Merge branch 'master' into staging-next

The java conflicts weren't trivial. Hopefully OK.
2022-09-19 07:35:50 +02:00 · 2022-09-19 07:35:50 +02:00 · a5dfac88d5
parent eeb9911827 6aa1694dd2
commit a5dfac88d5
64 changed files with 4734 additions and 573 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -13420,6 +13420,12 @@
    githubId = 1292007;
    name = "Sébastien Maccagnoni";
  };
+  tirex = {
+    email = "szymon@kliniewski.pl";
+    name = "Szymon Kliniewski";
+    github = "NoneTirex";
+    githubId = 26038207;
+  };
  titanous = {
    email = "jonathan@titanous.com";
    github = "titanous";
--- a/pkgs/applications/blockchains/erigon.nix
+++ b/pkgs/applications/blockchains/erigon.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "erigon";
-  version = "2022.09.01";
+  version = "2022.09.02";

  src = fetchFromGitHub {
    owner = "ledgerwatch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-vcppzHJ6yLIqp/5Gl9JIgkTVR1mKKAj1vhWY/bCvbPQ=";
+    sha256 = "sha256-ZLR6xdl3ckady+drYtN/kKK9xSRZ6jcWIxEQwN87MeU=";
    fetchSubmodules = true;
  };

-  vendorSha256 = "sha256-mY8m5bXm09pmq1imCo8uiBBnzPzrVuka8XtZyxL9LWo=";
+  vendorSha256 = "sha256-yUvz5ZrCegA69H0NDZfU9Yi97ljk4swnzPHJZ5Dl4Qs=";
  proxyVendor = true;

  # Build errors in mdbx when format hardening is enabled:
@ -30,6 +30,6 @@ buildGoModule rec {
    homepage = "https://github.com/ledgerwatch/erigon/";
    description = "Ethereum node implementation focused on scalability and modularity";
    license = with licenses; [ lgpl3Plus gpl3Plus ];
-    maintainers = with maintainers; [ d-xo ];
+    maintainers = with maintainers; [ d-xo happysalada ];
  };
 }
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@ -222,4 +222,44 @@ rec {
    export HOME=$TMPDIR
    ${nvimWithLuaPackages}/bin/nvim -i NONE --noplugin -es
  '';
+
+  # nixpkgs should install optional packages in the opt folder
+  nvim_with_opt_plugin = neovim.override {
+    extraName = "-with-opt-plugin";
+    configure.packages.opt-plugins = with pkgs.vimPlugins; {
+      opt = [
+        (dashboard-nvim.overrideAttrs(old: { pname = old.pname + "-unique-for-tests-please-dont-use-opt"; }))
+      ];
+    };
+    configure.customRC = ''
+      " Load all autoloaded plugins
+      packloadall
+
+      " Try to run Dashboard, and throw if it succeeds
+      try
+        Dashboard
+        echo "Dashboard found, throwing error"
+        cquit 1
+      catch /^Vim\%((\a\+)\)\=:E492/
+        echo "Dashboard not found"
+      endtry
+
+      " Load Dashboard as an optional
+      packadd dashboard-nvim-unique-for-tests-please-dont-use-opt
+
+      " Try to run Dashboard again, and throw if it fails
+      try
+        Dashboard
+        echo "Dashboard found"
+      catch /^Vim\%((\a\+)\)\=:E492/
+        echo "Dashboard not found, throwing error"
+        cquit 1
+      endtry
+    '';
+  };
+
+  run_nvim_with_opt_plugin = runTest nvim_with_opt_plugin ''
+    export HOME=$TMPDIR
+    ${nvim_with_opt_plugin}/bin/nvim -i NONE +quit! -e
+  '';
 })
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@ -170,8 +170,8 @@ let
          throw "The neovim legacy wrapper doesn't support configure.plug anymore, please setup your plugins via 'configure.packages' instead"
        else
          lib.flatten (lib.mapAttrsToList genPlugin (configure.packages or {}));
-      genPlugin = packageName: {start ? [], opt?[]}:
-        start ++ opt;
+      genPlugin = packageName: {start ? [], opt ? []}:
+        start ++ (map (p: { plugin = p; optional = true; }) opt);

      res = makeNeovimConfig {
        inherit withPython3;
--- a/pkgs/applications/editors/sublime/4/common.nix
+++ b/pkgs/applications/editors/sublime/4/common.nix
@ -116,7 +116,7 @@ in stdenv.mkDerivation (rec {
    makeWrapper "''$${primaryBinary}/${primaryBinary}" "$out/bin/${primaryBinary}"
  '' + builtins.concatStringsSep "" (map (binaryAlias: "ln -s $out/bin/${primaryBinary} $out/bin/${binaryAlias}\n") primaryBinaryAliases) + ''
    mkdir -p "$out/share/applications"
-    substitute "''$${primaryBinary}/${primaryBinary}.desktop" "$out/share/applications/${primaryBinary}.desktop" --replace "/opt/${primaryBinary}/${primaryBinary}" "$out/bin/${primaryBinary}"
+    substitute "''$${primaryBinary}/${primaryBinary}.desktop" "$out/share/applications/${primaryBinary}.desktop" --replace "/opt/${primaryBinary}/${primaryBinary}" "${primaryBinary}"
    for directory in ''$${primaryBinary}/Icon/*; do
      size=$(basename $directory)
      mkdir -p "$out/share/icons/hicolor/$size/apps"
--- a/pkgs/applications/editors/sublime/4/packages.nix
+++ b/pkgs/applications/editors/sublime/4/packages.nix
@ -11,9 +11,9 @@ in
    } {};

    sublime4-dev = common {
-      buildVersion = "4134";
+      buildVersion = "4136";
      dev = true;
-      x64sha256 = "rd3EG8e13FsPKihSM9qjUMRsEA6joMwVqhj1NZlwIaE=";
-      aarch64sha256 = "gdfEDd2E1sew08sVmcmw21zyil8JuJJMpG2T/9Pi81E=";
+      x64sha256 = "6cSaF8seS3XpXpoaROO5tpVuwJzE+z1kzwxNlOUadj0=";
+      aarch64sha256 = "Mtib8i29FCFutRXmWPQSp9h/FcLD7+wv+tGAjwf9d3w=";
    } {};
  }
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -245,12 +245,12 @@ final: prev:

  Recover-vim = buildVimPluginFrom2Nix {
    pname = "Recover.vim";
-    version = "2015-08-14";
+    version = "2022-09-07";
    src = fetchFromGitHub {
      owner = "chrisbra";
      repo = "Recover.vim";
-      rev = "efa491f6121f65e025f42d79a93081abb8db69d4";
-      sha256 = "17szim82bwnhf9q4n0n4jfmqkmhq6p0lh0j4y77a2x6lkn0pns5s";
+      rev = "e61319bce3cd1004e5b695933296d8f267dd65a3";
+      sha256 = "0hnww4a0vffgpj72qdhhsr28xdh219haldr6jd6my8mqy1rg3yq4";
    };
    meta.homepage = "https://github.com/chrisbra/Recover.vim/";
  };
@ -4149,6 +4149,18 @@ final: prev:
    meta.homepage = "https://github.com/lukas-reineke/lsp-format.nvim/";
  };

+  lsp-overloads-nvim = buildVimPluginFrom2Nix {
+    pname = "lsp-overloads.nvim";
+    version = "2022-08-12";
+    src = fetchFromGitHub {
+      owner = "Issafalcon";
+      repo = "lsp-overloads.nvim";
+      rev = "1258bfa3e21f5665b7a2c6c9b921a2ad8d8d8373";
+      sha256 = "146pykcnpf9b8c4mqvs1q4wnp5jqg8i21as3gvjygwm5b71lxbky";
+    };
+    meta.homepage = "https://github.com/Issafalcon/lsp-overloads.nvim/";
+  };
+
  lsp-rooter-nvim = buildVimPluginFrom2Nix {
    pname = "lsp-rooter.nvim";
    version = "2021-08-13";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -347,6 +347,7 @@ https://github.com/ldelossa/litee-symboltree.nvim/,,
 https://github.com/ldelossa/litee.nvim/,,
 https://github.com/folke/lsp-colors.nvim/,,
 https://github.com/lukas-reineke/lsp-format.nvim/,HEAD,
+https://github.com/Issafalcon/lsp-overloads.nvim/,main,
 https://github.com/ahmedkhalf/lsp-rooter.nvim/,,
 https://github.com/nvim-lua/lsp-status.nvim/,,
 https://github.com/nvim-lua/lsp_extensions.nvim/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -8,6 +8,7 @@
 , python3Packages
 , jdk
 , llvmPackages_8
+, llvmPackages_14
 , nixpkgs-fmt
 , protobuf
 , jq
@ -2551,7 +2552,7 @@ let
        };
      };

-      vadimcn.vscode-lldb = callPackage ./vscode-lldb { };
+      vadimcn.vscode-lldb = callPackage ./vscode-lldb { llvmPackages = llvmPackages_14; };

      valentjn.vscode-ltex = vscode-utils.buildVscodeMarketplaceExtension rec {
        mktplcRef = {
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/default.nix
@ -0,0 +1,17 @@
+# This file has been generated by node2nix 1.11.1. Do not edit!
+
+{pkgs ? import <nixpkgs> {
+    inherit system;
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-14_x"}:
+
+let
+  nodeEnv = import ./node-env.nix {
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
+    inherit pkgs nodejs;
+    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
+  };
+in
+import ./node-packages.nix {
+  inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
+  inherit nodeEnv;
+}
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/node-env.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/node-env.nix
@ -0,0 +1,598 @@
+# This file originates from node2nix
+
+{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:
+
+let
+  # Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
+  utillinux = if pkgs ? utillinux then pkgs.utillinux else pkgs.util-linux;
+
+  python = if nodejs ? python then nodejs.python else python2;
+
+  # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
+  tarWrapper = runCommand "tarWrapper" {} ''
+    mkdir -p $out/bin
+
+    cat > $out/bin/tar <<EOF
+    #! ${stdenv.shell} -e
+    $(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
+    EOF
+
+    chmod +x $out/bin/tar
+  '';
+
+  # Function that generates a TGZ file from a NPM project
+  buildNodeSourceDist =
+    { name, version, src, ... }:
+
+    stdenv.mkDerivation {
+      name = "node-tarball-${name}-${version}";
+      inherit src;
+      buildInputs = [ nodejs ];
+      buildPhase = ''
+        export HOME=$TMPDIR
+        tgzFile=$(npm pack | tail -n 1) # Hooks to the pack command will add output (https://docs.npmjs.com/misc/scripts)
+      '';
+      installPhase = ''
+        mkdir -p $out/tarballs
+        mv $tgzFile $out/tarballs
+        mkdir -p $out/nix-support
+        echo "file source-dist $out/tarballs/$tgzFile" >> $out/nix-support/hydra-build-products
+      '';
+    };
+
+  # Common shell logic
+  installPackage = writeShellScript "install-package" ''
+    installPackage() {
+      local packageName=$1 src=$2
+
+      local strippedName
+
+      local DIR=$PWD
+      cd $TMPDIR
+
+      unpackFile $src
+
+      # Make the base dir in which the target dependency resides first
+      mkdir -p "$(dirname "$DIR/$packageName")"
+
+      if [ -f "$src" ]
+      then
+          # Figure out what directory has been unpacked
+          packageDir="$(find . -maxdepth 1 -type d | tail -1)"
+
+          # Restore write permissions to make building work
+          find "$packageDir" -type d -exec chmod u+x {} \;
+          chmod -R u+w "$packageDir"
+
+          # Move the extracted tarball into the output folder
+          mv "$packageDir" "$DIR/$packageName"
+      elif [ -d "$src" ]
+      then
+          # Get a stripped name (without hash) of the source directory.
+          # On old nixpkgs it's already set internally.
+          if [ -z "$strippedName" ]
+          then
+              strippedName="$(stripHash $src)"
+          fi
+
+          # Restore write permissions to make building work
+          chmod -R u+w "$strippedName"
+
+          # Move the extracted directory into the output folder
+          mv "$strippedName" "$DIR/$packageName"
+      fi
+
+      # Change to the package directory to install dependencies
+      cd "$DIR/$packageName"
+    }
+  '';
+
+  # Bundle the dependencies of the package
+  #
+  # Only include dependencies if they don't exist. They may also be bundled in the package.
+  includeDependencies = {dependencies}:
+    lib.optionalString (dependencies != []) (
+      ''
+        mkdir -p node_modules
+        cd node_modules
+      ''
+      + (lib.concatMapStrings (dependency:
+        ''
+          if [ ! -e "${dependency.packageName}" ]; then
+              ${composePackage dependency}
+          fi
+        ''
+      ) dependencies)
+      + ''
+        cd ..
+      ''
+    );
+
+  # Recursively composes the dependencies of a package
+  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
+    builtins.addErrorContext "while evaluating node package '${packageName}'" ''
+      installPackage "${packageName}" "${src}"
+      ${includeDependencies { inherit dependencies; }}
+      cd ..
+      ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+    '';
+
+  pinpointDependencies = {dependencies, production}:
+    let
+      pinpointDependenciesFromPackageJSON = writeTextFile {
+        name = "pinpointDependencies.js";
+        text = ''
+          var fs = require('fs');
+          var path = require('path');
+
+          function resolveDependencyVersion(location, name) {
+              if(location == process.env['NIX_STORE']) {
+                  return null;
+              } else {
+                  var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json");
+
+                  if(fs.existsSync(dependencyPackageJSON)) {
+                      var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON));
+
+                      if(dependencyPackageObj.name == name) {
+                          return dependencyPackageObj.version;
+                      }
+                  } else {
+                      return resolveDependencyVersion(path.resolve(location, ".."), name);
+                  }
+              }
+          }
+
+          function replaceDependencies(dependencies) {
+              if(typeof dependencies == "object" && dependencies !== null) {
+                  for(var dependency in dependencies) {
+                      var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency);
+
+                      if(resolvedVersion === null) {
+                          process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n");
+                      } else {
+                          dependencies[dependency] = resolvedVersion;
+                      }
+                  }
+              }
+          }
+
+          /* Read the package.json configuration */
+          var packageObj = JSON.parse(fs.readFileSync('./package.json'));
+
+          /* Pinpoint all dependencies */
+          replaceDependencies(packageObj.dependencies);
+          if(process.argv[2] == "development") {
+              replaceDependencies(packageObj.devDependencies);
+          }
+          replaceDependencies(packageObj.optionalDependencies);
+
+          /* Write the fixed package.json file */
+          fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
+        '';
+      };
+    in
+    ''
+      node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"}
+
+      ${lib.optionalString (dependencies != [])
+        ''
+          if [ -d node_modules ]
+          then
+              cd node_modules
+              ${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
+              cd ..
+          fi
+        ''}
+    '';
+
+  # Recursively traverses all dependencies of a package and pinpoints all
+  # dependencies in the package.json file to the versions that are actually
+  # being used.
+
+  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
+    ''
+      if [ -d "${packageName}" ]
+      then
+          cd "${packageName}"
+          ${pinpointDependencies { inherit dependencies production; }}
+          cd ..
+          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+      fi
+    '';
+
+  # Extract the Node.js source code which is used to compile packages with
+  # native bindings
+  nodeSources = runCommand "node-sources" {} ''
+    tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
+    mv node-* $out
+  '';
+
+  # Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty)
+  addIntegrityFieldsScript = writeTextFile {
+    name = "addintegrityfields.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      function augmentDependencies(baseDir, dependencies) {
+          for(var dependencyName in dependencies) {
+              var dependency = dependencies[dependencyName];
+
+              // Open package.json and augment metadata fields
+              var packageJSONDir = path.join(baseDir, "node_modules", dependencyName);
+              var packageJSONPath = path.join(packageJSONDir, "package.json");
+
+              if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored
+                  console.log("Adding metadata fields to: "+packageJSONPath);
+                  var packageObj = JSON.parse(fs.readFileSync(packageJSONPath));
+
+                  if(dependency.integrity) {
+                      packageObj["_integrity"] = dependency.integrity;
+                  } else {
+                      packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
+                  }
+
+                  if(dependency.resolved) {
+                      packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
+                  } else {
+                      packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
+                  }
+
+                  if(dependency.from !== undefined) { // Adopt from property if one has been provided
+                      packageObj["_from"] = dependency.from;
+                  }
+
+                  fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
+              }
+
+              // Augment transitive dependencies
+              if(dependency.dependencies !== undefined) {
+                  augmentDependencies(packageJSONDir, dependency.dependencies);
+              }
+          }
+      }
+
+      if(fs.existsSync("./package-lock.json")) {
+          var packageLock = JSON.parse(fs.readFileSync("./package-lock.json"));
+
+          if(![1, 2].includes(packageLock.lockfileVersion)) {
+            process.stderr.write("Sorry, I only understand lock file versions 1 and 2!\n");
+            process.exit(1);
+          }
+
+          if(packageLock.dependencies !== undefined) {
+              augmentDependencies(".", packageLock.dependencies);
+          }
+      }
+    '';
+  };
+
+  # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
+  reconstructPackageLock = writeTextFile {
+    name = "addintegrityfields.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      var packageObj = JSON.parse(fs.readFileSync("package.json"));
+
+      var lockObj = {
+          name: packageObj.name,
+          version: packageObj.version,
+          lockfileVersion: 1,
+          requires: true,
+          dependencies: {}
+      };
+
+      function augmentPackageJSON(filePath, dependencies) {
+          var packageJSON = path.join(filePath, "package.json");
+          if(fs.existsSync(packageJSON)) {
+              var packageObj = JSON.parse(fs.readFileSync(packageJSON));
+              dependencies[packageObj.name] = {
+                  version: packageObj.version,
+                  integrity: "sha1-000000000000000000000000000=",
+                  dependencies: {}
+              };
+              processDependencies(path.join(filePath, "node_modules"), dependencies[packageObj.name].dependencies);
+          }
+      }
+
+      function processDependencies(dir, dependencies) {
+          if(fs.existsSync(dir)) {
+              var files = fs.readdirSync(dir);
+
+              files.forEach(function(entry) {
+                  var filePath = path.join(dir, entry);
+                  var stats = fs.statSync(filePath);
+
+                  if(stats.isDirectory()) {
+                      if(entry.substr(0, 1) == "@") {
+                          // When we encounter a namespace folder, augment all packages belonging to the scope
+                          var pkgFiles = fs.readdirSync(filePath);
+
+                          pkgFiles.forEach(function(entry) {
+                              if(stats.isDirectory()) {
+                                  var pkgFilePath = path.join(filePath, entry);
+                                  augmentPackageJSON(pkgFilePath, dependencies);
+                              }
+                          });
+                      } else {
+                          augmentPackageJSON(filePath, dependencies);
+                      }
+                  }
+              });
+          }
+      }
+
+      processDependencies("node_modules", lockObj.dependencies);
+
+      fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
+    '';
+  };
+
+  prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
+    let
+      forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
+    in
+    ''
+        # Pinpoint the versions of all dependencies to the ones that are actually being used
+        echo "pinpointing versions of dependencies..."
+        source $pinpointDependenciesScriptPath
+
+        # Patch the shebangs of the bundled modules to prevent them from
+        # calling executables outside the Nix store as much as possible
+        patchShebangs .
+
+        # Deploy the Node.js package by running npm install. Since the
+        # dependencies have been provided already by ourselves, it should not
+        # attempt to install them again, which is good, because we want to make
+        # it Nix's responsibility. If it needs to install any dependencies
+        # anyway (e.g. because the dependency parameters are
+        # incomplete/incorrect), it fails.
+        #
+        # The other responsibilities of NPM are kept -- version checks, build
+        # steps, postprocessing etc.
+
+        export HOME=$TMPDIR
+        cd "${packageName}"
+        runHook preRebuild
+
+        ${lib.optionalString bypassCache ''
+          ${lib.optionalString reconstructLock ''
+            if [ -f package-lock.json ]
+            then
+                echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
+                echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
+                rm package-lock.json
+            else
+                echo "No package-lock.json file found, reconstructing..."
+            fi
+
+            node ${reconstructPackageLock}
+          ''}
+
+          node ${addIntegrityFieldsScript}
+        ''}
+
+        npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild
+
+        if [ "''${dontNpmInstall-}" != "1" ]
+        then
+            # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
+            rm -f npm-shrinkwrap.json
+
+            npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} install
+        fi
+    '';
+
+  # Builds and composes an NPM package including all its dependencies
+  buildNodePackage =
+    { name
+    , packageName
+    , version ? null
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , preRebuild ? ""
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , meta ? {}
+    , ... }@args:
+
+    let
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
+    in
+    stdenv.mkDerivation ({
+      name = "${name}${if version == null then "" else "-${version}"}";
+      buildInputs = [ tarWrapper python nodejs ]
+        ++ lib.optional (stdenv.isLinux) utillinux
+        ++ lib.optional (stdenv.isDarwin) libtool
+        ++ buildInputs;
+
+      inherit nodejs;
+
+      inherit dontStrip; # Stripping may fail a build for some package deployments
+      inherit dontNpmInstall preRebuild unpackPhase buildPhase;
+
+      compositionScript = composePackage args;
+      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
+
+      installPhase = ''
+        source ${installPackage}
+
+        # Create and enter a root node_modules/ folder
+        mkdir -p $out/lib/node_modules
+        cd $out/lib/node_modules
+
+        # Compose the package and all its dependencies
+        source $compositionScriptPath
+
+        ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
+
+        # Create symlink to the deployed executable folder, if applicable
+        if [ -d "$out/lib/node_modules/.bin" ]
+        then
+            ln -s $out/lib/node_modules/.bin $out/bin
+
+            # Patch the shebang lines of all the executables
+            ls $out/bin/* | while read i
+            do
+                file="$(readlink -f "$i")"
+                chmod u+rwx "$file"
+                patchShebangs "$file"
+            done
+        fi
+
+        # Create symlinks to the deployed manual page folders, if applicable
+        if [ -d "$out/lib/node_modules/${packageName}/man" ]
+        then
+            mkdir -p $out/share
+            for dir in "$out/lib/node_modules/${packageName}/man/"*
+            do
+                mkdir -p $out/share/man/$(basename "$dir")
+                for page in "$dir"/*
+                do
+                    ln -s $page $out/share/man/$(basename "$dir")
+                done
+            done
+        fi
+
+        # Run post install hook, if provided
+        runHook postInstall
+      '';
+
+      meta = {
+        # default to Node.js' platforms
+        platforms = nodejs.meta.platforms;
+      } // meta;
+    } // extraArgs);
+
+  # Builds a node environment (a node_modules folder and a set of binaries)
+  buildNodeDependencies =
+    { name
+    , packageName
+    , version ? null
+    , src
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , ... }@args:
+
+    let
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
+    in
+      stdenv.mkDerivation ({
+        name = "node-dependencies-${name}${if version == null then "" else "-${version}"}";
+
+        buildInputs = [ tarWrapper python nodejs ]
+          ++ lib.optional (stdenv.isLinux) utillinux
+          ++ lib.optional (stdenv.isDarwin) libtool
+          ++ buildInputs;
+
+        inherit dontStrip; # Stripping may fail a build for some package deployments
+        inherit dontNpmInstall unpackPhase buildPhase;
+
+        includeScript = includeDependencies { inherit dependencies; };
+        pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+        passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
+
+        installPhase = ''
+          source ${installPackage}
+
+          mkdir -p $out/${packageName}
+          cd $out/${packageName}
+
+          source $includeScriptPath
+
+          # Create fake package.json to make the npm commands work properly
+          cp ${src}/package.json .
+          chmod 644 package.json
+          ${lib.optionalString bypassCache ''
+            if [ -f ${src}/package-lock.json ]
+            then
+                cp ${src}/package-lock.json .
+                chmod 644 package-lock.json
+            fi
+          ''}
+
+          # Go to the parent folder to make sure that all packages are pinpointed
+          cd ..
+          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+
+          ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
+
+          # Expose the executables that were installed
+          cd ..
+          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+
+          mv ${packageName} lib
+          ln -s $out/lib/node_modules/.bin $out/bin
+        '';
+      } // extraArgs);
+
+  # Builds a development shell
+  buildNodeShell =
+    { name
+    , packageName
+    , version ? null
+    , src
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , ... }@args:
+
+    let
+      nodeDependencies = buildNodeDependencies args;
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "unpackPhase" "buildPhase" ];
+    in
+    stdenv.mkDerivation ({
+      name = "node-shell-${name}${if version == null then "" else "-${version}"}";
+
+      buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) utillinux ++ buildInputs;
+      buildCommand = ''
+        mkdir -p $out/bin
+        cat > $out/bin/shell <<EOF
+        #! ${stdenv.shell} -e
+        $shellHook
+        exec ${stdenv.shell}
+        EOF
+        chmod +x $out/bin/shell
+      '';
+
+      # Provide the dependencies in a development shell through the NODE_PATH environment variable
+      inherit nodeDependencies;
+      shellHook = lib.optionalString (dependencies != []) ''
+        export NODE_PATH=${nodeDependencies}/lib/node_modules
+        export PATH="${nodeDependencies}/bin:$PATH"
+      '';
+    } // extraArgs);
+in
+{
+  buildNodeSourceDist = lib.makeOverridable buildNodeSourceDist;
+  buildNodePackage = lib.makeOverridable buildNodePackage;
+  buildNodeDependencies = lib.makeOverridable buildNodeDependencies;
+  buildNodeShell = lib.makeOverridable buildNodeShell;
+}
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/node-packages.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/node-packages.nix
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/package.json
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/package.json
@ -1,23 +0,0 @@
-{
-  "name": "vscode-lldb",
-  "version": "1.6.8",
-  "dependencies": {
-    "string-argv": "^0.3.1",
-    "yaml": "^1.10.0",
-    "yauzl": "^2.10.0",
-    "@types/vscode": "^1.31.0",
-    "@types/node": "^8.10.50",
-    "@types/mocha": "^7.0.1",
-    "@types/yauzl": "^2.9.0",
-    "typescript": "^4.2.4",
-    "mocha": "^8.4.0",
-    "source-map-support": "^0.5.12",
-    "memory-streams": "^0.1.3",
-    "vscode-debugprotocol": "^1.47.0",
-    "vscode-debugadapter-testsupport": "^1.47.0",
-    "vsce": "=1.88.0",
-    "webpack": "^5.37.1",
-    "webpack-cli": "^4.7.0",
-    "ts-loader": "^8.0.0"
-  }
-}
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/cmake-build-extension-only.patch
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/cmake-build-extension-only.patch
@ -1,5 +1,5 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 37745b5..cad11a0 100644
+index 6ae4dfb..519f544 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
@@ -16,13 +16,6 @@ endif()
@ -13,10 +13,10 @@ index 37745b5..cad11a0 100644
 -    message(FATAL_ERROR "LLDB_PACKAGE not set." )
 -endif()
 -
- set(TEST_TIMEOUT 5000 CACHE STRING "Test timeout [ms]")
- 
- # General OS-specific definitions
-@@ -87,16 +80,6 @@ configure_file(package.json ${CMAKE_CURRENT_BINARY_DIR}/package.json @ONLY)
+ if (CMAKE_SYSROOT)
+     set(CMAKE_C_FLAGS "--sysroot=${CMAKE_SYSROOT} ${CMAKE_C_FLAGS}")
+     set(CMAKE_CXX_FLAGS "--sysroot=${CMAKE_SYSROOT} ${CMAKE_CXX_FLAGS}")
+@@ -93,16 +86,6 @@ configure_file(package.json ${CMAKE_CURRENT_BINARY_DIR}/package.json @ONLY)
 configure_file(webpack.config.js ${CMAKE_CURRENT_BINARY_DIR}/webpack.config.js @ONLY)
 file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/package-lock.json DESTINATION ${CMAKE_CURRENT_BINARY_DIR})
 
@ -33,4 +33,20 @@ index 37745b5..cad11a0 100644
 # Copy it back, so we can commit the lock file.
 file(COPY ${CMAKE_CURRENT_BINARY_DIR}/package-lock.json DESTINATION ${CMAKE_CURRENT_SOURCE_DIR})
 
+@@ -154,6 +137,7 @@ add_custom_target(tests
+ 
+ add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/README.md ${CMAKE_CURRENT_BINARY_DIR}/README.md)
+ add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/CHANGELOG.md ${CMAKE_CURRENT_BINARY_DIR}/CHANGELOG.md)
+add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/LICENSE ${CMAKE_CURRENT_BINARY_DIR}/LICENSE)
+ add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/images/lldb.png ${CMAKE_CURRENT_BINARY_DIR}/images/lldb.png)
+ add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/images/user.svg ${CMAKE_CURRENT_BINARY_DIR}/images/user.svg)
+ add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/images/users.svg ${CMAKE_CURRENT_BINARY_DIR}/images/users.svg)
+@@ -170,6 +154,7 @@ add_custom_target(dev_debugging
+ set(PackagedFilesBootstrap
+     README.md
+     CHANGELOG.md
+    LICENSE
+     extension.js
+     images/*
+     syntaxes/*

--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
@ -1,11 +1,11 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, makeWrapper, callPackage
-, nodePackages, cmake, nodejs, unzip, python3
+{ pkgs, lib, stdenv, fetchFromGitHub, runCommand, rustPlatform, makeWrapper, llvmPackages
+, nodePackages, cmake, nodejs, unzip, python3, pkg-config, libsecret
 }:
 assert lib.versionAtLeast python3.version "3.5";
 let
  publisher = "vadimcn";
  pname = "vscode-lldb";
-  version = "1.6.10";
+  version = "1.7.4";

  vscodeExtUniqueId = "${publisher}.${pname}";

@ -13,19 +13,17 @@ let
    owner = "vadimcn";
    repo = "vscode-lldb";
    rev = "v${version}";
-    sha256 = "sha256-4PM/818UFHRZekfbdhS/Rz0Pu6HOjJEldi4YuBWECnI=";
+    sha256 = "sha256-yAB0qxeC2sWCQ1EcKG/7LsuUrxV/kbxkcOzRfAotxFc=";
  };

-  lldb = callPackage ./lldb.nix {};
+  # need to build a custom version of lldb and llvm for enhanced rust support
+  lldb = (import ./lldb.nix { inherit fetchFromGitHub runCommand llvmPackages; });

  adapter = rustPlatform.buildRustPackage {
    pname = "${pname}-adapter";
    inherit version src;

-    # It will pollute the build environment of `buildRustPackage`.
-    cargoPatches = [ ./reset-cargo-config.patch ];
-
-    cargoSha256 = "sha256-Ch1X2vN+p7oCqSs/GIu5IzG+pcSKmQ+VwP2T8ycRhos=";
+    cargoSha256 = "sha256-Ly7yIGB6kLy0c9RzWt8BFuX90dxu2QASocNTEdQA3yo=";

    nativeBuildInputs = [ makeWrapper ];

@ -42,7 +40,14 @@ let
    doCheck = false;
  };

-  nodeDeps = nodePackages."vscode-lldb-build-deps-../../applications/editors/vscode/extensions/vscode-lldb/build-deps";
+  nodeDeps = ((import ./build-deps/default.nix {
+    inherit pkgs nodejs;
+    inherit (stdenv.hostPlatform) system;
+  }).nodeDependencies.override (old: {
+    inherit src version;
+    buildInputs = [pkg-config libsecret];
+    dontNpmInstall = true;
+  }));

 in stdenv.mkDerivation {
  pname = "vscode-extension-${publisher}-${pname}";
@ -55,7 +60,7 @@ in stdenv.mkDerivation {
  patches = [ ./cmake-build-extension-only.patch ];

  postConfigure = ''
-    cp -r ${nodeDeps}/lib/node_modules/vscode-lldb/{node_modules,package-lock.json} .
+    cp -r ${nodeDeps}/lib/{node_modules,package-lock.json} .
  '';

  cmakeFlags = [
@ -92,6 +97,7 @@ in stdenv.mkDerivation {

  passthru = {
    inherit lldb adapter;
+    updateScript = ./update.sh;
  };

  meta = with lib; {
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/fix-python-installation.patch
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/fix-python-installation.patch
@ -0,0 +1,13 @@
+diff --git a/bindings/python/CMakeLists.txt b/bindings/python/CMakeLists.txt
+index 82a52da89a7e..5127dc1d8f41 100644
+--- a/bindings/python/CMakeLists.txt
+++ b/bindings/python/CMakeLists.txt
+@@ -160,7 +160,7 @@ function(finish_swig_python swig_target lldb_python_bindings_dir lldb_python_tar
+   if(LLDB_BUILD_FRAMEWORK)
+     set(LLDB_PYTHON_INSTALL_PATH ${LLDB_FRAMEWORK_INSTALL_DIR}/LLDB.framework/Versions/${LLDB_FRAMEWORK_VERSION}/Resources/Python)
+   else()
+-    set(LLDB_PYTHON_INSTALL_PATH ${LLDB_PYTHON_RELATIVE_PATH})
+    set(LLDB_PYTHON_INSTALL_PATH ${CMAKE_INSTALL_LIBDIR}/../${LLDB_PYTHON_RELATIVE_PATH})
+   endif()
+   if (NOT CMAKE_CFG_INTDIR STREQUAL  ".")
+     string(REPLACE ${CMAKE_CFG_INTDIR} "\$\{CMAKE_INSTALL_CONFIG_NAME\}" LLDB_PYTHON_INSTALL_PATH ${LLDB_PYTHON_INSTALL_PATH})
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/lldb.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/lldb.nix
@ -1,23 +1,35 @@
 # Patched lldb for Rust language support.
-{ lldb_12, fetchFromGitHub }:
+{ fetchFromGitHub, runCommand, llvmPackages }:
 let
  llvmSrc = fetchFromGitHub {
    owner = "vadimcn";
    repo = "llvm-project";
-    rev = "f2e9ff34256cd8c6feaf14359f88ad3f538ed687";
-    sha256 = "sha256-5UsCBu3rtt+l2HZiCswoQJPPh8T6y471TBF4AypdF9I=";
+    # codelldb/14.x branch
+    rev = "4c267c83cbb55fedf2e0b89644dc1db320fdfde7";
+    sha256 = "sha256-jM//ej6AxnRYj+8BAn4QrxHPT6HiDzK5RqHPSg3dCcw=";
  };
-in lldb_12.overrideAttrs (oldAttrs: {
-  src = "${llvmSrc}/lldb";
-
+in (llvmPackages.lldb.overrideAttrs (oldAttrs: rec {
  passthru = (oldAttrs.passthru or {}) // {
    inherit llvmSrc;
  };

+  patches = oldAttrs.patches ++ [
+    # backport of https://github.com/NixOS/nixpkgs/commit/0d3002334850a819d1a5c8283c39f114af907cd4
+    # remove when https://github.com/NixOS/nixpkgs/issues/166604 fixed
+    ./fix-python-installation.patch
+  ];
+
  doInstallCheck = true;
-  postInstallCheck = (oldAttrs.postInstallCheck or "") + ''
+
+  # installCheck for lldb_14 currently broken
+  # https://github.com/NixOS/nixpkgs/issues/166604#issuecomment-1086103692
+  # ignore the oldAttrs installCheck
+  installCheckPhase = ''
    versionOutput="$($out/bin/lldb --version)"
    echo "'lldb --version' returns: $versionOutput"
    echo "$versionOutput" | grep -q 'rust-enabled'
  '';
+})).override({
+  monorepoSrc = llvmSrc;
+  libllvm = llvmPackages.libllvm.override({ monorepoSrc = llvmSrc; });
 })
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/reset-cargo-config.patch
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/reset-cargo-config.patch
@ -1,19 +0,0 @@
-diff --git a/.cargo/config b/.cargo/config
-index c3c75e4..e69de29 100644
--- a/.cargo/config
-+++ b/.cargo/config
-@@ -1,14 +0,0 @@
-[build]
-target-dir = "build/target"
-
-[target.armv7-unknown-linux-gnueabihf]
-rustflags = [
-    "-C", "link-arg=-fuse-ld=lld",
-    "-C", "link-arg=--target=armv7-unknown-linux-gnueabihf",
-]
-
-[target.aarch64-unknown-linux-gnu]
-rustflags = [
-    "-C", "link-arg=-fuse-ld=lld",
-    "-C", "link-arg=--target=aarch64-unknown-linux-gnu",
-]
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/update.sh
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/update.sh
@ -3,10 +3,6 @@

 set -eo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
-if [[ $# -ne 1 ]]; then
-    echo "Usage: ./update.sh <version>"
-    exit 1
-fi

 echo "
 FIXME: This script doesn't update patched lldb. Please manually check branches
@ -19,28 +15,31 @@ nixFile=./default.nix
 owner=vadimcn
 repo=vscode-lldb
 version="$1"
+if [[ $# -ne 1 ]]; then
+    # no version specified, find the newest one
+    version=$(
+        curl -s "https://api.github.com/repos/$owner/$repo/releases" |
+        jq 'map(select(.prerelease | not)) | .[0].tag_name' --raw-output |
+        sed 's/[\"v]//'
+    )
+fi
+old_version=$(sed -nE 's/.*\bversion = "(.*)".*/\1/p' ./default.nix)
+if grep -q 'cargoSha256 = ""' ./default.nix; then
+    old_version='broken'
+fi
+if [[ "$version" == "$old_version" ]]; then
+    echo "Up to date: $version"
+    exit
+fi
+echo "$old_version -> $version"

+# update hashes
 sed -E 's/\bversion = ".*?"/version = "'$version'"/' --in-place "$nixFile"
 srcHash=$(nix-prefetch fetchFromGitHub --owner vadimcn --repo vscode-lldb --rev "v$version")
 sed -E 's#\bsha256 = ".*?"#sha256 = "'$srcHash'"#' --in-place "$nixFile"
 cargoHash=$(nix-prefetch "{ sha256 }: (import $nixpkgs {}).vscode-extensions.vadimcn.vscode-lldb.adapter.cargoDeps.overrideAttrs (_: { outputHash = sha256; })")
 sed -E 's#\bcargoSha256 = ".*?"#cargoSha256 = "'$cargoHash'"#' --in-place "$nixFile"

+# update node dependencies
 src="$(nix-build $nixpkgs -A vscode-extensions.vadimcn.vscode-lldb.src --no-out-link)"
-oldDeps="$(jq '.dependencies' build-deps/package.json)"
-newDeps="$(jq '.dependencies + .devDependencies' "$src/package.json")"
-jq '{ name, version: $version, dependencies: (.dependencies + .devDependencies) }' \
-    --arg version "$version" \
-    "$src/package.json" \
-    > build-deps/package.json
-
-if [[ "$oldDeps" == "$newDeps" ]]; then
-    echo "Dependencies not changed"
-    sed '/"vscode-lldb-build-deps-/,+3 s/version = ".*"/version = "'"$version"'"/' \
-        --in-place "$nixpkgs/pkgs/development/node-packages/node-packages.nix"
-else
-    echo "Dependencies changed"
-    # Regenerate nodePackages.
-    cd "$nixpkgs/pkgs/development/node-packages"
-    exec ./generate.sh
-fi
+nix-shell -p node2nix -I nixpkgs=$nixpkgs --run "cd build-deps && ls -R && node2nix -14 -d -i \"$src/package.json\" -l \"$src/package-lock.json\""
--- a/pkgs/applications/radio/gnuradio/3.9.nix
+++ b/pkgs/applications/radio/gnuradio/3.9.nix
@ -46,13 +46,13 @@
 , pname ? "gnuradio"
 , versionAttr ? {
  major = "3.9";
-  minor = "7";
+  minor = "8";
  patch = "0";
 }
 }:

 let
-  sourceSha256 = "sha256-6HEvQsV2JCkgNvBYsy1jfSTUIwEnrKJTzXNIVcPeWFQ=";
+  sourceSha256 = "sha256-0umGUOjD5l84CBBeDy1uFgUyEDpI9o9/SEQ8BZm22j4=";
  featuresInfo = {
    # Needed always
    basic = {
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@ -48,13 +48,13 @@
 , pname ? "gnuradio"
 , versionAttr ? {
  major = "3.10";
-  minor = "3";
+  minor = "4";
  patch = "0";
 }
 }:

 let
-  sourceSha256 = "sha256-pH0nvZBUto9jXSN6fXD5vP1lIBwCMuFAvF2qT5dYsHU=";
+  sourceSha256 = "sha256-Ov2NGiEj3mhqYwDYXWd6wcCAv78Ux2/LWyGjQ/ukQNk=";
  featuresInfo = {
    # Needed always
    basic = {
--- a/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
@ -9,17 +9,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-gone";
-  version = "0.3.8";
+  version = "0.4.0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "flausch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-hKbq2rJwEZI3391RsZXsQSjjp7rSqglUckRDYAu42KE=";
+    sha256 = "sha256-S9rNVWq1dbencp9Oy3eNPlJtBMdiFsiJnp5XvHi8hIw=";
  };

-  cargoSha256 = "sha256-gBQ4V8Bwx6Di8aVnOYwx0UZZIIOFxZAXT7Tl1Yli0Fk=";
+  cargoSha256 = "sha256-ZytIBdhyBp0p68ERlXNU8CnK9zYVZaBt/wn8F2bXlII=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/version-management/sublime-merge/common.nix
+++ b/pkgs/applications/version-management/sublime-merge/common.nix
@ -98,7 +98,7 @@ in stdenv.mkDerivation (rec {
    makeWrapper "''$${primaryBinary}/${primaryBinary}" "$out/bin/${primaryBinary}"
  '' + builtins.concatStringsSep "" (map (binaryAlias: "ln -s $out/bin/${primaryBinary} $out/bin/${binaryAlias}\n") primaryBinaryAliases) + ''
    mkdir -p "$out/share/applications"
-    substitute "''$${primaryBinary}/${primaryBinary}.desktop" "$out/share/applications/${primaryBinary}.desktop" --replace "/opt/${primaryBinary}/${primaryBinary}" "$out/bin/${primaryBinary}"
+    substitute "''$${primaryBinary}/${primaryBinary}.desktop" "$out/share/applications/${primaryBinary}.desktop" --replace "/opt/${primaryBinary}/${primaryBinary}" "${primaryBinary}"
    for directory in ''$${primaryBinary}/Icon/*; do
      size=$(basename $directory)
      mkdir -p "$out/share/icons/hicolor/$size/apps"
--- a/pkgs/applications/version-management/sublime-merge/default.nix
+++ b/pkgs/applications/version-management/sublime-merge/default.nix
@ -4,8 +4,8 @@ let
  common = opts: callPackage (import ./common.nix opts);
 in {
  sublime-merge = common {
-    buildVersion = "2074";
-    x64sha256 = "REo59Lpi0fmAOp0XJa4Iln3VKxR5kRiMpz2zfqz1MQs=";
+    buildVersion = "2077";
+    x64sha256 = "6xgh/oSatTYHCnQEXiZAoHs3yI1iimLMtzCosBKBVp8=";
  } {};

  sublime-merge-dev = common {
--- a/pkgs/common-updater/scripts/update-source-version
+++ b/pkgs/common-updater/scripts/update-source-version
@ -177,15 +177,15 @@ elif [[ "$oldHashAlgo" = "null" ]]; then
 fi

 case "$oldHashAlgo" in
-    # Lengths of hex-encoded hashes
-    sha256) hashLength=64 ;;
-    sha512) hashLength=128 ;;
+    # Choose a temporary hash for given algorithm.
+    # Not using all-zeroes hash, since that is sometimes
+    # used for clean-up when updating multi-source packages.
+    # Created by hashing “update-source-version” string.
+    sha256) tempHash=AzH1rZFqEH8sovZZfJykvsEmCedEZWigQFHWHl6/PdE= ;;
+    sha512) tempHash=KFj9Fvco4AuCgLJIGRnVzyssRf7VGP2oi5CkH6ADvj75ow3am3h8pxefOgQlO+i33Q/BBnG/ST/F7B/0BvWHxw== ;;
    *) die "Unhandled hash algorithm '$oldHashAlgo' in '$attr'!" ;;
 esac

-# Make a temporary all-zeroes hash of $hashLength characters
-tempHash=$(printf '%0*d' "$hashLength" 0)
-
 if [[ -n "$sri" ]]; then
    # SRI hashes only support base64
    # SRI hashes need to declare the hash type as part of the hash
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202209150105";
+  version = "202209170841";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "6666b85fc48179414d59613cdfd6f83354f778bc";
-    sha256 = "sha256-iBQvfVvfTG8zQdoTGOFxME0tr/YWCVxjXFQhP/zmRVU=";
+    rev = "9487b31412243e602ee3332ff3cce63a15906733";
+    sha256 = "sha256-gKzrPBiifC2Lg050tFJynFd6DZ4vzSoPB6wbR4OzMFQ=";
  };

  installPhase = ''
--- a/pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py
+++ b/pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py
@ -7,7 +7,7 @@ import requests
 import sys

 # openjdk15 is only for bootstrapping openjdk
-releases = ("openjdk8", "openjdk11", "openjdk13", "openjdk14", "openjdk15", "openjdk16")
+releases = ("openjdk8", "openjdk11", "openjdk13", "openjdk14", "openjdk15", "openjdk16", "openjdk17")
 oses = ("mac", "linux")
 types = ("jre", "jdk")
 impls = ("hotspot", "openj9")
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk17-darwin.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk17-darwin.nix
@ -0,0 +1,9 @@
+{ lib }:
+
+let
+  sources = lib.importJSON ./sources.json;
+in
+{
+  jdk-hotspot = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk17.mac.jdk.hotspot; };
+  jre-hotspot = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk17.mac.jre.hotspot; };
+}
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk17-linux.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk17-linux.nix
@ -0,0 +1,9 @@
+{ lib }:
+
+let
+  sources = lib.importJSON ./sources.json;
+in
+{
+  jdk-hotspot = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk17.linux.jdk.hotspot; };
+  jre-hotspot = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk17.linux.jre.hotspot; };
+}
--- a/pkgs/development/compilers/adoptopenjdk-bin/sources.json
+++ b/pkgs/development/compilers/adoptopenjdk-bin/sources.json
@ -793,6 +793,108 @@
      }
    }
  },
+  "openjdk17": {
+    "linux": {
+      "jdk": {
+        "hotspot": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "302caf29f73481b2b914ba2b89705036010c65eb9bc8d7712b27d6e9bedf6200",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          },
+          "armv6l": {
+            "build": "8",
+            "sha256": "544936145a4a9b1a316ed3708cd91b3960d5e8e87578bea73ef674ca3047158e",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jdk_arm_linux_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          },
+          "armv7l": {
+            "build": "8",
+            "sha256": "544936145a4a9b1a316ed3708cd91b3960d5e8e87578bea73ef674ca3047158e",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jdk_arm_linux_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "8",
+            "sha256": "288f34e3ba8a4838605636485d0365ce23e57d5f2f68997ac4c2e4c01967cd48",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jdk_x64_linux_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "6ef7a28d0d844fe347ab18f65a91db744547321fe8a101d883bd80722183ab64",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          },
+          "armv6l": {
+            "build": "8",
+            "sha256": "4fd1d11f3008aba1c6c17e1d1c1cf15e2a54e68275ad0874b47a781eaf73450e",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jre_arm_linux_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          },
+          "armv7l": {
+            "build": "8",
+            "sha256": "4fd1d11f3008aba1c6c17e1d1c1cf15e2a54e68275ad0874b47a781eaf73450e",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jre_arm_linux_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "8",
+            "sha256": "292ed702d95f5690e52e171afe9f3050b9d2fb803456b155c831735fad0f17c0",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jre_x64_linux_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          }
+        }
+      }
+    },
+    "mac": {
+      "jdk": {
+        "hotspot": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "157518e999d712b541b883c6c167f8faabbef1d590da9fe7233541b4adb21ea4",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jdk_aarch64_mac_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "8",
+            "sha256": "3630e21a571b7180876bf08f85d0aac0bdbb3267b2ae9bd242f4933b21f9be32",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jdk_x64_mac_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "f2f23d6629060eb1692c714bfda27dd5f100cc560578c7cdd9df920a8ac1d453",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jre_aarch64_mac_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "8",
+            "sha256": "4e2e5e9c079ccc48b056959b2808a96398ebbc92d6b13ee5beb3159b89469aa8",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.2%2B8/OpenJDK17U-jre_x64_mac_hotspot_17.0.2_8.tar.gz",
+            "version": "17.0.2"
+          }
+        }
+      }
+    }
+  },
  "openjdk8": {
    "linux": {
      "jdk": {
--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@ -40,7 +40,7 @@ let
      ./read-truststore-from-env-jdk10.patch
      ./currency-date-range-jdk10.patch
      ./increase-javadoc-heap-jdk13.patch
-      ./ignore-LegalNoticeFilePlugin.patch
+      ./ignore-LegalNoticeFilePlugin-jdk17.patch
      ./fix-library-path-jdk17.patch

      # -Wformat etc. are stricter in newer gccs, per
--- a/pkgs/development/compilers/openjdk/18.nix
+++ b/pkgs/development/compilers/openjdk/18.nix
@ -0,0 +1,167 @@
+{ stdenv, lib, fetchurl, fetchFromGitHub, bash, pkg-config, autoconf, cpio
+, file, which, unzip, zip, perl, cups, freetype, alsa-lib, libjpeg, giflib
+, libpng, zlib, lcms2, libX11, libICE, libXrender, libXext, libXt, libXtst
+, libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk18-bootstrap
+, setJavaClassPath
+, headless ? false
+, enableJavaFX ? openjfx.meta.available, openjfx
+, enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
+}:
+
+let
+  version = {
+    feature = "18";
+    build = "36";
+  };
+
+  openjdk = stdenv.mkDerivation {
+    pname = "openjdk" + lib.optionalString headless "-headless";
+    version = "${version.feature}+${version.build}";
+
+    src = fetchFromGitHub {
+      owner = "openjdk";
+      repo = "jdk${version.feature}u";
+      rev = "jdk-${version.feature}+${version.build}";
+      sha256 = "sha256-yGPC8VA983Ml6Fv/oiEgRrcVe4oe+Q4oCHbzOmFbZq8=";
+    };
+
+    nativeBuildInputs = [ pkg-config autoconf unzip ];
+    buildInputs = [
+      cpio file which zip perl zlib cups freetype alsa-lib libjpeg giflib
+      libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk18-bootstrap
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      gtk3 gnome_vfs GConf glib
+    ];
+
+    patches = [
+      ./fix-java-home-jdk10.patch
+      ./read-truststore-from-env-jdk10.patch
+      ./currency-date-range-jdk10.patch
+      ./increase-javadoc-heap-jdk13.patch
+      ./ignore-LegalNoticeFilePlugin-jdk18.patch
+
+      # -Wformat etc. are stricter in newer gccs, per
+      # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79677
+      # so grab the work-around from
+      # https://src.fedoraproject.org/rpms/java-openjdk/pull-request/24
+      (fetchurl {
+        url = "https://src.fedoraproject.org/rpms/java-openjdk/raw/06c001c7d87f2e9fe4fedeef2d993bcd5d7afa2a/f/rh1673833-remove_removal_of_wformat_during_test_compilation.patch";
+        sha256 = "082lmc30x64x583vqq00c8y0wqih3y4r0mp1c4bqq36l22qv6b6r";
+      })
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      ./swing-use-gtk-jdk13.patch
+    ];
+
+    postPatch = ''
+      chmod +x configure
+      patchShebangs --build configure
+    '';
+
+    configureFlags = [
+      "--with-boot-jdk=${openjdk18-bootstrap.home}"
+      "--with-version-build=${version.build}"
+      "--with-version-opt=nixos"
+      "--with-version-pre="
+      "--enable-unlimited-crypto"
+      "--with-native-debug-symbols=internal"
+      "--with-libjpeg=system"
+      "--with-giflib=system"
+      "--with-libpng=system"
+      "--with-zlib=system"
+      "--with-lcms=system"
+      "--with-stdc++lib=dynamic"
+    ] ++ lib.optional stdenv.isx86_64 "--with-jvm-features=zgc"
+      ++ lib.optional headless "--enable-headless-only"
+      ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx}";
+
+    separateDebugInfo = true;
+
+    NIX_CFLAGS_COMPILE = "-Wno-error";
+
+    NIX_LDFLAGS = toString (lib.optionals (!headless) [
+      "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
+    ]);
+
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
+    buildFlags = [ "images" ];
+
+    installPhase = ''
+      mkdir -p $out/lib
+
+      mv build/*/images/jdk $out/lib/openjdk
+
+      # Remove some broken manpages.
+      rm -rf $out/lib/openjdk/man/ja*
+
+      # Mirror some stuff in top-level.
+      mkdir -p $out/share
+      ln -s $out/lib/openjdk/include $out/include
+      ln -s $out/lib/openjdk/man $out/share/man
+
+      # IDEs use the provided src.zip to navigate the Java codebase (https://github.com/NixOS/nixpkgs/pull/95081)
+      ln -s $out/lib/openjdk/lib/src.zip $out/lib/src.zip
+
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/linux/*_md.h $out/include/
+
+      # Remove crap from the installation.
+      rm -rf $out/lib/openjdk/demo
+      ${lib.optionalString headless ''
+        rm $out/lib/openjdk/lib/{libjsound,libfontmanager}.so
+      ''}
+
+      ln -s $out/lib/openjdk/bin $out/bin
+    '';
+
+    preFixup = ''
+      # Propagate the setJavaClassPath setup hook so that any package
+      # that depends on the JDK has $CLASSPATH set up properly.
+      mkdir -p $out/nix-support
+      #TODO or printWords?  cf https://github.com/NixOS/nixpkgs/pull/27427#issuecomment-317293040
+      echo -n "${setJavaClassPath}" > $out/nix-support/propagated-build-inputs
+
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat <<EOF > $out/nix-support/setup-hook
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      EOF
+    '';
+
+    postFixup = ''
+      # Build the set of output library directories to rpath against
+      LIBDIRS=""
+      for output in $outputs; do
+        if [ "$output" = debug ]; then continue; fi
+        LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
+      done
+      # Add the local library paths to remove dependencies on the bootstrap
+      for output in $outputs; do
+        if [ "$output" = debug ]; then continue; fi
+        OUTPUTDIR=$(eval echo \$$output)
+        BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
+        echo "$BINLIBS" | while read i; do
+          patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
+          patchelf --shrink-rpath "$i" || true
+        done
+      done
+    '';
+
+    disallowedReferences = [ openjdk18-bootstrap ];
+
+    meta = import ./meta.nix lib version.feature;
+
+    passthru = {
+      architecture = "";
+      home = "${openjdk}/lib/openjdk";
+      inherit gtk3;
+    };
+  };
+in openjdk
--- a/pkgs/development/compilers/openjdk/darwin/18.nix
+++ b/pkgs/development/compilers/openjdk/darwin/18.nix
@ -0,0 +1,81 @@
+{ lib, stdenv, fetchurl, unzip, setJavaClassPath }:
+let
+  # Details from https://www.azul.com/downloads/?version=java-18-sts&os=macos&package=jdk
+  # Note that the latest build may differ by platform
+  dist = {
+    x86_64-darwin = {
+      arch = "x64";
+      zuluVersion = "18.28.13";
+      jdkVersion = "18.0.0";
+      sha256 = "0hc5m3d4q3n7sighq3pxkdg93vsrgj1kzla1py9nfnm9pnj9l2kq";
+    };
+
+    aarch64-darwin = {
+      arch = "aarch64";
+      zuluVersion = "18.28.13";
+      jdkVersion = "18.0.0";
+      sha256 = "0ch4jp2d4pjvxbmbswvjwf7w2flajrvjg5f16ggiy80y8l0y15cm";
+    };
+  }."${stdenv.hostPlatform.system}";
+
+  jce-policies = fetchurl {
+    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
+    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+  };
+
+  jdk = stdenv.mkDerivation rec {
+    pname = "zulu${dist.zuluVersion}-ca-jdk";
+    version = dist.jdkVersion;
+
+    src = fetchurl {
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
+      inherit (dist) sha256;
+      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
+    };
+
+    nativeBuildInputs = [ unzip ];
+
+    installPhase = ''
+      mkdir -p $out
+      mv * $out
+
+      unzip ${jce-policies}
+      mv -f ZuluJCEPolicies/*.jar $out/lib/security/
+
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/darwin/*_md.h $out/include/
+
+      if [ -f $out/LICENSE ]; then
+        install -D $out/LICENSE $out/share/zulu/LICENSE
+        rm $out/LICENSE
+      fi
+    '';
+
+    preFixup = ''
+      # Propagate the setJavaClassPath setup hook from the JDK so that
+      # any package that depends on the JDK has $CLASSPATH set up
+      # properly.
+      mkdir -p $out/nix-support
+      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
+
+      # Set JAVA_HOME automatically.
+      cat <<EOF >> $out/nix-support/setup-hook
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+      EOF
+    '';
+
+    # fixupPhase is moving the man to share/man which breaks it because it's a
+    # relative symlink.
+    postFixup = ''
+      ln -nsf ../zulu-${lib.versions.major version}.jdk/Contents/Home/man $out/share/man
+    '';
+
+    passthru = {
+      home = jdk;
+    };
+
+    meta = import ./meta.nix lib version;
+  };
+in
+jdk
--- a/pkgs/development/compilers/openjdk/ignore-LegalNoticeFilePlugin-jdk17.patch
+++ b/pkgs/development/compilers/openjdk/ignore-LegalNoticeFilePlugin-jdk17.patch
--- a/pkgs/development/compilers/openjdk/ignore-LegalNoticeFilePlugin-jdk18.patch
+++ b/pkgs/development/compilers/openjdk/ignore-LegalNoticeFilePlugin-jdk18.patch
@ -0,0 +1,21 @@
+--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/plugins/LegalNoticeFilePlugin.java
+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/plugins/LegalNoticeFilePlugin.java
+@@ -112,18 +112,6 @@
+             .filter(e -> Arrays.equals(e.contentBytes(), entry.contentBytes()))
+             .findFirst();
+         if (otarget.isEmpty()) {
+-            if (errorIfNotSameContent) {
+-                // all legal notices of the same file name are expected
+-                // to contain the same content
+-                Optional<ResourcePoolEntry> ores =
+-                    entries.stream().filter(e -> e.linkedTarget() == null)
+-                           .findAny();
+-
+-                if (ores.isPresent()) {
+-                    throw new PluginException(ores.get().path() + " " +
+-                        entry.path() + " contain different content");
+-                }
+-            }
+             entries.add(entry);
+         } else {
+             entries.add(ResourcePoolEntry.createSymLink(entry.path(),
--- a/pkgs/development/libraries/duckdb/default.nix
+++ b/pkgs/development/libraries/duckdb/default.nix
@ -17,29 +17,15 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "duckdb";
-  version = "0.4.0";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-pQ/t26dv9ZWLl0MHcAn0sgxryW2T2hM8XyOkXyfC5CY=";
+    sha256 = "sha256-dU8JXb++8OMEokr+4OyxLvcEc0vmdBvKDLxjeaWNkq0=";
  };

-  patches = [
-    ./version.patch
-    (fetchpatch {
-      name = "fix-tpce-test.patch";
-      url = "https://github.com/duckdb/duckdb/commit/82e13a4bb9f0683af6c52468af2fb903cce4286d.patch";
-      sha256 = "sha256-m0Bs0DOJQtkadbKZKk88NHyBFJkjxXUsiWYciuRIJLU=";
-    })
-    (fetchpatch {
-      name = "fix-list-type-metadata.patch";
-      url = "https://github.com/duckdb/duckdb/commit/26d123fdc57273903573c72b1ddafc52f365e378.patch";
-      sha256 = "sha256-ttqs5EjeSLhZQOXc43Y5/N5IYSESQTD1FZWV1uJ15Fo=";
-    })
-  ];
-
  postPatch = ''
    substituteInPlace CMakeLists.txt --subst-var-by DUCKDB_VERSION "v${version}"
  '';
@ -52,8 +38,6 @@ stdenv.mkDerivation rec {
    "-DBUILD_JSON_EXTENSION=ON"
    "-DBUILD_ODBC_DRIVER=${enableFeature withOdbc}"
    "-DBUILD_PARQUET_EXTENSION=ON"
-    "-DBUILD_REST=ON"
-    "-DBUILD_SUBSTRAIT_EXTENSION=ON"
    "-DBUILD_TPCDS_EXTENSION=ON"
    "-DBUILD_TPCE=ON"
    "-DBUILD_TPCH_EXTENSION=ON"
@ -63,7 +47,9 @@ stdenv.mkDerivation rec {

  doInstallCheck = true;

-  preInstallCheck = lib.optionalString stdenv.isDarwin ''
+  preInstallCheck = ''
+    export HOME="$(mktemp -d)"
+  '' + lib.optionalString stdenv.isDarwin ''
    export DYLD_LIBRARY_PATH="$out/lib''${DYLD_LIBRARY_PATH:+:}''${DYLD_LIBRARY_PATH}"
  '';

--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -378,7 +378,6 @@
 , "vscode-json-languageserver"
 , "vscode-json-languageserver-bin"
 , "vscode-langservers-extracted"
-, { "vscode-lldb-build-deps": "../../applications/editors/vscode/extensions/vscode-lldb/build-deps" }
 , "vue-cli"
 , "vue-language-server"
 , "wavedrom-cli"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@ -135972,354 +135972,6 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-  "vscode-lldb-build-deps-../../applications/editors/vscode/extensions/vscode-lldb/build-deps" = nodeEnv.buildNodePackage {
-    name = "vscode-lldb";
-    packageName = "vscode-lldb";
-    version = "1.6.8";
-    src = ../../applications/editors/vscode/extensions/vscode-lldb/build-deps;
-    dependencies = [
-      sources."@discoveryjs/json-ext-0.5.7"
-      sources."@jridgewell/gen-mapping-0.3.2"
-      sources."@jridgewell/resolve-uri-3.1.0"
-      sources."@jridgewell/set-array-1.1.2"
-      sources."@jridgewell/source-map-0.3.2"
-      sources."@jridgewell/sourcemap-codec-1.4.14"
-      sources."@jridgewell/trace-mapping-0.3.15"
-      sources."@types/eslint-8.4.6"
-      sources."@types/eslint-scope-3.7.4"
-      sources."@types/estree-0.0.51"
-      sources."@types/json-schema-7.0.11"
-      sources."@types/mocha-7.0.2"
-      sources."@types/node-8.10.66"
-      sources."@types/vscode-1.71.0"
-      sources."@types/yauzl-2.10.0"
-      sources."@ungap/promise-all-settled-1.1.2"
-      sources."@webassemblyjs/ast-1.11.1"
-      sources."@webassemblyjs/floating-point-hex-parser-1.11.1"
-      sources."@webassemblyjs/helper-api-error-1.11.1"
-      sources."@webassemblyjs/helper-buffer-1.11.1"
-      sources."@webassemblyjs/helper-numbers-1.11.1"
-      sources."@webassemblyjs/helper-wasm-bytecode-1.11.1"
-      sources."@webassemblyjs/helper-wasm-section-1.11.1"
-      sources."@webassemblyjs/ieee754-1.11.1"
-      sources."@webassemblyjs/leb128-1.11.1"
-      sources."@webassemblyjs/utf8-1.11.1"
-      sources."@webassemblyjs/wasm-edit-1.11.1"
-      sources."@webassemblyjs/wasm-gen-1.11.1"
-      sources."@webassemblyjs/wasm-opt-1.11.1"
-      sources."@webassemblyjs/wasm-parser-1.11.1"
-      sources."@webassemblyjs/wast-printer-1.11.1"
-      sources."@webpack-cli/configtest-1.2.0"
-      sources."@webpack-cli/info-1.5.0"
-      sources."@webpack-cli/serve-1.7.0"
-      sources."@xtuc/ieee754-1.2.0"
-      sources."@xtuc/long-4.2.2"
-      sources."acorn-8.8.0"
-      sources."acorn-import-assertions-1.8.0"
-      sources."ajv-6.12.6"
-      sources."ajv-keywords-3.5.2"
-      sources."ansi-colors-4.1.1"
-      sources."ansi-regex-3.0.1"
-      sources."ansi-styles-4.3.0"
-      sources."anymatch-3.1.2"
-      sources."argparse-2.0.1"
-      sources."azure-devops-node-api-10.2.2"
-      sources."balanced-match-1.0.2"
-      sources."big.js-5.2.2"
-      sources."binary-extensions-2.2.0"
-      sources."boolbase-1.0.0"
-      sources."brace-expansion-1.1.11"
-      sources."braces-3.0.2"
-      sources."browser-stdout-1.3.1"
-      sources."browserslist-4.21.3"
-      sources."buffer-crc32-0.2.13"
-      sources."buffer-from-1.1.2"
-      sources."call-bind-1.0.2"
-      sources."camelcase-6.3.0"
-      sources."caniuse-lite-1.0.30001399"
-      (sources."chalk-4.1.2" // {
-        dependencies = [
-          sources."supports-color-7.2.0"
-        ];
-      })
-      sources."cheerio-1.0.0-rc.12"
-      sources."cheerio-select-2.1.0"
-      sources."chokidar-3.5.1"
-      sources."chrome-trace-event-1.0.3"
-      (sources."cliui-7.0.4" // {
-        dependencies = [
-          sources."ansi-regex-5.0.1"
-          sources."is-fullwidth-code-point-3.0.0"
-          sources."string-width-4.2.3"
-          sources."strip-ansi-6.0.1"
-        ];
-      })
-      sources."clone-deep-4.0.1"
-      sources."color-convert-2.0.1"
-      sources."color-name-1.1.4"
-      sources."colorette-2.0.19"
-      sources."commander-6.2.1"
-      sources."concat-map-0.0.1"
-      sources."core-util-is-1.0.3"
-      sources."cross-spawn-7.0.3"
-      sources."css-select-5.1.0"
-      sources."css-what-6.1.0"
-      (sources."debug-4.3.1" // {
-        dependencies = [
-          sources."ms-2.1.2"
-        ];
-      })
-      sources."decamelize-4.0.0"
-      sources."denodeify-1.2.1"
-      sources."diff-5.0.0"
-      sources."dom-serializer-2.0.0"
-      sources."domelementtype-2.3.0"
-      sources."domhandler-5.0.3"
-      sources."domutils-3.0.1"
-      sources."electron-to-chromium-1.4.248"
-      sources."emoji-regex-8.0.0"
-      sources."emojis-list-3.0.0"
-      sources."enhanced-resolve-5.10.0"
-      sources."entities-4.4.0"
-      sources."envinfo-7.8.1"
-      sources."errno-0.1.8"
-      sources."es-module-lexer-0.9.3"
-      sources."escalade-3.1.1"
-      sources."escape-string-regexp-4.0.0"
-      sources."eslint-scope-5.1.1"
-      (sources."esrecurse-4.3.0" // {
-        dependencies = [
-          sources."estraverse-5.3.0"
-        ];
-      })
-      sources."estraverse-4.3.0"
-      sources."events-3.3.0"
-      sources."fast-deep-equal-3.1.3"
-      sources."fast-json-stable-stringify-2.1.0"
-      sources."fastest-levenshtein-1.0.16"
-      sources."fd-slicer-1.1.0"
-      sources."fill-range-7.0.1"
-      sources."find-up-5.0.0"
-      sources."flat-5.0.2"
-      sources."fs.realpath-1.0.0"
-      sources."fsevents-2.3.2"
-      sources."function-bind-1.1.1"
-      sources."get-caller-file-2.0.5"
-      sources."get-intrinsic-1.1.3"
-      sources."glob-7.1.6"
-      sources."glob-parent-5.1.2"
-      sources."glob-to-regexp-0.4.1"
-      sources."graceful-fs-4.2.10"
-      sources."growl-1.10.5"
-      sources."has-1.0.3"
-      sources."has-flag-4.0.0"
-      sources."has-symbols-1.0.3"
-      sources."he-1.2.0"
-      sources."htmlparser2-8.0.1"
-      sources."import-local-3.1.0"
-      sources."inflight-1.0.6"
-      sources."inherits-2.0.4"
-      sources."interpret-2.2.0"
-      sources."is-binary-path-2.1.0"
-      sources."is-core-module-2.10.0"
-      sources."is-extglob-2.1.1"
-      sources."is-fullwidth-code-point-2.0.0"
-      sources."is-glob-4.0.3"
-      sources."is-number-7.0.0"
-      sources."is-plain-obj-2.1.0"
-      sources."is-plain-object-2.0.4"
-      sources."isarray-0.0.1"
-      sources."isexe-2.0.0"
-      sources."isobject-3.0.1"
-      sources."jest-worker-27.5.1"
-      sources."js-yaml-4.0.0"
-      sources."json-parse-even-better-errors-2.3.1"
-      sources."json-schema-traverse-0.4.1"
-      sources."json5-2.2.1"
-      sources."kind-of-6.0.3"
-      sources."leven-3.1.0"
-      sources."linkify-it-2.2.0"
-      sources."loader-runner-4.3.0"
-      sources."loader-utils-2.0.2"
-      sources."locate-path-6.0.0"
-      sources."lodash-4.17.21"
-      sources."log-symbols-4.0.0"
-      sources."lru-cache-6.0.0"
-      (sources."markdown-it-10.0.0" // {
-        dependencies = [
-          sources."argparse-1.0.10"
-          sources."entities-2.0.3"
-        ];
-      })
-      sources."mdurl-1.0.1"
-      (sources."memory-fs-0.5.0" // {
-        dependencies = [
-          sources."isarray-1.0.0"
-          sources."readable-stream-2.3.7"
-          sources."safe-buffer-5.1.2"
-          sources."string_decoder-1.1.1"
-        ];
-      })
-      sources."memory-streams-0.1.3"
-      sources."merge-stream-2.0.0"
-      sources."micromatch-4.0.5"
-      sources."mime-1.6.0"
-      sources."mime-db-1.52.0"
-      sources."mime-types-2.1.35"
-      sources."minimatch-3.0.4"
-      sources."mocha-8.4.0"
-      sources."ms-2.1.3"
-      sources."mute-stream-0.0.8"
-      sources."nanoid-3.1.20"
-      sources."neo-async-2.6.2"
-      sources."node-releases-2.0.6"
-      sources."normalize-path-3.0.0"
-      sources."nth-check-2.1.1"
-      sources."object-inspect-1.12.2"
-      sources."once-1.4.0"
-      sources."os-homedir-1.0.2"
-      sources."os-tmpdir-1.0.2"
-      sources."osenv-0.1.5"
-      sources."p-limit-3.1.0"
-      sources."p-locate-5.0.0"
-      sources."p-try-2.2.0"
-      sources."parse-semver-1.1.1"
-      sources."parse5-7.1.1"
-      sources."parse5-htmlparser2-tree-adapter-7.0.0"
-      sources."path-exists-4.0.0"
-      sources."path-is-absolute-1.0.1"
-      sources."path-key-3.1.1"
-      sources."path-parse-1.0.7"
-      sources."pend-1.2.0"
-      sources."picocolors-1.0.0"
-      sources."picomatch-2.3.1"
-      (sources."pkg-dir-4.2.0" // {
-        dependencies = [
-          sources."find-up-4.1.0"
-          sources."locate-path-5.0.0"
-          sources."p-limit-2.3.0"
-          sources."p-locate-4.1.0"
-        ];
-      })
-      sources."process-nextick-args-2.0.1"
-      sources."prr-1.0.1"
-      sources."punycode-2.1.1"
-      sources."qs-6.11.0"
-      sources."randombytes-2.1.0"
-      sources."read-1.0.7"
-      sources."readable-stream-1.0.34"
-      sources."readdirp-3.5.0"
-      sources."rechoir-0.7.1"
-      sources."require-directory-2.1.1"
-      sources."resolve-1.22.1"
-      sources."resolve-cwd-3.0.0"
-      sources."resolve-from-5.0.0"
-      sources."safe-buffer-5.2.1"
-      sources."schema-utils-3.1.1"
-      sources."semver-5.7.1"
-      sources."serialize-javascript-5.0.1"
-      sources."shallow-clone-3.0.1"
-      sources."shebang-command-2.0.0"
-      sources."shebang-regex-3.0.0"
-      sources."side-channel-1.0.4"
-      sources."source-map-0.6.1"
-      sources."source-map-support-0.5.21"
-      sources."sprintf-js-1.0.3"
-      sources."string-argv-0.3.1"
-      sources."string-width-2.1.1"
-      sources."string_decoder-0.10.31"
-      sources."strip-ansi-4.0.0"
-      sources."strip-json-comments-3.1.1"
-      sources."supports-color-8.1.1"
-      sources."supports-preserve-symlinks-flag-1.0.0"
-      sources."tapable-2.2.1"
-      (sources."terser-5.15.0" // {
-        dependencies = [
-          sources."commander-2.20.3"
-        ];
-      })
-      (sources."terser-webpack-plugin-5.3.6" // {
-        dependencies = [
-          sources."serialize-javascript-6.0.0"
-        ];
-      })
-      sources."tmp-0.0.29"
-      sources."to-regex-range-5.0.1"
-      (sources."ts-loader-8.4.0" // {
-        dependencies = [
-          sources."enhanced-resolve-4.5.0"
-          sources."semver-7.3.7"
-          sources."tapable-1.1.3"
-        ];
-      })
-      sources."tunnel-0.0.6"
-      sources."typed-rest-client-1.8.9"
-      sources."typescript-4.8.3"
-      sources."uc.micro-1.0.6"
-      sources."underscore-1.13.4"
-      sources."update-browserslist-db-1.0.8"
-      sources."uri-js-4.4.1"
-      sources."url-join-1.1.0"
-      sources."util-deprecate-1.0.2"
-      (sources."vsce-1.88.0" // {
-        dependencies = [
-          sources."ansi-styles-3.2.1"
-          sources."chalk-2.4.2"
-          sources."color-convert-1.9.3"
-          sources."color-name-1.1.3"
-          sources."escape-string-regexp-1.0.5"
-          sources."has-flag-3.0.0"
-          sources."supports-color-5.5.0"
-        ];
-      })
-      sources."vscode-debugadapter-testsupport-1.51.0"
-      sources."vscode-debugprotocol-1.51.0"
-      sources."watchpack-2.4.0"
-      sources."webpack-5.74.0"
-      (sources."webpack-cli-4.10.0" // {
-        dependencies = [
-          sources."commander-7.2.0"
-        ];
-      })
-      sources."webpack-merge-5.8.0"
-      sources."webpack-sources-3.2.3"
-      sources."which-2.0.2"
-      sources."wide-align-1.1.3"
-      sources."wildcard-2.0.0"
-      sources."workerpool-6.1.0"
-      (sources."wrap-ansi-7.0.0" // {
-        dependencies = [
-          sources."ansi-regex-5.0.1"
-          sources."is-fullwidth-code-point-3.0.0"
-          sources."string-width-4.2.3"
-          sources."strip-ansi-6.0.1"
-        ];
-      })
-      sources."wrappy-1.0.2"
-      sources."y18n-5.0.8"
-      sources."yallist-4.0.0"
-      sources."yaml-1.10.2"
-      (sources."yargs-16.2.0" // {
-        dependencies = [
-          sources."ansi-regex-5.0.1"
-          sources."is-fullwidth-code-point-3.0.0"
-          sources."string-width-4.2.3"
-          sources."strip-ansi-6.0.1"
-        ];
-      })
-      sources."yargs-parser-20.2.4"
-      sources."yargs-unparser-2.0.0"
-      sources."yauzl-2.10.0"
-      sources."yazl-2.5.1"
-      sources."yocto-queue-0.1.0"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
  vue-cli = nodeEnv.buildNodePackage {
    name = "vue-cli";
    packageName = "vue-cli";
--- a/pkgs/development/python-modules/duckdb-engine/default.nix
+++ b/pkgs/development/python-modules/duckdb-engine/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "duckdb-engine";
-  version = "0.5.0";
+  version = "0.6.4";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -21,8 +21,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    repo = "duckdb_engine";
    owner = "Mause";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-6bR2pt7gUHZu4I7VmJgVsFT9u3/e4c9RAKHHlbX/Tyk=";
+    rev = "v${version}";
+    hash = "sha256-7PfrI4bNz0XtBa/cb8T43j06BJ3B2S5zIyBZsEusyXc=";
  };

  nativeBuildInputs = [
@ -34,6 +34,15 @@ buildPythonPackage rec {
    sqlalchemy
  ];

+  preCheck = ''
+    export HOME="$(mktemp -d)"
+  '';
+
+  # this test tries to download the httpfs extension
+  disabledTests = [
+    "test_preload_extension"
+  ];
+
  checkInputs = [
    pytestCheckHook
    hypothesis
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@ -36,11 +36,12 @@
 , python
 , pytz
 , regex
+, rich
 , rsync
 , shapely
 , sqlalchemy
+, sqlglot
 , sqlite
-, tabulate
 , toolz
 }:
 let
@ -62,7 +63,7 @@ in

 buildPythonPackage rec {
  pname = "ibis-framework";
-  version = "3.1.0";
+  version = "3.2.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -71,18 +72,9 @@ buildPythonPackage rec {
    repo = "ibis";
    owner = "ibis-project";
    rev = version;
-    hash = "sha256-/mQWQLiJa1DRZiyiA6F0/lMyn3wSY1IUwJl2S0IFkvs=";
+    hash = "sha256-YRP1nGJs4btqXQirm0GfEDKNPCVXexVrwQ6sE8JtD2o=";
  };

-  patches = [
-    (fetchpatch {
-      name = "xfail-datafusion-0.4.0";
-      url = "https://github.com/ibis-project/ibis/compare/c162abba4df24e0d531bd2e6a3be3109c16b43b9...6219d6caee19b6fd3171983c49cd8d6872e3564b.patch";
-      hash = "sha256-pCYPntj+TwzqCtYWRf6JF5/tJC4crSXHp0aepRocHck=";
-      excludes = ["poetry.lock"];
-    })
-  ];
-
  nativeBuildInputs = [ poetry-core ];

  propagatedBuildInputs = [
@ -96,7 +88,7 @@ buildPythonPackage rec {
    pydantic
    pytz
    regex
-    tabulate
+    rich
    toolz
  ];

@ -131,7 +123,9 @@ buildPythonPackage rec {
    set -eo pipefail

    export IBIS_TEST_DATA_DIRECTORY
-    IBIS_TEST_DATA_DIRECTORY="$(mktemp -d)"
+    IBIS_TEST_DATA_DIRECTORY="ci/ibis-testing-data"
+
+    mkdir -p "$IBIS_TEST_DATA_DIRECTORY"

    # copy the test data to a directory
    rsync --chmod=Du+rwx,Fu+rw --archive "${ibisTestingData}/" "$IBIS_TEST_DATA_DIRECTORY"
@ -147,16 +141,16 @@ buildPythonPackage rec {

  passthru = {
    optional-dependencies = {
-      clickhouse = [ clickhouse-cityhash clickhouse-driver lz4 ];
+      clickhouse = [ clickhouse-cityhash clickhouse-driver lz4 sqlglot ];
      dask = [ dask pyarrow ];
      datafusion = [ datafusion ];
-      duckdb = [ duckdb duckdb-engine sqlalchemy ];
+      duckdb = [ duckdb duckdb-engine pyarrow sqlalchemy sqlglot ];
      geospatial = [ geoalchemy2 geopandas shapely ];
-      mysql = [ pymysql sqlalchemy ];
+      mysql = [ sqlalchemy pymysql sqlglot ];
      pandas = [ ];
-      postgres = [ psycopg2 sqlalchemy ];
+      postgres = [ psycopg2 sqlalchemy sqlglot ];
      pyspark = [ pyarrow pyspark ];
-      sqlite = [ sqlalchemy sqlite ];
+      sqlite = [ sqlalchemy sqlite sqlglot ];
      visualization = [ graphviz-nox ];
    };
  };
--- a/pkgs/development/python-modules/pycocotools/default.nix
+++ b/pkgs/development/python-modules/pycocotools/default.nix
@ -7,12 +7,12 @@

 buildPythonPackage rec {
  pname = "pycocotools";
-  version = "2.0.4";
+  version = "2.0.5";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "2ab586aa389b9657b6d73c2b9a827a3681f8d00f36490c2e8ab05902e3fd9e93";
+    sha256 = "sha256-QdH7Bi31urXrw+kpcUVaoIlHnnzRBVMnjKVGKLncm/U=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/smhi-pkg/default.nix
+++ b/pkgs/development/python-modules/smhi-pkg/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "smhi-pkg";
-  version = "1.0.15";
+  version = "1.0.16";

  src = fetchFromGitHub {
    owner = "joysoftware";
    repo = "pypi_smhi";
-    rev = version;
-    sha256 = "sha256-tBNmfn2hBkS36B9zKDP+TgqeumbgzBVDiJ5L54RaSc8=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-jcIXzAZO9SxC/0apdjAVv1GmBTbdlasfXr1/Tj9adNc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/sqlglot/default.nix
+++ b/pkgs/development/python-modules/sqlglot/default.nix
@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, python-dateutil
+, duckdb
+}:
+buildPythonPackage rec {
+  pname = "sqlglot";
+  version = "6.0.7";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    repo = "sqlglot";
+    owner = "tobymao";
+    rev = "v${version}";
+    hash = "sha256-7PBhf9NN/mCi92xSkB9ygfmfxTyOYaEyrNvL309sG5Y=";
+  };
+
+  propagatedBuildInputs = [ python-dateutil ];
+
+  checkInputs = [ pytestCheckHook duckdb ];
+
+  pythonImportsCheck = [ "sqlglot" ];
+
+  meta = with lib; {
+    description = "A no dependency Python SQL parser, transpiler, and optimizer";
+    homepage = "https://github.com/tobymao/sqlglot";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
--- a/pkgs/development/python-modules/stanza/default.nix
+++ b/pkgs/development/python-modules/stanza/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "stanza";
-  version = "1.4.0";
+  version = "1.4.2";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "stanfordnlp";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-EAES3UpJqE7wmvCPycFhwI1lMrReN+L6W8CEDwdHTlA=";
+    hash = "sha256-v4/wYfXqOwSXxx864LNxviRtsqu5DXqs9diswA1oZXc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@ -132,12 +132,12 @@ rec {
    headers = "09dbx4qh0rgp5mdm6srz6fgx12zq6b9jqq1k6l3gzyvwigi3wny1";
  };

-  electron_20 = mkElectron "20.1.0" {
-    armv7l-linux = "3efbf6ca2e54f8292a521f368b710ae043a91ef1943a93b26a27860a494fbd49";
-    aarch64-linux = "b5ae63ee40b486058e234392e8ed959ca0b51de570cb6454cd787a41258385a9";
-    x86_64-linux = "46e334eeb03ad12b987b4d6d1ba176d4389fe54f6435e7dd3d7ebc840259847e";
-    x86_64-darwin = "5d790a90a6a156d846157e4ae210fd4c1013356a2849681b762e7dd8828bfedf";
-    aarch64-darwin = "551c7f9ecf3f9d40572b3971b02c30e492134ff9400d97d3055fa7d089eff3eb";
-    headers = "1m05pz5baypyphmxhnsbcxn9cn3s4ajjiwnk1iscjnm394y8vlhb";
+  electron_20 = mkElectron "20.1.3" {
+    armv7l-linux = "99710a57c55d95b540f4c3568da2a7caccb7f91da23b530c8c40db5ac861ab24";
+    aarch64-linux = "8f39562f20210d7cdedbb063683d632df442c8553f62104c7d676121f3d9a357";
+    x86_64-linux = "219fb6f01305669f78cf1881d257e3cc48e5563330338516f8b6592d85fdb4a3";
+    x86_64-darwin = "134714291dcbecbf10cbc27c490a6501e2810bd4147a74f3b2671503445f2ce8";
+    aarch64-darwin = "a09f83442f1e9f4b1edc07445a1dca73d9597529b23d62731eaa3fa0488f4ab0";
+    headers = "11cv0p52864k4knwlwakiq8v6rxdv3iz6kvwhn0w8mpap2h5pzii";
  };
 }
--- a/pkgs/development/tools/go-swag/default.nix
+++ b/pkgs/development/tools/go-swag/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "go-swag";
-  version = "1.8.5";
+  version = "1.8.6";

  src = fetchFromGitHub {
    owner = "swaggo";
    repo = "swag";
    rev = "v${version}";
-    sha256 = "sha256-S+WhBenTMyN7nM/UQIuMH1t9I/DRzQWN6g6tOWT71uo=";
+    sha256 = "sha256-WpxKddCwlsOu1xL/HcxuA07oucYobRSJfoWHG2QieVQ=";
  };

  vendorSha256 = "sha256-RqhGGIwruAlrif2FZ+tvsicns56Ifjpy2ZHovDyjdB4=";
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "oh-my-posh";
-  version = "9.3.1";
+  version = "9.4.0";

  src = fetchFromGitHub {
    owner = "jandedobbeleer";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-dVHf6nm7IRMpZ8Tx4VxRfBb8HOEfWc/5LgWZQ5LDbuk=";
+    sha256 = "sha256-biMqihvGW+rsNhM/kXQb3px5aRtyvAI0cxDQ9KDK7y4=";
  };

  vendorSha256 = "sha256-A4+sshIzPla7udHfnMmbFqn+fW3SOCrI6g7tArzmh1E=";
--- a/pkgs/development/tools/rust/cargo-temp/default.nix
+++ b/pkgs/development/tools/rust/cargo-temp/default.nix
@ -0,0 +1,22 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-temp";
+  version = "0.2.13";
+
+  src = fetchFromGitHub {
+    owner = "yozhgoor";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0g9ddzvgrb45ddflbcwpq320zwj4qrxfs07dydy6r86whdn1mlc0";
+  };
+
+  cargoSha256 = "sha256-5E1Fkipqb2nONQNAuj9xKn8k2PhH9IZ48UosNlPpP6c=";
+
+  meta = with lib; {
+    description = "A CLI tool that allow you to create a temporary new Rust project using cargo with already installed dependencies";
+    homepage = "https://github.com/yozhgoor/cargo-temp";
+    license = with licenses; [ mit /* or */ asl20 ];
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
--- a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@ -1,12 +1,18 @@
-{ stdenvNoCC, fetchzip, lib }:
+let
+  source = import ./source.nix;
+in {
+  stdenvNoCC,
+  fetchzip,
+  lib,
+}:

 stdenvNoCC.mkDerivation rec {
  pname = "linux-firmware";
-  version = "20220815";
+  version = source.version;

  src = fetchzip {
    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${version}.tar.gz";
-    sha256 = "sha256-StPlnwn4KOvOf4fRblDzJQqyI8iIz8e9fo/BsTyCKjI=";
+    hash = source.sourceHash;
  };

  installFlags = [ "DESTDIR=$(out)" ];
@ -16,7 +22,7 @@ stdenvNoCC.mkDerivation rec {

  outputHashMode = "recursive";
  outputHashAlgo = "sha256";
-  outputHash = "sha256-VTRrOOkdWepUCKAkziO/0egb3oaQEOJCtsuDEgs/W78=";
+  outputHash = source.outputHash;

  meta = with lib; {
    description = "Binary firmware collection packaged by kernel.org";
--- a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@ -0,0 +1,6 @@
+# This file is autogenerated! Run ./update.sh to regenerate.
+{
+  version = "20220913";
+  sourceHash = "sha256-qxSgkytJBW9ux95tEOHfz/4pvOp5TII3ICAY7dg5UC8=";
+  outputHash = "sha256-eVDXNyx9gwa46pBmsoTU9bQ2XBzkjVocIHydieJ9ruU=";
+}
--- a/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$(readlink -f "$0")")" || exit
+
+# step 1: figure out the latest version from the tags
+repo="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git"
+latestTag="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
+
+# step 2: prefetch the source tarball
+snapshotUrl="$repo/snapshot/linux-firmware-$latestTag.tar.gz"
+hash="$(nix-prefetch-url --unpack "$snapshotUrl")"
+sriHash="$(nix --experimental-features nix-command hash to-sri "sha256:$hash")"
+
+# step 3: rebuild as a non-FO derivation to get the right hash
+cat > source.nix << EOF
+{
+  version = "$latestTag";
+  sourceHash = "$sriHash";
+  outputHash = null;
+}
+EOF
+
+outPath="$(nix --experimental-features "nix-command flakes" build ".#linux-firmware" --no-link --print-out-paths)"
+outHash="$(nix --experimental-features nix-command hash path "$outPath")"
+
+# step 4: generate the final file
+cat > source.nix << EOF
+# This file is autogenerated! Run ./update.sh to regenerate.
+{
+  version = "$latestTag";
+  sourceHash = "$sriHash";
+  outputHash = "$outHash";
+}
+EOF
--- a/pkgs/servers/etcd/3.5.nix
+++ b/pkgs/servers/etcd/3.5.nix
@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, symlinkJoin }:

 let
-  version = "3.5.4";
+  version = "3.5.5";

  src = fetchFromGitHub {
    owner = "etcd-io";
    repo = "etcd";
    rev = "v${version}";
-    sha256 = "sha256-mTQHxLLfNiihvHg5zaTeVNWKuzvE0KBiJdY3qMJHMCM=";
+    sha256 = "sha256-V10aeYwr1ZS990lYZELJjq8NX7cBs0bzlYYzoYWS3zQ=";
  };

  CGO_ENABLED = 0;
@ -25,7 +25,7 @@ let

    inherit CGO_ENABLED meta src version;

-    vendorSha256 = "sha256-4djUQvWp9hScua9l1ZTq298zWSeDYRDojEt2AWmarzw=";
+    vendorSha256 = "sha256-BTIrLgUXnV+0d0DTKE3TvvW2JH4oSE+SnJs+yfH26Ms=";

    modRoot = "./server";

@ -45,7 +45,7 @@ let

    inherit CGO_ENABLED meta src version;

-    vendorSha256 = "sha256-nk56XGpNsDwcGrTKithKGnPCX0NhpQmzNSXHk3vmdtg=";
+    vendorSha256 = "sha256-yUgrKIjCtYTLmdZe1p9Rx9MUZzqOAmNF4tUckJgF8Ks=";

    modRoot = "./etcdutl";
  };
@ -55,7 +55,7 @@ let

    inherit CGO_ENABLED meta src version;

-    vendorSha256 = "sha256-WIMYrXfay6DMz+S/tIc/X4ffMizxub8GS1DDgIR40D4=";
+    vendorSha256 = "sha256-qT8OJg4aTzz0p0s6yhmDYcfJ0p9KNbnlRbOCfOao0vk=";

    modRoot = "./etcdctl";
  };
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@ -15,16 +15,16 @@ let
 in
 buildGoModule rec {
  pname = "minio";
-  version = "2022-09-07T22-25-02Z";
+  version = "2022-09-17T00-09-45Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "minio";
    rev = "RELEASE.${version}";
-    sha256 = "sha256-zLnYORTCYuinZEeut5fC1XS1Kj7o4c1Y6GMioSvXII4=";
+    sha256 = "sha256-lkb3mxUICToDQrhVltpxB1c/UB8LV2MRKR1Q+xQtlII=";
  };

-  vendorSha256 = "sha256-DL2hIvwflZf+jH73hhFtqK4yNbMcCXIghSVlBiSzvLk=";
+  vendorSha256 = "sha256-V6YP9DvtFd44gLESuASoDOLMesnTZLsWfuMHyQ6w6Bc=";

  doCheck = false;

--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@ -8,11 +8,11 @@ let
  py = python3.override {
    packageOverrides = self: super: {
      awscrt = super.awscrt.overridePythonAttrs (oldAttrs: rec {
-        version = "0.13.11";
+        version = "0.14.0";
        src = self.fetchPypi {
          inherit (oldAttrs) pname;
          inherit version;
-          sha256 = "sha256-Yx3I3RD57Nx6Cvm4moc5zmMbdsHeYiMghDfbQUor38E=";
+          sha256 = "sha256-MGLTFcsWVC/gTdgjny6LwyOO6QRc1QcLkVzy677Lqqw=";
        };
      });
    };
@ -21,13 +21,13 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.7.20"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.7.33"; # N.B: if you change this, check if overrides are still up-to-date

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    rev = version;
-    sha256 = "sha256-o6rs9OMP3154WApboSqUfVn3TRxap0htHczyjAMQe2I=";
+    sha256 = "sha256-9X056Xc9DPp8BiuAeCvQrswcj7mnZKrkMOad5aP1TI8=";
  };

  propagatedBuildInputs = [
@ -61,7 +61,7 @@ with py.pkgs; buildPythonApplication rec {
      --replace "colorama>=0.2.5,<0.4.4" "colorama" \
      --replace "cryptography>=3.3.2,<37.0.0" "cryptography" \
      --replace "docutils>=0.10,<0.16" "docutils" \
-      --replace "ruamel.yaml>=0.15.0,<0.16.0" "ruamel.yaml" \
+      --replace "ruamel.yaml>=0.15.0,<=0.17.21" "ruamel.yaml" \
      --replace "wcwidth<0.2.0" "wcwidth" \
      --replace "prompt-toolkit>=3.0.24,<3.0.29" "prompt-toolkit~=3.0" \
      --replace "distro>=1.5.0,<1.6.0" "distro"
--- a/pkgs/tools/admin/fastlane/Gemfile.lock
+++ b/pkgs/tools/admin/fastlane/Gemfile.lock
@ -8,8 +8,8 @@ GEM
    artifactory (3.0.15)
    atomos (0.1.3)
    aws-eventstream (1.2.0)
-    aws-partitions (1.622.0)
-    aws-sdk-core (3.136.0)
+    aws-partitions (1.631.0)
+    aws-sdk-core (3.149.0)
      aws-eventstream (~> 1, >= 1.0.2)
      aws-partitions (~> 1, >= 1.525.0)
      aws-sigv4 (~> 1.1)
@ -66,7 +66,7 @@ GEM
    faraday_middleware (1.2.0)
      faraday (~> 1.0)
    fastimage (2.2.6)
-    fastlane (2.209.1)
+    fastlane (2.210.0)
      CFPropertyList (>= 2.3, < 4.0.0)
      addressable (>= 2.8, < 3.0.0)
      artifactory (~> 3.0)
@ -106,9 +106,9 @@ GEM
      xcpretty (~> 0.3.0)
      xcpretty-travis-formatter (>= 0.0.3)
    gh_inspector (1.1.3)
-    google-apis-androidpublisher_v3 (0.25.0)
+    google-apis-androidpublisher_v3 (0.26.0)
      google-apis-core (>= 0.7, < 2.a)
-    google-apis-core (0.7.0)
+    google-apis-core (0.8.0)
      addressable (~> 2.5, >= 2.5.1)
      googleauth (>= 0.16.2, < 2.a)
      httpclient (>= 2.8.1, < 3.a)
@ -128,7 +128,7 @@ GEM
      google-cloud-errors (~> 1.0)
    google-cloud-env (1.6.0)
      faraday (>= 0.17.3, < 3.0)
-    google-cloud-errors (1.2.0)
+    google-cloud-errors (1.3.0)
    google-cloud-storage (1.37.0)
      addressable (~> 2.8)
      digest-crc (~> 0.4)
--- a/pkgs/tools/admin/fastlane/gemset.nix
+++ b/pkgs/tools/admin/fastlane/gemset.nix
@ -45,10 +45,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1py4q91ll3v7ylcqflgd190y40d3ixgrhpln011gr5adgbzg9hr6";
+      sha256 = "1xp068c7sn3n1w1ffvmc7bgjvp1bwkwcfr2gmik7h6mckdq6fl0q";
      type = "gem";
    };
-    version = "1.622.0";
+    version = "1.631.0";
  };
  aws-sdk-core = {
    dependencies = ["aws-eventstream" "aws-partitions" "aws-sigv4" "jmespath"];
@ -56,10 +56,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "111zdfl6p1n949rvsfr0c88k9yzpibrcd8fihyshbibc2w06qj2b";
+      sha256 = "10zhnnsvp8pdc97jqgs3l98l4j6rm2y97f60kyx6d8kkpvz7rjc8";
      type = "gem";
    };
-    version = "3.136.0";
+    version = "3.149.0";
  };
  aws-sdk-kms = {
    dependencies = ["aws-sdk-core" "aws-sigv4"];
@ -368,10 +368,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "17m4nrpsjx2kadgy3qasis9d8rzajxgi9gzwkvdj7c0jjs6a768d";
+      sha256 = "0wam1ddxjmwdhygg54w69k7xqbc94xba25cx5bmz839pa3ail58b";
      type = "gem";
    };
-    version = "2.209.1";
+    version = "2.210.0";
  };
  gh_inspector = {
    groups = ["default"];
@ -389,10 +389,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0psz3w8c95ashk5hlfvn5l32mg111z7fv07ngvvgm5mkw6wksh4d";
+      sha256 = "0hrs7mm4fp3cd3w1zn2cf6k6ns20q6i4ywz3h0zmaxjfkxik90fy";
      type = "gem";
    };
-    version = "0.25.0";
+    version = "0.26.0";
  };
  google-apis-core = {
    dependencies = ["addressable" "googleauth" "httpclient" "mini_mime" "representable" "retriable" "rexml" "webrick"];
@ -400,10 +400,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07jhk74awjc1npf2rim4kmwz4v0n3ny6y5g31saq7aqxkjmlp3hd";
+      sha256 = "0ykzjp7lz28mz9zah6jbkkyicv9r4p53gq6zdh0iy1v08hpi4f4d";
      type = "gem";
    };
-    version = "0.7.0";
+    version = "0.8.0";
  };
  google-apis-iamcredentials_v1 = {
    dependencies = ["google-apis-core"];
@ -465,10 +465,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0nakfswnck6grjpyhckzl40qccyys3sy999h5axk0rldx96fnivd";
+      sha256 = "0jynh1s93nl8njm5l5wcy86pnjmv112cq6m0443s52f04hg6h2s5";
      type = "gem";
    };
-    version = "1.2.0";
+    version = "1.3.0";
  };
  google-cloud-storage = {
    dependencies = ["addressable" "digest-crc" "google-apis-iamcredentials_v1" "google-apis-storage_v1" "google-cloud-core" "googleauth" "mini_mime"];
--- a/pkgs/tools/misc/opentelemetry-collector/contrib.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "opentelemetry-collector-contrib";
-  version = "0.59.0";
+  version = "0.60.0";

  src = fetchFromGitHub {
    owner = "open-telemetry";
    repo = "opentelemetry-collector-contrib";
    rev = "v${version}";
-    sha256 = "sha256-snkrgitPtrdX5LuMscmeeY9KQeBGsPApaDc2LRfRKJ0=";
+    sha256 = "sha256-dHxcV98z4LPI40qobNpcUTFFB4lf2FEf+f5N/50LtE4=";
  };
  # proxy vendor to avoid hash missmatches between linux and macOS
  proxyVendor = true;
-  vendorSha256 = "sha256-u0JC/4Pav0ZZIvOzE22kdUWR5wgYAUN8/fKfjsDev0g=";
+  vendorSha256 = "sha256-p1jyycI9dRXVwLjXON13GT64SsPVhBIRPa14O6q+klk=";

  subPackages = [ "cmd/otelcontribcol" ];

--- a/pkgs/tools/misc/opentelemetry-collector/default.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/default.nix
@ -12,17 +12,17 @@ let
 in
 buildGoModule rec {
  pname = "opentelemetry-collector";
-  version = "0.59.0";
+  version = "0.60.0";

  src = fetchFromGitHub {
    owner = "open-telemetry";
    repo = "opentelemetry-collector";
    rev = "v${version}";
-    sha256 = "sha256-eNndY3BPdeFO9cihfkPWlDVwWfNZWnjL5gJCxlgJn9c=";
+    sha256 = "sha256-zES2795gyMQ/VoRR4/dpUsqJlGnxl0Ac9Gb05lboWlI=";
  };
  # there is a nested go.mod
  sourceRoot = "source/cmd/otelcorecol";
-  vendorSha256 = "sha256-+i8uKR5EZXTmOnuwoeM6Vpt934v0egSjC951ryXaZS0=";
+  vendorSha256 = "sha256-9YKeHCFrN7drHJpk2k9M0VGvZ54kSSb9bAiyDFEiX+g=";

  preBuild = ''
    # set the build version, can't be done via ldflags
--- a/pkgs/tools/networking/curl-impersonate/default.nix
+++ b/pkgs/tools/networking/curl-impersonate/default.nix
@ -0,0 +1,27 @@
+#TODO: It should be possible to build this from source, but it's currently a lot faster to just package the binaries.
+{ lib, stdenv, fetchzip, zlib, autoPatchelfHook }:
+stdenv.mkDerivation rec {
+  pname = "curl-impersonate-bin";
+  version = "v0.5.3";
+
+  src = fetchzip {
+    url = "https://github.com/lwthiker/curl-impersonate/releases/download/${version}/curl-impersonate-${version}.x86_64-linux-gnu.tar.gz";
+    sha256 = "sha256-+cH1swAIadIrWG9anzf0dcW6qyBjcKsUHFWdv75F49g=";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook zlib ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp * $out/bin
+  '';
+
+  meta = with lib; {
+    description = "curl-impersonate: A special build of curl that can impersonate Chrome & Firefox ";
+    homepage = "https://github.com/lwthiker/curl-impersonate";
+    license = with licenses; [ curl mit ];
+    maintainers = with maintainers; [ deliciouslytyped ];
+    platforms = platforms.linux; #TODO I'm unsure about the restrictions here, feel free to expand the platforms it if it works elsewhere.
+  };
+}
--- a/pkgs/tools/networking/xdp-tools/default.nix
+++ b/pkgs/tools/networking/xdp-tools/default.nix
@ -0,0 +1,80 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, libbpf
+, elfutils
+, zlib
+, libpcap
+, llvmPackages
+, pkg-config
+, m4
+, emacs-nox
+, wireshark-cli
+, nukeReferences
+}:
+stdenv.mkDerivation rec {
+  pname = "xdp-tools";
+  version = "1.2.6";
+
+  src = fetchFromGitHub {
+    owner = "xdp-project";
+    repo = "xdp-tools";
+    rev = "v${version}";
+    sha256 = "xKxR20Jz+pGKzazFoZe0i0pv7AuaxdL8Yt3IE4JAje8=";
+  };
+
+  outputs = [ "out" "lib" ];
+
+  patches = [
+    (fetchpatch {
+      # Compat with libbpf 1.0: https://github.com/xdp-project/xdp-tools/pull/221
+      url = "https://github.com/xdp-project/xdp-tools/commit/f8592d0609807f5b2b73d27eb3bd623da4bd1997.diff";
+      sha256 = "+NpR0d5YE1TMFeyidBuXCDkcBTa2W0094nqYiEWKpY4=";
+    })
+  ];
+
+  buildInputs = [
+    libbpf
+    elfutils
+    libpcap
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    llvmPackages.clang
+    llvmPackages.llvm
+    pkg-config
+    m4
+    emacs-nox # to generate man pages from .org
+    nukeReferences
+  ];
+  checkInputs = [
+    wireshark-cli # for tshark
+  ];
+
+  # When building BPF, the default CC wrapper is interfering a bit too much.
+  BPF_CFLAGS = "-fno-stack-protector -Wno-error=unused-command-line-argument";
+
+  PRODUCTION = 1;
+  DYNAMIC_LIBXDP = 1;
+  FORCE_SYSTEM_LIBBPF = 1;
+  FORCE_EMACS = 1;
+
+  makeFlags = [ "PREFIX=$(out)" "LIBDIR=$(lib)/lib" ];
+
+  postInstall = ''
+    # Note that even the static libxdp would refer to BPF_OBJECT_DIR ?=$(LIBDIR)/bpf
+    rm "$lib"/lib/*.a
+    # Drop unfortunate references to glibc.dev/include at least from $lib
+    nuke-refs "$lib"/lib/bpf/*.o
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/xdp-project/xdp-tools";
+    description = "Library and utilities for use with XDP";
+    license = with licenses; [ gpl2 lgpl21 bsd2 ];
+    maintainers = with maintainers; [ tirex vcunat ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/tools/system/gdu/default.nix
+++ b/pkgs/tools/system/gdu/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "gdu";
-  version = "5.18.0";
+  version = "5.18.1";

  src = fetchFromGitHub {
    owner = "dundee";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-JmxnpMKzQorStGJqwQoblmdsGZxd7/XTPDcfje/IkCQ=";
+    sha256 = "sha256-Bz7oiW8UEnin3Wd8nYrqk5WI7EbRHSCsoxpuWXzHK5c=";
  };

  vendorSha256 = "sha256-rppVLeX1VDOW+eUHSM77DgY2KjOrUHdyqGWRAYRIbUE=";
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -5511,6 +5511,8 @@ with pkgs;

  curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };

+  curl-impersonate-bin = callPackage ../tools/networking/curl-impersonate { };
+
  curlie = callPackage ../tools/networking/curlie { };

  cunit = callPackage ../tools/misc/cunit { };
@ -12376,6 +12378,10 @@ with pkgs;

  xdg-launch = callPackage ../applications/misc/xdg-launch { };

+  xdp-tools = callPackage ../tools/networking/xdp-tools {
+    llvmPackages = llvmPackages_14;
+  };
+
  xkbvalidate = callPackage ../tools/X11/xkbvalidate { };

  xkeysnail = callPackage ../tools/X11/xkeysnail { };
@ -12993,6 +12999,16 @@ with pkgs;
  semeru-bin = semeru-bin-17;
  semeru-jre-bin = semeru-jre-bin-17;

+  adoptopenjdk-bin-17-packages-linux = import ../development/compilers/adoptopenjdk-bin/jdk17-linux.nix { inherit lib; };
+  adoptopenjdk-bin-17-packages-darwin = import ../development/compilers/adoptopenjdk-bin/jdk17-darwin.nix { inherit lib; };
+
+  adoptopenjdk-hotspot-bin-17 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-17-packages-linux.jdk-hotspot {}
+    else callPackage adoptopenjdk-bin-17-packages-darwin.jdk-hotspot {};
+  adoptopenjdk-jre-hotspot-bin-17 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-17-packages-linux.jre-hotspot {}
+    else callPackage adoptopenjdk-bin-17-packages-darwin.jre-hotspot {};
+
  adoptopenjdk-hotspot-bin-16 = javaPackages.compiler.adoptopenjdk-16.jdk-hotspot;
  adoptopenjdk-jre-hotspot-bin-16 = javaPackages.compiler.adoptopenjdk-16.jre-hotspot;
  adoptopenjdk-openj9-bin-16 = javaPackages.compiler.adoptopenjdk-16.jdk-openj9;
@ -13975,6 +13991,12 @@ with pkgs;

  openjdk16-bootstrap = javaPackages.compiler.openjdk16-bootstrap;

+  openjdk18-bootstrap = javaPackages.compiler.openjdk18-bootstrap;
+  openjdk18 = javaPackages.compiler.openjdk18;
+  openjdk18_headless = javaPackages.compiler.openjdk18.headless;
+  jdk18 = openjdk18;
+  jdk18_headless = openjdk18_headless;
+
  /* default JDK */
  jdk = jdk17;

@ -14330,7 +14352,7 @@ with pkgs;

  muonlang = callPackage ../development/compilers/muonlang { };

-  inherit (callPackages ../development/compilers/nim { })
+  inherit (callPackages ../development/compilers/nim { openssl = openssl_1_1; })
    nim-unwrapped nimble-unwrapped nim;
  nimPackages = recurseIntoAttrs nim.pkgs;

@ -14623,6 +14645,7 @@ with pkgs;
  cargo-tally = callPackage ../development/tools/rust/cargo-tally {
    inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation IOKit;
  };
+  cargo-temp = callPackage ../development/tools/rust/cargo-temp { };
  cargo-udeps = callPackage ../development/tools/rust/cargo-udeps {
    inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
  };
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@ -90,6 +90,10 @@ in {
      ../development/compilers/adoptopenjdk-bin/jdk16-linux.nix
      ../development/compilers/adoptopenjdk-bin/jdk16-darwin.nix;

+    adoptopenjdk-17 = mkAdoptopenjdk
+      ../development/compilers/adoptopenjdk-bin/jdk17-linux.nix
+      ../development/compilers/adoptopenjdk-bin/jdk17-darwin.nix;
+
    openjdk8-bootstrap = mkBootstrap adoptopenjdk-8
      ../development/compilers/openjdk/bootstrap.nix
      { version = "8"; };
@ -129,6 +133,12 @@ in {
        inherit openjdk16-bootstrap;
      });

+    openjdk18-bootstrap = mkBootstrap adoptopenjdk-17
+      ../development/compilers/openjdk/17.nix
+      (bootstrapArgs // {
+        inherit openjdk17-bootstrap;
+      });
+
    openjdk8 = mkOpenjdk
      ../development/compilers/openjdk/8.nix
      ../development/compilers/openjdk/darwin/8.nix
@ -176,6 +186,14 @@ in {
        openjfx = openjfx17;
      };

+    openjdk18 = mkOpenjdk
+      ../development/compilers/openjdk/18.nix
+      ../development/compilers/openjdk/darwin/18.nix
+      {
+        inherit openjdk18-bootstrap;
+        openjfx = openjfx17;
+      };
+
    temurin-bin = recurseIntoAttrs (callPackage (
      if stdenv.isLinux
      then ../development/compilers/temurin-bin/jdk-linux.nix
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -10483,6 +10483,8 @@ in {

  sqlalchemy-utils = callPackage ../development/python-modules/sqlalchemy-utils { };

+  sqlglot = callPackage ../development/python-modules/sqlglot { };
+
  sqlitedict = callPackage ../development/python-modules/sqlitedict { };

  sqlite-fts4 = callPackage ../development/python-modules/sqlite-fts4 { };