Merge master into haskell-updates

.github/workflows/update-terraform-providers.yml

@@ -12,7 +12,7 @@ jobs:
   tf-providers:
     permissions:
       contents: write # for peter-evans/create-pull-request to create branch
-      pull-requests: write # for peter-evans/create-pull-request to create a PR, for peter-evans/create-or-update-comment to create or update comment
+      pull-requests: write # for peter-evans/create-pull-request to create a PR
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
@@ -36,6 +36,12 @@ jobs:
             --argstr keep-going true \
             --argstr max-workers 2 \
             --argstr path terraform-providers
+      - name: get failed updates
+        run: |
+          echo 'FAILED<<EOF' >> $GITHUB_ENV
+          git ls-files --others >> $GITHUB_ENV
+          echo 'EOF' >> $GITHUB_ENV
+      # cleanup logs of failed updates so they aren't included in the PR
       - name: clean repo
         run: |
           git clean -f
@@ -47,10 +53,16 @@ jobs:
 
             https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}
 
+            These providers failed to update:
+            ```
+            ${{ env.FAILED }}
+            ```
+
             Check that all providers build with:
             ```
             @ofborg build terraform.full
             ```
+            If there is more than ten commits in the PR `ofborg` won't build it automatically and you will need to use the above command.
           branch: terraform-providers-update
           delete-branch: false
           title: ${{ steps.setup.outputs.title }}

lib/customisation.nix

@@ -176,7 +176,7 @@ rec {
       # Only show the error for the first missing argument
       error = errorForArg (lib.head missingArgs);
 
-    in if missingArgs == [] then makeOverridable f allArgs else throw error;
+    in if missingArgs == [] then makeOverridable f allArgs else abort error;
 
 
   /* Like callPackage, but for a function that returns an attribute

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -45,6 +45,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [opensearch](https://opensearch.org), a search server alternative to Elasticsearch. Available as [services.opensearch](options.html#opt-services.opensearch.enable).
 
+- [authelia](https://www.authelia.com/), is an open-source authentication and authorization server. Available under [services.authelia](options.html#opt-services.authelia.enable).
+
 - [goeland](https://github.com/slurdge/goeland), an alternative to rss2email written in golang with many filters. Available as [services.goeland](#opt-services.goeland.enable).
 
 - [alertmanager-irc-relay](https://github.com/google/alertmanager-irc-relay), a Prometheus Alertmanager IRC Relay. Available as [services.prometheus.alertmanagerIrcRelay](options.html#opt-services.prometheus.alertmanagerIrcRelay.enable).
@@ -77,7 +79,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [nimdow](https://github.com/avahe-kellenberger/nimdow), a window manager written in Nim, inspired by dwm.
 
-- [woodpecker-agent](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agent](#opt-services.woodpecker-agent.enable).
+- [woodpecker-agents](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agents](#opt-services.woodpecker-agents.agents._name_.enable).
 
 - [woodpecker-server](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable).
 
@@ -154,6 +156,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Nebula now runs as a system user and group created for each nebula network, using the `CAP_NET_ADMIN` ambient capability on launch rather than starting as root. Ensure that any files each Nebula instance needs to access are owned by the correct user and group, by default `nebula-${networkName}`.
 
+- The `i18n.inputMethod.fcitx` option has been replaced with `i18n.inputMethod.fcitx5` because fcitx 4 `pkgs.fcitx` has been removed.
+
 - In `mastodon` it is now necessary to specify location of file with `PostgreSQL` database password. In `services.mastodon.database.passwordFile` parameter default value `/var/lib/mastodon/secrets/db-password` has been changed to `null`.
 
 - The `--target-host` and `--build-host` options of `nixos-rebuild` no longer treat the `localhost` value specially – to build on/deploy to local machine, omit the relevant flag.

nixos/modules/i18n/input-method/default.md

@@ -9,7 +9,7 @@ than there are keys on the keyboard.
 The following input methods are available in NixOS:
 
   - IBus: The intelligent input bus.
-  - Fcitx: A customizable lightweight input method.
+  - Fcitx5: The next generation of fcitx, addons (including engines, dictionaries, skins) can be added using `i18n.inputMethod.fcitx5.addons`.
   - Nabi: A Korean input method based on XIM.
   - Uim: The universal input method, is a library with a XIM bridge.
   - Hime: An extremely easy-to-use input method framework.
@@ -67,38 +67,40 @@ application in the Nix store. The `glib` packages must
 match exactly. If they do not, uninstalling and reinstalling the
 application is a likely fix.
 
-## Fcitx {#module-services-input-methods-fcitx}
+## Fcitx5 {#module-services-input-methods-fcitx}
 
-Fcitx is an input method framework with extension support. It has three
+Fcitx5 is an input method framework with extension support. It has three
 built-in Input Method Engine, Pinyin, QuWei and Table-based input methods.
 
 The following snippet can be used to configure Fcitx:
 
 ```
 i18n.inputMethod = {
-  enabled = "fcitx";
+  enabled = "fcitx5";
-  fcitx.engines = with pkgs.fcitx-engines; [ mozc hangul m17n ];
+  fcitx5.addons = with pkgs; [ fcitx5-mozc fcitx5-hangul fcitx5-m17n ];
 };
 ```
 
-`i18n.inputMethod.fcitx.engines` is optional and can be
+`i18n.inputMethod.fcitx5.addons` is optional and can be
-used to add extra Fcitx engines.
+used to add extra Fcitx5 addons.
 
-Available extra Fcitx engines are:
+Available extra Fcitx5 addons are:
 
-  - Anthy (`fcitx-engines.anthy`): Anthy is a system for
+  - Anthy (`fcitx5-anthy`): Anthy is a system for
     Japanese input method. It converts Hiragana text to Kana Kanji mixed text.
-  - Chewing (`fcitx-engines.chewing`): Chewing is an
+  - Chewing (`fcitx5-chewing`): Chewing is an
     intelligent Zhuyin input method. It is one of the most popular input
     methods among Traditional Chinese Unix users.
-  - Hangul (`fcitx-engines.hangul`): Korean input method.
+  - Hangul (`fcitx5-hangul`): Korean input method.
-  - Unikey (`fcitx-engines.unikey`): Vietnamese input method.
+  - Unikey (`fcitx5-unikey`): Vietnamese input method.
-  - m17n (`fcitx-engines.m17n`): m17n is an input method that
+  - m17n (`fcitx5-m17n`): m17n is an input method that
     uses input methods and corresponding icons in the m17n database.
-  - mozc (`fcitx-engines.mozc`): A Japanese input method from
+  - mozc (`fcitx5-mozc`): A Japanese input method from
     Google.
-  - table-others (`fcitx-engines.table-others`): Various
+  - table-others (`fcitx5-table-other`): Various
     table-based input methods.
+  - chinese-addons (`fcitx5-chinese-addons`): Various chinese input methods.
+  - rime (`fcitx5-rime`): RIME support for fcitx5.
 
 ## Nabi {#module-services-input-methods-nabi}
 

nixos/modules/i18n/input-method/default.nix

@@ -29,9 +29,9 @@ in
   options.i18n = {
     inputMethod = {
       enabled = mkOption {
-        type    = types.nullOr (types.enum [ "ibus" "fcitx" "fcitx5" "nabi" "uim" "hime" "kime" ]);
+        type    = types.nullOr (types.enum [ "ibus" "fcitx5" "nabi" "uim" "hime" "kime" ]);
         default = null;
-        example = "fcitx";
+        example = "fcitx5";
         description = lib.mdDoc ''
           Select the enabled input method. Input methods is a software to input symbols that are not available on standard input devices.
 
@@ -40,7 +40,6 @@ in
           Currently the following input methods are available in NixOS:
 
           - ibus: The intelligent input bus, extra input engines can be added using `i18n.inputMethod.ibus.engines`.
-          - fcitx: A customizable lightweight input method, extra input engines can be added using `i18n.inputMethod.fcitx.engines`.
           - fcitx5: The next generation of fcitx, addons (including engines, dictionaries, skins) can be added using `i18n.inputMethod.fcitx5.addons`.
           - nabi: A Korean input method based on XIM. Nabi doesn't support Qt 5.
           - uim: The universal input method, is a library with a XIM bridge. uim mainly support Chinese, Japanese and Korean.

nixos/modules/i18n/input-method/fcitx.nix

@@ -1,46 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.i18n.inputMethod.fcitx;
-  fcitxPackage = pkgs.fcitx.override { plugins = cfg.engines; };
-  fcitxEngine = types.package // {
-    name  = "fcitx-engine";
-    check = x: (lib.types.package.check x) && (attrByPath ["meta" "isFcitxEngine"] false x);
-  };
-in
-{
-  options = {
-
-    i18n.inputMethod.fcitx = {
-      engines = mkOption {
-        type    = with types; listOf fcitxEngine;
-        default = [];
-        example = literalExpression "with pkgs.fcitx-engines; [ mozc hangul ]";
-        description =
-          let
-            enginesDrv = filterAttrs (const isDerivation) pkgs.fcitx-engines;
-            engines = concatStringsSep ", "
-              (map (name: "`${name}`") (attrNames enginesDrv));
-          in
-            lib.mdDoc "Enabled Fcitx engines. Available engines are: ${engines}.";
-      };
-    };
-
-  };
-
-  config = mkIf (config.i18n.inputMethod.enabled == "fcitx") {
-    i18n.inputMethod.package = fcitxPackage;
-
-    environment.variables = {
-      GTK_IM_MODULE = "fcitx";
-      QT_IM_MODULE  = "fcitx";
-      XMODIFIERS    = "@im=fcitx";
-    };
-    services.xserver.displayManager.sessionCommands = "${fcitxPackage}/bin/fcitx";
-  };
-
-  # uses attributes of the linked package
-  meta.buildDocsInSandbox = false;
-}

nixos/modules/module-list.nix

@@ -103,7 +103,6 @@
   ./hardware/xone.nix
   ./hardware/xpadneo.nix
   ./i18n/input-method/default.nix
-  ./i18n/input-method/fcitx.nix
   ./i18n/input-method/fcitx5.nix
   ./i18n/input-method/hime.nix
   ./i18n/input-method/ibus.nix
@@ -377,7 +376,7 @@
   ./services/continuous-integration/jenkins/default.nix
   ./services/continuous-integration/jenkins/job-builder.nix
   ./services/continuous-integration/jenkins/slave.nix
-  ./services/continuous-integration/woodpecker/agent.nix
+  ./services/continuous-integration/woodpecker/agents.nix
   ./services/continuous-integration/woodpecker/server.nix
   ./services/databases/aerospike.nix
   ./services/databases/cassandra.nix
@@ -1212,6 +1211,7 @@
   ./services/web-apps/zabbix.nix
   ./services/web-servers/agate.nix
   ./services/web-servers/apache-httpd/default.nix
+  ./services/web-servers/authelia.nix
   ./services/web-servers/caddy/default.nix
   ./services/web-servers/darkhttpd.nix
   ./services/web-servers/fcgiwrap.nix

nixos/modules/rename.nix

@@ -107,6 +107,8 @@ with lib;
     (mkRemovedOptionModule [ "services" "riak" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "cryptpad" ] "The corresponding package was removed from nixpkgs.")
 
+    (mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx" ] "The fcitx module has been removed. Plesae use fcitx5 instead")
+
     # Do NOT add any option renames here, see top of the file
   ];
 }

nixos/modules/services/continuous-integration/woodpecker/agent.nix

@@ -1,99 +0,0 @@
-{ config
-, lib
-, pkgs
-, ...
-}:
-
-let
-  cfg = config.services.woodpecker-agent;
-in
-{
-  meta.maintainers = [ lib.maintainers.janik ];
-
-  options = {
-    services.woodpecker-agent = {
-      enable = lib.mkEnableOption (lib.mdDoc "the Woodpecker-Agent, Agents execute tasks generated by a Server, every install will need one server and at least one agent");
-      package = lib.mkPackageOptionMD pkgs "woodpecker-agent" { };
-
-      environment = lib.mkOption {
-        default = { };
-        type = lib.types.attrsOf lib.types.str;
-        example = lib.literalExpression ''
-          {
-            WOODPECKER_SERVER = "localhost:9000";
-            WOODPECKER_BACKEND = "docker";
-            DOCKER_HOST = "unix:///run/podman/podman.sock";
-          }
-        '';
-        description = lib.mdDoc "woodpecker-agent config envrionment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/agent-config)";
-      };
-
-      extraGroups = lib.mkOption {
-        default = null;
-        type = lib.types.nullOr (lib.types.listOf lib.types.str);
-        example = [ "podman" ];
-        description = lib.mdDoc ''
-          Additional groups for the systemd service.
-        '';
-      };
-
-      environmentFile = lib.mkOption {
-        type = lib.types.nullOr lib.types.path;
-        default = null;
-        example = "/root/woodpecker-agent.env";
-        description = lib.mdDoc ''
-          File to load environment variables
-          from. This is helpful for specifying secrets.
-          Example content of environmentFile:
-          ```
-          WOODPECKER_AGENT_SECRET=your-shared-secret-goes-here
-          ```
-        '';
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services = {
-      woodpecker-agent = {
-        description = "Woodpecker-Agent Service";
-        wantedBy = [ "multi-user.target" ];
-        after = [ "network-online.target" ];
-        wants = [ "network-online.target" ];
-        serviceConfig = {
-          DynamicUser = true;
-          SupplementaryGroups = lib.optionals (cfg.extraGroups != null) cfg.extraGroups;
-          EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
-          ExecStart = "${cfg.package}/bin/woodpecker-agent";
-          Restart = "on-failure";
-          RestartSec = 15;
-          CapabilityBoundingSet = "";
-          # Security
-          NoNewPrivileges = true;
-          # Sandboxing
-          ProtectSystem = "strict";
-          PrivateTmp = true;
-          PrivateDevices = true;
-          PrivateUsers = true;
-          ProtectHostname = true;
-          ProtectClock = true;
-          ProtectKernelTunables = true;
-          ProtectKernelModules = true;
-          ProtectKernelLogs = true;
-          ProtectControlGroups = true;
-          RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
-          LockPersonality = true;
-          MemoryDenyWriteExecute = true;
-          RestrictRealtime = true;
-          RestrictSUIDSGID = true;
-          PrivateMounts = true;
-          # System Call Filtering
-          SystemCallArchitectures = "native";
-          SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
-        };
-        inherit (cfg) environment;
-      };
-    };
-  };
-}
-

nixos/modules/services/continuous-integration/woodpecker/agents.nix

@@ -0,0 +1,144 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+let
+  cfg = config.services.woodpecker-agents;
+
+  agentModule = lib.types.submodule {
+    options = {
+      enable = lib.mkEnableOption (lib.mdDoc "this Woodpecker-Agent. Agents execute tasks generated by a Server, every install will need one server and at least one agent");
+
+      package = lib.mkPackageOptionMD pkgs "woodpecker-agent" { };
+
+      environment = lib.mkOption {
+        default = { };
+        type = lib.types.attrsOf lib.types.str;
+        example = lib.literalExpression ''
+          {
+            WOODPECKER_SERVER = "localhost:9000";
+            WOODPECKER_BACKEND = "docker";
+            DOCKER_HOST = "unix:///run/podman/podman.sock";
+          }
+        '';
+        description = lib.mdDoc "woodpecker-agent config envrionment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/agent-config)";
+      };
+
+      extraGroups = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [ "podman" ];
+        description = lib.mdDoc ''
+          Additional groups for the systemd service.
+        '';
+      };
+
+      environmentFile = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
+        default = [ ];
+        example = [ "/var/secrets/woodpecker-agent.env" ];
+        description = lib.mdDoc ''
+          File to load environment variables
+          from. This is helpful for specifying secrets.
+          Example content of environmentFile:
+          ```
+          WOODPECKER_AGENT_SECRET=your-shared-secret-goes-here
+          ```
+        '';
+      };
+    };
+  };
+
+  mkAgentService = name: agentCfg: {
+    name = "woodpecker-agent-${name}";
+    value = {
+      description = "Woodpecker-Agent Service - ${name}";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        SupplementaryGroups = agentCfg.extraGroups;
+        EnvironmentFile = agentCfg.environmentFile;
+        ExecStart = lib.getExe agentCfg.package;
+        Restart = "on-failure";
+        RestartSec = 15;
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        PrivateMounts = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
+        BindReadOnlyPaths = [
+          "-/etc/resolv.conf"
+          "-/etc/nsswitch.conf"
+          "-/etc/ssl/certs"
+          "-/etc/static/ssl/certs"
+          "-/etc/hosts"
+          "-/etc/localtime"
+        ];
+      };
+      inherit (agentCfg) environment;
+    };
+  };
+in
+{
+  meta.maintainers = with lib.maintainers; [ janik ambroisie ];
+
+  options = {
+    services.woodpecker-agents = {
+      agents = lib.mkOption {
+        default = { };
+        type = lib.types.attrsOf agentModule;
+        example = {
+          docker = {
+            environment = {
+              WOODPECKER_SERVER = "localhost:9000";
+              WOODPECKER_BACKEND = "docker";
+              DOCKER_HOST = "unix:///run/podman/podman.sock";
+            };
+
+            extraGroups = [ "docker" ];
+
+            environmentFile = "/run/secrets/woodpecker/agent-secret.txt";
+          };
+
+          exec = {
+            environment = {
+              WOODPECKER_SERVER = "localhost:9000";
+              WOODPECKER_BACKEND = "exec";
+            };
+
+            environmentFile = "/run/secrets/woodpecker/agent-secret.txt";
+          };
+        };
+        description = lib.mdDoc "woodpecker-agents configurations";
+      };
+    };
+  };
+
+  config = {
+    systemd.services =
+      let
+        mkServices = lib.mapAttrs' mkAgentService;
+        enabledAgents = lib.filterAttrs (_: agent: agent.enable) cfg.agents;
+      in
+      mkServices enabledAgents;
+  };
+}

nixos/modules/services/continuous-integration/woodpecker/server.nix

@@ -8,7 +8,7 @@ let
   cfg = config.services.woodpecker-server;
 in
 {
-  meta.maintainers = [ lib.maintainers.janik ];
+  meta.maintainers = with lib.maintainers; [ janik ambroisie ];
 
 
   options = {

nixos/modules/services/hardware/kanata.nix

@@ -86,6 +86,7 @@ let
   mkService = name: keyboard: nameValuePair (mkName name) {
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
+      Type = "notify";
       ExecStart = ''
         ${getExe cfg.package} \
           --cfg ${mkConfig name keyboard} \
@@ -123,8 +124,7 @@ let
       ProtectKernelModules = true;
       ProtectKernelTunables = true;
       ProtectProc = "invisible";
-      RestrictAddressFamilies =
+      RestrictAddressFamilies = [ "AF_UNIX" ] ++ optional (keyboard.port != null) "AF_INET";
-        if (keyboard.port == null) then "none" else [ "AF_INET" ];
       RestrictNamespaces = true;
       RestrictRealtime = true;
       SystemCallArchitectures = [ "native" ];

nixos/modules/services/web-servers/authelia.nix

@@ -0,0 +1,401 @@
+{ lib
+, pkgs
+, config
+, ...
+}:
+
+let
+  cfg = config.services.authelia;
+
+  format = pkgs.formats.yaml { };
+  configFile = format.generate "config.yml" cfg.settings;
+
+  autheliaOpts = with lib; { name, ... }: {
+    options = {
+      enable = mkEnableOption (mdDoc "Authelia instance");
+
+      name = mkOption {
+        type = types.str;
+        default = name;
+        description = mdDoc ''
+          Name is used as a suffix for the service name, user, and group.
+          By default it takes the value you use for `<instance>` in:
+          {option}`services.authelia.<instance>`
+        '';
+      };
+
+      package = mkOption {
+        default = pkgs.authelia;
+        type = types.package;
+        defaultText = literalExpression "pkgs.authelia";
+        description = mdDoc "Authelia derivation to use.";
+      };
+
+      user = mkOption {
+        default = "authelia-${name}";
+        type = types.str;
+        description = mdDoc "The name of the user for this authelia instance.";
+      };
+
+      group = mkOption {
+        default = "authelia-${name}";
+        type = types.str;
+        description = mdDoc "The name of the group for this authelia instance.";
+      };
+
+      secrets = mkOption {
+        description = mdDoc ''
+          It is recommended you keep your secrets separate from the configuration.
+          It's especially important to keep the raw secrets out of your nix configuration,
+          as the values will be preserved in your nix store.
+          This attribute allows you to configure the location of secret files to be loaded at runtime.
+
+          https://www.authelia.com/configuration/methods/secrets/
+        '';
+        default = { };
+        type = types.submodule {
+          options = {
+            manual = mkOption {
+              default = false;
+              example = true;
+              description = mdDoc ''
+                Configuring authelia's secret files via the secrets attribute set
+                is intended to be convenient and help catch cases where values are required
+                to run at all.
+                If a user wants to set these values themselves and bypass the validation they can set this value to true.
+              '';
+              type = types.bool;
+            };
+
+            # required
+            jwtSecretFile = mkOption {
+              type = types.nullOr types.path;
+              default = null;
+              description = mdDoc ''
+                Path to your JWT secret used during identity verificaiton.
+              '';
+            };
+
+            oidcIssuerPrivateKeyFile = mkOption {
+              type = types.nullOr types.path;
+              default = null;
+              description = mdDoc ''
+                Path to your private key file used to encrypt OIDC JWTs.
+              '';
+            };
+
+            oidcHmacSecretFile = mkOption {
+              type = types.nullOr types.path;
+              default = null;
+              description = mdDoc ''
+                Path to your HMAC secret used to sign OIDC JWTs.
+              '';
+            };
+
+            sessionSecretFile = mkOption {
+              type = types.nullOr types.path;
+              default = null;
+              description = mdDoc ''
+                Path to your session secret. Only used when redis is used as session storage.
+              '';
+            };
+
+            # required
+            storageEncryptionKeyFile = mkOption {
+              type = types.nullOr types.path;
+              default = null;
+              description = mdDoc ''
+                Path to your storage encryption key.
+              '';
+            };
+          };
+        };
+      };
+
+      environmentVariables = mkOption {
+        type = types.attrsOf types.str;
+        description = mdDoc ''
+          Additional environment variables to provide to authelia.
+          If you are providing secrets please consider the options under {option}`services.authelia.<instance>.secrets`
+          or make sure you use the `_FILE` suffix.
+          If you provide the raw secret rather than the location of a secret file that secret will be preserved in the nix store.
+          For more details: https://www.authelia.com/configuration/methods/secrets/
+        '';
+        default = { };
+      };
+
+      settings = mkOption {
+        description = mdDoc ''
+          Your Authelia config.yml as a Nix attribute set.
+          There are several values that are defined and documented in nix such as `default_2fa_method`,
+          but additional items can also be included.
+
+          https://github.com/authelia/authelia/blob/master/config.template.yml
+        '';
+        default = { };
+        example = ''
+          {
+            theme = "light";
+            default_2fa_method = "totp";
+            log.level = "debug";
+            server.disable_healthcheck = true;
+          }
+        '';
+        type = types.submodule {
+          freeformType = format.type;
+          options = {
+            theme = mkOption {
+              type = types.enum [ "light" "dark" "grey" "auto" ];
+              default = "light";
+              example = "dark";
+              description = mdDoc "The theme to display.";
+            };
+
+            default_2fa_method = mkOption {
+              type = types.enum [ "" "totp" "webauthn" "mobile_push" ];
+              default = "";
+              example = "webauthn";
+              description = mdDoc ''
+                Default 2FA method for new users and fallback for preferred but disabled methods.
+              '';
+            };
+
+            server = {
+              host = mkOption {
+                type = types.str;
+                default = "localhost";
+                example = "0.0.0.0";
+                description = mdDoc "The address to listen on.";
+              };
+
+              port = mkOption {
+                type = types.port;
+                default = 9091;
+                description = mdDoc "The port to listen on.";
+              };
+            };
+
+            log = {
+              level = mkOption {
+                type = types.enum [ "info" "debug" "trace" ];
+                default = "debug";
+                example = "info";
+                description = mdDoc "Level of verbosity for logs: info, debug, trace.";
+              };
+
+              format = mkOption {
+                type = types.enum [ "json" "text" ];
+                default = "json";
+                example = "text";
+                description = mdDoc "Format the logs are written as.";
+              };
+
+              file_path = mkOption {
+                type = types.nullOr types.path;
+                default = null;
+                example = "/var/log/authelia/authelia.log";
+                description = mdDoc "File path where the logs will be written. If not set logs are written to stdout.";
+              };
+
+              keep_stdout = mkOption {
+                type = types.bool;
+                default = false;
+                example = true;
+                description = mdDoc "Whether to also log to stdout when a `file_path` is defined.";
+              };
+            };
+
+            telemetry = {
+              metrics = {
+                enabled = mkOption {
+                  type = types.bool;
+                  default = false;
+                  example = true;
+                  description = mdDoc "Enable Metrics.";
+                };
+
+                address = mkOption {
+                  type = types.str;
+                  default = "tcp://127.0.0.1:9959";
+                  example = "tcp://0.0.0.0:8888";
+                  description = mdDoc "The address to listen on for metrics. This should be on a different port to the main `server.port` value.";
+                };
+              };
+            };
+          };
+        };
+      };
+
+      settingsFiles = mkOption {
+        type = types.listOf types.path;
+        default = [ ];
+        example = [ "/etc/authelia/config.yml" "/etc/authelia/access-control.yml" "/etc/authelia/config/" ];
+        description = mdDoc ''
+          Here you can provide authelia with configuration files or directories.
+          It is possible to give authelia multiple files and use the nix generated configuration
+          file set via {option}`services.authelia.<instance>.settings`.
+        '';
+      };
+    };
+  };
+in
+{
+  options.services.authelia.instances = with lib; mkOption {
+    default = { };
+    type = types.attrsOf (types.submodule autheliaOpts);
+    description = mdDoc ''
+      Multi-domain protection currently requires multiple instances of Authelia.
+      If you don't require multiple instances of Authelia you can define just the one.
+
+      https://www.authelia.com/roadmap/active/multi-domain-protection/
+    '';
+    example = ''
+      {
+        main = {
+          enable = true;
+          secrets.storageEncryptionKeyFile = "/etc/authelia/storageEncryptionKeyFile";
+          secrets.jwtSecretFile = "/etc/authelia/jwtSecretFile";
+          settings = {
+            theme = "light";
+            default_2fa_method = "totp";
+            log.level = "debug";
+            server.disable_healthcheck = true;
+          };
+        };
+        preprod = {
+          enable = false;
+          secrets.storageEncryptionKeyFile = "/mnt/pre-prod/authelia/storageEncryptionKeyFile";
+          secrets.jwtSecretFile = "/mnt/pre-prod/jwtSecretFile";
+          settings = {
+            theme = "dark";
+            default_2fa_method = "webauthn";
+            server.host = "0.0.0.0";
+          };
+        };
+        test.enable = true;
+        test.secrets.manual = true;
+        test.settings.theme = "grey";
+        test.settings.server.disable_healthcheck = true;
+        test.settingsFiles = [ "/mnt/test/authelia" "/mnt/test-authelia.conf" ];
+        };
+      }
+    '';
+  };
+
+  config =
+    let
+      mkInstanceServiceConfig = instance:
+        let
+          execCommand = "${instance.package}/bin/authelia";
+          configFile = format.generate "config.yml" instance.settings;
+          configArg = "--config ${builtins.concatStringsSep "," (lib.concatLists [[configFile] instance.settingsFiles])}";
+        in
+        {
+          description = "Authelia authentication and authorization server";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          environment =
+            (lib.filterAttrs (_: v: v != null) {
+              AUTHELIA_JWT_SECRET_FILE = instance.secrets.jwtSecretFile;
+              AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = instance.secrets.storageEncryptionKeyFile;
+              AUTHELIA_SESSION_SECRET_FILE = instance.secrets.sessionSecretFile;
+              AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE = instance.secrets.oidcIssuerPrivateKeyFile;
+              AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = instance.secrets.oidcHmacSecretFile;
+            })
+            // instance.environmentVariables;
+
+          preStart = "${execCommand} ${configArg} validate-config";
+          serviceConfig = {
+            User = instance.user;
+            Group = instance.group;
+            ExecStart = "${execCommand} ${configArg}";
+            Restart = "always";
+            RestartSec = "5s";
+            StateDirectory = "authelia-${instance.name}";
+            StateDirectoryMode = "0700";
+
+            # Security options:
+            AmbientCapabilities = "";
+            CapabilityBoundingSet = "";
+            DeviceAllow = "";
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            NoNewPrivileges = true;
+
+            PrivateTmp = true;
+            PrivateDevices = true;
+            PrivateUsers = true;
+
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = "read-only";
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "noaccess";
+            ProtectSystem = "strict";
+
+            RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+
+            SystemCallArchitectures = "native";
+            SystemCallErrorNumber = "EPERM";
+            SystemCallFilter = [
+              "@system-service"
+              "~@cpu-emulation"
+              "~@debug"
+              "~@keyring"
+              "~@memlock"
+              "~@obsolete"
+              "~@privileged"
+              "~@setuid"
+            ];
+          };
+        };
+      mkInstanceUsersConfig = instance: {
+        groups."authelia-${instance.name}" =
+          lib.mkIf (instance.group == "authelia-${instance.name}") {
+            name = "authelia-${instance.name}";
+          };
+        users."authelia-${instance.name}" =
+          lib.mkIf (instance.user == "authelia-${instance.name}") {
+            name = "authelia-${instance.name}";
+            isSystemUser = true;
+            group = instance.group;
+          };
+      };
+      instances = lib.attrValues cfg.instances;
+    in
+    {
+      assertions = lib.flatten (lib.flip lib.mapAttrsToList cfg.instances (name: instance:
+        [
+          {
+            assertion = instance.secrets.manual || (instance.secrets.jwtSecretFile != null && instance.secrets.storageEncryptionKeyFile != null);
+            message = ''
+              Authelia requires a JWT Secret and a Storage Encryption Key to work.
+              Either set them like so:
+              services.authelia.${name}.secrets.jwtSecretFile = /my/path/to/jwtsecret;
+              services.authelia.${name}.secrets.storageEncryptionKeyFile = /my/path/to/encryptionkey;
+              Or set services.authelia.${name}.secrets.manual = true and provide them yourself via
+              environmentVariables or settingsFiles.
+              Do not include raw secrets in nix settings.
+            '';
+          }
+        ]
+      ));
+
+      systemd.services = lib.mkMerge
+        (map
+          (instance: lib.mkIf instance.enable {
+            "authelia-${instance.name}" = mkInstanceServiceConfig instance;
+          })
+          instances);
+      users = lib.mkMerge
+        (map
+          (instance: lib.mkIf instance.enable (mkInstanceUsersConfig instance))
+          instances);
+    };
+}

nixos/tests/all-tests.nix

@@ -85,6 +85,7 @@ in {
   atop = handleTest ./atop.nix {};
   atuin = handleTest ./atuin.nix {};
   auth-mysql = handleTest ./auth-mysql.nix {};
+  authelia = handleTest ./authelia.nix {};
   avahi = handleTest ./avahi.nix {};
   avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
   babeld = handleTest ./babeld.nix {};
@@ -217,7 +218,7 @@ in {
   extra-python-packages = handleTest ./extra-python-packages.nix {};
   evcc = handleTest ./evcc.nix {};
   fancontrol = handleTest ./fancontrol.nix {};
-  fcitx = handleTest ./fcitx {};
+  fcitx5 = handleTest ./fcitx5 {};
   fenics = handleTest ./fenics.nix {};
   ferm = handleTest ./ferm.nix {};
   firefox = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox; };

nixos/tests/authelia.nix

@@ -0,0 +1,169 @@
+# Test Authelia as an auth server for Traefik as a reverse proxy of a local web service
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "authelia";
+  meta.maintainers = with lib.maintainers; [ jk ];
+
+  nodes = {
+    authelia = { config, pkgs, lib, ... }: {
+      services.authelia.instances.testing = {
+        enable = true;
+        secrets.storageEncryptionKeyFile = "/etc/authelia/storageEncryptionKeyFile";
+        secrets.jwtSecretFile = "/etc/authelia/jwtSecretFile";
+        settings = {
+          authentication_backend.file.path = "/etc/authelia/users_database.yml";
+          access_control.default_policy = "one_factor";
+          session.domain = "example.com";
+          storage.local.path = "/tmp/db.sqlite3";
+          notifier.filesystem.filename = "/tmp/notifications.txt";
+        };
+      };
+
+      # These should not be set from nix but through other means to not leak the secret!
+      # This is purely for testing purposes!
+      environment.etc."authelia/storageEncryptionKeyFile" = {
+        mode = "0400";
+        user = "authelia-testing";
+        text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this";
+      };
+      environment.etc."authelia/jwtSecretFile" = {
+        mode = "0400";
+        user = "authelia-testing";
+        text = "a_very_important_secret";
+      };
+      environment.etc."authelia/users_database.yml" = {
+        mode = "0400";
+        user = "authelia-testing";
+        text = ''
+          users:
+            bob:
+              disabled: false
+              displayname: bob
+              # password of password
+              password: $argon2id$v=19$m=65536,t=3,p=4$2ohUAfh9yetl+utr4tLcCQ$AsXx0VlwjvNnCsa70u4HKZvFkC8Gwajr2pHGKcND/xs
+              email: bob@jim.com
+              groups:
+                - admin
+                - dev
+        '';
+      };
+
+      services.traefik = {
+        enable = true;
+
+        dynamicConfigOptions = {
+          tls.certificates =
+            let
+              certDir = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+                openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=example.com/CN=auth.example.com/CN=static.example.com' -days 36500
+                mkdir -p $out
+                cp key.pem cert.pem $out
+              '';
+            in
+            [{
+              certFile = "${certDir}/cert.pem";
+              keyFile = "${certDir}/key.pem";
+            }];
+          http.middlewares.authelia.forwardAuth = {
+            address = "http://localhost:9091/api/verify?rd=https%3A%2F%2Fauth.example.com%2F";
+            trustForwardHeader = true;
+            authResponseHeaders = [
+              "Remote-User"
+              "Remote-Groups"
+              "Remote-Email"
+              "Remote-Name"
+            ];
+          };
+          http.middlewares.authelia-basic.forwardAuth = {
+            address = "http://localhost:9091/api/verify?auth=basic";
+            trustForwardHeader = true;
+            authResponseHeaders = [
+              "Remote-User"
+              "Remote-Groups"
+              "Remote-Email"
+              "Remote-Name"
+            ];
+          };
+
+          http.routers.simplehttp = {
+            rule = "Host(`static.example.com`)";
+            tls = true;
+            entryPoints = "web";
+            service = "simplehttp";
+          };
+          http.routers.simplehttp-basic-auth = {
+            rule = "Host(`static-basic-auth.example.com`)";
+            tls = true;
+            entryPoints = "web";
+            service = "simplehttp";
+            middlewares = [ "authelia-basic@file" ];
+          };
+
+          http.services.simplehttp = {
+            loadBalancer.servers = [{
+              url = "http://localhost:8000";
+            }];
+          };
+
+          http.routers.authelia = {
+            rule = "Host(`auth.example.com`)";
+            tls = true;
+            entryPoints = "web";
+            service = "authelia@file";
+          };
+
+          http.services.authelia = {
+            loadBalancer.servers = [{
+              url = "http://localhost:9091";
+            }];
+          };
+        };
+
+        staticConfigOptions = {
+          global = {
+            checkNewVersion = false;
+            sendAnonymousUsage = false;
+          };
+
+          entryPoints.web.address = ":443";
+        };
+      };
+
+      systemd.services.simplehttp =
+        let fakeWebPageDir = pkgs.writeTextDir "index.html" "hello"; in
+        {
+          script = "${pkgs.python3}/bin/python -m http.server --directory ${fakeWebPageDir} 8000";
+          serviceConfig.Type = "simple";
+          wantedBy = [ "multi-user.target" ];
+        };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    authelia.wait_for_unit("simplehttp.service")
+    authelia.wait_for_unit("traefik.service")
+    authelia.wait_for_unit("authelia-testing.service")
+    authelia.wait_for_open_port(443)
+    authelia.wait_for_unit("multi-user.target")
+
+    with subtest("Check for authelia"):
+      # expect the login page
+      assert "Login - Authelia", "could not reach authelia" in \
+        authelia.succeed("curl --insecure -sSf -H Host:auth.example.com https://authelia:443/")
+
+    with subtest("Check contacting basic http server via traefik with https works"):
+      assert "hello", "could not reach raw static site" in \
+        authelia.succeed("curl --insecure -sSf -H Host:static.example.com https://authelia:443/")
+
+    with subtest("Test traefik and authelia"):
+      with subtest("No details fail"):
+        authelia.fail("curl --insecure -sSf -H Host:static-basic-auth.example.com https://authelia:443/")
+      with subtest("Incorrect details fail"):
+        authelia.fail("curl --insecure -sSf -u 'bob:wordpass' -H Host:static-basic-auth.example.com https://authelia:443/")
+        authelia.fail("curl --insecure -sSf -u 'alice:password' -H Host:static-basic-auth.example.com https://authelia:443/")
+      with subtest("Correct details pass"):
+        assert "hello", "could not reach authed static site with valid credentials" in \
+          authelia.succeed("curl --insecure -sSf -u 'bob:password' -H Host:static-basic-auth.example.com https://authelia:443/")
+  '';
+})

nixos/tests/fcitx/config

@@ -1,12 +0,0 @@
-[Hotkey]
-SwitchKey=Disabled
-IMSwitchHotkey=ALT_SHIFT
-TimeInterval=240
-
-[Program]
-DelayStart=5
-
-[Output]
-
-[Appearance]
-

nixos/tests/fcitx/profile

@@ -1,4 +0,0 @@
-[Profile]
-IMName=zhengma-large
-EnabledIMList=fcitx-keyboard-us:True,zhengma-large:True,m17n_sa_harvard-kyoto:True
-PreeditStringInClientWindow=False

nixos/tests/fcitx5/config

@@ -0,0 +1,11 @@
+[Hotkey]
+EnumerateSkipFirst=False
+
+[Hotkey/TriggerKeys]
+0=Control+space
+
+[Hotkey/EnumerateForwardKeys]
+0=Alt+Shift_L
+
+[Hotkey/EnumerateBackwardKeys]
+0=Alt+Shift_R

nixos/tests/fcitx5/default.nix

@@ -1,64 +1,48 @@
-import ../make-test-python.nix (
+import ../make-test-python.nix ({ pkgs, ... }:
+# copy_from_host works only for store paths
+rec {
+  name = "fcitx5";
+  nodes.machine = { pkgs, ... }:
   {
-    pkgs, ...
+    imports = [
-  }:
+      ../common/user-account.nix
-    # copy_from_host works only for store paths
+    ];
-    rec {
-        name = "fcitx";
-        meta.broken = true; # takes hours to time out since October 2021
-        nodes.machine =
-        {
-          pkgs,
-          ...
-        }:
-          {
 
-            imports = [
+    environment.systemPackages = [
-              ../common/user-account.nix
+      # To avoid clashing with xfce4-terminal
-            ];
+      pkgs.alacritty
+    ];
 
-            environment.systemPackages = [
+    services.xserver = {
-              # To avoid clashing with xfce4-terminal
+      enable = true;
-              pkgs.alacritty
-            ];
 
+      displayManager = {
+        lightdm.enable = true;
+        autoLogin = {
+          enable = true;
+          user = "alice";
+        };
+      };
 
-            services.xserver =
+      desktopManager.xfce.enable = true;
-            {
+    };
-              enable = true;
 
-              displayManager = {
+    i18n.inputMethod = {
-                lightdm.enable = true;
+      enabled = "fcitx5";
-                autoLogin = {
+      fcitx5.addons = [
-                  enable = true;
+        pkgs.fcitx5-m17n
-                  user = "alice";
+        pkgs.fcitx5-chinese-addons
-                };
+      ];
-              };
+    };
+  };
 
-              desktopManager.xfce.enable = true;
+  testScript = { nodes, ... }:
-            };
+    let
-
+      user = nodes.machine.users.users.alice;
-            i18n = {
+      xauth         = "${user.home}/.Xauthority";
-              inputMethod = {
+      fcitx_confdir = "${user.home}/.config/fcitx5";
-                enabled = "fcitx";
+    in
-                fcitx.engines = [
+      ''
-                  pkgs.fcitx-engines.m17n
-                  pkgs.fcitx-engines.table-extra
-                ];
-              };
-            };
-          }
-        ;
-
-        testScript = { nodes, ... }:
-        let
-            user = nodes.machine.config.users.users.alice;
-            userName      = user.name;
-            userHome      = user.home;
-            xauth         = "${userHome}/.Xauthority";
-            fcitx_confdir = "${userHome}/.config/fcitx";
-        in
-        ''
             # We need config files before login session
             # So copy first thing
 
@@ -75,13 +59,13 @@ import ../make-test-python.nix (
 
             start_all()
 
-            machine.wait_for_file("${xauth}")
+            machine.wait_for_file("${xauth}}")
             machine.succeed("xauth merge ${xauth}")
 
             machine.sleep(5)
 
-            machine.succeed("su - ${userName} -c 'alacritty&'")
+            machine.succeed("su - ${user.name} -c 'alacritty&'")
-            machine.succeed("su - ${userName} -c 'fcitx&'")
+            machine.succeed("su - ${user.name} -c 'fcitx5&'")
             machine.sleep(10)
 
             ### Type on terminal
@@ -109,8 +93,10 @@ import ../make-test-python.nix (
             machine.send_key("ctrl-spc")
             machine.sleep(1)
 
-            ### Default zhengma, enter 一下
+            ### Default wubi, enter 一下
-            machine.send_chars("a2")
+            machine.send_chars("gggh")
+            machine.sleep(1)
+            machine.send_key("\n")
             machine.sleep(1)
 
             ### Switch to Harvard Kyoto
@@ -134,9 +120,8 @@ import ../make-test-python.nix (
             machine.screenshot("terminal_chars")
 
             ### Verify that file contents are as expected
-            file_content = machine.succeed("cat ${userHome}/fcitx_test.out")
+            file_content = machine.succeed("cat ${user.home}/fcitx_test.out")
             assert file_content == "☺一下क\n"
             ''
-    ;
+  ;
-  }
+})
-)

nixos/tests/fcitx5/profile

@@ -0,0 +1,15 @@
+[Groups/0]
+Name=NixOS_test
+Default Layout=us
+DefaultIM=wbx
+
+[Groups/0/Items/0]
+Name=wbx
+Layout=us
+
+[Groups/0/Items/1]
+Name=m17n_sa_harvard-kyoto
+Layout=us
+
+[GroupOrder]
+0=NixOS_test

pkgs/applications/audio/jackmix/default.nix

@@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchFromGitHub, pkg-config, sconsPackages, qtbase, lash, libjack2, jack ? libjack2, alsa-lib
+{ mkDerivation, lib, fetchFromGitHub, pkg-config, scons, qtbase, lash, libjack2, jack ? libjack2, alsa-lib
 , fetchpatch
 }:
 
@@ -22,7 +22,7 @@ mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ sconsPackages.scons_latest pkg-config ];
+  nativeBuildInputs = [ scons pkg-config ];
   buildInputs = [
     qtbase
     lash

pkgs/applications/audio/klick/default.nix

@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , pkg-config
-, sconsPackages
+, scons
 , rubberband
 , boost
 , libjack2
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     rubberband
-    sconsPackages.scons_latest
+    scons
   ];
   buildInputs = [ libsamplerate libsndfile liblo libjack2 boost ];
   prefixKey = "PREFIX=";

pkgs/applications/audio/nova-filters/default.nix

@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, sconsPackages, boost, ladspaH, pkg-config }:
+{lib, stdenv, fetchurl, scons, boost, ladspaH, pkg-config }:
 
 stdenv.mkDerivation {
   version = "0.2-2";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "16064vvl2w5lz4xi3lyjk4xx7fphwsxc14ajykvndiz170q32s6i";
   };
 
-  nativeBuildInputs = [ pkg-config sconsPackages.scons_latest ];
+  nativeBuildInputs = [ pkg-config scons ];
   buildInputs = [ boost ladspaH ];
 
   patchPhase = ''

pkgs/applications/emulators/snes9x/default.nix

@@ -1,23 +1,28 @@
 { lib
 , stdenv
 , alsa-lib
-, autoreconfHook
+, cmake
 , fetchFromGitHub
 , fetchpatch
 , gtkmm3
 , libepoxy
 , libpng
+, libselinux
 , libX11
-, libXv
+, libXdmcp
 , libXext
 , libXinerama
-, meson
+, libXrandr
+, libXv
 , minizip
 , ninja
+, pcre2
 , pkg-config
 , portaudio
 , pulseaudio
+, python3
 , SDL2
+, util-linuxMinimal
 , wrapGAppsHook
 , zlib
 , withGtk ? false
@@ -29,40 +34,37 @@ stdenv.mkDerivation rec {
       "snes9x-gtk"
     else
       "snes9x";
-  version = "1.61";
+  version = "1.62";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
     rev = version;
     fetchSubmodules = true;
-    sha256 = "1kay7aj30x0vn8rkylspdycydrzsc0aidjbs0dd238hr5hid723b";
+    hash = "sha256-RcxFNmUbJp0rUugWOqQa3Sy/Hh18ZPOeDTxC0JY5GJQ=";
   };
 
   patches = [
     # Fix cross-compilation, otherwise it fails to detect host compiler features
     # Doesn't affect non CC builds
     (fetchpatch {
-      url = "https://mirror.its.dal.ca/gentoo-portage/games-emulation/snes9x/files/snes9x-1.53-cross-compile.patch";
+      url = "https://github.com/snes9xgit/snes9x/commit/f39ab408f4151c16d44e45470cc0736ffb2803f8.patch";
-      sha256 = "sha256-ZCmnprimz8PtDIXkB1dYD0oura9icW81yKvJ4coKaDg=";
+      hash = "sha256-GMlHBsADEF+rycmEVgpWy220hZwld5D2e8fsYA7HblM=";
     })
   ];
 
   nativeBuildInputs = [
     pkg-config
-  ]
+    python3
-  ++ lib.optionals (!withGtk) [
-    autoreconfHook
   ]
   ++ lib.optionals withGtk [
-    meson
+    cmake
     ninja
     wrapGAppsHook
   ];
 
   buildInputs = [
     libX11
-    libXext
     libXv
     minizip
     zlib
@@ -74,13 +76,19 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals (!withGtk) [
     libpng
+    libXext
     libXinerama
   ]
   ++ lib.optionals withGtk [
     gtkmm3
     libepoxy
+    libselinux
+    libXdmcp
+    libXrandr
+    pcre2
     portaudio
     SDL2
+    util-linuxMinimal # provides libmount
   ];
 
   configureFlags =
@@ -98,8 +106,7 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  preAutoreconf = lib.optionalString (!withGtk) "cd unix";
+  preConfigure = if withGtk then "cd gtk" else "cd unix";
-  preConfigure = lib.optionalString withGtk "cd gtk";
 
   enableParallelBuilding = true;
 

pkgs/applications/graphics/fluxus/default.nix

@@ -18,7 +18,7 @@
 , openal
 , openssl
 , racket_7_9
-, sconsPackages
+, scons
 , zlib
 }:
 let
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     openssl.dev
     racket_7_9
   ];
-  nativeBuildInputs = [ sconsPackages.scons_latest ];
+  nativeBuildInputs = [ scons ];
 
   patches = [ ./fix-build.patch ];
   sconsFlags = [

pkgs/applications/misc/1password/default.nix

@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.15.0";
+  version = "2.16.0";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-D+i+RrPBwFHDL7ExiZUL/xc7vBcfHI7C6z0gNIs/Brs=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-G0kn3BsgC8En4wNNr0aUSa52is+xmx3Ho+l3aMxKcKs=" "zip";
-    i686-linux = fetch "linux_386" "sha256-Y19dbv9eQJF3V+94bByfWLUeDuJ78fUM9vJf1/Nd3rI=" "zip";
+    i686-linux = fetch "linux_386" "sha256-b5v8BGf7QkEU61TrLhCWprxcpUJp5BmUwrB9Oi+qyDI=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-Mxp6wCwBUNNucN0W0awghUzg2OQTkrwXsZgS/nVP41M=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-ctHNRESQp+l7s1uXCv6AgNBARFQJydA/rLfdYDNyDXU=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-KJVXW2Ze1AmDWNeTEfr7SsZMBmLyMfBv/FgC+XAds0A=" "pkg";
+    aarch64-darwin = fetch "apple_universal" "sha256-j+BiFJawqAhZHJhYDQx51G/aEgwAqq7mXedP65HyaGo=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;

pkgs/applications/misc/logseq/default.nix

@@ -2,8 +2,8 @@
 , stdenv
 , fetchurl
 , appimageTools
-, appimage-run
 , makeWrapper
+, electron
 , git
 }:
 
@@ -30,23 +30,30 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin $out/share/${pname} $out/share/applications $out/share/${pname}/resources/app/icons
+    mkdir -p $out/bin $out/share/${pname} $out/share/applications
-    cp -a ${appimageContents}/resources/app/icons/logseq.png $out/share/${pname}/resources/app/icons/logseq.png
+    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
     cp -a ${appimageContents}/Logseq.desktop $out/share/applications/${pname}.desktop
 
-    # set the env "LOCAL_GIT_DIRECTORY" for dugite so that we can use the git in nixpkgs
+    # remove the `git` in `dugite` because we want the `git` in `nixpkgs`
-    makeWrapper ${appimage-run}/bin/appimage-run $out/bin/logseq \
+    chmod +w -R $out/share/${pname}/resources/app/node_modules/dugite/git
-      --set "LOCAL_GIT_DIRECTORY" ${git} \
+    chmod +w $out/share/${pname}/resources/app/node_modules/dugite
-      --add-flags ${src}
+    rm -rf $out/share/${pname}/resources/app/node_modules/dugite/git
+    chmod -w $out/share/${pname}/resources/app/node_modules/dugite
 
-    # Make the desktop entry run the app using appimage-run
     substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace Exec=Logseq "Exec=$out/bin/logseq" \
+      --replace Exec=Logseq Exec=${pname} \
       --replace Icon=Logseq Icon=$out/share/${pname}/resources/app/icons/logseq.png
 
     runHook postInstall
   '';
 
+  postFixup = ''
+    # set the env "LOCAL_GIT_DIRECTORY" for dugite so that we can use the git in nixpkgs
+    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
+      --set "LOCAL_GIT_DIRECTORY" ${git} \
+      --add-flags $out/share/${pname}/resources/app
+  '';
+
   passthru.updateScript = ./update.sh;
 
   meta = with lib; {

pkgs/applications/misc/river-luatile/default.nix

@@ -0,0 +1,36 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, luajit
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "river-luatile";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "MaxVerevkin";
+    repo = "river-luatile";
+    rev = "v${version}";
+    hash = "sha256-eZgoFbat7X/jh5udlNyIuTheBUCHpaVRbsojYLATO18=";
+  };
+
+  cargoHash = "sha256-Vqyt5bL1lVhy/Wxd+zF7Wugvb7dW1N9Kq2TTFSaodnE=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    luajit
+  ];
+
+  meta = with lib; {
+    description = "Write your own river layout generator in lua";
+    homepage = "https://github.com/MaxVerevkin/river-luatile";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pinpox ];
+  };
+}

pkgs/applications/misc/visidata/default.nix

@@ -2,25 +2,41 @@
 , lib
 , buildPythonApplication
 , fetchFromGitHub
-, python-dateutil
+# python requirements
-, pandas
+, beautifulsoup4
-, requests
+, boto3
-, lxml
+, faker
-, openpyxl
-, xlrd
-, h5py
-, odfpy
-, psycopg2
-, pyshp
 , fonttools
-, pyyaml
+, h5py
-, pdfminer-six
-, vobject
-, tabulate
-, wcwidth
-, zstandard
-, setuptools
 , importlib-metadata
+, lxml
+, matplotlib
+, numpy
+, odfpy
+, openpyxl
+, pandas
+, pdfminer-six
+, praw
+, psutil
+, psycopg2
+, pyarrow
+, pyshp
+, pypng
+, python-dateutil
+, pyyaml
+, requests
+, seaborn
+, setuptools
+, sh
+, tabulate
+, urllib3
+, vobject
+, wcwidth
+, xlrd
+, xlwt
+, zstandard
+, zulip
+# other
 , git
 , withPcap ? true, dpkt, dnslib
 , withXclip ? stdenv.isLinux, xclip
@@ -29,13 +45,13 @@
 }:
 buildPythonApplication rec {
   pname = "visidata";
-  version = "2.10.2";
+  version = "2.11";
 
   src = fetchFromGitHub {
     owner = "saulpw";
     repo = "visidata";
     rev = "v${version}";
-    hash = "sha256-OKCrlUWHgbaLZJPVvs9lnw4cD27pRoO7F9oel1NzT6A=";
+    hash = "sha256-G/9paJFJsRfIxMJ2hbuVS7pxCfSUCK69DNV2DHi60qA=";
   };
 
   propagatedBuildInputs = [
@@ -47,11 +63,13 @@ buildPythonApplication rec {
     lxml
     openpyxl
     xlrd
+    xlwt
     h5py
     psycopg2
+    boto3
     pyshp
     #mapbox-vector-tile
-    #pypng
+    pypng
     fonttools
     #sas7bdat
     #xport
@@ -66,6 +84,22 @@ buildPythonApplication rec {
     wcwidth
     zstandard
     odfpy
+    urllib3
+    pyarrow
+    seaborn
+    matplotlib
+    sh
+    psutil
+    numpy
+
+    #requests_cache
+    beautifulsoup4
+
+    faker
+    praw
+    zulip
+    #pyairtable
+
     setuptools
     importlib-metadata
   ] ++ lib.optionals withPcap [ dpkt dnslib ]
@@ -81,14 +115,16 @@ buildPythonApplication rec {
   checkPhase = ''
     runHook preCheck
     # disable some tests which require access to the network
-    rm tests/load-http.vd            # http
+    rm -f tests/load-http.vd            # http
-    rm tests/graph-cursor-nosave.vd  # http
+    rm -f tests/graph-cursor-nosave.vd  # http
-    rm tests/messenger-nosave.vd     # dns
+    rm -f tests/messenger-nosave.vd     # dns
 
     # tests use git to compare outputs to references
     git init -b "test-reference"
-    git config user.name "nobody"; git config user.email "no@where"
+    git config user.name "nobody"
-    git add .; git commit -m "test reference"
+    git config user.email "no@where"
+    git add .
+    git commit -m "test reference"
 
     substituteInPlace dev/test.sh --replace "bin/vd" "$out/bin/vd"
     bash dev/test.sh

pkgs/applications/misc/yewtube/default.nix

@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "yewtube";
-  version = "2.9.2";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
-    owner = "iamtalhaasghar";
+    owner = "mps-youtube";
     repo = "yewtube";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5+0OaoUan9IFEqtMvpvtkfpd7IbFJhG52oROER5TY20=";
+    hash = "sha256-1qYHgMp9OZQuKDycvVwp0ADvF8xNY668JvRMVIE/dko=";
   };
 
   postPatch = ''
@@ -16,8 +16,6 @@ python3Packages.buildPythonApplication rec {
     substituteInPlace mps_youtube/__init__.py \
       --replace "from pip._vendor import pkg_resources" "" \
       --replace "__version__ =" "__version__ = '${version}' #"
-    # https://github.com/iamtalhaasghar/yewtube/pull/105
-    sed -ie '/pyreadline/d' requirements.txt
   '';
 
   propagatedBuildInputs = with python3Packages; [
@@ -25,6 +23,7 @@ python3Packages.buildPythonApplication rec {
     requests
     youtube-search-python
     yt-dlp
+    pylast
   ];
 
   checkInputs = with python3Packages; [
@@ -41,7 +40,7 @@ python3Packages.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Terminal based YouTube player and downloader, forked from mps-youtube";
-    homepage = "https://github.com/iamtalhaasghar/yewtube";
+    homepage = "https://github.com/mps-youtube/yewtube";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ fgaz koral ];
   };

pkgs/applications/networking/browsers/brave/default.nix

@@ -90,11 +90,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.49.120";
+  version = "1.49.128";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-KSu6HaNKc7uVY1rSyzU+VZSE2dbIOOrsUx1RYKnz8yU=";
+    sha256 = "sha256-TXAPzhNRupv8R2rKj/mFdubAVjOrnmbdBtmasTnqfyU=";
   };
 
   dontConfigure = true;

pkgs/applications/networking/cluster/kubeone/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "kubeone";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "kubermatic";
     repo = "kubeone";
     rev = "v${version}";
-    hash = "sha256-NREZF27fzVKW/s7uCfsmTesEALwEzVBS4cUaatwDJJw=";
+    hash = "sha256-bFkJXnz4Nm1XfQMaBWSHfCxaTbGQQwKXRd1ktZKs7hY=";
   };
 
-  vendorHash = "sha256-riuEIR8V0j828S4XZrJULvYoe8ttJrA8MME0nxkaTwM=";
+  vendorHash = "sha256-ZpTUhJyM+9e8b2EZzv4hsnV5G3HVPo6ga0pF3Ab53+A=";
 
   ldflags = [
     "-s"

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -128,11 +128,11 @@
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-Sv9e48+2rV3t9dmg6COWfrxnfMaxS9xJAPN1sEPen60=",
+    "hash": "sha256-pt+lff+kdiFmYRFpCjF/Ok7Uq6wWGcMZRZJe1Lh+K8s=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.48.0",
+    "rev": "v3.49.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -765,11 +765,11 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-2MbzXcdtP4O+zWGhBCp+uryVJmZoA2kXDe8AH3vZ0zA=",
+    "hash": "sha256-Ibc53R68QOGGcFFXkMZXCPFo6H8nvQ5VYq/DXdLnBEA=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.18.0",
+    "rev": "v3.18.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-dEbJTeHWhfR+8o/s4fi4I0sio1uuh6OIzJhVF5Rup04="
   },
@@ -838,13 +838,13 @@
     "vendorHash": null
   },
   "opennebula": {
-    "hash": "sha256-r8z5rpSvjNSDuvcRLtnOUFnBFFNAlcvfCbmW6LLHP5E=",
+    "hash": "sha256-Y1rNhXnHgwpKPgN5iZxH0ChHUBOj36K3XnSOkObj10g=",
     "homepage": "https://registry.terraform.io/providers/OpenNebula/opennebula",
     "owner": "OpenNebula",
     "repo": "terraform-provider-opennebula",
-    "rev": "v1.1.1",
+    "rev": "v1.2.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-zKtBDnvlQHe+q0OZUMUGu1gNsx2wIrIoArtJrt0VaBk="
+    "vendorHash": "sha256-W7UGOtyFsIMXPqFDnde2XlzU7klR7Fs00mSuJ9ID20A="
   },
   "openstack": {
     "hash": "sha256-UGs2Os7cWSd69ekzyoDLwzJxhGgUJbDJyrCIc6ipcwY=",
@@ -874,11 +874,11 @@
     "vendorHash": null
   },
   "ovh": {
-    "hash": "sha256-d/G2o1G0cdb5shSv1WG7YBbhNift2sKjUd/Cz9XgvJ8=",
+    "hash": "sha256-ePF3lojT4Dit3n4oI/74u3372gsSW8B1FQfEPhdfmz4=",
     "homepage": "https://registry.terraform.io/providers/ovh/ovh",
     "owner": "ovh",
     "repo": "terraform-provider-ovh",
-    "rev": "v0.28.1",
+    "rev": "v0.29.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1099,11 +1099,11 @@
     "vendorHash": "sha256-GkmUKSnqkabwGCl22/90529BWb0oJaIJHYHlS/h3KNY="
   },
   "tencentcloud": {
-    "hash": "sha256-E1L/xL+8xqNlJamklpgqq9HwdypRIh3jHTdkJtN+WVU=",
+    "hash": "sha256-N6x3CKpLL62lc+V038740EGBicjroc07KhkvyCYgn24=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.79.17",
+    "rev": "v1.79.18",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/ids/suricata/default.nix

@@ -121,7 +121,7 @@ stdenv.mkDerivation rec {
 
   postConfigure = ''
     # Avoid unintended clousure growth.
-    sed -i 's|/nix/store/\(.\{8\}\)[^-]*-|/nix/store/\1...-|g' ./src/build-info.h
+    sed -i 's|${builtins.storeDir}/\(.\{8\}\)[^-]*-|${builtins.storeDir}/\1...-|g' ./src/build-info.h
   '';
 
   hardeningDisable = [ "stackprotector" ];

pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix

@@ -1,6 +1,6 @@
-{ lib, stdenv, clang14Stdenv, fetchFromGitHub, openssl, sqlite }:
+{ lib, stdenv, darwin, fetchFromGitHub, openssl, sqlite }:
 
-(if stdenv.isDarwin then clang14Stdenv else stdenv).mkDerivation rec {
+(if stdenv.isDarwin then darwin.apple_sdk_11_0.clang14Stdenv else stdenv).mkDerivation rec {
   pname = "signalbackup-tools";
   version = "20230316";
 

pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix

@@ -23,7 +23,7 @@ symlinkJoin {
     fixSymlink () {
      local link=$1
      local target=$(readlink $link);
-     local newtarget=$(sed "s@/nix/store/[^/]*/@$out/@" <<< "$target")
+     local newtarget=$(sed "s@${builtins.storeDir}/[^/]*/@$out/@" <<< "$target")
      if [[ $target != $newtarget ]] && [[ -d $newtarget ]]; then
        echo fixing link to point to $newtarget instead of $target
        rm $link
@@ -35,7 +35,7 @@ symlinkJoin {
     fixSymlink $out/lib/systemd/user
     for i in $out/share/dbus-1/services/*.service $out/lib/systemd/user/*.service; do
       echo fixing service file $i to point to $out
-      sed -i "s@/nix/store/[^/]*/@$out/@" $i
+      sed -i "s@${builtins.storeDir}/[^/]*/@$out/@" $i
     done
   '';
 }

pkgs/applications/networking/remote/aws-workspaces/default.nix

@@ -1,6 +1,6 @@
 { stdenv, lib
 , makeWrapper, dpkg, fetchurl, autoPatchelfHook
-, curl, libkrb5, lttng-ust, libpulseaudio, gtk3, openssl_1_1, icu70, webkitgtk, librsvg, gdk-pixbuf, libsoup, glib-networking, graphicsmagick_q16, libva, libusb, hiredis
+, curl, libkrb5, lttng-ust, libpulseaudio, gtk3, openssl_1_1, icu70, webkitgtk, librsvg, gdk-pixbuf, libsoup, glib-networking, graphicsmagick_q16, libva, libusb1, hiredis
 }:
 
 stdenv.mkDerivation rec {
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     glib-networking
     graphicsmagick_q16
     hiredis
-    libusb
+    libusb1
     libva
   ];
 

pkgs/applications/office/gnucash/default.nix

@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch2
 , fetchurl
 , aqbanking
 , boost
@@ -74,6 +75,34 @@ stdenv.mkDerivation rec {
     ./0003-remove-valgrind.patch
     # this patch makes gnucash exec the Finance::Quote helpers directly
     ./0004-exec-fq-helpers.patch
+    # the following patches fix compilation with gcc 13 and glib > 2.76
+    # "Build fails with gcc 13 and glib > 2.76"
+    (fetchpatch2 {
+      url = "https://github.com/Gnucash/gnucash/commit/184669f517744ac7be6e420e5e1f359384f676d5.patch";
+      sha256 = "sha256-X5HCK//n+V5k/pEUNL6xwZY5NTeGnBt+7GhooqOXQ2I=";
+    })
+    # "Build fails with gcc 13 and glib > 2.76, bis"
+    (fetchpatch2 {
+      url = "https://github.com/Gnucash/gnucash/commit/abcce5000ca72bf943ca8951867729942388848e.patch";
+      sha256 = "sha256-WiMkozqMAYl5wrRhAQMNVDY77aRBa3E5/a0gvYyc9Zk=";
+    })
+    # "Build fails with gcc 13 and glib > 2.76, ter"
+    (fetchpatch2 {
+      url = "https://github.com/Gnucash/gnucash/commit/89e63ef67235d231d242f018894295a6cb38cfc3.patch";
+      sha256 = "sha256-xCkY8RlZPVDaRLbVn+QT28s4qIUgtMgjmuB0axSrNpw=";
+    })
+    # "Build fails with gcc 13"
+    # "Protect against passing an lseek failure rv to read()."
+    (fetchpatch2 {
+      url = "https://github.com/Gnucash/gnucash/commit/ce3447e6ea8b2f734b24a2502e865ebbbc21aaaa.patch";
+      sha256 = "sha256-mfPs/5rkCamihE0z1SRoX0tV4FNPkKUGd1T6iaCwy7E=";
+    })
+    # "Fix crashes in test-engine on Arch Linux."
+    # Also fixes the same crashes in nixpkgs.
+    (fetchpatch2 {
+      url = "https://github.com/Gnucash/gnucash/commit/1020bde89c77f70cee6cc8181ead96e8fade47aa.patch";
+      sha256 = "sha256-JCWm3M8hdgAwjuhLbFRN4Vk3BQqpn0FUwHk6Kg5Qa7Q=";
+    })
   ];
 
   # this needs to be an environment variable and not a cmake flag to suppress

pkgs/applications/science/math/giac/default.nix

@@ -111,7 +111,7 @@ stdenv.mkDerivation rec {
     # notably texlive, and we don't want texlive to become a runtime
     # dependency
     for file in $(find $out -name Makefile) ; do
-      sed -i "s@/nix/store/[^/]*/bin/@@" "$file" ;
+      sed -i "s@${builtins.storeDir}/[^/]*/bin/@@" "$file" ;
     done;
 
     # reference cycle

pkgs/applications/terminal-emulators/mlterm/default.nix

@@ -3,7 +3,7 @@
 , harfbuzz #substituting glyphs with opentype fonts
 , fribidi, m17n_lib #bidi and encoding
 , openssl, libssh2 #build-in ssh
-, fcitx, ibus, uim #IME
+, fcitx5, fcitx5-gtk, ibus, uim #IME
 , wrapGAppsHook #color picker in mlconfig
 , Cocoa #Darwin
 }:
@@ -37,7 +37,8 @@ stdenv.mkDerivation rec {
     vte
     m17n_lib
 
-    fcitx
+    fcitx5
+    fcitx5-gtk
     ibus
   ] ++ lib.optionals (stdenv.system != "aarch64-linux") [
     # FIXME Currently broken on aarch64-linux

pkgs/applications/window-managers/i3/status-rust.nix

@@ -57,6 +57,7 @@ rustPlatform.buildRustPackage rec {
     description = "Very resource-friendly and feature-rich replacement for i3status";
     homepage = "https://github.com/greshake/i3status-rust";
     license = licenses.gpl3Only;
+    mainProgram = "i3status-rs";
     maintainers = with maintainers; [ backuitist globin ];
     platforms = platforms.linux;
   };

pkgs/build-support/dotnet/build-dotnet-module/default.nix

@@ -176,7 +176,7 @@ stdenvNoCC.mkDerivation (args // {
           # Note that toString is necessary here as it results in the path at
           # eval time (i.e. to the file in your local Nixpkgs checkout) rather
           # than the Nix store path of the path after it's been imported.
-          if lib.isPath nugetDeps && !lib.hasPrefix "/nix/store/" (toString nugetDeps)
+          if lib.isPath nugetDeps && !lib.hasPrefix "${builtins.storeDir}/" (toString nugetDeps)
           then toString nugetDeps
           else ''$(mktemp -t "${pname}-deps-XXXXXX.nix")'';
       in

pkgs/build-support/fetchdocker/default.nix

@@ -3,7 +3,7 @@ let
   stripScheme =
     builtins.replaceStrings [ "https://" "http://" ] [ "" "" ];
   stripNixStore =
-    s: lib.removePrefix "/nix/store/" s;
+    s: lib.removePrefix "${builtins.storeDir}/" s;
 in
 { name
 , registry         ? "https://registry-1.docker.io/v2/"

pkgs/build-support/release/nix-build.nix

@@ -140,7 +140,7 @@ stdenv.mkDerivation (
       (lib.optional doCoverityAnalysis args.cov-build) ++
       (lib.optional doCoverityAnalysis args.xz);
 
-    lcovFilter = ["/nix/store/*"] ++ lcovFilter;
+    lcovFilter = ["${builtins.storeDir}/*"] ++ lcovFilter;
 
     inherit lcovExtraTraceFiles;
 

pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sierra-breeze-enhanced";
-  version = "1.3.1";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "kupiqu";
     repo = "SierraBreezeEnhanced";
     rev = "V${version}";
-    sha256 = "sha256-x3OTLH8gcWrqpFGQPZHwvyPFwLhEGeHhU4cRqvtPupQ=";
+    sha256 = "sha256-zTUTsSzy4p0Y7RPOidCtxTjjyvPRyWSQCxA5sUzXcLc=";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules wrapQtAppsHook ];

pkgs/desktops/pantheon/desktop/gala/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -38,6 +39,27 @@ stdenv.mkDerivation rec {
     # We look for plugins in `/run/current-system/sw/lib/` because
     # there are multiple plugin providers (e.g. gala and wingpanel).
     ./plugins-dir.patch
+
+    # WindowClone: Don't calculate offset
+    # https://github.com/elementary/gala/pull/1567
+    (fetchpatch {
+      url = "https://github.com/elementary/gala/commit/b7139add2333e5419afd1c82c3790d85044c1f76.patch";
+      sha256 = "sha256-QhBARbA3YEXB/RIM/gmFiry1IzGvFFQVXGDs0kGjf20=";
+    })
+
+    # Map notification windows manually while switching workspace
+    # https://github.com/elementary/gala/pull/1577
+    (fetchpatch {
+      url = "https://github.com/elementary/gala/commit/97b33173e2ee8b4a4af3fe0513b6d264de9d9b2a.patch";
+      sha256 = "sha256-y2PicvHxtKlZTpr6a0Hua1ppXpRwDItsIoGG2r+DAjQ=";
+    })
+
+    # Use ClickAction for FramedBackground and close buttons
+    # https://github.com/elementary/gala/pull/1579
+    (fetchpatch {
+      url = "https://github.com/elementary/gala/commit/79453b324d2e737ba32124212632e1269c6c9af1.patch";
+      sha256 = "sha256-ipOoY3dn0Hs1U2d9OER+ZfgC5AL4yay4FD8ongID/xY=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/development/libraries/ffmpeg/6.nix

@@ -0,0 +1,4 @@
+import ./generic.nix rec {
+  version = "6.0";
+  sha256 = "sha256-RVbgsafIbeUUNXmUbDQ03ZN42oaUo0njqROo7KOQgv0=";
+}

pkgs/development/libraries/ffmpeg/generic.nix

@@ -227,6 +227,7 @@
 , libxml2
 , xz
 , nv-codec-headers
+, nv-codec-headers-11
 , openal
 , ocl-icd # OpenCL ICD
 , opencl-headers  # OpenCL headers
@@ -348,7 +349,14 @@ stdenv.mkDerivation (finalAttrs: {
       --replace VK_EXT_VIDEO_DECODE VK_KHR_VIDEO_DECODE
   '';
 
-  patches = map (patch: fetchpatch patch) extraPatches;
+  patches = map (patch: fetchpatch patch) (extraPatches
+    ++ (lib.optional (lib.versionAtLeast version "6" && lib.versionOlder version "6.1")
+      { # this can be removed post 6.1
+        name = "fix_aacps_tablegen";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/814178f92647be2411516bbb82f48532373d2554";
+        hash = "sha256-FQV9/PiarPXCm45ldtCsxGHjlrriL8DKpn1LaKJ8owI=";
+      }
+    ));
 
   configurePlatforms = [];
   setOutputFlags = false; # Only accepts some of them
@@ -539,7 +547,7 @@ stdenv.mkDerivation (finalAttrs: {
   # TODO This was always in buildInputs before, why?
   buildInputs = optionals withFullDeps [ libdc1394 ]
   ++ optionals (withFullDeps && !stdenv.isDarwin) [ libraw1394 ] # TODO where does this belong to
-  ++ optionals (withNvdec || withNvenc) [ nv-codec-headers ]
+  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast version "6") then nv-codec-headers-11 else nv-codec-headers) ]
   ++ optionals withAlsa [ alsa-lib ]
   ++ optionals withAom [ libaom ]
   ++ optionals withAss [ libass ]

pkgs/development/libraries/libdeltachat/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.111.0";
+  version = "1.112.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = "v${version}";
-    hash = "sha256-Fj5qrvlhty03+rxFqajdNoKFI+7qEHmKBXOLy3EonJ8=";
+    hash = "sha256-byUQQu+lzqTVufEHoeSd9hrDBWj92JCokzetdRITRns=";
   };
 
   patches = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-5s4onnL5aX4jFxEZWDU9xK6wSdTg7ZJZirxKTiImy38=";
+    hash = "sha256-j0Cz1tl6N1JuKt2io+uoqUo/cL/VRVVasJ0CU3X1xtw=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/nvidia-vaapi-driver/default.nix

@@ -4,6 +4,7 @@
 , meson
 , ninja
 , pkg-config
+, libdrm
 , libGL
 , gst_all_1
 , nv-codec-headers-11
@@ -13,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvidia-vaapi-driver";
-  version = "0.0.8";
+  version = "0.0.9";
 
   src = fetchFromGitHub {
     owner = "elFarto";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RMFkClaWoFNeSglV5otS/rzI6JNQMiAHDzH3DoEHA5I=";
+    sha256 = "sha256-mQtprgm6QonYiMUPPIcCbWxPQ/b2XuQiOkROZNPYaQk=";
   };
 
   nativeBuildInputs = [
@@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    libdrm
     libGL
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-bad
@@ -44,6 +46,7 @@ stdenv.mkDerivation rec {
   meta = with lib;{
     homepage = "https://github.com/elFarto/nvidia-vaapi-driver";
     description = "A VA-API implemention using NVIDIA's NVDEC";
+    changelog = "https://github.com/elFarto/nvidia-vaapi-driver/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers;[ nickcao ];
   };

pkgs/development/libraries/rocm-comgr/default.nix

@@ -15,7 +15,7 @@ let
     else throw "Unsupported ROCm LLVM platform";
 in stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-comgr";
-  version = "5.4.3";
+  version = "5.4.4";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";

pkgs/development/libraries/swiften/default.nix

@@ -9,7 +9,7 @@
 , fetchpatch
 , openssl
 , boost
-, sconsPackages
+, scons
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    sconsPackages.scons_latest
+    scons
   ];
 
   buildInputs = [

pkgs/development/lua-modules/generated-packages.nix

@@ -1352,7 +1352,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-session = callPackage({ lua_pack, buildLuarocksPackage, fetchgit, luaOlder, lua, lua-ffi-zlib, lua-resty-openssl }:
+lua-resty-session = callPackage({ buildLuarocksPackage, fetchgit, luaOlder, lua, lua-resty-openssl /*, lua_pack, lua-ffi-zlib */  }:
 buildLuarocksPackage {
   pname = "lua-resty-session";
   version = "4.0.3-1";
@@ -1374,12 +1374,13 @@ buildLuarocksPackage {
  '') ["date" "path"]) ;
 
   disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ lua lua-ffi-zlib lua-resty-openssl lua_pack ];
+  propagatedBuildInputs = [ lua lua-resty-openssl /* lua_pack lua-ffi-zlib */ ];
 
   meta = {
     homepage = "https://github.com/bungle/lua-resty-session";
     description = "Session Library for OpenResty - Flexible and Secure";
     license.fullName = "BSD";
+    broken = true; # lua_pack and lua-ffi-zlib are unpackaged, causing this package to not evaluate
   };
 }) {};
 

pkgs/development/python-modules/acquire/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "acquire";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "acquire";
     rev = "refs/tags/${version}";
-    hash = "sha256-VkO+XLIC/UQzvfLsgbKcx9i8OxTC6J32nkxPHWWn7m8=";
+    hash = "sha256-F0kKydFDL2XafK7A66qn3Ad/mGZU8x3UKtXtKpxHZqU=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/ansible-doctor/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "ansible-doctor";
-  version = "2.0.1";
+  version = "2.0.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "thegeeklab";
     repo = "ansible-doctor";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xUg7+7oWxIVdKLOGIE1uxh7SSjkz/w0//OyMF1HhEJk=";
+    hash = "sha256-hbHQbYc/cOqbeubAMa0J+UtI00jtyG/WUBe0xcSaGSI=";
   };
 
   pythonRelaxDeps = true;

pkgs/development/python-modules/ansible-later/default.nix

@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "ansible-later";
-  version = "3.2.0";
+  version = "3.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "thegeeklab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-5TV9cTMTx8R6jf9HypieinCyNgHC4LSHTRQd9RXApG4=";
+    hash = "sha256-icJn8lk7gAhqTRu3rAroWgtNwOdbimE4y+CHLiDvb9k=";
   };
 
   postPatch = ''

pkgs/development/python-modules/dissect-cim/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-cim";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.cim";
     rev = "refs/tags/${version}";
-    hash = "sha256-RlkTsAvX+9c69JBy+DZbcCfAvcCnWDisgdQQMBkphtg=";
+    hash = "sha256-VRHnDLyHZEzeEFK+2MNQibekIlb+tsBEjUbT5tI/tIs=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-clfs/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-clfs";
-  version = "1.3";
+  version = "1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.clfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-QzEcJvujkNVUXtqu7yY7sJ/U55jzGBbUHxOVDxg4vac=";
+    hash = "sha256-/QZuet54ws0IsjHKlv2a3hqoXhY5VaQQ0jU81J46Cyg=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-cstruct/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-cstruct";
-  version = "3.5";
+  version = "3.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.cstruct";
     rev = "refs/tags/${version}";
-    hash = "sha256-tEWqw3ySF1ebOMztZwAlkTiY0mFCzTM58wD0XDfljFA=";
+    hash = "sha256-f6cE1x7TsjJsdACLZjsbyfnTDPXcpXqs0qBo4l+fKS4=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-esedb/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-esedb";
-  version = "3.5";
+  version = "3.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.esedb";
     rev = "refs/tags/${version}";
-    hash = "sha256-wTzr9b95jhPbZVWM/C9T1OSBLK39sCIjbsNK/6Z83JE=";
+    hash = "sha256-RBU+aQbqPfF7kjt5Nc3+FnrmkTZgGyUv1HFTFP4ZgZ4=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-etl/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-etl";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.etl";
     rev = "refs/tags/${version}";
-    hash = "sha256-rEYWTMBzMyaADqT1Pp5z1J2Uf/t/GeX/FAnZVnaycYs=";
+    hash = "sha256-RNm6je3WW6ig+JCU4AlVYpAJZXq/l8U7Pbf/AGeAmXA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-eventlog/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-eventlog";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.eventlog";
     rev = "refs/tags/${version}";
-    hash = "sha256-PbU9Rd0D+xdleTIMAV+esw1WynWU4++8KeXlHS9yiJs=";
+    hash = "sha256-dU34eEUwRGHm/S0w6rnXJmootv1trkhKlXjWcfCFB3Q=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-evidence/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-evidence";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.evidence";
     rev = "refs/tags/${version}";
-    hash = "sha256-R4ua7JeT09GkoBwM2YGf2T0PJXhldUpqAS3xsB9L79c=";
+    hash = "sha256-XGS0PevalwaQX5OF/KcDhNSJMPzUOiLO5nwp/K3HHJ8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-executable/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-executable";
-  version = "1.1";
+  version = "1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.executable";
     rev = "refs/tags/${version}";
-    hash = "sha256-c58g2L3B/3/pC+iyXphYsjhpBs0I0Q64B8+rv5k1dtg=";
+    hash = "sha256-I/LwIGce1bebAvjVuFE0rJAuJ/65xMTIim6M0BJR6TI=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-extfs/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-extfs";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.extfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-VCPNY/4SUkFpLuSs2Cxu8u5qt2sQ9VGlfdPssybxhk8=";
+    hash = "sha256-NSDhkkxqQSrfV1uttxUjLmdXlrgfAMrs5vSWgKyjuB4=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-fat/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-fat";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.fat";
     rev = "refs/tags/${version}";
-    hash = "sha256-v4GjI6DdDfxO3kGZ7Z5C6mkdRj9axsT9mvlSOQyiMBw=";
+    hash = "sha256-fnppFbdI+SfGPPcSspIQnI5wH3MerGtlEbm8pe3oSBs=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-ffs/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ffs";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.ffs";
     rev = "refs/tags/${version}";
-    hash = "sha256-nGxojXslFVcqU+9StBOacmCyoZJJB4B4OIvql/cbcZE=";
+    hash = "sha256-A2KyXkL5SKy/iX2G6jQ2Fyx08UKVnekPICdcLhUbm3Q=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-hypervisor/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-hypervisor";
-  version = "3.5";
+  version = "3.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.hypervisor";
     rev = "refs/tags/${version}";
-    hash = "sha256-dWaU3v2QcoqVIygeufy0ZYVliBE1tijV3qEsvCOIarM=";
+    hash = "sha256-6oPLl18U0TtVCkLsNN8Q4hBLArfXWWRkZI4VrFKJd9Q=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-ntfs/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ntfs";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.ntfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-xhtAN0QaLLbQk/aAd9PlEkyW39w33iPaQtGzbouI6hc=";
+    hash = "sha256-n6FPdsObzHLhhkfyxTiCDR4PpIQqRJU+QpAYtxk1Snc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-ole/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ole";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.ole";
     rev = "refs/tags/${version}";
-    hash = "sha256-m2+AcKp8rH+VQIdT85oKoA8QoyNQOmrZ2DvBELZnEqM=";
+    hash = "sha256-bzm9NynNUxXefWBxPIqPcRD5E52IF4on6JMtJOrvvyk=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-regf/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-regf";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.regf";
     rev = "refs/tags/${version}";
-    hash = "sha256-3QJ1N9LukvEa74rndN/Sj6Vq10YJVBsOGdlMzR9TrKA=";
+    hash = "sha256-nF9vJACNPA5QQy+nWjkkAoVAVdrlzAgKq//ldWpVtlE=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-shellitem/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-shellitem";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.shellitem";
     rev = "refs/tags/${version}";
-    hash = "sha256-flTv2Y+UwMTQnvqRS/pZRPkTsIjvCAp7B4rKAQPOJL4=";
+    hash = "sha256-BL1eTxL82hjsGBRK5mBNxygEzQvjN8P6/tu6KOkHf9s=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-sql/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-sql";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.sql";
     rev = "refs/tags/${version}";
-    hash = "sha256-sIXFEckHFr9H4oGFw8uuC+c54PR8ZbQxJKb5x5EixxQ=";
+    hash = "sha256-JrdYCqyds6opgRz2Jxu70MewN7uR+GoN6GF0HZgB1BI=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-squashfs/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-squashfs";
-  version = "1.0";
+  version = "1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.squashfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-bDR6GAgl1dOhZ3fWA7E27KS6pj9AXInNxwmwNXXV3lc=";
+    hash = "sha256-fcL0kPuJaole9EkrqU8Gouh3yquT2QaO8//R0ixMuP8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-target/default.nix

@@ -37,16 +37,16 @@
 
 buildPythonPackage rec {
   pname = "dissect-target";
-  version = "3.7";
+  version = "3.8";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.target";
     rev = "refs/tags/${version}";
-    hash = "sha256-jFQ8BxCC4PW135igfXA5EmlWYIZ0zF12suiUMiLbArA=";
+    hash = "sha256-CPN8g6LDeS77fveFOK6gExIJq9g+5qXhwDhjw3tWuJc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -105,6 +105,13 @@ buildPythonPackage rec {
     "test_exec_target_command"
     # Issue with tar file
     "test_tar_sensitive_drive_letter"
+    # Tests compare dates and times
+    "yum"
+  ];
+
+  disabledTestPaths = [
+    # Tests are using Windows paths
+    "tests/test_plugins_browsers.py"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/dissect-thumbcache/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-thumbcache";
-  version = "1.2";
+  version = "1.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.thumbcache";
     rev = "refs/tags/${version}";
-    hash = "sha256-lTtTZQgEvgaVoNPnVeRGO/BQU/8RfQ2ktljSBflhlOw=";
+    hash = "sha256-HO2s9AxDRmL4TNRYCdkYpWry3i4GNR0K9i5D2Pz3mVQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   disabledTests = [
     # Don't run Windows related tests
     "windows"
+    "test_index_type"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/dissect-util/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-util";
-  version = "3.6";
+  version = "3.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.util";
     rev = "refs/tags/${version}";
-    hash = "sha256-hijwu2QT9xJZ1F0wz5NO0mAVe/VA3JcPmoEYQiQRLtM=";
+    hash = "sha256-uITIEiy4U2B0AQobvQIG/bYjelPmM8fyQduDhtC29QI=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-vmfs/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-vmfs";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.vmfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-9+1geOJ+vzy6+eGibX+BUHbtzyLhq3MPBsad98ykn3I=";
+    hash = "sha256-zLQzUSJnm5DOhKKCEWX1kVEmJK0oBGKHaWucVn1HOjg=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-volume/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-volume";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.volume";
     rev = "refs/tags/${version}";
-    hash = "sha256-5O2ywPJi9M7gvcreS7DrW2qJ32MoR3Qero7jJ5gv0ow=";
+    hash = "sha256-7ud767/UoOAbFaH1Jx4CAaQnVDzInsKIULg/LDhb/gY=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect-xfs/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-xfs";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.xfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-OasoZ+HGvW8PPWDBvKdrfiE3FqnXPx0xjBVFWLBYHwQ=";
+    hash = "sha256-6EJyRqTOoYCqAihosAefBqRFniSkcw7pBLq16pyPntk=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dissect/default.nix

@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "dissect";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect";
     rev = "refs/tags/${version}";
-    hash = "sha256-+t6v553lP9NEimNlp48NQ+6dpIOrgfZ1FU3LNJF44YY=";
+    hash = "sha256-fprB+TPwtGpRcG6pkAWHsttjxTbFmmm96DguMh7f+18=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/identify/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "2.5.21";
+  version = "2.5.22";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pre-commit";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-4e25m4RIeWKDXxbhIrfKqKgTxSqtDgwyShoRIbxGN0c=";
+    hash = "sha256-SSbphjcfgexVveXp2BfAiGzehb2tSBcsMEse5uSh9Xo=";
   };
 
   nativeCheckInputs = [

pkgs/development/python-modules/jc/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "jc";
-  version = "1.23.0";
+  version = "1.23.1";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "kellyjonbrazil";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-0ZKdySzRHHtDWvSrQ0qJTggu48TyCBVrtEZZkM8HqNQ=";
+    hash = "sha256-3AH/NKYMACNuS0I2RsyU+L5Vksdv9H/q3aV1US64rk0=";
   };
 
   propagatedBuildInputs = [ ruamel-yaml xmltodict pygments ];

pkgs/development/python-modules/mailchecker/default.nix

@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "mailchecker";
-  version = "5.0.7";
+  version = "5.0.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-u5htHCI10mn6AQDlAShMpbyI4PcqiRgpRvsy5Q3km+0=";
+    hash = "sha256-rqayN1W+dqHSdRH7NFKtD07r2OztQq5FBhMaJEI3iwY=";
   };
 
   # Module has no tests

pkgs/development/python-modules/mypy-boto3-builder/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.13.0";
+  version = "7.14.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     rev = "refs/tags/${version}";
-    hash = "sha256-9D2w1rnYf7aKOABXmePghR695dlq37bci+bVOWrQCYw=";
+    hash = "sha256-dcVEIeDsVX9bdi6IgBPHM/aVrRujmd/BHmCUCuD0v8k=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/mypy-boto3-s3/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-s3";
-  version = "1.26.62";
+  version = "1.26.97.post2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qBf/8o/ualbYlkEK4KbYSP/kNUgK43rBxIGUDZYOz+U=";
+    hash = "sha256-5fa2iL4H73Ne+U1hVzdJomV6NRJRcmsyXz3OSUcQrQg=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/scmrepo/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "scmrepo";
-  version = "0.1.16";
+  version = "0.1.17";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-d8CwvxWdFhKXzv6mzWh+WIH6VSBsQOpdyc5UIwrh7kg=";
+    hash = "sha256-hY46bowYJFmGfEmynTtGgXXkF9D5AcqApO7I/BIl/Lw=";
   };
 
   postPatch = ''

pkgs/development/python-modules/yalexs-ble/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "2.1.1";
+  version = "2.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-tYdm6XrjltQtN9m23GB9WDWLbXb4pMNiLQWpxxeqsLY=";
+    hash = "sha256-FvZ0U8aZNnGehDMt3+LWLYKU/CSPpifWE7STZkA+0iA=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/algolia-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "algolia-cli";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "algolia";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-lO+ysaXZcwRsuEdkMyPKqrChbW27eId466Eb8Mss2IQ=";
+    hash = "sha256-l0AIAg68HR8sD1l978OW3H7nnQbIrxtXqo2/rWTZJmY=";
   };
 
   vendorHash = "sha256-t8SqCBuE/JmVR71MC9sHtQ6tEovO2UJo7FCDM+IBk+c=";

pkgs/development/tools/analysis/cppcheck/default.nix

@@ -8,6 +8,7 @@
 , docbook_xsl
 , docbook_xml_dtd_45
 , which
+, pkg-config
 }:
 
 stdenv.mkDerivation rec {
@@ -21,8 +22,9 @@ stdenv.mkDerivation rec {
     hash = "sha256-wr2O9EqDvHaMQwnjFLLtP1XxfUwFa/P6gGqYNNPVyaA=";
   };
 
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config installShellFiles libxslt docbook_xsl docbook_xml_dtd_45 which python3 ];
   buildInputs = [ pcre (python3.withPackages (ps: [ps.pygments])) ];
-  nativeBuildInputs = [ installShellFiles libxslt docbook_xsl docbook_xml_dtd_45 which ];
 
   makeFlags = [ "PREFIX=$(out)" "MATCHCOMPILER=yes" "FILESDIR=$(out)/share/cppcheck" "HAVE_RULES=yes" ];
 
@@ -30,17 +32,22 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace 'PCRE_CONFIG = $(shell which pcre-config)' 'PCRE_CONFIG = $(PKG_CONFIG) libpcre'
+  '';
+
   postBuild = ''
     make DB2MAN=${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl man
   '';
 
-  # test/testcondition.cpp:4949(TestCondition::alwaysTrueContainer): Assertion failed.
-  doCheck = !(stdenv.isLinux && stdenv.isAarch64);
-
   postInstall = ''
     installManPage cppcheck.1
   '';
 
+  # test/testcondition.cpp:4949(TestCondition::alwaysTrueContainer): Assertion failed.
+  doCheck = !(stdenv.isLinux && stdenv.isAarch64);
+
   doInstallCheck = true;
   installCheckPhase = ''
     runHook preInstallCheck

pkgs/development/tools/cloud-nuke/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cloud-nuke";
-  version = "0.27.0";
+  version = "0.27.1";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-q1/BPJkoLjNbk6OTd+VDmRX7zjDXr8vKWme7csG9xN8=";
+    hash = "sha256-HzQKbG2Bzh3JcvRn6dUlL+n9IeDj/EhC7ir9HcmS96w=";
   };
 
-  vendorHash = "sha256-MQjUajAE9ST8mwbmfwTMBOkhyqPe7pS0yQimFaBn50U=";
+  vendorHash = "sha256-++LBd8FDZzZlwlCvwc1foBm8yx62YcJr0enJZxb9ZI0=";
 
   ldflags = [ "-s" "-w" "-X main.VERSION=${version}" ];
 

pkgs/development/tools/coursier/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "coursier";
-  version = "2.1.0-RC6";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "https://github.com/coursier/coursier/releases/download/v${version}/coursier";
-    sha256 = "0b52qp0jb2bhb649r6cca0yd1cj8wsyp0f1j3pnmir6rizjwkm5q";
+    sha256 = "PfvqoVwf5Cbf+Mef/v6jhMzVnfwM0+/vBQoS4RM5mK4=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/tools/esbuild/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.17.12";
+  version = "0.17.13";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-75qDQWAp6cmuXtq90oIIQCj5IKUoQxNARxhFo2Sm5mk=";
+    hash = "sha256-b9hepd8rF96lU/986Kgc0aSulUylecu73cuxM6Kuu24=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";

pkgs/development/tools/ginkgo/default.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "ginkgo";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "onsi";
     repo = "ginkgo";
     rev = "v${version}";
-    sha256 = "sha256-ew0O+xuRsIrjxJxmdYegbYjcXeEmpL00fJS43jyGIEg=";
+    sha256 = "sha256-lRJCRdt/LIFG6MmCkzlvp77CxM4Md7+eyyiw32Xz9rw=";
   };
-  vendorHash = "sha256-nz32DPm0Sg13ScAeXUYagXvxhpRm+L+rvvY0gE1L584=";
+  vendorHash = "sha256-1+uB/UuwrZw17eSRLwcER67z/Qxg2H04vbBdk2FKYf0=";
 
   # integration tests expect more file changes
   # types tests are missing CodeLocation

pkgs/development/tools/godot/3/default.nix

@@ -102,7 +102,7 @@ stdenv.mkDerivation rec {
     homepage = "https://godotengine.org";
     description = "Free and Open Source 2D and 3D game engine";
     license = licenses.mit;
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ twey ];
   };
 }

pkgs/development/tools/godot/4/default.nix

@@ -53,13 +53,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "godot";
-  version = "4.0-stable";
+  version = "4.0.1-stable";
 
   src = fetchFromGitHub {
     owner = "godotengine";
     repo = "godot";
     rev = version;
-    hash = "sha256-BaSIHTV7LFV5VqjW+q7u/t/DR6JS6vxfREab6EdKYPU=";
+    hash = "sha256-0PDKZ92PJo9N5oP56/Z8bzhVhfO7IHdtQ5rMj5Difto=";
   };
 
   nativeBuildInputs = [
@@ -125,7 +125,7 @@ stdenv.mkDerivation rec {
     homepage = "https://godotengine.org";
     description = "Free and Open Source 2D and 3D game engine";
     license = licenses.mit;
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ twey shiryel ];
   };
 }

pkgs/development/tools/misc/grpc-client-cli/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "grpc-client-cli";
-  version = "1.17.0";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "vadimi";
     repo = "grpc-client-cli";
     rev = "v${version}";
-    sha256 = "sha256-iIF/CzNWY8XQiXQ4WFDU2mHDuNeWmAOXP16irik83FU=";
+    sha256 = "sha256-gpTJObgLbH+4fBnBrI6YA3Y4ENuGHV6xP7oHbSFQyEw=";
   };
 
-  vendorHash = "sha256-6oJuyW3Yc/m7GnE2WipTUQk9eymK6xd+dT7mOVn2/vM=";
+  vendorHash = "sha256-FuUxCm/p8ke55kMjsmHwZTJMWO4cQZZ/B1RDpdxUr8U=";
 
   meta = with lib; {
     description = "generic gRPC command line client";

pkgs/development/tools/nsis/default.nix

@@ -3,7 +3,7 @@
 , symlinkJoin
 , fetchurl
 , fetchzip
-, sconsPackages
+, scons
 , zlib
 , libiconv
 }:
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     chmod -R u+w $out/share/nsis
   '';
 
-  nativeBuildInputs = [ sconsPackages.scons_latest ];
+  nativeBuildInputs = [ scons ];
   buildInputs = [ zlib ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
   CPPPATH = symlinkJoin {

pkgs/development/web/flyctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.492";
+  version = "0.0.498";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-15OzhjiN5pk+V72vTm/lItrQLtBleHC+V5NX3yWePXU=";
+    hash = "sha256-8rkG5OiyK7+HaUZjbTEr6KbK9cl4AFPepav76DS7LoU=";
   };
 
-  vendorHash = "sha256-w5S1LDttRHvJ4MJ+wXHREOU2/j0JVjoaoFcsfVhXaTU=";
+  vendorHash = "sha256-ZLENEilEH+GgSyCYbptdNkz6eveCbVr9f/09szyM8pw=";
 
   subPackages = [ "." ];
 

pkgs/games/cataclysm-dda/wrapper.nix

@@ -34,7 +34,7 @@ else symlinkJoin {
         cp "$1" "''${1}.bk"
         unlink "$1"
         mv "''${1}.bk" "$1"
-        sed -i "$1" -e "s,/nix/store/.\+\(/bin/cataclysm-tiles\),$out\1,"
+        sed -i "$1" -e "s,${builtins.storeDir}/.\+\(/bin/cataclysm-tiles\),$out\1,"
     }
     for script in "$out/share/applications/cataclysm-dda.desktop" \
                   "$out/Applications/Cataclysm.app/Contents/MacOS/Cataclysm.sh"