Merge master into staging-next

2023-10-30 18:01:02 +00:00 · 2023-10-30 18:01:02 +00:00 · 931938d1df
commit 931938d1df
parent 7f11b9b46b fe1e9d524b
59 changed files with 396 additions and 601 deletions
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@ -424,7 +424,7 @@ rec {
      # Filter suited when there's some files
      # This can't be used for when there's no files, because the base directory is always included
      nonEmpty =
-        path: _:
+        path: type:
        let
          # Add a slash to the path string, turning "/foo" to "/foo/",
          # making sure to not have any false prefix matches below.
@ -433,25 +433,37 @@ rec {
          # meaning this function can never receive "/" as an argument
          pathSlash = path + "/";
        in
-        # Same as `hasPrefix pathSlash baseString`, but more efficient.
-        # With base /foo/bar we need to include /foo:
-        # hasPrefix "/foo/" "/foo/bar/"
-        if substring 0 (stringLength pathSlash) baseString == pathSlash then
-          true
-        # Same as `! hasPrefix baseString pathSlash`, but more efficient.
-        # With base /foo/bar we need to exclude /baz
-        # ! hasPrefix "/baz/" "/foo/bar/"
-        else if substring 0 baseLength pathSlash != baseString then
-          false
-        else
-          # Same as `removePrefix baseString path`, but more efficient.
-          # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
-          # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
-          # With base /foo and path /foo/bar/baz this gives
-          # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
-          # == inTree (split "/" "bar/baz")
-          # == inTree [ "bar" "baz" ]
-          inTree (split "/" (substring baseLength (-1) path));
+        (
+          # Same as `hasPrefix pathSlash baseString`, but more efficient.
+          # With base /foo/bar we need to include /foo:
+          # hasPrefix "/foo/" "/foo/bar/"
+          if substring 0 (stringLength pathSlash) baseString == pathSlash then
+            true
+          # Same as `! hasPrefix baseString pathSlash`, but more efficient.
+          # With base /foo/bar we need to exclude /baz
+          # ! hasPrefix "/baz/" "/foo/bar/"
+          else if substring 0 baseLength pathSlash != baseString then
+            false
+          else
+            # Same as `removePrefix baseString path`, but more efficient.
+            # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
+            # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
+            # With base /foo and path /foo/bar/baz this gives
+            # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
+            # == inTree (split "/" "bar/baz")
+            # == inTree [ "bar" "baz" ]
+            inTree (split "/" (substring baseLength (-1) path))
+        )
+        # This is a way have an additional check in case the above is true without any significant performance cost
+        && (
+          # This relies on the fact that Nix only distinguishes path types "directory", "regular", "symlink" and "unknown",
+          # so everything except "unknown" is allowed, seems reasonable to rely on that
+          type != "unknown"
+          || throw ''
+            lib.fileset.toSource: `fileset` contains a file that cannot be added to the store: ${path}
+                This file is neither a regular file nor a symlink, the only file types supported by the Nix store.
+                Therefore the file set cannot be added to the Nix store as is. Make sure to not include that file to avoid this error.''
+        );
    in
    # Special case because the code below assumes that the _internalBase is always included in the result
    # which shouldn't be done when we have no files at all in the base
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@ -332,7 +332,7 @@ expectFailure 'with ((import <nixpkgs/lib>).extend (import <nixpkgs/lib/fileset/
 \s*`root`: root "'"$work"'/foo/mock-root"
 \s*`fileset`: root "'"$work"'/bar/mock-root"
 \s*Different roots are not supported.'
-rm -rf *
+rm -rf -- *

 # `root` needs to exist
 expectFailure 'toSource { root = ./a; fileset = ./.; }' 'lib.fileset.toSource: `root` \('"$work"'/a\) does not exist.'
@ -342,7 +342,7 @@ touch a
 expectFailure 'toSource { root = ./a; fileset = ./a; }' 'lib.fileset.toSource: `root` \('"$work"'/a\) is a file, but it should be a directory instead. Potential solutions:
 \s*- If you want to import the file into the store _without_ a containing directory, use string interpolation or `builtins.path` instead of this function.
 \s*- If you want to import the file into the store _with_ a containing directory, set `root` to the containing directory, such as '"$work"', and set `fileset` to the file path.'
-rm -rf *
+rm -rf -- *

 # The fileset argument should be evaluated, even if the directory is empty
 expectFailure 'toSource { root = ./.; fileset = abort "This should be evaluated"; }' 'evaluation aborted with the following error message: '\''This should be evaluated'\'
@ -352,7 +352,14 @@ mkdir a
 expectFailure 'toSource { root = ./a; fileset = ./.; }' 'lib.fileset.toSource: `fileset` could contain files in '"$work"', which is not under the `root` \('"$work"'/a\). Potential solutions:
 \s*- Set `root` to '"$work"' or any directory higher up. This changes the layout of the resulting store path.
 \s*- Set `fileset` to a file set that cannot contain files outside the `root` \('"$work"'/a\). This could change the files included in the result.'
-rm -rf *
+rm -rf -- *
+
+# non-regular and non-symlink files cannot be added to the Nix store
+mkfifo a
+expectFailure 'toSource { root = ./.; fileset = ./a; }' 'lib.fileset.toSource: `fileset` contains a file that cannot be added to the store: '"$work"'/a
+\s*This file is neither a regular file nor a symlink, the only file types supported by the Nix store.
+\s*Therefore the file set cannot be added to the Nix store as is. Make sure to not include that file to avoid this error.'
+rm -rf -- *

 # Path coercion only works for paths
 expectFailure 'toSource { root = ./.; fileset = 10; }' 'lib.fileset.toSource: `fileset` is of type int, but it should be a file set or a path instead.'
@ -493,7 +500,7 @@ expectFailure 'with ((import <nixpkgs/lib>).extend (import <nixpkgs/lib/fileset/
 \s*element 0: root "'"$work"'/foo/mock-root"
 \s*element 1: root "'"$work"'/bar/mock-root"
 \s*Different roots are not supported.'
-rm -rf *
+rm -rf -- *

 # Coercion errors show the correct context
 expectFailure 'toSource { root = ./.; fileset = union ./a ./.; }' 'lib.fileset.union: first argument \('"$work"'/a\) does not exist.'
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3680,6 +3680,15 @@
      fingerprint = "2017 E152 BB81 5C16 955C  E612 45BC C1E2 709B 1788";
    }];
  };
+  Cryolitia = {
+    name = "Beiyan Cryolitia";
+    email = "Cryolitia@gmail.com";
+    github = "Cryolitia";
+    githubId = 23723294;
+    keys = [{
+      fingerprint = "1C3C 6547 538D 7152 310C 0EEA 84DD 0C01 30A5 4DF7";
+    }];
+  };
  cryptix = {
    email = "cryptix@riseup.net";
    github = "cryptix";
--- a/nixos/modules/services/audio/wyoming/openwakeword.nix
+++ b/nixos/modules/services/audio/wyoming/openwakeword.nix
@ -22,15 +22,6 @@ let
    toString
    ;

-  models = [
-    # wyoming_openwakeword/models/*.tflite
-    "alexa"
-    "hey_jarvis"
-    "hey_mycroft"
-    "hey_rhasspy"
-    "ok_nabu"
-  ];
-
 in

 {
@ -51,15 +42,22 @@ in
    };

    models = mkOption {
-      type = listOf (enum models);
-      default = models;
+      type = listOf str;
+      default = [
+        # wyoming_openwakeword/models/*.tflite
+        "alexa"
+        "hey_jarvis"
+        "hey_mycroft"
+        "hey_rhasspy"
+        "ok_nabu"
+      ];
      description = mdDoc ''
        List of wake word models that should be made available.
      '';
    };

    preloadModels = mkOption {
-      type = listOf (enum models);
+      type = listOf str;
      default = [
        "ok_nabu"
      ];
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@ -350,7 +350,7 @@ in

    boot.kernelParams = mkIf (!config.networking.usePredictableInterfaceNames) [ "net.ifnames=0" ];

-    boot.initrd.extraUdevRulesCommands = optionalString (!config.boot.initrd.systemd.enable && config.boot.initrd.services.udev.rules != "")
+    boot.initrd.extraUdevRulesCommands = mkIf (!config.boot.initrd.systemd.enable && config.boot.initrd.services.udev.rules != "")
      ''
        cat <<'EOF' > $out/99-local.rules
        ${config.boot.initrd.services.udev.rules}
--- a/nixos/modules/services/misc/xmrig.nix
+++ b/nixos/modules/services/misc/xmrig.nix
@ -59,8 +59,8 @@ with lib;
      after = [ "network.target" ];
      description = "XMRig Mining Software Service";
      serviceConfig = {
-        ExecStartPre = "${cfg.package}/bin/xmrig --config=${configFile} --dry-run";
-        ExecStart = "${cfg.package}/bin/xmrig --config=${configFile}";
+        ExecStartPre = "${lib.getExe cfg.package} --config=${configFile} --dry-run";
+        ExecStart = "${lib.getExe cfg.package} --config=${configFile}";
        # https://xmrig.com/docs/miner/randomx-optimization-guide/msr
        # If you use recent XMRig with root privileges (Linux) or admin
        # privileges (Windows) the miner configure all MSR registers
--- a/nixos/modules/services/networking/multipath.nix
+++ b/nixos/modules/services/networking/multipath.nix
@ -546,8 +546,9 @@ in {
    # We do not have systemd in stage-1 boot so must invoke `multipathd`
    # with the `-1` argument which disables systemd calls. Invoke `multipath`
    # to display the multipath mappings in the output of `journalctl -b`.
+    # TODO: Implement for systemd stage 1
    boot.initrd.kernelModules = [ "dm-multipath" "dm-service-time" ];
-    boot.initrd.postDeviceCommands = ''
+    boot.initrd.postDeviceCommands = mkIf (!config.boot.initrd.systemd.enable) ''
      modprobe -a dm-multipath dm-service-time
      multipathd -s
      (set -x && sleep 1 && multipath -ll)
--- a/nixos/modules/system/boot/initrd-network.nix
+++ b/nixos/modules/system/boot/initrd-network.nix
@ -116,11 +116,11 @@ in

    boot.initrd.kernelModules = [ "af_packet" ];

-    boot.initrd.extraUtilsCommands = ''
+    boot.initrd.extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable) ''
      copy_bin_and_libs ${pkgs.klibc}/lib/klibc/bin.static/ipconfig
    '';

-    boot.initrd.preLVMCommands = mkBefore (
+    boot.initrd.preLVMCommands = mkIf (!config.boot.initrd.systemd.enable) (mkBefore (
      # Search for interface definitions in command line.
      ''
        ifaces=""
@ -148,9 +148,9 @@ in
        done
      ''

-      + cfg.postCommands);
+      + cfg.postCommands));

-    boot.initrd.postMountCommands = mkIf cfg.flushBeforeStage2 ''
+    boot.initrd.postMountCommands = mkIf (cfg.flushBeforeStage2 && !config.boot.initrd.systemd.enable) ''
      for iface in $ifaces; do
        ip address flush dev "$iface"
        ip link set dev "$iface" down
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -128,10 +128,6 @@ in {
        stage 2 counterparts such as {option}`systemd.services`,
        except that `restartTriggers` and `reloadTriggers` are not
        supported.
-
-        Note: This is experimental. Some of the `boot.initrd` options
-        are not supported when this is enabled, and the options under
-        `boot.initrd.systemd` are subject to change.
      '';
    };

@ -348,6 +344,27 @@ in {
  };

  config = mkIf (config.boot.initrd.enable && cfg.enable) {
+    assertions = map (name: {
+      assertion = lib.attrByPath name (throw "impossible") config.boot.initrd == "";
+      message = ''
+        systemd stage 1 does not support 'boot.initrd.${lib.concatStringsSep "." name}'. Please
+          convert it to analogous systemd units in 'boot.initrd.systemd'.
+
+            Definitions:
+        ${lib.concatMapStringsSep "\n" ({ file, ... }: "    - ${file}") (lib.attrByPath name (throw "impossible") options.boot.initrd).definitionsWithLocations}
+      '';
+    }) [
+      [ "preFailCommands" ]
+      [ "preDeviceCommands" ]
+      [ "preLVMCommands" ]
+      [ "postDeviceCommands" ]
+      [ "postMountCommands" ]
+      [ "extraUdevRulesCommands" ]
+      [ "extraUtilsCommands" ]
+      [ "extraUtilsCommandsTest" ]
+      [ "network" "postCommands" ]
+    ];
+
    system.build = { inherit initialRamdisk; };

    boot.initrd.availableKernelModules = [
--- a/nixos/modules/tasks/encrypted-devices.nix
+++ b/nixos/modules/tasks/encrypted-devices.nix
@ -110,10 +110,11 @@ in
          }) earlyEncDevs);
        forceLuksSupportInInitrd = true;
      };
-      postMountCommands =
-        concatMapStrings (dev:
+      # TODO: systemd stage 1
+      postMountCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
+        (concatMapStrings (dev:
          "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n"
-        ) lateEncDevs;
+        ) lateEncDevs);
    };
  };
 }
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@ -117,11 +117,11 @@ in
        copy_bin_and_libs ${pkgs.bcachefs-tools}/bin/bcachefs
        copy_bin_and_libs ${pkgs.bcachefs-tools}/bin/mount.bcachefs
      '';
-      boot.initrd.extraUtilsCommandsTest = ''
+      boot.initrd.extraUtilsCommandsTest = lib.mkIf (!config.boot.initrd.systemd.enable) ''
        $out/bin/bcachefs version
      '';

-      boot.initrd.postDeviceCommands = commonFunctions + concatStrings (mapAttrsToList openCommand bootFs);
+      boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable) (commonFunctions + concatStrings (mapAttrsToList openCommand bootFs));

      boot.initrd.systemd.services = lib.mapAttrs' (mkUnits "/sysroot") bootFs;
    })
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -584,17 +584,17 @@ in
      boot.initrd = mkIf inInitrd {
        kernelModules = [ "zfs" ] ++ optional (!cfgZfs.enableUnstable) "spl";
        extraUtilsCommands =
-          ''
+          mkIf (!config.boot.initrd.systemd.enable) ''
            copy_bin_and_libs ${cfgZfs.package}/sbin/zfs
            copy_bin_and_libs ${cfgZfs.package}/sbin/zdb
            copy_bin_and_libs ${cfgZfs.package}/sbin/zpool
          '';
-        extraUtilsCommandsTest = mkIf inInitrd
-          ''
+        extraUtilsCommandsTest =
+          mkIf (!config.boot.initrd.systemd.enable) ''
            $out/bin/zfs --help >/dev/null 2>&1
            $out/bin/zpool --help >/dev/null 2>&1
          '';
-        postDeviceCommands = concatStringsSep "\n" ([''
+        postDeviceCommands = mkIf (!config.boot.initrd.systemd.enable) (concatStringsSep "\n" ([''
            ZFS_FORCE="${optionalString cfgZfs.forceImportRoot "-f"}"
          ''] ++ [(importLib {
            # See comments at importLib definition.
@ -623,10 +623,10 @@ in
              else concatMapStrings (fs: ''
                zfs load-key -- ${escapeShellArg fs}
              '') (filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials)}
-        '') rootPools));
+        '') rootPools)));

        # Systemd in stage 1
-        systemd = {
+        systemd = mkIf config.boot.initrd.systemd.enable {
          packages = [cfgZfs.package];
          services = listToAttrs (map (pool: createImportService {
            inherit pool;
--- a/nixos/modules/tasks/swraid.nix
+++ b/nixos/modules/tasks/swraid.nix
@ -62,13 +62,13 @@ in {
        cp -v ${pkgs.mdadm}/lib/udev/rules.d/*.rules $out/
      '';

-      extraUtilsCommands = ''
+      extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
        # Add RAID mdadm tool.
        copy_bin_and_libs ${pkgs.mdadm}/sbin/mdadm
        copy_bin_and_libs ${pkgs.mdadm}/sbin/mdmon
      '';

-      extraUtilsCommandsTest = ''
+      extraUtilsCommandsTest = lib.mkIf (!config.boot.initrd.systemd.enable) ''
        $out/bin/mdadm --version
      '';

--- a/nixos/tests/common/auto-format-root-device.nix
+++ b/nixos/tests/common/auto-format-root-device.nix
@ -5,19 +5,19 @@
 # `virtualisation.fileSystems."/".autoFormat = true;`
 # instead.

-{ config, pkgs, ... }:
+{ lib, config, pkgs, ... }:

 let
  rootDevice = config.virtualisation.rootDevice;
 in
 {

-  boot.initrd.extraUtilsCommands = ''
+  boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
    # We need mke2fs in the initrd.
    copy_bin_and_libs ${pkgs.e2fsprogs}/bin/mke2fs
  '';

-  boot.initrd.postDeviceCommands = ''
+  boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
    # If the disk image appears to be empty, run mke2fs to
    # initialise.
    FSTYPE=$(blkid -o value -s TYPE ${rootDevice} || true)
--- a/nixos/tests/xfce.nix
+++ b/nixos/tests/xfce.nix
@ -66,6 +66,9 @@ import ./make-test-python.nix ({ pkgs, ...} : {
        machine.succeed("su - ${user.name} -c 'DISPLAY=:0 thunar >&2 &'")
        machine.wait_for_window("Thunar")
        machine.wait_for_text('(Pictures|Public|Templates|Videos)')
+
+      with subtest("Check if any coredumps are found"):
+        machine.succeed("(coredumpctl --json=short 2>&1 || true) | grep 'No coredumps found'")
        machine.sleep(10)
        machine.screenshot("screen")
    '';
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , fetchpatch
 , avahi
@ -50,6 +51,12 @@ stdenv.mkDerivation rec {
    sha256 = "d+g9dU9RrDjFQj847rVd5bPiYSjmC1EbAtLe/PNubBg=";
  };

+  # doesnt apply cleanly, so doing with substituteInPlace
+  # https://github.com/brummer10/guitarix/commit/39d7c21c4173eb0f121b1bbff439d9cf43331a00.patch
+  postPatch = ''
+    substituteInPlace wscript --replace "open(src_fname, 'rU')" "open(src_fname, 'r')"
+  '';
+
  nativeBuildInputs = [
    gettext
    hicolor-icon-theme
--- a/pkgs/applications/audio/mus/Cargo.lock
+++ b/pkgs/applications/audio/mus/Cargo.lock
@ -1,382 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi 0.1.19",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bufstream"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40e38929add23cdf8a366df9b0e088953150724bcbe5fc330b0d8eb3b328eec8"
-
-[[package]]
-name = "cc"
-version = "1.0.79"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
-
-[[package]]
-name = "clap"
-version = "4.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0b0588d44d4d63a87dbd75c136c166bbfd9a86a31cb89e09906521c7d3f5e3"
-dependencies = [
- "bitflags",
- "clap_derive",
- "clap_lex",
- "is-terminal",
- "once_cell",
- "strsim",
- "termcolor",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "684a277d672e91966334af371f1a7b5833f9aa00b07c84e92fbce95e00208ce8"
-dependencies = [
- "heck",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "783fe232adfca04f90f56201b26d79682d4cd2625e0bc7290b95123afe558ade"
-dependencies = [
- "os_str_bytes",
-]
-
-[[package]]
-name = "colored"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3616f750b84d8f0de8a58bda93e08e2a81ad3f523089b05f1dffecab48c6cbd"
-dependencies = [
- "atty",
- "lazy_static",
- "winapi",
-]
-
-[[package]]
-name = "errno"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
-
-[[package]]
-name = "io-lifetimes"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1abeb7a0dd0f8181267ff8adc397075586500b81b28a73e8a0208b00fc170fb3"
-dependencies = [
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "is-terminal"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0a45d56fe973d6db23972bf5bc46f988a4a2385deac9cc29572f09daef"
-dependencies = [
- "hermit-abi 0.3.1",
- "io-lifetimes",
- "rustix",
- "windows-sys",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.139"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4"
-
-[[package]]
-name = "mpd"
-version = "0.1.0"
-source = "git+https://github.com/kstep/rust-mpd?rev=e8b5c3d#e8b5c3d67bb602960aa21910430380d6626b3be7"
-dependencies = [
- "bufstream",
-]
-
-[[package]]
-name = "mus"
-version = "0.1.0"
-dependencies = [
- "clap",
- "colored",
- "mpd",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
-
-[[package]]
-name = "os_str_bytes"
-version = "6.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b7820b9daea5457c9f21c69448905d723fbd21136ccf521748f23fd49e723ee"
-
-[[package]]
-name = "proc-macro-error"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.51"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "rustix"
-version = "0.36.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f43abb88211988493c1abb44a70efa56ff0ce98f233b7b276146f1f3f7ba9644"
-dependencies = [
- "bitflags",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys",
- "windows-sys",
-]
-
-[[package]]
-name = "strsim"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
-
-[[package]]
-name = "syn"
-version = "1.0.107"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f4064b5b16e03ae50984a5a8ed5d4f8803e6bc1fd170a3cda91a1be4b18e3f5"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84a22b9f218b40614adcb3f4ff08b703773ad44fa9423e4e0d346d5db86e4ebc"
-
-[[package]]
-name = "version_check"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2522491fbfcd58cc84d47aeb2958948c4b8982e9a2d8a2a35bbaed431390e7"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9864e83243fdec7fc9c5444389dcbbfd258f745e7853198f365e3c4968a608"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c8b1b673ffc16c47a9ff48570a9d85e25d265735c503681332589af6253c6c7"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3887528ad530ba7bdbb1faa8275ec7a1155a45ffa57c37993960277145d640"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf4d1122317eddd6ff351aa852118a2418ad4214e6613a50e0191f7004372605"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1040f221285e17ebccbc2591ffdc2d44ee1f9186324dd3e84e99ac68d699c45"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "628bfdf232daa22b0d64fdb62b09fcc36bb01f05a3939e20ab73aaf9470d0463"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "447660ad36a13288b1db4d4248e857b510e8c3a225c822ba4fb748c0aafecffd"
--- a/pkgs/applications/audio/mus/default.nix
+++ b/pkgs/applications/audio/mus/default.nix
@ -2,21 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mus";
-  version = "0.1.0";
+  version = "0.2.0";

  src = fetchFromSourcehut {
    owner = "~sfr";
    repo = pname;
    rev = version;
-    hash = "sha256-s7rizOieOmzK0Stkk1SWe9h/5DoaH6MMmL/5QFeezt0=";
+    hash = "sha256-yvMV+lhU9Wtwrhw0RKRUNFNznvZP0zcnT6jqPaqzhUs=";
  };

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "mpd-0.1.0" = "sha256-5UC6aFNJU9B5AlgJ7uPO+W7e2MHpvTu2OpktjiIXMfc=";
-    };
-  };
+  cargoHash = "sha256-K9B8y9pOHcAOrUCmCB0zW2wy81DTF3K97gPYmAiKwAM=";

  meta = with lib; {
    description = "a pretty good mpd client";
--- a/pkgs/applications/audio/pipecontrol/default.nix
+++ b/pkgs/applications/audio/pipecontrol/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "pipecontrol";
-  version = "0.2.10";
+  version = "0.2.11";

  src = fetchFromGitHub {
    owner = "portaloffreedom";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-MSm9rW41x8qvPuDermOPIYpxgblk5hlKIQsUEAvCzMo=";
+    sha256 = "sha256-jMP8hPv0Rv/OIVIzR/5R8LmEcyzwtcof9Ire86WtISc=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/hydrus/0001-inform-nixpkgs.patch
+++ b/pkgs/applications/graphics/hydrus/0001-inform-nixpkgs.patch
@ -1,18 +0,0 @@
-diff --git a/hydrus/core/HydrusConstants.py b/hydrus/core/HydrusConstants.py
-index 809338ef..9125928f 100644
--- a/hydrus/core/HydrusConstants.py
-+++ b/hydrus/core/HydrusConstants.py
-@@ -59,12 +59,7 @@ elif PLATFORM_HAIKU:
- RUNNING_FROM_SOURCE = sys.argv[0].endswith( '.py' ) or sys.argv[0].endswith( '.pyw' )
- RUNNING_FROM_MACOS_APP = os.path.exists( os.path.join( BASE_DIR, 'running_from_app' ) )
- 
-if RUNNING_FROM_SOURCE:
-    NICE_RUNNING_AS_STRING = 'from source'
-elif RUNNING_FROM_FROZEN_BUILD:
-    NICE_RUNNING_AS_STRING = 'from frozen build'
-elif RUNNING_FROM_MACOS_APP:
-    NICE_RUNNING_AS_STRING = 'from App'
-+NICE_RUNNING_AS_STRING = "from nixpkgs (source)"
- 
- BIN_DIR = os.path.join( BASE_DIR, 'bin' )
- HELP_DIR = os.path.join( BASE_DIR, 'help' )
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -12,21 +12,16 @@

 python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "544";
+  version = "549";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    rev = "refs/tags/v${version}";
-    hash = "sha256-e3VvkdJAQx5heKDJ1Ms6XpXrXWdzv48f8yu0DHfPy1A=";
+    hash = "sha256-y3WFQhPE8H0198Xu3Dn9YAqaX8YvFJcdt90tebTg7qw=";
  };

-  patches = [
-    # Nixpkgs specific, can be removed if upstream makes a more reasonable check
-    ./0001-inform-nixpkgs.patch
-  ];
-
  nativeBuildInputs = [
    wrapQtAppsHook
    python3Packages.mkdocs-material
@ -75,31 +70,35 @@ python3Packages.buildPythonPackage rec {

  # most tests are failing, presumably because we are not using test.py
  checkPhase = ''
+    runHook preCheck
+
    nosetests $src/hydrus/test  \
-    -e TestClientAPI \
-    -e TestClientConstants \
-    -e TestClientDaemons \
-    -e TestClientData \
-    -e TestClientDB \
-    -e TestClientDBDuplicates \
-    -e TestClientDBTags \
-    -e TestClientImageHandling \
-    -e TestClientImportOptions \
-    -e TestClientListBoxes \
-    -e TestClientMigration \
-    -e TestClientNetworking \
-    -e TestClientTags \
-    -e TestClientThreading \
-    -e TestDialogs \
-    -e TestFunctions \
-    -e TestHydrusNetwork \
-    -e TestHydrusNATPunch \
-    -e TestHydrusSerialisable \
-    -e TestHydrusServer \
-    -e TestHydrusSessions \
-    -e TestServer \
-    -e TestClientMetadataMigration \
-    -e TestClientFileStorage \
+      -e TestClientAPI \
+      -e TestClientConstants \
+      -e TestClientDaemons \
+      -e TestClientData \
+      -e TestClientDB \
+      -e TestClientDBDuplicates \
+      -e TestClientDBTags \
+      -e TestClientImageHandling \
+      -e TestClientImportOptions \
+      -e TestClientListBoxes \
+      -e TestClientMigration \
+      -e TestClientNetworking \
+      -e TestClientTags \
+      -e TestClientThreading \
+      -e TestDialogs \
+      -e TestFunctions \
+      -e TestHydrusNetwork \
+      -e TestHydrusNATPunch \
+      -e TestHydrusSerialisable \
+      -e TestHydrusServer \
+      -e TestHydrusSessions \
+      -e TestServer \
+      -e TestClientMetadataMigration \
+      -e TestClientFileStorage \
+
+    runHook postCheck
  '';

  outputs = [ "out" "doc" ];
@ -112,7 +111,8 @@ python3Packages.buildPythonPackage rec {
    chmod -x $out/${python3Packages.python.sitePackages}/static/*.{png,svg,ico}
    # Build docs
    mkdocs build -d help
-    mv help $out/doc/
+    mkdir -p $doc/share/doc
+    mv help $doc/share/doc/hydrus

    # install the hydrus binaries
    mkdir -p $out/bin
--- a/pkgs/applications/misc/hyprdim/default.nix
+++ b/pkgs/applications/misc/hyprdim/default.nix
@ -2,38 +2,41 @@
 , rustPlatform
 , fetchFromGitHub
 , installShellFiles
+, nix-update-script
 }:

 rustPlatform.buildRustPackage rec {
  pname = "hyprdim";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "donovanglover";
-    repo = pname;
+    repo = "hyprdim";
    rev = version;
-    hash = "sha256-6HeVLgEJDPy4cWL5td3Xl7+a6WUFZWUFynvBzPhItcg=";
+    hash = "sha256-b2T/ueinKiheuK+siV29vJfEsEodq6qT2J3XxvoD/14=";
  };

-  cargoHash = "sha256-qYX5o64X8PsFcTYuZ82lIShyUN69oTzQIHrQH4B7iIw=";
+  cargoHash = "sha256-Sf32vaqcxVdg6/kDidxBSr5XDWg3aNEBpEl31do2ZJ8=";

  nativeBuildInputs = [
    installShellFiles
  ];

  postInstall = ''
-    installManPage man/hyprdim.1
+    installManPage target/man/hyprdim.1

    installShellCompletion --cmd hyprdim \
-      --bash <(cat completions/hyprdim.bash) \
-      --fish <(cat completions/hyprdim.fish) \
-      --zsh <(cat completions/_hyprdim)
+      --bash <(cat target/completions/hyprdim.bash) \
+      --fish <(cat target/completions/hyprdim.fish) \
+      --zsh <(cat target/completions/_hyprdim)
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "Automatically dim windows in Hyprland when switching between them";
    homepage = "https://github.com/donovanglover/hyprdim";
-    license = licenses.mit;
+    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ donovanglover ];
    mainProgram = "hyprdim";
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@ -1,6 +1,7 @@
 { buildPythonApplication
 , lib
 , fetchFromGitHub
+, fetchpatch

  # build inputs
 , atk
@ -75,15 +76,24 @@ let
 in
 buildPythonApplication rec {
  pname = "lutris-unwrapped";
-  version = "0.5.13";
+  version = "0.5.14";

  src = fetchFromGitHub {
    owner = "lutris";
    repo = "lutris";
    rev = "v${version}";
-    hash = "sha256-ectrfbIkPhIqfhkavDpBCNdLPnGQhCnfFYwTf2IxB50=";
+    hash = "sha256-h7oHFVqMJU1HuuUgh5oKXxr9uaIPHz7Q4gf8ONLzric=";
  };

+  # Backport patch to fix a failing test
+  # FIXME: remove in next release
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/lutris/lutris/commit/1f1d554df3b38da64fc65557ad619e55e050641e.patch";
+      hash = "sha256-kVK1RX6T1ijffWVU7VEt2fR62QpvI6VZebiKPgEE/N8=";
+    })
+  ];
+
  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
  buildInputs = [
    atk
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.25.1";
+  version = "2.25.2";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = "spicetify-cli";
    rev = "v${version}";
-    hash = "sha256-81dfAekWvMcp1Jar+jlXRiJr6UmHCdJZ0ML/6fFnvRs=";
+    hash = "sha256-llPxR4awKBBv0jiLr5MbE33D5KZx3LmBo5BDwZI8ZM0=";
  };

  vendorHash = "sha256-VktAO3yKCdm5yz/RRLeLv6zzyGrwuHC/i8WdJtqZoYc=";
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -66,6 +66,7 @@ stdenv.mkDerivation rec {
    description = "Monero (XMR) CPU miner";
    homepage = "https://github.com/xmrig/xmrig";
    license = licenses.gpl3Plus;
+    mainProgram = "xmrig";
    platforms = platforms.unix;
    maintainers = with maintainers; [ kim0 ];
  };
--- a/pkgs/applications/misc/xmrig/moneroocean.nix
+++ b/pkgs/applications/misc/xmrig/moneroocean.nix
@ -15,6 +15,7 @@ xmrig.overrideAttrs (oldAttrs: rec {
    description = "A fork of the XMRig CPU miner with support for algorithm switching";
    homepage = "https://github.com/MoneroOcean/xmrig";
    license = licenses.gpl3Plus;
+    mainProgram = "xmrig";
    platforms = platforms.unix;
    maintainers = with maintainers; [ j0hax ];
  };
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "civo";
-  version = "1.0.67";
+  version = "1.0.68";

  src = fetchFromGitHub {
    owner  = "civo";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-EBpKJrQ+zdoMlTbOsWCAj2Hfu8OqQTFb0l+i2UdkNSs=";
+    sha256 = "sha256-qvcMA8oPDyi8WoIzr/3mu+2cHDXn5rgLUmnsGdOQXVM=";
  };

-  vendorHash = "sha256-AvAS3S7bepaTFPelE+Bj5/UuQIXEDvSAtDuFaPRC9sk=";
+  vendorHash = "sha256-C+XaX78iGKw6Ll7PMPFWWAy6fRwjrmbLhFdmqJPMrxc=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@ -1,16 +1,23 @@
-{ lib, stdenv, callPackage }:
+{ lib, callPackage, ... }@args:

 let
  k3s_builder = import ./builder.nix lib;
  common = opts: callPackage (k3s_builder opts);
+  # extraArgs is the extra arguments passed in by the caller to propogate downward.
+  # This is to allow all-packages.nix to do:
+  #
+  #     let k3s_1_23 = (callPackage ./path/to/k3s {
+  #       commonK3sArg = ....
+  #     }).k3s_1_23;
+  extraArgs = builtins.removeAttrs args [ "callPackage" ];
 in
 {
  k3s_1_26 = common ((import ./1_26/versions.nix) // {
    updateScript = [ ./update-script.sh "26" ];
-  }) { };
+  }) extraArgs;

  # 1_27 can be built with the same builder as 1_26
  k3s_1_27 = common ((import ./1_27/versions.nix) // {
    updateScript = [ ./update-script.sh "27" ];
-  }) { };
+  }) extraArgs;
 }
--- a/pkgs/applications/networking/instant-messengers/ferdium/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ferdium/default.nix
@ -6,13 +6,13 @@ let
    aarch64-linux = "arm64";
  }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  hash = {
-    amd64-linux_hash = "sha256-MmDU6Hn/s4IuTYBLYbz5okzHbx+dPOoKDtMXlLmZjQw=";
-    arm64-linux_hash = "sha256-m8sygpqWiwWzbHe+n8hfVdYr0YpZNfg1B+/nf5QXoyg=";
+    amd64-linux_hash = "sha256-ZCyAz+XVp2NJVUuMWyv5ubjMaoYBsjPAye/1vO2jv/w=";
+    arm64-linux_hash = "sha256-prdVwEn6eynzjLQ+aw2CS4PJ/JgG4QFKs9WDbzjV5oo=";
  }."${arch}-linux_hash";
 in mkFranzDerivation rec {
  pname = "ferdium";
  name = "Ferdium";
-  version = "6.5.2";
+  version = "6.6.0";
  src = fetchurl {
    url = "https://github.com/ferdium/ferdium-app/releases/download/v${version}/Ferdium-linux-${version}-${arch}.deb";
    inherit hash;
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "seaweedfs";
-  version = "3.55";
+  version = "3.58";

  src = fetchFromGitHub {
    owner = "seaweedfs";
    repo = "seaweedfs";
    rev = version;
-    hash = "sha256-qAyvGisj6GOjyRmqpTsxX/Zy8bx6+cAtmEId5us70+k=";
+    hash = "sha256-4USDCss2KYjyuwH55ZqMwBWsf7iDcjN7qxTSXvKDkus=";
  };

-  vendorHash = "sha256-F6Fqv5tUsty/uGwBnKM4r671Gh2T1+9Z2LRGAMF+M2g=";
+  vendorHash = "sha256-cbc6xKAneBCWpc4kUQUtgV5rrsggCGvVkt9tkypeCiE=";

  subPackages = [ "weed" ];

--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@ -27,13 +27,13 @@ assert !(pulseaudioSupport && portaudioSupport);

 gnuradioMinimal.pkgs.mkDerivation rec {
  pname = "gqrx";
-  version = "2.17.2";
+  version = "2.17.3";

  src = fetchFromGitHub {
    owner = "gqrx-sdr";
    repo = "gqrx";
    rev = "v${version}";
-    hash = "sha256-dwqb/TYNkaXSLXQ0QJEQpy1es0hgNrkNnZww9RpfTt8=";
+    hash = "sha256-dHbDy/aIsqBQG1raeN9nM/QtiFgy+Qhoj/ThN8LV6gI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
@ -93,5 +93,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = licenses.bsd3;
    maintainers = with maintainers; [ fufexan ];
    platforms = wayland.meta.platforms;
+    mainProgram = "hyprpicker";
  };
 })
--- a/pkgs/by-name/fc/fcitx5-material-color/package.nix
+++ b/pkgs/by-name/fc/fcitx5-material-color/package.nix
@ -0,0 +1,41 @@
+{ stdenvNoCC
+, fetchFromGitHub
+, lib
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "fcitx5-material-color";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "hosxy";
+    repo = "Fcitx5-Material-Color";
+    rev = finalAttrs.version;
+    hash = "sha256-i9JHIJ+cHLTBZUNzj9Ujl3LIdkCllTWpO1Ta4OT1LTc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    # https://gitlab.archlinux.org/archlinux/packaging/packages/fcitx5-material-color/-/blob/main/PKGBUILD?ref_type=heads#L16
+    install -Dm644 arrow.png radio.png -t $out/share/${finalAttrs.pname}/
+    for _variant in black blue brown deepPurple indigo orange pink red sakuraPink teal; do
+      _variant_name=Material-Color-$_variant
+      install -dm755 $_variant_name $out/share/fcitx5/themes/$_variant_name
+      ln -sv ../../../$pname/arrow.png $out/share/fcitx5/themes/$_variant_name/
+      ln -sv ../../../$pname/radio.png $out/share/fcitx5/themes/$_variant_name/
+      install -Dm644 theme-$_variant.conf $out/share/fcitx5/themes/$_variant_name/theme.conf
+      sed -i "s/^Name=.*/Name=$_variant_name/" $out/share/fcitx5/themes/$_variant_name/theme.conf
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Fcitx5 themes based on Material color";
+    homepage = "https://github.com/hosxy/Fcitx5-Material-Color";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ Cryolitia h7x4 ];
+    platforms = platforms.all;
+  };
+})
--- a/pkgs/by-name/fc/fcitx5-nord/package.nix
+++ b/pkgs/by-name/fc/fcitx5-nord/package.nix
@ -0,0 +1,33 @@
+{ stdenvNoCC
+, fetchFromGitHub
+, lib
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "fcitx5-nord";
+  version = "unstable-2021-07-27";
+
+  src = fetchFromGitHub {
+    owner = "tonyfettes";
+    repo = "fcitx5-nord";
+    rev = "bdaa8fb723b8d0b22f237c9a60195c5f9c9d74d1";
+    hash = "sha256-qVo/0ivZ5gfUP17G29CAW0MrRFUO0KN1ADl1I/rvchE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -pv $out/share/fcitx5/themes/
+    cp -rv Nord* $out/share/fcitx5/themes/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Fcitx5 theme based on Nord color";
+    homepage = "https://github.com/tonyfettes/fcitx5-nord";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Cryolitia ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/interpreters/joker/default.nix
+++ b/pkgs/development/interpreters/joker/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "joker";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "candid82";
    repo = "joker";
-    sha256 = "sha256-D9maTCNNJ9ivj76SEjddFSYNu+RLEZG+3SgOWEAD7aU=";
+    sha256 = "sha256-9SsSXLZFwqsAeWFGsba8OG9bdmfQjn6qQHHQK6IdHK8=";
  };

-  vendorHash = "sha256-ioC7R5Pm2nmHXI+/ko1UoNJCvEFzvhZcAcVtaFECz2c=";
+  vendorHash = "sha256-VRQUbGJTC2v8w/l4iaNn3vPX3AdV9Likp2nuG0PQieU=";

  doCheck = false;

--- a/pkgs/development/python-modules/notmuch2/default.nix
+++ b/pkgs/development/python-modules/notmuch2/default.nix
@ -16,9 +16,11 @@ buildPythonPackage {
    cffi
  ];
  buildInputs = [
-    python notmuch cffi
+    python notmuch
  ];

+  propagatedBuildInputs = [ cffi ];
+
  # since notmuch 0.35, this package expects _notmuch_config.py that is
  # generated by notmuch's configure script. We write one which references our
  # built libraries.
--- a/pkgs/development/python-modules/nunavut/default.nix
+++ b/pkgs/development/python-modules/nunavut/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "nunavut";
-  version = "2.1.1";
+  version = "2.3.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ENP1uhzQwFEk990b1RX2wNVpInaSSH80KNihX6XpQtU=";
+    hash = "sha256-+wqQ7JKC4aSgdM8YcYlO289CRpwX4VPxVqNlSABJJ0U=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pgcli/default.nix
+++ b/pkgs/development/python-modules/pgcli/default.nix
@ -22,11 +22,11 @@
 # integrating with ipython-sql
 buildPythonPackage rec {
  pname = "pgcli";
-  version = "3.5.0";
+  version = "4.0.0";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-zESNlRWfwJA9NhgpkneKCW7aV1LWYNR2cTg8jiv2M/E=";
+    hash = "sha256-C/X427yQR+BkbQFqQhMoomDEbP8hCJCLEbtVyWR17o0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pgvector/default.nix
+++ b/pkgs/development/python-modules/pgvector/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "pgvector";
-  version = "0.2.2";
+  version = "0.2.3";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "pgvector";
    repo = "pgvector-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qvLDFnrTYibdhjSeeIFI4YdpPRsvNBnQ23uqsLCblEo=";
+    hash = "sha256-KQROG0cHvKmdWssr7Git3JH0YguRPno/ZzYiQL7VhwU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@ -14,6 +14,7 @@
 , lxml
 , packaging
 , parsel
+, pexpect
 , protego
 , pydispatcher
 , pyopenssl
@ -42,6 +43,18 @@ buildPythonPackage rec {
    hash = "sha256-PL3tzgw/DgSC1hvi10WGg758188UsO5q37rduA9bNqU=";
  };

+  patches = [
+    # Fix compatiblity with Twisted>=23.8. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/scrapy/scrapy/commit/aa95ada42cdf570f840f55c463375f8a81b303f8.patch";
+      hash = "sha256-LuhA5BqtjSUgkotplvUCtvGNYOTrl0MJRCXiSBMDFzY=";
+      excludes = [
+        "tests/CrawlerProcess/sleeping.py"
+        "tests/test_crawler.py"
+      ];
+    })
+  ];
+
  nativeBuildInputs = [
    installShellFiles
  ];
@ -69,6 +82,7 @@ buildPythonPackage rec {
    botocore
    glibcLocales
    jmespath
+    pexpect
    pytestCheckHook
    sybil
    testfixtures
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@ -143,10 +143,8 @@ in buildPythonPackage rec {
    ./pthreadpool-disable-gcd.diff
  ] ++ lib.optionals stdenv.isLinux [
    # Propagate CUPTI to Kineto by overriding the search path with environment variables.
-    (fetchpatch {
-      url = "https://github.com/pytorch/pytorch/pull/108847/commits/7ae4d7c0e2dec358b4fe81538efe9da5eb580ec9.patch";
-      hash = "sha256-skFaDg98xcJqJfzxWk+qhUxPLHDStqvd0mec3PgksIg=";
-    })
+    # https://github.com/pytorch/pytorch/pull/108847
+    ./pytorch-pr-108847.patch
  ];

  postPatch = lib.optionalString rocmSupport ''
--- a/pkgs/development/python-modules/torch/pytorch-pr-108847.patch
+++ b/pkgs/development/python-modules/torch/pytorch-pr-108847.patch
@ -0,0 +1,31 @@
+From bf4050edab9f294a8e0060c47f906cd7a80f25a2 Mon Sep 17 00:00:00 2001
+From: Samuel Ainsworth <skainsworth@gmail.com>
+Date: Sat, 9 Sep 2023 02:04:09 +0000
+Subject: [PATCH] Dependencies.cmake: support building against CUPTI outside of
+ CUDA_SOURCE_DIR
+
+Limitation discovered in https://github.com/NixOS/nixpkgs/pull/249259.
+---
+ cmake/Dependencies.cmake | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/cmake/Dependencies.cmake b/cmake/Dependencies.cmake
+index 0602d534dc4c14..5f6a5f79f3e3dc 100644
+--- a/cmake/Dependencies.cmake
+++ b/cmake/Dependencies.cmake
+@@ -1879,6 +1879,7 @@ if(USE_KINETO)
+         ${CUDA_SOURCE_DIR}/extras/CUPTI/lib64
+         ${CUDA_SOURCE_DIR}/lib
+         ${CUDA_SOURCE_DIR}/lib64
+        $ENV{CUPTI_LIBRARY_DIR}
+         NO_DEFAULT_PATH)
+ 
+     find_path(CUPTI_INCLUDE_DIR cupti.h PATHS
+@@ -1886,6 +1887,7 @@ if(USE_KINETO)
+         ${CUDA_INCLUDE_DIRS}
+         ${CUDA_SOURCE_DIR}
+         ${CUDA_SOURCE_DIR}/include
+        $ENV{CUPTI_INCLUDE_DIR}
+         NO_DEFAULT_PATH)
+ 
+     if(CUPTI_LIBRARY_PATH AND CUPTI_INCLUDE_DIR)
--- a/pkgs/development/tools/build-managers/scala-cli/sources.json
+++ b/pkgs/development/tools/build-managers/scala-cli/sources.json
@ -1,21 +1,21 @@
 {
-  "version": "1.0.4",
+  "version": "1.0.5",
  "assets": {
    "aarch64-darwin": {
      "asset": "scala-cli-aarch64-apple-darwin.gz",
-      "sha256": "1gqnsm8pcwrk1v1v4xaj0j0w5xsmh3xv61h6sv72297illxxkbgq"
+      "sha256": "1p2ibii71digdz7qqqyahvdmmxyx19crwgn4bmas0hahl6mz553x"
    },
    "aarch64-linux": {
      "asset": "scala-cli-aarch64-pc-linux.gz",
-      "sha256": "124xqn18xyn35pg18p0rz40d8vjgijp6sc6wg4i81ih2mrxqxsbc"
+      "sha256": "1y9ghb829jz9yg4l7bgwnbl3cm7z7c20cyfc71v9iz8bq5ns9akr"
    },
    "x86_64-darwin": {
      "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "0r581a1zzlk7qbcsfbv79asj5y56zzx9249h099k29rbdjc3ya26"
+      "sha256": "12qjrm979pfbr0j7s59dyn7xkk585av7l0qxf77rz71009kvql0a"
    },
    "x86_64-linux": {
      "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "018cmr71qhdqvmprrfb8clsj718gfkdvyw48dqkf2jsafq0kglk2"
+      "sha256": "17x4nv5f8g1kx8l4n8ncxf60zwhwpqg8fh5cl8qy9s5h9h81n0rz"
    }
  }
 }
--- a/pkgs/development/tools/mysql-shell/default.nix
+++ b/pkgs/development/tools/mysql-shell/default.nix
@ -5,7 +5,6 @@
 , fetchurl
 , git
 , cctools
-, developer_cmds
 , DarwinTools
 , makeWrapper
 , CoreServices
@ -38,16 +37,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mysql-shell";
-  version = "8.0.34";
+  version = "8.0.35";

  srcs = [
    (fetchurl {
      url = "https://cdn.mysql.com//Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-      hash = "sha256-5l0Do8QmGLX7+ZBCrtMyCUAumyeqYsfIdD/9R4jY2x0=";
+      hash = "sha256-kXxe04cE6ZIRGFzkviTjOowZyRJB7XOvQYGm840VdMI=";
    })
    (fetchurl {
      url = "https://cdn.mysql.com//Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-QY1PmhGw3PhqZ79+H/Xbb9uOvmrBlFQRS7idnV5OXF0=";
+      hash = "sha256-2Dn/RR5BWHMsD/QzKYPo8tqyAQGmHCGwVl2+bzNfy5I=";
    })
  ];

@ -66,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [ pkg-config cmake git bison makeWrapper ]
    ++ lib.optionals (!stdenv.isDarwin) [ rpcsvc-proto ]
-    ++ lib.optionals stdenv.isDarwin [ cctools developer_cmds DarwinTools ];
+    ++ lib.optionals stdenv.isDarwin [ cctools DarwinTools ];

  buildInputs = [
    boost
--- a/pkgs/games/minecraft-servers/versions.json
+++ b/pkgs/games/minecraft-servers/versions.json
@ -1,8 +1,8 @@
 {
  "1.20": {
-    "url": "https://piston-data.mojang.com/v1/objects/84194a2f286ef7c14ed7ce0090dba59902951553/server.jar",
-    "sha1": "84194a2f286ef7c14ed7ce0090dba59902951553",
-    "version": "1.20.1",
+    "url": "https://piston-data.mojang.com/v1/objects/5b868151bd02b41319f54c8d4061b8cae84e665c/server.jar",
+    "sha1": "5b868151bd02b41319f54c8d4061b8cae84e665c",
+    "version": "1.20.2",
    "javaVersion": 17
  },
  "1.19": {
--- a/pkgs/servers/dendrite/default.nix
+++ b/pkgs/servers/dendrite/default.nix
@ -3,16 +3,16 @@

 buildGoModule rec {
  pname = "matrix-dendrite";
-  version = "0.13.3";
+  version = "0.13.4";

  src = fetchFromGitHub {
    owner = "matrix-org";
    repo = "dendrite";
    rev = "v${version}";
-    hash = "sha256-wM9ayB3L9pc3696Ze5hVZPKGwrB5fD+64Wf8DUIjf1k=";
+    hash = "sha256-Hy3QuwAHmZSsjy5A/1mrmrxdtle466HsQtDat3tYS8s=";
  };

-  vendorHash = "sha256-COljILLiAFoX8IShpAmLrxkw6yw7YQE4lpe8IR92j6g=";
+  vendorHash = "sha256-M7ogR1ya+sqlWVQpaXlvJy9YwhdM4XBDw8e2ZBPvEGY=";

  subPackages = [
    # The server
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "klipper";
-  version = "unstable-2023-09-10";
+  version = "unstable-2023-10-21";

  src = fetchFromGitHub {
    owner = "KevinOConnor";
    repo = "klipper";
-    rev = "8ef0f7d7e3d3b2ac7bc1e80ed3295ceca6bba4e7";
-    sha256 = "sha256-f/fPnZvtnASphYtvM9NBae0on8GWSwQPykukZ3XCy3M=";
+    rev = "f7567a0db954eabe4c6b8da3f73ce68693698646";
+    sha256 = "sha256-zOXoHTySTtq2fR7ujU6aiKAgvw11ogM8K+HJF1RoWEQ=";
  };

  sourceRoot = "${src.name}/klippy";
--- a/pkgs/servers/mail/mailpit/default.nix
+++ b/pkgs/servers/mail/mailpit/default.nix
@ -11,13 +11,13 @@

 let

-  version = "1.7.1";
+  version = "1.9.9";

  src = fetchFromGitHub {
    owner = "axllent";
    repo = "mailpit";
    rev = "v${version}";
-    hash = "sha256-jT9QE0ikp9cJlT8qtfPPjKOUuqWyQk94D3UbkyaGXa8=";
+    hash = "sha256-WPfr1LHOgOFsF2g3junJ0km0gOk/LC52jekJ8BXlqP0=";
  };

  # Separate derivation, because if we mix this in buildGoModule, the separate
@ -29,7 +29,7 @@ let

    npmDeps = fetchNpmDeps {
      inherit src;
-      hash = "sha256-6VCs8125fTJkZW+eZgK56j7ccK8tcGhIXiq2HkYp4XM=";
+      hash = "sha256-RaXD+WfNywItveKzc+KWOw38H1EZ2yukgbMrtOfPSJc=";
    };

    nativeBuildInputs = [ nodejs python3 libtool npmHooks.npmConfigHook ];
@ -49,7 +49,7 @@ buildGoModule {
  pname = "mailpit";
  inherit src version;

-  vendorHash = "sha256-XBYIO7fdo5EahJB7EcAuY9SGKZb8dsvoJHp/D5LO5Qo=";
+  vendorHash = "sha256-akt72aBoiQKp1Hxf3NgzSmfgmsnjpheIh62lPCTyHBs=";

  CGO_ENABLED = 0;

@ -65,5 +65,6 @@ buildGoModule {
    changelog = "https://github.com/axllent/mailpit/releases/tag/v${version}";
    maintainers = with maintainers; [ stephank ];
    license = licenses.mit;
+    mainProgram = "mailpit";
  };
 }
--- a/pkgs/servers/mastodon/source.nix
+++ b/pkgs/servers/mastodon/source.nix
@ -8,7 +8,7 @@ applyPatches {
  src = fetchFromGitHub {
    owner = "mastodon";
    repo = "mastodon";
-    rev = "${version}";
+    rev = "v${version}";
    hash = "sha256-xpE/mg2AeioW6NThUjLS+SBxGavG4w1xtp3BOMADfYo=";
  };
  patches = [];
--- a/pkgs/servers/mastodon/update.sh
+++ b/pkgs/servers/mastodon/update.sh
@ -90,7 +90,7 @@ applyPatches {
  src = fetchFromGitHub {
    owner = "$OWNER";
    repo = "$REPO";
-    rev = "\${version}";
+    rev = "v\${version}";
    hash = "$HASH";
  };
  patches = [$PATCHES];
--- a/pkgs/tools/misc/cf-terraforming/default.nix
+++ b/pkgs/tools/misc/cf-terraforming/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "cf-terraforming";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cf-terraforming";
    rev = "v${version}";
-    sha256 = "sha256-9aGN3TP4bMz4V0MRrNFxMm16k9RfvU5iDVwe+Ws4Ask=";
+    sha256 = "sha256-4thb0AFlSYQ90SkdyTSiFUc6vTRpt6KX2nH/thMuv4o=";
  };

-  vendorHash = "sha256-fswT6t2LP6gRmCHrSHVJGdNc6gic3rMSrE+STe5oiyQ=";
+  vendorHash = "sha256-bfxF0qlEbZDczEuFhckqsG00/IzuM18ut/AQ9EMwdh0=";
  ldflags = [ "-X github.com/cloudflare/cf-terraforming/internal/app/cf-terraforming/cmd.versionString=${version}" ];

  # The test suite insists on downloading a binary release of Terraform from
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "chezmoi";
-  version = "2.40.0";
+  version = "2.40.4";

  src = fetchFromGitHub {
    owner = "twpayne";
    repo = "chezmoi";
    rev = "v${version}";
-    hash = "sha256-0FzhIsCsOVoQpxpxl83Ei8v8ANbanltLi5nvOt0kWsA=";
+    hash = "sha256-PtIT2PS88jkX/ERHYKRwhvCnCnlAP0lM0FDv74zi32M=";
  };

-  vendorHash = "sha256-941uw/7NoVnW3Ul5bAJLyvQ+RrNoiUVJHpKlfkiGT8c=";
+  vendorHash = "sha256-O9Ywq8LunS/0yBX9p9M2mzm+auvX1ynYaAY4EoBaE94=";

  doCheck = false;

--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@ -16,14 +16,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "esphome";
-  version = "2023.10.3";
+  version = "2023.10.4";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-rvU2eA9HEZv77cn2K4xEL/hqBk2hauFv7eUHZzR5Q5s=";
+    hash = "sha256-rDq6uudT1kW97TiE9FswfgzLlNPTo8+YjD7HEvbrMn0=";
  };

  postPatch = ''
--- a/pkgs/tools/networking/ddns-go/default.nix
+++ b/pkgs/tools/networking/ddns-go/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "ddns-go";
-  version = "5.6.3";
+  version = "5.6.4";

  src = fetchFromGitHub {
    owner = "jeessy2";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-yOi2dowde2hTZOWq1Trpf3tAypA6bD6SawP5geqK7Ms=";
+    hash = "sha256-wE4xzAH31yQ8xrA0dI7f961KNwK84gRSit+XNoW37pc=";
  };

  vendorHash = "sha256-e4mmUneFZCsteSrxfSeeky/pFc0sgNs0eRVnZQuG1ZI=";
--- a/pkgs/tools/networking/grpcurl/default.nix
+++ b/pkgs/tools/networking/grpcurl/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "grpcurl";
-  version = "1.8.8";
+  version = "1.8.9";

  src = fetchFromGitHub {
    owner = "fullstorydev";
    repo = "grpcurl";
    rev = "v${version}";
-    sha256 = "sha256-/GPFUMN6NQAoKOYJ6j9j0GmyEcYtYdOB7B8v2gNpNm8=";
+    sha256 = "sha256-zN/vleCph919HXZZ9wsXoJBXRT6y7gjyuQxnjRMzq00=";
  };

  subPackages = [ "cmd/grpcurl" ];

-  vendorHash = "sha256-8mGlmWuWae/NQ1aR0KVj0XS7rqROCs0PBDUkMAKijYU=";
+  vendorHash = "sha256-g5G966CuaVILGAgWunHAPrrkLjSv8pBj9R4bcLzyI+A=";

  ldflags = [ "-s" "-w" "-X main.version=${version}" ];

--- a/pkgs/tools/security/der-ascii/default.nix
+++ b/pkgs/tools/security/der-ascii/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "der-ascii";
-  version = "0.1.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "google";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1my93m1rx08kn2yms6k8w43byr8k61r1nra4b082j8b393wwxkqc";
+    sha256 = "sha256-LgxGSZQNxwx08mK9G8mSuBFTOd3pC1mvz3Wz7Y+6XR4=";
  };
  vendorHash = null;

--- a/pkgs/tools/security/fulcio/default.nix
+++ b/pkgs/tools/security/fulcio/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "fulcio";
-  version = "1.4.1";
+  version = "1.4.3";

  src = fetchFromGitHub {
    owner = "sigstore";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-6muoKiryWTGIoy1U3kWjuka0X1+gcrUQOvbuas26H1M=";
+    sha256 = "sha256-LT8J9s008XQtDtNdH1ungQREqQUrlTsoxnlRLKimqLY=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -20,7 +20,7 @@ buildGoModule rec {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorHash = "sha256-i9RK9kNSB9FOnVbYcHLBHt8KKBQCNsEDONNm1IxgTJc=";
+  vendorHash = "sha256-ImZJXdOfMepMFU1z47XyNU39NGGdiCzQji2/tKVfibQ=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/security/kubeclarity/default.nix
+++ b/pkgs/tools/security/kubeclarity/default.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "kubeclarity";
-  version = "2.21.1";
+  version = "2.22.0";

  src = fetchFromGitHub {
    owner = "openclarity";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-+kWqw8o5KlVciWIB8cCVkMuiqW0wpIfua5qVgXZG3ww=";
+    hash = "sha256-VpTLf4Z2l9Ix92GzcyJvj4j2j+aff8nc2qW9+2uaPBs=";
  };

  vendorHash = "sha256-kYdKCHqzDbfCGMlTMPSHAQkSLyhkCl/OvV7CF5jdyaY=";
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1084,7 +1084,7 @@ with pkgs;
  mya = callPackage ../applications/misc/mya { };

  mysql-shell = callPackage ../development/tools/mysql-shell {
-    inherit (darwin) cctools developer_cmds DarwinTools;
+    inherit (darwin) cctools DarwinTools;
    inherit (darwin.apple_sdk.frameworks) CoreServices;
    antlr = antlr4_10;
    boost = boost177; # Configure checks for specific version.
@ -32999,12 +32999,15 @@ with pkgs;

  jwm-settings-manager = callPackage ../applications/window-managers/jwm/jwm-settings-manager.nix { };

-  k3s_1_24 = callPackage ../applications/networking/cluster/k3s/1_24 { };
-  k3s_1_25 = callPackage ../applications/networking/cluster/k3s/1_25 { };
-  inherit (callPackage ../applications/networking/cluster/k3s { })
-    k3s_1_26
-    k3s_1_27
-  ;
+  k3s_1_24 = callPackage ../applications/networking/cluster/k3s/1_24 {
+    buildGoModule = buildGo120Module;
+  };
+  k3s_1_25 = callPackage ../applications/networking/cluster/k3s/1_25 {
+    buildGoModule = buildGo120Module;
+  };
+  inherit (callPackage ../applications/networking/cluster/k3s {
+    buildGoModule = buildGo120Module;
+  }) k3s_1_26 k3s_1_27;
  k3s = k3s_1_27;

  k3sup = callPackage ../applications/networking/cluster/k3sup { };