From 7d40fbbc04cded4adbbcd3e87546d43bdacf47e8 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 22 Sep 2023 06:59:40 +0000
Subject: [PATCH 01/41] nix-prefetch-git: ignore global and user git config

nix-prefetch-git is either run as part of a build, usually sandboxed,
or outside a build, unsandboxed, to prefetch something that will later
be used in a build.  It's important that the latter use produces
hashes that can be reproduced by the former.

One way that they can differ is if the user's git config does
something that changes the result of git clone.  I ran into this,
because my global git config automatically enables git-lfs, whereas
nix-prefetch-git otherwise only uses git-lfs if specifically
requested.  This led to very confusing hash mismatches.
---
 nixos/doc/manual/release-notes/rl-2311.section.md | 2 ++
 pkgs/build-support/fetchgit/nix-prefetch-git      | 9 ++++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 6cd59a95e63c..f5a7bf545067 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -124,6 +124,8 @@
 
 - `himalaya` has been updated to `0.8.0`, which drops the native TLS support (in favor of Rustls) and add OAuth 2.0 support. See the [release note](https://github.com/soywod/himalaya/releases/tag/v0.8.0) for more details.
 
+- `nix-prefetch-git` now ignores global and user git config, to improve reproducibility.
+
 - The [services.caddy.acmeCA](#opt-services.caddy.acmeCA) option now defaults to `null` instead of `"https://acme-v02.api.letsencrypt.org/directory"`, to use all of Caddy's default ACME CAs and enable Caddy's automatic issuer fallback feature by default, as recommended by upstream.
 
 - The default priorities of [`services.nextcloud.phpOptions`](#opt-services.nextcloud.phpOptions) have changed. This means that e.g.
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 2a53fd94e7f2..1194b39dafd7 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -293,9 +293,6 @@ clone_user_rev() {
     local rev="${3:-HEAD}"
 
     if [ -n "$fetchLFS" ]; then
-        tmpHomePath="$(mktemp -d "${TMPDIR:-/tmp}/nix-prefetch-git-tmp-home-XXXXXXXXXX")"
-        exit_handlers+=(remove_tmpHomePath)
-        HOME="$tmpHomePath"
         clean_git lfs install
     fi
 
@@ -417,6 +414,12 @@ if test -z "$branchName"; then
     branchName=fetchgit
 fi
 
+tmpHomePath="$(mktemp -d "${TMPDIR:-/tmp}/nix-prefetch-git-tmp-home-XXXXXXXXXX")"
+exit_handlers+=(remove_tmpHomePath)
+HOME="$tmpHomePath"
+unset XDG_CONFIG_HOME
+export GIT_CONFIG_NOSYSTEM=1
+
 if test -n "$builder"; then
     test -n "$out" -a -n "$url" -a -n "$rev" || usage
     mkdir -p "$out"

From 2058c02bad2e5840a2d06d289e98402088d6e411 Mon Sep 17 00:00:00 2001
From: BlankParticle <blankparticle@gmail.com>
Date: Sat, 23 Sep 2023 19:18:38 +0530
Subject: [PATCH 02/41] maintainers: add blankparticle to maintainer-list

---
 maintainers/maintainer-list.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 044d052e9f36..08f3b6678fb5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2336,6 +2336,15 @@
     github = "blaggacao";
     githubId = 7548295;
   };
+  blankparticle = {
+    name = "BlankParticle";
+    email = "blankparticle@gmail.com";
+    github = "BlankParticle";
+    githubId = 130567419;
+    keys = [{
+      fingerprint = "1757 64C3 7065 AA8D 614D  41C9 0ACE 126D 7B35 9261";
+    }];
+  };
   blanky0230 = {
     email = "blanky0230@gmail.com";
     github = "blanky0230";

From 8d17521a05047d5eb83d21e1adb518f68aeb61a4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 23 Sep 2023 23:47:44 +0000
Subject: [PATCH 03/41] gi-crystal: 0.17.0 -> 0.18.0

---
 pkgs/development/tools/gi-crystal/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/gi-crystal/default.nix b/pkgs/development/tools/gi-crystal/default.nix
index eee07206a2a1..441bbaba1558 100644
--- a/pkgs/development/tools/gi-crystal/default.nix
+++ b/pkgs/development/tools/gi-crystal/default.nix
@@ -5,13 +5,13 @@
 }:
 crystal.buildCrystalPackage rec {
   pname = "gi-crystal";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "hugopl";
     repo = "gi-crystal";
     rev = "v${version}";
-    hash = "sha256-DIH8L8P8lkWzzVUj1Tbf9oTUvu9X7OT66APyUHiDkYk=";
+    hash = "sha256-9px6JRdVzsUoU5wlO+blH1OBGKskozF3WvqLV/EYiiA=";
   };
 
   # Make sure gi-crystal picks up the name of the so or dylib and not the leading nix store path

From db522ccd096603be4bb3bd6fe11b6c096c85d779 Mon Sep 17 00:00:00 2001
From: BlankParticle <blankparticle@gmail.com>
Date: Sat, 23 Sep 2023 20:38:45 +0530
Subject: [PATCH 04/41] keepassxc: 2.7.5 -> 2.7.6

---
 pkgs/applications/misc/keepassxc/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/keepassxc/default.nix b/pkgs/applications/misc/keepassxc/default.nix
index 277a1b99cc1e..762434ef12c1 100644
--- a/pkgs/applications/misc/keepassxc/default.nix
+++ b/pkgs/applications/misc/keepassxc/default.nix
@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "keepassxc";
-  version = "2.7.5";
+  version = "2.7.6";
 
   src = fetchFromGitHub {
     owner = "keepassxreboot";
     repo = "keepassxc";
     rev = version;
-    sha256 = "sha256-OBEjczUIkY3pQXJfsuNj9Bm2TIbVWEHqMSolQnSfvLE=";
+    hash = "sha256-xgrkMz7BCBxjfxHsAz/CFLv1d175LnrAJIOZMM3GmU0=";
   };
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang (toString [
@@ -129,7 +129,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://keepassxc.org/";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ jonafato srapenne ];
+    maintainers = with maintainers; [ jonafato srapenne blankparticle ];
     platforms = platforms.linux ++ platforms.darwin;
   };
 }

From 8de99dd1cea43450348dec005a49914585b9f1c9 Mon Sep 17 00:00:00 2001
From: zaldnoay <zaldnoay@users.noreply.github.com>
Date: Wed, 20 Sep 2023 15:07:00 +0800
Subject: [PATCH 05/41] armbian-firmware: init at unstable-2023-09-16

---
 pkgs/by-name/ar/armbian-firmware/package.nix | 33 ++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 pkgs/by-name/ar/armbian-firmware/package.nix

diff --git a/pkgs/by-name/ar/armbian-firmware/package.nix b/pkgs/by-name/ar/armbian-firmware/package.nix
new file mode 100644
index 000000000000..6e97c5908871
--- /dev/null
+++ b/pkgs/by-name/ar/armbian-firmware/package.nix
@@ -0,0 +1,33 @@
+{ stdenvNoCC, lib, fetchFromGitHub }:
+stdenvNoCC.mkDerivation rec {
+  pname = "armbian-firmware";
+  version = "unstable-2023-09-16";
+
+  src = fetchFromGitHub {
+    owner = "armbian";
+    repo = "firmware";
+    rev = "01f9809bb0c4bd60c0c84b9438486b02d58b03f7";
+    hash = "sha256-ozKADff7lFjIT/Zf5dkNlCe8lOK+kwYb/60NaCJ8i2k=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/firmware
+    cp -a * $out/lib/firmware/
+
+    runHook postInstall
+  '';
+
+  # Firmware blobs do not need fixing and should not be modified
+  dontBuild = true;
+  dontFixup = true;
+
+  meta = with lib; {
+    description = "Firmware from Armbian";
+    homepage = "https://github.com/armbian/firmware";
+    license = licenses.unfree;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ zaldnoay ];
+  };
+}

From f2c59d3401eedd47689d80e4767bfc951b1eadb2 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 24 Sep 2023 20:26:33 +0300
Subject: [PATCH 06/41] libsForQt5.kdegraphics-thumbnailers: hardcode
 Ghostscript path

Fixes #153983.
---
 pkgs/applications/kde/default.nix             |  2 +-
 .../default.nix}                              | 11 +++++++++-
 .../kdegraphics-thumbnailers/gs-paths.patch   | 22 +++++++++++++++++++
 3 files changed, 33 insertions(+), 2 deletions(-)
 rename pkgs/applications/kde/{kdegraphics-thumbnailers.nix => kdegraphics-thumbnailers/default.nix} (55%)
 create mode 100644 pkgs/applications/kde/kdegraphics-thumbnailers/gs-paths.patch

diff --git a/pkgs/applications/kde/default.nix b/pkgs/applications/kde/default.nix
index e61e99751d0d..a0e59c43d17c 100644
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@@ -120,7 +120,7 @@ let
       kdebugsettings = callPackage ./kdebugsettings.nix {};
       kdeconnect-kde = callPackage ./kdeconnect-kde.nix {};
       kdegraphics-mobipocket = callPackage ./kdegraphics-mobipocket.nix {};
-      kdegraphics-thumbnailers = callPackage ./kdegraphics-thumbnailers.nix {};
+      kdegraphics-thumbnailers = callPackage ./kdegraphics-thumbnailers {};
       kdenetwork-filesharing = callPackage ./kdenetwork-filesharing.nix {};
       kdenlive = callPackage ./kdenlive {};
       kdepim-addons = callPackage ./kdepim-addons.nix {};
diff --git a/pkgs/applications/kde/kdegraphics-thumbnailers.nix b/pkgs/applications/kde/kdegraphics-thumbnailers/default.nix
similarity index 55%
rename from pkgs/applications/kde/kdegraphics-thumbnailers.nix
rename to pkgs/applications/kde/kdegraphics-thumbnailers/default.nix
index f0d9fea5d0e6..6686f582d6d2 100644
--- a/pkgs/applications/kde/kdegraphics-thumbnailers.nix
+++ b/pkgs/applications/kde/kdegraphics-thumbnailers/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, fetchpatch,
+  mkDerivation, lib, ghostscript, substituteAll,
   extra-cmake-modules, karchive, kio, libkexiv2, libkdcraw, kdegraphics-mobipocket
 }:
 
@@ -11,4 +11,13 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ karchive kio libkexiv2 libkdcraw kdegraphics-mobipocket ];
+
+  patches = [
+    # Hardcode patches to Ghostscript so PDF thumbnails work OOTB.
+    # Intentionally not doing the same for dvips because TeX is big.
+    (substituteAll {
+      gs = "${ghostscript}/bin/gs";
+      src = ./gs-paths.patch;
+    })
+  ];
 }
diff --git a/pkgs/applications/kde/kdegraphics-thumbnailers/gs-paths.patch b/pkgs/applications/kde/kdegraphics-thumbnailers/gs-paths.patch
new file mode 100644
index 000000000000..5aa4a8d7444c
--- /dev/null
+++ b/pkgs/applications/kde/kdegraphics-thumbnailers/gs-paths.patch
@@ -0,0 +1,22 @@
+diff --git a/ps/gscreator.cpp b/ps/gscreator.cpp
+index 5b84e49..cbb7c25 100644
+--- a/ps/gscreator.cpp
++++ b/ps/gscreator.cpp
+@@ -101,7 +101,7 @@ static const char *epsprolog =
+     "[ ] 0 setdash newpath false setoverprint false setstrokeadjust\n";
+ 
+ static const char * gsargs_ps[] = {
+-    "gs",
++    "@gs@",
+     "-sDEVICE=png16m",
+     "-sOutputFile=-",
+     "-dSAFER",
+@@ -120,7 +120,7 @@ static const char * gsargs_ps[] = {
+ };
+ 
+ static const char * gsargs_eps[] = {
+-    "gs",
++    "@gs@",
+     "-sDEVICE=png16m",
+     "-sOutputFile=-",
+     "-dSAFER",

From e010347d2c738072db109bab3cb9d3e4bebda3fd Mon Sep 17 00:00:00 2001
From: networkException <git@nwex.de>
Date: Sun, 24 Sep 2023 22:58:42 +0200
Subject: [PATCH 07/41] chromium: 117.0.5938.88 -> 117.0.5938.92

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_21.html
---
 .../networking/browsers/chromium/upstream-info.nix          | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index e67e3c114468..1e245d067944 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -41,9 +41,9 @@
         version = "2023-08-01";
       };
     };
-    sha256 = "01n9aqnilsjrbpv5kkx3c6nxs9p5l5lfwxj67hd5s5g4740di4a6";
-    sha256bin64 = "1dhgagphdzbd19gkc7vpl1hxc9vn0l7sxny346qjlmrwafqlhbgi";
-    version = "117.0.5938.88";
+    sha256 = "0b1l8gjhqbsyqi30rsn8dyq2hdvwasdqfk1qzk55f9ch4wclkjk5";
+    sha256bin64 = "047w7y4c8k076yzrjc50lvwncbk8b3lyqnd1si9nrsl7c66j2h0q";
+    version = "117.0.5938.92";
   };
   ungoogled-chromium = {
     deps = {

From 03720cb5c6336bbc54ead7d9a9a55e1907837235 Mon Sep 17 00:00:00 2001
From: networkException <git@nwex.de>
Date: Sun, 24 Sep 2023 22:59:03 +0200
Subject: [PATCH 08/41] ungoogled-chromium: 117.0.5938.88-1 -> 117.0.5938.92-1

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_21.html
---
 .../networking/browsers/chromium/upstream-info.nix     | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 1e245d067944..6871694bd3ac 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -54,12 +54,12 @@
         version = "2023-08-01";
       };
       ungoogled-patches = {
-        rev = "117.0.5938.88-1";
-        sha256 = "1wz15ib56j8c84bgrbf0djk5wli49b1lvaqbg18pdclkp1mqy5w9";
+        rev = "117.0.5938.92-1";
+        sha256 = "0ix0vaki9r305js61qraiah3vqjaj3dyycabi6grfavdgjpjkasb";
       };
     };
-    sha256 = "01n9aqnilsjrbpv5kkx3c6nxs9p5l5lfwxj67hd5s5g4740di4a6";
-    sha256bin64 = "1dhgagphdzbd19gkc7vpl1hxc9vn0l7sxny346qjlmrwafqlhbgi";
-    version = "117.0.5938.88";
+    sha256 = "0b1l8gjhqbsyqi30rsn8dyq2hdvwasdqfk1qzk55f9ch4wclkjk5";
+    sha256bin64 = "047w7y4c8k076yzrjc50lvwncbk8b3lyqnd1si9nrsl7c66j2h0q";
+    version = "117.0.5938.92";
   };
 }

From 6d7c3242752be338d5278c6efb9a2c6da9530178 Mon Sep 17 00:00:00 2001
From: networkException <git@nwex.de>
Date: Sun, 24 Sep 2023 22:59:33 +0200
Subject: [PATCH 09/41] chromedriver: 117.0.5938.88 -> 117.0.5938.92

---
 .../networking/browsers/chromium/upstream-info.nix        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 6871694bd3ac..f1020296d84a 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -27,11 +27,11 @@
   };
   stable = {
     chromedriver = {
-      sha256_darwin = "0phhcqid7wjw923qdi65zql3fid25swwszksgnw3b8fgz67jn955";
+      sha256_darwin = "138mw5p6r0n0531fs6322yxsjgj9hia5plw4mj0b3mclykzy5l37";
       sha256_darwin_aarch64 =
-        "00fwq8slvjm6c7krgwjd4mxhkkrp23n4icb63qlvi2hy06gfj4l6";
-      sha256_linux = "0ws8ch1j2hzp483vr0acvam1zxmzg9d37x6gqdwiqwgrk6x5pvkh";
-      version = "117.0.5938.88";
+        "1cym94av2gw2zwj3rdqbjcqkigpzf0zk2bam2hw9n2hiabb4rm0p";
+      sha256_linux = "1q1vyhmcx6b5criz5bn1c3x3z2dzqdgsmwcvlb0rzqlzpla9q26m";
+      version = "117.0.5938.92";
     };
     deps = {
       gn = {

From 599abc266c31b3d912e3b96254bce38651f27636 Mon Sep 17 00:00:00 2001
From: Sebastian Sellmeier <mail@sebastian-sellmeier.de>
Date: Mon, 25 Sep 2023 00:03:49 +0200
Subject: [PATCH 10/41] slack: Updatescript allow independent updates between
 linux and macos

---
 .../networking/instant-messengers/slack/update.sh           | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/slack/update.sh b/pkgs/applications/networking/instant-messengers/slack/update.sh
index 688fe579f877..2981a26a8e3e 100755
--- a/pkgs/applications/networking/instant-messengers/slack/update.sh
+++ b/pkgs/applications/networking/instant-messengers/slack/update.sh
@@ -6,12 +6,6 @@ set -eou pipefail
 latest_linux_version=$(curl -L --silent https://slack.com/downloads/linux | sed -n 's/.*Version \([0-9\.]\+\).*/\1/p')
 latest_mac_version=$(curl -L --silent https://slack.com/downloads/mac | sed -n 's/.*Version \([0-9\.]\+\).*/\1/p')
 
-# Double check that the latest mac and linux versions are in sync.
-if [[ "$latest_linux_version" != "$latest_mac_version" ]]; then
-  echo "the latest linux ($latest_linux_version) and mac ($latest_mac_version) versions are not the same"
-  exit 1
-fi
-
 nixpkgs="$(git rev-parse --show-toplevel)"
 slack_nix="$nixpkgs/pkgs/applications/networking/instant-messengers/slack/default.nix"
 nixpkgs_linux_version=$(cat "$slack_nix" | sed -n 's/.*x86_64-linux-version = \"\([0-9\.]\+\)\";.*/\1/p')

From 6500b4580c2a1f3d0f980d32d285739d8e156d92 Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Mon, 25 Sep 2023 14:22:51 +0200
Subject: [PATCH 11/41] Revert "nixos/boot/rasbperrypi: add support for
 boot.initrd.secret with uboot (#240358)" (#257251)

This reverts commit 94e939985b7730fd74b1c2e03292661734b490f0.
---
 .../manual/release-notes/rl-2311.section.md   |  2 --
 .../extlinux-conf-builder.sh                  | 28 ++-----------------
 .../boot/loader/raspberrypi/raspberrypi.nix   |  1 -
 nixos/modules/system/boot/stage-1.nix         |  7 -----
 4 files changed, 3 insertions(+), 35 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 02f7defc2dbb..e2b62265502b 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -270,8 +270,6 @@ The module update takes care of the new config syntax and the data itself (user
 
 - `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts.<name>.listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details.
 
-- `generic-extlinux-compatible` bootloader (and raspberry pi with uboot) supports appending secrets to the initramfs
-
 - `services.restic.backups` now adds wrapper scripts to your system path, which set the same environment variables as the service, so restic operations can easly be run from the command line. This behavior can be disabled by setting `createWrapper` to `false`, per backup configuration.
 
 - `services.prometheus.exporters` has a new exporter to monitor electrical power consumption based on PowercapRAPL sensor called [Scaphandre](https://github.com/hubblo-org/scaphandre), see [#239803](https://github.com/NixOS/nixpkgs/pull/239803) for more details.
diff --git a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
index 84a0a93ded17..1a0da0050291 100644
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
@@ -70,33 +70,13 @@ copyToKernelsDir() {
 addEntry() {
     local path=$(readlink -f "$1")
     local tag="$2" # Generation number or 'default'
-    local current="$3" # whether this is the current/latest generation
 
     if ! test -e $path/kernel -a -e $path/initrd; then
         return
     fi
 
-    if test -e "$path/append-initrd-secrets"; then
-        local initrd="$target/nixos/$(basename "$path")-initramfs-with-secrets"
-        cp $(readlink -f "$path/initrd") "$initrd"
-        chmod 600 "${initrd}"
-        chown 0:0 "${initrd}"
-        filesCopied[$initrd]=1
-
-        "$path/append-initrd-secrets" "$initrd" || if test "${current}" = "1"; then
-            echo "failed to create initrd secrets for the current generation." >&2
-            echo "are your \`boot.initrd.secrets\` still in place?" >&2
-            exit 1
-        else
-            echo "warning: failed to create initrd secrets for \"$path\", an older generation" >&2
-            echo "note: this is normal after having removed or renamed a file in \`boot.initrd.secrets\`" >&2
-        fi
-    else
-        copyToKernelsDir "$path/initrd"; initrd=$result
-    fi
-
     copyToKernelsDir "$path/kernel"; kernel=$result
-
+    copyToKernelsDir "$path/initrd"; initrd=$result
     dtbDir=$(readlink -m "$path/dtbs")
     if [ -e "$dtbDir" ]; then
         copyToKernelsDir "$dtbDir"; dtbs=$result
@@ -150,20 +130,18 @@ MENU TITLE ------------------------------------------------------------
 TIMEOUT $timeout
 EOF
 
-addEntry $default default 1 >> $tmpFile
+addEntry $default default >> $tmpFile
 
 if [ "$numGenerations" -gt 0 ]; then
     # Add up to $numGenerations generations of the system profile to the menu,
     # in reverse (most recent to least recent) order.
-    current=1
     for generation in $(
             (cd /nix/var/nix/profiles && ls -d system-*-link) \
             | sed 's/system-\([0-9]\+\)-link/\1/' \
             | sort -n -r \
             | head -n $numGenerations); do
         link=/nix/var/nix/profiles/system-$generation-link
-        addEntry $link $generation $current
-        current=0
+        addEntry $link $generation
     done >> $tmpFile
 fi
 
diff --git a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
index c64ef092667b..9c9bee93de8a 100644
--- a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
+++ b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
@@ -142,7 +142,6 @@ in
         assertion = !pkgs.stdenv.hostPlatform.isAarch64 || cfg.version >= 3;
         message = "Only Raspberry Pi >= 3 supports aarch64.";
       };
-      boot.loader.supportsInitrdSecrets = cfg.uboot.enable;
 
       system.build.installBootLoader = builder;
       system.boot.loader.id = "raspberrypi";
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index 1cf58dbe9f1f..a3551f68dbe8 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -610,13 +610,6 @@ in
             path the secret should have inside the initrd, the value
             is the path it should be copied from (or null for the same
             path inside and out).
-
-            The loader `generic-extlinux-compatible` supports this. Because
-            it is not well know how different implementations react to
-            concatenated cpio archives, this is disabled by default. It can be
-            enabled by setting {option}`boot.loader.supportsInitrdSecrets`
-            to true. If this works for you, please report your findings at
-            https://github.com/NixOS/nixpkgs/issues/247145 .
           '';
         example = literalExpression
           ''

From 7694f0e7fba69301c53ea939084b1b09c2c083df Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 25 Sep 2023 12:30:44 +0000
Subject: [PATCH 12/41] python310Packages.gspread: 5.11.1 -> 5.11.2

---
 pkgs/development/python-modules/gspread/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gspread/default.nix b/pkgs/development/python-modules/gspread/default.nix
index fd01e1b1d815..99351ee7b0c8 100644
--- a/pkgs/development/python-modules/gspread/default.nix
+++ b/pkgs/development/python-modules/gspread/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "gspread";
-  version = "5.11.1";
+  version = "5.11.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "burnash";
     repo = "gspread";
     rev = "refs/tags/v${version}";
-    hash = "sha256-a8A47il9NrMdHkSX4YmQj4VIAYDXK5V+FUdwv+LGIfQ=";
+    hash = "sha256-geP01U34HzBSmA8FTTaTMlv508hzGBXFiASjGw3uUmQ=";
   };
 
   nativeBuildInputs = [

From 8eb2f6c4192e07c0f2e4523853e5bb6c5a485cdb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 25 Sep 2023 12:32:02 +0000
Subject: [PATCH 13/41] python310Packages.softlayer: 6.1.8 -> 6.1.9

---
 pkgs/development/python-modules/softlayer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/softlayer/default.nix b/pkgs/development/python-modules/softlayer/default.nix
index d51ecb3d3e59..767d91b1220b 100644
--- a/pkgs/development/python-modules/softlayer/default.nix
+++ b/pkgs/development/python-modules/softlayer/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "softlayer";
-  version = "6.1.8";
+  version = "6.1.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "softlayer-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6LZ2vy6nkyWA7xbUl4aNi2ygRWDJTj7J9Af0GTvNLd4=";
+    hash = "sha256-mYezVJSBtZuNT6mG544dJhRFh26M4nN4nE3tUVB3cZQ=";
   };
 
   postPatch = ''

From 034b9ec5f7f3dfcf19c962246f0d4bdb1541c9c6 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 25 Sep 2023 05:35:56 -0700
Subject: [PATCH 14/41] pantheon.appcenter: 7.3.0 -> 7.4.0 (#257248)

Actually does the bump.

Fixes cb5ce1520a4df91ee5d4e85178c6cbff7171212b.
---
 pkgs/desktops/pantheon/apps/appcenter/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/desktops/pantheon/apps/appcenter/default.nix b/pkgs/desktops/pantheon/apps/appcenter/default.nix
index b80f6688a7d5..66042844d8b4 100644
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "appcenter";
-  version = "7.3.0";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Lj3j812XaCIN+TFSDAvIgtl49n5jG4fVlAFvrWqngpM=";
+    sha256 = "sha256-L6MGbzzujr4tEB2Cpd7IU+3mOtSCt2hLPw4mOfZ4TkQ=";
   };
 
   nativeBuildInputs = [

From ddccd7aa5558744f294f0ed1fb1f40d3bb5b1300 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 25 Sep 2023 11:44:27 +0000
Subject: [PATCH 15/41] mg.meta.mainProgram: init

---
 pkgs/applications/editors/mg/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/editors/mg/default.nix b/pkgs/applications/editors/mg/default.nix
index 0dc52b863014..c54cd01dbf28 100644
--- a/pkgs/applications/editors/mg/default.nix
+++ b/pkgs/applications/editors/mg/default.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
     description = "Micro GNU/emacs, a portable version of the mg maintained by the OpenBSD team";
     homepage = "https://man.openbsd.org/OpenBSD-current/man1/mg.1";
     license = licenses.publicDomain;
+    mainProgram = "mg";
     platforms = platforms.all;
   };
 }

From 7bcb119e9a728198ce15e446d97bcb81f832773c Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 25 Sep 2023 11:44:39 +0000
Subject: [PATCH 16/41] lynx.meta.mainProgram: init

---
 pkgs/applications/networking/browsers/lynx/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/networking/browsers/lynx/default.nix b/pkgs/applications/networking/browsers/lynx/default.nix
index e2d6854295a5..0a41ad0feb26 100644
--- a/pkgs/applications/networking/browsers/lynx/default.nix
+++ b/pkgs/applications/networking/browsers/lynx/default.nix
@@ -58,6 +58,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A text-mode web browser";
     homepage = "https://lynx.invisible-island.net/";
+    mainProgram = "lynx";
     maintainers = with maintainers; [ ];
     license = licenses.gpl2Plus;
     platforms = platforms.unix;

From 584d0cce2afd35c161315600eeef8823392f60ff Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 25 Sep 2023 11:44:45 +0000
Subject: [PATCH 17/41] catgirl.meta.mainProgram: init

---
 pkgs/applications/networking/irc/catgirl/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/networking/irc/catgirl/default.nix b/pkgs/applications/networking/irc/catgirl/default.nix
index d56573d9d728..c3e4fa1b7a8a 100644
--- a/pkgs/applications/networking/irc/catgirl/default.nix
+++ b/pkgs/applications/networking/irc/catgirl/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     description = "A TLS-only terminal IRC client";
     platforms = platforms.unix;
+    mainProgram = "catgirl";
     maintainers = with maintainers; [ xfnw ];
   };
 }

From ac683a485f14fa632e1a870c375ae9615ef70560 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 25 Sep 2023 11:44:52 +0000
Subject: [PATCH 18/41] cloud-hypervisor.meta.mainProgram: init

---
 pkgs/applications/virtualization/cloud-hypervisor/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/virtualization/cloud-hypervisor/default.nix b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
index 02d9239a3a42..d7182b813107 100644
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@@ -45,6 +45,7 @@ rustPlatform.buildRustPackage rec {
     description = "Open source Virtual Machine Monitor (VMM) that runs on top of KVM";
     changelog = "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v${version}";
     license = with licenses; [ asl20 bsd3 ];
+    mainProgram = "cloud-hypervisor";
     maintainers = with maintainers; [ offline qyliss ];
     platforms = [ "aarch64-linux" "x86_64-linux" ];
   };

From a2024d5e35eca912eceeac60484afe0dd37d845b Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 25 Sep 2023 11:45:00 +0000
Subject: [PATCH 19/41] crosvm.meta.mainProgram: init

---
 pkgs/applications/virtualization/crosvm/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/virtualization/crosvm/default.nix b/pkgs/applications/virtualization/crosvm/default.nix
index 74311ca3e13f..59cc830844c9 100644
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@@ -38,6 +38,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A secure virtual machine monitor for KVM";
     homepage = "https://chromium.googlesource.com/crosvm/crosvm/";
+    mainProgram = "crosvm";
     maintainers = with maintainers; [ qyliss ];
     license = licenses.bsd3;
     platforms = [ "aarch64-linux" "x86_64-linux" ];

From bcbcb3b54bd62e50107523cd2fee762ca021c606 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 25 Sep 2023 11:45:08 +0000
Subject: [PATCH 20/41] weston.meta.mainProgram: init

---
 pkgs/applications/window-managers/weston/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/window-managers/weston/default.nix b/pkgs/applications/window-managers/weston/default.nix
index b70c5bda0a59..e28c26c52874 100644
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@@ -78,6 +78,7 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.freedesktop.org/wayland/weston";
     license = licenses.mit; # Expat version
     platforms = platforms.linux;
+    mainProgram = "weston";
     maintainers = with maintainers; [ primeos qyliss ];
   };
 }

From c1a53897ad4290a1cbfa02fbe6f3869577b93744 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 25 Sep 2023 11:45:17 +0000
Subject: [PATCH 21/41] wayland-proxy-virtwl.meta.mainProgram: init

---
 pkgs/tools/wayland/wayland-proxy-virtwl/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/tools/wayland/wayland-proxy-virtwl/default.nix b/pkgs/tools/wayland/wayland-proxy-virtwl/default.nix
index 74e6c5359ed4..25123ec9b244 100644
--- a/pkgs/tools/wayland/wayland-proxy-virtwl/default.nix
+++ b/pkgs/tools/wayland/wayland-proxy-virtwl/default.nix
@@ -42,6 +42,7 @@ ocamlPackages.buildDunePackage rec {
     homepage = "https://github.com/talex5/wayland-virtwl-proxy";
     description = "Proxy Wayland connections across a VM boundary";
     license = licenses.asl20;
+    mainProgram = "wayland-proxy-virtwl";
     maintainers = [ maintainers.qyliss maintainers.sternenseemann ];
     platforms = platforms.linux;
   };

From 0594cd578af2035e4df34ca1277de51a2c5bfb62 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 25 Sep 2023 14:11:32 +0000
Subject: [PATCH 22/41] python310Packages.zigpy: 0.57.1 -> 0.57.2

---
 pkgs/development/python-modules/zigpy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zigpy/default.nix b/pkgs/development/python-modules/zigpy/default.nix
index 4828ff4264c5..dde789fd289c 100644
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy";
-  version = "0.57.1";
+  version = "0.57.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zigpy";
     rev = "refs/tags/${version}";
-    hash = "sha256-aVrLiWPjc4xn2GvKmZCrRJGGbxP545PKqAH9rPq8IPo=";
+    hash = "sha256-v4H8syWbXqmfvOznRECgSjYi246+socPJTffb79MXK4=";
   };
 
   postPatch = ''

From 370097ce864f731c6e281ab3970cef1b39dfa06f Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Mon, 25 Sep 2023 16:23:01 +0200
Subject: [PATCH 23/41] remove the misleading warning on using `nix-env` for
 split outputs (#255947)

The text was originally added [0] following an apparently incomplete
research on how everything plays together. In fact, Nix propagates
`outputs` to the corresponding nested derivations, and there is some
messy behavior in Nixpkgs that only seems to propagate
`meta.outputsToInstall` in `buildEnv`[1].

This change moves the hints on how to use NixOS specifics to NixOS
module documentation (which is hopefully easier to find through
search.nixos.org), describes the default behavior in Nixpkgs (updating
a the link to the source), and removes the confusing mention of
`nix-env`.

the last of them should not be there to begin with. we don't want
beginners to use `nix-env`, as this is known to run them into trouble
eventually.

[0]: https://github.com/NixOS/nixpkgs/pull/76794
[1]: https://github.com/NixOS/nixpkgs/blob/1774d07242995050d2d8a91cb4da0855eac2e472/pkgs/build-support/buildenv/default.nix#L66
---
 doc/stdenv/multiple-output.chapter.md | 44 +++------------------------
 nixos/modules/config/system-path.nix  | 10 ++++--
 2 files changed, 13 insertions(+), 41 deletions(-)

diff --git a/doc/stdenv/multiple-output.chapter.md b/doc/stdenv/multiple-output.chapter.md
index c19d497ab61e..1ee063c0c2f4 100644
--- a/doc/stdenv/multiple-output.chapter.md
+++ b/doc/stdenv/multiple-output.chapter.md
@@ -1,7 +1,5 @@
 # Multiple-output packages {#chap-multiple-output}
 
-## Introduction {#sec-multiple-outputs-introduction}
-
 The Nix language allows a derivation to produce multiple outputs, which is similar to what is utilized by other Linux distribution packaging systems. The outputs reside in separate Nix store paths, so they can be mostly handled independently of each other, including passing to build inputs, garbage collection or binary substitution. The exception is that building from source always produces all the outputs.
 
 The main motivation is to save disk space by reducing runtime closure sizes; consequently also sizes of substituted binaries get reduced. Splitting can be used to have more granular runtime dependencies, for example the typical reduction is to split away development-only files, as those are typically not needed during runtime. As a result, closure sizes of many packages can get reduced to a half or even much less.
@@ -10,44 +8,12 @@ The main motivation is to save disk space by reducing runtime closure sizes; con
 The reduction effects could be instead achieved by building the parts in completely separate derivations. That would often additionally reduce build-time closures, but it tends to be much harder to write such derivations, as build systems typically assume all parts are being built at once. This compromise approach of single source package producing multiple binary packages is also utilized often by rpm and deb.
 :::
 
-A number of attributes can be used to work with a derivation with multiple outputs. The attribute `outputs` is a list of strings, which are the names of the outputs. For each of these names, an identically named attribute is created, corresponding to that output. The attribute `meta.outputsToInstall` is used to determine the default set of outputs to install when using the derivation name unqualified.
+A number of attributes can be used to work with a derivation with multiple outputs.
+The attribute `outputs` is a list of strings, which are the names of the outputs.
+For each of these names, an identically named attribute is created, corresponding to that output.
 
-## Installing a split package {#sec-multiple-outputs-installing}
-
-When installing a package with multiple outputs, the package’s `meta.outputsToInstall` attribute determines which outputs are actually installed. `meta.outputsToInstall` is a list whose [default installs binaries and the associated man pages](https://github.com/NixOS/nixpkgs/blob/f1680774340d5443a1409c3421ced84ac1163ba9/pkgs/stdenv/generic/make-derivation.nix#L310-L320). The following sections describe ways to install different outputs.
-
-### Selecting outputs to install via NixOS {#sec-multiple-outputs-installing-nixos}
-
-NixOS provides two ways to select the outputs to install for packages listed in `environment.systemPackages`:
-
-- The configuration option `environment.extraOutputsToInstall` is appended to each package’s `meta.outputsToInstall` attribute to determine the outputs to install. It can for example be used to install `info` documentation or debug symbols for all packages.
-
-- The outputs can be listed as packages in `environment.systemPackages`. For example, the `"out"` and `"info"` outputs for the `coreutils` package can be installed by including `coreutils` and `coreutils.info` in `environment.systemPackages`.
-
-### Selecting outputs to install via `nix-env` {#sec-multiple-outputs-installing-nix-env}
-
-`nix-env` lacks an easy way to select the outputs to install. When installing a package, `nix-env` always installs the outputs listed in `meta.outputsToInstall`, even when the user explicitly selects an output.
-
-::: {.warning}
-`nix-env` silently disregards the outputs selected by the user, and instead installs the outputs from `meta.outputsToInstall`. For example,
-
-```ShellSession
-$ nix-env -iA nixpkgs.coreutils.info
-```
-
-installs the `"out"` output (`coreutils.meta.outputsToInstall` is `[ "out" ]`) instead of the requested `"info"`.
-:::
-
-The only recourse to select an output with `nix-env` is to override the package’s `meta.outputsToInstall`, using the functions described in [](#chap-overrides). For example, the following overlay adds the `"info"` output for the `coreutils` package:
-
-```nix
-self: super:
-{
-  coreutils = super.coreutils.overrideAttrs (oldAttrs: {
-    meta = oldAttrs.meta // { outputsToInstall = oldAttrs.meta.outputsToInstall or [ "out" ] ++ [ "info" ]; };
-  });
-}
-```
+The attribute `meta.outputsToInstall` is used to determine the [default set of outputs to install](https://github.com/NixOS/nixpkgs/blob/08c3198f1c6fd89a09f8f0ea09b425028a34de3e/pkgs/stdenv/generic/check-meta.nix#L411-L426) when using the derivation name unqualified:
+`bin`, or `out`, or the first specified output; as well as `man` if that is specified.
 
 ## Using a split package {#sec-multiple-outputs-using-split-packages}
 
diff --git a/nixos/modules/config/system-path.nix b/nixos/modules/config/system-path.nix
index e8bbeac4f720..222da3e02e86 100644
--- a/nixos/modules/config/system-path.nix
+++ b/nixos/modules/config/system-path.nix
@@ -116,8 +116,14 @@ in
       extraOutputsToInstall = mkOption {
         type = types.listOf types.str;
         default = [ ];
-        example = [ "doc" "info" "devdoc" ];
-        description = lib.mdDoc "List of additional package outputs to be symlinked into {file}`/run/current-system/sw`.";
+        example = [ "dev" "info" ];
+        description = lib.mdDoc ''
+          Entries listed here will be appended to the `meta.outputsToInstall` attribute for each package in `environment.systemPackages`, and the files from the corresponding derivation outputs symlinked into {file}`/run/current-system/sw`.
+
+          For example, this can be used to install the `dev` and `info` outputs for all packages in the system environment, if they are available.
+
+          To use specific outputs instead of configuring them globally, select the corresponding attribute on the package derivation, e.g. `libxml2.dev` or `coreutils.info`.
+        '';
       };
 
       extraSetup = mkOption {

From d822acc538a8b261b9a7e43781a848627b9cf7f0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 25 Sep 2023 14:30:07 +0000
Subject: [PATCH 24/41] amdvlk: 2023.Q3.1 -> 2023.Q3.2

---
 pkgs/development/libraries/amdvlk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/amdvlk/default.nix b/pkgs/development/libraries/amdvlk/default.nix
index efebd3034cda..bbccb9d66a20 100644
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@@ -25,13 +25,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "amdvlk";
-  version = "2023.Q3.1";
+  version = "2023.Q3.2";
 
   src = fetchRepoProject {
     name = "${pname}-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${version}";
-    sha256 = "W+igZbdQG1L62oGJa2Rz0n8YkTsZFqSm7w8VFfPu8k0=";
+    sha256 = "/1D2BbT1gnMLvIHfpkxLkeo1pjbG9LkTx9Zl5+gGU/M=";
   };
 
   buildInputs = [

From 43eecf9c7a7e119fb400e57dfebf86f0345890ea Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 20 Sep 2023 14:26:20 +0300
Subject: [PATCH 25/41] firefox-bin: cleanup, use autoPatchelfHook

---
 .../browsers/firefox-bin/default.nix          | 175 ++++--------------
 1 file changed, 41 insertions(+), 134 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index 31d1ef692065..c3b34bf2b78c 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -1,44 +1,13 @@
-{ lib, stdenv, fetchurl, config, wrapGAppsHook
+{ lib, stdenv, fetchurl, config, wrapGAppsHook, autoPatchelfHook
 , alsa-lib
-, atk
-, cairo
 , curl
-, cups
 , dbus-glib
-, dbus
-, fontconfig
-, freetype
-, gdk-pixbuf
-, glib
-, glibc
 , gtk3
-, libkrb5
-, libX11
-, libXScrnSaver
-, libxcb
-, libXcomposite
-, libXcursor
-, libXdamage
-, libXext
-, libXfixes
-, libXi
-, libXinerama
-, libXrender
-, libXrandr
-, libXt
 , libXtst
-, libcanberra
-, libnotify
-, adwaita-icon-theme
-, libGLU, libGL
-, nspr
-, nss
-, pango
-, pipewire
+, libva
 , pciutils
-, heimdal
-, libpulseaudio
-, systemd
+, pipewire
+, adwaita-icon-theme
 , channel
 , generated
 , writeScript
@@ -48,9 +17,7 @@
 , gnused
 , gnugrep
 , gnupg
-, ffmpeg
 , runtimeShell
-, mesa # firefox wants gbm for drm+dmabuf
 , systemLocale ? config.i18n.defaultLocale or "en_US"
 }:
 
@@ -95,115 +62,54 @@ stdenv.mkDerivation {
 
   src = fetchurl { inherit (source) url sha256; };
 
-  libPath = lib.makeLibraryPath
-    [ stdenv.cc.cc
-      alsa-lib
-      atk
-      cairo
-      curl
-      cups
-      dbus-glib
-      dbus
-      fontconfig
-      freetype
-      gdk-pixbuf
-      glib
-      glibc
-      gtk3
-      libkrb5
-      mesa
-      libX11
-      libXScrnSaver
-      libXcomposite
-      libXcursor
-      libxcb
-      libXdamage
-      libXext
-      libXfixes
-      libXi
-      libXinerama
-      libXrender
-      libXrandr
-      libXt
-      libXtst
-      libcanberra
-      libnotify
-      libGLU libGL
-      nspr
-      nss
-      pango
-      pipewire
-      pciutils
-      heimdal
-      libpulseaudio
-      systemd
-      ffmpeg
-    ] + ":" + lib.makeSearchPathOutput "lib" "lib64" [
-      stdenv.cc.cc
-    ];
-
-  inherit gtk3;
-
-  nativeBuildInputs = [ wrapGAppsHook ];
-  buildInputs = [ gtk3 adwaita-icon-theme ];
-
-  # "strip" after "patchelf" may break binaries.
-  # See: https://github.com/NixOS/patchelf/issues/10
-  dontStrip = true;
-  dontPatchELF = true;
-
-  postPatch = ''
-    # Don't download updates from Mozilla directly
-    echo 'pref("app.update.auto", "false");' >> defaults/pref/channel-prefs.js
-  '';
+  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook ];
+  buildInputs = [
+    gtk3
+    adwaita-icon-theme
+    alsa-lib
+    dbus-glib
+    libXtst
+  ];
+  runtimeDependencies = [
+    curl
+    libva.out
+    pciutils
+  ];
+  appendRunpaths = [
+    "${pipewire.lib}/lib"
+  ];
 
   installPhase =
     ''
-      mkdir -p "$prefix/usr/lib/firefox-bin-${version}"
-      cp -r * "$prefix/usr/lib/firefox-bin-${version}"
+      mkdir -p "$prefix/lib/firefox-bin-${version}"
+      cp -r * "$prefix/lib/firefox-bin-${version}"
 
       mkdir -p "$out/bin"
-      ln -s "$prefix/usr/lib/firefox-bin-${version}/firefox" "$out/bin/"
-
-      for executable in \
-        firefox firefox-bin plugin-container \
-        updater crashreporter webapprt-stub \
-        glxtest vaapitest
-      do
-        if [ -e "$out/usr/lib/firefox-bin-${version}/$executable" ]; then
-          patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-            "$out/usr/lib/firefox-bin-${version}/$executable"
-        fi
-      done
-
-      find . -executable -type f -exec \
-        patchelf --set-rpath "$libPath" \
-          "$out/usr/lib/firefox-bin-${version}/{}" \;
-
-      # wrapFirefox expects "$out/lib" instead of "$out/usr/lib"
-      ln -s "$out/usr/lib" "$out/lib"
-
-      gappsWrapperArgs+=(--argv0 "$out/bin/.firefox-wrapped")
+      ln -s "$prefix/lib/firefox-bin-${version}/firefox" "$out/bin/"
 
       # See: https://github.com/mozilla/policy-templates/blob/master/README.md
       mkdir -p "$out/lib/firefox-bin-${version}/distribution";
       ln -s ${policiesJson} "$out/lib/firefox-bin-${version}/distribution/policies.json";
     '';
 
-  passthru.binaryName = "firefox";
-  passthru.libName = "firefox-bin-${version}";
-  passthru.execdir = "/bin";
-  passthru.ffmpegSupport = true;
-  passthru.gssSupport = true;
-  # update with:
-  # $ nix-shell maintainers/scripts/update.nix --argstr package firefox-bin-unwrapped
-  passthru.updateScript = import ./update.nix {
-    inherit pname channel lib writeScript xidel coreutils gnused gnugrep gnupg curl runtimeShell;
-    baseUrl =
-      if channel == "devedition"
-        then "https://archive.mozilla.org/pub/devedition/releases/"
-        else "https://archive.mozilla.org/pub/firefox/releases/";
+  passthru = {
+    binaryName = "firefox";
+    libName = "firefox-bin-${version}";
+    ffmpegSupport = true;
+    gssSupport = true;
+    gtk3 = gtk3;
+
+    # update with:
+    # $ nix-shell maintainers/scripts/update.nix --argstr package firefox-bin-unwrapped
+    updateScript = import ./update.nix {
+      inherit pname channel lib writeScript xidel coreutils gnused gnugrep gnupg curl runtimeShell;
+      baseUrl =
+        if channel == "devedition"
+          then "https://archive.mozilla.org/pub/devedition/releases/"
+          else "https://archive.mozilla.org/pub/firefox/releases/";
+    };
   };
+
   meta = with lib; {
     changelog = "https://www.mozilla.org/en-US/firefox/${version}/releasenotes/";
     description = "Mozilla Firefox, free web browser (binary package)";
@@ -213,5 +119,6 @@ stdenv.mkDerivation {
     platforms = builtins.attrNames mozillaPlatforms;
     hydraPlatforms = [];
     maintainers = with maintainers; [ taku0 lovesegfault ];
+    mainProgram = "firefox";
   };
 }

From 40483b3bb58e75182cfec66d8e8c24b47f56888d Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 21 Sep 2023 12:42:52 +0300
Subject: [PATCH 26/41] firefox-bin: derive binary name from channel

---
 .../networking/browsers/firefox-bin/default.nix           | 8 +++++---
 pkgs/top-level/all-packages.nix                           | 1 -
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index c3b34bf2b78c..c0624e915acb 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -25,6 +25,8 @@ let
 
   inherit (generated) version sources;
 
+  binaryName = if channel == "release" then "firefox" else "firefox-${channel}";
+
   mozillaPlatforms = {
     i686-linux = "linux-i686";
     x86_64-linux = "linux-x86_64";
@@ -85,7 +87,7 @@ stdenv.mkDerivation {
       cp -r * "$prefix/lib/firefox-bin-${version}"
 
       mkdir -p "$out/bin"
-      ln -s "$prefix/lib/firefox-bin-${version}/firefox" "$out/bin/"
+      ln -s "$prefix/lib/firefox-bin-${version}/firefox" "$out/bin/${binaryName}"
 
       # See: https://github.com/mozilla/policy-templates/blob/master/README.md
       mkdir -p "$out/lib/firefox-bin-${version}/distribution";
@@ -93,7 +95,7 @@ stdenv.mkDerivation {
     '';
 
   passthru = {
-    binaryName = "firefox";
+    inherit binaryName;
     libName = "firefox-bin-${version}";
     ffmpegSupport = true;
     gssSupport = true;
@@ -119,6 +121,6 @@ stdenv.mkDerivation {
     platforms = builtins.attrNames mozillaPlatforms;
     hydraPlatforms = [];
     maintainers = with maintainers; [ taku0 lovesegfault ];
-    mainProgram = "firefox";
+    mainProgram = binaryName;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9cf0a108884c..7fff1f35040a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -32162,7 +32162,6 @@ with pkgs;
   };
 
   firefox-devedition-bin = res.wrapFirefox firefox-devedition-bin-unwrapped {
-    nameSuffix = "-devedition";
     pname = "firefox-devedition-bin";
     desktopName = "Firefox DevEdition";
     wmClass = "firefox-devedition";

From db6eb8f6bbfca56cb56c67880d03452d739e7b7b Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 21 Sep 2023 12:52:06 +0300
Subject: [PATCH 27/41] firefox-*-bin: fix branding and wmClass config to match
 upstream

---
 pkgs/top-level/all-packages.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7fff1f35040a..12c69ff4269f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -32152,19 +32152,18 @@ with pkgs;
   firefox-beta-bin = res.wrapFirefox firefox-beta-bin-unwrapped {
     pname = "firefox-beta-bin";
     desktopName = "Firefox Beta";
-    wmClass = "firefox-beta";
   };
 
   firefox-devedition-bin-unwrapped = callPackage ../applications/networking/browsers/firefox-bin {
     inherit (gnome) adwaita-icon-theme;
-    channel = "devedition";
+    channel = "developer-edition";
     generated = import ../applications/networking/browsers/firefox-bin/devedition_sources.nix;
   };
 
   firefox-devedition-bin = res.wrapFirefox firefox-devedition-bin-unwrapped {
     pname = "firefox-devedition-bin";
     desktopName = "Firefox DevEdition";
-    wmClass = "firefox-devedition";
+    wmClass = "firefox-aurora";
   };
 
   librewolf-unwrapped = callPackage ../applications/networking/browsers/librewolf { };

From eb83e438cb775c9cc5417becb73ab1ec28c7353d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <fabian@affolter-engineering.ch>
Date: Mon, 25 Sep 2023 04:57:56 +0200
Subject: [PATCH 28/41] python311Packages.aiocomelit: 0.0.6 -> 0.0.8 (#256641)

https://github.com/chemelli74/aiocomelit/compare/refs/tags/v0.0.6...v0.0.8

https://github.com/chemelli74/aiocomelit/blob/0.0.7/CHANGELOG.md
https://github.com/chemelli74/aiocomelit/blob/0.0.8/CHANGELOG.md
---
 pkgs/development/python-modules/aiocomelit/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiocomelit/default.nix b/pkgs/development/python-modules/aiocomelit/default.nix
index dd572da52210..2415048c9329 100644
--- a/pkgs/development/python-modules/aiocomelit/default.nix
+++ b/pkgs/development/python-modules/aiocomelit/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aiocomelit";
-  version = "0.0.6";
+  version = "0.0.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "chemelli74";
     repo = "aiocomelit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-u6CyqDFLgnIVak0UqN4JmL8ll/li3k9EhFs7iC5oZ9U=";
+    hash = "sha256-lPwkTWkzXe5c5+KJkLHr7/cydtnDOFGniNNeOk2UXdA=";
   };
 
   postPatch = ''

From b1f5f4fc2d43286ba2065b054bb7f39344e0f6a2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 Sep 2023 05:00:02 +0200
Subject: [PATCH 29/41] python311Packages.bellows: 0.36.3 -> 0.36.4

https://github.com/zigpy/bellows/releases/tag/0.36.4
---
 pkgs/development/python-modules/bellows/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index effdf9d010f8..5d791dc1a1bb 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.36.3";
+  version = "0.36.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "bellows";
     rev = "refs/tags/${version}";
-    hash = "sha256-5s2I24gvHRXHm7ZTNZxc6ge9Kbe6UObcY29SvbIUWJg=";
+    hash = "sha256-iouGT3ZqCFW34ududrtCHL/NmKgB9SznLA8p313B12Y=";
   };
 
   propagatedBuildInputs = [

From a1309c4fca6ec351a08d97a8e3617783652f2d5b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 23 Sep 2023 01:14:27 +0200
Subject: [PATCH 30/41] home-assistant.intents: 2023.8.2 -> 2023.9.22

https://github.com/home-assistant/intents/releases/tag/2023.9.22
---
 pkgs/servers/home-assistant/intents.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/intents.nix b/pkgs/servers/home-assistant/intents.nix
index 0d4caaea8b39..6d894aa0c9be 100644
--- a/pkgs/servers/home-assistant/intents.nix
+++ b/pkgs/servers/home-assistant/intents.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-intents";
-  version = "2023.8.2";
+  version = "2023.9.22";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "home-assistant";
     repo = "intents-package";
     rev = "refs/tags/${version}";
-    hash = "sha256-pNLH3GGfY8upKi7uYGZ466cIQkpdA16tR1tjwuiQ3JI=";
+    hash = "sha256-n0IIWS5edh4XD/W9Eo88pal2+zJQtrHg74FSGvPIlPg=";
     fetchSubmodules = true;
   };
 

From e18fc99f3ebba713dbbbd92e4a67cdeb290b0daa Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 Sep 2023 14:06:57 +0200
Subject: [PATCH 31/41] python3Packages.python-roborock: 0.33.2 -> 0.34.0

https://github.com/humbertogontijo/python-roborock/releases/tag/v0.34.0
---
 .../python-modules/python-roborock/default.nix           | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index a8e019ce88b7..037fc14b1c75 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "python-roborock";
-  version = "0.33.2";
+  version = "0.34.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -29,9 +29,14 @@ buildPythonPackage rec {
     owner = "humbertogontijo";
     repo = "python-roborock";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UAQlKfh6oljeWtEGYx7JiT1z9yFCAXRSlI4Ot6JUnoQ=";
+    hash = "sha256-WLnMc2UQyjHaHRms6SEdF/TSum3Cf5NC3SGXHtGj6d0=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "poetry-core==1.6.1" "poetry-core"
+  '';
+
   pythonRelaxDeps = [
     "pycryptodome"
   ];

From c8d30eac2e5b3f8da8ca8073e351b569a35e045a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 Sep 2023 05:15:43 +0200
Subject: [PATCH 32/41] python311Packages.universal-silabs-flasher: 0.0.13 ->
 0.0.14

https://github.com/NabuCasa/universal-silabs-flasher/compare/v0.0.13...v0.0.14
---
 .../python-modules/universal-silabs-flasher/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/universal-silabs-flasher/default.nix b/pkgs/development/python-modules/universal-silabs-flasher/default.nix
index 348fa01ffbe1..420b9f078c15 100644
--- a/pkgs/development/python-modules/universal-silabs-flasher/default.nix
+++ b/pkgs/development/python-modules/universal-silabs-flasher/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "universal-silabs-flasher";
-  version = "0.0.13";
+  version = "0.0.14";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "NabuCasa";
     repo = "universal-silabs-flasher";
     rev = "v${version}";
-    hash = "sha256-qiaDPCnVb6JQ2fZRFK+QF4o8K2UbIWGNKl5oo6MQUW0=";
+    hash = "sha256-0c9b571gJXFOAe5ct8O/qy7D6rDosmBHDYEv6odLQ2s=";
   };
 
   nativeBuildInputs = [

From 0f6c2c9ca2c9ce77b35a7915d2a05f9b05fe94a3 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 Sep 2023 05:16:52 +0200
Subject: [PATCH 33/41] python311Packages.zwave-js-server-python: 0.51.2 ->
 0.51.3

https://github.com/home-assistant-libs/zwave-js-server-python/releases/tag/0.51.3
---
 .../python-modules/zwave-js-server-python/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zwave-js-server-python/default.nix b/pkgs/development/python-modules/zwave-js-server-python/default.nix
index 7e98b142b44f..754da83efc3a 100644
--- a/pkgs/development/python-modules/zwave-js-server-python/default.nix
+++ b/pkgs/development/python-modules/zwave-js-server-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "zwave-js-server-python";
-  version = "0.51.2";
+  version = "0.51.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.11";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-SRBH7HdsgS60Z8y6ef5/VCunzMGBEWw0u1jR7wSByNc=";
+    hash = "sha256-79INvk5WLuSki/kBU25hMHRxGk7FAznU89U+y3Eh+wI=";
   };
 
   propagatedBuildInputs = [

From 2553e158531eb1f1b2d377df602dc986f09e2acc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 Sep 2023 05:17:21 +0200
Subject: [PATCH 34/41] home-assistant: 2023.9.2 -> 2023.9.3

https://github.com/home-assistant/core/releases/tag/2023.9.3
---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 pkgs/servers/home-assistant/default.nix            | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 88678c2cc96e..da8c4d4c36f1 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.9.2";
+  version = "2023.9.3";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index f6bb043f1984..3d7ea12691b1 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -316,7 +316,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.9.2";
+  hassVersion = "2023.9.3";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -332,7 +332,7 @@ in python.pkgs.buildPythonApplication rec {
   # Primary source is the pypi sdist, because it contains translations
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pVW9NQYEf2pmGCp342lCzEiWfAyFCiWeRMVbhPd8wxQ=";
+    hash = "sha256-tcIGYJ+r2+0jnf3xUxnFdwnLiOK9P0Y6sw0Mpd/YIT0=";
   };
 
   # Secondary source is git for tests
@@ -340,7 +340,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-4sZBrGd5gz4W7c7Ok5Bj/47MaXAqAFC4qufcidbU5zA=";
+    hash = "sha256-zAUMevj2xvRkhZg4wuHDz0+X//cEU/D/HmokmX9oeCU=";
   };
 
   nativeBuildInputs = with python.pkgs; [

From 11df0ab9917584433eeca6a611e835b03883c659 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 Sep 2023 06:07:26 +0200
Subject: [PATCH 35/41] python311Packages.homeassistant-stubs: 2023.9.2 ->
 2023.9.3

https://github.com/KapJI/homeassistant-stubs/releases/tag/2023.9.3
---
 pkgs/servers/home-assistant/stubs.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index c87e59034937..af923462a0a6 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2023.9.2";
+  version = "2023.9.3";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-cKBf7S6ZvLlRp0L23mDu1CvG7d1d34LaIev60JPD0TE=";
+    hash = "sha256-dZOpfSfq47sGJJB6CvcBDlSLBG8EVAX8RMuNzbP7bTs=";
   };
 
   nativeBuildInputs = [

From 05e4efecc2f2ce874f7219c6c315f7cb7483a1c0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 Sep 2023 06:09:46 +0200
Subject: [PATCH 36/41] python311Packages.aioesphomeapi: 16.0.5 -> 16.0.6

https://github.com/esphome/aioesphomeapi/releases/tag/v16.0.6
---
 pkgs/development/python-modules/aioesphomeapi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index f0a310b7a14c..271021fe0a4d 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "16.0.5";
+  version = "16.0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-SueK59CZTKkQPsHThs7k9eCEmc1GwaRIrw3oSK4E80E=";
+    hash = "sha256-BcFNxm4JpHaqKEhUTCXIrF18OMFxLbQHCQ9jfs+U0hc=";
   };
 
   propagatedBuildInputs = [

From fe537ec5aad0b9ba719f87a0632c3002bd5dd5dc Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Mon, 25 Sep 2023 17:35:21 +0200
Subject: [PATCH 37/41] libmongocrypt: fix build on x86_64-darwin

---
 pkgs/development/libraries/libmongocrypt/default.nix | 2 +-
 pkgs/top-level/all-packages.nix                      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libmongocrypt/default.nix b/pkgs/development/libraries/libmongocrypt/default.nix
index d2d22f4cf8c1..f45d41fed628 100644
--- a/pkgs/development/libraries/libmongocrypt/default.nix
+++ b/pkgs/development/libraries/libmongocrypt/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     mongoc
     openssl
   ] ++ lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk_11_0.frameworks.Security
   ];
 
   cmakeFlags = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 57e94596b541..17a9af01cb65 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10479,7 +10479,7 @@ with pkgs;
 
   libmbim = callPackage ../development/libraries/libmbim { };
 
-  libmongocrypt = callPackage ../development/libraries/libmongocrypt { };
+  libmongocrypt = darwin.apple_sdk_11_0.callPackage ../development/libraries/libmongocrypt { };
 
   libmesode = callPackage ../development/libraries/libmesode { };
 

From ad69bc581b2e3c90dc397ddfc1df7369c19e2ba6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 24 Sep 2023 21:31:32 +0000
Subject: [PATCH 38/41] tlp: 1.6.0 -> 1.6.1

---
 pkgs/tools/misc/tlp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/tlp/default.nix b/pkgs/tools/misc/tlp/default.nix
index 023028879245..51f10640ccbb 100644
--- a/pkgs/tools/misc/tlp/default.nix
+++ b/pkgs/tools/misc/tlp/default.nix
@@ -24,13 +24,13 @@
 , networkmanager
 }: stdenv.mkDerivation rec {
   pname = "tlp";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "linrunner";
     repo = "TLP";
     rev = version;
-    hash = "sha256-XAyko2MxFyo5RyioaexhoFAR3E+I3t/8vD2K3WYNmsI=";
+    hash = "sha256-CxO1KU7F6sT5D8vjKOmntjDxcieoRSHTvuSqXfplcHk=";
   };
 
   # XXX: See patch files for relevant explanations.

From 938bfe28acdd5dd6fa8706d7860a7caf8dad9eb4 Mon Sep 17 00:00:00 2001
From: Jennifer Graul <jennifer.graul@wobcom.de>
Date: Mon, 25 Sep 2023 13:03:43 +0200
Subject: [PATCH 39/41] phpExtensions.rrd: init at 2.0.3

Co-authored-by: Ember Keske <git@n0emis.eu>
---
 pkgs/development/php-packages/rrd/default.nix | 17 +++++++++++++++++
 pkgs/top-level/php-packages.nix               |  2 ++
 2 files changed, 19 insertions(+)
 create mode 100644 pkgs/development/php-packages/rrd/default.nix

diff --git a/pkgs/development/php-packages/rrd/default.nix b/pkgs/development/php-packages/rrd/default.nix
new file mode 100644
index 000000000000..a89f9a3b71b1
--- /dev/null
+++ b/pkgs/development/php-packages/rrd/default.nix
@@ -0,0 +1,17 @@
+{ buildPecl, lib, pkg-config, rrdtool }:
+
+buildPecl {
+  pname = "rrd";
+
+  version = "2.0.3";
+  hash = "sha256-pCFh5YzcioU7cs/ymJidy96CsPdkVt1ZzgKFTJK3MPc=";
+
+  nativeBuildInputs = [ pkg-config rrdtool ];
+
+  meta = {
+    description = "PHP bindings to RRD tool system";
+    license = lib.licenses.bsd0;
+    homepage = "https://github.com/php/pecl-processing-rrd";
+    maintainers = lib.teams.wdz.members;
+  };
+}
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index aad260fc3c00..e1f62aa37313 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -312,6 +312,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
     relay = callPackage ../development/php-packages/relay { inherit php; };
 
+    rrd = callPackage ../development/php-packages/rrd { };
+
     smbclient = callPackage ../development/php-packages/smbclient { };
 
     snuffleupagus = callPackage ../development/php-packages/snuffleupagus {

From 5d20a2b99a586c6611b30b12a684df96f8f95c1c Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Mon, 25 Sep 2023 14:52:33 +0200
Subject: [PATCH 40/41] buildPecl: pass hash attr to fetchurl

---
 pkgs/build-support/php/build-pecl.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/php/build-pecl.nix b/pkgs/build-support/php/build-pecl.nix
index 389447e066fa..6f38a668f3a3 100644
--- a/pkgs/build-support/php/build-pecl.nix
+++ b/pkgs/build-support/php/build-pecl.nix
@@ -8,10 +8,9 @@
 , nativeBuildInputs ? [ ]
 , postPhpize ? ""
 , makeFlags ? [ ]
-, src ? fetchurl {
+, src ? fetchurl ({
     url = "https://pecl.php.net/get/${pname}-${version}.tgz";
-    inherit (args) sha256;
-  }
+  } // lib.filterAttrs (attrName: _: lib.elem attrName [ "sha256" "hash" ]) args)
 , passthru ? { }
 , ...
 }@args:

From 99eb0f3469482c7a26b925e96d2a47914731193e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 25 Sep 2023 13:03:54 +0000
Subject: [PATCH 41/41] python310Packages.uproot: 5.0.11 -> 5.0.12

---
 pkgs/development/python-modules/uproot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index 1e5de05abe49..a906ce2d76f9 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "5.0.11";
+  version = "5.0.12";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = "uproot5";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qp1iffElJSAwqaycelnILBzeW8kG7Yy0R1bjMumW8UU=";
+    hash = "sha256-5RJPRrnPRRj1KXeyCqrGwaurXPx0aT6gso1o7gQ1aNs=";
   };
 
   nativeBuildInputs = [