Merge master into haskell-updates

lib/tests/modules.sh

@@ -63,6 +63,16 @@ checkConfigOutput '^"one two"$' config.result ./shorthand-meta.nix
 
 checkConfigOutput '^true$' config.result ./test-mergeAttrDefinitionsWithPrio.nix
 
+# types.pathInStore
+checkConfigOutput '".*/store/5lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv"' config.pathInStore.ok1 ./types.nix
+checkConfigOutput '".*/store/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15"' config.pathInStore.ok2 ./types.nix
+checkConfigOutput '".*/store/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash"' config.pathInStore.ok3 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ""' config.pathInStore.bad1 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store"' config.pathInStore.bad2 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store/"' config.pathInStore.bad3 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store/.links"' config.pathInStore.bad4 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: "/foo/bar"' config.pathInStore.bad5 ./types.nix
+
 # Check boolean option.
 checkConfigOutput '^false$' config.enable ./declare-enable.nix
 checkConfigError 'The option .* does not exist. Definition values:\n\s*- In .*: true' config.enable ./define-enable.nix

lib/tests/modules/types.nix

@@ -0,0 +1,24 @@
+{ lib, ... }:
+let
+  inherit (builtins)
+    storeDir;
+  inherit (lib)
+    types
+    mkOption
+    ;
+in
+{
+  options = {
+    pathInStore = mkOption { type = types.lazyAttrsOf types.pathInStore; };
+  };
+  config = {
+    pathInStore.ok1 = "${storeDir}/5lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv";
+    pathInStore.ok2 = "${storeDir}/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15";
+    pathInStore.ok3 = "${storeDir}/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash";
+    pathInStore.bad1 = "";
+    pathInStore.bad2 = "${storeDir}";
+    pathInStore.bad3 = "${storeDir}/";
+    pathInStore.bad4 = "${storeDir}/.links"; # technically true, but not reasonable
+    pathInStore.bad5 = "/foo/bar";
+  };
+}

lib/tests/release.nix

@@ -38,9 +38,6 @@ let
       export PAGER=cat
       cacheDir=$TEST_ROOT/binary-cache
 
-      mkdir -p $NIX_CONF_DIR
-      echo "experimental-features = nix-command" >> $NIX_CONF_DIR/nix.conf
-
       nix-store --init
 
       cp -r ${../.} lib

lib/types.nix

@@ -461,6 +461,7 @@ rec {
     # - strings with context, e.g. "${pkgs.foo}" or (toString pkgs.foo)
     # - hardcoded store path literals (/nix/store/hash-foo) or strings without context
     #   ("/nix/store/hash-foo"). These get a context added to them using builtins.storePath.
+    # If you don't need a *top-level* store path, consider using pathInStore instead.
     package = mkOptionType {
       name = "package";
       descriptionClass = "noun";
@@ -491,6 +492,14 @@ rec {
       merge = mergeEqualOption;
     };
 
+    pathInStore = mkOptionType {
+      name = "pathInStore";
+      description = "path in the Nix store";
+      descriptionClass = "noun";
+      check = x: isStringLike x && builtins.match "${builtins.storeDir}/[^.].*" (toString x) != null;
+      merge = mergeEqualOption;
+    };
+
     listOf = elemType: mkOptionType rec {
       name = "listOf";
       description = "list of ${optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType}";

maintainers/maintainer-list.nix

@@ -1439,6 +1439,12 @@
     githubId = 453170;
     name = "Alastair Pharo";
   };
+  astavie = {
+    email = "astavie@pm.me";
+    github = "astavie";
+    githubId = 7745457;
+    name = "Astavie";
+  };
   astro = {
     email = "astro@spaceboyz.net";
     github = "astro";
@@ -4216,6 +4222,14 @@
     githubId = 39825;
     name = "Dominik Honnef";
   };
+  donovanglover = {
+    github = "donovanglover";
+    githubId = 2374245;
+    name = "Donovan Glover";
+    keys = [{
+      fingerprint = "EE7D 158E F9E7 660E 0C33  86B2 8FC5 F7D9 0A5D 8F4D";
+    }];
+  };
   doriath = {
     email = "tomasz.zurkowski@gmail.com";
     github = "doriath";
@@ -10585,6 +10599,12 @@
     githubId = 1699466;
     name = "Michael Peyton Jones";
   };
+  michaelshmitty = {
+    name = "Michael Smith";
+    email = "shmitty@protonmail.com";
+    github = "michaelshmitty";
+    githubId = 114845;
+  };
   michalrus = {
     email = "m@michalrus.com";
     github = "michalrus";
@@ -16689,6 +16709,12 @@
     githubId = 9413924;
     name = "Thorsten Weber";
   };
+  twesterhout = {
+    name = "Tom Westerhout";
+    matrix = "@twesterhout:matrix.org";
+    github = "twesterhout";
+    githubId = 14264576;
+  };
   twey = {
     email = "twey@twey.co.uk";
     github = "Twey";

maintainers/scripts/check-hydra-by-maintainer.nix

@@ -1,15 +1,18 @@
 { maintainer }:
 let
-  pkgs = import ./../../default.nix { };
+  pkgs = import ./../../default.nix {
+    config.allowAliases = false;
+  };
+  inherit (pkgs) lib;
   maintainer_ = pkgs.lib.maintainers.${maintainer};
   packagesWith = cond: return: prefix: set:
-    (pkgs.lib.flatten
+    (lib.flatten
-      (pkgs.lib.mapAttrsToList
+      (lib.mapAttrsToList
         (name: pkg:
           let
             result = builtins.tryEval
               (
-                if pkgs.lib.isDerivation pkg && cond name pkg then
+                if lib.isDerivation pkg && cond name pkg then
                 # Skip packages whose closure fails on evaluation.
                 # This happens for pkgs like `python27Packages.djangoql`
                 # that have disabled Python pkgs as dependencies.
@@ -42,7 +45,7 @@ let
       )
     )
     (name: name)
-    ("")
+    ""
     pkgs;
 
 in

nixos/doc/manual/development/option-types.section.md

@@ -20,6 +20,11 @@ merging is handled.
     coerced to a string. Even if derivations can be considered as
     paths, the more specific `types.package` should be preferred.
 
+`types.pathInStore`
+
+:   A path that is contained in the Nix store. This can be a top-level store
+    path like `pkgs.hello` or a descendant like `"${pkgs.hello}/bin/hello"`.
+
 `types.package`
 
 :   A top-level store path. This can be an attribute set pointing

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -16,12 +16,16 @@
 
 - [GoToSocial](https://gotosocial.org/), an ActivityPub social network server, written in Golang. Available as [services.gotosocial](#opt-services.gotosocial.enable).
 
+- [Anuko Time Tracker](https://github.com/anuko/timetracker), a simple, easy to use, open source time tracking system. Available as [services.anuko-time-tracker](#opt-services.anuko-time-tracker.enable).
+
 - [sitespeed-io](https://sitespeed.io), a tool that can generate metrics (timings, diagnostics) for websites. Available as [services.sitespeed-io](#opt-services.sitespeed-io.enable).
 
 - [Apache Guacamole](https://guacamole.apache.org/), a cross-platform, clientless remote desktop gateway. Available as [services.guacamole-server](#opt-services.guacamole-server.enable) and [services.guacamole-client](#opt-services.guacamole-client.enable) services.
 
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
 
+- `python3.pkgs.sequoia` was removed in favor of `python3.pkgs.pysequoia`. The latter package is based on upstream's dedicated repository for sequoia's Python bindings, where the Python bindings from [gitlab:sequoia-pgp/sequoia](https://gitlab.com/sequoia-pgp/sequoia) were removed long ago.
+
 - `writeTextFile` now requires `executable` to be boolean, values like `null` or `""` will now fail to evaluate.
 
 - The latest version of `clonehero` now stores custom content in `~/.clonehero`. See the [migration instructions](https://clonehero.net/2022/11/29/v23-to-v1-migration-instructions.html). Typically, these content files would exist along side the binary, but the previous build used a wrapper script that would store them in `~/.config/unity3d/srylain Inc_/Clone Hero`.

nixos/modules/module-list.nix

@@ -1013,6 +1013,7 @@
   ./services/networking/shorewall.nix
   ./services/networking/shorewall6.nix
   ./services/networking/shout.nix
+  ./services/networking/sing-box.nix
   ./services/networking/sitespeed-io.nix
   ./services/networking/skydns.nix
   ./services/networking/smartdns.nix
@@ -1168,6 +1169,7 @@
   ./services/wayland/cage.nix
   ./services/web-apps/akkoma.nix
   ./services/web-apps/alps.nix
+  ./services/web-apps/anuko-time-tracker.nix
   ./services/web-apps/atlassian/confluence.nix
   ./services/web-apps/atlassian/crowd.nix
   ./services/web-apps/atlassian/jira.nix

nixos/modules/programs/shadow.nix

@@ -1,67 +1,131 @@
 # Configuration for the pwdutils suite of tools: passwd, useradd, etc.
-
 { config, lib, utils, pkgs, ... }:
-
 with lib;
-
 let
+  cfg = config.security.loginDefs;
+in
+{
+  options = with types; {
+    security.loginDefs = {
+      package = mkPackageOptionMD pkgs "shadow" { };
 
-  /*
+      chfnRestrict = mkOption {
-  There are three different sources for user/group id ranges, each of which gets
+        description = mdDoc ''
-  used by different programs:
+          Use chfn SUID to allow non-root users to change their account GECOS information.
-  - The login.defs file, used by the useradd, groupadd and newusers commands
+        '';
-  - The update-users-groups.pl file, used by NixOS in the activation phase to
+        type = nullOr str;
-    decide on which ids to use for declaratively defined users without a static
+        default = null;
-    id
+      };
-  - Systemd compile time options -Dsystem-uid-max= and -Dsystem-gid-max=, used
-    by systemd for features like ConditionUser=@system and systemd-sysusers
-  */
-  loginDefs =
-    ''
-      DEFAULT_HOME yes
 
-      SYS_UID_MIN  400
+      settings = mkOption {
-      SYS_UID_MAX  999
+        description = mdDoc ''
-      UID_MIN      1000
+          Config options for the /etc/login.defs file, that defines
-      UID_MAX      29999
+          the site-specific configuration for the shadow password suite.
+          See login.defs(5) man page for available options.
+        '';
+        type = submodule {
+          freeformType = (pkgs.formats.keyValue { }).type;
+          /* There are three different sources for user/group id ranges, each of which gets
+             used by different programs:
+             - The login.defs file, used by the useradd, groupadd and newusers commands
+             - The update-users-groups.pl file, used by NixOS in the activation phase to
+               decide on which ids to use for declaratively defined users without a static
+               id
+             - Systemd compile time options -Dsystem-uid-max= and -Dsystem-gid-max=, used
+               by systemd for features like ConditionUser=@system and systemd-sysusers
+              */
+          options = {
+            DEFAULT_HOME = mkOption {
+              description = mdDoc "Indicate if login is allowed if we can't cd to the home directory.";
+              default = "yes";
+              type = enum [ "yes" "no" ];
+            };
 
-      SYS_GID_MIN  400
+            ENCRYPT_METHOD = mkOption {
-      SYS_GID_MAX  999
+              description = mdDoc "This defines the system default encryption algorithm for encrypting passwords.";
-      GID_MIN      1000
+              # The default crypt() method, keep in sync with the PAM default
-      GID_MAX      29999
+              default = "YESCRYPT";
+              type = enum [ "YESCRYPT" "SHA512" "SHA256" "MD5" "DES"];
+            };
 
-      TTYGROUP     tty
+            SYS_UID_MIN = mkOption {
-      TTYPERM      0620
+              description = mdDoc "Range of user IDs used for the creation of system users by useradd or newusers.";
+              default = 400;
+              type = int;
+            };
 
-      # Ensure privacy for newly created home directories.
+            SYS_UID_MAX = mkOption {
-      UMASK        077
+              description = mdDoc "Range of user IDs used for the creation of system users by useradd or newusers.";
+              default = 999;
+              type = int;
+            };
 
-      # Uncomment this and install chfn SUID to allow non-root
+            UID_MIN = mkOption {
-      # users to change their account GECOS information.
+              description = mdDoc "Range of user IDs used for the creation of regular users by useradd or newusers.";
-      # This should be made configurable.
+              default = 1000;
-      #CHFN_RESTRICT frwh
+              type = int;
+            };
 
-      # The default crypt() method, keep in sync with the PAM default
+            UID_MAX = mkOption {
-      ENCRYPT_METHOD YESCRYPT
+              description = mdDoc "Range of user IDs used for the creation of regular users by useradd or newusers.";
-    '';
+              default = 29999;
+              type = int;
+            };
 
-  mkSetuidRoot = source:
+            SYS_GID_MIN = mkOption {
-    { setuid = true;
+              description = mdDoc "Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers";
-      owner = "root";
+              default = 400;
-      group = "root";
+              type = int;
-      inherit source;
+            };
+
+            SYS_GID_MAX = mkOption {
+              description = mdDoc "Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers";
+              default = 999;
+              type = int;
+            };
+
+            GID_MIN = mkOption {
+              description = mdDoc "Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.";
+              default = 1000;
+              type = int;
+            };
+
+            GID_MAX = mkOption {
+              description = mdDoc "Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.";
+              default = 29999;
+              type = int;
+            };
+
+            TTYGROUP = mkOption {
+              description = mdDoc ''
+                The terminal permissions: the login tty will be owned by the TTYGROUP group,
+                and the permissions will be set to TTYPERM'';
+              default = "tty";
+              type = str;
+            };
+
+            TTYPERM = mkOption {
+              description = mdDoc ''
+                The terminal permissions: the login tty will be owned by the TTYGROUP group,
+                and the permissions will be set to TTYPERM'';
+              default = "0620";
+              type = str;
+            };
+
+            # Ensure privacy for newly created home directories.
+            UMASK = mkOption {
+              description = mdDoc "The file mode creation mask is initialized to this value.";
+              default = "077";
+              type = str;
+            };
+          };
+        };
+        default = { };
+      };
     };
 
-in
+    users.defaultUserShell = mkOption {
-
+      description = mdDoc ''
-{
-
-  ###### interface
-
-  options = {
-
-    users.defaultUserShell = lib.mkOption {
-      description = lib.mdDoc ''
         This option defines the default shell assigned to user
         accounts. This can be either a full system path or a shell package.
 
@@ -69,63 +133,107 @@ in
         used outside the store (in particular in /etc/passwd).
       '';
       example = literalExpression "pkgs.zsh";
-      type = types.either types.path types.shellPackage;
+      type = either path shellPackage;
     };
-
   };
 
-
   ###### implementation
 
   config = {
+    assertions = [
+      {
+        assertion = cfg.settings.SYS_UID_MIN <= cfg.settings.SYS_UID_MAX;
+        message = "SYS_UID_MIN must be less than or equal to SYS_UID_MAX";
+      }
+      {
+        assertion = cfg.settings.UID_MIN <= cfg.settings.UID_MAX;
+        message = "UID_MIN must be less than or equal to UID_MAX";
+      }
+      {
+        assertion = cfg.settings.SYS_GID_MIN <= cfg.settings.SYS_GID_MAX;
+        message = "SYS_GID_MIN must be less than or equal to SYS_GID_MAX";
+      }
+      {
+        assertion = cfg.settings.GID_MIN <= cfg.settings.GID_MAX;
+        message = "GID_MIN must be less than or equal to GID_MAX";
+      }
+    ];
 
-    environment.systemPackages =
+    security.loginDefs.settings.CHFN_RESTRICT =
-      lib.optional config.users.mutableUsers pkgs.shadow ++
+      mkIf (cfg.chfnRestrict != null) cfg.chfnRestrict;
-      lib.optional (types.shellPackage.check config.users.defaultUserShell)
+
-        config.users.defaultUserShell;
+    environment.systemPackages = optional config.users.mutableUsers cfg.package
+      ++ optional (types.shellPackage.check config.users.defaultUserShell) config.users.defaultUserShell
+      ++ optional (cfg.chfnRestrict != null) pkgs.util-linux;
 
     environment.etc =
-      { # /etc/login.defs: global configuration for pwdutils.  You
+      # Create custom toKeyValue generator
-        # cannot login without it!
+      # see https://man7.org/linux/man-pages/man5/login.defs.5.html for config specification
-        "login.defs".source = pkgs.writeText "login.defs" loginDefs;
+      let
+        toKeyValue = generators.toKeyValue {
+          mkKeyValue = generators.mkKeyValueDefault { } " ";
+        };
+      in
+      {
+        # /etc/login.defs: global configuration for pwdutils.
+        # You cannot login without it!
+        "login.defs".source = pkgs.writeText "login.defs" (toKeyValue cfg.settings);
 
         # /etc/default/useradd: configuration for useradd.
-        "default/useradd".source = pkgs.writeText "useradd"
+        "default/useradd".source = pkgs.writeText "useradd" ''
-          ''
+          GROUP=100
-            GROUP=100
+          HOME=/home
-            HOME=/home
+          SHELL=${utils.toShellPath config.users.defaultUserShell}
-            SHELL=${utils.toShellPath config.users.defaultUserShell}
+        '';
-          '';
       };
 
-    security.pam.services =
+    security.pam.services = {
-      { chsh = { rootOK = true; };
+      chsh = { rootOK = true; };
-        chfn = { rootOK = true; };
+      chfn = { rootOK = true; };
-        su = { rootOK = true; forwardXAuth = true; logFailures = true; };
+      su = {
-        passwd = {};
+        rootOK = true;
-        # Note: useradd, groupadd etc. aren't setuid root, so it
+        forwardXAuth = true;
-        # doesn't really matter what the PAM config says as long as it
+        logFailures = true;
-        # lets root in.
-        useradd = { rootOK = true; };
-        usermod = { rootOK = true; };
-        userdel = { rootOK = true; };
-        groupadd = { rootOK = true; };
-        groupmod = { rootOK = true; };
-        groupmems = { rootOK = true; };
-        groupdel = { rootOK = true; };
-        login = { startSession = true; allowNullPassword = true; showMotd = true; updateWtmp = true; };
-        chpasswd = { rootOK = true; };
       };
-
+      passwd = { };
-    security.wrappers = {
+      # Note: useradd, groupadd etc. aren't setuid root, so it
-      su        = mkSetuidRoot "${pkgs.shadow.su}/bin/su";
+      # doesn't really matter what the PAM config says as long as it
-      sg        = mkSetuidRoot "${pkgs.shadow.out}/bin/sg";
+      # lets root in.
-      newgrp    = mkSetuidRoot "${pkgs.shadow.out}/bin/newgrp";
+      useradd.rootOK = true;
-      newuidmap = mkSetuidRoot "${pkgs.shadow.out}/bin/newuidmap";
+      usermod.rootOK = true;
-      newgidmap = mkSetuidRoot "${pkgs.shadow.out}/bin/newgidmap";
+      userdel.rootOK = true;
-    } // lib.optionalAttrs config.users.mutableUsers {
+      groupadd.rootOK = true;
-      chsh   = mkSetuidRoot "${pkgs.shadow.out}/bin/chsh";
+      groupmod.rootOK = true;
-      passwd = mkSetuidRoot "${pkgs.shadow.out}/bin/passwd";
+      groupmems.rootOK = true;
+      groupdel.rootOK = true;
+      login = {
+        startSession = true;
+        allowNullPassword = true;
+        showMotd = true;
+        updateWtmp = true;
+      };
+      chpasswd = { rootOK = true; };
     };
+
+    security.wrappers =
+      let
+        mkSetuidRoot = source: {
+          setuid = true;
+          owner = "root";
+          group = "root";
+          inherit source;
+        };
+      in
+      {
+        su = mkSetuidRoot "${cfg.package.su}/bin/su";
+        sg = mkSetuidRoot "${cfg.package.out}/bin/sg";
+        newgrp = mkSetuidRoot "${cfg.package.out}/bin/newgrp";
+        newuidmap = mkSetuidRoot "${cfg.package.out}/bin/newuidmap";
+        newgidmap = mkSetuidRoot "${cfg.package.out}/bin/newgidmap";
+      }
+      // optionalAttrs config.users.mutableUsers {
+        chsh = mkSetuidRoot "${cfg.package.out}/bin/chsh";
+        passwd = mkSetuidRoot "${cfg.package.out}/bin/passwd";
+      };
   };
 }

nixos/modules/services/hardware/udev.nix

@@ -72,7 +72,7 @@ let
           --replace \"/sbin/blkid \"${pkgs.util-linux}/sbin/blkid \
           --replace \"/bin/mount \"${pkgs.util-linux}/bin/mount \
           --replace /usr/bin/readlink ${pkgs.coreutils}/bin/readlink \
-          --replace /usr/bin/basename ${pkgs.coreutils}/bin/basename
+          --replace /usr/bin/basename ${pkgs.coreutils}/bin/basename 2>/dev/null
       ${optionalString (initrdBin != null) ''
         substituteInPlace $i --replace '/run/current-system/systemd' "${removeSuffix "/bin" initrdBin}"
       ''}

nixos/modules/services/misc/gitlab.nix

@@ -1281,6 +1281,7 @@ in {
       "d ${gitlabConfig.production.shared.path}/pages 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/registry 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/terraform_state 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/ci_secure_files 0750 ${cfg.user} ${cfg.group} -"
       "L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
       "L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
       "L+ /run/gitlab/tmp - - - - ${cfg.statePath}/tmp"

nixos/modules/services/misc/gollum.nix

@@ -91,18 +91,30 @@ in
         The package used in the service
       '';
     };
+
+    user = mkOption {
+      type = types.str;
+      default = "gollum";
+      description = lib.mdDoc "Specifies the owner of the wiki directory";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "gollum";
+      description = lib.mdDoc "Specifies the owner group of the wiki directory";
+    };
   };
 
   config = mkIf cfg.enable {
 
-    users.users.gollum = {
+    users.users.gollum = mkIf (cfg.user == "gollum") {
-      group = config.users.users.gollum.name;
+      group = cfg.group;
       description = "Gollum user";
       createHome = false;
       isSystemUser = true;
     };
 
-    users.groups.gollum = { };
+    users.groups."${cfg.group}" = { };
 
     systemd.tmpfiles.rules = [
       "d '${cfg.stateDir}' - ${config.users.users.gollum.name} ${config.users.groups.gollum.name} - -"
@@ -120,8 +132,8 @@ in
       '';
 
       serviceConfig = {
-        User = config.users.users.gollum.name;
+        User = cfg.user;
-        Group = config.users.groups.gollum.name;
+        Group = cfg.group;
         WorkingDirectory = cfg.stateDir;
         ExecStart = ''
           ${cfg.package}/bin/gollum \

nixos/modules/services/misc/nix-optimise.nix

@@ -1,28 +1,21 @@
 { config, lib, ... }:
 
-with lib;
-
 let
   cfg = config.nix.optimise;
 in
 
 {
-
-  ###### interface
-
   options = {
-
     nix.optimise = {
-
+      automatic = lib.mkOption {
-      automatic = mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = lib.mdDoc "Automatically run the nix store optimiser at a specific time.";
       };
 
-      dates = mkOption {
+      dates = lib.mkOption {
         default = ["03:45"];
-        type = types.listOf types.str;
+        type = with lib.types; listOf str;
         description = lib.mdDoc ''
           Specification (in the format described by
           {manpage}`systemd.time(7)`) of the time at
@@ -32,9 +25,6 @@ in
     };
   };
 
-
-  ###### implementation
-
   config = {
     assertions = [
       {
@@ -43,14 +33,19 @@ in
       }
     ];
 
-    systemd.services.nix-optimise = lib.mkIf config.nix.enable
+    systemd = lib.mkIf config.nix.enable {
-      { description = "Nix Store Optimiser";
+      services.nix-optimise = {
+        description = "Nix Store Optimiser";
         # No point this if the nix daemon (and thus the nix store) is outside
         unitConfig.ConditionPathIsReadWrite = "/nix/var/nix/daemon-socket";
         serviceConfig.ExecStart = "${config.nix.package}/bin/nix-store --optimise";
-        startAt = optionals cfg.automatic cfg.dates;
+        startAt = lib.optionals cfg.automatic cfg.dates;
       };
 
+      timers.nix-optimise.timerConfig = {
+        Persistent = true;
+        RandomizedDelaySec = 1800;
+      };
+    };
   };
-
 }

nixos/modules/services/networking/sing-box.nix

@@ -0,0 +1,67 @@
+{ config, lib, pkgs, utils, ... }:
+let
+  cfg = config.services.sing-box;
+  settingsFormat = pkgs.formats.json { };
+in
+{
+
+  meta = {
+    maintainers = with lib.maintainers; [ nickcao ];
+  };
+
+  options = {
+    services.sing-box = {
+      enable = lib.mkEnableOption (lib.mdDoc "sing-box universal proxy platform");
+
+      package = lib.mkPackageOptionMD pkgs "sing-box" { };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            route = {
+              geoip.path = lib.mkOption {
+                type = lib.types.path;
+                default = "${pkgs.sing-geoip}/share/sing-box/geoip.db";
+                defaultText = lib.literalExpression "\${pkgs.sing-geoip}/share/sing-box/geoip.db";
+                description = lib.mdDoc ''
+                  The path to the sing-geoip database.
+                '';
+              };
+              geosite.path = lib.mkOption {
+                type = lib.types.path;
+                default = "${pkgs.sing-geosite}/share/sing-box/geosite.db";
+                defaultText = lib.literalExpression "\${pkgs.sing-geosite}/share/sing-box/geosite.db";
+                description = lib.mdDoc ''
+                  The path to the sing-geosite database.
+                '';
+              };
+            };
+          };
+        };
+        default = { };
+        description = lib.mdDoc ''
+          The sing-box configuration, see https://sing-box.sagernet.org/configuration/ for documentation.
+
+          Options containing secret data should be set to an attribute set
+          containing the attribute `_secret` - a string pointing to a file
+          containing the value the option should be set to.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.packages = [ cfg.package ];
+
+    systemd.services.sing-box = {
+      preStart = ''
+        umask 0077
+        mkdir -p /etc/sing-box
+        ${utils.genJqSecretsReplacementSnippet cfg.settings "/etc/sing-box/config.json"}
+      '';
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+
+}

nixos/modules/services/web-apps/anuko-time-tracker.nix

@@ -0,0 +1,354 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.anuko-time-tracker;
+  configFile = let
+    smtpPassword = if cfg.settings.email.smtpPasswordFile == null
+                   then "''"
+                   else "trim(file_get_contents('${cfg.settings.email.smtpPasswordFile}'))";
+
+  in pkgs.writeText "config.php" ''
+    <?php
+    // Set include path for PEAR and its modules, which we include in the distribution.
+    // Updated for the correct location in the nix store.
+    set_include_path('${cfg.package}/WEB-INF/lib/pear' . PATH_SEPARATOR . get_include_path());
+    define('DSN', 'mysqli://${cfg.database.user}@${cfg.database.host}/${cfg.database.name}?charset=utf8mb4');
+    define('MULTIORG_MODE', ${lib.boolToString cfg.settings.multiorgMode});
+    define('EMAIL_REQUIRED', ${lib.boolToString cfg.settings.emailRequired});
+    define('WEEKEND_START_DAY', ${toString cfg.settings.weekendStartDay});
+    define('FORUM_LINK', '${cfg.settings.forumLink}');
+    define('HELP_LINK', '${cfg.settings.helpLink}');
+    define('SENDER', '${cfg.settings.email.sender}');
+    define('MAIL_MODE', '${cfg.settings.email.mode}');
+    define('MAIL_SMTP_HOST', '${toString cfg.settings.email.smtpHost}');
+    define('MAIL_SMTP_PORT', '${toString cfg.settings.email.smtpPort}');
+    define('MAIL_SMTP_USER', '${cfg.settings.email.smtpUser}');
+    define('MAIL_SMTP_PASSWORD', ${smtpPassword});
+    define('MAIL_SMTP_AUTH', ${lib.boolToString cfg.settings.email.smtpAuth});
+    define('MAIL_SMTP_DEBUG', ${lib.boolToString cfg.settings.email.smtpDebug});
+    define('DEFAULT_CSS', 'default.css');
+    define('RTL_CSS', 'rtl.css'); // For right to left languages.
+    define('LANG_DEFAULT', '${cfg.settings.defaultLanguage}');
+    define('CURRENCY_DEFAULT', '${cfg.settings.defaultCurrency}');
+    define('EXPORT_DECIMAL_DURATION', ${lib.boolToString cfg.settings.exportDecimalDuration});
+    define('REPORT_FOOTER', ${lib.boolToString cfg.settings.reportFooter});
+    define('AUTH_MODULE', 'db');
+  '';
+  package = pkgs.stdenv.mkDerivation rec {
+    pname = "anuko-time-tracker";
+    inherit (src) version;
+    src = cfg.package;
+    installPhase = ''
+      mkdir -p $out
+      cp -r * $out/
+
+      ln -s ${configFile} $out/WEB-INF/config.php
+
+      # Link writable templates_c directory
+      rm -rf $out/WEB-INF/templates_c
+      ln -s ${cfg.dataDir}/templates_c $out/WEB-INF/templates_c
+
+      # ln -fs ${cfg.dataDir}/templates_c $out/WEB-INF/templates_c
+    '';
+  };
+in
+{
+  options.services.anuko-time-tracker = {
+    enable = lib.mkEnableOption (lib.mdDoc "Anuko Time Tracker");
+
+    package = lib.mkPackageOptionMD pkgs "anuko-time-tracker" {};
+
+    database = {
+      createLocally = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc "Create the database and database user locally.";
+      };
+
+      host = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Database host.";
+        default = "localhost";
+      };
+
+      name = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Database name.";
+        default = "anuko_time_tracker";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Database username.";
+        default = "anuko_time_tracker";
+      };
+
+      passwordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = lib.mdDoc "Database user password file.";
+        default = null;
+      };
+    };
+
+    poolConfig = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.oneOf [ lib.types.str lib.types.int lib.types.bool ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = lib.mdDoc ''
+        Options for Anuko Time Tracker's PHP-FPM pool.
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/anuko-time-tracker";
+      description = lib.mdDoc "Default data folder for Anuko Time Tracker.";
+      example = "/mnt/anuko-time-tracker";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "anuko_time_tracker";
+      description = lib.mdDoc "User under which Anuko Time Tracker runs.";
+    };
+
+    virtualHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "localhost";
+      description = lib.mdDoc ''
+        Name of the nginx virtualhost to use and setup. If null, do not setup
+        any virtualhost.
+      '';
+    };
+
+    settings = {
+      multiorgMode = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          Defines whether users see the Register option in the menu of Time Tracker that allows them
+          to self-register and create new organizations (top groups).
+        '';
+      };
+
+      emailRequired = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = lib.mdDoc "Defines whether an email is required for new registrations.";
+      };
+
+      weekendStartDay = lib.mkOption {
+        type = lib.types.int;
+        default = 6;
+        description = lib.mdDoc ''
+          This option defines which days are highlighted with weekend color.
+          6 means Saturday. For Saudi Arabia, etc. set it to 4 for Thursday and Friday to be
+          weekend days.
+        '';
+      };
+
+      forumLink = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Forum link from the main menu.";
+        default = "https://www.anuko.com/forum/viewforum.php?f=4";
+      };
+
+      helpLink = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Help link from the main menu.";
+        default = "https://www.anuko.com/time-tracker/user-guide/index.htm";
+      };
+
+      email = {
+        sender = lib.mkOption {
+          type = lib.types.str;
+          description = lib.mdDoc "Default sender for mail.";
+          default = "Anuko Time Tracker <bounces@example.com>";
+        };
+
+        mode = lib.mkOption {
+          type = lib.types.str;
+          description = lib.mdDoc "Mail sending mode. Can be 'mail' or 'smtp'.";
+          default = "smtp";
+        };
+
+        smtpHost = lib.mkOption {
+          type = lib.types.str;
+          description = lib.mdDoc "MTA hostname.";
+          default = "localhost";
+        };
+
+        smtpPort = lib.mkOption {
+          type = lib.types.int;
+          description = lib.mdDoc "MTA port.";
+          default = 25;
+        };
+
+        smtpUser = lib.mkOption {
+          type = lib.types.str;
+          description = lib.mdDoc "MTA authentication username.";
+          default = "";
+        };
+
+        smtpAuth = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = lib.mdDoc "MTA requires authentication.";
+        };
+
+        smtpPasswordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          example = "/var/lib/anuko-time-tracker/secrets/smtp-password";
+          description = lib.mdDoc ''
+            Path to file containing the MTA authentication password.
+          '';
+        };
+
+        smtpDebug = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = lib.mdDoc "Debug mail sending.";
+        };
+      };
+
+      defaultLanguage = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc ''
+          Defines Anuko Time Tracker default language. It is used on Time Tracker login page.
+          After login, a language set for user group is used.
+          Empty string means the language is defined by user browser.
+        '';
+        default = "";
+        example = "nl";
+      };
+
+      defaultCurrency = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc ''
+          Defines a default currency symbol for new groups.
+          Use €, £, a more specific dollar like US$, CAD, etc.
+        '';
+        default = "$";
+        example = "€";
+      };
+
+      exportDecimalDuration = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          Defines whether time duration values are decimal in CSV and XML data
+          exports (1.25 vs 1:15).
+        '';
+      };
+
+      reportFooter = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc "Defines whether to use a footer on reports.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+        message = ''
+          <option>services.anuko-time-tracker.database.passwordFile</option> cannot be specified if
+          <option>services.anuko-time-tracker.database.createLocally</option> is set to true.
+        '';
+      }
+      {
+        assertion = cfg.settings.email.smtpAuth -> (cfg.settings.email.smtpPasswordFile != null);
+        message = ''
+          <option>services.anuko-time-tracker.settings.email.smtpPasswordFile</option> needs to be set if
+          <option>services.anuko-time-tracker.settings.email.smtpAuth</option> is enabled.
+        '';
+      }
+    ];
+
+    services.phpfpm = {
+      pools.anuko-time-tracker = {
+        inherit (cfg) user;
+        group = config.services.nginx.group;
+        settings = {
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
+        } // cfg.poolConfig;
+      };
+    };
+
+    services.nginx = lib.mkIf (cfg.virtualHost != null) {
+      enable = true;
+      virtualHosts = {
+        "${cfg.virtualHost}" = {
+          root = lib.mkForce "${package}";
+          locations."/".index = "index.php";
+          locations."~ [^/]\\.php(/|$)" = {
+            extraConfig = ''
+              fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+              fastcgi_pass unix:${config.services.phpfpm.pools.anuko-time-tracker.socket};
+            '';
+          };
+        };
+      };
+    };
+
+    services.mysql = lib.mkIf cfg.database.createLocally {
+      enable = lib.mkDefault true;
+      package = lib.mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [{
+        name = cfg.database.user;
+        ensurePermissions = {
+          "${cfg.database.name}.*" = "ALL PRIVILEGES";
+        };
+      }];
+    };
+
+    systemd = {
+      services = {
+        anuko-time-tracker-setup-database = lib.mkIf cfg.database.createLocally {
+          description = "Set up Anuko Time Tracker database";
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          wantedBy = [ "phpfpm-anuko-time-tracker.service" ];
+          after = [ "mysql.service" ];
+          script =
+            let
+              mysql = "${config.services.mysql.package}/bin/mysql";
+            in
+            ''
+              if [ ! -f ${cfg.dataDir}/.dbexists ]; then
+                # Load database schema provided with package
+                ${mysql} ${cfg.database.name} < ${cfg.package}/mysql.sql
+
+                touch ${cfg.dataDir}/.dbexists
+              fi
+            '';
+        };
+      };
+      tmpfiles.rules = [
+        "d ${cfg.dataDir} 0750 ${cfg.user} ${config.services.nginx.group} -"
+        "d ${cfg.dataDir}/templates_c 0750 ${cfg.user} ${config.services.nginx.group} -"
+      ];
+    };
+
+    users.users."${cfg.user}" = {
+      isSystemUser = true;
+      group = config.services.nginx.group;
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ michaelshmitty ];
+}

nixos/modules/services/web-apps/lemmy.nix

@@ -202,7 +202,7 @@ in
 
         environment = {
           LEMMY_CONFIG_LOCATION = "${settingsFormat.generate "config.hjson" cfg.settings}";
-          LEMMY_DATABASE_URL = mkIf (cfg.database.uri != null) cfg.database.uri;
+          LEMMY_DATABASE_URL = if cfg.database.uri != null then cfg.database.uri else (mkIf (cfg.database.createLocally) "postgres:///lemmy?host=/run/postgresql&user=lemmy");
         };
 
         documentation = [

nixos/modules/services/web-apps/pixelfed.nix

@@ -380,6 +380,12 @@ in {
       };
 
       script = ''
+        # Before running any PHP program, cleanup the code cache.
+        # It's necessary if you upgrade the application otherwise you might
+        # try to import non-existent modules.
+        rm -f ${cfg.runtimeDir}/app.php
+        rm -rf ${cfg.runtimeDir}/cache/*
+
         # Concatenate non-secret .env and secret .env
         rm -f ${cfg.dataDir}/.env
         cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env
@@ -406,11 +412,6 @@ in {
         # Install Horizon
         # FIXME: require write access to public/ — should be done as part of install — pixelfed-manage horizon:publish
 
-        # Before running any PHP program, cleanup the bootstrap.
-        # It's necessary if you upgrade the application otherwise you might
-        # try to import non-existent modules.
-        rm -rf ${cfg.runtimeDir}/bootstrap/*
-
         # Perform the first migration.
         [[ ! -f ${cfg.dataDir}/.initial-migration ]] && pixelfed-manage migrate --force && touch ${cfg.dataDir}/.initial-migration
 

nixos/modules/system/activation/top-level.nix

@@ -260,10 +260,10 @@ in
     };
 
     system.extraDependencies = mkOption {
-      type = types.listOf types.package;
+      type = types.listOf types.pathInStore;
       default = [];
       description = lib.mdDoc ''
-        A list of packages that should be included in the system
+        A list of paths that should be included in the system
         closure but generally not visible to users.
 
         This option has also been used for build-time checks, but the

nixos/modules/system/boot/networkd.nix

@@ -3165,7 +3165,7 @@ let
 
     (mkIf cfg.enable {
 
-      systemd.package = pkgs.systemdStage1Network;
+      systemd.package = mkDefault pkgs.systemdStage1Network;
 
       # For networkctl
       systemd.dbus.enable = mkDefault true;

nixos/tests/all-tests.nix

@@ -107,6 +107,7 @@ in {
   allTerminfo = handleTest ./all-terminfo.nix {};
   alps = handleTest ./alps.nix {};
   amazon-init-shell = handleTest ./amazon-init-shell.nix {};
+  anuko-time-tracker = handleTest ./anuko-time-tracker.nix {};
   apcupsd = handleTest ./apcupsd.nix {};
   apfs = runTest ./apfs.nix;
   apparmor = handleTest ./apparmor.nix {};
@@ -645,6 +646,7 @@ in {
   pulseaudio = discoverTests (import ./pulseaudio.nix);
   qboot = handleTestOn ["x86_64-linux" "i686-linux"] ./qboot.nix {};
   qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix {};
+  qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
   quorum = handleTest ./quorum.nix {};
   quake3 = handleTest ./quake3.nix {};
   qownnotes = handleTest ./qownnotes.nix {};
@@ -686,6 +688,7 @@ in {
   shiori = handleTest ./shiori.nix {};
   signal-desktop = handleTest ./signal-desktop.nix {};
   simple = handleTest ./simple.nix {};
+  sing-box = handleTest ./sing-box.nix {};
   slurm = handleTest ./slurm.nix {};
   smokeping = handleTest ./smokeping.nix {};
   snapcast = handleTest ./snapcast.nix {};

nixos/tests/anuko-time-tracker.nix

@@ -0,0 +1,17 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "anuko-time-tracker";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ michaelshmitty ];
+  };
+  nodes = {
+    machine = {
+      services.anuko-time-tracker.enable = true;
+    };
+  };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("phpfpm-anuko-time-tracker")
+    machine.wait_for_open_port(80);
+    machine.wait_until_succeeds("curl -s --fail -L http://localhost/time.php | grep 'Anuko Time Tracker'")
+  '';
+})

nixos/tests/lemmy.nix

@@ -26,6 +26,8 @@ in
             site_name = "Lemmy FTW";
             admin_email = "mightyiam@example.com";
           };
+          # https://github.com/LemmyNet/lemmy/blob/50efb1d519c63a7007a07f11cc8a11487703c70d/crates/utils/src/settings/mod.rs#L52
+          database.uri = "postgres:///lemmy?host=/run/postgresql&user=lemmy";
         };
         caddy.enable = true;
       };

nixos/tests/qemu-vm-volatile-root.nix

@@ -0,0 +1,17 @@
+# Test that the root filesystem is a volatile tmpfs.
+
+{ lib, ... }:
+
+{
+  name = "qemu-vm-volatile-root";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = _: {
+    virtualisation.diskImage = null;
+  };
+
+  testScript = ''
+    machine.succeed("findmnt --kernel --types tmpfs /")
+  '';
+}

nixos/tests/sing-box.nix

@@ -0,0 +1,45 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+
+  name = "sing-box";
+
+  meta = {
+    maintainers = with lib.maintainers; [ nickcao ];
+  };
+
+  nodes.machine = { pkgs, ... }: {
+    environment.systemPackages = [ pkgs.curl ];
+    services.nginx.enable = true;
+    services.sing-box = {
+      enable = true;
+      settings = {
+        inbounds = [{
+          type = "mixed";
+          tag = "inbound";
+          listen = "127.0.0.1";
+          listen_port = 1080;
+          users = [{
+            username = "user";
+            password = { _secret = pkgs.writeText "password" "supersecret"; };
+          }];
+        }];
+        outbounds = [{
+          type = "direct";
+          tag = "outbound";
+        }];
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("sing-box.service")
+
+    machine.wait_for_open_port(80)
+    machine.wait_for_open_port(1080)
+
+    machine.succeed("curl --fail --max-time 10 --proxy http://user:supersecret@localhost:1080 http://localhost")
+    machine.fail("curl --fail --max-time 10 --proxy http://user:supervillain@localhost:1080 http://localhost")
+    machine.succeed("curl --fail --max-time 10 --proxy socks5://user:supersecret@localhost:1080 http://localhost")
+  '';
+
+})

pkgs/applications/blockchains/dcrd/default.nix

@@ -2,20 +2,18 @@
 
 buildGoModule rec {
   pname = "dcrd";
-  version = "1.5.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "decred";
     repo = "dcrd";
     rev = "refs/tags/release-v${version}";
-    sha256 = "14pxajc8si90hnddilfm09kmljwxq6i6p53fk0g09jp000cbklkl";
+    hash = "sha256-ZNBSIzx07zJrBxas7bHpZ8ZPDWJ4d7jumpKYj5Qmzlo=";
   };
 
-  vendorSha256 = "03aw6mcvp1vr01ppxy673jf5hdryd5032cxndlkaiwg005mxp1dy";
+  vendorHash = "sha256-++IPB2IadXd1LC5r6f1a0UqsTG/McAf7KQAw8WKKoaE=";
 
-  doCheck = false;
+  subPackages = [ "." "cmd/promptsecret" ];
-
-  subPackages = [ "." "cmd/dcrctl" "cmd/promptsecret" ];
 
   meta = {
     homepage = "https://decred.org";

pkgs/applications/blockchains/dcrwallet/default.nix

@@ -2,18 +2,16 @@
 
 buildGoModule rec {
   pname = "dcrwallet";
-  version = "1.6.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "decred";
     repo = "dcrwallet";
-    rev = "refs/tags/v${version}";
+    rev = "release-v${version}";
-    sha256 = "sha256-WUfmv+laOwR/fc4osAFzPKqHQR+wOtSdLEsysICnuvg=";
+    hash = "sha256-ffY5IvSGu4Q7EdJpfdsIKxxjkm6FD0DR9ItnaO90SBc=";
   };
 
-  vendorSha256 = "sha256-9IRNlULvARIZu6dWaKrvx6fiDJ80SBLINhK/9tW9k/0=";
+  vendorHash = "sha256-dduHuMa5UPf73lfirTHSrYnOUbc2IyULpstZPGUJzuc=";
-
-  doCheck = false;
 
   subPackages = [ "." ];
 

pkgs/applications/editors/cpeditor/default.nix

@@ -30,6 +30,8 @@ stdenv.mkDerivation rec {
     substituteInPlace src/Core/Runner.cpp --replace "/bin/bash" "${runtimeShell}"
   '';
 
+  env.NIX_CFLAGS_COMPILE = "-std=c++14";
+
   meta = with lib; {
     description = "An IDE specially designed for competitive programming";
     homepage = "https://cpeditor.org";

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -403,12 +403,12 @@
   };
   elm = buildGrammar {
     language = "elm";
-    version = "0.0.0+rev=692c50c";
+    version = "0.0.0+rev=73edfcd";
     src = fetchFromGitHub {
       owner = "elm-tooling";
       repo = "tree-sitter-elm";
-      rev = "692c50c0b961364c40299e73c1306aecb5d20f40";
+      rev = "73edfcdc3bb2ddfc731cd5d63e6cb287a18da90d";
-      hash = "sha256-0LpuyebOB5ew9fULBcaw8aUbF7HM5sXQpv+Jroz4tXg=";
+      hash = "sha256-0fC3NYHtZQbi9Ca5UAAD9FEXQUJ9z8caf0XQsPpU5Rs=";
     };
     meta.homepage = "https://github.com/elm-tooling/tree-sitter-elm";
   };
@@ -711,12 +711,12 @@
   };
   hack = buildGrammar {
     language = "hack";
-    version = "0.0.0+rev=b7bd692";
+    version = "0.0.0+rev=b1c41e4";
     src = fetchFromGitHub {
       owner = "slackhq";
       repo = "tree-sitter-hack";
-      rev = "b7bd6928532ada34dddb1dece4a158ab62c6e783";
+      rev = "b1c41e4b82c625cc33ddb8701f6aa5a09c72fcf5";
-      hash = "sha256-TSbi4Ik/AjswuIdTaFfJ53S0c/qfq0JYPzVv07JASmc=";
+      hash = "sha256-eEvT8pZeGwtnEanYG2qdkCWR6ifh2qm/yxGOTbuZhdE=";
     };
     meta.homepage = "https://github.com/slackhq/tree-sitter-hack";
   };
@@ -733,15 +733,26 @@
   };
   haskell = buildGrammar {
     language = "haskell";
-    version = "0.0.0+rev=a75238f";
+    version = "0.0.0+rev=ba0bfb0";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-haskell";
-      rev = "a75238fdefc2281cdba7dc4dca13f1d68a91f177";
+      rev = "ba0bfb0e5d8e9e31c160d287878c6f26add3ec08";
-      hash = "sha256-KCP6nP2AI6ZwuADSlWTP21I+U4aUr40/sYTn1FVqVMA=";
+      hash = "sha256-ZSOF0CLOn82GwU3xgvFefmh/AD2j5zz8I0t5YPwfan0=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-haskell";
   };
+  haskell_persistent = buildGrammar {
+    language = "haskell_persistent";
+    version = "0.0.0+rev=58a6ccf";
+    src = fetchFromGitHub {
+      owner = "MercuryTechnologies";
+      repo = "tree-sitter-haskell-persistent";
+      rev = "58a6ccfd56d9f1de8fb9f77e6c42151f8f0d0f3d";
+      hash = "sha256-p4Anm/xeG/d7nYBPDABcdDih/a+0rMjwtVUJru7m9QY=";
+    };
+    meta.homepage = "https://github.com/MercuryTechnologies/tree-sitter-haskell-persistent";
+  };
   hcl = buildGrammar {
     language = "hcl";
     version = "0.0.0+rev=becebeb";
@@ -799,12 +810,12 @@
   };
   html = buildGrammar {
     language = "html";
-    version = "0.0.0+rev=86c253e";
+    version = "0.0.0+rev=ff48883";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-html";
-      rev = "86c253e675e7fdd1c0482efe0706f24bafbc3a7d";
+      rev = "ff48883eb679bbb71b7ac08c8023c8defbf9e234";
-      hash = "sha256-mOJ1JUlsnFPH5jQcWdhWJkoZ0qOK1CTvmi/gEPzzeYk=";
+      hash = "sha256-o4yQsFosxGHj60nezRXDGVBVEPsgITHqE7Ub4rOEAAU=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-html";
   };
@@ -1120,12 +1131,12 @@
   };
   matlab = buildGrammar {
     language = "matlab";
-    version = "0.0.0+rev=26c5255";
+    version = "0.0.0+rev=b09c27e";
     src = fetchFromGitHub {
       owner = "acristoffers";
       repo = "tree-sitter-matlab";
-      rev = "26c525577c7349b8d9805d244cacd8ef98807b78";
+      rev = "b09c27e42732c59321604a15163480ebb4f82f1c";
-      hash = "sha256-nvjqmyVcVfTkuMFyDWWJLZNN/SeiNwLrQU6qfvQqpmw=";
+      hash = "sha256-gIaHyExmgFSEe6Nm7G5NPNafWWhl50Fn1UQm35MrAuE=";
     };
     meta.homepage = "https://github.com/acristoffers/tree-sitter-matlab";
   };
@@ -1443,12 +1454,12 @@
   };
   python = buildGrammar {
     language = "python";
-    version = "0.0.0+rev=6282715";
+    version = "0.0.0+rev=6ecc2b5";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-python";
-      rev = "62827156d01c74dc1538266344e788da74536b8a";
+      rev = "6ecc2b54b39ac390848d81dfcf5ee961f33a2f03";
-      hash = "sha256-hVtX4Dyqrq+cSvKTmKMxLbAplcCdR8dfFDoIZNtPFA0=";
+      hash = "sha256-gfFD1E6hXaNU0z81VHvo0oMU9iLcyRWP6sIRj6uagYU=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-python";
   };
@@ -1509,12 +1520,12 @@
   };
   racket = buildGrammar {
     language = "racket";
-    version = "0.0.0+rev=2804e03";
+    version = "0.0.0+rev=bbdb0bf";
     src = fetchFromGitHub {
       owner = "6cdh";
       repo = "tree-sitter-racket";
-      rev = "2804e03223953dc4709f4c041b57b722095a0397";
+      rev = "bbdb0bfbaf0dd5f6650b97a393a06a19cef50562";
-      hash = "sha256-mPG0faYCxML1Ehu6bZS86rEV9Ys+tgwsGlNKgA4U3zQ=";
+      hash = "sha256-in/VhL0PkhOXaeiMje8oqTxYJ9/VirLTfzF9QZg/Fuk=";
     };
     meta.homepage = "https://github.com/6cdh/tree-sitter-racket";
   };
@@ -1696,12 +1707,12 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "0.0.0+rev=d38db87";
+    version = "0.0.0+rev=7bd15d1";
     src = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "d38db87c3e979a692cd542be44524f7f5e46f965";
+      rev = "7bd15d1ca789c5aaef5d2dbfdb14565ec8223d1b";
-      hash = "sha256-PT7joV3kA8LqB6t/bhahxNsp8zfOKNWQIT8gQ4UnqY4=";
+      hash = "sha256-yX1Ttwl+GgmguThHpIsnM/x3O57WY+u4NcChSdokHo0=";
     };
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };
@@ -2022,12 +2033,12 @@
   };
   vimdoc = buildGrammar {
     language = "vimdoc";
-    version = "0.0.0+rev=e9b4d2b";
+    version = "0.0.0+rev=8c0469d";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "tree-sitter-vimdoc";
-      rev = "e9b4d2b3e732ed841980e7369e945e46ce715b8c";
+      rev = "8c0469d1f84f1e2733d4490dfb3cf8f8b100e2da";
-      hash = "sha256-4j8iEo1BIh4RdYjGPokXNIHhlS7G3JE4ABQ/i3yuObA=";
+      hash = "sha256-8Y2Ow9Hppo8qB8SoaxF/vnOTC8pXZg/d5HjlBxy0wwg=";
     };
     meta.homepage = "https://github.com/neovim/tree-sitter-vimdoc";
   };

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -466,6 +466,10 @@ self: super: {
     '';
   });
 
+  executor-nvim = super.executor-nvim.overrideAttrs (old: {
+    dependencies = with self; [ nui-nvim ];
+  });
+
   fcitx-vim = super.fcitx-vim.overrideAttrs (old: {
     passthru.python3Dependencies = ps: with ps; [ dbus-python ];
     meta = {

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -257,6 +257,7 @@ https://github.com/dmix/elvish.vim/,,
 https://github.com/mattn/emmet-vim/,,
 https://github.com/vim-scripts/emodeline/,,
 https://github.com/sainnhe/everforest/,,
+https://github.com/google/executor.nvim/,HEAD,
 https://github.com/nvchad/extensions/,HEAD,nvchad-extensions
 https://github.com/jinh0/eyeliner.nvim/,HEAD,
 https://github.com/fenetikm/falcon/,,
@@ -574,6 +575,7 @@ https://github.com/ethanholz/nvim-lastplace/,HEAD,
 https://github.com/kosayoda/nvim-lightbulb/,,
 https://github.com/josa42/nvim-lightline-lsp/,,
 https://github.com/mfussenegger/nvim-lint/,,
+https://github.com/mrded/nvim-lsp-notify/,HEAD,
 https://github.com/jose-elias-alvarez/nvim-lsp-ts-utils/,,
 https://github.com/neovim/nvim-lspconfig/,,
 https://github.com/RishabhRD/nvim-lsputils/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -587,6 +587,22 @@ let
         };
       };
 
+      brandonkirbyson.solarized-palenight = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "solarized-palenight";
+          publisher = "BrandonKirbyson";
+          version = "1.0.1";
+          sha256 = "sha256-vVbaHSaBX6QzpnYMQlpPsJU1TQYJEBe8jq95muzwN0o=";
+        };
+        meta = {
+          description = " A solarized-palenight theme for vscode";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=BrandonKirbyson.solarized-palenight";
+          homepage = "https://github.com/BrandonKirbyson/Solarized-Palenight";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.sebtm ];
+        };
+      };
+
       brettm12345.nixfmt-vscode = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "nixfmt-vscode";

pkgs/applications/editors/xed-editor/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xed-editor";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xed";
     rev = version;
-    sha256 = "sha256-fBwxc6n4sNNRiKcax96Tl3cFD+Ryvmj+XizB3z2s4+Q=";
+    sha256 = "sha256-fTrvHf7iA3qexxdebSgzLXlngAOkdraW3KiVTVYodrY=";
   };
 
   nativeBuildInputs = [

pkgs/applications/emulators/craftos-pc/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, callPackage
 , patchelf
 , unzip
 , poco
@@ -59,6 +60,11 @@ stdenv.mkDerivation rec {
     cp -R ${craftos2-rom}/* $out/share/craftos
   '';
 
+  passthru.tests = {
+    eval-hello-world = callPackage ./test-eval-hello-world { };
+    eval-periphemu = callPackage ./test-eval-periphemu { };
+  };
+
   meta = with lib; {
     description = "An implementation of the CraftOS-PC API written in C++ using SDL";
     homepage = "https://www.craftos-pc.cc";

pkgs/applications/emulators/craftos-pc/test-eval-hello-world/default.nix

@@ -0,0 +1,18 @@
+{ stdenv
+, craftos-pc
+, grep
+}:
+
+stdenv.mkDerivation {
+  name = "craftos-pc-test-eval-hello-world";
+  meta.timeout = 60;
+  nativeBuildInputs = [ craftos-pc grep ];
+  buildCommand = ''
+    export HOME=$(pwd)
+    mkdir $HOME/.local $HOME/.config
+    export XDG_CONFIG_DIR=$HOME/.config
+    export XDG_DATA_DIR=$HOME/.local
+    craftos --headless --script ${./init.lua} | grep "Hello Nixpkgs!" > /dev/null
+    touch $out
+  '';
+}

pkgs/applications/emulators/craftos-pc/test-eval-hello-world/init.lua

@@ -0,0 +1,3 @@
+print("Hello Nixpkgs!")
+
+shell.run("shutdown")

pkgs/applications/emulators/craftos-pc/test-eval-periphemu/default.nix

@@ -0,0 +1,19 @@
+{ stdenv
+, craftos-pc
+, grep
+}:
+stdenv.mkDerivation {
+  name = "craftos-pc-test-eval-periphemu";
+  meta.timeout = 60;
+  nativeBuildInputs = [ craftos-pc grep ];
+  buildCommand = ''
+    export HOME=$(pwd)
+    mkdir $HOME/.local $HOME/.config
+    export XDG_CONFIG_DIR=$HOME/.config
+    export XDG_DATA_DIR=$HOME/.local
+    if craftos --headless --script ${./init.lua} | grep -q "FAIL"; then
+        exit 1
+    fi
+    touch $out
+  '';
+}

pkgs/applications/emulators/craftos-pc/test-eval-periphemu/init.lua

@@ -0,0 +1,18 @@
+local function assert(cond1, cond2)
+    if not cond1 == cond2 then print("FAIL") end
+end
+
+local function driveTests()
+    periphemu.create("left", "drive")
+    local p = peripheral.wrap("left")
+
+    assert(p.isDiskPresent(), false)
+    p.insertDisk(649)
+    assert(p.isDiskPresent(), true)
+    assert(p.getDiskID(), 649)
+    assert(p.getDiskLabel(), nil)
+end
+
+driveTests()
+
+shell.run("shutdown")

pkgs/applications/graphics/paraview/default.nix

@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "5.11.0";
+  version = "5.11.1";
 
   docFiles = [
     (fetchurl {
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
     owner = "paraview";
     repo = "paraview";
     rev = "v${version}";
-    sha256 = "sha256-WvkKGl5lG+apX6m4ULVZZVtDsSUjEVXe/seh95b+LmI=";
+    hash = "sha256-LatNHfiAqB2kqzERRnYae0WIXBb4nXQ79Be4kuh8NFQ=";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/1password-gui/default.nix

@@ -9,7 +9,7 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.10.7" else "8.10.8-13.BETA";
+  version = if channel == "stable" then "8.10.7" else "8.10.8-42.BETA";
 
   sources = {
     stable = {
@@ -33,19 +33,19 @@ let
     beta = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-+Gg4OJXjdufEBNa3+qBXz0/NfPDXDfuiCYjMEDHnOKo=";
+        sha256 = "sha256-nPstDndWuPMSGJlbyniEfljdEy+TOB9zWMJ+db7xCx4=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-xDwwxo4UsoPzcxFblYeZ9QIDIJ6f6vGBxYySqP9o/A0=";
+        sha256 = "sha256-waJjvqF6OXGrf90srvvZ+hyxapcQApGTsxTzNMX9V3s=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-NphHgeMrjBqApU5crNj1JOTTXD4kXoO067feVs/YxuA=";
+        sha256 = "sha256-i9hbnjXx2/RWJ9YvrFDOGbi7dpiHtxWsN0HAZPOhK8o=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-M1MnSbZ6qsT7Ke5e8/4ppCxlXekulJnm9Zb5+4tt8Vg=";
+        sha256 = "sha256-tat2x2J4/yKhWp4sWCEqU+SSZaNRx8WTcCJAAbo1Kpk=";
       };
     };
   };

pkgs/applications/misc/comodoro/default.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comodoro";
-  version = "0.0.8";
+  version = "0.0.9";
 
   src = fetchFromGitHub {
     owner = "soywod";
     repo = "comodoro";
     rev = "v${version}";
-    sha256 = "rGnVXyfWJkPHfpf1gRGbDJ6Y1ycKOOcCZ+Jx35fUo6M=";
+    hash = "sha256-pxe3Nv1N85uWsiv4s0wtD++zlZZgMADH51f5RMK9huA=";
   };
 
-  cargoSha256 = "jpshuavywCLN03xD/gFgQeGbKtmHq5pULbxd+RUbaDk=";
+  cargoSha256 = "E5oHeMow9MrVrlDX+v0tX9Nv3gHUxDNUpRAT5jPa+DI=";
 
   nativeBuildInputs = lib.optional (installManPages || installShellCompletions) installShellFiles;
 

pkgs/applications/misc/electrum/grs.nix

@@ -9,11 +9,11 @@
 }:
 
 let
-  version = "4.3.1";
+  version = "4.4.4";
 
   libsecp256k1_name =
-    if stdenv.isLinux then "libsecp256k1.so.0"
+    if stdenv.isLinux then "libsecp256k1.so.{v}"
-    else if stdenv.isDarwin then "libsecp256k1.0.dylib"
+    else if stdenv.isDarwin then "libsecp256k1.{v}.dylib"
     else "libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}";
 
   libzbar_name =
@@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication {
     owner = "Groestlcoin";
     repo = "electrum-grs";
     rev = "refs/tags/v${version}";
-    sha256 = "1h9r32wdn0p7br36r719x96c8gay83dijw80y2ks951mam16mkkb";
+    sha256 = "0fl01qdvb1z6l6kwipj1lj0qmjk3mzw25wv7yh5j1hh1f5lng0s8";
   };
 
   nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
@@ -55,6 +55,7 @@ python3.pkgs.buildPythonApplication {
     tlslite-ng
     # plugins
     btchip-python
+    ledger-bitcoin
     ckcc-protocol
     keepkey
     trezor
@@ -66,7 +67,7 @@ python3.pkgs.buildPythonApplication {
   postPatch = ''
     # make compatible with protobuf4 by easing dependencies ...
     substituteInPlace ./contrib/requirements/requirements.txt \
-      --replace "protobuf>=3.12,<4" "protobuf>=3.12"
+      --replace "protobuf>=3.20,<4" "protobuf>=3.20"
     # ... and regenerating the paymentrequest_pb2.py file
     protoc --python_out=. electrum_grs/paymentrequest.proto
 

pkgs/applications/misc/eos-installer/default.nix

@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
     description = "Installer UI which writes images to disk";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ qyliss ];
+    mainProgram = "gnome-image-installer";
     platforms = platforms.linux;
   };
 }

pkgs/applications/misc/mob/default.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "mob";
-  version = "4.4.3";
+  version = "4.4.5";
 
   src = fetchFromGitHub {
     owner = "remotemobprogramming";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-XWXoY/e/xceO3sOGvA2hrdvbdb8nomMg7AGUW090I74=";
+    sha256 = "sha256-/Kr5K0QkjARWKR8YhDsOQ2CoUzUu5LWUq6smhB0yDCM=";
   };
 
   vendorHash = null;

pkgs/applications/networking/browsers/firefox/mobile-config.nix

@@ -0,0 +1,113 @@
+{ stdenv, lib, runCommand, fetchFromGitLab, wrapFirefox, firefox-unwrapped }:
+
+let
+  pkg = fetchFromGitLab {
+    owner = "postmarketOS";
+    repo = "mobile-config-firefox";
+    rev = "ff2f07873f4ebc6e220da0e9b9f04c69f451edda";
+    sha256 = "sha256-8wRz8corz00+0qROMiOmZAddM4tjfmE91bx0+P8JNx4=";
+  };
+  userChrome = runCommand "userChrome.css" {} ''
+    cat ${pkg}/src/userChrome/*.css > $out
+  '';
+  userContent = runCommand "userContent.css" {} ''
+    cat ${pkg}/src/userContent/*.css > $out
+  '';
+in wrapFirefox firefox-unwrapped {
+  # extraPolicies = (lib.importJSON "${pkg}/src/policies.json").policies;
+  extraPoliciesFiles = [ "${pkg}/src/policies.json" ];
+  extraPrefs = ''
+    // Copyright 2022 Arnaud Ferraris, Oliver Smith
+    // SPDX-License-Identifier: MPL-2.0
+
+    // This is a Firefox autoconfig file:
+    // https://support.mozilla.org/en-US/kb/customizing-firefox-using-autoconfig
+
+    // Import custom userChrome.css on startup or new profile creation
+    const {classes: Cc, interfaces: Ci, utils: Cu} = Components;
+    Cu.import("resource://gre/modules/Services.jsm");
+    Cu.import("resource://gre/modules/FileUtils.jsm");
+
+    var updated = false;
+
+    // Create <profile>/chrome/ directory if not already present
+    var chromeDir = Services.dirsvc.get("ProfD", Ci.nsIFile);
+    chromeDir.append("chrome");
+    if (!chromeDir.exists()) {
+        chromeDir.create(Ci.nsIFile.DIRECTORY_TYPE, FileUtils.PERMS_DIRECTORY);
+    }
+
+    // Create nsIFile objects for userChrome.css in <profile>/chrome/ and in /etc/
+    var chromeFile = chromeDir.clone();
+    chromeFile.append("userChrome.css");
+    var defaultChrome = new FileUtils.File("${userChrome}");
+
+    // No auto-upgrade. Should this be replaced with symlinking?
+    // // Remove the existing userChrome.css if older than the installed one
+    // if (chromeFile.exists() && defaultChrome.exists() &&
+    //   chromeFile.lastModifiedTime < defaultChrome.lastModifiedTime) {
+    //   chromeFile.remove(false);
+    // }
+
+    // Copy userChrome.css to <profile>/chrome/
+    if (!chromeFile.exists()) {
+      defaultChrome.copyTo(chromeDir, "userChrome.css");
+      updated = true;
+    }
+
+    // Create nsIFile objects for userContent.css in <profile>/chrome/ and in /etc/
+    var contentFile = chromeDir.clone();
+    contentFile.append("userContent.css");
+    var defaultContent = new FileUtils.File("${userContent}");
+
+    // No auto-upgrade. Should this be replaced with symlinking?
+    // // Remove the existing userContent.css if older than the installed one
+    // if (contentFile.exists() && defaultContent.exists() &&
+    //   contentFile.lastModifiedTime < defaultContent.lastModifiedTime) {
+    //   contentFile.remove(false);
+    // }
+
+    // Copy userContent.css to <profile>/chrome/
+    if (!contentFile.exists()) {
+      defaultContent.copyTo(chromeDir, "userContent.css");
+      updated = true;
+    }
+
+    // Restart Firefox immediately if one of the files got updated
+    if (updated === true) {
+        var appStartup = Cc["@mozilla.org/toolkit/app-startup;1"].getService(Ci.nsIAppStartup);
+        appStartup.quit(Ci.nsIAppStartup.eForceQuit | Ci.nsIAppStartup.eRestart);
+    }
+
+    defaultPref('general.useragent.override', 'Mozilla/5.0 (Android 11; Mobile; rv:96.0) Gecko/96.0 Firefox/96.0');
+    defaultPref('browser.urlbar.suggest.topsites', false);
+    defaultPref('browser.urlbar.suggest.engines', false);
+    defaultPref('browser.newtabpage.enabled', true);
+
+    // Enable android-style pinch-to-zoom
+    pref('dom.w3c.touch_events.enabled', true);
+    pref('apz.allow_zooming', true);
+    pref('apz.allow_double_tap_zooming', true);
+
+    // Save vertical space by hiding the titlebar
+    pref('browser.tabs.inTitlebar', 1);
+
+    // Disable search suggestions
+    pref('browser.search.suggest.enabled', false);
+
+    // Empty new tab page: faster, less distractions
+    pref('browser.newtabpage.enabled', false);
+
+    // Allow UI customizations with userChrome.css and userContent.css
+    pref('toolkit.legacyUserProfileCustomizations.stylesheets', true);
+
+    // Select the entire URL with one click
+    pref('browser.urlbar.clickSelectsAll', true);
+
+    // Disable cosmetic animations, save CPU
+    pref('toolkit.cosmeticAnimations.enabled', false);
+
+    // Disable download animations, save CPU
+    pref('browser.download.animateNotifications', false);
+  '';
+}

pkgs/applications/networking/browsers/mullvad-browser/default.nix

@@ -78,12 +78,12 @@ let
       ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "12.0.7";
+  version = "12.5";
 
   sources = {
     x86_64-linux = fetchurl {
       url = "https://cdn.mullvad.net/browser/${version}/mullvad-browser-linux64-${version}_ALL.tar.xz";
-      hash = "sha256-8TcC39A9VFyhFb+pfefzvwJqXq1yF7C2YDcbCyEa0yo=";
+      hash = "sha256-RTDFi+vMkzRtDFgv9sP1bfIeWzzXR307aoMhNiT6vRs=";
     };
   };
 

pkgs/applications/networking/cluster/karmor/default.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "karmor";
-  version = "0.13.3";
+  version = "0.13.7";
 
   src = fetchFromGitHub {
     owner = "kubearmor";
     repo = "kubearmor-client";
     rev = "v${version}";
-    hash = "sha256-BhGe4CMd0YgWc4EAyig5wmLgHJxNc8ppsUMBeRaIJEE=";
+    hash = "sha256-IZUDVw41AfugqVG2hsxoKO7zl1FraVzME/GUxZwaAG4=";
   };
 
   vendorHash = "sha256-VT0CiaG5AODAL6nhoPmpulPApgTUiH0mXI6mS1eK14k=";

pkgs/applications/networking/cluster/kluctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kluctl";
-  version = "2.20.4";
+  version = "2.20.6";
 
   src = fetchFromGitHub {
     owner = "kluctl";
     repo = "kluctl";
     rev = "v${version}";
-    hash = "sha256-Z3tXfzbVs0FWTsi6vbM6BNQBLeCseWn4yBR5PNeRz2s=";
+    hash = "sha256-B8+HKqIuJaH+6ViBxWfiAAmXieQKcwAW565SwUpIJKI=";
   };
 
-  vendorHash = "sha256-z0eiWU5CFMfK6fz+LUtxtSP/MAuVn7iOHB+A7Uv2OQY=";
+  vendorHash = "sha256-x5Zy8H7DzxU+uBCUL6edv8x2LwiIjXl5UrRUMDtUEk8=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
 

pkgs/applications/networking/cluster/kubebuilder/default.nix

@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "kubebuilder";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "kubebuilder";
     rev = "v${version}";
-    hash = "sha256-W1FjmhZWBt/ThkSHHGAR4p1Vxal4WOCutlsHIDZeRZM=";
+    hash = "sha256-R4piek1mhMy5QPB6weR3F7PiIq0LvwkRAnIndbar9tg=";
   };
 
-  vendorHash = "sha256-/Kvn3KwSB/mxgBKM+383QHCnVTOt06ZP3gt7FGqA5aM=";
+  vendorHash = "sha256-5XUYmAfFH6UlLF09PqcSLUxkgZ5iHZGj0Vurab+Jl1g=";
 
   subPackages = ["cmd"];
 

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -164,13 +164,13 @@
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-T9e3IQHe6uCdllRTctJg/aG1QmPFR6V4ryw79yX2k/o=",
+    "hash": "sha256-Sby7Dvu4UWzdbQWa/GLMkDzlK7foaFApy4yLNBOJgck=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.33.0",
+    "rev": "v2.34.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ebkUF+Xv9diwUYXYt/WK+0tWheqL1cgA665VbGLmvvo="
+    "vendorHash": "sha256-AcUw5i3st7VfAnpy/6nTYfTv3rOAN2jm4rUmEKcSrXM="
   },
   "brightbox": {
     "hash": "sha256-yKoYjrZs6EOX1pdDuF+LOu/jZ3fidZJBU7yhSp6qSFU=",
@@ -363,11 +363,11 @@
     "vendorHash": "sha256-2iVEcpESaEdgTcmlQ6Wynuxv8RmPFlhF+BVDSjHmclM="
   },
   "exoscale": {
-    "hash": "sha256-DD6CkdZ9KCCkPCgPyWXaAvHfHyn9rYXRsXg9BVJkELM=",
+    "hash": "sha256-dLA9BWW4ghD1OSZaZtFfv8ipS+2lTeNRr1YD3E8ewpI=",
     "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
     "owner": "exoscale",
     "repo": "terraform-provider-exoscale",
-    "rev": "v0.49.0",
+    "rev": "v0.50.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -474,13 +474,13 @@
     "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
   },
   "grafana": {
-    "hash": "sha256-5V0TW80GQKa2JHrSf9SlsCrT9jTTQK+SMRa/OCIrthE=",
+    "hash": "sha256-J5Fn3JGp7jXAA04RJ3FFKqLpB4hekd0yFA8zkfPPQ+4=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v1.41.0",
+    "rev": "v1.42.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CRqUSPXap8lXRa/yIDnG11F/D+IdylY3JzkV6bXmzwY="
+    "vendorHash": "sha256-8FgjFIgEx3pA6vKo7m9e6gASrpp5cPtN7A2US2GASy8="
   },
   "gridscale": {
     "hash": "sha256-OzOI//WXMHzHSbsqLSAfVpt756SbF3Uv0r/7MsVMjzY=",
@@ -1234,11 +1234,11 @@
     "vendorHash": null
   },
   "vsphere": {
-    "hash": "sha256-XVMTKYb9RuK5sErVHsP0j5otUEioxp6C7GV7/J6OYVA=",
+    "hash": "sha256-lWMtsBRAirNI7dNXI7APzS1AbPmkz5fsbpCdd/0XBRc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vsphere",
     "owner": "hashicorp",
     "repo": "terraform-provider-vsphere",
-    "rev": "v2.4.0",
+    "rev": "v2.4.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-wKKrBSJkbdqqnDLoS+jhvI26rOzvMWjjsN8wh67Le5U="
   },

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -2,9 +2,9 @@
 let
   versions = if stdenv.isLinux then {
     stable = "0.0.27";
-    ptb = "0.0.42";
+    ptb = "0.0.43";
     canary = "0.0.161";
-    development = "0.0.216";
+    development = "0.0.217";
   } else {
     stable = "0.0.273";
     ptb = "0.0.59";
@@ -20,7 +20,7 @@ let
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        sha256 = "ZAMyAqyFEBJeTUqQzr5wK+BOFGURqhoHL8w2hJvL0vI=";
+        sha256 = "tG+QR62JcBYrvJS6KU6oAWSfQFdl68AMcU8E9Zahy2A=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
@@ -28,7 +28,7 @@ let
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        sha256 = "sha256-lQnIQC7Wek7OYDzZvLIJfb8I4oATD8pSB+mjQMPyqYQ=";
+        sha256 = "sha256-fzNFKrYo5qckrWZAkkiK337czCt6nOM1O8FeG18Q8Y0=";
       };
     };
     x86_64-darwin = {

pkgs/applications/networking/instant-messengers/gajim/default.nix

@@ -15,18 +15,17 @@
 , enableRST ? true, docutils
 , enableSpelling ? true, gspell
 , enableUPnP ? true, gupnp-igd
-, enableOmemoPluginDependencies ? true
 , enableAppIndicator ? true, libappindicator-gtk3
 , extraPythonPackages ? ps: []
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "1.7.3";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    hash = "sha256-t8yzWfdsY8pXye7Dn5hME0bOHgf+MzuyVY3hweXc0xg=";
+    hash = "sha256-EgH8mt0am2l9z4csGHH6rpLqTzFiBRzOPB4NCEP8TUM=";
   };
 
   format = "pyproject";
@@ -53,9 +52,9 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     nbxmpp pygobject3 dbus-python pillow css-parser precis-i18n keyring setuptools packaging gssapi
+    omemo-dr qrcode
   ] ++ lib.optionals enableE2E [ pycrypto python-gnupg ]
     ++ lib.optional enableRST docutils
-    ++ lib.optionals enableOmemoPluginDependencies [ python-axolotl qrcode ]
     ++ extraPythonPackages python3.pkgs;
 
   nativeCheckInputs = [ xvfb-run dbus ];
@@ -75,7 +74,7 @@ python3.pkgs.buildPythonApplication rec {
     ${python3.interpreter} -m unittest discover -s test/common -v
   '';
 
-  # test are broken in 1.7.3
+  # test are broken in 1.7.3, 1.8.0
   doCheck = false;
 
   # necessary for wrapGAppsHook

pkgs/applications/networking/instant-messengers/teams/default.nix

@@ -102,6 +102,10 @@ let
       mv share/teams $out/opt/
       mv share $out/share
 
+      mkdir -p $out/share/icons/hicolor/512x512/apps
+      mv $out/share/pixmaps/teams.png $out/share/icons/hicolor/512x512/apps
+      rmdir $out/share/pixmaps
+
       substituteInPlace $out/share/applications/teams.desktop \
         --replace /usr/bin/ ""
 

pkgs/applications/networking/mailreaders/ayatana-webmail/default.nix

@@ -0,0 +1,90 @@
+{ lib
+, fetchFromGitHub
+, gettext
+, gtk3
+, python3Packages
+, gdk-pixbuf
+, libnotify
+, glib
+, gobject-introspection
+, wrapGAppsHook
+# BTW libappindicator is also supported, but upstream recommends their
+# implementation, see:
+# https://github.com/AyatanaIndicators/ayatana-webmail/issues/24#issuecomment-1050352862
+, libayatana-appindicator
+, gsettings-desktop-schemas
+, libcanberra-gtk3
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "ayatana-webmail";
+  version = "22.12.15";
+
+  src = fetchFromGitHub {
+    owner = "AyatanaIndicators";
+    repo = "ayatana-webmail";
+    rev = version;
+    hash = "sha256-K2jqCWrY1i1wYdZVpjN/3TcVyWariOQQ4slZf6sEPRU=";
+  };
+  postConfigure = ''
+    # Fix fhs paths
+    substituteInPlace \
+      ayatanawebmail/accounts.py \
+      ayatanawebmail/actions.py \
+      ayatanawebmail/dialog.py \
+      --replace /usr/share $out/share
+  '';
+
+  buildInputs = [
+    gtk3
+    gdk-pixbuf
+    glib
+    libnotify
+    gettext
+    libayatana-appindicator
+    gsettings-desktop-schemas
+  ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+    glib # For compiling gsettings-schemas
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    urllib3
+    babel
+    psutil
+    secretstorage
+    polib
+    pygobject3
+    dbus-python
+  ];
+
+  # No tests, and they cause a failure
+  doCheck = false;
+
+  postInstall = ''
+    # Fix fhs paths
+    mv $out/${python3Packages.python.sitePackages}/etc $out
+    mv $out/${python3Packages.python.sitePackages}/usr/{bin,share} $out/
+    rmdir $out/${python3Packages.python.sitePackages}/usr
+    # Compile gsettings desktop schemas
+    glib-compile-schemas $out/share/glib-2.0/schemas
+  '';
+
+  # See https://nixos.org/nixpkgs/manual/#ssec-gnome-common-issues-double-wrapped
+  dontWrapGApps = true;
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ libcanberra-gtk3 ]})
+  '';
+
+  meta = with lib; {
+    description = "Webmail notifications and actions for any desktop";
+    homepage = "https://github.com/AyatanaIndicators/ayatana-webmail";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ doronbehar ];
+  };
+}

pkgs/applications/networking/mailreaders/electron-mail/default.nix

@@ -2,12 +2,12 @@
 
 let
   pname = "electron-mail";
-  version = "5.1.6";
+  version = "5.1.8";
   name = "ElectronMail-${version}";
 
   src = fetchurl {
     url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-linux-x86_64.AppImage";
-    sha256 = "sha256-lsXVsx7U43czWFWxAgwTUYTnUXSL4KPFnXLzUklieAo=";
+    sha256 = "sha256-btqlxFrQUyb728i99IE65A9jwEFNvJ5b6zji0kwwATU=";
   };
 
   appimageContents = appimageTools.extract { inherit name src; };

pkgs/applications/office/gnucash/default.nix

@@ -26,12 +26,12 @@
 
 stdenv.mkDerivation rec {
   pname = "gnucash";
-  version = "5.2";
+  version = "5.3";
 
   # raw source code doesn't work out of box; fetchFromGitHub not usable
   src = fetchurl {
     url = "https://github.com/Gnucash/gnucash/releases/download/${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-SCYXa35wu4ifmcIG+v+t2JJijXhSVxXp9xKOz0ixRoA=";
+    hash = "sha256-FFjLCMWF6unXJL7G8oErzAO76D7SlKRqeJeqqwGm8Vo=";
   };
 
   nativeBuildInputs = [

pkgs/applications/office/portfolio/default.nix

@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.64.0";
+  version = "0.64.1";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-8LebPYIML3YV8DsoLPQiH4Q6ETBTgZ7IpeGJDN2R7ro=";
+    hash = "sha256-R3Cj24dZ2wD1c29zRLGnuJm3wfc9+n/sNNW316HT9N4=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/electronics/kicad/base.nix

@@ -77,14 +77,13 @@ stdenv.mkDerivation rec {
   postPatch = lib.optionalString (!stable) ''
     substituteInPlace cmake/KiCadVersion.cmake \
       --replace "unknown" "${builtins.substring 0 10 src.rev}"
+
+    substituteInPlace cmake/CreateGitVersionHeader.cmake \
+      --replace "0000000000000000000000000000000000000000" "${src.rev}"
   '';
 
   makeFlags = optionals (debug) [ "CFLAGS+=-Og" "CFLAGS+=-ggdb" ];
 
-  # some ngspice tests attempt to write to $HOME/.cache/
-  XDG_CACHE_HOME = "$TMP";
-  # failing tests still attempt to create $HOME though
-
   cmakeFlags = [
     "-DKICAD_USE_EGL=ON"
     "-DOCC_INCLUDE_DIR=${opencascade-occt}/include/opencascade"
@@ -165,10 +164,24 @@ stdenv.mkDerivation rec {
   ++ optional (withNgspice) libngspice
   ++ optional (debug) valgrind;
 
+  # some ngspice tests attempt to write to $HOME/.cache/
+  # this could be and was resolved with XDG_CACHE_HOME = "$TMP";
+  # but failing tests still attempt to create $HOME
+  # and the newer CLI tests seem to also use $HOME...
+  HOME = "$TMP";
+
   # debug builds fail all but the python test
   doInstallCheck = !(debug);
   installCheckTarget = "test";
 
+  pythonForTests = python.withPackages(ps: with ps; [
+    numpy
+    pytest
+    cairosvg
+    pytest-image-diff
+  ]);
+  nativeInstallCheckInputs = optional (!stable) pythonForTests;
+
   dontStrip = debug;
 
   meta = {

pkgs/applications/science/electronics/kicad/versions.nix

@@ -25,23 +25,23 @@
   };
   "kicad-unstable" = {
     kicadVersion = {
-      version =			"2023-04-14";
+      version =			"2023-06-24";
       src = {
-        rev =			"4a3f77cd9dac9dc5921eb9beaa63d0d3c9c051e5";
+        rev =			"1c1849ec1a6614247abe4c623c086def2b3192e0";
-        sha256 =		"06dsiyvr7zn3cp13w0y63d1qmjlhzsqlvajkximg3pw5mmiljxrr";
+        sha256 =		"0faf4fw7nrfwdrl4pjqdyfzqbvb9jd4nk4aq83v1w358yqyk7zg9";
       };
     };
     libVersion = {
-      version =			"2023-04-14";
+      version =			"2023-06-24";
       libSources = {
-        symbols.rev =		"38d4e7e1ab6a9b5d9eee85f687e60467753b2135";
+        symbols.rev =		"43456780d309682f6da4a6f14710355b06fc4c5d";
-        symbols.sha256 =	"0df6fx9b19v6sxrfyggbisw72y66kiwqi05k8mldsgiw6q55gbkc";
+        symbols.sha256 =	"1ql2w3q3dv13ascw8s0hzwda486763qma7i2m877jw3p78gjhldr";
         templates.rev =		"867eef383a0f61015cb69677d5c632d78a2ea01a";
         templates.sha256 =	"1qi20mrsfn4fxmr1fyphmil2i9p2nzmwk5rlfchc5aq2194nj3lq";
-        footprints.rev =	"4da055a2d572ff87e7ecea97cf358ed8c1d46dfc";
+        footprints.rev =	"6a59a2d3940dbab7b3e8254a5b9bf06cc5330301";
-        footprints.sha256 =	"1xb84284dmcb7mbvzlrxb4v4km3ih7gq856h8cglf9jn8wzlnvrk";
+        footprints.sha256 =	"0jlz0ln9vzj1av1fmw8ma8kfqlb8w0r9vrfng19bkc3cgh9lvh9x";
-        packages3d.rev =	"0f43a0962437feb53bd2083e9f39efffb5a5dd90";
+        packages3d.rev =	"8a2c5c4c85457832f3320902456d066d29561806";
-        packages3d.sha256 =	"1nkk4325jh89vh52ykfnf9pz1k3jk5017gz6r2cia2v4b3jadi31";
+        packages3d.sha256 =	"0dmssyhqd94d9wj8w7g7xjan560b2rwcs540sgl0rc77cw2jify8";
       };
     };
   };

pkgs/applications/science/logic/klee/default.nix

@@ -45,30 +45,24 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "klee";
-  version = "2.3";
+  version = "3.0";
 
   src = fetchFromGitHub {
     owner = "klee";
     repo = "klee";
     rev = "v${version}";
-    sha256 = "sha256-E1c6K6Q+LAWm342W8I00JI6+LMvqmULHZLkv9Kj5RmY=";
+    hash = "sha256-y5lWmtIcLAthQ0oHYQNd+ir75YaxHZR9Jgiz+ZUFQjY=";
   };
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
     cryptominisat
     gperftools
-    lit # Configure phase checking for lit
     llvm
     sqlite
     stp
     z3
   ];
-
-  nativeBuildInputs = [
-    clang
-    cmake
-  ];
-
   nativeCheckInputs = [
     gtest
 
@@ -83,8 +77,9 @@ in stdenv.mkDerivation rec {
   in [
     "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else if !debug && includeDebugInfo then "RelWithDebInfo" else "MinSizeRel"}"
     "-DKLEE_RUNTIME_BUILD_TYPE=${if debugRuntime then "Debug" else "Release"}"
+    "-DLLVMCC=${clang}/bin/clang"
+    "-DLLVMCXX=${clang}/bin/clang++"
     "-DKLEE_ENABLE_TIMESTAMP=${onOff false}"
-    "-DENABLE_KLEE_UCLIBC=${onOff true}"
     "-DKLEE_UCLIBC_PATH=${kleeuClibc}"
     "-DENABLE_KLEE_ASSERTS=${onOff asserts}"
     "-DENABLE_POSIX_RUNTIME=${onOff true}"

pkgs/applications/version-management/git-machete/default.nix

@@ -12,13 +12,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.17.4";
+  version = "3.17.6";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-g3SEUVcyr6+nt0zMHB1F4drCwmQvPYQErOwSl9I+1Tg=";
+    hash = "sha256-o3Z1xPu5RcspU4m3Bb6ydZkXOMgOMJPN/+TLekwe/wI=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/version-management/gitlab/data.json

@@ -1,14 +1,14 @@
 {
-  "version": "16.0.5",
+  "version": "16.1.0",
-  "repo_hash": "sha256-hUEPJMdmR+p7nHWjdS+9SXcgm0LciPC9at+GP9UcUvI=",
+  "repo_hash": "sha256-sRel6okv2NYV4As3+AudqVvJ1/eLQGJGFvs+BA14wis=",
-  "yarn_hash": "0yy04jnfvn5dgciqd105xiwg7chjwp3w6iqbjpylak9h82ci6wlh",
+  "yarn_hash": "1cqyf06810ls94nkys0l4p86ni902q32aqjp66m7j1x6ldh248al",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v16.0.5-ee",
+  "rev": "v16.1.0-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "16.0.5",
+    "GITALY_SERVER_VERSION": "16.1.0",
-    "GITLAB_PAGES_VERSION": "16.0.5",
+    "GITLAB_PAGES_VERSION": "16.1.0",
-    "GITLAB_SHELL_VERSION": "14.20.0",
+    "GITLAB_SHELL_VERSION": "14.23.0",
-    "GITLAB_WORKHORSE_VERSION": "16.0.5"
+    "GITLAB_WORKHORSE_VERSION": "16.1.0"
   }
 }

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "16.0.5";
+  version = "16.1.0";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -24,10 +24,10 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      sha256 = "sha256-YhqKMFDjjL2I82m51GdKNVO8vdJPppDKZDBQGskpyA4=";
+      sha256 = "sha256-+Fnj9fgQQtyGMWOL5NkNON/N9p6POjAtpF2O06iKh90=";
     };
 
-    vendorSha256 = "sha256-KBhTI70eReZGSd7RxwGXcUGa0wDo7q5tU9fUhrLeFO0=";
+    vendorSha256 = "sha256-6oOFQGPwiMRQrESXsQsGzvWz9bCb0VTYIyyG/C2b3nA=";
 
     ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];
 

pkgs/applications/version-management/gitlab/gitlab-pages/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "16.0.5";
+  version = "16.1.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    sha256 = "sha256-bZwq8nG3QmPCgfuBUQW6LQdi7F1+n2JfzfU3oP+QCJw=";
+    sha256 = "sha256-vAprB+pDwpr2Wq4aM0wnHlNzUvc1ajasdORwT0LDTTY=";
   };
 
-  vendorHash = "sha256-s3HHoz9URACuVVhePQQFviTqlQU7vCLOjTJPBlus1Vo=";
+  vendorHash = "sha256-SN4r9hcTTQUr3miv2Cm7iBryyh7yG1xx9lCvq3vQwc0=";
   subPackages = [ "." ];
 
   meta = with lib; {

pkgs/applications/version-management/gitlab/gitlab-shell/default.nix

@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.20.0";
+  version = "14.23.0";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-5rjrBt0AihSHMYOD6JbXGvvFaUbtYnMHX2Z4K+Svno0=";
+    sha256 = "sha256-nQJq9aPC5YtTbyiwtzKwDG95PnBr6XdNpSIJkfgvnzU=";
   };
 
   buildInputs = [ ruby libkrb5 ];
 
   patches = [ ./remove-hardcoded-locations.patch ];
 
-  vendorSha256 = "sha256-kKbTbOCuAGIbnFXTOZyoVRM5PIackbmND6PrryVvLTM=";
+  vendorSha256 = "sha256-JEWgOuWvtuaipF8fFTsFbB+sYfaHEYUl9Z8Q1XAuJuE=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "16.0.5";
+  version = "16.1.0";
 
   src = fetchFromGitLab {
     owner = data.owner;
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   sourceRoot = "source/workhorse";
 
-  vendorSha256 = "sha256-B9YZkqAMYvTnnWx2tYEF0VZ/+9LZaWS5euQ9ZX2m49E=";
+  vendorSha256 = "sha256-lKl/V2fti0eqrEoeJNNwvJbZO7z7v+5HlES+dyxxcP4=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;

pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch

@@ -53,7 +53,7 @@ index d096174fca3a..02d0f689c523 100644
  # Important: keep the satellites.path setting until GitLab 9.0 at
  # least. This setting is fed to 'rm -rf' in
 diff --git a/config/puma.rb.example b/config/puma.rb.example
-index 9fc354a8fe8..2352ca9b58c 100644
+index 07a6f6a25015..14a718a43202 100644
 --- a/config/puma.rb.example
 +++ b/config/puma.rb.example
 @@ -5,12 +5,8 @@
@@ -71,7 +71,7 @@ index 9fc354a8fe8..2352ca9b58c 100644
  
  # Configure "min" to be the minimum number of threads to use to answer
  # requests and "max" the maximum.
-@@ -31,12 +27,12 @@ queue_requests false
+@@ -31,11 +27,11 @@ queue_requests false
  
  # Bind the server to "url". "tcp://", "unix://" and "ssl://" are the only
  # accepted protocols.
@@ -81,14 +81,12 @@ index 9fc354a8fe8..2352ca9b58c 100644
  workers 3
  
 -require_relative "/home/git/gitlab/lib/gitlab/cluster/lifecycle_events"
--require_relative "/home/git/gitlab/lib/gitlab/cluster/puma_worker_killer_initializer"
 +require_relative ENV['GITLAB_PATH'] + "lib/gitlab/cluster/lifecycle_events"
-+require_relative ENV['GITLAB_PATH'] + "lib/gitlab/cluster/puma_worker_killer_initializer"
  
  on_restart do
    # Signal application hooks that we're about to restart
-@@ -80,7 +76,7 @@ if defined?(nakayoshi_fork)
+@@ -74,7 +70,7 @@ worker_timeout 60
- end
+ wait_for_less_busy_worker ENV.fetch('PUMA_WAIT_FOR_LESS_BUSY_WORKER', 0.001).to_f
  
  # Use json formatter
 -require_relative "/home/git/gitlab/lib/gitlab/puma_logging/json_formatter"

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile

@@ -25,7 +25,7 @@ gem 'responders', '~> 3.0'
 
 gem 'sprockets', '~> 3.7.0'
 
-gem 'view_component', '~> 2.82.0'
+gem 'view_component', '~> 3.2.0'
 
 # Supported DBs
 gem 'pg', '~> 1.5.3'
@@ -46,9 +46,9 @@ gem 'devise', '~> 4.8.1'
 gem 'devise-pbkdf2-encryptable', '~> 0.0.0', path: 'vendor/gems/devise-pbkdf2-encryptable'
 gem 'bcrypt', '~> 3.1', '>= 3.1.14'
 gem 'doorkeeper', '~> 5.6', '>= 5.6.6'
-gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.6'
+gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.7'
 gem 'rexml', '~> 3.2.5'
-gem 'ruby-saml', '~> 1.13.0'
+gem 'ruby-saml', '~> 1.15.0'
 gem 'omniauth', '~> 2.1.0'
 gem 'omniauth-auth0', '~> 3.1'
 gem 'omniauth-azure-activedirectory-v2', '~> 2.0'
@@ -61,6 +61,7 @@ gem 'omniauth-gitlab', '~> 4.0.0', path: 'vendor/gems/omniauth-gitlab' # See ven
 gem 'omniauth-google-oauth2', '~> 1.1'
 gem 'omniauth-oauth2-generic', '~> 0.2.2'
 gem 'omniauth-saml', '~> 2.1.0'
+gem 'omniauth-shibboleth-redux', '~> 2.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.4.0', path: 'vendor/gems/omniauth_crowd' # See vendor/gems/omniauth_crowd/README.md
 gem 'omniauth_openid_connect', '~> 0.6.1'
@@ -105,13 +106,13 @@ gem 'gpgme', '~> 2.0.22'
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master
 gem 'gitlab_omniauth-ldap', '~> 2.2.0', require: 'omniauth-ldap'
-gem 'net-ldap', '~> 0.17.1'
+gem 'net-ldap', '~> 0.18.0'
 
 # API
-gem 'grape', '~> 1.5.2'
+gem 'grape', '~> 1.7.0'
 gem 'grape-entity', '~> 0.10.0'
 gem 'rack-cors', '~> 1.1.1', require: 'rack/cors'
-gem 'grape-swagger', '~>1.5.0', group: [:development, :test]
+gem 'grape-swagger', '~> 1.6.1', group: [:development, :test]
 gem 'grape-swagger-entity', '~> 0.5.1', group: [:development, :test]
 
 # GraphQL API
@@ -172,9 +173,9 @@ gem 'seed-fu', '~> 2.3.7'
 gem 'elasticsearch-model', '~> 7.2'
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation'
 gem 'elasticsearch-api',   '7.13.3'
-gem 'aws-sdk-core', '~> 3.172.0'
+gem 'aws-sdk-core', '~> 3.175.0'
 gem 'aws-sdk-cloudformation', '~> 1'
-gem 'aws-sdk-s3', '~> 1.122.0'
+gem 'aws-sdk-s3', '~> 1.126.0'
 gem 'faraday_middleware-aws-sigv4', '~>0.3.0'
 gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections
 
@@ -182,7 +183,7 @@ gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive
 gem 'html-pipeline', '~> 2.14.3'
 gem 'deckar01-task_list', '2.3.2'
 gem 'gitlab-markup', '~> 1.9.0', require: 'github/markup'
-gem 'commonmarker', '~> 0.23.6'
+gem 'commonmarker', '~> 0.23.9'
 gem 'kramdown', '~> 2.3.1'
 gem 'RedCloth', '~> 4.3.2'
 gem 'rdoc', '~> 6.3.2'
@@ -193,9 +194,9 @@ gem 'asciidoctor', '~> 2.0.18'
 gem 'asciidoctor-include-ext', '~> 0.4.0', require: false
 gem 'asciidoctor-plantuml', '~> 0.0.16'
 gem 'asciidoctor-kroki', '~> 0.8.0', require: false
-gem 'rouge', '~> 4.1.0'
+gem 'rouge', '~> 4.1.2'
 gem 'truncato', '~> 0.7.12'
-gem 'nokogiri', '~> 1.14.3'
+gem 'nokogiri', '~> 1.15', '>= 1.15.2'
 
 # Calendar rendering
 gem 'icalendar'
@@ -210,8 +211,7 @@ gem 'rack', '~> 2.2.7'
 gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base'
 
 group :puma do
-  gem 'puma', '~> 5.6.5', require: false
+  gem 'puma', '~> 6.3', require: false
-  gem 'puma_worker_killer', '~> 0.3.1', require: false
   gem 'sd_notify', '~> 0.1.0', require: false
 end
 
@@ -288,10 +288,10 @@ gem 'circuitbox', '2.0.0'
 
 # Sanitize user input
 gem 'sanitize', '~> 6.0'
-gem 'babosa', '~> 1.0.4'
+gem 'babosa', '~> 2.0'
 
 # Sanitizes SVG input
-gem 'loofah', '~> 2.21.0'
+gem 'loofah', '~> 2.21.3'
 
 # Working with license
 # Detects the open source license the repository includes
@@ -323,7 +323,7 @@ gem 'gon', '~> 6.4.0'
 gem 'request_store', '~> 1.5.1'
 gem 'base32', '~> 0.3.0'
 
-gem 'gitlab-license', '~> 2.2.1'
+gem 'gitlab-license', '~> 2.3'
 
 # Protect against bruteforcing
 gem 'rack-attack', '~> 6.6.1'
@@ -336,11 +336,11 @@ gem 'sentry-sidekiq', '~> 5.8.0'
 
 # PostgreSQL query parsing
 #
-gem 'pg_query', '~> 2.2', '>= 2.2.1'
+gem 'pg_query', '~> 4.2.1'
 
 gem 'premailer-rails', '~> 1.10.3'
 
-gem 'gitlab-labkit', '~> 0.32.0'
+gem 'gitlab-labkit', '~> 0.33.0'
 gem 'thrift', '>= 0.16.0'
 
 # I18n
@@ -363,12 +363,12 @@ gem 'snowplow-tracker', '~> 0.8.0'
 
 # Metrics
 gem 'webrick', '~> 1.8.1', require: false
-gem 'prometheus-client-mmap', '~> 0.23', require: 'prometheus/client'
+gem 'prometheus-client-mmap', '~> 0.25', require: 'prometheus/client'
 
 gem 'warning', '~> 1.3.0'
 
 group :development do
-  gem 'lefthook', '~> 1.3.13', require: false
+  gem 'lefthook', '~> 1.4.2', require: false
   gem 'rubocop'
   gem 'solargraph', '~> 0.47.2', require: false
 
@@ -376,7 +376,7 @@ group :development do
   gem 'lookbook', '~> 2.0', '>= 2.0.1'
 
   # Better errors handler
-  gem 'better_errors', '~> 2.10.0'
+  gem 'better_errors', '~> 2.10.1'
 
   gem 'sprite-factory', '~> 1.7'
 
@@ -386,6 +386,7 @@ end
 group :development, :test do
   gem 'deprecation_toolkit', '~> 1.5.1', require: false
   gem 'bullet', '~> 7.0.2'
+  gem 'parser', '~> 3.2', '>= 3.2.2.3'
   gem 'pry-byebug'
   gem 'pry-rails', '~> 0.3.9'
   gem 'pry-shell', '~> 0.6.1'
@@ -453,7 +454,7 @@ group :test do
   gem 'rspec-benchmark', '~> 0.6.0'
   gem 'rspec-parameterized', '~> 1.0', require: false
 
-  gem 'capybara', '~> 3.39'
+  gem 'capybara', '~> 3.39', '>= 3.39.1'
   gem 'capybara-screenshot', '~> 1.0.26'
   # 4.9.1 drops Ruby 2.7 support. We can upgrade further after we drop Ruby 2.7 support.
   gem 'selenium-webdriver', '= 4.9.0'
@@ -472,6 +473,8 @@ group :test do
 
   # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
   gem 'derailed_benchmarks', require: false
+
+  gem 'gitlab_quality-test_tooling', '~> 0.8.1', require: false
 end
 
 gem 'octokit', '~> 4.15'
@@ -506,14 +509,14 @@ gem 'ssh_data', '~> 1.3'
 gem 'spamcheck', '~> 1.3.0'
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 15.9.0-rc3'
+gem 'gitaly', '~> 16.1.0-rc2'
 
 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.1.0'
 
 gem 'grpc', '~> 1.42.0'
 
-gem 'google-protobuf', '~> 3.22', '>= 3.22.3'
+gem 'google-protobuf', '~> 3.23', '>= 3.23.3'
 
 gem 'toml-rb', '~> 2.2.0'
 
@@ -587,7 +590,7 @@ gem 'cvss-suite', '~> 3.0.1', require: 'cvss_suite'
 gem 'arr-pm', '~> 0.0.12'
 
 # Remote Development
-gem 'devfile', '~> 0.0.17.pre.alpha1'
+gem 'devfile', '~> 0.0.19.pre.alpha1'
 
 # Apple plist parsing
 gem 'CFPropertyList', '~> 3.0.0'
@@ -599,5 +602,8 @@ gem 'telesignenterprise', '~> 2.2'
 # BufferedIO patch
 # Updating this version will require updating scripts/allowed_warnings.txt
 gem 'net-protocol', '~> 0.1.3'
+# Lock this until we make DNS rebinding work with the updated net-http:
+# https://gitlab.com/gitlab-org/gitlab/-/issues/413528
+gem 'net-http', '= 0.1.1'
 
 gem 'duo_api', '~> 1.3'

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock

@@ -203,7 +203,7 @@ GEM
     aws-sdk-cloudformation (1.41.0)
       aws-sdk-core (~> 3, >= 3.99.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.172.0)
+    aws-sdk-core (3.175.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
@@ -211,8 +211,8 @@ GEM
     aws-sdk-kms (1.64.0)
       aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.122.0)
+    aws-sdk-s3 (1.126.0)
-      aws-sdk-core (~> 3, >= 3.165.0)
+      aws-sdk-core (~> 3, >= 3.174.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.4)
     aws-sigv4 (1.5.1)
@@ -236,7 +236,7 @@ GEM
       faraday_middleware (~> 1.0, >= 1.0.0.rc1)
       net-http-persistent (~> 4.0)
       nokogiri (~> 1, >= 1.10.8)
-    babosa (1.0.4)
+    babosa (2.0.0)
     backport (1.2.0)
     base32 (0.3.2)
     batch-loader (2.0.1)
@@ -248,7 +248,7 @@ GEM
       memory_profiler (~> 1)
     benchmark-perf (0.6.0)
     benchmark-trend (0.4.0)
-    better_errors (2.10.0)
+    better_errors (2.10.1)
       erubi (>= 1.0.0)
       rack (>= 0.9.0)
       rouge (>= 1.0.0)
@@ -266,7 +266,7 @@ GEM
       bundler (>= 1.2.0, < 3)
       thor (>= 0.18, < 2)
     byebug (11.1.3)
-    capybara (3.39.0)
+    capybara (3.39.1)
       addressable
       matrix
       mini_mime (>= 0.1.3)
@@ -307,7 +307,7 @@ GEM
     coercible (1.0.0)
       descendants_tracker (~> 0.0.1)
     colored2 (3.1.2)
-    commonmarker (0.23.6)
+    commonmarker (0.23.9)
     concurrent-ruby (1.2.2)
     connection_pool (2.3.0)
     cork (0.3.0)
@@ -367,7 +367,7 @@ GEM
       thor (>= 0.19, < 2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devfile (0.0.17.pre.alpha1)
+    devfile (0.0.19.pre.alpha1)
     device_detector (1.0.0)
     devise (4.8.1)
       bcrypt (~> 3.0)
@@ -393,30 +393,24 @@ GEM
       unf (>= 0.0.5, < 1.0.0)
     doorkeeper (5.6.6)
       railties (>= 5)
-    doorkeeper-openid_connect (1.8.6)
+    doorkeeper-openid_connect (1.8.7)
       doorkeeper (>= 5.5, < 5.7)
       jwt (>= 2.5)
     dotenv (2.7.6)
-    dry-configurable (0.12.0)
+    dry-core (1.0.0)
       concurrent-ruby (~> 1.0)
-      dry-core (~> 0.5, >= 0.5.0)
+      zeitwerk (~> 2.6)
-    dry-container (0.7.2)
+    dry-inflector (1.0.0)
+    dry-logic (1.5.0)
       concurrent-ruby (~> 1.0)
-      dry-configurable (~> 0.1, >= 0.1.3)
+      dry-core (~> 1.0, < 2)
-    dry-core (0.5.0)
+      zeitwerk (~> 2.6)
+    dry-types (1.7.1)
       concurrent-ruby (~> 1.0)
-    dry-equalizer (0.3.0)
+      dry-core (~> 1.0)
-    dry-inflector (0.2.0)
+      dry-inflector (~> 1.0)
-    dry-logic (1.1.0)
+      dry-logic (~> 1.4)
-      concurrent-ruby (~> 1.0)
+      zeitwerk (~> 2.6)
-      dry-core (~> 0.5, >= 0.5)
-    dry-types (1.4.0)
-      concurrent-ruby (~> 1.0)
-      dry-container (~> 0.3)
-      dry-core (~> 0.4, >= 0.4.4)
-      dry-equalizer (~> 0.3)
-      dry-inflector (~> 0.1, >= 0.1.2)
-      dry-logic (~> 1.0, >= 1.0.2)
     dumb_delegator (1.0.0)
     duo_api (1.3.0)
     e2mmap (0.1.0)
@@ -581,7 +575,7 @@ GEM
       rails (>= 3.2.0)
     git (1.11.0)
       rchardet (~> 1.8)
-    gitaly (15.9.0.pre.rc3)
+    gitaly (16.1.0.pre.rc2)
       grpc (~> 1.0)
     gitlab (4.19.0)
       httparty (~> 0.20)
@@ -602,15 +596,15 @@ GEM
       fog-json (~> 1.2.0)
       mime-types
       ms_rest_azure (~> 0.12.0)
-    gitlab-labkit (0.32.0)
+    gitlab-labkit (0.33.0)
       actionpack (>= 5.0.0, < 8.0.0)
       activesupport (>= 5.0.0, < 8.0.0)
       grpc (>= 1.37)
       jaeger-client (~> 1.1.0)
       opentracing (~> 0.4)
-      pg_query (~> 2.1)
+      pg_query (~> 4.2.1)
       redis (> 3.0.0, < 6.0.0)
-    gitlab-license (2.2.2)
+    gitlab-license (2.3.0)
     gitlab-mail_room (0.0.23)
       jwt (>= 2.0)
       net-imap (>= 0.2.1)
@@ -630,6 +624,15 @@ GEM
       omniauth (>= 1.3, < 3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
+    gitlab_quality-test_tooling (0.8.1)
+      activesupport (>= 6.1, < 7.1)
+      gitlab (~> 4.19)
+      http (~> 5.0)
+      nokogiri (~> 1.10)
+      parallel (>= 1, < 2)
+      rainbow (>= 3, < 4)
+      table_print (= 1.5.7)
+      zeitwerk (>= 2, < 3)
     globalid (1.1.0)
       activesupport (>= 5.0)
     gon (6.4.0)
@@ -691,7 +694,7 @@ GEM
       google-cloud-core (~> 1.6)
       googleauth (>= 0.16.2, < 2.a)
       mini_mime (~> 1.0)
-    google-protobuf (3.22.3)
+    google-protobuf (3.23.3)
     googleapis-common-protos (1.4.0)
       google-protobuf (~> 3.14)
       googleapis-common-protos-types (~> 1.2)
@@ -707,7 +710,7 @@ GEM
       signet (>= 0.16, < 2.a)
     gpgme (2.0.22)
       mini_portile2 (~> 2.7)
-    grape (1.5.2)
+    grape (1.7.0)
       activesupport
       builder
       dry-types (>= 1.1)
@@ -722,7 +725,7 @@ GEM
       grape (~> 1.3)
       rake (> 12)
       ruby2_keywords (~> 0.0.2)
-    grape-swagger (1.5.0)
+    grape-swagger (1.6.1)
       grape (~> 1.3)
     grape-swagger-entity (0.5.1)
       grape-entity (>= 0.6.0)
@@ -878,7 +881,7 @@ GEM
       rest-client (~> 2.0)
     launchy (2.5.0)
       addressable (~> 2.7)
-    lefthook (1.3.13)
+    lefthook (1.4.2)
     letter_opener (1.7.0)
       launchy (~> 2.2)
     letter_opener_web (2.0.0)
@@ -913,9 +916,9 @@ GEM
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.21.0)
+    loofah (2.21.3)
       crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
+      nokogiri (>= 1.12.0)
     lookbook (2.0.1)
       activemodel
       css_parser
@@ -949,7 +952,7 @@ GEM
     mini_histogram (0.3.1)
     mini_magick (4.10.1)
     mini_mime (1.1.2)
-    mini_portile2 (2.8.1)
+    mini_portile2 (2.8.2)
     minitest (5.11.3)
     mixlib-cli (2.1.8)
     mixlib-config (3.0.9)
@@ -971,20 +974,23 @@ GEM
     multi_xml (0.6.0)
     multipart-post (2.2.3)
     murmurhash3 (0.1.7)
-    mustermann (1.1.1)
+    mustermann (3.0.0)
       ruby2_keywords (~> 0.0.1)
-    mustermann-grape (1.0.1)
+    mustermann-grape (1.0.2)
       mustermann (>= 1.0.0)
     nap (1.1.0)
     neighbor (0.2.3)
       activerecord (>= 5.2)
     nenv (0.3.0)
+    net-http (0.1.1)
+      net-protocol
+      uri
     net-http-persistent (4.0.1)
       connection_pool (~> 2.2)
     net-imap (0.3.4)
       date
       net-protocol
-    net-ldap (0.17.1)
+    net-ldap (0.18.0)
     net-ntp (2.1.3)
     net-pop (0.1.2)
       net-protocol
@@ -998,8 +1004,8 @@ GEM
     netrc (0.11.0)
     nio4r (2.5.8)
     no_proxy_fix (0.1.2)
-    nokogiri (1.14.3)
+    nokogiri (1.15.2)
-      mini_portile2 (~> 2.8.0)
+      mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     notiffany (0.1.3)
       nenv (~> 0.1)
@@ -1070,6 +1076,8 @@ GEM
     omniauth-saml (2.1.0)
       omniauth (~> 2.0)
       ruby-saml (~> 1.12)
+    omniauth-shibboleth-redux (2.0.0)
+      omniauth (>= 2.0.0)
     omniauth-twitter (1.4.0)
       omniauth-oauth (~> 1.1)
       rack
@@ -1120,16 +1128,17 @@ GEM
       expgen (~> 0.1)
       rainbow (~> 3.1.1)
     parallel (1.22.1)
-    parser (3.2.0.0)
+    parser (3.2.2.3)
       ast (~> 2.4.1)
+      racc
     parslet (1.8.2)
     pastel (0.8.0)
       tty-color (~> 0.5)
     peek (1.1.0)
       railties (>= 4.0.0)
     pg (1.5.3)
-    pg_query (2.2.1)
+    pg_query (4.2.1)
-      google-protobuf (>= 3.19.2)
+      google-protobuf (>= 3.22.3)
     plist (3.6.0)
     png_quantizator (0.2.1)
     po_to_json (1.0.1)
@@ -1145,7 +1154,7 @@ GEM
       coderay
       parser
       unparser
-    prometheus-client-mmap (0.23.1)
+    prometheus-client-mmap (0.25.0)
       rb_sys (~> 0.9)
     pry (0.14.2)
       coderay (~> 1.1)
@@ -1160,11 +1169,8 @@ GEM
       tty-markdown
       tty-prompt
     public_suffix (5.0.0)
-    puma (5.6.5)
+    puma (6.3.0)
       nio4r (~> 2.0)
-    puma_worker_killer (0.3.1)
-      get_process_mem (~> 0.2)
-      puma (>= 2.7)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.4.0)
     racc (1.6.2)
@@ -1226,7 +1232,7 @@ GEM
     rb-fsevent (0.11.2)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rb_sys (0.9.75)
+    rb_sys (0.9.78)
     rbtrace (0.4.14)
       ffi (>= 1.0.6)
       msgpack (>= 0.4.3)
@@ -1273,7 +1279,7 @@ GEM
     rexml (3.2.5)
     rinku (2.0.0)
     rotp (6.2.0)
-    rouge (4.1.0)
+    rouge (4.1.2)
     rqrcode (0.7.0)
       chunky_png
     rqrcode-rails3 (0.1.7)
@@ -1358,8 +1364,8 @@ GEM
     ruby-openai (3.7.0)
       httparty (>= 0.18.1)
     ruby-progressbar (1.11.0)
-    ruby-saml (1.13.0)
+    ruby-saml (1.15.0)
-      nokogiri (>= 1.10.5)
+      nokogiri (>= 1.13.10)
       rexml
     ruby-statistics (3.0.0)
     ruby2_keywords (0.0.5)
@@ -1503,6 +1509,7 @@ GEM
     sys-filesystem (1.4.3)
       ffi (~> 1.1)
     sysexits (1.2.0)
+    table_print (1.5.7)
     tanuki_emoji (0.6.0)
     telesign (2.2.4)
       net-http-persistent (>= 3.0.0, < 5.0)
@@ -1585,6 +1592,7 @@ GEM
     unparser (0.6.7)
       diff-lcs (~> 1.3)
       parser (>= 3.2.0)
+    uri (0.12.1)
     uri_template (0.7.0)
     valid_email (0.1.3)
       activemodel
@@ -1600,7 +1608,7 @@ GEM
       activesupport (>= 3.0)
     version_gem (1.1.0)
     version_sorter (2.3.0)
-    view_component (2.82.0)
+    view_component (3.2.0)
       activesupport (>= 5.2.0, < 8.0)
       concurrent-ruby (~> 1.0)
       method_source (~> 1.0)
@@ -1672,28 +1680,28 @@ DEPENDENCIES
   autoprefixer-rails (= 10.2.5.1)
   awesome_print
   aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.172.0)
+  aws-sdk-core (~> 3.175.0)
-  aws-sdk-s3 (~> 1.122.0)
+  aws-sdk-s3 (~> 1.126.0)
   axe-core-rspec
-  babosa (~> 1.0.4)
+  babosa (~> 2.0)
   base32 (~> 0.3.0)
   batch-loader (~> 2.0.1)
   bcrypt (~> 3.1, >= 3.1.14)
   benchmark-ips (~> 2.11.0)
   benchmark-memory (~> 0.1)
-  better_errors (~> 2.10.0)
+  better_errors (~> 2.10.1)
   bootsnap (~> 1.16.0)
   browser (~> 5.3.1)
   bullet (~> 7.0.2)
   bundler-audit (~> 0.7.0.1)
   bundler-checksum (~> 0.1.0)!
-  capybara (~> 3.39)
+  capybara (~> 3.39, >= 3.39.1)
   capybara-screenshot (~> 1.0.26)
   carrierwave (~> 1.3)
   charlock_holmes (~> 0.7.7)
   circuitbox (= 2.0.0)
   cloud_profiler_agent (~> 0.0.0)!
-  commonmarker (~> 0.23.6)
+  commonmarker (~> 0.23.9)
   concurrent-ruby (~> 1.1)
   connection_pool (~> 2.0)
   countries (~> 4.0.0)
@@ -1705,7 +1713,7 @@ DEPENDENCIES
   declarative_policy (~> 1.1.0)
   deprecation_toolkit (~> 1.5.1)
   derailed_benchmarks
-  devfile (~> 0.0.17.pre.alpha1)
+  devfile (~> 0.0.19.pre.alpha1)
   device_detector
   devise (~> 4.8.1)
   devise-pbkdf2-encryptable (~> 0.0.0)!
@@ -1714,7 +1722,7 @@ DEPENDENCIES
   diffy (~> 3.4)
   discordrb-webhooks (~> 3.4)
   doorkeeper (~> 5.6, >= 5.6.6)
-  doorkeeper-openid_connect (~> 1.8, >= 1.8.6)
+  doorkeeper-openid_connect (~> 1.8, >= 1.8.7)
   duo_api (~> 1.3)
   ed25519 (~> 1.3.0)
   elasticsearch-api (= 7.13.3)
@@ -1741,13 +1749,13 @@ DEPENDENCIES
   gettext (~> 3.3)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 15.9.0.pre.rc3)
+  gitaly (~> 16.1.0.pre.rc2)
   gitlab-chronic (~> 0.10.5)
   gitlab-dangerfiles (~> 3.10.0)
   gitlab-experiment (~> 0.7.1)
   gitlab-fog-azure-rm (~> 1.7.0)
-  gitlab-labkit (~> 0.32.0)
+  gitlab-labkit (~> 0.33.0)
-  gitlab-license (~> 2.2.1)
+  gitlab-license (~> 2.3)
   gitlab-mail_room (~> 0.0.23)
   gitlab-markup (~> 1.9.0)
   gitlab-net-dns (~> 0.9.2)
@@ -1755,6 +1763,7 @@ DEPENDENCIES
   gitlab-styles (~> 10.0.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.2.0)
+  gitlab_quality-test_tooling (~> 0.8.1)
   gon (~> 6.4.0)
   google-apis-androidpublisher_v3 (~> 0.34.0)
   google-apis-cloudbilling_v1 (~> 0.21.0)
@@ -1767,12 +1776,12 @@ DEPENDENCIES
   google-apis-serviceusage_v1 (~> 0.28.0)
   google-apis-sqladmin_v1beta4 (~> 0.41.0)
   google-cloud-storage (~> 1.44.0)
-  google-protobuf (~> 3.22, >= 3.22.3)
+  google-protobuf (~> 3.23, >= 3.23.3)
   gpgme (~> 2.0.22)
-  grape (~> 1.5.2)
+  grape (~> 1.7.0)
   grape-entity (~> 0.10.0)
   grape-path-helpers (~> 1.7.1)
-  grape-swagger (~> 1.5.0)
+  grape-swagger (~> 1.6.1)
   grape-swagger-entity (~> 0.5.1)
   grape_logging (~> 1.8)
   graphiql-rails (~> 1.8)
@@ -1806,14 +1815,14 @@ DEPENDENCIES
   knapsack (~> 1.21.1)
   kramdown (~> 2.3.1)
   kubeclient (~> 4.11.0)
-  lefthook (~> 1.3.13)
+  lefthook (~> 1.4.2)
   letter_opener_web (~> 2.0.0)
   license_finder (~> 7.0)
   licensee (~> 9.15)
   listen (~> 3.7)
   lockbox (~> 1.1.1)
   lograge (~> 0.5)
-  loofah (~> 2.21.0)
+  loofah (~> 2.21.3)
   lookbook (~> 2.0, >= 2.0.1)
   lru_redux
   mail (= 2.8.1)
@@ -1825,10 +1834,11 @@ DEPENDENCIES
   minitest (~> 5.11.0)
   multi_json (~> 1.14.1)
   neighbor (~> 0.2.3)
-  net-ldap (~> 0.17.1)
+  net-http (= 0.1.1)
+  net-ldap (~> 0.18.0)
   net-ntp
   net-protocol (~> 0.1.3)
-  nokogiri (~> 1.14.3)
+  nokogiri (~> 1.15, >= 1.15.2)
   oauth2 (~> 2.0)
   octokit (~> 4.15)
   ohai (~> 17.9)
@@ -1848,6 +1858,7 @@ DEPENDENCIES
   omniauth-oauth2-generic (~> 0.2.2)
   omniauth-salesforce (~> 1.0.5)!
   omniauth-saml (~> 2.1.0)
+  omniauth-shibboleth-redux (~> 2.0)
   omniauth-twitter (~> 1.4)
   omniauth_crowd (~> 2.4.0)!
   omniauth_openid_connect (~> 0.6.1)
@@ -1856,18 +1867,18 @@ DEPENDENCIES
   org-ruby (~> 0.9.12)
   pact (~> 1.63)
   parallel (~> 1.19)
+  parser (~> 3.2, >= 3.2.2.3)
   parslet (~> 1.8)
   peek (~> 1.1)
   pg (~> 1.5.3)
-  pg_query (~> 2.2, >= 2.2.1)
+  pg_query (~> 4.2.1)
   png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
-  prometheus-client-mmap (~> 0.23)
+  prometheus-client-mmap (~> 0.25)
   pry-byebug
   pry-rails (~> 0.3.9)
   pry-shell (~> 0.6.1)
-  puma (~> 5.6.5)
+  puma (~> 6.3)
-  puma_worker_killer (~> 0.3.1)
   rack (~> 2.2.7)
   rack-attack (~> 6.6.1)
   rack-cors (~> 1.1.1)
@@ -1889,7 +1900,7 @@ DEPENDENCIES
   responders (~> 3.0)
   retriable (~> 3.1.2)
   rexml (~> 3.2.5)
-  rouge (~> 4.1.0)
+  rouge (~> 4.1.2)
   rqrcode-rails3 (~> 0.1.7)
   rspec-benchmark (~> 0.6.0)
   rspec-parameterized (~> 1.0)
@@ -1902,7 +1913,7 @@ DEPENDENCIES
   ruby-magic (~> 0.6)
   ruby-openai (~> 3.7)
   ruby-progressbar (~> 1.10)
-  ruby-saml (~> 1.13.0)
+  ruby-saml (~> 1.15.0)
   ruby_parser (~> 3.20)
   rubyzip (~> 2.3.2)
   rugged (~> 1.5)
@@ -1952,7 +1963,7 @@ DEPENDENCIES
   valid_email (~> 0.1)
   validates_hostname (~> 1.0.11)
   version_sorter (~> 2.3)
-  view_component (~> 2.82.0)
+  view_component (~> 3.2.0)
   vmstat (~> 2.3.0)
   warning (~> 1.3.0)
   webauthn (~> 3.0)
@@ -1962,4 +1973,4 @@ DEPENDENCIES
   yajl-ruby (~> 1.4.3)
 
 BUNDLED WITH
-   2.4.13
+   2.4.14

pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix

@@ -401,10 +401,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06scfn1qjfqvgr05ddrcbihlnfi7bffk8r0m5z536w4mm1s3gh6x";
+      sha256 = "1fbbzcszpdjy2yzxfvl5fzgn0jgznkwxvqpb46nxv69gqhv3dpsg";
       type = "gem";
     };
-    version = "3.172.0";
+    version = "3.175.0";
   };
   aws-sdk-kms = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
@@ -423,10 +423,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01cryf8kfkmlsxb327szcwcagsp7lss5gmk6zxlgap65lv8bc7rx";
+      sha256 = "17ya49rwjzimqhzsj6vlc4xfvj2sixy04kr4b6ddg3r6y0jrsixi";
       type = "gem";
     };
-    version = "1.122.0";
+    version = "1.126.0";
   };
   aws-sigv4 = {
     dependencies = ["aws-eventstream"];
@@ -499,10 +499,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16dwqn33kmxkqkv51cwiikdkbrdjfsymlnc0rgbjwilmym8a9phq";
+      sha256 = "19mqrnyizr1ipdp26vhrg0hwb851bwyvrs6xc29dk3ywljw8s8d6";
       type = "gem";
     };
-    version = "1.0.4";
+    version = "2.0.0";
   };
   backport = {
     groups = ["default" "development"];
@@ -611,10 +611,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fhi891k7c4l967bacahq2jhnxswfmbpmbsg1yapczwpm1ynmaz3";
+      sha256 = "0wqazisnn6hn1wsza412xribpw5wzx6b5z5p4mcpfgizr6xg367p";
       type = "gem";
     };
-    version = "2.10.0";
+    version = "2.10.1";
   };
   bindata = {
     groups = ["default"];
@@ -720,10 +720,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06b4nlhirsq8ny17s8zgz7qyvl9v41rixj1xkviiiwxlnjz982d3";
+      sha256 = "1qhg45jxxy5h90frmajrrh5sirmj29sbfhbf7q0qhjymc0w1p0r5";
       type = "gem";
     };
-    version = "3.39.0";
+    version = "3.39.1";
   };
   capybara-screenshot = {
     dependencies = ["capybara" "launchy"];
@@ -911,10 +911,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0f3v6ffikj694h925zvfzgx995q6l1ixnqpph3qpnjdsyjpsmbn8";
+      sha256 = "074162raa8pc92q6833hgqdlfr3z5jgid9avdz5k25cnls2rqwrf";
       type = "gem";
     };
-    version = "0.23.6";
+    version = "0.23.9";
   };
   concurrent-ruby = {
     groups = ["default" "development" "test"];
@@ -1163,10 +1163,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0v34ivsfpc4d291j89jyg2jz970h94jbz01hdm2jwcmq798yfm98";
+      sha256 = "1n4yxjijplg0klcnjdhk7kxmvlb0szchk1ad8flg5hb2j59c8a6r";
       type = "gem";
     };
-    version = "0.0.17.pre.alpha1";
+    version = "0.0.19.pre.alpha1";
   };
   device_detector = {
     groups = ["default"];
@@ -1300,10 +1300,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00z0n4ix21nvqk74hhz5ab811366pdjx99cn2i26yiwpwr1nbi4d";
+      sha256 = "11p7p3b0yb12xfdhxxsifc2mz0rj1hlgi8sbcwjzxvld24rszvbi";
       type = "gem";
     };
-    version = "1.8.6";
+    version = "1.8.7";
   };
   dotenv = {
     groups = ["default"];
@@ -1315,80 +1315,48 @@ src:
     };
     version = "2.7.6";
   };
-  dry-configurable = {
-    dependencies = ["concurrent-ruby" "dry-core"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0rvwvxrvcygvgfc3xjrihvdvnr0dh2144s8x80zfgfnz0jd5gac7";
-      type = "gem";
-    };
-    version = "0.12.0";
-  };
-  dry-container = {
-    dependencies = ["concurrent-ruby" "dry-configurable"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1npnhs3x2xcwwijpys5c8rpcvymrlab0y8806nr4h425ld5q4wd0";
-      type = "gem";
-    };
-    version = "0.7.2";
-  };
   dry-core = {
-    dependencies = ["concurrent-ruby"];
+    dependencies = ["concurrent-ruby" "zeitwerk"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "14s45hxcqpp2mbvwlwzn018i8qhcjzgkirigdrv31jd741rpgy9s";
+      sha256 = "01gks2hrp7nl3pzb487azvd25dlbrc40d5cpk4n0szwnf2c0k4ks";
       type = "gem";
     };
-    version = "0.5.0";
+    version = "1.0.0";
-  };
-  dry-equalizer = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0rsqpk0gjja6j6pjm0whx2px06cxr3h197vrwxp6k042p52r4v46";
-      type = "gem";
-    };
-    version = "0.3.0";
   };
   dry-inflector = {
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17mkdwglqsd9fg272y3zms7rixjgkb1km1xcb88ir5lxvk1jkky7";
+      sha256 = "09hnvna3lg2x36li63988kv664d0zvy7y0z33803yvrdr9hj7lka";
       type = "gem";
     };
-    version = "0.2.0";
+    version = "1.0.0";
   };
   dry-logic = {
-    dependencies = ["concurrent-ruby" "dry-core"];
+    dependencies = ["concurrent-ruby" "dry-core" "zeitwerk"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17dnc3g9y2nj42rdx2bdvsvvms10vgw4qzjb2iw2gln9hj8b797c";
+      sha256 = "05nldkc154r0qzlhss7n5klfiyyz05x2fkq08y13s34py6023vcr";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.5.0";
   };
   dry-types = {
-    dependencies = ["concurrent-ruby" "dry-container" "dry-core" "dry-equalizer" "dry-inflector" "dry-logic"];
+    dependencies = ["concurrent-ruby" "dry-core" "dry-inflector" "dry-logic" "zeitwerk"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1px1r5khlf4lw32gsrnnnsx7dvl2d94axx3h0b6zwxrhvfq3n038";
+      sha256 = "1f6dz0hm67rhybh6xq2s3vvr700cp43kf50z2lids62s2i0mh5hj";
       type = "gem";
     };
-    version = "1.4.0";
+    version = "1.7.1";
   };
   dumb_delegator = {
     groups = ["default" "test"];
@@ -2134,10 +2102,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gja1b2zirv1clavlg6c0c3xc0z2si2xvxcp9cd165q4lwh47ika";
+      sha256 = "1bz3i05lr1nzm35xg11blaq78v96sg49aw1yh4hj7wfk3cbdn1q0";
       type = "gem";
     };
-    version = "15.9.0.pre.rc3";
+    version = "16.1.0.pre.rc2";
   };
   gitlab = {
     dependencies = ["httparty" "terminal-table"];
@@ -2200,20 +2168,20 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vl64blqz850d5vahwpwyrsvw4iarn578p8bzmcw11imqpnk62pk";
+      sha256 = "0nz0g5s65wkicsn9ianqxi7ys2w666n226gfblzllcfy1z9siyyi";
       type = "gem";
     };
-    version = "0.32.0";
+    version = "0.33.0";
   };
   gitlab-license = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07pdi9zcifiw8vjv5zz5jdv2gmaq3rkyxfdkn0j3a0cdh9iwgjrc";
+      sha256 = "0ms1kf5nmclsnmd2xa9k273asmb73ivaykwrb3g7sq263j3y7jk0";
       type = "gem";
     };
-    version = "2.2.2";
+    version = "2.3.0";
   };
   gitlab-mail_room = {
     dependencies = ["jwt" "net-imap" "oauth2"];
@@ -2289,6 +2257,17 @@ src:
     };
     version = "2.2.0";
   };
+  gitlab_quality-test_tooling = {
+    dependencies = ["activesupport" "gitlab" "http" "nokogiri" "parallel" "rainbow" "table_print" "zeitwerk"];
+    groups = ["test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "02xwchhhfv8jkypap5pn1wjkdx92jxk4wsp71i2s0ymnqw98y401";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
   globalid = {
     dependencies = ["activesupport"];
     groups = ["default" "development" "test"];
@@ -2535,10 +2514,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xcg53yz44cqhcpb85w3ay80kvnniy0v441c9p08wb6zzia2mnq9";
+      sha256 = "1aczvz5jdslr1bfx08xrycp6ggdpaifdlh5hrdyd774mvcl0mg2d";
       type = "gem";
     };
-    version = "3.22.3";
+    version = "3.23.3";
   };
   googleapis-common-protos = {
     dependencies = ["google-protobuf" "googleapis-common-protos-types" "grpc"];
@@ -2586,14 +2565,14 @@ src:
   };
   grape = {
     dependencies = ["activesupport" "builder" "dry-types" "mustermann-grape" "rack" "rack-accept"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0adf01kihxbmh8q84r6zyfgdmpbyb0lwcar3fi8j6bl6qcsbgwqx";
+      sha256 = "0lbgysx2d64hsck11jajc4gwikj5nd82809bz0jibrnp4yb1lcw8";
       type = "gem";
     };
-    version = "1.5.2";
+    version = "1.7.0";
   };
   grape-entity = {
     dependencies = ["activesupport" "multi_json"];
@@ -2623,10 +2602,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zy84lxrnnslray9rmfgb7ri295wda3cxx3xryz4lr5hd8r5p24w";
+      sha256 = "17y6smk7shplblgic4jvi5njhd0x91n1xrvds3l6cjsjfs2d7lhg";
       type = "gem";
     };
-    version = "1.5.0";
+    version = "1.6.1";
   };
   grape-swagger-entity = {
     dependencies = ["grape-entity" "grape-swagger"];
@@ -3292,10 +3271,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wnz60wh2yb7s5g7an64cw2brl9vvw960xnq4gs3q6drlgmbjl8g";
+      sha256 = "0hqffqr2krk6gcjapriwwmdrjz56dczshxafnwrkipyxi51vwgvh";
       type = "gem";
     };
-    version = "1.3.13";
+    version = "1.4.2";
   };
   letter_opener = {
     dependencies = ["launchy"];
@@ -3410,10 +3389,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nq23yca06rq8qxxymh4nfbx484k2yll54y780b4ilyvmcipyh7c";
+      sha256 = "1p744kjpb5zk2ihklbykzii77alycjc04vpnm2ch2f3cp65imlj3";
       type = "gem";
     };
-    version = "2.21.0";
+    version = "2.21.3";
   };
   lookbook = {
     dependencies = ["activemodel" "css_parser" "htmlbeautifier" "htmlentities" "marcel" "railties" "redcarpet" "rouge" "view_component" "yard" "zeitwerk"];
@@ -3598,10 +3577,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1af4yarhbbx62f7qsmgg5fynrik0s36wjy3difkawy536xg343mp";
+      sha256 = "0z7f38iq37h376n9xbl4gajdrnwzq284c9v1py4imw3gri2d5cj6";
       type = "gem";
     };
-    version = "2.8.1";
+    version = "2.8.2";
   };
   minitest = {
     groups = ["development" "test"];
@@ -3729,25 +3708,25 @@ src:
   };
   mustermann = {
     dependencies = ["ruby2_keywords"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ccm54qgshr1lq3pr1dfh7gphkilc19dp63rw6fcx7460pjwy88a";
+      sha256 = "0rwbq20s2gdh8dljjsgj5s6wqqfmnbclhvv2c2608brv7jm6jdbd";
       type = "gem";
     };
-    version = "1.1.1";
+    version = "3.0.0";
   };
   mustermann-grape = {
     dependencies = ["mustermann"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0djlbi7nh161a5mwjdm1ya4hc6lyzc493ah48gn37gk6vyri5kh0";
+      sha256 = "1zpmc099rcpxmlfxb71zd6l7f9fcsg1fhi6627r03y1qlgb0jlvg";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.0.2";
   };
   nap = {
     groups = ["default" "development"];
@@ -3780,6 +3759,17 @@ src:
     };
     version = "0.3.0";
   };
+  net-http = {
+    dependencies = ["net-protocol" "uri"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "11mymfxpsgpwr1qbv8vwj8av9kksqj0632p9s3x35bzrnq4y393m";
+      type = "gem";
+    };
+    version = "0.1.1";
+  };
   net-http-persistent = {
     dependencies = ["connection_pool"];
     groups = ["default"];
@@ -3807,10 +3797,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ycw0qsw3hap8svakl0i30jkj0ffd4lpyrn17a1j0w8mz5ainmsj";
+      sha256 = "0xqcffn3c1564c4fizp10dzw2v5g2pabdzrcn25hq05bqhsckbar";
       type = "gem";
     };
-    version = "0.17.1";
+    version = "0.18.0";
   };
   net-ntp = {
     groups = ["default"];
@@ -3912,10 +3902,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fnw0z8zl8b5k35g9m5hhc1g4s6ajzjinhyxnqjrx7l7p07fw71v";
+      sha256 = "1mr2ibfk874ncv0qbdkynay738w2mfinlkhnbd5lyk5yiw5q1p10";
       type = "gem";
     };
-    version = "1.14.3";
+    version = "1.15.2";
   };
   notiffany = {
     dependencies = ["nenv" "shellany"];
@@ -4175,6 +4165,17 @@ src:
     };
     version = "2.1.0";
   };
+  omniauth-shibboleth-redux = {
+    dependencies = ["omniauth"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1qgzp0xaka6vqpx69mw6nbqaqmyqrawi11cyak4gq19l23ym7cz9";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
   omniauth-twitter = {
     dependencies = ["omniauth-oauth" "rack"];
     groups = ["default"];
@@ -4344,15 +4345,15 @@ src:
     version = "1.22.1";
   };
   parser = {
-    dependencies = ["ast"];
+    dependencies = ["ast" "racc"];
     groups = ["coverage" "default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zk8mdyr0322r11d63rcp5jhz4lakxilhvyvdv0ql5dw4lb83623";
+      sha256 = "1swigds85jddb5gshll1g8lkmbcgbcp9bi1d4nigwvxki8smys0h";
       type = "gem";
     };
-    version = "3.2.0.0";
+    version = "3.2.2.3";
   };
   parslet = {
     groups = ["default" "development" "test"];
@@ -4402,10 +4403,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1slcbzzqdv6104l5h8ql6kj43zmnm16g2dav8bc8dasfpwmrg1k0";
+      sha256 = "0cs8c0f903phs3yjjbrhlyaipvmvm95xids06a761hf0s6lj0j5h";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "4.2.1";
   };
   plist = {
     groups = ["default"];
@@ -4477,10 +4478,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h4w0947zwwg6kbdnvg4vbmrsc8yf5ijb37sg758apks44imym28";
+      sha256 = "14m09ysq0l6kih9pdy1mmdabdyjk09hvx4rzqh6phgb34s1w4pfp";
       type = "gem";
     };
-    version = "0.23.1";
+    version = "0.25.0";
   };
   pry = {
     dependencies = ["coderay" "method_source"];
@@ -4542,21 +4543,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qzq0c791kacv68hgk9zqsd1p7zx1y1rr9j10rn9yphibb8jj436";
+      sha256 = "1v7fmv0n4bhdcwh60dgza44iqai5pg34f5pzm4vh4i5fwx7mpqxh";
       type = "gem";
     };
-    version = "5.6.5";
+    version = "6.3.0";
-  };
-  puma_worker_killer = {
-    dependencies = ["get_process_mem" "puma"];
-    groups = ["puma"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0jk1bhmx5px8y1ip4ky80cq5cwdaybdg4y55shd2vsdmjv938mcw";
-      type = "gem";
-    };
-    version = "0.3.1";
   };
   pyu-ruby-sasl = {
     groups = ["default"];
@@ -4797,10 +4787,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zx8v677r2gs050z4cdiflp14kp6nx5z285ynj2ach0w0z7jfm23";
+      sha256 = "09kszvsa9av8yb8pm9nz6p5jgshin3cqvknlvd1m927qfvdpalk3";
       type = "gem";
     };
-    version = "0.9.75";
+    version = "0.9.78";
   };
   rbtrace = {
     dependencies = ["ffi" "msgpack" "optimist"];
@@ -5068,10 +5058,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "046xwhfhi2krmbaqmg9vshf01vzld8smczx6dwppinv61ndc2vqg";
+      sha256 = "0pym2zjwl6dwdfvbn7rbvmds32r70jx9qddhvvi6pqy6987ack1v";
       type = "gem";
     };
-    version = "4.1.0";
+    version = "4.1.2";
   };
   rqrcode = {
     dependencies = ["chunky_png"];
@@ -5363,10 +5353,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1706dyk5jdma75bnl9rhmx8vgzjw12ixnj3y32inmpcgzgsvs76k";
+      sha256 = "18vnbzin5ypxrgcs9lllg7x311b69dyrdw2w1pwz84438hmxm79s";
       type = "gem";
     };
-    version = "1.13.0";
+    version = "1.15.0";
   };
   ruby-statistics = {
     groups = ["default" "test"];
@@ -6022,6 +6012,16 @@ src:
     };
     version = "1.2.0";
   };
+  table_print = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1jxmd1yg3h0g27wzfpvq1jnkkf7frwb5wy9m4f47nf4k3wl68rj3";
+      type = "gem";
+    };
+    version = "1.5.7";
+  };
   tanuki_emoji = {
     groups = ["default"];
     platforms = [];
@@ -6463,6 +6463,16 @@ src:
     };
     version = "0.6.7";
   };
+  uri = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vigw7nfszfqgikr6n574k9bfh0rvs74z8xq46rz2zsm8249l8cc";
+      type = "gem";
+    };
+    version = "0.12.1";
+  };
   uri_template = {
     groups = ["default"];
     platforms = [];
@@ -6543,10 +6553,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1bwvpkv1iqa8g5cmmllx8fx0nprapzrzfvf1m15rr3wxw5hrbdn8";
+      sha256 = "08jc9k4qqazbf5frhdril5084adm90rs1lqbnqq3yfdm2dgaiyhx";
       type = "gem";
     };
-    version = "2.82.0";
+    version = "3.2.0";
   };
   virtus = {
     dependencies = ["axiom-types" "coercible" "descendants_tracker"];

pkgs/applications/version-management/gql/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gql";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "AmrDeveloper";
     repo = "GQL";
     rev = version;
-    hash = "sha256-UEfluWgoSuPnHGsoPcVLuAqmJsqCJL2B29UsQeZctuE=";
+    hash = "sha256-3x4ExSEs22wFP4Z5cY9+F8yyVc5voHAT1odnyzkSlhc=";
   };
 
-  cargoHash = "sha256-y49pnx1OkUu7yKnwTGpPGv3ULUPpj/Z4bOPVIO3nS0E=";
+  cargoHash = "sha256-Xmf64yRyWrqYO/ydxEblChVPKnR47Uc55FVAY3DU7no=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/video/flowblade/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flowblade";
-  version = "2.8.0.3";
+  version = "2.10.0.2";
 
   src = fetchFromGitHub {
     owner = "jliljebl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/EkI3qiceB5eKTVQnpG+z4e6yaE9hDtn6I+iN/J+h/g=";
+    sha256 = "sha256-lXMVtWsTyMaGIpEglHvnUgDSaFlnWtB3lSyg6ljNIdQ=";
   };
 
   buildInputs = [
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
     makeWrapper $out/flowblade/flowblade $out/bin/flowblade \
       --set FREI0R_PATH ${frei0r}/lib/frei0r-1 \
       --set LADSPA_PATH ${ladspaPlugins}/lib/ladspa \
+      --prefix PATH : "${lib.makeBinPath [ ffmpeg ]}" \
       ''${gappsWrapperArgs[@]}
 
     runHook postInstall

pkgs/applications/video/kodi/addons/inputstreamhelper/default.nix

@@ -2,11 +2,11 @@
 buildKodiAddon rec {
   pname = "inputstreamhelper";
   namespace = "script.module.inputstreamhelper";
-  version = "0.5.10+matrix.1";
+  version = "0.6.1+matrix.1";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-FcOktwtOT7kDM+3y9qPDk3xU1qVeCduyAdUzebtJzv4=";
+    sha256 = "sha256-v5fRikswmP+KVbxYibD0NbCK8leUnFbya5EtF1FmS0I=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/libretro-2048/default.nix

@@ -0,0 +1,31 @@
+{ lib, buildKodiBinaryAddon, fetchFromGitHub, libretro, twenty-fortyeight }:
+
+buildKodiBinaryAddon rec {
+  pname = "libretro-2048";
+  namespace = "game.libretro.2048";
+  version = "1.0.0.136";
+
+  src = fetchFromGitHub {
+    owner = "kodi-game";
+    repo = "game.libretro.2048";
+    rev = "${version}-Nexus";
+    hash = "sha256-cIo56ZGansBlAj6CFw51UOYJUivN9n1qhVTWAX9c5Tc=";
+  };
+
+  extraCMakeFlags = [
+    "-D2048_LIB=${twenty-fortyeight}/lib/retroarch/cores/2048_libretro.so"
+  ];
+
+  extraBuildInputs = [ twenty-fortyeight ];
+  propagatedBuildInputs = [
+    libretro
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/kodi-game/game.libretro.2048";
+    description = "2048 GameClient for Kodi";
+    platforms = platforms.all;
+    license = licenses.publicDomain;
+    maintainers = with maintainers; teams.kodi.members ++ [ kazenyuk ];
+  };
+}

pkgs/applications/video/kodi/addons/libretro-fuse/default.nix

@@ -0,0 +1,31 @@
+{ lib, buildKodiBinaryAddon, fetchFromGitHub, libretro, fuse }:
+
+buildKodiBinaryAddon rec {
+  pname = "libretro-fuse";
+  namespace = "game.libretro.fuse";
+  version = "1.6.0.34";
+
+  src = fetchFromGitHub {
+    owner = "kodi-game";
+    repo = "game.libretro.fuse";
+    rev = "${version}-Nexus";
+    hash = "sha256-MimwEV7YD6pMshxqbKTVbLDsPmMbqSy4HPnxwmKswpc=";
+  };
+
+  extraCMakeFlags = [
+    "-DFUSE_LIB=${fuse}/lib/retroarch/cores/fuse_libretro.so"
+  ];
+
+  extraBuildInputs = [ fuse ];
+  propagatedBuildInputs = [
+    libretro
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/kodi-game/game.libretro.fuse";
+    description = "Sinclair - ZX Spectrum (Fuse) GameClient for Kodi";
+    platforms = platforms.all;
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; teams.kodi.members ++ [ kazenyuk ];
+  };
+}

pkgs/applications/video/kodi/addons/vfs-rar/default.nix

@@ -0,0 +1,22 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, tinyxml }:
+buildKodiBinaryAddon rec {
+  pname = namespace;
+  namespace = "vfs.rar";
+  version = "20.1.0";
+
+  src = fetchFromGitHub {
+    owner = "xbmc";
+    repo = namespace;
+    rev = "${version}-${rel}";
+    sha256 = "sha256-8IEYA2gNchCa7O9kzrCbO5DxYWJqPzQN3SJIr9zCWc8=";
+  };
+
+  extraBuildInputs = [ tinyxml ];
+
+  meta = with lib; {
+    description = "RAR archive Virtual Filesystem add-on for Kodi";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = teams.kodi.members;
+  };
+}

pkgs/applications/video/mkvtoolnix/default.nix

@@ -56,6 +56,15 @@ stdenv.mkDerivation rec {
     sha256 = "t+kfFS5c8w+c9wxNh59nceFesfdMy8qvHlUqDbZAxkk=";
   };
 
+  patches = [
+    # Fix compatiblity with fmt 10.0. Remove with the next release
+    (fetchpatch {
+      url = "https://gitlab.com/mbunkus/mkvtoolnix/-/commit/24716ce95bf5b10d685611de23489045cf2ca5cc.patch";
+      hash = "sha256-vOm3FmXL3mHzs3RHCJ9gbTLSe3xhSXo8IfgA+s0cFjY=";
+      includes = [ "src/common/codec.h" ];
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     docbook_xsl

pkgs/applications/video/mpv/wrapper.nix

@@ -1,8 +1,11 @@
 # Arguments that this derivation gets when it is created with `callPackage`
 { stdenv
+, buildEnv
 , lib
 , makeWrapper
+, mpvScripts
 , symlinkJoin
+, writeTextDir
 , yt-dlp
 }:
 
@@ -71,6 +74,20 @@ let
 
       passthru.unwrapped = mpv;
 
+      passthru.tests.mpv-scripts-should-not-collide = buildEnv {
+        name = "mpv-scripts-env";
+        paths = lib.pipe mpvScripts [
+          # filters "override" "overrideDerivation" "recurseForDerivations"
+          (lib.filterAttrs (key: script: lib.isDerivation script))
+          # replaces unfree and meta.broken scripts with decent placeholders
+          (lib.mapAttrsToList (key: script:
+            if (builtins.tryEval script.outPath).success
+            then script
+            else writeTextDir "share/mpv/scripts/${script.scriptName}" "placeholder of ${script.name}"
+          ))
+        ];
+      };
+
       postBuild = ''
         # wrapProgram can't operate on symlinks
         rm "$out/bin/mpv"

pkgs/build-support/node/fetch-yarn-deps/common.js

@@ -0,0 +1,17 @@
+const path = require('path')
+
+// This has to match the logic in pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
+// so that fixup_yarn_lock produces the same paths
+const urlToName = url => {
+	const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
+
+	if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
+		return path.basename(url)
+	} else {
+		return url
+			.replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
+			.replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
+	}
+}
+
+module.exports = { urlToName };

pkgs/build-support/node/fetch-yarn-deps/default.nix

@@ -21,8 +21,8 @@ in {
       mkdir libexec
       tar --strip-components=1 -xf ${yarnpkg-lockfile-tar} package/index.js
       mv index.js libexec/yarnpkg-lockfile.js
-      cp ${./index.js} libexec/index.js
+      cp ${./.}/*.js libexec/
-      patchShebangs libexec/index.js
+      patchShebangs libexec
 
       runHook postBuild
     '';
@@ -34,6 +34,7 @@ in {
       cp -r libexec $out
       makeWrapper $out/libexec/index.js $out/bin/prefetch-yarn-deps \
         --prefix PATH : ${lib.makeBinPath [ coreutils nix-prefetch-git nix ]}
+      makeWrapper $out/libexec/fixup.js $out/bin/fixup-yarn-lock
 
       runHook postInstall
     '';

pkgs/build-support/node/fetch-yarn-deps/fixup.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+'use strict'
+
+const fs = require('fs')
+const process = require('process')
+const lockfile = require('./yarnpkg-lockfile.js')
+const { urlToName } = require('./common.js')
+
+const fixupYarnLock = async (lockContents, verbose) => {
+	const lockData = lockfile.parse(lockContents)
+
+	const fixedData = Object.fromEntries(
+		Object.entries(lockData.object)
+		.map(([dep, pkg]) => {
+			const [ url, hash ] = pkg.resolved.split("#", 2)
+
+			if (hash || url.startsWith("https://codeload.github.com")) {
+				if (verbose) console.log(`Removing integrity for git dependency ${dep}`)
+				delete pkg.integrity
+			}
+
+			if (verbose) console.log(`Rewriting URL ${url} for dependency ${dep}`)
+			pkg.resolved = urlToName(url)
+
+			return [dep, pkg]
+		})
+	)
+
+	if (verbose) console.log('Done')
+
+	return fixedData
+}
+
+const showUsage = async () => {
+	process.stderr.write(`
+syntax: fixup-yarn-lock [path to yarn.lock] [options]
+
+Options:
+  -h --help         Show this help
+  -v --verbose      Verbose output
+`)
+	process.exit(1)
+}
+
+const main = async () => {
+	const args = process.argv.slice(2)
+	let next, lockFile, verbose
+	while (next = args.shift()) {
+		if (next == '--verbose' || next == '-v') {
+			verbose = true
+		} else if (next == '--help' || next == '-h') {
+			showUsage()
+		} else if (!lockFile) {
+			lockFile = next
+		} else {
+			showUsage()
+		}
+	}
+	let lockContents
+	try {
+		lockContents = await fs.promises.readFile(lockFile || 'yarn.lock', 'utf-8')
+	} catch {
+		showUsage()
+	}
+
+	const fixedData = await fixupYarnLock(lockContents, verbose)
+	await fs.promises.writeFile(lockFile || 'yarn.lock', lockfile.stringify(fixedData))
+}
+
+main()
+	.catch(e => {
+		console.error(e)
+		process.exit(1)
+	})

pkgs/build-support/node/fetch-yarn-deps/index.js

@@ -10,6 +10,7 @@ const path = require('path')
 const lockfile = require('./yarnpkg-lockfile.js')
 const { promisify } = require('util')
 const url = require('url')
+const { urlToName } = require('./common.js')
 
 const execFile = promisify(child_process.execFile)
 
@@ -19,20 +20,6 @@ const exec = async (...args) => {
 	return res
 }
 
-// This has to match the logic in pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
-// so that fixup_yarn_lock produces the same paths
-const urlToName = url => {
-	const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
-
-	if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
-		return path.basename(url)
-	} else {
-		return url
-			.replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
-			.replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
-	}
-}
-
 const downloadFileHttps = (fileName, url, expectedHash, hashType = 'sha1') => {
 	return new Promise((resolve, reject) => {
 		https.get(url, (res) => {

pkgs/data/misc/spdx-license-list-data/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "spdx-license-list-data";
-  version = "3.20";
+  version = "3.21";
 
   src = fetchFromGitHub {
     owner = "spdx";
     repo = "license-list-data";
     rev = "v${version}";
-    hash = "sha256-qMVUP1EpeeO+i5RfnAt/Idz+pR9dVyCT4Ss9lEJgj6k=";
+    hash = "sha256-dv8aC4giD0JqaYN19eCHzEbmwXhqX+ZrKrwit9tzf5Y=";
   };
 
   # List of file formats to package.

pkgs/desktops/cinnamon/cinnamon-common/default.nix

@@ -72,13 +72,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cinnamon-common";
-  version = "5.8.2";
+  version = "5.8.3";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon";
     rev = version;
-    hash = "sha256-KY5ctByMYKxigiZ0X/blaHJuyiAUNB6B2gpGtC/k100=";
+    hash = "sha256-PvU5lcoIDguWiLdI+uIiJHqS1ae436Xc7TfRVytR02k=";
   };
 
   patches = [

pkgs/desktops/cinnamon/folder-color-switcher/default.nix

@@ -7,14 +7,14 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "folder-color-switcher";
-  version = "1.5.7";
+  version = "1.5.8";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     # They don't really do tags, this is just a named commit.
-    rev = "03311d62a62e2cd7d0592b241c287091161ec6b6";
+    rev = "f167627cffaf8b34e27b0515153b669b980fd62e";
-    sha256 = "sha256-HQv9vSpRSBjqbncGFv+O5XQtRJ+4Cq0aWZHoj5BhKYE=";
+    sha256 = "sha256-u8Lv0OTxKgjIp1q5WR0NXULhnwFfEDYGRlBpFMVHCBY=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/cinnamon/mint-themes/default.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-themes";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-Y+KmSKuREn2E3FySsScjL+oSpSFnyEqhoXQfU++86JY=";
+    hash = "sha256-ouqhksy3999pi8v4f64W4X/h655ZVi8dR22g4LlYwMI=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/cinnamon/nemo/default.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nemo";
-  version = "5.8.2";
+  version = "5.8.3";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Be67TOA1gLwSYx8y2iyfvY0QCpWOFutpXMDaPiTRQGg=";
+    sha256 = "sha256-/GwtTklOkhCkbBMQLl4dKUnlZwN6FX2kqxN7cJVaVwE=";
   };
 
   patches = [

pkgs/desktops/pantheon/apps/switchboard-plugs/applications/default.nix

@@ -7,6 +7,7 @@
 , pkg-config
 , vala
 , libgee
+, libhandy
 , granite
 , gtk3
 , switchboard
@@ -15,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchboard-plug-applications";
-  version = "6.0.1";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "18izmzhqp6x5ivha9yl8gyz9adyrsylw7w5p0cwm1bndgqbi7yh5";
+    sha256 = "sha256-M9JMrxhMiDC/qrrnPaBm6Kf3CAkxrhGWwJF8jVm2G5c=";
   };
 
   nativeBuildInputs = [
@@ -36,6 +37,7 @@ stdenv.mkDerivation rec {
     granite
     gtk3
     libgee
+    libhandy
     switchboard
   ];
 

pkgs/desktops/pantheon/desktop/gala/default.nix

@@ -21,17 +21,18 @@
 , gnome-settings-daemon
 , wrapGAppsHook
 , gexiv2
+, systemd
 }:
 
 stdenv.mkDerivation rec {
   pname = "gala";
-  version = "7.0.3";
+  version = "7.1.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-RLKPYDWVqT2WfjLPXRFPCNNvcW+fJ0OUKjSLLgPBqdw=";
+    sha256 = "sha256-x0EIah/iTluJk7P3k0g23cQldx++W58FbjnHNlF31AQ=";
   };
 
   patches = [
@@ -63,12 +64,7 @@ stdenv.mkDerivation rec {
     libgee
     mesa # for libEGL
     mutter
-  ];
+    systemd
-
-  mesonFlags = [
-    # TODO: enable this and remove --builtin flag from session-settings
-    # https://github.com/NixOS/nixpkgs/pull/140429
-    "-Dsystemd=false"
   ];
 
   postPatch = ''

pkgs/desktops/pantheon/services/xdg-desktop-portal-pantheon/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-pantheon";
-  version = "7.0.0";
+  version = "7.1.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "portals";
     rev = version;
-    sha256 = "sha256-Rfo9Z5rCJgk36Db3ce8dYBJswy8owjvRMrJVB/RfwyI=";
+    sha256 = "sha256-uy/etQiJuaROw8bWg2PUdptNr4I8uqqUZ8BWK6D2bog=";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/clasp/default.nix

@@ -55,7 +55,7 @@ in llvmPackages_15.stdenv.mkDerivation {
     sbcl
     git
     pkg-config
-    fmt
+    fmt_9
     gmpxx
     libelf
     boost

pkgs/development/compilers/halide/default.nix

@@ -3,9 +3,11 @@
 , lib
 , fetchFromGitHub
 , cmake
+, libffi
 , libpng
 , libjpeg
 , mesa
+, libGL
 , eigen
 , openblas
 , blas
@@ -43,11 +45,14 @@ stdenv.mkDerivation rec {
     llvmPackages.lld
     llvmPackages.openmp
     llvmPackages.libclang
+    libffi
     libpng
     libjpeg
-    mesa
     eigen
     openblas
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    mesa
+    libGL
   ];
 
   nativeBuildInputs = [ cmake ];
@@ -57,6 +62,6 @@ stdenv.mkDerivation rec {
     homepage = "https://halide-lang.org";
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = with maintainers; [ ck3d atila ];
+    maintainers = with maintainers; [ ck3d atila twesterhout ];
   };
 }

pkgs/development/compilers/ispc/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch
-, cmake, which, m4, python3, bison, flex, llvmPackages, ncurses
+, cmake, which, m4, python3, bison, flex, llvmPackages, ncurses, xcode
 
   # the default test target is sse4, but that is not supported by all Hydra agents
 , testedTargets ? if stdenv.isAarch64 || stdenv.isAarch32 then [ "neon-i32x4" ] else [ "sse2-i32x4" ]
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-WBAVgjQjW4x9JGx6xotPoTVOePsPjBJEyBYA7TCTBvc=";
   };
 
-  nativeBuildInputs = [ cmake which m4 bison flex python3 llvmPackages.libllvm.dev ];
+  nativeBuildInputs = [ cmake which m4 bison flex python3 llvmPackages.libllvm.dev ] ++ lib.lists.optionals stdenv.isDarwin [ xcode ];
   buildInputs = with llvmPackages; [
     libllvm libclang openmp ncurses
   ];
@@ -30,8 +30,7 @@ stdenv.mkDerivation rec {
 
   inherit testedTargets;
 
-  # needs 'transcendentals' executable, which is only on linux
+  doCheck = true;
-  doCheck = stdenv.isLinux;
 
   # the compiler enforces -Werror, and -fno-strict-overflow makes it mad.
   # hilariously this is something of a double negative: 'disable' the
@@ -60,6 +59,8 @@ stdenv.mkDerivation rec {
     "-DISPC_INCLUDE_UTILS=OFF"
     ("-DARM_ENABLED=" + (if stdenv.isAarch64 || stdenv.isAarch32 then "TRUE" else "FALSE"))
     ("-DX86_ENABLED=" + (if stdenv.isx86_64 || stdenv.isx86_32 then "TRUE" else "FALSE"))
+  ] ++ lib.lists.optionals stdenv.isDarwin [
+    "-DISPC_MACOS_SDK_PATH=${xcode}/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
   ];
 
   meta = with lib; {

pkgs/development/compilers/odin/default.nix

@@ -1,31 +1,43 @@
 { lib
 , fetchFromGitHub
-, llvmPackages
+, llvmPackages_13
 , makeWrapper
 , libiconv
+, MacOSX-SDK
+, which
 }:
 
 let
+  llvmPackages = llvmPackages_13;
   inherit (llvmPackages) stdenv;
 in stdenv.mkDerivation rec {
   pname = "odin";
-  version = "0.13.0";
+  version = "dev-2023-05";
 
   src = fetchFromGitHub {
     owner = "odin-lang";
     repo = "Odin";
-    rev = "v${version}";
+    rev = version;
-    sha256 = "ke2HPxVtF/Lh74Tv6XbpM9iLBuXLdH1+IE78MAacfYY=";
+    sha256 = "sha256-qEewo2h4dpivJ7D4RxxBZbtrsiMJ7AgqJcucmanbgxY=";
   };
 
   nativeBuildInputs = [
-    makeWrapper
+    makeWrapper which
   ];
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
-  postPatch = ''
+  LLVM_CONFIG = "${llvmPackages.llvm.dev}/bin/llvm-config";
-    sed -i 's/^GIT_SHA=.*$/GIT_SHA=/' Makefile
+
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    sed -i src/main.cpp \
+      -e 's|-syslibroot /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk|-syslibroot ${MacOSX-SDK}|'
+  '' + ''
+    sed -i build_odin.sh \
+      -e 's/^GIT_SHA=.*$/GIT_SHA=/' \
+      -e 's/LLVM-C/LLVM/' \
+      -e 's/framework System/lSystem/'
+    patchShebangs build_odin.sh
   '';
 
   dontConfigure = true;
@@ -37,21 +49,26 @@ in stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
     cp odin $out/bin/odin
-    cp -r core $out/bin/core
 
-    wrapProgram $out/bin/odin --prefix PATH : ${lib.makeBinPath (with llvmPackages; [
+    mkdir -p $out/share
-      bintools
+    cp -r core $out/share/core
-      llvm
+    cp -r vendor $out/share/vendor
-      clang
+
-      lld
+    wrapProgram $out/bin/odin \
-    ])}
+      --prefix PATH : ${lib.makeBinPath (with llvmPackages; [
+        bintools
+        llvm
+        clang
+        lld
+      ])} \
+      --set-default ODIN_ROOT $out/share
   '';
 
   meta = with lib; {
     description = "A fast, concise, readable, pragmatic and open sourced programming language";
     homepage = "https://odin-lang.org/";
-    license = licenses.bsd2;
+    license = licenses.bsd3;
-    maintainers = with maintainers; [ luc65r ];
+    maintainers = with maintainers; [ luc65r astavie ];
-    platforms = platforms.x86_64;
+    platforms = platforms.x86_64 ++ [ "aarch64-darwin" ];
   };
 }

pkgs/development/haskell-modules/configuration-common.nix

@@ -1696,6 +1696,8 @@ self: super: {
         sha256 = "sha256-J8N4+HUQ6vlJBCwCyxv8Fv5HSbtiim64Qh1n9CaRe1o=";
         stripLen = 1;
       })
+      # https://github.com/hercules-ci/hercules-ci-agent/pull/526
+      ./patches/hercules-ci-agent-cachix-1.6.patch
     ])
     (self.generateOptparseApplicativeCompletions [ "hercules-ci-agent" ])
   ];

pkgs/development/haskell-modules/configuration-nix.nix

@@ -1047,29 +1047,29 @@ self: super: builtins.intersectAttrs super {
   domaindriven-core = dontCheck super.domaindriven-core;
 
   cachix-api = overrideCabal (drv: {
-    version = "1.5";
+    version = "1.6";
     src = pkgs.fetchFromGitHub {
       owner = "cachix";
       repo = "cachix";
-      rev = "v1.5";
+      rev = "v1.6";
-      sha256 = "sha256-bt8FFtDSJpBckx3dIjW5Xdvj8aVCm78R3VTpjK5F3Ac=";
+      sha256 = "sha256-54ujAZYNigAn1oJAfupUtZHa0WRQbCQGLEfLmkw8iFc=";
     };
     postUnpack = "sourceRoot=$sourceRoot/cachix-api";
     postPatch = ''
-      sed -i 's/1.4.2/1.5/' cachix-api.cabal
+      sed -i 's/1.5/1.6/' cachix-api.cabal
     '';
   }) super.cachix-api;
   cachix = overrideCabal (drv: {
-    version = "1.5";
+    version = "1.6";
     src = pkgs.fetchFromGitHub {
       owner = "cachix";
       repo = "cachix";
-      rev = "v1.5";
+      rev = "v1.6";
-      sha256 = "sha256-bt8FFtDSJpBckx3dIjW5Xdvj8aVCm78R3VTpjK5F3Ac=";
+      sha256 = "sha256-54ujAZYNigAn1oJAfupUtZHa0WRQbCQGLEfLmkw8iFc=";
     };
     postUnpack = "sourceRoot=$sourceRoot/cachix";
     postPatch = ''
-      sed -i 's/1.4.2/1.5/' cachix.cabal
+      sed -i 's/1.5/1.6/' cachix.cabal
     '';
   }) (lib.pipe
         (super.cachix.override {
@@ -1080,8 +1080,7 @@ self: super: builtins.intersectAttrs super {
         [
          (addBuildTool self.hercules-ci-cnix-store.nixPackage)
          (addBuildTool pkgs.pkg-config)
-         (addBuildDepend self.inline-c-cpp)
+         (addBuildDepend self.ascii-progress)
-         (addBuildDepend self.hercules-ci-cnix-store)
         ]
   );
 

pkgs/development/haskell-modules/patches/hercules-ci-agent-cachix-1.6.patch

@@ -0,0 +1,32 @@
+diff --git a/hercules-ci-agent/hercules-ci-agent/Hercules/Agent/Cachix.hs b/hercules-ci-agent/hercules-ci-agent/Hercules/Agent/Cachix.hs
+index 849d9bc..972bc90 100644
+--- hercules-ci-agent/hercules-ci-agent/Hercules/Agent/Cachix.hs
++++ hercules-ci-agent/hercules-ci-agent/Hercules/Agent/Cachix.hs
+@@ -17,6 +17,7 @@ import Hercules.Agent.Log
+ import Hercules.CNix.Store (StorePath)
+ import Hercules.Error
+ import qualified Hercules.Formats.CachixCache as CachixCache
++import qualified Data.Conduit as Conduit
+ import Protolude
+ 
+ push :: Text -> [StorePath] -> Int -> App ()
+@@ -36,6 +37,9 @@ push cache paths workers = withNamedContext "cache" cache $ do
+         Cachix.Push.PushParams
+           { pushParamsName = Agent.Cachix.pushCacheName pushCache,
+             pushParamsSecret = Agent.Cachix.pushCacheSecret pushCache,
++#if MIN_VERSION_cachix(1,6,0)
++            pushOnClosureAttempt = \_ missing -> return missing,
++#endif
+             pushParamsStore = nixStore,
+             pushParamsClientEnv = clientEnv,
+             pushParamsStrategy = \storePath ->
+@@ -59,6 +63,9 @@ push cache paths workers = withNamedContext "cache" cache $ do
+                       compressionLevel = 2,
+ #else
+                       withXzipCompressor = Cachix.Push.defaultWithXzipCompressor,
++#endif
++#if MIN_VERSION_cachix(1,6,0)
++                      onUncompressedNARStream = \_ _ -> Conduit.awaitForever Conduit.yield,
+ #endif
+                       omitDeriver = False
+                     }

pkgs/development/interpreters/racket/default.nix

@@ -9,7 +9,6 @@
 , libGL
 , libGLU
 , libjpeg
-, xorg
 , ncurses
 , libpng, libtool, mpfr, openssl, pango, poppler
 , readline, sqlite
@@ -25,7 +24,7 @@ let
     fontDirectories = [ freefont_ttf ];
   };
 
-  libPath = lib.makeLibraryPath [
+  libPath = lib.makeLibraryPath ([
     cairo
     fontconfig
     glib
@@ -33,8 +32,6 @@ let
     gtk3
     gsettings-desktop-schemas
     libedit
-    libGL
-    libGLU
     libjpeg
     libpng
     mpfr
@@ -44,7 +41,10 @@ let
     poppler
     readline
     sqlite
-  ];
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
+    libGLU
+  ]);
 
 in