Merge master into staging-next

19 files changed, 485 insertions, 224 deletions

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 0bb9959a510..152974b465a 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -210,6 +210,7 @@ In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json
 * `npmPruneFlags`: Flags to pass to `npm prune`. Defaults to the value of `npmInstallFlags`.
 * `makeWrapperArgs`: Flags to pass to `makeWrapper`, added to executable calling the generated `.js` with `node` as an interpreter. These scripts are defined in `package.json`.
 * `nodejs`: The `nodejs` package to build against, using the corresponding `npm` shipped with that version of `node`. Defaults to `pkgs.nodejs`.
+* `npmDeps`: The dependencies used to build the npm package. Especially useful to not have to recompute workspace depedencies.
 
 #### prefetch-npm-deps {#javascript-buildNpmPackage-prefetch-npm-deps}
 
diff --git a/nixos/modules/services/search/opensearch.nix b/nixos/modules/services/search/opensearch.nix
index 9a50e796313..ae79d5545fd 100644
--- a/nixos/modules/services/search/opensearch.nix
+++ b/nixos/modules/services/search/opensearch.nix
@@ -72,6 +72,18 @@ in
             The port to listen on for transport traffic.
           '';
         };
+
+        options."plugins.security.disabled" = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = lib.mdDoc ''
+            Whether to enable the security plugin,
+            `plugins.security.ssl.transport.keystore_filepath` or
+            `plugins.security.ssl.transport.server.pemcert_filepath` and
+            `plugins.security.ssl.transport.client.pemcert_filepath`
+            must be set for this plugin to be enabled.
+          '';
+        };
       };
 
       default = {};
@@ -186,6 +198,13 @@ in
               shopt -s inherit_errexit
 
               # Install plugins
+
+              # remove plugins directory if it is empty.
+              if [ -z "$(ls -A ${cfg.dataDir}/plugins)" ]; then
+                rm -r "${cfg.dataDir}/plugins"
+              fi
+
+              ln -sfT "${cfg.package}/plugins" "${cfg.dataDir}/plugins"
               ln -sfT ${cfg.package}/lib ${cfg.dataDir}/lib
               ln -sfT ${cfg.package}/modules ${cfg.dataDir}/modules
 
diff --git a/nixos/tests/dnscrypt-wrapper/default.nix b/nixos/tests/dnscrypt-wrapper/default.nix
index 1c05376e097..1a794931dc5 100644
--- a/nixos/tests/dnscrypt-wrapper/default.nix
+++ b/nixos/tests/dnscrypt-wrapper/default.nix
@@ -1,5 +1,15 @@
+
 { lib, pkgs, ... }:
 
+let
+  snakeoil = import ../common/acme/server/snakeoil-certs.nix;
+
+  hosts = lib.mkForce
+   { "fd::a" = [ "server" snakeoil.domain ];
+     "fd::b" = [ "client" ];
+   };
+in
+
 {
   name = "dnscrypt-wrapper";
   meta = with pkgs.lib.maintainers; {
@@ -7,59 +17,122 @@
   };
 
   nodes = {
-    server = { lib, ... }:
-      { services.dnscrypt-wrapper = with builtins;
+    server = {
+      networking.hosts = hosts;
+      networking.interfaces.eth1.ipv6.addresses = lib.singleton
+        { address = "fd::a"; prefixLength = 64; };
+
+        services.dnscrypt-wrapper =
           { enable = true;
-            address = "192.168.1.1";
+            address = "[::]";
+            port = 5353;
             keys.expiration = 5; # days
             keys.checkInterval = 2;  # min
             # The keypair was generated by the command:
             # dnscrypt-wrapper --gen-provider-keypair \
             #  --provider-name=2.dnscrypt-cert.server \
-            #  --ext-address=192.168.1.1:5353
-            providerKey.public = toFile "public.key" (readFile ./public.key);
-            providerKey.secret = toFile "secret.key" (readFile ./secret.key);
+            providerKey.public = "${./public.key}";
+            providerKey.secret = "${./secret.key}";
+          };
+
+        # nameserver
+        services.bind.enable = true;
+        services.bind.zones = lib.singleton
+          { name = ".";
+            master = true;
+            file = pkgs.writeText "root.zone" ''
+              $TTL 3600
+              . IN SOA example.org. admin.example.org. ( 1 3h 1h 1w 1d )
+              . IN NS example.org.
+              example.org. IN AAAA 2001:db8::1
+            '';
+          };
+
+        # webserver
+        services.nginx.enable = true;
+        services.nginx.virtualHosts.${snakeoil.domain} =
+          { onlySSL = true;
+            listenAddresses = [ "localhost" ];
+            sslCertificate = snakeoil.${snakeoil.domain}.cert;
+            sslCertificateKey = snakeoil.${snakeoil.domain}.key;
+            locations."/ip".extraConfig = ''
+              default_type text/plain;
+              return 200 "Ciao $remote_addr!\n";
+            '';
           };
-        services.tinydns.enable = true;
-        services.tinydns.data = ''
-          ..:192.168.1.1:a
-          +it.works:1.2.3.4
-        '';
-        networking.firewall.allowedUDPPorts = [ 5353 ];
-        networking.firewall.allowedTCPPorts = [ 5353 ];
-        networking.interfaces.eth1.ipv4.addresses = lib.mkForce
-          [ { address = "192.168.1.1"; prefixLength = 24; } ];
+
+        # demultiplex HTTP and DNS from port 443
+        services.sslh =
+          { enable = true;
+            method = "ev";
+            settings.transparent = true;
+            settings.listen = lib.mkForce
+              [ { host = "server"; port = "443"; is_udp = false; }
+                { host = "server"; port = "443"; is_udp = true; }
+              ];
+            settings.protocols =
+              [ # Send TLS to webserver (TCP)
+                { name = "tls"; host= "localhost"; port= "443"; }
+                # Send DNSCrypt to dnscrypt-wrapper (TCP or UDP)
+                { name = "anyprot"; host = "localhost"; port = "5353"; }
+                { name = "anyprot"; host = "localhost"; port = "5353"; is_udp = true;}
+              ];
+          };
+
+        networking.firewall.allowedTCPPorts = [ 443 ];
+        networking.firewall.allowedUDPPorts = [ 443 ];
       };
 
-    client = { lib, ... }:
-      { services.dnscrypt-proxy2.enable = true;
-        services.dnscrypt-proxy2.upstreamDefaults = false;
-        services.dnscrypt-proxy2.settings = {
-          server_names = [ "server" ];
-          static.server.stamp = "sdns://AQAAAAAAAAAAEDE5Mi4xNjguMS4xOjUzNTMgFEHYOv0SCKSuqR5CDYa7-58cCBuXO2_5uTSVU9wNQF0WMi5kbnNjcnlwdC1jZXJ0LnNlcnZlcg";
+    client = {
+      networking.hosts = hosts;
+      networking.interfaces.eth1.ipv6.addresses = lib.singleton
+        { address = "fd::b"; prefixLength = 64; };
+
+      services.dnscrypt-proxy2.enable = true;
+      services.dnscrypt-proxy2.upstreamDefaults = false;
+      services.dnscrypt-proxy2.settings =
+        { server_names = [ "server" ];
+          listen_addresses = [ "[::1]:53" ];
+          cache = false;
+          # Computed using https://dnscrypt.info/stamps/
+          static.server.stamp =
+            "sdns://AQAAAAAAAAAADzE5Mi4xNjguMS4yOjQ0MyAUQdg6"
+            +"_RIIpK6pHkINhrv7nxwIG5c7b_m5NJVT3A1AXRYyLmRuc2NyeXB0LWNlcnQuc2VydmVy";
         };
-        networking.nameservers = [ "127.0.0.1" ];
-        networking.interfaces.eth1.ipv4.addresses = lib.mkForce
-          [ { address = "192.168.1.2"; prefixLength = 24; } ];
-      };
+      networking.nameservers = [ "::1" ];
+      security.pki.certificateFiles = [ snakeoil.ca.cert ];
+    };
 
   };
 
   testScript = ''
-    start_all()
-
     with subtest("The server can generate the ephemeral keypair"):
         server.wait_for_unit("dnscrypt-wrapper")
         server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.key")
         server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.crt")
         almost_expiration = server.succeed("date --date '4days 23 hours 56min'").strip()
 
-    with subtest("The client can connect to the server"):
-        server.wait_for_unit("tinydns")
-        client.wait_for_unit("dnscrypt-proxy2")
-        assert "1.2.3.4" in client.wait_until_succeeds(
-            "host it.works"
-        ), "The IP address of 'it.works' does not match 1.2.3.4"
+    with subtest("The DNSCrypt client can connect to the server"):
+        server.wait_for_unit("sslh")
+        client.wait_until_succeeds("journalctl -u dnscrypt-proxy2 --grep '\[server\] OK'")
+
+    with subtest("HTTP client can connect to the server"):
+        server.wait_for_unit("nginx")
+        client.succeed("curl -s --fail https://${snakeoil.domain}/ip | grep -q fd::b")
+
+    with subtest("DNS queries over UDP are working"):
+        server.wait_for_unit("bind")
+        client.wait_for_open_port(53)
+        assert "2001:db8::1" in client.wait_until_succeeds(
+            "host -U example.org"
+        ), "The IP address of 'example.org' does not match 2001:db8::1"
+
+    with subtest("DNS queries over TCP are working"):
+        server.wait_for_unit("bind")
+        client.wait_for_open_port(53)
+        assert "2001:db8::1" in client.wait_until_succeeds(
+            "host -T example.org"
+        ), "The IP address of 'example.org' does not match 2001:db8::1"
 
     with subtest("The server rotates the ephemeral keys"):
         # advance time by a little less than 5 days
@@ -68,7 +141,8 @@
         server.wait_for_file("/var/lib/dnscrypt-wrapper/oldkeys")
 
     with subtest("The client can still connect to the server"):
-        server.wait_for_unit("dnscrypt-wrapper")
-        client.succeed("host it.works")
+        client.systemctl("restart dnscrypt-proxy2")
+        client.wait_until_succeeds("host -T example.org")
+        client.wait_until_succeeds("host -U example.org")
   '';
 }
diff --git a/pkgs/build-support/node/build-npm-package/default.nix b/pkgs/build-support/node/build-npm-package/default.nix
index 9babc7ae628..2aefab8ac7a 100644
--- a/pkgs/build-support/node/build-npm-package/default.nix
+++ b/pkgs/build-support/node/build-npm-package/default.nix
@@ -35,16 +35,15 @@
   # Value for npm `--workspace` flag and directory in which the files to be installed are found.
 , npmWorkspace ? null
 , nodejs ? topLevelArgs.nodejs
+, npmDeps ?  fetchNpmDeps {
+  inherit forceGitDeps src srcs sourceRoot prePatch patches postPatch;
+  name = "${name}-npm-deps";
+  hash = npmDepsHash;
+}
 , ...
 } @ args:
 
 let
-  npmDeps = fetchNpmDeps {
-    inherit forceGitDeps src srcs sourceRoot prePatch patches postPatch;
-    name = "${name}-npm-deps";
-    hash = npmDepsHash;
-  };
-
   # .override {} negates splicing, so we need to use buildPackages explicitly
   npmHooks = buildPackages.npmHooks.override {
     inherit nodejs;
diff --git a/pkgs/development/compilers/elm/default.nix b/pkgs/development/compilers/elm/default.nix
index b72d418a97d..9ae727f9376 100644
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@@ -274,6 +274,17 @@ in lib.makeScope pkgs.newScope (self: with self; {
         }
       );
 
+      elm-land = nodePkgs."elm-land".overrideAttrs (
+        old: {
+          meta = with lib; nodePkgs."elm-land".meta // {
+            description = "A production-ready framework for building Elm applications.";
+            homepage = "https://elm.land/";
+            license = licenses.bsd3;
+            maintainers = [ maintainers.zupo ];
+          };
+        }
+      );
+
       lamdera = callPackage ./packages/lamdera.nix {};
 
       elm-doc-preview = nodePkgs."elm-doc-preview".overrideAttrs (old: {
diff --git a/pkgs/development/compilers/elm/packages/node-packages.json b/pkgs/development/compilers/elm/packages/node-packages.json
index 30b2662ba49..8112b01bc9e 100644
--- a/pkgs/development/compilers/elm/packages/node-packages.json
+++ b/pkgs/development/compilers/elm/packages/node-packages.json
@@ -3,6 +3,7 @@
   "elm-coverage",
   "elm-doc-preview",
   "@elm-tooling/elm-language-server",
+  "elm-land",
   "elm-live",
   "elm-spa",
   "elm-test",
diff --git a/pkgs/development/compilers/elm/packages/node-packages.nix b/pkgs/development/compilers/elm/packages/node-packages.nix
index 5bf0474e66f..bfc0fcdf7bd 100644
--- a/pkgs/development/compilers/elm/packages/node-packages.nix
+++ b/pkgs/development/compilers/elm/packages/node-packages.nix
@@ -4,13 +4,13 @@
 
 let
   sources = {
-    "@adobe/css-tools-4.2.0" = {
+    "@adobe/css-tools-4.3.1" = {
       name = "_at_adobe_slash_css-tools";
       packageName = "@adobe/css-tools";
-      version = "4.2.0";
+      version = "4.3.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.2.0.tgz";
-        sha512 = "E09FiIft46CmH5Qnjb0wsW54/YQd69LsxeKUOWawmws1XWvyFGURnAChH0mlr7YPFR1ofwvUQfcL0J3lMxXqPA==";
+        url = "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.3.1.tgz";
+        sha512 = "/62yikz7NLScCGAAST5SHdnjaDJQBDq0M2muyRTpf2VQhw6StBg2ALiu73zSJQ4fMVLA+0uBhBHAle7Wg+2kSg==";
       };
     };
     "@babel/cli-7.12.10" = {
@@ -1399,6 +1399,69 @@ let
         sha512 = "GaHYm+c0O9MjZRu0ongGBRbinu8gVAMd2UZjji6jVmqKtZluZnptXGWhz1E8j8D2HJ3f/yMxKAUC0b+57wncIw==";
       };
     };
+    "@lydell/elm-0.19.1-14" = {
+      name = "_at_lydell_slash_elm";
+      packageName = "@lydell/elm";
+      version = "0.19.1-14";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm/-/elm-0.19.1-14.tgz";
+        sha512 = "otpGlYiNRvL7F9k6MJOTcuyIgHr+XWy/1NtHpGUgQi8lHrnuyCjwKFPPiimKpr3bcZTwpD4nebHuYR0bmPIKuA==";
+      };
+    };
+    "@lydell/elm_darwin_arm64-0.19.1-3" = {
+      name = "_at_lydell_slash_elm_darwin_arm64";
+      packageName = "@lydell/elm_darwin_arm64";
+      version = "0.19.1-3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_darwin_arm64/-/elm_darwin_arm64-0.19.1-3.tgz";
+        sha512 = "RuKTz5ck+RBx4urj1EL/r0xWZZqBMPEXzNBQTEBCAMWLSi4Ck3TVz5pkhBaK+cRZXI+cCgytm/1bIttbp2fFIg==";
+      };
+    };
+    "@lydell/elm_darwin_x64-0.19.1-2" = {
+      name = "_at_lydell_slash_elm_darwin_x64";
+      packageName = "@lydell/elm_darwin_x64";
+      version = "0.19.1-2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_darwin_x64/-/elm_darwin_x64-0.19.1-2.tgz";
+        sha512 = "MXfQwxdQfmuQ22iDCFlcXu5YTA0w6/ASzbxmWc+8DkgUkHTynjViGBVkQljAbYe4ZWgrYGWinZQQyhVnp/5oZw==";
+      };
+    };
+    "@lydell/elm_linux_arm-0.19.1-0" = {
+      name = "_at_lydell_slash_elm_linux_arm";
+      packageName = "@lydell/elm_linux_arm";
+      version = "0.19.1-0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_linux_arm/-/elm_linux_arm-0.19.1-0.tgz";
+        sha512 = "crKrLzuT6jn4OOS7PWKZGYFw6vHwPu3iNP7lg8rFkOog/HxlkRwX4S695aILBG8SGTLhEdfP9tg28SQ7vR4Lpg==";
+      };
+    };
+    "@lydell/elm_linux_arm64-0.19.1-4" = {
+      name = "_at_lydell_slash_elm_linux_arm64";
+      packageName = "@lydell/elm_linux_arm64";
+      version = "0.19.1-4";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_linux_arm64/-/elm_linux_arm64-0.19.1-4.tgz";
+        sha512 = "JuUkkVBtJjUajtTriQFFANHDmwA14NhqNqgIcq5LCJ6vUQv5/LVd6NUOkl/Rdq7Ju/VN/XwBD1/vm7MGIMOTqA==";
+      };
+    };
+    "@lydell/elm_linux_x64-0.19.1-1" = {
+      name = "_at_lydell_slash_elm_linux_x64";
+      packageName = "@lydell/elm_linux_x64";
+      version = "0.19.1-1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_linux_x64/-/elm_linux_x64-0.19.1-1.tgz";
+        sha512 = "1Y8UAb+GfUqlSjUTX9CaaZhJqvhVcfNbYC0N9AEutlXf1CzFMvF4VsDeZdxzhNI4allPRWBD1IqtdlLhBTFacA==";
+      };
+    };
+    "@lydell/elm_win32_x64-0.19.1-1" = {
+      name = "_at_lydell_slash_elm_win32_x64";
+      packageName = "@lydell/elm_win32_x64";
+      version = "0.19.1-1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_win32_x64/-/elm_win32_x64-0.19.1-1.tgz";
+        sha512 = "3LMiJ+uUxDFLNnCd6HBmvVWSjSWjs/Z9dMXZWCMOcw3vrW9iOkRrsNGNxohRXun2YRd8wXOX8/DwVn8i2SJ3KA==";
+      };
+    };
     "@mrmlnc/readdir-enhanced-2.2.1" = {
       name = "_at_mrmlnc_slash_readdir-enhanced";
       packageName = "@mrmlnc/readdir-enhanced";
@@ -1642,13 +1705,13 @@ let
         sha512 = "U5icWpv7YnZYGsN4/cmh3WD2onMY0aJIiTE6+51TwJCttdHvtCYmkBNOobHlXwrJRL0nkH9jH4kD+1FAdMN4Tg==";
       };
     };
-    "@types/node-20.8.9" = {
+    "@types/node-20.8.10" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "20.8.9";
+      version = "20.8.10";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-20.8.9.tgz";
-        sha512 = "UzykFsT3FhHb1h7yD4CA4YhBHq545JC0YnEz41xkipN88eKQtL6rSgocL5tbAP6Ola9Izm/Aw4Ora8He4x0BHg==";
+        url = "https://registry.npmjs.org/@types/node/-/node-20.8.10.tgz";
+        sha512 = "TlgT8JntpcbmKUFzjhsyhGfP2fsiz1Mv56im6enJ905xG1DAYesxJaeSbGqQmAw8OWPdhyJGhGSQGKRNJ45u9w==";
       };
     };
     "@types/node-8.10.66" = {
@@ -1957,13 +2020,13 @@ let
         sha512 = "XtGIhXwF8YM8bJhGxG5kXgjkEuNGLTkoYqVE+KMR+aspr4KGYmKYg7yUe3KghyQ9yheNwLnjmzh/7+gfDBmHCQ==";
       };
     };
-    "acorn-8.11.0" = {
+    "acorn-8.11.2" = {
       name = "acorn";
       packageName = "acorn";
-      version = "8.11.0";
+      version = "8.11.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/acorn/-/acorn-8.11.0.tgz";
-        sha512 = "hNiSyky+cuYVALBrsjB7f9gMN9P4u09JyAiMNMLaVfsmkDJuH84M1T/0pfDX/OJfGWcobd2A7ecXYzygn8wibA==";
+        url = "https://registry.npmjs.org/acorn/-/acorn-8.11.2.tgz";
+        sha512 = "nc0Axzp/0FILLEVsm4fNwLCwMttvhEI263QtVPQcbpfZZ3ts0hLsZGOpE6czNlid7CJ9MlyH8reXkpsf3YUY4w==";
       };
     };
     "address-1.0.3" = {
@@ -3190,13 +3253,13 @@ let
         sha512 = "bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==";
       };
     };
-    "caniuse-lite-1.0.30001554" = {
+    "caniuse-lite-1.0.30001561" = {
       name = "caniuse-lite";
       packageName = "caniuse-lite";
-      version = "1.0.30001554";
+      version = "1.0.30001561";
       src = fetchurl {
-        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001554.tgz";
-        sha512 = "A2E3U//MBwbJVzebddm1YfNp7Nud5Ip+IPn4BozBmn4KqVX7AvluoIDFWjsv5OkGnKUXQVmMSoMKLa3ScCblcQ==";
+        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001561.tgz";
+        sha512 = "NTt0DNoKe958Q0BE0j0c1V9jbUzhBxHIEJy7asmGrpE0yG63KTV7PLHPnK2E1O9RsQrQ081I3NLuXGS6zht3cw==";
       };
     };
     "case-sensitive-paths-webpack-plugin-2.3.0" = {
@@ -3946,13 +4009,13 @@ let
         sha512 = "Kb2wC0fvsWfQrgk8HU5lW6U/Lcs8+9aaYcy4ZFc6DDlo4nZ7n70dEgE5rtR0oG6ufKDUnrwfWL1mXR5ljDatrQ==";
       };
     };
-    "core-js-compat-3.33.1" = {
+    "core-js-compat-3.33.2" = {
       name = "core-js-compat";
       packageName = "core-js-compat";
-      version = "3.33.1";
+      version = "3.33.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.33.1.tgz";
-        sha512 = "6pYKNOgD/j/bkC5xS5IIg6bncid3rfrI42oBH1SQJbsmYPKF7rhzcFzYCcxYMmNQQ0rCEB8WqpW7QHndOggaeQ==";
+        url = "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.33.2.tgz";
+        sha512 = "axfo+wxFVxnqf8RvxTzoAlzW4gRoacrHeoFlc9n0x50+7BEyZL/Rt3hicaED1/CEd7I6tPCPVUYcJwCMO5XUYw==";
       };
     };
     "core-util-is-1.0.2" = {
@@ -4810,13 +4873,13 @@ let
         sha512 = "WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==";
       };
     };
-    "electron-to-chromium-1.4.567" = {
+    "electron-to-chromium-1.4.576" = {
       name = "electron-to-chromium";
       packageName = "electron-to-chromium";
-      version = "1.4.567";
+      version = "1.4.576";
       src = fetchurl {
-        url = "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.567.tgz";
-        sha512 = "8KR114CAYQ4/r5EIEsOmOMqQ9j0MRbJZR3aXD/KFA8RuKzyoUB4XrUCg+l8RUGqTVQgKNIgTpjaG8YHRPAbX2w==";
+        url = "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.576.tgz";
+        sha512 = "yXsZyXJfAqzWk1WKryr0Wl0MN2D47xodPvEEwlVePBnhU5E7raevLQR+E6b9JAD3GfL/7MbAL9ZtWQQPcLx7wA==";
       };
     };
     "elliptic-6.5.4" = {
@@ -7204,15 +7267,6 @@ let
         sha512 = "opmNIX7uFnS96NtPmhWQgQx6/NYFgsUXYMllcfzwWKUMwfo8kku1TvE6hkNcH+Q1ts5cMVrsY7j0bxXQDciu9Q==";
       };
     };
-    "is-accessor-descriptor-0.1.6" = {
-      name = "is-accessor-descriptor";
-      packageName = "is-accessor-descriptor";
-      version = "0.1.6";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-0.1.6.tgz";
-        sha512 = "e1BM1qnDbMRG3ll2U9dSK0UMHuWOs3pY3AtcFsmvwPtKL3MML/Q86i+GilLfvqEs4GW+ExB91tQ3Ig9noDIZ+A==";
-      };
-    };
     "is-accessor-descriptor-1.0.1" = {
       name = "is-accessor-descriptor";
       packageName = "is-accessor-descriptor";
@@ -7330,15 +7384,6 @@ let
         sha512 = "hHrIjvZsftOsvKSn2TRYl63zvxsgE0K+0mYMoH6gD4omR5IWB2KynivBQczo3+wF1cCkjzvptnI9Q0sPU66ilw==";
       };
     };
-    "is-data-descriptor-0.1.4" = {
-      name = "is-data-descriptor";
-      packageName = "is-data-descriptor";
-      version = "0.1.4";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-0.1.4.tgz";
-        sha512 = "+w9D5ulSoBNlmw9OHn3U2v51SyoCd0he+bB3xMl62oijhrspxowjU+AIcDY0N3iEJbUEkB15IlMASQsxYigvXg==";
-      };
-    };
     "is-data-descriptor-1.0.1" = {
       name = "is-data-descriptor";
       packageName = "is-data-descriptor";
@@ -7357,22 +7402,22 @@ let
         sha512 = "9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ==";
       };
     };
-    "is-descriptor-0.1.6" = {
+    "is-descriptor-0.1.7" = {
       name = "is-descriptor";
       packageName = "is-descriptor";
-      version = "0.1.6";
+      version = "0.1.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.6.tgz";
-        sha512 = "avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==";
+        url = "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.7.tgz";
+        sha512 = "C3grZTvObeN1xud4cRWl366OMXZTj0+HGyk4hvfpx4ZHt1Pb60ANSXqCK7pdOTeUQpRzECBSTphqvD7U+l22Eg==";
       };
     };
-    "is-descriptor-1.0.2" = {
+    "is-descriptor-1.0.3" = {
       name = "is-descriptor";
       packageName = "is-descriptor";
-      version = "1.0.2";
+      version = "1.0.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz";
-        sha512 = "2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==";
+        url = "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.3.tgz";
+        sha512 = "JCNNGbwWZEVaSPtS45mdtrneRWJFp07LLmykxeFV5F6oBvNF8vHSfJuJgoT472pSfk+Mf8VnlrspaFBHWM8JAw==";
       };
     };
     "is-directory-0.3.1" = {
@@ -8122,15 +8167,6 @@ let
         sha512 = "24XsCxmEbRwEDbz/qz3stgin8TTzZ1ESR56OMCN0ujYg+vRutNSiOj9bHH9u85DKgXguraugV5sFuvbD4FW/hw==";
       };
     };
-    "kind-of-5.1.0" = {
-      name = "kind-of";
-      packageName = "kind-of";
-      version = "5.1.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/kind-of/-/kind-of-5.1.0.tgz";
-        sha512 = "NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==";
-      };
-    };
     "kind-of-6.0.3" = {
       name = "kind-of";
       packageName = "kind-of";
@@ -10957,13 +10993,13 @@ let
         sha512 = "jmYNElW7yvO7TV33CjSmvSiE2yco3bV2czu/OzDKdMNVZQWfxCblURLhf+47syQRBntjfLdd/H0egrzIG+oaFQ==";
       };
     };
-    "punycode-2.3.0" = {
+    "punycode-2.3.1" = {
       name = "punycode";
       packageName = "punycode";
-      version = "2.3.0";
+      version = "2.3.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/punycode/-/punycode-2.3.0.tgz";
-        sha512 = "rRV+zQD8tVFys26lAGR9WUuS4iUAngJScM+ZRSKtvl5tKeZ2t5bvdNFdNHBW9FWR4guGHlgmsZ1G7BSm2wTbuA==";
+        url = "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz";
+        sha512 = "vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==";
       };
     };
     "q-1.5.1" = {
@@ -12928,13 +12964,13 @@ let
         sha512 = "7GlLk9JwlElY4Y6a/rmbH2MhVlTyVmiJd1PfTCqFaIBEGMYNsrO/v3SeGTdhBThLg4Z+NbOk/qFMwCa+J+3p/g==";
       };
     };
-    "stylus-0.60.0" = {
+    "stylus-0.61.0" = {
       name = "stylus";
       packageName = "stylus";
-      version = "0.60.0";
+      version = "0.61.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/stylus/-/stylus-0.60.0.tgz";
-        sha512 = "j2pBgEwzCu05yCuY4cmyp0FtPQQFBBAGB7TY7QaNl7eztiHwkxzwvIp5vjZJND/a1JNOka+ZW9ewVPFZpI3pcA==";
+        url = "https://registry.npmjs.org/stylus/-/stylus-0.61.0.tgz";
+        sha512 = "oaV9T4sRBiQfChXE0av9SrLD+ovEdQiWzPJ5kwIeYvMhjUDJnZtdubAG6lSSbaR4sCnoT6sw411IOl5Akcht4Q==";
       };
     };
     "sudo-prompt-8.2.5" = {
@@ -13108,13 +13144,22 @@ let
         sha512 = "4GnLC0x667eJG0ewJTa6z/yXrbLGv80D9Ru6HIpCQmO+Q4PfEtBFi0ObSckqwL6VyQv/7ENJieXHo2ANmdQwgw==";
       };
     };
-    "terser-5.22.0" = {
+    "terser-5.15.1" = {
       name = "terser";
       packageName = "terser";
-      version = "5.22.0";
+      version = "5.15.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/terser/-/terser-5.22.0.tgz";
-        sha512 = "hHZVLgRA2z4NWcN6aS5rQDc+7Dcy58HOf2zbYwmFcQ+ua3h6eEFf5lIDKTzbWwlazPyOZsFQO8V80/IjVNExEw==";
+        url = "https://registry.npmjs.org/terser/-/terser-5.15.1.tgz";
+        sha512 = "K1faMUvpm/FBxjBXud0LWVAGxmvoPbZbfTCYbSgaaYQaIXI3/TdI7a7ZGA73Zrou6Q8Zmz3oeUTsp/dj+ag2Xw==";
+      };
+    };
+    "terser-5.24.0" = {
+      name = "terser";
+      packageName = "terser";
+      version = "5.24.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/terser/-/terser-5.24.0.tgz";
+        sha512 = "ZpGR4Hy3+wBEzVEnHvstMvqpD/nABNelQn/z2r0fjVWGQsN3bpOLzQlqDxmb4CDZnXq5lpjnQ+mHQLAOpfM5iw==";
       };
     };
     "terser-5.3.8" = {
@@ -13549,6 +13594,15 @@ let
         sha512 = "zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==";
       };
     };
+    "typescript-4.9.3" = {
+      name = "typescript";
+      packageName = "typescript";
+      version = "4.9.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/typescript/-/typescript-4.9.3.tgz";
+        sha512 = "CIfGzTelbKNEnLpLdGFgdyKhG23CKdKgQPOBc+OUNrkJ2vr+KSzsSV5kq5iWhEQbok+quxgGzrAtGWCyU7tHnA==";
+      };
+    };
     "typescript-4.9.5" = {
       name = "typescript";
       packageName = "typescript";
@@ -13720,13 +13774,13 @@ let
         sha512 = "rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==";
       };
     };
-    "universalify-2.0.0" = {
+    "universalify-2.0.1" = {
       name = "universalify";
       packageName = "universalify";
-      version = "2.0.0";
+      version = "2.0.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz";
-        sha512 = "hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==";
+        url = "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz";
+        sha512 = "gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==";
       };
     };
     "unpipe-1.0.0" = {
@@ -13990,6 +14044,15 @@ let
         sha512 = "ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw==";
       };
     };
+    "vite-4.3.9" = {
+      name = "vite";
+      packageName = "vite";
+      version = "4.3.9";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vite/-/vite-4.3.9.tgz";
+        sha512 = "qsTNZjO9NoJNW7KnOrgYwczm0WctJ8m/yqYAMAK9Lxt4SoySUfS5S8ia9K7JHpa3KEeMfyF8LoJ3c5NeBJy6pg==";
+      };
+    };
     "vite-4.5.0" = {
       name = "vite";
       packageName = "vite";
@@ -14880,7 +14943,7 @@ in
       sources."process-nextick-args-1.0.7"
       sources."proxy-addr-2.0.7"
       sources."psl-1.9.0"
-      sources."punycode-2.3.0"
+      sources."punycode-2.3.1"
       sources."qs-6.7.0"
       sources."range-parser-1.2.1"
       sources."raw-body-2.4.0"
@@ -15118,7 +15181,7 @@ in
       sources."picomatch-2.3.1"
       sources."pseudomap-1.0.2"
       sources."psl-1.9.0"
-      sources."punycode-2.3.0"
+      sources."punycode-2.3.1"
       sources."qs-6.5.3"
       sources."readdirp-3.1.3"
       sources."request-2.88.2"
@@ -15471,6 +15534,148 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  elm-land = nodeEnv.buildNodePackage {
+    name = "elm-land";
+    packageName = "elm-land";
+    version = "0.19.4";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/elm-land/-/elm-land-0.19.4.tgz";
+      sha512 = "ruspCQ7s+ZOSILEJ8psXuQMb4ASGfgXCqmMjiLIyV7oX42nSpQGYADTXwiAwo+E7ESev1TWspn/DkAxsuDo6Qg==";
+    };
+    dependencies = [
+      sources."@adobe/css-tools-4.3.1"
+      sources."@esbuild/android-arm-0.17.19"
+      sources."@esbuild/android-arm64-0.17.19"
+      sources."@esbuild/android-x64-0.17.19"
+      sources."@esbuild/darwin-arm64-0.17.19"
+      sources."@esbuild/darwin-x64-0.17.19"
+      sources."@esbuild/freebsd-arm64-0.17.19"
+      sources."@esbuild/freebsd-x64-0.17.19"
+      sources."@esbuild/linux-arm-0.17.19"
+      sources."@esbuild/linux-arm64-0.17.19"
+      sources."@esbuild/linux-ia32-0.17.19"
+      sources."@esbuild/linux-loong64-0.17.19"
+      sources."@esbuild/linux-mips64el-0.17.19"
+      sources."@esbuild/linux-ppc64-0.17.19"
+      sources."@esbuild/linux-riscv64-0.17.19"
+      sources."@esbuild/linux-s390x-0.17.19"
+      sources."@esbuild/linux-x64-0.17.19"
+      sources."@esbuild/netbsd-x64-0.17.19"
+      sources."@esbuild/openbsd-x64-0.17.19"
+      sources."@esbuild/sunos-x64-0.17.19"
+      sources."@esbuild/win32-arm64-0.17.19"
+      sources."@esbuild/win32-ia32-0.17.19"
+      sources."@esbuild/win32-x64-0.17.19"
+      sources."@jridgewell/gen-mapping-0.3.3"
+      sources."@jridgewell/resolve-uri-3.1.1"
+      sources."@jridgewell/set-array-1.1.2"
+      sources."@jridgewell/source-map-0.3.5"
+      sources."@jridgewell/sourcemap-codec-1.4.15"
+      sources."@jridgewell/trace-mapping-0.3.20"
+      sources."@lydell/elm-0.19.1-14"
+      sources."@lydell/elm_darwin_arm64-0.19.1-3"
+      sources."@lydell/elm_darwin_x64-0.19.1-2"
+      sources."@lydell/elm_linux_arm-0.19.1-0"
+      sources."@lydell/elm_linux_arm64-0.19.1-4"
+      sources."@lydell/elm_linux_x64-0.19.1-1"
+      sources."@lydell/elm_win32_x64-0.19.1-1"
+      sources."@types/node-20.8.10"
+      sources."acorn-8.11.2"
+      sources."anymatch-3.1.3"
+      sources."balanced-match-1.0.2"
+      sources."binary-extensions-2.2.0"
+      sources."brace-expansion-1.1.11"
+      sources."braces-3.0.2"
+      sources."buffer-from-1.1.2"
+      sources."chokidar-3.5.3"
+      sources."commander-2.20.3"
+      sources."concat-map-0.0.1"
+      sources."copy-anything-2.0.6"
+      sources."cross-spawn-6.0.5"
+      sources."debug-3.2.7"
+      sources."errno-0.1.8"
+      sources."esbuild-0.17.19"
+      sources."fill-range-7.0.1"
+      sources."find-elm-dependencies-2.0.4"
+      sources."firstline-1.3.1"
+      sources."fs.realpath-1.0.0"
+      sources."fsevents-2.3.3"
+      sources."glob-7.2.3"
+      sources."glob-parent-5.1.2"
+      sources."graceful-fs-4.2.11"
+      sources."iconv-lite-0.6.3"
+      sources."image-size-0.5.5"
+      sources."immutable-4.3.4"
+      sources."inflight-1.0.6"
+      sources."inherits-2.0.4"
+      sources."is-binary-path-2.1.0"
+      sources."is-extglob-2.1.1"
+      sources."is-glob-4.0.3"
+      sources."is-number-7.0.0"
+      sources."is-what-3.14.1"
+      sources."isexe-2.0.0"
+      sources."less-4.2.0"
+      sources."lodash-4.17.21"
+      sources."make-dir-2.1.0"
+      sources."mime-1.6.0"
+      sources."minimatch-3.1.2"
+      sources."minimist-1.2.8"
+      sources."mkdirp-0.5.6"
+      sources."ms-2.1.3"
+      sources."nanoid-3.3.6"
+      sources."needle-3.2.0"
+      sources."nice-try-1.0.5"
+      sources."node-elm-compiler-5.0.6"
+      sources."normalize-path-3.0.0"
+      sources."once-1.4.0"
+      sources."parse-node-version-1.0.1"
+      sources."path-is-absolute-1.0.1"
+      sources."path-key-2.0.1"
+      sources."picocolors-1.0.0"
+      sources."picomatch-2.3.1"
+      sources."pify-4.0.1"
+      sources."postcss-8.4.31"
+      sources."prr-1.0.1"
+      sources."readdirp-3.6.0"
+      sources."rimraf-2.6.3"
+      sources."rollup-3.29.4"
+      sources."safer-buffer-2.1.2"
+      sources."sass-1.69.5"
+      sources."sax-1.3.0"
+      sources."semver-5.7.2"
+      sources."shebang-command-1.2.0"
+      sources."shebang-regex-1.0.0"
+      sources."source-map-0.6.1"
+      sources."source-map-js-1.0.2"
+      sources."source-map-support-0.5.21"
+      (sources."stylus-0.61.0" // {
+        dependencies = [
+          sources."debug-4.3.4"
+          sources."ms-2.1.2"
+          sources."source-map-0.7.4"
+        ];
+      })
+      sources."sugarss-4.0.1"
+      sources."temp-0.9.4"
+      sources."terser-5.15.1"
+      sources."to-regex-range-5.0.1"
+      sources."tslib-2.6.2"
+      sources."typescript-4.9.3"
+      sources."undici-types-5.26.5"
+      sources."vite-4.3.9"
+      sources."which-1.3.1"
+      sources."wrappy-1.0.2"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "Reliable web apps for everyone";
+      homepage = "https://elm.land";
+      license = "ISC";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   elm-live = nodeEnv.buildNodePackage {
     name = "elm-live";
     packageName = "elm-live";
@@ -15756,7 +15961,7 @@ in
       sources."@types/cacheable-request-6.0.3"
       sources."@types/http-cache-semantics-4.0.3"
       sources."@types/keyv-3.1.4"
-      sources."@types/node-20.8.9"
+      sources."@types/node-20.8.10"
       sources."@types/responselike-1.0.2"
       sources."cacheable-lookup-2.0.1"
       sources."cacheable-request-7.0.4"
@@ -15920,7 +16125,7 @@ in
       (sources."fs-extra-11.1.1" // {
         dependencies = [
           sources."jsonfile-6.1.0"
-          sources."universalify-2.0.0"
+          sources."universalify-2.0.1"
         ];
       })
       sources."fs-minipass-1.2.7"
@@ -15984,7 +16189,7 @@ in
       sources."performance-now-2.1.0"
       sources."picomatch-2.3.1"
       sources."psl-1.9.0"
-      sources."punycode-2.3.0"
+      sources."punycode-2.3.1"
       sources."qs-6.5.3"
       sources."readdirp-3.1.3"
       sources."request-2.88.2"
@@ -16264,7 +16469,7 @@ in
       sources."@types/http-proxy-1.17.13"
       sources."@types/json-schema-7.0.14"
       sources."@types/minimatch-5.1.2"
-      sources."@types/node-20.8.9"
+      sources."@types/node-20.8.10"
       sources."@types/parse-json-4.0.1"
       sources."@types/q-1.5.7"
       sources."@types/source-list-map-0.1.4"
@@ -16435,7 +16640,7 @@ in
       sources."camel-case-4.1.2"
       sources."camelcase-5.3.1"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001554"
+      sources."caniuse-lite-1.0.30001561"
       sources."case-sensitive-paths-webpack-plugin-2.3.0"
       sources."caseless-0.12.0"
       (sources."chalk-2.4.2" // {
@@ -16455,18 +16660,7 @@ in
       (sources."class-utils-0.3.6" // {
         dependencies = [
           sources."define-property-0.2.5"
-          (sources."is-accessor-descriptor-0.1.6" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          (sources."is-data-descriptor-0.1.4" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          sources."is-descriptor-0.1.6"
-          sources."kind-of-5.1.0"
+          sources."is-descriptor-0.1.7"
         ];
       })
       (sources."clean-css-4.2.4" // {
@@ -16534,7 +16728,7 @@ in
         ];
       })
       sources."core-js-2.6.12"
-      sources."core-js-compat-3.33.1"
+      sources."core-js-compat-3.33.2"
       sources."core-util-is-1.0.3"
       sources."cosmiconfig-5.2.1"
       (sources."create-ecdh-4.0.4" // {
@@ -16659,7 +16853,7 @@ in
       sources."duplexify-3.7.1"
       sources."ecc-jsbn-0.1.2"
       sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.4.567"
+      sources."electron-to-chromium-1.4.576"
       (sources."elliptic-6.5.4" // {
         dependencies = [
           sources."bn.js-4.12.0"
@@ -16732,18 +16926,7 @@ in
           sources."debug-2.6.9"
           sources."define-property-0.2.5"
           sources."extend-shallow-2.0.1"
-          (sources."is-accessor-descriptor-0.1.6" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          (sources."is-data-descriptor-0.1.4" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          sources."is-descriptor-0.1.6"
-          sources."kind-of-5.1.0"
+          sources."is-descriptor-0.1.7"
           sources."ms-2.0.0"
         ];
       })
@@ -16987,7 +17170,7 @@ in
       sources."is-core-module-2.13.1"
       sources."is-data-descriptor-1.0.1"
       sources."is-date-object-1.0.5"
-      sources."is-descriptor-1.0.2"
+      sources."is-descriptor-1.0.3"
       sources."is-directory-0.3.1"
       sources."is-extendable-0.1.1"
       sources."is-extglob-2.1.1"
@@ -17144,13 +17327,7 @@ in
       (sources."object-copy-0.1.0" // {
         dependencies = [
           sources."define-property-0.2.5"
-          sources."is-accessor-descriptor-0.1.6"
-          sources."is-data-descriptor-0.1.4"
-          (sources."is-descriptor-0.1.6" // {
-            dependencies = [
-              sources."kind-of-5.1.0"
-            ];
-          })
+          sources."is-descriptor-0.1.7"
           sources."kind-of-3.2.2"
         ];
       })
@@ -17520,7 +17697,7 @@ in
           sources."pump-2.0.1"
         ];
       })
-      sources."punycode-2.3.0"
+      sources."punycode-2.3.1"
       sources."q-1.5.1"
       sources."qs-6.5.3"
       sources."query-string-4.3.4"
@@ -17696,18 +17873,7 @@ in
           sources."debug-2.6.9"
           sources."define-property-0.2.5"
           sources."extend-shallow-2.0.1"
-          (sources."is-accessor-descriptor-0.1.6" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          (sources."is-data-descriptor-0.1.4" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          sources."is-descriptor-0.1.6"
-          sources."kind-of-5.1.0"
+          sources."is-descriptor-0.1.7"
           sources."ms-2.0.0"
         ];
       })
@@ -17764,18 +17930,7 @@ in
       (sources."static-extend-0.1.2" // {
         dependencies = [
           sources."define-property-0.2.5"
-          (sources."is-accessor-descriptor-0.1.6" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          (sources."is-data-descriptor-0.1.4" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          sources."is-descriptor-0.1.6"
-          sources."kind-of-5.1.0"
+          sources."is-descriptor-0.1.7"
         ];
       })
       sources."statuses-2.0.1"
@@ -18231,7 +18386,7 @@ in
       sha512 = "EFwDCYHm3rwCiwXwfSUKeDDcIYrQ61deChDk7ruXPN4y0PkIINIKbljLu3uOnKSYhzc5CGSc7avwiAlkxXnJsA==";
     };
     dependencies = [
-      sources."@adobe/css-tools-4.2.0"
+      sources."@adobe/css-tools-4.3.1"
       sources."@esbuild/android-arm-0.17.19"
       sources."@esbuild/android-arm64-0.17.19"
       sources."@esbuild/android-x64-0.17.19"
@@ -18284,7 +18439,7 @@ in
       sources."@types/rimraf-2.0.5"
       sources."@types/tmp-0.0.33"
       sources."accepts-1.3.8"
-      sources."acorn-8.11.0"
+      sources."acorn-8.11.2"
       (sources."agent-base-6.0.2" // {
         dependencies = [
           sources."debug-4.3.4"
@@ -18593,7 +18748,7 @@ in
       sources."proxy-addr-2.0.7"
       sources."prr-1.0.1"
       sources."pump-3.0.0"
-      sources."punycode-2.3.0"
+      sources."punycode-2.3.1"
       sources."qs-6.11.0"
       sources."queue-microtask-1.2.3"
       sources."range-parser-1.2.1"
@@ -18671,11 +18826,10 @@ in
       sources."strip-ansi-cjs-6.0.1"
       sources."strip-bom-string-1.0.0"
       sources."strip-json-comments-2.0.1"
-      (sources."stylus-0.60.0" // {
+      (sources."stylus-0.61.0" // {
         dependencies = [
           sources."debug-4.3.4"
           sources."ms-2.1.2"
-          sources."sax-1.2.4"
           sources."source-map-0.7.4"
         ];
       })
@@ -18692,7 +18846,7 @@ in
           sources."mkdirp-1.0.4"
         ];
       })
-      (sources."terser-5.22.0" // {
+      (sources."terser-5.24.0" // {
         dependencies = [
           sources."commander-2.20.3"
         ];
@@ -18707,7 +18861,7 @@ in
       sources."undici-types-5.26.5"
       sources."unique-filename-3.0.0"
       sources."unique-slug-4.0.0"
-      sources."universalify-2.0.0"
+      sources."universalify-2.0.1"
       sources."unpipe-1.0.0"
       sources."url-parse-lax-3.0.0"
       sources."utf-8-validate-5.0.10"
@@ -18737,7 +18891,7 @@ in
           sources."@esbuild/win32-arm64-0.18.20"
           sources."@esbuild/win32-ia32-0.18.20"
           sources."@esbuild/win32-x64-0.18.20"
-          sources."@types/node-20.8.9"
+          sources."@types/node-20.8.10"
           sources."esbuild-0.18.20"
         ];
       })
@@ -18789,7 +18943,7 @@ in
       sources."@types/cacheable-request-6.0.3"
       sources."@types/http-cache-semantics-4.0.3"
       sources."@types/keyv-3.1.4"
-      sources."@types/node-20.8.9"
+      sources."@types/node-20.8.10"
       sources."@types/responselike-1.0.2"
       sources."ansi-escapes-4.3.2"
       sources."ansi-regex-6.0.1"
@@ -18938,7 +19092,7 @@ in
       sources."to-regex-range-5.0.1"
       sources."type-fest-0.21.3"
       sources."undici-types-5.26.5"
-      sources."universalify-2.0.0"
+      sources."universalify-2.0.1"
       sources."util-deprecate-1.0.2"
       sources."wcwidth-1.0.1"
       sources."which-2.0.2"
diff --git a/pkgs/development/libraries/sentry-native/default.nix b/pkgs/development/libraries/sentry-native/default.nix
index e8c090e392b..95ba1dc68e5 100644
--- a/pkgs/development/libraries/sentry-native/default.nix
+++ b/pkgs/development/libraries/sentry-native/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentry-native";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-native";
     rev = version;
-    hash = "sha256-mi9mEyb25fb3W6X07TX36fW6T2SOPOkDvpIXQn5sg8Q=";
+    hash = "sha256-pEFfs8xjc+6r+60aJF4Sjjy/oSU/+ADWgOBpS3t9rWI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index aca851a22f8..efee6e3d1fa 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -51,7 +51,7 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.35.1";
+  version = "4.35.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ayHx3U/Jpo8K189M6qjRvRbFa9QEpx2uqG85hB8zC/Y=";
+    hash = "sha256-h1RMSEcuali05AWeTm1wyZQJz6XrHamCF1eHrSnFnfM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkstyle/default.nix b/pkgs/development/tools/analysis/checkstyle/default.nix
index d6c6740e2a2..96bd017e777 100644
--- a/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenvNoCC, fetchurl, makeBinaryWrapper, jre }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "10.12.4";
+  version = "10.12.5";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-ecWTB/4Lc7zgkQI6nN5VvKfRizeMEdyGUyL0fxiAHhk=";
+    sha256 = "sha256-DAUPngTL9c2MePG5ISLul+iRvnwqChg04fo63aKAee0=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index 4f483fd5f3b..d8edce696a7 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     rev = "v${version}";
-    hash = "sha256-eX76LRzhAk2n96eMtvbnm4Id99jRCDo3gMlrr5hI3Nw=";
+    hash = "sha256-YXFfjJp4dSxzEyAtrEi/ONQZKD7QAU/MZ62l4QCcbwE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index d361773b4d9..23fac8ddac7 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Lfd6jULV64vP5GQtOQ/wqyu4zZNpU83HSVGXQ8AtnvQ=";
+    sha256 = "sha256-Bw9+BUvZC4sRLFyU5K6FHsWVZ3PTlMAonRmTSwV5AwU=";
   };
 
-  cargoSha256 = "sha256-rojb15M58TnGZfptTMVCC6XaI9RBlpVL7s/Mb18CaSM=";
+  cargoSha256 = "sha256-bainEM4eRMNyecSBi5k1ifjDULWdXed6GP6i10IVA+w=";
 
   # remove cargo config so it can find the linker on aarch64-unknown-linux-gnu
   postPatch = ''
diff --git a/pkgs/misc/mnemonicode/default.nix b/pkgs/misc/mnemonicode/default.nix
index 4ecacaf418a..1cd78fdce09 100644
--- a/pkgs/misc/mnemonicode/default.nix
+++ b/pkgs/misc/mnemonicode/default.nix
@@ -1,20 +1,21 @@
 { stdenv, lib, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mnemonicode";
-  version = "2015-11-30";
+  version = "1.0.0";
   src = fetchFromGitHub {
     owner = "singpolyma";
     repo = "mnemonicode";
-    rev = "1687fabdf48acf68d4186f219bc20bffe02e8ee0";
-    sha256 = "0kp1jhhqfwfiqg9kx0mbyr4qh4yc4zg4szqk5fbf809nx2pvprm5";
+    rev = finalAttrs.version;
+    hash = "sha256-bGipPvLj6ig+lMLsl/Yve8PmuA93ETvhNKoMPh0JMBM=";
   };
   installPhase = ''
     mkdir -p $out/bin
-    cp mnencode $out/bin
-    cp mndecode $out/bin
+    mv mnencode $out/bin
+    mv mndecode $out/bin
   '';
   meta = with lib; {
+    homepage = "https://github.com/singpolyma/mnemonicode";
     description = ''
       Routines which implement a method for encoding binary data into a sequence
       of words which can be spoken over the phone, for example, and converted
@@ -22,6 +23,7 @@ stdenv.mkDerivation {
     '';
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = [ ];
+    maintainers = with maintainers; [ kirillrdy ];
+    mainProgram = "mnencode";
   };
-}
+})
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 7888f426cb3..8dcee384d6d 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.28.4";
+  version = "1.28.5";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -16,10 +16,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-Z6BhMLpuK7j8yo3XGlu6DaTv6e+VMa9fft/KtWNprpc=";
+    hash = "sha256-dmePzJ10VgzN6CxFAz7QloIsPULuTZH+Pjkd/kIQUmU=";
   };
 
-  vendorHash = "sha256-ebfch59JXJYxXcoIPc8XdkRugsjZ1pKCgvUXODSWTrw=";
+  vendorHash = "sha256-3buC6N/tHTf6FMEXU3+XlJVGntLe86Hx3eNpn7w0yMs=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/nosql/victoriametrics/default.nix b/pkgs/servers/nosql/victoriametrics/default.nix
index 95435b4ea77..25517c0b437 100644
--- a/pkgs/servers/nosql/victoriametrics/default.nix
+++ b/pkgs/servers/nosql/victoriametrics/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "VictoriaMetrics";
-  version = "1.93.5";
+  version = "1.93.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AC3tQAgGHKl86MakfSWnFMX1Lr5r7RwZfomXtp5/oBs=";
+    hash = "sha256-MGIFM7PhKTeu7hnE9M2fj4EsJQv5AIDhFbypEJjYNwc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/servers/sozu/default.nix b/pkgs/servers/sozu/default.nix
index d7ff34951c8..63f94093a84 100644
--- a/pkgs/servers/sozu/default.nix
+++ b/pkgs/servers/sozu/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sozu";
-  version = "0.15.13";
+  version = "0.15.15";
 
   src = fetchFromGitHub {
     owner = "sozu-proxy";
     repo = pname;
     rev = version;
-    hash = "sha256-egxeKwIgjpzF19ZunK9o2F/pjHWP8wva4KhGreXvR1w=";
+    hash = "sha256-zxGP2SWrq8beb+mJpgB39T7B1HpE76YP6se01vMewuw=";
   };
 
-  cargoHash = "sha256-q61HLKsF6h9/JPmggXHrCHXiFLYnWHtKayC/O0BAtA8=";
+  cargoHash = "sha256-KqCDOWCMRYpBMsESTdhMEgTu6qAxcg4RHe252JBggqs=";
 
   nativeBuildInputs = [ protobuf ];
 
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index f14339e007f..e0da056c48c 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.8.0";
+  version = "5.8.1";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-VkWGVKLN8arc6BOivmjSk8MtMbp2WYqZE9lM8oTQe+U=";
+    sha256 = "sha256-nsGBBGw66LCwOuNdBjlz6u9RT+BX6iZmZeDY9yJoc+c=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index 9218e24230f..c9c1caff801 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -22,11 +22,11 @@ buildPythonPackage rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2023.11.14";
+  version = "2023.11.16";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-s8JTU7oQaSLYcKWlnk1qLrhXg+vRfinsQ1vD4XZN6L4=";
+    hash = "sha256-8Mza8S4IsVkCYBpGccerEpBtexHeOudfplBoEcJOxdo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/system/bfs/default.nix b/pkgs/tools/system/bfs/default.nix
index 757e6bcd9dd..17f6af921c7 100644
--- a/pkgs/tools/system/bfs/default.nix
+++ b/pkgs/tools/system/bfs/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   # Disable LTO on darwin. See https://github.com/NixOS/nixpkgs/issues/19098
   preConfigure = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace Makefile --replace "-flto" ""
+    substituteInPlace GNUMakefile --replace "-flto=auto" ""
   '';
 
   makeFlags = [ "PREFIX=$(out)" ];