Merge master into staging-next

26 files changed, 863 insertions, 28 deletions

diff --git a/doc/contributing/submitting-changes.chapter.md b/doc/contributing/submitting-changes.chapter.md
index 8e8ca8e19ad..e80a264dea6 100644
--- a/doc/contributing/submitting-changes.chapter.md
+++ b/doc/contributing/submitting-changes.chapter.md
@@ -244,12 +244,16 @@ The `master` branch is the main development branch. It should only see non-break
 
 The `staging` branch is a development branch where mass-rebuilds go. Mass rebuilds are commits that cause rebuilds for many packages, like more than 500 (or perhaps, if it's 'light' packages, 1000). It should only see non-breaking mass-rebuild commits. That means it is not to be used for testing, and changes must have been well tested already. If the branch is already in a broken state, please refrain from adding extra new breakages.
 
+During the process of a releasing a new NixOS version, this branch or the release-critical packages can be restricted to non-breaking changes.
+
 ### Staging-next branch {#submitting-changes-staging-next-branch}
 
 The `staging-next` branch is for stabilizing mass-rebuilds submitted to the `staging` branch prior to merging them into `master`. Mass-rebuilds must go via the `staging` branch. It must only see non-breaking commits that are fixing issues blocking it from being merged into the `master` branch.
 
 If the branch is already in a broken state, please refrain from adding extra new breakages. Stabilize it for a few days and then merge into master.
 
+During the process of a releasing a new NixOS version, this branch or the release-critical packages can be restricted to non-breaking changes.
+
 ### Stable release branches {#submitting-changes-stable-release-branches}
 
 The same staging workflow applies to stable release branches, but the main branch is called `release-*` instead of `master`.
diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix
index 6cd5718f422..a9a587b41e8 100644
--- a/nixos/modules/services/continuous-integration/jenkins/default.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/default.nix
@@ -87,8 +87,8 @@ in {
       };
 
       packages = mkOption {
-        default = [ pkgs.stdenv pkgs.git pkgs.jdk11 config.programs.ssh.package pkgs.nix ];
-        defaultText = literalExpression "[ pkgs.stdenv pkgs.git pkgs.jdk11 config.programs.ssh.package pkgs.nix ]";
+        default = [ pkgs.stdenv pkgs.git pkgs.jdk17 config.programs.ssh.package pkgs.nix ];
+        defaultText = literalExpression "[ pkgs.stdenv pkgs.git pkgs.jdk17 config.programs.ssh.package pkgs.nix ]";
         type = types.listOf types.package;
         description = lib.mdDoc ''
           Packages to add to PATH for the jenkins process.
@@ -228,7 +228,7 @@ in {
 
       # For reference: https://wiki.jenkins.io/display/JENKINS/JenkinsLinuxStartupScript
       script = ''
-        ${pkgs.jdk11}/bin/java ${concatStringsSep " " cfg.extraJavaOptions} -jar ${cfg.package}/webapps/jenkins.war --httpListenAddress=${cfg.listenAddress} \
+        ${pkgs.jdk17}/bin/java ${concatStringsSep " " cfg.extraJavaOptions} -jar ${cfg.package}/webapps/jenkins.war --httpListenAddress=${cfg.listenAddress} \
                                                   --httpPort=${toString cfg.port} \
                                                   --prefix=${cfg.prefix} \
                                                   -Djava.awt.headless=true \
diff --git a/nixos/modules/services/web-apps/peertube.nix b/nixos/modules/services/web-apps/peertube.nix
index 1ac6c15dace..a42d1a1a932 100644
--- a/nixos/modules/services/web-apps/peertube.nix
+++ b/nixos/modules/services/web-apps/peertube.nix
@@ -67,6 +67,12 @@ let
     node ~/dist/server/tools/peertube.js $@
   '';
 
+  nginxCommonHeaders = ''
+    add_header Access-Control-Allow-Origin    '*';
+    add_header Access-Control-Allow-Methods   'GET, OPTIONS';
+    add_header Access-Control-Allow-Headers   'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+  '';
+
 in {
   options.services.peertube = {
     enable = lib.mkEnableOption (lib.mdDoc "Enable Peertube’s service");
@@ -145,6 +151,12 @@ in {
       description = lib.mdDoc "Configuration for peertube.";
     };
 
+    configureNginx = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = lib.mdDoc "Configure nginx as a reverse proxy for peertube.";
+    };
+
     database = {
       createLocally = lib.mkOption {
         type = lib.types.bool;
@@ -351,6 +363,8 @@ in {
     systemd.tmpfiles.rules = [
       "d '/var/lib/peertube/config' 0700 ${cfg.user} ${cfg.group} - -"
       "z '/var/lib/peertube/config' 0700 ${cfg.user} ${cfg.group} - -"
+      "d '/var/lib/peertube/www' 0750 ${cfg.user} ${cfg.group} - -"
+      "z '/var/lib/peertube/www' 0750 ${cfg.user} ${cfg.group} - -"
     ];
 
     systemd.services.peertube-init-db = lib.mkIf cfg.database.createLocally {
@@ -410,8 +424,11 @@ in {
           password: '$(cat ${cfg.smtp.passwordFile})'
         ''}
         EOF
-        ln -sf ${cfg.package}/config/default.yaml /var/lib/peertube/config/default.yaml
+        umask 027
         ln -sf ${configFile} /var/lib/peertube/config/production.json
+        ln -sf ${cfg.package}/config/default.yaml /var/lib/peertube/config/default.yaml
+        ln -sf ${cfg.package}/client/dist -T /var/lib/peertube/www/client
+        ln -sf ${cfg.settings.storage.client_overrides} -T /var/lib/peertube/www/client-overrides
         npm start
       '';
       serviceConfig = {
@@ -441,6 +458,269 @@ in {
       } // cfgService;
     };
 
+    services.nginx = lib.mkIf cfg.configureNginx {
+      enable = true;
+      virtualHosts."${cfg.localDomain}" = {
+        root = "/var/lib/peertube";
+
+        # Application
+        locations."/" = {
+          tryFiles = "/dev/null @api";
+          priority = 1110;
+        };
+
+        locations."= /api/v1/videos/upload-resumable" = {
+          tryFiles = "/dev/null @api";
+          priority = 1120;
+
+          extraConfig = ''
+            client_max_body_size                        0;
+            proxy_request_buffering                     off;
+          '';
+        };
+
+        locations."~ ^/api/v1/videos/(upload|([^/]+/studio/edit))$" = {
+          tryFiles = "/dev/null @api";
+          root = cfg.settings.storage.tmp;
+          priority = 1130;
+
+          extraConfig = ''
+            client_max_body_size                        12G;
+            add_header X-File-Maximum-Size              8G always;
+          '';
+        };
+
+        locations."~ ^/api/v1/(videos|video-playlists|video-channels|users/me)" = {
+          tryFiles = "/dev/null @api";
+          priority = 1140;
+
+          extraConfig = ''
+            client_max_body_size                        6M;
+            add_header X-File-Maximum-Size              4M always;
+          '';
+        };
+
+        locations."@api" = {
+          proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}";
+          priority = 1150;
+
+          extraConfig = ''
+            proxy_set_header X-Forwarded-For            $proxy_add_x_forwarded_for;
+            proxy_set_header Host                       $host;
+            proxy_set_header X-Real-IP                  $remote_addr;
+
+            proxy_connect_timeout                       10m;
+
+            proxy_send_timeout                          10m;
+            proxy_read_timeout                          10m;
+
+            client_max_body_size                        100k;
+            send_timeout                                10m;
+          '';
+        };
+
+        # Websocket
+        locations."/socket.io" = {
+          tryFiles = "/dev/null @api_websocket";
+          priority = 1210;
+        };
+
+        locations."/tracker/socket" = {
+          tryFiles = "/dev/null @api_websocket";
+          priority = 1220;
+
+          extraConfig = ''
+            proxy_read_timeout                          15m;
+          '';
+        };
+
+        locations."@api_websocket" = {
+          proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}";
+          priority = 1230;
+
+          extraConfig = ''
+            proxy_set_header X-Forwarded-For            $proxy_add_x_forwarded_for;
+            proxy_set_header Host                       $host;
+            proxy_set_header X-Real-IP                  $remote_addr;
+            proxy_set_header Upgrade                    $http_upgrade;
+            proxy_set_header Connection                 'upgrade';
+
+            proxy_http_version                          1.1;
+          '';
+        };
+
+        # Bypass PeerTube for performance reasons.
+        locations."~ ^/client/(assets/images/(icons/icon-36x36\.png|icons/icon-48x48\.png|icons/icon-72x72\.png|icons/icon-96x96\.png|icons/icon-144x144\.png|icons/icon-192x192\.png|icons/icon-512x512\.png|logo\.svg|favicon\.png|default-playlist\.jpg|default-avatar-account\.png|default-avatar-account-48x48\.png|default-avatar-video-channel\.png|default-avatar-video-channel-48x48\.png))$" = {
+          tryFiles = "/www/client-overrides/$1 /www/client/$1 $1";
+          priority = 1310;
+        };
+
+        locations."~ ^/client/(.*\.(js|css|png|svg|woff2|otf|ttf|woff|eot))$" = {
+          alias = "${cfg.package}/client/dist/$1";
+          priority = 1320;
+          extraConfig = ''
+            add_header Cache-Control                    'public, max-age=604800, immutable';
+          '';
+        };
+
+        locations."~ ^/lazy-static/(avatars|banners)/" = {
+          tryFiles = "$uri @api";
+          root = cfg.settings.storage.avatars;
+          priority = 1330;
+          extraConfig = ''
+            if ($request_method = 'OPTIONS') {
+              ${nginxCommonHeaders}
+              add_header Access-Control-Max-Age         1728000;
+              add_header Cache-Control                  'no-cache';
+              add_header Content-Type                   'text/plain charset=UTF-8';
+              add_header Content-Length                 0;
+              return                                    204;
+            }
+
+            ${nginxCommonHeaders}
+            add_header Cache-Control                    'public, max-age=7200';
+
+            rewrite ^/lazy-static/avatars/(.*)$         /$1 break;
+            rewrite ^/lazy-static/banners/(.*)$         /$1 break;
+          '';
+        };
+
+        locations."^~ /lazy-static/previews/" = {
+          tryFiles = "$uri @api";
+          root = cfg.settings.storage.previews;
+          priority = 1340;
+          extraConfig = ''
+            if ($request_method = 'OPTIONS') {
+              ${nginxCommonHeaders}
+              add_header Access-Control-Max-Age         1728000;
+              add_header Cache-Control                  'no-cache';
+              add_header Content-Type                   'text/plain charset=UTF-8';
+              add_header Content-Length                 0;
+              return                                    204;
+            }
+
+            ${nginxCommonHeaders}
+            add_header Cache-Control                    'public, max-age=7200';
+
+            rewrite ^/lazy-static/previews/(.*)$        /$1 break;
+          '';
+        };
+
+        locations."^~ /static/thumbnails/" = {
+          tryFiles = "$uri @api";
+          root = cfg.settings.storage.thumbnails;
+          priority = 1350;
+          extraConfig = ''
+            if ($request_method = 'OPTIONS') {
+              ${nginxCommonHeaders}
+              add_header Access-Control-Max-Age         1728000;
+              add_header Cache-Control                  'no-cache';
+              add_header Content-Type                   'text/plain charset=UTF-8';
+              add_header Content-Length                 0;
+              return                                    204;
+            }
+
+            ${nginxCommonHeaders}
+            add_header Cache-Control                    'public, max-age=7200';
+
+            rewrite ^/static/thumbnails/(.*)$           /$1 break;
+          '';
+        };
+
+        locations."^~ /static/redundancy/" = {
+          tryFiles = "$uri @api";
+          root = cfg.settings.storage.redundancy;
+          priority = 1360;
+          extraConfig = ''
+            if ($request_method = 'OPTIONS') {
+              ${nginxCommonHeaders}
+              add_header Access-Control-Max-Age         1728000;
+              add_header Content-Type                   'text/plain charset=UTF-8';
+              add_header Content-Length                 0;
+              return                                    204;
+            }
+            if ($request_method = 'GET') {
+              ${nginxCommonHeaders}
+
+              access_log                                off;
+            }
+            aio                                         threads;
+            sendfile                                    on;
+            sendfile_max_chunk                          1M;
+
+            limit_rate_after                            5M;
+
+            set $peertube_limit_rate                    800k;
+            set $limit_rate                             $peertube_limit_rate;
+
+            rewrite ^/static/redundancy/(.*)$           /$1 break;
+          '';
+        };
+
+        locations."^~ /static/streaming-playlists/" = {
+          tryFiles = "$uri @api";
+          root = cfg.settings.storage.streaming_playlists;
+          priority = 1370;
+          extraConfig = ''
+            if ($request_method = 'OPTIONS') {
+              ${nginxCommonHeaders}
+              add_header Access-Control-Max-Age         1728000;
+              add_header Content-Type                   'text/plain charset=UTF-8';
+              add_header Content-Length                 0;
+              return                                    204;
+            }
+            if ($request_method = 'GET') {
+              ${nginxCommonHeaders}
+
+              access_log                                off;
+            }
+
+            aio                                         threads;
+            sendfile                                    on;
+            sendfile_max_chunk                          1M;
+
+            limit_rate_after                            5M;
+
+            set $peertube_limit_rate                    5M;
+            set $limit_rate                             $peertube_limit_rate;
+
+            rewrite ^/static/streaming-playlists/(.*)$  /$1 break;
+          '';
+        };
+
+        locations."~ ^/static/webseed/" = {
+          tryFiles = "$uri @api";
+          root = cfg.settings.storage.videos;
+          priority = 1380;
+          extraConfig = ''
+            if ($request_method = 'OPTIONS') {
+              ${nginxCommonHeaders}
+              add_header Access-Control-Max-Age         1728000;
+              add_header Content-Type                   'text/plain charset=UTF-8';
+              add_header Content-Length                 0;
+              return                                    204;
+            }
+            if ($request_method = 'GET') {
+              ${nginxCommonHeaders}
+
+              access_log                                off;
+            }
+
+            aio                                         threads;
+            sendfile                                    on;
+            sendfile_max_chunk                          1M;
+
+            limit_rate_after                            5M;
+
+            set $peertube_limit_rate                    800k;
+            set $limit_rate                             $peertube_limit_rate;
+
+            rewrite ^/static/webseed/(.*)$              /$1 break;
+          '';
+        };
+      };
+    };
+
     services.postgresql = lib.mkIf cfg.database.createLocally {
       enable = true;
     };
@@ -476,8 +756,10 @@ in {
       (lib.mkIf cfg.redis.enableUnixSocket {${config.services.peertube.user}.extraGroups = [ "redis-peertube" ];})
     ];
 
-    users.groups = lib.optionalAttrs (cfg.group == "peertube") {
-      peertube = { };
+    users.groups = {
+      ${cfg.group} = {
+        members = lib.optional cfg.configureNginx config.services.nginx.user;
+      };
     };
   };
 }
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index aa782b4267e..9cbac370612 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -275,7 +275,10 @@ let
         redirectListen = filter (x: !x.ssl) defaultListen;
 
         acmeLocation = optionalString (vhost.enableACME || vhost.useACMEHost != null) ''
-          location /.well-known/acme-challenge {
+          # Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx)
+          # We use ^~ here, so that we don't check any regexes (which could
+          # otherwise easily override this intended match accidentally).
+          location ^~ /.well-known/acme-challenge/ {
             ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"}
             ${optionalString (vhost.acmeRoot != null) "root ${vhost.acmeRoot};"}
             auth_basic off;
diff --git a/pkgs/applications/file-managers/felix-fm/default.nix b/pkgs/applications/file-managers/felix-fm/default.nix
index 104cb9d9367..0209a72cce2 100644
--- a/pkgs/applications/file-managers/felix-fm/default.nix
+++ b/pkgs/applications/file-managers/felix-fm/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "felix";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "kyoheiu";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ewPDbrOxinu+GXegunZjumTCnkflXQk74Ovr8QStDBM=";
+    sha256 = "sha256-yMuV7a8nkdymgJTPuVcZ/PEA2/Vr7rQf8mpikNe3e1w=";
   };
 
-  cargoSha256 = "sha256-wD0h8tXnqQOuBbFmpjMu0ZK7+omcOSqno6wFnSMTSjk=";
+  cargoSha256 = "sha256-yePPIehyv11f58HQzFoPh7izSPjmbhdVu9xlHD6PGRY=";
 
   checkInputs = [ zoxide ];
 
diff --git a/pkgs/applications/office/treesheets/default.nix b/pkgs/applications/office/treesheets/default.nix
index 6a0bb48c7de..2920ae3ccf8 100644
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "unstable-2022-10-11";
+  version = "unstable-2022-10-20";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "be79e537c148d961d40137a7f83d7bdcc4119dd6";
-    sha256 = "GKRxb6W9PDY7nzgPTPRPmA9GBvD4zLaZwnalZan3+m0=";
+    rev = "12580ce39ee89f0ae6b9bdb304f7bc68a74ecdf7";
+    sha256 = "Z1BAYRcoeYOWomfwgBS/CQbejARs6sqsyZorhbJ/RdI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index ad6a02ec3b0..ab023dc4f02 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,16 +2,21 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.11.2";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    sha256 = "sha256-L43BIkRaPAU0zgdVsf1a3OinbspiU0LfWZPssS91wTE=";
+    sha256 = "sha256-AwoWCaACq2s9rzvvpAx3GZd3oSZZPykLwYLUiUhEYfg=";
   };
 
-  vendorSha256 = "sha256-PZumm//BV9iAkq1Kb9xNenqVrx73ZZUHTCUSVNqqEXA=";
+  postPatch = ''
+    # entirely separate package that breaks the build
+    rm -rf e2e/
+  '';
+
+  vendorSha256 = "sha256-C7VgcbDB18dF+u422AFAfoICxGmqjREbOpUXrFlgmiM=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/development/libraries/paho-mqtt-c/default.nix b/pkgs/development/libraries/paho-mqtt-c/default.nix
new file mode 100644
index 00000000000..37a829088d8
--- /dev/null
+++ b/pkgs/development/libraries/paho-mqtt-c/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenv, fetchFromGitHub, cmake, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "paho.mqtt.c";
+  version = "1.3.11";
+
+  src = fetchFromGitHub {
+    owner = "eclipse";
+    repo = "paho.mqtt.c";
+    rev = "v${version}";
+    hash = "sha256-TGCWA9tOOx0rCb/XQWqLFbXb9gOyGS8u6o9fvSRS6xI=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/MQTTVersion.c \
+      --replace "namebuf[60]" "namebuf[120]" \
+      --replace "lib%s" "$out/lib/lib%s"
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ openssl ];
+
+  cmakeFlags = [ "-DPAHO_WITH_SSL=TRUE" ];
+
+  meta = with lib; {
+    description = "Eclipse Paho MQTT C Client Library";
+    homepage = "https://www.eclipse.org/paho/";
+    license = licenses.epl20;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/paho-mqtt-cpp/default.nix b/pkgs/development/libraries/paho-mqtt-cpp/default.nix
new file mode 100644
index 00000000000..b62e774ba51
--- /dev/null
+++ b/pkgs/development/libraries/paho-mqtt-cpp/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, cmake, openssl, paho-mqtt-c }:
+
+stdenv.mkDerivation rec {
+  pname = "paho.mqtt.cpp";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "eclipse";
+    repo = "paho.mqtt.cpp";
+    rev = "v${version}";
+    hash = "sha256-tcq0a4X5dKE4rnczRMAVe3Wt43YzUKbxsv9Sk+q+IB8=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ openssl paho-mqtt-c ];
+
+  meta = with lib; {
+    description = "Eclipse Paho MQTT C++ Client Library";
+    homepage = "https://www.eclipse.org/paho/";
+    license = licenses.epl10;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/perl-modules/Bio-Ext-Align/default.nix b/pkgs/development/perl-modules/Bio-Ext-Align/default.nix
new file mode 100644
index 00000000000..237a4be0361
--- /dev/null
+++ b/pkgs/development/perl-modules/Bio-Ext-Align/default.nix
@@ -0,0 +1,36 @@
+{ lib, buildPerlPackage, fetchFromGitHub }:
+
+buildPerlPackage rec {
+  pname = "BioExtAlign";
+  version = "1.5.1";
+
+  outputs = [ "out" "dev" ];
+
+  src = fetchFromGitHub {
+    owner = "bioperl";
+    repo = "bioperl-ext";
+    rev = "bioperl-ext-release-${lib.replaceStrings ["."] ["-"] version}";
+    sha256 = "sha256-+0tZ6q3PFem8DWa2vq+njOLmjDvMB0JhD0FGk00lVMA=";
+  };
+
+  patches = [ ./fprintf.patch ];
+
+  # Do not install other Bio-ext packages
+  preConfigure = ''
+    cd Bio/Ext/Align
+  '';
+
+  # Disable tests as it requires Bio::Tools::Align which is in a different directory
+  buildPhase = ''
+    make
+  '';
+
+  meta = {
+    homepage = "https://github.com/bioperl/bioperl-ext";
+    description = "Write Perl Subroutines in Other Programming Languages";
+    longDescription = ''
+      Part of BioPerl Extensions (BioPerl-Ext) distribution, a collection of Bioperl C-compiled extensions.
+    '';
+    license = with lib.licenses; [ artistic1 ];
+  };
+}
diff --git a/pkgs/development/perl-modules/Bio-Ext-Align/fprintf.patch b/pkgs/development/perl-modules/Bio-Ext-Align/fprintf.patch
new file mode 100644
index 00000000000..f62004a9a33
--- /dev/null
+++ b/pkgs/development/perl-modules/Bio-Ext-Align/fprintf.patch
@@ -0,0 +1,13 @@
+diff --git a/libs/dpalign.c b/libs/dpalign.c
+index 0e07b67..0eab932 100644
+--- a/Bio/Ext/Align/libs/dpalign.c
++++ b/Bio/Ext/Align/libs/dpalign.c
+@@ -40,7 +40,7 @@ int blosum62[24][24] = {
+ void
+ dpAlign_fatal(char * s)
+ {
+-    fprintf(stderr, s);
++    fputs(stderr, s);
+     exit(-1);
+ }
+ 
diff --git a/pkgs/development/python-modules/aiorwlock/default.nix b/pkgs/development/python-modules/aiorwlock/default.nix
new file mode 100644
index 00000000000..9ee21f2a7c9
--- /dev/null
+++ b/pkgs/development/python-modules/aiorwlock/default.nix
@@ -0,0 +1,31 @@
+{ buildPythonPackage
+, fetchPypi
+, lib
+, pytest-asyncio
+, pytest-cov
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "aiorwlock";
+  version = "1.3.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-g/Eth99LlyiguP2hdWWFqw1lKxB7q1nGCE4bGtaSq0U=";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ];
+
+  pythonImportsCheck = [ "aiorwlock" ];
+
+  meta = with lib; {
+    description = "Read write lock for asyncio";
+    homepage = "https://github.com/aio-libs/aiorwlock";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ billhuang ];
+  };
+}
diff --git a/pkgs/development/python-modules/django-debug-toolbar/default.nix b/pkgs/development/python-modules/django-debug-toolbar/default.nix
index b4409dc04d4..bc54eadde8f 100644
--- a/pkgs/development/python-modules/django-debug-toolbar/default.nix
+++ b/pkgs/development/python-modules/django-debug-toolbar/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "django-debug-toolbar";
-  version = "3.5";
+  version = "3.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-OZWO3tXZ+p+zKtQHCkj0kGSXpDFHFV+HqSgiJvLmMTg=";
+    hash = "sha256-LGEx21m5TNotbwKHf5in+EDkYqqNOoF7mBstnfLYe9s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gpustat/default.nix b/pkgs/development/python-modules/gpustat/default.nix
new file mode 100644
index 00000000000..fbfa2faf597
--- /dev/null
+++ b/pkgs/development/python-modules/gpustat/default.nix
@@ -0,0 +1,44 @@
+{ buildPythonPackage
+, blessed
+, fetchPypi
+, lib
+, mockito
+, nvidia-ml-py
+, psutil
+, pytest-runner
+, pythonRelaxDepsHook
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "gpustat";
+  version = "1.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-WB6P+FjDLJWjIruPA/HZ3D0Xe07LM93L7Sw3PGf04/E=";
+  };
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+  pythonRelaxDeps = [ "nvidia-ml-py" ];
+
+  propagatedBuildInputs = [
+    blessed
+    nvidia-ml-py
+    psutil
+  ];
+
+  checkInputs = [
+    mockito
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "gpustat" ];
+
+  meta = with lib; {
+    description = "A simple command-line utility for querying and monitoring GPU status";
+    homepage = "https://github.com/wookayin/gpustat";
+    license = licenses.mit;
+    maintainers = with maintainers; [ billhuang ];
+  };
+}
diff --git a/pkgs/development/python-modules/opencensus/default.nix b/pkgs/development/python-modules/opencensus/default.nix
new file mode 100644
index 00000000000..0690da3d7ba
--- /dev/null
+++ b/pkgs/development/python-modules/opencensus/default.nix
@@ -0,0 +1,55 @@
+{ buildPythonPackage
+, fetchPypi
+, lib
+, python
+, unittestCheckHook
+, google-api-core
+}:
+
+let
+  opencensus-context = buildPythonPackage rec {
+    pname = "opencensus-context";
+    version = "0.1.3";
+
+    checkInputs = [ unittestCheckHook ];
+
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "sha256-oDEIw8ENjIC7Xd9cih8DMWH6YZcqmRf5ubOhhRfwCIw=";
+    };
+  };
+in
+buildPythonPackage rec {
+  pname = "opencensus";
+  version = "0.11.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-AmIWq6uJ2U2FBJLz3GWVAFXsT4QRX6bHvq/7pEo0bkI=";
+  };
+
+  buildInputs = [
+    # opencensus-context is embedded in opencensus
+    opencensus-context
+  ];
+
+  propagatedBuildInputs = [
+    google-api-core
+  ];
+
+  postInstall = ''
+    ln -sf ${opencensus-context}/${python.sitePackages}/opencensus/common/runtime_context \
+      $out/${python.sitePackages}/opencensus/common/
+  '';
+
+  checkInputs = [ unittestCheckHook ];
+
+  pythonImportsCheck = [ "opencensus" ];
+
+  meta = with lib; {
+    description = "A stats collection and distributed tracing framework";
+    homepage = "https://github.com/census-instrumentation/opencensus-python";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ billhuang ];
+  };
+}
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index cea76281957..d9adb09e0db 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -43,7 +43,7 @@ let
       sha256 = {
         x86_64-linux = "0x71b4kb8hlyacixipgfbgjgrbmhckxpbmrs2xk8iis7n5kg7539";
         aarch64-linux = "125lih7g2gj91k7j196wy5a5746wyfr8idj3ng369yh5wl7lfcfv";
-        x86_64-darwin = "0z2kww4iby1izkwn6z2ai94y87bkjvwak8awdmjm8sgg00pa9l1a";
+        x86_64-darwin = "sha256-TzprR95KHYBu9SruI4BgwCaqI7KKe3HuzgCO1A5YFiM=";
         aarch64-darwin = "0qajh4ac5lr1sznb2c471r5c5g2r0dk2pyqz8vhvnbk36r524h1h";
       }.${system} or throwSystem;
     };
@@ -114,7 +114,7 @@ let
       jq
     ];
   } (''
-    BROWSERS_JSON=${driver}/share/playwright-driver/package/browsers.json
+    BROWSERS_JSON=${driver}/package/browsers.json
   '' + lib.optionalString withChromium ''
     CHROMIUM_REVISION=$(jq -r '.browsers[] | select(.name == "chromium").revision' $BROWSERS_JSON)
     mkdir -p $out/chromium-$CHROMIUM_REVISION/chrome-linux
@@ -200,7 +200,7 @@ buildPythonPackage rec {
     "playwright"
   ];
 
-  passthru = {
+  passthru = rec {
     inherit driver;
     browsers = {
       x86_64-linux = browsers-linux { };
@@ -210,6 +210,10 @@ buildPythonPackage rec {
     }.${system} or throwSystem;
     browsers-chromium = browsers-linux { withFirefox = false; };
     browsers-firefox = browsers-linux { withChromium = false; };
+
+    tests = {
+      inherit driver browsers;
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ray/binary-hashes.nix b/pkgs/development/python-modules/ray/binary-hashes.nix
new file mode 100644
index 00000000000..28f9e210333
--- /dev/null
+++ b/pkgs/development/python-modules/ray/binary-hashes.nix
@@ -0,0 +1,11 @@
+{
+  cp38 = {
+    sha256 = "da8adfa33ff54bc61cfe80334a0ee889e0060918db6ff9215aebe32e98b1f939";
+  };
+  cp39 = {
+    sha256 = "cab13346650f88171b3f348ed352f04695b96d1ab1090ed3b80bdc93e897dbd4";
+  };
+  cp310 = {
+    sha256 = "bcf3bff9517d77ea6c98592fa16e1cfb8bc0cfa345d3be69729bfa9c5bd78a7c";
+  };
+}
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
new file mode 100644
index 00000000000..c6b76418187
--- /dev/null
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -0,0 +1,166 @@
+{ aiohttp
+, aiohttp-cors
+, aiorwlock
+, aiosignal
+, attrs
+, autoPatchelfHook
+, buildBazelPackage
+, buildPythonPackage
+, fetchPypi
+, click
+, cloudpickle
+, colorama
+, colorful
+, cython
+, dm-tree
+, fastapi
+, filelock
+, frozenlist
+, fsspec
+, gpustat
+, grpc
+, grpcio
+, gym
+, jsonschema
+, lib
+, lz4
+, matplotlib
+, msgpack
+, numpy
+, opencensus
+, packaging
+, pandas
+, py-spy
+, prometheus-client
+, protobuf3_20
+, psutil
+, pyarrow
+, pydantic
+, python
+, pythonAtLeast
+, pythonOlder
+, pythonRelaxDepsHook
+, pyyaml
+, redis
+, requests
+, scikitimage
+, scipy
+, setproctitle
+, smart-open
+, starlette
+, stdenv
+, tabulate
+, tensorboardx
+, uvicorn
+, virtualenv
+}:
+
+let
+  pname = "ray";
+  version = "2.0.0";
+in
+buildPythonPackage rec {
+  inherit pname version;
+  format = "wheel";
+
+  disabled = pythonOlder "3.8" || pythonAtLeast "3.11";
+
+  src =
+    let
+      pyShortVersion = "cp${builtins.replaceStrings ["."] [""] python.pythonVersion}";
+      binary-hash = (import ./binary-hashes.nix)."${pyShortVersion}";
+    in
+    fetchPypi ({
+      inherit pname version format;
+      dist = pyShortVersion;
+      python = pyShortVersion;
+      abi = pyShortVersion;
+      platform = "manylinux2014_x86_64";
+    } // binary-hash);
+
+  passthru.optional-dependencies = rec {
+    data-deps = [
+      pandas
+      pyarrow
+      fsspec
+    ];
+
+    serve-deps = [
+      aiorwlock
+      fastapi
+      pandas
+      starlette
+      uvicorn
+    ];
+
+    tune-deps = [
+      tabulate
+      tensorboardx
+    ];
+
+    rllib-deps = tune-deps ++ [
+      dm-tree
+      gym
+      lz4
+      matplotlib
+      scikitimage
+      pyyaml
+      scipy
+    ];
+
+    air-deps = data-deps ++ serve-deps ++ tune-deps ++ rllib-deps;
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [ "grpcio" "click" "protobuf" ];
+
+  propagatedBuildInputs = [
+    attrs
+    aiohttp
+    aiohttp-cors
+    aiosignal
+    click
+    cloudpickle
+    colorama
+    colorful
+    cython
+    filelock
+    frozenlist
+    gpustat
+    grpcio
+    jsonschema
+    msgpack
+    numpy
+    opencensus
+    packaging
+    py-spy
+    prometheus-client
+    protobuf3_20
+    psutil
+    pydantic
+    pyyaml
+    requests
+    setproctitle
+    smart-open
+    virtualenv
+  ];
+
+  postInstall = ''
+    chmod +x $out/${python.sitePackages}/ray/core/src/ray/{gcs/gcs_server,raylet/raylet}
+    ln -sf ${redis}/bin/redis-server $out/${python.sitePackages}/ray/core/src/ray/thirdparty/redis/src/redis-server
+  '';
+
+  pythonImportsCheck = [ "ray" ];
+
+  meta = with lib; {
+    description = "A unified framework for scaling AI and Python applications";
+    homepage = "https://github.com/ray-project/ray";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ billhuang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/development/tools/misc/deheader/default.nix b/pkgs/development/tools/misc/deheader/default.nix
new file mode 100644
index 00000000000..ad1cb909b0d
--- /dev/null
+++ b/pkgs/development/tools/misc/deheader/default.nix
@@ -0,0 +1,68 @@
+{ lib
+, stdenv
+, python3
+, xmlto
+, docbook-xsl-nons
+, fetchFromGitLab
+, installShellFiles
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deheader";
+  version = "1.8";
+  outputs = [ "out" "man" ];
+
+  src = fetchFromGitLab {
+    owner = "esr";
+    repo = "deheader";
+    rev = version;
+    sha256 = "sha256-sjxgUtdsi/sfxOViDj7l8591TSYwtCzDQcHsk9ClXuM=";
+  };
+
+  buildInputs = [ python3 ];
+
+  nativeBuildInputs = [ xmlto docbook-xsl-nons installShellFiles ];
+
+  # With upstream Makefile, xmlto is called without "--skip-validation". It
+  # makes it require a lot of dependencies, yet ultimately it fails
+  # nevertheless in attempt to fetch something from SourceForge.
+  #
+  # Need to set "foundMakefile" so "make check" tests are run.
+  buildPhase = ''
+    runHook preBuild
+
+    xmlto man --skip-validation deheader.xml
+    patchShebangs ./deheader
+    foundMakefile=1
+
+    runHook postBuild
+  '';
+
+  doCheck = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 ./deheader -t $out/bin
+    installManPage ./deheader.1
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Tool to find and optionally remove unneeded includes in C or C++ source files";
+    longDescription = ''
+      This tool takes a list of C or C++ sourcefiles and generates a report
+      on which #includes can be omitted from them -- the test, for each foo.c
+      or foo.cc or foo.cpp, is simply whether 'rm foo.o; make foo.o' returns a
+      zero status. Optionally, with the -r option, the unneeded headers are removed.
+      The tool also reports on headers required for strict portability.
+    '';
+    homepage = "http://catb.org/~esr/deheader";
+    changelog = "https://gitlab.com/esr/deheader/-/blob/master/NEWS.adoc";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ kaction ];
+
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/gpsd/default.nix b/pkgs/servers/gpsd/default.nix
index 1327ea5d739..d1b11dfd3d5 100644
--- a/pkgs/servers/gpsd/default.nix
+++ b/pkgs/servers/gpsd/default.nix
@@ -32,11 +32,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gpsd";
-  version = "3.23.1";
+  version = "3.24";
 
   src = fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-C5kc6aRlOMTqRQ96juQo/0T7T41mX93y/+QP4K6abAk=";
+    sha256 = "sha256-AO4T9hVlUoSHSmYb4TVTq+ZhKObetc1kivm8DLNF/lw=";
   };
 
   # TODO: render & install HTML documentation using asciidoctor
diff --git a/pkgs/tools/misc/fsql/default.nix b/pkgs/tools/misc/fsql/default.nix
index 192959ec760..0f2300a7480 100644
--- a/pkgs/tools/misc/fsql/default.nix
+++ b/pkgs/tools/misc/fsql/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fsql";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "kshvmdn";
     repo = "fsql";
     rev = "v${version}";
-    sha256 = "sha256-YavkN7n2Nt92T+uMwWRVv3q81DA6fFoNIJt9NYMS3rc=";
+    sha256 = "sha256-6KqlpFBaAWrlEjkFQhOEic569+eoYVAsnhMrg8AEPV4=";
   };
 
   vendorSha256 = "sha256-xuD7/gTssf1Iu1VuIRysjtUjve16gozOq0Wz4w6mIB8=";
diff --git a/pkgs/tools/system/nvitop/default.nix b/pkgs/tools/system/nvitop/default.nix
new file mode 100644
index 00000000000..70a0311c3e4
--- /dev/null
+++ b/pkgs/tools/system/nvitop/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, python3Packages
+, fetchFromGitHub
+, makeWrapper
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "nvitop";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "XuehaiPan";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-nGdEMLxpw2Ts0dypkoZg3r2NF4IeT1ykbRmrmf9qxrA=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    cachetools
+    psutil
+    termcolor
+    nvidia-ml-py
+  ];
+
+  checkPhase = ''
+    $out/bin/nvitop --help
+  '';
+
+  meta = with lib; {
+    description = "An interactive NVIDIA-GPU process viewer, the one-stop solution for GPU process management";
+    homepage = "https://github.com/XuehaiPan/nvitop";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ GaetanLepage ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix
index 0b2a4acd0b5..cc46a5acf5f 100644
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@@ -12,20 +12,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdcat";
-  version = "0.28.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = "mdcat";
     rev = "mdcat-${version}";
-    sha256 = "sha256-l64gRoWYYLbPA0n6vNQf14CCUtnkfMnQdqbetIbWvBU=";
+    sha256 = "sha256-Fh2OVb4d6WHuoJM503jaN9lan/JCrxMXZjCVpvuYbRQ=";
   };
 
   nativeBuildInputs = [ pkg-config asciidoctor installShellFiles ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "sha256-MCldDRleFfl4UrITuMEmLo0JyR+eoi6S6zGvFOMnIBE=";
+  cargoSha256 = "sha256-ZwJX+kXpj6nARFDx/+LsHWLzMUGBYJvM0DA0+WZukpI=";
 
   checkInputs = [ ansi2html ];
   # Skip tests that use the network and that include files.
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3eae85f55a2..743b99ca4cc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3695,6 +3695,8 @@ with pkgs;
 
   dedup = callPackage ../tools/backup/dedup { };
 
+  deheader = callPackage ../development/tools/misc/deheader { };
+
   dehydrated = callPackage ../tools/admin/dehydrated { };
 
   deja-dup = callPackage ../applications/backup/deja-dup { };
@@ -10050,6 +10052,10 @@ with pkgs;
 
   pagmo2 = callPackage ../development/libraries/pagmo2 { };
 
+  paho-mqtt-c = callPackage ../development/libraries/paho-mqtt-c { };
+
+  paho-mqtt-cpp = callPackage ../development/libraries/paho-mqtt-cpp { };
+
   pakcs = callPackage ../development/compilers/pakcs {
     # Doesn't compile with GHC 9.0 due to whitespace syntax changes
     # see also https://github.com/NixOS/nixpkgs/issues/166108
@@ -21329,6 +21335,8 @@ with pkgs;
 
   nvidia-optical-flow-sdk = callPackage ../development/libraries/nvidia-optical-flow-sdk { };
 
+  nvitop = callPackage ../tools/system/nvitop { };
+
   nvtop = callPackage ../tools/system/nvtop { };
   nvtop-nvidia = callPackage ../tools/system/nvtop { amd = false; };
   nvtop-amd = callPackage ../tools/system/nvtop { nvidia = false; };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b4d54893a49..659c51f7665 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1594,6 +1594,8 @@ let
     };
   };
 
+  BioExtAlign = callPackage ../development/perl-modules/Bio-Ext-Align { };
+
   BioPerl = buildPerlPackage {
     pname = "BioPerl";
     version = "1.7.8";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8fe7d4fe77c..e2651496753 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -433,6 +433,8 @@ in {
 
   aiorun = callPackage ../development/python-modules/aiorun { };
 
+  aiorwlock = callPackage ../development/python-modules/aiorwlock { };
+
   aiosenseme = callPackage ../development/python-modules/aiosenseme { };
 
   aiosenz = callPackage ../development/python-modules/aiosenz { };
@@ -4031,6 +4033,8 @@ in {
 
   gpsoauth = callPackage ../development/python-modules/gpsoauth { };
 
+  gpustat = callPackage ../development/python-modules/gpustat { };
+
   gpxpy = callPackage ../development/python-modules/gpxpy { };
 
   gpy = callPackage ../development/python-modules/gpy { };
@@ -6512,6 +6516,8 @@ in {
       openbabel = callPackage ../development/libraries/openbabel { inherit (self) python; };
   };
 
+  opencensus = callPackage ../development/python-modules/opencensus { };
+
   opencv3 = toPythonModule (pkgs.opencv3.override {
     enablePython = true;
     pythonPackages = self;
@@ -9612,6 +9618,8 @@ in {
 
   rawkit = callPackage ../development/python-modules/rawkit { };
 
+  ray = callPackage ../development/python-modules/ray { redis = pkgs.redis; };
+
   rbtools = callPackage ../development/python-modules/rbtools { };
 
   rcssmin = callPackage ../development/python-modules/rcssmin { };