Merge staging-next into staging

2022-11-27 18:01:39 +00:00 · 2022-11-27 18:01:39 +00:00 · 38af11b9ce
commit 38af11b9ce
parent 1b2536c139 7bab2ce0db
112 changed files with 2017 additions and 1451 deletions
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@ -26,7 +26,7 @@ jobs:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Create backport PRs
-        uses: zeebe-io/backport-action@v0.0.8
+        uses: zeebe-io/backport-action@v0.0.9
        with:
          # Config README: https://github.com/zeebe-io/backport-action#backport-action
          github_token: ${{ secrets.GITHUB_TOKEN }}
--- a/nixos/modules/services/misc/pinnwand.nix
+++ b/nixos/modules/services/misc/pinnwand.nix
@ -19,29 +19,66 @@ in
    };

    settings = mkOption {
-      type = format.type;
+      default = {};
      description = lib.mdDoc ''
        Your {file}`pinnwand.toml` as a Nix attribute set. Look up
-        possible options in the [pinnwand.toml-example](https://github.com/supakeen/pinnwand/blob/master/pinnwand.toml-example).
+        possible options in the [documentation](https://pinnwand.readthedocs.io/en/v${pkgs.pinnwand.version}/configuration.html).
      '';
-      default = {};
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          database_uri = mkOption {
+            type = types.str;
+            default = "sqlite:////var/lib/pinnwand/pinnwand.db";
+            example = "sqlite:///:memory";
+            description = lib.mdDoc ''
+              Database URI compatible with [SQLAlchemyhttps://docs.sqlalchemy.org/en/14/core/engines.html#database-urls].
+
+              Additional packages may need to be introduced into the environment for certain databases.
+            '';
+          };
+
+          paste_size = mkOption {
+            type = types.ints.positive;
+            default = 262144;
+            example = 524288;
+            description = lib.mdDoc ''
+              Maximum size of a paste in bytes.
+            '';
+          };
+          paste_help = mkOption {
+            type = types.str;
+            default = ''
+              <p>Welcome to pinnwand, this site is a pastebin. It allows you to share code with others. If you write code in the text area below and press the paste button you will be given a link you can share with others so they can view your code as well.</p><p>People with the link can view your pasted code, only you can remove your paste and it expires automatically. Note that anyone could guess the URI to your paste so don't rely on it being private.</p>
+              '';
+            description = lib.mdDoc ''
+              Raw HTML help text shown in the header area.
+            '';
+          };
+          footer = mkOption {
+            type = types.str;
+            default = ''
+              View <a href="//github.com/supakeen/pinnwand" target="_BLANK">source code</a>, the <a href="/removal">removal</a> or <a href="/expiry">expiry</a> stories, or read the <a href="/about">about</a> page.
+            '';
+            description = lib.mdDoc ''
+              The footer in raw HTML.
+            '';
+          };
+        };
+      };
    };
  };

  config = mkIf cfg.enable {
-    services.pinnwand.settings = {
-      database_uri = mkDefault "sqlite:////var/lib/pinnwand/pinnwand.db";
-      paste_size = mkDefault 262144;
-      paste_help = mkDefault ''
-        <p>Welcome to pinnwand, this site is a pastebin. It allows you to share code with others. If you write code in the text area below and press the paste button you will be given a link you can share with others so they can view your code as well.</p><p>People with the link can view your pasted code, only you can remove your paste and it expires automatically. Note that anyone could guess the URI to your paste so don't rely on it being private.</p>
-      '';
-      footer = mkDefault ''
-        View <a href="//github.com/supakeen/pinnwand" target="_BLANK">source code</a>, the <a href="/removal">removal</a> or <a href="/expiry">expiry</a> stories, or read the <a href="/about">about</a> page.
-      '';
-    };
+    systemd.services.pinnwand = {
+      description = "Pinnwannd HTTP Server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];

-    systemd.services = let
-      hardeningOptions = {
+      unitConfig.Documentation = "https://pinnwand.readthedocs.io/en/latest/";
+
+      serviceConfig = {
+        ExecStart = "${pkgs.pinnwand}/bin/pinnwand --configuration-path ${configFile} http --port ${toString cfg.port}";
        User = "pinnwand";
        DynamicUser = true;

@ -72,32 +109,14 @@ in
        RestrictNamespaces = true;
        RestrictRealtime = true;
        SystemCallArchitectures = "native";
-        SystemCallFilter = "@system-service";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
        UMask = "0077";
      };
-
-      command = "${pkgs.pinnwand}/bin/pinnwand --configuration-path ${configFile}";
-    in {
-      pinnwand = {
-        description = "Pinnwannd HTTP Server";
-        after = [ "network.target" ];
-        wantedBy = [ "multi-user.target" ];
-
-        unitConfig.Documentation = "https://pinnwand.readthedocs.io/en/latest/";
-
-        serviceConfig = {
-          ExecStart = "${command} http --port ${toString(cfg.port)}";
-        } // hardeningOptions;
-      };
-
-      pinnwand-reaper = {
-        description = "Pinnwand Reaper";
-        startAt = "daily";
-
-        serviceConfig = {
-          ExecStart = "${command} -vvvv reap";  # verbosity increased to show number of deleted pastes
-        } // hardeningOptions;
-      };
    };
  };
+
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -192,6 +192,14 @@ let

      server_tokens ${if cfg.serverTokens then "on" else "off"};

+      ${optionalString (cfg.proxyCache.enable) ''
+        proxy_cache_path /var/cache/nginx keys_zone=${cfg.proxyCache.keysZoneName}:${cfg.proxyCache.keysZoneSize}
+                                          levels=${cfg.proxyCache.levels}
+                                          use_temp_path=${if cfg.proxyCache.useTempPath then "on" else "off"}
+                                          inactive=${cfg.proxyCache.inactive}
+                                          max_size=${cfg.proxyCache.maxSize};
+      ''}
+
      ${cfg.commonHttpConfig}

      ${vhosts}
@ -707,6 +715,72 @@ in
          '';
      };

+      proxyCache = mkOption {
+        type = types.submodule {
+          options = {
+            enable = mkEnableOption (lib.mdDoc "Enable proxy cache");
+
+            keysZoneName = mkOption {
+              type = types.str;
+              default = "cache";
+              example = "my_cache";
+              description = lib.mdDoc "Set name to shared memory zone.";
+            };
+
+            keysZoneSize = mkOption {
+              type = types.str;
+              default = "10m";
+              example = "32m";
+              description = lib.mdDoc "Set size to shared memory zone.";
+            };
+
+            levels = mkOption {
+              type = types.str;
+              default = "1:2";
+              example = "1:2:2";
+              description = lib.mdDoc ''
+                The levels parameter defines structure of subdirectories in cache: from
+                1 to 3, each level accepts values 1 or 2. Сan be used any combination of
+                1 and 2 in these formats: x, x:x and x:x:x.
+              '';
+            };
+
+            useTempPath = mkOption {
+              type = types.bool;
+              default = false;
+              example = true;
+              description = lib.mdDoc ''
+                Nginx first writes files that are destined for the cache to a temporary
+                storage area, and the use_temp_path=off directive instructs Nginx to
+                write them to the same directories where they will be cached. Recommended
+                that you set this parameter to off to avoid unnecessary copying of data
+                between file systems.
+              '';
+            };
+
+            inactive = mkOption {
+              type = types.str;
+              default = "10m";
+              example = "1d";
+              description = lib.mdDoc ''
+                Cached data that has not been accessed for the time specified by
+                the inactive parameter is removed from the cache, regardless of
+                its freshness.
+              '';
+            };
+
+            maxSize = mkOption {
+              type = types.str;
+              default = "1g";
+              example = "2048m";
+              description = lib.mdDoc "Set maximum cache size";
+            };
+          };
+        };
+        default = {};
+        description = lib.mdDoc "Configure proxy cache";
+      };
+
      resolver = mkOption {
        type = types.submodule {
          options = {
--- a/nixos/tests/pinnwand.nix
+++ b/nixos/tests/pinnwand.nix
@ -1,27 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ...}:
 let
-  pythonEnv = pkgs.python3.withPackages (py: with py; [ appdirs toml ]);
-
  port = 8000;
  baseUrl = "http://server:${toString port}";
-
-  configureSteck = pkgs.writeScript "configure.py" ''
-    #!${pythonEnv.interpreter}
-    import appdirs
-    import toml
-    import os
-
-    CONFIG = {
-      "base": "${baseUrl}/",
-      "confirm": False,
-      "magic": True,
-      "ignore": True
-    }
-
-    os.makedirs(appdirs.user_config_dir('steck'))
-    with open(os.path.join(appdirs.user_config_dir('steck'), 'steck.toml'), "w") as fd:
-        toml.dump(CONFIG, fd)
-    '';
 in
 {
  name = "pinnwand";
@ -44,7 +24,32 @@ in

    client = { pkgs, ... }:
    {
-      environment.systemPackages = [ pkgs.steck ];
+      environment.systemPackages = [
+        pkgs.steck
+
+        (pkgs.writers.writePython3Bin "setup-steck.py" {
+          libraries = with pkgs.python3.pkgs; [ appdirs toml ];
+          flakeIgnore = [
+            "E501"
+          ];
+        }
+        ''
+          import appdirs
+          import toml
+          import os
+
+          CONFIG = {
+              "base": "${baseUrl}/",
+              "confirm": False,
+              "magic": True,
+              "ignore": True
+          }
+
+          os.makedirs(appdirs.user_config_dir('steck'))
+          with open(os.path.join(appdirs.user_config_dir('steck'), 'steck.toml'), "w") as fd:
+              toml.dump(CONFIG, fd)
+        '')
+      ];
    };
  };

@ -55,7 +60,7 @@ in
    client.wait_for_unit("network.target")

    # create steck.toml config file
-    client.succeed("${configureSteck}")
+    client.succeed("setup-steck.py")

    # wait until the server running pinnwand is reachable
    client.wait_until_succeeds("ping -c1 server")
@ -75,12 +80,6 @@ in
        if line.startswith("Removal link:"):
            removal_link = line.split(":", 1)[1]

-
-    # start the reaper, it shouldn't do anything meaningful here
-    server.systemctl("start pinnwand-reaper.service")
-    server.wait_until_fails("systemctl is-active -q pinnwand-reaper.service")
-    server.log(server.execute("journalctl -u pinnwand-reaper -e --no-pager")[1])
-
    # check whether paste matches what we sent
    client.succeed(f"curl {raw_url} > /tmp/machine-id")
    client.succeed("diff /tmp/machine-id /etc/machine-id")
@ -89,6 +88,6 @@ in
    client.succeed(f"curl {removal_link}")
    client.fail(f"curl --fail {raw_url}")

-    server.log(server.succeed("systemd-analyze security pinnwand"))
+    server.log(server.execute("systemd-analyze security pinnwand | grep '✗'")[1])
  '';
 })
--- a/nixos/tests/stratis/encryption.nix
+++ b/nixos/tests/stratis/encryption.nix
@ -26,8 +26,7 @@ import ../make-test-python.nix ({ pkgs, ... }:
        # test rebinding encrypted pool
        machine.succeed("stratis pool rebind keyring  testpool testkey2")
        # test restarting encrypted pool
-        uuid = machine.succeed("stratis pool list | grep -oE '[0-9a-fA-F-]{36}'").rstrip('\n')
-        machine.succeed(" stratis pool stop   testpool")
-        machine.succeed(f"stratis pool start  {uuid}   --unlock-method keyring")
+        machine.succeed("stratis pool stop   testpool")
+        machine.succeed("stratis pool start  --name testpool --unlock-method keyring")
      '';
  })
--- a/nixos/tests/vector.nix
+++ b/nixos/tests/vector.nix
@ -21,7 +21,7 @@ with pkgs.lib;
              type = "file";
              inputs = [ "journald" ];
              path = "/var/lib/vector/logs.log";
-              encoding = { codec = "ndjson"; };
+              encoding = { codec = "json"; };
            };
          };
        };
--- a/pkgs/applications/audio/netease-music-tui/cargo-lock.patch
+++ b/pkgs/applications/audio/netease-music-tui/cargo-lock.patch
--- a/pkgs/applications/audio/netease-music-tui/default.nix
+++ b/pkgs/applications/audio/netease-music-tui/default.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "netease-music-tui";
-  version = "0.1.4";
+  version = "0.1.5";

  src = fetchFromGitHub {
    owner = "betta-cyber";
    repo = "netease-music-tui";
    rev = "v${version}";
-    sha256 = "sha256-ILJkejRKG2DRXgR6O2tAFbrbd8HtnLZJmITq7hF41DQ=";
+    sha256 = "sha256-+zRXihWg65DtyX3yD04CsW8aXIvNph36PW2veeg36lg=";
  };

  cargoPatches = [ ./cargo-lock.patch ];
@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ alsa-lib openssl ];

-  cargoSha256 = "sha256-/JQDUtSSkuO9nrYVSkQOaZjps1BUuH8Bc1SMyDSSJS4=";
+  cargoSha256 = "sha256-i+W/KwnqdaHcrdaWYUuCUeFlRKekVuEvFh/pxDolPNU=";

  meta = with lib; {
    homepage = "https://github.com/betta-cyber/netease-music-tui";
--- a/pkgs/applications/audio/pyradio/default.nix
+++ b/pkgs/applications/audio/pyradio/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyradio";
-  version = "0.8.9.28";
+  version = "0.8.9.31";

  src = fetchFromGitHub {
    owner = "coderholic";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-0j0AQZk+WEkcRTL/peAxzRw23gThlGtMnqoms2aUCrc=";
+    sha256 = "sha256-9Fc42f0plduihXDDLXWBdt62maxDJ0cwumIvbiMcrGc=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/audio/tauon/default.nix
+++ b/pkgs/applications/audio/tauon/default.nix
@ -25,13 +25,13 @@

 stdenv.mkDerivation rec {
  pname = "tauon";
-  version = "7.4.3";
+  version = "7.4.5";

  src = fetchFromGitHub {
    owner = "Taiko2k";
    repo = "TauonMusicBox";
    rev = "v${version}";
-    sha256 = "sha256-eB4fwW5UvylVslSEvDFdCVYcEK3M2H+8VJGHH13vvA0=";
+    sha256 = "sha256-fxmCLjnYO7ZblEiRoByxuFzw9xFHqbQvne1WNcFnnwI=";
  };

  postUnpack = ''
@ -131,6 +131,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "The Linux desktop music player from the future";
    homepage = "https://tauonmusicbox.rocks/";
+    changelog = "https://github.com/Taiko2k/TauonMusicBox/releases/tag/v${version}";
    license = licenses.gpl3;
    maintainers = with maintainers; [ jansol ];
    platforms = platforms.linux;
--- a/pkgs/applications/backup/ludusavi/default.nix
+++ b/pkgs/applications/backup/ludusavi/default.nix
@ -13,7 +13,7 @@
 , libXrandr
 , libXi
 , gnome
-, kdialog
+, libsForQt5
 }:

 rustPlatform.buildRustPackage rec {
@ -71,7 +71,7 @@ rustPlatform.buildRustPackage rec {
    in
    ''
      patchelf --set-rpath "${libPath}" "$out/bin/$pname"
-      wrapProgram $out/bin/$pname --prefix PATH : ${lib.makeBinPath [ gnome.zenity kdialog ]}
+      wrapProgram $out/bin/$pname --prefix PATH : ${lib.makeBinPath [ gnome.zenity libsForQt5.kdialog ]}
    '';


--- a/pkgs/applications/blockchains/dogecoin/default.nix
+++ b/pkgs/applications/blockchains/dogecoin/default.nix
@ -2,7 +2,7 @@
 , pkg-config, autoreconfHook
 , db5, openssl, boost, zlib, miniupnpc, libevent
 , protobuf, qtbase ? null
-, wrapQtAppsHook ? null, qttools, qmake ? null, qrencode
+, wrapQtAppsHook ? null, qttools ? null, qmake ? null, qrencode
 , withGui, withUpnp ? true, withUtils ? true, withWallet ? true
 , withZmq ? true, zeromq, util-linux ? null, Cocoa ? null }:

--- a/pkgs/applications/graphics/exrdisplay/default.nix
+++ b/pkgs/applications/graphics/exrdisplay/default.nix
@ -1,29 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config, fltk, openexr, libGLU, libGL, ctl }:
-
-stdenv.mkDerivation rec {
-  pname = "openexr_viewers";
-  version = "2.2.1";
-
-  src = fetchurl {
-    url = "mirror://savannah/openexr/openexr_viewers-${version}.tar.gz";
-    sha256 = "1ixx2wbjp4rvsf7h3bkja010gl1ihjrcjzy7h20jnn47ikg12vj8";
-  };
-
-  configurePhase = ''
-    ./configure --prefix=$out --with-fltk-config=${fltk}/bin/fltk-config
-  '';
-
-  buildPhase = ''
-    make LDFLAGS="`fltk-config --ldflags` -lGL -lfltk_gl"
-  '';
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openexr fltk libGLU libGL ctl ];
-
-  meta = {
-    description = "Application for viewing OpenEXR images on a display at various exposure settings";
-    homepage = "http://openexr.com";
-    platforms = lib.platforms.linux;
-    license = lib.licenses.bsd3;
-  };
-}
--- a/pkgs/applications/graphics/screencloud/default.nix
+++ b/pkgs/applications/graphics/screencloud/default.nix
@ -1,76 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, cmake, qt4, quazip, qt-mobility, qxt, python2Packages }:
-
-with lib;
-stdenv.mkDerivation rec {
-  pname = "screencloud";
-  version = "1.2.0";
-
-  # API Keys. According to the author of the AUR package, these are only used
-  # for tracking usage.
-  consumerKey = "23e747012c68601f27ab69c6de129ed70552d55b6";
-  consumerSecret = "4701cb00c1bd357bbcae7c3d713dd216";
-
-  src = fetchFromGitHub {
-    owner = "olav-st";
-    repo = "screencloud";
-    rev = "v${version}";
-    sha256 = "1s0dxa1sa37nvna5nfqdsp294810favj68qb7ghl78qna7zw0cim";
-  };
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ qt4 quazip qt-mobility qxt python2Packages.python python2Packages.pycrypto ];
-
-  patchPhase = ''
-    # Required to make the configure script work. Normally, screencloud's
-    # CMakeLists file sets the install prefix to /opt by force. This is stupid
-    # and breaks nix, so we force it to install where we want. Please don't
-    # write CMakeLists files like this, as things like this are why we can't
-    # have nice things.
-    substituteInPlace "CMakeLists.txt" --replace "set(CMAKE_INSTALL_PREFIX \"/opt\")" ""
-  '';
-
-  # We need to append /opt to our CMAKE_INSTALL_PREFIX, so we tell the Nix not
-  # to add the argument for us.
-  dontAddPrefix = true;
-
-  cmakeFlags = [
-    "-DQXT_QXTCORE_INCLUDE_DIR=${qxt}/include/QxtCore"
-    "-DQXT_QXTCORE_LIB_RELEASE=${qxt}/lib/libQxtCore.so"
-    "-DQXT_QXTGUI_INCLUDE_DIR=${qxt}/include/QxtGui"
-    "-DQXT_QXTGUI_LIB_RELEASE=${qxt}/lib/libQxtGui.so"
-    "-DCONSUMER_KEY_SCREENCLOUD=${consumerKey}"
-    "-DCONSUMER_SECRET_SCREENCLOUD=${consumerSecret}"
-  ];
-
-  setSourceRoot = ''
-    sourceRoot=$(echo */screencloud)
-  '';
-
-  preConfigure = ''
-    # This needs to be set in preConfigure instead of cmakeFlags in order to
-    # access the $prefix environment variable.
-    export cmakeFlags="-DCMAKE_INSTALL_PREFIX=$prefix/opt $cmakeFlags"
-  '';
-
-  # There are a number of issues with screencloud's installation. We need to add
-  # pycrypto to the PYTHONPATH so that the SFTP plugin will work properly; and
-  # we need to move the libPythonQt library into a folder where it can actually
-  # be found.
-  postInstall = ''
-    patchShebangs $prefix/opt/screencloud/screencloud.sh
-    substituteInPlace "$prefix/opt/screencloud/screencloud.sh" --replace "/opt" "$prefix/opt"
-    sed -i "2 i\export PYTHONPATH=$(toPythonPath ${python2Packages.pycrypto}):\$PYTHONPATH" "$prefix/opt/screencloud/screencloud.sh"
-    mkdir $prefix/bin
-    mkdir $prefix/lib
-    ln -s $prefix/opt/screencloud/screencloud.sh $prefix/bin/screencloud
-    ln -s $prefix/opt/screencloud/libPythonQt.so $prefix/lib/libPythonQt.so
-  '';
-
-  meta = {
-    homepage = "https://screencloud.net/";
-    description = "Client for Screencloud, an easy to use screenshot sharing tool";
-    license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ forkk ];
-    platforms = with lib.platforms; linux;
-  };
-}
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.106.0";
+  version = "0.107.0";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Dyre/ou0kjEqbq8WGGM/n8+JBTMNslbnmj+5clYJUHs=";
+    sha256 = "sha256-8Ru1T6GSz5TfMxFvUU2QgpiWNLJK+ky723qc3flrDIw=";
  };

-  vendorSha256 = "sha256-dhsGGu4uNrqKv6szGqruAcI2UTbbXknKaKk5pVCQB5A=";
+  vendorSha256 = "sha256-92QLkSUrwMEZ/8pIeOj4KKtC47oN+ITxJnpp7Fb0Z10=";

  doCheck = false;

--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.14.2";
+  version = "2.14.3";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-dcLzD+dzQ6Uj4XlXT4bKFniS/ZB9MBrqxEzM6SwnPes=";
+    sha256 = "sha256-7bCl8VfkMhoTBnr+O+oBYQeSV2sRwlP/qUkNkYerZdU=";
  };

  vendorSha256 = "sha256-E2Q+mXojMb8E0zSnaCOl9xp5QLeYcuTXjhcp3Hc8gH4=";
--- a/pkgs/applications/misc/tippecanoe/default.nix
+++ b/pkgs/applications/misc/tippecanoe/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tippecanoe";
-  version = "2.13.0";
+  version = "2.13.1";

  src = fetchFromGitHub {
    owner = "felt";
    repo = "tippecanoe";
    rev = finalAttrs.version;
-    hash = "sha256-YgmePs0GxygR0hvcnRngzW77QZTOygSYvRaYk6oCVls=";
+    hash = "sha256-cDNaZ3ZYCUWg30Td1hlzzaB46tI7cFZLvgwCAZN72QI=";
  };

  buildInputs = [ sqlite zlib ];
--- a/pkgs/applications/misc/tty-share/default.nix
+++ b/pkgs/applications/misc/tty-share/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "tty-share";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "elisescu";
    repo = "tty-share";
    rev = "v${version}";
-    sha256 = "sha256-/oK2m2kxmF9HHYfTK6NlZxKKkDS7Oay+ed7jR/+szs0=";
+    sha256 = "sha256-7rNSBpiZslUGWw0P/Q1zRtNxo9MN8Vq6hG8pD6bJIsA=";
  };

  # Upstream has a `./vendor` directory with all deps which we rely upon.
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "tektoncd-cli";
-  version = "0.27.0";
+  version = "0.28.0";

  src = fetchFromGitHub {
    owner = "tektoncd";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-zLPZueKdUNauIzqXOV773SZ/RWg7UuMNeJHr7z6ZJ+E=";
+    sha256 = "sha256-8OW0n6aS7bDDbzbrMfJLL8Yvq3vJg47qHQB4zY0xxAw=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.40.2";
+  version = "0.41.0";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-wNedd6C4NPLPw8CA1tyKx2MWsKatFbN4xt3Us2SC/ME=";
+    sha256 = "sha256-1if7Z+4Lr5eevf1NUJn//pcVU3Ts/FznDd/604aJO/c=";
  };

  vendorSha256 = "sha256-Qc0FnNxyErtieVvEj/eKPW5PpvYFwiYtv+ReJTVFAPA=";
--- a/pkgs/applications/networking/diswall/default.nix
+++ b/pkgs/applications/networking/diswall/default.nix
@ -0,0 +1,33 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "diswall";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "dis-works";
+    repo = "diswall-rs";
+    rev = "v${version}";
+    sha256 = "sha256-zT8RRg+Ver7dYtJL9htrZ8nXoD0V7IvdIqHTKDmbZ7c=";
+  };
+
+  cargoSha256 = "sha256-N+w1OiCy3scahFdYI49GpL301t1qNd/X4fdLMoQE/2s=";
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Distributed firewall";
+    longDescription = ''
+      Diswall (distributed firewall) - a client of distributed firewall
+      working on many servers and using NATS for the transport level.
+      Its purpose - blocking IPs with a blink of the eye on all servers
+      in any infrastructure when some IP checks any of the closed ports
+      of anyone of these servers. Therefore, diswall provides good
+      protection of whole infrastructure (as anti-shodan) preventing
+      intruder to get any system information.
+    '';
+    homepage = "https://www.diswall.stream";
+    license = with licenses; [ gpl3 ];
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
--- a/pkgs/applications/science/misc/graphia/default.nix
+++ b/pkgs/applications/science/misc/graphia/default.nix
@ -2,6 +2,7 @@
 , lib
 , cmake
 , fetchFromGitHub
+, fetchpatch
 , wrapQtAppsHook
 , qtbase
 , qtquickcontrols2
@ -10,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "graphia";
-  version = "3.1";
+  version = "3.2";

  src = fetchFromGitHub {
    owner = "graphia-app";
    repo = "graphia";
    rev = version;
-    sha256 = "sha256-mqoK5y2h0JSiE9VtwawCgc1+qETzuefLVUpgFPcNFnk=";
+    sha256 = "sha256-9kohXLXF4F/qoHm8qmvPM1y9ak0Thb4xvgKJlVuOPTg=";
  };

  patches = [
@ -24,6 +25,12 @@ stdenv.mkDerivation rec {
    # https://github.com/pytorch/pytorch/issues/70297
    # https://github.com/google/breakpad/commit/605c51ed96ad44b34c457bbca320e74e194c317e
    ./breakpad-sigstksz.patch
+
+    # FIXME: backport patch fixing build with Qt 5.15, remove for next release
+    (fetchpatch {
+      url = "https://github.com/graphia-app/graphia/commit/4b51bb8d465afa7ed0b2b30cb1c5e1c6af95976f.patch";
+      hash = "sha256-GDJAFLxQlRWKvcOgqqPYV/aVTRM7+KDjW7Zp9l7SuyM=";
+    })
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/version-management/fnc/default.nix
+++ b/pkgs/applications/version-management/fnc/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "fnc";
-  version = "0.12";
+  version = "0.13";

  src = fetchurl {
    url = "https://fnc.bsdbox.org/tarball/${version}/fnc-${version}.tar.gz";
-    sha256 = "05cg8id4d1ia8y60y3x23167bl1rn2fdpkf1jfj3aklhlihvkbxd";
+    sha256 = "126aklsjfqmrj0f9p1g6sdlqhwnbfhyn0lq2c9pidfnhppa7sz95";
  };

  buildInputs = [ libiconv ncurses zlib ];
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "lefthook";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "evilmartians";
    repo = "lefthook";
-    sha256 = "sha256-ZMqqiPSNNJw9t3p5h/GUHa9cvl9LcJ4u0HMf1ag8qCc=";
+    sha256 = "sha256-66exuMb0dUQWRhcDUU7mAJ06yD/acKX96KIQwMEU6xM=";
  };

  vendorSha256 = "sha256-NTZz0EDIjGdh8dD9jxbNVdWb7NFJsdtnMp7H6Ni0EbQ=";
--- a/pkgs/applications/version-management/gitoxide/default.nix
+++ b/pkgs/applications/version-management/gitoxide/default.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitoxide";
-  version = "0.18.0";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "Byron";
    repo = "gitoxide";
    rev = "v${version}";
-    sha256 = "sha256-VB7v51YW4aA5WHVD5ZWFzv9hQskjQeqMzm+pQ9glODg=";
+    sha256 = "sha256-GGXujTn5Xb63vKIycj5o9+PCsMN1Kp3RCSg1wiM31qA=";
  };

-  cargoSha256 = "sha256-uII6o/cJktpUFxROuu11dNSXx0p6phVVqszmbYK9Rd0=";
+  cargoSha256 = "sha256-MAZhrd9CtFOIAaUUbXplBo+eo6Zaws2LIRkPoX4HztE=";

  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = if stdenv.isDarwin
--- a/pkgs/applications/video/mythtv/default.nix
+++ b/pkgs/applications/video/mythtv/default.nix
@ -1,32 +1,41 @@
-{ lib, mkDerivation, fetchFromGitHub, which, qtbase, qtwebkit, qtscript, xlibsWrapper
+{ lib, mkDerivation, fetchFromGitHub, fetchpatch, which, qtbase, qtwebkit, qtscript, xlibsWrapper
 , libpulseaudio, fftwSinglePrec , lame, zlib, libGLU, libGL, alsa-lib, freetype
 , perl, pkg-config , libsamplerate, libbluray, lzo, libX11, libXv, libXrandr, libXvMC, libXinerama, libXxf86vm
-, libXmu , yasm, libuuid, taglib, libtool, autoconf, automake, file, exiv2, linuxHeaders
+, libXmu , yasm, libuuid, taglib, libtool, autoconf, automake, file, exiv2, linuxHeaders, soundtouch, libzip
+, withWebKit ? false
 }:

 mkDerivation rec {
  pname = "mythtv";
-  version = "31.0";
+  version = "32.0";

  src = fetchFromGitHub {
    owner = "MythTV";
    repo = "mythtv";
    rev = "v${version}";
-    sha256 = "092w5kvc1gjz6jd2lk2jhcazasz2h3xh0i5iq80k8x3znyp4i6v5";
+    sha256 = "0i4fs3rbk1jggh62wflpa2l03na9i1ihpz2vsdic9vfahqqjxff1";
  };

  patches = [
-    # Disables OS detection used while checking if enforce_wshadow should be disabled.
-    ./disable-os-detection.patch
+    # Disable sourcing /etc/os-release
+    ./dont-source-os-release.patch
+
+    # Fix QMake variable substitution syntax - MythTV/mythtv#550
+    (fetchpatch {
+      name = "fix-qmake-var-syntax.patch";
+      url = "https://github.com/MythTV/mythtv/commit/a8da7f7e7ec069164adbef65a8104adc9bb52e36.patch";
+      stripLen = 1;
+      hash = "sha256-JfRME00YNNjl6SKs1HBa0wBa/lR/Rt3zbQtWhsC36JM=";
+    })
  ];

  setSourceRoot = "sourceRoot=$(echo */mythtv)";

  buildInputs = [
-    freetype qtbase qtwebkit qtscript lame zlib xlibsWrapper libGLU libGL
+    freetype qtbase qtscript lame zlib xlibsWrapper libGLU libGL
    perl libsamplerate libbluray lzo alsa-lib libpulseaudio fftwSinglePrec libX11 libXv libXrandr libXvMC
-    libXmu libXinerama libXxf86vm libXmu libuuid taglib exiv2
-  ];
+    libXmu libXinerama libXxf86vm libXmu libuuid taglib exiv2 soundtouch libzip
+  ] ++ lib.optional withWebKit qtwebkit;
  nativeBuildInputs = [ pkg-config which yasm libtool autoconf automake file ];

  configureFlags =
--- a/pkgs/applications/video/mythtv/disable-os-detection.patch
+++ b/pkgs/applications/video/mythtv/disable-os-detection.patch
@ -1,31 +0,0 @@
--- a/configure	2020-07-21 20:50:58.653989766 +0200
-+++ b/configure	2020-07-21 20:52:21.236610586 +0200
-@@ -6537,17 +6537,17 @@
-                 }
- 
- enable enforce_wshadow
-case $target_os in
-    android)
-        disable enforce_wshadow
-        ;;
-    linux)
-        . /etc/os-release
-        if test $ID = "centos"; then
-            disable enforce_wshadow
-        fi
-        ;;
-esac
-+#case $target_os in
-+#    android)
-+#        disable enforce_wshadow
-+#        ;;
-+#    linux)
-+#        . /etc/os-release
-+#        if test $ID = "centos"; then
-+#            disable enforce_wshadow
-+#        fi
-+#        ;;
-+#esac
- 
- if $(pkg-config --exists Qt5WebKit) || $(pkg-config --exists QtWebKit) ; then
-     enable qtwebkit
--- a/pkgs/applications/video/mythtv/dont-source-os-release.patch
+++ b/pkgs/applications/video/mythtv/dont-source-os-release.patch
@ -0,0 +1,15 @@
+--- a/configure
+++ b/configure
+@@ -5894,9 +5894,9 @@ else
+     die "ERROR: cannot find soundtouch 1.8.0 or later."
+ fi
+ 
+-if [ $target_os = "linux" ] ; then
+-    . /etc/os-release
+-fi
+# if [ $target_os = "linux" ] ; then
+#     . /etc/os-release
+# fi
+ 
+ # libudfread
+ if enabled system_libudfread ; then
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "docker-compose";
-  version = "2.12.2";
+  version = "2.13.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    rev = "v${version}";
-    sha256 = "sha256-QyxWoq3hGFLm27tba5BL3xcnNCOAmY+rbGBtwREZPJA=";
+    sha256 = "sha256-m0lDnVu6T8P1di8DeQYAKBA6Y+4iSqmc0nE3iBHY5+M=";
  };

  postPatch = ''
@ -16,7 +16,7 @@ buildGoModule rec {
    rm -rf e2e/
  '';

-  vendorSha256 = "sha256-QlzneikTMBUpKJiyVrN+A6CctsVvdoTOOMDjJqIF3a8=";
+  vendorSha256 = "sha256-xigDihg2SvvcFSrKYlo5VluqhqK9xzWVbrsBvsJsLXA=";

  ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];

--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@ -79,7 +79,6 @@ rec {
      gtk3
      bashInteractive
      gnome.zenity
-      python2
      xorg.xrandr
      which
      perl
--- a/pkgs/build-support/fetchurl/tests.nix
+++ b/pkgs/build-support/fetchurl/tests.nix
@ -1,8 +1,8 @@
-{ invalidateFetcherByDrvHash, fetchurl, jq, moreutils, ... }: {
+{ testers, fetchurl, jq, moreutils, ... }: {
  # Tests that we can send custom headers with spaces in them
  header =
    let headerValue = "Test '\" <- These are some quotes";
-    in invalidateFetcherByDrvHash fetchurl {
+    in testers.invalidateFetcherByDrvHash fetchurl {
      url = "https://httpbin.org/headers";
      sha256 = builtins.hashString "sha256" (headerValue + "\n");
      curlOptsList = [ "-H" "Hello: ${headerValue}" ];
--- a/pkgs/data/fonts/tlwg/default.nix
+++ b/pkgs/data/fonts/tlwg/default.nix
@ -1,22 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, fontforge }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, autoconf-archive, fontforge }:

 stdenv.mkDerivation rec {
  pname = "tlwg";
-  version = "0.6.4";
+  version = "0.7.3";

  src = fetchFromGitHub {
    owner = "tlwg";
    repo = "fonts-tlwg";
    rev = "v${version}";
-    sha256 = "13bx98ygyyizb15ybdv3856lkxhx1fss8f7aiqmp0lk9zgw4mqyk";
+    sha256 = "hWiH5KJnYTdcrm+Kzn9HUQry8ry3SKzjA6/0536kCLQ=";
  };

-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook autoconf-archive ];

  buildInputs = [ fontforge ];

-  preAutoreconf = "echo ${version} > VERSION";
-
  meta = with lib; {
    description = "A collection of Thai scalable fonts available under free licenses";
    homepage = "https://linux.thai.net/projects/fonts-tlwg";
--- a/pkgs/data/icons/tela-circle-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-circle-icon-theme/default.nix
@ -2,7 +2,7 @@
 , stdenvNoCC
 , fetchFromGitHub
 , adwaita-icon-theme
-, breeze-icons
+, libsForQt5
 , gtk3
 , hicolor-icon-theme
 , jdupes
@ -35,7 +35,7 @@ stdenvNoCC.mkDerivation rec {

  propagatedBuildInputs = [
    adwaita-icon-theme
-    breeze-icons
+    libsForQt5.breeze-icons
    hicolor-icon-theme
  ];

--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202211170054";
+  version = "202211240054";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "e01c82114de0b2f3a2e8c80c78fc22e8fb71f68a";
-    sha256 = "sha256-T94G1s3vTkh0pd2ByOpOwJDPn7geaHbnBB7w1K9qwps=";
+    rev = "1887d855ed4b4b92999d3afecf71f43358029369";
+    sha256 = "sha256-WozqLA/akUF7T0LyR/nQkTxuZPNCpYarOQG5zQwGAMk=";
  };

  installPhase = ''
--- a/pkgs/development/compilers/llvm/rocm/llvm.nix
+++ b/pkgs/development/compilers/llvm/rocm/llvm.nix
@ -41,7 +41,7 @@ in stdenv.mkDerivation (finalAttrs: {
    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON" # Needed by rustc
    "-DLLVM_TARGETS_TO_BUILD=AMDGPU;${llvmNativeTarget}"
-    "-DLLVM_ENABLE_PROJECTS=clang;lld;compiler-rt"
+    "-DLLVM_ENABLE_PROJECTS=clang;lld;compiler-rt;clang-tools-extra"
  ]
  ++ lib.optionals enableManpages [
    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@ -154,7 +154,7 @@
 *  Darwin frameworks
 */
 , Cocoa, CoreAudio, CoreServices, AVFoundation, MediaToolbox
-, VideoDecodeAcceleration
+, VideoDecodeAcceleration, VideoToolbox
 }:

 /* Maintainer notes:
@ -454,7 +454,7 @@ stdenv.mkDerivation rec {
    ++ optional (nvdec || nvenc) nv-codec-headers
    ++ optional cuda-llvm clang
    ++ optionals stdenv.isDarwin [ Cocoa CoreServices CoreAudio AVFoundation
-                                   MediaToolbox VideoDecodeAcceleration
+                                   MediaToolbox VideoDecodeAcceleration VideoToolbox
                                   libiconv ];

  buildFlags = [ "all" ]
--- a/pkgs/development/libraries/hipsparse/default.nix
+++ b/pkgs/development/libraries/hipsparse/default.nix
@ -11,22 +11,14 @@
 , hip
 , gfortran
 , git
-, fetchzip ? null
 , gtest ? null
 , buildTests ? false
 }:

-assert buildTests -> fetchzip != null;
 assert buildTests -> gtest != null;

 # This can also use cuSPARSE as a backend instead of rocSPARSE
-let
-  matrices = lib.optionalAttrs buildTests import ./deps.nix {
-    inherit fetchzip;
-    mirror1 = "https://sparse.tamu.edu/MM";
-    mirror2 = "https://www.cise.ufl.edu/research/sparse/MM";
-  };
-in stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "hipsparse";
  repoVersion = "2.3.1";
  rocmVersion = "5.3.3";
@ -81,25 +73,25 @@ in stdenv.mkDerivation (finalAttrs: {
  '' + lib.optionalString buildTests ''
    mkdir -p matrices

-    ln -s ${matrices.matrix-01}/*.mtx matrices
-    ln -s ${matrices.matrix-02}/*.mtx matrices
-    ln -s ${matrices.matrix-03}/*.mtx matrices
-    ln -s ${matrices.matrix-04}/*.mtx matrices
-    ln -s ${matrices.matrix-05}/*.mtx matrices
-    ln -s ${matrices.matrix-06}/*.mtx matrices
-    ln -s ${matrices.matrix-07}/*.mtx matrices
-    ln -s ${matrices.matrix-08}/*.mtx matrices
-    ln -s ${matrices.matrix-09}/*.mtx matrices
-    ln -s ${matrices.matrix-10}/*.mtx matrices
-    ln -s ${matrices.matrix-11}/*.mtx matrices
-    ln -s ${matrices.matrix-12}/*.mtx matrices
-    ln -s ${matrices.matrix-13}/*.mtx matrices
-    ln -s ${matrices.matrix-14}/*.mtx matrices
-    ln -s ${matrices.matrix-15}/*.mtx matrices
-    ln -s ${matrices.matrix-16}/*.mtx matrices
-    ln -s ${matrices.matrix-17}/*.mtx matrices
-    ln -s ${matrices.matrix-18}/*.mtx matrices
-    ln -s ${matrices.matrix-19}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-01}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-02}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-03}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-04}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-05}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-06}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-07}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-08}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-09}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-10}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-11}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-12}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-13}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-14}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-15}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-16}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-17}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-18}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-19}/*.mtx matrices

    # Not used by the original cmake, causes an error
    rm matrices/*_b.mtx
--- a/pkgs/development/libraries/hipsparse/deps.nix
+++ b/pkgs/development/libraries/hipsparse/deps.nix
@ -1,177 +0,0 @@
-{ fetchzip
-, mirror1
-, mirror2
-}:
-
-{
-  matrix-01 = fetchzip {
-    sha256 = "sha256-AHur5ZIDZTFRrO2GV0ieXrffq4KUiGWiZ59pv0fUtEQ=";
-
-    urls = [
-      "${mirror1}/SNAP/amazon0312.tar.gz"
-      "${mirror2}/SNAP/amazon0312.tar.gz"
-    ];
-  };
-
-  matrix-02 = fetchzip {
-    sha256 = "sha256-0rSxaN4lQcdaCLsvlgicG70FXUxXeERPiEmQ4MzbRdE=";
-
-    urls = [
-      "${mirror1}/Muite/Chebyshev4.tar.gz"
-      "${mirror2}/Muite/Chebyshev4.tar.gz"
-    ];
-  };
-
-  matrix-03 = fetchzip {
-    sha256 = "sha256-hDzDWDUnHEyFedX/tMNq83ZH8uWyM4xtZYUUAD3rizo=";
-
-    urls = [
-      "${mirror1}/FEMLAB/sme3Dc.tar.gz"
-      "${mirror2}/FEMLAB/sme3Dc.tar.gz"
-    ];
-  };
-
-  matrix-04 = fetchzip {
-    sha256 = "sha256-GmN2yOt/MoX01rKe05aTyB3ypUP4YbQGOITZ0BqPmC0=";
-
-    urls = [
-      "${mirror1}/Williams/webbase-1M.tar.gz"
-      "${mirror2}/Williams/webbase-1M.tar.gz"
-    ];
-  };
-
-  matrix-05 = fetchzip {
-    sha256 = "sha256-gQNjfVyWzNM9RwImJGhkhahRmZz74LzDs1oijL7mI7k=";
-
-    urls = [
-      "${mirror1}/Williams/mac_econ_fwd500.tar.gz"
-      "${mirror2}/Williams/mac_econ_fwd500.tar.gz"
-    ];
-  };
-
-  matrix-06 = fetchzip {
-    sha256 = "sha256-87cdZjntNcTuz5BtO59irhcuRbPllWSbhCEX3Td02qc=";
-
-    urls = [
-      "${mirror1}/Williams/mc2depi.tar.gz"
-      "${mirror2}/Williams/mc2depi.tar.gz"
-    ];
-  };
-
-  matrix-07 = fetchzip {
-    sha256 = "sha256-WRamuJX3D8Tm+k0q67RjUDG3DeNAxhKiaPkk5afY5eU=";
-
-    urls = [
-      "${mirror1}/Bova/rma10.tar.gz"
-      "${mirror2}/Bova/rma10.tar.gz"
-    ];
-  };
-
-  matrix-08 = fetchzip {
-    sha256 = "sha256-5dhkm293Mc3lzakKxHy5W5XIn4Rw+gihVh7gyrjEHXo=";
-
-    urls = [
-      "${mirror1}/JGD_BIBD/bibd_22_8.tar.gz"
-      "${mirror2}/JGD_BIBD/bibd_22_8.tar.gz"
-    ];
-  };
-
-  matrix-09 = fetchzip {
-    sha256 = "sha256-czjLWCjXAjZCk5TGYHaEkwSAzQu3TQ3QyB6eNKR4G88=";
-
-    urls = [
-      "${mirror1}/Hamm/scircuit.tar.gz"
-      "${mirror2}/Hamm/scircuit.tar.gz"
-    ];
-  };
-
-  matrix-10 = fetchzip {
-    sha256 = "sha256-bYuLnJViAIcIejAkh69/bsNAVIDU4wfTLtD+nmHd6FM=";
-
-    urls = [
-      "${mirror1}/Sandia/ASIC_320k.tar.gz"
-      "${mirror2}/Sandia/ASIC_320k.tar.gz"
-    ];
-  };
-
-  matrix-11 = fetchzip {
-    sha256 = "sha256-aDwn8P1khYjo2Agbq5m9ZBInJUxf/knJNvyptt0fak0=";
-
-    urls = [
-      "${mirror1}/GHS_psdef/bmwcra_1.tar.gz"
-      "${mirror2}/GHS_psdef/bmwcra_1.tar.gz"
-    ];
-  };
-
-  matrix-12 = fetchzip {
-    sha256 = "sha256-8OJqA/byhlAZd869TPUzZFdsOiwOoRGfKyhM+RMjXoY=";
-
-    urls = [
-      "${mirror1}/HB/nos1.tar.gz"
-      "${mirror2}/HB/nos1.tar.gz"
-    ];
-  };
-
-  matrix-13 = fetchzip {
-    sha256 = "sha256-FS0rKqmg+uHwsM/yGfQLBdd7LH/rUrdutkNGBD/Mh1I=";
-
-    urls = [
-      "${mirror1}/HB/nos2.tar.gz"
-      "${mirror2}/HB/nos2.tar.gz"
-    ];
-  };
-
-  matrix-14 = fetchzip {
-    sha256 = "sha256-DANnlrNJikrI7Pst9vRedtbuxepyHmCIu2yhltc4Qcs=";
-
-    urls = [
-      "${mirror1}/HB/nos3.tar.gz"
-      "${mirror2}/HB/nos3.tar.gz"
-    ];
-  };
-
-  matrix-15 = fetchzip {
-    sha256 = "sha256-21mUgqjWGUfYgiWwSrKh9vH8Vdt3xzcefmqYNYRpxiY=";
-
-    urls = [
-      "${mirror1}/HB/nos4.tar.gz"
-      "${mirror2}/HB/nos4.tar.gz"
-    ];
-  };
-
-  matrix-16 = fetchzip {
-    sha256 = "sha256-FOuXvGqBBFNkVS6cexmkluret54hCfCOdK+DOZllE4c=";
-
-    urls = [
-      "${mirror1}/HB/nos5.tar.gz"
-      "${mirror2}/HB/nos5.tar.gz"
-    ];
-  };
-
-  matrix-17 = fetchzip {
-    sha256 = "sha256-+7NI1rA/qQxYPpjXKHvAaCZ+LSaAJ4xuJvMRMBEUYxg=";
-
-    urls = [
-      "${mirror1}/HB/nos6.tar.gz"
-      "${mirror2}/HB/nos6.tar.gz"
-    ];
-  };
-
-  matrix-18 = fetchzip {
-    sha256 = "sha256-q3NxJjbwGGcFiQ9nhWfUKgZmdVwCfPmgQoqy0AqOsNc=";
-
-    urls = [
-      "${mirror1}/HB/nos7.tar.gz"
-      "${mirror2}/HB/nos7.tar.gz"
-    ];
-  };
-
-  matrix-19 = fetchzip {
-    sha256 = "sha256-0GAN6qmVfD+tprIigzuUUUwm5KVhkN9X65wMEvFltDY=";
-
-    urls = [
-      "${mirror1}/DNVS/shipsec1.tar.gz"
-      "${mirror2}/DNVS/shipsec1.tar.gz"
-    ];
-  };
-}
--- a/pkgs/development/libraries/hotpatch/default.nix
+++ b/pkgs/development/libraries/hotpatch/default.nix
@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
    LD_LIBRARY_PATH=$(pwd)/src make test
  '';

+  patches = [ ./no-loader-test.patch ];
+
  meta = with lib; {
    description = "Hot patching executables on Linux using .so file injection";
    homepage = src.meta.homepage;
--- a/pkgs/development/libraries/hotpatch/no-loader-test.patch
+++ b/pkgs/development/libraries/hotpatch/no-loader-test.patch
@ -0,0 +1,25 @@
+diff --git a/test/loader.c b/test/loader.c
+index 4e3dfdc..7f98d94 100644
+--- a/test/loader.c
+++ b/test/loader.c
+@@ -54,20 +54,6 @@ int main(int argc, char **argv)
+ 	assert(ret < 0);
+ 	ret = ld_find_library(maps, mapnum, "libc", false, NULL, 6);
+ 	assert(ret >= 0);
+-#if __WORDSIZE == 64
+-	ret = ld_find_library(maps, mapnum, "/lib64/ld-linux-x86-64.so.2",
+-						  true, NULL, 6);
+-	assert(ret >= 0);
+-	ret = ld_find_library(maps, mapnum, "/lib/ld-linux-x86-64.so.2",
+-						  false, NULL, 6);
+-#else
+-	ret = ld_find_library(maps, mapnum, "/lib/ld-linux.so.2",
+-						  true, NULL, 6);
+-	assert(ret >= 0);
+-	ret = ld_find_library(maps, mapnum, "/lib32/ld-linux.so.2",
+-						  false, NULL, 6);
+-#endif
+-	assert(ret < 0);
+ 	ld_free_maps(maps, mapnum);
+     return 0;
+ }
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "libdeltachat";
-  version = "1.101.0";
+  version = "1.102.0";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-core-rust";
    rev = version;
-    hash = "sha256-EhFxun80s5tNZT4d7vbszTfHbYK9X3PohsQl20wRzlg=";
+    hash = "sha256-xw/lUNs39nkBrydpcgUBL3j6XrZFafKslxx6zUiElWw=";
  };

  patches = [
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-8uu4i4WfW9pmdLAWWUU1QP09B1/ws+DeVf8baYfikw4=";
+    hash = "sha256-CiqYKFABHcFSjYUH/qop1xWCoygQJajI7nhv04ElD10=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libeatmydata/default.nix
+++ b/pkgs/development/libraries/libeatmydata/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, strace, which }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, strace, which }:

 stdenv.mkDerivation rec {
  pname = "libeatmydata";
@ -11,7 +11,16 @@ stdenv.mkDerivation rec {
    sha256 = "0sx803h46i81h67xbpd3c7ky0nhaw4gij214nsx4lqig70223v9r";
  };

-  patches = [ ./find-shell-lib.patch ];
+  patches = [
+    ./find-shell-lib.patch
+
+    # Fixes "error: redefinition of 'open'" on musl
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/861ac185a6b60134292ff93d40e40b5391d0aa8e/srcpkgs/libeatmydata/patches/musl.patch";
+      stripLen = 1;
+      sha256 = "sha256-yfMfISbYL7r/R2C9hYPjvGcpUB553QSiW0rMrxG11Oo=";
+    })
+  ];

  patchFlags = [ "-p0" ];

--- a/pkgs/development/libraries/miopen/default.nix
+++ b/pkgs/development/libraries/miopen/default.nix
@ -0,0 +1,215 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, writeScript
+, pkg-config
+, cmake
+, rocm-cmake
+, rocm-runtime
+, rocm-device-libs
+, rocm-comgr
+, rocm-opencl-runtime
+, rocblas
+, rocmlir
+, hip
+, clang
+, clang-ocl
+, llvm
+, miopengemm
+, composable_kernel
+, half
+, boost
+, sqlite
+, bzip2
+, texlive ? null
+, doxygen ? null
+, sphinx ? null
+, python3Packages ? null
+, zlib ? null
+, fetchurl ? null
+, buildDocs ? false
+, buildTests ? false
+# LFS isn't working, so we will manually fetch these
+# This isn't strictly required, but is recommended
+# https://github.com/ROCmSoftwarePlatform/MIOpen/issues/1373
+, fetchKDBs ? true
+, useOpenCL ? false
+}:
+
+assert buildDocs -> texlive != null;
+assert buildDocs -> doxygen != null;
+assert buildDocs -> sphinx != null;
+assert buildDocs -> python3Packages != null;
+assert buildTests -> zlib != null;
+assert fetchKDBs -> fetchurl != null;
+
+let
+  latex = lib.optionalAttrs buildDocs (texlive.combine {
+    inherit (texlive) scheme-small
+    latexmk
+    tex-gyre
+    fncychap
+    wrapfig
+    capt-of
+    framed
+    needspace
+    tabulary
+    varwidth
+    titlesec;
+  });
+
+  kdbs = lib.optionalAttrs fetchKDBs import ./deps.nix {
+    inherit fetchurl;
+    mirror = "https://repo.radeon.com/rocm/miopen-kernel/rel-5.0";
+  };
+in stdenv.mkDerivation (finalAttrs: {
+  pname = "miopen";
+  # We have to manually specify the repoVersion for now
+  # Find the github release or `-- MIOpen_VERSION= X.X.X` in the build log
+  repoVersion = "2.18.0";
+  rocmVersion = "5.3.3";
+  version = "${finalAttrs.repoVersion}-${finalAttrs.rocmVersion}";
+
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildDocs [
+    "doc"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "ROCmSoftwarePlatform";
+    repo = "MIOpen";
+    rev = "rocm-${finalAttrs.rocmVersion}";
+    hash = "sha256-5/JitdGJ0afzK4pGOOywRLsB3/Thc6/71sRkKIxf2Lg=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    rocm-cmake
+    hip
+    clang
+    llvm
+  ];
+
+  buildInputs = [
+    rocm-runtime
+    rocm-device-libs
+    rocm-comgr
+    rocm-opencl-runtime
+    rocblas
+    rocmlir
+    clang-ocl
+    miopengemm
+    composable_kernel
+    half
+    boost
+    sqlite
+    bzip2
+  ] ++ lib.optionals buildDocs [
+    latex
+    doxygen
+    sphinx
+    python3Packages.sphinx_rtd_theme
+    python3Packages.breathe
+    python3Packages.myst-parser
+  ] ++ lib.optionals buildTests [
+    zlib
+  ];
+
+  cmakeFlags = [
+    "-DMIOPEN_USE_MIOPENGEMM=ON"
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ] ++ lib.optionals (!useOpenCL) [
+    "-DCMAKE_C_COMPILER=hipcc"
+    "-DCMAKE_CXX_COMPILER=hipcc"
+    "-DMIOPEN_BACKEND=HIP"
+  ] ++ lib.optionals useOpenCL [
+    "-DCMAKE_C_COMPILER=${clang}/bin/clang"
+    "-DCMAKE_CXX_COMPILER=${clang}/bin/clang++"
+    "-DMIOPEN_BACKEND=OpenCL"
+  ] ++ lib.optionals buildTests [
+    "-DBUILD_TESTS=ON"
+    "-DMIOPEN_TEST_ALL=ON"
+    "-DMIOPEN_TEST_GFX900=ON"
+    "-DMIOPEN_TEST_GFX906=ON"
+    "-DMIOPEN_TEST_GFX908=ON"
+    "-DMIOPEN_TEST_GFX90A=ON"
+    "-DMIOPEN_TEST_GFX103X=ON"
+  ];
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace "enable_testing()" "" \
+      --replace "MIOPEN_HIP_COMPILER MATCHES \".*clang\\\\+\\\\+$\"" "true" \
+      --replace "/opt/rocm/hip" "${hip}" \
+      --replace "/opt/rocm/llvm" "${llvm}" \
+      --replace "3 REQUIRED PATHS /opt/rocm)" "3 REQUIRED PATHS ${hip})" \
+      --replace "hip REQUIRED PATHS /opt/rocm" "hip REQUIRED PATHS ${hip}" \
+      --replace "rocblas REQUIRED PATHS /opt/rocm" "rocblas REQUIRED PATHS ${rocblas}" \
+      --replace "miopengemm PATHS /opt/rocm" "miopengemm PATHS ${miopengemm}" \
+      --replace "set(MIOPEN_TIDY_ERRORS ALL)" "" # Fix clang-tidy at some point
+  '' + lib.optionalString (!buildTests) ''
+    substituteInPlace CMakeLists.txt \
+      --replace "add_subdirectory(test)" ""
+  '' + lib.optionalString fetchKDBs ''
+    cp -a ${kdbs.gfx1030_36} src/kernels/gfx1030_36.kdb
+    cp -a ${kdbs.gfx900_56} src/kernels/gfx900_56.kdb
+    cp -a ${kdbs.gfx900_64} src/kernels/gfx900_64.kdb
+    cp -a ${kdbs.gfx906_60} src/kernels/gfx906_60.kdb
+    cp -a ${kdbs.gfx906_64} src/kernels/gfx906_64.kdb
+    cp -a ${kdbs.gfx90878} src/kernels/gfx90878.kdb
+    cp -a ${kdbs.gfx90a68} src/kernels/gfx90a68.kdb
+    cp -a ${kdbs.gfx90a6e} src/kernels/gfx90a6e.kdb
+  '';
+
+  # Unfortunately, it seems like we have to call make on these manually
+  postBuild = lib.optionalString buildDocs ''
+    export HOME=$(mktemp -d)
+    make doc
+  '' + lib.optionalString buildTests ''
+    make -j$NIX_BUILD_CORES check
+  '';
+
+  postInstall = ''
+    rm $out/bin/install_precompiled_kernels.sh
+  '' + lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    mv bin/test_* $test/bin
+    patchelf --set-rpath ${lib.makeLibraryPath (finalAttrs.nativeBuildInputs ++ finalAttrs.buildInputs)}:$out/lib $test/bin/*
+  '';
+
+  postFixup = lib.optionalString (buildDocs && !useOpenCL) ''
+    export docDir=$doc/share/doc/miopen-hip
+  '' + lib.optionalString (buildDocs && useOpenCL) ''
+    export docDir=$doc/share/doc/miopen-opencl
+  '' + lib.optionalString buildDocs ''
+    mkdir -p $docDir
+    mv ../doc/html $docDir
+    mv ../doc/pdf/miopen.pdf $docDir
+  '';
+
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl jq common-updater-scripts
+    rocmVersion="$(curl -sL "https://api.github.com/repos/ROCmSoftwarePlatform/MIOpen/releases?per_page=1" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
+    update-source-version miopen "$rocmVersion" --ignore-same-hash --version-key=rocmVersion
+  '';
+
+  meta = with lib; {
+    description = "Machine intelligence library for ROCm";
+    homepage = "https://github.com/ROCmSoftwarePlatform/MIOpen";
+    license = with licenses; [ mit ];
+    maintainers = teams.rocm.members;
+    broken = finalAttrs.rocmVersion != hip.version;
+    # MIOpen will produce a very large output due to KDBs fetched
+    # Also possibly in the future because of KDB generation
+    hydraPlatforms = [ ];
+  };
+})
--- a/pkgs/development/libraries/miopen/deps.nix
+++ b/pkgs/development/libraries/miopen/deps.nix
@ -0,0 +1,45 @@
+{ fetchurl
+, mirror
+}:
+
+{
+  gfx1030_36 = fetchurl {
+    sha256 = "sha256-zEXDLkRWAHS15LDA5IRyqG5rO7HHPBiVgPlQ8JjSqNc=";
+    url = "${mirror}/gfx1030_36.kdb";
+  };
+
+  gfx900_56 = fetchurl {
+    sha256 = "sha256-ZTqUPhVKcQzjO6bxykvZMJk1VZh31dRVs+XqcxEtmeI=";
+    url = "${mirror}/gfx900_56.kdb";
+  };
+
+  gfx900_64 = fetchurl {
+    sha256 = "sha256-ZTqUPhVKcQzjO6bxykvZMJk1VZh31dRVs+XqcxEtmeI=";
+    url = "${mirror}/gfx900_64.kdb";
+  };
+
+  gfx906_60 = fetchurl {
+    sha256 = "sha256-U6pDo8ICfs6fVIEqRziWeE5/4Vzvu41JkcRVn3ou1e4=";
+    url = "${mirror}/gfx906_60.kdb";
+  };
+
+  gfx906_64 = fetchurl {
+    sha256 = "sha256-U6pDo8ICfs6fVIEqRziWeE5/4Vzvu41JkcRVn3ou1e4=";
+    url = "${mirror}/gfx906_64.kdb";
+  };
+
+  gfx90878 = fetchurl {
+    sha256 = "sha256-r7DRhNH+jHUXAu64b9vWsZzGD4w5oSHnxH0l2RN0qlQ=";
+    url = "${mirror}/gfx90878.kdb";
+  };
+
+  gfx90a68 = fetchurl {
+    sha256 = "sha256-NT//zIPTbzsPJyaVycxwU6BcMTzGc/d+Z4Ab9FImDko=";
+    url = "${mirror}/gfx90a68.kdb";
+  };
+
+  gfx90a6e = fetchurl {
+    sha256 = "sha256-ENZHbf+/MGYgSTpALKh2meuZPNhH5bG+WrW/jzvGpBs=";
+    url = "${mirror}/gfx90a6e.kdb";
+  };
+}
--- a/pkgs/development/libraries/rocrand/default.nix
+++ b/pkgs/development/libraries/rocrand/default.nix
@ -0,0 +1,100 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, writeScript
+, cmake
+, rocm-cmake
+, rocm-runtime
+, rocm-device-libs
+, rocm-comgr
+, hip
+, gtest ? null
+, gbenchmark ? null
+, buildTests ? false
+, buildBenchmarks ? false
+}:
+
+assert buildTests -> gtest != null;
+assert buildBenchmarks -> gbenchmark != null;
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rocrand";
+  repoVersion = "2.10.15";
+  rocmVersion = "5.3.3";
+  version = "${finalAttrs.repoVersion}-${finalAttrs.rocmVersion}";
+
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ] ++ lib.optionals buildBenchmarks [
+    "benchmark"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "ROCmSoftwarePlatform";
+    repo = "rocRAND";
+    rev = "rocm-${finalAttrs.rocmVersion}";
+    hash = "sha256-awQLqPmhVxegrqqSoC8fiCQJ33bPKZlljSAXnHVcIZo=";
+    fetchSubmodules = true; # For inline hipRAND
+  };
+
+  nativeBuildInputs = [
+    cmake
+    rocm-cmake
+    hip
+  ];
+
+  buildInputs = [
+    rocm-runtime
+    rocm-device-libs
+    rocm-comgr
+  ] ++ lib.optionals buildTests [
+    gtest
+  ] ++ lib.optionals buildBenchmarks [
+    gbenchmark
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_C_COMPILER=hipcc"
+    "-DCMAKE_CXX_COMPILER=hipcc"
+    "-DHIP_ROOT_DIR=${hip}"
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ] ++ lib.optionals buildTests [
+    "-DBUILD_TEST=ON"
+  ] ++ lib.optionals buildBenchmarks [
+    "-DBUILD_BENCHMARK=ON"
+  ];
+
+  postInstall = lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    mv $out/bin/test_* $test/bin
+  '' + lib.optionalString buildBenchmarks ''
+    mkdir -p $benchmark/bin
+    mv $out/bin/benchmark_* $benchmark/bin
+  '' + lib.optionalString (buildTests || buildBenchmarks) ''
+    rmdir $out/bin
+  '';
+
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl jq common-updater-scripts
+    json="$(curl -sL "https://api.github.com/repos/ROCmSoftwarePlatform/rocRAND/releases?per_page=1")"
+    repoVersion="$(echo "$json" | jq '.[0].name | split(" ") | .[1]' --raw-output)"
+    rocmVersion="$(echo "$json" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
+    update-source-version rocrand "$repoVersion" --ignore-same-hash --version-key=repoVersion
+    update-source-version rocrand "$rocmVersion" --ignore-same-hash --version-key=rocmVersion
+  '';
+
+  meta = with lib; {
+    description = "Generate pseudo-random and quasi-random numbers";
+    homepage = "https://github.com/ROCmSoftwarePlatform/rocRAND";
+    license = with licenses; [ mit ];
+    maintainers = teams.rocm.members;
+    broken = finalAttrs.rocmVersion != hip.version;
+  };
+})
--- a/pkgs/development/libraries/rocsparse/default.nix
+++ b/pkgs/development/libraries/rocsparse/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchzip
 , writeScript
 , cmake
 , rocm-cmake
@ -11,7 +12,6 @@
 , hip
 , gfortran
 , git
-, fetchzip ? null
 , gtest ? null
 , boost ? null
 , python3Packages ? null
@ -19,18 +19,11 @@
 , buildBenchmarks ? false # Seems to depend on tests
 }:

-assert (buildTests || buildBenchmarks) -> fetchzip != null;
 assert (buildTests || buildBenchmarks) -> gtest != null;
 assert (buildTests || buildBenchmarks) -> boost != null;
 assert (buildTests || buildBenchmarks) -> python3Packages != null;

-let
-  matrices = lib.optionalAttrs (buildTests || buildBenchmarks) import ./deps.nix {
-    inherit fetchzip;
-    mirror1 = "https://sparse.tamu.edu/MM";
-    mirror2 = "https://www.cise.ufl.edu/research/sparse/MM";
-  };
-in stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "rocsparse";
  repoVersion = "2.3.2";
  rocmVersion = "5.3.3";
@ -90,30 +83,30 @@ in stdenv.mkDerivation (finalAttrs: {
  postPatch = lib.optionalString (buildTests || buildBenchmarks) ''
    mkdir -p matrices

-    ln -s ${matrices.matrix-01}/*.mtx matrices
-    ln -s ${matrices.matrix-02}/*.mtx matrices
-    ln -s ${matrices.matrix-03}/*.mtx matrices
-    ln -s ${matrices.matrix-04}/*.mtx matrices
-    ln -s ${matrices.matrix-05}/*.mtx matrices
-    ln -s ${matrices.matrix-06}/*.mtx matrices
-    ln -s ${matrices.matrix-07}/*.mtx matrices
-    ln -s ${matrices.matrix-08}/*.mtx matrices
-    ln -s ${matrices.matrix-09}/*.mtx matrices
-    ln -s ${matrices.matrix-10}/*.mtx matrices
-    ln -s ${matrices.matrix-11}/*.mtx matrices
-    ln -s ${matrices.matrix-12}/*.mtx matrices
-    ln -s ${matrices.matrix-13}/*.mtx matrices
-    ln -s ${matrices.matrix-14}/*.mtx matrices
-    ln -s ${matrices.matrix-15}/*.mtx matrices
-    ln -s ${matrices.matrix-16}/*.mtx matrices
-    ln -s ${matrices.matrix-17}/*.mtx matrices
-    ln -s ${matrices.matrix-18}/*.mtx matrices
-    ln -s ${matrices.matrix-19}/*.mtx matrices
-    ln -s ${matrices.matrix-20}/*.mtx matrices
-    ln -s ${matrices.matrix-21}/*.mtx matrices
-    ln -s ${matrices.matrix-22}/*.mtx matrices
-    ln -s ${matrices.matrix-23}/*.mtx matrices
-    ln -s ${matrices.matrix-24}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-01}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-02}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-03}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-04}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-05}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-06}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-07}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-08}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-09}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-10}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-11}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-12}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-13}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-14}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-15}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-16}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-17}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-18}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-19}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-20}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-21}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-22}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-23}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-24}/*.mtx matrices

    # Not used by the original cmake, causes an error
    rm matrices/*_b.mtx
@ -140,15 +133,23 @@ in stdenv.mkDerivation (finalAttrs: {
    rmdir $out/bin
  '';

-  passthru.updateScript = writeScript "update.sh" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl jq common-updater-scripts
-    json="$(curl -sL "https://api.github.com/repos/ROCmSoftwarePlatform/rocSPARSE/releases?per_page=1")"
-    repoVersion="$(echo "$json" | jq '.[0].name | split(" ") | .[1]' --raw-output)"
-    rocmVersion="$(echo "$json" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
-    update-source-version rocsparse "$repoVersion" --ignore-same-hash --version-key=repoVersion
-    update-source-version rocsparse "$rocmVersion" --ignore-same-hash --version-key=rocmVersion
-  '';
+  passthru = {
+    matrices = import ./deps.nix {
+      inherit fetchzip;
+      mirror1 = "https://sparse.tamu.edu/MM";
+      mirror2 = "https://www.cise.ufl.edu/research/sparse/MM";
+    };
+
+    updateScript = writeScript "update.sh" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl jq common-updater-scripts
+      json="$(curl -sL "https://api.github.com/repos/ROCmSoftwarePlatform/rocSPARSE/releases?per_page=1")"
+      repoVersion="$(echo "$json" | jq '.[0].name | split(" ") | .[1]' --raw-output)"
+      rocmVersion="$(echo "$json" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
+      update-source-version rocsparse "$repoVersion" --ignore-same-hash --version-key=repoVersion
+      update-source-version rocsparse "$rocmVersion" --ignore-same-hash --version-key=rocmVersion
+    '';
+  };

  meta = with lib; {
    description = "ROCm SPARSE implementation";
--- a/pkgs/development/libraries/rocwmma/0000-dont-fetch-googletest.patch
+++ b/pkgs/development/libraries/rocwmma/0000-dont-fetch-googletest.patch
@ -0,0 +1,19 @@
+diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
+index 7e0f2c8..db54eab 100644
+--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
+@@ -31,14 +31,6 @@ cmake_dependent_option( ROCWMMA_BUILD_BENCHMARK_TESTS "Build benchmarking tests"
+ cmake_dependent_option( ROCWMMA_BUILD_EXTENDED_TESTS "Build extended test parameter coverage" OFF "ROCWMMA_BUILD_TESTS" OFF )
+ 
+ # Test/benchmark requires additional dependencies
+-include( FetchContent )
+-
+-FetchContent_Declare(
+-  googletest
+-  URL https://github.com/google/googletest/archive/609281088cfefc76f9d0ce82e1ff6c30cc3591e5.zip
+-)
+-FetchContent_MakeAvailable(googletest)
+-
+ include(GoogleTest)
+ 
+ set(ROCWMMA_TEST_INCLUDE_DIR ${CMAKE_CURRENT_SOURCE_DIR})
--- a/pkgs/development/libraries/rocwmma/default.nix
+++ b/pkgs/development/libraries/rocwmma/default.nix
@ -0,0 +1,157 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, writeScript
+, cmake
+, rocm-cmake
+, hip
+, openmp
+, gtest ? null
+, rocblas ? null
+, texlive ? null
+, doxygen ? null
+, sphinx ? null
+, python3Packages ? null
+, buildTests ? false
+, buildSamples ? false
+, buildDocs ? false
+, gpuTargets ? null # gpuTargets = [ "gfx908:xnack-" "gfx90a:xnack-" "gfx90a:xnack+" ... ]
+}:
+
+assert buildTests -> gtest != null;
+assert buildTests -> rocblas != null;
+assert buildDocs -> texlive != null;
+assert buildDocs -> doxygen != null;
+assert buildDocs -> sphinx != null;
+assert buildDocs -> python3Packages != null;
+
+# Building tests isn't working for now
+# undefined reference to symbol '_ZTIN7testing4TestE'
+assert buildTests == false;
+
+let
+  latex = lib.optionalAttrs buildDocs (texlive.combine {
+    inherit (texlive) scheme-small
+    latexmk
+    tex-gyre
+    fncychap
+    wrapfig
+    capt-of
+    framed
+    needspace
+    tabulary
+    varwidth
+    titlesec;
+  });
+in stdenv.mkDerivation (finalAttrs: {
+  pname = "rocwmma";
+  repoVersion = "0.8";
+  rocmVersion = "5.3.3";
+  version = "${finalAttrs.repoVersion}-${finalAttrs.rocmVersion}";
+
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ] ++ lib.optionals buildSamples [
+    "sample"
+  ] ++ lib.optionals buildDocs [
+    "docs"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "ROCmSoftwarePlatform";
+    repo = "rocWMMA";
+    rev = "rocm-${finalAttrs.rocmVersion}";
+    hash = "sha256-wU3R1XGTy7uFbceUyE0wy+XayicuyJIVfd1ih6pbTN0=";
+  };
+
+  patches = lib.optionals buildTests [
+    ./0000-dont-fetch-googletest.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    rocm-cmake
+    hip
+  ];
+
+  buildInputs = [
+    openmp
+  ] ++ lib.optionals buildTests [
+    gtest
+    rocblas
+  ] ++ lib.optionals buildDocs [
+    latex
+    doxygen
+    sphinx
+    python3Packages.sphinx_rtd_theme
+    python3Packages.breathe
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_CXX_COMPILER=hipcc"
+    "-DROCWMMA_BUILD_TESTS=${if buildTests then "ON" else "OFF"}"
+    "-DROCWMMA_BUILD_SAMPLES=${if buildSamples then "ON" else "OFF"}"
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ] ++ lib.optionals (gpuTargets != null) [
+    "-DGPU_TARGETS=${lib.strings.concatStringsSep ";" gpuTargets}"
+  ] ++ lib.optionals buildTests [
+    "-DROCWMMA_BUILD_VALIDATION_TESTS=ON"
+    "-DROCWMMA_BUILD_BENCHMARK_TESTS=ON"
+    "-DROCWMMA_BUILD_EXTENDED_TESTS=ON"
+    "-DROCWMMA_VALIDATE_WITH_ROCBLAS=ON"
+    "-DROCWMMA_BENCHMARK_WITH_ROCBLAS=ON"
+  ];
+
+  postPatch = lib.optionalString buildDocs ''
+    patchShebangs docs/*.sh
+  '';
+
+  # Unfortunately, it seems like we have to call make on this manually
+  # -DROCWMMA_BUILD_DOCS=ON is invalid, despite being on the README
+  postBuild = lib.optionalString buildDocs ''
+    export HOME=$(mktemp -d)
+    ../docs/run_doc.sh
+  '';
+
+  postInstall = lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    mv $out/bin/*_test* $test/bin
+  '' + lib.optionalString buildSamples ''
+    mkdir -p $sample/bin
+    mv $out/bin/sgemmv $sample/bin
+    mv $out/bin/simple_gemm $sample/bin
+    mv $out/bin/simple_dlrm $sample/bin
+  '' + lib.optionalString (buildTests || buildSamples) ''
+    rmdir $out/bin
+  '';
+
+  postFixup = lib.optionalString buildDocs ''
+    mkdir -p $docs/share/doc/rocwmma
+    mv ../docs/source/_build/html $docs/share/doc/rocwmma
+    mv ../docs/source/_build/latex/rocWMMA.pdf $docs/share/doc/rocwmma
+  '';
+
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl jq common-updater-scripts
+    json="$(curl -sL "https://api.github.com/repos/ROCmSoftwarePlatform/rocWMMA/releases?per_page=1")"
+    repoVersion="$(echo "$json" | jq '.[0].name | split(" ") | .[1]' --raw-output)"
+    rocmVersion="$(echo "$json" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
+    update-source-version rocwmma "$repoVersion" --ignore-same-hash --version-key=repoVersion
+    update-source-version rocwmma "$rocmVersion" --ignore-same-hash --version-key=rocmVersion
+  '';
+
+  meta = with lib; {
+    description = "Mixed precision matrix multiplication and accumulation";
+    homepage = "https://github.com/ROCmSoftwarePlatform/rocWMMA";
+    license = with licenses; [ mit ];
+    maintainers = teams.rocm.members;
+    broken = finalAttrs.rocmVersion != hip.version;
+  };
+})
--- a/pkgs/development/python-modules/aiokafka/default.nix
+++ b/pkgs/development/python-modules/aiokafka/default.nix
@ -1,23 +1,30 @@
 { lib
+, async-timeout
 , buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, dataclasses
-, kafka-python
 , cython
+, fetchFromGitHub
+, gssapi
+, kafka-python
+, lz4
+, packaging
+, python-snappy
+, pythonOlder
 , zlib
+, zstandard
 }:

 buildPythonPackage rec {
  pname = "aiokafka";
-  version = "0.7.2";
-  disabled = pythonOlder "3.6";
+  version = "0.8.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "aio-libs";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-D+91k4zVg28qPbWIrvyXi6WtDs1jeJt9jFGsrSBA3cs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-g7xUB5RfjG4G7J9Upj3KXKSePa+VDit1Zf8pWHfui1o=";
  };

  nativeBuildInputs = [
@ -29,20 +36,38 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
+    async-timeout
    kafka-python
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
+    packaging
  ];

-  # checks require running kafka server
+  passthru.optional-dependencies = {
+    snappy = [
+      python-snappy
+    ];
+    lz4 = [
+      lz4
+    ];
+    zstd = [
+      zstandard
+    ];
+    gssapi = [
+      gssapi
+    ];
+  };
+
+  # Checks require running Kafka server
  doCheck = false;

-  pythonImportsCheck = [ "aiokafka" ];
+  pythonImportsCheck = [
+    "aiokafka"
+  ];

  meta = with lib; {
    description = "Kafka integration with asyncio";
    homepage = "https://aiokafka.readthedocs.org";
+    changelog = "https://github.com/aio-libs/aiokafka/releases/tag/v${version}";
    license = licenses.asl20;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
  };
 }
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "aiolifx-themes";
-  version = "0.2.0";
+  version = "0.2.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -20,8 +20,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "Djelibeybi";
    repo = "aiolifx-themes";
-    rev = "v${version}";
-    hash = "sha256:17498vdg8i20hk4i8hzc67qaj206ik3s1zn1k70plsjr9zlgs6vz";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-sWEWfsew758jl6vLB7AQQ3nA83BFHF7YPy1ZaoPt45Y=";
  };

  prePatch = ''
@ -52,6 +52,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Color themes for LIFX lights running on aiolifx";
    homepage = "https://github.com/Djelibeybi/aiolifx-themes";
+    changelog = "https://github.com/Djelibeybi/aiolifx-themes/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ lukegb ];
  };
--- a/pkgs/development/python-modules/ansible-lint/default.nix
+++ b/pkgs/development/python-modules/ansible-lint/default.nix
@ -22,13 +22,13 @@

 buildPythonPackage rec {
  pname = "ansible-lint";
-  version = "6.8.6";
+  version = "6.9.0";
  format = "pyproject";
  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-Fx/o2tYgeLmBm1x01g61r6ow6py5ybqHBhSeVsVam24=";
+    sha256 = "sha256-FO+RmSDErMmAVH3tC9Qjp6J6CyMnc45ZM0P0RvOxJsY=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
+++ b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
@ -7,11 +7,12 @@
 , pyric
 , pytestCheckHook
 , pythonOlder
+, usb-devices
 }:

 buildPythonPackage rec {
  pname = "bluetooth-auto-recovery";
-  version = "0.4.0";
+  version = "0.5.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -20,7 +21,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-juGrrUqPgg1bJsMZP0iitp0NW/XrCxNq/+/fx5QNkQ4=";
+    hash = "sha256-LvLav3OCud1EZe3JXvjbuuKU9xtd6ywrx6pZLLP0N/A=";
  };

  nativeBuildInputs = [
@ -31,6 +32,7 @@ buildPythonPackage rec {
    async-timeout
    btsocket
    pyric
+    usb-devices
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/can/default.nix
+++ b/pkgs/development/python-modules/can/default.nix
@ -12,42 +12,54 @@
 , pythonOlder
 , typing-extensions
 , wrapt
+, uptime
 }:

 buildPythonPackage rec {
-  pname = "python-can";
-  version = "4.0.0";
+  pname = "can";
+  version = "4.1.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "hardbyte";
-    repo = pname;
-    rev = version;
-    hash = "sha256-/z7zBfVbO7x4UtzWOXolH2YrtYWgsvRLObWwz8sqOEc=";
+    repo = "python-can";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-jNy47SapujTF3ReJtIbwUY53IftIH4cXZjkzHrnZMFQ=";
  };

+  postPatch = ''
+    substituteInPlace tox.ini \
+      --replace " --cov=can --cov-config=tox.ini --cov-report=lcov --cov-report=term" ""
+  '';
+
  propagatedBuildInputs = [
    msgpack
    packaging
-    pyserial
    typing-extensions
    wrapt
  ];

+  passthru.optional-dependencies = {
+    serial = [
+      pyserial
+    ];
+    seeedstudio = [
+      pyserial
+    ];
+    pcan = [
+      uptime
+    ];
+  };
+
  checkInputs = [
    future
    hypothesis
    parameterized
    pytest-timeout
    pytestCheckHook
-  ];
-
-  postPatch = ''
-    substituteInPlace tox.ini \
-      --replace " --cov=can --cov-config=tox.ini --cov-report=xml --cov-report=term" ""
-  '';
+  ] ++ passthru.optional-dependencies.serial;

  disabledTestPaths = [
    # We don't support all interfaces
@ -74,6 +86,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "CAN support for Python";
    homepage = "https://python-can.readthedocs.io";
+    changelog = "https://github.com/hardbyte/python-can/releases/tag/v${version}";
    license = licenses.lgpl3Only;
    maintainers = with maintainers; [ fab sorki ];
  };
--- a/pkgs/development/python-modules/databases/default.nix
+++ b/pkgs/development/python-modules/databases/default.nix
@ -1,42 +1,61 @@
 { lib
+, aiomysql
+, aiopg
+, aiosqlite
+, asyncmy
+, asyncpg
 , buildPythonPackage
 , fetchFromGitHub
-, sqlalchemy
-, aiocontextvars
-, aiopg
-, pythonOlder
 , pytestCheckHook
-, pymysql
-, asyncpg
-, aiomysql
-, aiosqlite
+, pythonOlder
+, sqlalchemy
 }:

 buildPythonPackage rec {
  pname = "databases";
-  version = "0.6.1";
+  version = "0.6.2";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "encode";
    repo = pname;
-    rev = version;
-    hash = "sha256-kHsA9XpolGmtuAGzRTj61igooLG9/LBQyv7TtuqiJ/A=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-3zgHfYGiO2xWualLa4h8A85qjC32ILadw/47Ul1GTmM=";
  };

  propagatedBuildInputs = [
-    aiopg
-    aiomysql
-    aiosqlite
-    asyncpg
-    pymysql
    sqlalchemy
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    aiocontextvars
  ];

+  passthru.optional-dependencies = {
+    postgresql = [
+      asyncpg
+    ];
+    asyncpg = [
+      asyncpg
+    ];
+    aiopg = [
+      aiopg
+    ];
+    mysql = [
+      aiomysql
+    ];
+    aiomysql = [
+      aiomysql
+    ];
+    asyncmy = [
+      asyncmy
+    ];
+    sqlite = [
+      aiosqlite
+    ];
+    aiosqlite = [
+      aiosqlite
+    ];
+  };
+
  checkInputs = [
    pytestCheckHook
  ];
@ -56,6 +75,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Async database support for Python";
    homepage = "https://github.com/encode/databases";
+    changelog = "https://github.com/encode/databases/releases/tag/${version}";
    license = licenses.bsd3;
    maintainers = with maintainers; [ costrouc ];
  };
--- a/pkgs/development/python-modules/elastic-apm/default.nix
+++ b/pkgs/development/python-modules/elastic-apm/default.nix
@ -24,11 +24,12 @@
 , tornado
 , urllib3
 , webob
+, wrapt
 }:

 buildPythonPackage rec {
  pname = "elastic-apm";
-  version = "6.12.0";
+  version = "6.13.2";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -37,7 +38,7 @@ buildPythonPackage rec {
    owner = "elastic";
    repo = "apm-agent-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-tAX96aOPuwtchLk5A1ANuZI5w5H9/yX3Zj9bRSyHv90=";
+    hash = "sha256-HbIra8Cxgn/2xOVEvtcc7rMtSLBmWMxxHlIM44Oy+8U=";
  };

  propagatedBuildInputs = [
@ -48,6 +49,7 @@ buildPythonPackage rec {
    starlette
    tornado
    urllib3
+    wrapt
  ];

  checkInputs = [
@ -84,6 +86,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python agent for the Elastic APM";
    homepage = "https://github.com/elastic/apm-agent-python";
+    changelog = "https://github.com/elastic/apm-agent-python/releases/tag/v${version}";
    license = with licenses; [ bsd3 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/h3/default.nix
+++ b/pkgs/development/python-modules/h3/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "h3";
-  version = "3.7.4";
+  version = "3.7.6";

  # pypi version does not include tests
  src = fetchFromGitHub {
    owner = "uber";
    repo = "h3-py";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-/DtQD2M+5kBn1RxAOobVqtu32+1cxN8lZSuGH613Bwc=";
+    sha256 = "sha256-QNiuiHJ4IMxpi39iobPSSlYUUj5oxpxO4B2+HXVQ/Zk=";
  };

  dontConfigure = true;
--- a/pkgs/development/python-modules/json-logging/default.nix
+++ b/pkgs/development/python-modules/json-logging/default.nix
@ -21,7 +21,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "bobbui";
    repo = "json-logging-python";
-    rev = version;
+    rev = "refs/tags/${version}";
    hash = "sha256-WOAEY1pONH+Gx1b8zHZDMNgJJSn7jvMO60LYTA8z/dE=";
  };

@ -53,6 +53,7 @@ buildPythonPackage rec {
      infrastructure such as ELK, EFK, AWS Cloudwatch, GCP Stackdriver.
    '';
    homepage = "https://github.com/bobbui/json-logging-python";
+    changelog = "https://github.com/bobbui/json-logging-python/releases/tag/${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ AluisioASG ];
  };
--- a/pkgs/development/python-modules/maestral/default.nix
+++ b/pkgs/development/python-modules/maestral/default.nix
@ -27,17 +27,17 @@
 buildPythonPackage rec {
  pname = "maestral";
  version = "1.6.3";
-  disabled = pythonOlder "3.6";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "SamSchott";
    repo = "maestral";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-JVzaWwdHAn5JOruLEN9Z2/5eV1oh3J2NQffNI3RqYfA=";
+    hash = "sha256-JVzaWwdHAn5JOruLEN9Z2/5eV1oh3J2NQffNI3RqYfA=";
  };

-  format = "pyproject";
-
  propagatedBuildInputs = [
    click
    desktop-notifier
@ -83,9 +83,13 @@ buildPythonPackage rec {
    "test_filestatus"
    "test_path_exists_case_insensitive"
    "test_cased_path_candidates"
+    # AssertionError
+    "test_locking_multiprocess"
  ];

-  pythonImportsCheck = [ "maestral" ];
+  pythonImportsCheck = [
+    "maestral"
+  ];

  passthru.tests.maestral = nixosTests.maestral;

--- a/pkgs/development/python-modules/nbconvert/default.nix
+++ b/pkgs/development/python-modules/nbconvert/default.nix
@ -33,7 +33,7 @@ let
  };
 in buildPythonPackage rec {
  pname = "nbconvert";
-  version = "7.2.3";
+  version = "7.2.5";

  disabled = pythonOlder "3.7";

@ -41,7 +41,7 @@ in buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-eufMxoSVtWXasVNFnufmUDmXCRPrEVBw2m4sZzzw6fg=";
+    hash = "sha256-j9xE/X2UJNt/3G4eg0oC9rhiD/tlN2c4i+L56xb4QYQ=";
  };

  # Add $out/share/jupyter to the list of paths that are used to search for
--- a/pkgs/development/python-modules/pysensibo/default.nix
+++ b/pkgs/development/python-modules/pysensibo/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "pysensibo";
-  version = "1.0.21";
+  version = "1.0.22";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -16,14 +16,14 @@ buildPythonPackage rec {
    owner = "andrey-git";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-YvriIG2G0NVlpzT91Ev13OJq8lNluqdEOTIQFQeWekI=";
+    hash = "sha256-AUcdKcdoYCg8OgUcFoLLpNK5GQMTg89XCR5CkTfNkcc=";
  };

  propagatedBuildInputs = [
    aiohttp
  ];

-  # no tests implemented
+  # No tests implemented
  doCheck = false;

  pythonImportsCheck = [
@ -33,6 +33,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Module for interacting with Sensibo";
    homepage = "https://github.com/andrey-git/pysensibo";
+    changelog = "https://github.com/andrey-git/pysensibo/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/python-bsblan/default.nix
+++ b/pkgs/development/python-modules/python-bsblan/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "python-bsblan";
-  version = "0.5.7";
+  version = "0.5.8";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "liudger";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-eavARej+R8SPNuwX6LOGr43SJi1AuZszThJVG00vKhQ=";
+    hash = "sha256-pLqX+gbY71OsLflTyDuL4revj5dXol//eTFVy8iT9O4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pytrafikverket/default.nix
+++ b/pkgs/development/python-modules/pytrafikverket/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "pytrafikverket";
-  version = "0.2.1";
+  version = "0.2.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-LBOq1AvJrRmyWIe2w4dQbWvlRAJN6s2/lsJRI2LZK2o=";
+    hash = "sha256-NWQHrdTKb3RQ7ZjXpHyQ5qPPXuZUU7G+FvBx1VQEbss=";
  };

  propagatedBuildInputs = [
@ -35,6 +35,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Library to get data from the Swedish Transport Administration (Trafikverket) API";
    homepage = "https://github.com/endor-force/pytrafikverket";
+    changelog = "https://github.com/endor-force/pytrafikverket/releases/tag/${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/sanic-routing/default.nix
+++ b/pkgs/development/python-modules/sanic-routing/default.nix
@ -3,25 +3,36 @@
 , fetchFromGitHub
 , pytestCheckHook
 , pytest-asyncio
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "sanic-routing";
-  version = "22.3.0";
+  version = "22.8.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "sanic-org";
    repo = "sanic-routing";
-    rev = "v${version}";
-    hash = "sha256-dX+uxrVjtPxX0ba3WUE/JKgj0PZzvFdKr/lXQgASN6Y=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-2T6WY0nzvr8Q9lBoStzmX7m7Ct35lcG53OSLcqxkEcY=";
  };

-  checkInputs = [ pytestCheckHook pytest-asyncio ];
-  pythonImportsCheck = [ "sanic_routing" ];
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "sanic_routing"
+  ];

  meta = with lib; {
    description = "Core routing component for the Sanic web framework";
    homepage = "https://github.com/sanic-org/sanic-routing";
+    changelog = "https://github.com/sanic-org/sanic-routing/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ AluisioASG ];
  };
--- a/pkgs/development/python-modules/sanic-testing/default.nix
+++ b/pkgs/development/python-modules/sanic-testing/default.nix
@ -1,21 +1,25 @@
 { lib
 , buildPythonPackage
+, callPackage
 , fetchFromGitHub
 , httpx
+, pythonOlder
 , sanic
 , websockets
-, callPackage
 }:

 buildPythonPackage rec {
  pname = "sanic-testing";
-  version = "22.3.1";
+  version = "22.9.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "sanic-org";
    repo = "sanic-testing";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-6aJyc5B9e65RPG3FwXAoQByVNdrLAWTEu2/Dqf9hf+g=";
+    hash = "sha256-o0uXeIw2wV9sxGkEH5jPrQvRj1W2CsUU2n+8R8Ta12Y=";
  };

  outputs = [
@ -23,10 +27,6 @@ buildPythonPackage rec {
    "testsout"
  ];

-  postPatch = ''
-    sed -i 's/httpx>=.*"/httpx"/' setup.py
-  '';
-
  propagatedBuildInputs = [
    httpx
    sanic
@ -38,8 +38,9 @@ buildPythonPackage rec {
    cp -R tests $testsout/tests
  '';

-  # check in passthru.tests.pytest to escape infinite recursion with sanic
+  # Check in passthru.tests.pytest to escape infinite recursion with sanic
  doCheck = false;
+
  doInstallCheck = false;

  passthru.tests = {
@ -49,6 +50,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Core testing clients for the Sanic web framework";
    homepage = "https://github.com/sanic-org/sanic-testing";
+    changelog = "https://github.com/sanic-org/sanic-testing/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ AluisioASG ];
  };
--- a/pkgs/development/python-modules/sanic/default.nix
+++ b/pkgs/development/python-modules/sanic/default.nix
@ -25,7 +25,7 @@

 buildPythonPackage rec {
  pname = "sanic";
-  version = "22.6.2";
+  version = "22.9.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -33,8 +33,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "sanic-org";
    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-krEQd0ak9Uua+r+pYmLStlizgE4HmZBO8Q0I2/gWAwU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-KbcHnAdr59hk7W36BiTb/hD74ktj/DGzq1vcuZ/lGfQ=";
  };

  propagatedBuildInputs = [
@ -104,6 +104,13 @@ buildPythonPackage rec {
    "test_keep_alive_client_timeout"
    "test_keep_alive_server_timeout"
    "test_zero_downtime"
+    # TLS tests
+    "test_missing_sni"
+    "test_no_matching_cert"
+    "test_wildcards"
+    # They thtow execptions
+    "test_load_app_simple"
+    "worker/test_loader.py"
    # broke with ujson 5.4 upgrade
    # https://github.com/sanic-org/sanic/pull/2504
    "test_json_response_json"
@ -129,6 +136,7 @@ buildPythonPackage rec {
    broken = stdenv.isDarwin;
    description = "Web server and web framework";
    homepage = "https://github.com/sanic-org/sanic/";
+    changelog = "https://github.com/sanic-org/sanic/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ costrouc AluisioASG ];
  };
--- a/pkgs/development/python-modules/usb-devices/default.nix
+++ b/pkgs/development/python-modules/usb-devices/default.nix
@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "usb-devices";
+  version = "0.4.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "Bluetooth-Devices";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9w7YCAEpdptQC0GCnJCEyhZgcHMDIw0alj7q4Y82hmA=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=usb_devices --cov-report=term-missing:skip-covered" ""
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "usb_devices"
+  ];
+
+  meta = with lib; {
+    description = "Library for for mapping, describing, and resetting USB devices";
+    homepage = "https://github.com/Bluetooth-Devices/usb-devices";
+    changelog = "https://github.com/Bluetooth-Devices/usb-devices/blob/v${version}/CHANGELOG.md";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/tools/build-managers/bazel/bazel_3/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_3/default.nix
@ -5,7 +5,7 @@
 , lr, xe, zip, unzip, bash, writeCBin, coreutils
 , which, gawk, gnused, gnutar, gnugrep, gzip, findutils
 # updater
-, python27, python3, writeScript
+, python3, writeScript
 # Apple dependencies
 , cctools, libcxx, CoreFoundation, CoreServices, Foundation
 # Allow to independently override the jdks used to build and run respectively
@ -406,11 +406,9 @@ stdenv.mkDerivation rec {

    genericPatches = ''
      # Substitute j2objc and objc wrapper's python shebang to plain python path.
-      # These scripts explicitly depend on Python 2.7, hence we use python27.
-      # See also `postFixup` where python27 is added to $out/nix-support
-      substituteInPlace tools/j2objc/j2objc_header_map.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
-      substituteInPlace tools/j2objc/j2objc_wrapper.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
-      substituteInPlace tools/objc/j2objc_dead_code_pruner.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
+      substituteInPlace tools/j2objc/j2objc_header_map.py --replace "$!/usr/bin/python2.7" "#!${python3.interpreter}"
+      substituteInPlace tools/j2objc/j2objc_wrapper.py --replace "$!/usr/bin/python2.7" "#!${python3.interpreter}"
+      substituteInPlace tools/objc/j2objc_dead_code_pruner.py --replace "$!/usr/bin/python2.7" "#!${python3.interpreter}"

      # md5sum is part of coreutils
      sed -i 's|/sbin/md5|md5sum|g' \
@ -424,8 +422,6 @@ stdenv.mkDerivation rec {
      grep -rlZ /bin src/main/java/com/google/devtools | while IFS="" read -r -d "" path; do
        # If you add more replacements here, you must change the grep above!
        # Only files containing /bin are taken into account.
-        # We default to python3 where possible. See also `postFixup` where
-        # python3 is added to $out/nix-support
        substituteInPlace "$path" \
          --replace /bin/bash ${customBash}/bin/bash \
          --replace "/usr/bin/env bash" ${customBash}/bin/bash \
@ -616,10 +612,6 @@ stdenv.mkDerivation rec {
    echo "${customBash} ${defaultShellPath}" >> $out/nix-support/depends
    # The templates get tar’d up into a .jar,
    # so nix can’t detect python is needed in the runtime closure
-    # Some of the scripts explicitly depend on Python 2.7. Otherwise, we
-    # default to using python3. Therefore, both python27 and python3 are
-    # runtime dependencies.
-    echo "${python27}" >> $out/nix-support/depends
    echo "${python3}" >> $out/nix-support/depends
    # The string literal specifying the path to the bazel-rc file is sometimes
    # stored non-contiguously in the binary due to gcc optimisations, which leads
--- a/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
@ -7,7 +7,7 @@
 , lr, xe, zip, unzip, bash, writeCBin, coreutils
 , which, gawk, gnused, gnutar, gnugrep, gzip, findutils
 # updater
-, python27, python3, writeScript
+, python3, writeScript
 # Apple dependencies
 , cctools, libcxx, CoreFoundation, CoreServices, Foundation
 # Allow to independently override the jdks used to build and run respectively
@ -102,10 +102,6 @@ let
    #            "@bison//:bin/bison",
    #        ],
    #     )
-    #
-    # Some of the scripts explicitly depend on Python 2.7. Otherwise, we
-    # default to using python3. Therefore, both python27 and python3 are
-    # runtime dependencies.
    [
      bash
      coreutils
@ -116,7 +112,6 @@ let
      gnused
      gnutar
      gzip
-      python27
      python3
      unzip
      which
@ -432,11 +427,9 @@ stdenv.mkDerivation rec {

    genericPatches = ''
      # Substitute j2objc and objc wrapper's python shebang to plain python path.
-      # These scripts explicitly depend on Python 2.7, hence we use python27.
-      # See also `postFixup` where python27 is added to $out/nix-support
-      substituteInPlace tools/j2objc/j2objc_header_map.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
-      substituteInPlace tools/j2objc/j2objc_wrapper.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
-      substituteInPlace tools/objc/j2objc_dead_code_pruner.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
+      substituteInPlace tools/j2objc/j2objc_header_map.py --replace "$!/usr/bin/python2.7" "#!${python3.interpreter}"
+      substituteInPlace tools/j2objc/j2objc_wrapper.py --replace "$!/usr/bin/python2.7" "#!${python3.interpreter}"
+      substituteInPlace tools/objc/j2objc_dead_code_pruner.py --replace "$!/usr/bin/python2.7" "#!${python3.interpreter}"

      # md5sum is part of coreutils
      sed -i 's|/sbin/md5|md5sum|g' \
@ -450,8 +443,6 @@ stdenv.mkDerivation rec {
      grep -rlZ /bin/ src/main/java/com/google/devtools | while IFS="" read -r -d "" path; do
        # If you add more replacements here, you must change the grep above!
        # Only files containing /bin are taken into account.
-        # We default to python3 where possible. See also `postFixup` where
-        # python3 is added to $out/nix-support
        substituteInPlace "$path" \
          --replace /bin/bash ${bash}/bin/bash \
          --replace "/usr/bin/env bash" ${bash}/bin/bash \
--- a/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
@ -7,7 +7,7 @@
 , lr, xe, zip, unzip, bash, writeCBin, coreutils
 , which, gawk, gnused, gnutar, gnugrep, gzip, findutils
 # updater
-, python27, python3, writeScript
+, python3, writeScript
 # Apple dependencies
 , cctools, libcxx, sigtool, CoreFoundation, CoreServices, Foundation
 # Allow to independently override the jdks used to build and run respectively
@ -100,10 +100,6 @@ let
    #            "@bison//:bin/bison",
    #        ],
    #     )
-    #
-    # Some of the scripts explicitly depend on Python 2.7. Otherwise, we
-    # default to using python3. Therefore, both python27 and python3 are
-    # runtime dependencies.
    [
      bash
      coreutils
@ -114,7 +110,6 @@ let
      gnused
      gnutar
      gzip
-      python27
      python3
      unzip
      which
@ -393,11 +388,9 @@ stdenv.mkDerivation rec {

    genericPatches = ''
      # Substitute j2objc and objc wrapper's python shebang to plain python path.
-      # These scripts explicitly depend on Python 2.7, hence we use python27.
-      # See also `postFixup` where python27 is added to $out/nix-support
-      substituteInPlace tools/j2objc/j2objc_header_map.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
-      substituteInPlace tools/j2objc/j2objc_wrapper.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
-      substituteInPlace tools/objc/j2objc_dead_code_pruner.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
+      substituteInPlace tools/j2objc/j2objc_header_map.py --replace "$!/usr/bin/python2.7" "#!${python3.interpreter}"
+      substituteInPlace tools/j2objc/j2objc_wrapper.py --replace "$!/usr/bin/python2.7" "#!${python3.interpreter}"
+      substituteInPlace tools/objc/j2objc_dead_code_pruner.py --replace "$!/usr/bin/python2.7" "#!${python3.interpreter}"

      # md5sum is part of coreutils
      sed -i 's|/sbin/md5|md5sum|g' \
@ -414,8 +407,6 @@ stdenv.mkDerivation rec {
      grep -rlZ /bin/ src/main/java/com/google/devtools | while IFS="" read -r -d "" path; do
        # If you add more replacements here, you must change the grep above!
        # Only files containing /bin are taken into account.
-        # We default to python3 where possible. See also `postFixup` where
-        # python3 is added to $out/nix-support
        substituteInPlace "$path" \
          --replace /bin/bash ${bash}/bin/bash \
          --replace "/usr/bin/env bash" ${bash}/bin/bash \
@ -426,7 +417,7 @@ stdenv.mkDerivation rec {

      grep -rlZ /bin/ tools/python | while IFS="" read -r -d "" path; do
        substituteInPlace "$path" \
-          --replace "/usr/bin/env python2" ${python27}/bin/python \
+          --replace "/usr/bin/env python2" ${python3.interpreter} \
          --replace "/usr/bin/env python3" ${python3}/bin/python \
          --replace /usr/bin/env ${coreutils}/bin/env
      done
--- a/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
@ -7,7 +7,7 @@
 , lr, xe, zip, unzip, bash, writeCBin, coreutils
 , which, gawk, gnused, gnutar, gnugrep, gzip, findutils
 # updater
-, python27, python3, writeScript
+, python3, writeScript
 # Apple dependencies
 , cctools, libcxx, CoreFoundation, CoreServices, Foundation
 # Allow to independently override the jdks used to build and run respectively
@ -103,10 +103,6 @@ let
    #            "@bison//:bin/bison",
    #        ],
    #     )
-    #
-    # Some of the scripts explicitly depend on Python 2.7. Otherwise, we
-    # default to using python3. Therefore, both python27 and python3 are
-    # runtime dependencies.
    [
      bash
      coreutils
@ -117,7 +113,6 @@ let
      gnused
      gnutar
      gzip
-      python27
      python3
      unzip
      which
@ -414,8 +409,6 @@ stdenv.mkDerivation rec {
      grep -rlZ /bin/ src/main/java/com/google/devtools | while IFS="" read -r -d "" path; do
        # If you add more replacements here, you must change the grep above!
        # Only files containing /bin are taken into account.
-        # We default to python3 where possible. See also `postFixup` where
-        # python3 is added to $out/nix-support
        substituteInPlace "$path" \
          --replace /bin/bash ${bash}/bin/bash \
          --replace "/usr/bin/env bash" ${bash}/bin/bash \
@ -426,7 +419,7 @@ stdenv.mkDerivation rec {

      grep -rlZ /bin/ tools/python | while IFS="" read -r -d "" path; do
        substituteInPlace "$path" \
-          --replace "/usr/bin/env python2" ${python27}/bin/python \
+          --replace "/usr/bin/env python2" ${python3.interpreter} \
          --replace "/usr/bin/env python3" ${python3}/bin/python \
          --replace /usr/bin/env ${coreutils}/bin/env
      done
--- a/pkgs/development/tools/flatpak-builder/default.nix
+++ b/pkgs/development/tools/flatpak-builder/default.nix
@ -80,7 +80,9 @@ in stdenv.mkDerivation rec {
    # this on our patch for Flatpak 0.99.
    (substituteAll {
      src = ./fix-test-paths.patch;
-      inherit glibcLocales python2;
+      inherit glibcLocales;
+      # FIXME use python3 for tests that rely on python2
+      # inherit python2;
    })
  ];

@ -137,7 +139,7 @@ in stdenv.mkDerivation rec {
    installedTestsDependencies = [
      gnupg
      ostree
-      python2
+      # FIXME python2
      gnumake
    ];

--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "just";
-  version = "1.8.0";
+  version = "1.9.0";

  src = fetchFromGitHub {
    owner = "casey";
    repo = pname;
    rev = version;
-    hash = "sha256-mzVwdvMYpThSPGvM3hpuKzeHZW5HOwkEfONIN/aziXY=";
+    hash = "sha256-qoKmYFwGgJrv39g6XvcUkYkjjfrfcxAztjsuTxwnVBM=";
  };

-  cargoSha256 = "sha256-dDaXmJ4wFJaE59qR5Bxvoz/Jrwt6hhWhJI8wLRXCLcU=";
+  cargoSha256 = "sha256-XJkcwaDgorRwKmMTMGN2z9ONTlO0ftjP9V4/OPpDClc=";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "terraform-ls";
-  version = "0.29.3";
+  version = "0.30.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-CYbeRhwoffyELM0REZL14m4tTe/66GDToqNKcEfmums=";
+    sha256 = "sha256-CyWOXyJ9c7gf+WznU1SLX7tEM1f95015w9ePVwZ7GJU=";
  };
-  vendorSha256 = "sha256-wbB3/RfzL05SaLv49gs7WKrjV//dM3SjpbMNGI1yH4I=";
+  vendorSha256 = "sha256-UYFw9srf4FcF2XGIfsJQsRapEwcOHql59rKeKUnXPLo=";

  ldflags = [ "-s" "-w" "-X main.version=v${version}" "-X main.prerelease=" ];

--- a/pkgs/development/tools/uniffi-bindgen/default.nix
+++ b/pkgs/development/tools/uniffi-bindgen/default.nix
@ -6,18 +6,19 @@
 , yapf
 , rubocop
 , rustfmt
+, nix-update-script
 }:

 rustPlatform.buildRustPackage rec {
  pname = "uniffi-bindgen";
-  version = "0.20.0";
+  version = "0.21.0";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-E0OMMg9GuZCwPuJKzMpN0PNxZicGW1blD322Jl01qQE=";
+    sha256 = "sha256-yVpxyYaFkX1HuFi4xcj45rsMbMIcdTHs9zfGvtcFdH8=";
  };

-  cargoSha256 = "sha256-REY88irDm45JOBwdb79JVrIyfuOB6HcAgIzYO65O0uE=";
+  cargoSha256 = "sha256-qn27aRVdD+/EWmCSF2t+CdMhtOknDCVnG9uDa2Rwf0A=";

  nativeBuildInputs = [ makeWrapper ];

@ -31,6 +32,10 @@ rustPlatform.buildRustPackage rec {
      --suffix PATH : ${lib.strings.makeBinPath [ ktlint yapf rubocop rustfmt ] }
  '';

+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
  meta = with lib; {
    description = "Toolkit for building cross-platform software components in Rust";
    homepage = "https://mozilla.github.io/uniffi-rs/";
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
@ -303,7 +303,7 @@ in rec {
        workspaceDependenciesTransitive;

    in stdenv.mkDerivation (builtins.removeAttrs attrs ["yarnNix" "pkgConfig" "workspaceDependencies" "packageResolutions"] // {
-      inherit src pname;
+      inherit src version pname;

      name = baseName;

@ -376,11 +376,10 @@ in rec {

      meta = {
        inherit (nodejs.meta) platforms;
-        description = packageJSON.description or "";
-        homepage = packageJSON.homepage or "";
-        version = packageJSON.version or "";
-        license = if packageJSON ? license then getLicenseFromSpdxId packageJSON.license else "";
-      } // (attrs.meta or {});
+      } // lib.optionalAttrs (package ? description) { inherit (package) description; }
+        // lib.optionalAttrs (package ? homepage) { inherit (package) homepage; }
+        // lib.optionalAttrs (package ? license) { license = getLicenseFromSpdxId package.license; }
+        // (attrs.meta or {});
    });

  yarn2nix = mkYarnPackage {
--- a/pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPackages, stdenvNoCC, autoreconfHook, fetchurl }:
+{ lib, buildPackages, stdenvNoCC, autoreconfHook, fetchurl, fetchpatch }:

 stdenvNoCC.mkDerivation rec {
  pname = "alsa-firmware";
@ -9,6 +9,14 @@ stdenvNoCC.mkDerivation rec {
    sha256 = "sha256-tnttfQi8/CR+9v8KuIqZwYgwWjz1euLf0LzZpbNs1bs=";
  };

+  patches = [
+    # fixes some includes / missing types on musl libc; should not make a difference for other platforms
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/ae690000017d5fd355ab397c49202426e3a01c11/srcpkgs/alsa-firmware/patches/musl.patch";
+      sha256 = "sha256-4A+TBBvpz14NwMNewLc2LQL51hnz4EZlZ44rhnx5dnc=";
+    })
+  ];
+
  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ autoreconfHook ];

--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -2,52 +2,52 @@
    "4.14": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.14.299-hardened1.patch",
-            "sha256": "1qgsi8kfbfqqkb2n0irqfrbq865dz4f5hmhxq7fbmnpacjgwdy6a",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.299-hardened1/linux-hardened-4.14.299-hardened1.patch"
+            "name": "linux-hardened-4.14.300-hardened1.patch",
+            "sha256": "1y43qxcn00w1gayjj1rr3vfws8m4f2p9nz080nqilw0g14kq73sa",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.300-hardened1/linux-hardened-4.14.300-hardened1.patch"
        },
-        "sha256": "0p5ic2mrb9vl3qkzvqxhia3kygjv8xa6s1kqkwgd6b4rmq1kc8r6",
-        "version": "4.14.299"
+        "sha256": "047vmh09icm45g7mnmdvyj9cam7747bcpah1s7n9dm5i2j2f906y",
+        "version": "4.14.300"
    },
    "4.19": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.19.265-hardened1.patch",
-            "sha256": "0psqvwqvq981hvix58z5bhc4xvgm2ic5y4q7bwsnh1cfvbfg6x2k",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.265-hardened1/linux-hardened-4.19.265-hardened1.patch"
+            "name": "linux-hardened-4.19.267-hardened1.patch",
+            "sha256": "0phlfwigzh2j5j8xjqamywqn8libpzvhingx0vjxggf0wqxvgix0",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.267-hardened1/linux-hardened-4.19.267-hardened1.patch"
        },
-        "sha256": "1l5cdpgng1gci1p1gdr2jzqw486h3w56gpyc7fbq74hlc6nnwh1p",
-        "version": "4.19.265"
+        "sha256": "035yxx13jz5f5ig2r6ybzgivm8vjafgnvjws0jfzha4w6klf7r9l",
+        "version": "4.19.267"
    },
    "5.10": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.10.154-hardened1.patch",
-            "sha256": "0srwi4033h8ypxbwwp1hb3y989jvlwzckvsfjkxzgpnj91i68hn9",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.154-hardened1/linux-hardened-5.10.154-hardened1.patch"
+            "name": "linux-hardened-5.10.156-hardened1.patch",
+            "sha256": "1caf5136i8k4afr1jfbnnqgbhq877in3azicbpazcgv1js9f0n30",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.156-hardened1/linux-hardened-5.10.156-hardened1.patch"
        },
-        "sha256": "12763vlnrgmgj03khj9ls2g7zlhclj9g1l3008b36j9jli6kvbn6",
-        "version": "5.10.154"
+        "sha256": "08srjps110zi4ivzh0z2jf78ddyfj2wivdliffb2f03jr9j9k7k7",
+        "version": "5.10.156"
    },
    "5.15": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.15.78-hardened1.patch",
-            "sha256": "1aavp00rswqbbpbyx0c7k2ga6lcd221gcgr4893q7w5z26mv7wkd",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.78-hardened1/linux-hardened-5.15.78-hardened1.patch"
+            "name": "linux-hardened-5.15.79-hardened1.patch",
+            "sha256": "102zaxvyjq1gwnp69w3941ni92sv7k1fsf35f1f9vj0hj6jig7j3",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.79-hardened1/linux-hardened-5.15.79-hardened1.patch"
        },
-        "sha256": "16d4d4g5n2g6jpp8bvad1bm1l0b0nb4ckwsmq6w2g3538xrrzf8d",
-        "version": "5.15.78"
+        "sha256": "0m61k7k6lj24z9a266q08wzghggjik2wizcabdwd1vn0vcqr18yb",
+        "version": "5.15.79"
    },
    "5.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.4.224-hardened1.patch",
-            "sha256": "1cx0h6sn8wdggg9nwqlrij7cfpa9q6nah73nrv92b4c9n8sjqiwq",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.224-hardened1/linux-hardened-5.4.224-hardened1.patch"
+            "name": "linux-hardened-5.4.225-hardened1.patch",
+            "sha256": "09h8bjq73fyx6kqk0kcy3z2a0cs32gg4visv859siwb8rw1ziva2",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.225-hardened1/linux-hardened-5.4.225-hardened1.patch"
        },
-        "sha256": "0dixs4w7nmkjgxv9dxgjdy8v6r4parkpqyvdfyr0wqk0amdz4zcb",
-        "version": "5.4.224"
+        "sha256": "1ak0qlxzfylgvkldh2whq4mzynh1rymhnnc1yif9a5s3f7v9dxar",
+        "version": "5.4.225"
    },
    "6.0": {
        "patch": {
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.14.299";
+  version = "4.14.300";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0p5ic2mrb9vl3qkzvqxhia3kygjv8xa6s1kqkwgd6b4rmq1kc8r6";
+    sha256 = "047vmh09icm45g7mnmdvyj9cam7747bcpah1s7n9dm5i2j2f906y";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.19.265";
+  version = "4.19.267";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1l5cdpgng1gci1p1gdr2jzqw486h3w56gpyc7fbq74hlc6nnwh1p";
+    sha256 = "035yxx13jz5f5ig2r6ybzgivm8vjafgnvjws0jfzha4w6klf7r9l";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.10.155";
+  version = "5.10.156";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1wyla96qsdf50n7qjj4hdf36bj56whv7gc9mgw9bvrsqdi92gc7i";
+    sha256 = "08srjps110zi4ivzh0z2jf78ddyfj2wivdliffb2f03jr9j9k7k7";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.15.79";
+  version = "5.15.80";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0m61k7k6lj24z9a266q08wzghggjik2wizcabdwd1vn0vcqr18yb";
+    sha256 = "0kgxznd3sfbmnygjvp9dzhzg5chxlaxk6kldxmh1y0njcrj1lciv";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.4.224";
+  version = "5.4.225";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0dixs4w7nmkjgxv9dxgjdy8v6r4parkpqyvdfyr0wqk0amdz4zcb";
+    sha256 = "1ak0qlxzfylgvkldh2whq4mzynh1rymhnnc1yif9a5s3f7v9dxar";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-6.0.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.0.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "6.0.9";
+  version = "6.0.10";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1irip1yk62carcisxlacwcxsiqib4qswx6h5mfhv8f97x04a4531";
+    sha256 = "1l0xak4w7c16cg8lhracy8r18zzdl0x5s654w6ivyw6dhk6pzr9r";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18978";
-    sha256 = "12mvj5c2k774fpmixcv7i4ciw7xqjaxqd20ryn8xw8vgrnb4h6fi";
+    rev = "18996";
+    sha256 = "0dflbcpdd75xwy5amk9665q9w6dvrybs0sdm61c6pydx4kd0b3ws";
  }
 , ...
 }:
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "consul";
-  version = "1.14.0";
+  version = "1.14.1";
  rev = "v${version}";

  # Note: Currently only release tags are supported, because they have the Consul UI
@ -17,7 +17,7 @@ buildGoModule rec {
    owner = "hashicorp";
    repo = pname;
    inherit rev;
-    sha256 = "sha256-so+JtDcIWRF8HaoiqalxKxzl8ITonDABXK07guwIYRA=";
+    sha256 = "sha256-iitwWFtgz4juqNFa6d6c+OzVo227gOOyWSwz+4cDgsc=";
  };

  passthru.tests.consul = nixosTests.consul;
@ -26,7 +26,7 @@ buildGoModule rec {
  # has a split module structure in one repo
  subPackages = ["." "connect/certgen"];

-  vendorSha256 = "sha256-cCfC/PcpNRQ3UL7OGk2ydCN8wNPvyJTGYMANfqpMHKg=";
+  vendorSha256 = "sha256-hECWi+jWfrmIqzsWQSoWxohGbF9Hcg2ZkBHBaTrjK+U=";

  doCheck = false;

--- a/pkgs/servers/frr/default.nix
+++ b/pkgs/servers/frr/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch

 # build time
 , autoreconfHook
@ -33,23 +32,15 @@

 stdenv.mkDerivation rec {
  pname = "frr";
-  version = "8.3.1";
+  version = "8.4.1";

  src = fetchFromGitHub {
    owner = "FRRouting";
    repo = pname;
    rev = "${pname}-${version}";
-    hash = "sha256-+M4xTdjCp5TJh0U8ZfUmw84Y7O0TZ9mmUXhh2J/QOE0=";
+    hash = "sha256-SJKDIs6bL8NroSieNeSYBv+8JTGgFdhP4WYKUWYhpbk=";
  };

-  patches = [
-    (fetchpatch {
-      name = "CVE-2022-37032.patch";
-      url = "https://github.com/FRRouting/frr/commit/ff6db1027f8f36df657ff2e5ea167773752537ed.patch";
-      sha256 = "sha256-b3nT6xco620hMSqlj/nTWTJCegf3ARAGaQbii4Yq6Ag=";
-    })
-  ];
-
  nativeBuildInputs = [
    autoreconfHook
    bison
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@ -79,11 +79,11 @@ stdenv.mkDerivation {
    "--http-log-path=/var/log/nginx/access.log"
    "--error-log-path=/var/log/nginx/error.log"
    "--pid-path=/var/log/nginx/nginx.pid"
-    "--http-client-body-temp-path=/var/cache/nginx/client_body"
-    "--http-proxy-temp-path=/var/cache/nginx/proxy"
-    "--http-fastcgi-temp-path=/var/cache/nginx/fastcgi"
-    "--http-uwsgi-temp-path=/var/cache/nginx/uwsgi"
-    "--http-scgi-temp-path=/var/cache/nginx/scgi"
+    "--http-client-body-temp-path=/tmp/nginx_client_body"
+    "--http-proxy-temp-path=/tmp/nginx_proxy"
+    "--http-fastcgi-temp-path=/tmp/nginx_fastcgi"
+    "--http-uwsgi-temp-path=/tmp/nginx_uwsgi"
+    "--http-scgi-temp-path=/tmp/nginx_scgi"
  ] ++ optionals withDebug [
    "--with-debug"
  ] ++ optionals withKTLS [
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@ -9,13 +9,13 @@

 buildDotnetModule rec {
  pname = "jackett";
-  version = "0.20.2271";
+  version = "0.20.2291";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "Sngvd9OWCB2I0qfYvb7yEGb7HiWuHtc+jU6O5r68mbU=";
+    sha256 = "cJ+muM6dv7pgV1uKsvZuodghi7Y1K5HQKt9ZcIrYLmw=";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/servers/krill/default.nix
+++ b/pkgs/servers/krill/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "krill";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "NLnetLabs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-0b8db5WYYHean+Ra2KNrLJcv5p7ofClX7So9qwhz6WQ=";
+    hash = "sha256-U74x6zEQS/3JjzIeYlosqISZoZM7cOMcheJKtRYnPyo=";
  };

-  cargoSha256 = "sha256-Ju71IyID6ZcKpU1RGJtwj4niORsnUaRfDfJArptjCF4=";
+  cargoSha256 = "sha256-CH97R9VGT7SFdJs6kWDIdOaV5Q6FtOPZ1tKcmI+zRgE=";

  buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/servers/mautrix-telegram/default.nix
+++ b/pkgs/servers/mautrix-telegram/default.nix
@ -9,11 +9,11 @@ let
  python = python3.override {
    packageOverrides = self: super: {
      tulir-telethon = self.telethon.overridePythonAttrs (oldAttrs: rec {
-        version = "1.26.0a5";
+        version = "1.27.0a1";
        pname = "tulir-telethon";
        src = super.fetchPypi {
          inherit pname version;
-          sha256 = "sha256-s6pj9kHqcl6XU1KQ/aOw1XWQ3CyDotaDl0m7aj9SbW4=";
+          sha256 = "sha256-tABAY4UlTyMK1ZafIFawegjBAtcnq3HMNbE1L6WaT3E=";
        };
        doCheck = false;
      });
@ -21,23 +21,18 @@ let
  };
 in python.pkgs.buildPythonPackage rec {
  pname = "mautrix-telegram";
-  version = "0.12.1";
+  version = "0.12.2";
  disabled = python.pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "mautrix";
    repo = "telegram";
    rev = "v${version}";
-    sha256 = "sha256-ecNcoNz++HtuDZnDLsXfPL0MRF+XMQ1BU/NFkKPbD5U=";
+    sha256 = "sha256-htCk0VLr6GfXbpYWF/2bmpko7gSVlkH6HwDjOMhW8is=";
  };

  patches = [ ./0001-Re-add-entrypoint.patch ];

-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "asyncpg>=0.20,<0.27" "asyncpg>=0.20"
-  '';
-
  propagatedBuildInputs = with python.pkgs; ([
    ruamel-yaml
    python-magic
--- a/pkgs/servers/monitoring/prometheus/snmp-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/snmp-exporter.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "snmp_exporter";
-  version = "0.20.0";
+  version = "0.21.0";

  src = fetchFromGitHub {
    owner = "prometheus";
    repo = "snmp_exporter";
    rev = "v${version}";
-    sha256 = "0qwbnx3l25460qbah4ik9mlcyrm31rwm51451gh0jprii80cf16x";
+    sha256 = "sha256-ko2PApbz8kL0n6IEsRKLwMq9WmAdvfwI6o7ZH/BTd6c=";
  };

-  vendorSha256 = "1rivil3hwk269ikrwc4i22k2y5c9zs5ac058y7llz8ivrrjr2w4h";
+  vendorSha256 = "sha256-nbJXiZ+vHN/EnvAPTJUKotCE+nwdrXtWHhGfugm+CQQ=";

  buildInputs = [ net-snmp ];

--- a/pkgs/servers/mqtt/nanomq/default.nix
+++ b/pkgs/servers/mqtt/nanomq/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, cmake, ninja, mbedtls, sqlite }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "nanomq";
-  version = "0.13.1";
+  version = "0.13.6";

  src = fetchFromGitHub {
    owner = "emqx";
    repo = "nanomq";
-    rev = version;
-    hash = "sha256-FJhM1IdS6Ee54JJqJXpvp0OcTJJo2NaB/uP8w3mf/Yw=";
+    rev = finalAttrs.version;
+    hash = "sha256-CZxUDuuXuC2MqiJZiJ/JwlORou6OXeuSieLG4LAnhuA=";
    fetchSubmodules = true;
  };

@ -33,4 +33,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ sikmir ];
    platforms = platforms.unix;
  };
-}
+})
--- a/pkgs/servers/pinnwand/default.nix
+++ b/pkgs/servers/pinnwand/default.nix
@ -7,24 +7,16 @@

 with python3.pkgs; buildPythonApplication rec {
  pname = "pinnwand";
-  version = "1.3.0";
+  version = "1.4.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "supakeen";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "046xk2y59wa0pdp7s3hp1gh8sqdw0yl4xab22r2x44iwwcyb0gy5";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-zJH2ojLQChElRvU2TWg4lW+Mey+wP0XbLJhVF16nvss=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'click = "^7.0"' 'click = "*"' \
-      --replace 'docutils = "^0.16"' 'docutils = "*"' \
-      --replace 'sqlalchemy = "^1.3"' 'sqlalchemy = "*"' \
-      --replace 'token-bucket = "^0.2.0"' 'token-bucket = "*"'
-  '';
-
  nativeBuildInputs = [
    poetry-core
  ];
@ -36,15 +28,12 @@ with python3.pkgs; buildPythonApplication rec {
    pygments-better-html
    sqlalchemy
    token-bucket
-    toml
+    tomli
    tornado
  ];

-  checkInputs = [ pytestCheckHook ];
-
-  disabledTests = [
-    # pygments renamed rst to restructuredText, hence a mismatch on this test
-    "test_guess_language"
+  checkInputs = [
+    pytestCheckHook
  ];

  __darwinAllowLocalNetworking = true;
@ -52,9 +41,10 @@ with python3.pkgs; buildPythonApplication rec {
  passthru.tests = nixosTests.pinnwand;

  meta = with lib; {
+    changelog = "https://github.com/supakeen/pinnwand/releases/tag/v${version}";
+    description = "A Python pastebin that tries to keep it simple";
    homepage = "https://supakeen.com/project/pinnwand/";
    license = licenses.mit;
-    description = "A Python pastebin that tries to keep it simple";
    maintainers = with maintainers; [ hexa ];
  };
 }
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@ -2,11 +2,11 @@
 , dataPath ? "/var/lib/snappymail" }:
 stdenv.mkDerivation rec {
  pname = "snappymail";
-  version = "2.21.4";
+  version = "2.22.3";

  src = fetchurl {
    url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-NxE3weZRI06scDZHSL5QjL+boc0GVffHCTzBxncBIuU=";
+    sha256 = "sha256-NznRHgBHapuuDxTWzD6xW+x1tu9TIdQ4mXFYDIhR1y0=";
  };

  sourceRoot = "snappymail";
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.120.0";
+  version = "0.121.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = version;
-    sha256 = "sha256-XrXT+SivZ240lSiCWmxB4N4miI6xYojqLVmDJbhhWko=";
+    sha256 = "sha256-PeUmOFtsca8SLeHHOjYVJURAsbWpLWNfSEPUXYsQhSE=";
  };

  vendorSha256 = "sha256-S1gnnhI0U7OLd6vEW5qpxGAiOdORYWsEst11Vfj6pdI=";
--- a/pkgs/tools/admin/pulumi/default.nix
+++ b/pkgs/tools/admin/pulumi/default.nix
@ -14,16 +14,16 @@

 buildGoModule rec {
  pname = "pulumi";
-  version = "3.47.2";
+  version = "3.48.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Px1PPCnVNHTMdKyj1kwdfdsc+Hpuqwcnsin0+tPNtfU=";
+    hash = "sha256-8lHNcRYvKa9CJDWe4g4h24TY6mwfYfyQwBcQ4cY/tdQ=";
  };

-  vendorSha256 = "sha256-cijM5R2Z/g3MJPOYDIeLSqTuVJvIKQbun+26FWHn2AI=";
+  vendorSha256 = "sha256-igZfXUrYA6m42WrBQkQYyGe5p9C8h66Hkezf9a1XFo0=";

  sourceRoot = "source/pkg";

--- a/pkgs/tools/audio/kaldi/default.nix
+++ b/pkgs/tools/audio/kaldi/default.nix
@ -25,19 +25,18 @@ let
 in
 stdenv.mkDerivation {
  pname = "kaldi";
-  version = "2021-12-03";
+  version = "unstable-2022-09-26";

  src = fetchFromGitHub {
    owner = "kaldi-asr";
    repo = "kaldi";
-    rev = "2b016ab8cb018e031ab3bf01ec36cc2950c7e509";
-    sha256 = "sha256-R8CrY7cwU5XfeGEgeFuZ0ApsEcEmWN/lrZaCjz85tyk=";
+    rev = "f6f4ccaf213f0fe8b26e633a7dc0c802150626a0";
+    sha256 = "sha256-ybW2J4lWf6YaQGZZvxEVDUMAg84DC17W+yX6ZsuBDac=";
  };

  cmakeFlags = [
    "-DKALDI_BUILD_TEST=off"
    "-DBUILD_SHARED_LIBS=on"
-  ] ++ lib.optionals stdenv.isDarwin [
    "-DBLAS_LIBRARIES=-lblas"
    "-DLAPACK_LIBRARIES=-llapack"
  ];
@ -71,6 +70,8 @@ stdenv.mkDerivation {
    export PATH=$(pwd)/bin:$PATH
  '';

+  outputs = [ "out" "dev" ];
+
  buildInputs = [
    openblas
    openfst
--- a/pkgs/tools/filesystems/fsfs/default.nix
+++ b/pkgs/tools/filesystems/fsfs/default.nix
@ -1,32 +0,0 @@
-{lib, stdenv, fetchurl, openssl, fuse}:
-
-throw "It still does not build"
-
-stdenv.mkDerivation rec {
-  pname = "fsfs";
-  version = "0.1.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/fsfs/fsfs-${version}.tar.gz";
-    sha256 = "05wka9aq182li2r7gxcd8bb3rhpns7ads0k59v7w1jza60l57c74";
-  };
-
-  buildInputs = [ fuse openssl ];
-
-  patchPhase = ''
-    sed -i -e 's,CONFDIR=\(.*\),CONFDIR='$out/etc, \
-      -e 's,USERCONFPREFIX=\(.*\),USERCONFPREFIX='$out/var/lib, Makefile \
-      src/Makefile src/utils/Makefile
-  '';
-
-  preInstall = ''
-    mkdir -p $out/etc $out/var/lib
-    makeFlags="$makeFlags prefix=$out"
-  '';
-
-  meta = {
-    homepage = "http://fsfs.sourceforge.net/";
-    description = "Secure distributed file system in user space";
-    license = lib.licenses.gpl2Plus;
-  };
-}
--- a/pkgs/tools/filesystems/stratis-cli/default.nix
+++ b/pkgs/tools/filesystems/stratis-cli/default.nix
@ -6,13 +6,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "stratis-cli";
-  version = "3.3.0";
+  version = "3.4.0";

  src = fetchFromGitHub {
    owner = "stratis-storage";
    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-tS9kjXE7wn5j13PO8c3C98MpFbgmR4le/PNKoXKPKQg=";
+    rev = "v${version}";
+    hash = "sha256-kB8saMgNIoDCXhxCPG1Mwj7dxrev82leoewajA5g9IM=";
  };

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/tools/filesystems/stratisd/default.nix
+++ b/pkgs/tools/filesystems/stratisd/default.nix
@ -24,18 +24,18 @@

 stdenv.mkDerivation rec {
  pname = "stratisd";
-  version = "3.3.0";
+  version = "3.4.0";

  src = fetchFromGitHub {
    owner = "stratis-storage";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-6CCSs359gPwUMQ2SFpxaWHXCjqqgIbvCaPL2zLuYRKg=";
+    hash = "sha256-SHrD9zzGLGSlsf4UOqp4Xday6IDnryVDHIVRiPbE5CM=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
-    hash = "sha256-9nE/SFGv1tYyGDdemCahxHlRnLms3eK0r4XQMhQBjSQ=";
+    hash = "sha256-lkuFWVmO+qw2ZXbCwdhU5OpRZy589QKnudgNVTgsJhI=";
  };

  postPatch = ''
@ -70,7 +70,6 @@ stdenv.mkDerivation rec {
  EXECUTABLES_PATHS = lib.makeBinPath ([
    xfsprogs
    thin-provisioning-tools
-    udev
  ] ++ lib.optionals clevisSupport [
    clevis
    jose
--- a/Show more
+++ b/Show more