Merge master into staging-next

28 files changed, 263 insertions, 83 deletions

diff --git a/pkgs/applications/audio/munt/libmt32emu.nix b/pkgs/applications/audio/munt/libmt32emu.nix
index 75cf863fc76..e011804944b 100644
--- a/pkgs/applications/audio/munt/libmt32emu.nix
+++ b/pkgs/applications/audio/munt/libmt32emu.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmt32emu";
-  version = "2.7.0";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "munt";
     repo = "munt";
     rev = "${pname}_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-XGds9lDfSiY0D8RhYG4TGyjYEVvVYuAfNSv9+VxiJEs=";
+    sha256 = "sha256-zY1AFcm8uvFkrKUZHsqtKY2CYTY4bWmkTJ7bZPqXoxk=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/misc/jrnl/default.nix b/pkgs/applications/misc/jrnl/default.nix
index 8dacbf81451..43d320a4c04 100644
--- a/pkgs/applications/misc/jrnl/default.nix
+++ b/pkgs/applications/misc/jrnl/default.nix
@@ -1,18 +1,20 @@
 { lib
 , fetchFromGitHub
 , python3
+, testers
+, jrnl
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "jrnl";
-  version = "4.0.1";
+  version = "4.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "jrnl-org";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-NpI19NQxfDiqcfFI9kMqfMboI4fQTqCG7AoG9o8YoEI=";
+    hash = "sha256-DtujXSDJWnOrHjVgJEJNKJMhSrNBHlR2hvHeHLSIF2o=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
@@ -20,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
-    ansiwrap
     asteval
     colorama
     cryptography
@@ -51,6 +52,11 @@ python3.pkgs.buildPythonApplication rec {
     "jrnl"
   ];
 
+  passthru.tests.version = testers.testVersion {
+    package = jrnl;
+    version = "v${version}";
+  };
+
   meta = with lib; {
     changelog = "https://github.com/jrnl-org/jrnl/releases/tag/v${version}";
     description = "Simple command line journal application that stores your journal in a plain text file";
diff --git a/pkgs/applications/misc/spicetify-cli/default.nix b/pkgs/applications/misc/spicetify-cli/default.nix
index 572e524aeea..9c6c8f93f3f 100644
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.26.0";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "spicetify-cli";
     rev = "v${version}";
-    hash = "sha256-3u55Pcd4VNgWGyu/IVsrMqm8E4H9y4Bvt3JMyIL/KXo=";
+    hash = "sha256-5WIITzm9yZWB847WHL+okwpULdwHegtZfvsVrAzwTO0=";
   };
 
   vendorHash = "sha256-VktAO3yKCdm5yz/RRLeLv6zzyGrwuHC/i8WdJtqZoYc=";
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index 9c070a71272..928acfa935a 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "kubernetes-helm";
-  version = "3.13.1";
+  version = "3.13.2";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-HzamUAqO21RuWLLEfGfrpnlSJslyh4zAppCich5ZzD4=";
+    sha256 = "sha256-WXtEXgKco50D1TR775lIm/VuD+MJMbOMQpPC0W4MAYo=";
   };
-  vendorHash = "sha256-U4adeMBruUje97rr1hHfiCxMWSXlqv+aAlsHZZ4n5zs=";
+  vendorHash = "sha256-kvler6o4On4SbFF7AvPSCF5fRYtPNI5fsOcUbrTGYcQ=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [
diff --git a/pkgs/applications/networking/cluster/kubebuilder/default.nix b/pkgs/applications/networking/cluster/kubebuilder/default.nix
index 1724cb60e14..6f54075dc58 100644
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "kubebuilder";
-  version = "3.12.0";
+  version = "3.13.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "kubebuilder";
     rev = "v${version}";
-    hash = "sha256-drg7hFUEFoicZxzorO365b3eFN9NRdhWYn9bIk+sSY8=";
+    hash = "sha256-JXI3hQVChM7czCwan1yswsrUSse/IbMzwXw0tnaBiek=";
   };
 
-  vendorHash = "sha256-qH7+DDGYRCrXI3B2dN/4pZMBqSXKkZUvIrtVEg0Ep+c=";
+  vendorHash = "sha256-yiRxSJIIYJbkV3QAFclrDDnsBoX1t4cSRvGmwVgz/w8=";
 
   subPackages = ["cmd"];
 
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 8f8104863e6..e02b2ea7fbc 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -207,6 +207,9 @@ checkout_ref(){
 
 # Update submodules
 init_submodules(){
+    # shallow with leaveDotGit will change hashes
+    [[ -z "$deepClone" ]] && [[ -z "$leaveDotGit" ]] && \
+    clean_git submodule update --init --recursive -j ${NIX_BUILD_CORES:-1} --progress --depth 1 || \
     clean_git submodule update --init --recursive -j ${NIX_BUILD_CORES:-1} --progress
 }
 
diff --git a/pkgs/build-support/fetchgit/tests.nix b/pkgs/build-support/fetchgit/tests.nix
index a18be65327b..23e5fa29901 100644
--- a/pkgs/build-support/fetchgit/tests.nix
+++ b/pkgs/build-support/fetchgit/tests.nix
@@ -1,15 +1,13 @@
-{ testers, fetchgit, ... }:
-
-{
+{ testers, fetchgit, ... }: {
   simple = testers.invalidateFetcherByDrvHash fetchgit {
-    name = "nix-source";
+    name = "simple-nix-source";
     url = "https://github.com/NixOS/nix";
     rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
     sha256 = "sha256-7DszvbCNTjpzGRmpIVAWXk20P0/XTrWZ79KSOGLrUWY=";
   };
 
   sparseCheckout = testers.invalidateFetcherByDrvHash fetchgit {
-    name = "nix-source";
+    name = "sparse-checkout-nix-source";
     url = "https://github.com/NixOS/nix";
     rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
     sparseCheckout = [
@@ -20,7 +18,7 @@
   };
 
   sparseCheckoutNonConeMode = testers.invalidateFetcherByDrvHash fetchgit {
-    name = "nix-source";
+    name = "sparse-checkout-non-cone-nix-source";
     url = "https://github.com/NixOS/nix";
     rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
     sparseCheckout = [
@@ -30,4 +28,48 @@
     nonConeMode = true;
     sha256 = "sha256-FknO6C/PSnMPfhUqObD4vsW4PhkwdmPa9blNzcNvJQ4=";
   };
+
+  leave-git = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "leave-git-nix-source";
+    url = "https://github.com/NixOS/nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    sha256 = "sha256-zZxDxqaeWvuWuzwPizBLR7d59zP24+zqnWllNICenko=";
+    leaveDotGit = true;
+  };
+
+  submodule-simple = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "submodule-simple-source";
+    url = "https://github.com/pineapplehunter/nix-test-repo-with-submodule";
+    rev = "26473335b84ead88ee0a3b649b1c7fa4a91cfd4a";
+    sha256 = "sha256-rmP8PQT0wJBopdtr/hsB7Y/L1G+ZPdHC2r9LB05Qrj4=";
+    fetchSubmodules = true;
+  };
+
+  submodule-leave-git = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "submodule-leave-git-source";
+    url = "https://github.com/pineapplehunter/nix-test-repo-with-submodule";
+    rev = "26473335b84ead88ee0a3b649b1c7fa4a91cfd4a";
+    sha256 = "sha256-+uXIClcRJ4S1rdgx2Oyww+Jv4h1VXp8tfeh9lb07Fhk=";
+    leaveDotGit = true;
+    fetchSubmodules = true;
+  };
+
+  submodule-deep = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "submodule-deep-source";
+    url = "https://github.com/pineapplehunter/nix-test-repo-with-submodule";
+    rev = "26473335b84ead88ee0a3b649b1c7fa4a91cfd4a";
+    sha256 = "sha256-LL7uhXQk3N3DcvBBxwjmfVx55tTXCGQ19T91tknopzw=";
+    deepClone = true;
+    fetchSubmodules = true;
+  };
+
+  submodule-leave-git-deep = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "submodule-leave-git-deep-source";
+    url = "https://github.com/pineapplehunter/nix-test-repo-with-submodule";
+    rev = "26473335b84ead88ee0a3b649b1c7fa4a91cfd4a";
+    sha256 = "sha256-LL7uhXQk3N3DcvBBxwjmfVx55tTXCGQ19T91tknopzw=";
+    deepClone = true;
+    leaveDotGit = true;
+    fetchSubmodules = true;
+  };
 }
diff --git a/pkgs/by-name/dv/dvb-apps/package.nix b/pkgs/by-name/dv/dvb-apps/package.nix
new file mode 100644
index 00000000000..ad28bcd0ce6
--- /dev/null
+++ b/pkgs/by-name/dv/dvb-apps/package.nix
@@ -0,0 +1,64 @@
+{ lib
+, stdenv
+, fetchurl
+, perl
+, fetchpatch
+}:
+stdenv.mkDerivation {
+  pname = "dvb-apps";
+  version = "1.1.1-unstable-2014-03-21";
+
+  src = fetchurl {
+    url = "https://www.linuxtv.org/hg/dvb-apps/archive/3d43b280298c.tar.bz2";
+    hash = "sha256-854vDr7X4yvOg1IgYq1NQU9n/M1d8bZHYYUkSX4V4Fc=";
+  };
+
+  patches = [
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-tv/linuxtv-dvb-apps/files/linuxtv-dvb-apps-glibc-2.31.patch?id=ec6d38022bd905cb5460d4812e52434fd1f9663c";
+      hash = "sha256-zSbbKSJgW4L983DR0GVXtgAHK6ILOQC3Gz2iGnmWOp8=";
+    })
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-tv/linuxtv-dvb-apps/files/linuxtv-dvb-apps-no-ca_set_pid.patch?id=ec6d38022bd905cb5460d4812e52434fd1f9663c";
+      hash = "sha256-GZunNYlhktalPOZ4ZST1MwooBvdDGA6ckscx/7mx8ok=";
+    })
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-tv/linuxtv-dvb-apps/files/linuxtv-dvb-apps-1.1.1.20100223-alevt.patch?id=ec6d38022bd905cb5460d4812e52434fd1f9663c";
+      hash = "sha256-+j+tP8O3mho+gcsDPzQUJaE39ZAgimMAJoRP1J1HrBk=";
+    })
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-tv/linuxtv-dvb-apps/files/linuxtv-dvb-apps-1.1.1.20100223-ldflags.patch?id=ec6d38022bd905cb5460d4812e52434fd1f9663c";
+      hash = "sha256-jrRE1yySLbQWbF+SaugFN8VuEIfveSvjR0nKpmKffpQ=";
+    })
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-tv/linuxtv-dvb-apps/files/linuxtv-dvb-apps-1.1.1.20100223-perl526.patch?id=ec6d38022bd905cb5460d4812e52434fd1f9663c";
+      hash = "sha256-zIROx0HEvtZqvNBLlKp3aI3S2CihuS6l/OWf6WFFCrY=";
+    })
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-tv/linuxtv-dvb-apps/files/linuxtv-dvb-apps-1.1.1.20140321-dvbdate.patch?id=ec6d38022bd905cb5460d4812e52434fd1f9663c";
+      hash = "sha256-dLPlscdDOd7Kq+2sEhgJ/PBY1zN/0/fh3TU6JOELaYw=";
+    })
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-tv/linuxtv-dvb-apps/files/linuxtv-dvb-apps-1.1.1.20140321-gcc10.patch?id=ec6d38022bd905cb5460d4812e52434fd1f9663c";
+      hash = "sha256-034TYxH1qHcdkwVxuAcNHORfBWhw/k8P+11QAc3jp74=";
+    })
+    (fetchpatch {
+      url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=779520;filename=bug779520.patch;msg=17";
+      hash = "sha256-UL5lKDfloXvngsabnslpVXbe/dmt4dzVK5W8JkIieps=";
+    })
+  ];
+
+  buildInputs = [ perl ];
+
+  installFlags = [ "prefix=$(out)" ];
+
+  dontConfigure = true; # skip configure
+
+  meta = {
+    description = "Linux DVB API applications and utilities";
+    homepage = "https://linuxtv.org/";
+    maintainers = with lib.maintainers; [ volfyd ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/development/coq-modules/vcfloat/default.nix b/pkgs/development/coq-modules/vcfloat/default.nix
index d5837812ae8..5d1805c2573 100644
--- a/pkgs/development/coq-modules/vcfloat/default.nix
+++ b/pkgs/development/coq-modules/vcfloat/default.nix
@@ -4,6 +4,10 @@ with lib; mkCoqDerivation {
   pname = "vcfloat";
   owner = "VeriNum";
   inherit version;
+  sourceRoot = "source/vcfloat";
+  postPatch = ''
+    coq_makefile -o Makefile -f _CoqProject *.v
+  '';
   defaultVersion = with versions; switch coq.coq-version [
     { case = range "8.16" "8.17"; out = "2.1.1"; }
   ] null;
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index 35280e4b5eb..2065ae2f875 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-bigcache"
 
     # Use WolfSSL's Single Precision Math with timing-resistant cryptography.
-    "--enable-sp=yes${lib.optionalString (!stdenv.isx86_32) ",asm"}"
+    "--enable-sp=yes${lib.optionalString (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isAarch) ",asm"}"
     "--enable-sp-math-all"
     "--enable-harden"
   ] ++ lib.optionals (stdenv.hostPlatform.isx86_64) [
diff --git a/pkgs/development/ocaml-modules/semver/default.nix b/pkgs/development/ocaml-modules/semver/default.nix
index 15bd02f1868..5f4880c0cf2 100644
--- a/pkgs/development/ocaml-modules/semver/default.nix
+++ b/pkgs/development/ocaml-modules/semver/default.nix
@@ -1,29 +1,19 @@
-{ stdenv, lib, fetchzip, ocaml, findlib, ocamlbuild }:
+{ lib, fetchurl, buildDunePackage, ocaml, alcotest }:
 
-lib.throwIfNot (lib.versionAtLeast ocaml.version "4.02")
-  "semver is not available on OCaml older than 4.02"
-
-stdenv.mkDerivation rec {
-  pname = "ocaml${ocaml.version}-semver";
-  version = "0.1.0";
-  src = fetchzip {
-    url = "https://github.com/rgrinberg/ocaml-semver/archive/v${version}.tar.gz";
-    sha256 = "sha256-0BzeuVTpuRIQjadGg08hTvMzZtKCl2utW2YK269oETk=";
+buildDunePackage rec {
+  pname = "semver";
+  version = "0.2.1";
+  src = fetchurl {
+    url = "https://github.com/rgrinberg/ocaml-semver/releases/download/${version}/semver-${version}.tbz";
+    hash = "sha256-CjzDUtoe5Hvt6zImb+EqVIulRUUUQd9MmuJ4BH/2mLg=";
   };
 
-  nativeBuildInputs = [
-    ocaml
-    findlib
-    ocamlbuild
-  ];
-
-  strictDeps = true;
-  createFindlibDestdir = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  checkInputs = [ alcotest ];
 
   meta = {
     homepage = "https://github.com/rgrinberg/ocaml-semver";
     description = "Semantic versioning module";
-    platforms = ocaml.meta.platforms;
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
diff --git a/pkgs/development/python-modules/azure-storage-file-share/default.nix b/pkgs/development/python-modules/azure-storage-file-share/default.nix
index 1a4ef7c80cb..b89653fb678 100644
--- a/pkgs/development/python-modules/azure-storage-file-share/default.nix
+++ b/pkgs/development/python-modules/azure-storage-file-share/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "azure-storage-file-share";
-  version = "12.14.2";
+  version = "12.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mcMtgN2jX4hO4NSNk/1X9vT/vgCulYR5w7fV9OsCHrw=";
+    hash = "sha256-AJjxz6k0TE94HODNUE/zo1JVdRVTwB5yDczQyqjYqio=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cassandra-driver/default.nix b/pkgs/development/python-modules/cassandra-driver/default.nix
index 5d6c520ad3c..e985ed544d3 100644
--- a/pkgs/development/python-modules/cassandra-driver/default.nix
+++ b/pkgs/development/python-modules/cassandra-driver/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , buildPythonPackage
+, cryptography
 , cython
 , eventlet
 , fetchFromGitHub
@@ -24,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "cassandra-driver";
-  version = "3.26.0";
+  version = "3.28.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +34,7 @@ buildPythonPackage rec {
     owner = "datastax";
     repo = "python-driver";
     rev = "refs/tags/${version}";
-    hash = "sha256-mLQEG41WyFtXY2PJzoM4uaI4Cm+0xSIAPGhijHHbTBk=";
+    hash = "sha256-5JRbzYl7ftgK6GuvXWdvo52ZlS1th9JyLAYu/UCcPVc=";
   };
 
   postPatch = ''
@@ -56,17 +57,12 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    eventlet
     mock
     nose
     pytz
     pyyaml
     sure
-    scales
-    gremlinpython
-    gevent
-    twisted
-  ];
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   # Make /etc/protocols accessible to allow socket.getprotobyname('tcp') in sandbox,
   # also /etc/resolv.conf is referenced by some tests
@@ -77,6 +73,13 @@ buildPythonPackage rec {
   '') + ''
     # increase tolerance for time-based test
     substituteInPlace tests/unit/io/utils.py --replace 'delta=.15' 'delta=.3'
+
+    export HOME=$(mktemp -d)
+    # cythonize this before we hide the source dir as it references
+    # one of its files
+    cythonize -i tests/unit/cython/types_testhelper.pyx
+
+    mv cassandra .cassandra.hidden
   '';
 
   pythonImportsCheck = [
@@ -105,6 +108,15 @@ buildPythonPackage rec {
     "test_nts_token_performance"
   ];
 
+  passthru.optional-dependencies = {
+    cle = [ cryptography ];
+    eventlet = [ eventlet ];
+    gevent = [ gevent ];
+    graph = [ gremlinpython ];
+    metrics = [ scales ];
+    twisted = [ twisted ];
+  };
+
   meta = with lib; {
     description = "A Python client driver for Apache Cassandra";
     homepage = "http://datastax.github.io/python-driver";
diff --git a/pkgs/development/python-modules/coinmetrics-api-client/default.nix b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
index 967bcab909d..91484fe6a7f 100644
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2023.9.29.14";
+  version = "2023.10.30.13";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-88tNPg/0U5ZC2OvH8Bh9EzKzRFF2YClS2tyrswBaUZw=";
+    hash = "sha256-Kb6iVLV///X0UKby/7/wfbSGUFLw6HQX3SUwPX79QD0=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/htmllistparse/default.nix b/pkgs/development/python-modules/htmllistparse/default.nix
new file mode 100644
index 00000000000..ae13f6585a1
--- /dev/null
+++ b/pkgs/development/python-modules/htmllistparse/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, beautifulsoup4
+, html5lib
+, requests
+, fusepy
+}:
+
+buildPythonPackage rec {
+  pname = "htmllistparse";
+  version = "0.6.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-bcimvwPIQ7nTJYQ6JqI1GnlbVzzZKiybgnFiEBnGQII=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+  propagatedBuildInputs = [ beautifulsoup4 html5lib requests fusepy ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "htmllistparse"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/gumblex/htmllisting-parser";
+    description = "Python parser for Apache/nginx-style HTML directory listing";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexchen ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyglet/default.nix b/pkgs/development/python-modules/pyglet/default.nix
index e27a5d99f4e..393ec9f2e4c 100644
--- a/pkgs/development/python-modules/pyglet/default.nix
+++ b/pkgs/development/python-modules/pyglet/default.nix
@@ -18,13 +18,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.0.9";
+  version = "2.0.10";
   pname = "pyglet";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oJIuQvLSWFBWeOL0o1XFR2waY1LD86N3VAQt23589y8=";
+    hash = "sha256-JCvrGzvWfFvr3+W6EexWtpathrUMbn8qMX+NeDJWuck=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/radish-bdd/default.nix b/pkgs/development/python-modules/radish-bdd/default.nix
index e5db1cbad3c..f0f9070180e 100644
--- a/pkgs/development/python-modules/radish-bdd/default.nix
+++ b/pkgs/development/python-modules/radish-bdd/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "radish-bdd";
-  version = "0.17.0";
+  version = "0.17.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "radish";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4cGUF4Qh5+mxHtKNnAjh37Q6hEFCQ9zmntya98UHx+0=";
+    hash = "sha256-9Wt+W7PWUVijzAeZMvcOl/Na60OCCGJJqxh2UaAxAcM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index 2b8d597ae67..3c4fda87976 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -51,7 +51,7 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.34.1";
+  version = "4.35.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZyRn1AyyKvtrUUSWZ95jfIMXydcCSM5zZeseF7golhU=";
+    hash = "sha256-f66Y6kcAm//Z2UyCl/iEBDP+6nm3QJ5EtwpAnBn4gbc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/wagtail-localize/default.nix b/pkgs/development/python-modules/wagtail-localize/default.nix
index 29439bb2a2d..23b41404034 100644
--- a/pkgs/development/python-modules/wagtail-localize/default.nix
+++ b/pkgs/development/python-modules/wagtail-localize/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "wagtail-localize";
-  version = "1.5.2";
+  version = "1.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     repo = pname;
     owner = "wagtail";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7r2FFfWGqjE3Z7wsdf6KwwbUZ+wXqOscsL/2CepSMLY=";
+    hash = "sha256-OrRR5wLTq3icSBq+9m+MxIvkTvJP7yiGR9yzPt53q+k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wagtail/default.nix b/pkgs/development/python-modules/wagtail/default.nix
index cc5fa6c5a9a..8fe5ba39ed5 100644
--- a/pkgs/development/python-modules/wagtail/default.nix
+++ b/pkgs/development/python-modules/wagtail/default.nix
@@ -24,20 +24,20 @@
 
 buildPythonPackage rec {
   pname = "wagtail";
-  version = "5.1.1";
+  version = "5.1.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IR/wzXBZ+Win/EOFUDsg2AHB5otW9YMeCmpPxgCllD8=";
+    hash = "sha256-RfrHlOTCDH51sBgGnX+XYfJfqjYZ7zDfJAE8okq/mnQ=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
       --replace "beautifulsoup4>=4.8,<4.12" "beautifulsoup4>=4.8" \
-      --replace "Pillow>=4.0.0,<10.0.0" "Pillow>=9.1.0,<11.0.0"
+      --replace "draftjs_exporter>=2.1.5,<3.0" "draftjs_exporter>=2.1.5,<6.0"
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/quickemu/default.nix b/pkgs/development/quickemu/default.nix
index 95043c7be48..39400d5b4bc 100644
--- a/pkgs/development/quickemu/default.nix
+++ b/pkgs/development/quickemu/default.nix
@@ -25,6 +25,7 @@
 , quickemu
 , testers
 , installShellFiles
+, fetchpatch
 }:
 let
   runtimePaths = [
@@ -50,15 +51,23 @@ in
 
 stdenv.mkDerivation rec {
   pname = "quickemu";
-  version = "4.8";
+  version = "4.9";
 
   src = fetchFromGitHub {
     owner = "quickemu-project";
     repo = "quickemu";
     rev = version;
-    hash = "sha256-QchY9inmBqAwNEhUL+uFCRX1laaM57ICbDJEBW7qTic=";
+    hash = "sha256-ZCHGZb4mdtnNfFBcSqZJRW7fmkTBrWrVko3iwEhO1RY=";
   };
 
+  patches = [
+    # https://github.com/quickemu-project/quickemu/pull/815
+    (fetchpatch {
+      url = "https://github.com/quickemu-project/quickemu/commit/2b9d95a746fd85be0cea48e5544b18dc3ae18d27.patch";
+      hash = "sha256-fTJEd3o7LznT1mGwfxXWlW8XM1BmIeId+j8pGjIfIcE=";
+    })
+  ];
+
   postPatch = ''
     sed -i \
       -e '/OVMF_CODE_4M.secboot.fd/s|ovmfs=(|ovmfs=("${OVMFFull.fd}/FV/OVMF_CODE.fd","${OVMFFull.fd}/FV/OVMF_VARS.fd" |' \
diff --git a/pkgs/development/tools/build-managers/xmake/default.nix b/pkgs/development/tools/build-managers/xmake/default.nix
index 6d8222e387e..01fc3b3aafb 100644
--- a/pkgs/development/tools/build-managers/xmake/default.nix
+++ b/pkgs/development/tools/build-managers/xmake/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xmake";
-  version = "2.8.3";
+  version = "2.8.5";
 
   src = fetchurl {
     url = "https://github.com/xmake-io/xmake/releases/download/v${version}/xmake-v${version}.tar.gz";
-    hash = "sha256-BC6RazVbT1sr4RLQ1ZR4hHZGXDqFSvuqpt5vPyMDylA=";
+    hash = "sha256-GcZ747z8valsqHoY7/rDm/zMRD+7N1THu8AVEd7NJK8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/web/bun/default.nix b/pkgs/development/web/bun/default.nix
index b5f92297761..4ca59fffe7f 100644
--- a/pkgs/development/web/bun/default.nix
+++ b/pkgs/development/web/bun/default.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.0.7";
+  version = "1.0.10";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-aPFKKCqjKZSz/ZX5G3RiIkLHIj89MGPp+PgFbE4vpgE=";
+        hash = "sha256-xwKNDTlghNkq36wMAKSa+reROqGwMm4dZ/Hfos1zuP4=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-u2UlimmIE2z7qsqkAbSfi7kxuOjlJGkX4RAsUGMklGc=";
+        hash = "sha256-gaquYp4q22IJHV7Fx5GxZWVFvJzU30HOmL32lkxJeQ8=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-MO01plCsZRR+2kC2J0/VhXJIhchMfLtMFvidPNAXtB4=";
+        hash = "sha256-DPVnTzdGprjZ16kme3Y6xBognjWHt+0N/zk0J3dm8jY=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-yw17x8DmKktE5fNBF3JQdVSEXFwAotA7hCzfLcd6JoI=";
+        hash = "sha256-Er7QiWBhENTa9xhCIVqECCzexWejBwBC59u3CJKQiwc=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/shells/oh/default.nix b/pkgs/shells/oh/default.nix
index 10bd86ba059..4504d6c8617 100644
--- a/pkgs/shells/oh/default.nix
+++ b/pkgs/shells/oh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "oh";
-  version = "0.8.1";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "michaelmacinnis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DMxC5fv5ZLDv7gMajC/eyJd2YpO+OXFdvwAPYotnczw=";
+    sha256 = "sha256-ryIh6MRIOVZPm2USpJC69Z/upIXGUHgcd17eZBA9Edc=";
   };
 
-  vendorHash = "sha256-f4rqXOu6yXUzNsseSaV9pb8c2KXItYOalB5pfH3Acnc=";
+  vendorHash = "sha256-Qma5Vk0JO/tTrZanvTCE40LmjeCfBup3U3N7gyhfp44=";
 
   meta = with lib; {
     homepage = "https://github.com/michaelmacinnis/oh";
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 63fd00d266e..9a794531bc1 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -152,9 +152,8 @@ let
 
     # flakeNote will be printed in the remediation messages below.
     flakeNote = "
- Note: For `nix shell`, `nix build`, `nix develop` or any other Nix 2.4+
- (Flake) command, `--impure` must be passed in order to read this
- environment variable.
+   Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
+         then pass `--impure` in order to allow use of environment variables.
     ";
 
   remediate_allowlist = allow_attr: rebuild_amendment: attrs:
diff --git a/pkgs/tools/misc/goreleaser/default.nix b/pkgs/tools/misc/goreleaser/default.nix
index dcef5f02627..d8e6b511521 100644
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule rec {
   pname = "goreleaser";
-  version = "1.21.2";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dH5Fh3F+UJRS/zZkxhZ7TzLWo0ncUNKbLZdjbnBPloE=";
+    hash = "sha256-82DaGmXS+qbPN3dg1Zk/WHGOymJEuhOzQl+MsPmi5tw=";
   };
 
-  vendorHash = "sha256-Ua1Eey0trzha1WyPtwZYvfzOSywb7ThfWcI/VlMgD88=";
+  vendorHash = "sha256-+ac4q820gETsNRVpW2u0MXU6HfoztLdsWK2HYqJ4mqo=";
 
   ldflags =
     [ "-s" "-w" "-X main.version=${version}" "-X main.builtBy=nixpkgs" ];
diff --git a/pkgs/tools/package-management/pdm/default.nix b/pkgs/tools/package-management/pdm/default.nix
index dff2375199e..aabdf172441 100644
--- a/pkgs/tools/package-management/pdm/default.nix
+++ b/pkgs/tools/package-management/pdm/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , python3
 , fetchFromGitHub
+, fetchpatch
 , fetchPypi
 , nix-update-script
 , runtimeShell
@@ -31,15 +32,25 @@ in
 with python.pkgs;
 buildPythonApplication rec {
   pname = "pdm";
-  version = "2.10.0";
+  version = "2.10.1";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ziJJWVr59hsJJqCJljLfSbHHESYegFak+uFLU/k9kZM=";
+    hash = "sha256-0WZTHGWfxJBZM1RlRN0uFs9kjCum2JjIISatakIReoE=";
   };
 
+  patches = [
+    # https://github.com/NixOS/nixpkgs/issues/265883
+    # https://github.com/pdm-project/pdm/pull/2379
+    (fetchpatch {
+      name = "fix-template-permission.patch";
+      url = "https://github.com/pdm-project/pdm/commit/f0efdcefe589bc58c28ccf6ce2d23cad9a81dccc.patch";
+      hash = "sha256-NnHDSz2N63JzSzh2t9a5f/QQWM6Hyd5Cn5JY2zem6Ac=";
+    })
+  ];
+
   nativeBuildInputs = [
     pdm-backend
   ];
@@ -101,10 +112,11 @@ buildPythonApplication rec {
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
-    homepage = "https://pdm.fming.dev";
+    homepage = "https://pdm-project.org";
     changelog = "https://github.com/pdm-project/pdm/releases/tag/${version}";
     description = "A modern Python package manager with PEP 582 support";
     license = licenses.mit;
     maintainers = with maintainers; [ cpcloud ];
+    mainProgram = "pdm";
   };
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a588d876676..5df3dbe70d0 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5094,6 +5094,8 @@ self: super: with self; {
 
   htmllaundry = callPackage ../development/python-modules/htmllaundry { };
 
+  htmllistparse = callPackage ../development/python-modules/htmllistparse { };
+
   htmlmin = callPackage ../development/python-modules/htmlmin { };
 
   html-sanitizer = callPackage ../development/python-modules/html-sanitizer { };