Merge master into haskell-updates

2023-02-22 00:13:06 +00:00 · 2023-02-22 00:13:06 +00:00 · f454e596de
commit f454e596de
parent 5fce642ce6 8260d35eb9
200 changed files with 11405 additions and 8619 deletions
--- a/lib/options.nix
+++ b/lib/options.nix
@ -337,19 +337,17 @@ rec {

  # Helper functions.

-  /* Convert an option, described as a list of the option parts in to a
-     safe, human readable version.
+  /* Convert an option, described as a list of the option parts to a
+     human-readable version.

     Example:
       (showOption ["foo" "bar" "baz"]) == "foo.bar.baz"
-       (showOption ["foo" "bar.baz" "tux"]) == "foo.bar.baz.tux"
+       (showOption ["foo" "bar.baz" "tux"]) == "foo.\"bar.baz\".tux"
+       (showOption ["windowManager" "2bwm" "enable"]) == "windowManager.\"2bwm\".enable"

     Placeholders will not be quoted as they are not actual values:
       (showOption ["foo" "*" "bar"]) == "foo.*.bar"
       (showOption ["foo" "<name>" "bar"]) == "foo.<name>.bar"
-
-     Unlike attributes, options can also start with numbers:
-       (showOption ["windowManager" "2bwm" "enable"]) == "windowManager.2bwm.enable"
  */
  showOption = parts: let
    escapeOptionPart = part:
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3404,6 +3404,12 @@
    githubId = 6754950;
    name = "David Armstrong Lewis";
  };
+  davidcromp = {
+    email = "davidcrompton1192@gmail.com";
+    github = "DavidCromp";
+    githubId = 10701143;
+    name = "David Crompton";
+  };
  davidrusu = {
    email = "davidrusu.me@gmail.com";
    github = "davidrusu";
@ -9198,6 +9204,12 @@
    githubId = 952712;
    name = "Matt Christ";
  };
+  matthew-levan = {
+    email = "matthew@coeli.network";
+    github = "matthew-levan";
+    githubId = 91502660;
+    name = "Matthew LeVan";
+  };
  matthewcroughan = {
    email = "matt@croughan.sh";
    github = "MatthewCroughan";
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -40,6 +40,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [goeland](https://github.com/slurdge/goeland), an alternative to rss2email written in golang with many filters. Available as [services.goeland](#opt-services.goeland.enable).

+- [tts](https://github.com/coqui-ai/TTS), a battle-tested deep learning toolkit for Text-to-Speech. Mutiple servers may be configured below [services.tts.servers](#opt-services.tts.servers).
+
 - [atuin](https://github.com/ellie/atuin), a sync server for shell history. Available as [services.atuin](#opt-services.atuin.enable).

 - [networkd-dispatcher](https://gitlab.com/craftyguy/networkd-dispatcher), a dispatcher service for systemd-networkd connection status changes. Available as [services.networkd-dispatcher](#opt-services.networkd-dispatcher.enable).
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@ -91,18 +91,24 @@ let
 in rec {
  inherit optionsNix;

-  optionsAsciiDoc = pkgs.runCommand "options.adoc" {} ''
-    ${pkgs.python3Minimal}/bin/python ${./generateDoc.py} \
-      --format asciidoc \
+  optionsAsciiDoc = pkgs.runCommand "options.adoc" {
+    nativeBuildInputs = [ pkgs.nixos-render-docs ];
+  } ''
+    nixos-render-docs -j $NIX_BUILD_CORES options asciidoc \
+      --manpage-urls ${pkgs.path + "/doc/manpage-urls.json"} \
+      --revision ${lib.escapeShellArg revision} \
      ${optionsJSON}/share/doc/nixos/options.json \
-      > $out
+      $out
  '';

-  optionsCommonMark = pkgs.runCommand "options.md" {} ''
-    ${pkgs.python3Minimal}/bin/python ${./generateDoc.py} \
-      --format commonmark \
+  optionsCommonMark = pkgs.runCommand "options.md" {
+    nativeBuildInputs = [ pkgs.nixos-render-docs ];
+  } ''
+    nixos-render-docs -j $NIX_BUILD_CORES options commonmark \
+      --manpage-urls ${pkgs.path + "/doc/manpage-urls.json"} \
+      --revision ${lib.escapeShellArg revision} \
      ${optionsJSON}/share/doc/nixos/options.json \
-      > $out
+      $out
  '';

  optionsJSON = pkgs.runCommand "options.json"
--- a/nixos/lib/make-options-doc/generateDoc.py
+++ b/nixos/lib/make-options-doc/generateDoc.py
@ -1,112 +0,0 @@
-import argparse
-import json
-import sys
-
-formats = ['commonmark', 'asciidoc']
-
-parser = argparse.ArgumentParser(
-    description = 'Generate documentation for a set of JSON-formatted NixOS options'
-)
-parser.add_argument(
-    'nix_options_path',
-    help = 'a path to a JSON file containing the NixOS options'
-)
-parser.add_argument(
-    '-f',
-    '--format',
-    choices = formats,
-    required = True,
-    help = f'the documentation format to generate'
-)
-
-args = parser.parse_args()
-
-class OptionsEncoder(json.JSONEncoder):
-    def encode(self, obj):
-        # Unpack literal expressions and other Nix types.
-        # Don't escape the strings: they were escaped when initially serialized to JSON.
-        if isinstance(obj, dict):
-            _type = obj.get('_type')
-            if _type is not None:
-                if _type == 'literalExpression' or _type == 'literalDocBook':
-                    return obj['text']
-
-                if _type == 'derivation':
-                    return obj['name']
-
-                raise Exception(f'Unexpected type `{_type}` in {json.dumps(obj)}')
-
-        return super().encode(obj)
-
-def generate_commonmark(options):
-    for (name, value) in options.items():
-        print('##', name.replace('<', '&lt;').replace('>', '&gt;'))
-        print(value['description'])
-        print()
-        if 'type' in value:
-            print('*_Type_*')
-            print ('```')
-            print(value['type'])
-            print ('```')
-        print()
-        print()
-        if 'default' in value:
-            print('*_Default_*')
-            print('```')
-            print(json.dumps(value['default'], cls=OptionsEncoder, ensure_ascii=False, separators=(',', ':')))
-            print('```')
-        print()
-        print()
-        if 'example' in value:
-            print('*_Example_*')
-            print('```')
-            print(json.dumps(value['example'], cls=OptionsEncoder, ensure_ascii=False, separators=(',', ':')))
-            print('```')
-        print()
-        print()
-
-# TODO: declarations: link to github
-def generate_asciidoc(options):
-    for (name, value) in options.items():
-        print(f'== {name}')
-        print()
-        print(value['description'])
-        print()
-        print('[discrete]')
-        print('=== details')
-        print()
-        print(f'Type:: {value["type"]}')
-        if 'default' in value:
-            print('Default::')
-            print('+')
-            print('----')
-            print(json.dumps(value['default'], cls=OptionsEncoder, ensure_ascii=False, separators=(',', ':')))
-            print('----')
-            print()
-        else:
-            print('No Default:: {blank}')
-        if value['readOnly']:
-            print('Read Only:: {blank}')
-        else:
-            print()
-        if 'example' in value:
-            print('Example::')
-            print('+')
-            print('----')
-            print(json.dumps(value['example'], cls=OptionsEncoder, ensure_ascii=False, separators=(',', ':')))
-            print('----')
-            print()
-        else:
-            print('No Example:: {blank}')
-        print()
-
-with open(args.nix_options_path) as nix_options_json:
-    options = json.load(nix_options_json)
-
-    if args.format == 'commonmark':
-        generate_commonmark(options)
-    elif args.format == 'asciidoc':
-        generate_asciidoc(options)
-    else:
-        raise Exception(f'Unsupported documentation format `--format {args.format}`')
-
--- a/nixos/modules/hardware/flipperzero.nix
+++ b/nixos/modules/hardware/flipperzero.nix
@ -0,0 +1,18 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.hardware.flipperzero;
+
+in
+
+{
+  options.hardware.flipperzero.enable = mkEnableOption (mdDoc "udev rules and software for Flipper Zero devices");
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.qFlipper ];
+    services.udev.packages = [ pkgs.qFlipper ];
+  };
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -53,6 +53,7 @@
  ./hardware/cpu/intel-sgx.nix
  ./hardware/device-tree.nix
  ./hardware/digitalbitbox.nix
+  ./hardware/flipperzero.nix
  ./hardware/flirc.nix
  ./hardware/gkraken.nix
  ./hardware/gpgsmartcards.nix
@ -314,6 +315,7 @@
  ./services/audio/snapserver.nix
  ./services/audio/spotifyd.nix
  ./services/audio/squeezelite.nix
+  ./services/audio/tts.nix
  ./services/audio/ympd.nix
  ./services/backup/automysqlbackup.nix
  ./services/backup/bacula.nix
--- a/nixos/modules/programs/flashrom.nix
+++ b/nixos/modules/programs/flashrom.nix
@ -22,6 +22,5 @@ in
  config = mkIf cfg.enable {
    services.udev.packages = [ cfg.package ];
    environment.systemPackages = [ cfg.package ];
-    users.groups.flashrom = { };
  };
 }
--- a/nixos/modules/services/audio/tts.nix
+++ b/nixos/modules/services/audio/tts.nix
@ -0,0 +1,151 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+let
+  cfg = config.services.tts;
+in
+
+{
+  options.services.tts = let
+    inherit (lib) literalExpression mkOption mdDoc mkEnableOption types;
+  in  {
+    servers = mkOption {
+      type = types.attrsOf (types.submodule (
+        { ... }: {
+          options = {
+            enable = mkEnableOption (mdDoc "Coqui TTS server");
+
+            port = mkOption {
+              type = types.port;
+              example = 5000;
+              description = mdDoc ''
+                Port to bind the TTS server to.
+              '';
+            };
+
+            model = mkOption {
+              type = types.nullOr types.str;
+              default = "tts_models/en/ljspeech/tacotron2-DDC";
+              example = null;
+              description = mdDoc ''
+                Name of the model to download and use for speech synthesis.
+
+                Check `tts-server --list_models` for possible values.
+
+                Set to `null` to use a custom model.
+              '';
+            };
+
+            useCuda = mkOption {
+              type = types.bool;
+              default = false;
+              example = true;
+              description = mdDoc ''
+                Whether to offload computation onto a CUDA compatible GPU.
+              '';
+            };
+
+            extraArgs = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              description = mdDoc ''
+                Extra arguments to pass to the server commandline.
+              '';
+            };
+          };
+        }
+      ));
+      default = {};
+      example = literalExpression ''
+        {
+          english = {
+            port = 5300;
+            model = "tts_models/en/ljspeech/tacotron2-DDC";
+          };
+          german = {
+            port = 5301;
+            model = "tts_models/de/thorsten/tacotron2-DDC";
+          };
+          dutch = {
+            port = 5302;
+            model = "tts_models/nl/mai/tacotron2-DDC";
+          };
+        }
+      '';
+      description = mdDoc ''
+        TTS server instances.
+      '';
+    };
+  };
+
+  config = let
+    inherit (lib) mkIf mapAttrs' nameValuePair optionalString concatMapStringsSep escapeShellArgs;
+  in mkIf (cfg.servers != {}) {
+    systemd.services = mapAttrs' (server: options:
+      nameValuePair "tts-${server}" {
+        description = "Coqui TTS server instance ${server}";
+        after = [
+          "network-online.target"
+        ];
+        wantedBy = [
+          "multi-user.target"
+        ];
+        path = with pkgs; [
+          espeak-ng
+        ];
+        environment.HOME = "/var/lib/tts";
+        serviceConfig = {
+          DynamicUser = true;
+          User = "tts";
+          StateDirectory = "tts";
+          ExecStart = "${pkgs.tts}/bin/tts-server --port ${toString options.port}"
+            + optionalString (options.model != null) " --model_name ${options.model}"
+            + optionalString (options.useCuda) " --use_cuda"
+            + (concatMapStringsSep " " escapeShellArgs options.extraArgs);
+          CapabilityBoundingSet = "";
+          DeviceAllow = if options.useCuda then [
+            # https://docs.nvidia.com/dgx/pdf/dgx-os-5-user-guide.pdf
+            "/dev/nvidia1"
+            "/dev/nvidia2"
+            "/dev/nvidia3"
+            "/dev/nvidia4"
+            "/dev/nvidia-caps/nvidia-cap1"
+            "/dev/nvidia-caps/nvidia-cap2"
+            "/dev/nvidiactl"
+            "/dev/nvidia-modeset"
+            "/dev/nvidia-uvm"
+            "/dev/nvidia-uvm-tools"
+          ] else "";
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          # jit via numba->llvmpipe
+          MemoryDenyWriteExecute = false;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectControlGroups = true;
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          UMask = "0077";
+        };
+      }) cfg.servers;
+  };
+}
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@ -409,6 +409,7 @@ in {
        (optionalString (cfg.config != null) copyConfig) +
        (optionalString (cfg.lovelaceConfig != null) copyLovelaceConfig)
      ;
+      environment.PYTHONPATH = package.pythonPath;
      serviceConfig = let
        # List of capabilities to equip home-assistant with, depending on configured components
        capabilities = lib.unique ([
--- a/nixos/modules/services/misc/mbpfan.nix
+++ b/nixos/modules/services/misc/mbpfan.nix
@ -1,5 +1,4 @@
 { config, lib, pkgs, ... }:
-
 with lib;

 let
@ -16,17 +15,19 @@ in {
      type = types.package;
      default = pkgs.mbpfan;
      defaultText = literalExpression "pkgs.mbpfan";
-      description = lib.mdDoc ''
-        The package used for the mbpfan daemon.
-      '';
+      description = lib.mdDoc "The package used for the mbpfan daemon.";
    };

    verbose = mkOption {
      type = types.bool;
      default = false;
-      description = lib.mdDoc ''
-        If true, sets the log level to verbose.
-      '';
+      description = lib.mdDoc "If true, sets the log level to verbose.";
+    };
+
+    aggressive = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc "If true, favors higher default fan speeds.";
    };

    settings = mkOption {
@ -35,24 +36,14 @@ in {
      type = types.submodule {
        freeformType = settingsFormat.type;

-        options.general.min_fan1_speed = mkOption {
-          type = types.nullOr types.int;
-          default = 2000;
-          description = lib.mdDoc ''
-            You can check minimum and maximum fan limits with
-            `cat /sys/devices/platform/applesmc.768/fan*_min` and
-            `cat /sys/devices/platform/applesmc.768/fan*_max` respectively.
-            Setting to null implies using default value from applesmc.
-          '';
-        };
        options.general.low_temp = mkOption {
          type = types.int;
-          default = 55;
+          default = 63;
          description = lib.mdDoc "If temperature is below this, fans will run at minimum speed.";
        };
        options.general.high_temp = mkOption {
          type = types.int;
-          default = 58;
+          default = 66;
          description = lib.mdDoc "If temperature is above this, fan speed will gradually increase.";
        };
        options.general.max_temp = mkOption {
@ -79,10 +70,16 @@ in {
  ];

  config = mkIf cfg.enable {
-    boot.kernelModules = [ "coretemp" "applesmc" ];
+    services.mbpfan.settings = mkIf cfg.aggressive {
+      general.min_fan1_speed = mkDefault 2000;
+      general.low_temp = mkDefault 55;
+      general.high_temp = mkDefault 58;
+      general.max_temp = mkDefault 70;
+    };

-    environment.etc."mbpfan.conf".source = settingsFile;
+    boot.kernelModules = [ "coretemp" "applesmc" ];
    environment.systemPackages = [ cfg.package ];
+    environment.etc."mbpfan.conf".source = settingsFile;

    systemd.services.mbpfan = {
      description = "A fan manager daemon for MacBook Pro";
--- a/nixos/modules/services/monitoring/mimir.nix
+++ b/nixos/modules/services/monitoring/mimir.nix
@ -25,6 +25,13 @@ in {
        Specify a configuration file that Mimir should use.
      '';
    };
+
+    package = mkOption {
+      default = pkgs.mimir;
+      defaultText = lib.literalExpression "pkgs.mimir";
+      type = types.package;
+      description = lib.mdDoc ''Mimir package to use.'';
+    };
  };

  config = mkIf cfg.enable {
@ -53,7 +60,7 @@ in {
               else cfg.configFile;
      in
      {
-        ExecStart = "${pkgs.mimir}/bin/mimir --config.file=${conf}";
+        ExecStart = "${cfg.package}/bin/mimir --config.file=${conf}";
        DynamicUser = true;
        Restart = "always";
        ProtectSystem = "full";
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@ -82,8 +82,8 @@ in {
    };

    boot.kernel.sysctl = mkIf (cfg.useRoutingFeatures == "server" || cfg.useRoutingFeatures == "both") {
-      "net.ipv4.conf.all.forwarding" = mkDefault true;
-      "net.ipv6.conf.all.forwarding" = mkDefault true;
+      "net.ipv4.conf.all.forwarding" = mkOverride 97 true;
+      "net.ipv6.conf.all.forwarding" = mkOverride 97 true;
    };

    networking.firewall.checkReversePath = mkIf (cfg.useRoutingFeatures == "client" || cfg.useRoutingFeatures == "both") "loose";
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@ -22,22 +22,23 @@ in {
      enable = true;
      inherit configDir;

-      # tests loading components by overriding the package
+      # provide dependencies through package overrides
      package = (pkgs.home-assistant.override {
        extraPackages = ps: with ps; [
          colorama
        ];
-        extraComponents = [ "zha" ];
-      }).overrideAttrs (oldAttrs: {
-        doInstallCheck = false;
+        extraComponents = [
+          # test char-tty device allow propagation into the service
+          "zha"
+         ];
      });

-      # tests loading components from the module
+      # provide component dependencies explicitly from the module
      extraComponents = [
-        "wake_on_lan"
+        "mqtt"
      ];

-      # test extra package passing from the module
+      # provide package for postgresql support
      extraPackages = python3Packages: with python3Packages; [
        psycopg2
      ];
@ -111,36 +112,38 @@ in {
  };

  testScript = { nodes, ... }: let
-    system = nodes.hass.config.system.build.toplevel;
+    system = nodes.hass.system.build.toplevel;
  in
  ''
-    import re
    import json

    start_all()

-    # Parse the package path out of the systemd unit, as we cannot
-    # access the final package, that is overridden inside the module,
-    # by any other means.
-    pattern = re.compile(r"path=(?P<path>[\/a-z0-9-.]+)\/bin\/hass")
-    response = hass.execute("systemctl show -p ExecStart home-assistant.service")[1]
-    match = pattern.search(response)
-    assert match
-    package = match.group('path')

-
-    def get_journal_cursor(host) -> str:
-        exit, out = host.execute("journalctl -u home-assistant.service -n1 -o json-pretty --output-fields=__CURSOR")
+    def get_journal_cursor() -> str:
+        exit, out = hass.execute("journalctl -u home-assistant.service -n1 -o json-pretty --output-fields=__CURSOR")
        assert exit == 0
        return json.loads(out)["__CURSOR"]


-    def wait_for_homeassistant(host, cursor):
-        host.wait_until_succeeds(f"journalctl --after-cursor='{cursor}' -u home-assistant.service | grep -q 'Home Assistant initialized in'")
+    def get_journal_since(cursor) -> str:
+        exit, out = hass.execute(f"journalctl --after-cursor='{cursor}' -u home-assistant.service")
+        assert exit == 0
+        return out
+
+
+    def get_unit_property(property) -> str:
+        exit, out = hass.execute(f"systemctl show --property={property} home-assistant.service")
+        assert exit == 0
+        return out
+
+
+    def wait_for_homeassistant(cursor):
+        hass.wait_until_succeeds(f"journalctl --after-cursor='{cursor}' -u home-assistant.service | grep -q 'Home Assistant initialized in'")


    hass.wait_for_unit("home-assistant.service")
-    cursor = get_journal_cursor(hass)
+    cursor = get_journal_cursor()

    with subtest("Check that YAML configuration file is in place"):
        hass.succeed("test -L ${configDir}/configuration.yaml")
@ -148,19 +151,22 @@ in {
    with subtest("Check the lovelace config is copied because lovelaceConfigWritable = true"):
        hass.succeed("test -f ${configDir}/ui-lovelace.yaml")

-    with subtest("Check extraComponents and extraPackages are considered from the package"):
-        hass.succeed(f"grep -q 'colorama' {package}/extra_packages")
-        hass.succeed(f"grep -q 'zha' {package}/extra_components")
-
-    with subtest("Check extraComponents and extraPackages are considered from the module"):
-        hass.succeed(f"grep -q 'psycopg2' {package}/extra_packages")
-        hass.succeed(f"grep -q 'wake_on_lan' {package}/extra_components")
-
    with subtest("Check that Home Assistant's web interface and API can be reached"):
-        wait_for_homeassistant(hass, cursor)
+        wait_for_homeassistant(cursor)
        hass.wait_for_open_port(8123)
        hass.succeed("curl --fail http://localhost:8123/lovelace")

+    with subtest("Check that optional dependencies are in the PYTHONPATH"):
+        env = get_unit_property("Environment")
+        python_path = env.split("PYTHONPATH=")[1].split()[0]
+        for package in ["colorama", "paho-mqtt", "psycopg2"]:
+            assert package in python_path, f"{package} not in PYTHONPATH"
+
+    with subtest("Check that declaratively configured components get setup"):
+        journal = get_journal_since(cursor)
+        for domain in ["emulated_hue", "wake_on_lan"]:
+            assert f"Setup of domain {domain} took" in journal, f"{domain} setup missing"
+
    with subtest("Check that capabilities are passed for emulated_hue to bind to port 80"):
        hass.wait_for_open_port(80)
        hass.succeed("curl --fail http://localhost:80/description.xml")
@ -169,25 +175,28 @@ in {
        hass.succeed("systemctl show -p DeviceAllow home-assistant.service | grep -q char-ttyUSB")

    with subtest("Check service reloads when configuration changes"):
-      # store the old pid of the process
-      pid = hass.succeed("systemctl show --property=MainPID home-assistant.service")
-      cursor = get_journal_cursor(hass)
-      hass.succeed("${system}/specialisation/differentName/bin/switch-to-configuration test")
-      new_pid = hass.succeed("systemctl show --property=MainPID home-assistant.service")
-      assert pid == new_pid, "The PID of the process should not change between process reloads"
-      wait_for_homeassistant(hass, cursor)
+        pid = hass.succeed("systemctl show --property=MainPID home-assistant.service")
+        cursor = get_journal_cursor()
+        hass.succeed("${system}/specialisation/differentName/bin/switch-to-configuration test")
+        new_pid = hass.succeed("systemctl show --property=MainPID home-assistant.service")
+        assert pid == new_pid, "The PID of the process should not change between process reloads"
+        wait_for_homeassistant(cursor)

-    with subtest("check service restarts when package changes"):
-      pid = new_pid
-      cursor = get_journal_cursor(hass)
-      hass.succeed("${system}/specialisation/newFeature/bin/switch-to-configuration test")
-      new_pid = hass.succeed("systemctl show --property=MainPID home-assistant.service")
-      assert pid != new_pid, "The PID of the process shoudl change when the HA binary changes"
-      wait_for_homeassistant(hass, cursor)
+    with subtest("Check service restarts when dependencies change"):
+        pid = new_pid
+        cursor = get_journal_cursor()
+        hass.succeed("${system}/specialisation/newFeature/bin/switch-to-configuration test")
+        new_pid = hass.succeed("systemctl show --property=MainPID home-assistant.service")
+        assert pid != new_pid, "The PID of the process should change when its PYTHONPATH changess"
+        wait_for_homeassistant(cursor)
+
+    with subtest("Check that new components get setup after restart"):
+        journal = get_journal_since(cursor)
+        for domain in ["esphome"]:
+            assert f"Setup of domain {domain} took" in journal, f"{domain} setup missing"

    with subtest("Check that no errors were logged"):
-        output_log = hass.succeed("cat ${configDir}/home-assistant.log")
-        assert "ERROR" not in output_log
+        hass.fail("journalctl -u home-assistant -o cat | grep -q ERROR")

    with subtest("Check systemd unit hardening"):
        hass.log(hass.succeed("systemctl cat home-assistant.service"))
--- a/nixos/tests/keepassxc.nix
+++ b/nixos/tests/keepassxc.nix
@ -4,6 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
  name = "keepassxc";
  meta = with pkgs.lib.maintainers; {
    maintainers = [ turion ];
+    timeout = 1800;
  };

  nodes.machine = { ... }:
@ -55,9 +56,12 @@ import ./make-test-python.nix ({ pkgs, ...} :
        machine.sleep(5)
        # Regression #163482: keepassxc did not crash
        machine.succeed("ps -e | grep keepassxc")
-        machine.wait_for_text("foo.kdbx")
+        machine.wait_for_text("Open database")
        machine.send_key("ret")
-        machine.sleep(1)
+
+        # Wait for the enter password screen to appear.
+        machine.wait_for_text("/home/alice/foo.kdbx")
+
        # Click on "Browse" button to select keyfile
        machine.send_key("tab")
        machine.send_chars("/home/alice/foo.keyfile")
--- a/pkgs/applications/audio/ashuffle/default.nix
+++ b/pkgs/applications/audio/ashuffle/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "ashuffle";
-  version = "3.13.4";
+  version = "3.13.6";

  src = fetchFromGitHub {
    owner = "joshkunz";
    repo = "ashuffle";
    rev = "v${version}";
-    sha256 = "sha256-J6NN0Rsc9Zw9gagksDlwpwEErs+4XmrGF9YHKlAE1FA=";
+    sha256 = "sha256-8XjLs4MI5MXvA6veCoTAj8tlYDe7YTggutO3F9eNyMM=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@ -1,29 +1,33 @@
-{ lib
-, stdenv
+{ asio
 , cmake
-, pkg-config
 , curl
-, asio
 , fetchFromGitHub
 , fetchpatch
 , ffmpeg
 , gnutls
 , lame
+, lib
 , libev
 , game-music-emu
 , libmicrohttpd
 , libopenmpt
 , mpg123
 , ncurses
+, pkg-config
+, portaudio
+, stdenv
 , taglib
 # Linux Dependencies
 , alsa-lib
+, pipewireSupport ? true, pipewire
 , pulseaudio
-, systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd
+, sndioSupport ? true, sndio
 , systemd
+, systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd
 # Darwin Dependencies
 , Cocoa
 , SystemConfiguration
+, coreaudioSupport ? stdenv.hostPlatform.isDarwin
 }:

 stdenv.mkDerivation rec {
@ -56,13 +60,18 @@ stdenv.mkDerivation rec {
    libopenmpt
    mpg123
    ncurses
+    portaudio
    taglib
  ] ++ lib.optionals systemdSupport [
    systemd
  ] ++ lib.optionals stdenv.isLinux [
    alsa-lib pulseaudio
  ] ++ lib.optionals stdenv.isDarwin [
-    Cocoa SystemConfiguration
+    Cocoa coreaudioSupport SystemConfiguration
+  ] ++ lib.optional sndioSupport [
+    sndio
+  ] ++ lib.optional pipewireSupport [
+    pipewire
  ];

  cmakeFlags = [
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergo";
-  version = "5.0.6";
+  version = "5.0.7";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-UiPwvZcdkeFOTMVcUT1Xr5ByrJC+yzodCfi8Br61hjU=";
+    sha256 = "sha256-yxb8cMAokAv0tl9FSjjtdvHkJP/UKlZxLLu/+gx8kyQ=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/blockchains/erigon/default.nix
+++ b/pkgs/applications/blockchains/erigon/default.nix
@ -2,7 +2,7 @@

 let
  pname = "erigon";
-  version = "2.38.1";
+  version = "2.39.0";
 in
 buildGoModule {
  inherit pname version;
@ -11,11 +11,11 @@ buildGoModule {
    owner = "ledgerwatch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-sLJMmSEUQNsodZ9Ms0ipDwN2QOYa9pZTlEqt4CF23Sc=";
+    sha256 = "sha256-HlAnuc6n/de6EzHTit3xGCFLrc2+S+H/o0gCxH8d0aU=";
    fetchSubmodules = true;
  };

-  vendorSha256 = "sha256-KESY+PSbWQHPJphop4GnVF4T8Q/MPb2GFDEko0ieXEM=";
+  vendorSha256 = "sha256-kKwaA6NjRdg97tTEzEI+TWMSx7izzFWcefR5B086cUY=";
  proxyVendor = true;

  # Build errors in mdbx when format hardening is enabled:
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cudatext";
-  version = "1.184.0";
+  version = "1.185.0";

  src = fetchFromGitHub {
    owner = "Alexey-T";
    repo = "CudaText";
    rev = version;
-    hash = "sha256-bRe9yS9CMsBH04oefImSYkd1jUe3SnJU6JZETLwow/0=";
+    hash = "sha256-hzEDKpH1dShmEZ6EYkA5rLtbJc2ukw7Gs7spMjiocCE=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@ -16,8 +16,8 @@
  },
  "ATSynEdit": {
    "owner": "Alexey-T",
-    "rev": "2023.02.12",
-    "hash": "sha256-PSRKxKJkX9GlV8JUACYzDZguv8M8jKVxlW7U4Mmla9o="
+    "rev": "2023.02.19",
+    "hash": "sha256-2qNY7xzyJ0rCVNDQcJaJ7qZgOhtBCcuGCxY1BvVAoEs="
  },
  "ATSynEdit_Cmp": {
    "owner": "Alexey-T",
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@ -23,6 +23,9 @@ rustPlatform.buildRustPackage rec {
    mkdir -p $out/lib
    cp -r runtime $out/lib
    installShellCompletion contrib/completion/hx.{bash,fish,zsh}
+    mkdir -p $out/share/{applications,icons}
+    cp contrib/Helix.desktop $out/share/applications
+    cp contrib/helix.png $out/share/icons
  '';
  postFixup = ''
    wrapProgram $out/bin/hx --set HELIX_RUNTIME $out/lib/runtime
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -1203,12 +1203,12 @@
  };
  python = buildGrammar {
    language = "python";
-    version = "9e53981";
+    version = "528855e";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-python";
-      rev = "9e53981ec31b789ee26162ea335de71f02186003";
-      hash = "sha256-D2++Xg7dRfjGM2r4cxaXGQnBOAX5JBREcEAJeNa7Y9M=";
+      rev = "528855eee2665210e1bf5556de48b8d8dacb8932";
+      hash = "sha256-H2RWMbbKIMbfH/TMC5SKbO9qEB9RfFUOYrczwmDdrVo=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-python";
  };
--- a/pkgs/applications/misc/cubiomes-viewer/default.nix
+++ b/pkgs/applications/misc/cubiomes-viewer/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "cubiomes-viewer";
-  version = "3.1.1";
+  version = "3.2.1";

  src = fetchFromGitHub {
    owner = "Cubitect";
    repo = pname;
    rev = version;
-    sha256 = "sha256-5PtMXipULnzAnarESu2biYOeHSlDeKXoX5XnlpvgIAk=";
+    sha256 = "sha256-67augXXZsriXdndrCFUFWZbL+rVKgTPAyqlbZua2Ul4=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/gnome-firmware/default.nix
+++ b/pkgs/applications/misc/gnome-firmware/default.nix
@ -20,14 +20,14 @@

 stdenv.mkDerivation rec {
  pname = "gnome-firmware";
-  version = "43.1";
+  version = "43.2";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "gnome-firmware";
    rev = version;
-    sha256 = "9QS6X1Cm9/wToQ8hnGNn3VytSCpZI8StZ3+vf0/wbAw=";
+    sha256 = "oplypNSj028cVBn+eJxNm5pJltp7Cw5Oto/L39pI0vA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@ -3,7 +3,6 @@
 , fetchFromGitHub
 , cmake
 , qttools
-, darwin

 , asciidoctor
 , botan2
@ -25,6 +24,8 @@
 , wrapQtAppsHook
 , zlib

+, LocalAuthentication
+
 , withKeePassBrowser ? true
 , withKeePassFDOSecrets ? true
 , withKeePassKeeShare ? true
@ -110,7 +111,7 @@ stdenv.mkDerivation rec {
    readline
    zlib
  ]
-  ++ lib.optional (stdenv.isDarwin && withKeePassTouchID) darwin.apple_sdk.frameworks.LocalAuthentication
+  ++ lib.optional (stdenv.isDarwin && withKeePassTouchID) LocalAuthentication
  ++ lib.optional stdenv.isDarwin qtmacextras
  ++ lib.optional stdenv.isLinux libusb1
  ++ lib.optional withKeePassX11 qtx11extras;
--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "pueue";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "Nukesor";
    repo = "pueue";
    rev = "v${version}";
-    hash = "sha256-vJJ3qQb38b0vr7o+7rc3z5wftI6Ko4mJiGLvVzyjTeE=";
+    hash = "sha256-5xHY8DOQnOdYqNyfAS2kMuW2vxAuoSe6RaOItnAJCkQ=";
  };

-  cargoHash = "sha256-3taLua69kqPnNraIZIesMkFguCbPWTF5Hu9s2Lc02ZA=";
+  cargoHash = "sha256-3IOtx1aeth6QBjY6aILtzxhjZddovD7KIKzNhVCabfU=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/applications/misc/rofi-bluetooth/default.nix
+++ b/pkgs/applications/misc/rofi-bluetooth/default.nix
@ -2,20 +2,19 @@
 , stdenv
 , fetchFromGitHub
 , makeWrapper
-, rofi-unwrapped
 , bluez
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "rofi-bluetooth";
-  version = "unstable-2021-03-05";
+  version = "unstable-2023-02-03";

  src = fetchFromGitHub {
    owner = "nickclyde";
-    repo = "rofi-bluetooth";
+    repo = finalAttrs.pname;
    # https://github.com/nickclyde/rofi-bluetooth/issues/19
-    rev = "893db1f2b549e7bc0e9c62e7670314349a29cdf2";
-    sha256 = "sha256-3oROJKEQCuSnLfbJ+JSSc9hcmJTPrLHRQJsrUcaOMss=";
+    rev = "9d91c048ff129819f4c6e9e48a17bd54343bbffb";
+    sha256 = "sha256-1Xe3QFThIvJDCUznDP5ZBzwZEMuqmxpDIV+BcVvQDG8=";
  };

  nativeBuildInputs = [ makeWrapper ];
@ -26,7 +25,7 @@ stdenv.mkDerivation rec {
    install -D --target-directory=$out/bin/ ./rofi-bluetooth

    wrapProgram $out/bin/rofi-bluetooth \
-      --prefix PATH ":" ${lib.makeBinPath [ rofi-unwrapped bluez ] }
+      --prefix PATH ":" ${lib.makeBinPath [ bluez ] }

    runHook postInstall
  '';
@ -38,4 +37,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ MoritzBoehme ];
    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/polypane/default.nix
+++ b/pkgs/applications/networking/browsers/polypane/default.nix
@ -2,12 +2,12 @@

 let
  pname = "polypane";
-  version = "10.0.1";
+  version = "13.0.2";

  src = fetchurl {
    url = "https://github.com/firstversionist/${pname}/releases/download/v${version}/${pname}-${version}.AppImage";
    name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-J0D49VESNgdBEWAf01LkiiU2I01r4PBLyWKpnE9t45Q=";
+    sha256 = "sha256-+44a9dPQOV1D2rnsuy+GyJqZz/UCbITmMuunwHc4JFY=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -26,6 +26,7 @@
 , pulseaudioSupport ? mediaSupport
 , libpulseaudio
 , apulse
+, alsa-lib

 # Media support (implies audio support)
 , mediaSupport ? true
@ -57,6 +58,7 @@ let
  libPath = lib.makeLibraryPath libPkgs;

  libPkgs = [
+    alsa-lib
    atk
    cairo
    dbus
@ -85,9 +87,9 @@ let
  fteLibPath = lib.makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "11.5.8";
+  version = "12.0.3";

-  lang = "en-US";
+  lang = "ALL";

  srcs = {
    x86_64-linux = fetchurl {
@ -97,7 +99,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
      ];
-      sha256 = "sha256-/KK9oTijk5dEziAwp5966NaM2V4k1mtBjTJq88Ct7N0=";
+      hash = "sha256-bOGY/RdwD6O7QIuOiBw7OVnZfpumGGso6hwMJJwN2g0=";
    };

    i686-linux = fetchurl {
@ -107,7 +109,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
      ];
-      sha256 = "sha256-TGdJ5yIeo0YQ4XSsb9lv3vuW6qEjhFe7KBmkjYO6fAc=";
+      hash = "sha256-t1tnEZtiRig2r8GNJpqT+J0XoxCLMyUsI9tX6aa0lYk=";
    };
  };
 in
@ -291,13 +293,9 @@ stdenv.mkDerivation rec {
    # TBB will fail if ownership is too permissive
    chmod 0700 "\$HOME/TorBrowser/Data/Tor"

-    # Initialize the browser profile state.  Note that the only data
-    # copied from the Store payload is the initial bookmark file, which is
-    # never updated once created.  All other files under user's profile
-    # dir are generated by TBB.
+    # Initialize the browser profile state.
+    # All files under user's profile dir are generated by TBB.
    mkdir -p "\$HOME/TorBrowser/Data/Browser/profile.default"
-    cp -u --no-preserve=mode,owner "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/bookmarks.html" \
-      "\$HOME/TorBrowser/Data/Browser/profile.default/bookmarks.html"

    # Clear some files if the last known store path is different from the new one
    : "\''${KNOWN_STORE_PATH:=\$HOME/known-store-path}"
@ -325,6 +323,9 @@ stdenv.mkDerivation rec {
    # chance that TBB would continue using old font files.
    rm -rf "\$HOME/.cache/fontconfig"

+    # Workaround a bug in 12.0.X that Tor directories are not cleaned up and tor gets confused where its socket is
+    rm -rf \$XDG_RUNTIME_DIR/Tor*
+
    # Manually specify data paths (by default TB attempts to create these in the store)
    {
      echo "user_pref(\"extensions.torlauncher.toronionauthdir_path\", \"\$HOME/TorBrowser/Data/Tor/onion-auth\");"
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "glooctl";
-  version = "1.13.6";
+  version = "1.13.7";

  src = fetchFromGitHub {
    owner = "solo-io";
    repo = "gloo";
    rev = "v${version}";
-    hash = "sha256-CBWKKW5VIkRgl7wY63OCm/CowWHO389se3kEraqaDCI=";
+    hash = "sha256-npp03e5pAir8t9Ej52fafW7Uk24Y+UOFojaNc2MSkVA=";
  };

  subPackages = [ "projects/gloo/cli/cmd" ];
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.16.2";
+  version = "1.17.0";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    sha256 = "sha256-Qvpg6qLrtnnMrRWFHv7J+drM75V6DaMu1jxcxaCJ4kk=";
+    sha256 = "sha256-cMpFf+VTTH8d1KpvbUoB2pJYPp3FHhRthut8tjTEZtc=";
  };
-  vendorHash = "sha256-wPkjRkgQiGvZm+eOGVlM5cgrYugF/E8H71bcR2ofP2U=";
+  vendorHash = "sha256-C8UyfVCCkLAU9/qY9Kcv8TKKfG3rLNzu8mfi23O18rU=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "k9s";
-  version = "0.27.2";
+  version = "0.27.3";

  src = fetchFromGitHub {
    owner  = "derailed";
    repo   = "k9s";
    rev    = "v${version}";
-    sha256 = "sha256-9wdc3Wiqry8+q/60Y7mPzH0k4dp1nKIGinxfkYBaHJY=";
+    sha256 = "sha256-oUn9qQG4rpunfeHgSlY9THkYv1aGWrVmdTZoEWeZJTs=";
  };

  ldflags = [
@ -20,7 +20,7 @@ buildGoModule rec {

  tags = [ "netgo" ];

-  vendorHash = "sha256-8H7siVl6gXifQOBOLtyCeDbYflhKjaIRmP0KOTWVJk0=";
+  vendorHash = "sha256-sQ3D4JUK9epRkDZ7DC+IH+iMaLN+uKM2hZkhqji+0Zc=";

  # TODO investigate why some config tests are failing
  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -219,13 +219,13 @@
    "vendorHash": "sha256-PALZGyGZ6Ggccl4V9gG+gsEdNipYG+DCaZkqF0W1IMQ="
  },
  "cloudflare": {
-    "hash": "sha256-Y48H7P69ORr8U0yXf1HEBqh//oOmWn3Uj8GQ12PsV/M=",
+    "hash": "sha256-fHugf+nvel/bSyh+l94q0iE7E+ZYBt2qfGSoot9xI8w=",
    "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
    "owner": "cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v3.33.1",
+    "rev": "v4.0.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-3JH+4ExREL3vtq6CiQN0G0x08ScrzOf2pTAnsWcGgq8="
+    "vendorHash": "sha256-jIQcgGknigQFUkLjLoxUjq+Mqjb085v6Zqgd49Dxivo="
  },
  "cloudfoundry": {
    "hash": "sha256-/Zxj9cous0SjYxeDo+8/u61pqDwMGt/UsS/OC1oSR2U=",
@ -503,11 +503,11 @@
    "vendorHash": null
  },
  "heroku": {
-    "hash": "sha256-UGA01N4ToEb3eSKCI2raI3ZXFeRm0MVVXVWgAc7im9g=",
+    "hash": "sha256-Fc8nCrFR3cHEN68y277/eZ6DLVfFxEyliCkii5343MI=",
    "homepage": "https://registry.terraform.io/providers/heroku/heroku",
    "owner": "heroku",
    "repo": "terraform-provider-heroku",
-    "rev": "v5.1.10",
+    "rev": "v5.1.11",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1054,13 +1054,13 @@
    "vendorHash": "sha256-sVNtY2wDGE2ZOB4YNytx0n4V4cbNKoXAv7JCA+Ym3JU="
  },
  "stackpath": {
-    "hash": "sha256-nTR9HgSmuNCt7wxE4qqIH2+HA2igzqVx0lLRx6FoKrE=",
+    "hash": "sha256-7KQUddq+M35WYyAIAL8sxBjAaXFcsczBRO1R5HURUZg=",
    "homepage": "https://registry.terraform.io/providers/stackpath/stackpath",
    "owner": "stackpath",
    "repo": "terraform-provider-stackpath",
-    "rev": "v1.4.0",
+    "rev": "v1.5.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Fvku4OB1sdWuvMx/FIHfOJt9STgao0xPDao6b2SYxcQ="
+    "vendorHash": "sha256-OGYiynCwbJU2KisS7Y6xmLuBKOtQvh3MWPrvBk/x95U="
  },
  "statuscake": {
    "hash": "sha256-PcA0t/G11w9ud+56NdiRXi82ubJ+wpL4XcexT1O2ADw=",
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -1,7 +1,7 @@
 { branch ? "stable", callPackage, fetchurl, lib, stdenv }:
 let
  versions = if stdenv.isLinux then {
-    stable = "0.0.24";
+    stable = "0.0.25";
    ptb = "0.0.38";
    canary = "0.0.148";
  } else {
@ -14,7 +14,7 @@ let
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        sha256 = "sha256-SG+34ft0mTqtg9rFiI60N6JIONyqF8c8SlnRcn5a4Xc=";
+        sha256 = "sha256-WBcmy9fwGPq3Vs1+7lIOR7OiW/d0kZNIKp4Q5NRYBCw=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
--- a/pkgs/applications/networking/instant-messengers/jami/client.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/client.nix
@ -1,77 +0,0 @@
-{ version
-, src
-, jami-meta
-, lib
-, stdenv
-, pkg-config
-, cmake
-, networkmanager # for libnm
-, python3
-, qttools # for translations
-, wrapQtAppsHook
-, ffmpeg_5
-, jami-daemon
-, libnotify
-, qt5compat
-, qtbase
-, qtdeclarative
-, qrencode
-, qtmultimedia
-, qtnetworkauth
-, qtsvg
-, qtwebengine
-, qtwebchannel
-, withWebengine ? true
-}:
-
-stdenv.mkDerivation {
-  pname = "jami-client";
-  inherit version src;
-
-  sourceRoot = "source/client-qt";
-
-  preConfigure = ''
-    echo 'const char VERSION_STRING[] = "${version}";' > src/app/version.h
-  '';
-
-  nativeBuildInputs = [
-    wrapQtAppsHook
-    pkg-config
-    cmake
-    python3
-    qttools
-  ];
-
-  buildInputs = [
-    ffmpeg_5
-    jami-daemon
-    libnotify
-    networkmanager
-    qtbase
-    qt5compat
-    qrencode
-    qtnetworkauth
-    qtdeclarative
-    qtmultimedia
-    qtsvg
-    qtwebchannel
-  ] ++ lib.optionals withWebengine [
-    qtwebengine
-  ];
-
-  cmakeFlags = [
-    "-DLIBJAMI_INCLUDE_DIR=${jami-daemon}/include/jami"
-    "-DLIBJAMI_XML_INTERFACES_DIR=${jami-daemon}/share/dbus-1/interfaces"
-  ] ++ lib.optionals (!withWebengine) [
-    "-DWITH_WEBENGINE=false"
-  ];
-
-  qtWrapperArgs = [
-    # With wayland the titlebar is not themed and the wmclass is wrong.
-    "--set-default QT_QPA_PLATFORM xcb"
-  ];
-
-  meta = jami-meta // {
-    description = "The client based on QT" + jami-meta.description;
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/jami/daemon.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
@ -1,89 +0,0 @@
-{ src
-, version
-, jami-meta
-, stdenv
-, autoreconfHook
-, pkg-config
-, perl # for pod2man
-, alsa-lib
-, asio
-, dbus
-, dbus_cplusplus
-, ffmpeg_5
-, fmt
-, gmp
-, gnutls
-, http-parser
-, jack
-, jsoncpp
-, libarchive
-, libgit2
-, libnatpmp
-, libpulseaudio
-, libupnp
-, yaml-cpp
-, msgpack
-, opendht-jami
-, openssl
-, pjsip-jami
-, restinio
-, secp256k1
-, speex
-, udev
-, webrtc-audio-processing
-, zlib
-}:
-
-stdenv.mkDerivation {
-  pname = "jami-daemon";
-  inherit src version;
-  sourceRoot = "source/daemon";
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-    perl
-  ];
-
-  buildInputs = [
-    alsa-lib
-    asio
-    dbus
-    dbus_cplusplus
-    fmt
-    ffmpeg_5
-    gmp
-    gnutls
-    http-parser
-    jack
-    jsoncpp
-    libarchive
-    libgit2
-    libnatpmp
-    libpulseaudio
-    libupnp
-    yaml-cpp
-    msgpack
-    opendht-jami
-    openssl
-    pjsip-jami
-    restinio
-    secp256k1
-    speex
-    udev
-    webrtc-audio-processing
-    zlib
-  ];
-
-  doCheck = false; # The tests fail to compile due to missing headers.
-
-  enableParallelBuilding = true;
-
-  passthru = {
-    updateScript = ./update.sh;
-  };
-
-  meta = jami-meta // {
-    description = "The daemon" + jami-meta.description;
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@ -1,73 +1,95 @@
 { stdenv
 , lib
-, callPackage
-, fetchFromGitHub
-, fetchzip
-, fetchpatch
-, pjsip
-, opendht
+, pkg-config
+, fetchFromGitLab
+, gitUpdater
+, ffmpeg_5
+
+# for daemon
+, autoreconfHook
+, perl # for pod2man
+, alsa-lib
+, asio
+, dbus
+, dbus_cplusplus
+, fmt
+, gmp
+, gnutls
+, http-parser
 , jack
+, jsoncpp
+, libarchive
+, libgit2
+, libnatpmp
+, libpulseaudio
+, libupnp
+, yaml-cpp
+, msgpack
+, openssl
+, restinio
+, secp256k1
+, speex
 , udev
-, qt6Packages
+, webrtc-audio-processing
+, zlib
+
+# for client
+, cmake
+, networkmanager # for libnm
+, python3
+, qttools # for translations
+, wrapQtAppsHook
+, libnotify
+, qt5compat
+, qtbase
+, qtdeclarative
+, qrencode
+, qtmultimedia
+, qtnetworkauth
+, qtsvg
+, qtwebengine
+, qtwebchannel
+, withWebengine ? true
+
+# for pjsip
+, fetchFromGitHub
+, pjsip
+
+# for opendht
+, opendht
 }:

 let
-  version = "20221220.0956.79e1207";
-
-  src = fetchzip {
-    url = "https://dl.jami.net/release/tarballs/jami_${version}.tar.gz";
-    hash = "sha256-AQgz2GqueFG+yK42zJ9MzvP4BddGt0BFb+cIoA6Fif8=";
-
-    stripRoot = false;
-    postFetch = ''
-      cd $out
-      mv jami-project/daemon ./
-      mv jami-project/client-qt ./
-      mv jami-project/COPYING ./
-      rm -r jami-project.rst jami-project
-      rm daemon/contrib/tarballs/*
-    '';
-  };
-
-  jami-meta = with lib; {
-    homepage = "https://jami.net/";
-    description = " for Jami, the free and universal communication platform that respects the privacy and freedoms of its users";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.linsui ];
-  };
-
  readLinesToList = with builtins; file: filter (s: isString s && stringLength s > 0) (split "\n" (readFile file));
 in
-rec {
+stdenv.mkDerivation rec {
+  pname = "jami";
+  version = "20230206.0";
+
+  src = fetchFromGitLab {
+    domain = "git.jami.net";
+    owner = "savoirfairelinux";
+    repo = "jami-client-qt";
+    rev = "stable/${version}";
+    hash = "sha256-MQ28UJUvgJoPk65neUgMrG+SxOcfnUl803urEFQ7468=";
+    fetchSubmodules = true;
+  };
+
  pjsip-jami = pjsip.overrideAttrs (old:
    let
      patch-src = src + "/daemon/contrib/src/pjproject/";
    in
    rec {
-      version = "eae25732568e600d248aa8c226271ff6b81df170";
+      version = "3b78ef1c48732d238ba284cdccb04dc6de79c54f";

      src = fetchFromGitHub {
        owner = "savoirfairelinux";
        repo = "pjproject";
        rev = version;
-        sha256 = "sha256-N7jn4qen+PgFiVkTFi2HSWhx2QPHwAYMtnrpE/ptDVc=";
+        hash = "sha256-hrm5tDM2jknU/gWMeO6/FhqOvay8bajFid39OiEtAAQ=";
      };

-      patches = (map (x: patch-src + x) (readLinesToList ./config/pjsip_patches)) ++ [
-        (fetchpatch {
-          name = "CVE-2022-23537.patch";
-          url = "https://github.com/pjsip/pjproject/commit/d8440f4d711a654b511f50f79c0445b26f9dd1e1.patch";
-          sha256 = "sha256-7ueQCHIiJ7MLaWtR4+GmBc/oKaP+jmEajVnEYqiwLRA=";
-        })
-        (fetchpatch {
-          name = "CVE-2022-23547.patch";
-          url = "https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36.patch";
-          sha256 = "sha256-bpc8e8VAQpfyl5PX96G++6fzkFpw3Or1PJKNPKl7N5k=";
-        })
-      ];
-
-      patchFlags = [ "-p1" "-l" ];
+      patches = (map (x: patch-src + x) (readLinesToList ./config/pjsip_patches));

      configureFlags = (readLinesToList ./config/pjsip_args_common)
        ++ lib.optionals stdenv.isLinux (readLinesToList ./config/pjsip_args_linux);
@ -78,11 +100,105 @@ rec {
    enablePushNotifications = true;
  };

-  jami-daemon = callPackage ./daemon.nix {
-    inherit version src udev jack jami-meta pjsip-jami opendht-jami;
+  daemon = stdenv.mkDerivation {
+    pname = "jami-daemon";
+    inherit src version meta;
+    sourceRoot = "source/daemon";
+
+    nativeBuildInputs = [
+      autoreconfHook
+      pkg-config
+      perl
+    ];
+
+    buildInputs = [
+      alsa-lib
+      asio
+      dbus
+      dbus_cplusplus
+      fmt
+      ffmpeg_5
+      gmp
+      gnutls
+      http-parser
+      jack
+      jsoncpp
+      libarchive
+      libgit2
+      libnatpmp
+      libpulseaudio
+      libupnp
+      yaml-cpp
+      msgpack
+      opendht-jami
+      openssl
+      pjsip-jami
+      restinio
+      secp256k1
+      speex
+      udev
+      webrtc-audio-processing
+      zlib
+    ];
+
+    enableParallelBuilding = true;
  };

-  jami-client = qt6Packages.callPackage ./client.nix {
-    inherit version src jami-meta;
+  preConfigure = ''
+    echo 'const char VERSION_STRING[] = "${version}";' > src/app/version.h
+  '';
+
+  nativeBuildInputs = [
+    wrapQtAppsHook
+    pkg-config
+    cmake
+    python3
+    qttools
+  ];
+
+  buildInputs = [
+    daemon
+    ffmpeg_5
+    libnotify
+    networkmanager
+    qtbase
+    qt5compat
+    qrencode
+    qtnetworkauth
+    qtdeclarative
+    qtmultimedia
+    qtsvg
+    qtwebchannel
+  ] ++ lib.optionals withWebengine [
+    qtwebengine
+  ];
+
+  cmakeFlags = [
+    "-DLIBJAMI_INCLUDE_DIR=${daemon}/include/jami"
+    "-DLIBJAMI_XML_INTERFACES_DIR=${daemon}/share/dbus-1/interfaces"
+  ] ++ lib.optionals (!withWebengine) [
+    "-DWITH_WEBENGINE=false"
+  ];
+
+  qtWrapperArgs = [
+    # With wayland the titlebar is not themed and the wmclass is wrong.
+    "--set-default QT_QPA_PLATFORM xcb"
+  ];
+
+  postInstall = ''
+    # Make the jamid d-bus services available
+    ln -s ${daemon}/share/dbus-1 $out/share
+  '';
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "stable/";
+  };
+
+  meta = with lib; {
+    homepage = "https://jami.net/";
+    description = "The free and universal communication platform that respects the privacy and freedoms of its users";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.linsui ];
  };
 }
--- a/pkgs/applications/networking/instant-messengers/jami/update.sh
+++ b/pkgs/applications/networking/instant-messengers/jami/update.sh
@ -1,61 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl gnused common-updater-scripts nix-prefetch
-
-set -e
-
-jami_dir=$(readlink -e $(dirname "${BASH_SOURCE[0]}"))
-
-cd $jami_dir/../../../../..
-
-# Update src version and hash
-version=$(curl -s 'https://dl.jami.net/release/tarballs/?C=M;O=D' | sed -n -E 's/^.*jami_([0-9.a-f]+)\.tar\.gz.*$/\1/p' | head -n 1)
-echo "Latest version: ${version}"
-
-update-source-version jami-daemon "$version" --file=$jami_dir/default.nix
-
-src=$(nix-build --no-out-link -A jami-daemon.src)
-
-config_dir="$jami_dir/config"
-mkdir -p $config_dir
-
-ffmpeg_rules="${src}/daemon/contrib/src/ffmpeg/rules.mak"
-
-# Update FFmpeg patches
-ffmpeg_patches=$(sed -n '/^ffmpeg:/,/^$/p' ${ffmpeg_rules} | sed -n -E 's/.*ffmpeg\/(.*patch).*/\1/p')
-echo -e "Patches for FFmpeg:\n${ffmpeg_patches}\n"
-echo "${ffmpeg_patches}" > "$config_dir/ffmpeg_patches"
-
-# Update FFmpeg args
-ffmpeg_args_common=$(sed -n '/#disable everything/,/#platform specific options/p' ${ffmpeg_rules} | sed -n -E 's/.*(--[0-9a-z=_-]+).*/\1/p')
-echo -e "Common args for FFmpeg:\n${ffmpeg_args_common}\n"
-echo "${ffmpeg_args_common}" > "$config_dir/ffmpeg_args_common"
-
-ffmpeg_args_linux1=$(sed -n '/ifdef HAVE_LINUX/,/ifdef HAVE_ANDROID/p' ${ffmpeg_rules} | sed -n -E 's/.*(--[0-9a-z=_-]+).*/\1/p')
-ffmpeg_args_linux2=$(sed -n '/# Desktop Linux/,/i386 x86_64/p' ${ffmpeg_rules} | sed -n -E 's/.*(--[0-9a-z=_-]+).*/\1/p')
-echo -e "Linux args for FFmpeg:\n${ffmpeg_args_linux1}\n${ffmpeg_args_linux2}\n"
-echo "${ffmpeg_args_linux1}" > "$config_dir/ffmpeg_args_linux"
-echo "${ffmpeg_args_linux2}" >> "$config_dir/ffmpeg_args_linux"
-
-ffmpeg_args_x86=$(sed -n '/i386 x86_64/,/# End Desktop Linux:/p' ${ffmpeg_rules} | sed -n -E 's/.*(--[0-9a-z=_-]+).*/\1/p')
-echo -e "x86 args for FFmpeg:\n${ffmpeg_args_x86}\n"
-echo "${ffmpeg_args_x86}" > "$config_dir/ffmpeg_args_x86"
-
-# Update pjsip patches
-pjsip_patches=$(sed -n '/UNPACK/,/HAVE_ANDROID/p' ${src}/daemon/contrib/src/pjproject/rules.mak | sed -n -E 's/.*pjproject\/(00.*patch).*/\1/p')
-echo -e "Patches for pjsip:\n${pjsip_patches}\n"
-echo "${pjsip_patches}" > "$config_dir/pjsip_patches"
-
-# Update pjsip version
-pjsip_version=$(sed -n -E 's/.*PJPROJECT_VERSION := ([0-9a-f]+).*/\1/p' ${src}/daemon/contrib/src/pjproject/rules.mak)
-update-source-version jami.pjsip-jami "$pjsip_version" --file=$jami_dir/default.nix
-
-pjsip_rules="${src}/daemon/contrib/src/pjproject/rules.mak"
-
-# Update pjsip args
-pjsip_args_common=$(sed -n '/PJPROJECT_OPTIONS :=/,/with-gnutls/p' ${pjsip_rules} | sed -n -E 's/.*(--[0-9a-z=_-]+).*\\/\1/p')
-echo -e "Common args for pjsip:\n${pjsip_args_common}\n"
-echo "${pjsip_args_common}" > "$config_dir/pjsip_args_common"
-
-pjsip_args_linux=$(sed -n '/HAVE_LINUX/,/endif/p' ${pjsip_rules} | sed -n -E 's/.*(--[0-9a-z=_-]+).*/\1/p')
-echo -e "Linux args for pjsip:\n${pjsip_args_linux}\n"
-echo "${pjsip_args_linux}" > "$config_dir/pjsip_args_linux"
--- a/pkgs/applications/networking/instant-messengers/nchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nchat/default.nix
@ -0,0 +1,44 @@
+{ lib, stdenv,  fetchFromGitHub, cmake, gperf
+, file, ncurses, openssl, readline, sqlite, zlib
+, AppKit, Cocoa, Foundation
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nchat";
+  version = "3.17";
+
+  src = fetchFromGitHub {
+    owner = "d99kris";
+    repo = "nchat";
+    rev = "v${version}";
+    hash = "sha256-BtWKt8paI0gCGSzLYN8x3Yp5MUpwCb2vBGcGQG2aumY=";
+  };
+
+  postPatch = ''
+    substituteInPlace lib/tgchat/ext/td/CMakeLists.txt \
+      --replace "get_git_head_revision" "#get_git_head_revision"
+  '';
+
+  nativeBuildInputs = [ cmake gperf ];
+
+  buildInputs = [
+    file # for libmagic
+    ncurses
+    openssl
+    readline
+    sqlite
+    zlib
+  ] ++ lib.optional stdenv.isDarwin [ AppKit Cocoa Foundation ];
+
+  cmakeFlags = [
+    "-DHAS_WHATSAPP=OFF" # go module build required
+  ];
+
+  meta = with lib; {
+    description = "Terminal-based chat client with support for Telegram and WhatsApp";
+    homepage = "https://github.com/d99kris/nchat";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "signal-cli";
-  version = "0.11.6";
+  version = "0.11.7";

  # Building from source would be preferred, but is much more involved.
  src = fetchurl {
    url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}-Linux.tar.gz";
-    hash = "sha256-DWG67Jr2hDas1aL5Q+9MUjNKNLFpOFLsehYbJfy/rzg=";
+    hash = "sha256-oN80HQkPpJfhM4WBaRm4ytmhLjSokjEpfMhP6/XnQXs=";
  };

  buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@ -70,13 +70,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "freerdp";
-  version = "2.9.0";
+  version = "2.10.0";

  src = fetchFromGitHub {
    owner = "FreeRDP";
    repo = "FreeRDP";
    rev = version;
-    sha256 = "sha256-I9xJWHoY8fZ5T9zca77gFciC+7JdD6fMwV16giiY4FU=";
+    sha256 = "sha256-4sq3LblFRWCBREudtzg+o9wjstm58gPzBq7QAwlWvEg=";
  };

  postPatch = ''
--- a/pkgs/applications/radio/cloudlog/default.nix
+++ b/pkgs/applications/radio/cloudlog/default.nix
@ -1,18 +1,19 @@
 { lib
 , stdenvNoCC
 , fetchFromGitHub
+, nix-update-script
 , nixosTests
 , php}:

 stdenvNoCC.mkDerivation rec {
  name = "cloudlog";
-  version = "2.3.3";
+  version = "2.4";

  src = fetchFromGitHub {
    owner = "magicbug";
    repo = "Cloudlog";
    rev = version;
-    sha256 = "sha256-9m7BuUNdGeKqi8pzeW2J9zpxShulpynCwJJGkRFkBa4=";
+    sha256 = "sha256-aF1f6EmlcUgZOkHJgrW6P923QW56vWMH8CZ4cnYiiSk=";
  };

  postPath = ''
@ -25,8 +26,11 @@ stdenvNoCC.mkDerivation rec {
    cp -R ./* $out
  '';

-  passthru.tests = {
-    inherit (nixosTests) cloudlog;
+  passthru = {
+    tests = {
+      inherit (nixosTests) cloudlog;
+    };
+    updateScript = nix-update-script { };
  };

  meta = with lib; {
--- a/pkgs/applications/radio/quisk/default.nix
+++ b/pkgs/applications/radio/quisk/default.nix
@ -3,11 +3,11 @@

 python39Packages.buildPythonApplication rec {
  pname = "quisk";
-  version = "4.2.12";
+  version = "4.2.17";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "62b017d881139ed38bd906b0467b303fbdae17e5607e93b6b2fe929e26d0551d";
+    sha256 = "sha256-eF/3++wRG0JulVTT+GvtqleBPkzLSZeu+RfHDI1xfOY=";
  };

  buildInputs = [ fftw alsa-lib pulseaudio ];
--- a/pkgs/applications/science/biology/neuron/default.nix
+++ b/pkgs/applications/science/biology/neuron/default.nix
@ -1,94 +1,104 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
-, pkg-config
-, automake
-, autoconf
-, libtool
-, ncurses
 , readline
-, which
-, python ? null
-, useMpi ? false
+, xorg
 , mpi
-, iv
+, cmake
+, bison
+, flex
+, git
+, perl
+, gsl
+, xcbuild
+, python3
+, useMpi ? false
+, useIv ? true
+, useCore ? false
+, useRx3d ? false
 }:

+
 stdenv.mkDerivation rec {
-  pname = "neuron${lib.optionalString useMpi "-mpi"}";
-  version = "7.5";
+  pname = "neuron";
+  version = "8.2.1";

-  nativeBuildInputs = [ which pkg-config automake autoconf libtool ];
-  buildInputs = [ ncurses readline python iv ]
-    ++ lib.optional useMpi mpi;
+  # format is for pythonModule conversion
+  format = "other";

-  src = fetchurl {
-    url = "https://www.neuron.yale.edu/ftp/neuron/versions/v${version}/nrn-${version}.tar.gz";
-    sha256 = "0f26v3qvzblcdjg7isq0m9j2q8q7x3vhmkfllv8lsr3gyj44lljf";
-  };
+  nativeBuildInputs = [
+    cmake
+    bison
+    flex
+    git
+  ] ++ lib.optional useCore [ perl gsl ]
+  ++ lib.optional stdenv.isDarwin [ xcbuild ];

-  patches = (lib.optionals (stdenv.isDarwin) [ ./neuron-carbon-disable.patch ]);
+  buildInputs = lib.optional useIv [
+    xorg.libX11.dev
+    xorg.libXcomposite.dev
+    xorg.libXext.dev
+  ];

-  # With LLVM 3.8 and above, clang (really libc++) gets upset if you attempt to redefine these...
-  postPatch = lib.optionalString stdenv.cc.isClang ''
-    substituteInPlace src/gnu/neuron_gnu_builtin.h \
-      --replace 'double abs(double arg);' "" \
-      --replace 'float abs(float arg);' "" \
-      --replace 'short abs(short arg);' "" \
-      --replace 'long abs(long arg);' ""
-  '' + lib.optionalString stdenv.isDarwin ''
-    # we are darwin, but we don't have all the quirks the source wants to compensate for
-    substituteInPlace src/nrnpython/setup.py.in --replace 'readline="edit"' 'readline="readline"'
-    for f in src/nrnpython/*.[ch] ; do
-      substituteInPlace $f --replace "<Python/Python.h>" "<Python.h>"
+  propagatedBuildInputs = [
+    readline
+    python3
+    python3.pkgs.wheel
+    python3.pkgs.setuptools
+    python3.pkgs.scikit-build
+    python3.pkgs.matplotlib
+  ] ++ lib.optional useMpi [
+    mpi
+  ] ++ lib.optional useMpi [
+    python3.pkgs.mpi4py
+  ] ++ lib.optional useRx3d [
+    python3.pkgs.cython
+    python3.pkgs.numpy
+  ];
+
+  patches = [ ./neuron_darwin_rpath.patch ];
+
+  # Patch build shells for cmake (bin, src, cmake) and submodules (external)
+  postPatch = ''
+    patchShebangs ./bin ./src ./external ./cmake
+    sed -e 's#DESTDIR =#DESTDIR = '"$out"'#' -i external/coreneuron/extra/nrnivmodl_core_makefile.in
+  '';
+
+  cmakeFlags = [
+    "-DNRN_ENABLE_INTERVIEWS=${if useIv then "ON" else "OFF"}"
+    "-DNRN_ENABLE_MPI=${if useMpi then "ON" else "OFF"}"
+    "-DNRN_ENABLE_CORENEURON=${if useCore then "ON" else "OFF"}"
+    "-DNRN_ENABLE_RX3D=${if useRx3d then "ON" else "OFF"}"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/${python3.sitePackages}
+    mv $out/lib/python/* $out/${python3.sitePackages}/
+    rm -rf $out/lib/python build
+    for entry in $out/lib/*.so; do
+      # remove references to build
+      patchelf --set-rpath $(patchelf --print-rpath $entry | tr ':' '\n' | sed '/^\/build/d' | tr '\n' ':') $entry
    done
  '';

-  enableParallelBuilding = true;
-
-  ## neuron install by default everything under prefix/${host_arch}/*
-  ## override this to support nix standard file hierarchy
-  ## without issues: install everything under prefix/
-  preConfigure = ''
-    ./build.sh
-    export prefix="''${prefix} --exec-prefix=''${out}"
-  '';
-
-  configureFlags = with lib;
-                    [ "--with-readline=${readline}" "--with-iv=${iv}" ]
-                    ++  optionals (python != null)  [ "--with-nrnpython=${python.interpreter}" ]
-                    ++ (if useMpi then ["--with-mpi" "--with-paranrn"]
-                        else ["--without-mpi"]);
-
-
-  postInstall = lib.optionalString (python != null) ''
-    ## standardise python neuron install dir if any
-    if [[ -d $out/lib/python ]]; then
-        mkdir -p ''${out}/${python.sitePackages}
-        mv ''${out}/lib/python/*  ''${out}/${python.sitePackages}/
-    fi
-  '';
-
-  propagatedBuildInputs = [ readline ncurses which libtool ];
+  src = fetchurl {
+    url = "https://github.com/neuronsimulator/nrn/releases/download/${version}/full-src-package-${version}.tar.gz";
+    sha256 = "0kb0dn7nmivv3zflzkbj2fj3184zwp2crkxp0mdxkwm4kpnxqz0v";
+  };

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "Simulation environment for empirically-based simulations of neurons and networks of neurons";
-
-    longDescription = "NEURON is a simulation environment for developing and exercising models of
-                neurons and networks of neurons. It is particularly well-suited to problems where
-                cable properties of cells play an important role, possibly including extracellular
-                potential close to the membrane), and where cell membrane properties are complex,
-                involving many ion-specific channels, ion accumulation, and second messengers";
-
-    sourceProvenance = with sourceTypes; [
-      fromSource
-    ] ++ lib.optionals (python != null) [
-      binaryNativeCode  # "geometry3d" bundled libraries
-    ];
-    license     = licenses.bsd3;
-    homepage    = "http://www.neuron.yale.edu/neuron";
-    maintainers = [ maintainers.adev ];
-    # source claims it's only tested for x86 and powerpc
-    platforms   = platforms.x86_64 ++ platforms.i686;
+    longDescription = ''
+      NEURON is a simulation environment for developing and exercising models of
+      neurons and networks of neurons. It is particularly well-suited to problems where
+      cable properties of cells play an important role, possibly including extracellular
+      potential close to the membrane), and where cell membrane properties are complex,
+      involving many ion-specific channels, ion accumulation, and second messengers
+    '';
+    sourceProvenance = with sourceTypes; [ fromSource ];
+    license = licenses.bsd3;
+    homepage = "http://www.neuron.yale.edu/neuron";
+    maintainers = with maintainers; [ adev davidcromp ];
+    platforms = platforms.all;
  };
 }
--- a/pkgs/applications/science/biology/neuron/neuron-carbon-disable.patch
+++ b/pkgs/applications/science/biology/neuron/neuron-carbon-disable.patch
@ -1,21 +0,0 @@
--- nrn-7.4/src/mac/Makefile.am	2015-11-12 21:42:45.000000000 +0100
-+++ nrn-7.4.new/src/mac/Makefile.am	2016-08-24 17:43:39.000000000 +0200
-@@ -15,18 +15,8 @@
- host_cpu = @host_cpu@
- 
- if MAC_DARWIN
-carbon = @enable_carbon@
- bin_SCRIPTS = $(launch_scripts)
- install: install-am
-if UniversalMacBinary
-	$(CC) -arch ppc -o aoutppc -Dcpu="\"$(host_cpu)\"" -I. $(srcdir)/launch.c $(srcdir)/mac2uxarg.c -framework Carbon
-	$(CC) -arch i386 -o aouti386 -Dcpu="\"$(host_cpu)\"" -I. $(srcdir)/launch.c $(srcdir)/mac2uxarg.c -framework Carbon
-	lipo aouti386 aoutppc -create -output a.out
-else
-	gcc -g -arch i386 -Dncpu="\"$(host_cpu)\"" -I. $(srcdir)/launch.c $(srcdir)/mac2uxarg.c -framework Carbon
-
-endif
-	carbon=$(carbon) sh $(srcdir)/launch_inst.sh "$(host_cpu)" "$(DESTDIR)$(prefix)" "$(srcdir)"
- 	for i in $(S) ; do \
- 		sed "s/^CPU.*/CPU=\"$(host_cpu)\"/" < $(DESTDIR)$(bindir)/$$i > temp; \
- 		mv temp $(DESTDIR)$(bindir)/$$i; \
--- a/pkgs/applications/science/biology/neuron/neuron_darwin_rpath.patch
+++ b/pkgs/applications/science/biology/neuron/neuron_darwin_rpath.patch
@ -0,0 +1,11 @@
+--- a/src/nrnpython/setup.py.in
+++ b/src/nrnpython/setup.py.in
+@@ -124,7 +124,7 @@ libdirs = [destdir + get_escaped_path("@NRN_LIBDIR@"),
+ rpath_prefix_flag='-Wl,-R'
+ extra_link_args = [@NRN_LINK_FLAGS_COMMA_SEPARATED_STRINGS@]
+ @MAC_DARWIN_FALSE@extra_link_args += [rpath_prefix_flag+lib_path for lib_path in libdirs]
+-@MAC_DARWIN_TRUE@extra_link_args.append("-Wl,-rpath,@loader_path/../../")
+@MAC_DARWIN_TRUE@extra_link_args.append("-Wl,-rpath,@loader_path/../../../")
+ @MAC_DARWIN_TRUE@extra_link_args.append("-Wl,-rpath,%s" % ivlibdir)
+
+ # as neuron module will be built during make, add build/lib
--- a/pkgs/applications/science/electronics/nvc/default.nix
+++ b/pkgs/applications/science/electronics/nvc/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "nvc";
-  version = "1.8.1";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "nickg";
    repo = pname;
    rev = "r${version}";
-    hash = "sha256-9ziGNAZgUYnBofx7YwSzAgL4zIAwoPYMsGWBYs+xtg0=";
+    hash = "sha256-s7QgufD3sQ6sZh2H78E8x0dMidHRKHUm8tASXoKK3xk=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@ -15,12 +15,12 @@

 buildGoModule rec {
  pname = "gitea";
-  version = "1.18.4";
+  version = "1.18.5";

  # not fetching directly from the git repo, because that lacks several vendor files for the web UI
  src = fetchurl {
    url = "https://dl.gitea.io/gitea/${version}/gitea-src-${version}.tar.gz";
-    hash = "sha256-LSSOmqSeiv9qNCAsRWYtjRLfUDLMd8mOVAxTOacvNOA=";
+    hash = "sha256-OGPn4fknYfzmuAi6CL8m/Ih4uRNraVDmpBm20qT3lKk=";
  };

  vendorHash = null;
--- a/pkgs/applications/video/ani-cli/default.nix
+++ b/pkgs/applications/video/ani-cli/default.nix
@ -12,13 +12,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "ani-cli";
-  version = "4.0";
+  version = "4.1";

  src = fetchFromGitHub {
    owner = "pystardust";
    repo = "ani-cli";
    rev = "v${version}";
-    hash = "sha256-1yhBlQ/abT+/BKEIskgnAh+cmKCzXuS9hu6apaangVk=";
+    hash = "sha256-8fpOCyv/XafrVy76jtazRoHW2gidjikgnRdaWzh8kY8=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/video/streamlink/default.nix
+++ b/pkgs/applications/video/streamlink/default.nix
@ -6,12 +6,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "streamlink";
-  version = "5.2.1";
+  version = "5.3.0";
  format = "pyproject";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    hash = "sha256-/YcFH5t9x9EsmK7oPvSECmhL2ypHYgPvsMdL1IupEfw=";
+    hash = "sha256-+9MSSzPYZ8gwOeQLehR41SklfdcUn8Pa6TI//lh9twE=";
  };

  nativeCheckInputs = with python3Packages; [
--- a/pkgs/data/fonts/andika/default.nix
+++ b/pkgs/data/fonts/andika/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "andika";
-  version = "6.101";
+  version = "6.200";

  src = fetchzip {
    url = "https://software.sil.org/downloads/r/andika/Andika-${version}.zip";
-    hash = "sha256-LghkGd/cjuXghzsU9X/YneNIdBeDEnu0ARszipANm8w=";
+    hash = "sha256-Ge+Yq3+1IJ+mXhjw7Vtpu5DIWiMfwOdEH/S1RSzYh3A=";
  };

  installPhase = ''
--- a/pkgs/data/fonts/cozette/default.nix
+++ b/pkgs/data/fonts/cozette/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cozette";
-  version = "1.19.0";
+  version = "1.19.1";

  src = fetchzip {
    url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts.zip";
-    hash = "sha256-nlEnQjQJAFRvZgdGMiloMs4afugmSFnITTIHD+Qkggg=";
+    hash = "sha256-CpabWJJDCY+mgE+9U8L50MmWVfhkm+LnfMQtOTXyE8s=";
  };

  installPhase = ''
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202302160443";
+  version = "202302200325";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "f8fbab498f52848317db703f57f0c839e81cd587";
-    sha256 = "sha256-9LZxVNhigy2cO41d8nZtFrfDoCjJTdzrGUZpmjcpje8=";
+    rev = "c642604d56dbe9b426871e3a47e18eba3d3d3850";
+    sha256 = "sha256-tsDoz/2b0InjLWfgi2Jcs8BpscQ0SFA6+tVZIw6JQGA=";
  };

  installPhase = ''
--- a/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome/core/epiphany/default.nix
@ -38,11 +38,11 @@

 stdenv.mkDerivation rec {
  pname = "epiphany";
-  version = "43.0";
+  version = "43.1";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "tm1Jn57nJpbYPPhEElN3GBqVRVSkuzeFtzKTOArAwic=";
+    sha256 = "6G6tJ8uZgoFRUGZN478g+vN193uAZbArMRgMZba767Q=";
  };

  patches = lib.optionals withPantheon [
--- a/pkgs/development/compilers/xa/dxa.nix
+++ b/pkgs/development/compilers/xa/dxa.nix
@ -4,14 +4,14 @@
 , installShellFiles
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
  pname = "dxa";
  version = "0.1.5";

  src = fetchurl {
    urls = [
-      "https://www.floodgap.com/retrotech/xa/dists/${pname}-${version}.tar.gz"
-      "https://www.floodgap.com/retrotech/xa/dists/unsupported/${pname}-${version}.tar.gz"
+      "https://www.floodgap.com/retrotech/xa/dists/dxa-${self.version}.tar.gz"
+      "https://www.floodgap.com/retrotech/xa/dists/unsupported/dxa-${self.version}.tar.gz"
    ];
    hash = "sha256-jkDtd4FlgfmtlaysLtaaL7KseFDkM9Gc1oQZOkWCZ5k=";
  };
@ -27,17 +27,18 @@ stdenv.mkDerivation rec {

  installPhase = ''
    runHook preInstall
-    install -d $out/bin/
-    install dxa $out/bin/
+
+    install -Dm755 -T dxa $out/bin/dxa
    installManPage dxa.1
+
    runHook postInstall
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://www.floodgap.com/retrotech/xa/";
    description = "Andre Fachat's open-source 6502 disassembler";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; unix;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = with lib.platforms; unix;
  };
-}
+})
--- a/pkgs/development/compilers/xa/xa.nix
+++ b/pkgs/development/compilers/xa/xa.nix
@ -4,16 +4,16 @@
 , perl
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
  pname = "xa";
-  version = "2.3.13";
+  version = "2.3.14";

  src = fetchurl {
    urls = [
-      "https://www.floodgap.com/retrotech/xa/dists/${pname}-${version}.tar.gz"
-      "https://www.floodgap.com/retrotech/xa/dists/unsupported/${pname}-${version}.tar.gz"
+      "https://www.floodgap.com/retrotech/xa/dists/xa-${self.version}.tar.gz"
+      "https://www.floodgap.com/retrotech/xa/dists/unsupported/xa-${self.version}.tar.gz"
    ];
-    hash = "sha256-qUd68VC2yKkc09QeHPjJ31UtODMmSVV2gwJxykRnvYY=";
+    hash = "sha256-G5u6vdvY07lBC4UuUKEo7qQeaBM55vdsPoB2+lQg8C4=";
  };

  nativeCheckInputs = [ perl ];
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
    patchShebangs tests
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://www.floodgap.com/retrotech/xa/";
    description = "Andre Fachat's open-source 6502 cross assembler";
    longDescription = ''
@ -62,8 +62,8 @@ stdenv.mkDerivation rec {
        suite, as well as "bare" plain binary object files
      - block structure for label scoping
    '';
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; unix;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = with lib.platforms; unix;
  };
-}
+})
--- a/pkgs/development/dotnet-modules/python-language-server/default.nix
+++ b/pkgs/development/dotnet-modules/python-language-server/default.nix
@ -1,46 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, buildDotnetModule
-, dotnetCorePackages
-, stdenvNoCC
-, autoPatchelfHook
-, openssl
-, icu
-}:
-
-buildDotnetModule rec {
-  pname = "python-language-server";
-  version = "2022-02-18";
-
-  src = fetchFromGitHub {
-    owner = "microsoft";
-    repo = "python-language-server";
-    rev = "52c1afd34b5acb0b44597bb8681232876fe94084";
-    sha256 = "05s8mwi3dqzjghgpr1mfs1b7cgrq818bbj1v7aly6axc8c2n4gny";
-  };
-
-  projectFile = "src/LanguageServer/Impl/Microsoft.Python.LanguageServer.csproj";
-  nugetDeps = ./deps.nix;
-
-  dotnet-sdk = dotnetCorePackages.sdk_3_1;
-  dotnet-runtime = dotnetCorePackages.runtime_3_1;
-
-  nativeBuildInputs = [ autoPatchelfHook ];
-  buildInputs = [ stdenv.cc.cc.lib ];
-  runtimeDeps = [ openssl icu ];
-
-  postFixup = ''
-    mv $out/bin/Microsoft.Python.LanguageServer $out/bin/python-language-server
-  '';
-
-  passthru.updateScript = ./updater.sh;
-
-  meta = with lib; {
-    description = "Microsoft Language Server for Python";
-    homepage = "https://github.com/microsoft/python-language-server";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ thomasjm ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
--- a/pkgs/development/dotnet-modules/python-language-server/deps.nix
+++ b/pkgs/development/dotnet-modules/python-language-server/deps.nix
@ -1,107 +0,0 @@
-# This file was automatically generated by passthru.fetch-deps.
-# Please dont edit it manually, your changes might get overwritten!
-
-{ fetchNuGet }: [
-  (fetchNuGet { pname = "MessagePack"; version = "2.1.90"; sha256 = "1j5wjl7aq7nn5ga3j6zaaivdf2wlfyd7w66ak0i7krgrmv26lb8i"; })
-  (fetchNuGet { pname = "MessagePack.Annotations"; version = "2.1.90"; sha256 = "08sghhwbz8h7ji9lg0klhwcyndxg6v11pq9jac975sb38samnm11"; })
-  (fetchNuGet { pname = "MicroBuild.Core"; version = "0.3.0"; sha256 = "190d755l60j3l5m1661wj19gj9w6ngza56q3vkijkkmbbabdmqln"; })
-  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "1.0.0"; sha256 = "00dx5armvkqjxvkldz3invdlck9nj7w21dlsr2aqp1rqbyrbsbbh"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileSystemGlobbing"; version = "3.1.8"; sha256 = "1v2lr0vbssqayzgxvdwb54jmvz7mvlih4l9h7i71gm3c62nlbq8y"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.1"; sha256 = "164wycgng4mi9zqi2pnsf1pq6gccbqvw6ib916mqizgjmd8f44pj"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "3.0.0"; sha256 = "1bk8r4r3ihmi6322jmcag14jmw11mjqys202azqjzglcx59pxh51"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
-  (fetchNuGet { pname = "Microsoft.VisualStudio.Threading"; version = "16.6.13"; sha256 = "0qbvcwy7njz5zpqgfqdf41gf9xqcz64z4rkfjf6bi4zynpkv6n1l"; })
-  (fetchNuGet { pname = "Microsoft.VisualStudio.Threading.Analyzers"; version = "16.6.13"; sha256 = "09nqkjnarwj0chb6xrzscq98mpgi86n2a3mfdd3y695kviq99s18"; })
-  (fetchNuGet { pname = "Microsoft.VisualStudio.Validation"; version = "15.5.31"; sha256 = "1ah99rn922qa0sd2k3h64m324f2r32pw8cn4cfihgvwx4qdrpmgw"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.6.0"; sha256 = "0i4y782yrqqyx85pg597m20gm0v126w0j9ddk5z7xb3crx4z9f2s"; })
-  (fetchNuGet { pname = "Nerdbank.Streams"; version = "2.5.76"; sha256 = "017h8m1zrm247alhlz4vqsz580b8b88s50cyxb939hmc2nn0qlfv"; })
-  (fetchNuGet { pname = "NETStandard.Library"; version = "2.0.3"; sha256 = "1fn9fxppfcg4jgypp2pmrpr6awl3qz1xmnri0cygpkwvyx27df1y"; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "12.0.3"; sha256 = "17dzl305d835mzign8r15vkmav2hq8l6g7942dfjpnzr17wwl89x"; })
-  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
-  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "00j6nv2xgmd3bi347k00m7wr542wjlig53rmj28pmw7ddcn97jbn"; })
-  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
-  (fetchNuGet { pname = "runtime.any.System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1ghhhk5psqxcg6w88sxkqrc35bxcz27zbqm2y5p5298pv3v7g201"; })
-  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; sha256 = "0l8xz8zn46w4d10bcn3l4yyn4vhb3lrj2zw8llvz7jk14k4zps5x"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; sha256 = "02c9h3y35pylc0zfq3wcsvc5nqci95nrkq0mszifc0sjx7xrzkly"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.3.0"; sha256 = "0x1mm8c6iy8rlxm8w9vqw7gb7s1ljadrn049fmf70cyh42vdfhrf"; })
-  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "03kickal0iiby82wa5flar18kyv82s9s6d4xhk5h4bi5kfcyfjzl"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.3.0"; sha256 = "1cqh1sv3h5j7ixyb7axxbdkqx6cxy00p4np4j91kpm492rf4s25b"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; sha256 = "0bh5bi25nk9w9xi8z23ws45q5yia6k7dg3i4axhfqlnj145l011x"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "0c3g3g3jmhlhw4klrc86ka9fjbl7i59ds1fadsb2l8nqf8z3kb19"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; sha256 = "0aqqi1v4wx51h51mk956y783wzags13wa7mgqyclacmsmpv02ps3"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "0lqhgqi0i8194ryqq6v2gqx0fb86db2gqknbm0aq31wb378j7ip8"; })
-  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; sha256 = "03mnvkhskbzxddz4hm113zsch1jyzh2cs450dk3rgfjp8crlw1va"; })
-  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "0rwpqngkqiapqc5c2cpkj7idhngrgss5qpnqg0yh40mbyflcxf8i"; })
-  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "1n06gxwlinhs0w7s8a94r1q3lwqzvynxwd3mp10ws9bg6gck8n4r"; })
-  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "0404wqrc7f2yc0wxv71y3nnybvqx8v4j9d47hlscxy759a525mc3"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
-  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; sha256 = "1n6rgz5132lcibbch1qlf0g9jk60r0kqv087hxc0lisy50zpm7kk"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "1b61p6gw1m02cc1ry996fl49liiwky6181dzr873g9ds92zl326q"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "0zy5r25jppz48i2bkg8b9lfig24xixg6nm3xyr1379zdnqnpm8f6"; })
-  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "096ch4n4s8k82xga80lfmpimpzahd2ip1mgwdqgar0ywbbl6x438"; })
-  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "1dm8fifl7rf1gy7lnwln78ch4rw54g0pl5g1c189vawavll7p6rj"; })
-  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "10yc8jdrwgcl44b4g93f1ds76b176bajd3zqi2faf5rvh1vy9smi"; })
-  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "1m9z1k9kzva9n9kwinqxl97x2vgl79qhqjlv17k9s2ymcyv2bwr6"; })
-  (fetchNuGet { pname = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "1cpx56mcfxz7cpn57wvj18sjisvzq8b5vd9rw16ihd2i6mcp3wa1"; })
-  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "15gsm1a8jdmgmf8j5v1slfz8ks124nfdhk2vxs2rw3asrxalg8hi"; })
-  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "0q0n5q1r1wnqmr5i5idsrd9ywl33k0js4pngkwq9p368mbxp8x1w"; })
-  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; sha256 = "1x0g58pbpjrmj2x2qw17rdwwnrcl0wvim2hdwz48lixvwvp22n9c"; })
-  (fetchNuGet { pname = "runtime.unix.Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0y61k9zbxhdi0glg154v30kkq7f8646nif8lnnxbvkjpakggd5id"; })
-  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "1lps7fbnw34bnh3lm31gs5c0g0dh7548wfmb8zz62v0zqz71msj5"; })
-  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; sha256 = "14nbkhvs7sji5r1saj2x8daz82rnf9kx28d3v2qss34qbr32dzix"; })
-  (fetchNuGet { pname = "runtime.unix.System.Net.Primitives"; version = "4.3.0"; sha256 = "0bdnglg59pzx9394sy4ic66kmxhqp8q8bvmykdxcbs5mm0ipwwm4"; })
-  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; sha256 = "1jx02q6kiwlvfksq1q9qr17fj78y5v6mwsszav4qcz9z25d5g6vk"; })
-  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
-  (fetchNuGet { pname = "StreamJsonRpc"; version = "2.5.46"; sha256 = "0rsgxfxcfgbx1w2jhllx1cwnbj9vra6034gv4kgzahh0v5vn8shf"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.5.0"; sha256 = "1ywfqn4md6g3iilpxjn5dsr0f5lx6z0yvhqp4pgjcamygg73cz2c"; })
-  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
-  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
-  (fetchNuGet { pname = "System.Collections.Immutable"; version = "1.5.0"; sha256 = "1d5gjn5afnrf461jlxzawcvihz195gayqpcfbv6dd7pxa9ialn06"; })
-  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
-  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.3.0"; sha256 = "0z6m3pbiy0qw6rn3n209rrzf9x1k4002zh90vwcrsym09ipm2liq"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
-  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
-  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq"; })
-  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; sha256 = "02a5zfxavhv3jd437bsncbhd2fp1zv4gxzakp1an9l6kdq1mcqls"; })
-  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
-  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw"; })
-  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; sha256 = "0j6ndgglcf4brg2lz4wzsh1av1gh8xrzdsn9f0yznskhqn1xzj9c"; })
-  (fetchNuGet { pname = "System.IO.Pipelines"; version = "4.7.0"; sha256 = "1cx6bl2bhzp30ahy2csnwbphmlwwp840j56wgab105xc32la0mg4"; })
-  (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
-  (fetchNuGet { pname = "System.Memory"; version = "4.5.3"; sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a"; })
-  (fetchNuGet { pname = "System.Net.Http"; version = "4.3.4"; sha256 = "0kdp31b8819v88l719j6my0yas6myv9d1viql3qz5577mv819jhl"; })
-  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; sha256 = "0c87k50rmdgmxx7df2khd9qj7q35j9rzdmm2572cc55dygmdk3ii"; })
-  (fetchNuGet { pname = "System.Net.WebSockets"; version = "4.3.0"; sha256 = "1gfj800078kggcgl0xyl00a6y5k4wwh2k2qm69rjy22wbmq7fy4p"; })
-  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
-  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
-  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.6.0"; sha256 = "18h375q5bn9h7swxnk4krrxym1dxmi9bm26p89xps9ygrj4q6zqw"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.6.0"; sha256 = "0hry2k6b7kicg4zxnq0hhn0ys52711pxy7l9v5sp7gvp9cicwpgp"; })
-  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
-  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
-  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.5.2"; sha256 = "1vz4275fjij8inf31np78hw50al8nqkngk04p3xv5n4fcmf1grgi"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.6.0"; sha256 = "0xmzi2gpbmgyfr75p24rqqsba3cmrqgmcv45lsqp5amgrdwd0f0m"; })
-  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
-  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
-  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
-  (fetchNuGet { pname = "System.Security.AccessControl"; version = "4.6.0"; sha256 = "1wl1dyghi0qhpap1vgfhg2ybdyyhy9vc2a7dpm1xb30vfgmlkjmf"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; sha256 = "1x5wcrddf2s3hb8j78cry7yalca4lb5vfnkrysagbn6r9x6xvrx1"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; sha256 = "1jr6w70igqn07k5zs1ph6xja97hxnb3mqbspdrff6cvssgrixs32"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h"; })
-  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.6.0"; sha256 = "1jmfzfz1n8hp63s5lja5xxpzkinbp6g59l3km9h8avjiisdrg5wm"; })
-  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
-  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
-  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
-  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Dataflow"; version = "4.9.0"; sha256 = "1g6s9pjg4z8iy98df60y9a01imdqy59zd767vz74rrng78jl2dk5"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.3"; sha256 = "0g7r6hm572ax8v28axrdxz1gnsblg6kszq17g51pj14a5rn2af7i"; })
-  (fetchNuGet { pname = "System.ValueTuple"; version = "4.5.0"; sha256 = "00k8ja51d0f9wrq4vv5z2jhq8hy31kac2rg0rv06prylcybzl8cy"; })
-]
--- a/pkgs/development/dotnet-modules/python-language-server/updater.sh
+++ b/pkgs/development/dotnet-modules/python-language-server/updater.sh
@ -1,23 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p gnused jq common-updater-scripts nix-prefetch-git
-set -eo pipefail
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-deps_file="$(realpath ./deps.nix)"
-
-nix-prefetch-git https://github.com/microsoft/python-language-server --quiet > repo_info
-new_version="$(jq -r ".date" < repo_info | cut -d"T" -f1)"
-new_hash="$(jq -r ".sha256" < repo_info)"
-new_rev="$(jq -r ".rev" < repo_info)"
-rm repo_info
-
-old_rev="$(sed -nE 's/\s*rev = "(.*)".*/\1/p' ./default.nix)"
-
-if [[ $new_rev == $old_rev ]]; then
-  echo "Already up to date!"
-  exit 0
-fi
-
-pushd ../../../..
-update-source-version python-language-server "$new_version" "$new_hash" --rev="$new_rev"
-$(nix-build -A python-language-server.fetch-deps --no-out-link) "$deps_file"
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@ -25,13 +25,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "amdvlk";
-  version = "2022.Q4.4";
+  version = "2023.Q1.2";

  src = fetchRepoProject {
    name = "${pname}-src";
    manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
    rev = "refs/tags/v-${version}";
-    sha256 = "sha256-MKU7bfjrvH4M2kON2tr5463nYjN1xoGAknsC9YmklEc=";
+    sha256 = "sha256-QNjBLOnSfCTA+5qLqejAqJv9eIWAEVNc/VrhidGjmTc=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "belle-sip";
-  version = "5.2.16";
+  version = "5.2.23";

  src = fetchFromGitLab {
    domain = "gitlab.linphone.org";
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    group = "BC";
    repo = pname;
    rev = version;
-    sha256 = "sha256-LMbQz22ENTT27jr9tGakzNjidC5nfCuLDMZ6sFwtRKI=";
+    sha256 = "sha256-c73PCM+bRz6CjGRY2AapEcvKC1UqyEfzb7qsicmrkQU=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/edencommon/default.nix
+++ b/pkgs/development/libraries/edencommon/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "edencommon";
-  version = "2023.01.30.00";
+  version = "2023.02.13.00";

  src = fetchFromGitHub {
    owner = "facebookexperimental";
    repo = "edencommon";
    rev = "v${version}";
-    sha256 = "sha256-N3/Ey0zrfOfuAaS6qIpEgUUL5GkCZrqpAspJ7OprLPk=";
+    sha256 = "sha256-WxxE7ePZuNkSKRQG5Vni51xrrZT6BsKwwvhzykQf9X4=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "libdeltachat";
-  version = "1.108.0";
+  version = "1.109.0";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-core-rust";
    rev = version;
-    hash = "sha256-6nEjSo0EuYJd9/0NyvTzfUON1OMJt5FBLx7Y8sjnb3I=";
+    hash = "sha256-6zlXa9N7gaF1ta6mjszsA25+QRrHF8m1brKoSiL5OHo=";
  };

  patches = [
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-/tCEiPvoIPScpKcDmJ0t21AN+bOBH5/XzOBajQg+7ck=";
+    hash = "sha256-Z7CLKhKWqAaLhsXi81OOKWmwQddHCebCJibbKiNNptk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@ -12,7 +12,13 @@ let
    then "DYLD_LIBRARY_PATH"
    else "LD_LIBRARY_PATH";

-  generic = { version, hash, patches ? [] }: stdenv.mkDerivation rec {
+  generic =
+    { version
+    , hash
+    , patches ? []
+    , knownVulnerabilities ? []
+    }: stdenv.mkDerivation rec
+  {
    pname = "libressl";
    inherit version;

@ -80,6 +86,7 @@ let
      license = with licenses; [ publicDomain bsdOriginal bsd0 bsd3 gpl3 isc openssl ];
      platforms   = platforms.all;
      maintainers = with maintainers; [ thoughtpolice fpletz ];
+      inherit knownVulnerabilities;
    };
  };

@ -87,11 +94,22 @@ in {
  libressl_3_4 = generic {
    version = "3.4.3";
    hash = "sha256-/4i//jVIGLPM9UXjyv5FTFAxx6dyFwdPUzJx1jw38I0=";
+    knownVulnerabilities = [ "Support ended 2022-10-14." ];
+    patches = [
+      (fetchpatch {
+        # https://marc.info/?l=libressl&m=167582148932407&w=2
+        name = "backport-type-confusion-fix.patch";
+        url = "https://raw.githubusercontent.com/libressl/portable/30dc760ed1d7c70766b135500950d8ca9d17b13a/patches/x509_genn.c.diff";
+        sha256 = "sha256-N9jsOueqposDWZwaR+n/v/cHgNiZbZ644d8/wKjN2/M=";
+        stripLen = 2;
+        extraPrefix = "crypto/";
+      })
+    ];
  };

  libressl_3_5 = generic {
-    version = "3.5.3";
-    hash = "sha256-OrXl6u9pziDGsXDuZNeFtCI19I8uYrCV/KXXtmcriyg=";
+    version = "3.5.4";
+    hash = "sha256-A3naE0Si9xrUpOO+MO+dgu7N3Of43CrmZjGh3+FDQ6w=";

    patches = [
      # Fix endianness detection on aarch64-darwin, issue #181187
@ -104,7 +122,7 @@ in {
  };

  libressl_3_6 = generic {
-    version = "3.6.1";
-    hash = "sha256-rPrGExbpO5GcKNYtUwN8pzTehcRrTXA/Gf2Dlc8AZ3Q=";
+    version = "3.6.2";
+    hash = "sha256-S+gP/wc3Rs9QtKjlur4nlayumMaxMqngJRm0Rd+/0DM=";
  };
 }
--- a/pkgs/development/libraries/libubox/default.nix
+++ b/pkgs/development/libraries/libubox/default.nix
@ -1,8 +1,8 @@
-{ stdenv, lib, fetchgit, cmake, pkg-config, json_c, with_lua ? false, lua5_1 }:
+{ stdenv, lib, fetchgit, cmake, pkg-config, json_c, with_lua ? false, lua5_1, with_ustream_ssl ? false, ustream-ssl }:

 stdenv.mkDerivation {
  pname = "libubox";
-  version = "unstable-2023-01-03";
+  version = "unstable-2023-01-03${lib.optionalString with_ustream_ssl "-${ustream-ssl.ssl_implementation.pname}"}";

  src = fetchgit {
    url = "https://git.openwrt.org/project/libubox.git";
@ -13,7 +13,14 @@ stdenv.mkDerivation {
  cmakeFlags = [ "-DBUILD_EXAMPLES=OFF" (if with_lua then "-DLUAPATH=${placeholder "out"}/lib/lua" else "-DBUILD_LUA=OFF") ];

  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ json_c ] ++ lib.optional with_lua lua5_1;
+  buildInputs = [ json_c ] ++ lib.optional with_lua lua5_1 ++ lib.optional with_ustream_ssl ustream-ssl;
+
+  postInstall = lib.optionalString with_ustream_ssl ''
+    for fin in $(find ${ustream-ssl} -type f); do
+      fout="''${fin/"${ustream-ssl}"/"''${out}"}"
+      ln -s "$fin" "$fout"
+    done
+  '';

  meta = with lib; {
    description = "C utility functions for OpenWrt";
--- a/pkgs/development/libraries/science/math/nccl/default.nix
+++ b/pkgs/development/libraries/science/math/nccl/default.nix
@ -1,14 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, which, cudatoolkit, addOpenGLRunpath }:
+{ lib, stdenv, fetchFromGitHub, which, cudaPackages, addOpenGLRunpath }:
+
+let
+  inherit (cudaPackages) cudatoolkit;
+in

 stdenv.mkDerivation rec {
  name = "nccl-${version}-cuda-${cudatoolkit.majorVersion}";
-  version = "2.12.10-1";
+  version = "2.16.5-1";

  src = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "nccl";
    rev = "v${version}";
-    sha256 = "sha256-QqORzm0gD+QG+P8rId8bQn2oZsxL5YyxCIobUVs85wE=";
+    hash = "sha256-JyhhYKSVIqUKIbC1rCJozPT1IrIyRLGrTjdPjJqsYaU=";
  };

  outputs = [ "out" "dev" ];
@ -39,7 +43,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  passthru = {
-    inherit cudatoolkit;
+    inherit cudaPackages;
  };

  meta = with lib; {
--- a/pkgs/development/libraries/thrift/default.nix
+++ b/pkgs/development/libraries/thrift/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "thrift";
-  version = "0.17.0";
+  version = "0.18.0";

  src = fetchurl {
    url = "https://archive.apache.org/dist/thrift/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-snLBeIuxZdmVIaJZmzG5f6aeWTHQmQFdka4QegsMxY8=";
+    hash = "sha256-fBk4nLeRCiDli45GkDyMGjY1MAj5/MGwP3SKzPm18+E=";
  };

  # Workaround to make the Python wrapper not drop this package:
@ -74,6 +74,11 @@ stdenv.mkDerivation rec {
      url = "https://github.com/apache/thrift/commit/2ab850824f75d448f2ba14a468fb77d2594998df.diff";
      hash = "sha256-ejMKFG/cJgoPlAFzVDPI4vIIL7URqaG06/IWdQ2NkhY=";
    })
+    (fetchpatch {
+      name = "thrift-fix-tests-OpenSSL3.patch"; # https://github.com/apache/thrift/pull/2760
+      url = "https://github.com/apache/thrift/commit/eae3ac418f36c73833746bcd53e69ed8a12f0e1a.diff";
+      hash = "sha256-0jlN4fo94cfGFUKcLFQgVMI/x7uxn5OiLiFk6txVPzs=";
+    })
  ];

  cmakeFlags = [
@ -90,6 +95,7 @@ stdenv.mkDerivation rec {

  disabledTests = [
    "PythonTestSSLSocket"
+    "PythonThriftTNonblockingServer"
  ] ++ lib.optionals stdenv.isDarwin [
    # Tests that hang up in the Darwin sandbox
    "SecurityTest"
@ -106,7 +112,6 @@ stdenv.mkDerivation rec {
    "StressTest"
    "StressTestConcurrent"
    "StressTestNonBlocking"
-    "PythonThriftTNonblockingServer"
  ];

  doCheck = !static;
--- a/pkgs/development/libraries/tinygltf/default.nix
+++ b/pkgs/development/libraries/tinygltf/default.nix
@ -6,14 +6,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "2.8.2";
+  version = "2.8.3";
  pname = "tinygltf";

  src = fetchFromGitHub {
    owner = "syoyo";
    repo = "tinygltf";
    rev = "v${version}";
-    sha256 = "sha256-0O+Vfsd1omCXeSGdjLZ29yTutC+527NCIBm6hU3qKj4=";
+    sha256 = "sha256-6rfC5nXGseXtqh2IonZto+DM8ZV/t5U1ulZ3GFHwoeg=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/uclient/default.nix
+++ b/pkgs/development/libraries/uclient/default.nix
@ -0,0 +1,30 @@
+{ stdenv, lib, fetchgit, cmake, pkg-config, libubox }:
+
+stdenv.mkDerivation {
+  pname = "uclient";
+  version = "unstable-2022-02-24";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/uclient.git";
+    rev = "644d3c7e13c6a64bf5cb628137ee5bd4dada4b74";
+    sha256 = "0vy4whs64699whp92d1zl7a8kh16yrfywqq0yp2y809l9z19sw22";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buidInputs = [ libubox ];
+
+  preConfigure = ''
+    sed -e 's|ubox_include_dir libubox/ustream-ssl.h|ubox_include_dir libubox/ustream-ssl.h HINTS ${libubox}/include|g' \
+        -e 's|ubox_library NAMES ubox|ubox_library NAMES ubox HINTS ${libubox}/lib|g' \
+        -i CMakeLists.txt
+  '';
+
+  meta = with lib; {
+    description = "Tiny OpenWrt fork of libnl";
+    homepage = "https://git.openwrt.org/?p=project/uclient.git;a=summary";
+    license = licenses.isc;
+    maintainers = with maintainers; [ mkg20001 ];
+    mainProgram = "uclient-fetch";
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/libraries/ustream-ssl/default.nix
+++ b/pkgs/development/libraries/ustream-ssl/default.nix
@ -0,0 +1,37 @@
+{ stdenv, lib, fetchgit, cmake, pkg-config, libubox-nossl, ssl_implementation }:
+
+stdenv.mkDerivation {
+  pname = "ustream-ssl";
+  version = "unstable-2022-12-08-${ssl_implementation.pname}";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/ustream-ssl.git";
+    rev = "9217ab46536353c7c792951b57163063f5ec7a3b";
+    sha256 = "1ldyyb3is213iljyccx98f56rb69rfpgdcb1kjxw9a176hvpipdd";
+  };
+
+  preConfigure = ''
+    sed -r \
+        -e "s|ubox_include_dir libubox/ustream.h|ubox_include_dir libubox/ustream.h HINTS ${libubox-nossl}/include|g" \
+        -e "s|ubox_library NAMES ubox|ubox_library NAMES ubox HINTS ${libubox-nossl}/lib|g" \
+        -e "s|^  FIND_LIBRARY\((.+)\)|  FIND_LIBRARY\(\1 HINTS ${if ssl_implementation ? lib then ssl_implementation.lib else ssl_implementation.out}\)|g" \
+        -i CMakeLists.txt
+  '';
+
+  cmakeFlags = [ "-D${lib.toUpper ssl_implementation.pname}=ON" ];
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ ssl_implementation ];
+
+  passthru = {
+    inherit ssl_implementation;
+  };
+
+  meta = with lib; {
+    description = "ustream SSL wrapper";
+    homepage = "https://git.openwrt.org/?p=project/ustream-ssl.git;a=summary";
+    license = licenses.isc;
+    maintainers = with maintainers; [ fpletz ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/ocaml-modules/sha/default.nix
+++ b/pkgs/development/ocaml-modules/sha/default.nix
@ -2,12 +2,12 @@

 buildDunePackage rec {
  pname = "sha";
-  version = "1.15.2";
+  version = "1.15.4";
  duneVersion = "3";

  src = fetchurl {
-    url = "https://github.com/djs55/ocaml-${pname}/releases/download/${version}/${pname}-${version}.tbz";
-    hash = "sha256-P71Xs5p8QAaOtBrh7MuhQJOL6144BqTLvXlZOyGD/7c=";
+    url = "https://github.com/djs55/ocaml-${pname}/releases/download/v${version}/${pname}-${version}.tbz";
+    hash = "sha256-beWxITmxmZzp30zHiloxiGwqVHydRIvyhT+LU7zx8bE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiocurrencylayer/default.nix
+++ b/pkgs/development/python-modules/aiocurrencylayer/default.nix
@ -11,16 +11,16 @@

 buildPythonPackage rec {
  pname = "aiocurrencylayer";
-  version = "1.0.4";
+  version = "1.0.5";
  format = "pyproject";

-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "home-assistant-ecosystem";
    repo = pname;
-    rev = version;
-    sha256 = "sha256-neWUld/XnF5xTHSrw5EfGfNhpYzZi5TZsWN4+eqsVXs=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-468OBQV7ISnPRUfi/CM3dCh1ez0jwSVnM6DduPvAgPI=";
  };

  nativeBuildInputs = [
@ -44,6 +44,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python API for interacting with currencylayer";
    homepage = "https://github.com/home-assistant-ecosystem/aiocurrencylayer";
+    changelog = "https://github.com/home-assistant-ecosystem/aiocurrencylayer/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/ascii-magic/default.nix
+++ b/pkgs/development/python-modules/ascii-magic/default.nix
@ -3,16 +3,20 @@
 , colorama
 , fetchPypi
 , pillow
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "ascii-magic";
-  version = "1.6";
+  version = "2.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    pname = "ascii_magic";
    inherit version;
-    sha256 = "sha256-faVRj3No5z8R4hUaDAYIBKoUniZ7Npt+52U/vXsEalE=";
+    hash = "sha256-YfGa+3nuqAAo69TydxO6uKNMcqZAkOEi/PMP8Frasfw=";
  };

  propagatedBuildInputs = [
@ -21,6 +25,7 @@ buildPythonPackage rec {
  ];

  # Project is not tagging releases and tests are not shipped with PyPI source
+  # https://github.com/LeandroBarone/python-ascii_magic/issues/10
  doCheck = false;

  pythonImportsCheck = [
@ -30,6 +35,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python module to converts pictures into ASCII art";
    homepage = "https://github.com/LeandroBarone/python-ascii_magic";
+    changelog = "https://github.com/LeandroBarone/python-ascii_magic#changelog";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/async-lru/default.nix
+++ b/pkgs/development/python-modules/async-lru/default.nix
@ -2,23 +2,30 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, typing-extensions
 , pytestCheckHook
 , pytest-asyncio
 }:

 buildPythonPackage rec {
  pname = "async-lru";
-  version = "1.0.3";
+  version = "2.0.0";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
+
+  format = "setuptools";

  src = fetchFromGitHub {
    owner = "aio-libs";
    repo = "async-lru";
    rev = "v${version}";
-    hash = "sha256-98ZPFSOFRnymTCfCG9OuajfxXAWyCrByyJEHhpPVPbM=";
+    hash = "sha256-mCmEMN9D6kEkHb3GoYuVk4XxvhaSX5eOHqpKawrcoxs=";
  };

+  propagatedBuildInputs = [
+    typing-extensions
+  ];
+
  postPatch = ''
    sed -i -e '/^addopts/d' -e '/^filterwarnings/,+2d' setup.cfg
  '';
@ -28,10 +35,6 @@ buildPythonPackage rec {
    pytest-asyncio
  ];

-  pytestFlagsArray = [
-    "--asyncio-mode=strict"
-  ];
-
  pythonImportsCheck = [ "async_lru" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/asyncwhois/default.nix
+++ b/pkgs/development/python-modules/asyncwhois/default.nix
@ -1,7 +1,7 @@
 { lib
-, asynctest
 , buildPythonPackage
 , fetchFromGitHub
+, pytest-mock
 , pytestCheckHook
 , python-socks
 , pythonOlder
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "asyncwhois";
-  version = "1.0.1";
+  version = "1.0.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,8 +19,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "pogzyb";
    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-TpUiUW9ntrpuT/rUhucedl+DM5X88Mislrd+3D5/TUE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-MYK09kszv7CTvZjdA9YQFfhlJ/A5d/aebLRaiMlnuB0=";
  };

  propagatedBuildInputs = [
@ -30,7 +30,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
-    asynctest
+    pytest-mock
    pytestCheckHook
  ];

@ -61,6 +61,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python module for retrieving WHOIS information";
    homepage = "https://github.com/pogzyb/asyncwhois";
+    changelog = "https://github.com/pogzyb/asyncwhois/releases/tag/v${version}";
    license = with licenses; [ asl20 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix
@ -1,27 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
 , azure-common
 , azure-mgmt-core
 , msrest
-, msrestazure
+, typing-extensions
 }:

 buildPythonPackage rec {
-  version = "10.0.0";
  pname = "azure-mgmt-containerregistry";
-  disabled = isPy27;
+  version = "10.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-HjejK28Em5AeoQ20o4fucnXTlAwADF/SEpVfHn9anZk=";
+    hash = "sha256-VrX9YfYNvlA8+eNqHCp35BAeQZzQKakZs7ZZKwT8oYc=";
    extension = "zip";
  };

-  propagatedBuildInputs = [ azure-common azure-mgmt-core msrest msrestazure ];
+  propagatedBuildInputs = [
+    azure-common
+    azure-mgmt-core
+    msrest
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
+  ];

  # no tests included
  doCheck = false;

-  pythonImportsCheck = [ "azure.common" "azure.mgmt.containerregistry" ];
+  pythonImportsCheck = [
+    "azure.common"
+    "azure.mgmt.containerregistry"
+  ];

  meta = with lib; {
    description = "Microsoft Azure Container Registry Client Library for Python";
--- a/pkgs/development/python-modules/boltons/default.nix
+++ b/pkgs/development/python-modules/boltons/default.nix
@ -1,15 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pytestCheckHook
-, pythonAtLeast
 , pythonOlder
 }:

 buildPythonPackage rec {
  pname = "boltons";
-  version = "21.0.0";
+  version = "23.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,22 +16,13 @@ buildPythonPackage rec {
    owner = "mahmoud";
    repo = "boltons";
    rev = "refs/tags/${version}";
-    hash = "sha256-8HO7X2PQEbQIQsCa2cMHQI3rlofVT22GYrWNXY34MLk=";
+    hash = "sha256-NqlCu0W/BQkLiaLYs9DB1RrEya6KGPfNtpAzKXxoRD0=";
  };

  nativeCheckInputs = [
    pytestCheckHook
  ];

-  patches = lib.optionals (pythonAtLeast "3.10") [
-    # pprint has no attribute _safe_repr, https://github.com/mahmoud/boltons/issues/294
-    (fetchpatch {
-      name = "fix-pprint-attribute.patch";
-      url = "https://github.com/mahmoud/boltons/commit/270e974975984f662f998c8f6eb0ebebd964de82.patch";
-      sha256 = "sha256-pZLfr6SRCw2aLwZeYaX7bzfJeZC4cFUILEmnVsKR6zc=";
-    })
-  ];
-
  # Tests bind to localhost
  __darwinAllowLocalNetworking = true;

@ -41,11 +30,6 @@ buildPythonPackage rec {
    "boltons"
  ];

-  disabledTests = lib.optionals (pythonAtLeast "3.11") [
-    # https://github.com/mahmoud/boltons/issues/326
-    "test_frozendict_api"
-  ];
-
  meta = with lib; {
    description = "Constructs, recipes, and snippets extending the Python standard library";
    longDescription = ''
--- a/pkgs/development/python-modules/clint/default.nix
+++ b/pkgs/development/python-modules/clint/default.nix
@ -5,7 +5,6 @@
 , mock
 , blessings
 , nose
-, nose_progressive
 , pillow
 , args
 , pkgs
@ -28,7 +27,7 @@ buildPythonPackage rec {
  # no longer compatible as behavior demand 2to3, which was removed
  # in setuptools>=58
  doCheck  = false;
-  nativeCheckInputs = [ mock nose nose_progressive pkgs.glibcLocales ];
+  nativeCheckInputs = [ mock nose pkgs.glibcLocales ];
  checkPhase = ''
    ${python.interpreter} test_clint.py
  '';
--- a/pkgs/development/python-modules/cvelib/default.nix
+++ b/pkgs/development/python-modules/cvelib/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "cvelib";
-  version = "1.2.0";
+  version = "1.2.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "RedHatProductSecurity";
    repo = "cvelib";
    rev = "tags/${version}";
-    hash = "sha256-8qlXwEbgLRZ1qYtBJ1c0nv6qfIOW5zAK9eOS+n+afWQ=";
+    hash = "sha256-hJPcxnc4iQzsYNNVJ9fw6yQl+5K7pdtjHT6oMmBx/Zs=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
--- a/pkgs/development/python-modules/deal/default.nix
+++ b/pkgs/development/python-modules/deal/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "deal";
-  version = "4.23.4";
+  version = "4.23.7";
  format = "pyproject";
  disabled = pythonOlder "3.7";

@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "life4";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-YwozwoTb1JsvrwcTntlpWpQJ9DszH2lmtuKkK8qZiG0=";
+    hash = "sha256-RWbMitgrU8VUsOgarBKYDNPIa/AwifvBURUytiGzeVo=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/deltachat/default.nix
+++ b/pkgs/development/python-modules/deltachat/default.nix
@ -1,9 +1,10 @@
 { lib
 , buildPythonPackage
-, isPy27
+, pythonOlder
 , pkg-config
 , pkgconfig
 , setuptools-scm
+, wheel
 , libdeltachat
 , cffi
 , imap-tools
@ -18,12 +19,16 @@ buildPythonPackage rec {
  inherit (libdeltachat) version src;
  sourceRoot = "${src.name}/python";

-  disabled = isPy27;
+  disabled = pythonOlder "3.7";
+  format = "pyproject";

  nativeBuildInputs = [
+    cffi
    pkg-config
    pkgconfig
+    setuptools
    setuptools-scm
+    wheel
  ];

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
@ -37,7 +42,7 @@ buildPythonPackage rec {
    imap-tools
    pluggy
    requests
-    setuptools
+    setuptools # for pkg_resources
  ];

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@ -43,14 +43,14 @@

 buildPythonPackage rec {
  pname = "Django";
-  version = "4.1.6";
+  version = "4.1.7";
  format = "pyproject";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-vOsP4aOGeBrweIyuQQhiJ1bNBed3VEje7ASnHd+HaF0=";
+    hash = "sha256-RPcUuBxfGQ2dLdrQGlMv5QL6AcTLj68dCB9CZO0V3Ng=";
  };

  patches = [
--- a/pkgs/development/python-modules/dunamai/default.nix
+++ b/pkgs/development/python-modules/dunamai/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "dunamai";
-  version = "1.15.0";
+  version = "1.16.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "mtkennerly";
    repo = "dunamai";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-dqMI51UHbkyfkxAPojRlS6qew2Ob4LbUkYua6zmcQgc=";
+    hash = "sha256-pPUn+1rv76N/7WVDyWJLPVMweJ1Qbx6/P4zIKU06hSs=";
  };

  nativeBuildInputs = [
@ -49,11 +49,14 @@ buildPythonPackage rec {
    setuptools
  ];

-  pythonImportsCheck = [ "dunamai" ];
+  pythonImportsCheck = [
+    "dunamai"
+  ];

  meta = with lib; {
    description = "Dynamic version generation";
    homepage = "https://github.com/mtkennerly/dunamai";
+    changelog = "https://github.com/mtkennerly/dunamai/blob/v${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ jmgilman ];
  };
--- a/pkgs/development/python-modules/eiswarnung/default.nix
+++ b/pkgs/development/python-modules/eiswarnung/default.nix
@ -7,12 +7,13 @@
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, pytz
 , yarl
 }:

 buildPythonPackage rec {
  pname = "eiswarnung";
-  version = "1.1.1";
+  version = "1.2.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -21,7 +22,7 @@ buildPythonPackage rec {
    owner = "klaasnicolaas";
    repo = "python-eiswarnung";
    rev = "refs/tags/v${version}";
-    hash = "sha256-sMR16if2Q+lK+ilnVNYVootBN2LFwBQLlZFkoX+oS/g=";
+    hash = "sha256-PVFAy34+UfNQNdzVdfvNiySrCTaKGuepnTINZYkOsuo=";
  };

  nativeBuildInputs = [
@ -30,6 +31,7 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    aiohttp
+    pytz
    yarl
  ];

@ -52,6 +54,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Module for getting Eiswarning API forecasts";
    homepage = "https://github.com/klaasnicolaas/python-eiswarnung";
+    changelog = "https://github.com/klaasnicolaas/python-eiswarnung/releases/tag/v${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/first/default.nix
+++ b/pkgs/development/python-modules/first/default.nix
@ -1,19 +1,31 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:

 buildPythonPackage rec {
  pname = "first";
  version = "2.0.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1gykyrm6zlrbf9iz318p57qwk594mx1jf0d79v79g32zql45na7z";
+    hash = "sha256-/yhbCMVfjJfOTqcBJ0OvJJXJ8SkXhfFjcivTb2r2078=";
  };

  doCheck = false; # no tests

+  pythonImportsCheck = [
+    "first"
+  ];
+
  meta = with lib; {
    description = "The function you always missed in Python";
    homepage = "https://github.com/hynek/first/";
+    changelog = "https://github.com/hynek/first/blob/${version}/HISTORY.rst";
    license = licenses.mit;
    maintainers = with maintainers; [ zimbatm ];
  };
--- a/pkgs/development/python-modules/gdown/default.nix
+++ b/pkgs/development/python-modules/gdown/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "gdown";
-  version = "4.6.3";
+  version = "4.6.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-7G6pIu9ONhagVAc2VtmqLNxxf729CpTS931S0yOUMwc=";
+    hash = "sha256-0zIQsbPXsS/vBda56n8ipRNzmQnKUR1dnSNtxnZmf3k=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-language/default.nix
+++ b/pkgs/development/python-modules/google-cloud-language/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-language";
-  version = "2.8.1";
+  version = "2.9.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-o4o9x7r7HpwzByUijDegzos35FILro0Esr2ugN2nyws=";
+    hash = "sha256-7rKNcG11cgvvwNEYiN9l8h8UR8u6DFfcI+S1QDi+t/c=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/insteon-frontend-home-assistant/default.nix
+++ b/pkgs/development/python-modules/insteon-frontend-home-assistant/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "insteon-frontend-home-assistant";
-  version = "0.3.1";
+  version = "0.3.2";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-gS2jDjgAcY4ve80yOPZcZR1v4c9EISYEoJkIezUQilU=";
+    hash = "sha256-7jRf6fp+5u6qqR5xP1R+kp6LURsBVqfct6yuCkbxBMw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/ipydatawidgets/default.nix
+++ b/pkgs/development/python-modules/ipydatawidgets/default.nix
@ -14,13 +14,13 @@

 buildPythonPackage rec {
  pname = "ipydatawidgets";
-  version = "4.3.2";
+  version = "4.3.3";

  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-LyuZf2Vp0+4fT3412wyx2gjAd7IaiPHAHFn1uYajGqY=";
+    sha256 = "sha256-T7LOaT+yaM2ukAN0z6GpFkHiLZUU0eweYtp0cFCST3Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/lektor/default.nix
+++ b/pkgs/development/python-modules/lektor/default.nix
@ -10,6 +10,7 @@
 , importlib-metadata
 , inifile
 , jinja2
+, markupsafe
 , marshmallow
 , marshmallow-dataclass
 , mistune
@ -19,8 +20,10 @@
 , pytest-mock
 , pytest-pylint
 , pytestCheckHook
+, python
 , pythonOlder
 , python-slugify
+, pytz
 , requests
 , setuptools
 , typing-inspect
@ -30,7 +33,7 @@

 buildPythonPackage rec {
  pname = "lektor";
-  version = "3.4.0b2";
+  version = "3.4.0b4";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -39,7 +42,7 @@ buildPythonPackage rec {
    owner = "lektor";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-5w3tT0celHgjmLlsM3sdBdYlXx57z3kMePVGSQkOP7M=";
+    hash = "sha256-O0bTmJqRymrQuHW19Y7/Kp+2XlbmDzcjl/jDACDlCSk=";
  };

  propagatedBuildInputs = [
@ -51,12 +54,14 @@ buildPythonPackage rec {
    flask
    inifile
    jinja2
+    markupsafe
    marshmallow
    marshmallow-dataclass
    mistune
    pip
    pyopenssl
    python-slugify
+    pytz
    requests
    setuptools
    typing-inspect
@ -72,9 +77,8 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "typing.inspect < 0.8.0" "typing.inspect"
+  postInstall = ''
+    cp -r lektor/translations "$out/${python.sitePackages}/lektor/"
  '';

  pythonImportsCheck = [
@ -89,6 +93,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "A static content management system";
    homepage = "https://www.getlektor.com/";
+    changelog = "https://github.com/lektor/lektor/blob/v${version}/CHANGES.md";
    license = licenses.bsd0;
    maintainers = with maintainers; [ costrouc ];
  };
--- a/pkgs/development/python-modules/lightgbm/default.nix
+++ b/pkgs/development/python-modules/lightgbm/default.nix
@ -13,7 +13,7 @@
 buildPythonPackage rec {
  pname = "lightgbm";
  version = "3.3.5";
-  format = "other";
+  format = "setuptools";

  disabled = pythonOlder "3.7";

--- a/pkgs/development/python-modules/neuronpy/default.nix
+++ b/pkgs/development/python-modules/neuronpy/default.nix
@ -1,31 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, numpy
-, matplotlib
-, scipy
-, isPy27
-}:
-
-buildPythonPackage rec {
-  pname = "neuronpy";
-  version = "0.1.6";
-  disabled = !isPy27;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1clhc2b5fy2l8nfrji4dagmj9419nj6kam090yqxhq5c28sngk25";
-  };
-
-  propagatedBuildInputs = [ numpy matplotlib scipy ];
-
-  #No tests included
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Interfaces and utilities for the NEURON simulator and analysis of neural data";
-    maintainers = [ maintainers.nico202 ];
-    license = licenses.mit;
-  };
-
-}
--- a/pkgs/development/python-modules/nose_progressive/default.nix
+++ b/pkgs/development/python-modules/nose_progressive/default.nix
@ -1,34 +0,0 @@
-{ stdenv
-, lib
-, buildPythonPackage
-, fetchPypi
-, nose
-, pillow
-, blessings
-, isPy3k
-}:
-
-buildPythonPackage rec {
-  pname = "nose-progressive";
-  version = "1.5.2";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1mzmgq0wnfizmg9m2wn0c9g9282rdgv1jnphp8ww5h8kwqrjhvis";
-  };
-
-  buildInputs = [ nose ];
-  propagatedBuildInputs = [ pillow blessings ];
-
-  # fails with obscure error
-  doCheck = !isPy3k;
-
-  meta = with lib; {
-    homepage = "https://github.com/erikrose/nose-progressive";
-    description = "A testrunner with a progress bar and smarter tracebacks";
-    license = licenses.mit;
-    maintainers = with maintainers; [ domenkozar ];
-    broken = true; # relies on 2to3 conversion, which was removed from setuptools>=58.0
-  };
-
-}
--- a/pkgs/development/python-modules/overrides/default.nix
+++ b/pkgs/development/python-modules/overrides/default.nix
@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "overrides";
+  version = "7.3.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "mkorpela";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-mxMh1ifOnii2SqxYjupDKvslHVGwClGtRgyoJSCGfZo=";
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "overrides"
+  ];
+
+  meta = with lib; {
+    description = "Decorator to automatically detect mismatch when overriding a method";
+    homepage = "https://github.com/mkorpela/overrides";
+    changelog = "https://github.com/mkorpela/overrides/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pipdeptree";
-  version = "2.4.0";
+  version = "2.5.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "tox-dev";
    repo = "pipdeptree";
    rev = "refs/tags/${version}";
-    hash = "sha256-agjerQTSkrpHCleqNUxg+NFiPnf9u9DQrs3vSR917oE=";
+    hash = "sha256-hAODK7kFCntfKC77VF/KyTk0O/z+bXHixVxQIz8JuDk=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/pydeconz/default.nix
+++ b/pkgs/development/python-modules/pydeconz/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "pydeconz";
-  version = "107";
+  version = "108";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "Kane610";
    repo = "deconz";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5NR+N2UoWvzD/y1kP08qOS2djMsLIwLDuaIBmt0AV/s=";
+    hash = "sha256-CPFkfVwvk0AO/DoE1Nj1jLdLvuOpRzndmRK/M6SSGtk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyfibaro/default.nix
+++ b/pkgs/development/python-modules/pyfibaro/default.nix
@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, requests
+, requests-mock
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "pyfibaro";
+  version = "0.6.8";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "rappenze";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-2BDVCukm2y4rZyIWozRWJ+pY2bI2A7Vpitjd8jSJoWQ=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    requests-mock
+  ];
+
+  pythonImportsCheck = [
+    "pyfibaro"
+  ];
+
+  meta = with lib; {
+    description = "Library to access FIBARO Home center";
+    homepage = "https://github.com/rappenze/pyfibaro";
+    changelog = "https://github.com/rappenze/pyfibaro/releases/tag/${version}";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/Show more
+++ b/Show more