Merge master into staging-next

2023-08-31 18:01:26 +00:00
parent 1e588fe2a3 c7bb13c661
commit cfbf9d795e
63 changed files with 15222 additions and 508 deletions
@@ -54,3 +54,65 @@ for your specific card(s).

 Library maintainers should consult [NVCC Docs](https://docs.nvidia.com/cuda/cuda-compiler-driver-nvcc/)
 and release notes for their software package.
+
+## Adding a new CUDA release {#adding-a-new-cuda-release}
+
+> **WARNING**
+>
+> This section of the docs is still very much in progress. Feedback is welcome in GitHub Issues tagging @NixOS/cuda-maintainers or on [Matrix](https://matrix.to/#/#cuda:nixos.org).
+
+The CUDA Toolkit is a suite of CUDA libraries and software meant to provide a development environment for CUDA-accelerated applications. Until the release of CUDA 11.4, NVIDIA had only made the CUDA Toolkit available as a multi-gigabyte runfile installer, which we provide through the [`cudaPackages.cudatoolkit`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.cudatoolkit) attribute. From CUDA 11.4 and onwards, NVIDIA has also provided CUDA redistributables (“CUDA-redist”): individually packaged CUDA Toolkit components meant to facilitate redistribution and inclusion in downstream projects. These packages are available in the [`cudaPackages`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages) package set.
+
+All new projects should use the CUDA redistributables available in [`cudaPackages`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages) in place of [`cudaPackages.cudatoolkit`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.cudatoolkit), as they are much easier to maintain and update.
+
+### Updating CUDA redistributables {#updating-cuda-redistributables}
+
+1. Go to NVIDIA's index of CUDA redistributables: <https://developer.download.nvidia.com/compute/cuda/redist/>
+2. Copy the `redistrib_*.json` corresponding to the release to `pkgs/development/compilers/cudatoolkit/redist/manifests`.
+3. Generate the `redistrib_features_*.json` file by running:
+
+    ```bash
+    nix run github:ConnorBaker/cuda-redist-find-features -- <path to manifest>
+    ```
+
+    That command will generate the `redistrib_features_*.json` file in the same directory as the manifest.
+
+4. Include the path to the new manifest in `pkgs/development/compilers/cudatoolkit/redist/extension.nix`.
+
+### Updating the CUDA Toolkit runfile installer {#updating-the-cuda-toolkit}
+
+> **WARNING**
+>
+> While the CUDA Toolkit runfile installer is still available in Nixpkgs as the [`cudaPackages.cudatoolkit`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.cudatoolkit) attribute, its use is not recommended and should it be considered deprecated. Please migrate to the CUDA redistributables provided by the [`cudaPackages`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages) package set.
+>
+> To ensure packages relying on the CUDA Toolkit runfile installer continue to build, it will continue to be updated until a migration path is available.
+
+1. Go to NVIDIA's CUDA Toolkit runfile installer download page: <https://developer.nvidia.com/cuda-downloads>
+2. Select the appropriate OS, architecture, distribution, and version, and installer type.
+
+   - For example: Linux, x86_64, Ubuntu, 22.04, runfile (local)
+   - NOTE: Typically, we use the Ubuntu runfile. It is unclear if the runfile for other distributions will work.
+
+3. Take the link provided by the installer instructions on the webpage after selecting the installer type and get its hash by running:
+
+   ```bash
+   nix store prefetch-file --hash-type sha256 <link>
+   ```
+
+4. Update `pkgs/development/compilers/cudatoolkit/versions.toml` to include the release.
+
+### Updating the CUDA package set {#updating-the-cuda-package-set}
+
+1. Include a new `cudaPackages_<major>_<minor>` package set in `pkgs/top-level/all-packages.nix`.
+
+   - NOTE: Changing the default CUDA package set should occur in a separate PR, allowing time for additional testing.
+
+2. Successfully build the closure of the new package set, updating `pkgs/development/compilers/cudatoolkit/redist/overrides.nix` as needed. Below are some common failures:
+
+| Unable to ... | During ... | Reason | Solution | Note |
+| --- | --- | --- | --- | --- |
+| Find headers | `configurePhase` or `buildPhase` | Missing dependency on a `dev` output | Add the missing dependency | The `dev` output typically contain the headers |
+| Find libraries | `configurePhase` | Missing dependency on a `dev` output | Add the missing dependency | The `dev` output typically contain CMake configuration files |
+| Find libraries | `buildPhase` or `patchelf` | Missing dependency on a `lib` or `static` output | Add the missing dependency | The `lib` or `static` output typically contain the libraries |
+
+In the scenario you are unable to run the resulting binary: this is arguably the most complicated as it could be any combination of the previous reasons. This type of failure typically occurs when a library attempts to load or open a library it depends on that it does not declare in its `DT_NEEDED` section. As a first step, ensure that dependencies are patched with [`cudaPackages.autoAddOpenGLRunpath`](https://search.nixos.org/packages?channel=unstable&type=packages&query=cudaPackages.autoAddOpenGLRunpath). Failing that, try running the application with [`nixGL`](https://github.com/guibou/nixGL) or a similar wrapper tool. If that works, it likely means that the application is attempting to load a library that is not in the `RPATH` or `RUNPATH` of the binary.
@@ -6318,6 +6318,12 @@
    githubId = 1447245;
    name = "Robin Gloster";
  };
+  gmemstr = {
+    email = "git@gmem.ca";
+    github = "gmemstr";
+    githubId = 1878840;
+    name = "Gabriel Simmer";
+  };
  gnxlxnxx = {
    email = "gnxlxnxx@web.de";
    github = "gnxlxnxx";
@@ -137,7 +137,7 @@ in
      default = { };
      description = lib.mdDoc ''
        Settings for Kanidm, see
-        [the documentation](https://github.com/kanidm/kanidm/blob/master/kanidm_book/src/server_configuration.md)
+        [the documentation](https://kanidm.github.io/kanidm/stable/server_configuration.html)
        and [example configuration](https://github.com/kanidm/kanidm/blob/master/examples/server.toml)
        for possible values.
      '';
@@ -155,7 +155,7 @@ in
      };
      description = lib.mdDoc ''
        Configure Kanidm clients, needed for the PAM daemon. See
-        [the documentation](https://github.com/kanidm/kanidm/blob/master/kanidm_book/src/client_tools.md#kanidm-configuration)
+        [the documentation](https://kanidm.github.io/kanidm/stable/client_tools.html#kanidm-configuration)
        and [example configuration](https://github.com/kanidm/kanidm/blob/master/examples/config)
        for possible values.
      '';
@@ -173,7 +173,7 @@ in
      };
      description = lib.mdDoc ''
        Configure Kanidm unix daemon.
-        See [the documentation](https://github.com/kanidm/kanidm/blob/master/kanidm_book/src/pam_and_nsswitch.md#the-unix-daemon)
+        See [the documentation](https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch.html#the-unix-daemon)
        and [example configuration](https://github.com/kanidm/kanidm/blob/master/examples/unixd)
        for possible values.
      '';
@@ -8,9 +8,9 @@ lib.makeScope pkgs.newScope (self:
      inherit gconf;

      inherit (pkgs.darwin) sigtool;
-      inherit (pkgs.darwin.apple_sdk.frameworks)
-        AppKit Carbon Cocoa GSS ImageCaptureCore ImageIO IOKit OSAKit Quartz
-        QuartzCore WebKit;
+      inherit (pkgs.darwin.apple_sdk_11_0.frameworks)
+        Accelerate AppKit Carbon Cocoa GSS ImageCaptureCore ImageIO IOKit OSAKit
+        Quartz QuartzCore UniformTypeIdentifiers WebKit;
    };
  in {
    sources = import ./sources.nix {
@@ -42,7 +42,7 @@
 , libtiff
 , libwebp
 , libxml2
-, llvmPackages_6
+, llvmPackages_14
 , m17n_lib
 , makeWrapper
 , motif
@@ -99,6 +99,7 @@
  else "lucid")

 # macOS dependencies for NS and macPort
+, Accelerate
 , AppKit
 , Carbon
 , Cocoa
@@ -109,6 +110,7 @@
 , OSAKit
 , Quartz
 , QuartzCore
+, UniformTypeIdentifiers
 , WebKit
 }:

@@ -135,7 +137,7 @@ let
  ];

  inherit (if variant == "macport"
-           then llvmPackages_6.stdenv
+           then llvmPackages_14.stdenv
           else stdenv) mkDerivation;
 in
 mkDerivation (finalAttrs: (lib.optionalAttrs withNativeCompilation {
@@ -287,6 +289,7 @@ mkDerivation (finalAttrs: (lib.optionalAttrs withNativeCompilation {
    GSS
    ImageIO
  ] ++ lib.optionals (variant == "macport") [
+    Accelerate
    AppKit
    Carbon
    Cocoa
@@ -294,6 +297,7 @@ mkDerivation (finalAttrs: (lib.optionalAttrs withNativeCompilation {
    OSAKit
    Quartz
    QuartzCore
+    UniformTypeIdentifiers
    WebKit
    # TODO are these optional?
    GSS
@@ -337,6 +341,11 @@ mkDerivation (finalAttrs: (lib.optionalAttrs withNativeCompilation {
  ++ lib.optional withXwidgets "--with-xwidgets"
  ;

+  # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
+  # See https://github.com/NixOS/nixpkgs/issues/127902
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (variant == "macport")
+    "-include ${./macport_noescape_noop.h}";
+
  enableParallelBuilding = true;

  installTargets = [ "tags" "install" ];
@@ -0,0 +1,31 @@
+#ifndef NOESCAPE_NOOP_H_
+#define NOESCAPE_NOOP_H_
+
+// First, do some work to get definitions for *_WIDTH. Normally, Emacs would
+// have these defined by headers in-tree, but clang's headers clash with those.
+// Due to how include paths work, we have to include clang headers if we want to
+// mess with CoreFoundation definitions.
+#pragma push_macro("__STDC_VERSION__")
+// Make the preprocessor think that we're on C2x. The macros we want are gated
+// on it.
+#undef __STDC_VERSION__
+#define __STDC_VERSION__ 202000L
+// Include limits.h first, as stdint.h includes it.
+#include <limits.h>
+
+// XX: clang's stdint.h is shy and won't give us its defs unless it thinks it's
+// in freestanding mode.
+#undef __STDC_HOSTED__
+#include <stdint.h>
+#define __STDC_HOSTED__ 1
+
+#pragma pop_macro("__STDC_VERSION__")
+
+// Now, pull in the header that defines CF_NOESCAPE.
+#include <CoreFoundation/CFBase.h>
+
+// Redefine CF_NOESCAPE as empty.
+#undef CF_NOESCAPE
+#define CF_NOESCAPE
+
+#endif // NOESCAPE_NOOP_H_
@@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "openmsx";
-  version = "19.0";
+  version = "19.1";

  src = fetchFromGitHub {
    owner = "openMSX";
    repo = "openMSX";
    rev = "RELEASE_${builtins.replaceStrings ["."] ["_"] finalAttrs.version}";
-    sha256 = "sha256-NR0+vOUkbyuVWdHLmKEewDDmR1ibi3dtbSq+6RaxrGo=";
+    sha256 = "sha256-5ULljLmEDGFp32rnrXKLfL6P3ad2STJUNngBuWlRCbc=";
    fetchSubmodules = true;
  };

@@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "corekeyboard";
-  version = "4.4.0";
+  version = "4.5.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-zOH/w4QroMaVjWnFuWAJQ11RYlpXwIXRG9QYGDkfLVY=";
+    sha256 = "sha256-Hylz1x9Wsk0iVhpNBFZJChsl3gIvJDICgpITjIXDZAg=";
  };

  nativeBuildInputs = [
@@ -22,14 +22,14 @@

 stdenv.mkDerivation rec {
  pname = "valent";
-  version = "unstable-2023-07-31";
+  version = "unstable-2023-08-26";

  src = fetchFromGitHub {
    owner = "andyholmes";
    repo = "valent";
-    rev = "698f39b496957d50c68437f16e74a7ac41eb5147";
+    rev = "89d1e5a0312a0371bfcd9a95486805917c3729c0";
    fetchSubmodules = true;
-    hash = "sha256-AdW6oMRVIgat8XlH342PEwe6BfkzKVLSadGOTLGwzwo=";
+    hash = "sha256-28l+SkjVQkOA/5f5nT5BbqIV2BrMLmSK/YtDGYl1xjQ=";
  };

  nativeBuildInputs = [
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.252";
+  version = "1.2.253";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    hash = "sha256-dKbdEkC0+HFRWsOIteNDlKc1FHB24ECWyOqrVW9MITY=";
+    hash = "sha256-cHMMLV2NdYueL3qV0wpB4n0+2XZTvg4mfKTSgGZHqqY=";
  };

-  vendorHash = "sha256-0PQDMncERGrPI5sSx76jE7MAz49CYvSORMa/Gc19agA=";
+  vendorHash = "sha256-vuEqimNRWQGwybzOkGVoevpyVpU8XyXqhAIa7I66ajs=";

  proxyVendor = true;

@@ -1,7 +1,7 @@
 { branch ? "stable", callPackage, fetchurl, lib, stdenv }:
 let
  versions = if stdenv.isLinux then {
-    stable = "0.0.28";
+    stable = "0.0.29";
    ptb = "0.0.45";
    canary = "0.0.166";
    development = "0.0.217";
@@ -16,7 +16,7 @@ let
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        sha256 = "sha256-JwxVVm/QIBLoVyQ2Ff/MX06UNgZ+dAsD960GsCg1M+U=";
+        sha256 = "sha256-3vjOvkqMD7qKX2zRUbKrw5gHtE/v8WfH557rtagWIWc=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
@@ -34,7 +34,7 @@ let
  };

  xrdp = stdenv.mkDerivation rec {
-    version = "0.9.22.1";
+    version = "0.9.23";
    pname = "xrdp";

    src = fetchFromGitHub {
@@ -42,7 +42,7 @@ let
      repo = "xrdp";
      rev = "v${version}";
      fetchSubmodules = true;
-      hash = "sha256-8gAP4wOqSmar8JhKRt4qRRwh23coIn0Q8Tt9ClHQSt8=";
+      hash = "sha256-14qsRfLn+26rm+vyMmOtaBEs8mWfSTIsIVseSC2FjXc=";
    };

    nativeBuildInputs = [ pkg-config autoconf automake which libtool nasm perl ];
@@ -4,12 +4,12 @@
 }:

 let
-  version = "1.6.1";
+  version = "1.8.0";
  src = fetchFromGitHub {
    owner  = "tamarin-prover";
    repo   = "tamarin-prover";
    rev    = version;
-    sha256 = "sha256:0cz1v7k4d0im749ag632nc34n91b51b0pq4z05rzw1p59a5lza92";
+    sha256 = "sha256-ujnaUdbjqajmkphOS4Fs4QBCRGX4JZkQ2p1X2jripww=";
  };

  # tamarin has its own dependencies, but they're kept inside the repo,
@@ -51,6 +51,7 @@ let
    doHaddock = false; # broken
    libraryHaskellDepends = (with haskellPackages; [
      aeson aeson-pretty parallel uniplate
+      regex-pcre-builtin regex-posix split
    ]) ++ [ tamarin-prover-utils tamarin-prover-term ];
  });

@@ -62,31 +63,37 @@ let
    ]) ++ [ tamarin-prover-theory ];
  });

+  tamarin-prover-accountability = mkDerivation (common "tamarin-prover-accountability" (src + "/lib/accountability") // {
+    postPatch = "cp --remove-destination ${src}/LICENSE .";
+    doHaddock = false; # broken
+    libraryHaskellDepends = (with haskellPackages; [
+      raw-strings-qq
+    ]) ++ [
+      tamarin-prover-utils
+      tamarin-prover-term
+      tamarin-prover-theory
+    ];
+  });
+
+  tamarin-prover-export = mkDerivation (common "tamarin-prover-export" (src + "/lib/export") // {
+    postPatch = "cp --remove-destination ${src}/LICENSE .";
+    doHaddock = false; # broken
+    libraryHaskellDepends = (with haskellPackages; [
+      HStringTemplate
+    ]) ++ [
+      tamarin-prover-utils
+      tamarin-prover-term
+      tamarin-prover-theory
+      tamarin-prover-sapic
+    ];
+  });
+
 in
 mkDerivation (common "tamarin-prover" src // {
  isLibrary = false;
  isExecutable = true;

-  patches = [
-    # Backport unreleased patch allowing maude 3.2.1
-    (fetchpatch {
-      name = "tamarin-prover-allow-maude-3.2.1.patch";
-      url = "https://github.com/tamarin-prover/tamarin-prover/commit/bfcf56909479e154a203f0eeefa767f4d91b600d.patch";
-      sha256 = "1zjqzyxwnfp7z3h3li8jrxn9732dx6lyq9q3w2dsphmxbzrs64dg";
-    })
-    # Backport unreleased patch allowing maude 3.2.2
-    (fetchpatch {
-      name = "tamarin-prover-allow-maude-3.2.2.patch";
-      url = "https://github.com/tamarin-prover/tamarin-prover/commit/df1aa9fc4fcc72b6cf0bed0f71844efe3d8ad238.patch";
-      sha256 = "1bkwvyyz5d660jjh08z8wq9c3l40s0rxd2nsbn20xnl2nynyvqpy";
-    })
-    # Backport proposed patch allowing maude 3.3 and 3.3.1
-    (fetchpatch {
-      name = "tamarin-prover-allow-maude-3.3.patch";
-      url = "https://github.com/tamarin-prover/tamarin-prover/pull/544/commits/d0313b1a1bac7c92130773f7ccdd890f8aec286d.patch";
-      sha256 = "1jhlz8vp9a3aahyhj24yjcv4l1389y9kg878yfnq0rkkgvk0m681";
-    })
-  ];
+  patches = [ ];

  # strip out unneeded deps manually
  doHaddock = false;
@@ -118,6 +125,8 @@ mkDerivation (common "tamarin-prover" src // {
    resourcet shakespeare threads wai warp yesod-core yesod-static
  ]) ++ [ tamarin-prover-utils
          tamarin-prover-sapic
+          tamarin-prover-accountability
+          tamarin-prover-export
          tamarin-prover-term
          tamarin-prover-theory
        ];
@@ -35,13 +35,13 @@

 mkDerivation rec {
  pname = "maui-shell";
-  version = "0.5.6";
+  version = "0.6.6";

  src = fetchFromGitHub {
    owner = "Nitrux";
    repo = pname;
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-lhTtIHE+FUgZFaPYoIRgLPrBUPISeXHCg3rn0FlQg7w=";
+    sha256 = "sha256-8D3rlYrqLfyDZQFRSaVlxLaEblbv8w787v8Np2aW3yc=";
  };

  nativeBuildInputs = [
@@ -105,6 +105,7 @@ let

    # Force compilers and other tools to look in default search paths
    unset NIX_ENFORCE_PURITY
+    export NIX_BINTOOLS_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
    export NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
    export NIX_CFLAGS_COMPILE='-idirafter /usr/include'
    export NIX_CFLAGS_LINK='-L/usr/lib -L/usr/lib32'
@@ -78,6 +78,7 @@ let

    # Force compilers and other tools to look in default search paths
    unset NIX_ENFORCE_PURITY
+    export NIX_BINTOOLS_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
    export NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
    export NIX_CFLAGS_COMPILE='-idirafter /usr/include'
    export NIX_CFLAGS_LINK='-L/usr/lib -L/usr/lib32'
@@ -4,6 +4,7 @@
 , fetchpatch
 , scfbuild
 , fontforge
+, node-glob
 , libuninameslist
 , nodejs
 , nodePackages
@@ -59,7 +60,7 @@ in stdenv.mkDerivation rec {
  nativeBuildInputs = [
    scfbuild-with-fontforge-20201107
    nodejs
-    nodePackages.glob
+    node-glob
    nodePackages.lodash
  ];

@@ -2,4 +2,4 @@

 # CMake's enable_language(CUDA) runs a compiler test and it doesn't account for
 # CUDAToolkit_ROOT. We have to help it locate libcudart
-export NVCC_APPEND_FLAGS+=" -L@cudartRoot@/lib -I@cudartRoot@/include"
+export NVCC_APPEND_FLAGS+=" -L@cudartLib@/lib -L@cudartStatic@/lib -I@cudartInclude@/include"
@@ -56,7 +56,7 @@ setupCUDAToolkitCompilers() {
    # CMake's enable_language(CUDA) runs a compiler test and it doesn't account for
    # CUDAToolkit_ROOT. We have to help it locate libcudart
    if [[ -z "${nvccDontPrependCudartFlags-}" ]] ; then
-        export NVCC_APPEND_FLAGS+=" -L@cudartRoot@/lib -I@cudartRoot@/include"
+        export NVCC_APPEND_FLAGS+=" -L@cudartLib@/lib -L@cudartStatic@/lib -I@cudartInclude@/include"
    fi
 }

@@ -1,3 +1,10 @@
+# Type Aliases
+#
+# See ./extension.nix:
+# - ReleaseAttrs
+# - ReleaseFeaturesAttrs
+#
+# General callPackage-supplied arguments
 { lib
 , stdenv
 , backendStdenv
@@ -5,23 +12,58 @@
 , autoPatchelfHook
 , autoAddOpenGLRunpathHook
 , markForCudatoolkitRootHook
+, lndir
+, symlinkJoin
+}:
+# Function arguments
+{
+  # Short package name (e.g., "cuda_cccl")
+  # pname : String
+  pname
+, # Long package name (e.g., "CXX Core Compute Libraries")
+  # description : String
+  description
+, # platforms : List System
+  platforms
+, # version : Version
+  version
+, # releaseAttrs : ReleaseAttrs
+  releaseAttrs
+, # releaseFeaturesAttrs : ReleaseFeaturesAttrs
+  releaseFeaturesAttrs
+,
 }:
-
-pname:
-attrs:
-
 let
-  arch = "linux-x86_64";
+  # Useful imports
+  inherit (lib.lists) optionals;
+  inherit (lib.meta) getExe;
+  inherit (lib.strings) optionalString;
 in
 backendStdenv.mkDerivation {
-  inherit pname;
-  inherit (attrs) version;
+  # NOTE: Even though there's no actual buildPhase going on here, the derivations of the
+  # redistributables are sensitive to the compiler flags provided to stdenv. The patchelf package
+  # is sensitive to the compiler flags provided to stdenv, and we depend on it. As such, we are
+  # also sensitive to the compiler flags provided to stdenv.
+  inherit pname version;
+  strictDeps = true;

-  src = assert (lib.hasAttr arch attrs); fetchurl {
-    url = "https://developer.download.nvidia.com/compute/cuda/redist/${attrs.${arch}.relative_path}";
-    inherit (attrs.${arch}) sha256;
+  outputs = with releaseFeaturesAttrs;
+    [ "out" ]
+    ++ optionals hasBin [ "bin" ]
+    ++ optionals hasLib [ "lib" ]
+    ++ optionals hasStatic [ "static" ]
+    ++ optionals hasDev [ "dev" ]
+    ++ optionals hasDoc [ "doc" ]
+    ++ optionals hasSample [ "sample" ];
+
+  src = fetchurl {
+    url = "https://developer.download.nvidia.com/compute/cuda/redist/${releaseAttrs.relative_path}";
+    inherit (releaseAttrs) sha256;
  };

+  # We do need some other phases, like configurePhase, so the multiple-output setup hook works.
+  dontBuild = true;
+
  nativeBuildInputs = [
    autoPatchelfHook
    # This hook will make sure libcuda can be found
@@ -46,23 +88,87 @@ backendStdenv.mkDerivation {
    "$ORIGIN"
  ];

-  dontBuild = true;
+  installPhase = with releaseFeaturesAttrs;
+    # Pre-install hook
+    ''
+      runHook preInstall
+    ''
+    # doc and dev have special output handling. Other outputs need to be moved to their own
+    # output.
+    # Note that moveToOutput operates on all outputs:
+    # https://github.com/NixOS/nixpkgs/blob/2920b6fc16a9ed5d51429e94238b28306ceda79e/pkgs/build-support/setup-hooks/multiple-outputs.sh#L105-L107
+    + ''
+      mkdir -p "$out"
+      rm LICENSE
+      mv * "$out"
+    ''
+    # Handle bin, which defaults to out
+    + optionalString hasBin ''
+      moveToOutput "bin" "$bin"
+    ''
+    # Handle lib, which defaults to out
+    + optionalString hasLib ''
+      moveToOutput "lib" "$lib"
+    ''
+    # Handle static libs, which isn't handled by the setup hook
+    + optionalString hasStatic ''
+      moveToOutput "**/*.a" "$static"
+    ''
+    # Handle samples, which isn't handled by the setup hook
+    + optionalString hasSample ''
+      moveToOutput "samples" "$sample"
+    ''
+    # Post-install hook
+    + ''
+      runHook postInstall
+    '';

-  # TODO: choose whether to install static/dynamic libs
-  installPhase = ''
-    runHook preInstall
-    rm LICENSE
-    mkdir -p $out
-    mv * $out
-    runHook postInstall
+  # The out output leverages the same functionality which backs the `symlinkJoin` function in
+  # Nixpkgs:
+  # https://github.com/NixOS/nixpkgs/blob/d8b2a92df48f9b08d68b0132ce7adfbdbc1fbfac/pkgs/build-support/trivial-builders/default.nix#L510
+  #
+  # That should allow us to emulate "fat" default outputs without having to actually create them.
+  #
+  # It is important that this run after the autoPatchelfHook, otherwise the symlinks in out will reference libraries in lib, creating a circular dependency.
+  postPhases = [ "postPatchelf" ];
+  # For each output, create a symlink to it in the out output.
+  # NOTE: We must recreate the out output here, because the setup hook will have deleted it
+  # if it was empty.
+  # NOTE: Do not use optionalString based on whether `outputs` contains only `out` -- phases
+  # which are empty strings are skipped/unset and result in errors of the form "command not
+  # found: <customPhaseName>".
+  postPatchelf = ''
+    mkdir -p "$out"
+    for output in $outputs; do
+      if [ "$output" = "out" ]; then
+        continue
+      fi
+      ${getExe lndir} "''${!output}" "$out"
+    done
  '';

+  # Make the CUDA-patched stdenv available
  passthru.stdenv = backendStdenv;

+  # Setting propagatedBuildInputs to false will prevent outputs known to the multiple-outputs
+  # from depending on `out` by default.
+  # https://github.com/NixOS/nixpkgs/blob/2920b6fc16a9ed5d51429e94238b28306ceda79e/pkgs/build-support/setup-hooks/multiple-outputs.sh#L196
+  # Indeed, we want to do the opposite -- fat "out" outputs that contain all the other outputs.
+  propagatedBuildOutputs = false;
+
+  # By default, if the dev output exists it just uses that.
+  # However, because we disabled propagatedBuildOutputs, dev doesn't contain libraries or
+  # anything of the sort. To remedy this, we set outputSpecified to true, and use
+  # outputsToInstall, which tells Nix which outputs to use when the package name is used
+  # unqualified (that is, without an explicit output).
+  outputSpecified = true;
+
  meta = {
-    description = attrs.name;
+    inherit description platforms;
    license = lib.licenses.unfree;
    maintainers = lib.teams.cuda.members;
-    platforms = lib.optionals (lib.hasAttr arch attrs) [ "x86_64-linux" ];
+    # Force the use of the default, fat output by default (even though `dev` exists, which
+    # causes Nix to prefer that output over the others if outputSpecified isn't set).
+    outputsToInstall = [ "out" ];
  };
 }
@@ -1,33 +1,139 @@
-final: prev: let
-
+# Type Aliases
+#
+# ReleaseAttrs : {
+#   "relative_path" : String,
+#   "sha256" : String,
+#   "md5" : String,
+#   "size" : String,
+# }
+#
+# NOTE: PackageAttrs must have at least one of the arches.
+# PackageAttrs : {
+#   "name" : String,
+#   "license" : String,
+#   "version" : String,
+#   "license_path" : None | String,
+#   "linux-aarch64" : None | ReleaseAttrs,
+#   "linux-ppc64le" : None | ReleaseAttrs,
+#   "linux-sbsa" : None | ReleaseAttrs,
+#   "linux-x86_64" : None | ReleaseAttrs,
+#   "windows-x86_64" : None | ReleaseAttrs,
+# }
+#
+# ReleaseFeaturesAttrs : {
+#   "hasBin" : Boolean,
+#   "hasDev" : Boolean,
+#   "hasDoc" : Boolean,
+#   "hasLib" : Boolean,
+#   "hasOut" : Boolean,
+#   "hasSample" : Boolean,
+#   "hasStatic" : Boolean,
+#   "rootDirs" : List String,
+# }
+#
+# NOTE: PackageFeatureAttrs must have at least one of the arches.
+# PackageFeatureAttrs : {
+#   "linux-aarch64" : None | ReleaseFeaturesAttrs,
+#   "linux-ppc64le" : None | ReleaseFeaturesAttrs,
+#   "linux-sbsa" : None | ReleaseFeaturesAttrs,
+#   "linux-x86_64" : None | ReleaseFeaturesAttrs,
+#   "windows-x86_64" : None | ReleaseFeaturesAttrs,
+# }
+#
+final: prev:
+let
+  # NOTE: We use hasAttr throughout instead of the (?) operator because hasAttr does not require
+  # us to interpolate our variables into strings (like ${attrName}).
+  inherit (builtins) attrNames concatMap hasAttr listToAttrs removeAttrs;
  inherit (final) callPackage;
-  inherit (prev) cudaVersion lib;
+  inherit (prev) cudaVersion;
+  inherit (prev.lib.attrsets) nameValuePair optionalAttrs;
+  inherit (prev.lib.lists) optionals;
+  inherit (prev.lib.trivial) flip importJSON pipe;

-  ### Cuda Toolkit Redist
-
-  # Manifest files for redist cudatoolkit. These can be found at
+  # Manifest files for CUDA redistributables (aka redist). These can be found at
  # https://developer.download.nvidia.com/compute/cuda/redist/
-  cudaToolkitRedistManifests = {
-    "11.4" = ./manifests/redistrib_11.4.4.json;
-    "11.5" = ./manifests/redistrib_11.5.2.json;
-    "11.6" = ./manifests/redistrib_11.6.2.json;
-    "11.7" = ./manifests/redistrib_11.7.0.json;
-    "11.8" = ./manifests/redistrib_11.8.0.json;
-    "12.0" = ./manifests/redistrib_12.0.1.json;
-    "12.1" = ./manifests/redistrib_12.1.1.json;
-    "12.2" = ./manifests/redistrib_12.2.0.json;
+  # Maps a cuda version to the specific version of the manifest.
+  cudaVersionMap = {
+    "11.4" = "11.4.4";
+    "11.5" = "11.5.2";
+    "11.6" = "11.6.2";
+    "11.7" = "11.7.0";
+    "11.8" = "11.8.0";
+    "12.0" = "12.0.1";
+    "12.1" = "12.1.1";
+    "12.2" = "12.2.0";
  };

-  # Function to build a single cudatoolkit redist package
-  buildCudaToolkitRedistPackage = callPackage ./build-cuda-redist-package.nix { };
+  # Check if the current CUDA version is supported.
+  cudaVersionMappingExists = hasAttr cudaVersion cudaVersionMap;

-  # Function that builds all cudatoolkit redist packages given a cuda version and manifest file
-  buildCudaToolkitRedistPackages = { version, manifest }: let
-    attrs = lib.filterAttrs (key: value: key != "release_date") (lib.importJSON manifest);
-  in lib.mapAttrs buildCudaToolkitRedistPackage attrs;
+  # Maps a cuda version to its manifest files.
+  # The manifest itself is from NVIDIA, but the features manifest is generated
+  # by us ahead of time and allows us to split pacakges into multiple outputs.
+  # Package names (e.g., "cuda_cccl") are mapped to their attributes or features.
+  # Since we map each attribute to a package name, we need to make sure to get rid of meta
+  # attributes included in the manifest. Currently, these are any of the following:
+  # - release_date
+  # - release_label
+  # - release_product
+  redistManifests =
+    let
+      # Remove meta attributes from the manifest
+      # removeAttrs : AttrSet String b -> Attr String b
+      removeMetaAttrs = flip removeAttrs [ "release_date" "release_label" "release_product" ];
+      # processManifest : Path -> Attr Set (String PackageAttrs)
+      processManifest = flip pipe [ importJSON removeMetaAttrs ];
+      # fullCudaVersion : String
+      fullCudaVersion = cudaVersionMap.${cudaVersion};
+    in
+    {
+      # features : Attr Set (String PackageFeatureAttrs)
+      features = processManifest ./manifests/redistrib_features_${fullCudaVersion}.json;
+      # manifest : Attr Set (String PackageAttrs)
+      manifest = processManifest ./manifests/redistrib_${fullCudaVersion}.json;
+    };

-  # All cudatoolkit redist packages for the current cuda version
-  cudaToolkitRedistPackages = lib.optionalAttrs (lib.hasAttr cudaVersion cudaToolkitRedistManifests)
-    (buildCudaToolkitRedistPackages { version = cudaVersion; manifest = cudaToolkitRedistManifests.${cudaVersion}; });
+  # Function to build a single redist package
+  buildRedistPackage = callPackage ./build-cuda-redist-package.nix { };

-in cudaToolkitRedistPackages
+  # Function that builds all redist packages given manifests
+  buildRedistPackages = { features, manifest }:
+    let
+      wrapper = pname:
+        let
+          # Get the redist architectures the package provides distributables for
+          packageAttrs = manifest.${pname};
+
+          # Check if supported
+          # TODO(@connorbaker): Currently hardcoding x86_64-linux as the only supported platform.
+          isSupported = packageAttrs ? linux-x86_64;
+
+          # Build the derivation
+          drv = buildRedistPackage {
+            inherit pname;
+            # TODO(@connorbaker): We currently discard the license attribute.
+            inherit (manifest.${pname}) version;
+            description = manifest.${pname}.name;
+            platforms = [ "x86_64-linux" ];
+            releaseAttrs = manifest.${pname}.linux-x86_64;
+            releaseFeaturesAttrs = features.${pname}.linux-x86_64;
+          };
+
+          # Wrap in an optional so we can filter out the empty lists created by unsupported
+          # packages with concatMap.
+          wrapped = optionals isSupported [ (nameValuePair pname drv) ];
+        in
+        wrapped;
+
+      # concatMap provides us an easy way to filter out packages for unsupported platforms.
+      # We wrap the buildRedistPackage call in a list to prevent errors when the package is not
+      # supported (by returning an empty list).
+      redistPackages = listToAttrs (concatMap wrapper (attrNames manifest));
+    in
+    redistPackages;
+
+  # All redistributable packages for the current CUDA version
+  redistPackages = optionalAttrs cudaVersionMappingExists (buildRedistPackages redistManifests);
+in
+redistPackages
@@ -1,6 +1,8 @@
 final: prev:
 let
  inherit (prev) lib pkgs;
+  cudaVersionOlder = lib.versionOlder final.cudaVersion;
+  cudaVersionAtLeast = lib.versionAtLeast final.cudaVersion;
 in
 (lib.filterAttrs (attr: _: (prev ? "${attr}")) {
  ### Overrides to fix the components of cudatoolkit-redist
@@ -10,51 +12,83 @@ in

  libcufile = prev.libcufile.overrideAttrs (oldAttrs: {
    buildInputs = oldAttrs.buildInputs ++ [
-      prev.libcublas
+      final.libcublas.lib
      pkgs.numactl
      pkgs.rdma-core
    ];
    # libcuda needs to be resolved during runtime
-    autoPatchelfIgnoreMissingDeps = true;
+    autoPatchelfIgnoreMissingDeps =
+      ["libcuda.so.1"]
+      # Before 12.0 libcufile depends on itself for some reason.
+      ++ lib.optionals (cudaVersionOlder "12.0") [
+        "libcufile.so.0"
+      ];
  });

-  libcusolver = final.addBuildInputs prev.libcusolver [
-    prev.libcublas
-  ];
+  libcusolver = final.addBuildInputs prev.libcusolver (
+    # Always depends on this
+    [final.libcublas.lib]
+    # Dependency from 12.0 and on
+    ++ lib.optionals (cudaVersionAtLeast "12.0") [
+      final.libnvjitlink.lib
+    ]
+    # Dependency from 12.1 and on
+    ++ lib.optionals (cudaVersionAtLeast "12.1") [
+      final.libcusparse.lib
+    ]
+  );

-  cuda_nvcc = prev.cuda_nvcc.overrideAttrs (oldAttrs:
-    let
-      inherit (prev.backendStdenv) cc;
-    in
-    {
-      # Required by cmake's enable_language(CUDA) to build a test program
-      # When implementing cross-compilation support: this is
-      # final.pkgs.targetPackages.cudaPackages.cuda_cudart
-      env.cudartRoot = "${prev.lib.getDev final.cuda_cudart}";
+  libcusparse = final.addBuildInputs prev.libcusparse (
+    lib.optionals (cudaVersionAtLeast "12.0") [
+      final.libnvjitlink.lib
+    ]
+  );

-      # Point NVCC at a compatible compiler
+  cuda_gdb = final.addBuildInputs prev.cuda_gdb (
+    # x86_64 only needs gmp from 12.0 and on
+    lib.optionals (cudaVersionAtLeast "12.0") [
+      pkgs.gmp
+    ]
+  );

-      # Desiredata: whenever a package (e.g. magma) adds cuda_nvcc to
-      # nativeBuildInputs (offsets `(-1, 0)`), magma should also source the
-      # setupCudaHook, i.e. we want it the hook to be propagated into the
-      # same nativeBuildInputs.
-      #
-      # Logically, cuda_nvcc should include the hook in depsHostHostPropagated,
-      # so that the final offsets for the propagated hook would be `(-1, 0) +
-      # (0, 0) = (-1, 0)`.
-      #
-      # In practice, TargetTarget appears to work:
-      # https://gist.github.com/fd80ff142cd25e64603618a3700e7f82
-      depsTargetTargetPropagated = [
-        final.setupCudaHook
-      ];
-    });
+  cuda_nvcc = prev.cuda_nvcc.overrideAttrs (_: {
+    # Required by cmake's enable_language(CUDA) to build a test program
+    # When implementing cross-compilation support: this is
+    # final.pkgs.targetPackages.cudaPackages.cuda_cudart
+    env = {
+      # Given the multiple-outputs each CUDA redist has, we can specify the exact components we
+      # need from the package. CMake requires:
+      # - the cuda_runtime.h header, which is in the dev output
+      # - the dynamic library, which is in the lib output
+      # - the static library, which is in the static output
+      cudartInclude = "${final.cuda_cudart.dev}";
+      cudartLib = "${final.cuda_cudart.lib}";
+      cudartStatic = "${final.cuda_cudart.static}";
+    };
+
+    # Point NVCC at a compatible compiler
+
+    # Desiredata: whenever a package (e.g. magma) adds cuda_nvcc to
+    # nativeBuildInputs (offsets `(-1, 0)`), magma should also source the
+    # setupCudaHook, i.e. we want it the hook to be propagated into the
+    # same nativeBuildInputs.
+    #
+    # Logically, cuda_nvcc should include the hook in depsHostHostPropagated,
+    # so that the final offsets for the propagated hook would be `(-1, 0) +
+    # (0, 0) = (-1, 0)`.
+    #
+    # In practice, TargetTarget appears to work:
+    # https://gist.github.com/fd80ff142cd25e64603618a3700e7f82
+    depsTargetTargetPropagated = [
+      final.setupCudaHook
+    ];
+  });

  cuda_nvprof = prev.cuda_nvprof.overrideAttrs (oldAttrs: {
    nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ pkgs.addOpenGLRunpath ];
-    buildInputs = oldAttrs.buildInputs ++ [ prev.cuda_cupti ];
+    buildInputs = oldAttrs.buildInputs ++ [ final.cuda_cupti.lib ];
    # libcuda needs to be resolved during runtime
-    autoPatchelfIgnoreMissingDeps = true;
+    autoPatchelfIgnoreMissingDeps = ["libcuda.so.1"];
  });

  cuda_demo_suite = final.addBuildInputs prev.cuda_demo_suite [
@@ -62,8 +96,8 @@ in
    pkgs.libGLU
    pkgs.libglvnd
    pkgs.mesa
-    prev.libcufft
-    prev.libcurand
+    final.libcufft.lib
+    final.libcurand.lib
  ];

  nsight_compute = prev.nsight_compute.overrideAttrs (oldAttrs: {
@@ -100,7 +134,7 @@ in

  nvidia_driver = prev.nvidia_driver.overrideAttrs (oldAttrs: {
    # libcuda needs to be resolved during runtime
-    autoPatchelfIgnoreMissingDeps = true;
+    autoPatchelfIgnoreMissingDeps = ["libcuda.so.1"];
    # No need to support this package as we have drivers already
    # in linuxPackages.
    meta.broken = true;
@@ -2,12 +2,12 @@

 let
  base = (callPackage ./generic.nix (_args // {
-    version = "8.3.0beta3";
+    version = "8.3.0RC1";
    hash = null;
  })).overrideAttrs (oldAttrs: {
    src = fetchurl {
-      url = "https://downloads.php.net/~eric/php-8.3.0beta3.tar.xz";
-      hash = "sha256-XW3t9BOsBFvThYXF66faVl8VyMLFB+Oi7h45vWUmE6Y=";
+      url = "https://downloads.php.net/~jakub/php-8.3.0RC1.tar.xz";
+      hash = "sha256-pWnkxSIhzKU8Cp+AiGzqhqRtWoJu+zBfCM45n2ugH7c=";
    };
  });
 in
@@ -7,18 +7,21 @@

 buildGoModule rec {
  pname = "risor";
-  version = "0.15.0";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "risor-io";
    repo = "risor";
    rev = "v${version}";
-    hash = "sha256-aBUM/+mAuQ+JUOqeMtRYpOwdKbD6An9/Nc2Q6YDnUmE=";
+    hash = "sha256-/7jUz2180m+YVyE9z4UKOhVv0DSqrCWdkyAftluMHeo=";
  };

-  sourceRoot = "${src.name}/cmd/risor";
+  proxyVendor = true;
+  vendorHash = "sha256-OUQY5yzsbMS81gRb1mIvkRHal4mvOE2Na2HAsqkeWG4=";

-  vendorHash = "sha256-vlrYmY70nEAI8FSsMzZtuLMt8+aVi0jDX7PGKRMw4r8=";
+  subPackages = [
+    "cmd/risor"
+  ];

  ldflags = [
    "-s"
@@ -41,3 +44,4 @@ buildGoModule rec {
    maintainers = with maintainers; [ figsoda ];
  };
 }
+
@@ -1,6 +1,7 @@
 { stdenv,
  backendStdenv,
  lib,
+  lndir,
  zlib,
  useCudatoolkitRunfile ? false,
  cudaVersion,
@@ -10,14 +11,6 @@
  autoPatchelfHook,
  autoAddOpenGLRunpathHook,
  fetchurl,
-  # The distributed version of CUDNN includes both dynamically liked .so files,
-  # as well as statically linked .a files.  However, CUDNN is quite large
-  # (multiple gigabytes), so you can save some space in your nix store by
-  # removing the statically linked libraries if you are not using them.
-  #
-  # Setting this to true removes the statically linked .a files.
-  # Setting this to false keeps these statically linked .a files.
-  removeStatic ? false,
 }: {
  version,
  url,
@@ -48,11 +41,16 @@ in
  backendStdenv.mkDerivation {
    pname = "cudatoolkit-${cudaMajorVersion}-cudnn";
    version = versionTriple;
+    strictDeps = true;
+    outputs = ["out" "lib" "static" "dev"];

    src = fetchurl {
      inherit url hash;
    };

+    # We do need some other phases, like configurePhase, so the multiple-output setup hook works.
+    dontBuild = true;
+
    # Check and normalize Runpath against DT_NEEDED using autoPatchelf.
    # Prepend /run/opengl-driver/lib using addOpenGLRunpath for dlopen("libcudacuda.so")
    nativeBuildInputs = [
@@ -74,27 +72,49 @@ in
    #
    # Note also that version <=8.3.0 contained a subdirectory "lib64/" but in
    # version 8.3.2 it seems to have been renamed to simply "lib/".
+    #
+    # doc and dev have special output handling. Other outputs need to be moved to their own
+    # output.
+    # Note that moveToOutput operates on all outputs:
+    # https://github.com/NixOS/nixpkgs/blob/2920b6fc16a9ed5d51429e94238b28306ceda79e/pkgs/build-support/setup-hooks/multiple-outputs.sh#L105-L107
    installPhase =
      ''
        runHook preInstall

-        mkdir -p $out
-        cp -a include $out/include
-        [ -d "lib/" ] && cp -a lib $out/lib
-        [ -d "lib64/" ] && cp -a lib64 $out/lib64
-      ''
-      + strings.optionalString removeStatic ''
-        rm -f $out/lib/*.a
-        rm -f $out/lib64/*.a
-      ''
-      + ''
+        mkdir -p "$out"
+        mv * "$out"
+        moveToOutput "lib64" "$lib"
+        moveToOutput "lib" "$lib"
+        moveToOutput "**/*.a" "$static"
+
        runHook postInstall
      '';

    # Without --add-needed autoPatchelf forgets $ORIGIN on cuda>=8.0.5.
    postFixup = strings.optionalString (strings.versionAtLeast versionTriple "8.0.5") ''
-      patchelf $out/lib/libcudnn.so --add-needed libcudnn_cnn_infer.so
-      patchelf $out/lib/libcudnn_ops_infer.so --add-needed libcublas.so --add-needed libcublasLt.so
+      patchelf $lib/lib/libcudnn.so --add-needed libcudnn_cnn_infer.so
+      patchelf $lib/lib/libcudnn_ops_infer.so --add-needed libcublas.so --add-needed libcublasLt.so
+    '';
+
+    # The out output leverages the same functionality which backs the `symlinkJoin` function in
+    # Nixpkgs:
+    # https://github.com/NixOS/nixpkgs/blob/d8b2a92df48f9b08d68b0132ce7adfbdbc1fbfac/pkgs/build-support/trivial-builders/default.nix#L510
+    #
+    # That should allow us to emulate "fat" default outputs without having to actually create them.
+    #
+    # It is important that this run after the autoPatchelfHook, otherwise the symlinks in out will reference libraries in lib, creating a circular dependency.
+    postPhases = ["postPatchelf"];
+    # For each output, create a symlink to it in the out output.
+    # NOTE: We must recreate the out output here, because the setup hook will have deleted it
+    # if it was empty.
+    # NOTE: Do not use optionalString based on whether `outputs` contains only `out` -- phases
+    # which are empty strings are skipped/unset and result in errors of the form "command not
+    # found: <customPhaseName>".
+    postPatchelf = ''
+      mkdir -p "$out"
+      ${lib.meta.getExe lndir} "$lib" "$out"
+      ${lib.meta.getExe lndir} "$static" "$out"
+      ${lib.meta.getExe lndir} "$dev" "$out"
    '';

    passthru = {
@@ -111,6 +131,19 @@ in
      majorVersion = versions.major versionTriple;
    };

+    # Setting propagatedBuildInputs to false will prevent outputs known to the multiple-outputs
+    # from depending on `out` by default.
+    # https://github.com/NixOS/nixpkgs/blob/2920b6fc16a9ed5d51429e94238b28306ceda79e/pkgs/build-support/setup-hooks/multiple-outputs.sh#L196
+    # Indeed, we want to do the opposite -- fat "out" outputs that contain all the other outputs.
+    propagatedBuildOutputs = false;
+
+    # By default, if the dev output exists it just uses that.
+    # However, because we disabled propagatedBuildOutputs, dev doesn't contain libraries or
+    # anything of the sort. To remedy this, we set outputSpecified to true, and use
+    # outputsToInstall, which tells Nix which outputs to use when the package name is used
+    # unqualified (that is, without an explicit output).
+    outputSpecified = true;
+
    meta = with lib; {
      # Check that the cudatoolkit version satisfies our min/max constraints (both
      # inclusive). We mark the package as broken if it fails to satisfies the
@@ -127,5 +160,8 @@ in
      license = licenses.unfree;
      platforms = ["x86_64-linux"];
      maintainers = with maintainers; [mdaiter samuela];
+      # Force the use of the default, fat output by default (even though `dev` exists, which
+      # causes Nix to prefer that output over the others if outputSpecified isn't set).
+      outputsToInstall = ["out"];
    };
  }
@@ -113,13 +113,17 @@ stdenv.mkDerivation {
    lapack
    blas
  ] ++ lists.optionals cudaSupport (with cudaPackages; [
-    cuda_cudart
-    libcublas # cublas_v2.h
-    libcusparse # cusparse.h
+    cuda_cudart.dev # cuda_runtime.h
+    cuda_cudart.lib # cudart
+    cuda_cudart.static # cudart_static
+    libcublas.dev # cublas_v2.h
+    libcublas.lib # cublas
+    libcusparse.dev # cusparse.h
+    libcusparse.lib # cusparse
  ] ++ lists.optionals (strings.versionOlder cudaVersion "11.8") [
-    cuda_nvprof # <cuda_profiler_api.h>
+    cuda_nvprof.dev # <cuda_profiler_api.h>
  ] ++ lists.optionals (strings.versionAtLeast cudaVersion "11.8") [
-    cuda_profiler_api # <cuda_profiler_api.h>
+    cuda_profiler_api.dev # <cuda_profiler_api.h>
  ]) ++ lists.optionals rocmSupport [
    hip
    hipblas
@@ -66,6 +66,7 @@ mapAliases {
  inherit (pkgs) firebase-tools; # added 2023-08-18
  flood = pkgs.flood; # Added 2023-07-25
  git-ssb = throw "git-ssb was removed because it was broken"; # added 2023-08-21
+  glob = pkgs.node-glob; # added 2023-08-18
  inherit (pkgs) graphqurl; # added 2023-08-19
  gtop = pkgs.gtop; # added 2023-07-31
  inherit (pkgs) html-minifier; # added 2023-08-19
@@ -133,7 +133,6 @@
 , "git-standup"
 , "@gitbeaker/cli"
 , "gitmoji-cli"
-, "glob"
 , "gramma"
 , "grammarly-languageserver"
 , "graphql"
@@ -88688,71 +88688,6 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-  glob = nodeEnv.buildNodePackage {
-    name = "glob";
-    packageName = "glob";
-    version = "10.3.3";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/glob/-/glob-10.3.3.tgz";
-      sha512 = "92vPiMb/iqpmEgsOoIDvTjc50wf9CCCvMzsi6W0JLPeUKE8TWP1a73PgqSrqy7iAZxaSD1YdzU7QZR5LF51MJw==";
-    };
-    dependencies = [
-      sources."@isaacs/cliui-8.0.2"
-      sources."ansi-regex-5.0.1"
-      sources."ansi-styles-6.2.1"
-      sources."balanced-match-1.0.2"
-      sources."brace-expansion-2.0.1"
-      sources."color-convert-2.0.1"
-      sources."color-name-1.1.4"
-      sources."cross-spawn-7.0.3"
-      sources."eastasianwidth-0.2.0"
-      sources."emoji-regex-9.2.2"
-      sources."foreground-child-3.1.1"
-      sources."is-fullwidth-code-point-3.0.0"
-      sources."isexe-2.0.0"
-      sources."jackspeak-2.3.0"
-      sources."lru-cache-10.0.1"
-      sources."minimatch-9.0.3"
-      sources."minipass-7.0.3"
-      sources."path-key-3.1.1"
-      sources."path-scurry-1.10.1"
-      sources."shebang-command-2.0.0"
-      sources."shebang-regex-3.0.0"
-      sources."signal-exit-4.1.0"
-      sources."string-width-5.1.2"
-      (sources."string-width-cjs-4.2.3" // {
-        dependencies = [
-          sources."emoji-regex-8.0.0"
-          sources."strip-ansi-6.0.1"
-        ];
-      })
-      (sources."strip-ansi-7.1.0" // {
-        dependencies = [
-          sources."ansi-regex-6.0.1"
-        ];
-      })
-      sources."strip-ansi-cjs-6.0.1"
-      sources."which-2.0.2"
-      sources."wrap-ansi-8.1.0"
-      (sources."wrap-ansi-cjs-7.0.0" // {
-        dependencies = [
-          sources."ansi-styles-4.3.0"
-          sources."emoji-regex-8.0.0"
-          sources."string-width-4.2.3"
-          sources."strip-ansi-6.0.1"
-        ];
-      })
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "the most correct and second fastest glob implementation in JavaScript";
-      homepage = "https://github.com/isaacs/node-glob#readme";
-      license = "ISC";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
  gramma = nodeEnv.buildNodePackage {
    name = "gramma";
    packageName = "gramma";
@@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "aioridwell";
-  version = "2023.07.0";
+  version = "2023.08.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "bachya";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-8EPELXxSq+B9o9eMFeM5ZPVYTa1+kT/S6cO7hKtD18s=";
+    hash = "sha256-AreQC5LOthnOEj0HnEww4zLob394XwCvqZBwjsT2Lcg=";
  };

  patches = [
@@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "django-admin-datta";
-  version = "1.0.7";
+  version = "1.0.10";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Onk9T+QKsl8y68eJ2ikrUEeMc9ljzzvSw7cjjP4D3sE=";
+    hash = "sha256-VV7mb3501aZVuXUqzVqQYUttvkYa4pAECYWn7HksOmI=";
  };

  propagatedBuildInputs = [
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "grpc-interceptor";
-  version = "0.15.2";
+  version = "0.15.3";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "d5h-foss";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-zulK0SVehzHcrmgIyH0D5sUOiAN53eIg88IoVyF6/DA=";
+    hash = "sha256-tTi1X1r7584ZXa12eLp2G/Am8G6Dnd18eE5wF/Lp/EY=";
  };

  patches = [
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "mashumaro";
-  version = "3.9";
+  version = "3.9.1";
  format = "pyproject";
  disabled = pythonOlder "3.7";

@@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "Fatal1ty";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-oH44poFVnoM831dJuA9KcHCsuW6gh5B2EHrnKwza6A4=";
+    hash = "sha256-VDB6313lvKuLJFOnuzEaiiRLUBOvbdjfowgl3nvG8Y0=";
  };

  nativeBuildInputs = [
@@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "pytile";
-  version = "2023.04.0";
+  version = "2023.08.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "bachya";
    repo = pname;
-    rev = version;
-    hash = "sha256-SFHWhXKC7PIqanJIQyGcpM8klwxOAJPVtzk9w0i2YYA=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-wPtGofli3ZKBcAwjwjCbeYnLaSZ5lLshlBSz1/WlAcg=";
  };

  patches = [
@@ -196,7 +196,8 @@ in buildPythonPackage rec {
    export TORCH_CUDA_ARCH_LIST="${gpuTargetString}"
    export CC=${cudatoolkit.cc}/bin/gcc CXX=${cudatoolkit.cc}/bin/g++
  '' + lib.optionalString (cudaSupport && cudnn != null) ''
-    export CUDNN_INCLUDE_DIR=${cudnn}/include
+    export CUDNN_INCLUDE_DIR=${cudnn.dev}/include
+    export CUDNN_LIB_DIR=${cudnn.lib}/lib
  '' + lib.optionalString rocmSupport ''
    export ROCM_PATH=${rocmtoolkit_joined}
    export ROCM_SOURCE_DIR=${rocmtoolkit_joined}
@@ -290,7 +291,7 @@ in buildPythonPackage rec {

  buildInputs = [ blas blas.provider pybind11 ]
    ++ lib.optionals stdenv.isLinux [ linuxHeaders_5_19 ] # TMP: avoid "flexible array member" errors for now
-    ++ lib.optionals cudaSupport [ cudnn nccl ]
+    ++ lib.optionals cudaSupport [ cudnn.dev cudnn.lib nccl ]
    ++ lib.optionals rocmSupport [ openmp ]
    ++ lib.optionals (cudaSupport || rocmSupport) [ magma ]
    ++ lib.optionals stdenv.isLinux [ numactl ]
@@ -1,22 +1,20 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 , aiohttp
 , eth-abi
 , eth-account
 , eth-hash
 , eth-typing
 , eth-utils
-, eth-rlp
 , hexbytes
 , ipfshttpclient
 , jsonschema
 , lru-dict
 , protobuf
 , requests
-, typing-extensions
 , websockets
-, pythonOlder
 }:

 buildPythonPackage rec {
@@ -33,24 +31,25 @@ buildPythonPackage rec {
    hash = "sha256-RNWCZQjcse415SSNkHhMWckDcBJGFZnjisckF7gbYY8=";
  };

+  # Note: to reflect the extra_requires in main/setup.py.
+  passthru.optional-dependencies = {
+    ipfs = [ ipfshttpclient ];
+  };
+
  propagatedBuildInputs = [
    aiohttp
    eth-abi
    eth-account
-    eth-hash
-    eth-rlp
+    eth-hash ] ++ eth-hash.optional-dependencies.pycryptodome ++ [
    eth-typing
    eth-utils
    hexbytes
-    ipfshttpclient
    jsonschema
    lru-dict
    protobuf
    requests
    websockets
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
-  ] ++ eth-hash.optional-dependencies.pycryptodome;
+  ];

  # TODO: package eth-tester required for tests
  doCheck = false;
@@ -64,9 +63,9 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    description = "Web3 library for interactions";
-    homepage = "https://github.com/ethereum/web3";
+    description = "A python interface for interacting with the Ethereum blockchain and ecosystem";
+    homepage = "https://web3py.readthedocs.io/";
    license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ hellwolf ];
  };
 }
@@ -4,9 +4,9 @@ version = 3

 [[package]]
 name = "addr2line"
-version = "0.20.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4fa78e18c64fce05e902adecd7a5eed15a5e0a3439f7b0e169f0252214865e3"
+checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
 dependencies = [
 "gimli",
 ]
@@ -30,9 +30,9 @@ dependencies = [

 [[package]]
 name = "aho-corasick"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b8f9420f797f2d9e935edf629310eb938a0d839f984e25327f3c7eed22300c"
+checksum = "6748e8def348ed4d14996fa801f4122cd763fff530258cdc03f64b25f89d3a5a"
 dependencies = [
 "memchr",
 ]
@@ -54,9 +54,9 @@ dependencies = [

 [[package]]
 name = "anyhow"
-version = "1.0.72"
+version = "1.0.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b13c32d80ecc7ab747b80c3784bce54ee8a7a0cc4fbda9bf4cda2cf6fe90854"
+checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"

 [[package]]
 name = "arrayref"
@@ -102,7 +102,7 @@ checksum = "bc00ceb34980c03614e35a3a4e218276a0a824e911d07651cd0d858a51e8c0f0"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -131,9 +131,9 @@ checksum = "7b7e4c2464d97fe331d41de9d5db0def0a96f4d823b8b32a2efd503578988973"

 [[package]]
 name = "backtrace"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4319208da049c43661739c5fade2ba182f09d1dc2299b32298d3a31692b17e12"
+checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
 dependencies = [
 "addr2line",
 "cc",
@@ -202,23 +202,33 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

 [[package]]
 name = "bitflags"
-version = "2.3.3"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "bpaf"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c359c5e742f51d3238e83af24b289903591fbce38990eb9fcc903c7f8d5d95f9"
+checksum = "1dc3b1bd654a8d16eea03586c3eee8ffd25c7f242b9eae9730cc442834fe56d9"
 dependencies = [
 "owo-colors",
 "supports-color",
 ]

+[[package]]
+name = "bstr"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6798148dccfbff0fae41c7574d2fa8f1ef3492fba0face179de5d8d447d67b05"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.13.0"
@@ -251,9 +261,9 @@ checksum = "a2698f953def977c68f935bb0dfa959375ad4638570e969e2f1e9f433cbf1af6"

 [[package]]
 name = "cc"
-version = "1.0.82"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "305fe645edc1442a0fa8b6726ba61d422798d37a52e12eaecf4b022ebbb88f01"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
 dependencies = [
 "libc",
 ]
@@ -313,7 +323,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28a097f142aeb5b03af73595536cd55f5d649fca4d656379aac86b3af133cf92"
 dependencies = [
 "comemo-macros",
- "siphasher",
+ "siphasher 0.3.11",
 ]

 [[package]]
@@ -463,9 +473,9 @@ dependencies = [

 [[package]]
 name = "dashmap"
-version = "5.5.0"
+version = "5.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6943ae99c34386c84a470c499d3414f66502a41340aa895406e0d2e4a207b91d"
+checksum = "9b101bb8960ab42ada6ae98eb82afcea4452294294c45b681295af26610d6d28"
 dependencies = [
 "cfg-if",
 "hashbrown 0.14.0",
@@ -482,9 +492,9 @@ checksum = "8d7439c3735f405729d52c3fbbe4de140eaf938a1fe47d227c27f8254d4302a5"

 [[package]]
 name = "deranged"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7684a49fb1af197853ef7b2ee694bc1f5b4179556f1e5710e1760c5db6f5e929"
+checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"

 [[package]]
 name = "dirs"
@@ -515,14 +525,14 @@ checksum = "487585f4d0c6655fe74905e2504d8ad6908e4db67f744eb140876906c2f3175d"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
 name = "ecow"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5c5051925c54d9a42c8652313b5358a7432eed209466b443ed5220431243a14"
+checksum = "1d1990d053cf6edf3f030682dba3b0eb65ef01fabb2686072765d8a17d6728e8"
 dependencies = [
 "serde",
 ]
@@ -544,9 +554,9 @@ dependencies = [

 [[package]]
 name = "encoding_rs"
-version = "0.8.32"
+version = "0.8.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071a31f4ee85403370b58aca746f01041ede6f0da2730960ad001edc2b71b394"
+checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
 dependencies = [
 "cfg-if",
 ]
@@ -561,7 +571,7 @@ dependencies = [
 "num-traits",
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -661,9 +671,9 @@ dependencies = [

 [[package]]
 name = "flate2"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b9429470923de8e8cbd4d2dc513535400b4b3fef0319fb5c4e1f520a7bef743"
+checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
 dependencies = [
 "crc32fast",
 "miniz_oxide",
@@ -801,7 +811,7 @@ checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -859,15 +869,39 @@ dependencies = [

 [[package]]
 name = "gimli"
-version = "0.27.3"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c80984affa11d98d1b88b66ac8853f143217b399d3c74116778ff8fdb4ed2e"
+checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
+
+[[package]]
+name = "globmatch"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0e82f77d5e36ce0c3941a39a6d8fff8ed9553ae13586b31640d6885f7376097"
+dependencies = [
+ "globset",
+ "log",
+ "walkdir",
+]
+
+[[package]]
+name = "globset"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "759c97c1e17c55525b57192c06a267cda0ac5210b222d6b82189a2338fa1c13d"
+dependencies = [
+ "aho-corasick",
+ "bstr",
+ "fnv",
+ "log",
+ "regex",
+]

 [[package]]
 name = "h2"
-version = "0.3.20"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97ec8491ebaf99c8eaa73058b045fe58073cd6be7f596ac993ced0b0a0c01049"
+checksum = "91fc23aa11be92976ef4729127f1a74adf36d8436f7816b185d18df956790833"
 dependencies = [
 "bytes",
 "fnv",
@@ -969,9 +1003,9 @@ checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"

 [[package]]
 name = "httpdate"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"

 [[package]]
 name = "hyper"
@@ -1309,6 +1343,15 @@ dependencies = [
 "phf",
 ]

+[[package]]
+name = "itertools"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itertools"
 version = "0.11.0"
@@ -1436,9 +1479,9 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"

 [[package]]
 name = "lsp-types"
@@ -1542,9 +1585,9 @@ dependencies = [

 [[package]]
 name = "num-bigint"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f93ab6289c7b344a8a9f60f88d80aa20032336fe78da341afc91c8a2341fc75f"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
 dependencies = [
 "autocfg",
 "num-integer",
@@ -1600,9 +1643,9 @@ checksum = "e25be21376a772d15f97ae789845340a9651d3c4246ff5ebb6a2b35f9c37bd31"

 [[package]]
 name = "object"
-version = "0.31.1"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bda667d9f2b5051b8833f59f3bf748b28ef54f850f4fcb389a252aa383866d1"
+checksum = "77ac5bbd07aea88c60a577a1ce218075ffd59208b2d7ca97adf9bfc5aeb21ebe"
 dependencies = [
 "memchr",
 ]
@@ -1645,7 +1688,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -1745,7 +1788,7 @@ dependencies = [
 "futures-util",
 "once_cell",
 "opentelemetry_api",
- "ordered-float 3.7.0",
+ "ordered-float 3.9.1",
 "percent-encoding",
 "rand",
 "regex",
@@ -1771,9 +1814,9 @@ dependencies = [

 [[package]]
 name = "ordered-float"
-version = "3.7.0"
+version = "3.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fc2dbde8f8a79f2102cc474ceb0ad68e3b80b85289ea62389b60e66777e4213"
+checksum = "2a54938017eacd63036332b4ae5c8a49fc8c0c1d6d629893057e4f13609edd06"
 dependencies = [
 "num-traits",
 ]
@@ -1851,7 +1894,7 @@ version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90fcb95eef784c2ac79119d1dd819e162b5da872ce6f3c3abe1e8ca1c082f72b"
 dependencies = [
- "siphasher",
+ "siphasher 0.3.11",
 ]

 [[package]]
@@ -1877,14 +1920,14 @@ checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
 name = "pin-project-lite"
-version = "0.2.12"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12cc1b0bf1727a77a54b6654e7b5f1af8604923edc8b81885f8ec92f9e3f0a05"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"

 [[package]]
 name = "pin-utils"
@@ -1923,9 +1966,9 @@ dependencies = [

 [[package]]
 name = "png"
-version = "0.17.9"
+version = "0.17.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59871cc5b6cce7eaccca5a802b4173377a1c2ba90654246789a8fa2334426d11"
+checksum = "dd75bf2d8dd3702b9707cdbc56a5b9ef42cec752eb8b3bafc01234558442aa64"
 dependencies = [
 "bitflags 1.3.2",
 "crc32fast",
@@ -2028,9 +2071,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.32"
+version = "1.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50f3b39ccfb720540debaa0164757101c08ecb8d326b15358ce76a62c7e85965"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
 "proc-macro2",
 ]
@@ -2153,9 +2196,9 @@ checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"

 [[package]]
 name = "reqwest"
-version = "0.11.18"
+version = "0.11.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cde824a14b7c14f85caff81225f411faacc04a2013f41670f41443742b1c1c55"
+checksum = "3e9ad3fe7488d7e34558a2033d45a0c90b72d97b4f80705666fea71472e2e6a1"
 dependencies = [
 "base64",
 "bytes",
@@ -2245,7 +2288,7 @@ dependencies = [
 "log",
 "roxmltree",
 "simplecss",
- "siphasher",
+ "siphasher 0.3.11",
 "svgtypes",
 ]

@@ -2270,7 +2313,7 @@ version = "0.38.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19ed4fa021d81c8392ce04db050a3da9a60299050b7ae1cf482d862b54a7218f"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
 "errno",
 "libc",
 "linux-raw-sys",
@@ -2300,9 +2343,9 @@ dependencies = [

 [[package]]
 name = "rustls-webpki"
-version = "0.101.3"
+version = "0.101.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "261e9e0888cba427c3316e6322805653c9425240b6fd96cee7cb671ab70ab8d0"
+checksum = "7d93931baf2d282fff8d3a532bbfd7653f734643161b87e3e01e59a04439bf0d"
 dependencies = [
 "ring",
 "untrusted",
@@ -2401,29 +2444,29 @@ dependencies = [

 [[package]]
 name = "serde"
-version = "1.0.183"
+version = "1.0.187"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32ac8da02677876d532745a130fc9d8e6edfa81a269b107c5b00829b91d8eb3c"
+checksum = "30a7fe14252655bd1e578af19f5fa00fe02fd0013b100ca6b49fde31c41bae4c"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.183"
+version = "1.0.187"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aafe972d60b0b9bee71a91b92fee2d4fb3c9d7e8f6b179aa99f27203d99a4816"
+checksum = "e46b2a6ca578b3f1d4501b12f78ed4692006d79d82a1a7c561c12dbc3d625eb8"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
 name = "serde_json"
-version = "1.0.104"
+version = "1.0.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "076066c5f1078eac5b722a31827a8832fe108bed65dfa75e233c89f8206e976c"
+checksum = "693151e1ac27563d6dbcec9dee9fbd5da8539b20fa14ad3752b2e6d363ace360"
 dependencies = [
 "itoa",
 "ryu",
@@ -2438,7 +2481,7 @@ checksum = "8725e1dfadb3a50f7e5ce0b1a540466f6ed3fe7a0fca2ac2b8b831d31316bd00"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -2500,15 +2543,21 @@ dependencies = [

 [[package]]
 name = "siphasher"
-version = "0.3.10"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bd3e3206899af3f8b12af284fafc038cc1dc2b41d1b89dd17297221c5d225de"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
+[[package]]
+name = "siphasher"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54ac45299ccbd390721be55b412d41931911f654fa99e2cb8bfb57184b2061fe"

 [[package]]
 name = "slab"
-version = "0.4.8"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6528351c9bc8ab22353f9d776db39a20288e8d6c37ef8cfe3317cf875eecfc2d"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
 dependencies = [
 "autocfg",
 ]
@@ -2643,7 +2692,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "rustversion",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -2681,7 +2730,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed4b0611e7f3277f68c0fa18e385d9e2d26923691379690039548f867cef02a7"
 dependencies = [
 "kurbo",
- "siphasher",
+ "siphasher 0.3.11",
 ]

 [[package]]
@@ -2697,9 +2746,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "2.0.28"
+version = "2.0.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04361975b3f5e348b2189d8dc55bc942f278b2d482a6a0365de5bdd62d351567"
+checksum = "c324c494eba9d92503e6f1ef2e6df781e78f6a7705a0202d9801b198807d518a"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2747,9 +2796,9 @@ checksum = "af547b166dd1ea4b472165569fc456cfb6818116f854690b0ff205e636523dab"

 [[package]]
 name = "tempfile"
-version = "3.7.1"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc02fddf48964c42031a0b3fe0428320ecf3a73c401040fc0096f97794310651"
+checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
 dependencies = [
 "cfg-if",
 "fastrand 2.0.0",
@@ -2760,22 +2809,22 @@ dependencies = [

 [[package]]
 name = "thiserror"
-version = "1.0.44"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "611040a08a0439f8248d1990b111c95baa9c704c805fa1f62104b39655fd7f90"
+checksum = "97a802ec30afc17eee47b2855fc72e0c4cd62be9b4efe6591edde0ec5bd68d8f"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "1.0.44"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "090198534930841fab3a5d1bb637cde49e339654e606195f8d9c76eeb081dc96"
+checksum = "6bb623b56e39ab7dcd4b1b98bb6c8f8d907ed255b18de254088016b27a8ee19b"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -2823,9 +2872,9 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.25"
+version = "0.3.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fdd63d58b18d663fbdf70e049f00a22c8e42be082203be7f26589213cd75ea"
+checksum = "0bb39ee79a6d8de55f48f2293a830e040392f1c5f16e336bdd1788cd0aadce07"
 dependencies = [
 "deranged",
 "itoa",
@@ -2842,9 +2891,9 @@ checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"

 [[package]]
 name = "time-macros"
-version = "0.2.11"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb71511c991639bb078fd5bf97757e03914361c48100d52878b8e52b46fb92cd"
+checksum = "733d258752e9303d392b94b75230d07b0b9c489350c69b851fc6c065fde3e8f9"
 dependencies = [
 "time-core",
 ]
@@ -2903,9 +2952,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.31.0"
+version = "1.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40de3a2ba249dcb097e01be5e67a5ff53cf250397715a071a81543e8a832a920"
+checksum = "17ed6077ed6cd6c74735e21f37eb16dc3935f96878b1fe961074089cc80893f9"
 dependencies = [
 "backtrace",
 "bytes",
@@ -2926,7 +2975,7 @@ checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -3074,7 +3123,7 @@ checksum = "84fd902d4e0b9a4b27f2f440108dc034e1758628a9b702f8ec61ad66355422fa"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -3104,7 +3153,7 @@ checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -3186,7 +3235,7 @@ name = "typst"
 version = "0.7.0"
 source = "git+https://github.com/typst/typst.git?tag=v0.7.0#da8367e189b02918a8fe1a98fd3059fd11a82cd9"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
 "bytemuck",
 "comemo",
 "ecow",
@@ -3206,7 +3255,7 @@ dependencies = [
 "roxmltree",
 "rustybuzz",
 "serde",
- "siphasher",
+ "siphasher 0.3.11",
 "stacker",
 "subsetter",
 "svg2pdf",
@@ -3267,7 +3316,7 @@ dependencies = [

 [[package]]
 name = "typst-lsp"
-version = "0.9.4"
+version = "0.9.5"
 dependencies = [
 "anyhow",
 "async-compression",
@@ -3281,7 +3330,7 @@ dependencies = [
 "if_chain",
 "indexmap 2.0.0",
 "internment",
- "itertools",
+ "itertools 0.11.0",
 "lazy_static",
 "memmap2 0.7.1",
 "once_cell",
@@ -3294,7 +3343,7 @@ dependencies = [
 "same-file",
 "serde",
 "serde_json",
- "siphasher",
+ "siphasher 1.0.0",
 "strum 0.25.0",
 "temp-dir",
 "thiserror",
@@ -3307,6 +3356,7 @@ dependencies = [
 "tracing-subscriber",
 "typst",
 "typst-library",
+ "typstfmt_lib",
 "walkdir",
 ]

@@ -3318,7 +3368,7 @@ dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 ]

 [[package]]
@@ -3337,6 +3387,21 @@ dependencies = [
 "unscanny",
 ]

+[[package]]
+name = "typstfmt_lib"
+version = "0.2.0"
+source = "git+https://github.com/astrale-sharp/typstfmt?rev=45d1ebb6073312d21ce8b4f5dd59b76cfdbe0880#45d1ebb6073312d21ce8b4f5dd59b76cfdbe0880"
+dependencies = [
+ "globmatch",
+ "itertools 0.10.5",
+ "regex",
+ "serde",
+ "toml",
+ "tracing",
+ "typst-syntax",
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "unic-langid"
 version = "0.9.1"
@@ -3590,7 +3655,7 @@ dependencies = [
 "once_cell",
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 "wasm-bindgen-shared",
 ]

@@ -3624,7 +3689,7 @@ checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.28",
+ "syn 2.0.29",
 "wasm-bindgen-backend",
 "wasm-bindgen-shared",
 ]
@@ -3637,9 +3702,9 @@ checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"

 [[package]]
 name = "wasm-streams"
-version = "0.2.3"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bbae3363c08332cadccd13b67db371814cd214c2524020932f0804b8cf7c078"
+checksum = "b4609d447824375f43e1ffbc051b50ad8f4b3ae8219680c94452ea05eb240ac7"
 dependencies = [
 "futures-util",
 "js-sys",
@@ -3658,24 +3723,11 @@ dependencies = [
 "wasm-bindgen",
 ]

-[[package]]
-name = "webpki"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "webpki-roots"
-version = "0.22.6"
+version = "0.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c71e40d7d2c34a5106301fb632274ca37242cd0c9d3e64dbece371a40a2d87"
-dependencies = [
- "webpki",
-]
+checksum = "14247bb57be4f377dfb94c72830b8ce8fc6beac03cf4bf7b9732eadd414123fc"

 [[package]]
 name = "weezl"
@@ -3734,9 +3786,9 @@ dependencies = [

 [[package]]
 name = "windows-targets"
-version = "0.48.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05d4b17490f70499f20b9e791dcf6a299785ce8af4d709018206dc5b4953e95f"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
 "windows_aarch64_gnullvm",
 "windows_aarch64_msvc",
@@ -3749,62 +3801,63 @@ dependencies = [

 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"

 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"

 [[package]]
 name = "windows_i686_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"

 [[package]]
 name = "windows_i686_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"

 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"

 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"

 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"

 [[package]]
 name = "winnow"
-version = "0.5.6"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50be2474cf85af7994b8ddd153dcde06fbcf847ced8f14d2e401ac3c33df143c"
+checksum = "7c2e3184b9c4e92ad5167ca73039d0c42476302ab603e2fec4487511f38ccefc"
 dependencies = [
 "memchr",
 ]

 [[package]]
 name = "winreg"
-version = "0.10.1"
+version = "0.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d"
+checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
 dependencies = [
- "winapi",
+ "cfg-if",
+ "windows-sys",
 ]

 [[package]]
@@ -7,22 +7,30 @@

 rustPlatform.buildRustPackage rec {
  pname = "typst-lsp";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "nvarner";
    repo = "typst-lsp";
    rev = "v${version}";
-    hash = "sha256-qbmNZFXg+XaDkHdBA3dU0ICKovEQrl7AAcMkElMLbMA=";
+    hash = "sha256-rV7vzI4PPyBJX/ofVCXnXd8eH6+UkGaAL7PwhP71t0k=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
      "typst-0.7.0" = "sha256-yrtOmlFAKOqAmhCP7n0HQCOQpU3DWyms5foCdUb9QTg=";
+      "typstfmt_lib-0.2.0" = "sha256-DOh7WQowJXTxI9GDXfy73hvr3J+VcDqSDaClLlUpMsM=";
    };
  };

+  patches = [
+    # update typstfmt to symlink its README.md into the library crate
+    # without this patch, typst-lsp fails to build when dependencies are vendored
+    # https://github.com/astrale-sharp/typstfmt/pull/81
+    ./update-typstfmt.patch
+  ];
+
  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Security
  ];
@@ -0,0 +1,22 @@
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -3390,7 +3390,7 @@ dependencies = [
+ [[package]]
+ name = "typstfmt_lib"
+ version = "0.2.0"
+-source = "git+https://github.com/astrale-sharp/typstfmt?rev=cf0ac91#cf0ac9189a4a2d47f4bc833f2538dca032534455"
+source = "git+https://github.com/astrale-sharp/typstfmt?rev=45d1ebb6073312d21ce8b4f5dd59b76cfdbe0880#45d1ebb6073312d21ce8b4f5dd59b76cfdbe0880"
+ dependencies = [
+  "globmatch",
+  "itertools 0.10.5",
+--- a/Cargo.toml
+++ b/Cargo.toml
+@@ -70,7 +70,7 @@ tracing-subscriber = { version = "0.3.17", default-features = false, features =
+     "fmt",
+ ] }
+ walkdir = "2.3"
+-typstfmt_lib = { git = "https://github.com/astrale-sharp/typstfmt", rev = "cf0ac91" }
+typstfmt_lib = { git = "https://github.com/astrale-sharp/typstfmt", rev = "45d1ebb6073312d21ce8b4f5dd59b76cfdbe0880" }
+ 
+ # jaeger
+ opentelemetry = { version = "0.20.0", optional = true }
@@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-expand";
-  version = "1.0.64";
+  version = "1.0.65";

  src = fetchFromGitHub {
    owner = "dtolnay";
    repo = pname;
    rev = version;
-    sha256 = "sha256-8DBkF2JRrsrZTW6gNBiUyVpwFvOpoZnm2vsR4O/6c6c=";
+    sha256 = "sha256-fPrke89Nlr9Yj0bkB6HTwMymQsjAQ+5+o7iVPGH7Tyc=";
  };

-  cargoHash = "sha256-r5qRxc8Jt5OBWCiBhFs8zPoxbuercsQ7gw5FfOKH3ow=";
+  cargoHash = "sha256-Q7nBKdwZlL/HleuiniuvErGF6Avf58xR++cJ7PP8RME=";

  meta = with lib; {
    description = "A utility and Cargo subcommand designed to let people expand macros in their Rust source code";
@@ -6,22 +6,22 @@
 , libGLU
 , libsndfile
 , openal
-, zig_0_9
+, zig_0_11
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "blackshades";
-  version = "2.4.9";
+  version = "2.5.1";

  src = fetchFromSourcehut {
    owner = "~cnx";
    repo = "blackshades";
    rev = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-Hg+VcWI28GzY/CPm1lUftP0RGztOnzizrKJQVTmeJ9I=";
+    hash = "sha256-qdpXpuXHr9w2XMfgOVveWv3JoqdJHVB8TCqZdyaw/DM=";
  };

-  nativeBuildInputs = [ zig_0_9.hook ];
+  nativeBuildInputs = [ zig_0_11.hook ];

  buildInputs = [
    glfw
@@ -34,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    homepage = "https://sr.ht/~cnx/blackshades";
    description = "A psychic bodyguard FPS";
+    changelog = "https://git.sr.ht/~cnx/blackshades/refs/${finalAttrs.version}";
+    mainProgram = "blackshades";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ McSinyx viric ];
    platforms = lib.platforms.linux;
@@ -25,6 +25,7 @@
 , libbfd_2_38
 , libopcodes
 , libopcodes_2_38
+, libpfm
 , libtraceevent
 , openssl
 , systemtap
@@ -125,6 +126,7 @@ stdenv.mkDerivation {
  ++ lib.optional withGtk gtk2
  ++ lib.optional withZstd zstd
  ++ lib.optional withLibcap libcap
+  ++ lib.optional (lib.versionAtLeast kernel.version "5.8") libpfm
  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3.pkgs.setuptools;

  env.NIX_CFLAGS_COMPILE = toString [
@@ -15,13 +15,13 @@ in

 stdenv.mkDerivation rec {
  pname = "janus-gateway";
-  version = "1.1.4";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "meetecho";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-kvaO2g4QF6LYZcxv39yXkwY9iZVenJio8oOlRLLH2Kk=";
+    sha256 = "sha256-YbY7wcd8YHcPo5w4n54gjOtepYLbboLsrLij7oYzhco=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config gengetopt ];
@@ -2,7 +2,6 @@
 , fetchpatch
 , python3
 , fetchPypi
-, docutils
 , sphinx
 , postfix
 , lynx
@@ -41,7 +40,6 @@ buildPythonPackage rec {
  ];

  checkInputs = [
-    docutils
    sphinx
  ];

@@ -0,0 +1,44 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, olm
+, nix-update-script
+, testers
+, mautrix-discord
+}:
+
+buildGoModule rec {
+  pname = "mautrix-discord";
+  version = "0.6.1";
+
+  src = fetchFromGitHub {
+    owner = "mautrix";
+    repo = "discord";
+    rev = "v${version}";
+    hash = "sha256-rs7wWlQMc79Vls+cqPPo+lRzYAGye4WcKKz+9EXlEBo=";
+  };
+
+  vendorSha256 = "sha256-ZI1+Tfru2OfnqLnaaiDL08OtSmbMBiRDvkL39+jhhmI=";
+
+  ldflags = [ "-s" "-w" ];
+
+  buildInputs = [ olm ];
+
+  doCheck = false;
+
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = mautrix-discord;
+    };
+  };
+
+  meta = with lib; {
+    description = "A Matrix-Discord puppeting bridge";
+    homepage = "https://github.com/mautrix/discord";
+    changelog = "https://github.com/mautrix/discord/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ MoritzBoehme ];
+  };
+}
@@ -1,47 +1,49 @@
 { lib
 , stdenv
-, fetchzip
+, buildNpmPackage
+, fetchFromGitHub
 , testers
+, balena-cli
+, nodePackages
+, python3
+, udev
+, darwin
 }:
-let
-  inherit (stdenv.hostPlatform) system;
-  throwSystem = throw "Unsupported system: ${system}";

-  plat = {
-    x86_64-linux = "linux-x64";
-    x86_64-darwin = "macOS-x64";
-    # Balena only packages for x86 so we rely on Rosetta for Apple Silicon
-    aarch64-darwin = "macOS-x64";
-  }.${system} or throwSystem;
-
-  sha256 = {
-    x86_64-linux = "sha256-USljQ/cnbSabzsZWXlZ0eeZSqkTr3wVP0ktXqZ7Fw4U=";
-    x86_64-darwin = "sha256-NWzJPB+HzlsB6yTcEMwTg8pioonGWPOU96jyIpiZiTY=";
-    aarch64-darwin = "sha256-NWzJPB+HzlsB6yTcEMwTg8pioonGWPOU96jyIpiZiTY=";
-  }.${system} or throwSystem;
-
-  version = "16.7.6";
-  src = fetchzip {
-    url = "https://github.com/balena-io/balena-cli/releases/download/v${version}/balena-cli-v${version}-${plat}-standalone.zip";
-    inherit sha256;
-  };
-in
-stdenv.mkDerivation (finalAttrs: {
+buildNpmPackage rec {
  pname = "balena-cli";
-  inherit version src;
+  version = "17.0.0";

-  installPhase = ''
-    runHook preInstall
+  src = fetchFromGitHub {
+    owner = "balena-io";
+    repo = "balena-cli";
+    rev = "v${version}";
+    hash = "sha256-sNpxjSumiP+4fX6b3j+HEl/lr4pvudrhfTzr2TYastE=";
+  };

-    mkdir -p $out/bin
-    cp -r ./* $out/
-    ln -s $out/balena $out/bin/balena
+  npmDepsHash = "sha256-q2Yc6e5dEiP2Q4tFIeqj4mswM1/pX1pdGeoagyiupvs=";

-    runHook postInstall
+  postPatch = ''
+    ln -s npm-shrinkwrap.json package-lock.json
  '';
+  makeCacheWritable = true;
+
+  nativeBuildInputs = [
+    nodePackages.node-gyp
+    python3
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.cctools
+  ];
+
+  buildInputs = lib.optionals stdenv.isLinux [
+    udev
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Foundation
+    darwin.apple_sdk.frameworks.Cocoa
+  ];

  passthru.tests.version = testers.testVersion {
-    package = finalAttrs.finalPackage;
+    package = balena-cli;
    command = ''
      # Override default cache directory so Balena CLI's unavoidable update check does not fail due to write permissions
      BALENARC_DATA_DIRECTORY=./ balena --version
@@ -49,46 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
    inherit version;
  };

-  # https://github.com/NixOS/nixpkgs/pull/48193/files#diff-b65952dbe5271c002fbc941b01c3586bf5050ad0e6aa6b2fcc74357680e103ea
-  preFixup =
-    if stdenv.isLinux then
-      let
-        libPath = lib.makeLibraryPath [ stdenv.cc.cc ];
-      in
-      ''
-        orig_size=$(stat --printf=%s $out/balena)
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/balena
-        patchelf --set-rpath ${libPath} $out/balena
-        chmod +x $out/balena
-        new_size=$(stat --printf=%s $out/balena)
-        ###### zeit-pkg fixing starts here.
-        # we're replacing plaintext js code that looks like
-        # PAYLOAD_POSITION = '1234                  ' | 0
-        # [...]
-        # PRELUDE_POSITION = '1234                  ' | 0
-        # ^-----20-chars-----^^------22-chars------^
-        # ^-- grep points here
-        #
-        # var_* are as described above
-        # shift_by seems to be safe so long as all patchelf adjustments occur
-        # before any locations pointed to by hardcoded offsets
-        var_skip=20
-        var_select=22
-        shift_by=$(expr $new_size - $orig_size)
-        function fix_offset {
-          # $1 = name of variable to adjust
-          location=$(grep -obUam1 "$1" $out/bin/balena | cut -d: -f1)
-          location=$(expr $location + $var_skip)
-          value=$(dd if=$out/balena iflag=count_bytes,skip_bytes skip=$location \
-                     bs=1 count=$var_select status=none)
-          value=$(expr $shift_by + $value)
-          echo -n $value | dd of=$out/balena bs=1 seek=$location conv=notrunc
-        }
-        fix_offset PAYLOAD_POSITION
-        fix_offset PRELUDE_POSITION
-      '' else '''';
-  dontStrip = true;
-
  meta = with lib; {
    description = "A command line interface for balenaCloud or openBalena";
    longDescription = ''
@@ -100,9 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/balena-io/balena-cli";
    changelog = "https://github.com/balena-io/balena-cli/blob/v${version}/CHANGELOG.md";
    license = licenses.asl20;
-    maintainers = [ maintainers.kalebpace ];
-    platforms = platforms.linux ++ platforms.darwin;
-    sourceProvenance = [ sourceTypes.binaryNativeCode ];
+    maintainers = [ maintainers.kalebpace maintainers.doronbehar ];
    mainProgram = "balena";
  };
-})
+}
@@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "faketty";
-  version = "1.0.12";
+  version = "1.0.13";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-1q1TOwKC2Tse/Ct/6Nw7YiOviJyBZAsOBEp3sT4N0ss=";
+    hash = "sha256-jV5b6mB81Nz0Q+Toj5DTQq2QcM+EoQ7jRYV/OXgtemA=";
  };

-  cargoSha256 = "sha256-x8+7sZJnA+kEwKAu8DBF8z7JhWjJ6ZFiLaQP8kFOt08=";
+  cargoHash = "sha256-9t1Km/ZXzxyO72CaWM81fWGcFkri7F+wMAVom0GV/YM=";

  postPatch = ''
    patchShebangs tests/test.sh
@@ -18,6 +18,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "A wrapper to execute a command in a pty, even if redirecting the output";
    homepage = "https://github.com/dtolnay/faketty";
+    changelog = "https://github.com/dtolnay/faketty/releases/tag/${version}";
    license = with licenses; [ asl20 /* or */ mit ];
    maintainers = with maintainers; [ figsoda ];
  };
@@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "fsearch";
-  version = "0.2.2";
+  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "cboxdoerfer";
    repo = pname;
    rev = version;
-    hash = "sha256-1nu6J5eHVpPHGXcFKHSnUhAJccxABBht5H2bpBx42og=";
+    hash = "sha256-VBcoDxh4ip2zLBcXVHDe9s1lVRQF4bZJKsGUt6sPcos=";
  };

  nativeBuildInputs = [
@@ -1,27 +1,39 @@
-{ lib, rustPlatform, fetchFromGitHub, ncurses, openssl, pkg-config, stdenv, Security }:
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, stdenv
+, darwin
+}:

 rustPlatform.buildRustPackage rec {
  pname = "hoard";
-  version = "1.3.1";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "Hyde46";
-    repo = pname;
+    repo = "hoard";
    rev = "v${version}";
-    sha256 = "sha256-Gm3X6/g5JQJEl7wRvWcO4j5XpROhtfRJ72LNaUeZRGc=";
+    hash = "sha256-c9iSbxkHwLOeATkO7kzTyLD0VAwZUzCvw5c4FyuR5/E=";
  };

-  buildInputs = [ ncurses openssl ]
-    ++ lib.optional stdenv.isDarwin Security;
+  cargoHash = "sha256-4EeeD1ySR4M1i2aaKJP/BNSn+t1l8ingiv2ZImFFn1A=";

  nativeBuildInputs = [ pkg-config ];

-  cargoHash = "sha256-ZNhUqnsme1rczl3FdFBGGs+vBDFcFEELkPp0/udTfR4=";
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];

  meta = with lib; {
    description = "CLI command organizer written in rust";
    homepage = "https://github.com/hyde46/hoard";
+    changelog = "https://github.com/Hyde46/hoard/blob/${src.rev}/CHANGES.md";
    license = licenses.mit;
-    maintainers = with maintainers; [ builditluc ];
+    maintainers = with maintainers; [ builditluc figsoda ];
+    mainProgram = "hoard";
  };
 }
@@ -0,0 +1,29 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "glob";
+  version = "10.3.3";
+
+  src = fetchFromGitHub {
+    owner = "isaacs";
+    repo = "node-glob";
+    rev = "v${version}";
+    hash = "sha256-oLlNhQOnu/hlKjNWa5vjqslz1EarZJOpUEXUB+vGQvc=";
+  };
+
+  npmDepsHash = "sha256-78oODw+CBCk5JRJbDqLqVmzTVImP7Z7o6jRIimDxZDQ=";
+
+  dontNpmBuild = true;
+
+  meta = {
+    changelog = "https://github.com/isaacs/node-glob/blob/${src.rev}/changelog.md";
+    description = "A little globber for Node.js";
+    homepage = "https://github.com/isaacs/node-glob";
+    license = lib.licenses.isc;
+    mainProgram = "glob";
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "traceroute";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchurl {
    url = "mirror://sourceforge/traceroute/${pname}-${version}.tar.gz";
-    sha256 = "sha256-UHwmjyl3tOIYznPn6+1Fug2XCoykmV3Zy7H/6OmbWx8=";
+    sha256 = "sha256-BevHq6KKkQD5u65Uzuy/dcgsz0a9/Oi11kgGRZp+BBI=";
  };

  makeFlags = [
@@ -28,11 +28,11 @@

 stdenv.mkDerivation rec {
  pname = "apt";
-  version = "2.7.2";
+  version = "2.7.3";

  src = fetchurl {
    url = "mirror://debian/pool/main/a/apt/apt_${version}.tar.xz";
-    hash = "sha256-CVySyC/O/0zALdrcJHeFm4JjyI0wFdZ5mqcuMwE1my8=";
+    hash = "sha256-mtLrLE8lzjU12aXYBW4f6TLW27WMJkfNX8jfjJ+N71M=";
  };

  nativeBuildInputs = [
@@ -4,9 +4,9 @@ version = 3

 [[package]]
 name = "aho-corasick"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6748e8def348ed4d14996fa801f4122cd763fff530258cdc03f64b25f89d3a5a"
+checksum = "0c378d78423fdad8089616f827526ee33c19f2fddbd5de1629152c9593ba4783"
 dependencies = [
 "memchr",
 ]
@@ -24,9 +24,9 @@ dependencies = [

 [[package]]
 name = "bstr"
-version = "1.6.0"
+version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6798148dccfbff0fae41c7574d2fa8f1ef3492fba0face179de5d8d447d67b05"
+checksum = "4c2f7349907b712260e64b0afe2f84692af14a454be26187d9df565c7f69266a"
 dependencies = [
 "memchr",
 "serde",
@@ -122,7 +122,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "759c97c1e17c55525b57192c06a267cda0ac5210b222d6b82189a2338fa1c13d"
 dependencies = [
 "aho-corasick",
- "bstr 1.6.0",
+ "bstr 1.6.2",
 "fnv",
 "log",
 "regex",
@@ -198,9 +198,9 @@ checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"

 [[package]]
 name = "memchr"
-version = "2.6.0"
+version = "2.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76fc44e2588d5b436dbc3c6cf62aef290f90dab6235744a93dfe1cc18f451e2c"
+checksum = "5486aed0026218e61b8a01d5fbd5a0a134649abb71a0e53b7bc088529dced86e"

 [[package]]
 name = "nu-ansi-term"
@@ -504,7 +504,7 @@ dependencies = [

 [[package]]
 name = "typstfmt"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
 "lexopt",
 "typstfmt_lib",
@@ -512,7 +512,7 @@ dependencies = [

 [[package]]
 name = "typstfmt_lib"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
 "globmatch",
 "insta",
@@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "typstfmt";
-  version = "0.2.0";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "astrale-sharp";
    repo = "typstfmt";
    rev = version;
-    hash = "sha256-tLkb9KmjkevjGdqqlbcz0jRyBpB079VgqWI81qNPCUw=";
+    hash = "sha256-cxiT8QVioZ7cGdkxsa8ampwNBWcdpAu4fO1ijfviHhI=";
  };

  cargoLock = {
@@ -21,6 +21,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "A formatter for the Typst language";
    homepage = "https://github.com/astrale-sharp/typstfmt";
+    changelog = "https://github.com/astrale-sharp/typstfmt/blob/${src.rev}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ figsoda geri1701 ];
  };
@@ -1903,6 +1903,8 @@ with pkgs;
    systemd = pkgs.systemd;
  };

+  node-glob = callPackage ../tools/misc/node-glob { };
+
  nominatim = callPackage ../servers/nominatim { };

  npm-check-updates = callPackage ../tools/package-management/npm-check-updates { };
@@ -9993,6 +9995,8 @@ with pkgs;

  matrix-hookshot = callPackage ../servers/matrix-synapse/matrix-hookshot { };

+  mautrix-discord = callPackage ../servers/mautrix-discord { };
+
  mautrix-facebook = callPackage ../servers/mautrix-facebook { };

  mautrix-googlechat = callPackage ../servers/mautrix-googlechat { };
@@ -26651,7 +26655,7 @@ with pkgs;

  hiraeth = callPackage ../servers/hiraeth { };

-  hoard = callPackage ../tools/misc/hoard { inherit (darwin) Security; };
+  hoard = callPackage ../tools/misc/hoard { };

  home-assistant = callPackage ../servers/home-assistant { };

@@ -31490,7 +31494,7 @@ with pkgs;

  em = callPackage ../applications/editors/em { };

-  inherit (recurseIntoAttrs (callPackage ../applications/editors/emacs { }))
+  inherit (recurseIntoAttrs (darwin.apple_sdk_11_0.callPackage ../applications/editors/emacs { }))
    emacs28
    emacs28-gtk2
    emacs28-gtk3