Merge staging-next into staging

2022-08-15 18:02:00 +00:00 · 2022-08-15 18:02:00 +00:00 · 79661ba7e2
commit 79661ba7e2
parent e442c9084b 94f107a45f
62 changed files with 3344 additions and 667 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -369,6 +369,16 @@
          release notes</link> for more details.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>github-runner</literal> gained support for ephemeral
+          runners and registrations using a personal access token (PAT)
+          instead of a registration token. See
+          <literal>services.github-runner.ephemeral</literal> and
+          <literal>services.github-runner.tokenFile</literal> for
+          details.
+        </para>
+      </listitem>
      <listitem>
        <para>
          A new module was added for the Saleae Logic device family,
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -137,6 +137,8 @@ Use `configure.packages` instead.

 - The `xplr` package has been updated from 0.18.0 to 0.19.0, which brings some breaking changes. See the [upstream release notes](https://github.com/sayanarijit/xplr/releases/tag/v0.19.0) for more details.

+- `github-runner` gained support for ephemeral runners and registrations using a personal access token (PAT) instead of a registration token. See `services.github-runner.ephemeral` and `services.github-runner.tokenFile` for details.
+
 - A new module was added for the Saleae Logic device family, providing the options `hardware.saleae-logic.enable` and `hardware.saleae-logic.package`.

 - The Redis module now disables RDB persistence when `services.redis.servers.<name>.save = []` instead of using the Redis default.
--- a/nixos/modules/services/continuous-integration/github-runner.nix
+++ b/nixos/modules/services/continuous-integration/github-runner.nix
@ -48,9 +48,14 @@ in
    tokenFile = mkOption {
      type = types.path;
      description = lib.mdDoc ''
-        The full path to a file which contains the runner registration token.
+        The full path to a file which contains either a runner registration token or a
+        personal access token (PAT).
        The file should contain exactly one line with the token without any newline.
-        The token can be used to re-register a runner of the same name but is time-limited.
+        If a registration token is given, it can be used to re-register a runner of the same
+        name but is time-limited. If the file contains a PAT, the service creates a new
+        registration token on startup as needed. Make sure the PAT has a scope of
+        `admin:org` for organization-wide registrations or a scope of
+        `repo` for a single repository.

        Changing this option or the file's content triggers a new runner registration.
      '';
@ -117,6 +122,24 @@ in
      default = pkgs.github-runner;
      defaultText = literalExpression "pkgs.github-runner";
    };
+
+    ephemeral = mkOption {
+      type = types.bool;
+      description = lib.mdDoc ''
+        If enabled, causes the following behavior:
+
+        - Passes the `--ephemeral` flag to the runner configuration script
+        - De-registers and stops the runner with GitHub after it has processed one job
+        - On stop, systemd wipes the runtime directory (this always happens, even without using the ephemeral option)
+        - Restarts the service after its successful exit
+        - On start, wipes the state directory and configures a new runner
+
+        You should only enable this option if `tokenFile` points to a file which contains a
+        personal access token (PAT). If you're using the option with a registration token, restarting the
+        service will fail as soon as the registration token expired.
+      '';
+      default = false;
+    };
  };

  config = mkIf cfg.enable {
@ -136,7 +159,7 @@ in

      environment = {
        HOME = runtimeDir;
-        RUNNER_ROOT = runtimeDir;
+        RUNNER_ROOT = stateDir;
      };

      path = (with pkgs; [
@ -150,7 +173,7 @@ in
      ] ++ cfg.extraPackages;

      serviceConfig = rec {
-        ExecStart = "${cfg.package}/bin/runsvc.sh";
+        ExecStart = "${cfg.package}/bin/Runner.Listener run --startuptype service";

        # Does the following, sequentially:
        # - If the module configuration or the token has changed, purge the state directory,
@ -178,7 +201,7 @@ in
              ${lines}
            '';
            currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
-            runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" ] cfg;
+            runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" ] cfg;
            newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
            newConfigTokenFilename = ".new-token";
            runnerCredFiles = [
@ -188,17 +211,24 @@ in
            ];
            unconfigureRunner = writeScript "unconfigure" ''
              differs=
-              # Set `differs = 1` if current and new runner config differ or if `currentConfigPath` does not exist
-              ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 || differs=1
-              # Also trigger a registration if the token content changed
-              ${pkgs.diffutils}/bin/diff -q \
-                "$STATE_DIRECTORY"/${currentConfigTokenFilename} \
-                ${escapeShellArg cfg.tokenFile} \
-                >/dev/null 2>&1 || differs=1
+
+              if [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then
+                # State directory is not empty
+                # Set `differs = 1` if current and new runner config differ or if `currentConfigPath` does not exist
+                ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 || differs=1
+                # Also trigger a registration if the token content changed
+                ${pkgs.diffutils}/bin/diff -q \
+                  "$STATE_DIRECTORY"/${currentConfigTokenFilename} \
+                  ${escapeShellArg cfg.tokenFile} \
+                  >/dev/null 2>&1 || differs=1
+                # If .credentials does not exist, assume a previous run de-registered the runner on stop (ephemeral mode)
+                [[ ! -f "$STATE_DIRECTORY/.credentials" ]] && differs=1
+              fi

              if [[ -n "$differs" ]]; then
                echo "Config has changed, removing old runner state."
-                echo "The old runner will still appear in the GitHub Actions UI." \
+                # In ephemeral mode, the runner deletes the `.credentials` file after de-registering it with GitHub
+                [[ -f "$STATE_DIRECTORY/.credentials" ]] && echo "The old runner will still appear in the GitHub Actions UI." \
                  "You have to remove it manually."
                find "$STATE_DIRECTORY/" -mindepth 1 -delete

@ -212,17 +242,28 @@ in
              if [[ -e "$STATE_DIRECTORY/${newConfigTokenFilename}" ]]; then
                echo "Configuring GitHub Actions Runner"

-                token=$(< "$STATE_DIRECTORY"/${newConfigTokenFilename})
-                RUNNER_ROOT="$STATE_DIRECTORY" ${cfg.package}/bin/config.sh \
-                  --unattended \
-                  --disableupdate \
-                  --work "$RUNTIME_DIRECTORY" \
-                  --url ${escapeShellArg cfg.url} \
-                  --token "$token" \
-                  --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)} \
-                  --name ${escapeShellArg cfg.name} \
-                  ${optionalString cfg.replace "--replace"} \
+                args=(
+                  --unattended
+                  --disableupdate
+                  --work "$RUNTIME_DIRECTORY"
+                  --url ${escapeShellArg cfg.url}
+                  --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)}
+                  --name ${escapeShellArg cfg.name}
+                  ${optionalString cfg.replace "--replace"}
                  ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"}
+                  ${optionalString cfg.ephemeral "--ephemeral"}
+                )
+
+                # If the token file contains a PAT (i.e., it starts with "ghp_"), we have to use the --pat option,
+                # if it is not a PAT, we assume it contains a registration token and use the --token option
+                token=$(<"$STATE_DIRECTORY/${newConfigTokenFilename}")
+                if [[ "$token" =~ ^ghp_* ]]; then
+                  args+=(--pat "$token")
+                else
+                  args+=(--token "$token")
+                fi
+
+                ${cfg.package}/bin/config.sh "''${args[@]}"

                # Move the automatically created _diag dir to the logs dir
                mkdir -p  "$STATE_DIRECTORY/_diag"
@ -250,6 +291,10 @@ in
            setupRuntimeDir
          ];

+        # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner)
+        # to trigger a fresh registration.
+        Restart = if cfg.ephemeral then "on-success" else "no";
+
        # Contains _diag
        LogsDirectory = [ systemdDir ];
        # Default RUNNER_ROOT which contains ephemeral Runner data
@ -269,8 +314,7 @@ in
        # By default, use a dynamically allocated user
        DynamicUser = true;

-        KillMode = "process";
-        KillSignal = "SIGTERM";
+        KillSignal = "SIGINT";

        # Hardening (may overlap with DynamicUser=)
        # The following options are only for optimizing:
--- a/nixos/modules/services/networking/globalprotect-vpn.nix
+++ b/nixos/modules/services/networking/globalprotect-vpn.nix
@ -5,7 +5,8 @@ with lib;
 let
  cfg = config.services.globalprotect;

-  execStart = if cfg.csdWrapper == null then
+  execStart =
+    if cfg.csdWrapper == null then
      "${pkgs.globalprotect-openconnect}/bin/gpservice"
    else
      "${pkgs.globalprotect-openconnect}/bin/gpservice --csd-wrapper=${cfg.csdWrapper}";
@ -15,6 +16,22 @@ in
  options.services.globalprotect = {
    enable = mkEnableOption "globalprotect";

+    settings = mkOption {
+      description = ''
+        GlobalProtect-openconnect configuration. For more information, visit
+        <link
+        xlink:href="https://github.com/yuezk/GlobalProtect-openconnect/wiki/Configuration"
+        />.
+      '';
+      default = { };
+      example = {
+        "vpn1.company.com" = {
+          openconnect-args = "--script=/path/to/vpnc-script";
+        };
+      };
+      type = types.attrs;
+    };
+
    csdWrapper = mkOption {
      description = lib.mdDoc ''
        A script that will produce a Host Integrity Protection (HIP) report,
@ -29,12 +46,14 @@ in
  config = mkIf cfg.enable {
    services.dbus.packages = [ pkgs.globalprotect-openconnect ];

+    environment.etc."gpservice/gp.conf".text = lib.generators.toINI { } cfg.settings;
+
    systemd.services.gpservice = {
      description = "GlobalProtect openconnect DBus service";
      serviceConfig = {
-        Type="dbus";
-        BusName="com.yuezk.qt.GPService";
-        ExecStart=execStart;
+        Type = "dbus";
+        BusName = "com.yuezk.qt.GPService";
+        ExecStart = execStart;
      };
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
--- a/nixos/modules/services/networking/headscale.nix
+++ b/nixos/modules/services/networking/headscale.nix
@ -286,11 +286,11 @@ in
            '';
          };
          challengeType = mkOption {
-            type = types.enum [ "TLS_ALPN-01" "HTTP-01" ];
+            type = types.enum [ "TLS-ALPN-01" "HTTP-01" ];
            default = "HTTP-01";
            description = lib.mdDoc ''
              Type of ACME challenge to use, currently supported types:
-              `HTTP-01` or `TLS_ALPN-01`.
+              `HTTP-01` or `TLS-ALPN-01`.
            '';
          };
          httpListen = mkOption {
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@ -212,6 +212,7 @@ in
        # external apps shipped with linux-mint
        hexchat
        gnome-calculator
+        gnome-screenshot
      ] config.environment.cinnamon.excludePackages;
    })
  ];
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@ -1,22 +1,22 @@
 { lib, stdenv, fetchurl, pkg-config, makeWrapper
 , libsndfile, jack2
 , libGLU, libGL, lv2, cairo
-, ladspaH, php }:
+, ladspaH, php, libXrandr }:

 stdenv.mkDerivation rec {
-  pname = "lsp-plugins";
-  version = "1.2.1";
+        pname = "lsp-plugins";
+        version = "1.2.2";

-  src = fetchurl {
-    url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-wHibZJbrgy7t0z2rRDe1FUAG38BW/dR0JgoKVWYCn60=";
-  };
+        src = fetchurl {
+                url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
+                sha256 = "sha256-qIakDWNs8fQmlw/VHwTET2LmIvI+6I6zK88bmsWF4VI=";
+        };

-  nativeBuildInputs = [ pkg-config php makeWrapper ];
-  buildInputs = [ jack2 libsndfile libGLU libGL lv2 cairo ladspaH ];
+        nativeBuildInputs = [ pkg-config php makeWrapper ];
+        buildInputs = [ jack2 libsndfile libGLU libGL lv2 cairo ladspaH libXrandr ];

-  makeFlags = [
-    "PREFIX=${placeholder "out"}"
+        makeFlags = [
+                "PREFIX=${placeholder "out"}"
  ];

  NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
--- a/pkgs/applications/audio/zynaddsubfx/ZynLogo.svg
+++ b/pkgs/applications/audio/zynaddsubfx/ZynLogo.svg
@ -0,0 +1,6 @@
+<svg viewBox="64 60 33 33" xmlns="http://www.w3.org/2000/svg">
+  <polygon points="97 64 64 61 67.3 63.3 64 63 87 79 97 66 95.6 65.9" fill="#2E3239"/>
+  <polygon points="97 90 74 74 64 87 65.4 87.1 64 89 97 92 93.7 89.7" fill="#2E3239"/>
+  <polygon points="64 62 97 65 87 78" fill="#50C3C7"/>
+  <polygon points="97 91 64 88 74 75" fill="#57C1A6"/>
+</svg>
--- a/pkgs/applications/audio/zynaddsubfx/default.nix
+++ b/pkgs/applications/audio/zynaddsubfx/default.nix
@ -15,7 +15,7 @@
 , zlib

  # Optional dependencies
-, alsaSupport ? true
+, alsaSupport ? stdenv.isLinux
 , alsa-lib
 , dssiSupport ? false
 , dssi
@ -27,11 +27,13 @@
 , ossSupport ? true
 , portaudioSupport ? true
 , portaudio
+, sndioSupport ? stdenv.isOpenBSD
+, sndio

  # Optional GUI dependencies
 , guiModule ? "off"
 , cairo
-, fltk13
+, fltk
 , libGL
 , libjpeg
 , libX11
@ -40,6 +42,7 @@

  # Test dependencies
 , cxxtest
+, ruby
 }:

 assert builtins.any (g: guiModule == g) [ "fltk" "ntk" "zest" "off" ];
@ -50,20 +53,24 @@ let
    "ntk" = "NTK";
    "zest" = "Zyn-Fusion";
  }.${guiModule};
+
  mruby-zest = callPackage ./mruby-zest { };
 in stdenv.mkDerivation rec {
  pname = "zynaddsubfx";
-  version = "3.0.5";
+  version = "3.0.6";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
-    rev = version;
-    sha256 = "1vh1gszgjxwn8m32rk5222z1j2cnjax0bqpag7b47v6i36p2q4x8";
+    rev = "refs/tags/${version}";
    fetchSubmodules = true;
+    sha256 = "sha256-0siAx141DZx39facXWmKbsi0rHBNpobApTdey07EcXg=";
  };

+  outputs = [ "out" "doc" ];
+
  postPatch = ''
+    patchShebangs rtosc/test/test-port-checker.rb src/Tests/check-ports.rb
    substituteInPlace src/Misc/Config.cpp --replace /usr $out
  '';

@ -75,7 +82,8 @@ in stdenv.mkDerivation rec {
    ++ lib.optionals jackSupport [ libjack2 ]
    ++ lib.optionals lashSupport [ lash ]
    ++ lib.optionals portaudioSupport [ portaudio ]
-    ++ lib.optionals (guiModule == "fltk") [ fltk13 libjpeg libXpm ]
+    ++ lib.optionals sndioSupport [ sndio ]
+    ++ lib.optionals (guiModule == "fltk") [ fltk libjpeg libXpm ]
    ++ lib.optionals (guiModule == "ntk") [ ntk cairo libXpm ]
    ++ lib.optionals (guiModule == "zest") [ libGL libX11 ];

@ -87,29 +95,39 @@ in stdenv.mkDerivation rec {
    ++ lib.optional (guiModule == "fltk") "-DFLTK_SKIP_OPENGL=ON";

  doCheck = true;
-  checkInputs = [ cxxtest ];
+  checkInputs = [ cxxtest ruby ];

  # TODO: Update cmake hook to make it simpler to selectively disable cmake tests: #113829
  checkPhase = let
-    # Tests fail on aarch64
-    disabledTests = lib.optionals stdenv.isAarch64 [
-      "MessageTest"
-      "UnisonTest"
-    ];
+    disabledTests =
+      # PortChecker test fails when lashSupport is enabled because
+      # zynaddsubfx takes to long to start trying to connect to lash
+      lib.optionals lashSupport [ "PortChecker" ]
+
+      # Tests fail on aarch64
+      ++ lib.optionals stdenv.isAarch64 [ "MessageTest" "UnisonTest" ];
  in ''
    runHook preCheck
    ctest --output-on-failure -E '^${lib.concatStringsSep "|" disabledTests}$'
    runHook postCheck
  '';

+  # Use Zyn-Fusion logo for zest build
+  # An SVG version of the logo isn't hosted anywhere we can fetch, I
+  # had to manually derive it from the code that draws it in-app:
+  # https://github.com/mruby-zest/mruby-zest-build/blob/3.0.6/src/mruby-zest/example/ZynLogo.qml#L65-L97
+  postInstall = lib.optionalString (guiModule == "zest") ''
+    rm -r "$out/share/pixmaps"
+    mkdir -p "$out/share/icons/hicolor/scalable/apps"
+    cp ${./ZynLogo.svg} "$out/share/icons/hicolor/scalable/apps/zynaddsubfx.svg"
+  '';
+
  # When building with zest GUI, patch plugins
  # and standalone executable to properly locate zest
  postFixup = lib.optionalString (guiModule == "zest") ''
-    patchelf --set-rpath "${mruby-zest}:$(patchelf --print-rpath "$out/lib/lv2/ZynAddSubFX.lv2/ZynAddSubFX_ui.so")" \
-      "$out/lib/lv2/ZynAddSubFX.lv2/ZynAddSubFX_ui.so"
-
-    patchelf --set-rpath "${mruby-zest}:$(patchelf --print-rpath "$out/lib/vst/ZynAddSubFX.so")" \
-      "$out/lib/vst/ZynAddSubFX.so"
+    for lib in "$out/lib/lv2/ZynAddSubFX.lv2/ZynAddSubFX_ui.so" "$out/lib/vst/ZynAddSubFX.so"; do
+      patchelf --set-rpath "${mruby-zest}:$(patchelf --print-rpath "$lib")" "$lib"
+    done

    wrapProgram "$out/bin/zynaddsubfx" \
      --prefix PATH : ${mruby-zest} \
@ -123,8 +141,15 @@ in stdenv.mkDerivation rec {
      then "https://zynaddsubfx.sourceforge.io/zyn-fusion.html"
      else "https://zynaddsubfx.sourceforge.io";

-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ goibhniu kira-bruneau ];
-    platforms = platforms.linux;
+    platforms = platforms.all;
+
+    # On macOS:
+    # - Tests don't compile (ld: unknown option: --no-as-needed)
+    # - ZynAddSubFX LV2 & VST plugin fail to compile (not setup to use ObjC version of pugl)
+    # - TTL generation crashes (`pointer being freed was not allocated`) for all VST plugins using AbstractFX
+    # - Zest UI fails to start on pulg_setup: Could not open display, aborting.
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/applications/audio/zynaddsubfx/mruby-zest/default.nix
+++ b/pkgs/applications/audio/zynaddsubfx/mruby-zest/default.nix
@ -1,9 +1,8 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, fetchpatch
 , bison
-, git
-, python2
+, pkg-config
 , rake
 , ruby
 , libGL
@ -11,87 +10,42 @@
 , libX11
 }:

-let
-  mgem-list = fetchFromGitHub {
-    owner = "mruby";
-    repo = "mgem-list";
-    rev = "2033837203c8a141b1f9d23bb781fe0cbaefbd24";
-    sha256 = "0igf2nsx5i6g0yf7sjxxkngyriv213d0sjs3yidrflrabiywpxmm";
-  };
-
-  mruby-dir = fetchFromGitHub {
-    owner = "iij";
-    repo = "mruby-dir";
-    rev = "89dceefa1250fb1ae868d4cb52498e9e24293cd1";
-    sha256 = "0zrhiy9wmwmc9ls62iyb2z86j2ijqfn7rn4xfmrbrfxygczarsm9";
-  };
-
-  mruby-errno = fetchFromGitHub {
-    owner = "iij";
-    repo = "mruby-errno";
-    rev = "b4415207ff6ea62360619c89a1cff83259dc4db0";
-    sha256 = "12djcwjjw0fygai5kssxbfs3pzh3cpnq07h9m2h5b51jziw380xj";
-  };
-
-  mruby-file-stat = fetchFromGitHub {
-    owner = "ksss";
-    repo = "mruby-file-stat";
-    rev = "aa474589f065c71d9e39ab8ba976f3bea6f9aac2";
-    sha256 = "1clarmr67z133ivkbwla1a42wcjgj638j9w0mlv5n21mhim9rid5";
-  };
-
-  mruby-process = fetchFromGitHub {
-    owner = "iij";
-    repo = "mruby-process";
-    rev = "fe171fbe2a6cc3c2cf7d713641bddde71024f7c8";
-    sha256 = "00yrzc371f90gl5m1gbkw0qq8c394bpifssjr8p1wh5fmzhxqyml";
-  };
-
-  mruby-pack = fetchFromGitHub {
-    owner = "iij";
-    repo = "mruby-pack";
-    rev = "383a9c79e191d524a9a2b4107cc5043ecbf6190b";
-    sha256 = "003glxgxifk4ixl12sy4gn9bhwvgb79b4wga549ic79isgv81w2d";
-  };
-in
 stdenv.mkDerivation rec {
  pname = "mruby-zest";
-  version = "3.0.5";
+  version = "3.0.6";

  src = fetchFromGitHub {
    owner = pname;
    repo = "${pname}-build";
-    rev = version;
-    sha256 = "0fxljrgamgz2rm85mclixs00b0f2yf109jc369039n1vf0l5m57d";
+    rev = "refs/tags/${version}";
    fetchSubmodules = true;
+    sha256 = "sha256-rIb6tQimwrUj+623IU5zDyKNWsNYYBElLQClOsP+5Dc=";
  };

-  nativeBuildInputs = [ bison git python2 rake ruby ];
-  buildInputs = [ libGL libuv libX11 ];
-
  patches = [
-    ./force-gcc-as-linker.patch
-    ./system-libuv.patch
-
-    # Pull upstream fix for -fno-common toolchains:
-    #   https://github.com/mruby-zest/mruby-zest-build/issues/25
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://github.com/mruby-zest/mruby-zest-build/commit/4eb88250f22ee684acac95d4d1f114df504e37a7.patch";
-      sha256 = "0wg7qy1vg0mzcxagf35bv35dlr0q17pxjicigpf86yqppvgrzrsb";
-    })
+    ./force-cxx-as-linker.patch
  ];

-  # Add missing dependencies of deps/mruby-dir-glob/mrbgem.rake
-  # Should be fixed in next release, see bcadb0a5490bd6d599f1a0e66ce09b46363c9dae
-  postPatch = ''
-    mkdir -p mruby/build/mrbgems
-    ln -s ${mgem-list} mruby/build/mrbgems/mgem-list
-    ln -s ${mruby-dir} mruby/build/mrbgems/mruby-dir
-    ln -s ${mruby-errno} mruby/build/mrbgems/mruby-errno
-    ln -s ${mruby-file-stat} mruby/build/mrbgems/mruby-file-stat
-    ln -s ${mruby-process} mruby/build/mrbgems/mruby-process
-    ln -s ${mruby-pack} mruby/build/mrbgems/mruby-pack
+  nativeBuildInputs = [
+    bison
+    pkg-config
+    rake
+    ruby
+  ];
+
+  buildInputs = [
+    libGL
+    libuv
+    libX11
+  ];
+
+  # Force optimization to fix:
+  # warning: #warning _FORTIFY_SOURCE requires compiling with optimization (-O)
+  NIX_CFLAGS_COMPILE = "-O3";
+
+  # Remove pre-built y.tab.c to generate with nixpkgs bison
+  preBuild = ''
+    rm mruby/mrbgems/mruby-compiler/core/y.tab.c
  '';

  installTargets = [ "pack" ];
@ -102,8 +56,8 @@ stdenv.mkDerivation rec {

    # mruby-widget-lib/src/api.c requires MainWindow.qml as part of a
    # sanity check, even though qml files are compiled into the binary
-    # https://github.com/mruby-zest/mruby-zest-build/tree/3.0.5/src/mruby-widget-lib/src/api.c#L99-L116
-    # https://github.com/mruby-zest/mruby-zest-build/tree/3.0.5/linux-pack.sh#L17-L18
+    # https://github.com/mruby-zest/mruby-zest-build/blob/3.0.6/src/mruby-widget-lib/src/api.c#L107-L124
+    # https://github.com/mruby-zest/mruby-zest-build/blob/3.0.6/linux-pack.sh#L17-L18
    mkdir -p "$out/qml"
    touch "$out/qml/MainWindow.qml"
  '';
@ -111,7 +65,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "The Zest Framework used in ZynAddSubFX's UI";
    homepage = "https://github.com/mruby-zest";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Plus;
    maintainers = with maintainers; [ kira-bruneau ];
    platforms = platforms.all;
  };
--- a/pkgs/applications/audio/zynaddsubfx/mruby-zest/force-cxx-as-linker.patch
+++ b/pkgs/applications/audio/zynaddsubfx/mruby-zest/force-cxx-as-linker.patch
@ -1,13 +1,13 @@
 diff --git a/mruby/tasks/toolchains/gcc.rake b/mruby/tasks/toolchains/gcc.rake
-index f370c0ab..e5ab9f60 100644
+index 51bda6517..9bc96d0e2 100644
 --- a/mruby/tasks/toolchains/gcc.rake
 +++ b/mruby/tasks/toolchains/gcc.rake
-@@ -22,7 +22,7 @@ MRuby::Toolchain.new(:gcc) do |conf, _params|
+@@ -23,7 +23,7 @@ MRuby::Toolchain.new(:gcc) do |conf, params|
   end
 
   conf.linker do |linker|
-    linker.command = ENV['LD'] || 'gcc'
-+    linker.command = 'gcc'
+-    linker.command = ENV['LD'] || ENV['CXX'] || ENV['CC'] || default_command
+    linker.command = ENV['CXX'] || ENV['CC'] || default_command
     linker.flags = [ENV['LDFLAGS'] || %w()]
     linker.libraries = %w(m)
     linker.library_paths = []
--- a/pkgs/applications/audio/zynaddsubfx/mruby-zest/system-libuv.patch
+++ b/pkgs/applications/audio/zynaddsubfx/mruby-zest/system-libuv.patch
@ -1,113 +0,0 @@
-diff --git a/Makefile b/Makefile
-index f3e3be2..2398852 100644
--- a/Makefile
-+++ b/Makefile
-@@ -1,8 +1,3 @@
-UV_DIR    = libuv-v1.9.1
-UV_FILE   = $(UV_DIR).tar.gz
-UV_URL    = http://dist.libuv.org/dist/v1.9.1/$(UV_FILE)
-	 
-
- all:
- 	ruby ./rebuild-fcache.rb
- 	cd deps/nanovg/src   && $(CC) nanovg.c -c -fPIC
-@@ -10,12 +5,12 @@ all:
- #	cd deps/pugl         && python2 ./waf configure --no-cairo --static
- 	cd deps/pugl         && python2 ./waf configure --no-cairo --static --debug
- 	cd deps/pugl         && python2 ./waf
-	cd src/osc-bridge    && CFLAGS="-I ../../deps/$(UV_DIR)/include " make lib
-+	cd src/osc-bridge    && make lib
- 	cd mruby             && MRUBY_CONFIG=../build_config.rb rake
- 	$(CC) -shared -o libzest.so `find mruby/build/host -type f | grep -e "\.o$$" | grep -v bin` ./deps/libnanovg.a \
- 		./deps/libnanovg.a \
- 		src/osc-bridge/libosc-bridge.a \
-		./deps/$(UV_DIR)/.libs/libuv.a  -lm -lX11 -lGL -lpthread
-+		-luv -lm -lX11 -lGL -lpthread
- 	$(CC) test-libversion.c deps/pugl/build/libpugl-0.a -ldl -o zest -lX11 -lGL -lpthread -I deps/pugl -std=gnu99
- 
- osx:
-@@ -25,12 +20,12 @@ osx:
- 	cd deps/pugl         && python2 ./waf configure --no-cairo --static
- #	cd deps/pugl         && python2 ./waf configure --no-cairo --static --debug
- 	cd deps/pugl         && python2 ./waf
-	cd src/osc-bridge    && CFLAGS="-I ../../deps/$(UV_DIR)/include " make lib
-+	cd src/osc-bridge    && make lib
- 	cd mruby             && MRUBY_CONFIG=../build_config.rb rake
- 	$(CC) -shared -o libzest.so `find mruby/build/host -type f | grep -e "\.o$$" | grep -v bin` ./deps/libnanovg.a \
- 		./deps/libnanovg.a \
- 		src/osc-bridge/libosc-bridge.a \
-		./deps/$(UV_DIR)/.libs/libuv.a  -lm -framework OpenGL -lpthread
-+		-luv -lm -framework OpenGL -lpthread
- 	$(CC) test-libversion.c deps/pugl/build/libpugl-0.a -ldl -o zest -framework OpenGL -framework AppKit -lpthread -I deps/pugl -std=gnu99
- 
- windows:
-@@ -38,38 +33,14 @@ windows:
- 	$(AR) rc deps/libnanovg.a deps/nanovg/src/*.o
- 	cd deps/pugl         && CFLAGS="-mstackrealign" python2 ./waf configure --no-cairo --static --target=win32
- 	cd deps/pugl         && python2 ./waf
-	cd src/osc-bridge    && CFLAGS="-mstackrealign -I ../../deps/$(UV_DIR)/include " make lib
-+	cd src/osc-bridge    && CFLAGS="-mstackrealign" make lib
- 	cd mruby             && WINDOWS=1 MRUBY_CONFIG=../build_config.rb rake
- 	$(CC) -mstackrealign -shared -o libzest.dll -static-libgcc `find mruby/build/w64 -type f | grep -e "\.o$$" | grep -v bin` \
-         ./deps/libnanovg.a \
-         src/osc-bridge/libosc-bridge.a \
-        ./deps/libuv-win.a \
-        -lm -lpthread -lws2_32 -lkernel32 -lpsapi -luserenv -liphlpapi -lglu32 -lgdi32 -lopengl32
-+        -luv -lm -lpthread -lws2_32 -lkernel32 -lpsapi -luserenv -liphlpapi -lglu32 -lgdi32 -lopengl32
- 	$(CC) -mstackrealign -DWIN32 test-libversion.c deps/pugl/build/libpugl-0.a -o zest.exe -lpthread -I deps/pugl -std=c99 -lws2_32 -lkernel32 -lpsapi -luserenv -liphlpapi -lglu32 -lgdi32 -lopengl32
- 
-
-builddep: deps/libuv.a
-deps/libuv.a:
-	cd deps/$(UV_DIR)    && ./autogen.sh
-	cd deps/$(UV_DIR)    && CFLAGS=-fPIC ./configure
-	cd deps/$(UV_DIR)    && CFLAGS=-fPIC make
-	cp deps/$(UV_DIR)/.libs/libuv.a deps/
-
-builddepwin: deps/libuv-win.a
-deps/libuv-win.a:
-	cd deps/$(UV_DIR)   && ./autogen.sh
-	cd deps/$(UV_DIR)   && CFLAGS="-mstackrealign" ./configure  --host=x86_64-w64-mingw32
-	cd deps/$(UV_DIR)   && LD=x86_64-w64-mingw32-gcc make
-	cp deps/$(UV_DIR)/.libs/libuv.a deps/libuv-win.a
-
-deps/$(UV_DIR):
-	cd deps              && wget -4 $(UV_URL) && tar xvf $(UV_FILE)
-setup: deps/$(UV_DIR)
-
-setupwin:
-	cd deps              && wget -4 $(UV_URL)
-	cd deps              && tar xvf $(UV_FILE)
-
- push:
- 	cd src/osc-bridge      && git push
- 	cd src/mruby-qml-parse  && git push
-diff --git a/build_config.rb b/build_config.rb
-index 00f1f69..11ac15b 100644
--- a/build_config.rb
-+++ b/build_config.rb
-@@ -96,7 +96,6 @@ build_type.new(build_name) do |conf|
-   conf.cc do |cc|
-       cc.include_paths << "#{`pwd`.strip}/../deps/nanovg/src"
-       cc.include_paths << "#{`pwd`.strip}/../deps/pugl/"
-      cc.include_paths << "#{`pwd`.strip}/../deps/libuv-v1.9.1/include/"
-       cc.include_paths << "/usr/share/mingw-w64/include/" if windows
-       cc.include_paths << "/usr/x86_64-w64-mingw32/include/" if windows
-       cc.flags << "-DLDBL_EPSILON=1e-6" if windows
-@@ -117,14 +116,14 @@ build_type.new(build_name) do |conf|
-       linker.flags_after_libraries  << "#{`pwd`.strip}/../deps/pugl/build/libpugl-0.a"
-       linker.flags_after_libraries  << "#{`pwd`.strip}/../deps/libnanovg.a"
-       if(!windows)
-        linker.flags_after_libraries  << "#{`pwd`.strip}/../deps/libuv.a"
-+        linker.flags_after_libraries  << "-luv"
-         if(ENV['OS'] != "Mac")
-           linker.libraries << 'GL'
-           linker.libraries << 'X11'
-         end
-         linker.flags_after_libraries  << "-lpthread -ldl -lm"
-       else
-        linker.flags_after_libraries  << "#{`pwd`.strip}/../deps/libuv-win.a"
-+        linker.flags_after_libraries  << "-luv"
-         linker.flags_after_libraries  << "-lws2_32 -lkernel32 -lpsapi -luserenv -liphlpapi"
-         linker.flags_after_libraries  << "-lglu32 -lgdi32 -lopengl32"
-       end
--- a/pkgs/applications/editors/leo-editor/default.nix
+++ b/pkgs/applications/editors/leo-editor/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "leo-editor";
-  version = "6.6-b2";
+  version = "6.6.3";

  src = fetchFromGitHub {
    owner = "leo-editor";
    repo = "leo-editor";
    rev = version;
-    sha256 = "sha256-oUOsAYcxknG+bao76bzPhStO1m08pMWTEEiG2rLkklA=";
+    sha256 = "sha256-QBK+4V9Nff3K6KcJ1PEyU0Ohn3cLawKe/5sR4Tih0dM=";
  };

  dontBuild = true;
--- a/pkgs/applications/misc/avizo/default.nix
+++ b/pkgs/applications/misc/avizo/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "avizo";
-  version = "1.2";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "misterdanb";
    repo = "avizo";
    rev = version;
-    sha256 = "sha256-BRtdCOBFsKkJif/AlnF7N9ZDcmA+878M9lDQld+SAgo=";
+    sha256 = "sha256-ainU4nXWFp1udVujPHZUeWIfJE4RrjU1hn9J17UuuzU=";
  };

  nativeBuildInputs = [ meson ninja pkg-config vala gobject-introspection wrapGAppsHook ];
--- a/pkgs/applications/misc/sticky/default.nix
+++ b/pkgs/applications/misc/sticky/default.nix
@ -11,14 +11,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sticky";
-  version = "1.11";
+  version = "1.12";
  format = "other";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-PXJpNKzF9goQvfh3lUUfOaZFessFNrWtg8nMDxPxRMo=";
+    hash = "sha256-kAO8Qz4bTn3+YeIXAvPZ1SpKgn+g+rBgi9+TaqL1vOY=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -86,6 +86,8 @@ let
            ++ pkcs11Modules;
      gtk_modules = [ libcanberra-gtk3 ];

+      launcherName = "${applicationName}${nameSuffix}";
+
      #########################
      #                       #
      #   EXTRA PREF CHANGES  #
@ -167,7 +169,7 @@ let

      desktopItem = makeDesktopItem {
        name = applicationName;
-        exec = "${applicationName}${nameSuffix} %U";
+        exec = "${launcherName} %U";
        inherit icon;
        desktopName = "${desktopName}${nameSuffix}${lib.optionalString forceWayland " (Wayland)"}";
        genericName = "Web Browser";
@ -182,6 +184,20 @@ let
          "x-scheme-handler/ftp"
        ];
        startupWMClass = wmClass;
+        actions = {
+          new-window = {
+            name = "New Window";
+            exec = "${launcherName} --new-window %U";
+          };
+          new-private-window = {
+            name = "New Private Window";
+            exec = "${launcherName} --private-window %U";
+          };
+          profile-manager-window = {
+            name = "Profile Manager";
+            exec = "${launcherName} --ProfileManger";
+          };
+        };
      };

      nativeBuildInputs = [ makeWrapper lndir jq ];
@ -261,7 +277,7 @@ let
            --suffix-each GTK_PATH ':' "$gtk_modules" \
            --prefix PATH ':' "${xdg-utils}/bin" \
            --suffix PATH ':' "$out/bin" \
-            --set MOZ_APP_LAUNCHER "${applicationName}${nameSuffix}" \
+            --set MOZ_APP_LAUNCHER "${launcherName}" \
            --set MOZ_SYSTEM_DIR "$out/lib/mozilla" \
            --set MOZ_LEGACY_PROFILES 1 \
            --set MOZ_ALLOW_DOWNGRADE 1 \
--- a/pkgs/applications/networking/cluster/atlantis/default.nix
+++ b/pkgs/applications/networking/cluster/atlantis/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "atlantis";
-  version = "0.19.6";
+  version = "0.19.7";

  src = fetchFromGitHub {
    owner = "runatlantis";
    repo = "atlantis";
    rev = "v${version}";
-    sha256 = "sha256-A4OJNZHCERV2Sd/XQgt29xeBP+8PEIrpk22QypeVQ/A=";
+    sha256 = "sha256-wnYLZ/mSNco8lIr6zmVoGGVGnOBWAzXgB+uy5U5Os4A=";
  };

-  vendorSha256 = "sha256-k8FvHvo2qrQcYNKXH0LiAjaW+J+BKEflhjaulQ3SRMI=";
+  vendorSha256 = "sha256-nNZLL8S32vGfQkDD+vI4ovUvZZgGzgQmb8BAGBb+R4k=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "kubelogin";
-  version = "1.25.1";
+  version = "1.25.2";

  src = fetchFromGitHub {
    owner = "int128";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-BKJ6dZMGW+Md+YUEEgWtPdfiFiOP5Nfb+awx8FXB+bM=";
+    sha256 = "sha256-d3iiUmNEPKylYSFq9cSfgJuQYLPhBJavGV8tOao0l4s=";
  };

  subPackages = ["."];

-  vendorSha256 = "sha256-mu4NHeYZBM4C5qpj2wRTLsRNLDvZGNkppKGDw621mp4=";
+  vendorSha256 = "sha256-XxVXhNWZOyvrdh2yPQogtH62h7d8NbsNhhrwGuqcLJs=";

  # Rename the binary instead of symlinking to avoid conflict with the
  # Azure version of kubelogin
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@ -5,13 +5,13 @@ buildGoModule rec {
  /* Do not use "dev" as a version. If you do, Tilt will consider itself
    running in development environment and try to serve assets from the
    source tree, which is not there once build completes.  */
-  version = "0.30.6";
+  version = "0.30.7";

  src = fetchFromGitHub {
    owner  = "tilt-dev";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "sha256-i4i406Ys3MY77t4oN+kIeWopdjtfysm4xDFkTpuo+X0=";
+    sha256 = "sha256-zYP9bn3wC5FJwCdDJEBunaEHoFhRKlH7Mec/Stvp76A=";
  };
  vendorSha256 = null;

--- a/pkgs/applications/radio/fldigi/default.nix
+++ b/pkgs/applications/radio/fldigi/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "fldigi";
-  version = "4.1.20";
+  version = "4.1.23";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0f64pqijl3jlfmv00hkdxvn1wy5yy3zl33p6vf3fn1b91w590c2h";
+    sha256 = "sha256-42bh/J/DQ/V9ORKKZgOmlvhyNR7UjbqPPD0Wi9ofyo0=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/radio/flmsg/default.nix
+++ b/pkgs/applications/radio/flmsg/default.nix
@ -7,12 +7,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "4.0.19";
+  version = "4.0.20";
  pname = "flmsg";

  src = fetchurl {
    url = "mirror://sourceforge/fldigi/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Pm5qAUNbenkX9V3OSQWW09iIRR/WB1jB4ioyRCZmjqs=";
+    sha256 = "sha256-TsYwd2uUGJsweiKigTWBPXA7PtItZeIOxKk3lV3sy24=";
  };

  buildInputs = [
--- a/pkgs/applications/science/electronics/openboardview/default.nix
+++ b/pkgs/applications/science/electronics/openboardview/default.nix
@ -0,0 +1,57 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, gitUpdater
+, cmake
+, pkg-config
+, python3
+, SDL2
+, fontconfig
+, gtk3
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openboardview";
+  version = "9.0.3";
+
+  src = fetchFromGitHub {
+    owner = "OpenBoardView";
+    repo = "OpenBoardView";
+    rev = version;
+    sha256 = "sha256-0vxWFNM9KQ5zs+VDDV3mVMfHZau4pgNxQ1HhH2vktCM=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake pkg-config python3 wrapGAppsHook ];
+  buildInputs = [ SDL2 fontconfig gtk3 ];
+
+  postPatch = ''
+    substituteInPlace src/openboardview/CMakeLists.txt \
+      --replace "SDL2::SDL2main" ""
+  '';
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DGLAD_REPRODUCIBLE=On"
+  ];
+
+  dontWrapGApps = true;
+  postFixup = ''
+    wrapGApp "$out/bin/${pname}" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gtk3 ]}
+  '';
+
+  passthru.updateScript = gitUpdater {
+    inherit pname version;
+    ignoredVersions = ''.*\.90\..*'';
+  };
+
+  meta = with lib; {
+    description = "Linux SDL/ImGui edition software for viewing .brd files";
+    homepage = "https://github.com/OpenBoardView/OpenBoardView";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ k3a ];
+  };
+}
--- a/pkgs/applications/science/misc/graphia/default.nix
+++ b/pkgs/applications/science/misc/graphia/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "graphia";
-  version = "3.0";
+  version = "3.1";

  src = fetchFromGitHub {
    owner = "graphia-app";
    repo = "graphia";
    rev = version;
-    sha256 = "sha256-9JIVMtu8wlux7vIapOQQIemE7ehIol2XZuIvwLfB8fY=";
+    sha256 = "sha256-mqoK5y2h0JSiE9VtwawCgc1+qETzuefLVUpgFPcNFnk=";
  };

  patches = [
--- a/pkgs/applications/version-management/git-and-tools/git-cinnabar/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-cinnabar/default.nix
@ -8,13 +8,13 @@ in

 stdenv.mkDerivation rec {
  pname = "git-cinnabar";
-  version = "0.5.7";
+  version = "0.5.10";

  src = fetchFromGitHub {
    owner = "glandium";
    repo = "git-cinnabar";
    rev = version;
-    sha256 = "04dsjlsw98avrckldx7rc70b2zsbajzkyqqph4c7d9xd5djh3yaj";
+    sha256 = "sha256-vHHugCZ7ikB4lIv/TcNuOMSQsm0zCkGqu2hAFrqygu0=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/version-management/git-and-tools/git-team/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-team/default.nix
@ -1,4 +1,10 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, fetchpatch
+, installShellFiles
+}:
+
 buildGoModule rec {
  pname = "git-team";
  version = "1.7.0";
@ -7,10 +13,28 @@ buildGoModule rec {
    owner = "hekmekk";
    repo = "git-team";
    rev = "v${version}";
-    sha256 = "0nl5j64b61jw4bkf29y51svjbndmqqrqx96yaip4vjzj2dx9ywm4";
+    hash = "sha256-pHKfehPyy01uVN6kjjPGtdkltw7FJ+HmIlwGs4iRhVo=";
  };

-  vendorSha256 = "sha256-xJMWPDuqoNtCCUnKuUvwlYztyrej1uZttC0NsDvYnXI=";
+  patches = [
+    (fetchpatch {
+      name = "1-update-dependencies-for-go-1.18.patch";
+      url = "https://github.com/hekmekk/git-team/commit/d8632d9938379293521f9b3f2a93df680dd13a31.patch";
+      hash = "sha256-hlmjPf3qp8WPNSH+GgkqATDiKIRzo+t81Npkptw8vgI=";
+    })
+    (fetchpatch {
+      name = "2-update-dependencies-for-go-1.18.patch";
+      url = "https://github.com/hekmekk/git-team/commit/f6acc96c2ffe76c527f2f2897b368cbb631d738c.patch";
+      hash = "sha256-Pe+UAK9N1NpXhFGYv9l1iZ1/fCCqnT8OSgKdt/vUqO4=";
+    })
+    (fetchpatch {
+      name = "3-update-dependencies-for-go-1.18.patch";
+      url = "https://github.com/hekmekk/git-team/commit/2f38137298e4749a8dfe37e085015360949e73ad.patch";
+      hash = "sha256-+6C8jp/qwYVmbL+SpV9FJIVyBRvX4tXBcoHMB//nNTk=";
+    })
+  ];
+
+  vendorSha256 = "sha256-GdwksPmYEGTq/FkG/rvn3o0zMKU1cSkpgZ+GrfVgLWM=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/video/obs-studio/wrapper.nix
+++ b/pkgs/applications/video/obs-studio/wrapper.nix
@ -16,19 +16,14 @@ symlinkJoin {

      pluginsJoined = symlinkJoin {
        name = "obs-studio-plugins";
-        paths = lists.map (plugin: "${plugin}/lib/obs-plugins") plugins;
-      };
-
-      pluginsDataJoined = symlinkJoin {
-        name = "obs-studio-plugins-data";
-        paths = lists.map (plugin: "${plugin}/share/obs/obs-plugins") plugins;
+        paths = plugins;
      };

      wrapCommand = [
          "wrapProgram"
          "$out/bin/obs"
-          ''--set OBS_PLUGINS_PATH "${pluginsJoined}"''
-          ''--set OBS_PLUGINS_DATA_PATH "${pluginsDataJoined}"''
+          ''--set OBS_PLUGINS_PATH "${pluginsJoined}/lib/obs-plugins"''
+          ''--set OBS_PLUGINS_DATA_PATH "${pluginsJoined}/share/obs/obs-plugins"''
        ] ++ pluginArguments;
    in concatStringsSep " " wrapCommand;

--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "15.6.1";
+  version = "15.6.3";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, nodejs, nodePackages, remarshal
+{ stdenv, lib, pkgs, fetchFromGitHub, nodejs, remarshal
 , ttfautohint-nox
  # Custom font set options.
  # See https://typeof.net/Iosevka/customizer
@ -55,13 +55,18 @@ let
  #
  # Doing it this way ensures that the package can always be built,
  # although possibly an older version than ioseva-bin.
-  nodeIosevka = (
-    lib.findSingle
-      (drv: drv ? packageName && drv.packageName == "iosevka")
-      (throw "no 'iosevka' package found in nodePackages")
-      (throw "multiple 'iosevka' packages found in nodePackages")
-      (lib.attrValues nodePackages)
-  ).override (drv: { dontNpmInstall = true; });
+  nodeIosevka = (import ./node-composition.nix {
+    inherit pkgs nodejs;
+    inherit (stdenv.hostPlatform) system;
+  }).package.override {
+    src = fetchFromGitHub {
+      owner = "be5invis";
+      repo = "Iosevka";
+      rev = "v15.6.3";
+      hash = "sha256-wsFx5sD1CjQTcmwpLSt97OYFI8GtVH54uvKQLU1fWTg=";
+    };
+  };
+
 in
 stdenv.mkDerivation rec {
  pname = if set != null then "iosevka-${set}" else "iosevka";
@ -69,7 +74,6 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    nodejs
-    nodeIosevka
    remarshal
    ttfautohint-nox
  ];
@ -108,7 +112,7 @@ stdenv.mkDerivation rec {
  buildPhase = ''
    export HOME=$TMPDIR
    runHook preBuild
-    npm run build --no-update-notifier -- --jCmd=$NIX_BUILD_CORES ttf::$pname >/dev/null
+    npm run build --no-update-notifier -- --jCmd=$NIX_BUILD_CORES --verbose=9 ttf::$pname
    runHook postBuild
  '';

--- a/pkgs/data/fonts/iosevka/node-composition.nix
+++ b/pkgs/data/fonts/iosevka/node-composition.nix
@ -0,0 +1,17 @@
+# This file has been generated by node2nix 1.11.1. Do not edit!
+
+{pkgs ? import <nixpkgs> {
+    inherit system;
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-16_x"}:
+
+let
+  nodeEnv = import ../../../development/node-packages/node-env.nix {
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
+    inherit pkgs nodejs;
+    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
+  };
+in
+import ./node-packages.nix {
+  inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
+  inherit nodeEnv;
+}
--- a/pkgs/data/fonts/iosevka/node-packages.nix
+++ b/pkgs/data/fonts/iosevka/node-packages.nix
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1sd45spjccrqydamgi62ipn8yc378y44s7ikv1zrpfwl29vnnwhr";
-  iosevka-aile = "05dsr38f1gvxflna8hk3x61jdf2rl3qrh3bjy4vdffi76fvd1m73";
-  iosevka-curly = "1056j12bbljzazdwclj6a6l37h9lpj90kvs08rh6aqxb9hgjkdfy";
-  iosevka-curly-slab = "1y8kyz4a7yzdqf619vbgkbmrsyz005nihwkjwljhhnr7w577gm3q";
-  iosevka-etoile = "1wxdra9j7cdkxx92yvmkcf3i86iy2rp918aixpgnw50hpyz370qh";
-  iosevka-slab = "06xaxh77ghf327p9bc40n45c3bhc0vqgdpk3ym60gfbcxs7jrpxh";
-  iosevka-ss01 = "0wlwhl4dm2gg0z4vxkqhp076arkyv9bl8xiwhhif06w440b5nikw";
-  iosevka-ss02 = "10kk2n5p85haymfaf3viy4la6hz9kvpvr2a4wd5hs410sc0mkp7g";
-  iosevka-ss03 = "16skp5l65jkaz2c02g5slma0qd43v54lavi091z8p7sfl01c7mlk";
-  iosevka-ss04 = "0s5m76m9gk4a6b72abpdg4abvp85ymjhrfwmy69il4x02ffx3cih";
-  iosevka-ss05 = "1j5nm3rinincz50axxsd8rjrbmj8n8y09sxfj56fxxl9j9qq5vrx";
-  iosevka-ss06 = "0g96yj19kd5xx8fvnxjxp19bx8inhl9bsy8r03rlgc2c130xng3z";
-  iosevka-ss07 = "05h6knsms00akridmrrrbn2gph9i3gkn15z8snjni99apd1iy6hi";
-  iosevka-ss08 = "075m6hdmnsjcq0ybp0h7b5my1w4nbgvczba2a2hxpbh06qqbkyng";
-  iosevka-ss09 = "0shw8xwbh3v3sc5agrincx4mz3qpjgbr48alyffzfwrzy4divff7";
-  iosevka-ss10 = "08b1517kzfhvpbsbsz38wf5ddbnar55m0z43v4nm8zw76wfhbz9i";
-  iosevka-ss11 = "10hvldhxgzr9pyabi6kznh77gl1hkr7fkxmlrvrks4a5h406xq0q";
-  iosevka-ss12 = "10lbga8xr9dabvwkdq51xhnniyrlywj54a2ncwchikglyzfzz260";
-  iosevka-ss13 = "0h19ggacndxnkl5m7v3cc69mzzfqvyzkaa5al1njmipxfmwlw19c";
-  iosevka-ss14 = "04razagrzzpfgacv43nsq6ic7wj22lx0kwfcmlii3cpkyxmyfmhy";
-  iosevka-ss15 = "1dm673k51hpi1201yyc18wdb9blvh7ad2qcsn10vxsyi6j34nbdr";
-  iosevka-ss16 = "1bhljlji97r2b7lmkczv0v9l5kil70q3isvljgz0m40vbrnknsli";
-  iosevka-ss17 = "1nqkg0xx0q418981liv8smv8s1p2nnvrkwdmp2vp57q6gjiw2mf7";
-  iosevka-ss18 = "0jmff0f5h20md03as2gprbk74wgg2fwvzd45ap6a4w0cyf7wjpmm";
-  sgr-iosevka = "1asrysbc1ah8b7fas49md1b100jw09w13n8bvw9vbipk9zvbbzg5";
-  sgr-iosevka-aile = "1dpkakcbl1l5lzrl3bmgci1dyszhp1h38yvm0cfc51pwsy9a81c2";
-  sgr-iosevka-curly = "037vmrsqxzls4xdjzzddamxgxan0gx7rhflzwsc4izq5agv77605";
-  sgr-iosevka-curly-slab = "1faammvd4dj0nibgfh7xg01wp34ilmzls6azri0d3v9844wmm50a";
-  sgr-iosevka-etoile = "0kagsz04z9p5pqg6dvqsx4plrsspnk7pd0kffzxyspfc6h6j3lir";
-  sgr-iosevka-fixed = "1wxq1416z8kb22mqvqg2pgrvm9pb2rqalm48gjnyaxz1w15hdxf5";
-  sgr-iosevka-fixed-curly = "1i8nbm24hb8m7sj2igvsgil9ab5jwnsjgczypzwkmj559r1jlqzv";
-  sgr-iosevka-fixed-curly-slab = "1s1n771dq9w668i22107lmxh7hdjf2lvdcqj2d9lb2mipjawqhfd";
-  sgr-iosevka-fixed-slab = "1bldr80k7iwzzrniq7gfgdxnzd9lqwsdwyd19r3ryar8r7d93f9n";
-  sgr-iosevka-fixed-ss01 = "0daz5kpmkrjx1s0qvk0gcf0hh2q2sddngglr9v3ci8c026xnn04y";
-  sgr-iosevka-fixed-ss02 = "0rak6bnz90rnjb1977apkkabl65090c7iliggbg6g65ljqn3gkfc";
-  sgr-iosevka-fixed-ss03 = "1ilk06wvs2p6snzdcrvax7s51p0vyyb8vzzpikmrql1w1q1xdh60";
-  sgr-iosevka-fixed-ss04 = "1lmdj7wdxgfqjp348hpmgbc96dmigvdzw3hz1axq64wf18dw4hza";
-  sgr-iosevka-fixed-ss05 = "0y7z4v7xyvwzlg792jx8rsqdj7agl2s4z2syhkjrw77dd94mxi4x";
-  sgr-iosevka-fixed-ss06 = "1m55n2djfkzwz95xavlvkihcfn4liyiymllhibgh3sgza55gljnc";
-  sgr-iosevka-fixed-ss07 = "1dj2bab7rq9rr2n9q4siq8hgdf9pwmwf8hlpn1fkks1998yqshsp";
-  sgr-iosevka-fixed-ss08 = "0dmckvn1vd7v86q3rxrb1g6rvz0yfzcfzmyn10maddnrnwf8llfm";
-  sgr-iosevka-fixed-ss09 = "15gcw3cvbyvnqj66fp5c5475g9gfz38s98slvqwwhlzlg4g8xfnj";
-  sgr-iosevka-fixed-ss10 = "0dbd1yrcfwfr4dx01iwk8rhhh0f40lw5qncc6x5ihqrbsskaspn4";
-  sgr-iosevka-fixed-ss11 = "188yga2n0cv9xqdilc06ld1pl0v5k50fb5vr46s2l40p1dkd988i";
-  sgr-iosevka-fixed-ss12 = "06h82cd10ia4pdhgdkznli3brkkn8q4fxw3kbylp8c9lxbmrvi40";
-  sgr-iosevka-fixed-ss13 = "1xbwdxxpc762y9ghgf6g50mhydd1m7fiqjr62lsqs9811d2db0l4";
-  sgr-iosevka-fixed-ss14 = "0am6xg4c5x62s1670lgq7y2qyvc4g9lsffb8xbslvijqlp8k6q3z";
-  sgr-iosevka-fixed-ss15 = "0cnikxyl8jps6f2dipq8zry95dh1xqm8wvkdqsxpisnm9cfd7y1k";
-  sgr-iosevka-fixed-ss16 = "0dcgj4lcfnzcds8qbdi798qsrdpsi1wqiqpy39080h1908zyzyz2";
-  sgr-iosevka-fixed-ss17 = "1iidvrn0ij2wqglndl5a82pw81r4nzd921fsdr4rvklw7a6dlppq";
-  sgr-iosevka-fixed-ss18 = "0v73i320wrnlj25grhqz4acw7zbivnjhjj8bcly9ghgv1mzbbaga";
-  sgr-iosevka-slab = "0s4kwmic87sll394kynj1hc407mgk43kfakgpgv6x60miqmhp7pz";
-  sgr-iosevka-ss01 = "02bjnsjcjgj3418qfbkgbm43mfp3q8fh81ckgjxl6pj0r3cwqahd";
-  sgr-iosevka-ss02 = "1pzii9rgim4dz3yjv1hpa4qs2x4s180gkk4p3lkyfwn07kkrbwm6";
-  sgr-iosevka-ss03 = "18r4slc9p94w2db4n9d0pqln1v1mn8snfbw3bfpjza3470xfrdwd";
-  sgr-iosevka-ss04 = "0laypbvzsxfwpak6c3xhhzzbm1akkzpm9f2nyjgr0pfaix0kdhdi";
-  sgr-iosevka-ss05 = "0l9dn96mbv8ssgp6352dm5hykwn5z5457fwkxn6i91jiia693j7r";
-  sgr-iosevka-ss06 = "057lgnf1pcir8q76ya8819mg0mwdv7sam810qnrya31dc18dzj6z";
-  sgr-iosevka-ss07 = "0w04v61qnl8pwfsm2654w39x0a42c27qs5qc8xpah7j6flpmhk07";
-  sgr-iosevka-ss08 = "1nr14v36cq846k9km8sznbvacrnhf4nh62mxvnb3nr17csf85al2";
-  sgr-iosevka-ss09 = "1b3pkzv3hdzc2hsj3pzf135g109ln0wzic08kdzsqzsh4yb8q6dp";
-  sgr-iosevka-ss10 = "1nmb38l1p1ywccdiysw8mvn5gnm8lwfakvnxk4ya7s4k5p72wpi0";
-  sgr-iosevka-ss11 = "0449rzm07rfixsfd9ag3a2s4nl1wwf6q5h0zy9iq507af8ys29ji";
-  sgr-iosevka-ss12 = "0n198kxjq81ji3i1q2kg3hyg2p14bllzg7r4kqsz8bvf4ivhdbdl";
-  sgr-iosevka-ss13 = "0vm2w0ikhrxr5k6w3521vv6r028gg23iazzr0vg71l0yr05z6z83";
-  sgr-iosevka-ss14 = "0nnnzfzr4my9lxvahv8sn6dvj8b5jh0nwc0adq4ca2zpfp7py9qp";
-  sgr-iosevka-ss15 = "129v06xq7d0minhrmjm1sz6235khgfp7jc746lkk16dr3fsvajbq";
-  sgr-iosevka-ss16 = "0rvda1xpb0c35qhdh3lx84gdymb2hxp8s8zxxl6cmwjhpd2n8mwd";
-  sgr-iosevka-ss17 = "0a0y5fh97kqf7nvx1hn5727438y5g75dkqwzba2hy8shx14m9cqq";
-  sgr-iosevka-ss18 = "1phcfn83wj0dlh6l514s4nj67k0v919nbd79kg0lyn786lingggq";
-  sgr-iosevka-term = "178bp8r875ic65wx34y3193iz4pqp5cls1w534zkqkaw21ppl6gv";
-  sgr-iosevka-term-curly = "18fh2z87g1zlf7r5r9gk8cxfvdwrc57r7i1llfadh66xs928imps";
-  sgr-iosevka-term-curly-slab = "00sv5ibgwjwgm75lkk56n4ldc0hfk98lc04d45q5gi6rfqzy8bjj";
-  sgr-iosevka-term-slab = "1izygr56940q8w5gvgfhqyvamfgsz6g26fpm0lf3hm68ypz6vsx8";
-  sgr-iosevka-term-ss01 = "0iad3lzj1w84qrnh8yv9hr7kc7xa84m94r1w8j1yyjjqkf41kqzd";
-  sgr-iosevka-term-ss02 = "03lj938i8rilrmdki24xyd38hb83wbazqmkw677q8hbj2pw5j1ax";
-  sgr-iosevka-term-ss03 = "1svsffkkp3a3gfw8p1cqm6qc0bmadb5nyyg7jip52qil963bv7yx";
-  sgr-iosevka-term-ss04 = "1rndp4r7imysdlxrs0fka63v7dx6i5zsyw03hh0ij034qsnpjdxq";
-  sgr-iosevka-term-ss05 = "0013pwg24dzziixz16011zdsda37g65nl1ykd505l5527lgr1ypx";
-  sgr-iosevka-term-ss06 = "0ccspibjgbb2d7gp784c70cs4pv8hhzrjvr680v82si4siacshd7";
-  sgr-iosevka-term-ss07 = "193px84zyc2f6c7xrzzcpr31xn5h9bhbsygzp35rxma4pgs5qr3x";
-  sgr-iosevka-term-ss08 = "1v5gs1lphpbc1pwxg2a4vvwlbckpy9p40gwjsvf99q73mvvs7b4b";
-  sgr-iosevka-term-ss09 = "16kd1l9nbqcl1w11l9ppp1xhjhm3rihzm5ndpds0clyjacj2s71f";
-  sgr-iosevka-term-ss10 = "1l8jksvg3lq1ygrndh7l2nd2v1f7lsl7wr16g7n44acz94xqyj3i";
-  sgr-iosevka-term-ss11 = "005jcj0nk4n7gsl88ygxyncj51lxsh3fr1vdcyjp3d0ipmf9dybb";
-  sgr-iosevka-term-ss12 = "08850qi22mb6j48ack9091pgqgfagsyad4jzapn9skhfb04kzc13";
-  sgr-iosevka-term-ss13 = "0q85sr0dl93xdia9pdh5lfw11vnnvs9mb0xwrc6zikvakriw8zlb";
-  sgr-iosevka-term-ss14 = "0akawjz58qnynagnmf82ldnn6yxjxqyfn5fa9261k91lcrbkcils";
-  sgr-iosevka-term-ss15 = "18qmj66589nl68sg047d9hzfh485q6wbib5pa5gllgida92k9vw6";
-  sgr-iosevka-term-ss16 = "1baipchlrfj3h8aqcmws5s1s08g843na61p9ql17f86f1lib0gw4";
-  sgr-iosevka-term-ss17 = "0zfis06pg6b41gx79qrcl8mniirchfads3vrr1hxi37b9prqqi2y";
-  sgr-iosevka-term-ss18 = "0hh4ahrj54fpw3p0fiig6m8y69b2mgxv15qfm9j88fik2aps6b3i";
+  iosevka = "001k987gf2drwh57iplicylnk4ssgzrhrfjv3b27xpwanjjdi0j9";
+  iosevka-aile = "1yg2g5sq7qc4aw85vaj3f6yc1lrqnx1dfghcb5p5icflp23giv48";
+  iosevka-curly = "0haxn2sxmnydrrmmbp0rf4ylzc05z10p73bmhvm53grysawr0lph";
+  iosevka-curly-slab = "1z7ji33wf91zayqk6bkjq6ayny5r3sgi1sr94ikn47vb8rax75af";
+  iosevka-etoile = "0xcvp5v4fz459fhihij9mm6q95plrz6ffgrr6c9ir4nk0d44gh9p";
+  iosevka-slab = "0923yshy81lcssz8p52kjwa0njiyr95kk193n8fnfwycgak5w4g7";
+  iosevka-ss01 = "0g90589l5wsa2r7yl7ii04g2lninpw36yrw6djpvh3821d7zfwli";
+  iosevka-ss02 = "1pvxnrhcz01ga4yklsc7s8qbcz3il1ibqaszcmkkaxazlqqk600a";
+  iosevka-ss03 = "16j0bbyq5yyph07z1vz0lgy1c0ac4hywz394favz00i2gc9gczql";
+  iosevka-ss04 = "0000b4d9iwydyyh91v1jkbwszglq8z1wz9a3gaklisga0zfalm32";
+  iosevka-ss05 = "0fdcjsfk3ih18cd4ax2vxsxsa3gf6rx7v1ynm3l1ww642zfn7kj6";
+  iosevka-ss06 = "0rgnz8d9mlkinkq4bkbgmkvmnnym6amwsbri0pj60dm2dgsp9ipn";
+  iosevka-ss07 = "0bfrkh8bc0h2gkyq79vmppjcvil549y2qqaz7vb8gm2gmbglspaz";
+  iosevka-ss08 = "17wbg6zzrx6inzx1n7c3gc6h2fa6fch0lnmic8ky4dvzhaqzcpyn";
+  iosevka-ss09 = "03fq1mcm0jywjawlkii634vgm2d6173j35ppg1qlgpg5gysjnsvg";
+  iosevka-ss10 = "15189r3cg1y1fjcb7qpk03lqfm3f76gzxicwm1kb5220rvjhsqhj";
+  iosevka-ss11 = "00yqca40dbnwbz58nyfpqmg6j7azckjwwid1fqabm5dvd5lc2616";
+  iosevka-ss12 = "0ikv5rfnvyq5fnppcsfddrz5yjjm6p97hfp7xzx50i4gpykdays7";
+  iosevka-ss13 = "0n9nlq4qmgwbxh1qzzhrjf6kb955hk6lkagq7gk1vig49xj2v2w9";
+  iosevka-ss14 = "11vva8mdanb5sdx6nv7jr2vqzx7jwapz4hy6dc4xdxvsp90wvqrc";
+  iosevka-ss15 = "0v4v6fh4nzd1v15csxj5dc9s7wwxrgx1crb2c1q42xa1fj5s6q11";
+  iosevka-ss16 = "0h2vgy0fk8gc2b9nnb8hf79njdkyigsjhnzp0p1mi8k08ca8zy95";
+  iosevka-ss17 = "1v1sl9j5ckcvx3p6g4dagxf4cx5n44k6awpg4mz4fhzvfi5y1a3b";
+  iosevka-ss18 = "0qjal5mg8bmwa0fd9m59k2m9qjsmfwz0n6f6q6zvb00bi7mw6qhn";
+  sgr-iosevka = "1cvf6512iqngy772z78ayzyyd574ymffpldlrdpyvbcgw9kcrh84";
+  sgr-iosevka-aile = "166hncxlaq5z32ic88lkgxkj6pbhjz1fdhb5bhzrp1l1mgl29s53";
+  sgr-iosevka-curly = "0m37ccridvjik1jhvy0pblbps7m44wkwd1v2s34xv6wr901dmr5x";
+  sgr-iosevka-curly-slab = "100cvlpxlv62if341s52w8441axscyijgjz9m1g46yr3lngazff9";
+  sgr-iosevka-etoile = "1nwcaqw6rnmp89fhshh74dr45avp59x3fg0h3ipkk17n9slw6b1l";
+  sgr-iosevka-fixed = "1m12k9f4a2rn4jx31qw11s4nffw9bgr4v9k12hdnxr7r1ybgg974";
+  sgr-iosevka-fixed-curly = "1db12r5amcvxvqn8sqwd120vixnbzk7rb75nibnan1k5zx9vyl2r";
+  sgr-iosevka-fixed-curly-slab = "15rly7vg69avxzkiyy2k8jhb29ppjyw7rk49j5zhsyapw6n0f6sy";
+  sgr-iosevka-fixed-slab = "0c4sihad0vgy8hhgcbwlwayn3y8krigr6w2f9qlz70adzy8g1z5n";
+  sgr-iosevka-fixed-ss01 = "0zw90a22143ixnpb3gx76fgilvbn986lca4bpmd7r318hq48byw3";
+  sgr-iosevka-fixed-ss02 = "12hkwg294a11k882s0fr13w2j7cqlri5p0mn5bys926159j71ani";
+  sgr-iosevka-fixed-ss03 = "0mz69vxisd12mqx3aw486p96xjhqhgy1nn8p4b17b51zaj7mn593";
+  sgr-iosevka-fixed-ss04 = "12rmh62y1s5am7lsw01p14vlchw34spy0rdma7f9yhyjfy0403rs";
+  sgr-iosevka-fixed-ss05 = "0mp27hibvz6va2ssapbqk2jhhz1yzr0ax0gprzwrdg89bpnglf34";
+  sgr-iosevka-fixed-ss06 = "0z3m9s4366rdk0k4m7vjp5g076jv6kbb7nzf2msdrfz1sxwjl8w3";
+  sgr-iosevka-fixed-ss07 = "19b7i5gqzbsf8am81a9yzfn7zbdr5k34vgsp11cj5rrs82li9qrs";
+  sgr-iosevka-fixed-ss08 = "0hwr5df93w1ghb2wkszv5npgbdxak0zvdv45nrmpsxhc9hfzy3mx";
+  sgr-iosevka-fixed-ss09 = "0i7fahdwlna1nzjsc2iwxj9da0glp8j6ipqxaj3r03chb7p6d5qd";
+  sgr-iosevka-fixed-ss10 = "0kq9sfidq14114b3564mp490yi7kwsyk5fx0bc8c06nfn50y565k";
+  sgr-iosevka-fixed-ss11 = "19ra48lbasm03ypd9dkfqv816ykn7mvvwcc0x97vlakxqnqb526m";
+  sgr-iosevka-fixed-ss12 = "0s4jdj1v5dbfapiqm985w31l7b5ibkz0z2rqzj39rcin42nbbkbi";
+  sgr-iosevka-fixed-ss13 = "1437igg9ff9by2bkk1qll1dhssccdi3bzja7s18m5dnjij0g62vp";
+  sgr-iosevka-fixed-ss14 = "0n89r0xvcvaxaf67lmsqzxqlxpx9q7ci3zppijvpkhks4p09p70j";
+  sgr-iosevka-fixed-ss15 = "1dg7s62kmy024q46hvf29h58gj0mv6hfb9zvkbcxss9vx9xrhw8y";
+  sgr-iosevka-fixed-ss16 = "0pfg9m421996cgzvi3y9jxpjl8cxa69mlrddyk98hfq64d9flf3l";
+  sgr-iosevka-fixed-ss17 = "17vd2lnxvq2w138p1pkkhs3scl5g96q684ln20gb8hy4330s4fps";
+  sgr-iosevka-fixed-ss18 = "00cj148drpnzr9kgb1ginbb294cj1pw35knl866zxl6ds34b4n71";
+  sgr-iosevka-slab = "03p0zr75l6q5w1zccv1pk1qmi51rvf680qwvgjgrfzvavqpdzbj9";
+  sgr-iosevka-ss01 = "1ncy21zjqsa559pvqbr4alcblc7bpq05i1gfcr2l18aiv8xk4ska";
+  sgr-iosevka-ss02 = "1ki1fkwkdzj4f75ysiza2r58x3p4v4i21p7krgphgzz1i9j7z0bc";
+  sgr-iosevka-ss03 = "039pf9xlwy9lp03yvc8j2qb0w35kx7h4zncvprbrrpgw0rv688gq";
+  sgr-iosevka-ss04 = "1fmqxd4v4lshja2sfbcnb6x038dy3fi3lx6qn93vi9b6rd699xvw";
+  sgr-iosevka-ss05 = "0lfk2wijvkv6nzji4fy8zllmgqjszw0aw3g48zl2568348vm8c0z";
+  sgr-iosevka-ss06 = "1j9q0v74wkl512z7lgmjqgckprly6zkq1b23ca2cynw5aklsl1c9";
+  sgr-iosevka-ss07 = "08v716j55d9m4p349bg4bscn8222fv5prrmlmyjfmj7l2r47sr7m";
+  sgr-iosevka-ss08 = "1nnixhi6x26p6l19c54p1hm8pjkdqxjgsxqym82h5dyzsfcraws6";
+  sgr-iosevka-ss09 = "1hnb9l1symazn4rz5fjbfpsz3ly0j29vyzkg020i8ibb9h32rg9s";
+  sgr-iosevka-ss10 = "109w970ma7fj81bi5nq04nvf6d8ph25i7anaxq6wx507sd5n4bwa";
+  sgr-iosevka-ss11 = "04j2y0p2j0zxc2nmmk8m16ham93jm0faymc825zaxj6lmavcygzv";
+  sgr-iosevka-ss12 = "1l3rv9p8k0i1zz9gm0gffz3qfzak13ay48b3vx8mmxgd4w6b8q8r";
+  sgr-iosevka-ss13 = "19m9hfc236ncp7b7cchm9b315px4cynmhby7pzww9czdjvii8ph3";
+  sgr-iosevka-ss14 = "1im0dhlb113kgwq6cba9r14i6m1l60sziddj37bxf4b4qsqcrjkn";
+  sgr-iosevka-ss15 = "0jv3gkm9yw7gzrs67m5vnxr7dg99ysnkl09wv1y855r5gx93w0gg";
+  sgr-iosevka-ss16 = "1qmwxgw837gqnzf0klq0malfpkg4my3czz50n7rv806x7sn0zsg5";
+  sgr-iosevka-ss17 = "161cjfnwm7wcq3vywrn381mps2cd51506b437rpspj8a9xg6dq9w";
+  sgr-iosevka-ss18 = "0f4bij7q5mxbwsakqyw879dlwlw6irzk57ryjklqrg2p4zvjll5s";
+  sgr-iosevka-term = "1m861kjnk6z7723cjz3gxzfjzqah15r55f6s5plsqipb77pbhh5a";
+  sgr-iosevka-term-curly = "07l3zqww2hfw9bipv7ckr59gg38krk925bjxyp51s1fcxn38p3j3";
+  sgr-iosevka-term-curly-slab = "1zqyyk33fcz5r73hd5ifg4nbm79jbvzqr2z58jsd8jmamgxbl6fc";
+  sgr-iosevka-term-slab = "0cd9ca9iivicwj7vyj3y4vvpix9xn1hl65hb2bvwqh8bqmhxdqg7";
+  sgr-iosevka-term-ss01 = "01nx6pckjlhm5lzrfwxzvvgq8hjhqha7y0p3vn1f42qcplsgvcf4";
+  sgr-iosevka-term-ss02 = "0qcgx90v0s8472ql99q9165pc27r0xmrkb0fkc0ad0pg2jrdxibh";
+  sgr-iosevka-term-ss03 = "1mcw5mbnazx1sma4i4zqsag110zll4m3by59i8gpf7wxlql5lw6j";
+  sgr-iosevka-term-ss04 = "17ywb2mgkm7qzjicdkp811q7k36xy6zba33ccp4v9x1i17w13kf7";
+  sgr-iosevka-term-ss05 = "0nfnjlyx0avh0vmxxhb8pimy6s1lmzky8vys6hzmivr5q8m3b7g4";
+  sgr-iosevka-term-ss06 = "1aq0khld8qpdhgqnasrwrf0kwijjw7b8gkliirpw4jnksyx0kllz";
+  sgr-iosevka-term-ss07 = "0vbz95341hmfni82bysrvsw6n30fcbm9j6ac7as824vkxa5lswp8";
+  sgr-iosevka-term-ss08 = "0sq4ln16p3g8bbn01a32wi585lbahg4snmfaypbwnxr4gci7jfy3";
+  sgr-iosevka-term-ss09 = "1ys24c2gwrizdkrglcns9x5sqgi4z810c8ssqzp6p8n9ldw8q36g";
+  sgr-iosevka-term-ss10 = "16v8klsa8xbwlkx60di96c48f7gxnislikrdl7rz222b3pwl6p2j";
+  sgr-iosevka-term-ss11 = "1bayyybq3xnrx4sd0pfh18zzwfal5va2j4ykv4vd680pkr7wm3rv";
+  sgr-iosevka-term-ss12 = "02280qik2msr9r32pz49sk421fy11vjmay4ic5zfm2rjhvvckvpm";
+  sgr-iosevka-term-ss13 = "0h6pi0qbfh35bzpfcgvm14hbvc13ja5pakrwz6nbg4llrghhwg4y";
+  sgr-iosevka-term-ss14 = "1yxdbx3y7j21p76mnwwzxknvssw25ymwckcxyjk86c2dq9yjk8id";
+  sgr-iosevka-term-ss15 = "1bkcrx9jmq4wbl548hvdqh4ks4s3m446x5990n49s7n0q9qqv4fr";
+  sgr-iosevka-term-ss16 = "0p5486bd155whlg9frm8dzrx2p2gs2cz9qjgviva5ldci3w9qhj5";
+  sgr-iosevka-term-ss17 = "1wx8gsg8ginqzx91pmddh55nviv070czyyphcl1micwfgwicjs1d";
+  sgr-iosevka-term-ss18 = "1wr60w8rnlczdvpq26av27qg8r4abn5jssjrdk7ccl5l84hirrn7";
 }
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@ -9,7 +9,9 @@
 , cjs
 , clutter
 , fetchFromGitHub
+, fetchpatch
 , gdk-pixbuf
+, gettext
 , libgnomekbd
 , glib
 , gobject-introspection
@ -53,18 +55,31 @@

 stdenv.mkDerivation rec {
  pname = "cinnamon-common";
-  version = "5.4.9";
+  version = "5.4.10";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "cinnamon";
    rev = version;
-    hash = "sha256-nM87NO/dwOd+hN5/3zX7XUjyKvXh4uDhLcGFcKE9ccA=";
+    hash = "sha256-yNjFP32+0LXqHfJUxm1A+CTuwny5/IxxT08689f7VlE=";
  };

  patches = [
    ./use-sane-install-dir.patch
    ./libdir.patch
+    # Re-add libsoup 2.4 as dependency - needed by some applets.
+    # Can be removed on next update.
+    (fetchpatch {
+      url = "https://github.com/linuxmint/cinnamon/commit/76224fe409d074f8a44c70e4fd5e1289f92800b9.patch";
+      sha256 = "sha256-nDt4kkK1kVstxbij63XxTJ2L/TM9Q1P6feok3xlPQOM=";
+    })
+    # keybindings.js: Use bindings.get().
+    # Can be removed on next update.
+    # https://github.com/linuxmint/cinnamon/issues/11055
+    (fetchpatch {
+      url = "https://github.com/linuxmint/cinnamon/commit/7724e4146baf8431bc1fb55dce60984e77adef5a.patch";
+      sha256 = "sha256-idGtkBa13nmoEprtmAr6OssO16wJwBd16r2ZbbhrYDQ=";
+    })
  ];

  buildInputs = [
@ -95,7 +110,7 @@ stdenv.mkDerivation rec {
    gsound
    gtk3
    json-glib
-    libsoup
+    libsoup # referenced in js/ui/environment.js
    libstartup_notification
    libXtst
    libXdamage
@ -164,6 +179,8 @@ stdenv.mkDerivation rec {
    sed "s| cinnamon-session| ${cinnamon-session}/bin/cinnamon-session|g" -i ./files/usr/bin/cinnamon-session-cinnamon  -i ./files/usr/bin/cinnamon-session-cinnamon2d
    sed "s|/usr/bin|$out/bin|g" -i ./files/usr/share/xsessions/cinnamon.desktop ./files/usr/share/xsessions/cinnamon2d.desktop

+    sed "s|msgfmt|${gettext}/bin/msgfmt|g" -i ./files/usr/share/cinnamon/cinnamon-settings/bin/Spices.py
+
    patchShebangs src/data-to-c.pl
  '';

--- a/pkgs/desktops/cinnamon/nemo/default.nix
+++ b/pkgs/desktops/cinnamon/nemo/default.nix
@ -23,7 +23,7 @@

 stdenv.mkDerivation rec {
  pname = "nemo";
-  version = "5.4.2";
+  version = "5.4.3";

  # TODO: add plugins support (see https://github.com/NixOS/nixpkgs/issues/78327)

@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Xn9CgGe7j2APaJRLvx58z2w+sN7ZeDScQz53ZBBnsQs=";
+    sha256 = "sha256-f3rO0lpOcwpSpIpKrslf6/6nqFbbGTwnKbHpWO+Uf+Q=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/desktops/cinnamon/xreader/default.nix
+++ b/pkgs/desktops/cinnamon/xreader/default.nix
@ -26,13 +26,13 @@

 stdenv.mkDerivation rec {
  pname = "xreader";
-  version = "3.4.3";
+  version = "3.4.4";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "sha256-GkJo/wc5StyeQv0pv5XK0Qy3o8EGpfPYY8gOMq0Afgs=";
+    sha256 = "sha256-uYnQE1GjkUxYlvXSJNmvr6q4OdvAWgv8HqTXk0KkRQM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/embree/default.nix
+++ b/pkgs/development/libraries/embree/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "embree";
-  version = "3.13.3";
+  version = "3.13.4";

  src = fetchFromGitHub {
    owner = "embree";
    repo = "embree";
    rev = "v${version}";
-    sha256 = "sha256-g6BsXMNUvx17hgAq0PewtBLgtWqpp03M0k6vWNapDKs=";
+    sha256 = "sha256-WmblxU1kHiC8+hYAfUDcbJ1/e80f1LcKX8qCwgaBwGc=";
  };

  postPatch = ''
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -175,7 +175,7 @@
 , "insect"
 , "intelephense"
 , "ionic"
-, {"iosevka": "https://github.com/be5invis/Iosevka/archive/v15.5.2.tar.gz"}
+, {"iosevka": "https://github.com/be5invis/Iosevka/archive/v15.6.3.tar.gz"}
 , "jake"
 , "javascript-typescript-langserver"
 , "joplin"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@ -1,6 +1,6 @@
 # This file has been generated by node2nix 1.11.1. Do not edit!

-{nodeEnv, fetchurl, fetchgit, nix-gitignore, stdenv, lib, globalBuildInputs ? []}:
+{ nodeEnv, fetchurl, fetchgit, nix-gitignore, stdenv, lib, globalBuildInputs ? [ ] }:

 let
  sources = {
@ -91168,8 +91168,7 @@ in
      sources."yauzl-2.10.0"
    ];
    buildInputs = globalBuildInputs;
-    meta = {
-    };
+    meta = { };
    production = true;
    bypassCache = true;
    reconstructLock = true;
@ -95916,8 +95915,7 @@ in
      })
    ];
    buildInputs = globalBuildInputs;
-    meta = {
-    };
+    meta = { };
    production = true;
    bypassCache = true;
    reconstructLock = true;
@ -106350,14 +106348,14 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-  "iosevka-https://github.com/be5invis/Iosevka/archive/v15.5.2.tar.gz" = nodeEnv.buildNodePackage {
+  "iosevka-https://github.com/be5invis/Iosevka/archive/v15.6.3.tar.gz" = nodeEnv.buildNodePackage {
    name = "iosevka";
    packageName = "iosevka";
-    version = "15.5.2";
+    version = "15.6.3";
    src = fetchurl {
-      name = "iosevka-15.5.2.tar.gz";
-      url = "https://codeload.github.com/be5invis/Iosevka/tar.gz/refs/tags/v15.5.2";
-      sha256 = "41d5fea642aeff7555608f0e6286a9cc0ebd59bfaa49e278d3cfcd3caed29603";
+      name = "iosevka-15.6.3.tar.gz";
+      url = "https://codeload.github.com/be5invis/Iosevka/tar.gz/refs/tags/v15.6.3";
+      sha256 = "sha256-OJAgZaIAgd0kDQakfyONSp4EBj6xCUM3U4wdN9ZFgcc=";
    };
    dependencies = [
      sources."@iarna/toml-2.2.5"
@ -106511,8 +106509,7 @@ in
      sources."yargs-parser-20.2.9"
    ];
    buildInputs = globalBuildInputs;
-    meta = {
-    };
+    meta = { };
    production = true;
    bypassCache = true;
    reconstructLock = true;
@ -123218,8 +123215,7 @@ in
      sources."yocto-queue-0.1.0"
    ];
    buildInputs = globalBuildInputs;
-    meta = {
-    };
+    meta = { };
    production = true;
    bypassCache = true;
    reconstructLock = true;
@ -123345,8 +123341,7 @@ in
      sources."xmlbuilder-0.4.2"
    ];
    buildInputs = globalBuildInputs;
-    meta = {
-    };
+    meta = { };
    production = true;
    bypassCache = true;
    reconstructLock = true;
@ -134729,8 +134724,7 @@ in
      sources."yocto-queue-0.1.0"
    ];
    buildInputs = globalBuildInputs;
-    meta = {
-    };
+    meta = { };
    production = true;
    bypassCache = true;
    reconstructLock = true;
--- a/pkgs/development/python-modules/bluetooth-sensor-state-data/default.nix
+++ b/pkgs/development/python-modules/bluetooth-sensor-state-data/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "bluetooth-sensor-state-data";
-  version = "1.5.0";
+  version = "1.6.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Xr9MCTcEnO5bMk9AdBTwBCXwm33UUTP7FYZyjDYrMNA=";
+    hash = "sha256-Btfya9l1UX7GbiUxuaFHT0l+pG+Dg5X0L2JS+1/VYOo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/django-maintenance-mode/default.nix
+++ b/pkgs/development/python-modules/django-maintenance-mode/default.nix
@ -1,4 +1,10 @@
-{ lib, fetchFromGitHub, buildPythonPackage, pytest, django }:
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, pytest
+, django
+, python-fsutil
+}:

 buildPythonPackage rec {
  pname = "django-maintenance-mode";
@ -8,12 +14,12 @@ buildPythonPackage rec {
    owner = "fabiocaccamo";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-G08xQpLQxnt7JbtIo06z0NlRAMbca3UWbo4aXQR/Wy0=";
+    hash = "sha256-G08xQpLQxnt7JbtIo06z0NlRAMbca3UWbo4aXQR/Wy0=";
  };

  checkInputs = [ pytest ];

-  propagatedBuildInputs = [ django ];
+  propagatedBuildInputs = [ django python-fsutil ];

  meta = with lib; {
    description = "Shows a 503 error page when maintenance-mode is on";
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@ -5,7 +5,6 @@
 , pythonOlder
 , pytestCheckHook
 , atpublic
-, cached-property
 , click
 , clickhouse-cityhash
 , clickhouse-driver
@ -13,10 +12,10 @@
 , datafusion
 , duckdb
 , duckdb-engine
+, filelock
 , geoalchemy2
 , geopandas
 , graphviz-nox
-, importlib-metadata
 , lz4
 , multipledispatch
 , numpy
@ -37,6 +36,7 @@
 , python
 , pytz
 , regex
+, rsync
 , shapely
 , sqlalchemy
 , sqlite
@ -55,14 +55,14 @@ let
  ibisTestingData = fetchFromGitHub {
    owner = "ibis-project";
    repo = "testing-data";
-    rev = "a88a4b3c3b54a88e7f77e59de70f5bf20fb62f19";
-    sha256 = "sha256-BnRhVwPcWFwiBJ2ySgiiuUdnF4gesnTq1/dLcuvc868=";
+    rev = "3c39abfdb4b284140ff481e8f9fbb128b35f157a";
+    sha256 = "sha256-BZWi4kEumZemQeYoAtlUSw922p+R6opSWp/bmX0DjAo=";
  };
 in

 buildPythonPackage rec {
  pname = "ibis-framework";
-  version = "3.0.2";
+  version = "3.1.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -71,14 +71,15 @@ buildPythonPackage rec {
    repo = "ibis";
    owner = "ibis-project";
    rev = version;
-    hash = "sha256-7ywDMAHQAl39kiHfxVkq7voUEKqbb9Zq8qlaug7+ukI=";
+    hash = "sha256-/mQWQLiJa1DRZiyiA6F0/lMyn3wSY1IUwJl2S0IFkvs=";
  };

  patches = [
    (fetchpatch {
-      url = "https://github.com/ibis-project/ibis/commit/a6f64c6c32b49098d39bb205952cbce4bdfea657.patch";
-      sha256 = "sha256-puVMjiJXWk8C9yhuXPD9HKrgUBYcYmUPacQz5YO5xYQ=";
-      includes = [ "pyproject.toml" ];
+      name = "xfail-datafusion-0.4.0";
+      url = "https://github.com/ibis-project/ibis/compare/c162abba4df24e0d531bd2e6a3be3109c16b43b9...6219d6caee19b6fd3171983c49cd8d6872e3564b.patch";
+      hash = "sha256-pCYPntj+TwzqCtYWRf6JF5/tJC4crSXHp0aepRocHck=";
+      excludes = ["poetry.lock"];
    })
  ];

@ -86,8 +87,6 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    atpublic
-    cached-property
-    importlib-metadata
    multipledispatch
    numpy
    packaging
@ -104,14 +103,17 @@ buildPythonPackage rec {
  checkInputs = [
    pytestCheckHook
    click
+    filelock
    pytest-benchmark
    pytest-mock
    pytest-randomly
    pytest-xdist
+    rsync
  ] ++ lib.concatMap (name: passthru.optional-dependencies.${name}) testBackends;

  preBuild = ''
    # setup.py exists only for developer convenience and is automatically generated
+    # it gets in the way in nixpkgs so we remove it
    rm setup.py
  '';

@ -119,6 +121,10 @@ buildPythonPackage rec {
    "--dist=loadgroup"
    "-m"
    "'${lib.concatStringsSep " or " testBackends} or core'"
+    # this test fails on nixpkgs datafusion version (0.4.0), but works on
+    # datafusion 0.6.0
+    "-k"
+    "'not datafusion-no_op'"
  ];

  preCheck = ''
@ -127,16 +133,8 @@ buildPythonPackage rec {
    export IBIS_TEST_DATA_DIRECTORY
    IBIS_TEST_DATA_DIRECTORY="$(mktemp -d)"

-    # copy the test data to a writable directory
-    cp -r ${ibisTestingData}/* "$IBIS_TEST_DATA_DIRECTORY"
-
-    find "$IBIS_TEST_DATA_DIRECTORY" -type d -exec chmod u+rwx {} +
-    find "$IBIS_TEST_DATA_DIRECTORY" -type f -exec chmod u+rw {} +
-
-    # load data
-    for backend in ${lib.concatStringsSep " " testBackends}; do
-      ${python.interpreter} ci/datamgr.py load "$backend"
-    done
+    # copy the test data to a directory
+    rsync --chmod=Du+rwx,Fu+rw --archive "${ibisTestingData}/" "$IBIS_TEST_DATA_DIRECTORY"
  '';

  postCheck = ''
--- a/pkgs/development/python-modules/iminuit/default.nix
+++ b/pkgs/development/python-modules/iminuit/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "iminuit";
-  version = "2.13.0";
+  version = "2.15.2";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-40eFwqLArqb/hmcv6BuAoErJ1Cp57YJJYw8lKaj2oPo=";
+    hash = "sha256-YKx9L+lAXJIGZ1IpJz9AFhHT9d+iKUJUFkbEYltZ8eo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/nix-prefetch-github/default.nix
+++ b/pkgs/development/python-modules/nix-prefetch-github/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "nix-prefetch-github";
-  version = "5.1.2";
+  version = "5.2.1";

  disabled = pythonOlder "3.7";

@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "seppeljordan";
    repo = "nix-prefetch-github";
    rev = "v${version}";
-    sha256 = "GHUH3Oog800qrdgXs5AEa4O6ovZ1LT0k3P4YwEHfwlY=";
+    sha256 = "etmlRavPzJKLmyw3PYMgeMveFj4aVi38crHjdtDuaLg=";
  };

  checkInputs = [ unittestCheckHook git which ];
--- a/pkgs/development/python-modules/sensorpush-ble/default.nix
+++ b/pkgs/development/python-modules/sensorpush-ble/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "sensorpush-ble";
-  version = "1.5.1";
+  version = "1.5.2";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-2Q56fXMgw1Al3l6WKI1cdGXfLmZ1qkidkoWKmvEXRaI=";
+    hash = "sha256-64DywtZwfDFjW8WUzw3ZTT462sBGFgAHGc0bGnKCJpY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/univers/default.nix
+++ b/pkgs/development/python-modules/univers/default.nix
@ -0,0 +1,50 @@
+{ lib
+, fetchPypi
+, fetchpatch
+, buildPythonPackage
+, setuptools-scm
+, attrs
+, packaging
+, pyparsing
+, semantic-version
+, semver
+, commoncode
+, pytestCheckHook
+, saneyaml
+}:
+
+buildPythonPackage rec {
+  pname = "univers";
+  version = "30.7.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-yM0SDBpkiZEbaZ0ugjiMwwUFKqZGbmh1JNlv5qvPAYo=";
+  };
+
+  patches = [
+    # Make tests work when not using virtualenv, can be dropped with the next version
+    # Upstream PR (already merged): https://github.com/nexB/univers/pull/77
+    (fetchpatch {
+      url = "https://github.com/nexB/univers/commit/b74229cc1c8790287633cd7220d6b2e97c508302.patch";
+      sha256 = "sha256-i6zWv9rAlwCMghd9g5FP6WIQLLDLYvp+6qJ1E7nfTSY=";
+    })
+  ];
+
+  nativeBuildInputs = [ setuptools-scm ];
+  propagatedBuildInputs = [ attrs packaging pyparsing semantic-version semver ];
+  checkInputs = [ commoncode pytestCheckHook saneyaml ];
+
+  dontConfigure = true; # ./configure tries to setup virtualenv and downloads dependencies
+
+  disabledTests = [ "test_codestyle" ];
+
+  pythonImportsCheck = [ "univers" ];
+
+  meta = with lib; {
+    description = "Library for parsing version ranges and expressions";
+    homepage = "https://github.com/nexB/univers";
+    license = with licenses; [ asl20 bsd3 mit ];
+    maintainers = with maintainers; [ armijnhemel sbruder ];
+  };
+}
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@ -22,17 +22,16 @@
 }:

 assert (!libsOnly) -> kernel != null;
-assert lib.elem stdenv.hostPlatform.system [ "x86_64-linux" "i686-linux" "aarch64-linux" ];

 stdenv.mkDerivation rec {
-  version = "17.1.4-51567";
+  version = "18.0.0-53049";
  pname = "prl-tools";

  # We download the full distribution to extract prl-tools-lin.iso from
  # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
  src = fetchurl {
    url = "https://download.parallels.com/desktop/v${lib.versions.major version}/${version}/ParallelsDesktop-${version}.dmg";
-    sha256 = "sha256-gjLxQOTFuVghv1Bj+zfbNW97q1IN2rurSnPQi13gzRA=";
+    sha256 = "sha256-MGiqCvOsu/sKz6JHJFGP5bT12XYnm2kTMdOiflg9ses=";
  };

  hardeningDisable = [ "pic" "format" ];
@ -56,9 +55,6 @@ stdenv.mkDerivation rec {
    fi
  '';

-  patches = lib.optional (lib.versionAtLeast kernel.version "5.18") ./prl-tools-5.18.patch
-    ++ lib.optional (lib.versionAtLeast kernel.version "5.19") ./prl-tools-5.19.patch;
-
  kernelVersion = lib.optionalString (!libsOnly) kernel.modDirVersion;
  kernelDir = lib.optionalString (!libsOnly) "${kernel.dev}/lib/modules/${kernelVersion}";

--- a/pkgs/os-specific/linux/prl-tools/prl-tools-5.18.patch
+++ b/pkgs/os-specific/linux/prl-tools/prl-tools-5.18.patch
@ -1,143 +0,0 @@
-diff -puNr prl-tools-build/kmods/prl_tg/Toolgate/Guest/Linux/prl_tg/prltg.c prl-tools-build/kmods/prl_tg/Toolgate/Guest/Linux/prl_tg/prltg.c
--- prl-tools-build/kmods/prl_tg/Toolgate/Guest/Linux/prl_tg/prltg.c
-+++ prl-tools-build/kmods/prl_tg/Toolgate/Guest/Linux/prl_tg/prltg.c
-@@ -382,7 +382,7 @@ static int prl_tg_initialize(struct tg_d
- 	}
- #endif
- 	/* Set DMA ability. Only lower 4G is possible to address */
-	rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
-+	rc = dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
- 	if (rc) {
- 		printk(KERN_ERR "no usable DMA configuration\n");
- 		goto err_out;
-diff -puNr prl-tools-build/kmods/prl_tg/Toolgate/Guest/Linux/prl_tg/prltg_call.c prl-tools-build/kmods/prl_tg/Toolgate/Guest/Linux/prl_tg/prltg_call.c
--- prl-tools-build/kmods/prl_tg/Toolgate/Guest/Linux/prl_tg/prltg_call.c
-+++ prl-tools-build/kmods/prl_tg/Toolgate/Guest/Linux/prl_tg/prltg_call.c
-@@ -76,7 +76,7 @@ static int tg_req_map_internal(struct TG
- 		uple->p[i] = vmalloc_to_page(mem);
- 		page_cache_get(uple->p[i]);
- 
-		dst->RequestPages[i] = pci_map_page(pdev, uple->p[i], 0, PAGE_SIZE, DMA_BIDIRECTIONAL) >> PAGE_SHIFT;
-+		dst->RequestPages[i] = dma_map_page(&pdev->dev, uple->p[i], 0, PAGE_SIZE, DMA_BIDIRECTIONAL) >> PAGE_SHIFT;
- 		if (!dst->RequestPages[i]) {
- 			page_cache_release(uple->p[i]);
- 			goto err;
-@@ -88,7 +88,7 @@ static int tg_req_map_internal(struct TG
- 
- err:
- 	for (i = 0; i < uple->count; i++) {
-		pci_unmap_page(pdev, dst->RequestPages[i] << PAGE_SHIFT, PAGE_SIZE, DMA_BIDIRECTIONAL);
-+		dma_unmap_page(&pdev->dev, dst->RequestPages[i] << PAGE_SHIFT, PAGE_SIZE, DMA_BIDIRECTIONAL);
- 		page_cache_release(uple->p[i]);
- 	}
- 	kfree(uple);
-@@ -129,7 +129,7 @@ static TG_PAGED_BUFFER *tg_req_map_user_
- 	pfn = (u64 *)dbuf - 1;
- 
- 	for (; npages > 0; npages--, mapped++) {
-		dma_addr_t addr = pci_map_page(pdev, uple->p[npages-1], 0, PAGE_SIZE, DMA_BIDIRECTIONAL);
-+		dma_addr_t addr = dma_map_page(&pdev->dev, uple->p[npages-1], 0, PAGE_SIZE, DMA_BIDIRECTIONAL);
- 
- 		if (!addr) {
- 			DPRINTK("[3] %d < %d	\n", got, npages);
-@@ -144,7 +144,7 @@ static TG_PAGED_BUFFER *tg_req_map_user_
- 
- err_unmap:
- 	for (i = 0; i < mapped; i++, pfn++)
-		pci_unmap_page(pdev, *pfn << PAGE_SHIFT, PAGE_SIZE, DMA_BIDIRECTIONAL);
-+		dma_unmap_page(&pdev->dev, *pfn << PAGE_SHIFT, PAGE_SIZE, DMA_BIDIRECTIONAL);
- 
- err_put:
- 	for(i = 0; i < got; i++)
-@@ -176,7 +176,7 @@ static TG_PAGED_BUFFER *tg_req_map_kerne
- 			goto err;
- 		}
- 
-		addr = pci_map_page(pdev, page, 0, PAGE_SIZE, DMA_BIDIRECTIONAL);
-+		addr = dma_map_page(&pdev->dev, page, 0, PAGE_SIZE, DMA_BIDIRECTIONAL);
- 		if (!addr) {
- 			DPRINTK("[2] va:%p can't map\n", buffer);
- 			goto err;
-@@ -189,7 +189,7 @@ static TG_PAGED_BUFFER *tg_req_map_kerne
- 
- err:
- 	for (; i > 0; i--, pfn--)
-		pci_unmap_page(pdev, *pfn << PAGE_SHIFT, PAGE_SIZE, DMA_BIDIRECTIONAL);
-+		dma_unmap_page(&pdev->dev, *pfn << PAGE_SHIFT, PAGE_SIZE, DMA_BIDIRECTIONAL);
- 
- 	return ERR_PTR(-ENOMEM);
- }
-@@ -203,7 +203,7 @@ static inline int tg_req_unmap_internal(
- 			dst->RequestSize + ~PAGE_MASK) >> PAGE_SHIFT;
- 
- 	for (i = 0; i < count; i++)
-		pci_unmap_page(req->dev->pci_dev, dst->RequestPages[i] << PAGE_SHIFT, PAGE_SIZE, DMA_BIDIRECTIONAL);
-+		dma_unmap_page(&req->dev->pci_dev->dev, dst->RequestPages[i] << PAGE_SHIFT, PAGE_SIZE, DMA_BIDIRECTIONAL);
- 
- 	return count;
- }
-@@ -264,7 +264,7 @@ static void tg_req_unmap_pages(struct TG
- 
- 		pfn = (u64 *)(dbuf + 1);
- 		for (; npages > 0; npages--, pfn++)
-			pci_unmap_page(pdev, (*pfn) << PAGE_SHIFT, PAGE_SIZE, DMA_BIDIRECTIONAL);
-+			dma_unmap_page(&pdev->dev, (*pfn) << PAGE_SHIFT, PAGE_SIZE, DMA_BIDIRECTIONAL);
- 
- 		dbuf = (TG_PAGED_BUFFER *)pfn;
- 	}
-@@ -374,7 +374,7 @@ static int tg_req_submit(struct TG_PENDI
- 	 * also no any offset inside page needed.
- 	 */
- 	req->pg = vmalloc_to_page(dst);
-	req->phys = pci_map_page(dev->pci_dev, vmalloc_to_page(dst), 0, PAGE_SIZE, DMA_BIDIRECTIONAL);
-+	req->phys = dma_map_page(&dev->pci_dev->dev, vmalloc_to_page(dst), 0, PAGE_SIZE, DMA_BIDIRECTIONAL);
- 	if (!req->phys) {
- 		DPRINTK("Can not allocate memory for DMA mapping\n");
- 		goto out;
-@@ -405,7 +405,7 @@ static int tg_req_submit(struct TG_PENDI
- out:
- 	if (ret != TG_STATUS_PENDING) {
- 		page_cache_release(req->pg);
-		pci_unmap_page(dev->pci_dev, req->phys, PAGE_SIZE, DMA_BIDIRECTIONAL);
-+		dma_unmap_page(&dev->pci_dev->dev, req->phys, PAGE_SIZE, DMA_BIDIRECTIONAL);
- 	}
- 
- 	DPRINTK("EXIT\n");
-@@ -460,7 +460,7 @@ out_wait:
- 	wait_for_completion(&req->waiting);
- out:
- 	page_cache_release(req->pg);
-	pci_unmap_page(dev->pci_dev, req->phys, PAGE_SIZE, DMA_BIDIRECTIONAL);
-+	dma_unmap_page(&dev->pci_dev->dev, req->phys, PAGE_SIZE, DMA_BIDIRECTIONAL);
- 	DPRINTK("EXIT\n");
- 	return ret;
- }
-diff -puNr prl-tools-build/kmods/prl_fs/SharedFolders/Guest/Linux/prl_fs/inode.c prl-tools-build/kmods/prl_fs/SharedFolders/Guest/Linux/prl_fs/inode.c
--- prl-tools-build/kmods/prl_fs/SharedFolders/Guest/Linux/prl_fs/inode.c
-+++ prl-tools-build/kmods/prl_fs/SharedFolders/Guest/Linux/prl_fs/inode.c
-@@ -16,6 +16,7 @@
- #include <linux/pagemap.h>
- #include <linux/namei.h>
- #include <linux/cred.h>
-+#include <linux/writeback.h>
- 
- #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 40)) && \
-     (LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0))
-@@ -57,7 +58,7 @@ unsigned long *prlfs_dfl( struct dentry
- }
- 
- #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0)
-#define prl_uaccess_kernel() uaccess_kernel()
-+#define prl_uaccess_kernel() (false)
- #else
- #define prl_uaccess_kernel() segment_eq(get_fs(), KERNEL_DS)
- #endif
-@@ -954,7 +955,7 @@ static const struct address_space_operat
- 	.writepage		= prlfs_writepage,
- 	.write_begin    = simple_write_begin,
- 	.write_end      = prlfs_write_end,
-	.set_page_dirty = __set_page_dirty_nobuffers,
-+	.dirty_folio    = filemap_dirty_folio,
- };
- 
- 
--- a/pkgs/os-specific/linux/prl-tools/prl-tools-5.19.patch
+++ b/pkgs/os-specific/linux/prl-tools/prl-tools-5.19.patch
@ -1,29 +0,0 @@
-diff -puNr prl-tools-build/kmods/prl_fs/SharedFolders/Guest/Linux/prl_fs/inode.c prl-tools-build/kmods/prl_fs/SharedFolders/Guest/Linux/prl_fs/inode.c
--- prl-tools-build/kmods/prl_fs/SharedFolders/Guest/Linux/prl_fs/inode.c
-+++ prl-tools-build/kmods/prl_fs/SharedFolders/Guest/Linux/prl_fs/inode.c
-@@ -851,7 +851,7 @@ ssize_t prlfs_rw(struct inode *inode, char *buf, size_t size,
- 		                loff_t *off, unsigned int rw, int user, int flags);
- 
- 
-int prlfs_readpage(struct file *file, struct page *page) {
-+int prlfs_read_folio(struct file *file, struct folio *folio) {
- 	char *buf;
- 	ssize_t ret;
- #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
-@@ -859,6 +859,7 @@ int prlfs_readpage(struct file *file, struct page *page) {
- #else
- 	struct inode *inode = file->f_dentry->d_inode;
- #endif
-+	struct page *page = &folio->page;
- 	loff_t off = page->index << PAGE_SHIFT;
- 
- 	if (!file) {
-@@ -950,7 +951,7 @@ out:
- }
- 
- static const struct address_space_operations prlfs_aops = {
-	.readpage		= prlfs_readpage,
-+	.read_folio		= prlfs_read_folio,
- 	.writepage		= prlfs_writepage,
- 	.write_begin    = simple_write_begin,
- 	.write_end      = prlfs_write_end,
--- a/pkgs/servers/dex/default.nix
+++ b/pkgs/servers/dex/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dex";
-  version = "2.32.0";
+  version = "2.33.0";

  src = fetchFromGitHub {
    owner = "dexidp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-7nuolUA4U99o+bM/pwwd2Q4GPpyxu8TpYRKkCK+b1aI=";
+    sha256 = "sha256-sl/OdwSkN4uEtuIyYtR5xjxy1z7B6rmG2Cf7xWz0Kp0=";
  };

-  vendorSha256 = "sha256-LXZ/QL2+Ty9oq4BXXWceO3+uyY1EOeU5jqVcakSaE94=";
+  vendorSha256 = "sha256-9zjQBgAuphtvpbs9kzFmrgto6KvNh1N4GdRDk3wIBGY=";

  subPackages = [
    "cmd/dex"
--- a/pkgs/servers/headscale/default.nix
+++ b/pkgs/servers/headscale/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "headscale";
-  version = "0.16.1";
+  version = "0.16.2";

  src = fetchFromGitHub {
    owner = "juanfont";
    repo = "headscale";
    rev = "v${version}";
-    sha256 = "sha256-uQpvIWK80+s/aFJQZGdSSrWsCwjvbpK9jLdmcFMAeLw=";
+    sha256 = "sha256-RgRRBz9i12mavzCBtZN8QLlIjMjG7GfkGMRJGKMJosw=";
  };

  vendorSha256 = "sha256-RzmnAh81BN4tbzAGzJbb6CMuws8kuPJDw7aPkRRnSS8=";
--- a/pkgs/servers/monitoring/prometheus/pihole-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/pihole-exporter.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pihole-exporter";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "eko";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-JxznxE4Pq1fhlt3l1jbGWD5eUg5VF0GmewkuSYECG0Y=";
+    sha256 = "sha256-LtiJpXucD9Ok1tFFCQ5/V6FhYxbgBWDPF6S49FzWPes=";
  };

-  vendorSha256 = "sha256-jfpM192LtFGVgsVv+F+P8avTGD5c8I+7JFsn4oVoqr0=";
+  vendorSha256 = "sha256-GCHCWnP3YPC1Dg8Tu0GF5ITDMVRoBv28QVpk6JGN5nQ=";

  meta = with lib; {
    description = "Prometheus exporter for PI-Hole's Raspberry PI ad blocker";
--- a/pkgs/shells/fish/plugins/fzf-fish.nix
+++ b/pkgs/shells/fish/plugins/fzf-fish.nix
@ -2,13 +2,13 @@

 buildFishPlugin rec {
  pname = "fzf.fish";
-  version = "9.0";
+  version = "9.2";

  src = fetchFromGitHub {
    owner = "PatrickF1";
    repo = "fzf.fish";
    rev = "v${version}";
-    sha256 = "sha256-0rnd8oJzLw8x/U7OLqoOMQpK81gRc7DTxZRSHxN9YlM=";
+    sha256 = "sha256-XmRGe39O3xXmTvfawwT2mCwLIyXOlQm7f40mH5tzz+s=";
  };

  checkInputs = [ fzf fd util-linux ];
--- a/pkgs/tools/graphics/mangohud/default.nix
+++ b/pkgs/tools/graphics/mangohud/default.nix
@ -25,7 +25,6 @@
 , vulkan-loader
 , libXNVCtrl
 , wayland
-, spdlog
 , glew
 , glfw
 , nlohmann_json
@ -49,6 +48,27 @@ let
      sha256 = "sha256-bQC0QmkLalxdj4mDEdqvvOFtNwz2T1MpTDuMXGYeQ18=";
    };
  };
+
+  # Derived from subprojects/spdlog.wrap
+  #
+  # NOTE: We only statically link spdlog due to a bug in pressure-vessel:
+  # https://github.com/ValveSoftware/steam-runtime/issues/511
+  #
+  # Once this fix is released upstream, we should switch back to using
+  # the system provided spdlog
+  spdlog = rec {
+    version = "1.8.5";
+    src = fetchFromGitHub {
+      owner = "gabime";
+      repo = "spdlog";
+      rev = "refs/tags/v${version}";
+      sha256 = "sha256-D29jvDZQhPscaOHlrzGN1s7/mXlcsovjbqYpXd7OM50=";
+    };
+    patch = fetchurl {
+      url = "https://wrapdb.mesonbuild.com/v2/spdlog_${version}-1/get_patch";
+      sha256 = "sha256-PDjyddV5KxKGORECWUMp6YsXc3kks0T5gxKrCZKbdL4=";
+    };
+  };
 in stdenv.mkDerivation rec {
  pname = "mangohud";
  version = "0.6.8";
@ -67,7 +87,7 @@ in stdenv.mkDerivation rec {
  postUnpack = ''(
    cd "$sourceRoot/subprojects"
    cp -R --no-preserve=mode,ownership ${imgui.src} imgui-${imgui.version}
-    unzip ${imgui.patch}
+    cp -R --no-preserve=mode,ownership ${spdlog.src} spdlog-${spdlog.version}
  )'';

  patches = [
@ -102,11 +122,16 @@ in stdenv.mkDerivation rec {
    })
  ];

+  postPatch = ''(
+    cd subprojects
+    unzip ${imgui.patch}
+    unzip ${spdlog.patch}
+  )'';
+
  mesonFlags = [
    "-Duse_system_vulkan=enabled"
    "-Dvulkan_datadir=${vulkan-headers}/share"
    "-Dwith_wayland=enabled"
-    "-Duse_system_spdlog=enabled"
  ] ++ lib.optionals gamescopeSupport [
    "-Dmangoapp_layer=true"
    "-Dmangoapp=true"
@ -130,7 +155,6 @@ in stdenv.mkDerivation rec {
    libX11
    libXNVCtrl
    wayland
-    spdlog
  ] ++ lib.optionals gamescopeSupport [
    glew
    glfw
--- a/pkgs/tools/misc/calamares/default.nix
+++ b/pkgs/tools/misc/calamares/default.nix
@ -7,12 +7,12 @@

 mkDerivation rec {
  pname = "calamares";
-  version = "3.2.59";
+  version = "3.2.60";

  # release including submodule
  src = fetchurl {
    url = "https://github.com/calamares/calamares/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "55adef250613e80a868f2aa3d1e57bdae5b769387d91decf0fe2b64e3605574f";
+    sha256 = "sha256-nsbEn04jFs0wWNQCwqtl7/8C4/CaACjVDwNZ5RVObIw=";
  };

  patches = lib.optionals nixos-extensions [
--- a/pkgs/tools/misc/yubikey-personalization-gui/default.nix
+++ b/pkgs/tools/misc/yubikey-personalization-gui/default.nix
@ -19,9 +19,9 @@ mkDerivation rec {

    # Desktop files
    install -D -m0644 resources/lin/yubikey-personalization-gui.desktop "$out/share/applications/yubikey-personalization-gui.desktop"
-    install -D -m0644 resources/lin/yubikey-personalization-gui.desktop "$out/share/pixmaps/yubikey-personalization-gui.xpm"

    # Icons
+    install -D -m0644 resources/lin/yubikey-personalization-gui.xpm "$out/share/pixmaps/yubikey-personalization-gui.xpm"
    install -D -m0644 resources/lin/yubikey-personalization-gui.png "$out/share/icons/hicolor/128x128/apps/yubikey-personalization-gui.png"
    for SIZE in 16 24 32 48 64 96; do
      # set modify/create for reproducible builds
--- a/pkgs/tools/networking/globalprotect-openconnect/default.nix
+++ b/pkgs/tools/networking/globalprotect-openconnect/default.nix
@ -21,10 +21,6 @@ stdenv.mkDerivation rec {
  patchPhase = ''
    substituteInPlace GPService/gpservice.h \
      --replace /usr/local/bin/openconnect ${openconnect}/bin/openconnect;
-    substituteInPlace GPClient/settingsdialog.ui \
-      --replace /etc/gpservice/gp.conf $out/etc/gpservice/gp.conf;
-    substituteInPlace GPService/gpservice.cpp \
-      --replace /etc/gpservice/gp.conf $out/etc/gpservice/gp.conf;
    substituteInPlace GPService/CMakeLists.txt \
      --replace /etc/gpservice $out/etc/gpservice;
  '';
--- a/pkgs/tools/security/duo-unix/default.nix
+++ b/pkgs/tools/security/duo-unix/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "duo-unix";
-  version = "1.12.0";
+  version = "1.12.1";

  src = fetchurl {
    url    = "https://dl.duosecurity.com/duo_unix-${version}.tar.gz";
-    sha256 = "sha256-i7oAmNjXkGn1MCn5EBmidMY/u3h/rzRAHCD4uhVGV/Q=";
+    sha256 = "sha256-oufVgjJHV4ew50gd529b3MvVtBoebcDUGZUn0rHP4ZE=";
  };

  buildInputs = [ pam openssl zlib ];
--- a/pkgs/tools/security/ioccheck/default.nix
+++ b/pkgs/tools/security/ioccheck/default.nix
@ -74,7 +74,8 @@ buildPythonApplication rec {
    # Can be removed with the next release
    substituteInPlace pyproject.toml \
      --replace '"hurry.filesize" = "^0.9"' "" \
-      --replace 'vt-py = ">=0.6.1,<0.8.0"' 'vt-py = ">=0.6.1"'
+      --replace 'vt-py = ">=0.6.1,<0.8.0"' 'vt-py = ">=0.6.1"' \
+      --replace 'backoff = "^1.10.0"' 'backoff = ">=1.10.0"'
  '';

  pythonImportsCheck = [
--- a/pkgs/tools/security/maigret/default.nix
+++ b/pkgs/tools/security/maigret/default.nix
@ -63,12 +63,17 @@ python3.pkgs.buildPythonApplication rec {
  postPatch = ''
    # Remove all version pinning
    sed -i -e "s/==[0-9.]*//" requirements.txt
+
    # We are not build for Python < 3.7
-    sed -i -e '/future-annotations/d' requirements.txt
-    # We can't work with dummy packages
-    sed -i -e 's/bs4/beautifulsoup4/g' requirements.txt
+    substituteInPlace requirements.txt \
+      --replace "future-annotations" ""
  '';

+  pytestFlagsArray = [
+    # DeprecationWarning: There is no current event loop
+    "-W ignore::DeprecationWarning"
+  ];
+
  disabledTests = [
    # Tests require network access
    "test_extract_ids_from_page"
--- a/pkgs/tools/text/mark/default.nix
+++ b/pkgs/tools/text/mark/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "mark";
-  version = "8.0";
+  version = "8.3";

  src = fetchFromGitHub {
    owner  = "kovetskiy";
    repo   = "mark";
    rev    = version;
-    sha256 = "sha256-1cJt/+OClc7YxSy9kGLQrREckjDvMIBdzet9SJGPb84=";
+    sha256 = "sha256-HU7kPzcRhptMGuqsrHOTT3yZ9ALQGBK/cYZ8KbIO0RU=";
  };

-  vendorSha256 = "sha256-a+pWSt24+aNABcLhiiFy+g/imBQtiqliAAWWkjPolxU=";
+  vendorSha256 = "sha256-Q628lMGV/Ys8BC5zMq3xXgmj74NYHQmP0IrMU5gyyMw=";

  ldflags = [ "-s" "-w" "-X main.version=${version}" ];

--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1648,6 +1648,7 @@ mapAliases ({
  torchat = throw "torchat was removed because it was broken and requires Python 2"; # added 2022-06-05
  ttyrec = ovh-ttyrec; # Added 2021-01-02
  zplugin = zinit; # Added 2021-01-30
+  zyn-fusion = zynaddsubfx; # Added 2022-08-05

  inherit (stdenv.hostPlatform) system; # Added 2021-10-22

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -31937,20 +31937,19 @@ with pkgs;

  inherit (nodePackages) zx;

-  zynaddsubfx = zyn-fusion;
+  zynaddsubfx = callPackage ../applications/audio/zynaddsubfx {
+    guiModule = "zest";
+    fftw = fftwSinglePrec;
+  };

-  zynaddsubfx-fltk = callPackage ../applications/audio/zynaddsubfx {
+  zynaddsubfx-fltk = zynaddsubfx.override {
    guiModule = "fltk";
  };

-  zynaddsubfx-ntk = callPackage ../applications/audio/zynaddsubfx {
+  zynaddsubfx-ntk = zynaddsubfx.override {
    guiModule = "ntk";
  };

-  zyn-fusion = callPackage ../applications/audio/zynaddsubfx {
-    guiModule = "zest";
-  };
-
  ### BLOCKCHAINS / CRYPTOCURRENCIES / WALLETS

  aeon = callPackage ../applications/blockchains/aeon {
@ -34482,6 +34481,8 @@ with pkgs;

  openroad = libsForQt5.callPackage ../applications/science/electronics/openroad { };

+  openboardview = callPackage ../applications/science/electronics/openboardview { };
+
  pcb = callPackage ../applications/science/electronics/pcb { };

  qucs = callPackage ../applications/science/electronics/qucs { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -11153,6 +11153,8 @@ in {

  unittest-xml-reporting = callPackage ../development/python-modules/unittest-xml-reporting { };

+  univers = callPackage ../development/python-modules/univers { };
+
  unpaddedbase64 = callPackage ../development/python-modules/unpaddedbase64 { };

  unrardll = callPackage ../development/python-modules/unrardll { };