Merge master into haskell-updates

2023-03-29 00:14:47 +00:00 · 2023-03-29 00:14:47 +00:00 · f41b2e5230
parent 7bf643e2ce ed65ee50e0
commit f41b2e5230
264 changed files with 3072 additions and 2183 deletions
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@ -3,7 +3,7 @@
 Building software with Nix often requires downloading source code and other files from the internet.
 `nixpkgs` provides *fetchers* for different protocols and services. Fetchers are functions that simplify downloading files.

-## Caveats
+## Caveats {#chap-pkgs-fetchers-caveats}

 Fetchers create [fixed output derivations](https://nixos.org/manual/nix/stable/#fixed-output-drvs) from downloaded files.
 Nix can reuse the downloaded files via the hash of the resulting derivation.
--- a/doc/builders/images/binarycache.section.md
+++ b/doc/builders/images/binarycache.section.md
@ -6,7 +6,7 @@ Nix packages are most commonly shared between machines using [HTTP, SSH, or S3](

 Note that this function is meant for advanced use-cases. The more idiomatic way to work with flat-file binary caches is via the [nix-copy-closure](https://nixos.org/manual/nix/stable/command-ref/nix-copy-closure.html) command. You may also want to consider [dockerTools](#sec-pkgs-dockerTools) for your containerization needs.

-## Example
+## Example {#sec-pkgs-binary-cache-example}

 The following derivation will construct a flat-file binary cache containing the closure of `hello`.

--- a/doc/builders/images/dockertools.section.md
+++ b/doc/builders/images/dockertools.section.md
@ -410,7 +410,7 @@ If the derivation is fully buildable (i.e. `nix-build` can be used on it), runni
 The behavior doesn't match `nix-shell` or `nix-build` exactly and this function is known not to work correctly for e.g. fixed-output derivations, content-addressed derivations, impure derivations and other special types of derivations.
 :::

-### Arguments
+### Arguments {#ssec-pkgs-dockerTools-buildNixShellImage-arguments}

 `drv`

@ -473,7 +473,7 @@ The behavior doesn't match `nix-shell` or `nix-build` exactly and this function

    *Default:* (none)

-### Example
+### Example {#ssec-pkgs-dockerTools-buildNixShellImage-example}

 The following shows how to build the `pkgs.hello` package inside a Docker container built with `buildNixShellImage`.

--- a/doc/builders/images/makediskimage.section.md
+++ b/doc/builders/images/makediskimage.section.md
@ -12,12 +12,12 @@ Whereas for many web servers, applications, it is possible to work with a Nix st

 NixOS tests also use this function when preparing the VM. The `cptofs` method is used when `virtualisation.useBootLoader` is false (the default). Otherwise the second method is used.

-## Features
+## Features {#sec-make-disk-image-features}

 For reference, read the function signature source code for documentation on arguments: <https://github.com/NixOS/nixpkgs/blob/master/nixos/lib/make-disk-image.nix>.
 Features are separated in various sections depending on if you opt for a Nix-store only image or a full NixOS image.

-### Common
+### Common {#sec-make-disk-image-features-common}

 - arbitrary NixOS configuration
 - automatic or bound disk size: `diskSize` parameter, `additionalSpace` can be set when `diskSize` is `auto` to add a constant of disk space
@ -29,7 +29,7 @@ Features are separated in various sections depending on if you opt for a Nix-sto
 - the current nixpkgs can be realized as a channel in the disk image, which will change the hash of the image when the sources are updated
 - additional store paths can be provided through `additionalPaths`

-### Full NixOS image
+### Full NixOS image {#sec-make-disk-image-features-full-image}

 - arbitrary contents with permissions can be placed in the target filesystem using `contents`
 - a `/etc/nixpkgs/nixos/configuration.nix` can be provided through `configFile`
@ -37,7 +37,7 @@ Features are separated in various sections depending on if you opt for a Nix-sto
 - EFI variables can be mutated during image production and the result is exposed in `$out`
 - boot partition size when partition table is `efi` or `hybrid`

-### On bit-to-bit reproducibility
+### On bit-to-bit reproducibility {#sec-make-disk-image-features-reproducibility}

 Images are **NOT** deterministic, please do not hesitate to try to fix this, source of determinisms are (not exhaustive) :

@ -47,7 +47,7 @@ Images are **NOT** deterministic, please do not hesitate to try to fix this, sou

 A `deterministic` flag is available for best efforts determinism.

-## Usage
+## Usage {#sec-make-disk-image-usage}

 To produce a Nix-store only image:
 ```nix
--- a/doc/builders/special/makesetuphook.section.md
+++ b/doc/builders/special/makesetuphook.section.md
@ -12,7 +12,7 @@ pkgs.makeSetupHook {
 } ./script.sh
 ```

-#### setup hook that depends on the hello package and runs hello and @shell@ is substituted with path to bash
+#### setup hook that depends on the hello package and runs hello and @shell@ is substituted with path to bash {#sec-pkgs.makeSetupHook-usage-example}

 ```nix
 pkgs.makeSetupHook {
@ -27,7 +27,7 @@ pkgs.makeSetupHook {
 '')
 ```

-## Attributes
+## Attributes {#sec-pkgs.makeSetupHook-attributes}

 * `name` Set the name of the hook.
 * `propagatedBuildInputs` Runtime dependencies (such as binaries) of the hook.
--- a/doc/builders/special/mkshell.section.md
+++ b/doc/builders/special/mkshell.section.md
@ -20,7 +20,7 @@ pkgs.mkShell {
 }
 ```

-## Attributes
+## Attributes {#sec-pkgs-mkShell-attributes}

 * `name` (default: `nix-shell`). Set the name of the derivation.
 * `packages` (default: `[]`). Add executable packages to the `nix-shell` environment.
@ -29,7 +29,7 @@ pkgs.mkShell {

 ... all the attributes of `stdenv.mkDerivation`.

-## Building the shell
+## Building the shell {#sec-pkgs-mkShell-building}

 This derivation output will contain a text file that contains a reference to
 all the build inputs. This is useful in CI where we want to make sure that
--- a/doc/builders/testers.chapter.md
+++ b/doc/builders/testers.chapter.md
@ -178,7 +178,7 @@ letting NixOS invoke Nixpkgs anew.
 If a test machine needs to set NixOS options under `nixpkgs`, it must set only the
 `nixpkgs.pkgs` option.

-### Parameter
+### Parameter {#tester-nixosTest-parameter}

 A [NixOS VM test network](https://nixos.org/nixos/manual/index.html#sec-nixos-tests), or path to it. Example:

@ -200,7 +200,7 @@ A [NixOS VM test network](https://nixos.org/nixos/manual/index.html#sec-nixos-te
 }
 ```

-### Result
+### Result {#tester-nixosTest-result}

 A derivation that runs the VM test.

--- a/doc/contributing/submitting-changes.chapter.md
+++ b/doc/contributing/submitting-changes.chapter.md
@ -290,7 +290,7 @@ Other examples of reasons are:
 - The previous download links were all broken
 - Crash when starting on some X11 systems

-#### Acceptable backport criteria
+#### Acceptable backport criteria {#acceptable-backport-criteria}

 The stable branch does have some changes which cannot be backported. Most notable are breaking changes. The desire is to have stable users be uninterrupted when updating packages.

--- a/doc/languages-frameworks/agda.section.md
+++ b/doc/languages-frameworks/agda.section.md
@ -216,7 +216,7 @@ you can test whether it builds correctly by writing in a comment:
@ofborg build agdaPackages.iowa-stdlib
 ```

-### Maintaining Agda packages
+### Maintaining Agda packages {#agda-maintaining-packages}

 As mentioned before, the aim is to have a compatible, and up-to-date package set.
 These two conditions sometimes exclude each other:
--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@ -281,11 +281,11 @@ mkShell {
 }
 ```

-### Using an overlay
+### Using an overlay {#beam-using-overlays}

 If you need to use an overlay to change some attributes of a derivation, e.g. if you need a bugfix from a version that is not yet available in nixpkgs, you can override attributes such as `version` (and the corresponding `hash`) and then use this overlay in your development environment:

-#### `shell.nix`
+#### `shell.nix` {#beam-using-overlays-shell.nix}

 ```nix
 let
--- a/doc/languages-frameworks/chicken.section.md
+++ b/doc/languages-frameworks/chicken.section.md
@ -4,7 +4,7 @@
 [R⁵RS](https://schemers.org/Documents/Standards/R5RS/HTML/)-compliant Scheme
 compiler. It includes an interactive mode and a custom package format, "eggs".

-## Using Eggs
+## Using Eggs {#sec-chicken-using}

 Eggs described in nixpkgs are available inside the
 `chickenPackages.chickenEggs` attrset. Including an egg as a build input is
@ -22,7 +22,7 @@ might write:
 Both `chicken` and its eggs have a setup hook which configures the environment
 variables `CHICKEN_INCLUDE_PATH` and `CHICKEN_REPOSITORY_PATH`.

-## Updating Eggs
+## Updating Eggs {#sec-chicken-updating-eggs}

 nixpkgs only knows about a subset of all published eggs. It uses
 [egg2nix](https://github.com/the-kenny/egg2nix) to generate a
@ -36,7 +36,7 @@ $ cd pkgs/development/compilers/chicken/5/
 $ egg2nix eggs.scm > eggs.nix
 ```

-## Adding Eggs
+## Adding Eggs {#sec-chicken-adding-eggs}

 When we run `egg2nix`, we obtain one collection of eggs with
 mutually-compatible versions. This means that when we add new eggs, we may
--- a/doc/languages-frameworks/cuelang.section.md
+++ b/doc/languages-frameworks/cuelang.section.md
@ -7,7 +7,7 @@
 - do configuration akin to [Dhall Lang](https://dhall-lang.org/)
 - perform data validation

-## Cuelang schema quick start
+## Cuelang schema quick start {#cuelang-quickstart}

 Cuelang schemas are similar to JSON, here is a quick cheatsheet:

@ -21,7 +21,7 @@ Cuelang schemas are similar to JSON, here is a quick cheatsheet:
 - Read <https://cuelang.org/docs/concepts/logic/> to learn more about the semantics.
 - Read <https://cuelang.org/docs/references/spec/> to learn about the language specification.

-## `writeCueValidator`
+## `writeCueValidator` {#cuelang-writeCueValidator}

 Nixpkgs provides a `pkgs.writeCueValidator` helper, which will write a validation script based on the provided Cuelang schema.

--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@ -160,7 +160,7 @@ All `haskell.packages.*` package sets use the same package descriptions and the
 of versions by default. There are however GHC version specific override `.nix`
 files to loosen this a bit.

-### Dependency resolution
+### Dependency resolution {#haskell-dependency-resolution}

 Normally when you build Haskell packages with `cabal-install`, `cabal-install`
 does dependency resolution. It will look at all Haskell package versions known
@ -230,7 +230,7 @@ specification, test suites, benchmarks etc. by compiling and invoking the
 package's `Setup.hs`. It does *not* use or invoke the `cabal-install` binary,
 but uses the underlying `Cabal` library instead.

-### General arguments
+### General arguments {#haskell-derivation-args}

 `pname`
 : Package name, assumed to be the same as on Hackage (if applicable)
@ -479,7 +479,7 @@ are especially useful when writing [overrides](#haskell-overriding-haskell-packa
 when you want to make sure that they are definitely included. However, it is
 recommended to use the more accurate ones listed above when possible.

-### Meta attributes
+### Meta attributes {#haskell-derivation-meta}

 `haskellPackages.mkDerivation` accepts the following attributes as direct
 arguments which are transparently set in `meta` of the resulting derivation. See
@ -714,7 +714,7 @@ editor plugin to achieve this.

 ## Overriding Haskell packages {#haskell-overriding-haskell-packages}

-### Overriding a single package
+### Overriding a single package {#haskell-overriding-a-single-package}

 <!-- TODO(@sternenseemann): we should document /somewhere/ that base == null etc. -->

@ -803,7 +803,7 @@ lib.pipe my-haskell-package [
 ]
 ```

-#### `haskell.lib.compose`
+#### `haskell.lib.compose` {#haskell-haskell.lib.compose}

 The base interface for all overriding is the following function:

@ -826,7 +826,7 @@ following overview. Refer to the
 [documentation of `haskellPackages.mkDerivation`](#haskell-mkderivation)
 for a more detailed description of the effects of the respective arguments.

-##### Packaging Helpers
+##### Packaging Helpers {#haskell-packaging-helpers}

 `overrideSrc { src, version } drv`
 : Replace the source used for building `drv` with the path or derivation given
@ -875,7 +875,7 @@ sometimes necessary when working with versioned packages in
 altogether. Useful if it fails to evaluate cleanly and is causing
 noise in the evaluation errors tab on Hydra.

-##### Development Helpers
+##### Development Helpers {#haskell-development-helpers}

 `sdistTarball drv`
 : Create a source distribution tarball like those found on Hackage
@ -913,7 +913,7 @@ for debugging with e.g. `gdb`.

 <!-- TODO(@sternenseemann): shellAware -->

-##### Trivial Helpers
+##### Trivial Helpers {#haskell-trivial-helpers}

 `doJailbreak drv`
 : Sets the `jailbreak` argument to `true` for `drv`.
@ -998,7 +998,7 @@ benchmark component.
 `dontCoverage drv`
 : Sets the `doCoverage` argument to `false` for `drv`.

-#### Library functions in the Haskell package sets
+#### Library functions in the Haskell package sets {#haskell-package-set-lib-functions}

 Some library functions depend on packages from the Haskell package sets. Thus they are
 exposed from those instead of from `haskell.lib.compose` which can only access what is
@ -1062,7 +1062,7 @@ it does for the unstable branches.

 ## F.A.Q. {#haskell-faq}

-### Why is topic X not covered in this section? Why is section Y missing?
+### Why is topic X not covered in this section? Why is section Y missing? {#haskell-why-not-covered}

 We have been working on [moving the nixpkgs Haskell documentation back into the
 nixpkgs manual](https://github.com/NixOS/nixpkgs/issues/121403). Since this
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@ -6,16 +6,16 @@ This contains instructions on how to package javascript applications.

 The various tools available will be listed in the [tools-overview](#javascript-tools-overview). Some general principles for packaging will follow. Finally some tool specific instructions will be given.

-## Getting unstuck / finding code examples
+## Getting unstuck / finding code examples {#javascript-finding-examples}

 If you find you are lacking inspiration for packing javascript applications, the links below might prove useful. Searching online for prior art can be helpful if you are running into solved problems.

-### Github
+### Github {#javascript-finding-examples-github}

 - Searching Nix files for `mkYarnPackage`: <https://github.com/search?q=mkYarnPackage+language%3ANix&type=code>
 - Searching just `flake.nix` files for `mkYarnPackage`: <https://github.com/search?q=mkYarnPackage+filename%3Aflake.nix&type=code>

-### Gitlab
+### Gitlab {#javascript-finding-examples-gitlab}

 - Searching Nix files for `mkYarnPackage`: <https://gitlab.com/search?scope=blobs&search=mkYarnPackage+extension%3Anix>
 - Searching just `flake.nix` files for `mkYarnPackage`: <https://gitlab.com/search?scope=blobs&search=mkYarnPackage+filename%3Aflake.nix>
@ -105,7 +105,7 @@ After you have identified the correct system, you need to override your package
    });
 ```

-### Adding and Updating Javascript packages in nixpkgs
+### Adding and Updating Javascript packages in nixpkgs {#javascript-adding-or-updating-packages}

 To add a package from NPM to nixpkgs:

@ -140,7 +140,7 @@ To update NPM packages in nixpkgs, run the same `generate.sh` script:
 ./pkgs/development/node-packages/generate.sh
 ```

-#### Git protocol error
+#### Git protocol error {#javascript-git-error}

 Some packages may have Git dependencies from GitHub specified with `git://`.
 GitHub has [disabled unecrypted Git connections](https://github.blog/2021-09-01-improving-git-protocol-security-github/#no-more-unauthenticated-git), so you may see the following error when running the generate script:
@ -288,7 +288,7 @@ configurePhase = ''
 This will generate a derivation including the `node_modules` directory.
 If you have to build a derivation for an integrated web framework (rails, phoenix..), this is probably the easiest way.

-#### Overriding dependency behavior
+#### Overriding dependency behavior {#javascript-mkYarnPackage-overriding-dependencies}

 In the `mkYarnPackage` record the property `pkgConfig` can be used to override packages when you encounter problems building.

--- a/doc/languages-frameworks/pkg-config.section.md
+++ b/doc/languages-frameworks/pkg-config.section.md
@ -4,7 +4,7 @@

 Nixpkgs provides a couple of facilities for working with this tool.

-## Writing packages providing pkg-config modules
+## Writing packages providing pkg-config modules {#pkg-config-writing-packages}

 Packages should set `meta.pkgConfigModules` with the list of package config modules they provide.
 They should also use `testers.testMetaPkgConfig` to check that the final built package matches that list.
@ -29,9 +29,9 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```

-## Accessing packages via pkg-config module name
+## Accessing packages via pkg-config module name {#sec-pkg-config-usage}

-### Within Nixpkgs
+### Within Nixpkgs {#sec-pkg-config-usage-internal}

 A [setup hook](#setup-hook-pkg-config) is bundled in the `pkg-config` package to bring a derivation's declared build inputs into the environment.
 This will populate environment variables like `PKG_CONFIG_PATH`, `PKG_CONFIG_PATH_FOR_BUILD`, and `PKG_CONFIG_PATH_HOST` based on:
@ -44,7 +44,7 @@ For more details see the section on [specifying dependencies in general](#ssec-s

 Normal pkg-config commands to look up dependencies by name will then work with those environment variables defined by the hook.

-### Externally
+### Externally {#sec-pkg-config-usage-external}

 The `defaultPkgConfigPackages` package set is a set of aliases, named after the modules they provide.
 This is meant to be used by language-to-nix integrations.
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -1117,7 +1117,7 @@ with import <nixpkgs> {};
 in python.withPackages(ps: [ps.blaze])).env
 ```

-#### Optional extra dependencies
+#### Optional extra dependencies {#python-optional-dependencies}

 Some packages define optional dependencies for additional features. With
 `setuptools` this is called `extras_require` and `flit` calls it
@ -1801,14 +1801,14 @@ The following rules are desired to be respected:
 * Attribute names in `python-packages.nix` should be sorted alphanumerically to
  avoid merge conflicts and ease locating attributes.

-## Package set maintenance
+## Package set maintenance {#python-package-set-maintenance}

 The whole Python package set has a lot of packages that do not see regular
 updates, because they either are a very fragile component in the Python
 ecosystem, like for example the `hypothesis` package, or packages that have
 no maintainer, so maintenance falls back to the package set maintainers.

-### Updating packages in bulk
+### Updating packages in bulk {#python-package-bulk-updates}

 There is a tool to update alot of python libraries in bulk, it exists at
 `maintainers/scripts/update-python-libraries` with this repository.
@ -1836,7 +1836,7 @@ would be:
 $ maintainers/scripts/update-python-libraries --target minor --commit --use-pkgs-prefix pkgs/development/python-modules/**/default.nix
 ```

-## CPython Update Schedule
+## CPython Update Schedule {#python-cpython-update-schedule}

 With [PEP 602](https://www.python.org/dev/peps/pep-0602/), CPython now
 follows a yearly release cadence. In nixpkgs, all supported interpreters
--- a/doc/languages-frameworks/ruby.section.md
+++ b/doc/languages-frameworks/ruby.section.md
@ -201,7 +201,7 @@ $ nix-shell --run 'ruby -rpg -e "puts PG.library_version"'

 Of course for this use-case one could also use overlays since the configuration for `pg` depends on the `postgresql` alias, but for demonstration purposes this has to suffice.

-### Platform-specific gems
+### Platform-specific gems {#ruby-platform-specif-gems}

 Right now, bundix has some issues with pre-built, platform-specific gems: [bundix PR #68](https://github.com/nix-community/bundix/pull/68).
 Until this is solved, you can tell bundler to not use platform-specific gems and instead build them from source each time:
--- a/doc/languages-frameworks/vim.section.md
+++ b/doc/languages-frameworks/vim.section.md
@ -166,8 +166,8 @@ in

 If your package requires building specific parts, use instead `pkgs.vimUtils.buildVimPlugin`.

-### Specificities for some plugins
-#### Treesitter
+### Specificities for some plugins {#vim-plugin-specificities}
+#### Treesitter {#vim-plugin-treesitter}

 By default `nvim-treesitter` encourages you to download, compile and install
 the required Treesitter grammars at run time with `:TSInstall`. This works
@ -244,7 +244,7 @@ Alternatively, set the number of processes to a lower count to avoid rate-limiti
 ./pkgs/applications/editors/vim/plugins/update.py --proc 1
 ```

-## How to maintain an out-of-tree overlay of vim plugins ?
+## How to maintain an out-of-tree overlay of vim plugins ? {#vim-out-of-tree-overlays}

 You can use the updater script to generate basic packages out of a custom vim
 plugin list:
--- a/doc/manual.xml
+++ b/doc/manual.xml
@ -1,19 +1,20 @@
 <book xmlns="http://docbook.org/ns/docbook"
-      xmlns:xi="http://www.w3.org/2001/XInclude">
+      xmlns:xi="http://www.w3.org/2001/XInclude"
+      xml:id="nixpkgs-manual">
 <info>
  <title>Nixpkgs Manual</title>
  <subtitle>Version <xi:include href=".version" parse="text" />
  </subtitle>
 </info>
 <xi:include href="preface.chapter.xml" />
- <part>
+ <part xml:id="part-using">
  <title>Using Nixpkgs</title>
  <xi:include href="using/configuration.chapter.xml" />
  <xi:include href="using/overlays.chapter.xml" />
  <xi:include href="using/overrides.chapter.xml" />
  <xi:include href="functions.xml" />
 </part>
- <part>
+ <part xml:id="part-stdenv">
  <title>Standard environment</title>
  <xi:include href="stdenv/stdenv.chapter.xml" />
  <xi:include href="stdenv/meta.chapter.xml" />
@ -21,7 +22,7 @@
  <xi:include href="stdenv/cross-compilation.chapter.xml" />
  <xi:include href="stdenv/platform-notes.chapter.xml" />
 </part>
- <part>
+ <part xml:id="part-builders">
  <title>Builders</title>
  <xi:include href="builders/fetchers.chapter.xml" />
  <xi:include href="builders/trivial-builders.chapter.xml" />
@ -32,7 +33,7 @@
  <xi:include href="languages-frameworks/index.xml" />
  <xi:include href="builders/packages/index.xml" />
 </part>
- <part>
+ <part xml:id="part-contributing">
  <title>Contributing to Nixpkgs</title>
  <xi:include href="contributing/quick-start.chapter.xml" />
  <xi:include href="contributing/coding-conventions.chapter.xml" />
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@ -101,7 +101,7 @@ $ cd path/to/nixpkgs
 $ nix-build -A your-package.tests
 ```

-#### Package tests
+#### Package tests {#var-meta-tests-packages}

 Tests that are part of the source package are often executed in the `installCheckPhase`.

@ -113,7 +113,7 @@ Prefer `passthru.tests` for tests that are introduced in nixpkgs because:

 For more on how to write and run package tests, see <xref linkend="sec-package-tests"/>.

-#### NixOS tests
+#### NixOS tests {#var-meta-tests-nixos}

 The NixOS tests are available as `nixosTests` in parameters of derivations. For instance, the OpenSMTPD derivation includes lines similar to:

--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@ -703,7 +703,7 @@ The prefix under which the package must be installed, passed via the `--prefix`

 The key to use when specifying the prefix. By default, this is set to `--prefix=` as that is used by the majority of packages.

-##### `dontAddStaticConfigureFlags`
+##### `dontAddStaticConfigureFlags` {#var-stdenv-dontAddStaticConfigureFlags}

 By default, when building statically, stdenv will try to add build system appropriate configure flags to try to enable static builds.

@ -1095,15 +1095,15 @@ postInstall = ''

 Performs string substitution on the contents of \<infile\>, writing the result to \<outfile\>. The substitutions in \<subs\> are of the following form:

-#### `--replace` \<s1\> \<s2\>
+#### `--replace` \<s1\> \<s2\> {#fun-substitute-replace}

 Replace every occurrence of the string \<s1\> by \<s2\>.

-#### `--subst-var` \<varName\>
+#### `--subst-var` \<varName\> {#fun-substitute-subst-var}

 Replace every occurrence of `@varName@` by the contents of the environment variable \<varName\>. This is useful for generating files from templates, using `@...@` in the template as placeholders.

-#### `--subst-var-by` \<varName\> \<s\>
+#### `--subst-var-by` \<varName\> \<s\> {#fun-substitute-subst-var-by}

 Replace every occurrence of `@varName@` by the string \<s\>.

@ -1244,7 +1244,7 @@ Multiple paths can be specified.
 patchShebangs [--build | --host] PATH...
 ```

-##### Flags
+##### Flags {#patch-shebangs.sh-invocation-flags}

 `--build`
 : Look up commands available at build time
@ -1252,7 +1252,7 @@ patchShebangs [--build | --host] PATH...
 `--host`
 : Look up commands available at run time

-##### Examples
+##### Examples {#patch-shebangs.sh-invocation-examples}

 ```sh
 patchShebangs --host /nix/store/<hash>-hello-1.0/bin
@ -1339,7 +1339,7 @@ Similarly, the CC Wrapper follows the Bintools Wrapper in defining standard envi

 Here are some more packages that provide a setup hook. Since the list of hooks is extensible, this is not an exhaustive list. The mechanism is only to be used as a last resort, so it might cover most uses.

-### Other hooks
+### Other hooks {#stdenv-other-hooks}

 Many other packages provide hooks, that are not part of `stdenv`. You can find
 these in the [Hooks Reference](#chap-hooks).
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -158,7 +158,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The [services.wordpress.sites.&lt;name&gt;.plugins](#opt-services.wordpress.sites._name_.plugins) and [services.wordpress.sites.&lt;name&gt;.themes](#opt-services.wordpress.sites._name_.themes) options have been converted from sets to attribute sets to allow for consumers to specify explicit install paths via attribute name.

- `protonmail-bridge` package has been updated to v3.0 and the CLI executable is now named bridge instead of protonmail-bridge to be more in line with upstream.
+- `protonmail-bridge` package has been updated to major version 3.

 - Nebula now runs as a system user and group created for each nebula network, using the `CAP_NET_ADMIN` ambient capability on launch rather than starting as root. Ensure that any files each Nebula instance needs to access are owned by the correct user and group, by default `nebula-${networkName}`.

@ -336,8 +336,6 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The `unifi-poller` package and corresponding NixOS module have been renamed to `unpoller` to match upstream.

- `protonmail-bridge` package has been updated to v3.0 and the CLI executable is now named bridge instead of protonmail-bridge to be more in line with upstream.
-
 - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting.

 - `openjdk` from version 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`.
--- a/nixos/modules/hardware/opengl.nix
+++ b/nixos/modules/hardware/opengl.nix
@ -90,8 +90,8 @@ in

      mesaPackage = mkOption {
        type = types.package;
-        default = pkgs.mesa_23;
-        defaultText = literalExpression "pkgs.mesa_23";
+        default = pkgs.mesa;
+        defaultText = literalExpression "pkgs.mesa";
        example = literalExpression "pkgs.mesa_22";
        description = lib.mdDoc ''
          The Mesa driver package used for rendering support on the system.
@ -103,8 +103,8 @@ in
      };
      mesaPackage32 = mkOption {
        type = types.package;
-        default = pkgs.pkgsi686Linux.mesa_23;
-        defaultText = literalExpression "pkgs.pkgsi686Linux.mesa_23";
+        default = pkgs.pkgsi686Linux.mesa;
+        defaultText = literalExpression "pkgs.pkgsi686Linux.mesa";
        example = literalExpression "pkgs.pkgsi686Linux.mesa_22";
        description = lib.mdDoc ''
          Same as {option}`mesaPackage` but for the 32-bit Mesa on 64-bit
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -462,8 +462,7 @@ in
    boot.kernelParams = optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1"
      ++ optional cfg.powerManagement.enable "nvidia.NVreg_PreserveVideoMemoryAllocations=1"
      ++ optional cfg.open "nvidia.NVreg_OpenRmEnableUnsupportedGpus=1"
-      # proprietary driver is not compiled with support for X86_KERNEL_IBT
-      ++ optional (!cfg.open && config.boot.kernelPackages.kernel.kernelAtLeast "6.2") "ibt=off";
+      ++ optional (!cfg.open && config.boot.kernelPackages.kernel.kernelAtLeast "6.2" && lib.versionOlder nvidia_x11.version "530") "ibt=off";

    services.udev.extraRules =
      ''
--- a/nixos/modules/programs/proxychains.nix
+++ b/nixos/modules/programs/proxychains.nix
@ -51,6 +51,10 @@ in {

      enable = mkEnableOption (lib.mdDoc "installing proxychains configuration");

+      package = mkPackageOptionMD pkgs "proxychains" {
+        example = "pkgs.proxychains-ng";
+      };
+
      chain = {
        type = mkOption {
          type = types.enum [ "dynamic" "strict" "random" ];
@ -159,7 +163,7 @@ in {
      };

    environment.etc."proxychains.conf".text = configFile;
-    environment.systemPackages = [ pkgs.proxychains ];
+    environment.systemPackages = [ cfg.package ];
  };

 }
--- a/nixos/modules/programs/steam.nix
+++ b/nixos/modules/programs/steam.nix
@ -9,23 +9,36 @@ in {
    enable = mkEnableOption (lib.mdDoc "steam");

    package = mkOption {
-      type        = types.package;
-      default     = pkgs.steam.override {
-        extraLibraries = pkgs: with config.hardware.opengl;
-          if pkgs.stdenv.hostPlatform.is64bit
-          then [ package ] ++ extraPackages
-          else [ package32 ] ++ extraPackages32;
-      };
-      defaultText = literalExpression ''
-        pkgs.steam.override {
-          extraLibraries = pkgs: with config.hardware.opengl;
+      type = types.package;
+      default = pkgs.steam;
+      defaultText = literalExpression "pkgs.steam";
+      example = literalExpression ''
+        pkgs.steam-small.override {
+          extraEnv = {
+            MANGOHUD = true;
+            OBS_VKCAPTURE = true;
+            RADV_TEX_ANISO = 16;
+          };
+          extraLibraries = p: with p; [
+            atk
+          ];
+        }
+      '';
+      apply = steam: steam.override (prev: {
+        extraLibraries = pkgs: let
+          prevLibs = if prev ? extraLibraries then prev.extraLibraries pkgs else [ ];
+          additionalLibs = with config.hardware.opengl;
            if pkgs.stdenv.hostPlatform.is64bit
            then [ package ] ++ extraPackages
            else [ package32 ] ++ extraPackages32;
-        }
-      '';
+        in prevLibs ++ additionalLibs;
+      });
      description = lib.mdDoc ''
-        steam package to use.
+        The Steam package to use. Additional libraries are added from the system
+        configuration to ensure graphics work properly.
+
+        Use this option to customise the Steam package rather than adding your
+        custom Steam to {option}`environment.systemPackages` yourself.
      '';
    };

--- a/nixos/modules/services/x11/extra-layouts.nix
+++ b/nixos/modules/services/x11/extra-layouts.nix
@ -121,7 +121,7 @@ in
    environment.sessionVariables = {
      # runtime override supported by multiple libraries e. g. libxkbcommon
      # https://xkbcommon.org/doc/current/group__include-path.html
-      XKB_CONFIG_ROOT = "${xkb_patched}/etc/X11/xkb";
+      XKB_CONFIG_ROOT = config.services.xserver.xkbDir;
    };

    services.xserver = {
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@ -121,6 +121,8 @@ let
                  driver.find_element(By.CSS_SELECTOR, 'input#register-form_input_confirm-master-password').send_keys(
                      '${userPassword}'
                  )
+                  if driver.find_element(By.CSS_SELECTOR, 'input#checkForBreaches').is_selected():
+                      driver.find_element(By.CSS_SELECTOR, 'input#checkForBreaches').click()

                  driver.find_element(By.XPATH, "//button[contains(., 'Create account')]").click()

@ -133,9 +135,9 @@ let
                  )
                  driver.find_element(By.XPATH, "//button[contains(., 'Log in')]").click()

-                  wait.until(EC.title_contains("Vaultwarden Web Vault"))
+                  wait.until(EC.title_contains("Vaults"))

-                  driver.find_element(By.XPATH, "//button[contains(., 'Add item')]").click()
+                  driver.find_element(By.XPATH, "//button[contains(., 'New item')]").click()

                  driver.find_element(By.CSS_SELECTOR, 'input#name').send_keys(
                      'secrets'
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@ -75,6 +75,8 @@ stdenv.mkDerivation rec {
  '' + lib.optionalString stdenv.isLinux ''
    substituteInPlace libraries/lib-files/FileNames.cpp \
      --replace /usr/include/linux/magic.h ${linuxHeaders}/include/linux/magic.h
+  '' + lib.optionalString (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinMinVersion "11.0") ''
+    sed -z -i "s/NSAppearanceName.*systemAppearance//" src/AudacityApp.mm
  '';

  nativeBuildInputs = [
@ -93,9 +95,6 @@ stdenv.mkDerivation rec {
    ffmpeg_4
    file
    flac
-  ] ++ lib.optionals stdenv.isDarwin [
-    AppKit
-  ] ++ [
    gtk3
    lame
    libid3tag
@ -135,6 +134,7 @@ stdenv.mkDerivation rec {
    libuuid
    util-linux
  ] ++ lib.optionals stdenv.isDarwin [
+    AppKit
    CoreAudioKit # for portaudio
    libpng
    libjpeg
--- a/pkgs/applications/audio/go-musicfox/default.nix
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@ -10,13 +10,13 @@
 # gcc only supports objc on darwin
 buildGoModule.override { stdenv = clangStdenv; } rec {
  pname = "go-musicfox";
-  version = "3.7.5";
+  version = "3.7.7";

  src = fetchFromGitHub {
    owner = "anhoder";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-+0s+MCFLw527gFj7pfiYGfKYihthFjRLPeto2SbALw0=";
+    hash = "sha256-gQPr+mCZ7tnASs/ibow1b0Qj3ppZhdgP4U1Vxo+FfE4=";
  };

  deleteVendor = true;
--- a/pkgs/applications/audio/setbfree/default.nix
+++ b/pkgs/applications/audio/setbfree/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation  rec {
  pname = "setbfree";
-  version = "0.8.11";
+  version = "0.8.12";

  src = fetchFromGitHub {
    owner = "pantherb";
    repo = "setBfree";
    rev = "v${version}";
-    sha256 = "sha256-OYrsq3zVaotmS1KUgDIQbVQgxpfweMKiB17/PC1iXDA=";
+    sha256 = "sha256-e/cvD/CtT8dY1lYcsZ21DC8pNqKXqKfC/eRXX8k01eI=";
  };

  postPatch = ''
--- a/pkgs/applications/blockchains/exodus/default.nix
+++ b/pkgs/applications/blockchains/exodus/default.nix
@ -4,11 +4,11 @@ cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core, libxkbcommon, mesa }:

 stdenv.mkDerivation rec {
  pname = "exodus";
-  version = "22.8.12";
+  version = "23.3.13";

  src = fetchzip {
    url = "https://downloads.exodus.com/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "sha256-jNzHh4zYhFzpFZAC9rHmwjTdFkbpROSEN3qpL7geiOU=";
+    sha256 = "sha256-/xCDtR3V++LaZZWTaNpeD3YuP5ZM5BChB1CUBH/xNcU=";
  };

  installPhase = ''
--- a/pkgs/applications/blockchains/teos/default.nix
+++ b/pkgs/applications/blockchains/teos/default.nix
@ -24,6 +24,7 @@ let
    license = licenses.mit;
    maintainers = with maintainers; [ seberm ];
  };
+  updateScript = ./update.sh;
 in
 {
  teos = rustPlatform.buildRustPackage {
@ -43,6 +44,8 @@ in
      darwin.apple_sdk.frameworks.Security
    ];

+    passthru.updateScript = updateScript;
+
    __darwinAllowLocalNetworking = true;

    meta = meta // {
@ -70,6 +73,8 @@ in
      darwin.apple_sdk.frameworks.SystemConfiguration
    ];

+    passthru.updateScript = updateScript;
+
    __darwinAllowLocalNetworking = true;

    meta = meta // {
--- a/pkgs/applications/blockchains/teos/update.sh
+++ b/pkgs/applications/blockchains/teos/update.sh
@ -0,0 +1,31 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl jq git gnupg common-updater-scripts
+set -euo pipefail
+
+# Fetch latest release, update derivation
+scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+nixpkgs=$(realpath "$scriptDir"/../../../..)
+
+oldVersion=$(nix-instantiate --eval -E "(import \"$nixpkgs\" { config = {}; overlays = []; }).teos.version" | tr -d '"')
+version=$(curl -s --show-error "https://api.github.com/repos/talaia-labs/rust-teos/releases/latest" | jq -r '.tag_name' | tail -c +2)
+
+if [[ $version == $oldVersion ]]; then
+  echo "Already at latest version $version"
+  exit 0
+fi
+echo "New version: $version"
+
+tmpdir=$(mktemp -d /tmp/teos.XXX)
+repo="${tmpdir}/repo"
+trap 'rm -rf $tmpdir' EXIT
+
+git clone --depth 1 --branch "v${version}" -c advice.detachedHead=false 'https://github.com/talaia-labs/rust-teos' "$repo"
+git -C "$repo" checkout "tags/v${version}"
+
+rm -rf "${repo}/.git"
+hashcheck=$(nix hash path "$repo")
+
+(cd "$nixpkgs" && update-source-version teos "$version" "$hashcheck")
+sed -i 's|cargoHash = .*|cargoHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";|' "${scriptDir}/default.nix"
+echo
+echo "rust-teos: $oldVersion -> $version"
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -25,11 +25,13 @@ let
  inherit (vscode-utils) buildVscodeMarketplaceExtension;

  #
-  # Unless there is a good reason not to, we attempt to use the same name as the
-  # extension's unique identifier (the name the extension gets when installed
-  # from vscode under `~/.vscode`) and found on the marketplace extension page.
-  # So an extension's attribute name should be of the form:
-  # "${mktplcRef.publisher}.${mktplcRef.name}".
+  # Unless there is a good reason not to, we attempt to use the lowercase
+  # version of the extension's unique identifier. The unique identifier can be
+  # found on the marketplace extension page, and is the name under which the
+  # extension is installed by VSCode under `~/.vscode`.
+  #
+  # This means an extension should be located at
+  # ${lib.strings.toLower mktplcRef.publisher}.${lib.string.toLower mktplcRef.name}
  #
  baseExtensions = self: lib.mapAttrs (_n: lib.recurseIntoAttrs)
    {
@ -253,7 +255,7 @@ let
        };
      };

-      Arjun.swagger-viewer = buildVscodeMarketplaceExtension {
+      arjun.swagger-viewer = buildVscodeMarketplaceExtension {
        mktplcRef = {
          publisher = "Arjun";
          name = "swagger-viewer";
@ -451,18 +453,6 @@ let
        };
      };

-      bodil.file-browser = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "file-browser";
-          publisher = "bodil";
-          version = "0.2.11";
-          sha256 = "sha256-yPVhhsAUZxnlhj58fXkk+yhxop2q7YJ6X4W9dXGKJfo=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
      bierner.emojisense = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "emojisense";
@ -536,6 +526,18 @@ let
        };
      };

+      bodil.file-browser = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "file-browser";
+          publisher = "bodil";
+          version = "0.2.11";
+          sha256 = "sha256-yPVhhsAUZxnlhj58fXkk+yhxop2q7YJ6X4W9dXGKJfo=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
      bradlc.vscode-tailwindcss = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "vscode-tailwindcss";
@ -594,6 +596,23 @@ let

      chenglou92.rescript-vscode = callPackage ./chenglou92.rescript-vscode { };

+      chris-hayes.chatgpt-reborn = buildVscodeMarketplaceExtension {
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/chris-hayes.chatgpt-reborn/changelog";
+          description = "A Visual Studio Code extension to support ChatGPT, GPT-3 and Codex conversations";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=chris-hayes.chatgpt-reborn";
+          homepage = "https://github.com/christopher-hayes/vscode-chatgpt-reborn";
+          license = lib.licenses.isc;
+          maintainers = [ lib.maintainers.drupol ];
+        };
+        mktplcRef = {
+          name = "chatgpt-reborn";
+          publisher = "chris-hayes";
+          version = "3.11.2";
+          sha256 = "sha256-YidcekYTgPYlzfmDHHAxywF+bJE8Da3pg/TCumK4Epo=";
+        };
+      };
+
      christian-kohler.path-intellisense = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "path-intellisense";
@ -634,35 +653,6 @@ let
        };
      };

-      coenraads.bracket-pair-colorizer = buildVscodeMarketplaceExtension {
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/CoenraadS.bracket-pair-colorizer/changelog";
-          description = "A customizable extension for colorizing matching brackets";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=CoenraadS.bracket-pair-colorizer";
-          homepage = "https://github.com/CoenraadS/BracketPair";
-          license = lib.licenses.mit;
-          maintainers = [ ];
-        };
-        mktplcRef = {
-          name = "bracket-pair-colorizer";
-          publisher = "CoenraadS";
-          version = "1.0.61";
-          sha256 = "0r3bfp8kvhf9zpbiil7acx7zain26grk133f0r0syxqgml12i652";
-        };
-      };
-
-      coenraads.bracket-pair-colorizer-2 = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "bracket-pair-colorizer-2";
-          publisher = "CoenraadS";
-          version = "0.2.2";
-          sha256 = "0zcbs7h801agfs2cggk1cz8m8j0i2ypmgznkgw17lcx3zisll9ad";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
      colejcummins.llvm-syntax-highlighting = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "llvm-syntax-highlighting";
@ -692,23 +682,6 @@ let
        };
      };

-      chris-hayes.chatgpt-reborn = buildVscodeMarketplaceExtension {
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/chris-hayes.chatgpt-reborn/changelog";
-          description = "A Visual Studio Code extension to support ChatGPT, GPT-3 and Codex conversations";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=chris-hayes.chatgpt-reborn";
-          homepage = "https://github.com/christopher-hayes/vscode-chatgpt-reborn";
-          license = lib.licenses.isc;
-          maintainers = [ lib.maintainers.drupol ];
-        };
-        mktplcRef = {
-          name = "chatgpt-reborn";
-          publisher = "chris-hayes";
-          version = "3.11.2";
-          sha256 = "sha256-YidcekYTgPYlzfmDHHAxywF+bJE8Da3pg/TCumK4Epo=";
-        };
-      };
-
      cweijan.vscode-database-client2 = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "vscode-database-client2";
@ -1080,23 +1053,6 @@ let
        };
      };

-      faustinoaq.lex-flex-yacc-bison = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "lex-flex-yacc-bison";
-          publisher = "faustinoaq";
-          version = "0.0.3";
-          sha256 = "6254f52157dc796eae7bf135ac88c1c9cc19d884625331a1e634f9768722cc3d";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/faustinoaq.lex-flex-yacc-bison/changelog";
-          description = "Language support for Lex, Flex, Yacc and Bison.";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=faustinoaq.lex-flex-yacc-bison";
-          homepage = "https://github.com/faustinoaq/vscode-lex-flex-yacc-bison";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.emilytrau ];
-        };
-      };
-
      file-icons.file-icons = buildVscodeMarketplaceExtension {
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/file-icons.file-icons/changelog";
@ -1257,59 +1213,57 @@ let
        };
      };

-      github = {
-        codespaces = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            publisher = "github";
-            name = "codespaces";
-            version = "1.14.1";
-            sha256 = "sha256-oiAn/tW4jfccsY8zH6L7UzldeM7sV9tllSvgZD8c9aY=";
-          };
-          meta = { license = lib.licenses.unfree; };
+      github.codespaces = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "github";
+          name = "codespaces";
+          version = "1.14.1";
+          sha256 = "sha256-oiAn/tW4jfccsY8zH6L7UzldeM7sV9tllSvgZD8c9aY=";
        };
+        meta = { license = lib.licenses.unfree; };
+      };

-        copilot = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            publisher = "github";
-            name = "copilot";
-            version = "1.78.9758";
-            sha256 = "sha256-qIaaM72SenMv+vtkTMBodD2JsroZLpw8qEttr5aIDQk=";
-          };
-          meta = {
-            description = "GitHub Copilot uses OpenAI Codex to suggest code and entire functions in real-time right from your editor.";
-            downloadPage = "https://marketplace.visualstudio.com/items?itemName=GitHub.copilot";
-            homepage = "https://github.com/features/copilot";
-            license = lib.licenses.unfree;
-            maintainers = [ lib.maintainers.Zimmi48 ];
-          };
+      github.copilot = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "github";
+          name = "copilot";
+          version = "1.78.9758";
+          sha256 = "sha256-qIaaM72SenMv+vtkTMBodD2JsroZLpw8qEttr5aIDQk=";
        };
+        meta = {
+          description = "GitHub Copilot uses OpenAI Codex to suggest code and entire functions in real-time right from your editor.";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=GitHub.copilot";
+          homepage = "https://github.com/features/copilot";
+          license = lib.licenses.unfree;
+          maintainers = [ lib.maintainers.Zimmi48 ];
+        };
+      };

-        github-vscode-theme = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            name = "github-vscode-theme";
-            publisher = "github";
-            version = "6.3.3";
-            sha256 = "sha256-fN9ljeZlbbSNW9qggLEz5HOLZlPhHmTHNi1VsZo7Uxk=";
-          };
-          meta = {
-            description = "GitHub theme for VS Code";
-            downloadPage =
-              "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
-            homepage = "https://github.com/primer/github-vscode-theme";
-            license = lib.licenses.mit;
-            maintainers = [ lib.maintainers.hugolgst ];
-          };
+      github.github-vscode-theme = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "github-vscode-theme";
+          publisher = "github";
+          version = "6.3.3";
+          sha256 = "sha256-fN9ljeZlbbSNW9qggLEz5HOLZlPhHmTHNi1VsZo7Uxk=";
        };
+        meta = {
+          description = "GitHub theme for VS Code";
+          downloadPage =
+            "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
+          homepage = "https://github.com/primer/github-vscode-theme";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.hugolgst ];
+        };
+      };

-        vscode-pull-request-github = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            name = "vscode-pull-request-github";
-            publisher = "github";
-            version = "0.61.2023032418";
-            sha256 = "sha256-pCFq0lAMH3fno4/BtHJHhS4hX1KqxsPf4wEmAm66Y8E=";
-          };
-          meta = { license = lib.licenses.mit; };
+      github.vscode-pull-request-github = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-pull-request-github";
+          publisher = "github";
+          version = "0.61.2023032418";
+          sha256 = "sha256-pCFq0lAMH3fno4/BtHJHhS4hX1KqxsPf4wEmAm66Y8E=";
        };
+        meta = { license = lib.licenses.mit; };
      };

      gitlab.gitlab-workflow = buildVscodeMarketplaceExtension {
@ -1598,18 +1552,6 @@ let
        };
      };

-      jpoissonnier.vscode-styled-components = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-styled-components";
-          publisher = "jpoissonnier";
-          version = "1.4.1";
-          sha256 = "sha256-ojbeuYBCS+DjF5R0aLuBImzoSOb8mXw1s0Uh0CzggzE=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
      justusadam.language-haskell = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "language-haskell";
@ -1809,8 +1751,6 @@ let
        meta.license = lib.licenses.mit;
      };

-      matklad.rust-analyzer = self.rust-lang.rust-analyzer; # Previous publisher
-
      matthewpi.caddyfile-support = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "caddyfile-support";
@ -1990,88 +1930,6 @@ let
        };
      };

-      ms-vscode.anycode = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "anycode";
-          publisher = "ms-vscode";
-          version = "0.0.70";
-          sha256 = "sha256-POxgwvKF4A+DxKVIOte4I8REhAbO1U9Gu6r/S41/MmA=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
-      ms-vscode.cmake-tools = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "cmake-tools";
-          publisher = "ms-vscode";
-          version = "1.14.20";
-          sha256 = "sha256-j67Z65N9YW8wY4zIWWCtPIKgW9GYoUntBoGVBLR/H2o=";
-        };
-        meta.license = lib.licenses.mit;
-      };
-
-      ms-vscode.cpptools = callPackage ./ms-vscode.cpptools { };
-
-      ms-vscode.hexeditor = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "hexeditor";
-          publisher = "ms-vscode";
-          version = "1.9.11";
-          sha256 = "sha256-w1R8z7Q/JRAsqJ1mgcvlHJ6tywfgKtS6A6zOY2p01io=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
-      ms-vscode.makefile-tools = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "makefile-tools";
-          publisher = "ms-vscode";
-          version = "0.6.0";
-          sha256 = "07zagq5ib9hd3w67yk2g728vypr4qazw0g9dyd5bax21shnmppa9";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
-      ms-vscode.PowerShell = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "PowerShell";
-          publisher = "ms-vscode";
-          version = "2023.3.1";
-          sha256 = "sha256-FJolnWU0DbuQYvMuGL3mytf0h39SH9rUPCl2ahLXLuY=";
-        };
-        meta = {
-          description = "A Visual Studio Code extension for PowerShell language support";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.PowerShell";
-          homepage = "https://github.com/PowerShell/vscode-powershell";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.rhoriguchi ];
-        };
-      };
-
-      ms-vscode-remote.remote-ssh = callPackage ./ms-vscode-remote.remote-ssh { };
-
-      ms-vscode.theme-tomorrowkit = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "Theme-TomorrowKit";
-          publisher = "ms-vscode";
-          version = "0.1.4";
-          sha256 = "sha256-qakwJWak+IrIeeVcMDWV/fLPx5M8LQGCyhVt4TS/Lmc=";
-        };
-        meta = {
-          description = "Additional Tomorrow and Tomorrow Night themes for VS Code. Based on the TextMate themes.";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.Theme-TomorrowKit";
-          homepage = "https://github.com/microsoft/vscode-themes";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.ratsclub ];
-        };
-      };
-
      ms-toolsai.jupyter = callPackage ./ms-toolsai.jupyter { };

      ms-toolsai.jupyter-keymap = buildVscodeMarketplaceExtension {
@ -2122,20 +1980,90 @@ let
        };
      };

-      ms-vsliveshare.vsliveshare = callPackage ./ms-vsliveshare.vsliveshare { };
-
-      msjsdiag.debugger-for-chrome = buildVscodeMarketplaceExtension {
+      ms-vscode.anycode = buildVscodeMarketplaceExtension {
        mktplcRef = {
-          name = "debugger-for-chrome";
-          publisher = "msjsdiag";
-          version = "4.12.11";
-          sha256 = "sha256-9i3TgCFThnFF5ccwzS4ATj5c2Xoe/4tDFGv75jJxeQ4=";
+          name = "anycode";
+          publisher = "ms-vscode";
+          version = "0.0.70";
+          sha256 = "sha256-POxgwvKF4A+DxKVIOte4I8REhAbO1U9Gu6r/S41/MmA=";
        };
        meta = {
          license = lib.licenses.mit;
        };
      };

+      ms-vscode.cmake-tools = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "cmake-tools";
+          publisher = "ms-vscode";
+          version = "1.14.20";
+          sha256 = "sha256-j67Z65N9YW8wY4zIWWCtPIKgW9GYoUntBoGVBLR/H2o=";
+        };
+        meta.license = lib.licenses.mit;
+      };
+
+      ms-vscode.cpptools = callPackage ./ms-vscode.cpptools { };
+
+      ms-vscode.hexeditor = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "hexeditor";
+          publisher = "ms-vscode";
+          version = "1.9.11";
+          sha256 = "sha256-w1R8z7Q/JRAsqJ1mgcvlHJ6tywfgKtS6A6zOY2p01io=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
+      ms-vscode.makefile-tools = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "makefile-tools";
+          publisher = "ms-vscode";
+          version = "0.6.0";
+          sha256 = "07zagq5ib9hd3w67yk2g728vypr4qazw0g9dyd5bax21shnmppa9";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
+      ms-vscode.powershell = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "PowerShell";
+          publisher = "ms-vscode";
+          version = "2023.3.1";
+          sha256 = "sha256-FJolnWU0DbuQYvMuGL3mytf0h39SH9rUPCl2ahLXLuY=";
+        };
+        meta = {
+          description = "A Visual Studio Code extension for PowerShell language support";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.PowerShell";
+          homepage = "https://github.com/PowerShell/vscode-powershell";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.rhoriguchi ];
+        };
+      };
+
+      ms-vscode.theme-tomorrowkit = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "Theme-TomorrowKit";
+          publisher = "ms-vscode";
+          version = "0.1.4";
+          sha256 = "sha256-qakwJWak+IrIeeVcMDWV/fLPx5M8LQGCyhVt4TS/Lmc=";
+        };
+        meta = {
+          description = "Additional Tomorrow and Tomorrow Night themes for VS Code. Based on the TextMate themes.";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.Theme-TomorrowKit";
+          homepage = "https://github.com/microsoft/vscode-themes";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.ratsclub ];
+        };
+      };
+
+      ms-vscode-remote.remote-ssh = callPackage ./ms-vscode-remote.remote-ssh { };
+
+      ms-vsliveshare.vsliveshare = callPackage ./ms-vsliveshare.vsliveshare { };
+
      mskelton.one-dark-theme = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "one-dark-theme";
@ -2211,6 +2139,18 @@ let
        };
      };

+      octref.vetur = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vetur";
+          publisher = "octref";
+          version = "0.37.3";
+          sha256 = "sha256-3hi1LOZto5AYaomB9ihkAt4j/mhkCDJ8Jqa16piwHIQ=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
      oderwat.indent-rainbow = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "indent-rainbow";
@ -2227,18 +2167,6 @@ let
        };
      };

-      octref.vetur = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vetur";
-          publisher = "octref";
-          version = "0.37.3";
-          sha256 = "sha256-3hi1LOZto5AYaomB9ihkAt4j/mhkCDJ8Jqa16piwHIQ=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
      phoenixframework.phoenix = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "phoenix";
@ -2337,6 +2265,16 @@ let
        };
      };

+      redhat.vscode-xml = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-xml";
+          publisher = "redhat";
+          version = "0.25.2023032304";
+          sha256 = "sha256-3hU/MZU9dP91p2PVycFL6yg/nf4/x8tt76vmlkiHnE8=";
+        };
+        meta.license = lib.licenses.epl20;
+      };
+
      redhat.vscode-yaml = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "vscode-yaml";
@ -2349,16 +2287,6 @@ let
        };
      };

-      redhat.vscode-xml = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-xml";
-          publisher = "redhat";
-          version = "0.25.2023032304";
-          sha256 = "sha256-3hU/MZU9dP91p2PVycFL6yg/nf4/x8tt76vmlkiHnE8=";
-        };
-        meta.license = lib.licenses.epl20;
-      };
-
      richie5um2.snake-trail = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "snake-trail";
@ -2371,7 +2299,7 @@ let
        };
      };

-      rioj7.commandOnAllFiles = buildVscodeMarketplaceExtension {
+      rioj7.commandonallfiles = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "commandOnAllFiles";
          publisher = "rioj7";
@ -2407,18 +2335,6 @@ let
        };
      };

-      rubymaniac.vscode-paste-and-indent = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-paste-and-indent";
-          publisher = "Rubymaniac";
-          version = "0.0.8";
-          sha256 = "0fqwcvwq37ndms6vky8jjv0zliy6fpfkh8d9raq8hkinfxq6klgl";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
      rubbersheep.gi = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "gi";
@ -2431,6 +2347,18 @@ let
        };
      };

+      rubymaniac.vscode-paste-and-indent = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-paste-and-indent";
+          publisher = "Rubymaniac";
+          version = "0.0.8";
+          sha256 = "0fqwcvwq37ndms6vky8jjv0zliy6fpfkh8d9raq8hkinfxq6klgl";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
      rust-lang.rust-analyzer = callPackage ./rust-lang.rust-analyzer { };

      ryu1kn.partial-diff = buildVscodeMarketplaceExtension {
@ -2546,18 +2474,6 @@ let
        };
      };

-      silvenon.mdx = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "mdx";
-          publisher = "silvenon";
-          version = "0.1.0";
-          sha256 = "1mzsqgv0zdlj886kh1yx1zr966yc8hqwmiqrb1532xbmgyy6adz3";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
      skellock.just = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "just";
@ -2688,6 +2604,22 @@ let
        };
      };

+      styled-components.vscode-styled-components = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-styled-components";
+          publisher = "styled-components";
+          version = "1.7.6";
+          sha256 = "sha256-ZXXXFUriu//2Wmj1N+plj7xzJauGBfj+79SyrkUZAO4=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/styled-components.vscode-styled-components/changelog";
+          description = "Syntax highlighting and IntelliSense for styled-components";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=styled-components.vscode-styled-components";
+          homepage = "https://github.com/styled-components/vscode-styled-components";
+          license = lib.licenses.mit;
+        };
+      };
+
      sumneko.lua = callPackage ./sumneko.lua { };

      svelte.svelte-vscode = buildVscodeMarketplaceExtension {
@ -3098,7 +3030,7 @@ let
        };
      };

-      WakaTime.vscode-wakatime = callPackage ./WakaTime.vscode-wakatime { };
+      wakatime.vscode-wakatime = callPackage ./WakaTime.vscode-wakatime { };

      wholroyd.jinja = buildVscodeMarketplaceExtension {
        mktplcRef = {
@ -3230,10 +3162,15 @@ let
      };
    };

-  aliases = self: super: {
-    # aliases
+  aliases = super: {
+    Arjun.swagger-viewer = super.arjun.swagger-viewer;
    jakebecker.elixir-ls = super.elixir-lsp.vscode-elixir-ls;
-    ms-vscode = lib.recursiveUpdate super.ms-vscode { inherit (super.golang) go; };
+    jpoissonnier.vscode-styled-components = super.styled-components.vscode-styled-components;
+    matklad.rust-analyzer = super.rust-lang.rust-analyzer; # Previous publisher
+    ms-vscode.go = super.golang.go;
+    ms-vscode.PowerShell = super.ms-vscode.powershell;
+    rioj7.commandOnAllFiles = super.rioj7.commandonallfiles;
+    WakaTime.vscode-wakatime = super.wakatime.vscode-wakatime;
    _1Password = throw ''_1Password has been replaced with "1Password"'';
    _2gua = throw ''_2gua has been replaced with "2gua"'';
    _4ops = throw ''_4ops has been replaced with "4ops"'';
@ -3243,7 +3180,9 @@ let
  # then apply extension specific modifcations to packages.

  # overlays will be applied left to right, overrides should come after aliases.
-  overlays = lib.optionals config.allowAliases [ aliases ];
+  overlays = lib.optionals config.allowAliases [
+    (self: super: lib.recursiveUpdate super (aliases super))
+  ];

  toFix = lib.foldl' (lib.flip lib.extends) baseExtensions overlays;
 in
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -1,5 +1,5 @@
 { config, stdenv, lib, fetchurl, fetchzip, boost, cmake, ffmpeg, gettext, glew
-, ilmbase, libXi, libX11, libXext, libXrender
+, ilmbase, libepoxy, libXi, libX11, libXext, libXrender
 , libjpeg, libpng, libsamplerate, libsndfile
 , libtiff, libwebp, libGLU, libGL, openal, opencolorio, openexr, openimagedenoise, openimageio, openjpeg, python310Packages
 , openvdb, libXxf86vm, tbb, alembic
@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "blender";
-  version = "3.3.1";
+  version = "3.4.1";

  src = fetchurl {
    url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    hash = "sha256-KtpI8L+KDKgCuYfXV0UgEuH48krPTSNFOwnC1ZURjMo=";
+    hash = "sha256-JHxMEignDJAQ9HIcmFy1tiirUKvPnyZ4Ywc3FC7rkcM=";
  };

  patches = lib.optional stdenv.isDarwin ./darwin.patch;
@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
      pugixml
      potrace
      libharu
+      libepoxy
    ]
    ++ (if (!stdenv.isDarwin) then [
      libXi libX11 libXext libXrender
--- a/pkgs/applications/misc/gum/default.nix
+++ b/pkgs/applications/misc/gum/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "gum";
-  version = "0.8.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-6x1t/PLs1dqlY5XQ1F0PDqZ/TofZ0h1hTc0C1sjn3fA=";
+    sha256 = "sha256-SP8n9PGfn4Oe+3+i7gT4i2WKgO35igPu+86SGp65R7g=";
  };

-  vendorSha256 = "sha256-rOBwhPXo4sTSI3j3rn3c5qWGnGFgkpeFUKgtzKBltbg=";
+  vendorSha256 = "sha256-gA545IqG3us0mmWxbw3fu3mFLqJzluH/T6d3ilfnLyM=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/applications/misc/holochain-launcher/default.nix
+++ b/pkgs/applications/misc/holochain-launcher/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  name = "holochain-launcher";
-  version = "0.9.2";
+  version = "0.9.3";

  src = fetchurl {
    url = "https://github.com/holochain/launcher/releases/download/v${version}/holochain-launcher_${version}_amd64.deb";
-    sha256 = "sha256-ipcv1rP4DDjBEybmntsfw2ubjCgm1cGDlYM7sN0jeVo=";
+    sha256 = "sha256-hvnOB6cTL+VffwtBulrEzujxVZEQMSDoJx2HjivJ9z8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/hubstaff/default.nix
+++ b/pkgs/applications/misc/hubstaff/default.nix
@ -4,9 +4,9 @@
 , curl, writeShellScript, common-updater-scripts }:

 let
-  url = "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/1.6.12-da9418f3/Hubstaff-1.6.12-da9418f3.sh";
-  version = "1.6.12-da9418f3";
-  sha256 = "1iz81g0r20215z65mj6bfls7h0dp1k5kk8q10fjbdfj82rpwbfws";
+  url = "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/1.6.13-269829b4/Hubstaff-1.6.13-269829b4.sh";
+  version = "1.6.13-269829b4";
+  sha256 = "0i05d8kivm09hqsc1z6vn7w0bbc3l9dawssqpqsm7kqdyaq0l304";

  rpath = lib.makeLibraryPath
    [ libX11 zlib libSM libICE libXext freetype libXrender fontconfig libXft
--- a/pkgs/applications/misc/keyleds/default.nix
+++ b/pkgs/applications/misc/keyleds/default.nix
@ -0,0 +1,66 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, pkg-config
+, libuv
+, libX11
+, libXi
+, libyaml
+, luajit
+, udev
+}:
+
+stdenv.mkDerivation rec {
+  pname = "keyleds";
+  version = "unstable-2021-04-08";
+
+  src = fetchFromGitHub {
+    owner = "keyleds";
+    repo = pname;
+    rev = "171361654a64b570d747c2d196acb2da4b8dc293";
+    sha256 = "sha256-mojgHMT0gni0Po0hiZqQ8eMzqfwUipXue1uqpionihw=";
+  };
+
+  # This commit corresponds to the following open PR:
+  # https://github.com/keyleds/keyleds/pull/74
+  # According to the author of the PR, the maintainer of keyleds is unreachable.
+  # This patch fixes the build process which is broken on the current master branch of keyleds.
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/keyleds/keyleds/commit/bffed5eb181127df915002b6ed830f85f15feafd.patch";
+      sha256 = "sha256-i2N3D/K++34JVqJloNK2UcN473NarIjdjAz6PUhXcNY=";
+    })
+  ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    libuv
+    libX11
+    libXi
+    libyaml
+    luajit
+    udev
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=MinSizeRel"
+  ];
+
+  meta = {
+    homepage = "https://github.com/keyleds/keyleds";
+    description = "Advanced RGB animation service for Logitech keyboards";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@ -47,7 +47,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "prusa-slicer";
-  version = "2.5.0";
+  version = "2.5.1";

  nativeBuildInputs = [
    cmake
@ -150,7 +150,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "prusa3d";
    repo = "PrusaSlicer";
-    sha256 = "sha256-wLe+5TFdkgQ1mlGYgp8HBzugeONSne17dsBbwblILJ4=";
+    sha256 = "sha256-ZeCofpBtsIBPRcjeJSEjOj+yNOOmYQA91/NLZwB2GUs=";
    rev = "version_${version}";
  };

--- a/pkgs/applications/misc/weather/default.nix
+++ b/pkgs/applications/misc/weather/default.nix
@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, python3, installShellFiles }:

 stdenv.mkDerivation rec {
-  version = "2.4.2";
+  version = "2.4.4";
  pname = "weather";

  src = fetchurl {
    url = "http://fungi.yuggoth.org/weather/src/${pname}-${version}.tar.xz";
-    sha256 = "sha256-qJl5rFDk31Fm+tmR6+Iiihcx6qyd9alHz2L672pNJsc=";
+    sha256 = "sha256-uBwcntmLmIAztbIOHEDx0Y0/kcoJqAHqBOM2yBiRHrU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/xmrig/moneroocean.nix
+++ b/pkgs/applications/misc/xmrig/moneroocean.nix
@ -2,13 +2,13 @@

 xmrig.overrideAttrs (oldAttrs: rec {
  pname = "xmrig-mo";
-  version = "6.19.0-mo1";
+  version = "6.19.1-mo1";

  src = fetchFromGitHub {
    owner = "MoneroOcean";
    repo = "xmrig";
    rev = "v${version}";
-    sha256 = "sha256-+J6gl/R9Yi8V2nYNuIH/oyplWi8vzfdamELHjp6iS7c=";
+    sha256 = "sha256-wrjn1QhHI/OeSpPkwuwqQAsTOW8O/lNqIgKjkjxSbbA=";
  };

  meta = with lib; {
--- a/pkgs/applications/misc/yewtube/default.nix
+++ b/pkgs/applications/misc/yewtube/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "yewtube";
-  version = "2.10.1";
+  version = "2.10.2";

  src = fetchFromGitHub {
    owner = "mps-youtube";
    repo = "yewtube";
    rev = "refs/tags/v${version}";
-    hash = "sha256-1qYHgMp9OZQuKDycvVwp0ADvF8xNY668JvRMVIE/dko=";
+    hash = "sha256-yqztce6t7VTtrumxbhbikYY54FiyUaegBPYSnF4wTkU=";
  };

  postPatch = ''
--- a/pkgs/applications/misc/zola/default.nix
+++ b/pkgs/applications/misc/zola/default.nix
@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "zola";
-  version = "0.17.1";
+  version = "0.17.2";

  src = fetchFromGitHub {
    owner = "getzola";
    repo = "zola";
    rev = "v${version}";
-    hash = "sha256-+q6arKZjHVstnbPQhmuxdj/kCPTFf9L0jZYlPS+lksk=";
+    hash = "sha256-br7VpxkVMZ/TgwMaFbnVMOw9RemNjur/UYnloMoDzHs=";
  };

-  cargoHash = "sha256-mS+yQD7ggQJ/6TYgL54+lLsUbKQaZX9oxT2/GaFoWyI=";
+  cargoHash = "sha256-AAub8UwAvX3zNX+SM/T9biyNxFTgfqUQG/MUGfwWuno=";

  nativeBuildInputs = [
    cmake
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -29,11 +29,11 @@ rec {

  firefox-beta = buildMozillaMach rec {
    pname = "firefox-beta";
-    version = "112.0b6";
+    version = "112.0b7";
    applicationName = "Mozilla Firefox Beta";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "sha512-3Ae3IilmvG7twTaFnKs0TJpiuzLERdrjToTmE644VFeK2GpRgaXgFRfsSB32cyAE+zXPYN/fub8sUoPAHLMbvg==";
+      sha512 = "sha512-81g/K0tLZ6lDnMnomMlX1++WMfK45PLBw7AzppuJGNhl9cnryc4BXilSMF9ibIuyTuSMpLHoCggFtH0k7IRyAA==";
    };

    meta = {
@ -56,12 +56,12 @@ rec {

  firefox-devedition = buildMozillaMach rec {
    pname = "firefox-devedition";
-    version = "112.0b6";
+    version = "112.0b7";
    applicationName = "Mozilla Firefox Developer Edition";
    branding = "browser/branding/aurora";
    src = fetchurl {
      url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "sha512-UJjZ4HFaO6XUpFt+d61KXdliN3FW0BDHFpwt4f6/pv6Rv10mxeRUnGKZDomoLwv+yCgN3EKDZ+iPA9FzkLxZCQ==";
+      sha512 = "sha512-2g+2/0s2lp36P+W2Z+9zd8AaMKvDFXjV+JgRoqtFr57HPIC+HwW1f9Swg4dFUVN7oz1CQ7cZiPBuH+FmMT7Q6Q==";
    };

    meta = {
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@ -1,11 +1,11 @@
 {
-  "packageVersion": "111.0-3",
+  "packageVersion": "111.0.1-1",
  "source": {
-    "rev": "111.0-3",
-    "sha256": "09vb9vi9rrm5y8ym21g52lrbbp6w4k6qpk9q13k0vxzf26wmwk5n"
+    "rev": "111.0.1-1",
+    "sha256": "045nisl000ll0pzir9zhrkbbkl87bsd38mygx7gz9kv6p0pppl7i"
  },
  "firefox": {
-    "version": "111.0",
-    "sha512": "cdb300fdbb2b60068b0fc10a18df587b417e484901d36f52dd174d320d3440a42b02ea000f325c5781fd8853a5171b1a5184562fb535ece90619e4c64d46bb82"
+    "version": "111.0.1",
+    "sha512": "b16c9399a19cb1de2d865a023d54fbe71c23a363ea4d36cd58f41f64f7ad04bc1b9d8a8448943417516e17337e0ee2afd370c29a72b51b0947161f4ffab6935f"
  }
 }
--- a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
@ -94,9 +94,6 @@ stdenv.mkDerivation rec {
      libGLESv2 = lib.makeLibraryPath [
        xorg.libX11 xorg.libXext xorg.libxcb wayland
      ];
-      libsmartscreen = lib.makeLibraryPath [
-        libuuid stdenv.cc.cc.lib
-      ];
      libsmartscreenn = lib.makeLibraryPath [
        libuuid
      ];
@ -131,10 +128,6 @@ stdenv.mkDerivation rec {
      --set-rpath "${libPath.libGLESv2}" \
      opt/microsoft/${shortName}/libGLESv2.so

-    patchelf \
-      --set-rpath "${libPath.libsmartscreen}" \
-      opt/microsoft/${shortName}/libsmartscreen.so
-
    patchelf \
      --set-rpath "${libPath.libsmartscreenn}" \
      opt/microsoft/${shortName}/libsmartscreenn.so
--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@ -1,20 +1,20 @@
 {
+  stable = import ./browser.nix {
+    channel = "stable";
+    version = "111.0.1661.44";
+    revision = "1";
+    sha256 = "sha256-ePViYQZUteMBkV7AkvsoQwPVxibMB68LDWgg7d82iIE=";
+  };
  beta = import ./browser.nix {
    channel = "beta";
-    version = "108.0.1462.20";
+    version = "112.0.1722.15";
    revision = "1";
-    sha256 = "sha256:0dfmzjfy4y07pqifyzv3rc8dbmxz8rr3v2idanla7jrks0pghcxm";
+    sha256 = "sha256-Ba6f5MOBTtY8bUxCcMySQCWqDvOiI1hLnuwcIspReq8=";
  };
  dev = import ./browser.nix {
    channel = "dev";
-    version = "109.0.1495.2";
+    version = "113.0.1741.1";
    revision = "1";
-    sha256 = "sha256:1bk7dx3mf020ahzmvr9cdgcn72rjrn2420j9g362vwcl1khyxciw";
-  };
-  stable = import ./browser.nix {
-    channel = "stable";
-    version = "107.0.1418.52";
-    revision = "1";
-    sha256 = "sha256:1k3c5r9lq3vpc190bzs5fn944bi3af6wjxzwcliy4wzzrb5g0day";
+    sha256 = "sha256-1d92bQAoiTkqWgiWdUBn3VKBYCRP1KCvPiu7cQTFVio=";
  };
 }
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -45,7 +45,7 @@ assert with lib.strings; (

 stdenv.mkDerivation rec {
  pname = "palemoon";
-  version = "32.0.1";
+  version = "32.1.0";

  src = fetchFromGitea {
    domain = "repo.palemoon.org";
@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
    repo = "Pale-Moon";
    rev = "${version}_Release";
    fetchSubmodules = true;
-    sha256 = "sha256-lz9Ok8i95pVfl4UHy2zWFe9vwJocUvDbueiWdZuz4Bo=";
+    sha256 = "sha256-yfXcHoPdTknryYFV8mBWHvzs68oELqsJjTC/nT4SMB8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "2.6.5";
+  version = "2.6.7";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = "v${version}";
-    sha256 = "sha256-+3d20bD2sxck8fCrMv6Z9O70g7iWdHA5FdFVoLDtY2k=";
+    sha256 = "sha256-KvnKz+NxCiCqX/lDsm4YdrUmtK028D9KM9Ke9mxiZQw=";
  };

  proxyVendor = true; # darwin/linux hash mismatch
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -7,20 +7,20 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    sha256 = "sha256-r3cSHiNlWrP7JCqYOy86mn6ssfDEbm6DYerVCoARz7M=";
+    sha256 = "sha256-gC7HdOrmOIYTaksx/CxXMt4wIly3RBL1SsQRbwQWLi8=";
  };

  CGO_ENABLED = 0;

  nativeBuildInputs = [ installShellFiles ];

-  vendorHash = "sha256-9QQuFrICfYLkoObNFsIn3H6brcv3qXL3FIguQMZ02HY=";
+  vendorHash = "sha256-BGUaU8p0C6kN8l3b27WQjfWP1e2LWD1KLWNsJdyEuRc=";

  # Exclude pkg/get: tests downloading of binaries which fail when sandbox=true
  subPackages = [
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -73,13 +73,13 @@
    "vendorHash": "sha256-DqAHkNxfI1txtW9PadHzgWuRCiuV/CVqq/qba+e0O7M="
  },
  "argocd": {
-    "hash": "sha256-nxNZ0W8tcnnUhqf2S8tM6CvupYS4ALamYg3zYZQScA8=",
+    "hash": "sha256-fmIbmjXOwIvtNMNQHtg3ucKzwXdh0do8DW5c6iYlil0=",
    "homepage": "https://registry.terraform.io/providers/oboukili/argocd",
    "owner": "oboukili",
    "repo": "terraform-provider-argocd",
-    "rev": "v5.0.0",
+    "rev": "v5.0.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-KgEX0h+WgcVjMMgNb5QJJNQjqAxQ8ATolVXZBro+adQ="
+    "vendorHash": "sha256-mKefDPwWPlUleoAkJpTvJwQeOb7pA80cZQ7fpwir6kk="
  },
  "auth0": {
    "hash": "sha256-y2pjk+rSLAM7H4XjwvwZSNFW4+9EhN3fb01cml6RTb0=",
@ -182,12 +182,12 @@
    "vendorHash": "sha256-dm+2SseBeS49/QoepRwJ1VFwPCtU+6VymvyEH/sLkvI="
  },
  "buildkite": {
-    "hash": "sha256-H9kVHGnIzOHViTAuJnLJqcxDjSRXVqyKBAFfOd8fkHo=",
+    "hash": "sha256-CRxGzg0wQZOJ2gWKjRjCOsVjYF3ls35EMHO8DrfPNFk=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "proxyVendor": true,
    "repo": "terraform-provider-buildkite",
-    "rev": "v0.11.1",
+    "rev": "v0.12.1",
    "spdx": "MIT",
    "vendorHash": "sha256-C7bm9wDNEO7fJuqssUxQ4t9poVkPkKd8MU7S9MJTOW4="
  },
@ -382,11 +382,11 @@
    "vendorHash": "sha256-E1gzdES/YVxQq2J47E2zosvud2C/ViBeQ8+RfNHMBAg="
  },
  "fastly": {
-    "hash": "sha256-60WydEYr/U1oDVq2YI5W86ivbLw/MRztOOQbTqbDQSg=",
+    "hash": "sha256-FO6SXpFk/DxOvDszwYiftB65JVNoN90JG6JFc8zid50=",
    "homepage": "https://registry.terraform.io/providers/fastly/fastly",
    "owner": "fastly",
    "repo": "terraform-provider-fastly",
-    "rev": "v4.1.0",
+    "rev": "v4.1.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/coreth/default.nix
+++ b/pkgs/applications/networking/coreth/default.nix
@ -6,19 +6,19 @@

 buildGoModule rec {
  pname = "coreth";
-  version = "0.11.8";
+  version = "0.11.9";

  src = fetchFromGitHub {
    owner = "ava-labs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-O6dTbhnZPWd7BKMwaPfUOPwcvwzQoHUKR9Zj7uKqtGM=";
+    hash = "sha256-i0mLyTeosGlnTpKvAUS3wDvBRFpgmnfmKXAtCnAGqE0=";
  };

  # go mod vendor has a bug, see: golang/go#57529
  proxyVendor = true;

-  vendorHash = "sha256-nJA83SfMv+5xKKyJTtaSRsro1XR+3sNiszBeXRRY5NA=";
+  vendorHash = "sha256-zX1rQ9RDBkzZIbqCDlFEgseYyKYUHYyGFApZqhOrkGU=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/datovka/default.nix
+++ b/pkgs/applications/networking/datovka/default.nix
@ -12,11 +12,11 @@

 mkDerivation rec {
  pname = "datovka";
-  version = "4.21.1";
+  version = "4.22.0";

  src = fetchurl {
    url = "https://gitlab.nic.cz/datovka/datovka/-/archive/v${version}/datovka-v${version}.tar.gz";
-    sha256 = "sha256-mzCtZE4mira/ZeyfujBh+cONq1YbCyLIypiIX0kTVJg=";
+    sha256 = "sha256-MM2fTONdgvCOrVlMlBgpaoaZLbuSMVG/ENOx2egug98=";
  };

  buildInputs = [ libdatovka qmake qtbase qtsvg libxml2 qtwebsockets ];
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "alfaview";
-  version = "8.58.2";
+  version = "8.65.0";

  src = fetchurl {
    url = "https://production-alfaview-assets.alfaview.com/stable/linux/${pname}_${version}.deb";
-    sha256 = "sha256-z6GjIR9K4OWFuQTGBbP05aYFNa2sD1UW4e/GW01xj78=";
+    sha256 = "sha256-/1qYC2JCbgiR8fGL9R0mnRm8fY1DbAKhkjkDwEENWsA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -2,7 +2,7 @@
 let
  versions = if stdenv.isLinux then {
    stable = "0.0.25";
-    ptb = "0.0.39";
+    ptb = "0.0.41";
    canary = "0.0.150";
  } else {
    stable = "0.0.273";
@ -18,7 +18,7 @@ let
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        sha256 = "LoDg3iwK18rDszU/dQEK0/J8DIxrqydsfflZo8IARks=";
+        sha256 = "AhiZXgkXG/lroG7XAgcvJ7r5PSvzMFhamsxB1cXJOak=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
--- a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
+++ b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
@ -7,7 +7,6 @@
 , python-magic
 , markdown
 , pillow
-, urllib3
 , aiofiles
 , notify2
 , dbus-python
@ -17,13 +16,13 @@

 buildPythonApplication rec {
  pname = "matrix-commander";
-  version = "3.5.0";
+  version = "6.0.1";

  src = fetchFromGitHub {
    owner = "8go";
    repo = "matrix-commander";
    rev = "v${version}";
-    sha256 = "sha256-/hNTaajZTyeIcGILIXqUVbBvZ8AUNZKBDsZ4Gr5RL2o=";
+    sha256 = "sha256-NSoMGUQjy4TQXdzZcQfO2rUQDsuSzQnoGDpqFiLQHVQ=";
  };

  format = "pyproject";
@ -45,7 +44,6 @@ buildPythonApplication rec {
    python-magic
    markdown
    pillow
-    urllib3
    aiofiles
    notify2
    dbus-python
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@ -23,12 +23,12 @@ assert gpgmeSupport -> sslSupport;

 stdenv.mkDerivation rec {
  pname = "mutt";
-  version = "2.2.9";
+  version = "2.2.10";
  outputs = [ "out" "doc" "info" ];

  src = fetchurl {
    url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "+lMbIx1Y/h8wztoO1iZoPqnr37ds5H74uyfC93Qiz/s=";
+    sha256 = "sha256-TXc/IkIveQlve5S1e+5FZUrZolFl27NkY8WClbTNPYg=";
  };

  patches = lib.optional smimeSupport (fetchpatch {
--- a/pkgs/applications/networking/p2p/opentracker/default.nix
+++ b/pkgs/applications/networking/p2p/opentracker/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation {
  pname = "opentracker";
-  version = "unstable-2018-05-26";
+  version = "unstable-2021-08-23";

  src = fetchgit {
    url = "https://erdgeist.org/gitweb/opentracker";
-    rev = "6411f1567f64248b0d145493c2e61004d2822623";
-    sha256 = "110nfb6n4clykwdzpk54iccsfjawq0krjfqhg114i1z0ri5dyl8j";
+    rev = "110868ec4ebe60521d5a4ced63feca6a1cf0aa2a";
+    sha256 = "sha256-SuElfmk7zONolTiyg0pyvbfvyJRn3r9OrXwpTzLw8LI=";
  };

  buildInputs = [ libowfat zlib ];
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@ -142,7 +142,7 @@ in stdenv.mkDerivation {
    '';
    homepage = "http://www.transmissionbt.com/";
    license = lib.licenses.gpl2Plus; # parts are under MIT
-    maintainers = with lib.maintainers; [ astsmtl vcunat wizeman ];
+    maintainers = with lib.maintainers; [ astsmtl vcunat ];
    platforms = lib.platforms.unix;
  };

--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "protonmail-bridge";
-  version = "3.0.18";
+  version = "3.0.21";

  src = fetchFromGitHub {
    owner = "ProtonMail";
    repo = "proton-bridge";
    rev = "v${version}";
-    hash = "sha256-0gQnMhjwW2NEJwafqndStQ33dIu82lW6ntXFRCpbmm4=";
+    hash = "sha256-aRzVXmAWRifIGCAPWYciBhK9XMvsmtHc67XRoI19VYU=";
  };

-  vendorHash = "sha256-lHMcVcaoBwjE2ikEZPeZexC5XvhkAtvHnDci7UAa4vg=";
+  vendorHash = "sha256-zCE4LO6m4uyOvSzhUbzH2F9EgDs0UZH4eCl6lfRjIRQ=";

  nativeBuildInputs = [ pkg-config ];

@ -38,7 +38,7 @@ buildGoModule rec {
  ];

  postInstall = ''
-    mv $out/bin/Desktop-Bridge $out/bin/bridge # The cli is named like that in the upstream repo
+    mv $out/bin/Desktop-Bridge $out/bin/protonmail-bridge # The cli is named like that in other distro packages
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/sync/unison/default.nix
+++ b/pkgs/applications/networking/sync/unison/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "unison";
-  version = "2.53.0";
+  version = "2.53.2";

  src = fetchFromGitHub {
    owner = "bcpierce00";
    repo = "unison";
    rev = "v${version}";
-    sha256 = "sha256-4Lyn1UecpVIhoEXIFu35XK4aoAfYGPCZ9L4ZY7224yo=";
+    sha256 = "sha256-H+70NZZP0cUsxetFcsjWEx2kENsgMdo/41wBwwaX6zg=";
  };

  strictDeps = true;
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -1,4 +1,13 @@
-{ pkgsBuildBuild, go, buildGoModule, stdenv, lib, procps, fetchFromGitHub, nixosTests }:
+{ pkgsBuildBuild
+, go
+, buildGoModule
+, stdenv
+, lib
+, procps
+, fetchFromGitHub
+, nixosTests
+, autoSignDarwinBinariesHook
+}:

 let
  common = { stname, target, postInstall ? "" }:
@ -15,6 +24,15 @@ let

      vendorHash = "sha256-5NgflkRXkbWiIkASmxIgWliE8sF89HtlMtlIF+5u6Ic=";

+      nativeBuildInputs = lib.optionals stdenv.isDarwin [
+        # Recent versions of macOS seem to require binaries to be signed when
+        # run from Launch Agents/Daemons, even on x86 devices where it has a
+        # more lax code signing policy compared to Apple Silicon. So just sign
+        # the binaries on both architectures to make it possible for launchd to
+        # auto-start Syncthing at login.
+        autoSignDarwinBinariesHook
+      ];
+
      doCheck = false;

      BUILD_USER = "nix";
--- a/pkgs/applications/radio/chirp/default.nix
+++ b/pkgs/applications/radio/chirp/default.nix
@ -6,13 +6,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "chirp";
-  version = "unstable-2022-12-07";
+  version = "unstable-2023-03-15";

  src = fetchFromGitHub {
    owner = "kk7ds";
    repo = "chirp";
-    rev = "dc0c98d22423b496faf0a86296a6ec0bb3b3e11a";
-    hash = "sha256-z0xD11CB7Vt8k0dPXE+E5ZD9XAFwWNxjnUs25/Gd7zI=";
+    rev = "33402b7c545c5a92b7042369867e7eb75ef32a59";
+    hash = "sha256-duSEpd2GBBskoKNFos5X9wFtsjRct1918VhZd1T2rvU=";
  };

  propagatedBuildInputs = with python3.pkgs; [
@ -21,6 +21,7 @@ python3.pkgs.buildPythonApplication rec {
    requests
    six
    wxPython_4_2
+    yattag
  ];

  # "running build_ext" fails with no output
--- a/pkgs/applications/science/astronomy/calcmysky/default.nix
+++ b/pkgs/applications/science/astronomy/calcmysky/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "calcmysky";
-  version = "0.2.1";
+  version = "unstable-2023-02-11";

  src = fetchFromGitHub {
    owner = "10110111";
    repo = "CalcMySky";
-    rev = "v${version}";
-    hash = "sha256-7Yj6OlZ7weenekXYGhK5EWcME20oCHiLPOxz5KEuKy4=";
+    rev = "c5f281452816d8de775b13a70fb90e79427c93c4";
+    hash = "sha256-mzxtu6YTaZpR17m2WGiSDo/bAPXGJdQskyz7aqtxGoQ=";
  };

  nativeBuildInputs = [ cmake wrapQtAppsHook ];
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "stellarium";
-  version = "1.2";
+  version = "23.1";

  src = fetchFromGitHub {
    owner = "Stellarium";
    repo = "stellarium";
    rev = "v${version}";
-    sha256 = "sha256-0/ZSe6QfM2zVsqcbyqefl9hiuex72KPxJvVMRNCnpZg=";
+    hash = "sha256-7jzS3pRklPsCTgCr3nrywfHCNlBDHuyuGGvrVoI9+A0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -53,7 +53,7 @@ let
   "8.15.2".sha256     = "sha256:0qibbvzrhsvs6w3zpkhyclndp29jnr6bs9i5skjlpp431jdjjfqd";
   "8.16.0".sha256   = "sha256-3V6kL9j2rn5FHBxq1mtmWWTZS9X5cAyvtUsS6DaM+is=";
   "8.16.1".sha256   = "sha256-n7830+zfZeyYHEOGdUo57bH6bb2/SZs8zv8xJhV+iAc=";
-   "8.17+rc1".sha256   = "sha256-BsVgYa2fAYqRmQNSaY/YSiZhqkmwM+xbE5T4FHOEqkc=";
+   "8.17.0".sha256   = "sha256-TGwm7S6+vkeZ8cidvp8pkiAd9tk008jvvPvYgfEOXhM=";
  };
  releaseRev = v: "V${v}";
  fetched = import ../../../../build-support/coq/meta-fetch/default.nix
--- a/pkgs/applications/science/math/ginac/default.nix
+++ b/pkgs/applications/science/math/ginac/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ginac";
-  version = "1.8.5";
+  version = "1.8.6";

  src = fetchurl {
    url = "https://www.ginac.de/ginac-${version}.tar.bz2";
-    sha256 = "sha256-wks3oecJ9mDQl4eH6GszSAPNKOwXaJzzbd/zgAc+omE=";
+    sha256 = "sha256-ALMgsRFsrlt7QzZNv/t5EkcdFx9ITYJ2RgXXFYWNl1s=";
  };

  propagatedBuildInputs = [ cln ];
--- a/pkgs/applications/science/math/primecount/default.nix
+++ b/pkgs/applications/science/math/primecount/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "primecount";
-  version = "7.6";
+  version = "7.7";

  src = fetchFromGitHub {
    owner = "kimwalisch";
    repo = "primecount";
    rev = "v${version}";
-    hash = "sha256-x9sXLuHd3nfVM6sL/5yAzIoTVkf1LIUnbhx2WlD/OS8=";
+    hash = "sha256-6Q9DPnlGKb31QYEGpm78ISfbj90MeLD0/2k2fDZm7cM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/networking/sumo/default.nix
+++ b/pkgs/applications/science/networking/sumo/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "sumo";
-  version = "1.15.0";
+  version = "1.16.0";

  src = fetchFromGitHub {
    owner = "eclipse";
    repo = "sumo";
    rev = "v${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "sha256-Mm8Kqb5W9h2jYvRGypI6v5IHDm4CnAeT+NcJybdU5K0=";
+    sha256 = "sha256-0aUm7sgBLTPNSJuH6/xsTDZKUzAI87wPI2G3WSi5SGA=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/system/booster/default.nix
+++ b/pkgs/applications/system/booster/default.nix
@ -16,16 +16,16 @@

 buildGoModule rec {
  pname = "booster";
-  version = "0.9";
+  version = "0.10";

  src = fetchFromGitHub {
    owner = "anatol";
    repo = pname;
    rev = version;
-    hash = "sha256-kalVFVBb+ngoUpm+iiIHGS6vBVLEvTVyKuSMSMbp7Qc=";
+    hash = "sha256-mUmh2oAD3G9cpv7yiKcFaXJkEdo18oMD/sttnYnAQL8=";
  };

-  vendorHash = "sha256-GD+nsT4/Y2mTF+ztOC3N560BY5+QSfsPrXZ+dJYtzAw=";
+  vendorHash = "sha256-czzNAUO4eRYTwfnidNLqyvIsR0nyzR9cb+G9/5JRvKs=";

  postPatch = ''
    substituteInPlace init/main.go --replace "/usr/bin/fsck" "${unixtools.fsck}/bin/fsck"
--- a/pkgs/applications/version-management/git-stack/default.nix
+++ b/pkgs/applications/version-management/git-stack/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-stack";
-  version = "0.10.12";
+  version = "0.10.14";

  src = fetchFromGitHub {
    owner = "gitext-rs";
    repo = "git-stack";
    rev = "v${version}";
-    hash = "sha256-ghH3wmXLPzJZ4lNXFwEGKD89r7xaRMXUe9kGHm7MC4s=";
+    hash = "sha256-DAvvVI3npHM7ln/EAr0RjtUCqCoKx9QHsCw69F8C8p4=";
  };

-  cargoHash = "sha256-5FXcReXgq5LFysPGBuYawFdkYAgRHsW+p2Ytin4+ZxI=";
+  cargoHash = "sha256-KDVHSCQx7qIS/Gwx/wlpdIMgirPSfG535dvu33gjF7c=";

  buildInputs = lib.optionals stdenv.isDarwin [
    Security
--- a/pkgs/applications/version-management/src/default.nix
+++ b/pkgs/applications/version-management/src/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "src";
-  version = "1.29";
+  version = "1.31";

  src = fetchurl {
    url = "http://www.catb.org/~esr/src/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Tc+qBhLtC9u23BrqVniAprAV8YhXELvbMn+XxN5BQkE=";
+    sha256 = "sha256-m00CG96w5olzxitxzTE2RLAQniUm1hhHpFmSaVgvDt0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/video/vokoscreen-ng/default.nix
+++ b/pkgs/applications/video/vokoscreen-ng/default.nix
@ -16,6 +16,7 @@
 , gst-plugins-bad
 , gst-plugins-ugly
 , wayland
+, pipewire
 , wrapQtAppsHook
 }:

@ -41,6 +42,7 @@ mkDerivation rec {
    qtmultimedia
    qtx11extras
    wayland
+    pipewire
    gst-plugins-base
    gst-plugins-good
    gst-plugins-bad
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixpacks";
-  version = "1.5.1";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-eAniM4o7TshGhO5jGrCZz+Rs5n5Q24tvIWMWebKAWAs=";
+    sha256 = "sha256-q+NMV0GagcGeUb+WD8BoFjAKJWgzBSq/POqwPUADAUI=";
  };

-  cargoHash = "sha256-0Y4hHuWB7NY7rRJImNIrxlEffrT9055ThQGqJlMeDMM=";
+  cargoHash = "sha256-m9CvMorM7uX6OOfVCtM2pZPgRcKm7fVoTk/SCt8FXyU=";

  # skip test due FHS dependency
  doCheck = false;
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -61,13 +61,13 @@ let
 in
 buildGoModule rec {
  pname = "podman";
-  version = "4.4.3";
+  version = "4.4.4";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    hash = "sha256-s0aGZN4rnyyNLoO3nnAO7KbeD7MYxE9VMOHrQsKGNBk=";
+    hash = "sha256-rLXq+sveSxeoD3gyXSnfgGFx6alOBKSRCdDHGwwvPm4=";
  };

  patches = [
--- a/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
+++ b/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
@ -0,0 +1,57 @@
+{ lib
+, fetchFromGitHub
+, makeRustPlatform
+, hostPlatform
+, targetPlatform
+, lld
+}:
+
+let
+  arch = targetPlatform.qemuArch;
+
+  target = ./. + "/${arch}-unknown-none.json";
+
+  cross = import ../../../.. {
+    system = hostPlatform.system;
+    crossSystem = lib.systems.examples."${arch}-embedded" // {
+      rustc.config = "${arch}-unknown-none";
+      rustc.platform = lib.importJSON target;
+    };
+  };
+
+  inherit (cross) rustPlatform;
+
+in
+
+rustPlatform.buildRustPackage rec {
+  pname = "rust-hypervisor-firmware";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "cloud-hypervisor";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-hKk5pcop8rb5Q+IVchcl+XhMc3DCBBPn5P+AkAb9XxI=";
+  };
+
+  cargoSha256 = "sha256-edi6/Md6KebKM3wHArZe1htUCg0/BqMVZKA4xEH25GI=";
+
+  RUSTC_BOOTSTRAP = 1;
+
+  nativeBuildInputs = [
+    lld
+  ];
+
+  RUSTFLAGS = "-C linker=lld -C linker-flavor=ld.lld";
+
+  # Tests don't work for `no_std`. See https://os.phil-opp.com/testing/
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/cloud-hypervisor/rust-hypervisor-firmware";
+    description = "A simple firmware that is designed to be launched from anything that supports loading ELF binaries and running them with the PVH booting standard";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ astro ];
+    platforms = [ "x86_64-none" ];
+  };
+}
--- a/pkgs/applications/virtualization/rust-hypervisor-firmware/x86_64-unknown-none.json
+++ b/pkgs/applications/virtualization/rust-hypervisor-firmware/x86_64-unknown-none.json
@ -0,0 +1,20 @@
+{
+  "llvm-target": "x86_64-unknown-none",
+  "data-layout": "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128",
+  "arch": "x86_64",
+  "target-endian": "little",
+  "target-pointer-width": "64",
+  "target-c-int-width": "32",
+  "os": "none",
+  "executables": true,
+  "linker": "rust-lld",
+  "linker-flavor": "ld.lld",
+  "panic-strategy": "abort",
+  "disable-redzone": true,
+  "features": "-mmx,-sse,+soft-float",
+  "code-model": "small",
+  "relocation-model": "pic",
+  "pre-link-args": {
+    "ld.lld": ["--script=x86_64-unknown-none.ld"]
+  }
+}
--- a/pkgs/applications/virtualization/vmware-workstation/default.nix
+++ b/pkgs/applications/virtualization/vmware-workstation/default.nix
@ -16,6 +16,7 @@
 , vulkan-loader
 , alsa-lib
 , libpulseaudio
+, libxcrypt-legacy
 , libGL
 , numactl
 , libX11
@ -86,6 +87,7 @@ stdenv.mkDerivation rec {
    vulkan-loader
    alsa-lib
    libpulseaudio
+    libxcrypt-legacy
    libGL
    numactl
    libX11
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/buildFHSEnv.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/buildFHSEnv.nix
@ -1,6 +1,6 @@
 { stdenv, lib, buildEnv, writeText, writeShellScriptBin, pkgs, pkgsi686Linux }:

-{ name, profile ? ""
+args@{ name, profile ? ""
 , targetPkgs ? pkgs: [], multiPkgs ? pkgs: []
 , extraBuildCommands ? "", extraBuildCommandsMulti ? ""
 , extraOutputsToInstall ? []
@ -216,4 +216,8 @@ in stdenv.mkDerivation {
  '';
  preferLocalBuild = true;
  allowSubstitutes = false;
+
+  passthru = {
+    inherit args multiPaths targetPaths;
+  };
 }
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@ -20,9 +20,9 @@ args @ {

 with builtins;
 let
-  buildFHSEnv = callPackage ./env.nix { };
+  buildFHSEnv = callPackage ./buildFHSEnv.nix { };

-  env = buildFHSEnv (removeAttrs args [
+  fhsenv = buildFHSEnv (removeAttrs args [
    "runScript" "extraInstallCommands" "meta" "passthru" "extraBwrapArgs" "dieWithParent"
    "unshareUser" "unshareCgroup" "unshareUts" "unshareNet" "unsharePid" "unshareIpc"
    "version"
@ -104,7 +104,7 @@ let
    ro_mounts=()
    symlinks=()
    etc_ignored=()
-    for i in ${env}/*; do
+    for i in ${fhsenv}/*; do
      path="/''${i##*/}"
      if [[ $path == '/etc' ]]; then
        :
@ -117,8 +117,8 @@ let
      fi
    done

-    if [[ -d ${env}/etc ]]; then
-      for i in ${env}/etc/*; do
+    if [[ -d ${fhsenv}/etc ]]; then
+      for i in ${fhsenv}/etc/*; do
        path="/''${i##*/}"
        # NOTE: we're binding /etc/fonts and /etc/ssl/certs from the host so we
        # don't want to override it with a path from the FHS environment.
@ -221,6 +221,7 @@ in runCommandLocal nameAndVersion {
      echo >&2 ""
      exit 1
    '';
+    inherit args fhsenv;
  };
 } ''
  mkdir -p $out/bin
--- a/pkgs/build-support/ocaml/dune.nix
+++ b/pkgs/build-support/ocaml/dune.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation ({
    runHook preInstall
    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${pname} \
     ${if lib.versionAtLeast Dune.version "2.9"
-       then "--docdir $out/share/doc --man $out/share/man"
+       then "--docdir $out/share/doc --mandir $out/share/man"
       else ""}
    runHook postInstall
  '';
--- a/pkgs/data/misc/osinfo-db/default.nix
+++ b/pkgs/data/misc/osinfo-db/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "osinfo-db";
-  version = "20221130";
+  version = "20230308";

  src = fetchurl {
    url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.xz";
-    sha256 = "sha256-opVMrXob7yZ5lJmHxjiI8eCBsJ4R+3JQVDcvA37HcX8=";
+    sha256 = "sha256-VGugTsxekzui1/PztDM6KYDUrk38UoSYm5xUdY8rkIg=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/deepin/apps/deepin-clone/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-clone/default.nix
@ -0,0 +1,77 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, qttools
+, pkg-config
+, qtbase
+, wrapQtAppsHook
+, dtkwidget
+, qt5integration
+, qt5platform-plugins
+, libuuid
+, parted
+, partclone
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deepin-clone";
+  version = "5.0.11";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-ZOJc8R82R9q87Qpf/J4CXE+xL6nvbsXRIs0boNY+2uk=";
+  };
+
+  postPatch = ''
+    substituteInPlace app/{deepin-clone-ionice,deepin-clone-pkexec,deepin-clone.desktop,com.deepin.pkexec.deepin-clone.policy.tmp} \
+      --replace "/usr" "$out"
+
+    substituteInPlace app/src/corelib/ddevicediskinfo.cpp \
+      --replace "/sbin/blkid" "${libuuid}/bin/blkid"
+
+    substituteInPlace app/src/corelib/helper.cpp \
+      --replace "/bin/lsblk" "${libuuid}/bin/lsblk" \
+      --replace "/sbin/sfdisk" "${libuuid}/bin/sfdisk" \
+      --replace "/sbin/partprobe" "${parted}/bin/partprobe" \
+      --replace "/usr/sbin" "${partclone}/bin"
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    qttools
+    pkg-config
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+    dtkwidget
+    qt5platform-plugins
+    libuuid
+    parted
+    partclone
+  ];
+
+  cmakeFlags = [
+    "-DDISABLE_DFM_PLUGIN=YES"
+  ];
+
+  strictDeps = true;
+
+  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
+  qtWrapperArgs = [
+    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
+  ];
+
+  meta = with lib; {
+    description = "Disk and partition backup/restore tool";
+    homepage = "https://github.com/linuxdeepin/deepin-clone";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
+
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@ -39,6 +39,7 @@ let
    deepin-calculator = callPackage ./apps/deepin-calculator { };
    deepin-camera = callPackage ./apps/deepin-camera { };
    deepin-compressor = callPackage ./apps/deepin-compressor { };
+    deepin-clone = callPackage ./apps/deepin-clone { };
    deepin-draw = callPackage ./apps/deepin-draw { };
    deepin-editor = callPackage ./apps/deepin-editor { };
    deepin-image-viewer = callPackage ./apps/deepin-image-viewer { };
--- a/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
+++ b/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
@ -19,6 +19,7 @@
 , kdeclarative
 , plasma-framework
 , plasma-wayland-protocols
+, plasma-workspace
 , kio
 , qtbase
 }:
@ -45,5 +46,6 @@ mkDerivation {
    kdeclarative
    plasma-framework
    plasma-wayland-protocols
+    plasma-workspace
  ];
 }
--- a/pkgs/development/compilers/bluespec/default.nix
+++ b/pkgs/development/compilers/bluespec/default.nix
@ -28,18 +28,18 @@ let

 in stdenv.mkDerivation rec {
  pname = "bluespec";
-  version = "2022.01";
+  version = "2023.01";

  src = fetchFromGitHub {
    owner = "B-Lang-org";
    repo = "bsc";
    rev = version;
-    sha256 = "sha256-ivTua3MLa8akma3MGkhsqwSdwswYX916kywKdlj7TqY=";
+    sha256 = "sha256-kFHQtRaQmZiHo+IQ+mwbW23i3kbdAh/XH0OE7P/ibd0=";
  };

  yices-src = fetchurl {
    url = "https://github.com/B-Lang-org/bsc/releases/download/${version}/yices-src-for-bsc-${version}.tar.gz";
-    sha256 = "sha256-ey5yIIVFZyG4EnYGqbIJqmxK1rZ70FWM0Jz+2hIoGXE=";
+    sha256 = "sha256-pyEdCJvmgwOYPMZEtw7aro76tSn/Y/2GcKTyARmIh4E=";
  };

  enableParallelBuilding = true;
@ -50,8 +50,7 @@ in stdenv.mkDerivation rec {
  patches = [ ./libstp_stub_makefile.patch ];

  postUnpack = ''
-    mkdir -p $sourceRoot/src/vendor/yices/v2.6/yices2
-    tar -C $sourceRoot/src/vendor/yices/v2.6/yices2 -xf ${yices-src}
+    tar -C $sourceRoot/ -xf ${yices-src}
    chmod -R +rwX $sourceRoot/src/vendor/yices/v2.6/yices2
  '';

@ -94,7 +93,7 @@ in stdenv.mkDerivation rec {

  makeFlags = [
    "release"
-    "NO_DEPS_CHECKS=1" # skip the subrepo check (this deriviation uses yices.src instead of the subrepo)
+    "NO_DEPS_CHECKS=1" # skip the subrepo check (this deriviation uses yices-src instead of the subrepo)
    "NOGIT=1" # https://github.com/B-Lang-org/bsc/issues/12
    "LDCONFIG=ldconfig" # https://github.com/B-Lang-org/bsc/pull/43
    "STP_STUB=1"
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@ -4,6 +4,7 @@
 , runCommand
 , fetchpatch
 , cmake
+, darwin
 , ninja
 , python3
 , libffi
@ -16,9 +17,10 @@
 , release_version
 , zlib
 , which
+, sysctl
 , buildLlvmTools
 , debugVersion ? false
-, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
@ -85,17 +87,122 @@ in stdenv.mkDerivation (rec {

  propagatedBuildInputs = [ ncurses zlib ];

-  nativeCheckInputs = [ which ];
+  nativeCheckInputs = [
+    which
+  ] ++ lib.optional stdenv.isDarwin sysctl;

  patches = [
    ./gnu-install-dirs.patch
-  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
+
+    # Running the tests involves invoking binaries (like `opt`) that depend on
+    # the LLVM dylibs and reference them by absolute install path (i.e. their
+    # nix store path).
+    #
+    # Because we have not yet run the install phase (we're running these tests
+    # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+    # paths do not exist yet; to work around this we point the loader (`ld` on
+    # unix, `dyld` on macOS) at the `lib` directory which will later become this
+    # package's `lib` output.
+    #
+    # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+    # dir but:
+    #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+    #     `DYLD_LIBRARY_PATH` (macOS):
+    #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+    #   - even if `lit` forwarded this env var, we actually cannot set
+    #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+    #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+    #     "protected processes" (i.e. the python interpreter that runs `lit`):
+    #     https://stackoverflow.com/a/35570229
+    #   - other LLVM subprojects deal with this issue by having their `lit`
+    #     configuration set these env vars for us; it makes sense to do the same
+    #     for LLVM:
+    #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+    #
+    # !!! TODO: look into upstreaming this patch
+    ./llvm-lit-cfg-add-libs-to-dylib-path.patch
+
+    # `lit` has a mode where it executes run lines as a shell script which is
+    # constructs; this is problematic for macOS because it means that there's
+    # another process in between `lit` and the binaries being tested. As noted
+    # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+    # tests fail with dyld errors.
+    #
+    # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+    # present in the test configuration.
+    #
+    # It's not clear to me why this isn't an issue for LLVM developers running
+    # on macOS (nothing about this _seems_ nix specific)..
+    ./lit-shell-script-runner-set-dyld-library-path.patch
+  ] ++ lib.optionals enablePolly [
+    ./gnu-install-dirs-polly.patch
+
+    # Just like the `llvm-lit-cfg` patch, but for `polly`.
+    ./polly-lit-cfg-add-libs-to-dylib-path.patch
+  ];

  postPatch = optionalString stdenv.isDarwin ''
    substituteInPlace cmake/modules/AddLLVM.cmake \
      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  '' + ''
+    # As of LLVM 15, marked as XFAIL on arm64 macOS but lit doesn't seem to pick
+    # this up: https://github.com/llvm/llvm-project/blob/c344d97a125b18f8fed0a64aace73c49a870e079/llvm/test/MC/ELF/cfi-version.ll#L7
+    rm test/MC/ELF/cfi-version.ll
+
+    # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
+    # and thus fails under the sandbox:
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
+   '' + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86) ''
+    # This test tries to call the intrinsics `@llvm.roundeven.f32` and
+    # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
+    # and `roundeven` on x86_64 macOS.
+    #
+    # However these functions are glibc specific so the test fails:
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundevenf.html
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundeven.html
+    #
+    # TODO(@rrbutani): this seems to run fine on `aarch64-darwin`, why does it
+    # pass there?
+    substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
+      --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
+      --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
+
+    # This test fails on darwin x86_64 because `sw_vers` reports a different
+    # macOS version than what LLVM finds by reading
+    # `/System/Library/CoreServices/SystemVersion.plist` (which is passed into
+    # the sandbox on macOS).
+    #
+    # The `sw_vers` provided by nixpkgs reports the macOS version associated
+    # with the `CoreFoundation` framework with which it was built. Because
+    # nixpkgs pins the SDK for `aarch64-darwin` and `x86_64-darwin` what
+    # `sw_vers` reports is not guaranteed to match the macOS version of the host
+    # that's building this derivation.
+    #
+    # Astute readers will note that we only _patch_ this test on aarch64-darwin
+    # (to use the nixpkgs provided `sw_vers`) instead of disabling it outright.
+    # So why does this test pass on aarch64?
+    #
+    # Well, it seems that `sw_vers` on aarch64 actually links against the _host_
+    # CoreFoundation framework instead of the nixpkgs provided one.
+    #
+    # Not entirely sure what the right fix is here. I'm assuming aarch64
+    # `sw_vers` doesn't intentionally link against the host `CoreFoundation`
+    # (still digging into how this ends up happening, will follow up) but that
+    # aside I think the more pertinent question is: should we be patching LLVM's
+    # macOS version detection logic to use `sw_vers` instead of reading host
+    # paths? This *is* a way in which details about builder machines can creep
+    # into the artifacts that are produced, affecting reproducibility, but it's
+    # not clear to me when/where/for what this even gets used in LLVM.
+    #
+    # TODO(@rrbutani): fix/follow-up
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
+
+    # This test fails with a `dysmutil` crash; have not yet dug into what's
+    # going on here (TODO(@rrbutani)).
+    rm test/tools/dsymutil/ARM/obfuscated.test
+    '' + ''
    # FileSystem permissions tests fail with various special bits
    substituteInPlace unittests/Support/CMakeLists.txt \
      --replace "Path.cpp" ""
@ -134,12 +241,6 @@ in stdenv.mkDerivation (rec {
    )
  '';

-  # hacky fix: created binaries need to be run before installation
-  preBuild = ''
-    mkdir -p $out/
-    ln -sv $PWD/lib $out
-  '';
-
  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";

@ -216,14 +317,6 @@ in stdenv.mkDerivation (rec {
    )
  ];

-  postBuild = ''
-    rm -fR $out
-  '';
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
-  '';
-
  postInstall = ''
    mkdir -p $python/share
    mv $out/share/opt-viewer $python/share/opt-viewer
--- a/pkgs/development/compilers/llvm/git/llvm/lit-shell-script-runner-set-dyld-library-path.patch
+++ b/pkgs/development/compilers/llvm/git/llvm/lit-shell-script-runner-set-dyld-library-path.patch
@ -0,0 +1,26 @@
+diff --git a/utils/lit/lit/TestRunner.py b/utils/lit/lit/TestRunner.py
+index 0242e0b75af3..d732011306f7 100644
+--- a/utils/lit/lit/TestRunner.py
+++ b/utils/lit/lit/TestRunner.py
+@@ -1029,6 +1029,12 @@ def executeScript(test, litConfig, tmpBase, commands, cwd):
+             f.write('@echo off\n')
+         f.write('\n@if %ERRORLEVEL% NEQ 0 EXIT\n'.join(commands))
+     else:
+        # This env var is *purged* when invoking subprocesses so we have to
+        # manually set it from within the bash script in order for the commands
+        # in run lines to see this var:
+        if "DYLD_LIBRARY_PATH" in test.config.environment:
+            f.write(f'export DYLD_LIBRARY_PATH="{test.config.environment["DYLD_LIBRARY_PATH"]}"\n')
+
+         for i, ln in enumerate(commands):
+             match = re.match(kPdbgRegex, ln)
+             if match:
+@@ -1363,7 +1369,7 @@ def applySubstitutions(script, substitutions, conditions={},
+         return processed
+ 
+     process = processLine if recursion_limit is None else processLineToFixedPoint
+-    
+
+     return [unescapePercents(process(ln)) for ln in script]
+ 
+ 
--- a/pkgs/development/compilers/llvm/git/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
+++ b/pkgs/development/compilers/llvm/git/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
@ -0,0 +1,79 @@
+diff --git a/test/Unit/lit.cfg.py b/test/Unit/lit.cfg.py
+index 81e8dc04acea..479ff95681e2 100644
+--- a/test/Unit/lit.cfg.py
+++ b/test/Unit/lit.cfg.py
+@@ -3,6 +3,7 @@
+ # Configuration file for the 'lit' test runner.
+ 
+ import os
+import platform
+ import subprocess
+ 
+ import lit.formats
+@@ -55,3 +56,26 @@ if sys.platform in ['win32', 'cygwin'] and os.path.isdir(config.shlibdir):
+ # Win32 may use %SYSTEMDRIVE% during file system shell operations, so propogate.
+ if sys.platform == 'win32' and 'SYSTEMDRIVE' in os.environ:
+     config.environment['SYSTEMDRIVE'] = os.environ['SYSTEMDRIVE']
+
+# Add the LLVM dynamic libs to the platform-specific loader search path env var:
+#
+# TODO: this is copied from `clang`'s `lit.cfg.py`; should unify..
+def find_shlibpath_var():
+    if platform.system() in ['Linux', 'FreeBSD', 'NetBSD', 'OpenBSD', 'SunOS']:
+        yield 'LD_LIBRARY_PATH'
+    elif platform.system() == 'Darwin':
+        yield 'DYLD_LIBRARY_PATH'
+    elif platform.system() == 'Windows':
+        yield 'PATH'
+    elif platform.system() == 'AIX':
+        yield 'LIBPATH'
+
+for shlibpath_var in find_shlibpath_var():
+    shlibpath = os.path.pathsep.join(
+        (config.shlibdir,
+         config.environment.get(shlibpath_var, '')))
+    config.environment[shlibpath_var] = shlibpath
+    break
+else:
+    lit_config.warning("unable to inject shared library path on '{}'"
+                       .format(platform.system()))
+diff --git a/test/lit.cfg.py b/test/lit.cfg.py
+index 75a38b4c5dad..856fc75c9d74 100644
+--- a/test/lit.cfg.py
+++ b/test/lit.cfg.py
+@@ -42,6 +42,26 @@ llvm_config.with_environment('PATH', config.llvm_tools_dir, append_path=True)
+ llvm_config.with_system_environment(
+     ['HOME', 'INCLUDE', 'LIB', 'TMP', 'TEMP'])
+ 
+# Add the LLVM dynamic libs to the platform-specific loader search path env var:
+#
+# TODO: this is copied from `clang`'s `lit.cfg.py`; should unify..
+def find_shlibpath_var():
+    if platform.system() in ['Linux', 'FreeBSD', 'NetBSD', 'OpenBSD', 'SunOS']:
+        yield 'LD_LIBRARY_PATH'
+    elif platform.system() == 'Darwin':
+        yield 'DYLD_LIBRARY_PATH'
+    elif platform.system() == 'Windows':
+        yield 'PATH'
+    elif platform.system() == 'AIX':
+        yield 'LIBPATH'
+
+for shlibpath_var in find_shlibpath_var():
+    shlibpath = config.llvm_shlib_dir
+    llvm_config.with_environment(shlibpath_var, shlibpath, append_path = True)
+    break
+else:
+    lit_config.warning("unable to inject shared library path on '{}'"
+                       .format(platform.system()))
+ 
+ # Set up OCAMLPATH to include newly built OCaml libraries.
+ top_ocaml_lib = os.path.join(config.llvm_lib_dir, 'ocaml')
+@@ -318,7 +338,7 @@ def have_cxx_shared_library():
+ 
+     try:
+         readobj_cmd = subprocess.Popen(
+-            [readobj_exe, '--needed-libs', readobj_exe], stdout=subprocess.PIPE)
+            [readobj_exe, '--needed-libs', readobj_exe], stdout=subprocess.PIPE, env=config.environment)
+     except OSError:
+         print('could not exec llvm-readobj')
+         return False
--- a/pkgs/development/compilers/llvm/git/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
+++ b/pkgs/development/compilers/llvm/git/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
@ -0,0 +1,24 @@
+diff --git a/tools/polly/test/lit.cfg b/tools/polly/test/lit.cfg
+index 41e3a589c61e..09f3b17498b0 100644
+--- a/tools/polly/test/lit.cfg
+++ b/tools/polly/test/lit.cfg
+@@ -36,9 +36,17 @@ base_paths = [config.llvm_tools_dir, config.environment['PATH']]
+ path = os.path.pathsep.join(base_paths + config.extra_paths)
+ config.environment['PATH'] = path
+ 
+# (Copied from polly/test/Unit/lit.cfg)
+if platform.system() == 'Darwin':
+    shlibpath_var = 'DYLD_LIBRARY_PATH'
+elif platform.system() == 'Windows':
+    shlibpath_var = 'PATH'
+else:
+    shlibpath_var = 'LD_LIBRARY_PATH'
+
+ path = os.path.pathsep.join((config.llvm_libs_dir,
+-                              config.environment.get('LD_LIBRARY_PATH','')))
+-config.environment['LD_LIBRARY_PATH'] = path
+                              config.environment.get(shlibpath_var,'')))
+config.environment[shlibpath_var] = path
+ 
+ llvm_config.use_default_substitutions()
+ 
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@ -3,7 +3,7 @@

 { lib, callPackage, buildPackages, stdenv, fetchurl, fetchgit, fetchFromGitHub
 , makeWrapper, openssl, pcre, readline, boehmgc, sqlite, nim-unwrapped
-, nimble-unwrapped }:
+, nimble-unwrapped, Security }:

 let
  parseCpu = platform:
@ -94,7 +94,8 @@ in {
      hash = "sha256-rO8LCrdzYE1Nc5S2hRntt0+zD0aRIpSyi8J+DHtLTcI=";
    };

-    buildInputs = [ boehmgc openssl pcre readline sqlite ];
+    buildInputs = [ boehmgc openssl pcre readline sqlite ]
+      ++ lib.optional stdenv.isDarwin Security;

    patches = [
      ./NIM_CONFIG_DIR.patch
--- a/pkgs/development/interpreters/gtk-server/default.nix
+++ b/pkgs/development/interpreters/gtk-server/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "gtk-server";
-  version = "2.4.5";
+  version = "2.4.6";

  src = fetchurl {
    url = "https://www.gtk-server.org/stable/gtk-server-${version}.tar.gz";
-    sha256 = "0vlx5ibvc7hyc8yipjgvrx1azvmh42i9fv1khg3dvn09nrdkrc7f";
+    sha256 = "sha256-sFL3y068oXDKgkEUcNnGVsNSPBdI1NzpsqdYJfmOQoA=";
  };

  preConfigure = ''
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@ -15,7 +15,7 @@
 , portaudio
 , libX11
 , graphicsmagick
-, pcre
+, pcre2
 , pkg-config
 , libGL
 , libGLU
@ -112,12 +112,12 @@ let
  };

  self = mkDerivation rec {
-    version = "7.3.0";
+    version = "8.1.0";
    pname = "octave";

    src = fetchurl {
      url = "mirror://gnu/octave/${pname}-${version}.tar.gz";
-      sha256 = "sha256-bhSkZJ1wr0WrZg+Mu/ZFqvHsM/JfiL/aRpfLF+RAxPU=";
+      sha256 = "sha256-gFIHTRew72Q9A33oqziWcsdSuyAe6c6k36aYWPtqIT8=";
    };

    buildInputs = [
@ -127,7 +127,7 @@ let
      flex
      qhull
      graphicsmagick
-      pcre
+      pcre2
      fltk
      zlib
      curl
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "armadillo";
-  version = "11.4.3";
+  version = "12.0.1";

  src = fetchurl {
    url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-h2AyY2ZJiK9B2iyk82IF426kepKB+mz9RjEV83l6HaI=";
+    sha256 = "sha256-IwpcddqtUtxH4a3Oj1pQ+apOQ1Tg8bsY6oTvoucOIN8=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/cogl/default.nix
+++ b/pkgs/development/libraries/cogl/default.nix
@ -41,11 +41,13 @@ stdenv.mkDerivation rec {
    (fetchpatch {
      url = "https://bug787443.bugzilla-attachments.gnome.org/attachment.cgi?id=359589";
      sha256 = "0f0d9iddg8zwy853phh7swikg4yzhxxv71fcag36f8gis0j5p998";
+      decode = "xz -d";
    })

    (fetchpatch {
      url = "https://bug787443.bugzilla-attachments.gnome.org/attachment.cgi?id=361056";
      sha256 = "09fyrdci4727fg6qm5aaapsbv71sf4wgfaqz8jqlyy61dibgg490";
+      decode = "xz -d";
    })
  ];

--- a/pkgs/development/libraries/fbthrift/default.nix
+++ b/pkgs/development/libraries/fbthrift/default.nix
@ -22,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "fbthrift";
-  version = "2023.02.20.00";
+  version = "2023.03.20.00";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "fbthrift";
    rev = "v${version}";
-    sha256 = "sha256-MnF2JS+5kvcA6nymFWW7DTM5yWsnQR0U69lirG/CLDg=";
+    sha256 = "sha256-jCgdo7jE5QlRK5f2S6XEVM4+TPWI//4DKG/fDMFzgzg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@ -1,18 +1,17 @@
 { lib
-, stdenv
 , fetchurl
-, fetchpatch
-, cmake
+, stdenv
 , testers
+, cmake
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "geos";
-  version = "3.11.1";
+  version = "3.11.2";

  src = fetchurl {
    url = "https://download.osgeo.org/geos/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-bQ6zz6n5LZR3Mcx18XUDVrO9/AfqAgVT2vavHHaOC+I=";
+    hash = "sha256-sfB3ZpSBxaPmKv/EnpbrBvKBmHpdNv2rIlIX5bgl5Mw=";
  };

  nativeBuildInputs = [ cmake ];
--- a/Show more
+++ b/Show more