Merge staging-next into staging

2023-02-21 12:02:07 +00:00 · 2023-02-21 12:02:07 +00:00 · 8d3dc41d38
commit 8d3dc41d38
parent 9cc5599dfe a160ec1116
34 changed files with 1420 additions and 818 deletions
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -40,6 +40,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [goeland](https://github.com/slurdge/goeland), an alternative to rss2email written in golang with many filters. Available as [services.goeland](#opt-services.goeland.enable).

+- [tts](https://github.com/coqui-ai/TTS), a battle-tested deep learning toolkit for Text-to-Speech. Mutiple servers may be configured below [services.tts.servers](#opt-services.tts.servers).
+
 - [atuin](https://github.com/ellie/atuin), a sync server for shell history. Available as [services.atuin](#opt-services.atuin.enable).

 - [networkd-dispatcher](https://gitlab.com/craftyguy/networkd-dispatcher), a dispatcher service for systemd-networkd connection status changes. Available as [services.networkd-dispatcher](#opt-services.networkd-dispatcher.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -314,6 +314,7 @@
  ./services/audio/snapserver.nix
  ./services/audio/spotifyd.nix
  ./services/audio/squeezelite.nix
+  ./services/audio/tts.nix
  ./services/audio/ympd.nix
  ./services/backup/automysqlbackup.nix
  ./services/backup/bacula.nix
--- a/nixos/modules/programs/flashrom.nix
+++ b/nixos/modules/programs/flashrom.nix
@ -22,6 +22,5 @@ in
  config = mkIf cfg.enable {
    services.udev.packages = [ cfg.package ];
    environment.systemPackages = [ cfg.package ];
-    users.groups.flashrom = { };
  };
 }
--- a/nixos/modules/services/audio/tts.nix
+++ b/nixos/modules/services/audio/tts.nix
@ -0,0 +1,151 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+let
+  cfg = config.services.tts;
+in
+
+{
+  options.services.tts = let
+    inherit (lib) literalExpression mkOption mdDoc mkEnableOption types;
+  in  {
+    servers = mkOption {
+      type = types.attrsOf (types.submodule (
+        { ... }: {
+          options = {
+            enable = mkEnableOption (mdDoc "Coqui TTS server");
+
+            port = mkOption {
+              type = types.port;
+              example = 5000;
+              description = mdDoc ''
+                Port to bind the TTS server to.
+              '';
+            };
+
+            model = mkOption {
+              type = types.nullOr types.str;
+              default = "tts_models/en/ljspeech/tacotron2-DDC";
+              example = null;
+              description = mdDoc ''
+                Name of the model to download and use for speech synthesis.
+
+                Check `tts-server --list_models` for possible values.
+
+                Set to `null` to use a custom model.
+              '';
+            };
+
+            useCuda = mkOption {
+              type = types.bool;
+              default = false;
+              example = true;
+              description = mdDoc ''
+                Whether to offload computation onto a CUDA compatible GPU.
+              '';
+            };
+
+            extraArgs = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              description = mdDoc ''
+                Extra arguments to pass to the server commandline.
+              '';
+            };
+          };
+        }
+      ));
+      default = {};
+      example = literalExpression ''
+        {
+          english = {
+            port = 5300;
+            model = "tts_models/en/ljspeech/tacotron2-DDC";
+          };
+          german = {
+            port = 5301;
+            model = "tts_models/de/thorsten/tacotron2-DDC";
+          };
+          dutch = {
+            port = 5302;
+            model = "tts_models/nl/mai/tacotron2-DDC";
+          };
+        }
+      '';
+      description = mdDoc ''
+        TTS server instances.
+      '';
+    };
+  };
+
+  config = let
+    inherit (lib) mkIf mapAttrs' nameValuePair optionalString concatMapStringsSep escapeShellArgs;
+  in mkIf (cfg.servers != {}) {
+    systemd.services = mapAttrs' (server: options:
+      nameValuePair "tts-${server}" {
+        description = "Coqui TTS server instance ${server}";
+        after = [
+          "network-online.target"
+        ];
+        wantedBy = [
+          "multi-user.target"
+        ];
+        path = with pkgs; [
+          espeak-ng
+        ];
+        environment.HOME = "/var/lib/tts";
+        serviceConfig = {
+          DynamicUser = true;
+          User = "tts";
+          StateDirectory = "tts";
+          ExecStart = "${pkgs.tts}/bin/tts-server --port ${toString options.port}"
+            + optionalString (options.model != null) " --model_name ${options.model}"
+            + optionalString (options.useCuda) " --use_cuda"
+            + (concatMapStringsSep " " escapeShellArgs options.extraArgs);
+          CapabilityBoundingSet = "";
+          DeviceAllow = if options.useCuda then [
+            # https://docs.nvidia.com/dgx/pdf/dgx-os-5-user-guide.pdf
+            "/dev/nvidia1"
+            "/dev/nvidia2"
+            "/dev/nvidia3"
+            "/dev/nvidia4"
+            "/dev/nvidia-caps/nvidia-cap1"
+            "/dev/nvidia-caps/nvidia-cap2"
+            "/dev/nvidiactl"
+            "/dev/nvidia-modeset"
+            "/dev/nvidia-uvm"
+            "/dev/nvidia-uvm-tools"
+          ] else "";
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          # jit via numba->llvmpipe
+          MemoryDenyWriteExecute = false;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectControlGroups = true;
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          UMask = "0077";
+        };
+      }) cfg.servers;
+  };
+}
--- a/nixos/modules/services/monitoring/mimir.nix
+++ b/nixos/modules/services/monitoring/mimir.nix
@ -25,6 +25,13 @@ in {
        Specify a configuration file that Mimir should use.
      '';
    };
+
+    package = mkOption {
+      default = pkgs.mimir;
+      defaultText = lib.literalExpression "pkgs.mimir";
+      type = types.package;
+      description = lib.mdDoc ''Mimir package to use.'';
+    };
  };

  config = mkIf cfg.enable {
@ -53,7 +60,7 @@ in {
               else cfg.configFile;
      in
      {
-        ExecStart = "${pkgs.mimir}/bin/mimir --config.file=${conf}";
+        ExecStart = "${cfg.package}/bin/mimir --config.file=${conf}";
        DynamicUser = true;
        Restart = "always";
        ProtectSystem = "full";
--- a/nixos/tests/keepassxc.nix
+++ b/nixos/tests/keepassxc.nix
@ -4,6 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
  name = "keepassxc";
  meta = with pkgs.lib.maintainers; {
    maintainers = [ turion ];
+    timeout = 1800;
  };

  nodes.machine = { ... }:
@ -55,9 +56,12 @@ import ./make-test-python.nix ({ pkgs, ...} :
        machine.sleep(5)
        # Regression #163482: keepassxc did not crash
        machine.succeed("ps -e | grep keepassxc")
-        machine.wait_for_text("foo.kdbx")
+        machine.wait_for_text("Open database")
        machine.send_key("ret")
-        machine.sleep(1)
+
+        # Wait for the enter password screen to appear.
+        machine.wait_for_text("/home/alice/foo.kdbx")
+
        # Click on "Browse" button to select keyfile
        machine.send_key("tab")
        machine.send_chars("/home/alice/foo.keyfile")
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@ -3,7 +3,6 @@
 , fetchFromGitHub
 , cmake
 , qttools
-, darwin

 , asciidoctor
 , botan2
@ -25,6 +24,8 @@
 , wrapQtAppsHook
 , zlib

+, LocalAuthentication
+
 , withKeePassBrowser ? true
 , withKeePassFDOSecrets ? true
 , withKeePassKeeShare ? true
@ -110,7 +111,7 @@ stdenv.mkDerivation rec {
    readline
    zlib
  ]
-  ++ lib.optional (stdenv.isDarwin && withKeePassTouchID) darwin.apple_sdk.frameworks.LocalAuthentication
+  ++ lib.optional (stdenv.isDarwin && withKeePassTouchID) LocalAuthentication
  ++ lib.optional stdenv.isDarwin qtmacextras
  ++ lib.optional stdenv.isLinux libusb1
  ++ lib.optional withKeePassX11 qtx11extras;
--- a/pkgs/applications/networking/instant-messengers/nchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nchat/default.nix
@ -0,0 +1,44 @@
+{ lib, stdenv,  fetchFromGitHub, cmake, gperf
+, file, ncurses, openssl, readline, sqlite, zlib
+, AppKit, Cocoa, Foundation
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nchat";
+  version = "3.17";
+
+  src = fetchFromGitHub {
+    owner = "d99kris";
+    repo = "nchat";
+    rev = "v${version}";
+    hash = "sha256-BtWKt8paI0gCGSzLYN8x3Yp5MUpwCb2vBGcGQG2aumY=";
+  };
+
+  postPatch = ''
+    substituteInPlace lib/tgchat/ext/td/CMakeLists.txt \
+      --replace "get_git_head_revision" "#get_git_head_revision"
+  '';
+
+  nativeBuildInputs = [ cmake gperf ];
+
+  buildInputs = [
+    file # for libmagic
+    ncurses
+    openssl
+    readline
+    sqlite
+    zlib
+  ] ++ lib.optional stdenv.isDarwin [ AppKit Cocoa Foundation ];
+
+  cmakeFlags = [
+    "-DHAS_WHATSAPP=OFF" # go module build required
+  ];
+
+  meta = with lib; {
+    description = "Terminal-based chat client with support for Telegram and WhatsApp";
+    homepage = "https://github.com/d99kris/nchat";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@ -25,13 +25,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "amdvlk";
-  version = "2022.Q4.4";
+  version = "2023.Q1.2";

  src = fetchRepoProject {
    name = "${pname}-src";
    manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
    rev = "refs/tags/v-${version}";
-    sha256 = "sha256-MKU7bfjrvH4M2kON2tr5463nYjN1xoGAknsC9YmklEc=";
+    sha256 = "sha256-QNjBLOnSfCTA+5qLqejAqJv9eIWAEVNc/VrhidGjmTc=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/libubox/default.nix
+++ b/pkgs/development/libraries/libubox/default.nix
@ -1,8 +1,8 @@
-{ stdenv, lib, fetchgit, cmake, pkg-config, json_c, with_lua ? false, lua5_1 }:
+{ stdenv, lib, fetchgit, cmake, pkg-config, json_c, with_lua ? false, lua5_1, with_ustream_ssl ? false, ustream-ssl }:

 stdenv.mkDerivation {
  pname = "libubox";
-  version = "unstable-2023-01-03";
+  version = "unstable-2023-01-03${lib.optionalString with_ustream_ssl "-${ustream-ssl.ssl_implementation.pname}"}";

  src = fetchgit {
    url = "https://git.openwrt.org/project/libubox.git";
@ -13,7 +13,14 @@ stdenv.mkDerivation {
  cmakeFlags = [ "-DBUILD_EXAMPLES=OFF" (if with_lua then "-DLUAPATH=${placeholder "out"}/lib/lua" else "-DBUILD_LUA=OFF") ];

  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ json_c ] ++ lib.optional with_lua lua5_1;
+  buildInputs = [ json_c ] ++ lib.optional with_lua lua5_1 ++ lib.optional with_ustream_ssl ustream-ssl;
+
+  postInstall = lib.optionalString with_ustream_ssl ''
+    for fin in $(find ${ustream-ssl} -type f); do
+      fout="''${fin/"${ustream-ssl}"/"''${out}"}"
+      ln -s "$fin" "$fout"
+    done
+  '';

  meta = with lib; {
    description = "C utility functions for OpenWrt";
--- a/pkgs/development/libraries/thrift/default.nix
+++ b/pkgs/development/libraries/thrift/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "thrift";
-  version = "0.17.0";
+  version = "0.18.0";

  src = fetchurl {
    url = "https://archive.apache.org/dist/thrift/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-snLBeIuxZdmVIaJZmzG5f6aeWTHQmQFdka4QegsMxY8=";
+    hash = "sha256-fBk4nLeRCiDli45GkDyMGjY1MAj5/MGwP3SKzPm18+E=";
  };

  # Workaround to make the Python wrapper not drop this package:
@ -74,6 +74,11 @@ stdenv.mkDerivation rec {
      url = "https://github.com/apache/thrift/commit/2ab850824f75d448f2ba14a468fb77d2594998df.diff";
      hash = "sha256-ejMKFG/cJgoPlAFzVDPI4vIIL7URqaG06/IWdQ2NkhY=";
    })
+    (fetchpatch {
+      name = "thrift-fix-tests-OpenSSL3.patch"; # https://github.com/apache/thrift/pull/2760
+      url = "https://github.com/apache/thrift/commit/eae3ac418f36c73833746bcd53e69ed8a12f0e1a.diff";
+      hash = "sha256-0jlN4fo94cfGFUKcLFQgVMI/x7uxn5OiLiFk6txVPzs=";
+    })
  ];

  cmakeFlags = [
@ -90,6 +95,7 @@ stdenv.mkDerivation rec {

  disabledTests = [
    "PythonTestSSLSocket"
+    "PythonThriftTNonblockingServer"
  ] ++ lib.optionals stdenv.isDarwin [
    # Tests that hang up in the Darwin sandbox
    "SecurityTest"
@ -106,7 +112,6 @@ stdenv.mkDerivation rec {
    "StressTest"
    "StressTestConcurrent"
    "StressTestNonBlocking"
-    "PythonThriftTNonblockingServer"
  ];

  doCheck = !static;
--- a/pkgs/development/libraries/uclient/default.nix
+++ b/pkgs/development/libraries/uclient/default.nix
@ -0,0 +1,30 @@
+{ stdenv, lib, fetchgit, cmake, pkg-config, libubox }:
+
+stdenv.mkDerivation {
+  pname = "uclient";
+  version = "unstable-2022-02-24";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/uclient.git";
+    rev = "644d3c7e13c6a64bf5cb628137ee5bd4dada4b74";
+    sha256 = "0vy4whs64699whp92d1zl7a8kh16yrfywqq0yp2y809l9z19sw22";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buidInputs = [ libubox ];
+
+  preConfigure = ''
+    sed -e 's|ubox_include_dir libubox/ustream-ssl.h|ubox_include_dir libubox/ustream-ssl.h HINTS ${libubox}/include|g' \
+        -e 's|ubox_library NAMES ubox|ubox_library NAMES ubox HINTS ${libubox}/lib|g' \
+        -i CMakeLists.txt
+  '';
+
+  meta = with lib; {
+    description = "Tiny OpenWrt fork of libnl";
+    homepage = "https://git.openwrt.org/?p=project/uclient.git;a=summary";
+    license = licenses.isc;
+    maintainers = with maintainers; [ mkg20001 ];
+    mainProgram = "uclient-fetch";
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/libraries/ustream-ssl/default.nix
+++ b/pkgs/development/libraries/ustream-ssl/default.nix
@ -0,0 +1,37 @@
+{ stdenv, lib, fetchgit, cmake, pkg-config, libubox-nossl, ssl_implementation }:
+
+stdenv.mkDerivation {
+  pname = "ustream-ssl";
+  version = "unstable-2022-12-08-${ssl_implementation.pname}";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/ustream-ssl.git";
+    rev = "9217ab46536353c7c792951b57163063f5ec7a3b";
+    sha256 = "1ldyyb3is213iljyccx98f56rb69rfpgdcb1kjxw9a176hvpipdd";
+  };
+
+  preConfigure = ''
+    sed -r \
+        -e "s|ubox_include_dir libubox/ustream.h|ubox_include_dir libubox/ustream.h HINTS ${libubox-nossl}/include|g" \
+        -e "s|ubox_library NAMES ubox|ubox_library NAMES ubox HINTS ${libubox-nossl}/lib|g" \
+        -e "s|^  FIND_LIBRARY\((.+)\)|  FIND_LIBRARY\(\1 HINTS ${if ssl_implementation ? lib then ssl_implementation.lib else ssl_implementation.out}\)|g" \
+        -i CMakeLists.txt
+  '';
+
+  cmakeFlags = [ "-D${lib.toUpper ssl_implementation.pname}=ON" ];
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ ssl_implementation ];
+
+  passthru = {
+    inherit ssl_implementation;
+  };
+
+  meta = with lib; {
+    description = "ustream SSL wrapper";
+    homepage = "https://git.openwrt.org/?p=project/ustream-ssl.git;a=summary";
+    license = licenses.isc;
+    maintainers = with maintainers; [ fpletz ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/ocaml-modules/sha/default.nix
+++ b/pkgs/development/ocaml-modules/sha/default.nix
@ -2,12 +2,12 @@

 buildDunePackage rec {
  pname = "sha";
-  version = "1.15.2";
+  version = "1.15.4";
  duneVersion = "3";

  src = fetchurl {
-    url = "https://github.com/djs55/ocaml-${pname}/releases/download/${version}/${pname}-${version}.tbz";
-    hash = "sha256-P71Xs5p8QAaOtBrh7MuhQJOL6144BqTLvXlZOyGD/7c=";
+    url = "https://github.com/djs55/ocaml-${pname}/releases/download/v${version}/${pname}-${version}.tbz";
+    hash = "sha256-beWxITmxmZzp30zHiloxiGwqVHydRIvyhT+LU7zx8bE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix
@ -1,27 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
 , azure-common
 , azure-mgmt-core
 , msrest
-, msrestazure
+, typing-extensions
 }:

 buildPythonPackage rec {
-  version = "10.0.0";
  pname = "azure-mgmt-containerregistry";
-  disabled = isPy27;
+  version = "10.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-HjejK28Em5AeoQ20o4fucnXTlAwADF/SEpVfHn9anZk=";
+    hash = "sha256-VrX9YfYNvlA8+eNqHCp35BAeQZzQKakZs7ZZKwT8oYc=";
    extension = "zip";
  };

-  propagatedBuildInputs = [ azure-common azure-mgmt-core msrest msrestazure ];
+  propagatedBuildInputs = [
+    azure-common
+    azure-mgmt-core
+    msrest
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
+  ];

  # no tests included
  doCheck = false;

-  pythonImportsCheck = [ "azure.common" "azure.mgmt.containerregistry" ];
+  pythonImportsCheck = [
+    "azure.common"
+    "azure.mgmt.containerregistry"
+  ];

  meta = with lib; {
    description = "Microsoft Azure Container Registry Client Library for Python";
--- a/pkgs/development/python-modules/google-cloud-language/default.nix
+++ b/pkgs/development/python-modules/google-cloud-language/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-language";
-  version = "2.8.1";
+  version = "2.9.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-o4o9x7r7HpwzByUijDegzos35FILro0Esr2ugN2nyws=";
+    hash = "sha256-7rKNcG11cgvvwNEYiN9l8h8UR8u6DFfcI+S1QDi+t/c=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/insteon-frontend-home-assistant/default.nix
+++ b/pkgs/development/python-modules/insteon-frontend-home-assistant/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "insteon-frontend-home-assistant";
-  version = "0.3.1";
+  version = "0.3.2";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-gS2jDjgAcY4ve80yOPZcZR1v4c9EISYEoJkIezUQilU=";
+    hash = "sha256-7jRf6fp+5u6qqR5xP1R+kp6LURsBVqfct6yuCkbxBMw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/lektor/default.nix
+++ b/pkgs/development/python-modules/lektor/default.nix
@ -10,6 +10,7 @@
 , importlib-metadata
 , inifile
 , jinja2
+, markupsafe
 , marshmallow
 , marshmallow-dataclass
 , mistune
@ -19,8 +20,10 @@
 , pytest-mock
 , pytest-pylint
 , pytestCheckHook
+, python
 , pythonOlder
 , python-slugify
+, pytz
 , requests
 , setuptools
 , typing-inspect
@ -30,7 +33,7 @@

 buildPythonPackage rec {
  pname = "lektor";
-  version = "3.4.0b2";
+  version = "3.4.0b4";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -39,7 +42,7 @@ buildPythonPackage rec {
    owner = "lektor";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-5w3tT0celHgjmLlsM3sdBdYlXx57z3kMePVGSQkOP7M=";
+    hash = "sha256-O0bTmJqRymrQuHW19Y7/Kp+2XlbmDzcjl/jDACDlCSk=";
  };

  propagatedBuildInputs = [
@ -51,12 +54,14 @@ buildPythonPackage rec {
    flask
    inifile
    jinja2
+    markupsafe
    marshmallow
    marshmallow-dataclass
    mistune
    pip
    pyopenssl
    python-slugify
+    pytz
    requests
    setuptools
    typing-inspect
@ -72,9 +77,8 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "typing.inspect < 0.8.0" "typing.inspect"
+  postInstall = ''
+    cp -r lektor/translations "$out/${python.sitePackages}/lektor/"
  '';

  pythonImportsCheck = [
@ -89,6 +93,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "A static content management system";
    homepage = "https://www.getlektor.com/";
+    changelog = "https://github.com/lektor/lektor/blob/v${version}/CHANGES.md";
    license = licenses.bsd0;
    maintainers = with maintainers; [ costrouc ];
  };
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "esbuild";
-  version = "0.17.8";
+  version = "0.17.10";

  src = fetchFromGitHub {
    owner = "evanw";
    repo = "esbuild";
    rev = "v${version}";
-    hash = "sha256-UJIbx0UkpHYMgDr+1dbNoMLrY5hWs0E2Ehu3txG/80E=";
+    hash = "sha256-qe7YCOIwp+MSa5VkwImdOea1aMcpWdor/13PIgGEkkw=";
  };

  vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
--- a/pkgs/development/tools/squawk/correct-Cargo.lock.patch
+++ b/pkgs/development/tools/squawk/correct-Cargo.lock.patch
@ -6,8 +6,8 @@ index d5803a8..384224d 100644
 
 [[package]]
 name = "squawk"
-version = "0.19.0"
-+version = "0.20.0"
+-version = "0.20.0"
+version = "0.21.0"
 dependencies = [
  "atty",
  "base64 0.12.3",
--- a/pkgs/development/tools/squawk/default.nix
+++ b/pkgs/development/tools/squawk/default.nix
@ -23,16 +23,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "squawk";
-  version = "0.20.0";
+  version = "0.21.0";

  src = fetchFromGitHub {
    owner = "sbdchd";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-v9F+HfscX4dIExIP1YvxOldZPPtmxh8lO3SREu6M+C0=";
+    hash = "sha256-ObaYGGTAGGLOAji86Q5R9fqbCGg6GP0A3iheNLgzezY=";
  };

-  cargoHash = "sha256-kSaQxqom8LSCOQBoIZ1iv+q2+Ih8l61L97xXv5c4a0k=";
+  cargoHash = "sha256-VOGgwBKcJK7x+PwvzvuVu9Zd1G8t9UoC/Me3G6bdtrk=";

  cargoPatches = [
    ./correct-Cargo.lock.patch
@ -55,6 +55,8 @@ rustPlatform.buildRustPackage rec {
    Security
  ]);

+  OPENSSL_NO_VENDOR = 1;
+
  LIBPG_QUERY_PATH = libpg_query13;

  meta = with lib; {
--- a/pkgs/development/web/grails/default.nix
+++ b/pkgs/development/web/grails/default.nix
@ -11,11 +11,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "grails";
-  version = "5.3.0";
+  version = "5.3.2";

  src = fetchurl {
    url = "https://github.com/grails/grails-core/releases/download/v${version}/grails-${version}.zip";
-    sha256 = "sha256-0Ow3G0QbKXQSpjLf371CYNxC3XoO5sv1SQD4MlHeOQ4=";
+    sha256 = "sha256-UdRtrQiHbBc8VoVUulDCZmAfZ1YTVdgNfeF91HomSqc=";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/os-specific/linux/libnl-tiny/default.nix
+++ b/pkgs/os-specific/linux/libnl-tiny/default.nix
@ -0,0 +1,28 @@
+{ stdenv, lib, fetchgit, cmake, pkg-config }:
+
+stdenv.mkDerivation {
+  pname = "libnl-tiny";
+  version = "unstable-2022-12-13";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/libnl-tiny.git";
+    rev = "f5d9b7e4f534a69cbd35c3f150fa6d57b9d631e4";
+    sha256 = "0c5ycsdas8rr5c33gd0mnmm515dq631fmdjn5mp2j1m0j1bk7hc0";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  preConfigure = ''
+    sed -e 's|''${prefix}/@CMAKE_INSTALL_LIBDIR@|@CMAKE_INSTALL_FULL_LIBDIR@|g' \
+        -e 's|''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@|@CMAKE_INSTALL_FULL_INCLUDEDIR@|g' \
+        -i libnl-tiny.pc.in
+  '';
+
+  meta = with lib; {
+    description = "Tiny OpenWrt fork of libnl";
+    homepage = "https://git.openwrt.org/?p=project/libnl-tiny.git;a=summary";
+    license = licenses.isc;
+    maintainers = with maintainers; [ mkg20001 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@ -38,12 +38,12 @@ in

 stdenv.mkDerivation rec {
  pname = "rabbitmq-server";
-  version = "3.11.8";
+  version = "3.11.9";

  # when updating, consider bumping elixir version in all-packages.nix
  src = fetchurl {
    url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-sD9E60xXNJQSg98XbMq6xn+nk3uQn1XnrxApAuSaF44=";
+    hash = "sha256-b/SfUyn+x33SnFo/n/zTLxG4PWz34F2qQs4B4p2/Ty4=";
  };

  nativeBuildInputs = [ unzip xmlto docbook_xml_dtd_45 docbook_xsl zip rsync python3 ];
--- a/pkgs/servers/http/go-camo/default.nix
+++ b/pkgs/servers/http/go-camo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "go-camo";
-  version = "2.4.2";
+  version = "2.4.3";

  src = fetchFromGitHub {
    owner = "cactus";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-TW32pzYcSMdtcO3MGxgANCLMLvq7S/Tq3KSimv90PU0=";
+    sha256 = "sha256-GRctsE+uAvyA0pcz+ym4sz3K80pUHoDipVsjFcdrT2A=";
  };

-  vendorHash = "sha256-AcSClJwDsM+tUbDE7sQ8LLkxCPTtLEGXsQePqQ6CwMA=";
+  vendorHash = "sha256-C66QxlMBupbHYktyzHapUrl0yk+pvWZN0BLhpjIGVzI=";

  ldflags = [ "-s" "-w" "-X=main.ServerVersion=${version}" ];

--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@ -5,16 +5,6 @@
 , espeak-ng
 }:

-# USAGE:
-# $ tts-server --list_models
-# # pick your favorite vocoder/tts model
-# $ tts-server --model_name tts_models/en/ljspeech/glow-tts --vocoder_name vocoder_models/universal/libri-tts/fullband-melgan
-#
-# If you upgrade from an old version you may have to delete old models from ~/.local/share/tts
-#
-# For now, for deployment check the systemd unit in the pull request:
-#   https://github.com/NixOS/nixpkgs/pull/103851#issue-521121136
-
 let
  python = python3.override {
    packageOverrides = self: super: {
--- a/pkgs/tools/games/minecraft/packwiz/default.nix
+++ b/pkgs/tools/games/minecraft/packwiz/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "packwiz";
-  version = "unstable-2022-10-29";
+  version = "unstable-2023-02-13";

  src = fetchFromGitHub {
    owner = "packwiz";
    repo = "packwiz";
-    rev = "f00dc9844ffdd6ee5c0526a79b0084429e9cb130";
-    sha256 = "sha256-YpihFWdcKfHJLEs+jHzHH7G+m/E8i5y2yp7IubObNhY=";
+    rev = "4b336e46e277d4b252c11f43080576dc23b001d2";
+    sha256 = "sha256-f6560XrnriKNq89aOxfJjN4mDdtYzMSOUlRWwItLuHk=";
  };

-  vendorSha256 = "sha256-09S8RFdCvtE50EICLIKCTnTjG/0XsGf+yq9SNObKmRA=";
+  vendorSha256 = "sha256-yL5pWbVqf6mEpgYsItLnv8nwSmoMP+SE0rX/s7u2vCg=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/tools/misc/flashrom/default.nix
+++ b/pkgs/tools/misc/flashrom/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace util/flashrom_udev.rules \
-      --replace "plugdev" "flashrom"
+      --replace 'GROUP="plugdev"' 'TAG+="uaccess", TAG+="udev-acl"'
  '';

  makeFlags = [ "PREFIX=$(out)" "libinstall" ]
--- a/pkgs/tools/misc/ntfy-sh/default.nix
+++ b/pkgs/tools/misc/ntfy-sh/default.nix
@ -10,16 +10,16 @@ let
 in
 buildGoModule rec {
  pname = "ntfy-sh";
-  version = "1.31.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "binwiederhier";
    repo = "ntfy";
    rev = "v${version}";
-    sha256 = "sha256-SQOiVHhdwOmzWVPtr1hw9oz8G/xjz5HghYcNN/u3ITo=";
+    sha256 = "sha256-r5MAffvQVya6VWzdO3NPVBAekeZQllxtpS5A06EQnI4=";
  };

-  vendorSha256 = "sha256-Ffmz7c/FMtXjmanZYp8vquxUu+eSTqtR5nesNdN/F0c=";
+  vendorSha256 = "sha256-QUUZX9UnLnhyYrbws9pGfN/gqbwt7CeJNYlsPsLRb6g=";

  doCheck = false;

--- a/pkgs/tools/misc/ntfy-sh/generate-dependencies.sh
+++ b/pkgs/tools/misc/ntfy-sh/generate-dependencies.sh
@ -6,6 +6,7 @@ $(nix-build $ROOT -A  nodePackages.node2nix --no-out-link)/bin/node2nix \
  --nodejs-14 \
  --node-env ../../../development/node-packages/node-env.nix \
  --development \
-  --lock ./package-lock-temp.json \
  --output node-packages.nix \
  --composition node-composition.nix
+# removed temporarily because of https://github.com/svanderburg/node2nix/issues/312
+# --lock ./package-lock-temp.json \
--- a/pkgs/tools/misc/ntfy-sh/node-packages.nix
+++ b/pkgs/tools/misc/ntfy-sh/node-packages.nix
--- a/pkgs/tools/misc/ntfy-sh/package.json
+++ b/pkgs/tools/misc/ntfy-sh/package.json
@ -15,6 +15,7 @@
    "@mui/material": "latest",
    "dexie": "^3.2.1",
    "dexie-react-hooks": "^1.1.1",
+    "humanize-duration": "^3.27.3",
    "i18next": "^21.6.14",
    "i18next-browser-languagedetector": "^6.1.4",
    "i18next-http-backend": "^1.4.0",
--- a/pkgs/tools/security/mfoc-hardnested/default.nix
+++ b/pkgs/tools/security/mfoc-hardnested/default.nix
@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libnfc, xz }:
+
+stdenv.mkDerivation rec {
+  pname = "mfoc-hardnested";
+  version = "unstable-2021-08-14";
+
+  src = fetchFromGitHub {
+    owner = "nfc-tools";
+    repo = pname;
+    rev = "2c25bf05a0b13827b9d06382c5d384b2e5c88238";
+    hash = "sha256-fhfevQCw0E5TorHx61Vltpmv7DAjgH73i27O7aBKxz4=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ libnfc xz ];
+
+  meta = with lib; {
+    description = "A fork of mfoc integrating hardnested code from the proxmark";
+    license = licenses.gpl2;
+    homepage = "https://github.com/nfc-tools/mfoc-hardnested";
+    maintainers = with maintainers; [ azuwis ];
+    platforms = platforms.unix;
+    broken = (stdenv.isDarwin && stdenv.isAarch64); # Undefined symbols "_memalign" referenced
+  };
+}
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -9778,6 +9778,8 @@ with pkgs;

  mfoc = callPackage ../tools/security/mfoc { };

+  mfoc-hardnested = callPackage ../tools/security/mfoc-hardnested { };
+
  microbin = callPackage ../servers/microbin { };

  microdnf = callPackage ../tools/package-management/microdnf { };
@ -19387,6 +19389,14 @@ with pkgs;

  uci = callPackage ../development/libraries/uci { };

+  uclient = callPackage ../development/libraries/uclient { };
+
+  ustream-ssl = callPackage ../development/libraries/ustream-ssl { ssl_implementation = openssl; };
+
+  ustream-ssl-wolfssl = callPackage ../development/libraries/ustream-ssl { ssl_implementation = wolfssl; };
+
+  ustream-ssl-mbedtls = callPackage ../development/libraries/ustream-ssl { ssl_implementation = mbedtls_2; };
+
  uri = callPackage ../development/libraries/uri { stdenv = gcc10StdenvCompat; };

  cppcms = callPackage ../development/libraries/cppcms { };
@ -21831,7 +21841,13 @@ with pkgs;

  libu2f-server = callPackage ../development/libraries/libu2f-server { };

-  libubox = callPackage ../development/libraries/libubox { };
+  libubox-nossl = callPackage ../development/libraries/libubox { };
+
+  libubox = callPackage ../development/libraries/libubox { with_ustream_ssl = true; };
+
+  libubox-wolfssl = callPackage ../development/libraries/libubox { with_ustream_ssl = true; ustream-ssl = ustream-ssl-wolfssl; };
+
+  libubox-mbedtls = callPackage ../development/libraries/libubox { with_ustream_ssl = true; ustream-ssl = ustream-ssl-mbedtls; };

  libudev-zero = callPackage ../development/libraries/libudev-zero { };

@ -23538,9 +23554,7 @@ with pkgs;

  theft = callPackage ../development/libraries/theft { };

-  thrift = callPackage ../development/libraries/thrift {
-    openssl = openssl_1_1;
-  };
+  thrift = callPackage ../development/libraries/thrift { };

  thrift-0_10 = callPackage ../development/libraries/thrift/0.10.nix { };

@ -26011,6 +26025,8 @@ with pkgs;

  libnl = callPackage ../os-specific/linux/libnl { };

+  libnl-tiny = callPackage ../os-specific/linux/libnl-tiny { };
+
  libtraceevent = callPackage ../os-specific/linux/libtraceevent {};

  libtracefs = callPackage ../os-specific/linux/libtracefs {};
@ -29285,7 +29301,10 @@ with pkgs;

  keepassx = callPackage ../applications/misc/keepassx { };
  keepassx2 = callPackage ../applications/misc/keepassx/2.0.nix { };
-  keepassxc = libsForQt5.callPackage ../applications/misc/keepassx/community.nix { };
+  keepassxc = libsForQt5.callPackage ../applications/misc/keepassx/community.nix {
+    inherit (darwin.apple_sdk_11_0.frameworks) LocalAuthentication;
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
+  };

  keepass-diff = callPackage ../applications/misc/keepass-diff { };

@ -31975,6 +31994,10 @@ with pkgs;

  ngt = callPackage ../development/libraries/ngt { };

+  nchat = callPackage ../applications/networking/instant-messengers/nchat {
+    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation;
+  };
+
  nheko = libsForQt5.callPackage ../applications/networking/instant-messengers/nheko {
    # https://github.com/NixOS/nixpkgs/issues/201254
    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv else stdenv;