Merge staging-next into staging

2023-12-03 00:02:52 +00:00 · 2023-12-03 00:02:52 +00:00 · 4ba324904e
commit 4ba324904e
parent efcd9c73d5 d865fa4303
48 changed files with 1815 additions and 633 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -90,6 +90,9 @@ insert_final_newline = unset
 indent_style = unset
 trim_trailing_whitespace = unset

+[pkgs/misc/documentation-highlighter/**]
+insert_final_newline = unset
+
 [pkgs/servers/dict/wordnet_structures.py]
 trim_trailing_whitespace = unset

--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@ -4,11 +4,12 @@ let
  inherit (builtins)
    intersectAttrs;
  inherit (lib)
-    functionArgs isFunction mirrorFunctionArgs isAttrs setFunctionArgs levenshteinAtMost
+    functionArgs isFunction mirrorFunctionArgs isAttrs setFunctionArgs
    optionalAttrs attrNames levenshtein filter elemAt concatStringsSep sort take length
    filterAttrs optionalString flip pathIsDirectory head pipe isDerivation listToAttrs
    mapAttrs seq flatten deepSeq warnIf isInOldestRelease extends
    ;
+  inherit (lib.strings) levenshteinAtMost;

 in
 rec {
@ -198,7 +199,7 @@ rec {
        + "${loc'}${prettySuggestions (getSuggestions arg)}";

      # Only show the error for the first missing argument
-      error = errorForArg missingArgs.${head (attrNames missingArgs)};
+      error = errorForArg (head (attrNames missingArgs));

    in if missingArgs == {}
       then makeOverridable f allArgs
--- a/nixos/modules/config/mysql.nix
+++ b/nixos/modules/config/mysql.nix
@ -6,6 +6,8 @@ let
  cfg = config.users.mysql;
 in
 {
+  meta.maintainers = [ maintainers.netali ];
+
  options = {
    users.mysql = {
      enable = mkEnableOption (lib.mdDoc "Authentication against a MySQL/MariaDB database");
@ -358,7 +360,7 @@ in
      user = "root";
      group = "root";
      mode = "0600";
-      # password will be added from password file in activation script
+      # password will be added from password file in systemd oneshot
      text = ''
        users.host=${cfg.host}
        users.db_user=${cfg.user}
@ -423,21 +425,33 @@ in
      mode = "0600";
      user = config.services.nscd.user;
      group = config.services.nscd.group;
-      # password will be added from password file in activation script
+      # password will be added from password file in systemd oneshot
      text = ''
        username ${cfg.user}
      '';
    };

-    # preStart script to append the password from the password file
-    # to the configuration files. It also fixes the owner of the
-    # libnss-mysql-root.cfg because it is changed to root after the
-    # password is appended.
-    systemd.services.mysql.preStart = ''
-      if [[ -r ${cfg.passwordFile} ]]; then
-        org_umask=$(umask)
-        umask 0077
+    systemd.services.mysql-auth-pw-init = {
+      description = "Adds the mysql password to the mysql auth config files";

+      before = [ "nscd.service" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        Group = "root";
+      };
+
+      restartTriggers = [
+        config.environment.etc."security/pam_mysql.conf".source
+        config.environment.etc."libnss-mysql.cfg".source
+        config.environment.etc."libnss-mysql-root.cfg".source
+      ];
+
+      script = ''
+        if [[ -r ${cfg.passwordFile} ]]; then
+          umask 0077
          conf_nss="$(mktemp)"
          cp /etc/libnss-mysql-root.cfg $conf_nss
          printf 'password %s\n' "$(cat ${cfg.passwordFile})" >> $conf_nss
@ -448,9 +462,8 @@ in
          cp /etc/security/pam_mysql.conf $conf_pam
          printf 'users.db_passwd=%s\n' "$(cat ${cfg.passwordFile})" >> $conf_pam
          mv -fT "$conf_pam" /etc/security/pam_mysql.conf
-
-        umask $org_umask
        fi
      '';
    };
+  };
 }
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@ -455,10 +455,10 @@ in {
          ln -s /etc/home-assistant/configuration.yaml "${cfg.configDir}/configuration.yaml"
        '';
        copyLovelaceConfig = if cfg.lovelaceConfigWritable then ''
+          rm -f "${cfg.configDir}/ui-lovelace.yaml"
          cp --no-preserve=mode ${lovelaceConfigFile} "${cfg.configDir}/ui-lovelace.yaml"
        '' else ''
-          rm -f "${cfg.configDir}/ui-lovelace.yaml"
-          ln -s /etc/home-assistant/ui-lovelace.yaml "${cfg.configDir}/ui-lovelace.yaml"
+          ln -fs /etc/home-assistant/ui-lovelace.yaml "${cfg.configDir}/ui-lovelace.yaml"
        '';
        copyCustomLovelaceModules = if cfg.customLovelaceModules != [] then ''
          mkdir -p "${cfg.configDir}/www"
--- a/nixos/modules/services/misc/preload.nix
+++ b/nixos/modules/services/misc/preload.nix
@ -19,7 +19,7 @@ in {

      serviceConfig = {
        EnvironmentFile = "${cfg.package}/etc/conf.d/preload";
-        ExecStart = "${getExe cfg.package} --foreground $PRELOAD_OPTS";
+        ExecStart = "${getExe cfg.package} -l '' --foreground $PRELOAD_OPTS";
        Type = "simple";
        # Only preload data during CPU idle time
        IOSchedulingClass = 3;
--- a/nixos/tests/auth-mysql.nix
+++ b/nixos/tests/auth-mysql.nix
@ -84,7 +84,7 @@ in
          getpwuid = ''
            SELECT name, 'x', uid, gid, name, CONCAT('/home/', name), "/run/current-system/sw/bin/bash" \
            FROM users \
-            WHERE id=%1$u \
+            WHERE uid=%1$u \
            LIMIT 1
          '';
          getspnam = ''
@ -140,6 +140,7 @@ in

    machine.wait_for_unit("multi-user.target")
    machine.wait_for_unit("mysql.service")
+    machine.wait_until_succeeds("cat /etc/security/pam_mysql.conf | grep users.db_passwd")
    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")

    with subtest("Local login"):
--- a/pkgs/applications/science/robotics/mujoco/default.nix
+++ b/pkgs/applications/science/robotics/mujoco/default.nix
@ -1,26 +1,29 @@
-{ cmake
+{ cereal_1_3_2
+, cmake
 , fetchFromGitHub
 , fetchFromGitLab
-, git
+, glfw
+, glm
 , lib
-, libGL
+, spdlog
 , stdenv
-, xorg
 }:

 let
-  # See https://github.com/deepmind/mujoco/blob/c9246e1f5006379d599e0bcddf159a8616d31441/cmake/MujocoDependencies.cmake#L17-L55
+  pin = {
+
+    # See https://github.com/google-deepmind/mujoco/blob/3.0.0/cmake/MujocoDependencies.cmake#L17-L64
    abseil-cpp = fetchFromGitHub {
      owner = "abseil";
      repo = "abseil-cpp";
-    rev = "c2435f8342c2d0ed8101cb43adfd605fdc52dca2";
-    hash = "sha256-PLoI7ix+reUqkZ947kWzls8lujYqWXk9A9a55UcfahI=";
+      rev = "fb3621f4f897824c0dbe0615fa94543df6192f30";
+      hash = "sha256-uNGrTNg5G5xFGtc+BSWE389x0tQ/KxJQLHfebNWas/k=";
    };
    benchmark = fetchFromGitHub {
      owner = "google";
      repo = "benchmark";
-    rev = "2dd015dfef425c866d9a43f2c67d8b52d709acb6";
-    hash = "sha256-pUW9YVaujs/y00/SiPqDgK4wvVsaM7QUp/65k0t7Yr0=";
+      rev = "344117638c8ff7e239044fd0fa7085839fc03021";
+      hash = "sha256-gztnxui9Fe/FTieMjdvfJjWHjkImtlsHn6fM1FruyME=";
    };
    ccd = fetchFromGitHub {
      owner = "danfis";
@ -31,14 +34,14 @@ let
    eigen3 = fetchFromGitLab {
      owner = "libeigen";
      repo = "eigen";
-    rev = "211c5dfc6741a5570ad007983c113ef4d144f9f3";
-    hash = "sha256-oT/h8QkL0vwaflh46Zsnu9Db1b65AP6p//nAga8M5jI=";
+      rev = "e8515f78ac098329ab9f8cab21c87caede090a3f";
+      hash = "sha256-HXKtFJsKGpug+wNPjYynTuyaG0igo3oG4rFQktveh1g=";
    };
    googletest = fetchFromGitHub {
      owner = "google";
      repo = "googletest";
-    rev = "b796f7d44681514f58a683a3a71ff17c94edb0c1";
-    hash = "sha256-LVLEn+e7c8013pwiLzJiiIObyrlbBHYaioO/SWbItPQ=";
+      rev = "f8d7d77c06936315286eb55f8de22cd23c188571";
+      hash = "sha256-t0RchAHTJbuI5YW4uyBPykTvcjy90JW9AOPNjIhwh6U=";
    };
    lodepng = fetchFromGitHub {
      owner = "lvandeve";
@ -64,59 +67,118 @@ let
      rev = "9a89766acc42ddfa9e7133c7d81a5bda108a0ade";
      hash = "sha256-YGAe4+Ttv/xeou+9FoJjmQCKgzupTYdDhd+gzvtz/88=";
    };
-
-  # See https://github.com/deepmind/mujoco/blob/c9246e1f5006379d599e0bcddf159a8616d31441/simulate/cmake/SimulateDependencies.cmake#L32-L35
-  glfw3 = fetchFromGitHub {
-    owner = "glfw";
-    repo = "glfw";
-    rev = "7482de6071d21db77a7236155da44c172a7f6c9e";
-    hash = "sha256-4+H0IXjAwbL5mAWfsIVhW0BSJhcWjkQx4j2TrzZ3aIo=";
+    marchingcubecpp = fetchFromGitHub {
+      owner = "aparis69";
+      repo = "MarchingCubeCpp";
+      rev = "5b79e5d6bded086a0abe276a4b5a69fc17ae9bf1";
+      hash = "sha256-L0DH1GJZ/3vatQAU/KZj/2xTKE6Fwcw9eQYzLdqX2N4=";
    };
-in
-stdenv.mkDerivation rec {
-  pname = "mujoco";
-  version = "2.3.7";
+
+    tmd = stdenv.mkDerivation rec {
+      name = "TriangleMeshDistance";

      src = fetchFromGitHub {
-    owner = "deepmind";
-    repo = pname;
-    rev = version;
-    hash = "sha256-LgpA+iPGqciHuWBSD6/7yvZ7p+vo48ZYKjjrDZSnAwE=";
+        owner = "InteractiveComputerGraphics";
+        repo = name;
+        rev = "e55a15c20551f36242fd6368df099a99de71d43a";
+        hash = "sha256-vj6TMMT8mp7ciLa5nzVAhMWPcAHXq+ZwHlWsRA3uCmg=";
      };

-  patches = [ ./dependencies.patch ];
+      installPhase = ''
+        mkdir -p $out/include/tmd
+        cp ${name}/include/tmd/${name}.h $out/include/tmd/
+      '';
+    };

-  nativeBuildInputs = [ cmake git ];
+    sdflib = stdenv.mkDerivation rec {
+      name = "SdfLib";
+
+      src = fetchFromGitHub {
+        owner = "UPC-ViRVIG";
+        repo = name;
+        rev = "7c49cfba9bbec763b5d0f7b90b26555f3dde8088";
+        hash = "sha256-5bnQ3rHH9Pw1jRVpZpamFnhIJHWnGm6krgZgIBqNtVg=";
+      };
+
+      patches = [ ./sdflib-system-deps.patch ];
+
+      cmakeFlags = [
+        "-DSDFLIB_USE_ASSIMP=OFF"
+        "-DSDFLIB_USE_OPENMP=OFF"
+        "-DSDFLIB_USE_ENOKI=OFF"
+        "-DSDFLIB_USE_SYSTEM_GLM=ON"
+        "-DSDFLIB_USE_SYSTEM_SPDLOG=ON"
+        "-DSDFLIB_USE_SYSTEM_CEREAL=ON"
+        "-DSDFLIB_USE_SYSTEM_TRIANGLEMESHDISTANCE=ON"
+      ];
+
+      nativeBuildInputs = [ cmake ];
+      buildInputs = [
+        pin.tmd
+
+        # Mainline. The otherwise pinned glm realease from 2018 does
+        # not build due to test failures and missing files.
+        glm
+
+        spdlog
+        cereal_1_3_2
+      ];
+    };
+
+  };
+
+in stdenv.mkDerivation rec {
+  pname = "mujoco";
+  version = "3.0.1";
+
+  src = fetchFromGitHub {
+    owner = "google-deepmind";
+    repo = pname;
+    rev = version;
+    hash = "sha256-UXE+7KDti8RarpoJoo9Ei3TgW/Qdnj3ASRo8uTWhGrU=";
+  };
+
+  patches = [ ./mujoco-system-deps-dont-fetch.patch ];
+
+  nativeBuildInputs = [ cmake ];

  buildInputs = [
-    libGL
-    xorg.libX11
-    xorg.libXcursor
-    xorg.libXext
-    xorg.libXi
-    xorg.libXinerama
-    xorg.libXrandr
+    pin.sdflib
+    glm
+
+    # non-numerical
+    spdlog
+    cereal_1_3_2
+    glfw
+  ];
+
+  cmakeFlags = [
+    "-DMUJOCO_USE_SYSTEM_sdflib=ON"
+    "-DMUJOCO_SIMULATE_USE_SYSTEM_GLFW=ON"
+    "-DMUJOCO_SAMPLES_USE_SYSTEM_GLFW=ON"
  ];

  # Move things into place so that cmake doesn't try downloading dependencies.
  preConfigure = ''
    mkdir -p build/_deps
-    ln -s ${abseil-cpp} build/_deps/abseil-cpp-src
-    ln -s ${benchmark} build/_deps/benchmark-src
-    ln -s ${ccd} build/_deps/ccd-src
-    ln -s ${eigen3} build/_deps/eigen3-src
-    ln -s ${glfw3} build/_deps/glfw3-src
-    ln -s ${googletest} build/_deps/googletest-src
-    ln -s ${lodepng} build/_deps/lodepng-src
-    ln -s ${qhull} build/_deps/qhull-src
-    ln -s ${tinyobjloader} build/_deps/tinyobjloader-src
-    ln -s ${tinyxml2} build/_deps/tinyxml2-src
+    ln -s ${pin.abseil-cpp} build/_deps/abseil-cpp-src
+    ln -s ${pin.benchmark} build/_deps/benchmark-src
+    ln -s ${pin.ccd} build/_deps/ccd-src
+    ln -s ${pin.eigen3} build/_deps/eigen3-src
+    ln -s ${pin.googletest} build/_deps/googletest-src
+    ln -s ${pin.lodepng} build/_deps/lodepng-src
+    ln -s ${pin.qhull} build/_deps/qhull-src
+    ln -s ${pin.tinyobjloader} build/_deps/tinyobjloader-src
+    ln -s ${pin.tinyxml2} build/_deps/tinyxml2-src
+    ln -s ${pin.marchingcubecpp} build/_deps/marchingcubecpp-src
  '';

+  passthru.pin = { inherit (pin) lodepng eigen3 abseil-cpp; };
+
  meta = with lib; {
    description = "Multi-Joint dynamics with Contact. A general purpose physics simulator.";
    homepage = "https://mujoco.org/";
    license = licenses.asl20;
-    maintainers = with maintainers; [ samuela ];
+    maintainers = with maintainers; [ samuela tmplt ];
  };
 }
--- a/pkgs/applications/science/robotics/mujoco/dependencies.patch
+++ b/pkgs/applications/science/robotics/mujoco/dependencies.patch
@ -1,114 +0,0 @@
-diff --git a/cmake/MujocoDependencies.cmake b/cmake/MujocoDependencies.cmake
-index 3e322ea..980aace 100644
--- a/cmake/MujocoDependencies.cmake
-+++ b/cmake/MujocoDependencies.cmake
-@@ -87,8 +87,6 @@ set(BUILD_SHARED_LIBS
- if(NOT TARGET lodepng)
-   FetchContent_Declare(
-     lodepng
-    GIT_REPOSITORY https://github.com/lvandeve/lodepng.git
-    GIT_TAG ${MUJOCO_DEP_VERSION_lodepng}
-   )
- 
-   FetchContent_GetProperties(lodepng)
-@@ -127,10 +125,6 @@ findorfetch(
-   qhull
-   LIBRARY_NAME
-   qhull
-  GIT_REPO
-  https://github.com/qhull/qhull.git
-  GIT_TAG
-  ${MUJOCO_DEP_VERSION_qhull}
-   TARGETS
-   qhull
-   EXCLUDE_FROM_ALL
-@@ -151,10 +145,6 @@ findorfetch(
-   tinyxml2
-   LIBRARY_NAME
-   tinyxml2
-  GIT_REPO
-  https://github.com/leethomason/tinyxml2.git
-  GIT_TAG
-  ${MUJOCO_DEP_VERSION_tinyxml2}
-   TARGETS
-   tinyxml2
-   EXCLUDE_FROM_ALL
-@@ -169,10 +159,6 @@ findorfetch(
-   tinyobjloader
-   LIBRARY_NAME
-   tinyobjloader
-  GIT_REPO
-  https://github.com/tinyobjloader/tinyobjloader.git
-  GIT_TAG
-  ${MUJOCO_DEP_VERSION_tinyobjloader}
-   TARGETS
-   tinyobjloader
-   EXCLUDE_FROM_ALL
-@@ -187,10 +173,6 @@ findorfetch(
-   ccd
-   LIBRARY_NAME
-   ccd
-  GIT_REPO
-  https://github.com/danfis/libccd.git
-  GIT_TAG
-  ${MUJOCO_DEP_VERSION_ccd}
-   TARGETS
-   ccd
-   EXCLUDE_FROM_ALL
-@@ -227,10 +209,6 @@ if(MUJOCO_BUILD_TESTS)
-     absl
-     LIBRARY_NAME
-     abseil-cpp
-    GIT_REPO
-    https://github.com/abseil/abseil-cpp.git
-    GIT_TAG
-    ${MUJOCO_DEP_VERSION_abseil}
-     TARGETS
-     absl::core_headers
-     EXCLUDE_FROM_ALL
-@@ -254,10 +232,6 @@ if(MUJOCO_BUILD_TESTS)
-     GTest
-     LIBRARY_NAME
-     googletest
-    GIT_REPO
-    https://github.com/google/googletest.git
-    GIT_TAG
-    ${MUJOCO_DEP_VERSION_gtest}
-     TARGETS
-     gtest
-     gmock
-@@ -288,10 +262,6 @@ if(MUJOCO_BUILD_TESTS)
-     benchmark
-     LIBRARY_NAME
-     benchmark
-    GIT_REPO
-    https://github.com/google/benchmark.git
-    GIT_TAG
-    ${MUJOCO_DEP_VERSION_benchmark}
-     TARGETS
-     benchmark::benchmark
-     benchmark::benchmark_main
-@@ -308,8 +278,6 @@ if(MUJOCO_TEST_PYTHON_UTIL)
- 
-     FetchContent_Declare(
-       Eigen3
-      GIT_REPOSITORY https://gitlab.com/libeigen/eigen.git
-      GIT_TAG ${MUJOCO_DEP_VERSION_Eigen3}
-     )
- 
-     FetchContent_GetProperties(Eigen3)
-diff --git a/simulate/cmake/SimulateDependencies.cmake b/simulate/cmake/SimulateDependencies.cmake
-index fa539c2..5985d5a 100644
--- a/simulate/cmake/SimulateDependencies.cmake
-+++ b/simulate/cmake/SimulateDependencies.cmake
-@@ -81,10 +81,6 @@ findorfetch(
-   glfw3
-   LIBRARY_NAME
-   glfw3
-  GIT_REPO
-  https://github.com/glfw/glfw.git
-  GIT_TAG
-  ${MUJOCO_DEP_VERSION_glfw3}
-   TARGETS
-   glfw
-   EXCLUDE_FROM_ALL
--- a/pkgs/applications/science/robotics/mujoco/mujoco-system-deps-dont-fetch.patch
+++ b/pkgs/applications/science/robotics/mujoco/mujoco-system-deps-dont-fetch.patch
@ -0,0 +1,538 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 285250b..32d03e3 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -92,7 +92,7 @@ add_subdirectory(src/render)
+ add_subdirectory(src/thread)
+ add_subdirectory(src/ui)
+ 
+-target_compile_definitions(mujoco PRIVATE _GNU_SOURCE CCD_STATIC_DEFINE MUJOCO_DLL_EXPORTS -DMC_IMPLEM_ENABLE)
+target_compile_definitions(mujoco PRIVATE _GNU_SOURCE MUJOCO_DLL_EXPORTS -DMC_IMPLEM_ENABLE)
+ if(MUJOCO_ENABLE_AVX_INTRINSICS)
+   target_compile_definitions(mujoco PUBLIC mjUSEPLATFORMSIMD)
+ endif()
+@@ -117,7 +117,7 @@ target_link_libraries(
+           lodepng
+           qhullstatic_r
+           tinyobjloader
+-          tinyxml2
+          tinyxml2::tinyxml2
+ )
+ 
+ set_target_properties(
+diff --git a/cmake/MujocoDependencies.cmake b/cmake/MujocoDependencies.cmake
+index 4e3e2c8..f6143d9 100644
+--- a/cmake/MujocoDependencies.cmake
+++ b/cmake/MujocoDependencies.cmake
+@@ -90,153 +90,203 @@ set(BUILD_SHARED_LIBS
+     CACHE INTERNAL "Build SHARED libraries"
+ )
+ 
+
+ if(NOT TARGET lodepng)
+-  FetchContent_Declare(
+  fetchcontent_declare(
+     lodepng
+-    GIT_REPOSITORY https://github.com/lvandeve/lodepng.git
+-    GIT_TAG ${MUJOCO_DEP_VERSION_lodepng}
+   )
+endif()
+
+if(NOT TARGET lodepng)
+  if(NOT MUJOCO_USE_SYSTEM_lodepng)
+    fetchcontent_declare(
+      lodepng
+      GIT_REPOSITORY https://github.com/lvandeve/lodepng.git
+      GIT_TAG ${MUJOCO_DEP_VERSION_lodepng}
+    )
+ 
+-  FetchContent_GetProperties(lodepng)
+-  if(NOT lodepng_POPULATED)
+-    FetchContent_Populate(lodepng)
+-    # This is not a CMake project.
+-    set(LODEPNG_SRCS ${lodepng_SOURCE_DIR}/lodepng.cpp)
+-    set(LODEPNG_HEADERS ${lodepng_SOURCE_DIR}/lodepng.h)
+-    add_library(lodepng STATIC ${LODEPNG_HEADERS} ${LODEPNG_SRCS})
+-    target_compile_options(lodepng PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+-    target_link_options(lodepng PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
+-    target_include_directories(lodepng PUBLIC ${lodepng_SOURCE_DIR})
+    fetchcontent_getproperties(lodepng)
+    if(NOT lodepng_POPULATED)
+      fetchcontent_populate(lodepng)
+      # This is not a CMake project.
+      set(LODEPNG_SRCS ${lodepng_SOURCE_DIR}/lodepng.cpp)
+      set(LODEPNG_HEADERS ${lodepng_SOURCE_DIR}/lodepng.h)
+      add_library(lodepng STATIC ${LODEPNG_HEADERS} ${LODEPNG_SRCS})
+      target_compile_options(lodepng PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+      target_link_options(lodepng PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
+      target_include_directories(lodepng PUBLIC ${lodepng_SOURCE_DIR})
+    endif()
+  else()
+    find_package(lodepng REQUIRED)
+   endif()
+ endif()
+ 
+ if(NOT TARGET marchingcubecpp)
+-  FetchContent_Declare(
+  fetchcontent_declare(
+     marchingcubecpp
+-    GIT_REPOSITORY https://github.com/aparis69/MarchingCubeCpp.git
+-    GIT_TAG ${MUJOCO_DEP_VERSION_MarchingCubeCpp}
+   )
+ 
+-  FetchContent_GetProperties(marchingcubecpp)
+  fetchcontent_getproperties(marchingcubecpp)
+   if(NOT marchingcubecpp_POPULATED)
+-    FetchContent_Populate(marchingcubecpp)
+    fetchcontent_populate(marchingcubecpp)
+     include_directories(${marchingcubecpp_SOURCE_DIR})
+   endif()
+ endif()
+ 
+option(MUJOCO_USE_SYSTEM_qhull "Use installed qhull version." OFF)
+mark_as_advanced(MUJOCO_USE_SYSTEM_qhull)
+
+ set(QHULL_ENABLE_TESTING OFF)
+ 
+ findorfetch(
+   USE_SYSTEM_PACKAGE
+-  OFF
+  ${MUJOCO_USE_SYSTEM_qhull}
+   PACKAGE_NAME
+-  qhull
+  Qhull
+   LIBRARY_NAME
+   qhull
+-  GIT_REPO
+-  https://github.com/qhull/qhull.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_qhull}
+   TARGETS
+   qhull
+   EXCLUDE_FROM_ALL
+ )
+-# MuJoCo includes a file from libqhull_r which is not exported by the qhull include directories.
+-# Add it to the target.
+-target_include_directories(
+-  qhullstatic_r INTERFACE $<BUILD_INTERFACE:${qhull_SOURCE_DIR}/src/libqhull_r>
+-)
+-target_compile_options(qhullstatic_r PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+-target_link_options(qhullstatic_r PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
+
+if(NOT MUJOCO_USE_SYSTEM_qhull)
+  # MuJoCo includes a file from libqhull_r which is not exported by the qhull include directories.
+  # Add it to the target.
+  target_include_directories(
+    qhullstatic_r INTERFACE $<BUILD_INTERFACE:${qhull_SOURCE_DIR}/src/libqhull_r>
+  )
+  target_compile_options(qhullstatic_r PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+  target_link_options(qhullstatic_r PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
+else()
+  if(NOT TARGET qhullstatic_r)
+    add_library(qhullstatic_r INTERFACE)
+    set_target_properties(qhullstatic_r PROPERTIES INTERFACE_LINK_LIBRARIES Qhull::qhull_r)
+
+    # Workaround as headers are installed in <prefix>/include/libqhull_r/something.h
+    # but mujoco include them as #include <something.h>
+    get_property(qhull_include_dirs TARGET Qhull::qhull_r PROPERTY INTERFACE_INCLUDE_DIRECTORIES)
+    foreach(qhull_include_dir IN LISTS qhull_include_dirs)
+      target_include_directories(qhullstatic_r INTERFACE ${qhull_include_dirs}/libqhull_r)
+    endforeach()
+    target_include_directories(qhullstatic_r INTERFACE )
+  endif()
+endif()
+
+option(MUJOCO_USE_SYSTEM_tinyxml2 "Use installed tinyxml2 version." OFF)
+mark_as_advanced(MUJOCO_USE_SYSTEM_tinyxml2)
+ 
+ set(tinyxml2_BUILD_TESTING OFF)
+ findorfetch(
+   USE_SYSTEM_PACKAGE
+-  OFF
+  ${MUJOCO_USE_SYSTEM_tinyxml2}
+   PACKAGE_NAME
+   tinyxml2
+   LIBRARY_NAME
+   tinyxml2
+-  GIT_REPO
+-  https://github.com/leethomason/tinyxml2.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_tinyxml2}
+   TARGETS
+-  tinyxml2
+  tinyxml2::tinyxml2
+   EXCLUDE_FROM_ALL
+ )
+-target_compile_options(tinyxml2 PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+-target_link_options(tinyxml2 PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
+
+if(NOT MUJOCO_USE_SYSTEM_tinyxml2)
+  target_compile_options(tinyxml2 PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+  target_link_options(tinyxml2 PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
+endif()
+
+option(MUJOCO_USE_SYSTEM_tinyobjloader "Use installed tinyobjloader version." OFF)
+mark_as_advanced(MUJOCO_USE_SYSTEM_tinyobjloader)
+ 
+ findorfetch(
+   USE_SYSTEM_PACKAGE
+-  OFF
+  ${MUJOCO_USE_SYSTEM_tinyobjloader}
+   PACKAGE_NAME
+   tinyobjloader
+   LIBRARY_NAME
+   tinyobjloader
+-  GIT_REPO
+-  https://github.com/tinyobjloader/tinyobjloader.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_tinyobjloader}
+   TARGETS
+   tinyobjloader
+   EXCLUDE_FROM_ALL
+ )
+ 
+if(MUJOCO_USE_SYSTEM_tinyobjloader)
+  # As of tinyobjloader v2.0.0rc10, the tinyobjloader target is named tinyobjloader in the build,
+  # but tinyobjloader::tinyobjloader when it is installed. To deal with this, if tinyobjloader is
+  # found in the system, we create an ALIAS
+  # The following is equivalent to add_library(tinyobjloader ALIAS tinyobjloader::tinyobjloader),
+  # but compatible with CMake 3.16 . Once the minimum CMake is bumped to CMake 3.18, we can use
+  # the simpler version
+  add_library(tinyobjloader INTERFACE IMPORTED)
+  set_target_properties(tinyobjloader PROPERTIES INTERFACE_LINK_LIBRARIES tinyobjloader::tinyobjloader)
+endif()
+
+option(MUJOCO_USE_SYSTEM_sdflib "Use installed sdflib version." OFF)
+mark_as_advanced(MUJOCO_USE_SYSTEM_sdflib)
+
+ option(SDFLIB_USE_ASSIMP OFF)
+ option(SDFLIB_USE_OPENMP OFF)
+ option(SDFLIB_USE_ENOKI OFF)
+
+ findorfetch(
+   USE_SYSTEM_PACKAGE
+-  OFF
+  ${MUJOCO_USE_SYSTEM_sdflib}
+   PACKAGE_NAME
+-  sdflib
+  SdfLib
+   LIBRARY_NAME
+   sdflib
+-  GIT_REPO
+-  https://github.com/UPC-ViRVIG/SdfLib.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_sdflib}
+   TARGETS
+-  SdfLib
+  SdfLib::SdfLib
+   EXCLUDE_FROM_ALL
+ )
+-target_compile_options(SdfLib PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+-target_link_options(SdfLib PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
+
+if(NOT MUJOCO_USE_SYSTEM_sdflib)
+  target_compile_options(SdfLib PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+  target_link_options(SdfLib PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
+endif()
+
+option(MUJOCO_USE_SYSTEM_ccd "Use installed ccd version." OFF)
+mark_as_advanced(MUJOCO_USE_SYSTEM_ccd)
+ 
+ set(ENABLE_DOUBLE_PRECISION ON)
+ set(CCD_HIDE_ALL_SYMBOLS ON)
+ findorfetch(
+   USE_SYSTEM_PACKAGE
+-  OFF
+  ${MUJOCO_USE_SYSTEM_ccd}
+   PACKAGE_NAME
+   ccd
+   LIBRARY_NAME
+   ccd
+-  GIT_REPO
+-  https://github.com/danfis/libccd.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_ccd}
+   TARGETS
+   ccd
+   EXCLUDE_FROM_ALL
+ )
+-target_compile_options(ccd PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+-target_link_options(ccd PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
+-
+-# libCCD has an unconditional `#define _CRT_SECURE_NO_WARNINGS` on Windows.
+-# TODO(stunya): Remove this after https://github.com/danfis/libccd/pull/77 is merged.
+-if(WIN32)
+-  if(MSVC)
+-    # C4005 is the MSVC equivalent of -Wmacro-redefined.
+-    target_compile_options(ccd PRIVATE /wd4005)
+-  else()
+-    target_compile_options(ccd PRIVATE -Wno-macro-redefined)
+
+if(NOT MUJOCO_USE_SYSTEM_ccd)
+  target_compile_options(ccd PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+  target_link_options(ccd PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
+  # This is necessary to ensure that the any library that consumes the ccd
+  # compiled internally by MuJoCo (as static library) has CCD_EXPORT correctly
+  # defined as an empty string. For ccd itself, this is ensured by the variable
+  # CCD_HIDE_ALL_SYMBOLS set to ON before the call to findorfetch
+  # See https://github.com/danfis/libccd/pull/79
+  target_compile_definitions(ccd INTERFACE CCD_STATIC_DEFINE)
+
+  # libCCD has an unconditional `#define _CRT_SECURE_NO_WARNINGS` on Windows.
+  # TODO(stunya): Remove this after https://github.com/danfis/libccd/pull/77 is merged.
+  if(WIN32)
+    if(MSVC)
+      # C4005 is the MSVC equivalent of -Wmacro-redefined.
+      target_compile_options(ccd PRIVATE /wd4005)
+    else()
+      target_compile_options(ccd PRIVATE -Wno-macro-redefined)
+    endif()
+   endif()
+ endif()
+ 
+ if(MUJOCO_BUILD_TESTS)
+  option(MUJOCO_USE_SYSTEM_abseil "Use installed abseil version." OFF)
+  mark_as_advanced(MUJOCO_USE_SYSTEM_abseil)
+
+   set(ABSL_PROPAGATE_CXX_STD ON)
+ 
+   # This specific version of Abseil does not have the following variable. We need to work with BUILD_TESTING
+@@ -249,15 +299,11 @@ if(MUJOCO_BUILD_TESTS)
+   set(ABSL_BUILD_TESTING OFF)
+   findorfetch(
+     USE_SYSTEM_PACKAGE
+-    OFF
+    ${MUJOCO_USE_SYSTEM_abseil}
+     PACKAGE_NAME
+     absl
+     LIBRARY_NAME
+     abseil-cpp
+-    GIT_REPO
+-    https://github.com/abseil/abseil-cpp.git
+-    GIT_TAG
+-    ${MUJOCO_DEP_VERSION_abseil}
+     TARGETS
+     absl::core_headers
+     EXCLUDE_FROM_ALL
+@@ -268,6 +314,9 @@ if(MUJOCO_BUILD_TESTS)
+       CACHE BOOL "Build tests." FORCE
+   )
+ 
+  option(MUJOCO_USE_SYSTEM_gtest "Use installed gtest version." OFF)
+  mark_as_advanced(MUJOCO_USE_SYSTEM_gtest)
+
+   # Avoid linking errors on Windows by dynamically linking to the C runtime.
+   set(gtest_force_shared_crt
+       ON
+@@ -276,22 +325,20 @@ if(MUJOCO_BUILD_TESTS)
+ 
+   findorfetch(
+     USE_SYSTEM_PACKAGE
+-    OFF
+    ${MUJOCO_USE_SYSTEM_gtest}
+     PACKAGE_NAME
+     GTest
+     LIBRARY_NAME
+     googletest
+-    GIT_REPO
+-    https://github.com/google/googletest.git
+-    GIT_TAG
+-    ${MUJOCO_DEP_VERSION_gtest}
+     TARGETS
+-    gtest
+-    gmock
+-    gtest_main
+    GTest::gmock
+    GTest::gtest_main
+     EXCLUDE_FROM_ALL
+   )
+ 
+  option(MUJOCO_USE_SYSTEM_benchmark "Use installed benchmark version." OFF)
+  mark_as_advanced(MUJOCO_USE_SYSTEM_benchmark)
+
+   set(BENCHMARK_EXTRA_FETCH_ARGS "")
+   if(WIN32 AND NOT MSVC)
+     set(BENCHMARK_EXTRA_FETCH_ARGS
+@@ -310,15 +357,11 @@ if(MUJOCO_BUILD_TESTS)
+ 
+   findorfetch(
+     USE_SYSTEM_PACKAGE
+-    OFF
+    ${MUJOCO_USE_SYSTEM_benchmark}
+     PACKAGE_NAME
+     benchmark
+     LIBRARY_NAME
+     benchmark
+-    GIT_REPO
+-    https://github.com/google/benchmark.git
+-    GIT_TAG
+-    ${MUJOCO_DEP_VERSION_benchmark}
+     TARGETS
+     benchmark::benchmark
+     benchmark::benchmark_main
+@@ -328,26 +371,42 @@ if(MUJOCO_BUILD_TESTS)
+ endif()
+ 
+ if(MUJOCO_TEST_PYTHON_UTIL)
+  option(MUJOCO_USE_SYSTEM_Eigen3 "Use installed Eigen3 version." OFF)
+  mark_as_advanced(MUJOCO_USE_SYSTEM_Eigen3)
+
+   add_compile_definitions(EIGEN_MPL2_ONLY)
+-  if(NOT TARGET eigen)
+-    # Support new IN_LIST if() operator.
+-    set(CMAKE_POLICY_DEFAULT_CMP0057 NEW)
+  if(NOT TARGET Eigen3::Eigen)
+    if(NOT MUJOCO_USE_SYSTEM_Eigen3)
+      # Support new IN_LIST if() operator.
+      set(CMAKE_POLICY_DEFAULT_CMP0057 NEW)
+    endif()
+ 
+-    FetchContent_Declare(
+    fetchcontent_declare(
+       Eigen3
+-      GIT_REPOSITORY https://gitlab.com/libeigen/eigen.git
+-      GIT_TAG ${MUJOCO_DEP_VERSION_Eigen3}
+     )
+ 
+-    FetchContent_GetProperties(Eigen3)
+    fetchcontent_getproperties(Eigen3)
+     if(NOT Eigen3_POPULATED)
+-      FetchContent_Populate(Eigen3)
+      fetchcontent_populate(Eigen3)
+ 
+       # Mark the library as IMPORTED as a workaround for https://gitlab.kitware.com/cmake/cmake/-/issues/15415
+       add_library(Eigen3::Eigen INTERFACE IMPORTED)
+       set_target_properties(
+         Eigen3::Eigen PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "${eigen3_SOURCE_DIR}"
+       )
+
+      fetchcontent_getproperties(Eigen3)
+      # if(NOT Eigen3_POPULATED)
+      #   fetchcontent_populate(Eigen3)
+
+      #   # Mark the library as IMPORTED as a workaround for https://gitlab.kitware.com/cmake/cmake/-/issues/15415
+      #   add_library(Eigen3::Eigen INTERFACE IMPORTED)
+      #   set_target_properties(
+      #     Eigen3::Eigen PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "${eigen3_SOURCE_DIR}"
+      #   )
+      # endif()
+    else()
+      find_package(Eigen3 REQUIRED)
+     endif()
+   endif()
+ endif()
+diff --git a/plugin/sdf/CMakeLists.txt b/plugin/sdf/CMakeLists.txt
+index 3e216fc..e7e3a1e 100644
+--- a/plugin/sdf/CMakeLists.txt
+++ b/plugin/sdf/CMakeLists.txt
+@@ -37,7 +37,7 @@ set(MUJOCO_SDF_SRCS
+ add_library(sdf SHARED)
+ target_sources(sdf PRIVATE ${MUJOCO_SDF_SRCS})
+ target_include_directories(sdf PRIVATE ${MUJOCO_SDF_INCLUDE})
+-target_link_libraries(sdf PRIVATE mujoco SdfLib)
+target_link_libraries(sdf PRIVATE mujoco SdfLib::SdfLib)
+ target_compile_options(
+   sdf
+   PRIVATE ${AVX_COMPILE_OPTIONS}
+diff --git a/python/mujoco/util/CMakeLists.txt b/python/mujoco/util/CMakeLists.txt
+index 666a372..d89bb49 100644
+--- a/python/mujoco/util/CMakeLists.txt
+++ b/python/mujoco/util/CMakeLists.txt
+@@ -63,8 +63,8 @@ if(BUILD_TESTING)
+   target_link_libraries(
+     array_traits_test
+     array_traits
+-    gmock
+-    gtest_main
+    GTest::gmock
+    GTest::gtest_main
+   )
+   gtest_add_tests(TARGET array_traits_test SOURCES array_traits_test.cc)
+ 
+@@ -72,8 +72,8 @@ if(BUILD_TESTING)
+   target_link_libraries(
+     func_traits_test
+     func_traits
+-    gmock
+-    gtest_main
+    GTest::gmock
+    GTest::gtest_main
+   )
+   gtest_add_tests(TARGET func_traits_test SOURCES func_traits_test.cc)
+ 
+@@ -81,8 +81,8 @@ if(BUILD_TESTING)
+   target_link_libraries(
+     func_wrap_test
+     func_wrap
+-    gmock
+-    gtest_main
+    GTest::gmock
+    GTest::gtest_main
+   )
+   gtest_add_tests(TARGET func_wrap_test SOURCES func_wrap_test.cc)
+ 
+@@ -90,8 +90,8 @@ if(BUILD_TESTING)
+   target_link_libraries(
+     tuple_tools_test
+     func_wrap
+-    gmock
+-    gtest_main
+    GTest::gmock
+    GTest::gtest_main
+   )
+   gtest_add_tests(TARGET tuple_tools_test SOURCES tuple_tools_test.cc)
+ endif()
+diff --git a/simulate/cmake/SimulateDependencies.cmake b/simulate/cmake/SimulateDependencies.cmake
+index 5141406..75ff788 100644
+--- a/simulate/cmake/SimulateDependencies.cmake
+++ b/simulate/cmake/SimulateDependencies.cmake
+@@ -81,10 +81,6 @@ findorfetch(
+   glfw3
+   LIBRARY_NAME
+   glfw3
+-  GIT_REPO
+-  https://github.com/glfw/glfw.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_glfw3}
+   TARGETS
+   glfw
+   EXCLUDE_FROM_ALL
+diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
+index 6bec911..2a16c21 100644
+--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
+@@ -30,7 +30,7 @@ macro(mujoco_test name)
+   )
+ 
+   add_executable(${name} ${name}.cc)
+-  target_link_libraries(${name} gtest_main mujoco)
+  target_link_libraries(${name} GTest::gtest_main mujoco)
+   target_include_directories(${name} PRIVATE ${MUJOCO_TEST_INCLUDE})
+   set_target_properties(${name} PROPERTIES BUILD_RPATH ${CMAKE_LIBRARY_OUTPUT_DIRECTORY})
+   # gtest_discover_tests is recommended over gtest_add_tests, but has some issues in Windows.
+@@ -59,20 +59,20 @@ target_link_libraries(
+   PUBLIC absl::core_headers
+          absl::strings
+          absl::synchronization
+-         gtest
+-         gmock
+         GTest::gtest
+         GTest::gmock
+          mujoco::mujoco
+ )
+ target_include_directories(fixture PRIVATE ${mujoco_SOURCE_DIR}/include gmock)
+ 
+ mujoco_test(fixture_test)
+-target_link_libraries(fixture_test fixture gmock)
+target_link_libraries(fixture_test fixture GTest::gmock)
+ 
+ mujoco_test(header_test)
+-target_link_libraries(header_test fixture gmock)
+target_link_libraries(header_test fixture GTest::gmock)
+ 
+ mujoco_test(pipeline_test)
+-target_link_libraries(pipeline_test fixture gmock)
+target_link_libraries(pipeline_test fixture GTest::gmock)
+ 
+ add_subdirectory(benchmark)
+ add_subdirectory(engine)
--- a/pkgs/applications/science/robotics/mujoco/sdflib-system-deps.patch
+++ b/pkgs/applications/science/robotics/mujoco/sdflib-system-deps.patch
@ -0,0 +1,192 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 251c456..3d30231 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -27,7 +27,7 @@ option(SDFLIB_USE_SYSTEM_GLM "Use glm library via find_package instead of downlo
+ option(SDFLIB_USE_SYSTEM_SPDLOG "Use spdlog library via find_package instead of downloading it" OFF)
+ option(SDFLIB_USE_SYSTEM_CEREAL "Use cereal library via find_package instead of downloading it" OFF)
+ option(SDFLIB_USE_SYSTEM_ASSIMP "Use assimp library via find_package instead of downloading it" OFF)
+-
+option(SDFLIB_USE_SYSTEM_TRIANGLEMESHDISTANCE "Use TriangleMeshDistance library via system includes instead of downloading it" OFF)
+ 
+ if(SDFLIB_DEBUG_INFO)
+     add_compile_definitions(SDFLIB_PRINT_STATISTICS)
+@@ -55,13 +55,52 @@ file(GLOB UTILS_SOURCE_FILES src/utils/*.cpp)
+ file(GLOB UTILS_HEADER_FILES src/utils/*.h)
+ 
+ # Add libraries
+-add_library(${PROJECT_NAME} STATIC  ${SOURCE_FILES} ${HEADER_FILES} ${PUBLIC_HEADER_FILES}
+-                                    ${SDF_SOURCE_FILES} ${SDF_HEADER_FILES}
+-                                    ${UTILS_SOURCE_FILES} ${UTILS_HEADER_FILES})
+-
+-target_include_directories(${PROJECT_NAME} PUBLIC include/)
+add_library(${PROJECT_NAME} ${SOURCE_FILES} ${HEADER_FILES} ${PUBLIC_HEADER_FILES}
+                            ${SDF_SOURCE_FILES} ${SDF_HEADER_FILES}
+                            ${UTILS_SOURCE_FILES} ${UTILS_HEADER_FILES})
+add_library(${PROJECT_NAME}::${PROJECT_NAME} ALIAS ${PROJECT_NAME})
+if(BUILD_SHARED_LIBS AND WIN32)
+    set_target_properties(${PROJECT_NAME} PROPERTIES WINDOWS_EXPORT_ALL_SYMBOLS ON)
+endif()
+include(GNUInstallDirs)
+target_include_directories(${PROJECT_NAME} PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
+                                                  $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
+ target_include_directories(${PROJECT_NAME} PRIVATE src/)
+ 
+# Install library and CMake config files
+install(TARGETS ${PROJECT_NAME} EXPORT ${PROJECT_NAME})
+install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/include/SdfLib
+        DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
+
+install(EXPORT ${PROJECT_NAME}
+        FILE ${PROJECT_NAME}Targets.cmake
+        DESTINATION lib/cmake/${PROJECT_NAME}
+        NAMESPACE ${PROJECT_NAME}::
+)
+
+include(CMakePackageConfigHelpers)
+set(PACKAGE_DEPENDENCIES "")
+if(SDFLIB_USE_SYSTEM_GLM)
+    string(APPEND PACKAGE_DEPENDENCIES "find_dependency(glm)\n")
+endif()
+if(SDFLIB_USE_SYSTEM_SPDLOG)
+    string(APPEND PACKAGE_DEPENDENCIES "find_dependency(spdlog)\n")
+endif()
+if(SDFLIB_USE_SYSTEM_CEREAL)
+    string(APPEND PACKAGE_DEPENDENCIES "find_dependency(cereal)\n")
+endif()
+if(SDFLIB_USE_ASSIMP AND SDFLIB_USE_SYSTEM_ASSIMP)
+    string(APPEND PACKAGE_DEPENDENCIES "find_dependency(assimp)\n")
+endif()
+
+configure_package_config_file(${CMAKE_CURRENT_SOURCE_DIR}/${PROJECT_NAME}Config.cmake.in
+                              "${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}Config.cmake"
+                              INSTALL_DESTINATION "lib/cmake/${PROJECT_NAME}"
+                              NO_SET_AND_CHECK_MACRO
+                              NO_CHECK_REQUIRED_COMPONENTS_MACRO)
+install(FILES ${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}Config.cmake
+        DESTINATION lib/cmake/${PROJECT_NAME})
+
+ # Add shaders
+ file(GLOB SHADER_FILES RELATIVE ${CMAKE_CURRENT_SOURCE_DIR}/src/render_engine/shaders 
+                        src/render_engine/shaders/*.frag 
+@@ -69,7 +108,7 @@ file(GLOB SHADER_FILES RELATIVE ${CMAKE_CURRENT_SOURCE_DIR}/src/render_engine/sh
+                        src/render_engine/shaders/*.comp)
+ 
+ foreach(SHADER IN LISTS SHADER_FILES)
+-    add_custom_command(OUTPUT ${SHADER}
+add_custom_command(OUTPUT ${SHADER}
+             COMMAND cmake -E copy_if_different ${CMAKE_CURRENT_SOURCE_DIR}/src/render_engine/shaders/${SHADER} $<TARGET_FILE_DIR:${PROJECT_NAME}>/shaders/${SHADER}
+             DEPENDS src/render_engine/shaders/${SHADER}
+         )
+@@ -112,7 +151,10 @@ endif()
+ target_link_libraries(${PROJECT_NAME} PUBLIC ${SDFLIB_GLM_TARGET})
+ target_link_libraries(${PROJECT_NAME} PUBLIC spdlog::spdlog)
+ target_link_libraries(${PROJECT_NAME} PUBLIC cereal::cereal)
+-target_link_libraries(${PROJECT_NAME} PUBLIC icg)
+
+if(NOT SDFLIB_USE_SYSTEM_TRIANGLEMESHDISTANCE)
+    target_link_libraries(${PROJECT_NAME} PUBLIC TriangleMeshDistance)
+endif()
+ 
+ if(CMAKE_CXX_COMPILER_ID MATCHES GNU)
+     target_link_libraries(${PROJECT_NAME} PUBLIC -lstdc++fs)
+diff --git a/SdfLibConfig.cmake.in b/SdfLibConfig.cmake.in
+new file mode 100644
+index 0000000..9b8265c
+--- /dev/null
+++ b/SdfLibConfig.cmake.in
+@@ -0,0 +1,7 @@
+@PACKAGE_INIT@
+
+include(CMakeFindDependencyMacro)
+
+@PACKAGE_DEPENDENCIES@
+
+include("${CMAKE_CURRENT_LIST_DIR}/SdfLibTargets.cmake")
+diff --git a/include/SdfLib/TrianglesInfluence.h b/include/SdfLib/TrianglesInfluence.h
+index fc2ca52..b276f23 100644
+--- a/include/SdfLib/TrianglesInfluence.h
+++ b/include/SdfLib/TrianglesInfluence.h
+@@ -11,7 +11,7 @@
+ #include "InterpolationMethods.h"
+ #include "utils/Timer.h"
+ #include "utils/GJK.h"
+-#include <InteractiveComputerGraphics/TriangleMeshDistance.h>
+#include <tmd/TriangleMeshDistance.h>
+ 
+ #include <vector>
+ #include <array>
+diff --git a/libs/CMakeLists.txt b/libs/CMakeLists.txt
+index 79f70c1..e2a4f10 100644
+--- a/libs/CMakeLists.txt
+++ b/libs/CMakeLists.txt
+@@ -137,9 +137,10 @@ if(SDFLIB_BUILD_APPS OR SDFLIB_BUILD_DEBUG_APPS)
+ 	target_include_directories(stb_image INTERFACE stb)
+  endif()
+ 
+-# icg
+-add_library(icg INTERFACE)
+-target_include_directories(icg INTERFACE InteractiveComputerGraphics)
+if (NOT SDFLIB_USE_SYSTEM_TRIANGLEMESHDISTANCE)
+	add_library(TriangleMeshDistance INTERFACE)
+	target_include_directories(TriangleMeshDistance INTERFACE InteractiveComputerGraphics)
+endif()
+ 
+ if(SDFLIB_BUILD_APPS OR SDFLIB_BUILD_DEBUG_APPS)
+ 	# glfw
+diff --git a/libs/InteractiveComputerGraphics/InteractiveComputerGraphics/TriangleMeshDistance.h b/libs/InteractiveComputerGraphics/tmd/TriangleMeshDistance.h
+similarity index 100%
+rename from libs/InteractiveComputerGraphics/InteractiveComputerGraphics/TriangleMeshDistance.h
+rename to libs/InteractiveComputerGraphics/tmd/TriangleMeshDistance.h
+diff --git a/src/tools/ImageQueryTime/main.cpp b/src/tools/ImageQueryTime/main.cpp
+index 357a78b..f4fd9e7 100644
+--- a/src/tools/ImageQueryTime/main.cpp
+++ b/src/tools/ImageQueryTime/main.cpp
+@@ -17,7 +17,7 @@
+ 
+ #define TEST_METHODS 
+ #ifdef TEST_METHODS
+-#include <InteractiveComputerGraphics/TriangleMeshDistance.h>
+#include <tmd/TriangleMeshDistance.h>
+ // #include <CGAL/Simple_cartesian.h>
+ // #include <CGAL/AABB_tree.h>
+ // #include <CGAL/AABB_traits.h>
+diff --git a/src/tools/SdfErrorCompare/main.cpp b/src/tools/SdfErrorCompare/main.cpp
+index deef25f..9e402c4 100644
+--- a/src/tools/SdfErrorCompare/main.cpp
+++ b/src/tools/SdfErrorCompare/main.cpp
+@@ -23,7 +23,7 @@ using namespace sdflib;
+ // #define TEST_OPENVDB
+ 
+ #ifdef TEST_ICG
+-#include <InteractiveComputerGraphics/TriangleMeshDistance.h>
+#include <tmd/TriangleMeshDistance.h>
+ #endif
+ #ifdef TEST_CGAL
+ #include <CGAL/Simple_cartesian.h>
+diff --git a/src/tools/SdfLibUnity/SdfExportFunc.cpp b/src/tools/SdfLibUnity/SdfExportFunc.cpp
+index ff4e017..7e06ada 100644
+--- a/src/tools/SdfLibUnity/SdfExportFunc.cpp
+++ b/src/tools/SdfLibUnity/SdfExportFunc.cpp
+@@ -1,7 +1,7 @@
+ #include "SdfExportFunc.h"
+ #include "spdlog/sinks/rotating_file_sink.h"
+ 
+-#include <InteractiveComputerGraphics/TriangleMeshDistance.h>
+#include <tmd/TriangleMeshDistance.h>
+ 
+ using namespace sdflib;
+ 
+diff --git a/src/tools/SdfOffsets/main.cpp b/src/tools/SdfOffsets/main.cpp
+index b6769d7..07f137b 100644
+--- a/src/tools/SdfOffsets/main.cpp
+++ b/src/tools/SdfOffsets/main.cpp
+@@ -9,7 +9,7 @@
+ #include <glm/gtc/type_ptr.hpp>
+ #include <glm/gtc/matrix_transform.hpp>
+ 
+-#include <InteractiveComputerGraphics/TriangleMeshDistance.h>
+#include <tmd/TriangleMeshDistance.h>
+ #include <CGAL/Surface_mesh_default_triangulation_3.h>
+ #include <CGAL/Complex_2_in_triangulation_3.h>
+ #include <CGAL/make_surface_mesh.h>
--- a/pkgs/by-name/vi/vinegar/package.nix
+++ b/pkgs/by-name/vi/vinegar/package.nix
@ -0,0 +1,54 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, wine
+, makeBinaryWrapper
+, pkg-config
+, libGL
+, libxkbcommon
+, xorg
+}:
+
+buildGoModule rec {
+  pname = "vinegar";
+  version = "1.5.8";
+
+  src = fetchFromGitHub {
+    owner = "vinegarhq";
+    repo = "vinegar";
+    rev = "v${version}";
+    hash = "sha256-1KDcc9Hms1hQgpvf/49zFJ85kDUsieNcoOTYaZWV+S0=";
+  };
+
+  vendorHash = "sha256-UJLwSOJ4vZt3kquKllm5OMfFheZtAG5gLSA20313PpA=";
+
+  nativeBuildInputs = [ pkg-config makeBinaryWrapper ];
+  buildInputs = [ libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wine ];
+
+  buildPhase = ''
+    runHook preBuild
+    make PREFIX=$out
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    make PREFIX=$out install
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/vinegar \
+      --prefix PATH : ${lib.makeBinPath [ wine ]}
+  '';
+
+  meta = with lib; {
+    description = "An open-source, minimal, configurable, fast bootstrapper for running Roblox on Linux";
+    homepage = "https://github.com/vinegarhq/vinegar";
+    changelog = "https://github.com/vinegarhq/vinegar/releases/tag/v${version}";
+    mainProgram = "vinegar";
+    license = licenses.gpl3Only;
+    platforms = [ "x86_64-linux" "i686-linux" ];
+    maintainers = with maintainers; [ nyanbinary ];
+  };
+}
--- a/pkgs/desktops/xfce/applications/parole/default.nix
+++ b/pkgs/desktops/xfce/applications/parole/default.nix
@ -1,15 +1,25 @@
-{ lib, mkXfceDerivation, dbus, dbus-glib
-, gst_all_1, gtk3, libnotify, libxfce4ui, libxfce4util
-, taglib, xfconf }:
+{ lib
+, mkXfceDerivation
+, dbus
+, dbus-glib
+, gst_all_1
+, gtk3
+, libnotify
+, libX11
+, libxfce4ui
+, libxfce4util
+, taglib
+, xfconf
+}:

 # Doesn't seem to find H.264 codec even though built with gst-plugins-bad.

 mkXfceDerivation {
  category = "apps";
  pname = "parole";
-  version = "4.18.0";
+  version = "4.18.1";

-  sha256 = "sha256-TLH9ZUggjclJlbBg3EBVgbcrdiMZ8n+cGDgfNgYNiPI=";
+  sha256 = "sha256-g+Wy90tHpCeylbU7aUa8578ehmuyWI5WlCK7YdJKlNQ=";

  postPatch = ''
    substituteInPlace src/plugins/mpris2/Makefile.am \
@ -25,6 +35,7 @@ mkXfceDerivation {
    gst-plugins-ugly
    gtk3
    libnotify
+    libX11
    libxfce4ui
    libxfce4util
    taglib
--- a/pkgs/desktops/xfce/core/tumbler/default.nix
+++ b/pkgs/desktops/xfce/core/tumbler/default.nix
@ -16,9 +16,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "tumbler";
-  version = "4.18.1";
+  version = "4.18.2";

-  sha256 = "sha256-hn77W8IsvwNc9xSuDe9rXw9499olOvvJ2P7q+26HIG8=";
+  sha256 = "sha256-thioE0q2qnV4weJFPz8OWoHIRuUcXnQEviwBtCWsSV4=";

  buildInputs = [
    libxfce4util
--- a/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
@ -12,9 +12,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "xfce4-power-manager";
-  version = "4.18.2";
+  version = "4.18.3";

-  sha256 = "sha256-1+DP5CACzzj96FyRTeCdVEFORnpzFT49d9Uk1iijbFs=";
+  sha256 = "sha256-CuW2siApho7u8P01t15dAiqNAiwQzAMZsEugYuKN4kM=";

  buildInputs = [
    gtk3
--- a/pkgs/desktops/xfce/core/xfce4-settings/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-settings/default.nix
@ -16,9 +16,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "xfce4-settings";
-  version = "4.18.3";
+  version = "4.18.4";

-  sha256 = "sha256-QGh5th790qkvqchUfi+kOAJ9A1M+zEIzMxOM5eCGPEk=";
+  sha256 = "sha256-f6ldTmTSvfRjn6j/LKIoFI3cbYZFtNdnAq3dQewc948=";

  postPatch = ''
    for f in xfsettingsd/pointers.c dialogs/mouse-settings/main.c; do
--- a/pkgs/development/interpreters/elixir/generic-builder.nix
+++ b/pkgs/development/interpreters/elixir/generic-builder.nix
@ -20,7 +20,7 @@
 } @ args:

 let
-  inherit (lib) getVersion versionAtLeast optional;
+  inherit (lib) getVersion versionAtLeast optional concatStringsSep;

 in
 assert versionAtLeast (getVersion erlang) minimumOTPVersion;
@ -36,7 +36,12 @@ stdenv.mkDerivation ({
  LANG = "C.UTF-8";
  LC_TYPE = "C.UTF-8";

-  buildFlags = optional debugInfo "ERL_COMPILER_OPTIONS=debug_info";
+  ERLC_OPTS =
+    let
+      erlc_opts = [ "deterministic" ]
+        ++ optional debugInfo "debug_info";
+    in
+    "[${concatStringsSep "," erlc_opts}]";

  preBuild = ''
    patchShebangs ${escriptPath} || true
--- a/pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py
+++ b/pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py
@ -12,23 +12,24 @@ to update all non-pinned libraries in that folder.
 """

 import argparse
+import collections
 import json
 import logging
 import os
 import re
-import requests
-from concurrent.futures import ThreadPoolExecutor as Pool
-from packaging.version import Version as _Version
-from packaging.version import InvalidVersion
-from packaging.specifiers import SpecifierSet
-from typing import Optional, Any
-import collections
 import subprocess
+from concurrent.futures import ThreadPoolExecutor as Pool
+from typing import Any, Optional
+
+import requests
+from packaging.specifiers import SpecifierSet
+from packaging.version import InvalidVersion
+from packaging.version import Version as _Version

 INDEX = "https://pypi.io/pypi"
 """url of PyPI"""

-EXTENSIONS = ['tar.gz', 'tar.bz2', 'tar', 'zip', '.whl']
+EXTENSIONS = ["tar.gz", "tar.bz2", "tar", "zip", ".whl"]
 """Permitted file extensions. These are evaluated from left to right and the first occurance is returned."""

 PRERELEASES = False
@ -37,13 +38,16 @@ BULK_UPDATE = False

 GIT = "git"

-NIXPKGS_ROOT = subprocess.check_output(["git", "rev-parse", "--show-toplevel"]).decode('utf-8').strip()
+NIXPKGS_ROOT = (
+    subprocess.check_output(["git", "rev-parse", "--show-toplevel"])
+    .decode("utf-8")
+    .strip()
+)

 logging.basicConfig(level=logging.INFO)


 class Version(_Version, collections.abc.Sequence):
-
    def __init__(self, version):
        super().__init__(version)
        # We cannot use `str(Version(0.04.21))` because that becomes `0.4.21`
@ -65,7 +69,7 @@ def _get_values(attribute, text):

    :returns: List of matches.
    """
-    regex = fr'{re.escape(attribute)}\s+=\s+"(.*)";'
+    regex = rf'{re.escape(attribute)}\s+=\s+"(.*)";'
    regex = re.compile(regex)
    values = regex.findall(text)
    return values
@ -73,14 +77,19 @@ def _get_values(attribute, text):

 def _get_attr_value(attr_path: str) -> Optional[Any]:
    try:
-        response = subprocess.check_output([
+        response = subprocess.check_output(
+            [
                "nix",
-            "--extra-experimental-features", "nix-command",
+                "--extra-experimental-features",
+                "nix-command",
                "eval",
-            "-f", f"{NIXPKGS_ROOT}/default.nix",
+                "-f",
+                f"{NIXPKGS_ROOT}/default.nix",
                "--json",
-            f"{attr_path}"
-        ])
+                f"{attr_path}",
+            ],
+            stderr=subprocess.DEVNULL,
+        )
        return json.loads(response.decode())
    except (subprocess.CalledProcessError, ValueError):
        return None
@ -100,12 +109,13 @@ def _get_unique_value(attribute, text):
    else:
        raise ValueError("no value found for {}".format(attribute))

+
 def _get_line_and_value(attribute, text, value=None):
    """Match attribute in text. Return the line and the value of the attribute."""
    if value is None:
-        regex = rf'({re.escape(attribute)}\s+=\s+\"(.*)\";)'
+        regex = rf"({re.escape(attribute)}\s+=\s+\"(.*)\";)"
    else:
-        regex = rf'({re.escape(attribute)}\s+=\s+\"({re.escape(value)})\";)'
+        regex = rf"({re.escape(attribute)}\s+=\s+\"({re.escape(value)})\";)"
    regex = re.compile(regex)
    results = regex.findall(text)
    n = len(results)
@ -138,7 +148,7 @@ def _fetch_page(url):

 def _fetch_github(url):
    headers = {}
-    token = os.environ.get('GITHUB_API_TOKEN')
+    token = os.environ.get("GITHUB_API_TOKEN")
    if token:
        headers["Authorization"] = f"token {token}"
    r = requests.get(url, headers=headers)
@ -151,31 +161,26 @@ def _fetch_github(url):

 def _hash_to_sri(algorithm, value):
    """Convert a hash to its SRI representation"""
-    return subprocess.check_output([
-        "nix",
-        "hash",
-        "to-sri",
-        "--type", algorithm,
-        value
-    ]).decode().strip()
+    return (
+        subprocess.check_output(["nix", "hash", "to-sri", "--type", algorithm, value])
+        .decode()
+        .strip()
+    )


 def _skip_bulk_update(attr_name: str) -> bool:
-    return bool(_get_attr_value(
-        f"{attr_name}.skipBulkUpdate"
-    ))
+    return bool(_get_attr_value(f"{attr_name}.skipBulkUpdate"))


 SEMVER = {
-    'major' : 0,
-    'minor' : 1,
-    'patch' : 2,
+    "major": 0,
+    "minor": 1,
+    "patch": 2,
 }


 def _determine_latest_version(current_version, target, versions):
-    """Determine latest version, given `target`.
-    """
+    """Determine latest version, given `target`."""
    current_version = Version(current_version)

    def _parse_versions(versions):
@ -193,7 +198,7 @@ def _determine_latest_version(current_version, target, versions):
    if len(ceiling) == 0:
        ceiling = None
    else:
-        ceiling[-1]+=1
+        ceiling[-1] += 1
        ceiling = Version(".".join(map(str, ceiling)))

    # We do not want prereleases
@ -210,17 +215,19 @@ def _get_latest_version_pypi(package, extension, current_version, target):
    url = "{}/{}/json".format(INDEX, package)
    json = _fetch_page(url)

-    versions = json['releases'].keys()
+    versions = json["releases"].keys()
    version = _determine_latest_version(current_version, target, versions)

    try:
-        releases = json['releases'][version]
+        releases = json["releases"][version]
    except KeyError as e:
-        raise KeyError('Could not find version {} for {}'.format(version, package)) from e
+        raise KeyError(
+            "Could not find version {} for {}".format(version, package)
+        ) from e
    for release in releases:
-        if release['filename'].endswith(extension):
+        if release["filename"].endswith(extension):
            # TODO: In case of wheel we need to do further checks!
-            sha256 = release['digests']['sha256']
+            sha256 = release["digests"]["sha256"]
            break
    else:
        sha256 = None
@ -240,33 +247,40 @@ def _get_latest_version_github(package, extension, current_version, target):
    attr_path = os.environ.get("UPDATE_NIX_ATTR_PATH", f"python3Packages.{package}")
    try:
        homepage = subprocess.check_output(
-            ["nix", "eval", "-f", f"{NIXPKGS_ROOT}/default.nix", "--raw", f"{attr_path}.src.meta.homepage"])\
-            .decode('utf-8')
+            [
+                "nix",
+                "eval",
+                "-f",
+                f"{NIXPKGS_ROOT}/default.nix",
+                "--raw",
+                f"{attr_path}.src.meta.homepage",
+            ]
+        ).decode("utf-8")
    except Exception as e:
        raise ValueError(f"Unable to determine homepage: {e}")
-    owner_repo = homepage[len("https://github.com/"):]  # remove prefix
+    owner_repo = homepage[len("https://github.com/") :]  # remove prefix
    owner, repo = owner_repo.split("/")

    url = f"https://api.github.com/repos/{owner}/{repo}/releases"
    all_releases = _fetch_github(url)
-    releases = list(filter(lambda x: not x['prerelease'], all_releases))
+    releases = list(filter(lambda x: not x["prerelease"], all_releases))

    if len(releases) == 0:
        raise ValueError(f"{homepage} does not contain any stable releases")

-    versions = map(lambda x: strip_prefix(x['tag_name']), releases)
+    versions = map(lambda x: strip_prefix(x["tag_name"]), releases)
    version = _determine_latest_version(current_version, target, versions)

-    release = next(filter(lambda x: strip_prefix(x['tag_name']) == version, releases))
-    prefix = get_prefix(release['tag_name'])
+    release = next(filter(lambda x: strip_prefix(x["tag_name"]) == version, releases))
+    prefix = get_prefix(release["tag_name"])

    # some attributes require using the fetchgit
    git_fetcher_args = []
-    if (_get_attr_value(f"{attr_path}.src.fetchSubmodules")):
+    if _get_attr_value(f"{attr_path}.src.fetchSubmodules"):
        git_fetcher_args.append("--fetch-submodules")
-    if (_get_attr_value(f"{attr_path}.src.fetchLFS")):
+    if _get_attr_value(f"{attr_path}.src.fetchLFS"):
        git_fetcher_args.append("--fetch-lfs")
-    if (_get_attr_value(f"{attr_path}.src.leaveDotGit")):
+    if _get_attr_value(f"{attr_path}.src.leaveDotGit"):
        git_fetcher_args.append("--leave-dotGit")

    if git_fetcher_args:
@ -274,8 +288,10 @@ def _get_latest_version_github(package, extension, current_version, target):
        cmd = [
            "nix-prefetch-git",
            f"https://github.com/{owner}/{repo}.git",
-            "--hash", algorithm,
-            "--rev", f"refs/tags/{release['tag_name']}"
+            "--hash",
+            algorithm,
+            "--rev",
+            f"refs/tags/{release['tag_name']}",
        ]
        cmd.extend(git_fetcher_args)
        response = subprocess.check_output(cmd)
@ -283,45 +299,60 @@ def _get_latest_version_github(package, extension, current_version, target):
        hash = _hash_to_sri(algorithm, document[algorithm])
    else:
        try:
-            hash = subprocess.check_output([
+            hash = (
+                subprocess.check_output(
+                    [
                        "nix-prefetch-url",
-                "--type", "sha256",
+                        "--type",
+                        "sha256",
                        "--unpack",
-                f"{release['tarball_url']}"
-            ], stderr=subprocess.DEVNULL).decode('utf-8').strip()
+                        f"{release['tarball_url']}",
+                    ],
+                    stderr=subprocess.DEVNULL,
+                )
+                .decode("utf-8")
+                .strip()
+            )
        except (subprocess.CalledProcessError, UnicodeError):
            # this may fail if they have both a branch and a tag of the same name, attempt tag name
-            tag_url = str(release['tarball_url']).replace("tarball","tarball/refs/tags")
-            hash = subprocess.check_output([
-                "nix-prefetch-url",
-                "--type", "sha256",
-                "--unpack",
-                tag_url
-            ], stderr=subprocess.DEVNULL).decode('utf-8').strip()
+            tag_url = str(release["tarball_url"]).replace(
+                "tarball", "tarball/refs/tags"
+            )
+            hash = (
+                subprocess.check_output(
+                    ["nix-prefetch-url", "--type", "sha256", "--unpack", tag_url],
+                    stderr=subprocess.DEVNULL,
+                )
+                .decode("utf-8")
+                .strip()
+            )

    return version, hash, prefix


 FETCHERS = {
-    'fetchFromGitHub'   :   _get_latest_version_github,
-    'fetchPypi'         :   _get_latest_version_pypi,
-    'fetchurl'          :   _get_latest_version_pypi,
+    "fetchFromGitHub": _get_latest_version_github,
+    "fetchPypi": _get_latest_version_pypi,
+    "fetchurl": _get_latest_version_pypi,
 }


-DEFAULT_SETUPTOOLS_EXTENSION = 'tar.gz'
+DEFAULT_SETUPTOOLS_EXTENSION = "tar.gz"


 FORMATS = {
-    'setuptools'        :   DEFAULT_SETUPTOOLS_EXTENSION,
-    'wheel'             :   'whl',
-    'pyproject'         :   'tar.gz',
-    'flit'              :   'tar.gz'
+    "setuptools": DEFAULT_SETUPTOOLS_EXTENSION,
+    "wheel": "whl",
+    "pyproject": "tar.gz",
+    "flit": "tar.gz",
 }

+
 def _determine_fetcher(text):
    # Count occurrences of fetchers.
-    nfetchers = sum(text.count('src = {}'.format(fetcher)) for fetcher in FETCHERS.keys())
+    nfetchers = sum(
+        text.count("src = {}".format(fetcher)) for fetcher in FETCHERS.keys()
+    )
    if nfetchers == 0:
        raise ValueError("no fetcher.")
    elif nfetchers > 1:
@ -329,7 +360,7 @@ def _determine_fetcher(text):
    else:
        # Then we check which fetcher to use.
        for fetcher in FETCHERS.keys():
-            if 'src = {}'.format(fetcher) in text:
+            if "src = {}".format(fetcher) in text:
                return fetcher


@ -341,47 +372,46 @@ def _determine_extension(text, fetcher):
    - fetchurl, we determine the extension from the url.
    - fetchFromGitHub we simply use `.tar.gz`.
    """
-    if fetcher == 'fetchPypi':
+    if fetcher == "fetchPypi":
        try:
-            src_format = _get_unique_value('format', text)
+            src_format = _get_unique_value("format", text)
        except ValueError:
            src_format = None  # format was not given

        try:
-            extension = _get_unique_value('extension', text)
+            extension = _get_unique_value("extension", text)
        except ValueError:
            extension = None  # extension was not given

        if extension is None:
            if src_format is None:
-                src_format = 'setuptools'
-            elif src_format == 'other':
+                src_format = "setuptools"
+            elif src_format == "other":
                raise ValueError("Don't know how to update a format='other' package.")
            extension = FORMATS[src_format]

-    elif fetcher == 'fetchurl':
-        url = _get_unique_value('url', text)
+    elif fetcher == "fetchurl":
+        url = _get_unique_value("url", text)
        extension = os.path.splitext(url)[1]
-        if 'pypi' not in url:
-            raise ValueError('url does not point to PyPI.')
+        if "pypi" not in url:
+            raise ValueError("url does not point to PyPI.")

-    elif fetcher == 'fetchFromGitHub':
+    elif fetcher == "fetchFromGitHub":
        extension = "tar.gz"

    return extension


 def _update_package(path, target):
-
    # Read the expression
-    with open(path, 'r') as f:
+    with open(path, "r") as f:
        text = f.read()

    # Determine pname. Many files have more than one pname
-    pnames = _get_values('pname', text)
+    pnames = _get_values("pname", text)

    # Determine version.
-    version = _get_unique_value('version', text)
+    version = _get_unique_value("version", text)

    # First we check how many fetchers are mentioned.
    fetcher = _determine_fetcher(text)
@ -393,8 +423,12 @@ def _update_package(path, target):
    for pname in pnames:
        if BULK_UPDATE and _skip_bulk_update(f"python3Packages.{pname}"):
            raise ValueError(f"Bulk update skipped for {pname}")
+        elif _get_attr_value(f"python3Packages.{pname}.cargoDeps") is not None:
+            raise ValueError(f"Cargo dependencies are unsupported, skipping {pname}")
        try:
-            new_version, new_sha256, prefix = FETCHERS[fetcher](pname, extension, version, target)
+            new_version, new_sha256, prefix = FETCHERS[fetcher](
+                pname, extension, version, target
+            )
            successful_fetch = True
            break
        except ValueError:
@ -411,7 +445,7 @@ def _update_package(path, target):
    if not new_sha256:
        raise ValueError("no file available for {}.".format(pname))

-    text = _replace_value('version', new_version, text)
+    text = _replace_value("version", new_version, text)

    # hashes from pypi are 16-bit encoded sha256's, normalize it to sri to avoid merge conflicts
    # sri hashes have been the default format since nix 2.4+
@ -421,16 +455,16 @@ def _update_package(path, target):
    if old_hash := _get_attr_value(f"python3Packages.{pname}.src.outputHash"):
        # fetchers can specify a sha256, or a sri hash
        try:
-            text = _replace_value('hash', sri_hash, text, old_hash)
+            text = _replace_value("hash", sri_hash, text, old_hash)
        except ValueError:
-            text = _replace_value('sha256', sri_hash, text, old_hash)
+            text = _replace_value("sha256", sri_hash, text, old_hash)
    else:
        raise ValueError(f"Unable to retrieve old hash for {pname}")

-    if fetcher == 'fetchFromGitHub':
+    if fetcher == "fetchFromGitHub":
        # in the case of fetchFromGitHub, it's common to see `rev = version;` or `rev = "v${version}";`
        # in which no string value is meant to be substituted. However, we can just overwrite the previous value.
-        regex = r'(rev\s+=\s+[^;]*;)'
+        regex = r"(rev\s+=\s+[^;]*;)"
        regex = re.compile(regex)
        matches = regex.findall(text)
        n = len(matches)
@ -442,19 +476,23 @@ def _update_package(path, target):
            match = matches[0]
            text = text.replace(match, f'rev = "refs/tags/{prefix}${{version}}";')
            # incase there's no prefix, just rewrite without interpolation
-            text = text.replace('"${version}";', 'version;')
+            text = text.replace('"${version}";', "version;")

-    with open(path, 'w') as f:
+    with open(path, "w") as f:
        f.write(text)

-        logging.info("Path {}: updated {} from {} to {}".format(path, pname, version, new_version))
+        logging.info(
+            "Path {}: updated {} from {} to {}".format(
+                path, pname, version, new_version
+            )
+        )

    result = {
-        'path'  : path,
-        'target': target,
-        'pname': pname,
-        'old_version'   : version,
-        'new_version'   : new_version,
+        "path": path,
+        "target": target,
+        "pname": pname,
+        "old_version": version,
+        "new_version": new_version,
        #'fetcher'       : fetcher,
    }

@ -462,10 +500,9 @@ def _update_package(path, target):


 def _update(path, target):
-
    # We need to read and modify a Nix expression.
    if os.path.isdir(path):
-        path = os.path.join(path, 'default.nix')
+        path = os.path.join(path, "default.nix")

    # If a default.nix does not exist, we quit.
    if not os.path.isfile(path):
@ -485,32 +522,41 @@ def _update(path, target):


 def _commit(path, pname, old_version, new_version, pkgs_prefix="python: ", **kwargs):
-    """Commit result.
-    """
+    """Commit result."""

-    msg = f'{pkgs_prefix}{pname}: {old_version} -> {new_version}'
+    msg = f"{pkgs_prefix}{pname}: {old_version} -> {new_version}"
+
+    if changelog := _get_attr_value(f"{pkgs_prefix}{pname}.meta.changelog"):
+        msg += f"\n\n{changelog}"

    try:
-        subprocess.check_call([GIT, 'add', path])
-        subprocess.check_call([GIT, 'commit', '-m', msg])
+        subprocess.check_call([GIT, "add", path])
+        subprocess.check_call([GIT, "commit", "-m", msg])
    except subprocess.CalledProcessError as e:
-        subprocess.check_call([GIT, 'checkout', path])
-        raise subprocess.CalledProcessError(f'Could not commit {path}') from e
+        subprocess.check_call([GIT, "checkout", path])
+        raise subprocess.CalledProcessError(f"Could not commit {path}") from e

    return True


 def main():
-
    epilog = """
 environment variables:
  GITHUB_API_TOKEN\tGitHub API token used when updating github packages
    """
-    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter, epilog=epilog)
-    parser.add_argument('package', type=str, nargs='+')
-    parser.add_argument('--target', type=str, choices=SEMVER.keys(), default='major')
-    parser.add_argument('--commit', action='store_true', help='Create a commit for each package update')
-    parser.add_argument('--use-pkgs-prefix', action='store_true', help='Use python3Packages.${pname}: instead of python: ${pname}: when making commits')
+    parser = argparse.ArgumentParser(
+        formatter_class=argparse.RawDescriptionHelpFormatter, epilog=epilog
+    )
+    parser.add_argument("package", type=str, nargs="+")
+    parser.add_argument("--target", type=str, choices=SEMVER.keys(), default="major")
+    parser.add_argument(
+        "--commit", action="store_true", help="Create a commit for each package update"
+    )
+    parser.add_argument(
+        "--use-pkgs-prefix",
+        action="store_true",
+        help="Use python3Packages.${pname}: instead of python: ${pname}: when making commits",
+    )

    args = parser.parse_args()
    target = args.target
@ -545,6 +591,5 @@ environment variables:
    logging.info("{} package(s) updated".format(count))


-
-if __name__ == '__main__':
+if __name__ == "__main__":
    main()
--- a/pkgs/development/libraries/mlt/default.nix
+++ b/pkgs/development/libraries/mlt/default.nix
@ -40,13 +40,13 @@

 stdenv.mkDerivation rec {
  pname = "mlt";
-  version = "7.20.0";
+  version = "7.22.0";

  src = fetchFromGitHub {
    owner = "mltframework";
    repo = "mlt";
    rev = "v${version}";
-    hash = "sha256-5yELGA3U/YkINEtRyr/tb3HjWMQjqKIWjUbH7ZFMgLU=";
+    hash = "sha256-vJKpeEdQIWBQRRdDui5ibSZtD8qUlDZBD+UQE+0cQqk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/tiledb/default.nix
+++ b/pkgs/development/libraries/tiledb/default.nix
@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "tiledb";
-  version = "2.18.0";
+  version = "2.18.2";

  src = fetchFromGitHub {
    owner = "TileDB-Inc";
    repo = "TileDB";
    rev = version;
-    hash = "sha256-y5/kXODzkNKmMn8P+WOOWGy9Htd0nhXbUxmfw/SqSYY=";
+    hash = "sha256-uLiXhigYz3v7NgY38twot3sBHxZS5QCrOiPfME4wWzE=";
  };

  patches = [
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@ -26,14 +26,14 @@

 buildPythonPackage rec {
  pname = "black";
-  version = "23.9.1";
+  version = "23.11.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-JLaz/1xtnqCKiIj2l36uhY4fNA1yYM9W1wpJgjI2ti0=";
+    hash = "sha256-TGiFWCX/Qy0ZcimEb5cbxNZmbOkEkuWwIBO8rKTZqwU=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@ -42,14 +42,14 @@

 buildPythonPackage rec {
  pname = "Django";
-  version = "5.0b1";
+  version = "5.0rc1";
  pyproject = true;

  disabled = pythonOlder "3.10";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-yIY15zPwoO9GwhljXiHI9ZeOsqFMORgiRlRUG8XVcDA=";
+    hash = "sha256-pLt3plnaAyt0GpXcuVeGTzaVJ10dWB73Y3IUMA+qrzA=";
  };

  patches = [
--- a/pkgs/development/python-modules/fontawesomefree/default.nix
+++ b/pkgs/development/python-modules/fontawesomefree/default.nix
@ -5,7 +5,7 @@

 buildPythonPackage rec {
  pname = "fontawesomefree";
-  version = "6.4.2";
+  version = "6.5.1";
  format = "wheel";

  # they only provide a wheel
@ -13,7 +13,7 @@ buildPythonPackage rec {
    inherit pname version format;
    dist = "py3";
    python = "py3";
-    hash = "sha256-zq/378T8Odrf88P/cpinoQlUAxENNz8iRWuxw0q22wI=";
+    hash = "sha256-jexKLuN7+OUzeeu/DTjO/sTgbHySJ/Wa8527exYygXs=";
  };

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/glfw/default.nix
+++ b/pkgs/development/python-modules/glfw/default.nix
@ -20,10 +20,8 @@ buildPythonPackage rec {
  };

  # Patch path to GLFW shared object
-  patches = [ ./search-path.patch ];
-
  postPatch = ''
-    substituteInPlace glfw/library.py --replace "@GLFW@" '${glfw3}/lib'
+    substituteInPlace glfw/library.py --replace "_get_library_search_paths()," "[ '${glfw3}/lib' ],"
  '';

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/glfw/search-path.patch
+++ b/pkgs/development/python-modules/glfw/search-path.patch
@ -1,11 +0,0 @@
-diff --git a/glfw/library.py b/glfw/library.py
-index 20387e1..9bdd62a 100644
--- a/glfw/library.py
-+++ b/glfw/library.py
-@@ -189,5 +189,4 @@ elif sys.platform == 'win32':
-         except OSError:
-             pass
- else:
-    glfw = _load_library(['glfw', 'glfw3'], ['.so', '.dylib'],
-                          _get_library_search_paths(), _glfw_get_version)
-+    glfw = _load_library(['glfw', 'glfw3'], ['.so', '.dylib'], ['@GLFW@'], _glfw_get_version)
--- a/pkgs/development/python-modules/mujoco/default.nix
+++ b/pkgs/development/python-modules/mujoco/default.nix
@ -0,0 +1,70 @@
+{ buildPythonPackage
+, cmake
+, fetchPypi
+, glfw
+, lib
+, mujoco
+, numpy
+, perl
+, pkgs
+, pybind11
+, python
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "mujoco";
+  version = "3.0.1";
+
+  pyproject = true;
+
+  # We do not fetch from the repository because the PyPi tarball is
+  # impurely build via
+  # <https://github.com/google-deepmind/mujoco/blob/main/python/make_sdist.sh>
+  # in the project's CI.
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-pftecOk4q19qKBHs9hBBVenI+SgJg9VT7vc6NKuiY0s=";
+  };
+
+  nativeBuildInputs = [ cmake setuptools ];
+  dontUseCmakeConfigure = true;
+  buildInputs = [ mujoco pybind11 ];
+  propagatedBuildInputs = [ glfw numpy ];
+
+  pythonImportsCheck = [ "${pname}" ];
+
+  env.MUJOCO_PATH = "${mujoco}";
+  env.MUJOCO_PLUGIN_PATH = "${mujoco}/lib";
+  env.MUJOCO_CMAKE_ARGS = "-DMUJOCO_SIMULATE_USE_SYSTEM_GLFW=ON";
+
+  preConfigure =
+    # Use system packages for pybind
+    ''
+      ${perl}/bin/perl -0777 -i -pe "s/(findorfetch\(.{3}USE_SYSTEM_PACKAGE.{3})(OFF)(.{3}PACKAGE_NAME.{3}pybind11.*\))/\1ON\3/gms" mujoco/CMakeLists.txt
+    '' +
+    # Use non-system eigen3, lodepng, abseil: Remove mirror info and prefill
+    # dependency directory. $build from setuptools.
+    (let
+      # E.g. 3.11.2 -> "311"
+      pythonVersionMajorMinor = with lib.versions;
+        "${major python.pythonVersion}${minor python.pythonVersion}";
+    in ''
+      ${perl}/bin/perl -0777 -i -pe "s/GIT_REPO\n.*\n.*GIT_TAG\n.*\n//gm" mujoco/CMakeLists.txt
+      ${perl}/bin/perl -0777 -i -pe "s/(FetchContent_Declare\(\n.*lodepng\n.*)(GIT_REPO.*\n.*GIT_TAG.*\n)(.*\))/\1\3/gm" mujoco/simulate/CMakeLists.txt
+
+      build="/build/${pname}-${version}/build/temp.linux-x86_64-cpython-${pythonVersionMajorMinor}/"
+      mkdir -p $build/_deps
+      ln -s ${mujoco.pin.lodepng} $build/_deps/lodepng-src
+      ln -s ${mujoco.pin.eigen3} $build/_deps/eigen-src
+      ln -s ${mujoco.pin.abseil-cpp} $build/_deps/abseil-cpp-src
+    '');
+
+  meta = with lib; {
+    description =
+      "Python bindings for MuJoCo: a general purpose physics simulator.";
+    homepage = "https://mujoco.org/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ tmplt ];
+  };
+}
--- a/pkgs/development/tools/fsautocomplete/deps.nix
+++ b/pkgs/development/tools/fsautocomplete/deps.nix
@ -78,9 +78,9 @@
  (fetchNuGet { pname = "McMaster.NETCore.Plugins"; version = "1.4.0"; sha256 = "1k2qz0qnf2b1kfwbzcynivy93jm7dcwl866d0fl7qlgq5vql7niy"; })
  (fetchNuGet { pname = "MessagePack"; version = "2.5.108"; sha256 = "0cnaz28lhrdmavnxjkakl9q8p2yv8mricvp1b0wxdfnz8v41gwzs"; })
  (fetchNuGet { pname = "MessagePack.Annotations"; version = "2.5.108"; sha256 = "0nb1fx8dwl7304kw0bc375bvlhb7pg351l4cl3vqqd7d8zqjwx5v"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "6.0.24"; sha256 = "0lriw4f48f0q2vyagbngnffshdismn3msn7d6dj0lb2xdkzsz1f1"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.24"; sha256 = "08670zhn2ywkwy0d7sj89rikxccy5qg0vsjwpbypvzndawng0bb9"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.24"; sha256 = "0knx6lhlqxn3lkgakpab0663788q0si00m9ga7wdn2mzqq0s9yx0"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "6.0.25"; sha256 = "1vrmqn5j6ibwkqasbf7x7n4w5jdclnz3giymiwvym2wa0y5zc59q"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.25"; sha256 = "0mgcs4si7mwd0f555s1vg17pf4nqfaijd1pci359l1pgrmv70rrg"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.25"; sha256 = "0wvzhqhlmlbnpa18qp8m3wcrlcgj3ckvp3iv2n7g8vb60c3238aq"; })
  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "7.0.0"; sha256 = "1waiggh3g1cclc81gmjrqbh128kwfjky3z79ma4bd2ms9pa3gvfm"; })
  (fetchNuGet { pname = "Microsoft.Bcl.HashCode"; version = "1.1.0"; sha256 = "1ggsadahlp76zcn1plapszd5v5ja8rh479fwrahqd3knql4dfnr0"; })
  (fetchNuGet { pname = "Microsoft.Build"; version = "17.2.0"; sha256 = "09hs74nr0kv83wc1way9x7vq3nmxbr2s4vdy99hx78kj25pylcr7"; })
@ -121,11 +121,11 @@
  (fetchNuGet { pname = "Microsoft.NET.StringTools"; version = "17.4.0"; sha256 = "1smx30nq22plrn2mw4wb5vfgxk6hyx12b60c4wabmpnr81lq3nzv"; })
  (fetchNuGet { pname = "Microsoft.NET.StringTools"; version = "17.6.3"; sha256 = "0g5jdg0jp844a2ygwlm04igsxkrihqcq2rpmfx722nrv3vrk0r0z"; })
  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.4.1"; sha256 = "02p1j9fncd4fb2hyp51kw49d0dz30vvazhzk24c9f5ccc00ijpra"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "6.0.24"; sha256 = "1vyy01i4w2wcx82mrjjsbp98v9sjn1cwhdvkhrw8yrrb04lcxbir"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.24"; sha256 = "02l6javfqwsaialkimmpsq3v4dhb1j4sxy19yvr5w5sdjmq1jh5y"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "6.0.24"; sha256 = "1fy1hr14igy4lix4vmwkjj13cbyjjfhx8izch9cd9hc4f1y25767"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.24"; sha256 = "1zcn4px94z67j60cidynm5ab8cln1rrxabv7c24mlajqnkfw14sb"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.24"; sha256 = "0rylvdvdc5rdmw2vcqi0fdzmiwwa1pwlqiavqnb2pslhhq8qg4mh"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "6.0.25"; sha256 = "052388yjivzkfllkss0nljbzmjx787jqdjsbb6ls855sp6wh9xfd"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.25"; sha256 = "103xy6kncjwbbchfnpqvsjpjy92x3dralcg9pw939jp0dwggwarz"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "6.0.25"; sha256 = "0jfhmfxpx1h4f3axgf60gc8d4cnlvbb853400kag6nk0875hr0x1"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.25"; sha256 = "0jpcmva1l8z36r4phz055l7fz9s6z8pv8pqc4ia69mhhgvr0ks7y"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.25"; sha256 = "012jml0bqxbspahf1j4bvvd91pz85hsbcyhq00gxczcazhxpkhz4"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "7.0.4"; sha256 = "0afmivk3m0hmwsiqnl87frzi7g57aiv5fwnjds0icl66djpb6zsm"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "5.0.0"; sha256 = "0z3qyv7qal5irvabc8lmkh58zsl42mrzd1i0sssvzhv4q4kl3cg6"; })
  (fetchNuGet { pname = "Microsoft.NETFramework.ReferenceAssemblies"; version = "1.0.3"; sha256 = "0hc4d4d4358g5192mf8faijwk0bpf9pjwcfd3h85sr67j0zhj6hl"; })
--- a/pkgs/games/amoeba/default.nix
+++ b/pkgs/games/amoeba/default.nix
@ -1,18 +1,18 @@
-{ lib, stdenv, fetchurl, amoeba-data, alsa-lib, expat, freetype, gtk2, libvorbis, libGLU, xorg, pkg-config }:
+{ lib, stdenv, fetchurl, amoeba-data, alsa-lib, expat, freetype, gtk3, libvorbis, libGLU, xorg, pkg-config, installShellFiles }:

 stdenv.mkDerivation rec {
  pname = "amoeba";
  version = "1.1";
-  debver = "29.1";
+  debver = "31";

  srcs = [
    (fetchurl {
      url = "http://http.debian.net/debian/pool/contrib/a/amoeba/amoeba_${version}.orig.tar.gz";
-      sha256 = "1hyycw4r36ryka2gab9vzkgs8gq4gqhk08vn29cwak95w0rahgim";
+      hash = "sha256-NT6oMuAlTcVZEnYjMCF+BD+k3/w7LfWEmj6bkQln3sM=";
    })
    (fetchurl {
      url = "http://http.debian.net/debian/pool/contrib/a/amoeba/amoeba_${version}-${debver}.debian.tar.xz";
-      sha256 = "1xgi2sqzq97w6hd3dcyq6cka8xmp6nr25qymzhk52cwqh7qb75p3";
+      hash = "sha256-Ga/YeXbPXjkG/6qd9Z201d14Hlj/Je6DxgzeIQOqrWc=";
    })
  ];
  sourceRoot = "amoeba-1.1.orig";
@ -22,17 +22,17 @@ stdenv.mkDerivation rec {
  '';
  postPatch = ''
    sed -i packer/pakfile.cpp -e 's|/usr/share/amoeba|${amoeba-data}/share/amoeba|'
-    sed -i main/linux-config/linux-config.cpp -e 's|libgdk-x11-2.0.so.0|${gtk2}/lib/&|'
-    sed -i main/linux-config/linux-config.cpp -e 's|libgtk-x11-2.0.so.0|${gtk2}/lib/&|'
+    sed -i main/linux-config/linux-config.cpp -e 's|libgdk-x11-2.0.so.0|${gtk3}/lib/&|'
+    sed -i main/linux-config/linux-config.cpp -e 's|libgtk-x11-2.0.so.0|${gtk3}/lib/&|'
  '';

-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ alsa-lib expat freetype gtk2 libvorbis libGLU xorg.libXxf86vm ];
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+  buildInputs = [ alsa-lib expat freetype gtk3 libvorbis libGLU xorg.libXxf86vm ];

  installPhase = ''
-    mkdir -p $out/bin $out/share/man/man1/
+    mkdir -p $out/bin
    cp amoeba $out/bin/
-    cp ../debian/amoeba.1 $out/share/man/man1/
+    installManPage ../debian/amoeba.1
  '';

  meta = with lib; {
--- a/pkgs/misc/documentation-highlighter/LICENSE
+++ b/pkgs/misc/documentation-highlighter/LICENSE
@ -1,24 +1,29 @@
-Copyright (c) 2006, Ivan Sagalaev
+BSD 3-Clause License
+
+Copyright (c) 2006, Ivan Sagalaev.
 All rights reserved.
+
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:

-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-    * Neither the name of highlight.js nor the names of its contributors 
-      may be used to endorse or promote products derived from this software 
-      without specific prior written permission.
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.

-THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY
-EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE REGENTS AND CONTRIBUTORS BE LIABLE FOR ANY
-DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+* Neither the name of the copyright holder nor the names of its
+  contributors may be used to endorse or promote products derived from
+  this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--- a/pkgs/misc/documentation-highlighter/README.md
+++ b/pkgs/misc/documentation-highlighter/README.md
@ -1,132 +1,30 @@
 This file was generated with pkgs/misc/documentation-highlighter/update.sh

-# Highlight.js
+# Highlight.js CDN Assets

-[![Build Status](https://travis-ci.org/isagalaev/highlight.js.svg?branch=master)](https://travis-ci.org/isagalaev/highlight.js)
+[![install size](https://packagephobia.now.sh/badge?p=highlight.js)](https://packagephobia.now.sh/result?p=highlight.js)
+
+**This package contains only the CDN build assets of highlight.js.**
+
+This may be what you want if you'd like to install the pre-built distributable highlight.js client-side assets via NPM. If you're wanting to use highlight.js mainly on the server-side you likely want the [highlight.js][1] package instead.
+
+To access these files via CDN:<br>
+https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@latest/build/
+
+**If you just want a single .js file with the common languages built-in:
+<https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@latest/build/highlight.min.js>**
+
+---
+
+## Highlight.js

 Highlight.js is a syntax highlighter written in JavaScript. It works in
 the browser as well as on the server. It works with pretty much any
-markup, doesn’t depend on any framework and has automatic language
+markup, doesn’t depend on any framework, and has automatic language
 detection.

-## Getting Started
-
-The bare minimum for using highlight.js on a web page is linking to the
-library along with one of the styles and calling
-[`initHighlightingOnLoad`][1]:
-
-```html
-<link rel="stylesheet" href="/path/to/styles/default.css">
-<script src="/path/to/highlight.pack.js"></script>
-<script>hljs.initHighlightingOnLoad();</script>
-```
-
-This will find and highlight code inside of `<pre><code>` tags; it tries
-to detect the language automatically. If automatic detection doesn’t
-work for you, you can specify the language in the `class` attribute:
-
-```html
-<pre><code class="html">...</code></pre>
-```
-
-The list of supported language classes is available in the [class
-reference][2].  Classes can also be prefixed with either `language-` or
-`lang-`.
-
-To disable highlighting altogether use the `nohighlight` class:
-
-```html
-<pre><code class="nohighlight">...</code></pre>
-```
-
-## Custom Initialization
-
-When you need a bit more control over the initialization of
-highlight.js, you can use the [`highlightBlock`][3] and [`configure`][4]
-functions. This allows you to control *what* to highlight and *when*.
-
-Here’s an equivalent way to calling [`initHighlightingOnLoad`][1] using
-jQuery:
-
-```javascript
-$(document).ready(function() {
-  $('pre code').each(function(i, block) {
-    hljs.highlightBlock(block);
-  });
-});
-```
-
-You can use any tags instead of `<pre><code>` to mark up your code. If
-you don't use a container that preserve line breaks you will need to
-configure highlight.js to use the `<br>` tag:
-
-```javascript
-hljs.configure({useBR: true});
-
-$('div.code').each(function(i, block) {
-  hljs.highlightBlock(block);
-});
-```
-
-For other options refer to the documentation for [`configure`][4].
-
-
-## Web Workers
-
-You can run highlighting inside a web worker to avoid freezing the browser
-window while dealing with very big chunks of code.
-
-In your main script:
-
-```javascript
-addEventListener('load', function() {
-  var code = document.querySelector('#code');
-  var worker = new Worker('worker.js');
-  worker.onmessage = function(event) { code.innerHTML = event.data; }
-  worker.postMessage(code.textContent);
-})
-```
-
-In worker.js:
-
-```javascript
-onmessage = function(event) {
-  importScripts('<path>/highlight.pack.js');
-  var result = self.hljs.highlightAuto(event.data);
-  postMessage(result.value);
-}
-```
-
-
-## Getting the Library
-
-You can get highlight.js as a hosted, or custom-build, browser script or
-as a server module. Right out of the box the browser script supports
-both AMD and CommonJS, so if you wish you can use RequireJS or
-Browserify without having to build from source. The server module also
-works perfectly fine with Browserify, but there is the option to use a
-build specific to browsers rather than something meant for a server.
-Head over to the [download page][5] for all the options.
-
-**Don't link to GitHub directly.** The library is not supposed to work straight
-from the source, it requires building. If none of the pre-packaged options
-work for you refer to the [building documentation][6].
-
-**The CDN-hosted package doesn't have all the languages.** Otherwise it'd be
-too big. If you don't see the language you need in the ["Common" section][5],
-it can be added manually:
-
-```html
-<script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.4.0/languages/go.min.js"></script>
-```
-
-**On Almond.** You need to use the optimizer to give the module a name. For
-example:
-
-```
-r.js -o name=hljs paths.hljs=/path/to/highlight out=highlight.js
-```
-
+If you'd like to read the full README:<br>
+<https://github.com/highlightjs/highlight.js/blob/main/README.md>

 ## License

@ -137,16 +35,13 @@ for details.

 The official site for the library is at <https://highlightjs.org/>.

+The Github project may be found at: <https://github.com/highlightjs/highlight.js>
+
 Further in-depth documentation for the API and other topics is at
 <http://highlightjs.readthedocs.io/>.

-Authors and contributors are listed in the [AUTHORS.en.txt][8] file.
+A list of the Core Team and contributors can be found in the [CONTRIBUTORS.md][8] file.

-[1]: http://highlightjs.readthedocs.io/en/latest/api.html#inithighlightingonload
-[2]: http://highlightjs.readthedocs.io/en/latest/css-classes-reference.html
-[3]: http://highlightjs.readthedocs.io/en/latest/api.html#highlightblock-block
-[4]: http://highlightjs.readthedocs.io/en/latest/api.html#configure-options
-[5]: https://highlightjs.org/download/
-[6]: http://highlightjs.readthedocs.io/en/latest/building-testing.html
-[7]: https://github.com/isagalaev/highlight.js/blob/master/LICENSE
-[8]: https://github.com/isagalaev/highlight.js/blob/master/AUTHORS.en.txt
+[1]: https://www.npmjs.com/package/highlight.js
+[7]: https://github.com/highlightjs/highlight.js/blob/main/LICENSE
+[8]: https://github.com/highlightjs/highlight.js/blob/main/CONTRIBUTORS.md
--- a/pkgs/misc/documentation-highlighter/highlight.pack.js
+++ b/pkgs/misc/documentation-highlighter/highlight.pack.js
--- a/pkgs/misc/documentation-highlighter/loader.js
+++ b/pkgs/misc/documentation-highlighter/loader.js
@ -1,7 +1,6 @@
 /* This file is NOT part of highlight.js */
-document.onreadystatechange = function () {
-    var listings = document.querySelectorAll('.programlisting, .screen');
-    for (i = 0; i < listings.length; ++i) {
-        hljs.highlightBlock(listings[i]);
-    }
-}
+document.addEventListener('DOMContentLoaded', (event) => {
+    document.querySelectorAll('.programlisting, .screen').forEach((element) => {
+        hljs.highlightElement(element);
+    });
+});
--- a/pkgs/misc/documentation-highlighter/mono-blue.css
+++ b/pkgs/misc/documentation-highlighter/mono-blue.css
@ -1,17 +1,18 @@
+pre code.hljs {
+  display: block;
+  overflow-x: auto;
+  padding: 1em
+}
+code.hljs {
+  padding: 3px 5px
+}
 /*
  Five-color theme from a single blue hue.
 */
 .hljs {
-  display: block;
-  overflow-x: auto;
-  padding: 0.5em;
  background: #eaeef3;
+  color: #00193a
 }
-
-.hljs {
-  color: #00193a;
-}
-
 .hljs-keyword,
 .hljs-selector-tag,
 .hljs-title,
@ -19,13 +20,11 @@
 .hljs-doctag,
 .hljs-name,
 .hljs-strong {
-  font-weight: bold;
+  font-weight: bold
 }
-
 .hljs-comment {
-  color: #738191;
+  color: #738191
 }
-
 .hljs-string,
 .hljs-title,
 .hljs-section,
@ -38,9 +37,8 @@
 .hljs-name,
 .hljs-selector-id,
 .hljs-selector-class {
-  color: #0048ab;
+  color: #0048ab
 }
-
 .hljs-meta,
 .hljs-subst,
 .hljs-symbol,
@ -51,9 +49,8 @@
 .hljs-template-variable,
 .hljs-link,
 .hljs-bullet {
-  color: #4c81c9;
+  color: #4c81c9
 }
-
 .hljs-emphasis {
-  font-style: italic;
+  font-style: italic
 }
--- a/pkgs/misc/documentation-highlighter/update.sh
+++ b/pkgs/misc/documentation-highlighter/update.sh
@ -21,19 +21,21 @@ trap finish EXIT
 mkdir $scratch/src
 cd $scratch/src

-token=$(curl https://highlightjs.org/download/ -c "$scratch/jar" \
-    | grep csrf \
-    | cut -d"'" -f6)
+curl \
+    -X POST \
+    -H 'Content-Type: application/json' \
+    --data-raw '{
+      "api": 2,
+      "languages": ["bash", "nix", "shell"]
+    }' \
+    https://highlightjs.org/api/download > $scratch/out.zip

-curl --header "Referer: https://highlightjs.org/download/"\
-    -b "$scratch/jar" \
-    --data "csrfmiddlewaretoken=$token&nix.js=on&bash.js=on" \
-    https://highlightjs.org/download/ > $scratch/out.zip

 unzip "$scratch/out.zip"
 out="$root/"
 mkdir -p "$out"
-cp ./{highlight.pack.js,LICENSE,styles/mono-blue.css} "$out"
+cp ./highlight.min.js "$out/highlight.pack.js"
+cp ./{LICENSE,styles/mono-blue.css} "$out"

 (
    echo "This file was generated with pkgs/misc/documentation-highlighter/update.sh"
--- a/pkgs/os-specific/linux/libnss-mysql/default.nix
+++ b/pkgs/os-specific/linux/libnss-mysql/default.nix
@ -1,4 +1,11 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, which, libmysqlclient }:
+{ lib
+, nixosTests
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, which
+, libmysqlclient
+}:

 stdenv.mkDerivation rec {
  pname = "libnss-mysql";
@ -20,6 +27,10 @@ stdenv.mkDerivation rec {
    rm -r $out/etc
  '';

+  passthru.tests = {
+    inherit (nixosTests) auth-mysql;
+  };
+
  meta = with lib; {
    description = "MySQL module for the Solaris Nameservice Switch (NSS)";
    homepage = "https://github.com/saknopper/libnss-mysql";
--- a/pkgs/os-specific/linux/pam_mysql/default.nix
+++ b/pkgs/os-specific/linux/pam_mysql/default.nix
@ -1,4 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pam, pkg-config, libmysqlclient, mariadb, libxcrypt }:
+{ lib
+, nixosTests
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pam
+, pkg-config
+, libmysqlclient
+, mariadb
+, libxcrypt
+}:

 stdenv.mkDerivation rec {
  pname = "pam_mysql";
@ -14,6 +25,10 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ meson pkg-config ninja ];
  buildInputs = [ pam libmysqlclient mariadb libxcrypt ];

+  passthru.tests = {
+    inherit (nixosTests) auth-mysql;
+  };
+
  meta = with lib; {
    description = "PAM authentication module against a MySQL database";
    homepage = "https://github.com/NigelCunningham/pam-MySQL";
--- a/pkgs/servers/etcd/3.4.nix
+++ b/pkgs/servers/etcd/3.4.nix
@ -2,25 +2,25 @@

 buildGoModule rec {
  pname = "etcd";
-  version = "3.4.27";
-
-  vendorHash = "sha256-duqOIMIXAuJjvKDM15mDdi+LZUZm0uK0MjTv2Dsl3FA=";
-
-  doCheck = false;
+  version = "3.4.28";

  src = fetchFromGitHub {
    owner = "etcd-io";
    repo = "etcd";
    rev = "v${version}";
-    sha256 = "sha256-iw9rWfloK1h0M0O10AqCFKETSN6Adn71ujn4twVgsnk=";
+    hash = "sha256-M0iD05Wk3pC56kGKeIb0bfMUpy9idMKin0+DYhBo/cw=";
  };

+  vendorHash = "sha256-DbDIz/cbXqYHaGqNqP+wYpuiaFiZYElRXmQwBXnCbMk=";
+
  buildPhase = ''
    patchShebangs .
    ./build
    ./functional/build
  '';

+  doCheck = false;
+
  installPhase = ''
    install -Dm755 bin/* bin/functional/cmd/* -t $out/bin
  '';
--- a/pkgs/servers/etcd/3.5.nix
+++ b/pkgs/servers/etcd/3.5.nix
@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, symlinkJoin, nixosTests }:

 let
-  version = "3.5.9";
+  version = "3.5.10";

  src = fetchFromGitHub {
    owner = "etcd-io";
    repo = "etcd";
    rev = "v${version}";
-    hash = "sha256-Vp8U49fp0FowIuSSvbrMWjAKG2oDO1o0qO4izSnTR3U=";
+    hash = "sha256-X/de8YA55SZ6p8r/pV8CGxfDKN8voJlyA0r4ckan6ZE=";
  };

  CGO_ENABLED = 0;
@ -25,7 +25,7 @@ let

    inherit CGO_ENABLED meta src version;

-    vendorHash = "sha256-vu5VKHnDbvxSd8qpIFy0bA88IIXLaQ5S8dVUJEwnKJA=";
+    vendorHash = "sha256-kFR6RvHoNM4SZOgJd7inUuw5GfRLM+3WsKU73We8UzU=";

    modRoot = "./server";

@ -45,7 +45,7 @@ let

    inherit CGO_ENABLED meta src version;

-    vendorHash = "sha256-i60rKCmbEXkdFOZk2dTbG5EtYKb5eCBSyMcsTtnvATs=";
+    vendorHash = "sha256-oVabZ2JZlLKHFCuAeeWRTrcSCxzz05HlvDu/YSMKuCs=";

    modRoot = "./etcdutl";
  };
@ -55,7 +55,7 @@ let

    inherit CGO_ENABLED meta src version;

-    vendorHash = "sha256-awl/4kuOjspMVEwfANWK0oi3RId6ERsFkdluiRaaXlA=";
+    vendorHash = "sha256-0j35caQfLh7kwDKgmTe1novqKfz/3JlQLbUk3+GFPhk=";

    modRoot = "./etcdctl";
  };
--- a/pkgs/servers/sql/pgpool/default.nix
+++ b/pkgs/servers/sql/pgpool/default.nix
@ -10,12 +10,12 @@

 stdenv.mkDerivation rec {
  pname = "pgpool-II";
-  version = "4.4.4";
+  version = "4.4.5";

  src = fetchurl {
    url = "https://www.pgpool.net/mediawiki/download.php?f=pgpool-II-${version}.tar.gz";
    name = "pgpool-II-${version}.tar.gz";
-    sha256 = "sha256-EL7Wb4GXx03LAKDnP2GAZtXV4K3IeIZcL8+hyUXmj08=";
+    hash = "sha256-zNSSLIaUmRECor72TdQ/M/U59qGFvULyGDIrqwo4imA=";
  };

  buildInputs = [
--- a/pkgs/servers/zigbee2mqtt/default.nix
+++ b/pkgs/servers/zigbee2mqtt/default.nix
@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "zigbee2mqtt";
-  version = "1.33.2";
+  version = "1.34.0";

  src = fetchFromGitHub {
    owner = "Koenkk";
    repo = "zigbee2mqtt";
    rev = version;
-    hash = "sha256-pRY4FOIJwsLSKYieN0D1esKdoUqx62NMFgiYXaXguJ0=";
+    hash = "sha256-2D9WylfpetnEZdY4STIrGEU6Gg1gET/zf5p7Ou/Wm5Q=";
  };

-  npmDepsHash = "sha256-9bOFM8Ie0334H2L94ypgkMrB6zyVJ9YTvNnKeBJjOUI=";
+  npmDepsHash = "sha256-MXTKZNERxryt7L42dHxKx7XfXByNQ67oU+4FKTd0u4U=";

  nativeBuildInputs = [
    python3
--- a/pkgs/tools/audio/mpdcron/fix-canonicalize-conflict-with-glibc.patch
+++ b/pkgs/tools/audio/mpdcron/fix-canonicalize-conflict-with-glibc.patch
@ -0,0 +1,22 @@
+diff --git a/ext/nokogiri/xml_document.c b/ext/nokogiri/xml_document.c
+index 1d2119c8..c1c87713 100644
+--- a/ext/nokogiri/xml_document.c
+++ b/ext/nokogiri/xml_document.c
+@@ -492,7 +492,7 @@ static int block_caller(void * ctx, xmlNodePtr _node, xmlNodePtr _parent)
+  * The block must return a non-nil, non-false value if the +obj+ passed in
+  * should be included in the canonicalized document.
+  */
+-static VALUE canonicalize(int argc, VALUE* argv, VALUE self)
+static VALUE nokogiri_xml_document_canonicalize(int argc, VALUE* argv, VALUE self)
+ {
+   VALUE mode;
+   VALUE incl_ns;
+@@ -573,7 +573,7 @@ void init_xml_document()
+   rb_define_method(klass, "encoding", encoding, 0);
+   rb_define_method(klass, "encoding=", set_encoding, 1);
+   rb_define_method(klass, "version", version, 0);
+-  rb_define_method(klass, "canonicalize", canonicalize, -1);
+  rb_define_method(klass, "nokogiri_xml_document_canonicalize", canonicalize, -1);
+   rb_define_method(klass, "dup", duplicate_document, -1);
+   rb_define_method(klass, "url", url, 0);
+   rb_define_method(klass, "create_entity", create_entity, -1);
--- a/pkgs/tools/audio/mpdcron/gemset.nix
+++ b/pkgs/tools/audio/mpdcron/gemset.nix
@ -18,6 +18,19 @@
      sha256 = "02bjydih0j515szfv9mls195cvpyidh6ixm7dwbl3s2sbaxxk5s4";
      type = "gem";
    };
+
+    dontBuild = false;
+    patches = [
+      # Fixes a naming conflict of nokogiri's `canonicalize` function
+      # with one defined in glibc. This has been fixed upstream in 2020
+      # in a much newer version (1.15.5), but through the divergence
+      # of the affected file, the commit isn't directly applicable to
+      # the one packaged here:
+      #
+      # https://github.com/sparklemotion/nokogiri/pull/2106/commits/7a74cdbe4538e964023e5a0fdca58d8af708b91e
+      # https://github.com/sparklemotion/nokogiri/issues/2105
+      ./fix-canonicalize-conflict-with-glibc.patch
+    ];
    version = "1.10.3";
  };
 }
--- a/pkgs/tools/graphics/argyllcms/default.nix
+++ b/pkgs/tools/graphics/argyllcms/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "argyllcms";
-  version = "3.0.2";
+  version = "3.1.0";

  src = fetchzip {
    # Kind of flacky URL, it was reaturning 406 and inconsistent binaries for a
    # while on me. It might be good to find a mirror
    url = "https://www.argyllcms.com/Argyll_V${version}_src.zip";
-    hash = "sha256-9+rUhZVwSzAM9Ko6FYyl2OVvsOFBaUCA1PJs9kaLWaE=";
+    hash = "sha256-IZScf+xpvvMt5YFlYQprg51cw2ztMdOrqcLm7l5uBhU=";
  };

  nativeBuildInputs = [ jam unzip ];
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@ -16,14 +16,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "esphome";
-  version = "2023.11.4";
+  version = "2023.11.6";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-KIDqIf9aJP5IS+qE0Gy5j3F2DGz/WGbN4Wf9SGzgnzA=";
+    hash = "sha256-9LqZlhCt+7p6tnSHFhbnUzkEOJQDsg/Pd/hgd/Il0ZQ=";
  };

  postPatch = ''
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/html.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/html.py
@ -97,8 +97,8 @@ class HTMLRenderer(Renderer):
    def strong_close(self, token: Token, tokens: Sequence[Token], i: int) -> str:
        return "</strong></span>"
    def fence(self, token: Token, tokens: Sequence[Token], i: int) -> str:
-        # TODO use token.info. docbook doesn't so we can't yet.
-        return f'<pre class="programlisting">\n{escape(token.content)}</pre>'
+        info = f" {escape(token.info, True)}" if token.info != "" else ""
+        return f'<pre><code class="programlisting{info}">{escape(token.content)}</code></pre>'
    def blockquote_open(self, token: Token, tokens: Sequence[Token], i: int) -> str:
        return '<div class="blockquote"><blockquote class="blockquote">'
    def blockquote_close(self, token: Token, tokens: Sequence[Token], i: int) -> str:
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
@ -496,8 +496,8 @@ class OptionsHTMLRenderer(OptionDocsRestrictions, HTMLRenderer):
        token.meta['compact'] = False
        return super().bullet_list_open(token, tokens, i)
    def fence(self, token: Token, tokens: Sequence[Token], i: int) -> str:
-        # TODO use token.info. docbook doesn't so we can't yet.
-        return f'<pre class="programlisting">{html.escape(token.content)}</pre>'
+        info = f" {html.escape(token.info, True)}" if token.info != "" else ""
+        return f'<pre><code class="programlisting{info}">{html.escape(token.content)}</code></pre>'

 class HTMLConverter(BaseConverter[OptionsHTMLRenderer]):
    __option_block_separator__ = ""
--- a/pkgs/tools/nix/nixos-render-docs/src/tests/test_html.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/tests/test_html.py
@ -204,8 +204,10 @@ def test_full() -> None:
          <div class="blockquote">
           <blockquote class="blockquote">
            <p>with <span class="emphasis"><em>nesting</em></span></p>
-            <pre class="programlisting">↵
+            <pre>
+             <code class="programlisting">
              nested code block↵
+             </code>
            </pre>
           </blockquote>
          </div>
@ -213,8 +215,10 @@ def test_full() -> None:
           <ul class="itemizedlist compact" style="list-style-type: disc;">
            <li class="listitem"><p>and lists</p></li>
            <li class="listitem">
-             <pre class="programlisting">↵
+             <pre>
+              <code class="programlisting">
               containing code↵
+              </code>
             </pre>
            </li>
           </ul>
@ -240,11 +244,15 @@ def test_full() -> None:
             </p>
            </blockquote>
           </div>
-           <pre class="programlisting">↵
+           <pre>
+            <code class="programlisting">
             code block↵
+            </code>
           </pre>
-           <pre class="programlisting">↵
+           <pre>
+            <code class="programlisting">
             fenced block↵
+            </code>
           </pre>
           <p>text</p>
          </dd>
--- a/pkgs/tools/video/go2rtc/default.nix
+++ b/pkgs/tools/video/go2rtc/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "go2rtc";
-  version = "1.8.2";
+  version = "1.8.4";

  src = fetchFromGitHub {
    owner = "AlexxIT";
    repo = "go2rtc";
    rev = "refs/tags/v${version}";
-    hash = "sha256-3cWhASwOgSovApNT/MUbhHhmp/o4k3ckgfcSFwJJqI8=";
+    hash = "sha256-knC8GWu8543QIvk2OKotTHB88qgSQpOI+58oHusgVKc=";
  };

-  vendorHash = "sha256-SV4sMDgUv6Ci0aC7wsam7ftqMSpFwsMGkC9qLpR+O68=";
+  vendorHash = "sha256-+n0atALq5e2iEbEeJ1kefnKka7gTE0iFRSRnUCz4bh8=";

  buildFlagArrays = [
    "-trimpath"
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -7210,6 +7210,10 @@ self: super: with self; {

  mutf8 = callPackage ../development/python-modules/mutf8 { };

+  mujoco = callPackage ../development/python-modules/mujoco {
+    inherit (pkgs) mujoco;
+  };
+
  mujson = callPackage ../development/python-modules/mujson { };

  mwcli = callPackage ../development/python-modules/mwcli { };