Merge master into haskell-updates

.github/CODEOWNERS

@@ -61,7 +61,7 @@
 /pkgs/build-support/writers @lassulus @Profpatsch
 
 # Nixpkgs make-disk-image
-/doc/builders/images/makediskimage.section.md  @raitobezarius
+/doc/build-helpers/images/makediskimage.section.md  @raitobezarius
 /nixos/lib/make-disk-image.nix                 @raitobezarius
 
 # Nixpkgs documentation
@@ -219,7 +219,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/tests/knot.nix @mweinelt
 
 # Web servers
-/doc/builders/packages/nginx.section.md @raitobezarius
+/doc/packages/nginx.section.md @raitobezarius
 /pkgs/servers/http/nginx/ @raitobezarius
 /nixos/modules/services/web-servers/nginx/ @raitobezarius
 
@@ -272,7 +272,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 # Docker tools
 /pkgs/build-support/docker                   @roberth
 /nixos/tests/docker-tools*                   @roberth
-/doc/builders/images/dockertools.section.md  @roberth
+/doc/build-helpers/images/dockertools.section.md  @roberth
 
 # Blockchains
 /pkgs/applications/blockchains  @mmahut @RaghavSood

.github/workflows/backport.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
-        uses: korthout/backport-action@v2.0.0
+        uses: korthout/backport-action@v2.1.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'

doc/build-helpers.md

@@ -0,0 +1,28 @@
+# Build helpers {#part-builders}
+
+A build helper is a function that produces derivations.
+
+:::{.warning}
+This is not to be confused with the [`builder` argument of the Nix `derivation` primitive](https://nixos.org/manual/nix/unstable/language/derivations.html), which refers to the executable that produces the build result, or [remote builder](https://nixos.org/manual/nix/stable/advanced-topics/distributed-builds.html), which refers to a remote  machine that could run such an executable.
+:::
+
+Such a function is usually designed to abstract over a typical workflow for a given programming language or framework.
+This allows declaring a build recipe by setting a limited number of options relevant to the particular use case instead of using the `derivation` function directly.
+
+[`stdenv.mkDerivation`](#part-stdenv) is the most widely used build helper, and serves as a basis for many others.
+In addition, it offers various options to customize parts of the builds.
+
+There is no uniform interface for build helpers.
+[Trivial build helpers](#chap-trivial-builders) and [fetchers](#chap-pkgs-fetchers) have various input types for convenience.
+[Language- or framework-specific build helpers](#chap-language-support) usually follow the style of `stdenv.mkDerivation`, which accepts an attribute set or a fixed-point function taking an attribute set.
+
+```{=include=} chapters
+build-helpers/fetchers.chapter.md
+build-helpers/trivial-build-helpers.chapter.md
+build-helpers/testers.chapter.md
+build-helpers/special.md
+build-helpers/images.md
+hooks/index.md
+languages-frameworks/index.md
+packages/index.md
+```

doc/build-helpers/special.md

@@ -1,11 +1,10 @@
-# Special builders {#chap-special}
+# Special build helpers {#chap-special}
 
-This chapter describes several special builders.
+This chapter describes several special build helpers.
 
 ```{=include=} sections
 special/fhs-environments.section.md
 special/makesetuphook.section.md
 special/mkshell.section.md
-special/darwin-builder.section.md
 special/vm-tools.section.md
 ```

doc/build-helpers/special/makesetuphook.section.md

@@ -1,6 +1,6 @@
 # pkgs.makeSetupHook {#sec-pkgs.makeSetupHook}
 
-`pkgs.makeSetupHook` is a builder that produces hooks that go in to `nativeBuildInputs`
+`pkgs.makeSetupHook` is a build helper that produces hooks that go in to `nativeBuildInputs`
 
 ## Usage {#sec-pkgs.makeSetupHook-usage}
 

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -1,4 +1,4 @@
-# Trivial builders {#chap-trivial-builders}
+# Trivial build helpers {#chap-trivial-builders}
 
 Nixpkgs provides a couple of functions that help with building derivations. The most important one, `stdenv.mkDerivation`, has already been documented above. The following functions wrap `stdenv.mkDerivation`, making it easier to use in certain cases.
 

doc/builders.md

@@ -1,12 +0,0 @@
-# Builders {#part-builders}
-
-```{=include=} chapters
-builders/fetchers.chapter.md
-builders/trivial-builders.chapter.md
-builders/testers.chapter.md
-builders/special.md
-builders/images.md
-hooks/index.md
-languages-frameworks/index.md
-builders/packages/index.md
-```

doc/languages-frameworks/python.section.md

@@ -142,7 +142,7 @@ buildPythonPackage rec {
 
 The `buildPythonPackage` mainly does four things:
 
-* In the [`buildPhase`](#build-phase), it calls `${python.pythonForBuild.interpreter} setup.py bdist_wheel` to
+* In the [`buildPhase`](#build-phase), it calls `${python.pythonOnBuildForHost.interpreter} setup.py bdist_wheel` to
   build a wheel binary zipfile.
 * In the [`installPhase`](#ssec-install-phase), it installs the wheel file using `pip install *.whl`.
 * In the [`postFixup`](#var-stdenv-postFixup) phase, the `wrapPythonPrograms` bash function is called to
@@ -1682,7 +1682,7 @@ of such package using the feature is `pkgs/tools/X11/xpra/default.nix`.
 As workaround install it as an extra `preInstall` step:
 
 ```shell
-${python.pythonForBuild.interpreter} setup.py install_data --install-dir=$out --root=$out
+${python.pythonOnBuildForHost.interpreter} setup.py install_data --install-dir=$out --root=$out
 sed -i '/ = data\_files/d' setup.py
 ```
 

doc/languages-frameworks/texlive.section.md

@@ -2,6 +2,46 @@
 
 Since release 15.09 there is a new TeX Live packaging that lives entirely under attribute `texlive`.
 
+## User's guide (experimental new interface) {#sec-language-texlive-user-guide-experimental}
+
+Release 23.11 ships with a new interface that will eventually replace `texlive.combine`.
+
+- For basic usage, use some of the prebuilt environments available at the top level, such as `texliveBasic`, `texliveSmall`. For the full list of prebuilt environments, inspect `texlive.schemes`.
+
+- Packages cannot be used directly but must be assembled in an environment. To create or add packages to an environment, use
+  ```nix
+  texliveSmall.withPackages (ps: with ps; [ collection-langkorean algorithms cm-super ])
+  ```
+  The function `withPackages` can be called multiple times to add more packages.
+
+  - **Note.** Within Nixpkgs, packages should only use prebuilt environments as inputs, such as `texliveSmall` or `texliveInfraOnly`, and should not depend directly on `texlive`. Further dependencies should be added by calling `withPackages`. This is to ensure that there is a consistent and simple way to override the inputs.
+
+- `texlive.withPackages` uses the same logic as `buildEnv`. Only parts of a package are installed in an environment: its 'runtime' files (`tex` output), binaries (`out` output), and support files (`tlpkg` output). Moreover, man and info pages are assembled into separate `man` and `info` outputs. To add only the TeX files of a package, or its documentation (`texdoc` output), just specify the outputs:
+  ```nix
+  texlive.withPackages (ps: with ps; [
+    texdoc # recommended package to navigate the documentation
+    perlPackages.LaTeXML.tex # tex files of LaTeXML, omit binaries
+    cm-super
+    cm-super.texdoc # documentation of cm-super
+  ])
+  ```
+
+- All packages distributed by TeX Live, which contains most of CTAN, are available and can be found under `texlive.pkgs`:
+  ```ShellSession
+  $ nix repl
+  nix-repl> :l <nixpkgs>
+  nix-repl> texlive.pkgs.[TAB]
+  ```
+  Note that the packages in `texlive.pkgs` are only provided for search purposes and must not be used directly.
+
+- **Experimental and subject to change without notice:** to add the documentation for all packages in the environment, use
+  ```nix
+  texliveSmall.__overrideTeXConfig { withDocs = true; }
+  ```
+  This can be applied before or after calling `withPackages`.
+
+  The function currently support the parameters `withDocs`, `withSources`, and `requireTeXPackages`.
+
 ## User's guide {#sec-language-texlive-user-guide}
 
 - For basic usage just pull `texlive.combined.scheme-basic` for an environment with basic LaTeX support.

doc/manual.md.in

@@ -9,7 +9,7 @@ preface.chapter.md
 using-nixpkgs.md
 lib.md
 stdenv.md
-builders.md
+build-helpers.md
 development.md
 contributing.md
 ```

doc/packages/darwin-builder.section.md

@@ -1,10 +1,10 @@
 # darwin.linux-builder {#sec-darwin-builder}
 
-`darwin.linux-builder` provides a way to bootstrap a Linux builder on a macOS machine.
+`darwin.linux-builder` provides a way to bootstrap a Linux remote builder on a macOS machine.
 
 This requires macOS version 12.4 or later.
 
-The builder runs on host port 31022 by default.
+The remote builder runs on host port 31022 by default.
 You can change it by overriding `virtualisation.darwin-builder.hostPort`.
 See the [example](#sec-darwin-builder-example-flake).
 
@@ -15,7 +15,7 @@ words, your `/etc/nix/nix.conf` should have something like:
 extra-trusted-users = <your username goes here>
 ```
 
-To launch the builder, run the following flake:
+To launch the remote builder, run the following flake:
 
 ```ShellSession
 $ nix run nixpkgs#darwin.linux-builder
@@ -57,7 +57,7 @@ builders = ssh-ng://builder@linux-builder ${ARCH}-linux /etc/nix/builder_ed25519
 builders-use-substitutes = true
 ```
 
-To allow Nix to connect to a builder not running on port 22, you will also need to create a new file at `/etc/ssh/ssh_config.d/100-linux-builder.conf`:
+To allow Nix to connect to a remote builder not running on port 22, you will also need to create a new file at `/etc/ssh/ssh_config.d/100-linux-builder.conf`:
 
 ```
 Host linux-builder
@@ -130,11 +130,11 @@ $ sudo launchctl kickstart -k system/org.nixos.nix-daemon
 }
 ```
 
-## Reconfiguring the builder {#sec-darwin-builder-reconfiguring}
+## Reconfiguring the remote builder {#sec-darwin-builder-reconfiguring}
 
-Initially you should not change the builder configuration else you will not be
-able to use the binary cache. However, after you have the builder running locally
-you may use it to build a modified builder with additional storage or memory.
+Initially you should not change the remote builder configuration else you will not be
+able to use the binary cache. However, after you have the remote builder running locally
+you may use it to build a modified remote builder with additional storage or memory.
 
 To do this, you just need to set the `virtualisation.darwin-builder.*` parameters as
 in the example below and rebuild.

doc/packages/index.md

@@ -4,6 +4,7 @@ This chapter contains information about how to use and maintain the Nix expressi
 
 ```{=include=} sections
 citrix.section.md
+darwin-builder.section.md
 dlib.section.md
 eclipse.section.md
 elm.section.md

doc/stdenv/stdenv.chapter.md

@@ -528,7 +528,7 @@ If the returned array contains exactly one object (e.g. `[{}]`), all values are
 ```
 :::
 
-### Recursive attributes in `mkDerivation` {#mkderivation-recursive-attributes}
+### Fixed-point arguments of `mkDerivation` {#mkderivation-recursive-attributes}
 
 If you pass a function to `mkDerivation`, it will receive as its argument the final arguments, including the overrides when reinvoked via `overrideAttrs`. For example:
 

lib/strings.nix

@@ -144,6 +144,20 @@ rec {
   */
   concatLines = concatMapStrings (s: s + "\n");
 
+  /*
+    Replicate a string n times,
+    and concatenate the parts into a new string.
+
+    Type: replicate :: int -> string -> string
+
+    Example:
+      replicate 3 "v"
+      => "vvv"
+      replicate 5 "hello"
+      => "hellohellohellohellohello"
+  */
+  replicate = n: s: concatStrings (lib.lists.replicate n s);
+
   /* Construct a Unix-style, colon-separated search path consisting of
      the given `subDir` appended to each of the given paths.
 

lib/tests/misc.nix

@@ -191,6 +191,11 @@ runTests {
     expected = "a\nb\nc\n";
   };
 
+  testReplicateString = {
+    expr = strings.replicate 5 "hello";
+    expected = "hellohellohellohellohello";
+  };
+
   testSplitStringsSimple = {
     expr = strings.splitString "." "a.b.c.d";
     expected = [ "a" "b" "c" "d" ];

maintainers/maintainer-list.nix

@@ -540,6 +540,12 @@
     githubId = 732652;
     name = "Andreas Herrmann";
   };
+  ahoneybun = {
+    email = "aaron@system76.com";
+    github = "ahoneybun";
+    githubId = 4884946;
+    name = "Aaron Honeycutt";
+  };
   ahrzb = {
     email = "ahrzb5@gmail.com";
     github = "ahrzb";
@@ -4215,6 +4221,12 @@
     githubId = 12224254;
     name = "Delta";
   };
+  delta231 = {
+    email = "swstkbaranwal@gmail.com";
+    github = "Delta456";
+    githubId = 28479139;
+    name = "Swastik Baranwal";
+  };
   deltadelta = {
     email = "contact@libellules.eu";
     name = "Dara Ly";

nixos/lib/make-btrfs-fs.nix

@@ -15,6 +15,8 @@
 , volumeLabel
 , uuid ? "44444444-4444-4444-8888-888888888888"
 , btrfs-progs
+, libfaketime
+, fakeroot
 }:
 
 let
@@ -23,7 +25,7 @@ in
 pkgs.stdenv.mkDerivation {
   name = "btrfs-fs.img${lib.optionalString compressImage ".zst"}";
 
-  nativeBuildInputs = [ btrfs-progs ] ++ lib.optional compressImage zstd;
+  nativeBuildInputs = [ btrfs-progs libfaketime fakeroot ] ++ lib.optional compressImage zstd;
 
   buildCommand =
     ''
@@ -50,7 +52,7 @@ pkgs.stdenv.mkDerivation {
       cp ${sdClosureInfo}/registration ./rootImage/nix-path-registration
 
       touch $img
-      mkfs.btrfs -L ${volumeLabel} -U ${uuid} -r ./rootImage --shrink $img
+      faketime -f "1970-01-01 00:00:01" fakeroot mkfs.btrfs -L ${volumeLabel} -U ${uuid} -r ./rootImage --shrink $img
 
       if ! btrfs check $img; then
         echo "--- 'btrfs check' failed for BTRFS image ---"

nixos/lib/testing/nodes.nix

@@ -32,9 +32,6 @@ let
             key = "nodes.nix-pkgs";
             config = optionalAttrs (!config.node.pkgsReadOnly) (
               mkIf (!options.nixpkgs.pkgs.isDefined) {
-                # Ensure we do not use aliases. Ideally this is only set
-                # when the test framework is used by Nixpkgs NixOS tests.
-                nixpkgs.config.allowAliases = false;
                 # TODO: switch to nixpkgs.hostPlatform and make sure containers-imperative test still evaluates.
                 nixpkgs.system = hostPkgs.stdenv.hostPlatform.system;
               }

nixos/modules/hardware/all-firmware.nix

@@ -18,29 +18,16 @@ in {
 
   options = {
 
-    hardware.enableAllFirmware = mkOption {
-      default = false;
-      type = types.bool;
-      description = lib.mdDoc ''
-        Turn on this option if you want to enable all the firmware.
-      '';
-    };
+    hardware.enableAllFirmware = mkEnableOption "all firmware regardless of license";
 
-    hardware.enableRedistributableFirmware = mkOption {
+    hardware.enableRedistributableFirmware = mkEnableOption "firmware with a license allowing redistribution" // {
       default = config.hardware.enableAllFirmware;
       defaultText = lib.literalExpression "config.hardware.enableAllFirmware";
-      type = types.bool;
-      description = lib.mdDoc ''
-        Turn on this option if you want to enable all the firmware with a license allowing redistribution.
-      '';
     };
 
-    hardware.wirelessRegulatoryDatabase = mkOption {
-      default = false;
-      type = types.bool;
-      description = lib.mdDoc ''
-        Load the wireless regulatory database at boot.
-      '';
+    hardware.wirelessRegulatoryDatabase = mkEnableOption "loading the wireless regulatory database at boot" // {
+      default = cfg.enableRedistributableFirmware || cfg.enableAllFirmware;
+      defaultText = literalMD "Enabled if proprietary firmware is allowed via {option}`enableRedistributableFirmware` or {option}`enableAllFirmware`.";
     };
 
   };
@@ -65,7 +52,6 @@ in {
         ++ optionals (versionOlder config.boot.kernelPackages.kernel.version "4.13") [
         rtl8723bs-firmware
       ];
-      hardware.wirelessRegulatoryDatabase = true;
     })
     (mkIf cfg.enableAllFirmware {
       assertions = [{

nixos/modules/programs/fish.nix

@@ -268,7 +268,7 @@ in
             ''
               mkdir -p $out
               if [ -d $package/share/man ]; then
-                find $package/share/man -type f | xargs ${pkgs.python3.pythonForBuild.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
+                find $package/share/man -type f | xargs ${pkgs.python3.pythonOnBuildForHost.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
               fi
             '';
         in

nixos/modules/services/backup/restic.nix

@@ -345,7 +345,7 @@ in
             } // optionalAttrs (backup.environmentFile != null) {
               EnvironmentFile = backup.environmentFile;
             };
-          } // optionalAttrs (backup.initialize || backup.dynamicFilesFrom != null || backup.backupPrepareCommand != null) {
+          } // optionalAttrs (backup.initialize || doBackup || backup.backupPrepareCommand != null) {
             preStart = ''
               ${optionalString (backup.backupPrepareCommand != null) ''
                 ${pkgs.writeScript "backupPrepareCommand" backup.backupPrepareCommand}
@@ -360,12 +360,12 @@ in
                 ${pkgs.writeScript "dynamicFilesFromScript" backup.dynamicFilesFrom} >> ${filesFromTmpFile}
               ''}
             '';
-          } // optionalAttrs (backup.dynamicFilesFrom != null || backup.backupCleanupCommand != null) {
+          } // optionalAttrs (doBackup || backup.backupCleanupCommand != null) {
             postStop = ''
               ${optionalString (backup.backupCleanupCommand != null) ''
                 ${pkgs.writeScript "backupCleanupCommand" backup.backupCleanupCommand}
               ''}
-              ${optionalString (backup.dynamicFilesFrom != null) ''
+              ${optionalString doBackup ''
                 rm ${filesFromTmpFile}
               ''}
             '';

nixos/modules/services/monitoring/smartd.nix

@@ -19,7 +19,7 @@ let
       {
       ${pkgs.coreutils}/bin/cat << EOF
       From: smartd on ${host} <${nm.sender}>
-      To: undisclosed-recipients:;
+      To: ${nm.recipient}
       Subject: $SMARTD_SUBJECT
 
       $SMARTD_FULLMESSAGE

nixos/modules/system/boot/systemd/journald.nix

@@ -28,6 +28,15 @@ in {
       '';
     };
 
+    services.journald.storage = mkOption {
+      default = "persistent";
+      type = types.enum [ "persistent" "volatile" "auto" "none" ];
+      description = mdDoc ''
+        Controls where to store journal data. See
+        {manpage}`journald.conf(5)` for further information.
+      '';
+    };
+
     services.journald.rateLimitBurst = mkOption {
       default = 10000;
       type = types.int;
@@ -100,7 +109,7 @@ in {
     environment.etc = {
       "systemd/journald.conf".text = ''
         [Journal]
-        Storage=persistent
+        Storage=${cfg.storage}
         RateLimitInterval=${cfg.rateLimitInterval}
         RateLimitBurst=${toString cfg.rateLimitBurst}
         ${optionalString (cfg.console != "") ''

nixos/modules/virtualisation/oci-containers.nix

@@ -252,11 +252,10 @@ let
       text = ''
         ${cfg.backend} rm -f ${name} || true
         ${optionalString (isValidLogin container.login) ''
-          cat ${container.login.passwordFile} | \
           ${cfg.backend} login \
           ${container.login.registry} \
           --username ${container.login.username} \
-          --password-stdin
+          --password-stdin < ${container.login.passwordFile}
         ''}
         ${optionalString (container.imageFile != null) ''
           ${cfg.backend} load -i ${container.imageFile}

nixos/tests/gitea.nix

@@ -26,7 +26,7 @@ let
   supportedDbTypes = [ "mysql" "postgres" "sqlite3" ];
   makeGiteaTest = type: nameValuePair type (makeTest {
     name = "${giteaPackage.pname}-${type}";
-    meta.maintainers = with maintainers; [ aanderse emilylange kolaente ma27 ];
+    meta.maintainers = with maintainers; [ aanderse kolaente ma27 ];
 
     nodes = {
       server = { config, pkgs, ... }: {

nixos/tests/mobilizon.nix

@@ -10,7 +10,7 @@ import ./make-test-python.nix ({ lib, ... }:
     meta.maintainers = with lib.maintainers; [ minijackson erictapen ];
 
     nodes.server =
-      { ... }:
+      { pkgs, ... }:
       {
         services.mobilizon = {
           enable = true;
@@ -25,6 +25,8 @@ import ./make-test-python.nix ({ lib, ... }:
           };
         };
 
+        services.postgresql.package = pkgs.postgresql_14;
+
         security.pki.certificateFiles = [ certs.ca.cert ];
 
         services.nginx.virtualHosts."${mobilizonDomain}" = {

nixos/tests/openssh.nix

@@ -103,7 +103,12 @@ in {
   testScript = ''
     start_all()
 
-    server.wait_for_unit("sshd")
+    server.wait_for_unit("sshd", timeout=30)
+    server_localhost_only.wait_for_unit("sshd", timeout=30)
+    server_match_rule.wait_for_unit("sshd", timeout=30)
+
+    server_lazy.wait_for_unit("sshd.socket", timeout=30)
+    server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=30)
 
     with subtest("manual-authkey"):
         client.succeed("mkdir -m 700 /root/.ssh")

nixos/tests/restic.nix

@@ -4,6 +4,7 @@ import ./make-test-python.nix (
   let
     remoteRepository = "/root/restic-backup";
     remoteFromFileRepository = "/root/restic-backup-from-file";
+    remoteNoInitRepository = "/root/restic-backup-no-init";
     rcloneRepository = "rclone:local:/root/restic-rclone-backup";
 
     backupPrepareCommand = ''
@@ -64,6 +65,11 @@ import ./make-test-python.nix (
                 find /opt -mindepth 1 -maxdepth 1 ! -name a_dir # all files in /opt except for a_dir
               '';
             };
+            remote-noinit-backup = {
+              inherit passwordFile exclude pruneOpts paths;
+              initialize = false;
+              repository = remoteNoInitRepository;
+            };
             rclonebackup = {
               inherit passwordFile paths exclude pruneOpts;
               initialize = true;
@@ -114,6 +120,7 @@ import ./make-test-python.nix (
           "cp -rT ${testDir} /opt",
           "touch /opt/excluded_file_1 /opt/excluded_file_2",
           "mkdir -p /root/restic-rclone-backup",
+          "restic-remote-noinit-backup init",
 
           # test that remotebackup runs custom commands and produces a snapshot
           "timedatectl set-time '2016-12-13 13:45'",
@@ -130,6 +137,10 @@ import ./make-test-python.nix (
           "systemctl start restic-backups-remote-from-file-backup.service",
           'restic-remote-from-file-backup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
 
+          # test that remote-noinit-backup produces a snapshot
+          "systemctl start restic-backups-remote-noinit-backup.service",
+          'restic-remote-noinit-backup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+
           # test that restoring that snapshot produces the same directory
           "mkdir /tmp/restore-2",
           "${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} restore latest -t /tmp/restore-2",

nixos/tests/shattered-pixel-dungeon.nix

@@ -21,9 +21,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
       machine.wait_for_x()
       machine.execute("shattered-pixel-dungeon >&2 &")
       machine.wait_for_window(r"Shattered Pixel Dungeon")
-      machine.sleep(5)
-      if "Enter" not in machine.get_screen_text():
-          raise Exception("Program did not start successfully")
+      machine.wait_for_text("Enter")
       machine.screenshot("screen")
     '';
 })

nixos/tests/vaultwarden.nix

@@ -54,9 +54,8 @@ let
             services.postgresql = {
               enable = true;
               initialScript = pkgs.writeText "postgresql-init.sql" ''
-                CREATE DATABASE bitwarden;
                 CREATE USER bitwardenuser WITH PASSWORD '${dbPassword}';
-                GRANT ALL PRIVILEGES ON DATABASE bitwarden TO bitwardenuser;
+                CREATE DATABASE bitwarden WITH OWNER bitwardenuser;
               '';
             };
 

pkgs/applications/audio/mopidy/spotify.nix

@@ -1,14 +1,14 @@
-{ lib, fetchFromGitHub, pythonPackages, mopidy }:
+{ lib, fetchFromGitHub, pythonPackages, mopidy, unstableGitUpdater }:
 
 pythonPackages.buildPythonApplication rec {
   pname = "mopidy-spotify";
-  version = "unstable-2023-04-21";
+  version = "unstable-2023-11-01";
 
   src = fetchFromGitHub {
     owner = "mopidy";
     repo = "mopidy-spotify";
-    rev = "984151ac96c5f9c35892055bff20cc11f46092d5";
-    hash = "sha256-4e9Aj0AOFR4/FK54gr1ZyPt0nYZDMrMetV4FPtBxapU=";
+    rev = "48faaaa2642647b0152231798b46ccd9631694f5";
+    hash = "sha256-RwkUdcbDU7/ndVnPteG/iXB2dloljvCHQlvPk4tacuA=";
   };
 
   propagatedBuildInputs = [
@@ -22,6 +22,8 @@ pythonPackages.buildPythonApplication rec {
 
   pythonImportsCheck = [ "mopidy_spotify" ];
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with lib; {
     homepage = "https://github.com/mopidy/mopidy-spotify";
     description = "Mopidy extension for playing music from Spotify";

pkgs/applications/editors/cosmic-edit/default.nix

@@ -0,0 +1,80 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rust
+, rustPlatform
+, cmake
+, makeWrapper
+, cosmic-icons
+, just
+, pkg-config
+, libxkbcommon
+, glib
+, gtk3
+, libinput
+, fontconfig
+, freetype
+, wayland
+, expat
+, udev
+, which
+, lld
+, util-linuxMinimal
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-edit";
+  version = "unstable-2023-11-02";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-edit";
+    rev = "ee2dea71e6e21967bc705046f9650407d07cdada";
+    sha256 = "sha256-27j9Imlyzwy2yjpNsWWcX0qW38ZxMDkht1Eaggr4NYY=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "cosmic-config-0.1.0" = "sha256-VKvJ7cNwMLLs6ElpgP6xwsBUnD5MDApwWl7rrb/Lr/U=";
+      "cosmic-text-0.10.0" = "sha256-g9y2qZ2ivpDtZAtsXqMXgGjUFi9QZx/weMhk7hmnB3E=";
+      "sctk-adwaita-0.5.4" = "sha256-yK0F2w/0nxyKrSiHZbx7+aPNY2vlFs7s8nu/COp2KqQ=";
+      "smithay-client-toolkit-0.16.1" = "sha256-z7EZThbh7YmKzAACv181zaEZmWxTrMkFRzP0nfsHK6c=";
+      "softbuffer-0.2.0" = "sha256-VD2GmxC58z7Qfu/L+sfENE+T8L40mvUKKSfgLmCTmjY=";
+      "taffy-0.3.11" = "sha256-0hXOEj6IjSW8e1t+rvxBFX6V9XRum3QO2Des1XlHJEw=";
+      "winit-0.28.6" = "sha256-FhW6d2XnXCGJUMoT9EMQew9/OPXiehy/JraeCiVd76M=";
+    };
+  };
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ cmake just pkg-config which lld util-linuxMinimal makeWrapper ];
+  buildInputs = [ libxkbcommon libinput fontconfig freetype wayland expat udev glib gtk3 ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${rust.lib.toRustTargetSpecShort stdenv.hostPlatform}/release/cosmic-edit"
+  ];
+
+ postInstall = ''
+    wrapProgram "$out/bin/${pname}" \
+      --suffix XDG_DATA_DIRS : "${cosmic-icons}/share"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-edit";
+    description = "Text Editor for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ahoneybun ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/file-managers/felix-fm/default.nix

@@ -3,6 +3,8 @@
 , fetchFromGitHub
 , pkg-config
 , bzip2
+, libgit2
+, zlib
 , zstd
 , zoxide
 }:
@@ -24,11 +26,17 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     bzip2
+    libgit2
+    zlib
     zstd
   ];
 
   nativeCheckInputs = [ zoxide ];
 
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
   buildFeatures = [ "zstd/pkg-config" ];
 
   checkFlags = [
@@ -37,11 +45,6 @@ rustPlatform.buildRustPackage rec {
     "--skip=state::tests::test_has_write_permission"
   ];
 
-  # Cargo.lock is outdated
-  postConfigure = ''
-    cargo metadata --offline
-  '';
-
   meta = with lib; {
     description = "A tui file manager with vim-like key mapping";
     homepage = "https://github.com/kyoheiu/felix";

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -76,14 +76,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.28.11";
+  version = "3.28.12";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-3yV47GlIhYGR7+ZlPLQw1vy1x8xuJd5erUJO3Pw7L+g=";
+    hash = "sha256-C80ZrQW7WFXz8UMXSt3FJcK2gDd292H24Ic3pJD/yqI=";
   };
 
   passthru = {

pkgs/applications/misc/calibre/default.nix

@@ -148,7 +148,7 @@ stdenv.mkDerivation (finalAttrs: {
     export XDG_DATA_HOME=$out/share
     export XDG_UTILS_INSTALL_MODE="user"
 
-    ${python3Packages.python.pythonForBuild.interpreter} setup.py install --root=$out \
+    ${python3Packages.python.pythonOnBuildForHost.interpreter} setup.py install --root=$out \
       --prefix=$out \
       --libdir=$out/lib \
       --staging-root=$out \

pkgs/applications/misc/kbt/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kbt";
-  version = "1.2.3";
+  version = "2.0.6";
 
   src = fetchFromGitHub {
     owner = "bloznelis";
     repo = "kbt";
     rev = version;
-    hash = "sha256-AhMl8UuSVKLiIj+EnnmJX8iURjytLByDRLqDkgHGBr0=";
+    hash = "sha256-G5/Sb/suTUkpR6OGlOawLVGLTthcrp78Y+5mxlndfA4=";
   };
 
-  cargoHash = "sha256-pgdI+BoYrdSdQpVN0pH4QMcNAKbjbnrUbAmMpmtfd2s=";
+  cargoHash = "sha256-7P93mttZ9W76lpGPKN33cgr4nEaHRlDQWov+TUbDHkM=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
     pkg-config

pkgs/applications/misc/lunatask/default.nix

@@ -1,19 +1,20 @@
 { lib, appimageTools, fetchurl }:
 
 let
-  version = "1.7.7";
+  version = "1.7.8";
   pname = "lunatask";
 
   src = fetchurl {
     url = "https://lunatask.app/download/Lunatask-${version}.AppImage";
-    sha256 = "sha256-3WiJR+gwudeLs6Mn75SJP4BZ6utwxvvRLOHe/W+1Pfs=";
+    sha256 = "sha256-DhTWD9uL7zKWiRfeLYKxPtmAy1yR20wjlVA+N33YgpQ=";
   };
 
   appimageContents = appimageTools.extractType2 {
     inherit pname version src;
   };
 
-in appimageTools.wrapType2 rec {
+in
+appimageTools.wrapType2 rec {
   inherit pname version src;
 
   extraInstallCommands = ''

pkgs/applications/misc/redshift/default.nix

@@ -43,7 +43,7 @@ let
         "--enable-quartz=${if withQuartz then "yes" else "no"}"
         "--enable-corelocation=${if withCoreLocation then "yes" else "no"}"
       ] ++ lib.optionals (pname == "gammastep") [
-        "--with-systemduserunitdir=${placeholder "out"}/share/systemd/user/"
+        "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user/"
         "--enable-apparmor"
       ];
 
@@ -117,6 +117,7 @@ rec {
       license = licenses.gpl3Plus;
       homepage = "http://jonls.dk/redshift";
       platforms = platforms.unix;
+      mainProgram = "redshift";
       maintainers = with maintainers; [ yana ];
     };
   };
@@ -137,7 +138,8 @@ rec {
       longDescription = "Gammastep"
         + lib.removePrefix "Redshift" redshift.meta.longDescription;
       homepage = "https://gitlab.com/chinstrap/gammastep";
-      maintainers = [ lib.maintainers.primeos ] ++ redshift.meta.maintainers;
+      mainProgram = "gammastep";
+      maintainers = (with lib.maintainers; [ eclairevoyant primeos ]) ++ redshift.meta.maintainers;
     };
   };
 }

pkgs/applications/misc/rofi/wayland.nix

@@ -26,6 +26,7 @@ rofi-unwrapped.overrideAttrs (oldAttrs: rec {
     description = "Window switcher, run dialog and dmenu replacement for Wayland";
     homepage = "https://github.com/lbonn/rofi";
     license = licenses.mit;
+    mainProgram = "rofi";
     maintainers = with maintainers; [ bew ];
     platforms = with platforms; linux;
   };

pkgs/applications/misc/spicetify-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.25.2";
+  version = "2.26.0";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "spicetify-cli";
     rev = "v${version}";
-    hash = "sha256-llPxR4awKBBv0jiLr5MbE33D5KZx3LmBo5BDwZI8ZM0=";
+    hash = "sha256-3u55Pcd4VNgWGyu/IVsrMqm8E4H9y4Bvt3JMyIL/KXo=";
   };
 
   vendorHash = "sha256-VktAO3yKCdm5yz/RRLeLv6zzyGrwuHC/i8WdJtqZoYc=";

pkgs/applications/misc/tandoor-recipes/default.nix

@@ -113,8 +113,8 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
     touch cookbook/static/themes/bootstrap.min.css.map
     touch cookbook/static/css/bootstrap-vue.min.css.map
 
-    ${python.pythonForBuild.interpreter} manage.py collectstatic_js_reverse
-    ${python.pythonForBuild.interpreter} manage.py collectstatic
+    ${python.pythonOnBuildForHost.interpreter} manage.py collectstatic_js_reverse
+    ${python.pythonOnBuildForHost.interpreter} manage.py collectstatic
 
     runHook postBuild
   '';

pkgs/applications/misc/tippecanoe/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tippecanoe";
-  version = "2.19.0";
+  version = "2.35.0";
 
   src = fetchFromGitHub {
     owner = "felt";
     repo = "tippecanoe";
     rev = finalAttrs.version;
-    hash = "sha256-FWdAMIAoj3/+SQLIan++UpmWH1o3v92FsDw//b5RorM=";
+    hash = "sha256-l19p/Ql1gaNJpmDH46jwLgUUmJ5YTYRQi6DdayAd84Q=";
   };
 
   buildInputs = [ sqlite zlib ];
@@ -17,7 +17,9 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [ "PREFIX=$(out)" ];
 
   enableParallelBuilding = true;
-  doCheck = true;
+
+  # https://github.com/felt/tippecanoe/issues/148
+  doCheck = false;
 
   passthru.tests.version = testers.testVersion {
     package = finalAttrs.finalPackage;

pkgs/applications/misc/zathura/core/default.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
-    meson ninja pkg-config desktop-file-utils python3.pythonForBuild.pkgs.sphinx
+    meson ninja pkg-config desktop-file-utils python3.pythonOnBuildForHost.pkgs.sphinx
     gettext wrapGAppsHook libxml2 appstream-glib
   ];
 

pkgs/applications/networking/browsers/chromium/common.nix

@@ -62,7 +62,7 @@
 buildFun:
 
 let
-  python3WithPackages = python3.pythonForBuild.withPackages(ps: with ps; [
+  python3WithPackages = python3.pythonOnBuildForHost.withPackages(ps: with ps; [
     ply jinja2 setuptools
   ]);
   clangFormatPython3 = fetchurl {
@@ -437,7 +437,7 @@ let
 
       # This is to ensure expansion of $out.
       libExecPath="${libExecPath}"
-      ${python3.pythonForBuild}/bin/python3 build/linux/unbundle/replace_gn_files.py --system-libraries ${toString gnSystemLibraries}
+      ${python3.pythonOnBuildForHost}/bin/python3 build/linux/unbundle/replace_gn_files.py --system-libraries ${toString gnSystemLibraries}
       ${gnChromium}/bin/gn gen --args=${lib.escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
 
       # Fail if `gn gen` contains a WARNING.

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -3,10 +3,10 @@
 {
   firefox = buildMozillaMach rec {
     pname = "firefox";
-    version = "119.0";
+    version = "119.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "4b555c444add36567fd538752b122f227cf78bb70b72c79e6d8ae8d9c2e61c3cdacfae79c37970753b8b5c7716b28c686071eb7b551773c30a76852f3550676c";
+      sha512 = "4f3201aee10e7b831cc384b2c7430a24f4de81f703115a917f9eb7acecb2ae1725f11af56c41257a056bb9d7a4d749d590cc9baffcd6e13852be45aaecf8163a";
     };
 
     meta = {

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -10,9 +10,9 @@
 , qtwebengine
 , enableWideVine ? false
 , widevine-cdm
-, enableVulkan ? stdenv.isLinux
+# can cause issues on some graphics chips
+, enableVulkan ? false
 , vulkan-loader
-, buildPackages
 }:
 
 let
@@ -56,10 +56,7 @@ python3.pkgs.buildPythonApplication {
     # scripts and userscripts libs
     tldextract beautifulsoup4
     readability-lxml pykeepass
-  ] ++ lib.optionals ((builtins.tryEval stem.outPath).success) [
-    # error: stem-1.8.2 not supported for interpreter python3.11
     stem
-  ] ++ [
     pynacl
     # extensive ad blocking
     adblock
@@ -86,7 +83,7 @@ python3.pkgs.buildPythonApplication {
     runHook preInstall
 
     make -f misc/Makefile \
-      PYTHON=${buildPackages.python3}/bin/python3 \
+      PYTHON=${python3.pythonOnBuildForHost.interpreter} \
       PREFIX=. \
       DESTDIR="$out" \
       DATAROOTDIR=/share \
@@ -125,8 +122,10 @@ python3.pkgs.buildPythonApplication {
 
   meta = with lib; {
     homepage    = "https://github.com/qutebrowser/qutebrowser";
+    changelog   = "https://github.com/qutebrowser/qutebrowser/blob/v${version}/doc/changelog.asciidoc";
     description = "Keyboard-focused browser with a minimal GUI";
     license     = licenses.gpl3Plus;
+    mainProgram = "qutebrowser";
     platforms   = if enableWideVine then [ "x86_64-linux" ] else qtwebengine.meta.platforms;
     maintainers = with maintainers; [ jagajaga rnhmjoj ebzzry dotlambda nrdxp ];
   };

pkgs/applications/networking/cloudflared/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2023.8.2";
+  version = "2023.10.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     rev = "refs/tags/${version}";
-    hash = "sha256-8khwpGOBSpbAHnKeKFZUrJoE0dgQB3bN6Y/W2gwRfCM=";
+    hash = "sha256-T+hxNvsckL8PAVb4GjXhnkVi3rXMErTjRgGxCUypwVA=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/docker-machine/hyperkit.nix

@@ -18,6 +18,6 @@ buildGoModule rec {
     description = "HyperKit driver for docker-machine";
     license = licenses.asl20;
     maintainers = with maintainers; [ atkinschang ];
-    platforms = platforms.darwin;
+    platforms = [ "x86_64-darwin" ];
   };
 }

pkgs/applications/networking/cluster/hubble/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hubble";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YJrL4fLJnTkfzZQp4MzPZL8ZZOGhFbHUzOpvaA5JrOA=";
+    sha256 = "sha256-nnW0dLFPHex4fYJeBPFy8SP7Uc6cs5eN+dv0kIfCUYs=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/k9s/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.27.4";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner  = "derailed";
     repo   = "k9s";
     rev    = "v${version}";
-    sha256 = "sha256-SMdpjeMerIEc0oeNe0SfZyc3yQTq6eif1fDLICNceKY=";
+    sha256 = "sha256-qFZLl37Y9g9LMRnWacwz46cgjVreLg2WyWZrSj3T4ok=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   tags = [ "netgo" ];
 
-  vendorHash = "sha256-wh4WjfDBX9xdtF9fBjSLPBbqb6k8H/LpWO9eTn86le4=";
+  vendorHash = "sha256-TfU1IzTdrWQpK/YjQQImRGeo7byaXUI182xSed+21PU=";
 
   # TODO investigate why some config tests are failing
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);

pkgs/applications/networking/deck/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "deck";
-  version = "1.27.1";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "Kong";
     repo = "deck";
     rev = "v${version}";
-    hash = "sha256-9eMcbmRCr92ebJsPTyDFnwGn3gsRpR7aAkzV6Qfntgo=";
+    hash = "sha256-glCZdaIsV8bim3iQuFKlIVmDm/YhDohVC6wIYvQuJAM=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -21,7 +21,7 @@ buildGoModule rec {
   ];
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-ikgD17+lnKpxCzrIkOXOq332X48qEdSWXIIRoq76fB4=";
+  vendorHash = "sha256-tDaFceewyNW19HMmfdDC2qL12hUCw5TUa3TX5TXfvVo=";
 
   postInstall = ''
     installShellCompletion --cmd deck \

pkgs/applications/networking/flent/default.nix

@@ -34,7 +34,7 @@ buildPythonApplication rec {
 
     cat >test-runner <<EOF
     #!/bin/sh
-    ${python.pythonForBuild.interpreter} nix_run_setup test
+    ${python.pythonOnBuildForHost.interpreter} nix_run_setup test
     EOF
     chmod +x test-runner
     wrapQtApp test-runner --prefix PYTHONPATH : $PYTHONPATH

pkgs/applications/networking/geph/default.nix

@@ -2,19 +2,23 @@
 , stdenvNoCC
 , rustPlatform
 , fetchFromGitHub
-, buildNpmPackage
+, buildGoModule
+, makeWrapper
+, nodePackages
+, esbuild
+, jq
+, moreutils
 , perl
 , pkg-config
 , glib
 , webkitgtk
-, libappindicator-gtk3
 , libayatana-appindicator
 , cairo
 , openssl
 }:
 
 let
-  version = "4.7.8";
+  version = "4.10.1";
   geph-meta = with lib; {
     description = "A modular Internet censorship circumvention system designed specifically to deal with national filtering.";
     homepage = "https://geph.io";
@@ -31,10 +35,10 @@ in
       owner = "geph-official";
       repo = pname;
       rev = "v${version}";
-      hash = "sha256-DVGbLyFgraQMSIUAqDehF8DqbnvcaeWbuLVgiSQY3KE=";
+      hash = "sha256-e0Pdg4pQ5s1wvTnFm1rKuAwkYtCtu2Uacd7yH3EHeCo=";
     };
 
-    cargoHash = "sha256-uBq6rjUnKEscwhu60HEZffLvuXcArz+AiR52org+qKw=";
+    cargoHash = "sha256-Kwc+EOH2pJJVvIcTUfL39Xrv/7YmTPUDge7mmjDs9pQ=";
 
     nativeBuildInputs = [ perl ];
 
@@ -50,52 +54,91 @@ in
     src = fetchFromGitHub {
       owner = "geph-official";
       repo = "gephgui-pkg";
-      rev = "85a55bfc2f4314d9c49608f252080696b1f8e2a9";
-      hash = "sha256-id/sfaQsF480kUXg//O5rBIciuuhDuXY19FQe1E3OQs=";
+      rev = "4163e12188dd679ba548e127fc9771cb5e87bab0";
+      hash = "sha256-wBvhfgp5sZTRCBR9HZqs1G0VaIt9DW2e9CWMAp/T5WI=";
       fetchSubmodules = true;
     };
 
-    gephgui = buildNpmPackage {
-      pname = "gephgui";
-      inherit version src;
+    pnpm-deps = stdenvNoCC.mkDerivation {
+      pname = "${pname}-pnpm-deps";
+      inherit src version;
 
-      sourceRoot = "${src.name}/gephgui-wry/gephgui";
+      sourceRoot = "source/gephgui-wry/gephgui";
 
-      postPatch = "ln -s ${./package-lock.json} ./package-lock.json";
-
-      npmDepsHash = "sha256-5y6zpMF4M56DiWVhMvjJGsYpVdlJSoWoWyPgLc7hJoo=";
+      nativeBuildInputs = [
+        jq
+        moreutils
+        nodePackages.pnpm
+      ];
 
       installPhase = ''
-        runHook preInstall
+        export HOME=$(mktemp -d)
+        pnpm config set store-dir $out
+        pnpm install --ignore-scripts
 
-        mkdir -p $out
-        mv dist $out
-
-        runHook postInstall
+        # Remove timestamp and sort the json files
+        rm -rf $out/v3/tmp
+        for f in $(find $out -name "*.json"); do
+          sed -i -E -e 's/"checkedAt":[0-9]+,//g' $f
+          jq --sort-keys . $f | sponge $f
+        done
       '';
+
+      dontFixup = true;
+      outputHashMode = "recursive";
+      outputHash = "sha256-OKPx5xRI7DWd6m31nYx1biP0k6pcZ7fq7dfVlHda4O0=";
     };
 
-    gephgui-wry = rustPlatform.buildRustPackage rec {
+    gephgui-wry = rustPlatform.buildRustPackage {
       pname = "gephgui-wry";
       inherit version src;
 
-      sourceRoot = "${src.name}/gephgui-wry";
+      sourceRoot = "source/gephgui-wry";
 
-      cargoHash = "sha256-lidlUUfHXKPUlICdaVv/SFlyyWsZ7cYHyTJ3kkMn3L4=";
+      cargoLock = {
+        lockFile = ./Cargo.lock;
+        outputHashes = {
+          "tao-0.5.2" = "sha256-HyQyPRoAHUcgtYgaAW7uqrwEMQ45V+xVSxmlAZJfhv0=";
+          "wry-0.12.2" = "sha256-kTMXvignEF3FlzL0iSlF6zn1YTOCpyRUDN8EHpUS+yI=";
+        };
+      };
 
-      nativeBuildInputs = [ pkg-config ];
+      nativeBuildInputs = [
+        pkg-config
+        nodePackages.pnpm
+        makeWrapper
+      ];
 
       buildInputs = [
         glib
         webkitgtk
-        libappindicator-gtk3
         libayatana-appindicator
         cairo
         openssl
       ];
 
+      ESBUILD_BINARY_PATH = "${lib.getExe (esbuild.override {
+        buildGoModule = args: buildGoModule (args // rec {
+          version = "0.15.10";
+          src = fetchFromGitHub {
+            owner = "evanw";
+            repo = "esbuild";
+            rev = "v${version}";
+            hash = "sha256-DebmLtgPrla+1UcvOHMnWmxa/ZqrugeRRKXIiJ9LYDk=";
+          };
+          vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
+        });
+      })}";
+
       preBuild = ''
-        ln -s ${gephgui}/dist ./gephgui
+        cd gephgui
+        export HOME=$(mktemp -d)
+        pnpm config set store-dir ${pnpm-deps}
+        pnpm install --ignore-scripts --offline
+        chmod -R +w node_modules
+        pnpm rebuild
+        pnpm build
+        cd ..
       '';
     };
 

pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix

@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-1QNhNPa6ZKn0lGQXs/cmfdSFHscwlYwFC/2DpnMoHvY=";
   };
 
-  nativeBuildInputs = with python3.pythonForBuild.pkgs; [
+  nativeBuildInputs = with python3.pythonOnBuildForHost.pkgs; [
     setuptools
     setuptools-scm
   ];

pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix

@@ -2,13 +2,13 @@
 
 (if stdenv.isDarwin then darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv).mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20231030-1";
+  version = "20231106-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-xY5UpM1vYAL2hZUkh5O4Z6zJ5HVxXTtvDlXedlsU820=";
+    hash = "sha256-alQOYh1I4t1OppHbjsbDK6wc599Z0uDAyQjCtKM72ak=";
   };
 
   postPatch = ''

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix

@@ -53,7 +53,6 @@
 , libthai
 , libdatrie
 , xdg-utils
-, xorg
 , libsysprof-capture
 , libpsl
 , brotli
@@ -217,7 +216,6 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/telegram-desktop \
       "''${gappsWrapperArgs[@]}" \
       "''${qtWrapperArgs[@]}" \
-      --prefix LD_LIBRARY_PATH : "${xorg.libXcursor}/lib" \
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
   '';
 

pkgs/applications/networking/instant-messengers/wavebox/default.nix

@@ -4,6 +4,7 @@
 , gtk3
 , gtk4
 , libnotify
+, copyDesktopItems
 , makeDesktopItem
 , makeWrapper
 , mesa
@@ -17,32 +18,21 @@
 , xorg
 }:
 
-let
-  version = "10.114.26-2";
-  desktopItem = makeDesktopItem rec {
-    name = "Wavebox";
-    exec = "wavebox";
-    icon = "wavebox";
-    desktopName = name;
-    genericName = name;
-    categories = [ "Network" "WebBrowser" ];
-  };
-
-  tarball = "Wavebox_${version}.tar.gz";
-
-in
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "wavebox";
-  inherit version;
+  version = "10.118.5-2";
+
   src = fetchurl {
-    url = "https://download.wavebox.app/stable/linux/tar/${tarball}";
-    sha256 = "1yk664zgahjg6n98n3kc9avcay0nqwcyq8wq231p7kvd79zazk0r";
+    url = "https://download.wavebox.app/stable/linux/tar/Wavebox_${version}.tar.gz";
+    sha256 = "sha256-TxMl8pdycCMY6NFi5MSLZg0p/+KmuAPQOm370bPMm/0=";
   };
 
   # don't remove runtime deps
   dontPatchELF = true;
+  # ignore optional Qt 6 shim
+  autoPatchelfIgnoreMissingDeps = [ "libQt6Widgets.so.6" "libQt6Gui.so.6" "libQt6Core.so.6" ];
 
-  nativeBuildInputs = [ autoPatchelfHook makeWrapper qt5.wrapQtAppsHook ];
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper qt5.wrapQtAppsHook copyDesktopItems ];
 
   buildInputs = with xorg; [
     libXdmcp
@@ -62,14 +52,28 @@ stdenv.mkDerivation {
 
   runtimeDependencies = [ (lib.getLib udev) libnotify gtk4 ];
 
+  desktopItems = [
+    (makeDesktopItem rec {
+      name = "Wavebox";
+      exec = "wavebox";
+      icon = "wavebox";
+      desktopName = name;
+      genericName = name;
+      categories = [ "Network" "WebBrowser" ];
+    })
+  ];
+
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin $out/opt/wavebox
     cp -r * $out/opt/wavebox
 
-    # provide desktop item and icon
-    mkdir -p $out/share/applications $out/share/icons/hicolor/128x128/apps
-    ln -s ${desktopItem}/share/applications/* $out/share/applications
+    # provide icon for desktop item
+    mkdir -p $out/share/icons/hicolor/128x128/apps
     ln -s $out/opt/wavebox/product_logo_128.png $out/share/icons/hicolor/128x128/apps/wavebox.png
+
+    runHook postInstall
   '';
 
   postFixup = ''
@@ -77,6 +81,8 @@ stdenv.mkDerivation {
     --prefix PATH : ${xdg-utils}/bin
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Wavebox messaging application";
     homepage = "https://wavebox.io";

pkgs/applications/networking/instant-messengers/wavebox/update.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update curl jq
+
+version=$(curl "https://download.wavebox.app/stable/linux/latest.json" | jq --raw-output '.["urls"]["tar"] | match("https://download.wavebox.app/stable/linux/tar/Wavebox_(.+).tar.gz").captures[0]["string"]')
+nix-update wavebox --version "$version"

pkgs/applications/networking/mailreaders/afew/default.nix

@@ -26,7 +26,7 @@ python3Packages.buildPythonApplication rec {
   outputs = [ "out" "doc" ];
 
   postBuild =  ''
-    ${python3Packages.python.pythonForBuild.interpreter} setup.py build_sphinx -b html,man
+    ${python3Packages.python.pythonOnBuildForHost.interpreter} setup.py build_sphinx -b html,man
   '';
 
   postInstall = ''

pkgs/applications/networking/p2p/zeronet-conservancy/default.nix

@@ -24,7 +24,7 @@ python3Packages.buildPythonApplication rec {
 
   buildPhase = ''
     runHook preBuild
-    ${python3Packages.python.pythonForBuild.interpreter} -O -m compileall .
+    ${python3Packages.python.pythonOnBuildForHost.interpreter} -O -m compileall .
     runHook postBuild
   '';
 

pkgs/applications/networking/p2p/zeronet/default.nix

@@ -18,7 +18,7 @@ python3Packages.buildPythonApplication rec {
   ];
 
   buildPhase = ''
-    ${python3Packages.python.pythonForBuild.interpreter} -O -m compileall .
+    ${python3Packages.python.pythonOnBuildForHost.interpreter} -O -m compileall .
   '';
 
   installPhase = ''

pkgs/applications/networking/pcloud/default.nix

@@ -38,13 +38,13 @@
 
 let
   pname = "pcloud";
-  version = "1.14.1";
-  code = "XZ5iuiVZQsuexQaMmmLAS7FGWNh1TkXRWJR7";
+  version = "1.14.2";
+  code = "XZAwMrVZidapyDxpd2pCNlGy3BcjdbYCf1Yk";
 
   # Archive link's codes: https://www.pcloud.com/release-notes/linux.html
   src = fetchzip {
     url = "https://api.pcloud.com/getpubzip?code=${code}&filename=${pname}-${version}.zip";
-    hash = "sha256-6IHt9qxMuDe9f1T+t8JXfPXLUCVe865Od8/ixPR3gso=";
+    hash = "sha256-5dTo0/R+RA+C0PKzaCmcSy7YwzT3Qlwq1xMw6wPJt28=";
   };
 
   appimageContents = appimageTools.extractType2 {