From 5f23eb96cddf606c78e803ecc207b34d25d69440 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Thu, 13 Jul 2023 23:13:09 +0200
Subject: [PATCH 01/37] ntp: 4.2.8p15 -> 4.2.8p17

Fixes CVE-2023-26555, CVE-2023-26551, CVE-2023-26552, CVE-2023-26553 and CVE-2023-26554.

Release announcement:
https://www.ntp.org/support/securitynotice/4_2_8p17-release-announcement/
https://www.ntp.org/support/securitynotice/4_2_8p16-release-announcement/
---
 pkgs/tools/networking/ntp/default.nix         | 13 +++------
 .../tools/networking/ntp/glibc-2.34-fix.patch | 28 -------------------
 2 files changed, 4 insertions(+), 37 deletions(-)
 delete mode 100644 pkgs/tools/networking/ntp/glibc-2.34-fix.patch

diff --git a/pkgs/tools/networking/ntp/default.nix b/pkgs/tools/networking/ntp/default.nix
index f272470a98f4..1a081993bbd6 100644
--- a/pkgs/tools/networking/ntp/default.nix
+++ b/pkgs/tools/networking/ntp/default.nix
@@ -2,18 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ntp";
-  version = "4.2.8p15";
+  version = "4.2.8p17";
 
   src = fetchurl {
-    url = "https://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-${lib.versions.majorMinor version}/ntp-${version}.tar.gz";
-    sha256 = "06cwhimm71safmwvp6nhxp6hvxsg62whnbgbgiflsqb8mgg40n7n";
+    url = "https://archive.ntp.org/ntp4/ntp-${lib.versions.majorMinor version}/ntp-${version}.tar.gz";
+    hash = "sha256-ED3ScuambFuN8H3OXpoCVV/NbxOXvft4IjcyjonTqGY=";
   };
 
-  patches = [
-    # From https://patchwork.openembedded.org/patch/180019/
-    ./glibc-2.34-fix.patch
-  ];
-
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
@@ -33,7 +28,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "http://www.ntp.org/";
+    homepage = "https://www.ntp.org/";
     description = "An implementation of the Network Time Protocol";
     license = {
       # very close to isc and bsd2
diff --git a/pkgs/tools/networking/ntp/glibc-2.34-fix.patch b/pkgs/tools/networking/ntp/glibc-2.34-fix.patch
deleted file mode 100644
index 256f125a77b2..000000000000
--- a/pkgs/tools/networking/ntp/glibc-2.34-fix.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 082a504cfcc046c3d8adaae1164268bc94e5108a Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Sat, 31 Jul 2021 10:51:41 -0700
-Subject: [PATCH] libntp: Do not use PTHREAD_STACK_MIN on glibc
-In glibc 2.34+ PTHREAD_STACK_MIN is not a compile-time constant which
-could mean different stack sizes at runtime on different architectures
-and it also causes compile failure. Default glibc thread stack size
-or 64Kb set by ntp should be good in glibc these days.
-Upstream-Status: Pending
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- libntp/work_thread.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/libntp/work_thread.c b/libntp/work_thread.c
-index 03a5647..3ddd751 100644
---- a/libntp/work_thread.c
-+++ b/libntp/work_thread.c
-@@ -41,7 +41,7 @@
- #ifndef THREAD_MINSTACKSIZE
- # define THREAD_MINSTACKSIZE	(64U * 1024)
- #endif
--#ifndef __sun
-+#if !defined(__sun) && !defined(__GLIBC__)
- #if defined(PTHREAD_STACK_MIN) && THREAD_MINSTACKSIZE < PTHREAD_STACK_MIN
- # undef THREAD_MINSTACKSIZE
- # define THREAD_MINSTACKSIZE PTHREAD_STACK_MIN
--- 
-2.32.0

From 3601ccf5aeece88bf85f4373aa9aaf3c939b0e73 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Fri, 14 Jul 2023 11:50:31 +0200
Subject: [PATCH 02/37] pjsip: 2.13 -> 2.13.1

Fixes CVE-2023-27585.

Changes:
https://github.com/pjsip/pjproject/releases/tag/2.13.1
---
 pkgs/applications/networking/pjsip/default.nix | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/networking/pjsip/default.nix b/pkgs/applications/networking/pjsip/default.nix
index 11462dab9a1b..9c1b8e4f2617 100644
--- a/pkgs/applications/networking/pjsip/default.nix
+++ b/pkgs/applications/networking/pjsip/default.nix
@@ -2,7 +2,6 @@
 , testers
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , openssl
 , libsamplerate
 , swig
@@ -16,27 +15,17 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "pjsip";
-  version = "2.13";
+  version = "2.13.1";
 
   src = fetchFromGitHub {
     owner = finalAttrs.pname;
     repo = "pjproject";
-    rev = finalAttrs.version;
-    sha256 = "sha256-yzszmm3uIyXtYFgZtUP3iswLx4u/8UbFt80Ln25ToFE=";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-R1iKIkWyNCRV2PjQgTqKmJYUgHAZrREanD60Jz6MY1Y=";
   };
 
   patches = [
     ./fix-aarch64.patch
-    (fetchpatch {
-      name = "CVE-2022-23537.patch";
-      url = "https://github.com/pjsip/pjproject/commit/d8440f4d711a654b511f50f79c0445b26f9dd1e1.patch";
-      sha256 = "sha256-7ueQCHIiJ7MLaWtR4+GmBc/oKaP+jmEajVnEYqiwLRA=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-23547.patch";
-      url = "https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36.patch";
-      sha256 = "sha256-bpc8e8VAQpfyl5PX96G++6fzkFpw3Or1PJKNPKl7N5k=";
-    })
   ];
 
   nativeBuildInputs =

From 6a2999310e4f5d4bfdec15d1aed54f98096fba9d Mon Sep 17 00:00:00 2001
From: Paul Stadig <paul@thoughtfull.systems>
Date: Thu, 27 Jul 2023 06:12:34 -0400
Subject: [PATCH 03/37] xfce.xfce4-power-manager: use fixed path for helpers

Using a nix store path for `xfpm-power-backlight-helper` and `xfce4-pm-helper` causes permission
errors after a rebuild when adjusting brightness or putting the system to sleep, because the
permitted executables are different from the ones `xfce4-power-manager` wants to execute.  Using a
fixed path (/run/current-system/sw/bin) means the paths do not change after a rebuild, so there's no
permission error.

A similar approach is taken with gnome's `gsd-backlight-helper`.

Fixes #77485
---
 pkgs/desktops/xfce/core/xfce4-power-manager/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix b/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
index 8755234cbc82..19b552937119 100644
--- a/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
@@ -26,6 +26,14 @@ mkXfceDerivation {
     xfce4-panel
   ];
 
+  # using /run/current-system/sw/bin instead of nix store path prevents polkit permission errors on
+  # rebuild.  See https://github.com/NixOS/nixpkgs/issues/77485
+  postPatch = ''
+    substituteInPlace src/org.xfce.power.policy.in2 --replace "@sbindir@" "/run/current-system/sw/bin"
+    substituteInPlace common/xfpm-brightness.c --replace "SBINDIR" "\"/run/current-system/sw/bin\""
+    substituteInPlace src/xfpm-suspend.c --replace "SBINDIR" "\"/run/current-system/sw/bin\""
+  '';
+
   meta = with lib; {
     description = "A power manager for the Xfce Desktop Environment";
     maintainers = with maintainers; [ ] ++ teams.xfce.members;

From 16d5bc3418d43b5cd7522b6fd3fa8de007abeed0 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 28 Jul 2023 08:26:05 +0200
Subject: [PATCH 04/37] =?UTF-8?q?coqPackages.interval:=204.7.0=20=E2=86=92?=
 =?UTF-8?q?=204.8.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/coq-modules/interval/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/coq-modules/interval/default.nix b/pkgs/development/coq-modules/interval/default.nix
index 9e8a691fca3e..1e31323f2e36 100644
--- a/pkgs/development/coq-modules/interval/default.nix
+++ b/pkgs/development/coq-modules/interval/default.nix
@@ -7,13 +7,14 @@ mkCoqDerivation rec {
   domain = "gitlab.inria.fr";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.12" "8.17"; out = "4.7.0"; }
+    { case = range "8.12" "8.17"; out = "4.8.0"; }
     { case = range "8.12" "8.16"; out = "4.6.0"; }
     { case = range "8.8" "8.16"; out = "4.5.2"; }
     { case = range "8.8" "8.12"; out = "4.0.0"; }
     { case = range "8.7" "8.11"; out = "3.4.2"; }
     { case = range "8.5" "8.6";  out = "3.3.0"; }
   ] null;
+  release."4.8.0".sha256 = "sha256-YPQ1tuUgGixAVdQUJ9a3lZUNVgm2pKK3RKvl3m+/8rY=";
   release."4.7.0".sha256 = "sha256-Cel25w4BeaNqu9KAW3N2KYO2IGY0EOAK5FQ6VHBPmFQ=";
   release."4.6.1".sha256 = "sha256-ZZSxt8ksz0g6dl/LEido5qJXgsaxHrVLqkGUHu90+e0=";
   release."4.6.0".sha256 = "sha256-n9ECKnV0L6XYcIcbYyOJKwlbisz/RRbNW5YESHo07X0=";

From 589023909328df90e2ddcd6d5ad977ca78c62ccb Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 28 Jul 2023 08:39:50 +0200
Subject: [PATCH 05/37] =?UTF-8?q?coqPackages.coquelicot:=203.3.1=20?=
 =?UTF-8?q?=E2=86=92=203.4.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/coq-modules/coquelicot/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/coq-modules/coquelicot/default.nix b/pkgs/development/coq-modules/coquelicot/default.nix
index 91b202272476..a56a8c6324d8 100644
--- a/pkgs/development/coq-modules/coquelicot/default.nix
+++ b/pkgs/development/coq-modules/coquelicot/default.nix
@@ -7,12 +7,13 @@ mkCoqDerivation {
   domain = "gitlab.inria.fr";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.12" "8.17"; out = "3.3.1"; }
+    { case = range "8.12" "8.17"; out = "3.4.0"; }
     { case = range "8.12" "8.17"; out = "3.3.0"; }
     { case = range "8.8" "8.16"; out = "3.2.0"; }
     { case = range "8.8" "8.13"; out = "3.1.0"; }
     { case = range "8.5" "8.9";  out = "3.0.2"; }
   ] null;
+  release."3.4.0".sha256 = "sha256-LIj2SwTvVBxSAO58VYCQix/uxQQe8ey6hqFOSh3PNcg=";
   release."3.3.1".sha256 = "sha256-YCvd4aIt2BxLKBYSWzN7aqo0AuY7z8oADmKvybhYBQI=";
   release."3.3.0".sha256 = "sha256-bh9qP/EhWrHpTe2GMGG3S2vgBSSK088mFfhAIGejVoU=";
   release."3.2.0".sha256 = "07w7dbl8x7xxnbr2q39wrdh054gvi3daqjpdn1jm53crsl1fjxm4";

From 4ffc1c82c6abb61aebf1a452020a4d41201e89e7 Mon Sep 17 00:00:00 2001
From: Daniel Carosone <dan@geek.com.au>
Date: Fri, 28 Jul 2023 16:57:12 +1000
Subject: [PATCH 06/37] zfs: 'want', don't 'require', systemd-udev-settle

This completes changes in #227208
Fixes: #244737, #245089.
---
 nixos/modules/tasks/filesystems/zfs.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix
index e148446540bd..21d604bee6e3 100644
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -110,10 +110,11 @@ let
   createImportService = { pool, systemd, force, prefix ? "" }:
     nameValuePair "zfs-import-${pool}" {
       description = "Import ZFS pool \"${pool}\"";
-      # we need systemd-udev-settle to ensure devices are available
+      # We wait for systemd-udev-settle to ensure devices are available,
+      # but don't *require* it, because mounts shouldn't be killed if it's stopped.
       # In the future, hopefully someone will complete this:
       # https://github.com/zfsonlinux/zfs/pull/4943
-      requires = [ "systemd-udev-settle.service" ];
+      wants = [ "systemd-udev-settle.service" ];
       after = [
         "systemd-udev-settle.service"
         "systemd-modules-load.service"

From 79ab9bde456965fe2cd76c43e51fa08af448e1b0 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Fri, 28 Jul 2023 17:32:22 +0900
Subject: [PATCH 07/37] stalwart-mail: 0.3.1 -> 0.3.2

---
 pkgs/servers/mail/stalwart/Cargo.lock  | 68 +++++++++++++-------------
 pkgs/servers/mail/stalwart/default.nix |  9 ++--
 2 files changed, 41 insertions(+), 36 deletions(-)

diff --git a/pkgs/servers/mail/stalwart/Cargo.lock b/pkgs/servers/mail/stalwart/Cargo.lock
index 1140656e59c4..73d43bda98c5 100644
--- a/pkgs/servers/mail/stalwart/Cargo.lock
+++ b/pkgs/servers/mail/stalwart/Cargo.lock
@@ -697,9 +697,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.3.17"
+version = "4.3.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0827b011f6f8ab38590295339817b0d26f344aa4932c3ced71b45b0c54b4a9"
+checksum = "5fd304a20bff958a57f04c4e96a2e7594cc4490a0e809cbd48bb6437edaa452d"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -708,9 +708,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.3.17"
+version = "4.3.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9441b403be87be858db6a23edb493e7f694761acdc3343d5a0fcaafd304cbc9e"
+checksum = "01c6a3f08f1fe5662a35cfe393aec09c4df95f60ee93b7556505260f75eee9e1"
 dependencies = [
  "anstream",
  "anstyle",
@@ -1029,6 +1029,7 @@ dependencies = [
  "argon2",
  "async-trait",
  "bb8",
+ "futures",
  "ldap3",
  "lru-cache",
  "mail-builder",
@@ -1039,6 +1040,7 @@ dependencies = [
  "password-hash 0.5.0",
  "pbkdf2 0.12.2",
  "pwhash",
+ "regex",
  "rustls 0.21.5",
  "scrypt",
  "sha1",
@@ -1149,9 +1151,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 dependencies = [
  "serde",
 ]
@@ -1920,7 +1922,7 @@ dependencies = [
 
 [[package]]
 name = "imap"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "ahash 0.8.3",
  "dashmap",
@@ -2084,7 +2086,7 @@ dependencies = [
 
 [[package]]
 name = "jmap"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "aes-gcm",
  "aes-gcm-siv",
@@ -2280,9 +2282,9 @@ dependencies = [
 
 [[package]]
 name = "libz-sys"
-version = "1.1.9"
+version = "1.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56ee889ecc9568871456d42f603d6a0ce59ff328d291063a45cbdf0036baf6db"
+checksum = "d97137b25e321a73eef1418d1d5d2eda4d77e12813f8e6dead84bc52c5870a7b"
 dependencies = [
  "cc",
  "pkg-config",
@@ -2390,7 +2392,7 @@ dependencies = [
 
 [[package]]
 name = "mail-server"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "directory",
  "imap",
@@ -3295,9 +3297,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.31"
+version = "1.0.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fe8a65d69dd0808184ebb5f836ab526bb259db23c657efa38711b1072ee47f0"
+checksum = "50f3b39ccfb720540debaa0164757101c08ecb8d326b15358ce76a62c7e85965"
 dependencies = [
  "proc-macro2",
 ]
@@ -3522,9 +3524,9 @@ dependencies = [
 
 [[package]]
 name = "roaring"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef0fb5e826a8bde011ecae6a8539dd333884335c57ff0f003fbe27c25bbe8f71"
+checksum = "6106b5cf8587f5834158895e9715a3c6c9716c8aefab57f1f7680917191c7873"
 dependencies = [
  "bytemuck",
  "byteorder",
@@ -3704,7 +3706,7 @@ checksum = "79ea77c539259495ce8ca47f53e66ae0330a8819f67e23ac96ca02f50e7b7d36"
 dependencies = [
  "log",
  "ring",
- "rustls-webpki 0.101.1",
+ "rustls-webpki 0.101.2",
  "sct",
 ]
 
@@ -3741,9 +3743,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.101.1"
+version = "0.101.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15f36a6828982f422756984e47912a7a51dcbc2a197aa791158f8ca61cd8204e"
+checksum = "513722fd73ad80a71f72b61009ea1b584bcfa1483ca93949c8f290298837fa59"
 dependencies = [
  "ring",
  "untrusted",
@@ -3832,9 +3834,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "2.9.1"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fc758eb7bffce5b308734e9b0c1468893cae9ff70ebf13e7090be8dcbcc83a8"
+checksum = "05b64fb303737d99b81884b2c63433e9ae28abebe5eb5045dcdd175dc2ecf4de"
 dependencies = [
  "bitflags 1.3.2",
  "core-foundation",
@@ -3845,9 +3847,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.9.0"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f51d0c0d83bec45f16480d0ce0058397a69e48fcdc52d1dc8855fb68acbd31a7"
+checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -3855,9 +3857,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.174"
+version = "1.0.176"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b88756493a5bd5e5395d53baa70b194b05764ab85b59e43e4b8f4e1192fa9b1"
+checksum = "76dc28c9523c5d70816e393136b86d48909cfb27cecaa902d338c19ed47164dc"
 dependencies = [
  "serde_derive",
 ]
@@ -3873,9 +3875,9 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.174"
+version = "1.0.176"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e5c3a298c7f978e53536f95a63bdc4c4a64550582f31a0359a9afda6aede62e"
+checksum = "a4e7b8c5dc823e3b90651ff1d3808419cd14e5ad76de04feaf37da114e7a306f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3884,9 +3886,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.103"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d03b412469450d4404fe8499a268edd7f8b79fecb074b0d812ad64ca21f4031b"
+checksum = "076066c5f1078eac5b722a31827a8832fe108bed65dfa75e233c89f8206e976c"
 dependencies = [
  "itoa",
  "ryu",
@@ -4002,7 +4004,7 @@ checksum = "43b2853a4d09f215c24cc5489c992ce46052d359b5109343cbafbf26bc62f8a3"
 [[package]]
 name = "sieve-rs"
 version = "0.3.1"
-source = "git+https://github.com/stalwartlabs/sieve#0ab2dc8cd41ee5dadcc3ab5e932b9b92abc5e067"
+source = "git+https://github.com/stalwartlabs/sieve#f9c01ba6947d73855fdd645b17c9a5d347724ee3"
 dependencies = [
  "ahash 0.8.3",
  "bincode",
@@ -4055,7 +4057,7 @@ checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
 
 [[package]]
 name = "smtp"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "ahash 0.8.3",
  "blake3",
@@ -4355,7 +4357,7 @@ dependencies = [
 
 [[package]]
 name = "stalwart-cli"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "clap",
  "console",
@@ -4377,7 +4379,7 @@ dependencies = [
 
 [[package]]
 name = "stalwart-install"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "base64 0.21.2",
  "clap",
@@ -5318,7 +5320,7 @@ version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b291546d5d9d1eab74f069c77749f2cb8504a12caa20f0f2de93ddbf6f411888"
 dependencies = [
- "rustls-webpki 0.101.1",
+ "rustls-webpki 0.101.2",
 ]
 
 [[package]]
diff --git a/pkgs/servers/mail/stalwart/default.nix b/pkgs/servers/mail/stalwart/default.nix
index 7cff28f413d1..66b0e2bdebc8 100644
--- a/pkgs/servers/mail/stalwart/default.nix
+++ b/pkgs/servers/mail/stalwart/default.nix
@@ -9,10 +9,11 @@
 , zstd
 , stdenv
 , darwin
+, nix-update-script
 }:
 
 let
-  version = "0.3.1";
+  version = "0.3.2";
 in
 rustPlatform.buildRustPackage {
   pname = "stalwart-mail";
@@ -22,7 +23,7 @@ rustPlatform.buildRustPackage {
     owner = "stalwartlabs";
     repo = "mail-server";
     rev = "v${version}";
-    hash = "sha256-RLLKZ1nUYv8fCEd6SSIpy7o88Ee5vs5EaPcfulCXiIU=";
+    hash = "sha256-5+r1xWpxIwyvRUPw2X4vIvbvqUe6lBcYurbxwNySXAY=";
     fetchSubmodules = true;
   };
 
@@ -35,7 +36,7 @@ rustPlatform.buildRustPackage {
       "mail-builder-0.3.0" = "sha256-0o/fV7ZKiRKeitBBt8yOM/2nXIEgOGSMEMaBj+3i7Kw=";
       "mail-parser-0.8.2" = "sha256-XvKEgzQ+HDoLI16CmqE/RRgApg0q9Au9sqOOEpZz6W0=";
       "mail-send-0.4.0" = "sha256-bMPI871hBj/RvrW4kESGS9XzfnkSo8r2/9uUwgE12EU=";
-      "sieve-rs-0.3.1" = "sha256-0LE98L7JEc6FObygIsln4Enw2kx8FnLotJ/fXGpc4E8=";
+      "sieve-rs-0.3.1" = "sha256-FJBQorFRXQYhiCzprAqiv69Qae9YI5OAipjayooFDAw=";
       "smtp-proto-0.1.1" = "sha256-HhKZQHQv3tMEfRZgCoAtyxVzwHbcB4FSjKlMoU1PkHg=";
     };
   };
@@ -64,6 +65,8 @@ rustPlatform.buildRustPackage {
   # Tests require reading to /etc/resolv.conf
   doCheck = false;
 
+  passthru.update-script = nix-update-script { };
+
   meta = with lib; {
     description = "Secure & Modern All-in-One Mail Server (IMAP, JMAP, SMTP)";
     homepage = "https://github.com/stalwartlabs/mail-server";

From de1e10bc783412637600c9bf148384c781b500f6 Mon Sep 17 00:00:00 2001
From: Lena Fuhrimann <6780471+cloudlena@users.noreply.github.com>
Date: Fri, 28 Jul 2023 13:33:31 +0200
Subject: [PATCH 08/37] zsh-history-substring-search: 1.0.2 -> 1.1.0

---
 pkgs/shells/zsh/zsh-history-substring-search/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/shells/zsh/zsh-history-substring-search/default.nix b/pkgs/shells/zsh/zsh-history-substring-search/default.nix
index 63e5fe8281e3..4b2aea76a7b7 100644
--- a/pkgs/shells/zsh/zsh-history-substring-search/default.nix
+++ b/pkgs/shells/zsh/zsh-history-substring-search/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zsh-history-substring-search";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "zsh-users";
     repo = "zsh-history-substring-search";
     rev = "v${version}";
-    sha256 = "0y8va5kc2ram38hbk2cibkk64ffrabfv1sh4xm7pjspsba9n5p1y";
+    sha256 = "0vjw4s0h4sams1a1jg9jx92d6hd2swq4z908nbmmm2qnz212y88r";
   };
 
   strictDeps = true;

From bab27b6419f73f8758538c93ba36786b7d386699 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 28 Jul 2023 11:49:01 +0000
Subject: [PATCH 09/37] python311Packages.aiohomekit: 2.6.11 -> 2.6.12

---
 pkgs/development/python-modules/aiohomekit/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index a2d14ff72a7e..c0d8da783758 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "2.6.11";
+  version = "2.6.12";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-oTH/YM21l9N03F9zFTOAvxgdG6SyL6qXeeA28jLAOq8=";
+    hash = "sha256-a1qxj/6VCnTqfcCfvjjnfM53JjJXP672wumGCvXwxUY=";
   };
 
   nativeBuildInputs = [

From adf434ca17631e8edcdb3e24d453bce75eaa03dc Mon Sep 17 00:00:00 2001
From: Babeuh <babeuh@rlglr.fr>
Date: Fri, 28 Jul 2023 13:59:13 +0200
Subject: [PATCH 10/37] multiviewer-for-f1: 1.24.1 -> 1.24.2

---
 pkgs/applications/video/multiviewer-for-f1/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/video/multiviewer-for-f1/default.nix b/pkgs/applications/video/multiviewer-for-f1/default.nix
index d373a850e65a..0c6dbe8e7a95 100644
--- a/pkgs/applications/video/multiviewer-for-f1/default.nix
+++ b/pkgs/applications/video/multiviewer-for-f1/default.nix
@@ -24,15 +24,15 @@
 }:
 
 let
-  id = "117980724";
+  id = "118976581";
 in
 stdenvNoCC.mkDerivation rec {
   pname = "multiviewer-for-f1";
-  version = "1.24.1";
+  version = "1.24.2";
 
   src = fetchurl {
     url = "https://releases.multiviewer.dev/download/${id}/multiviewer-for-f1_${version}_amd64.deb";
-    sha256 = "sha256-uEcxDIWolouIUJ8Xuva3rtW51gfCddAwTGqOBnucmmY=";
+    sha256 = "sha256-zll639fQFdrNvIj/4ECqEGxQw4VgfERGlti7opSmSi0=";
   };
 
   nativeBuildInputs = [

From 74cf9a8f98f896716cf7dba88244b4820ecc605c Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Fri, 28 Jul 2023 09:39:09 -0400
Subject: [PATCH 11/37] kbt: 1.1.0 -> 1.2.1

Diff: https://github.com/bloznelis/kbt/compare/1.1.0...1.2.1
---
 pkgs/applications/misc/kbt/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/kbt/default.nix b/pkgs/applications/misc/kbt/default.nix
index 918f463699a4..62c70b5630bd 100644
--- a/pkgs/applications/misc/kbt/default.nix
+++ b/pkgs/applications/misc/kbt/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kbt";
-  version = "1.1.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "bloznelis";
     repo = "kbt";
     rev = version;
-    hash = "sha256-dC/o5VzdhoggEgY2LvdapT4CuSdz2iI+zbv3RZD/8XU=";
+    hash = "sha256-IVKGpifLcpqPD4ZYP+1mY0EokNoQW6qSbxt66w6b81w=";
   };
 
-  cargoHash = "sha256-UVTUcc8OeGdCRGFt9FV1rQuOsVWmh2KEDpu1jSC0XHM=";
+  cargoHash = "sha256-iPsBYccLQdPvzaV7pRa3ZLFFwJ1lIJoFMWChLkQpyyk=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
     pkg-config

From 20e6ef62a7de5ea4d066bc9cb61cb52f932408d4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 28 Jul 2023 14:40:24 +0000
Subject: [PATCH 12/37] python311Packages.riscv-isac: 0.17.0 -> 0.18.0

---
 pkgs/development/python-modules/riscv-isac/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/riscv-isac/default.nix b/pkgs/development/python-modules/riscv-isac/default.nix
index 13aca2c0d7b6..651c27be676a 100644
--- a/pkgs/development/python-modules/riscv-isac/default.nix
+++ b/pkgs/development/python-modules/riscv-isac/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "riscv-isac";
-  version = "0.17.0";
+  version = "0.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "riscv-software-src";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-I0RsvSCrSlNGVj8z+WUQx6vbdNkKCRyMFvNx+0mTBAE=";
+    hash = "sha256-7CWUyYwzynFq/Qk5SzQB+ljsVVI98kPPDT63Emhqihw=";
   };
 
   postPatch = ''

From 71302e5c147ae5fa5c9ba798d6ffd78fa02403df Mon Sep 17 00:00:00 2001
From: rewine <lhongxu@outlook.com>
Date: Fri, 28 Jul 2023 23:22:52 +0800
Subject: [PATCH 13/37] cage: 0.1.4 ->0.1.5

---
 pkgs/applications/window-managers/cage/default.nix | 12 ++++--------
 pkgs/top-level/all-packages.nix                    |  2 +-
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/pkgs/applications/window-managers/cage/default.nix b/pkgs/applications/window-managers/cage/default.nix
index fafad73527dc..6c56c75418f9 100644
--- a/pkgs/applications/window-managers/cage/default.nix
+++ b/pkgs/applications/window-managers/cage/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub
 , meson, ninja, pkg-config, wayland-scanner, scdoc, makeWrapper
-, wlroots, wayland, wayland-protocols, pixman, libxkbcommon
+, wlroots, wayland, wayland-protocols, pixman, libxkbcommon, xcbutilwm
 , systemd, libGL, libX11, mesa
 , xwayland ? null
 , nixosTests
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cage";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "Hjdskes";
     repo = "cage";
     rev = "v${version}";
-    sha256 = "0vm96gxinhy48m3x9p1sfldyd03w3gk6iflb7n9kn06j1vqyswr6";
+    hash = "sha256-Suq14YRw/MReDRvO/TQqjpZvpzAEDnHUyVbQj0BPT4c=";
   };
 
   depsBuildBuild = [
@@ -24,15 +24,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson ninja pkg-config wayland-scanner scdoc makeWrapper ];
 
   buildInputs = [
-    wlroots wayland wayland-protocols pixman libxkbcommon
+    wlroots wayland wayland-protocols pixman libxkbcommon xcbutilwm
     mesa # for libEGL headers
     systemd libGL libX11
   ];
 
-  # https://github.com/cage-kiosk/cage/issues/231
-  # cage will segfault on start with `-m last` without this
-  CFLAGS = "-O0";
-
   mesonFlags = [ "-Dxwayland=${lib.boolToString (xwayland != null)}" ];
 
   postFixup = lib.optionalString (xwayland != null) ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2185766a0923..88edbffacd58 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30359,7 +30359,7 @@ with pkgs;
   cardo = callPackage ../data/fonts/cardo { };
 
   cage = callPackage ../applications/window-managers/cage {
-    wlroots = wlroots_0_14;
+    wlroots = wlroots_0_16;
   };
 
   calf = callPackage ../applications/audio/calf {

From 4e356caa4ef1eb78d44bed16dba77ac13cd1abe2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 28 Jul 2023 08:53:27 -0700
Subject: [PATCH 14/37] iptsd: 1.3.0 -> 1.3.1

Diff: https://github.com/linux-surface/iptsd/compare/v1.3.0...v1.3.1

Changelog: https://github.com/linux-surface/iptsd/releases/tag/v1.3.1
---
 pkgs/applications/misc/iptsd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/iptsd/default.nix b/pkgs/applications/misc/iptsd/default.nix
index 268538957344..833ea7203d11 100644
--- a/pkgs/applications/misc/iptsd/default.nix
+++ b/pkgs/applications/misc/iptsd/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iptsd";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "linux-surface";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-6sP50sdjuOijukztLQ4HoXqU9qjZuTzs5NMIBENVw2w=";
+    hash = "sha256-06KGMXkp5lR05iNQOll1h0q+Z+XWMberqG1C9Cs7VfA=";
   };
 
   nativeBuildInputs = [

From b94abe0b543f5d55c7d2580e05fd98a4db811493 Mon Sep 17 00:00:00 2001
From: StepBroBD <Hi@StepBroBD.com>
Date: Fri, 28 Jul 2023 09:40:12 -0700
Subject: [PATCH 15/37] airbuddy: 2.7 -> 2.7.1

---
 pkgs/os-specific/darwin/airbuddy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/airbuddy/default.nix b/pkgs/os-specific/darwin/airbuddy/default.nix
index 1dfb5cf1c135..303311ccb105 100644
--- a/pkgs/os-specific/darwin/airbuddy/default.nix
+++ b/pkgs/os-specific/darwin/airbuddy/default.nix
@@ -6,12 +6,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "airbuddy";
-  version = "2.7";
+  version = "2.7.1";
 
   src = fetchurl {
     name = "AirBuddy.dmg";
     url = "https://download.airbuddy.app/WebDownload/AirBuddy_v${finalAttrs.version}.dmg";
-    hash = "sha256-i/pxRG5o03jh9D46F9s8cSpf8A1aQEb+u3JiPjDlubA=";
+    hash = "sha256-z8iy3kIBO+1HDgmWxXmFHArLdw85CLNSMvMFZfEJAp0=";
   };
 
   dontPatch = true;

From b8c903826b042c1a38accf1b995f687717209c20 Mon Sep 17 00:00:00 2001
From: Elliot Cameron <nixpkgs-commits@deshaw.com>
Date: Fri, 28 Jul 2023 12:43:20 -0400
Subject: [PATCH 16/37] maintainers: add invokes-su

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index cc5b8172d8d7..e674f2ec1d8a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7237,6 +7237,12 @@
       fingerprint = "5CB5 9AA0 D180 1997 2FB3  E0EC 943A 1DE9 372E BE4E";
     }];
   };
+  invokes-su = {
+    email = "nixpkgs-commits@deshaw.com";
+    github = "invokes-su";
+    githubId = 88038050;
+    name = "Souvik Sen";
+  };
   ionutnechita = {
     email = "ionut_n2001@yahoo.com";
     github = "ionutnechita";

From 9c6274d5fbb0df562e542459494b30bcffa25ae1 Mon Sep 17 00:00:00 2001
From: Elliot Cameron <nixpkgs-commits@deshaw.com>
Date: Fri, 28 Jul 2023 12:43:44 -0400
Subject: [PATCH 17/37] maintainers: add de11n

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e674f2ec1d8a..16e267e5fd70 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3909,6 +3909,12 @@
     githubId = 75067;
     name = "Daniel Duan";
   };
+  de11n = {
+    email = "nixpkgs-commits@deshaw.com";
+    github = "de11n";
+    githubId = 130508846;
+    name = "Elliot Cameron";
+  };
   dearrude = {
     name = "Ebrahim Nejati";
     email = "dearrude@tfwno.gf";

From 8821dc9535bcb4daf3a334429df91324594130e7 Mon Sep 17 00:00:00 2001
From: Elliot Cameron <nixpkgs-commits@deshaw.com>
Date: Fri, 28 Jul 2023 12:28:58 -0400
Subject: [PATCH 18/37] maintainers: teams.deshaw: update members

---
 maintainers/team-list.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 5c0f0373d206..c0b8e88727fc 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -193,10 +193,11 @@ with lib.maintainers; {
   deshaw = {
     # Verify additions to this team with at least one already existing member of the team.
     members = [
-      limeytexan
+      de11n
+      invokes-su
     ];
     scope = "Group registration for D. E. Shaw employees who collectively maintain packages.";
-    shortName = "Shaw employees";
+    shortName = "D. E. Shaw employees";
   };
 
   determinatesystems = {

From 51e2937f85501c839aed9fe9275f7ef67782c900 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Fri, 28 Jul 2023 14:09:08 -0400
Subject: [PATCH 19/37] cargo-deny: 0.13.9 -> 0.14.0

Diff: https://github.com/EmbarkStudios/cargo-deny/compare/0.13.9...0.14.0

Changelog: https://github.com/EmbarkStudios/cargo-deny/blob/0.14.0/CHANGELOG.md
---
 .../tools/rust/cargo-deny/default.nix         | 30 +++++++------------
 1 file changed, 11 insertions(+), 19 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-deny/default.nix b/pkgs/development/tools/rust/cargo-deny/default.nix
index 37f4967a8ab6..89dcf0389e93 100644
--- a/pkgs/development/tools/rust/cargo-deny/default.nix
+++ b/pkgs/development/tools/rust/cargo-deny/default.nix
@@ -2,41 +2,33 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, libgit2_1_5
-, openssl
-, zlib
 , zstd
 , stdenv
-, curl
 , darwin
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deny";
-  version = "0.13.9";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
-    repo = pname;
+    repo = "cargo-deny";
     rev = version;
-    hash = "sha256-fkbYPn7GmnOgLvJqbizVKKLBnzVn0Ji6jQc23DimIX4=";
+    hash = "sha256-oNo/I0GblFnOZ6+/SBn31jp+Fywlf7PIpJQnWyPn8hU=";
   };
 
-  cargoHash = "sha256-WHr2Ky0LlK/EVOrSK3MF9Yt/Qe/6o7Ftx7X8iECj6pM=";
+  cargoHash = "sha256-DbC9VeJl0OObZNvMkTIp0caiBMlw2EvJ9ib1TCRlJGQ=";
 
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [
-    libgit2_1_5
-    openssl
-    zlib
-    zstd
-  ] ++ lib.optionals stdenv.isDarwin [
-    curl
-    darwin.apple_sdk.frameworks.Security
+  nativeBuildInputs = [
+    pkg-config
   ];
 
-  buildNoDefaultFeatures = true;
+  buildInputs = [
+    zstd
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;

From a916174941d4301dca9bcdebb8f6ec8319fd34ae Mon Sep 17 00:00:00 2001
From: Arjan Schrijver <github@anymore.nl>
Date: Fri, 28 Jul 2023 21:33:59 +0200
Subject: [PATCH 20/37] python3Packages.types-pillow: 9.5.0.4 -> 10.0.0.2

---
 pkgs/development/python-modules/types-pillow/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/types-pillow/default.nix b/pkgs/development/python-modules/types-pillow/default.nix
index fa0b37055c3b..c3c63592624f 100644
--- a/pkgs/development/python-modules/types-pillow/default.nix
+++ b/pkgs/development/python-modules/types-pillow/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "types-pillow";
-  version = "9.5.0.4";
+  version = "10.0.0.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "types-Pillow";
-    hash = "sha256-8bavR6vRUYR+4lkR/+unhImbx9x/nrqMpqWqxSKwEu8=";
+    hash = "sha256-/gk4CrItQSztmJoGfp7kr3Gfo6R7obU7IytGUUqHEEI=";
   };
 
   # Modules doesn't have tests

From 4798f154e44d0304d3f17a3c5f937d2ee99a30ec Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 28 Jul 2023 21:35:35 +0200
Subject: [PATCH 21/37] python311Packages.losant-rest: 1.17.5 -> 1.18.0

Diff: https://github.com/Losant/losant-rest-python/compare/v1.17.5...v1.18.0
---
 pkgs/development/python-modules/losant-rest/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix
index 1b97989636a5..7f0231c7d357 100644
--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.17.5";
+  version = "1.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     rev = "v${version}";
-    hash = "sha256-P3MpnVWjeB2OwqRcm4Wj6GixBDguMOFN227iM+e5Fi8=";
+    hash = "sha256-wl8L+ZQQgzWb7QUHWHSOT3meCn1baE7Prs1nWAOvnKo=";
   };
 
   propagatedBuildInputs = [

From dd28ccaf96ca269f021691dc4d8a402c672acf9a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 28 Jul 2023 21:43:03 +0200
Subject: [PATCH 22/37] python311Packages.pyschlage: 2023.6.0 -> 2023.7.0

Diff: https://github.com/dknowles2/pyschlage/compare/refs/tags/2023.6.0...2023.7.0

Changelog: https://github.com/dknowles2/pyschlage/releases/tag/2023.7.0
---
 pkgs/development/python-modules/pyschlage/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyschlage/default.nix b/pkgs/development/python-modules/pyschlage/default.nix
index 80920c5c9148..abc30c72ce84 100644
--- a/pkgs/development/python-modules/pyschlage/default.nix
+++ b/pkgs/development/python-modules/pyschlage/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyschlage";
-  version = "2023.6.0";
+  version = "2023.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "dknowles2";
     repo = "pyschlage";
     rev = "refs/tags/${version}";
-    hash = "sha256-ogYVk0Kvv595IlIa/qdV1lqlnW45IG29PX5EEaMaphw=";
+    hash = "sha256-PH8ClpuYwTu+34hSPPwI1KMFut6UaxWVrbf38LYb9EQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From e54f8b11a1a1e12000a5e303fbe663bc22248ec9 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 28 Jul 2023 21:54:59 +0200
Subject: [PATCH 23/37] python311Packages.python-homewizard-energy: 2.0.1 ->
 2.0.2

Diff: https://github.com/DCSBL/python-homewizard-energy/compare/refs/tags/v2.0.1...v2.0.2

Changelog: https://github.com/DCSBL/python-homewizard-energy/releases/tag/v2.0.2
---
 .../python-modules/python-homewizard-energy/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-homewizard-energy/default.nix b/pkgs/development/python-modules/python-homewizard-energy/default.nix
index c327257e0a92..bfb53c92df41 100644
--- a/pkgs/development/python-modules/python-homewizard-energy/default.nix
+++ b/pkgs/development/python-modules/python-homewizard-energy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "python-homewizard-energy";
-  version = "2.0.1";
+  version = "2.0.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "DCSBL";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-s3FNRpMZC/MG3s+ZDHgdsIT2AhvBDmGvJfutUPzY4wE=";
+    hash = "sha256-XTSnIL/hBL1Rsyv/tBce/WCvA3n7mZern0v3i6gTOeA=";
   };
 
   nativeBuildInputs = [

From ffabc8c65820ff71f4de8b4e4ecd09a94c38100f Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Fri, 28 Jul 2023 16:18:15 -0400
Subject: [PATCH 24/37] fetchfirefoxaddon: fix passing md5 to fetchurl

Broken in 6f30e0a9062685bd7aa3b9cf025b31f32af0463f.

See https://github.com/NixOS/nixpkgs/issues/245949.
---
 pkgs/build-support/fetchfirefoxaddon/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/build-support/fetchfirefoxaddon/default.nix b/pkgs/build-support/fetchfirefoxaddon/default.nix
index 41eaa550ea27..e07a6a1a79dd 100644
--- a/pkgs/build-support/fetchfirefoxaddon/default.nix
+++ b/pkgs/build-support/fetchfirefoxaddon/default.nix
@@ -9,7 +9,6 @@
 
 { name
 , url ? null
-, md5 ? ""
 , sha1 ? ""
 , sha256 ? ""
 , sha512 ? ""
@@ -23,7 +22,7 @@ let
   source = if url == null then src else
   fetchurl {
     url = url;
-    inherit md5 sha1 sha256 sha512 hash;
+    inherit sha1 sha256 sha512 hash;
   };
 in
 stdenv.mkDerivation {

From 2dbda3314fb7bef997d93ce641e9a82752072485 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jaros=C5=82aw=20Wygoda?= <jaroslaw@wygoda.me>
Date: Wed, 26 Jul 2023 19:32:52 +0200
Subject: [PATCH 25/37] nixos/tailscale: add extraUpFlags option

---
 .../modules/services/networking/tailscale.nix  | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/services/networking/tailscale.nix b/nixos/modules/services/networking/tailscale.nix
index dfb5422a1e9a..f308b7e33114 100644
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@@ -29,12 +29,7 @@ in {
       description = lib.mdDoc "Username or user ID of the user allowed to to fetch Tailscale TLS certificates for the node.";
     };
 
-    package = mkOption {
-      type = types.package;
-      default = pkgs.tailscale;
-      defaultText = literalExpression "pkgs.tailscale";
-      description = lib.mdDoc "The package to use for tailscale";
-    };
+    package = lib.mkPackageOptionMD pkgs "tailscale" {};
 
     useRoutingFeatures = mkOption {
       type = types.enum [ "none" "client" "server" "both" ];
@@ -58,6 +53,13 @@ in {
         A file containing the auth key.
       '';
     };
+
+    extraUpFlags = mkOption {
+      description = lib.mdDoc "Extra flags to pass to {command}`tailscale up`.";
+      type = types.listOf types.str;
+      default = [];
+      example = ["--ssh"];
+    };
   };
 
   config = mkIf cfg.enable {
@@ -98,10 +100,10 @@ in {
       serviceConfig = {
         Type = "oneshot";
       };
-      script = with pkgs; ''
+      script = ''
         status=$(${config.systemd.package}/bin/systemctl show -P StatusText tailscaled.service)
         if [[ $status != Connected* ]]; then
-          ${pkgs.tailscale}/bin/tailscale up --auth-key 'file:${cfg.authKeyFile}'
+          ${cfg.package}/bin/tailscale up --auth-key 'file:${cfg.authKeyFile}' ${escapeShellArgs cfg.extraUpFlags}
         fi
       '';
     };

From 19a2f8dfb87c55a2825ac4e37e6db3a1574477ca Mon Sep 17 00:00:00 2001
From: Kiskae <Kiskae@users.noreply.github.com>
Date: Fri, 28 Jul 2023 23:08:20 +0200
Subject: [PATCH 26/37] linuxPackages.nvidia_x11_vulkan_beta: 525.47.34 ->
 525.47.35

---
 pkgs/os-specific/linux/nvidia-x11/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 254a02f1f0c1..8f1ca40aa97c 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -65,11 +65,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "525.47.34";
+    version = "525.47.35";
     persistencedVersion = "525.116.04";
     settingsVersion = "525.116.04";
-    sha256_64bit = "sha256-/QJmOZtzS7mnjWupz1RwVeqDAiqx4nw4xPp6mEGUHlk=";
-    openSha256 = "sha256-bQ7qW9KOPAxccbBfQs7s+UX4TrIW/eI4CvjIMlLekfo=";
+    sha256_64bit = "sha256-HnjCHsHHH/fqqyc8dXDx/wQhVkXWoH5Z9jJ+/zQWNFc=";
+    openSha256 = "sha256-/qkCMybr8sC/Da9zi2KbSkLBeQcSbVURnAg1IbjZiBk=";
     settingsSha256 = "sha256-qNjfsT9NGV151EHnG4fgBonVFSKc4yFEVomtXg9uYD4=";
     persistencedSha256 = "sha256-ci86XGlno6DbHw6rkVSzBpopaapfJvk0+lHcR4LDq50=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitString "." version)}-linux";

From e847a2742aa1f9a189f58c41f66c5959ac5a2ef5 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Fri, 28 Jul 2023 17:34:31 -0400
Subject: [PATCH 27/37] psitop: 1.0.0 -> 1.1.3

Diff: https://github.com/jamespwilliams/psitop/compare/1.0.0...1.1.3
---
 pkgs/applications/system/psitop/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/system/psitop/default.nix b/pkgs/applications/system/psitop/default.nix
index a3080338b89a..cfcdf2488f6a 100644
--- a/pkgs/applications/system/psitop/default.nix
+++ b/pkgs/applications/system/psitop/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "psitop";
-  version = "1.0.0";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "jamespwilliams";
     repo = "psitop";
     rev = version;
-    hash = "sha256-C8WEbA7XXohKFz7QgII0LPU1eJ4Z7CSlmEOamgo4wQI=";
+    hash = "sha256-TD+NTlfmBtz+m2w2FnTcUIJQakpvVBCK/MAHfCrOue4=";
   };
 
   vendorHash = "sha256-oLtKpBvTsM5TbzfWIDfqgb7DL5D3Mldu0oimVeiUeSc=";

From 174cbb964f6b518d3318fa86187b244fb519b80a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 29 Jul 2023 00:13:31 +0000
Subject: [PATCH 28/37] kapp: 0.57.1 -> 0.58.0

---
 pkgs/tools/networking/kapp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/kapp/default.nix b/pkgs/tools/networking/kapp/default.nix
index 1170fffad96c..8238253636cb 100644
--- a/pkgs/tools/networking/kapp/default.nix
+++ b/pkgs/tools/networking/kapp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kapp";
-  version = "0.57.1";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-kapp";
     rev = "v${version}";
-    sha256 = "sha256-JNo6+WlMcIUGb/36GM6ofvJBIJnF4oRocdYsEw7V1Ks=";
+    sha256 = "sha256-E5QiR4hcO2Ii5qXAlMrw9Yxy8IYqjnonSGiUUyzhMVc=";
   };
 
   vendorHash = null;

From 797c3cad71eb40741f9b789651eeff52a078fefd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 29 Jul 2023 00:28:21 +0000
Subject: [PATCH 29/37] libzim: 8.2.0 -> 8.2.1

---
 pkgs/development/libraries/libzim/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libzim/default.nix b/pkgs/development/libraries/libzim/default.nix
index 0f2ad8406376..f9bcdeb933b0 100644
--- a/pkgs/development/libraries/libzim/default.nix
+++ b/pkgs/development/libraries/libzim/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libzim";
-  version = "8.2.0";
+  version = "8.2.1";
 
   src = fetchFromGitHub {
     owner = "openzim";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Xh1SQNmG4lQ3f/g+i5m36LJO9JlPzP4bNqhyyKT7NEA=";
+    hash = "sha256-bhztigbiIGdVxBV5cpuHuuRGBN5UgC39w51uwLEq47w=";
   };
 
   nativeBuildInputs = [

From 788ecd08fea1071ca214d53f1e47c8adff4fed69 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 29 Jul 2023 01:20:23 +0000
Subject: [PATCH 30/37] circleci-cli: 0.1.27660 -> 0.1.28084

---
 pkgs/development/tools/misc/circleci-cli/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index 283949b3617e..a6808c2bb3bd 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.27660";
+  version = "0.1.28084";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bor2rQfyvUD6SYSxYYTTL7TvvFuZ0oZdN0E+HoVCo28=";
+    sha256 = "sha256-LyD9zAS/tjI6Ad+tC2mCadOEuXHlhkNpF0M5lzli5Qc=";
   };
 
-  vendorHash = "sha256-Tbce59lQsj6Db0B734PAWiAz9NbLCp43it28j5IJf68=";
+  vendorHash = "sha256-bPi0voXVJPAMWuovDInzk2PzbP0kPFpyOyjYoPZTNLM=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From b2f61e8ba04b5630f80e45faaee69355791e054d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 29 Jul 2023 01:30:58 +0000
Subject: [PATCH 31/37] killport: 0.9.0 -> 0.9.1

---
 pkgs/tools/misc/killport/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/killport/default.nix b/pkgs/tools/misc/killport/default.nix
index 44484c17ef58..714beb78dccd 100644
--- a/pkgs/tools/misc/killport/default.nix
+++ b/pkgs/tools/misc/killport/default.nix
@@ -5,14 +5,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "killport";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-aGnjLgDn86OUFQGj7K7+DUSGJuNEIL52yXJz/Mt5DT0=";
+    hash = "sha256-aaKvrWJGZ26wyqoblAcUkGUPkbt8XNx9Z4xT+qI2B3o=";
   };
 
-  cargoHash = "sha256-Z3+hqssm5g7rl3XCnrmjuPhsG8E0Yc2Qg8/mjGlnaT4=";
+  cargoHash = "sha256-4CUMt5aDHq943uU5PAY1TJtmCqlBvgOruGQ69OG5fB4=";
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 

From bd4cdb0b3568f4c1dd64a92466c840b20dc0f4fa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 29 Jul 2023 01:43:27 +0000
Subject: [PATCH 32/37] lefthook: 1.4.6 -> 1.4.7

---
 pkgs/applications/version-management/lefthook/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/lefthook/default.nix b/pkgs/applications/version-management/lefthook/default.nix
index 66d61bac7123..e4e9010f64e2 100644
--- a/pkgs/applications/version-management/lefthook/default.nix
+++ b/pkgs/applications/version-management/lefthook/default.nix
@@ -6,7 +6,7 @@
 
 let
   pname = "lefthook";
-  version = "1.4.6";
+  version = "1.4.7";
 in
 buildGoModule rec {
   inherit pname version;
@@ -15,7 +15,7 @@ buildGoModule rec {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-2SgzNDG63Lsddhn1phqBNuar4I5Gr4mkHv3pYvMIZ28=";
+    hash = "sha256-zpey+2j0pLpE+wvqPcjVS5Mp+eQJiYtRsFAC8lPh4ck=";
   };
 
   vendorHash = "sha256-/VLS7+nPERjIU7V2CzqXH69Z3/y+GKZbAFn+KcRKRuA=";

From 5dbff84445feb756a122c75bbb1de4c2f070e57b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 29 Jul 2023 02:18:11 +0000
Subject: [PATCH 33/37] proxify: 0.0.9 -> 0.0.10

---
 pkgs/tools/networking/proxify/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/networking/proxify/default.nix b/pkgs/tools/networking/proxify/default.nix
index 17ba57f3cd72..27cc53522b71 100644
--- a/pkgs/tools/networking/proxify/default.nix
+++ b/pkgs/tools/networking/proxify/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "proxify";
-  version = "0.0.9";
+  version = "0.0.10";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "proxify";
     rev = "refs/tags/v${version}";
-    hash = "sha256-InHo5nfgCLDxciwjaB9tamV6MGEM3DlRGU00Ng2SfVY=";
+    hash = "sha256-bEAPj72HDiJHTN1WF50ow1OUwwsPhFwAkCvvEqgsVcA=";
   };
 
-  vendorHash = "sha256-GPkxUU9HXLWnj+qjee/CuSE683l2V22cH9KBP2ssaXc=";
+  vendorHash = "sha256-ViUMPHj1udvyy19XToq3f7Bj708v6DuBg5k0tMtZmHA=";
 
   meta = with lib; {
     description = "Proxy tool for HTTP/HTTPS traffic capture";

From 7535dce48c6d47db958a0fe7b65739b7fc50440a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 29 Jul 2023 02:29:09 +0000
Subject: [PATCH 34/37] kubernetes-metrics-server: 0.6.3 -> 0.6.4

---
 .../networking/cluster/kubernetes-metrics-server/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/kubernetes-metrics-server/default.nix b/pkgs/applications/networking/cluster/kubernetes-metrics-server/default.nix
index 4ac7a163b38e..9efefd064667 100644
--- a/pkgs/applications/networking/cluster/kubernetes-metrics-server/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes-metrics-server/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubernetes-metrics-server";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "metrics-server";
     rev = "v${version}";
-    sha256 = "sha256-hPI+Wq0mZ2iu4FSDpdPdGEqgFCeUdqeK5ldJCByDE4M=";
+    sha256 = "sha256-e9iFOe2iZaKbYNUk0vuyzcGDCNxot34kRH06L5UQs4I=";
   };
 
   vendorHash = "sha256-BR9mBBH5QE3FMTNtyHfHA1ei18CIDr5Yhvg28hGbDR4=";

From 0abed5ec8a0ed7457447ed963b72a452195ca214 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 29 Jul 2023 03:20:02 +0000
Subject: [PATCH 35/37] vals: 0.25.0 -> 0.26.1

---
 pkgs/tools/security/vals/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/vals/default.nix b/pkgs/tools/security/vals/default.nix
index e26cbda2aa8b..0e86d644c82b 100644
--- a/pkgs/tools/security/vals/default.nix
+++ b/pkgs/tools/security/vals/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "vals";
-  version = "0.25.0";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "variantdev";
     repo = pname;
-    sha256 = "sha256-MofzTQM/dREw9b+IzjvexKoYZZ/ptbdWICROtwYK4X8=";
+    sha256 = "sha256-gICEqwt34pllvxA8JVc0rCQ2F3w6wT96eKTTxE0j398=";
   };
 
   vendorHash = "sha256-6DJiqDEgEHQbyIt4iShoBnagBvspd3W3vD56/FGjESs=";

From 2c7ab46ea685fbac379160c9913968cfee7685c4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 29 Jul 2023 03:30:06 +0000
Subject: [PATCH 36/37] efm-langserver: 0.0.44 -> 0.0.46

---
 pkgs/development/tools/efm-langserver/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/efm-langserver/default.nix b/pkgs/development/tools/efm-langserver/default.nix
index 788c4edc9a86..c696fbaa995a 100644
--- a/pkgs/development/tools/efm-langserver/default.nix
+++ b/pkgs/development/tools/efm-langserver/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "efm-langserver";
-  version = "0.0.44";
+  version = "0.0.46";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "efm-langserver";
     rev = "v${version}";
-    sha256 = "sha256-+yN08MAoFaixvt2EexhRNucG6I4v2FdHf44XlYIwzhA=";
+    sha256 = "sha256-mGcpV4PDD6HJZH+3Lybsds4xPJS5rkOouKqKX7j+7WA=";
   };
 
-  vendorSha256 = "sha256-KABezphT5/o3XWSFNe2OvfawFR8uwsGMnjsI9xh378Q=";
+  vendorHash = "sha256-KABezphT5/o3XWSFNe2OvfawFR8uwsGMnjsI9xh378Q=";
   subPackages = [ "." ];
 
   meta = with lib; {

From f1468a99463b4e94ff049263e3fda6efd10fe21d Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Sat, 29 Jul 2023 01:34:33 -0400
Subject: [PATCH 37/37] blender: Build with Draco support (#245535)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

See https://github.com/NixOS/nixpkgs/issues/217921

Blender sets WITH_DRACO=OFF if WITH_PYTHON_INSTALL=OFF, however that’s
not totally necessary. Removing that forced-set then builds with
WITH_DRACO=ON, however Blender fails to launch because this creates
e.g. `share/blender/3.6/python`, and Blender then sets this as Python’s
home dir, so Python fails to init since it expects Python core to be
there (and it’s not). I couldn’t figure out how Blender sets Python’s
home dir, and explicitly setting PYTHONHOME in the env didn’t have any
effect. So instead just rename that dir to python-ext to avoid this
behavior. All that is left then is to adjust where Blender is looking
for the Draco lib.

This functionality may be verified by:

1. Visiting File → Export → glTF 2.0
2. In the right side panel (press the gear icon in top-right if not
   visible), expanding “Data”
3. Enabling “Compression”
4. Press “Export glTF 2.0”
5. Verify:
   - Blender stdout+stderr shows “Draco mesh compression is available”
   - no error or warning message
   - exported file exists
---
 pkgs/applications/misc/blender/default.nix |  5 ++++-
 pkgs/applications/misc/blender/draco.patch | 26 ++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/applications/misc/blender/draco.patch

diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index f6f5edc84ef8..58cdf9592cdc 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -35,7 +35,9 @@ stdenv.mkDerivation rec {
     hash = "sha256-SzdWyzdGhsaesv1VX5ZUfUnLHvRvW8buJTlOVxz6yOk=";
   };
 
-  patches = lib.optional stdenv.isDarwin ./darwin.patch;
+  patches = [
+    ./draco.patch
+  ] ++ lib.optional stdenv.isDarwin ./darwin.patch;
 
   nativeBuildInputs =
     [ cmake makeWrapper python310Packages.wrapPython llvmPackages.llvm.dev
@@ -165,6 +167,7 @@ stdenv.mkDerivation rec {
     mkdir $out/Applications
     mv $out/Blender.app $out/Applications
   '' + ''
+    mv $out/share/blender/${lib.versions.majorMinor version}/python{,-ext}
     buildPythonPath "$pythonPath"
     wrapProgram $blenderExecutable \
       --prefix PATH : $program_PATH \
diff --git a/pkgs/applications/misc/blender/draco.patch b/pkgs/applications/misc/blender/draco.patch
new file mode 100644
index 000000000000..2a856a0638ae
--- /dev/null
+++ b/pkgs/applications/misc/blender/draco.patch
@@ -0,0 +1,26 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -898,11 +898,6 @@ set_and_warn_dependency(WITH_PYTHON WITH_CYCLES        OFF)
+ set_and_warn_dependency(WITH_PYTHON WITH_DRACO         OFF)
+ set_and_warn_dependency(WITH_PYTHON WITH_MOD_FLUID     OFF)
+ 
+-if(WITH_DRACO AND NOT WITH_PYTHON_INSTALL)
+-  message(STATUS "WITH_DRACO requires WITH_PYTHON_INSTALL to be ON, disabling WITH_DRACO for now")
+-  set(WITH_DRACO OFF)
+-endif()
+-
+ # enable boost for cycles, audaspace or i18n
+ # otherwise if the user disabled
+ 
+--- a/scripts/addons/io_scene_gltf2/io/com/gltf2_io_draco_compression_extension.py
++++ b/scripts/addons/io_scene_gltf2/io/com/gltf2_io_draco_compression_extension.py
+@@ -17,7 +17,7 @@ def dll_path() -> Path:
+     """
+     lib_name = 'extern_draco'
+-    blender_root = Path(bpy.app.binary_path).parent
++    blender_root = Path(bpy.app.binary_path).parent.parent
+-    python_lib = Path('{v[0]}.{v[1]}/python/lib'.format(v=bpy.app.version))
++    python_lib = Path('share/blender/{v[0]}.{v[1]}/python-ext/lib'.format(v=bpy.app.version))
+     python_version = 'python{v[0]}.{v[1]}'.format(v=sys.version_info)
+ 
+     path = os.environ.get('BLENDER_EXTERN_DRACO_LIBRARY_PATH')