Merge master into staging-next

36 files changed, 223 insertions, 74 deletions

diff --git a/nixos/modules/services/hardware/kanata.nix b/nixos/modules/services/hardware/kanata.nix
index 7d544050130..aac20c6c760 100644
--- a/nixos/modules/services/hardware/kanata.nix
+++ b/nixos/modules/services/hardware/kanata.nix
@@ -9,8 +9,14 @@ let
     options = {
       devices = mkOption {
         type = types.listOf types.str;
+        default = [ ];
         example = [ "/dev/input/by-id/usb-0000_0000-event-kbd" ];
-        description = mdDoc "Paths to keyboard devices.";
+        description = mdDoc ''
+          Paths to keyboard devices.
+
+          An empty list, the default value, lets kanata detect which
+          input devices are keyboards and intercept them all.
+        '';
       };
       config = mkOption {
         type = types.lines;
@@ -162,6 +168,14 @@ in
   };
 
   config = mkIf cfg.enable {
+    warnings =
+      let
+        keyboardsWithEmptyDevices = filterAttrs (name: keyboard: keyboard.devices == [ ]) cfg.keyboards;
+        existEmptyDevices = length (attrNames keyboardsWithEmptyDevices) > 0;
+        moreThanOneKeyboard = length (attrNames cfg.keyboards) > 1;
+      in
+      optional (existEmptyDevices && moreThanOneKeyboard) "One device can only be intercepted by one kanata instance.  Setting services.kanata.keyboards.${head (attrNames keyboardsWithEmptyDevices)}.devices = [ ] and using more than one services.kanata.keyboards may cause a race condition.";
+
     hardware.uinput.enable = true;
 
     systemd.services = mapAttrs' mkService cfg.keyboards;
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index 21473388d76..d4099be12a2 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -164,6 +164,15 @@ let
           of the wireguard network has to be adjusted as well.
         '';
       };
+
+      metric = mkOption {
+        default = null;
+        type = with types; nullOr int;
+        example = 700;
+        description = lib.mdDoc ''
+          Set the metric of routes related to this Wireguard interface.
+        '';
+      };
     };
 
   };
@@ -395,7 +404,7 @@ let
             optionalString interfaceCfg.allowedIPsAsRoutes
               (concatMapStringsSep "\n"
                 (allowedIP:
-                  ''${ip} route replace "${allowedIP}" dev "${interfaceName}" table "${interfaceCfg.table}"''
+                  ''${ip} route replace "${allowedIP}" dev "${interfaceName}" table "${interfaceCfg.table}" ${optionalString (interfaceCfg.metric != null) "metric ${toString interfaceCfg.metric}"}''
                 ) peer.allowedIPs);
         in ''
           ${wg_setup}
diff --git a/pkgs/applications/editors/ldtk/default.nix b/pkgs/applications/editors/ldtk/default.nix
index 4d8dc4d58dc..f82ee11c3f8 100644
--- a/pkgs/applications/editors/ldtk/default.nix
+++ b/pkgs/applications/editors/ldtk/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ldtk";
-  version = "1.3.4";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "https://github.com/deepnight/ldtk/releases/download/v${finalAttrs.version}/ubuntu-distribution.zip";
-    hash = "sha256-/EFmuzj8hYhQJegZpZhZb4fuSeMF9wdG1Be4duEvW54=";
+    hash = "sha256-WuKzhE9r/yMqlV2bf/0AuNVKfxq/SlecmN3rHt6RjXo=";
   };
 
   nativeBuildInputs = [ unzip makeWrapper copyDesktopItems appimage-run ];
diff --git a/pkgs/applications/graphics/hydrus/0001-inform-nixpkgs.patch b/pkgs/applications/graphics/hydrus/0001-inform-nixpkgs.patch
new file mode 100644
index 00000000000..e7200814eb0
--- /dev/null
+++ b/pkgs/applications/graphics/hydrus/0001-inform-nixpkgs.patch
@@ -0,0 +1,18 @@
+diff --git a/hydrus/core/HydrusConstants.py b/hydrus/core/HydrusConstants.py
+index 809338ef..9125928f 100644
+--- a/hydrus/core/HydrusConstants.py
++++ b/hydrus/core/HydrusConstants.py
+@@ -59,12 +59,7 @@ elif PLATFORM_HAIKU:
+ RUNNING_FROM_SOURCE = sys.argv[0].endswith( '.py' ) or sys.argv[0].endswith( '.pyw' )
+ RUNNING_FROM_MACOS_APP = os.path.exists( os.path.join( BASE_DIR, 'running_from_app' ) )
+ 
+-if RUNNING_FROM_SOURCE:
+-    NICE_RUNNING_AS_STRING = 'from source'
+-elif RUNNING_FROM_FROZEN_BUILD:
+-    NICE_RUNNING_AS_STRING = 'from frozen build'
+-elif RUNNING_FROM_MACOS_APP:
+-    NICE_RUNNING_AS_STRING = 'from App'
++NICE_RUNNING_AS_STRING = "from nixpkgs (source)"
+ 
+ BIN_DIR = os.path.join( BASE_DIR, 'bin' )
+ HELP_DIR = os.path.join( BASE_DIR, 'help' )
diff --git a/pkgs/applications/graphics/hydrus/default.nix b/pkgs/applications/graphics/hydrus/default.nix
index ed8f2bef9e3..968f60ba809 100644
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@@ -12,16 +12,21 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "520";
+  version = "544";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-y8KfPe3cBBq/iPCG7hNXrZDkOSNi+qSir6rO/65SHkI=";
+    hash = "sha256-e3VvkdJAQx5heKDJ1Ms6XpXrXWdzv48f8yu0DHfPy1A=";
   };
 
+  patches = [
+    # Nixpkgs specific, can be removed if upstream makes a more reasonable check
+    ./0001-inform-nixpkgs.patch
+  ];
+
   nativeBuildInputs = [
     wrapQtAppsHook
     python3Packages.mkdocs-material
@@ -37,13 +42,16 @@ python3Packages.buildPythonPackage rec {
     cbor2
     chardet
     cloudscraper
+    dateparser
     html5lib
     lxml
     lz4
     numpy
     opencv4
     pillow
+    pillow-heif
     psutil
+    psd-tools
     pympler
     pyopenssl
     pyqt6
@@ -56,7 +64,6 @@ python3Packages.buildPythonPackage rec {
     requests
     send2trash
     service-identity
-    six
     twisted
   ];
 
@@ -92,6 +99,7 @@ python3Packages.buildPythonPackage rec {
     -e TestHydrusSessions \
     -e TestServer \
     -e TestClientMetadataMigration \
+    -e TestClientFileStorage \
   '';
 
   outputs = [ "out" "doc" ];
@@ -100,13 +108,16 @@ python3Packages.buildPythonPackage rec {
     # Move the hydrus module and related directories
     mkdir -p $out/${python3Packages.python.sitePackages}
     mv {hydrus,static} $out/${python3Packages.python.sitePackages}
+    # Fix random files being marked with execute permissions
+    chmod -x $out/${python3Packages.python.sitePackages}/static/*.{png,svg,ico}
+    # Build docs
     mkdocs build -d help
     mv help $out/doc/
 
     # install the hydrus binaries
     mkdir -p $out/bin
-    install -m0755 server.py $out/bin/hydrus-server
-    install -m0755 client.py $out/bin/hydrus-client
+    install -m0755 hydrus_server.py $out/bin/hydrus-server
+    install -m0755 hydrus_client.py $out/bin/hydrus-client
   '' + lib.optionalString enableSwftools ''
     mkdir -p $out/${python3Packages.python.sitePackages}/bin
     # swfrender seems to have to be called sfwrender_linux
diff --git a/pkgs/applications/graphics/upscayl/default.nix b/pkgs/applications/graphics/upscayl/default.nix
index d146919e556..ec37b9b429f 100644
--- a/pkgs/applications/graphics/upscayl/default.nix
+++ b/pkgs/applications/graphics/upscayl/default.nix
@@ -4,11 +4,11 @@
   lib,
 }: let
   pname = "upscayl";
-  version = "2.8.1";
+  version = "2.8.6";
 
   src = fetchurl {
     url = "https://github.com/upscayl/upscayl/releases/download/v${version}/upscayl-${version}-linux.AppImage";
-    hash = "sha256-gmFT6onuoaw9WDCUDImZM/AxuZECqPC73ZyNnp6WSGA=";
+    hash = "sha256-w5rjLqdlPOZWgdc2t0Y3tl24qZqpjBV6I9gruLaI+qc=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/office/appflowy/default.nix b/pkgs/applications/office/appflowy/default.nix
index 11d29123872..e99c0fedf96 100644
--- a/pkgs/applications/office/appflowy/default.nix
+++ b/pkgs/applications/office/appflowy/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "appflowy";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchzip {
     url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${version}/AppFlowy_x86_64-unknown-linux-gnu_ubuntu-20.04.tar.gz";
-    hash = "sha256-jIekGA+MG9tvjEyHAI3dcD7lI1JL/qPqRpVO9gRhcTw=";
+    hash = "sha256-UmBXAfRIr9zOScqibKPHeKzr+UTx3gbGEm0tl7qn+oE=";
     stripRoot = false;
   };
 
diff --git a/pkgs/applications/science/logic/beluga/default.nix b/pkgs/applications/science/logic/beluga/default.nix
index 3cb06c4e7b1..693be7f3388 100644
--- a/pkgs/applications/science/logic/beluga/default.nix
+++ b/pkgs/applications/science/logic/beluga/default.nix
@@ -2,13 +2,13 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "beluga";
-  version = "1.1";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "Beluga-lang";
     repo = "Beluga";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0E7rmiLmQPfOAQ1qKiqxeLdqviVl+Thkl6KfOWkGZRc=";
+    hash = "sha256-l/C77czLtlLnpadVx4d9ve9jv/e11jsOgzrbXt+Zo5s=";
   };
 
   duneVersion = "3";
diff --git a/pkgs/applications/video/anilibria-winmaclinux/default.nix b/pkgs/applications/video/anilibria-winmaclinux/default.nix
index 823dbfef97a..f1c2b13d73a 100644
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "1.2.9";
+  version = "1.2.10";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    sha256 = "sha256-Fdj7i4jpKIDwaIBAch7SjIV/WnqMDnCfNYSiZLsamx8=";
+    sha256 = "sha256-mCDw8V/Uzewm32rj+mkkm5atS5nJAFJ3ry1boTn+gqI=";
   };
 
   sourceRoot = "source/src";
diff --git a/pkgs/build-support/php/hooks/default.nix b/pkgs/build-support/php/hooks/default.nix
index e7de98647c3..5ff69a87786 100644
--- a/pkgs/build-support/php/hooks/default.nix
+++ b/pkgs/build-support/php/hooks/default.nix
@@ -3,20 +3,21 @@
 , moreutils
 , makeBinaryWrapper
 , php
+, cacert
 }:
 
 {
   composerRepositoryHook = makeSetupHook
     {
       name = "composer-repository-hook.sh";
-      propagatedBuildInputs = [ jq moreutils php ];
+      propagatedBuildInputs = [ jq moreutils php cacert ];
       substitutions = { };
     } ./composer-repository-hook.sh;
 
   composerInstallHook = makeSetupHook
     {
       name = "composer-install-hook.sh";
-      propagatedBuildInputs = [ jq makeBinaryWrapper moreutils php ];
+      propagatedBuildInputs = [ jq makeBinaryWrapper moreutils php cacert ];
       substitutions = { };
     } ./composer-install-hook.sh;
 }
diff --git a/pkgs/by-name/pe/pesign/package.nix b/pkgs/by-name/pe/pesign/package.nix
new file mode 100644
index 00000000000..b39db9cd430
--- /dev/null
+++ b/pkgs/by-name/pe/pesign/package.nix
@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, nss
+, efivar
+, util-linux
+, popt
+, nspr
+, mandoc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pesign";
+  version = "116";
+
+  src = fetchFromGitHub {
+    owner = "rhboot";
+    repo = "pesign";
+    rev = version;
+    hash = "sha256-cuOSD/ZHkilgguDFJviIZCG8kceRWw2JgssQuWN02Do=";
+  };
+
+  # nss-util is missing because it is already contained in nss
+  # Red Hat seems to be shipping a separate nss-util:
+  # https://centos.pkgs.org/7/centos-x86_64/nss-util-devel-3.44.0-4.el7_7.x86_64.rpm.html
+  # containing things we already have in `nss`.
+  # We can ignore all the errors pertaining to a missing
+  # nss-util.pc I suppose.
+  buildInputs = [ efivar util-linux nss popt nspr mandoc ];
+  nativeBuildInputs = [ pkg-config ];
+
+  makeFlags = [ "INSTALLROOT=$(out)" ];
+
+  postInstall = ''
+    mv $out/usr/bin $out/bin
+    mv $out/usr/share $out/share
+
+    rm -rf $out/usr
+    rm -rf $out/etc
+    rm -rf $out/run
+  '';
+
+  meta = with lib; {
+    description = "Signing tools for PE-COFF binaries. Compliant with the PE and Authenticode specifications.";
+    homepage = "https://github.com/rhboot/pesign";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ raitobezarius ];
+    # efivar is currently Linux-only.
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/libite/default.nix b/pkgs/development/libraries/libite/default.nix
index 900146f6b01..c75c83764ac 100644
--- a/pkgs/development/libraries/libite/default.nix
+++ b/pkgs/development/libraries/libite/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libite";
-  version = "2.5.3";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "troglobit";
     repo = "libite";
     rev = "v${version}";
-    sha256 = "sha256-orxmd6yItB6XLj650RQb0CP/EnN9563v+P9xz9LEJkY=";
+    sha256 = "sha256-hdV8g/BFTI/QfEgVsf942SR0G5xdqP/+h+vnydt4kf0=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/development/php-packages/phalcon/default.nix b/pkgs/development/php-packages/phalcon/default.nix
index 6f998be9a1f..cbd689b136b 100644
--- a/pkgs/development/php-packages/phalcon/default.nix
+++ b/pkgs/development/php-packages/phalcon/default.nix
@@ -2,13 +2,13 @@
 
 buildPecl rec {
   pname = "phalcon";
-  version = "5.3.0";
+  version = "5.3.1";
 
   src = fetchFromGitHub {
     owner = "phalcon";
     repo = "cphalcon";
     rev = "v${version}";
-    hash = "sha256-82DJ+Qx0OYhw9Nv6FkAoyBec8WWfAiqNfBU9Ll/8RfA=";
+    hash = "sha256-FxGibpGlbNLqWDplCv4T4yUPg5US020niLfC7tHfkCU=";
   };
 
   internalDeps = [ php.extensions.session php.extensions.pdo ];
diff --git a/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix b/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
index 9f4098d6fa5..2a753b42510 100644
--- a/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "aliyun-python-sdk-iot";
-  version = "8.56.0";
+  version = "8.57.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8d77P522c6gV8LhKErixzE2DvGmjr9bms+2eHYirgwg=";
+    hash = "sha256-Ea0IUn2mlu0c7QYJZkUrBUrtjUuTHoTeuvZHw/il+4A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/app-model/default.nix b/pkgs/development/python-modules/app-model/default.nix
index 29f19979ff5..1371cc72de3 100644
--- a/pkgs/development/python-modules/app-model/default.nix
+++ b/pkgs/development/python-modules/app-model/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "app-model";
-  version = "0.2.1";
+  version = "0.2.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "pyapp-kit";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-1LldqihVCCgFdnsod751zWAAqkaaIH2qMpfsPYjWzgs=";
+    hash = "sha256-vo10BHUzvYlldAqTw/1LxgvSXgTM3LAls9jQIeB5LcU=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/bluetooth-data-tools/default.nix b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
index 920bb1cecc4..608d7af455e 100644
--- a/pkgs/development/python-modules/bluetooth-data-tools/default.nix
+++ b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-data-tools";
-  version = "1.11.0";
+  version = "1.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-iyfk0OOJezNCNyqRCbR2cTTTdgdYQM6hExTngd/3CtA=";
+    hash = "sha256-zdMqjZ7CEwDnvVvIe1breQ+/4ZwzdLk2CtI+GCY+3uk=";
   };
 
   # The project can build both an optimized cython version and an unoptimized
diff --git a/pkgs/development/python-modules/garth/default.nix b/pkgs/development/python-modules/garth/default.nix
index 0eaf2793caa..224ebcca08a 100644
--- a/pkgs/development/python-modules/garth/default.nix
+++ b/pkgs/development/python-modules/garth/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "garth";
-  version = "0.4.26";
+  version = "0.4.27";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ezq9lZE6HTtuW396sKZ32mDvNjrkz6UHQGvLhXUjfnI=";
+    hash = "sha256-GOpYR1fudDKHbnxwAMCXrk95xYe0Pdi7pYebHua+IjM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index 9415343d6ea..18b4b3f7fa0 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "nomadnet";
-  version = "0.3.7";
+  version = "0.3.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "NomadNet";
     rev = "refs/tags/${version}";
-    hash = "sha256-cyD68GsAuJKmbVxWCCJVWz/VErB9LEdRzz9IT8ir+U0=";
+    hash = "sha256-w7NQH4CEfYQ4iwPtLQO5mYRnfWQbPuxb/qXRBP0V56Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pillow-heif/default.nix b/pkgs/development/python-modules/pillow-heif/default.nix
new file mode 100644
index 00000000000..fe243c6a032
--- /dev/null
+++ b/pkgs/development/python-modules/pillow-heif/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, cmake
+, pillow
+, pytest
+, nasm
+, libheif
+, libaom
+, libde265
+, x265
+}:
+
+buildPythonPackage rec {
+  pname = "pillow_heif";
+  version = "0.13.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "bigcat88";
+    repo = "pillow_heif";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-GbOW29rGpLMS7AfShuO6UCzcspdHtFS7hyNKori0otI=";
+  };
+
+  nativeBuildInputs = [ cmake nasm ];
+  buildInputs = [ libheif libaom libde265 x265 ];
+  propagatedBuildInputs = [ pillow ];
+  nativeCheckInputs = [ pytest ];
+
+  dontUseCmakeConfigure = true;
+
+  pythonImportsCheck = [ "pillow_heif" ];
+
+  meta = {
+    description = "Python library for working with HEIF images and plugin for Pillow";
+    homepage = "https://github.com/bigcat88/pillow_heif";
+    license = with lib.licenses; [ bsd3 lgpl3 ];
+    maintainers = with lib.maintainers; [ dandellion ];
+  };
+}
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index c180e5349b0..bb130d57af3 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.5.9";
+  version = "0.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "Reticulum";
     rev = "refs/tags/${version}";
-    hash = "sha256-vzFN8b+F4CO/f/7CbUpX/Xj8wZMEpz2veUXsPHYzPxE=";
+    hash = "sha256-wlFDl7yCawLrijQMouFWcRoXmIJRcpHSAKFHyu+sMGk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/wsgidav/default.nix b/pkgs/development/python-modules/wsgidav/default.nix
index 9dc51364bc6..bff7c88f146 100644
--- a/pkgs/development/python-modules/wsgidav/default.nix
+++ b/pkgs/development/python-modules/wsgidav/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "wsgidav";
-  version = "4.2.0";
+  version = "4.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "mar10";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-1S3Zi92YRcu/PKNWJIn2ayr5Wbc+/+E7irFBQpMrKW8=";
+    hash = "sha256-DEUoKoFELIOg5KX6hL1VgR18dtsery4ZzKksrxl0D7Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/goredo/default.nix b/pkgs/development/tools/build-managers/goredo/default.nix
index 9284aae220e..e1c2b402df6 100644
--- a/pkgs/development/tools/build-managers/goredo/default.nix
+++ b/pkgs/development/tools/build-managers/goredo/default.nix
@@ -9,11 +9,11 @@
 
 buildGoModule rec {
   pname = "goredo";
-  version = "1.30.0";
+  version = "1.31.0";
 
   src = fetchurl {
     url = "http://www.goredo.cypherpunks.ru/download/${pname}-${version}.tar.zst";
-    hash = "sha256-glsg2q8jFd4z6CuKzlZ3afJx/S7Aw6LCxFAS/uHLlUg=";
+    hash = "sha256-z7u71VFMoq4VwHohMnYx/ahBSkRZHoI8MZet9gO+XVw=";
   };
 
   patches = [ ./fix-tests.diff ];
diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index acae7f04f6a..2a1bbbeed51 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.5.8";
-  vendorHash = "sha256-hOYVIynWsbsindNJRbXX4NkC3FW3RErORCSLlV1bCWc=";
+  version = "5.5.9";
+  vendorHash = "sha256-eeVi/O4p7bF4CPqJBCpLfx1Yc5vZZ3b8RV5ERcIL8H4=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    hash = "sha256-K2DttdK8g5NI+XlGwIA9HTPTLlMGgGc1K625FquIhi4=";
+    hash = "sha256-dQ7ImNSnWD2u9cY9VEBlum45YqlhHgczAkD70QJFr68=";
   };
 
   ldflags = [
diff --git a/pkgs/development/tools/wxformbuilder/default.nix b/pkgs/development/tools/wxformbuilder/default.nix
index 2fccd17f281..c8e05c1fc10 100644
--- a/pkgs/development/tools/wxformbuilder/default.nix
+++ b/pkgs/development/tools/wxformbuilder/default.nix
@@ -10,7 +10,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "wxFormBuilder";
+  pname = "wxformbuilder";
   version = "unstable-2023-04-21";
 
   src = fetchFromGitHub {
@@ -47,13 +47,14 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/{Applications,bin}
     mv $out/wxFormBuilder.app $out/Applications
-    makeWrapper $out/{Applications/wxFormBuilder.app/Contents/MacOS,bin}/wxFormBuilder
+    makeWrapper $out/Applications/wxFormBuilder.app/Contents/MacOS/wxFormBuilder $out/bin/wxformbuilder
   '';
 
   meta = with lib; {
     description = "RAD tool for wxWidgets GUI design";
     homepage = "https://github.com/wxFormBuilder/wxFormBuilder";
     license = licenses.gpl2Only;
+    mainProgram = "wxformbuilder";
     maintainers = with maintainers; [ matthuszagh wegank ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/web/bun/default.nix b/pkgs/development/web/bun/default.nix
index 8b88adeed42..aeb611ef0f2 100644
--- a/pkgs/development/web/bun/default.nix
+++ b/pkgs/development/web/bun/default.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.0.2";
+  version = "1.0.3";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-QvoEakfR5wmP10d6MDpfS8THke975bVyZc5pLVliUbQ=";
+        hash = "sha256-M0OG9V+TVqUqNuEDvpPCJR1KvILty7M59JiYjOsRjS0=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-izVtW28QE7Tty6DfQDKmw1oqD5GOolTzCeIUmtgI1Uw=";
+        hash = "sha256-0Nto5EikWEvW6PCX6801qxDdlB1PtWJ1iym0mwh/YJI=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-e/VXNCq2CwNsM7ruk8IGSwU/swkVhcvvQRv/yiIQtCU=";
+        hash = "sha256-3GUQk7Nv5Nx25SPk+Z+6EDNEsDbLW68IOXmLt8NkSYQ=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-kHv8PU48Le4lG3pf304hXggAtx/I5uBeu4aHmLsbdgw=";
+        hash = "sha256-8xMBU3jloMsdekejKrnswWfzXhxwvsHFNgcUf4hn0W4=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/misc/urbit/default.nix b/pkgs/misc/urbit/default.nix
index 81dd6b81bad..3a9488a5951 100644
--- a/pkgs/misc/urbit/default.nix
+++ b/pkgs/misc/urbit/default.nix
@@ -10,15 +10,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "urbit";
-  version = "2.11";
+  version = "2.12";
 
   src = fetchzip {
     url = "https://github.com/urbit/vere/releases/download/vere-v${version}/${platform}.tgz";
     sha256 = {
-      x86_64-linux = "sha256-k2zmcjZ9NXmwZf93LIAg1jx4IRprKUgdkvwzxEOKWDY=";
-      aarch64-linux = "sha256-atMBXyXwavpSDTZxUnXIq+NV4moKGRWLaFTM9Kuzt94=";
-      x86_64-darwin = "sha256-LSJ9jVY3fETlpRAkyUWa/2vZ5xAFmmMssvbzUfIBY/4=";
-      aarch64-darwin = "sha256-AViUt2N+YCgMWOcv3ZI0GfdYVOiRLbhseQ7TTq4zCiQ=";
+      x86_64-linux = "sha256-N8RYlafw0HcmtGAQMKQb1cG7AivOpWS/5rU8CESJWAw=";
+      aarch64-linux = "sha256-RsBtwxSdqHVXMk7or1nPAFWd6Ypa0SqjpTihv8riyk4=";
+      x86_64-darwin = "sha256-/QPI66/gl3mlQHc+8zrEyP4/Hv5vwXlEx1cW2mP33IY=";
+      aarch64-darwin = "sha256-+2DYohaBxVcR1ZOjuk6GWcNpzb6aJMXq6BxwWw1OeIY=";
     }.${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
 
diff --git a/pkgs/servers/http/jetty/default.nix b/pkgs/servers/http/jetty/default.nix
index 0aa226e4665..efcce583ce9 100644
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "jetty";
-  version = "11.0.15";
+  version = "11.0.16";
   src = fetchurl {
     url = "mirror://maven/org/eclipse/jetty/jetty-home/${version}/jetty-home-${version}.tar.gz";
-    sha256 = "sha256-bDg3CYPAGryqRv/gcPdeZKucXx6YTkkNd0Cu1+zIjto=";
+    hash = "sha256-iL1s4o/1Hds0N/fzXgwOMriPtZNG7ei2t4frF1ImW+E=";
   };
 
   dontBuild = true;
diff --git a/pkgs/servers/jellyfin/default.nix b/pkgs/servers/jellyfin/default.nix
index 9ac59bf72cf..9d846ba8a8d 100644
--- a/pkgs/servers/jellyfin/default.nix
+++ b/pkgs/servers/jellyfin/default.nix
@@ -14,13 +14,13 @@
 
 buildDotnetModule rec {
   pname = "jellyfin";
-  version = "10.8.10"; # ensure that jellyfin-web has matching version
+  version = "10.8.11"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     rev = "v${version}";
-    sha256 = "uX56TSyi0V0Rs6R3A8QHZrjTIHUZobLYIgG+nZDE3Hg=";
+    sha256 = "deJv2lWo0kXGixCBJzfdIBZcNjg45y2ITGQfWcM2smU=";
   };
 
   patches = [
diff --git a/pkgs/servers/jellyfin/web.nix b/pkgs/servers/jellyfin/web.nix
index f982cc5dd04..6f9d278091b 100644
--- a/pkgs/servers/jellyfin/web.nix
+++ b/pkgs/servers/jellyfin/web.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "jellyfin-web";
-  version = "10.8.10";
+  version = "10.8.11";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-web";
     rev = "v${version}";
-    hash = "sha256-fJmGiHLwhgd3Ac7ggCbkMu6llob3qN87EpHpCO4K29I=";
+    hash = "sha256-Gl8eaC/AXBD956tAepwWVG3lSvL4rBCcgmkHeT/mrzM=";
   };
 
-  npmDepsHash = "sha256-X8a/pmQGAhoGKhThJ86b50sf0nlsCXGgvLQaxRsmA5Q=";
+  npmDepsHash = "sha256-HoRteA6KFCFxDdwGtDKrvwWCMYNfYQWlit52RAN1eAU=";
 
   npmBuildScript = [ "build:production" ];
 
diff --git a/pkgs/servers/routinator/default.nix b/pkgs/servers/routinator/default.nix
index a56a5e491a0..3ab45831389 100644
--- a/pkgs/servers/routinator/default.nix
+++ b/pkgs/servers/routinator/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "routinator";
-  version = "0.12.2";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fblUr2gtlGMRAFbpWYDafskLmIls56e9b2GFD7ASZHM=";
+    hash = "sha256-gInJS7JpvEbmOuZecB4xjff2d7TnjcVV+8mPOmy5Oyo=";
   };
 
-  cargoHash = "sha256-pvb/tZW4jqNSLgp+Ktakd3J1KVfCRtPgE0bgNst6ImQ=";
+  cargoHash = "sha256-c5SQysjO821pfGhnyB4aGOZuwrHaN502PfkA1gBPtY4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/shells/nushell/plugins/formats.nix b/pkgs/shells/nushell/plugins/formats.nix
index 8c511782e3d..f55c8c5eae2 100644
--- a/pkgs/shells/nushell/plugins/formats.nix
+++ b/pkgs/shells/nushell/plugins/formats.nix
@@ -14,9 +14,9 @@ rustPlatform.buildRustPackage {
   inherit pname;
   version = "0.85.0";
   src = nushell.src;
-  cargoHash = "sha256-OKtktjBOujvljAX260TbC2sQWZOiGgU+sXsbYRhGPRM=";
+  cargoHash = "sha256-WS8VRpJnn/VWS7GUkGowFf51ifUx0SbEZzcoTfx2dp0=";
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ IOKit Foundation ];
+  buildInputs = lib.optionals stdenv.isDarwin [ IOKit Foundation ];
   cargoBuildFlags = [ "--package nu_plugin_formats" ];
   doCheck = false;
   meta = with lib; {
diff --git a/pkgs/shells/nushell/plugins/gstat.nix b/pkgs/shells/nushell/plugins/gstat.nix
index f7e912a6fdc..589eda96b06 100644
--- a/pkgs/shells/nushell/plugins/gstat.nix
+++ b/pkgs/shells/nushell/plugins/gstat.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage {
   inherit pname;
   version = "0.85.0";
   src = nushell.src;
-  cargoHash = "sha256-Fj70uKYzEKxeZeNrqlwM7ZFJ+K1tz10RqLndrdY40CE=";
+  cargoHash = "sha256-6luY3SIRRd9vaY9KIJcj8Q974FW0LtAvRjVpdpzkdLo=";
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
   cargoBuildFlags = [ "--package nu_plugin_gstat" ];
diff --git a/pkgs/shells/nushell/plugins/query.nix b/pkgs/shells/nushell/plugins/query.nix
index 51db91bec26..feaeb7f63d1 100644
--- a/pkgs/shells/nushell/plugins/query.nix
+++ b/pkgs/shells/nushell/plugins/query.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage {
 
   src = nushell.src;
 
-  cargoHash = "sha256-8iUqOdGWm2kDW72ptlCBIqqe4zjckN09MOQD77kCf5Y=";
+  cargoHash = "sha256-xyty3GfI+zNkuHs7LYHBctqXUHZ4/MNNcnnfYvI18do=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ IOKit CoreFoundation ];
 
diff --git a/pkgs/tools/networking/clash-meta/default.nix b/pkgs/tools/networking/clash-meta/default.nix
index 5c3f4c976b4..5c7e7706887 100644
--- a/pkgs/tools/networking/clash-meta/default.nix
+++ b/pkgs/tools/networking/clash-meta/default.nix
@@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
   pname = "clash-meta";
-  version = "1.15.1";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "MetaCubeX";
     repo = "Clash.Meta";
     rev = "v${version}";
-    hash = "sha256-gOUG+XtLfkgnbTj1yUun50pevOh+aPXfIlof5/U2ud8=";
+    hash = "sha256-N7uCvzKBqOWYBfY1FBS9TjuHUfoKeMJF6o4k8C3f4z4=";
   };
 
-  vendorHash = "sha256-My/fwa8BgaJcSGKcyyzUExVE0M2fk7rMZtOBW7V5edQ=";
+  vendorHash = "sha256-ySCmHLuMTCxBcAYo7YD8zOpUAa90PQmeLLt+uOn40Pk=";
 
   # Do not build testing suit
   excludedPackages = [ "./test" ];
diff --git a/pkgs/tools/networking/oha/default.nix b/pkgs/tools/networking/oha/default.nix
index 24e70cb073d..327161c8a97 100644
--- a/pkgs/tools/networking/oha/default.nix
+++ b/pkgs/tools/networking/oha/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oha";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "hatoo";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-vna0wmdcugrYLubnjSgBBeDW6ZHH3VToIJG0z8sB/ss=";
+    sha256 = "sha256-zupenhIxw93EifV1JRcM9ryGli+wqo88JH+8JciOn8E=";
   };
 
-  cargoSha256 = "sha256-d6gK/+dsJYb/9HSOHOsly3b35dh0FZ+aNnDVVzcXiV0=";
+  cargoSha256 = "sha256-g0YJu34LmqqKCSVqS6LaO71iCJ26QKvbMpR6+sMLTr4=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
     pkg-config
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ce1944ea8d8..aac55bdb268 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8190,6 +8190,8 @@ self: super: with self; {
     inherit (pkgs.xorg) libX11 libxcb;
   };
 
+  pillow-heif = callPackage ../development/python-modules/pillow-heif { };
+
   pillow-simd = callPackage ../development/python-modules/pillow-simd {
       inherit (pkgs) freetype libjpeg zlib libtiff libwebp tcl lcms2 tk;
       inherit (pkgs.xorg) libX11;