Merge branch 'master' into staging-next

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -187,6 +187,12 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `services.pipewire.config` options have been removed, as they have basically never worked correctly. All behavior defined by the default configuration can be overridden with drop-in files as necessary - see [below](#sec-release-23.05-migration-pipewire) for details.
 
+- The catch-all `hardware.video.hidpi.enable` option was removed. Users on high density displays may want to:
+
+  - Set `services.xserver.upscaleDefaultCursor` to upscale the default X11 cursor for higher resolutions
+  - Adjust settings under `fonts.fontconfig` according to preference
+  - Adjust `console.font` according to preference, though the kernel will generally choose a reasonably sized font
+
 - `services.pipewire.media-session` and the `pipewire-media-session` package have been removed, as they are no longer supported upstream. Users are encouraged to use `services.pipewire.wireplumber` instead.
 
 - The `baget` package and module was removed due to being unmaintained.
@@ -270,11 +276,6 @@ In addition to numerous new and upgraded packages, this release has the followin
     [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
     can be directly written as attribute-set in Nix within this option.
 
-- The `hardware.video.hidpi.enable` was renamed to `fonts.optimizeForVeryHighDPI` to be consistent with what it actually does.
-  They disable by default: antialiasing, hinting and LCD filter for subpixel rendering. They can be overridden if you experience problems with font rendering.
-  On Xorg, the default cursor is upscaled.
-  Please see the documentation for the new option to decide if you want to keep it enabled.
-
 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.
 
 - `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion.
@@ -345,6 +346,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `k3s` can now be configured with an EnvironmentFile for its systemd service, allowing secrets to be provided without ending up in the Nix Store.
 
+- `boot.initrd.luks.device.<name>` has a new `tryEmptyPassphrase` option, this is useful for OEM's who need to install an encrypted disk with a future settable passphrase
+
 ## Detailed migration information {#sec-release-23.05-migration}
 
 ### Pipewire configuration overrides {#sec-release-23.05-migration-pipewire}

nixos/modules/config/fonts/fontconfig.nix

@@ -7,6 +7,19 @@ This module generates a package containing configuration files and link it in /e
 Fontconfig reads files in folder name / file name order, so the number prepended to the configuration file name decide the order of parsing.
 Low number means high priority.
 
+NOTE: Please take extreme care when adjusting the default settings of this module.
+People care a lot, and I mean A LOT, about their font rendering, and you will be
+The Person That Broke It if it changes in a way people don't like.
+
+See prior art:
+- https://github.com/NixOS/nixpkgs/pull/194594
+- https://github.com/NixOS/nixpkgs/pull/222236
+- https://github.com/NixOS/nixpkgs/pull/222689
+
+And do not repeat our mistakes.
+
+- @K900, March 2023
+
 */
 
 { config, pkgs, lib, ... }:
@@ -218,6 +231,8 @@ let
     paths = cfg.confPackages;
     ignoreCollisions = true;
   };
+
+  fontconfigNote = "Consider manually configuring fonts.fontconfig according to personal preference.";
 in
 {
   imports = [
@@ -229,6 +244,8 @@ in
     (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
     (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
     (mkRemovedOptionModule [ "fonts" "fontconfig" "dpi" ] "Use display server-specific options")
+    (mkRemovedOptionModule [ "hardware" "video" "hidpi" "enable" ] fontconfigNote)
+    (mkRemovedOptionModule [ "fonts" "optimizeForVeryHighDPI" ] fontconfigNote)
   ] ++ lib.forEach [ "enable" "substitutions" "preset" ]
      (opt: lib.mkRemovedOptionModule [ "fonts" "fontconfig" "ultimate" "${opt}" ] ''
        The fonts.fontconfig.ultimate module and configuration is obsolete.

nixos/modules/config/fonts/fonts.nix

@@ -13,13 +13,10 @@ let
       pkgs.unifont
       pkgs.noto-fonts-emoji
     ];
-
 in
-
 {
   imports = [
     (mkRemovedOptionModule [ "fonts" "enableCoreFonts" ] "Use fonts.fonts = [ pkgs.corefonts ]; instead.")
-    (mkRenamedOptionModule [ "hardware" "video" "hidpi" "enable" ] [ "fonts" "optimizeForVeryHighDPI" ])
   ];
 
   options = {
@@ -42,33 +39,9 @@ in
           and families and reasonable coverage of Unicode.
         '';
       };
-
-      optimizeForVeryHighDPI = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Optimize configuration for very high-density (>200 DPI) displays:
-            - disable subpixel anti-aliasing
-            - disable hinting
-            - automatically upscale the default X11 cursor
-        '';
-      };
     };
 
   };
 
-  config = mkMerge [
+  config = { fonts.fonts = mkIf cfg.enableDefaultFonts defaultFonts; };
-    { fonts.fonts = mkIf cfg.enableDefaultFonts defaultFonts; }
-    (mkIf cfg.optimizeForVeryHighDPI {
-      services.xserver.upscaleDefaultCursor = mkDefault true;
-      # Conforms to the recommendation in fonts/fontconfig.nix
-      # for > 200DPI.
-      fonts.fontconfig = {
-        antialias = mkDefault false;
-        hinting.enable = mkDefault false;
-        subpixel.lcdfilter = mkDefault "none";
-      };
-    })
-  ];
-
 }

nixos/modules/services/logging/logrotate.nix

@@ -187,7 +187,7 @@ in
           A configuration file automatically generated by NixOS.
         '';
         description = lib.mdDoc ''
-          Override the configuration file used by MySQL. By default,
+          Override the configuration file used by logrotate. By default,
           NixOS generates one automatically from [](#opt-services.logrotate.settings).
         '';
         example = literalExpression ''

nixos/modules/system/boot/luksroot.nix

@@ -158,6 +158,20 @@ let
       wait_target "header" ${dev.header} || die "${dev.header} is unavailable"
     ''}
 
+    try_empty_passphrase() {
+        ${if dev.tryEmptyPassphrase then ''
+             echo "Trying empty passphrase!"
+             echo "" | ${csopen}
+             cs_status=$?
+             if [ $cs_status -eq 0 ]; then
+                 return 0
+             else
+                 return 1
+             fi
+        '' else "return 1"}
+    }
+
+
     do_open_passphrase() {
         local passphrase
 
@@ -212,13 +226,27 @@ let
             ${csopen} --key-file=${dev.keyFile} \
               ${optionalString (dev.keyFileSize != null) "--keyfile-size=${toString dev.keyFileSize}"} \
               ${optionalString (dev.keyFileOffset != null) "--keyfile-offset=${toString dev.keyFileOffset}"}
+            cs_status=$?
+            if [ $cs_status -ne 0 ]; then
+              echo "Key File ${dev.keyFile} failed!"
+              if ! try_empty_passphrase; then
+                ${if dev.fallbackToPassword then "echo" else "die"} "${dev.keyFile} is unavailable"
+                echo " - failing back to interactive password prompt"
+                do_open_passphrase
+              fi
+            fi
         else
-            ${if dev.fallbackToPassword then "echo" else "die"} "${dev.keyFile} is unavailable"
+            # If the key file never shows up we should also try the empty passphrase
-            echo " - failing back to interactive password prompt"
+            if ! try_empty_passphrase; then
-            do_open_passphrase
+               ${if dev.fallbackToPassword then "echo" else "die"} "${dev.keyFile} is unavailable"
+               echo " - failing back to interactive password prompt"
+               do_open_passphrase
+            fi
         fi
         '' else ''
-        do_open_passphrase
+           if ! try_empty_passphrase; then
+              do_open_passphrase
+           fi
         ''}
     }
 
@@ -476,6 +504,7 @@ let
   preLVM = filterAttrs (n: v: v.preLVM) luks.devices;
   postLVM = filterAttrs (n: v: !v.preLVM) luks.devices;
 
+
   stage1Crypttab = pkgs.writeText "initrd-crypttab" (lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: let
     opts = v.crypttabExtraOpts
       ++ optional v.allowDiscards "discard"
@@ -483,6 +512,8 @@ let
       ++ optional (v.header != null) "header=${v.header}"
       ++ optional (v.keyFileOffset != null) "keyfile-offset=${toString v.keyFileOffset}"
       ++ optional (v.keyFileSize != null) "keyfile-size=${toString v.keyFileSize}"
+      ++ optional (v.keyFileTimeout != null) "keyfile-timeout=${builtins.toString v.keyFileTimeout}s"
+      ++ optional (v.tryEmptyPassphrase) "try-empty-password=true"
     ;
   in "${n} ${v.device} ${if v.keyFile == null then "-" else v.keyFile} ${lib.concatStringsSep "," opts}") luks.devices));
 
@@ -594,6 +625,25 @@ in
             '';
           };
 
+          tryEmptyPassphrase = mkOption {
+            default = false;
+            type = types.bool;
+            description = lib.mdDoc ''
+              If keyFile fails then try an empty passphrase first before
+              prompting for password.
+            '';
+          };
+
+          keyFileTimeout = mkOption {
+            default = null;
+            example = 5;
+            type = types.nullOr types.int;
+            description = lib.mdDoc ''
+              The amount of time in seconds for a keyFile to appear before
+              timing out and trying passwords.
+            '';
+          };
+
           keyFileSize = mkOption {
             default = null;
             example = 4096;
@@ -889,6 +939,10 @@ in
           message = "boot.initrd.luks.devices.<name>.bypassWorkqueues is not supported for kernels older than 5.9";
         }
 
+        { assertion = !config.boot.initrd.systemd.enable -> all (x: x.keyFileTimeout == null) (attrValues luks.devices);
+          message = "boot.initrd.luks.devices.<name>.keyFileTimeout is only supported for systemd initrd";
+        }
+
         { assertion = config.boot.initrd.systemd.enable -> all (dev: !dev.fallbackToPassword) (attrValues luks.devices);
           message = "boot.initrd.luks.devices.<name>.fallbackToPassword is implied by systemd stage 1.";
         }

nixos/tests/all-tests.nix

@@ -311,6 +311,7 @@ in {
   influxdb = handleTest ./influxdb.nix {};
   initrd-network-openvpn = handleTest ./initrd-network-openvpn {};
   initrd-network-ssh = handleTest ./initrd-network-ssh {};
+  initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix {};
   initrdNetwork = handleTest ./initrd-network.nix {};
   initrd-secrets = handleTest ./initrd-secrets.nix {};
   initrd-secrets-changing = handleTest ./initrd-secrets-changing.nix {};
@@ -662,6 +663,7 @@ in {
   systemd-initrd-btrfs-raid = handleTest ./systemd-initrd-btrfs-raid.nix {};
   systemd-initrd-luks-fido2 = handleTest ./systemd-initrd-luks-fido2.nix {};
   systemd-initrd-luks-keyfile = handleTest ./systemd-initrd-luks-keyfile.nix {};
+  systemd-initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix { systemdStage1 = true; };
   systemd-initrd-luks-password = handleTest ./systemd-initrd-luks-password.nix {};
   systemd-initrd-luks-tpm2 = handleTest ./systemd-initrd-luks-tpm2.nix {};
   systemd-initrd-modprobe = handleTest ./systemd-initrd-modprobe.nix {};

nixos/tests/initrd-luks-empty-passphrase.nix

@@ -0,0 +1,97 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. {inherit system config; }
+, systemdStage1 ? false }:
+import ./make-test-python.nix ({ lib, pkgs, ... }: let
+
+  keyfile = pkgs.writeText "luks-keyfile" ''
+    MIGHAoGBAJ4rGTSo/ldyjQypd0kuS7k2OSsmQYzMH6TNj3nQ/vIUjDn7fqa3slt2
+    gV6EK3TmTbGc4tzC1v4SWx2m+2Bjdtn4Fs4wiBwn1lbRdC6i5ZYCqasTWIntWn+6
+    FllUkMD5oqjOR/YcboxG8Z3B5sJuvTP9llsF+gnuveWih9dpbBr7AgEC
+  '';
+
+in {
+  name = "initrd-luks-empty-passphrase";
+
+  nodes.machine = { pkgs, ... }: {
+    virtualisation = {
+      emptyDiskImages = [ 512 ];
+      useBootLoader = true;
+      useEFIBoot = true;
+    };
+
+    boot.loader.systemd-boot.enable = true;
+    boot.initrd.systemd = lib.mkIf systemdStage1 {
+      enable = true;
+      emergencyAccess = true;
+    };
+    environment.systemPackages = with pkgs; [ cryptsetup ];
+
+    specialisation.boot-luks-wrong-keyfile.configuration = {
+      boot.initrd.luks.devices = lib.mkVMOverride {
+        cryptroot = {
+          device = "/dev/vdc";
+          keyFile = "/etc/cryptroot.key";
+          tryEmptyPassphrase = true;
+          fallbackToPassword = !systemdStage1;
+        };
+      };
+      virtualisation.bootDevice = "/dev/mapper/cryptroot";
+      boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
+    };
+
+    specialisation.boot-luks-missing-keyfile.configuration = {
+      boot.initrd.luks.devices = lib.mkVMOverride {
+        cryptroot = {
+          device = "/dev/vdc";
+          keyFile = "/etc/cryptroot.key";
+          tryEmptyPassphrase = true;
+          fallbackToPassword = !systemdStage1;
+        };
+      };
+      virtualisation.bootDevice = "/dev/mapper/cryptroot";
+    };
+  };
+
+  testScript = ''
+    # Encrypt key with empty key so boot should try keyfile and then fallback to empty passphrase
+
+
+    def grub_select_boot_luks_wrong_key_file():
+        """
+        Selects "boot-luks" from the GRUB menu
+        to trigger a login request.
+        """
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey ret")
+
+    def grub_select_boot_luks_missing_key_file():
+        """
+        Selects "boot-luks" from the GRUB menu
+        to trigger a login request.
+        """
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey ret")
+
+    # Create encrypted volume
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("echo "" | cryptsetup luksFormat /dev/vdc --batch-mode")
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-wrong-keyfile.conf")
+    machine.succeed("sync")
+    machine.crash()
+
+    # Check if rootfs is on /dev/mapper/cryptroot
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+
+    # Choose boot-luks-missing-keyfile specialisation
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-missing-keyfile.conf")
+    machine.succeed("sync")
+    machine.crash()
+
+    # Check if rootfs is on /dev/mapper/cryptroot
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+  '';
+})

pkgs/applications/audio/lsp-plugins/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lsp-plugins";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchurl {
     url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
+    sha256 = "sha256-lNrIsXW3ZNKMFwsl5qowWqK/ZaCaQUAlrSscnsOxvVg=";
   };
 
   outputs = [ "out" "dev" "doc" ];
@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
+    "ETCDIR=${placeholder "out"}/etc"
+    "SHAREDDIR=${placeholder "out"}/share"
   ];
 
   env.NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
@@ -34,138 +36,58 @@ stdenv.mkDerivation rec {
   meta = with lib;
     { description = "Collection of open-source audio plugins";
       longDescription = ''
-        Compatible with follwing formats:
+        Compatible with the following formats:
 
+        - CLAP - set of plugins for Clever Audio Plugins API
         - LADSPA - set of plugins for Linux Audio Developer's Simple Plugin API
         - LV2 - set of plugins and UIs for Linux Audio Developer's Simple Plugin API (LADSPA) version 2
         - LinuxVST - set of plugins and UIs for Steinberg's VST 2.4 format ported on GNU/Linux Platform
         - JACK - Standalone versions for JACK Audio connection Kit with UI
 
-        Contains the following plugins:
+        Contains the following plugins (https://lsp-plug.in/?page=plugins)
 
-        - Limiter Mono - Begrenzer Mono
+        Equalizers:
-        - Limiter Stereo - Begrenzer Stereo
+        - Graphic Equalizer
-        - Dynamic Processor LeftRight - Dynamikprozessor LeftRight
+        - Parametric Equalizer
-        - Dynamic Processor MidSide - Dynamikprozessor MidSide
+        Dynamic Processing:
-        - Dynamic Processor Mono - Dynamikprozessor Mono
+        - Compressor
-        - Dynamic Processor Stereo - Dynamikprozessor Stereo
+        - Dynamic Processor
-        - Expander LeftRight - Expander LeftRight
+        - Expander
-        - Expander MidSide - Expander MidSide
+        - Gate
-        - Expander Mono - Expander Mono
+        - Limiter
-        - Expander Stereo - Expander Stereo
+        Multiband Dynamic Processing:
-        - Crossover LeftRight x8 - Frequenzweiche LeftRight x8
+        - Multiband Compressor
-        - Crossover MidSide x8 - Frequenzweiche MidSide x8
+        - Multiband Dynamic Processor
-        - Crossover Mono x8 - Frequenzweiche Mono x8
+        - Multiband Expander
-        - Crossover Stereo x8 - Frequenzweiche Stereo x8
+        - Multiband Gate
-        - Gate LeftRight - Gate LeftRight
+        Convolution / Reverb processing:
-        - Gate MidSide - Gate MidSide
+        - Impulse Responses
-        - Gate Mono - Gate Mono
+        - Impulse Reverb
-        - Gate Stereo - Gate Stereo
+        - Room Builder
-        - Graphic Equalizer x16 LeftRight - Grafischer Entzerrer x16 LeftRight
+        Delay Effects:
-        - Graphic Equalizer x16 MidSide - Grafischer Entzerrer x16 MidSide
+        - Artistic Delay
-        - Graphic Equalizer x16 Mono - Grafischer Entzerrer x16 Mono
+        - Compensation Delay
-        - Graphic Equalizer x16 Stereo - Grafischer Entzerrer x16 Stereo
+        - Slap-back Delay
-        - Graphic Equalizer x32 LeftRight - Grafischer Entzerrer x32 LeftRight
+        Analyzers:
-        - Graphic Equalizer x32 MidSide - Grafischer Entzerrer x32 MidSide
+        - Oscilloscope
-        - Graphic Equalizer x32 Mono - Grafischer Entzerrer x32 Mono
+        - Phase Detector
-        - Graphic Equalizer x32 Stereo - Grafischer Entzerrer x32 Stereo
+        - Spectrum Analyzer
-        - Impulse Responses Mono - Impulsantworten Mono
+        Multiband Processing:
-        - Impulse Responses Stereo - Impulsantworten Stereo
+        - Crossover
-        - Impulse Reverb Mono - Impulsnachhall Mono
+        Samplers:
-        - Impulse Reverb Stereo - Impulsnachhall Stereo
+        - Multisampler
-        - Sampler Mono - Klangerzeuger Mono
+        - Sampler
-        - Sampler Stereo - Klangerzeuger Stereo
+        Generators / Oscillators:
-        - Compressor LeftRight - Kompressor LeftRight
+        - Noise Generator
-        - Compressor MidSide - Kompressor MidSide
+        - Oscillator
-        - Compressor Mono - Kompressor Mono
+        Utilitary Plugins:
-        - Compressor Stereo - Kompressor Stereo
+        - A/B Test Plugin
-        - Artistic Delay Mono - Künstlerische Verzögerung
+        - Latency Meter
-        - Artistic Delay Stereo - Künstlerische Verzögerung
+        - Loudness Compensator
-        - Latency Meter - Latenzmessgerät
+        - Mixer
-        - Loudness Compensator Mono - Lautstärke Kompensator Mono
+        - Profiler
-        - Loudness Compensator Stereo - Lautstärke Kompensator Stereo
+        - Surge Filter
-        - Multiband Expander LeftRight x8 - Multi-band Expander LeftRight x8
+        - Trigger
-        - Multiband Expander MidSide x8 - Multi-band Expander MidSide x8
-        - Multiband Expander Mono x8 - Multi-band Expander Mono x8
-        - Multiband Expander Stereo x8 - Multi-band Expander Stereo x8
-        - Multiband Gate LeftRight x8 - Multi-band Gate LeftRight x8
-        - Multiband Gate MidSide x8 - Multi-band Gate MidSide x8
-        - Multiband Gate Mono x8 - Multi-band Gate Mono x8
-        - Multiband Gate Stereo x8 - Multi-band Gate Stereo x8
-        - Multiband Compressor LeftRight x8 - Multi-band Kompressor LeftRight x8
-        - Multiband Compressor MidSide x8 - Multi-band Kompressor MidSide x8
-        - Multiband Compressor Mono x8 - Multi-band Kompressor Mono x8
-        - Multiband Compressor Stereo x8 - Multi-band Kompressor Stereo x8
-        - Oscilloscope x1 - Oscilloscope x1
-        - Oscilloscope x2 - Oscilloscope x2
-        - Oscilloscope x4 - Oscilloscope x4
-        - Oscillator Mono - Oszillator Mono
-        - Parametric Equalizer x16 LeftRight - Parametrischer Entzerrer x16 LeftRight
-        - Parametric Equalizer x16 MidSide - Parametrischer Entzerrer x16 MidSide
-        - Parametric Equalizer x16 Mono - Parametrischer Entzerrer x16 Mono
-        - Parametric Equalizer x16 Stereo - Parametrischer Entzerrer x16 Stereo
-        - Parametric Equalizer x32 LeftRight - Parametrischer Entzerrer x32 LeftRight
-        - Parametric Equalizer x32 MidSide - Parametrischer Entzerrer x32 MidSide
-        - Parametric Equalizer x32 Mono - Parametrischer Entzerrer x32 Mono
-        - Parametric Equalizer x32 Stereo - Parametrischer Entzerrer x32 Stereo
-        - Phase Detector - Phasendetektor
-        - Profiler Mono - Profiler Mono
-        - Profiler Stereo - Profiler Stereo
-        - Room Builder Mono - Raumbaumeister Mono
-        - Room Builder Stereo - Raumbaumeister Stereo
-        - Multi-Sampler x12 DirectOut - Schlagzeug x12 Direktausgabe
-        - Multi-Sampler x12 Stereo - Schlagzeug x12 Stereo
-        - Multi-Sampler x24 DirectOut - Schlagzeug x24 Direktausgabe
-        - Multi-Sampler x24 Stereo - Schlagzeug x24 Stereo
-        - Multi-Sampler x48 DirectOut - Schlagzeug x48 Direktausgabe
-        - Multi-Sampler x48 Stereo - Schlagzeug x48 Stereo
-        - Sidechain Multiband Expander LeftRight x8 - Sidechain Multi-band Expander LeftRight x8
-        - Sidechain Multiband Expander MidSide x8 - Sidechain Multi-band Expander MidSide x8
-        - Sidechain Multiband Expander Mono x8 - Sidechain Multi-band Expander Mono x8
-        - Sidechain Multiband Expander Stereo x8 - Sidechain Multi-band Expander Stereo x8
-        - Sidechain Multiband Gate LeftRight x8 - Sidechain Multi-band Gate LeftRight x8
-        - Sidechain Multiband Gate MidSide x8 - Sidechain Multi-band Gate MidSide x8
-        - Sidechain Multiband Gate Mono x8 - Sidechain Multi-band Gate Mono x8
-        - Sidechain Multiband Gate Stereo x8 - Sidechain Multi-band Gate Stereo x8
-        - Sidechain Multiband Compressor LeftRight x8 - Sidechain Multi-band Kompressor LeftRight x8
-        - Sidechain Multiband Compressor MidSide x8 - Sidechain Multi-band Kompressor MidSide x8
-        - Sidechain Multiband Compressor Mono x8 - Sidechain Multi-band Kompressor Mono x8
-        - Sidechain Multiband Compressor Stereo x8 - Sidechain Multi-band Kompressor Stereo x8
-        - Sidechain Limiter Mono - Sidechain-Begrenzer Mono
-        - Sidechain Limiter Stereo - Sidechain-Begrenzer Stereo
-        - Sidechain Dynamic Processor LeftRight - Sidechain-Dynamikprozessor LeftRight
-        - Sidechain Dynamic Processor MidSide - Sidechain-Dynamikprozessor MidSide
-        - Sidechain Dynamic Processor Mono - Sidechain-Dynamikprozessor Mono
-        - Sidechain Dynamic Processor Stereo - Sidechain-Dynamikprozessor Stereo
-        - Sidechain Expander LeftRight - Sidechain-Expander LeftRight
-        - Sidechain Expander MidSide - Sidechain-Expander MidSide
-        - Sidechain Expander Mono - Sidechain-Expander Mono
-        - Sidechain Expander Stereo - Sidechain-Expander Stereo
-        - Sidechain Gate LeftRight - Sidechain-Gate LeftRight
-        - Sidechain Gate MidSide - Sidechain-Gate MidSide
-        - Sidechain Gate Mono - Sidechain-Gate Mono
-        - Sidechain Gate Stereo - Sidechain-Gate Stereo
-        - Sidechain Compressor LeftRight - Sidechain-Kompressor LeftRight
-        - Sidechain Compressor MidSide - Sidechain-Kompressor MidSide
-        - Sidechain Compressor Mono - Sidechain-Kompressor Mono
-        - Sidechain Compressor Stereo - Sidechain-Kompressor Stereo
-        - Slapback Delay Mono - Slapback-Delay Mono
-        - Slapback Delay Stereo - Slapback-Delay Stereo
-        - Spectrum Analyzer x1 - Spektrumanalysator x1
-        - Spectrum Analyzer x12 - Spektrumanalysator x12
-        - Spectrum Analyzer x16 - Spektrumanalysator x16
-        - Spectrum Analyzer x2 - Spektrumanalysator x2
-        - Spectrum Analyzer x4 - Spektrumanalysator x4
-        - Spectrum Analyzer x8 - Spektrumanalysator x8
-        - Surge Filter Mono - Sprungfilter Mono
-        - Surge Filter Stereo - Sprungfilter Stereo
-        - Trigger MIDI Mono - Triggersensor MIDI Mono
-        - Trigger MIDI Stereo - Triggersensor MIDI Stereo
-        - Trigger Mono - Triggersensor Mono
-        - Trigger Stereo - Triggersensor Stereo
-        - Delay Compensator Mono - Verzögerungsausgleicher Mono
-        - Delay Compensator Stereo - Verzögerungsausgleicher Stereo
-        - Delay Compensator x2 Stereo - Verzögerungsausgleicher x2 Stereo
       '';
       homepage = "https://lsp-plug.in";
       maintainers = with maintainers; [ magnetophon ];

pkgs/applications/audio/sonic-lineup/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, alsa-lib, boost, bzip2, fftw, fftwFloat, libfishsound
+{ lib, stdenv, fetchurl, fetchpatch2, alsa-lib, boost, bzip2, fftw, fftwFloat, libfishsound
 , libid3tag, liblo, libmad, liboggz, libpulseaudio, libsamplerate
 , libsndfile, lrdf, opusfile, portaudio, rubberband, serd, sord, capnproto
 , wrapQtAppsHook, pkg-config
@@ -14,6 +14,16 @@ stdenv.mkDerivation rec {
     sha256 = "0k45k9fawcm4s5yy05x00pgww7j8m7k2cxcc7g0fn9vqy7vcbq9h";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/sonic-visualiser/svcore/commit/5a7b517e43b7f0b3f03b7fc3145102cf4e5b0ffc.patch";
+      stripLen = 1;
+      extraPrefix = "svcore/";
+      sha256 = "sha256-DOCdQqCihkR0g/6m90DbJxw00QTpyVmFzCxagrVWKiI=";
+    })
+    ./match-vamp.patch
+  ];
+
   buildInputs =
     [ alsa-lib boost bzip2 fftw fftwFloat libfishsound libid3tag liblo
       libmad liboggz libpulseaudio libsamplerate libsndfile lrdf opusfile
@@ -36,7 +46,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = [ maintainers.vandenoever ];
     platforms = platforms.linux;
-    # undefined reference to `std::__throw_bad_array_new_length()@GLIBCXX_3.4.29'
-    broken = true; # at 2022-09-30
   };
 }

pkgs/applications/audio/sonic-lineup/match-vamp.patch

@@ -0,0 +1,11 @@
+--- a/match/src/FullDTW.h
++++ b/match/src/FullDTW.h
+@@ -83,7 +83,7 @@
+      * against the best-matching subsequence of s1; otherwise it is
+      * against the whole of s1.
+      */
+-    std::vector<size_t> align(const featureseq_t &s1,
++    std::vector<std::size_t> align(const featureseq_t &s1,
+                               const featureseq_t &s2);
+ 
+ private:

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -69,6 +69,17 @@
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
   };
+  bass = buildGrammar {
+    language = "bass";
+    version = "27f110d";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-bass";
+      rev = "27f110dfe79620993f5493ffa0d0f2fe12d250ed";
+      hash = "sha256-OmYtp2TAsAjw2fgdSezHUrP46b/QXgCbDeJa4ANrtvY=";
+    };
+    meta.homepage = "https://github.com/amaanq/tree-sitter-bass";
+  };
   beancount = buildGrammar {
     language = "beancount";
     version = "f3741a3";
@@ -590,12 +601,12 @@
   };
   glimmer = buildGrammar {
     language = "glimmer";
-    version = "40cfb72";
+    version = "bc1c685";
     src = fetchFromGitHub {
       owner = "alexlafroscia";
       repo = "tree-sitter-glimmer";
-      rev = "40cfb72a53654cbd666451ca04ffd500257c7b73";
+      rev = "bc1c685aa6a7caf9e58c5746ab386a1e673eb9af";
-      hash = "sha256-h9ZZz6mbkErLIG/BamNRRoRdqmuBO3v17W0uvmpbm7A=";
+      hash = "sha256-CDXyynCsnmOvOs1rs9e29tNHosywTvGM0UyWVtwMqZ8=";
     };
     meta.homepage = "https://github.com/alexlafroscia/tree-sitter-glimmer";
   };
@@ -1597,12 +1608,12 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "4cb5b36";
+    version = "d2b64d8";
     src = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "4cb5b36d70687bfe4687c68483b4dacde309ae6f";
+      rev = "d2b64d85d0cab5edeffe44243134033e6ff07c02";
-      hash = "sha256-7YkVPuQS8NGcHXHwgFTZ4kWL01AnNeOGxdY8xFISSzY=";
+      hash = "sha256-Mo87yEF0YGF9t+bXvxuULtlOWAFKyBDjU6rF6eOXLao=";
     };
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -793,7 +793,7 @@ self: super: {
         pname = "sg-nvim-rust";
         inherit (old) version src;
 
-        cargoHash = "sha256-z3ZWHhqiJKFzVcFJadfPU6+ELlnvEOAprCyStszegdI=";
+        cargoHash = "sha256-GN7KM3fkeOcqmyUwsPMw499kS/eYqh8pbyPgMv4/NN4=";
 
         nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -324,6 +324,7 @@ https://github.com/cocopon/iceberg.vim/,,
 https://github.com/idris-hackers/idris-vim/,,
 https://github.com/edwinb/idris2-vim/,,
 https://github.com/lewis6991/impatient.nvim/,,
+https://github.com/smjonas/inc-rename.nvim/,HEAD,
 https://github.com/nishigori/increment-activator/,,
 https://github.com/haya14busa/incsearch-easymotion.vim/,,
 https://github.com/haya14busa/incsearch.vim/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2953,6 +2953,24 @@ let
         };
       };
 
+      vscjava.vscode-gradle = buildVscodeMarketplaceExtension rec {
+        mktplcRef = {
+          name = "vscode-gradle";
+          publisher = "vscjava";
+          version = "3.12.6";
+          sha256 = "sha256-j4JyhNGsRlJmS8Wj38gLpC1gXVvdPx10cgzP8dXmmNo=";
+        };
+
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/vscjava.vscode-gradle/changelog";
+          description = "A Visual Studio Code extension for Gradle build tool";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=vscjava.vscode-gradle";
+          homepage = "https://github.com/microsoft/vscode-gradle";
+          license = lib.licenses.mit;
+          maintainers = with lib.maintainers; [ rhoriguchi ];
+        };
+      };
+
       vscjava.vscode-java-debug = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-java-debug";

pkgs/applications/graphics/komikku/default.nix

@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "komikku";
-  version = "1.15.0";
+  version = "1.16.0";
 
   format = "other";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "valos";
     repo = "Komikku";
     rev = "v${version}";
-    hash = "sha256-dmi8a9Gf4ixq5oW6ewDGZYRmxY2qmUrD42DfjskRpHk=";
+    hash = "sha256-SzK86uzdGnNFNtbvw56n3AxjxcCBjHFs9wD98TVggAo=";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/pick-colour-picker/default.nix

@@ -22,6 +22,11 @@ buildPythonPackage rec {
     fetchSubmodules = false;
   };
 
+  postPatch = ''
+    sed "s|sys\.prefix|'\.'|g" -i setup.py
+    sed "s|os.environ.get('SNAP'), \"usr\"|'$out'|g" -i pick/__main__.py
+  '';
+
   nativeBuildInputs = [
     gobject-introspection
     wrapGAppsHook
@@ -37,16 +42,6 @@ buildPythonPackage rec {
     gtk3
   ];
 
-  preDistPhases = [ "fixupIconPath" ];
-
-  fixupIconPath = ''
-    pickLoc="$out/${python.sitePackages}/pick"
-    shareLoc=$(echo "$out/${python.sitePackages}/nix/store/"*)
-    mv "$shareLoc/share" "$out/share"
-
-    sed "s|os.environ.get('SNAP'), \"usr\"|'$out'|g" -i "$pickLoc/__main__.py"
-    '';
-
   meta = with lib; {
     homepage = "https://kryogenix.org/code/pick/";
     license = licenses.mit;

pkgs/applications/misc/ttdl/default.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ttdl";
-  version = "3.6.5";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "VladimirMarkelov";
     repo = "ttdl";
     rev = "v${version}";
-    sha256 = "sha256-mplV++N+us6IntNJsZoH4yyKZ8eYplUYuVJeac0ZIkQ=";
+    sha256 = "sha256-4XmOFoj2kynQZzos/vf0rciJCGfnFLN7f1MG9NU53os=";
   };
 
-  cargoHash = "sha256-mgvMQjScXCmr3HIQtGJ2YWRUhiSP5resL96LUCe8D+c=";
+  cargoHash = "sha256-9TyEHAlxTNx/ildlqEjuFIKfmUQQFQSVoxcrb2Tg9Ps=";
 
   meta = with lib; {
     description = "A CLI tool to manage todo lists in todo.txt format";

pkgs/applications/misc/veracrypt/default.nix

@@ -12,6 +12,7 @@
 , exfat
 , ntfs3g
 , btrfs-progs
+, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -37,7 +38,7 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "src";
 
-  nativeBuildInputs = [ makeself pkg-config yasm ];
+  nativeBuildInputs = [ makeself pkg-config yasm wrapGAppsHook ];
   buildInputs = [ fuse lvm2 wxGTK ];
 
   enableParallelBuilding = true;

pkgs/applications/misc/watchmate/default.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "watchmate";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "azymohliad";
     repo = "watchmate";
     rev = "v${version}";
-    hash = "sha256-LwtlI6WCOO24w8seUzyhCp51pfEiCM+iL6lu/J6v4PQ=";
+    hash = "sha256-+E1tyDfFSu3J89fXd75bdYxh+Z1zTwKL6AmMTNQBEYY=";
   };
 
-  cargoHash = "sha256-MD0eWZDpCevBY1Y3Gzgk13qCFtL7QOPDATv8MA+Q5go=";
+  cargoHash = "sha256-xfgO2MInUAidgqN1B7byMIzHD19IzbnBvRMo7Ir10hk=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "111.0.5563.64",
+    "version": "111.0.5563.110",
-    "sha256": "0x20zqwq051a5j76q1c3m0ddf1hhcm6fgz3b7rqrfamjppia0p3x",
+    "sha256": "0rd7hxa02dy64xwhkwk8v71hqmbvyzcnqldvxpvdr8khn5rnrpa9",
-    "sha256bin64": "0rnqrjnybghb4h413cw3f54ga2x76mfmf1fp2nnf59c1yml4r4vf",
+    "sha256bin64": "18ph8di5g235jrsc0xpwf58f2sx2mmaz25g1921d3fqva8s1vri0",
     "deps": {
       "gn": {
         "version": "2022-12-12",
@@ -12,16 +12,16 @@
       }
     },
     "chromedriver": {
-      "version": "111.0.5563.41",
+      "version": "111.0.5563.64",
-      "sha256_linux": "160khwa4x6w9gv5vkvalwbx87r6hrql0y0xr7zvxsir1x6rklwm2",
+      "sha256_linux": "0f4v6hds5wl43hnmqxmzidlg5nqgr4iy04hmrmvzaihsdny3na8s",
-      "sha256_darwin": "0z5q9r39jd5acyd79yzrkgqkvv3phdkyq4wvdsmhnpypazg072l6",
+      "sha256_darwin": "0izdp36d4wid5hmz8wcna3gddly7nbkafqqf5k1ikb2jgx9ipp8f",
-      "sha256_darwin_aarch64": "0xiagydqnywzrpqq3i7363zhiywkp8ra9ygb2q1gznb40rx98pbr"
+      "sha256_darwin_aarch64": "0yzn7bibj36wrc980s9sa8cl0qds01n9i88jk95afx5lk5zb8rgc"
     }
   },
   "beta": {
-    "version": "112.0.5615.29",
+    "version": "112.0.5615.39",
-    "sha256": "0k9dn1gzfr2j353ppza1nypj0a4b27p9n742cms3z8583da8kw6p",
+    "sha256": "12q4wxlgcqqflsxvcbx00228l1hjzb940ichywhiwmndxjjdvrgg",
-    "sha256bin64": "04m77ndsfygpb1g11iyscvfszgykbr5n3s6bh1shnpkpdbvx3dki",
+    "sha256bin64": "0b5c02wlmywhkxgdlnwys1djknicvqxcichxgazgpxbjmr8mmzwv",
     "deps": {
       "gn": {
         "version": "2023-02-17",
@@ -45,8 +45,8 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "111.0.5563.65",
+    "version": "111.0.5563.111",
-    "sha256": "1wg84pd50zi5268snkiahnp5191c66bqkbvdz2z8azivm95lwqwp",
+    "sha256": "0r03p8m92fwsi8z1i8qjwllbb68gkspnzwynvmag3jy5kyk4vprv",
     "sha256bin64": null,
     "deps": {
       "gn": {
@@ -56,8 +56,8 @@
         "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
       },
       "ungoogled-patches": {
-        "rev": "111.0.5563.65-1",
+        "rev": "111.0.5563.111-1",
-        "sha256": "06mfm2gaz1nbwqhn2jp34pm52rw1q99i9fq7wh19m0qasdpidis9"
+        "sha256": "1m8kf8af5zjc5mgdccppyfbl6bxlwcnb6rw58q5020a810x7y6f8"
       }
     }
   }

pkgs/applications/networking/cluster/kubernetes/default.nix

@@ -20,16 +20,16 @@
 
 buildGoModule rec {
   pname = "kubernetes";
-  version = "1.26.1";
+  version = "1.26.3";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "sha256-bC2Q4jWBh27bqLGhvG4JcuHIAQmiGz5jDt9Me9qbVpk=";
+    hash = "sha256-dJMfnd82JIPxyVisr5o9s/bC3ZDiolF841pmV4c9LN8=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   doCheck = false;
 

pkgs/applications/networking/cluster/kubeshark/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubeshark";
-  version = "38.5";
+  version = "39.4";
 
   src = fetchFromGitHub {
     owner = "kubeshark";
     repo = "kubeshark";
     rev = version;
-    sha256 = "sha256-xu+IcmYNsFBYhb0Grnqyi31LCG/3XhSh1LH8XakQ3Yk=";
+    sha256 = "sha256-Z32FuQPh9wG2XNMAfC9Zg7G9j8btNxTcYRl+Z5f5gM8=";
   };
 
-  vendorHash = "sha256-o04XIUsHNqOBkvcejASHNz1HDnV6F9t+Q2Hg8eL/Uoc=";
+  vendorHash = "sha256-stpWIqLQ2PTjocuekkOI/D7QvkxX4NI1YTKIh3V6c4c=";
 
   ldflags = let t = "github.com/kubeshark/kubeshark"; in [
    "-s" "-w"

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -110,13 +110,13 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-j+hKWMHnIE6nmRdGHaQxLybeljmheZ7t83NSXVWViZI=",
+    "hash": "sha256-7LN+ezJMoBsH/WiJuVbkVyaOURUHTuY1kJ8gBOebAIM=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v4.59.0",
+    "rev": "v4.60.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-TGzTElOmYW6XO4EtMD9MWvdvd1opnFSAVcEA2eYCQdk="
+    "vendorHash": "sha256-ydAQqeaj/XN3VXNpcJAYYOV0iXSQVUraWUZKDoZOyrw="
   },
   "azuread": {
     "hash": "sha256-MGCGfocs16qmJnvMRRD7TRHnPkS17h+oNUkMARAQhLs=",
@@ -328,13 +328,13 @@
     "vendorHash": "sha256-Ba4J6LUchqhdZTxcJxTgP20aZVioybIzKvF4j5TDQIk="
   },
   "dnsimple": {
-    "hash": "sha256-8xESl8n/AMURVtnJ9Gd0eZ+flbdLya8RotRBgMF7mBk=",
+    "hash": "sha256-fLYaGjQy4NtXuVePYQ8/dI7W04QM6UV3h6f2qU8hM6k=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v0.16.2",
+    "rev": "v0.16.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Id1rL/Mu/aES7OFQ/rQRMmm3D/GSbGofZludqbWffKo="
+    "vendorHash": "sha256-gARkcCVDxamHHyLhUaJ85OGDmUjeOW8LUxVyM348QUY="
   },
   "docker": {
     "hash": "sha256-UyHOI8C0eDV5YllAi9clHp/CEldHjIp3FHHMPy1rK58=",
@@ -639,11 +639,11 @@
     "vendorHash": "sha256-lXQHo66b9X0jZhoF+5Ix5qewQGyI82VPJ7gGzc2CHao="
   },
   "kubernetes": {
-    "hash": "sha256-4TUUejEKbnsRmqwdQVhHF+QWW8kReq+ZQQvpcT+YhsQ=",
+    "hash": "sha256-FV5FoEd0zjXa8x77r/z8Tn/I1lZI1NZ4a8yisAuAhNQ=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/kubernetes",
     "owner": "hashicorp",
     "repo": "terraform-provider-kubernetes",
-    "rev": "v2.18.1",
+    "rev": "v2.19.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -856,13 +856,13 @@
     "vendorHash": "sha256-62q67aaOZA3fQmyL8bEHB+W497bcx9Xy7kKrbkjkbaI="
   },
   "opentelekomcloud": {
-    "hash": "sha256-fkEQ4VWGJiPFTA6Wz8AxAiL4DOW+Kewl8T9ywy/yPME=",
+    "hash": "sha256-ZDhihbYH6O6UCU2WOkPE+tcOODkAsbx7v9Vg1wrbklg=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.33.2",
+    "rev": "v1.34.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-EbUHKM6fKEZk1ey4qTgAd/20OKJu0DoBF0MAOxB7y64="
+    "vendorHash": "sha256-tLtgg6QQiXivDxDVEYeOnLqXobwN7ZFqQrI0d3pUHeE="
   },
   "opsgenie": {
     "hash": "sha256-Wbe+DyK5wKuZZX8yd3DJN+2wT8KZt+YsBwJYKnZnfcI=",
@@ -1072,13 +1072,13 @@
     "vendorHash": "sha256-fgvNdBwkz+YHOrLRQSe1D+3/VUhttKkJGzV6cg57g8s="
   },
   "sumologic": {
-    "hash": "sha256-1BwhcyEJs7Xm+p2ChA9K7g+qBzqoh3eyAT9qKMfHB1g=",
+    "hash": "sha256-sJo3dGGtKT+hPo9qVA+2BYkJhNY9N9FrgKpHqdTYrUQ=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v2.21.0",
+    "rev": "v2.22.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-dpMa+XnfavXO0lXiBZOsU+O+5/3a/IMkfzpQcnD/sSw="
+    "vendorHash": "sha256-iNBM4Y24vDGPKyb5cppSogk145F0/pAFmOzEeiWgfLI="
   },
   "tailscale": {
     "hash": "sha256-X3YV640d3pLyKm/v88oEhXfYnox+ksrEWKgiJbYl6gk=",
@@ -1108,13 +1108,13 @@
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-eFyRa4T+CqIeOcEYj4DQP6ypR7AROYrGDYuYSqBfKr0=",
+    "hash": "sha256-K0l9oaYkgilz47ErUxio9oJtPHQTWZnKdPpjRZ1SDhg=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.42.0",
+    "rev": "v0.43.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-bhAoNJSbrpAzw0qCKIm84h6tFqUWT0JeBs1gJpPeJdU="
+    "vendorHash": "sha256-plYy3INLi/SeKu7R0lDLY1CvRDU7bmZsQKzFtMc2Wu4="
   },
   "thunder": {
     "hash": "sha256-GLyGm9Q+ajuQFIni/OCYvYhpj2fiVYHzkPwbofq/DEs=",
@@ -1254,13 +1254,13 @@
     "vendorHash": "sha256-ib1Esx2AO7b9S+v+zzuATgSVHI3HVwbzEeyqhpBz1BQ="
   },
   "yandex": {
-    "hash": "sha256-XT31rLurZAvjE08cAGIkd7pcS1LMdOIU6e60qLrLsXI=",
+    "hash": "sha256-bkKGZAGxeJC5JeVwRB+moChFvTF2zUHxB75H82RSACI=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "proxyVendor": true,
     "repo": "terraform-provider-yandex",
-    "rev": "v0.87.0",
+    "rev": "v0.88.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-r2+ARKvTghscGBhmZpz84vdBudiy2OsmQR03oDz5gbs="
+    "vendorHash": "sha256-X8jQnuTtuN1M2qDYaE0dgOdB2DdgyQashsGb8mZOycQ="
   }
 }

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dino";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "dino";
     repo = "dino";
     rev = "v${version}";
-    sha256 = "sha256-1czey1/Zn96JneCUnhPMyffG9FVV4bA9aidNB7Ozkpo=";
+    sha256 = "sha256-85Sh3UwoMaa+bpL81gIKtkpCeRl1mXbs8Odux1FURdQ=";
   };
 
   postPatch = ''

pkgs/applications/networking/shellhub-agent/default.nix

@@ -9,18 +9,18 @@
 
 buildGo120Module rec {
   pname = "shellhub-agent";
-  version = "0.11.6";
+  version = "0.11.7";
 
   src = fetchFromGitHub {
     owner = "shellhub-io";
     repo = "shellhub";
     rev = "v${version}";
-    sha256 = "eZLQzy3lWwGM6VWFbsJ6JuGC+/dZnoymZgNtM8CPBM4=";
+    sha256 = "d5ESQQgBPUFe2tuCbeFIqiWPpr9wUczbXLc5QdXurXY=";
   };
 
   modRoot = "./agent";
 
-  vendorSha256 = "sha256-7kDPo24I58Nh7OiHj6Zy40jAEaXSOmbcczkgJPXBItU=";
+  vendorSha256 = "sha256-/85rIBfFBpXYrsCBDGVzXfAxO6xXQ8uTL2XeEPKQwDQ=";
 
   ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];
 

pkgs/applications/version-management/datalad/default.nix

@@ -8,7 +8,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "datalad";
     repo = pname;
     rev = version;
-    hash = "sha256-6uWOKsYeNZJ64WqoGHL7AsoK4iZd24TQOJ1ECw+K28Y=";
+    hash = "sha256-F5UFW0/XqntrHclpj3TqoAwuHJbiiv5a7/4MnFoJ1dE=";
   };
 
   nativeBuildInputs = [ installShellFiles git ];

pkgs/applications/version-management/dvc/default.nix

@@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "iterative";
     repo = pname;
     rev = version;
-    hash = "sha256-2h+fy4KMxFrVtKJBtA1RmJDZv0OVm1BxO1akZzAw95Y=";
+    hash = "sha256-P0J+3TNHGqMw3krfs1uLnf8nEiIBK6UrrB37mY+fBA0=";
   };
 
   postPatch = ''
@@ -98,5 +98,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://dvc.org";
     license = licenses.asl20;
     maintainers = with maintainers; [ cmcdragonkai fab ];
+    broken = true; # requires new python package: dvc-studio-client
   };
 }

pkgs/applications/version-management/gitkraken/default.nix

@@ -10,24 +10,24 @@ with lib;
 
 let
   pname = "gitkraken";
-  version = "9.1.1";
+  version = "9.2.1";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      sha256 = "sha256-CbIKdErthpMnVIuv+EJsWBRixMDG8h9aQ2XcmqpzKUc=";
+      sha256 = "sha256-JyfbCFh76b2ZWQ8J1xhsp8LYeFGdgJcUDgBCJWHf0Rk=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      sha256 = "sha256-J6ruK1UE0A9VG1tUHeSUDEL4wqRmUnOH8ftKHIIQuVc=";
+      sha256 = "sha256-sXWgxl+j78r/OhkMkQMQ6iUPz+SY+QDS4pvLErJTeRQ=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      sha256 = "sha256-cjz/pbV+uV6tbhj3NXDfZ93hgxFtNYhFIh6+jG4pFtU=";
+      sha256 = "sha256-1IsNJMfqpi+s2bHkB6Uo6FacvuRdLpkF+ctmi5b2Lto=";
     };
   };
 

pkgs/applications/video/olive-editor/default.nix

@@ -1,34 +1,69 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib
-, pkg-config, which, qmake, wrapQtAppsHook
+, stdenv
-, qtmultimedia, frei0r, opencolorio_1, ffmpeg_4, CoreFoundation }:
+, fetchFromGitHub
+, pkg-config
+, which
+, frei0r
+, opencolorio
+, ffmpeg_4
+, CoreFoundation
+, cmake
+, wrapQtAppsHook
+, openimageio2
+, openexr_3
+, portaudio
+, imath
+, qtwayland
+, qtmultimedia
+, qttools
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "olive-editor";
-  version = "0.1.2";
+  version = "unstable-2023-03-20";
 
   src = fetchFromGitHub {
+    fetchSubmodules = true;
     owner = "olive-editor";
     repo = "olive";
-    rev = version;
+    rev = "8ca16723613517c41304de318169d27c571b90af";
-    sha256 = "151g6jwhipgbq4llwib92sq23p1s9hm6avr7j4qq3bvykzrm8z1a";
+    sha256 = "sha256-lL90+8L7J7pjvhbqfeIVF0WKgl6qQzNun8pL9YPL5Is=";
   };
 
-  patches = [
+  cmakeFlags = [
-    ./q-painter-path.patch
+    "-DBUILD_QT6=1"
   ];
 
+  # https://github.com/olive-editor/olive/issues/2200
+  patchPhase = ''
+    runHook prePatch
+    substituteInPlace ./app/node/project/serializer/serializer.h \
+      --replace 'QStringRef' 'QStringView'
+    substituteInPlace ./app/node/project/serializer/serializer.cpp \
+      --replace 'QStringRef' 'QStringView'
+    substituteInPlace ./app/node/project/serializer/serializer230220.cpp \
+      --replace 'QStringRef' 'QStringView'
+    runHook postPatch
+  '';
+
   nativeBuildInputs = [
     pkg-config
     which
-    qmake
+    cmake
     wrapQtAppsHook
   ];
 
   buildInputs = [
     ffmpeg_4
     frei0r
-    opencolorio_1
+    opencolorio
+    openimageio2
+    imath
+    openexr_3
+    portaudio
+    qtwayland
     qtmultimedia
+    qttools
   ] ++ lib.optional stdenv.isDarwin CoreFoundation;
 
   meta = with lib; {

pkgs/applications/virtualization/podman/default.nix

@@ -61,13 +61,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.4.2";
+  version = "4.4.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-337PFsPGm7pUgnFeNJKwT+/7AdbWSfCx4kXyAvHyWJQ=";
+    hash = "sha256-s0aGZN4rnyyNLoO3nnAO7KbeD7MYxE9VMOHrQsKGNBk=";
   };
 
   patches = [

pkgs/build-support/rust/build-rust-package/sysroot/default.nix

@@ -1,10 +1,10 @@
-{ stdenv, rust, rustPlatform, buildPackages }:
+{ lib, stdenv, rust, rustPlatform, buildPackages }:
 
 { shortTarget, originalCargoToml, target, RUSTFLAGS }:
 
 let
   cargoSrc = import ../../sysroot/src.nix {
-    inherit stdenv rustPlatform buildPackages originalCargoToml;
+    inherit lib stdenv rustPlatform buildPackages originalCargoToml;
   };
 in rustPlatform.buildRustPackage {
   inherit target RUSTFLAGS;
@@ -14,7 +14,7 @@ in rustPlatform.buildRustPackage {
 
   RUSTC_BOOTSTRAP = 1;
   __internal_dontAddSysroot = true;
-  cargoSha256 = "0y6dqfhsgk00y3fv5bnjzk0s7i30nwqc1rp0xlrk83hkh80x81mw";
+  cargoSha256 = "sha256-zgkwevitxsu1C4OgGTsqNSc0gDxaNXYK1WPbfER48d0=";
 
   doCheck = false;
 
@@ -29,4 +29,7 @@ in rustPlatform.buildRustPackage {
     host=${rust.toRustTarget stdenv.buildPlatform}
     cp -r $RUST_SYSROOT/lib/rustlib/$host $out
   '';
+
+  # allows support for cross-compilation
+  meta.platforms = lib.platforms.all;
 }

pkgs/build-support/rust/replace-workspace-values.py

@@ -63,8 +63,16 @@ def replace_dependencies(
 
 
 def main() -> None:
+    top_cargo_toml = load_file(sys.argv[2])
+
+    if "workspace" not in top_cargo_toml:
+        # If top_cargo_toml is not a workspace manifest, then this script was probably
+        # ran on something that does not actually use workspace dependencies
+        print(f"{sys.argv[2]} is not a workspace manifest, doing nothing.")
+        return
+
     crate_manifest = load_file(sys.argv[1])
-    workspace_manifest = load_file(sys.argv[2])["workspace"]
+    workspace_manifest = top_cargo_toml["workspace"]
 
     if "workspace" in crate_manifest:
         return

pkgs/build-support/rust/sysroot/Cargo.lock

@@ -1,5 +1,7 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
+version = 3
+
 [[package]]
 name = "alloc"
 version = "0.0.0"
@@ -10,9 +12,9 @@ dependencies = [
 
 [[package]]
 name = "compiler_builtins"
-version = "0.1.52"
+version = "0.1.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6591c2442ee984e2b264638a8b5e7ae44fd47b32d28e3a08e2e9c3cdb0c2fb0"
+checksum = "f867ce54c09855ccd135ad4a50c777182a0c7af5ff20a8f537617bd648b10d50"
 dependencies = [
  "rustc-std-workspace-core",
 ]

pkgs/build-support/rust/sysroot/src.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   + ''
     ${buildPackages.python3.withPackages (ps: with ps; [ toml ])}/bin/python3 ${./cargo.py}
     mkdir -p $out/src
-    touch $out/src/lib.rs
+    echo '#![no_std]' > $out/src/lib.rs
     cp Cargo.toml $out/Cargo.toml
     cp ${./Cargo.lock} $out/Cargo.lock
   '';

pkgs/desktops/mate/mate-desktop/default.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-desktop";
-  version = "1.26.0";
+  version = "1.26.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "18sj8smf0b998m5qvki37hxg0agcx7wmgz9z7cwv6v48i2dnnz2z";
+    sha256 = "EtFmiiesGr1gk1OB0/OYIbuAhGenuKz570WIXXyAohE=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/mate/mate-polkit/default.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-polkit";
-  version = "1.26.0";
+  version = "1.26.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0kkjv025l1l8352m5ky1g7hmk7isgi3dnfnh7sqg9pyhml97i9dd";
+    sha256 = "9bewtd/FMwLEBAMkWZjrkSGvP1DnFmagmrc7slRSA1c=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/bootil/default.nix

@@ -39,6 +39,7 @@ stdenv.mkDerivation {
     license = licenses.free;
     maintainers = with maintainers; [ abigailbuccaneer ];
     # Build uses `-msse` and `-mfpmath=sse`
+    platforms = platforms.all;
     badPlatforms = [ "aarch64-linux" ];
   };
 }

pkgs/development/libraries/imgui/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "imgui";
-  version = "1.89.3";
+  version = "1.89.4";
 
   src = fetchFromGitHub {
     owner = "ocornut";
     repo = "imgui";
     rev = "v${version}";
-    sha256 = "sha256-hPUOqXMpjKNuWVo2RUq2Nw5i+p8PE8qmlyATV7y3Lgg=";
+    sha256 = "sha256-iBpJzfU8ATDilU/1zhV9T/1Zy22g8vw81cmkmJ5+6cg=";
   };
 
   dontBuild = true;

pkgs/development/libraries/minizip-ng/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "minizip-ng";
-  version = "3.0.8";
+  version = "3.0.9";
 
   src = fetchFromGitHub {
     owner = "zlib-ng";
     repo = finalAttrs.pname;
     rev = finalAttrs.version;
-    sha256 = "sha256-Vzp+5fQBJoO1pG7j8LwC2/B/cOgM/exhKyb3zHuy89Y=";
+    sha256 = "sha256-yuHJUy/Ed7dutmosmcbedz5nZoCc5imLDOXikIde8bs=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

pkgs/development/libraries/mygui/default.nix

@@ -20,13 +20,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mygui";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "MyGUI";
     repo = "mygui";
     rev = "MyGUI${version}";
-    sha256 = "0a4zi8w18pjj813n7kmxldl1d9r1jp0iyhkw7pbqgl8f7qaq994w";
+    hash = "sha256-5u9whibYKPj8tCuhdLOhL4nDisbFAB0NxxdjU/8izb8=";
   };
 
   patches = [
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://mygui.info/";
     description = "Library for creating GUIs for games and 3D applications";
-    license = licenses.lgpl3Plus;
+    license = licenses.mit;
     platforms = platforms.unix;
   };
 }

pkgs/development/libraries/physics/rivet/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rivet";
-  version = "3.1.6";
+  version = "3.1.7";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/rivet/Rivet-${version}.tar.bz2";
-    hash = "sha256-HPbrtqedGBxEHR0MfG1iPEI4F8YQk/NvIa2q4j5nkJA=";
+    hash = "sha256-J8fbvLX9fugcrxNtr06WC8oOwlXZ+hq+YC9NQwhhsno=";
   };
 
   latex = texlive.combine { inherit (texlive)

pkgs/development/libraries/rocm-opencl-runtime/default.nix

@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-opencl-runtime";
-  version = "5.4.3";
+  version = "5.4.4";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";

pkgs/development/libraries/science/math/or-tools/default.nix

@@ -39,6 +39,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/google/or-tools/commit/a26602f24781e7bfcc39612568aa9f4010bb9736.patch";
       hash = "sha256-gM0rW0xRXMYaCwltPK0ih5mdo3HtX6mKltJDHe4gbLc=";
     })
+    # Backport fix in cmake test configuration where pip installs newer version from PyPi over local build,
+    #  breaking checkPhase: https://github.com/google/or-tools/issues/3260
+    (fetchpatch {
+      url = "https://github.com/google/or-tools/commit/edd1544375bd55f79168db315151a48faa548fa0.patch";
+      hash = "sha256-S//1YM3IoRCp3Ghg8zMF0XXgIpVmaw4gH8cVb9eUbqM=";
+    })
   ];
 
   cmakeFlags = [
@@ -48,7 +54,7 @@ stdenv.mkDerivation rec {
     "-DFETCH_PYTHON_DEPS=OFF"
     "-DUSE_GLPK=ON"
     "-DUSE_SCIP=OFF"
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ "-DCMAKE_MACOSX_RPATH=OFF" ];
   nativeBuildInputs = [
     cmake
     ensureNewerSourcesForZipFilesHook
@@ -104,6 +110,6 @@ stdenv.mkDerivation rec {
       Google's software suite for combinatorial optimization.
     '';
     maintainers = with maintainers; [ andersk ];
-    platforms = with platforms; linux;
+    platforms = with platforms; linux ++ darwin;
   };
 }

pkgs/development/libraries/sope/default.nix

@@ -1,4 +1,4 @@
-{ gnustep, lib, fetchFromGitHub , libxml2, openssl
+{ gnustep, lib, fetchFromGitHub, fetchpatch, libxml2, openssl
 , openldap, mariadb, libmysqlclient, postgresql }:
 
 gnustep.stdenv.mkDerivation rec {
@@ -12,20 +12,36 @@ gnustep.stdenv.mkDerivation rec {
     hash = "sha256-sXIpKdJ5930+W+FsxQ8DZOq/49XWMM1zV8dIzbQdcbc=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "sope-no-unnecessary-vars.patch";
+      url = "https://github.com/Alinto/sope/commit/0751a2f11961fd7de4e2728b6e34e9ba4ba5887e.patch";
+      hash = "sha256-1txj8Qehg2N7ZsiYQA2FXI4peQAE3HUwDYkJEP9WnEk=";
+    })
+    (fetchpatch {
+      name = "sope-fix-wformat.patch";
+      url = "https://github.com/Alinto/sope/commit/6adfadd5dd2da4041657ad071892f2c9b1704d22.patch";
+      hash = "sha256-zCbvVdbeBeNo3/cDVdYbyUUC2z8D6Q5ga0plUoMqr98=";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
   nativeBuildInputs = [ gnustep.make ];
-  buildInputs = lib.flatten ([ gnustep.base libxml2 openssl ]
+  buildInputs = [ gnustep.base libxml2 openssl ]
     ++ lib.optional (openldap != null) openldap
     ++ lib.optionals (mariadb != null) [ libmysqlclient mariadb ]
-    ++ lib.optional (postgresql != null) postgresql);
+    ++ lib.optional (postgresql != null) postgresql;
-
-  postPatch = ''
-    # Exclude NIX_ variables
-    sed -i 's/grep GNUSTEP_/grep ^GNUSTEP_/g' configure
-  '';
 
+  # Configure directories where files are installed to. Everything is automatically
+  # put into $out (thanks GNUstep) apart from the makefiles location which is where
+  # makefiles are read from during build but also where the SOPE makefiles are
+  # installed to in the install phase. We move them over after the installation.
   preConfigure = ''
-    export DESTDIR="$out"
+    mkdir -p /build/Makefiles
+    ln -s ${gnustep.make}/share/GNUstep/Makefiles/* /build/Makefiles
+    cat <<EOF > /build/GNUstep.conf
+    GNUSTEP_MAKEFILES=/build/Makefiles
+    EOF
   '';
 
   configureFlags = [ "--prefix=" "--disable-debug" "--enable-xml" "--with-ssl=ssl" ]
@@ -33,10 +49,12 @@ gnustep.stdenv.mkDerivation rec {
     ++ lib.optional (mariadb != null) "--enable-mysql"
     ++ lib.optional (postgresql != null) "--enable-postgresql";
 
-  # Yes, this is ugly.
+  env.GNUSTEP_CONFIG_FILE = "/build/GNUstep.conf";
-  preFixup = ''
+
-    cp -rlPa $out/nix/store/*/* $out
+  # Move over the makefiles (see comment over preConfigure)
-    rm -rf $out/nix/store
+  postInstall = ''
+    mkdir -p $out/share/GNUstep/Makefiles
+    find /build/Makefiles -mindepth 1 -maxdepth 1 -not -type l -exec cp -r '{}' $out/share/GNUstep/Makefiles \;
   '';
 
   meta = with lib; {

pkgs/development/libraries/wayland/default.nix

@@ -11,6 +11,7 @@
 , withLibraries ? stdenv.isLinux
 , withTests ? stdenv.isLinux
 , libffi
+, epoll-shim
 , withDocumentation ? withLibraries && stdenv.hostPlatform == stdenv.buildPlatform
 , graphviz-nox
 , doxygen
@@ -82,6 +83,8 @@ stdenv.mkDerivation rec {
     libxml2
   ] ++ lib.optionals withLibraries [
     libffi
+  ] ++ lib.optionals (withLibraries && !stdenv.hostPlatform.isLinux) [
+    epoll-shim
   ] ++ lib.optionals withDocumentation [
     docbook_xsl
     docbook_xml_dtd_45

pkgs/development/ocaml-modules/janestreet/0.15.nix

@@ -254,6 +254,15 @@ with self;
     propagatedBuildInputs = [ async_websocket cohttp-async ppx_jane uri-sexp ];
   };
 
+  cohttp_static_handler = janePackage {
+    duneVersion = "3";
+    pname = "cohttp_static_handler";
+    version = "0.15.0";
+    hash = "sha256-ENaH8ChvjeMc9WeNIhkeNBB7YK9vB4lw95o6FFZI1ys=";
+    meta.description = "A library for easily creating a cohttp handler for static files";
+    propagatedBuildInputs = [ cohttp-async ];
+  };
+
   core = janePackage {
     pname = "core";
     version = "0.15.1";

pkgs/development/ocaml-modules/magic-trace/default.nix

@@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub, buildDunePackage, async, cohttp_static_handler
+, core_unix, owee, ppx_jane, shell }:
+
+buildDunePackage rec {
+  pname = "magic-trace";
+  version = "1.1.0";
+
+  minimalOCamlVersion = "4.12";
+  duneVersion = "3";
+
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = "magic-trace";
+    rev = "v${version}";
+    sha256 = "sha256-615AOkrbQI6vRosA5Kz3Epipe9f9+Gs9+g3bVl5gzBY=";
+  };
+
+  buildInputs = [ async cohttp_static_handler core_unix owee ppx_jane shell ];
+
+  meta = with lib; {
+    description =
+      "Collects and displays high-resolution traces of what a process is doing";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/janestreet/magic-trace";
+  };
+}

pkgs/development/ocaml-modules/owee/default.nix

@@ -2,19 +2,20 @@
 
 buildDunePackage rec {
   minimalOCamlVersion = "4.06";
-  useDune2 = true;
+  duneVersion = "2";
   pname = "owee";
-  version = "0.4";
+  version = "0.6";
 
   src = fetchurl {
-    url = "https://github.com/let-def/owee/releases/download/v${version}/owee-${version}.tbz";
+    url =
-    sha256 = "sha256:055bi0yfdki1pqagbhrwmfvigyawjgsmqw04zhpp6hds8513qzvb";
+      "https://github.com/let-def/owee/releases/download/v${version}/owee-${version}.tbz";
+    sha256 = "sha256-GwXV5t4GYbDiGwyvQyW8NZoYvn4qXlLnjX331Bj1wjM=";
   };
 
-  meta = {
+  meta = with lib; {
     description = "An experimental OCaml library to work with DWARF format";
     homepage = "https://github.com/let-def/owee/";
-    license = lib.licenses.mit;
+    license = licenses.mit;
-    maintainers = [ lib.maintainers.vbgl ];
+    maintainers = with maintainers; [ vbgl alizter ];
   };
 }

pkgs/development/ocaml-modules/spacetime_lib/default.nix

@@ -6,8 +6,7 @@ lib.throwIfNot (lib.versionAtLeast "4.12" ocaml.version)
 buildDunePackage rec {
   pname = "spacetime_lib";
   version = "0.3.0";
-
+  duneVersion = "2";
-  useDune2 = true;
 
   src = fetchFromGitHub {
     owner = "lpw25";
@@ -16,6 +15,8 @@ buildDunePackage rec {
     sha256 = "0biisgbycr5v3nm5jp8i0h6vq76vzasdjkcgh8yr7fhxc81jgv3p";
   };
 
+  patches = [ ./spacetime.diff ];
+
   propagatedBuildInputs = [ owee ];
 
   preConfigure = ''

pkgs/development/ocaml-modules/spacetime_lib/spacetime.diff

@@ -0,0 +1,14 @@
+diff --git a/src/elf_locations.ml b/src/elf_locations.ml
+index a08b359..0db9274 100644
+--- a/src/elf_locations.ml
++++ b/src/elf_locations.ml
+@@ -37,7 +37,8 @@ let resolve_from_dwarf t ~program_counter =
+     | Some section ->
+       let body = Owee_buf.cursor (Owee_elf.section_body t.map section) in
+       let rec aux () =
+-        match Owee_debug_line.read_chunk body with
++        let pointers_to_other_sections = Owee_elf.debug_line_pointers t.map t.sections in
++        match Owee_debug_line.read_chunk body ~pointers_to_other_sections with
+         | None -> ()
+         | Some (header, chunk) ->
+           (* CR-soon mshinwell: fix owee .mli to note that [state] is

pkgs/development/python-modules/ailment/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.42";
+  version = "9.2.43";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-45wEnYx2/XvyVlew8rwPFSHZtj6NdZWPEEomkqBLNIw=";
+    hash = "sha256-Nww43TIIWHJo8tKNQoPYWHXzslnsBGftxfTCg3elo6w=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/aioharmony/default.nix

@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "aioharmony";
-  version = "0.2.9";
+  version = "0.2.10";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-T30pLzPWD+5pb0ShkpNdiBFO45RdiMYgCOSg8rx+t+Y=";
+    hash = "sha256-18+38QunEdEGdirQOT+528vYqiqDuUr/CWRQtXKf4rs=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/angr/default.nix

@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.42";
+  version = "9.2.43";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-EbOGAY7aqpWngy8ImdDt8dmJhc1UEiX0I8KY8TSump0=";
+    hash = "sha256-SHUuKF7rT2x7CxF9s6ntxniOjhf7asY7HJeMi38Dqrc=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/annexremote/default.nix

@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Lykos153";
     repo = "AnnexRemote";
     rev = "v${version}";
-    sha256 = "08myswj1vqkl4s1glykq6xn76a070nv5mxj0z8ibl6axz89bvypi";
+    sha256 = "sha256-h03gkRAMmOq35zzAq/OuctJwPAbP0Idu4Lmeu0RycDc=";
   };
 
   nativeCheckInputs = [

pkgs/development/python-modules/archinfo/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.42";
+  version = "9.2.43";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jDC4nmHg7OCo7mQ7iLeG7OFB1xAQxkKw1WZTyY2FBoY=";
+    hash = "sha256-j+JzLN6ila3PsTtxespvPKyH6NVO8eFncDw9qPFDLyQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/asf-search/default.nix

@@ -9,7 +9,6 @@
 , importlib-metadata
 , numpy
 , dateparser
-, jinja2
 , remotezip
 , pytestCheckHook
 , requests-mock
@@ -18,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "asf-search";
-  version = "6.1.0";
+  version = "6.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +26,7 @@ buildPythonPackage rec {
     owner = "asfadmin";
     repo = "Discovery-asf_search";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3CnarUqW7/hEo4zvRGLJ+VAY5X+aacBdY1Epef523vY=";
+    hash = "sha256-4RFGhA9xzc1kxSni6rAbevoDkc1bLdQD1II/2xq/uKM=";
   };
 
   propagatedBuildInputs = [
@@ -38,7 +37,6 @@ buildPythonPackage rec {
     importlib-metadata
     numpy
     dateparser
-    jinja2
     remotezip
   ];
 
@@ -56,6 +54,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/asfadmin/Discovery-asf_search/blob/${src.rev}/CHANGELOG.md";
     description = "Python wrapper for the ASF SearchAPI";
     homepage = "https://github.com/asfadmin/Discovery-asf_search";
     license = licenses.bsd3;

pkgs/development/python-modules/azure-keyvault-keys/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "azure-keyvault-keys";
-  version = "4.7.0";
+  version = "4.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-9jdA9dwNmxQtitZZCfSoSe9UmiDobf8uwyLBPeBILYw=";
+    hash = "sha256-bAuy94MgKjSj5ex0hm5iEuWRrHEk8DuWadGwm2giS8Q=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/cairo-lang/default.nix

@@ -31,28 +31,16 @@
 
 buildPythonPackage rec {
   pname = "cairo-lang";
-  version = "0.10.0";
+  version = "0.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchzip {
     url = "https://github.com/starkware-libs/cairo-lang/releases/download/v${version}/cairo-lang-${version}.zip";
-    hash = "sha256-+PE7RSKEGADbue63FoT6UBOwURJs7lBNkL7aNlpSxP8=";
+    hash = "sha256-MNbzDqqNhij9JizozLp9hhQjbRGzWxECOErS3TOPlAA=";
   };
 
-  # TODO: remove a substantial part when https://github.com/starkware-libs/cairo-lang/pull/88/files is merged.
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "lark-parser" "lark"
-
-    substituteInPlace starkware/cairo/lang/compiler/parser_transformer.py \
-      --replace 'value, meta' 'meta, value' \
-      --replace 'value: Tuple[CommaSeparatedWithNotes], meta' 'meta, value: Tuple[CommaSeparatedWithNotes]'
-    substituteInPlace starkware/cairo/lang/compiler/parser.py \
-      --replace 'standard' 'basic'
-  '';
-
   nativeBuildInputs = [
     pythonRelaxDepsHook
   ];
@@ -99,6 +87,10 @@ buildPythonPackage rec {
     "pytest-asyncio"
   ];
 
+  postFixup = ''
+    chmod +x $out/bin/*
+  '';
+
   # There seems to be no test included in the ZIP release…
   # Cloning from GitHub is harder because they use a custom CMake setup
   # TODO(raitobezarius): upstream was pinged out of band about it.

pkgs/development/python-modules/claripy/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.42";
+  version = "9.2.43";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-94FEyPL9zjHBFC8L/Aij8OcS5GiBBEY1Tnm4N7zNW0g=";
+    hash = "sha256-g7kXjoJDzc+MPmGR6dO7mGi3LcJQem6pnLvbuoC9Pxw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/cle/default.nix

@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.42";
+  version = "9.2.43";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NZPXpL4bnPXJHIPf+Jwt6vE7G43JAjhZhW2xeNSw3R8=";
+    hash = "sha256-GWChdbQRnoD6hRVONLcFNoW9vJO9iWKLnjd8xiA/7jI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/dateparser/default.nix

@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "dateparser";
-  version = "1.1.7";
+  version = "1.1.8";
 
   disabled = pythonOlder "3.7";
 
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "scrapinghub";
     repo = "dateparser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KQCjXuBDBZduNYJITwk1qx7mBp8CJ95ZbFlhrFMkE8w=";
+    hash = "sha256-52g8defF5bsisBv2QoyUymXcf0sljOI9PjeR4l0Pw6k=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/debugpy/default.nix

@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , pythonOlder
+, pythonAtLeast
 , fetchFromGitHub
 , fetchpatch
 , substituteAll
@@ -22,13 +23,15 @@ buildPythonPackage rec {
   version = "1.6.6";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  # Currently doesn't support 3.11:
+  # https://github.com/microsoft/debugpy/issues/1107
+  disabled = pythonOlder "3.7" || pythonAtLeast "3.11";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "debugpy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GanRWzGyg0Efa+kuU7Q0IOmO0ohXZIjuz8RZYERTpzo=";
+    hash = "sha256-jEhvpPO3QeKjPiOMxg2xOWitWtZ6UCWyM1WvnbrKnFI=";
   };
 
   patches = [

pkgs/development/python-modules/gvm-tools/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "gvm-tools";
-  version = "23.2.0";
+  version = "23.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-TwGeLEfP69ZK/fkhS0sB6aPh8aDjg6Tri2mUUzk4jbk=";
+    hash = "sha256-sv34PwOEWGsIgSNpUcqvwjJ+6FSrmpXNB5gc47EjFU0=";
   };
 
   nativeBuildInputs = [
@@ -48,6 +48,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Collection of APIs that help with remote controlling a Greenbone Security Manager";
     homepage = "https://github.com/greenbone/gvm-tools";
+    changelog = "https://github.com/greenbone/gvm-tools/releases/tag/v${version}";
     license = with licenses; [ gpl3Plus ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/mautrix/default.nix

@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.19.6";
+  version = "0.19.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -29,8 +29,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "python";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    hash = "sha256-Km6Lh4iKUBwQcsChTrV9yCaPhVBINJotp/5XnPfoOMk=";
+    hash = "sha256-uL4eNMe+NXyE+kLy87zZPNBDuMnAt3KHT01ryFVfBZU=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/myst-docutils/default.nix

@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "myst-docutils";
-  version = "0.18.1";
+  version = "1.0.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Dxg5TtQaK4plvRmXZa7AqPFIv/jvUOpV8M/BJohiXj0=";
+    hash = "sha256-fbh97Z/5TnnMHj2bGZ4UvJkPpYtrTTcFOgpLWgHUYk0=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/peaqevcore/default.nix

@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "13.3.0";
+  version = "13.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1faEVqSGhRr+CaRHgZMS093fSC3hBgK2CX0oCxAIjCU=";
+    hash = "sha256-f4Xq68QBcnHZdwZrAwg7QUvZrXYvrflEkh1us48YN/g=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pontos/default.nix

@@ -17,16 +17,16 @@
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "23.3.5";
+  version = "23.3.6";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Eb9mX04ws+FhiRw5j1XsEhjm5ZdYFCbA5pntgb4z//M=";
+    hash = "sha256-cs+UeE5QRL/yzFABpMQ4masbLHwG++Ipu5GidXJ1Y0E=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pvo/default.nix

@@ -13,16 +13,16 @@
 
 buildPythonPackage rec {
   pname = "pvo";
-  version = "0.2.2";
+  version = "1.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-pvoutput";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    hash = "sha256-2/O81MnFYbdOrzLiTSoX7IW+3ZGyyE/tIqgKr/sEaHI=";
+    hash = "sha256-6oVACUnK8WVlEx047CUXmSXQ0+M3xnSvyMHw5Wttk7M=";
   };
 
   nativeBuildInputs = [
@@ -55,6 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to interact with the PVOutput API";
     homepage = "https://github.com/frenck/python-pvoutput";
+    changelog = "https://github.com/frenck/python-pvoutput/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/pyswitchbot/default.nix

@@ -1,10 +1,12 @@
 { lib
+, async-timeout
 , bleak
 , bleak-retry-connector
 , boto3
 , buildPythonPackage
 , cryptography
 , fetchFromGitHub
+, pyopenssl
 , pythonOlder
 , pytestCheckHook
 , requests
@@ -12,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbot";
-  version = "0.37.3";
+  version = "0.37.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,14 +23,16 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     rev = "refs/tags/${version}";
-    hash = "sha256-0Kzzyzlxs5PaEHKzJLsconUg4zmgPzWI8LD5UIcKwEY=";
+    hash = "sha256-2P7hj0kfKLPyuKk6ouHJtkWCUT3EC1spQTjBQarwpbU=";
   };
 
   propagatedBuildInputs = [
+    async-timeout
     bleak
     bleak-retry-connector
     boto3
     cryptography
+    pyopenssl
     requests
   ];
 

pkgs/development/python-modules/pyvex/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.42";
+  version = "9.2.43";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5pp66sI15sdavyZD+xrTFqhAgjT89KswBE0MQ09Fdl4=";
+    hash = "sha256-X1lFSbVhHBhQ6Y1pbzjObAISqA6rBTpx0Ww5c6p+3LM=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/rpmfile/default.nix

@@ -5,11 +5,11 @@
 }:
 buildPythonPackage rec {
   pname = "rpmfile";
-  version = "1.0.8";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e56cfc10e1a7d953b1890d81652a89400c614f4cdd9909464aece434d93c3a3e";
+    sha256 = "sha256-ZxcHe1QxdG2GBIPMNrnJy6Vd8SRgZ4HOtwsks2be8Cs=";
   };
 
   # Tests access the internet

pkgs/development/python-modules/scmrepo/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "scmrepo";
-  version = "0.1.15";
+  version = "0.1.16";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Z/W49P1T8XgCmKWLTO/eI7ArAB9QKWUbJWRTlRnjJ7E=";
+    hash = "sha256-d8CwvxWdFhKXzv6mzWh+WIH6VSBsQOpdyc5UIwrh7kg=";
   };
 
   postPatch = ''

pkgs/development/python-modules/upcloud-api/default.nix

@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "upcloud-api";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "UpCloudLtd";
     repo = "upcloud-python-api";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "1kkgrn97pw4k49ys97hjrvh2j8y2p2r9970v9csgrk5wci4562wm";
+    sha256 = "sha256-thmrbCpGjlDkHIZwIjRgIVMplaypiKByFS/nS8F2LXA=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/vispy/default.nix

@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "vispy";
-  version = "0.12.1";
+  version = "0.12.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4AiBwdD5ssCOtuJuk2GtveijqW54eO5sHhmefFhyIk8=";
+    hash = "sha256-FBwt3MwRWFVbyJ8JAQxLHXVEh+gWNXMz8x55WnFGoCQ=";
   };
 
   patches = [

pkgs/development/tools/buildah/default.nix

@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "buildah";
-  version = "1.29.0";
+  version = "1.29.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     rev = "v${version}";
-    hash = "sha256-g8Y4ZmQvDbzM7rG1otTxm+SRl/sK3sLM2SOWrBseOPQ=";
+    hash = "sha256-l21mirarWEOd+XxyM0YgfDiA1JSEr/uqREmBS22C9fs=";
   };
 
   outputs = [ "out" "man" ];

pkgs/development/tools/clj-kondo/default.nix

@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "clj-kondo";
-  version = "2023.02.17";
+  version = "2023.03.17";
 
   src = fetchurl {
     url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-HVwZZ280ZABgG/LAAaRfq6wYmUF1c2ojR7XLMCwVSk0=";
+    sha256 = "sha256-hI/0kYAQtkDSu8LE8CO6+2zDA6OOK/MdybsLQEPMkCk=";
   };
 
   extraNativeImageBuildArgs = [

pkgs/development/tools/coursier/default.nix

@@ -1,24 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre, writeScript, common-updater-scripts
 , coreutils, git, gnused, nix, nixfmt }:
 
-let
+stdenv.mkDerivation rec {
+  pname = "coursier";
   version = "2.1.0-RC6";
 
-  zshCompletion = fetchurl {
-    url =
-      "https://raw.githubusercontent.com/coursier/coursier/v${version}/modules/cli/src/main/resources/completions/zsh";
-    sha256 = "0afxzrk9w1qinfsz55jjrxydw0fcv6p722g1q955dl7f6xbab1jh";
-  };
-
-  repo = "git@github.com:coursier/coursier.git";
-in stdenv.mkDerivation rec {
-  inherit version;
-
-  pname = "coursier";
-
   src = fetchurl {
-    url =
+    url = "https://github.com/coursier/coursier/releases/download/v${version}/coursier";
-      "https://github.com/coursier/coursier/releases/download/v${version}/coursier";
     sha256 = "0b52qp0jb2bhb649r6cca0yd1cj8wsyp0f1j3pnmir6rizjwkm5q";
   };
 
@@ -28,28 +16,18 @@ in stdenv.mkDerivation rec {
     install -Dm555 $src $out/bin/cs
     patchShebangs $out/bin/cs
     wrapProgram $out/bin/cs --prefix PATH ":" ${jre}/bin
-
-    # copy zsh completion
-    install -Dm755 ${zshCompletion} $out/share/zsh/site-functions/_cs
   '';
 
   passthru.updateScript = writeScript "update.sh" ''
     #!${stdenv.shell}
     set -o errexit
-    PATH=${
+    PATH=${lib.makeBinPath [ common-updater-scripts coreutils git gnused nix ]}
-      lib.makeBinPath [ common-updater-scripts coreutils git gnused nix nixfmt ]
-    }
     oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion ${pname}" | tr -d '"')"
-    latestTag="$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags ${repo} 'v*.*.*' | tail --lines=1 | cut --delimiter='/' --fields=3 | sed 's|^v||g')"
+    latestTag="$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags https://github.com/coursier/coursier.git 'v*.*.*' | tail --lines=1 | cut --delimiter='/' --fields=3 | sed 's|^v||g')"
     if [ "$oldVersion" != "$latestTag" ]; then
       nixpkgs="$(git rev-parse --show-toplevel)"
       default_nix="$nixpkgs/pkgs/development/tools/coursier/default.nix"
       update-source-version ${pname} "$latestTag" --version-key=version --print-changes
-      url="${builtins.head zshCompletion.urls}"
-      completion_url=$(echo $url | sed "s|$oldVersion|$latestTag|g")
-      completion_sha256="$(nix-prefetch-url --type sha256 $completion_url)"
-      sed -i "s|${zshCompletion.outputHash}|$completion_sha256|g" "$default_nix"
-      nixfmt "$default_nix"
     else
       echo "${pname} is already up-to-date"
     fi
@@ -57,8 +35,7 @@ in stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://get-coursier.io/";
-    description =
+    description = "Scala library to fetch dependencies from Maven / Ivy repositories";
-      "A Scala library to fetch dependencies from Maven / Ivy repositories";
     license = licenses.asl20;
     maintainers = with maintainers; [ adelbertc nequissimus ];
   };

pkgs/development/tools/git-ps-rs/default.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-ps-rs";
-  version = "6.5.0";
+  version = "6.6.0";
 
   src = fetchFromGitHub {
     owner = "uptech";
     repo = "git-ps-rs";
     rev = version;
-    hash = "sha256-4wSm3H+98ZJZ+fZdLYshPKafRkPq98Pv3Lwh9o0be6U=";
+    hash = "sha256-pWad/OCSoszdEQb6Mb6fD4vsZRagbYa3TKft4IyGg94=";
   };
 
-  cargoHash = "sha256-1p46xvo7abMPlVP8BeQ1j/8QQpK3kCgbTL3cdidfq04=";
+  cargoHash = "sha256-MoWb6slvcTlLYbUg/5xBuOYT40C9SQeHIJKdBdhqics=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/development/tools/misc/drush/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drush";
-  version = "8.4.11";
+  version = "8.4.12";
 
   src = fetchurl {
     url = "https://github.com/drush-ops/drush/releases/download/${version}/drush.phar";
-    sha256 = "sha256-4DD16PQHGZzAGwmm/WNeZ/dDKnlQslcb35AkpiJs5tQ=";
+    sha256 = "sha256-YtD9lD621LJJAM/ieL4KWvY4o4Uqo3+FWgjGYGdQQaw=";
   };
 
   dontUnpack = true;

pkgs/development/tools/poetry2nix/poetry2nix/default.nix

@@ -1,10 +1,11 @@
 { pkgs ? import <nixpkgs> { }
 , lib ? pkgs.lib
+, poetry ? null
 , poetryLib ? import ./lib.nix { inherit lib pkgs; stdenv = pkgs.stdenv; }
 }:
 let
   # Poetry2nix version
-  version = "1.39.1";
+  version = "1.40.1";
 
   inherit (poetryLib) isCompatible readTOML normalizePackageName normalizePackageSet;
 
@@ -27,6 +28,7 @@ let
     , includeBuildSystem ? true
     , groups ? [ ]
     , checkGroups ? [ "dev" ]
+    , extras ? [ "*" ]  # * means all extras, otherwise include the dependencies for a given extra
     }:
     let
       getInputs = attr: attrs.${attr} or [ ];
@@ -58,12 +60,26 @@ let
 
       mkInput = attr: extraInputs: getInputs attr ++ extraInputs;
 
+      rawDeps = pyProject.tool.poetry."dependencies" or { };
+
+      rawRequiredDeps = lib.filterAttrs (_: v: !(v.optional or false)) rawDeps;
+
+      desiredExtrasDeps = lib.unique
+        (lib.concatMap (extra: pyProject.tool.poetry.extras.${extra}) extras);
+
+      allRawDeps =
+        if extras == [ "*" ] then
+          rawDeps
+        else
+          rawRequiredDeps // lib.getAttrs desiredExtrasDeps rawDeps;
+      checkInputs' = getDeps (pyProject.tool.poetry."dev-dependencies" or { })  # <poetry-1.2.0
+        # >=poetry-1.2.0 dependency groups
+        ++ lib.flatten (map (g: getDeps (pyProject.tool.poetry.group.${g}.dependencies or { })) checkGroups);
     in
     {
       buildInputs = mkInput "buildInputs" (if includeBuildSystem then buildSystemPkgs else [ ]);
       propagatedBuildInputs = mkInput "propagatedBuildInputs" (
-        (getDeps pyProject.tool.poetry."dependencies" or { })
+        getDeps allRawDeps ++ (
-        ++ (
           # >=poetry-1.2.0 dependency groups
           if pyProject.tool.poetry.group or { } != { }
           then lib.flatten (map (g: getDeps pyProject.tool.poetry.group.${g}.dependencies) groups)
@@ -71,11 +87,8 @@ let
         )
       );
       nativeBuildInputs = mkInput "nativeBuildInputs" [ ];
-      nativeCheckInputs = mkInput "nativeCheckInputs" (
+      checkInputs = mkInput "checkInputs" checkInputs';
-        getDeps (pyProject.tool.poetry."dev-dependencies" or { })  # <poetry-1.2.0
+      nativeCheckInputs = mkInput "nativeCheckInputs" checkInputs';
-        # >=poetry-1.2.0 dependency groups
-        ++ lib.flatten (map (g: getDeps (pyProject.tool.poetry.group.${g}.dependencies or { })) checkGroups)
-      );
     };
 
 
@@ -124,6 +137,7 @@ lib.makeScope pkgs.newScope (self: {
     { projectDir ? null
     , pyproject ? projectDir + "/pyproject.toml"
     , poetrylock ? projectDir + "/poetry.lock"
+    , poetrylockPos ? { file = toString poetrylock; line = 0; column = 0; }
     , overrides ? self.defaultPoetryOverrides
     , python ? pkgs.python3
     , pwd ? projectDir
@@ -133,6 +147,7 @@ lib.makeScope pkgs.newScope (self: {
     , pyProject ? readTOML pyproject
     , groups ? [ ]
     , checkGroups ? [ "dev" ]
+    , extras ? [ "*" ]
     }:
     let
       /* The default list of poetry2nix override overlays */
@@ -193,6 +208,7 @@ lib.makeScope pkgs.newScope (self: {
                   value = self.mkPoetryDep (
                     pkgMeta // {
                       inherit pwd preferWheels;
+                      pos = poetrylockPos;
                       source = pkgMeta.source or null;
                       # Default to files from lock file version 2.0 and fall back to 1.1
                       files = pkgMeta.files or lockFiles.${normalizedName};
@@ -221,6 +237,11 @@ lib.makeScope pkgs.newScope (self: {
         (
           [
             # Remove Python packages aliases with non-normalized names to avoid issues with infinite recursion (issue #750).
+            (self: super: {
+              # Upstream nixpkgs uses non canonical names
+              async-generator = super.async-generator or super.async_generator or null;
+            })
+
             (self: super: lib.attrsets.mapAttrs
               (
                 name: value:
@@ -248,7 +269,7 @@ lib.makeScope pkgs.newScope (self: {
                 }
             )
 
-            # Fix infinite recursion in a lot of packages because of nativeCheckInputs
+            # Fix infinite recursion in a lot of packages because of checkInputs
             (self: super: lib.mapAttrs
               (name: value: (
                 if lib.isDerivation value && lib.hasAttr "overridePythonAttrs" value
@@ -268,7 +289,7 @@ lib.makeScope pkgs.newScope (self: {
       packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) overlays;
       py = python.override { inherit packageOverrides; self = py; };
 
-      inputAttrs = mkInputAttrs { inherit py pyProject groups checkGroups; attrs = { }; includeBuildSystem = false; };
+      inputAttrs = mkInputAttrs { inherit py pyProject groups checkGroups extras; attrs = { }; includeBuildSystem = false; };
 
       requiredPythonModules = python.pkgs.requiredPythonModules;
       /* Include all the nested dependencies which are required for each package.
@@ -304,6 +325,7 @@ lib.makeScope pkgs.newScope (self: {
     , editablePackageSources ? { }
     , extraPackages ? ps: [ ]
     , groups ? [ "dev" ]
+    , extras ? [ "*" ]
     }:
     let
       inherit (lib) hasAttr;
@@ -336,7 +358,7 @@ lib.makeScope pkgs.newScope (self: {
         excludedEditablePackageNames;
 
       poetryPython = self.mkPoetryPackages {
-        inherit pyproject poetrylock overrides python pwd preferWheels pyProject groups;
+        inherit pyproject poetrylock overrides python pwd preferWheels pyProject groups extras;
         editablePackageSources = editablePackageSources';
       };
 
@@ -371,11 +393,12 @@ lib.makeScope pkgs.newScope (self: {
     , preferWheels ? false
     , groups ? [ ]
     , checkGroups ? [ "dev" ]
+    , extras ? [ "*" ]
     , ...
     }@attrs:
     let
       poetryPython = self.mkPoetryPackages {
-        inherit pyproject poetrylock overrides python pwd preferWheels groups checkGroups;
+        inherit pyproject poetrylock overrides python pwd preferWheels groups checkGroups extras;
       };
       py = poetryPython.python;
 
@@ -392,7 +415,7 @@ lib.makeScope pkgs.newScope (self: {
       ];
       passedAttrs = builtins.removeAttrs attrs specialAttrs;
 
-      inputAttrs = mkInputAttrs { inherit py pyProject attrs groups checkGroups; };
+      inputAttrs = mkInputAttrs { inherit py pyProject attrs groups checkGroups extras; };
 
       app = py.pkgs.buildPythonPackage (
         passedAttrs // inputAttrs // {
@@ -481,7 +504,7 @@ lib.makeScope pkgs.newScope (self: {
   /*
     The default list of poetry2nix override overlays
 
-    Can be overridden by calling defaultPoetryOverrides.overrideOverlay which takes an overlay function
+    Can be overriden by calling defaultPoetryOverrides.overrideOverlay which takes an overlay function
   */
   defaultPoetryOverrides = self.mkDefaultPoetryOverrides (import ./overrides { inherit pkgs lib poetryLib; });
 
@@ -501,8 +524,8 @@ lib.makeScope pkgs.newScope (self: {
       combining it with poetry2nix default overrides
     */
     withDefaults = overlay: [
-      self.defaultPoetryOverrides
       overlay
+      self.defaultPoetryOverrides
     ];
   };
 })

pkgs/development/tools/poetry2nix/poetry2nix/fetch_from_legacy.py

@@ -60,6 +60,12 @@ context = ssl.create_default_context()
 context.check_hostname = False
 context.verify_mode = ssl.CERT_NONE
 
+# Extract out username/password from index_url, if present.
+parsed_url = urlparse(index_url)
+username = parsed_url.username or username
+password = parsed_url.password or password
+index_url = parsed_url._replace(netloc=parsed_url.netloc.rpartition("@")[-1]).geturl()
+
 req = urllib.request.Request(index_url)
 if username and password:
     import base64

pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix

@@ -1,12 +1,14 @@
 { python
+, stdenv
 , buildPackages
 , makeSetupHook
 , wheel
 , pip
 , pkgs
+, lib
 }:
 let
-  callPackage = python.pythonForBuild.pkgs.callPackage;
+  inherit (python.pythonForBuild.pkgs) callPackage;
   pythonInterpreter = python.pythonForBuild.interpreter;
   pythonSitePackages = python.sitePackages;
 
@@ -14,23 +16,27 @@ let
   makeRemoveSpecialDependenciesHook = { fields, kind }:
     nonOverlayedPython.pkgs.callPackage
       (
-        {}:
+        _:
         makeSetupHook
           {
             name = "remove-path-dependencies.sh";
-            propagatedBuildInputs = [ ];
             substitutions = {
               # NOTE: We have to use a non-overlayed Python here because otherwise we run into an infinite recursion
               # because building of tomlkit and its dependencies also use these hooks.
               pythonPath = nonOverlayedPython.pkgs.makePythonPath [ nonOverlayedPython ];
               pythonInterpreter = nonOverlayedPython.interpreter;
               pyprojectPatchScript = "${./pyproject-without-special-deps.py}";
-              fields = fields;
+              inherit fields;
-              kind = kind;
+              inherit kind;
             };
           } ./remove-special-dependencies.sh
       )
       { };
+  makeSetupHookArgs = deps:
+    if lib.elem "propagatedBuildInputs" (builtins.attrNames (builtins.functionArgs makeSetupHook)) then
+      { propagatedBuildInputs = deps; }
+    else
+      { inherit deps; };
 in
 {
   removePathDependenciesHook = makeRemoveSpecialDependenciesHook {
@@ -48,23 +54,21 @@ in
     (
       { pip, wheel }:
       makeSetupHook
-        {
+        ({
           name = "pip-build-hook.sh";
-          propagatedBuildInputs = [ pip wheel ];
           substitutions = {
             inherit pythonInterpreter pythonSitePackages;
           };
-        } ./pip-build-hook.sh
+        } // (makeSetupHookArgs [ pip wheel ])) ./pip-build-hook.sh
     )
     { };
 
   poetry2nixFixupHook = callPackage
     (
-      {}:
+      _:
       makeSetupHook
         {
           name = "fixup-hook.sh";
-          propagatedBuildInputs = [ ];
           substitutions = {
             inherit pythonSitePackages;
             filenames = builtins.concatStringsSep " " [
@@ -77,14 +81,51 @@ in
     )
     { };
 
+  # As of 2023-03 a newer version of packaging introduced a new behaviour where python-requires
+  # cannot contain version wildcards. This behaviour is complaint with PEP440
+  #
+  # The wildcards are a no-op anyway so we can work around this issue by just dropping the precision down to the last known number.
+  poetry2nixPythonRequiresPatchHook = callPackage
+    (
+      _:
+      let
+        # Python pre 3.9 does not contain the ast.unparse method.
+        # We can extract this from Python 3.8 for any
+        unparser = stdenv.mkDerivation {
+          name = "${python.name}-astunparse";
+          inherit (python) src;
+          dontConfigure = true;
+          dontBuild = true;
+
+          installPhase = ''
+            mkdir -p $out/poetry2nix_astunparse
+            cp ./Tools/parser/unparse.py $out/poetry2nix_astunparse/__init__.py
+          '';
+        };
+
+        pythonPath =
+          [ ]
+          ++ lib.optional (lib.versionOlder python.version "3.9") unparser;
+
+      in
+      makeSetupHook
+        {
+          name = "require-python-patch-hook.sh";
+          substitutions = {
+            inherit pythonInterpreter pythonPath;
+            patchScript = ./python-requires-patch-hook.py;
+          };
+        } ./python-requires-patch-hook.sh
+    )
+    { };
+
   # When the "wheel" package itself is a wheel the nixpkgs hook (which pulls in "wheel") leads to infinite recursion
   # It doesn't _really_ depend on wheel though, it just copies the wheel.
   wheelUnpackHook = callPackage
-    ({}:
+    (_:
       makeSetupHook
         {
           name = "wheel-unpack-hook.sh";
-          propagatedBuildInputs = [ ];
         } ./wheel-unpack-hook.sh
     )
     { };

pkgs/development/tools/poetry2nix/poetry2nix/hooks/python-requires-patch-hook.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python
+import ast
+import sys
+import io
+
+
+# Python2 compat
+if sys.version_info[0] < 3:
+    FileNotFoundError = IOError
+
+
+# Python <= 3.8 compat
+def astunparse(tree):
+    # Use bundled unparse by default
+    if hasattr(ast, "unparse"):
+        return ast.unparse(tree)
+
+    # Use example tool from Python sources for older interpreter versions
+    from poetry2nix_astunparse import Unparser
+
+    buf = io.StringIO()
+    up = Unparser(tree, buf)
+
+    return buf.getvalue()
+
+
+class Rewriter(ast.NodeVisitor):
+    def __init__(self, *args, **kwargs):
+        super(Rewriter, self).__init__(*args, **kwargs)
+        self.modified = False
+
+    def visit_Call(self, node):
+        function_name = ""
+
+        if isinstance(node.func, ast.Name):
+            function_name = node.func.id
+        elif isinstance(node.func, ast.Attribute):
+            function_name = node.func.attr
+        else:
+            return
+
+        if function_name != "setup":
+            return
+
+        for kw in node.keywords:
+            if kw.arg != "python_requires":
+                continue
+
+            value = kw.value
+            if not isinstance(value, ast.Constant):
+                return
+
+            # Rewrite version constraints without wildcard characters.
+            #
+            # Only rewrite the file if the modified value actually differs, as we lose whitespace and comments when rewriting
+            # with the AST module.
+            python_requires = ", ".join(
+                [v.strip().rstrip(".*") for v in value.value.split(",")]
+            )
+            if value.value != python_requires:
+                value.value = python_requires
+                self.modified = True
+
+
+if __name__ == "__main__":
+    sys.path.extend(sys.argv[1:])
+
+    try:
+        with open("setup.py") as f:
+            tree = ast.parse(f.read())
+    except FileNotFoundError:
+        exit(0)
+
+    r = Rewriter()
+    r.visit(tree)
+
+    if r.modified:
+        with open("setup.py", "w") as f:
+            f.write(astunparse(tree))

pkgs/development/tools/poetry2nix/poetry2nix/hooks/python-requires-patch-hook.sh

@@ -0,0 +1,7 @@
+poetry2nix-python-requires-patch-hook() {
+    if [ -z "${dontFixupPythonRequires-}" ]; then
+        @pythonInterpreter@ @patchScript@ @pythonPath@
+    fi
+}
+
+postPatchHooks+=(poetry2nix-python-requires-patch-hook)

pkgs/development/tools/poetry2nix/poetry2nix/lib.nix

@@ -151,7 +151,7 @@ let
         (builtins.filter
           ({ prefix, path }: "NETRC" == prefix)
           builtins.nixPath);
-      netrc_file = lib.optionalString (pathParts != [ ]) (builtins.head pathParts).path;
+      netrc_file = if (pathParts != [ ]) then (builtins.head pathParts).path else "";
     in
     pkgs.runCommand file
       {

pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix

@@ -7,6 +7,7 @@
 }:
 { name
 , version
+, pos ? __curPos
 , files
 , source
 , dependencies ? { }
@@ -45,6 +46,7 @@ pythonPackages.callPackage
       isSource = source != null;
       isGit = isSource && source.type == "git";
       isUrl = isSource && source.type == "url";
+      isWheelUrl = isSource && source.type == "url" && lib.strings.hasSuffix ".whl" source.url;
       isDirectory = isSource && source.type == "directory";
       isFile = isSource && source.type == "file";
       isLegacy = isSource && source.type == "legacy";
@@ -61,6 +63,8 @@ pythonPackages.callPackage
               inherit pythonPackages pyProject;
             } else [ ];
 
+      pname = normalizePackageName name;
+      preferWheel' = preferWheel && pname != "wheel";
       fileInfo =
         let
           isBdist = f: lib.strings.hasSuffix "whl" f.file;
@@ -69,7 +73,9 @@ pythonPackages.callPackage
           binaryDist = selectWheel fileCandidates;
           sourceDist = builtins.filter isSdist fileCandidates;
           eggs = builtins.filter isEgg fileCandidates;
-          entries = (if preferWheel then binaryDist ++ sourceDist else sourceDist ++ binaryDist) ++ eggs;
+          # the `wheel` package cannot be built from a wheel, since that requires the wheel package
+          # this causes a circular dependency so we special-case ignore its `preferWheel` attribute value
+          entries = (if preferWheel' then binaryDist ++ sourceDist else sourceDist ++ binaryDist) ++ eggs;
           lockFileEntry = (
             if lib.length entries > 0 then builtins.head entries
             else throw "Missing suitable source/wheel file entry for ${name}"
@@ -89,13 +95,12 @@ pythonPackages.callPackage
             else (builtins.elemAt (lib.strings.splitString "-" name) 2);
         };
 
-      format = if isDirectory || isGit || isUrl then "pyproject" else fileInfo.format;
+      format = if isWheelUrl then "wheel" else if isDirectory || isGit || isUrl then "pyproject" else fileInfo.format;
 
       hooks = python.pkgs.callPackage ./hooks { };
     in
     buildPythonPackage {
-      pname = normalizePackageName name;
+      inherit pname version;
-      version = version;
 
       # Circumvent output separation (https://github.com/NixOS/nixpkgs/pull/190487)
       format = if format == "pyproject" then "poetry2nix" else format;
@@ -108,6 +113,7 @@ pythonPackages.callPackage
       nativeBuildInputs = [
         hooks.poetry2nixFixupHook
       ]
+      ++ lib.optional (!pythonPackages.isPy27) hooks.poetry2nixPythonRequiresPatchHook
       ++ lib.optional (isLocked && (getManyLinuxDeps fileInfo.name).str != null) autoPatchelfHook
       ++ lib.optionals (format == "wheel") [
         hooks.wheelUnpackHook
@@ -147,6 +153,8 @@ pythonPackages.callPackage
         in
         builtins.map (n: pythonPackages.${normalizePackageName n}) depAttrs;
 
+      inherit pos;
+
       meta = {
         broken = ! isCompatible (poetryLib.getPythonVersion python) python-versions;
         license = [ ];
@@ -155,6 +163,7 @@ pythonPackages.callPackage
 
       passthru = {
         inherit args;
+        preferWheel = preferWheel';
       };
 
       # We need to retrieve kind from the interpreter and the filename of the package
@@ -174,10 +183,17 @@ pythonPackages.callPackage
               }
             ))
           )
+        else if isWheelUrl then
+          builtins.fetchurl
+            {
+              inherit (source) url;
+              sha256 = fileInfo.hash;
+            }
         else if isUrl then
           builtins.fetchTarball
             {
               inherit (source) url;
+              sha256 = fileInfo.hash;
             }
         else if isDirectory then
           (poetryLib.cleanPythonSources { src = localDepPath; })

pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix

@@ -27,7 +27,7 @@ let
                 true;
             intendedBuildSystem =
               if attr.buildSystem == "cython" then
-                self.python.pythonForBuild.cython
+                self.python.pythonForBuild.pkgs.cython
               else
                 self.${attr.buildSystem};
           in
@@ -50,7 +50,7 @@ let
             {
               nativeBuildInputs =
                 (old.nativeBuildInputs or [ ])
-                ++ lib.optionals (buildSystem != null) [ buildSystem ]
+                ++ lib.optionals (!(builtins.isNull buildSystem)) [ buildSystem ]
                 ++ map (a: self.${a}) extraAttrs;
             }
         )
@@ -99,7 +99,7 @@ lib.composeManyExtensions [
 
     {
       automat = super.automat.overridePythonAttrs (
-        old: {
+        old: lib.optionalAttrs (lib.versionOlder old.version "22.10.0") {
           propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.m2r ];
         }
       );
@@ -296,7 +296,7 @@ lib.composeManyExtensions [
             old: {
               nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ pkg-config ];
               buildInputs = old.buildInputs or [ ] ++ [ pkgs.libffi ];
-              prePatch = (old.prePatch or "") + lib.optionalString stdenv.isDarwin ''
+              prePatch = (old.prePatch or "") + lib.optionalString (!(old.src.isWheel or false) && stdenv.isDarwin) ''
                 # Remove setup.py impurities
                 substituteInPlace setup.py --replace "'-iwithsysroot/usr/include/ffi'" ""
                 substituteInPlace setup.py --replace "'/usr/include/ffi'," ""
@@ -345,7 +345,7 @@ lib.composeManyExtensions [
           LIB_DIR = "${lib.getLib pkgs.secp256k1}/lib";
 
           # for actual C toolchain build
-          env.NIX_CFLAGS_COMPILE = "-I ${lib.getDev pkgs.secp256k1}/include";
+          NIX_CFLAGS_COMPILE = "-I ${lib.getDev pkgs.secp256k1}/include";
           NIX_LDFLAGS = "-L ${lib.getLib pkgs.secp256k1}/lib";
         }
       );
@@ -382,6 +382,8 @@ lib.composeManyExtensions [
             "38.0.1" = "sha256-o8l13fnfEUvUdDasq3LxSPArozRHKVsZfQg9DNR6M6Q=";
             "38.0.3" = "sha256-lzHLW1N4hZj+nn08NZiPVM/X+SEcIsuZDjEOy0OOkSc=";
             "38.0.4" = "sha256-BN0kOblUwgHj5QBf52RY2Jx0nBn03lwoN1O5PEohbwY=";
+            "39.0.0" = "sha256-clorC0NtGukpE3DnZ84MSdGhJN+qC89DZPITZFuL01Q=";
+            "39.0.2" = "sha256-Admz48/GS2t8diz611Ciin1HKQEyMDEwHxTpJ5tZ1ZA=";
           }.${version} or (
             lib.warn "Unknown cryptography version: '${version}'. Please update getCargoHash." lib.fakeHash
           );
@@ -443,6 +445,17 @@ lib.composeManyExtensions [
         buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools ];
       });
 
+      databricks-connect = super.databricks-connect.overridePythonAttrs (old: {
+        sourceRoot = ".";
+      });
+
+      dbt-extractor = super.dbt-extractor.overridePythonAttrs
+        (
+          old: {
+            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.cargo pkgs.rustc pkgs.maturin ];
+          }
+        );
+
       dbus-python = super.dbus-python.overridePythonAttrs (old: {
         outputs = [ "out" "dev" ];
 
@@ -457,9 +470,9 @@ lib.composeManyExtensions [
 
         preConfigure = lib.concatStringsSep "\n" [
           (old.preConfigure or "")
-          (lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11" && stdenv.isDarwin) ''
+          (if (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11" && stdenv.isDarwin) then ''
             MACOSX_DEPLOYMENT_TARGET=10.16
-          '')
+          '' else "")
         ];
 
         preBuild = old.preBuild or "" + ''
@@ -562,6 +575,14 @@ lib.composeManyExtensions [
             )
           ) else super.docutils;
 
+      duckdb = super.duckdb.overridePythonAttrs (old: {
+        postPatch = lib.optionalString (!(old.src.isWheel or false)) ''
+          substituteInPlace setup.py \
+            --replace 'multiprocessing.cpu_count()' "$NIX_BUILD_CORES" \
+            --replace 'setuptools_scm<7.0.0' 'setuptools_scm'
+        '';
+      });
+
       # Environment markers are not always included (depending on how a dep was defined)
       enum34 = if self.pythonAtLeast "3.4" then null else super.enum34;
 
@@ -608,7 +629,7 @@ lib.composeManyExtensions [
 
       fancycompleter = super.fancycompleter.overridePythonAttrs (
         old: {
-          postPatch = ''
+          postPatch = lib.optionalString (!(old.src.isWheel or false)) ''
             substituteInPlace setup.py \
               --replace 'setup_requires="setupmeta"' 'setup_requires=[]' \
               --replace 'versioning="devcommit"' 'version="${old.version}"'
@@ -636,11 +657,12 @@ lib.composeManyExtensions [
 
       fiona = super.fiona.overridePythonAttrs (
         old: {
-          format = "setuptools";
+          format = lib.optionalString (!(old.src.isWheel or false)) "setuptools";
-          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.gdal ];
+          buildInputs = old.buildInputs or [ ] ++ [ pkgs.gdal ];
-          nativeBuildInputs = [
+          nativeBuildInputs = old.nativeBuildInputs or [ ]
-            pkgs.gdal # for gdal-config
+            ++ lib.optionals ((old.src.isWheel or false) && (!pkgs.stdenv.isDarwin)) [ pkgs.autoPatchelfHook ]
-          ];
+            # for gdal-config
+            ++ [ pkgs.gdal ];
         }
       );
 
@@ -648,14 +670,28 @@ lib.composeManyExtensions [
         VERSION = old.version;
       });
 
-      gdal = super.gdal.overridePythonAttrs (
+      gdal =
-        old: {
+        let
-          preBuild = (old.preBuild or "") + ''
+          # Build gdal without python bindings to prevent version mixing
-            substituteInPlace setup.cfg \
+          # We're only interested in the native libraries, not the python ones
-              --replace "../../apps/gdal-config" '${pkgs.gdal}/bin/gdal-config'
+          # as we build that separately.
-          '';
+          gdal = pkgs.gdal.overrideAttrs (old: {
-        }
+            doInstallCheck = false;
-      );
+            doCheck = false;
+            cmakeFlags = (old.cmakeFlags or [ ]) ++ [
+              "-DBUILD_PYTHON_BINDINGS=OFF"
+            ];
+          });
+        in
+        super.gdal.overridePythonAttrs (
+          old: {
+            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ gdal ];
+            preBuild = (old.preBuild or "") + ''
+              substituteInPlace setup.cfg \
+                --replace "../../apps/gdal-config" '${gdal}/bin/gdal-config'
+            '';
+          }
+        );
 
       grandalf = super.grandalf.overridePythonAttrs (
         old: {
@@ -664,6 +700,34 @@ lib.composeManyExtensions [
         }
       );
 
+      granian =
+        let
+          getRepoHash = version: {
+            "0.2.1" = "sha256-XEhu6M1hFi3/gAKZcei7KJSrIhhlZhlvZvbfyA6VLR4=";
+            "0.2.2" = "sha256-KWwefJ3CfOUGCgAm7AhFlIxRF9qxNEo3npGOxVJ23FY=";
+            "0.2.3" = "sha256-2JnyO0wxkV49R/0wzDb/PnUWWHi3ckwK4nVe7dWeH1k=";
+            "0.2.4" = "sha256-GdQJvVPsWgC1z7La9h11x2pRAP+L998yImhTFrFT5l8=";
+            "0.2.5" = "sha256-vMXMxss77rmXSjoB53eE8XN2jXyIEf03WoQiDfvhDmw=";
+            "0.2.6" = "sha256-l9W9+KDg/43mc0toEz1n1pqw+oQdiHdAxGlS+KLIGhw=";
+          }.${version};
+          sha256 = getRepoHash super.granian.version;
+        in
+        super.granian.overridePythonAttrs (old: rec {
+          src = pkgs.fetchFromGitHub {
+            owner = "emmett-framework";
+            repo = "granian";
+            rev = "v${old.version}";
+            inherit sha256;
+          };
+          cargoDeps = pkgs.rustPlatform.importCargoLock {
+            lockFile = "${src.out}/Cargo.lock";
+          };
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            pkgs.rustPlatform.cargoSetupHook
+            pkgs.rustPlatform.maturinBuildHook
+          ];
+        });
+
       gitpython = super.gitpython.overridePythonAttrs (
         old: {
           buildInputs = (old.buildInputs or [ ]) ++ [ self.typing-extensions ];
@@ -720,7 +784,7 @@ lib.composeManyExtensions [
                 (old.propagatedBuildInputs or [ ])
                 ++ lib.optionals mpiSupport [ self.mpi4py self.openssh ]
               ;
-              preBuild = lib.optionalString mpiSupport "export CC=${mpi}/bin/mpicc";
+              preBuild = if mpiSupport then "export CC=${mpi}/bin/mpicc" else "";
               HDF5_DIR = "${pkgs.hdf5}";
               HDF5_MPI = if mpiSupport then "ON" else "OFF";
               # avoid strict pinning of numpy
@@ -749,6 +813,18 @@ lib.composeManyExtensions [
         }
       );
 
+      hikari = super.hikari.overrideAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools ];
+        }
+      );
+
+      hikari-lightbulb = super.hikari-lightbulb.overrideAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools ];
+        }
+      );
+
       horovod = super.horovod.overridePythonAttrs (
         old: {
           propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.mpi ];
@@ -864,6 +940,15 @@ lib.composeManyExtensions [
         }
       );
 
+      trio = super.trio.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ])
+          ++ [ self.async-generator self.idna ];
+      });
+
+      jeepney = super.jeepney.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++ [ self.outcome self.trio ];
+      });
+
       jinja2-ansible-filters = super.jinja2-ansible-filters.overridePythonAttrs (
         old: {
           preBuild = (old.preBuild or "") + ''
@@ -930,6 +1015,13 @@ lib.composeManyExtensions [
         propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools self.wheel ];
       });
 
+      jupyter-server = super.jupyter-server.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ])
+          ++ [ self.hatchling ];
+        buildInputs = (old.buildInputs or [ ])
+          ++ [ self.hatch-jupyter-builder ];
+      });
+
       jupyterlab-widgets = super.jupyterlab-widgets.overridePythonAttrs (
         old: {
           buildInputs = (old.buildInputs or [ ]) ++ [ self.jupyter-packaging ];
@@ -964,6 +1056,15 @@ lib.composeManyExtensions [
         }
       );
 
+      libarchive = super.libarchive.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools ];
+
+        postPatch = ''
+          substituteInPlace libarchive/library.py --replace \
+            "_FILEPATH = find_and_load_library()" "_FILEPATH = '${pkgs.libarchive.lib}/lib/libarchive${stdenv.hostPlatform.extensions.sharedLibrary}'"
+        '';
+      });
+
       libvirt-python = super.libvirt-python.overridePythonAttrs ({ nativeBuildInputs ? [ ], ... }: {
         nativeBuildInputs = nativeBuildInputs ++ [ pkg-config ];
         propagatedBuildInputs = [ pkgs.libvirt ];
@@ -1082,6 +1183,8 @@ lib.composeManyExtensions [
             pkgs.ghostscript
           ] ++ lib.optionals stdenv.isDarwin [
             Cocoa
+          ] ++ lib.optionals (lib.versionAtLeast super.matplotlib.version "3.7.0") [
+            self.pybind11
           ];
 
           propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
@@ -1137,11 +1240,6 @@ lib.composeManyExtensions [
         }
       );
 
-      # Calls Cargo at build time for source builds and is really tricky to package
-      maturin = super.maturin.override {
-        preferWheel = true;
-      };
-
       mccabe = super.mccabe.overridePythonAttrs (
         old: {
           buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
@@ -1308,6 +1406,9 @@ lib.composeManyExtensions [
           preBuild = ''
             ln -s ${cfg} site.cfg
           '';
+          preConfigure = ''
+            export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
+          '';
           passthru = old.passthru // {
             blas = blas;
             inherit blasImplementation cfg;
@@ -1353,6 +1454,8 @@ lib.composeManyExtensions [
         autoPatchelfIgnoreMissingDeps = true;
       });
 
+      openbabel-wheel = super.openbabel-wheel.override { preferWheel = true; };
+
       # Overrides for building packages based on OpenCV
       # These flags are inspired by the opencv 4.x package in nixpkgs
       _opencv-python-override =
@@ -1376,14 +1479,14 @@ lib.composeManyExtensions [
 
       opencv-python = super.opencv-python.overridePythonAttrs self._opencv-python-override;
 
-      opencv-python-headless = super.opencv-python.overridePythonAttrs self._opencv-python-override;
+      opencv-python-headless = super.opencv-python-headless.overridePythonAttrs self._opencv-python-override;
 
       opencv-contrib-python = super.opencv-contrib-python.overridePythonAttrs self._opencv-python-override;
 
       openexr = super.openexr.overridePythonAttrs (
         old: {
           buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openexr pkgs.ilmbase ];
-          env.NIX_CFLAGS_COMPILE = toString [ "-I${pkgs.openexr.dev}/include/OpenEXR" "-I${pkgs.ilmbase.dev}/include/OpenEXR" ];
+          NIX_CFLAGS_COMPILE = [ "-I${pkgs.openexr.dev}/include/OpenEXR" "-I${pkgs.ilmbase.dev}/include/OpenEXR" ];
         }
       );
 
@@ -1409,6 +1512,10 @@ lib.composeManyExtensions [
             "3.8.0" = "sha256-8k0DetamwLqkdcg8V/D2J5ja6IJSLi50CE+ZjFa7Hdc=";
             "3.8.1" = "sha256-QXguyDxQHW9Fd3Nhmi5JzSxZQuk3HGPhhh/RGuOTZNY=";
             "3.8.3" = "sha256-oSZO4cN1sJKd0T7pYrKG63is8AZMKaLRZqj5UCVY/14=";
+            "3.8.4" = "sha256-O2W9zO7qHWG+78T+uECICAmecaSIbTTJPktJIPZYElE=";
+            "3.8.5" = "sha256-JtUCJ3TP9EKGcddeyW1e/72k21uKneq9SnZJeLvn9Os=";
+            "3.8.6" = "sha256-8T//q6nQoZhh8oJWDCeQf3gYRew58dXAaxkYELY4CJM=";
+            "3.8.7" = "sha256-JBO8nl0sC+XIn17vI7hC8+nA1HYI9jfvZrl9nCE3k1s=";
           }.${version} or (
             lib.warn "Unknown orjson version: '${version}'. Please update getCargoHash." lib.fakeHash
           );
@@ -1444,7 +1551,7 @@ lib.composeManyExtensions [
 
         # For OSX, we need to add a dependency on libcxx, which provides
         # `complex.h` and other libraries that pandas depends on to build.
-        postPatch = lib.optionalString stdenv.isDarwin ''
+        postPatch = lib.optionalString (!(old.src.isWheel or false) && stdenv.isDarwin) ''
           cpp_sdk="${lib.getDev pkgs.libcxx}/include/c++/v1";
           echo "Adding $cpp_sdk to the setup.py common_include variable"
           substituteInPlace setup.py \
@@ -1509,13 +1616,27 @@ lib.composeManyExtensions [
           nativeBuildInputs = (old.nativeBuildInputs or [ ])
             ++ [ pkg-config self.pytest-runner ];
           buildInputs = with pkgs; (old.buildInputs or [ ])
-            ++ [ freetype libjpeg zlib libtiff libwebp tcl lcms2 ]
+            ++ [ freetype libjpeg zlib libtiff libxcrypt libwebp tcl lcms2 ]
             ++ lib.optionals (lib.versionAtLeast old.version "7.1.0") [ xorg.libxcb ]
             ++ lib.optionals (self.isPyPy) [ tk xorg.libX11 ];
           preConfigure = lib.optional (old.format != "wheel") preConfigure;
         }
       );
 
+      pip-requirements-parser = super.pip-requirements-parser.overridePythonAttrs (old: {
+        dontConfigure = true;
+      });
+
+      pluralizer = super.pluralizer.overridePythonAttrs (old: {
+        preBuild = ''
+          export PYPI_VERSION="${old.version}"
+        '';
+      });
+
+      poethepoet = super.poethepoet.overrideAttrs (old: {
+        propagatedBuildInputs = old.propagatedBuildInputs ++ [ self.poetry ];
+      });
+
       poetry-core = super.poetry-core.overridePythonAttrs (old:
         let
           initFile =
@@ -1600,7 +1721,7 @@ lib.composeManyExtensions [
       );
 
       pyarrow =
-        if lib.versionAtLeast super.pyarrow.version "0.16.0" then
+        if (!super.pyarrow.src.isWheel or false) && lib.versionAtLeast super.pyarrow.version "0.16.0" then
           super.pyarrow.overridePythonAttrs
             (
               old:
@@ -1662,7 +1783,7 @@ lib.composeManyExtensions [
           old: {
 
             nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-              pkgs.meson
+              self.meson
               pkgs.ninja
               pkg-config
             ];
@@ -1838,7 +1959,7 @@ lib.composeManyExtensions [
           propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ (
             if withApplePCSC then [ PCSC ] else [ pcsclite ]
           );
-          env.NIX_CFLAGS_COMPILE = lib.optionalString (! withApplePCSC)
+          NIX_CFLAGS_COMPILE = lib.optionalString (! withApplePCSC)
             "-I ${lib.getDev pcsclite}/include/PCSC";
           nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
             pkgs.swig
@@ -1868,6 +1989,18 @@ lib.composeManyExtensions [
         }
       );
 
+      python-snap7 = super.python-snap7.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+          pkgs.snap7
+        ];
+
+        postPatch = (old.postPatch or "") + ''
+          echo "Patching find_library call."
+          substituteInPlace snap7/common.py \
+            --replace "find_library('snap7')" "\"${pkgs.snap7}/lib/libsnap7.so\""
+        '';
+      });
+
       pytoml = super.pytoml.overridePythonAttrs (
         old: {
           doCheck = false;
@@ -2068,6 +2201,18 @@ lib.composeManyExtensions [
         }
       );
 
+      recommonmark = super.rich.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.commonmark ];
+        }
+      );
+
+      rich = super.rich.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.commonmark ];
+        }
+      );
+
       rockset = super.rockset.overridePythonAttrs (
         old: {
           postPatch = ''
@@ -2098,9 +2243,24 @@ lib.composeManyExtensions [
             "-DPYBIND11_TEST=off"
           ];
           doCheck = false; # Circular test dependency
+
+          # Link include and share so it can be used by packages that use pybind11 through cmake
+          postInstall = ''
+            ln -s $out/${self.python.sitePackages}/pybind11/{include,share} $out/
+          '';
         }
       );
 
+      rasterio = super.rasterio.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.gdal ];
+      });
+
+      rfc3986-validator = super.rfc3986-validator.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+          self.pytest-runner
+        ];
+      });
+
       rlp = super.rlp.overridePythonAttrs {
         preConfigure = ''
           substituteInPlace setup.py --replace \'setuptools-markdown\' ""
@@ -2134,6 +2294,7 @@ lib.composeManyExtensions [
             [ pkgs.gfortran ] ++
             lib.optionals (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ] ++
             lib.optionals (lib.versionAtLeast super.scipy.version "1.9.0") [ self.meson-python pkg-config ];
+          dontUseMesonConfigure = true;
           propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pybind11 ];
           setupPyBuildFlags = [ "--fcompiler='gnu95'" ];
           enableParallelBuilding = true;
@@ -2185,17 +2346,31 @@ lib.composeManyExtensions [
         '';
       });
 
+      selenium =
+        let
+          v4orLater = lib.versionAtLeast super.selenium.version "4";
+          selenium = super.selenium.override {
+            # Selenium >=4 is built with Bazel
+            preferWheel = v4orLater;
+          };
+        in
+        selenium.overridePythonAttrs (old: {
+          # Selenium <4 can be installed from sources, with setuptools
+          buildInputs = old.buildInputs ++ (lib.optionals (!v4orLater) [ self.setuptools ]);
+        });
+
       shapely = super.shapely.overridePythonAttrs (
         old: {
-          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.geos ];
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.geos ];
-          inherit (pkgs.python3.pkgs.shapely) GEOS_LIBRARY_PATH;
+
+          GEOS_LIBRARY_PATH = "${pkgs.geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";
 
           GEOS_LIBC = lib.optionalString (!stdenv.isDarwin) "${lib.getLib stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}.6";
 
           # Fix library paths
-          postPatch = old.postPatch or "" + ''
+          postPatch = lib.optionalString (!(old.src.isWheel or false)) (old.postPatch or "" + ''
             ${pkgs.python3.interpreter} ${./shapely-rewrite.py} shapely/geos.py
-          '';
+          '');
         }
       );
 
@@ -2410,7 +2585,9 @@ lib.composeManyExtensions [
 
       # Stop infinite recursion by using bootstrapped pkg from nixpkgs
       bootstrapped-pip = super.bootstrapped-pip.override {
-        wheel = self.python.pkgs.wheel;
+        wheel = ((if self.python.isPy2 then pkgs.python2 else pkgs.python3).pkgs.override {
+          python = self.python;
+        }).wheel;
       };
 
       watchfiles =
@@ -2481,27 +2658,15 @@ lib.composeManyExtensions [
         }
       );
 
-      wheel =
+      wheel = ((
-        let
+        pkgs.python3.pkgs.override {
-          isWheel = super.wheel.src.isWheel or false;
+          python = self.python;
-          # If "wheel" is a pre-built binary wheel
+        }
-          wheelPackage = super.buildPythonPackage {
+      ).wheel.override {
-            inherit (super.wheel) pname name version src;
+        inherit (self) buildPythonPackage bootstrapped-pip setuptools;
-            inherit (pkgs.python3.pkgs.wheel) meta;
+      }).overrideAttrs (old: {
-            format = "wheel";
+        inherit (super.wheel) pname name version src;
-          };
+      });
-          # If "wheel" is built from source
-          sourcePackage = ((
-            pkgs.python3.pkgs.override {
-              python = self.python;
-            }
-          ).wheel.override {
-            inherit (self) buildPythonPackage bootstrapped-pip setuptools;
-          }).overrideAttrs (old: {
-            inherit (super.wheel) pname name version src;
-          });
-        in
-        if isWheel then wheelPackage else sourcePackage;
 
       zipp = if super.zipp == null then null else
       super.zipp.overridePythonAttrs (
@@ -2600,6 +2765,13 @@ lib.composeManyExtensions [
         }
       );
 
+      minimal-snowplow-tracker = super.minimal-snowplow-tracker.overridePythonAttrs
+        (
+          old: {
+            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ super.setuptools ];
+          }
+        );
+
       # nixpkgs has setuptools_scm 4.1.2
       # but newrelic has a seemingly unnecessary version constraint for <4
       # So we patch that out
@@ -2686,6 +2858,10 @@ lib.composeManyExtensions [
         '';
       });
 
+      pyyaml-include = super.pyyaml-include.overridePythonAttrs (old: {
+        SETUPTOOLS_SCM_PRETEND_VERSION = old.version;
+      });
+
       selinux = super.selinux.overridePythonAttrs (old: {
         buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools-scm-git-archive ];
       });
@@ -2708,27 +2884,69 @@ lib.composeManyExtensions [
         buildInputs = (old.buildInputs or [ ]) ++ [ self.Babel ];
       });
 
-      nbconvert = super.nbconvert.overridePythonAttrs (_: {
+      nbconvert =
-        postPatch = lib.optionalString (lib.versionAtLeast self.nbconvert.version "6.5.0") ''
+        let
-          substituteInPlace \
+          patchExporters = lib.optionalString (lib.versionAtLeast self.nbconvert.version "6.5.0") ''
-            ./nbconvert/exporters/templateexporter.py \
+            substituteInPlace \
-            --replace \
+              ./nbconvert/exporters/templateexporter.py \
-            'root_dirs.extend(jupyter_path())' \
+              --replace \
-            'root_dirs.extend(jupyter_path() + [os.path.join("@out@", "share", "jupyter")])' \
+              'root_dirs.extend(jupyter_path())' \
-            --subst-var out
+              'root_dirs.extend(jupyter_path() + [os.path.join("@out@", "share", "jupyter")])' \
-        '' + lib.optionalString (lib.versionAtLeast self.nbconvert.version "7.0") ''
+              --subst-var out
-          substituteInPlace \
+          '';
-            ./hatch_build.py \
+        in
-            --replace \
+        super.nbconvert.overridePythonAttrs (old: {
-            'if self.target_name not in ["wheel", "sdist"]:' \
+          postPatch = lib.optionalString (!(old.src.isWheel or false)) (
-            'if True:'
+            patchExporters + lib.optionalString (lib.versionAtLeast self.nbconvert.version "7.0") ''
-        '';
+              substituteInPlace \
+                ./hatch_build.py \
+                --replace \
+                'if self.target_name not in ["wheel", "sdist"]:' \
+                'if True:'
+            ''
+          );
+          postInstall = lib.optionalString (old.src.isWheel or false) ''
+            pushd $out/${self.python.sitePackages}
+            ${patchExporters}
+            popd
+          '';
+        });
+
+      meson-python = super.meson-python.overridePythonAttrs (old: {
+        dontUseMesonConfigure = true;
       });
 
       mkdocs = super.mkdocs.overridePythonAttrs (old: {
         propagatedBuildInputs = old.propagatedBuildInputs or [ ] ++ [ self.babel ];
       });
+
+      # patch mkdocstrings to fix jinja2 imports
+      mkdocstrings =
+        let
+          patchJinja2Imports = self.pkgs.fetchpatch {
+            name = "fix-jinja2-imports.patch";
+            url = "https://github.com/mkdocstrings/mkdocstrings/commit/b37722716b1e0ed6393ec71308dfb0f85e142f3b.patch";
+            hash = "sha256-DD1SjEvs5HBlSRLrqP3jhF/yoeWkF7F3VXCD1gyt5Fc=";
+          };
+        in
+        super.mkdocstrings.overridePythonAttrs (
+          old: lib.optionalAttrs
+            (lib.versionAtLeast old.version "0.17" && lib.versionOlder old.version "0.18")
+            {
+              patches = old.patches or [ ] ++ lib.optionals (!(old.src.isWheel or false)) [ patchJinja2Imports ];
+              # strip the first two levels ("a/src/") when patching since we're in site-packages
+              # just above mkdocstrings
+              postInstall = lib.optionalString (old.src.isWheel or false) ''
+                pushd "$out/${self.python.sitePackages}"
+                patch -p2 < "${patchJinja2Imports}"
+                popd
+              '';
+            }
+        );
+
+      y-py = super.y-py.override {
+        preferWheel = true;
+      };
     }
   )
-
 ]

pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix

@@ -106,7 +106,7 @@ let
       filtered = builtins.filter filterWheel filesWithoutSources;
       choose = files:
         let
-          osxMatches = [ "12_0" "11_0" "10_15" "10_12" "10_11" "10_10" "10_9" "10_8" "10_7" "any" ];
+          osxMatches = [ "12_0" "11_0" "10_15" "10_14" "10_12" "10_11" "10_10" "10_9" "10_8" "10_7" "any" ];
           linuxMatches = [ "manylinux1_" "manylinux2010_" "manylinux2014_" "manylinux_" "any" ];
           chooseLinux = x: lib.take 1 (findBestMatches linuxMatches x);
           chooseOSX = x: lib.take 1 (findBestMatches osxMatches x);

pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "poetry"
-version = "1.3.0"
+version = "1.4.1"
 description = "Python dependency management and packaging made easy."
 authors = [
     "Sébastien Eustace <sebastien@eustace.io>",
@@ -47,23 +47,27 @@ generate-setup-file = false
 [tool.poetry.dependencies]
 python = "^3.7"
 
-poetry-core = "1.4.0"
+poetry-core = "1.5.2"
-poetry-plugin-export = "^1.2.0"
+poetry-plugin-export = "^1.3.0"
 "backports.cached-property" = { version = "^1.0.2", python = "<3.8" }
+build = "^0.10.0"
 cachecontrol = { version = "^0.12.9", extras = ["filecache"] }
 cleo = "^2.0.0"
 crashtest = "^0.4.1"
-dulwich = "^0.20.46"
+dulwich = "^0.21.2"
 filelock = "^3.8.0"
 html5lib = "^1.0"
-importlib-metadata = { version = "^4.4", python = "<3.10" }
+importlib-metadata = { version = ">=4.4", python = "<3.10" }
+installer = "^0.7.0"
 jsonschema = "^4.10.0"
 keyring = "^23.9.0"
+lockfile = "^0.12.2"
 # packaging uses calver, so version is unclamped
 packaging = ">=20.4"
 pexpect = "^4.7.0"
-pkginfo = "^1.5"
+pkginfo = "^1.9.4"
 platformdirs = "^2.5.2"
+pyproject-hooks = "^1.0.0"
 requests = "^2.18"
 requests-toolbelt = ">=0.9.1,<0.11.0"
 shellingham = "^1.5"
@@ -74,9 +78,9 @@ tomlkit = ">=0.11.1,<1.0.0,!=0.11.2,!=0.11.3"
 trove-classifiers = ">=2022.5.19"
 # exclude 20.4.5 - 20.4.6 due to https://github.com/pypa/pip/issues/9953
 virtualenv = [
-    { version = "^20.4.3,!=20.4.5,!=20.4.6", markers = "sys_platform != 'win32' or python_version != '3.9'" },
+    { version = "^20.4.3,!=20.4.5,!=20.4.6" },
     # see https://github.com/python-poetry/poetry/pull/6950 for details
-    { version = "^20.4.3,!=20.4.5,!=20.4.6,<20.16.6", markers = "sys_platform == 'win32' and python_version == '3.9'" },
+    { version = "<20.16.6", markers = "sys_platform == 'win32' and python_version == '3.9'" },
 ]
 xattr = { version = "^0.10.0", markers = "sys_platform == 'darwin'" }
 urllib3 = "^1.26.0"
@@ -87,18 +91,22 @@ pre-commit = "^2.6"
 [tool.poetry.group.test.dependencies]
 # Cachy frozen to test backwards compatibility for `poetry.utils.cache`.
 cachy = "0.3.0"
-deepdiff = "^5.0"
+deepdiff = [
-flatdict = "^4.0.1"
+    { version = "^6.2" },
+    # avoid orjson, which is required by deepdiff 6.2.3, on FreeBSD
+    # because it requires a rust compiler
+    { version = "<6.2.3", markers = "platform_system == 'FreeBSD'"},
+]
 httpretty = "^1.0"
 pytest = "^7.1"
 pytest-cov = "^4.0"
 pytest-mock = "^3.9"
 pytest-randomly = "^3.12"
-pytest-xdist = { version = "^2.5", extras = ["psutil"] }
+pytest-xdist = { version = "^3.1", extras = ["psutil"] }
 zipp = { version = "^3.4", python = "<3.8" }
 
 [tool.poetry.group.typing.dependencies]
-mypy = ">=0.990"
+mypy = ">=1.0"
 types-html5lib = ">=1.1.9"
 types-jsonschema = ">=4.9.0"
 types-requests = ">=2.28.8"
@@ -161,25 +169,22 @@ enable_error_code = [
 # warning.
 [[tool.mypy.overrides]]
 module = [
-  'poetry.console.commands.self.show.plugins',
+    'poetry.console.commands.self.show.plugins',
-  'poetry.installation.executor',
+    'poetry.plugins.plugin_manager',
-  'poetry.mixology.version_solver',
+    'poetry.repositories.installed_repository',
-  'poetry.plugins.plugin_manager',
+    'poetry.utils.env',
-  'poetry.repositories.installed_repository',
-  'poetry.utils.env',
 ]
 warn_unused_ignores = false
 
 [[tool.mypy.overrides]]
 module = [
-  'cachecontrol.*',
+    'cachecontrol.*',
-  'lockfile.*',
+    'lockfile.*',
-  'pexpect.*',
+    'pexpect.*',
-  'pkginfo.*',
+    'requests_toolbelt.*',
-  'requests_toolbelt.*',
+    'shellingham.*',
-  'shellingham.*',
+    'virtualenv.*',
-  'virtualenv.*',
+    'xattr.*',
-  'xattr.*',
 ]
 ignore_missing_imports = true
 

pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json

@@ -1,8 +1,8 @@
 {
   "owner": "python-poetry",
   "repo": "poetry",
-  "rev": "1.3.0",
+  "rev": "1.4.1",
-  "sha256": "16ng59ykm7zkjizmwb482y0hawpjjr5mvl0ahjd790xzxcc2bbbv",
+  "sha256": "09mqabplg5kprs6qgjj2c2xvm1w43ibsawb18swh3css92s4bm4c",
   "fetchSubmodules": true
 }
 

pkgs/development/tools/ruff/Cargo.lock

@@ -780,7 +780,7 @@ checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
 [[package]]
 name = "flake8-to-ruff"
-version = "0.0.258"
+version = "0.0.259"
 dependencies = [
  "anyhow",
  "clap 4.1.8",
@@ -1982,7 +1982,7 @@ dependencies = [
 
 [[package]]
 name = "ruff"
-version = "0.0.258"
+version = "0.0.259"
 dependencies = [
  "anyhow",
  "bisection",
@@ -2063,7 +2063,7 @@ dependencies = [
 
 [[package]]
 name = "ruff_cli"
-version = "0.0.258"
+version = "0.0.259"
 dependencies = [
  "annotate-snippets 0.9.1",
  "anyhow",

pkgs/development/tools/ruff/default.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.258";
+  version = "0.0.259";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-rlMghh6NmyIJTdjf6xmzVuevXh/OrBqhx+CkvvQwlng=";
+    hash = "sha256-K0EfKG140MDfSg3BVJi9x0q1it5nEeREpkanx2RW1Kw=";
   };
 
   # We have to use importCargoLock here because `cargo vendor` currently doesn't support workspace

pkgs/development/tools/rust/cargo-audit/default.nix

@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-audit";
-  version = "0.17.4";
+  version = "0.17.5";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-tglBtgjhZmeZTE8X6wNGI9CS3OsbHxTlPJVN4wjXVgs=";
+    sha256 = "sha256-qsHy4MKQHBzChcOJ9TrlUbEnEtVxlzxDgZlahhDsoxM=";
   };
 
-  cargoSha256 = "sha256-THoV87GpTuFhO/Qo37n4oascQK/tCaFUa8G2MKxrz+k=";
+  cargoSha256 = "sha256-7uBRybAkexBl3SldV4qudwPZ8JcKCUaAlwbAcT9JXy8=";
 
   nativeBuildInputs = [
     pkg-config
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Audit Cargo.lock files for crates with security vulnerabilities";
     homepage = "https://rustsec.org";
-    changelog = "https://github.com/rustsec/rustsec/blob/cargo-audit/v${version}/cargo-audit/CHANGELOG.md";
+    changelog = "https://github.com/rustsec/rustsec/blob/cargo-audit/${version}/cargo-audit/CHANGELOG.md";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ basvandijk figsoda jk ];
   };

pkgs/development/tools/rust/cargo-binstall/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "0.21.3";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-K4NerJSW3ckXMFFnFCMXIqMeevE3Xzr/Wsz9nloolBI=";
+    hash = "sha256-jY5mIbrcX2B0D6ezi1k0mcRAmrSPIoebJFHn3lZ2t9w=";
   };
 
-  cargoHash = "sha256-YSKnfhSZ885evtEK40QTt90RwtH03aO/aJ6A/DddoVU=";
+  cargoHash = "sha256-+O/+zsiG0wyNKp/2TP5I8EPMf6YPT8VtCD4BXI76J7Q=";
 
   nativeBuildInputs = [
     pkg-config
@@ -43,6 +43,9 @@ rustPlatform.buildRustPackage rec {
     "zstd-thin"
   ];
 
+  cargoBuildFlags = [ "-p" "cargo-binstall" ];
+  cargoTestFlags = [ "-p" "cargo-binstall" ];
+
   checkFlags = [
     # requires internet access
     "--skip=download::test::test_and_extract"

pkgs/development/tools/rust/cargo-semver-checks/default.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-semver-checks";
-  version = "0.18.3";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PR8+4SK0Bb7+0fDwdvJBYERvhjWLXRGswNoEdRo5JiM=";
+    sha256 = "sha256-tZ83Lxo7yKpFQrD1rnm/3YaT3MgiVb/jL2OVdt491xg=";
   };
 
-  cargoSha256 = "sha256-wZR5ylhtdAUvpJ0raTM5IrbdmaHLPAYrAKU31oE8Bbg=";
+  cargoSha256 = "sha256-k0dc/bOkIcLP++ZH+rh01do5kcVDh/8hNGM3MPhg/0g=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/development/tools/rust/cargo-zigbuild/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.16.3";
+  version = "0.16.4";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IqGKK3g56RB9o6i+sJjlod3KuAAB9O7RerQshKoCOfk=";
+    sha256 = "sha256-95cmmYHRS9BS+CtVE/sV2dwmoAk1EKJjX7NulKRuPLs=";
   };
 
-  cargoSha256 = "sha256-RPOMc0+FwjhewqiMwVxAwg5g7GphOtXW8xMElDyTPUk=";
+  cargoSha256 = "sha256-5zdakF/6pDNWcAw8IXCe4Jl246V/Jdto1FPBFkKy6gg=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/games/unciv/default.nix

@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.5.9";
+  version = "4.5.10";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-sDrVGQeyhMHurbmdqWBUDepJmdPYajiSrpqvts2view=";
+    hash = "sha256-vV0Ux1TWwDlgDzQyIalMRcktP3SYP2RPacTIY9VV0W8=";
   };
 
   dontUnpack = true;