Merge staging-next into staging

2023-03-18 06:01:47 +00:00 · 2023-03-18 06:01:47 +00:00 · ad9c132f13
parent d681bc8661 36748936f9
commit ad9c132f13
25 changed files with 722 additions and 188 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -7712,6 +7712,13 @@
    githubId = 87115;
    name = "Wael Nasreddine";
  };
+  kalebpace = {
+    email = "kaleb.pace@pm.me";
+    matrix = "@kalebpace:matrix.org";
+    github = "kalebpace";
+    githubId = 5586615;
+    name = "Kaleb Pace";
+  };
  kalekseev = {
    email = "mail@kalekseev.com";
    github = "kalekseev";
--- a/maintainers/scripts/fetch-kde-qt.sh
+++ b/maintainers/scripts/fetch-kde-qt.sh
@ -127,8 +127,7 @@ echo "$urllist" | xargs wget $wgetargs -nH -r -c --no-parent && {

    # TODO fetch only missing tar.xz files
    echo "fetching $filecount tar.xz files ..."
-    urllist="$(echo "$filelist" | while read file; do echo "$BASE_URL/$file"; done)"
-    echo "$urllist" | xargs wget $wgetargs -nH -r -c --no-parent
+    echo "$filelist" | xargs wget $wgetargs -nH -r -c --no-parent

    echo "generating sha256 files ..."
    find . -type f -name '*.tar.xz' | while read src; do
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -71,6 +71,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [photoprism](https://photoprism.app/), a AI-Powered Photos App for the Decentralized Web. Available as [services.photoprism](options.html#opt-services.photoprism.enable).

+- [peroxide](https://github.com/ljanyst/peroxide), a fork of the official [ProtonMail bridge](https://github.com/ProtonMail/proton-bridge) that aims to be similar to [Hydroxide](https://github.com/emersion/hydroxide). Available as [services.peroxide](#opt-services.peroxide.enable).
+
 - [autosuspend](https://github.com/languitar/autosuspend), a python daemon that suspends a system if certain conditions are met, or not met.

 - [sharing](https://github.com/parvardegr/sharing), a command-line tool to share directories and files from the CLI to iOS and Android devices without the need of an extra client app. Available as [programs.sharing](#opt-programs.sharing.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -949,6 +949,7 @@
  ./services/networking/owamp.nix
  ./services/networking/pdns-recursor.nix
  ./services/networking/pdnsd.nix
+  ./services/networking/peroxide.nix
  ./services/networking/pixiecore.nix
  ./services/networking/pleroma.nix
  ./services/networking/polipo.nix
--- a/nixos/modules/services/networking/peroxide.nix
+++ b/nixos/modules/services/networking/peroxide.nix
@ -0,0 +1,131 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.peroxide;
+  settingsFormat = pkgs.formats.yaml { };
+  stateDir = "peroxide";
+in
+{
+  options.services.peroxide = {
+    enable = mkEnableOption (lib.mdDoc "enable");
+
+    package = mkPackageOptionMD pkgs "peroxide" {
+      default = [ "peroxide" ];
+    };
+
+    logLevel = mkOption {
+      # https://github.com/sirupsen/logrus#level-logging
+      type = types.enum [ "Panic" "Fatal" "Error" "Warning" "Info" "Debug" "Trace" ];
+      default = "Warning";
+      example = "Info";
+      description = lib.mdDoc "Only log messages of this priority or higher.";
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+
+        options = {
+          UserPortImap = mkOption {
+            type = types.port;
+            default = 1143;
+            description = lib.mdDoc "The port on which to listen for IMAP connections.";
+          };
+
+          UserPortSmtp = mkOption {
+            type = types.port;
+            default = 1025;
+            description = lib.mdDoc "The port on which to listen for SMTP connections.";
+          };
+
+          ServerAddress = mkOption {
+            type = types.str;
+            default = "[::0]";
+            example = "localhost";
+            description = lib.mdDoc "The address on which to listen for connections.";
+          };
+        };
+      };
+      default = { };
+      description = lib.mdDoc ''
+        Configuration for peroxide.  See
+        [config.example.yaml](https://github.com/ljanyst/peroxide/blob/master/config.example.yaml)
+        for an example configuration.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.peroxide.settings = {
+      # peroxide deletes the cache directory on startup, which requires write
+      # permission on the parent directory, so we can't use
+      # /var/cache/peroxide
+      CacheDir = "/var/cache/peroxide/cache";
+      X509Key = mkDefault "/var/lib/${stateDir}/key.pem";
+      X509Cert = mkDefault "/var/lib/${stateDir}/cert.pem";
+      CookieJar = "/var/lib/${stateDir}/cookies.json";
+      CredentialsStore = "/var/lib/${stateDir}/credentials.json";
+    };
+
+    users.users.peroxide = {
+      isSystemUser = true;
+      group = "peroxide";
+    };
+    users.groups.peroxide = { };
+
+    systemd.services.peroxide = {
+      description = "Peroxide ProtonMail bridge";
+      requires = [ "network.target" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      restartTriggers = [ config.environment.etc."peroxide.conf".source ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = "peroxide";
+        LogsDirectory = "peroxide";
+        LogsDirectoryMode = "0750";
+        # Specify just "peroxide" so that the user has write permission, because
+        # peroxide deletes and recreates the cache directory on startup.
+        CacheDirectory = [ "peroxide" "peroxide/cache" ];
+        CacheDirectoryMode = "0700";
+        StateDirectory = stateDir;
+        StateDirectoryMode = "0700";
+        ExecStart = "${cfg.package}/bin/peroxide -log-file=/var/log/peroxide/peroxide.log -log-level ${cfg.logLevel}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+      };
+
+      preStart = ''
+        # Create a self-signed certificate if no certificate exists.
+        if [[ ! -e "${cfg.settings.X509Key}" && ! -e "${cfg.settings.X509Cert}" ]]; then
+            ${cfg.package}/bin/peroxide-cfg -action gen-x509 \
+              -x509-org 'N/A' \
+              -x509-cn 'nixos' \
+              -x509-cert "${cfg.settings.X509Cert}" \
+              -x509-key "${cfg.settings.X509Key}"
+        fi
+      '';
+    };
+
+    # https://github.com/ljanyst/peroxide/blob/master/peroxide.logrotate
+    services.logrotate.settings.peroxide = {
+      files = "/var/log/peroxide/peroxide.log";
+      rotate = 31;
+      frequency = "daily";
+      compress = true;
+      delaycompress = true;
+      missingok = true;
+      notifempty = true;
+      su = "peroxide peroxide";
+      postrotate = "systemctl reload peroxide";
+    };
+
+    environment.etc."peroxide.conf".source = settingsFormat.generate "peroxide.conf" cfg.settings;
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with maintainers; [ aanderse aidalgol ];
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -528,6 +528,7 @@ in {
  peerflix = handleTest ./peerflix.nix {};
  peering-manager = handleTest ./web-apps/peering-manager.nix {};
  peertube = handleTestOn ["x86_64-linux"] ./web-apps/peertube.nix {};
+  peroxide = handleTest ./peroxide.nix {};
  pgadmin4 = handleTest ./pgadmin4.nix {};
  pgjwt = handleTest ./pgjwt.nix {};
  pgmanage = handleTest ./pgmanage.nix {};
--- a/nixos/tests/peroxide.nix
+++ b/nixos/tests/peroxide.nix
@ -0,0 +1,16 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "peroxide";
+  meta.maintainers = with lib.maintainers; [ aidalgol ];
+
+  nodes.machine =
+    { config, pkgs, ... }: {
+      networking.hostName = "nixos";
+      services.peroxide.enable = true;
+    };
+
+  testScript = ''
+    machine.wait_for_unit("peroxide.service")
+    machine.wait_for_open_port(1143) # IMAP
+    machine.wait_for_open_port(1025) # SMTP
+  '';
+})
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -931,8 +931,8 @@ let
          # semver scheme, contrary to preview versions which are listed on
          # the VSCode Marketplace and use a calver scheme. We should avoid
          # using preview versions, because they expire after two weeks.
-          version = "13.3.2";
-          sha256 = "sha256-4o4dmjio/I531szcoeGPVtfrNAyRAPJRrmsNny/PY2w=";
+          version = "13.4.0";
+          sha256 = "sha256-CYI62sWPlJNRP2KIkg4vQutIMC6gaCxtTVoOWZIS8Lw=";
        };
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@ -1632,6 +1632,23 @@ let
        };
      };

+      kalebpace.balena-vscode = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "balena-vscode";
+          publisher = "kalebpace";
+          version = "0.1.3";
+          sha256 = "sha256-CecEv19nEtnMe0KlCMNBM9ZAjbAVgPNUcZ6cBxHw44M=";
+        };
+        meta = with lib; {
+          changelog = "https://marketplace.visualstudio.com/items/kalebpace.balena-vscode/changelog";
+          description = "VS Code extension for integration with Balena";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=kalebpace.balena-vscode";
+          homepage = "https://github.com/balena-vscode/balena-vscode";
+          license = licenses.mit;
+          maintainers = with maintainers; [ kalebpace ];
+        };
+      };
+
      kamadorueda.alejandra = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "alejandra";
--- a/pkgs/applications/graphics/rnote/default.nix
+++ b/pkgs/applications/graphics/rnote/default.nix
@ -24,19 +24,19 @@

 stdenv.mkDerivation rec {
  pname = "rnote";
-  version = "0.5.17";
+  version = "0.5.18";

  src = fetchFromGitHub {
    owner = "flxzt";
    repo = "rnote";
    rev = "v${version}";
-    hash = "sha256-/crqcp0oCq1f/5hnYfIcuSUzF5GmiAh2lLhQh+IzP4o=";
+    hash = "sha256-N07Y9kmGvMFS0Kq4i2CltJvNTuqbXausZZGjAQRDmNU=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-sfsk67zTmVPPtohJcgQ/OoMPeoNTo/zGs3hdA1D9SwM=";
+    hash = "sha256-ckYmoZLPPo/3WsdA0ir7iBJDqKn7ZAkN0f110ADSBC0=";
  };

  patches = [
--- a/pkgs/applications/misc/avizo/default.nix
+++ b/pkgs/applications/misc/avizo/default.nix
@ -1,8 +1,21 @@
-{ lib, stdenv, fetchFromGitHub
-, meson, ninja, pkg-config, vala
-, gtk3, glib, gtk-layer-shell
-, dbus, dbus-glib, librsvg
-, gobject-introspection, gdk-pixbuf, wrapGAppsHook
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, vala
+, gtk3
+, glib
+, gtk-layer-shell
+, dbus
+, dbus-glib
+, librsvg
+, gobject-introspection
+, gdk-pixbuf
+, wrapGAppsHook
+, pamixer
+, brightnessctl
 }:

 stdenv.mkDerivation rec {
@ -21,10 +34,8 @@ stdenv.mkDerivation rec {
  buildInputs = [ dbus dbus-glib gdk-pixbuf glib gtk-layer-shell gtk3 librsvg ];

  postInstall = ''
-    substituteInPlace "$out"/bin/volumectl \
-      --replace 'avizo-client' "$out/bin/avizo-client"
-    substituteInPlace "$out"/bin/lightctl \
-      --replace 'avizo-client' "$out/bin/avizo-client"
+    wrapProgram $out/bin/volumectl --suffix PATH : $out/bin:${lib.makeBinPath ([ pamixer ])}
+    wrapProgram $out/bin/lightctl --suffix PATH : $out/bin:${lib.makeBinPath ([ brightnessctl ])}
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -46,11 +46,11 @@
    "vendorHash": "sha256-JOaw8rKH7eb3RiP/FD+M7VEXCRfVuarTjfEusz1yGmQ="
  },
  "alicloud": {
-    "hash": "sha256-g+ksw5Yc3qiCGopxGMX9dEXCa3UDXfa8Evxx9qYjkzU=",
+    "hash": "sha256-L+KTE97aSrZI8Wn5SDKoNvsFO/con4IsNmrgWQymXno=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.201.1",
+    "rev": "v1.201.2",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -82,13 +82,13 @@
    "vendorHash": "sha256-99PwwxVHfRGC0QCQGhifRzqWFOHZ1R7Ge2ou7OjiggQ="
  },
  "auth0": {
-    "hash": "sha256-d5zM6FKFT9UFUyrm+5aF2wRvGsdtkq3Z8NvlsvZib7c=",
+    "hash": "sha256-y2pjk+rSLAM7H4XjwvwZSNFW4+9EhN3fb01cml6RTb0=",
    "homepage": "https://registry.terraform.io/providers/auth0/auth0",
    "owner": "auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v0.44.1",
+    "rev": "v0.45.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-vcKw8G9SqbP0wBnhLKJUz9ua1nGdP5ioZ+5ACxkeCZk="
+    "vendorHash": "sha256-cMB9iISEoTMFCA7YJQWZMocDlXXn8xNavDvFq9ypGec="
  },
  "avi": {
    "hash": "sha256-mBLdIL4mUI4zA3c9gB4DL1QY0xHW15Q1rO/v1gVYKYU=",
@ -337,13 +337,13 @@
    "vendorHash": "sha256-Id1rL/Mu/aES7OFQ/rQRMmm3D/GSbGofZludqbWffKo="
  },
  "docker": {
-    "hash": "sha256-M2K4N39vtVDA/vMp/s2KYiS/uoE+STf2e6yh6q0CS28=",
+    "hash": "sha256-UyHOI8C0eDV5YllAi9clHp/CEldHjIp3FHHMPy1rK58=",
    "homepage": "https://registry.terraform.io/providers/kreuzwerker/docker",
    "owner": "kreuzwerker",
    "repo": "terraform-provider-docker",
-    "rev": "v3.0.1",
+    "rev": "v3.0.2",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OdZQb81d7N1TdbDWEImq2U3kLkCPdhRk38+8T8fu+F4="
+    "vendorHash": "sha256-XxltOTtCgmJ9wZX8Yw39HkwVVZb58kZjAH7jfKPhjKM="
  },
  "elasticsearch": {
    "hash": "sha256-a6kHN3w0sQCP+0+ZtFwcg9erfVBYkhNo+yOrnwweGWo=",
@ -540,11 +540,11 @@
    "vendorHash": "sha256-rxh8Me+eOKPCbfHFT3tRsbM7JU67dBqv2JOiWArI/2Y="
  },
  "huaweicloud": {
-    "hash": "sha256-5Yw1b7tuGg8tDL1rQhqgFMTgtvc2k0n45dR5xvr7Dmo=",
+    "hash": "sha256-DYgqq4Joq7R9pljbtKi/Oi150qTxYK4hOLXu3h3ZcMI=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.45.1",
+    "rev": "v1.46.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -729,13 +729,13 @@
    "vendorHash": "sha256-QxbZv6YMa5/I4bTeQBNdmG3EKtLEmstnH7HMiZzFJrI="
  },
  "minio": {
-    "hash": "sha256-zfnldsJcr36RMwEcmoDiwko1f+VR9tlPVUe/OVgX4Bc=",
+    "hash": "sha256-eF3yT3cI+ODGN4nqf9rTy3PUev09KMGgzvaa4znPIm4=",
    "homepage": "https://registry.terraform.io/providers/aminueza/minio",
    "owner": "aminueza",
    "repo": "terraform-provider-minio",
-    "rev": "v1.12.0",
+    "rev": "v1.13.0",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-MLhHRMahJjTgQBzYkSaVv6wFm6b+YgpkitBHuj5B6po="
+    "vendorHash": "sha256-Tps4SoiSmGwPWZgf2Q1MilpLhKnB/TCFe35Hb4DfwaU="
  },
  "mongodbatlas": {
    "hash": "sha256-HkY2X6EbgObgXH2jLhQ96edlxMHytSGfXETQ5oXPI6M=",
@ -765,11 +765,11 @@
    "vendorHash": null
  },
  "newrelic": {
-    "hash": "sha256-1COn48CDGvRnM4M7tWZd5XxEW0vdeFmpOMEhi3sI2to=",
+    "hash": "sha256-EJpIITB6OF6TuFgQ4e9UIP7zaaFGc6DgR1fJ1pK2isc=",
    "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
    "owner": "newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v3.17.0",
+    "rev": "v3.17.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-QL9uEO89PwU8UFbLWCytXpzgrVeXKmaPmFm844ABAvI="
  },
@ -1099,11 +1099,11 @@
    "vendorHash": "sha256-GkmUKSnqkabwGCl22/90529BWb0oJaIJHYHlS/h3KNY="
  },
  "tencentcloud": {
-    "hash": "sha256-M1ymjlqA/rynuoGI9v1oO4+vaAWopvFezdPANn4oWNY=",
+    "hash": "sha256-E1L/xL+8xqNlJamklpgqq9HwdypRIh3jHTdkJtN+WVU=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.79.16",
+    "rev": "v1.79.17",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/instant-messengers/teams/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams/default.nix
@ -25,11 +25,11 @@ let
  pname = "teams";
  versions = {
    linux = "1.5.00.23861";
-    darwin = "1.5.00.22362";
+    darwin = "1.6.00.4464";
  };
  hashes = {
    linux = "sha256-h0YnCeJX//l4TegJVZtavV3HrxjYUF2Fa5KmaYmZW8E=";
-    darwin = "sha256-fbw6T+k6R5FyQ7XOKzyNYBvXlxH2xpJsBnsR1L+3Jmw=";
+    darwin = "sha256-DvXMrXotKWUqFCb7rZj8wU7mmZJKuTLGyx8qOB/aQtg=";
  };
  meta = with lib; {
    description = "Microsoft Teams";
--- a/pkgs/applications/networking/peroxide/default.nix
+++ b/pkgs/applications/networking/peroxide/default.nix
@ -0,0 +1,41 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, nixosTests
+}:
+
+buildGoModule rec {
+  pname = "peroxide";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "ljanyst";
+    repo = "peroxide";
+    rev = "v${version}";
+    sha256 = "sha256-6Jb1i4aNjeemiQp9FF/KGyZ+Evom9PPBvARbJWyrhok=";
+  };
+
+  vendorSha256 = "sha256-kuFlkkMkCKO5Rrh1EoyVdaykvxTfchK2l1/THqTBeAY=";
+
+  postPatch = ''
+    # These tests connect to the internet, which does not work in sandboxed
+    # builds, so skip these.
+    rm pkg/pmapi/dialer_pinning_test.go \
+       pkg/pmapi/dialer_proxy_provider_test.go \
+       pkg/pmapi/dialer_proxy_test.go
+  '';
+
+  passthru.tests.peroxide = nixosTests.peroxide;
+
+  meta = with lib; {
+    homepage = "https://github.com/ljanyst/peroxide";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ aidalgol ];
+    description = "Unofficial ProtonMail bridge";
+    longDescription = ''
+      Peroxide is a fork of the official ProtonMail bridge that aims to be
+      similar to Hydroxide while reusing as much code from the official bridge
+      as possible.
+    '';
+  };
+}
--- a/pkgs/build-support/rust/fetchcrate.nix
+++ b/pkgs/build-support/rust/fetchcrate.nix
@ -1,15 +1,17 @@
-{ lib, fetchzip }:
+{ lib, fetchzip, fetchurl }:

 { crateName ? args.pname
 , pname ? null
 , version
+, unpack ? true
 , ...
 } @ args:

 assert pname == null || pname == crateName;

-fetchzip ({
+(if unpack then fetchzip else fetchurl) ({
  name = "${crateName}-${version}.tar.gz";
  url = "https://crates.io/api/v1/crates/${crateName}/${version}/download";
+} // lib.optionalAttrs unpack {
  extension = "tar.gz";
-} // removeAttrs args [ "crateName" "pname" "version" ])
+} // removeAttrs args [ "crateName" "pname" "version" "unpack" ])
--- a/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@ -30,6 +31,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-IY+ml/ftLSk0A3Emi0ZL2wxIDIngNU6QKbHErRAaaMA=";
  };

+  patches = [
+    # MessageListItem: avoid crashing on empty Mime
+    # https://github.com/elementary/mail/pull/828
+    (fetchpatch {
+      url = "https://github.com/elementary/mail/commit/7cb412dee4cc8c0bfab55057c47d5ecce6918788.patch";
+      sha256 = "sha256-7rYvgFeVmV/rVYzC/xt/lioRlveM0d8ORqZdMYkm/d4=";
+    })
+  ];
+
  nativeBuildInputs = [
    libxml2
    meson
--- a/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix
+++ b/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenvNoCC
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , gettext
 , meson
@ -20,6 +21,27 @@ stdenvNoCC.mkDerivation rec {
    sha256 = "sha256-KUo9IbB10JRgFrn6I5y4+34PEihuwp78b+YsX2Wqip8=";
  };

+  patches = [
+    # All patches listed below are fixes for Epiphany 44.
+    # https://github.com/elementary/browser/discussions/82
+    (fetchpatch {
+      url = "https://github.com/elementary/stylesheet/commit/c0028159dd5a7767ead9a12e9a4cfb693159c823.patch";
+      sha256 = "sha256-JgJ6FoE2aSTmjJ7klAoYXITbxJwy1HFGvr6F6lVQysY=";
+    })
+    (fetchpatch {
+      url = "https://github.com/elementary/stylesheet/commit/2b9aa7aabce8ab2656340de41f7d5194ddd62078.patch";
+      sha256 = "sha256-84sCbVw3JChw25FIKG4eFbj3EkDioefJp5Q938TwXPc=";
+    })
+    (fetchpatch {
+      url = "https://github.com/elementary/stylesheet/commit/88682d3e931fdd46682d3ac8f1f1e700e2514c56.patch";
+      sha256 = "sha256-2/yYO9Upt33bZembRRuvcfwpQunD1hhJ/BC2DZSuWPk=";
+    })
+    (fetchpatch {
+      url = "https://github.com/elementary/stylesheet/commit/bb15232abc6167a305b4404467498d11901aea69.patch";
+      sha256 = "sha256-L6y61CVRTakSHDvFanhbpsSzLkiSp5Dsm0Fg3RKccQk=";
+    })
+  ];
+
  nativeBuildInputs = [
    gettext
    meson
--- a/pkgs/development/libraries/geogram/default.nix
+++ b/pkgs/development/libraries/geogram/default.nix
@ -0,0 +1,128 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchFromGitHub
+
+, cmake
+, doxygen
+, zlib
+, python3Packages
+}:
+
+let
+  testdata = fetchFromGitHub {
+    owner = "BrunoLevy";
+    repo = "geogram.data";
+    rev = "8fd071a560bd6859508f1710981386d0b2ba01b1";
+    hash = "sha256-jMUGX6/uYIZMVwXxTAAGUaOXqF+NrFQqgmIPCD58cwM=";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "geogram";
+  version = "1.8.3";
+
+  src = fetchurl {
+    url = "https://github.com/BrunoLevy/geogram/releases/download/v${version}/geogram_${version}.tar.gz";
+    hash = "sha256-91q0M/4kAr0UoWXOQIEYS1VbgEQ/F4EBOfJE9Vr1bnw=";
+  };
+
+  outputs = [ "bin" "lib" "dev" "doc" "out" ];
+
+  cmakeFlags = [
+    # Triangle is unfree
+    "-DGEOGRAM_WITH_TRIANGLE=OFF"
+
+    # Disable some extra features (feel free to create a PR if you need one of those)
+
+    # If GEOGRAM_WITH_LEGACY_NUMERICS is enabled GeoGram will build its own version of
+    # ARPACK, CBLAS, CLAPACK, LIBF2C and SUPERLU
+    "-DGEOGRAM_WITH_LEGACY_NUMERICS=OFF"
+
+    # Don't build Lua
+    "-DGEOGRAM_WITH_LUA=OFF"
+
+    # Disable certain features requiring GLFW
+    "-DGEOGRAM_WITH_GRAPHICS=OFF"
+
+    # NOTE: Options introduced by patch (see below)
+    "-DGEOGRAM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake"
+    "-DGEOGRAM_INSTALL_PKGCONFIG_DIR=${placeholder "dev"}/lib/pkgconfig"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    doxygen
+  ];
+
+  buildInputs = [
+    zlib
+  ];
+
+  patches = [
+    # See https://github.com/BrunoLevy/geogram/pull/76
+    ./fix-cmake-install-destination.patch
+
+    # This patch replaces the bundled (outdated) zlib with our zlib
+    # Should be harmless, but if there are issues this patch can also be removed
+    # Also check https://github.com/BrunoLevy/geogram/issues/49 for progress
+    ./replace-bundled-zlib.patch
+  ];
+
+  postPatch = lib.optionalString stdenv.isAarch64 ''
+    substituteInPlace cmake/platforms/*/config.cmake \
+      --replace "-m64" ""
+  '';
+
+  postBuild = ''
+    make doc-devkit-full
+  '';
+
+  nativeCheckInputs = [
+    python3Packages.robotframework
+  ];
+
+  doCheck = true;
+
+  checkPhase =
+    let
+      skippedTests = [
+        # Failing tests as of version 1.8.3
+        "FileConvert"
+        "Reconstruct"
+        "Remesh"
+
+        # Skip slow RVD test
+        "RVD"
+      ];
+    in
+    ''
+      runHook preCheck
+
+      ln -s ${testdata} ../tests/data
+
+      source tests/testenv.sh
+      robot \
+        ${lib.concatMapStringsSep " " (t: lib.escapeShellArg "--skip=${t}") skippedTests} \
+        ../tests
+
+      runHook postCheck
+    '';
+
+  meta = with lib; {
+    description = "Programming Library with Geometric Algorithms";
+    longDescription = ''
+      Geogram contains the main results in Geometry Processing from the former ALICE Inria project,
+      that is, more than 30 research articles published in ACM SIGGRAPH, ACM Transactions on Graphics,
+      Symposium on Geometry Processing and Eurographics.
+    '';
+    homepage = "https://github.com/BrunoLevy/geogram";
+    license = licenses.bsd3;
+
+    # Broken on aarch64-linux as of version 1.8.3
+    # See https://github.com/BrunoLevy/geogram/issues/74
+    broken = stdenv.isLinux && stdenv.isAarch64;
+
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+    maintainers = with maintainers; [ tmarkus ];
+  };
+}
--- a/pkgs/development/libraries/geogram/fix-cmake-install-destination.patch
+++ b/pkgs/development/libraries/geogram/fix-cmake-install-destination.patch
@ -0,0 +1,92 @@
+--- a/cmake/utilities.cmake	1970-01-01 01:00:01.000000000 +0100
+++ b/cmake/utilities.cmake	2023-03-09 19:28:16.556251981 +0100
+@@ -241,9 +241,9 @@
+     install(
+         TARGETS ${ARGN}
+         COMPONENT runtime
+-        RUNTIME DESTINATION bin
+-        LIBRARY DESTINATION lib
+-        ARCHIVE DESTINATION lib
+        RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+        LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+        ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+     )
+ endfunction()
+ 
+@@ -270,9 +270,9 @@
+         install(
+             TARGETS ${ARGN}
+             COMPONENT ${component}
+-            RUNTIME DESTINATION bin
+-            LIBRARY DESTINATION lib
+-            ARCHIVE DESTINATION lib
+            RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+            LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+            ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+         )
+     endforeach()
+ endfunction()
+--- a/src/lib/geogram/CMakeLists.txt	1970-01-01 01:00:01.000000000 +0100
+++ b/src/lib/geogram/CMakeLists.txt	2023-03-09 20:29:12.346780432 +0100
+@@ -76,7 +76,7 @@
+ # Install include files for the standard devkit
+ install(
+     DIRECTORY api
+-    DESTINATION include/${VORPALINE_INCLUDE_SUBPATH}/geogram
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/${VORPALINE_INCLUDE_SUBPATH}/geogram
+     COMPONENT devkit
+     FILES_MATCHING PATTERN *.h
+ )
+@@ -84,7 +84,7 @@
+ # Install include files for the full devkit
+ install(
+     DIRECTORY .
+-    DESTINATION include/${VORPALINE_INCLUDE_SUBPATH}/geogram
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/${VORPALINE_INCLUDE_SUBPATH}/geogram
+     COMPONENT devkit-full
+     FILES_MATCHING PATTERN *.h
+     # Exclude all files related to licensing
+@@ -93,7 +93,7 @@
+ 
+ install(
+         FILES "${PROJECT_BINARY_DIR}/geogram${VORPALINE_VERSION_MAJOR}.pc"
+-        DESTINATION lib${LIB_SUFFIX}/pkgconfig
+        DESTINATION ${GEOGRAM_INSTALL_PKGCONFIG_DIR}
+ )
+ 
+ 
+--- a/CMakeLists.txt	1970-01-01 01:00:01.000000000 +0100
+++ b/CMakeLists.txt	2023-03-09 20:40:20.075218356 +0100
+@@ -158,7 +158,7 @@
+ 
+ # FindGeogram.cmake
+ 
+-install(FILES cmake/FindGeogram.cmake DESTINATION lib/cmake/modules COMPONENT devkit)
+install(FILES cmake/FindGeogram.cmake DESTINATION ${GEOGRAM_INSTALL_CMAKE_DIR} COMPONENT devkit)
+ 
+ # Configure CPack
+ 
+--- a/doc/CMakeLists.txt	1970-01-01 01:00:01.000000000 +0100
+++ b/doc/CMakeLists.txt	2023-03-09 21:12:04.386327003 +0100
+@@ -25,14 +25,14 @@
+ 
+   # Install documentation
+   if(GEOGRAM_WITH_VORPALINE)
+-      install(FILES README.txt DESTINATION doc COMPONENT runtime)
+-      install(FILES ${CMAKE_CURRENT_BINARY_DIR}/LICENSE.txt DESTINATION doc COMPONENT runtime OPTIONAL)
+      install(FILES README.txt DESTINATION ${CMAKE_INSTALL_DOCDIR} COMPONENT runtime)
+      install(FILES ${CMAKE_CURRENT_BINARY_DIR}/LICENSE.txt DESTINATION ${CMAKE_INSTALL_DOCDIR} COMPONENT runtime OPTIONAL)
+   endif()
+ 
+-  install(FILES ${CMAKE_CURRENT_BINARY_DIR}/VERSION.txt DESTINATION doc/geogram COMPONENT runtime OPTIONAL)
+-  
+-  install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/devkit/html DESTINATION doc/devkit COMPONENT doc-devkit OPTIONAL)
+-  install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/devkit-full/html DESTINATION doc/devkit COMPONENT doc-devkit-full OPTIONAL)
+-  install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/devkit-internal/html DESTINATION doc/devkit COMPONENT doc-devkit-internal OPTIONAL)
+  install(FILES ${CMAKE_CURRENT_BINARY_DIR}/VERSION.txt DESTINATION ${CMAKE_INSTALL_DOCDIR}/geogram COMPONENT runtime OPTIONAL)
+
+  install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/devkit/html DESTINATION ${CMAKE_INSTALL_DOCDIR}/devkit COMPONENT doc-devkit OPTIONAL)
+  install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/devkit-full/html DESTINATION ${CMAKE_INSTALL_DOCDIR}/devkit COMPONENT doc-devkit-full OPTIONAL)
+  install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/devkit-internal/html DESTINATION ${CMAKE_INSTALL_DOCDIR}/devkit COMPONENT doc-devkit-internal OPTIONAL)
+ 
+ endif()
--- a/pkgs/development/libraries/geogram/replace-bundled-zlib.patch
+++ b/pkgs/development/libraries/geogram/replace-bundled-zlib.patch
@ -0,0 +1,46 @@
+--- a/src/lib/geogram/third_party/CMakeLists.txt	1970-01-01 01:00:01.000000000 +0100
+++ b/src/lib/geogram/third_party/CMakeLists.txt	2023-03-09 20:46:16.740801862 +0100
+@@ -33,7 +33,6 @@
+ aux_source_directories(SOURCES "Source Files\\LM6"          LM7)
+ aux_source_directories(SOURCES "Source Files\\rply"         rply)
+ aux_source_directories(SOURCES "Source Files\\shewchuk"     shewchuk)
+-aux_source_directories(SOURCES "Source Files\\zlib"         zlib)
+ aux_source_directories(SOURCES "Source Files\\PoissonRecon" PoissonRecon)
+ aux_source_directories(SOURCES "Source Files\\xatlas"       xatlas)
+ 
+--- a/src/lib/geogram/CMakeLists.txt	1970-01-01 01:00:01.000000000 +0100
+++ b/src/lib/geogram/CMakeLists.txt	2023-03-09 20:49:21.080059939 +0100
+@@ -70,6 +70,9 @@
+     target_link_libraries(geogram psapi)
+ endif()
+ 
+find_package(ZLIB REQUIRED)
+target_link_libraries(geogram ZLIB::ZLIB)
+
+ # Install the library
+ install_devkit_targets(geogram)
+ 
+--- a/src/lib/geogram/basic/geofile.h	1970-01-01 01:00:01.000000000 +0100
+++ b/src/lib/geogram/basic/geofile.h	2023-03-09 20:52:33.713329571 +0100
+@@ -44,7 +44,7 @@
+ #include <geogram/basic/numeric.h>
+ #include <geogram/basic/memory.h>
+ #include <geogram/basic/string.h>
+-#include <geogram/third_party/zlib/zlib.h>
+#include <zlib.h>
+ 
+ #include <stdexcept>
+ #include <fstream>
+--- a/src/lib/geogram/third_party/CMakeLists.txt	1970-01-01 01:00:01.000000000 +0100
+++ b/src/lib/geogram/third_party/CMakeLists.txt	2023-03-09 20:54:50.276520762 +0100
+@@ -60,8 +59,10 @@
+     ${ANDROID_NDK}/sources/android/native_app_glue
+   )
+   message(STATUS "building for Android")
+ endif()  
+ 
+find_package(ZLIB REQUIRED)
+target_link_libraries(geogram_third_party PUBLIC ZLIB::ZLIB)
+ 
+ set_target_properties(
+     geogram_third_party PROPERTIES
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.4/6.4.2/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.4/6.4.3/submodules/ -A '*.tar.xz' )
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@ -4,283 +4,283 @@

 {
  qt3d = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qt3d-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0hbkld6ys78xvd2npbnbajdqiyjjskzfi7xp43kp60l4sg1j8v25";
-      name = "qt3d-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qt3d-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0w9xmsrd3mqbm5vf1m8cv67kcjrcbjnfmm6fmw2icg95jzwjb0m8";
+      name = "qt3d-everywhere-src-6.4.3.tar.xz";
    };
  };
  qt5compat = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qt5compat-everywhere-src-6.4.2.tar.xz";
-      sha256 = "14mpqj9ci31nn2n68czmxqdiikkg5iw7vqiksyvm2nwqirf507zm";
-      name = "qt5compat-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qt5compat-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0ymak3cr36b8hyr3axxywrv153ds4kcj8p04x7p7bm93p2mlkcnl";
+      name = "qt5compat-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtactiveqt = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtactiveqt-everywhere-src-6.4.2.tar.xz";
-      sha256 = "1ky5gp251r4lslc2wnmiy44p231zrqmdgb73m28kl9ii9rn0wg8j";
-      name = "qtactiveqt-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtactiveqt-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0v8wf7xv5dqcw9v75a1zhhfqhmrya9q66az3awkfscjda78y2gh9";
+      name = "qtactiveqt-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtbase = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtbase-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0paj0p3j3nvdcp9xnpzrsjxcyy6fr9wslav2kaj7hj5kvg7cd2x8";
-      name = "qtbase-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtbase-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0q0si40bmgbplczr1skacd98zkfh6mmigax4q71pnphnn3jwk1sh";
+      name = "qtbase-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtcharts = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtcharts-everywhere-src-6.4.2.tar.xz";
-      sha256 = "1am9s1wahbfz1gvv5db31b8aw6k86wzyp8n3s6bwyw48ikhc19x1";
-      name = "qtcharts-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtcharts-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0in36za9iq41mc1hq62vjd8zni6amdd2b24gqngzcpdmzzsy8qaa";
+      name = "qtcharts-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtconnectivity = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtconnectivity-everywhere-src-6.4.2.tar.xz";
-      sha256 = "1bypqp6szqp6wp5npyqv585qk2760iwl4pyadx6lqaz476r496wc";
-      name = "qtconnectivity-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtconnectivity-everywhere-src-6.4.3.tar.xz";
+      sha256 = "17acli5wksd793v145mv8a4ld59v8g9dvv32wxlyvdsarha2137r";
+      name = "qtconnectivity-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtdatavis3d = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtdatavis3d-everywhere-src-6.4.2.tar.xz";
-      sha256 = "1m145mxgx1hgd8c3kdnjblvq50a8hycihn0a1ibc1y3a3phpp4l3";
-      name = "qtdatavis3d-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtdatavis3d-everywhere-src-6.4.3.tar.xz";
+      sha256 = "15brg1gcx2am3wbr54lx20fw1q42gryjxxnxf600nmk3nrfsqy69";
+      name = "qtdatavis3d-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtdeclarative = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtdeclarative-everywhere-src-6.4.2.tar.xz";
-      sha256 = "1ggm612fv7ahizd0c2ip9rai31srv2ypsxjvz2hbr72fvs1xkgd4";
-      name = "qtdeclarative-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtdeclarative-everywhere-src-6.4.3.tar.xz";
+      sha256 = "15d73d957zfhls3ny322i1n9iqvg2nxk8swi00v5w4w8p6rx3pk7";
+      name = "qtdeclarative-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtdoc = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtdoc-everywhere-src-6.4.2.tar.xz";
-      sha256 = "178kp7jkam2j5slccv3xkfi21ah9q1kj44kh71kg8sgc7v3fn7sa";
-      name = "qtdoc-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtdoc-everywhere-src-6.4.3.tar.xz";
+      sha256 = "10w12bsfwmxw6z4n50mv653q6vj7bcb7r0pmik52kxi9sr6w7skk";
+      name = "qtdoc-everywhere-src-6.4.3.tar.xz";
    };
  };
  qthttpserver = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qthttpserver-everywhere-src-6.4.2.tar.xz";
-      sha256 = "1i8bkcz08ya53mvgilwxifr8sfpa599fxmc21cicqxypcx1a9cql";
-      name = "qthttpserver-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qthttpserver-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0yf162pxm55aybm62z1qqf3h9ff39iy72ffpxk775fbrqynxqyn3";
+      name = "qthttpserver-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtimageformats = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtimageformats-everywhere-src-6.4.2.tar.xz";
-      sha256 = "01qpw7pbk6q3vqradjvcry0yp1jk67fx8mkra3ang6kpw2d9jpzw";
-      name = "qtimageformats-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtimageformats-everywhere-src-6.4.3.tar.xz";
+      sha256 = "165pk7z2k0ymzkm1r8fjykc6hlxdrpc2b0ysqlbldf3l5q35izqa";
+      name = "qtimageformats-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtlanguageserver = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtlanguageserver-everywhere-src-6.4.2.tar.xz";
-      sha256 = "04d83hjbfgapzsfqm6zmqm8jjplih0k2psx35c1vnzqaxz36cgkl";
-      name = "qtlanguageserver-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtlanguageserver-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0xbrsg1z9p9wwx1zhh9birb44lb8ri1c6afjlv2cf69f8h31120f";
+      name = "qtlanguageserver-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtlottie = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtlottie-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0mhwvv8n3y0j0x471qprg5d18d8js9ic6c1s6xdwx590qxlqik5c";
-      name = "qtlottie-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtlottie-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0gb9y4c9d1x548hpvcjbgr0pvw3v4c1vicqy6ppavv368ph54v7z";
+      name = "qtlottie-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtmultimedia = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtmultimedia-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0xn7fa4z4mm8pzvd2hyms6jrgwjpcql02a0fcs71r4fsxbg70avz";
-      name = "qtmultimedia-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtmultimedia-everywhere-src-6.4.3.tar.xz";
+      sha256 = "003xav0vxlh6i6l0nk9m7ikaa86nfxk2xarjw2gfb89dw5lj99x4";
+      name = "qtmultimedia-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtnetworkauth = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtnetworkauth-everywhere-src-6.4.2.tar.xz";
-      sha256 = "1vn28x83079zdf41lrmrdxclg0cif09cfyvmswxlj2kxjnyigayy";
-      name = "qtnetworkauth-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtnetworkauth-everywhere-src-6.4.3.tar.xz";
+      sha256 = "1rbaf73ijvr6y91scdyk5cjnsm930yj2ck2gnvxwif7lfajmn4ad";
+      name = "qtnetworkauth-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtpositioning = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtpositioning-everywhere-src-6.4.2.tar.xz";
-      sha256 = "10pgkag7bjhh1yxq3fm2szch17q1fmh2xly926rgayl7pbsvl0bz";
-      name = "qtpositioning-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtpositioning-everywhere-src-6.4.3.tar.xz";
+      sha256 = "036pph2hy2wzr1z6gs3zc688zxifnkc001p9ba9y44kwsghv265j";
+      name = "qtpositioning-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtquick3d = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtquick3d-everywhere-src-6.4.2.tar.xz";
-      sha256 = "19r655jinshg210ik1mann57ic92bvr52gd3xqy5c06wlrn3ngcm";
-      name = "qtquick3d-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtquick3d-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0l40vkada3l1zkz042lcg9ybkqd3bg6wlc0vzngr76s4bmb8v8vq";
+      name = "qtquick3d-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtquick3dphysics = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtquick3dphysics-everywhere-src-6.4.2.tar.xz";
-      sha256 = "14fc4fzcpx4phqf768cavkwxxzhccz7hgif4g5a6xcirdimzhyp8";
-      name = "qtquick3dphysics-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtquick3dphysics-everywhere-src-6.4.3.tar.xz";
+      sha256 = "05fv5mbcfqzmrr3ciqlx3vw5b6agk3kpb4r548h0hcacqjiyi1mb";
+      name = "qtquick3dphysics-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtquicktimeline = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtquicktimeline-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0plsy3pz589hrzjz717vmpsy60rl7hf9sl519qsjldkqyjvsp21h";
-      name = "qtquicktimeline-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtquicktimeline-everywhere-src-6.4.3.tar.xz";
+      sha256 = "199xbvjq1xg1lzkkq4ilbp1jiikiqg9khbzijz3ribx3qd3w821q";
+      name = "qtquicktimeline-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtremoteobjects = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtremoteobjects-everywhere-src-6.4.2.tar.xz";
-      sha256 = "04l88akwawyippzc4j82wd4vn801fl6iibppxrld1m9001j56g2q";
-      name = "qtremoteobjects-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtremoteobjects-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0shq1i26k76nymvlj48l5n4afn06j6kbca463lclk8nbg7glg54w";
+      name = "qtremoteobjects-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtscxml = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtscxml-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0zsfylzbh3hwjii6l4y1ha524qrby3piyylnh4jfsjrrb4sd9c0k";
-      name = "qtscxml-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtscxml-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0fignzvz9wc37s94bdnqd7z8x6a5m3adbiz32gkh4k23dl0jqwpy";
+      name = "qtscxml-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtsensors = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtsensors-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0mp6gq3mlinmagb3gd4kr3zwibygzd91k7lwljmlr7x353zijmj5";
-      name = "qtsensors-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtsensors-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0j5wp93hlf1gpb9y55llad9pimjz20hp5w5xl0v6fic953x68faz";
+      name = "qtsensors-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtserialbus = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtserialbus-everywhere-src-6.4.2.tar.xz";
-      sha256 = "06xz91yn2vwybdwn8jgz6ymlbrdmpjsdwj07lnd8j9vkgiji6h30";
-      name = "qtserialbus-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtserialbus-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0rj3nfs017vmp8i7f1hg2mrav7fkwh6cby803ib4xw6i2rsnli5n";
+      name = "qtserialbus-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtserialport = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtserialport-everywhere-src-6.4.2.tar.xz";
-      sha256 = "1yj08d810l4drsnhav3mych4p5b2dz5qrpn3nf20301pj28rav9k";
-      name = "qtserialport-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtserialport-everywhere-src-6.4.3.tar.xz";
+      sha256 = "1plmzkn1g00g0vrw5n9kawq1y6fj0cgbryrr5a59m8zgcy8av5sz";
+      name = "qtserialport-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtshadertools = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtshadertools-everywhere-src-6.4.2.tar.xz";
-      sha256 = "05x24v12jjh3fyr5wrxy7n33vqp00y10kyznrfs2r72f9pwbyrgs";
-      name = "qtshadertools-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtshadertools-everywhere-src-6.4.3.tar.xz";
+      sha256 = "1y384xw3jb1x4z3qzwzjxp7ymg20qn4sb4i7sq5s4sg7wd6bfj66";
+      name = "qtshadertools-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtspeech = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtspeech-everywhere-src-6.4.2.tar.xz";
-      sha256 = "1jwlnh640qk602nn5zslrxmp87ph87fyp6jcysmh1xfn6j6rzjd9";
-      name = "qtspeech-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtspeech-everywhere-src-6.4.3.tar.xz";
+      sha256 = "1qja4n2wkkxkcczr1afi8d083qq4lrngkvj698w1s1habqcx1q3r";
+      name = "qtspeech-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtsvg = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtsvg-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0503b63zxqrakw33283lq8fm85asmpckibkyxpc22dkrn4yayimp";
-      name = "qtsvg-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtsvg-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0jlshycc0cy3ja652g6jb51p4q31dsxfsz28brq9h67qdj45ycc8";
+      name = "qtsvg-everywhere-src-6.4.3.tar.xz";
    };
  };
  qttools = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qttools-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0s3chbap59allfkj825yi07wqcg9x10shgidabpsbr44c68qf4x3";
-      name = "qttools-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qttools-everywhere-src-6.4.3.tar.xz";
+      sha256 = "14d0qmqdyrz524srb5iwn5j2fm136582bs32zs7axlswrllzhzc6";
+      name = "qttools-everywhere-src-6.4.3.tar.xz";
    };
  };
  qttranslations = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qttranslations-everywhere-src-6.4.2.tar.xz";
-      sha256 = "15n4m6r279wqy9834iwc3n98nbyjbf9y2c7pzrr4nq6208ajkq5v";
-      name = "qttranslations-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qttranslations-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0b4pprdczbnk1gvda2bs1fg84yinii9ih201m2l4k5nl01w6prbr";
+      name = "qttranslations-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtvirtualkeyboard = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtvirtualkeyboard-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0a2gd8s7jrc56n4b743ln1qdvvl820cprp2zrbx6x28pdq7q6g4w";
-      name = "qtvirtualkeyboard-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtvirtualkeyboard-everywhere-src-6.4.3.tar.xz";
+      sha256 = "1r8fvqjmh18x89snxflzci1vinf7jvflfjihidffc02vdwi8aiiz";
+      name = "qtvirtualkeyboard-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtwayland = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtwayland-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0pqkpvc21h3gkr8x7nxylxgksj046xgmqpc1nhvidasiyw51mkr4";
-      name = "qtwayland-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtwayland-everywhere-src-6.4.3.tar.xz";
+      sha256 = "12a7pi39zn7miyli6ywhkfx7vh0sl2h5iddp226f80acizd63cf6";
+      name = "qtwayland-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtwebchannel = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtwebchannel-everywhere-src-6.4.2.tar.xz";
-      sha256 = "11xxpvf53g63dxd6i6bzp4as4wc5pc6xlh3w7drnrwh94lmpnr86";
-      name = "qtwebchannel-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtwebchannel-everywhere-src-6.4.3.tar.xz";
+      sha256 = "1a7kpsy5c9vmwk69csnni6n6kn4zpvbf9fwbr1j4mrzhhx2h8mg9";
+      name = "qtwebchannel-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtwebengine = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtwebengine-everywhere-src-6.4.2.tar.xz";
-      sha256 = "1j8rl5r981xdqh2sqzlw5md4z14h42f8sgjjfgpdkj0wim8lbagz";
-      name = "qtwebengine-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtwebengine-everywhere-src-6.4.3.tar.xz";
+      sha256 = "09995fhpzkpycjgad4s2wh5wx3vxl95h35cd3fj7kp516vvmmy2m";
+      name = "qtwebengine-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtwebsockets = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtwebsockets-everywhere-src-6.4.2.tar.xz";
-      sha256 = "09n64yjlkd6kcg4hk0j4f85spi1k3kanfvx50c0w486vh9sqbkvi";
-      name = "qtwebsockets-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtwebsockets-everywhere-src-6.4.3.tar.xz";
+      sha256 = "13s5im5ms7bza9f9dy6ahnxb5d9ndgvxfw83asp86pjwnmz3a9yy";
+      name = "qtwebsockets-everywhere-src-6.4.3.tar.xz";
    };
  };
  qtwebview = {
-    version = "6.4.2";
+    version = "6.4.3";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.4/6.4.2/submodules/qtwebview-everywhere-src-6.4.2.tar.xz";
-      sha256 = "0wpkn9pwbq3bn2yjxhvrmwb32rakknzgxbf8ybxwcly12la9chm6";
-      name = "qtwebview-everywhere-src-6.4.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.4/6.4.3/submodules/qtwebview-everywhere-src-6.4.3.tar.xz";
+      sha256 = "0hz8ydf45nfxdsp2srff1yq2qpan50flwyw2aa4js52y95q1g5ai";
+      name = "qtwebview-everywhere-src-6.4.3.tar.xz";
    };
  };
 }
--- a/pkgs/development/tools/bacon/default.nix
+++ b/pkgs/development/tools/bacon/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "bacon";
-  version = "2.6.3";
+  version = "2.7.0";

  src = fetchFromGitHub {
    owner = "Canop";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-EmkPH0TjLa9ouRjgv0IEyhqx5VaHR2TUQdqznKIKZdY=";
+    hash = "sha256-qN1Jpv6hoIKVGGQXzon8P0O12YlIB7Dam1UxXL3TQrY=";
  };

-  cargoHash = "sha256-vEged6GfcdcibCm4JX4/GIo1qbVtT+jX721+iLKOQsc=";
+  cargoHash = "sha256-253j34Kxzsfe5UeiWRdV+2P0rbnTYig18cZ25HVKX+8=";

  buildInputs = lib.optionals stdenv.isDarwin [
    CoreServices
--- a/pkgs/tools/misc/halp/default.nix
+++ b/pkgs/tools/misc/halp/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "halp";
-  version = "0.1.3";
+  version = "0.1.4";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = "halp";
    rev = "v${version}";
-    hash = "sha256-abr/GfqKNY/55X1siChPrp/9Y2dYNT3weTyZWbaQZVY=";
+    hash = "sha256-ZlatBdMFLbw3+lApc68IG4xnFKQgCxRPX2n1oQtPrmw=";
  };

-  cargoHash = "sha256-1PC6IZCYJ3pT5SbTeIEUbVrc8RSzBvkhkpGxFu5rgdc=";
+  cargoHash = "sha256-rGqqa2olnIm2bGkltM6cHceM4HJDRFIUmOrl2hLOSiI=";

  patches = [
    # patch tests to point to the correct target directory
--- a/pkgs/tools/networking/sing-box/default.nix
+++ b/pkgs/tools/networking/sing-box/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "sing-box";
-  version = "1.1.6";
+  version = "1.1.7";

  src = fetchFromGitHub {
    owner = "SagerNet";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-CwXhCJo6Nq0dZaTcUetsSpvNKme1PN6pzMRX1QeY3gg=";
+    hash = "sha256-jovUK535vZeCgnnW+9/gjXwCkNLMXdiCJwWqFKCubcU=";
  };

-  vendorHash = "sha256-cLaMtnTSmCZoPwfeQpWXCiFtmDm3vA6AD12H5h8Obhk=";
+  vendorHash = "sha256-WYMCsFX5/4H+Bc0KcxcPMjfz2wEXz3V4D0sww15AgvE=";

  tags = [
    "with_quic"
@ -38,6 +38,10 @@ buildGoModule rec {

  nativeBuildInputs = [ installShellFiles ];

+  ldflags = [
+    "-X=github.com/sagernet/sing-box/constant.Version=${version}"
+  ];
+
  postInstall = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
    installShellCompletion --cmd sing-box \
      --bash <(${emulator} $out/bin/sing-box completion bash) \
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -20068,6 +20068,8 @@ with pkgs;
    geoipDatabase = geolite-legacy;
  };

+  geogram = callPackage ../development/libraries/geogram { };
+
  geographiclib = callPackage ../development/libraries/geographiclib { };

  geoip = callPackage ../development/libraries/geoip { };
@ -32608,6 +32610,8 @@ with pkgs;
    nodejs = nodejs-16_x;
  };

+  peroxide = callPackage ../applications/networking/peroxide { };
+
  pflask = callPackage ../os-specific/linux/pflask { };

  pfsshell = callPackage ../tools/misc/pfsshell { };