDiOpGd5N3ziMBWt3/IdmpInc+jEAxW3GcvOA=";
   };
   sample_documents = fetchFromGitLab {
     domain = "gitlab.gnome.org";

pkgs/applications/science/electronics/xschem/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xschem";
-  version = "3.1.0";
+  version = "3.4.4";
 
   src = fetchFromGitHub {
     owner = "StefanSchippers";
     repo = "xschem";
     rev = version;
-    sha256 = "sha256-SHpESg5mn9lSDOURQusQUsug8Jqin/W5rqkVgmseSgA=";
+    sha256 = "sha256-1jP1SJeq23XNkOQgcl2X+rBrlka4a04irmfhoKRM1j4=";
   };
 
   nativeBuildInputs = [ bison flex pkg-config ];

pkgs/applications/science/logic/proverif/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "proverif";
-  version = "2.04";
+  version = "2.05";
 
   src = fetchurl {
     url    = "https://bblanche.gitlabpages.inria.fr/proverif/proverif${version}.tar.gz";
-    sha256 = "sha256:0xgwnp59779xc40sb7ck8rmfn620pilxyq79l3bymj9m7z0mwvm9";
+    hash = "sha256-SHH1PDKrSgRmmgYMSIa6XZCASWlj+5gKmmLSxCnOq8Q=";
   };
 
   strictDeps = true;

pkgs/applications/science/math/calc/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   postPatch = ''
-    substituteInPlace Makefile \
+    substituteInPlace Makefile.target \
       --replace '-install_name ''${LIBDIR}/libcalc''${LIB_EXT_VERSION}' '-install_name ''${T}''${LIBDIR}/libcalc''${LIB_EXT_VERSION}' \
       --replace '-install_name ''${LIBDIR}/libcustcalc''${LIB_EXT_VERSION}' '-install_name ''${T}''${LIBDIR}/libcustcalc''${LIB_EXT_VERSION}'
   '';

pkgs/applications/science/math/wxmaxima/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs:{
   pname = "wxmaxima";
-  version = "23.02.1";
+  version = "23.10.0";
 
   src = fetchFromGitHub {
     owner = "wxMaxima-developers";
     repo = "wxmaxima";
     rev = "Version-${finalAttrs.version}";
-    sha256 = "sha256-Lrj/oJNmKlCkNbnCGY2TewCospwajKdWgmKkreHzEIU=";
+    sha256 = "sha256-3zQzpw0KWNAAvML55O2FMlid9j0GtP8OWy1eqifzVwI=";
   };
 
   buildInputs = [

pkgs/applications/version-management/diff-so-fancy/default.nix

@@ -52,6 +52,6 @@ stdenv.mkDerivation rec {
       diff-so-fancy builds on the good-lookin' output of git contrib's
       diff-highlight to upgrade your diffs' appearances.
     '';
-    maintainers = with maintainers; [ fpletz globin ma27 ];
+    maintainers = with maintainers; [ fpletz ma27 ];
   };
 }

pkgs/applications/version-management/git-mit/default.nix

@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.12.163";
+  version = "5.12.164";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-Vntwh3YVi6W5eoO0lgMkwMu6EhNhtZDSrkoIze8gBDs=";
+    hash = "sha256-egK/C4pSNOS1vvn+HkgWVyNbQONiBYA5AZWP4/CT9Q0=";
   };
 
-  cargoHash = "sha256-l+fABvV3nBTUqd6oA6/b7mHIi9LObrsL7beEEveKxgU=";
+  cargoHash = "sha256-NyRvYkvswfwCHnvLw21EhnY6pkCIBMImZPRtNYnT5c4=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/version-management/gitkraken/default.nix

@@ -10,24 +10,24 @@ with lib;
 
 let
   pname = "gitkraken";
-  version = "9.5.1";
+  version = "9.9.2";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      sha256 = "sha256-irKs0yvz2TrKvF34DMOBdmJvH+Lox/ZVbPSaHAl6Vyo=";
+      sha256 = "sha256-UfzHkgqxEaSsoiDwFLsyIBW2min9AvSBrLPJ2MlKh3U=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      sha256 = "sha256-3g49FBbolEhBgSPanLnrWhfxHR5jg4C1p+70rIrQ2GM=";
+      sha256 = "sha256-ble0n+giM8xmuSewBVdj+RuT2093rW0taNzsyQLO92I=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      sha256 = "sha256-8ateh2LswWMOboPASWcYTy6OfK30h7wABIgoZXJ7GTM=";
+      sha256 = "sha256-QYhYzjqbCO0/pRDK7c5jYifj+/UY7SLpRqQUQ3LBFkE=";
     };
   };
 
@@ -139,9 +139,15 @@ let
     nativeBuildInputs = [ unzip ];
 
     installPhase = ''
+      runHook preInstall
+
       mkdir -p $out/Applications/GitKraken.app
       cp -R . $out/Applications/GitKraken.app
+
+      runHook postInstall
     '';
+
+    dontFixup = true;
   };
 in
 if stdenv.isDarwin

pkgs/applications/video/obs-studio/default.nix

@@ -118,12 +118,12 @@ stdenv.mkDerivation rec {
   postUnpack = ''
     mkdir -p cef/Release cef/Resources cef/libcef_dll_wrapper/
     for i in ${libcef}/share/cef/*; do
-      cp -r $i cef/Release/
-      cp -r $i cef/Resources/
+      ln -s $i cef/Release/
+      ln -s $i cef/Resources/
     done
-    cp -r ${libcef}/lib/libcef.so cef/Release/
-    cp -r ${libcef}/lib/libcef_dll_wrapper.a cef/libcef_dll_wrapper/
-    cp -r ${libcef}/include cef/
+    ln -s ${libcef}/lib/libcef.so cef/Release/
+    ln -s ${libcef}/lib/libcef_dll_wrapper.a cef/libcef_dll_wrapper/
+    ln -s ${libcef}/include cef/
   '';
 
   cmakeFlags = [
@@ -145,6 +145,9 @@ stdenv.mkDerivation rec {
       blackmagic-desktop-video
     ];
   in ''
+    # Remove libcef before patchelf, otherwise it will fail
+    rm $out/lib/obs-plugins/libcef.so
+
     qtWrapperArgs+=(
       --prefix LD_LIBRARY_PATH : "$out/lib:${lib.makeLibraryPath wrapperLibraries}"
       ''${gappsWrapperArgs[@]}
@@ -154,6 +157,9 @@ stdenv.mkDerivation rec {
   postFixup = lib.optionalString stdenv.isLinux ''
     addOpenGLRunpath $out/lib/lib*.so
     addOpenGLRunpath $out/lib/obs-plugins/*.so
+
+    # Link libcef again after patchelfing other libs
+    ln -s ${libcef}/lib/libcef.so $out/lib/obs-plugins/libcef.so
   '';
 
   meta = with lib; {

pkgs/applications/virtualization/crun/default.nix

@@ -39,13 +39,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.9.2";
+  version = "1.10";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    hash = "sha256-C2VPEtHJyO7azDmvH74AoCnNaCeJ7XOLlIIe3nay4Po=";
+    hash = "sha256-deva/IPyjcGGAnUIofev3RV2ia7uI+OgSiUz/GtHhxE=";
     fetchSubmodules = true;
   };
 

pkgs/applications/virtualization/docker/distribution.nix

@@ -17,7 +17,7 @@ buildGoPackage rec {
   meta = with lib; {
     description = "The Docker toolset to pack, ship, store, and deliver content";
     license = licenses.asl20;
-    maintainers = [ maintainers.globin ];
+    maintainers = [];
     platforms = platforms.unix;
   };
 }

pkgs/applications/window-managers/hyprwm/hyprland/default.nix

@@ -40,13 +40,13 @@ assert lib.assertMsg (!nvidiaPatches) "The option `nvidiaPatches` has been renam
 assert lib.assertMsg (!hidpiXWayland) "The option `hidpiXWayland` has been removed. Please refer https://wiki.hyprland.org/Configuring/XWayland";
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + lib.optionalString debug "-debug";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
-    hash = "sha256-a0nqm82brOC0QroGOXxcIKxOMAfl9I6pfFOYjCeRzO0=";
+    hash = "sha256-8n67P8wvtFgjOufTj4y1sRpBcbMrlhSlH7d8dOhUKns=";
   };
 
   patches = [
@@ -57,9 +57,15 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     # Fix hardcoded paths to /usr installation
     sed -i "s#/usr#$out#" src/render/OpenGL.cpp
-    substituteInPlace meson.build \
-      --replace "@GIT_COMMIT_HASH@" '${finalAttrs.src.rev}' \
-      --replace "@GIT_DIRTY@" ""
+
+    # Generate version.h
+    cp src/version.h.in src/version.h
+    substituteInPlace src/version.h \
+      --replace "@HASH@" '${finalAttrs.src.rev}' \
+      --replace "@BRANCH@" "" \
+      --replace "@MESSAGE@" "" \
+      --replace "@TAG@" "" \
+      --replace "@DIRTY@" ""
   '';
 
   nativeBuildInputs = [

pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix

@@ -42,8 +42,8 @@ wlroots.overrideAttrs
       domain = "gitlab.freedesktop.org";
       owner = "wlroots";
       repo = "wlroots";
-      rev = "98a745d926d8048bc30aef11b421df207a01c279";
-      hash = "sha256-LEIUGXvKR5DYFQUTavC3yifcObvG4XZUUHfxXmu8nEM=";
+      rev = "3406c1b17a4a7e6d4e2a7d9c1176affa72bce1bc";
+      hash = "sha256-ecDhdYLXWHsxMv+EWG36mCNDvzRbu9qfjH7dLxL7aGM=";
     };
 
     pname =

pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix

@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (self: {
   pname = "xdg-desktop-portal-hyprland";
-  version = "1.1.0";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "xdg-desktop-portal-hyprland";
     rev = "v${self.version}";
-    hash = "sha256-K1cqx+NP4lxPwRVPLEeSUfagaMI3m5hdYvQe7sZr7BU=";
+    hash = "sha256-y8q4XUwx+gVK7i2eLjfR32lVo7TYvEslyzrmzYEaPZU=";
   };
 
   nativeBuildInputs = [

pkgs/applications/window-managers/i3/default.nix

@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A tiling window manager";
     homepage    = "https://i3wm.org";
-    maintainers = with maintainers; [ modulistic fpletz globin ];
+    maintainers = with maintainers; [ modulistic fpletz ];
     license     = licenses.bsd3;
     platforms   = platforms.all;
 

pkgs/build-support/php/build-composer-project.nix

@@ -13,6 +13,7 @@ let
       composerNoDev = previousAttrs.composerNoDev or true;
       composerNoPlugins = previousAttrs.composerNoPlugins or true;
       composerNoScripts = previousAttrs.composerNoScripts or true;
+      composerStrictValidation = previousAttrs.composerStrictValidation or true;
 
       nativeBuildInputs = (previousAttrs.nativeBuildInputs or [ ]) ++ [
         composer
@@ -69,6 +70,7 @@ let
         composerNoDev = previousAttrs.composerNoDev or true;
         composerNoPlugins = previousAttrs.composerNoPlugins or true;
         composerNoScripts = previousAttrs.composerNoScripts or true;
+        composerStrictValidation = previousAttrs.composerStrictValidation or true;
       };
 
       COMPOSER_CACHE_DIR="/dev/null";

pkgs/build-support/php/build-composer-repository.nix

@@ -32,6 +32,7 @@ let
       composerNoDev = previousAttrs.composerNoDev or true;
       composerNoPlugins = previousAttrs.composerNoPlugins or true;
       composerNoScripts = previousAttrs.composerNoScripts or true;
+      composerStrictValidation = previousAttrs.composerStrictValidation or true;
 
       name = "${previousAttrs.pname}-${previousAttrs.version}-composer-repository";
 

pkgs/build-support/php/hooks/composer-install-hook.sh

@@ -35,14 +35,16 @@ composerInstallConfigureHook() {
         cp composer.lock $out/
 
         echo
-        echo 'No composer.lock file found, consider adding one to your repository to ensure reproducible builds.'
-        echo "In the meantime, a composer.lock file has been generated for you in $out/composer.lock"
+        echo -e "\e[31mERROR: No composer.lock found\e[0m"
         echo
-        echo 'To fix the issue:'
-        echo "1. Copy the composer.lock file from $out/composer.lock to the project's source:"
-        echo "  cp $out/composer.lock <path>"
-        echo '2. Add the composerLock attribute, pointing to the copied composer.lock file:'
-        echo '  composerLock = ./composer.lock;'
+        echo -e '\e[31mNo composer.lock file found, consider adding one to your repository to ensure reproducible builds.\e[0m'
+        echo -e "\e[31mIn the meantime, a composer.lock file has been generated for you in $out/composer.lock\e[0m"
+        echo
+        echo -e '\e[31mTo fix the issue:\e[0m'
+        echo -e "\e[31m1. Copy the composer.lock file from $out/composer.lock to the project's source:\e[0m"
+        echo -e "\e[31m  cp $out/composer.lock <path>\e[0m"
+        echo -e '\e[31m2. Add the composerLock attribute, pointing to the copied composer.lock file:\e[0m'
+        echo -e '\e[31m  composerLock = ./composer.lock;\e[0m'
         echo
 
         exit 1
@@ -51,15 +53,15 @@ composerInstallConfigureHook() {
     echo "Validating consistency between composer.lock and ${composerRepository}/composer.lock"
     if ! @cmp@ -s "composer.lock" "${composerRepository}/composer.lock"; then
         echo
-        echo "ERROR: vendorHash is out of date"
+        echo -e "\e[31mERROR: vendorHash is out of date\e[0m"
         echo
-        echo "composer.lock is not the same in $composerRepository"
+        echo -e "\e[31mcomposer.lock is not the same in $composerRepository\e[0m"
         echo
-        echo "To fix the issue:"
-        echo '1. Set vendorHash to an empty string: `vendorHash = "";`'
-        echo '2. Build the derivation and wait for it to fail with a hash mismatch'
-        echo '3. Copy the "got: sha256-..." value back into the vendorHash field'
-        echo '   You should have: vendorHash = "sha256-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=";'
+        echo -e "\e[31mTo fix the issue:\e[0m"
+        echo -e '\e[31m1. Set vendorHash to an empty string: `vendorHash = "";`\e[0m'
+        echo -e '\e[31m2. Build the derivation and wait for it to fail with a hash mismatch\e[0m'
+        echo -e '\e[31m3. Copy the "got: sha256-..." value back into the vendorHash field\e[0m'
+        echo -e '\e[31m   You should have: vendorHash = "sha256-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=";\e[0m'
         echo
 
         exit 1
@@ -105,7 +107,26 @@ composerInstallBuildHook() {
 composerInstallCheckHook() {
     echo "Executing composerInstallCheckHook"
 
-    composer validate --no-ansi --no-interaction
+    if ! composer validate --strict --no-ansi --no-interaction --quiet; then
+        if [ ! -z "${composerStrictValidation-}" ]; then
+            echo
+            echo -e "\e[31mERROR: composer files validation failed\e[0m"
+            echo
+            echo -e '\e[31mThe validation of the composer.json and composer.lock failed.\e[0m'
+            echo -e '\e[31mMake sure that the file composer.lock is consistent with composer.json.\e[0m'
+            echo
+            exit 1
+        else
+            echo
+            echo -e "\e[33mWARNING: composer files validation failed\e[0m"
+            echo
+            echo -e '\e[33mThe validation of the composer.json and composer.lock failed.\e[0m'
+            echo -e '\e[33mMake sure that the file composer.lock is consistent with composer.json.\e[0m'
+            echo
+            echo -e '\e[33mThis check is not blocking, but it is recommended to fix the issue.\e[0m'
+            echo
+        fi
+    fi
 
     echo "Finished composerInstallCheckHook"
 }

pkgs/build-support/php/hooks/composer-repository-hook.sh

@@ -3,6 +3,7 @@ declare version
 declare composerNoDev
 declare composerNoPlugins
 declare composerNoScripts
+declare composerStrictValidation
 
 preConfigureHooks+=(composerRepositoryConfigureHook)
 preBuildHooks+=(composerRepositoryBuildHook)
@@ -31,14 +32,16 @@ composerRepositoryConfigureHook() {
         cp composer.lock $out/
 
         echo
-        echo 'No composer.lock file found, consider adding one to your repository to ensure reproducible builds.'
-        echo "In the meantime, a composer.lock file has been generated for you in $out/composer.lock"
+        echo -e "\e[31mERROR: No composer.lock found\e[0m"
         echo
-        echo 'To fix the issue:'
-        echo "1. Copy the composer.lock file from $out/composer.lock to the project's source:"
-        echo "  cp $out/composer.lock <path>"
-        echo '2. Add the composerLock attribute, pointing to the copied composer.lock file:'
-        echo '  composerLock = ./composer.lock;'
+        echo -e '\e[31mNo composer.lock file found, consider adding one to your repository to ensure reproducible builds.\e[0m'
+        echo -e "\e[31mIn the meantime, a composer.lock file has been generated for you in $out/composer.lock\e[0m"
+        echo
+        echo -e '\e[31mTo fix the issue:\e[0m'
+        echo -e "\e[31m1. Copy the composer.lock file from $out/composer.lock to the project's source:\e[0m"
+        echo -e "\e[31m  cp $out/composer.lock <path>\e[0m"
+        echo -e '\e[31m2. Add the composerLock attribute, pointing to the copied composer.lock file:\e[0m'
+        echo -e '\e[31m  composerLock = ./composer.lock;\e[0m'
         echo
 
         exit 1
@@ -63,7 +66,26 @@ composerRepositoryBuildHook() {
 composerRepositoryCheckHook() {
     echo "Executing composerRepositoryCheckHook"
 
-    composer validate --no-ansi --no-interaction
+    if ! composer validate --strict --no-ansi --no-interaction --quiet; then
+        if [ ! -z "${composerStrictValidation-}" ]; then
+            echo
+            echo -e "\e[31mERROR: composer files validation failed\e[0m"
+            echo
+            echo -e '\e[31mThe validation of the composer.json and composer.lock failed.\e[0m'
+            echo -e '\e[31mMake sure that the file composer.lock is consistent with composer.json.\e[0m'
+            echo
+            exit 1
+        else
+            echo
+            echo -e "\e[33mWARNING: composer files validation failed\e[0m"
+            echo
+            echo -e '\e[33mThe validation of the composer.json and composer.lock failed.\e[0m'
+            echo -e '\e[33mMake sure that the file composer.lock is consistent with composer.json.\e[0m'
+            echo
+            echo -e '\e[33mThis check is not blocking, but it is recommended to fix the issue.\e[0m'
+            echo
+        fi
+    fi
 
     echo "Finished composerRepositoryCheckHook"
 }

pkgs/build-support/writers/data.nix

@@ -1,4 +1,4 @@
-{ lib, runCommand, dasel }:
+{ lib, pkgs, formats, runCommand, dasel }:
 let
   daselBin = lib.getExe dasel;
 
@@ -23,7 +23,7 @@ rec {
   #   writeJSON = makeDataWriter { input = builtins.toJSON; output = "cp $inputPath $out"; };
   #   myConfig = writeJSON "config.json" { hello = "world"; }
   #
-  makeDataWriter = { input ? lib.id, output ? "cp $inputPath $out" }: nameOrPath: data:
+  makeDataWriter = lib.warn "pkgs.writers.makeDataWriter is deprecated. Use pkgs.writeTextFile." ({ input ? lib.id, output ? "cp $inputPath $out" }: nameOrPath: data:
     assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
     let
       name = last (builtins.split "/" nameOrPath);
@@ -40,41 +40,25 @@ rec {
         mkdir -p $out/$(dirname "${nameOrPath}")
         mv tmp $out/${nameOrPath}
       ''}
-    '';
+    '');
 
-  # Writes the content to text.
-  #
-  # Example:
-  #   writeText "filename.txt" "file content"
-  writeText = makeDataWriter {
-    input = toString;
-    output = "cp $inputPath $out";
-  };
+  inherit (pkgs) writeText;
 
   # Writes the content to a JSON file.
   #
   # Example:
   #   writeJSON "data.json" { hello = "world"; }
-  writeJSON = makeDataWriter {
-    input = builtins.toJSON;
-    output = "${daselBin} -f $inputPath -r json -w json > $out";
-  };
+  writeJSON = (pkgs.formats.json {}).generate;
 
   # Writes the content to a TOML file.
   #
   # Example:
   #   writeTOML "data.toml" { hello = "world"; }
-  writeTOML = makeDataWriter {
-    input = builtins.toJSON;
-    output = "${daselBin} -f $inputPath -r json -w toml > $out";
-  };
+  writeTOML = (pkgs.formats.toml {}).generate;
 
   # Writes the content to a YAML file.
   #
   # Example:
   #   writeYAML "data.yaml" { hello = "world"; }
-  writeYAML = makeDataWriter {
-    input = builtins.toJSON;
-    output = "${daselBin} -f $inputPath -r json -w yaml > $out";
-  };
+  writeYAML = (pkgs.formats.yaml {}).generate;
 }

pkgs/build-support/writers/test.nix

@@ -7,6 +7,7 @@
 , python3Packages
 , pypy3Packages
 , runCommand
+, testers
 , writers
 , writeText
 }:
@@ -36,14 +37,7 @@ let
     let
       expectedFile = writeText "${file.name}-expected" expected;
     in
-    runCommand "run-${file.name}" {} ''
-      if ! diff -u ${file} ${expectedFile}; then
-        echo 'test ${file.name} failed'
-        exit 1
-      fi
-
-      touch $out
-    '';
+    testers.testEqualContents { expected = expectedFile; actual = file; assertion = "${file.name} matches"; };
 in
 lib.recurseIntoAttrs {
   bin = lib.recurseIntoAttrs {
@@ -261,7 +255,9 @@ lib.recurseIntoAttrs {
 
     toml = expectDataEqual {
       file = writeTOML "data.toml" { hello = "world"; };
-      expected = "hello = 'world'\n";
+      expected = ''
+        hello = "world"
+      '';
     };
 
     yaml = expectDataEqual {

pkgs/by-name/di/diesel-cli-ext/package.nix

@@ -19,6 +19,7 @@ rustPlatform.buildRustPackage rec {
     description = "Provides different tools for projects using the diesel_cli";
     homepage = "https://crates.io/crates/diesel_cli_ext";
     license = with licenses; [ asl20 mit ];
+    mainProgram = "diesel_ext";
     maintainers = with maintainers; [ siph ];
   };
 }

pkgs/by-name/fa/fantomas/package.nix

@@ -0,0 +1,17 @@
+{ buildDotnetGlobalTool, lib }:
+
+buildDotnetGlobalTool {
+  pname = "fantomas";
+  version = "6.2.2";
+
+  nugetSha256 = "sha256-r5F44iwAV3QSeh3TyGTVhrN2oL4A68eD5dKiz/VnwdI=";
+
+  meta = with lib; {
+    description = "F# source code formatter";
+    homepage = "https://github.com/fsprojects/fantomas";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mikaelfangel ];
+    mainProgram = "fantomas";
+  };
+}

pkgs/by-name/gr/grun/package.nix

@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, gtk2
+, pkg-config
+, autoreconfHook
+}:
+
+stdenv.mkDerivation {
+  pname = "grun";
+  version = "0.9.3";
+
+  src = fetchFromGitHub {
+    owner = "lrgc";
+    repo = "grun";
+    rev = "release_0_9_3";
+    hash = "sha256-VbvX0wrgMIPmPnu3aQdtQ6H0X3umi8aJ42QvmmeMrJ0=";
+  };
+
+  buildInputs = [
+    gtk2
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  meta = {
+    description = "An application launcher written in C and using GTK for the interface";
+    homepage = "https://github.com/lrgc/grun";
+    platforms = lib.platforms.linux;
+    license = with lib.licenses; [ gpl2Only ];
+    maintainers = with lib.maintainers; [ _3JlOy-PYCCKUi ];
+  };
+}
+

pkgs/by-name/pa/paper-age/package.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "paper-age";
-  version = "1.1.4";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "matiaskorhonen";
     repo = "paper-age";
     rev = "v${version}";
-    hash = "sha256-/8t+4iO+rYlc2WjjECq5mk8t0af/whmzatU63r9sO98=";
+    hash = "sha256-7dd1R41CDgkpFI8fUWCJfgz3lr22IjWQYW6vRYEFidc=";
   };
 
-  cargoHash = "sha256-lLY3PINWGpdnNojIPT+snvLJTH4UEM7JWXdqrOLxibY=";
+  cargoHash = "sha256-IJDV0dmOsA9gbVKGfPsN3TKJbox3JTNxldArQK6GPt8=";
 
   meta = with lib; {
     description = "Easy and secure paper backups of secrets";

pkgs/by-name/sy/systemctl-tui/package.nix

@@ -0,0 +1,30 @@
+{ lib
+, rustPlatform
+, fetchCrate
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "systemctl-tui";
+  version = "0.2.2";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-q/LzehMspiqxQOgALh1smhmL1803xr4GzIw9t+jE6NM=";
+  };
+
+  cargoHash = "sha256-GNuWag8Y1aSkBMzXcHpwfVU80zmhusLIOrKtZSe/jI0=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.AppKit
+  ];
+
+  meta = with lib; {
+    description = "A simple TUI for interacting with systemd services and their logs";
+    homepage = "https://crates.io/crates/systemctl-tui";
+    license = licenses.mit;
+    maintainers = with maintainers; [ siph ];
+    mainProgram = "systemctl-tui";
+  };
+}

pkgs/by-name/ui/uiua/package.nix

@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uiua";
-  version = "0.0.20";
+  version = "0.0.22";
 
   src = fetchFromGitHub {
     owner = "uiua-lang";
     repo = "uiua";
     rev = "refs/tags/${version}";
-    hash = "sha256-fFsMN+4ORB//Ch+wrRRMeZKXvW8ta5m66Vy3I3uyHO8=";
+    hash = "sha256-x1xZH+AVJqnvwxgBgcVB5LvDb54C+HnPBCTIqZ8Dv7E=";
   };
 
-  cargoHash = "sha256-old+U0sJWnp8wTiZBjcQ7+mv+6N15cpyyTDEjTUnghk=";
+  cargoHash = "sha256-gY+KeE2ATsCydpxcRoLtRDeyEvOGv7+I0SskLq8b9rw=";
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin [
     rustPlatform.bindgenHook

pkgs/data/themes/adw-gtk3/default.nix

@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "adw-gtk3";
-  version = "4.9";
+  version = "5.1";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ni1u6696jrwjYZ4gppF9yD1RAum0+D7WxQgu09cxVGg=";
+    sha256 = "sha256-vRB6+C27M4u7v10c6dqGsKpxHMGfpCSiScZ+8qlJRr0=";
   };
 
   nativeBuildInputs = [

pkgs/data/themes/whitesur/default.nix

@@ -33,13 +33,13 @@ lib.checkListOfEnum "${pname}: panel size" [ "default" "smaller" "bigger" ] (sin
 
 stdenv.mkDerivation rec {
   pname = "whitesur-gtk-theme";
-  version = "2023-06-30";
+  version = "2023-10-13";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ctEaS+zWkmiVoq0WVA3ecHc2rm8LFQC/kqi/KEXAyXw=";
+    sha256 = "sha256-H8QdKCX6C36J7AfFd0VV9Rnm8LGXSfkxj5Yp2p+PduE=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/qterminal/default.nix

@@ -43,6 +43,6 @@ mkDerivation rec {
     description = "A lightweight Qt-based terminal emulator";
     license = licenses.gpl2Plus;
     platforms = with platforms; unix;
-    maintainers = with maintainers; [ globin ] ++ teams.lxqt.members;
+    maintainers = with maintainers; teams.lxqt.members;
   };
 }

pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix

@@ -17,10 +17,10 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-notifyd";
-  version = "0.9.2";
+  version = "0.9.3";
   odd-unstable = false;
 
-  sha256 = "sha256-BHhz5LURXLeILxQ+iNQ+50yHd/oIF7twHAqxiBQ2hFE=";
+  sha256 = "sha256-kgTKJAUB/w/6vtNm2Ewb2v62t0kFK+T8e5Q3/nKwrMg=";
 
   buildInputs = [
     dbus

pkgs/development/beam-modules/elixir-ls/default.nix

@@ -4,12 +4,12 @@
 
 let
   pname = "elixir-ls";
-  version = "0.17.1";
+  version = "0.17.2";
   src = fetchFromGitHub {
     owner = "elixir-lsp";
     repo = "elixir-ls";
     rev = "v${version}";
-    hash = "sha256-xC6JfhqUNnTqKh1jEm3WshFB69ne97lZGVqlEUbDkk4=";
+    hash = "sha256-uWNBUHdXahOrwCA+lnq6s5rj9wjcNV+AXSk319SuVQs=";
     fetchSubmodules = true;
   };
 in

pkgs/development/compilers/flutter/wrapper.nix

@@ -177,6 +177,7 @@ in
     ++ lib.optionals supportsLinuxDesktop [ glib wrapGAppsHook ];
 
   passthru = flutter.passthru // {
+    inherit (flutter) version;
     unwrapped = flutter;
     inherit engineArtifacts;
   };

pkgs/development/compilers/rust/rustc.nix

@@ -263,7 +263,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.rust-lang.org/";
     description = "A safe, concurrent, practical language";
-    maintainers = with maintainers; [ globin havvy ] ++ teams.rust.members;
+    maintainers = with maintainers; [ havvy ] ++ teams.rust.members;
     license = [ licenses.mit licenses.asl20 ];
     platforms = [
       # Platforms with host tools from

pkgs/development/libraries/avro-c/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avro-c";
-  version = "1.11.2";
+  version = "1.11.3";
 
   src = fetchurl {
     url = "mirror://apache/avro/avro-${version}/c/avro-c-${version}.tar.gz";
-    sha256 = "sha256-nx+ZqXsmcS0tQ/5+ck8Z19vdXO81R4uuRqGSDfIEV/U=";
+    sha256 = "sha256-chfKrPt9XzRhF2ZHOmbC4nm8e/rxuimMfwSzsvulc2U=";
   };
 
   postPatch = ''

pkgs/development/libraries/bctoolbox/default.nix

@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bctoolbox";
-  version = "5.2.98";
+  version = "5.2.109";
 
   nativeBuildInputs = [
     cmake
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     group = "BC";
     repo = pname;
     rev = version;
-    hash = "sha256-j1vVd9UcwmP3tGGN6NApiMyOql8vYljTqj3CKor1Ckk=";
+    hash = "sha256-OwwSGzMFwR2ajUUgAy7ea/Q2pWxn3DO72W7ukcjBJnU=";
   };
 
   # Do not build static libraries

pkgs/development/libraries/libchamplain/default.nix

@@ -84,6 +84,6 @@ stdenv.mkDerivation rec {
     '';
 
     maintainers = teams.gnome.members ++ teams.pantheon.members;
-    platforms = platforms.gnu ++ platforms.linux; # arbitrary choice
+    platforms = platforms.unix;
   };
 }

pkgs/development/libraries/spdk/default.nix

@@ -1,5 +1,4 @@
 { lib, stdenv
-, fetchpatch
 , fetchFromGitHub
 , ncurses
 , python3
@@ -10,65 +9,70 @@
 , libuuid
 , numactl
 , openssl
-, fetchurl
+, pkg-config
+, zlib
+, libpcap
+, libnl
+, libelf
+, jansson
+, ensureNewerSourcesForZipFilesHook
 }:
 
-let
-  # The old version has some CVEs howver they should not affect SPDK's usage of the framework: https://github.com/NixOS/nixpkgs/pull/171648#issuecomment-1121964568
-  dpdk' = dpdk.overrideAttrs (old: rec {
-    name = "dpdk-21.11";
-    src = fetchurl {
-      url = "https://fast.dpdk.org/rel/${name}.tar.xz";
-      sha256 = "sha256-Mkbj7WjuKzaaXYviwGzxCKZp4Vf01Bxby7sha/Wr06E=";
-    };
-  });
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "spdk";
-  version = "21.10";
+
+  version = "23.09";
 
   src = fetchFromGitHub {
     owner = "spdk";
     repo = "spdk";
     rev = "v${version}";
-    sha256 = "sha256-pFynTbbSF1g58VD9bOhe3c4oCozeqE+35kECTQwDBDM=";
+    sha256 = "sha256-P10NDa+MIEY8B3bu34Dq2keyuv2a24XV5Wf+Ah701b8=";
+    fetchSubmodules = true;
   };
 
-  patches = [
-    # Backport of upstream patch for ncurses-6.3 support.
-    # Will be in next release after 21.10.
-    ./ncurses-6.3.patch
-
-    # DPDK 21.11 compatibility.
-    (fetchpatch {
-      url = "https://github.com/spdk/spdk/commit/f72cab94dd35d7b45ec5a4f35967adf3184ca616.patch";
-      sha256 = "sha256-sSetvyNjlM/hSOUsUO3/dmPzAliVcteNDvy34yM5d4A=";
-    })
-  ];
-
   nativeBuildInputs = [
     python3
+    python3.pkgs.setuptools
+    pkg-config
+    ensureNewerSourcesForZipFilesHook
   ];
 
   buildInputs = [
-    cunit dpdk' libaio libbsd libuuid numactl openssl ncurses
+    cunit
+    dpdk
+    jansson
+    libaio
+    libbsd
+    libelf
+    libuuid
+    libpcap
+    libnl
+    numactl
+    openssl
+    ncurses
+    zlib
+  ];
+
+  patches = [
+    # https://review.spdk.io/gerrit/c/spdk/spdk/+/20394
+    ./setuptools.patch
   ];
 
   postPatch = ''
     patchShebangs .
-
-    # glibc-2.36 adds arc4random, so we don't need the custom implementation
-    # here anymore. Fixed upstream in https://github.com/spdk/spdk/commit/43a3984c6c8fde7201d6c8dfe1b680cb88237269,
-    # but the patch doesn't apply here.
-    sed -i -e '1i #define HAVE_ARC4RANDOM 1' lib/iscsi/iscsi.c
   '';
 
   enableParallelBuilding = true;
 
-  configureFlags = [ "--with-dpdk=${dpdk'}" ];
+  configureFlags = [
+    "--with-dpdk=${dpdk}"
+    "--pydir=${placeholder "out"}/${python3.sitePackages}"
+  ];
 
   env.NIX_CFLAGS_COMPILE = "-mssse3"; # Necessary to compile.
   # otherwise does not find strncpy when compiling
-  NIX_LDFLAGS = "-lbsd";
+  env.NIX_LDFLAGS = "-lbsd";
 
   meta = with lib; {
     description = "Set of libraries for fast user-mode storage";

pkgs/development/libraries/spdk/ncurses-6.3.patch

@@ -1,48 +0,0 @@
-Backport of upstream https://review.spdk.io/gerrit/c/spdk/spdk/+/10300
---- a/app/spdk_top/spdk_top.c
-+++ b/app/spdk_top/spdk_top.c
-@@ -1012 +1012 @@ print_max_len(WINDOW *win, int row, uint16_t col, uint16_t max_len, enum str_ali
--	mvwprintw(win, row, col, tmp_str);
-+	mvwprintw(win, row, col, "%s", tmp_str);
-@@ -1944 +1944 @@ display_thread(struct rpc_thread_info *thread_info)
--	mvwprintw(thread_win, 3, THREAD_WIN_FIRST_COL + 6, "%" PRIu64,
-+	mvwprintw(thread_win, 3, THREAD_WIN_FIRST_COL + 6, "%d",
-@@ -1949 +1949 @@ display_thread(struct rpc_thread_info *thread_info)
--		mvwprintw(thread_win, 3, THREAD_WIN_FIRST_COL + 32, idle_time);
-+		mvwprintw(thread_win, 3, THREAD_WIN_FIRST_COL + 32, "%s", idle_time);
-@@ -1951 +1951 @@ display_thread(struct rpc_thread_info *thread_info)
--		mvwprintw(thread_win, 3, THREAD_WIN_FIRST_COL + 54, busy_time);
-+		mvwprintw(thread_win, 3, THREAD_WIN_FIRST_COL + 54, "%s", busy_time);
-@@ -1954 +1954 @@ display_thread(struct rpc_thread_info *thread_info)
--		mvwprintw(thread_win, 3, THREAD_WIN_FIRST_COL + 32, idle_time);
-+		mvwprintw(thread_win, 3, THREAD_WIN_FIRST_COL + 32, "%s", idle_time);
-@@ -1956 +1956 @@ display_thread(struct rpc_thread_info *thread_info)
--		mvwprintw(thread_win, 3, THREAD_WIN_FIRST_COL + 54, busy_time);
-+		mvwprintw(thread_win, 3, THREAD_WIN_FIRST_COL + 54, "%s", busy_time);
-@@ -2111 +2111 @@ show_core(uint8_t current_page)
--	mvwprintw(core_win, 5, CORE_WIN_FIRST_COL + 20, idle_time);
-+	mvwprintw(core_win, 5, CORE_WIN_FIRST_COL + 20, "%s", idle_time);
-@@ -2118 +2118 @@ show_core(uint8_t current_page)
--	mvwprintw(core_win, 7, CORE_WIN_FIRST_COL + 20, busy_time);
-+	mvwprintw(core_win, 7, CORE_WIN_FIRST_COL + 20, "%s", busy_time);
-@@ -2124 +2124 @@ show_core(uint8_t current_page)
--		mvwprintw(core_win, i + 10, 1, core_info->threads.thread[i].name);
-+		mvwprintw(core_win, i + 10, 1, "%s", core_info->threads.thread[i].name);
-@@ -2137 +2137 @@ show_core(uint8_t current_page)
--				mvwprintw(core_win, i + 10, 1, core_info->threads.thread[i].name);
-+				mvwprintw(core_win, i + 10, 1, "%s", core_info->threads.thread[i].name);
-@@ -2214 +2214 @@ show_poller(uint8_t current_page)
--	mvwprintw(poller_win, 3, POLLER_WIN_FIRST_COL,
-+	mvwprintw(poller_win, 3, POLLER_WIN_FIRST_COL, "%s",
-@@ -2216 +2216 @@ show_poller(uint8_t current_page)
--	mvwprintw(poller_win, 3, POLLER_WIN_FIRST_COL + 23, poller->thread_name);
-+	mvwprintw(poller_win, 3, POLLER_WIN_FIRST_COL + 23, "%s", poller->thread_name);
-@@ -2231 +2231 @@ show_poller(uint8_t current_page)
--		mvwprintw(poller_win, 4, POLLER_WIN_FIRST_COL + 23, poller_period);
-+		mvwprintw(poller_win, 4, POLLER_WIN_FIRST_COL + 23, "%s", poller_period);
-@@ -2264 +2264 @@ print_bottom_error_message(char *msg)
--	mvprintw(g_max_row - 1, g_max_col - strlen(msg) - 2, msg);
-+	mvprintw(g_max_row - 1, g_max_col - strlen(msg) - 2, "%s", msg);
-@@ -2434 +2434 @@ show_stats(pthread_t *data_thread)
--			mvprintw(g_max_row - 1, 1, current_page_str);
-+			mvprintw(g_max_row - 1, 1, "%s", current_page_str);

pkgs/development/libraries/spdk/setuptools.patch

@@ -0,0 +1,25 @@
+From 3a72290ba7e2d71ca887225fc0eb8792ca863be2 Mon Sep 17 00:00:00 2001
+From: Jörg Thalheim <joerg@thalheim.io>
+Date: Tue, 24 Oct 2023 14:30:53 +0200
+Subject: [PATCH] python: drop deprecated distutils
+
+This is scheduled for removal in python 3.12: https://docs.python.org/3/whatsnew/3.12.html
+
+Change-Id: I728dc0cf4ed20f22016d3d58cca8aee3af2bcd8b
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+
+diff --git a/python/setup.py b/python/setup.py
+index 47e2104..ae4dff7 100755
+--- a/python/setup.py
++++ b/python/setup.py
+@@ -2,8 +2,7 @@
+ # SPDX-License-Identifier: BSD-3-Clause
+ # Copyright (C) 2023 Intel Corporation.  All rights reserved.
+ 
+-from distutils.core import setup
+-from setuptools import find_packages
++from setuptools import setup, find_packages
+ from spdk import __version__
+ 
+ 

pkgs/development/libraries/waffle/default.nix

@@ -17,14 +17,14 @@
 
 stdenv.mkDerivation rec {
   pname = "waffle";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "waffle";
     rev = "v${version}";
-    sha256 = "sha256-dwDNMLgZrILb559yGs4sNA7D+nD60972+JOy0PKfL0w=";
+    sha256 = "sha256-GVULv/TkCS9CgSFWlskIamw5Z402n684G6jeTLMCPNc=";
   };
 
   buildInputs = [

pkgs/development/libraries/xeus-zmq/default.nix

@@ -13,13 +13,13 @@
 
 clangStdenv.mkDerivation rec {
   pname = "xeus-zmq";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "jupyter-xeus";
     repo = "xeus-zmq";
     rev = "${version}";
-    hash = "sha256-j23NPgqwjQ7x4QriCb+N7CtBWhph+pCmBC0AULEDL1U=";
+    hash = "sha256-sfGXo6CPJu5TJrkecLLoaQxrGaJbeQG+QiCkltAwuI8=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/xeus/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xeus";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "jupyter-xeus";
     repo = pname;
     rev = version;
-    sha256 = "sha256-bSZ5ImgFztiNYGrn513LLm4OtO1hYGak3xAsBN224g8=";
+    sha256 = "sha256-kGIVcsgLG6weNfBwgEVTMa8NA9MXSztzi9ML5/gDqAQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/zchunk/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zchunk";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "zchunk";
     repo = pname;
     rev = version;
-    hash = "sha256-mZc8DC26c4hZzHsozhBmuvaIjL3ifQ7GYYGDEsBBPKc=";
+    hash = "sha256-wmbnkxJHFyqntULxzXF16lt+TfwywLdZamQXvcfSFVM=";
   };
 
   nativeBuildInputs = [

pkgs/development/ocaml-modules/janestreet/0.15.nix

@@ -3,6 +3,7 @@
 , fetchpatch
 , fzf
 , lib
+, ocaml
 , openssl
 , zstd
 }:
@@ -264,6 +265,7 @@ with self;
     buildInputs = [ jst-config ];
     propagatedBuildInputs = [ base base_bigstring base_quickcheck ppx_jane time_now ];
     doCheck = false; # circular dependency with core_kernel
+    meta.broken = lib.versionAtLeast ocaml.version "5.1";
   };
 
   core_bench = janePackage {