Merge master into staging-next

2023-12-29 18:00:57 +00:00 · 2023-12-29 18:00:57 +00:00 · f50aae4fb1
commit f50aae4fb1
parent 895cd4b126 01962add7e
70 changed files with 613 additions and 391 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -18994,6 +18994,13 @@
    matrix = "@ty:tjll.net";
    name = "Tyler Langlois";
  };
+  tylervick = {
+    email = "nix@tylervick.com";
+    github = "tylervick";
+    githubId = 1395852;
+    name = "Tyler Vick";
+    matrix = "@tylervick:matrix.org";
+  };
  tymscar = {
    email = "oscar@tymscar.com";
    github = "tymscar";
--- a/nixos/modules/config/ldap.nix
+++ b/nixos/modules/config/ldap.nix
@ -226,18 +226,6 @@ in
      "ldap.conf" = ldapConfig;
    };

-    system.activationScripts = mkIf (!cfg.daemon.enable) {
-      ldap = stringAfter [ "etc" "groups" "users" ] ''
-        if test -f "${cfg.bind.passwordFile}" ; then
-          umask 0077
-          conf="$(mktemp)"
-          printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
-          cat ${ldapConfig.source} - >"$conf"
-          mv -fT "$conf" /etc/ldap.conf
-        fi
-      '';
-    };
-
    system.nssModules = mkIf cfg.nsswitch (singleton (
      if cfg.daemon.enable then nss_pam_ldapd else nss_ldap
    ));
@ -258,42 +246,63 @@ in
      };
    };

-    systemd.services = mkIf cfg.daemon.enable {
-      nslcd = {
-        wantedBy = [ "multi-user.target" ];
-
-        preStart = ''
-          umask 0077
-          conf="$(mktemp)"
-          {
-            cat ${nslcdConfig}
-            test -z '${cfg.bind.distinguishedName}' -o ! -f '${cfg.bind.passwordFile}' ||
-            printf 'bindpw %s\n' "$(cat '${cfg.bind.passwordFile}')"
-            test -z '${cfg.daemon.rootpwmoddn}' -o ! -f '${cfg.daemon.rootpwmodpwFile}' ||
-            printf 'rootpwmodpw %s\n' "$(cat '${cfg.daemon.rootpwmodpwFile}')"
-          } >"$conf"
-          mv -fT "$conf" /run/nslcd/nslcd.conf
-        '';
-
-        restartTriggers = [
-          nslcdConfig
-          cfg.bind.passwordFile
-          cfg.daemon.rootpwmodpwFile
-        ];
-
-        serviceConfig = {
-          ExecStart = "${nslcdWrapped}/bin/nslcd";
-          Type = "forking";
-          Restart = "always";
-          User = "nslcd";
-          Group = "nslcd";
-          RuntimeDirectory = [ "nslcd" ];
-          PIDFile = "/run/nslcd/nslcd.pid";
-          AmbientCapabilities = "CAP_SYS_RESOURCE";
+    systemd.services = mkMerge [
+      (mkIf (!cfg.daemon.enable) {
+        ldap-password = {
+          wantedBy = [ "sysinit.target" ];
+          before = [ "sysinit.target" "shutdown.target" ];
+          conflicts = [ "shutdown.target" ];
+          unitConfig.DefaultDependencies = false;
+          serviceConfig.Type = "oneshot";
+          serviceConfig.RemainAfterExit = true;
+          script = ''
+            if test -f "${cfg.bind.passwordFile}" ; then
+              umask 0077
+              conf="$(mktemp)"
+              printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
+              cat ${ldapConfig.source} - >"$conf"
+              mv -fT "$conf" /etc/ldap.conf
+            fi
+          '';
        };
-      };
+      })

-    };
+      (mkIf cfg.daemon.enable {
+        nslcd = {
+          wantedBy = [ "multi-user.target" ];
+
+          preStart = ''
+            umask 0077
+            conf="$(mktemp)"
+            {
+              cat ${nslcdConfig}
+              test -z '${cfg.bind.distinguishedName}' -o ! -f '${cfg.bind.passwordFile}' ||
+              printf 'bindpw %s\n' "$(cat '${cfg.bind.passwordFile}')"
+              test -z '${cfg.daemon.rootpwmoddn}' -o ! -f '${cfg.daemon.rootpwmodpwFile}' ||
+              printf 'rootpwmodpw %s\n' "$(cat '${cfg.daemon.rootpwmodpwFile}')"
+            } >"$conf"
+            mv -fT "$conf" /run/nslcd/nslcd.conf
+          '';
+
+          restartTriggers = [
+            nslcdConfig
+            cfg.bind.passwordFile
+            cfg.daemon.rootpwmodpwFile
+          ];
+
+          serviceConfig = {
+            ExecStart = "${nslcdWrapped}/bin/nslcd";
+            Type = "forking";
+            Restart = "always";
+            User = "nslcd";
+            Group = "nslcd";
+            RuntimeDirectory = [ "nslcd" ];
+            PIDFile = "/run/nslcd/nslcd.pid";
+            AmbientCapabilities = "CAP_SYS_RESOURCE";
+          };
+        };
+      })
+    ];

  };

--- a/nixos/modules/config/nix-channel.nix
+++ b/nixos/modules/config/nix-channel.nix
@ -12,7 +12,6 @@ let
    mkDefault
    mkIf
    mkOption
-    stringAfter
    types
    ;

--- a/nixos/modules/hardware/video/amdgpu-pro.nix
+++ b/nixos/modules/hardware/video/amdgpu-pro.nix
@ -39,9 +39,10 @@ in

    hardware.firmware = [ package.fw ];

-    system.activationScripts.setup-amdgpu-pro = ''
-      ln -sfn ${package}/opt/amdgpu{,-pro} /run
-    '';
+    systemd.tmpfiles.settings.amdgpu-pro = {
+      "/run/amdgpu"."L+".argument = "${package}/opt/amdgpu";
+      "/run/amdgpu-pro"."L+".argument = "${package}/opt/amdgpu-pro";
+    };

    system.requiredKernelConfig = with config.lib.kernelConfig; [
      (isYes "DEVICE_PRIVATE")
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@ -231,7 +231,8 @@ in
        # even if you've upgraded your system to a new NixOS release.
        #
        # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
-        # so changing it will NOT upgrade your system.
+        # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+        # to actually do that.
        #
        # This value being lower than the current NixOS release does NOT mean your system is
        # out of date, out of support, or vulnerable.
--- a/nixos/modules/security/ipa.nix
+++ b/nixos/modules/security/ipa.nix
@ -181,25 +181,33 @@ in {
      '';
    };

-    system.activationScripts.ipa = stringAfter ["etc"] ''
-      # libcurl requires a hard copy of the certificate
-      if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
-        rm -f /etc/ipa/ca.crt
-        cp ${cfg.certificate} /etc/ipa/ca.crt
-      fi
+    systemd.services."ipa-activation" = {
+      wantedBy = [ "sysinit.target" ];
+      before = [ "sysinit.target" "shutdown.target" ];
+      conflicts = [ "shutdown.target" ];
+      unitConfig.DefaultDependencies = false;
+      serviceConfig.Type = "oneshot";
+      serviceConfig.RemainAfterExit = true;
+      script = ''
+        # libcurl requires a hard copy of the certificate
+        if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
+          rm -f /etc/ipa/ca.crt
+          cp ${cfg.certificate} /etc/ipa/ca.crt
+        fi

-      if [ ! -f /etc/krb5.keytab ]; then
-        cat <<EOF
+        if [ ! -f /etc/krb5.keytab ]; then
+          cat <<EOF

-          In order to complete FreeIPA integration, please join the domain by completing the following steps:
-          1. Authenticate as an IPA user authorized to join new hosts, e.g. kinit admin@${cfg.realm}
-          2. Join the domain and obtain the keytab file: ipa-join
-          3. Install the keytab file: sudo install -m 600 krb5.keytab /etc/
-          4. Restart sssd systemd service: sudo systemctl restart sssd
+            In order to complete FreeIPA integration, please join the domain by completing the following steps:
+            1. Authenticate as an IPA user authorized to join new hosts, e.g. kinit admin@${cfg.realm}
+            2. Join the domain and obtain the keytab file: ipa-join
+            3. Install the keytab file: sudo install -m 600 krb5.keytab /etc/
+            4. Restart sssd systemd service: sudo systemctl restart sssd

-      EOF
-      fi
-    '';
+        EOF
+        fi
+      '';
+    };

    services.sssd.config = ''
      [domain/${cfg.domain}]
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -280,6 +280,7 @@ in
      wantedBy = [ "sysinit.target" ];
      before = [ "sysinit.target" "shutdown.target" ];
      conflicts = [ "shutdown.target" ];
+      after = [ "systemd-sysusers.service" ];
      unitConfig.DefaultDependencies = false;
      unitConfig.RequiresMountsFor = [ "/nix/store" "/run/wrappers" ];
      serviceConfig.Type = "oneshot";
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@ -143,20 +143,15 @@ let
  };

  # Paths listed in ReadWritePaths must exist before service is started
-  mkActivationScript = name: cfg:
+  mkTmpfiles = name: cfg:
    let
-      install = "install -o ${cfg.user} -g ${cfg.group}";
-    in
-      nameValuePair "borgbackup-job-${name}" (stringAfter [ "users" ] (''
-        # Ensure that the home directory already exists
-        # We can't assert createHome == true because that's not the case for root
-        cd "${config.users.users.${cfg.user}.home}"
-        # Create each directory separately to prevent root owned parent dirs
-        ${install} -d .config .config/borg
-        ${install} -d .cache .cache/borg
-      '' + optionalString (isLocalPath cfg.repo && !cfg.removableDevice) ''
-        ${install} -d ${escapeShellArg cfg.repo}
-      ''));
+      settings = { inherit (cfg) user group; };
+    in lib.nameValuePair "borgbackup-job-${name}" ({
+      "${config.users.users."${cfg.user}".home}/.config/borg".d = settings;
+      "${config.users.users."${cfg.user}".home}/.cache/borg".d = settings;
+    } // optionalAttrs (isLocalPath cfg.repo && !cfg.removableDevice) {
+      "${cfg.repo}".d = settings;
+    });

  mkPassAssertion = name: cfg: {
    assertion = with cfg.encryption;
@ -760,7 +755,7 @@ in {
        ++ mapAttrsToList mkSourceAssertions jobs
        ++ mapAttrsToList mkRemovableDeviceAssertions jobs;

-      system.activationScripts = mapAttrs' mkActivationScript jobs;
+      systemd.tmpfiles.settings = mapAttrs' mkTmpfiles jobs;

      systemd.services =
        # A job named "foo" is mapped to systemd.services.borgbackup-job-foo
--- a/nixos/modules/services/logging/logcheck.nix
+++ b/nixos/modules/services/logging/logcheck.nix
@ -220,10 +220,16 @@ in
      logcheck = {};
    };

-    system.activationScripts.logcheck = ''
-      mkdir -m 700 -p /var/{lib,lock}/logcheck
-      chown ${cfg.user} /var/{lib,lock}/logcheck
-    '';
+    systemd.tmpfiles.settings.logcheck = {
+      "/var/lib/logcheck".d = {
+        mode = "700";
+        inherit (cfg) user;
+      };
+      "/var/lock/logcheck".d = {
+        mode = "700";
+        inherit (cfg) user;
+      };
+    };

    services.cron.systemCronJobs =
        let withTime = name: {timeArgs, ...}: timeArgs != null;
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@ -137,16 +137,24 @@ in
        message = "networking.enableIPv6 must be true for yggdrasil to work";
      }];

-      system.activationScripts.yggdrasil = mkIf cfg.persistentKeys ''
-        if [ ! -e ${keysPath} ]
-        then
-          mkdir --mode=700 -p ${builtins.dirOf keysPath}
-          ${binYggdrasil} -genconf -json \
-            | ${pkgs.jq}/bin/jq \
-                'to_entries|map(select(.key|endswith("Key")))|from_entries' \
-            > ${keysPath}
-        fi
-      '';
+      # This needs to be a separate service. The yggdrasil service fails if
+      # this is put into its preStart.
+      systemd.services.yggdrasil-persistent-keys = lib.mkIf cfg.persistentKeys {
+        wantedBy = [ "multi-user.target" ];
+        before = [ "yggdrasil.service" ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        script = ''
+          if [ ! -e ${keysPath} ]
+          then
+            mkdir --mode=700 -p ${builtins.dirOf keysPath}
+            ${binYggdrasil} -genconf -json \
+              | ${pkgs.jq}/bin/jq \
+                  'to_entries|map(select(.key|endswith("Key")))|from_entries' \
+              > ${keysPath}
+          fi
+        '';
+      };

      systemd.services.yggdrasil = {
        description = "Yggdrasil Network Service";
--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  inherit (lib) mkOption mkDefault types optionalString stringAfter;
+  inherit (lib) mkOption mkDefault types optionalString;

  cfg = config.boot.binfmt;

--- a/nixos/modules/tasks/trackpoint.nix
+++ b/nixos/modules/tasks/trackpoint.nix
@ -80,10 +80,17 @@ with lib;
        ACTION=="add|change", SUBSYSTEM=="input", ATTR{name}=="${cfg.device}", ATTR{device/speed}="${toString cfg.speed}", ATTR{device/sensitivity}="${toString cfg.sensitivity}"
      '';

-      system.activationScripts.trackpoint =
-        ''
-          ${config.systemd.package}/bin/udevadm trigger --attr-match=name="${cfg.device}"
+      systemd.services.trackpoint = {
+        wantedBy = [ "sysinit.target" ] ;
+        before = [ "sysinit.target" "shutdown.target" ];
+        conflicts = [ "shutdown.target" ];
+        unitConfig.DefaultDependencies = false;
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        serviceConfig.ExecStart = ''
+          ${config.systemd.package}/bin/udevadm trigger --attr-match=name="${cfg.device}
        '';
+      };
    })

    (mkIf (cfg.emulateWheel) {
--- a/nixos/modules/virtualisation/vmware-host.nix
+++ b/nixos/modules/virtualisation/vmware-host.nix
@ -85,35 +85,44 @@ in
      };
    };

-    ###### wrappers activation script
-
-    system.activationScripts.vmwareWrappers =
-      lib.stringAfter [ "specialfs" "users" ]
-        ''
-          mkdir -p "${parentWrapperDir}"
-          chmod 755 "${parentWrapperDir}"
-          # We want to place the tmpdirs for the wrappers to the parent dir.
-          wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
-          chmod a+rx "$wrapperDir"
-          ${lib.concatStringsSep "\n" (vmwareWrappers)}
-          if [ -L ${wrapperDir} ]; then
-            # Atomically replace the symlink
-            # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
-            old=$(readlink -f ${wrapperDir})
-            if [ -e "${wrapperDir}-tmp" ]; then
-              rm --force --recursive "${wrapperDir}-tmp"
-            fi
-            ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
-            mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
-            rm --force --recursive "$old"
-          else
-            # For initial setup
-            ln --symbolic "$wrapperDir" "${wrapperDir}"
-          fi
-        '';
-
    # Services

+    systemd.services."vmware-wrappers" = {
+      description = "Create VMVare Wrappers";
+      wantedBy = [ "multi-user.target" ];
+      before = [
+        "vmware-authdlauncher.service"
+        "vmware-networks-configuration.service"
+        "vmware-networks.service"
+        "vmware-usbarbitrator.service"
+      ];
+      after = [ "systemd-sysusers.service" ];
+      serviceConfig.Type = "oneshot";
+      serviceConfig.RemainAfterExit = true;
+      script = ''
+        mkdir -p "${parentWrapperDir}"
+        chmod 755 "${parentWrapperDir}"
+        # We want to place the tmpdirs for the wrappers to the parent dir.
+        wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
+        chmod a+rx "$wrapperDir"
+        ${lib.concatStringsSep "\n" (vmwareWrappers)}
+        if [ -L ${wrapperDir} ]; then
+          # Atomically replace the symlink
+          # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
+          old=$(readlink -f ${wrapperDir})
+          if [ -e "${wrapperDir}-tmp" ]; then
+            rm --force --recursive "${wrapperDir}-tmp"
+          fi
+          ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
+          mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
+          rm --force --recursive "$old"
+        else
+          # For initial setup
+          ln --symbolic "$wrapperDir" "${wrapperDir}"
+        fi
+      '';
+    };
+
    systemd.services."vmware-authdlauncher" = {
      description = "VMware Authentication Daemon";
      serviceConfig = {
--- a/nixos/tests/anbox.nix
+++ b/nixos/tests/anbox.nix
@ -15,7 +15,7 @@
    test-support.displayManager.auto.user = "alice";

    virtualisation.anbox.enable = true;
-    boot.kernelPackages = pkgs.linuxPackages_5_15;
+    boot.kernelPackages = pkgs.linuxKernel.packages.linux_5_15;
    virtualisation.memorySize = 2500;
  };

--- a/nixos/tests/incron.nix
+++ b/nixos/tests/incron.nix
@ -13,9 +13,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
      '';

      # ensure the directory to be monitored exists before incron is started
-      system.activationScripts.incronTest = ''
-        mkdir /test
-      '';
+      systemd.tmpfiles.settings.incron-test = {
+        "/test".d = { };
+      };
    };

  testScript = ''
--- a/nixos/tests/nextcloud/basic.nix
+++ b/nixos/tests/nextcloud/basic.nix
@ -13,10 +13,12 @@ in {
    # The only thing the client needs to do is download a file.
    client = { ... }: {
      services.davfs2.enable = true;
-      system.activationScripts.davfs2-secrets = ''
-        echo "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}" > /tmp/davfs2-secrets
-        chmod 600 /tmp/davfs2-secrets
-      '';
+      systemd.tmpfiles.settings.nextcloud = {
+        "/tmp/davfs2-secrets"."f+" = {
+          mode = "0600";
+          argument = "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}";
+        };
+      };
      virtualisation.fileSystems = {
        "/mnt/dav" = {
          device = "http://nextcloud/remote.php/dav/files/${adminuser}";
--- a/pkgs/applications/audio/g4music/default.nix
+++ b/pkgs/applications/audio/g4music/default.nix
@ -15,14 +15,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "g4music";
-  version = "3.3";
+  version = "3.4-1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "neithern";
    repo = "g4music";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-sajA8+G1frQA0p+8RK84hvh2P36JaarmSZx/sxMoFqo=";
+    hash = "sha256-uklgxhyrnFQSUcttXvYQtm2BybRkdTK1IfaRpOp0sOE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/sidplayfp/default.nix
+++ b/pkgs/applications/audio/sidplayfp/default.nix
@ -2,38 +2,49 @@
 , lib
 , fetchFromGitHub
 , nix-update-script
-, autoreconfHook
-, perl
-, pkg-config
-, libsidplayfp
 , alsaSupport ? stdenv.hostPlatform.isLinux
 , alsa-lib
+, autoreconfHook
 , pulseSupport ? stdenv.hostPlatform.isLinux
 , libpulseaudio
+, libsidplayfp
 , out123Support ? stdenv.hostPlatform.isDarwin
 , mpg123
+, perl
+, pkg-config
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "sidplayfp";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "libsidplayfp";
    repo = "sidplayfp";
-    rev = "v${version}";
-    sha256 = "sha256-ECHtHJrkJ5Y0YvDNdMM3VB+s7I/8JCPZiwsPYLM/oig=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-oV7ZPWgMEsNlsF2OoOvf7Ah5ZLcVkIDyC+PrPIJGyzQ=";
  };

-  nativeBuildInputs = [ autoreconfHook perl pkg-config ];
+  strictDeps = true;

-  buildInputs = [ libsidplayfp ]
-    ++ lib.optional alsaSupport alsa-lib
-    ++ lib.optional pulseSupport libpulseaudio
-    ++ lib.optional out123Support mpg123;
+  nativeBuildInputs = [
+    autoreconfHook
+    perl
+    pkg-config
+  ];

-  configureFlags = lib.optionals out123Support [
-    "--with-out123"
+  buildInputs = [
+    libsidplayfp
+  ] ++ lib.optionals alsaSupport [
+    alsa-lib
+  ] ++ lib.optionals pulseSupport [
+    libpulseaudio
+  ] ++ lib.optionals out123Support [
+    mpg123
+  ];
+
+  configureFlags = [
+    (lib.strings.withFeature out123Support "out123")
  ];

  enableParallelBuilding = true;
@ -46,7 +57,8 @@ stdenv.mkDerivation rec {
    description = "A SID player using libsidplayfp";
    homepage = "https://github.com/libsidplayfp/sidplayfp";
    license = with licenses; [ gpl2Plus ];
+    mainProgram = "sidplayfp";
    maintainers = with maintainers; [ dezgeg OPNA2608 ];
    platforms = platforms.all;
  };
-}
+})
--- a/pkgs/applications/blockchains/bitcoin-knots/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@ -68,10 +68,6 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  passthru.tests = {
-    smoke-test = nixosTests.bitcoind-knots;
-  };
-
  meta = with lib; {
    description = "A derivative of Bitcoin Core with a collection of improvements";
    homepage = "https://bitcoinknots.org/";
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -710,8 +710,8 @@ let
        mktplcRef = {
          name = "ruff";
          publisher = "charliermarsh";
-          version = "2023.40.0";
-          sha256 = "sha256-Ym76WtKvz18NgxH9o8O/Ozn+/AtqLvjJs8ffLhPOWkQ=";
+          version = "2023.60.0";
+          sha256 = "sha256-zxE4QcWt8M6djTbdIf0YNSpeF1w7vMK4/BW5ArCOYbE=";
        };
        meta = {
          license = lib.licenses.mit;
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@ -19,7 +19,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.32.0";
+  version = "1.33.0";

  format = "other";

@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "valos";
    repo = "Komikku";
    rev = "v${version}";
-    hash = "sha256-aF7EByUQ6CO+rXfGz4ivU18N5sh0X8nGgJT94dCuN8c=";
+    hash = "sha256-59RkynW02gxVPz48diC1Th+vtru+oHMeuArfdA2a1IU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/ddgr/default.nix
+++ b/pkgs/applications/misc/ddgr/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, python3, installShellFiles }:

 stdenv.mkDerivation rec {
-  version = "2.1";
+  version = "2.2";
  pname = "ddgr";

  src = fetchFromGitHub {
    owner = "jarun";
    repo = "ddgr";
    rev = "v${version}";
-    sha256 = "sha256-D5FUhv1moQKzcLj/3VWJNs24jTXJir1dMpv59orPTtc=";
+    sha256 = "sha256-88cCQm3eViy0OwSyCTlnW7uuiFwz2/6Wz45QzxCgXxg=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/misc/remarkable/rmapi/default.nix
+++ b/pkgs/applications/misc/remarkable/rmapi/default.nix
@ -21,5 +21,6 @@ buildGoModule rec {
    changelog = "https://github.com/juruen/rmapi/blob/v${version}/CHANGELOG.md";
    license = licenses.agpl3Only;
    maintainers = [ maintainers.nickhu ];
+    mainProgram = "rmapi";
  };
 }
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
@ -22,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "evolution-ews";
-  version = "3.50.1";
+  version = "3.50.2";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "577S3Z/AhFf3W6ufiWJV8w/TTHu8nIqV74fi4pEqCa0=";
+    sha256 = "gYgjez2TGnOrire1c5/0Pqoky8mtjnK4I5KZ9pizHmY=";
  };

  patches = [
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/hardcode-gsettings.patch
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/hardcode-gsettings.patch
@ -1,8 +1,8 @@
 diff --git a/src/EWS/calendar/e-cal-backend-ews-utils.c b/src/EWS/calendar/e-cal-backend-ews-utils.c
-index 653a8fb..ad80283 100644
+index b7c65ae..b334198 100644
 --- a/src/EWS/calendar/e-cal-backend-ews-utils.c
 +++ b/src/EWS/calendar/e-cal-backend-ews-utils.c
-@@ -2406,7 +2406,19 @@ e_cal_backend_ews_get_configured_evolution_icaltimezone (void)
+@@ -2425,7 +2425,19 @@ e_cal_backend_ews_get_configured_evolution_icaltimezone (void)
 		if (schema) {
 			GSettings *settings;
 
--- a/pkgs/applications/office/planner/default.nix
+++ b/pkgs/applications/office/planner/default.nix
@ -17,14 +17,14 @@

 stdenv.mkDerivation rec {
  pname = "planner";
-  version = "0.14.91";
+  version = "0.14.92";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "planner";
    rev = version;
-    hash = "sha256-LxctZv/CKolJ1I4Hql20E+/+p+ZoJLR1eZe34HPMqvY=";
+    hash = "sha256-2LmNeyZURVtA52Vosyn44wT8zSaJn8tR+8sPM9atAwM=";
  };

  postPatch = ''
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -19,14 +19,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "23.12.3";
+  version = "23.12.5";
 in
 stdenv.mkDerivation {
  inherit pname appname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-cQjO5LgGDU9ZHnvKniFMBzcxgWRFfS+PQ0OSe+NFv+c=";
+    hash = "sha256-nPlaKbtG6ncHI9I/qHUFRtc98lWkz7C/VXFX/JkXhDo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/electronics/picoscope/default.nix
+++ b/pkgs/applications/science/electronics/picoscope/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, dpkg, makeWrapper , mono, gtk-sharp-3_0
-, glib, libusb1 , zlib, gtk3-x11, callPackage
+, glib, libusb1 , zlib, gtk3-x11, callPackage, writeTextDir
 , scopes ? [
  "picocv"
  "ps2000"
@ -114,7 +114,7 @@ in stdenv.mkDerivation rec {
  # services.udev.packages = [ pkgs.picoscope.rules ];
  # users.groups.pico = {};
  # users.users.you.extraGroups = [ "pico" ];
-  passthru.rules = lib.writeTextDir "lib/udev/rules.d/95-pico.rules" ''
+  passthru.rules = writeTextDir "lib/udev/rules.d/95-pico.rules" ''
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0ce9", MODE="664",GROUP="pico"
  '';

--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@ -1,84 +1,98 @@
 { lib
-, callPackage
 , config
+, newScope
 , runCommand
 }:

 let
-  buildLua = callPackage ./buildLua.nix { };
-
  unionOfDisjoints = lib.fold lib.attrsets.unionOfDisjoint {};

-  addTests = name: drv: let
-    inherit (drv) scriptName;
-    scriptPath = "share/mpv/scripts/${scriptName}";
-    fullScriptPath = "${drv}/${scriptPath}";
+  addTests = name: drv:
+    if ! lib.isDerivation drv then
+      drv
+    else let
+      inherit (drv) scriptName;
+      scriptPath = "share/mpv/scripts/${scriptName}";
+      fullScriptPath = "${drv}/${scriptPath}";
+    in drv.overrideAttrs (old: { passthru = (old.passthru or {}) // { tests = unionOfDisjoints [
+      (old.passthru.tests or {})

-  in drv.overrideAttrs (old: { passthru = (old.passthru or {}) // { tests = unionOfDisjoints [
-    (old.passthru.tests or {})
+      {
+        scriptName-is-valid = runCommand "mpvScripts.${name}.passthru.tests.scriptName-is-valid" {
+          meta.maintainers = with lib.maintainers; [ nicoo ];
+          preferLocalBuild = true;
+        } ''
+          if [ -e "${fullScriptPath}" ]; then
+            touch $out
+          else
+            echo "mpvScripts.\"${name}\" does not contain a script named \"${scriptName}\"" >&2
+            exit 1
+          fi
+        '';
+      }

-    {
-      scriptName-is-valid = runCommand "mpvScripts.${name}.passthru.tests.scriptName-is-valid" {
-        meta.maintainers = with lib.maintainers; [ nicoo ];
-        preferLocalBuild = true;
-      } ''
-        if [ -e "${fullScriptPath}" ]; then
-          touch $out
-        else
-          echo "mpvScripts.\"${name}\" does not contain a script named \"${scriptName}\"" >&2
-          exit 1
-        fi
-      '';
-    }
+      # can't check whether `fullScriptPath` is a directory, in pure-evaluation mode
+      (with lib; optionalAttrs (! any (s: hasSuffix s drv.passthru.scriptName) [ ".js" ".lua" ".so" ]) {
+        single-main-in-script-dir = runCommand "mpvScripts.${name}.passthru.tests.single-main-in-script-dir" {
+          meta.maintainers = with lib.maintainers; [ nicoo ];
+          preferLocalBuild = true;
+        } ''
+          die() {
+            echo "$@" >&2
+            exit 1
+          }

-    # can't check whether `fullScriptPath` is a directory, in pure-evaluation mode
-    (with lib; optionalAttrs (! any (s: hasSuffix s drv.passthru.scriptName) [ ".js" ".lua" ".so" ]) {
-      single-main-in-script-dir = runCommand "mpvScripts.${name}.passthru.tests.single-main-in-script-dir" {
-        meta.maintainers = with lib.maintainers; [ nicoo ];
-        preferLocalBuild = true;
-      } ''
-        die() {
-          echo "$@" >&2
-          exit 1
-        }
+          cd "${drv}/${scriptPath}"  # so the glob expands to filenames only
+          mains=( main.* )
+          if [ "''${#mains[*]}" -eq 1 ]; then
+            touch $out
+          elif [ "''${#mains[*]}" -eq 0 ]; then
+            die "'${scriptPath}' contains no 'main.*' file"
+          else
+            die "'${scriptPath}' contains multiple 'main.*' files:" "''${mains[*]}"
+          fi
+        '';
+      })
+    ]; }; });

-        cd "${drv}/${scriptPath}"  # so the glob expands to filenames only
-        mains=( main.* )
-        if [ "''${#mains[*]}" -eq 1 ]; then
-          touch $out
-        elif [ "''${#mains[*]}" -eq 0 ]; then
-          die "'${scriptPath}' contains no 'main.*' file"
-        else
-          die "'${scriptPath}' contains multiple 'main.*' files:" "''${mains[*]}"
-        fi
-      '';
-    })
-  ]; }; });
-in
+  scope = self: let
+    inherit (self) callPackage;
+  in lib.mapAttrs addTests {
+    inherit (callPackage ./mpv.nix { })
+      acompressor autocrop autodeint autoload;
+    inherit (callPackage ./occivink.nix { })
+      blacklistExtensions seekTo;

-lib.recurseIntoAttrs
-  (lib.mapAttrs addTests ({
-    chapterskip = callPackage ./chapterskip.nix { inherit buildLua; };
-    convert = callPackage ./convert.nix { inherit buildLua; };
-    cutter = callPackage ./cutter.nix { inherit buildLua; };
+    buildLua = callPackage ./buildLua.nix { };
+    chapterskip = callPackage ./chapterskip.nix { };
+    convert = callPackage ./convert.nix { };
+    cutter = callPackage ./cutter.nix { };
    inhibit-gnome = callPackage ./inhibit-gnome.nix { };
    mpris = callPackage ./mpris.nix { };
-    mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { inherit buildLua; };
-    mpv-webm = callPackage ./mpv-webm.nix { inherit buildLua; };
-    mpvacious = callPackage ./mpvacious.nix { inherit buildLua; };
-    quality-menu = callPackage ./quality-menu.nix { inherit buildLua; };
-    simple-mpv-webui = callPackage ./simple-mpv-webui.nix { inherit buildLua; };
+    mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { };
+    mpv-webm = callPackage ./mpv-webm.nix { };
+    mpvacious = callPackage ./mpvacious.nix { };
+    quality-menu = callPackage ./quality-menu.nix { };
+    simple-mpv-webui = callPackage ./simple-mpv-webui.nix { };
    sponsorblock = callPackage ./sponsorblock.nix { };
-    sponsorblock-minimal = callPackage ./sponsorblock-minimal.nix { inherit buildLua; };
-    thumbfast = callPackage ./thumbfast.nix { inherit buildLua; };
-    thumbnail = callPackage ./thumbnail.nix { inherit buildLua; };
-    uosc = callPackage ./uosc.nix { inherit buildLua; };
-    visualizer = callPackage ./visualizer.nix { inherit buildLua; };
+    sponsorblock-minimal = callPackage ./sponsorblock-minimal.nix { };
+    thumbfast = callPackage ./thumbfast.nix { };
+    thumbnail = callPackage ./thumbnail.nix { };
+    uosc = callPackage ./uosc.nix { };
+    visualizer = callPackage ./visualizer.nix { };
    vr-reversal = callPackage ./vr-reversal.nix { };
    webtorrent-mpv-hook = callPackage ./webtorrent-mpv-hook.nix { };
-  }
-  // (callPackage ./mpv.nix      { inherit buildLua; })
-  // (callPackage ./occivink.nix { inherit buildLua; })))
-  // lib.optionalAttrs config.allowAliases {
-  youtube-quality = throw "'youtube-quality' is no longer maintained, use 'quality-menu' instead"; # added 2023-07-14
-}
+  };
+
+  aliases = {
+    youtube-quality = throw "'youtube-quality' is no longer maintained, use 'quality-menu' instead"; # added 2023-07-14
+  };
+in
+
+with lib; pipe scope [
+  (makeScope newScope)
+  (self:
+    assert builtins.intersectAttrs self aliases == {};
+    self // optionalAttrs config.allowAliases aliases)
+  recurseIntoAttrs
+]
--- a/pkgs/by-name/ca/caido/package.nix
+++ b/pkgs/by-name/ca/caido/package.nix
@ -0,0 +1,43 @@
+{ lib
+, fetchurl
+, appimageTools
+, makeWrapper
+}:
+
+let
+  pname = "caido";
+  version = "0.29.2";
+  src = fetchurl {
+    url = "https://storage.googleapis.com/caido-releases/v${version}/caido-desktop-linux-v${version}-e0f8102b.AppImage";
+    hash = "sha256-4PgQK52LAX1zacmoUK0muIhrvFDF7anQ6sx35I+ErVs=";
+  };
+  appimageContents = appimageTools.extractType2 { inherit pname src version; };
+
+in appimageTools.wrapType2 {
+  inherit pname src version;
+
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libthai ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/caido.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/caido.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+    install -m 444 -D ${appimageContents}/caido.png \
+      $out/share/icons/hicolor/512x512/apps/caido.png
+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram $out/bin/${pname} \
+      --set WEBKIT_DISABLE_COMPOSITING_MODE 1
+  '';
+
+  meta = with lib; {
+    description = "A lightweight web security auditing toolkit";
+    homepage = "https://caido.io/";
+    changelog = "https://github.com/caido/caido/releases/tag/v${version}";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ octodi ];
+    mainProgram = "caido";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/by-name/gi/git-releaser/package.nix
+++ b/pkgs/by-name/gi/git-releaser/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "git-releaser";
-  version = "0.1.1";
+  version = "0.1.2";

  src = fetchFromGitHub {
    owner = "git-releaser";
    repo = "git-releaser";
    rev = "refs/tags/v${version}";
-    hash = "sha256-owIXiLLnCkda9O0C0wW0nEuwXC4hipNpR9fdFqgbWts=";
+    hash = "sha256-rgnOXon68QMfVbyYhERy5z2pUlLCBwum7a/U9kdp5M0=";
  };

-  vendorHash = "sha256-dTyHKSCEImySu6Tagqvh6jDvgDbOTL0fMUOjFBpp64k=";
+  vendorHash = "sha256-O6Rqdf6yZvW8aix51oIziip+WcVIiyDZZ2VOQfwP8Fs=";

  ldflags = [ "-X main.version=${version}" ];

--- a/pkgs/by-name/ic/icewm/package.nix
+++ b/pkgs/by-name/ic/icewm/package.nix
@ -41,13 +41,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "icewm";
-  version = "3.4.4";
+  version = "3.4.5";

  src = fetchFromGitHub {
    owner = "ice-wm";
    repo = "icewm";
    rev = finalAttrs.version;
-    hash = "sha256-bnoNkBsNJ/6CVmm5I/nwy6LGxYhxPXssjZ3TT7FdEz8=";
+    hash = "sha256-Auuu+hRYVziAF3hXH7XSOyNlDehEKg6QmSJicY+XQLk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ig/ignite-cli/package.nix
+++ b/pkgs/by-name/ig/ignite-cli/package.nix
@ -0,0 +1,43 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, makeWrapper
+, go
+, buf
+}:
+
+buildGoModule rec {
+  pname = "ignite-cli";
+  version = "28.1.0";
+
+  src = fetchFromGitHub {
+    repo = "cli";
+    owner = "ignite";
+    rev = "v${version}";
+    hash = "sha256-/MsBVJ3aqlNfGtktjqDKGdibbZea/bdLuQbXnP3Ag0k=";
+  };
+
+  vendorHash = "sha256-VAXzwZ79TGvAoSRzjupL9XkXBn05tvaPCtRuxhls6XE=";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  # Many tests require access to either executables, state or networking
+  doCheck = false;
+
+  # Required for wrapProgram
+  allowGoReference = true;
+
+  # Required for commands like `ignite version`, `ignite network` and others
+  postFixup = ''
+    wrapProgram $out/bin/ignite --prefix PATH : ${lib.makeBinPath [ go buf ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://ignite.com/";
+    changelog = "https://github.com/ignite/cli/releases/tag/v${version}";
+    description = "All-in-one platform to build, launch, and maintain any crypto application on a sovereign and secured blockchain";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ kashw2 ];
+    mainProgram = "ignite";
+  };
+}
--- a/pkgs/by-name/li/libui-ng/package.nix
+++ b/pkgs/by-name/li/libui-ng/package.nix
@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, cmocka
+, darwin
+, fetchFromGitHub
+, gtk3
+, meson
+, ninja
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libui-ng";
+  version = "unstable-2023-12-19";
+
+  src = fetchFromGitHub {
+    owner = "libui-ng";
+    repo = "libui-ng";
+    rev = "8de4a5c8336f82310df1c6dad51cb732113ea114";
+    hash = "sha256-ZMt2pEHwxXxLWtK8Rm7hky9Kxq5ZIB0olBLf1d9wVfc=";
+  };
+
+  postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    substituteInPlace meson.build --replace "'-arch', 'arm64'" ""
+  '';
+
+  nativeBuildInputs = [
+    cmocka
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs =
+    if stdenv.isDarwin then [
+      darwin.libobjc
+      darwin.apple_sdk_11_0.Libsystem
+      darwin.apple_sdk_11_0.frameworks.Cocoa
+      darwin.apple_sdk_11_0.frameworks.AppKit
+      darwin.apple_sdk_11_0.frameworks.CoreFoundation
+    ] else [
+      gtk3
+    ];
+
+  mesonFlags = [
+    (lib.mesonBool "examples" (!stdenv.isDarwin))
+  ];
+
+  meta = with lib; {
+    description = "A portable GUI library for C";
+    homepage = "https://github.com/libui-ng/libui-ng";
+    license = licenses.mit;
+    maintainers = with maintainers; [ marsam ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@ -17,7 +17,7 @@
 , openclSupport ? false
 , clblast

-, openblasSupport ? true
+, openblasSupport ? !rocmSupport
 , openblas
 , pkg-config
 }:
@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "1671";
+  version = "1710";

  src = fetchFromGitHub {
    owner = "ggerganov";
    repo = "llama.cpp";
    rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-OFRc3gHKQboVCsDlQVHwzEBurIsOMj/bVGYuCLilydE=";
+    hash = "sha256-fbzHjaL+qAE9HdtBVxboo8T2/KCdS5O1RkTQvDwD/xs=";
  };

  patches = [
--- a/pkgs/by-name/sa/satty/package.nix
+++ b/pkgs/by-name/sa/satty/package.nix
@ -15,16 +15,16 @@
 rustPlatform.buildRustPackage rec {

  pname = "satty";
-  version = "0.8.2";
+  version = "0.8.3";

  src = fetchFromGitHub {
    owner = "gabm";
    repo = "Satty";
    rev = "v${version}";
-    hash = "sha256-5FKEQUH43qx8w7s7lW8EDOWtWCUJTbWlXcMQazR8Thk=";
+    hash = "sha256-KCHKR6DP8scd9xdWi0bLw3wObrEi0tOsflXHa9f4Z5k=";
  };

-  cargoHash = "sha256-FpCmzU2C+5+5eSB5Mno+lOFd4trHXmfp6e5oV+CvU1c=";
+  cargoHash = "sha256-pUBtUC+WOuiypLUpXCPR1pu0fRrMVTxg7FE2JSaszNw=";

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@ -4,12 +4,12 @@

 let
  pname = "elixir-ls";
-  version = "0.17.10";
+  version = "0.18.1";
  src = fetchFromGitHub {
    owner = "elixir-lsp";
    repo = "elixir-ls";
    rev = "v${version}";
-    hash = "sha256-LUAYfR6MNNGLaqv8EBx0JQ8KYYD7jRvez3HJFnczV+Y=";
+    hash = "sha256-o5/H2FeDXzT/ZyWtLmRs+TWJQfmuDUnnR5Brvkifn6E=";
    fetchSubmodules = true;
  };
 in
@ -21,7 +21,7 @@ mixRelease {
  mixFodDeps = fetchMixDeps {
    pname = "mix-deps-${pname}";
    inherit src version elixir;
-    hash = "sha256-MVGYENy6/xI/ph/X0DxquigCuLK1FAEIONzoQU7TXoM=";
+    hash = "sha256-q4VKtGxrRaAhtNIJFjNN7tF+HFgU/UX9sKq0BkOIiQI=";
  };

  # elixir-ls is an umbrella app
@ -50,9 +50,9 @@ mixRelease {
      --replace 'exec "''${dir}/launch.sh"' "exec $out/lib/launch.sh"
    chmod +x $out/bin/elixir-ls

-    substitute release/debugger.sh $out/bin/elixir-debugger \
+    substitute release/debug_adapter.sh $out/bin/elixir-debug-adapter \
      --replace 'exec "''${dir}/launch.sh"' "exec $out/lib/launch.sh"
-    chmod +x $out/bin/elixir-debugger
+    chmod +x $out/bin/elixir-debug-adapter
    # prepare the launcher
    substituteInPlace $out/lib/launch.sh \
      --replace "ERL_LIBS=\"\$SCRIPTPATH:\$ERL_LIBS\"" \
--- a/pkgs/development/compilers/jasmin-compiler/default.nix
+++ b/pkgs/development/compilers/jasmin-compiler/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "jasmin-compiler";
-  version = "2023.06.1";
+  version = "2023.06.2";

  src = fetchurl {
    url = "https://github.com/jasmin-lang/jasmin/releases/download/v${version}/jasmin-compiler-v${version}.tar.bz2";
-    hash = "sha256-3+eIR8wkBlcUQVDsugHo/rHNHbE2vpE9gutp55kRY4Y=";
+    hash = "sha256-I3+MP2Q7ENOdQdvvCqcyD+I8ImF6c+9HQDpY6QUWuY8=";
  };

  sourceRoot = "jasmin-compiler-v${version}/compiler";
--- a/pkgs/development/interpreters/joker/default.nix
+++ b/pkgs/development/interpreters/joker/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "joker";
-  version = "1.3.3";
+  version = "1.3.4";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "candid82";
    repo = "joker";
-    sha256 = "sha256-TaNuw84VCC1s2I7rmTdVKTrpT/nTrb+45haEFWf6S7k=";
+    sha256 = "sha256-sueFfR5KVj6HXR+5XWowL0Zjbuu7K+p/+skcTaXlOMc=";
  };

  vendorHash = "sha256-rxWYNGFbFUKjy232DOhVlh341GV2VKLngJKM+DEd27o=";
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@ -2,6 +2,7 @@ self: dontUse: with self;

 let
  inherit (python) pythonOnBuildForHost;
+  inherit (pkgs) runCommand;
  pythonInterpreter = pythonOnBuildForHost.interpreter;
  pythonSitePackages = python.sitePackages;
  pythonCheckInterpreter = python.interpreter;
@ -67,7 +68,7 @@ in {
      # Such conflicts don't happen within the standard nixpkgs python package
      #   set, but in downstream projects that build packages depending on other
      #   versions of this hook's dependencies.
-      passthru.tests = import ./pypa-build-hook-tests.nix {
+      passthru.tests = import ./pypa-build-hook-test.nix {
        inherit pythonOnBuildForHost runCommand;
      };
    } ./pypa-build-hook.sh) {
--- a/pkgs/development/libraries/libsidplayfp/default.nix
+++ b/pkgs/development/libraries/libsidplayfp/default.nix
@ -4,38 +4,55 @@
 , fetchpatch
 , makeFontsConf
 , nix-update-script
+, testers
 , autoreconfHook
-, pkg-config
-, perl
-, unittest-cpp
-, xa
-, libgcrypt
-, libexsid
 , docSupport ? true
 , doxygen
 , graphviz
+, libexsid
+, libgcrypt
+, perl
+, pkg-config
+, unittest-cpp
+, xa
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libsidplayfp";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "libsidplayfp";
    repo = "libsidplayfp";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    sha256 = "sha256-KCp/8UjVl8e3+4s1FD4GvHP7AUAS+eIB7RWhmgm5GIA=";
+    hash = "sha256-1e1QDSJ8CjLU794saba2auCKko7p2ylrdI0JWhh8Kco=";
  };

+  outputs = [
+    "out"
+  ] ++ lib.optionals docSupport [
+    "doc"
+  ];
+
  patches = [
    # Pull autoconf-2.72 compatibility fix:
    #   https://github.com/libsidplayfp/libsidplayfp/pull/103
+    # Remove when version > 2.5.1
    (fetchpatch {
-      name = "autoconf-2.72";
-      url = "https://github.com/libsidplayfp/libsidplayfp/commit/b8fff55f6aaa005a3899b59e70cd8730f962641b.patch";
+      name = "0001-libsidplayfp-autoconf-2.72-compat.patch";
+      url = "https://github.com/libsidplayfp/libsidplayfp/commit/2b1b41beb5099d5697e3f8416d78f27634732a9e.patch";
      hash = "sha256-5Hk202IuHUBow7HnnPr2/ieWFjKDuHLQjQ9mJUML9q8=";
    })
+
+    # Fix --disable-tests logic
+    # https://github.com/libsidplayfp/libsidplayfp/pull/108
+    # Remove when version > 2.5.1
+    (fetchpatch {
+      name = "0002-libsidplayfp-Fix-autoconf-logic-for-tests-option.patch";
+      url = "https://github.com/libsidplayfp/libsidplayfp/commit/39dd2893b6186c4932d17b529bb62627b742b742.patch";
+      hash = "sha256-ErdfPvu8R81XxdHu2TaV87OpLFlRhJai51QcYUIkUZ4=";
+    })
  ];

  postPatch = ''
@ -44,30 +61,35 @@ stdenv.mkDerivation rec {

  strictDeps = true;

-  nativeBuildInputs = [ autoreconfHook pkg-config perl xa ]
-    ++ lib.optionals docSupport [ doxygen graphviz ];
+  nativeBuildInputs = [
+    autoreconfHook
+    perl
+    pkg-config
+    xa
+  ] ++ lib.optionals docSupport [
+    doxygen
+    graphviz
+  ];

-  buildInputs = [ libgcrypt libexsid ];
+  buildInputs = [
+    libexsid
+    libgcrypt
+  ];

-  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-
-  checkInputs = [ unittest-cpp ];
+  checkInputs = [
+    unittest-cpp
+  ];

  enableParallelBuilding = true;

-  installTargets = [ "install" ]
-    ++ lib.optionals docSupport [ "doc" ];
-
-  outputs = [ "out" ]
-    ++ lib.optionals docSupport [ "doc" ];
-
  configureFlags = [
-    "--enable-hardsid"
-    "--with-gcrypt"
-    "--with-exsid"
-  ]
-  ++ lib.optional doCheck "--enable-tests";
+    (lib.strings.enableFeature true "hardsid")
+    (lib.strings.withFeature true "gcrypt")
+    (lib.strings.withFeature true "exsid")
+    (lib.strings.enableFeature finalAttrs.finalPackage.doCheck "tests")
+  ];

+  # Make Doxygen happy with the setup, reduce log noise
  FONTCONFIG_FILE = lib.optionalString docSupport (makeFontsConf { fontDirectories = [ ]; });

  preBuild = ''
@ -75,12 +97,21 @@ stdenv.mkDerivation rec {
    export XDG_CACHE_HOME=$TMPDIR
  '';

+  buildFlags = [
+    "all"
+  ] ++ lib.optionals docSupport [
+    "doc"
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
  postInstall = lib.optionalString docSupport ''
    mkdir -p $doc/share/doc/libsidplayfp
    mv docs/html $doc/share/doc/libsidplayfp/
  '';

  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
    updateScript = nix-update-script { };
  };

@ -96,5 +127,9 @@ stdenv.mkDerivation rec {
    license = with licenses; [ gpl2Plus ];
    maintainers = with maintainers; [ ramkromberg OPNA2608 ];
    platforms = platforms.all;
+    pkgConfigModules = [
+      "libsidplayfp"
+      "libstilview"
+    ];
  };
-}
+})
--- a/pkgs/development/python-modules/array-record/default.nix
+++ b/pkgs/development/python-modules/array-record/default.nix
@ -32,7 +32,7 @@ buildPythonPackage rec {
      cp39 = "sha256-BzMOVue7E1S1+5+XTcPELko81ujc9MbmqLhNsU7pqO0=";
      cp310 = "sha256-eUD9pQu9GsbV8MPD1MiF3Ihr+zYioSOo6P15hYIwPYo=";
      cp311 = "sha256-rAmkI3EIZPYiXrxFowfDC0Gf3kRw0uX0i6Kx6Zu+hNM=";
-    }.${pyShortVersion};
+    }.${pyShortVersion} or (throw "${pname} is missing hash for ${pyShortVersion}");
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/ndms2-client/default.nix
+++ b/pkgs/development/python-modules/ndms2-client/default.nix
@ -1,22 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "ndms2-client";
-  version = "0.1.2";
+  version = "0.1.3";

-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "foxel";
    repo = "python_ndms2_client";
    rev = version;
-    hash = "sha256-cM36xNLymg5Xph3bvbUGdAEmMABJ9y3/w/U8re6ZfB4=";
+    hash = "sha256-A19olC1rTHTy0xyeSP45fqvv9GUynQSrMgXBgW8ySOs=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  nativeCheckInputs = [
    pytestCheckHook
  ];
--- a/pkgs/development/python-modules/textdistance/default.nix
+++ b/pkgs/development/python-modules/textdistance/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "textdistance";
-  version = "4.6.0";
+  version = "4.6.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-cyxQMVzU7pRjg4ZDzxnWkiEwLDYDHqpgcMMMwKpdqMo=";
+    hash = "sha256-JYllgBse+FaGppq/bDzv3F2iHC+9iMkMaHJfV6fUXyE=";
  };

  # There aren't tests
--- a/pkgs/development/python-modules/withings-sync/default.nix
+++ b/pkgs/development/python-modules/withings-sync/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "withings-sync";
-  version = "4.2.1";
+  version = "4.2.2";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "jaroslawhartman";
    repo = "withings-sync";
    rev = "refs/tags/v${version}";
-    hash = "sha256-6igjUmgIA077/1SQMt10tRpnLVKxGFNJN1GeLhQLROg=";
+    hash = "sha256-p1coGTbMQ+zptFKVLW5qgSdoudo2AggGT8Xu+cSCCs4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
@ -287,7 +287,7 @@ stdenv.mkDerivation rec {
        sha256 = "1mm4awx6sa0myiz9j4hwp71rpr7yh8vihf3zm15n2ii6xb82r31k";
      };

-    in (lib.optionalSttrs (!stdenv.hostPlatform.isDarwin) {
+    in (lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
      # `extracted` doesn’t work on darwin
      shebang = callPackage ../shebang-test.nix { inherit runLocal extracted bazelTest distDir; bazel = bazel_self;};
    }) // {
--- a/pkgs/development/tools/build-managers/jam/default.nix
+++ b/pkgs/development/tools/build-managers/jam/default.nix
@ -7,6 +7,9 @@ let
    depsBuildBuild = [ buildPackages.stdenv.cc ];
    nativeBuildInputs = [ bison ];

+    # Jam uses c89 conventions
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-std=c89";
+
    # Jambase expects ar to have flags.
    preConfigure = ''
      export AR="$AR rc"
--- a/pkgs/development/tools/deadcode/default.nix
+++ b/pkgs/development/tools/deadcode/default.nix
@ -1,31 +0,0 @@
-{ buildGoPackage
-, lib
-, fetchFromGitHub
-}:
-
-# TODO(yl): should we package https://github.com/remyoudompheng/go-misc instead of
-# the standalone extract of deadcode from it?
-buildGoPackage rec {
-  pname = "deadcode-unstable";
-  version = "2016-07-24";
-  rev = "210d2dc333e90c7e3eedf4f2242507a8e83ed4ab";
-
-  goPackagePath = "github.com/tsenart/deadcode";
-  excludedPackages = "cmd/fillswitch/test-fixtures";
-
-  src = fetchFromGitHub {
-    inherit rev;
-
-    owner = "tsenart";
-    repo = "deadcode";
-    sha256 = "05kif593f4wygnrq2fdjhn7kkcpdmgjnykcila85d0gqlb1f36g0";
-  };
-
-  meta = with lib; {
-    description = "Very simple utility which detects unused declarations in a Go package";
-    homepage = "https://github.com/remyoudompheng/go-misc/tree/master/deadcode";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ kalbasit ];
-    platforms = platforms.linux ++ platforms.darwin;
-  };
-}
--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "just";
-  version = "1.18.1";
+  version = "1.20.0";
  outputs = [ "out" "man" "doc" ];

  src = fetchFromGitHub {
    owner = "casey";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-jmTSTx2WSLOtxy0gPCTonjcoy4o9FKA5aiQW3+wPrZQ=";
+    hash = "sha256-MTfxVUr5rQpu5AXJmP/7rOjeHSsX+iQqfBdYb8YWfiU=";
  };

-  cargoHash = "sha256-4kbvtmXkU5bhuC079K5NOGKVdqYvTileVNXSNLIV0ok=";
+  cargoHash = "sha256-lvqtt6RCy/SqzZXWRR5u2P9UOlHC5Hjg6UhYjxpS3as=";

  nativeBuildInputs = [ installShellFiles mdbook ];
  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
--- a/pkgs/development/tools/mutmut/default.nix
+++ b/pkgs/development/tools/mutmut/default.nix
@ -1,6 +1,7 @@
 { lib
 , fetchFromGitHub
 , python3
+, testers
 }:

 let self = with python3.pkgs; buildPythonApplication rec {
--- a/pkgs/development/tools/supabase-cli/default.nix
+++ b/pkgs/development/tools/supabase-cli/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "supabase-cli";
-  version = "1.127.1";
+  version = "1.129.0";

  src = fetchFromGitHub {
    owner = "supabase";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-FzAGhIEuAOvLNQdoDqkIJBWcl0cDGz1nkbpp4Ha4yQo=";
+    hash = "sha256-qbm7ByPZpLx0BB/iZ3UjYFe/g6l7ZuUw4wzrH72Ut7U=";
  };

  vendorHash = "sha256-lFholyFVr6uMcfafM/tb8r1/4ysgWZOW5neoy3uL0Vw=";
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@ -8,14 +8,14 @@

 buildGoModule rec {
  pname = "symfony-cli";
-  version = "5.7.6";
-  vendorHash = "sha256-GuLcevYEM+neWAJoNBZrAVzVxdaLFFi9nubXGzp4EXw=";
+  version = "5.7.7";
+  vendorHash = "sha256-R0/zJlK9T0iAfquROOWraoBHzd//rIIXNIps3GvGRvA=";

  src = fetchFromGitHub {
    owner = "symfony-cli";
    repo = "symfony-cli";
    rev = "v${version}";
-    hash = "sha256-HMyq4raB6pPtx4DEJlcSM2+jlw7KWJW72RRVdG2wvn0=";
+    hash = "sha256-ZoBMOArpsmUniVc7cqbB4UZZ6ujnVfHqRos0Mcr+E4Q=";
  };

  ldflags = [
--- a/pkgs/development/tools/unityhub/default.nix
+++ b/pkgs/development/tools/unityhub/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "unityhub";
-  version = "3.6.1";
+  version = "3.7.0";

  src = fetchurl {
    url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/unityhub-amd64-${version}.deb";
-    sha256 = "sha256-rpH87aFvbYanthwPw/SlluOH/rtj6owcVetBD4+TJeU=";
+    sha256 = "sha256-cFHcfpsHSDlR82PtZ0leRDpvCD6nw0Qdb3PsYKMnosA=";
  };

  nativeBuildInputs = [
--- a/pkgs/games/osu-lazer/bin.nix
+++ b/pkgs/games/osu-lazer/bin.nix
@ -7,22 +7,22 @@

 let
  pname = "osu-lazer-bin";
-  version = "2023.1224.0";
+  version = "2023.1229.0";

  src = {
    aarch64-darwin = fetchzip {
      url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-      hash = "sha256-6+Ddar9uu/0U0H/rvs0J3v+BfNHtDnJbnjmzRt5zYlc=";
+      hash = "sha256-aZp8pVeCxmaAyWYnBg7w8sPMXy+L2UGRk3NvG/VsxYI=";
      stripRoot = false;
    };
    x86_64-darwin = fetchzip {
      url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-      hash = "sha256-TJR0GpMEL3Gu+cQZMI7rwdeY0rm5CIbhIJ1AG653csg=";
+      hash = "sha256-Xle/WcWg+lYA+DxQmE4Kzn1pJTa+HrM13utXqdK8ZZY=";
      stripRoot = false;
    };
    x86_64-linux = fetchurl {
      url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-      hash = "sha256-4kwRTgkiLWbDxR+KTc6pyULKLS2wDKNC4BO6OhysijI=";
+      hash = "sha256-lRdRPwa6xix5Nvt3szPeposmqU8D826iFmE6S1uPBF8=";
    };
  }.${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported.");

--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@ -16,13 +16,13 @@

 buildDotnetModule rec {
  pname = "osu-lazer";
-  version = "2023.1224.0";
+  version = "2023.1229.0";

  src = fetchFromGitHub {
    owner = "ppy";
    repo = "osu";
    rev = version;
-    sha256 = "sha256-o/I8f0aYM9FnMuRF6+Yk2DH20EwgzbLwvl4lqPPPJUk=";
+    hash = "sha256-2GcPV6UHnNdToXfLs2+i3XNwE6Ymaj2bqNb5EePE3kM=";
  };

  projectFile = "osu.Desktop/osu.Desktop.csproj";
--- a/pkgs/games/osu-lazer/deps.nix
+++ b/pkgs/games/osu-lazer/deps.nix
@ -126,22 +126,23 @@
  (fetchNuGet { pname = "NuGet.Versioning"; version = "5.11.0"; sha256 = "041351n1rbyqpfxqyxbvjgfrcbbawymbq96givz5pvdbabvyf5vq"; })
  (fetchNuGet { pname = "NUnit"; version = "3.13.3"; sha256 = "0wdzfkygqnr73s6lpxg5b1pwaqz9f414fxpvpdmf72bvh4jaqzv6"; })
  (fetchNuGet { pname = "NVika"; version = "2.2.0"; sha256 = "1lxv5m5nf4hfwfdhcscrl8m0hhjkqxxn555wxwb95x0d5w2czx6x"; })
-  (fetchNuGet { pname = "OpenTabletDriver"; version = "0.6.3"; sha256 = "1ac4s2422gyfmi5b2znn6i9j5p3w3w2jjng7g9lzh1mfgad3wfc2"; })
-  (fetchNuGet { pname = "OpenTabletDriver.Configurations"; version = "0.6.3"; sha256 = "176lj975yz2m34dzhjjawnsca4vviaayvmqinh6vsss6v1084fws"; })
-  (fetchNuGet { pname = "OpenTabletDriver.Native"; version = "0.6.3"; sha256 = "0dd37qfh6mxsf13bfnywy5ni17wvy6g419ksc4ga3ljv0zhrbpfz"; })
-  (fetchNuGet { pname = "OpenTabletDriver.Plugin"; version = "0.6.3"; sha256 = "0pq43y1zlx4a0lidav1w6jsywvwc4z3aaq4w53w68cqf855k4wv9"; })
+  (fetchNuGet { pname = "OpenTabletDriver"; version = "0.6.4"; sha256 = "14wc2rgnbi2ili6sx9iqnmcbn1zlmbsk49zbiz5cycib6rxkqfdm"; })
+  (fetchNuGet { pname = "OpenTabletDriver.Configurations"; version = "0.6.4"; sha256 = "0l7vf607i54y1xilr7bmjy9zlxacm00wz42mfbvzjf9rr54sy2pm"; })
+  (fetchNuGet { pname = "OpenTabletDriver.Native"; version = "0.6.4"; sha256 = "1jsw2kwxxskwppk65i52yrxjjgbfbhicpmz30iaxlm68d5m6gwz2"; })
+  (fetchNuGet { pname = "OpenTabletDriver.Plugin"; version = "0.6.4"; sha256 = "0lbd80yddsy7wqjw014kvj9an49h2rbgd9s86ifq38dyin5r2czn"; })
  (fetchNuGet { pname = "PolySharp"; version = "1.10.0"; sha256 = "06qici3hhk6a0jmy0nyvspcnmhbapnic6iin3i28pkdvrii02hnz"; })
  (fetchNuGet { pname = "ppy.LocalisationAnalyser"; version = "2023.1117.0"; sha256 = "04q65q27nzjq0fmv8p62r5lmhzdbpfk6y65fxqmfmm7qz2wkiy27"; })
  (fetchNuGet { pname = "ppy.LocalisationAnalyser.Tools"; version = "2023.1117.0"; sha256 = "1yr0r628x5aaa1vqxpkr9ys1xnf4qnz6ypggms6v4a336gjz2734"; })
  (fetchNuGet { pname = "ppy.ManagedBass"; version = "2022.1216.0"; sha256 = "19nnj1hq2v21mrplnivjr9c4y3wg4hhfnc062sjgzkmiv1cchvf8"; })
  (fetchNuGet { pname = "ppy.ManagedBass.Fx"; version = "2022.1216.0"; sha256 = "1vw573mkligpx9qiqasw1683cqaa1kgnxhlnbdcj9c4320b1pwjm"; })
  (fetchNuGet { pname = "ppy.ManagedBass.Mix"; version = "2022.1216.0"; sha256 = "185bpvgbnd8y20r7vxb1an4pd1aal9b7b5wvmv3knz0qg8j0chd9"; })
-  (fetchNuGet { pname = "ppy.osu.Framework"; version = "2023.1219.0"; sha256 = "0ljm2pj5brf024wd50mqzmqxw2ngchwyvbsxdx2g3dp9459bwsrh"; })
-  (fetchNuGet { pname = "ppy.osu.Framework.NativeLibs"; version = "2023.1205.0-nativelibs"; sha256 = "1ldsn6fdcgp2dl64z2r4m87fwm84r4vfwlqfnyhxgs5n7xwwmb11"; })
+  (fetchNuGet { pname = "ppy.ManagedBass.Wasapi"; version = "2022.1216.0"; sha256 = "0h2ncf59sza8whvrwwqi8b6fcrkqrnfgfhd0vnhyw0s98nj74f0z"; })
+  (fetchNuGet { pname = "ppy.osu.Framework"; version = "2023.1227.1"; sha256 = "1jx40963xr1wsbx09n7aq9i86wa33qm932159wp0nhbk6iqwafix"; })
+  (fetchNuGet { pname = "ppy.osu.Framework.NativeLibs"; version = "2023.1225.0-nativelibs"; sha256 = "008kj91i9486ff2q7fcgb8mmpinskvnmfsqza2m5vafh295y3h7m"; })
  (fetchNuGet { pname = "ppy.osu.Framework.SourceGeneration"; version = "2023.720.0"; sha256 = "001vvxyv483ibid25fdknvij77x0y983mp4psx2lbg3x2al7yxax"; })
-  (fetchNuGet { pname = "ppy.osu.Game.Resources"; version = "2023.1215.0"; sha256 = "03zmwpvmqw24zgl9hhnbxh3a9l2jmj5yb7j067606hk7kg14k04d"; })
+  (fetchNuGet { pname = "ppy.osu.Game.Resources"; version = "2023.1228.0"; sha256 = "09qjfavp71nlzyl6fqgpjfpsilii2fbsjyjggdbq9hf9i49hwz7s"; })
  (fetchNuGet { pname = "ppy.osuTK.NS20"; version = "1.0.211"; sha256 = "0j4a9n39pqm0cgdcps47p5n2mqph3h94r7hmf0bs59imif4jxvjy"; })
-  (fetchNuGet { pname = "ppy.SDL2-CS"; version = "1.0.671-alpha"; sha256 = "1yzakyp0wwayd9k2wmmfklmpvhig0skqk6sn98axpfgnq4hxhllm"; })
+  (fetchNuGet { pname = "ppy.SDL2-CS"; version = "1.0.693-alpha"; sha256 = "15fgd3j9cs3adldiscqm0ffixf68h06wqdz1xy1286z4gczhi954"; })
  (fetchNuGet { pname = "ppy.Veldrid"; version = "4.9.3-g91ce5a6cda"; sha256 = "0m96jkagz1ab3jgmz61d4z7jrxz058nzsamvqz93c90rlw802cvm"; })
  (fetchNuGet { pname = "ppy.Veldrid.MetalBindings"; version = "4.9.3-g91ce5a6cda"; sha256 = "14qcrvhpvj3w9nr8fcki0j53qxc8bfgflivr989salh0srnlv764"; })
  (fetchNuGet { pname = "ppy.Veldrid.OpenGLBindings"; version = "4.9.3-g91ce5a6cda"; sha256 = "1gdwk7s9sdvzrqr2rs9j87nvyl7b47b7m6kkhk1mpz6ryq403nsx"; })
--- a/pkgs/os-specific/linux/bpftune/default.nix
+++ b/pkgs/os-specific/linux/bpftune/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "bpftune";
-  version = "unstable-2023-09-11";
+  version = "unstable-2023-12-20";

  src = fetchFromGitHub {
    owner = "oracle";
    repo = "bpftune";
-    rev = "22926812a555eac910eac0699100bac0f8776f1b";
-    hash = "sha256-BflJc5lYWYFIo9LzKfb34F4V1qOI8ywVjnzOLz605DI=";
+    rev = "0e6bca2e5880fcbaac6478c4042f5f9314e61463";
+    hash = "sha256-y9WQrQb9U5YdzKAR63FzC8V1+jZL027pzAmQPpgM3jM=";
  };

  postPatch = ''
--- a/pkgs/os-specific/linux/displaylink/default.nix
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@ -8,7 +8,6 @@
 , makeWrapper
 , requireFile
 , substituteAll
-, nixosTests
 }:

 let
@ -69,12 +68,6 @@ stdenv.mkDerivation rec {
  dontStrip = true;
  dontPatchELF = true;

-  passthru = {
-    tests = {
-      inherit (nixosTests) displaylink;
-    };
-  };
-
  meta = with lib; {
    description = "DisplayLink DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
    homepage = "https://www.displaylink.com/";
--- a/pkgs/servers/corosync/default.nix
+++ b/pkgs/servers/corosync/default.nix
@ -4,6 +4,7 @@
 , enableInfiniBandRdma ? false
 , enableMonitoring ? false
 , enableSnmp ? false
+, nixosTests
 }:

 with lib;
--- a/pkgs/servers/guacamole-client/default.nix
+++ b/pkgs/servers/guacamole-client/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenvNoCC
 , fetchurl
-, nixosTests
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
@ -25,10 +24,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

-  passthru.tests = {
-    inherit (nixosTests) guacamole-client;
-  };
-
  meta = {
    description = "Clientless remote desktop gateway";
    homepage = "https://guacamole.apache.org/";
--- a/pkgs/servers/static-web-server/default.nix
+++ b/pkgs/servers/static-web-server/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "static-web-server";
-  version = "2.24.1";
+  version = "2.24.2";

  src = fetchFromGitHub {
    owner = "static-web-server";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-U+B/k/stwjJw+mxUCb4A3yUtc/+Tg0PsWhVnovLLX4A=";
+    hash = "sha256-5Axqn3sYLM4yjGkN8d0ZUe8KrjYszaZmTg5GqmamNtc=";
  };

-  cargoHash = "sha256-ZDrRjIM8187nr72MlzFr0NAqH2f8qkF1sGAT9+NvfhA=";
+  cargoHash = "sha256-xS2XARqXXcQ2J1k3jC5St19RdcK2korbEia4koUxG5s=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Security
--- a/pkgs/tools/admin/fioctl/default.nix
+++ b/pkgs/tools/admin/fioctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "fioctl";
-  version = "0.38";
+  version = "0.40";

  src = fetchFromGitHub {
    owner = "foundriesio";
    repo = "fioctl";
    rev = "v${version}";
-    sha256 = "sha256-MA7mMGZyRbQ4165qB+Q6/gQZP/yaUoZmMCVrPCPZoj4=";
+    sha256 = "sha256-G1CHm5z2D7l3NDmUMhubJsrXYUHb6FJ70EsYQShhsDE=";
  };

-  vendorHash = "sha256-OmukK6ecaiCRnK6fL238GhkxW4A4yrcR/xelBZzVwqI=";
+  vendorHash = "sha256-j0tdFvOEp9VGx8OCfUruCzwVSB8thcenpvVNn7Rf0dA=";

  ldflags = [
    "-s" "-w"
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@ -6,7 +6,7 @@
 assert par2Support -> par2cmdline != null;

 let
-  version = "0.33.2";
+  version = "0.33.3";

  pythonDeps = with python3.pkgs; [ setuptools tornado ]
    ++ lib.optionals (!stdenv.isDarwin) [ pyxattr pylibacl fuse ];
@ -20,7 +20,7 @@ stdenv.mkDerivation {
    repo = "bup";
    owner = "bup";
    rev = version;
-    hash = "sha256-DDVCrY4SFqzKukXm8rIq90xAW2U+yYyhyPmUhslMMWI=";
+    hash = "sha256-w7yPs7hG4v0Kd9i2tYhWH7vW95MAMfI/8g61MB6bfps=";
  };

  buildInputs = [ git python3 ];
--- a/pkgs/tools/misc/charasay/default.nix
+++ b/pkgs/tools/misc/charasay/default.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "charasay";
-  version = "3.1.0";
+  version = "3.2.0";

  src = fetchFromGitHub {
    owner = "latipun7";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-ijr6AvhoiYWHYTPUxSdBds9jBW1HEy1n7h6zH1VGP1c=";
+    hash = "sha256-7z5+7yrx5X5rdBMNj9oWBZ2IX0s88c1SLhgz2IDDEn8=";
  };

-  cargoHash = "sha256-HCHdiCeb4dqxQMWfYZV2k8Yq963vWfmL05BRpVYmIcg=";
+  cargoHash = "sha256-5htNU8l+amh+C8EL1K4UcXzf5Pbhhjd5RhxrucJoj/M=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/misc/wakapi/default.nix
+++ b/pkgs/tools/misc/wakapi/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "wakapi";
-  version = "2.10.0";
+  version = "2.10.2";

  src = fetchFromGitHub {
    owner = "muety";
    repo = pname;
    rev = version;
-    sha256 = "sha256-CyMzhEKaTiLODjXbHqkqEJNeCsssCjmdVOzg3vXVjJY=";
+    sha256 = "sha256-ecbWP6WnFCMCnk8o3A0UUdMj8cSmKm5KD/gVN/AVvIY=";
  };

-  vendorHash = "sha256-+FYeaIQXHZyrik/9OICl2zk+OA8X9bry7JCQbdf9QGs=";
+  vendorHash = "sha256-RG6lc2axeAAPHLS1xRh8gpV/bcnyTWzYcb1YPLpQ0uQ=";

  # Not a go module required by the project, contains development utilities
  excludedPackages = [ "scripts" ];
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@ -5,6 +5,7 @@
 , enableMinimal ? false
 , withPcsc ? !enableMinimal, pcsclite
 , guiSupport ? stdenv.isDarwin, pinentry
+, nixosTests
 }:

 assert guiSupport -> enableMinimal == false;
@ -80,7 +81,7 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  passthru.tests = lib.nixosTests.gnupg;
+  passthru.tests = nixosTests.gnupg;

  meta = with lib; {
    homepage = "https://gnupg.org";
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "automatic-timezoned";
-  version = "1.0.137";
+  version = "1.0.138";

  src = fetchFromGitHub {
    owner = "maxbrunet";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-+/P+pt79kGIr399c3oTwqbvtMc1nJNRhBYmYJsLrmDg=";
+    sha256 = "sha256-QygghEMpIoYaIIzINHXKUQmkCdoZdScZLHlIW9sObWk=";
  };

-  cargoHash = "sha256-QCWlyuoogrU09JvP+X5If1KcYjaoL0zVhBexXwSqc1U=";
+  cargoHash = "sha256-HLqONTd+8kn6nUWEEJTGevJxntnfYEu5e41/wvENZAw=";

  meta = with lib; {
    description = "Automatically update system timezone based on location";
--- a/pkgs/tools/system/nkeys/default.nix
+++ b/pkgs/tools/system/nkeys/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "nkeys";
-  version = "0.4.6";
+  version = "0.4.7";

  src = fetchFromGitHub {
    owner = "nats-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-Sgj4+akOs/3fnpP0YDoRY9WwSk4uwtIPyPilutDXOlE=";
+    hash = "sha256-ui/vSa2TGe6Pe2aAzitBa1Pd2vKgTMuHoBhYYy2p6Rw=";
  };

-  vendorHash = "sha256-8EfOtCiYCGmhGtZdPiFyNzBj+QsPx67vwFDMZ6ATidc=";
+  vendorHash = "sha256-SiSqmj6ktfiGsJOSu/pBY53e3vnN+RBfTkGwUuW52uo=";

  meta = with lib; {
    description = "Public-key signature system for NATS";
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -187,6 +187,7 @@ mapAliases ({
  dagger = throw "'dagger' has been removed from nixpkgs, as the trademark policy of the upstream project is incompatible"; # Added 2023-10-16
  dart_stable = dart; # Added 2020-01-15
  dat = nodePackages.dat;
+  deadcode = throw "'deadcode' has been removed, as upstream is abandoned since 2019-04-27. Use the official deadcode from 'gotools' package."; # Added 2023-12-28
  deadpixi-sam = deadpixi-sam-unstable;

  debugedit-unstable = debugedit; # Added 2021-11-22
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -614,8 +614,6 @@ with pkgs;

  djhtml = python3Packages.callPackage ../development/tools/djhtml { };

-  deadcode = callPackage ../development/tools/deadcode { };
-
  deadnix = callPackage ../development/tools/deadnix { };

  dec-decode = callPackage ../development/tools/dec-decode { };