Merge master into haskell-updates

2024-10-02 02:27:33 +03:00 · 2023-02-16 00:13:54 +00:00 · 2023-02-16 00:13:54 +00:00 · dd816c8cfd
commit dd816c8cfd
parent 066aaaf121 383cd683b6
124 changed files with 1730 additions and 567 deletions
--- a/doc/languages-frameworks/pkg-config.section.md
+++ b/doc/languages-frameworks/pkg-config.section.md
@ -6,7 +6,7 @@ Nixpkgs provides a couple of facilities for working with this tool.

 ## Writing packages providing pkg-config modules

-Packages should set `meta.pkgConfigProvides` with the list of package config modules they provide.
+Packages should set `meta.pkgConfigModules` with the list of package config modules they provide.
 They should also use `testers.testMetaPkgConfig` to check that the final built package matches that list.
 Additionally, the [`validatePkgConfig` setup hook](https://nixos.org/manual/nixpkgs/stable/#validatepkgconfig), will do extra checks on to-be-installed pkg-config modules.

--- a/lib/systems/architectures.nix
+++ b/lib/systems/architectures.nix
@ -40,14 +40,21 @@ rec {
  # a superior CPU has all the features of an inferior and is able to build and test code for it
  inferiors = {
    # x86_64 Intel
+    # https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
    default        = [ ];
    westmere       = [ ];
-    sandybridge    = [ "westmere"    ] ++ inferiors.westmere;
-    ivybridge      = [ "sandybridge" ] ++ inferiors.sandybridge;
-    haswell        = [ "ivybridge"   ] ++ inferiors.ivybridge;
-    broadwell      = [ "haswell"     ] ++ inferiors.haswell;
-    skylake        = [ "broadwell"   ] ++ inferiors.broadwell;
-    skylake-avx512 = [ "skylake"     ] ++ inferiors.skylake;
+    sandybridge    = [ "westmere"       ] ++ inferiors.westmere;
+    ivybridge      = [ "sandybridge"    ] ++ inferiors.sandybridge;
+    haswell        = [ "ivybridge"      ] ++ inferiors.ivybridge;
+    broadwell      = [ "haswell"        ] ++ inferiors.haswell;
+    skylake        = [ "broadwell"      ] ++ inferiors.broadwell;
+    skylake-avx512 = [ "skylake"        ] ++ inferiors.skylake;
+    cannonlake     = [ "skylake-avx512" ] ++ inferiors.skylake-avx512;
+    icelake-client = [ "cannonlake"     ] ++ inferiors.cannonlake;
+    icelake-server = [ "icelake-client" ] ++ inferiors.icelake-client;
+    cascadelake    = [ "skylake-avx512" ] ++ inferiors.cannonlake;
+    cooperlake     = [ "cascadelake"    ] ++ inferiors.cascadelake;
+    tigerlake      = [ "icelake-server" ] ++ inferiors.icelake-server;

    # x86_64 AMD
    # TODO: fill this (need testing)
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -36,6 +36,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [imaginary](https://github.com/h2non/imaginary), a microservice for high-level image processing that Nextcloud can use to generate previews. Available as [services.imaginary](#opt-services.imaginary.enable).

+- [opensearch](https://opensearch.org), a search server alternative to Elasticsearch. Available as [services.opensearch](options.html#opt-services.opensearch.enable).
+
 - [goeland](https://github.com/slurdge/goeland), an alternative to rss2email written in golang with many filters. Available as [services.goeland](#opt-services.goeland.enable).

 - [atuin](https://github.com/ellie/atuin), a sync server for shell history. Available as [services.atuin](#opt-services.atuin.enable).
@ -66,6 +68,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `borgbackup` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.borgbackup.jobs.<name>.inhibitsSleep`](#opt-services.borgbackup.jobs._name_.inhibitsSleep).

+- The `ssh` client tool now disables the `~C` escape sequence by default. This can be re-enabled by setting `EnableEscapeCommandline yes`
+
 - `podman` now uses the `netavark` network stack. Users will need to delete all of their local containers, images, volumes, etc, by running `podman system reset --force` once before upgrading their systems.

 - `git-bug` has been updated to at least version 0.8.0, which includes backwards incompatible changes. The `git-bug-migration` package can be used to upgrade existing repositories.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1048,6 +1048,7 @@
  ./services/search/hound.nix
  ./services/search/kibana.nix
  ./services/search/meilisearch.nix
+  ./services/search/opensearch.nix
  ./services/search/solr.nix
  ./services/security/aesmd.nix
  ./services/security/certmgr.nix
--- a/nixos/modules/services/search/opensearch.nix
+++ b/nixos/modules/services/search/opensearch.nix
@ -0,0 +1,244 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.opensearch;
+
+  settingsFormat = pkgs.formats.yaml {};
+
+  configDir = cfg.dataDir + "/config";
+
+  usingDefaultDataDir = cfg.dataDir == "/var/lib/opensearch";
+  usingDefaultUserAndGroup = cfg.user == "opensearch" && cfg.group == "opensearch";
+
+  opensearchYml = settingsFormat.generate "opensearch.yml" cfg.settings;
+
+  loggingConfigFilename = "log4j2.properties";
+  loggingConfigFile = pkgs.writeTextFile {
+    name = loggingConfigFilename;
+    text = cfg.logging;
+  };
+in
+{
+
+  options.services.opensearch = {
+    enable = mkEnableOption (lib.mdDoc "OpenSearch");
+
+    package = lib.mkPackageOptionMD pkgs "OpenSearch" {
+      default = [ "opensearch" ];
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        options."network.host" = lib.mkOption {
+          type = lib.types.str;
+          default = "127.0.0.1";
+          description = lib.mdDoc ''
+            Which port this service should listen on.
+          '';
+        };
+
+        options."cluster.name" = lib.mkOption {
+          type = lib.types.str;
+          default = "opensearch";
+          description = lib.mdDoc ''
+            The name of the cluster.
+          '';
+        };
+
+        options."discovery.type" = lib.mkOption {
+          type = lib.types.str;
+          default = "single-node";
+          description = lib.mdDoc ''
+            The type of discovery to use.
+          '';
+        };
+
+        options."http.port" = lib.mkOption {
+          type = lib.types.port;
+          default = 9200;
+          description = lib.mdDoc ''
+            The port to listen on for HTTP traffic.
+          '';
+        };
+
+        options."transport.port" = lib.mkOption {
+          type = lib.types.port;
+          default = 9300;
+          description = lib.mdDoc ''
+            The port to listen on for transport traffic.
+          '';
+        };
+      };
+
+      default = {};
+
+      description = lib.mdDoc ''
+        OpenSearch configuration.
+      '';
+    };
+
+    logging = lib.mkOption {
+      description = lib.mdDoc "opensearch logging configuration.";
+
+      default = ''
+        logger.action.name = org.opensearch.action
+        logger.action.level = info
+
+        appender.console.type = Console
+        appender.console.name = console
+        appender.console.layout.type = PatternLayout
+        appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n
+
+        rootLogger.level = info
+        rootLogger.appenderRef.console.ref = console
+      '';
+      type = types.str;
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/opensearch";
+      apply = converge (removeSuffix "/");
+      description = lib.mdDoc ''
+        Data directory for OpenSearch. If you change this, you need to
+        manually create the directory. You also need to create the
+        `opensearch` user and group, or change
+        [](#opt-services.opensearch.user) and
+        [](#opt-services.opensearch.group) to existing ones with
+        access to the directory.
+      '';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "opensearch";
+      description = lib.mdDoc ''
+        The user OpenSearch runs as. Should be left at default unless
+        you have very specific needs.
+      '';
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "opensearch";
+      description = lib.mdDoc ''
+        The group OpenSearch runs as. Should be left at default unless
+        you have very specific needs.
+      '';
+    };
+
+    extraCmdLineOptions = lib.mkOption {
+      description = lib.mdDoc "Extra command line options for the OpenSearch launcher.";
+      default = [ ];
+      type = lib.types.listOf lib.types.str;
+    };
+
+    extraJavaOptions = lib.mkOption {
+      description = lib.mdDoc "Extra command line options for Java.";
+      default = [ ];
+      type = lib.types.listOf lib.types.str;
+      example = [ "-Djava.net.preferIPv4Stack=true" ];
+    };
+
+    restartIfChanged = lib.mkOption {
+      type = lib.types.bool;
+      description = lib.mdDoc ''
+        Automatically restart the service on config change.
+        This can be set to false to defer restarts on a server or cluster.
+        Please consider the security implications of inadvertently running an older version,
+        and the possibility of unexpected behavior caused by inconsistent versions across a cluster when disabling this option.
+      '';
+      default = true;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.opensearch = {
+      description = "OpenSearch Daemon";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      path = [ pkgs.inetutils ];
+      inherit (cfg) restartIfChanged;
+      environment = {
+        OPENSEARCH_HOME = cfg.dataDir;
+        OPENSEARCH_JAVA_OPTS = toString cfg.extraJavaOptions;
+        OPENSEARCH_PATH_CONF = configDir;
+      };
+      serviceConfig = {
+        ExecStartPre =
+          let
+            startPreFullPrivileges = ''
+              set -o errexit -o pipefail -o nounset -o errtrace
+              shopt -s inherit_errexit
+            '' + (optionalString (!config.boot.isContainer) ''
+              # Only set vm.max_map_count if lower than ES required minimum
+              # This avoids conflict if configured via boot.kernel.sysctl
+              if [ $(${pkgs.procps}/bin/sysctl -n vm.max_map_count) -lt 262144 ]; then
+                ${pkgs.procps}/bin/sysctl -w vm.max_map_count=262144
+              fi
+            '');
+            startPreUnprivileged = ''
+              set -o errexit -o pipefail -o nounset -o errtrace
+              shopt -s inherit_errexit
+
+              # Install plugins
+              ln -sfT ${cfg.package}/lib ${cfg.dataDir}/lib
+              ln -sfT ${cfg.package}/modules ${cfg.dataDir}/modules
+
+              # opensearch needs to create the opensearch.keystore in the config directory
+              # so this directory needs to be writable.
+              mkdir -p ${configDir}
+              chmod 0700 ${configDir}
+
+              # Note that we copy config files from the nix store instead of symbolically linking them
+              # because otherwise X-Pack Security will raise the following exception:
+              # java.security.AccessControlException:
+              # access denied ("java.io.FilePermission" "/var/lib/opensearch/config/opensearch.yml" "read")
+
+              cp ${opensearchYml} ${configDir}/opensearch.yml
+
+              # Make sure the logging configuration for old OpenSearch versions is removed:
+              rm -f "${configDir}/logging.yml"
+              cp ${loggingConfigFile} ${configDir}/${loggingConfigFilename}
+              mkdir -p ${configDir}/scripts
+              cp ${cfg.package}/config/jvm.options ${configDir}/jvm.options
+
+              # redirect jvm logs to the data directory
+              mkdir -p ${cfg.dataDir}/logs
+              chmod 0700 ${cfg.dataDir}/logs
+              sed -e '#logs/gc.log#${cfg.dataDir}/logs/gc.log#' -i ${configDir}/jvm.options
+            '';
+          in [
+            "+${pkgs.writeShellScript "opensearch-start-pre-full-privileges" startPreFullPrivileges}"
+            "${pkgs.writeShellScript "opensearch-start-pre-unprivileged" startPreUnprivileged}"
+          ];
+        ExecStartPost = pkgs.writeShellScript "opensearch-start-post" ''
+          set -o errexit -o pipefail -o nounset -o errtrace
+          shopt -s inherit_errexit
+
+          # Make sure opensearch is up and running before dependents
+          # are started
+          while ! ${pkgs.curl}/bin/curl -sS -f http://${cfg.settings."network.host"}:${toString cfg.settings."http.port"} 2>/dev/null; do
+            sleep 1
+          done
+        '';
+        ExecStart = "${cfg.package}/bin/opensearch ${toString cfg.extraCmdLineOptions}";
+        User = cfg.user;
+        Group = cfg.group;
+        LimitNOFILE = "1024000";
+        Restart = "always";
+        TimeoutStartSec = "infinity";
+        DynamicUser = usingDefaultUserAndGroup && usingDefaultDataDir;
+      } // (optionalAttrs (usingDefaultDataDir) {
+        StateDirectory = "opensearch";
+        StateDirectoryMode = "0700";
+      });
+    };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -490,6 +490,7 @@ in {
  ombi = handleTest ./ombi.nix {};
  openarena = handleTest ./openarena.nix {};
  openldap = handleTest ./openldap.nix {};
+  opensearch = discoverTests (import ./opensearch.nix);
  openresty-lua = handleTest ./openresty-lua.nix {};
  opensmtpd = handleTest ./opensmtpd.nix {};
  opensmtpd-rspamd = handleTest ./opensmtpd-rspamd.nix {};
--- a/nixos/tests/opensearch.nix
+++ b/nixos/tests/opensearch.nix
@ -0,0 +1,52 @@
+let
+  opensearchTest =
+    import ./make-test-python.nix (
+      { pkgs, lib, extraSettings ? {} }: {
+        name = "opensearch";
+        meta.maintainers = with pkgs.lib.maintainers; [ shyim ];
+
+        nodes.machine = lib.mkMerge [
+          {
+            virtualisation.memorySize = 2048;
+            services.opensearch.enable = true;
+          }
+          extraSettings
+        ];
+
+        testScript = ''
+          machine.start()
+          machine.wait_for_unit("opensearch.service")
+          machine.wait_for_open_port(9200)
+
+          machine.succeed(
+              "curl --fail localhost:9200"
+          )
+        '';
+      });
+in
+{
+  opensearch = opensearchTest {};
+  opensearchCustomPathAndUser = opensearchTest {
+    extraSettings = {
+      services.opensearch.dataDir = "/var/opensearch_test";
+      services.opensearch.user = "open_search";
+      services.opensearch.group = "open_search";
+      system.activationScripts.createDirectory = {
+        text = ''
+          mkdir -p "/var/opensearch_test"
+          chown open_search:open_search /var/opensearch_test
+          chmod 0700 /var/opensearch_test
+        '';
+        deps = [ "users" "groups" ];
+      };
+      users = {
+        groups.open_search = {};
+        users.open_search = {
+          description = "OpenSearch daemon user";
+          group = "open_search";
+          isSystemUser = true;
+        };
+      };
+    };
+  };
+}
--- a/pkgs/applications/audio/listenbrainz-mpd/default.nix
+++ b/pkgs/applications/audio/listenbrainz-mpd/default.nix
@ -0,0 +1,35 @@
+{ lib
+, rustPlatform
+, fetchFromGitea
+, pkg-config
+, stdenv
+, openssl
+, libiconv
+, Security }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "listenbrainz-mpd";
+  version = "2.0.2";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "elomatreb";
+    repo = "listenbrainz-mpd";
+    rev = "v${version}";
+    hash = "sha256-DO7YUqaJZyVWjiAZ9WIVNTTvOU0qdsI2ct7aT/6O5dQ=";
+  };
+
+  cargoHash = "sha256-MiAalxe0drRHrST3maVvi8GM2y3d0z4Zl7R7Zx8VjEM=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = if stdenv.isDarwin then [ libiconv Security ] else [ openssl ];
+
+  meta = with lib; {
+    homepage = "https://codeberg.org/elomatreb/listenbrainz-mpd";
+    changelog = "https://codeberg.org/elomatreb/listenbrainz-mpd/src/tag/v${version}/CHANGELOG.md";
+    description = "ListenBrainz submission client for MPD";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ DeeUnderscore ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -927,8 +927,8 @@ let
        mktplcRef = {
          name = "gitlens";
          publisher = "eamodio";
-          version = "2023.2.1204";
-          sha256 = "sha256-FurYfkw+mOjyymR1VCGf0jJ2JCZJ8eGb1J7zD2peBjw=";
+          version = "2023.2.1404";
+          sha256 = "sha256-hszwiETLDKqV4yqchPA1o3WuAgvmY2AwslvvbAhkRCE=";
        };
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@ -1375,8 +1375,8 @@ let
        mktplcRef = {
          name = "todo-tree";
          publisher = "Gruntfuggly";
-          version = "0.0.220";
-          sha256 = "06kzb4msfdv11lij4dwbn1vxdxhvnpfcjqw0gvydgkqjy7dridjk";
+          version = "0.0.224";
+          sha256 = "sha256-ObFmzAaOlbtWC31JRYR/1y+JK1h22SVDPPRWWqPzrQs=";
        };
        meta = with lib; {
          license = licenses.mit;
@ -1555,8 +1555,8 @@ let
        mktplcRef = {
          name = "svg";
          publisher = "jock";
-          version = "1.4.23";
-          sha256 = "11f1g4a8v8330ki4240bvg5zpydagg1dwqfh1sar9ds7p1795ims";
+          version = "1.5.0";
+          sha256 = "sha256-anIZxqO4pK77FmhUamRnJVN2q8FifH6ffqRE2eFwyWM=";
        };
        meta = with lib; {
          license = licenses.mit;
@ -1865,8 +1865,8 @@ let
        mktplcRef = {
          name = "vscode-docker";
          publisher = "ms-azuretools";
-          version = "1.22.2";
-          sha256 = "13scns5iazzsjx8rli311ym2z8i8f4nvbcd5w8hqj5z0rzsds6xi";
+          version = "1.23.3";
+          sha256 = "sha256-0qflugzWA1pV0PVWGTzOjdxM/0G8hTLOozoXCAdQnRY=";
        };
        meta = {
          license = lib.licenses.mit;
@ -1929,8 +1929,8 @@ let
        mktplcRef = {
          name = "PowerShell";
          publisher = "ms-vscode";
-          version = "2022.11.0";
-          sha256 = "01pq84rqh2q6rd0ljfql37q6i1kg597qy0mr7fiz5ddi15zcfn19";
+          version = "2023.1.0";
+          sha256 = "sha256-OiVb88BGvzsPTzKU1rGLGSMQSwKV4zI9FthOmutz34U=";
        };
        meta = with lib; {
          description = "A Visual Studio Code extension for PowerShell language support";
@ -2146,8 +2146,8 @@ let
        mktplcRef = {
          name = "java";
          publisher = "redhat";
-          version = "1.14.2022120303";
-          sha256 = "sha256-tlWb2rkDcEWgdpuidkBGN5Nxr3pmkYxnPJN/UdbQfEw=";
+          version = "1.15.2023021403";
+          sha256 = "sha256-g56+nproGC8zHidyf1Tqz0kbJrmrkgOsDA5jqaZULas=";
        };
        buildInputs = [ jdk ];
        meta = {
@ -2226,8 +2226,8 @@ let
        mktplcRef = {
          name = "material-icon-theme";
          publisher = "PKief";
-          version = "4.22.0";
-          sha256 = "0irrivfidgjqfd205gh27r2ccj2anvqgvq7lfaaf92wrrc2zvlsk";
+          version = "4.24.0";
+          sha256 = "sha256-hJy+ymnlF9a2vvN/HhJ5N75lIc2afzkq+S0Cv/KnD3M=";
        };
        meta = {
          license = lib.licenses.mit;
@ -2737,8 +2737,8 @@ let
        mktplcRef = {
          name = "pdf";
          publisher = "tomoki1207";
-          version = "1.2.0";
-          sha256 = "1bcj546bp0w4yndd0qxwr8grhiwjd1jvf33jgmpm0j96y34vcszz";
+          version = "1.2.2";
+          sha256 = "sha256-i3Rlizbw4RtPkiEsodRJEB3AUzoqI95ohyqZ0ksROps=";
        };
        meta = {
          description = "Show PDF preview in VSCode";
--- a/pkgs/applications/editors/vscode/extensions/vscodeEnv.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscodeEnv.nix
@ -25,8 +25,7 @@
 }:
 let
  mutableExtensionsFilePath = toString mutableExtensionsFile;
-  mutableExtensions = if builtins.pathExists mutableExtensionsFile
-                      then import mutableExtensionsFilePath else [];
+  mutableExtensions = lib.optionals builtins.pathExists mutableExtensionsFile (import mutableExtensionsFilePath);
  vscodeWithConfiguration = import ./vscodeWithConfiguration.nix {
    inherit lib writeShellScriptBin extensionsFromVscodeMarketplace;
    vscodeDefault = vscode;
--- a/pkgs/applications/file-managers/spacefm/default.nix
+++ b/pkgs/applications/file-managers/spacefm/default.nix
@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    gtk3 udev desktop-file-utils shared-mime-info
    wrapGAppsHook ffmpegthumbnailer jmtpfs lsof udisks2
-  ] ++ (if ifuseSupport then [ ifuse ] else []);
+  ] ++ (lib.optionals ifuseSupport [ ifuse ]);
  # Introduced because ifuse doesn't build due to CVEs in libplist
  # Revert when libplist builds again…

--- a/pkgs/applications/kde/kdevelop/wrapper.nix
+++ b/pkgs/applications/kde/kdevelop/wrapper.nix
@ -1,7 +1,7 @@
-{ symlinkJoin, kdevelop-unwrapped, plugins ? null }:
+{ lib, symlinkJoin, kdevelop-unwrapped, plugins ? null }:

 symlinkJoin {
  name = "kdevelop-with-plugins";

-  paths = [ kdevelop-unwrapped ] ++ (if plugins != null then plugins else []);
+  paths = [ kdevelop-unwrapped ] ++ (lib.optionals (plugins != null) plugins);
 }
--- a/pkgs/applications/misc/auto-multiple-choice/default.nix
+++ b/pkgs/applications/misc/auto-multiple-choice/default.nix
@ -42,8 +42,14 @@ stdenv.mkDerivation rec {
    # Relative paths.
    "BINDIR=/bin"
    "PERLDIR=/share/perl5"
-    "MODSDIR=/nonexistent" # AMC will test for that dir before
-    # defaulting to the "portable" strategy, so this test *must* fail.
+    "MODSDIR=/lib" # At runtime, AMC will test for that dir before
+    # defaulting to the "portable" strategy we use, so this test
+    # *must* fail.  *But* this variable cannot be set to anything but
+    # "/lib" , because that name is hardcoded in the main executable
+    # and this variable controls both both the path AMC will check at
+    # runtime, AND the path where the actual modules will be stored at
+    # build-time.  This has been reported upstream as
+    # https://project.auto-multiple-choice.net/issues/872
    "TEXDIR=/tex/latex/" # what texlive.combine expects
    "TEXDOCDIR=/share/doc/texmf/" # TODO where to put this?
    "MAN1DIR=/share/man/man1"
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -22,6 +22,7 @@
 , qtbase
 , qtwayland
 , removeReferencesTo
+, speechd
 , sqlite
 , wrapQtAppsHook
 , xdg-utils
@ -121,6 +122,7 @@ stdenv.mkDerivation rec {
      regex
      sip
      setuptools
+      speechd
      zeroconf
      jeepney
      pycryptodome
--- a/pkgs/applications/misc/vhs/default.nix
+++ b/pkgs/applications/misc/vhs/default.nix
@ -1,4 +1,4 @@
-{ lib, buildGoModule, installShellFiles, fetchFromGitHub, ffmpeg, ttyd, makeWrapper }:
+{ lib, buildGoModule, installShellFiles, fetchFromGitHub, ffmpeg, ttyd, chromium, makeWrapper }:

 buildGoModule rec {
  pname = "vhs";
@ -14,12 +14,11 @@ buildGoModule rec {
  vendorHash = "sha256-9nkRr5Jh1nbI+XXbPj9KB0ZbLybv5JUVovpB311fO38=";

  nativeBuildInputs = [ installShellFiles makeWrapper ];
-  buildInputs = [ ttyd ffmpeg ];

  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];

  postInstall = ''
-    wrapProgram $out/bin/vhs --prefix PATH : ${lib.makeBinPath [ ffmpeg ttyd ]}
+    wrapProgram $out/bin/vhs --prefix PATH : ${lib.makeBinPath [ chromium ffmpeg ttyd ]}
    $out/bin/vhs man > vhs.1
    installManPage vhs.1
    installShellCompletion --cmd vhs \
--- a/pkgs/applications/misc/zine/default.nix
+++ b/pkgs/applications/misc/zine/default.nix
@ -10,14 +10,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "zine";
-  version = "0.10.0";
+  version = "0.10.1";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-hkBQ9WaWJrDhGAt35yueINutc7sAMbgbr8Iw5h0Ey4I=";
+    sha256 = "sha256-3xFJ7v/IZQ3yfU0D09sFXV+4XKRau+Mj3BNxkeUjbbU=";
  };

-  cargoSha256 = "sha256-rY7WHgd5wyx7TUgJamzre8HjeI0BRtaM14V3doCkfVY=";
+  cargoHash = "sha256-3Sw/USfGJuf6JGSR3Xkjnmm/UR7NK8rB8St48b4WpIM=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@ -90,9 +90,7 @@ mkChromiumDerivation (base: rec {
    license = if enableWideVine then lib.licenses.unfree else lib.licenses.bsd3;
    platforms = lib.platforms.linux;
    mainProgram = "chromium";
-    hydraPlatforms = if (channel == "stable" || channel == "ungoogled-chromium")
-      then ["aarch64-linux" "x86_64-linux"]
-      else [];
+    hydraPlatforms = lib.optionals (channel == "stable" || channel == "ungoogled-chromium") ["aarch64-linux" "x86_64-linux"];
    timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
  };
 })
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -98,7 +98,7 @@ let

      usesNixExtensions = nixExtensions != null;

-      nameArray = builtins.map(a: a.name) (if usesNixExtensions then nixExtensions else []);
+      nameArray = builtins.map(a: a.name) (lib.optionals usesNixExtensions nixExtensions);

      requiresSigning = browser ? MOZ_REQUIRE_SIGNING
                     -> toString browser.MOZ_REQUIRE_SIGNING != "";
@ -114,7 +114,7 @@ let
        throw "nixExtensions has an invalid entry. Missing extid attribute. Please use fetchfirefoxaddon"
        else
        a
-      ) (if usesNixExtensions then nixExtensions else []);
+      ) (lib.optionals usesNixExtensions nixExtensions);

      enterprisePolicies =
      {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -173,11 +173,11 @@
    "vendorHash": "sha256-foMmZbNPLww1MN4UZwuynBDgt2w40aMqVINRw//Q0d0="
  },
  "brightbox": {
-    "hash": "sha256-ISK6cpE4DVrVzjC0N5BdyR3Z5LfF9qfg/ACTgDP+WqY=",
+    "hash": "sha256-YmgzzDLNJg7zm8smboI0gE2kOgjb2RwPf5v1CbzgvGA=",
    "homepage": "https://registry.terraform.io/providers/brightbox/brightbox",
    "owner": "brightbox",
    "repo": "terraform-provider-brightbox",
-    "rev": "v3.2.0",
+    "rev": "v3.2.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-IiP1LvAX8fknB56gJoI75kGGkRIIoSfpmPkoTxujVDU="
  },
@ -438,24 +438,24 @@
    "vendorHash": "sha256-aVbJT31IIgW0GYzwVX7kT4j7E+dadSbnttThh2lzGyE="
  },
  "google": {
-    "hash": "sha256-z5Fi+ac7dcDr/eTTJWWfsIm9tJJ+NgcY2L08h317G7g=",
+    "hash": "sha256-WE1UjyqsrhlGWJHZ6VlNCBtdSsXM6ewK4WJrmqFN6NU=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.53.0",
+    "rev": "v4.53.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-glxBI4e5BN28GMGeixUSiCaDTIlr+8e4QHnzaDagyno="
+    "vendorHash": "sha256-oModEw/gaQCDHLf+2EKf1O1HQSGWnqEReXowE6F7W0o="
  },
  "google-beta": {
-    "hash": "sha256-0NCndgGz/xrYNvWjs49u//VXvndw0RFyAINnGUTKQ4s=",
+    "hash": "sha256-eXIYVB3YzhJNjYNR1oB7bj5uGZgRhgMD5eWxLls6KoE=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.53.0",
+    "rev": "v4.53.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-glxBI4e5BN28GMGeixUSiCaDTIlr+8e4QHnzaDagyno="
+    "vendorHash": "sha256-oModEw/gaQCDHLf+2EKf1O1HQSGWnqEReXowE6F7W0o="
  },
  "googleworkspace": {
    "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@ -494,11 +494,11 @@
    "vendorHash": "sha256-/dsiIxgW4BxSpRtnD77NqtkxEEAXH1Aj5hDCRSdiDYg="
  },
  "helm": {
-    "hash": "sha256-MSBCn4AriAWys2FIYJIGamcaLGx0gtO5IiB/WxcN2rg=",
+    "hash": "sha256-X9keFjAmV86F/8ktxiv/VrnkHOazP9e/aOC9aRw1A48=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/helm",
    "owner": "hashicorp",
    "repo": "terraform-provider-helm",
-    "rev": "v2.8.0",
+    "rev": "v2.9.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1045,13 +1045,13 @@
    "vendorHash": "sha256-NO1r/EWLgH1Gogru+qPeZ4sW7FuDENxzNnpLSKstnE8="
  },
  "spotinst": {
-    "hash": "sha256-UivENbjPajJdH9PwHznMP+cLXBJ8C38wgHS2IqyoqRk=",
+    "hash": "sha256-5irTp8teFShAd0FV2fIKf4dE9WokmxK3rREEozinQZM=",
    "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
    "owner": "spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.97.0",
+    "rev": "v1.99.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-iQLZpSa1gJ4z2/r1Om9vFrcKP5ik7kcx+rNVZLhmSBc="
+    "vendorHash": "sha256-yuGUEy9us2BL2v06tL3XDcpCujQk8H2DUzQiJQQNsvo="
  },
  "stackpath": {
    "hash": "sha256-nTR9HgSmuNCt7wxE4qqIH2+HA2igzqVx0lLRx6FoKrE=",
--- a/pkgs/applications/plasma-mobile/default.nix
+++ b/pkgs/applications/plasma-mobile/default.nix
@ -78,6 +78,7 @@ let
      plasma-phonebook = callPackage ./plasma-phonebook.nix {};
      plasma-settings = callPackage ./plasma-settings.nix {};
      plasmatube = callPackage ./plasmatube {};
+      qmlkonsole = callPackage ./qmlkonsole.nix {};
      spacebar = callPackage ./spacebar.nix { inherit srcs; };
      tokodon = callPackage ./tokodon.nix {};
    };
--- a/pkgs/applications/plasma-mobile/qmlkonsole.nix
+++ b/pkgs/applications/plasma-mobile/qmlkonsole.nix
@ -0,0 +1,42 @@
+{ lib
+, mkDerivation
+
+, cmake
+, extra-cmake-modules
+
+, kconfig
+, ki18n
+, kirigami-addons
+, kirigami2
+, kcoreaddons
+, qtquickcontrols2
+, kwindowsystem
+, qmltermwidget
+}:
+
+mkDerivation {
+  pname = "qmlkonsole";
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
+
+  buildInputs = [
+    kconfig
+    ki18n
+    kirigami-addons
+    kirigami2
+    qtquickcontrols2
+    kcoreaddons
+    kwindowsystem
+    qmltermwidget
+  ];
+
+  meta = with lib; {
+    description = "Terminal app for Plasma Mobile";
+    homepage = "https://invent.kde.org/plasma-mobile/qmlkonsole";
+    license = with licenses; [ gpl2Plus gpl3Plus cc0 ];
+    maintainers = with maintainers; [ balsoft ];
+  };
+}
--- a/pkgs/applications/radio/gnuradio/shared.nix
+++ b/pkgs/applications/radio/gnuradio/shared.nix
@ -37,20 +37,18 @@ rec {
  );
  nativeBuildInputs = lib.flatten (lib.mapAttrsToList (
    feat: info: (
-      if hasFeature feat then
-        (if builtins.hasAttr "native" info then info.native else []) ++
-        (if builtins.hasAttr "pythonNative" info then info.pythonNative else [])
-      else
-        []
+      lib.optionals (hasFeature feat) (
+        (lib.optionals (builtins.hasAttr "native" info) info.native) ++
+        (lib.optionals (builtins.hasAttr "pythonNative" info) info.pythonNative)
+      )
    )
  ) featuresInfo);
  buildInputs = lib.flatten (lib.mapAttrsToList (
    feat: info: (
-      if hasFeature feat then
-        (if builtins.hasAttr "runtime" info then info.runtime else []) ++
-        (if builtins.hasAttr "pythonRuntime" info then info.pythonRuntime else [])
-      else
-        []
+      lib.optionals (hasFeature feat) (
+        (lib.optionals (builtins.hasAttr "runtime" info) info.runtime) ++
+        (lib.optionals (builtins.hasAttr "pythonRuntime" info) info.pythonRuntime)
+      )
    )
  ) featuresInfo);
  cmakeFlags = lib.mapAttrsToList (
--- a/pkgs/applications/radio/gnuradio/wrapper.nix
+++ b/pkgs/applications/radio/gnuradio/wrapper.nix
@ -41,12 +41,9 @@ let
    ++ (builtins.map unwrapped.python.pkgs.toPythonModule extraPackages)
    ++ lib.flatten (lib.mapAttrsToList (
      feat: info: (
-        if unwrapped.hasFeature feat then
-          (if builtins.hasAttr "pythonRuntime" info then info.pythonRuntime else [])
-        else
-          []
+        lib.optionals ((unwrapped.hasFeature feat) && (builtins.hasAttr "pythonRuntime" info)) info.pythonRuntime
      )
-      ) unwrapped.featuresInfo)
+    ) unwrapped.featuresInfo)
  ;
  pythonEnv = unwrapped.python.withPackages(ps: pythonPkgs);

--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "docker-compose";
-  version = "2.15.1";
+  version = "2.16.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    rev = "v${version}";
-    sha256 = "sha256-CDkewlZFvjp6kb6UoMDUv9iAUfm0akMD9RpI9/H7Sz8=";
+    sha256 = "sha256-/kdEzC97atFJw8rWFAdm9tofayj1fwBRvNKwbjWIGR8=";
  };

  postPatch = ''
@ -16,7 +16,7 @@ buildGoModule rec {
    rm -rf e2e/
  '';

-  vendorSha256 = "sha256-sv4lK6MRwmp/1CSGBoYMpcGunVCuE8p1vB4VKaRuwQc=";
+  vendorHash = "sha256-1iEJPVrsRqQQhkspRmUtS4ru4DCKiyobGztM4d0vb2Y=";

  ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];

--- a/pkgs/applications/window-managers/river/default.nix
+++ b/pkgs/applications/window-managers/river/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "river";
-  version = "0.2.3";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "riverwm";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-noZ2vo4J0cG3PN2k+2LzMc5WMtj0FEmMttE9obFH/tM=";
+    hash = "sha256-cIcO6owM6eYn+obYVaBOVQpnBx4++KOqQk5Hzo3GcNs=";
    fetchSubmodules = true;
  };

--- a/pkgs/build-support/build-setupcfg/default.nix
+++ b/pkgs/build-support/build-setupcfg/default.nix
@ -6,8 +6,8 @@
 # * application: Whether this package is a python library or an
 #   application which happens to be written in python.
 # * doCheck: Whether to run the test suites.
-pythonPackages:
-{ src, info, meta ? {}, application ? false, doCheck ? true }: let
+lib: pythonPackages:
+{ src, info, meta ? {}, application ? false, doCheck ? true}: let
  build = if application
    then pythonPackages.buildPythonApplication
  else pythonPackages.buildPythonPackage;
@ -18,7 +18,8 @@ in build {

  nativeBuildInputs = map (p: pythonPackages.${p}) (
    (info.setup_requires or []) ++
-    (if doCheck then (info.tests_require or []) else []));
+    (lib.optionals doCheck (info.tests_require or []))
+  );

  propagatedBuildInputs = map (p: pythonPackages.${p})
    (info.install_requires or []);
--- a/pkgs/build-support/dotnet/make-nuget-source/default.nix
+++ b/pkgs/build-support/dotnet/make-nuget-source/default.nix
@ -30,9 +30,7 @@ let
    meta.licence = let
      depLicenses = lib.splitString "\n" (builtins.readFile "${nuget-source}/share/licenses");
    in (lib.flatten (lib.forEach depLicenses (spdx:
-      if (spdx != "")
-        then lib.getLicenseFromSpdxId spdx
-        else []
+      lib.optionals (spdx != "") (lib.getLicenseFromSpdxId spdx)
    )));
  };
 in nuget-source
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "numix-icon-theme-circle";
-  version = "23.02.05";
+  version = "23.02.12";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-wS7GAfrzJ2/BvfoBZ7YR/X5j/ND4o7shf08dgk9GBkA=";
+    sha256 = "sha256-gQdVmF7ZzC+KjU0uQW6+sEw9Wz5940G60ebXqKHajuY=";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/desktops/deepin/apps/deepin-reader/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-reader/default.nix
@ -0,0 +1,74 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, qmake
+, pkg-config
+, qttools
+, wrapQtAppsHook
+, dtkwidget
+, qt5integration
+, qt5platform-plugins
+, dde-qt-dbus-factory
+, qtwebengine
+, karchive
+, poppler
+, libchardet
+, libspectre
+, openjpeg
+, djvulibre
+, gtest
+, qtbase
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deepin-reader";
+  version = "5.10.28";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-0jHhsxEjBbu3ktvjX1eKnkZDwzRk9MrUSJSdYeOvWtI=";
+  };
+
+  patches = [ ./use-pkg-config.diff ];
+
+  postPatch = ''
+    substituteInPlace reader/{reader.pro,document/Model.cpp} htmltopdf/htmltopdf.pro 3rdparty/deepin-pdfium/src/src.pro \
+      --replace "/usr" "$out"
+  '';
+
+  nativeBuildInputs = [
+    qmake
+    pkg-config
+    qttools
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    dtkwidget
+    qt5platform-plugins
+    dde-qt-dbus-factory
+    qtwebengine
+    karchive
+    poppler
+    libchardet
+    libspectre
+    djvulibre
+    openjpeg
+    gtest
+  ];
+
+  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
+  qtWrapperArgs = [
+    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
+  ];
+
+  meta = with lib; {
+    description = "A simple memo software with texts and voice recordings";
+    homepage = "https://github.com/linuxdeepin/deepin-reader";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
--- a/pkgs/desktops/deepin/apps/deepin-reader/use-pkg-config.diff
+++ b/pkgs/desktops/deepin/apps/deepin-reader/use-pkg-config.diff
@ -0,0 +1,46 @@
+diff --git a/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri b/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri
+index 3e04f340..894b0ac7 100755
+--- a/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri
+++ b/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri
+@@ -20,13 +20,8 @@ DEFINES +=  USE_SYSTEM_LIBJPEG \
+             USE_SYSTEM_LIBOPENJPEG2 \
+             USE_SYSTEM_FREETYPE
+ 
+-INCLUDEPATH += /usr/include/openjpeg-2.3 \
+-               /usr/include/openjpeg-2.4 \
+-               /usr/include/freetype2 \
+-               /usr/include/freetype2/freetype \
+-               /usr/include/freetype2/freetype/config
+-
+-LIBS += -lopenjp2 -llcms2 -lfreetype
+CONFIG += link_pkgconfig
+PKGCONFIG += libopenjp2 lcms2 freetype2
+ 
+ #QMAKE_CXXFLAGS += "-Wc++11-narrowing"  #is_clang
+ #QMAKE_CXXFLAGS += "-Wno-inconsistent-missing-override"  #is_clang Suppress no override warning for overridden functions.
+diff --git a/3rdparty/deepin-pdfium/src/src.pro b/3rdparty/deepin-pdfium/src/src.pro
+index 196b91d3..bda71ff4 100755
+--- a/3rdparty/deepin-pdfium/src/src.pro
+++ b/3rdparty/deepin-pdfium/src/src.pro
+@@ -2,7 +2,9 @@ TARGET = $$PWD/../lib/deepin-pdfium
+ 
+ TEMPLATE = lib
+ 
+-CONFIG += c++14
+CONFIG += c++14 link_pkgconfig
+
+PKGCONFIG += chardet
+ 
+ ###安全漏洞检测
+ #QMAKE_CXX += -g -fsanitize=undefined,address -O2
+@@ -28,10 +30,6 @@ include($$PWD/3rdparty/pdfium/pdfium.pri)
+ 
+ INCLUDEPATH += $$PWD/../include
+ 
+-INCLUDEPATH += /usr/include/chardet
+-
+-LIBS += -lchardet
+-
+ public_headers += \
+     $$PWD/../include/dpdfglobal.h \
+     $$PWD/../include/dpdfdoc.h \
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@ -38,6 +38,7 @@ let
    deepin-image-viewer = callPackage ./apps/deepin-image-viewer { };
    deepin-picker = callPackage ./apps/deepin-picker { };
    deepin-terminal = callPackage ./apps/deepin-terminal { };
+    deepin-reader = callPackage ./apps/deepin-reader { };

    #### Go Packages
    go-lib = callPackage ./go-package/go-lib { inherit replaceAll; };
--- a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
@ -4,8 +4,6 @@
 , testers
 }:

-with lib;
-
 stdenv.mkDerivation (finalAttrs: {
  pname = "gtksourceview";
  version = "2.10.5";
@ -17,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "c585773743b1df8a04b1be7f7d90eecdf22681490d6810be54c81a7ae152191e";
  };

-  patches = optionals stdenv.isDarwin [
+  patches = lib.optionals stdenv.isDarwin [
    (fetchpatch {
      name = "change-igemacintegration-to-gtkosxapplication.patch";
      url = "https://gitlab.gnome.org/GNOME/gtksourceview/commit/e88357c5f210a8796104505c090fb6a04c213902.patch";
@ -35,11 +33,11 @@ stdenv.mkDerivation (finalAttrs: {
    atk cairo glib gtk2
    pango libxml2Python perl
    gettext
-  ] ++ optionals stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
    gnome-common gtk-mac-integration-gtk2
  ];

-  preConfigure = optionalString stdenv.isDarwin ''
+  preConfigure = lib.optionalString stdenv.isDarwin ''
    intltoolize --force
  '';

--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.20";
+  version = "1.20.1";

  src = fetchurl {
    url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-Oin/BCG+r2MpKSuKRjEcn78GyAAHfO3e9ft/jVsazjM=";
+    hash = "sha256-tcGjr1LDhabRx2rtU2HPJkWQI5gNAyDedli645FYMaI=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
@ -4,29 +4,51 @@
 , autoPatchelfHook
 , cairo
 , cups
+, darwin
 , fontconfig
-, Foundation
 , glib
 , gtk3
-, gtkSupport ? stdenv.isLinux
 , makeWrapper
 , setJavaClassPath
 , unzip
 , xorg
 , zlib
-}:
-{ javaVersion
+  # extra params
+, javaVersion
 , meta ? { }
 , products ? [ ]
-, ... } @ args:
+, gtkSupport ? stdenv.isLinux
+, ...
+} @ args:

 let
+  extraArgs = builtins.removeAttrs args [
+    "lib"
+    "stdenv"
+    "alsa-lib"
+    "autoPatchelfHook"
+    "cairo"
+    "cups"
+    "darwin"
+    "fontconfig"
+    "glib"
+    "gtk3"
+    "makeWrapper"
+    "setJavaClassPath"
+    "unzip"
+    "xorg"
+    "zlib"
+    "javaVersion"
+    "meta"
+    "products"
+    "gtkSupport"
+  ];
  runtimeLibraryPath = lib.makeLibraryPath
    ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
-  mapProducts = key: default: (map (p: p.${key} or default) products);
+  mapProducts = key: default: (map (p: p.graalvmPhases.${key} or default) products);
  concatProducts = key: lib.concatStringsSep "\n" (mapProducts key "");

-  graalvmXXX-ce = stdenv.mkDerivation (args // {
+  graalvmXXX-ce = stdenv.mkDerivation ({
    pname = "graalvm${javaVersion}-ce";

    unpackPhase = ''
@ -71,7 +93,7 @@ let
      ++ lib.optional stdenv.isLinux autoPatchelfHook;

    propagatedBuildInputs = [ setJavaClassPath zlib ]
-      ++ lib.optional stdenv.isDarwin Foundation;
+      ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Foundation;

    buildInputs = lib.optionals stdenv.isLinux [
      alsa-lib # libasound.so wanted by lib/libjsound.so
@ -109,6 +131,12 @@ let
    installCheckPhase = ''
      runHook preInstallCheck

+      ${# broken in darwin
+        lib.optionalString stdenv.isLinux ''
+        echo "Testing Jshell"
+        echo '1 + 1' | $out/bin/jshell
+      ''}
+
      echo ${
        lib.escapeShellArg ''
          public class HelloWorld {
@ -136,7 +164,6 @@ let
    };

    meta = with lib; ({
-      inherit platforms;
      homepage = "https://www.graalvm.org/";
      description = "High-Performance Polyglot VM";
      license = with licenses; [ upl gpl2Classpath bsd3 ];
@ -144,5 +171,6 @@ let
      mainProgram = "java";
      maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
    } // meta);
-  });
-in graalvmXXX-ce
+  } // extraArgs);
+in
+graalvmXXX-ce
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
@ -1,20 +1,42 @@
 { lib
 , stdenv
 , autoPatchelfHook
+, graalvm-ce
 , makeWrapper
 , perl
 , unzip
 , zlib
-}:
-{ product
+  # extra params
+, product
 , javaVersion
-, extraNativeBuildInputs ? [ ]
 , extraBuildInputs ? [ ]
+, extraNativeBuildInputs ? [ ]
+, graalvmPhases ? { }
 , meta ? { }
 , passthru ? { }
-, ... } @ args:
+, ...
+} @ args:

-stdenv.mkDerivation (args // {
+let
+  extraArgs = builtins.removeAttrs args [
+    "lib"
+    "stdenv"
+    "autoPatchelfHook"
+    "graalvm-ce"
+    "makeWrapper"
+    "perl"
+    "unzip"
+    "zlib"
+    "product"
+    "javaVersion"
+    "extraBuildInputs"
+    "extraNativeBuildInputs"
+    "graalvmPhases"
+    "meta"
+    "passthru"
+  ];
+in
+stdenv.mkDerivation ({
  pname = "${product}-java${javaVersion}";

  nativeBuildInputs = [ perl unzip makeWrapper ]
@ -55,19 +77,19 @@ stdenv.mkDerivation (args // {
  dontInstall = true;
  dontBuild = true;
  dontStrip = true;
-  # installCheckPhase is going to run in GraalVM main derivation (see buildGraalvm.nix)
-  # to make sure that it has everything it needs to run correctly.
-  # Other hooks like fixupPhase/installPhase are also going to run there for the
-  # same reason.
-  doInstallCheck = false;

-  passthru = { inherit product; } // passthru;
+  passthru = {
+    inherit product javaVersion;
+    # build phases that are going to run during GraalVM derivation build,
+    # since they depend in having the fully setup GraalVM environment
+    # e.g.: graalvmPhases.installCheckPhase will run the checks only after
+    # GraalVM+products is build
+    # see buildGraalvm.nix file for the available phases
+    inherit graalvmPhases;
+  } // passthru;

  meta = with lib; ({
-    homepage = "https://www.graalvm.org/";
+    inherit (graalvm-ce.meta) homepage license sourceProvenance maintainers platforms;
    description = "High-Performance Polyglot VM (Product: ${product})";
-    license = with licenses; [ upl gpl2Classpath bsd3 ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
  } // meta);
-})
+} // extraArgs)
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@ -2,12 +2,11 @@
 , stdenv
 , callPackage
 , fetchurl
-, Foundation
 }:

 let
-  buildGraalvm = callPackage ./buildGraalvm.nix { inherit Foundation; };
-  buildGraalvmProduct = callPackage ./buildGraalvmProduct.nix { };
+  buildGraalvm = callPackage ./buildGraalvm.nix;
+  buildGraalvmProduct = callPackage ./buildGraalvmProduct.nix;
  javaPlatform = {
    "aarch64-linux" = "linux-aarch64";
    "x86_64-linux" = "linux-amd64";
@ -16,7 +15,8 @@ let
  };
  javaPlatformVersion = javaVersion:
    "${javaVersion}-${javaPlatform.${stdenv.system} or (throw "Unsupported platform: ${stdenv.system}")}";
-  source = product: javaVersion: (import ./hashes.nix).${product}.${javaPlatformVersion javaVersion};
+  source = product: javaVersion: (import ./hashes.nix).${product}.${javaPlatformVersion javaVersion}
+    or (throw "Unsupported product combination: product=${product} java=${javaVersion} system=${stdenv.system}");

 in
 rec {
@ -30,12 +30,55 @@ rec {
    products = [ native-image-installable-svm-java11 ];
  };

+  # Mostly available for testing, not to be exposed at the top level
+  graalvm11-ce-full = graalvm11-ce.override {
+    products = [
+      js-installable-svm-java11
+      llvm-installable-svm-java11
+      native-image-installable-svm-java11
+      python-installable-svm-java11
+      ruby-installable-svm-java11
+      wasm-installable-svm-java11
+    ];
+  };
+
+  js-installable-svm-java11 = callPackage ./js-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "js-installable-svm" javaVersion);
+  };
+
+  llvm-installable-svm-java11 = callPackage ./llvm-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "llvm-installable-svm" javaVersion);
+  };
+
  native-image-installable-svm-java11 = callPackage ./native-image-installable-svm.nix rec {
    javaVersion = "11";
    version = "22.3.1";
    src = fetchurl (source "native-image-installable-svm" javaVersion);
  };

+  python-installable-svm-java11 = callPackage ./python-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "python-installable-svm" javaVersion);
+  };
+
+  ruby-installable-svm-java11 = callPackage ./ruby-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "ruby-installable-svm" javaVersion);
+    llvm-installable-svm = llvm-installable-svm-java11;
+  };
+
+  wasm-installable-svm-java11 = callPackage ./wasm-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "wasm-installable-svm" javaVersion);
+  };
+
  graalvm17-ce = buildGraalvm rec {
    version = "22.3.1";
    javaVersion = "17";
@ -44,9 +87,52 @@ rec {
    products = [ native-image-installable-svm-java17 ];
  };

+  # Mostly available for testing, not to be exposed at the top level
+  graalvm17-ce-full = graalvm17-ce.override {
+    products = [
+      js-installable-svm-java17
+      llvm-installable-svm-java17
+      native-image-installable-svm-java17
+      python-installable-svm-java17
+      ruby-installable-svm-java17
+      wasm-installable-svm-java17
+    ];
+  };
+
+  js-installable-svm-java17 = callPackage ./js-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "js-installable-svm" javaVersion);
+  };
+
+  llvm-installable-svm-java17 = callPackage ./llvm-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "llvm-installable-svm" javaVersion);
+  };
+
  native-image-installable-svm-java17 = callPackage ./native-image-installable-svm.nix rec {
    javaVersion = "17";
    version = "22.3.1";
    src = fetchurl (source "native-image-installable-svm" javaVersion);
  };
+
+  python-installable-svm-java17 = callPackage ./python-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "python-installable-svm" javaVersion);
+  };
+
+  ruby-installable-svm-java17 = callPackage ./ruby-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "ruby-installable-svm" javaVersion);
+    llvm-installable-svm = llvm-installable-svm-java17;
+  };
+
+  wasm-installable-svm-java17 = callPackage ./wasm-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "wasm-installable-svm" javaVersion);
+  };
 }
--- a/pkgs/development/compilers/graalvm/community-edition/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
@ -1,5 +1,133 @@
 # Generated by pkgs/development/compilers/graalvm/community-edition/update.sh script
 {
+  "llvm-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "0h8xkvsixcwak5dymkj3jgjv11w3ivnd6d45v5pdbymd0m2ifia8";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "1zww45z7m3mvzg47fwc3jgqz3hkra220isf4ih8sv6kjg1jc4y14";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "133m9vg9rlp2xkndh3d6b8ybq8vwch99rj1b50xr6bz8r6306ara";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0nz09idp8wawm3yinsplzvxhld8yav06l1nqj02gxrc1kxd5nsr1";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "0ngcm3ara7g1xz4kh515igpyrjhr1k5z9nf4vsaw4lpa5sqljv7z";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "1lr8kk82c3l9hx7wc5hqmpqfgvpk72xg1h07b6cgibry1bm6baj6";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "058pzrd90xx4yi7mm2fvs2npqcdkb2nzhqfwfz5v202038igi61g";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "10rfz8ddq82zpf6cy2y0gx1bx0zhjzm3gwwdb1j7mll0hvwp84sg";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
+  "wasm-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "1d67jm41psypkhpy77cb2l00smhni3pgkybwx79z7dzcyid7p2l1";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "1cg9zxyjirfl0afr9cppg2h17j8qdidi4llbal2g5w1p2v9zq78b";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "19v7jqhvijmzzb0i9q6hbvrmqnmmzbyvai3il9f357qvv6r6lylb";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0sfnsy0r4qf7ni9mh437dad1d8sidajcra2azsmy5qdmh091zhj5";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "0764d97mla5cii4iyvyb43v62dk8ff3plqjmdc69qqxx8mdzpwqv";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "1ip6ybm7p28bs2lifxqhq6fyvfm3wmacv6dqziyl2v7v7yl0iw4i";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
+  "js-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "1b8vnjjsa548c6j3dycxp57i9xmyvndiz2xhv7fm10izcplyspxq";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "1kcy3mjk908zs7f3k95awp6294cwr06hand4cbw1lsnfvp0qwhk7";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "0sq80a4nnvik560whgv5vwlsszi8z02idvpd92p0caf03bra9x2b";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0fd160yxsi09m97z7vqh5kwf1g0p0hn4niy48glj9jhirfqzzw0c";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "18g0xixzk45yrxv3zfs7qrdyj0b3ksp59jhbcis0vwy9gx8094wq";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "0cf4iivkniilvbqyniqxcz1qf49cs4lxi0axjsk9sz1zmxcq0bnk";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "0ibcz6ivx068ndf45j9pghm8qwq287glqxf0xx08kjxnhms67p52";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "16q7whnvdrk8lb4fp96qr3p567kggyk9q5iqcn081qk8xjkbx0zv";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
+  "python-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "1yl36x5svld7qnm3m6vmacm2n4d6l9vhdxhaypvlv2bbfbnym3c5";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "0ggx5rwz3qnnxgz407r8yx12556pcbirhnc44972l77r320rdmqc";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "11c19a20v3ff83dxzs9hf1z89kh0qich41b03gx8mancf12jfwnl";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0pga44whhvm98d8j2v2bpl9rkbvr9bv947rc4imlbf01cyxjwl71";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "0qnh8i9nazrv25jhn13wp7qqm9wwhcz4kpp2ygvsdmf9s3d2f5lf";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "0j13xvy9d19glipz4wdma2y02g0cnksg1iij4247fjhpqh0axkdz";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "1ny5664h7pibvskmm51mlxrxkbbj2dvxsv2yqbq6v51a57wm1yzn";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "01jjncx8jm1yrps2nj217vgcmjaqclmpb27rdp3qn7k64w5wzipg";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
  "native-image-installable-svm" = {
    "11-linux-aarch64" = {
      sha256 = "0z9rbmci6yz7f7mqd3xzsxc5ih4hq72lyzqfchan7fr6mh38d6gw";
@ -68,4 +196,38 @@
      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-darwin-amd64-22.3.1.tar.gz";
    };
  };
+  "ruby-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "10wm1sq7smywy63mzlsbn21kzd65yaqj8yismpq8bz19h9skas7w";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "0kh1w49yp3kpfvhqw19bbx51ay1wgzq80gsrfqax4zm5ixz4wsbz";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "0avsawgfkqbgqc2hm8zmz37qg9ag3ddni3my8g73kvzfkghsdabh";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "1ib00pqdhzl24y97j16mm86qwrijqjnmhjmk3g5vdhyhh099vjp1";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "1im75qad89xa2nbl80csnwn56k6n11zv5g91xlkqq4xk300v1saj";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "1pfzsisf4sgzxmk3r1p4apzqkwipjpf8naly3v94i5v3b5gbnczx";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "1jfls71y92hw09s869v2qw8pypgl1fciqz3m9zcd2602hikysq6c";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "03x2h4sw72l05xxg73xj9mzzkxffbjpv8hdi59rgxxljnz0ai6rx";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
 }
--- a/pkgs/development/compilers/graalvm/community-edition/js-installable-svm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/js-installable-svm.nix
@ -0,0 +1,18 @@
+{ lib
+, stdenv
+, graalvm-ce
+, graalvmCEPackages
+, javaVersion
+, src
+, version
+}:
+
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "js-installable-svm";
+
+  graalvmPhases.installCheckPhase = ''
+    echo "Testing GraalJS"
+    echo '1 + 1' | $out/bin/js
+  '';
+}
--- a/pkgs/development/compilers/graalvm/community-edition/llvm-installable-svm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/llvm-installable-svm.nix
@ -0,0 +1,22 @@
+{ lib
+, stdenv
+, graalvmCEPackages
+, javaVersion
+, src
+, version
+}:
+
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "llvm-installable-svm";
+
+  postUnpack = ''
+    ln -s $out/languages/llvm/native/lib/*.so $out/lib
+  '';
+
+  # TODO: improve this test
+  graalvmPhases.installCheckPhase = ''
+    echo "Testing llvm"
+    $out/bin/lli --help
+  '';
+}
--- a/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
@ -27,19 +27,20 @@ graalvmCEPackages.buildGraalvmProduct rec {
  inherit src javaVersion version;
  product = "native-image-installable-svm";

-  postInstall = lib.optionalString stdenv.isLinux ''
+  graalvmPhases.postInstall = lib.optionalString stdenv.isLinux ''
    wrapProgram $out/bin/native-image \
      --prefix PATH : ${binPath} \
      ${lib.concatStringsSep " "
        (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs)}
  '';

-  installCheckPhase = ''
+  graalvmPhases.installCheckPhase = ''
    echo "Ahead-Of-Time compilation"
    $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces HelloWorld
    ./helloworld | fgrep 'Hello World'

-    ${lib.optionalString (stdenv.isLinux && !useMusl) ''
+    ${# --static is only available in Linux
+      lib.optionalString (stdenv.isLinux && !useMusl) ''
      echo "Ahead-Of-Time compilation with -H:+StaticExecutableWithDynamicLibC"
      $out/bin/native-image -H:+StaticExecutableWithDynamicLibC HelloWorld
      ./helloworld | fgrep 'Hello World'
@ -49,7 +50,8 @@ graalvmCEPackages.buildGraalvmProduct rec {
      ./helloworld | fgrep 'Hello World'
    ''}

-    ${lib.optionalString (stdenv.isLinux && useMusl) ''
+    ${# --static is only available in Linux
+      lib.optionalString (stdenv.isLinux && useMusl) ''
      echo "Ahead-Of-Time compilation with --static and --libc=musl"
      $out/bin/native-image --static HelloWorld --libc=musl
      ./helloworld | fgrep 'Hello World'
--- a/pkgs/development/compilers/graalvm/community-edition/python-installable-svm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/python-installable-svm.nix
@ -0,0 +1,18 @@
+{ lib
+, stdenv
+, graalvmCEPackages
+, javaVersion
+, src
+, version
+}:
+
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "python-installable-svm";
+
+  graalvmPhases.installCheckPhase = ''
+    echo "Testing GraalPython"
+    $out/bin/graalpy -c 'print(1 + 1)'
+    echo '1 + 1' | $out/bin/graalpy
+  '';
+}
--- a/pkgs/development/compilers/graalvm/community-edition/ruby-installable-svm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/ruby-installable-svm.nix
@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, graalvmCEPackages
+, openssl
+, javaVersion
+, musl
+, src
+, version
+, llvm-installable-svm
+}:
+
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "ruby-installable-svm";
+
+  extraBuildInputs = [
+    llvm-installable-svm
+    openssl
+  ];
+
+  preFixup = lib.optionalString stdenv.isLinux ''
+    patchelf $out/languages/ruby/lib/mri/openssl.so \
+      --replace-needed libssl.so.10 libssl.so \
+      --replace-needed libcrypto.so.10 libcrypto.so
+  '';
+
+  graalvmPhases.installCheckPhase = ''
+    echo "Testing TruffleRuby"
+    # Fixup/silence warnings about wrong locale
+    export LANG=C
+    export LC_ALL=C
+    $out/bin/ruby -e 'puts(1 + 1)'
+    ${# broken in darwin with sandbox enabled
+      lib.optionalString stdenv.isLinux ''
+      echo '1 + 1' | $out/bin/irb
+    ''}
+  '';
+}
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@ -14,9 +14,10 @@ verlte() {
    [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
 }

+readonly hashes_nix="hashes.nix"
 readonly nixpkgs=../../../../..

-readonly current_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm-ce.version | tr -d \")"
+readonly current_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm-ce.version --json | jq -r)"

 if [[ -z "${1:-}" ]]; then
  readonly gh_version="$(curl \
@ -39,10 +40,12 @@ fi

 declare -r -A products_urls=(
  [graalvm-ce]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/graalvm-ce-java@platform@-${new_version}.tar.gz"
+  [js-installable-svm]="https://github.com/graalvm/graaljs/releases/download/vm-${new_version}/js-installable-svm-java@platform@-${new_version}.jar"
+  [llvm-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/llvm-installable-svm-java@platform@-${new_version}.jar"
  [native-image-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/native-image-installable-svm-java@platform@-${new_version}.jar"
-  # [ruby-installable-svm]="https://github.com/oracle/truffleruby/releases/download/vm-${new_version}/ruby-installable-svm-java@platform@-${new_version}.jar"
-  # [wasm-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/wasm-installable-svm-java@platform@-${new_version}.jar"
-  # [python-installable-svm]="https://github.com/graalvm/graalpython/releases/download/vm-${new_version}/python-installable-svm-java@platform@-${new_version}.jar"
+  [python-installable-svm]="https://github.com/graalvm/graalpython/releases/download/vm-${new_version}/python-installable-svm-java@platform@-${new_version}.jar"
+  [ruby-installable-svm]="https://github.com/oracle/truffleruby/releases/download/vm-${new_version}/ruby-installable-svm-java@platform@-${new_version}.jar"
+  [wasm-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/wasm-installable-svm-java@platform@-${new_version}.jar"
 )

 readonly platforms=(
@ -65,11 +68,20 @@ for product in "${!products_urls[@]}"; do
  url="${products_urls["${product}"]}"
 echo_file "  \"$product\" = {"
  for platform in "${platforms[@]}"; do
-    if hash="$(nix-prefetch-url "${url//@platform@/$platform}")"; then
+    # Reuse cache as long the version is the same
+    if [[ "$current_version" == "$new_version" ]]; then
+        previous_hash="$(nix-instantiate --eval "$hashes_nix" -A "$product.$platform.sha256" --json | jq -r || true)"
+    else
+        previous_hash=""
+    fi
+    # Lack of quoting in $previous_hash is proposital
+    if hash="$(nix-prefetch-url "${url//@platform@/$platform}" $previous_hash)"; then
 echo_file "    \"$platform\" = {"
 echo_file "      sha256 = \"$hash\";"
 echo_file "      url = \"${url//@platform@/${platform}}\";"
 echo_file "    };"
+    else
+        info "Error while downloading '$product' for '$platform'. Skipping it..."
    fi
  done
 echo_file "  };"
@ -81,6 +93,6 @@ info "Updating graalvm-ce version..."
 sed "s|$current_version|$new_version|" -i default.nix

 info "Moving the temporary file to hashes.nix"
-mv "$tmpfile" hashes.nix
+mv "$tmpfile" "$hashes_nix"

 info "Done!"
--- a/pkgs/development/compilers/graalvm/community-edition/wasm-installable-svm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/wasm-installable-svm.nix
@ -0,0 +1,22 @@
+{ lib
+, stdenv
+, graalvm-ce
+, graalvmCEPackages
+, javaVersion
+, src
+, version
+}:
+
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "wasm-installable-svm";
+
+  # TODO: improve this test
+  graalvmPhases.installCheckPhase = ''
+    echo "Testing wasm"
+    $out/bin/wasm --help
+  '';
+
+  # Not supported in aarch64-darwin yet as GraalVM 22.3.1 release
+  meta.platforms = builtins.filter (p: p != "aarch64-darwin") graalvm-ce.meta.platforms;
+}
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -63,7 +63,7 @@
          hooks = import ./hooks/default.nix;
          keep = lib.extends hooks pythonPackagesFun;
          extra = _: {};
-          optionalExtensions = cond: as: if cond then as else [];
+          optionalExtensions = cond: as: lib.optionals cond as;
          pythonExtension = import ../../../top-level/python-packages.nix;
          python2Extension = import ../../../top-level/python2-packages.nix;
          extensions = lib.composeManyExtensions ([
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@ -39,7 +39,7 @@ let
  }));

  # See build-setupcfg/default.nix for documentation.
-  buildSetupcfg = import ../../../build-support/build-setupcfg self;
+  buildSetupcfg = import ../../../build-support/build-setupcfg lib self;

  # Check whether a derivation provides a Python module.
  hasPythonModule = drv: drv?pythonModule && drv.pythonModule == python;
--- a/pkgs/development/interpreters/spidermonkey/102.nix
+++ b/pkgs/development/interpreters/spidermonkey/102.nix
@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "102.1.0";
-  hash = "sha512-JQW4fOQRVEVWjra32K9BZ4vXh/0H8/eenwoi2QzfdSrl1DcYVs+cVuLZ2n1bfDk53CqrV1P8wBc5jn1lJg9vAw==";
+  version = "102.8.0";
+  hash = "sha512-k+qHmXtmCIuUxulDtumemnHRkIRE0JbA9ltodtLFhOVf9hICZvOFH5hrZkvR8S+jEgawNHnCt1Hnw8oJesFCdQ==";
 }
--- a/pkgs/development/interpreters/spidermonkey/91.nix
+++ b/pkgs/development/interpreters/spidermonkey/91.nix
@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "91.12.0";
-  hash = "sha512-Mj+3UkiLRYcrQPCw7h2MHf+haHTb/yr94ZpUKGyCTvSBdyM+Ap+ur6WUYYTnHDHGvFun7BelceIa9k/F9zNAQg==";
+  version = "91.13.0";
+  hash = "sha512-OLTMUt4h521gYea6F14cv9iIoWBwqpUfWkQoPy251+lPJQRiHw2nj+rG5xSRptDnA49j3QrhEtytcA6wLpqlFg==";
 }
--- a/pkgs/development/interpreters/spidermonkey/common.nix
+++ b/pkgs/development/interpreters/spidermonkey/common.nix
@ -62,19 +62,6 @@ stdenv.mkDerivation (finalAttrs: rec {
    # use pkg-config at all systems
    ./always-check-for-pkg-config.patch
    ./allow-system-s-nspr-and-icu-on-bootstrapped-sysroot.patch
-
-    # Patches required by GJS
-    # https://discourse.gnome.org/t/gnome-43-to-depend-on-spidermonkey-102/10658
-    # Install ProfilingCategoryList.h
-    (fetchpatch {
-      url = "https://hg.mozilla.org/releases/mozilla-esr102/raw-rev/33147b91e42b79f4c6dd3ec11cce96746018407a";
-      sha256 = "sha256-xJFJZMYJ6P11HQDZbr48GFgybpAeVcu3oLIFEyyMjBI=";
-    })
-    # Fix embeder build
-    (fetchpatch {
-      url = "https://hg.mozilla.org/releases/mozilla-esr102/raw-rev/1fa20fb474f5d149cc32d98df169dee5e6e6861b";
-      sha256 = "sha256-eCisKjNxy9SLr9KoEE2UB26BflUknnR7PIvnpezsZeA=";
-    })
  ] ++ lib.optionals (lib.versionAtLeast version "91" && stdenv.hostPlatform.system == "i686-linux") [
    # Fixes i686 build, https://bugzilla.mozilla.org/show_bug.cgi?id=1729459
    ./fix-float-i686.patch
--- a/pkgs/development/java-modules/m2install.nix
+++ b/pkgs/development/java-modules/m2install.nix
@ -5,7 +5,7 @@
 , sha512
 , type ? "jar"
 , suffix ? ""
-, sourceProvenance ? (if type == "jar" then [ lib.sourceTypes.binaryBytecode ] else [])
+, sourceProvenance ? (lib.optionals (type == "jar") [ lib.sourceTypes.binaryBytecode ])
 }:

 let
--- a/pkgs/development/libraries/eccodes/default.nix
+++ b/pkgs/development/libraries/eccodes/default.nix
@ -4,6 +4,7 @@
 , cmake
 , netcdf
 , openjpeg
+, libaec
 , libpng
 , gfortran
 , perl
@ -15,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "eccodes";
-  version = "2.24.2";
+  version = "2.28.0";

  src = fetchurl {
    url = "https://confluence.ecmwf.int/download/attachments/45757960/eccodes-${version}-Source.tar.gz";
-    sha256 = "sha256-xgrQ/YnhGRis4NhMAUifISIrEdbK0/90lYVqCt1hBAM=";
+    sha256 = "sha256-KDE0exUXr569cN08rYiugYqESNTmyGcapyhhfnNDHNU=";
  };

  postPatch = ''
@ -42,6 +43,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    netcdf
    openjpeg
+    libaec
    libpng
  ];

@ -60,9 +62,7 @@ stdenv.mkDerivation rec {
  doCheck = true;

  # Only do tests that don't require downloading 120MB of testdata
-  checkPhase = lib.optionalString (stdenv.isDarwin) ''
-    substituteInPlace "tests/include.sh" --replace "set -ea" "set -ea; export DYLD_LIBRARY_PATH=$(pwd)/lib"
-  '' + ''
+  checkPhase = ''
    ctest -R "eccodes_t_(definitions|calendar|unit_tests|md5|uerra|grib_2nd_order_numValues|julian)" -VV
  '';

--- a/pkgs/development/libraries/libadwaita/default.nix
+++ b/pkgs/development/libraries/libadwaita/default.nix
@ -20,7 +20,7 @@

 stdenv.mkDerivation rec {
  pname = "libadwaita";
-  version = "1.2.1";
+  version = "1.2.2";

  outputs = [ "out" "dev" "devdoc" ];
  outputBin = "devdoc"; # demo app
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
    owner = "GNOME";
    repo = "libadwaita";
    rev = version;
-    hash = "sha256-FJmH/DTTn01UlATgxC0d7vrpVLwAot6Y4cZralQz2nU=";
+    hash = "sha256-ftq7PLbTmhAAAhAYfrwicWn8t88+dG45G8q/vQa2cKw=";
  };

  depsBuildBuild = [
--- a/pkgs/development/libraries/ndn-cxx/default.nix
+++ b/pkgs/development/libraries/ndn-cxx/default.nix
@ -6,38 +6,37 @@
 , python3
 , python3Packages
 , wafHook
-, boost175
+, boost
 , openssl
 , sqlite
 }:

 stdenv.mkDerivation rec {
  pname = "ndn-cxx";
-  version = "0.7.1";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "named-data";
    repo = "ndn-cxx";
    rev = "${pname}-${version}";
-    sha256 = "sha256-oTSc/lh0fDdk7dQeDhYKX5+gFl2t2Xlu1KkNmw7DitE=";
+    sha256 = "sha256-nnnxlkYVTSRB6ZcuIUDFol999+amGtqegHXK+06ITK8=";
  };

  nativeBuildInputs = [ doxygen pkg-config python3 python3Packages.sphinx wafHook ];

-  buildInputs = [ boost175 openssl sqlite ];
+  buildInputs = [ boost openssl sqlite ];

  wafConfigureFlags = [
    "--with-openssl=${openssl.dev}"
-    "--boost-includes=${boost175.dev}/include"
-    "--boost-libs=${boost175.out}/lib"
-    # "--with-tests" # disabled since upstream tests fail (Net/TestFaceUri/ParseDev Bug #3896)
+    "--boost-includes=${boost.dev}/include"
+    "--boost-libs=${boost.out}/lib"
+    "--with-tests"
  ];

-
-  doCheck = false; # disabled since upstream tests fail (Net/TestFaceUri/ParseDev Bug #3896)
+  doCheck = false; # some tests fail in upstream, some fail because of the sandbox environment
  checkPhase = ''
    runHook preCheck
-    LD_PRELOAD=build/ndn-cxx.so build/unit-tests
+    LD_PRELOAD=build/libndn-cxx.so build/unit-tests
    runHook postCheck
  '';

--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@ -186,7 +186,7 @@ rec {
  system-images = lib.flatten (map (apiVersion:
    map (type:
      map (abiVersion:
-        if lib.hasAttrByPath [apiVersion type abiVersion] system-images-packages then
+        lib.optionals (lib.hasAttrByPath [apiVersion type abiVersion] system-images-packages) (
          deployAndroidPackage {
            inherit os;
            package = system-images-packages.${apiVersion}.${type}.${abiVersion};
@ -197,7 +197,7 @@ rec {
              sed -i '/^Addon.Vendor/d' source.properties
            '';
          }
-        else []
+        )
      ) abiVersions
    ) systemImageTypes
  ) platformVersions);
@ -217,7 +217,7 @@ rec {
    };

  # All NDK bundles.
-  ndk-bundles = if includeNDK then map makeNdkBundle ndkVersions else [];
+  ndk-bundles = lib.optionals includeNDK (map makeNdkBundle ndkVersions);

  # The "default" NDK bundle.
  ndk-bundle = if includeNDK then lib.findFirst (x: x != null) null ndk-bundles else null;
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.37";
+  version = "9.2.38";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-MFQiLOCqEAKzST7voMIQH0TYGuwICSVBcQZwUkk9S1Q=";
+    hash = "sha256-nhvFBXOoxCWaSjUdPyQP234URI50DM3ZoweRK9d1LIA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aioaladdinconnect/default.nix
+++ b/pkgs/development/python-modules/aioaladdinconnect/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "aioaladdinconnect";
-  version = "0.1.55";
+  version = "0.1.56";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -15,7 +15,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "AIOAladdinConnect";
    inherit version;
-    hash = "sha256-Lyhv6JF+KuCiGz05EbXMEeXzVCI7ACsJmnEuAtDghYo=";
+    hash = "sha256-YLAIT33ItaNgokwensOan/OO2lK01GO/u5AZwzvuoPo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiohttp-jinja2/default.nix
+++ b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
@ -52,6 +52,6 @@ buildPythonPackage rec {
    description = "Jinja2 support for aiohttp";
    homepage = "https://github.com/aio-libs/aiohttp_jinja2";
    license = licenses.asl20;
-    maintainers = with maintainers; [ peterhoeg ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -31,7 +31,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.37";
+  version = "9.2.38";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -40,7 +40,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-sl3GzNMN90ez1Zks43B2How7QTaaJZbxOxK2hl/UzdQ=";
+    hash = "sha256-9/7GiF+Q7AUmKEqleVF8brCFSAqswalXxgPCApD19ZE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/approvaltests/default.nix
+++ b/pkgs/development/python-modules/approvaltests/default.nix
@ -19,7 +19,7 @@
 }:

 buildPythonPackage rec {
-  version = "8.1.0";
+  version = "8.2.0";
  pname = "approvaltests";
  format = "setuptools";

@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "approvals";
    repo = "ApprovalTests.Python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-01OgofksXFglohcQtJqkir/nqBJArw3pXEmnX9P7rOA=";
+    hash = "sha256-7OeFOPBOs+SXKOQGKxiigVvoY50+bqRo+oDbVYTMQxU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.37";
+  version = "9.2.38";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-WGc6FmrS0aVmiY5s8fUVHCT6cqcmj52H6FD2TR1HyK0=";
+    hash = "sha256-fpYoX5+TrZaozq7E3qBlhYUPrbbL3fb+wadQToLqtU0=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.37";
+  version = "9.2.38";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-8kABsLp3Nrzjn7staiNfU6HdQTu1x6DNQzilMceqKVY=";
+    hash = "sha256-nKUp8N1T6fcXd1V9Ppqb5fFy8UHGPE/tiyHIanhgUoE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -16,7 +16,7 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.37";
+  version = "9.2.38";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-vgH8UAR8B4l29RH0dwMlGVjOHgdcOTfLMHPiKN9Z36s=";
+    hash = "sha256-3B62NMlAGv4Q6HOkACafBETbOj4QsWsvfrTAM+5b9NY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-pubsub";
-  version = "2.14.0";
+  version = "2.14.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-4nFPB7dQRYvq9bB7Zw6ntgWO4VXAIcmH0LjmpAvzRG8=";
+    hash = "sha256-KLPGICGwT3j5FYwVfb/K6+n/tQTt0pda0PIo6/AgTG8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/grad-cam/default.nix
+++ b/pkgs/development/python-modules/grad-cam/default.nix
@ -0,0 +1,65 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, matplotlib
+, numpy
+, opencv4
+, pillow
+, scikitlearn
+, torch
+, torchvision
+, ttach
+, tqdm
+}:
+
+buildPythonPackage rec {
+  pname = "grad-cam";
+  version = "1.4.6";
+  disabled = pythonOlder "3.6";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-sL4+UUfC60JWAgJPvXeVGUHAskuoceVYwYDrYlibUOE=";
+  };
+
+  postPatch = ''
+    substituteInPlace requirements.txt --replace "opencv-python" "opencv"
+  '';
+
+  propagatedBuildInputs = [
+    matplotlib
+    numpy
+    opencv4
+    pillow
+    scikitlearn
+    torchvision
+    ttach
+    tqdm
+  ];
+
+  # Let the user bring their own instance (as with torchmetrics)
+  buildInputs = [
+    torch
+  ];
+
+  doCheck = false;  # every nontrivial test tries to download a pretrained model
+
+  pythonImportsCheck = [
+    "pytorch_grad_cam"
+    "pytorch_grad_cam.metrics"
+    "pytorch_grad_cam.metrics.cam_mult_image"
+    "pytorch_grad_cam.metrics.road"
+    "pytorch_grad_cam.utils"
+    "pytorch_grad_cam.utils.image"
+    "pytorch_grad_cam.utils.model_targets"
+  ];
+
+  meta = with lib; {
+    description = "Advanced AI explainability for computer vision.";
+    homepage = "https://jacobgil.github.io/pytorch-gradcam-book";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@ -42,7 +42,7 @@ buildPythonPackage {
  # Revisit this whenever package or Rust is upgraded
  RUSTC_BOOTSTRAP = 1;

-  propagatedBuildInputs = if pythonOlder "3.10" then [ typing-extensions ] else [];
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.10") [ typing-extensions ];

  nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];

--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "pontos";
-  version = "23.2.8";
+  version = "23.2.9";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-yxE+Gx48JQE++7SB8ouwgh2/rKKv8CC0QQSvwaSeFVc=";
+    hash = "sha256-+oHqBopA2FLrDdxsVQhciW4ZXluZn+z05LmHtyDtFyI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyopenuv/default.nix
+++ b/pkgs/development/python-modules/pyopenuv/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pyopenuv";
-  version = "2023.01.0";
+  version = "2023.02.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "bachya";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-qPLfah35E0vX2tQhGw4wTSMyE4nIyWMDIaKlJePVSd4=";
+    hash = "sha256-EiTTck6hmOGSQ7LyZsbhnH1zgkH8GccejLdJaH2m0F8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyregion/default.nix
+++ b/pkgs/development/python-modules/pyregion/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
@ -47,6 +48,13 @@ buildPythonPackage rec {

  nativeCheckInputs = [ pytestCheckHook pytest-astropy ];

+  disabledTests = lib.optional (!stdenv.hostPlatform.isDarwin) [
+    # Skipping 2 tests because it's failing. Domain knowledge was unavailable on decision.
+    # Error logs: https://gist.github.com/superherointj/3f616f784014eeb2e3039b0f4037e4e9
+    "test_calculate_rotation_angle"
+    "test_region"
+  ];
+
  # Disable automatic update of the astropy-helper module
  postPatch = ''
    substituteInPlace setup.cfg --replace "auto_use = True" "auto_use = False"
--- a/pkgs/development/python-modules/python-matter-server/default.nix
+++ b/pkgs/development/python-modules/python-matter-server/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "python-matter-server";
-  version = "2.0.2";
+  version = "2.1.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "home-assistant-libs";
    repo = "python-matter-server";
    rev = "refs/tags/${version}";
-    hash = "sha256-9Lb5Q54hPdyqMjrHvwBzVXPk8uKBLNRUl2Bljo64Fpo=";
+    hash = "sha256-T7afZsrvvJeEfLZm4jopAtfQ0Bhqa+s77SyrJToyUWU=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "pyvex";
-  version = "9.2.37";
+  version = "9.2.38";
  format = "pyproject";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-JGTfOE16tycBkbsihKPgSZPlfqun1vr/86kAlNwrSZA=";
+    hash = "sha256-9Cv0Quh0uN/DxOG1J2QCFb8fqRJTyovixmU8X721t8o=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "reolink-aio";
-  version = "0.4.0";
+  version = "0.4.2";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "starkillerOG";
    repo = "reolink_aio";
    rev = "refs/tags/${version}";
-    hash = "sha256-fMB71fUMtckXiwCXaDHy3jmh0MsdKtamatEL+gYSdXA=";
+    hash = "sha256-7XD8nmuja8BL66OCdflKWiKyR47TRXUjJLSmcgqSl8g=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/twitchapi/default.nix
+++ b/pkgs/development/python-modules/twitchapi/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "twitchapi";
-  version = "3.7.0";
+  version = "3.8.0";

  disabled = pythonOlder "3.7";

@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "twitchAPI";
    inherit version;
-    hash = "sha256-zmMzHuaSsuj2MxkmQyzROrZ/zxO0/I7llKlnpZzauDw=";
+    hash = "sha256-gGLSR6XESaUUt31njQJtPeTOKSgVJHlS+UdYhPKvQJQ=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/types-urllib3/default.nix
+++ b/pkgs/development/python-modules/types-urllib3/default.nix
@ -5,12 +5,12 @@

 buildPythonPackage rec {
  pname = "types-urllib3";
-  version = "1.26.25.5";
+  version = "1.26.25.6";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-VjDleCRtFw2R6+OQF4jNKNU8TgRNwuJIjjsNVftoldg=";
+    hash = "sha256-NVhnJ8vXdRrMzywPNKiLr/wJL0NatiRY8Qd2RmWQ8tU=";
  };

  # Module doesn't have tests
--- a/pkgs/development/ruby-modules/with-packages/Gemfile
+++ b/pkgs/development/ruby-modules/with-packages/Gemfile
@ -84,6 +84,7 @@ gem 'jwt'
 gem 'kramdown-rfc2629'
 gem 'libv8'
 gem 'libxml-ruby'
+gem 'mail'
 gem 'magic'
 gem 'markaby'
 gem 'method_source'
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "cppcheck";
-  version = "2.10";
+  version = "2.9.3";

  src = fetchFromGitHub {
    owner = "danmar";
    repo = "cppcheck";
    rev = version;
-    hash = "sha256-Ss35foFlh4sw6TxMp++0b9E5KDUjBpDPuWIHsak8OGY=";
+    hash = "sha256-AaZzr5r+tpG5M40HSx45KCUBPhN/nSpXxS5H3FuSx2c=";
  };

  buildInputs = [ pcre
--- a/pkgs/games/xjump/default.nix
+++ b/pkgs/games/xjump/default.nix
@ -12,12 +12,8 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ autoconf automake ];
  buildInputs = [ libX11 libXt libXpm libXaw ];
  preConfigure = "autoreconf --install";
-  patches = if stdenv.buildPlatform.isDarwin then [ ./darwin.patch ] else [];
-  configureFlags =
-    if localStateDir != null then
-      ["--localstatedir=${localStateDir}"]
-    else
-      [];
+  patches = lib.optionals stdenv.buildPlatform.isDarwin [ ./darwin.patch ];
+  configureFlags = lib.optionals (localStateDir != null) ["--localstatedir=${localStateDir}"];

  meta = with lib; {
    description = "The falling tower game";
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -32,12 +32,12 @@
    "5.15": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.15.92-hardened1.patch",
-            "sha256": "0wwi15r51jb0396vc4nbwjh9kxh68jvcbdw72pllwsgkhijgzkhg",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.92-hardened1/linux-hardened-5.15.92-hardened1.patch"
+            "name": "linux-hardened-5.15.93-hardened1.patch",
+            "sha256": "093a6qpiws4v8pzld6r92dczwvslrp8f2xrpb29qrp37i3kny5si",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.93-hardened1/linux-hardened-5.15.93-hardened1.patch"
        },
-        "sha256": "14ggwrvk9n2nvk38fp4g486k864knf3n9979mm51m8wrvd8h8hlz",
-        "version": "5.15.92"
+        "sha256": "1baxkkd572110p95ah1wv0b4i2hfbkf8vyncb08y3w0bd7r29vg7",
+        "version": "5.15.93"
    },
    "5.4": {
        "patch": {
@ -52,11 +52,11 @@
    "6.1": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-6.1.10-hardened1.patch",
-            "sha256": "0v0w4phc02ghylqnyhzkl1frmjkxwkxgadf2ycyzm8ckl73q8lr5",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.10-hardened1/linux-hardened-6.1.10-hardened1.patch"
+            "name": "linux-hardened-6.1.11-hardened1.patch",
+            "sha256": "1pydcjy2cjnb4zxcqr41hr34fg8alph314xasdsfvdw4zaz55s6h",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.11-hardened1/linux-hardened-6.1.11-hardened1.patch"
        },
-        "sha256": "17fifhfh2jrvlhry696n428ldl5ag3g2km5l9hx8gx8wm6dr3qhb",
-        "version": "6.1.10"
+        "sha256": "18gpkaa030g8mgmyprl05h4i8y5rjgyvbh0jcl8waqvq0xh0a6sq",
+        "version": "6.1.11"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.15.93";
+  version = "5.15.94";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1baxkkd572110p95ah1wv0b4i2hfbkf8vyncb08y3w0bd7r29vg7";
+    sha256 = "0wjsqvhp0jnisypb8yw6dncyp5k7zxbhjivh7jqivpsdwvdp14ns";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "6.1.11";
+  version = "6.1.12";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "18gpkaa030g8mgmyprl05h4i8y5rjgyvbh0jcl8waqvq0xh0a6sq";
+    sha256 = "1spdl3i69qwn7cywzs6kql8nlisdnmnwk9za7v4xq1092xsscynl";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@ -6,7 +6,7 @@
 , ... } @ args:

 let
-  version = "5.15.92-rt57"; # updated by ./update-rt.sh
+  version = "5.15.93-rt58"; # updated by ./update-rt.sh
  branch = lib.versions.majorMinor version;
  kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@ -18,14 +18,14 @@ in buildLinux (args // {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "14ggwrvk9n2nvk38fp4g486k864knf3n9979mm51m8wrvd8h8hlz";
+    sha256 = "1baxkkd572110p95ah1wv0b4i2hfbkf8vyncb08y3w0bd7r29vg7";
  };

  kernelPatches = let rt-patch = {
    name = "rt";
    patch = fetchurl {
      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "181db4cdaw8wjrqfh07mbqgyzv1awl1g12x6k8lciv78j10x5kmb";
+      sha256 = "10xx70qf6nph3223yh6sc5jcyy938qrfdilli2a4zzhp0ibgp8bz";
    };
  }; in [ rt-patch ] ++ kernelPatches;

--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -4,16 +4,16 @@ let
  # comments with variant added for update script
  # ./update-zen.py zen
  zenVariant = {
-    version = "6.1.10"; #zen
+    version = "6.1.12"; #zen
    suffix = "zen1"; #zen
-    sha256 = "0dfn449v3lzz1clxbsypakd0sfii9iycy1hq9x52fr9xf8wy3cxk"; #zen
+    sha256 = "16g0rkgmxbj4425mbnadam7vbd8621ar13ddx26j298bc9m8yqic"; #zen
    isLqx = false;
  };
  # ./update-zen.py lqx
  lqxVariant = {
-    version = "6.1.10"; #lqx
+    version = "6.1.12"; #lqx
    suffix = "lqx1"; #lqx
-    sha256 = "1ka94z0wvq90vfzd4ncjrzk5xcb5gvaldaph7mc25jxgh6pal822"; #lqx
+    sha256 = "0a6slrydf47hk4b3xlxycjw9y2xgjgvzjic2psbcb1c5y75zq720"; #lqx
    isLqx = true;
  };
  zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "microcode-intel";
-  version = "20221108";
+  version = "20230214";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "Intel-Linux-Processor-Microcode-Data-Files";
    rev = "microcode-${version}";
-    hash = "sha256-JZbBrD3fHgJogDw4u2YggDX7OCXCu5/XEZKzHuVJR9k=";
+    hash = "sha256-SwdE1c7OEg5nncs5QqaTKCL77KddeHw7ZilctQ4L9RA=";
  };

  nativeBuildInputs = [ iucode-tool libarchive ];
--- a/pkgs/servers/adguardhome/bins.nix
+++ b/pkgs/servers/adguardhome/bins.nix
@ -1,31 +1,31 @@
 { fetchurl, fetchzip }:
 {
 x86_64-darwin = fetchzip {
-  sha256 = "sha256-ZhezLVn4PHPAnKCjlR9zI4zt9eJZYIUUODjS01M7q1E=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.23/AdGuardHome_darwin_amd64.zip";
+  sha256 = "sha256-sfEnGeWjqCjjZSUUVMi5tsqXdrkCPXrg7Xpi8jTmjLU=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.24/AdGuardHome_darwin_amd64.zip";
 };
 aarch64-darwin = fetchzip {
-  sha256 = "sha256-Vfu/mCR1rMBtYMsm/l5cfIwBnNNeJ7G0pC42rLdqWOk=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.23/AdGuardHome_darwin_arm64.zip";
+  sha256 = "sha256-htHUgx/A+AOhlbEjK5tEvJ0GbC/GsEUz/N2x9Wfyr5o=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.24/AdGuardHome_darwin_arm64.zip";
 };
 i686-linux = fetchurl {
-  sha256 = "sha256-1pgGKUE9hHFGPNAOYNEM0VTYBDdmcrXyJjcT9ymyyiM=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.23/AdGuardHome_linux_386.tar.gz";
+  sha256 = "sha256-VzPxraAqmTp6c9OFw3VbpcpzRVkAxiaOlA/eQT7z/js=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.24/AdGuardHome_linux_386.tar.gz";
 };
 x86_64-linux = fetchurl {
-  sha256 = "sha256-ApCBjbhfoGYm0rmjQ8U1zA/VHNJgC1kBlk5DvmQ6wTc=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.23/AdGuardHome_linux_amd64.tar.gz";
+  sha256 = "sha256-cQMKUL5RT+CJiCwXnOPc9o0AwDmo0Z6X8L8TjWTKwpY=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.24/AdGuardHome_linux_amd64.tar.gz";
 };
 aarch64-linux = fetchurl {
-  sha256 = "sha256-qC7BrBhI9berbuIVIQ6yOo74eHRsoneVRJMx1K/Ljds=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.23/AdGuardHome_linux_arm64.tar.gz";
+  sha256 = "sha256-TixmsB8ZmevQB/ZK7NhtZGchDm+r8XRkCR7qiaUTKLE=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.24/AdGuardHome_linux_arm64.tar.gz";
 };
 armv6l-linux = fetchurl {
-  sha256 = "sha256-cWoEpOScFzcz3tsG7IIBV2xpBT+uvSYMEfrmE3pohWA=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.23/AdGuardHome_linux_armv6.tar.gz";
+  sha256 = "sha256-OUvxgvF8qtLuFVuhLYEL7HipcTZrpuYxp8u7uroaUMc=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.24/AdGuardHome_linux_armv6.tar.gz";
 };
 armv7l-linux = fetchurl {
-  sha256 = "sha256-DTGyyNCncbGrrpHzcIxpZqukAYsHarqSJhlbYvjN6dA=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.23/AdGuardHome_linux_armv7.tar.gz";
+  sha256 = "sha256-okhx2mOIBzJevugpcUh12D85WATV7iCqiiOuvOgUezI=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.24/AdGuardHome_linux_armv7.tar.gz";
 };
 }
--- a/pkgs/servers/adguardhome/default.nix
+++ b/pkgs/servers/adguardhome/default.nix
@ -7,7 +7,7 @@ in

 stdenv.mkDerivation rec {
  pname = "adguardhome";
-  version = "0.107.23";
+  version = "0.107.24";
  src = sources.${system} or (throw "Source for ${pname} is not available for ${system}");

  installPhase = ''
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  passthru = {
    updateScript = ./update.sh;
-    schema_version = 14;
+    schema_version = 16;
    tests.adguardhome = nixosTests.adguardhome;
  };

--- a/pkgs/servers/caddy/default.nix
+++ b/pkgs/servers/caddy/default.nix
@ -7,12 +7,12 @@
 , installShellFiles
 }:
 let
-  version = "2.6.3";
+  version = "2.6.4";
  dist = fetchFromGitHub {
    owner = "caddyserver";
    repo = "dist";
    rev = "v${version}";
-    sha256 = "sha256-SJO1q4g9uyyky9ZYSiqXJgNIvyxT5RjrpYd20YDx8ec=";
+    hash = "sha256-SJO1q4g9uyyky9ZYSiqXJgNIvyxT5RjrpYd20YDx8ec=";
  };
 in
 buildGoModule {
@ -23,10 +23,10 @@ buildGoModule {
    owner = "caddyserver";
    repo = "caddy";
    rev = "v${version}";
-    sha256 = "sha256-YH+lo6gKqmhu1/3HZdWXnxTXaUwC8To+OCmGpji6i3k=";
+    hash = "sha256-3a3+nFHmGONvL/TyQRqgJtrSDIn0zdGy9YwhZP17mU0=";
  };

-  vendorSha256 = "sha256-sqjN+NgwdP2qw7/CBxKvSwwA3teg/trXg/oa1Ff0N8s=";
+  vendorHash = "sha256-toi6efYZobjDV3YPT9seE/WZAzNaxgb1ioVG4txcuXM=";

  subPackages = [ "cmd/caddy" ];

--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2023.2.4";
+  version = "2023.2.5";
  components = {
    "3_day_blinds" = ps: with ps; [
    ];
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -270,7 +270,7 @@ let
  extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.2.4";
+  hassVersion = "2023.2.5";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@ -288,7 +288,7 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = "refs/tags/${version}";
-    hash = "sha256-Lt/t4S6To0MvdvmdKir7VytrNXPGhC7sMfjQmgox5XY=";
+    hash = "sha256-7rH4tEW5gQZ/dPkgGzygfT2PwdZGASuyiFrNyn3hfys=";
  };

  nativeBuildInputs = with python3.pkgs; [
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@ -31,14 +31,12 @@ outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
 , passthru ? { tests = {}; }
 }:

-with lib;
-
 let

  moduleNames = map (mod: mod.name or (throw "The nginx module with source ${toString mod.src} does not have a `name` attribute. This prevents duplicate module detection and is no longer supported."))
    modules;

-  mapModules = attrPath: flip concatMap modules
+  mapModules = attrPath: lib.flip lib.concatMap modules
    (mod:
      let supports = mod.supports or (_: true);
      in
@ -47,8 +45,8 @@ let

 in

-assert assertMsg (unique moduleNames == moduleNames)
-  "nginx: duplicate modules: ${concatStringsSep ", " moduleNames}. A common cause for this is that services.nginx.additionalModules adds a module which the nixos module itself already adds.";
+assert lib.assertMsg (lib.unique moduleNames == moduleNames)
+  "nginx: duplicate modules: ${lib.concatStringsSep ", " moduleNames}. A common cause for this is that services.nginx.additionalModules adds a module which the nixos module itself already adds.";

 stdenv.mkDerivation {
  inherit pname version nginxVersion;
@ -94,37 +92,37 @@ stdenv.mkDerivation {
    "--http-fastcgi-temp-path=/tmp/nginx_fastcgi"
    "--http-uwsgi-temp-path=/tmp/nginx_uwsgi"
    "--http-scgi-temp-path=/tmp/nginx_scgi"
-  ] ++ optionals withDebug [
+  ] ++ lib.optionals withDebug [
    "--with-debug"
-  ] ++ optionals withKTLS [
+  ] ++ lib.optionals withKTLS [
    "--with-openssl-opt=enable-ktls"
-  ] ++ optionals withStream [
+  ] ++ lib.optionals withStream [
    "--with-stream"
    "--with-stream_realip_module"
    "--with-stream_ssl_module"
    "--with-stream_ssl_preread_module"
-  ] ++ optionals withMail [
+  ] ++ lib.optionals withMail [
    "--with-mail"
    "--with-mail_ssl_module"
-  ] ++ optionals withPerl [
+  ] ++ lib.optionals withPerl [
    "--with-http_perl_module"
    "--with-perl=${perl}/bin/perl"
    "--with-perl_modules_path=lib/perl5"
-  ] ++ optional withSlice "--with-http_slice_module"
-    ++ optional (gd != null) "--with-http_image_filter_module"
-    ++ optional (geoip != null) "--with-http_geoip_module"
-    ++ optional (withStream && geoip != null) "--with-stream_geoip_module"
-    ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
+  ] ++ lib.optional withSlice "--with-http_slice_module"
+    ++ lib.optional (gd != null) "--with-http_image_filter_module"
+    ++ lib.optional (geoip != null) "--with-http_geoip_module"
+    ++ lib.optional (withStream && geoip != null) "--with-stream_geoip_module"
+    ++ lib.optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
    ++ configureFlags
    ++ map (mod: "--add-module=${mod.src}") modules;

  NIX_CFLAGS_COMPILE = toString ([
    "-I${libxml2.dev}/include/libxml2"
    "-Wno-error=implicit-fallthrough"
-  ] ++ optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
    # fix build vts module on gcc11
    "-Wno-error=stringop-overread"
-  ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations");
+  ] ++ lib.optional stdenv.isDarwin "-Wno-error=deprecated-declarations");

  configurePlatforms = [];

@ -133,7 +131,7 @@ stdenv.mkDerivation {
  preConfigure = ''
    setOutputFlags=
  '' + preConfigure
-     + concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules;
+     + lib.concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules;

  patches = map fixPatch ([
    (substituteAll {
@ -143,7 +141,7 @@ stdenv.mkDerivation {
      '';
    })
    ./nix-skip-check-logs-path.patch
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    (fetchpatch {
      url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/102-sizeof_test_fix.patch";
      sha256 = "0i2k30ac8d7inj9l6bl0684kjglam2f68z8lf3xggcc2i5wzhh8a";
@ -161,7 +159,7 @@ stdenv.mkDerivation {

  inherit postPatch;

-  hardeningEnable = optional (!stdenv.isDarwin) "pie";
+  hardeningEnable = lib.optional (!stdenv.isDarwin) "pie";

  enableParallelBuilding = true;

@ -186,7 +184,7 @@ stdenv.mkDerivation {
    } // passthru.tests;
  };

-  meta = if meta != null then meta else {
+  meta = if meta != null then meta else with lib; {
    description = "A reverse proxy and lightweight webserver";
    homepage    = "http://nginx.org";
    license     = licenses.bsd2;
--- a/pkgs/servers/nfd/default.nix
+++ b/pkgs/servers/nfd/default.nix
@ -1,6 +1,6 @@
 { lib
 , stdenv
-, boost175
+, boost
 , fetchFromGitHub
 , libpcap
 , ndn-cxx
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "nfd";
-  version = "0.7.1";
+  version = "22.12";

  src = fetchFromGitHub {
    owner = "named-data";
    repo = lib.toUpper pname;
    rev = "NFD-${version}";
-    sha256 = "sha256-8Zm8oxbpw9qD31NuofDdgPYnTWIz5E04NhkZhiRkK9E=";
+    sha256 = "sha256-epY5qtET7rsKL3KIKvxfa+wF+AGZbYs+zRhy8SnIffk=";
    fetchSubmodules = true;
  };

@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
  buildInputs = [ libpcap ndn-cxx openssl websocketpp ] ++ lib.optional withSystemd systemd;

  wafConfigureFlags = [
-    "--boost-includes=${boost175.dev}/include"
-    "--boost-libs=${boost175.out}/lib"
+    "--boost-includes=${boost.dev}/include"
+    "--boost-libs=${boost.out}/lib"
    "--with-tests"
  ] ++ lib.optional (!withWebSocket) "--without-websocket";

@ -50,6 +50,6 @@ stdenv.mkDerivation rec {
    description = "Named Data Networking (NDN) Forwarding Daemon";
    license = licenses.gpl3Plus;
    platforms = platforms.unix;
-    maintainers = [ lib.maintainers.bertof ];
+    maintainers = with maintainers; [ bertof ];
  };
 }
--- a/pkgs/servers/search/opensearch/default.nix
+++ b/pkgs/servers/search/opensearch/default.nix
@ -0,0 +1,54 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, makeWrapper
+, jre_headless
+, util-linux
+, gnugrep
+, coreutils
+, autoPatchelfHook
+, zlib
+, nixosTests
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "opensearch";
+  version = "2.5.0";
+
+  src = fetchurl {
+    url = "https://artifacts.opensearch.org/releases/bundle/opensearch/${version}/opensearch-${version}-linux-x64.tar.gz";
+    hash = "sha256-WPD5StVBb/hK+kP/1wkQQBKRQma/uaP+8ULeIFUBL1U=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre_headless util-linux ];
+  patches = [./opensearch-home-fix.patch ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -R bin config lib modules plugins $out
+
+    substituteInPlace $out/bin/opensearch \
+      --replace 'bin/opensearch-keystore' "$out/bin/opensearch-keystore"
+
+    wrapProgram $out/bin/opensearch \
+      --prefix PATH : "${lib.makeBinPath [ util-linux gnugrep coreutils ]}" \
+      --set JAVA_HOME "${jre_headless}"
+
+    wrapProgram $out/bin/opensearch-plugin --set JAVA_HOME "${jre_headless}"
+
+    runHook postInstall
+  '';
+
+  passthru.tests = nixosTests.opensearch;
+
+  meta = {
+    description = "Open Source, Distributed, RESTful Search Engine";
+    homepage = "https://github.com/opensearch-project/OpenSearch";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ shyim ];
+  };
+}
--- a/pkgs/servers/search/opensearch/opensearch-home-fix.patch
+++ b/pkgs/servers/search/opensearch/opensearch-home-fix.patch
@ -0,0 +1,26 @@
+diff -Naur a/bin/opensearch-env b/bin/opensearch-env
+--- a/bin/opensearch-env	2017-12-12 13:31:51.000000000 +0100
+++ b/bin/opensearch-env	2017-12-18 19:51:12.282809695 +0100
+@@ -19,18 +19,10 @@
+   fi
+ done
+ 
+-# determine OpenSearch home; to do this, we strip from the path until we find
+-# bin, and then strip bin (there is an assumption here that there is no nested
+-# directory under bin also named bin)
+-OPENSEARCH_HOME=`dirname "$SCRIPT"`
+-
+-# now make OPENSEARCH_HOME absolute
+-OPENSEARCH_HOME=`cd "$OPENSEARCH_HOME"; pwd`
+-
+-while [ "`basename "$OPENSEARCH_HOME"`" != "bin" ]; do
+-  OPENSEARCH_HOME=`dirname "$OPENSEARCH_HOME"`
+-done
+-OPENSEARCH_HOME=`dirname "$OPENSEARCH_HOME"`
+if [ -z "$OPENSEARCH_HOME" ]; then
+    echo "You must set the OPENSEARCH_HOME var" >&2
+    exit 1
+fi
+ 
+ # now set the classpath
+ OPENSEARCH_CLASSPATH="$OPENSEARCH_HOME/lib/*"
--- a/pkgs/servers/static-web-server/default.nix
+++ b/pkgs/servers/static-web-server/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "static-web-server";
-  version = "2.14.1";
+  version = "2.14.2";

  src = fetchFromGitHub {
    owner = "static-web-server";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1x9l39yf65a8ji8x84h583s82hlj6s99gj0fsm4sh2l4i8yrq2yb";
+    sha256 = "sha256-c+bPe1t7Nhpx5fwwpLYtsuzxleLd4b1SwBFBaySmLOg=";
  };

-  cargoSha256 = "sha256-Ox1mHjeBprxmuqPIVxeTXDyFcEuipSJ7UjXZjcLElIs=";
+  cargoSha256 = "sha256-K+YXl1SFVe6aBt663QXlQFD8jB5pvlLwNqUvUP+5aU8=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Security
--- a/pkgs/shells/nix-your-shell/default.nix
+++ b/pkgs/shells/nix-your-shell/default.nix
@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "nix-your-shell";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "MercuryTechnologies";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-kdZFwMHatnhdXGSIItuE3g27qqUKqT/Hkbz13Ba5eq4=";
+    sha256 = "sha256-W3MeApvqO3hBaHWu6vyrR6pniEMMKiXTAQ0bhUPbpx8=";
  };

-  cargoSha256 = "sha256-U4nN/N345XFRj0L9cLJAjRuND0W3OE6XEB/z3zXaUiQ=";
+  cargoSha256 = "sha256-M6yj4jTTWnembVX51/Xz+JtKhWJsmQ7SpipH8pHzids=";

  meta = with lib; {
    description = "A `nix` and `nix-shell` wrapper for shells other than `bash`";
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@ -322,7 +322,7 @@ let
        }"
    else
      "key 'meta.${k}' is unrecognized; expected one of: \n  [${lib.concatMapStringsSep ", " (x: "'${x}'") (lib.attrNames metaTypes)}]";
-  checkMeta = meta: if config.checkMeta then lib.remove null (lib.mapAttrsToList checkMetaAttr meta) else [];
+  checkMeta = meta: lib.optionals config.checkMeta (lib.remove null (lib.mapAttrsToList checkMetaAttr meta));

  checkOutputsToInstall = attrs: let
      expectedOutputs = attrs.meta.outputsToInstall or [];
--- a/pkgs/stdenv/native/default.nix
+++ b/pkgs/stdenv/native/default.nix
@ -12,9 +12,9 @@ let
    else "/bin/bash";

  path =
-    (if system == "i686-solaris" then [ "/usr/gnu" ] else []) ++
-    (if system == "i686-netbsd" then [ "/usr/pkg" ] else []) ++
-    (if system == "x86_64-solaris" then [ "/opt/local/gnu" ] else []) ++
+    (lib.optionals (system == "i686-solaris") [ "/usr/gnu" ]) ++
+    (lib.optionals (system == "i686-netbsd") [ "/usr/pkg" ]) ++
+    (lib.optionals (system == "x86_64-solaris") [ "/opt/local/gnu" ]) ++
    ["/" "/usr" "/usr/local"];

  prehookBase = ''
--- a/pkgs/tools/admin/pulumi/default.nix
+++ b/pkgs/tools/admin/pulumi/default.nix
@ -14,21 +14,21 @@

 buildGoModule rec {
  pname = "pulumi";
-  version = "3.54.0";
+  version = "3.55.0";

  # Used in pulumi-language packages, which inherit this prop
-  sdkVendorHash = "sha256-NstNzPKHlN8S+HSpYnG60ZtZtUQsh1Idr8Zz2Ef/jiw=";
+  sdkVendorHash = "sha256-ZE+df01jRx3nDiPGdlh1JNJn5NqsHW22fiUzeNlkzF8=";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Rl0kh9NCliADfU9Nxc2SwnOIGDilYEeA0rcVCfal5N8=";
+    hash = "sha256-x5XebYFpxFi2QgrrK+wdMFOLiJLnRmar4gsply8F718=";
    # Some tests rely on checkout directory name
    name = "pulumi";
  };

-  vendorSha256 = "sha256-Bkmpw+ZneB1zHmaV4S29LFNoCjB2QmO5nR/iwQQQPpo=";
+  vendorSha256 = "sha256-8vchyD3MTi9Fxrd6SiywFK4tadyauvDxjs9RmoJuULA=";

  sourceRoot = "${src.name}/pkg";

--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "syft";
-  version = "0.70.0";
+  version = "0.71.0";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Dr0kVJk2LyyRFZq1fZBQSLb7z/AfCm8Y+tIMm8JmyJo=";
+    hash = "sha256-Q02WBUMwboGkXrSjCT2C3vLYH4UlnavIudvOSb5g2bA=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -22,7 +22,7 @@ buildGoModule rec {
  };
  # hash mismatch with darwin
  proxyVendor = true;
-  vendorHash = "sha256-UB0ltY4CYlsH4CyQZSOHDH8C9jSCL0TCri33H3oPH/0=";
+  vendorHash = "sha256-bUSQk4uJ4TAhjLS8pjqC486sa31z/MyZf5jDsnxhtSM=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/archivers/zip/default.nix
+++ b/pkgs/tools/archivers/zip/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
    "INSTALL=cp"
  ];

-  patches = if (enableNLS && !stdenv.isCygwin) then [ ./natspec-gentoo.patch.bz2 ] else [];
+  patches = lib.optionals (enableNLS && !stdenv.isCygwin) [ ./natspec-gentoo.patch.bz2 ];

  buildInputs = lib.optional enableNLS libnatspec
    ++ lib.optional stdenv.isCygwin libiconv;
--- a/pkgs/tools/audio/soco-cli/default.nix
+++ b/pkgs/tools/audio/soco-cli/default.nix
@ -5,7 +5,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "soco-cli";
-  version = "0.4.21";
+  version = "0.4.55";
  format = "setuptools";

  disabled = python3.pythonOlder "3.6";
@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "avantrec";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1kz2zx59gjfs01jiyzmps8j6yca06yqn6wkidvdk4s3izdm0rarw";
+    sha256 = "sha256-zdu1eVtVBTYa47KjGc5fqKN6olxp98RoLGT2sNCfG9E=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/tools/misc/cf-terraforming/default.nix
+++ b/pkgs/tools/misc/cf-terraforming/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "cf-terraforming";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cf-terraforming";
    rev = "v${version}";
-    sha256 = "sha256-wELV3Jp11Iv3G//VOAosL5QDnbNTyEAvq9hmLWDdPBU=";
+    sha256 = "sha256-2YL+ncT1UcanslFnMIMonvGugD7HxO6taYZtKK6kmEc=";
  };

-  vendorHash = "sha256-XFJGw76Fz9tzknWuzc1aw1uJ34UQfFLe1WUVtPGbn64=";
+  vendorHash = "sha256-eAWgLR3wqcTmlA3hG9IGgTm/Q+EKcypXYXRdtRAb94o=";
  ldflags = [ "-X github.com/cloudflare/cf-terraforming/internal/app/cf-terraforming/cmd.versionString=${version}" ];

  # The test suite insists on downloading a binary release of Terraform from
--- a/Show More
+++ b/Show More