Merge master into haskell-updates

2024-09-20 12:29:02 +02:00 · 2023-11-12 00:13:27 +00:00 · 2023-11-12 00:13:27 +00:00 · 03b2d8c501
parent 1e513f33ee 647a6f42ee
commit 03b2d8c501
327 changed files with 3191 additions and 5418 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -353,7 +353,7 @@ In a case a contributor definitively leaves the Nix community, they should creat
 # Flow of merged pull requests

 After a pull request is merged, it eventually makes it to the [official Hydra CI](https://hydra.nixos.org/).
-Hydra regularly evaluates and builds Nixpkgs, updating [the official channels](http://channels.nixos.org/) when specific Hydra jobs succeeded.
+Hydra regularly evaluates and builds Nixpkgs, updating [the official channels](https://channels.nixos.org/) when specific Hydra jobs succeeded.
 See [Nix Channel Status](https://status.nixos.org/) for the current channels and their state.
 Here's a brief overview of the main Git branches and what channels they're used for:

--- a/doc/languages-frameworks/lisp.section.md
+++ b/doc/languages-frameworks/lisp.section.md
@ -66,7 +66,7 @@ buildPhase = ''
 To save some work of writing Nix expressions, there is a script that imports all
 the packages distributed by Quicklisp into `imported.nix`. This works by parsing
 its `releases.txt` and `systems.txt` files, which are published every couple of
-months on [quicklisp.org](http://beta.quicklisp.org/dist/quicklisp.txt).
+months on [quicklisp.org](https://beta.quicklisp.org/dist/quicklisp.txt).

 The import process is implemented in the `import` directory as Common Lisp
 code in the `org.lispbuilds.nix` ASDF system. To run the script, one can
--- a/doc/packages/steam.section.md
+++ b/doc/packages/steam.section.md
@ -11,7 +11,7 @@ Nix problems and constraints:
 - The `steam.sh` script in `$HOME` cannot be patched, as it is checked and rewritten by steam.
 - The steam binary cannot be patched, it's also checked.

-The current approach to deploy Steam in NixOS is composing a FHS-compatible chroot environment, as documented [here](http://sandervanderburg.blogspot.nl/2013/09/composing-fhs-compatible-chroot.html). This allows us to have binaries in the expected paths without disrupting the system, and to avoid patching them to work in a non FHS environment.
+The current approach to deploy Steam in NixOS is composing a FHS-compatible chroot environment, as documented [here](https://sandervanderburg.blogspot.com/2013/09/composing-fhs-compatible-chroot.html). This allows us to have binaries in the expected paths without disrupting the system, and to avoid patching them to work in a non FHS environment.

 ## How to play {#sec-steam-play}

--- a/doc/using/overlays.chapter.md
+++ b/doc/using/overlays.chapter.md
@ -77,7 +77,7 @@ In Nixpkgs, we have multiple implementations of the BLAS/LAPACK numerical linear

    The Nixpkgs attribute is `openblas` for ILP64 (integer width = 64 bits) and `openblasCompat` for LP64 (integer width = 32 bits).  `openblasCompat` is the default.

-   [LAPACK reference](http://www.netlib.org/lapack/) (also provides BLAS and CBLAS)
+-   [LAPACK reference](https://www.netlib.org/lapack/) (also provides BLAS and CBLAS)

    The Nixpkgs attribute is `lapack-reference`.

--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -516,17 +516,17 @@ in mkLicense lset) ({

  generaluser = {
    fullName = "GeneralUser GS License v2.0";
-    url = "http://www.schristiancollins.com/generaluser.php"; # license included in sources
+    url = "https://www.schristiancollins.com/generaluser.php"; # license included in sources
  };

  gfl = {
    fullName = "GUST Font License";
-    url = "http://www.gust.org.pl/fonts/licenses/GUST-FONT-LICENSE.txt";
+    url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-LICENSE.txt";
  };

  gfsl = {
    fullName = "GUST Font Source License";
-    url = "http://www.gust.org.pl/fonts/licenses/GUST-FONT-SOURCE-LICENSE.txt";
+    url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-SOURCE-LICENSE.txt";
  };

  gpl1Only = {
@ -613,7 +613,7 @@ in mkLicense lset) ({
  info-zip = {
    spdxId = "Info-ZIP";
    fullName = "Info-ZIP License";
-    url = "http://www.info-zip.org/pub/infozip/license.html";
+    url = "https://infozip.sourceforge.net/license.html";
  };

  inria-compcert = {
@ -1182,7 +1182,7 @@ in mkLicense lset) ({

  xfig = {
    fullName = "xfig";
-    url = "http://mcj.sourceforge.net/authors.html#xfig"; # https is broken
+    url = "https://mcj.sourceforge.net/authors.html#xfig";
  };

  zlib = {
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -12478,6 +12478,11 @@
    githubId = 6709831;
    name = "Jake Hill";
  };
+  nasageek = {
+    github = "NasaGeek";
+    githubId = 474937;
+    name = "Chris Roberts";
+  };
  nasirhm = {
    email = "nasirhussainm14@gmail.com";
    github = "nasirhm";
@ -12868,13 +12873,6 @@
      fingerprint = "9B1A 7906 5D2F 2B80 6C8A  5A1C 7D2A CDAF 4653 CF28";
    }];
  };
-  ninjatrappeur = {
-    email = "felix@alternativebit.fr";
-    matrix = "@ninjatrappeur:matrix.org";
-    github = "NinjaTrappeur";
-    githubId = 1219785;
-    name = "Félix Baylac-Jacqué";
-  };
  nintron = {
    email = "nintron@sent.com";
    github = "Nintron27";
@ -13979,6 +13977,13 @@
    githubId = 627831;
    name = "Hoang Xuan Phu";
  };
+  picnoir = {
+    email = "felix@alternativebit.fr";
+    matrix = "@picnoir:alternativebit.fr";
+    github = "picnoir";
+    githubId = 1219785;
+    name = "Félix Baylac-Jacqué";
+  };
  piegames = {
    name = "piegames";
    email = "nix@piegames.de";
@ -16495,12 +16500,6 @@
    githubId = 158321;
    name = "Stewart Mackenzie";
  };
-  skeidel = {
-    email = "svenkeidel@gmail.com";
-    github = "svenkeidel";
-    githubId = 266500;
-    name = "Sven Keidel";
-  };
  skykanin = {
    github = "skykanin";
    githubId = 3789764;
--- a/maintainers/scripts/haskell/upload-nixos-package-list-to-hackage.sh
+++ b/maintainers/scripts/haskell/upload-nixos-package-list-to-hackage.sh
@ -39,5 +39,5 @@ fi
 package_list="$(nix-build -A haskell.package-list)/nixos-hackage-packages.csv"
 username=$(grep "^username:" "$CABAL_DIR/config" | sed "s/^username: //")
 password_command=$(grep "^password-command:" "$CABAL_DIR/config" | sed "s/^password-command: //")
-curl -u "$username:$($password_command | head -n1)" --digest -H "Content-type: text/csv" -T "$package_list" http://hackage.haskell.org/distro/NixOS/packages.csv
+curl -u "$username:$($password_command | head -n1)" --digest -H "Content-type: text/csv" -T "$package_list" https://hackage.haskell.org/distro/NixOS/packages.csv
 echo
--- a/nixos/doc/manual/configuration/subversion.chapter.md
+++ b/nixos/doc/manual/configuration/subversion.chapter.md
@ -2,7 +2,7 @@

 [Subversion](https://subversion.apache.org/) is a centralized
 version-control system. It can use a [variety of
-protocols](http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.choosing)
+protocols](https://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.choosing)
 for communication between client and server.

 ## Subversion inside Apache HTTP {#module-services-subversion-apache-httpd}
@ -14,7 +14,7 @@ for communication.

 For more information on the general setup, please refer to the [the
 appropriate section of the Subversion
-book](http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.httpd).
+book](https://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.httpd).

 To configure, include in `/etc/nixos/configuration.nix` code to activate
 Apache HTTP, setting [](#opt-services.httpd.adminAddr)
--- a/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
+++ b/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
@ -62,7 +62,7 @@ where socat is running.
 If your test has only a single VM, you may use e.g.

 ```ShellSession
-$ QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:2222-127.0.0.1:22" ./result/bin/nixos-test-driver
+$ QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:2222-:22" ./result/bin/nixos-test-driver
 ```

 to port-forward a port in the VM (here `22`) to the host machine (here port `2222`).
@ -73,6 +73,11 @@ since a single port on the host cannot forward to multiple VMs.
 If the test defines multiple machines, you may opt to _temporarily_ set
 `virtualisation.forwardPorts` in the test definition for debugging.

+Such port forwardings connect via the VM's virtual network interface.
+Thus they cannot connect to ports that are only bound to the VM's
+loopback interface (`127.0.0.1`), and the VM's NixOS firewall
+must be configured to allow these connections.
+
 ## Reuse VM state {#sec-nixos-test-reuse-vm-state}

 You can re-use the VM states coming from a previous run by setting the
--- a/nixos/doc/manual/development/writing-documentation.chapter.md
+++ b/nixos/doc/manual/development/writing-documentation.chapter.md
@ -33,13 +33,13 @@ symlink at `./result/share/doc/nixos/index.html`.
 ## Editing DocBook XML {#sec-writing-docs-editing-docbook-xml}

 For general information on how to write in DocBook, see [DocBook 5: The
-Definitive Guide](http://www.docbook.org/tdg5/en/html/docbook.html).
+Definitive Guide](https://tdg.docbook.org/tdg/5.1/).

 Emacs nXML Mode is very helpful for editing DocBook XML because it
 validates the document as you write, and precisely locates errors. To
 use it, see [](#sec-emacs-docbook-xml).

-[Pandoc](http://pandoc.org) can generate DocBook XML from a multitude of
+[Pandoc](https://pandoc.org/) can generate DocBook XML from a multitude of
 formats, which makes a good starting point. Here is an example of Pandoc
 invocation to convert GitHub-Flavoured MarkDown to DocBook 5 XML:

@ -62,9 +62,9 @@ topic from scratch.

 Keep the following guidelines in mind when you create and add a topic:

-   The NixOS [`book`](http://www.docbook.org/tdg5/en/html/book.html)
+-   The NixOS [`book`](https://tdg.docbook.org/tdg/5.0/book.html)
    element is in `nixos/doc/manual/manual.xml`. It includes several
-    [`parts`](http://www.docbook.org/tdg5/en/html/book.html) which are in
+    [`parts`](https://tdg.docbook.org/tdg/5.0/book.html) which are in
    subdirectories.

 -   Store the topic file in the same directory as the `part` to which it
--- a/nixos/doc/manual/installation/changing-config.chapter.md
+++ b/nixos/doc/manual/installation/changing-config.chapter.md
@ -89,7 +89,7 @@ guest. For instance, the following will forward host port 2222 to guest
 port 22 (SSH):

 ```ShellSession
-$ QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:2222-127.0.0.1:22" ./result/bin/run-*-vm
+$ QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:2222-:22" ./result/bin/run-*-vm
 ```

 allowing you to log in via SSH (assuming you have set the appropriate
@ -98,3 +98,8 @@ passwords or SSH authorized keys):
 ```ShellSession
 $ ssh -p 2222 localhost
 ```
+
+Such port forwardings connect via the VM's virtual network interface.
+Thus they cannot connect to ports that are only bound to the VM's
+loopback interface (`127.0.0.1`), and the VM's NixOS firewall
+must be configured to allow these connections.
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -153,7 +153,7 @@ let
          {file}`pam_mount.conf.xml`.
          Useful attributes might include `path`,
          `options`, `fstype`, and `server`.
-          See <http://pam-mount.sourceforge.net/pam_mount.conf.5.html>
+          See <https://pam-mount.sourceforge.net/pam_mount.conf.5.html>
          for more information.
        '';
      };
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@ -130,7 +130,7 @@ sub pciCheck {
    debug "\n";

    if (defined $module) {
-        # See the bottom of http://pciids.sourceforge.net/pci.ids for
+        # See the bottom of https://pciids.sourceforge.net/pci.ids for
        # device classes.
        if (# Mass-storage controller.  Definitely important.
            $class =~ /^0x01/ ||
--- a/nixos/modules/programs/npm.nix
+++ b/nixos/modules/programs/npm.nix
@ -34,7 +34,7 @@ in
          prefix = ''${HOME}/.npm
          https-proxy=proxy.example.com
          init-license=MIT
-          init-author-url=http://npmjs.org
+          init-author-url=https://www.npmjs.com/
          color=true
        '';
      };
--- a/nixos/modules/programs/zsh/oh-my-zsh.md
+++ b/nixos/modules/programs/zsh/oh-my-zsh.md
@ -78,7 +78,7 @@ If third-party customizations (e.g. new themes) are supposed to be added to

  - Completion scripts are supposed to be stored at
    `$out/share/zsh/site-functions`. This directory is part of the
-    [`fpath`](http://zsh.sourceforge.net/Doc/Release/Functions.html)
+    [`fpath`](https://zsh.sourceforge.io/Doc/Release/Functions.html)
    and the package should be compatible with pure `ZSH`
    setups. The module will automatically link the contents of
    `site-functions` to completions directory in the proper
--- a/nixos/modules/security/google_oslogin.nix
+++ b/nixos/modules/security/google_oslogin.nix
@ -42,6 +42,10 @@ in
    security.sudo.extraConfig = ''
      #includedir /run/google-sudoers.d
    '';
+    security.sudo-rs.extraConfig = ''
+      #includedir /run/google-sudoers.d
+    '';
+
    systemd.tmpfiles.rules = [
      "d /run/google-sudoers.d 750 root root -"
      "d /var/google-users.d 750 root root -"
--- a/nixos/modules/security/pam_mount.nix
+++ b/nixos/modules/security/pam_mount.nix
@ -33,7 +33,7 @@ in
        default = [];
        description = lib.mdDoc ''
          List of volume definitions for pam_mount.
-          For more information, visit <http://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
+          For more information, visit <https://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
        '';
      };

@ -78,7 +78,7 @@ in
        description = lib.mdDoc ''
          Sets the Debug-Level. 0 disables debugging, 1 enables pam_mount tracing,
          and 2 additionally enables tracing in mount.crypt. The default is 0.
-          For more information, visit <http://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
+          For more information, visit <https://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
        '';
      };

@ -88,7 +88,7 @@ in
        description = lib.mdDoc ''
          Amount of microseconds to wait until killing remaining processes after
          final logout.
-          For more information, visit <http://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
+          For more information, visit <https://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
        '';
      };

--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@ -35,7 +35,7 @@ in
      description = lib.mdDoc
        ''
          Any polkit rules to be added to config (in JavaScript ;-). See:
-          http://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html#polkit-rules
+          <https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html#polkit-rules>
        '';
    };

@ -117,4 +117,3 @@ in
  };

 }
-
--- a/nixos/modules/services/audio/jack.nix
+++ b/nixos/modules/services/audio/jack.nix
@ -225,7 +225,7 @@ in {
        description = "JACK Audio system service user";
        isSystemUser = true;
      };
-      # http://jackaudio.org/faq/linux_rt_config.html
+      # https://jackaudio.org/faq/linux_rt_config.html
      security.pam.loginLimits = [
        { domain = "@jackaudio"; type = "-"; item = "rtprio"; value = "99"; }
        { domain = "@jackaudio"; type = "-"; item = "memlock"; value = "unlimited"; }
--- a/nixos/modules/services/computing/boinc/client.nix
+++ b/nixos/modules/services/computing/boinc/client.nix
@ -54,7 +54,7 @@ in
          only the hosts listed in {var}`dataDir`/remote_hosts.cfg will be allowed to
          connect.

-          See also: <http://boinc.berkeley.edu/wiki/Controlling_BOINC_remotely#Remote_access>
+          See also: <https://boinc.berkeley.edu/wiki/Controlling_BOINC_remotely#Remote_access>
        '';
      };

--- a/nixos/modules/services/computing/slurm/slurm.nix
+++ b/nixos/modules/services/computing/slurm/slurm.nix
@ -6,7 +6,7 @@ let

  cfg = config.services.slurm;
  opt = options.services.slurm;
-  # configuration file can be generated by http://slurm.schedmd.com/configurator.html
+  # configuration file can be generated by https://slurm.schedmd.com/configurator.html

  defaultUser = "slurm";

--- a/nixos/modules/services/databases/couchdb.nix
+++ b/nixos/modules/services/databases/couchdb.nix
@ -79,7 +79,7 @@ in {
        '';
      };

-      # couchdb options: http://docs.couchdb.org/en/latest/config/index.html
+      # couchdb options: https://docs.couchdb.org/en/latest/config/index.html

      databaseDir = mkOption {
        type = types.path;
--- a/nixos/modules/services/databases/firebird.nix
+++ b/nixos/modules/services/databases/firebird.nix
@ -17,7 +17,7 @@
 # There are at least two ways to run firebird. superserver has been chosen
 # however there are no strong reasons to prefer this or the other one AFAIK
 # Eg superserver is said to be most efficiently using resources according to
-# http://www.firebirdsql.org/manual/qsg25-classic-or-super.html
+# https://www.firebirdsql.org/manual/qsg25-classic-or-super.html

 with lib;

--- a/nixos/modules/services/databases/pgmanage.nix
+++ b/nixos/modules/services/databases/pgmanage.nix
@ -66,7 +66,7 @@ in {
        pgmanage requires at least one PostgreSQL server be defined.

        Detailed information about PostgreSQL connection strings is available at:
-        <http://www.postgresql.org/docs/current/static/libpq-connect.html>
+        <https://www.postgresql.org/docs/current/libpq-connect.html>

        Note that you should not specify your user name or password. That
        information will be entered on the login screen. If you specify a
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@ -5,7 +5,7 @@

 *Source:* {file}`modules/services/databases/postgresql.nix`

-*Upstream documentation:* <http://www.postgresql.org/docs/>
+*Upstream documentation:* <https://www.postgresql.org/docs/>

 <!-- FIXME: more stuff, like maintainer? -->

--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@ -588,7 +588,7 @@ in
                   else "simple";

            # Shut down Postgres using SIGINT ("Fast Shutdown mode").  See
-            # http://www.postgresql.org/docs/current/static/server-shutdown.html
+            # https://www.postgresql.org/docs/current/server-shutdown.html
            KillSignal = "SIGINT";
            KillMode = "mixed";

--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@ -63,7 +63,7 @@ in {

      vmOverCommit = mkEnableOption (lib.mdDoc ''
        setting of vm.overcommit_memory to 1
-        (Suggested for Background Saving: http://redis.io/topics/faq)
+        (Suggested for Background Saving: <https://redis.io/docs/get-started/faq/>)
      '');

      servers = mkOption {
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@ -279,7 +279,7 @@ in
      default = true;
      type = types.bool;
      description = lib.mdDoc ''
-        Whether to assign [predictable names to network interfaces](http://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames).
+        Whether to assign [predictable names to network interfaces](https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/).
        If enabled, interfaces
        are assigned names that contain topology information
        (e.g. `wlp3s0`) and thus should be stable
--- a/nixos/modules/services/logging/logstash.nix
+++ b/nixos/modules/services/logging/logstash.nix
@ -123,7 +123,7 @@ in
        example = ''
          if [type] == "syslog" {
            # Keep only relevant systemd fields
-            # http://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html
+            # https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html
            prune {
              whitelist_names => [
                "type", "@timestamp", "@version",
--- a/nixos/modules/services/misc/mediatomb.nix
+++ b/nixos/modules/services/misc/mediatomb.nix
@ -186,7 +186,7 @@ let
  defaultFirewallRules = {
    # udp 1900 port needs to be opened for SSDP (not configurable within
    # mediatomb/gerbera) cf.
-    # http://docs.gerbera.io/en/latest/run.html?highlight=udp%20port#network-setup
+    # https://docs.gerbera.io/en/latest/run.html?highlight=udp%20port#network-setup
    allowedUDPPorts = [ 1900 cfg.port ];
    allowedTCPPorts = [ cfg.port ];
  };
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
@ -25,7 +25,7 @@ let
      || head srvMatch == srv # Include sections for the service being configured
      then v
      # Enable Web links and integrations between services.
-      else if tail srvMatch == [ null ] && elem (head srvMatch) cfg.services
+      else if tail srvMatch == [ null ] && cfg.${head srvMatch}.enable
      then {
        inherit (v) origin;
        # mansrht crashes without it
@ -38,9 +38,9 @@ let
      # for services needing access to them.
      "builds.sr.ht::worker".buildlogs = "/var/log/sourcehut/buildsrht-worker";
      "git.sr.ht".post-update-script = "/usr/bin/gitsrht-update-hook";
-      "git.sr.ht".repos = "/var/lib/sourcehut/gitsrht/repos";
+      "git.sr.ht".repos = cfg.settings."git.sr.ht".repos;
      "hg.sr.ht".changegroup-script = "/usr/bin/hgsrht-hook-changegroup";
-      "hg.sr.ht".repos = "/var/lib/sourcehut/hgsrht/repos";
+      "hg.sr.ht".repos = cfg.settings."hg.sr.ht".repos;
      # Making this a per service option despite being in a global section,
      # so that it uses the redis-server used by the service.
      "sr.ht".redis-host = cfg.${srv}.redis.host;
@ -77,6 +77,14 @@ let
      type = types.path;
      apply = s: "<" + toString s;
    };
+    api-origin = mkOption {
+      description = lib.mdDoc "Origin URL for the API";
+      type = types.str;
+      default = "http://${cfg.listenAddress}:${toString (cfg.${srv}.port + 100)}";
+      defaultText = lib.literalMD ''
+        `"http://''${`[](#opt-services.sourcehut.listenAddress)`}:''${toString (`[](#opt-services.sourcehut.${srv}.port)` + 100)}"`
+      '';
+    };
  };

  # Specialized python containing all the modules
@ -112,15 +120,6 @@ in
      and account management services
    '');

-    services = mkOption {
-      type = with types; listOf (enum
-        [ "builds" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
-      defaultText = "locally enabled services";
-      description = lib.mdDoc ''
-        Services that may be displayed as links in the title bar of the Web interface.
-      '';
-    };
-
    listenAddress = mkOption {
      type = types.str;
      default = "localhost";
@ -400,8 +399,8 @@ in
              This setting is propagated to newer and existing repositories.
            '';
            type = types.str;
-            default = "${cfg.python}/bin/hgsrht-hook-changegroup";
-            defaultText = "\${cfg.python}/bin/hgsrht-hook-changegroup";
+            default = "${pkgs.sourcehut.hgsrht}/bin/hgsrht-hook-changegroup";
+            defaultText = "\${pkgs.sourcehut.hgsrht}/bin/hgsrht-hook-changegroup";
          };
          repos = mkOption {
            description = lib.mdDoc ''
@ -501,12 +500,6 @@ in
        options."meta.sr.ht" =
          removeAttrs (commonServiceSettings "meta")
            ["oauth-client-id" "oauth-client-secret"] // {
-          api-origin = mkOption {
-            description = lib.mdDoc "Origin URL for API, 100 more than web.";
-            type = types.str;
-            default = "http://${cfg.listenAddress}:${toString (cfg.meta.port + 100)}";
-            defaultText = lib.literalMD ''`"http://''${`[](#opt-services.sourcehut.listenAddress)`}:''${toString (`[](#opt-services.sourcehut.meta.port)` + 100)}"`'';
-          };
          webhooks = mkOption {
            description = lib.mdDoc "The Redis connection used for the webhooks worker.";
            type = types.str;
@ -784,6 +777,7 @@ in
        extraConfig = ''
          PermitUserEnvironment SRHT_*
        '';
+        startWhenNeeded = false;
      };
      environment.etc."ssh/sourcehut/config.ini".source =
        settingsFormat.generate "sourcehut-dispatch-config.ini"
@ -792,15 +786,28 @@ in
      environment.etc."ssh/sourcehut/subdir/srht-dispatch" = {
        # sshd_config(5): The program must be owned by root, not writable by group or others
        mode = "0755";
-        source = pkgs.writeShellScript "srht-dispatch" ''
+        source = pkgs.writeShellScript "srht-dispatch-wrapper" ''
          set -e
+          set -x
          cd /etc/ssh/sourcehut/subdir
-          ${cfg.python}/bin/gitsrht-dispatch "$@"
+          ${pkgs.sourcehut.gitsrht}/bin/gitsrht-dispatch "$@"
        '';
      };
+      systemd.tmpfiles.settings."10-sourcehut-gitsrht" = mkIf cfg.git.enable (
+        builtins.listToAttrs (map (name: {
+          name = "/var/log/sourcehut/gitsrht-${name}";
+          value.f = {
+            inherit (cfg.git) user group;
+            mode = "0644";
+          };
+        }) [ "keys" "shell" "update-hook" ])
+      );
      systemd.services.sshd = {
-        #path = optional cfg.git.enable [ cfg.git.package ];
+        preStart = mkIf cfg.hg.enable ''
+          chown ${cfg.hg.user}:${cfg.hg.group} /var/log/sourcehut/hgsrht-keys
+        '';
        serviceConfig = {
+          LogsDirectory = "sourcehut";
          BindReadOnlyPaths =
            # Note that those /usr/bin/* paths are hardcoded in multiple places in *.sr.ht,
            # for instance to get the user from the [git.sr.ht::dispatch] settings.
@ -813,7 +820,6 @@ in
              "${pkgs.writeShellScript "buildsrht-keys-wrapper" ''
                set -e
                cd /run/sourcehut/buildsrht/subdir
-                set -x
                exec -a "$0" ${pkgs.sourcehut.buildsrht}/bin/buildsrht-keys "$@"
              ''}:/usr/bin/buildsrht-keys"
              "${pkgs.sourcehut.buildsrht}/bin/master-shell:/usr/bin/master-shell"
@ -825,31 +831,26 @@ in
              "${pkgs.writeShellScript "gitsrht-keys-wrapper" ''
                set -e
                cd /run/sourcehut/gitsrht/subdir
-                set -x
                exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-keys "$@"
              ''}:/usr/bin/gitsrht-keys"
              "${pkgs.writeShellScript "gitsrht-shell-wrapper" ''
                set -e
                cd /run/sourcehut/gitsrht/subdir
-                set -x
+                export PATH="${cfg.git.package}/bin:$PATH"
+                export SRHT_CONFIG=/run/sourcehut/gitsrht/config.ini
                exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-shell "$@"
              ''}:/usr/bin/gitsrht-shell"
              "${pkgs.writeShellScript "gitsrht-update-hook" ''
                set -e
-                test -e "''${PWD%/*}"/config.ini ||
-                # Git hooks are run relative to their repository's directory,
-                # but gitsrht-update-hook looks up ../config.ini
-                ln -s /run/sourcehut/gitsrht/config.ini "''${PWD%/*}"/config.ini
+                export SRHT_CONFIG=/run/sourcehut/gitsrht/config.ini
                # hooks/post-update calls /usr/bin/gitsrht-update-hook as hooks/stage-3
                # but this wrapper being a bash script, it overrides $0 with /usr/bin/gitsrht-update-hook
                # hence this hack to put hooks/stage-3 back into gitsrht-update-hook's $0
                if test "''${STAGE3:+set}"
                then
-                  set -x
                  exec -a hooks/stage-3 ${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook "$@"
                else
                  export STAGE3=set
-                  set -x
                  exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook "$@"
                fi
              ''}:/usr/bin/gitsrht-update-hook"
@ -860,13 +861,11 @@ in
              "${pkgs.writeShellScript "hgsrht-keys-wrapper" ''
                set -e
                cd /run/sourcehut/hgsrht/subdir
-                set -x
                exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-keys "$@"
              ''}:/usr/bin/hgsrht-keys"
              "${pkgs.writeShellScript "hgsrht-shell-wrapper" ''
                set -e
                cd /run/sourcehut/hgsrht/subdir
-                set -x
                exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-shell "$@"
              ''}:/usr/bin/hgsrht-shell"
              # Mercurial's changegroup hooks are run relative to their repository's directory,
@ -875,8 +874,7 @@ in
                set -e
                test -e "''$PWD"/config.ini ||
                ln -s /run/sourcehut/hgsrht/config.ini "''$PWD"/config.ini
-                set -x
-                exec -a "$0" ${cfg.python}/bin/hgsrht-hook-changegroup "$@"
+                exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-hook-changegroup "$@"
              ''}:/usr/bin/hgsrht-hook-changegroup"
            ];
        };
@ -1066,10 +1064,11 @@ in
          };
        })
      ];
-      extraServices.gitsrht-api = {
-        serviceConfig.Restart = "always";
-        serviceConfig.RestartSec = "5s";
-        serviceConfig.ExecStart = "${pkgs.sourcehut.gitsrht}/bin/gitsrht-api -b ${cfg.listenAddress}:${toString (cfg.git.port + 100)}";
+      extraServices.gitsrht-api.serviceConfig = {
+        Restart = "always";
+        RestartSec = "5s";
+        ExecStart = "${pkgs.sourcehut.gitsrht}/bin/gitsrht-api -b ${cfg.listenAddress}:${toString (cfg.git.port + 100)}";
+        BindPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ];
      };
      extraServices.gitsrht-fcgiwrap = mkIf cfg.nginx.enable {
        serviceConfig = {
@ -1188,7 +1187,7 @@ in
      extraServices.listssrht-lmtp = {
        wants = [ "postfix.service" ];
        unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service";
-        serviceConfig.ExecStart = "${cfg.python}/bin/listssrht-lmtp";
+        serviceConfig.ExecStart = "${pkgs.sourcehut.listssrht}/bin/listssrht-lmtp";
        # Avoid crashing: os.chown(sock, os.getuid(), sock_gid)
        serviceConfig.PrivateUsers = mkForce false;
      };
@ -1252,55 +1251,30 @@ in
          ) cfg.settings));
        serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b ${cfg.listenAddress}:${toString (cfg.meta.port + 100)}";
      };
-      extraConfig = mkMerge [
-        {
-          assertions = [
-            { assertion = let s = cfg.settings."meta.sr.ht::billing"; in
-                          s.enabled == "yes" -> (s.stripe-public-key != null && s.stripe-secret-key != null);
-              message = "If meta.sr.ht::billing is enabled, the keys must be defined.";
-            }
-          ];
-          environment.systemPackages = optional cfg.meta.enable
-            (pkgs.writeShellScriptBin "metasrht-manageuser" ''
-              set -eux
-              if test "$(${pkgs.coreutils}/bin/id -n -u)" != '${cfg.meta.user}'
-              then exec sudo -u '${cfg.meta.user}' "$0" "$@"
-              else
-                # In order to load config.ini
-                if cd /run/sourcehut/metasrht
-                then exec ${cfg.python}/bin/metasrht-manageuser "$@"
-                else cat <<EOF
-                  Please run: sudo systemctl start metasrht
-              EOF
-                  exit 1
-                fi
+      extraConfig = {
+        assertions = [
+          { assertion = let s = cfg.settings."meta.sr.ht::billing"; in
+                        s.enabled == "yes" -> (s.stripe-public-key != null && s.stripe-secret-key != null);
+            message = "If meta.sr.ht::billing is enabled, the keys must be defined.";
+          }
+        ];
+        environment.systemPackages = optional cfg.meta.enable
+          (pkgs.writeShellScriptBin "metasrht-manageuser" ''
+            set -eux
+            if test "$(${pkgs.coreutils}/bin/id -n -u)" != '${cfg.meta.user}'
+            then exec sudo -u '${cfg.meta.user}' "$0" "$@"
+            else
+              # In order to load config.ini
+              if cd /run/sourcehut/metasrht
+              then exec ${pkgs.sourcehut.metasrht}/bin/metasrht-manageuser "$@"
+              else cat <<EOF
+                Please run: sudo systemctl start metasrht
+            EOF
+                exit 1
              fi
-            '');
-        }
-        (mkIf cfg.nginx.enable {
-          services.nginx.virtualHosts."meta.${domain}" = {
-            locations."/query" = {
-              proxyPass = cfg.settings."meta.sr.ht".api-origin;
-              extraConfig = ''
-                if ($request_method = 'OPTIONS') {
-                  add_header 'Access-Control-Allow-Origin' '*';
-                  add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
-                  add_header 'Access-Control-Allow-Headers' 'User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
-                  add_header 'Access-Control-Max-Age' 1728000;
-                  add_header 'Content-Type' 'text/plain; charset=utf-8';
-                  add_header 'Content-Length' 0;
-                  return 204;
-                }
-
-                add_header 'Access-Control-Allow-Origin' '*';
-                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
-                add_header 'Access-Control-Allow-Headers' 'User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
-                add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
-              '';
-            };
-          };
-        })
-      ];
+            fi
+          '');
+      };
    })

    (import ./service.nix "pages" {
@ -1356,7 +1330,7 @@ in
      extraServices.todosrht-lmtp = {
        wants = [ "postfix.service" ];
        unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service";
-        serviceConfig.ExecStart = "${cfg.python}/bin/todosrht-lmtp";
+        serviceConfig.ExecStart = "${pkgs.sourcehut.todosrht}/bin/todosrht-lmtp";
        # Avoid crashing: os.chown(sock, os.getuid(), sock_gid)
        serviceConfig.PrivateUsers = mkForce false;
      };
@ -1388,6 +1362,10 @@ in
        dispatch is deprecated. See https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/
        for more information.
    '')
+
+    (mkRemovedOptionModule [ "services" "sourcehut" "services"] ''
+        This option was removed in favor of individual <service>.enable flags.
+    '')
  ];

  meta.doc = ./default.md;
--- a/nixos/modules/services/misc/sourcehut/service.nix
+++ b/nixos/modules/services/misc/sourcehut/service.nix
@ -108,7 +108,7 @@ let
      #SocketBindDeny = "any";
      SystemCallFilter = [
        "@system-service"
-        "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@timer"
+        "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@timer"
        "@chown" "@setuid"
      ];
      SystemCallArchitectures = "native";
@ -222,6 +222,23 @@ in
            expires 30d;
          '';
        };
+        locations."/query" = mkIf (cfg.settings.${iniKey} ? api-origin) {
+          proxyPass = cfg.settings.${iniKey}.api-origin;
+          extraConfig = ''
+            add_header 'Access-Control-Allow-Origin' '*';
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+            add_header 'Access-Control-Allow-Headers' 'User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
+
+            if ($request_method = 'OPTIONS') {
+              add_header 'Access-Control-Max-Age' 1728000;
+              add_header 'Content-Type' 'text/plain; charset=utf-8';
+              add_header 'Content-Length' 0;
+              return 204;
+            }
+
+            add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
+          '';
+        };
      } cfg.nginx.virtualHost ];
    };

@ -236,9 +253,6 @@ in
        }) [srvCfg.user];
    };

-    services.sourcehut.services = mkDefault (filter (s: cfg.${s}.enable)
-      [ "builds" "dispatch" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
-
    services.sourcehut.settings = mkMerge [
      {
        "${srv}.sr.ht".origin = mkDefault "https://${srv}.${cfg.settings."sr.ht".global-domain}";
@ -363,6 +377,20 @@ in
        }
        extraService
      ])) extraServices)
+
+      # Work around 'pq: permission denied for schema public' with postgres v15, until a
+      # solution for `services.postgresql.ensureUsers` is found.
+      # See https://github.com/NixOS/nixpkgs/issues/216989
+      # Workaround taken from nixos/forgejo: https://github.com/NixOS/nixpkgs/pull/262741
+      (lib.mkIf (
+          cfg.postgresql.enable
+          && lib.strings.versionAtLeast config.services.postgresql.package.version "15.0"
+        ) {
+          postgresql.postStart = (lib.mkAfter ''
+            $PSQL -tAc 'ALTER DATABASE "${srvCfg.postgresql.database}" OWNER TO "${srvCfg.user}";'
+          '');
+        }
+      )
    ];

    systemd.timers = mapAttrs (timerName: timer:
--- a/nixos/modules/services/monitoring/bosun.nix
+++ b/nixos/modules/services/monitoring/bosun.nix
@ -108,7 +108,7 @@ in {
          option.

          A detailed description of the supported syntax can be found at-spi2-atk
-          http://bosun.org/configuration.html
+          https://bosun.org/configuration.html
        '';
      };

--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@ -88,7 +88,7 @@ let
  # Get a submodule without any embedded metadata:
  _filter = x: filterAttrs (k: v: k != "_module") x;

-  # http://docs.grafana.org/administration/provisioning/#datasources
+  # https://grafana.com/docs/grafana/latest/administration/provisioning/#datasources
  grafanaTypes.datasourceConfig = types.submodule {
    freeformType = provisioningSettingsFormat.type;

@ -140,7 +140,7 @@ let
    };
  };

-  # http://docs.grafana.org/administration/provisioning/#dashboards
+  # https://grafana.com/docs/grafana/latest/administration/provisioning/#dashboards
  grafanaTypes.dashboardConfig = types.submodule {
    freeformType = provisioningSettingsFormat.type;

--- a/nixos/modules/services/monitoring/graphite.nix
+++ b/nixos/modules/services/monitoring/graphite.nix
@ -102,7 +102,7 @@ in {
        default = "";
        description = lib.mdDoc ''
          Graphite webapp settings. See:
-          <http://graphite.readthedocs.io/en/latest/config-local-settings.html>
+          <https://graphite.readthedocs.io/en/latest/config-local-settings.html>
        '';
      };
    };
--- a/nixos/modules/services/monitoring/munin.nix
+++ b/nixos/modules/services/monitoring/munin.nix
@ -4,7 +4,7 @@
 # TODO: LWP/Pg perl libs aren't recognized

 # TODO: support fastcgi
-# http://guide.munin-monitoring.org/en/latest/example/webserver/apache-cgi.html
+# https://guide.munin-monitoring.org/en/latest/example/webserver/apache-cgi.html
 # spawn-fcgi -s /run/munin/fastcgi-graph.sock -U www-data   -u munin -g munin /usr/lib/munin/cgi/munin-cgi-graph
 # spawn-fcgi -s /run/munin/fastcgi-html.sock  -U www-data   -u munin -g munin /usr/lib/munin/cgi/munin-cgi-html
 # https://paste.sh/vofcctHP#-KbDSXVeWoifYncZmLfZzgum
@ -147,7 +147,7 @@ in
          Enable Munin Node agent. Munin node listens on 0.0.0.0 and
          by default accepts connections only from 127.0.0.1 for security reasons.

-          See <http://guide.munin-monitoring.org/en/latest/architecture/index.html>.
+          See <https://guide.munin-monitoring.org/en/latest/architecture/index.html>.
        '';
      };

@ -156,7 +156,7 @@ in
        type = types.lines;
        description = lib.mdDoc ''
          {file}`munin-node.conf` extra configuration. See
-          <http://guide.munin-monitoring.org/en/latest/reference/munin-node.conf.html>
+          <https://guide.munin-monitoring.org/en/latest/reference/munin-node.conf.html>
        '';
      };

@ -165,7 +165,7 @@ in
        type = types.lines;
        description = lib.mdDoc ''
          {file}`plugin-conf.d` extra plugin configuration. See
-          <http://guide.munin-monitoring.org/en/latest/plugin/use.html>
+          <https://guide.munin-monitoring.org/en/latest/plugin/use.html>
        '';
        example = ''
          [fail2ban_*]
@ -273,9 +273,9 @@ in
        type = types.lines;
        description = lib.mdDoc ''
          {file}`munin.conf` extra global configuration.
-          See <http://guide.munin-monitoring.org/en/latest/reference/munin.conf.html>.
+          See <https://guide.munin-monitoring.org/en/latest/reference/munin.conf.html>.
          Useful to setup notifications, see
-          <http://guide.munin-monitoring.org/en/latest/tutorial/alert.html>
+          <https://guide.munin-monitoring.org/en/latest/tutorial/alert.html>
        '';
        example = ''
          contact.email.command mail -s "Munin notification for ''${var:host}" someone@example.com
@ -288,7 +288,7 @@ in
        description = lib.mdDoc ''
          Definitions of hosts of nodes to collect data from. Needs at least one
          host for cron to succeed. See
-          <http://guide.munin-monitoring.org/en/latest/reference/munin.conf.html>
+          <https://guide.munin-monitoring.org/en/latest/reference/munin.conf.html>
        '';
        example = literalExpression ''
          '''
--- a/nixos/modules/services/monitoring/nagios.nix
+++ b/nixos/modules/services/monitoring/nagios.nix
@ -88,7 +88,7 @@ in

  options = {
    services.nagios = {
-      enable = mkEnableOption (lib.mdDoc ''[Nagios](http://www.nagios.org/) to monitor your system or network.'');
+      enable = mkEnableOption (lib.mdDoc ''[Nagios](https://www.nagios.org/) to monitor your system or network.'');

      objectDefs = mkOption {
        description = lib.mdDoc ''
--- a/nixos/modules/services/network-filesystems/xtreemfs.nix
+++ b/nixos/modules/services/network-filesystems/xtreemfs.nix
@ -176,7 +176,7 @@ in
          description = lib.mdDoc ''
            Configuration of XtreemFS DIR service.
            WARNING: configuration is saved as plaintext inside nix store.
-            For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+            For more options: https://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
          '';
        };
        replication = {
@ -218,7 +218,7 @@ in
            description = lib.mdDoc ''
              Configuration of XtreemFS DIR replication plugin.
              WARNING: configuration is saved as plaintext inside nix store.
-              For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+              For more options: https://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
            '';
          };
        };
@ -319,7 +319,7 @@ in
          description = lib.mdDoc ''
            Configuration of XtreemFS MRC service.
            WARNING: configuration is saved as plaintext inside nix store.
-            For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+            For more options: https://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
          '';
        };
        replication = {
@ -361,7 +361,7 @@ in
            description = lib.mdDoc ''
              Configuration of XtreemFS MRC replication plugin.
              WARNING: configuration is saved as plaintext inside nix store.
-              For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+              For more options: https://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
            '';
          };
        };
@ -438,7 +438,7 @@ in
          description = lib.mdDoc ''
            Configuration of XtreemFS OSD service.
            WARNING: configuration is saved as plaintext inside nix store.
-            For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+            For more options: https://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
          '';
        };
      };
--- a/nixos/modules/services/networking/asterisk.nix
+++ b/nixos/modules/services/networking/asterisk.nix
@ -139,7 +139,7 @@ in
          path.

          See
-          <http://www.asterisk.org/community/documentation>
+          <https://www.asterisk.org/community/documentation/>
          for more examples of what is possible here.
        '';
      };
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@ -239,7 +239,7 @@ in
      enable = mkEnableOption (lib.mdDoc "I2Pd daemon") // {
        description = lib.mdDoc ''
          Enables I2Pd as a running service upon activation.
-          Please read http://i2pd.readthedocs.io/en/latest/ for further
+          Please read <https://i2pd.readthedocs.io/en/latest/> for further
          configuration help.
        '';
      };
--- a/nixos/modules/services/networking/ntp/ntpd.nix
+++ b/nixos/modules/services/networking/ntp/ntpd.nix
@ -56,7 +56,7 @@ in
          The default flags prevent external hosts from using ntpd as a DDoS
          reflector, setting system time, and querying OS/ntpd version. As
          recommended in section 6.5.1.1.3, answer "No" of
-          http://support.ntp.org/bin/view/Support/AccessRestrictions
+          https://support.ntp.org/Support/AccessRestrictions
        '';
        default = [ "limited" "kod" "nomodify" "notrap" "noquery" "nopeer" ];
      };
--- a/nixos/modules/services/networking/pleroma.nix
+++ b/nixos/modules/services/networking/pleroma.nix
@ -146,6 +146,6 @@ in {
    };

  };
-  meta.maintainers = with lib.maintainers; [ ninjatrappeur ];
+  meta.maintainers = with lib.maintainers; [ picnoir ];
  meta.doc = ./pleroma.md;
 }
--- a/nixos/modules/services/networking/tox-bootstrapd.nix
+++ b/nixos/modules/services/networking/tox-bootstrapd.nix
@ -47,7 +47,7 @@ in
              lib.mdDoc ''
                Configuration for bootstrap daemon.
                See <https://github.com/irungentoo/toxcore/blob/master/other/bootstrap_daemon/tox-bootstrapd.conf>
-                and <http://wiki.tox.im/Nodes>.
+                and <https://wiki.tox.chat/users/nodes>.
             '';
          };
      };
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@ -148,7 +148,7 @@ in
            type = types.bool;
            default = true;
            description = lib.mdDoc ''
-              Whether to enable [Micro Transport Protocol (µTP)](http://en.wikipedia.org/wiki/Micro_Transport_Protocol).
+              Whether to enable [Micro Transport Protocol (µTP)](https://en.wikipedia.org/wiki/Micro_Transport_Protocol).
            '';
          };
          options.watch-dir = mkOption {
--- a/nixos/modules/services/video/unifi-video.nix
+++ b/nixos/modules/services/video/unifi-video.nix
@ -32,7 +32,7 @@ let
    name = "mongo.conf";
    executable = false;
    text = ''
-      # for documentation of all options, see http://docs.mongodb.org/manual/reference/configuration-options/
+      # for documentation of all options, see https://www.mongodb.com/docs/manual/reference/configuration-options/

      storage:
         dbPath: ${cfg.dataDir}/db
@ -63,7 +63,7 @@ let
    executable = false;
    text = ''
      # for documentation of all options, see:
-      #   http://docs.mongodb.org/manual/reference/configuration-options/
+      #   https://www.mongodb.com/docs/manual/reference/configuration-options/

      storage:
         dbPath: ${cfg.dataDir}/db-wt
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@ -909,7 +909,7 @@ in {
  };

  config = mkIf cfg.enable {
-    warnings = optionals (!config.security.sudo.enable) [''
+    warnings = optionals (with config.security; (!sudo.enable) && (!sudo-rs.enable)) [''
      The pleroma_ctl wrapper enabled by the installWrapper option relies on
      sudo, which appears to have been disabled through security.sudo.enable.
    ''];
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@ -407,7 +407,7 @@ in
            type = with lib.types; nullOr (enum ["plain" "login" "cram_md5"]);
            default = null;
            description = lib.mdDoc ''
-              Authentication type to use, see http://api.rubyonrails.org/classes/ActionMailer/Base.html
+              Authentication type to use, see https://api.rubyonrails.org/classes/ActionMailer/Base.html
            '';
          };

@ -423,7 +423,7 @@ in
            type = lib.types.str;
            default = "peer";
            description = lib.mdDoc ''
-              How OpenSSL checks the certificate, see http://api.rubyonrails.org/classes/ActionMailer/Base.html
+              How OpenSSL checks the certificate, see https://api.rubyonrails.org/classes/ActionMailer/Base.html
            '';
          };

--- a/nixos/modules/services/web-apps/nextcloud.md
+++ b/nixos/modules/services/web-apps/nextcloud.md
@ -49,7 +49,7 @@ used by the imperative installer and all values are written to an additional fil
 to ensure that changes can be applied by changing the module's options.

 In case the application serves multiple domains (those are checked with
-[`$_SERVER['HTTP_HOST']`](http://php.net/manual/en/reserved.variables.server.php))
+[`$_SERVER['HTTP_HOST']`](https://www.php.net/manual/en/reserved.variables.server.php))
 it's needed to add them to
 [`services.nextcloud.config.extraTrustedDomains`](#opt-services.nextcloud.config.extraTrustedDomains).

--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@ -430,7 +430,7 @@ let
          background processes while not running tt-rss, this method is generally
          viable to keep your feeds up to date.
          Still, there are more robust (and recommended) updating methods
-          available, you can read about them here: http://tt-rss.org/wiki/UpdatingFeeds
+          available, you can read about them here: <https://tt-rss.org/wiki/UpdatingFeeds>
        '';
      };

--- a/nixos/modules/services/web-servers/lighttpd/default.nix
+++ b/nixos/modules/services/web-servers/lighttpd/default.nix
@ -10,7 +10,7 @@ let

  # List of known lighttpd modules, ordered by how the lighttpd documentation
  # recommends them being imported:
-  # http://redmine.lighttpd.net/projects/1/wiki/Server_modulesDetails
+  # https://redmine.lighttpd.net/projects/1/wiki/Server_modulesDetails
  #
  # Some modules are always imported and should not appear in the config:
  # disallowedModules = [ "mod_indexfile" "mod_dirlisting" "mod_staticfile" ];
@ -84,8 +84,8 @@ let
      # server.modules += () entries in each sub-service extraConfig snippet,
      # read this:
      #
-      #   http://redmine.lighttpd.net/projects/1/wiki/Server_modulesDetails
-      #   http://redmine.lighttpd.net/issues/2337
+      #   https://redmine.lighttpd.net/projects/1/wiki/Server_modulesDetails
+      #   https://redmine.lighttpd.net/issues/2337
      #
      # Basically, lighttpd doesn't want to load (or even silently ignore) a
      # module for a second time, and there is no way to check if a module has
--- a/nixos/modules/services/web-servers/mighttpd2.nix
+++ b/nixos/modules/services/web-servers/mighttpd2.nix
@ -44,7 +44,7 @@ in {
      type = types.lines;
      description = lib.mdDoc ''
        Verbatim config file to use
-        (see http://www.mew.org/~kazu/proj/mighttpd/en/config.html)
+        (see https://kazu-yamamoto.github.io/mighttpd2/config.html)
      '';
    };

@ -78,7 +78,7 @@ in {
      type = types.lines;
      description = lib.mdDoc ''
        Verbatim routing file to use
-        (see http://www.mew.org/~kazu/proj/mighttpd/en/config.html)
+        (see https://kazu-yamamoto.github.io/mighttpd2/config.html)
      '';
    };

--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -955,7 +955,7 @@ in
        default = {};
        description = lib.mdDoc ''
          Configure a proxy cache path entry.
-          See <http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_path> for documentation.
+          See <https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_path> for documentation.
        '';
      };

--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@ -63,7 +63,7 @@ in
        # make available for D-BUS user services
        #export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}:${config.system.path}/share:${e.efl}/share

-        # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
+        # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
        ${pkgs.xdg-user-dirs}/bin/xdg-user-dirs-update
      fi
    '';
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@ -455,7 +455,7 @@ in
            pkgs.glib # for gsettings program
            pkgs.gnome-menus
            pkgs.gtk3.out # for gtk-launch program
-            pkgs.xdg-user-dirs # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
+            pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
          ];
        in
        mandatoryPackages
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -201,7 +201,7 @@ in
        onboard
        orca # elementary/greeter#668
        sound-theme-freedesktop
-        xdg-user-dirs # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
+        xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
      ]) ++ (with pkgs.pantheon; [
        # Artwork
        elementary-gtk-theme
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -96,7 +96,7 @@ let
      )}

      # Speed up application start by 50-150ms according to
-      # http://kdemonkey.blogspot.nl/2008/04/magic-trick.html
+      # https://kdemonkey.blogspot.com/2008/04/magic-trick.html
      compose_cache="''${XCOMPOSECACHE:-$HOME/.compose-cache}"
      mkdir -p "$compose_cache"
      # To avoid accidentally deleting a wrongly set up XCOMPOSECACHE directory,
--- a/nixos/modules/services/x11/display-managers/xpra.nix
+++ b/nixos/modules/services/x11/display-managers/xpra.nix
@ -60,11 +60,11 @@ in
      VertRefresh 1.0 - 200.0
      #To add your own modes here, use a modeline calculator, like:
      # cvt:
-      # http://www.x.org/archive/X11R7.5/doc/man/man1/cvt.1.html
+      # https://www.x.org/archive/X11R7.5/doc/man/man1/cvt.1.html
      # xtiming:
-      # http://xtiming.sourceforge.net/cgi-bin/xtiming.pl
+      # https://xtiming.sourceforge.net/cgi-bin/xtiming.pl
      # gtf:
-      # http://gtf.sourceforge.net/
+      # https://gtf.sourceforge.net/
      #This can be used to get a specific DPI, but only for the default resolution:
      #DisplaySize 508 317
      #NOTE: the highest modes will not work without increasing the VideoRam
--- a/nixos/modules/services/x11/imwheel.nix
+++ b/nixos/modules/services/x11/imwheel.nix
@ -37,7 +37,7 @@ in
            Window class translation rules.
            /etc/X11/imwheelrc is generated based on this config
            which means this config is global for all users.
-            See [official man pages](http://imwheel.sourceforge.net/imwheel.1.html)
+            See [official man pages](https://imwheel.sourceforge.net/imwheel.1.html)
            for more information.
          '';
        };
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix
@ -25,7 +25,7 @@ in
          under `/boot/extlinux.conf`.  For instance,
          U-Boot's generic distro boot support uses this file format.

-          See [U-boot's documentation](http://git.denx.de/?p=u-boot.git;a=blob;f=doc/README.distro;hb=refs/heads/master)
+          See [U-boot's documentation](https://u-boot.readthedocs.io/en/latest/develop/distro.html)
          for more information.
        '';
      };
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@ -339,7 +339,7 @@ in
          See the
          [
          GRUB source code
-          ](http://git.savannah.gnu.org/cgit/grub.git/tree/grub-core/commands/nativedisk.c?h=grub-2.04#n326)
+          ](https://git.savannah.gnu.org/cgit/grub.git/tree/grub-core/commands/nativedisk.c?h=grub-2.04#n326)
          for which disk modules are available.

          The list elements are passed directly as `argv`
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@ -537,7 +537,7 @@ in
      description = lib.mdDoc ''
        Unless enabled, encryption keys can be easily recovered by an attacker with physical
        access to any machine with PCMCIA, ExpressCard, ThunderBolt or FireWire port.
-        More information is available at <http://en.wikipedia.org/wiki/DMA_attack>.
+        More information is available at <https://en.wikipedia.org/wiki/DMA_attack>.

        This option blacklists FireWire drivers, but doesn't remove them. You can manually
        load the drivers if you need to use a FireWire device, but don't forget to unload them!
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -284,7 +284,7 @@ let
      # in the NixOS installation CD, so use ID_CDROM_MEDIA in the
      # corresponding udev rules for now.  This was the behaviour in
      # udev <= 154.  See also
-      #   http://www.spinics.net/lists/hotplug/msg03935.html
+      #   https://www.spinics.net/lists/hotplug/msg03935.html
      substituteInPlace $out/60-persistent-storage.rules \
        --replace ID_CDROM_MEDIA_TRACK_COUNT_DATA ID_CDROM_MEDIA
    ''; # */
--- a/nixos/modules/virtualisation/google-compute-config.nix
+++ b/nixos/modules/virtualisation/google-compute-config.nix
@ -84,6 +84,10 @@ in
    { groups = [ "google-sudoers" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; }
  ];

+  security.sudo-rs.extraRules = mkIf config.users.mutableUsers [
+    { groups = [ "google-sudoers" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; }
+  ];
+
  users.groups.google-sudoers = mkIf config.users.mutableUsers { };

  boot.extraModprobeConfig = readFile "${pkgs.google-guest-configs}/etc/modprobe.d/gce-blacklist.conf";
--- a/nixos/tests/sourcehut.nix
+++ b/nixos/tests/sourcehut.nix
@ -126,6 +126,7 @@ in
    virtualisation.diskSize = 4 * 1024;
    virtualisation.memorySize = 2 * 1024;
    networking.domain = domain;
+    networking.enableIPv6 = false;
    networking.extraHosts = ''
      ${config.networking.primaryIPAddress} builds.${domain}
      ${config.networking.primaryIPAddress} git.${domain}
@ -134,11 +135,6 @@ in

    services.sourcehut = {
      enable = true;
-      services = [
-        "builds"
-        "git"
-        "meta"
-      ];
      nginx.enable = true;
      nginx.virtualHost = {
        forceSSL = true;
--- a/nixos/tests/systemd-networkd.nix
+++ b/nixos/tests/systemd-networkd.nix
@ -65,7 +65,7 @@ let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: {
 in import ./make-test-python.nix ({pkgs, ... }: {
  name = "networkd";
  meta = with pkgs.lib.maintainers; {
-    maintainers = [ ninjatrappeur ];
+    maintainers = [ picnoir ];
  };
  nodes = {
    node1 = { pkgs, ... }@attrs:
--- a/nixos/tests/tandoor-recipes.nix
+++ b/nixos/tests/tandoor-recipes.nix
@ -3,33 +3,8 @@ import ./make-test-python.nix ({ lib, ... }: {
  meta.maintainers = with lib.maintainers; [ ambroisie ];

  nodes.machine = { pkgs, ... }: {
-    # Setup using Postgres
    services.tandoor-recipes = {
      enable = true;
-
-      extraConfig = {
-        DB_ENGINE = "django.db.backends.postgresql";
-        POSTGRES_HOST = "/run/postgresql";
-        POSTGRES_USER = "tandoor_recipes";
-        POSTGRES_DB = "tandoor_recipes";
-      };
-    };
-
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ "tandoor_recipes" ];
-      ensureUsers = [
-        {
-          name = "tandoor_recipes";
-          ensurePermissions."DATABASE tandoor_recipes" = "ALL PRIVILEGES";
-        }
-      ];
-    };
-
-    systemd.services = {
-      tandoor-recipes = {
-        after = [ "postgresql.service" ];
-      };
    };
  };

--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@ -95,6 +95,6 @@ python3Packages.buildPythonApplication rec {
    homepage = "http://gpodder.org/";
    license = licenses.gpl3;
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ skeidel mic92 ];
+    maintainers = with maintainers; [ mic92 ];
  };
 }
--- a/pkgs/applications/audio/gtkpod/default.nix
+++ b/pkgs/applications/audio/gtkpod/default.nix
@ -35,6 +35,6 @@ stdenv.mkDerivation rec {
    homepage = "https://sourceforge.net/projects/gtkpod/";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.skeidel ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/pbpctrl/default.nix
+++ b/pkgs/applications/audio/pbpctrl/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "pbpctrl";
-  version = "0.1.4";
+  version = "0.1.5";

  src = fetchFromGitHub {
    owner = "qzed";
    repo = "${pname}";
    rev = "v${version}";
-    hash = "sha256-91sdlnffL/HX+Y8e6T+ZCa7MAcf4fWE0NJGLgmK47o8=";
+    hash = "sha256-tOdKXYfeO+HsYIDDU3fDb76ytRHVOcIqffEjFnLwOTI=";
  };

-  cargoHash = "sha256-U4//GvAEhrfOrivwW/6PbKHdWXGIuilPl7Zo17wnwDY=";
+  cargoHash = "sha256-yP4tsXCAPE1KUDU5oBIejL4kACK1dNXK7Kmw37VMexM=";

  nativeBuildInputs = [ pkg-config protobuf ];
  buildInputs = [ dbus ];
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-generated.nix
@ -297,10 +297,10 @@
      elpaBuild {
        pname = "async";
        ename = "async";
-        version = "1.9.7.0.20230802.104021";
+        version = "1.9.7.0.20231105.171300";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/async-1.9.7.0.20230802.104021.tar";
-          sha256 = "1w300q3fgnpibsbgkmxpicxv5ba8xj7cv9i28j7854b49d6xvjb6";
+          url = "https://elpa.gnu.org/devel/async-1.9.7.0.20231105.171300.tar";
+          sha256 = "1f3z679jlhv8xyc1kssmcgq9alwa06r64cpclf477fs6581nda2w";
        };
        packageRequires = [ emacs ];
        meta = {
@ -582,10 +582,10 @@
      elpaBuild {
        pname = "breadcrumb";
        ename = "breadcrumb";
-        version = "1.0.1.0.20230913.180643";
+        version = "1.0.1.0.20231107.53204";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/breadcrumb-1.0.1.0.20230913.180643.tar";
-          sha256 = "1f2kgjmdn8m9sgwx42yv7ldn41s0az53kn6vzlshx5h77y2g1bsn";
+          url = "https://elpa.gnu.org/devel/breadcrumb-1.0.1.0.20231107.53204.tar";
+          sha256 = "0ai8vw9mnlbsc6qmvapdw8mnkssxj1g3hg83acjc4vlcrdxr40vg";
        };
        packageRequires = [ emacs project ];
        meta = {
@ -620,10 +620,10 @@
      elpaBuild {
        pname = "buffer-env";
        ename = "buffer-env";
-        version = "0.5.0.20231008.102838";
+        version = "0.5.0.20231028.161716";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/buffer-env-0.5.0.20231008.102838.tar";
-          sha256 = "0isxis03qgiq73zrizsv4xmmbdzqpcwh4kiva4kfiggz43xsk2g7";
+          url = "https://elpa.gnu.org/devel/buffer-env-0.5.0.20231028.161716.tar";
+          sha256 = "1gi7092mfzsqfj8l000arxdwmg73xzbgzfliazzk0s617480ccbw";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -650,6 +650,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    bufferlo = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "bufferlo";
+        ename = "bufferlo";
+        version = "0.2.0.20231106.215852";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/devel/bufferlo-0.2.0.20231106.215852.tar";
+          sha256 = "17qjjifdl3y8p4ldzami9b3ns9mzzqdacvkzsryv5885hzas67zz";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/bufferlo.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    bug-hunter = callPackage ({ cl-lib ? null
                              , elpaBuild
                              , fetchurl
@ -710,10 +725,10 @@
      elpaBuild {
        pname = "cape";
        ename = "cape";
-        version = "0.17.0.20231022.115714";
+        version = "0.17.0.20231029.100801";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/cape-0.17.0.20231022.115714.tar";
-          sha256 = "0bvmrxjd054f14qap6w5052900k4pn33vb7cbc87rvrgdyhh5ixa";
+          url = "https://elpa.gnu.org/devel/cape-0.17.0.20231029.100801.tar";
+          sha256 = "14898pkxh61sxhmapb87zafl5wjz5w2na0mqpj8c36hvr5h33jnj";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -905,17 +920,14 @@
          license = lib.licenses.free;
        };
      }) {};
-    company = callPackage ({ elpaBuild
-                           , emacs
-                           , fetchurl
-                           , lib }:
+    company = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "company";
        ename = "company";
-        version = "0.10.2.0.20231023.103313";
+        version = "0.10.2.0.20231110.5234";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/company-0.10.2.0.20231023.103313.tar";
-          sha256 = "1zcap5mv6cn9a2j8axg4yw4iprxkwwyjmw7qahijlk02ycwmwwfn";
+          url = "https://elpa.gnu.org/devel/company-0.10.2.0.20231110.5234.tar";
+          sha256 = "18533dlk7k77if51kjhwlf2yb872ixjf1cffg197bnfy29sdrm11";
        };
        packageRequires = [ emacs ];
        meta = {
@ -988,10 +1000,10 @@
      elpaBuild {
        pname = "compat";
        ename = "compat";
-        version = "29.1.4.2.0.20230927.210420";
+        version = "29.1.4.3.0.20231107.184238";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/compat-29.1.4.2.0.20230927.210420.tar";
-          sha256 = "16apiq2aj82gmlg1xaqrrv6riikdb2m4iyg3b4abp472q8hwwfk5";
+          url = "https://elpa.gnu.org/devel/compat-29.1.4.3.0.20231107.184238.tar";
+          sha256 = "1mcfx5my48zr14syzmpidgr1kjji2v63sqmx3zh7spxxd274yviq";
        };
        packageRequires = [ emacs seq ];
        meta = {
@ -1003,10 +1015,10 @@
      elpaBuild {
        pname = "consult";
        ename = "consult";
-        version = "0.35.0.20231023.154305";
+        version = "0.35.0.20231107.212252";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/consult-0.35.0.20231023.154305.tar";
-          sha256 = "1cx8m0llk76z1kawkqg9dq7aws2i2bsgnhr3xvw7chdwvjywghs6";
+          url = "https://elpa.gnu.org/devel/consult-0.35.0.20231107.212252.tar";
+          sha256 = "1p9l79sxxa06cxky5z08mccf34hbbp742iza57riknf0zmrglkpc";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -1055,10 +1067,10 @@
      elpaBuild {
        pname = "corfu";
        ename = "corfu";
-        version = "0.38.0.20231013.185720";
+        version = "0.38.0.20231108.174629";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/corfu-0.38.0.20231013.185720.tar";
-          sha256 = "0573w5zgkchk5kkj2wb7sl1qrp88k99v44jv0cddrrn35r77hrpx";
+          url = "https://elpa.gnu.org/devel/corfu-0.38.0.20231108.174629.tar";
+          sha256 = "1ynkyw7mkl8y66kxwy51gwdj60b4nadk9qbwsjljbfdnc80y6ws5";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -1290,10 +1302,10 @@
      elpaBuild {
        pname = "debbugs";
        ename = "debbugs";
-        version = "0.37.0.20231020.114541";
+        version = "0.37.0.20231029.152335";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/debbugs-0.37.0.20231020.114541.tar";
-          sha256 = "1bzphx74h67jyfdz66p6d78knqddfgvzwk8w848r1lfw2jh2h6dc";
+          url = "https://elpa.gnu.org/devel/debbugs-0.37.0.20231029.152335.tar";
+          sha256 = "0i2jbns27cfrlkyq3rszqkg6vqbw9r2pq2w9yxcyj60v0hq0ww53";
        };
        packageRequires = [ emacs soap-client ];
        meta = {
@ -1320,10 +1332,10 @@
      elpaBuild {
        pname = "denote";
        ename = "denote";
-        version = "2.0.0.0.20231027.53913";
+        version = "2.0.0.0.20231107.64253";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/denote-2.0.0.0.20231027.53913.tar";
-          sha256 = "044r77y0b7b3svwjin926xkp8xcwkxjpixi0x8nrfzh2krzkkakx";
+          url = "https://elpa.gnu.org/devel/denote-2.0.0.0.20231107.64253.tar";
+          sha256 = "143pgnsfi3mf42n1yrwjr79b32k0081i19zdkwg97xhvfbqhiddw";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1472,6 +1484,24 @@
          license = lib.licenses.free;
        };
      }) {};
+    dired-duplicates = callPackage ({ elpaBuild
+                                    , emacs
+                                    , fetchurl
+                                    , lib }:
+      elpaBuild {
+        pname = "dired-duplicates";
+        ename = "dired-duplicates";
+        version = "0.2.0.20231109.135341";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/devel/dired-duplicates-0.2.0.20231109.135341.tar";
+          sha256 = "07ridbcy3n0v3dax7kj3d7nk2k0w57dnapd4kki4xhkm4fklx6w6";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/dired-duplicates.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    dired-git-info = callPackage ({ elpaBuild
                                  , emacs
                                  , fetchurl
@ -1727,10 +1757,10 @@
      elpaBuild {
        pname = "eev";
        ename = "eev";
-        version = "20230127.0.20230521.54745";
+        version = "20230127.0.20231106.221153";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/eev-20230127.0.20230521.54745.tar";
-          sha256 = "09s6r6xjyfhdiy7j3wnw53gyjbjr8347ikzhi6xxzkna3r5fc1mx";
+          url = "https://elpa.gnu.org/devel/eev-20230127.0.20231106.221153.tar";
+          sha256 = "0labf7shjyv5v5rakkgra8338k9y5ads82ziqracklgj5p39gakf";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1745,10 +1775,10 @@
      elpaBuild {
        pname = "ef-themes";
        ename = "ef-themes";
-        version = "1.4.0.0.20231026.80318";
+        version = "1.4.0.0.20231031.71401";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/ef-themes-1.4.0.0.20231026.80318.tar";
-          sha256 = "02nx6p5m54gyyw2rjb0msvh3cijnqpm0p5i9l71gykg54rbabwnr";
+          url = "https://elpa.gnu.org/devel/ef-themes-1.4.0.0.20231031.71401.tar";
+          sha256 = "02yrb6cv0l6k30xyd8wz0jjr4cy66p9limcrmkm52q1k7l0dq3za";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1770,10 +1800,10 @@
      elpaBuild {
        pname = "eglot";
        ename = "eglot";
-        version = "1.15.0.20231021.100531";
+        version = "1.15.0.20231107.90944";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/eglot-1.15.0.20231021.100531.tar";
-          sha256 = "0rgf0s76sbmabmv1wvghs2qapl3g23j58ka4ks9dd95nc004b8i6";
+          url = "https://elpa.gnu.org/devel/eglot-1.15.0.20231107.90944.tar";
+          sha256 = "135a3zyzjpv2n0c988b9g9mh93y7p1dp9nvmchm4i26mdmzn6jbz";
        };
        packageRequires = [
          eldoc
@ -1881,10 +1911,10 @@
      elpaBuild {
        pname = "embark";
        ename = "embark";
-        version = "0.23.0.20231026.124244";
+        version = "0.23.0.20231104.193345";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/embark-0.23.0.20231026.124244.tar";
-          sha256 = "0d73fpxqv243pbj36299nfb4j6w2aqabpn4l3z1gvcpx2x2abbrd";
+          url = "https://elpa.gnu.org/devel/embark-0.23.0.20231104.193345.tar";
+          sha256 = "10qny8wp74np12sczz08gfrxspvapwvz2zkdig76wcrpd4kdpjk4";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -1901,10 +1931,10 @@
      elpaBuild {
        pname = "embark-consult";
        ename = "embark-consult";
-        version = "0.8.0.20231026.124244";
+        version = "0.8.0.20231104.193345";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/embark-consult-0.8.0.20231026.124244.tar";
-          sha256 = "0wd3pdkh0y5x2bd8q6q7bc543s5ks7d8zlxrflk5ywlqaz8xi9g4";
+          url = "https://elpa.gnu.org/devel/embark-consult-0.8.0.20231104.193345.tar";
+          sha256 = "15syrabv26yq69g2lz2dqs8w4drw1v3whr0h2vzmc1p0pv9jpks2";
        };
        packageRequires = [ consult emacs embark ];
        meta = {
@ -1926,10 +1956,10 @@
      elpaBuild {
        pname = "ement";
        ename = "ement";
-        version = "0.14pre0.20231007.60132";
+        version = "0.14pre0.20231029.40923";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/ement-0.14pre0.20231007.60132.tar";
-          sha256 = "0ndvlrmmwlpn08pf45vg8qa9z8xjg41i03bw9x7lknlj27lk77c7";
+          url = "https://elpa.gnu.org/devel/ement-0.14pre0.20231029.40923.tar";
+          sha256 = "06r0s8dxlxr63a1zgdk0qxzd6x27r6mlymi6hxp8923yvwqddkdf";
        };
        packageRequires = [
          emacs
@ -1955,10 +1985,10 @@
      elpaBuild {
        pname = "emms";
        ename = "emms";
-        version = "16.0.20231017.153742";
+        version = "16.0.20231106.173540";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/emms-16.0.20231017.153742.tar";
-          sha256 = "02lvppyraqc66hb4q4smlcpccq3ggvhg6qj3ld66vmjl7gfasw1a";
+          url = "https://elpa.gnu.org/devel/emms-16.0.20231106.173540.tar";
+          sha256 = "08l7nzz596jwqr4wcjcvsihdhai4faqihavrshvja2nhrdxxm79x";
        };
        packageRequires = [ cl-lib nadvice seq ];
        meta = {
@ -2024,10 +2054,10 @@
      elpaBuild {
        pname = "erc";
        ename = "erc";
-        version = "5.6snapshot0.20231027.130929";
+        version = "5.6snapshot0.20231104.154155";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/erc-5.6snapshot0.20231027.130929.tar";
-          sha256 = "1v1r86cpl4jnnds9ljwr71g3xc96b2gvjbcpcvkhjfbf8g58ky40";
+          url = "https://elpa.gnu.org/devel/erc-5.6snapshot0.20231104.154155.tar";
+          sha256 = "0z22cw6hgn4lsc1bp4ci75v03mvlra1nyfj8g7xkfdv75nbv2yga";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -2277,6 +2307,25 @@
          license = lib.licenses.free;
        };
      }) {};
+    flymake-codespell = callPackage ({ compat
+                                     , elpaBuild
+                                     , emacs
+                                     , fetchurl
+                                     , lib }:
+      elpaBuild {
+        pname = "flymake-codespell";
+        ename = "flymake-codespell";
+        version = "0.1.0.20231030.222337";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/devel/flymake-codespell-0.1.0.20231030.222337.tar";
+          sha256 = "1i4gk9z9yfs9gb9x64n8wzxqy8lb81j422173xxg1lwsirc9a040";
+        };
+        packageRequires = [ compat emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/flymake-codespell.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    flymake-proselint = callPackage ({ elpaBuild
                                     , emacs
                                     , fetchurl
@ -2560,17 +2609,14 @@
          license = lib.licenses.free;
        };
      }) {};
-    gpastel = callPackage ({ elpaBuild
-                           , emacs
-                           , fetchurl
-                           , lib }:
+    gpastel = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "gpastel";
        ename = "gpastel";
-        version = "0.5.0.0.20181231.183754";
+        version = "0.5.0.0.20231030.71342";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/gpastel-0.5.0.0.20181231.183754.tar";
-          sha256 = "19byv5l09h8zdsgpifsc0j7np0iq1md4l0y7865g95xbax60i9id";
+          url = "https://elpa.gnu.org/devel/gpastel-0.5.0.0.20231030.71342.tar";
+          sha256 = "1vd49mn7xgys0apc7z6s6cs3yygznlyyf4l1hhfrgg5vwfb3c7ry";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2637,10 +2683,10 @@
      elpaBuild {
        pname = "greader";
        ename = "greader";
-        version = "0.5.0.0.20231026.5322";
+        version = "0.6.0.0.20231104.45848";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/greader-0.5.0.0.20231026.5322.tar";
-          sha256 = "0m4d1cr637jsy75ax6y2aqhzjwax7qkidm25k4qiqa69lzbkckid";
+          url = "https://elpa.gnu.org/devel/greader-0.6.0.0.20231104.45848.tar";
+          sha256 = "1ppvgi17agzrsjfd9jaa5zszvqcm1n4rfy7z82da4rl5mbgnml9p";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2738,10 +2784,10 @@
      elpaBuild {
        pname = "hiddenquote";
        ename = "hiddenquote";
-        version = "1.2.0.20230911.171055";
+        version = "1.2.0.20231107.184113";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/hiddenquote-1.2.0.20230911.171055.tar";
-          sha256 = "00basln4s5ngxp353ldpzxp382chdxp05bafsazgxkh5mg94jsyf";
+          url = "https://elpa.gnu.org/devel/hiddenquote-1.2.0.20231107.184113.tar";
+          sha256 = "0zgnxfcfd78c755rykmbnkvxx5lfpk7z3n8qky0lf3kj2hwas27v";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2823,10 +2869,10 @@
      elpaBuild {
        pname = "hyperbole";
        ename = "hyperbole";
-        version = "8.0.1pre0.20231022.151646";
+        version = "8.0.1pre0.20231106.194732";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/hyperbole-8.0.1pre0.20231022.151646.tar";
-          sha256 = "1kr6ayfnq9ah8n8b6k4lxh5napghb90y5sz0g3fs5qjbszcbvxc9";
+          url = "https://elpa.gnu.org/devel/hyperbole-8.0.1pre0.20231106.194732.tar";
+          sha256 = "02d4r3w6angwjw2wr192gkgwyzfb3vszdsb18baziqbwq2xh5cch";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3067,10 +3113,10 @@
      elpaBuild {
        pname = "jinx";
        ename = "jinx";
-        version = "0.9.0.20231026.154650";
+        version = "0.9.0.20231104.142700";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/jinx-0.9.0.20231026.154650.tar";
-          sha256 = "1fck948ay9n64mxqmx7j6fn6hzfn858l0s0gw544in2y617niyh6";
+          url = "https://elpa.gnu.org/devel/jinx-0.9.0.20231104.142700.tar";
+          sha256 = "16qq42qmklyls2fc482x2pv1l14x3kn78l41imvg8jrv3z64j89p";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -3315,10 +3361,10 @@
      elpaBuild {
        pname = "llm";
        ename = "llm";
-        version = "0.5.0.0.20231026.5843";
+        version = "0.5.2.0.20231110.3036";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/llm-0.5.0.0.20231026.5843.tar";
-          sha256 = "0ywmfbis4jrqjg2gc3khgwc9kdbhjh99syag2bk1vzjmwfd2cq89";
+          url = "https://elpa.gnu.org/devel/llm-0.5.2.0.20231110.3036.tar";
+          sha256 = "0ai405k9lx0rmlawfmldphjpwrrpahyawhzzam0500jp6x02ppkg";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3476,10 +3522,10 @@
      elpaBuild {
        pname = "marginalia";
        ename = "marginalia";
-        version = "1.3.0.20231026.181335";
+        version = "1.3.0.20231028.90751";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/marginalia-1.3.0.20231026.181335.tar";
-          sha256 = "1q7dbzrdzjwiyq09zbq8wbj673vaj5ss3xyrz3y226wb6jpmzr74";
+          url = "https://elpa.gnu.org/devel/marginalia-1.3.0.20231028.90751.tar";
+          sha256 = "05k37f3qjvm6kv7y6fa6g5z02irpifvl1as4allrxgn12408ydvh";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -3674,10 +3720,10 @@
      elpaBuild {
        pname = "modus-themes";
        ename = "modus-themes";
-        version = "4.3.0.0.20230926.152405";
+        version = "4.3.0.0.20231031.71656";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/modus-themes-4.3.0.0.20230926.152405.tar";
-          sha256 = "04fncghgdsz0fb1f49dr64nvy4as9wrvlxnc7jlx1im1dgjv9lcq";
+          url = "https://elpa.gnu.org/devel/modus-themes-4.3.0.0.20231031.71656.tar";
+          sha256 = "04hjhg596qfkrnll0wrg4f50ilns28jpf2ws7021wivr370xajki";
        };
        packageRequires = [ emacs ];
        meta = {
@ -4093,10 +4139,10 @@
      elpaBuild {
        pname = "orderless";
        ename = "orderless";
-        version = "1.0.0.20231025.204425";
+        version = "1.0.0.20231107.210315";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/orderless-1.0.0.20231025.204425.tar";
-          sha256 = "1lsfa62hpq6zmk49mnf1434lqv3p472la3aky003xplkvl0xbw7l";
+          url = "https://elpa.gnu.org/devel/orderless-1.0.0.20231107.210315.tar";
+          sha256 = "0j5fkmw4qy40ab2c6d0mf6637s8q95gi3sp7w477d6ymck5i2ck8";
        };
        packageRequires = [ emacs ];
        meta = {
@ -4108,10 +4154,10 @@
      elpaBuild {
        pname = "org";
        ename = "org";
-        version = "9.7pre0.20231027.91944";
+        version = "9.7pre0.20231108.95550";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/org-9.7pre0.20231027.91944.tar";
-          sha256 = "0af65mm22bl6c38abqn39s5rz6i67pbcmhfq6n2hn0a8jgmmppwc";
+          url = "https://elpa.gnu.org/devel/org-9.7pre0.20231108.95550.tar";
+          sha256 = "01dk4sq5wfiwj9g5bfriqqkfrgdfy3c7kixd7y4cf9k6pbjl4sfp";
        };
        packageRequires = [ emacs ];
        meta = {
@ -4306,10 +4352,10 @@
      elpaBuild {
        pname = "osm";
        ename = "osm";
-        version = "0.14.0.20231014.133720";
+        version = "0.14.0.20231029.105928";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/osm-0.14.0.20231014.133720.tar";
-          sha256 = "1zfjn4p30f5d6j3mwgc7asvb2p4jfl16svq98mx0q1n270bgs098";
+          url = "https://elpa.gnu.org/devel/osm-0.14.0.20231029.105928.tar";
+          sha256 = "0hd2yg7yqnpdiy0icxz6fa128arrf2zl1sknj20ig52ba7z0wk2w";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -4529,6 +4575,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    plz-see = callPackage ({ elpaBuild, emacs, fetchurl, lib, plz }:
+      elpaBuild {
+        pname = "plz-see";
+        ename = "plz-see";
+        version = "0.1.0.20231101.73512";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/devel/plz-see-0.1.0.20231101.73512.tar";
+          sha256 = "1nqlv1ww8ba2a40bg3riv5w1sgj8cmhx6bldyzcgs88cpjjkia79";
+        };
+        packageRequires = [ emacs plz ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/plz-see.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    poke = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "poke";
@ -4667,10 +4728,10 @@
      elpaBuild {
        pname = "project";
        ename = "project";
-        version = "0.10.0.0.20231020.190403";
+        version = "0.10.0.0.20231108.75740";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/project-0.10.0.0.20231020.190403.tar";
-          sha256 = "07ywa9rf3gy4jjh4xpyp9v6sk39jiqc1nifklrvckm1mp84hl0qq";
+          url = "https://elpa.gnu.org/devel/project-0.10.0.0.20231108.75740.tar";
+          sha256 = "02arwv35vcpspg2k8nasmaz2ggc32v7p3iq2q6z5sznmdanl1jm4";
        };
        packageRequires = [ emacs xref ];
        meta = {
@ -4712,10 +4773,10 @@
      elpaBuild {
        pname = "pulsar";
        ename = "pulsar";
-        version = "1.0.1.0.20230929.115806";
+        version = "1.0.1.0.20231101.62313";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/pulsar-1.0.1.0.20230929.115806.tar";
-          sha256 = "1rs8jnvj4g5m675srf3civhk52csm4nf7df81xscgvh6pafgyfvj";
+          url = "https://elpa.gnu.org/devel/pulsar-1.0.1.0.20231101.62313.tar";
+          sha256 = "10k57sd29hkbja85sn5yf7wm0g5wyk216ykdjl4vr03891ic03dg";
        };
        packageRequires = [ emacs ];
        meta = {
@ -5269,10 +5330,10 @@
      elpaBuild {
        pname = "setup";
        ename = "setup";
-        version = "1.3.2.0.20230826.202144";
+        version = "1.3.2.0.20231031.80845";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/setup-1.3.2.0.20230826.202144.tar";
-          sha256 = "15nsn4kgh50qrcxvar1j9rbbg9d4szvyxhy13r7fq0vp9n6wv6iw";
+          url = "https://elpa.gnu.org/devel/setup-1.3.2.0.20231031.80845.tar";
+          sha256 = "0bm5rbhhsl1wfrrf5ikvn368xv49fzxh375jhl9f5r5m4dj1l0s4";
        };
        packageRequires = [ emacs ];
        meta = {
@ -5658,10 +5719,10 @@
      elpaBuild {
        pname = "srht";
        ename = "srht";
-        version = "0.2.0.20221114.63606";
+        version = "0.3.0.20231103.213748";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/srht-0.2.0.20221114.63606.tar";
-          sha256 = "0y3xl9l0c7mjppsglwnbawrq4wx402mjvgnim2ilw1d7568ahi9i";
+          url = "https://elpa.gnu.org/devel/srht-0.3.0.20231103.213748.tar";
+          sha256 = "1nr6faizww1nzv5lpdikbqxkc6i1hswg2qa50cybl05ycqq9b10a";
        };
        packageRequires = [ emacs plz ];
        meta = {
@ -5694,10 +5755,10 @@
      elpaBuild {
        pname = "standard-themes";
        ename = "standard-themes";
-        version = "1.2.0.0.20230916.90636";
+        version = "1.2.0.0.20231031.71926";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/standard-themes-1.2.0.0.20230916.90636.tar";
-          sha256 = "0i1xqg65sbwm7xy26b116ips2769wa8yiqmyvcgsbsmig4vrydw8";
+          url = "https://elpa.gnu.org/devel/standard-themes-1.2.0.0.20231031.71926.tar";
+          sha256 = "10hj6w5wyr7kw4rargk9n1iiyl0i48cc9mbv2m0vg6bnb72237z5";
        };
        packageRequires = [ emacs ];
        meta = {
@ -5981,10 +6042,10 @@
      elpaBuild {
        pname = "tempel";
        ename = "tempel";
-        version = "0.8.0.20230915.222920";
+        version = "0.8.0.20231106.72513";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/tempel-0.8.0.20230915.222920.tar";
-          sha256 = "1lsc3d8sqydbhyrd9ja43y06i0qxwc0dns2n4rnnb8039y2dvfnn";
+          url = "https://elpa.gnu.org/devel/tempel-0.8.0.20231106.72513.tar";
+          sha256 = "1pbw7wrhz5h1xykbc1ihhpzqc0kki6k637wagx8yfz95n606808d";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -6096,10 +6157,10 @@
      elpaBuild {
        pname = "tramp";
        ename = "tramp";
-        version = "2.6.1.3.0.20230929.72305";
+        version = "2.6.1.4.0.20231030.81039";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/tramp-2.6.1.3.0.20230929.72305.tar";
-          sha256 = "1k0hmnr7wnkmahmqxcg2km2cr44h3fiv4x4kv9h0297jqqi2jiq4";
+          url = "https://elpa.gnu.org/devel/tramp-2.6.1.4.0.20231030.81039.tar";
+          sha256 = "1m8ij5xrh5yp5n70yqlxdxgvk0ap6mqnymhasncm2vqfzlxkdd45";
        };
        packageRequires = [ emacs ];
        meta = {
@ -6169,10 +6230,10 @@
      elpaBuild {
        pname = "transient";
        ename = "transient";
-        version = "0.4.3.0.20231024.181508";
+        version = "0.4.3.0.20231027.212124";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/transient-0.4.3.0.20231024.181508.tar";
-          sha256 = "0b092m462gndqlyv8lvfikkdqmly2w5dkbbkn405rbmki2r4bggk";
+          url = "https://elpa.gnu.org/devel/transient-0.4.3.0.20231027.212124.tar";
+          sha256 = "0rzc5ks0b9nlnvggj7hn9648y5siw9qjpg8n3swlmkb68m3b2c05";
        };
        packageRequires = [ compat emacs seq ];
        meta = {
@ -6347,10 +6408,10 @@
      elpaBuild {
        pname = "urgrep";
        ename = "urgrep";
-        version = "0.3.0snapshot0.20231026.224925";
+        version = "0.3.0snapshot0.20231101.193012";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/urgrep-0.3.0snapshot0.20231026.224925.tar";
-          sha256 = "07akrg4z177xjway75bl7281ic78j8sl818jd52nmxhx4wxys9mv";
+          url = "https://elpa.gnu.org/devel/urgrep-0.3.0snapshot0.20231101.193012.tar";
+          sha256 = "12hmms0yr0vybayvzkbqbp5j428lsnirzwg93f1l8m05xxs3xm9w";
        };
        packageRequires = [ compat emacs project ];
        meta = {
@ -6582,10 +6643,10 @@
      elpaBuild {
        pname = "vertico";
        ename = "vertico";
-        version = "1.4.0.20231015.92801";
+        version = "1.4.0.20231108.202420";
        src = fetchurl {
-          url = "https://elpa.gnu.org/devel/vertico-1.4.0.20231015.92801.tar";
-          sha256 = "0h73z4jbwd3pmn3rfgbklnrslcd0d60h1fg3j5ykbgqd770gklhc";
+          url = "https://elpa.gnu.org/devel/vertico-1.4.0.20231108.202420.tar";
+          sha256 = "1c34pq5l7ckjlyimpa528d8a7q5pakz3li5bc4ka86mwf861kd7v";
        };
        packageRequires = [ compat emacs ];
        meta = {
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
@ -565,6 +565,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    bufferlo = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "bufferlo";
+        ename = "bufferlo";
+        version = "0.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/bufferlo-0.2.tar";
+          sha256 = "1dvpzxlnzs037wz9xhiwiz2qrc7r2i05z6p6p0sy8i4kb6scc6gy";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/bufferlo.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    bug-hunter = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib, seq }:
      elpaBuild {
        pname = "bug-hunter";
@ -862,10 +877,10 @@
      elpaBuild {
        pname = "compat";
        ename = "compat";
-        version = "29.1.4.2";
+        version = "29.1.4.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/compat-29.1.4.2.tar";
-          sha256 = "1njvbvvx2gl10psswb8md2s9diiy476gy4yj6vwips40r0n96l3g";
+          url = "https://elpa.gnu.org/packages/compat-29.1.4.3.tar";
+          sha256 = "08lg6jph1hqkamf1fhm5ajwy4klh2a2260llr1z7wlbbq52032k5";
        };
        packageRequires = [ emacs seq ];
        meta = {
@ -1299,6 +1314,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    dired-duplicates = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "dired-duplicates";
+        ename = "dired-duplicates";
+        version = "0.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/dired-duplicates-0.2.tar";
+          sha256 = "1n5n961f1mrvcqfrz56734qj1ynajdjblyf4y60pw9m3fn03db4s";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/dired-duplicates.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    dired-git-info = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "dired-git-info";
@ -2022,6 +2052,25 @@
          license = lib.licenses.free;
        };
      }) {};
+    flymake-codespell = callPackage ({ compat
+                                     , elpaBuild
+                                     , emacs
+                                     , fetchurl
+                                     , lib }:
+      elpaBuild {
+        pname = "flymake-codespell";
+        ename = "flymake-codespell";
+        version = "0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/flymake-codespell-0.1.tar";
+          sha256 = "0r1g0imh9azy1yf0naxif80vmzrjvn5dx3lcrlpj70xb86wzliym";
+        };
+        packageRequires = [ compat emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/flymake-codespell.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    flymake-proselint = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "flymake-proselint";
@ -2358,10 +2407,10 @@
      elpaBuild {
        pname = "greader";
        ename = "greader";
-        version = "0.5.0";
+        version = "0.6.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/greader-0.5.0.tar";
-          sha256 = "11rcppg3850dbrvwsp3y814bibkv0h35rc5sf4w9qlmd5rc5ilxj";
+          url = "https://elpa.gnu.org/packages/greader-0.6.0.tar";
+          sha256 = "01sral1nrgkpbrajvg2pqhaj4rx48rryqfxckj3xprrs0yls3k8q";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2975,10 +3024,10 @@
      elpaBuild {
        pname = "llm";
        ename = "llm";
-        version = "0.5.0";
+        version = "0.5.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/llm-0.5.0.tar";
-          sha256 = "07n32hfzyjzj7vjy5l7rxaldpa4hyjwharkizs2gzz66lg83wix8";
+          url = "https://elpa.gnu.org/packages/llm-0.5.2.tar";
+          sha256 = "1nbxdnxpbyvx5rww9mn0zr9hcnblrnk8790cih206y3p1kvs0pnq";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3704,10 +3753,10 @@
      elpaBuild {
        pname = "org";
        ename = "org";
-        version = "9.6.10";
+        version = "9.6.11";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-9.6.10.tar";
-          sha256 = "1lv503jf556hrv9s85q8sk6lg0rwxkchp2sn0sgdki208l0im8wj";
+          url = "https://elpa.gnu.org/packages/org-9.6.11.tar";
+          sha256 = "18hp5jx90wn9xsg8frql3r1kmn2q9qph6plcssj64fp34wcwxsd8";
        };
        packageRequires = [ emacs ];
        meta = {
@ -4060,6 +4109,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    plz-see = callPackage ({ elpaBuild, emacs, fetchurl, lib, plz }:
+      elpaBuild {
+        pname = "plz-see";
+        ename = "plz-see";
+        version = "0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/plz-see-0.1.tar";
+          sha256 = "0dmckrny21rlm5spiwx7j6q0xikzwlsrhg8yz890w47zpdxpl3bb";
+        };
+        packageRequires = [ emacs plz ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/plz-see.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    poke = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "poke";
@ -5034,10 +5098,10 @@
      elpaBuild {
        pname = "srht";
        ename = "srht";
-        version = "0.2";
+        version = "0.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/srht-0.2.tar";
-          sha256 = "1qps9vdsiy5zkz88kh9kl1hnn1wlfz6n5brzcxi28fwx0hb3ksz2";
+          url = "https://elpa.gnu.org/packages/srht-0.3.tar";
+          sha256 = "03am21w1gsc1af7slsxny9ga4vqd8rbabbp4rl6mkrq46y5ak375";
        };
        packageRequires = [ emacs plz ];
        meta = {
@ -5418,10 +5482,10 @@
      elpaBuild {
        pname = "tramp";
        ename = "tramp";
-        version = "2.6.1.3";
+        version = "2.6.1.4";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/tramp-2.6.1.3.tar";
-          sha256 = "0z7q55yilwicgzl2m69r275pq6bzpyksxcjaf8fb3bcr3zvzil0y";
+          url = "https://elpa.gnu.org/packages/tramp-2.6.1.4.tar";
+          sha256 = "1ajlx0982hx6ypby9dvw1yh9zyl1h4j9xp4n9rfzxhfvvq3139bi";
        };
        packageRequires = [ emacs ];
        meta = {
--- a/pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix
@ -64,10 +64,10 @@
      elpaBuild {
        pname = "annotate";
        ename = "annotate";
-        version = "2.0.3";
+        version = "2.1.0";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/annotate-2.0.3.tar";
-          sha256 = "1kq195nmspysb1kiqcfh0kwxzp40ij9ccw1c204ayr40a0wp7ilc";
+          url = "https://elpa.nongnu.org/nongnu/annotate-2.1.0.tar";
+          sha256 = "07q8s3qi3lm8g01ypvqqq0cn5jx5jrgyv74fbfam3mmz5l3mqp6q";
        };
        packageRequires = [];
        meta = {
@ -261,10 +261,10 @@
      elpaBuild {
        pname = "blueprint-ts-mode";
        ename = "blueprint-ts-mode";
-        version = "0.0.2";
+        version = "0.0.3";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/blueprint-ts-mode-0.0.2.tar";
-          sha256 = "0fyvff2zh6iiswhxcvqgnxdhq3yk5f0w4a2w0jp126fvd3ryspym";
+          url = "https://elpa.nongnu.org/nongnu/blueprint-ts-mode-0.0.3.tar";
+          sha256 = "1ii46kmiaxywymhjlj85c3ypdnkkhgyaqgzhnkzzfz6946dchj3v";
        };
        packageRequires = [ emacs ];
        meta = {
@ -361,10 +361,10 @@
      elpaBuild {
        pname = "cider";
        ename = "cider";
-        version = "1.9.0";
+        version = "1.11.0";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/cider-1.9.0.tar";
-          sha256 = "08vc1v4gzh1njvqhg10c07wq28r2s9qq3y7i4b5clrzgy9l872cw";
+          url = "https://elpa.nongnu.org/nongnu/cider-1.11.0.tar";
+          sha256 = "010sl2l9vx3k095bkgvi7w1zvb68jh7lj4plmjn98lmzmbhq7q27";
        };
        packageRequires = [
          clojure-mode
@ -1339,10 +1339,10 @@
      elpaBuild {
        pname = "git-modes";
        ename = "git-modes";
-        version = "1.4.1";
+        version = "1.4.2";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/git-modes-1.4.1.tar";
-          sha256 = "0zxab7rjy5rh8y0ln9h04pvcim8a4qdpj1zs0c0dwbxcsa7v7hz1";
+          url = "https://elpa.nongnu.org/nongnu/git-modes-1.4.2.tar";
+          sha256 = "15lvya85710wyyynmgq7a92lc5mrrv2nfh19nxh92mkdd3r0c3fg";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -2366,6 +2366,7 @@
        };
      }) {};
    package-lint = callPackage ({ cl-lib ? null
+                                , compat
                                , elpaBuild
                                , emacs
                                , fetchurl
@ -2374,12 +2375,12 @@
      elpaBuild {
        pname = "package-lint";
        ename = "package-lint";
-        version = "0.19";
+        version = "0.20";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/package-lint-0.19.tar";
-          sha256 = "0zq4kbir2l5fly8a37fdp4msygswl44vhjpwpcj1zqz13w30cd8h";
+          url = "https://elpa.nongnu.org/nongnu/package-lint-0.20.tar";
+          sha256 = "13ff9g2lzcddi8n6bcmb7g93kxc8v9h3g9k8qcn42bl7jjy12iqf";
        };
-        packageRequires = [ cl-lib emacs let-alist ];
+        packageRequires = [ cl-lib compat emacs let-alist ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/package-lint.html";
          license = lib.licenses.free;
@ -2607,10 +2608,10 @@
      elpaBuild {
        pname = "racket-mode";
        ename = "racket-mode";
-        version = "1.0.20230919.113921";
+        version = "1.0.20231109.110741";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20230919.113921.tar";
-          sha256 = "00b4bw4cqm9yc8fxz14da5ahrjrmshf3497l8p65ss0s6qby5ag3";
+          url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20231109.110741.tar";
+          sha256 = "19d1bs0ajc28wa49f1mphdwrpfywib5cvv3mxip6az9x6faand7g";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2986,10 +2987,10 @@
      elpaBuild {
        pname = "subed";
        ename = "subed";
-        version = "1.2.5";
+        version = "1.2.6";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/subed-1.2.5.tar";
-          sha256 = "0qaliyn79zkpy3ppqb0s61i5hfbbcj8climj7x9c6vpq86s57mv1";
+          url = "https://elpa.nongnu.org/nongnu/subed-1.2.6.tar";
+          sha256 = "005nzmv5i24wxwhs1l76fpk06rpf8bw19fccrqkiph5k77lg42gr";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3001,10 +3002,10 @@
      elpaBuild {
        pname = "sweeprolog";
        ename = "sweeprolog";
-        version = "0.26.0";
+        version = "0.26.2";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/sweeprolog-0.26.0.tar";
-          sha256 = "0pgxz3ckw3qjzqyn6vr8k8y1gdiybsm47ik8j62ybsnqs7ivs208";
+          url = "https://elpa.nongnu.org/nongnu/sweeprolog-0.26.2.tar";
+          sha256 = "14rcg6rs4dd4a0pr4makkg1flwxfrxyg5xrs5sa034bzxj6zqal5";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -3470,10 +3471,10 @@
      elpaBuild {
        pname = "xah-fly-keys";
        ename = "xah-fly-keys";
-        version = "24.13.20231025112537";
+        version = "24.15.20231105091131";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-24.13.20231025112537.tar";
-          sha256 = "1h7z9g3307w0cg361md8mbhsia2534ncqihdfsasg5qhw9184sib";
+          url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-24.15.20231105091131.tar";
+          sha256 = "13wvf6zn87xpglpycxmjmq6mfvpr21bsihsshx06my38832kw128";
        };
        packageRequires = [ emacs ];
        meta = {
--- a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
--- a/pkgs/applications/editors/geany/default.nix
+++ b/pkgs/applications/editors/geany/default.nix
@ -7,20 +7,27 @@
 , file
 , libintl
 , hicolor-icon-theme
+, python3
 , wrapGAppsHook
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "geany";
-  version = "1.38";
+  version = "2.0";

  outputs = [ "out" "dev" "doc" "man" ];

  src = fetchurl {
-    url = "https://download.geany.org/${pname}-${version}.tar.bz2";
-    sha256 = "abff176e4d48bea35ee53037c49c82f90b6d4c23e69aed6e4a5ca8ccd3aad546";
+    url = "https://download.geany.org/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-VltM0vAxHB46Fn7HHEoy26ZC4P5VSuW7a4F3t6dMzJI=";
  };

+  patches = [
+    # The test runs into UB in headless environments and crashes at least on headless Darwin.
+    # Remove if https://github.com/geany/geany/pull/3676 is merged (or the issue fixed otherwise).
+    ./disable-test-sidebar.patch
+  ];
+
  nativeBuildInputs = [
    pkg-config
    intltool
@ -28,6 +35,7 @@ stdenv.mkDerivation rec {
    which
    file
    hicolor-icon-theme
+    python3
    wrapGAppsHook
  ];

@ -35,6 +43,11 @@ stdenv.mkDerivation rec {
    gtk3
  ];

+  preCheck = ''
+    patchShebangs --build tests/ctags/runner.sh
+    patchShebangs --build scripts
+  '';
+
  doCheck = true;

  enableParallelBuilding = true;
@ -61,9 +74,9 @@ stdenv.mkDerivation rec {
      - Plugin interface
    '';
    homepage = "https://www.geany.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ frlan ];
    platforms = platforms.all;
    mainProgram = "geany";
  };
-}
+})
--- a/pkgs/applications/editors/geany/disable-test-sidebar.patch
+++ b/pkgs/applications/editors/geany/disable-test-sidebar.patch
@ -0,0 +1,11 @@
+--- a/tests/Makefile.in	2023-10-19 18:10:06.000000000 +0200
+++ b/tests/Makefile.in	2023-11-10 00:13:09.816498568 +0100
+@@ -86,7 +86,7 @@
+ POST_UNINSTALL = :
+ build_triplet = @build@
+ host_triplet = @host@
+-check_PROGRAMS = test_utils$(EXEEXT) test_sidebar$(EXEEXT)
+check_PROGRAMS = test_utils$(EXEEXT)
+ subdir = tests
+ ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_cxx_compile_stdcxx.m4 \
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -30,21 +30,21 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "01xw0dpwb4ih2xlpgc0yq48wqb5nmicz98srbgz01sbmyji8x1lf";
-    x86_64-darwin = "13i449px6pajb94ymvi6vwmm25vyyh4vjrb86yiq4dcx1plcrxfc";
-    aarch64-linux = "174zl811pv5rznxz3fh7bkwz9iini8lmb8xfjs4i14sym7sxw5x3";
-    aarch64-darwin = "05kjmhr3dwbj16k4ilc8nl6ckm21fyak6pr1zzdxywqb5qd7qwr8";
-    armv7l-linux = "0icc4cx5p5fxsi8cz3mxik4vnmrv2dvfzm220nl9p13bn1ri3f6s";
+    x86_64-linux = "1vdgc4mnysij2sf87d5dfh0yw9j2a58lvmnwzzsj1icaydhkhfjy";
+    x86_64-darwin = "0zxky35ifgjwb6p41mi3z34fvn49fpl09r1n9kp46ip8mqsm7gm7";
+    aarch64-linux = "0qv0gbkfx78a393x44g6zmi5gs57d2cnjqlwfv0yrhkgi5s8v1ma";
+    aarch64-darwin = "1rl4256h8i52akzy8g2bkydsi5llp05qqj0jr2di896x4niw57iz";
+    armv7l-linux = "18mcf5x3h3mwlvhkl86b2wcl0adj7pr4aqr12va07mwlh2fp83h4";
  }.${system} or throwSystem;
 in
  callPackage ./generic.nix rec {
    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.84.0";
+    version = "1.84.2";
    pname = "vscode" + lib.optionalString isInsiders "-insiders";

    # This is used for VS Code - Remote SSH test
-    rev = "d037ac076cee195194f93ce6fe2bdfe2969cc82d";
+    rev = "1a5daa3a0231a0fbba4f14db7ec463cf99d7768e";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
    longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@ -68,7 +68,7 @@ in
      src = fetchurl {
        name = "vscode-server-${rev}.tar.gz";
        url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "017g82h3jcygm6hi0s36ij8vxggz7p5j36nww5f53kn6a1s1wzcx";
+        sha256 = "18kx7szx1v7dk0qqsw6cf40zd8mrc7a8snvm6i1n8q039d9mx2jz";
      };
    };

--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0cqkxd4pywkrvg3b96f1dyain6vlrb3di8a0yskmq3h58qd6k8rc";
-    x86_64-darwin = "09y3whpp2z8fgb42pb9lw0b4wn0np3rdjkn5l1kldjljfrcwcn9g";
-    aarch64-linux = "1kh8qylj77km8jhmx9a2bck7y4bb0fjx46sll7swagxz27b8ahi0";
-    aarch64-darwin = "14g60sx3c5m02ly880sxwhmzvpxqw4pfij2ibgyprzdlpap0r2b0";
-    armv7l-linux = "1s4rpd5p4kwmi89cml1106l9dccdwnqq3lyr8ym781pj9p75i8wp";
+    x86_64-linux = "1v2lcbmb0g3pw58mmiqd2j9c7r7dcl371nxc6w9rsmcbf7s0f8h0";
+    x86_64-darwin = "11if8l556rsvacwbsknv2hnqfwkad99klgnwx4kjcbm8g63ra3ab";
+    aarch64-linux = "1fmahjn99cvylm8r4cf4b1654gyyk6n6mqad1l0cncpypdxc2pdw";
+    aarch64-darwin = "053jnxpkpfh5a8nfx557ib6byhi4dd1dnxasp4igy59cbx25an9q";
+    armv7l-linux = "0qc48mg34pkr23p3wnlczvfspfii3qn6ikbkgj1qsagxn9ycqjak";
  }.${system} or throwSystem;

  sourceRoot = lib.optionalString (!stdenv.isDarwin) ".";
@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.83.1.23285";
+    version = "1.84.2.23314";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/emulators/gxemul/default.nix
+++ b/pkgs/applications/emulators/gxemul/default.nix
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
  version = "0.7.0";

  src = fetchurl {
-    url = "http://gavare.se/gxemul/src/${pname}-${version}.tar.gz";
+    url = "https://gavare.se/gxemul/src/${pname}-${version}.tar.gz";
    sha256 = "sha256-ecRDfG+MqQT0bTOsNgYqZf3PSpKiSEeOQIqxEpXPjoM=";
  };

@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    homepage = "http://gavare.se/gxemul/";
+    homepage = "https://gavare.se/gxemul/";
    description = "Gavare's experimental emulator";
    longDescription = ''
      GXemul is a framework for full-system computer architecture
--- a/pkgs/applications/file-managers/dfilemanager/default.nix
+++ b/pkgs/applications/file-managers/dfilemanager/default.nix
@ -17,7 +17,7 @@ mkDerivation {
  cmakeFlags = [ "-DQT5BUILD=true" ];

  meta = {
-    homepage = "http://dfilemanager.sourceforge.net/";
+    homepage = "https://github.com/probonopd/dfilemanager";
    description = "File manager written in Qt/C++";
    license = lib.licenses.gpl2;
    platforms = lib.platforms.unix;
--- a/pkgs/applications/file-managers/worker/default.nix
+++ b/pkgs/applications/file-managers/worker/default.nix
@ -1,20 +0,0 @@
-{ lib, stdenv, libX11, fetchurl }:
-
-stdenv.mkDerivation rec {
-  pname = "worker";
-  version = "4.12.1";
-
-  src = fetchurl {
-    url = "http://www.boomerangsworld.de/cms/worker/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-11tSOVuGuCU0IvqpEKiKvUZj9DtjWJErLpM8IsTtvcs=";
-  };
-
-  buildInputs = [ libX11 ];
-
-  meta = with lib; {
-    description = "A two-pane file manager with advanced file manipulation features";
-    homepage = "http://www.boomerangsworld.de/cms/worker/index.html";
-    license =  licenses.gpl2;
-    maintainers = [];
-  };
-}
--- a/pkgs/applications/graphics/freecad/0001-NIXOS-don-t-ignore-PYTHONPATH.patch
+++ b/pkgs/applications/graphics/freecad/0001-NIXOS-don-t-ignore-PYTHONPATH.patch
@ -24,12 +24,13 @@ diff --git a/src/Base/Interpreter.cpp b/src/Base/Interpreter.cpp
 index 52c47168af..9966bd0013 100644
 --- a/src/Base/Interpreter.cpp
 +++ b/src/Base/Interpreter.cpp
-@@ -554,7 +554,7 @@ void initInterpreter(int argc,char *argv[])
+@@ -554,7 +554,9 @@ void initInterpreter(int argc,char *argv[])
 {
     PyStatus status;
     PyConfig config;
-    PyConfig_InitIsolatedConfig(&config);
-+    PyConfig_InitPythonConfig(&config);
+     PyConfig_InitIsolatedConfig(&config);
+    config.isolated = 0;
+    config.use_environment = 1;
 
     status = PyConfig_SetBytesArgv(&config, argc, argv);
     if (PyStatus_Exception(status)) {
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@ -9,6 +9,7 @@
 , boost
 , coin3d
 , eigen
+, freecad  # for passthru.tests
 , gfortran
 , gts
 , hdf5
@ -35,6 +36,7 @@
 , qtwebengine
 , qtx11extras
 , qtxmlpatterns
+, runCommand  # for passthru.tests
 , scipy
 , shiboken2
 , soqt
@ -147,6 +149,21 @@ stdenv.mkDerivation (finalAttrs: {
    ln -s $out/bin/FreeCADCmd $out/bin/freecadcmd
  '';

+  passthru.tests = {
+    # Check that things such as argument parsing still work correctly with
+    # the above PYTHONPATH patch. Previously the patch used above changed
+    # the `PyConfig_InitIsolatedConfig` to `PyConfig_InitPythonConfig`,
+    # which caused the built-in interpreter to attempt (and fail) to doubly
+    # parse argv. This should catch if that ever regresses and also ensures
+    # that PYTHONPATH is still respected enough for the FreeCAD console to
+    # successfully run and check that it was included in `sys.path`.
+    python-path = runCommand "freecad-test-console" {
+      nativeBuildInputs = [ freecad ];
+    } ''
+      HOME="$(mktemp -d)" PYTHONPATH="$(pwd)/test" FreeCADCmd --log-file $out -c "if not '$(pwd)/test' in sys.path: sys.exit(1)" </dev/null
+    '';
+  };
+
  meta = {
    homepage = "https://www.freecad.org";
    description = "General purpose Open Source 3D CAD/MCAD/CAx/CAE/PLM modeler";
--- a/pkgs/applications/graphics/openscad/default.nix
+++ b/pkgs/applications/graphics/openscad/default.nix
@ -105,7 +105,7 @@ mkDerivation rec {
      machine parts but pretty sure is not what you are looking for when you are more
      interested in creating computer-animated movies.
    '';
-    homepage = "http://openscad.org/";
+    homepage = "https://openscad.org/";
    license = lib.licenses.gpl2;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ bjornfor raskin gebner ];
--- a/pkgs/applications/graphics/pikopixel/default.nix
+++ b/pkgs/applications/graphics/pikopixel/default.nix
@ -13,7 +13,7 @@ in gnustep'.gsmakeDerivation rec {
  version = "1.0-b10";

  src = fetchurl {
-    url = "http://twilightedge.com/downloads/PikoPixel.Sources.${version}.tar.gz";
+    url = "https://twilightedge.com/downloads/PikoPixel.Sources.${version}.tar.gz";
    sha256 = "1b27npgsan2nx1p581b9q2krx4506yyd6s34r4sf1r9x9adshm77";
  };

@ -38,8 +38,8 @@ in gnustep'.gsmakeDerivation rec {

  meta = with lib; {
    description = "Application for drawing and editing pixel-art images";
-    homepage = "http://twilightedge.com/mac/pikopixel/";
-    downloadPage = "http://twilightedge.com/mac/pikopixel/";
+    homepage = "https://twilightedge.com/mac/pikopixel/";
+    downloadPage = "https://twilightedge.com/mac/pikopixel/";
    license = licenses.agpl3;
    maintainers = with maintainers; [ fgaz ];
    platforms = platforms.all;
--- a/pkgs/applications/graphics/viewnior/default.nix
+++ b/pkgs/applications/graphics/viewnior/default.nix
@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
         in mind (follows Gnome HIG2).
      '';
    license = licenses.gpl3;
-    homepage = "http://siyanpanayotov.com/project/viewnior/";
+    homepage = "https://siyanpanayotov.com/project/viewnior/";
    maintainers = with maintainers; [ smironov artturin ];
    platforms = platforms.gnu ++ platforms.linux;
  };
--- a/pkgs/applications/misc/binance/default.nix
+++ b/pkgs/applications/misc/binance/default.nix
@ -1,56 +0,0 @@
-{ lib, stdenv, fetchurl, dpkg, autoPatchelfHook, makeWrapper, electron
-, alsa-lib, gtk3, libxshmfence, mesa, nss, popt }:
-
-stdenv.mkDerivation rec {
-  pname = "binance";
-  version = "1.39.0";
-
-  src = fetchurl {
-    url = "https://github.com/binance/desktop/releases/download/v${version}/${pname}-${version}-amd64-linux.deb";
-    sha256 = "sha256-6VQerIzX2u8QGUsa8kvu6Qud3OEn9lrZkQddfkZ1X0g=";
-  };
-
-  nativeBuildInputs = [
-    dpkg
-    autoPatchelfHook
-    makeWrapper
-  ];
-
-  buildInputs = [ alsa-lib gtk3 libxshmfence mesa nss popt ];
-
-  libPath = lib.makeLibraryPath buildInputs;
-
-  dontBuild = true;
-  dontConfigure = true;
-
-  unpackPhase = ''
-    dpkg-deb -x ${src} ./
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mv usr $out
-    mv opt $out
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    substituteInPlace $out/share/applications/binance.desktop --replace '/opt/Binance' $out/bin
-
-    makeWrapper ${electron}/bin/electron \
-      $out/bin/binance \
-      --add-flags $out/opt/Binance/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : ${libPath}
-  '';
-
-  meta = with lib; {
-    description = "Binance Cryptoexchange Official Desktop Client";
-    homepage = "https://www.binance.com/en/desktop-download";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [ wolfangaukang ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
--- a/pkgs/applications/misc/openbrf/default.nix
+++ b/pkgs/applications/misc/openbrf/default.nix
@ -1,4 +1,4 @@
-{ mkDerivation, lib, stdenv, fetchFromGitHub, qtbase, vcg, glew, qmake, libGLU, libGL }:
+{ mkDerivation, lib, stdenv, fetchFromGitHub, fetchpatch, qtbase, vcg, glew, qmake, libGLU, eigen, libGL }:


 mkDerivation {
@ -12,12 +12,23 @@ mkDerivation {
    sha256 = "16254cnr60ihcn7bki7wl1qm6gkvzb99cn66md1pnb7za8nvzf4j";
  };

-  buildInputs = [ qtbase vcg glew ];
+  patches = [
+    # https://github.com/cfcohen/openbrf/pull/7
+    (fetchpatch {
+      name = "fix-build-against-newer-vcglib.patch";
+      url = "https://github.com/cfcohen/openbrf/commit/6d82a25314a393e72bfbe2ffc3965bcac407df4c.patch";
+      hash = "sha256-rNxAw6Le6QXMSirIAMhMmqVgNJLq6osnEOhWrY3mTpM=";
+    })
+  ];
+
+  buildInputs = [ qtbase vcg glew eigen ];

  nativeBuildInputs = [ qmake ];

  qmakeFlags = [ "openBrf.pro" ];

+  env.NIX_CFLAGS_COMPILE = "-isystem ${lib.getDev eigen}/include/eigen3";
+
  postPatch = ''
    sed -i 's,^VCGLIB .*,VCGLIB = ${vcg}/include,' openBrf.pro
  '';
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@ -33,14 +33,14 @@ https://github.com/NixOS/nixpkgs/issues/199596#issuecomment-1310136382 */
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.4.7";
+  version = "1.4.8";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-ddOyAyvFifsdNMbwcMZTyhA+5pvz6/Eu/VoBmdsHi54=";
+    sha256 = "sha256-Fy3cy6c36Qsi8F7cC/MI8g6tdfkn8fDBncL+ZOoiGcs=";
  };

  buildInputs = [
--- a/pkgs/applications/misc/tandoor-recipes/default.nix
+++ b/pkgs/applications/misc/tandoor-recipes/default.nix
@ -42,6 +42,11 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
  patches = [
    # Allow setting MEDIA_ROOT through environment variable
    ./media-root.patch
+    # https://github.com/TandoorRecipes/recipes/pull/2706
+    (fetchpatch {
+      url = "https://github.com/TandoorRecipes/recipes/commit/8f66f5c3ca61751a80cc133ff4c59019d6fca406.patch";
+      hash = "sha256-oF5YlPg1LEdLvKpxiSqjTmYPbrGquPlRIz6A05031gs=";
+    })
  ];

  propagatedBuildInputs = with python.pkgs; [
--- a/pkgs/applications/misc/yate/default.nix
+++ b/pkgs/applications/misc/yate/default.nix
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Yet another telephony engine";
-    homepage = "http://yate.ro/";
+    homepage = "https://yate.ro/";
    # Yate's license is GPL with an exception for linking with
    # OpenH323 and PWlib (licensed under MPL).
    license = lib.licenses.gpl2Only;
--- a/pkgs/applications/networking/clash-verge/default.nix
+++ b/pkgs/applications/networking/clash-verge/default.nix
@ -4,7 +4,6 @@
 , dpkg
 , wrapGAppsHook
 , autoPatchelfHook
-, clash
 , clash-meta
 , openssl
 , webkitgtk
@ -49,7 +48,6 @@ stdenv.mkDerivation rec {
  '';

  postFixup = ''
-    ln -s ${lib.getExe clash} $out/bin/clash
    ln -s ${lib.getExe clash-meta} $out/bin/clash-meta
  '';

--- a/pkgs/applications/networking/cluster/fn-cli/default.nix
+++ b/pkgs/applications/networking/cluster/fn-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "fn";
-  version = "0.6.26";
+  version = "0.6.28";

  src = fetchFromGitHub {
    owner = "fnproject";
    repo = "cli";
    rev = version;
-    hash = "sha256-Tj64/8uYEy4qZISjmtpOGTMzgSkBB516/Dej6/biYRY=";
+    hash = "sha256-/ifr/sSaChZKRe9wCcjURhqZl2/JhIMewZSlJiit/7w=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/opentofu/default.nix
+++ b/pkgs/applications/networking/cluster/opentofu/default.nix
@ -14,15 +14,15 @@
 let
  package =  buildGoModule rec {
    pname = "opentofu";
-    version = "1.6.0-alpha3";
+    version = "1.6.0-alpha4";

    src = fetchFromGitHub {
      owner = "opentofu";
      repo = "opentofu";
      rev = "v${version}";
-      hash = "sha256-D95YzliadhhcOx8gW+lhECiYBtezsS8rj0Tz/29azlA=";
+      hash = "sha256-JkYMGD6hNMcMYPXnFUm/6T0EfzeAfG4oQuyqcNv3hVE=";
    };
-    vendorHash = "sha256-SbGdmPTJRSMDhqg0GEfdiQ+2Uw7xmz0Kcyrr1ANlKo4=";
+    vendorHash = "sha256-kE61inSQ8aCFnPf8plVRUJgruSFVOsogJAbI1zvJdb4=";
    ldflags = [ "-s" "-w" ];

    postConfigure = ''
--- a/pkgs/applications/networking/cluster/pig/default.nix
+++ b/pkgs/applications/networking/cluster/pig/default.nix
@ -40,6 +40,6 @@ stdenv.mkDerivation rec {
    '';

    platforms = platforms.linux;
-    maintainers = [ maintainers.skeidel ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "pluto";
-  version = "5.18.5";
+  version = "5.18.6";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${version}";
-    hash = "sha256-zdfzGmEL1ZsU3g3jmkgOfxcIGyffkC9UeiU18jPOr7Y=";
+    hash = "sha256-PQf1gEFlZ6Y9KMQjKeXAZy/OfxCbiKfST3pr9xp0/vg=";
  };

  vendorHash = "sha256-8ZOYp/vM16PugmE+3QK7ZRDwIwRCMEwD0NRyiOBlh14=";
--- a/pkgs/applications/networking/irc/kirc/default.nix
+++ b/pkgs/applications/networking/irc/kirc/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
  installFlags = [ "PREFIX=$(out)" ];

  meta = with lib; {
-    homepage = "http://kirc.io/";
+    homepage = "https://mcpcpc.github.io/kirc/";
    description = "Tiny IRC client written in C99";
    longDescription = ''
      kirc is a tiny open-source Internet Relay Chat (IRC) client designed with
--- a/pkgs/applications/networking/irc/kvirc/default.nix
+++ b/pkgs/applications/networking/irc/kvirc/default.nix
@ -24,7 +24,7 @@ mkDerivation rec {

  meta = with lib; {
    description = "Advanced IRC Client";
-    homepage = "http://www.kvirc.net/";
+    homepage = "https://www.kvirc.net/";
    license = licenses.gpl2;
    maintainers = [ maintainers.suhr ];
    platforms = platforms.linux;
--- a/pkgs/applications/networking/p2p/mldonkey/default.nix
+++ b/pkgs/applications/networking/p2p/mldonkey/default.nix
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
  meta = {
    broken = stdenv.isDarwin;
    description = "Client for many p2p networks, with multiple frontends";
-    homepage = "http://mldonkey.sourceforge.net/";
+    homepage = "https://github.com/ygrek/mldonkey";
    license = lib.licenses.gpl2Only;
    platforms = lib.platforms.unix;
  };
--- a/pkgs/applications/networking/ssb-patchwork/default.nix
+++ b/pkgs/applications/networking/ssb-patchwork/default.nix
@ -47,7 +47,7 @@ in
      '';
      homepage = "https://www.scuttlebutt.nz/";
      license = licenses.agpl3;
-      maintainers = with maintainers; [ asymmetric ninjatrappeur cyplo ];
+      maintainers = with maintainers; [ asymmetric picnoir cyplo ];
      mainProgram = "ssb-patchwork";
      platforms = [ "x86_64-linux" ];
    };
--- a/pkgs/applications/networking/upnp-router-control/default.nix
+++ b/pkgs/applications/networking/upnp-router-control/default.nix
@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "upnp-router-control";
-  version = "0.3.3";
+  version = "0.3.4";

  src = fetchzip {
    url = "https://launchpad.net/upnp-router-control/trunk/${version}/+download/upnp-router-control-${version}.tar.xz";
-    hash = "sha256-d5NmA1tOQtYPjGXYfH0p9CCnWM+aVTX2KuV36QCDxd8=";
+    hash = "sha256-28F/OB2fHemn7HLVFEDmefRA5AsEaQKy+Qbcv75z9w0=";
  };

  nativeBuildInputs = [
--- a/Show more
+++ b/Show more