Merge master into haskell-updates

doc/stdenv/stdenv.chapter.md

@@ -16,7 +16,8 @@ stdenv.mkDerivation {
 }
 ```
 
-(`stdenv` needs to be in scope, so if you write this in a separate Nix expression from `pkgs/all-packages.nix`, you need to pass it as a function argument.) Specifying a `name` and a `src` is the absolute minimum Nix requires. For convenience, you can also use `pname` and `version` attributes and `mkDerivation` will automatically set `name` to `"${pname}-${version}"` by default. Since [RFC 0035](https://github.com/NixOS/rfcs/pull/35), this is preferred for packages in Nixpkgs, as it allows us to reuse the version easily:
+(`stdenv` needs to be in scope, so if you write this in a separate Nix expression from `pkgs/all-packages.nix`, you need to pass it as a function argument.) Specifying a `name` and a `src` is the absolute minimum Nix requires. For convenience, you can also use `pname` and `version` attributes and `mkDerivation` will automatically set `name` to `"${pname}-${version}"` by default.
+**Since [RFC 0035](https://github.com/NixOS/rfcs/pull/35), this is preferred for packages in Nixpkgs**, as it allows us to reuse the version easily:
 
 ```nix
 stdenv.mkDerivation rec {
@@ -33,7 +34,8 @@ Many packages have dependencies that are not provided in the standard environmen
 
 ```nix
 stdenv.mkDerivation {
-  name = "libfoo-1.2.3";
+  pname = "libfoo";
+  version = "1.2.3";
   ...
   buildInputs = [libbar perl ncurses];
 }
@@ -45,7 +47,8 @@ Often it is necessary to override or modify some aspect of the build. To make th
 
 ```nix
 stdenv.mkDerivation {
-  name = "fnord-4.5";
+  pname = "fnord";
+  version = "4.5";
   ...
   buildPhase = ''
     gcc foo.c -o foo
@@ -65,7 +68,8 @@ While the standard environment provides a generic builder, you can still supply
 
 ```nix
 stdenv.mkDerivation {
-  name = "libfoo-1.2.3";
+  pname = "libfoo";
+  version = "1.2.3";
   ...
   builder = ./builder.sh;
 }

maintainers/maintainer-list.nix

@@ -5479,6 +5479,11 @@
     githubId = 2430469;
     name = "Gavin Rogers";
   };
+  gaykitty = {
+    github = "gaykitty";
+    githubId = 126119280;
+    name = "Kitty Pride";
+  };
   gazally = {
     email = "gazally@runbox.com";
     github = "gazally";
@@ -6902,6 +6907,12 @@
     githubId = 6874204;
     name = "Jason Carr";
   };
+  jasonodoom = {
+    email = "jasonodoom@riseup.net";
+    github = "jasonodoom";
+    githubId = 6789916;
+    name = "Jason Odoom";
+  };
   javaguirre = {
     email = "contacto@javaguirre.net";
     github = "javaguirre";

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -40,6 +40,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [cups-pdf-to-pdf](https://github.com/alexivkin/CUPS-PDF-to-PDF), a pdf-generating cups backend based on [cups-pdf](https://www.cups-pdf.de/). Available as [services.printing.cups-pdf](#opt-services.printing.cups-pdf.enable).
 
+- [clash-verge](https://github.com/zzzgydi/clash-verge), A Clash GUI based on tauri. Available as [programs.clash-verge](#opt-programs.clash-verge.enable).
+
 - [Cloudlog](https://www.magicbug.co.uk/cloudlog/), a web-based Amateur Radio logging application. Available as [services.cloudlog](#opt-services.cloudlog.enable).
 
 - [fzf](https://github.com/junegunn/fzf), a command line fuzzyfinder. Available as [programs.fzf](#opt-programs.fzf.fuzzyCompletion).
@@ -123,6 +125,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `ssh` client tool now disables the `~C` escape sequence by default. This can be re-enabled by setting `EnableEscapeCommandline yes`
 
+- The `ssh` module does not read `/etc/ssh/ssh_known_hosts2` anymore since this location is [deprecated since 2001](https://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2).
+
+- The openssh module does not read `~/.ssh/authorized_keys2` anymore since this location is [deprecated since 2001](https://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2).
+
 - `podman` now uses the `netavark` network stack. Users will need to delete all of their local containers, images, volumes, etc, by running `podman system reset --force` once before upgrading their systems.
 
 - `git-bug` has been updated to at least version 0.8.0, which includes backwards incompatible changes. The `git-bug-migration` package can be used to upgrade existing repositories.
@@ -131,7 +137,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `keepassx` and `keepassx2` have been removed, due to upstream [stopping development](https://www.keepassx.org/index.html%3Fp=636.html). Consider [KeePassXC](https://keepassxc.org) as a maintained alternative.
 
-- The `services.kubo.settings` option is now no longer stateful. If you changed any of the options in `services.kubo.settings` in the past and then removed them from your NixOS configuration again, those changes are still in your Kubo configuration file but will now be reset to the default. If you're unsure, you may want to make a backup of your configuration file (probably /var/lib/ipfs/config) and compare after the update.
+- The [services.kubo.settings](#opt-services.kubo.settings) option is now no longer stateful. If you changed any of the options in [services.kubo.settings](#opt-services.kubo.settings) in the past and then removed them from your NixOS configuration again, those changes are still in your Kubo configuration file but will now be reset to the default. If you're unsure, you may want to make a backup of your configuration file (probably /var/lib/ipfs/config) and compare after the update.
+
+- The Kubo HTTP API will no longer listen on localhost and will instead only listen on a Unix domain socket by default. Read the [services.kubo.settings.Addresses.API](#opt-services.kubo.settings.Addresses.API) option description for more information.
 
 - The EC2 image module no longer fetches instance metadata in stage-1. This results in a significantly smaller initramfs, since network drivers no longer need to be included, and faster boots, since metadata fetching can happen in parallel with startup of other services.
   This breaks services which rely on metadata being present by the time stage-2 is entered. Anything which reads EC2 metadata from `/etc/ec2-metadata` should now have an `after` dependency on `fetch-ec2-metadata.service`
@@ -334,7 +342,7 @@ In addition to numerous new and upgraded packages, this release has the followin
     [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
     can be directly written as attribute-set in Nix within this option.
 
-- `services.kubo` now unmounts `ipfsMountDir` and `ipnsMountDir` even if it is killed unexpectedly when 'autoMount` is enabled.
+- `services.kubo` now unmounts `ipfsMountDir` and `ipnsMountDir` even if it is killed unexpectedly when `autoMount` is enabled.
 
 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.
 

nixos/modules/module-list.nix

@@ -149,6 +149,7 @@
   ./programs/cdemu.nix
   ./programs/cfs-zen-tweaks.nix
   ./programs/chromium.nix
+  ./programs/clash-verge.nix
   ./programs/cnping.nix
   ./programs/command-not-found/command-not-found.nix
   ./programs/criu.nix

nixos/modules/programs/clash-verge.nix

@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+{
+  options.programs.clash-verge = {
+    enable = lib.mkEnableOption (lib.mdDoc ''
+      Clash Verge.
+    '');
+
+    autoStart = lib.mkEnableOption (lib.mdDoc ''
+      Clash Verge Auto Launch.
+    '');
+
+    tunMode = lib.mkEnableOption (lib.mdDoc ''
+      Clash Verge Tun Mode.
+    '');
+  };
+
+  config =
+    let
+      cfg = config.programs.clash-verge;
+    in
+    lib.mkIf cfg.enable {
+
+      environment.systemPackages = [
+        pkgs.clash-verge
+        (lib.mkIf cfg.autoStart (pkgs.makeAutostartItem {
+          name = "clash-verge";
+          package = pkgs.clash-verge;
+        }))
+      ];
+
+      security.wrappers.clash-verge = lib.mkIf cfg.tunMode {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_net_bind_service,cap_net_admin=+ep";
+        source = "${lib.getExe pkgs.clash-verge}";
+      };
+    };
+
+  meta.maintainers = with lib.maintainers; [ zendo ];
+}

nixos/modules/programs/regreet.nix

@@ -50,7 +50,7 @@ in
   config = lib.mkIf cfg.enable {
     services.greetd = {
       enable = lib.mkDefault true;
-      settings.default_session.command = lib.mkDefault "${lib.getExe pkgs.cage} -s -- ${lib.getExe cfg.package}";
+      settings.default_session.command = lib.mkDefault "${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} -s -- ${lib.getExe cfg.package}";
     };
 
     environment.etc = {

nixos/modules/programs/ssh.nix

@@ -26,7 +26,7 @@ let
       + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
     )) + "\n";
 
-  knownHostsFiles = [ "/etc/ssh/ssh_known_hosts" "/etc/ssh/ssh_known_hosts2" ]
+  knownHostsFiles = [ "/etc/ssh/ssh_known_hosts" ]
     ++ map pkgs.copyPathToStore cfg.knownHostsFiles;
 
 in
@@ -232,9 +232,8 @@ in
         description = lib.mdDoc ''
           Files containing SSH host keys to set as global known hosts.
           `/etc/ssh/ssh_known_hosts` (which is
-          generated by {option}`programs.ssh.knownHosts`) and
+          generated by {option}`programs.ssh.knownHosts`) is
-          `/etc/ssh/ssh_known_hosts2` are always
+          always included.
-          included.
         '';
         example = literalExpression ''
           [

nixos/modules/programs/zsh/zsh.nix

@@ -236,6 +236,9 @@ in
           setopt ${concatStringsSep " " cfg.setOptions}
         ''}
 
+        # Alternative method of determining short and full hostname.
+        HOST=${config.networking.fqdnOrHostName}
+
         # Setup command line history.
         # Don't export these, otherwise other shells (bash) will try to use same HISTFILE.
         SAVEHIST=${toString cfg.histSize}

nixos/modules/services/mail/roundcube.nix

@@ -7,7 +7,7 @@ let
   fpm = config.services.phpfpm.pools.roundcube;
   localDB = cfg.database.host == "localhost";
   user = cfg.database.username;
-  phpWithPspell = pkgs.php80.withExtensions ({ enabled, all }: [ all.pspell ] ++ enabled);
+  phpWithPspell = pkgs.php81.withExtensions ({ enabled, all }: [ all.pspell ] ++ enabled);
 in
 {
   options.services.roundcube = {

nixos/modules/services/network-filesystems/kubo.nix

@@ -22,6 +22,18 @@ let
 
   configFile = settingsFormat.generate "kubo-config.json" customizedConfig;
 
+  # Create a fake repo containing only the file "api".
+  # $IPFS_PATH will point to this directory instead of the real one.
+  # For some reason the Kubo CLI tools insist on reading the
+  # config file when it exists. But the Kubo daemon sets the file
+  # permissions such that only the ipfs user is allowed to read
+  # this file. This prevents normal users from talking to the daemon.
+  # To work around this terrible design, create a fake repo with no
+  # config file, only an api file and everything should work as expected.
+  fakeKuboRepo = pkgs.writeTextDir "api" ''
+    /unix/run/ipfs.sock
+  '';
+
   kuboFlags = utils.escapeSystemdExecArgs (
     optional cfg.autoMount "--mount" ++
     optional cfg.enableGC "--enable-gc" ++
@@ -38,6 +50,22 @@ let
 
   splitMulitaddr = addrRaw: lib.tail (lib.splitString "/" addrRaw);
 
+  multiaddrsToListenStreams = addrIn:
+    let
+      addrs = if builtins.typeOf addrIn == "list"
+      then addrIn else [ addrIn ];
+      unfilteredResult = map multiaddrToListenStream addrs;
+    in
+      builtins.filter (addr: addr != null) unfilteredResult;
+
+  multiaddrsToListenDatagrams = addrIn:
+    let
+      addrs = if builtins.typeOf addrIn == "list"
+      then addrIn else [ addrIn ];
+      unfilteredResult = map multiaddrToListenDatagram addrs;
+    in
+      builtins.filter (addr: addr != null) unfilteredResult;
+
   multiaddrToListenStream = addrRaw:
     let
       addr = splitMulitaddr addrRaw;
@@ -154,13 +182,18 @@ in
 
           options = {
             Addresses.API = mkOption {
-              type = types.str;
+              type = types.oneOf [ types.str (types.listOf types.str) ];
-              default = "/ip4/127.0.0.1/tcp/5001";
+              default = [ ];
-              description = lib.mdDoc "Where Kubo exposes its API to";
+              description = lib.mdDoc ''
+                Multiaddr or array of multiaddrs describing the address to serve the local HTTP API on.
+                In addition to the multiaddrs listed here, the daemon will also listen on a Unix domain socket.
+                To allow the ipfs CLI tools to communicate with the daemon over that socket,
+                add your user to the correct group, e.g. `users.users.alice.extraGroups = [ config.services.kubo.group ];`
+              '';
             };
 
             Addresses.Gateway = mkOption {
-              type = types.str;
+              type = types.oneOf [ types.str (types.listOf types.str) ];
               default = "/ip4/127.0.0.1/tcp/8080";
               description = lib.mdDoc "Where the IPFS Gateway can be reached";
             };
@@ -248,7 +281,7 @@ in
     ];
 
     environment.systemPackages = [ cfg.package ];
-    environment.variables.IPFS_PATH = cfg.dataDir;
+    environment.variables.IPFS_PATH = fakeKuboRepo;
 
     # https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size
     boot.kernel.sysctl."net.core.rmem_max" = mkDefault 2500000;
@@ -338,27 +371,23 @@ in
       wantedBy = [ "sockets.target" ];
       socketConfig = {
         ListenStream =
-          let
+          [ "" ] ++ (multiaddrsToListenStreams cfg.settings.Addresses.Gateway);
-            fromCfg = multiaddrToListenStream cfg.settings.Addresses.Gateway;
-          in
-          [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
         ListenDatagram =
-          let
+          [ "" ] ++ (multiaddrsToListenDatagrams cfg.settings.Addresses.Gateway);
-            fromCfg = multiaddrToListenDatagram cfg.settings.Addresses.Gateway;
-          in
-          [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
       };
     };
 
     systemd.sockets.ipfs-api = {
       wantedBy = [ "sockets.target" ];
-      # We also include "%t/ipfs.sock" because there is no way to put the "%t"
+      socketConfig = {
-      # in the multiaddr.
+        # We also include "%t/ipfs.sock" because there is no way to put the "%t"
-      socketConfig.ListenStream =
+        # in the multiaddr.
-        let
+        ListenStream =
-          fromCfg = multiaddrToListenStream cfg.settings.Addresses.API;
+          [ "" "%t/ipfs.sock" ] ++ (multiaddrsToListenStreams cfg.settings.Addresses.API);
-        in
+        SocketMode = "0660";
-        [ "" "%t/ipfs.sock" ] ++ lib.optional (fromCfg != null) fromCfg;
+        SocketUser = cfg.user;
+        SocketGroup = cfg.group;
+      };
     };
   };
 

nixos/modules/services/networking/ssh/sshd.nix

@@ -536,7 +536,7 @@ in
     # https://github.com/NixOS/nixpkgs/pull/10155
     # https://github.com/NixOS/nixpkgs/pull/41745
     services.openssh.authorizedKeysFiles =
-      [ "%h/.ssh/authorized_keys" "%h/.ssh/authorized_keys2" "/etc/ssh/authorized_keys.d/%u" ];
+      [ "%h/.ssh/authorized_keys" "/etc/ssh/authorized_keys.d/%u" ];
 
     services.openssh.extraConfig = mkOrder 0
       ''

nixos/modules/services/search/qdrant.nix

@@ -100,6 +100,7 @@ in {
       after = [ "network.target" ];
 
       serviceConfig = {
+        LimitNOFILE=65536;
         ExecStart = "${pkgs.qdrant}/bin/qdrant --config-path ${configFile}";
         DynamicUser = true;
         Restart = "on-failure";

nixos/modules/virtualisation/cri-o.nix

@@ -4,7 +4,10 @@ with lib;
 let
   cfg = config.virtualisation.cri-o;
 
-  crioPackage = (pkgs.cri-o.override { inherit (cfg) extraPackages; });
+  crioPackage = pkgs.cri-o.override {
+    extraPackages = cfg.extraPackages
+      ++ lib.optional (builtins.elem "zfs" config.boot.supportedFilesystems) config.boot.zfs.package;
+  };
 
   format = pkgs.formats.toml { };
 
@@ -19,7 +22,7 @@ in
     enable = mkEnableOption (lib.mdDoc "Container Runtime Interface for OCI (CRI-O)");
 
     storageDriver = mkOption {
-      type = types.enum [ "btrfs" "overlay" "vfs" ];
+      type = types.enum [ "aufs" "btrfs" "devmapper" "overlay" "vfs" "zfs" ];
       default = "overlay";
       description = lib.mdDoc "Storage driver to be used";
     };

nixos/tests/all-tests.nix

@@ -359,7 +359,7 @@ in {
   ksm = handleTest ./ksm.nix {};
   kthxbye = handleTest ./kthxbye.nix {};
   kubernetes = handleTestOn ["x86_64-linux"] ./kubernetes {};
-  kubo = handleTest ./kubo.nix {};
+  kubo = runTest ./kubo.nix;
   ladybird = handleTest ./ladybird.nix {};
   languagetool = handleTest ./languagetool.nix {};
   latestKernel.login = handleTest ./login.nix { latestKernel = true; };

nixos/tests/kubo.nix

@@ -1,10 +1,10 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
+{ lib, ...} : {
   name = "kubo";
-  meta = with pkgs.lib.maintainers; {
+  meta = with lib.maintainers; {
-    maintainers = [ mguentner ];
+    maintainers = [ mguentner Luflosi ];
   };
 
-  nodes.machine = { ... }: {
+  nodes.machine = { config, ... }: {
     services.kubo = {
       enable = true;
       # Also will add a unix domain socket socket API address, see module.
@@ -12,58 +12,74 @@ import ./make-test-python.nix ({ pkgs, ...} : {
       settings.Addresses.API = "/ip4/127.0.0.1/tcp/2324";
       dataDir = "/mnt/ipfs";
     };
+    users.users.alice = {
+      isNormalUser = true;
+      extraGroups = [ config.services.kubo.group ];
+    };
   };
 
-  nodes.fuse = { ... }: {
+  nodes.fuse = { config, ... }: {
     services.kubo = {
       enable = true;
-      settings.Addresses.API = "/ip4/127.0.0.1/tcp/2324";
       autoMount = true;
     };
+    users.users.alice = {
+      isNormalUser = true;
+      extraGroups = [ config.services.kubo.group ];
+    };
+    users.users.bob = {
+      isNormalUser = true;
+    };
   };
 
   testScript = ''
     start_all()
 
-    # IPv4 activation
+    with subtest("Automatic socket activation"):
-
+        ipfs_hash = machine.succeed(
-    machine.succeed("ipfs --api /ip4/127.0.0.1/tcp/2324 id")
+            "echo fnord0 | su alice -l -c 'ipfs add --quieter'"
-    ipfs_hash = machine.succeed(
+        )
-        "echo fnord | ipfs --api /ip4/127.0.0.1/tcp/2324 add | awk '{ print $2 }'"
+        machine.succeed(f"ipfs cat /ipfs/{ipfs_hash.strip()} | grep fnord0")
-    )
-
-    machine.succeed(f"ipfs cat /ipfs/{ipfs_hash.strip()} | grep fnord")
-
-    # Unix domain socket activation
 
     machine.stop_job("ipfs")
 
-    ipfs_hash = machine.succeed(
+    with subtest("IPv4 socket activation"):
-        "echo fnord2 | ipfs --api /unix/run/ipfs.sock add | awk '{ print $2 }'"
+        machine.succeed("ipfs --api /ip4/127.0.0.1/tcp/2324 id")
-    )
+        ipfs_hash = machine.succeed(
-    machine.succeed(
+            "echo fnord | ipfs --api /ip4/127.0.0.1/tcp/2324 add --quieter"
-        f"ipfs --api /unix/run/ipfs.sock cat /ipfs/{ipfs_hash.strip()} | grep fnord2"
+        )
-    )
+        machine.succeed(f"ipfs cat /ipfs/{ipfs_hash.strip()} | grep fnord")
 
-    # Test if setting dataDir works properly with the hardened systemd unit
+    machine.stop_job("ipfs")
-    machine.succeed("test -e /mnt/ipfs/config")
-    machine.succeed("test ! -e /var/lib/ipfs/")
 
-    # Test FUSE mountpoint
+    with subtest("Unix domain socket activation"):
-    # The FUSE mount functionality is broken as of v0.13.0 and v0.17.0.
+        ipfs_hash = machine.succeed(
-    # See https://github.com/ipfs/kubo/issues/9044.
+            "echo fnord2 | ipfs --api /unix/run/ipfs.sock add --quieter"
-    # Workaround: using CID Version 1 avoids that.
+        )
-    ipfs_hash = fuse.succeed(
+        machine.succeed(
-        "echo fnord3 | ipfs --api /ip4/127.0.0.1/tcp/2324 add --quieter --cid-version=1"
+            f"ipfs --api /unix/run/ipfs.sock cat /ipfs/{ipfs_hash.strip()} | grep fnord2"
-    ).strip()
+        )
 
-    fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+    with subtest("Setting dataDir works properly with the hardened systemd unit"):
+        machine.succeed("test -e /mnt/ipfs/config")
+        machine.succeed("test ! -e /var/lib/ipfs/")
 
-    # Force Kubo to crash and wait for it to restart
+    with subtest("FUSE mountpoint"):
-    # Tests the unmounting of /ipns and /ipfs
+        fuse.fail("echo a | su bob -l -c 'ipfs add --quieter'")
-    fuse.systemctl("kill --signal=SIGKILL ipfs.service")
+        # The FUSE mount functionality is broken as of v0.13.0 and v0.17.0.
-    fuse.wait_for_unit("ipfs.service", timeout = 30)
+        # See https://github.com/ipfs/kubo/issues/9044.
+        # Workaround: using CID Version 1 avoids that.
+        ipfs_hash = fuse.succeed(
+            "echo fnord3 | su alice -l -c 'ipfs add --quieter --cid-version=1'"
+        ).strip()
 
-    fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+        fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+
+    with subtest("Unmounting of /ipns and /ipfs"):
+        # Force Kubo to crash and wait for it to restart
+        fuse.systemctl("kill --signal=SIGKILL ipfs.service")
+        fuse.wait_for_unit("ipfs.service", timeout = 30)
+
+        fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
   '';
-})
+}

pkgs/applications/audio/go-musicfox/default.nix

@@ -10,13 +10,13 @@
 # gcc only supports objc on darwin
 buildGoModule.override { stdenv = clangStdenv; } rec {
   pname = "go-musicfox";
-  version = "4.0.2";
+  version = "4.0.3";
 
   src = fetchFromGitHub {
     owner = "anhoder";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ZxyW/NUKSCcx/KGgFV2pt5ucTBP7BE7qFeTvBoRmUvQ=";
+    hash = "sha256-6JOD0RsZY79jLYJqPrzc43jgR03XQEfa8B0mGvlIkF4=";
   };
 
   deleteVendor = true;

pkgs/applications/audio/tageditor/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tageditor";
-  version = "3.7.8";
+  version = "3.7.9";
 
   src = fetchFromGitHub {
     owner = "martchus";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-/34KS6nxpIsKEklSRpO+AmGAdpJhapoGe24DCCodU38=";
+    hash = "sha256-QQvc9S+9h0Qy/qBROwJMZIALf/Rbj/9my4PZGxQzlnM=";
   };
 
   nativeBuildInputs = [

pkgs/applications/backup/vorta/default.nix

@@ -8,19 +8,18 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vorta";
-  version = "0.8.10";
+  version = "0.8.12";
 
   src = fetchFromGitHub {
     owner = "borgbase";
     repo = "vorta";
-    rev = "refs/tags/v${version}";
+    rev = "v${version}";
-    hash = "sha256-okxZ1kALB5l94ShStAJLfzD37MLhob8MCzhbqfVISkw=";
+    hash = "sha256-nLdLTh1qSKvOR2cE9HWQrIWQ9L+ynX4qF+lTtKn/Ubs=";
   };
 
   nativeBuildInputs = [ wrapQtAppsHook ];
 
   propagatedBuildInputs = with python3Packages; [
-    paramiko
     peewee
     pyqt5
     python-dateutil
@@ -29,6 +28,9 @@ python3Packages.buildPythonApplication rec {
     secretstorage
     appdirs
     setuptools
+    platformdirs
+  ] ++ lib.optionals stdenv.isLinux [
+    qt5.qtwayland
   ];
 
   postPatch = ''

pkgs/applications/graphics/komikku/default.nix

@@ -19,7 +19,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "komikku";
-  version = "1.17.0";
+  version = "1.18.0";
 
   format = "other";
 
@@ -27,21 +27,9 @@ python3.pkgs.buildPythonApplication rec {
     owner = "valos";
     repo = "Komikku";
     rev = "v${version}";
-    hash = "sha256-DxW9uefY6Fks3qSUeLMp3BB85SfLgzwBr4KO9do2y2o=";
+    hash = "sha256-suqoYV+YsbCB7sUNzds6OoEMH9KO3bt2udok6oXXyls=";
   };
 
-  patches = [
-    # https://gitlab.com/valos/Komikku/-/merge_requests/208
-    (fetchpatch {
-      url = "https://gitlab.com/valos/Komikku/-/commit/c9a09817acd767a7cb4ceea9b212fffd798eae61.patch";
-      hash = "sha256-McjQApLY7OKbdelrTeh3aRw90B6T9V5FtLL5Y62BmGA=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/valos/Komikku/-/commit/bda93631420f6a69a50be0068f259d60b9558930.patch";
-      hash = "sha256-Xu+IaQKf0I99a2uh97j8xSlGYSJHuNPMy/zZtWRxLaM=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja

pkgs/applications/misc/1password-gui/default.nix

@@ -9,43 +9,43 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.10.0" else "8.10.1-19.BETA";
+  version = if channel == "stable" then "8.10.4" else "8.10.5-10.BETA";
 
   sources = {
     stable = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-mIplIW1XGb7EVlPIHgzL16zvVa/3ypfwTMtVSiSvYYE=";
+        sha256 = "sha256-zFB8bUl0FNmMvNN5AoDeYdUjasJblVxRAi50V2BF5OU=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-xjbqZ/+sw3jBzbqhzd/mP7CZOCLYYi6KpX8Ypy/8/Es=";
+        sha256 = "sha256-gALQ43mAJy3eX/0qmdBp0yfMLgAdqAqD93CbDydvJR8=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-06wOSKzxZ7xVAUyIa4Fv48Z6nbMsQ/o74mEyVkmgkJs=";
+        sha256 = "sha256-4kpf3U4G3Jx8g24kU4nXZbDA3o29hEpwACOE2zAadhA=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-zDu3PBj6kvDVpiFuoOuNlmyiSK4ZVuUWX3rBBwlwEvo=";
+        sha256 = "sha256-eTRI7reSZ24S8uwNFPk8BkwMexdoXD5tlL6Bd3zzIGI=";
       };
     };
     beta = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-F/dnA9mqtXXp5vx6OQ5aPrdeEBMg9g6nozzMMNAZWHk=";
+        sha256 = "sha256-GM93nW7kGeC2Mmq1ZtOK72RQc0QHvlWedDLEAmqtPt4=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-u8ktPt7W4teCJoXq1eEdKZCEsKxjhep/7DMHSMtuFBA=";
+        sha256 = "sha256-f0K35utZ/WPv08wRe/ZQPWC/IYiXsf/tBqhKjgeNBHc=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-dZ1Vv4oocDYlw2sibnokUyAKcZ2W7zKofTX2ELamilI=";
+        sha256 = "sha256-zWS1nmRNm2SjMKWRbCJp4DRCzvVsdATdf/EMlpvRz1k=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-JA2U/PfW2+qHPjqIGQL5gWIdqtd5G1lL3+hecYh2lcE=";
+        sha256 = "sha256-fQ98NJI5h0IBvrcsV8GBt9RBWDiyYq0NPtS5B5ikz8k=";
       };
     };
   };

pkgs/applications/misc/1password-gui/update.sh

@@ -27,6 +27,18 @@ print_hash() {
     echo "$CHANNEL ${ARCH}-${OS}: $CURRENT_HASH"
 }
 
+if [[ -z "$STABLE_VER" && -n "$1" ]]; then
+    STABLE_VER="$1"
+fi
+
+if [[ -z "$BETA_VER" && -n "$2" ]]; then
+    BETA_VER="$2"
+fi
+
+if [[ "${BETA_VER: -4}" != "BETA" ]]; then
+    BETA_VER="$BETA_VER.BETA"
+fi
+
 if [[ -z "$STABLE_VER" ]]; then
     echo "No 'STABLE_VER' environment variable provided, skipping"
 else

pkgs/applications/misc/gallery-dl/default.nix

@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.25.1";
+  version = "1.25.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-us9lzchdsCD4sY4XQ1f4j3wKuFtEZnEuBrlSa3FpDP4=";
+    sha256 = "sha256-T9PzvjOdcLaO7iTxBZxucQdiAPVpk1+9wDfcpShIBdM=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/misc/logseq/default.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "logseq";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    hash = "sha256-8jplCIylG1xbpp/VGnU06MwfqWe2E9iVQApZaWbhuVc=";
+    hash = "sha256-nXNzUHZXh2NGcg/OXRKhag/BWLB/YOAkCPITiBiMIIE=";
     name = "${pname}-${version}.AppImage";
   };
 

pkgs/applications/misc/shavee/default.nix

@@ -0,0 +1,39 @@
+{ lib, pkgs, rustPlatform, fetchFromGitHub, pkg-config, openssl, zlib,stdenv, pam }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "shavee";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "ashuio";
+    repo = "shavee";
+    rev = "v${version}";
+    sha256 = "sha256-41wJ3QBZdmCl7v/6JetXhzH2zF7tsKYMKZY1cKhByX8=";
+  };
+
+  cargoSha256 = "sha256-iNGn5KknSNgazFSu6Nur7AkKVb6qKMxuFwTdCz5djWU=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    zlib
+    pam
+  ];
+
+   # these tests require network access
+  checkFlags = [
+    "--skip=filehash::tests::remote_file_hash"
+    "--skip=filehash::tests::get_filehash_unit_test"
+  ];
+
+  meta = with lib; {
+    description = "A Program to automatically decrypt and mount ZFS datasets using Yubikey HMAC as 2FA or any File on USB/SFTP/HTTPS.";
+    homepage = "https://github.com/ashuio/shavee";
+    license = licenses.mit;
+    maintainers = with maintainers; [jasonodoom];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "112.0.5615.49",
+    "version": "112.0.5615.121",
-    "sha256": "0hgzbbmz40235binfn3vkkxzvwxilaxg04dclqrz980z7hvkgzfx",
+    "sha256": "1qbsgcsw3jgy9b76i8ypiq91fkm9zy1hy77l52w2xbw53ghjfwlw",
-    "sha256bin64": "0jq5pbyayk8pa9ksxp2dk3k7j2jic506mfpkq1a1z48j1l4fkr5i",
+    "sha256bin64": "1zh674vpczs1nyzbijpcgs2j2r0hdgp7bkwyn5l8w1hcj6az6k3n",
     "deps": {
       "gn": {
         "version": "2023-02-17",
@@ -12,16 +12,16 @@
       }
     },
     "chromedriver": {
-      "version": "112.0.5615.28",
+      "version": "112.0.5615.49",
-      "sha256_linux": "13i2y1zd3dxjvs9575m00gg8xxll1g08sn7dayl7l8qr3zy74p98",
+      "sha256_linux": "0acp7hck7p9v1ysyzdyyrj43z2azlj35l8sw2f8fn5nfbl4bsbkf",
-      "sha256_darwin": "0mw8h7ijc0nf7c2j731w30ajh6djy1lk6nak81fpksgk98vkv64f",
+      "sha256_darwin": "14205fqfinlqw9kbs2p6pzb666mnz8rbfim1crpdkzsrfn5dlb9h",
-      "sha256_darwin_aarch64": "103b3n7vxqvim4ks8vi5b29d41wdldkj1rz94fnqvgw04lykm9sk"
+      "sha256_darwin_aarch64": "17v9k9k5p3rwq1i58xw19p93hzirp0r0aiq5s3gc20i7ka3bk1xj"
     }
   },
   "beta": {
-    "version": "113.0.5672.24",
+    "version": "113.0.5672.37",
-    "sha256": "1z7yv5lqi1n4ycymkf0kz1v8ig06n430a37ik8hri3a6db8r9lv8",
+    "sha256": "0hmn7h5l8q161f6hwp5g7zbxfdsplwqh5j3yby56qgljgca8pj7f",
-    "sha256bin64": "1y9jaw47dgphqr2l8yc36s7k9lf4qrbmfll1d2d1zdjd5ma3slab",
+    "sha256bin64": "0j4hl2sbh8cig00rpn4ssxi2087wr33749b5sdcrk93kfzqinrix",
     "deps": {
       "gn": {
         "version": "2023-03-18",
@@ -45,9 +45,9 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "112.0.5615.50",
+    "version": "112.0.5615.121",
-    "sha256": "006x62z7cpb2aqi2q67l1n3nq1wyrmdgdnkdc46xjw751jax8h8j",
+    "sha256": "1qbsgcsw3jgy9b76i8ypiq91fkm9zy1hy77l52w2xbw53ghjfwlw",
-    "sha256bin64": null,
+    "sha256bin64": "1zh674vpczs1nyzbijpcgs2j2r0hdgp7bkwyn5l8w1hcj6az6k3n",
     "deps": {
       "gn": {
         "version": "2023-02-17",
@@ -56,8 +56,8 @@
         "sha256": "075p4jwk1apvwmqmvhwfw5f669ci7nxwjq9mz5aa2g5lz4fkdm4c"
       },
       "ungoogled-patches": {
-        "rev": "112.0.5615.50-1",
+        "rev": "112.0.5615.121-1",
-        "sha256": "0axz76hbcc5h6gqv41yxd0yy9vcldps5xn9ffx98iyzghi76z1sa"
+        "sha256": "1zdk0sn84sj5zwcjjxikm0sc8mfpw0gri6w1fmpcbwyqawwjmi4f"
       }
     }
   }

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -29,11 +29,11 @@ rec {
 
   firefox-beta = buildMozillaMach rec {
     pname = "firefox-beta";
-    version = "113.0b2";
+    version = "113.0b3";
     applicationName = "Mozilla Firefox Beta";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "96b1ce4616c0f7337a22803fbdc86fb791c817a452fbf61eb7470a4c4b6c81a8be32d9db18ace5770a99335fb03bfbcdbf73d86257a9404c1f169d4a907ea4e3";
+      sha512 = "52fe2551eac62c88366445e469f92471e6a00e5a1bce502dc10c2de8b94d170adc603ad53afad3083c38d4a9fa6f988883287882b26ba2d8709edb637769bced";
     };
 
     meta = {
@@ -56,12 +56,12 @@ rec {
 
   firefox-devedition = buildMozillaMach rec {
     pname = "firefox-devedition";
-    version = "113.0b2";
+    version = "113.0b3";
     applicationName = "Mozilla Firefox Developer Edition";
     branding = "browser/branding/aurora";
     src = fetchurl {
       url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "634271b19a0a5369fb91a286da2c476b6570e501bb7d8b05efe22eea1ecff66a7fbf62ef21ac9dcfd863be2d63a3be117615b5c0b1b1fc8c7d746d720b3d9876";
+      sha512 = "e0efa46db05105dd747d6105a668263b006ef1651514526d18e8d1daa2787db6ef00f4ead12542b2eb9d2d35ba5caf6aa0dfc26569c66474d07c1053ebd1cdfa";
     };
 
     meta = {

pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "helm-secrets";
-  version = "4.2.2";
+  version = "4.4.2";
 
   src = fetchFromGitHub {
     owner = "jkroepke";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-aqRgny1vU+dxpZpzwL4aSbYfTGrZbRffQy81mMBvnJk=";
+    hash = "sha256-GpPgjRqzH4fcnaHs9SWfdaCZimwBleXnxQLjqy8SArs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/networking/cluster/pachyderm/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pachyderm";
-  version = "2.5.2";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "pachyderm";
     repo = "pachyderm";
     rev = "v${version}";
-    hash = "sha256-COtOYR1toSr+oiRZ5Hfbgfy2InF9jFThT0ozwrcSVio=";
+    hash = "sha256-VYHSExQDIyK86kCz3gzIR+Q5iYrhkAPx56vST73vPOo=";
   };
 
   vendorHash = "sha256-XmIPifozTYd1rV2wm0dU0GPvg/+HFoSLGHB6DDrkzVc=";

pkgs/applications/networking/cluster/stern/default.nix

@@ -1,7 +1,5 @@
 { stdenv, lib, buildPackages, buildGoModule, fetchFromGitHub, installShellFiles }:
-let isCrossBuild = stdenv.hostPlatform != stdenv.buildPlatform;
 
-in
 buildGoModule rec {
   pname = "stern";
   version = "1.24.0";
@@ -19,12 +17,11 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  ldflags =
+  ldflags = [ "-s" "-w" "-X github.com/stern/stern/cmd.version=${version}" ];
-    [ "-s" "-w" "-X github.com/stern/stern/cmd.version=${version}" ];
 
-  postInstall =
+  postInstall = let
-    let stern = if isCrossBuild then buildPackages.stern else "$out";
+    stern = if stdenv.buildPlatform.canExecute stdenv.hostPlatform then "$out" else buildPackages.stern;
-    in
+  in
     ''
       for shell in bash zsh; do
         ${stern}/bin/stern --completion $shell > stern.$shell

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -46,11 +46,11 @@
     "vendorHash": "sha256-nwl8GvS/hc07xSzM+wEwOAkT9oQcAuguHaEcM1nWjwg="
   },
   "alicloud": {
-    "hash": "sha256-ZFnVCrC2fK2i5idK2rWCOZQ3W4K3nDSG5ZkEZk2Zg9c=",
+    "hash": "sha256-6PStzU5YBhFDGtQOWUZ8Iyo9miRCTMgDsuJX0rNCYMQ=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.202.0",
+    "rev": "v1.203.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -101,11 +101,11 @@
     "vendorHash": "sha256-0k1BYRQWp4iU9DRwPbluOg3S5VzL981PpFrgiQaYWNw="
   },
   "aviatrix": {
-    "hash": "sha256-gEIfDiI0ZVTVwijY+rc5nL8fKptSlUocx2lS8pT1Xjg=",
+    "hash": "sha256-DjdA4kvOtPO4x1MY+lJjX+KNuQTxSZQvisSfokQk5Sg=",
     "homepage": "https://registry.terraform.io/providers/AviatrixSystems/aviatrix",
     "owner": "AviatrixSystems",
     "repo": "terraform-provider-aviatrix",
-    "rev": "v3.0.4",
+    "rev": "v3.0.5",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -390,11 +390,11 @@
     "vendorHash": null
   },
   "flexibleengine": {
-    "hash": "sha256-0wpyi397+5YAa3epZZII312rK1SnPU5k9a1/iVTbqmU=",
+    "hash": "sha256-TZR/zXgecHUbaD9Yb83HvBwWauDtHDsnEcSZYFmY5y4=",
     "homepage": "https://registry.terraform.io/providers/FlexibleEngineCloud/flexibleengine",
     "owner": "FlexibleEngineCloud",
     "repo": "terraform-provider-flexibleengine",
-    "rev": "v1.36.1",
+    "rev": "v1.37.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-HcyUGKbgj322fU7keN/lBEn6UJhV3QXScBJHZHJkCII="
   },
@@ -484,11 +484,11 @@
     "vendorHash": null
   },
   "hcloud": {
-    "hash": "sha256-yAUrrIhaJIdwKCsOcsouEev7GFLLJPoXAif1DXD46sU=",
+    "hash": "sha256-B6XL9izArnbkI7TWbuB/m/UgGK+YlrpaQEJ+etWQBJk=",
     "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
     "owner": "hetznercloud",
     "repo": "terraform-provider-hcloud",
-    "rev": "v1.38.1",
+    "rev": "v1.38.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-gz96b+GOE7AgXzEL4odneYA01wZv4oXwz//Yyu9rg3E="
   },
@@ -882,11 +882,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-roreCock+WDBNw/v3/esVVntF7cZmEnDW5sZ4GMmQbs=",
+    "hash": "sha256-jEpQ6TD+RsmuBGPGLotkTyM7ADBLOAu97oPVeMRsiQk=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v2.14.0",
+    "rev": "v2.14.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1098,11 +1098,11 @@
     "vendorHash": "sha256-GkmUKSnqkabwGCl22/90529BWb0oJaIJHYHlS/h3KNY="
   },
   "tencentcloud": {
-    "hash": "sha256-Wapcnyf1jN75ZKZTFXMixRNianq1FWC8TMddXmFSmj8=",
+    "hash": "sha256-j1PffTicdXiit3D+dX9HzkBZFmf8Ch7LxNVU3XGi5uY=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.80.2",
+    "rev": "v1.80.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/flexget/default.nix

@@ -19,7 +19,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.6.0";
+  version = "3.6.3";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -27,7 +27,7 @@ python.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VsXiWsvEjRhWckwqHcUPx2B9mwOUmRLLHIM5ALoW9GI=";
+    hash = "sha256-Z1tiIs4NHHsWa7agAl1dnwliQbgFEl/SPT6QLQkqTVA=";
   };
 
   postPatch = ''

pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix

@@ -53,16 +53,16 @@ let
   };
 in buildNpmPackage rec {
   pname = "deltachat-desktop";
-  version = "1.36.1";
+  version = "1.36.2";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     rev = "v${version}";
-    hash = "sha256-dfDgUDGRYcJKi7X30jaYx0kqlSkDjfo83yaZ16Mrklk=";
+    hash = "sha256-0f3i+ZmORq1IDdzsIJo7e4lCnC3K1B5SY9pjpGM8+ro=";
   };
 
-  npmDepsHash = "sha256-IQod8femD9yhM4c9mDfbpjmXdpLoWzOU0g3Z9g5DLQM=";
+  npmDepsHash = "sha256-9gfqVFGmouGd+E78/GDKyanHEvA37OZSR1zBEpVOYF0=";
 
   nativeBuildInputs = [
     makeWrapper

pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix

@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.46.4";
+  version = "3.48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "bLYE99MKkh7MgxA9ZPKOj1+1VcFT9mHSQvayB/9Hy58=";
+    sha256 = "FmFlu+oUQbuS8qk0jZp97EiCoNMTGc0lZlcdpnd+8t4=";
   };
 
   patches = [

pkgs/applications/networking/mailreaders/evolution/evolution-ews/hardcode-gsettings.patch

@@ -70,3 +70,27 @@ index ff1b8e3..4f876c0 100644
  	strv = g_settings_get_strv (settings, "labels");
  
  	for (ii = 0; strv && strv[ii]; ii++) {
+diff --git a/src/Microsoft365/common/e-m365-tz-utils.c b/src/Microsoft365/common/e-m365-tz-utils.c
+index 7a1d7f4..3c0d5e1 100644
+--- a/src/Microsoft365/common/e-m365-tz-utils.c
++++ b/src/Microsoft365/common/e-m365-tz-utils.c
+@@ -192,7 +192,18 @@ e_m365_tz_utils_get_user_timezone (void)
+ 	gchar *location;
+ 	ICalTimezone *zone = NULL;
+ 
+-	settings = g_settings_new ("org.gnome.evolution.calendar");
++	{
++		g_autoptr(GSettingsSchemaSource) schema_source;
++		g_autoptr(GSettingsSchema) schema;
++		schema_source = g_settings_schema_source_new_from_directory("@evo@",
++									    g_settings_schema_source_get_default(),
++									    TRUE,
++									    NULL);
++		schema = g_settings_schema_source_lookup(schema_source,
++							 "org.gnome.evolution.calendar",
++							 FALSE);
++		settings = g_settings_new_full(schema, NULL, NULL);
++	}
+ 
+ 	if (g_settings_get_boolean (settings, "use-system-timezone"))
+ 		location = e_cal_util_get_system_timezone_location ();

pkgs/applications/office/treesheets/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "unstable-2023-04-04";
+  version = "unstable-2023-04-09";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "a7d0065763c0bf0cfc2b410b17cb1fce33619616";
+    rev = "afeb34a1c5255484eea912edf0cc175cae5eea12";
-    sha256 = "wDAheXzObiqFkZ2ZVQAzMVZT5mzIEzxh6jNwPiPoWis=";
+    sha256 = "KFGI3p9V8clOACQ+kxhLazOqcSm7Ou/84+1JrEA1rC0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/astronomy/stellarium/default.nix

@@ -30,6 +30,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-7jzS3pRklPsCTgCr3nrywfHCNlBDHuyuGGvrVoI9+A0=";
   };
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace CMakeLists.txt \
+      --replace 'SET(CMAKE_INSTALL_PREFIX "''${PROJECT_BINARY_DIR}/Stellarium.app/Contents")' \
+                'SET(CMAKE_INSTALL_PREFIX "${placeholder "out"}/Applications/Stellarium.app/Contents")'
+    substituteInPlace src/CMakeLists.txt \
+      --replace "\''${_qt_bin_dir}/../" "${qtmultimedia}/lib/qt-6/"
+  '';
+
   nativeBuildInputs = [
     cmake
     perl
@@ -44,22 +52,28 @@ stdenv.mkDerivation rec {
     qtmultimedia
     qtserialport
     qttranslations
-    qtwayland
     qtwebengine
     calcmysky
     qxlsx
     indilib
     libnova
+  ] ++ lib.optionals stdenv.isLinux [
+    qtwayland
   ];
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace CMakeLists.txt \
+    export LC_ALL=en_US.UTF-8
-      --replace 'SET(CMAKE_INSTALL_PREFIX "''${PROJECT_BINARY_DIR}/Stellarium.app/Contents")' \
-                'SET(CMAKE_INSTALL_PREFIX "${placeholder "out"}/Applications/Stellarium.app/Contents")'
   '';
 
+  # fatal error: 'QtSerialPort/QSerialPortInfo' file not found
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-F${qtserialport}/lib";
+
   dontWrapGApps = true;
 
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    makeWrapper $out/Applications/Stellarium.app/Contents/MacOS/Stellarium $out/bin/stellarium
+  '';
+
   preFixup = ''
     qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';

pkgs/applications/science/electronics/dataexplorer/default.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dataexplorer";
-  version = "3.7.4";
+  version = "3.7.6";
 
   src = fetchurl {
     url = "mirror://savannah/dataexplorer/dataexplorer-${version}-src.tar.gz";
-    sha256 = "sha256-bghI7Hun7ZKUVEj7T58K0oaclnhUGd4z+eIqZF3eXHQ=";
+    sha256 = "sha256-mwz4o1m2ldjyD4pbwMQxeaI8a8JXzis+s0I+6GW8WaY=";
   };
 
   nativeBuildInputs = [ ant makeWrapper ];
@@ -45,8 +45,8 @@ stdenv.mkDerivation rec {
       --set SWT_GTK3 0 \
       --set LIBOVERLAY_SCROLLBAR 0
 
-    install -Dvm644 build/misc/GNU_LINUX_JUNSI_ICHARER_DUO_UDEV_RULE/50-Junsi-iCharger-DUO.rules \
+    install -Dvm644 build/misc/GNU_LINUX_JUNSI_ICHARER_USB_UDEV_RULE/50-Junsi-iCharger-USB.rules \
-      $out/etc/udev/rules.d/50-Junsi-iCharger-DUO.rules
+      $out/etc/udev/rules.d/50-Junsi-iCharger-USB.rules
     install -Dvm644 build/misc/GNU_LINUX_SKYRC_UDEV_RULE/50-SkyRC-Charger.rules \
       $out/etc/udev/rules.d/50-SkyRC-Charger.rules
   '';

pkgs/applications/science/electronics/kicad/base.nix

@@ -94,9 +94,6 @@ stdenv.mkDerivation rec {
     # should be resolved in the next release
     "-DCMAKE_CTEST_ARGUMENTS='--exclude-regex;qa_eeschema'"
   ]
-  ++ optionals (!stable) [ # workaround for https://gitlab.com/kicad/code/kicad/-/issues/14346
-    "-DPYTHON_SITE_PACKAGE_PATH=${placeholder "out"}/${python.sitePackages}/"
-  ]
   ++ optional (stable && !withNgspice) "-DKICAD_SPICE=OFF"
   ++ optionals (!withScripting) [
     "-DKICAD_SCRIPTING_WXPYTHON=OFF"

pkgs/applications/science/electronics/kicad/versions.nix

@@ -3,45 +3,45 @@
 {
   "kicad" = {
     kicadVersion = {
-      version =			"7.0.1";
+      version =			"7.0.2";
       src = {
-        rev =			"3b83917a115be1ce2f33a73039f59f8784b5c2e7";
+        rev =			"6a45011f421d65a241e1df4a2dc720819922f343";
-        sha256 =		"021safxvyq9qzs08jy3jvpazmhvix4kyl05s9y9hwmyzdmdl2smn";
+        sha256 =		"0san7pjgvd8niwrki722qb6y46r71rlyspqp43pmkiz55dmz52zx";
       };
     };
     libVersion = {
-      version =			"7.0.1";
+      version =			"7.0.2";
       libSources = {
-        symbols.rev =		"adfe3c06b5750d81580ed44e669b578f49c205eb";
+        symbols.rev =		"22ed11504c140fded542eeb104cdb02e0a65672e";
-        symbols.sha256 =	"14c5gci13m30xv0cmic5jxsmfx9lq3fnd8hyq3mmgkrw7443zy30";
+        symbols.sha256 =	"0aah92rb8yx00z0xwx9z7xn5rrw4cc3z35gr7c0bnb49hiak01jc";
-        templates.rev =		"66d76556d9e81f8a5be74457686d211c666ed200";
+        templates.rev =		"331068741c80fee8195646d3dee40f3b840495e7";
-        templates.sha256 =	"02i279269mhq7wjhb1yqk90820ncssxl9n7b20qr2r4fmm7jpvxv";
+        templates.sha256 =	"1qi20mrsfn4fxmr1fyphmil2i9p2nzmwk5rlfchc5aq2194nj3lq";
-        footprints.rev =	"1cf5a1d979cffebd62464c1bb0d7b09c5ee3b8c3";
+        footprints.rev =	"e187e2dfa9bd04d91cad0d875049ab56780b6e32";
-        footprints.sha256 =	"0k0z40wmaq665hjxb6kp1yl3v7clxz49r6ki0chyphsxv1cnixmy";
+        footprints.sha256 =	"1qrdznfd4a6kzwd4aaijkpyjy0xnrmi66isq9z52652a8s6ja48v";
-        packages3d.rev =	"e54b5b6368d03f396098448bcce37f2e432dac33";
+        packages3d.rev =	"6374ae3db8b43a4d779185b7017fcfe0e1f32590";
-        packages3d.sha256 =	"0nzi7ijfb3rjm98kaa9va2mkh0nfzpq4vfhxkq8j18qhx24h5c8v";
+        packages3d.sha256 =	"1nkk4325jh89vh52ykfnf9pz1k3jk5017gz6r2cia2v4b3jadi31";
       };
     };
   };
   "kicad-unstable" = {
     kicadVersion = {
-      version =			"2023-03-29";
+      version =			"2023-04-14";
       src = {
-        rev =			"d5bc223ff2cd1fbf4e923e23b5bb442bb54faa95";
+        rev =			"4a3f77cd9dac9dc5921eb9beaa63d0d3c9c051e5";
-        sha256 =		"0pbzmv9vh4bzhsxj46gjkgh7kk6a0v8gijvkmb56fy5i8xv2ixkn";
+        sha256 =		"06dsiyvr7zn3cp13w0y63d1qmjlhzsqlvajkximg3pw5mmiljxrr";
       };
     };
     libVersion = {
-      version =			"2023-03-29";
+      version =			"2023-04-14";
       libSources = {
-        symbols.rev =		"36fc1c88921bf32ebf667e027dfe63cca649fd95";
+        symbols.rev =		"38d4e7e1ab6a9b5d9eee85f687e60467753b2135";
-        symbols.sha256 =	"177mqvjf3knldnl7pf1abv4pmlgi5cg02ggfwbc655jq4x6x8fkz";
+        symbols.sha256 =	"0df6fx9b19v6sxrfyggbisw72y66kiwqi05k8mldsgiw6q55gbkc";
         templates.rev =		"867eef383a0f61015cb69677d5c632d78a2ea01a";
         templates.sha256 =	"1qi20mrsfn4fxmr1fyphmil2i9p2nzmwk5rlfchc5aq2194nj3lq";
-        footprints.rev =	"dc4574eb65136d95a7775d09412d5159f8d7832c";
+        footprints.rev =	"4da055a2d572ff87e7ecea97cf358ed8c1d46dfc";
-        footprints.sha256 =	"1iz4wyiysdii378c3pjgkgwh1cssxbh5jkbhvj7rmi2vmgngl6nc";
+        footprints.sha256 =	"1xb84284dmcb7mbvzlrxb4v4km3ih7gq856h8cglf9jn8wzlnvrk";
-        packages3d.rev =	"e54b5b6368d03f396098448bcce37f2e432dac33";
+        packages3d.rev =	"0f43a0962437feb53bd2083e9f39efffb5a5dd90";
-        packages3d.sha256 =	"0nzi7ijfb3rjm98kaa9va2mkh0nfzpq4vfhxkq8j18qhx24h5c8v";
+        packages3d.sha256 =	"1nkk4325jh89vh52ykfnf9pz1k3jk5017gz6r2cia2v4b3jadi31";
       };
     };
   };

pkgs/applications/science/misc/sasview/default.nix

@@ -25,6 +25,12 @@ python3.pkgs.buildPythonApplication rec {
     })
   ];
 
+  # AttributeError: module 'numpy' has no attribute 'float'.
+  postPatch = ''
+    substituteInPlace src/sas/sascalc/pr/p_invertor.py \
+      --replace "dtype=np.float)" "dtype=float)"
+  '';
+
   nativeBuildInputs = [
     python3.pkgs.pyqt5
     wrapQtAppsHook

pkgs/applications/version-management/radicle-cli/default.nix

@@ -38,6 +38,9 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
+  # Otherwise, there are errors due to the `abigen` macro from `ethers`.
+  auditable = false;
+
   nativeBuildInputs = [
     pkg-config
     cmake

pkgs/applications/video/vokoscreen-ng/default.nix

@@ -22,13 +22,13 @@
 
 mkDerivation rec {
   pname = "vokoscreen-ng";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "vkohaupt";
     repo = "vokoscreenNG";
     rev = version;
-    sha256 = "sha256-4VEIQj9/rSzXM5EQFt2I+cKKOM1URKlblf+6vlWEuO0=";
+    sha256 = "sha256-Du/Dq7AUH5CeEKYr0kxcqguAyRVI5Ame41nU3FGvG+U=";
   };
 
   qmakeFlags = [ "src/vokoscreenNG.pro" ];

pkgs/applications/virtualization/cri-o/wrapper.nix

@@ -4,6 +4,7 @@
 , lib
 , extraPackages ? []
 , runc # Default container runtime
+, conntrack-tools
 , crun # Container runtime (default with cgroups v2 for podman/buildah)
 , conmon # Container runtime monitor
 , util-linux # nsenter
@@ -13,6 +14,7 @@
 let
   binPath = lib.makeBinPath ([
     runc
+    conntrack-tools
     crun
     conmon
     util-linux

pkgs/applications/virtualization/podman/default.nix

@@ -15,6 +15,7 @@
 , nixosTests
 , python3
 , makeWrapper
+, runtimeShell
 , symlinkJoin
 , extraPackages ? [ ]
 , runc
@@ -61,13 +62,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.4.4";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-rLXq+sveSxeoD3gyXSnfgGFx6alOBKSRCdDHGwwvPm4=";
+    hash = "sha256-udvvTdkpL8xvY0iIMBgBFQk5sybpn9vCFFXP0ZqOajM=";
   };
 
   patches = [
@@ -99,6 +100,7 @@ buildGoModule rec {
   buildPhase = ''
     runHook preBuild
     patchShebangs .
+    substituteInPlace Makefile --replace "/bin/bash" "${runtimeShell}"
     ${if stdenv.isDarwin then ''
       make podman-remote # podman-mac-helper uses FHS paths
     '' else ''

pkgs/build-support/cc-wrapper/default.nix

@@ -14,7 +14,7 @@
 , propagateDoc ? cc != null && cc ? man
 , extraTools ? [], extraPackages ? [], extraBuildCommands ? ""
 , nixSupport ? {}
-, isGNU ? false, isClang ? cc.isClang or false, gnugrep ? null
+, isGNU ? false, isClang ? cc.isClang or false, isCcache ? cc.isCcache or false, gnugrep ? null
 , buildPackages ? {}
 , libcxx ? null
 , grossHackForStagingNext ? false
@@ -208,7 +208,7 @@ stdenv.mkDerivation {
         local dst="$1"
         local wrapper="$2"
         export prog="$3"
-        export use_response_file_by_default=${if isClang then "1" else "0"}
+        export use_response_file_by_default=${if isClang && !isCcache then "1" else "0"}
         substituteAll "$wrapper" "$out/bin/$dst"
         chmod +x "$out/bin/$dst"
       }

pkgs/desktops/deepin/apps/deepin-movie-reborn/default.nix

@@ -46,20 +46,30 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      name = "chore: dont use </usr/include/linux/cdrom.h>";
+      name = "feat-rewrite-libPath-to-read-LD_LIBRARY_PATH.patch";
-      url = "https://github.com/linuxdeepin/deepin-movie-reborn/commit/2afc63541589adab8b0c8c48e290f03535ec2996.patch";
-      sha256 = "sha256-Q9dv5L5sUGeuvNxF8ypQlZuZVuU4NIR/8d8EyP/Q5wk=";
-    })
-    (fetchpatch {
-      name = "feat: rewrite libPath to read LD_LIBRARY_PATH";
       url = "https://github.com/linuxdeepin/deepin-movie-reborn/commit/432bf452ed244c256e99ecaf80bb6a0eef9b4a74.patch";
       sha256 = "sha256-5hRQ8D9twBKgouVpIBa1pdAGk0lI/wEdQaHBBHFCZBA";
     })
   ];
 
   postPatch = ''
+    # https://github.com/linuxdeepin/deepin-movie-reborn/pull/198
+    substituteInPlace src/common/diskcheckthread.cpp \
+      --replace "/usr/include/linux/cdrom.h" "linux/cdrom.h"
     substituteInPlace src/widgets/toolbox_proxy.cpp \
       --replace "/bin/bash" "${runtimeShell}"
+
+    # libdmr always assume that these libraries exist
+    # otherwise it will lead to coredump
+    # This affects the preview plugin for dde-file-manager
+
+    substituteInPlace src/libdmr/{filefilter.cpp,playlist_model.cpp,gstutils.cpp} \
+      --replace 'LibraryLoader::libPath("libavcodec.so")' '"${lib.getLib ffmpeg}/lib/libavcodec.so"' \
+      --replace 'LibraryLoader::libPath("libavformat.so")' '"${lib.getLib ffmpeg}/lib/libavformat.so"' \
+      --replace 'LibraryLoader::libPath("libavutil.so")' '"${lib.getLib ffmpeg}/lib/libavutil.so"' \
+      --replace 'LibraryLoader::libPath("libffmpegthumbnailer.so")' '"${lib.getLib ffmpegthumbnailer}/lib/libffmpegthumbnailer.so"' \
+      --replace 'LibraryLoader::libPath("libgstreamer-1.0.so")' '"${lib.getLib gst_all_1.gstreamer}/lib/libgstreamer-1.0.so"' \
+      --replace 'LibraryLoader::libPath("libgstpbutils-1.0.so")' '"${lib.getLib gst_all_1.gst-plugins-base}/lib/libgstpbutils-1.0.so"'
   '';
 
   outputs = [ "out" "dev" ];

pkgs/desktops/deepin/core/dde-file-manager/default.nix

@@ -0,0 +1,171 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, runtimeShell
+, dtkwidget
+, qt5integration
+, qt5platform-plugins
+, dde-qt-dbus-factory
+, docparser
+, dde-dock
+, deepin-movie-reborn
+, cmake
+, qttools
+, qtx11extras
+, qtmultimedia
+, kcodecs
+, pkg-config
+, ffmpegthumbnailer
+, libsecret
+, libmediainfo
+, mediainfo
+, libzen
+, poppler
+, polkit-qt
+, polkit
+, wrapQtAppsHook
+, wrapGAppsHook
+, lucenepp
+, boost
+, taglib
+, cryptsetup
+, glib
+, qtbase
+, util-dfm
+, deepin-pdfium
+, libuuid
+, libselinux
+, glibmm
+, pcre
+, udisks2
+, libisoburn
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dde-file-manager";
+  version = "6.0.13";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-Kn8LuAQNWY2SwzKjMyylEAlQNxsP+3bl5hM83yHfjvo=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    qttools
+    pkg-config
+    wrapQtAppsHook
+    wrapGAppsHook
+  ];
+  dontWrapGApps = true;
+
+  patches = [
+    (fetchpatch {
+      name = "chore-cmake-use_CMAKE_INSTALL_SYSCONFDIR.patch";
+      url = "https://github.com/linuxdeepin/dde-file-manager/commit/b3b6b1e5ace0fdd86d0a94687a4e60e7bdfb1086.patch";
+      sha256 = "sha256-GEMuMa1UMSGf0dlHZRQyR1hC08U0GlAlmUKLIxzzoc4=";
+    })
+    (fetchpatch {
+      name = "feat-GRANDSEARCHDAEMON_LIB_DIR-use-CMAKE_INSTALL_FULL_LIBDIR.patch";
+      url = "https://github.com/linuxdeepin/dde-file-manager/commit/58e3826fc4ad46145b57c2b6f8ca2c74efd8d4d3.patch";
+      sha256 = "sha256-athDoFhQ9v9cXOf4YKmZld1RScX43+6/q1zBa/1yAgQ=";
+    })
+    (fetchpatch {
+      name = "fix-include-path-should-follow-Qt5Widgets_PRIVATE_INCLUDE_DIRS.patch";
+      url = "https://github.com/linuxdeepin/dde-file-manager/commit/19fdfffc6ddba2844176ee8384e4147bebee9be4.patch";
+      sha256 = "sha256-VPyiKKxFgNsY70ZdYE5oNF8BFosq/92YrZuZ882Fj4E=";
+    })
+    (fetchpatch {
+      name = "chore-do-not-hardcode-APPSHAREDIR.patch";
+      url = "https://github.com/linuxdeepin/dde-file-manager/commit/74f5cbda8114e24259b6fd998ade794e7880c725.patch";
+      sha256 = "sha256-oZQcuPP9JTZ7aybPnmY/6RyqmJhvpxer4mhv+XpqeQY=";
+    })
+    (fetchpatch {
+      name = "fix-use-pkgconfig-to-check-mount.patch";
+      url = "https://github.com/linuxdeepin/dde-file-manager/commit/4d5be539ba2c567bee1ec4aad90ecda0b87878d5.patch";
+      sha256 = "sha256-k808IsaV/RJg7bYNmUnhcFZMnMRQ8sGRagMlx5i4h4Q=";
+    })
+  ];
+
+  postPatch = ''
+    patchShebangs .
+
+    substituteInPlace src/plugins/filemanager/dfmplugin-vault/utils/vaultdefine.h \
+      --replace "/usr/bin/deepin-compressor" "deepin-compressor"
+
+    substituteInPlace src/plugins/filemanager/dfmplugin-avfsbrowser/utils/avfsutils.cpp \
+      --replace "/usr/bin/mountavfs" "mountavfs" \
+      --replace "/usr/bin/umountavfs" "umountavfs"
+
+    substituteInPlace src/plugins/common/core/dfmplugin-menu/{extendmenuscene/extendmenu/dcustomactionparser.cpp,oemmenuscene/oemmenu.cpp} \
+      --replace "/usr" "$out"
+
+    substituteInPlace src/tools/upgrade/dialog/processdialog.cpp \
+      --replace "/usr/bin/dde-file-manager" "dde-file-manager" \
+      --replace "/usr/bin/dde-desktop" "dde-desktop"
+
+    substituteInPlace src/dfm-base/file/local/localfilehandler.cpp \
+      --replace "/usr/lib/deepin-daemon" "/run/current-system/sw/lib/deepin-daemon"
+
+    substituteInPlace src/plugins/desktop/ddplugin-background/backgroundservice.cpp \
+      src/plugins/desktop/ddplugin-wallpapersetting/wallpapersettings.cpp \
+      --replace "/usr/share/backgrounds" "/run/current-system/sw/share/backgrounds"
+
+    find . -type f -regex ".*\\.\\(service\\|policy\\|desktop\\)" -exec sed -i -e "s|/usr/|$out/|g" {} \;
+  '';
+
+  buildInputs = [
+    dtkwidget
+    qt5platform-plugins
+    qt5integration
+    deepin-pdfium
+    util-dfm
+    dde-qt-dbus-factory
+    glibmm
+    docparser
+    dde-dock
+    deepin-movie-reborn
+    qtx11extras
+    qtmultimedia
+    kcodecs
+    ffmpegthumbnailer
+    libsecret
+    libmediainfo
+    mediainfo
+    poppler
+    polkit-qt
+    polkit
+    lucenepp
+    boost
+    taglib
+    cryptsetup
+    libuuid
+    libselinux
+    pcre
+    udisks2
+    libisoburn
+  ];
+
+  cmakeFlags = [
+    "-DVERSION=${version}"
+    "-DDEEPIN_OS_VERSION=20"
+  ];
+
+  enableParallelBuilding = true;
+
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  meta = with lib; {
+    description = "File manager for deepin desktop environment";
+    homepage = "https://github.com/linuxdeepin/dde-file-manager";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
+

pkgs/desktops/deepin/default.nix

@@ -28,6 +28,7 @@ let
     dde-calendar = callPackage ./core/dde-calendar { };
     dde-clipboard = callPackage ./core/dde-clipboard { };
     dde-dock = callPackage ./core/dde-dock { };
+    dde-file-manager = callPackage ./core/dde-file-manager { };
     dde-launcher = callPackage ./core/dde-launcher { };
     dde-network-core = callPackage ./core/dde-network-core { };
     dde-session-shell = callPackage ./core/dde-session-shell { };

pkgs/desktops/gnome/core/gucharmap/default.nix

@@ -45,7 +45,7 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "gucharmap";
-  version = "15.0.2";
+  version = "15.0.3";
 
   outputs = [ "out" "lib" "dev" "devdoc" ];
 
@@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "gucharmap";
     rev = version;
-    sha256 = "sha256-QoHLMq3U/BvpCFKttxLo0qs2xmZ/pCqPjsgq/MMWNbo=";
+    sha256 = "sha256-Rdi48IJdiZy8Dt8hQCkQW2VFWBX1P2CtPPfowCcAEq0=";
   };
 
   strictDeps = true;

pkgs/desktops/gnome/games/aisleriot/default.nix

@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation rec {
   pname = "aisleriot";
-  version = "3.22.27";
+  version = "3.22.28";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "aisleriot";
     rev = version;
-    sha256 = "sha256-XvYQ1JWMBWVZF5u3VL1zPADgMDMN/1FNuwZ4vaOeo7Y=";
+    sha256 = "sha256-/yxItJu8He6Zx7hDK5VaApqm9FJ6uK8KHIDj4adwb2Q=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome/misc/pomodoro/default.nix

@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-pomodoro";
-  version = "0.22.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-VsrguYU1rfYWse7FuA4uYASfqET0Q3RBeU7i+HOWFBw=";
+    hash = "sha256-0ZUTRrth5AfzI1E4JsuchbYeFwAbl9/XGBSYQ+AnNvM=";
   };
 
   patches = [

pkgs/development/compilers/llvm/git/compiler-rt/default.nix

@@ -66,6 +66,9 @@ stdenv.mkDerivation {
     "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=ON"
     "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.darwinArch}"
     "-DDARWIN_osx_BUILTIN_ARCHS=${stdenv.hostPlatform.darwinArch}"
+    # `COMPILER_RT_DEFAULT_TARGET_ONLY` does not apply to Darwin:
+    # https://github.com/llvm/llvm-project/blob/27ef42bec80b6c010b7b3729ed0528619521a690/compiler-rt/cmake/base-config-ix.cmake#L153
+    "-DCOMPILER_RT_ENABLE_IOS=OFF"
   ];
 
   outputs = [ "out" "dev" ];

pkgs/development/compilers/openjdk/11.nix

@@ -14,6 +14,9 @@ let
   update = "18";
   build = "10";
 
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk11-bootstrap.override { gtkSupport = !headless; };
+
   openjdk = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
     version = "${major}.${minor}.${update}+${build}";
@@ -29,7 +32,7 @@ let
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
-      libXi libXinerama libXcursor libXrandr fontconfig openjdk11-bootstrap
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
       gtk3 gnome_vfs GConf glib
     ];
@@ -58,7 +61,7 @@ let
     '';
 
     configureFlags = [
-      "--with-boot-jdk=${openjdk11-bootstrap.home}"
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-pre="
       "--enable-unlimited-crypto"
       "--with-native-debug-symbols=internal"
@@ -155,7 +158,7 @@ let
       done
     '';
 
-    disallowedReferences = [ openjdk11-bootstrap ];
+    disallowedReferences = [ openjdk-bootstrap ];
 
     meta = import ./meta.nix lib version;
 

pkgs/development/compilers/openjdk/12.nix

@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, bash, pkg-config, autoconf, cpio, file, which, unzip
 , zip, perl, cups, freetype, harfbuzz, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
 , libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama
-, libXcursor, libXrandr, fontconfig, openjdk11, fetchpatch
+, libXcursor, libXrandr, fontconfig, openjdk11-bootstrap, fetchpatch
 , setJavaClassPath
 , headless ? false
 , enableJavaFX ? false, openjfx
@@ -13,6 +13,9 @@ let
   update = ".0.2";
   build = "ga";
 
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk11-bootstrap.override { gtkSupport = !headless; };
+
   openjdk = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
     version = "${major}${update}-${build}";
@@ -26,7 +29,7 @@ let
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
-      libXi libXinerama libXcursor libXrandr fontconfig openjdk11
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
       gtk3 gnome_vfs GConf glib
     ];
@@ -59,7 +62,7 @@ let
     '';
 
     configureFlags = [
-      "--with-boot-jdk=${openjdk11.home}"
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-pre="
       "--enable-unlimited-crypto"
       "--with-native-debug-symbols=internal"
@@ -151,7 +154,7 @@ let
       done
     '';
 
-    disallowedReferences = [ openjdk11 ];
+    disallowedReferences = [ openjdk-bootstrap ];
 
     meta = import ./meta.nix lib version;
 

pkgs/development/compilers/openjdk/13.nix

@@ -13,6 +13,9 @@ let
   update = ".0.2";
   build = "-ga";
 
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk13-bootstrap.override { gtkSupport = !headless; };
+
   openjdk = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
     version = "${major}${update}${build}";
@@ -26,7 +29,7 @@ let
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
-      libXi libXinerama libXcursor libXrandr fontconfig openjdk13-bootstrap
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
       gtk3 gnome_vfs GConf glib
     ];
@@ -58,8 +61,13 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
-      "--with-boot-jdk=${openjdk13-bootstrap.home}"
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-pre="
       "--enable-unlimited-crypto"
       "--with-native-debug-symbols=internal"
@@ -151,7 +159,7 @@ let
       done
     '';
 
-    disallowedReferences = [ openjdk13-bootstrap ];
+    disallowedReferences = [ openjdk-bootstrap ];
 
     meta = import ./meta.nix lib version;
 

pkgs/development/compilers/openjdk/14.nix

@@ -13,6 +13,9 @@ let
   update = ".0.2";
   build = "-ga";
 
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk14-bootstrap.override { gtkSupport = !headless; };
+
   openjdk = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
     version = "${major}${update}${build}";
@@ -26,7 +29,7 @@ let
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
-      libXi libXinerama libXcursor libXrandr fontconfig openjdk14-bootstrap
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
       gtk3 gnome_vfs GConf glib
     ];
@@ -53,8 +56,13 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
-      "--with-boot-jdk=${openjdk14-bootstrap.home}"
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-pre="
       "--enable-unlimited-crypto"
       "--with-native-debug-symbols=internal"
@@ -147,7 +155,7 @@ let
       done
     '';
 
-    disallowedReferences = [ openjdk14-bootstrap ];
+    disallowedReferences = [ openjdk-bootstrap ];
 
     meta = import ./meta.nix lib version;
 

pkgs/development/compilers/openjdk/15.nix

@@ -16,6 +16,9 @@ let
     __toString = self: "${self.major}${self.update}${self.build}";
   };
 
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk15-bootstrap.override { gtkSupport = !headless; };
+
   openjdk = stdenv.mkDerivation {
     pname = "openjdk" + lib.optionalString headless "-headless";
     inherit version;
@@ -29,7 +32,7 @@ let
     buildInputs = [
       cpio perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
-      libXi libXinerama libXcursor libXrandr fontconfig openjdk15-bootstrap
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
       gtk3 gnome_vfs GConf glib
     ];
@@ -56,8 +59,13 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
-      "--with-boot-jdk=${openjdk15-bootstrap.home}"
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-pre="
       "--enable-unlimited-crypto"
       "--with-native-debug-symbols=internal"
@@ -150,7 +158,7 @@ let
       done
     '';
 
-    disallowedReferences = [ openjdk15-bootstrap ];
+    disallowedReferences = [ openjdk-bootstrap ];
 
     pos = builtins.unsafeGetAttrPos "major" version;
     meta = import ./meta.nix lib version.major;

pkgs/development/compilers/openjdk/16.nix

@@ -15,6 +15,9 @@ let
     build = "36";
   };
 
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk16-bootstrap.override { gtkSupport = !headless; };
+
   openjdk = stdenv.mkDerivation {
     pname = "openjdk" + lib.optionalString headless "-headless";
     version = "${version.feature}+${version.build}";
@@ -30,7 +33,7 @@ let
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
-      libXi libXinerama libXcursor libXrandr fontconfig openjdk16-bootstrap
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
       gtk3 gnome_vfs GConf glib
     ];
@@ -58,8 +61,13 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
-      "--with-boot-jdk=${openjdk16-bootstrap.home}"
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-build=${version.build}"
       "--with-version-opt=nixos"
       "--with-version-pre="
@@ -154,7 +162,7 @@ let
       done
     '';
 
-    disallowedReferences = [ openjdk16-bootstrap ];
+    disallowedReferences = [ openjdk-bootstrap ];
 
     pos = builtins.unsafeGetAttrPos "feature" version;
     meta = import ./meta.nix lib version.feature;

pkgs/development/compilers/openjdk/17.nix

@@ -15,6 +15,9 @@ let
     build = "10";
   };
 
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk17-bootstrap.override { gtkSupport = !headless; };
+
   openjdk = stdenv.mkDerivation {
     pname = "openjdk" + lib.optionalString headless "-headless";
     version = "${version.feature}${version.interim}+${version.build}";
@@ -30,7 +33,7 @@ let
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
-      libXi libXinerama libXcursor libXrandr fontconfig openjdk17-bootstrap
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
       gtk3 gnome_vfs GConf glib
     ];
@@ -75,8 +78,13 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
-      "--with-boot-jdk=${openjdk17-bootstrap.home}"
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-build=${version.build}"
       "--with-version-opt=nixos"
       "--with-version-pre="
@@ -173,7 +181,7 @@ let
       done
     '';
 
-    disallowedReferences = [ openjdk17-bootstrap ];
+    disallowedReferences = [ openjdk-bootstrap ];
 
     pos = builtins.unsafeGetAttrPos "feature" version;
     meta = import ./meta.nix lib version.feature;

pkgs/development/compilers/openjdk/18.nix

@@ -14,6 +14,9 @@ let
     build = "36";
   };
 
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk18-bootstrap.override { gtkSupport = !headless; };
+
   openjdk = stdenv.mkDerivation {
     pname = "openjdk" + lib.optionalString headless "-headless";
     version = "${version.feature}+${version.build}";
@@ -29,7 +32,7 @@ let
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
-      libXi libXinerama libXcursor libXrandr fontconfig openjdk18-bootstrap
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
       gtk3 gnome_vfs GConf glib
     ];
@@ -65,8 +68,13 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
-      "--with-boot-jdk=${openjdk18-bootstrap.home}"
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-build=${version.build}"
       "--with-version-opt=nixos"
       "--with-version-pre="
@@ -163,7 +171,7 @@ let
       done
     '';
 
-    disallowedReferences = [ openjdk18-bootstrap ];
+    disallowedReferences = [ openjdk-bootstrap ];
 
     pos = builtins.unsafeGetAttrPos "feature" version;
     meta = import ./meta.nix lib version.feature;

pkgs/development/compilers/openjdk/19.nix

@@ -18,6 +18,9 @@ let
     build = "7";
   };
 
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk19-bootstrap.override { gtkSupport = !headless; };
+
   openjdk = stdenv.mkDerivation {
     pname = "openjdk" + lib.optionalString headless "-headless";
     version = "${version.feature}${version.interim}+${version.build}";
@@ -33,7 +36,7 @@ let
     buildInputs = [
       cpio file which zip perl zlib cups freetype alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
-      libXi libXinerama libXcursor libXrandr fontconfig openjdk19-bootstrap
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
       gtk3 gnome_vfs GConf glib
     ];
@@ -77,8 +80,13 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
-      "--with-boot-jdk=${openjdk19-bootstrap.home}"
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-build=${version.build}"
       "--with-version-opt=nixos"
       "--with-version-pre="
@@ -173,7 +181,7 @@ let
       done
     '';
 
-    disallowedReferences = [ openjdk19-bootstrap ];
+    disallowedReferences = [ openjdk-bootstrap ];
 
     pos = builtins.unsafeGetAttrPos "feature" version;
     meta = import ./meta.nix lib version.feature;

pkgs/development/compilers/openjdk/8.nix

@@ -23,6 +23,9 @@ let
   update = "362";
   build = "ga";
 
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk8-bootstrap.override { gtkSupport = !headless; };
+
   openjdk8 = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
     version = "8u${update}-${build}";
@@ -37,9 +40,9 @@ let
 
     nativeBuildInputs = [ pkg-config lndir unzip ];
     buildInputs = [
-      cpio file which zip perl openjdk8-bootstrap zlib cups freetype alsa-lib
+      cpio file which zip perl zlib cups freetype alsa-lib
       libjpeg giflib libX11 libICE libXext libXrender libXtst libXt libXtst
-      libXi libXinerama libXcursor libXrandr fontconfig
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
       gtk2 gnome_vfs GConf glib
     ];
@@ -64,7 +67,7 @@ let
     '';
 
     configureFlags = [
-      "--with-boot-jdk=${openjdk8-bootstrap.home}"
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-update-version=${update}"
       "--with-build-number=${build}"
       "--with-milestone=fcs"

pkgs/development/compilers/temurin-bin/jdk-linux-base.nix

@@ -40,7 +40,7 @@ let
   providedCpuTypes = builtins.filter
     (arch: builtins.elem arch validCpuTypes)
     (builtins.attrNames sourcePerArch);
-  result = stdenv.mkDerivation rec {
+  result = stdenv.mkDerivation {
     pname = if sourcePerArch.packageType == "jdk"
       then "${name-prefix}-bin"
       else "${name-prefix}-${sourcePerArch.packageType}-bin";

pkgs/development/coq-modules/LibHyps/default.nix

@@ -4,7 +4,7 @@ mkCoqDerivation {
   pname = "LibHyps";
   owner = "Matafou";
   inherit version;
-  defaultVersion = if (lib.versions.range "8.11" "8.16") coq.version then "2.0.4.1" else null;
+  defaultVersion = if (lib.versions.range "8.11" "8.17") coq.version then "2.0.4.1" else null;
   release = {
     "2.0.4.1".sha256 = "09p89701zhrfdmqlpxw3mziw8yylj1w1skb4b0xpbdwd1vsn4k3h";
   };

pkgs/development/coq-modules/addition-chains/default.nix

@@ -12,7 +12,7 @@ mkCoqDerivation {
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.13" "8.16"; out = "0.6"; }
+    { case = range "8.13" "8.17"; out = "0.6"; }
     { case = range "8.11" "8.12"; out = "0.4"; }
   ] null;
 

pkgs/development/coq-modules/category-theory/default.nix

@@ -17,7 +17,7 @@ mkCoqDerivation {
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.14" "8.16"; out = "1.0.0"; }
+    { case = range "8.14" "8.17"; out = "1.0.0"; }
     { case = range "8.10" "8.15"; out = "20211213"; }
     { case = range "8.8" "8.9"; out = "20190414"; }
     { case = range "8.6" "8.7"; out = "20180709"; }

pkgs/development/coq-modules/coq-record-update/default.nix

@@ -5,7 +5,7 @@
   owner = "tchajed";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.10" "8.16";  out = "0.3.1"; }
+    { case = range "8.10" "8.17";  out = "0.3.1"; }
   ] null;
   release."0.3.1".sha256 = "sha256-DyGxO2tqmYZZluXN6Oy5Tw6fuLMyuyxonj8CCToWKkk=";
   release."0.3.0".sha256 = "1ffr21dd6hy19gxnvcd4if2450iksvglvkd6q5713fajd72hmc0z";

pkgs/development/coq-modules/metalib/default.nix

@@ -5,7 +5,7 @@ mkCoqDerivation {
   owner = "plclub";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.14" "8.16"; out = "8.15"; }
+    { case = range "8.14" "8.17"; out = "8.15"; }
     { case = range "8.10" "8.13"; out = "8.10"; }
   ] null;
   releaseRev = v: "coq${v}";

pkgs/development/coq-modules/semantics/default.nix

@@ -15,7 +15,7 @@ mkCoqDerivation rec {
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.10" "8.16"; out = "8.14.0"; }
+    { case = range "8.10" "8.17"; out = "8.14.0"; }
     { case = "8.9"; out = "8.9.0"; }
     { case = "8.8"; out = "8.8.0"; }
     { case = "8.7"; out = "8.7.0"; }

pkgs/development/coq-modules/trakt/default.nix

@@ -9,7 +9,7 @@ mkCoqDerivation {
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch [ coq.version ] [
-    { cases = [ (range "8.13" "8.16") ]; out = "1.0"; }
+    { cases = [ (range "8.13" "8.17") ]; out = "1.0"; }
   ] null;
 
   propagatedBuildInputs = [ coq-elpi ];

pkgs/development/interpreters/elixir/1.14.nix

@@ -1,8 +1,8 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "1.14.3";
+  version = "1.14.4";
-  sha256 = "sha256-8rkuyAQAZdaKFXnSMaIPwbgoHnPs+nJ+mdbqcqYNeE4=";
+  sha256 = "sha256-mV40pSpLrYKT43b8KXiQsaIB+ap+B4cS2QUxUoylm7c=";
-  # https://hexdocs.pm/elixir/1.14.3/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
+  # https://hexdocs.pm/elixir/1.14.4/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
   minimumOTPVersion = "23";
 }

pkgs/development/libraries/goffice/default.nix

@@ -1,5 +1,8 @@
 { fetchurl, lib, stdenv, pkg-config, intltool, glib, gtk3, lasem
-, libgsf, libxml2, libxslt, cairo, pango, librsvg, gnome }:
+, libgsf, libxml2, libxslt, cairo, pango, librsvg, gnome
+, autoreconfHook
+, gtk-doc
+}:
 
 stdenv.mkDerivation rec {
   pname = "goffice";
@@ -12,7 +15,10 @@ stdenv.mkDerivation rec {
     sha256 = "FqIhGRhVpqbA0Gse+OSBzz9SBBplTsltNYFwRboama8=";
   };
 
-  nativeBuildInputs = [ pkg-config intltool ];
+  nativeBuildInputs = [
+    pkg-config intltool autoreconfHook gtk-doc
+    glib  # for glib-genmarshal
+  ];
 
   propagatedBuildInputs = [
     glib gtk3 libxml2 cairo pango libgsf lasem

pkgs/development/libraries/gpgme/default.nix

@@ -17,7 +17,6 @@
 , qtbase ? null
 , pythonSupport ? false
 , swig2 ? null
-, python ? null
 # only for passthru.tests
 , libsForQt5
 , python3
@@ -51,12 +50,16 @@ stdenv.mkDerivation rec {
     pkg-config
     texinfo
   ] ++ lib.optionals pythonSupport [
+    python3.pythonForBuild
     ncurses
-    python
     swig2
     which
   ];
 
+  buildInputs = lib.optionals pythonSupport [
+    python3
+  ];
+
   propagatedBuildInputs = [
     glib
     libassuan

pkgs/development/libraries/gstreamer/ges/default.nix

@@ -35,7 +35,6 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     gobject-introspection
-    gst-devtools
     python3
     flex
 
@@ -47,6 +46,8 @@ stdenv.mkDerivation rec {
     bash-completion
     libxml2
     gobject-introspection
+    gst-devtools
+    python3
   ];
 
   propagatedBuildInputs = [

pkgs/development/libraries/gstreamer/vaapi/default.nix

@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
+    python3
     bzip2
 
     # documentation
@@ -62,7 +63,6 @@ stdenv.mkDerivation rec {
     libGLU
     nasm
     libvpx
-    python3
   ];
 
   mesonFlags = [

pkgs/development/libraries/qt-6/modules/qtbase.nix

@@ -184,6 +184,7 @@ stdenv.mkDerivation rec {
     libinput
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
     AppKit
+    CoreBluetooth
   ]
   ++ lib.optional withGtk3 gtk3
   ++ lib.optional developerBuild gdb

pkgs/development/libraries/science/astronomy/indilib/default.nix

@@ -53,6 +53,8 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/indilib/indi/releases/tag/v${version}";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ hjones2199 ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
+    # error: use of undeclared identifier 'MSG_NOSIGNAL'
+    broken = stdenv.isDarwin && stdenv.isx86_64;
   };
 }

pkgs/development/libraries/simdjson/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "simdjson";
-  version = "3.1.6";
+  version = "3.1.7";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     rev = "v${version}";
-    sha256 = "sha256-9WVLvyehbXSLD7HNIwMkkq1XzF0jB8PkltsWSNfXaDk=";
+    sha256 = "sha256-a6I1qcuBSkwQxuU4T7tKrqouhLMJsY/rfCKqhGGvkjQ=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/misc/datafusion/default.nix

@@ -7,17 +7,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "datafusion-cli";
-  version = "15.0.0";
+  version = "22.0.0";
 
   src = fetchFromGitHub {
+    name = "datafusion-cli-source";
     owner = "apache";
     repo = "arrow-datafusion";
     rev = version;
-    sha256 = "sha256-s+gQoczTesJGOpz4W5hBPDdxo4eQnf+D10+V2kx65Io=";
+    sha256 = "sha256-TWvbtuLmAdYS8otD2TpVlZx2FJS6DF03U2zM28FNsfc=";
   };
-  sourceRoot = "source/datafusion-cli";
 
-  cargoSha256 = "sha256-w+/5Ig+U8y4nwu7QisnZvc3UlZaEU/kovV6birOWndE=";
+  sourceRoot = "datafusion-cli-source/datafusion-cli";
+
+  cargoSha256 = "sha256-muWWVJDKm4rbpCK0SS7Zj6umFoMKGMScEAd2ZyZ5An8=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
@@ -26,6 +28,8 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [
     # fails even outside the Nix sandbox
     "--skip=object_storage::tests::s3_region_validation"
+    # broken
+    "--skip=exec::tests::create_object_store_table_gcs"
   ];
 
   meta = with lib; {

pkgs/development/nim-packages/illwillwidgets/default.nix

@@ -0,0 +1,21 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "illwillwidgets";
+  version = "0.1.11";
+
+  src = fetchFromGitHub {
+    owner = "enthus1ast";
+    repo = "illwillWidgets";
+    rev = "04f507cfd651df430b1421403b3a70cb061c4624";
+    hash = "sha256-YVNdgs8jquJ58qbcyNMMJt+hJYcvahYpkSrDBbO4ILU=";
+  };
+
+  meta = with lib;
+    src.meta // {
+      description = "Mouse enabled widgets for illwill";
+
+      license = [ licenses.mit ];
+      maintainers = with maintainers; [ marcusramberg ];
+    };
+}

pkgs/development/php-packages/pdepend/default.nix

@@ -2,14 +2,14 @@
 
 let
   pname = "pdepend";
-  version = "2.12.1";
+  version = "2.13.0";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pdepend/pdepend/releases/download/${version}/pdepend.phar";
-    sha256 = "sha256-/fmrmtMBFycN6su/JEdFzB2uTDtHZvhZMYgl7duaaIE=";
+    sha256 = "sha256-cd76PoHzAqsRxQzvklyEIsNO+4jByK8Mwx1aNu8rnnk=";
   };
 
   dontUnpack = true;

pkgs/development/python-modules/accuweather/default.nix

@@ -12,25 +12,18 @@
 
 buildPythonPackage rec {
   pname = "accuweather";
-  version = "0.5.0";
+  version = "0.5.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-v4mFvW+p0g+5IeZT8o0Z60MafHyYZ62d4lNH27wlAeI=";
+    hash = "sha256-kWhb9tDp7/p5iCXTpf4/fjSo1ceuA9I2eqSprt50rWU=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "pytest-runner" ""
-    substituteInPlace setup.cfg \
-      --replace "--cov --cov-report term-missing" ""
-  '';
-
   propagatedBuildInputs = [
     aiohttp
     orjson

pkgs/development/python-modules/bytecode/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "bytecode";
-  version = "0.14.0";
+  version = "0.14.1";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "vstinner";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-nGZ4qcms27lYr1dYvVe4ebd/jc5qIb1EDhSpSZmKKIo=";
+    hash = "sha256-vSuGjNTQw7prFxmVyiq7s8cnl+VGbRArC2sp7GVP0XA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/cwl-upgrader/default.nix

@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, mypy-extensions
 , pytest-xdist
 , pytestCheckHook
 , pythonOlder
@@ -30,6 +31,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
+    mypy-extensions
     ruamel-yaml
     schema-salad
   ];

pkgs/development/python-modules/cwl-utils/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-utils";
-  version = "0.23";
+  version = "0.24";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-tr4QQ/p0jx/e5kHx4WSYfo06/qMNFyxIGsaAA8nBBoA=";
+    hash = "sha256-g8HnY5/UDmujijXStNRwKBGMZ3soUHKPIlpJdIQaAlE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/databricks-cli/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "databricks-cli";
-  version = "0.17.5";
+  version = "0.17.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "databricks";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-HaSSaRd8WFq1g8WT5forBGBz9hSKsyBiTD4FnLprSgE=";
+    hash = "sha256-K20fhfdJuABqpbm8O8PSA9pIW8Uu1MdlP3r5E49pt6Q=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/datafusion/default.nix

@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, fetchurl
 , buildPythonPackage
 , fetchPypi
 , fetchFromGitHub
@@ -8,39 +7,45 @@
 , pytestCheckHook
 , libiconv
 , numpy
-, pandas
+, protobuf
 , pyarrow
 }:
 
 let
   arrow-testing = fetchFromGitHub {
+    name = "arrow-testing";
     owner = "apache";
     repo = "arrow-testing";
-    rev = "5bab2f264a23f5af68f69ea93d24ef1e8e77fc88";
+    rev = "47f7b56b25683202c1fd957668e13f2abafc0f12";
-    hash = "sha256-Pxx8ohUpXb5u1995IvXmxQMqWiDJ+7LAll/AjQP7ph8=";
+    hash = "sha256-ZDznR+yi0hm5O1s9as8zq5nh1QxJ8kXCRwbNQlzXpnI=";
   };
 
   parquet-testing = fetchFromGitHub {
+    name = "parquet-testing";
     owner = "apache";
     repo = "parquet-testing";
-    rev = "5b82793ef7196f7b3583e85669ced211cd8b5ff2";
+    rev = "b2e7cc755159196e3a068c8594f7acbaecfdaaac";
-    hash = "sha256-gcOvk7qFHZgJWE9CpucC8zwayYw47VbC3lmSRu4JQFg=";
+    hash = "sha256-IFvGTOkaRSNgZOj8DziRj88yH5JRF+wgSDZ5N0GNvjk=";
   };
 in
 
 buildPythonPackage rec {
   pname = "datafusion";
-  version = "0.7.0";
+  version = "22.0.0";
   format = "pyproject";
 
-  src = fetchPypi {
+  src = fetchFromGitHub {
-    inherit pname version;
+    name = "datafusion-source";
-    hash = "sha256-XYXZMorPs2Ue7E38DASd4rmxvX0wlx8A6sCpAbYUh4I=";
+    owner = "apache";
+    repo = "arrow-datafusion-python";
+    rev = "22.0.0";
+    hash = "sha256-EKurQ4h5IOTU3JiGN+MHrDciQUadUrywNRhnv9S/9iY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
+    name = "datafusion-cargo-deps";
     inherit src pname version;
-    hash = "sha256-6mPdKwsEN09Gf4eNsd/v3EBHVezHmff/KYB2lsXgzcA=";
+    hash = "sha256-0kfavTFqsQ1Uvg5nQw6VFGlvih8ysOyS2KGT4cTIsVI=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -48,15 +53,11 @@ buildPythonPackage rec {
     maturinBuildHook
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
+  buildInputs = [ protobuf ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = [ pyarrow ];
-    numpy
-    pandas
-    pyarrow
-  ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ pytestCheckHook numpy ];
   pythonImportsCheck = [ "datafusion" ];
   pytestFlagsArray = [ "--pyargs" pname ];
 

pkgs/development/python-modules/deepdiff/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "deepdiff";
-  version = "6.2.3";
+  version = "6.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "seperman";
     repo = "deepdiff";
     rev = "refs/tags/${version}";
-    hash = "sha256-rlMksUi+R48fIEjVv2E3yOETDezTghZ8+Zsypu8fAnQ=";
+    hash = "sha256-txZ1X1J8DwueDRpLP3OuRA+S9hc5G3YCmEG+AS6ZAkI=";
   };
 
   postPatch = ''

pkgs/development/python-modules/dicom2nifti/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dicom2nifti";
-  version = "2.4.3";
+  version = "2.4.8";
   disabled = pythonOlder "3.6";
 
   # no tests in PyPI dist
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "icometrix";
     repo = pname;
     rev = version;
-    hash = "sha256-za2+HdnUhPu3+p29JsF4iL1lyPQVmEv3fam0Yf1oeMQ=";
+    hash = "sha256-2Pspxdeu3pHwXpbjS6bQQnvdeMuITRwYarPuLlmNcv8";
   };
 
   propagatedBuildInputs = [ gdcm nibabel numpy pydicom scipy setuptools ];

pkgs/development/python-modules/frigidaire/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "frigidaire";
-  version = "0.18.5";
+  version = "0.18.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,13 +20,11 @@ buildPythonPackage rec {
     owner = "bm1549";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-mmHcS0cjj43hCHLiCO8cGPfQoh+nqlNK3MdFP8IhD4w=";
+    hash = "sha256-U6ko6P5/ANGy84GQDuSQq+YArou0TrXH5SIc5x4euvU=";
   };
 
   postPatch = ''
-    # https://github.com/bm1549/frigidaire/issues/14
     substituteInPlace setup.py \
-      --replace "urllib3>=1.26.42" "urllib3" \
       --replace 'version = "SNAPSHOT"' 'version = "${version}"'
   '';
 

pkgs/development/python-modules/gaphas/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "gaphas";
-  version = "3.9.2";
+  version = "3.10.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hw8aGjsrx6xWPbFybpss5EB3eg6tmxgkXpGiWguLKP4=";
+    hash = "sha256-I+/DsXppY//KOZgydDR4/Ks5qEsL4hLIiH+GaaFZHpA=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/hahomematic/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2023.3.0";
+  version = "2023.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-ZclhJoJg80P0iysA0G7+gTg8S3qJaaAbHsr4v6DUGKQ=";
+    hash = "sha256-LS46I3f6ivBnQ5mLrh6tVCQBfjsMJx0RD6fgyczLQr4=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/jupyter-book/default.nix

@@ -65,6 +65,7 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "docutils"
+    "sphinx-design"
   ];
 
   pythonImportsCheck = [

pkgs/development/python-modules/jupyterlab-lsp/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab-lsp";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Rh5rX48HglIGy7Qg4lvmP3bVVCB3ibWnenCHMui5pJE=";
+    hash = "sha256-1VPRfs+F24h2xJeoJglZQpuCcPDk6Ptf8cWrAW3G5to=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/onvif-zeep-async/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "onvif-zeep-async";
-  version = "1.2.3";
+  version = "1.2.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ziFDSGKJB4wGvEF5x8eFMLVKHORXKkLbqBkAjy7FSX4=";
+    hash = "sha256-JjdttEa3Mua4aTaLvr3v9o/ZG+FAQ4g2+ijvUIdhf90=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/peaqevcore/default.nix

@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "15.2.4";
+  version = "15.2.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+k1G4A4bJJzRfYRISp869NeCBTsVldWb+c6Z1tNZNg0=";
+    hash = "sha256-z/wGjLAigZ7EHckj7h4IK14tpybIvK3NyECCNy9+H7g=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pontos/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "23.4.2";
+  version = "23.4.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-z7mZVcL7zu4SJZm22S6hbEWROb6OwesuqRNKFpXCe+U=";
+    hash = "sha256-dfalOFksqrOOhoQz2VCeEFS10Sqr7qmjgH7Rgb2YCeY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pooch/default.nix

@@ -7,6 +7,9 @@
 , packaging
 , appdirs
 , requests
+, tqdm
+, paramiko
+, xxhash
 }:
 
 buildPythonPackage rec {
@@ -44,6 +47,14 @@ buildPythonPackage rec {
     "integration"
   ];
 
+  passthru = {
+    optional-dependencies = {
+      progress = [ tqdm ];
+      sftp = [ paramiko ];
+      xxhash = [ xxhash ];
+    };
+  };
+
   meta = with lib; {
     description = "A friend to fetch your data files.";
     homepage = "https://github.com/fatiando/pooch";