Merge master into haskell-updates

2023-03-24 00:12:50 +00:00 · 2023-03-24 00:12:50 +00:00 · 28ee5a375a
parent 0d1b947217 a64e169e39
commit 28ee5a375a
276 changed files with 4451 additions and 2465 deletions
--- a/maintainers/scripts/update-octave-packages
+++ b/maintainers/scripts/update-octave-packages
@ -0,0 +1,468 @@
+#!/usr/bin/env nix-shell
+#!nix-shell update-octave-shell.nix -i python3
+
+"""
+Update a Octave package expression by passing in the `.nix` file, or the directory containing it.
+You can pass in multiple files or paths.
+
+You'll likely want to use
+``
+  $ ./update-octave-libraries ../../pkgs/development/octave-modules/**/default.nix
+``
+to update all non-pinned libraries in that folder.
+"""
+
+import argparse
+import os
+import pathlib
+import re
+import requests
+import yaml
+from concurrent.futures import ThreadPoolExecutor as Pool
+from packaging.version import Version as _Version
+from packaging.version import InvalidVersion
+from packaging.specifiers import SpecifierSet
+import collections
+import subprocess
+import tempfile
+
+INDEX = "https://raw.githubusercontent.com/gnu-octave/packages/main/packages"
+"""url of Octave packages' source on GitHub"""
+
+EXTENSIONS = ['tar.gz', 'tar.bz2', 'tar', 'zip']
+"""Permitted file extensions. These are evaluated from left to right and the first occurance is returned."""
+
+PRERELEASES = False
+
+GIT = "git"
+
+NIXPGKS_ROOT = subprocess.check_output(["git", "rev-parse", "--show-toplevel"]).decode('utf-8').strip()
+
+import logging
+logging.basicConfig(level=logging.INFO)
+
+
+class Version(_Version, collections.abc.Sequence):
+
+    def __init__(self, version):
+        super().__init__(version)
+        # We cannot use `str(Version(0.04.21))` because that becomes `0.4.21`
+        # https://github.com/avian2/unidecode/issues/13#issuecomment-354538882
+        self.raw_version = version
+
+    def __getitem__(self, i):
+        return self._version.release[i]
+
+    def __len__(self):
+        return len(self._version.release)
+
+    def __iter__(self):
+        yield from self._version.release
+
+
+def _get_values(attribute, text):
+    """Match attribute in text and return all matches.
+
+    :returns: List of matches.
+    """
+    regex = '{}\s+=\s+"(.*)";'.format(attribute)
+    regex = re.compile(regex)
+    values = regex.findall(text)
+    return values
+
+def _get_unique_value(attribute, text):
+    """Match attribute in text and return unique match.
+
+    :returns: Single match.
+    """
+    values = _get_values(attribute, text)
+    n = len(values)
+    if n > 1:
+        raise ValueError("found too many values for {}".format(attribute))
+    elif n == 1:
+        return values[0]
+    else:
+        raise ValueError("no value found for {}".format(attribute))
+
+def _get_line_and_value(attribute, text):
+    """Match attribute in text. Return the line and the value of the attribute."""
+    regex = '({}\s+=\s+"(.*)";)'.format(attribute)
+    regex = re.compile(regex)
+    value = regex.findall(text)
+    n = len(value)
+    if n > 1:
+        raise ValueError("found too many values for {}".format(attribute))
+    elif n == 1:
+        return value[0]
+    else:
+        raise ValueError("no value found for {}".format(attribute))
+
+
+def _replace_value(attribute, value, text):
+    """Search and replace value of attribute in text."""
+    old_line, old_value = _get_line_and_value(attribute, text)
+    new_line = old_line.replace(old_value, value)
+    new_text = text.replace(old_line, new_line)
+    return new_text
+
+
+def _fetch_page(url):
+    r = requests.get(url)
+    if r.status_code == requests.codes.ok:
+        return list(yaml.safe_load_all(r.content))[0]
+    else:
+        raise ValueError("request for {} failed".format(url))
+
+
+def _fetch_github(url):
+    headers = {}
+    token = os.environ.get('GITHUB_API_TOKEN')
+    if token:
+        headers["Authorization"] = f"token {token}"
+    r = requests.get(url, headers=headers)
+
+    if r.status_code == requests.codes.ok:
+        return r.json()
+    else:
+        raise ValueError("request for {} failed".format(url))
+
+
+SEMVER = {
+    'major' : 0,
+    'minor' : 1,
+    'patch' : 2,
+}
+
+
+def _determine_latest_version(current_version, target, versions):
+    """Determine latest version, given `target`, returning the more recent version.
+    """
+    current_version = Version(current_version)
+
+    def _parse_versions(versions):
+        for v in versions:
+            try:
+                yield Version(v)
+            except InvalidVersion:
+                pass
+
+    versions = _parse_versions(versions)
+
+    index = SEMVER[target]
+
+    ceiling = list(current_version[0:index])
+    if len(ceiling) == 0:
+        ceiling = None
+    else:
+        ceiling[-1]+=1
+        ceiling = Version(".".join(map(str, ceiling)))
+
+    # We do not want prereleases
+    versions = SpecifierSet(prereleases=PRERELEASES).filter(versions)
+
+    if ceiling is not None:
+        versions = SpecifierSet(f"<{ceiling}").filter(versions)
+
+    return (max(sorted(versions))).raw_version
+
+
+def _get_latest_version_octave_packages(package, extension, current_version, target):
+    """Get latest version and hash from Octave Packages."""
+    url = "{}/{}.yaml".format(INDEX, package)
+    yaml = _fetch_page(url)
+
+    versions = list(map(lambda pv: pv['id'], yaml['versions']))
+    version = _determine_latest_version(current_version, target, versions)
+
+    try:
+        releases = [v if v['id'] == version else None for v in yaml['versions']]
+    except KeyError as e:
+        raise KeyError('Could not find version {} for {}'.format(version, package)) from e
+    for release in releases:
+        if release['url'].endswith(extension):
+            sha256 = release['sha256']
+            break
+    else:
+        sha256 = None
+    return version, sha256, None
+
+
+def _get_latest_version_github(package, extension, current_version, target):
+    def strip_prefix(tag):
+        return re.sub("^[^0-9]*", "", tag)
+
+    def get_prefix(string):
+        matches = re.findall(r"^([^0-9]*)", string)
+        return next(iter(matches), "")
+
+    # when invoked as an updateScript, UPDATE_NIX_ATTR_PATH will be set
+    # this allows us to work with packages which live outside of octave-modules
+    attr_path = os.environ.get("UPDATE_NIX_ATTR_PATH", f"octavePackages.{package}")
+    try:
+        homepage = subprocess.check_output(
+            ["nix", "eval", "-f", f"{NIXPGKS_ROOT}/default.nix", "--raw", f"{attr_path}.src.meta.homepage"])\
+            .decode('utf-8')
+    except Exception as e:
+        raise ValueError(f"Unable to determine homepage: {e}")
+    owner_repo = homepage[len("https://github.com/"):]  # remove prefix
+    owner, repo = owner_repo.split("/")
+
+    url = f"https://api.github.com/repos/{owner}/{repo}/releases"
+    all_releases = _fetch_github(url)
+    releases = list(filter(lambda x: not x['prerelease'], all_releases))
+
+    if len(releases) == 0:
+        raise ValueError(f"{homepage} does not contain any stable releases")
+
+    versions = map(lambda x: strip_prefix(x['tag_name']), releases)
+    version = _determine_latest_version(current_version, target, versions)
+
+    release = next(filter(lambda x: strip_prefix(x['tag_name']) == version, releases))
+    prefix = get_prefix(release['tag_name'])
+    try:
+        sha256 = subprocess.check_output(["nix-prefetch-url", "--type", "sha256", "--unpack", f"{release['tarball_url']}"], stderr=subprocess.DEVNULL)\
+            .decode('utf-8').strip()
+    except:
+        # this may fail if they have both a branch and a tag of the same name, attempt tag name
+        tag_url = str(release['tarball_url']).replace("tarball","tarball/refs/tags")
+        sha256 = subprocess.check_output(["nix-prefetch-url", "--type", "sha256", "--unpack", tag_url], stderr=subprocess.DEVNULL)\
+            .decode('utf-8').strip()
+
+
+    return version, sha256, prefix
+
+def _get_latest_version_git(package, extension, current_version, target):
+    """NOTE: Unimplemented!"""
+    # attr_path = os.environ.get("UPDATE_NIX_ATTR_PATH", f"octavePackages.{package}")
+    # try:
+    #     download_url = subprocess.check_output(
+    #         ["nix", "--extra-experimental-features", "nix-command", "eval", "-f", f"{NIXPGKS_ROOT}/default.nix", "--raw", f"{attr_path}.src.url"])\
+    #         .decode('utf-8')
+    # except Exception as e:
+    #     raise ValueError(f"Unable to determine download link: {e}")
+
+    # with tempfile.TemporaryDirectory(prefix=attr_path) as new_clone_location:
+    #     subprocess.run(["git", "clone", download_url, new_clone_location])
+    #     newest_commit = subprocess.check_output(
+    #         ["git" "rev-parse" "$(git branch -r)" "|" "tail" "-n" "1"]).decode('utf-8')
+    pass
+
+
+FETCHERS = {
+    'fetchFromGitHub'   :   _get_latest_version_github,
+    'fetchurl'          :   _get_latest_version_octave_packages,
+    'fetchgit'          :   _get_latest_version_git,
+}
+
+
+DEFAULT_SETUPTOOLS_EXTENSION = 'tar.gz'
+
+
+FORMATS = {
+    'setuptools'        :   DEFAULT_SETUPTOOLS_EXTENSION,
+}
+
+def _determine_fetcher(text):
+    # Count occurrences of fetchers.
+    nfetchers = sum(text.count('src = {}'.format(fetcher)) for fetcher in FETCHERS.keys())
+    if nfetchers == 0:
+        raise ValueError("no fetcher.")
+    elif nfetchers > 1:
+        raise ValueError("multiple fetchers.")
+    else:
+        # Then we check which fetcher to use.
+        for fetcher in FETCHERS.keys():
+            if 'src = {}'.format(fetcher) in text:
+                return fetcher
+
+
+def _determine_extension(text, fetcher):
+    """Determine what extension is used in the expression.
+
+    If we use:
+    - fetchPypi, we check if format is specified.
+    - fetchurl, we determine the extension from the url.
+    - fetchFromGitHub we simply use `.tar.gz`.
+    """
+    if fetcher == 'fetchurl':
+        url = _get_unique_value('url', text)
+        extension = os.path.splitext(url)[1]
+
+    elif fetcher == 'fetchFromGitHub' or fetcher == 'fetchgit':
+        if "fetchSubmodules" in text:
+            raise ValueError("fetchFromGitHub fetcher doesn't support submodules")
+        extension = "tar.gz"
+
+    return extension
+
+
+def _update_package(path, target):
+
+    # Read the expression
+    with open(path, 'r') as f:
+        text = f.read()
+
+    # Determine pname. Many files have more than one pname
+    pnames = _get_values('pname', text)
+
+    # Determine version.
+    version = _get_unique_value('version', text)
+
+    # First we check how many fetchers are mentioned.
+    fetcher = _determine_fetcher(text)
+
+    extension = _determine_extension(text, fetcher)
+
+    # Attempt a fetch using each pname, e.g. backports-zoneinfo vs backports.zoneinfo
+    successful_fetch = False
+    for pname in pnames:
+        if fetcher == "fetchgit":
+            logging.warning(f"You must update {pname} MANUALLY!")
+            return { 'path': path, 'target': target, 'pname': pname,
+                     'old_version': version, 'new_version': version }
+        try:
+            new_version, new_sha256, prefix = FETCHERS[fetcher](pname, extension, version, target)
+            successful_fetch = True
+            break
+        except ValueError:
+            continue
+
+    if not successful_fetch:
+        raise ValueError(f"Unable to find correct package using these pnames: {pnames}")
+
+    if new_version == version:
+        logging.info("Path {}: no update available for {}.".format(path, pname))
+        return False
+    elif Version(new_version) <= Version(version):
+        raise ValueError("downgrade for {}.".format(pname))
+    if not new_sha256:
+        raise ValueError("no file available for {}.".format(pname))
+
+    text = _replace_value('version', new_version, text)
+    # hashes from pypi are 16-bit encoded sha256's, normalize it to sri to avoid merge conflicts
+    # sri hashes have been the default format since nix 2.4+
+    sri_hash = subprocess.check_output(["nix", "--extra-experimental-features", "nix-command", "hash", "to-sri", "--type", "sha256", new_sha256]).decode('utf-8').strip()
+
+
+    # fetchers can specify a sha256, or a sri hash
+    try:
+        text = _replace_value('sha256', sri_hash, text)
+    except ValueError:
+        text = _replace_value('hash', sri_hash, text)
+
+    if fetcher == 'fetchFromGitHub':
+        # in the case of fetchFromGitHub, it's common to see `rev = version;` or `rev = "v${version}";`
+        # in which no string value is meant to be substituted. However, we can just overwrite the previous value.
+        regex = '(rev\s+=\s+[^;]*;)'
+        regex = re.compile(regex)
+        matches = regex.findall(text)
+        n = len(matches)
+
+        if n == 0:
+            raise ValueError("Unable to find rev value for {}.".format(pname))
+        else:
+            # forcefully rewrite rev, incase tagging conventions changed for a release
+            match = matches[0]
+            text = text.replace(match, f'rev = "refs/tags/{prefix}${{version}}";')
+            # incase there's no prefix, just rewrite without interpolation
+            text = text.replace('"${version}";', 'version;')
+
+    with open(path, 'w') as f:
+        f.write(text)
+
+        logging.info("Path {}: updated {} from {} to {}".format(path, pname, version, new_version))
+
+    result = {
+        'path'  : path,
+        'target': target,
+        'pname': pname,
+        'old_version'   : version,
+        'new_version'   : new_version,
+        #'fetcher'       : fetcher,
+        }
+
+    return result
+
+
+def _update(path, target):
+
+    # We need to read and modify a Nix expression.
+    if os.path.isdir(path):
+        path = os.path.join(path, 'default.nix')
+
+    # If a default.nix does not exist, we quit.
+    if not os.path.isfile(path):
+        logging.info("Path {}: does not exist.".format(path))
+        return False
+
+    # If file is not a Nix expression, we quit.
+    if not path.endswith(".nix"):
+        logging.info("Path {}: does not end with `.nix`.".format(path))
+        return False
+
+    try:
+        return _update_package(path, target)
+    except ValueError as e:
+        logging.warning("Path {}: {}".format(path, e))
+        return False
+
+
+def _commit(path, pname, old_version, new_version, pkgs_prefix="octave: ", **kwargs):
+    """Commit result.
+    """
+
+    msg = f'{pkgs_prefix}{pname}: {old_version} -> {new_version}'
+
+    try:
+        subprocess.check_call([GIT, 'add', path])
+        subprocess.check_call([GIT, 'commit', '-m', msg])
+    except subprocess.CalledProcessError as e:
+        subprocess.check_call([GIT, 'checkout', path])
+        raise subprocess.CalledProcessError(f'Could not commit {path}') from e
+
+    return True
+
+
+def main():
+
+    epilog = """
+environment variables:
+  GITHUB_API_TOKEN\tGitHub API token used when updating github packages
+    """
+    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter, epilog=epilog)
+    parser.add_argument('package', type=str, nargs='+')
+    parser.add_argument('--target', type=str, choices=SEMVER.keys(), default='major')
+    parser.add_argument('--commit', action='store_true', help='Create a commit for each package update')
+    parser.add_argument('--use-pkgs-prefix', action='store_true', help='Use octavePackages.${pname}: instead of octave: ${pname}: when making commits')
+
+    args = parser.parse_args()
+    target = args.target
+
+    packages = list(map(os.path.abspath, args.package))
+
+    logging.info("Updating packages...")
+
+    # Use threads to update packages concurrently
+    with Pool() as p:
+        results = list(filter(bool, p.map(lambda pkg: _update(pkg, target), packages)))
+
+    logging.info("Finished updating packages.")
+
+    commit_options = {}
+    if args.use_pkgs_prefix:
+        logging.info("Using octavePackages. prefix for commits")
+        commit_options["pkgs_prefix"] = "octavePackages."
+
+    # Commits are created sequentially.
+    if args.commit:
+        logging.info("Committing updates...")
+        # list forces evaluation
+        list(map(lambda x: _commit(**x, **commit_options), results))
+        logging.info("Finished committing updates")
+
+    count = len(results)
+    logging.info("{} package(s) updated".format(count))
+
+
+if __name__ == '__main__':
+    main()
--- a/maintainers/scripts/update-octave-shell.nix
+++ b/maintainers/scripts/update-octave-shell.nix
@ -0,0 +1,12 @@
+{ nixpkgs ? import ../.. { }
+}:
+with nixpkgs;
+let
+  pyEnv = python3.withPackages(ps: with ps; [ packaging requests toolz pyyaml ]);
+in
+mkShell {
+  packages = [
+    pyEnv
+    nix-prefetch-scripts
+  ];
+}
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -138,6 +138,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation.

+- `fail2ban` has been updated to 1.0.2, which has a few breaking changes compared to 0.11.2 ([changelog for 1.0.1](https://github.com/fail2ban/fail2ban/blob/1.0.1/ChangeLog), [changelog for 1.0.2](https://github.com/fail2ban/fail2ban/blob/1.0.2/ChangeLog))
+
 - Calling `makeSetupHook` without passing a `name` argument is deprecated.

 - `lib.systems.examples.ghcjs` and consequently `pkgsCross.ghcjs` now use the target triplet `javascript-unknown-ghcjs` instead of `js-unknown-ghcjs`. This has been done to match an [upstream decision](https://gitlab.haskell.org/ghc/ghc/-/commit/6636b670233522f01d002c9b97827d00289dbf5c) to follow Cabal's platform naming more closely. Nixpkgs will also reject `js` as an architecture name.
@ -177,6 +179,12 @@ In addition to numerous new and upgraded packages, this release has the followin

 - conntrack helper autodetection has been removed from kernels 6.0 and up upstream, and an assertion was added to ensure things don't silently stop working. Migrate your configuration to assign helpers explicitly or use an older LTS kernel branch as a temporary workaround.

+- The catch-all `hardware.video.hidpi.enable` option was removed. Users on high density displays may want to:
+
+  - Set `services.xserver.upscaleDefaultCursor` to upscale the default X11 cursor for higher resolutions
+  - Adjust settings under `fonts.fontconfig` according to preference
+  - Adjust `console.font` according to preference, though the kernel will generally choose a reasonably sized font
+
 - The `baget` package and module was removed due to being unmaintained.

 ## Other Notable Changes {#sec-release-23.05-notable-changes}
@ -222,6 +230,8 @@ In addition to numerous new and upgraded packages, this release has the followin
  The `{aclUse,superUser,disableActions}` attributes have been renamed, `pluginsConfig` now also accepts an attribute set of booleans, passing plain PHP is deprecated.
  Same applies to `acl` which now also accepts structured settings.

+- The `zsh` package changes the way to set environment variables on NixOS systems where `programs.zsh.enable` equals `false`.  It now sources `/etc/set-environment` when reading the system-level `zshenv` file.  Before, it sourced `/etc/profile` when reading the system-level `zprofile` file.
+
 - The `wordpress` service now takes configuration via the `services.wordpress.sites.<name>.settings` attribute set, `extraConfig` is still available to append  additional text to `wp-config.php`.

 - To reduce closure size in `nixos/modules/profiles/minimal.nix` profile disabled installation documentations and manuals. Also disabled `logrotate` and `udisks2` services.
@ -256,11 +266,6 @@ In addition to numerous new and upgraded packages, this release has the followin
    [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
    can be directly written as attribute-set in Nix within this option.

- The `hardware.video.hidpi.enable` was renamed to `fonts.optimizeForVeryHighDPI` to be consistent with what it actually does.
-  They disable by default: antialiasing, hinting and LCD filter for subpixel rendering. They can be overridden if you experience problems with font rendering.
-  On Xorg, the default cursor is upscaled.
-  Please see the documentation for the new option to decide if you want to keep it enabled.
-
 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.

 - `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion.
--- a/nixos/lib/systemd-lib.nix
+++ b/nixos/lib/systemd-lib.nix
@ -24,7 +24,7 @@ in rec {
        }
        ''
          name=${shellEscape name}
-          mkdir -p "$out/$(dirname "$name")"
+          mkdir -p "$out/$(dirname -- "$name")"
          echo -n "$text" > "$out/$name"
        ''
    else
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@ -737,9 +737,10 @@ class Machine:
            self.connected = True

    def screenshot(self, filename: str) -> None:
-        word_pattern = re.compile(r"^\w+$")
-        if word_pattern.match(filename):
-            filename = os.path.join(self.out_dir, f"{filename}.png")
+        if "." not in filename:
+            filename += ".png"
+        if "/" not in filename:
+            filename = os.path.join(self.out_dir, filename)
        tmp = f"{filename}.ppm"

        with self.nested(
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -7,6 +7,19 @@ This module generates a package containing configuration files and link it in /e
 Fontconfig reads files in folder name / file name order, so the number prepended to the configuration file name decide the order of parsing.
 Low number means high priority.

+NOTE: Please take extreme care when adjusting the default settings of this module.
+People care a lot, and I mean A LOT, about their font rendering, and you will be
+The Person That Broke It if it changes in a way people don't like.
+
+See prior art:
+- https://github.com/NixOS/nixpkgs/pull/194594
+- https://github.com/NixOS/nixpkgs/pull/222236
+- https://github.com/NixOS/nixpkgs/pull/222689
+
+And do not repeat our mistakes.
+
+- @K900, March 2023
+
 */

 { config, pkgs, lib, ... }:
@ -218,6 +231,8 @@ let
    paths = cfg.confPackages;
    ignoreCollisions = true;
  };
+
+  fontconfigNote = "Consider manually configuring fonts.fontconfig according to personal preference.";
 in
 {
  imports = [
@ -229,6 +244,8 @@ in
    (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "dpi" ] "Use display server-specific options")
+    (mkRemovedOptionModule [ "hardware" "video" "hidpi" "enable" ] fontconfigNote)
+    (mkRemovedOptionModule [ "fonts" "optimizeForVeryHighDPI" ] fontconfigNote)
  ] ++ lib.forEach [ "enable" "substitutions" "preset" ]
     (opt: lib.mkRemovedOptionModule [ "fonts" "fontconfig" "ultimate" "${opt}" ] ''
       The fonts.fontconfig.ultimate module and configuration is obsolete.
--- a/nixos/modules/config/fonts/fonts.nix
+++ b/nixos/modules/config/fonts/fonts.nix
@ -13,13 +13,10 @@ let
      pkgs.unifont
      pkgs.noto-fonts-emoji
    ];
-
 in
-
 {
  imports = [
    (mkRemovedOptionModule [ "fonts" "enableCoreFonts" ] "Use fonts.fonts = [ pkgs.corefonts ]; instead.")
-    (mkRenamedOptionModule [ "hardware" "video" "hidpi" "enable" ] [ "fonts" "optimizeForVeryHighDPI" ])
  ];

  options = {
@ -42,33 +39,9 @@ in
          and families and reasonable coverage of Unicode.
        '';
      };
-
-      optimizeForVeryHighDPI = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Optimize configuration for very high-density (>200 DPI) displays:
-            - disable subpixel anti-aliasing
-            - disable hinting
-            - automatically upscale the default X11 cursor
-        '';
-      };
    };

  };

-  config = mkMerge [
-    { fonts.fonts = mkIf cfg.enableDefaultFonts defaultFonts; }
-    (mkIf cfg.optimizeForVeryHighDPI {
-      services.xserver.upscaleDefaultCursor = mkDefault true;
-      # Conforms to the recommendation in fonts/fontconfig.nix
-      # for > 200DPI.
-      fonts.fontconfig = {
-        antialias = mkDefault false;
-        hinting.enable = mkDefault false;
-        subpixel.lcdfilter = mkDefault "none";
-      };
-    })
-  ];
-
+  config = { fonts.fonts = mkIf cfg.enableDefaultFonts defaultFonts; };
 }
--- a/nixos/modules/config/zram.nix
+++ b/nixos/modules/config/zram.nix
@ -82,12 +82,30 @@ in
          {command}`cat /sys/class/block/zram*/comp_algorithm`
        '';
      };
+
+      writebackDevice = lib.mkOption {
+        default = null;
+        example = "/dev/zvol/tarta-zoot/swap-writeback";
+        type = lib.types.nullOr lib.types.path;
+        description = lib.mdDoc ''
+          Write incompressible pages to this device,
+          as there's no gain from keeping them in RAM.
+        '';
+      };
    };

  };

  config = lib.mkIf cfg.enable {

+    assertions = [
+      {
+        assertion = cfg.writebackDevice == null || cfg.swapDevices <= 1;
+        message = "A single writeback device cannot be shared among multiple zram devices";
+      }
+    ];
+
+
    system.requiredKernelConfig = with config.lib.kernelConfig; [
      (isModule "ZRAM")
    ];
@ -112,6 +130,8 @@ in
                zram-size = if cfg.memoryMax != null then "min(${size}, ${toString cfg.memoryMax} / 1024 / 1024)" else size;
                compression-algorithm = cfg.algorithm;
                swap-priority = cfg.priority;
+              } // lib.optionalAttrs (cfg.writebackDevice != null) {
+                writeback-device = cfg.writebackDevice;
              };
          })
          devices));
--- a/nixos/modules/services/databases/dgraph.nix
+++ b/nixos/modules/services/databases/dgraph.nix
@ -12,7 +12,7 @@ let
  ''
    mkdir -p $out/bin
    makeWrapper ${cfg.package}/bin/dgraph $out/bin/dgraph \
-      --set PATH '${lib.makeBinPath [ pkgs.nodejs ]}:$PATH' \
+      --prefix PATH : "${lib.makeBinPath [ pkgs.nodejs ]}" \
  '';
  securityOptions = {
      NoNewPrivileges = true;
--- a/nixos/modules/services/logging/logrotate.nix
+++ b/nixos/modules/services/logging/logrotate.nix
@ -187,7 +187,7 @@ in
          A configuration file automatically generated by NixOS.
        '';
        description = lib.mdDoc ''
-          Override the configuration file used by MySQL. By default,
+          Override the configuration file used by logrotate. By default,
          NixOS generates one automatically from [](#opt-services.logrotate.settings).
        '';
        example = literalExpression ''
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@ -365,6 +365,8 @@ in
    ];

    services.gitea.settings = {
+      "cron.update_checker".ENABLED = lib.mkDefault false;
+
      database = mkMerge [
        {
          DB_TYPE = cfg.database.type;
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@ -273,26 +273,16 @@ in
      "fail2ban/filter.d".source = "${cfg.package}/etc/fail2ban/filter.d/*.conf";
    };

+    systemd.packages = [ cfg.package ];
    systemd.services.fail2ban = {
-      description = "Fail2ban Intrusion Prevention System";
-
      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
      partOf = optional config.networking.firewall.enable "firewall.service";

      restartTriggers = [ fail2banConf jailConf pathsConf ];

      path = [ cfg.package cfg.packageFirewall pkgs.iproute2 ] ++ cfg.extraPackages;

-      unitConfig.Documentation = "man:fail2ban(1)";
-
      serviceConfig = {
-        ExecStart = "${cfg.package}/bin/fail2ban-server -xf start";
-        ExecStop = "${cfg.package}/bin/fail2ban-server stop";
-        ExecReload = "${cfg.package}/bin/fail2ban-server reload";
-        Type = "simple";
-        Restart = "on-failure";
-        PIDFile = "/run/fail2ban/fail2ban.pid";
        # Capabilities
        CapabilityBoundingSet = [ "CAP_AUDIT_READ" "CAP_DAC_READ_SEARCH" "CAP_NET_ADMIN" "CAP_NET_RAW" ];
        # Security
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -184,8 +184,8 @@ let
        brotli_types ${lib.concatStringsSep " " compressMimeTypes};
      ''}

-      # https://docs.nginx.com/nginx/admin-guide/web-server/compression/
      ${optionalString cfg.recommendedGzipSettings ''
+        # https://docs.nginx.com/nginx/admin-guide/web-server/compression/
        gzip on;
        gzip_static on;
        gzip_vary on;
@ -195,6 +195,14 @@ let
        gzip_types ${lib.concatStringsSep " " compressMimeTypes};
      ''}

+      ${optionalString cfg.recommendedZstdSettings ''
+        zstd on;
+        zstd_comp_level 9;
+        zstd_min_length 256;
+        zstd_static on;
+        zstd_types ${lib.concatStringsSep " " compressMimeTypes};
+      ''}
+
      ${optionalString cfg.recommendedProxySettings ''
        proxy_redirect          off;
        proxy_connect_timeout   ${cfg.proxyTimeout};
@ -490,6 +498,16 @@ in
        '';
      };

+      recommendedZstdSettings = mkOption {
+        default = false;
+        type = types.bool;
+        description = lib.mdDoc ''
+          Enable recommended zstd settings. Learn more about compression in Zstd format [here](https://github.com/tokers/zstd-nginx-module).
+
+          This adds `pkgs.nginxModules.zstd` to `services.nginx.additionalModules`.
+        '';
+      };
+
      proxyTimeout = mkOption {
        type = types.str;
        default = "60s";
@ -1015,7 +1033,8 @@ in
      groups = config.users.groups;
    }) dependentCertNames;

-    services.nginx.additionalModules = optional cfg.recommendedBrotliSettings pkgs.nginxModules.brotli;
+    services.nginx.additionalModules = optional cfg.recommendedBrotliSettings pkgs.nginxModules.brotli
+      ++ lib.optional cfg.recommendedZstdSettings pkgs.nginxModules.zstd;

    systemd.services.nginx = {
      description = "Nginx Web Server";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -488,6 +488,7 @@ in {
  nomad = handleTest ./nomad.nix {};
  non-default-filesystems = handleTest ./non-default-filesystems.nix {};
  noto-fonts = handleTest ./noto-fonts.nix {};
+  noto-fonts-cjk-qt-default-weight = handleTest ./noto-fonts-cjk-qt-default-weight.nix {};
  novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {};
  nscd = handleTest ./nscd.nix {};
  nsd = handleTest ./nsd.nix {};
--- a/nixos/tests/noto-fonts-cjk-qt-default-weight.nix
+++ b/nixos/tests/noto-fonts-cjk-qt-default-weight.nix
@ -0,0 +1,30 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "noto-fonts-cjk-qt";
+  meta.maintainers = with lib.maintainers; [ oxalica ];
+
+  nodes.machine = {
+    imports = [ ./common/x11.nix ];
+    fonts = {
+      enableDefaultFonts = false;
+      fonts = [ pkgs.noto-fonts-cjk-sans ];
+    };
+  };
+
+  testScript =
+    let
+      script = pkgs.writers.writePython3 "qt-default-weight" {
+        libraries = [ pkgs.python3Packages.pyqt6 ];
+      } ''
+        from PyQt6.QtWidgets import QApplication
+        from PyQt6.QtGui import QFont, QRawFont
+
+        app = QApplication([])
+        f = QRawFont.fromFont(QFont("Noto Sans CJK SC", 20))
+
+        assert f.styleName() == "Regular", f.styleName()
+      '';
+    in ''
+      machine.wait_for_x()
+      machine.succeed("${script}")
+    '';
+})
--- a/nixos/tests/zram-generator.nix
+++ b/nixos/tests/zram-generator.nix
@ -1,18 +1,36 @@
 import ./make-test-python.nix {
  name = "zram-generator";

-  nodes.machine = { ... }: {
-    zramSwap = {
-      enable = true;
-      priority = 10;
-      algorithm = "lz4";
-      swapDevices = 2;
-      memoryPercent = 30;
-      memoryMax = 10 * 1024 * 1024;
+  nodes = {
+    single = { ... }: {
+      virtualisation = {
+        emptyDiskImages = [ 512 ];
+      };
+      zramSwap = {
+        enable = true;
+        priority = 10;
+        algorithm = "lz4";
+        swapDevices = 1;
+        memoryPercent = 30;
+        memoryMax = 10 * 1024 * 1024;
+        writebackDevice = "/dev/vdb";
+      };
+    };
+    machine = { ... }: {
+      zramSwap = {
+        enable = true;
+        priority = 10;
+        algorithm = "lz4";
+        swapDevices = 2;
+        memoryPercent = 30;
+        memoryMax = 10 * 1024 * 1024;
+      };
    };
  };

  testScript = ''
+    single.wait_for_unit("systemd-zram-setup@zram0.service")
+
    machine.wait_for_unit("systemd-zram-setup@zram0.service")
    machine.wait_for_unit("systemd-zram-setup@zram1.service")
    zram = machine.succeed("zramctl --noheadings --raw")
--- a/pkgs/applications/blockchains/sparrow/default.nix
+++ b/pkgs/applications/blockchains/sparrow/default.nix
@ -20,11 +20,11 @@

 let
  pname = "sparrow";
-  version = "1.7.1";
+  version = "1.7.3";

  src = fetchurl {
    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}-x86_64.tar.gz";
-    sha256 = "0q31b4ncvbhr9gb47wplphg43pwlg5vpd1b12qiidqlrkgm2vjy8";
+    sha256 = "sha256-/tKct73v0zWAjY4kTllnb/+SB/8ENgVl8Yh/LErKTxY=";
  };

  launcher = writeScript "sparrow" ''
@ -156,24 +156,6 @@ let
      ln -s ${hwi}/bin/hwi $out/modules/com.sparrowwallet.sparrow/native/linux/x64/hwi
    '';
  };
-
-  # To use the udev rules for connected hardware wallets,
-  # add "pkgs.sparrow" to "services.udev.packages" and add user accounts to the user group "plugdev".
-  udev-rules = stdenv.mkDerivation {
-    name = "sparrow-udev";
-
-    src = let version = "2.0.2"; in
-      fetchurl {
-        url = "https://github.com/bitcoin-core/HWI/releases/download/${version}/hwi-${version}.tar.gz";
-        sha256 = "sha256-di1fRsMbwpHcBFNTCVivfxpwhUoUKLA3YTnJxKq/jHM=";
-      };
-
-    installPhase = ''
-      mkdir -p $out/etc/udev/rules.d
-      cp -a hwilib/udev/* $out/etc/udev/rules.d
-      rm $out/etc/udev/rules.d/README.md
-    '';
-  };
 in
 stdenv.mkDerivation rec {
  inherit pname version src;
@ -186,8 +168,9 @@ stdenv.mkDerivation rec {
      icon = pname;
      desktopName = "Sparrow Bitcoin Wallet";
      genericName = "Bitcoin Wallet";
-      categories = [ "Finance" ];
+      categories = [ "Finance" "Network" ];
      mimeTypes = [ "application/psbt" "application/bitcoin-transaction" "x-scheme-handler/bitcoin" "x-scheme-handler/auth47" "x-scheme-handler/lightning" ];
+      startupWMClass = "Sparrow";
    })
  ];

@ -217,8 +200,8 @@ stdenv.mkDerivation rec {
    mkdir -p $out/share/icons
    ln -s ${sparrow-icons}/hicolor $out/share/icons

-    mkdir -p $out/etc/udev
-    ln -s ${udev-rules}/etc/udev/rules.d $out/etc/udev/rules.d
+    mkdir -p $out/etc/udev/rules.d
+    cp ${hwi}/lib/python*/site-packages/hwilib/udev/*.rules $out/etc/udev/rules.d

    runHook postInstall
  '';
--- a/pkgs/applications/blockchains/sparrow/fhsenv.nix
+++ b/pkgs/applications/blockchains/sparrow/fhsenv.nix
@ -0,0 +1,30 @@
+{ lib
+, buildFHSUserEnv
+, sparrow-unwrapped
+}:
+
+buildFHSUserEnv {
+  name = "sparrow";
+
+  runScript = "${sparrow-unwrapped}/bin/sparrow";
+
+  targetPkgs = pkgs: with pkgs; [
+    sparrow-unwrapped
+    pcsclite
+  ];
+
+  multiPkgs = pkgs: with pkgs; [
+    pcsclite
+  ];
+
+  extraInstallCommands = ''
+    mkdir -p $out/share
+    ln -s ${sparrow-unwrapped}/share/applications $out/share
+    ln -s ${sparrow-unwrapped}/share/icons $out/share
+
+    mkdir -p $out/etc/udev
+    ln -s ${sparrow-unwrapped}/etc/udev/rules.d $out/etc/udev/rules.d
+  '';
+
+  meta = sparrow-unwrapped.meta;
+}
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/mind-wave/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/mind-wave/default.nix
@ -0,0 +1,89 @@
+{ lib
+, pkgs
+, melpaBuild
+, substituteAll
+}:
+# To use this package with emacs-overlay:
+# nixpkgs.overlays = [
+#   inputs.emacs-overlay.overlay
+#   (final: prev: {
+#     emacs30 = prev.emacsGit.overrideAttrs (old: {
+#       name = "emacs30";
+#       version = inputs.emacs-upstream.shortRev;
+#       src = inputs.emacs-upstream;
+#     });
+#     emacsWithConfig = prev.emacsWithPackagesFromUsePackage {
+#       config = let
+#         readRecursively = dir:
+#           builtins.concatStringsSep "\n"
+#           (lib.mapAttrsToList (name: value:
+#             if value == "regular"
+#             then builtins.readFile (dir + "/${name}")
+#             else
+#               (
+#                 if value == "directory"
+#                 then readRecursively (dir + "/${name}")
+#                 else []
+#               ))
+#           (builtins.readDir dir));
+#       in
+#         # your home-manager config
+#         readRecursively ./home/modules/emacs;
+#       alwaysEnsure = true;
+#       package = final.emacs30;
+#       extraEmacsPackages = epkgs: [
+#         epkgs.use-package
+#         (epkgs.melpaBuild rec {
+#           # ...
+#         })
+#       ];
+#       override = epkgs:
+#         epkgs
+#         // {
+#           # ...
+#         };
+#     };
+#   })
+# ];
+melpaBuild rec {
+  pname = "mind-wave";
+  version = "20230322.1348"; # 13:48 UTC
+  src = pkgs.fetchFromGitHub {
+    owner = "manateelazycat";
+    repo = "mind-wave";
+    rev = "2d94f553a394ce73bcb91490b81e0fc042baa8d3";
+    sha256 = "sha256-6tmcPYAEch5bX5hEHMiQGDNYEMUOvnxF1Vq0VVpBsYo=";
+  };
+  commit = "2d94f553a394ce73bcb91490b81e0fc042baa8d3";
+  # elisp dependencies
+  packageRequires = [
+    pkgs.emacsPackages.markdown-mode
+  ];
+  buildInputs = [
+    (pkgs.python3.withPackages (ps:
+      with ps; [
+        openai
+        epc
+        sexpdata
+        six
+      ]))
+  ];
+  recipe = pkgs.writeText "recipe" ''
+    (mind-wave
+    :repo "manateelazycat/mind-wave"
+    :fetcher github
+    :files
+    ("mind-wave.el"
+    "mind-wave-epc.el"
+    "mind_wave.py"
+    "utils.py"))
+  '';
+  doCheck = true;
+  passthru.updateScript = pkgs.unstableGitUpdater {};
+  meta = with lib; {
+    description = " Emacs AI plugin based on ChatGPT API ";
+    homepage = "https://github.com/manateelazycat/mind-wave";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [yuzukicat];
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -69,6 +69,17 @@
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
  };
+  bass = buildGrammar {
+    language = "bass";
+    version = "27f110d";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-bass";
+      rev = "27f110dfe79620993f5493ffa0d0f2fe12d250ed";
+      hash = "sha256-OmYtp2TAsAjw2fgdSezHUrP46b/QXgCbDeJa4ANrtvY=";
+    };
+    meta.homepage = "https://github.com/amaanq/tree-sitter-bass";
+  };
  beancount = buildGrammar {
    language = "beancount";
    version = "f3741a3";
@ -590,12 +601,12 @@
  };
  glimmer = buildGrammar {
    language = "glimmer";
-    version = "40cfb72";
+    version = "bc1c685";
    src = fetchFromGitHub {
      owner = "alexlafroscia";
      repo = "tree-sitter-glimmer";
-      rev = "40cfb72a53654cbd666451ca04ffd500257c7b73";
-      hash = "sha256-h9ZZz6mbkErLIG/BamNRRoRdqmuBO3v17W0uvmpbm7A=";
+      rev = "bc1c685aa6a7caf9e58c5746ab386a1e673eb9af";
+      hash = "sha256-CDXyynCsnmOvOs1rs9e29tNHosywTvGM0UyWVtwMqZ8=";
    };
    meta.homepage = "https://github.com/alexlafroscia/tree-sitter-glimmer";
  };
@ -1597,12 +1608,12 @@
  };
  sql = buildGrammar {
    language = "sql";
-    version = "4cb5b36";
+    version = "d2b64d8";
    src = fetchFromGitHub {
      owner = "derekstride";
      repo = "tree-sitter-sql";
-      rev = "4cb5b36d70687bfe4687c68483b4dacde309ae6f";
-      hash = "sha256-7YkVPuQS8NGcHXHwgFTZ4kWL01AnNeOGxdY8xFISSzY=";
+      rev = "d2b64d85d0cab5edeffe44243134033e6ff07c02";
+      hash = "sha256-Mo87yEF0YGF9t+bXvxuULtlOWAFKyBDjU6rF6eOXLao=";
    };
    meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
  };
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -793,7 +793,7 @@ self: super: {
        pname = "sg-nvim-rust";
        inherit (old) version src;

-        cargoHash = "sha256-z3ZWHhqiJKFzVcFJadfPU6+ELlnvEOAprCyStszegdI=";
+        cargoHash = "sha256-GN7KM3fkeOcqmyUwsPMw499kS/eYqh8pbyPgMv4/NN4=";

        nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -324,6 +324,7 @@ https://github.com/cocopon/iceberg.vim/,,
 https://github.com/idris-hackers/idris-vim/,,
 https://github.com/edwinb/idris2-vim/,,
 https://github.com/lewis6991/impatient.nvim/,,
+https://github.com/smjonas/inc-rename.nvim/,HEAD,
 https://github.com/nishigori/increment-activator/,,
 https://github.com/haya14busa/incsearch-easymotion.vim/,,
 https://github.com/haya14busa/incsearch.vim/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2953,6 +2953,24 @@ let
        };
      };

+      vscjava.vscode-gradle = buildVscodeMarketplaceExtension rec {
+        mktplcRef = {
+          name = "vscode-gradle";
+          publisher = "vscjava";
+          version = "3.12.6";
+          sha256 = "sha256-j4JyhNGsRlJmS8Wj38gLpC1gXVvdPx10cgzP8dXmmNo=";
+        };
+
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/vscjava.vscode-gradle/changelog";
+          description = "A Visual Studio Code extension for Gradle build tool";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=vscjava.vscode-gradle";
+          homepage = "https://github.com/microsoft/vscode-gradle";
+          license = lib.licenses.mit;
+          maintainers = with lib.maintainers; [ rhoriguchi ];
+        };
+      };
+
      vscjava.vscode-java-debug = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "vscode-java-debug";
--- a/pkgs/applications/graphics/focus-stack/default.nix
+++ b/pkgs/applications/graphics/focus-stack/default.nix
@ -0,0 +1,32 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, which
+, ronn
+, opencv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "focus-stack";
+  version = "1.4";
+
+  src = fetchFromGitHub {
+    owner = "PetteriAimonen";
+    repo = "focus-stack";
+    rev = version;
+    hash = "sha256-SoECgBMjWI+n7H6p3hf8J5E9UCLHGiiz5WAsEEioJsU=";
+  };
+
+  nativeBuildInputs = [ pkg-config which ronn ];
+  buildInputs = [ opencv ];
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  meta = with lib; {
+    description = "Fast and easy focus stacking";
+    homepage = "https://github.com/PetteriAimonen/focus-stack";
+    license = licenses.mit;
+    maintainers = with maintainers; [ paperdigits ];
+  };
+}
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@ -18,7 +18,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.15.0";
+  version = "1.16.0";

  format = "other";

@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "valos";
    repo = "Komikku";
    rev = "v${version}";
-    hash = "sha256-dmi8a9Gf4ixq5oW6ewDGZYRmxY2qmUrD42DfjskRpHk=";
+    hash = "sha256-SzK86uzdGnNFNtbvw56n3AxjxcCBjHFs9wD98TVggAo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/pick-colour-picker/default.nix
+++ b/pkgs/applications/graphics/pick-colour-picker/default.nix
@ -22,6 +22,11 @@ buildPythonPackage rec {
    fetchSubmodules = false;
  };

+  postPatch = ''
+    sed "s|sys\.prefix|'\.'|g" -i setup.py
+    sed "s|os.environ.get('SNAP'), \"usr\"|'$out'|g" -i pick/__main__.py
+  '';
+
  nativeBuildInputs = [
    gobject-introspection
    wrapGAppsHook
@ -37,16 +42,6 @@ buildPythonPackage rec {
    gtk3
  ];

-  preDistPhases = [ "fixupIconPath" ];
-
-  fixupIconPath = ''
-    pickLoc="$out/${python.sitePackages}/pick"
-    shareLoc=$(echo "$out/${python.sitePackages}/nix/store/"*)
-    mv "$shareLoc/share" "$out/share"
-
-    sed "s|os.environ.get('SNAP'), \"usr\"|'$out'|g" -i "$pickLoc/__main__.py"
-    '';
-
  meta = with lib; {
    homepage = "https://kryogenix.org/code/pick/";
    license = licenses.mit;
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@ -22,11 +22,6 @@ buildDotnetModule rec {
    sha256 = "sha256-SRWqe8KTjFdgVW7/EYRVUONtDWwxpcZ1GXWFPjKZzpI=";
  };

-  patches = [
-    # otherwise installPhase fails with NETSDK1129
-    ./fix-framework.diff
-  ];
-
  dotnet-runtime = dotnetCorePackages.aspnetcore_7_0;
  dotnet-sdk = dotnetCorePackages.sdk_7_0;

@ -38,6 +33,9 @@ buildDotnetModule rec {
    "-p:PublishSingleFile=true"
    "-p:PublishTrimmed=true"
  ];
+  dotnetInstallFlags = [
+    "--framework=net7.0"
+  ];
  selfContainedBuild = true;

  runtimeDeps = [ libkrb5 zlib openssl ];
@ -58,9 +56,11 @@ buildDotnetModule rec {

  postInstall = ''
    buildPlugin() {
+      echo "Publishing plugin $1"
      dotnet publish $1 -p:ContinuousIntegrationBuild=true -p:Deterministic=true \
        --output $out/lib/${pname}/plugins/$1 --configuration Release \
-        -p:TargetLatestRuntimePatch=false -p:UseAppHost=false --no-restore
+        -p:TargetLatestRuntimePatch=false -p:UseAppHost=false --no-restore \
+        --framework=net7.0
     }

     buildPlugin ArchiSteamFarm.OfficialPlugins.ItemsMatcher
--- a/pkgs/applications/misc/ArchiSteamFarm/fix-framework.diff
+++ b/pkgs/applications/misc/ArchiSteamFarm/fix-framework.diff
@ -1,24 +0,0 @@
-diff --git a/Directory.Build.props b/Directory.Build.props
-index 89137fba..bce300a4 100644
--- a/Directory.Build.props
-+++ b/Directory.Build.props
-@@ -29,16 +29,16 @@
- 		<RepositoryUrl>$(PackageProjectUrl).git</RepositoryUrl>
- 		<RollForward>LatestMajor</RollForward>
- 		<RuntimeIdentifiers>linux-arm;linux-arm64;linux-x64;osx-arm64;osx-x64;win-arm64;win-x64</RuntimeIdentifiers>
-		<TargetFrameworks>net7.0</TargetFrameworks>
-+		<TargetFramework>net7.0</TargetFramework>
- 		<TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>
- 	</PropertyGroup>
- 
- 	<PropertyGroup Condition="'$(OS)' == 'Windows_NT' OR '$(ASFNetFramework)' != ''">
-		<TargetFrameworks>$(TargetFrameworks);net481</TargetFrameworks>
-+		<TargetFramework>$(TargetFramework);net481</TargetFramework>
- 	</PropertyGroup>
- 
- 	<PropertyGroup Condition="'$(ASFNetStandard)' != ''">
-		<TargetFrameworks>$(TargetFrameworks);netstandard2.1</TargetFrameworks>
-+		<TargetFramework>$(TargetFramework);netstandard2.1</TargetFramework>
- 	</PropertyGroup>
- 
- 	<ItemGroup Condition="'$(TargetFramework)' == 'net481' OR '$(TargetFramework)' == 'netstandard2.1'">
--- a/pkgs/applications/misc/watchmate/default.nix
+++ b/pkgs/applications/misc/watchmate/default.nix
@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "watchmate";
-  version = "0.4.3";
+  version = "0.4.4";

  src = fetchFromGitHub {
    owner = "azymohliad";
    repo = "watchmate";
    rev = "v${version}";
-    hash = "sha256-LwtlI6WCOO24w8seUzyhCp51pfEiCM+iL6lu/J6v4PQ=";
+    hash = "sha256-+E1tyDfFSu3J89fXd75bdYxh+Z1zTwKL6AmMTNQBEYY=";
  };

-  cargoHash = "sha256-MD0eWZDpCevBY1Y3Gzgk13qCFtL7QOPDATv8MA+Q5go=";
+  cargoHash = "sha256-xfgO2MInUAidgqN1B7byMIzHD19IzbnBvRMo7Ir10hk=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,8 +1,8 @@
 {
  "stable": {
-    "version": "111.0.5563.64",
-    "sha256": "0x20zqwq051a5j76q1c3m0ddf1hhcm6fgz3b7rqrfamjppia0p3x",
-    "sha256bin64": "0rnqrjnybghb4h413cw3f54ga2x76mfmf1fp2nnf59c1yml4r4vf",
+    "version": "111.0.5563.110",
+    "sha256": "0rd7hxa02dy64xwhkwk8v71hqmbvyzcnqldvxpvdr8khn5rnrpa9",
+    "sha256bin64": "18ph8di5g235jrsc0xpwf58f2sx2mmaz25g1921d3fqva8s1vri0",
    "deps": {
      "gn": {
        "version": "2022-12-12",
@ -12,16 +12,16 @@
      }
    },
    "chromedriver": {
-      "version": "111.0.5563.41",
-      "sha256_linux": "160khwa4x6w9gv5vkvalwbx87r6hrql0y0xr7zvxsir1x6rklwm2",
-      "sha256_darwin": "0z5q9r39jd5acyd79yzrkgqkvv3phdkyq4wvdsmhnpypazg072l6",
-      "sha256_darwin_aarch64": "0xiagydqnywzrpqq3i7363zhiywkp8ra9ygb2q1gznb40rx98pbr"
+      "version": "111.0.5563.64",
+      "sha256_linux": "0f4v6hds5wl43hnmqxmzidlg5nqgr4iy04hmrmvzaihsdny3na8s",
+      "sha256_darwin": "0izdp36d4wid5hmz8wcna3gddly7nbkafqqf5k1ikb2jgx9ipp8f",
+      "sha256_darwin_aarch64": "0yzn7bibj36wrc980s9sa8cl0qds01n9i88jk95afx5lk5zb8rgc"
    }
  },
  "beta": {
-    "version": "112.0.5615.29",
-    "sha256": "0k9dn1gzfr2j353ppza1nypj0a4b27p9n742cms3z8583da8kw6p",
-    "sha256bin64": "04m77ndsfygpb1g11iyscvfszgykbr5n3s6bh1shnpkpdbvx3dki",
+    "version": "112.0.5615.39",
+    "sha256": "12q4wxlgcqqflsxvcbx00228l1hjzb940ichywhiwmndxjjdvrgg",
+    "sha256bin64": "0b5c02wlmywhkxgdlnwys1djknicvqxcichxgazgpxbjmr8mmzwv",
    "deps": {
      "gn": {
        "version": "2023-02-17",
@ -45,8 +45,8 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "111.0.5563.65",
-    "sha256": "1wg84pd50zi5268snkiahnp5191c66bqkbvdz2z8azivm95lwqwp",
+    "version": "111.0.5563.111",
+    "sha256": "0r03p8m92fwsi8z1i8qjwllbb68gkspnzwynvmag3jy5kyk4vprv",
    "sha256bin64": null,
    "deps": {
      "gn": {
@ -56,8 +56,8 @@
        "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
      },
      "ungoogled-patches": {
-        "rev": "111.0.5563.65-1",
-        "sha256": "06mfm2gaz1nbwqhn2jp34pm52rw1q99i9fq7wh19m0qasdpidis9"
+        "rev": "111.0.5563.111-1",
+        "sha256": "1m8kf8af5zjc5mgdccppyfbl6bxlwcnb6rw58q5020a810x7y6f8"
      }
    }
  }
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "glooctl";
-  version = "1.13.10";
+  version = "1.13.11";

  src = fetchFromGitHub {
    owner = "solo-io";
    repo = "gloo";
    rev = "v${version}";
-    hash = "sha256-PsdaGVBEslcBMNCj1NQozwbrRx1Nx7Z5+jtZLCrJwDU=";
+    hash = "sha256-K3tk55YPgBSF0YrxSw8zypnzgwEiyEPAAbiGyuKId9o=";
  };

  subPackages = [ "projects/gloo/cli/cmd" ];
-  vendorHash = "sha256-sQv6g0Xgs+6jgxacWJwE3dK3GimfiPHly0Z0rvdKNE4=";
+  vendorHash = "sha256-BRF4kc2Yers3jV2YqG7koycFK34i8NqTcuyt1oGXzsU=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubeshark";
-  version = "38.5";
+  version = "39.4";

  src = fetchFromGitHub {
    owner = "kubeshark";
    repo = "kubeshark";
    rev = version;
-    sha256 = "sha256-xu+IcmYNsFBYhb0Grnqyi31LCG/3XhSh1LH8XakQ3Yk=";
+    sha256 = "sha256-Z32FuQPh9wG2XNMAfC9Zg7G9j8btNxTcYRl+Z5f5gM8=";
  };

-  vendorHash = "sha256-o04XIUsHNqOBkvcejASHNz1HDnV6F9t+Q2Hg8eL/Uoc=";
+  vendorHash = "sha256-stpWIqLQ2PTjocuekkOI/D7QvkxX4NI1YTKIh3V6c4c=";

  ldflags = let t = "github.com/kubeshark/kubeshark"; in [
   "-s" "-w"
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -28,11 +28,11 @@
    "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
  },
  "aiven": {
-    "hash": "sha256-MKxLfR2yV4/LYqQ/yZt44JAHIEinO8078ikWPBD/HXo=",
+    "hash": "sha256-wVgfT/1o5Hz7xbX3OOfjF2P5bhV7kPxnXZOU/3erRpk=",
    "homepage": "https://registry.terraform.io/providers/aiven/aiven",
    "owner": "aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v4.1.2",
+    "rev": "v4.1.3",
    "spdx": "MIT",
    "vendorHash": "sha256-wz1Wy/4GI8/Wlu828RX7OE+XJHzCS/X45tW3Jb7Tx3E="
  },
@ -301,11 +301,11 @@
    "vendorHash": "sha256-BpXhKjfxyCLdGRHn1GexW0MoLj4/C6Bn7scZ76JARxQ="
  },
  "digitalocean": {
-    "hash": "sha256-ZTt/lfHWD9G/SbZ7mLKPjJAsva5bgRqvvX8Lh1Ci+ts=",
+    "hash": "sha256-fnABnzEMDJBzUl6/K1rgWdW4oCqrKZ+3RSXVvT1sHVk=",
    "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
    "owner": "digitalocean",
    "repo": "terraform-provider-digitalocean",
-    "rev": "v2.26.0",
+    "rev": "v2.27.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -429,13 +429,13 @@
    "vendorHash": null
  },
  "gitlab": {
-    "hash": "sha256-nBmb+wHl6FEHIH/P9SsDCtvDKVHzcL4/iaQwtuSjbVg=",
+    "hash": "sha256-bn02BLLSgdo7/Oh95rNOxVUVvwflSvU43DOsii5LM0E=",
    "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
    "owner": "gitlabhq",
    "repo": "terraform-provider-gitlab",
-    "rev": "v15.9.0",
+    "rev": "v15.10.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-yK2M07+FmMEE9YuCJk86qLncHr2ToeZQAzWRQz1lLNM="
+    "vendorHash": "sha256-s4FynUO6bT+8uZYkecbQCtFw1jFTAAYUkSzONI6Ba9g="
  },
  "google": {
    "hash": "sha256-RLWfaJX7ytU8xKcXUp+ON2//rO6R0cw0beXdiH9E3SU=",
@ -476,11 +476,11 @@
    "vendorHash": "sha256-zPO+TbJsFrgfjSaSrX5YRop/0LDDw/grNNntaIGiBU0="
  },
  "gridscale": {
-    "hash": "sha256-deEP1x5rGIgX/CcRK4gWYbCsV1IKY7CFkwQl+uKhbEk=",
+    "hash": "sha256-61LZyXqb+1kWHBk1/lw5C5hmeL4aHwSSS++9/9L/tDw=",
    "homepage": "https://registry.terraform.io/providers/gridscale/gridscale",
    "owner": "gridscale",
    "repo": "terraform-provider-gridscale",
-    "rev": "v1.18.0",
+    "rev": "v1.18.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -765,13 +765,13 @@
    "vendorHash": null
  },
  "newrelic": {
-    "hash": "sha256-EJpIITB6OF6TuFgQ4e9UIP7zaaFGc6DgR1fJ1pK2isc=",
+    "hash": "sha256-2MbzXcdtP4O+zWGhBCp+uryVJmZoA2kXDe8AH3vZ0zA=",
    "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
    "owner": "newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v3.17.1",
+    "rev": "v3.18.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-QL9uEO89PwU8UFbLWCytXpzgrVeXKmaPmFm844ABAvI="
+    "vendorHash": "sha256-dEbJTeHWhfR+8o/s4fi4I0sio1uuh6OIzJhVF5Rup04="
  },
  "nomad": {
    "hash": "sha256-oHY+jM4JQgLlE1wd+/H9H8H2g0e9ZuxI6OMlz3Izfjg=",
@ -811,11 +811,11 @@
    "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
  },
  "oci": {
-    "hash": "sha256-OceXVqPbjJnPNKbf5vKzbTBEES1+CNCa/dTfPFgdACM=",
+    "hash": "sha256-KxhX9QJ7VssZz388xhmNsyDcnDKxu5MDL0nDWMOfEXQ=",
    "homepage": "https://registry.terraform.io/providers/oracle/oci",
    "owner": "oracle",
    "repo": "terraform-provider-oci",
-    "rev": "v4.112.0",
+    "rev": "v4.113.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1045,13 +1045,13 @@
    "vendorHash": "sha256-NO1r/EWLgH1Gogru+qPeZ4sW7FuDENxzNnpLSKstnE8="
  },
  "spotinst": {
-    "hash": "sha256-fa6mEFNNAAp3E8W9U3VpICgKX3SGcQGQtce8DO+cUbY=",
+    "hash": "sha256-4zD2/0s7zeZhreM1dauJ6BSMxTKL16HH530bNCiKNv4=",
    "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
    "owner": "spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.106.1",
+    "rev": "v1.108.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-TxTw+13HJDHDdLhGjM3SXOL87RJdRFs0Y+t/oK81DfI="
+    "vendorHash": "sha256-Ac8cWoaTj18DFZOf8FYbI9FPb17GcA9r7ZkOMNV7iI4="
  },
  "stackpath": {
    "hash": "sha256-7KQUddq+M35WYyAIAL8sxBjAaXFcsczBRO1R5HURUZg=",
@ -1063,13 +1063,13 @@
    "vendorHash": "sha256-OGYiynCwbJU2KisS7Y6xmLuBKOtQvh3MWPrvBk/x95U="
  },
  "statuscake": {
-    "hash": "sha256-PcA0t/G11w9ud+56NdiRXi82ubJ+wpL4XcexT1O2ADw=",
+    "hash": "sha256-yky6aCRK1I9NOEWcz6n6uvU+6HBJcLPQr1LLVO+34jE=",
    "homepage": "https://registry.terraform.io/providers/StatusCakeDev/statuscake",
    "owner": "StatusCakeDev",
    "repo": "terraform-provider-statuscake",
-    "rev": "v2.0.6",
+    "rev": "v2.1.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0D36uboEHqw968MKqkgARib9R04JH5FlXAfPL8OEpgU="
+    "vendorHash": "sha256-fgvNdBwkz+YHOrLRQSe1D+3/VUhttKkJGzV6cg57g8s="
  },
  "sumologic": {
    "hash": "sha256-1BwhcyEJs7Xm+p2ChA9K7g+qBzqoh3eyAT9qKMfHB1g=",
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dnscontrol";
-  version = "3.27.2";
+  version = "3.28.0";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-2U5DlXnW+mCxGfdjikeMm+k+KyxDwjXmjGrH3uq4lJo=";
+    sha256 = "sha256-LIW5z8xb7o9oah6P3GvhzXTPRoBNuxYfZlGq4l0KS8M=";
  };

-  vendorHash = "sha256-h0n0dR1iqeVEFvcDeMlfBu7mlrSNloAih2ZhT3ML1FI=";
+  vendorHash = "sha256-fd3pf23Cw85RVYDrI9LYQIF0d3+o5VG+qqcN1c/xhuY=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/networking/freefilesync/default.nix
+++ b/pkgs/applications/networking/freefilesync/default.nix
@ -10,6 +10,7 @@
 , openssl
 , wxGTK32
 , gitUpdater
+, wrapGAppsHook
 }:

 gcc12Stdenv.mkDerivation rec {
@ -45,6 +46,7 @@ gcc12Stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [
+    wrapGAppsHook
    pkg-config
  ];

--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "dino";
-  version = "0.4.1";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "dino";
    repo = "dino";
    rev = "v${version}";
-    sha256 = "sha256-1czey1/Zn96JneCUnhPMyffG9FVV4bA9aidNB7Ozkpo=";
+    sha256 = "sha256-85Sh3UwoMaa+bpL81gIKtkpCeRl1mXbs8Odux1FURdQ=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , callPackage
 , pkg-config
 , cmake
@ -84,6 +85,16 @@ stdenv.mkDerivation rec {
    sha256 = "0c65ry82ffmh1qzc2lnsyjs78r9jllv62p9vglpz0ikg86zf36sk";
  };

+  patches = [
+    # the generated .desktop files contains references to unwrapped tdesktop, breaking scheme handling
+    # and the scheme handler is already registered in the packaged .desktop file, rendering this unnecessary
+    # see https://github.com/NixOS/nixpkgs/issues/218370
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/telegram-desktop/-/raw/09b363ed5a4fcd8ecc3282b9bfede5fbb83f97ef/debian/patches/Disable-register-custom-scheme.patch";
+      hash = "sha256-B8X5lnSpwwdp1HlvyXJWQPybEN+plOwimdV5gW6aY2Y=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
      --replace '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@ -9,18 +9,18 @@

 buildGo120Module rec {
  pname = "shellhub-agent";
-  version = "0.11.6";
+  version = "0.11.7";

  src = fetchFromGitHub {
    owner = "shellhub-io";
    repo = "shellhub";
    rev = "v${version}";
-    sha256 = "eZLQzy3lWwGM6VWFbsJ6JuGC+/dZnoymZgNtM8CPBM4=";
+    sha256 = "d5ESQQgBPUFe2tuCbeFIqiWPpr9wUczbXLc5QdXurXY=";
  };

  modRoot = "./agent";

-  vendorSha256 = "sha256-7kDPo24I58Nh7OiHj6Zy40jAEaXSOmbcczkgJPXBItU=";
+  vendorSha256 = "sha256-/85rIBfFBpXYrsCBDGVzXfAxO6xXQ8uTL2XeEPKQwDQ=";

  ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];

--- a/pkgs/applications/office/appflowy/default.nix
+++ b/pkgs/applications/office/appflowy/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "appflowy";
-  version = "0.1.0";
+  version = "0.1.1";

  src = fetchzip {
    url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${version}/AppFlowy_x86_64-unknown-linux-gnu_ubuntu-20.04.tar.gz";
-    sha256 = "sha256-WuEwhJ1YhbldFfisfUsp3GCV2vQy9oTam6BkL/7QEgI=";
+    sha256 = "sha256-H4xVUXC7cRCgC1fHMXPucGRTBlGRcyzskhNBaNVGAns=";
    stripRoot = false;
  };

@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
  installPhase = ''
    runHook preInstall

-    mv AppFlowy/* ./
+    cd AppFlowy/

    mkdir -p $out/opt/
    mkdir -p $out/bin/
@ -52,7 +52,7 @@ stdenv.mkDerivation rec {

  preFixup = ''
    # Add missing libraries to appflowy using the ones it comes with
-    makeWrapper $out/opt/app_flowy $out/bin/appflowy \
+    makeWrapper $out/opt/AppFlowy $out/bin/appflowy \
      --set LD_LIBRARY_PATH "$out/opt/lib/" \
      --prefix PATH : "${lib.makeBinPath [ xdg-user-dirs ]}"
  '';
--- a/pkgs/applications/version-management/datalad/default.nix
+++ b/pkgs/applications/version-management/datalad/default.nix
@ -8,7 +8,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "datalad";
    repo = pname;
    rev = version;
-    hash = "sha256-6uWOKsYeNZJ64WqoGHL7AsoK4iZd24TQOJ1ECw+K28Y=";
+    hash = "sha256-F5UFW0/XqntrHclpj3TqoAwuHJbiiv5a7/4MnFoJ1dE=";
  };

  nativeBuildInputs = [ installShellFiles git ];
--- a/pkgs/applications/version-management/dvc/default.nix
+++ b/pkgs/applications/version-management/dvc/default.nix
@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "iterative";
    repo = pname;
    rev = version;
-    hash = "sha256-2h+fy4KMxFrVtKJBtA1RmJDZv0OVm1BxO1akZzAw95Y=";
+    hash = "sha256-P0J+3TNHGqMw3krfs1uLnf8nEiIBK6UrrB37mY+fBA0=";
  };

  postPatch = ''
@ -98,5 +98,6 @@ python3.pkgs.buildPythonApplication rec {
    homepage = "https://dvc.org";
    license = licenses.asl20;
    maintainers = with maintainers; [ cmcdragonkai fab ];
+    broken = true; # requires new python package: dvc-studio-client
  };
 }
--- a/pkgs/applications/version-management/git-open/default.nix
+++ b/pkgs/applications/version-management/git-open/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "git-open";
-  version = "2.1.0";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "paulirish";
    repo = "git-open";
    rev = "v${version}";
-    sha256 = "11n46bngvca5wbdbfcxzjhjbfdbad7sgf7h9gf956cb1q8swsdm0";
+    sha256 = "sha256-Bag2rI2uR7ilkg2ozjR8tPXqKz5XjiY7WAUJKTVTXd8=";
  };

  nativeBuildInputs = [ installShellFiles makeWrapper pandoc ];
@ -23,10 +23,10 @@ stdenv.mkDerivation rec {

  installPhase = ''
    mkdir -p $out/bin
-    cp git-open $out/bin
+    mv git-open $out/bin
    installManPage git-open.1
    wrapProgram $out/bin/git-open \
-      --prefix PATH : "${lib.makeBinPath [ git gnugrep ]}" \
+      --prefix PATH : "${lib.makeBinPath [ gnugrep ]}" \
      --suffix PATH : "${lib.makeBinPath [ xdg-utils ]}"
  '';

@ -35,6 +35,6 @@ stdenv.mkDerivation rec {
    description = "Open the GitHub page or website for a repository in your browser";
    license = licenses.mit;
    platforms = platforms.all;
-    maintainers = with maintainers; [ jlesquembre SuperSandro2000 ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
  };
 }
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -10,24 +10,24 @@ with lib;

 let
  pname = "gitkraken";
-  version = "9.1.1";
+  version = "9.2.1";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      sha256 = "sha256-CbIKdErthpMnVIuv+EJsWBRixMDG8h9aQ2XcmqpzKUc=";
+      sha256 = "sha256-JyfbCFh76b2ZWQ8J1xhsp8LYeFGdgJcUDgBCJWHf0Rk=";
    };

    x86_64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      sha256 = "sha256-J6ruK1UE0A9VG1tUHeSUDEL4wqRmUnOH8ftKHIIQuVc=";
+      sha256 = "sha256-sXWgxl+j78r/OhkMkQMQ6iUPz+SY+QDS4pvLErJTeRQ=";
    };

    aarch64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      sha256 = "sha256-cjz/pbV+uV6tbhj3NXDfZ93hgxFtNYhFIh6+jG4pFtU=";
+      sha256 = "sha256-1IsNJMfqpi+s2bHkB6Uo6FacvuRdLpkF+ctmi5b2Lto=";
    };
  };

--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixpacks";
-  version = "1.5.0";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-1IJboAy0GYgkysY84+wHHOulA/aiux7pgCtxfr0CFV8=";
+    sha256 = "sha256-eAniM4o7TshGhO5jGrCZz+Rs5n5Q24tvIWMWebKAWAs=";
  };

-  cargoHash = "sha256-kAou5pPOwbOZ9n8+fQJ4+Hh9x7wrY898R5XTuUEvF2o=";
+  cargoHash = "sha256-0Y4hHuWB7NY7rRJImNIrxlEffrT9055ThQGqJlMeDMM=";

  # skip test due FHS dependency
  doCheck = false;
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -145,6 +145,11 @@ buildGoModule rec {
  meta = with lib; {
    homepage = "https://podman.io/";
    description = "A program for managing pods, containers and container images";
+    longDescription = ''
+      Podman (the POD MANager) is a tool for managing containers and images, volumes mounted into those containers, and pods made from groups of containers. Podman runs containers on Linux, but can also be used on Mac and Windows systems using a Podman-managed virtual machine. Podman is based on libpod, a library for container lifecycle management that is also contained in this repository. The libpod library provides APIs for managing containers, pods, container images, and volumes.
+
+      To install on NixOS, please use the option `virtualisation.podman.enable = true`.
+    '';
    changelog = "https://github.com/containers/podman/blob/v${version}/RELEASE_NOTES.md";
    license = licenses.asl20;
    maintainers = with maintainers; [ marsam ] ++ teams.podman.members;
--- a/pkgs/data/fonts/lxgw-neoxihei/default.nix
+++ b/pkgs/data/fonts/lxgw-neoxihei/default.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lxgw-neoxihei";
-  version = "1.007";
+  version = "1.009";

  src = fetchurl {
    url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-ChYpRCw8DAo8bo6fJ+5LyF+FGmER+4nY2aEx1GIROdU=";
+    hash = "sha256-Q7rrgqrjALLY2y40mNfNmzSeGwcVwhZUmDj08nlWsao=";
  };

  dontUnpack = true;
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "sarasa-gothic";
-  version = "0.40.3";
+  version = "0.40.4";

  src = fetchurl {
    # Use the 'ttc' files here for a smaller closure size.
    # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
    url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-    hash = "sha256-lhjsmsgFEXMX5byp50qRoHoX9nuKcsrAp6NGDdfXo3I=";
+    hash = "sha256-PVlozsWYomsQKp8WxHD8+pxzlTmIKGPK71HDLWMR9S0=";
  };

  sourceRoot = ".";
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@ -72,13 +72,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cinnamon-common";
-  version = "5.6.7";
+  version = "5.6.8";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "cinnamon";
    rev = version;
-    hash = "sha256-oBD9jpZSOB7R3bbMv1qOQkkQyFTKkNnNagJ1INeA0s4=";
+    hash = "sha256-qL8GaEH/0d4yEwwdaR55fTp0RitbyptoxKOBO3nmbic=";
  };

  patches = [
@ -159,8 +159,6 @@ stdenv.mkDerivation rec {

    sed "s|'python3'|'${pythonEnv.interpreter}'|g" -i ./files/usr/share/cinnamon/cinnamon-settings/bin/CinnamonGtkSettings.py

-    sed "s|/usr/share/%s|/run/current-system/sw/share/%s|g" -i ./files/usr/share/cinnamon/cinnamon-settings/modules/cs_themes.py
-
    sed "s|/usr/bin/cinnamon-screensaver-command|/run/current-system/sw/bin/cinnamon-screensaver-command|g" \
      -i ./files/usr/share/cinnamon/applets/menu@cinnamon.org/applet.js -i ./files/usr/share/cinnamon/applets/user@cinnamon.org/applet.js

--- a/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
@ -32,13 +32,13 @@

 stdenv.mkDerivation rec {
  pname = "cinnamon-settings-daemon";
-  version = "5.6.1";
+  version = "5.6.2";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-QR77O3rFfY0+6cKoS75xoFRplNo4nvTMtR2rNKZERYE=";
+    hash = "sha256-IqYfHMjKe7gVsM6HgihQMNkcXSYBOft1lamXOLa1Y8k=";
  };

  patches = [
--- a/pkgs/desktops/cinnamon/muffin/default.nix
+++ b/pkgs/desktops/cinnamon/muffin/default.nix
@ -35,7 +35,7 @@

 stdenv.mkDerivation rec {
  pname = "muffin";
-  version = "5.6.3";
+  version = "5.6.4";

  outputs = [ "out" "dev" "man" ];

@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-qcm1CRUMKFx4KDXBnaIVLHuZTzSMEWEBFTWMe85pJDE=";
+    hash = "sha256-NnQ7KF979HnsEc4X/Wf1YOfUvByHvVIdTAcJyUjhsp8=";
  };

  patches = [
--- a/pkgs/desktops/cinnamon/nemo/default.nix
+++ b/pkgs/desktops/cinnamon/nemo/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "nemo";
-  version = "5.6.3";
+  version = "5.6.4";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "sha256-CuG0s2gtuYwuIvti5xGiGJa5C5IcruFtNhv6s1vcuUA=";
+    sha256 = "sha256-zvELN9ggfmfIEPeD0VEWM25kRi8RWA/aKlrdO5dKX1k=";
  };

  patches = [
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@ -36,7 +36,7 @@ mixRelease  {
  # of the no-deps-check requirement
  buildPhase = ''
    runHook preBuild
-    mix do compile --no-deps-check, elixir-ls.release
+    mix do compile --no-deps-check, elixir_ls.release
    runHook postBuild
  '';

--- a/pkgs/development/interpreters/octave/build-octave-package.nix
+++ b/pkgs/development/interpreters/octave/build-octave-package.nix
@ -62,13 +62,21 @@ let
  ]
  ++ nativeBuildInputs;

+  passthru' = {
+    updateScript = [
+      ../../../../maintainers/scripts/update-octave-packages
+      (builtins.unsafeGetAttrPos "pname" octave.pkgs.${attrs.pname}).file
+    ];
+  }
+  // passthru;
+
  # This step is required because when
  # a = { test = [ "a" "b" ]; }; b = { test = [ "c" "d" ]; };
  # (a // b).test = [ "c" "d" ];
  # This used to mean that if a package defined extra nativeBuildInputs, it
  # would override the ones for building an Octave package (the hook and Octave
  # itself, causing everything to fail.
-  attrs' = builtins.removeAttrs attrs [ "nativeBuildInputs" ];
+  attrs' = builtins.removeAttrs attrs [ "nativeBuildInputs" "passthru" ];

 in stdenv.mkDerivation ({
  packageName = "${fullLibName}";
@ -121,5 +129,7 @@ in stdenv.mkDerivation ({
  # together with Octave.
  dontInstall = true;

+  passthru = passthru';
+
  inherit meta;
 } // attrs')
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "belle-sip";
-  version = "5.2.23";
+  version = "5.2.37";

  src = fetchFromGitLab {
    domain = "gitlab.linphone.org";
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    group = "BC";
    repo = pname;
    rev = version;
-    sha256 = "sha256-c73PCM+bRz6CjGRY2AapEcvKC1UqyEfzb7qsicmrkQU=";
+    sha256 = "sha256-e5CwLzpvW5ktv5R8PZkNmSXAi/SaTltJs9LY26iKsLo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/bootil/default.nix
+++ b/pkgs/development/libraries/bootil/default.nix
@ -39,6 +39,7 @@ stdenv.mkDerivation {
    license = licenses.free;
    maintainers = with maintainers; [ abigailbuccaneer ];
    # Build uses `-msse` and `-mfpmath=sse`
+    platforms = platforms.all;
    badPlatforms = [ "aarch64-linux" ];
  };
 }
--- a/pkgs/development/libraries/imgui/default.nix
+++ b/pkgs/development/libraries/imgui/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "imgui";
-  version = "1.89.3";
+  version = "1.89.4";

  src = fetchFromGitHub {
    owner = "ocornut";
    repo = "imgui";
    rev = "v${version}";
-    sha256 = "sha256-hPUOqXMpjKNuWVo2RUq2Nw5i+p8PE8qmlyATV7y3Lgg=";
+    sha256 = "sha256-iBpJzfU8ATDilU/1zhV9T/1Zy22g8vw81cmkmJ5+6cg=";
  };

  dontBuild = true;
--- a/pkgs/development/libraries/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch
+++ b/pkgs/development/libraries/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch
@ -0,0 +1,201 @@
+From 1cf6b108882669f1b20c18fb5f2d6dff0fc83296 Mon Sep 17 00:00:00 2001
+From: Jan Tojnar <jtojnar@gmail.com>
+Date: Sat, 24 Dec 2022 15:31:51 +0100
+Subject: [PATCH 1/4] libbacktrace: avoid libtool wrapping tests
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When `--enable-shared` is used, libtool will produce shell scripts
+instead of programs, preventing separate debug info from being generated:
+
+    objcopy --only-keep-debug btest btest_gnudebuglink.debug
+    objcopy: btest: file format not recognized
+    make[2]: *** [Makefile:2615: btest_gnudebuglink] Error 1
+
+Let’s make it properly set rpath with `-no-install` flag,
+so that wrappers are not needed, as mentioned on
+https://autotools.info/libtool/wrappers.html
+---
+ Makefile.am | 28 +++++++++++++++++++++++-----
+ 1 file changed, 23 insertions(+), 5 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index c53cbae..6eab991 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -107,6 +107,8 @@ check_DATA =
+ # Flags to use when compiling test programs.
+ libbacktrace_TEST_CFLAGS = $(EXTRA_FLAGS) $(WARN_FLAGS) -g
+ 
+libbacktrace_TEST_LDFLAGS = -no-install
+
+ if USE_DSYMUTIL
+ 
+ %.dSYM: %
+@@ -171,48 +173,56 @@ xcoff_%.c: xcoff.c
+ 
+ test_elf_32_SOURCES = test_format.c testlib.c
+ test_elf_32_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+test_elf_32_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ test_elf_32_LDADD = libbacktrace_noformat.la elf_32.lo
+ 
+ BUILDTESTS += test_elf_32
+ 
+ test_elf_64_SOURCES = test_format.c testlib.c
+ test_elf_64_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+test_elf_64_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ test_elf_64_LDADD = libbacktrace_noformat.la elf_64.lo
+ 
+ BUILDTESTS += test_elf_64
+ 
+ test_macho_SOURCES = test_format.c testlib.c
+ test_macho_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+test_macho_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ test_macho_LDADD = libbacktrace_noformat.la macho.lo
+ 
+ BUILDTESTS += test_macho
+ 
+ test_xcoff_32_SOURCES = test_format.c testlib.c
+ test_xcoff_32_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+test_xcoff_32_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ test_xcoff_32_LDADD = libbacktrace_noformat.la xcoff_32.lo
+ 
+ BUILDTESTS += test_xcoff_32
+ 
+ test_xcoff_64_SOURCES = test_format.c testlib.c
+ test_xcoff_64_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+test_xcoff_64_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ test_xcoff_64_LDADD = libbacktrace_noformat.la xcoff_64.lo
+ 
+ BUILDTESTS += test_xcoff_64
+ 
+ test_pecoff_SOURCES = test_format.c testlib.c
+ test_pecoff_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+test_pecoff_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ test_pecoff_LDADD = libbacktrace_noformat.la pecoff.lo
+ 
+ BUILDTESTS += test_pecoff
+ 
+ test_unknown_SOURCES = test_format.c testlib.c
+ test_unknown_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+test_unknown_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ test_unknown_LDADD = libbacktrace_noformat.la unknown.lo
+ 
+ BUILDTESTS += test_unknown
+ 
+ unittest_SOURCES = unittest.c testlib.c
+ unittest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+unittest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ unittest_LDADD = libbacktrace.la
+ 
+ BUILDTESTS += unittest
+@@ -253,7 +263,7 @@ if HAVE_OBJCOPY_DEBUGLINK
+ 
+ b2test_SOURCES = $(btest_SOURCES)
+ b2test_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+-b2test_LDFLAGS = -Wl,--build-id
+b2test_LDFLAGS = -Wl,--build-id $(libbacktrace_TEST_LDFLAGS)
+ b2test_LDADD = libbacktrace_elf_for_test.la
+ 
+ check_PROGRAMS += b2test
+@@ -263,7 +273,7 @@ if HAVE_DWZ
+ 
+ b3test_SOURCES = $(btest_SOURCES)
+ b3test_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+-b3test_LDFLAGS = -Wl,--build-id
+b3test_LDFLAGS = -Wl,--build-id $(libbacktrace_TEST_LDFLAGS)
+ b3test_LDADD = libbacktrace_elf_for_test.la
+ 
+ check_PROGRAMS += b3test
+@@ -276,6 +286,7 @@ endif HAVE_ELF
+ 
+ btest_SOURCES = btest.c testlib.c
+ btest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -O
+btest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ btest_LDADD = libbacktrace.la
+ 
+ BUILDTESTS += btest
+@@ -330,6 +341,7 @@ endif HAVE_DWZ
+ 
+ stest_SOURCES = stest.c
+ stest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+stest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ stest_LDADD = libbacktrace.la
+ 
+ BUILDTESTS += stest
+@@ -352,6 +364,7 @@ if HAVE_ELF
+ 
+ ztest_SOURCES = ztest.c testlib.c
+ ztest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
+ztest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ ztest_LDADD = libbacktrace.la
+ ztest_alloc_LDADD = libbacktrace_alloc.la
+ 
+@@ -371,6 +384,7 @@ BUILDTESTS += ztest_alloc
+ 
+ zstdtest_SOURCES = zstdtest.c testlib.c
+ zstdtest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
+zstdtest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ zstdtest_LDADD = libbacktrace.la
+ zstdtest_alloc_LDADD = libbacktrace_alloc.la
+ 
+@@ -392,6 +406,7 @@ endif HAVE_ELF
+ 
+ edtest_SOURCES = edtest.c edtest2_build.c testlib.c
+ edtest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+edtest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ edtest_LDADD = libbacktrace.la
+ 
+ BUILDTESTS += edtest
+@@ -422,6 +437,7 @@ BUILDTESTS += ttest
+ 
+ ttest_SOURCES = ttest.c testlib.c
+ ttest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -pthread
+ttest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ ttest_LDADD = libbacktrace.la
+ 
+ if USE_DSYMUTIL
+@@ -460,12 +476,12 @@ if HAVE_COMPRESSED_DEBUG
+ 
+ ctestg_SOURCES = btest.c testlib.c
+ ctestg_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+-ctestg_LDFLAGS = -Wl,--compress-debug-sections=zlib-gnu
+ctestg_LDFLAGS = -Wl,--compress-debug-sections=zlib-gnu $(libbacktrace_TEST_LDFLAGS)
+ ctestg_LDADD = libbacktrace.la
+ 
+ ctesta_SOURCES = btest.c testlib.c
+ ctesta_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+-ctesta_LDFLAGS = -Wl,--compress-debug-sections=zlib-gabi
+ctesta_LDFLAGS = -Wl,--compress-debug-sections=zlib-gabi $(libbacktrace_TEST_LDFLAGS)
+ ctesta_LDADD = libbacktrace.la
+ 
+ BUILDTESTS += ctestg ctesta
+@@ -474,7 +490,7 @@ if HAVE_COMPRESSED_DEBUG_ZSTD
+ 
+ ctestzstd_SOURCES = btest.c testlib.c
+ ctestzstd_CFLAGS = $(libbacktrace_TEST_CFLAGS)
+-ctestzstd_LDFLAGS = -Wl,--compress-debug-sections=zstd
+ctestzstd_LDFLAGS = -Wl,--compress-debug-sections=zstd $(libbacktrace_TEST_LDFLAGS)
+ ctestzstd_LDADD = libbacktrace.la
+ 
+ BUILDTESTS += ctestzstd
+@@ -521,6 +537,7 @@ endif
+ 
+ mtest_SOURCES = mtest.c testlib.c
+ mtest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -O
+mtest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ mtest_LDADD = libbacktrace.la
+ 
+ BUILDTESTS += mtest
+@@ -553,6 +570,7 @@ if HAVE_ELF
+ 
+ xztest_SOURCES = xztest.c testlib.c
+ xztest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
+xztest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
+ xztest_LDADD = libbacktrace.la
+ 
+ xztest_alloc_SOURCES = $(xztest_SOURCES)
+-- 
+2.38.1
+
--- a/pkgs/development/libraries/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch
+++ b/pkgs/development/libraries/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch
@ -0,0 +1,108 @@
+From f409ee343fe6cdc059bb411746f27a515aec66a8 Mon Sep 17 00:00:00 2001
+From: Jan Tojnar <jtojnar@gmail.com>
+Date: Sat, 24 Dec 2022 16:46:18 +0100
+Subject: [PATCH 2/4] libbacktrace: Allow configuring debug dir
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On platforms that do not use FHS like NixOS or GNU Guix,
+the build-id directories are not under `/usr/lib/debug`.
+
+Let’s add `--with-separate-debug-dir` configure flag so that
+the path can be changed. The same flag is supported by gdb:
+
+https://github.com/bminor/binutils-gdb/blob/095f84c7e3cf85cd68c657c46b80be078f336bc9/gdb/configure.ac#L113-L115
+---
+ Makefile.am  | 11 ++++++-----
+ configure.ac |  8 ++++++++
+ elf.c        |  4 ++--
+ 3 files changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 6eab991..da443c1 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -33,7 +33,8 @@ ACLOCAL_AMFLAGS = -I config
+ 
+ AM_CPPFLAGS =
+ 
+-AM_CFLAGS = $(EXTRA_FLAGS) $(WARN_FLAGS) $(PIC_FLAG)
+AM_CFLAGS = $(EXTRA_FLAGS) $(WARN_FLAGS) $(PIC_FLAG) \
+	-DSYSTEM_DEBUG_DIR=\"$(SEPARATE_DEBUG_DIR)\"
+ 
+ include_HEADERS = backtrace.h backtrace-supported.h
+ 
+@@ -134,7 +135,7 @@ libbacktrace_noformat_la_DEPENDENCIES = $(libbacktrace_noformat_la_LIBADD)
+ if HAVE_ELF
+ if HAVE_OBJCOPY_DEBUGLINK
+ 
+-TEST_BUILD_ID_DIR=$(abs_builddir)/usr/lib/debug/.build-id/
+TEST_DEBUG_DIR=$(abs_builddir)/usr/lib/debug
+ 
+ check_LTLIBRARIES += libbacktrace_elf_for_test.la
+ 
+@@ -143,8 +144,8 @@ libbacktrace_elf_for_test_la_LIBADD = $(BACKTRACE_FILE) elf_for_test.lo \
+ 	$(VIEW_FILE) $(ALLOC_FILE)
+ 
+ elf_for_test.c: elf.c
+-	SEARCH='^#define SYSTEM_BUILD_ID_DIR.*$$'; \
+-	REPLACE="#define SYSTEM_BUILD_ID_DIR \"$(TEST_BUILD_ID_DIR)\""; \
+	SEARCH='^#define BUILD_ID_DIR.*$$'; \
+	REPLACE='\0\n#undef SYSTEM_DEBUG_DIR\n#define SYSTEM_DEBUG_DIR "$(TEST_DEBUG_DIR)"'; \
+ 	$(SED) "s%$$SEARCH%$$REPLACE%" \
+ 		$< \
+ 		> $@.tmp
+@@ -468,7 +469,7 @@ endif HAVE_OBJCOPY_DEBUGLINK
+ 
+ %_buildid: %
+ 	./install-debuginfo-for-buildid.sh \
+-	  "$(TEST_BUILD_ID_DIR)" \
+	  "$(TEST_DEBUG_DIR)/.build-id" \
+ 	  $<
+ 	$(OBJCOPY) --strip-debug $< $@
+ 
+diff --git a/configure.ac b/configure.ac
+index 7f122cb..bb590ab 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -67,6 +67,14 @@ AM_MAINTAINER_MODE
+ AC_ARG_WITH(target-subdir,
+ [  --with-target-subdir=SUBDIR      Configuring in a subdirectory for target])
+ 
+AC_ARG_WITH(separate-debug-dir,
+[  --with-separate-debug-dir=DEBUGDIR      Look for global separate debug info in this path @<:@LIBDIR/debug@:>@],
+[separate_debug_dir=$withval],
+[separate_debug_dir=$libdir/debug])
+
+SEPARATE_DEBUG_DIR=$separate_debug_dir
+AC_SUBST(SEPARATE_DEBUG_DIR)
+
+ # We must force CC to /not/ be precious variables; otherwise
+ # the wrong, non-multilib-adjusted value will be used in multilibs.
+ # As a side effect, we have to subst CFLAGS ourselves.
+diff --git a/elf.c b/elf.c
+index e82ecc5..8b1189c 100644
+--- a/elf.c
+++ b/elf.c
+@@ -856,7 +856,7 @@ elf_readlink (struct backtrace_state *state, const char *filename,
+     }
+ }
+ 
+-#define SYSTEM_BUILD_ID_DIR "/usr/lib/debug/.build-id/"
+#define BUILD_ID_DIR "/.build-id/"
+ 
+ /* Open a separate debug info file, using the build ID to find it.
+    Returns an open file descriptor, or -1.
+@@ -870,7 +870,7 @@ elf_open_debugfile_by_buildid (struct backtrace_state *state,
+ 			       backtrace_error_callback error_callback,
+ 			       void *data)
+ {
+-  const char * const prefix = SYSTEM_BUILD_ID_DIR;
+  const char * const prefix = SYSTEM_DEBUG_DIR BUILD_ID_DIR;
+   const size_t prefix_len = strlen (prefix);
+   const char * const suffix = ".debug";
+   const size_t suffix_len = strlen (suffix);
+-- 
+2.38.1
+
--- a/pkgs/development/libraries/libbacktrace/0003-libbacktrace-Support-multiple-build-id-directories.patch
+++ b/pkgs/development/libraries/libbacktrace/0003-libbacktrace-Support-multiple-build-id-directories.patch
@ -0,0 +1,101 @@
+From de122af5382d8017cae63bdee946206c6c6c23ab Mon Sep 17 00:00:00 2001
+From: Jan Tojnar <jtojnar@gmail.com>
+Date: Sat, 24 Dec 2022 20:19:27 +0100
+Subject: [PATCH 3/4] libbacktrace: Support multiple build id directories
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+gdb supports multiple debug directories separated by colons:
+https://github.com/bminor/binutils-gdb/blob/fcbfb25dcca625a7f999ec51d48b6fc3a32123c3/gdb/build-id.c#L136-L142
+
+This is useful for example when using dwarffs in addition
+to debug data installed using distribution’s package manager.
+---
+ elf.c | 57 ++++++++++++++++++++++++++++++++++++---------------------
+ 1 file changed, 36 insertions(+), 21 deletions(-)
+
+diff --git a/elf.c b/elf.c
+index 8b1189c..65c647a 100644
+--- a/elf.c
+++ b/elf.c
+@@ -865,12 +865,12 @@ elf_readlink (struct backtrace_state *state, const char *filename,
+    when the build ID is known is in /usr/lib/debug/.build-id.  */
+ 
+ static int
+-elf_open_debugfile_by_buildid (struct backtrace_state *state,
+elf_open_debugfile_by_buildid (const char * const prefix,
+                               struct backtrace_state *state,
+ 			       const char *buildid_data, size_t buildid_size,
+ 			       backtrace_error_callback error_callback,
+ 			       void *data)
+ {
+-  const char * const prefix = SYSTEM_DEBUG_DIR BUILD_ID_DIR;
+   const size_t prefix_len = strlen (prefix);
+   const char * const suffix = ".debug";
+   const size_t suffix_len = strlen (suffix);
+@@ -6936,27 +6936,42 @@ elf_add (struct backtrace_state *state, const char *filename, int descriptor,
+   if (buildid_data != NULL)
+     {
+       int d;
+      char debug_directories[strlen(SYSTEM_DEBUG_DIR) + 1];
+      char *debug_dir;
+ 
+-      d = elf_open_debugfile_by_buildid (state, buildid_data, buildid_size,
+-					 error_callback, data);
+-      if (d >= 0)
+-	{
+-	  int ret;
+      strcpy(debug_directories, SYSTEM_DEBUG_DIR);
+ 
+-	  elf_release_view (state, &buildid_view, error_callback, data);
+-	  if (debuglink_view_valid)
+-	    elf_release_view (state, &debuglink_view, error_callback, data);
+-	  if (debugaltlink_view_valid)
+-	    elf_release_view (state, &debugaltlink_view, error_callback, data);
+-	  ret = elf_add (state, "", d, NULL, 0, base_address, error_callback,
+-			 data, fileline_fn, found_sym, found_dwarf, NULL, 0,
+-			 1, NULL, 0);
+-	  if (ret < 0)
+-	    backtrace_close (d, error_callback, data);
+-	  else if (descriptor >= 0)
+-	    backtrace_close (descriptor, error_callback, data);
+-	  return ret;
+-	}
+      debug_dir = strtok (debug_directories, ":");
+      while (debug_dir != NULL)
+      {
+        char prefix[strlen(debug_dir) + strlen(BUILD_ID_DIR) + 1];
+        strcpy(prefix, debug_dir);
+        strcat(prefix, BUILD_ID_DIR);
+
+        d = elf_open_debugfile_by_buildid (prefix, state, buildid_data, buildid_size,
+                                           error_callback, data);
+
+        if (d >= 0)
+          {
+            int ret;
+
+            elf_release_view (state, &buildid_view, error_callback, data);
+            if (debuglink_view_valid)
+              elf_release_view (state, &debuglink_view, error_callback, data);
+            if (debugaltlink_view_valid)
+              elf_release_view (state, &debugaltlink_view, error_callback, data);
+            ret = elf_add (state, "", d, NULL, 0, base_address, error_callback,
+                           data, fileline_fn, found_sym, found_dwarf, NULL, 0,
+                           1, NULL, 0);
+            if (ret < 0)
+              backtrace_close (d, error_callback, data);
+            else if (descriptor >= 0)
+              backtrace_close (descriptor, error_callback, data);
+            return ret;
+          }
+
+        debug_dir = strtok (NULL, ":");
+      }
+     }
+ 
+   if (buildid_view_valid)
+-- 
+2.38.1
+
--- a/pkgs/development/libraries/libbacktrace/0004-libbacktrace-Support-NIX_DEBUG_INFO_DIRS-environment.patch
+++ b/pkgs/development/libraries/libbacktrace/0004-libbacktrace-Support-NIX_DEBUG_INFO_DIRS-environment.patch
@ -0,0 +1,42 @@
+From a3b7510e4c9e7201a4301f2a45d8569b06354607 Mon Sep 17 00:00:00 2001
+From: Jan Tojnar <jtojnar@gmail.com>
+Date: Sat, 24 Dec 2022 20:30:22 +0100
+Subject: [PATCH 4/4] libbacktrace: Support NIX_DEBUG_INFO_DIRS environment
+ variable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Let’s make debug data lookup work on NixOS just like in gdb.
+---
+ elf.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/elf.c b/elf.c
+index 65c647a..5c8abc0 100644
+--- a/elf.c
+++ b/elf.c
+@@ -6935,11 +6935,18 @@ elf_add (struct backtrace_state *state, const char *filename, int descriptor,
+ 
+   if (buildid_data != NULL)
+     {
+      const char *debug_directories_immutable;
+      const char *nix_debug = getenv ("NIX_DEBUG_INFO_DIRS");
+      if (nix_debug != NULL)
+        debug_directories_immutable = nix_debug;
+      else
+        debug_directories_immutable = SYSTEM_DEBUG_DIR;
+
+       int d;
+-      char debug_directories[strlen(SYSTEM_DEBUG_DIR) + 1];
+      char debug_directories[strlen(debug_directories_immutable) + 1];
+       char *debug_dir;
+ 
+-      strcpy(debug_directories, SYSTEM_DEBUG_DIR);
+      strcpy(debug_directories, debug_directories_immutable);
+ 
+       debug_dir = strtok (debug_directories, ":");
+       while (debug_dir != NULL)
+-- 
+2.38.1
+
--- a/pkgs/development/libraries/libbacktrace/default.nix
+++ b/pkgs/development/libraries/libbacktrace/default.nix
@ -1,22 +1,52 @@
-{ lib, stdenv, callPackage, fetchFromGitHub
+{ stdenv
+, lib
+, fetchFromGitHub
 , enableStatic ? stdenv.hostPlatform.isStatic
 , enableShared ? !stdenv.hostPlatform.isStatic
+, unstableGitUpdater
+, autoreconfHook
 }:
-let
-  yesno = b: if b then "yes" else "no";
-in stdenv.mkDerivation rec {
+
+stdenv.mkDerivation {
  pname = "libbacktrace";
-  version = "2020-05-13";
+  version = "unstable-2022-12-16";
+
  src = fetchFromGitHub {
    owner = "ianlancetaylor";
-    repo = pname;
-    rev = "9b7f216e867916594d81e8b6118f092ac3fcf704";
-    sha256 = "0qr624v954gnfkmpdlfk66sxz3acyfmv805rybsaggw5gz5sd1nh";
+    repo = "libbacktrace";
+    rev = "da7eff2f37e38136c5a0c8922957b9dfab5483ef";
+    sha256 = "ADp8n1kUf8OysFY/Jv1ytxKjqgz1Nu2VRcFGlt1k/HM=";
  };
-  configureFlags = [
-    "--enable-static=${yesno enableStatic}"
-    "--enable-shared=${yesno enableShared}"
+
+  patches = [
+    # Fix tests with shared library.
+    # https://github.com/ianlancetaylor/libbacktrace/pull/99
+    ./0001-libbacktrace-avoid-libtool-wrapping-tests.patch
+
+    # Support multiple debug dirs.
+    # https://github.com/ianlancetaylor/libbacktrace/pull/100
+    ./0002-libbacktrace-Allow-configuring-debug-dir.patch
+    ./0003-libbacktrace-Support-multiple-build-id-directories.patch
+
+    # Support NIX_DEBUG_INFO_DIRS environment variable.
+    ./0004-libbacktrace-Support-NIX_DEBUG_INFO_DIRS-environment.patch
  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  configureFlags = [
+    (lib.enableFeature enableStatic "static")
+    (lib.enableFeature enableShared "shared")
+  ];
+
+  doCheck = stdenv.isLinux;
+
+  passthru = {
+    updateScript = unstableGitUpdater { };
+  };
+
  meta = with lib; {
    description = "A C library that may be linked into a C/C++ program to produce symbolic backtraces";
    homepage = "https://github.com/ianlancetaylor/libbacktrace";
--- a/pkgs/development/libraries/libcef/default.nix
+++ b/pkgs/development/libraries/libcef/default.nix
@ -61,26 +61,21 @@ let
      platformStr = "linuxarm64";
      projectArch = "arm64";
    };
-    "i686-linux" = {
-      platformStr = "linux32";
-      projectArch = "x86";
-    };
    "x86_64-linux" = {
      platformStr = "linux64";
      projectArch = "x86_64";
    };
  };
-  platforms."aarch64-linux".sha256 = "0gmnmr0zn2ffn7xbhmfh6rhmwmxy5zzlj0s3lyp99knjn47lg2fg";
-  platforms."i686-linux".sha256 = "1lp2z9db89qk2wh900c2dzlhflwmcbmp4m7xnlj04pq4q2kgfm9p";
-  platforms."x86_64-linux".sha256 = "1ljrp0iky7rrj04sbqicrg1jr938xnid6jlirbf7gwlmzliz3wfs";
+  platforms."aarch64-linux".sha256 = "1aacq9baw0hxf3h354fmws4v6008d3axxmri23vlvhzg7hza05n1";
+  platforms."x86_64-linux".sha256 = "17wpmvrbkdhnsk63f36yk6kq0mqhx63ih0mbhf8hl0qj6yndabgc";

  platformInfo = builtins.getAttr stdenv.targetPlatform.system platforms;
 in
 stdenv.mkDerivation rec {
  pname = "cef-binary";
-  version = "100.0.24";
-  gitRevision = "0783cf8";
-  chromiumVersion = "100.0.4896.127";
+  version = "110.0.27";
+  gitRevision = "1296c82";
+  chromiumVersion = "110.0.5481.100";

  src = fetchurl {
    url = "https://cef-builds.spotifycdn.com/cef_binary_${version}+g${gitRevision}+chromium-${chromiumVersion}_${platformInfo.platformStr}_minimal.tar.bz2";
--- a/pkgs/development/libraries/libcef/update.sh
+++ b/pkgs/development/libraries/libcef/update.sh
@ -12,7 +12,6 @@ GIT_REVISION=$(echo ${VERSION_JSON} | jq -r '.cef_version' | cut -d'+' -f2 | cut
 CHROMIUM_VERSION=$(echo ${VERSION_JSON} | jq -r '.chromium_version')

 SHA256_LINUX64=$(nix-prefetch-url --quiet https://cef-builds.spotifycdn.com/cef_binary_${CEF_VERSION}+g${GIT_REVISION}+chromium-${CHROMIUM_VERSION}_linux64_minimal.tar.bz2)
-SHA256_LINUX32=$(nix-prefetch-url --quiet https://cef-builds.spotifycdn.com/cef_binary_${CEF_VERSION}+g${GIT_REVISION}+chromium-${CHROMIUM_VERSION}_linux32_minimal.tar.bz2)
 SHA256_LINUXARM64=$(nix-prefetch-url --quiet https://cef-builds.spotifycdn.com/cef_binary_${CEF_VERSION}+g${GIT_REVISION}+chromium-${CHROMIUM_VERSION}_linuxarm64_minimal.tar.bz2)

 setKV () {
@ -23,5 +22,4 @@ setKV version ${CEF_VERSION}
 setKV gitRevision ${GIT_REVISION}
 setKV chromiumVersion ${CHROMIUM_VERSION}
 setKV 'platforms."aarch64-linux".sha256' ${SHA256_LINUXARM64}
-setKV 'platforms."i686-linux".sha256' ${SHA256_LINUX32}
 setKV 'platforms."x86_64-linux".sha256' ${SHA256_LINUX64}
--- a/pkgs/development/libraries/libsegfault/default.nix
+++ b/pkgs/development/libraries/libsegfault/default.nix
@ -0,0 +1,43 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, meson
+, ninja
+, boost
+, libbacktrace
+, unstableGitUpdater
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libsegfault";
+  version = "unstable-2022-11-13";
+
+  src = fetchFromGitHub {
+    owner = "jonathanpoelen";
+    repo = "libsegfault";
+    rev = "8bca5964613695bf829c96f7a3a14dbd8304fe1f";
+    sha256 = "vKtY6ZEkyK2K+BzJCSo30f9MpERpPlUnarFIlvJ1Giw=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  buildInputs = [
+    boost
+    libbacktrace
+  ];
+
+  passthru = {
+    updateScript = unstableGitUpdater { };
+  };
+
+  meta = with lib; {
+    description = "Implementation of libSegFault.so with Boost.stracktrace";
+    homepage = "https://github.com/jonathanpoelen/libsegfault";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jtojnar ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/libraries/minizip-ng/default.nix
+++ b/pkgs/development/libraries/minizip-ng/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "minizip-ng";
-  version = "3.0.8";
+  version = "3.0.9";

  src = fetchFromGitHub {
    owner = "zlib-ng";
    repo = finalAttrs.pname;
    rev = finalAttrs.version;
-    sha256 = "sha256-Vzp+5fQBJoO1pG7j8LwC2/B/cOgM/exhKyb3zHuy89Y=";
+    sha256 = "sha256-yuHJUy/Ed7dutmosmcbedz5nZoCc5imLDOXikIde8bs=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/ogre/1.9.x.nix
+++ b/pkgs/development/libraries/ogre/1.9.x.nix
@ -1,53 +0,0 @@
-{ fetchFromGitHub, stdenv, lib
-, cmake, libGLU, libGL
-, freetype, freeimage, zziplib, xorgproto, libXrandr
-, libXaw, freeglut, libXt, libpng, boost, ois
-, libX11, libXmu, libSM, pkg-config
-, libXxf86vm, libICE
-, libXrender
-, withNvidiaCg ? false, nvidia_cg_toolkit
-, withSamples ? false }:
-
-stdenv.mkDerivation rec {
-  pname = "ogre";
-  version = "1.9.1";
-
-  src = fetchFromGitHub {
-    owner = "OGRECave";
-    repo = "ogre";
-    rev = "v${version}";
-    sha256 = "11lfgzqaps3728dswrq3cbwk7aicigyz08q4hfyy6ikc6m35r4wg";
-  };
-
-  # fix for ARM. sys/sysctl.h has moved in later glibcs, and
-  # https://github.com/OGRECave/ogre-next/issues/132 suggests it isn't
-  # needed anyway.
-  postPatch = ''
-    substituteInPlace OgreMain/src/OgrePlatformInformation.cpp \
-      --replace '#include <sys/sysctl.h>' ""
-  '';
-
-  cmakeFlags = [ "-DOGRE_BUILD_SAMPLES=${toString withSamples}" ]
-    ++ map (x: "-DOGRE_BUILD_PLUGIN_${x}=on")
-           ([ "BSP" "OCTREE" "PCZ" "PFX" ] ++ lib.optional withNvidiaCg "CG")
-    ++ map (x: "-DOGRE_BUILD_RENDERSYSTEM_${x}=on") [ "GL" ];
-
-
-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs =
-   [ libGLU libGL
-     freetype freeimage zziplib xorgproto libXrandr
-     libXaw freeglut libXt libpng boost ois
-     libX11 libXmu libSM
-     libXxf86vm libICE
-     libXrender
-   ] ++ lib.optional withNvidiaCg nvidia_cg_toolkit;
-
-  meta = {
-    description = "A 3D engine";
-    homepage = "https://www.ogre3d.org/";
-    maintainers = [ lib.maintainers.raskin ];
-    platforms = lib.platforms.linux;
-    license = lib.licenses.mit;
-  };
-}
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@ -59,6 +59,7 @@ let
          ./patches/qtbase-qmake-mkspecs-mac.patch
          ./patches/qtbase-qmake-pkg-config.patch
          ./patches/qtbase-tzdir.patch
+          ./patches/qtbase-variable-fonts.patch
          # Remove symlink check causing build to bail out and fail.
          # https://gitlab.kitware.com/cmake/cmake/-/issues/23251
          (fetchpatch {
--- a/pkgs/development/libraries/qt-6/patches/qtbase-variable-fonts.patch
+++ b/pkgs/development/libraries/qt-6/patches/qtbase-variable-fonts.patch
@ -0,0 +1,26 @@
+From 9ba9c690fb16188ff524b53def104e68e45cf5c3 Mon Sep 17 00:00:00 2001
+From: Nick Cao <nickcao@nichi.co>
+Date: Tue, 21 Mar 2023 15:48:49 +0800
+Subject: [PATCH] Deal with a font face at index 0 as Regular for Variable
+ fonts
+
+Reference: https://bugreports.qt.io/browse/QTBUG-111994
+---
+ src/gui/text/unix/qfontconfigdatabase.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/gui/text/unix/qfontconfigdatabase.cpp b/src/gui/text/unix/qfontconfigdatabase.cpp
+index 9b60cf2963..5a42ef6a68 100644
+--- a/src/gui/text/unix/qfontconfigdatabase.cpp
+++ b/src/gui/text/unix/qfontconfigdatabase.cpp
+@@ -554,6 +554,7 @@ void QFontconfigDatabase::populateFontDatabase()
+             FcObjectSetAdd(os, *p);
+             ++p;
+         }
+        FcPatternAddBool(pattern, FC_VARIABLE, FcFalse);
+         fonts = FcFontList(nullptr, pattern, os);
+         FcObjectSetDestroy(os);
+         FcPatternDestroy(pattern);
+-- 
+2.39.2
+
--- a/pkgs/development/libraries/sope/default.nix
+++ b/pkgs/development/libraries/sope/default.nix
@ -1,4 +1,4 @@
-{ gnustep, lib, fetchFromGitHub , libxml2, openssl
+{ gnustep, lib, fetchFromGitHub, fetchpatch, libxml2, openssl
 , openldap, mariadb, libmysqlclient, postgresql }:

 gnustep.stdenv.mkDerivation rec {
@ -12,20 +12,36 @@ gnustep.stdenv.mkDerivation rec {
    hash = "sha256-sXIpKdJ5930+W+FsxQ8DZOq/49XWMM1zV8dIzbQdcbc=";
  };

+  patches = [
+    (fetchpatch {
+      name = "sope-no-unnecessary-vars.patch";
+      url = "https://github.com/Alinto/sope/commit/0751a2f11961fd7de4e2728b6e34e9ba4ba5887e.patch";
+      hash = "sha256-1txj8Qehg2N7ZsiYQA2FXI4peQAE3HUwDYkJEP9WnEk=";
+    })
+    (fetchpatch {
+      name = "sope-fix-wformat.patch";
+      url = "https://github.com/Alinto/sope/commit/6adfadd5dd2da4041657ad071892f2c9b1704d22.patch";
+      hash = "sha256-zCbvVdbeBeNo3/cDVdYbyUUC2z8D6Q5ga0plUoMqr98=";
+    })
+  ];
+
  hardeningDisable = [ "format" ];
  nativeBuildInputs = [ gnustep.make ];
-  buildInputs = lib.flatten ([ gnustep.base libxml2 openssl ]
+  buildInputs = [ gnustep.base libxml2 openssl ]
    ++ lib.optional (openldap != null) openldap
    ++ lib.optionals (mariadb != null) [ libmysqlclient mariadb ]
-    ++ lib.optional (postgresql != null) postgresql);
-
-  postPatch = ''
-    # Exclude NIX_ variables
-    sed -i 's/grep GNUSTEP_/grep ^GNUSTEP_/g' configure
-  '';
+    ++ lib.optional (postgresql != null) postgresql;

+  # Configure directories where files are installed to. Everything is automatically
+  # put into $out (thanks GNUstep) apart from the makefiles location which is where
+  # makefiles are read from during build but also where the SOPE makefiles are
+  # installed to in the install phase. We move them over after the installation.
  preConfigure = ''
-    export DESTDIR="$out"
+    mkdir -p /build/Makefiles
+    ln -s ${gnustep.make}/share/GNUstep/Makefiles/* /build/Makefiles
+    cat <<EOF > /build/GNUstep.conf
+    GNUSTEP_MAKEFILES=/build/Makefiles
+    EOF
  '';

  configureFlags = [ "--prefix=" "--disable-debug" "--enable-xml" "--with-ssl=ssl" ]
@ -33,10 +49,12 @@ gnustep.stdenv.mkDerivation rec {
    ++ lib.optional (mariadb != null) "--enable-mysql"
    ++ lib.optional (postgresql != null) "--enable-postgresql";

-  # Yes, this is ugly.
-  preFixup = ''
-    cp -rlPa $out/nix/store/*/* $out
-    rm -rf $out/nix/store
+  env.GNUSTEP_CONFIG_FILE = "/build/GNUstep.conf";
+
+  # Move over the makefiles (see comment over preConfigure)
+  postInstall = ''
+    mkdir -p $out/share/GNUstep/Makefiles
+    find /build/Makefiles -mindepth 1 -maxdepth 1 -not -type l -exec cp -r '{}' $out/share/GNUstep/Makefiles \;
  '';

  meta = with lib; {
--- a/pkgs/development/libraries/timezonemap/default.nix
+++ b/pkgs/development/libraries/timezonemap/default.nix
@ -1,6 +1,8 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , autoreconfHook
 , fetchbzr
+, fetchpatch
 , pkg-config
 , gtk3
 , glib
@ -20,6 +22,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-wCJXwgnN+aZVerjQCm8oT3xIcwmc4ArcEoCh9pMrt+E=";
  };

+  patches = [
+    # Fix crashes when running in GLib 2.76
+    # https://bugs.launchpad.net/ubuntu/+source/libtimezonemap/+bug/2012116
+    (fetchpatch {
+      url = "https://git.launchpad.net/ubuntu/+source/libtimezonemap/plain/debian/patches/timezone-map-Never-try-to-access-to-free-d-or-null-values.patch?id=88f72f724e63df061204f6818c9a1e7d8c003e29";
+      sha256 = "sha256-M5eR0uaqpJOeW2Ya1Al+3ZciXukzHpnjJTMVvdO0dPE=";
+    })
+  ];
+
  nativeBuildInputs = [
    pkg-config
    autoreconfHook
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@ -9,7 +9,9 @@
 , expat
 , libxml2
 , withLibraries ? stdenv.isLinux
+, withTests ? stdenv.isLinux
 , libffi
+, epoll-shim
 , withDocumentation ? withLibraries && stdenv.hostPlatform == stdenv.buildPlatform
 , graphviz-nox
 , doxygen
@ -24,6 +26,9 @@
 # Documentation is only built when building libraries.
 assert withDocumentation -> withLibraries;

+# Tests are only built when building libraries.
+assert withTests -> withLibraries;
+
 let
  isCross = stdenv.buildPlatform != stdenv.hostPlatform;
 in
@ -50,7 +55,7 @@ stdenv.mkDerivation rec {
  mesonFlags = [
    "-Ddocumentation=${lib.boolToString withDocumentation}"
    "-Dlibraries=${lib.boolToString withLibraries}"
-    "-Dtests=${lib.boolToString withLibraries}"
+    "-Dtests=${lib.boolToString withTests}"
  ];

  depsBuildBuild = [
@ -78,6 +83,8 @@ stdenv.mkDerivation rec {
    libxml2
  ] ++ lib.optionals withLibraries [
    libffi
+  ] ++ lib.optionals (withLibraries && !stdenv.hostPlatform.isLinux) [
+    epoll-shim
  ] ++ lib.optionals withDocumentation [
    docbook_xsl
    docbook_xml_dtd_45
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
  pname = "wayland-protocols";
  version = "1.31";

-  doCheck = stdenv.hostPlatform == stdenv.buildPlatform && wayland.withLibraries;
+  # https://gitlab.freedesktop.org/wayland/wayland-protocols/-/issues/48
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform && stdenv.targetPlatform.linker == "bfd" && wayland.withLibraries;

  src = fetchurl {
    url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@ -625,6 +625,7 @@ final: prev: {
    # These dependencies are required by
    # https://github.com/Automattic/node-canvas.
    buildInputs = with pkgs; [
+      giflib
      pixman
      cairo
      pango
--- a/pkgs/development/ocaml-modules/bls12-381-signature/default.nix
+++ b/pkgs/development/ocaml-modules/bls12-381-signature/default.nix
@ -16,6 +16,8 @@ buildDunePackage rec {
    sha256 = "sha256-KaUpAT+BWxmUP5obi4loR9vVUeQmz3p3zG3CBolUuL4=";
  };

+  duneVersion = "3";
+
  minimalOCamlVersion = "4.08";

  propagatedBuildInputs = [ bls12-381 ];
--- a/pkgs/development/ocaml-modules/bls12-381/default.nix
+++ b/pkgs/development/ocaml-modules/bls12-381/default.nix
@ -14,6 +14,7 @@ buildDunePackage rec {
  };

  minimalOCamlVersion = "4.08";
+  duneVersion = "3";

  propagatedBuildInputs = [
    ff-sig
--- a/pkgs/development/ocaml-modules/bls12-381/gen.nix
+++ b/pkgs/development/ocaml-modules/bls12-381/gen.nix
@ -11,7 +11,7 @@ buildDunePackage rec {
    sha256 = "qocIfQdv9rniOUykRulu2zWsqkzT0OrsGczgVKALRuk=";
  };

-  useDune2 = true;
+  duneVersion = "3";

  minimalOCamlVersion = "4.08";

--- a/pkgs/development/ocaml-modules/bls12-381/legacy.nix
+++ b/pkgs/development/ocaml-modules/bls12-381/legacy.nix
@ -13,7 +13,9 @@
 buildDunePackage rec {
  pname = "bls12-381-legacy";

-  inherit (bls12-381-gen) version src useDune2 doCheck;
+  inherit (bls12-381-gen) version src doCheck;
+
+  duneVersion = "3";

  minimalOCamlVersion = "4.08";

--- a/pkgs/development/ocaml-modules/hex/default.nix
+++ b/pkgs/development/ocaml-modules/hex/default.nix
@ -1,19 +1,18 @@
-{ lib, fetchurl, buildDunePackage, bigarray-compat, cstruct }:
+{ lib, fetchurl, buildDunePackage, cstruct }:

 buildDunePackage rec {
  pname = "hex";
-  version = "1.4.0";
+  version = "1.5.0";

-  useDune2 = true;
-
-  minimumOCamlVersion = "4.02";
+  duneVersion = "3";
+  minimalOCamlVersion = "4.08";

  src = fetchurl {
-    url = "https://github.com/mirage/ocaml-${pname}/releases/download/v${version}/hex-v${version}.tbz";
-    sha256 = "07b9y0lmnflsslkrm6xilkj40n8sf2hjqkyqghnk7sw5l0plkqsp";
+    url = "https://github.com/mirage/ocaml-${pname}/releases/download/v${version}/hex-${version}.tbz";
+    hash = "sha256-LmfuyhsDBJMHowgxtc1pS8stPn8qa0+1l/vbZHNRtNw=";
  };

-  propagatedBuildInputs = [ bigarray-compat cstruct ];
+  propagatedBuildInputs = [ cstruct ];
  doCheck = true;

  meta = {
--- a/pkgs/development/ocaml-modules/ipaddr/cstruct.nix
+++ b/pkgs/development/ocaml-modules/ipaddr/cstruct.nix
@ -7,6 +7,8 @@ buildDunePackage rec {

  inherit (ipaddr) version src;

+  duneVersion = "3";
+
  propagatedBuildInputs = [ ipaddr cstruct ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/ipaddr/default.nix
+++ b/pkgs/development/ocaml-modules/ipaddr/default.nix
@ -1,6 +1,6 @@
 { lib, buildDunePackage
 , macaddr, domain-name, stdlib-shims
-, ounit, ppx_sexp_conv
+, ounit2, ppx_sexp_conv
 }:

 buildDunePackage rec {
@ -8,9 +8,12 @@ buildDunePackage rec {

  inherit (macaddr) version src;

+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
  propagatedBuildInputs = [ macaddr domain-name stdlib-shims ];

-  checkInputs = [ ppx_sexp_conv ounit ];
+  checkInputs = [ ppx_sexp_conv ounit2 ];
  doCheck = true;

  meta = macaddr.meta // {
--- a/pkgs/development/ocaml-modules/ipaddr/sexp.nix
+++ b/pkgs/development/ocaml-modules/ipaddr/sexp.nix
@ -1,5 +1,5 @@
 { lib, buildDunePackage
-, ipaddr, ipaddr-cstruct, ounit, ppx_sexp_conv
+, ipaddr, ipaddr-cstruct, ounit2, ppx_sexp_conv
 }:

 buildDunePackage rec {
@ -7,9 +7,11 @@ buildDunePackage rec {

  inherit (ipaddr) version src;

+  duneVersion = "3";
+
  propagatedBuildInputs = [ ipaddr ];

-  checkInputs = [ ipaddr-cstruct ounit ppx_sexp_conv ];
+  checkInputs = [ ipaddr-cstruct ounit2 ppx_sexp_conv ];
  doCheck = true;

  meta = ipaddr.meta // {
--- a/pkgs/development/ocaml-modules/janestreet/0.15.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.15.nix
@ -254,6 +254,15 @@ with self;
    propagatedBuildInputs = [ async_websocket cohttp-async ppx_jane uri-sexp ];
  };

+  cohttp_static_handler = janePackage {
+    duneVersion = "3";
+    pname = "cohttp_static_handler";
+    version = "0.15.0";
+    hash = "sha256-ENaH8ChvjeMc9WeNIhkeNBB7YK9vB4lw95o6FFZI1ys=";
+    meta.description = "A library for easily creating a cohttp handler for static files";
+    propagatedBuildInputs = [ cohttp-async ];
+  };
+
  core = janePackage {
    pname = "core";
    version = "0.15.1";
--- a/pkgs/development/ocaml-modules/macaddr/cstruct.nix
+++ b/pkgs/development/ocaml-modules/macaddr/cstruct.nix
@ -7,6 +7,8 @@ buildDunePackage {

  inherit (macaddr) version src;

+  duneVersion = "3";
+
  propagatedBuildInputs = [ macaddr cstruct ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/macaddr/default.nix
+++ b/pkgs/development/ocaml-modules/macaddr/default.nix
@ -1,19 +1,20 @@
 { lib, fetchurl, buildDunePackage
-, ppx_sexp_conv, ounit
+, ppx_sexp_conv, ounit2
 }:

 buildDunePackage rec {
  pname = "macaddr";
-  version = "5.3.0";
+  version = "5.4.0";

  minimalOCamlVersion = "4.04";
+  duneVersion = "3";

  src = fetchurl {
    url = "https://github.com/mirage/ocaml-ipaddr/releases/download/v${version}/ipaddr-${version}.tbz";
-    sha256 = "0mdp38mkvk2f5h2q7nb9fc70a8hyssblnl7kam0d8r5lckgrx5rn";
+    hash = "sha256-WmYpG/cQtF9+lVDs1WIievUZ1f7+iZ2hufsdD1HHNeo=";
  };

-  checkInputs = [ ppx_sexp_conv ounit ];
+  checkInputs = [ ppx_sexp_conv ounit2 ];
  doCheck = true;

  meta = with lib; {
--- a/pkgs/development/ocaml-modules/macaddr/sexp.nix
+++ b/pkgs/development/ocaml-modules/macaddr/sexp.nix
@ -1,5 +1,5 @@
 { lib, buildDunePackage
-, macaddr, ppx_sexp_conv, macaddr-cstruct, ounit
+, macaddr, ppx_sexp_conv, macaddr-cstruct, ounit2
 }:

 buildDunePackage {
@ -7,9 +7,11 @@ buildDunePackage {

  inherit (macaddr) version src;

+  duneVersion = "3";
+
  propagatedBuildInputs = [ ppx_sexp_conv ];

-  checkInputs = [ macaddr-cstruct ounit ];
+  checkInputs = [ macaddr-cstruct ounit2 ];
  doCheck = true;

  meta = macaddr.meta // {
--- a/pkgs/development/ocaml-modules/magic-trace/default.nix
+++ b/pkgs/development/ocaml-modules/magic-trace/default.nix
@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub, buildDunePackage, async, cohttp_static_handler
+, core_unix, owee, ppx_jane, shell }:
+
+buildDunePackage rec {
+  pname = "magic-trace";
+  version = "1.1.0";
+
+  minimalOCamlVersion = "4.12";
+  duneVersion = "3";
+
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = "magic-trace";
+    rev = "v${version}";
+    sha256 = "sha256-615AOkrbQI6vRosA5Kz3Epipe9f9+Gs9+g3bVl5gzBY=";
+  };
+
+  buildInputs = [ async cohttp_static_handler core_unix owee ppx_jane shell ];
+
+  meta = with lib; {
+    description =
+      "Collects and displays high-resolution traces of what a process is doing";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/janestreet/magic-trace";
+  };
+}
--- a/pkgs/development/ocaml-modules/mirage-logs/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-logs/default.nix
@ -1,20 +1,20 @@
 { lib, fetchurl, buildDunePackage
-, logs, lwt, mirage-clock, mirage-profile, ptime
-, alcotest, stdlib-shims
+, logs, lwt, mirage-clock, ptime
+, alcotest
 }:

 buildDunePackage rec {
  pname = "mirage-logs";
-  version = "1.2.0";
+  version = "1.3.0";

-  useDune2 = true;
+  duneVersion = "3";

  src = fetchurl {
-    url = "https://github.com/mirage/mirage-logs/releases/download/v${version}/mirage-logs-v${version}.tbz";
-    sha256 = "0h0amzjxy067jljscib7fvw5q8k0adqa8m86affha9hq5jsh07a1";
+    url = "https://github.com/mirage/mirage-logs/releases/download/v${version}/mirage-logs-${version}.tbz";
+    hash = "sha256-c1YQIutqp58TRz+a9Vd/69FCv0jnGRvFnei9BtSbOxA=";
  };

-  propagatedBuildInputs = [ logs lwt mirage-clock mirage-profile ptime stdlib-shims ];
+  propagatedBuildInputs = [ logs lwt mirage-clock ptime ];

  doCheck = true;
  checkInputs = [ alcotest ];
--- a/pkgs/development/ocaml-modules/mirage-net/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-net/default.nix
@ -6,11 +6,11 @@ buildDunePackage rec {
  pname = "mirage-net";
  version = "4.0.0";

-  useDune2 = true;
+  duneVersion = "3";

  src = fetchurl {
    url = "https://github.com/mirage/mirage-net/releases/download/v${version}/mirage-net-v${version}.tbz";
-    sha256 = "sha256-Zo7/0Ye4GgqzJFCHDBXbuJ/5ETl/8ziolRgH4lDhlM4=";
+    hash = "sha256-Zo7/0Ye4GgqzJFCHDBXbuJ/5ETl/8ziolRgH4lDhlM4=";
  };

  propagatedBuildInputs = [ cstruct fmt lwt macaddr mirage-device ];
--- a/pkgs/development/ocaml-modules/mirage-profile/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-profile/default.nix
@ -7,7 +7,7 @@ buildDunePackage rec {
  pname = "mirage-profile";
  version = "0.9.1";

-  useDune2 = true;
+  duneVersion = "3";

  src = fetchurl {
    url = "https://github.com/mirage/mirage-profile/releases/download/v${version}/mirage-profile-v${version}.tbz";
--- a/pkgs/development/ocaml-modules/mirage/runtime.nix
+++ b/pkgs/development/ocaml-modules/mirage/runtime.nix
@ -8,6 +8,7 @@ buildDunePackage rec {
  inherit (functoria-runtime) src version;

  minimalOCamlVersion = "4.08";
+  duneVersion = "3";

  propagatedBuildInputs = [ ipaddr functoria-runtime fmt logs lwt ];
  checkInputs = [ alcotest ];
--- a/pkgs/development/ocaml-modules/owee/default.nix
+++ b/pkgs/development/ocaml-modules/owee/default.nix
@ -2,19 +2,20 @@

 buildDunePackage rec {
  minimalOCamlVersion = "4.06";
-  useDune2 = true;
+  duneVersion = "2";
  pname = "owee";
-  version = "0.4";
+  version = "0.6";

  src = fetchurl {
-    url = "https://github.com/let-def/owee/releases/download/v${version}/owee-${version}.tbz";
-    sha256 = "sha256:055bi0yfdki1pqagbhrwmfvigyawjgsmqw04zhpp6hds8513qzvb";
+    url =
+      "https://github.com/let-def/owee/releases/download/v${version}/owee-${version}.tbz";
+    sha256 = "sha256-GwXV5t4GYbDiGwyvQyW8NZoYvn4qXlLnjX331Bj1wjM=";
  };

-  meta = {
+  meta = with lib; {
    description = "An experimental OCaml library to work with DWARF format";
    homepage = "https://github.com/let-def/owee/";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.vbgl ];
+    license = licenses.mit;
+    maintainers = with maintainers; [ vbgl alizter ];
  };
 }
--- a/pkgs/development/ocaml-modules/shared-memory-ring/default.nix
+++ b/pkgs/development/ocaml-modules/shared-memory-ring/default.nix
@ -2,19 +2,20 @@
 , buildDunePackage
 , fetchurl
 , ppx_cstruct
-, mirage-profile
 , cstruct
+, lwt
 , ounit
-, stdlib-shims
 }:

 buildDunePackage rec {
  pname = "shared-memory-ring";
  version = "3.1.1";

+  duneVersion = "3";
+
  src = fetchurl {
    url = "https://github.com/mirage/shared-memory-ring/releases/download/v${version}/shared-memory-ring-${version}.tbz";
-    sha256 = "sha256-KW8grij/OAnFkdUdRRZF21X39DvqayzkTWeRKwF8uoU=";
+    hash = "sha256-KW8grij/OAnFkdUdRRZF21X39DvqayzkTWeRKwF8uoU=";
  };

  buildInputs = [
@ -22,13 +23,12 @@ buildDunePackage rec {
  ];

  propagatedBuildInputs = [
-    mirage-profile
    cstruct
-    stdlib-shims
  ];

  doCheck = true;
  checkInputs = [
+    lwt
    ounit
  ];

--- a/pkgs/development/ocaml-modules/shared-memory-ring/lwt.nix
+++ b/pkgs/development/ocaml-modules/shared-memory-ring/lwt.nix
@ -14,6 +14,8 @@ buildDunePackage {

  inherit (shared-memory-ring) version src;

+  duneVersion = "3";
+
  buildInputs = [
    ppx_cstruct
  ];
--- a/pkgs/development/ocaml-modules/spacetime_lib/default.nix
+++ b/pkgs/development/ocaml-modules/spacetime_lib/default.nix
@ -6,8 +6,7 @@ lib.throwIfNot (lib.versionAtLeast "4.12" ocaml.version)
 buildDunePackage rec {
  pname = "spacetime_lib";
  version = "0.3.0";
-
-  useDune2 = true;
+  duneVersion = "2";

  src = fetchFromGitHub {
    owner = "lpw25";
@ -16,6 +15,8 @@ buildDunePackage rec {
    sha256 = "0biisgbycr5v3nm5jp8i0h6vq76vzasdjkcgh8yr7fhxc81jgv3p";
  };

+  patches = [ ./spacetime.diff ];
+
  propagatedBuildInputs = [ owee ];

  preConfigure = ''
--- a/pkgs/development/ocaml-modules/spacetime_lib/spacetime.diff
+++ b/pkgs/development/ocaml-modules/spacetime_lib/spacetime.diff
@ -0,0 +1,14 @@
+diff --git a/src/elf_locations.ml b/src/elf_locations.ml
+index a08b359..0db9274 100644
+--- a/src/elf_locations.ml
+++ b/src/elf_locations.ml
+@@ -37,7 +37,8 @@ let resolve_from_dwarf t ~program_counter =
+     | Some section ->
+       let body = Owee_buf.cursor (Owee_elf.section_body t.map section) in
+       let rec aux () =
+-        match Owee_debug_line.read_chunk body with
+        let pointers_to_other_sections = Owee_elf.debug_line_pointers t.map t.sections in
+        match Owee_debug_line.read_chunk body ~pointers_to_other_sections with
+         | None -> ()
+         | Some (header, chunk) ->
+           (* CR-soon mshinwell: fix owee .mli to note that [state] is
--- a/pkgs/development/ocaml-modules/tuntap/default.nix
+++ b/pkgs/development/ocaml-modules/tuntap/default.nix
@ -6,9 +6,9 @@ buildDunePackage rec {
  pname = "tuntap";
  version = "2.0.0";

-  useDune2 = true;
+  duneVersion = "3";

-  minimumOCamlVersion = "4.04.2";
+  minimalOCamlVersion = "4.04.2";

  src = fetchurl {
    url = "https://github.com/mirage/ocaml-tuntap/releases/download/v${version}/tuntap-v${version}.tbz";
--- a/pkgs/development/octave-modules/arduino/default.nix
+++ b/pkgs/development/octave-modules/arduino/default.nix
@ -7,11 +7,11 @@

 buildOctavePackage rec {
  pname = "arduino";
-  version = "0.7.0";
+  version = "0.10.0";

  src = fetchurl {
    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0r0bcq2zkwba6ab6yi6czbhrj4adm9m9ggxmzzcd9h40ckqg6wjv";
+    sha256 = "sha256-p9SDTXkIwnrkNXeVhzAHks7EL4NdwBokrH2j9hqAJqQ=";
  };

  requiredOctavePackages = [
--- a/pkgs/development/octave-modules/audio/default.nix
+++ b/pkgs/development/octave-modules/audio/default.nix
@ -9,11 +9,11 @@

 buildOctavePackage rec {
  pname = "audio";
-  version = "2.0.3";
+  version = "2.0.5";

  src = fetchurl {
    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1431pf7mhxsrnzrx8r3hsy537kha7jhaligmp2rghwyxhq25hs0r";
+    sha256 = "sha256-/4akeeOQnvTlk9ah+e8RJfwJG2Eq2HAGOCejhiIUjF4=";
  };

  nativeBuildInputs = [
--- a/Show more
+++ b/Show more