From 16e4a92e0de44af134e76ffbd80029eed201f2a7 Mon Sep 17 00:00:00 2001
From: Charles Duffy <charles@dyfis.net>
Date: Fri, 3 Mar 2023 11:14:43 -0600
Subject: [PATCH 01/56] pcsc-safenet: 10.0.37 -> 10.8.28

Update pcsc-safenet to a version with better hardware support, clearer licensing, less-unofficial download location

- Version 10.8 explicitly supports the 5110+ CC line of SafeNet tokens.

- Version 10.8 release notes explicitly document that "from SAC 10.8 release onwards, no license is required for SAC on Linux".

It's not clear to me whether this is sufficient to allow clearing the nonfree flag, but it's certainly an improvement.

Also, we're now getting our downloads from a company that distributes SafeNet hardware rather than a website under the control of an Arch contributor, and thus have a clearer chain-of-custody for these security-critical binaries.
---
 pkgs/tools/security/pcsc-safenet/default.nix | 78 +++++++++++---------
 1 file changed, 43 insertions(+), 35 deletions(-)

diff --git a/pkgs/tools/security/pcsc-safenet/default.nix b/pkgs/tools/security/pcsc-safenet/default.nix
index 68006a40da8d..be86f9cd643d 100644
--- a/pkgs/tools/security/pcsc-safenet/default.nix
+++ b/pkgs/tools/security/pcsc-safenet/default.nix
@@ -1,22 +1,31 @@
 { stdenv
 , lib
+, runCommand
 , fetchurl
 , autoPatchelfHook
 , dpkg
-, gtk2
-, openssl
+, gtk3
+, openssl_1_1
 , pcsclite
+, unzip
 }:
 
 stdenv.mkDerivation rec {
   pname = "pcsc-safenet";
-  version = "10.0.37-0";
+  version = "10.8.28";
 
-  # https://aur.archlinux.org/packages/sac-core/
-  src = fetchurl {
-    url = "https://storage.spidlas.cz/public/soft/safenet/SafenetAuthenticationClient-core-${version}_amd64.deb";
-    sha256 = "1r9739bhal7ramj1rpawaqvik45xbs1c756l1da96din638gzy5l";
-  };
+  # extract debian package from larger zip file
+  src = runCommand "sac.deb" {
+    zipSrc = let
+      versionWithUnderscores = builtins.replaceStrings ["."] ["_"] version;
+    in fetchurl {
+      url = "https://www.digicert.com/StaticFiles/SAC_${versionWithUnderscores}_GA_Build.zip";
+      hash = "sha256-bh+TB7ZGDMh9G4lcPtv7mc0XeGhmCfMMqrlqtyGIIaA=";
+    };
+    debName = "SAC ${version} GA Build/Installation/Standard/Ubuntu-2004/safenetauthenticationclient_${version}_amd64.deb";
+  } ''
+    ${unzip}/bin/unzip -p "$zipSrc" "$debName" >"$out"
+  '';
 
   dontBuild = true;
   dontConfigure = true;
@@ -26,13 +35,13 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    gtk2
-    openssl
+    gtk3
+    openssl_1_1
     pcsclite
   ];
 
   runtimeDependencies = [
-    openssl
+    openssl_1_1
   ];
 
   nativeBuildInputs = [
@@ -41,35 +50,34 @@ stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
-    # Set up for pcsc drivers
+    mv usr/* .
+
     mkdir -p pcsc/drivers
-    mv usr/share/eToken/drivers/* pcsc/drivers/
-    rm -r usr/share/eToken/drivers
+    mv -- lib/pkcs11/* pcsc/drivers/
+    rmdir lib/pkcs11
 
-    # Move binaries out
-    mv usr/bin bin
+    mkdir "$out"
+    cp -r ./* "$out/"
 
-    # Move UI to bin
-    mv usr/share/SAC/SACUIProcess bin/
-    rm -r usr/share/SAC
+    (
+      cd "$out/lib/" || exit
+      for f in *.so.*.*.*; do
+        ln -sf "$f" "''${f%.*}" || exit
+        ln -sf "$f" "''${f%.*.*}" || exit
+        ln -sf "$f" "''${f%.*.*.*}" || exit
+      done
+    ) || exit
 
-    mkdir $out
-    cp -r {bin,etc,lib,pcsc,usr,var} $out/
+    (
+      cd "$out/pcsc/drivers" || exit
+      for f in *; do
+        if [[ ! -e $f && -e ../../lib/$f ]]; then
+          ln -sf ../../lib/"$f" "$f" || exit
+        fi
+      done
+    ) || exit
 
-    cd "$out/lib/"
-    ln -sf libeToken.so.10.0.37 libeTPkcs11.so
-    ln -sf libeToken.so.10.0.37 libeToken.so.10.0
-    ln -sf libeToken.so.10.0.37 libeToken.so.10
-    ln -sf libeToken.so.10.0.37 libeToken.so
-    ln -sf libcardosTokenEngine.so.10.0.37 libcardosTokenEngine.so.10.0
-    ln -sf libcardosTokenEngine.so.10.0.37 libcardosTokenEngine.so.10
-    ln -sf libcardosTokenEngine.so.10.0.37 libcardosTokenEngine.so
-
-    cd $out/pcsc/drivers/aks-ifdh.bundle/Contents/Linux/
-    ln -sf libAksIfdh.so.10.0 libAksIfdh.so
-    ln -sf libAksIfdh.so.10.0 libAksIfdh.so.10
-
-    ln -sf ${lib.getLib openssl}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
+    ln -sf ${lib.getLib openssl_1_1}/lib/libcrypto.so $out/lib/libcrypto.so.1.1.0
   '';
 
   dontAutoPatchelf = true;

From 1b0cd6bcdaa4d591b9ccf0de620eafe04544bd83 Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel@dionne-riel.com>
Date: Tue, 7 Mar 2023 00:11:41 -0500
Subject: [PATCH 02/56] grub2: Pull upstream patches for flicker-free boot

---
 pkgs/tools/misc/grub/2.0x.nix | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index b6125b9faf76..f44b3c7a1bcf 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -81,6 +81,30 @@ stdenv.mkDerivation rec {
       url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=000b5cd04fd228f9741f5dca0491636bc0b89eb8";
       sha256 = "sha256-Mex3qQ0lW7ZCv7ZI7MSSqbylJXZ5RTbR4Pv1+CJ0ciM=";
     })
+
+    # Upstreamed patches for flicker-free boot
+    # Remove these patches once a new release is cut
+    (fetchpatch {
+      # term/efi/console: Do not set colorstate until the first text output
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9381dbe045b39bd9395c9ab4276d95b4041ec9fb";
+      sha256 = "sha256-ZFq/PdCYo6aRySZRAfZARO8BmXwGgqeXz+9uNgNJEO8=";
+    })
+    (fetchpatch {
+      # term/efi/console: Do not set cursor until the first text output
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7c316e18301e101e4dcd8abe88c0bed0b1b78857";
+      sha256 = "sha256-WJiK7MqmdStzq77vIDsO60Fu7i9LE/jDYzF4E9FXb7c=";
+    })
+    (fetchpatch {
+      # normal/menu: Don't show "Booting `%s'" msg when auto-booting with TIMEOUT_STYLE_HIDDEN
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5bb4f2b7d665c84bde402d1a528b652a61753380";
+      sha256 = "sha256-lwJPPyq6yj7X1C2RuHfxnwKKstFkWGxcMXuSQqd9Z4I=";
+    })
+    (fetchpatch {
+      # kern/main: Suppress the "Welcome to GRUB!" message in EFI builds
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=3e4cbbeca0ef35097301a1086f85fd0d119e64aa";
+      sha256 = "sha256-cQX4x9V5Y7SU9WACn5FzDjukL2/StAUMMoHY/DRHq+g=";
+    })
+
     (fetchpatch {
       name = "CVE-2021-3981.patch";
       url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0adec29674561034771c13e446069b41ef41e4d4";

From 22d7930c643dad6979e1145feeab734cb4a3e9c8 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 17 Mar 2023 04:20:00 +0000
Subject: [PATCH 03/56] dash: 0.5.11.5 -> 0.5.12

---
 pkgs/shells/dash/default.nix | 28 ++++------------------------
 1 file changed, 4 insertions(+), 24 deletions(-)

diff --git a/pkgs/shells/dash/default.nix b/pkgs/shells/dash/default.nix
index e6113c0d7696..ff4656f6650f 100644
--- a/pkgs/shells/dash/default.nix
+++ b/pkgs/shells/dash/default.nix
@@ -1,10 +1,8 @@
 { lib
 , stdenv
 , buildPackages
-, autoreconfHook
 , pkg-config
 , fetchurl
-, fetchpatch
 , libedit
 , runCommand
 , dash
@@ -12,34 +10,16 @@
 
 stdenv.mkDerivation rec {
   pname = "dash";
-  version = "0.5.11.5";
+  version = "0.5.12";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-23eBEIkfeTeYXym/I0EP4cXWaVAnYPWE5U4OeynhI70=";
+    sha256 = "sha256-akdKxG6LCzKRbExg32lMggWNMpfYs4W3RQgDDKSo8oo=";
   };
 
-  hardeningDisable = [ "format" ];
-
-  patches = [
-    (fetchpatch {
-      # Dash executes code when noexec ("-n") is specified
-      # https://www.openwall.com/lists/oss-security/2020/11/11/3
-      url = "https://git.kernel.org/pub/scm/utils/dash/dash.git/patch/?id=29d6f2148f10213de4e904d515e792d2cf8c968e";
-      sha256 = "0aadb7aaaan6jxmi6icv4p5gqx7k510yszaqsa29b5giyxz5l9i1";
-    })
-
-    # aarch64-darwin fix from upstream; remove on next release
-    (fetchpatch {
-      url = "https://git.kernel.org/pub/scm/utils/dash/dash.git/patch/?id=6f6d1f2da03468c0e131fdcbdcfa9771ffca2614";
-      sha256 = "16iz2ylkyhpxqq411ns8pjk8rizh6afhavvsf052wvzsnmmlvfbw";
-    })
-  ];
-
   strictDeps = true;
-  # configure.ac patched; remove on next release
-  nativeBuildInputs = [ autoreconfHook ]
-    ++ lib.optionals stdenv.hostPlatform.isStatic [ pkg-config ];
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isStatic [ pkg-config ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = [ libedit ];

From c3ab41d59273e5c4283213c745ffdbe09f6f974c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Mar 2023 15:38:56 +0000
Subject: [PATCH 04/56] armadillo: 11.4.3 -> 12.0.1

---
 pkgs/development/libraries/armadillo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index d3bee03c5e19..bd147fffc99d 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "11.4.3";
+  version = "12.0.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-h2AyY2ZJiK9B2iyk82IF426kepKB+mz9RjEV83l6HaI=";
+    sha256 = "sha256-IwpcddqtUtxH4a3Oj1pQ+apOQ1Tg8bsY6oTvoucOIN8=";
   };
 
   nativeBuildInputs = [ cmake ];

From 8da60f204ffc26b6ac59b39568071fa4e3276412 Mon Sep 17 00:00:00 2001
From: midchildan <git@midchildan.org>
Date: Tue, 21 Mar 2023 21:05:38 +0900
Subject: [PATCH 05/56] syncthing: apply autoSignDarwinBinariesHook

Somewhere between macOS 13.0.1 and 13.2.1, launchd started rejecting
binaries that aren't signed in Launch Agents/Daemons. This is the case
even on x86 devices, which has a more lax code signing policy compared
to Apple Silicon. This change signs Syncthing binaries so that it can be
auto-started at login by launchd.
---
 .../networking/syncthing/default.nix          | 20 ++++++++++++++++++-
 pkgs/top-level/all-packages.nix               |  1 +
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 952851b08dba..0ddf1fc8f9cc 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -1,4 +1,13 @@
-{ pkgsBuildBuild, go, buildGoModule, stdenv, lib, procps, fetchFromGitHub, nixosTests }:
+{ pkgsBuildBuild
+, go
+, buildGoModule
+, stdenv
+, lib
+, procps
+, fetchFromGitHub
+, nixosTests
+, autoSignDarwinBinariesHook
+}:
 
 let
   common = { stname, target, postInstall ? "" }:
@@ -15,6 +24,15 @@ let
 
       vendorHash = "sha256-5NgflkRXkbWiIkASmxIgWliE8sF89HtlMtlIF+5u6Ic=";
 
+      nativeBuildInputs = lib.optionals stdenv.isDarwin [
+        # Recent versions of macOS seem to require binaries to be signed when
+        # run from Launch Agents/Daemons, even on x86 devices where it has a
+        # more lax code signing policy compared to Apple Silicon. So just sign
+        # the binaries on both architectures to make it possible for launchd to
+        # auto-start Syncthing at login.
+        autoSignDarwinBinariesHook
+      ];
+
       doCheck = false;
 
       BUILD_USER = "nix";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 633b100887ab..e768a67217c5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -33598,6 +33598,7 @@ with pkgs;
   syncterm = callPackage ../applications/terminal-emulators/syncterm { };
 
   inherit (callPackages ../applications/networking/syncthing {
+    inherit (darwin) autoSignDarwinBinariesHook;
     buildGoModule = buildGo119Module; # go 1.20 build failure
    })
     syncthing

From 14a55e86420ee9a5ed75949edc66d063bc6bceec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 21 Mar 2023 22:46:15 +0100
Subject: [PATCH 06/56] via: 2.1.0 -> 3.0.0

---
 pkgs/tools/misc/via/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/via/default.nix b/pkgs/tools/misc/via/default.nix
index 4d1783b53acc..5fd808cd1d81 100644
--- a/pkgs/tools/misc/via/default.nix
+++ b/pkgs/tools/misc/via/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "via";
-  version = "2.1.0";
+  version = "3.0.0";
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/the-via/releases/releases/download/v${version}/via-${version}-linux.AppImage";
     name = "via-${version}-linux.AppImage";
-    sha256 = "sha256-eVmaVD3W+ZEw3HkuZWKsd9XYhASP5+dxzVW64fOhqwk=";
+    sha256 = "sha256-+uTvmrqHK7L5VA/lUHCZZeRYPUrcVA+vjG7venxuHhs=";
   };
   appimageContents = appimageTools.extractType2 { inherit name src; };
 in

From c4b7a1439f905090faf0173d7288925e076bbc11 Mon Sep 17 00:00:00 2001
From: Jona Enzinger <jona_enzinger@outlook.com>
Date: Fri, 24 Feb 2023 15:48:47 +0100
Subject: [PATCH 07/56] microsoft-edge: 107.0.1418.52 -> 111.0.1661.44

---
 .../browsers/microsoft-edge/browser.nix       |  7 -------
 .../browsers/microsoft-edge/default.nix       | 20 +++++++++----------
 2 files changed, 10 insertions(+), 17 deletions(-)

diff --git a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
index 685bd7e42ac8..a2eda0dc3c17 100644
--- a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
@@ -94,9 +94,6 @@ stdenv.mkDerivation rec {
       libGLESv2 = lib.makeLibraryPath [
         xorg.libX11 xorg.libXext xorg.libxcb wayland
       ];
-      libsmartscreen = lib.makeLibraryPath [
-        libuuid stdenv.cc.cc.lib
-      ];
       libsmartscreenn = lib.makeLibraryPath [
         libuuid
       ];
@@ -131,10 +128,6 @@ stdenv.mkDerivation rec {
       --set-rpath "${libPath.libGLESv2}" \
       opt/microsoft/${shortName}/libGLESv2.so
 
-    patchelf \
-      --set-rpath "${libPath.libsmartscreen}" \
-      opt/microsoft/${shortName}/libsmartscreen.so
-
     patchelf \
       --set-rpath "${libPath.libsmartscreenn}" \
       opt/microsoft/${shortName}/libsmartscreenn.so
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/default.nix b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
index 7a9e69421495..c60a867055ca 100644
--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@@ -1,20 +1,20 @@
 {
+  stable = import ./browser.nix {
+    channel = "stable";
+    version = "111.0.1661.44";
+    revision = "1";
+    sha256 = "sha256-ePViYQZUteMBkV7AkvsoQwPVxibMB68LDWgg7d82iIE=";
+  };
   beta = import ./browser.nix {
     channel = "beta";
-    version = "108.0.1462.20";
+    version = "112.0.1722.15";
     revision = "1";
-    sha256 = "sha256:0dfmzjfy4y07pqifyzv3rc8dbmxz8rr3v2idanla7jrks0pghcxm";
+    sha256 = "sha256-Ba6f5MOBTtY8bUxCcMySQCWqDvOiI1hLnuwcIspReq8=";
   };
   dev = import ./browser.nix {
     channel = "dev";
-    version = "109.0.1495.2";
+    version = "113.0.1741.1";
     revision = "1";
-    sha256 = "sha256:1bk7dx3mf020ahzmvr9cdgcn72rjrn2420j9g362vwcl1khyxciw";
-  };
-  stable = import ./browser.nix {
-    channel = "stable";
-    version = "107.0.1418.52";
-    revision = "1";
-    sha256 = "sha256:1k3c5r9lq3vpc190bzs5fn944bi3af6wjxzwcliy4wzzrb5g0day";
+    sha256 = "sha256-1d92bQAoiTkqWgiWdUBn3VKBYCRP1KCvPiu7cQTFVio=";
   };
 }

From 91c2c00aad7d60baa0de4d20edc203615a539ba5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Mar 2023 12:07:12 +0000
Subject: [PATCH 08/56] sumo: 1.15.0 -> 1.16.0

---
 pkgs/applications/science/networking/sumo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/networking/sumo/default.nix b/pkgs/applications/science/networking/sumo/default.nix
index 6fda53161dd3..b48ea98387d8 100644
--- a/pkgs/applications/science/networking/sumo/default.nix
+++ b/pkgs/applications/science/networking/sumo/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sumo";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "eclipse";
     repo = "sumo";
     rev = "v${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "sha256-Mm8Kqb5W9h2jYvRGypI6v5IHDm4CnAeT+NcJybdU5K0=";
+    sha256 = "sha256-0aUm7sgBLTPNSJuH6/xsTDZKUzAI87wPI2G3WSi5SGA=";
     fetchSubmodules = true;
   };
 

From 1d31b69cddb893e18a76908f9e57b39f344113d4 Mon Sep 17 00:00:00 2001
From: Daniel Goertzen <daniel.goertzen@gmail.com>
Date: Wed, 22 Mar 2023 12:43:07 -0500
Subject: [PATCH 09/56] linux-kernels/linuxConfig: add kernelPatches

Kernel patches may contain new Kconfig elements
so they should be applied to src before generating
a config.
---
 pkgs/top-level/linux-kernels.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index fa83d6c925fc..6b8a14f921e2 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -630,6 +630,7 @@ in {
   # Derive one of the default .config files
   linuxConfig = {
     src,
+    kernelPatches ? [],
     version ? (builtins.parseDrvName src.name).version,
     makeTarget ? "defconfig",
     name ? "kernel.config",
@@ -637,6 +638,7 @@ in {
     inherit name src;
     depsBuildBuild = [ buildPackages.stdenv.cc ]
       ++ lib.optionals (lib.versionAtLeast version "4.16") [ buildPackages.bison buildPackages.flex ];
+    patches = map (p: p.patch) kernelPatches;  # Patches may include new configs.
     postPatch = ''
       patchShebangs scripts/
     '';

From 3dade082a18fbd36b3ba85b398bab1dcb8cac41b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 23 Mar 2023 05:35:15 +0000
Subject: [PATCH 10/56] exodus: 22.8.12 -> 23.3.13

---
 pkgs/applications/blockchains/exodus/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/blockchains/exodus/default.nix b/pkgs/applications/blockchains/exodus/default.nix
index 1bc33588c42d..709e20f476b2 100644
--- a/pkgs/applications/blockchains/exodus/default.nix
+++ b/pkgs/applications/blockchains/exodus/default.nix
@@ -4,11 +4,11 @@ cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core, libxkbcommon, mesa }:
 
 stdenv.mkDerivation rec {
   pname = "exodus";
-  version = "22.8.12";
+  version = "23.3.13";
 
   src = fetchzip {
     url = "https://downloads.exodus.com/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "sha256-jNzHh4zYhFzpFZAC9rHmwjTdFkbpROSEN3qpL7geiOU=";
+    sha256 = "sha256-/xCDtR3V++LaZZWTaNpeD3YuP5ZM5BChB1CUBH/xNcU=";
   };
 
   installPhase = ''

From ba783d488784ae1ad28a821aedf33015931874c0 Mon Sep 17 00:00:00 2001
From: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>
Date: Wed, 15 Mar 2023 11:33:36 +0100
Subject: [PATCH 11/56] protonmail-bridge: 3.0.18 -> 3.0.21

Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>
---
 pkgs/applications/networking/protonmail-bridge/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/protonmail-bridge/default.nix b/pkgs/applications/networking/protonmail-bridge/default.nix
index 5dc7779e12e9..d02bf7ec1fe2 100644
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protonmail-bridge";
-  version = "3.0.18";
+  version = "3.0.21";
 
   src = fetchFromGitHub {
     owner = "ProtonMail";
     repo = "proton-bridge";
     rev = "v${version}";
-    hash = "sha256-0gQnMhjwW2NEJwafqndStQ33dIu82lW6ntXFRCpbmm4=";
+    hash = "sha256-aRzVXmAWRifIGCAPWYciBhK9XMvsmtHc67XRoI19VYU=";
   };
 
-  vendorHash = "sha256-lHMcVcaoBwjE2ikEZPeZexC5XvhkAtvHnDci7UAa4vg=";
+  vendorHash = "sha256-zCE4LO6m4uyOvSzhUbzH2F9EgDs0UZH4eCl6lfRjIRQ=";
 
   nativeBuildInputs = [ pkg-config ];
 

From f50a1657dede88134b9289651d81d4c54b9c1d25 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 24 Mar 2023 21:23:07 +0000
Subject: [PATCH 12/56] vips: 8.14.1 -> 8.14.2

---
 pkgs/tools/graphics/vips/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/vips/default.nix b/pkgs/tools/graphics/vips/default.nix
index db44108112f3..9c4099783e0c 100644
--- a/pkgs/tools/graphics/vips/default.nix
+++ b/pkgs/tools/graphics/vips/default.nix
@@ -39,7 +39,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vips";
-  version = "8.14.1";
+  version = "8.14.2";
 
   outputs = [ "bin" "out" "man" "dev" ] ++ lib.optionals (!stdenv.isDarwin) [ "devdoc" ];
 
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     owner = "libvips";
     repo = "libvips";
     rev = "v${version}";
-    hash = "sha256-ajGVSVjnv78S/Xd3Aqn0N87I7m39DWKZHAQjwbog+5U=";
+    hash = "sha256-QUWZ11t2JEJBdpNuIY2uRiSL/hffRbV0SV5HowxWaME=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''

From 50e860b91ebcdbc71b94f3ceeb7542e28ae12d29 Mon Sep 17 00:00:00 2001
From: Lijun Chen <chenlijun1999@gmail.com>
Date: Sat, 25 Mar 2023 10:28:01 +0100
Subject: [PATCH 13/56] xdg-desktop-portal-kde: fix missing runtime dependency

`plasma-workspace` is required when `xdg-desktop-portal-kde` needs to
open an application picker to let the user pick the application to use to
open a certain file (when no existing default is available).
If `plasma-workspace` is not available the `xdg-desktop-portal-kde` service
logs an error and nothing else happens (the application picker is not opened).

See https://github.com/NixOS/nixpkgs/issues/160923#issuecomment-1474989176
---
 pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix b/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
index dc5728791b60..5fa1a17c4240 100644
--- a/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
+++ b/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
@@ -19,6 +19,7 @@
 , kdeclarative
 , plasma-framework
 , plasma-wayland-protocols
+, plasma-workspace
 , kio
 , qtbase
 }:
@@ -45,5 +46,6 @@ mkDerivation {
     kdeclarative
     plasma-framework
     plasma-wayland-protocols
+    plasma-workspace
   ];
 }

From 56376c515a7bb0d1b7f42ff69ab006f87458de8b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Mar 2023 08:52:24 +0000
Subject: [PATCH 14/56] redpanda: 23.1.1 -> 23.1.3

---
 pkgs/servers/redpanda/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/redpanda/default.nix b/pkgs/servers/redpanda/default.nix
index fde3454dd310..ef8335c56ccc 100644
--- a/pkgs/servers/redpanda/default.nix
+++ b/pkgs/servers/redpanda/default.nix
@@ -7,12 +7,12 @@
 , stdenv
 }:
 let
-  version = "23.1.1";
+  version = "23.1.3";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-3IRhr+XQLZXCeKhUHOlE8REwUkxLw1jcHYIataG3BaM=";
+    sha256 = "sha256-tqQl7Elslcdw0hNjayYShj19KYmVskJG0qtaijGTzm0=";
   };
   server = callPackage ./server.nix { inherit src version; };
 in

From 0da407258286793d3c1189b2b0ef496063acac4d Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Tue, 28 Feb 2023 15:28:42 +0000
Subject: [PATCH 15/56] llvmPackages_git.llvm: run the tests on macOS

Port of c7231c0b6d8 ("llvmPackages_15.llvm: run the tests on macOS").

The sysctl native check input was taken from
6d0c87602fe ("llvmPackages_15.llvm: add in a missing check dep"),
because it looks like it was supposed to be part of c7231c0b6d8
instead.
---
 .../compilers/llvm/git/llvm/default.nix       | 69 ++++++++++++----
 ...-script-runner-set-dyld-library-path.patch | 26 ++++++
 .../llvm-lit-cfg-add-libs-to-dylib-path.patch | 79 +++++++++++++++++++
 ...polly-lit-cfg-add-libs-to-dylib-path.patch | 24 ++++++
 4 files changed, 181 insertions(+), 17 deletions(-)
 create mode 100644 pkgs/development/compilers/llvm/git/llvm/lit-shell-script-runner-set-dyld-library-path.patch
 create mode 100644 pkgs/development/compilers/llvm/git/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
 create mode 100644 pkgs/development/compilers/llvm/git/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch

diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 1daeb745e588..d944ee949fd9 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -16,9 +16,10 @@
 , release_version
 , zlib
 , which
+, sysctl
 , buildLlvmTools
 , debugVersion ? false
-, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
   && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
@@ -85,11 +86,59 @@ in stdenv.mkDerivation (rec {
 
   propagatedBuildInputs = [ ncurses zlib ];
 
-  nativeCheckInputs = [ which ];
+  nativeCheckInputs = [
+    which
+  ] ++ lib.optional stdenv.isDarwin sysctl;
 
   patches = [
     ./gnu-install-dirs.patch
-  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
+
+    # Running the tests involves invoking binaries (like `opt`) that depend on
+    # the LLVM dylibs and reference them by absolute install path (i.e. their
+    # nix store path).
+    #
+    # Because we have not yet run the install phase (we're running these tests
+    # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+    # paths do not exist yet; to work around this we point the loader (`ld` on
+    # unix, `dyld` on macOS) at the `lib` directory which will later become this
+    # package's `lib` output.
+    #
+    # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+    # dir but:
+    #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+    #     `DYLD_LIBRARY_PATH` (macOS):
+    #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+    #   - even if `lit` forwarded this env var, we actually cannot set
+    #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+    #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+    #     "protected processes" (i.e. the python interpreter that runs `lit`):
+    #     https://stackoverflow.com/a/35570229
+    #   - other LLVM subprojects deal with this issue by having their `lit`
+    #     configuration set these env vars for us; it makes sense to do the same
+    #     for LLVM:
+    #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+    #
+    # !!! TODO: look into upstreaming this patch
+    ./llvm-lit-cfg-add-libs-to-dylib-path.patch
+
+    # `lit` has a mode where it executes run lines as a shell script which is
+    # constructs; this is problematic for macOS because it means that there's
+    # another process in between `lit` and the binaries being tested. As noted
+    # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+    # tests fail with dyld errors.
+    #
+    # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+    # present in the test configuration.
+    #
+    # It's not clear to me why this isn't an issue for LLVM developers running
+    # on macOS (nothing about this _seems_ nix specific)..
+    ./lit-shell-script-runner-set-dyld-library-path.patch
+  ] ++ lib.optionals enablePolly [
+    ./gnu-install-dirs-polly.patch
+
+    # Just like the `llvm-lit-cfg` patch, but for `polly`.
+    ./polly-lit-cfg-add-libs-to-dylib-path.patch
+  ];
 
   postPatch = optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
@@ -134,12 +183,6 @@ in stdenv.mkDerivation (rec {
     )
   '';
 
-  # hacky fix: created binaries need to be run before installation
-  preBuild = ''
-    mkdir -p $out/
-    ln -sv $PWD/lib $out
-  '';
-
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
@@ -216,14 +259,6 @@ in stdenv.mkDerivation (rec {
     )
   ];
 
-  postBuild = ''
-    rm -fR $out
-  '';
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
-  '';
-
   postInstall = ''
     mkdir -p $python/share
     mv $out/share/opt-viewer $python/share/opt-viewer
diff --git a/pkgs/development/compilers/llvm/git/llvm/lit-shell-script-runner-set-dyld-library-path.patch b/pkgs/development/compilers/llvm/git/llvm/lit-shell-script-runner-set-dyld-library-path.patch
new file mode 100644
index 000000000000..32f1d13a9dc2
--- /dev/null
+++ b/pkgs/development/compilers/llvm/git/llvm/lit-shell-script-runner-set-dyld-library-path.patch
@@ -0,0 +1,26 @@
+diff --git a/utils/lit/lit/TestRunner.py b/utils/lit/lit/TestRunner.py
+index 0242e0b75af3..d732011306f7 100644
+--- a/utils/lit/lit/TestRunner.py
++++ b/utils/lit/lit/TestRunner.py
+@@ -1029,6 +1029,12 @@ def executeScript(test, litConfig, tmpBase, commands, cwd):
+             f.write('@echo off\n')
+         f.write('\n@if %ERRORLEVEL% NEQ 0 EXIT\n'.join(commands))
+     else:
++        # This env var is *purged* when invoking subprocesses so we have to
++        # manually set it from within the bash script in order for the commands
++        # in run lines to see this var:
++        if "DYLD_LIBRARY_PATH" in test.config.environment:
++            f.write(f'export DYLD_LIBRARY_PATH="{test.config.environment["DYLD_LIBRARY_PATH"]}"\n')
++
+         for i, ln in enumerate(commands):
+             match = re.match(kPdbgRegex, ln)
+             if match:
+@@ -1363,7 +1369,7 @@ def applySubstitutions(script, substitutions, conditions={},
+         return processed
+ 
+     process = processLine if recursion_limit is None else processLineToFixedPoint
+-    
++
+     return [unescapePercents(process(ln)) for ln in script]
+ 
+ 
diff --git a/pkgs/development/compilers/llvm/git/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch b/pkgs/development/compilers/llvm/git/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
new file mode 100644
index 000000000000..d824516c0a16
--- /dev/null
+++ b/pkgs/development/compilers/llvm/git/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
@@ -0,0 +1,79 @@
+diff --git a/test/Unit/lit.cfg.py b/test/Unit/lit.cfg.py
+index 81e8dc04acea..479ff95681e2 100644
+--- a/test/Unit/lit.cfg.py
++++ b/test/Unit/lit.cfg.py
+@@ -3,6 +3,7 @@
+ # Configuration file for the 'lit' test runner.
+ 
+ import os
++import platform
+ import subprocess
+ 
+ import lit.formats
+@@ -55,3 +56,26 @@ if sys.platform in ['win32', 'cygwin'] and os.path.isdir(config.shlibdir):
+ # Win32 may use %SYSTEMDRIVE% during file system shell operations, so propogate.
+ if sys.platform == 'win32' and 'SYSTEMDRIVE' in os.environ:
+     config.environment['SYSTEMDRIVE'] = os.environ['SYSTEMDRIVE']
++
++# Add the LLVM dynamic libs to the platform-specific loader search path env var:
++#
++# TODO: this is copied from `clang`'s `lit.cfg.py`; should unify..
++def find_shlibpath_var():
++    if platform.system() in ['Linux', 'FreeBSD', 'NetBSD', 'OpenBSD', 'SunOS']:
++        yield 'LD_LIBRARY_PATH'
++    elif platform.system() == 'Darwin':
++        yield 'DYLD_LIBRARY_PATH'
++    elif platform.system() == 'Windows':
++        yield 'PATH'
++    elif platform.system() == 'AIX':
++        yield 'LIBPATH'
++
++for shlibpath_var in find_shlibpath_var():
++    shlibpath = os.path.pathsep.join(
++        (config.shlibdir,
++         config.environment.get(shlibpath_var, '')))
++    config.environment[shlibpath_var] = shlibpath
++    break
++else:
++    lit_config.warning("unable to inject shared library path on '{}'"
++                       .format(platform.system()))
+diff --git a/test/lit.cfg.py b/test/lit.cfg.py
+index 75a38b4c5dad..856fc75c9d74 100644
+--- a/test/lit.cfg.py
++++ b/test/lit.cfg.py
+@@ -42,6 +42,26 @@ llvm_config.with_environment('PATH', config.llvm_tools_dir, append_path=True)
+ llvm_config.with_system_environment(
+     ['HOME', 'INCLUDE', 'LIB', 'TMP', 'TEMP'])
+ 
++# Add the LLVM dynamic libs to the platform-specific loader search path env var:
++#
++# TODO: this is copied from `clang`'s `lit.cfg.py`; should unify..
++def find_shlibpath_var():
++    if platform.system() in ['Linux', 'FreeBSD', 'NetBSD', 'OpenBSD', 'SunOS']:
++        yield 'LD_LIBRARY_PATH'
++    elif platform.system() == 'Darwin':
++        yield 'DYLD_LIBRARY_PATH'
++    elif platform.system() == 'Windows':
++        yield 'PATH'
++    elif platform.system() == 'AIX':
++        yield 'LIBPATH'
++
++for shlibpath_var in find_shlibpath_var():
++    shlibpath = config.llvm_shlib_dir
++    llvm_config.with_environment(shlibpath_var, shlibpath, append_path = True)
++    break
++else:
++    lit_config.warning("unable to inject shared library path on '{}'"
++                       .format(platform.system()))
+ 
+ # Set up OCAMLPATH to include newly built OCaml libraries.
+ top_ocaml_lib = os.path.join(config.llvm_lib_dir, 'ocaml')
+@@ -318,7 +338,7 @@ def have_cxx_shared_library():
+ 
+     try:
+         readobj_cmd = subprocess.Popen(
+-            [readobj_exe, '--needed-libs', readobj_exe], stdout=subprocess.PIPE)
++            [readobj_exe, '--needed-libs', readobj_exe], stdout=subprocess.PIPE, env=config.environment)
+     except OSError:
+         print('could not exec llvm-readobj')
+         return False
diff --git a/pkgs/development/compilers/llvm/git/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch b/pkgs/development/compilers/llvm/git/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
new file mode 100644
index 000000000000..1354ad267314
--- /dev/null
+++ b/pkgs/development/compilers/llvm/git/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
@@ -0,0 +1,24 @@
+diff --git a/tools/polly/test/lit.cfg b/tools/polly/test/lit.cfg
+index 41e3a589c61e..09f3b17498b0 100644
+--- a/tools/polly/test/lit.cfg
++++ b/tools/polly/test/lit.cfg
+@@ -36,9 +36,17 @@ base_paths = [config.llvm_tools_dir, config.environment['PATH']]
+ path = os.path.pathsep.join(base_paths + config.extra_paths)
+ config.environment['PATH'] = path
+ 
++# (Copied from polly/test/Unit/lit.cfg)
++if platform.system() == 'Darwin':
++    shlibpath_var = 'DYLD_LIBRARY_PATH'
++elif platform.system() == 'Windows':
++    shlibpath_var = 'PATH'
++else:
++    shlibpath_var = 'LD_LIBRARY_PATH'
++
+ path = os.path.pathsep.join((config.llvm_libs_dir,
+-                              config.environment.get('LD_LIBRARY_PATH','')))
+-config.environment['LD_LIBRARY_PATH'] = path
++                              config.environment.get(shlibpath_var,'')))
++config.environment[shlibpath_var] = path
+ 
+ llvm_config.use_default_substitutions()
+ 

From 422b0ff93b3d72b366f7473766dbbbd0fa665e47 Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Sun, 29 Jan 2023 14:42:38 +0100
Subject: [PATCH 16/56] steam: use writeShellScript

---
 pkgs/games/steam/fhsenv.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index c50176dce790..246f59cb24b5 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, writeScript, buildFHSUserEnv, steam, glxinfo-i686, runtimeShell
+{ lib, stdenv, writeShellScript, buildFHSUserEnv, steam, glxinfo-i686
 , steam-runtime-wrapped, steam-runtime-wrapped-i686 ? null
 , extraPkgs ? pkgs: [ ] # extra packages to add to targetPkgs
 , extraLibraries ? pkgs: [ ] # extra packages to add to multiPkgs
@@ -228,8 +228,7 @@ in buildFHSUserEnv rec {
     export SDL_JOYSTICK_DISABLE_UDEV=1
   '' + extraProfile;
 
-  runScript = writeScript "steam-wrapper.sh" ''
-    #!${runtimeShell}
+  runScript = writeShellScript "steam-wrapper.sh" ''
     if [ -f /host/etc/NIXOS ]; then   # Check only useful on NixOS
       ${glxinfo-i686}/bin/glxinfo >/dev/null 2>&1
       # If there was an error running glxinfo, we know something is wrong with the configuration
@@ -272,8 +271,7 @@ in buildFHSUserEnv rec {
     inherit multiPkgs profile extraInstallCommands;
     inherit unshareIpc unsharePid;
 
-    runScript = writeScript "steam-run" ''
-      #!${runtimeShell}
+    runScript = writeShellScript "steam-run" ''
       run="$1"
       if [ "$run" = "" ]; then
         echo "Usage: steam-run command-to-run args..." >&2

From 192c3ecd4bcc317c3d8868d3c944a75de0dee32e Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Tue, 7 Mar 2023 20:35:30 +0100
Subject: [PATCH 17/56] buildFHSEnvBubblewrap: allow deeper introspection via
 passthru

---
 .../{env.nix => buildFHSEnv.nix}                      |  6 +++++-
 .../build-fhs-userenv-bubblewrap/default.nix          | 11 ++++++-----
 2 files changed, 11 insertions(+), 6 deletions(-)
 rename pkgs/build-support/build-fhs-userenv-bubblewrap/{env.nix => buildFHSEnv.nix} (98%)

diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/buildFHSEnv.nix
similarity index 98%
rename from pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
rename to pkgs/build-support/build-fhs-userenv-bubblewrap/buildFHSEnv.nix
index c4d967a11c69..0d98c0a2bc64 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/buildFHSEnv.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, buildEnv, writeText, writeShellScriptBin, pkgs, pkgsi686Linux }:
 
-{ name, profile ? ""
+args@{ name, profile ? ""
 , targetPkgs ? pkgs: [], multiPkgs ? pkgs: []
 , extraBuildCommands ? "", extraBuildCommandsMulti ? ""
 , extraOutputsToInstall ? []
@@ -216,4 +216,8 @@ in stdenv.mkDerivation {
   '';
   preferLocalBuild = true;
   allowSubstitutes = false;
+
+  passthru = {
+    inherit args multiPaths targetPaths;
+  };
 }
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
index 76e68573faa8..290ad35c0640 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -19,9 +19,9 @@ args @ {
 
 with builtins;
 let
-  buildFHSEnv = callPackage ./env.nix { };
+  buildFHSEnv = callPackage ./buildFHSEnv.nix { };
 
-  env = buildFHSEnv (removeAttrs args [
+  fhsenv = buildFHSEnv (removeAttrs args [
     "runScript" "extraInstallCommands" "meta" "passthru" "extraBwrapArgs" "dieWithParent"
     "unshareUser" "unshareCgroup" "unshareUts" "unshareNet" "unsharePid" "unshareIpc"
   ]);
@@ -102,7 +102,7 @@ let
     ro_mounts=()
     symlinks=()
     etc_ignored=()
-    for i in ${env}/*; do
+    for i in ${fhsenv}/*; do
       path="/''${i##*/}"
       if [[ $path == '/etc' ]]; then
         :
@@ -115,8 +115,8 @@ let
       fi
     done
 
-    if [[ -d ${env}/etc ]]; then
-      for i in ${env}/etc/*; do
+    if [[ -d ${fhsenv}/etc ]]; then
+      for i in ${fhsenv}/etc/*; do
         path="/''${i##*/}"
         # NOTE: we're binding /etc/fonts and /etc/ssl/certs from the host so we
         # don't want to override it with a path from the FHS environment.
@@ -215,6 +215,7 @@ in runCommandLocal name {
       echo >&2 ""
       exit 1
     '';
+    inherit args fhsenv;
   };
 } ''
   mkdir -p $out/bin

From 473159871236e584af08386ed408aef30102395c Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Tue, 7 Mar 2023 20:24:28 +0100
Subject: [PATCH 18/56] nixos/steam: always apply extraLibraries and make them
 additive

Before, setting {option}`programs.steam.package` would result in a steam without
the {option}`hardware.opengl.package`, {option}`hardware.opengl.extraPackages`
etc. You had to manually add them yourself.

Additionally, overlaying `steam = prev.steam.override { extraLibraries = [ ... ]; }`
resulted in those extra libraries not actually being put into the fhsenv because
they'd be fully overridden by the option's default.

Now, the user can supply a custom steam to {option}`programs.steam.package` with
its own list of extraLibraries which will not be overridden and overlays work as
expected too.
---
 nixos/modules/programs/steam.nix | 34 ++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/nixos/modules/programs/steam.nix b/nixos/modules/programs/steam.nix
index 98269f6250db..6935ac93bf74 100644
--- a/nixos/modules/programs/steam.nix
+++ b/nixos/modules/programs/steam.nix
@@ -9,23 +9,31 @@ in {
     enable = mkEnableOption (lib.mdDoc "steam");
 
     package = mkOption {
-      type        = types.package;
-      default     = pkgs.steam.override {
-        extraLibraries = pkgs: with config.hardware.opengl;
-          if pkgs.stdenv.hostPlatform.is64bit
-          then [ package ] ++ extraPackages
-          else [ package32 ] ++ extraPackages32;
-      };
-      defaultText = literalExpression ''
-        pkgs.steam.override {
-          extraLibraries = pkgs: with config.hardware.opengl;
+      type = types.package;
+      default = pkgs.steam;
+      defaultText = literalExpression "pkgs.steam";
+      example = literalExpression ''
+        pkgs.steam-small.override {
+          extraLibraries = with pkgs; [
+            atk
+          ];
+        }
+      '';
+      apply = steam: steam.override (prev: {
+        extraLibraries = pkgs: let
+          prevLibs = if prev ? extraLibraries then prev.extraLibraries pkgs else [ ];
+          additionalLibs = with config.hardware.opengl;
             if pkgs.stdenv.hostPlatform.is64bit
             then [ package ] ++ extraPackages
             else [ package32 ] ++ extraPackages32;
-        }
-      '';
+        in prevLibs ++ additionalLibs;
+      });
       description = lib.mdDoc ''
-        steam package to use.
+        The Steam package to use. Additional libraries are added from the system
+        configuration to ensure graphics work properly.
+
+        Use this option to customise the Steam package rather than adding your
+        custom Steam to {option}`environment.systemPackages` yourself.
       '';
     };
 

From 1f27e0b77a63fd243ab40dfce22edf106424faea Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Sun, 29 Jan 2023 14:56:57 +0100
Subject: [PATCH 19/56] steam: add extraEnv option

---
 nixos/modules/programs/steam.nix | 7 ++++++-
 pkgs/games/steam/fhsenv.nix      | 9 +++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/programs/steam.nix b/nixos/modules/programs/steam.nix
index 6935ac93bf74..fc63f0f187e8 100644
--- a/nixos/modules/programs/steam.nix
+++ b/nixos/modules/programs/steam.nix
@@ -14,7 +14,12 @@ in {
       defaultText = literalExpression "pkgs.steam";
       example = literalExpression ''
         pkgs.steam-small.override {
-          extraLibraries = with pkgs; [
+          extraEnv = {
+            MANGOHUD = true;
+            OBS_VKCAPTURE = true;
+            RADV_TEX_ANISO = 16;
+          };
+          extraLibraries = p: with p; [
             atk
           ];
         }
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index 246f59cb24b5..8d461104eaac 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -4,6 +4,7 @@
 , extraLibraries ? pkgs: [ ] # extra packages to add to multiPkgs
 , extraProfile ? "" # string to append to profile
 , extraArgs ? "" # arguments to always pass to steam
+, extraEnv ? { } # Environment variables to pass to Steam
 , withGameSpecificLibraries ? true # exclude game specific libraries
 }:
 
@@ -52,6 +53,8 @@ let
     fi
   '';
 
+  envScript = lib.toShellVars extraEnv;
+
 in buildFHSUserEnv rec {
   name = "steam";
 
@@ -248,6 +251,9 @@ in buildFHSUserEnv rec {
 
     ${exportLDPath}
     ${fixBootstrap}
+
+    set -o allexport # Export the following env vars
+    ${envScript}
     exec steam ${extraArgs} "$@"
   '';
 
@@ -281,6 +287,9 @@ in buildFHSUserEnv rec {
 
       ${exportLDPath}
       ${fixBootstrap}
+
+      set -o allexport # Export the following env vars
+      ${envScript}
       exec -- "$run" "$@"
     '';
 

From 3f9a9ad9f27bb6c82485cee964da4b05def00f78 Mon Sep 17 00:00:00 2001
From: Rahul Butani <rrbutani@users.noreply.github.com>
Date: Sun, 8 Jan 2023 04:31:14 -0800
Subject: [PATCH 20/56] llvmPackages_git.llvm: adjust a path, skip an xfail
 test on darwin

Port of 0ee52512f0fd4f5b675ba9f742a300b50adf27d3 ("llvmPackages_15.llvm:
adjust a path, skip an xfail test on darwin")
---
 pkgs/development/compilers/llvm/git/llvm/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index d944ee949fd9..4f0e68dc7b5f 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -4,6 +4,7 @@
 , runCommand
 , fetchpatch
 , cmake
+, darwin
 , ninja
 , python3
 , libffi
@@ -144,6 +145,14 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
+    # As of LLVM 15, marked as XFAIL on arm64 macOS but lit doesn't seem to pick
+    # this up: https://github.com/llvm/llvm-project/blob/c344d97a125b18f8fed0a64aace73c49a870e079/llvm/test/MC/ELF/cfi-version.ll#L7
+    rm test/MC/ELF/cfi-version.ll
+
+    # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
+    # thus fails under the sandbox:
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \

From ff75d77c5d6803123568981d0413606f58252a53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 26 Mar 2023 23:58:05 +0200
Subject: [PATCH 21/56] golangci-lint: 1.52.1 -> 1.52.2

Diff: https://github.com/golangci/golangci-lint/compare/v1.52.1...v1.52.2
---
 pkgs/development/tools/golangci-lint/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index 0f0c486ee617..30529f03ffdb 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.52.1";
+  version = "1.52.2";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-Du0u31P2Ay4MVLmgrQmbAstmczuIy+ONIUAUEbbK+j4=";
+    hash = "sha256-FmNXjOMDDdGxMQvy5f1NoaqrKFpmlPWclXooMxXP8zg=";
   };
 
-  vendorHash = "sha256-N20AJaREqmvCey5P0YuUd3l/5xRzrIG+mPOiVHOUFWc=";
+  vendorHash = "sha256-BhD3a0LNc3hpiH4QC8FpmNn3swx3to8+6gfcgZT8TLg=";
 
   subPackages = [ "cmd/golangci-lint" ];
 

From 855b6e2ad0e08fa92956f3f9f7de0a5fc5c794ee Mon Sep 17 00:00:00 2001
From: toonn <toonn@toonn.io>
Date: Mon, 27 Mar 2023 13:28:46 +0200
Subject: [PATCH 22/56] nim-unwrapped: Add missing Security framework
 buildInput

---
 pkgs/development/compilers/nim/default.nix | 5 +++--
 pkgs/top-level/all-packages.nix            | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
index 318a7ac34052..5518eb64bbd8 100644
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@@ -3,7 +3,7 @@
 
 { lib, callPackage, buildPackages, stdenv, fetchurl, fetchgit, fetchFromGitHub
 , makeWrapper, openssl, pcre, readline, boehmgc, sqlite, nim-unwrapped
-, nimble-unwrapped }:
+, nimble-unwrapped, Security }:
 
 let
   parseCpu = platform:
@@ -94,7 +94,8 @@ in {
       hash = "sha256-rO8LCrdzYE1Nc5S2hRntt0+zD0aRIpSyi8J+DHtLTcI=";
     };
 
-    buildInputs = [ boehmgc openssl pcre readline sqlite ];
+    buildInputs = [ boehmgc openssl pcre readline sqlite ]
+      ++ lib.optional stdenv.isDarwin Security;
 
     patches = [
       ./NIM_CONFIG_DIR.patch
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 489e3d50e00c..ca79d2ad2505 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15579,8 +15579,9 @@ with pkgs;
 
   muonlang = callPackage ../development/compilers/muonlang { };
 
-  inherit (callPackages ../development/compilers/nim { })
-    nim-unwrapped nimble-unwrapped nim;
+  inherit (callPackages ../development/compilers/nim
+                        { inherit (darwin) Security;  }
+          ) nim-unwrapped nimble-unwrapped nim;
   nimPackages = recurseIntoAttrs nim.pkgs;
 
   nrpl = callPackage ../development/tools/nrpl { };

From 20659b83308a02fcf043982f6274bddec69c853c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Mar 2023 13:19:14 +0000
Subject: [PATCH 23/56] python310Packages.google-cloud-spanner: 3.28.0 ->
 3.29.0

---
 .../python-modules/google-cloud-spanner/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index ce2a5366ac60..922f8163e171 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-spanner";
-  version = "3.28.0";
+  version = "3.29.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3WA2SUC9frxafOXiGquDinwyffNrubQ4QEnfMxxC2KE=";
+    hash = "sha256-Dk13N2SeCGBjjwXCffLGVM0iOL6fGptRcmNidbxnzQc=";
   };
 
   propagatedBuildInputs = [

From decad3f23c29fa7046da80fa3de5ec2af69dd639 Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 19:32:12 +0200
Subject: [PATCH 24/56] vscode-extensions.github: split up for consistency

---
 .../editors/vscode/extensions/default.nix     | 90 +++++++++----------
 1 file changed, 44 insertions(+), 46 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index bf975ce68eba..3e3831ca59d4 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1257,59 +1257,57 @@ let
         };
       };
 
-      github = {
-        codespaces = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            publisher = "github";
-            name = "codespaces";
-            version = "1.14.1";
-            sha256 = "sha256-oiAn/tW4jfccsY8zH6L7UzldeM7sV9tllSvgZD8c9aY=";
-          };
-          meta = { license = lib.licenses.unfree; };
+      github.codespaces = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "github";
+          name = "codespaces";
+          version = "1.14.1";
+          sha256 = "sha256-oiAn/tW4jfccsY8zH6L7UzldeM7sV9tllSvgZD8c9aY=";
         };
+        meta = { license = lib.licenses.unfree; };
+      };
 
-        copilot = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            publisher = "github";
-            name = "copilot";
-            version = "1.78.9758";
-            sha256 = "sha256-qIaaM72SenMv+vtkTMBodD2JsroZLpw8qEttr5aIDQk=";
-          };
-          meta = {
-            description = "GitHub Copilot uses OpenAI Codex to suggest code and entire functions in real-time right from your editor.";
-            downloadPage = "https://marketplace.visualstudio.com/items?itemName=GitHub.copilot";
-            homepage = "https://github.com/features/copilot";
-            license = lib.licenses.unfree;
-            maintainers = [ lib.maintainers.Zimmi48 ];
-          };
+      github.copilot = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "github";
+          name = "copilot";
+          version = "1.78.9758";
+          sha256 = "sha256-qIaaM72SenMv+vtkTMBodD2JsroZLpw8qEttr5aIDQk=";
         };
+        meta = {
+          description = "GitHub Copilot uses OpenAI Codex to suggest code and entire functions in real-time right from your editor.";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=GitHub.copilot";
+          homepage = "https://github.com/features/copilot";
+          license = lib.licenses.unfree;
+          maintainers = [ lib.maintainers.Zimmi48 ];
+        };
+      };
 
-        github-vscode-theme = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            name = "github-vscode-theme";
-            publisher = "github";
-            version = "6.3.3";
-            sha256 = "sha256-fN9ljeZlbbSNW9qggLEz5HOLZlPhHmTHNi1VsZo7Uxk=";
-          };
-          meta = {
-            description = "GitHub theme for VS Code";
-            downloadPage =
-              "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
-            homepage = "https://github.com/primer/github-vscode-theme";
-            license = lib.licenses.mit;
-            maintainers = [ lib.maintainers.hugolgst ];
-          };
+      github.github-vscode-theme = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "github-vscode-theme";
+          publisher = "github";
+          version = "6.3.3";
+          sha256 = "sha256-fN9ljeZlbbSNW9qggLEz5HOLZlPhHmTHNi1VsZo7Uxk=";
         };
+        meta = {
+          description = "GitHub theme for VS Code";
+          downloadPage =
+            "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
+          homepage = "https://github.com/primer/github-vscode-theme";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.hugolgst ];
+        };
+      };
 
-        vscode-pull-request-github = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            name = "vscode-pull-request-github";
-            publisher = "github";
-            version = "0.61.2023032418";
-            sha256 = "sha256-pCFq0lAMH3fno4/BtHJHhS4hX1KqxsPf4wEmAm66Y8E=";
-          };
-          meta = { license = lib.licenses.mit; };
+      github.vscode-pull-request-github = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-pull-request-github";
+          publisher = "github";
+          version = "0.61.2023032418";
+          sha256 = "sha256-pCFq0lAMH3fno4/BtHJHhS4hX1KqxsPf4wEmAm66Y8E=";
         };
+        meta = { license = lib.licenses.mit; };
       };
 
       gitlab.gitlab-workflow = buildVscodeMarketplaceExtension {

From 09adaec7c13bfe06e22c0d151c2a72901585d13e Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 19:35:05 +0200
Subject: [PATCH 25/56] vscode-extensions.coenraads.bracket-pair-colorizer:
 remove

The extension no longer exists on the marketplace.
---
 .../editors/vscode/extensions/default.nix       | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 3e3831ca59d4..4c56d43c653b 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -634,23 +634,6 @@ let
         };
       };
 
-      coenraads.bracket-pair-colorizer = buildVscodeMarketplaceExtension {
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/CoenraadS.bracket-pair-colorizer/changelog";
-          description = "A customizable extension for colorizing matching brackets";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=CoenraadS.bracket-pair-colorizer";
-          homepage = "https://github.com/CoenraadS/BracketPair";
-          license = lib.licenses.mit;
-          maintainers = [ ];
-        };
-        mktplcRef = {
-          name = "bracket-pair-colorizer";
-          publisher = "CoenraadS";
-          version = "1.0.61";
-          sha256 = "0r3bfp8kvhf9zpbiil7acx7zain26grk133f0r0syxqgml12i652";
-        };
-      };
-
       coenraads.bracket-pair-colorizer-2 = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "bracket-pair-colorizer-2";

From 9c73895c06e460c4beaa9578e3a9136f737abfd8 Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 19:35:46 +0200
Subject: [PATCH 26/56] vscode-extensions.coenraads.bracket-pair-colorizer-2:
 remove

The extension is deprecated as its functionality is now a native feature
of VSCode. See also:
https://marketplace.visualstudio.com/items?itemName=CoenraadS.bracket-pair-colorizer-2
---
 .../editors/vscode/extensions/default.nix            | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 4c56d43c653b..1471c0a616e6 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -634,18 +634,6 @@ let
         };
       };
 
-      coenraads.bracket-pair-colorizer-2 = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "bracket-pair-colorizer-2";
-          publisher = "CoenraadS";
-          version = "0.2.2";
-          sha256 = "0zcbs7h801agfs2cggk1cz8m8j0i2ypmgznkgw17lcx3zisll9ad";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       colejcummins.llvm-syntax-highlighting = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "llvm-syntax-highlighting";

From 359124ad033209aca919cc0fa51693cf42ea207f Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 19:38:54 +0200
Subject: [PATCH 27/56] vscode-extensions.faustinoaq.lex-flex-yacc-bison:
 remove

The extension no longer exists on the marketplace.
---
 .../editors/vscode/extensions/default.nix       | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 1471c0a616e6..555faf7ec9a7 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1051,23 +1051,6 @@ let
         };
       };
 
-      faustinoaq.lex-flex-yacc-bison = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "lex-flex-yacc-bison";
-          publisher = "faustinoaq";
-          version = "0.0.3";
-          sha256 = "6254f52157dc796eae7bf135ac88c1c9cc19d884625331a1e634f9768722cc3d";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/faustinoaq.lex-flex-yacc-bison/changelog";
-          description = "Language support for Lex, Flex, Yacc and Bison.";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=faustinoaq.lex-flex-yacc-bison";
-          homepage = "https://github.com/faustinoaq/vscode-lex-flex-yacc-bison";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.emilytrau ];
-        };
-      };
-
       file-icons.file-icons = buildVscodeMarketplaceExtension {
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/file-icons.file-icons/changelog";

From e8888cfda14e16c649cd6ab27d50df21c2c7f25a Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 19:40:09 +0200
Subject: [PATCH 28/56] vscode-extensions.msjsdiag.debugger-for-chrome: remove

The extension is deprecated as VSCode now has its own debugger that
covers the same functionality. See also:
https://marketplace.visualstudio.com/items?itemName=msjsdiag.debugger-for-chrome
---
 .../editors/vscode/extensions/default.nix            | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 555faf7ec9a7..ece4db7e9b12 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2076,18 +2076,6 @@ let
 
       ms-vsliveshare.vsliveshare = callPackage ./ms-vsliveshare.vsliveshare { };
 
-      msjsdiag.debugger-for-chrome = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "debugger-for-chrome";
-          publisher = "msjsdiag";
-          version = "4.12.11";
-          sha256 = "sha256-9i3TgCFThnFF5ccwzS4ATj5c2Xoe/4tDFGv75jJxeQ4=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       mskelton.one-dark-theme = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "one-dark-theme";

From 4dcef4d9c91bd14990b154a4d52faf6fbfa66709 Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 19:42:23 +0200
Subject: [PATCH 29/56] vscode-extensions.silvenon.mdx: remove

The extension is deprecated in favor of the official MDX extension at
https://marketplace.visualstudio.com/items?itemName=unifiedjs.vscode-mdx
See also:
https://marketplace.visualstudio.com/items?itemName=silvenon.mdx
---
 .../editors/vscode/extensions/default.nix            | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index ece4db7e9b12..dd5fe68da373 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2486,18 +2486,6 @@ let
         };
       };
 
-      silvenon.mdx = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "mdx";
-          publisher = "silvenon";
-          version = "0.1.0";
-          sha256 = "1mzsqgv0zdlj886kh1yx1zr966yc8hqwmiqrb1532xbmgyy6adz3";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       skellock.just = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "just";

From aed907112c7108a25ff9a7bb9a29e9205217ae64 Mon Sep 17 00:00:00 2001
From: Charles Duffy <charles@dyfis.net>
Date: Mon, 27 Mar 2023 12:55:52 -0500
Subject: [PATCH 30/56] pcsc-safenet: switch from fetchurl to fetchzip

---
 pkgs/tools/security/pcsc-safenet/default.nix | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/pkgs/tools/security/pcsc-safenet/default.nix b/pkgs/tools/security/pcsc-safenet/default.nix
index be86f9cd643d..c424dfb32667 100644
--- a/pkgs/tools/security/pcsc-safenet/default.nix
+++ b/pkgs/tools/security/pcsc-safenet/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , runCommand
-, fetchurl
+, fetchzip
 , autoPatchelfHook
 , dpkg
 , gtk3
@@ -14,24 +14,22 @@ stdenv.mkDerivation rec {
   pname = "pcsc-safenet";
   version = "10.8.28";
 
+  debName = "Installation/Standard/Ubuntu-2004/safenetauthenticationclient_${version}_amd64.deb";
+
   # extract debian package from larger zip file
-  src = runCommand "sac.deb" {
-    zipSrc = let
+  src =
+    let
       versionWithUnderscores = builtins.replaceStrings ["."] ["_"] version;
-    in fetchurl {
+    in fetchzip {
       url = "https://www.digicert.com/StaticFiles/SAC_${versionWithUnderscores}_GA_Build.zip";
-      hash = "sha256-bh+TB7ZGDMh9G4lcPtv7mc0XeGhmCfMMqrlqtyGIIaA=";
+      hash = "sha256-7XWj3T9/KnmgQ05urOJV6dqgkAS/A2G7efnqjQO2ing=";
     };
-    debName = "SAC ${version} GA Build/Installation/Standard/Ubuntu-2004/safenetauthenticationclient_${version}_amd64.deb";
-  } ''
-    ${unzip}/bin/unzip -p "$zipSrc" "$debName" >"$out"
-  '';
 
   dontBuild = true;
   dontConfigure = true;
 
   unpackPhase = ''
-    dpkg-deb -x $src .
+    dpkg-deb -x "$src/$debName" .
   '';
 
   buildInputs = [

From 8b5a5c29f7ed0ab739b8581518ba9aabd2b74ffd Mon Sep 17 00:00:00 2001
From: Charles Duffy <charles@dyfis.net>
Date: Mon, 27 Mar 2023 12:56:51 -0500
Subject: [PATCH 31/56] pcsc-safenet: add comments documenting library symlink
 munging

---
 pkgs/tools/security/pcsc-safenet/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/security/pcsc-safenet/default.nix b/pkgs/tools/security/pcsc-safenet/default.nix
index c424dfb32667..2fcbd302e8cc 100644
--- a/pkgs/tools/security/pcsc-safenet/default.nix
+++ b/pkgs/tools/security/pcsc-safenet/default.nix
@@ -57,15 +57,17 @@ stdenv.mkDerivation rec {
     mkdir "$out"
     cp -r ./* "$out/"
 
+    # for each library like libfoo.so.1.2.3, create symlinks to it from libfoo.so, libfoo.so.1, libfoo.so.1.2
     (
       cd "$out/lib/" || exit
-      for f in *.so.*.*.*; do
-        ln -sf "$f" "''${f%.*}" || exit
-        ln -sf "$f" "''${f%.*.*}" || exit
-        ln -sf "$f" "''${f%.*.*.*}" || exit
+      for f in *.so.*.*.*; do                # find library names with three-layer suffixes
+        ln -sf "$f" "''${f%.*}" || exit      # strip only one suffix layer
+        ln -sf "$f" "''${f%.*.*}" || exit    # strip two suffix layers
+        ln -sf "$f" "''${f%.*.*.*}" || exit  # strip all three suffix layers
       done
     ) || exit
 
+    # when library links are missing in pcsc/drivers, create them
     (
       cd "$out/pcsc/drivers" || exit
       for f in *; do

From a761d073ca9caaf226125cab1cdad34c716c6e3d Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 19:58:36 +0200
Subject: [PATCH 32/56] 
 vscode-extensions.jpoinssonnier.vscode-styled-components: move to
 styled-components.vscode-styled-components, 1.4.1 -> 1.7.6

According to the readme, the old location will no longer receive
updates: https://github.com/styled-components/vscode-styled-components
---
 .../editors/vscode/extensions/default.nix     | 29 +++++++++++--------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index dd5fe68da373..2a33974d6106 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1550,18 +1550,6 @@ let
         };
       };
 
-      jpoissonnier.vscode-styled-components = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-styled-components";
-          publisher = "jpoissonnier";
-          version = "1.4.1";
-          sha256 = "sha256-ojbeuYBCS+DjF5R0aLuBImzoSOb8mXw1s0Uh0CzggzE=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       justusadam.language-haskell = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "language-haskell";
@@ -2616,6 +2604,22 @@ let
         };
       };
 
+      styled-components.vscode-styled-components = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-styled-components";
+          publisher = "styled-components";
+          version = "1.7.6";
+          sha256 = "sha256-ZXXXFUriu//2Wmj1N+plj7xzJauGBfj+79SyrkUZAO4=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/styled-components.vscode-styled-components/changelog";
+          description = "Syntax highlighting and IntelliSense for styled-components";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=styled-components.vscode-styled-components";
+          homepage = "https://github.com/styled-components/vscode-styled-components";
+          license = lib.licenses.mit;
+        };
+      };
+
       sumneko.lua = callPackage ./sumneko.lua { };
 
       svelte.svelte-vscode = buildVscodeMarketplaceExtension {
@@ -3161,6 +3165,7 @@ let
   aliases = self: super: {
     # aliases
     jakebecker.elixir-ls = super.elixir-lsp.vscode-elixir-ls;
+    jpoissonnier.vscode-styled-components = super.styled-components.vscode-styled-components;
     ms-vscode = lib.recursiveUpdate super.ms-vscode { inherit (super.golang) go; };
     _1Password = throw ''_1Password has been replaced with "1Password"'';
     _2gua = throw ''_2gua has been replaced with "2gua"'';

From 32a11f9cf16c37f2b6d030447df253cafe5af7f5 Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 20:01:20 +0200
Subject: [PATCH 33/56] vscode-extensions.matklad.rust-analyzer: move to alias
 section

---
 pkgs/applications/editors/vscode/extensions/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 2a33974d6106..2c25798d9622 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1749,8 +1749,6 @@ let
         meta.license = lib.licenses.mit;
       };
 
-      matklad.rust-analyzer = self.rust-lang.rust-analyzer; # Previous publisher
-
       matthewpi.caddyfile-support = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "caddyfile-support";
@@ -3166,6 +3164,7 @@ let
     # aliases
     jakebecker.elixir-ls = super.elixir-lsp.vscode-elixir-ls;
     jpoissonnier.vscode-styled-components = super.styled-components.vscode-styled-components;
+    matklad.rust-analyzer = super.rust-lang.rust-analyzer; # Previous publisher
     ms-vscode = lib.recursiveUpdate super.ms-vscode { inherit (super.golang) go; };
     _1Password = throw ''_1Password has been replaced with "1Password"'';
     _2gua = throw ''_2gua has been replaced with "2gua"'';

From 5cfaf84ab6266931c7a43c32c4ce7fda2ce53cfe Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 20:28:53 +0200
Subject: [PATCH 34/56] vscode-extensions: restore alphabetical order

---
 .../editors/vscode/extensions/default.nix     | 228 +++++++++---------
 1 file changed, 114 insertions(+), 114 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 2c25798d9622..814ec75fb785 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -451,18 +451,6 @@ let
         };
       };
 
-      bodil.file-browser = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "file-browser";
-          publisher = "bodil";
-          version = "0.2.11";
-          sha256 = "sha256-yPVhhsAUZxnlhj58fXkk+yhxop2q7YJ6X4W9dXGKJfo=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       bierner.emojisense = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "emojisense";
@@ -536,6 +524,18 @@ let
         };
       };
 
+      bodil.file-browser = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "file-browser";
+          publisher = "bodil";
+          version = "0.2.11";
+          sha256 = "sha256-yPVhhsAUZxnlhj58fXkk+yhxop2q7YJ6X4W9dXGKJfo=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       bradlc.vscode-tailwindcss = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-tailwindcss";
@@ -594,6 +594,23 @@ let
 
       chenglou92.rescript-vscode = callPackage ./chenglou92.rescript-vscode { };
 
+      chris-hayes.chatgpt-reborn = buildVscodeMarketplaceExtension {
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/chris-hayes.chatgpt-reborn/changelog";
+          description = "A Visual Studio Code extension to support ChatGPT, GPT-3 and Codex conversations";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=chris-hayes.chatgpt-reborn";
+          homepage = "https://github.com/christopher-hayes/vscode-chatgpt-reborn";
+          license = lib.licenses.isc;
+          maintainers = [ lib.maintainers.drupol ];
+        };
+        mktplcRef = {
+          name = "chatgpt-reborn";
+          publisher = "chris-hayes";
+          version = "3.11.2";
+          sha256 = "sha256-YidcekYTgPYlzfmDHHAxywF+bJE8Da3pg/TCumK4Epo=";
+        };
+      };
+
       christian-kohler.path-intellisense = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "path-intellisense";
@@ -663,23 +680,6 @@ let
         };
       };
 
-      chris-hayes.chatgpt-reborn = buildVscodeMarketplaceExtension {
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/chris-hayes.chatgpt-reborn/changelog";
-          description = "A Visual Studio Code extension to support ChatGPT, GPT-3 and Codex conversations";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=chris-hayes.chatgpt-reborn";
-          homepage = "https://github.com/christopher-hayes/vscode-chatgpt-reborn";
-          license = lib.licenses.isc;
-          maintainers = [ lib.maintainers.drupol ];
-        };
-        mktplcRef = {
-          name = "chatgpt-reborn";
-          publisher = "chris-hayes";
-          version = "3.11.2";
-          sha256 = "sha256-YidcekYTgPYlzfmDHHAxywF+bJE8Da3pg/TCumK4Epo=";
-        };
-      };
-
       cweijan.vscode-database-client2 = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-database-client2";
@@ -1928,6 +1928,56 @@ let
         };
       };
 
+      ms-toolsai.jupyter = callPackage ./ms-toolsai.jupyter { };
+
+      ms-toolsai.jupyter-keymap = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "jupyter-keymap";
+          publisher = "ms-toolsai";
+          version = "1.1.0";
+          sha256 = "sha256-krDtR+ZJiJf1Kxcu5mdXOaSAiJb2bXC1H0XWWviWeMQ=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
+      ms-toolsai.jupyter-renderers = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "jupyter-renderers";
+          publisher = "ms-toolsai";
+          version = "1.0.15";
+          sha256 = "sha256-JR6PunvRRTsSqjSGGAn/1t1B+Ia6X0MgqahehcuSNYA=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
+      ms-toolsai.vscode-jupyter-cell-tags = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-jupyter-cell-tags";
+          publisher = "ms-toolsai";
+          version = "0.1.8";
+          sha256 = "sha256-0oPyptnUWL1h/H13SdR+FdgGzVwEpTaK9SCE7BvI/5M=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
+      ms-toolsai.vscode-jupyter-slideshow = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-jupyter-slideshow";
+          publisher = "ms-toolsai";
+          version = "0.1.5";
+          sha256 = "1p6r5vkzvwvxif3wxqi9599vplabzig27fzzz0bx9z0awfglzyi7";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       ms-vscode.anycode = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "anycode";
@@ -1992,8 +2042,6 @@ let
         };
       };
 
-      ms-vscode-remote.remote-ssh = callPackage ./ms-vscode-remote.remote-ssh { };
-
       ms-vscode.theme-tomorrowkit = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "Theme-TomorrowKit";
@@ -2010,55 +2058,7 @@ let
         };
       };
 
-      ms-toolsai.jupyter = callPackage ./ms-toolsai.jupyter { };
-
-      ms-toolsai.jupyter-keymap = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "jupyter-keymap";
-          publisher = "ms-toolsai";
-          version = "1.1.0";
-          sha256 = "sha256-krDtR+ZJiJf1Kxcu5mdXOaSAiJb2bXC1H0XWWviWeMQ=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
-      ms-toolsai.jupyter-renderers = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "jupyter-renderers";
-          publisher = "ms-toolsai";
-          version = "1.0.15";
-          sha256 = "sha256-JR6PunvRRTsSqjSGGAn/1t1B+Ia6X0MgqahehcuSNYA=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
-      ms-toolsai.vscode-jupyter-cell-tags = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-jupyter-cell-tags";
-          publisher = "ms-toolsai";
-          version = "0.1.8";
-          sha256 = "sha256-0oPyptnUWL1h/H13SdR+FdgGzVwEpTaK9SCE7BvI/5M=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
-      ms-toolsai.vscode-jupyter-slideshow = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-jupyter-slideshow";
-          publisher = "ms-toolsai";
-          version = "0.1.5";
-          sha256 = "1p6r5vkzvwvxif3wxqi9599vplabzig27fzzz0bx9z0awfglzyi7";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
+      ms-vscode-remote.remote-ssh = callPackage ./ms-vscode-remote.remote-ssh { };
 
       ms-vsliveshare.vsliveshare = callPackage ./ms-vsliveshare.vsliveshare { };
 
@@ -2137,6 +2137,18 @@ let
         };
       };
 
+      octref.vetur = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vetur";
+          publisher = "octref";
+          version = "0.37.3";
+          sha256 = "sha256-3hi1LOZto5AYaomB9ihkAt4j/mhkCDJ8Jqa16piwHIQ=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       oderwat.indent-rainbow = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "indent-rainbow";
@@ -2153,18 +2165,6 @@ let
         };
       };
 
-      octref.vetur = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vetur";
-          publisher = "octref";
-          version = "0.37.3";
-          sha256 = "sha256-3hi1LOZto5AYaomB9ihkAt4j/mhkCDJ8Jqa16piwHIQ=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       phoenixframework.phoenix = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "phoenix";
@@ -2263,6 +2263,16 @@ let
         };
       };
 
+      redhat.vscode-xml = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-xml";
+          publisher = "redhat";
+          version = "0.25.2023032304";
+          sha256 = "sha256-3hU/MZU9dP91p2PVycFL6yg/nf4/x8tt76vmlkiHnE8=";
+        };
+        meta.license = lib.licenses.epl20;
+      };
+
       redhat.vscode-yaml = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-yaml";
@@ -2275,16 +2285,6 @@ let
         };
       };
 
-      redhat.vscode-xml = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-xml";
-          publisher = "redhat";
-          version = "0.25.2023032304";
-          sha256 = "sha256-3hU/MZU9dP91p2PVycFL6yg/nf4/x8tt76vmlkiHnE8=";
-        };
-        meta.license = lib.licenses.epl20;
-      };
-
       richie5um2.snake-trail = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "snake-trail";
@@ -2333,18 +2333,6 @@ let
         };
       };
 
-      rubymaniac.vscode-paste-and-indent = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-paste-and-indent";
-          publisher = "Rubymaniac";
-          version = "0.0.8";
-          sha256 = "0fqwcvwq37ndms6vky8jjv0zliy6fpfkh8d9raq8hkinfxq6klgl";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       rubbersheep.gi = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "gi";
@@ -2357,6 +2345,18 @@ let
         };
       };
 
+      rubymaniac.vscode-paste-and-indent = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-paste-and-indent";
+          publisher = "Rubymaniac";
+          version = "0.0.8";
+          sha256 = "0fqwcvwq37ndms6vky8jjv0zliy6fpfkh8d9raq8hkinfxq6klgl";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       rust-lang.rust-analyzer = callPackage ./rust-lang.rust-analyzer { };
 
       ryu1kn.partial-diff = buildVscodeMarketplaceExtension {

From c7f5ccaef9fb0bcb992797a88b9811d090aff14f Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 22:18:21 +0200
Subject: [PATCH 35/56] vscode-extensions: lowercase remaining extension names

In practice, the vast majority of extensions with uppercase characters
in their extension identifiers was already using lowercased versions of
the identifiers as names. This commit documents this practice and
converts the four remaining extensions.
---
 .../editors/vscode/extensions/default.nix     | 31 ++++++++++++-------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 814ec75fb785..282b2800ec75 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -25,11 +25,13 @@ let
   inherit (vscode-utils) buildVscodeMarketplaceExtension;
 
   #
-  # Unless there is a good reason not to, we attempt to use the same name as the
-  # extension's unique identifier (the name the extension gets when installed
-  # from vscode under `~/.vscode`) and found on the marketplace extension page.
-  # So an extension's attribute name should be of the form:
-  # "${mktplcRef.publisher}.${mktplcRef.name}".
+  # Unless there is a good reason not to, we attempt to use the lowercase
+  # version of the extension's unique identifier. The unique identifier can be
+  # found on the marketplace extension page, and is the name under which the
+  # extension is installed by VSCode under `~/.vscode`.
+  #
+  # This means an extension should be located at
+  # ${lib.strings.toLower mktplcRef.publisher}.${lib.string.toLower mktplcRef.name}
   #
   baseExtensions = self: lib.mapAttrs (_n: lib.recurseIntoAttrs)
     {
@@ -253,7 +255,7 @@ let
         };
       };
 
-      Arjun.swagger-viewer = buildVscodeMarketplaceExtension {
+      arjun.swagger-viewer = buildVscodeMarketplaceExtension {
         mktplcRef = {
           publisher = "Arjun";
           name = "swagger-viewer";
@@ -2026,7 +2028,7 @@ let
         };
       };
 
-      ms-vscode.PowerShell = buildVscodeMarketplaceExtension {
+      ms-vscode.powershell = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "PowerShell";
           publisher = "ms-vscode";
@@ -2297,7 +2299,7 @@ let
         };
       };
 
-      rioj7.commandOnAllFiles = buildVscodeMarketplaceExtension {
+      rioj7.commandonallfiles = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "commandOnAllFiles";
           publisher = "rioj7";
@@ -3028,7 +3030,7 @@ let
         };
       };
 
-      WakaTime.vscode-wakatime = callPackage ./WakaTime.vscode-wakatime { };
+      wakatime.vscode-wakatime = callPackage ./WakaTime.vscode-wakatime { };
 
       wholroyd.jinja = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -3161,11 +3163,18 @@ let
     };
 
   aliases = self: super: {
-    # aliases
+    Arjun.swagger-viewer = super.arjun.swagger-viewer;
     jakebecker.elixir-ls = super.elixir-lsp.vscode-elixir-ls;
     jpoissonnier.vscode-styled-components = super.styled-components.vscode-styled-components;
     matklad.rust-analyzer = super.rust-lang.rust-analyzer; # Previous publisher
-    ms-vscode = lib.recursiveUpdate super.ms-vscode { inherit (super.golang) go; };
+    ms-vscode = lib.recursiveUpdate super.ms-vscode {
+      go = super.golang.go;
+      PowerShell = super.ms-vscode.powershell;
+    };
+    rioj7 = lib.recursiveUpdate super.rioj7 {
+      commandOnAllFiles = super.rioj7.commandonallfiles;
+    };
+    WakaTime.vscode-wakatime = super.wakatime.vscode-wakatime;
     _1Password = throw ''_1Password has been replaced with "1Password"'';
     _2gua = throw ''_2gua has been replaced with "2gua"'';
     _4ops = throw ''_4ops has been replaced with "4ops"'';

From 11df65743da95d6153c6c048dbc9596e47871fa6 Mon Sep 17 00:00:00 2001
From: Joscha <joscha@plugh.de>
Date: Mon, 27 Mar 2023 22:36:23 +0200
Subject: [PATCH 36/56] vscode-extensions: simplify how aliases are specified

---
 .../editors/vscode/extensions/default.nix        | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 282b2800ec75..40ff07c7d4fc 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3162,18 +3162,14 @@ let
       };
     };
 
-  aliases = self: super: {
+  aliases = super: {
     Arjun.swagger-viewer = super.arjun.swagger-viewer;
     jakebecker.elixir-ls = super.elixir-lsp.vscode-elixir-ls;
     jpoissonnier.vscode-styled-components = super.styled-components.vscode-styled-components;
     matklad.rust-analyzer = super.rust-lang.rust-analyzer; # Previous publisher
-    ms-vscode = lib.recursiveUpdate super.ms-vscode {
-      go = super.golang.go;
-      PowerShell = super.ms-vscode.powershell;
-    };
-    rioj7 = lib.recursiveUpdate super.rioj7 {
-      commandOnAllFiles = super.rioj7.commandonallfiles;
-    };
+    ms-vscode.go = super.golang.go;
+    ms-vscode.PowerShell = super.ms-vscode.powershell;
+    rioj7.commandOnAllFiles = super.rioj7.commandonallfiles;
     WakaTime.vscode-wakatime = super.wakatime.vscode-wakatime;
     _1Password = throw ''_1Password has been replaced with "1Password"'';
     _2gua = throw ''_2gua has been replaced with "2gua"'';
@@ -3184,7 +3180,9 @@ let
   # then apply extension specific modifcations to packages.
 
   # overlays will be applied left to right, overrides should come after aliases.
-  overlays = lib.optionals config.allowAliases [ aliases ];
+  overlays = lib.optionals config.allowAliases [
+    (self: super: lib.recursiveUpdate super (aliases super))
+  ];
 
   toFix = lib.foldl' (lib.flip lib.extends) baseExtensions overlays;
 in

From 4cd7d8634dfbfe237d2ede2ae0da882ab2829efe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Mar 2023 03:34:54 +0000
Subject: [PATCH 37/56] nixpacks: 1.5.1 -> 1.6.0

---
 pkgs/applications/virtualization/nixpacks/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index 2de8989830c3..4143c21218da 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-eAniM4o7TshGhO5jGrCZz+Rs5n5Q24tvIWMWebKAWAs=";
+    sha256 = "sha256-q+NMV0GagcGeUb+WD8BoFjAKJWgzBSq/POqwPUADAUI=";
   };
 
-  cargoHash = "sha256-0Y4hHuWB7NY7rRJImNIrxlEffrT9055ThQGqJlMeDMM=";
+  cargoHash = "sha256-m9CvMorM7uX6OOfVCtM2pZPgRcKm7fVoTk/SCt8FXyU=";
 
   # skip test due FHS dependency
   doCheck = false;

From 8932f6b0b4879181ee9006b198170bdb645a4fd2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Mar 2023 03:59:24 +0000
Subject: [PATCH 38/56] svls: 0.2.7 -> 0.2.8

---
 pkgs/development/tools/language-servers/svls/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/language-servers/svls/default.nix b/pkgs/development/tools/language-servers/svls/default.nix
index fef2306b1cd7..e568568ccdeb 100644
--- a/pkgs/development/tools/language-servers/svls/default.nix
+++ b/pkgs/development/tools/language-servers/svls/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svls";
-  version = "0.2.7";
+  version = "0.2.8";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = "svls";
     rev = "v${version}";
-    sha256 = "sha256-+auy6LfvT7OCCSM/WNjnzFsBTAHS+kcghOaMpG3f9dA=";
+    sha256 = "sha256-vUvDdeowbrmDQvUCUYRjOGQQrlyGGKrnXsYFsMWMfFw=";
   };
 
-  cargoHash = "sha256-ZNYYb0Ji4AmiXfhKMPK/4MPfFYSmnUeeeTmiq6rpBvg=";
+  cargoHash = "sha256-zb1F3bv1MrXkoBzTaVXbHcKFlg5R9Ulq6eN8mh8WKSg=";
 
   meta = with lib; {
     description = "SystemVerilog language server";

From f0a09cc1658c000790f9becf3dc7fd7c55e18948 Mon Sep 17 00:00:00 2001
From: Ruixi-rebirth <ruixirebirth@gmail.com>
Date: Tue, 28 Mar 2023 13:59:43 +0800
Subject: [PATCH 39/56] chatgpt-cli: init at 0.6.0-beta

chatgpt-cli: init at 0.6.0-beta

chatgpt-cli: init at 0.6.0-beta

chatgpt-cli: init at 0.6.0-beta

chatgpt-cli: init at 0.6.0-beta

chatgpt-cli: init at 0.6.0-beta
---
 pkgs/tools/misc/chatgpt-cli/default.nix | 28 +++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix         |  2 ++
 2 files changed, 30 insertions(+)
 create mode 100644 pkgs/tools/misc/chatgpt-cli/default.nix

diff --git a/pkgs/tools/misc/chatgpt-cli/default.nix b/pkgs/tools/misc/chatgpt-cli/default.nix
new file mode 100644
index 000000000000..0818e860b5ce
--- /dev/null
+++ b/pkgs/tools/misc/chatgpt-cli/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+,
+}:
+buildGoModule rec {
+  pname = "chatgpt";
+  version = "0.6.0-beta";
+
+  src = fetchFromGitHub {
+    owner = "j178";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-qIa0eU3aFyDC5cm/J/BmZfcJe1DARqAtmpUMqlaqsF4=";
+  };
+
+  vendorHash = "sha256-JlBAPHtMm5mq91aOtsNMDu48net9i3W/AxCiKalYkm4=";
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Interactive CLI for ChatGPT";
+    homepage = "https://github.com/j178/chatgpt";
+    license = licenses.mit;
+    mainProgram = "chatgpt";
+    maintainers = with maintainers; [ Ruixi-rebirth ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 452fb8108891..fd86d9ec1de0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -402,6 +402,8 @@ with pkgs;
 
   cewl = callPackage ../tools/security/cewl { };
 
+  chatgpt-cli = callPackage ../tools/misc/chatgpt-cli { };
+
   checkov = callPackage ../development/tools/analysis/checkov {
     python3 = python311;
   };

From 1139cea54204b0d9ec29a2805628ba3bceb2b67b Mon Sep 17 00:00:00 2001
From: Gabriel Arazas <foodogsquared@foodogsquared.one>
Date: Tue, 28 Mar 2023 17:39:17 +0800
Subject: [PATCH 40/56] gum: 0.8.0 -> 0.10.0

---
 pkgs/applications/misc/gum/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/gum/default.nix b/pkgs/applications/misc/gum/default.nix
index d4bd7c63a722..753ff769a647 100644
--- a/pkgs/applications/misc/gum/default.nix
+++ b/pkgs/applications/misc/gum/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gum";
-  version = "0.8.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6x1t/PLs1dqlY5XQ1F0PDqZ/TofZ0h1hTc0C1sjn3fA=";
+    sha256 = "sha256-SP8n9PGfn4Oe+3+i7gT4i2WKgO35igPu+86SGp65R7g=";
   };
 
-  vendorSha256 = "sha256-rOBwhPXo4sTSI3j3rn3c5qWGnGFgkpeFUKgtzKBltbg=";
+  vendorSha256 = "sha256-gA545IqG3us0mmWxbw3fu3mFLqJzluH/T6d3ilfnLyM=";
 
   nativeBuildInputs = [
     installShellFiles

From a0849883432b75507153db90ce999ebb41308f5d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Mar 2023 10:44:47 +0000
Subject: [PATCH 41/56] dagger: 0.4.1 -> 0.4.2

---
 .../tools/continuous-integration/dagger/default.nix         | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/continuous-integration/dagger/default.nix b/pkgs/development/tools/continuous-integration/dagger/default.nix
index 05b303878779..334c52cd47f8 100644
--- a/pkgs/development/tools/continuous-integration/dagger/default.nix
+++ b/pkgs/development/tools/continuous-integration/dagger/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dagger";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "dagger";
     repo = "dagger";
     rev = "v${version}";
-    hash = "sha256-d7Yz5MgV5l54uGbQPmGUVZuz4xdGO+gSiI9/6Axqsb0=";
+    hash = "sha256-R9O+ilOz5AZmsSR0uoOhXLNMTUEej9sV4ONaIF6ZnVc=";
   };
 
-  vendorHash = "sha256-fRHs2B/pea9FIqPpOaR6z3do+tpnaGlKTbwfF/smC4w=";
+  vendorHash = "sha256-/ZwIuzUvs7GvpoR6CfxdCivyOS8kDOukM92NuWFXJCY=";
   proxyVendor = true;
 
   subPackages = [

From a3afe1883609dc0e5c8a3659999c09476f79a70b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Mar 2023 10:52:38 +0000
Subject: [PATCH 42/56] coreth: 0.11.8 -> 0.11.9

---
 pkgs/applications/networking/coreth/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/coreth/default.nix b/pkgs/applications/networking/coreth/default.nix
index 5f857caee92c..1366bfa7fdf5 100644
--- a/pkgs/applications/networking/coreth/default.nix
+++ b/pkgs/applications/networking/coreth/default.nix
@@ -6,19 +6,19 @@
 
 buildGoModule rec {
   pname = "coreth";
-  version = "0.11.8";
+  version = "0.11.9";
 
   src = fetchFromGitHub {
     owner = "ava-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-O6dTbhnZPWd7BKMwaPfUOPwcvwzQoHUKR9Zj7uKqtGM=";
+    hash = "sha256-i0mLyTeosGlnTpKvAUS3wDvBRFpgmnfmKXAtCnAGqE0=";
   };
 
   # go mod vendor has a bug, see: golang/go#57529
   proxyVendor = true;
 
-  vendorHash = "sha256-nJA83SfMv+5xKKyJTtaSRsro1XR+3sNiszBeXRRY5NA=";
+  vendorHash = "sha256-zX1rQ9RDBkzZIbqCDlFEgseYyKYUHYyGFApZqhOrkGU=";
 
   ldflags = [
     "-s"

From 5a4cfac5ecdd2e56efe3596dfbb35caee9fe46b2 Mon Sep 17 00:00:00 2001
From: Rahul Butani <rrbutani@users.noreply.github.com>
Date: Fri, 27 Jan 2023 11:26:14 -0800
Subject: [PATCH 43/56] llvmPackages_git.llvm: fix the tests on `x86_64-darwin`

Port of eafb8fbd3215f0fe6b1d4a0360a9c4f761677179 ("llvmPackages_15.llvm: fix the tests on `x86_64-darwin`")
---
 .../compilers/llvm/git/llvm/default.nix       | 53 ++++++++++++++++++-
 1 file changed, 51 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 4f0e68dc7b5f..ef7ff66e7464 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -150,10 +150,59 @@ in stdenv.mkDerivation (rec {
     rm test/MC/ELF/cfi-version.ll
 
     # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
-    # thus fails under the sandbox:
+    # and thus fails under the sandbox:
     substituteInPlace unittests/Support/Host.cpp \
       --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
-  '' + ''
+   '' + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86) ''
+    # This test tries to call the intrinsics `@llvm.roundeven.f32` and
+    # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
+    # and `roundeven` on x86_64 macOS.
+    #
+    # However these functions are glibc specific so the test fails:
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundevenf.html
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundeven.html
+    #
+    # TODO(@rrbutani): this seems to run fine on `aarch64-darwin`, why does it
+    # pass there?
+    substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
+      --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
+      --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
+
+    # This test fails on darwin x86_64 because `sw_vers` reports a different
+    # macOS version than what LLVM finds by reading
+    # `/System/Library/CoreServices/SystemVersion.plist` (which is passed into
+    # the sandbox on macOS).
+    #
+    # The `sw_vers` provided by nixpkgs reports the macOS version associated
+    # with the `CoreFoundation` framework with which it was built. Because
+    # nixpkgs pins the SDK for `aarch64-darwin` and `x86_64-darwin` what
+    # `sw_vers` reports is not guaranteed to match the macOS version of the host
+    # that's building this derivation.
+    #
+    # Astute readers will note that we only _patch_ this test on aarch64-darwin
+    # (to use the nixpkgs provided `sw_vers`) instead of disabling it outright.
+    # So why does this test pass on aarch64?
+    #
+    # Well, it seems that `sw_vers` on aarch64 actually links against the _host_
+    # CoreFoundation framework instead of the nixpkgs provided one.
+    #
+    # Not entirely sure what the right fix is here. I'm assuming aarch64
+    # `sw_vers` doesn't intentionally link against the host `CoreFoundation`
+    # (still digging into how this ends up happening, will follow up) but that
+    # aside I think the more pertinent question is: should we be patching LLVM's
+    # macOS version detection logic to use `sw_vers` instead of reading host
+    # paths? This *is* a way in which details about builder machines can creep
+    # into the artifacts that are produced, affecting reproducibility, but it's
+    # not clear to me when/where/for what this even gets used in LLVM.
+    #
+    # TODO(@rrbutani): fix/follow-up
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
+
+    # This test fails with a `dysmutil` crash; have not yet dug into what's
+    # going on here (TODO(@rrbutani)).
+    rm test/tools/dsymutil/ARM/obfuscated.test
+    '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""

From c492acd865a2b5347de5257273bb5961b3daa11e Mon Sep 17 00:00:00 2001
From: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>
Date: Wed, 15 Mar 2023 11:33:52 +0100
Subject: [PATCH 44/56] protonmail-bridge: rename back the binary to
 protonmail-bridge

`bridge` is used by iproute2, so using this name for protonmail-bridge
made it very likely to produce a name "conflict".
Also `bridge` is used in the Makefile by upstream project Makefile but
it apparently is renamed later on when packaged in rpm/deb so even for
coherence purposes it does make sense to revert it back to the name
`protonmail-bridge` that were previously being used.

Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>
---
 nixos/doc/manual/release-notes/rl-2305.section.md          | 4 +---
 pkgs/applications/networking/protonmail-bridge/default.nix | 2 +-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index b5e157cdb76e..2cdc70a7fd67 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -134,7 +134,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The [services.wordpress.sites.&lt;name&gt;.plugins](#opt-services.wordpress.sites._name_.plugins) and [services.wordpress.sites.&lt;name&gt;.themes](#opt-services.wordpress.sites._name_.themes) options have been converted from sets to attribute sets to allow for consumers to specify explicit install paths via attribute name.
 
-- `protonmail-bridge` package has been updated to v3.0 and the CLI executable is now named bridge instead of protonmail-bridge to be more in line with upstream.
+- `protonmail-bridge` package has been updated to major version 3.
 
 - Nebula now runs as a system user and group created for each nebula network, using the `CAP_NET_ADMIN` ambient capability on launch rather than starting as root. Ensure that any files each Nebula instance needs to access are owned by the correct user and group, by default `nebula-${networkName}`.
 
@@ -286,8 +286,6 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `unifi-poller` package and corresponding NixOS module have been renamed to `unpoller` to match upstream.
 
-- `protonmail-bridge` package has been updated to v3.0 and the CLI executable is now named bridge instead of protonmail-bridge to be more in line with upstream.
-
 - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting.
 
 - `openjdk` from version 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`.
diff --git a/pkgs/applications/networking/protonmail-bridge/default.nix b/pkgs/applications/networking/protonmail-bridge/default.nix
index d02bf7ec1fe2..3cac4a2dcdd6 100644
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@@ -38,7 +38,7 @@ buildGoModule rec {
   ];
 
   postInstall = ''
-    mv $out/bin/Desktop-Bridge $out/bin/bridge # The cli is named like that in the upstream repo
+    mv $out/bin/Desktop-Bridge $out/bin/protonmail-bridge # The cli is named like that in other distro packages
   '';
 
   meta = with lib; {

From a991a71d04cb18241ee9cc4c7b613fe78cb86ce1 Mon Sep 17 00:00:00 2001
From: Sumner Evans <me@sumnerevans.com>
Date: Tue, 28 Mar 2023 13:55:24 +0200
Subject: [PATCH 45/56] matrix-synapse: 1.79.0 -> 1.80.0

Signed-off-by: Sumner Evans <me@sumnerevans.com>
---
 pkgs/servers/matrix-synapse/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 3e9fadea76fa..0061fa71e6b8 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -12,20 +12,20 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.79.0";
+  version = "1.80.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-2MHP4Gu+C5yyXObbd7NLYWCy1E0L7fUwpzYsoD7ULDo=";
+    hash = "sha256-Lw6gmuI+ntOW54HQbmDoY9QYNDTu5vgtrJz6HMWWmMM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-yDKs6KRStjJMC/48dZcyQ4OmBXY1TombjH/ZDfBJbSc=";
+    hash = "sha256-KqPpaIJ8VuVV6f6n14/7wbA+Vtk7NvWm09bUBWuAAlY=";
   };
 
   postPatch = ''

From c09ecd65bf98a764f6e4008d4f21c21e688cea21 Mon Sep 17 00:00:00 2001
From: IndeedNotJames <git@indeednotjames.com>
Date: Tue, 28 Mar 2023 14:29:39 +0200
Subject: [PATCH 46/56] rustic-rs: 0.4.4 -> 0.5.0

Temporarily removed zsh shell completions, as they don't generate due to a bug.

https://github.com/rustic-rs/rustic/blob/v0.5.0/changelog/0.5.0.txt
https://github.com/rustic-rs/rustic/releases/tag/v0.5.0
diff: https://github.com/rustic-rs/rustic/compare/v0.4.4...v0.5.0
---
 pkgs/tools/backup/rustic-rs/default.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/backup/rustic-rs/default.nix b/pkgs/tools/backup/rustic-rs/default.nix
index 559fcf2a0ff9..5487a2641750 100644
--- a/pkgs/tools/backup/rustic-rs/default.nix
+++ b/pkgs/tools/backup/rustic-rs/default.nix
@@ -2,27 +2,30 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rustic-rs";
-  version = "0.4.4";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "rustic-rs";
     repo = "rustic";
     rev = "v${version}";
-    hash = "sha256-irN5enJ0nyyzrLvnLXm7YhyEJ3nz9PQukzAfUrKmOzY=";
+    hash = "sha256-r4hOjX/LKv2wX720FMEztUo9rf2hDBLfcHtENSZNA3U=";
   };
 
-  cargoHash = "sha256-wJuWeoS45ikP12S2o6aB2Iogw5HomXzCIjkFbp3rSR4=";
+  cargoHash = "sha256-sNxD8rDkfUw5aVhRYpYftpPMiWhiTYDdShlVZvx2BHk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
+  ## v0.5.0 panics when trying to generate zsh completions due to a bug.
+  ## See https://github.com/rustic-rs/rustic/issues/533
+  ## and https://github.com/rustic-rs/rustic/pull/536
   postInstall = ''
-    for shell in {ba,fi,z}sh; do
+    for shell in {ba,fi}sh; do
       $out/bin/rustic completions $shell > rustic.$shell
     done
 
-    installShellCompletion rustic.{ba,fi,z}sh
+    installShellCompletion rustic.{ba,fi}sh
   '';
 
   meta = {

From c9e77048fbeb2d1e0bd792020e7ce22c4a77ed63 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Tue, 28 Mar 2023 11:30:05 +0200
Subject: [PATCH 47/56] typst: 23-03-21-2 -> 23-03-28

---
 pkgs/tools/typesetting/typst/Cargo.lock  | 26 +++++++++++++++---------
 pkgs/tools/typesetting/typst/default.nix | 22 +++++---------------
 2 files changed, 21 insertions(+), 27 deletions(-)

diff --git a/pkgs/tools/typesetting/typst/Cargo.lock b/pkgs/tools/typesetting/typst/Cargo.lock
index fe52185931f8..c595674ad62c 100644
--- a/pkgs/tools/typesetting/typst/Cargo.lock
+++ b/pkgs/tools/typesetting/typst/Cargo.lock
@@ -58,8 +58,9 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "biblatex"
-version = "0.6.3"
-source = "git+https://github.com/typst/biblatex#932ad283dd45dd88d4fa14dc5b9bda7a270ba027"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc17a7f4d461f93f5dbbae4c961746cb4aafb5c6c1a61089a86836614932a3c"
 dependencies = [
  "chrono",
  "numerals",
@@ -159,8 +160,9 @@ checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
 [[package]]
 name = "comemo"
-version = "0.1.0"
-source = "git+https://github.com/typst/comemo#9b520e8f5284d1c39d0bb13eb426f923972775f8"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22bf2c21093020535dd771993fedae8dd55393a4258cca501a9b55a962d350a5"
 dependencies = [
  "comemo-macros",
  "siphasher",
@@ -168,8 +170,9 @@ dependencies = [
 
 [[package]]
 name = "comemo-macros"
-version = "0.1.0"
-source = "git+https://github.com/typst/comemo#9b520e8f5284d1c39d0bb13eb426f923972775f8"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9faa23f4534253fa656b176ff524d5cd7306a6fed3048929f9cc01ab38ab5a5a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -430,8 +433,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hayagriva"
-version = "0.1.1"
-source = "git+https://github.com/typst/hayagriva#754efb7e1034bcd4d4f1366e432197edbbfb9ed5"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33f939b9606af811242f770582c89a2f8bb5de4e531c0a1df9d2d4906bcbc32a"
 dependencies = [
  "biblatex",
  "chrono",
@@ -844,7 +848,8 @@ checksum = "db8bcd96cb740d03149cbad5518db9fd87126a10ab519c011893b1754134c468"
 [[package]]
 name = "pixglyph"
 version = "0.1.0"
-source = "git+https://github.com/typst/pixglyph#e3ff0272d6723cdada91a00b0c99cda0e5adb56d"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eefadd393715fe315c8cdcd587f893b818a6dfe4f6f9faeb44b764c7c38fd8b"
 dependencies = [
  "ttf-parser 0.18.1",
 ]
@@ -1500,7 +1505,8 @@ checksum = "e5464a87b239f13a63a501f2701565754bae92d243d4bb7eb12f6d57d2269bf4"
 [[package]]
 name = "unicode-math-class"
 version = "0.1.0"
-source = "git+https://github.com/typst/unicode-math-class#a7ac7dd75cd79ab2e0bdb629036cb913371608d2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d246cf599d5fae3c8d56e04b20eb519adb89a8af8d0b0fbcded369aa3647d65"
 
 [[package]]
 name = "unicode-normalization"
diff --git a/pkgs/tools/typesetting/typst/default.nix b/pkgs/tools/typesetting/typst/default.nix
index 0e4cdfcb9a30..ed5473892e4c 100644
--- a/pkgs/tools/typesetting/typst/default.nix
+++ b/pkgs/tools/typesetting/typst/default.nix
@@ -7,25 +7,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typst";
-  version = "23-03-21-2";
+  version = "23-03-28";
 
   src = fetchFromGitHub {
     owner = "typst";
     repo = "typst";
     rev = "v${version}";
-    hash = "sha256-bJPGs/Bd9nKYDrCCaFT+20+1wTN4YdkV8bGrtOCR4tM=";
+    hash = "sha256-0fTGbXdpzPadABWqdReQNZf2N7OMZ8cs9U5fmhfN6m4=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "biblatex-0.6.3" = "sha256-TfH2tk7B61HHqpdGY48TdPKelp4+78x+8LRFobAg8QA=";
-      "comemo-0.1.0" = "sha256-zg056kUc8sVLQ8vvT4uOuRJnyrCORsGYUvsjBJEkFPg=";
-      "hayagriva-0.1.1" = "sha256-HGQ+jNAnejxUBQNaqXPw57zfAC3qNXSWUVzDALZTXg0=";
       "iai-0.1.1" = "sha256-EdNzCPht5chg7uF9O8CtPWR/bzSYyfYIXNdLltqdlR0=";
       "lipsum-0.8.2" = "sha256-deIbpn4YM7/NeuJ5Co48ivJmxwrcsbLl6c3cP3JZxAQ=";
-      "pixglyph-0.1.0" = "sha256-8veNF3rzV21ayzk9gh2x0mQA8nHGM662ohvh084a0vk=";
-      "unicode-math-class-0.1.0" = "sha256-NkwDzj1SfUe570UcfotmVP6bIEYwiegZd0j8TPEWoOk=";
     };
   };
 
@@ -36,20 +31,13 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = [ "-p" "typst-cli" ];
   cargoTestFlags = [ "-p" "typst-cli" ];
 
-  # the build script tries to get the revision using git
-  # which overwrites the environment variable set below
-  postPatch = ''
-    rm cli/build.rs
-  '';
-
-  # git revision used for `--version`
-  # https://github.com/typst/typst/blob/b934a2fd83d63fc115c01f959e888c7bc1aa87e4/cli/build.rs#L7
-  TYPST_HASH = "b934a2fd";
+  # https://github.com/typst/typst/blob/056d15a/cli/src/main.rs#L164
+  TYPST_VERSION = version;
 
   meta = with lib; {
     description = "A new markup-based typesetting system that is powerful and easy to learn";
     homepage = "https://typst.app";
     license = licenses.asl20;
-    maintainers = with maintainers; [ figsoda kanashimia ];
+    maintainers = with maintainers; [ drupol figsoda kanashimia ];
   };
 }

From ad103077d9ed9959cecea32a5e89ca79a17e4667 Mon Sep 17 00:00:00 2001
From: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
Date: Tue, 28 Mar 2023 10:30:02 -0300
Subject: [PATCH 48/56] svu: init at 1.10.2 (#223393)

---
 pkgs/tools/misc/svu/default.nix | 31 +++++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix |  2 ++
 2 files changed, 33 insertions(+)
 create mode 100644 pkgs/tools/misc/svu/default.nix

diff --git a/pkgs/tools/misc/svu/default.nix b/pkgs/tools/misc/svu/default.nix
new file mode 100644
index 000000000000..62568696c42d
--- /dev/null
+++ b/pkgs/tools/misc/svu/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildGoModule, fetchFromGitHub, testers, svu }:
+
+buildGoModule rec {
+  pname = "svu";
+  version = "1.10.2";
+
+  src = fetchFromGitHub {
+    owner = "caarlos0";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "37AT+ygN7u3KfFqr26M9c7aTt15z8m4PBrSd+G5mJcE=";
+  };
+
+  vendorHash = "sha256-+e1oL08KvBSNaRepGR2SBBrEDJaGxl5V9rOBysGEfQs=";
+
+  ldflags = [ "-s" "-w" "-X=main.version=${version}" "-X=main.builtBy=nixpkgs" ];
+
+  # test assumes source directory to be a git repository
+  postPatch = ''
+    rm internal/git/git_test.go
+  '';
+
+  passthru.tests.version = testers.testVersion { package = svu; };
+
+  meta = with lib; {
+    description = "Semantic Version Util";
+    homepage = "https://github.com/caarlos0/svu";
+    maintainers = with maintainers; [ caarlos0 ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 50a72b68608b..bf9e382dd6d4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12426,6 +12426,8 @@ with pkgs;
 
   svgcleaner = callPackage ../tools/graphics/svgcleaner { };
 
+  svu = callPackage ../tools/misc/svu { };
+
   ssb = callPackage ../tools/security/ssb { };
 
   ssb-patchwork = callPackage ../applications/networking/ssb-patchwork { };

From 4766c30e4df6a3a32cc79145c9f7ed497cc7ba12 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Tue, 28 Mar 2023 16:44:47 +0300
Subject: [PATCH 49/56] audacity: fix build on x86_64-darwin (#223386)

---
 pkgs/applications/audio/audacity/default.nix | 6 +++---
 pkgs/top-level/all-packages.nix              | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 6d8f279dadbd..24d610f62d02 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -75,6 +75,8 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString stdenv.isLinux ''
     substituteInPlace libraries/lib-files/FileNames.cpp \
       --replace /usr/include/linux/magic.h ${linuxHeaders}/include/linux/magic.h
+  '' + lib.optionalString (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinMinVersion "11.0") ''
+    sed -z -i "s/NSAppearanceName.*systemAppearance//" src/AudacityApp.mm
   '';
 
   nativeBuildInputs = [
@@ -93,9 +95,6 @@ stdenv.mkDerivation rec {
     ffmpeg_4
     file
     flac
-  ] ++ lib.optionals stdenv.isDarwin [
-    AppKit
-  ] ++ [
     gtk3
     lame
     libid3tag
@@ -135,6 +134,7 @@ stdenv.mkDerivation rec {
     libuuid
     util-linux
   ] ++ lib.optionals stdenv.isDarwin [
+    AppKit
     CoreAudioKit # for portaudio
     libpng
     libjpeg
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bf9e382dd6d4..2040db59dfae 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -28705,8 +28705,8 @@ with pkgs;
   };
   audaciousQt5 = audacious;
 
-  audacity = darwin.apple_sdk_11_0.callPackage ../applications/audio/audacity {
-    inherit (darwin.apple_sdk_11_0.frameworks) AppKit CoreAudioKit;
+  audacity = callPackage ../applications/audio/audacity {
+    inherit (darwin.apple_sdk.frameworks) AppKit CoreAudioKit;
   };
 
   audio-recorder = callPackage ../applications/audio/audio-recorder { };

From 5a8991c6b34fc62793f3996cb4614595d5d13a6c Mon Sep 17 00:00:00 2001
From: Ulrik Strid <ulrik.strid@outlook.com>
Date: Tue, 28 Mar 2023 16:17:52 +0200
Subject: [PATCH 50/56] Fix dune-configurator

---
 .../ocaml-modules/dune-configurator/default.nix    | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/ocaml-modules/dune-configurator/default.nix b/pkgs/development/ocaml-modules/dune-configurator/default.nix
index f5303db9a3b5..862e0d01d598 100644
--- a/pkgs/development/ocaml-modules/dune-configurator/default.nix
+++ b/pkgs/development/ocaml-modules/dune-configurator/default.nix
@@ -1,17 +1,21 @@
-{ lib, buildDunePackage, dune_2, csexp, result }:
+{ lib, buildDunePackage, dune_3, csexp }:
 
 buildDunePackage rec {
   pname = "dune-configurator";
 
-  useDune2 = true;
+  inherit (dune_3) src version;
 
-  inherit (dune_2) src version patches;
+  # This fixes finding csexp
+  postPatch = ''
+    rm -rf ./vendor
+  '';
 
-  minimumOCamlVersion = "4.03";
+  minimumOCamlVersion = "4.04";
 
+  duneVersion = "3";
   dontAddPrefix = true;
 
-  propagatedBuildInputs = [ csexp result ];
+  propagatedBuildInputs = [ csexp ];
 
   meta = with lib; {
     description = "Helper library for gathering system configuration";

From f79bec0b3a3f3d56fe7ad39b280da7a0ac7a9477 Mon Sep 17 00:00:00 2001
From: "Ricardo M. Correia" <rcorreia@wizy.org>
Date: Tue, 28 Mar 2023 14:13:11 +0000
Subject: [PATCH 51/56] zfs: remove myself from maintainers

---
 pkgs/os-specific/linux/zfs/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 750586ff1b1d..8655bd2ed323 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -210,7 +210,7 @@ let
         changelog = "https://github.com/openzfs/zfs/releases/tag/zfs-${version}";
         license = lib.licenses.cddl;
         platforms = lib.platforms.linux;
-        maintainers = with lib.maintainers; [ jcumming jonringer wizeman globin raitobezarius ];
+        maintainers = with lib.maintainers; [ jcumming jonringer globin raitobezarius ];
         mainProgram = "zfs";
         # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
         # On NixOS set the option boot.zfs.enableUnstable.

From ce251cd8a948e3d82047b4a3d3825c680af63bd7 Mon Sep 17 00:00:00 2001
From: "Ricardo M. Correia" <rcorreia@wizy.org>
Date: Tue, 28 Mar 2023 14:13:33 +0000
Subject: [PATCH 52/56] transmission: remove myself from maintainers

---
 pkgs/applications/networking/p2p/transmission/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index 8f44d79f817d..403b0bc9e87c 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -142,7 +142,7 @@ in stdenv.mkDerivation {
     '';
     homepage = "http://www.transmissionbt.com/";
     license = lib.licenses.gpl2Plus; # parts are under MIT
-    maintainers = with lib.maintainers; [ astsmtl vcunat wizeman ];
+    maintainers = with lib.maintainers; [ astsmtl vcunat ];
     platforms = lib.platforms.unix;
   };
 

From 81487980879ff04d1f94a65a06831a42dc75a1db Mon Sep 17 00:00:00 2001
From: Ruixi-rebirth <ruixirebirth@gmail.com>
Date: Tue, 28 Mar 2023 22:06:43 +0800
Subject: [PATCH 53/56] go-musicfox: 3.7.5 -> 3.7.7

---
 pkgs/applications/audio/go-musicfox/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/go-musicfox/default.nix b/pkgs/applications/audio/go-musicfox/default.nix
index da54f07dfb00..40ecd0dd21a6 100644
--- a/pkgs/applications/audio/go-musicfox/default.nix
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@@ -10,13 +10,13 @@
 # gcc only supports objc on darwin
 buildGoModule.override { stdenv = clangStdenv; } rec {
   pname = "go-musicfox";
-  version = "3.7.5";
+  version = "3.7.7";
 
   src = fetchFromGitHub {
     owner = "anhoder";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+0s+MCFLw527gFj7pfiYGfKYihthFjRLPeto2SbALw0=";
+    hash = "sha256-gQPr+mCZ7tnASs/ibow1b0Qj3ppZhdgP4U1Vxo+FfE4=";
   };
 
   deleteVendor = true;

From bca930867614ab4edcb9164a0ca6dce7fc6d4b17 Mon Sep 17 00:00:00 2001
From: MGlolenstine <mglolenstine@gmail.com>
Date: Mon, 20 Mar 2023 19:53:59 +0100
Subject: [PATCH 54/56] shell_gpt: init at 0.7.3

---
 pkgs/tools/misc/shell_gpt/default.nix | 40 +++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix       |  2 ++
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/tools/misc/shell_gpt/default.nix

diff --git a/pkgs/tools/misc/shell_gpt/default.nix b/pkgs/tools/misc/shell_gpt/default.nix
new file mode 100644
index 000000000000..695ceb15fe04
--- /dev/null
+++ b/pkgs/tools/misc/shell_gpt/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "shell_gpt";
+  version = "0.7.3";
+
+  src = python3.pkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-lS8zLtsh8Uz782KJwHqifEQnWQswbCXRVIfXWAmWtvI=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    python3.pkgs.pythonRelaxDepsHook
+    python3
+    pip
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    markdown-it-py
+    rich
+    distro
+    typer
+    requests
+  ];
+
+  pythonRelaxDeps = [ "requests" "rich" "distro" "typer" ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    mainProgram = "sgpt";
+    homepage = "https://github.com/TheR1D/shell_gpt";
+    description = "Access ChatGPT from your terminal";
+    platforms = platforms.linux;
+    license = licenses.mit;
+    maintainers = with maintainers; [ mglolenstine ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2040db59dfae..00fd1bb285e3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -33275,6 +33275,8 @@ with pkgs;
 
   shadowfox = callPackage ../tools/networking/shadowfox { };
 
+  shell_gpt = callPackage ../tools/misc/shell_gpt { };
+
   shfmt = callPackage ../tools/text/shfmt { };
 
   shipments = callPackage ../applications/misc/shipments { };

From 445760731092ffa38d03eb9668b17251cf2b7b22 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Tue, 28 Mar 2023 12:37:16 -0300
Subject: [PATCH 55/56] ocamlPackages.dune-configurator: revert last commit

---
 .../ocaml-modules/dune-configurator/default.nix    | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/ocaml-modules/dune-configurator/default.nix b/pkgs/development/ocaml-modules/dune-configurator/default.nix
index 862e0d01d598..cdb1e3fc2005 100644
--- a/pkgs/development/ocaml-modules/dune-configurator/default.nix
+++ b/pkgs/development/ocaml-modules/dune-configurator/default.nix
@@ -1,21 +1,17 @@
-{ lib, buildDunePackage, dune_3, csexp }:
+{ lib, buildDunePackage, dune_2, csexp, result }:
 
 buildDunePackage rec {
   pname = "dune-configurator";
 
-  inherit (dune_3) src version;
+  inherit (dune_2) src version patches;
 
-  # This fixes finding csexp
-  postPatch = ''
-    rm -rf ./vendor
-  '';
+  duneVersion = "2";
 
-  minimumOCamlVersion = "4.04";
+  minimalOCamlVersion = "4.03";
 
-  duneVersion = "3";
   dontAddPrefix = true;
 
-  propagatedBuildInputs = [ csexp ];
+  propagatedBuildInputs = [ csexp result ];
 
   meta = with lib; {
     description = "Helper library for gathering system configuration";

From 49079a134fd3d3ac25d5ae1f5516f37770f19138 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Mar 2023 05:52:38 +0000
Subject: [PATCH 56/56] tkrzw: 1.0.26 -> 1.0.27

---
 pkgs/development/libraries/tkrzw/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/tkrzw/default.nix b/pkgs/development/libraries/tkrzw/default.nix
index 843eb2f5b103..b3e8c8fbae28 100644
--- a/pkgs/development/libraries/tkrzw/default.nix
+++ b/pkgs/development/libraries/tkrzw/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "tkrzw";
-  version = "1.0.26";
+  version = "1.0.27";
   # TODO: defeat multi-output reference cycles
 
   src = fetchurl {
     url = "https://dbmx.net/tkrzw/pkg/tkrzw-${version}.tar.gz";
-    hash = "sha256-vbuzV4ZZnb0Vl+U9B8BorDD7mHQ7ILwkR35GaFs+aTI=";
+    hash = "sha256-DxLtDtscTPR1yzeOENyQPylKo+VxJTswUAE/MieEoXQ=";
   };
 
   postPatch = ''