Project import generated by Copybara.

GitOrigin-RevId: 636051e353461f073ac55d5d42c1ed062a345046

third_party/nixpkgs/doc/languages-frameworks/rust.section.md

@@ -319,6 +319,18 @@ The above are just guidelines, and exceptions may be granted on a case-by-case b
 However, please check if it's possible to disable a problematic subset of the
 test suite and leave a comment explaining your reasoning.
 
+This can be achived with `--skip` in `checkFlags`:
+
+```nix
+rustPlatform.buildRustPackage {
+  /* ... */
+  checkFlags = [
+    # reason for disabling test
+    "--skip=example::tests:example_test"
+  ];
+}
+```
+
 #### Setting `test-threads` {#setting-test-threads}
 
 `buildRustPackage` will use parallel test threads by default,

third_party/nixpkgs/doc/languages-frameworks/vim.section.md

@@ -170,8 +170,8 @@ of precompiled grammars, you can use `nvim-treesitter.withPlugins` function:
       start = [
         (nvim-treesitter.withPlugins (
           plugins: with plugins; [
-            tree-sitter-nix
+            nix
-            tree-sitter-python
+            python
           ]
         ))
       ];
@@ -180,7 +180,7 @@ of precompiled grammars, you can use `nvim-treesitter.withPlugins` function:
 })
 ```
 
-To enable all grammars packaged in nixpkgs, use `(pkgs.vimPlugins.nvim-treesitter.withPlugins (plugins: pkgs.tree-sitter.allGrammars))`.
+To enable all grammars packaged in nixpkgs, use `pkgs.vimPlugins.nvim-treesitter.withAllGrammars`.
 
 ## Managing plugins with vim-plug {#managing-plugins-with-vim-plug}
 
@@ -203,6 +203,8 @@ Note: this is not possible anymore for Neovim.
 
 Nix expressions for Vim plugins are stored in [pkgs/applications/editors/vim/plugins](https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/editors/vim/plugins). For the vast majority of plugins, Nix expressions are automatically generated by running [`./update.py`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/update.py). This creates a [generated.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/generated.nix) file based on the plugins listed in [vim-plugin-names](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/vim-plugin-names). Plugins are listed in alphabetical order in `vim-plugin-names` using the format `[github username]/[repository]@[gitref]`. For example https://github.com/scrooloose/nerdtree becomes `scrooloose/nerdtree`.
 
+After running `./update.py`, if nvim-treesitter received an update, also run [`nvim-treesitter/update.py`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/update.py) to update the tree sitter grammars for `nvim-treesitter`.
+
 Some plugins require overrides in order to function properly. Overrides are placed in [overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/overrides.nix). Overrides are most often required when a plugin requires some dependencies, or extra steps are required during the build process. For example `deoplete-fish` requires both `deoplete-nvim` and `vim-fish`, and so the following override was added:
 
 ```nix

third_party/nixpkgs/maintainers/maintainer-list.nix

@@ -1481,6 +1481,12 @@
     githubId = 35324;
     name = "Badi' Abdul-Wahid";
   };
+  baduhai = {
+    email = "baduhai@pm.me";
+    github = "baduhai";
+    githubId = 31864305;
+    name = "William";
+  };
   baitinq = {
     email = "manuelpalenzuelamerino@gmail.com";
     name = "Baitinq";
@@ -2465,6 +2471,12 @@
       fingerprint = "4EBB 30F1 E89A 541A A7F2  52BE 830A 9728 6309 66F4";
     }];
   };
+  christophcharles = {
+    email = "23055925+christophcharles@users.noreply.github.com";
+    github = "christophcharles";
+    githubId = 23055925;
+    name = "Christoph Charles";
+  };
   christopherpoole = {
     email = "mail@christopherpoole.net";
     github = "christopherpoole";
@@ -2661,6 +2673,16 @@
     githubId = 5561189;
     name = "Cody Opel";
   };
+  cofob = {
+    name = "Egor Ternovoy";
+    email = "cofob@riseup.net";
+    matrix = "@cofob:matrix.org";
+    github = "cofob";
+    githubId = 49928332;
+    keys = [{
+      fingerprint = "5F3D 9D3D ECE0 8651 DE14  D29F ACAD 4265 E193 794D";
+    }];
+  };
   Cogitri = {
     email = "oss@cogitri.dev";
     github = "Cogitri";
@@ -5884,6 +5906,12 @@
     githubId = 54999;
     name = "Ariel Nunez";
   };
+  iopq = {
+    email = "iop_jr@yahoo.com";
+    github = "iopq";
+    githubId = 1817528;
+    name = "Igor Polyakov";
+  };
   irenes = {
     name = "Irene Knapp";
     email = "ireneista@gmail.com";
@@ -13305,6 +13333,12 @@
     githubId = 102685;
     name = "Thomas Friese";
   };
+  taylor1791 = {
+    email = "nixpkgs@tayloreverding.com";
+    github = "taylor1791";
+    githubId = 555003;
+    name = "Taylor Everding";
+  };
   tazjin = {
     email = "mail@tazj.in";
     github = "tazjin";

third_party/nixpkgs/maintainers/scripts/copy-tarballs.pl

@@ -164,6 +164,7 @@ elsif (defined $expr) {
         my $algo = $fetch->{type};
         my $hash = $fetch->{hash};
         my $name = $fetch->{name};
+        my $isPatch = $fetch->{isPatch};
 
         if ($hash =~ /^([a-z0-9]+)-([A-Za-z0-9+\/=]+)$/) {
             $algo = $1;
@@ -189,6 +190,11 @@ elsif (defined $expr) {
             next;
         }
 
+        if ($isPatch) {
+            print STDERR "skipping $url (support for patches is missing)\n";
+            next;
+        }
+
         next if defined $exclude && $url =~ /$exclude/;
 
         if (alreadyMirrored($algo, $hash)) {

third_party/nixpkgs/maintainers/scripts/find-tarballs.nix

@@ -14,12 +14,12 @@ let
     operator = const [ ];
   });
 
-  urls = map (drv: { url = head (drv.urls or [ drv.url ]); hash = drv.outputHash; type = drv.outputHashAlgo; name = drv.name; }) fetchurlDependencies;
+  urls = map (drv: { url = head (drv.urls or [ drv.url ]); hash = drv.outputHash; isPatch = (drv?postFetch && drv.postFetch != ""); type = drv.outputHashAlgo; name = drv.name; }) fetchurlDependencies;
 
   fetchurlDependencies =
     filter
       (drv: drv.outputHash or "" != "" && drv.outputHashMode or "flat" == "flat"
-          && drv.postFetch or "" == "" && (drv ? url || drv ? urls))
+          && (drv ? url || drv ? urls))
       dependencies;
 
   dependencies = map (x: x.value) (genericClosure {

third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -189,6 +189,15 @@
           <link xlink:href="options.html#opt-virtualisation.appvm.enable">virtualisation.appvm</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          [xray] (https://github.com/XTLS/Xray-core), a fully compatible
+          v2ray-core replacement. Features XTLS, which when enabled on
+          server and client, brings UDP FullCone NAT to proxy setups.
+          Available as
+          <link xlink:href="options.html#opt-services.xray.enable">services.xray</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://github.com/mozilla-services/syncstorage-rs">syncstorage-rs</link>,
@@ -305,6 +314,13 @@
           <link linkend="opt-services.alps.enable">services.alps</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/skeeto/endlessh">endlessh</link>,
+          an SSH tarpit. Available as
+          <link linkend="opt-services.endlessh.enable">services.endlessh</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://github.com/shizunge/endlessh-go">endlessh-go</link>,
@@ -365,6 +381,13 @@
           <link linkend="opt-services.expressvpn.enable">services.expressvpn</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://troglobit.com/projects/merecat/">merecat</link>,
+          a small and easy HTTP server based on thttpd. Available as
+          <link linkend="opt-services.merecat.enable">services.merecat</link>
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://github.com/L11R/go-autoconfig">go-autoconfig</link>,
@@ -705,6 +728,16 @@
           instead.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="https://ce-programming.github.io/CEmu">CEmu
+          TI-84 Plus CE emulator</link> package has been renamed to
+          <literal>cemu-ti</literal>. The
+          <link xlink:href="https://cemu.info">Cemu Wii U
+          emulator</link> is now packaged as <literal>cemu</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <literal>systemd-networkd</literal> v250 deprecated, renamed,

third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2211.section.md

@@ -71,6 +71,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 ## New Services {#sec-release-22.11-new-services}
 
 - [appvm](https://github.com/jollheef/appvm), Nix based app VMs. Available as [virtualisation.appvm](options.html#opt-virtualisation.appvm.enable).
+
+- [xray] (https://github.com/XTLS/Xray-core), a fully compatible v2ray-core replacement. Features XTLS, which when enabled on server and client, brings UDP FullCone NAT to proxy setups. Available as [services.xray](options.html#opt-services.xray.enable).
+
 - [syncstorage-rs](https://github.com/mozilla-services/syncstorage-rs), a self-hostable sync server for Firefox. Available as [services.firefox-syncserver](options.html#opt-services.firefox-syncserver.enable).
 
 - [dragonflydb](https://dragonflydb.io/), a modern replacement for Redis and Memcached. Available as [services.dragonflydb](#opt-services.dragonflydb.enable).
@@ -106,6 +109,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [alps](https://git.sr.ht/~migadu/alps), a simple and extensible webmail. Available as [services.alps](#opt-services.alps.enable).
 
+- [endlessh](https://github.com/skeeto/endlessh), an SSH tarpit. Available as [services.endlessh](#opt-services.endlessh.enable).
+
 - [endlessh-go](https://github.com/shizunge/endlessh-go), an SSH tarpit that exposes Prometheus metrics. Available as [services.endlessh-go](#opt-services.endlessh-go.enable).
 
 - [Garage](https://garagehq.deuxfleurs.fr/), a simple object storage server for geodistributed deployments, alternative to MinIO. Available as [services.garage](#opt-services.garage.enable).
@@ -123,6 +128,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [expressvpn](https://www.expressvpn.com), the CLI client for ExpressVPN. Available as [services.expressvpn](#opt-services.expressvpn.enable).
 
+- [merecat](https://troglobit.com/projects/merecat/), a small and easy HTTP server based on thttpd. Available as [services.merecat](#opt-services.merecat.enable)
+
 - [go-autoconfig](https://github.com/L11R/go-autoconfig), IMAP/SMTP autodiscover server. Available as [services.go-autoconfig](#opt-services.go-autoconfig.enable).
 
 - [tmate-ssh-server](https://github.com/tmate-io/tmate-ssh-server), server side part of [tmate](https://tmate.io/). Available as [services.tmate-ssh-server](#opt-services.tmate-ssh-server.enable).
@@ -230,6 +237,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 
 - The `aws` package has been removed due to being abandoned by the upstream. It is recommended to use `awscli` or `awscli2` instead.
 
+- The [CEmu TI-84 Plus CE emulator](https://ce-programming.github.io/CEmu) package has been renamed to `cemu-ti`. The [Cemu Wii U emulator](https://cemu.info) is now packaged as `cemu`.
+
 - `systemd-networkd` v250 deprecated, renamed, and moved some sections and settings which leads to the following breaking module changes:
 
    * `systemd.network.networks.<name>.dhcpV6PrefixDelegationConfig` is renamed to `systemd.network.networks.<name>.dhcpPrefixDelegationConfig`.

third_party/nixpkgs/nixos/lib/systemd-unit-options.nix

@@ -68,10 +68,9 @@ in rec {
       default = [];
       type = types.listOf unitNameType;
       description = lib.mdDoc ''
-        Units that require (i.e. depend on and need to go down with)
+        Units that require (i.e. depend on and need to go down with) this unit.
-        this unit. The discussion under `wantedBy`
+        As discussed in the `wantedBy` option description this also creates
-        applies here as well: inverse `.requires`
+        `.requires` symlinks automatically.
-        symlinks are established.
       '';
     };
 
@@ -79,16 +78,17 @@ in rec {
       default = [];
       type = types.listOf unitNameType;
       description = lib.mdDoc ''
-        Units that want (i.e. depend on) this unit. The standard way
+        Units that want (i.e. depend on) this unit. The default method for
-        to make a unit start by default at boot is to set this option
+        starting a unit by default at boot time is to set this option to
-        to `[ "multi-user.target" ]`. That's despite
+        '["multi-user.target"]' for system services. Likewise for user units
-        the fact that the systemd.unit(5) manpage says this option
+        (`systemd.user.<name>.*`) set it to `["default.target"]` to make a unit
-        goes in the `[Install]` section that controls
+        start by default when the user `<name>` logs on.
-        the behaviour of `systemctl enable`. Since
+
-        such a process is stateful and thus contrary to the design of
+        This option creates a `.wants` symlink in the given target that exists
-        NixOS, setting this option instead causes the equivalent
+        statelessly without the need for running `systemctl enable`.
-        inverse `.wants` symlink to be present,
+        The in systemd.unit(5) manpage described `[Install]` section however is
-        establishing the same desired relationship in a stateless way.
+        not supported because it is a stateful process that does not fit well
+        into the NixOS design.
       '';
     };
 

third_party/nixpkgs/nixos/modules/module-list.nix

@@ -991,6 +991,7 @@
   ./services/networking/xinetd.nix
   ./services/networking/xl2tpd.nix
   ./services/networking/x2goserver.nix
+  ./services/networking/xray.nix
   ./services/networking/xrdp.nix
   ./services/networking/yggdrasil.nix
   ./services/networking/zerobin.nix
@@ -1011,6 +1012,7 @@
   ./services/security/certmgr.nix
   ./services/security/cfssl.nix
   ./services/security/clamav.nix
+  ./services/security/endlessh.nix
   ./services/security/endlessh-go.nix
   ./services/security/fail2ban.nix
   ./services/security/fprintd.nix
@@ -1042,6 +1044,7 @@
   ./services/security/vaultwarden/default.nix
   ./services/security/yubikey-agent.nix
   ./services/system/cachix-agent/default.nix
+  ./services/system/cachix-watch-store.nix
   ./services/system/cloud-init.nix
   ./services/system/dbus.nix
   ./services/system/earlyoom.nix
@@ -1155,6 +1158,7 @@
   ./services/web-servers/lighttpd/collectd.nix
   ./services/web-servers/lighttpd/default.nix
   ./services/web-servers/lighttpd/gitweb.nix
+  ./services/web-servers/merecat.nix
   ./services/web-servers/mighttpd2.nix
   ./services/web-servers/minio.nix
   ./services/web-servers/molly-brown.nix

third_party/nixpkgs/nixos/modules/security/pam.nix

@@ -615,12 +615,12 @@ let
           optionalString cfg.setLoginUid ''
             session ${if config.boot.isContainer then "optional" else "required"} pam_loginuid.so
           '' +
-          optionalString cfg.ttyAudit.enable ''
+          optionalString cfg.ttyAudit.enable (concatStringsSep " \\\n  " ([
-            session required ${pkgs.pam}/lib/security/pam_tty_audit.so
+            "session required ${pkgs.pam}/lib/security/pam_tty_audit.so"
-                open_only=${toString cfg.ttyAudit.openOnly}
+          ] ++ optional cfg.ttyAudit.openOnly "open_only"
-                ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"}
+          ++ optional (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"
-                ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"}
+          ++ optional (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"
-          '' +
+          )) +
           optionalString cfg.makeHomeDir ''
             session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0077
           '' +

third_party/nixpkgs/nixos/modules/services/continuous-integration/jenkins/job-builder.nix

@@ -30,7 +30,7 @@ in {
       };
 
       accessUser = mkOption {
-        default = "";
+        default = "admin";
         type = types.str;
         description = lib.mdDoc ''
           User id in Jenkins used to reload config.
@@ -48,7 +48,8 @@ in {
       };
 
       accessTokenFile = mkOption {
-        default = "";
+        default = "${config.services.jenkins.home}/secrets/initialAdminPassword";
+        defaultText = literalExpression ''"''${config.services.jenkins.home}/secrets/initialAdminPassword"'';
         type = types.str;
         example = "/run/keys/jenkins-job-builder-access-token";
         description = lib.mdDoc ''

third_party/nixpkgs/nixos/modules/services/hardware/pcscd.nix

@@ -5,6 +5,10 @@ with lib;
 let
   cfgFile = pkgs.writeText "reader.conf" config.services.pcscd.readerConfig;
 
+  package = if config.security.polkit.enable
+              then pkgs.pcscliteWithPolkit
+              else pkgs.pcsclite;
+
   pluginEnv = pkgs.buildEnv {
     name = "pcscd-plugins";
     paths = map (p: "${p}/pcsc/drivers") config.services.pcscd.plugins;
@@ -49,8 +53,8 @@ in
 
     environment.etc."reader.conf".source = cfgFile;
 
-    environment.systemPackages = [ pkgs.pcsclite ];
+    environment.systemPackages = [ package ];
-    systemd.packages = [ (getBin pkgs.pcsclite) ];
+    systemd.packages = [ (getBin package) ];
 
     systemd.sockets.pcscd.wantedBy = [ "sockets.target" ];
 
@@ -66,7 +70,7 @@ in
       # around it, we force the path to the cfgFile.
       #
       # https://github.com/NixOS/nixpkgs/issues/121088
-      serviceConfig.ExecStart = [ "" "${getBin pkgs.pcsclite}/bin/pcscd -f -x -c ${cfgFile}" ];
+      serviceConfig.ExecStart = [ "" "${getBin package}/bin/pcscd -f -x -c ${cfgFile}" ];
     };
   };
 }

third_party/nixpkgs/nixos/modules/services/hardware/udev.nix

@@ -192,7 +192,6 @@ in
   ###### interface
 
   options = {
-
     boot.hardwareScan = mkOption {
       type = types.bool;
       default = true;
@@ -205,6 +204,9 @@ in
     };
 
     services.udev = {
+      enable = mkEnableOption (lib.mdDoc "udev") // {
+        default = true;
+      };
 
       packages = mkOption {
         type = types.listOf types.path;
@@ -345,7 +347,7 @@ in
 
   ###### implementation
 
-  config = mkIf (!config.boot.isContainer) {
+  config = mkIf cfg.enable {
 
     services.udev.extraRules = nixosRules;
 

third_party/nixpkgs/nixos/modules/services/matrix/mautrix-telegram.nix

@@ -19,6 +19,10 @@ in {
         apply = recursiveUpdate default;
         inherit (settingsFormat) type;
         default = {
+          homeserver = {
+            software = "standard";
+          };
+
           appservice = rec {
             database = "sqlite:///${dataDir}/mautrix-telegram.db";
             database_opts = {};
@@ -81,7 +85,7 @@ in {
         description = lib.mdDoc ''
           {file}`config.yaml` configuration as a Nix attribute set.
           Configuration options should match those described in
-          [example-config.yaml](https://github.com/tulir/mautrix-telegram/blob/master/example-config.yaml).
+          [example-config.yaml](https://github.com/mautrix/telegram/blob/master/mautrix_telegram/example-config.yaml).
 
           Secret tokens should be specified using {option}`environmentFile`
           instead of this world-readable attribute set.

third_party/nixpkgs/nixos/modules/services/misc/sourcehut/default.nix

@@ -1419,5 +1419,5 @@ in
   ];
 
   meta.doc = ./sourcehut.xml;
-  meta.maintainers = with maintainers; [ julm tomberek ];
+  meta.maintainers = with maintainers; [ tomberek ];
 }

third_party/nixpkgs/nixos/modules/services/monitoring/grafana.nix

@@ -408,7 +408,7 @@ in {
 
             socket = mkOption {
               description = lib.mdDoc "Path where the socket should be created when protocol=socket. Make sure that Grafana has appropriate permissions before you change this setting.";
-              default = "";
+              default = "/run/grafana/grafana.sock";
               type = types.str;
             };
           };

third_party/nixpkgs/nixos/modules/services/networking/bitcoind.nix

@@ -204,7 +204,7 @@ in
         '';
       in {
         description = "Bitcoin daemon";
-        after = [ "network.target" ];
+        after = [ "network-online.target" ];
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
           User = cfg.user;

third_party/nixpkgs/nixos/modules/services/networking/syncthing.nix

@@ -55,8 +55,8 @@ let
 
     # generate the new config by merging with the NixOS config options
     new_cfg=$(printf '%s\n' "$old_cfg" | ${pkgs.jq}/bin/jq -c '. * {
-        "devices": (${builtins.toJSON devices}${optionalString (! cfg.overrideDevices) " + .devices"}),
+        "devices": (${builtins.toJSON devices}${optionalString (cfg.devices == {} || ! cfg.overrideDevices) " + .devices"}),
-        "folders": (${builtins.toJSON folders}${optionalString (! cfg.overrideFolders) " + .folders"})
+        "folders": (${builtins.toJSON folders}${optionalString (cfg.folders == {} || ! cfg.overrideFolders) " + .folders"})
     } * ${builtins.toJSON cfg.extraOptions}')
 
     # send the new config

third_party/nixpkgs/nixos/modules/services/networking/xray.nix

@@ -0,0 +1,96 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  options = {
+
+    services.xray = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Whether to run xray server.
+
+          Either `settingsFile` or `settings` must be specified.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.xray;
+        defaultText = literalExpression "pkgs.xray";
+        description = lib.mdDoc ''
+          Which xray package to use.
+        '';
+      };
+
+      settingsFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/etc/xray/config.json";
+        description = lib.mdDoc ''
+          The absolute path to the configuration file.
+
+          Either `settingsFile` or `settings` must be specified.
+
+          See <https://www.v2fly.org/en_US/config/overview.html>.
+        '';
+      };
+
+      settings = mkOption {
+        type = types.nullOr (types.attrsOf types.unspecified);
+        default = null;
+        example = {
+          inbounds = [{
+            port = 1080;
+            listen = "127.0.0.1";
+            protocol = "http";
+          }];
+          outbounds = [{
+            protocol = "freedom";
+          }];
+        };
+        description = lib.mdDoc ''
+          The configuration object.
+
+          Either `settingsFile` or `settings` must be specified.
+
+          See <https://www.v2fly.org/en_US/config/overview.html>.
+        '';
+      };
+    };
+
+  };
+
+  config = let
+    cfg = config.services.xray;
+    settingsFile = if cfg.settingsFile != null
+      then cfg.settingsFile
+      else pkgs.writeTextFile {
+        name = "xray.json";
+        text = builtins.toJSON cfg.settings;
+        checkPhase = ''
+          ${cfg.package}/bin/xray -test -config $out
+        '';
+      };
+
+  in mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = (cfg.settingsFile == null) != (cfg.settings == null);
+        message = "Either but not both `settingsFile` and `settings` should be specified for xray.";
+      }
+    ];
+
+    systemd.services.xray = {
+      description = "xray Daemon";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = "${cfg.package}/bin/xray -config ${settingsFile}";
+      };
+    };
+  };
+}

third_party/nixpkgs/nixos/modules/services/security/endlessh.nix

@@ -0,0 +1,99 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.endlessh;
+in
+{
+  options.services.endlessh = {
+    enable = mkEnableOption (mdDoc "endlessh service");
+
+    port = mkOption {
+      type = types.port;
+      default = 2222;
+      example = 22;
+      description = mdDoc ''
+        Specifies on which port the endlessh daemon listens for SSH
+        connections.
+
+        Setting this to `22` may conflict with {option}`services.openssh`.
+      '';
+    };
+
+    extraOptions = mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [ "-6" "-d 9000" "-v" ];
+      description = mdDoc ''
+        Additional command line options to pass to the endlessh daemon.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Whether to open a firewall port for the SSH listener.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.endlessh = {
+      description = "SSH tarpit";
+      requires = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig =
+        let
+          needsPrivileges = cfg.port < 1024;
+          capabilities = [ "" ] ++ optionals needsPrivileges [ "CAP_NET_BIND_SERVICE" ];
+          rootDirectory = "/run/endlessh";
+        in
+        {
+          Restart = "always";
+          ExecStart = with cfg; concatStringsSep " " ([
+            "${pkgs.endlessh}/bin/endlessh"
+            "-p ${toString port}"
+          ] ++ extraOptions);
+          DynamicUser = true;
+          RootDirectory = rootDirectory;
+          BindReadOnlyPaths = [ builtins.storeDir ];
+          InaccessiblePaths = [ "-+${rootDirectory}" ];
+          RuntimeDirectory = baseNameOf rootDirectory;
+          RuntimeDirectoryMode = "700";
+          AmbientCapabilities = capabilities;
+          CapabilityBoundingSet = capabilities;
+          UMask = "0077";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = !needsPrivileges;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          ProtectProc = "noaccess";
+          ProcSubset = "pid";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
+        };
+    };
+
+    networking.firewall.allowedTCPPorts = with cfg;
+      optionals openFirewall [ port ];
+  };
+
+  meta.maintainers = with maintainers; [ azahi ];
+}

third_party/nixpkgs/nixos/modules/services/web-apps/healthchecks.nix

@@ -15,14 +15,14 @@ let
 
   environmentFile = pkgs.writeText "healthchecks-environment" (lib.generators.toKeyValue { } environment);
 
-  healthchecksManageScript = with pkgs; (writeShellScriptBin "healthchecks-manage" ''
+  healthchecksManageScript = pkgs.writeShellScriptBin "healthchecks-manage" ''
+    sudo=exec
     if [[ "$USER" != "${cfg.user}" ]]; then
-        echo "please run as user 'healtchecks'." >/dev/stderr
+      sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} --preserve-env --preserve-env=PYTHONPATH'
-        exit 1
     fi
-    export $(cat ${environmentFile} | xargs);
+    export $(cat ${environmentFile} | xargs)
-    exec ${pkg}/opt/healthchecks/manage.py "$@"
+    $sudo ${pkg}/opt/healthchecks/manage.py "$@"
-  '');
+  '';
 in
 {
   options.services.healthchecks = {
@@ -163,7 +163,7 @@ in
           WorkingDirectory = cfg.dataDir;
           User = cfg.user;
           Group = cfg.group;
-          EnvironmentFile = environmentFile;
+          EnvironmentFile = [ environmentFile ];
           StateDirectory = mkIf (cfg.dataDir == "/var/lib/healthchecks") "healthchecks";
           StateDirectoryMode = mkIf (cfg.dataDir == "/var/lib/healthchecks") "0750";
         };

third_party/nixpkgs/nixos/modules/services/web-apps/invoiceplane.nix

@@ -36,10 +36,10 @@ let
     version = src.version;
     src = pkgs.invoiceplane;
 
-    patchPhase = ''
+    postPhase = ''
       # Patch index.php file to load additional config file
       substituteInPlace index.php \
-        --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); \$dotenv = new \Dotenv\Dotenv(__DIR__, 'extraConfig.php'); \$dotenv->load();";
+        --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); \$dotenv = Dotenv\Dotenv::createImmutable(__DIR__, 'extraConfig.php'); \$dotenv->load();";
     '';
 
     installPhase = ''

third_party/nixpkgs/nixos/modules/services/web-apps/nextcloud.nix

@@ -148,6 +148,15 @@ in {
       default = 2;
       description = lib.mdDoc "Log level value between 0 (DEBUG) and 4 (FATAL).";
     };
+    logType = mkOption {
+      type = types.enum [ "errorlog" "file" "syslog" "systemd" ];
+      default = "syslog";
+      description = lib.mdDoc ''
+        Logging backend to use.
+        systemd requires the php-systemd package to be added to services.nextcloud.phpExtraExtensions.
+        See the [nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html) for details.
+      '';
+    };
     https = mkOption {
       type = types.bool;
       default = false;
@@ -758,7 +767,7 @@ in {
               'datadirectory' => '${datadir}/data',
               'skeletondirectory' => '${cfg.skeletonDirectory}',
               ${optionalString cfg.caching.apcu "'memcache.local' => '\\OC\\Memcache\\APCu',"}
-              'log_type' => 'syslog',
+              'log_type' => '${cfg.logType}',
               'loglevel' => '${builtins.toString cfg.logLevel}',
               ${optionalString (c.overwriteProtocol != null) "'overwriteprotocol' => '${c.overwriteProtocol}',"}
               ${optionalString (c.dbname != null) "'dbname' => '${c.dbname}',"}

third_party/nixpkgs/nixos/modules/services/web-servers/merecat.nix

@@ -0,0 +1,55 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.merecat;
+  format = pkgs.formats.keyValue {
+    mkKeyValue = generators.mkKeyValueDefault {
+      mkValueString = v:
+        # In merecat.conf, booleans are "true" and "false"
+        if builtins.isBool v
+        then if v then "true" else "false"
+        else generators.mkValueStringDefault {} v;
+    } "=";
+  };
+  configFile = format.generate "merecat.conf" cfg.settings;
+
+in {
+
+  options.services.merecat = {
+
+    enable = mkEnableOption (lib.mdDoc "Merecat HTTP server");
+
+    settings = mkOption {
+      inherit (format) type;
+      default = { };
+      description = lib.mdDoc ''
+        Merecat configuration. Refer to merecat(8) for details on supported values.
+      '';
+      example = {
+        hostname = "localhost";
+        port = 8080;
+        virtual-host = true;
+        directory = "/srv/www";
+      };
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.merecat = {
+      description = "Merecat HTTP server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = "${pkgs.merecat}/bin/merecat -n -f ${configFile}";
+        AmbientCapabilities = lib.mkIf ((cfg.settings.port or 80) < 1024) [ "CAP_NET_BIND_SERVICE" ];
+      };
+    };
+
+  };
+
+}

third_party/nixpkgs/nixos/modules/tasks/network-interfaces.nix

@@ -1356,8 +1356,8 @@ in
       "net.ipv6.conf.default.disable_ipv6" = mkDefault (!cfg.enableIPv6);
       # networkmanager falls back to "/proc/sys/net/ipv6/conf/default/use_tempaddr"
       "net.ipv6.conf.default.use_tempaddr" = tempaddrValues.${cfg.tempAddresses}.sysctl;
-    } // listToAttrs (flip concatMap (filter (i: i.proxyARP) interfaces)
+    } // listToAttrs (forEach interfaces
-        (i: [(nameValuePair "net.ipv4.conf.${replaceChars ["."] ["/"] i.name}.proxy_arp" true)]))
+        (i: nameValuePair "net.ipv4.conf.${replaceChars ["."] ["/"] i.name}.proxy_arp" i.proxyARP))
       // listToAttrs (forEach interfaces
         (i: let
           opt = i.tempAddress;

third_party/nixpkgs/nixos/modules/virtualisation/container-config.nix

@@ -16,6 +16,9 @@ with lib;
     # Containers should be light-weight, so start sshd on demand.
     services.openssh.startWhenNeeded = mkDefault true;
 
+    # containers do not need to setup devices
+    services.udev.enable = false;
+
     # Shut up warnings about not having a boot loader.
     system.build.installBootLoader = lib.mkDefault "${pkgs.coreutils}/bin/true";
 

third_party/nixpkgs/nixos/modules/virtualisation/vmware-guest.nix

@@ -16,7 +16,8 @@ in
     enable = mkEnableOption (lib.mdDoc "VMWare Guest Support");
     headless = mkOption {
       type = types.bool;
-      default = false;
+      default = !config.services.xserver.enable;
+      defaultText = "!config.services.xserver.enable";
       description = lib.mdDoc "Whether to disable X11-related features.";
     };
   };

third_party/nixpkgs/nixos/tests/all-tests.nix

@@ -172,6 +172,7 @@ in {
   documentation = pkgs.callPackage ../modules/misc/documentation/test.nix { inherit nixosLib; };
   doh-proxy-rust = handleTest ./doh-proxy-rust.nix {};
   dokuwiki = handleTest ./dokuwiki.nix {};
+  dolibarr = handleTest ./dolibarr.nix {};
   domination = handleTest ./domination.nix {};
   dovecot = handleTest ./dovecot.nix {};
   drbd = handleTest ./drbd.nix {};
@@ -182,6 +183,7 @@ in {
   ejabberd = handleTest ./xmpp/ejabberd.nix {};
   elk = handleTestOn ["x86_64-linux"] ./elk.nix {};
   emacs-daemon = handleTest ./emacs-daemon.nix {};
+  endlessh = handleTest ./endlessh.nix {};
   endlessh-go = handleTest ./endlessh-go.nix {};
   engelsystem = handleTest ./engelsystem.nix {};
   enlightenment = handleTest ./enlightenment.nix {};
@@ -368,6 +370,7 @@ in {
   mediawiki = handleTest ./mediawiki.nix {};
   meilisearch = handleTest ./meilisearch.nix {};
   memcached = handleTest ./memcached.nix {};
+  merecat = handleTest ./merecat.nix {};
   metabase = handleTest ./metabase.nix {};
   minecraft = handleTest ./minecraft.nix {};
   minecraft-server = handleTest ./minecraft-server.nix {};

third_party/nixpkgs/nixos/tests/endlessh.nix

@@ -0,0 +1,43 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+{
+  name = "endlessh";
+  meta.maintainers = with lib.maintainers; [ azahi ];
+
+  nodes = {
+    server = { ... }: {
+      services.endlessh = {
+        enable = true;
+        openFirewall = true;
+      };
+
+      specialisation = {
+        unprivileged.configuration.services.endlessh.port = 2222;
+
+        privileged.configuration.services.endlessh.port = 22;
+      };
+    };
+
+    client = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [ curl netcat ];
+    };
+  };
+
+  testScript = ''
+    def activate_specialisation(name: str):
+        server.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
+
+    start_all()
+
+    with subtest("Unprivileged"):
+        activate_specialisation("unprivileged")
+        server.wait_for_unit("endlessh.service")
+        server.wait_for_open_port(2222)
+        client.succeed("nc -dvW5 server 2222")
+
+    with subtest("Privileged"):
+        activate_specialisation("privileged")
+        server.wait_for_unit("endlessh.service")
+        server.wait_for_open_port(22)
+        client.succeed("nc -dvW5 server 22")
+  '';
+})

third_party/nixpkgs/nixos/tests/invoiceplane.nix

@@ -13,12 +13,12 @@ import ./make-test-python.nix ({ pkgs, ... }:
       services.invoiceplane.webserver = "caddy";
       services.invoiceplane.sites = {
         "site1.local" = {
-          #database.name = "invoiceplane1";
+          database.name = "invoiceplane1";
           database.createLocally = true;
           enable = true;
         };
         "site2.local" = {
-          #database.name = "invoiceplane2";
+          database.name = "invoiceplane2";
           database.createLocally = true;
           enable = true;
         };

third_party/nixpkgs/nixos/tests/jenkins.nix

@@ -18,8 +18,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
           enable = true;
           jobBuilder = {
             enable = true;
-            accessUser = "admin";
-            accessTokenFile = "/var/lib/jenkins/secrets/initialAdminPassword";
             nixJobs = [
               { job = {
                   name = "job-1";

third_party/nixpkgs/nixos/tests/kernel-generic.nix

@@ -30,7 +30,7 @@ let
       linux_5_4_hardened
       linux_5_10_hardened
       linux_5_15_hardened
-      linux_5_19_hardened
+      linux_6_0_hardened
 
       linux_testing;
   };

third_party/nixpkgs/nixos/tests/merecat.nix

@@ -0,0 +1,28 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "merecat";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine = { config, pkgs, ... }: {
+    services.merecat = {
+      enable = true;
+      settings = {
+        hostname = "localhost";
+        virtual-host = true;
+        directory = toString (pkgs.runCommand "merecat-webdir" {} ''
+          mkdir -p $out/foo.localhost $out/bar.localhost
+          echo '<h1>Hello foo</h1>' > $out/foo.localhost/index.html
+          echo '<h1>Hello bar</h1>' > $out/bar.localhost/index.html
+        '');
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("merecat")
+    machine.wait_for_open_port(80)
+    machine.succeed("curl --fail foo.localhost | grep 'Hello foo'")
+    machine.succeed("curl --fail bar.localhost | grep 'Hello bar'")
+  '';
+})

third_party/nixpkgs/nixos/tests/upnp.nix

@@ -47,7 +47,7 @@ in
 
       client1 =
         { pkgs, nodes, ... }:
-        { environment.systemPackages = [ pkgs.miniupnpc_2 pkgs.netcat ];
+        { environment.systemPackages = [ pkgs.miniupnpc pkgs.netcat ];
           virtualisation.vlans = [ 2 ];
           networking.defaultGateway = internalRouterAddress;
           networking.interfaces.eth1.ipv4.addresses = [
@@ -65,7 +65,7 @@ in
 
       client2 =
         { pkgs, ... }:
-        { environment.systemPackages = [ pkgs.miniupnpc_2 ];
+        { environment.systemPackages = [ pkgs.miniupnpc ];
           virtualisation.vlans = [ 1 ];
           networking.interfaces.eth1.ipv4.addresses = [
             { address = externalClient2Address; prefixLength = 24; }

third_party/nixpkgs/nixos/tests/web-apps/healthchecks.nix

@@ -33,10 +33,10 @@ import ../make-test-python.nix ({ lib, pkgs, ... }: {
         )
 
     with subtest("Manage script works"):
-        # Should fail if not called by healthchecks user
-        machine.fail("echo 'print(\"foo\")' | healthchecks-manage help")
-
         # "shell" sucommand should succeed, needs python in PATH.
         assert "foo\n" == machine.succeed("echo 'print(\"foo\")' | sudo -u healthchecks healthchecks-manage shell")
+
+        # Shouldn't fail if not called by healthchecks user
+        assert "foo\n" == machine.succeed("echo 'print(\"foo\")' | healthchecks-manage shell")
   '';
 })

third_party/nixpkgs/pkgs/applications/audio/bambootracker/default.nix

@@ -12,14 +12,14 @@
 
 mkDerivation rec {
   pname = "bambootracker";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "BambooTracker";
     repo = "BambooTracker";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-+9PmpmsF08oU//pJOWaoGQzG7a2O13kYqKbGwVRAMlU=";
+    sha256 = "sha256-OaktEUWWDEW+MYnQkaB8FvkuH29VDXFqBVSTEJ7Sz7A=";
   };
 
   nativeBuildInputs = [ qmake qttools pkg-config ];

third_party/nixpkgs/pkgs/applications/audio/cava/default.nix

@@ -1,33 +1,27 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, alsa-lib, fftw,
-  libpulseaudio, ncurses }:
+  libpulseaudio, ncurses, iniparser }:
 
 stdenv.mkDerivation rec {
   pname = "cava";
-  version = "0.7.4";
+  version = "0.8.2";
 
   buildInputs = [
     alsa-lib
     fftw
     libpulseaudio
     ncurses
+    iniparser
   ];
 
   src = fetchFromGitHub {
     owner = "karlstav";
     repo = "cava";
     rev = version;
-    sha256 = "sha256-BlHGst34aUgQcXcuQG43VnKUTclCxfQmWRa6iCud8dc=";
+    sha256 = "sha256-5nguoC2MrcNHMQ6rMOIRdSPtjA6bx5OrMGYdU/H08z0=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  postConfigure = ''
-    substituteInPlace Makefile.am \
-      --replace "-L/usr/local/lib -Wl,-rpath /usr/local/lib" ""
-    substituteInPlace configure.ac \
-      --replace "/usr/share/consolefonts" "$out/share/consolefonts"
-  '';
-
   meta = with lib; {
     description = "Console-based Audio Visualizer for Alsa";
     homepage = "https://github.com/karlstav/cava";

third_party/nixpkgs/pkgs/applications/audio/cider/default.nix

@@ -2,11 +2,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "cider";
-  version = "1.5.6";
+  version = "1.5.7";
 
   src = fetchurl {
     url = "https://github.com/ciderapp/cider-releases/releases/download/v${version}/Cider-${version}.AppImage";
-    sha256 = "sha256-gn0dRoPPolujZ1ukuo/esSLwbhiPdcknIe9+W6iRaYw=";
+    sha256 = "sha256-fWpt7YxqEDa1U4CwyVZwgbiwe0lrh64v0cJG9pbNMUU=";
   };
 
   extraInstallCommands =

third_party/nixpkgs/pkgs/applications/audio/espeak-ng/default.nix

@@ -1,18 +1,30 @@
-{ stdenv, lib, fetchFromGitHub, autoconf, automake, which, libtool, pkg-config
+{ stdenv
-, ronn, substituteAll
+, lib
-, mbrolaSupport ? true, mbrola
+, fetchFromGitHub
-, pcaudiolibSupport ? true, pcaudiolib
+, autoconf
-, sonicSupport ? true, sonic }:
+, automake
+, which
+, libtool
+, pkg-config
+, ronn
+, substituteAll
+, mbrolaSupport ? true
+, mbrola
+, pcaudiolibSupport ? true
+, pcaudiolib
+, sonicSupport ? true
+, sonic
+}:
 
 stdenv.mkDerivation rec {
   pname = "espeak-ng";
-  version = "1.50";
+  version = "1.51";
 
   src = fetchFromGitHub {
     owner = "espeak-ng";
     repo = "espeak-ng";
     rev = version;
-    sha256 = "0jkqhf2h94vbqq7mg7mmm23bq372fa7mdk941my18c3vkldcir1b";
+    hash = "sha256-KwzMlQ3/JgpNOpuV4zNc0zG9oWEGFbVSJ4bEd3dtD3Y=";
   };
 
   patches = lib.optionals mbrolaSupport [
@@ -35,12 +47,6 @@ stdenv.mkDerivation rec {
     "--with-mbrola=${if mbrolaSupport then "yes" else "no"}"
   ];
 
-  # Current release lacks dependencies on local espeak-ng:
-  #  cd dictsource && ESPEAK_DATA_PATH=/build/espeak-ng LD_LIBRARY_PATH=../src: ../src/espeak-ng --compile=yue && cd ..
-  #  bash: line 1: ../src/espeak-ng: No such file or directory
-  # Should be fixed in next release: https://github.com/espeak-ng/espeak-ng/pull/1029
-  enableParallelBuilding = false;
-
   postInstall = lib.optionalString stdenv.isLinux ''
     patchelf --set-rpath "$(patchelf --print-rpath $out/bin/espeak-ng)" $out/bin/speak-ng
   '';

third_party/nixpkgs/pkgs/applications/audio/fluidsynth/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.2.9";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "sha256-8vsYn/4qkANp6f6avtdaXHfJD+9NTHTrl7i4RTlKXPQ=";
+    sha256 = "sha256-7SuM7a8IIecAJ83QvJfUba/wArAEXywqL2HwVbeG8H4=";
   };
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];

third_party/nixpkgs/pkgs/applications/audio/musikcube/default.nix

@@ -27,26 +27,15 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "0.98.0";
+  version = "0.98.1";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    sha256 = "sha256-bnwOxEcvRXWPuqtkv8YlpclvH/6ZtQvyvHy4mqJCwik=";
+    sha256 = "sha256-pnAdlCCqWzR0W8dF9CE48K8yHMVIx3egZlXvibxU18A=";
   };
 
-  patches = []
-    ++ lib.optionals stdenv.isDarwin [
-      # Fix pending upstream inclusion for Darwin nixpkgs builds:
-      # https://github.com/clangen/musikcube/pull/531
-      (fetchpatch {
-        name = "darwin-build.patch";
-        url = "https://github.com/clangen/musikcube/commit/9077bb9fa6ddfe93ebb14bb8feebc8a0ef9b7ee4.patch";
-        sha256 = "sha256-Am9AGKDGMN5z+JJFJKdsBLrHf2neHFovgF/8I5EXLDA=";
-      })
-    ];
-
   nativeBuildInputs = [
     cmake
     pkg-config

third_party/nixpkgs/pkgs/applications/audio/pianobooster/default.nix

@@ -1,29 +1,69 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, qttools
+{ lib
-, alsa-lib, ftgl, libGLU, libjack2, qtbase, rtmidi, wrapQtAppsHook
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, qttools
+, alsa-lib
+, ftgl
+, libGLU
+, qtbase
+, rtmidi
+, libjack2
+, fluidsynth
+, soundfont-fluid
+, unzip
+, wrapQtAppsHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "pianobooster";
-  version = "0.7.2b";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
-    owner = "captnfab";
+    owner = "pianobooster";
     repo = "PianoBooster";
     rev = "v${version}";
-    sha256 = "03xcdnlpsij22ca3i6xj19yqzn3q2ch0d32r73v0c96nm04gvhjj";
+    hash = "sha256-1WOlAm/HXSL6QK0Kd1mnFEZxxpMseTG+6WzgMNWt+RA=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config qttools wrapQtAppsHook ];
+  postPatch = ''
+    substituteInPlace src/Settings.cpp src/GuiMidiSetupDialog.cpp \
+      --replace "/usr/share/soundfonts" "${soundfont-fluid}/share/soundfonts" \
+      --replace "FluidR3_GM.sf2" "FluidR3_GM2-2.sf2"
+  '';
 
-  buildInputs = [ alsa-lib ftgl libGLU libjack2 qtbase rtmidi ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qttools
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    alsa-lib
+    ftgl
+    libGLU
+    qtbase
+    rtmidi
+    libjack2
+    fluidsynth
+  ];
 
   cmakeFlags = [
     "-DOpenGL_GL_PREFERENCE=GLVND"
+    "-DUSE_JACK=ON"
   ];
 
+  postInstall = ''
+    qtWrapperArgs+=(
+      --prefix PATH : "${lib.makeBinPath [ unzip ]}"
+    )
+  '';
+
   meta = with lib; {
     description = "A MIDI file player that teaches you how to play the piano";
-    homepage = "https://github.com/captnfab/PianoBooster";
+    homepage = "https://github.com/pianobooster/PianoBooster";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ goibhniu orivej ];

third_party/nixpkgs/pkgs/applications/audio/tagger/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tagger";
-  version = "2022.10.4";
+  version = "2022.10.5";
 
   src = fetchFromGitHub {
     owner = "nlogozzo";
     repo = "NickvisionTagger";
     rev = version;
-    hash = "sha256-I4jhlz/dmS24nszP755xlYMF6aLhmAxlv6Td4xFbr3U=";
+    hash = "sha256-rkpeecJUOBom0clrwftBa/VxACTihfMfWVmfbZhMQ50=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/backup/proxmox-backup-client/default.nix

@@ -0,0 +1,70 @@
+{ lib, fetchgit, rustPlatform, pkg-config, openssl, fuse3, libuuid, acl, libxcrypt }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "proxmox-backup-client";
+  version = "2.2.1";
+
+  srcs = [
+    (fetchgit {
+      url = "git://git.proxmox.com/git/proxmox-backup.git";
+      rev = "v${version}";
+      name = pname;
+      hash = "sha256-uOKQe/BzO69f/ggEPoZQ2Rn3quytQrUeH7be19QV3KI=";
+    })
+    (fetchgit {
+      url = "git://git.proxmox.com/git/proxmox.git";
+      rev = "43b4440ef015d846161657490b18cf6ac7600fc4";
+      name = "proxmox";
+      hash = "sha256-05Z+IRRIioFGn+iAYG04DyNsgw9gQrJ6qAArpCwoIb0=";
+    })
+    (fetchgit {
+      url = "git://git.proxmox.com/git/proxmox-fuse.git";
+      rev = "d162ef9039878b871e2aa11b7d9a373ae512e2d1";
+      name = "proxmox-fuse";
+      hash = "sha256-w33ViWpBkCkMAhZVXiOdqnGOn/tddNRgzn71WioTnBU=";
+    })
+    (fetchgit {
+      url = "git://git.proxmox.com/git/pxar.git";
+      rev = "6f3f889e98c5f4e60c3b2c6bce73bd506b548c21";
+      name = "pxar";
+      hash = "sha256-GtNq6+O1xnxuR7b4TTWLFxcsejRyadSlk85H8C+yUGA=";
+    })
+  ];
+
+  sourceRoot = pname;
+
+  cargoPatches = [
+    ./re-route-dependencies.patch
+  ];
+
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+    rm .cargo/config
+  '';
+
+  cargoLock = {
+    lockFileContents = builtins.readFile ./Cargo.lock;
+  };
+
+  cargoBuildFlags = [
+    "--package=proxmox-backup-client"
+    "--bin=proxmox-backup-client"
+    "--bin=dump-catalog-shell-cli"
+
+    "--package=pxar-bin"
+    "--bin=pxar"
+  ];
+
+  doCheck = false;
+
+  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];
+  buildInputs = [ openssl fuse3 libuuid acl libxcrypt ];
+
+  meta = with lib; {
+    description = "The command line client for Proxmox Backup Server";
+    homepage = "https://pbs.proxmox.com/docs/backup-client.html";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ cofob ];
+    platforms = platforms.linux;
+  };
+}

third_party/nixpkgs/pkgs/applications/backup/proxmox-backup-client/re-route-dependencies.patch

@@ -0,0 +1,148 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Thomas Lamprecht <thomas@lamprecht.org>
+Date: Wed, 18 May 2022 08:41:14 +0200
+Subject: [PATCH] re-route dependencies not available on crates.io to git repos
+
+Signed-off-by: Thomas Lamprecht <thomas@lamprecht.org>
+---
+ Cargo.toml    | 112 +++++++-------------------------------------------
+ 1 file changed, 15 insertions(+), 97 deletions(-)
+
+diff --git a/Cargo.toml b/Cargo.toml
+index 41980292..e7daaad5 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -25,94 +25,12 @@ members = [
+     "pbs-config",
+     "pbs-datastore",
+     "pbs-fuse-loop",
+-    "proxmox-rest-server",
+-    "proxmox-rrd",
+-    "pbs-tape",
+     "pbs-tools",
+ 
+-    "proxmox-backup-banner",
+     "proxmox-backup-client",
+-    "proxmox-file-restore",
+-    "proxmox-restore-daemon",
+     "pxar-bin",
+ ]
+ 
+-[lib]
+-name = "proxmox_backup"
+-path = "src/lib.rs"
+-
+-[dependencies]
+-apt-pkg-native = "0.3.2"
+-base64 = "0.13"
+-bitflags = "1.2.1"
+-bytes = "1.0"
+-cidr = "0.2.1"
+-crc32fast = "1"
+-endian_trait = { version = "0.6", features = ["arrays"] }
+-flate2 = "1.0"
+-anyhow = "1.0"
+-thiserror = "1.0"
+-futures = "0.3"
+-h2 = { version = "0.3", features = [ "stream" ] }
+-handlebars = "3.0"
+-hex = "0.4.3"
+-http = "0.2"
+-hyper = { version = "0.14", features = [ "full" ] }
+-lazy_static = "1.4"
+-libc = "0.2"
+-log = "0.4.17"
+-nix = "0.19.1"
+-num-traits = "0.2"
+-once_cell = "1.3.1"
+-openssl = "0.10.38" # currently patched!
+-pam = "0.7"
+-pam-sys = "0.5"
+-percent-encoding = "2.1"
+-regex = "1.5.5"
+-rustyline = "7"
+-serde = { version = "1.0", features = ["derive"] }
+-serde_json = "1.0"
+-siphasher = "0.3"
+-syslog = "4.0"
+-tokio = { version = "1.6", features = [ "fs", "io-util", "io-std", "macros", "net", "parking_lot", "process", "rt", "rt-multi-thread", "signal", "time" ] }
+-tokio-openssl = "0.6.1"
+-tokio-stream = "0.1.0"
+-tokio-util = { version = "0.6", features = [ "codec", "io" ] }
+-tower-service = "0.3.0"
+-udev = "0.4"
+-url = "2.1"
+-#valgrind_request = { git = "https://github.com/edef1c/libvalgrind_request", version = "1.1.0", optional = true }
+-walkdir = "2"
+-xdg = "2.2"
+-nom = "5.1"
+-crossbeam-channel = "0.5"
+-
+-# Used only by examples currently:
+-zstd = { version = "0.6", features = [ "bindgen" ] }
+-
+-pathpatterns = "0.1.2"
+-pxar = { version = "0.10.1", features = [ "tokio-io" ] }
+-
+-proxmox-http = { version = "0.6.1", features = [ "client", "http-helpers", "websocket" ] }
+-proxmox-io = "1"
+-proxmox-lang = "1.1"
+-proxmox-router = { version = "1.2.2", features = [ "cli" ] }
+-proxmox-schema = { version = "1.3.1", features = [ "api-macro" ] }
+-proxmox-section-config = "1"
+-proxmox-tfa = { version = "2", features = [ "api", "api-types" ] }
+-proxmox-time = "1.1.2"
+-proxmox-uuid = "1"
+-proxmox-serde = "0.1"
+-proxmox-shared-memory = "0.2"
+-proxmox-sys = { version = "0.2", features = [ "sortable-macro" ] }
+-proxmox-compression = "0.1"
+-
+-
+-proxmox-acme-rs = "0.4"
+-proxmox-apt = "0.8.0"
+-proxmox-async = "0.4"
+-proxmox-openid = "0.9.0"
+-
+ pbs-api-types = { path = "pbs-api-types" }
+ pbs-buildcfg = { path = "pbs-buildcfg" }
+ pbs-client = { path = "pbs-client" }
+@@ -126,22 +44,23 @@ pbs-tape = { path = "pbs-tape" }
+ # Local path overrides
+ # NOTE: You must run `cargo update` after changing this for it to take effect!
+ [patch.crates-io]
+-#proxmox = { path = "../proxmox/proxmox" }
+-#proxmox-async = { path = "../proxmox/proxmox-async" }
+-#proxmox-borrow = { path = "../proxmox/proxmox-borrow" }
+-#proxmox-fuse = { path = "../proxmox-fuse" }
+-#proxmox-http = { path = "../proxmox/proxmox-http" }
+-#proxmox-io = { path = "../proxmox/proxmox-io" }
+-#proxmox-lang = { path = "../proxmox/proxmox-lang" }
+-#proxmox-router = { path = "../proxmox/proxmox-router" }
+-#proxmox-schema = { path = "../proxmox/proxmox-schema" }
+-#proxmox-section-config = { path = "../proxmox/proxmox-section-config" }
+-#proxmox-shared-memory = { path = "../proxmox/proxmox-shared-memory" }
+-#proxmox-sys = { path = "../proxmox/proxmox-sys" }
++proxmox-async = { path = "../proxmox/proxmox-async" }
++proxmox-compression = { path = "../proxmox/proxmox-compression" }
++proxmox-borrow = { path = "../proxmox/proxmox-borrow" }
++proxmox-fuse = { path = "../proxmox-fuse" }
++proxmox-http = { path = "../proxmox/proxmox-http" }
++proxmox-io = { path = "../proxmox/proxmox-io" }
++proxmox-lang = { path = "../proxmox/proxmox-lang" }
++proxmox-router = { path = "../proxmox/proxmox-router" }
++proxmox-schema = { path = "../proxmox/proxmox-schema" }
++proxmox-section-config = { path = "../proxmox/proxmox-section-config" }
++proxmox-serde = { path = "../proxmox/proxmox-serde" }
++proxmox-shared-memory = { path = "../proxmox/proxmox-shared-memory" }
++proxmox-sys = { path = "../proxmox/proxmox-sys" }
+ #proxmox-tfa = { path = "../proxmox/proxmox-tfa" }
+-#proxmox-time = { path = "../proxmox/proxmox-time" }
+-#proxmox-uuid = { path = "../proxmox/proxmox-uuid" }
+-#pxar = { path = "../pxar" }
++proxmox-time = { path = "../proxmox/proxmox-time" }
++proxmox-uuid = { path = "../proxmox/proxmox-uuid" }
++pxar = { path = "../pxar" }
+ 
+ [features]
+ default = []

third_party/nixpkgs/pkgs/applications/backup/timeshift/unwrapped.nix

@@ -72,6 +72,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/linuxmint/timeshift";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ShamrockLee ];
+    maintainers = with maintainers; [ ShamrockLee bobby285271 ];
   };
 }

third_party/nixpkgs/pkgs/applications/blockchains/bisq-desktop/default.nix

@@ -34,11 +34,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bisq-desktop";
-  version = "1.9.5";
+  version = "1.9.6";
 
   src = fetchurl {
     url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
-    sha256 = "1jmhngxyn2yf7k1dn98yr9d20jlvkmskbpzz5kbzci36v2wfmjrp";
+    sha256 = "02j6n693lhfn9x8kaz253xm76zzsdz8h10rkyxnlqiwwbn1wnmsa";
   };
 
   nativeBuildInputs = [ makeWrapper copyDesktopItems imagemagick dpkg zip xz ];

third_party/nixpkgs/pkgs/applications/blockchains/groestlcoin/default.nix

@@ -10,7 +10,7 @@
 , wrapQtAppsHook ? null
 , boost
 , libevent
-, miniupnpc_2
+, miniupnpc
 , zeromq
 , zlib
 , db53
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [ autoSignDarwinBinariesHook ]
     ++ lib.optionals withGui [ wrapQtAppsHook ];
 
-  buildInputs = [ boost libevent miniupnpc_2 zeromq zlib ]
+  buildInputs = [ boost libevent miniupnpc zeromq zlib ]
     ++ lib.optionals withWallet [ db53 sqlite ]
     ++ lib.optionals withGui [ qrencode qtbase qttools ];
 

third_party/nixpkgs/pkgs/applications/blockchains/lnd/default.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.15.2-beta";
+  version = "0.15.4-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    sha256 = "sha256-C7BZ6awY2v5Uvvh12YEosoEQyJoetWzH/1wIQSVjtEk=";
+    sha256 = "sha256-/PKW2Y6+PlWk88pC4DHFi1ZRqMfQzoO9MVLYZrB2UNc=";
   };
 
-  vendorSha256 = "sha256-rCdcPkgrFcDfLfF8wipFws7YTKEgotuVqVIJYLMOxbs=";
+  vendorSha256 = "sha256-bUo0PhtOFhsZfhAXtRJMjfaLrAsOv3ksxsrPOlMNv48=";
 
   subPackages = [ "cmd/lncli" "cmd/lnd" ];
 

third_party/nixpkgs/pkgs/applications/blockchains/wownero/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitea, cmake, boost, miniupnpc_2, openssl, unbound
+{ lib, stdenv, fetchFromGitea, cmake, boost, miniupnpc, openssl, unbound
 , readline, libsodium, rapidjson
 }:
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [
-    boost miniupnpc_2 openssl unbound rapidjson readline libsodium
+    boost miniupnpc openssl unbound rapidjson readline libsodium
   ];
 
   postUnpack = ''

third_party/nixpkgs/pkgs/applications/blockchains/zcash/default.nix

@@ -1,17 +1,17 @@
-{ autoreconfHook, boost179, cargo, coreutils, curl, cxx-rs, db62, fetchFromGitHub
+{ autoreconfHook, boost180, cargo, coreutils, curl, cxx-rs, db62, fetchFromGitHub
-, hexdump, lib, libevent, libsodium, makeWrapper, rust, rustPlatform, pkg-config
+, hexdump, hostPlatform, lib, libevent, libsodium, makeWrapper, rust, rustPlatform
-, stdenv, testers, utf8cpp, util-linux, zcash, zeromq
+, pkg-config, Security, stdenv, testers, utf8cpp, util-linux, zcash, zeromq
 }:
 
 rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
   pname = "zcash";
-  version = "5.1.0";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "zcash";
     repo  = "zcash";
     rev = "v${version}";
-    sha256 = "sha256-tU6DuWpe8Vlx0qIilAKWuO7WFp1ucbxtvOxoWLA0gdc=";
+    hash = "sha256-mlABKZDYYC3y+KlXQVFqdcm46m8K9tbOCqk4lM4shp8=";
   };
 
   prePatch = lib.optionalString stdenv.isAarch64 ''
@@ -20,15 +20,20 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
       --replace "linker = \"aarch64-linux-gnu-gcc\"" ""
   '';
 
-  patches = [
+  cargoHash = "sha256-6uhtOaBsgMw59Dy6yivZYUEWDsYfpInA7VmJrqxDS/4=";
-    ./patches/fix-missing-header.patch
-  ];
-
-  cargoSha256 = "sha256-ZWmkveDEENdXRirGmnUWSjtPNJvX0Jpgfxhzk44F7Q0=";
 
   nativeBuildInputs = [ autoreconfHook cargo cxx-rs hexdump makeWrapper pkg-config ];
 
-  buildInputs = [ boost179 db62 libevent libsodium utf8cpp zeromq ];
+  buildInputs = [
+    boost180
+    db62
+    libevent
+    libsodium
+    utf8cpp
+    zeromq
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
+  ];
 
   # Use the stdenv default phases (./configure; make) instead of the
   # ones from buildRustPackage.
@@ -50,7 +55,7 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
 
   configureFlags = [
     "--disable-tests"
-    "--with-boost-libdir=${lib.getLib boost179}/lib"
+    "--with-boost-libdir=${lib.getLib boost180}/lib"
     "RUST_TARGET=${rust.toRustTargetSpec stdenv.hostPlatform}"
   ];
 
@@ -75,5 +80,8 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
     homepage = "https://z.cash/";
     maintainers = with maintainers; [ rht tkerber centromere ];
     license = licenses.mit;
+
+    # https://github.com/zcash/zcash/issues/4405
+    broken = hostPlatform.isAarch64 && hostPlatform.isDarwin;
   };
 }

third_party/nixpkgs/pkgs/applications/blockchains/zcash/patches/fix-missing-header.patch

@@ -1,10 +0,0 @@
---- a/src/uint256.h	2022-07-20 10:07:39.191319302 +0000
-+++ b/src/uint256.h	2022-07-20 10:07:11.809632293 +0000
-@@ -7,6 +7,7 @@
- #ifndef BITCOIN_UINT256_H
- #define BITCOIN_UINT256_H
-
-+#include <array>
- #include <assert.h>
- #include <cstring>
- #include <stdexcept>

third_party/nixpkgs/pkgs/applications/display-managers/lightdm-slick-greeter/default.nix

@@ -104,7 +104,7 @@ stdenv.mkDerivation rec {
     description = "A slick-looking LightDM greeter";
     homepage = "https://github.com/linuxmint/slick-greeter";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ water-sucks ];
+    maintainers = with maintainers; [ water-sucks bobby285271 ];
     platforms = platforms.linux;
   };
 }

third_party/nixpkgs/pkgs/applications/editors/nedit/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, xlibsWrapper, motif, libXpm }:
+{ lib, stdenv, fetchurl, motif, libXpm, libXt }:
 
 stdenv.mkDerivation rec {
   pname = "nedit";
@@ -11,8 +11,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  nativeBuildInputs = [ xlibsWrapper ];
+  buildInputs = [ motif libXpm libXt ];
-  buildInputs = [ motif libXpm ];
 
   # the linux config works fine on darwin too!
   buildFlags = lib.optional (stdenv.isLinux || stdenv.isDarwin) "linux";

third_party/nixpkgs/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix

@@ -0,0 +1,38 @@
+{ lib, callPackage, tree-sitter, nodejs }:
+
+self: super:
+
+let
+  builtGrammars = callPackage ./generated.nix {
+    buildGrammar = callPackage ../../../../../development/tools/parsing/tree-sitter/grammar.nix { };
+  };
+
+  allGrammars = lib.filter lib.isDerivation (lib.attrValues builtGrammars);
+
+  # Usage:
+  # pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [ p.c p.java ... ])
+  # or for all grammars:
+  # pkgs.vimPlugins.nvim-treesitter.withAllGrammars
+  withPlugins =
+    grammarFn: self.nvim-treesitter.overrideAttrs (_: {
+      postPatch =
+        let
+          grammars = tree-sitter.withPlugins (ps: grammarFn (ps // builtGrammars));
+        in
+        ''
+          rm -r parser
+          ln -s ${grammars} parser
+        '';
+    });
+in
+
+{
+  passthru = {
+    inherit builtGrammars allGrammars withPlugins;
+
+    tests.builtGrammars = lib.recurseIntoAttrs builtGrammars;
+
+    withAllGrammars = withPlugins (_: allGrammars);
+  };
+}
+

third_party/nixpkgs/pkgs/applications/editors/vim/plugins/nvim-treesitter/update-shell.nix

@@ -0,0 +1,17 @@
+{ pkgs ? import ../../../../../.. { } }:
+
+with pkgs;
+
+let
+  inherit (vimPlugins) nvim-treesitter;
+
+  neovim = pkgs.neovim.override {
+    configure.packages.all.start = [ nvim-treesitter ];
+  };
+in
+
+mkShell {
+  packages = [ neovim nix-prefetch python3 ];
+
+  NVIM_TREESITTER = nvim-treesitter;
+}

third_party/nixpkgs/pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py

@@ -0,0 +1,123 @@
+#!/usr/bin/env nix-shell
+#!nix-shell update-shell.nix -i python
+
+import json
+import re
+import subprocess
+from os import getenv
+from os.path import dirname, join
+
+lockfile = json.load(open(join(getenv("NVIM_TREESITTER"), "lockfile.json")))
+
+configs = json.loads(
+    subprocess.check_output(
+        [
+            "nvim",
+            "--headless",
+            "-u",
+            "NONE",
+            "+lua io.write(vim.json.encode(require('nvim-treesitter.parsers').get_parser_configs()))",
+            "+quit!",
+        ]
+    )
+)
+
+regex = re.compile("^https?://(github.com|gitlab.com)/(.+?)/(.+?)(.git)?$")
+
+
+def generate_grammar(item):
+    lang, lock = item
+    cfg = configs.get(lang)
+    if not cfg:
+        return ""
+
+    info = cfg["install_info"]
+    url = info["url"]
+    rev = lock["revision"]
+
+    generated = f"""  {lang} = buildGrammar {{
+    language = "{lang}";
+    version = "{rev[:7]}";
+    source = """
+
+    m = regex.fullmatch(url)
+    cmd = ["nix-prefetch", "--rev", rev]
+
+    match m and m.group(1, 2, 3):
+        case "github.com", owner, repo:
+            cmd += [
+                "fetchFromGitHub",
+                "--owner",
+                owner,
+                "--repo",
+                repo,
+            ]
+
+            generated += f"""fetchFromGitHub {{
+      owner = "{owner}";
+      repo = "{repo}";"""
+
+        case "gitlab.com", owner, repo:
+            cmd += [
+                "fetchFromGitLab",
+                "--owner",
+                owner,
+                "--repo",
+                repo,
+            ]
+
+            generated += f"""fetchFromGitLab {{
+      owner = "{owner}";
+      repo = "{repo}";"""
+
+        case _:
+            cmd += ["fetchgit", "url"]
+            generated += f"""fetchgit {{
+      url = "{url}";"""
+
+    if info.get("requires_generate_from_grammar"):
+        cmd += [
+            "--arg",
+            "nativeBuildInputs",
+            "[ nodejs tree-sitter ]",
+            "--postFetch",
+            "pushd $out && tree-sitter generate && popd",
+        ]
+
+        generated += """
+      nativeBuildInputs = [ nodejs tree-sitter ];
+      postFetch = "pushd $out && tree-sitter generate && popd";"""
+
+    hash = subprocess.check_output(cmd, text=True).strip()
+
+    generated += f"""
+      rev = "{rev}";
+      hash = "{hash}";
+    }};"""
+
+    location = info.get("location")
+    if location:
+        generated += f"""
+    location = "{location}";
+"""
+
+    generated += """
+  };
+"""
+
+    return generated
+
+
+generated_file = """# generated by pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py
+
+{ buildGrammar, fetchFromGitHub, fetchFromGitLab, fetchgit, nodejs, tree-sitter }:
+
+{
+"""
+
+for generated in map(generate_grammar, lockfile.items()):
+    generated_file += generated
+
+generated_file += "}\n"
+
+open(join(dirname(__file__), "generated.nix"), "w").write(generated_file)

third_party/nixpkgs/pkgs/applications/editors/vim/plugins/overrides.nix

@@ -67,7 +67,7 @@
 , CoreServices
 
   # nvim-treesitter dependencies
-, tree-sitter
+, callPackage
 
   # sved dependencies
 , glib
@@ -652,23 +652,9 @@ self: super: {
     dependencies = with self; [ plenary-nvim ];
   });
 
-  # Usage:
+  nvim-treesitter = super.nvim-treesitter.overrideAttrs (old:
-  # pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [ p.tree-sitter-c p.tree-sitter-java ... ])
+    callPackage ./nvim-treesitter/overrides.nix { } self super
-  # or for all grammars:
+  );
-  # pkgs.vimPlugins.nvim-treesitter.withPlugins (_: tree-sitter.allGrammars)
-  nvim-treesitter = super.nvim-treesitter.overrideAttrs (old: {
-    passthru.withPlugins =
-      grammarFn: self.nvim-treesitter.overrideAttrs (_: {
-        postPatch =
-          let
-            grammars = tree-sitter.withPlugins grammarFn;
-          in
-          ''
-            rm -r parser
-            ln -s ${grammars} parser
-          '';
-      });
-  });
 
   octo-nvim = super.octo-nvim.overrideAttrs (old: {
     dependencies = with self; [ telescope-nvim plenary-nvim ];

third_party/nixpkgs/pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1047,6 +1047,7 @@ https://github.com/milkypostman/vim-togglelist/,,
 https://github.com/cespare/vim-toml/,,
 https://github.com/vimpostor/vim-tpipeline/,,
 https://github.com/bronson/vim-trailing-whitespace/,,
+https://github.com/tridactyl/vim-tridactyl/,HEAD,
 https://github.com/ianks/vim-tsx/,,
 https://github.com/lumiliet/vim-twig/,,
 https://github.com/sodapopcan/vim-twiggy/,,

third_party/nixpkgs/pkgs/applications/editors/vscode/extensions/default.nix

@@ -1469,8 +1469,8 @@ let
         mktplcRef = {
           name = "nix-ide";
           publisher = "jnoortheen";
-          version = "0.1.23";
+          version = "0.2.1";
-          sha256 = "sha256-64gwwajfgniVzJqgVLK9b8PfkNG5mk1W+qewKL7Dv0Q=";
+          sha256 = "sha256-yC4ybThMFA2ncGhp8BYD7IrwYiDU3226hewsRvJYKy4=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";

third_party/nixpkgs/pkgs/applications/editors/xed-editor/default.nix

@@ -63,6 +63,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/linuxmint/xed";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ tu-maurice ];
+    maintainers = with maintainers; [ tu-maurice bobby285271 ];
   };
 }

third_party/nixpkgs/pkgs/applications/emulators/bochs/default.nix

@@ -1,26 +1,26 @@
 { lib
 , stdenv
 , fetchurl
+, SDL2
+, curl
 , docbook_xml_dtd_45
 , docbook_xsl
-, libtool
+, gtk3
-, pkg-config
-, curl
-, readline
-, wget
-, libobjc
-, enableX11 ? !stdenv.isDarwin
 , libGL
 , libGLU
 , libX11
 , libXpm
-, enableSdl2 ? true
+, libobjc
-, SDL2
+, libtool
-, enableTerm ? true
 , ncurses
-, enableWx ? !stdenv.isDarwin
+, pkg-config
+, readline
+, wget
 , wxGTK
-, gtk3
+, enableSDL2 ? true
+, enableTerm ? true
+, enableWx ? !stdenv.isDarwin
+, enableX11 ? !stdenv.isDarwin
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "2.7";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/${finalAttrs.pname}/${finalAttrs.pname}/${finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
+    url = "mirror://sourceforge/project/bochs/bochs/${finalAttrs.version}/bochs-${finalAttrs.version}.tar.gz";
     hash = "sha256-oBCrG/3HKsWgjS4kEs1HHA/r1mrx2TSbwNeWh53lsXo=";
   };
 
@@ -43,20 +43,20 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     readline
     wget
-  ] ++ lib.optionals stdenv.isDarwin [
+  ] ++ lib.optionals enableSDL2 [
-    libobjc
+    SDL2
+  ] ++ lib.optionals enableTerm [
+    ncurses
+  ] ++ lib.optionals enableWx [
+    gtk3
+    wxGTK
   ] ++ lib.optionals enableX11 [
     libGL
     libGLU
     libX11
     libXpm
-  ] ++ lib.optionals enableSdl2 [
+  ] ++ lib.optionals stdenv.isDarwin [
-    SDL2
+    libobjc
-  ] ++ lib.optionals enableTerm [
-    ncurses
-  ] ++ lib.optionals enableWx [
-    wxGTK
-    gtk3
   ];
 
   configureFlags = [
@@ -114,6 +114,15 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-voodoo"
     "--enable-x86-64"
     "--enable-x86-debugger"
+  ] ++ lib.optionals enableSDL2 [
+    "--with-sdl2"
+  ] ++ lib.optionals enableTerm [
+    "--with-term"
+  ] ++ lib.optionals enableWx [
+    "--with-wx"
+  ] ++ lib.optionals enableX11 [
+    "--with-x"
+    "--with-x11"
   ] ++ lib.optionals (!stdenv.isDarwin) [
     "--enable-e1000"
     "--enable-es1370"
@@ -121,15 +130,6 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-plugins"
     "--enable-pnic"
     "--enable-sb16"
-  ] ++ lib.optionals enableX11 [
-    "--with-x"
-    "--with-x11"
-  ] ++ lib.optionals enableSdl2 [
-    "--with-sdl2"
-  ] ++ lib.optionals enableTerm [
-    "--with-term"
-  ] ++ lib.optionals enableWx [
-    "--with-wx"
   ];
 
   enableParallelBuilding = true;

third_party/nixpkgs/pkgs/applications/emulators/cemu/cmakelists.patch

@@ -0,0 +1,12 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 4b2b789..48d9be0 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -92,6 +92,7 @@ find_package(pugixml REQUIRED)
+ find_package(RapidJSON REQUIRED)
+ find_package(Boost COMPONENTS program_options filesystem nowide REQUIRED)
+ find_package(libzip REQUIRED)
++find_package(SPIRV-Tools-opt REQUIRED)
+ find_package(glslang REQUIRED)
+ find_package(ZLIB REQUIRED)
+ find_package(zstd MODULE REQUIRED) # MODULE so that zstd::zstd is available

third_party/nixpkgs/pkgs/applications/emulators/cemu/default.nix

@@ -0,0 +1,119 @@
+{ lib, stdenv, fetchFromGitHub
+, addOpenGLRunpath
+, wrapGAppsHook
+, cmake
+, glslang
+, nasm
+, pkg-config
+
+, SDL2
+, boost
+, cubeb
+, curl
+, fmt_9
+, glm
+, gtk3
+, imgui
+, libpng
+, libzip
+, libXrender
+, pugixml
+, rapidjson
+, vulkan-headers
+, wxGTK32
+, zarchive
+
+, vulkan-loader
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cemu";
+  version = "2.0-10";
+
+  src = fetchFromGitHub {
+    owner = "cemu-project";
+    repo = "Cemu";
+    rev = "v${version}";
+    hash = "sha256-GJA/lJJqShuHeYirBW1kyVsU44kMpmAn916PSGOnKkY=";
+  };
+
+  patches = [
+    # glslangTargets want SPIRV-Tools-opt to be defined:
+    # > The following imported targets are referenced, but are missing:
+    # > SPIRV-Tools-opt
+    ./cmakelists.patch
+  ];
+
+  nativeBuildInputs = [
+    addOpenGLRunpath
+    wrapGAppsHook
+    cmake
+    glslang
+    nasm
+    pkg-config
+  ];
+
+  buildInputs = [
+    SDL2
+    boost
+    cubeb
+    curl
+    fmt_9
+    glm
+    gtk3
+    imgui
+    libpng
+    libzip
+    libXrender
+    pugixml
+    rapidjson
+    vulkan-headers
+    wxGTK32
+    zarchive
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_C_FLAGS_RELEASE=-DNDEBUG"
+    "-DCMAKE_CXX_FLAGS_RELEASE=-DNDEBUG"
+    "-DENABLE_VCPKG=OFF"
+
+    # PORTABLE:
+    # "All data created and maintained by Cemu will be in the directory where the executable file is located"
+    "-DPORTABLE=OFF"
+  ];
+
+  preConfigure = ''
+    rm -rf dependencies/imgui
+    ln -s ${imgui}/include/imgui dependencies/imgui
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 ../bin/Cemu_release $out/bin/Cemu
+    ln -s $out/bin/Cemu $out/bin/cemu
+
+    mkdir -p $out/share/applications
+    substitute ../dist/linux/info.cemu.Cemu.desktop $out/share/applications/info.cemu.Cemu.desktop \
+      --replace "Exec=Cemu" "Exec=$out/bin/Cemu"
+
+    install -Dm644 ../dist/linux/info.cemu.Cemu.metainfo.xml -t $out/share/metainfo
+    install -Dm644 ../src/resource/logo_icon.png $out/share/icons/hicolor/128x128/apps/info.cemu.Cemu.png
+
+    runHook postInstall
+  '';
+
+  preFixup = let
+    libs = [ vulkan-loader ] ++ cubeb.passthru.backendLibs;
+  in ''
+    gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath libs}")
+  '';
+
+  meta = with lib; {
+    description = "Cemu is a Wii U emulator";
+    homepage = "https://cemu.info";
+    license = licenses.mpl20;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ zhaofengli baduhai ];
+  };
+}

third_party/nixpkgs/pkgs/applications/emulators/mame/default.nix

@@ -1,9 +1,11 @@
 { lib
 , stdenv
 , alsa-lib
+, copyDesktopItems
 , CoreAudioKit
 , expat
 , fetchFromGitHub
+, fetchurl
 , flac
 , fontconfig
 , ForceFeedback
@@ -33,14 +35,11 @@
 }:
 
 let
-  desktopItem = makeDesktopItem {
+  # Get icon from Arch Linux package
-    name = "MAME";
+  icon = fetchurl {
-    exec = "mame${lib.optionalString stdenv.is64bit "64"}";
+    url = "https://raw.githubusercontent.com/archlinux/svntogit-community/614b24ef3856cb52b5cafc386b0f77923cbc9156/trunk/mame.svg";
-    desktopName = "MAME";
+    sha256 = "sha256-F8RCyTPXZBdeTOHeUKgMDC3dXXM8rwnDzV5rppesQ/Q=";
-    genericName = "MAME is a multi-purpose emulation framework";
-    categories = [ "System" "Emulator" ];
   };
-
   dest = "$out/opt/mame";
 in
 stdenv.mkDerivation rec {
@@ -54,8 +53,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-im6y/E0pQxruX2kNXZLE3fHq+zXfsstnOoC1QvH4fd4=";
   };
 
-  hardeningDisable = [ "fortify" ];
-
   makeFlags = [
     "CC=${stdenv.cc.targetPrefix}cc"
     "CXX=${stdenv.cc.targetPrefix}c++"
@@ -97,7 +94,14 @@ stdenv.mkDerivation rec {
   ++ lib.optionals stdenv.isLinux [ alsa-lib libpulseaudio libXinerama libXi fontconfig ]
   ++ lib.optionals stdenv.isDarwin [ libpcap CoreAudioKit ForceFeedback ];
 
-  nativeBuildInputs = [ python3 pkg-config which makeWrapper installShellFiles ];
+  nativeBuildInputs = [
+    copyDesktopItems
+    installShellFiles
+    makeWrapper
+    pkg-config
+    python3
+    which
+  ];
 
   patches = [
     # MAME is now generating the PDF documentation on its release script since commit:
@@ -116,7 +120,23 @@ stdenv.mkDerivation rec {
       --subst-var-by mame ${dest}
   '';
 
+  desktopItems = [
+    (makeDesktopItem {
+      name = "MAME";
+      desktopName = "MAME";
+      exec = "mame";
+      icon = "mame";
+      type = "Application";
+      genericName = "MAME is a multi-purpose emulation framework";
+      comment = "Play vintage games using the MAME emulator";
+      categories = [ "Game" "Emulator" ];
+      keywords = [ "Game" "Emulator" "Arcade" ];
+    })
+  ];
+
   installPhase = ''
+    runHook preInstall
+
     make -f dist.mak PTR64=${lib.optionalString stdenv.is64bit "1"}
     mkdir -p ${dest}
     mv build/release/*/Release/mame/* ${dest}
@@ -126,11 +146,11 @@ stdenv.mkDerivation rec {
     install -Dm755 src/osd/sdl/taputil.sh $out/bin/taputil.sh
 
     installManPage ${dest}/docs/man/*.1 ${dest}/docs/man/*.6
+    install -Dm644 ${icon} $out/share/icons/hicolor/scalable/apps/mame.svg
 
     mv artwork plugins samples ${dest}
-  '' + lib.optionalString stdenv.isLinux ''
+
-    mkdir -p $out/share
+    runHook postInstall
-    ln -s ${desktopItem}/share/applications $out/share
   '';
 
   enableParallelBuilding = true;
@@ -146,7 +166,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    broken = stdenv.isDarwin;
     description = "Is a multi-purpose emulation framework";
     homepage = "https://www.mamedev.org/";
     license = with licenses; [ bsd3 gpl2Plus ];

third_party/nixpkgs/pkgs/applications/emulators/mgba/default.nix

@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , SDL2
 , cmake
-, copyDesktopItems
 , ffmpeg
 , imagemagick
 , libedit
@@ -11,7 +10,6 @@
 , libepoxy
 , libzip
 , lua
-, makeDesktopItem
 , minizip
 , pkg-config
 , qtbase
@@ -33,7 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    copyDesktopItems
     pkg-config
     wrapQtAppsHook
   ];
@@ -53,19 +50,6 @@ stdenv.mkDerivation (finalAttrs: {
     qttools
   ];
 
-  desktopItems = [
-    (makeDesktopItem {
-      name = "mgba";
-      exec = "mgba-qt";
-      icon = "mgba";
-      comment = "A Game Boy Advance Emulator";
-      desktopName = "mgba";
-      genericName = "Game Boy Advance Emulator";
-      categories = [ "Game" "Emulator" ];
-      startupNotify = false;
-    })
-  ];
-
   meta = with lib; {
     homepage = "https://mgba.io";
     description = "A modern GBA emulator with a focus on accuracy";

third_party/nixpkgs/pkgs/applications/graphics/hydrus/default.nix

@@ -1,7 +1,7 @@
 { lib
 , fetchFromGitHub
 , wrapQtAppsHook
-, miniupnpc_2
+, miniupnpc
 , ffmpeg
 , enableSwftools ? false
 , swftools
@@ -108,7 +108,7 @@ python3Packages.buildPythonPackage rec {
   dontWrapQtApps = true;
   preFixup = ''
     makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ ffmpeg miniupnpc_2 ]})
+    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ ffmpeg miniupnpc ]})
   '';
 
   meta = with lib; {

third_party/nixpkgs/pkgs/applications/graphics/inkscape/default.nix

@@ -5,6 +5,7 @@
 , cairo
 , cmake
 , fetchurl
+, fetchpatch
 , gettext
 , ghostscript
 , glib
@@ -78,6 +79,12 @@ stdenv.mkDerivation rec {
       # e.g., those from the "Effects" menu.
       python3 = "${python3Env}/bin/python";
     })
+
+    # Fix build with Poppler 22.09
+    (fetchpatch {
+      url = "https://github.com/archlinux/svntogit-packages/raw/b2f65dfb60ae0c8cd6cd9affd3d71064082a6201/trunk/inkscape-1.2.1-poppler-22.09.0.patch";
+      sha256 = "pArvsS/qoCTMAisF8yj3agZKrb90zRFZkck1TX0KeGc=";
+    })
   ];
 
   postPatch = ''

third_party/nixpkgs/pkgs/applications/graphics/rnote/default.nix

@@ -3,6 +3,8 @@
 , fetchFromGitHub
 , alsa-lib
 , appstream-glib
+, clang
+, cmake
 , desktop-file-utils
 , gio-sharp
 , glib
@@ -22,24 +24,26 @@
 
 stdenv.mkDerivation rec {
   pname = "rnote";
-  version = "0.5.4";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "flxzt";
     repo = "rnote";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-CZLZblC10k5ynzDDXi/bOe6Rc6M94eywXjyu0ABOVq4=";
+    hash = "sha256-w4y+t8idcaNwvC2Wp9SRjcd4m23Zt+yHG2fjOA2rBU8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-Udat35KqrMWR0Ckx34BWoF0HiJHZ5CP2CGFD6FNCWRA=";
+    hash = "sha256-Hybbbokru4vz5ly3oZuNGdBa+lYbhdYjESUpRxIUqJc=";
   };
 
   nativeBuildInputs = [
     appstream-glib # For appstream-util
+    clang
+    cmake
     desktop-file-utils # For update-desktop-database
     meson
     ninja
@@ -52,6 +56,8 @@ stdenv.mkDerivation rec {
     wrapGAppsHook4
   ];
 
+  dontUseCmakeConfigure = true;
+
   buildInputs = [
     alsa-lib
     gio-sharp
@@ -63,6 +69,8 @@ stdenv.mkDerivation rec {
     poppler
   ];
 
+  LIBCLANG_PATH = "${clang.cc.lib}/lib";
+
   postPatch = ''
     pushd build-aux
     chmod +x meson_post_install.py

third_party/nixpkgs/pkgs/applications/graphics/vengi-tools/default.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vengi-tools";
-  version = "0.0.21";
+  version = "0.0.22";
 
   src = fetchFromGitHub {
     owner = "mgerhardy";
     repo = "vengi";
     rev = "v${version}";
-    sha256 = "sha256-T9YBU/YhhOASdKnzLcwQGBLc4HcQspiOV9VRgotfq3c=";
+    sha256 = "sha256-OlOnr1Spy8kdie9CyLVOQkY1+ib6Uwcd/xP5TSaZkYg=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/misc/ausweisapp2/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "AusweisApp2";
-  version = "1.24.2";
+  version = "1.24.3";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = version;
-    sha256 = "sha256-p38zcTFbCyImiGVCr5o/QQ6BT8U2SMiHeYE3aTNYpJs=";
+    sha256 = "sha256-zwAmMj9Px27e/xJPAsOUh4saCZNQYBdse0bcZu8M3xA=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

third_party/nixpkgs/pkgs/applications/misc/darkman/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "darkman";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitLab {
     owner = "WhyNotHugo";
     repo = "darkman";
     rev = "v${version}";
-    sha256 = "09iwc9cwwc88c6yrf6a552nbsnf1w8cnlra9axsar2p0k21v5yl1";
+    sha256 = "sha256-Q/pjQmlyREl32C0LiwypEz1qBw2AeBOZbUIwNP392Sc=";
   };
 
   vendorSha256 = "09rjqw6v1jaf0mhmycw9mcay9q0y1fya2azj8216gdgkl48ics08";

third_party/nixpkgs/pkgs/applications/misc/gallery-dl/default.nix

@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.23.4";
+  version = "1.23.5";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-IpbV6wWIfRDuljX/Bexo9siFXMezeCRBFK5CzVH0vUU=";
+    sha256 = "sha256-NhnuW7rq5Dgrnkw/nUO/pFg/Sh2D/d9gFCIb+gQy5QE=";
   };
 
   propagatedBuildInputs = [

third_party/nixpkgs/pkgs/applications/misc/jgmenu/default.nix

@@ -11,17 +11,18 @@
 , enableXfcePanelApplet ? false
 , xfce
 , gtk3
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "jgmenu";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "johanmalm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-REzrN4tz+cFmKyJeOPOkzjvthsJdY3GButF7RdnzviE=";
+    sha256 = "sha256-UC92zyuMVjyMLNEOBMElO8wCWYgwWRZAGLEOdTPNMak=";
   };
 
   nativeBuildInputs = [
@@ -57,6 +58,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
   meta = with lib; {
     homepage = "https://github.com/johanmalm/jgmenu";
     description = "Small X11 menu intended to be used with openbox and tint2";

third_party/nixpkgs/pkgs/applications/misc/josm/default.nix

@@ -3,15 +3,15 @@
 }:
 let
   pname = "josm";
-  version = "18570";
+  version = "18583";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-EAEh/n7M56rzjtkIs8ZteDvOLuHxNsMyT7VGFyPre6s=";
+      hash = "sha256-6S6E7ngTCBXb0epPfYxIswLvfm9r2Ql0wgOs/PxpmIM=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java17.zip";
-      hash = "sha256-2xsHsaDxm/wjiCyS5tmD8uUlLrBdd3sS8JLal3pX3pA=";
+      hash = "sha256-3XEoSCXEpeqZj1y4nns5+0JR1SINYE1rsmQ4fMflxRQ=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";

third_party/nixpkgs/pkgs/applications/misc/keepassx/community.nix

@@ -40,13 +40,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "keepassxc";
-  version = "2.7.3";
+  version = "2.7.4";
 
   src = fetchFromGitHub {
     owner = "keepassxreboot";
     repo = "keepassxc";
     rev = version;
-    sha256 = "sha256-mtOnUB6+iBBqgPT5KKhEX4M7UUM3s5fT0OTePE6THXw=";
+    sha256 = "sha256-amedKK9nplLVJTldeabN3/c+g/QesrdH+qx+rba2/4s=";
   };
 
   NIX_CFLAGS_COMPILE = optionalString stdenv.cc.isClang [

third_party/nixpkgs/pkgs/applications/misc/lutris/fhsenv.nix

@@ -126,6 +126,15 @@ in buildFHSUserEnv {
     ln -sf ${lutris-unwrapped}/share/icons $out/share
   '';
 
+  # allows for some gui applications to share IPC
+  # this fixes certain issues where they don't render correctly
+  unshareIpc = false;
+
+  # Some applications such as Natron need access to MIT-SHM or other
+  # shared memory mechanisms. Unsharing the pid namespace
+  # breaks the ability for application to reference shared memory.
+  unsharePid = false;
+
   meta = {
     inherit (lutris-unwrapped.meta)
       homepage

third_party/nixpkgs/pkgs/applications/misc/metadata-cleaner/default.nix

@@ -18,22 +18,23 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "metadata-cleaner";
-  version = "2.2.3";
+  version = "2.2.5";
 
   format = "other";
 
   src = fetchFromGitLab {
     owner = "rmnvgr";
-    repo = "metadata-cleaner";
+    repo = pname;
     rev = "v${version}";
-    hash = "sha256-ykJd1ZjAqT8OtJsZiSjbDdkN5fFlQcWtTO88x3zAfU8=";
+    hash = "sha256-Yb5tCvhVg9p4v7++MmoaeQDyP1qdfpHM+IGj8BoacVs=";
   };
 
   nativeBuildInputs = [
     appstream
     desktop-file-utils
-    glib
+    glib # glib-compile-resources
-    gtk4
+    gtk4 # gtk4-update-icon-cache
+    gobject-introspection
     itstool
     meson
     ninja
@@ -42,7 +43,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    gobject-introspection
+    glib
     gtk4
     libadwaita
     librsvg

third_party/nixpkgs/pkgs/applications/misc/obsidian/default.nix

@@ -12,7 +12,7 @@
 let
   inherit (stdenv.hostPlatform) system;
   pname = "obsidian";
-  version = "1.0.0";
+  version = "1.0.3";
   appname = "Obsidian";
   meta = with lib; {
     description = "A powerful knowledge base that works on top of a local folder of plain text Markdown files";
@@ -25,7 +25,7 @@ let
   filename = if stdenv.isDarwin then "Obsidian-${version}-universal.dmg" else "obsidian-${version}.tar.gz";
   src = fetchurl {
     url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
-    sha256 = if stdenv.isDarwin then "sha256-KVWqdXzbQT93Dj4yesdnfFwAdYin1vfpPsj/ur1AGA0=" else "sha256-H1Cl9SBz/mwN8gezFkcV4KxI7+xVjQV2AtyLKyjVpI8=";
+    sha256 = if stdenv.isDarwin then "sha256-DYF9fEpZaP4tD/eeZAegDahR7UZyroqNB9bn2U7sgXs=" else "sha256-MpQk5g4184ZkCAjLU5Ug0ReWgVADskS1QuMcnPdNofs=";
   };
 
   icon = fetchurl {

third_party/nixpkgs/pkgs/applications/misc/passky-desktop/default.nix

@@ -2,16 +2,16 @@
 
 let
   pname = "passky-desktop";
-  version = "5.0.0";
+  version = "7.1.0";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://github.com/Rabbit-Company/Passky-Desktop/releases/download/v${version}/Passky-${version}.AppImage";
-      sha256 = "19sy9y2bcxrf10ifszinh4yn32q3032h3d1qxm046zffzl069807";
+      sha256 = "1xnhrmmm018mmyzjq05mhbf673f0n81fh1k3kbfarbgk2kbwpq6y";
     };
     x86_64-darwin = fetchurl {
       url = "https://github.com/Rabbit-Company/Passky-Desktop/releases/download/v${version}/Passky-${version}.dmg";
-      sha256 = "sha256-lclJOaYe+2XeKhJb2WcOAzjBMzK3YEmlS4rXuRUJYU0=";
+      sha256 = "0mm7hk4v7zvpjdqyw3nhk33x72j0gh3f59bx3q18azlm4dr61r2d";
     };
   };
   src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

third_party/nixpkgs/pkgs/applications/misc/sticky/default.nix

@@ -85,6 +85,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/linuxmint/sticky";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ linsui ];
+    maintainers = with maintainers; [ linsui bobby285271 ];
   };
 }

third_party/nixpkgs/pkgs/applications/misc/synergy/default.nix

@@ -26,6 +26,7 @@
 , avahi-compat
 
   # MacOS / darwin
+, darwin
 , ApplicationServices
 , Carbon
 , Cocoa
@@ -48,6 +49,7 @@ stdenv.mkDerivation rec {
   patches = [
     # Without this OpenSSL from nixpkgs is not detected
     ./darwin-non-static-openssl.patch
+  ] ++ lib.optionals (stdenv.isDarwin && !(darwin.apple_sdk.frameworks ? UserNotifications)) [
     # We cannot include UserNotifications because of a build failure in the Apple SDK.
     # The functions used from it are already implicitly included anyways.
     ./darwin-no-UserNotifications-includes.patch
@@ -76,6 +78,8 @@ stdenv.mkDerivation rec {
     Cocoa
     CoreServices
     ScreenSaver
+  ] ++ lib.optionals (stdenv.isDarwin && darwin.apple_sdk.frameworks ? UserNotifications) [
+    darwin.apple_sdk.frameworks.UserNotifications
   ] ++ lib.optionals stdenv.isLinux [
     util-linux
     libselinux
@@ -97,7 +101,8 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-inconsistent-missing-override";
 
   cmakeFlags = lib.optional (!withGUI) "-DSYNERGY_BUILD_LEGACY_GUI=OFF"
-    ++ lib.optional stdenv.isDarwin "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.targetPlatform.darwinSdkVersion}";
+    # NSFilenamesPboardType is deprecated in 10.14+
+    ++ lib.optional stdenv.isDarwin "-DCMAKE_OSX_DEPLOYMENT_TARGET=${if stdenv.isAarch64 then "10.13" else stdenv.targetPlatform.darwinSdkVersion}";
 
   doCheck = true;
 

third_party/nixpkgs/pkgs/applications/misc/xca/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, mkDerivation, lib, fetchFromGitHub, autoreconfHook, pkg-config
+{ stdenv, mkDerivation, lib, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config
 , libtool, openssl, qtbase, qttools, sphinx }:
 
 mkDerivation rec {
@@ -12,6 +12,12 @@ mkDerivation rec {
     sha256 = "04z0mmjsry72nvib4icmwh1717y4q9pf2gr68ljrzln4vv4ckpwk";
   };
 
+  # Adaptions to stay OpenSSL 3.0 compatible
+  patches = [ (fetchpatch {
+    url = "https://github.com/chris2511/xca/commit/f5ac099e948ea354deac75ff9fa09d51453476e1.patch";
+    hash = "sha256-4rRO2y9hZq879HTsgBgbXGRYEcgfG4niJKyK3l3PMZ8=";
+  }) ];
+
   buildInputs = [ libtool openssl qtbase ];
 
   nativeBuildInputs = [ autoreconfHook pkg-config qttools sphinx ];

third_party/nixpkgs/pkgs/applications/misc/xplr/default.nix

@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xplr";
-  version = "0.19.4";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "sayanarijit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-oVMnhtsovZAqMdmtV8oJ8frgHGidjlFzVyrYxi+gNdg=";
+    sha256 = "sha256-TH5ksbEVBlOPmqQOtRmoHTDBRkj/KaMsM+Xc7e2ObzY=";
   };
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
-  cargoSha256 = "sha256-PDbhnVThdb/42Q/dp/MNU6i6Un/lkKzfKuGukFt5tmc=";
+  cargoSha256 = "sha256-RcH1J5I9FPQ/Npq4I5lcOsZHzvKyYhxmqOIEYcBXqU0=";
 
   meta = with lib; {
     description = "A hackable, minimal, fast TUI file explorer";

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "107.0.5304.68",
+    "version": "107.0.5304.87",
-    "sha256": "0k5qrmby1k2gw3lj96x3qag20kka61my578pv0zyrqqj5sdz3i5a",
+    "sha256": "0n9wr5v7zcdmbqs7mmnyydjvzw0glh5l3skpj7i1nap2hv0h03kc",
-    "sha256bin64": "1x9svz5s8fm2zhnpzjpqckzfp37hjni3nf3pm63rwnvbd06y48ja",
+    "sha256bin64": "16a6qisxkfmx60qh67rvfy3knp66hdgxan48cga6j3zd683inas2",
     "deps": {
       "gn": {
         "version": "2022-09-14",
@@ -19,22 +19,9 @@
     }
   },
   "beta": {
-    "version": "107.0.5304.68",
+    "version": "108.0.5359.22",
-    "sha256": "0k5qrmby1k2gw3lj96x3qag20kka61my578pv0zyrqqj5sdz3i5a",
+    "sha256": "1wwrwqyl9nl4kpkmkybw14ygj5lfrk274yx5f817ha1kpk8vma0y",
-    "sha256bin64": "15ijvsm9k28iwr7dxi2vbrlb7z5nz63yvpx7cg766z1z1q5jcg7m",
+    "sha256bin64": "0dq3mf1rai7i3aqq9h8g4iy9nxy3hbb6gd86c31admxygdpgpds5",
-    "deps": {
-      "gn": {
-        "version": "2022-09-14",
-        "url": "https://gn.googlesource.com/gn",
-        "rev": "fff29c1b3f9703ea449f720fe70fa73575ef24e5",
-        "sha256": "1c0dvpp4im1hf277bs5w7rgqxz3g2bax266i2g6smi3pl7a8jpnp"
-      }
-    }
-  },
-  "dev": {
-    "version": "108.0.5359.19",
-    "sha256": "1093anaymbmza6rf9hisl6qdf9jfaa27kyd3gbv5xyc0i450ypg5",
-    "sha256bin64": "0yi6qi7asmh3kx6y86p22smjf5bpay1nrj09zg7l2qd3gi836xp0",
     "deps": {
       "gn": {
         "version": "2022-10-05",
@@ -44,10 +31,23 @@
       }
     }
   },
+  "dev": {
+    "version": "109.0.5384.0",
+    "sha256": "195lbklp5c6bvfzhdvah4k2yr44jwy64499y37kgxky0mb79a26n",
+    "sha256bin64": "02qbwj9gfcgxdqm1mhxg0mljvrhnl994lhis615y23099r3r67i8",
+    "deps": {
+      "gn": {
+        "version": "2022-10-26",
+        "url": "https://gn.googlesource.com/gn",
+        "rev": "3e98c606ed0dff59fa461fbba4892c0b6de1966e",
+        "sha256": "08cz58svkb7c71f1x1ahr60a6ircr31rfmkk4d46z2v39sgry1gv"
+      }
+    }
+  },
   "ungoogled-chromium": {
-    "version": "107.0.5304.68",
+    "version": "107.0.5304.88",
-    "sha256": "0k5qrmby1k2gw3lj96x3qag20kka61my578pv0zyrqqj5sdz3i5a",
+    "sha256": "1k4j4j9b1m7kjybfgns9akb7adfby3gnjpibk0kjd22n3sprar8y",
-    "sha256bin64": "1x9svz5s8fm2zhnpzjpqckzfp37hjni3nf3pm63rwnvbd06y48ja",
+    "sha256bin64": null,
     "deps": {
       "gn": {
         "version": "2022-09-14",
@@ -56,8 +56,8 @@
         "sha256": "1c0dvpp4im1hf277bs5w7rgqxz3g2bax266i2g6smi3pl7a8jpnp"
       },
       "ungoogled-patches": {
-        "rev": "107.0.5304.68-1",
+        "rev": "107.0.5304.88-1",
-        "sha256": "0rjdi2lr71xjjf4x27183ys87fc95m85yp5x3kk6i39ppksvsj6b"
+        "sha256": "1m9hjbs79ga5jw7x332jl882lh7yrr4n4r4qrzy37ai75x371pz2"
       }
     }
   }

third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix

@@ -3,10 +3,10 @@
 rec {
   firefox = buildMozillaMach rec {
     pname = "firefox";
-    version = "106.0.2";
+    version = "106.0.3";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "2aad75c05c3398c19842be46dcde275581344b09f0c65b51a630cef201545996ee00f8020f52a0d7b6416d9ad52cbd5c71b8f1cdf47cd18e4abf1ba21f7cdb93";
+      sha512 = "226bde9082330abe134d1726cec59b473d4d6839ea55ca20faddb901f032d89eb9d2bd5d887ccd4ba515c6b1a44817420cfee2e9f4f8a79ed46a38287083d28d";
     };
 
     # This patch could be applied anywhere (just rebuild, no effect)

third_party/nixpkgs/pkgs/applications/networking/browsers/librewolf/src.json

@@ -1,11 +1,11 @@
 {
-  "packageVersion": "106.0.1-1",
+  "packageVersion": "106.0.3-1",
   "source": {
-    "rev": "106.0.1-1",
+    "rev": "106.0.3-1",
-    "sha256": "0dg4dvpa4fqhaikqnyqvxmi84g4gw535rdxmax724d0m6ksjm5yh"
+    "sha256": "0f0nz7fbp9k1pz7i8lh3fq3218crwqw2fdy9ia9hi9nlnybh114f"
   },
   "firefox": {
-    "version": "106.0.1",
+    "version": "106.0.3",
-    "sha512": "15f5a65a69e11dd0c463b358cafb5ad0f31db93619b9ec3f89e8c5e14d4d319d9423fe4dcd0dbbcbedc1ad444dcbd8e5e30e483220277f5b550bff6124b66519"
+    "sha512": "226bde9082330abe134d1726cec59b473d4d6839ea55ca20faddb901f032d89eb9d2bd5d887ccd4ba515c6b1a44817420cfee2e9f4f8a79ed46a38287083d28d"
   }
 }

third_party/nixpkgs/pkgs/applications/networking/cluster/arkade/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.8.48";
+  version = "0.8.50";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    sha256 = "sha256-3yYbuVx2dZsMefFFNVGivAR4wwXJwsr9XqGiyUKNAMo=";
+    sha256 = "sha256-DPBQ+MisNgVh2DpaIF//fjIzGvfpNYRS4zpYeUVqLwg=";
   };
 
   CGO_ENABLED = 0;

third_party/nixpkgs/pkgs/applications/networking/cluster/k3sup/default.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "k3sup";
-  version = "0.12.7";
+  version = "0.12.10";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "k3sup";
     rev = version;
-    sha256 = "sha256-EOGYOxRhpPHOSo9ccCSvat9kq2SlujPqno8v7/zmuto=";
+    sha256 = "sha256-d9YZOrMZKwkHmo7/b0BE552OLnD/ETfF4n+jE7fQ4zA=";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];

third_party/nixpkgs/pkgs/applications/networking/cluster/kubecfg/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubecfg";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "kubecfg";
     repo = "kubecfg";
     rev = "v${version}";
-    sha256 = "sha256-IJ/QKqGhhJfqRBVKfmV4jTC2C53DmzmK5AECJg2xdmw=";
+    sha256 = "sha256-Ask1Mbt/7xhfTNPmLIFtndT6qqbyotFrhoaUggzgGas=";
   };
 
-  vendorSha256 = "sha256-kmUhcHZ6LcxtuuucOwcO6TNk2TsWL6lcppD6M6unY2M=";
+  vendorSha256 = "sha256-vqlANAwZTC4goeN/KsrYL9GWzkhi4WUx9Llyi863KVY=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
 

third_party/nixpkgs/pkgs/applications/networking/cluster/odo/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "odo";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "redhat-developer";
     repo = "odo";
     rev = "v${version}";
-    sha256 = "sha256-CtlT6nUh0oqjJSWaIqAgu9CNGVHcf+uLNWBCl950Kus=";
+    sha256 = "sha256-+QLRm01JTV7nnMiIvitdkm38E08TsmU6EfrNTUCTddY=";
   };
 
   vendorSha256 = null;

third_party/nixpkgs/pkgs/applications/networking/cluster/temporalite/default.nix

@@ -0,0 +1,35 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "temporalite";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "temporalio";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-rLEkWg5LNVb7i/2IARKGuP9ugaVJA9pwYbKLm0QLmOc=";
+  };
+
+  vendorSha256 = "sha256-vjuwh/HRRYfB6J49rfJxif12nYPnbBodWF9hTiGygS8=";
+
+  subPackages = [ "cmd/temporalite" ];
+
+  postPatch = ''
+    substituteInPlace cmd/temporalite/ui_test.go \
+      --replace "TestNewUIConfigWithMissingConfigFile" "SkipNewUIConfigWithMissingConfigFile"
+
+    substituteInPlace cmd/temporalite/mtls_test.go \
+      --replace "TestMTLSConfig" "SkipMTLSConfig"
+  '';
+
+  meta = with lib; {
+    description = "An experimental distribution of Temporal that runs as a single process";
+    homepage = "https://github.com/temporalio/temporalite";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lucperkins ];
+  };
+}

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -48,13 +48,13 @@
     "version": "3.0.0"
   },
   "alicloud": {
-    "hash": "sha256-CyubHE3YFGDt4T4dJ6ZHgvQ6V/nIHK/LODkl7Qm65Sk=",
+    "hash": "sha256-IP5TCFi4NEjnBa9rKCZI6TVFAAyjfsZbmc+PgkwgvIo=",
     "owner": "aliyun",
     "provider-source-address": "registry.terraform.io/aliyun/alicloud",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.189.0",
+    "rev": "v1.190.0",
     "vendorHash": null,
-    "version": "1.189.0"
+    "version": "1.190.0"
   },
   "ansible": {
     "hash": "sha256-3nha5V4rNgVzgqliebmbC5e12Lj/zlCsyyiIVFlmUrY=",
@@ -74,6 +74,15 @@
     "vendorHash": null,
     "version": "2.2.0"
   },
+  "argocd": {
+    "hash": "sha256-yWhq2WolfL7PQVuWr5P7EH0cM78wGyL2+yezh2WzL2c=",
+    "owner": "oboukili",
+    "provider-source-address": "registry.terraform.io/oboukili/argocd",
+    "repo": "terraform-provider-argocd",
+    "rev": "v4.1.0",
+    "vendorHash": "sha256-hPgZ/2AebjtovopbSEJqsm0J85LdlLWBtP15vaqgLF4=",
+    "version": "4.1.0"
+  },
   "auth0": {
     "hash": "sha256-kyQBl/gdTj1Dlu4/FFowAQbBDTYMjp0JGQ09eBqwHEc=",
     "owner": "auth0",
@@ -138,13 +147,14 @@
     "version": "1.0.0"
   },
   "baiducloud": {
-    "hash": "sha256-tVvpWXKJyhiuyFnDMPvTPBhWUx169PjvZL2iQXDuK1s=",
+    "deleteVendor": true,
+    "hash": "sha256-mM4wikawrXdePX2ZemsjyoHrf0LQ0gwoUspcbvBUSeA=",
     "owner": "baidubce",
     "provider-source-address": "registry.terraform.io/baidubce/baiducloud",
     "repo": "terraform-provider-baiducloud",
-    "rev": "v1.16.2",
+    "rev": "v1.16.3",
-    "vendorHash": null,
+    "vendorHash": "sha256-UxVRz0Nhz6jqXPlAAJZ+GJFu30JJ4hYvVi5OlXInE0g=",
-    "version": "1.16.2"
+    "version": "1.16.3"
   },
   "bigip": {
     "hash": "sha256-uSe+J4AlW8Dt96BVF1ZI/yrgWUbZsl64b/D+k5ysHC0=",
@@ -222,13 +232,13 @@
     "version": "1.20.0"
   },
   "cloudflare": {
-    "hash": "sha256-uItV3BTB3bY8NrjD63oUWZMB0gEscEN4Y6aDTuDQW7c=",
+    "hash": "sha256-DqGHPD1CnkIkABB0sB90zE/mVxo0aXQwu4Et7apuM1A=",
     "owner": "cloudflare",
     "provider-source-address": "registry.terraform.io/cloudflare/cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v3.26.0",
+    "rev": "v3.27.0",
-    "vendorHash": "sha256-pifWJoCbV0bIDzDihdvpC3k5d615HTsYHqVV3s50euk=",
+    "vendorHash": "sha256-tpOyqFpO1jMEfXkXgodGEnFVGMqeAqsU5oou60lqcUE=",
-    "version": "3.26.0"
+    "version": "3.27.0"
   },
   "cloudfoundry": {
     "hash": "sha256-VfGB0NkT36oYT5F1fh1N/2rlZdfhk+K76AXNh0NkO50=",
@@ -441,24 +451,24 @@
     "version": "3.18.0"
   },
   "google": {
-    "hash": "sha256-gm3Ltq1fpgiaWuR8bdMaj3I9sNSJIfW+/nSn3TKxlxs=",
+    "hash": "sha256-LyPvK1IPCCfYcRfh9nPyPBZh1cU3sSkUb6tYKUko2C4=",
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/google",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.41.0",
+    "rev": "v4.42.0",
-    "vendorHash": "sha256-PWSok1sTU/57Xeri4Un5B9Fbwg8gBP6Quy5oIZrjxUI=",
+    "vendorHash": "sha256-Hzl95NLEZlvTBpCGJYzF5rtHWfYe26TwW0pbtqWmxOo=",
-    "version": "4.41.0"
+    "version": "4.42.0"
   },
   "google-beta": {
-    "hash": "sha256-zeCz6B5WmNJVirWOPU+8HYab9hTwxX490Pk1gX/0jd8=",
+    "hash": "sha256-Yi5nFjnYXFztqQURX3LIdmFNam7Ebhp0jTTXyTcX28Q=",
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.41.0",
+    "rev": "v4.42.0",
-    "vendorHash": "sha256-PWSok1sTU/57Xeri4Un5B9Fbwg8gBP6Quy5oIZrjxUI=",
+    "vendorHash": "sha256-Hzl95NLEZlvTBpCGJYzF5rtHWfYe26TwW0pbtqWmxOo=",
-    "version": "4.41.0"
+    "version": "4.42.0"
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -534,22 +544,22 @@
     "version": "1.0.4"
   },
   "http": {
-    "hash": "sha256-ZIV4OrfwUtWuQyp9Uw/sA7tW7JlG2+bAUu8TamyTPbs=",
+    "hash": "sha256-04OMH0+fT4QOV34YdE67avnbC3GoK7xyMGxpILNM7Jk=",
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/http",
     "repo": "terraform-provider-http",
-    "rev": "v3.1.0",
+    "rev": "v3.2.0",
-    "vendorHash": "sha256-LPd5TQbuauXKMXraHsJd5uIdn357CveRyaLmavtMHSA=",
+    "vendorHash": "sha256-diQ5bYFywVZXziRKiKdIU4grg93vF68bkbMrRpM/vQc=",
-    "version": "3.1.0"
+    "version": "3.2.0"
   },
   "huaweicloud": {
-    "hash": "sha256-QBRnlBR+gPMy9gtM2P93Lot4GDW94z7B4BgYs+lT5IQ=",
+    "hash": "sha256-cr7xV7Z4UU+kRykVSOKeuXDiHQPL4CsCJVXf2uTZOms=",
     "owner": "huaweicloud",
     "provider-source-address": "registry.terraform.io/huaweicloud/huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.41.1",
+    "rev": "v1.42.0",
     "vendorHash": null,
-    "version": "1.41.1"
+    "version": "1.42.0"
   },
   "huaweicloudstack": {
     "hash": "sha256-WSJDp+LFjVPquQVMgib/YZV35kktLH2vMCIZJWqakXs=",
@@ -624,13 +634,13 @@
     "version": "4.0.1"
   },
   "ksyun": {
-    "hash": "sha256-sfvmDByxAQbbdPHb9l5tIT5dyu8eA3r63i5FZJYEYTI=",
+    "hash": "sha256-xmBpDYN1MRQ9cyIOqHMAD7RucRkOKmwnmzjIsjxA7VQ=",
     "owner": "kingsoftcloud",
     "provider-source-address": "registry.terraform.io/kingsoftcloud/ksyun",
     "repo": "terraform-provider-ksyun",
-    "rev": "v1.3.55",
+    "rev": "v1.3.56",
     "vendorHash": "sha256-miHKAz+ONXtuC1DNukcyZbbaYReY69dz9Zk6cJdORdQ=",
-    "version": "1.3.55"
+    "version": "1.3.56"
   },
   "kubectl": {
     "hash": "sha256-UkUwWi7Z9cSMyZakD6JxMl+qdczAYfZQgwroCUjFIUM=",
@@ -642,13 +652,13 @@
     "version": "1.14.0"
   },
   "kubernetes": {
-    "hash": "sha256-E8ew1MwQa1DVYZH//ePjZXLQdyRN7Q0yomH0ma0neks=",
+    "hash": "sha256-93cGlfYUH4VTdDYbtGySOUw5Kak7hKs0gxLCT0Bxca4=",
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/kubernetes",
     "repo": "terraform-provider-kubernetes",
-    "rev": "v2.14.0",
+    "rev": "v2.15.0",
     "vendorHash": null,
-    "version": "2.14.0"
+    "version": "2.15.0"
   },
   "launchdarkly": {
     "hash": "sha256-AsFtlCIGvlG8c+PilhMhaMowaea/g1+IXYzEiIIbZ44=",
@@ -705,13 +715,14 @@
     "version": "2.0.3"
   },
   "lxd": {
-    "hash": "sha256-rNqlPyKpBNaIRtiNHB8U8jowWhqdQtDIMxreZ5Dfm3E=",
+    "hash": "sha256-x0f8kP7OsgSD8d9vu99vp7Xq3szwLKxoAZdUCJc8B7A=",
     "owner": "terraform-lxd",
     "provider-source-address": "registry.terraform.io/terraform-lxd/lxd",
+    "proxyVendor": true,
     "repo": "terraform-provider-lxd",
-    "rev": "v1.7.2",
+    "rev": "v1.7.3",
-    "vendorHash": "sha256-ervfG/BAaF4M+BXsp0eCDM6nPWQOS3pthClhArsUoYc=",
+    "vendorHash": "sha256-omaslX89hMAdIppBfILsGO6133Q3UgihgiJcy/Gn83M=",
-    "version": "1.7.2"
+    "version": "1.7.3"
   },
   "mailgun": {
     "hash": "sha256-Yi258SIFSdD+JSi5oX74bhBFYYGYQfSAyYD07eO8MmM=",
@@ -1021,13 +1032,13 @@
     "version": "3.8.5"
   },
   "sentry": {
-    "hash": "sha256-dNyUp+gXrOvMQu5tEnv2dOsXihyd19gdYakIo7+h3pY=",
+    "hash": "sha256-D6w2HfgIcNFfDXeqzuerK8msrFF7vajk80MUxbUxA+A=",
     "owner": "jianyuan",
     "provider-source-address": "registry.terraform.io/jianyuan/sentry",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.9.4",
+    "rev": "v0.10.0",
-    "vendorHash": "sha256-ohPZpFCjawaymVHZoCstPeu+p0erRnfnpbjipT6Sp20=",
+    "vendorHash": "sha256-OxapqNRE5Poz6qsFjDv5G5zzivbBldzjC7kbwG2Cswg=",
-    "version": "0.9.4"
+    "version": "0.10.0"
   },
   "shell": {
     "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",
@@ -1057,13 +1068,13 @@
     "version": "0.15.0"
   },
   "snowflake": {
-    "hash": "sha256-i96scuSP7I8rcyncUkpBoxxM0D4zp9rNHqWwb9WLbhA=",
+    "hash": "sha256-XjLsRS7n3p0lNVEPx6b+h5TCzK+1Kws/72FNgy3sVbE=",
     "owner": "Snowflake-Labs",
     "provider-source-address": "registry.terraform.io/Snowflake-Labs/snowflake",
     "repo": "terraform-provider-snowflake",
-    "rev": "v0.46.0",
+    "rev": "v0.49.0",
-    "vendorHash": "sha256-43q1SrV7tEt0x7iRUAgBFg1oh8+B9i1i59nlR8kbLIY=",
+    "vendorHash": "sha256-n6ov9eTlNF/jNDTDOZuuqyFfuv8lDZHKP/5jhFauwY8=",
-    "version": "0.46.0"
+    "version": "0.49.0"
   },
   "sops": {
     "hash": "sha256-6FuThi6iuuUGcMhswAk3Z6Lxth/2nuI57A02Xu2s+/U=",
@@ -1075,13 +1086,13 @@
     "version": "0.7.1"
   },
   "spotinst": {
-    "hash": "sha256-D/cLkMAZwjJoaliUmfiLAn6uY1rNt1vu6QS5mQmBQ0s=",
+    "hash": "sha256-mcj16B7VM5mc5UUXSLdcGApPac6xPU86H0lgpeR1FMs=",
     "owner": "spotinst",
     "provider-source-address": "registry.terraform.io/spotinst/spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.85.1",
+    "rev": "v1.86.0",
-    "vendorHash": "sha256-BDYX/4D3R2A1w3k14mON/2KZUg2kPbwePXQQpVanqdU=",
+    "vendorHash": "sha256-INJLhHiMs/bk3Y8/shtQaW10bUnuhCXdTa8wCNZf0+U=",
-    "version": "1.85.1"
+    "version": "1.86.0"
   },
   "stackpath": {
     "hash": "sha256-nTR9HgSmuNCt7wxE4qqIH2+HA2igzqVx0lLRx6FoKrE=",
@@ -1156,13 +1167,13 @@
     "version": "0.9.0"
   },
   "tls": {
-    "hash": "sha256-q3zt+5zd/bJ42sWbFwuE+rDyHHcZoVBZF4c61aJJkMs=",
+    "hash": "sha256-DBOkfvT0+mlgaWiBHggZUKvHL8jLZjQjRi0xFZKgcoM=",
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/tls",
     "repo": "terraform-provider-tls",
-    "rev": "v4.0.3",
+    "rev": "v4.0.4",
-    "vendorHash": "sha256-tW4e+QETPSykMEosahs68VeagToqWWe4ZUQN49gpHHM=",
+    "vendorHash": "sha256-k7aW5ZD6pAtdT6tTXy8YaJlFS5WR5FzPd9eINgPBYJM=",
-    "version": "4.0.3"
+    "version": "4.0.4"
   },
   "triton": {
     "deleteVendor": true,

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform/default.nix

@@ -168,9 +168,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.3.3";
+    version = "1.3.4";
-    sha256 = "sha256-Oqswfw/ZkBJKldRd916Jfaugz66C3wE8VU44kAkGmUA=";
+    sha256 = "sha256-UaMZTBmaLHbW1mNjDrMQSPMLKRIADlVvyP2qwuAv2Zo=";
-    vendorSha256 = "sha256-mXCtgB1MdMP2XlJBagaDtZURw5o0JudAB2koHmfM0f8=";
+    vendorSha256 = "sha256-Wwf2EcqtlNqcGijR8WWcdSsayJrbZO68JEBPKWHXHuw=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/discord/linux.nix

@@ -77,7 +77,6 @@ stdenv.mkDerivation rec {
     libXrender
     libXtst
     nspr
-    nss
     libxcb
     pango
     libXScrnSaver

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-web.nix

@@ -9,6 +9,7 @@
 , fixup_yarn_lock
 , nodejs
 , jitsi-meet
+, applyPatches
 , conf ? { }
 }:
 
@@ -24,12 +25,15 @@ in stdenv.mkDerivation rec {
   pname = "element-web";
   inherit (pinData) version;
 
+  src = applyPatches {
     src = fetchFromGitHub {
       owner = "vector-im";
       repo = pname;
       rev = "v${version}";
       sha256 = pinData.webSrcHash;
     };
+    patches = [ ./regenerate-element-web-yarn.lock.diff ];
+  };
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";