Merge branch 'staging-next' into staging

2024-09-20 04:19:00 +02:00 · 2023-11-07 03:41:49 +01:00 · 2023-11-07 03:41:49 +01:00 · 8012034692
parent fbb3ff5e12 311c0ae699
commit 8012034692
568 changed files with 25678 additions and 8009 deletions
--- a/doc/builders/images/dockertools.section.md
+++ b/doc/builders/images/dockertools.section.md
@ -275,7 +275,7 @@ pullImage {
 `nix-prefetch-docker` command can be used to get required image parameters:

 ```ShellSession
-$ nix run nixpkgs.nix-prefetch-docker -c nix-prefetch-docker --image-name mysql --image-tag 5
+$ nix run nixpkgs#nix-prefetch-docker -- --image-name mysql --image-tag 5
 ```

 Since a given `imageName` may transparently refer to a manifest list of images which support multiple architectures and/or operating systems, you can supply the `--os` and `--arch` arguments to specify exactly which image you want. By default it will match the OS and architecture of the host the command is run on.
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@ -343,7 +343,24 @@ rec {
    , newScope
    }:
    { otherSplices
+    # Attrs from `self` which won't be spliced.
+    # Avoid using keep, it's only used for a python hook workaround, added in PR #104201.
+    # ex: `keep = (self: { inherit (self) aAttr; })`
    , keep ? (_self: {})
+    # Additional attrs to add to the sets `callPackage`.
+    # When the package is from a subset (but not a subset within a package IS #211340)
+    # within `spliced0` it will be spliced.
+    # When using an package outside the set but it's available from `pkgs`, use the package from `pkgs.__splicedPackages`.
+    # If the package is not available within the set or in `pkgs`, such as a package in a let binding, it will not be spliced
+    # ex:
+    # ```
+    # nix-repl> darwin.apple_sdk.frameworks.CoreFoundation
+    #   «derivation ...CoreFoundation-11.0.0.drv»
+    # nix-repl> darwin.CoreFoundation
+    #   error: attribute 'CoreFoundation' missing
+    # nix-repl> darwin.callPackage ({ CoreFoundation }: CoreFoundation) { }
+    #   «derivation ...CoreFoundation-11.0.0.drv»
+    # ```
    , extra ? (_spliced0: {})
    , f
    }:
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@ -100,6 +100,32 @@ rec {
    ];
  };

+  # given two patterns, return a pattern which is their logical AND.
+  # Since a pattern is a list-of-disjuncts, this needs to
+  patternLogicalAnd = pat1_: pat2_:
+    let
+      # patterns can be either a list or a (bare) singleton; turn
+      # them into singletons for uniform handling
+      pat1 = lib.toList pat1_;
+      pat2 = lib.toList pat2_;
+    in
+      lib.concatMap (attr1:
+        map (attr2:
+          lib.recursiveUpdateUntil
+            (path: subattr1: subattr2:
+              if (builtins.intersectAttrs subattr1 subattr2) == {} || subattr1 == subattr2
+              then true
+              else throw ''
+                pattern conflict at path ${toString path}:
+                  ${builtins.toJSON subattr1}
+                  ${builtins.toJSON subattr2}
+                '')
+            attr1
+            attr2
+            )
+          pat2)
+        pat1;
+
  matchAnyAttrs = patterns:
    if builtins.isList patterns then attrs: any (pattern: matchAttrs pattern attrs) patterns
    else matchAttrs patterns;
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1411,6 +1411,12 @@
    githubId = 58516559;
    name = "Alexander Rezvov";
  };
+  argrat = {
+    email = "n.bertazzo@protonmail.com";
+    github = "argrat";
+    githubId = 98821629;
+    name = "Nicolò Bertazzo";
+  };
  arian-d = {
    email = "arianxdehghani@gmail.com";
    github = "arian-d";
@ -19179,6 +19185,12 @@
    githubId = 43315;
    name = "William Roe";
  };
+  wladmis = {
+    email = "dev@wladmis.org";
+    github = "wladmis";
+    githubId = 5000261;
+    name = "Wladmis";
+  };
  wldhx = {
    email = "wldhx+nixpkgs@wldhx.me";
    github = "wldhx";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -48,6 +48,7 @@ lua-resty-jwt,,,,,,
 lua-resty-openidc,,,,,,
 lua-resty-openssl,,,,,,
 lua-resty-session,,,,,,
+lua-rtoml,https://github.com/lblasc/lua-rtoml,,,,,lblasc
 lua-subprocess,https://github.com/0x0ade/lua-subprocess,,,,5.1,scoder12
 lua-term,,,,,,
 lua-toml,,,,,,
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -104,6 +104,8 @@

 - hardware/infiniband.nix adds infiniband subnet manager support using an [opensm](https://github.com/linux-rdma/opensm) systemd-template service, instantiated on card guids. The module also adds kernel modules and cli tooling to help administrators debug and measure performance. Available as [hardware.infiniband.enable](#opt-hardware.infiniband.enable).

+- [zwave-js](https://github.com/zwave-js/zwave-js-server), a small server wrapper around Z-Wave JS to access it via a WebSocket. Available as [services.zwave-js](#opt-services.zwave-js.enable).
+
 - [Honk](https://humungus.tedunangst.com/r/honk), a complete ActivityPub server with minimal setup and support costs.
  Available as [services.honk](#opt-services.honk.enable).

--- a/nixos/lib/make-btrfs-fs.nix
+++ b/nixos/lib/make-btrfs-fs.nix
@ -15,6 +15,8 @@
 , volumeLabel
 , uuid ? "44444444-4444-4444-8888-888888888888"
 , btrfs-progs
+, libfaketime
+, fakeroot
 }:

 let
@ -23,7 +25,7 @@ in
 pkgs.stdenv.mkDerivation {
  name = "btrfs-fs.img${lib.optionalString compressImage ".zst"}";

-  nativeBuildInputs = [ btrfs-progs ] ++ lib.optional compressImage zstd;
+  nativeBuildInputs = [ btrfs-progs libfaketime fakeroot ] ++ lib.optional compressImage zstd;

  buildCommand =
    ''
@ -50,7 +52,7 @@ pkgs.stdenv.mkDerivation {
      cp ${sdClosureInfo}/registration ./rootImage/nix-path-registration

      touch $img
-      mkfs.btrfs -L ${volumeLabel} -U ${uuid} -r ./rootImage --shrink $img
+      faketime -f "1970-01-01 00:00:01" fakeroot mkfs.btrfs -L ${volumeLabel} -U ${uuid} -r ./rootImage --shrink $img

      if ! btrfs check $img; then
        echo "--- 'btrfs check' failed for BTRFS image ---"
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -564,6 +564,7 @@
  ./services/home-automation/home-assistant.nix
  ./services/home-automation/homeassistant-satellite.nix
  ./services/home-automation/zigbee2mqtt.nix
+  ./services/home-automation/zwave-js.nix
  ./services/logging/SystemdJournal2Gelf.nix
  ./services/logging/awstats.nix
  ./services/logging/filebeat.nix
--- a/nixos/modules/programs/wayland/sway.nix
+++ b/nixos/modules/programs/wayland/sway.nix
@ -42,11 +42,6 @@ in {
      <https://github.com/swaywm/sway/wiki> and
      "man 5 sway" for more information'');

-    enableRealtime = mkEnableOption (lib.mdDoc ''
-      add CAP_SYS_NICE capability on `sway` binary for realtime scheduling
-      privileges. This may improve latency and reduce stuttering, specially in
-      high load scenarios'') // { default = true; };
-
    package = mkOption {
      type = with types; nullOr package;
      default = defaultSwayPackage;
@ -154,14 +149,6 @@ in {
            "sway/config".source = mkOptionDefault "${cfg.package}/etc/sway/config";
          };
        };
-        security.wrappers = mkIf (cfg.enableRealtime && cfg.package != null) {
-          sway = {
-            owner = "root";
-            group = "root";
-            source = "${cfg.package}/bin/sway";
-            capabilities = "cap_sys_nice+ep";
-          };
-        };
        # To make a Sway session available if a display manager like SDDM is enabled:
        services.xserver.displayManager.sessionPackages = optionals (cfg.package != null) [ cfg.package ]; }
      (import ./wayland-session.nix { inherit lib pkgs; })
--- a/nixos/modules/services/backup/syncoid.nix
+++ b/nixos/modules/services/backup/syncoid.nix
@ -369,7 +369,7 @@ in
              PrivateDevices = true;
              PrivateMounts = true;
              PrivateNetwork = mkDefault false;
-              PrivateUsers = true;
+              PrivateUsers = false; # Enabling this breaks on zfs-2.2.0
              ProtectClock = true;
              ProtectControlGroups = true;
              ProtectHome = true;
--- a/nixos/modules/services/display-managers/greetd.nix
+++ b/nixos/modules/services/display-managers/greetd.nix
@ -59,6 +59,7 @@ in
    security.pam.services.greetd = {
      allowNullPassword = true;
      startSession = true;
+      enableGnomeKeyring = mkDefault config.services.gnome.gnome-keyring.enable;
    };

    # This prevents nixos-rebuild from killing greetd by activating getty again
--- a/nixos/modules/services/home-automation/zwave-js.nix
+++ b/nixos/modules/services/home-automation/zwave-js.nix
@ -0,0 +1,152 @@
+{config, pkgs, lib, ...}:
+
+with lib;
+
+let
+  cfg = config.services.zwave-js;
+  mergedConfigFile = "/run/zwave-js/config.json";
+  settingsFormat = pkgs.formats.json {};
+in {
+  options.services.zwave-js = {
+    enable = mkEnableOption (mdDoc "the zwave-js server on boot");
+
+    package = mkPackageOptionMD pkgs "zwave-js-server" { };
+
+    port = mkOption {
+      type = types.port;
+      default = 3000;
+      description = mdDoc ''
+        Port for the server to listen on.
+      '';
+    };
+
+    serialPort = mkOption {
+      type = types.path;
+      description = mdDoc ''
+        Serial port device path for Z-Wave controller.
+      '';
+      example = "/dev/ttyUSB0";
+    };
+
+    secretsConfigFile = mkOption {
+      type = types.path;
+      description = mdDoc ''
+        JSON file containing secret keys. A dummy example:
+
+        ```
+        {
+          "securityKeys": {
+            "S0_Legacy": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+            "S2_Unauthenticated": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
+            "S2_Authenticated": "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC",
+            "S2_AccessControl": "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
+          }
+        }
+        ```
+
+        See
+        <https://zwave-js.github.io/node-zwave-js/#/getting-started/security-s2>
+        for details. This file will be merged with the module-generated config
+        file (taking precedence).
+
+        Z-Wave keys can be generated with:
+
+          {command}`< /dev/urandom tr -dc A-F0-9 | head -c32 ;echo`
+
+
+        ::: {.warning}
+        A file in the nix store should not be used since it will be readable to
+        all users.
+        :::
+      '';
+      example = "/secrets/zwave-js-keys.json";
+    };
+
+    settings = mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        options = {
+          storage = {
+            cacheDir = mkOption {
+              type = types.path;
+              default = "/var/cache/zwave-js";
+              readOnly = true;
+              description = lib.mdDoc "Cache directory";
+            };
+          };
+        };
+      };
+      default = {};
+      description = mdDoc ''
+        Configuration settings for the generated config
+        file.
+      '';
+    };
+
+    extraFlags = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+      example = [ "--mock-driver" ];
+      description = lib.mdDoc ''
+        Extra flags to pass to command
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.zwave-js = let
+      configFile = settingsFormat.generate "zwave-js-config.json" cfg.settings;
+    in {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      description = "Z-Wave JS Server";
+      serviceConfig = {
+        ExecStartPre = ''
+          /bin/sh -c "${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${configFile} ${cfg.secretsConfigFile} > ${mergedConfigFile}"
+        '';
+        ExecStart = lib.concatStringsSep " " [
+          "${cfg.package}/bin/zwave-server"
+          "--config ${mergedConfigFile}"
+          "--port ${toString cfg.port}"
+          cfg.serialPort
+          (escapeShellArgs cfg.extraFlags)
+        ];
+        Restart = "on-failure";
+        User = "zwave-js";
+        SupplementaryGroups = [ "dialout" ];
+        CacheDirectory = "zwave-js";
+        RuntimeDirectory = "zwave-js";
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        DeviceAllow = [cfg.serialPort];
+        DevicePolicy = "closed";
+        DynamicUser = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = false;
+        NoNewPrivileges = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service @pkey"
+          "~@privileged @resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ graham33 ];
+}
--- a/nixos/modules/services/matrix/appservice-discord.nix
+++ b/nixos/modules/services/matrix/appservice-discord.nix
@ -100,9 +100,9 @@ in {

      serviceDependencies = mkOption {
        type = with types; listOf str;
-        default = optional config.services.matrix-synapse.enable "matrix-synapse.service";
+        default = optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
        defaultText = literalExpression ''
-          optional config.services.matrix-synapse.enable "matrix-synapse.service"
+          optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
        '';
        description = lib.mdDoc ''
          List of Systemd services to require and wait for when starting the application service,
--- a/nixos/modules/services/matrix/matrix-sliding-sync.nix
+++ b/nixos/modules/services/matrix/matrix-sliding-sync.nix
@ -80,8 +80,11 @@ in
      } ];
    };

-    systemd.services.matrix-sliding-sync = {
-      after = lib.optional cfg.createDatabase "postgresql.service";
+    systemd.services.matrix-sliding-sync = rec {
+      after =
+        lib.optional cfg.createDatabase "postgresql.service"
+        ++ lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
+      wants = after;
      wantedBy = [ "multi-user.target" ];
      environment = cfg.settings;
      serviceConfig = {
@ -90,6 +93,8 @@ in
        ExecStart = lib.getExe cfg.package;
        StateDirectory = "matrix-sliding-sync";
        WorkingDirectory = "%S/matrix-sliding-sync";
+        Restart = "on-failure";
+        RestartSec = "1s";
      };
    };
  };
--- a/nixos/modules/services/matrix/mautrix-facebook.nix
+++ b/nixos/modules/services/matrix/mautrix-facebook.nix
@ -145,7 +145,7 @@ in {
      wantedBy = [ "multi-user.target" ];
      wants = [
        "network-online.target"
-      ] ++ optional config.services.matrix-synapse.enable "matrix-synapse.service"
+      ] ++ optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
        ++ optional cfg.configurePostgresql "postgresql.service";
      after = wants;

--- a/nixos/modules/services/matrix/mautrix-telegram.nix
+++ b/nixos/modules/services/matrix/mautrix-telegram.nix
@ -122,9 +122,9 @@ in {

      serviceDependencies = mkOption {
        type = with types; listOf str;
-        default = optional config.services.matrix-synapse.enable "matrix-synapse.service";
+        default = optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
        defaultText = literalExpression ''
-          optional config.services.matrix-synapse.enable "matrix-synapse.service"
+          optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
        '';
        description = lib.mdDoc ''
          List of Systemd services to require and wait for when starting the application service.
--- a/nixos/modules/services/matrix/mautrix-whatsapp.nix
+++ b/nixos/modules/services/matrix/mautrix-whatsapp.nix
@ -100,9 +100,9 @@ in {

    serviceDependencies = lib.mkOption {
      type = with lib.types; listOf str;
-      default = lib.optional config.services.matrix-synapse.enable "matrix-synapse.service";
+      default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
      defaultText = lib.literalExpression ''
-        optional config.services.matrix-synapse.enable "matrix-synapse.service"
+        optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnits
      '';
      description = lib.mdDoc ''
        List of Systemd services to require and wait for when starting the application service.
--- a/nixos/modules/services/matrix/mx-puppet-discord.nix
+++ b/nixos/modules/services/matrix/mx-puppet-discord.nix
@ -66,9 +66,9 @@ in {
      };
      serviceDependencies = mkOption {
        type = with types; listOf str;
-        default = optional config.services.matrix-synapse.enable "matrix-synapse.service";
+        default = optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
        defaultText = literalExpression ''
-          optional config.services.matrix-synapse.enable "matrix-synapse.service"
+          optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
        '';
        description = lib.mdDoc ''
          List of Systemd services to require and wait for when starting the application service.
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@ -296,6 +296,18 @@ in {
    services.matrix-synapse = {
      enable = mkEnableOption (lib.mdDoc "matrix.org synapse");

+      serviceUnit = lib.mkOption {
+        type = lib.types.str;
+        readOnly = true;
+        description = lib.mdDoc ''
+          The systemd unit (a service or a target) for other services to depend on if they
+          need to be started after matrix-synapse.
+
+          This option is useful as the actual parent unit for all matrix-synapse processes
+          changes when configuring workers.
+        '';
+      };
+
      configFile = mkOption {
        type = types.path;
        readOnly = true;
@ -1021,6 +1033,7 @@ in {
      port = 9093;
    });

+    services.matrix-synapse.serviceUnit = if hasWorkers then "matrix-synapse.target" else "matrix-synapse.service";
    services.matrix-synapse.configFile = configFile;
    services.matrix-synapse.package = wrapped;

--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@ -899,25 +899,6 @@ in {
                      '';
                    };
                  };
-
-                  managementFrameProtection = mkOption {
-                    default = "required";
-                    type = types.enum ["disabled" "optional" "required"];
-                    apply = x:
-                      getAttr x {
-                        "disabled" = 0;
-                        "optional" = 1;
-                        "required" = 2;
-                      };
-                    description = mdDoc ''
-                      Management frame protection (MFP) authenticates management frames
-                      to prevent deauthentication (or related) attacks.
-
-                      - {var}`"disabled"`: No management frame protection
-                      - {var}`"optional"`: Use MFP if a connection allows it
-                      - {var}`"required"`: Force MFP for all clients
-                    '';
-                  };
                };

                config = let
@ -943,7 +924,8 @@ in {

                    # IEEE 802.11i (authentication) related configuration
                    # Encrypt management frames to protect against deauthentication and similar attacks
-                    ieee80211w = bssCfg.managementFrameProtection;
+                    ieee80211w = mkDefault 1;
+                    sae_require_mfp = mkDefault 1;

                    # Only allow WPA by default and disable insecure WEP
                    auth_algs = mkDefault 1;
@ -1184,14 +1166,6 @@ in {
                  assertion = (length (attrNames radioCfg.networks) > 1) -> (bssCfg.bssid != null);
                  message = ''hostapd radio ${radio} bss ${bss}: bssid must be specified manually (for now) since this radio uses multiple BSS.'';
                }
-                {
-                  assertion = auth.mode == "wpa3-sae" -> bssCfg.managementFrameProtection == 2;
-                  message = ''hostapd radio ${radio} bss ${bss}: uses WPA3-SAE which requires managementFrameProtection="required"'';
-                }
-                {
-                  assertion = auth.mode == "wpa3-sae-transition" -> bssCfg.managementFrameProtection != 0;
-                  message = ''hostapd radio ${radio} bss ${bss}: uses WPA3-SAE in transition mode with WPA2-SHA256, which requires managementFrameProtection="optional" or ="required"'';
-                }
                {
                  assertion = countWpaPasswordDefinitions <= 1;
                  message = ''hostapd radio ${radio} bss ${bss}: must use at most one WPA password option (wpaPassword, wpaPasswordFile, wpaPskFile)'';
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@ -779,9 +779,6 @@ in

      admins = ${toLua cfg.admins}

-      -- we already build with libevent, so we can just enable it for a more performant server
-      use_libevent = true
-
      modules_enabled = {

        ${ lib.concatStringsSep "\n  " (lib.mapAttrsToList
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@ -108,6 +108,13 @@ let
  containsGutenprint = pkgs: length (filterGutenprint pkgs) > 0;
  getGutenprint = pkgs: head (filterGutenprint pkgs);

+  parsePorts = addresses: let
+    splitAddress = addr: lib.strings.splitString ":" addr;
+    extractPort = addr: builtins.elemAt (builtins.tail (splitAddress addr)) 0;
+    toInt = str: lib.strings.toInt str;
+  in
+    builtins.map (address: toInt (extractPort address)) addresses;
+
 in

 {
@ -172,6 +179,15 @@ in
        '';
      };

+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the firewall for TCP/UDP ports specified in
+          listenAdrresses option.
+        '';
+      };
+
      bindirCmds = mkOption {
        type = types.lines;
        internal = true;
@ -463,6 +479,13 @@ in

    security.pam.services.cups = {};

+    networking.firewall = let
+      listenPorts = parsePorts cfg.listenAddresses;
+    in mkIf cfg.openFirewall {
+      allowedTCPPorts = listenPorts;
+      allowedUDPPorts = listenPorts;
+    };
+
  };

  meta.maintainers = with lib.maintainers; [ matthewbauer ];
--- a/nixos/modules/services/web-apps/freshrss.nix
+++ b/nixos/modules/services/web-apps/freshrss.nix
@ -220,7 +220,7 @@ in
            "catch_workers_output" = true;
          };
          phpEnv = {
-            FRESHRSS_DATA_PATH = "${cfg.dataDir}";
+            DATA_PATH = "${cfg.dataDir}";
          };
        };
      };
@ -267,7 +267,7 @@ in
            WorkingDirectory = cfg.package;
          };
          environment = {
-            FRESHRSS_DATA_PATH = cfg.dataDir;
+            DATA_PATH = cfg.dataDir;
          };

          script =
@ -302,7 +302,7 @@ in
        wantedBy = [ "multi-user.target" ];
        startAt = "*:0/5";
        environment = {
-          FRESHRSS_DATA_PATH = cfg.dataDir;
+          DATA_PATH = cfg.dataDir;
        };
        serviceConfig = defaultServiceConfig //{
          ExecStart = "${cfg.package}/app/actualize_script.php";
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@ -493,6 +493,8 @@ in
    services.phpfpm.pools.mediawiki = {
      inherit user group;
      phpEnv.MEDIAWIKI_CONFIG = "${mediawikiConfig}";
+      # https://www.mediawiki.org/wiki/Compatibility
+      phpPackage = pkgs.php81;
      settings = (if (cfg.webserver == "apache") then {
        "listen.owner" = config.services.httpd.user;
        "listen.group" = config.services.httpd.group;
@ -552,24 +554,20 @@ in
            deny all;
          '';
          # MediaWiki assets (usually images)
-          "~ ^/w/resources/(assets|lib|src)" = {
-            tryFiles = "$uri =404";
-            extraConfig = ''
-              add_header Cache-Control "public";
-              expires 7d;
-            '';
-          };
+          "~ ^/w/resources/(assets|lib|src)".extraConfig = ''
+            rewrite ^/w(/.*) $1 break;
+            add_header Cache-Control "public";
+            expires 7d;
+          '';
          # Assets, scripts and styles from skins and extensions
-          "~ ^/w/(skins|extensions)/.+\\.(css|js|gif|jpg|jpeg|png|svg|wasm|ttf|woff|woff2)$" = {
-            tryFiles = "$uri =404";
-            extraConfig = ''
-              add_header Cache-Control "public";
-              expires 7d;
-            '';
-          };
+          "~ ^/w/(skins|extensions)/.+\\.(css|js|gif|jpg|jpeg|png|svg|wasm|ttf|woff|woff2)$".extraConfig = ''
+            rewrite ^/w(/.*) $1 break;
+            add_header Cache-Control "public";
+            expires 7d;
+          '';

          # Handling for Mediawiki REST API, see [[mw:API:REST_API]]
-          "/w/rest.php".tryFiles = "$uri $uri/ /rest.php?$query_string";
+          "/w/rest.php/".tryFiles = "$uri $uri/ /w/rest.php?$query_string";

          # Handling for the article path (pretty URLs)
          "/wiki/".extraConfig = ''
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -29,7 +29,7 @@ let
  libsForQt5 = pkgs.plasma5Packages;
  inherit (libsForQt5) kdeGear kdeFrameworks plasma5;
  inherit (lib)
-    getBin optionalString literalExpression
+    getBin optionalAttrs optionalString literalExpression
    mkRemovedOptionModule mkRenamedOptionModule
    mkDefault mkIf mkMerge mkOption mkPackageOptionMD types;

@ -178,7 +178,7 @@ in
          capabilities = "cap_sys_nice+ep";
          source = "${getBin plasma5.kwin}/bin/kwin_wayland";
        };
-      } // mkIf (!cfg.runUsingSystemd) {
+      } // optionalAttrs (!cfg.runUsingSystemd) {
        start_kdeinit = {
          setuid = true;
          owner = "root";
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@ -67,6 +67,8 @@ let
  '';
 in {

+  meta.maintainers = with lib.maintainers; [ julienmalka ];
+
  imports =
    [ (mkRenamedOptionModule [ "boot" "loader" "gummiboot" "enable" ] [ "boot" "loader" "systemd-boot" "enable" ])
    ];
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -253,9 +253,6 @@ done
@setHostId@

 # Load the required kernel modules.
-mkdir -p /lib
-ln -s @modulesClosure@/lib/modules /lib/modules
-ln -s @modulesClosure@/lib/firmware /lib/firmware
 echo @extraUtils@/bin/modprobe > /proc/sys/kernel/modprobe
 for i in @kernelModules@; do
    info "loading module $(basename $i)..."
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -307,7 +307,7 @@ let
      ${pkgs.buildPackages.busybox}/bin/ash -n $target
    '';

-    inherit linkUnits udevRules extraUtils modulesClosure;
+    inherit linkUnits udevRules extraUtils;

    inherit (config.boot) resumeDevice;

@ -349,6 +349,9 @@ let
      [ { object = bootStage1;
          symlink = "/init";
        }
+        { object = "${modulesClosure}/lib";
+          symlink = "/lib";
+        }
        { object = pkgs.runCommand "initrd-kmod-blacklist-ubuntu" {
              src = "${pkgs.kmod-blacklist-ubuntu}/modprobe.conf";
              preferLocalBuild = true;
--- a/nixos/modules/virtualisation/oci-containers.nix
+++ b/nixos/modules/virtualisation/oci-containers.nix
@ -214,6 +214,13 @@ let
          '';
        };

+        hostname = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          description = lib.mdDoc "The hostname of the container.";
+          example = "hello-world";
+        };
+
        extraOptions = mkOption {
          type = with types; listOf str;
          default = [];
@ -280,6 +287,8 @@ let
      "--log-driver=${container.log-driver}"
    ] ++ optional (container.entrypoint != null)
      "--entrypoint=${escapeShellArg container.entrypoint}"
+      ++ optional (container.hostname != null)
+      "--hostname=${escapeShellArg container.hostname}"
      ++ lib.optionals (cfg.backend == "podman") [
        "--cidfile=/run/podman-${escapedName}.ctr-id"
        "--cgroups=no-conmon"
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -997,7 +997,7 @@ in
              virtualisation.memorySize is above 2047, but qemu is only able to allocate 2047MB RAM on 32bit max.
            '';
          }
-          { assertion = cfg.directBoot.initrd != options.virtualisation.directBoot.initrd.default -> cfg.directBoot.enable;
+          { assertion = cfg.directBoot.enable || cfg.directBoot.initrd == options.virtualisation.directBoot.initrd.default;
            message =
              ''
                You changed the default of `virtualisation.directBoot.initrd` but you are not
--- a/nixos/modules/virtualisation/vagrant-guest.nix
+++ b/nixos/modules/virtualisation/vagrant-guest.nix
@ -55,4 +55,5 @@ in
  };

  security.sudo.wheelNeedsPassword = false;
+  security.sudo-rs.wheelNeedsPassword = false;
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -934,4 +934,5 @@ in {
  zram-generator = handleTest ./zram-generator.nix {};
  zrepl = handleTest ./zrepl.nix {};
  zsh-history = handleTest ./zsh-history.nix {};
+  zwave-js = handleTest ./zwave-js.nix {};
 }
--- a/nixos/tests/printing.nix
+++ b/nixos/tests/printing.nix
@ -19,6 +19,7 @@ import ./make-test-python.nix (
      startWhenNeeded = socket;
      listenAddresses = [ "*:631" ];
      defaultShared = true;
+      openFirewall = true;
      extraConf = ''
        <Location />
          Order allow,deny
@ -26,7 +27,6 @@ import ./make-test-python.nix (
        </Location>
      '';
    };
-    networking.firewall.allowedTCPPorts = [ 631 ];
    # Add a HP Deskjet printer connected via USB to the server.
    hardware.printers.ensurePrinters = [{
      name = "DeskjetLocal";
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -471,7 +471,7 @@ let
        services.knot = {
          enable = true;
          extraArgs = [ "-v" ];
-          extraConfig = ''
+          settingsFile = pkgs.writeText "knot.conf" ''
            server:
              listen: 127.0.0.1@53

@ -969,7 +969,7 @@ let
    pgbouncer = {
      exporterConfig = {
        enable = true;
-        connectionString = "postgres://admin:@localhost:6432/pgbouncer?sslmode=disable";
+        connectionStringFile = pkgs.writeText "connection.conf" "postgres://admin:@localhost:6432/pgbouncer?sslmode=disable";
      };

      metricProvider = {
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@ -18,7 +18,7 @@ in
 {
  basic = makeTest {
    name = "systemd-boot";
-    meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer ];
+    meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer julienmalka ];

    nodes.machine = common;

@ -42,7 +42,7 @@ in
  # Check that specialisations create corresponding boot entries.
  specialisation = makeTest {
    name = "systemd-boot-specialisation";
-    meta.maintainers = with pkgs.lib.maintainers; [ lukegb ];
+    meta.maintainers = with pkgs.lib.maintainers; [ lukegb julienmalka ];

    nodes.machine = { pkgs, lib, ... }: {
      imports = [ common ];
@ -65,7 +65,7 @@ in
  # Boot without having created an EFI entry--instead using default "/EFI/BOOT/BOOTX64.EFI"
  fallback = makeTest {
    name = "systemd-boot-fallback";
-    meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer ];
+    meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer julienmalka ];

    nodes.machine = { pkgs, lib, ... }: {
      imports = [ common ];
@ -91,7 +91,7 @@ in

  update = makeTest {
    name = "systemd-boot-update";
-    meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer ];
+    meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer julienmalka ];

    nodes.machine = common;

@ -113,7 +113,7 @@ in

  memtest86 = makeTest {
    name = "systemd-boot-memtest86";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
+    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];

    nodes.machine = { pkgs, lib, ... }: {
      imports = [ common ];
@ -128,7 +128,7 @@ in

  netbootxyz = makeTest {
    name = "systemd-boot-netbootxyz";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
+    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];

    nodes.machine = { pkgs, lib, ... }: {
      imports = [ common ];
@ -143,7 +143,7 @@ in

  entryFilename = makeTest {
    name = "systemd-boot-entry-filename";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
+    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];

    nodes.machine = { pkgs, lib, ... }: {
      imports = [ common ];
@ -160,7 +160,7 @@ in

  extraEntries = makeTest {
    name = "systemd-boot-extra-entries";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
+    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];

    nodes.machine = { pkgs, lib, ... }: {
      imports = [ common ];
@ -179,7 +179,7 @@ in

  extraFiles = makeTest {
    name = "systemd-boot-extra-files";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
+    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];

    nodes.machine = { pkgs, lib, ... }: {
      imports = [ common ];
@ -196,7 +196,7 @@ in

  switch-test = makeTest {
    name = "systemd-boot-switch-test";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
+    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];

    nodes = {
      inherit common;
@ -256,7 +256,7 @@ in
  # itself, systems with such firmware won't boot without this fix
  uefiLargeFileWorkaround = makeTest {
    name = "uefi-large-file-workaround";
-
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
    nodes.machine = { pkgs, ... }: {
      imports = [common];
      virtualisation.efi.OVMF = pkgs.OVMF.overrideAttrs (old: {
--- a/nixos/tests/zwave-js.nix
+++ b/nixos/tests/zwave-js.nix
@ -0,0 +1,31 @@
+import ./make-test-python.nix ({ pkgs, lib, ...} :
+
+let
+  secretsConfigFile = pkgs.writeText "secrets.json" (builtins.toJSON {
+    securityKeys = {
+      "S0_Legacy" = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+    };
+  });
+in {
+  name = "zwave-js";
+  meta.maintainers = with lib.maintainers; [ graham33 ];
+
+  nodes = {
+    machine = { config, ... }: {
+      services.zwave-js = {
+        enable = true;
+        serialPort = "/dev/null";
+        extraFlags = ["--mock-driver"];
+        inherit secretsConfigFile;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("zwave-js.service")
+    machine.wait_for_open_port(3000)
+    machine.wait_until_succeeds("journalctl --since -1m --unit zwave-js --grep 'ZwaveJS server listening'")
+  '';
+})
--- a/pkgs/applications/accessibility/wvkbd/default.nix
+++ b/pkgs/applications/accessibility/wvkbd/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "wvkbd";
-  version = "0.14.1";
+  version = "0.14.3";

  src = fetchFromGitHub {
    owner = "jjsullivan5196";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-a1VOSLpvSKiEkR73V/Q3Es9irueDihMKcQvO9alPCqo=";
+    sha256 = "sha256-U4xq9FY2uZlnBwm8Se1wReU1c1RAJMx6FIoD0D2BlM4=";
  };

  postPatch = ''
--- a/pkgs/applications/audio/deadbeef/default.nix
+++ b/pkgs/applications/audio/deadbeef/default.nix
@ -121,6 +121,13 @@ in clangStdenv.mkDerivation {
    ./autogen.sh
  '';

+  postPatch = ''
+    # Fix the build on c++17 compiler:
+    #   https://github.com/DeaDBeeF-Player/deadbeef/issues/3012
+    # TODO: remove after 1.9.5 release.
+    substituteInPlace plugins/adplug/Makefile.am --replace 'adplug_la_CXXFLAGS = ' 'adplug_la_CXXFLAGS = -std=c++11 '
+  '';
+
  meta = with lib; {
    description = "Ultimate Music Player for GNU/Linux";
    homepage = "http://deadbeef.sourceforge.net/";
--- a/pkgs/applications/audio/espeak-ng/default.nix
+++ b/pkgs/applications/audio/espeak-ng/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , autoconf
 , automake
 , which
@ -33,7 +34,13 @@ stdenv.mkDerivation rec {
    hash = "sha256-aAJ+k+kkOS6k835mEW7BvgAIYGhUHxf7Q4P5cKO8XTk=";
  };

-  patches = lib.optionals mbrolaSupport [
+  patches = [
+    # Fix build with Clang 16.
+    (fetchpatch {
+      url = "https://github.com/espeak-ng/espeak-ng/commit/497c6217d696c1190c3e8b992ff7b9110eb3bedd.patch";
+      hash = "sha256-KfzqnRyQfz6nuMKnsHoUzb9rn9h/Pg54mupW1Cr+Zx0=";
+    })
+  ] ++ lib.optionals mbrolaSupport [
    # Hardcode correct mbrola paths.
    (substituteAll {
      src = ./mbrola.patch;
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "lsp-plugins";
-  version = "1.2.12";
+  version = "1.2.13";

  src = fetchurl {
    url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-a3ts+7wiEwcoLPj6KsfP9lvTNTDSr9t+qEujSgpotXo=";
+    sha256 = "sha256-eJO+1fCNzqjTdGrPlhIrHc3UimkJOydRqTq49IN+Iwo=";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/applications/audio/schismtracker/default.nix
+++ b/pkgs/applications/audio/schismtracker/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "schismtracker";
-  version = "20230906";
+  version = "20231029";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    sha256 = "sha256-eW1sqfcAR3lutSyQKj7j1elkFTa8jfZqgrJYYAzMlzo=";
+    sha256 = "sha256-ELCV5c79fFX1C4+S9bnDFOx3jAs/R2TERH1Q9fkBGnY=";
  };

  configureFlags = [ "--enable-dependency-tracking" ]
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@ -3,25 +3,25 @@
 , rustPlatform
 , fetchFromGitHub
 , llvmPackages
-, rocksdb_6_23
+, rocksdb_7_10
 , Security
 }:

 let
-  rocksdb = rocksdb_6_23;
+  rocksdb = rocksdb_7_10;
 in
 rustPlatform.buildRustPackage rec {
  pname = "electrs";
-  version = "0.9.13";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "romanz";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-GV/cwFdYpXJXRTgdVfuzJpmwNhe0kVJnYAJe+DPmRV8=";
+    hash = "sha256-cRnCo/N0k5poiOh308Djw6bySFQFIY3GiD2qjRyMjLM=";
  };

-  cargoHash = "sha256-eQAizO26oQRosbMGJLwMmepBN3pocmnbc0qsHsAJysg=";
+  cargoHash = "sha256-fsYJ+80se5VsIaRkFgwJaPPgRw/WdsecRTt6EIjoQTQ=";

  # needed for librocksdb-sys
  nativeBuildInputs = [ rustPlatform.bindgenHook ];
--- a/pkgs/applications/blockchains/exodus/default.nix
+++ b/pkgs/applications/blockchains/exodus/default.nix
@ -27,13 +27,13 @@

 stdenv.mkDerivation rec {
  pname = "exodus";
-  version = "23.9.25";
+  version = "23.10.24";

  src = fetchurl {
    name = "exodus-linux-x64-${version}.zip";
    url = "https://downloads.exodus.com/releases/${pname}-linux-x64-${version}.zip";
    curlOptsList = [ "--user-agent" "Mozilla/5.0" ];
-    sha256 = "a3e314de257e1ec01baa1023886f327ade4b233d833f7fe79f6c3e0f26d07ced";
+    sha256 = "sha256-g28jSQaqjnM34sCpyYLSipUoU3pqAcXQIyWhlrR4xz4=";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/blockchains/mycrypto/default.nix
+++ b/pkgs/applications/blockchains/mycrypto/default.nix
@ -49,6 +49,6 @@ in appimageTools.wrapType2 rec {
    homepage = "https://mycrypto.com";
    license = licenses.mit;
    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ oxalica ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/blockchains/nearcore/default.nix
+++ b/pkgs/applications/blockchains/nearcore/default.nix
@ -52,7 +52,7 @@ rustPlatform.buildRustPackage rec {
    description = "Reference client for NEAR Protocol";
    homepage = "https://github.com/near/nearcore";
    license = licenses.gpl3;
-    maintainers = with maintainers; [ mic92 mikroskeem ];
+    maintainers = with maintainers; [ mikroskeem ];
    # only x86_64 is supported in nearcore because of sse4+ support, macOS might
    # be also possible
    platforms = [ "x86_64-linux" ];
--- a/pkgs/applications/editors/apostrophe/default.nix
+++ b/pkgs/applications/editors/apostrophe/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitLab, meson, ninja
 , wrapGAppsHook, pkg-config, desktop-file-utils
 , appstream-glib, pythonPackages, glib, gobject-introspection
-, gtk3, webkitgtk, glib-networking, gnome, gspell, texlive
+, gtk3, webkitgtk, glib-networking, gnome, gspell, texliveMedium
 , shared-mime-info, libhandy, fira, sassc
 }:

@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
    appstream-glib wrapGAppsHook sassc gobject-introspection ];

  buildInputs = [ glib pythonEnv gtk3
-    gnome.adwaita-icon-theme webkitgtk gspell texlive
+    gnome.adwaita-icon-theme webkitgtk gspell texliveMedium
    glib-networking libhandy ];

  postPatch = ''
@ -43,7 +43,7 @@ in stdenv.mkDerivation rec {
  preFixup = ''
    gappsWrapperArgs+=(
      --prefix PYTHONPATH : "$out/lib/python${pythonEnv.pythonVersion}/site-packages/"
-      --prefix PATH : "${texlive}/bin"
+      --prefix PATH : "${texliveMedium}/bin"
      --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
    )
  '';
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cudatext";
-  version = "1.200.0";
+  version = "1.201.0";

  src = fetchFromGitHub {
    owner = "Alexey-T";
    repo = "CudaText";
    rev = version;
-    hash = "sha256-0+bjp9JOR06wLzA3CJqtGjCK1M0qPdzoLRt6+fV8tJ0=";
+    hash = "sha256-Do2JPNZtoi7zbUnJomQAZ8zR/WPB6+G051xZWmeUBP4=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@ -11,13 +11,13 @@
  },
  "ATFlatControls": {
    "owner": "Alexey-T",
-    "rev": "2023.10.02",
-    "hash": "sha256-9oV8xqkqpCfA7rk4UMxWFBIFQQ9slClFbaENRldFb8Q="
+    "rev": "2023.10.30",
+    "hash": "sha256-fuTQnnuWjIsABx457y+n6luLxQf+b9TiZGLXYjNsUrw="
  },
  "ATSynEdit": {
    "owner": "Alexey-T",
-    "rev": "2023.10.03",
-    "hash": "sha256-dJYpsvJNwQg6/NeXT23cpWFXwcfIYnWkHYoDItiUeOo="
+    "rev": "2023.10.30",
+    "hash": "sha256-xsJ02zGzi7ByFBXql4lLWWLiPVWwtOLXzixmv4AeC2I="
  },
  "ATSynEdit_Cmp": {
    "owner": "Alexey-T",
@ -36,7 +36,7 @@
  },
  "Python-for-Lazarus": {
    "owner": "Alexey-T",
-    "rev": "2023.06.29",
+    "rev": "2023.06.30",
    "hash": "sha256-mO8/RNJjy9KtFuDUmV2Y8Ff+Jjm9yRd7GSrI6mOONUc="
  },
  "Emmet-Pascal": {
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
@ -57,6 +57,8 @@ in
    inherit (pkgs) python3 git go gopls pyright;
  };

+  lspce = callPackage ./manual-packages/lspce { };
+
  matrix-client = callPackage ./manual-packages/matrix-client {
    _map = self.map;
  };
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lspce/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lspce/default.nix
@ -0,0 +1,72 @@
+{ lib
+, emacs
+, f
+, fetchFromGitHub
+, markdown-mode
+, rustPlatform
+, trivialBuild
+, yasnippet
+}:
+
+let
+  version = "unstable-2023-10-30";
+
+  src = fetchFromGitHub {
+    owner = "zbelial";
+    repo = "lspce";
+    rev = "34c59787bcdbf414c92d9b3bf0a0f5306cb98d64";
+    hash = "sha256-kUHGdeJo2zXA410FqXGclgXmgWrll30Zv8fSprcmnIo=";
+  };
+
+  meta = {
+    homepage = "https://github.com/zbelial/lspce";
+    description = "LSP Client for Emacs implemented as a module using rust";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.marsam ];
+    inherit (emacs.meta) platforms;
+  };
+
+  lspce-module = rustPlatform.buildRustPackage {
+    inherit version src meta;
+    pname = "lspce-module";
+
+    cargoHash = "sha256-eqSromwJrFhtJWedDVJivfbKpAtSFEtuCP098qOxFgI=";
+
+    checkFlags = [
+      # flaky test
+      "--skip=msg::tests::serialize_request_with_null_params"
+    ];
+
+    postFixup = ''
+      for f in $out/lib/*; do
+        mv $f $out/lib/lspce-module.''${f##*.}
+      done
+    '';
+  };
+in
+trivialBuild rec {
+  inherit version src meta;
+  pname = "lspce";
+
+  preBuild = ''
+    ln -s ${lspce-module}/lib/lspce-module* .
+
+    # Fix byte-compilation
+    substituteInPlace lspce-util.el \
+      --replace "(require 'yasnippet)" "(require 'yasnippet)(require 'url-util)"
+    substituteInPlace lspce-calltree.el \
+      --replace "(require 'compile)" "(require 'compile)(require 'cl-lib)"
+  '';
+
+  buildInputs = propagatedUserEnvPkgs;
+
+  propagatedUserEnvPkgs = [
+    f
+    markdown-mode
+    yasnippet
+  ];
+
+  postInstall = ''
+    install lspce-module* $LISPDIR
+  '';
+}
--- a/pkgs/applications/editors/greenfoot/default.nix
+++ b/pkgs/applications/editors/greenfoot/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "greenfoot";
-  version = "3.8.0";
+  version = "3.8.1";

  src = fetchurl {
    # We use the deb here. First instinct might be to go for the "generic" JAR
    # download, but that is actually a graphical installer that is much harder
    # to unpack than the deb.
    url = "https://www.greenfoot.org/download/files/Greenfoot-linux-${builtins.replaceStrings ["."] [""] version}.deb";
-    sha256 = "sha256-HDXmgLHS18VZVV+hCA0RgIrKRftOlV7t+fvE0pAHGjk=";
+    sha256 = "sha256-utGSAbP74O1t1iEoN0CwiZVc8HxdCxhozPPMwQCtkEE=";
  };

  nativeBuildInputs = [ dpkg wrapGAppsHook ];
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -47,7 +47,7 @@ let
          Enhancing productivity for every C and C++
          developer on Linux, macOS and Windows.
        '';
-        maintainers = with maintainers; [ edwtjo mic92 tymscar ];
+        maintainers = with maintainers; [ edwtjo tymscar ];
      };
    }).overrideAttrs (attrs: {
      nativeBuildInputs = (attrs.nativeBuildInputs or [ ]) ++ lib.optionals (stdenv.isLinux) [
--- a/pkgs/applications/editors/ne/default.nix
+++ b/pkgs/applications/editors/ne/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ncurses, texinfo6, texlive, perl, ghostscript }:
+{ lib, stdenv, fetchFromGitHub, ncurses, texinfo6, texliveMedium, perl, ghostscript }:

 stdenv.mkDerivation rec {
  pname = "ne";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    substituteInPlace src/makefile --replace "-lcurses" "-lncurses"
  '';

-  nativeBuildInputs = [ texlive.combined.scheme-medium texinfo6 perl ghostscript ];
+  nativeBuildInputs = [ texliveMedium texinfo6 perl ghostscript ];
  buildInputs = [ ncurses ];

  makeFlags = [ "PREFIX=${placeholder "out"}" ];
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@ -2,7 +2,7 @@
  guile_1_8, xmodmap, which, freetype,
  libjpeg,
  sqlite,
-  tex ? null,
+  texliveSmall ? null,
  aspell ? null,
  git ? null,
  python3 ? null,
@ -23,7 +23,8 @@ let
  pname = "texmacs";
  version = "2.1.2";
  common = callPackage ./common.nix {
-    inherit tex extraFonts chineseFonts japaneseFonts koreanFonts;
+    inherit extraFonts chineseFonts japaneseFonts koreanFonts;
+    tex = texliveSmall;
  };
 in
 stdenv.mkDerivation {
@ -70,7 +71,7 @@ stdenv.mkDerivation {
      which
      ghostscriptX
      aspell
-      tex
+      texliveSmall
      git
      python3
    ])
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -360,12 +360,12 @@
  };
  dart = buildGrammar {
    language = "dart";
-    version = "0.0.0+rev=e14bbac";
+    version = "0.0.0+rev=f71e310";
    src = fetchFromGitHub {
      owner = "UserNobody14";
      repo = "tree-sitter-dart";
-      rev = "e14bbac8a0fcb6fab1b3becf6ed3fe464123c377";
-      hash = "sha256-9CNKTaP9XudM6BDUlXmroJZ31c3eqjF2s0+Bb5mcfm4=";
+      rev = "f71e310a93010863f4b17a2a501ea8e2032c345b";
+      hash = "sha256-6iRUtQ1bol0a7whK35MaJ3UKrxmTAzchQ8Yxy4TeerE=";
    };
    meta.homepage = "https://github.com/UserNobody14/tree-sitter-dart";
  };
@ -593,12 +593,12 @@
  };
  forth = buildGrammar {
    language = "forth";
-    version = "0.0.0+rev=e7d1f8a";
+    version = "0.0.0+rev=9018923";
    src = fetchFromGitHub {
      owner = "AlexanderBrevig";
      repo = "tree-sitter-forth";
-      rev = "e7d1f8a351fd5e95d9a89a8e87878c49ca14a5b0";
-      hash = "sha256-AoV/DoQl2j4U0evWrM7ke544sei8VpdednWojwbhicU=";
+      rev = "90189238385cf636b9ee99ce548b9e5b5e569d48";
+      hash = "sha256-vySBDu9cMnubu4+7/sBttNxg1S4/MxWUKpjwEa14Rws=";
    };
    meta.homepage = "https://github.com/AlexanderBrevig/tree-sitter-forth";
  };
@ -681,12 +681,12 @@
  };
  gitattributes = buildGrammar {
    language = "gitattributes";
-    version = "0.0.0+rev=2339ffe";
+    version = "0.0.0+rev=f58a4a4";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-gitattributes";
-      rev = "2339ffe87a88d0b7838c015592c8269eb0063140";
-      hash = "sha256-O3yzJjxrHdDoqcYu4ZDqrMuzinb0/0ub4puaSZPaG3c=";
+      rev = "f58a4a4bc55b9b43dfa7c4106257422764f97776";
+      hash = "sha256-COCQXia5TiPjJ8/WZELB2lARbn/5YeNvunrm+GHFDQs=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-gitattributes";
  };
@ -714,12 +714,12 @@
  };
  gleam = buildGrammar {
    language = "gleam";
-    version = "0.0.0+rev=32c8f1e";
+    version = "0.0.0+rev=0589025";
    src = fetchFromGitHub {
      owner = "gleam-lang";
      repo = "tree-sitter-gleam";
-      rev = "32c8f1e32aee036583ca09e7e6e4ea881852b42c";
-      hash = "sha256-tAYlenGQM+TK8AR8RtyDULBgWjAXgHx13/lrhNAZVhs=";
+      rev = "0589025ee57e335fe0698190a1bc322748d8f026";
+      hash = "sha256-/lNo6p4hsl7TiWzIdJOuSHu0RFwPYdZGIVzlcgKOWr4=";
    };
    meta.homepage = "https://github.com/gleam-lang/tree-sitter-gleam";
  };
@ -736,12 +736,12 @@
  };
  glsl = buildGrammar {
    language = "glsl";
-    version = "0.0.0+rev=952739a";
+    version = "0.0.0+rev=bea82d3";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-glsl";
-      rev = "952739a25a7c014882aa777f1a32da8950f31f58";
-      hash = "sha256-f68bObZPZuPvzyLYP/PeZKbtG0YqbX8BhsLyviBfRY4=";
+      rev = "bea82d337801e472e35b5cd08038afdf13263768";
+      hash = "sha256-O1c9LJex/VHAYuoVaM6dMhTSKNg7RYZJ4N+MYAYZ/AE=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-glsl";
  };
@ -978,12 +978,12 @@
  };
  htmldjango = buildGrammar {
    language = "htmldjango";
-    version = "0.0.0+rev=717e83a";
+    version = "0.0.0+rev=8873e3d";
    src = fetchFromGitHub {
      owner = "interdependence";
      repo = "tree-sitter-htmldjango";
-      rev = "717e83aefd328735beeeb671f3f95b2624e70c57";
-      hash = "sha256-xOWR5Lp9Ggkqmm5rutKrnMNXFASdyn6vPtxcY2mu2zs=";
+      rev = "8873e3df89f9ea1d33f6235e516b600009288557";
+      hash = "sha256-zVpjgnP39ToEDf59Ldq/DhRVKZOGaWX+usVOcSsJX3k=";
    };
    meta.homepage = "https://github.com/interdependence/tree-sitter-htmldjango";
  };
@ -1033,12 +1033,12 @@
  };
  janet_simple = buildGrammar {
    language = "janet_simple";
-    version = "0.0.0+rev=bd9cbaf";
+    version = "0.0.0+rev=3c6f947";
    src = fetchFromGitHub {
      owner = "sogaiu";
      repo = "tree-sitter-janet-simple";
-      rev = "bd9cbaf1ea8b942dfd58e68df10c9a378ab3d2b6";
-      hash = "sha256-2FucTi1wATBcomyNx2oCqMJVmAqLWHJiPQ2+L0VtwUM=";
+      rev = "3c6f947f9039bbd803d9f3cf57dcee3783b3e2ce";
+      hash = "sha256-wpiI0KQ4fy7fGTT3+oDfQy9zEuWmF5P/xSc1pLeA++I=";
    };
    meta.homepage = "https://github.com/sogaiu/tree-sitter-janet-simple";
  };
@ -1165,12 +1165,12 @@
  };
  kotlin = buildGrammar {
    language = "kotlin";
-    version = "0.0.0+rev=5baa0fe";
+    version = "0.0.0+rev=494fb76";
    src = fetchFromGitHub {
      owner = "fwcd";
      repo = "tree-sitter-kotlin";
-      rev = "5baa0fe2288830f88bd38e328b08d829f3914164";
-      hash = "sha256-e2X8Hl8N8iTL0JUJhyyeebNPZ63QAq9C+R5F2lOYZKk=";
+      rev = "494fb7644a9d2bbe4c7a0c5db2ef94d2aad6b0d8";
+      hash = "sha256-AnUqNfqs8QMeiwltaVNnYGxEnqCeAyTi4nNEyUsH8F0=";
    };
    meta.homepage = "https://github.com/fwcd/tree-sitter-kotlin";
  };
@ -1220,12 +1220,12 @@
  };
  liquidsoap = buildGrammar {
    language = "liquidsoap";
-    version = "0.0.0+rev=4620ab7";
+    version = "0.0.0+rev=cff1fea";
    src = fetchFromGitHub {
      owner = "savonet";
      repo = "tree-sitter-liquidsoap";
-      rev = "4620ab746d1e9e5b6ebccaaa6afc5ebce06b4d75";
-      hash = "sha256-M9HTG58WMvQ1PS7oRDeJ+bUwe+bmXf/fuTc6inEtkek=";
+      rev = "cff1fea7c2ef9eed066a4d3de8af6cb4d7117056";
+      hash = "sha256-WWq7aLFqjHnNe280u4+4SuqD+x73ww75fAE/Zm5ttAs=";
    };
    meta.homepage = "https://github.com/savonet/tree-sitter-liquidsoap";
  };
@ -1408,6 +1408,28 @@
    };
    meta.homepage = "https://github.com/nickel-lang/tree-sitter-nickel";
  };
+  nim = buildGrammar {
+    language = "nim";
+    version = "0.0.0+rev=1f9308c";
+    src = fetchFromGitHub {
+      owner = "alaviss";
+      repo = "tree-sitter-nim";
+      rev = "1f9308c9e440ddbc67c0aaeb9396c992d266b281";
+      hash = "sha256-VgyZk6P2hMCySE8ZrYip7bVtP5OKdfRIgXESDmMgFBc=";
+    };
+    meta.homepage = "https://github.com/alaviss/tree-sitter-nim";
+  };
+  nim_format_string = buildGrammar {
+    language = "nim_format_string";
+    version = "0.0.0+rev=d45f750";
+    src = fetchFromGitHub {
+      owner = "aMOPel";
+      repo = "tree-sitter-nim-format-string";
+      rev = "d45f75022d147cda056e98bfba68222c9c8eca3a";
+      hash = "sha256-hbM0JIxtZ3e2JUV4jXYO4RIO6r63nf2csvsLeIxkMn0=";
+    };
+    meta.homepage = "https://github.com/aMOPel/tree-sitter-nim-format-string";
+  };
  ninja = buildGrammar {
    language = "ninja";
    version = "0.0.0+rev=0a95cfd";
@ -1512,12 +1534,12 @@
  };
  odin = buildGrammar {
    language = "odin";
-    version = "0.0.0+rev=d165dbe";
+    version = "0.0.0+rev=751f779";
    src = fetchFromGitHub {
      owner = "amaanq";
      repo = "tree-sitter-odin";
-      rev = "d165dbee27617dab2653e38737d96ede1030d14f";
-      hash = "sha256-NxF3aSDtXGMcE7v0BrYQbnUM/hophanKgsYX1ad8AFY=";
+      rev = "751f7796fa76075cff52edd1afff569a8a09c2a7";
+      hash = "sha256-VKcyuoXSRN4PAHQKzfuCKB9lg5y5MQyofy3FkN79Nrw=";
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-odin";
  };
@ -1567,23 +1589,23 @@
  };
  perl = buildGrammar {
    language = "perl";
-    version = "0.0.0+rev=495ea4b";
+    version = "0.0.0+rev=e99bb52";
    src = fetchFromGitHub {
      owner = "tree-sitter-perl";
      repo = "tree-sitter-perl";
-      rev = "495ea4b2bb2ca7ebc64c598e4a60d8c0856b2811";
-      hash = "sha256-6xLeT4dfBnxysrfW7kX3KyW96dfJgN4L040xI8IWVMU=";
+      rev = "e99bb5283805db4cb86c964722d709df21b0ac16";
+      hash = "sha256-PiQIHB94UYvm0fHeBcjJiegcfZ3Rqhs1lxusGdXQ5zI=";
    };
    meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-perl";
  };
  php = buildGrammar {
    language = "php";
-    version = "0.0.0+rev=0e02e7f";
+    version = "0.0.0+rev=33e3016";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-php";
-      rev = "0e02e7fab7913a0e77343edb347c8f17cac1f0ba";
-      hash = "sha256-cHXstpU5XaBv9vO59DKol7PfrVLc0olBLlhkb3wFNDE=";
+      rev = "33e30169e6f9bb29845c80afaa62a4a87f23f6d6";
+      hash = "sha256-xDk+zegvCef5O4uAF/DYzPLBQeFWwaqCTHjLUKK43Nc=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
  };
@ -1854,12 +1876,12 @@
  };
  rego = buildGrammar {
    language = "rego";
-    version = "0.0.0+rev=b2667c9";
+    version = "0.0.0+rev=9ac75e7";
    src = fetchFromGitHub {
      owner = "FallenAngel97";
      repo = "tree-sitter-rego";
-      rev = "b2667c975f07b33be3ceb83bea5cfbad88095866";
-      hash = "sha256-y3w+gfjXb9N8Vf6ZrafP1j50Ap2KPaNfwo5h06EqHKM=";
+      rev = "9ac75e71b2d791e0aadeef68098319d86a2a14cf";
+      hash = "sha256-L6n6Z5y9t1ixpy9mktB9HVKy69jigqbIFB2SrSW/yoo=";
    };
    meta.homepage = "https://github.com/FallenAngel97/tree-sitter-rego";
  };
@ -2077,12 +2099,12 @@
  };
  sql = buildGrammar {
    language = "sql";
-    version = "0.0.0+rev=caf2938";
+    version = "0.0.0+rev=25be0b8";
    src = fetchFromGitHub {
      owner = "derekstride";
      repo = "tree-sitter-sql";
-      rev = "caf2938f1bc6b174e5bf5b6f3b5522cb723ee55b";
-      hash = "sha256-PbbPp6CsnrFj7/OwF957MEbSf3PekXon7dMkcoHMO7c=";
+      rev = "25be0b8f17e9189ad9e1b875869d025c5aec1286";
+      hash = "sha256-ztiTMusfPkCpzqiEQt+HmkLt6gDhHt6dBdjIOb4ZBxs=";
    };
    meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
  };
@ -2099,12 +2121,12 @@
  };
  ssh_config = buildGrammar {
    language = "ssh_config";
-    version = "0.0.0+rev=e400863";
+    version = "0.0.0+rev=9dcfe0f";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-ssh-config";
-      rev = "e4008633536870f3fed3198c96503250af0b0a12";
-      hash = "sha256-jPEJQgFys+gwwLiIXmhHvrsT9ai0R7wXJVxRQANACkI=";
+      rev = "9dcfe0f30ccbde8115790c72acbde4c04ec8e74e";
+      hash = "sha256-X7zfOxOVZ99vbCqRSt3rhtiaolByRPspldu9XF1B/XY=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-ssh-config";
  };
@ -2121,12 +2143,12 @@
  };
  strace = buildGrammar {
    language = "strace";
-    version = "0.0.0+rev=0dc85e4";
+    version = "0.0.0+rev=d819cdd";
    src = fetchFromGitHub {
      owner = "sigmaSd";
      repo = "tree-sitter-strace";
-      rev = "0dc85e4cfcd0cc4b33f855ddb782d81d1297bf6e";
-      hash = "sha256-JK5+HlCELcBD2Af4uNNoBMYecDGnwcoTqdZr5mKBq+Q=";
+      rev = "d819cdd5dbe455bd3c859193633c8d91c0df7c36";
+      hash = "sha256-u2LznohljEq7WEoVbwr1ZyV+qbchDuoktJFCeh4iePg=";
    };
    meta.homepage = "https://github.com/sigmaSd/tree-sitter-strace";
  };
@ -2199,12 +2221,12 @@
  };
  t32 = buildGrammar {
    language = "t32";
-    version = "0.0.0+rev=b075f2f";
+    version = "0.0.0+rev=884a034";
    src = fetchFromGitLab {
      owner = "xasc";
      repo = "tree-sitter-t32";
-      rev = "b075f2f55ba29edce51b6b6b9f234ce3988dbb0a";
-      hash = "sha256-NoJLMzyQmE4XpI1KKyq5GkkotOl8MU/zniTnP2nkjes=";
+      rev = "884a034e0ae29ce72649041a603deacdfb4a3275";
+      hash = "sha256-BGux3rIBOkZl7sKAjATjeVLhDXoL7kBvX5sACoceyWY=";
    };
    meta.homepage = "https://gitlab.com/xasc/tree-sitter-t32.git";
  };
@ -2346,12 +2368,12 @@
  };
  twig = buildGrammar {
    language = "twig";
-    version = "0.0.0+rev=779ee5a";
+    version = "0.0.0+rev=eaf80e6";
    src = fetchFromGitHub {
      owner = "gbprod";
      repo = "tree-sitter-twig";
-      rev = "779ee5ab1e065dcef7f51f253030dc875445b25f";
-      hash = "sha256-4De6ETY0oqbvMXtTDyd1vwheJdfuIusNHjyqyspsz2A=";
+      rev = "eaf80e6af969e25993576477a9dbdba3e48c1305";
+      hash = "sha256-fp7HcdJEFxi/zBFSrM86THwBMpqFwAGugcTVbPk3bd4=";
    };
    meta.homepage = "https://github.com/gbprod/tree-sitter-twig";
  };
@ -2367,6 +2389,17 @@
    location = "typescript";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
  };
+  typoscript = buildGrammar {
+    language = "typoscript";
+    version = "0.0.0+rev=43b221c";
+    src = fetchFromGitHub {
+      owner = "Teddytrombone";
+      repo = "tree-sitter-typoscript";
+      rev = "43b221c0b76e77244efdaa9963e402a17c930fbc";
+      hash = "sha256-7ottrupSWC83rDP59yceDG/TuikNHoyCBnAlns/x6Tc=";
+    };
+    meta.homepage = "https://github.com/Teddytrombone/tree-sitter-typoscript";
+  };
  ungrammar = buildGrammar {
    language = "ungrammar";
    version = "0.0.0+rev=debd26f";
@ -2380,12 +2413,12 @@
  };
  unison = buildGrammar {
    language = "unison";
-    version = "0.0.0+rev=694c8c0";
+    version = "0.0.0+rev=a69d087";
    src = fetchFromGitHub {
      owner = "kylegoetz";
      repo = "tree-sitter-unison";
-      rev = "694c8c0c79f8d1b80d497401acf4d1b77bfb004a";
-      hash = "sha256-g8g/YUKabxWwN+w0akMYMu0fFOkUHGAN44CVDOfPqI4=";
+      rev = "a69d087590f2ca057d1ef1a393de7e22869bb557";
+      hash = "sha256-9eDWvNkY3rEz6khluAJuTXF95CF384IRptaRXGOHma4=";
    };
    generate = true;
    meta.homepage = "https://github.com/kylegoetz/tree-sitter-unison";
@ -2514,12 +2547,12 @@
  };
  wing = buildGrammar {
    language = "wing";
-    version = "0.0.0+rev=8abdb5e";
+    version = "0.0.0+rev=61ed52f";
    src = fetchFromGitHub {
      owner = "winglang";
      repo = "wing";
-      rev = "8abdb5e1846a56004bcba6e1d9a735e22bb5fff4";
-      hash = "sha256-Pmj7Tk9GSeRNIvWODo9StI1c0Hx35B/G15r4kGvErgs=";
+      rev = "61ed52fa76a1797b7d22b831959b3abbbfdb7a05";
+      hash = "sha256-SE4BKB1IKsvNFeqrLAzajSfB9dbLQlSSvSpzOBNChcQ=";
    };
    location = "libs/tree-sitter-wing";
    generate = true;
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -470,6 +470,7 @@ https://github.com/jakewvincent/mkdnflow.nvim/,HEAD,
 https://github.com/SidOfc/mkdx/,,
 https://github.com/mawkler/modicator.nvim/,HEAD,
 https://github.com/tomasr/molokai/,,
+https://github.com/benlubas/molten-nvim/,HEAD,
 https://github.com/loctvl842/monokai-pro.nvim/,HEAD,
 https://github.com/shaunsingh/moonlight.nvim/,,pure-lua
 https://github.com/leafo/moonscript-vim/,HEAD,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1744,6 +1744,22 @@ let
        };
      };

+      griimick.vhs = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vhs";
+          publisher = "griimick";
+          version = "0.0.4";
+          sha256 = "sha256-zAy8o5d2pK5ra/dbwoLgPAQAYfRQtUYQjisWYgIhsXA=";
+        };
+        meta = {
+          description = "Visual Studio Code extension providing syntax support for VHS .tape files";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=griimick.vhs";
+          homepage = "https://github.com/griimick/vscode-vhs";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.drupol ];
+        };
+      };
+
      gruntfuggly.todo-tree = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "todo-tree";
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -30,21 +30,21 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1061hpazgs2gbn1xbn3in1sh7img71l5fx1irlgr86k70jdjw0qp";
-    x86_64-darwin = "17n16az3b8lnh1wq7mj4fd2kvvbh3l4d72iwxqx2z08vpsiaivad";
-    aarch64-linux = "0ggjh58nxwz5hlv4hwig2w32lcg2vsvszsr7dq6p7rd3c7l13mqr";
-    aarch64-darwin = "0irvjlzx79a2p8jbv8kiblkrzkslpv6qmqzi5yj7gl2dl2f5y1lx";
-    armv7l-linux = "1nyaz1nmswyy6qkz83cqb8nw1ajlhchqcwbj5msq3camkjdjr8g6";
+    x86_64-linux = "01xw0dpwb4ih2xlpgc0yq48wqb5nmicz98srbgz01sbmyji8x1lf";
+    x86_64-darwin = "13i449px6pajb94ymvi6vwmm25vyyh4vjrb86yiq4dcx1plcrxfc";
+    aarch64-linux = "174zl811pv5rznxz3fh7bkwz9iini8lmb8xfjs4i14sym7sxw5x3";
+    aarch64-darwin = "05kjmhr3dwbj16k4ilc8nl6ckm21fyak6pr1zzdxywqb5qd7qwr8";
+    armv7l-linux = "0icc4cx5p5fxsi8cz3mxik4vnmrv2dvfzm220nl9p13bn1ri3f6s";
  }.${system} or throwSystem;
 in
  callPackage ./generic.nix rec {
    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.83.1";
+    version = "1.84.0";
    pname = "vscode" + lib.optionalString isInsiders "-insiders";

    # This is used for VS Code - Remote SSH test
-    rev = "f1b07bd25dfad64b0167beb15359ae573aecd2cc";
+    rev = "d037ac076cee195194f93ce6fe2bdfe2969cc82d";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
    longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@ -68,7 +68,7 @@ in
      src = fetchurl {
        name = "vscode-server-${rev}.tar.gz";
        url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "0hbqbkzynqxp99rhqq46878cp1jnjklqy8vgbf0dm2cwfw86jbrw";
+        sha256 = "017g82h3jcygm6hi0s36ij8vxggz7p5j36nww5f53kn6a1s1wzcx";
      };
    };

--- a/pkgs/applications/emulators/retroarch/cores.nix
+++ b/pkgs/applications/emulators/retroarch/cores.nix
@ -760,7 +760,7 @@ in
    # causes redefinition of _FORTIFY_SOURCE
    hardeningDisable = [ "fortify3" ];

-    postBuild = "cd $NIX_BUILD_TOP/source/build/pcsx2";
+    postBuild = "cd pcsx2";
    meta = {
      description = "Port of PCSX2 to libretro";
      license = lib.licenses.gpl3Plus;
--- a/pkgs/applications/emulators/yuzu/sources.nix
+++ b/pkgs/applications/emulators/yuzu/sources.nix
@ -1,19 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2023-10-20
+# Last updated: 2023-11-05
 {
  compatList = {
-    rev = "9d17cbd71408476c6a28cbf0fa8177155c511681";
+    rev = "e9c4e5da6e5e88e889c87582dfd826d204ca8782";
    hash = "sha256:1hdsza3wf9a0yvj6h55gsl7xqvhafvbz1i8paz9kg7l49b0gnlh1";
  };

  mainline = {
-    version = "1595";
-    hash = "sha256:09b0w6z4w9z4ms2pvik2vrmklfcx25jxcgs61bff3nflilnw9m97";
+    version = "1611";
+    hash = "sha256:18rrw63j2zjwakbn99wbzprb1rpmlznl6gb09ay9sq8brxy7zjsv";
  };

  ea = {
-    version = "3940";
-    distHash = "sha256:0g0vv274sh3iy56n7s324km87g302005ahi9zh2qhwkiirbnc811";
-    fullHash = "sha256:0ywppc4z5d4b1zl1cr8yfnba58hgi0z2szficwpinapai7q0pyid";
+    version = "3966";
+    distHash = "sha256:1p60455s0h3dwigxm2lxdfgxgv4l2ibwybisja1khcy4i8lgss03";
+    fullHash = "sha256:1jq2bfbv9a6i3dlqsdgmi87rccvks45iyybxwf8p6rxdjqh4bvl2";
  };
 }
--- a/pkgs/applications/emulators/zesarux/default.nix
+++ b/pkgs/applications/emulators/zesarux/default.nix
@ -1,97 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, SDL2
-, aalib
-, alsa-lib
-, libXext
-, libXxf86vm
-, libcaca
-, libpulseaudio
-, libsndfile
-, ncurses
-, openssl
-, which
-}:
-
-stdenv.mkDerivation rec {
-  pname = "zesarux";
-  version = "10.0";
-
-  src = fetchFromGitHub {
-    owner = "chernandezba";
-    repo = pname;
-    rev = version;
-    hash = "sha256-cxV2dAzGnIzJiCRdq8vN/Cl4AQeJqjmiCAahijIJQ9k=";
-  };
-
-  nativeBuildInputs = [
-    which
-  ];
-
-  buildInputs = [
-    SDL2
-    aalib
-    alsa-lib
-    libXxf86vm
-    libXext
-    libcaca
-    libpulseaudio
-    libsndfile
-    ncurses
-    openssl
-  ];
-
-  patches = [
-    # Patch the shell scripts; remove it when the next version arrives
-    (fetchpatch {
-      name = "000-fix-shebangs.patch";
-      url = "https://github.com/chernandezba/zesarux/commit/4493439b38f565c5be7c36239ecaf0cf80045627.diff";
-      sha256 = "sha256-f+21naPcPXdcVvqU8ymlGfl1WkYGOeOBe9B/WFUauTI=";
-    })
-
-    # Patch pending upstream release for libcaca-0.99.beta20 support:
-    #  https://github.com/chernandezba/zesarux/pull/1
-    (fetchpatch {
-      name = "libcaca-0.99.beta20.patch";
-      url = "https://github.com/chernandezba/zesarux/commit/542786338d00ab6fcdf712bbd6f5e891e8b26c34.diff";
-      sha256 = "sha256-UvXvBb9Nzw5HNz0uiv2SV1Oeiw7aVCa0jhEbThDRVec=";
-    })
-  ];
-
-  postPatch = ''
-    cd src
-    patchShebangs ./configure *.sh
-  '';
-
-  configureFlags = [
-    "--prefix=${placeholder "out"}"
-    "--c-compiler ${stdenv.cc.targetPrefix}cc"
-    "--enable-cpustats"
-    "--enable-memptr"
-    "--enable-sdl2"
-    "--enable-ssl"
-    "--enable-undoc-scfccf"
-    "--enable-visualmem"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    ./generate_install_sh.sh
-    patchShebangs ./install.sh
-    ./install.sh
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/chernandezba/zesarux";
-    description = " ZX Second-Emulator And Released for UniX";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.unix;
-  };
-}
-# TODO: Darwin support
--- a/pkgs/applications/file-managers/clifm/default.nix
+++ b/pkgs/applications/file-managers/clifm/default.nix
@ -1,17 +1,17 @@
-{ stdenv, lib, fetchFromGitHub, libcap, acl, file, readline }:
+{ stdenv, lib, fetchFromGitHub, libcap, acl, file, readline, python3 }:

 stdenv.mkDerivation rec {
  pname = "clifm";
-  version = "1.14.6";
+  version = "1.15";

  src = fetchFromGitHub {
    owner = "leo-arch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-0EOG7BAZL3OPP2/qePNkljAa0/Qb3zwuJWz2P4l8GZc=";
+    sha256 = "sha256-4Z2u1APNfJ9Ai95MMWb5FCUgCA2Hrbp+5eBJZD3tN+U=";
  };

-  buildInputs = [ libcap acl file readline ];
+  buildInputs = [ libcap acl file readline python3];

  makeFlags = [
    "DESTDIR=${placeholder "out"}"
--- a/pkgs/applications/file-managers/felix-fm/default.nix
+++ b/pkgs/applications/file-managers/felix-fm/default.nix
@ -3,32 +3,40 @@
 , fetchFromGitHub
 , pkg-config
 , bzip2
+, libgit2
+, zlib
 , zstd
 , zoxide
 }:

 rustPlatform.buildRustPackage rec {
  pname = "felix";
-  version = "2.9.0";
+  version = "2.10.1";

  src = fetchFromGitHub {
    owner = "kyoheiu";
    repo = "felix";
    rev = "v${version}";
-    hash = "sha256-bTe8fPFVWuAATXdeyUvtdK3P4vDpGXX+H4TQ+h9bqUI=";
+    hash = "sha256-pDJW/QhkJtEAq7xusYn/t/pPizT77OYmlbVlF/RTXic=";
  };

-  cargoHash = "sha256-q86NiJPtr1X9D9ym8iLN1ed1FMmEb217Jx3Ei4Bn5y0=";
+  cargoHash = "sha256-AGQt06fMXuyOEmQIEiUCzuK1Atx3gQMUCB+hPWlrldk=";

  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
    bzip2
+    libgit2
+    zlib
    zstd
  ];

  nativeCheckInputs = [ zoxide ];

+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
  buildFeatures = [ "zstd/pkg-config" ];

  checkFlags = [
@ -37,11 +45,6 @@ rustPlatform.buildRustPackage rec {
    "--skip=state::tests::test_has_write_permission"
  ];

-  # Cargo.lock is outdated
-  postConfigure = ''
-    cargo metadata --offline
-  '';
-
  meta = with lib; {
    description = "A tui file manager with vim-like key mapping";
    homepage = "https://github.com/kyoheiu/felix";
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@ -76,14 +76,14 @@ let
    urllib3
  ];
 in mkDerivation rec {
-  version = "3.28.11";
+  version = "3.28.12";
  pname = "qgis-ltr-unwrapped";

  src = fetchFromGitHub {
    owner = "qgis";
    repo = "QGIS";
    rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-3yV47GlIhYGR7+ZlPLQw1vy1x8xuJd5erUJO3Pw7L+g=";
+    hash = "sha256-C80ZrQW7WFXz8UMXSt3FJcK2gDd292H24Ic3pJD/yqI=";
  };

  passthru = {
--- a/pkgs/applications/graphics/azpainter/default.nix
+++ b/pkgs/applications/graphics/azpainter/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "azpainter";
-  version = "3.0.6";
+  version = "3.0.7";

  src = fetchFromGitLab {
    owner = "azelpg";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-/shmLdZ4mCBZAeUuqJtCiUjeI8B5f/8dIGPqmXMjZ1I=";
+    hash = "sha256-RlsiN9pefpTYUh4M8j4Ty/Ipi9StoVcNcICd7QDirhI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/fiji/default.nix
+++ b/pkgs/applications/graphics/fiji/default.nix
@ -71,6 +71,6 @@ stdenv.mkDerivation rec {
      binaryNativeCode
    ];
    license = with lib.licenses; [ gpl2Plus gpl3Plus bsd2 publicDomain ];
-    maintainers = with maintainers; [ zane ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@ -40,6 +40,7 @@
 , python3
 , substituteAll
 , wrapGAppsHook
+, libepoxy
 , zlib
 }:
 let
@ -48,12 +49,17 @@ let
      appdirs
      beautifulsoup4
      cachecontrol
-      filelock
+    ]
+    # CacheControl requires extra runtime dependencies for FileCache
+    # https://gitlab.com/inkscape/extras/extension-manager/-/commit/9a4acde6c1c028725187ff5972e29e0dbfa99b06
+    ++ cachecontrol.optional-dependencies.filecache
+    ++ [
      numpy
      lxml
      packaging
      pillow
      scour
+      pyparsing
      pyserial
      requests
      pygobject3
@ -61,11 +67,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "inkscape";
-  version = "1.2.2";
+  version = "1.3";

  src = fetchurl {
-    url = "https://media.inkscape.org/dl/resources/file/inkscape-${version}.tar.xz";
-    sha256 = "oMf9DQPAohU15kjvMB3PgN18/B81ReUQZfvxuj7opcQ=";
+    url = "https://inkscape.org/release/inkscape-${version}/source/archive/xz/dl/inkscape-${version}.tar.xz";
+    sha256 = "sha256-v08oawJeAWm4lIzBTVGZqbTCBNdhyJTEtISWVx7HYwc=";
  };

  # Inkscape hits the ARGMAX when linking on macOS. It appears to be
@ -143,6 +149,7 @@ stdenv.mkDerivation rec {
    potrace
    python3Env
    zlib
+    libepoxy
  ] ++ lib.optionals (!stdenv.isDarwin) [
    gspell
  ] ++ lib.optionals stdenv.isDarwin [
@ -152,8 +159,9 @@ stdenv.mkDerivation rec {

  # Make sure PyXML modules can be found at run-time.
  postInstall = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -change $out/lib/libinkscape_base.dylib $out/lib/inkscape/libinkscape_base.dylib $out/bin/inkscape
-    install_name_tool -change $out/lib/libinkscape_base.dylib $out/lib/inkscape/libinkscape_base.dylib $out/bin/inkview
+    for f in $out/lib/inkscape/*.dylib; do
+      ln -s $f $out/lib/$(basename $f)
+    done
  '';

  meta = with lib; {
--- a/pkgs/applications/graphics/ipe/default.nix
+++ b/pkgs/applications/graphics/ipe/default.nix
@ -13,7 +13,7 @@
 , libspiro
 , lua5
 , qtbase
-, texlive
+, texliveSmall
 , wrapQtAppsHook
 , zlib
 , withTeXLive ? true
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
    qtbase
    zlib
  ] ++ (lib.optionals withTeXLive [
-    texlive
+    texliveSmall
  ]);

  makeFlags = [
@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    "IPE_NO_SPELLCHECK=1" # qtSpell is not yet packaged
  ];

-  qtWrapperArgs = lib.optionals withTeXLive [ "--prefix PATH : ${lib.makeBinPath [ texlive ]}" ];
+  qtWrapperArgs = lib.optionals withTeXLive [ "--prefix PATH : ${lib.makeBinPath [ texliveSmall ]}" ];

  enableParallelBuilding = true;

--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@ -27,6 +27,12 @@ mkDerivation rec {
      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/krita/-/raw/acd9a818660e86b14a66fceac295c2bab318c671/exiv2-0.28.patch";
      hash = "sha256-iD2pyid513ThJVeotUlVDrwYANofnEiZmWINNUm/saw=";
    })
+    (fetchpatch {
+      name = "krita-opencolorio-2.3-compat.patch";
+      url = "https://invent.kde.org/graphics/krita/-/commit/520c633c2c868f2236d8e56eefecdcb6e3ebd840.patch";
+      hash = "sha256-eXsgBN8OnKjZOQsOxViPypts6CVh3L+IYKMB/mDUcfQ=";
+      includes = [ "plugins/dockers/lut/ocio_display_filter_vfx2021.cpp" ];
+    })
  ];

  nativeBuildInputs = [ cmake extra-cmake-modules python3Packages.sip makeWrapper ];
--- a/pkgs/applications/graphics/xpano/default.nix
+++ b/pkgs/applications/graphics/xpano/default.nix
@ -15,21 +15,16 @@

 stdenv.mkDerivation rec {
  pname = "xpano";
-  version = "0.16.1";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "krupkat";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1f95spf7bbbdvbr4gqfyrs161049jj1wnkvf5wgsd0ga3vb15mcj";
+    sha256 = "aKO9NYHFjb69QopseNOJvUvvVT1povP9tyGSOHJFWVo=";
    fetchSubmodules = true;
  };

-  patches = [
-    # force install desktop + icon files
-    ./skip_prefix_check.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    ninja
@ -42,7 +37,7 @@ stdenv.mkDerivation rec {
    SDL2
    gtk3
    spdlog
-    # exiv2 # TODO: enable when 0.28.0 is available
+    exiv2
  ];

  checkInputs = [
@ -53,6 +48,7 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DBUILD_TESTING=ON"
+    "-DXPANO_INSTALL_DESKTOP_FILES=ON"
  ];

  meta = with lib; {
--- a/pkgs/applications/graphics/xpano/skip_prefix_check.patch
+++ b/pkgs/applications/graphics/xpano/skip_prefix_check.patch
@ -1,18 +0,0 @@
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -167,7 +167,6 @@ install(FILES
-   TYPE BIN
- )
- 
-if(CMAKE_INSTALL_PREFIX MATCHES "^/usr.*|^/app.*")
-   install(FILES
-     "misc/build/linux/xpano.desktop"
-     DESTINATION "${CMAKE_INSTALL_PREFIX}/share/applications"
-@@ -184,7 +183,6 @@ if(CMAKE_INSTALL_PREFIX MATCHES "^/usr.*|^/app.*")
-     "misc/build/linux/cz.krupkat.Xpano.metainfo.xml"
-     DESTINATION "${CMAKE_INSTALL_PREFIX}/share/metainfo"
-   )
-endif()
- 
- install(DIRECTORY
-   "${CMAKE_SOURCE_DIR}/misc/assets"
--- a/pkgs/applications/misc/bazecor/10-dygma.rules
+++ b/pkgs/applications/misc/bazecor/10-dygma.rules
@ -0,0 +1,4 @@
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2201", MODE="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2200", MODE="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="35ef", MODE="0666"
+KERNEL=="hidraw*", ATTRS{idVendor}=="35ef", MODE="0666"
--- a/pkgs/applications/misc/bazecor/default.nix
+++ b/pkgs/applications/misc/bazecor/default.nix
@ -0,0 +1,56 @@
+{ lib
+, appimageTools
+, fetchurl
+}:
+
+appimageTools.wrapAppImage rec {
+  pname = "bazecor";
+  version = "1.3.6";
+
+  src = appimageTools.extract {
+    inherit pname version;
+    src = fetchurl {
+      url = "https://github.com/Dygmalab/Bazecor/releases/download/v.${version}/Bazecor-${version}-x64.AppImage";
+      hash = "sha256-Mz7T/AAlyfMzdfy/ZV4AEP3ClTolwr2pPzkSCPL66/w=";
+    };
+
+    # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
+    postExtract = ''
+      substituteInPlace \
+        $out/usr/lib/bazecor/resources/app/.webpack/main/index.js \
+        --replace \
+          'checkUdev=()=>{try{if(c.default.existsSync(f))return c.default.readFileSync(f,"utf-8").trim()===l.trim()}catch(e){console.error(e)}return!1}' \
+          'checkUdev=()=>{return 1}'
+    '';
+  };
+
+  # also make sure to update the udev rules in ./10-dygma.rules; most recently
+  # taken from
+  # https://github.com/Dygmalab/Bazecor/blob/v1.3.6/src/main/utils/udev.ts#L6
+
+  extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
+    p.glib
+  ];
+
+  # Also expose the udev rules here, so it can be used as:
+  #   services.udev.packages = [ pkgs.bazecor ];
+  # to allow non-root modifications to the keyboards.
+
+  extraInstallCommands = ''
+    mv $out/bin/bazecor-* $out/bin/bazecor
+
+    mkdir -p $out/lib/udev/rules.d
+    ln -s --target-directory=$out/lib/udev/rules.d ${./10-dygma.rules}
+  '';
+
+  meta = {
+    description = "Graphical configurator for Dygma Products";
+    homepage = "https://github.com/Dygmalab/Bazecor";
+    changelog = "https://github.com/Dygmalab/Bazecor/releases/tag/v${version}";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ amesgen ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "bazecor";
+  };
+}
--- a/pkgs/applications/misc/birdtray/default.nix
+++ b/pkgs/applications/misc/birdtray/default.nix
@ -33,7 +33,7 @@ mkDerivation rec {
    description = "Mail system tray notification icon for Thunderbird";
    homepage = "https://github.com/gyunaev/birdtray";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ Flakebi oxalica ];
+    maintainers = with maintainers; [ Flakebi ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/etesync-dav/default.nix
+++ b/pkgs/applications/misc/etesync-dav/default.nix
@ -7,54 +7,7 @@
 , radicale3
 }:

-let
-  python = python3.override {
-    packageOverrides = self: super: {
-      flask = super.flask.overridePythonAttrs (old: rec {
-        version = "2.0.3";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-4RIMIoyi9VO0cN9KX6knq2YlhGdSYGmYGz6wqRkCaH0=";
-        };
-
-        patches = [
-          # Pulling in this patch lets us continue running tests without any
-          # other changes using setuptools >= 67.5.0.
-          (fetchpatch {
-            name = "remove-deprecated-pkg-resources.patch";
-            url = "https://github.com/pallets/flask/commit/751d85f3de3f726446bb12e4ddfae885a6645ba1.patch";
-            hash = "sha256-T4vKSSe3P0xtb2/iQjm0RH2Bwk1ZHWiPoX1Ycr63EqU=";
-            includes = [ "src/flask/cli.py" ];
-          })
-        ];
-      });
-      flask-wtf = super.flask-wtf.overridePythonAttrs (old: rec {
-        version = "0.15.1";
-        format = "setuptools";
-        src = old.src.override {
-          inherit version;
-          pname = "Flask-WTF";
-          hash = "sha256-/xdxhfiRMC3CU0N/5jCB56RqTpmsph3+CG+yPlT/8tw=";
-        };
-        disabledTests = [
-          "test_outside_request"
-        ];
-        disabledTestPaths = [
-          "tests/test_form.py"
-          "tests/test_html5.py"
-        ];
-        patches = [ ];
-      });
-      werkzeug = super.werkzeug.overridePythonAttrs (old: rec {
-        version = "2.0.3";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-uGP4/wV8UiFktgZ8niiwQRYbS+W6TQ2s7qpQoWOCLTw=";
-        };
-      });
-    };
-  };
-in python.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "etesync-dav";
  version = "0.32.1";

@ -71,7 +24,7 @@ in python.pkgs.buildPythonApplication rec {
    })
  ];

-  propagatedBuildInputs = with python.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
    appdirs
    etebase
    etesync
--- a/pkgs/applications/misc/flashprint/default.nix
+++ b/pkgs/applications/misc/flashprint/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "flashprint";
-  version = "5.8.0";
+  version = "5.8.1";

  src = fetchurl {
    url = "http://www.ishare3d.com/3dapp/public/FlashPrint-5/FlashPrint/flashprint5_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-T7NHSTDFqM/LygTU3zO64Ut/tdd3vDPQoZuhAv7PWHU=";
+    hash = "sha256-X5CsJmJa3qGQxdZ1xg3xoVnIaChzxZ/GaLZFqBE2dIk=";
  };

  nativeBuildInputs = [ dpkg autoPatchelfHook wrapQtAppsHook ];
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -2,13 +2,13 @@

 buildPythonApplication rec {
  pname = "gallery-dl";
-  version = "1.26.1";
+  version = "1.26.2";
  format = "setuptools";

  src = fetchPypi {
    inherit version;
    pname = "gallery_dl";
-    sha256 = "sha256-SJshEdvmPDQZ5mqiQfJpWcQ43WGXUxPvMMJiY/4Cxsc=";
+    sha256 = "sha256-Agccsz0TlzCDnhR5Vy7Tt3jrqz9+hwaclQgXJBhGY9w=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/misc/lunatask/default.nix
+++ b/pkgs/applications/misc/lunatask/default.nix
@ -1,19 +1,20 @@
 { lib, appimageTools, fetchurl }:

 let
-  version = "1.7.7";
+  version = "1.7.8";
  pname = "lunatask";

  src = fetchurl {
    url = "https://lunatask.app/download/Lunatask-${version}.AppImage";
-    sha256 = "sha256-3WiJR+gwudeLs6Mn75SJP4BZ6utwxvvRLOHe/W+1Pfs=";
+    sha256 = "sha256-DhTWD9uL7zKWiRfeLYKxPtmAy1yR20wjlVA+N33YgpQ=";
  };

  appimageContents = appimageTools.extractType2 {
    inherit pname version src;
  };

-in appimageTools.wrapType2 rec {
+in
+appimageTools.wrapType2 rec {
  inherit pname version src;

  extraInstallCommands = ''
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
  pname = "process-compose";
-  version = "0.65.1";
+  version = "0.69.0";

  src = fetchFromGitHub {
    owner = "F1bonacc1";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-wlsZV9yE9486EBbIwVOcA4KBf9tfI0Ao1JSIPjJAcEU=";
+    hash = "sha256-YVNcr8oYEOsy0KLOsPdWTZcXYTqyz4RYG9MCEngLn7c=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -43,7 +43,7 @@ buildGoModule rec {
    installShellFiles
  ];

-  vendorHash = "sha256-Z5vCxzdpd2OmlZ/woHhlLN2QMgqa9mm873QGuqDToiM=";
+  vendorHash = "sha256-lU21nRfIi4/eobnHhX/fCWnWtoiQBiWvTUOjBL0I4X4=";

  doCheck = false;

--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.25.2";
+  version = "2.26.0";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = "spicetify-cli";
    rev = "v${version}";
-    hash = "sha256-llPxR4awKBBv0jiLr5MbE33D5KZx3LmBo5BDwZI8ZM0=";
+    hash = "sha256-3u55Pcd4VNgWGyu/IVsrMqm8E4H9y4Bvt3JMyIL/KXo=";
  };

  vendorHash = "sha256-VktAO3yKCdm5yz/RRLeLv6zzyGrwuHC/i8WdJtqZoYc=";
--- a/pkgs/applications/misc/stretchly/default.nix
+++ b/pkgs/applications/misc/stretchly/default.nix
@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
    homepage = "https://hovancik.net/stretchly";
    downloadPage = "https://hovancik.net/stretchly/downloads/";
    license = licenses.bsd2;
-    maintainers = with maintainers; [ _1000101 oxalica ];
+    maintainers = with maintainers; [ _1000101 ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/therion/default.nix
+++ b/pkgs/applications/misc/therion/default.nix
@ -10,7 +10,7 @@
 , expat
 , bwidget
 , python3
-, texlive
+, texliveTeTeX
 , survex
 , makeWrapper
 , fmt
@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
    pkg-config
    perl
    python3
-    texlive.combined.scheme-tetex
+    texliveTeTeX
    makeWrapper
    tcl.tclPackageHook
  ];
@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
  fixupPhase = ''
    runHook preFixup
    wrapProgram $out/bin/therion \
-      --prefix PATH : ${lib.makeBinPath [ survex texlive.combined.scheme-tetex ]}
+      --prefix PATH : ${lib.makeBinPath [ survex texliveTeTeX ]}
    wrapProgram $out/bin/xtherion \
      --prefix PATH : ${lib.makeBinPath [ tk ]}
    runHook postFixup
--- a/pkgs/applications/misc/yubioath-flutter/helper.nix
+++ b/pkgs/applications/misc/yubioath-flutter/helper.nix
@ -4,7 +4,7 @@
 , yubikey-manager
 , fido2
 , mss
-, zxing_cpp
+, zxing-cpp
 , pillow
 , cryptography

@ -43,7 +43,7 @@ buildPythonApplication {
    yubikey-manager
    fido2
    mss
-    zxing_cpp
+    zxing-cpp
    pillow
    cryptography
  ];
--- a/pkgs/applications/misc/zettlr/default.nix
+++ b/pkgs/applications/misc/zettlr/default.nix
@ -1,6 +1,6 @@
-{ callPackage, texlive }:
+{ callPackage, texliveMedium }:

-builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; inherit texlive; })) {
+builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; inherit texliveMedium; })) {
  zettlr = {
    version = "3.0.2";
    hash = "sha256-xwBq+kLmTth15uLiYWJOhi/YSPZVJNO6JTrKFojSDXA=";
--- a/pkgs/applications/misc/zettlr/generic.nix
+++ b/pkgs/applications/misc/zettlr/generic.nix
@ -4,7 +4,7 @@
 , appimageTools
 , lib
 , fetchurl
-, texlive
+, texliveMedium
 , pandoc
 }:

@ -23,7 +23,7 @@ appimageTools.wrapType2 rec {
  inherit name src;

  multiArch = false; # no 32bit needed
-  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ texlive pandoc ];
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ texliveMedium pandoc ];
  extraInstallCommands = ''
    mv $out/bin/{${name},${pname}}
    install -m 444 -D ${appimageContents}/Zettlr.desktop $out/share/applications/Zettlr.desktop
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,39 +1,39 @@
 {
  stable = {
    chromedriver = {
-      hash_darwin = "sha256-ugsxRhIPtDD7Y4/PsIc8Apqrtyo4uiVKoLmtRvQaJ3k=";
+      hash_darwin = "sha256-sRAU9RJANz+Sov6oaoZasMoaqM+mIZSDbag92wXsVCI=";
      hash_darwin_aarch64 =
-        "sha256-aD/bHIxMm1OQu6un8cTYLPWoq/cC6kd1hTkxLEqGGRM=";
-      hash_linux = "sha256-Ie5wtKXz27/vI97Ku7dqqQicR+tujgFUzANAIKTRw8M=";
-      version = "118.0.5993.70";
+        "sha256-U+PBsfpc7PNZYedHIdPnWXA9xKpRnon5vxgKKJr69ow=";
+      hash_linux = "sha256-2o6LAo2pEsCi1exPv1nEMk2Tklhh49UyWaYoyQ7Df/Y=";
+      version = "119.0.6045.105";
    };
    deps = {
      gn = {
-        hash = "sha256-SwlET5h5xtDlQvlt8wbG73ZfUWJr4hlWc+uQsBH5x9M=";
-        rev = "cc56a0f98bb34accd5323316e0292575ff17a5d4";
+        hash = "sha256-4jWqtsOBh96xbYk1m06G9hj2eQwW6buUXsxWsa5W6/4=";
+        rev = "991530ce394efb58fcd848195469022fa17ae126";
        url = "https://gn.googlesource.com/gn";
-        version = "2023-08-10";
+        version = "2023-09-12";
      };
    };
-    hash = "sha256-65rN17DIF+9FgZu7ohc9dM8ni6Qmqc9l1oyOcloip44=";
-    hash_deb_amd64 = "sha256-RJcyIA0TdXWRk+K2GVcHSv4OSq5c6Y7InUblao3uusc=";
-    version = "118.0.5993.117";
+    hash = "sha256-sVBZ0FnaJg1P9a2X8N1MSs8ehPSPzgfbhprb+4v0gXA=";
+    hash_deb_amd64 = "sha256-WLTTFMUvtBHvvegDFpZ+7Eht9StMyleaqXEBhPhgPTs=";
+    version = "119.0.6045.105";
  };
  ungoogled-chromium = {
    deps = {
      gn = {
-        hash = "sha256-SwlET5h5xtDlQvlt8wbG73ZfUWJr4hlWc+uQsBH5x9M=";
-        rev = "cc56a0f98bb34accd5323316e0292575ff17a5d4";
+        hash = "sha256-4jWqtsOBh96xbYk1m06G9hj2eQwW6buUXsxWsa5W6/4=";
+        rev = "991530ce394efb58fcd848195469022fa17ae126";
        url = "https://gn.googlesource.com/gn";
-        version = "2023-08-10";
+        version = "2023-09-12";
      };
      ungoogled-patches = {
-        hash = "sha256-10kSaLteFtvg3nGffslRpAxmc7nFsp0rA8gwm8jqt/8=";
-        rev = "118.0.5993.117-1";
+        hash = "sha256-+1ln5xD+VwhB+f64rnSXeNOYmhbnm6Kb2xBe5Aanxkc=";
+        rev = "119.0.6045.105-1";
      };
    };
-    hash = "sha256-65rN17DIF+9FgZu7ohc9dM8ni6Qmqc9l1oyOcloip44=";
-    hash_deb_amd64 = "sha256-RJcyIA0TdXWRk+K2GVcHSv4OSq5c6Y7InUblao3uusc=";
-    version = "118.0.5993.117";
+    hash = "sha256-sVBZ0FnaJg1P9a2X8N1MSs8ehPSPzgfbhprb+4v0gXA=";
+    hash_deb_amd64 = "sha256-WLTTFMUvtBHvvegDFpZ+7Eht9StMyleaqXEBhPhgPTs=";
+    version = "119.0.6045.105";
  };
 }
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@ -12,9 +12,11 @@
 , widevine-cdm
 , enableVulkan ? stdenv.isLinux
 , vulkan-loader
+, buildPackages
 }:

 let
+  isQt6 = lib.versions.major qtbase.version == "6";
  pdfjs = let
    version = "3.9.179";
  in
@ -50,10 +52,14 @@ python3.pkgs.buildPythonApplication {
  ];

  propagatedBuildInputs = with python3.pkgs; ([
-    pyyaml pyqt6-webengine jinja2 pygments
+    pyyaml (if isQt6 then pyqt6-webengine else pyqtwebengine) jinja2 pygments
    # scripts and userscripts libs
    tldextract beautifulsoup4
-    readability-lxml pykeepass stem
+    readability-lxml pykeepass
+  ] ++ lib.optionals ((builtins.tryEval stem.outPath).success) [
+    # error: stem-1.8.2 not supported for interpreter python3.11
+    stem
+  ] ++ [
    pynacl
    # extensive ad blocking
    adblock
@ -80,7 +86,7 @@ python3.pkgs.buildPythonApplication {
    runHook preInstall

    make -f misc/Makefile \
-      PYTHON=${python3}/bin/python3 \
+      PYTHON=${buildPackages.python3}/bin/python3 \
      PREFIX=. \
      DESTDIR="$out" \
      DATAROOTDIR=/share \
--- a/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "kubectl-cnpg";
-  version = "1.20.2";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "cloudnative-pg";
    repo = "cloudnative-pg";
    rev = "v${version}";
-    hash = "sha256-JkvaFhzazvuqRJ6ertwMQhp+H2zsjRGA23XbvLCIYg0=";
+    hash = "sha256-FRSypaZex55ABE+e23kvNZFTTn6Z8AEy8ag3atwMdEk=";
  };

-  vendorHash = "sha256-unOPTQeJW9rUOpZh7gTjD8IZDh4wi04oBAfDO5juJf8=";
+  vendorHash = "sha256-mirnieBrrVwRccJDgelZvSfQaAVlTsttOh3nJBN6ev0=";

  subPackages = [ "cmd/kubectl-cnpg" ];

--- a/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubectl-gadget";
-  version = "0.21.0";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    rev = "v${version}";
-    hash = "sha256-e93rQRIF3CmXjQhpACxBp4WnPtQ5IJnm7H5BcHGqH0c=";
+    hash = "sha256-tVkuLoQ0xKnPQG7a6tShTIJ7/kDYlmmLPHlPfhk01qw=";
  };

-  vendorHash = "sha256-YkOw4HpbX6e6uIAUa7zQPah/ifRfB4ICi90AxleKNNE=";
+  vendorHash = "sha256-45KvBV9R7a7GcZtszxTaOOert1vWH4eltVr/AWGqOSY=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/cluster/kubectl-klock/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-klock/default.nix
@ -2,21 +2,21 @@

 buildGo121Module rec {
  pname = "kubectl-klock";
-  version = "0.4.0";
+  version = "0.5.0";

  src = fetchFromGitHub {
-    owner = "jillejr";
+    owner = "applejag";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-HO9/hr/CBmJkrbNdX8tp2pNRfZDaWNW8shyCR46G77A=";
+    sha256 = "sha256-fR97rTMFwtqVH9wqKy1+EzKKg753c18v8VDCQ2Y69+s=";
  };

-  vendorHash = "sha256-QvD5yVaisq5Zz/M81HAMKpgQJRB5qPCYveLgldHHGf0=";
+  vendorHash = "sha256-AkYKKM4PR/msG44MwdSq6XAf6EvdtJHoXyw7Xj7MXso=";

  meta = with lib; {
    description = "A kubectl plugin to render watch output in a more readable fashion";
-    homepage = "https://github.com/jillejr/kubectl-klock";
-    changelog = "https://github.com/jillejr/kubectl-klock/releases/tag/v${version}";
+    homepage = "https://github.com/applejag/kubectl-klock";
+    changelog = "https://github.com/applejag/kubectl-klock/releases/tag/v${version}";
    license = licenses.gpl3Plus;
    maintainers = [ maintainers.scm2342 ];
  };
--- a/pkgs/applications/networking/cluster/kuma/default.nix
+++ b/pkgs/applications/networking/cluster/kuma/default.nix
@ -15,17 +15,17 @@

 buildGoModule rec {
  inherit pname;
-  version = "2.3.1";
+  version = "2.4.3";
  tags = lib.optionals enableGateway [ "gateway" ];

  src = fetchFromGitHub {
    owner = "kumahq";
    repo = "kuma";
    rev = version;
-    hash = "sha256-BayfHBTTqgc0ArD6ux9HOqaZy0GrEpqgDa7zHZtiG2I=";
+    hash = "sha256-MAruZVXkokwiRIIo84dikIEUuYYJLgTDl4Zgivrltyk=";
  };

-  vendorHash = "sha256-St+jGks7ojKrgecmN7UJ9FjGrmjtgEKsunSY+4itUyA=";
+  vendorHash = "sha256-F428xc4YeTtBMlTEUdEdbLwtm2MPpCkDib/dgRTT/3Y=";

  # no test files
  doCheck = false;
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "nerdctl";
-  version = "1.6.2";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-izFDqaJFJrgeb3YPP/7rIf/IjvrtlwjbktNy702zVTU=";
+    hash = "sha256-PR3vhNfY84vKQaAMKmPPmY7kK3BRxELAC34NfMYXQPk=";
  };

-  vendorHash = "sha256-4I+qCh/A/Yj5kUZLFvXTUV85l/2LVGPUCivTdDlA1ao=";
+  vendorHash = "sha256-qLxUAICm/SGy2iHAbg+12xmId+P335dFyjltYlB45iw=";

  nativeBuildInputs = [ makeWrapper installShellFiles ];

--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.53.0";
+  version = "0.53.2";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-Y3the1+p+ZAkPxKnScNIup7cfyTtE2LU3IdghA0mOY8=";
+    hash = "sha256-nolZ660rU7WisQdufswrH5vqAedKlA3Y0AQMul/+sTo=";
  };

-  vendorHash = "sha256-5O3souGEosqLFxZpGbak4r57V39lR6X8mEPgfad3X5Q=";
+  vendorHash = "sha256-1+ebqMqtil2/KrFjRIfCx60aWu8ByIFV1my8RiUrSNo=";

  doCheck = false;

--- a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
@ -1,38 +1,55 @@
 { lib
 , python3
 , fetchFromGitHub
+, testers
+, deltachat-cursed
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "deltachat-cursed";
-  version = "0.7.2";
+  version = "0.8.0";
+
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "adbenitez";
    repo = "deltachat-cursed";
    rev = "v${version}";
-    hash = "sha256-Cv2QT8GsPAcA5TTZGfNvFNwnUITSR0PmQE0QCO1nFNk=";
+    hash = "sha256-1QNhNPa6ZKn0lGQXs/cmfdSFHscwlYwFC/2DpnMoHvY=";
  };

-  nativeBuildInputs = [
-    python3.pkgs.setuptools-scm
+  nativeBuildInputs = with python3.pythonForBuild.pkgs; [
+    setuptools
+    setuptools-scm
  ];

  SETUPTOOLS_SCM_PRETEND_VERSION = version;

  propagatedBuildInputs = with python3.pkgs; [
+    appdirs
    deltachat
    emoji
    notify-py
+    setuptools # for pkg_resources
    urwid-readline
  ];

  doCheck = false; # no tests implemented

+  passthru.tests = {
+    version = testers.testVersion rec {
+      package = deltachat-cursed;
+      command = ''
+        HOME="$TEMP" ${lib.getExe package} --version
+      '';
+    };
+  };
+
  meta = with lib; {
    description = "Lightweight Delta Chat client";
    homepage = "https://github.com/adbenitez/deltachat-cursed";
    license = licenses.gpl3Plus;
+    mainProgram = "curseddelta";
    maintainers = with maintainers; [ dotlambda ];
  };
 }
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@ -1,7 +1,7 @@
 { lib
 , buildNpmPackage
 , copyDesktopItems
-, electron_22
+, electron_26
 , buildGoModule
 , esbuild
 , fetchFromGitHub
@ -33,16 +33,16 @@ let
 in
 buildNpmPackage rec {
  pname = "deltachat-desktop";
-  version = "1.40.4";
+  version = "unstable-2023-11-03";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-desktop";
-    rev = "v${version}";
-    hash = "sha256-cNCM0McWBmHUUutMDa/Cy0qOxhx4NJnhjrW++HRl/nU=";
+    rev = "40152e9543eb773fc27e7a4f96ef1eecebe9310e";
+    hash = "sha256-9GPXFUCu9GKa/bJgO8CIPMLccI6WAJ6PhfoyJ6s/DHE=";
  };

-  npmDepsHash = "sha256-CoWa0l2If+SGqD47nP91qsvUlTzOEWP5or5zNUdV7P0=";
+  npmDepsHash = "sha256-g3nkgqZNoq+xuwXbXLHEMVpHH6Sq3792xhITCx7WvOc=";

  nativeBuildInputs = [
    makeWrapper
@ -92,7 +92,7 @@ buildNpmPackage rec {
        $out/lib/node_modules/deltachat-desktop/html-dist/fonts
    done

-    makeWrapper ${electron_22}/bin/electron $out/bin/deltachat \
+    makeWrapper ${electron_26}/bin/electron $out/bin/deltachat \
      --set LD_PRELOAD ${sqlcipher}/lib/libsqlcipher${stdenv.hostPlatform.extensions.sharedLibrary} \
      --add-flags $out/lib/node_modules/deltachat-desktop

--- a/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/default.nix
@ -1,7 +1,7 @@
 { lib
 , newScope
 , pidgin
-, texlive
+, texliveBasic
 , config
 }:

@ -19,7 +19,7 @@ lib.makeScope newScope (self:
    pidgin-indicator = callPackage ./pidgin-indicator { };

    pidgin-latex = callPackage ./pidgin-latex {
-      texLive = texlive.combined.scheme-basic;
+      texLive = texliveBasic;
    };

    pidgin-msn-pecan = callPackage ./msn-pecan { };
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -19,18 +19,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "teams-for-linux";
-  version = "1.3.14";
+  version = "1.3.18";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = "teams-for-linux";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-2H7j8e2wPMd4cHXDKxSmyC2Ng/B3jb3/tGVTpUOU3XM=";
+    hash = "sha256-evOwjHUmeGw8AUpXSig8zVW2cpJbWkNTH/RUuNipFsQ=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-zB6H14VAf13pAHQmsWC51d/qqyfRmAEbltyLD5ucG4Y=";
+    hash = "sha256-tMC8/qHYli7+OTdxVWRDEyCNzrkYA+zKlHJXlTsl+W0=";
  };

  nativeBuildInputs = [ yarn fixup_yarn_lock nodejs copyDesktopItems makeWrapper ];
--- a/pkgs/applications/networking/p2p/pyrosimple/default.nix
+++ b/pkgs/applications/networking/p2p/pyrosimple/default.nix
@ -10,14 +10,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "pyrosimple";
-  version = "2.11.4";
+  version = "2.12.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "kannibalox";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-jzLckRFdjivWcyM3NWSVBauT5/7A1jTICtK2j65Wojo=";
+    hash = "sha256-6TDfNkEqtSrPpyExJ/68GAalIo9pSNiIDo7KdqwoulQ=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -1,58 +1,92 @@
-{ mkDerivation, lib, stdenv, fetchFromGitHub, pkg-config
-, boost, libtorrent-rasterbar, qtbase, qttools, qtsvg
-, debugSupport ? false
-, guiSupport ? true, dbus ? null # GUI (disable to run headless)
-, webuiSupport ? true # WebUI
-, trackerSearch ? true, python3 ? null
+{ lib
+, stdenv
+, fetchFromGitHub
+
+, boost
+, cmake
+, Cocoa
+, libtorrent-rasterbar
+, ninja
+, qtbase
+, qtsvg
+, qttools
+, wrapQtAppsHook
+
+, guiSupport ? true
+, dbus
+, qtwayland
+
+, trackerSearch ? true
+, python3
+
+, webuiSupport ? true
 }:

-assert guiSupport -> (dbus != null);
-assert trackerSearch -> (python3 != null);
-
-mkDerivation rec {
-  pname = "qbittorrent" + lib.optionalString (!guiSupport) "-nox";
-  version = "4.5.5";
+let
+  qtVersion = lib.versions.major qtbase.version;
+in
+stdenv.mkDerivation rec {
+  pname = "qbittorrent"
+    + lib.optionalString (guiSupport && qtVersion == "5") "-qt5"
+    + lib.optionalString (!guiSupport) "-nox";
+  version = "4.6.0";

  src = fetchFromGitHub {
    owner = "qbittorrent";
    repo = "qBittorrent";
    rev = "release-${version}";
-    hash = "sha256-rWv+KGw+3385GOKK4MvoSP0CepotUZELiDVFpyDf+9k=";
+    hash = "sha256-o9zMGjVCXLqdRdXzRs1kFPDMFJXQWBEtWwIfeIyFxJw=";
  };

-  enableParallelBuilding = true;
+  nativeBuildInputs = [
+    cmake
+    ninja
+    wrapQtAppsHook
+  ];

-  # NOTE: 2018-05-31: CMake is working but it is not officially supported
-  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    boost
+    libtorrent-rasterbar
+    qtbase
+    qtsvg
+    qttools
+  ] ++ lib.optionals stdenv.isDarwin [
+    Cocoa
+  ] ++ lib.optionals guiSupport [
+    dbus
+  ] ++ lib.optionals (guiSupport && stdenv.isLinux) [
+    qtwayland
+  ] ++ lib.optionals trackerSearch [
+    python3
+  ];

-  buildInputs = [ boost libtorrent-rasterbar qtbase qttools qtsvg ]
-    ++ lib.optional guiSupport dbus # D(esktop)-Bus depends on GUI support
-    ++ lib.optional trackerSearch python3;
+  cmakeFlags = lib.optionals (qtVersion == "6") [
+    "-DQT6=ON"
+  ] ++ lib.optionals (!guiSupport) [
+    "-DGUI=OFF"
+    "-DSYSTEMD=ON"
+    "-DSYSTEMD_SERVICES_INSTALL_DIR=${placeholder "out"}/lib/systemd/system"
+  ] ++ lib.optionals (!webuiSupport) [
+    "-DWEBUI=OFF"
+  ];

-  # Otherwise qm_gen.pri assumes lrelease-qt5, which does not exist.
-  QMAKE_LRELEASE = "lrelease";
-
-  configureFlags = [
-    "--with-boost-libdir=${boost.out}/lib"
-    "--with-boost=${boost.dev}" ]
-    ++ lib.optionals (!guiSupport) [ "--disable-gui" "--enable-systemd" ] # Also place qbittorrent-nox systemd service files
-    ++ lib.optional (!webuiSupport) "--disable-webui"
-    ++ lib.optional debugSupport "--enable-debug";
-
-  qtWrapperArgs = lib.optional trackerSearch "--prefix PATH : ${lib.makeBinPath [ python3 ]}";
+  qtWrapperArgs = lib.optionals trackerSearch [
+    "--prefix PATH : ${lib.makeBinPath [ python3 ]}"
+  ];

  postInstall = lib.optionalString stdenv.isDarwin ''
+    APP_NAME=qbittorrent${lib.optionalString (!guiSupport) "-nox"}
    mkdir -p $out/{Applications,bin}
-    cp -R src/${pname}.app $out/Applications
-    makeWrapper $out/{Applications/${pname}.app/Contents/MacOS,bin}/${pname}
+    cp -R $APP_NAME.app $out/Applications
+    makeWrapper $out/{Applications/$APP_NAME.app/Contents/MacOS,bin}/$APP_NAME
  '';

  meta = with lib; {
    description = "Featureful free software BitTorrent client";
-    homepage    = "https://www.qbittorrent.org/";
-    changelog   = "https://github.com/qbittorrent/qBittorrent/blob/release-${version}/Changelog";
-    license     = licenses.gpl2Plus;
-    platforms   = platforms.unix;
-    maintainers = with maintainers; [ Anton-Latukha kashw2 ];
+    homepage = "https://www.qbittorrent.org";
+    changelog = "https://github.com/qbittorrent/qBittorrent/blob/release-${version}/Changelog";
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ Anton-Latukha kashw2 paveloom ];
  };
 }
--- a/Show more
+++ b/Show more