Merge master into staging-next

2024-02-23 12:01:18 +00:00 · 2024-02-23 12:01:18 +00:00 · d08f9b5833
commit d08f9b5833
parent 8c8dc02d9d b13bb492c7
41 changed files with 625 additions and 219 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -129,19 +129,17 @@ When a PR is created, it will be pre-populated with some checkboxes detailed bel

 #### Tested using sandboxing

-When sandbox builds are enabled, Nix will setup an isolated environment for each build process. It is used to remove further hidden dependencies set by the build environment to improve reproducibility. This includes access to the network during the build outside of `fetch*` functions and files outside the Nix store. Depending on the operating system access to other resources are blocked as well (ex. inter process communication is isolated on Linux); see [sandbox](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-sandbox) in the Nix manual for details.
+When sandbox builds are enabled, Nix will set up an isolated environment for each build process.
+It is used to remove further hidden dependencies set by the build environment to improve reproducibility.
+This includes access to the network during the build outside of `fetch*` functions and files outside the Nix store.
+Depending on the operating system, access to other resources is blocked as well (e.g., inter-process communication is isolated on Linux); see [sandbox](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-sandbox) in the Nix manual for details.

-Sandboxing is not enabled by default in Nix due to a small performance hit on each build. In pull requests for [nixpkgs](https://github.com/NixOS/nixpkgs/) people are asked to test builds with sandboxing enabled (see `Tested using sandboxing` in the pull request template) because in [Hydra](https://nixos.org/hydra/) sandboxing is also used.
+In pull requests for [nixpkgs](https://github.com/NixOS/nixpkgs/) people are asked to test builds with sandboxing enabled (see `Tested using sandboxing` in the pull request template) because in [Hydra](https://nixos.org/hydra/) sandboxing is also used.

-Depending if you use NixOS or other platforms you can use one of the following methods to enable sandboxing **before** building the package:
+If you are on Linux, sandboxing is enabled by default.
+On other platforms, sandboxing is disabled by default due to a small performance hit on each build.

- **Globally enable sandboxing on NixOS**: add the following to `configuration.nix`
-
-  ```nix
-  nix.settings.sandbox = true;
-  ```
-
- **Globally enable sandboxing on non-NixOS platforms**: add the following to: `/etc/nix/nix.conf`
+Please enable sandboxing **before** building the package by adding the following to: `/etc/nix/nix.conf`:

  ```ini
  sandbox = true
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4433,6 +4433,12 @@
    githubId = 49904992;
    name = "Dawid Sowa";
  };
+  dawoox = {
+    email = "contact@antoinebellanger.fr";
+    github = "dawoox";
+    githubId = 48325941;
+    name = "Dawoox";
+  };
  daylinmorgan = {
    email = "daylinmorgan@gmail.com";
    github = "daylinmorgan";
--- a/nixos/modules/programs/ccache.nix
+++ b/nixos/modules/programs/ccache.nix
@ -1,35 +1,43 @@
 { config, pkgs, lib, ... }:

-with lib;
 let
  cfg = config.programs.ccache;
 in {
  options.programs.ccache = {
    # host configuration
-    enable = mkEnableOption (lib.mdDoc "CCache");
-    cacheDir = mkOption {
-      type = types.path;
+    enable = lib.mkEnableOption (lib.mdDoc "CCache");
+    cacheDir = lib.mkOption {
+      type = lib.types.path;
      description = lib.mdDoc "CCache directory";
      default = "/var/cache/ccache";
    };
    # target configuration
-    packageNames = mkOption {
-      type = types.listOf types.str;
+    packageNames = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
      description = lib.mdDoc "Nix top-level packages to be compiled using CCache";
      default = [];
      example = [ "wxGTK32" "ffmpeg" "libav_all" ];
    };
+    owner = lib.mkOption {
+      type = lib.types.str;
+      default = "root";
+      description = lib.mdDoc "Owner of CCache directory";
+    };
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "nixbld";
+      description = lib.mdDoc "Group owner of CCache directory";
+    };
  };

-  config = mkMerge [
+  config = lib.mkMerge [
    # host configuration
-    (mkIf cfg.enable {
-      systemd.tmpfiles.rules = [ "d ${cfg.cacheDir} 0770 root nixbld -" ];
+    (lib.mkIf cfg.enable {
+      systemd.tmpfiles.rules = [ "d ${cfg.cacheDir} 0770 ${cfg.owner} ${cfg.group} -" ];

      # "nix-ccache --show-stats" and "nix-ccache --clear"
      security.wrappers.nix-ccache = {
-        owner = "root";
-        group = "nixbld";
+        inherit (cfg) owner group;
        setuid = false;
        setgid = true;
        source = pkgs.writeScript "nix-ccache.pl" ''
@ -50,9 +58,9 @@ in {
    })

    # target configuration
-    (mkIf (cfg.packageNames != []) {
+    (lib.mkIf (cfg.packageNames != []) {
      nixpkgs.overlays = [
-        (self: super: genAttrs cfg.packageNames (pn: super.${pn}.override { stdenv = builtins.trace "with ccache: ${pn}" self.ccacheStdenv; }))
+        (self: super: lib.genAttrs cfg.packageNames (pn: super.${pn}.override { stdenv = builtins.trace "with ccache: ${pn}" self.ccacheStdenv; }))

        (self: super: {
          ccacheWrapper = super.ccacheWrapper.override {
@ -65,7 +73,7 @@ in {
                echo "Directory '$CCACHE_DIR' does not exist"
                echo "Please create it with:"
                echo "  sudo mkdir -m0770 '$CCACHE_DIR'"
-                echo "  sudo chown root:nixbld '$CCACHE_DIR'"
+                echo "  sudo chown ${cfg.owner}:${cfg.group} '$CCACHE_DIR'"
                echo "====="
                exit 1
              fi
--- a/nixos/tests/ccache.nix
+++ b/nixos/tests/ccache.nix
@ -0,0 +1,24 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "ccache";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ehmry ];
+  };
+
+  nodes.machine = { ... }: {
+    imports = [ ../modules/profiles/minimal.nix ];
+    environment.systemPackages = [ pkgs.hello ];
+    programs.ccache = {
+      enable = true;
+      packageNames = [ "hello" ];
+    };
+  };
+
+  testScript =
+    ''
+      start_all()
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("nix-ccache --show-stats")
+      machine.succeed("hello")
+      machine.shutdown()
+    '';
+})
--- a/nixos/tests/matomo.nix
+++ b/nixos/tests/matomo.nix
@ -47,4 +47,8 @@ in {
    name = "matomo-beta";
    meta.maintainers = with maintainers; [ florianjacob kiwi mmilata twey boozedog ];
  };
+  matomo_5 = matomoTest pkgs.matomo_5 // {
+    name = "matomo-5";
+    meta.maintainers = with maintainers; [ florianjacob kiwi mmilata twey boozedog ] ++ lib.teams.flyingcircus.members;
+  };
 }
--- a/pkgs/applications/audio/raysession/default.nix
+++ b/pkgs/applications/audio/raysession/default.nix
@ -2,11 +2,11 @@

 buildPythonApplication rec {
  pname = "raysession";
-  version = "0.14.2";
+  version = "0.14.3";

  src = fetchurl {
    url = "https://github.com/Houston4444/RaySession/releases/download/v${version}/RaySession-${version}-source.tar.gz";
-    sha256 = "sha256-qEN3zBK/goRLIZaU06XXm8H5yj4Qjj/NH+bkHkjhLaw=";
+    sha256 = "sha256-3+g1zdjGkxNEpyuKuxzhr2p9gkEFjYAso4fPedbjmlY=";
  };

  postPatch = ''
--- a/pkgs/applications/graphics/rawtherapee/default.nix
+++ b/pkgs/applications/graphics/rawtherapee/default.nix
@ -20,17 +20,21 @@
 , librsvg
 , libcanberra-gtk3
 , gtk-mac-integration
+, exiv2
 }:

 stdenv.mkDerivation rec {
  pname = "rawtherapee";
-  version = "5.9";
+  version = "5.10";

  src = fetchFromGitHub {
    owner = "Beep6581";
    repo = "RawTherapee";
    rev = version;
-    hash = "sha256-kdctfjss/DHEcaSDPXcmT20wXTwkI8moRX/i/5wT5Hg=";
+    hash = "sha256-rIwwKNm7l7oPEt95sHyRj4aF3mtnvM4KAu8oVaIMwyE=";
+    # The developpers ask not to use the tarball from Github releases, see
+    # https://www.rawtherapee.com/downloads/5.10/#news-relevant-to-package-maintainers
+    forceFetchGit = true;
  };

  postPatch = ''
@ -61,6 +65,7 @@ stdenv.mkDerivation rec {
    libsigcxx
    lensfun
    librsvg
+    exiv2
  ] ++ lib.optionals stdenv.isLinux [
    libcanberra-gtk3
  ] ++ lib.optionals stdenv.isDarwin [
--- a/pkgs/applications/networking/browsers/yandex-browser/default.nix
+++ b/pkgs/applications/networking/browsers/yandex-browser/default.nix
@ -54,15 +54,15 @@

 let
  version = {
-    corporate = "23.9.1.1016-1";
-    beta = "23.9.1.1028-1";
-    stable = "23.9.1.962-1";
+    corporate = "23.11.1.822-1";
+    beta = "24.1.1.939-1";
+    stable = "24.1.1.940-1";
  }.${edition};

  hash = {
-    corporate = "sha256-A/MjphA6vefDzPmShpPbgjDTl4WnCiZWuHofy1Djrzc=";
-    beta = "sha256-vnz1weMwR3V/mBNzrJ0iqnA/aifYTCucW+9kyy/0SnA=";
-    stable = "sha256-VrDqFLvK7RdnV6Yt1DILu7mV1WFcilOH5+VKlCdpXjc=";
+    corporate = "sha256-OOcz2dQeVea0vBjF1FyrCsnRR+WrCzfLTd+YXpLJCsI=";
+    beta = "sha256-Meswp1aeNTBr79l7XGWqJT9qqUdOfSzIpdL1L29UfJw=";
+    stable = "sha256-FZHoCRedpHHVwibSXts2DncUN83PZ9UlVOSXPjgAaNs=";
  }.${edition};

  app = {
--- a/pkgs/applications/networking/cluster/opentofu/default.nix
+++ b/pkgs/applications/networking/cluster/opentofu/default.nix
@ -14,13 +14,13 @@
 let
  package =  buildGoModule rec {
    pname = "opentofu";
-    version = "1.6.1";
+    version = "1.6.2";

    src = fetchFromGitHub {
      owner = "opentofu";
      repo = "opentofu";
      rev = "v${version}";
-      hash = "sha256-wEDxZtmC+SLIYbN+mGTmefcD6VZu87E9E0XhiJPGmK0=";
+      hash = "sha256-CYiwn2NDIAx30J8tmbrV45dbCIGoA3U+yBdMj4RX5Ho=";
    };

    vendorHash = "sha256-kSm5RZqQRgbmPaKt5IWmuMhHwAu+oJKTX1q1lbE7hWk=";
--- a/pkgs/applications/radio/gnss-sdr/default.nix
+++ b/pkgs/applications/radio/gnss-sdr/default.nix
@ -21,13 +21,13 @@

 gnuradio.pkgs.mkDerivation rec {
  pname = "gnss-sdr";
-  version = "0.0.17";
+  version = "0.0.19.1";

  src = fetchFromGitHub {
    owner = "gnss-sdr";
    repo = "gnss-sdr";
    rev = "v${version}";
-    sha256 = "sha256-0aAjkrVAswoRL/KANBSZ5Jq4Y9VwOHZKUKLpXDdKtk8=";
+    sha256 = "sha256-IbkYdw1pwI+FMnZMChsxMz241Kv4EzMcBb0mm6/jq1k=";
  };

  patches = [
@ -75,27 +75,27 @@ gnuradio.pkgs.mkDerivation rec {
  ];

  cmakeFlags = [
-    "-DGFlags_INCLUDE_DIRS=${gflags}/include"
-    "-DGLOG_INCLUDE_DIR=${glog}/include"
+    (lib.cmakeFeature "GFlags_INCLUDE_DIRS" "${gflags}/include")
+    (lib.cmakeFeature "GLOG_INCLUDE_DIR" "${glog}/include")
    # Should use .dylib if darwin support is requested
-    "-DGFlags_LIBS=${gflags}/lib/libgflags.so"
-    "-DGLOG_LIBRARIES=${glog}/lib/libglog.so"
+    (lib.cmakeFeature "GFlags_LIBS" "${gflags}/lib/libgflags.so")
+    (lib.cmakeFeature "-DGLOG_LIBRARIES" "${glog}/lib/libglog.so")
    # Use our dependencies glog, gflags and armadillo dependencies
-    "-DENABLE_OWN_GLOG=OFF"
-    "-DENABLE_OWN_ARMADILLO=OFF"
-    "-DENABLE_ORC=ON"
-    "-DENABLE_LOG=ON"
-    "-DENABLE_RAW_UDP=${if enableRawUdp then "ON" else "OFF"}"
-    "-DENABLE_UHD=${if (gnuradio.hasFeature "gr-uhd") then "ON" else "OFF"}"
-    "-DENABLE_FMCOMMS2=${if (gnuradio.hasFeature "gr-iio" && gnuradio.hasFeature "gr-pdu") then "ON" else "OFF"}"
-    "-DENABLE_PLUTOSDR=${if (gnuradio.hasFeature "gr-iio") then "ON" else "OFF"}"
-    "-DENABLE_AD9361=${if (gnuradio.hasFeature "gr-pdu") then "ON" else "OFF"}"
-    "-DENABLE_UNIT_TESTING=OFF"
+    (lib.cmakeBool "ENABLE_OWN_GLOG" false)
+    (lib.cmakeBool "ENABLE_OWN_ARMADILLO" false)
+    (lib.cmakeBool "ENABLE_ORC" true)
+    (lib.cmakeBool "ENABLE_LOG" true)
+    (lib.cmakeBool "ENABLE_RAW_UDP" enableRawUdp)
+    (lib.cmakeBool "ENABLE_UHD" (gnuradio.hasFeature "gr-uhd"))
+    (lib.cmakeBool "ENABLE_FMCOMMS2" (gnuradio.hasFeature "gr-iio" && gnuradio.hasFeature "gr-pdu"))
+    (lib.cmakeBool "ENABLE_PLUTOSDR" (gnuradio.hasFeature "gr-iio"))
+    (lib.cmakeBool "ENABLE_AD9361" (gnuradio.hasFeature "gr-pdu"))
+    (lib.cmakeBool "ENABLE_UNIT_TESTING" false)

    # gnss-sdr doesn't truly depend on BLAS or LAPACK, as long as
    # armadillo is built using both, so skip checking for them.
-    "-DBLAS_LIBRARIES=-lblas"
-    "-DLAPACK_LIBRARIES=-llapack"
+    (lib.cmakeFeature "BLAS_LIBRARIES" "-lblas")
+    (lib.cmakeFeature "LAPACK_LIBRARIES" "-llapack")
  ];

  meta = with lib; {
--- a/pkgs/applications/radio/gnss-sdr/fix_libcpu_features_install_path.patch
+++ b/pkgs/applications/radio/gnss-sdr/fix_libcpu_features_install_path.patch
@ -1,7 +1,7 @@
 --- i/CMakeLists.txt
 +++ w/CMakeLists.txt
-@@ -1210,7 +1210,7 @@ if(NOT VOLKGNSSSDR_FOUND)
-             BINARY_DIR ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/build
+@@ -1233,7 +1233,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+             BINARY_DIR ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/build
             CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
                 -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
 -                -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
@ -9,17 +9,17 @@
             DOWNLOAD_COMMAND ""
             UPDATE_COMMAND ""
             PATCH_COMMAND ""
-@@ -1248,7 +1248,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+@@ -1274,7 +1274,7 @@ if(NOT VOLKGNSSSDR_FOUND)
                     )
                     set(VOLK_GNSSSDR_BUILD_BYPRODUCTS
                         ${VOLK_GNSSSDR_BUILD_BYPRODUCTS}
-                        ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
-+                        ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
+-                        ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
+                        ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
                     )
                 endif()
             endif()
-@@ -1261,7 +1261,7 @@ if(NOT VOLKGNSSSDR_FOUND)
-                 BINARY_DIR ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/build
+@@ -1287,7 +1287,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+                 BINARY_DIR ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/build
                 CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
                     -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
 -                    -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
@ -27,8 +27,8 @@
                 DOWNLOAD_COMMAND ""
                 UPDATE_COMMAND ""
                 PATCH_COMMAND ""
-@@ -1280,7 +1280,7 @@ if(NOT VOLKGNSSSDR_FOUND)
-                 BINARY_DIR ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/build
+@@ -1306,7 +1306,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+                 BINARY_DIR ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/build
                 CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
                     -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
 -                    -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
@ -36,12 +36,12 @@
                 DOWNLOAD_COMMAND ""
                 UPDATE_COMMAND ""
                 PATCH_COMMAND ""
-@@ -1319,7 +1319,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+@@ -1346,7 +1346,7 @@ if(NOT VOLKGNSSSDR_FOUND)
         if(CMAKE_VERSION VERSION_GREATER 3.0 AND SUPPORTED_CPU_FEATURES_ARCH)
             if(NOT CPUFEATURES_FOUND AND ENABLE_CPUFEATURES)
                 set_target_properties(Volkgnsssdr::volkgnsssdr PROPERTIES
-                    INTERFACE_LINK_LIBRARIES ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
-+                    INTERFACE_LINK_LIBRARIES ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
+-                    INTERFACE_LINK_LIBRARIES ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
+                    INTERFACE_LINK_LIBRARIES ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
                 )
             endif()
         endif()
--- a/pkgs/applications/science/logic/elan/default.nix
+++ b/pkgs/applications/science/logic/elan/default.nix
@ -3,16 +3,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "elan";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "leanprover";
    repo = "elan";
    rev = "v${version}";
-    hash = "sha256-IC/xb4tZer2cbwIusdCwXxJS3K7kN/XFoU4mxKW4dVc=";
+    hash = "sha256-/g5bO3UQcg0XYm62KdoWcVQqOV3SIedWUYLufEcblmE=";
  };

-  cargoHash = "sha256-F80iiXb0UpV+N9q7Msef6/Uzas1DGjMKPWuOKrk8tqU=";
+  cargoHash = "sha256-f8YVUTxHX1FY2p73DlnLDtCJaG/0JImUtJFraV6ErNM=";

  nativeBuildInputs = [ pkg-config makeWrapper ];

--- a/pkgs/by-name/ac/action-validator/package.nix
+++ b/pkgs/by-name/ac/action-validator/package.nix
@ -5,17 +5,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "action-validator";
-  version = "0.5.4";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "mpalmer";
    repo = "action-validator";
    rev = "v${version}";
-    hash = "sha256-roWmks+AgRf2ACoI7Vc/QEyqgQ0bR/XhRwLk9VaLEdY=";
+    hash = "sha256-lJHGx/GFddIwVVXRj75Z/l5CH/yuw/uIhr02Qkjruww=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-WUtFWuk2y/xXe39doMqANaIr0bbxmLDpT4/H2GRGH6k=";
+  cargoHash = "sha256-mBY+J6JcIhV++tO6Dhw5JvYLSwoYZR3lB3l0KTjkcQM=";

  meta = with lib; {
    description = "Tool to validate GitHub Action and Workflow YAML files";
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ast-grep";
-  version = "0.19.1";
+  version = "0.19.2";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    rev = version;
-    hash = "sha256-uRAWcEG4+8tkfHe9bmVSWsRp3A35+5PRPdGuXuDm210=";
+    hash = "sha256-u9VoLGf8Qfy6wtU+rWZvIxOj1Q3RUKjE+LKISKtTKfA=";
  };

-  cargoHash = "sha256-U7W3Ila75XQDwtcVDEzooLxdbcGZCrUU/Ijcx/xhRaM=";
+  cargoHash = "sha256-IPZ0R7SMdZi/h51lInXhRZFBAyEu/D8fwnUUkWV9Ivg=";

  # Work around https://github.com/NixOS/nixpkgs/issues/166205.
  env = lib.optionalAttrs stdenv.cc.isClang {
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.171.0";
+  version = "0.172.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = version;
-    hash = "sha256-+kM/RKC/HxGRH3qOzlhkzaxj1l60D+6aNGIkrDuTk7A=";
+    hash = "sha256-DzbCtTXeoERV9ceUsZ+srATIyviJp+oNyB7EE/iHe6g=";
  };

-  vendorHash = "sha256-cuLzn0OZ5VC+RWGsJ8DCdJN8wm0DrsjH55K/cnyuqB8=";
+  vendorHash = "sha256-P+T+ynSkG3KEmJsrzJusCPBD1ClaVK/VIHD+2xkGswQ=";

  doCheck = false;

--- a/pkgs/by-name/my/mystmd/package.nix
+++ b/pkgs/by-name/my/mystmd/package.nix
@ -2,16 +2,16 @@

 buildNpmPackage rec {
  pname = "mystmd";
-  version = "1.1.42";
+  version = "1.1.43";

  src = fetchFromGitHub {
    owner = "executablebooks";
    repo = "mystmd";
    rev = "mystmd@${version}";
-    hash = "sha256-oVdZ2U1h1BFjo82IDFFHlQHR/V/GNLx4qWtSLhWm3ck=";
+    hash = "sha256-NKb62xhmdqA/fLF2HIm/t+eiIiSLKvPDLlAdjWBKJrQ=";
  };

-  npmDepsHash = "sha256-ucw9ayyIocF/AKkXrzvBDaQ5Mv2edQdiYbX+G3bcHrs=";
+  npmDepsHash = "sha256-5PcGD5La3g9Gd9Me31nLZA+Pi9k+x0s8APXYVa6QSH8=";

  dontNpmInstall = true;

--- a/pkgs/by-name/ne/neocities-cli/Gemfile
+++ b/pkgs/by-name/ne/neocities-cli/Gemfile
@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'neocities'
--- a/pkgs/by-name/ne/neocities-cli/Gemfile.lock
+++ b/pkgs/by-name/ne/neocities-cli/Gemfile.lock
@ -0,0 +1,48 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    equatable (0.5.0)
+    httpclient-fixcerts (2.8.5)
+    necromancer (0.4.0)
+    neocities (0.0.18)
+      httpclient-fixcerts (~> 2.8, >= 2.8.5)
+      pastel (~> 0.7, = 0.7.2)
+      rake (~> 12.3, >= 12.3.1)
+      tty-prompt (~> 0.12, = 0.12.0)
+      tty-table (~> 0.10, = 0.10.0)
+    pastel (0.7.2)
+      equatable (~> 0.5.0)
+      tty-color (~> 0.4.0)
+    rake (12.3.3)
+    strings (0.1.8)
+      strings-ansi (~> 0.1)
+      unicode-display_width (~> 1.5)
+      unicode_utils (~> 1.4)
+    strings-ansi (0.2.0)
+    tty-color (0.4.3)
+    tty-cursor (0.4.0)
+    tty-prompt (0.12.0)
+      necromancer (~> 0.4.0)
+      pastel (~> 0.7.0)
+      tty-cursor (~> 0.4.0)
+      wisper (~> 1.6.1)
+    tty-screen (0.6.5)
+    tty-table (0.10.0)
+      equatable (~> 0.5.0)
+      necromancer (~> 0.4.0)
+      pastel (~> 0.7.2)
+      strings (~> 0.1.0)
+      tty-screen (~> 0.6.4)
+    unicode-display_width (1.8.0)
+    unicode_utils (1.4.0)
+    wisper (1.6.1)
+
+PLATFORMS
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  neocities
+
+BUNDLED WITH
+   2.5.5
--- a/pkgs/by-name/ne/neocities-cli/gemset.nix
+++ b/pkgs/by-name/ne/neocities-cli/gemset.nix
@ -0,0 +1,169 @@
+{
+  equatable = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1sjm9zjakyixyvsqziikdrsqfzis6j3fq23crgjkp6fwkfgndj7x";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
+  httpclient-fixcerts = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1zfszylh51y8ic8sbff3mwf30jb0gj270r5nxkcm1ydxad19w6sl";
+      type = "gem";
+    };
+    version = "2.8.5";
+  };
+  necromancer = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0v9nhdkv6zrp7cn48xv7n2vjhsbslpvs0ha36mfkcd56cp27pavz";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
+  neocities = {
+    dependencies =
+      [ "httpclient-fixcerts" "pastel" "rake" "tty-prompt" "tty-table" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1hfvy4gc7rzxkgl2dbrjs2fqzi5mphmr22rjfhk6n0i3bd0wazbw";
+      type = "gem";
+    };
+    version = "0.0.18";
+  };
+  pastel = {
+    dependencies = [ "equatable" "tty-color" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1yf30d9kzpm96gw9kwbv31p0qigwfykn8qdis5950plnzgc1vlp1";
+      type = "gem";
+    };
+    version = "0.7.2";
+  };
+  rake = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cvaqarr1m84mhc006g3l1vw7sa5qpkcw0138lsxlf769zdllsgp";
+      type = "gem";
+    };
+    version = "12.3.3";
+  };
+  strings = {
+    dependencies = [ "strings-ansi" "unicode-display_width" "unicode_utils" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "111876lcqrykh30w7zzkrl06d6rj9lq24y625m28674vgfxkkcz0";
+      type = "gem";
+    };
+    version = "0.1.8";
+  };
+  strings-ansi = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "120wa6yjc63b84lprglc52f40hx3fx920n4dmv14rad41rv2s9lh";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  tty-color = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0zz5xa6xbrj69h334d8nx7z732fz80s1a0b02b53mim95p80s7bk";
+      type = "gem";
+    };
+    version = "0.4.3";
+  };
+  tty-cursor = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "07whfm8mnp7l49s2cm2qy1snhsqq3a90sqwb71gvym4hm2kx822a";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
+  tty-prompt = {
+    dependencies = [ "necromancer" "pastel" "tty-cursor" "wisper" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1026nyqhgmgxi2nmk8xk3hca07gy5rpisjs8y6w00wnw4f01kpv0";
+      type = "gem";
+    };
+    version = "0.12.0";
+  };
+  tty-screen = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0azpjgyhdm8ycblnx9crq3dgb2x8yg454a13n60zfpsc0n138sw1";
+      type = "gem";
+    };
+    version = "0.6.5";
+  };
+  tty-table = {
+    dependencies =
+      [ "equatable" "necromancer" "pastel" "strings" "tty-screen" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "05krrj1x5pmfbz74paszrsr1316w9b9jlc4wpd9s9gpzqfzwjzcg";
+      type = "gem";
+    };
+    version = "0.10.0";
+  };
+  unicode-display_width = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1204c1jx2g89pc25qk5150mk7j5k90692i7ihgfzqnad6qni74h2";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+  unicode_utils = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0h1a5yvrxzlf0lxxa1ya31jcizslf774arnsd89vgdhk4g7x08mr";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
+  wisper = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19bw0z1qw1dhv7gn9lad25hgbgpb1bkw8d599744xdfam158ms2s";
+      type = "gem";
+    };
+    version = "1.6.1";
+  };
+}
--- a/pkgs/by-name/ne/neocities-cli/package.nix
+++ b/pkgs/by-name/ne/neocities-cli/package.nix
@ -0,0 +1,22 @@
+{ lib
+, bundlerApp
+, bundlerUpdateScript
+}:
+
+bundlerApp {
+  pname = "neocities";
+  gemdir = ./.;
+  exes = [ "neocities" ];
+
+  passthru.updateScript = bundlerUpdateScript "neocities";
+
+  meta = with lib; {
+    description = "The Neocities Gem - A CLI and library for using the Neocities web site API.";
+    homepage = "https://github.com/neocities/neocities-ruby";
+    license = licenses.mit;
+    mainProgram = "neocities";
+    maintainers = with maintainers; [ dawoox ];
+    platforms = platforms.unix;
+  };
+}
+
--- a/pkgs/by-name/um/umpire/package.nix
+++ b/pkgs/by-name/um/umpire/package.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "umpire";
-  version = "2023.06.0";
+  version = "2024.02.0";

  src = fetchFromGitHub {
    owner = "LLNL";
    repo = "umpire";
    rev = "v${version}";
-    hash = "sha256-gdwr0ACCfkrtlVROPhxM7zT7SaCo2Eg1etrPFN4JHaA=";
+    hash = "sha256-0xJrICpGHQCLXfhDfS0/6gD3wrM9y6XB4XxyjG3vWGw=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/uv/uv/Cargo.lock
+++ b/pkgs/by-name/uv/uv/Cargo.lock
@ -909,6 +909,7 @@ dependencies = [
 "tracing",
 "url",
 "urlencoding",
+ "uv-auth",
 "uv-fs",
 "uv-git",
 "uv-normalize",
@ -4127,7 +4128,7 @@ checksum = "f00cc9702ca12d3c81455259621e676d0f7251cec66a21e98fe2e9a37db93b2a"

 [[package]]
 name = "uv"
-version = "0.1.8"
+version = "0.1.9"
 dependencies = [
 "anstream",
 "anyhow",
@ -4193,6 +4194,14 @@ dependencies = [
 "which",
 ]

+[[package]]
+name = "uv-auth"
+version = "0.0.1"
+dependencies = [
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "uv-build"
 version = "0.0.1"
@ -4284,6 +4293,7 @@ dependencies = [
 "tracing",
 "url",
 "urlencoding",
+ "uv-auth",
 "uv-cache",
 "uv-fs",
 "uv-normalize",
@ -4590,9 +4600,12 @@ name = "uv-traits"
 version = "0.0.1"
 dependencies = [
 "anyhow",
+ "clap",
 "distribution-types",
 "once-map",
 "pep508_rs",
+ "serde",
+ "serde_json",
 "tokio",
 "uv-cache",
 "uv-interpreter",
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@ -15,14 +15,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "uv";
-  version = "0.1.8";
+  version = "0.1.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    rev = version;
-    hash = "sha256-nFhCl/5s+Ts3pTXtweoUXfBA3PN2jm08eHalMekPwnM=";
+    hash = "sha256-N9m0dvJXABAY7dFTE5i7KXIHF9AMEFptEwKFoBsxmyE=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/development/libraries/glfw/3.x.nix
+++ b/pkgs/development/libraries/glfw/3.x.nix
@ -6,14 +6,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.3.9";
+  version = "3.3.10";
  pname = "glfw";

  src = fetchFromGitHub {
    owner = "glfw";
    repo = "GLFW";
    rev = version;
-    sha256 = "sha256-DlPRNGCBr6XF9Jn8kWs5lCRTyjPeDt/69PNDzBDhoyg=";
+    sha256 = "sha256-kTRXsfQ+9PFurG3ffz0lwnITAYAXtNl3h/3O6FSny5o=";
  };

  # Fix linkage issues on X11 (https://github.com/NixOS/nixpkgs/issues/142583)
--- a/pkgs/development/libraries/ocl-icd/default.nix
+++ b/pkgs/development/libraries/ocl-icd/default.nix
@ -5,6 +5,7 @@
 , opencl-headers
 , addOpenGLRunpath
 , autoreconfHook
+, windows
 }:

 stdenv.mkDerivation rec {
@ -23,17 +24,21 @@ stdenv.mkDerivation rec {
    ruby
  ];

-  buildInputs = [ opencl-headers ];
+  buildInputs = [ opencl-headers ]
+    ++ lib.optionals stdenv.hostPlatform.isWindows [ windows.dlfcn ];

  configureFlags = [
    "--enable-custom-vendordir=/run/opengl-driver/etc/OpenCL/vendors"
  ];

+  # fixes: can't build x86_64-w64-mingw32 shared library unless -no-undefined is specified
+  makeFlags = lib.optionals stdenv.hostPlatform.isWindows [ "LDFLAGS=-no-undefined" ];
+
  meta = with lib; {
    description = "OpenCL ICD Loader for ${opencl-headers.name}";
    homepage    = "https://github.com/OCL-dev/ocl-icd";
    license     = licenses.bsd2;
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
    maintainers = with maintainers; [ r-burns ];
  };
 }
--- a/pkgs/development/libraries/opencl-headers/default.nix
+++ b/pkgs/development/libraries/opencl-headers/default.nix
@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Khronos OpenCL headers version ${finalAttrs.version}";
    homepage = "https://www.khronos.org/registry/cl/";
    license = licenses.asl20;
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
    maintainers = [ ];
  };
 })
--- a/pkgs/development/python-modules/django-simple-history/default.nix
+++ b/pkgs/development/python-modules/django-simple-history/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "django-simple-history";
-  version = "3.4.0";
+  version = "3.5.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "jazzband";
    repo = "django-simple-history";
    rev = "refs/tags/${version}";
-    hash = "sha256-XY6YNajwX5z3AXkYYGFtrURDqxub9EQwu52jQ7CZwrI=";
+    hash = "sha256-BW/F+RBf1KvwGRY9IK00+n69Jtx/ndEuvpHSi8/odSE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-appengine-logging";
-  version = "1.4.1";
+  version = "1.4.2";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-mQXHwww8K77dCxMuKycfyCRzM+vJMdLSOvG7vRG0Nf4=";
+    hash = "sha256-E03mSoQBfP4mpLOjJbzJtKLboF+cnTkC7iS0sfo+KK8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-firestore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-firestore/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-firestore";
-  version = "2.14.0";
+  version = "2.15.0";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-mr+3U+s89wB2uc/whvcdOYwJfAsbD9ll1a8n1a5K5AE=";
+    hash = "sha256-WJzknGuNcxWiSDJ+ShJKRBQ/WlMU6naPfIUWYMIeYyE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/iodata/default.nix
+++ b/pkgs/development/python-modules/iodata/default.nix
@ -2,22 +2,20 @@

 buildPythonPackage rec {
  pname = "iodata";
-  version = "0.1.7";
+  version = "1.0.0a2";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "theochem";
    repo = pname;
    rev = version;
-    hash = "sha256-Qn2xWFxdS12K92DhdHVzYrBjPRV+vYo7Cs27vkeCaxM=";
+    hash = "sha256-GFTCYE19Re7WLhV8eU+0i8OMp/Tsms/Xj9DRTcgjcz4=";
  };

-  leaveDotGit = true;
-
  nativeBuildInputs = [ cython nose ];
  propagatedBuildInputs = [ numpy scipy attrs ];

-  pythonImportsCheck = [ "iodata" "iodata.overlap_accel" ];
+  pythonImportsCheck = [ "iodata" ];
  doCheck = false; # Requires roberto or nose and a lenghtly setup to find the cython modules

  meta = with lib; {
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@ -12,6 +12,7 @@
 , curl
 , cython
 , fetchFromGitHub
+, fetchpatch
 , git
 , IOKit
 , jsoncpp
@ -47,14 +48,19 @@

  # MKL:
 , mklSupport ? true
-}:
+}@inputs:

 let
-  inherit (cudaPackagesGoogle) backendStdenv cudatoolkit cudaFlags cudnn nccl;
+  inherit (cudaPackagesGoogle) autoAddOpenGLRunpathHook cudaFlags cudaVersion cudnn nccl;

  pname = "jaxlib";
  version = "0.4.24";

+  # It's necessary to consistently use backendStdenv when building with CUDA
+  # support, otherwise we get libstdc++ errors downstream
+  stdenv = throw "Use effectiveStdenv instead";
+  effectiveStdenv = if cudaSupport then cudaPackagesGoogle.backendStdenv else inputs.stdenv;
+
  meta = with lib; {
    description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
    homepage = "https://github.com/google/jax";
@ -65,25 +71,51 @@ let
    # however even with that fix applied, it doesn't work for everyone:
    # https://github.com/NixOS/nixpkgs/pull/184395#issuecomment-1207287129
    # NOTE: We always build with NCCL; if it is unsupported, then our build is broken.
-    broken = stdenv.isDarwin || nccl.meta.unsupported;
+    broken = effectiveStdenv.isDarwin || nccl.meta.unsupported;
  };

-  cudatoolkit_joined = symlinkJoin {
-    name = "${cudatoolkit.name}-merged";
-    paths = [
-      cudatoolkit.lib
-      cudatoolkit.out
-    ] ++ lib.optionals (lib.versionOlder cudatoolkit.version "11") [
-      # for some reason some of the required libs are in the targets/x86_64-linux
-      # directory; not sure why but this works around it
-      "${cudatoolkit}/targets/${stdenv.system}"
+  # These are necessary at build time and run time.
+  cuda_libs_joined = symlinkJoin {
+    name = "cuda-joined";
+    paths = with cudaPackagesGoogle; [
+      cuda_cudart.lib # libcudart.so
+      cuda_cudart.static # libcudart_static.a
+      cuda_cupti.lib # libcupti.so
+      libcublas.lib # libcublas.so
+      libcufft.lib # libcufft.so
+      libcurand.lib # libcurand.so
+      libcusolver.lib # libcusolver.so
+      libcusparse.lib # libcusparse.so
+    ];
+  };
+  # These are only necessary at build time.
+  cuda_build_deps_joined = symlinkJoin {
+    name = "cuda-build-deps-joined";
+    paths = with cudaPackagesGoogle; [
+      cuda_libs_joined
+
+      # Binaries
+      cudaPackagesGoogle.cuda_nvcc.bin # nvcc
+
+      # Headers
+      cuda_cccl.dev # block_load.cuh
+      cuda_cudart.dev # cuda.h
+      cuda_cupti.dev # cupti.h
+      cuda_nvcc.dev # See https://github.com/google/jax/issues/19811
+      cuda_nvml_dev # nvml.h
+      cuda_nvtx.dev # nvToolsExt.h
+      libcublas.dev # cublas_api.h
+      libcufft.dev # cufft.h
+      libcurand.dev # curand.h
+      libcusolver.dev # cusolver_common.h
+      libcusparse.dev # cusparse.h
    ];
  };

-  cudatoolkit_cc_joined = symlinkJoin {
-    name = "${cudatoolkit.cc.name}-merged";
+  backend_cc_joined = symlinkJoin {
+    name = "cuda-cc-joined";
    paths = [
-      backendStdenv.cc
+      effectiveStdenv.cc
      binutils.bintools # for ar, dwp, nm, objcopy, objdump, strip
    ];
  };
@ -137,8 +169,44 @@ let

  arch =
    # KeyError: ('Linux', 'arm64')
-    if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.linuxArch == "arm64" then "aarch64"
-    else stdenv.hostPlatform.linuxArch;
+    if effectiveStdenv.hostPlatform.isLinux && effectiveStdenv.hostPlatform.linuxArch == "arm64" then "aarch64"
+    else effectiveStdenv.hostPlatform.linuxArch;
+
+  xla = effectiveStdenv.mkDerivation {
+    pname = "xla-src";
+    version = "unstable";
+
+    src = fetchFromGitHub {
+      owner = "openxla";
+      repo = "xla";
+      # Update this according to https://github.com/google/jax/blob/jaxlib-v${version}/third_party/xla/workspace.bzl.
+      rev = "12eee889e1f2ad41e27d7b0e970cb92d282d3ec5";
+      hash = "sha256-68kjjgwYjRlcT0TVJo9BN6s+WTkdu5UMJqQcfHpBT90=";
+    };
+
+    patches = [
+      # Resolves "could not convert ‘result’ from ‘SmallVector<[...],6>’ to
+      # ‘SmallVector<[...],4>’" compilation error. See https://github.com/google/jax/issues/19814#issuecomment-1945141259.
+      (fetchpatch {
+        url = "https://github.com/openxla/xla/commit/7a614cd346594fc7ea2fe75570c9c53a4a444f60.patch";
+        hash = "sha256-RtuQTH8wzNiJcOtISLhf+gMlH1gg8hekvxEB+4wX6BM=";
+      })
+    ];
+
+    dontBuild = true;
+
+    # This is necessary for patchShebangs to know the right path to use.
+    nativeBuildInputs = [ python ];
+
+    # Main culprits we're targeting are third_party/tsl/third_party/gpus/crosstool/clang/bin/*.tpl
+    postPatch = ''
+      patchShebangs .
+    '';
+
+    installPhase = ''
+      cp -r . $out
+    '';
+  };

  bazel-build = buildBazelPackage rec {
    name = "bazel-build-${pname}-${version}";
@ -162,7 +230,7 @@ let
      wheel
      build
      which
-    ] ++ lib.optionals stdenv.isDarwin [
+    ] ++ lib.optionals effectiveStdenv.isDarwin [
      cctools
    ];

@ -181,15 +249,13 @@ let
      six
      snappy
      zlib
-    ] ++ lib.optionals cudaSupport [
-      cudatoolkit
-      cudnn
-    ] ++ lib.optionals stdenv.isDarwin [
+    ] ++ lib.optionals effectiveStdenv.isDarwin [
      IOKit
-    ] ++ lib.optionals (!stdenv.isDarwin) [
+    ] ++ lib.optionals (!effectiveStdenv.isDarwin) [
      nsync
    ];

+    # We don't want to be quite so picky regarding bazel version
    postPatch = ''
      rm -f .bazelversion
    '';
@ -204,50 +270,80 @@ let

    removeRulesCC = false;

-    GCC_HOST_COMPILER_PREFIX = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin";
-    GCC_HOST_COMPILER_PATH = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin/gcc";
+    GCC_HOST_COMPILER_PREFIX = lib.optionalString cudaSupport "${backend_cc_joined}/bin";
+    GCC_HOST_COMPILER_PATH = lib.optionalString cudaSupport "${backend_cc_joined}/bin/gcc";

    # The version is automatically set to ".dev" if this variable is not set.
    # https://github.com/google/jax/commit/e01f2617b85c5bdffc5ffb60b3d8d8ca9519a1f3
    JAXLIB_RELEASE = "1";

-    preConfigure = ''
-      # dummy ldconfig
-      mkdir dummy-ldconfig
-      echo "#!${stdenv.shell}" > dummy-ldconfig/ldconfig
-      chmod +x dummy-ldconfig/ldconfig
-      export PATH="$PWD/dummy-ldconfig:$PATH"
-      cat <<CFG > ./.jax_configure.bazelrc
-      build --strategy=Genrule=standalone
-      build --repo_env PYTHON_BIN_PATH="${python}/bin/python"
-      build --action_env=PYENV_ROOT
-      build --python_path="${python}/bin/python"
-      build --distinct_host_configuration=false
-      build --define PROTOBUF_INCLUDE_PATH="${pkgs.protobuf}/include"
-    '' + lib.optionalString (stdenv.hostPlatform.avxSupport && stdenv.hostPlatform.isUnix) ''
-      build --config=avx_posix
-    '' + lib.optionalString mklSupport ''
-      build --config=mkl_open_source_only
-    '' + lib.optionalString cudaSupport ''
-      build --action_env CUDA_TOOLKIT_PATH="${cudatoolkit_joined}"
-      build --action_env CUDNN_INSTALL_PATH="${cudnn}"
-      build --action_env TF_CUDA_PATHS="${cudatoolkit_joined},${cudnn},${nccl}"
-      build --action_env TF_CUDA_VERSION="${lib.versions.majorMinor cudatoolkit.version}"
-      build --action_env TF_CUDNN_VERSION="${lib.versions.major cudnn.version}"
-      build:cuda --action_env TF_CUDA_COMPUTE_CAPABILITIES="${builtins.concatStringsSep "," cudaFlags.realArches}"
-    '' + ''
-      CFG
-    '';
+    preConfigure =
+      # Dummy ldconfig to work around "Can't open cache file /nix/store/<hash>-glibc-2.38-44/etc/ld.so.cache" error
+      ''
+        mkdir dummy-ldconfig
+        echo "#!${effectiveStdenv.shell}" > dummy-ldconfig/ldconfig
+        chmod +x dummy-ldconfig/ldconfig
+        export PATH="$PWD/dummy-ldconfig:$PATH"
+      '' +
+
+      # Construct .jax_configure.bazelrc. See https://github.com/google/jax/blob/b9824d7de3cb30f1df738cc42e486db3e9d915ff/build/build.py#L259-L345
+      # for more info. We assume
+      # * `cpu = None`
+      # * `enable_nccl = True`
+      # * `target_cpu_features = "release"`
+      # * `rocm_amdgpu_targets = None`
+      # * `enable_rocm = False`
+      # * `build_gpu_plugin = False`
+      # * `use_clang = False` (Should we use `effectiveStdenv.cc.isClang` instead?)
+      #
+      # Note: We should try just running https://github.com/google/jax/blob/ceb198582b62b9e6f6bdf20ab74839b0cf1db16e/build/build.py#L259-L266
+      # instead of duplicating the logic here. Perhaps we can leverage the
+      # `--configure_only` flag (https://github.com/google/jax/blob/ceb198582b62b9e6f6bdf20ab74839b0cf1db16e/build/build.py#L544-L548)?
+      ''
+        cat <<CFG > ./.jax_configure.bazelrc
+        build --strategy=Genrule=standalone
+        build --repo_env PYTHON_BIN_PATH="${python}/bin/python"
+        build --action_env=PYENV_ROOT
+        build --python_path="${python}/bin/python"
+        build --distinct_host_configuration=false
+        build --define PROTOBUF_INCLUDE_PATH="${pkgs.protobuf}/include"
+      '' + lib.optionalString cudaSupport ''
+        build --config=cuda
+        build --action_env CUDA_TOOLKIT_PATH="${cuda_build_deps_joined}"
+        build --action_env CUDNN_INSTALL_PATH="${cudnn}"
+        build --action_env TF_CUDA_PATHS="${cuda_build_deps_joined},${cudnn},${nccl}"
+        build --action_env TF_CUDA_VERSION="${lib.versions.majorMinor cudaVersion}"
+        build --action_env TF_CUDNN_VERSION="${lib.versions.major cudnn.version}"
+        build:cuda --action_env TF_CUDA_COMPUTE_CAPABILITIES="${builtins.concatStringsSep "," cudaFlags.realArches}"
+      '' +
+      # Note that upstream conditions this on `wheel_cpu == "x86_64"`. We just
+      # rely on `effectiveStdenv.hostPlatform.avxSupport` instead. So far so
+      # good. See https://github.com/google/jax/blob/b9824d7de3cb30f1df738cc42e486db3e9d915ff/build/build.py#L322
+      # for upstream's version.
+      lib.optionalString (effectiveStdenv.hostPlatform.avxSupport && effectiveStdenv.hostPlatform.isUnix) ''
+        build --config=avx_posix
+      '' + lib.optionalString mklSupport ''
+        build --config=mkl_open_source_only
+      '' +
+      ''
+        CFG
+      '';

    # Make sure Bazel knows about our configuration flags during fetching so that the
    # relevant dependencies can be downloaded.
    bazelFlags = [
      "-c opt"
-    ] ++ lib.optionals stdenv.cc.isClang [
+      # See https://bazel.build/external/advanced#overriding-repositories for
+      # information on --override_repository flag.
+      "--override_repository=xla=${xla}"
+    ] ++ lib.optionals effectiveStdenv.cc.isClang [
      # bazel depends on the compiler frontend automatically selecting these flags based on file
      # extension but our clang doesn't.
      # https://github.com/NixOS/nixpkgs/issues/150655
-      "--cxxopt=-x" "--cxxopt=c++" "--host_cxxopt=-x" "--host_cxxopt=c++"
+      "--cxxopt=-x"
+      "--cxxopt=c++"
+      "--host_cxxopt=-x"
+      "--host_cxxopt=c++"
    ];

    # We intentionally overfetch so we can share the fetch derivation across all the different configurations
@ -257,40 +353,34 @@ let
      bazelTargets = [ bazelRunTarget "@mkl_dnn_v1//:mkl_dnn" ];
      bazelFlags = bazelFlags ++ [
        "--config=avx_posix"
+        "--config=mkl_open_source_only"
      ] ++ lib.optionals cudaSupport [
        # ideally we'd add this unconditionally too, but it doesn't work on darwin
        # we make this conditional on `cudaSupport` instead of the system, so that the hash for both
        # the cuda and the non-cuda deps can be computed on linux, since a lot of contributors don't
        # have access to darwin machines
        "--config=cuda"
-      ] ++ [
-        "--config=mkl_open_source_only"
      ];

      sha256 = (if cudaSupport then {
-        x86_64-linux = "sha256-c0avcURLAYNiLASjIeu5phXX3ze5TR812SW5SCG/iwk=";
+        x86_64-linux = "sha256-IEKoHjCOtKZKvU/DUUjbvXldORFJuyO1R3F6CZZDXxM=";
      } else {
-        x86_64-linux = "sha256-1hrQ9ehFy3vBJxKNUzi/T0l+eZxo26Th7i5VRd/9U+0=";
-        aarch64-linux = "sha256-3QVYJOj1lNHgYVV9rOzVdfhq5q6GDwpcWCjKNrSZ4aU=";
-      }).${stdenv.system} or (throw "jaxlib: unsupported system: ${stdenv.system}");
+        x86_64-linux = "sha256-IE4+Tk4llo85u3NjakvY04tPw4R1bidyecPpQ4gknR8=";
+        aarch64-linux = "sha256-NehnpA4m+Fynvh0S6WKy/v9ab81487NE9ahvbS70wjY=";
+      }).${effectiveStdenv.system} or (throw "jaxlib: unsupported system: ${effectiveStdenv.system}");
    };

    buildAttrs = {
      outputs = [ "out" ];

-      TF_SYSTEM_LIBS = lib.concatStringsSep "," (tf_system_libs ++ lib.optionals (!stdenv.isDarwin) [
+      TF_SYSTEM_LIBS = lib.concatStringsSep "," (tf_system_libs ++ lib.optionals (!effectiveStdenv.isDarwin) [
        "nsync" # fails to build on darwin
      ]);

-      # Note: we cannot do most of this patching at `patch` phase as the deps are not available yet.
-      # 1) Link protobuf from nixpkgs (through TF_SYSTEM_LIBS when using gcc) to prevent crashes on
-      #    loading multiple extensions in the same python program due to duplicate protobuf DBs.
-      # 2) Patch python path in the compiler driver.
-      preBuild = lib.optionalString cudaSupport ''
-        patchShebangs ../output/external/xla/third_party/gpus/crosstool/clang/bin/crosstool_wrapper_driver_is_not_gcc.tpl
-      '' + lib.optionalString stdenv.isDarwin ''
-        # Framework search paths aren't added by bintools hook
-        # https://github.com/NixOS/nixpkgs/pull/41914
+      # Note: we cannot do most of this patching at `patch` phase as the deps
+      # are not available yet. Framework search paths aren't added by bintools
+      # hook. See https://github.com/NixOS/nixpkgs/pull/41914.
+      preBuild = lib.optionalString effectiveStdenv.isDarwin ''
        export NIX_LDFLAGS+=" -F${IOKit}/Library/Frameworks"
        substituteInPlace ../output/external/rules_cc/cc/private/toolchain/osx_cc_wrapper.sh.tpl \
          --replace "/usr/bin/install_name_tool" "${cctools}/bin/install_name_tool"
@ -302,13 +392,13 @@ let
    inherit meta;
  };
  platformTag =
-    if stdenv.hostPlatform.isLinux then
+    if effectiveStdenv.hostPlatform.isLinux then
      "manylinux2014_${arch}"
-    else if stdenv.system == "x86_64-darwin" then
+    else if effectiveStdenv.system == "x86_64-darwin" then
      "macosx_10_9_${arch}"
-    else if stdenv.system == "aarch64-darwin" then
+    else if effectiveStdenv.system == "aarch64-darwin" then
      "macosx_11_0_${arch}"
-    else throw "Unsupported target platform: ${stdenv.hostPlatform}";
+    else throw "Unsupported target platform: ${effectiveStdenv.hostPlatform}";

 in
 buildPythonPackage {
@ -319,20 +409,18 @@ buildPythonPackage {
    let cp = "cp${builtins.replaceStrings ["."] [""] python.pythonVersion}";
    in "${bazel-build}/jaxlib-${version}-${cp}-${cp}-${platformTag}.whl";

-  # Note that cudatoolkit is necessary since jaxlib looks for "ptxas" in $PATH.
-  # See https://github.com/NixOS/nixpkgs/pull/164176#discussion_r828801621 for
-  # more info.
+  # Note that jaxlib looks for "ptxas" in $PATH. See https://github.com/NixOS/nixpkgs/pull/164176#discussion_r828801621
+  # for more info.
  postInstall = lib.optionalString cudaSupport ''
    mkdir -p $out/bin
-    ln -s ${cudatoolkit}/bin/ptxas $out/bin/ptxas
+    ln -s ${cudaPackagesGoogle.cuda_nvcc.bin}/bin/ptxas $out/bin/ptxas

    find $out -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do
-      addOpenGLRunpath "$lib"
-      patchelf --set-rpath "${cudatoolkit}/lib:${cudatoolkit.lib}/lib:${cudnn}/lib:${nccl}/lib:$(patchelf --print-rpath "$lib")" "$lib"
+      patchelf --add-rpath "${lib.makeLibraryPath [cuda_libs_joined cudnn nccl]}" "$lib"
    done
  '';

-  nativeBuildInputs = lib.optional cudaSupport addOpenGLRunpath;
+  nativeBuildInputs = lib.optionals cudaSupport [ autoAddOpenGLRunpathHook ];

  propagatedBuildInputs = [
    absl-py
--- a/pkgs/development/python-modules/myuplink/default.nix
+++ b/pkgs/development/python-modules/myuplink/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "myuplink";
-  version = "0.3.0";
+  version = "0.4.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -17,9 +17,14 @@ buildPythonPackage rec {
    owner = "pajzo";
    repo = "myuplink";
    rev = "refs/tags/${version}";
-    hash = "sha256-XDsQmgP3VvWpuZWGBVW5pBsxTRZT2cl3kp1i2sb+LnM=";
+    hash = "sha256-xITV5+d/9j8pjfvmnt8RfGHu4lfLu8cMFV0MzURy6hA=";
  };

+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace-fail "%%VERSION_NO%%" "${version}"
+  '';
+
  nativeBuildInputs = [
    setuptools
  ];
--- a/pkgs/development/python-modules/rova/default.nix
+++ b/pkgs/development/python-modules/rova/default.nix
@ -4,22 +4,27 @@
 , pytestCheckHook
 , pythonOlder
 , requests
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "rova";
-  version = "0.3.0";
-  format = "setuptools";
+  version = "0.4.0";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "GidoHakvoort";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-TLL9Ta+7Xd55hGTTXjc6CBMj+tW1LpFrprpsnGqZvkQ=";
+    repo = "rova";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6tICjph+ffS6OSMxzR4ANB4Q6sG1AKAgUN83DyEGpvo=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    requests
  ];
@ -34,6 +39,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Module to access for ROVA calendars";
    homepage = "https://github.com/GidoHakvoort/rova";
+    changelog = "https://github.com/GidoHakvoort/rova/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/tools/toast/default.nix
+++ b/pkgs/development/tools/toast/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "toast";
-  version = "0.47.5";
+  version = "0.47.6";

  src = fetchFromGitHub {
    owner = "stepchowfun";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-kAXzBJMAxHjZSK6lbpF+/27n9CGvq7x6Ay2TaFYgQSU=";
+    sha256 = "sha256-+qntd687LF4tJwHZglZ6mppHq3dOZ+l431oKBBNDI0k=";
  };

-  cargoHash = "sha256-681ZFS8dtn815VYdFwPEJXnuMGTycSuRPDxmj1kN3rs=";
+  cargoHash = "sha256-A2sJ0o0RDztk3NjxG0CD8wNA4tmOizY4Tvff6ADzYQ8=";

  checkFlags = [ "--skip=format::tests::code_str_display" ]; # fails

--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@ -8,31 +8,31 @@
        "hash": "sha256:1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq"
    },
    "6.1": {
-        "version": "6.1.78",
-        "hash": "sha256:12fn23m2xwdlv6gr1s8872lk8mvigqkblvlhr54nh8rik2b6n835"
+        "version": "6.1.79",
+        "hash": "sha256:16xkd0hcslqlcf55d4ivzhf1fkhfs5yy0m9arbax8pmm5yi9r97s"
    },
    "5.15": {
-        "version": "5.15.148",
-        "hash": "sha256:1n75lrck581mppx84cds1a1l5vj05cdkp8ahpry7dx6rgz4pb1f4"
+        "version": "5.15.149",
+        "hash": "sha256:1c01fnaghj55mkgsgddznq1zq4mswsa05rz00kmh1d3y6sd8115x"
    },
    "5.10": {
-        "version": "5.10.209",
-        "hash": "sha256:1mc8rssk5aypgb58jz6i2bbflfr6qh1kgqpam0k8fqvwcjnjzqj4"
+        "version": "5.10.210",
+        "hash": "sha256:0vggj3a71awc1w803cdzrnkn88rxr7l1xh9mmdcw9hzxj1d3r9jf"
    },
    "5.4": {
-        "version": "5.4.268",
-        "hash": "sha256:081695lgkdwlrp6gpp6pyflgh76zax1w52shys4s9zjnrfkarj5g"
+        "version": "5.4.269",
+        "hash": "sha256:1kqqm4hpif3jy2ycnb0dfjgzyn18vqhm1i5q7d7rkisks33bwm7z"
    },
    "4.19": {
-        "version": "4.19.306",
-        "hash": "sha256:06dy270xw4frnrc9p2qjh8chgp02fr5ll5g2b0lx9xqzlq7y86xr"
+        "version": "4.19.307",
+        "hash": "sha256:0lp3fc7sqy48vpcl2g0n1bz7i1hp9k0nlz3i1xfh9l056ihzzvl3"
    },
    "6.6": {
-        "version": "6.6.17",
-        "hash": "sha256:0si20m9ckir826jg40bh7sh4kwlp610rnc3gwsgs4nm7dfcm0xpf"
+        "version": "6.6.18",
+        "hash": "sha256:07cv97l5jiakmmv35n0ganvqfr0590b02f3qb617qkx1zg2xhhsf"
    },
    "6.7": {
-        "version": "6.7.5",
-        "hash": "sha256:1zrralagnv9yr8qdg7lc05735691dbh92mgwfyxrq5xqc504dxi9"
+        "version": "6.7.6",
+        "hash": "sha256:1lrp7pwnxnqyy8c2l4n4nz997039gbnssrfm8ss8kl3h2c7fr2g4"
    }
 }
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@ -99,11 +99,11 @@ rec {
  };

  dc_535 = generic rec {
-    version = "535.129.03";
+    version = "535.154.05";
    url = "https://us.download.nvidia.com/tesla/${version}/NVIDIA-Linux-x86_64-${version}.run";
-    sha256_64bit = "sha256-5tylYmomCMa7KgRs/LfBrzOLnpYafdkKwJu4oSb/AC4=";
-    persistencedSha256 = "sha256-FRMqY5uAJzq3o+YdM2Mdjj8Df6/cuUUAnh52Ne4koME=";
-    fabricmanagerSha256 = "sha256-5KRYS+JLVAhDkBn8Z7e0uJvULQy6dSpwnYsbBxw7Mxg=";
+    sha256_64bit = "sha256-fpUGXKprgt6SYRDxSCemGXLrEsIA6GOinp+0eGbqqJg=";
+    persistencedSha256 = "sha256-d0Q3Lk80JqkS1B54Mahu2yY/WocOqFFbZVBh+ToGhaE=";
+    fabricmanagerSha256 = "sha256-/HQfV7YA3MYVmre/sz897PF6tc6MaMiS/h7Q10m2p/o=";
    useSettings = false;
    usePersistenced = true;
    useFabricmanager = true;
--- a/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
@ -18,12 +18,12 @@ stdenv.mkDerivation rec {
  };

  installPhase = ''
-    find .
    mkdir -p $out/{bin,share/nvidia-fabricmanager}
    for bin in nv{-fabricmanager,switch-audit};do
    ${patchelf}/bin/patchelf \
      --set-interpreter ${stdenv.cc.libc}/lib/ld-${bsys}.so.2 \
      --set-rpath ${lib.makeLibraryPath [ stdenv.cc.libc ]} \
+      --shrink-rpath \
      bin/$bin
    done
    mv bin/nv{-fabricmanager,switch-audit} $out/bin/.
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@ -6,6 +6,10 @@ let
      version = "4.16.0";
      hash = "sha256-OFZT4195WTWw2XNAyGiNixW6hSNKC3IyBpa5kM9PCVk=";
    };
+    matomo_5 = {
+      version = "5.0.2";
+      hash = "sha256-rLAShJLtzd3HB1Je+P+i8GKWdeklyC2sTnmPR07Md+8=";
+    };
    matomo-beta = {
      version = "5.0.0";
      # `beta` examples: "b1", "rc1", null
--- a/pkgs/shells/zsh/zsh-autocomplete/default.nix
+++ b/pkgs/shells/zsh/zsh-autocomplete/default.nix
@ -2,20 +2,20 @@

 stdenvNoCC.mkDerivation rec {
  pname = "zsh-autocomplete";
-  version = "23.05.24";
+  version = "23.07.13";

  src = fetchFromGitHub {
    owner = "marlonrichert";
    repo = "zsh-autocomplete";
    rev = version;
-    sha256 = "sha256-/6V6IHwB5p0GT1u5SAiUa20LjFDSrMo731jFBq/bnpw=";
+    sha256 = "sha256-0NW0TI//qFpUA2Hdx6NaYdQIIUpRSd0Y4NhwBbdssCs=";
  };

  strictDeps = true;
  installPhase = ''
    install -D zsh-autocomplete.plugin.zsh $out/share/zsh-autocomplete/zsh-autocomplete.plugin.zsh
-    cp -R scripts $out/share/zsh-autocomplete/scripts
-    cp -R functions $out/share/zsh-autocomplete/functions
+    cp -R Completions $out/share/zsh-autocomplete/Completions
+    cp -R Functions $out/share/zsh-autocomplete/Functions
  '';

  meta = with lib; {
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@ -31,16 +31,16 @@ let
 in
 buildGoModule rec {
  pname = "netbird";
-  version = "0.25.9";
+  version = "0.26.0";

  src = fetchFromGitHub {
    owner = "netbirdio";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-asY5/g/RztQqZA5sH2Zoucm6QNUe/8QYoAmMAslnswo=";
+    hash = "sha256-hZnxemBoMAol0m9XZPMEh/Lf0woxoLNH97bRyg8xtv4=";
  };

-  vendorHash = "sha256-CFLwb5cqsfxTxOwuLOB0IMYkRZUNPgB7grjQ4xm84BM=";
+  vendorHash = "sha256-csa83P74Y9fHsPg5VgPfR9WMg4VKOXcIR0pOMzh0QoA=";

  nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -27252,6 +27252,7 @@ with pkgs;

  inherit (callPackages ../servers/web-apps/matomo {})
    matomo
+    matomo_5
    matomo-beta;

  axis2 = callPackage ../servers/http/tomcat/axis2 { };