Merge master into haskell-updates

2023-11-09 00:12:27 +00:00 · 2023-11-09 00:12:27 +00:00 · f3e8efda49
commit f3e8efda49
parent fe1578be1e 1e45a23642
169 changed files with 1899 additions and 609 deletions
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -877,6 +877,21 @@ in mkLicense lset) ({
    fullName = "Non-Profit Open Software License 3.0";
  };

+  nvidiaCuda = {
+    shortName = "CUDA EULA";
+    fullName = "CUDA Toolkit End User License Agreement (EULA)";
+    url = "https://docs.nvidia.com/cuda/eula/index.html#cuda-toolkit-supplement-license-agreement";
+    free = false;
+  };
+
+  nvidiaCudaRedist = {
+    shortName = "CUDA EULA";
+    fullName = "CUDA Toolkit End User License Agreement (EULA)";
+    url = "https://docs.nvidia.com/cuda/eula/index.html#cuda-toolkit-supplement-license-agreement";
+    free = false;
+    redistributable = true;
+  };
+
  obsidian = {
    fullName = "Obsidian End User Agreement";
    url = "https://obsidian.md/eula";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -7998,6 +7998,12 @@
    githubId = 488556;
    name = "Javier Aguirre";
  };
+  javimerino = {
+    email = "merino.jav@gmail.com";
+    name = "Javi Merino";
+    github = "JaviMerino";
+    githubId = 44926;
+  };
  jayesh-bhoot = {
    name = "Jayesh Bhoot";
    email = "jb@jayeshbhoot.com";
@ -14623,7 +14629,7 @@
  };
  quantenzitrone = {
    email = "quantenzitrone@protonmail.com";
-    github = "Quantenzitrone";
+    github = "quantenzitrone";
    githubId = 74491719;
    matrix = "@quantenzitrone:matrix.org";
    name = "quantenzitrone";
@ -19078,6 +19084,12 @@
      fingerprint = "640B EDDE 9734 310A BFA3  B257 52ED AE6A 3995 AFAB";
    }];
  };
+  whiteley = {
+    email = "mattwhiteley@gmail.com";
+    github = "whiteley";
+    githubId = 2215;
+    name = "Matt Whiteley";
+  };
  WhittlesJr = {
    email = "alex.joseph.whitt@gmail.com";
    github = "WhittlesJr";
@ -19381,11 +19393,11 @@
    name = "Uli Baum";
  };
  xfix = {
-    email = "konrad@borowski.pw";
+    email = "kamila@borowska.pw";
    matrix = "@xfix:matrix.org";
    github = "xfix";
    githubId = 1297598;
-    name = "Konrad Borowski";
+    name = "Kamila Borowska";
  };
  xfnw = {
    email = "xfnw+nixos@riseup.net";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -485,6 +485,8 @@ The module update takes care of the new config syntax and the data itself (user
  - `keepTerminfo` controls whether `TERMINFO` and `TERMINFO_DIRS` are preserved
    for `root` and the `wheel` group.

+- `virtualisation.googleComputeImage` now provides `efi` option to support UEFI booting.
+
 - CoreDNS can now be built with external plugins by overriding `externalPlugins` and `vendorHash` arguments like this:

  ```
--- a/nixos/modules/services/audio/wyoming/faster-whisper.nix
+++ b/nixos/modules/services/audio/wyoming/faster-whisper.nix
@ -146,6 +146,8 @@ in
          CapabilityBoundingSet = "";
          DeviceAllow = if builtins.elem options.device [ "cuda" "auto" ] then [
            # https://docs.nvidia.com/dgx/pdf/dgx-os-5-user-guide.pdf
+            # CUDA not working? Check DeviceAllow and PrivateDevices first!
+            "/dev/nvidia0"
            "/dev/nvidia1"
            "/dev/nvidia2"
            "/dev/nvidia3"
@ -160,7 +162,6 @@ in
          DevicePolicy = "closed";
          LockPersonality = true;
          MemoryDenyWriteExecute = true;
-          PrivateDevices = true;
          PrivateUsers = true;
          ProtectHome = true;
          ProtectHostname = true;
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@ -12,6 +12,7 @@ let
    ln -s /run/wrappers/bin/perf.plugin $out/libexec/netdata/plugins.d/perf.plugin
    ln -s /run/wrappers/bin/slabinfo.plugin $out/libexec/netdata/plugins.d/slabinfo.plugin
    ln -s /run/wrappers/bin/freeipmi.plugin $out/libexec/netdata/plugins.d/freeipmi.plugin
+    ln -s /run/wrappers/bin/systemd-journal.plugin $out/libexec/netdata/plugins.d/systemd-journal.plugin
  '';

  plugins = [
@ -254,7 +255,7 @@ in {
        # Capabilities
        CapabilityBoundingSet = [
          "CAP_DAC_OVERRIDE"      # is required for freeipmi and slabinfo plugins
-          "CAP_DAC_READ_SEARCH"   # is required for apps plugin
+          "CAP_DAC_READ_SEARCH"   # is required for apps and systemd-journal plugin
          "CAP_FOWNER"            # is required for freeipmi plugin
          "CAP_SETPCAP"           # is required for apps, perf and slabinfo plugins
          "CAP_SYS_ADMIN"         # is required for perf plugin
@ -263,6 +264,7 @@ in {
          "CAP_NET_RAW"           # is required for fping app
          "CAP_SYS_CHROOT"        # is required for cgroups plugin
          "CAP_SETUID"            # is required for cgroups and cgroups-network plugins
+          "CAP_SYSLOG"            # is required for systemd-journal plugin
        ];
        # Sandboxing
        ProtectSystem = "full";
@ -318,6 +320,14 @@ in {
        permissions = "u+rx,g+x,o-rwx";
      };

+      "systemd-journal.plugin" = {
+        source = "${cfg.package}/libexec/netdata/plugins.d/systemd-journal.plugin.org";
+        capabilities = "cap_dac_read_search,cap_syslog+ep";
+        owner = cfg.user;
+        group = cfg.group;
+        permissions = "u+rx,g+x,o-rwx";
+      };
+
      "slabinfo.plugin" = {
        source = "${cfg.package}/libexec/netdata/plugins.d/slabinfo.plugin.org";
        capabilities = "cap_dac_override+ep";
--- a/nixos/modules/services/networking/trust-dns.nix
+++ b/nixos/modules/services/networking/trust-dns.nix
@ -54,7 +54,7 @@ in
        defaultText = "pkgs.trust-dns";
        description = mdDoc ''
          Trust-dns package to use.
-          Only `bin/trust-dns` need be provided: the other trust-dns utilities (client and resolver) are not needed.
+          The package must provide `meta.mainProgram` which names the server binary; any other utilities (client, resolver) are not needed.
        '';
      };
      quiet = mkOption {
@ -135,7 +135,7 @@ in
          flags =  (lib.optional cfg.debug "--debug") ++ (lib.optional cfg.quiet "--quiet");
          flagsStr = builtins.concatStringsSep " " flags;
        in ''
-          ${cfg.package}/bin/trust-dns --config ${configFile} ${flagsStr}
+          ${cfg.package}/bin/${cfg.package.meta.mainProgram} --config ${configFile} ${flagsStr}
        '';
        Type = "simple";
        Restart = "on-failure";
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@ -586,6 +586,7 @@ in
        }) all_peers;

    boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard;
+    boot.kernelModules = [ "wireguard" ];
    environment.systemPackages = [ pkgs.wireguard-tools ];

    systemd.services =
--- a/nixos/modules/system/boot/initrd-ssh.nix
+++ b/nixos/modules/system/boot/initrd-ssh.nix
@ -166,7 +166,7 @@ in
      }
    ];

-    warnings = lib.optional (config.boot.initrd.systemd.enable -> cfg.shell != null) ''
+    warnings = lib.optional (config.boot.initrd.systemd.enable && cfg.shell != null) ''
      Please set 'boot.initrd.systemd.users.root.shell' instead of 'boot.initrd.network.ssh.shell'
    '';

--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@ -44,10 +44,17 @@ in
        GZIP compression level of the resulting disk image (1-9).
      '';
    };
+    virtualisation.googleComputeImage.efi = mkEnableOption "EFI booting";
  };

  #### implementation
  config = {
+    boot.initrd.availableKernelModules = [ "nvme" ];
+    boot.loader.grub = mkIf cfg.efi {
+      device = mkForce "nodev";
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+    };

    system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
      name = "google-compute-image";
@ -62,6 +69,7 @@ in
      '';
      format = "raw";
      configFile = if cfg.configFile == null then defaultConfigFile else cfg.configFile;
+      partitionTableType = if cfg.efi then "efi" else "legacy";
      inherit (cfg) diskSize;
      inherit config lib pkgs;
    };
--- a/nixos/tests/castopod.nix
+++ b/nixos/tests/castopod.nix
@ -82,6 +82,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
    castopod.succeed("curl -s http://localhost/cp-install | grep 'Create your Super Admin account' > /dev/null")

    with subtest("Create superadmin and log in"):
-        castopod.succeed("PYTHONUNBUFFERED=1 test-runner | systemd-cat -t test-runner")
+        castopod.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner")
  '';
 })
--- a/nixos/tests/hadoop/hadoop.nix
+++ b/nixos/tests/hadoop/hadoop.nix
@ -176,22 +176,22 @@ import ../make-test-python.nix ({ package, ... }: {
    nn2.succeed("systemctl stop hdfs-zkfc")

    # Initialize zookeeper for failover controller
-    nn1.succeed("sudo -u hdfs hdfs zkfc -formatZK 2>&1 | systemd-cat")
+    nn1.succeed("sudo -u hdfs systemd-cat hdfs zkfc -formatZK")

    # Format NN1 and start it
-    nn1.succeed("sudo -u hdfs hadoop namenode -format 2>&1 | systemd-cat")
+    nn1.succeed("sudo -u hdfs systemd-cat hadoop namenode -format")
    nn1.succeed("systemctl start hdfs-namenode")
    nn1.wait_for_open_port(9870)
    nn1.wait_for_open_port(8022)
    nn1.wait_for_open_port(8020)

    # Bootstrap NN2 from NN1 and start it
-    nn2.succeed("sudo -u hdfs hdfs namenode -bootstrapStandby 2>&1 | systemd-cat")
+    nn2.succeed("sudo -u hdfs systemd-cat hdfs namenode -bootstrapStandby")
    nn2.succeed("systemctl start hdfs-namenode")
    nn2.wait_for_open_port(9870)
    nn2.wait_for_open_port(8022)
    nn2.wait_for_open_port(8020)
-    nn1.succeed("netstat -tulpne | systemd-cat")
+    nn1.succeed("systemd-cat netstat -tulpne")

    # Start failover controllers
    nn1.succeed("systemctl start hdfs-zkfc")
@ -200,10 +200,10 @@ import ../make-test-python.nix ({ package, ... }: {
    # DN should have started by now, but confirm anyway
    dn1.wait_for_unit("hdfs-datanode")
    # Print states of namenodes
-    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u hdfs systemd-cat hdfs haadmin -getAllServiceState")
    # Wait for cluster to exit safemode
    client.succeed("sudo -u hdfs hdfs dfsadmin -safemode wait")
-    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u hdfs systemd-cat hdfs haadmin -getAllServiceState")
    # test R/W
    client.succeed("echo testfilecontents | sudo -u hdfs hdfs dfs -put - /testfile")
    assert "testfilecontents" in client.succeed("sudo -u hdfs hdfs dfs -cat /testfile")
@ -211,7 +211,7 @@ import ../make-test-python.nix ({ package, ... }: {
    # Test NN failover
    nn1.succeed("systemctl stop hdfs-namenode")
    assert "active" in client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState")
-    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u hdfs systemd-cat hdfs haadmin -getAllServiceState")
    assert "testfilecontents" in client.succeed("sudo -u hdfs hdfs dfs -cat /testfile")

    nn1.succeed("systemctl start hdfs-namenode")
@ -219,7 +219,7 @@ import ../make-test-python.nix ({ package, ... }: {
    nn1.wait_for_open_port(8022)
    nn1.wait_for_open_port(8020)
    assert "standby" in client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState")
-    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u hdfs systemd-cat hdfs haadmin -getAllServiceState")

    #### YARN tests ####

@ -236,18 +236,18 @@ import ../make-test-python.nix ({ package, ... }: {
    nm1.wait_for_open_port(8042)
    nm1.wait_for_open_port(8040)
    client.wait_until_succeeds("yarn node -list | grep Nodes:1")
-    client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
-    client.succeed("sudo -u yarn yarn node -list | systemd-cat")
+    client.succeed("sudo -u yarn systemd-cat yarn rmadmin -getAllServiceState")
+    client.succeed("sudo -u yarn systemd-cat yarn node -list")

    # Test RM failover
    rm1.succeed("systemctl stop yarn-resourcemanager")
    assert "standby" not in client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState")
-    client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u yarn systemd-cat yarn rmadmin -getAllServiceState")
    rm1.succeed("systemctl start yarn-resourcemanager")
    rm1.wait_for_unit("yarn-resourcemanager")
    rm1.wait_for_open_port(8088)
    assert "standby" in client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState")
-    client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u yarn systemd-cat yarn rmadmin -getAllServiceState")

    assert "Estimated value of Pi is" in client.succeed("HADOOP_USER_NAME=hdfs yarn jar $(readlink $(which yarn) | sed -r 's~bin/yarn~share/hadoop/mapreduce/hadoop-mapreduce-examples-*.jar~g') pi 2 10")
    assert "SUCCEEDED" in client.succeed("yarn application -list -appStates FINISHED")
--- a/nixos/tests/hadoop/hdfs.nix
+++ b/nixos/tests/hadoop/hdfs.nix
@ -50,8 +50,8 @@ import ../make-test-python.nix ({ package, lib, ... }:
    namenode.wait_for_unit("hdfs-namenode")
    namenode.wait_for_unit("network.target")
    namenode.wait_for_open_port(8020)
-    namenode.succeed("ss -tulpne | systemd-cat")
-    namenode.succeed("cat /etc/hadoop*/hdfs-site.xml | systemd-cat")
+    namenode.succeed("systemd-cat ss -tulpne")
+    namenode.succeed("systemd-cat cat /etc/hadoop*/hdfs-site.xml")
    namenode.wait_for_open_port(9870)

    datanode.wait_for_unit("hdfs-datanode")
--- a/nixos/tests/iscsi-multipath-root.nix
+++ b/nixos/tests/iscsi-multipath-root.nix
@ -202,7 +202,7 @@ import ./make-test-python.nix (
      initiatorAuto.succeed("umount /mnt")

      initiatorAuto.succeed("systemctl restart multipathd")
-      initiatorAuto.succeed("multipath -ll | systemd-cat")
+      initiatorAuto.succeed("systemd-cat multipath -ll")

      # Install our RootDisk machine to 123456, the alias to the device that multipath is now managing
      initiatorAuto.succeed("mount /dev/mapper/123456 /mnt")
@ -223,7 +223,7 @@ import ./make-test-python.nix (
      initiatorRootDisk.fail("iscsiadm -m discovery -o update -t sendtargets -p 192.168.1.3 --login")
      initiatorRootDisk.fail("iscsiadm -m discovery -o update -t sendtargets -p 192.168.2.3 --login")
      initiatorRootDisk.succeed("systemctl restart multipathd")
-      initiatorRootDisk.succeed("multipath -ll | systemd-cat")
+      initiatorRootDisk.succeed("systemd-cat multipath -ll")

      # Verify we can write and sync the root disk
      initiatorRootDisk.succeed("mkdir /scratch")
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@ -173,7 +173,7 @@ let
          )

      with subtest("use the web interface to sign up, log in, and save a password"):
-          server.succeed("PYTHONUNBUFFERED=1 test-runner | systemd-cat -t test-runner")
+          server.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner")

      with subtest("log in with the cli"):
          key = client.succeed(
--- a/pkgs/applications/audio/zam-plugins/default.nix
+++ b/pkgs/applications/audio/zam-plugins/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "zam-plugins";
-  version = "4.1";
+  version = "4.2";

  src = fetchFromGitHub {
    owner = "zamaudio";
    repo = pname;
    rev = version;
-    sha256 = "sha256-NKa6lOP3fpAFMYwzZAMFgW0tBSM/F89oB/nDbEUeflw=";
+    sha256 = "sha256-6TPZMDhGHqXjY8UYEqlr4hweF+W19IpIfSa9Bo9Ta1A=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -75,7 +75,7 @@ rustPlatform.buildRustPackage rec {
    description = "Polkadot Node Implementation";
    homepage = "https://polkadot.network";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ akru andresilva asymmetric FlorianFranzen RaghavSood ];
+    maintainers = with maintainers; [ akru andresilva FlorianFranzen RaghavSood ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/graphics/photoflare/default.nix
+++ b/pkgs/applications/graphics/photoflare/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "photoflare";
-  version = "1.6.12";
+  version = "1.6.13";

  src = fetchFromGitHub {
    owner = "PhotoFlare";
    repo = "photoflare";
    rev = "v${version}";
-    sha256 = "sha256-UIEHQil7NsdIKQlrNPpf7rxj6O6P1xlz0E7FNYTcdT4=";
+    sha256 = "sha256-0eAuof/FBro2IKxkJ6JHauW6C96VTPxy7QtfPVzPFi4=";
  };

  nativeBuildInputs = [ qmake qttools ];
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@ -34,7 +34,7 @@ appimageTools.wrapType2 {
    description = "P2P note-taking tool";
    homepage = "https://anytype.io/";
    license = licenses.unfree;
-    maintainers = with maintainers; [ bbigras ];
+    maintainers = with maintainers; [ ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/misc/nwg-launchers/default.nix
+++ b/pkgs/applications/misc/nwg-launchers/default.nix
@ -46,6 +46,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/nwg-piotr/nwg-launchers";
    license = licenses.gpl3;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ bbigras ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/misc/p2pool/default.nix
+++ b/pkgs/applications/misc/p2pool/default.nix
@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "p2pool";
-  version = "3.7";
+  version = "3.8";

  src = fetchFromGitHub {
    owner = "SChernykh";
    repo = "p2pool";
    rev = "v${version}";
-    sha256 = "sha256-WGavhxCGM10LXKvrXT3A2SOMSJRuoA/wAlEj7NFs8Ok=";
+    sha256 = "sha256-e/QXwRVtgl9+BaKbkeztCPfXORhef1HaKBPzKvVPVpM=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/solaar/default.nix
+++ b/pkgs/applications/misc/solaar/default.nix
@ -14,13 +14,13 @@
 # instead of adding this to `services.udev.packages` on NixOS,
 python3Packages.buildPythonApplication rec {
  pname = "solaar";
-  version = "1.1.9";
+  version = "1.1.10";

  src = fetchFromGitHub {
    owner = "pwr-Solaar";
    repo = "Solaar";
    rev = "refs/tags/${version}";
-    hash = "sha256-MdPZ9uLQYwgZ6xXWinzFg5A2gJ3ihTS9CbEmXnaNEkI=";
+    hash = "sha256-cs1kj/spZtMUL9aUtBHINAH7uyjMSn9jRDF/hRPzIbo=";
  };

  outputs = [ "out" "udev" ];
@ -38,13 +38,14 @@ python3Packages.buildPythonApplication rec {

  propagatedBuildInputs = with python3Packages; [
    evdev
+    dbus-python
    gtk3
+    hid-parser
    psutil
    pygobject3
    pyudev
    pyyaml
    xlib
-    hid-parser
  ];

  # the -cli symlink is just to maintain compabilility with older versions where
--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@ -2,16 +2,18 @@

 buildGoModule rec {
  pname = "kluctl";
-  version = "2.20.8";
+  version = "2.22.1";

  src = fetchFromGitHub {
    owner = "kluctl";
    repo = "kluctl";
    rev = "v${version}";
-    hash = "sha256-F4vEHzN44+d0EtfJukEq5WVm8aLVWqmT5Xcpa/DBPng=";
+    hash = "sha256-s7ADEWy3wx2hGeJzfXPVSBv+bAOoOQPsF75Sq02T/AI=";
  };

-  vendorHash = "sha256-x5Zy8H7DzxU+uBCUL6edv8x2LwiIjXl5UrRUMDtUEk8=";
+  subPackages = [ "cmd" ];
+
+  vendorHash = "sha256-EEOVd15f1SK8InSIG+TuVwWibkf+ePJ5AGZpiMD+RaQ=";

  ldflags = [ "-s" "-w" "-X main.version=v${version}" ];

--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pachyderm";
-  version = "2.7.2";
+  version = "2.7.6";

  src = fetchFromGitHub {
    owner = "pachyderm";
    repo = "pachyderm";
    rev = "v${version}";
-    hash = "sha256-+DqkYzRS1H6PGthljAqsmLAnGtKkX4g0drZiRh8b1v4=";
+    hash = "sha256-h0xr94DNmqjpRcas0F+UxQEnCHt5VGU2CRtv+GzJl00=";
  };

-  vendorHash = "sha256-q8Cx+J5BjMvO5wuvH5Tc5Oa9rjW7vXvS4DhSVv/E3E4=";
+  vendorHash = "sha256-UBuCAIwx1UOh9bsk3eNlTOozB55RIvuKQ0P1WRkJNaI=";

  subPackages = [ "src/server/cmd/pachctl" ];

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -772,13 +772,13 @@
    "vendorHash": "sha256-cufN4QYXE+bqDKLUV+Rdslr5CgbI0DvoFVWVQiBVomw="
  },
  "mongodbatlas": {
-    "hash": "sha256-aS5TU9xnevgjK9TH0J4nzSr6ct2Cqw2Wa+d+jIjA9Qg=",
+    "hash": "sha256-SMIc78haJiH0XdTr9OBGWOcvXfYQW9thcNkCOxmNxDw=",
    "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
    "owner": "mongodb",
    "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.12.2",
+    "rev": "v1.12.3",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-on7kyb/AGdQK++5AOCEmkrRlbuW09u2653mda9gmvKE="
+    "vendorHash": "sha256-B1trhV2/H5gP7EnUU7G45gIh95S2wYbANHsRM76CDWE="
  },
  "namecheap": {
    "hash": "sha256-cms8YUL+SjTeYyIOQibksi8ZHEBYq2JlgTEpOO1uMZE=",
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 (if stdenv.isDarwin then darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv).mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20231106-1";
+  version = "20231107-1";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-alQOYh1I4t1OppHbjsbDK6wc599Z0uDAyQjCtKM72ak=";
+    hash = "sha256-5JF/cU2yz1TDKUSAiZJ5LQfvsGSQtuww543O03gkZ+Y=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@ -103,14 +103,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "telegram-desktop";
-  version = "4.11.3";
+  version = "4.11.5";

  src = fetchFromGitHub {
    owner = "telegramdesktop";
    repo = "tdesktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-Xjb8um3TA2yIPrCdEV1BJ10keyAqTnlU20ZZ0T3P3ls=";
+    hash = "sha256-NkUm05bR5y5TAI5SL0en029n9903PzarQ6HC2vot27o=";
  };

  patches = [
--- a/pkgs/applications/networking/remote/wayvnc/default.nix
+++ b/pkgs/applications/networking/remote/wayvnc/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "wayvnc";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "any1";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-hmlzv1WaT+KucR7RGPC3bKcIdTxPOvK2s17nDucdu7c=";
+    sha256 = "sha256-6at0p1Xc25K5l6sq2uMWpaLVvZMNlWC0ybyZyrIw41I=";
  };

  strictDeps = true;
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchFromGitHub
 , fetchurl
 , fetchpatch
 , aqbanking
@ -32,7 +33,7 @@ stdenv.mkDerivation rec {
  # raw source code doesn't work out of box; fetchFromGitHub not usable
  src = fetchurl {
    # Upstream uploaded a -1 tarball on the same release, remove on next release
-    url = "https://github.com/Gnucash/gnucash/releases/download/${version}/${pname}-${version}-1.tar.bz2";
+    url = "https://github.com/Gnucash/gnucash/releases/download/${version}/gnucash-${version}-1.tar.bz2";
    hash = "sha256-d0EWXW1lLqe0oehJjPQ5pWuBpcyLZTKRpZBU8jYqv8w=";
  };

@ -97,12 +98,29 @@ stdenv.mkDerivation rec {
  enableParallelChecking = true;
  checkTarget = "check";

+  passthru.docs = stdenv.mkDerivation {
+    pname = "gnucash-docs";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "Gnucash";
+      repo = "gnucash-docs";
+      rev = version;
+      hash = "sha256-aPxQEcpo8SPv8lPQbxMl1wg8ijH9Rz0oo4K5lp3C/bw=";
+    };
+
+    nativeBuildInputs = [ cmake ];
+    buildInputs = [ libxml2 libxslt ];
+  };
+
  preFixup = ''
    gappsWrapperArgs+=(
+      # documentation
+      --prefix XDG_DATA_DIRS : ${passthru.docs}/share
      # db drivers location
      --set GNC_DBD_DIR ${libdbiDrivers}/lib/dbd
      # gsettings schema location on Nix
-      --set GSETTINGS_SCHEMA_DIR ${glib.makeSchemaPath "$out" "${pname}-${version}"}
+      --set GSETTINGS_SCHEMA_DIR ${glib.makeSchemaPath "$out" "gnucash-${version}"}
    )
  '';

--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@ -21,14 +21,14 @@

 stdenv.mkDerivation rec {
  pname = "wpsoffice";
-  version = "11.1.0.11704";
+  version = "11.1.0.11708";

  src = if useChineseVersion then fetchurl {
    url = "https://wps-linux-personal.wpscdn.cn/wps/download/ep/Linux2019/${lib.last (lib.splitString "." version)}/wps-office_${version}_amd64.deb";
-    hash = "sha256-ffLSon9FpQZDQ1uapchBUkVaHOXs+H/6kHJLNiWqwiE=";
+    hash = "sha256-GcWRrJ0I1Q6D2VK6YsPmd5Uir5LcIBFJa1amV2sUurk=";
  } else fetchurl {
    url = "https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/${lib.last (lib.splitString "." version)}/wps-office_${version}.XA_amd64.deb";
-    hash = "sha256-nxpMEWKiNjjEUoVJkhpvjnCuWBCCGjPk+sUlKz+KjMI=";
+    hash = "sha256-J40/wrmMz/r4eb2X/rbxWn04UcSsag7SO3aSqBLFSN4=";
  };

  unpackCmd = "dpkg -x $src .";
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@ -70,7 +70,9 @@ stdenv.mkDerivation rec {
    qtwayland
  ];

-  preConfigure = lib.optionalString stdenv.isDarwin ''
+  preConfigure = ''
+    export SOURCE_DATE_EPOCH=$(date -d 20${lib.versions.major version}0101 +%s)
+  '' + lib.optionalString stdenv.isDarwin ''
    export LC_ALL=en_US.UTF-8
  '';

--- a/pkgs/applications/version-management/guilt/darwin-fix.patch
+++ b/pkgs/applications/version-management/guilt/darwin-fix.patch
@ -0,0 +1,20 @@
+uname -s is used to determine the differences between the command line
+utilities like stat or awk in linux and darwin. However, in nix, guilt
+will be using the nix versions of this programs, not the ones
+installed in the system.  Therefore, guilt should use the command-line
+parameters that the linux forms of these commands expect, even if it
+is being run on Darwin.
+
+diff --git a/guilt b/guilt
+index bf50343..cfc9332 100755
+--- a/guilt
+++ b/guilt
+@@ -986,7 +986,7 @@ guards_file="$GUILT_DIR/$branch/guards"
+ pager="more"
+ [ ! -z "$PAGER" ] && pager="$PAGER"
+ 
+-UNAME_S=`uname -s`
+UNAME_S="Linux"
+ 
+ if [ -r "$GUILT_PATH/os.$UNAME_S" ]; then
+ 	. "$GUILT_PATH/os.$UNAME_S"
--- a/pkgs/applications/version-management/guilt/default.nix
+++ b/pkgs/applications/version-management/guilt/default.nix
@ -0,0 +1,92 @@
+{ asciidoc
+, docbook_xml_dtd_45
+, docbook_xsl
+, fetchFromGitHub
+, gawk
+, git
+, gnused
+, lib
+, makeWrapper
+, openssl
+, perl
+, stdenv
+, xmlto
+}:
+
+stdenv.mkDerivation rec {
+  pname = "guilt";
+  version = "0.37-rc1";
+
+  src = fetchFromGitHub {
+    owner = "jeffpc";
+    repo = "guilt";
+    rev = "v${version}";
+    sha256 = "sha256-7OgRbMGYWtGvrZxKfJe0CkpmU3AUkPebF5NyTsfXeGA=";
+  };
+
+  doCheck = true;
+
+  patches = [
+    ./guilt-help-mandir.patch
+    ./darwin-fix.patch
+  ];
+  nativeBuildInputs = [
+    asciidoc
+    docbook_xml_dtd_45
+    docbook_xsl
+    makeWrapper
+    perl
+    xmlto
+  ];
+  buildInputs = [
+    gawk
+    git
+    gnused
+  ] ++ lib.optionals stdenv.isDarwin [ openssl ];
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  postBuild = ''
+    make -j $NIX_BUILD_CORES doc
+  '';
+
+  preCheck = ''
+    patchShebangs regression/run-tests regression/*.sh
+  '';
+
+  postInstall = ''
+    make PREFIX=$out install-doc
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/guilt --prefix PATH : ${lib.makeBinPath buildInputs}
+  '';
+
+  meta = with lib; {
+    description = "Manage patches like quilt, on top of a git repository";
+    longDescription = ''
+      Andrew Morton originally developed a set of scripts for
+      maintaining kernel patches outside of any SCM tool. Others
+      extended these into a suite called quilt]. The basic idea behind
+      quilt is to maintain patches instead of maintaining source
+      files. Patches can be added, removed or reordered, and they can
+      be refreshed as you fix bugs or update to a new base
+      revision. quilt is very powerful, but it is not integrated with
+      the underlying SCM tools. This makes it difficult to visualize
+      your changes.
+
+      Guilt allows one to use quilt functionality on top of a Git
+      repository. Changes are maintained as patches which are
+      committed into Git. Commits can be removed or reordered, and the
+      underlying patch can be refreshed based on changes made in the
+      working directory. The patch directory can also be placed under
+      revision control, so you can have a separate history of changes
+      made to your patches.
+    '';
+    homepage = "https://github.com/jeffpc/guilt";
+    maintainers = with lib.maintainers; [ javimerino ];
+    license = [ licenses.gpl2 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/version-management/guilt/guilt-help-mandir.patch
+++ b/pkgs/applications/version-management/guilt/guilt-help-mandir.patch
@ -0,0 +1,15 @@
+nixpkgs' post-installation fixup moves the pages to share/man.  Tell guilt-help so that it can find them.
+
+diff --git a/guilt-help b/guilt-help
+index 93442a3..b29e059 100755
+--- a/guilt-help
+++ b/guilt-help
+@@ -34,7 +34,7 @@ case $# in
+ 		;;
+ esac
+ 
+-MANDIR=`dirname $0`/../man
+MANDIR=`dirname $0`/../share/man
+ MANDIR=`(cd "$MANDIR"; pwd)`
+ exec man -M "$MANDIR" "$page"
+ 
--- a/pkgs/applications/version-management/meld/default.nix
+++ b/pkgs/applications/version-management/meld/default.nix
@ -47,7 +47,7 @@ python3.pkgs.buildPythonApplication rec {
    gnome.adwaita-icon-theme
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  pythonPath = with python3.pkgs; [
    pygobject3
    pycairo
  ];
--- a/pkgs/applications/video/mpv/scripts/acompressor.nix
+++ b/pkgs/applications/video/mpv/scripts/acompressor.nix
@ -1,27 +1,17 @@
-{ stdenvNoCC
+{ lib
+, buildLua
 , mpv-unwrapped
-, lib
 }:

-stdenvNoCC.mkDerivation rec {
+buildLua {
+  inherit (mpv-unwrapped) src version;
  pname = "mpv-acompressor";
-  version = mpv-unwrapped.version;
-
-  src = "${mpv-unwrapped.src.outPath}/TOOLS/lua/acompressor.lua";
-
-  dontBuild = true;
-  dontUnpack = true;
-
-  installPhase = ''
-    install -Dm644 ${src} $out/share/mpv/scripts/acompressor.lua
-  '';
-
-  passthru.scriptName = "acompressor.lua";
+  scriptPath = "TOOLS/lua/acompressor.lua";

  meta = with lib; {
+    inherit (mpv-unwrapped.meta) license;
    description = "Script to toggle and control ffmpeg's dynamic range compression filter.";
    homepage = "https://github.com/mpv-player/mpv/blob/master/TOOLS/lua/acompressor.lua";
-    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ nicoo ];
  };
 }
--- a/pkgs/applications/video/mpv/scripts/buildLua.nix
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@ -0,0 +1,22 @@
+{ lib
+, stdenvNoCC }:
+
+let fileName = pathStr: lib.last (lib.splitString "/" pathStr);
+in
+lib.makeOverridable (
+  { pname, scriptPath ? "${pname}.lua", ... }@args:
+  stdenvNoCC.mkDerivation (lib.attrsets.recursiveUpdate {
+    dontBuild = true;
+    preferLocalBuild = true;
+
+    outputHashMode = "recursive";
+    installPhase = ''
+      runHook preInstall
+      install -m644 -Dt $out/share/mpv/scripts ${scriptPath}
+      runHook postInstall
+    '';
+
+    passthru.scriptName = fileName scriptPath;
+    meta.platforms = lib.platforms.all;
+  } args)
+)
--- a/pkgs/applications/video/mpv/scripts/chapterskip.nix
+++ b/pkgs/applications/video/mpv/scripts/chapterskip.nix
@ -1,11 +1,9 @@
 { lib
 , fetchFromGitHub
-, nix-update-script
-, stdenvNoCC }:
+, buildLua }:

-stdenvNoCC.mkDerivation {
+buildLua {
  pname = "chapterskip";
-  passthru.scriptName = "chapterskip.lua";

  version = "unstable-2022-09-08";
  src = fetchFromGitHub {
@ -15,17 +13,8 @@ stdenvNoCC.mkDerivation {
    hash  = "sha256-OTrLQE3rYvPQamEX23D6HttNjx3vafWdTMxTiWpDy90=";
  };

-  dontBuild = true;
-  preferLocalBuild = true;
-  installPhase = "install -Dt $out/share/mpv/scripts chapterskip.lua";
-
-  passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version=branch" ];
-  };
-
-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/po5/chapterskip";
-    platforms = platforms.all;
-    maintainers = with maintainers; [ nicoo ];
+    maintainers = with lib.maintainers; [ nicoo ];
  };
 }
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@ -3,13 +3,14 @@
 , config
 }:

-lib.recurseIntoAttrs
+let buildLua = callPackage ./buildLua.nix { };
+in lib.recurseIntoAttrs
  ({
-    acompressor = callPackage ./acompressor.nix { };
+    acompressor = callPackage ./acompressor.nix { inherit buildLua; };
    autocrop = callPackage ./autocrop.nix { };
    autodeint = callPackage ./autodeint.nix { };
    autoload = callPackage ./autoload.nix { };
-    chapterskip = callPackage ./chapterskip.nix { };
+    chapterskip = callPackage ./chapterskip.nix { inherit buildLua; };
    convert = callPackage ./convert.nix { };
    inhibit-gnome = callPackage ./inhibit-gnome.nix { };
    mpris = callPackage ./mpris.nix { };
@ -27,7 +28,7 @@ lib.recurseIntoAttrs
    webtorrent-mpv-hook = callPackage ./webtorrent-mpv-hook.nix { };
    cutter = callPackage ./cutter.nix { };
  }
-  // (callPackage ./occivink.nix { }))
+  // (callPackage ./occivink.nix { inherit buildLua; }))
  // lib.optionalAttrs config.allowAliases {
  youtube-quality = throw "'youtube-quality' is no longer maintained, use 'quality-menu' instead"; # added 2023-07-14
 }
--- a/pkgs/applications/video/mpv/scripts/occivink.nix
+++ b/pkgs/applications/video/mpv/scripts/occivink.nix
@ -1,14 +1,17 @@
 { lib
-, stdenvNoCC
 , fetchFromGitHub
+, buildLua
 }:

 let
-  script = { n, ... }@p:
-    stdenvNoCC.mkDerivation (lib.attrsets.recursiveUpdate {
-      pname = "mpv_${n}";
-      passthru.scriptName = "${n}.lua";
+  camelToKebab = let
+    inherit (lib.strings) match stringAsChars toLower;
+    isUpper = match "[A-Z]";
+  in stringAsChars (c: if isUpper c != null then "-${toLower c}" else c);

+  mkScript = name: args:
+    buildLua (lib.attrsets.recursiveUpdate rec {
+      pname = camelToKebab name;
      src = fetchFromGitHub {
        owner = "occivink";
        repo = "mpv-scripts";
@ -17,37 +20,26 @@ let
      };
      version = "unstable-2022-10-02";

-      dontBuild = true;
-      installPhase = ''
-        mkdir -p $out/share/mpv/scripts
-        cp -r scripts/${n}.lua $out/share/mpv/scripts/
-      '';
+      scriptPath = "scripts/${pname}.lua";

      meta = with lib; {
        homepage = "https://github.com/occivink/mpv-scripts";
        license = licenses.unlicense;
-        platforms = platforms.all;
        maintainers = with maintainers; [ nicoo ];
      };
-
-      outputHashAlgo = "sha256";
-      outputHashMode = "recursive";
-    } p);
+    } args);

 in
-{
+lib.mapAttrs (name: lib.makeOverridable (mkScript name)) {

  # Usage: `pkgs.mpv.override { scripts = [ pkgs.mpvScripts.seekTo ]; }`
-  seekTo = script {
-    n = "seek-to";
+  seekTo = {
    meta.description = "Mpv script for seeking to a specific position";
    outputHash = "sha256-3RlbtUivmeoR9TZ6rABiZSd5jd2lFv/8p/4irHMLshs=";
  };

-  blacklistExtensions = script {
-    n = "blacklist-extensions";
+  blacklistExtensions = {
    meta.description = "Automatically remove playlist entries based on their extension.";
    outputHash = "sha256-qw9lz8ofmvvh23F9aWLxiU4YofY+YflRETu+nxMhvVE=";
  };
-
 }
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@ -102,11 +102,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "${optionalString onlyLibVLC "lib"}vlc";
-  version = "3.0.18";
+  version = "3.0.20";

  src = fetchurl {
    url = "http://get.videolan.org/vlc/${finalAttrs.version}/vlc-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VwlEOcNl2KqLm0H6MIDMDu8r7+YCW7XO9yKszGJa7ew=";
+    hash = "sha256-rccoW00nIc3fQOtScMraKqoQozTLVG/VWgY1NEe6KbU=";
  };

  nativeBuildInputs = [
@ -220,12 +220,6 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://code.videolan.org/videolan/vlc/uploads/eb1c313d2d499b8a777314f789794f9d/0001-Add-lssl-and-lcrypto-to-liblive555_plugin_la_LIBADD.patch";
      sha256 = "0kyi8q2zn2ww148ngbia9c7qjgdrijf4jlvxyxgrj29cb5iy1kda";
    })
-    # patch to build with recent libplacebo
-    # https://code.videolan.org/videolan/vlc/-/merge_requests/3027
-    (fetchpatch {
-      url = "https://code.videolan.org/videolan/vlc/-/commit/65ea8d19d91ac1599a29e8411485a72fe89c45e2.patch";
-      hash = "sha256-Zz+g75V6X9OZI3sn614K9Uenxl3WtRHKSdLkWP3b17w=";
-    })
  ];

  postPatch = ''
--- a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
@ -40,13 +40,13 @@ assert lib.assertMsg (!nvidiaPatches) "The option `nvidiaPatches` has been renam
 assert lib.assertMsg (!hidpiXWayland) "The option `hidpiXWayland` has been removed. Please refer https://wiki.hyprland.org/Configuring/XWayland";
 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprland" + lib.optionalString debug "-debug";
-  version = "0.31.0";
+  version = "0.32.0";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = finalAttrs.pname;
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8n67P8wvtFgjOufTj4y1sRpBcbMrlhSlH7d8dOhUKns=";
+    hash = "sha256-HrnlCdZBqqE37gFORapfSGEGcqhCyhX2aSMRnDEmR0k=";
  };

  patches = [
--- a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
@ -42,8 +42,8 @@ wlroots.overrideAttrs
      domain = "gitlab.freedesktop.org";
      owner = "wlroots";
      repo = "wlroots";
-      rev = "3406c1b17a4a7e6d4e2a7d9c1176affa72bce1bc";
-      hash = "sha256-ecDhdYLXWHsxMv+EWG36mCNDvzRbu9qfjH7dLxL7aGM=";
+      rev = "47bf87ade2bd32395615a385ebde1fefbcdf79a2";
+      hash = "sha256-jU0I6FoCKnj4zIBL4daosFWh81U1fM719Z6cae8PxSY=";
    };

    pname =
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (self: {
  pname = "xdg-desktop-portal-hyprland";
-  version = "1.2.3";
+  version = "1.2.4";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "xdg-desktop-portal-hyprland";
    rev = "v${self.version}";
-    hash = "sha256-y8q4XUwx+gVK7i2eLjfR32lVo7TYvEslyzrmzYEaPZU=";
+    hash = "sha256-IKcRTKzlcDsbD5xydRNc9s4c4KjcQHaZgOc5kWPOAtU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ge/gerrit-queue/package.nix
+++ b/pkgs/by-name/ge/gerrit-queue/package.nix
@ -0,0 +1,25 @@
+{ buildGoModule
+, lib
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "gerrit-queue";
+  version = "0.0.1";
+
+  src = fetchFromGitHub {
+    owner = "flokli";
+    repo = "gerrit-queue";
+    rev = "v${version}";
+    hash = "sha256-JkAYqqet6y89RTBU9FuxkMwJiGM6opL0reXbojSal3Y=";
+  };
+  vendorHash = "sha256-+Ig4D46NphzpWKXO23Haea9EqVtpda8v9zLPJkbe3bQ=";
+
+  meta = with lib; {
+    description = "Merge bot for Gerrit";
+    homepage = "https://github.com/flokli/gerrit-queue";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ flokli ];
+    mainProgram = "gerrit-queue";
+  };
+}
--- a/pkgs/by-name/ja/jasper/package.nix
+++ b/pkgs/by-name/ja/jasper/package.nix
@ -7,20 +7,24 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "jasper";
-  version = "4.0.0";
+  version = "4.0.1";

  src = fetchFromGitHub {
    owner = "jasper-software";
    repo = "jasper";
    rev = "version-${finalAttrs.version}";
-    hash = "sha256-v/AFx40JWdbTCa008tDz/n9cXgpAkKv4rSiGJ8yx1YQ=";
+    hash = "sha256-IQBszOKou5Q1lgDy2LICHFmOKYJ3/djmuHGNalVHeBQ=";
  };

+  outputs = [ "out" "doc" "man" ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
  ];

+  # Since "build" already exists and is populated, cmake tries to use it,
+  # throwing uncomprehensible error messages...
  cmakeBuildDir = "build-directory";

  strictDeps = true;
--- a/pkgs/by-name/mc/mcuboot-imgtool/package.nix
+++ b/pkgs/by-name/mc/mcuboot-imgtool/package.nix
@ -0,0 +1,38 @@
+{ lib
+, fetchPypi
+, python3Packages
+, nix-update-script
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "mfgtool-imgtool";
+  version = "1.10.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "imgtool";
+    hash = "sha256-A7NOdZNKw9lufEK2vK8Rzq9PRT98bybBfXJr0YMQS0A=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    cbor2
+    click
+    cryptography
+    intelhex
+  ];
+
+  meta = with lib; {
+    description = "MCUboot's image signing and key management";
+    homepage = "https://github.com/mcu-tools/mcuboot/tree/main/scripts";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ otavio ];
+    mainProgram = "imgtool";
+  };
+}
--- a/pkgs/by-name/me/memtree/package.nix
+++ b/pkgs/by-name/me/memtree/package.nix
@ -0,0 +1,50 @@
+{ lib
+, fetchFromGitHub
+, nix-update-script
+, python3Packages
+}:
+
+python3Packages.buildPythonApplication {
+  pname = "memtree";
+  version = "unstable-2023-11-04";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "nbraud";
+    repo = "memtree";
+    rev = "093caeef26ee944b5bf4408710f63494e442b5ff";
+    hash = "sha256-j4LqWy7DxeV7pjwnCfpkHwug4p48kux6BM6oDJmvuUo=";
+  };
+
+  nativeBuildInputs = with python3Packages; [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    rich
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    hypothesis
+    pytest
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    python -m pytest -v
+    runHook postCheck
+  '';
+
+  pythonImportChecks = [ "memtree" ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = with lib; {
+    description = "Render cgroups tree annotated by memory usage";
+    homepage = "https://github.com/nbraud/memtree";
+    maintainers = with maintainers; [ nicoo ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/nu/numbat/package.nix
+++ b/pkgs/by-name/nu/numbat/package.nix
@ -24,6 +24,13 @@ rustPlatform.buildRustPackage rec {
    darwin.apple_sdk.frameworks.Security
  ];

+  env.NUMBAT_SYSTEM_MODULE_PATH = "${placeholder "out"}/share/${pname}/modules";
+
+  postInstall = ''
+    mkdir -p $out/share/${pname}
+    cp -r $src/${pname}/modules $out/share/${pname}/
+  '';
+
  passthru.tests.version = testers.testVersion {
    package = numbat;
  };
--- a/pkgs/by-name/op/open-english-wordnet/package.nix
+++ b/pkgs/by-name/op/open-english-wordnet/package.nix
@ -0,0 +1,73 @@
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, gzip
+, python3
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "open-english-wordnet";
+  version = "2022";
+
+  src = fetchFromGitHub {
+    owner = "globalwordnet";
+    repo = "english-wordnet";
+    rev = "${self.version}-edition";
+    hash = "sha256-a1fWIp39uuJZL1aFX/r+ttLB1+kwh/XPHwphgENTQ5M=";
+  };
+
+  patches = lib.mapAttrsToList (rev: hash: fetchpatch {
+    url = "https://github.com/globalwordnet/english-wordnet/commit/${rev}.patch";
+    inherit hash;
+  }) {
+    # Upstream commit bumping the version number, accidentally ommited from the tagged release
+    "bc07902f8995b62c70f01a282b23f40f30630540" = "sha256-1e4MG/k86g3OFUhiShCCbNXnvDKrYFr1KlGVsGl++KI=";
+    # PR #982, “merge.py: Make result independent of filesystem order”
+    "6da46a48dd76a48ad9ff563e6c807b8271fc83cd" = "sha256-QkkJH7NVGy/IbeSWkotU80IGF4esz0b8mIL9soHdQtQ=";
+  };
+
+  # TODO(nicoo): make compression optional?
+  nativeBuildInputs = [
+    gzip
+    (python3.withPackages (p: with p; [ pyyaml ]))
+  ];
+
+  # TODO(nicoo): generate LMF and WNDB versions with separate outputs
+  buildPhase = ''
+    runHook preBuild
+
+    echo Generating wn.xml
+    python scripts/from-yaml.py
+    python scripts/merge.py
+
+    echo Compressing
+    gzip --best --no-name --stdout ./wn.xml > 'oewn:${self.version}.xml.gz'
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out/share/wordnet 'oewn:${self.version}.xml.gz'
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Lexical network of the English language";
+    longDescription = ''
+      Open English WordNet is a lexical network of the English language grouping
+      words into synsets and linking them according to relationships such as
+      hypernymy, antonymy and meronymy. It is intended to be used in natural
+      language processing applications and provides deep lexical information
+      about the English language as a graph.
+
+      Open English WordNet is a fork of the Princeton Wordnet developed under an
+      open source methodology.
+    '';
+    homepage = "https://en-word.net/";
+    license = licenses.cc-by-40;
+    maintainers = with maintainers; [ nicoo ];
+    platforms = platforms.all;
+  };
+})
--- a/pkgs/applications/misc/polybar/default.nix
+++ b/pkgs/applications/misc/polybar/default.nix
@ -40,15 +40,15 @@
 , i3Support ? false
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "polybar";
-  version = "3.6.3";
+  version = "3.7.0";

  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = version;
-    hash = "sha256-FKkPSAEMzptnjJq3xTk+fpD8XjASQ3smX5imstDyLNE=";
+    owner = "polybar";
+    repo = "polybar";
+    rev = finalAttrs.version;
+    hash = "sha256-Z1rL9WvEZHr5M03s9KCJ6O6rNuaK7PpwUDaatYuCocI=";
    fetchSubmodules = true;
  };

@ -113,4 +113,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ afldcr Br1ght0ne fortuneteller2k ckie ];
    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/applications/misc/polybar/remove-hardcoded-etc.diff
+++ b/pkgs/applications/misc/polybar/remove-hardcoded-etc.diff
--- a/pkgs/by-name/si/simde/package.nix
+++ b/pkgs/by-name/si/simde/package.nix
@ -0,0 +1,30 @@
+{ stdenv, lib, fetchFromGitHub, meson, ninja }:
+
+stdenv.mkDerivation rec {
+  pname = "simde";
+  version = "0.7.6";
+
+  src = fetchFromGitHub {
+    owner = "simd-everywhere";
+    repo = "simde";
+    rev = "v${version}";
+    hash = "sha256-pj+zaD5o9XYkTavezcQFzM6ao0IdQP1zjP9L4vcCyEY=";
+  };
+
+  nativeBuildInputs = [ meson ninja ];
+
+  meta = with lib; {
+    homepage = "https://simd-everywhere.github.io";
+    description = "Implementations of SIMD instruction sets for systems which don't natively support them";
+    license = with licenses; [mit];
+    maintainers = with maintainers; [ whiteley ];
+    platforms = flatten (with platforms; [
+      arm
+      armv7
+      aarch64
+      x86
+      power
+      mips
+    ]);
+  };
+}
--- a/pkgs/by-name/su/supersonic/package.nix
+++ b/pkgs/by-name/su/supersonic/package.nix
@ -20,16 +20,16 @@ assert waylandSupport -> stdenv.isLinux;

 buildGoModule rec {
  pname = "supersonic" + lib.optionalString waylandSupport "-wayland";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "dweymouth";
    repo = "supersonic";
    rev = "v${version}";
-    hash = "sha256-elDVkhRW1mTez56OKQJJ0m0VxP8/Bq+HcXf5iokeY5I=";
+    hash = "sha256-DVduZ1qPbcDlH+B5hibC2HUjwEUV+CpDDpMI8GdPwro";
  };

-  vendorHash = "sha256-z1sDlyc7HW+tYfG0Z4EjUCEM3Su4JjmWIKxU2MV6GOA=";
+  vendorHash = "sha256-Dj6I+gt0gB5HWTWdFXCV5UpLuvg+HhuygRJAdvV/Yp8";

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/by-name/yg/yggdrasil/package.nix
+++ b/pkgs/by-name/yg/yggdrasil/package.nix
@ -30,6 +30,6 @@ buildGoModule rec {
      "An experiment in scalable routing as an encrypted IPv6 overlay network";
    homepage = "https://yggdrasil-network.github.io/";
    license = licenses.lgpl3;
-    maintainers = with maintainers; [ bbigras ehmry gazally lassulus ];
+    maintainers = with maintainers; [ ehmry gazally lassulus ];
  };
 }
--- a/pkgs/data/fonts/sketchybar-app-font/default.nix
+++ b/pkgs/data/fonts/sketchybar-app-font/default.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "sketchybar-app-font";
-  version = "1.0.17";
+  version = "1.0.20";

  src = fetchurl {
    url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/sketchybar-app-font.ttf";
-    hash = "sha256-sDMasHVcITTSUP9B87w4I7IZ44tYmabNNWl+kE3dUoE=";
+    hash = "sha256-pf3SSxzlNIdbXXHfRauFCnrVUMOd5J9sSUE9MsfWrwo=";
  };

  dontUnpack = true;
--- a/pkgs/data/themes/tokyo-night-gtk/default.nix
+++ b/pkgs/data/themes/tokyo-night-gtk/default.nix
@ -1,38 +1,38 @@
 { lib
-, stdenvNoCC
-, fetchFromGitHub
+, callPackage
+, runCommand
 , gtk-engine-murrine
+, gnome-themes-extra
 }:

-stdenvNoCC.mkDerivation {
-  pname = "tokyo-night-gtk";
-  version = "2023.01.17";
+let
+  prefix = "tokyo-night-gtk";

-  src = fetchFromGitHub {
-    owner = "Fausto-Korpsvart";
-    repo = "Tokyo-Night-GTK-Theme";
-    rev = "f7ae3421ac0d415ca57fb6224e093e12b8a980bb";
-    sha256 = "sha256-90V55pRfgiaP1huhD+3456ziJ2EU24iNQHt5Ro+g+M0=";
-  };
+  packages = lib.mapAttrs' (type: content: {
+    name = type;

-  propagatedUserEnvPkgs = [
-    gtk-engine-murrine
-  ];
+    value = lib.mapAttrs' (variantName: variant: {
+      name = variantName;
+      value = callPackage ./generic.nix { inherit prefix type variantName variant; };
+    }) content;
+  }) (lib.importJSON ./variants.json);
+in packages // {
+  # Not using `symlinkJoin` because it's massively inefficient in this case
+  full = runCommand "${prefix}_full" {
+    preferLocalBuild = true;

-  dontBuild = true;
+    propagatedUserEnvPkgs = [
+      gtk-engine-murrine
+      gnome-themes-extra
+    ];
+  } ''
+    mkdir -p $out/share/{icons,themes,${prefix}}

-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/share/themes
-    cp -a themes/* $out/share/themes
-    runHook postInstall
+    ${lib.concatStrings (lib.forEach (lib.attrValues (lib.attrsets.mergeAttrsList (lib.attrValues packages))) (variant:
+      ''
+        ln -s ${variant}/share/${variant.ptype}/Tokyonight-${variant.pvariant} $out/share/${variant.ptype}/Tokyonight-${variant.pvariant}
+        ln -s ${variant}/share/${prefix}/LICENSE $out/share/${prefix}/LICENSE 2>/dev/null || true
+      ''
+    ))}
  '';
-
-  meta = with lib; {
-    description = "A GTK theme based on the Tokyo Night colour palette.";
-    homepage = "www.pling.com/p/1681315/";
-    license = licenses.gpl3Only;
-    platforms = platforms.unix;
-    maintainers = with lib.maintainers; [ garaiza-93 ];
-  };
 }
--- a/pkgs/data/themes/tokyo-night-gtk/generic.nix
+++ b/pkgs/data/themes/tokyo-night-gtk/generic.nix
@ -0,0 +1,77 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, writeScript
+, gtk-engine-murrine
+, gnome-themes-extra
+, prefix ? ""
+, type ? ""
+, variantName ? ""
+, variant ? ""
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "${prefix}_${type}-${variantName}";
+  version = "unstable-2023-05-30";
+
+  src = fetchFromGitHub {
+    owner = "Fausto-Korpsvart";
+    repo = "Tokyo-Night-GTK-Theme";
+    rev = "e9790345a6231cd6001f1356d578883fac52233a";
+    hash = "sha256-Q9UnvmX+GpvqSmTwdjU4hsEsYhA887wPqs5pyqbIhmc=";
+  };
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+    gnome-themes-extra
+  ];
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/{${type},${prefix}}
+    cp -a ${type}/Tokyonight-${variant} $out/share/${type}
+    cp -a LICENSE $out/share/${prefix}
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = writeScript "update.sh" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl common-updater-scripts tree jq
+      res="$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
+        -sL "https://api.github.com/repos/${finalAttrs.src.owner}/${finalAttrs.src.repo}/commits/HEAD")"
+
+      rev="$(echo $res | jq '.sha' --raw-output)"
+      version="unstable-$(echo $res | jq '.commit | .author | .date' --raw-output | sed 's/T.*$//')"
+      update-source-version ${prefix}-variants.${type}.${variantName} "$version" "$rev" --ignore-same-hash
+
+      commonjq1='.[] .contents .[] | {(.name): .name} | walk(if type=="object" then with_entries(.key|=ascii_downcase) else . end)'
+      commonjq2='reduce inputs as $in (.; . + $in)'
+      commontree="-dJ -L 1 --noreport ${finalAttrs.src}"
+
+      echo $(tree $commontree/icons | jq "$commonjq1" | jq "$commonjq2" | jq '{icons: .}') \
+        $(tree $commontree/themes | jq "$commonjq1" | jq "$commonjq2" | jq '{themes: .}') | \
+        jq 'reduce inputs as $in (.; . + $in)' | sed "s/[tT]okyonight-//g" > \
+        "$(git rev-parse --show-toplevel)/pkgs/data/themes/${prefix}/variants.json"
+    '';
+
+    # For "full" in default.nix
+    ptype = type;
+    pvariant = variant;
+  };
+
+  meta = with lib; {
+    description = "A GTK theme based on the Tokyo Night colour palette";
+    homepage = "https://www.pling.com/p/1681315";
+    license = licenses.gpl3Only;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ garaiza-93 Madouura ];
+  };
+})
--- a/pkgs/data/themes/tokyo-night-gtk/variants.json
+++ b/pkgs/data/themes/tokyo-night-gtk/variants.json
@ -0,0 +1,18 @@
+{
+  "icons": {
+    "dark": "Dark",
+    "dark-cyan": "Dark-Cyan",
+    "light": "Light",
+    "moon": "Moon"
+  },
+  "themes": {
+    "dark-b": "Dark-B",
+    "dark-bl": "Dark-BL",
+    "dark-b-lb": "Dark-B-LB",
+    "dark-bl-lb": "Dark-BL-LB",
+    "storm-b": "Storm-B",
+    "storm-bl": "Storm-BL",
+    "storm-b-lb": "Storm-B-LB",
+    "storm-bl-lb": "Storm-BL-LB"
+  }
+}
--- a/pkgs/development/compilers/cudatoolkit/common.nix
+++ b/pkgs/development/compilers/cudatoolkit/common.nix
@ -361,7 +361,7 @@ backendStdenv.mkDerivation rec {
    description = "A compiler for NVIDIA GPUs, math libraries, and tools";
    homepage = "https://developer.nvidia.com/cuda-toolkit";
    platforms = [ "x86_64-linux" ];
-    license = licenses.unfree;
+    license = licenses.nvidiaCuda;
    maintainers = teams.cuda.members;
  };
 }
--- a/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix
+++ b/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix
@ -39,7 +39,7 @@ let
  inherit (lib.meta) getExe;
  inherit (lib.strings) optionalString;
 in
-backendStdenv.mkDerivation {
+backendStdenv.mkDerivation (finalAttrs: {
  # NOTE: Even though there's no actual buildPhase going on here, the derivations of the
  # redistributables are sensitive to the compiler flags provided to stdenv. The patchelf package
  # is sensitive to the compiler flags provided to stdenv, and we depend on it. As such, we are
@ -164,11 +164,15 @@ backendStdenv.mkDerivation {
  outputSpecified = true;

  meta = {
-    inherit description platforms;
-    license = lib.licenses.unfree;
+    inherit platforms;
+    description = "${description}. By downloading and using the packages you accept the terms and conditions of the ${finalAttrs.meta.license.shortName}";
+    license = lib.licenses.nvidiaCudaRedist // {
+      url = "https://developer.download.nvidia.com/compute/cuda/redist/${releaseAttrs.license_path or "${pname}/LICENSE.txt"}";
+    };
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
    maintainers = lib.teams.cuda.members;
    # Force the use of the default, fat output by default (even though `dev` exists, which
    # causes Nix to prefer that output over the others if outputSpecified isn't set).
    outputsToInstall = [ "out" ];
  };
-}
+})
--- a/pkgs/development/compilers/gcc/all.nix
+++ b/pkgs/development/compilers/gcc/all.nix
@ -34,9 +34,6 @@ let
              else            /* "4.8" */   isl_0_14;
      } // lib.optionalAttrs (majorMinorVersion == "4.8") {
        texinfo = texinfo5; # doesn't validate since 6.1 -> 6.3 bump
-      } // lib.optionalAttrs (majorMinorVersion == "4.9") {
-        # Build fails on Darwin with clang
-        stdenv = if stdenv.isDarwin then gccStdenv else stdenv;
      } // lib.optionalAttrs (!(atLeast "6")) {
        cloog = if stdenv.isDarwin
                then null
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@ -33,6 +33,7 @@
 , nukeReferences
 , callPackage
 , majorMinorVersion
+, darwin

 # only for gcc<=6.x
 , langJava ? false
@ -408,10 +409,15 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
      maintainers
    ;
  } // lib.optionalAttrs (!atLeast11) {
-    badPlatforms = if !is49 then [ "aarch64-darwin" ] else lib.platforms.darwin;
+    badPlatforms = if !(is48 || is49) then [ "aarch64-darwin" ] else lib.platforms.darwin;
  };
 } // optionalAttrs is7 {
  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
+} // lib.optionalAttrs (!atLeast10 && stdenv.hostPlatform.isDarwin) {
+  # GCC <10 requires default cctools `strip` instead of `llvm-strip` used by Darwin bintools.
+  preBuild = ''
+    makeFlagsArray+=('STRIP=${lib.getBin darwin.cctools-port}/bin/${stdenv.cc.targetPrefix}strip')
+  '';
 } // optionalAttrs (!atLeast7) {
  env.langJava = langJava;
 } // optionalAttrs atLeast6 {
--- a/pkgs/development/compilers/gcc/patches/11/libgcc-aarch64-darwin-detection.patch
+++ b/pkgs/development/compilers/gcc/patches/11/libgcc-aarch64-darwin-detection.patch
@ -0,0 +1,21 @@
+diff -u a/libgcc/config.host b/libgcc/config.host
+--- a/libgcc/config.host	2023-11-05 11:01:55.778638446 -0500
+++ b/libgcc/config.host	2023-11-05 11:07:29.405103979 -0500
+@@ -227,7 +227,7 @@
+   tmake_file="$tmake_file t-slibgcc-darwin"
+   # newer toolsets produce warnings when building for unsupported versions.
+   case ${host} in
+-    *-*-darwin1[89]* | *-*-darwin2* )
+    *-*-darwin1[89]* | *-*-darwin2* | aarch64*-*-darwin*)
+       tmake_file="t-darwin-min-8 $tmake_file"
+       ;;
+     *-*-darwin9* | *-*-darwin1[0-7]*)
+diff -ur a/libgcc/config/t-darwin-rpath b/libgcc/config/t-darwin-rpath
+--- a/libgcc/config/t-darwin-rpath	2023-11-05 11:34:18.691150009 -0500
+++ b/libgcc/config/t-darwin-rpath	2023-11-05 11:50:36.968920904 -0500
+@@ -2,4 +2,4 @@
+ SHLIB_RPATH = @rpath
+
+ # Which does not work for Darwin < 9
+-HOST_LIBGCC2_CFLAGS += -mmacosx-version-min=10.5
+SHLIB_LOADER_PATH = -Wl,-rpath,@loader_path
--- a/pkgs/development/compilers/gcc/patches/4.9/darwin-clang-as.patch
+++ b/pkgs/development/compilers/gcc/patches/4.9/darwin-clang-as.patch
@ -0,0 +1,16 @@
+diff -ur a/libgcc/config/t-darwin b/libgcc/config/t-darwin
+--- a/libgcc/config/t-darwin	2012-07-14 09:50:59.000000000 -0400
+++ b/libgcc/config/t-darwin	2023-11-05 21:26:11.696825584 -0500
+@@ -7,12 +7,6 @@
+ crttme.o: $(srcdir)/config/darwin-crt-tm.c
+ 	$(crt_compile) $(DARWIN_EXTRA_CRT_BUILD_CFLAGS) -DEND -c $<
+ 
+-# -pipe because there's an assembler bug, 4077127, which causes
+-# it to not properly process the first # directive, causing temporary
+-# file names to appear in stabs, causing the bootstrap to fail.  Using -pipe
+-# works around this by not having any temporary file names.
+-HOST_LIBGCC2_CFLAGS += -pipe
+-
+ # Use unwind-dw2-fde-darwin
+ LIB2ADDEH = $(srcdir)/unwind-dw2.c $(srcdir)/config/unwind-dw2-fde-darwin.c \
+   $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
--- a/pkgs/development/compilers/gcc/patches/8/gcc8-darwin-as-gstabs.patch
+++ b/pkgs/development/compilers/gcc/patches/8/gcc8-darwin-as-gstabs.patch
@ -0,0 +1,96 @@
+Backported from https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=b2cee5e1e89c8f939bc36fe9756befcb93d96982
+
+diff -ur a/gcc/config/darwin.h b/gcc/config/darwin.h
+--- a/gcc/config/darwin.h	2021-05-14 04:42:08.000000000 -0400
+++ b/gcc/config/darwin.h	2023-11-06 08:53:27.629155053 -0500
+@@ -233,12 +233,18 @@
+ 
+ #define DSYMUTIL "\ndsymutil"
+ 
+/* Spec that controls whether the debug linker is run automatically for
+   a link step.  This needs to be done if there is a source file on the
+   command line which will result in a temporary object (and debug is
+   enabled).  */
+
+ #define DSYMUTIL_SPEC \
+    "%{!fdump=*:%{!fsyntax-only:%{!c:%{!M:%{!MM:%{!E:%{!S:\
+     %{v} \
+-    %{gdwarf-2:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
+-    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm: \
+-    %{gdwarf-2:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
+    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
+    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm|.s|.f|.f90|\
+      .f95|.f03|.f77|.for|.F|.F90|.F95|.F03: \
+    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
+ 
+ #define LINK_COMMAND_SPEC LINK_COMMAND_SPEC_A DSYMUTIL_SPEC
+ 
+@@ -469,18 +475,31 @@
+ /* Default ASM_DEBUG_SPEC.  Darwin's as cannot currently produce dwarf
+    debugging data.  */
+ 
+#ifdef HAS_AS_STABS_DIRECTIVE
+/* We only pass a debug option to the assembler if that supports stabs, since
+   dwarf is not uniformly supported in the assemblers.  */
+ #define ASM_DEBUG_SPEC  "%{g*:%{%:debug-level-gt(0):%{!gdwarf*:--gstabs}}}"
+#else
+#define ASM_DEBUG_SPEC ""
+#endif
+
+#undef  ASM_DEBUG_OPTION_SPEC
+#define ASM_DEBUG_OPTION_SPEC  ""
+
+ #define ASM_FINAL_SPEC \
+   "%{gsplit-dwarf:%ngsplit-dwarf is not supported on this platform } %<gsplit-dwarf"
+ 
+-/* We still allow output of STABS if the assembler supports it.  */
+/* We now require C++11 to bootstrap and newer tools than those based on
+   stabs, so require DWARF-2, even if stabs is supported by the assembler.  */
+
+#define PREFERRED_DEBUGGING_TYPE DWARF2_DEBUG
+#define DARWIN_PREFER_DWARF
+#define DWARF2_DEBUGGING_INFO 1
+
+ #ifdef HAVE_AS_STABS_DIRECTIVE
+ #define DBX_DEBUGGING_INFO 1
+-#define PREFERRED_DEBUGGING_TYPE DBX_DEBUG
+ #endif
+ 
+-#define DWARF2_DEBUGGING_INFO 1
+-
+ #define DEBUG_FRAME_SECTION	  "__DWARF,__debug_frame,regular,debug"
+ #define DEBUG_INFO_SECTION	  "__DWARF,__debug_info,regular,debug"
+ #define DEBUG_ABBREV_SECTION	  "__DWARF,__debug_abbrev,regular,debug"
+diff -ur a/gcc/config/darwin9.h b/gcc/config/darwin9.h
+--- a/gcc/config/darwin9.h	2021-05-14 04:42:08.000000000 -0400
+++ b/gcc/config/darwin9.h	2023-11-06 08:54:02.663945206 -0500
+@@ -18,29 +18,6 @@
+ along with GCC; see the file COPYING3.  If not see
+ <http://www.gnu.org/licenses/>.  */
+ 
+-/* Prefer DWARF2.  */
+-#undef PREFERRED_DEBUGGING_TYPE
+-#define PREFERRED_DEBUGGING_TYPE DWARF2_DEBUG
+-#define DARWIN_PREFER_DWARF
+-
+-/* Since DWARF2 is default, conditions for running dsymutil are different.  */
+-#undef DSYMUTIL_SPEC
+-#define DSYMUTIL_SPEC \
+-   "%{!fdump=*:%{!fsyntax-only:%{!c:%{!M:%{!MM:%{!E:%{!S:\
+-    %{v} \
+-    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
+-    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm|.s|.f|.f90|.f95|.f03|.f77|.for|.F|.F90|.F95|.F03: \
+-    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
+-
+-/* Tell collect2 to run dsymutil for us as necessary.  */
+-#define COLLECT_RUN_DSYMUTIL 1
+-
+-/* Only ask as for debug data if the debug style is stabs (since as doesn't
+-   yet generate dwarf.)  */
+-
+-#undef  ASM_DEBUG_SPEC
+-#define ASM_DEBUG_SPEC  "%{g*:%{%:debug-level-gt(0):%{gstabs:--gstabs}}}"
+-
+ #undef  ASM_OUTPUT_ALIGNED_COMMON
+ #define ASM_OUTPUT_ALIGNED_COMMON(FILE, NAME, SIZE, ALIGN)		\
+   do {									\
--- a/pkgs/development/compilers/gcc/patches/9/gcc9-darwin-as-gstabs.patch
+++ b/pkgs/development/compilers/gcc/patches/9/gcc9-darwin-as-gstabs.patch
@ -0,0 +1,99 @@
+Backported from https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=b2cee5e1e89c8f939bc36fe9756befcb93d96982
+
+diff -ur a/gcc/config/darwin.h b/gcc/config/darwin.h
+--- a/gcc/config/darwin.h	2022-05-27 03:21:10.947379000 -0400
+++ b/gcc/config/darwin.h	2023-11-06 12:18:27.209236423 -0500
+@@ -230,12 +230,18 @@
+ 
+ #define DSYMUTIL "\ndsymutil"
+ 
+/* Spec that controls whether the debug linker is run automatically for
+   a link step.  This needs to be done if there is a source file on the
+   command line which will result in a temporary object (and debug is
+   enabled).  */
+
+ #define DSYMUTIL_SPEC \
+    "%{!fdump=*:%{!fsyntax-only:%{!c:%{!M:%{!MM:%{!E:%{!S:\
+     %{v} \
+-    %{gdwarf-2:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
+-    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm: \
+-    %{gdwarf-2:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
+    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
+    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm|.s|.f|.f90|\
+      .f95|.f03|.f77|.for|.F|.F90|.F95|.F03: \
+    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
+ 
+ #define LINK_COMMAND_SPEC LINK_COMMAND_SPEC_A DSYMUTIL_SPEC
+ 
+@@ -463,21 +469,31 @@
+   %{Zforce_cpusubtype_ALL:-force_cpusubtype_ALL} \
+   %{static}" ASM_MMACOSX_VERSION_MIN_SPEC
+ 
+-/* Default ASM_DEBUG_SPEC.  Darwin's as cannot currently produce dwarf
+-   debugging data.  */
+-
+#ifdef HAS_AS_STABS_DIRECTIVE
+/* We only pass a debug option to the assembler if that supports stabs, since
+   dwarf is not uniformly supported in the assemblers.  */
+ #define ASM_DEBUG_SPEC  "%{g*:%{%:debug-level-gt(0):%{!gdwarf*:--gstabs}}}"
+#else
+#define ASM_DEBUG_SPEC ""
+#endif
+
+#undef  ASM_DEBUG_OPTION_SPEC
+#define ASM_DEBUG_OPTION_SPEC  ""
+
+ #define ASM_FINAL_SPEC \
+   "%{gsplit-dwarf:%ngsplit-dwarf is not supported on this platform} %<gsplit-dwarf"
+ 
+-/* We still allow output of STABS if the assembler supports it.  */
+/* We now require C++11 to bootstrap and newer tools than those based on
+   stabs, so require DWARF-2, even if stabs is supported by the assembler.  */
+
+#define PREFERRED_DEBUGGING_TYPE DWARF2_DEBUG
+#define DARWIN_PREFER_DWARF
+#define DWARF2_DEBUGGING_INFO 1
+
+ #ifdef HAVE_AS_STABS_DIRECTIVE
+ #define DBX_DEBUGGING_INFO 1
+-#define PREFERRED_DEBUGGING_TYPE DBX_DEBUG
+ #endif
+ 
+-#define DWARF2_DEBUGGING_INFO 1
+-
+ #define DEBUG_FRAME_SECTION	  "__DWARF,__debug_frame,regular,debug"
+ #define DEBUG_INFO_SECTION	  "__DWARF,__debug_info,regular,debug"
+ #define DEBUG_ABBREV_SECTION	  "__DWARF,__debug_abbrev,regular,debug"
+diff -ur a/gcc/config/darwin9.h b/gcc/config/darwin9.h
+--- a/gcc/config/darwin9.h	2022-05-27 03:21:10.947379000 -0400
+++ b/gcc/config/darwin9.h	2023-11-06 12:18:48.325260590 -0500
+@@ -18,29 +18,6 @@
+ along with GCC; see the file COPYING3.  If not see
+ <http://www.gnu.org/licenses/>.  */
+ 
+-/* Prefer DWARF2.  */
+-#undef PREFERRED_DEBUGGING_TYPE
+-#define PREFERRED_DEBUGGING_TYPE DWARF2_DEBUG
+-#define DARWIN_PREFER_DWARF
+-
+-/* Since DWARF2 is default, conditions for running dsymutil are different.  */
+-#undef DSYMUTIL_SPEC
+-#define DSYMUTIL_SPEC \
+-   "%{!fdump=*:%{!fsyntax-only:%{!c:%{!M:%{!MM:%{!E:%{!S:\
+-    %{v} \
+-    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
+-    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm|.s|.f|.f90|.f95|.f03|.f77|.for|.F|.F90|.F95|.F03: \
+-    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
+-
+-/* Tell collect2 to run dsymutil for us as necessary.  */
+-#define COLLECT_RUN_DSYMUTIL 1
+-
+-/* Only ask as for debug data if the debug style is stabs (since as doesn't
+-   yet generate dwarf.)  */
+-
+-#undef  ASM_DEBUG_SPEC
+-#define ASM_DEBUG_SPEC  "%{g*:%{%:debug-level-gt(0):%{gstabs:--gstabs}}}"
+-
+ #undef  ASM_OUTPUT_ALIGNED_COMMON
+ #define ASM_OUTPUT_ALIGNED_COMMON(FILE, NAME, SIZE, ALIGN)		\
+   do {									\
--- a/pkgs/development/compilers/gcc/patches/clang-genconditions.patch
+++ b/pkgs/development/compilers/gcc/patches/clang-genconditions.patch
@ -0,0 +1,34 @@
+From https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92061#c5
+
+--- a/gcc/genconditions.c	2019-01-01 12:37:19.064943662 +0100
+++ b/gcc/genconditions.c	2019-10-11 10:57:11.464595789 +0200
+@@ -57,8 +57,9 @@ write_header (void)
+ \n\
+ /* It is necessary, but not entirely safe, to include the headers below\n\
+    in a generator program.  As a defensive measure, don't do so when the\n\
+-   table isn't going to have anything in it.  */\n\
+-#if GCC_VERSION >= 3001\n\
+   table isn't going to have anything in it.\n\
+   Clang 9 is buggy and doesn't handle __builtin_constant_p correctly.  */\n\
+#if GCC_VERSION >= 3001 && __clang_major__ < 9\n\
+ \n\
+ /* Do not allow checking to confuse the issue.  */\n\
+ #undef CHECKING_P\n\
+@@ -170,7 +171,7 @@ struct c_test\n\
+    vary at run time.  It works in 3.0.1 and later; 3.0 only when not\n\
+    optimizing.  */\n\
+ \n\
+-#if GCC_VERSION >= 3001\n\
+#if GCC_VERSION >= 3001 && __clang_major__ < 9\n\
+ static const struct c_test insn_conditions[] = {\n");
+ 
+   traverse_c_tests (write_one_condition, 0);
+@@ -191,7 +192,7 @@ write_writer (void)
+ 	"  unsigned int i;\n"
+         "  const char *p;\n"
+         "  puts (\"(define_conditions [\");\n"
+-	"#if GCC_VERSION >= 3001\n"
+	"#if GCC_VERSION >= 3001 && __clang_major__ < 9\n"
+ 	"  for (i = 0; i < ARRAY_SIZE (insn_conditions); i++)\n"
+ 	"    {\n"
+ 	"      printf (\"  (%d \\\"\", insn_conditions[i].value);\n"
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@ -178,6 +178,9 @@ in
 # https://github.com/osx-cross/homebrew-avr/issues/280#issuecomment-1272381808
 ++ optional (is11 && stdenv.isDarwin && targetPlatform.isAvr) ./avr-gcc-11.3-darwin.patch

+# libgcc’s `configure` script misdetects aarch64-darwin, resulting in an invalid deployment target.
++ optional (is11 && stdenv.isDarwin && stdenv.isAarch64) ./11/libgcc-aarch64-darwin-detection.patch
+
 # openjdk build fails without this on -march=opteron; is upstream in gcc12
 ++ optionals (is11) [ ./11/gcc-issue-103910.patch ]

@ -191,12 +194,19 @@ in
  sha256 = "sha256-XtykrPd5h/tsnjY1wGjzSOJ+AyyNLsfnjuOZ5Ryq9vA=";
 })

+# Fix undefined symbol errors when building older versions with clang
++ optional (!atLeast11 && stdenv.cc.isClang && stdenv.hostPlatform.isDarwin) ./clang-genconditions.patch
+

 ## gcc 9.0 and older ##############################################################################

 ++ optional (majorVersion == "9") ./9/fix-struct-redefinition-on-glibc-2.36.patch
 ++ optional (atLeast7 && !atLeast10 && targetPlatform.isNetBSD) ./libstdc++-netbsd-ctypes.patch

+# Make Darwin bootstrap respect whether the assembler supports `--gstabs`,
+# which is not supported by the clang integrated assembler used by default on Darwin.
++ optional (is9 && hostPlatform.isDarwin) ./9/gcc9-darwin-as-gstabs.patch
+

 ## gcc 8.0 and older ##############################################################################

@ -204,6 +214,10 @@ in
 ++ optional (atLeast49 && !is49 && !atLeast9) ./libsanitizer-no-cyclades-9.patch
 ++ optional (is7 || is8) ./9/fix-struct-redefinition-on-glibc-2.36.patch

+# Make Darwin bootstrap respect whether the assembler supports `--gstabs`,
+# which is not supported by the clang integrated assembler used by default on Darwin.
++ optional (is8 && hostPlatform.isDarwin) ./8/gcc8-darwin-as-gstabs.patch
+

 ## gcc 7.0 and older ##############################################################################

@ -240,6 +254,12 @@ in
  ./6/gnat-glibc234.patch
 ]

+# The clang-based assembler used in darwin.cctools-llvm (LLVM >11) does not support piping input.
+# Fortunately, it does not exhibit the problem GCC has with the cctools assembler.
+# This patch can be dropped should darwin.cctools-llvm ever implement support.
++ optional (!atLeast7 && hostPlatform.isDarwin && lib.versionAtLeast (lib.getVersion stdenv.cc) "12") ./4.9/darwin-clang-as.patch
+
+
 ## gcc 4.9 and older ##############################################################################

 ++ optional (!atLeast6) ./parallel-bconfig.patch
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "go";
-  version = "1.20.10";
+  version = "1.20.11";

  src = fetchurl {
    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-ctL1GAXEcVAGbBA3VMdf3bLBnUjJIZ+jPR5GaWyEHbs=";
+    hash = "sha256-01XFrjqPd2PJ7J3CUVOq43OVjLy2DdCekai1bHYhsvw=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/odin/default.nix
+++ b/pkgs/development/compilers/odin/default.nix
@ -12,13 +12,13 @@ let
  inherit (llvmPackages) stdenv;
 in stdenv.mkDerivation rec {
  pname = "odin";
-  version = "dev-2023-08";
+  version = "dev-2023-11";

  src = fetchFromGitHub {
    owner = "odin-lang";
    repo = "Odin";
    rev = version;
-    hash = "sha256-pmgrauhB5/JWBkwrAm7tCml9IYQhXyGXsNVDKTntA0M=";
+    hash = "sha256-5plcr+j9aFSaLfLQXbG4WD1GH6rE7D3uhlUbPaDEYf8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@ -33,10 +33,12 @@ let
    , jq

    , version
-    , hash
+    , phpSrc ? null
+    , hash ? null
    , extraPatches ? [ ]
    , packageOverrides ? (final: prev: { })
    , phpAttrsOverrides ? (attrs: { })
+    , pearInstallPhar ? (callPackage ./install-pear-nozlib-phar.nix { })

      # Sapi flags
    , cgiSupport ? true
@ -192,6 +194,11 @@ let

      mkWithExtensions = prevArgs: prevExtensionFunctions: extensions:
        mkBuildEnv prevArgs prevExtensionFunctions { inherit extensions; };
+
+      defaultPhpSrc = fetchurl {
+        url = "https://www.php.net/distributions/php-${version}.tar.bz2";
+        inherit hash;
+      };
    in
    stdenv.mkDerivation (
      let
@ -278,6 +285,15 @@ let
              substituteInPlace configure --replace "-lstdc++" "-lc++"
            '';

+          # When compiling PHP sources from Github, this file is missing and we
+          # need to install it ourselves.
+          # On the other hand, a distribution includes this file by default.
+          preInstall = ''
+            if [[ ! -f ./pear/install-pear-nozlib.phar ]]; then
+              cp ${pearInstallPhar} ./pear/install-pear-nozlib.phar
+            fi
+          '';
+
          postInstall = ''
            test -d $out/etc || mkdir $out/etc
            cp php.ini-production $out/etc/php.ini
@ -291,10 +307,7 @@ let
               $dev/share/man/man1/
          '';

-          src = fetchurl {
-            url = "https://www.php.net/distributions/php-${version}.tar.bz2";
-            inherit hash;
-          };
+          src = if phpSrc == null then defaultPhpSrc else phpSrc;

          patches = [ ./fix-paths-php7.patch ] ++ extraPatches;

--- a/pkgs/development/interpreters/php/install-pear-nozlib-phar.nix
+++ b/pkgs/development/interpreters/php/install-pear-nozlib-phar.nix
@ -0,0 +1,8 @@
+{
+  fetchurl
+}:
+
+fetchurl {
+  url = "https://pear.php.net/install-pear-nozlib.phar";
+  hash = "sha256-UblKVcsm030tNSA6mdeab+h7ZhANNz7MkFf4Z1iigjs=";
+}
--- a/pkgs/development/libraries/gtk4-layer-shell/default.nix
+++ b/pkgs/development/libraries/gtk4-layer-shell/default.nix
@ -16,7 +16,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gtk4-layer-shell";
-  version = "1.0.1";
+  version = "1.0.2";

  outputs = [ "out" "dev" "devdoc" ];
  outputBin = "devdoc";
@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "wmww";
    repo = "gtk4-layer-shell";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-MG/YW4AhC2joUX93Y/pzV4s8TrCo5Z/I3hAT70jW8dw=";
+    hash = "sha256-decjPkFkYy7kIjyozsB7BEmw33wzq1EQyIBrxO36984=";
  };

  strictDeps = true;
--- a/pkgs/development/libraries/libsolv/default.nix
+++ b/pkgs/development/libraries/libsolv/default.nix
@ -16,14 +16,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "0.7.25";
+  version = "0.7.26";
  pname = "libsolv";

  src = fetchFromGitHub {
    owner = "openSUSE";
    repo = "libsolv";
    rev = version;
-    sha256 = "sha256-OSYfv8dTyoa2f1T/zCEruKczickP5jS05xjYLQQiFaY=";
+    sha256 = "sha256-NGybpl/Fd46pmSYMNGocStQQCXr5pX34PCmN/hFKeyk=";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/neatvnc/default.nix
+++ b/pkgs/development/libraries/neatvnc/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "neatvnc";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "any1";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-R+PvD7E/z+Gc7h2y0pUYaCkzfgpxzwToOr4pKSrOnxU=";
+    sha256 = "sha256-bRlz5RW+NUSTgzjRM9alZjSrzmF8/7p4IIXqK/HEcJo=";
  };

  strictDeps = true;
--- a/pkgs/development/libraries/science/math/cudnn/generic.nix
+++ b/pkgs/development/libraries/science/math/cudnn/generic.nix
@ -153,8 +153,14 @@ in
      description = "NVIDIA CUDA Deep Neural Network library (cuDNN)";
      homepage = "https://developer.nvidia.com/cudnn";
      sourceProvenance = with sourceTypes; [binaryNativeCode];
-      # TODO: consider marking unfreRedistributable when not using runfile
-      license = licenses.unfree;
+      license = {
+        shortName = "cuDNN EULA";
+        fullName = "NVIDIA cuDNN Software License Agreement (EULA)";
+        url = "https://docs.nvidia.com/deeplearning/sdk/cudnn-sla/index.html#supplement";
+        free = false;
+      } // lib.optionalAttrs (!useCudatoolkitRunfile) {
+        redistributable = true;
+      };
      platforms = ["x86_64-linux"];
      maintainers = with maintainers; [mdaiter samuela];
      # Force the use of the default, fat output by default (even though `dev` exists, which
--- a/pkgs/development/php-packages/memprof/default.nix
+++ b/pkgs/development/php-packages/memprof/default.nix
@ -0,0 +1,33 @@
+{ buildPecl
+, lib
+, fetchFromGitHub
+, judy
+}:
+
+let
+  version = "3.0.2";
+in buildPecl {
+  inherit version;
+  pname = "memprof";
+
+  src = fetchFromGitHub {
+    owner = "arnaud-lb";
+    repo = "php-memory-profiler";
+    rev = version;
+    hash = "sha256-K8YcvCobErBkaWFTkVGLXXguQPOLIgQuRGWJF+HAIRA=";
+  };
+
+  configureFlags = [
+    "--with-judy-dir=${judy}"
+  ];
+
+  doCheck = true;
+
+  meta = {
+    changelog = "https://github.com/arnaud-lb/php-memory-profiler/releases/tag/${version}";
+    description = "Memory profiler for PHP. Helps finding memory leaks in PHP scripts";
+    homepage = "https://github.com/arnaud-lb/php-memory-profiler";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ gaelreyrol ];
+  };
+}
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.75";
+  version = "9.2.76";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-k3CX0ntqbKBL9xLTPifwjTqwYEDLlNdEHlIPiokkkPA=";
+    hash = "sha256-RIYGWPvQ2n+NgZHw2pGEvgWAtbpb/rdyb6/K4JClRxM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.75";
+  version = "9.2.76";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "angr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-tDOO0wn5gYxK1CuMWhu/i4Xk3CfcuhPvxsG0LI7BlA4=";
+    hash = "sha256-B3oYh0okbIeEvBjBHvY29QTqPyR2TTzLmz6fMsIRcs0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.75";
+  version = "9.2.76";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-t8kxGwLEVVp1WMFA+yFLMAPJBT46m0ZFG2lhWMxoolw=";
+    hash = "sha256-g1qlcaSByXhF+6ffxwbV/0tXFdmLySH3TcDuok4y6xw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , pythonOlder
-, fetchPypi
+, fetchFromGitHub
 , hatch-fancy-pypi-readme
 , hatchling
 , awkward-cpp
@ -23,14 +23,16 @@

 buildPythonPackage rec {
  pname = "awkward";
-  version = "2.4.6";
+  version = "2.4.9";
  pyproject = true;

  disabled = pythonOlder "3.8";

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-MRnrPChX3a26JELh4oH5nefwoQurpvpprZXeNnz1Cwo=";
+  src = fetchFromGitHub {
+    owner = "scikit-hep";
+    repo = "awkward";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-8MllMKf/xp5SdtF9P1Sa6Ytml4nQ5OX7vs7ITU8mCRU=";
  };

  nativeBuildInputs = [
@ -69,7 +71,6 @@ buildPythonPackage rec {
  # The following tests have been disabled because they need to be run on a GPU platform.
  disabledTestPaths = [
    "tests-cuda"
-    "tests-cuda-kernels"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/bork/default.nix
+++ b/pkgs/development/python-modules/bork/default.nix
@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+, build
+, coloredlogs
+, packaging
+, toml
+, twine
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "bork";
+  version = "7.0.0";
+  pyproject = true;
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "duckinator";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-frwkU2YesYK0RJNz9yqiXj1XeTZ8jg5oClri4hEYokg=";
+  };
+
+  propagatedBuildInputs = [
+    build
+    coloredlogs
+    packaging
+    toml
+    twine
+    wheel
+  ];
+
+  pythonImportsCheck = [
+    "bork"
+    "bork.api"
+    "bork.cli"
+  ];
+
+  meta = with lib; {
+    description = "Python build and release management tool";
+    homepage = "https://github.com/duckinator/bork";
+    maintainers = with maintainers; [ nicoo ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.75";
+  version = "9.2.76";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "claripy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ErPk93hDKV1QyGOjxYNaLzNuq6Od374G8qOxWiJwpuo=";
+    hash = "sha256-BwhM5J+20ZvP0d+9TAqy0AgRuPU6XoLKgM88WJdf3Qg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -16,14 +16,14 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.75";
+  version = "9.2.76";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
    owner = "angr";
    repo = "binaries";
    rev = "refs/tags/v${version}";
-    hash = "sha256-xiYkXC3/JPgXJ23ISl0LVrdm368hDPCG5NqQM6lDXf4=";
+    hash = "sha256-01Y4UKTkaO6bYtVTvv4KFzkEdj4qKiWKaC80/iKa/Eg=";
  };

 in
@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "cle";
    rev = "refs/tags/v${version}";
-    hash = "sha256-F2kgEffFWK7i1BgU5ulsNJitGcGcEziYRU+y86wKgXU=";
+    hash = "sha256-uMT9LvDkXl3SueR80pgGJRkWbymDRmGEn8HV93K/VNc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/dalle-mini/default.nix
+++ b/pkgs/development/python-modules/dalle-mini/default.nix
@ -49,5 +49,7 @@ buildPythonPackage rec {
    homepage = "https://github.com/borisdayma/dalle-mini";
    license = licenses.asl20;
    maintainers = with maintainers; [ r-burns ];
+    # incompatible with recent versions of JAX
+    broken = true;
  };
 }
--- a/pkgs/development/python-modules/dash/default.nix
+++ b/pkgs/development/python-modules/dash/default.nix
@ -1,27 +1,43 @@
 { lib
 , buildPythonPackage
-, celery
-, dash-core-components
-, dash-html-components
-, dash-table
-, diskcache
-, fetchFromGitHub
-, flask
-, flask-compress
-, mock
-, multiprocess
-, plotly
-, psutil
-, pytest-mock
-, pytestCheckHook
 , pythonOlder
-, pyyaml
+, fetchFromGitHub
+
+, nodejs
+, yarn
+, fixup_yarn_lock
+, fetchYarnDeps
+
+, setuptools
+, flask
+, werkzeug
+, plotly
+, dash-html-components
+, dash-core-components
+, dash-table
+, importlib-metadata
+, typing-extensions
+, requests
+, retrying
+, ansi2html
+, nest-asyncio
+
+, celery
 , redis
+, diskcache
+, multiprocess
+, psutil
+, flask-compress
+
+, pytestCheckHook
+, pytest-mock
+, mock
+, pyyaml
 }:

 buildPythonPackage rec {
  pname = "dash";
-  version = "2.13.0";
+  version = "2.14.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -30,16 +46,52 @@ buildPythonPackage rec {
    owner = "plotly";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-+pTxEPuXtcu+ZekphqXD/k2tQ5werH/1ueGJOxA8pZw=";
+    hash = "sha256-vQOfX9RCIbr5lfUyT2knwrO374/vm7jH+/1+BeqmRjI=";
  };

+  nativeBuildInputs = [
+    nodejs
+    yarn
+    fixup_yarn_lock
+  ];
+
+  yarnDeps = fetchYarnDeps {
+    yarnLock = src + "/@plotly/dash-jupyterlab/yarn.lock";
+    hash = "sha256-mkiyrA0jGiP0zbabSjgHFLEUX3f+LZdJ8eARI5QA8CU=";
+  };
+
+  preBuild = ''
+    pushd @plotly/dash-jupyterlab
+
+    export HOME=$(mktemp -d)
+
+    yarn config --offline set yarn-offline-mirror ${yarnDeps}
+    fixup_yarn_lock yarn.lock
+
+    substituteInPlace package.json --replace jlpm yarn
+    yarn install --offline --frozen-lockfile --ignore-engines --ignore-scripts
+    patchShebangs .
+
+    # Generates the jupyterlab extension files
+    yarn run build:pack
+
+    popd
+  '';
+
  propagatedBuildInputs = [
-    dash-core-components
-    dash-html-components
-    dash-table
+    setuptools # for importing pkg_resources
    flask
-    flask-compress
+    werkzeug
    plotly
+    dash-html-components
+    dash-core-components
+    dash-table
+    importlib-metadata
+    typing-extensions
+    requests
+    retrying
+    ansi2html
+    nest-asyncio
  ];

  passthru.optional-dependencies = {
@ -52,35 +104,31 @@ buildPythonPackage rec {
      multiprocess
      psutil
    ];
+    compress = [
+      flask-compress
+    ];
  };

  nativeCheckInputs = [
-    mock
-    pytest-mock
    pytestCheckHook
+    pytest-mock
+    mock
    pyyaml
  ];

  disabledTestPaths = [
    "tests/unit/test_browser.py"
-    "tests/unit/test_app_runners.py" # Use selenium
+    "tests/unit/test_app_runners.py" # Uses selenium
    "tests/integration"
  ];

-  disabledTests = [
-    # Failed: DID NOT RAISE <class 'ImportError'>
-    "test_missing_flask_compress_raises"
-  ];
+  pythonImportsCheck = [ "dash" ];

-  pythonImportsCheck = [
-    "dash"
-  ];
-
-  meta = with lib; {
+  meta = {
    description = "Python framework for building analytical web applications";
    homepage = "https://dash.plot.ly/";
-    changelog = "https://github.com/plotly/dash/blob/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ antoinerg ];
+    changelog = "https://github.com/plotly/dash/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ antoinerg tomasajt ];
  };
 }
--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "dask-awkward";
-  version = "2023.10.1";
+  version = "2023.11.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "dask-contrib";
    repo = "dask-awkward";
    rev = "refs/tags/${version}";
-    hash = "sha256-ov5vE9O+dq0ByfSMluQl7NN0vZAcvvBX27iwoYSruSs=";
+    hash = "sha256-oOIXqKwKjF6wCgRNRJ2EZn4F7sMqUKDSNQuGUpvL7sA=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@ -38,7 +38,7 @@

 buildPythonPackage rec {
  pname = "dask";
-  version = "2023.10.0";
+  version = "2023.10.1";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -47,7 +47,7 @@ buildPythonPackage rec {
    owner = "dask";
    repo = "dask";
    rev = "refs/tags/${version}";
-    hash = "sha256-u7KuZT0uH833zqLNBfqRLU7EcMrUmXgszevYA3Z7G1Y=";
+    hash = "sha256-asD5oLd7XcZ8ZFSrsSCAKgZ3Gsqs6T77nb1qesamgUI=";
  };

  nativeBuildInputs = [
@ -114,7 +114,7 @@ buildPythonPackage rec {
      --replace "cmdclass=versioneer.get_cmdclass()," ""

    substituteInPlace pyproject.toml \
-      --replace ', "versioneer[toml]==0.28"' "" \
+      --replace ', "versioneer[toml]==0.29"' "" \
      --replace " --durations=10" "" \
      --replace " --cov-config=pyproject.toml" "" \
      --replace "\"-v" "\" "
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "dbus-fast";
-  version = "2.12.0";
+  version = "2.13.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-ZeDQn+/b6WBCodZ7Ow5IlC9XlWieAifCMJtM1yse5P8=";
+    hash = "sha256-ay/NaJ/u/XG9XQ7C2dzmJKs/j1s/vDHUnaE/qDhho9Q=";
  };

  # The project can build both an optimized cython version and an unoptimized
--- a/pkgs/development/python-modules/dinghy/default.nix
+++ b/pkgs/development/python-modules/dinghy/default.nix
@ -5,17 +5,21 @@
 , pythonOlder
 , aiofiles
 , aiohttp
+, backports-datetime-fromisoformat
+, click
 , click-log
 , emoji
 , glom
 , jinja2
 , pyyaml
+, freezegun
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "dinghy";
-  version = "1.3.0";
-  format = "setuptools";
+  version = "1.3.2";
+  pyproject = true;

  disabled = pythonOlder "3.8";

@ -23,12 +27,18 @@ buildPythonPackage rec {
    owner = "nedbat";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-a1CHbPSoiR3JbuAXYPJc1EsSq13DbrOttk9zLFF9+cM=";
+    hash = "sha256-0U08QHQuNm7qaxhU8sNxeN0fZ4S8N0RYRsWjFUqhZSU=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    aiofiles
    aiohttp
+    backports-datetime-fromisoformat
+    click
    click-log
    emoji
    glom
@ -37,6 +47,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    freezegun
    pytestCheckHook
  ];

--- a/pkgs/development/python-modules/ducc0/default.nix
+++ b/pkgs/development/python-modules/ducc0/default.nix
@ -2,16 +2,16 @@

 buildPythonPackage rec {
  pname = "ducc0";
-  version = "0.31.0";
+  version = "0.32.0";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitLab {
    domain = "gitlab.mpcdf.mpg.de";
    owner = "mtr";
    repo = "ducc";
    rev = "ducc0_${lib.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-4aNIq5RNo1Qqiqr2wjYB/FXKyvbARsRF1yW1ZzZlAOo=";
+    hash = "sha256-D+Gt5RrzljZQHBijaPuCuNsK08VxxJoWhqxSDu4bjH0=";
  };

  buildInputs = [ pybind11 ];
--- a/pkgs/development/python-modules/farm-haystack/default.nix
+++ b/pkgs/development/python-modules/farm-haystack/default.nix
@ -0,0 +1,290 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonRelaxDepsHook
+, hatchling
+, boilerpy3
+, events
+, httpx
+, jsonschema
+, lazy-imports
+, more-itertools
+, networkx
+, pandas
+, pillow
+, platformdirs
+, posthog
+, prompthub-py
+, pydantic
+, quantulum3
+, rank-bm25
+, requests
+, requests-cache
+, scikit-learn
+, sseclient-py
+, tenacity
+, tiktoken
+, tqdm
+, transformers
+, openai-whisper
+, boto3
+, botocore
+# , beir
+, selenium
+, coverage
+, dulwich
+# , jupytercontrib
+, mkdocs
+, mypy
+, pre-commit
+, psutil
+# , pydoc-markdown
+, pylint
+, pytest
+, pytest-asyncio
+, pytest-cov
+# , pytest-custom-exit-code
+, python-multipart
+, reno
+, responses
+, toml
+, tox
+, watchdog
+, elastic-transport
+, elasticsearch
+# , azure-ai-formrecognizer
+, beautifulsoup4
+, markdown
+, python-docx
+, python-frontmatter
+, python-magic
+, tika
+, black
+, huggingface-hub
+, sentence-transformers
+, mlflow
+, rapidfuzz
+, scipy
+, seqeval
+, pdf2image
+, pytesseract
+, faiss
+# , faiss-gpu
+, pinecone-client
+, onnxruntime
+, onnxruntime-tools
+# , onnxruntime-gpu
+, opensearch-py
+, pymupdf
+, langdetect
+, nltk
+, canals
+, jinja2
+, openai
+, aiorwlock
+, ray
+, psycopg2
+, sqlalchemy
+, sqlalchemy-utils
+, weaviate-client
+}:
+
+buildPythonPackage rec {
+  pname = "farm-haystack";
+  version = "1.21.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "deepset-ai";
+    repo = "haystack";
+    rev = "v${version}";
+    hash = "sha256-h+8F1e6fFoxT4Cu0DxtXTyDd+OFXpX1+uk21/k9qcxw=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+    pythonRelaxDepsHook
+  ];
+
+  pythonRemoveDeps = [
+    # We call it faiss, not faiss-cpu.
+    "faiss-cpu"
+  ];
+
+  propagatedBuildInputs = [
+    boilerpy3
+    events
+    httpx
+    jsonschema
+    lazy-imports
+    more-itertools
+    networkx
+    pandas
+    pillow
+    platformdirs
+    posthog
+    prompthub-py
+    pydantic
+    quantulum3
+    rank-bm25
+    requests
+    requests-cache
+    scikit-learn
+    sseclient-py
+    tenacity
+    tiktoken
+    tqdm
+    transformers
+  ];
+
+  env.HOME = "$(mktemp -d)";
+
+  passthru.optional-dependencies = {
+    # all = [
+    #   farm-haystack
+    # ];
+    # all-gpu = [
+    #   farm-haystack
+    # ];
+    audio = [
+      openai-whisper
+    ];
+    aws = [
+      boto3
+      botocore
+    ];
+    # beir = [
+    #   beir
+    # ];
+    colab = [
+      pillow
+    ];
+    crawler = [
+      selenium
+    ];
+    dev = [
+      coverage
+      dulwich
+      # jupytercontrib
+      mkdocs
+      mypy
+      pre-commit
+      psutil
+      # pydoc-markdown
+      pylint
+      pytest
+      pytest-asyncio
+      pytest-cov
+      # pytest-custom-exit-code
+      python-multipart
+      reno
+      responses
+      toml
+      tox
+      watchdog
+    ];
+    elasticsearch7 = [
+      elastic-transport
+      elasticsearch
+    ];
+    elasticsearch8 = [
+      elastic-transport
+      elasticsearch
+    ];
+    file-conversion = [
+      # azure-ai-formrecognizer
+      beautifulsoup4
+      markdown
+      python-docx
+      python-frontmatter
+      python-magic
+      # python-magic-bin
+      tika
+    ];
+    formatting = [
+      black
+    ];
+    inference = [
+      huggingface-hub
+      sentence-transformers
+      transformers
+    ];
+    metrics = [
+      mlflow
+      rapidfuzz
+      scipy
+      seqeval
+    ];
+    ocr = [
+      pdf2image
+      pytesseract
+    ];
+    only-faiss = [
+      faiss
+    ];
+    # only-faiss-gpu = [
+    #   faiss-gpu
+    # ];
+    only-pinecone = [
+      pinecone-client
+    ];
+    onnx = [
+      onnxruntime
+      onnxruntime-tools
+    ];
+    # onnx-gpu = [
+    #   onnxruntime-gpu
+    #   onnxruntime-tools
+    # ];
+    opensearch = [
+      opensearch-py
+    ];
+    pdf = [
+      pymupdf
+    ];
+    preprocessing = [
+      langdetect
+      nltk
+    ];
+    preview = [
+      canals
+      jinja2
+      lazy-imports
+      openai
+      pandas
+      rank-bm25
+      requests
+      tenacity
+      tqdm
+    ];
+    ray = [
+      aiorwlock
+      ray
+    ];
+    sql = [
+      psycopg2
+      sqlalchemy
+      sqlalchemy-utils
+    ];
+    weaviate = [
+      weaviate-client
+    ];
+  };
+
+  # the setup for test is intensive, hopefully can be done at some point
+  doCheck = false;
+
+
+  pythonImportsCheck = [ "haystack" ];
+
+  meta = with lib; {
+    description = "LLM orchestration framework to build customizable, production-ready LLM applications";
+    longDescription = ''
+    LLM orchestration framework to build customizable, production-ready LLM applications. Connect components (models, vector DBs, file converters) to pipelines or agents that can interact with your data. With advanced retrieval methods, it's best suited for building RAG, question answering, semantic search or conversational agent chatbots
+    '';
+    changelog = "https://github.com/deepset-ai/haystack/releases/tag/${src.rev}";
+    homepage = "https://github.com/deepset-ai/haystack";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ happysalada ];
+  };
+}
--- a/pkgs/development/python-modules/flax/default.nix
+++ b/pkgs/development/python-modules/flax/default.nix
@ -1,53 +1,66 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , fetchFromGitHub
 , jaxlib
+, pythonRelaxDepsHook
+, setuptools-scm
 , jax
-, keras
-, lib
-, matplotlib
 , msgpack
 , numpy
 , optax
+, pyyaml
+, rich
+, tensorstore
+, typing-extensions
+, matplotlib
+, cloudpickle
+, einops
+, keras
 , pytest-xdist
 , pytestCheckHook
-, pythonRelaxDepsHook
 , tensorflow
-, tensorstore
-, fetchpatch
-, rich
 }:

 buildPythonPackage rec {
  pname = "flax";
-  version = "0.7.4";
+  version = "0.7.5";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "google";
-    repo = pname;
+    repo = "flax";
    rev = "refs/tags/v${version}";
-    hash = "sha256-i48omag/1Si3mCCGfsUD9qeejyeCLWzvvwKJqH8vm8k=";
+    hash = "sha256-NDah0ayQbiO1/sTU1DDf/crPq5oLTnSuosV7cFHlTM8=";
  };

-  nativeBuildInputs = [ jaxlib pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    jaxlib
+    pythonRelaxDepsHook
+    setuptools-scm
+  ];

  propagatedBuildInputs = [
    jax
-    matplotlib
    msgpack
    numpy
    optax
+    pyyaml
    rich
    tensorstore
+    typing-extensions
  ];

-  # See https://github.com/google/flax/pull/2882.
-  pythonRemoveDeps = [ "orbax" ];
+  passthru.optional-dependencies = {
+    all = [ matplotlib ];
+  };

  pythonImportsCheck = [
    "flax"
  ];

  nativeCheckInputs = [
+    cloudpickle
+    einops
    keras
    pytest-xdist
    pytestCheckHook
@ -78,22 +91,6 @@ buildPythonPackage rec {
    "tests/checkpoints_test.py"
  ];

-  disabledTests = [
-    # See https://github.com/google/flax/issues/2554.
-    "test_async_save_checkpoints"
-    "test_jax_array0"
-    "test_jax_array1"
-    "test_keep0"
-    "test_keep1"
-    "test_optimized_lstm_cell_matches_regular"
-    "test_overwrite_checkpoints"
-    "test_save_restore_checkpoints_target_empty"
-    "test_save_restore_checkpoints_target_none"
-    "test_save_restore_checkpoints_target_singular"
-    "test_save_restore_checkpoints_w_float_steps"
-    "test_save_restore_checkpoints"
-  ];
-
  meta = with lib; {
    description = "Neural network library for JAX";
    homepage = "https://github.com/google/flax";
--- a/pkgs/development/python-modules/folium/default.nix
+++ b/pkgs/development/python-modules/folium/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "folium";
-  version = "0.14.0";
+  version = "0.15.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "python-visualization";
    repo = "folium";
    rev = "refs/tags/v${version}";
-    hash = "sha256-zxLFj5AeTVAxE0En7ZlbBdJEm3WrcPv23MgOhyfNi14=";
+    hash = "sha256-xaz9oelkyS8lWECCmKs8P3mHB3Usv0KMUoh/K7rBnAs=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/formencode/default.nix
+++ b/pkgs/development/python-modules/formencode/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "formencode";
-  version = "2.0.1";
+  version = "2.1.0";

  disabled = isPy27;

  src = fetchPypi {
    pname = "FormEncode";
    inherit version;
-    sha256 = "8f2974112c2557839d5bae8b76490104c03830785d923abbdef148bf3f710035";
+    sha256 = "sha256-63TSIweKKM8BX6iJZsbjTy0Y11EnMY1lwUS+2a/EJj8=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/insightface/default.nix
+++ b/pkgs/development/python-modules/insightface/default.nix
@ -69,9 +69,6 @@ buildPythonPackage rec {
  doCheck = false; # Upstream has no tests

  meta = with lib; {
-    # Both protobuf3 and protobuf4 in the build closure.
-    # related: https://github.com/onnx/onnx/issues/5563
-    broken = true;
    description = "State-of-the-art 2D and 3D Face Analysis Project";
    homepage = "https://github.com/deepinsight/insightface";
    license = licenses.mit;
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "mypy-boto3-builder";
-  version = "7.19.0";
+  version = "7.19.1";
  format = "pyproject";

  disabled = pythonOlder "3.10";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "youtype";
    repo = "mypy_boto3_builder";
    rev = "refs/tags/${version}";
-    hash = "sha256-Wczk1DNoOpvd7efnZFUf4FSjYqHdkMKMNwNVeQOPeEg=";
+    hash = "sha256-Gz6OJ2ER60R14aTmhPfodX22FlbicUClBtlqNglTjC4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/nilearn/default.nix
+++ b/pkgs/development/python-modules/nilearn/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "nilearn";
-  version = "0.10.1";
+  version = "0.10.2";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-koo2Tn7XfRXQK38icZfqfHj0Ty/ngP61VdbXz5Iy+EY=";
+    hash = "sha256-A+9Npy0a6HsuPyi3cdx+BUZKoXliblfDAFlWJahlQnM=";
  };

  nativeBuildInputs = [ hatch-vcs ];
--- a/pkgs/development/python-modules/nvidia-ml-py/default.nix
+++ b/pkgs/development/python-modules/nvidia-ml-py/default.nix
@ -5,13 +5,13 @@

 buildPythonPackage rec {
  pname = "nvidia-ml-py";
-  version = "12.535.108";
+  version = "12.535.133";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
    extension = "tar.gz";
-    hash = "sha256-FB/oGHcaFl+5P3Xb5/Afdnw7r6fBP2h29TWDURsHjuE=";
+    hash = "sha256-sVWa8NV90glVv1jQWv/3sWbd1ElH6zBRyZBWOHmesdw=";
  };

  patches = [
--- a/pkgs/development/python-modules/optimum/default.nix
+++ b/pkgs/development/python-modules/optimum/default.nix
@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "optimum";
-  version = "1.13.3";
+  version = "1.14.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -31,7 +31,7 @@ buildPythonPackage rec {
    owner = "huggingface";
    repo = "optimum";
    rev = "refs/tags/v${version}";
-    hash = "sha256-4bKQcltUr7q8wHfiRXQcK5dw0TrnMr9/bTNXeOyg7oA=";
+    hash = "sha256-fCLMDbWfEAG7pTFKWv67fpr6lNTxRTCBkppgDZR51eY=";
  };

  propagatedBuildInputs = [
--- a/Show more
+++ b/Show more