summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix15
-rw-r--r--nixos/doc/manual/release-notes/rl-2305.section.md2
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/networking/bird-lg.nix105
-rw-r--r--nixos/modules/services/web-servers/stargazer.nix198
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/promscale.nix60
-rw-r--r--nixos/tests/web-servers/stargazer.nix30
-rw-r--r--pkgs/applications/audio/tauon/default.nix8
-rw-r--r--pkgs/applications/editors/standardnotes/src.json10
-rw-r--r--pkgs/applications/misc/1password/default.nix10
-rw-r--r--pkgs/applications/misc/pgmodeler/default.nix4
-rw-r--r--pkgs/applications/misc/ttdl/default.nix6
-rw-r--r--pkgs/applications/misc/yubioath-flutter/default.nix15
-rw-r--r--pkgs/applications/misc/yubioath-flutter/deps.json1319
-rw-r--r--pkgs/applications/networking/cluster/kubeshark/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json24
-rw-r--r--pkgs/applications/networking/dnscontrol/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/sniffers/wireshark/default.nix4
-rw-r--r--pkgs/applications/science/physics/elmerfem/default.nix21
-rw-r--r--pkgs/applications/science/physics/elmerfem/patches/0001-fix-import-of-QPainterPath.patch24
-rw-r--r--pkgs/applications/science/physics/elmerfem/patches/0002-fem-rename-loopvars-to-avoid-redefinition.patch82
-rw-r--r--pkgs/applications/science/physics/elmerfem/patches/0003-ignore-qwt_compat.patch36
-rw-r--r--pkgs/build-support/dart/fetch-dart-deps/default.nix186
-rw-r--r--pkgs/build-support/dart/fetch-dart-deps/setup-hook.sh41
-rw-r--r--pkgs/build-support/flutter/default.nix379
-rw-r--r--pkgs/build-support/node/build-npm-package/default.nix5
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/default.nix11
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/src/cacache.rs2
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/src/main.rs425
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs191
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs370
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/src/tests.rs141
-rw-r--r--pkgs/build-support/rust/build-rust-package/default.nix11
-rw-r--r--pkgs/data/fonts/iosevka/bin.nix2
-rw-r--r--pkgs/data/fonts/iosevka/variants.nix184
-rw-r--r--pkgs/data/fonts/sarasa-gothic/default.nix4
-rw-r--r--pkgs/development/compilers/cmdstan/default.nix4
-rw-r--r--pkgs/development/compilers/flutter/default.nix37
-rw-r--r--pkgs/development/compilers/flutter/engine-artifacts/default.nix128
-rw-r--r--pkgs/development/compilers/flutter/engine-artifacts/hashes.nix144
-rw-r--r--pkgs/development/compilers/flutter/flutter.nix366
-rw-r--r--pkgs/development/compilers/flutter/package-overrides/default.nix4
-rw-r--r--pkgs/development/compilers/flutter/patches/flutter2/copy-without-perms.patch17
-rw-r--r--pkgs/development/compilers/flutter/patches/flutter2/disable-auto-update.patch13
-rw-r--r--pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch41
-rw-r--r--pkgs/development/compilers/flutter/patches/flutter3/copy-without-perms.patch17
-rw-r--r--pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch13
-rw-r--r--pkgs/development/compilers/flutter/patches/flutter3/dont-validate-executable-location.patch12
-rw-r--r--pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch161
-rw-r--r--pkgs/development/compilers/flutter/sdk-symlink.nix24
-rw-r--r--pkgs/development/compilers/flutter/wrapper.nix110
-rw-r--r--pkgs/development/compilers/rust/rustc.nix15
-rw-r--r--pkgs/development/compilers/stanc/default.nix4
-rw-r--r--pkgs/development/interpreters/wasmtime/default.nix6
-rw-r--r--pkgs/development/libraries/epoll-shim/default.nix6
-rw-r--r--pkgs/development/libraries/gtk/4.x.nix4
-rw-r--r--pkgs/development/libraries/libadwaita/default.nix10
-rw-r--r--pkgs/development/libraries/libwpe/fdo.nix4
-rw-r--r--pkgs/development/libraries/webkitgtk/default.nix4
-rw-r--r--pkgs/development/python-modules/accelerate/default.nix74
-rw-r--r--pkgs/development/python-modules/catboost/default.nix10
-rw-r--r--pkgs/development/python-modules/docformatter/default.nix4
-rw-r--r--pkgs/development/python-modules/elmax-api/default.nix4
-rw-r--r--pkgs/development/python-modules/gehomesdk/default.nix4
-rw-r--r--pkgs/development/python-modules/hahomematic/default.nix4
-rw-r--r--pkgs/development/python-modules/markdown-it-py/default.nix2
-rw-r--r--pkgs/development/python-modules/mdit-py-plugins/default.nix5
-rw-r--r--pkgs/development/python-modules/peft/default.nix54
-rw-r--r--pkgs/development/python-modules/safetensors/default.nix79
-rw-r--r--pkgs/development/python-modules/syncedlyrics/default.nix14
-rw-r--r--pkgs/development/python-modules/ttp-templates/default.nix2
-rw-r--r--pkgs/development/python-modules/yalexs/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/bear/default.nix4
-rw-r--r--pkgs/development/tools/goda/default.nix6
-rw-r--r--pkgs/development/tools/jql/default.nix6
-rw-r--r--pkgs/development/tools/misc/sccache/default.nix6
-rw-r--r--pkgs/development/tools/mongosh/source.json2
-rw-r--r--pkgs/development/tools/okteto/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-careful/default.nix6
-rw-r--r--pkgs/development/tools/yq-go/default.nix6
-rw-r--r--pkgs/os-specific/darwin/sketchybar/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/default.nix10
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/deps.json763
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock493
-rw-r--r--pkgs/servers/monitoring/prometheus/promscale/0001-remove-jaeger-test-dep.patch17
-rw-r--r--pkgs/servers/monitoring/prometheus/promscale/default.nix18
-rw-r--r--pkgs/servers/simple-http-server/default.nix6
-rw-r--r--pkgs/servers/sql/postgresql/ext/promscale_extension.nix60
-rw-r--r--pkgs/servers/sql/postgresql/packages.nix2
-rw-r--r--pkgs/tools/backup/rustic-rs/default.nix6
-rw-r--r--pkgs/tools/graphics/gmic-qt/default.nix1
-rw-r--r--pkgs/tools/misc/boxxy/default.nix12
-rw-r--r--pkgs/tools/misc/flashrom-stable/default.nix46
-rw-r--r--pkgs/tools/misc/gh-dash/default.nix6
-rw-r--r--pkgs/tools/security/cosign/default.nix6
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock21
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix36
-rw-r--r--pkgs/tools/virtualization/awsebcli/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix17
-rw-r--r--pkgs/top-level/all-packages.nix8
-rw-r--r--pkgs/top-level/python-packages.nix6
108 files changed, 5301 insertions, 1645 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f190c7086bb..8c8409f4923 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1061,6 +1061,16 @@
     githubId = 1342360;
     name = "Andrew Morgan";
   };
+  anpin = {
+    email = "pavel@anpin.fyi";
+    github = "anpin";
+    githubId = 6060545;
+    matrix = "@anpin:matrix.org";
+    name = "Pavel Anpin";
+    keys = [{
+      fingerprint = "06E8 4FF6 0CCF 7AFD 5101  76C9 0FBC D3EE 6310 7407";
+    }];
+  };
   anpryl = {
     email = "anpryl@gmail.com";
     github = "anpryl";
@@ -3304,9 +3314,12 @@
     }];
   };
   cyntheticfox = {
-    email = "houstdav000@gmail.com";
+    email = "cyntheticfox@gh0st.sh";
     github = "cyntheticfox";
     githubId = 17628961;
+    keys = [{
+      fingerprint = "73C1 C5DF 51E7 BB92 85E9  A262 5960 278C E235 F821";
+    }];
     matrix = "@houstdav000:gh0st.ems.host";
     name = "Cynthia Fox";
   };
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index a89c46152ca..c411ecb6dcb 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -95,6 +95,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [jellyseerr](https://github.com/Fallenbagel/jellyseerr), a web-based requests manager for Jellyfin, forked from Overseerr. Available as [services.jellyseerr](#opt-services.jellyseerr.enable).
 
+- [stargazer](https://sr.ht/~zethra/stargazer/), a fast and easy to use Gemini server. Available as [services.stargazer](#opt-services.stargazer.enable).
+
 - [photoprism](https://photoprism.app/), a AI-Powered Photos App for the Decentralized Web. Available as [services.photoprism](options.html#opt-services.photoprism.enable).
 
 - [peroxide](https://github.com/ljanyst/peroxide), a fork of the official [ProtonMail bridge](https://github.com/ProtonMail/proton-bridge) that aims to be similar to [Hydroxide](https://github.com/emersion/hydroxide). Available as [services.peroxide](#opt-services.peroxide.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index f1c459f7557..bbbe8682fd0 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1243,6 +1243,7 @@
   ./services/web-servers/nginx/gitweb.nix
   ./services/web-servers/phpfpm/default.nix
   ./services/web-servers/pomerium.nix
+  ./services/web-servers/stargazer.nix
   ./services/web-servers/tomcat.nix
   ./services/web-servers/traefik.nix
   ./services/web-servers/trafficserver/default.nix
diff --git a/nixos/modules/services/networking/bird-lg.nix b/nixos/modules/services/networking/bird-lg.nix
index 11cfe3e7ec0..8ef14c93a2e 100644
--- a/nixos/modules/services/networking/bird-lg.nix
+++ b/nixos/modules/services/networking/bird-lg.nix
@@ -4,6 +4,48 @@ with lib;
 
 let
   cfg = config.services.bird-lg;
+
+  stringOrConcat = sep: v: if builtins.isString v then v else concatStringsSep sep v;
+
+  frontend_args = let
+    fe = cfg.frontend;
+  in {
+    "--servers" = concatStringsSep "," fe.servers;
+    "--domain" = fe.domain;
+    "--listen" = fe.listenAddress;
+    "--proxy-port" = fe.proxyPort;
+    "--whois" = fe.whois;
+    "--dns-interface" = fe.dnsInterface;
+    "--bgpmap-info" = concatStringsSep "," cfg.frontend.bgpMapInfo;
+    "--title-brand" = fe.titleBrand;
+    "--navbar-brand" = fe.navbar.brand;
+    "--navbar-brand-url" = fe.navbar.brandURL;
+    "--navbar-all-servers" = fe.navbar.allServers;
+    "--navbar-all-url" = fe.navbar.allServersURL;
+    "--net-specific-mode" = fe.netSpecificMode;
+    "--protocol-filter" = concatStringsSep "," cfg.frontend.protocolFilter;
+  };
+
+  proxy_args = let
+    px = cfg.proxy;
+  in {
+    "--allowed" = concatStringsSep "," px.allowedIPs;
+    "--bird" = px.birdSocket;
+    "--listen" = px.listenAddress;
+    "--traceroute_bin" = px.traceroute.binary;
+    "--traceroute_raw" = px.traceroute.rawOutput;
+  };
+
+  mkArgValue = value:
+    if isString value
+      then escapeShellArg value
+      else if isBool value
+        then boolToString value
+        else toString value;
+
+  filterNull = filterAttrs (_: v: v != "" && v != null && v != []);
+
+  argsAttrToList = args: mapAttrsToList (name: value: "${name} " + mkArgValue value ) (filterNull args);
 in
 {
   options = {
@@ -44,14 +86,12 @@ in
 
         domain = mkOption {
           type = types.str;
-          default = "";
           example = "dn42.lantian.pub";
           description = lib.mdDoc "Server name domain suffixes.";
         };
 
         servers = mkOption {
           type = types.listOf types.str;
-          default = [ ];
           example = [ "gigsgigscloud" "hostdare" ];
           description = lib.mdDoc "Server name prefixes.";
         };
@@ -134,10 +174,14 @@ in
         };
 
         extraArgs = mkOption {
-          type = types.lines;
-          default = "";
+          type = with types; either lines (listOf str);
+          default = [ ];
           description = lib.mdDoc ''
             Extra parameters documented [here](https://github.com/xddxdd/bird-lg-go#frontend).
+
+            :::{.note}
+            Passing lines (plain strings) is deprecated in favour of passing lists of strings.
+            :::
           '';
         };
       };
@@ -160,8 +204,7 @@ in
 
         birdSocket = mkOption {
           type = types.str;
-          default = "/run/bird.ctl";
-          example = "/var/run/bird/bird.ctl";
+          default = "/var/run/bird/bird.ctl";
           description = lib.mdDoc "Bird control socket path.";
         };
 
@@ -181,10 +224,14 @@ in
         };
 
         extraArgs = mkOption {
-          type = types.lines;
-          default = "";
+          type = with types; either lines (listOf str);
+          default = [ ];
           description = lib.mdDoc ''
             Extra parameters documented [here](https://github.com/xddxdd/bird-lg-go#proxy).
+
+            :::{.note}
+            Passing lines (plain strings) is deprecated in favour of passing lists of strings.
+            :::
           '';
         };
       };
@@ -194,6 +241,16 @@ in
   ###### implementation
 
   config = {
+
+    warnings =
+      lib.optional (cfg.frontend.enable  && builtins.isString cfg.frontend.extraArgs) ''
+        Passing strings to `services.bird-lg.frontend.extraOptions' is deprecated. Please pass a list of strings instead.
+      ''
+      ++ lib.optional (cfg.proxy.enable  && builtins.isString cfg.proxy.extraArgs) ''
+        Passing strings to `services.bird-lg.proxy.extraOptions' is deprecated. Please pass a list of strings instead.
+      ''
+    ;
+
     systemd.services = {
       bird-lg-frontend = mkIf cfg.frontend.enable {
         enable = true;
@@ -211,23 +268,8 @@ in
         };
         script = ''
           ${cfg.package}/bin/frontend \
-            --servers ${concatStringsSep "," cfg.frontend.servers } \
-            --domain ${cfg.frontend.domain} \
-            --listen ${cfg.frontend.listenAddress} \
-            --proxy-port ${toString cfg.frontend.proxyPort} \
-            --whois ${cfg.frontend.whois} \
-            --dns-interface ${cfg.frontend.dnsInterface} \
-            --bgpmap-info ${concatStringsSep "," cfg.frontend.bgpMapInfo } \
-            --title-brand ${cfg.frontend.titleBrand} \
-            --navbar-brand ${cfg.frontend.navbar.brand} \
-            --navbar-brand-url ${cfg.frontend.navbar.brandURL} \
-            --navbar-all-servers ${cfg.frontend.navbar.allServers} \
-            --navbar-all-url ${cfg.frontend.navbar.allServersURL} \
-            --net-specific-mode ${cfg.frontend.netSpecificMode} \
-            --protocol-filter ${concatStringsSep "," cfg.frontend.protocolFilter } \
-            --name-filter ${cfg.frontend.nameFilter} \
-            --time-out ${toString cfg.frontend.timeout} \
-            ${cfg.frontend.extraArgs}
+            ${concatStringsSep " \\\n  " (argsAttrToList frontend_args)} \
+            ${stringOrConcat " " cfg.frontend.extraArgs}
         '';
       };
 
@@ -247,12 +289,8 @@ in
         };
         script = ''
           ${cfg.package}/bin/proxy \
-          --allowed ${concatStringsSep "," cfg.proxy.allowedIPs } \
-          --bird ${cfg.proxy.birdSocket} \
-          --listen ${cfg.proxy.listenAddress} \
-          --traceroute_bin ${cfg.proxy.traceroute.binary}
-          --traceroute_raw ${boolToString cfg.proxy.traceroute.rawOutput}
-          ${cfg.proxy.extraArgs}
+            ${concatStringsSep " \\\n  " (argsAttrToList proxy_args)} \
+            ${stringOrConcat " " cfg.proxy.extraArgs}
         '';
       };
     };
@@ -266,4 +304,9 @@ in
       };
     };
   };
+
+  meta.maintainers = with lib.maintainers; [
+    e1mo
+    tchekda
+  ];
 }
diff --git a/nixos/modules/services/web-servers/stargazer.nix b/nixos/modules/services/web-servers/stargazer.nix
new file mode 100644
index 00000000000..85783a500d6
--- /dev/null
+++ b/nixos/modules/services/web-servers/stargazer.nix
@@ -0,0 +1,198 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.stargazer;
+  routesFormat = pkgs.formats.ini { };
+  globalFile = pkgs.writeText "global.ini" ''
+    listen = ${concatStringsSep " " cfg.listen}
+    connection-logging = ${boolToString cfg.connectionLogging}
+    log-ip = ${boolToString cfg.ipLog}
+    log-ip-partial = ${boolToString cfg.ipLogPartial}
+    request-timeout = ${toString cfg.requestTimeout}
+    response-timeout = ${toString cfg.responseTimeout}
+
+    [:tls]
+    store = ${toString cfg.store}
+    organization = ${cfg.certOrg}
+    gen-certs = ${boolToString cfg.genCerts}
+    regen-certs = ${boolToString cfg.regenCerts}
+    ${optionalString (cfg.certLifetime != "") "cert-lifetime = ${cfg.certLifetime}"}
+
+  '';
+  routesFile = routesFormat.generate "router.ini" cfg.routes;
+  configFile = pkgs.runCommand "config.ini" { } ''
+    cat ${globalFile} ${routesFile} > $out
+  '';
+in
+{
+  options.services.stargazer = {
+    enable = mkEnableOption (lib.mdDoc "Stargazer Gemini server");
+
+    listen = lib.mkOption {
+      type = types.listOf types.str;
+      default = [ "0.0.0.0" ] ++ optional config.networking.enableIPv6 "[::0]";
+      defaultText = literalExpression ''[ "0.0.0.0" ] ++ lib.optional config.networking.enableIPv6 "[::0]"'';
+      example = literalExpression ''[ "10.0.0.12" "[2002:a00:1::]" ]'';
+      description = lib.mdDoc ''
+        Address and port to listen on.
+      '';
+    };
+
+    connectionLogging = lib.mkOption {
+      type = types.bool;
+      default = true;
+      description = lib.mdDoc "Whether or not to log connections to stdout.";
+    };
+
+    ipLog = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc "Log client IP addresses in the connection log.";
+    };
+
+    ipLogPartial = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc "Log partial client IP addresses in the connection log.";
+    };
+
+    requestTimeout = lib.mkOption {
+      type = types.int;
+      default = 5;
+      description = lib.mdDoc ''
+        Number of seconds to wait for the client to send a complete
+        request. Set to 0 to disable.
+      '';
+    };
+
+    responseTimeout = lib.mkOption {
+      type = types.int;
+      default = 0;
+      description = lib.mdDoc ''
+        Number of seconds to wait for the client to send a complete
+        request and for stargazer to finish sending the response.
+        Set to 0 to disable.
+      '';
+    };
+
+    store = lib.mkOption {
+      type = types.path;
+      default = /var/lib/gemini/certs;
+      description = lib.mdDoc ''
+        Path to the certificate store on disk. This should be a
+        persistent directory writable by Stargazer.
+      '';
+    };
+
+    certOrg = lib.mkOption {
+      type = types.str;
+      default = "stargazer";
+      description = lib.mdDoc ''
+        The name of the organization responsible for the X.509
+        certificate's /O name.
+      '';
+    };
+
+    genCerts = lib.mkOption {
+      type = types.bool;
+      default = true;
+      description = lib.mdDoc ''
+        Set to false to disable automatic certificate generation.
+        Use if you want to provide your own certs.
+      '';
+    };
+
+    regenCerts = lib.mkOption {
+      type = types.bool;
+      default = true;
+      description = lib.mdDoc ''
+        Set to false to turn off automatic regeneration of expired certificates.
+        Use if you want to provide your own certs.
+      '';
+    };
+
+    certLifetime = lib.mkOption {
+      type = types.str;
+      default = "";
+      description = lib.mdDoc ''
+        How long certs generated by Stargazer should live for.
+        Certs live forever by default.
+      '';
+      example = literalExpression "\"1y\"";
+    };
+
+    routes = lib.mkOption {
+      type = routesFormat.type;
+      default = { };
+      description = lib.mdDoc ''
+        Routes that Stargazer should server.
+
+        [Refer to upstream docs](https://git.sr.ht/~zethra/stargazer/tree/main/item/doc/stargazer.ini.5.txt)
+      '';
+      example = literalExpression ''
+        {
+          "example.com" = {
+            root = "/srv/gemini/example.com";
+          };
+          "example.com:/man" = {
+            root = "/cgi-bin";
+            cgi = true;
+          };
+          "other.org~(.*)" = {
+            redirect = "gemini://example.com";
+            rewrite = "\1";
+          };
+        }
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "stargazer";
+      description = lib.mdDoc "User account under which stargazer runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "stargazer";
+      description = lib.mdDoc "Group account under which stargazer runs.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.stargazer = {
+      description = "Stargazer gemini server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.stargazer}/bin/stargazer ${configFile}";
+        Restart = "always";
+        # User and group
+        User = cfg.user;
+        Group = cfg.group;
+      };
+    };
+
+    # Create default cert store
+    system.activationScripts.makeStargazerCertDir =
+      optionalAttrs (cfg.store == /var/lib/gemini/certs) ''
+        mkdir -p /var/lib/gemini/certs
+        chown -R ${cfg.user}:${cfg.group} /var/lib/gemini/certs
+      '';
+
+    users.users = optionalAttrs (cfg.user == "stargazer") {
+      stargazer = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == "stargazer") {
+      stargazer = { };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ gaykitty ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 715fe7e51e0..506cba25ba5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -645,6 +645,7 @@ in {
   sslh = handleTest ./sslh.nix {};
   sssd = handleTestOn ["x86_64-linux"] ./sssd.nix {};
   sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
+  stargazer = runTest ./web-servers/stargazer.nix;
   starship = handleTest ./starship.nix {};
   step-ca = handleTestOn ["x86_64-linux"] ./step-ca.nix {};
   stratis = handleTest ./stratis {};
@@ -712,6 +713,7 @@ in {
   tiddlywiki = handleTest ./tiddlywiki.nix {};
   tigervnc = handleTest ./tigervnc.nix {};
   timescaledb = handleTest ./timescaledb.nix {};
+  promscale = handleTest ./promscale.nix {};
   timezone = handleTest ./timezone.nix {};
   tinc = handleTest ./tinc {};
   tinydns = handleTest ./tinydns.nix {};
diff --git a/nixos/tests/promscale.nix b/nixos/tests/promscale.nix
new file mode 100644
index 00000000000..d4825b6d7f5
--- /dev/null
+++ b/nixos/tests/promscale.nix
@@ -0,0 +1,60 @@
+# mostly copied from ./timescaledb.nix which was copied from ./postgresql.nix
+# as it seemed unapproriate to test additional extensions for postgresql there.
+
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+let
+  postgresql-versions = import ../../pkgs/servers/sql/postgresql pkgs;
+  test-sql = pkgs.writeText "postgresql-test" ''
+    CREATE USER promscale SUPERUSER PASSWORD 'promscale';
+    CREATE DATABASE promscale OWNER promscale;
+  '';
+
+  make-postgresql-test = postgresql-name: postgresql-package: makeTest {
+    name = postgresql-name;
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ anpin ];
+    };
+
+    nodes.machine = { config, pkgs, ... }:
+      {
+        services.postgresql = {
+          enable = true;
+          package = postgresql-package;
+          extraPlugins = with postgresql-package.pkgs; [
+            timescaledb
+            promscale_extension
+          ];
+          settings = { shared_preload_libraries = "timescaledb, promscale"; };
+        };
+        environment.systemPackages = with pkgs; [ promscale ];
+      };
+
+    testScript = ''
+      machine.start()
+      machine.wait_for_unit("postgresql")
+      with subtest("Postgresql with extensions timescaledb and promscale is available just after unit start"):
+          print(machine.succeed("sudo -u postgres psql -f ${test-sql}"))
+          machine.succeed("sudo -u postgres psql promscale -c 'SHOW shared_preload_libraries;' | grep promscale")
+          machine.succeed(
+            "promscale --db.name promscale --db.password promscale --db.user promscale --db.ssl-mode allow --startup.install-extensions --startup.only"
+          )
+      machine.succeed("sudo -u postgres psql promscale -c 'SELECT ps_trace.get_trace_retention_period();' | grep '(1 row)'")
+      machine.shutdown()
+    '';
+  };
+  #version 15 is not supported yet
+  applicablePostgresqlVersions = filterAttrs (_: value: versionAtLeast value.version "12" && !(versionAtLeast value.version "15")) postgresql-versions;
+in
+mapAttrs'
+  (name: package: {
+    inherit name;
+    value = make-postgresql-test name package;
+  })
+  applicablePostgresqlVersions
diff --git a/nixos/tests/web-servers/stargazer.nix b/nixos/tests/web-servers/stargazer.nix
new file mode 100644
index 00000000000..6e720b120d1
--- /dev/null
+++ b/nixos/tests/web-servers/stargazer.nix
@@ -0,0 +1,30 @@
+{ pkgs, lib, ... }:
+{
+  name = "stargazer";
+  meta = with lib.maintainers; { maintainers = [ gaykitty ]; };
+
+  nodes = {
+    geminiserver = { pkgs, ... }: {
+      services.stargazer = {
+        enable = true;
+        routes = {
+          "localhost" = {
+            root = toString (pkgs.writeTextDir "index.gmi" ''
+              # Hello NixOS!
+            '');
+          };
+        };
+      };
+    };
+  };
+
+  testScript = { nodes, ... }: ''
+    geminiserver.wait_for_unit("stargazer")
+    geminiserver.wait_for_open_port(1965)
+
+    with subtest("check is serving over gemini"):
+      response = geminiserver.succeed("${pkgs.gmni}/bin/gmni -j once -i -N gemini://localhost:1965")
+      print(response)
+      assert "Hello NixOS!" in response
+  '';
+}
diff --git a/pkgs/applications/audio/tauon/default.nix b/pkgs/applications/audio/tauon/default.nix
index 427c1e9e5dc..a75110c15da 100644
--- a/pkgs/applications/audio/tauon/default.nix
+++ b/pkgs/applications/audio/tauon/default.nix
@@ -57,6 +57,8 @@ stdenv.mkDerivation rec {
 
     patchShebangs compile-phazor.sh
 
+    substituteInPlace compile-phazor.sh --replace 'gcc' '${stdenv.cc.targetPrefix}cc'
+
     substituteInPlace extra/tauonmb.desktop --replace 'Exec=/opt/tauon-music-box/tauonmb.sh' 'Exec=${placeholder "out"}/bin/tauon'
   '';
 
@@ -95,7 +97,6 @@ stdenv.mkDerivation rec {
     natsort
     pillow
     plexapi
-    pulsectl
     pycairo
     pychromecast
     pylast
@@ -105,7 +106,8 @@ stdenv.mkDerivation rec {
     requests
     send2trash
     setproctitle
-  ] ++ lib.optional withDiscordRPC pypresence;
+  ] ++ lib.optional withDiscordRPC pypresence
+    ++ lib.optional stdenv.isLinux pulsectl;
 
   makeWrapperArgs = [
     "--prefix PATH : ${lib.makeBinPath [ffmpeg]}"
@@ -134,6 +136,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/Taiko2k/TauonMusicBox/releases/tag/v${version}";
     license = licenses.gpl3;
     maintainers = with maintainers; [ jansol ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/applications/editors/standardnotes/src.json b/pkgs/applications/editors/standardnotes/src.json
index ddb759837b0..10c7ee38e9c 100644
--- a/pkgs/applications/editors/standardnotes/src.json
+++ b/pkgs/applications/editors/standardnotes/src.json
@@ -1,13 +1,13 @@
 {
-  "version": "3.150.45",
+  "version": "3.151.3",
   "appimage": {
     "x86_64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.150.45/standard-notes-3.150.45-linux-x86_64.AppImage",
-      "hash": "sha512-a1g+nOJJ1MSiCvguFAlAPhwyogAS6cwDD8Ou+P0lufLLG2HyLPdOEwVl8Nhqq4iaFFQoyY3FtKm+Sdpd3WJ72Q=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.151.3/standard-notes-3.151.3-linux-x86_64.AppImage",
+      "hash": "sha512-Wk31nB9OjR8E3cPFfh4KpUqQxXsnerzDt5TgaExXW4OeWLftv3ejyf2ROWXAoqG/8K87OclbunCqS3b2g8hAjA=="
     },
     "aarch64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.150.45/standard-notes-3.150.45-linux-arm64.AppImage",
-      "hash": "sha512-ivnyuMhdBweRs+9Qkt4srm2JlMMxLFDbT0DBaeNCHVuyWM/13LRczIyto2tbPp9xC6DCJmGktjY3ZYsB3odftA=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.151.3/standard-notes-3.151.3-linux-arm64.AppImage",
+      "hash": "sha512-nPTpEJs978wxZjG1pN15ETgUBdGBzl574QHCQNo2ShYvhi9Uf38jCaGQIsY0d779eT8kSHuMBXoAiE/flxfWMQ=="
     }
   }
 }
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index f7a7281496b..f71d1ff0fcb 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.16.1";
+  version = "2.17.0";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-8zKxd2yY8syGhgyPv06b+ag2bEfFfG19ZmQPrfi+Qh4=" "zip";
-    i686-linux = fetch "linux_386" "sha256-3OO0JMJMRqbmq/rD/VRKIMBdjYu66ebEFGNLKX9K6A8=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-ZCXfreBiFDc5YFd9YsMddEvzl22KwnnfSQsV6BmHqeA=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-vlsqvz+AgEhL7M8cJhxmjjZ6ocIVUdq7MC1EVZOExU8=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-pnLAFCKhQKOIqp0qDv3DfAqF4fDXjFdw7Jl9WgDf7C0=" "zip";
+    i686-linux = fetch "linux_386" "sha256-o+pSWUOSzDKA5m+Riu3QOi9gQMyEmbIGcE/yUjKu9p8=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-aukQSeC+5p6ioTE6QlzEAM+9VOI34GfzzjaGt/N0klY=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-HSXbbeDWYrFTh9SsKwvNovprWRwaDr3rA6X6E1QJJos=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
diff --git a/pkgs/applications/misc/pgmodeler/default.nix b/pkgs/applications/misc/pgmodeler/default.nix
index ca9387e34e6..367c0aee408 100644
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgmodeler";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "pgmodeler";
     repo = "pgmodeler";
     rev = "v${version}";
-    sha256 = "sha256-yvVgBfJLjEynsqxQisDfOM99C8/QM0F44RIHAmxh4uU=";
+    sha256 = "sha256-ZlIz+7YyER0/wQEkEe8XHYHcLK4vu09v1zkDrIgR/Dc=";
   };
 
   nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
diff --git a/pkgs/applications/misc/ttdl/default.nix b/pkgs/applications/misc/ttdl/default.nix
index 519efbcf587..03ecf260d24 100644
--- a/pkgs/applications/misc/ttdl/default.nix
+++ b/pkgs/applications/misc/ttdl/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ttdl";
-  version = "3.7.1";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "VladimirMarkelov";
     repo = "ttdl";
     rev = "v${version}";
-    sha256 = "sha256-Bhi1d01VqeLmxsiyIG8HXD6AgabgsKgZoKYgnGNpk/8=";
+    sha256 = "sha256-6QfUy1Y7qFOdBFmDFQyRr+GJZSdH+pbU3dEcAjsV1JM=";
   };
 
-  cargoHash = "sha256-A/5DS7b7Dgj+GlCPu6fx0t14BfMm4XjkpcDjSpeDSnE=";
+  cargoHash = "sha256-N+mVfgbL22fmynmz4/xFNxQh7l455cH2jyuczc4XsM4=";
 
   meta = with lib; {
     description = "A CLI tool to manage todo lists in todo.txt format";
diff --git a/pkgs/applications/misc/yubioath-flutter/default.nix b/pkgs/applications/misc/yubioath-flutter/default.nix
index dde9f3b6986..4012b40ff60 100644
--- a/pkgs/applications/misc/yubioath-flutter/default.nix
+++ b/pkgs/applications/misc/yubioath-flutter/default.nix
@@ -2,19 +2,13 @@
 , flutter
 , python3
 , fetchFromGitHub
-, stdenv
 , pcre2
 , gnome
 , makeWrapper
 , removeReferencesTo
 }:
-let
-  vendorHashes = {
-    x86_64-linux = "sha256-Upe0cEDG02RJD50Ht9VNMwkelsJHX8zOuJZssAhMuMY=";
-    aarch64-linux = "sha256-lKER4+gcyFqnCvgBl/qdVBCbUpocWUnXGLXsX82MSy4=";
-  };
-in
-flutter.mkFlutterApp rec {
+
+flutter.buildFlutterApplication rec {
   pname = "yubioath-flutter";
   version = "6.1.0";
 
@@ -27,7 +21,8 @@ flutter.mkFlutterApp rec {
 
   passthru.helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };
 
-  vendorHash = vendorHashes.${stdenv.system};
+  depsListFile = ./deps.json;
+  vendorHash = "sha256-WfZiB7MO4wHUg81xm67BMu4zQdC9CfhN5BQol+AI2S8=";
 
   postPatch = ''
     substituteInPlace linux/CMakeLists.txt \
@@ -89,6 +84,6 @@ flutter.mkFlutterApp rec {
     homepage = "https://github.com/Yubico/yubioath-flutter";
     license = licenses.asl20;
     maintainers = with maintainers; [ lukegb ];
-    platforms = builtins.attrNames vendorHashes;
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 }
diff --git a/pkgs/applications/misc/yubioath-flutter/deps.json b/pkgs/applications/misc/yubioath-flutter/deps.json
new file mode 100644
index 00000000000..1ce525f799b
--- /dev/null
+++ b/pkgs/applications/misc/yubioath-flutter/deps.json
@@ -0,0 +1,1319 @@
+[
+  {
+    "name": "yubico_authenticator",
+    "version": "6.1.0+60100",
+    "kind": "root",
+    "source": "root",
+    "dependencies": [
+      "flutter",
+      "flutter_localizations",
+      "intl",
+      "async",
+      "logging",
+      "collection",
+      "shared_preferences",
+      "flutter_riverpod",
+      "json_annotation",
+      "freezed_annotation",
+      "window_manager",
+      "qrscanner_zxing",
+      "desktop_drop",
+      "url_launcher",
+      "integration_test",
+      "flutter_test",
+      "flutter_lints",
+      "build_runner",
+      "freezed",
+      "json_serializable"
+    ]
+  },
+  {
+    "name": "json_serializable",
+    "version": "6.5.4",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "build",
+      "build_config",
+      "collection",
+      "json_annotation",
+      "meta",
+      "path",
+      "pub_semver",
+      "pubspec_parse",
+      "source_gen",
+      "source_helper"
+    ]
+  },
+  {
+    "name": "source_helper",
+    "version": "1.3.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "collection",
+      "source_gen"
+    ]
+  },
+  {
+    "name": "source_gen",
+    "version": "1.2.6",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "build",
+      "dart_style",
+      "glob",
+      "meta",
+      "path",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "yaml",
+    "version": "3.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "string_scanner",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_span",
+    "version": "1.9.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "path",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "term_glyph",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "path",
+    "version": "1.8.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "collection",
+    "version": "1.17.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "meta",
+    "version": "1.8.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "glob",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "file",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "file",
+    "version": "6.1.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "async",
+    "version": "2.10.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "dart_style",
+    "version": "2.2.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "args",
+      "path",
+      "pub_semver",
+      "source_span"
+    ]
+  },
+  {
+    "name": "pub_semver",
+    "version": "2.1.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "args",
+    "version": "2.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "analyzer",
+    "version": "5.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "_fe_analyzer_shared",
+      "collection",
+      "convert",
+      "crypto",
+      "glob",
+      "meta",
+      "package_config",
+      "path",
+      "pub_semver",
+      "source_span",
+      "watcher",
+      "yaml"
+    ]
+  },
+  {
+    "name": "watcher",
+    "version": "1.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "package_config",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "crypto",
+    "version": "3.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "typed_data",
+    "version": "1.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "convert",
+    "version": "3.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "_fe_analyzer_shared",
+    "version": "50.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "build",
+    "version": "2.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "convert",
+      "crypto",
+      "glob",
+      "logging",
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "logging",
+    "version": "1.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "pubspec_parse",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "checked_yaml",
+      "collection",
+      "json_annotation",
+      "pub_semver",
+      "yaml"
+    ]
+  },
+  {
+    "name": "json_annotation",
+    "version": "4.7.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "checked_yaml",
+    "version": "2.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "json_annotation",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "build_config",
+    "version": "1.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "checked_yaml",
+      "json_annotation",
+      "path",
+      "pubspec_parse",
+      "yaml"
+    ]
+  },
+  {
+    "name": "freezed",
+    "version": "2.3.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "build",
+      "build_config",
+      "collection",
+      "meta",
+      "source_gen",
+      "freezed_annotation",
+      "json_annotation"
+    ]
+  },
+  {
+    "name": "freezed_annotation",
+    "version": "2.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "json_annotation",
+      "meta"
+    ]
+  },
+  {
+    "name": "build_runner",
+    "version": "2.3.3",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "async",
+      "analyzer",
+      "build",
+      "build_config",
+      "build_daemon",
+      "build_resolvers",
+      "build_runner_core",
+      "code_builder",
+      "collection",
+      "crypto",
+      "dart_style",
+      "frontend_server_client",
+      "glob",
+      "graphs",
+      "http_multi_server",
+      "io",
+      "js",
+      "logging",
+      "meta",
+      "mime",
+      "package_config",
+      "path",
+      "pool",
+      "pub_semver",
+      "pubspec_parse",
+      "shelf",
+      "shelf_web_socket",
+      "stack_trace",
+      "stream_transform",
+      "timing",
+      "watcher",
+      "web_socket_channel",
+      "yaml"
+    ]
+  },
+  {
+    "name": "web_socket_channel",
+    "version": "2.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "crypto",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "stream_channel",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "timing",
+    "version": "1.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "json_annotation"
+    ]
+  },
+  {
+    "name": "stream_transform",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "stack_trace",
+    "version": "1.11.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "shelf_web_socket",
+    "version": "1.0.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "shelf",
+      "stream_channel",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "shelf",
+    "version": "1.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "http_parser",
+      "path",
+      "stack_trace",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "http_parser",
+    "version": "4.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner",
+      "typed_data"
+    ]
+  },
+  {
+    "name": "pool",
+    "version": "1.5.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "mime",
+    "version": "1.0.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "js",
+    "version": "0.6.5",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "io",
+    "version": "1.0.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "http_multi_server",
+    "version": "3.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "graphs",
+    "version": "2.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "frontend_server_client",
+    "version": "3.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "code_builder",
+    "version": "4.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "built_value",
+      "collection",
+      "matcher",
+      "meta"
+    ]
+  },
+  {
+    "name": "matcher",
+    "version": "0.12.13",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "built_value",
+    "version": "8.4.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "collection",
+      "fixnum",
+      "meta"
+    ]
+  },
+  {
+    "name": "fixnum",
+    "version": "1.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "built_collection",
+    "version": "5.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "build_runner_core",
+    "version": "7.2.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "build",
+      "build_config",
+      "build_resolvers",
+      "collection",
+      "convert",
+      "crypto",
+      "glob",
+      "graphs",
+      "json_annotation",
+      "logging",
+      "meta",
+      "path",
+      "package_config",
+      "pool",
+      "timing",
+      "watcher",
+      "yaml"
+    ]
+  },
+  {
+    "name": "build_resolvers",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "build",
+      "crypto",
+      "graphs",
+      "logging",
+      "path",
+      "package_config",
+      "pool",
+      "pub_semver",
+      "stream_transform",
+      "yaml"
+    ]
+  },
+  {
+    "name": "build_daemon",
+    "version": "3.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "built_value",
+      "http_multi_server",
+      "logging",
+      "path",
+      "pool",
+      "shelf",
+      "shelf_web_socket",
+      "stream_transform",
+      "watcher",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "flutter_lints",
+    "version": "2.0.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "lints"
+    ]
+  },
+  {
+    "name": "lints",
+    "version": "2.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_test",
+    "version": "0.0.0",
+    "kind": "dev",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "test_api",
+      "path",
+      "fake_async",
+      "clock",
+      "stack_trace",
+      "vector_math",
+      "async",
+      "boolean_selector",
+      "characters",
+      "collection",
+      "js",
+      "matcher",
+      "material_color_utilities",
+      "meta",
+      "source_span",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "material_color_utilities",
+    "version": "0.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "characters",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "boolean_selector",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "vector_math",
+    "version": "2.1.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "clock",
+    "version": "1.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "fake_async",
+    "version": "1.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "collection"
+    ]
+  },
+  {
+    "name": "test_api",
+    "version": "0.4.16",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "boolean_selector",
+      "collection",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph",
+      "matcher"
+    ]
+  },
+  {
+    "name": "flutter",
+    "version": "0.0.0",
+    "kind": "direct",
+    "source": "sdk",
+    "dependencies": [
+      "characters",
+      "collection",
+      "js",
+      "material_color_utilities",
+      "meta",
+      "vector_math",
+      "sky_engine"
+    ]
+  },
+  {
+    "name": "sky_engine",
+    "version": "0.0.99",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": []
+  },
+  {
+    "name": "integration_test",
+    "version": "0.0.0",
+    "kind": "dev",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "flutter_driver",
+      "flutter_test",
+      "path",
+      "vm_service",
+      "archive",
+      "async",
+      "boolean_selector",
+      "characters",
+      "clock",
+      "collection",
+      "crypto",
+      "fake_async",
+      "file",
+      "js",
+      "matcher",
+      "material_color_utilities",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "sync_http",
+      "term_glyph",
+      "test_api",
+      "typed_data",
+      "vector_math",
+      "webdriver"
+    ]
+  },
+  {
+    "name": "webdriver",
+    "version": "3.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "archive",
+      "matcher",
+      "path",
+      "stack_trace",
+      "sync_http"
+    ]
+  },
+  {
+    "name": "sync_http",
+    "version": "0.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "archive",
+    "version": "3.3.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "crypto",
+      "path"
+    ]
+  },
+  {
+    "name": "vm_service",
+    "version": "9.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_driver",
+    "version": "0.0.0",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": [
+      "file",
+      "flutter",
+      "flutter_test",
+      "fuchsia_remote_debug_protocol",
+      "path",
+      "meta",
+      "vm_service",
+      "webdriver",
+      "archive",
+      "async",
+      "boolean_selector",
+      "characters",
+      "clock",
+      "collection",
+      "crypto",
+      "js",
+      "matcher",
+      "material_color_utilities",
+      "platform",
+      "process",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "sync_http",
+      "term_glyph",
+      "test_api",
+      "typed_data",
+      "vector_math"
+    ]
+  },
+  {
+    "name": "process",
+    "version": "4.2.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "file",
+      "path",
+      "platform"
+    ]
+  },
+  {
+    "name": "platform",
+    "version": "3.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "fuchsia_remote_debug_protocol",
+    "version": "0.0.0",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": [
+      "process",
+      "vm_service",
+      "file",
+      "meta",
+      "path",
+      "platform"
+    ]
+  },
+  {
+    "name": "url_launcher",
+    "version": "6.1.7",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "url_launcher_android",
+      "url_launcher_ios",
+      "url_launcher_linux",
+      "url_launcher_macos",
+      "url_launcher_platform_interface",
+      "url_launcher_web",
+      "url_launcher_windows"
+    ]
+  },
+  {
+    "name": "url_launcher_windows",
+    "version": "3.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "url_launcher_platform_interface"
+    ]
+  },
+  {
+    "name": "url_launcher_platform_interface",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "plugin_platform_interface"
+    ]
+  },
+  {
+    "name": "plugin_platform_interface",
+    "version": "2.1.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "url_launcher_web",
+    "version": "2.0.13",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_web_plugins",
+      "url_launcher_platform_interface"
+    ]
+  },
+  {
+    "name": "flutter_web_plugins",
+    "version": "0.0.0",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "js",
+      "characters",
+      "collection",
+      "material_color_utilities",
+      "meta",
+      "vector_math"
+    ]
+  },
+  {
+    "name": "url_launcher_macos",
+    "version": "3.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "url_launcher_platform_interface"
+    ]
+  },
+  {
+    "name": "url_launcher_linux",
+    "version": "3.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "url_launcher_platform_interface"
+    ]
+  },
+  {
+    "name": "url_launcher_ios",
+    "version": "6.0.17",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "url_launcher_platform_interface"
+    ]
+  },
+  {
+    "name": "url_launcher_android",
+    "version": "6.0.22",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "url_launcher_platform_interface"
+    ]
+  },
+  {
+    "name": "desktop_drop",
+    "version": "0.4.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_web_plugins",
+      "cross_file"
+    ]
+  },
+  {
+    "name": "cross_file",
+    "version": "0.3.3+2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "js",
+      "meta"
+    ]
+  },
+  {
+    "name": "qrscanner_zxing",
+    "version": "1.0.0",
+    "kind": "direct",
+    "source": "path",
+    "dependencies": [
+      "flutter",
+      "plugin_platform_interface"
+    ]
+  },
+  {
+    "name": "window_manager",
+    "version": "0.3.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "path",
+      "screen_retriever"
+    ]
+  },
+  {
+    "name": "screen_retriever",
+    "version": "0.1.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "flutter_riverpod",
+    "version": "2.1.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "flutter",
+      "meta",
+      "riverpod",
+      "state_notifier"
+    ]
+  },
+  {
+    "name": "state_notifier",
+    "version": "0.7.2+1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "riverpod",
+    "version": "2.1.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta",
+      "stack_trace",
+      "state_notifier"
+    ]
+  },
+  {
+    "name": "shared_preferences",
+    "version": "2.0.16",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "shared_preferences_android",
+      "shared_preferences_foundation",
+      "shared_preferences_linux",
+      "shared_preferences_platform_interface",
+      "shared_preferences_web",
+      "shared_preferences_windows"
+    ]
+  },
+  {
+    "name": "shared_preferences_windows",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "file",
+      "flutter",
+      "path",
+      "path_provider_platform_interface",
+      "path_provider_windows",
+      "shared_preferences_platform_interface"
+    ]
+  },
+  {
+    "name": "shared_preferences_platform_interface",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "plugin_platform_interface"
+    ]
+  },
+  {
+    "name": "path_provider_windows",
+    "version": "2.1.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "ffi",
+      "flutter",
+      "path",
+      "path_provider_platform_interface",
+      "win32"
+    ]
+  },
+  {
+    "name": "win32",
+    "version": "3.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "ffi"
+    ]
+  },
+  {
+    "name": "ffi",
+    "version": "2.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "path_provider_platform_interface",
+    "version": "2.0.5",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "platform",
+      "plugin_platform_interface"
+    ]
+  },
+  {
+    "name": "shared_preferences_web",
+    "version": "2.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_web_plugins",
+      "shared_preferences_platform_interface"
+    ]
+  },
+  {
+    "name": "shared_preferences_linux",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "file",
+      "flutter",
+      "path",
+      "path_provider_linux",
+      "path_provider_platform_interface",
+      "shared_preferences_platform_interface"
+    ]
+  },
+  {
+    "name": "path_provider_linux",
+    "version": "2.1.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "ffi",
+      "flutter",
+      "path",
+      "path_provider_platform_interface",
+      "xdg_directories"
+    ]
+  },
+  {
+    "name": "xdg_directories",
+    "version": "0.2.0+2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path",
+      "process"
+    ]
+  },
+  {
+    "name": "shared_preferences_foundation",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "shared_preferences_platform_interface"
+    ]
+  },
+  {
+    "name": "shared_preferences_android",
+    "version": "2.0.14",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "shared_preferences_platform_interface"
+    ]
+  },
+  {
+    "name": "intl",
+    "version": "0.17.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "path"
+    ]
+  },
+  {
+    "name": "flutter_localizations",
+    "version": "0.0.0",
+    "kind": "direct",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "intl",
+      "characters",
+      "clock",
+      "collection",
+      "js",
+      "material_color_utilities",
+      "meta",
+      "path",
+      "vector_math"
+    ]
+  }
+]
diff --git a/pkgs/applications/networking/cluster/kubeshark/default.nix b/pkgs/applications/networking/cluster/kubeshark/default.nix
index 8f1b9533214..22a4bde4c34 100644
--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubeshark";
-  version = "39.5";
+  version = "40.0";
 
   src = fetchFromGitHub {
     owner = "kubeshark";
     repo = "kubeshark";
     rev = version;
-    sha256 = "sha256-1SmIL4kA65VlsHw7YUTxklUtXTwMkb12SCpm3Ja24KA=";
+    sha256 = "sha256-Tmk9xbAqEsJ8nffRX6qw3RKKoBbSO2gmVT5Ff4Cn9DA=";
   };
 
-  vendorHash = "sha256-cMX9OYErnnnkvmXgau5xLBSv+wo0VTqgo/rYCBmXYZ4=";
+  vendorHash = "sha256-ckIjmrXkn1AVBQRwM6+wdRwwYHytxKm3rKEe+csORdU=";
 
   ldflags = let t = "github.com/kubeshark/kubeshark"; in [
    "-s" "-w"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index dfbeb9d95d2..d0d25383099 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -318,13 +318,13 @@
     "vendorHash": null
   },
   "dns": {
-    "hash": "sha256-Bzj1rLTzWJuqKEq5mz0UAbYMWMp4JoRhedfC2lORocE=",
+    "hash": "sha256-feMN0Fpq8ct3l0u1Y8Zjgee4iC+e90CwAZmk5VQj2So=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/dns",
     "owner": "hashicorp",
     "repo": "terraform-provider-dns",
-    "rev": "v3.3.1",
+    "rev": "v3.3.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wx8BXlobu86Nk9D8o5loKhbO14ANI+shFQ2i7jswKgE="
+    "vendorHash": "sha256-SvyeMKuAJ4vu++7Fx0hutx3vQvgf1sh1PFSLPRqJPjw="
   },
   "dnsimple": {
     "hash": "sha256-I5TUhq8OZqcLQs/jr8LB22Uc9s5M/WH9LRzV8EsgRnc=",
@@ -363,11 +363,11 @@
     "vendorHash": "sha256-rJev48aS0nd8DRWmUN4i0LgDYvfjdfoO67N6AiWeg+k="
   },
   "exoscale": {
-    "hash": "sha256-XbuVvVOv8k7T/7smr73+lvhFMxKtJkaLN3WgvTWIkrA=",
+    "hash": "sha256-u/2ePkENpx8Q7WcmtNxXR4GIsr2TnIHyOA8CnzTFTnk=",
     "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
     "owner": "exoscale",
     "repo": "terraform-provider-exoscale",
-    "rev": "v0.46.0",
+    "rev": "v0.47.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -437,22 +437,22 @@
     "vendorHash": "sha256-SLFpH7isx4OM2X9bzWYYD4VlejlgckBovOxthg47OOQ="
   },
   "google": {
-    "hash": "sha256-rF68NnqyEY4BWl+oLOxfTaQw5zEGs6Ue/L9DwzsJ46M=",
+    "hash": "sha256-92abTfGWNFQMf8YjOxgKEncdqEdbfAt+3BU0fQaSnGk=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.62.1",
+    "rev": "v4.63.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-Xm1P6P2tMLqjV9QFX6D7koBPzg4umTH6jCQesyt0A/A="
   },
   "google-beta": {
-    "hash": "sha256-/wcNrCMaXjameyE3o09N+bPjL8r627BJy1vYy1u2iAI=",
+    "hash": "sha256-OyaMoySQ7qd8fsxMcetZCUVvxi6nWwVJusNV61DASck=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.62.1",
+    "rev": "v4.63.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-Xm1P6P2tMLqjV9QFX6D7koBPzg4umTH6jCQesyt0A/A="
   },
@@ -1089,13 +1089,13 @@
     "vendorHash": "sha256-6UxBnQiogcizff5Rv4eadOeiG5JaXQphUWlfnqELvAI="
   },
   "talos": {
-    "hash": "sha256-/Ml+Vsh50U5CoVdnls69iTPoSPpgAtOpO2hWlcmbyKw=",
+    "hash": "sha256-bYDFtng6kASmBtQN+iewVOh6HPD57GDUuusiQSVfuBs=",
     "homepage": "https://registry.terraform.io/providers/siderolabs/talos",
     "owner": "siderolabs",
     "repo": "terraform-provider-talos",
-    "rev": "v0.1.2",
+    "rev": "v0.2.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-GkmUKSnqkabwGCl22/90529BWb0oJaIJHYHlS/h3KNY="
+    "vendorHash": "sha256-GNSKSlaFBj2P+z40U+0uwPSOuQBy+9vOVFfPe8p0A24="
   },
   "tencentcloud": {
     "hash": "sha256-kIsH+kp+fnYsZatEJOH51lUdQs9cq/8FtpXHZIRzSM0=",
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index 47c47276095..653f27fcc11 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "3.31.1";
+  version = "3.31.2";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-T8fErChbQbarvE3/Zds1482m1hfD9Qa3esYvqjzNN3c=";
+    sha256 = "sha256-vKfbL2a/5rTVsG0rDs/D0t5eXDNWlbwURI2FYzGu9lY=";
   };
 
   vendorHash = "sha256-BE/UnJw5elHYmyB+quN89ZkrlMcTjaVN0T2+h8cpPS8=";
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index 0de4809ff23..ed3849ffac3 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -25,7 +25,7 @@ let
     src = fetchFromGitHub {
       owner = "deltachat";
       repo = "deltachat-core-rust";
-      rev = version;
+      rev = "v${version}";
       hash = "sha256-bvXZtgFZx94Sw9Tst620HAhi9kmG8PjtWnghdw2ZF84=";
     };
     cargoDeps = rustPlatform.importCargoLock {
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index 34d06f9fd1e..d71f653892c 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 (if stdenv.isDarwin then darwin.apple_sdk_11_0.clang14Stdenv else stdenv).mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20230421-1";
+  version = "20230424-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-ZQFoajkD7vvz74TXVT7I4D0Qjknt5YxfHYpGi3i01Ns=";
+    hash = "sha256-G3cAXpHixRVp+FOwyWS+3uuKGp5+7AGLE/1TlghAlFA=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
index 03465c8ee3e..33c943e3bc9 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@@ -73,7 +73,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.8.0";
+  version = "4.8.1";
   # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
   src = fetchFromGitHub {
@@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "1ari4kdjd99klrla0rn4cjjc54d6glf17s0q881f67vh2v5zdwf0";
+    sha256 = "0mxxfh70dffkrq76nky3pwrk10s1q4ahxx2ddb58dz8igq6pl4zi";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 14f8db6a7e8..49bf77a483c 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -49,7 +49,7 @@
 assert withQt -> qt5 != null;
 
 let
-  version = "4.0.4";
+  version = "4.0.5";
   variant = if withQt then "qt" else "cli";
 in
 stdenv.mkDerivation {
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
     repo = "wireshark";
     owner = "wireshark";
     rev = "v${version}";
-    hash = "sha256-x7McplQVdLczTov+u9eqmT1Ons22KqRsCN65pUuwYGw=";
+    hash = "sha256-9U0V2oLVyzq+3HxvOuD8Uzj1tjoMtYBws43fn5RfGhQ=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/applications/science/physics/elmerfem/default.nix b/pkgs/applications/science/physics/elmerfem/default.nix
index 9221f4bcdbd..41a0e00ae78 100644
--- a/pkgs/applications/science/physics/elmerfem/default.nix
+++ b/pkgs/applications/science/physics/elmerfem/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, cmake, git, gfortran, mpi, blas, liblapack, pkg-config, libGL, libGLU, opencascade, libsForQt5, vtk_8_withQt5}:
+{ lib, stdenv, fetchFromGitHub, cmake, git, gfortran, mpi, blas, liblapack, pkg-config, libGL, libGLU, opencascade, libsForQt5, tbb, vtkWithQt5 }:
 
 stdenv.mkDerivation rec {
   pname = "elmerfem";
-  version = "9.0";
+  version = "unstable-2023-02-03";
 
   src = fetchFromGitHub {
     owner = "elmercsc";
-    repo = "elmerfem";
-    rev = "release-${version}";
-    sha256 = "VK7jvu4s5d7k0c39XqY9dEzg/vXtX5Yr/09VcuZVQ9A=";
+    repo = pname;
+    rev = "39c8784b6e4543a6bf560b5d597e0eec1eb06343";
+    hash = "sha256-yyxgFvlS+I4PouDL6eD4ZrXuONTDejCSYKq2AwQ0Iug=";
   };
 
   hardeningDisable = [ "format" ];
@@ -29,19 +29,14 @@ stdenv.mkDerivation rec {
     libGL
     libGLU
     opencascade
-    vtk_8_withQt5
+    tbb
+    vtkWithQt5
   ];
 
   preConfigure = ''
     patchShebangs ./
   '';
 
-  patches = [
-    ./patches/0001-fix-import-of-QPainterPath.patch
-    ./patches/0002-fem-rename-loopvars-to-avoid-redefinition.patch
-    ./patches/0003-ignore-qwt_compat.patch
-  ];
-
   storepath = placeholder "out";
 
   cmakeFlags = [
@@ -58,7 +53,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    homepage = "https://elmerfem.org/";
+    homepage = "https://elmerfem.org";
     description = "A finite element software for multiphysical problems";
     platforms = platforms.unix;
     maintainers = with maintainers; [ wulfsta broke ];
diff --git a/pkgs/applications/science/physics/elmerfem/patches/0001-fix-import-of-QPainterPath.patch b/pkgs/applications/science/physics/elmerfem/patches/0001-fix-import-of-QPainterPath.patch
deleted file mode 100644
index a9e1ba442b4..00000000000
--- a/pkgs/applications/science/physics/elmerfem/patches/0001-fix-import-of-QPainterPath.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 87885de957aa3f891fe963503c94685675c24f49 Mon Sep 17 00:00:00 2001
-From: grindhold <grindhold@gmx.net>
-Date: Wed, 27 Apr 2022 19:16:42 +0200
-Subject: [PATCH] fix import of QPainterPath
-
----
- ElmerGUI/Application/twod/renderarea.cpp | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/ElmerGUI/Application/twod/renderarea.cpp b/ElmerGUI/Application/twod/renderarea.cpp
-index 4c2515c5..65128ea9 100644
---- a/ElmerGUI/Application/twod/renderarea.cpp
-+++ b/ElmerGUI/Application/twod/renderarea.cpp
-@@ -38,6 +38,7 @@
-  *                                                                           *
-  *****************************************************************************/
- #include <QPainter>
-+#include <QPainterPath>
- #include <QMouseEvent>
- #include <QFile>
- #include <QTextStream>
--- 
-2.33.3
-
diff --git a/pkgs/applications/science/physics/elmerfem/patches/0002-fem-rename-loopvars-to-avoid-redefinition.patch b/pkgs/applications/science/physics/elmerfem/patches/0002-fem-rename-loopvars-to-avoid-redefinition.patch
deleted file mode 100644
index 6c2782b9e0b..00000000000
--- a/pkgs/applications/science/physics/elmerfem/patches/0002-fem-rename-loopvars-to-avoid-redefinition.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 06634e5fd46a27dca11b87d4a38e9ead561de3d5 Mon Sep 17 00:00:00 2001
-From: grindhold <grindhold@gmx.net>
-Date: Thu, 28 Apr 2022 15:47:07 +0200
-Subject: [PATCH] fem: rename loopvars to avoid redefinition
-
----
- fem/src/modules/DCRComplexSolve.F90 | 28 ++++++++++++++--------------
- 1 file changed, 14 insertions(+), 14 deletions(-)
-
-diff --git a/fem/src/modules/DCRComplexSolve.F90 b/fem/src/modules/DCRComplexSolve.F90
-index 469214ee..268591fd 100644
---- a/fem/src/modules/DCRComplexSolve.F90
-+++ b/fem/src/modules/DCRComplexSolve.F90
-@@ -502,14 +502,14 @@ CONTAINS
- 
-       IF ( SIZE(Hwrk,1) == 1 ) THEN
- 
--         DO i=1,MIN(3,SIZE(Hwrk,2))
--            Tensor( i,1:n ) = Hwrk( 1,1,1:n )
-+         DO k=1,MIN(3,SIZE(Hwrk,2))
-+            Tensor( k,1:n ) = Hwrk( 1,1,1:n )
-          END DO
- 
-       ELSE
- 
--        DO i=1,MIN(3,SIZE(Hwrk,1))
--           Tensor( i,1:n ) = Hwrk( i,1,1:n )
-+        DO k=1,MIN(3,SIZE(Hwrk,1))
-+           Tensor( k,1:n ) = Hwrk( k,1,1:n )
-         END DO
- 
-       END IF
-@@ -1391,21 +1391,21 @@ contains
- 
-       IF ( SIZE(Hwrk,1) == 1 ) THEN
- 
--         DO i=1,MIN(3,SIZE(Hwrk,2))
--            Tensor( i,i,1:n ) = Hwrk( 1,1,1:n )
-+         DO k=1,MIN(3,SIZE(Hwrk,2))
-+            Tensor( k,k,1:n ) = Hwrk( 1,1,1:n )
-          END DO
- 
-       ELSE IF ( SIZE(Hwrk,2) == 1 ) THEN
- 
--         DO i=1,MIN(3,SIZE(Hwrk,1))
--            Tensor(i,i,1:n) = Hwrk(i,1,1:n)
-+         DO k=1,MIN(3,SIZE(Hwrk,1))
-+            Tensor(k,k,1:n) = Hwrk(k,1,1:n)
-          END DO
- 
-       ELSE
- 
--        DO i=1,MIN(3,SIZE(Hwrk,1))
-+        DO k=1,MIN(3,SIZE(Hwrk,1))
-            DO j=1,MIN(3,SIZE(Hwrk,2))
--              Tensor( i,j,1:n ) = Hwrk(i,j,1:n)
-+              Tensor( k,j,1:n ) = Hwrk(k,j,1:n)
-            END DO
-         END DO
- 
-@@ -1443,14 +1443,14 @@ contains
- 
-       IF ( SIZE(Hwrk,1) == 1 ) THEN
- 
--         DO i=1,MIN(3,SIZE(Hwrk,2))
--            Tensor( i,1:n ) = Hwrk( 1,1,1:n )
-+         DO k=1,MIN(3,SIZE(Hwrk,2))
-+            Tensor( k,1:n ) = Hwrk( 1,1,1:n )
-          END DO
- 
-       ELSE
- 
--        DO i=1,MIN(3,SIZE(Hwrk,1))
--           Tensor( i,1:n ) = Hwrk( i,1,1:n )
-+        DO k=1,MIN(3,SIZE(Hwrk,1))
-+           Tensor( k,1:n ) = Hwrk( k,1,1:n )
-         END DO
- 
-       END IF
--- 
-2.33.3
-
diff --git a/pkgs/applications/science/physics/elmerfem/patches/0003-ignore-qwt_compat.patch b/pkgs/applications/science/physics/elmerfem/patches/0003-ignore-qwt_compat.patch
deleted file mode 100644
index 26954008d5d..00000000000
--- a/pkgs/applications/science/physics/elmerfem/patches/0003-ignore-qwt_compat.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 26601fec36a4978e805aad40e6d0cbf268c653d2 Mon Sep 17 00:00:00 2001
-From: grindhold <grindhold@gmx.net>
-Date: Thu, 28 Apr 2022 17:13:06 +0200
-Subject: [PATCH] ignore qwt_compat
-
----
- ElmerGUI/Application/src/convergenceview.h | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/ElmerGUI/Application/src/convergenceview.h b/ElmerGUI/Application/src/convergenceview.h
-index 377b644b..64250149 100755
---- a/ElmerGUI/Application/src/convergenceview.h
-+++ b/ElmerGUI/Application/src/convergenceview.h
-@@ -52,7 +52,7 @@
- #include <qwt_plot_grid.h>

- #include <qwt_legend.h>

- /*#include <qwt_data.h> <-- deprecated in Qwt6, using qwt_compat.h instead*/

--#include <qwt_compat.h>

-+/*#include <qwt_compat.h>*/

- #include <qwt_text.h>

- #include <qwt_scale_engine.h>

- 

-@@ -76,8 +76,8 @@ public:
-   

- private:

-   int d_count;

--  QwtArray<double> d_x;

--  QwtArray<double> d_y;

-+  QVector<double> d_x;

-+  QVector<double> d_y;

- };

- 

- class Curve

--- 
-2.33.3
-
diff --git a/pkgs/build-support/dart/fetch-dart-deps/default.nix b/pkgs/build-support/dart/fetch-dart-deps/default.nix
new file mode 100644
index 00000000000..9deb99648c0
--- /dev/null
+++ b/pkgs/build-support/dart/fetch-dart-deps/default.nix
@@ -0,0 +1,186 @@
+{ stdenvNoCC
+, lib
+, makeSetupHook
+, dart
+, git
+, cacert
+, jq
+}:
+
+{
+  # The output hash of the dependencies for this project.
+  vendorHash ? ""
+  # Commands to run once before using Dart or pub.
+, sdkSetupScript ? ""
+  # Commands to run to populate the pub cache.
+, pubGetScript ? "dart pub get"
+  # A path to a pubspec.lock file to use instead of the one in the source directory.
+, pubspecLockFile ? null
+  # Arguments used in the derivation that builds the Dart package.
+  # Passing these is recommended to ensure that the same steps are made to prepare the sources in both this
+  # derivation and the one that builds the Dart package.
+, buildDrvArgs ? { }
+, ...
+}@args:
+
+# This is a fixed-output derivation and setup hook that can be used to fetch dependencies for Dart projects.
+# It is designed to be placed in the nativeBuildInputs of a derivation that builds a Dart package.
+# Providing the buildDrvArgs argument is highly recommended.
+let
+  buildDrvInheritArgNames = [
+    "name"
+    "pname"
+    "version"
+    "src"
+    "sourceRoot"
+    "setSourceRoot"
+    "preUnpack"
+    "unpackPhase"
+    "unpackCmd"
+    "postUnpack"
+    "prePatch"
+    "patchPhase"
+    "patches"
+    "patchFlags"
+    "postPatch"
+  ];
+
+  buildDrvInheritArgs = builtins.foldl'
+    (attrs: arg:
+      if buildDrvArgs ? ${arg}
+      then attrs // { ${arg} = buildDrvArgs.${arg}; }
+      else attrs)
+    { }
+    buildDrvInheritArgNames;
+
+  drvArgs = buildDrvInheritArgs // (removeAttrs args [ "buildDrvArgs" ]);
+  name = (if drvArgs ? name then drvArgs.name else "${drvArgs.pname}-${drvArgs.version}");
+
+  deps =
+    stdenvNoCC.mkDerivation ({
+      name = "${name}-dart-deps";
+
+      nativeBuildInputs = [
+        dart
+        git
+      ];
+
+      # avoid pub phase
+      dontBuild = true;
+
+      configurePhase = ''
+        # Configure the package cache
+        export PUB_CACHE="$out/cache/.pub-cache"
+        mkdir -p "$PUB_CACHE"
+
+        ${sdkSetupScript}
+      '';
+
+      installPhase = ''
+        _pub_get() {
+          ${pubGetScript}
+        }
+
+        # so we can use lock, diff yaml
+        mkdir -p "$out/pubspec"
+        cp "pubspec.yaml" "$out/pubspec"
+        ${lib.optionalString (pubspecLockFile != null) "install -m644 ${pubspecLockFile} pubspec.lock"}
+        if ! cp "pubspec.lock" "$out/pubspec"; then
+          echo 1>&2 -e '\nThe pubspec.lock file is missing. This is a requirement for reproducible builds.' \
+                       '\nThe following steps should be taken to fix this issue:' \
+                       '\n  1. If you are building an application, contact the developer(s).' \
+                       '\n     The pubspec.lock file should be provided with the source code.' \
+                       '\n     https://dart.dev/guides/libraries/private-files#pubspeclock' \
+                       '\n  2. An attempt to generate and print a compressed pubspec.lock file will be made now.' \
+                       '\n     It is compressed with gzip and base64 encoded.' \
+                       '\n     Paste it to a file and extract it with `base64 -d pubspec.lock.in | gzip -d > pubspec.lock`.' \
+                       '\n     Provide the path to the pubspec.lock file in the pubspecLockFile argument.' \
+                       '\n     This must be updated whenever the application is updated.' \
+                       '\n'
+          _pub_get
+          echo ""
+          gzip --to-stdout --best pubspec.lock | base64 1>&2
+          echo 1>&2 -e '\nA gzipped pubspec.lock file has been printed. Please see the informational message above.'
+          exit 1
+        fi
+
+        _pub_get
+
+        # nuke nondeterminism
+
+        # Remove Git directories in the Git package cache - these are rarely used by Pub,
+        # which instead maintains a corresponsing mirror and clones cached packages through it.
+        #
+        # An exception is made to keep .git/pub-packages files, which are important.
+        # https://github.com/dart-lang/pub/blob/c890afa1d65b340fa59308172029680c2f8b0fc6/lib/src/source/git.dart#L621
+        if [ -d "$PUB_CACHE"/git ]; then
+          find "$PUB_CACHE"/git -maxdepth 4 -path "*/.git/*" ! -name "pub-packages" -prune -exec rm -rf {} +
+        fi
+
+        # Remove continuously updated package metadata caches
+        rm -rf "$PUB_CACHE"/hosted/*/.cache # Not pinned by pubspec.lock
+        rm -rf "$PUB_CACHE"/git/cache/*/* # Recreate this on the other end. See: https://github.com/dart-lang/pub/blob/c890afa1d65b340fa59308172029680c2f8b0fc6/lib/src/source/git.dart#L531
+
+        # Miscelaneous transient package cache files
+        rm -f "$PUB_CACHE"/README.md # May change with different Dart versions
+        rm -rf "$PUB_CACHE"/_temp # https://github.com/dart-lang/pub/blob/c890afa1d65b340fa59308172029680c2f8b0fc6/lib/src/system_cache.dart#L131
+        rm -rf "$PUB_CACHE"/log # https://github.com/dart-lang/pub/blob/c890afa1d65b340fa59308172029680c2f8b0fc6/lib/src/command.dart#L348
+      '';
+
+      GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+      SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+      impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+        "GIT_PROXY_COMMAND"
+        "NIX_GIT_SSL_CAINFO"
+        "SOCKS_SERVER"
+      ];
+
+      # Patching shebangs introduces input references to this fixed-output derivation.
+      # This triggers a bug in Nix, causing the output path to change unexpectedly.
+      # https://github.com/NixOS/nix/issues/6660
+      dontPatchShebangs = true;
+
+      # The following operations are not generally useful for this derivation.
+      # If a package does contain some native components used at build time,
+      # please file an issue.
+      dontStrip = true;
+      dontMoveSbin = true;
+      dontPatchELF = true;
+
+      outputHashAlgo = "sha256";
+      outputHashMode = "recursive";
+      outputHash = if vendorHash != "" then vendorHash else lib.fakeSha256;
+    } // (removeAttrs drvArgs [ "name" "pname" ]));
+
+  depsListDrv = stdenvNoCC.mkDerivation ({
+    name = "${name}-dart-deps-list.json";
+    nativeBuildInputs = [ hook dart jq ];
+
+    configurePhase = ''
+      runHook preConfigure
+      dart pub get --offline
+      runHook postConfigure
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+      dart pub deps --json | jq .packages > $out
+      runHook postBuild
+    '';
+  } // buildDrvInheritArgs);
+
+  hook = (makeSetupHook {
+    # The setup hook should not be part of the fixed-output derivation.
+    # Updates to the hook script should not change vendor hashes, and it won't
+    # work at all anyway due to https://github.com/NixOS/nix/issues/6660.
+    name = "${name}-dart-deps-setup-hook";
+    substitutions = { inherit deps; };
+    propagatedBuildInputs = [ dart git ];
+    passthru = {
+      files = deps.outPath;
+      depsListFile = depsListDrv.outPath;
+    };
+  }) ./setup-hook.sh;
+in
+hook
diff --git a/pkgs/build-support/dart/fetch-dart-deps/setup-hook.sh b/pkgs/build-support/dart/fetch-dart-deps/setup-hook.sh
new file mode 100644
index 00000000000..37ef74aa62d
--- /dev/null
+++ b/pkgs/build-support/dart/fetch-dart-deps/setup-hook.sh
@@ -0,0 +1,41 @@
+preConfigureHooks+=(_setupPubCache)
+
+_setupPubCache() {
+    deps="@deps@"
+
+    # Configure the package cache.
+    export PUB_CACHE="$(mktemp -d)"
+    mkdir -p "$PUB_CACHE"
+
+    if [ -d "$deps/cache/.pub-cache/git" ]; then
+        # Link the Git package cache.
+        mkdir -p "$PUB_CACHE/git"
+        ln -s "$deps/cache/.pub-cache/git"/* "$PUB_CACHE/git"
+
+        # Recreate the internal Git cache subdirectory.
+        # See: https://github.com/dart-lang/pub/blob/c890afa1d65b340fa59308172029680c2f8b0fc6/lib/src/source/git.dart#L339)
+        # Blank repositories are created instead of attempting to match the cache mirrors to checkouts.
+        # This is not an issue, as pub does not need the mirrors in the Flutter build process.
+        rm "$PUB_CACHE/git/cache" && mkdir "$PUB_CACHE/git/cache"
+        for mirror in $(ls -A "$deps/cache/.pub-cache/git/cache"); do
+            git --git-dir="$PUB_CACHE/git/cache/$mirror" init --bare --quiet
+        done
+    fi
+
+    # Link the remaining package cache directories.
+    # At this point, any subdirectories that must be writable must have been taken care of.
+    for file in $(comm -23 <(ls -A "$deps/cache/.pub-cache") <(ls -A "$PUB_CACHE")); do
+        ln -s "$deps/cache/.pub-cache/$file" "$PUB_CACHE/$file"
+    done
+
+    # ensure we're using a lockfile for the right package version
+    if [ ! -e pubspec.lock ]; then
+        cp -v "$deps/pubspec/pubspec.lock" .
+        # Sometimes the pubspec.lock will get opened in write mode, even when offline.
+        chmod u+w pubspec.lock
+    elif ! { diff -u pubspec.lock "$deps/pubspec/pubspec.lock" && diff -u pubspec.yaml "$deps/pubspec/pubspec.yaml"; }; then
+        echo 1>&2 -e 'The pubspec.lock or pubspec.yaml of the project derivation differs from the one in the dependency derivation.' \
+                   '\nYou most likely forgot to update the vendorHash while updating the sources.'
+        exit 1
+    fi
+}
diff --git a/pkgs/build-support/flutter/default.nix b/pkgs/build-support/flutter/default.nix
index a4b4942ef59..abb1c8ac359 100644
--- a/pkgs/build-support/flutter/default.nix
+++ b/pkgs/build-support/flutter/default.nix
@@ -1,284 +1,159 @@
-{ flutter
-, lib
-, llvmPackages_13
-, cmake
-, ninja
-, pkg-config
-, wrapGAppsHook
-, autoPatchelfHook
-, util-linux
-, libselinux
-, libsepol
-, libthai
-, libdatrie
-, libxkbcommon
-, at-spi2-core
-, libsecret
-, jsoncpp
-, xorg
-, dbus
-, gtk3
-, glib
-, pcre
-, libepoxy
+{ lib
+, callPackage
 , stdenvNoCC
+, makeWrapper
+, llvmPackages_13
 , cacert
-, git
-, dart
-, nukeReferences
-, bash
-, curl
-, unzip
-, which
-, xz
+, flutter
+, jq
 }:
 
 # absolutely no mac support for now
 
-args:
+{ pubGetScript ? "flutter pub get"
+, flutterBuildFlags ? [ ]
+, runtimeDependencies ? [ ]
+, customPackageOverrides ? { }
+, autoDepsList ? false
+, depsListFile ? null
+, vendorHash
+, pubspecLockFile ? null
+, nativeBuildInputs ? [ ]
+, preUnpack ? ""
+, postFixup ? ""
+, ...
+}@args:
 let
-  pl = n: "##FLUTTER_${n}_PLACEHOLDER_MARKER##";
-  placeholder_deps = pl "DEPS";
-  placeholder_flutter = pl "FLUTTER";
-  fetchAttrs = [ "src" "sourceRoot" "setSourceRoot" "unpackPhase" "patches" ];
-  getAttrsOrNull = names: attrs: lib.genAttrs names (name: if attrs ? ${name} then attrs.${name} else null);
-  flutterDeps = [
-    # flutter deps
-    flutter.unwrapped
-    bash
-    curl
-    flutter.dart
-    git
-    unzip
-    which
-    xz
-  ];
-  self =
-(self: llvmPackages_13.stdenv.mkDerivation (args // {
-  deps = stdenvNoCC.mkDerivation (lib.recursiveUpdate (getAttrsOrNull fetchAttrs args) {
-    name = "${self.name}-deps-flutter-v${flutter.unwrapped.version}-${stdenvNoCC.targetPlatform.system}.tar.gz";
-
-    nativeBuildInputs = flutterDeps ++ [
-      nukeReferences
-    ];
-
-    # avoid pub phase
-    dontBuild = true;
+  flutterSetupScript = ''
+    export HOME="$NIX_BUILD_TOP"
+    flutter config --no-analytics &>/dev/null # mute first-run
+    flutter config --enable-linux-desktop >/dev/null
+  '';
 
-    installPhase = ''
-      . ${../fetchgit/deterministic-git}
+  deps = callPackage ../dart/fetch-dart-deps { dart = flutter; } {
+    sdkSetupScript = flutterSetupScript;
+    inherit pubGetScript vendorHash pubspecLockFile;
+    buildDrvArgs = args;
+  };
+
+  baseDerivation = llvmPackages_13.stdenv.mkDerivation (finalAttrs: args // {
+    inherit flutterBuildFlags runtimeDependencies;
+
+    outputs = [ "out" "debug" ];
+
+    nativeBuildInputs = [
+      makeWrapper
+      deps
+      flutter
+      jq
+    ] ++ nativeBuildInputs;
+
+    preUnpack = ''
+      ${lib.optionalString (!autoDepsList) ''
+        if ! { [ '${lib.boolToString (depsListFile != null)}' = 'true' ] ${lib.optionalString (depsListFile != null) "&& cmp -s <(jq -Sc . '${depsListFile}') <(jq -Sc . '${finalAttrs.passthru.depsListFile}')"}; }; then
+          echo 1>&2 -e '\nThe dependency list file was either not given or differs from the expected result.' \
+                      '\nPlease choose one of the following solutions:' \
+                      '\n - Duplicate the following file and pass it to the depsListFile argument.' \
+                      '\n   ${finalAttrs.passthru.depsListFile}' \
+                      '\n - Set autoDepsList to true (not supported by Hydra or permitted in Nixpkgs)'.
+          exit 1
+        fi
+      ''}
+
+      ${preUnpack}
+    '';
 
-      TMP=$(mktemp -d)
+    configurePhase = ''
+      runHook preConfigure
 
-      export HOME="$TMP"
-      export PUB_CACHE=''${PUB_CACHE:-"$HOME/.pub-cache"}
-      export ANDROID_EMULATOR_USE_SYSTEM_LIBS=1
+      ${flutterSetupScript}
 
-      flutter config --no-analytics &>/dev/null # mute first-run
-      flutter config --enable-linux-desktop
-      flutter packages get
-      flutter build linux || true # so it downloads tools
-      ${lib.optionalString (args ? flutterExtraFetchCommands) args.flutterExtraFetchCommands}
+      runHook postConfigure
+    '';
 
-      RES="$TMP"
+    buildPhase = ''
+      runHook preBuild
 
-      mkdir -p "$RES/f"
+      mkdir -p build/flutter_assets/fonts
 
-      # so we can use lock, diff yaml
-      cp "pubspec.yaml" "$RES"
-      cp "pubspec.lock" "$RES"
-      [[ -e .packages ]] && mv .packages "$RES/f"
-      mv .dart_tool .flutter-plugins .flutter-plugins-dependencies "$RES/f"
+      flutter packages get --offline -v
+      flutter build linux -v --release --split-debug-info="$debug" ${builtins.concatStringsSep " " (map (flag: "\"${flag}\"") finalAttrs.flutterBuildFlags)}
 
-      # replace paths with placeholders
-      find "$RES" -type f -exec sed -i \
-        -e s,$TMP,${placeholder_deps},g \
-        -e s,${flutter.unwrapped},${placeholder_flutter},g \
-        {} +
+      runHook postBuild
+    '';
 
-      remove_line_matching() {
-        replace_line_matching "$1" "$2" ""
-      }
+    installPhase = ''
+      runHook preInstall
 
-      replace_line_matching() {
-        sed "s|.*$2.*|$3|g" -r -i "$1"
-      }
+      built=build/linux/*/release/bundle
 
-      # nuke nondeterminism
+      mkdir -p $out/bin
+      mv $built $out/app
 
-      # clientId is random
-      remove_line_matching "$RES/.flutter" clientId
+      for f in $(find $out/app -iname "*.desktop" -type f); do
+        install -D $f $out/share/applications/$(basename $f)
+      done
 
-      # deterministic git repos
-      find "$RES" -iname .git -type d | while read -r repoGit; do
-        make_deterministic_repo "$(dirname "$repoGit")"
+      for f in $(find $out/app -maxdepth 1 -type f); do
+        ln -s $f $out/bin/$(basename $f)
       done
 
-      # dart _fetchedAt, etc
-      DART_DATE=$(date --date="@$SOURCE_DATE_EPOCH" -In | sed "s|,|.|g" | sed "s|+.*||g")
-      find "$RES/.pub-cache" -iname "*.json" -exec sed -r 's|.*_fetchedAt.*|    "_fetchedAt": "'"$DART_DATE"'",|g' -i {} +
-      replace_line_matching "$RES/f/.dart_tool/package_config.json" '"generated"' '"generated": "'"$DART_DATE"'",'
-      replace_line_matching "$RES/f/.flutter-plugins-dependencies" '"date_created"' '"date_created": "'"$DART_DATE"'",'
-      [[ -e "$RES/f/.packages" ]] && remove_line_matching "$RES/f/.packages" "Generated by pub"
+      # make *.so executable
+      find $out/app -iname "*.so" -type f -exec chmod +x {} +
 
-      # nuke refs
-      find "$RES" -type f -exec nuke-refs {} +
+      # remove stuff like /build/source/packages/ubuntu_desktop_installer/linux/flutter/ephemeral
+      for f in $(find $out/app -executable -type f); do
+        if patchelf --print-rpath "$f" | grep /build; then # this ignores static libs (e,g. libapp.so) also
+          echo "strip RPath of $f"
+          newrp=$(patchelf --print-rpath $f | sed -r "s|/build.*ephemeral:||g" | sed -r "s|/build.*profile:||g")
+          patchelf --set-rpath "$newrp" "$f"
+        fi
+      done
 
-      # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
-      tar --owner=0 --group=0 --numeric-owner --format=gnu \
-          --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
-          -czf "$out" -C "$RES" .
+      runHook postInstall
     '';
 
-    GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
-    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
-      "GIT_PROXY_COMMAND" "NIX_GIT_SSL_CAINFO" "SOCKS_SERVER"
-    ];
-
-    # unnecesarry
-    dontFixup = true;
+    postFixup = ''
+      # Add runtime library dependencies to the LD_LIBRARY_PATH.
+      # For some reason, the RUNPATH of the executable is not used to load dynamic libraries in dart:ffi with DynamicLibrary.open().
+      #
+      # This could alternatively be fixed with patchelf --add-needed, but this would cause all the libraries to be opened immediately,
+      # which is not what application authors expect.
+      for f in "$out"/bin/*; do
+        wrapProgram "$f" \
+          --suffix LD_LIBRARY_PATH : '${lib.makeLibraryPath finalAttrs.runtimeDependencies}'
+      done
 
-    outputHashAlgo = if self ? vendorHash then null else "sha256";
-    # outputHashMode = "recursive";
-    outputHash = if self ? vendorHash then
-      self.vendorHash
-    else if self ? vendorSha256 then
-      self.vendorSha256
-    else
-      lib.fakeSha256;
+      ${postFixup}
+    '';
 
+    passthru = {
+      inherit (deps) depsListFile;
+    };
   });
 
-  nativeBuildInputs = flutterDeps ++ [
-    # flutter dev tools
-    cmake
-    ninja
-    pkg-config
-    wrapGAppsHook
-    # flutter likes dynamic linking
-    autoPatchelfHook
-  ] ++ lib.optionals (args ? nativeBuildInputs) args.nativeBuildInputs;
-
-  buildInputs = [
-    # cmake deps
-    gtk3
-    glib
-    pcre
-    util-linux
-    # also required by cmake, not sure if really needed or dep of all packages
-    libselinux
-    libsepol
-    libthai
-    libdatrie
-    xorg.libXdmcp
-    xorg.libXtst
-    libxkbcommon
-    dbus
-    at-spi2-core
-    libsecret
-    jsoncpp
-    # build deps
-    xorg.libX11
-    # directly required by build
-    libepoxy
-  ] ++ lib.optionals (args ? buildInputs) args.buildInputs;
-
-  # TODO: do we need this?
-  NIX_LDFLAGS = "-rpath ${lib.makeLibraryPath self.buildInputs}";
-  env.NIX_CFLAGS_COMPILE = "-I${xorg.libX11}/include";
-  LD_LIBRARY_PATH = lib.makeLibraryPath self.buildInputs;
-
-  configurePhase = ''
-    runHook preConfigure
-
-    # for some reason fluffychat build breaks without this - seems file gets overriden by some tool
-    cp pubspec.yaml pubspec-backup
-
-    # we get this from $depsFolder so disabled for now, but we might need it again once deps are fetched properly
-    # flutter config --no-analytics >/dev/null 2>/dev/null # mute first-run
-    # flutter config --enable-linux-desktop
-
-    # extract deps
-    depsFolder=$(mktemp -d)
-    tar xzf "$deps" -C "$depsFolder"
-
-    # after extracting update paths to point to real paths
-    find "$depsFolder" -type f -exec sed -i \
-      -e s,${placeholder_deps},$depsFolder,g \
-      -e s,${placeholder_flutter},${flutter.unwrapped},g \
-      {} +
-
-    # ensure we're using a lockfile for the right package version
-    if [ -e pubspec.lock ]; then
-      # FIXME: currently this is broken. in theory this should not break, but flutter has it's own way of doing things.
-      # diff -u pubspec.lock $depsFolder/pubspec.lock
-      true
+  packageOverrideRepository = (callPackage ../../development/compilers/flutter/package-overrides { }) // customPackageOverrides;
+  productPackages = builtins.filter (package: package.kind != "dev")
+    (if autoDepsList
+    then builtins.fromJSON (builtins.readFile deps.depsListFile)
     else
-      cp -v "$depsFolder/pubspec.lock" .
-    fi
-    diff -u pubspec.yaml $depsFolder/pubspec.yaml
-
-    mv -v $(find $depsFolder/f -type f) .
-
-    # prepare
-    export HOME=$depsFolder
-    export PUB_CACHE=''${PUB_CACHE:-"$HOME/.pub-cache"}
-    export ANDROID_EMULATOR_USE_SYSTEM_LIBS=1
-
-    # binaries need to be patched
-    autoPatchelf -- "$depsFolder"
-
-    runHook postConfigure
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    # for some reason fluffychat build breaks without this - seems file gets overriden by some tool
-    mv pubspec-backup pubspec.yaml
-    mkdir -p build/flutter_assets/fonts
-
-    flutter packages get --offline -v
-    flutter build linux --release -v
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    built=build/linux/*/release/bundle
-
-    mkdir -p $out/bin
-    mv $built $out/app
-
-    for f in $(find $out/app -iname "*.desktop" -type f); do
-      install -D $f $out/share/applications/$(basename $f)
-    done
-
-    for f in $(find $out/app -maxdepth 1 -type f); do
-      ln -s $f $out/bin/$(basename $f)
-    done
-
-    # this confuses autopatchelf hook otherwise
-    rm -rf "$depsFolder"
-
-    # make *.so executable
-    find $out/app -iname "*.so" -type f -exec chmod +x {} +
-
-    # remove stuff like /build/source/packages/ubuntu_desktop_installer/linux/flutter/ephemeral
-    for f in $(find $out/app -executable -type f); do
-      if patchelf --print-rpath "$f" | grep /build; then # this ignores static libs (e,g. libapp.so) also
-        echo "strip RPath of $f"
-        newrp=$(patchelf --print-rpath $f | sed -r "s|/build.*ephemeral:||g" | sed -r "s|/build.*profile:||g")
-        patchelf --set-rpath "$newrp" "$f"
-      fi
-    done
-
-    runHook postInstall
-  '';
-})) self;
+      if depsListFile == null
+      then [ ]
+      else builtins.fromJSON (builtins.readFile depsListFile));
 in
-  self
+builtins.foldl'
+  (prev: package:
+  if packageOverrideRepository ? ${package.name}
+  then
+    prev.overrideAttrs
+      (packageOverrideRepository.${package.name} {
+        inherit (package)
+          name
+          version
+          kind
+          source
+          dependencies;
+      })
+  else prev)
+  baseDerivation
+  productPackages
diff --git a/pkgs/build-support/node/build-npm-package/default.nix b/pkgs/build-support/node/build-npm-package/default.nix
index 26cc678c571..1c3fb6a74ef 100644
--- a/pkgs/build-support/node/build-npm-package/default.nix
+++ b/pkgs/build-support/node/build-npm-package/default.nix
@@ -12,6 +12,9 @@
   # The output hash of the dependencies for this project.
   # Can be calculated in advance with prefetch-npm-deps.
 , npmDepsHash ? ""
+  # Whether to force the usage of Git dependencies that have install scripts, but not a lockfile.
+  # Use with care.
+, forceGitDeps ? false
   # Whether to make the cache writable prior to installing dependencies.
   # Don't set this unless npm tries to write to the cache directory, as it can slow down the build.
 , makeCacheWritable ? false
@@ -32,7 +35,7 @@
 
 let
   npmDeps = fetchNpmDeps {
-    inherit src srcs sourceRoot prePatch patches postPatch;
+    inherit forceGitDeps src srcs sourceRoot prePatch patches postPatch;
     name = "${name}-npm-deps";
     hash = npmDepsHash;
   };
diff --git a/pkgs/build-support/node/fetch-npm-deps/default.nix b/pkgs/build-support/node/fetch-npm-deps/default.nix
index d87071d8559..41cad9d12ee 100644
--- a/pkgs/build-support/node/fetch-npm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-npm-deps/default.nix
@@ -36,8 +36,8 @@
           '';
         };
 
-        makeTest = { name, src, hash }: testers.invalidateFetcherByDrvHash fetchNpmDeps {
-          inherit name hash;
+        makeTest = { name, src, hash, forceGitDeps ? false }: testers.invalidateFetcherByDrvHash fetchNpmDeps {
+          inherit name hash forceGitDeps;
 
           src = makeTestSrc { inherit name src; };
         };
@@ -108,6 +108,8 @@
           };
 
           hash = "sha256-+KA8/orSBJ4EhuSyQO8IKSxsN/FAsYU3lOzq+awuxNQ=";
+
+          forceGitDeps = true;
         };
       };
 
@@ -121,6 +123,7 @@
   fetchNpmDeps =
     { name ? "npm-deps"
     , hash ? ""
+    , forceGitDeps ? false
     , ...
     } @ args:
     let
@@ -131,6 +134,8 @@
           outputHash = "";
           outputHashAlgo = "sha256";
         };
+
+      forceGitDeps_ = lib.optionalAttrs forceGitDeps { FORCE_GIT_DEPS = true; };
     in
     stdenvNoCC.mkDerivation (args // {
       inherit name;
@@ -161,5 +166,5 @@
       dontInstall = true;
 
       outputHashMode = "recursive";
-    } // hash_);
+    } // hash_ // forceGitDeps_);
 }
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs b/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
index 715e115e723..5326c3e858b 100644
--- a/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
@@ -72,7 +72,7 @@ impl Cache {
                 &mut p,
                 &hash
                     .into_iter()
-                    .map(|x| format!("{:02x}", x))
+                    .map(|n| format!("{n:02x}"))
                     .collect::<String>(),
             );
 
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/main.rs b/pkgs/build-support/node/fetch-npm-deps/src/main.rs
index 3d2204071a6..57725a922df 100644
--- a/pkgs/build-support/node/fetch-npm-deps/src/main.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/main.rs
@@ -1,250 +1,18 @@
 #![warn(clippy::pedantic)]
 
 use crate::cacache::Cache;
-use anyhow::{anyhow, Context};
+use anyhow::anyhow;
 use rayon::prelude::*;
-use serde::Deserialize;
 use serde_json::{Map, Value};
 use std::{
-    collections::{HashMap, HashSet},
-    env, fmt, fs, io,
+    env, fs,
     path::Path,
-    process::{self, Command, Stdio},
+    process::{self, Command},
 };
 use tempfile::tempdir;
-use url::Url;
 
 mod cacache;
-#[cfg(test)]
-mod tests;
-
-#[derive(Deserialize)]
-struct PackageLock {
-    #[serde(rename = "lockfileVersion")]
-    version: u8,
-    dependencies: Option<HashMap<String, OldPackage>>,
-    packages: Option<HashMap<String, Package>>,
-}
-
-#[derive(Deserialize)]
-struct OldPackage {
-    version: UrlOrString,
-    #[serde(default)]
-    bundled: bool,
-    resolved: Option<UrlOrString>,
-    integrity: Option<String>,
-    dependencies: Option<HashMap<String, OldPackage>>,
-}
-
-#[derive(Debug, Deserialize, PartialEq, Eq)]
-struct Package {
-    resolved: Option<UrlOrString>,
-    integrity: Option<String>,
-}
-
-#[derive(Debug, Deserialize, PartialEq, Eq)]
-#[serde(untagged)]
-enum UrlOrString {
-    Url(Url),
-    String(String),
-}
-
-impl fmt::Display for UrlOrString {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            UrlOrString::Url(url) => url.fmt(f),
-            UrlOrString::String(string) => string.fmt(f),
-        }
-    }
-}
-
-#[allow(clippy::case_sensitive_file_extension_comparisons)]
-fn to_new_packages(
-    old_packages: HashMap<String, OldPackage>,
-    initial_url: &Url,
-) -> anyhow::Result<HashMap<String, Package>> {
-    let mut new = HashMap::new();
-
-    for (name, mut package) in old_packages {
-        // In some cases, a bundled dependency happens to have the same version as a non-bundled one, causing
-        // the bundled one without a URL to override the entry for the non-bundled instance, which prevents the
-        // dependency from being downloaded.
-        if package.bundled {
-            continue;
-        }
-
-        if let UrlOrString::Url(v) = &package.version {
-            for (scheme, host) in [
-                ("github", "github.com"),
-                ("bitbucket", "bitbucket.org"),
-                ("gitlab", "gitlab.com"),
-            ] {
-                if v.scheme() == scheme {
-                    package.version = {
-                        let mut new_url = initial_url.clone();
-
-                        new_url.set_host(Some(host))?;
-
-                        if v.path().ends_with(".git") {
-                            new_url.set_path(v.path());
-                        } else {
-                            new_url.set_path(&format!("{}.git", v.path()));
-                        }
-
-                        new_url.set_fragment(v.fragment());
-
-                        UrlOrString::Url(new_url)
-                    };
-
-                    break;
-                }
-            }
-        }
-
-        new.insert(
-            format!("{name}-{}", package.version),
-            Package {
-                resolved: if matches!(package.version, UrlOrString::Url(_)) {
-                    Some(package.version)
-                } else {
-                    package.resolved
-                },
-                integrity: package.integrity,
-            },
-        );
-
-        if let Some(dependencies) = package.dependencies {
-            new.extend(to_new_packages(dependencies, initial_url)?);
-        }
-    }
-
-    Ok(new)
-}
-
-#[allow(clippy::case_sensitive_file_extension_comparisons)]
-fn get_hosted_git_url(url: &Url) -> Option<Url> {
-    if ["git", "http", "git+ssh", "git+https", "ssh", "https"].contains(&url.scheme()) {
-        let mut s = url.path_segments()?;
-
-        match url.host_str()? {
-            "github.com" => {
-                let user = s.next()?;
-                let mut project = s.next()?;
-                let typ = s.next();
-                let mut commit = s.next();
-
-                if typ.is_none() {
-                    commit = url.fragment();
-                } else if typ.is_some() && typ != Some("tree") {
-                    return None;
-                }
-
-                if project.ends_with(".git") {
-                    project = project.strip_suffix(".git")?;
-                }
-
-                let commit = commit.unwrap();
-
-                Some(
-                    Url::parse(&format!(
-                        "https://codeload.github.com/{user}/{project}/tar.gz/{commit}"
-                    ))
-                    .ok()?,
-                )
-            }
-            "bitbucket.org" => {
-                let user = s.next()?;
-                let mut project = s.next()?;
-                let aux = s.next();
-
-                if aux == Some("get") {
-                    return None;
-                }
-
-                if project.ends_with(".git") {
-                    project = project.strip_suffix(".git")?;
-                }
-
-                let commit = url.fragment()?;
-
-                Some(
-                    Url::parse(&format!(
-                        "https://bitbucket.org/{user}/{project}/get/{commit}.tar.gz"
-                    ))
-                    .ok()?,
-                )
-            }
-            "gitlab.com" => {
-                let path = &url.path()[1..];
-
-                if path.contains("/~/") || path.contains("/archive.tar.gz") {
-                    return None;
-                }
-
-                let user = s.next()?;
-                let mut project = s.next()?;
-
-                if project.ends_with(".git") {
-                    project = project.strip_suffix(".git")?;
-                }
-
-                let commit = url.fragment()?;
-
-                Some(
-                    Url::parse(&format!(
-                    "https://gitlab.com/{user}/{project}/repository/archive.tar.gz?ref={commit}"
-                ))
-                    .ok()?,
-                )
-            }
-            "git.sr.ht" => {
-                let user = s.next()?;
-                let mut project = s.next()?;
-                let aux = s.next();
-
-                if aux == Some("archive") {
-                    return None;
-                }
-
-                if project.ends_with(".git") {
-                    project = project.strip_suffix(".git")?;
-                }
-
-                let commit = url.fragment()?;
-
-                Some(
-                    Url::parse(&format!(
-                        "https://git.sr.ht/{user}/{project}/archive/{commit}.tar.gz"
-                    ))
-                    .ok()?,
-                )
-            }
-            _ => None,
-        }
-    } else {
-        None
-    }
-}
-
-fn get_ideal_hash(integrity: &str) -> anyhow::Result<&str> {
-    let split: Vec<_> = integrity.split_ascii_whitespace().collect();
-
-    if split.len() == 1 {
-        Ok(split[0])
-    } else {
-        for hash in ["sha512-", "sha1-"] {
-            if let Some(h) = split.iter().find(|s| s.starts_with(hash)) {
-                return Ok(h);
-            }
-        }
-
-        Err(anyhow!("not sure which hash to select out of {split:?}"))
-    }
-}
-
-fn get_initial_url() -> anyhow::Result<Url> {
-    Url::parse("git+ssh://git@a.b").context("initial url should be valid")
-}
+mod parse;
 
 /// `fixup_lockfile` removes the `integrity` field from Git dependencies.
 ///
@@ -294,7 +62,6 @@ fn fixup_lockfile(mut lock: Map<String, Value>) -> anyhow::Result<Option<Map<Str
     }
 }
 
-#[allow(clippy::too_many_lines)]
 fn main() -> anyhow::Result<()> {
     let args = env::args().collect::<Vec<_>>();
 
@@ -319,7 +86,6 @@ fn main() -> anyhow::Result<()> {
     }
 
     let lock_content = fs::read_to_string(&args[1])?;
-    let lock: PackageLock = serde_json::from_str(&lock_content)?;
 
     let out_tempdir;
 
@@ -331,137 +97,92 @@ fn main() -> anyhow::Result<()> {
         (out_tempdir.path(), true)
     };
 
-    let agent = ureq::agent();
-
-    eprintln!("lockfile version: {}", lock.version);
-
-    let packages = match lock.version {
-        1 => {
-            let initial_url = get_initial_url()?;
-
-            lock.dependencies
-                .map(|p| to_new_packages(p, &initial_url))
-                .transpose()?
-        }
-        2 | 3 => lock.packages,
-        _ => panic!(
-            "We don't support lockfile version {}, please file an issue.",
-            lock.version
-        ),
-    };
-
-    if packages.is_none() {
-        return Ok(());
-    }
-
-    let packages = {
-        let mut seen = HashSet::new();
-        let mut new_packages = HashMap::new();
-
-        for (dep, package) in packages.unwrap().drain() {
-            if let (false, Some(UrlOrString::Url(resolved))) = (dep.is_empty(), &package.resolved) {
-                if !seen.contains(resolved) {
-                    seen.insert(resolved.clone());
-                    new_packages.insert(dep, package);
-                }
-            }
-        }
-
-        new_packages
-    };
+    let packages = parse::lockfile(&lock_content, env::var("FORCE_GIT_DEPS").is_ok())?;
 
     let cache = Cache::new(out.join("_cacache"));
 
-    packages
-        .into_par_iter()
-        .try_for_each(|(dep, mut package)| {
-            eprintln!("{dep}");
+    packages.into_par_iter().try_for_each(|package| {
+        eprintln!("{}", package.name);
 
-            let mut resolved = match package.resolved {
-                Some(UrlOrString::Url(url)) => url,
-                _ => unreachable!(),
-            };
+        let tarball = package.tarball()?;
+        let integrity = package.integrity();
 
-            let mut hosted = false;
+        cache
+            .put(
+                format!("make-fetch-happen:request-cache:{}", package.url),
+                package.url,
+                &tarball,
+                integrity,
+            )
+            .map_err(|e| anyhow!("couldn't insert cache entry for {}: {e:?}", package.name))?;
 
-            if let Some(hosted_git_url) = get_hosted_git_url(&resolved) {
-                resolved = hosted_git_url;
-                package.integrity = None;
-                hosted = true;
-            }
+        Ok::<_, anyhow::Error>(())
+    })?;
 
-            let mut data = Vec::new();
-
-            let mut body = agent.get(resolved.as_str()).call()?.into_reader();
-
-            if hosted {
-                let workdir = tempdir()?;
+    fs::write(out.join("package-lock.json"), lock_content)?;
 
-                let tar_path = workdir.path().join("package");
+    if print_hash {
+        Command::new("nix")
+            .args(["--experimental-features", "nix-command", "hash", "path"])
+            .arg(out.as_os_str())
+            .status()?;
+    }
 
-                fs::create_dir(&tar_path)?;
+    Ok(())
+}
 
-                let mut cmd = Command::new("tar")
-                    .args(["--extract", "--gzip", "--strip-components=1", "-C"])
-                    .arg(&tar_path)
-                    .stdin(Stdio::piped())
-                    .spawn()?;
+#[cfg(test)]
+mod tests {
+    use super::fixup_lockfile;
+    use serde_json::json;
+
+    #[test]
+    fn lockfile_fixup() -> anyhow::Result<()> {
+        let input = json!({
+            "lockfileVersion": 2,
+            "name": "foo",
+            "packages": {
+                "": {
 
-                io::copy(&mut body, &mut cmd.stdin.take().unwrap())?;
+                },
+                "foo": {
+                    "resolved": "https://github.com/NixOS/nixpkgs",
+                    "integrity": "aaa"
+                },
+                "bar": {
+                    "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
+                    "integrity": "bbb"
+                }
+            }
+        });
 
-                let exit = cmd.wait()?;
+        let expected = json!({
+            "lockfileVersion": 2,
+            "name": "foo",
+            "packages": {
+                "": {
 
-                if !exit.success() {
-                    return Err(anyhow!(
-                        "failed to extract tarball for {dep}: tar exited with status code {}",
-                        exit.code().unwrap()
-                    ));
+                },
+                "foo": {
+                    "resolved": "https://github.com/NixOS/nixpkgs",
+                    "integrity": "aaa"
+                },
+                "bar": {
+                    "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
                 }
-
-                data = Command::new("tar")
-                    .args([
-                        "--sort=name",
-                        "--mtime=@0",
-                        "--owner=0",
-                        "--group=0",
-                        "--numeric-owner",
-                        "--format=gnu",
-                        "-I",
-                        "gzip -n -9",
-                        "--create",
-                        "-C",
-                    ])
-                    .arg(workdir.path())
-                    .arg("package")
-                    .output()?
-                    .stdout;
-            } else {
-                body.read_to_end(&mut data)?;
             }
+        });
 
-            cache
-                .put(
-                    format!("make-fetch-happen:request-cache:{resolved}"),
-                    resolved,
-                    &data,
-                    package
-                        .integrity
-                        .map(|i| Ok::<String, anyhow::Error>(get_ideal_hash(&i)?.to_string()))
-                        .transpose()?,
-                )
-                .map_err(|e| anyhow!("couldn't insert cache entry for {dep}: {e:?}"))?;
-
-            Ok::<_, anyhow::Error>(())
-        })?;
+        assert_eq!(
+            fixup_lockfile(input.as_object().unwrap().clone())?,
+            Some(expected.as_object().unwrap().clone())
+        );
 
-    fs::write(out.join("package-lock.json"), lock_content)?;
+        assert_eq!(
+            fixup_lockfile(json!({"lockfileVersion": 1}).as_object().unwrap().clone())?,
+            None
+        );
 
-    if print_hash {
-        Command::new("nix")
-            .args(["--experimental-features", "nix-command", "hash", "path"])
-            .arg(out.as_os_str())
-            .status()?;
+        Ok(())
     }
-
-    Ok(())
 }
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs b/pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs
new file mode 100644
index 00000000000..99bd3020b52
--- /dev/null
+++ b/pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs
@@ -0,0 +1,191 @@
+use anyhow::{bail, Context};
+use rayon::slice::ParallelSliceMut;
+use serde::Deserialize;
+use std::{collections::HashMap, fmt};
+use url::Url;
+
+pub(super) fn packages(content: &str) -> anyhow::Result<Vec<Package>> {
+    let lockfile: Lockfile = serde_json::from_str(content)?;
+
+    let mut packages = match lockfile.version {
+        1 => {
+            let initial_url = get_initial_url()?;
+
+            lockfile
+                .dependencies
+                .map(|p| to_new_packages(p, &initial_url))
+                .transpose()?
+        }
+        2 | 3 => lockfile.packages.map(|pkgs| {
+            pkgs.into_iter()
+                .filter(|(n, p)| !n.is_empty() && matches!(p.resolved, Some(UrlOrString::Url(_))))
+                .map(|(n, p)| Package { name: Some(n), ..p })
+                .collect()
+        }),
+        _ => bail!(
+            "We don't support lockfile version {}, please file an issue.",
+            lockfile.version
+        ),
+    }
+    .expect("lockfile should have packages");
+
+    packages.par_sort_by(|x, y| {
+        x.resolved
+            .partial_cmp(&y.resolved)
+            .expect("resolved should be comparable")
+    });
+
+    packages.dedup_by(|x, y| x.resolved == y.resolved);
+
+    Ok(packages)
+}
+
+#[derive(Deserialize)]
+struct Lockfile {
+    #[serde(rename = "lockfileVersion")]
+    version: u8,
+    dependencies: Option<HashMap<String, OldPackage>>,
+    packages: Option<HashMap<String, Package>>,
+}
+
+#[derive(Deserialize)]
+struct OldPackage {
+    version: UrlOrString,
+    #[serde(default)]
+    bundled: bool,
+    resolved: Option<UrlOrString>,
+    integrity: Option<String>,
+    dependencies: Option<HashMap<String, OldPackage>>,
+}
+
+#[derive(Debug, Deserialize, PartialEq, Eq)]
+pub(super) struct Package {
+    #[serde(default)]
+    pub(super) name: Option<String>,
+    pub(super) resolved: Option<UrlOrString>,
+    pub(super) integrity: Option<String>,
+}
+
+#[derive(Debug, Deserialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(untagged)]
+pub(super) enum UrlOrString {
+    Url(Url),
+    String(String),
+}
+
+impl fmt::Display for UrlOrString {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            UrlOrString::Url(url) => url.fmt(f),
+            UrlOrString::String(string) => string.fmt(f),
+        }
+    }
+}
+
+#[allow(clippy::case_sensitive_file_extension_comparisons)]
+fn to_new_packages(
+    old_packages: HashMap<String, OldPackage>,
+    initial_url: &Url,
+) -> anyhow::Result<Vec<Package>> {
+    let mut new = Vec::new();
+
+    for (name, mut package) in old_packages {
+        // In some cases, a bundled dependency happens to have the same version as a non-bundled one, causing
+        // the bundled one without a URL to override the entry for the non-bundled instance, which prevents the
+        // dependency from being downloaded.
+        if package.bundled {
+            continue;
+        }
+
+        if let UrlOrString::Url(v) = &package.version {
+            for (scheme, host) in [
+                ("github", "github.com"),
+                ("bitbucket", "bitbucket.org"),
+                ("gitlab", "gitlab.com"),
+            ] {
+                if v.scheme() == scheme {
+                    package.version = {
+                        let mut new_url = initial_url.clone();
+
+                        new_url.set_host(Some(host))?;
+
+                        if v.path().ends_with(".git") {
+                            new_url.set_path(v.path());
+                        } else {
+                            new_url.set_path(&format!("{}.git", v.path()));
+                        }
+
+                        new_url.set_fragment(v.fragment());
+
+                        UrlOrString::Url(new_url)
+                    };
+
+                    break;
+                }
+            }
+        }
+
+        new.push(Package {
+            name: Some(name),
+            resolved: if matches!(package.version, UrlOrString::Url(_)) {
+                Some(package.version)
+            } else {
+                package.resolved
+            },
+            integrity: package.integrity,
+        });
+
+        if let Some(dependencies) = package.dependencies {
+            new.append(&mut to_new_packages(dependencies, initial_url)?);
+        }
+    }
+
+    Ok(new)
+}
+
+fn get_initial_url() -> anyhow::Result<Url> {
+    Url::parse("git+ssh://git@a.b").context("initial url should be valid")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{get_initial_url, to_new_packages, OldPackage, Package, UrlOrString};
+    use std::collections::HashMap;
+    use url::Url;
+
+    #[test]
+    fn git_shorthand_v1() -> anyhow::Result<()> {
+        let old = {
+            let mut o = HashMap::new();
+            o.insert(
+                String::from("sqlite3"),
+                OldPackage {
+                    version: UrlOrString::Url(
+                        Url::parse(
+                            "github:mapbox/node-sqlite3#593c9d498be2510d286349134537e3bf89401c4a",
+                        )
+                        .unwrap(),
+                    ),
+                    bundled: false,
+                    resolved: None,
+                    integrity: None,
+                    dependencies: None,
+                },
+            );
+            o
+        };
+
+        let initial_url = get_initial_url()?;
+
+        let new = to_new_packages(old, &initial_url)?;
+
+        assert_eq!(new.len(), 1, "new packages map should contain 1 value");
+        assert_eq!(new[0], Package {
+            name: Some(String::from("sqlite3")),
+            resolved: Some(UrlOrString::Url(Url::parse("git+ssh://git@github.com/mapbox/node-sqlite3.git#593c9d498be2510d286349134537e3bf89401c4a").unwrap())),
+            integrity: None
+        });
+
+        Ok(())
+    }
+}
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs b/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs
new file mode 100644
index 00000000000..387b3add7ec
--- /dev/null
+++ b/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs
@@ -0,0 +1,370 @@
+use anyhow::{anyhow, bail, Context};
+use lock::UrlOrString;
+use rayon::prelude::*;
+use serde_json::{Map, Value};
+use std::{
+    fs, io,
+    process::{Command, Stdio},
+};
+use tempfile::{tempdir, TempDir};
+use url::Url;
+
+mod lock;
+
+pub fn lockfile(content: &str, force_git_deps: bool) -> anyhow::Result<Vec<Package>> {
+    let mut packages = lock::packages(content)
+        .context("failed to extract packages from lockfile")?
+        .into_par_iter()
+        .map(|p| {
+            let n = p.name.clone().unwrap();
+
+            Package::from_lock(p).with_context(|| format!("failed to parse data for {n}"))
+        })
+        .collect::<anyhow::Result<Vec<_>>>()?;
+
+    let mut new = Vec::new();
+
+    for pkg in packages
+        .iter()
+        .filter(|p| matches!(p.specifics, Specifics::Git { .. }))
+    {
+        let dir = match &pkg.specifics {
+            Specifics::Git { workdir } => workdir,
+            Specifics::Registry { .. } => unimplemented!(),
+        };
+
+        let path = dir.path().join("package");
+
+        let lockfile_contents = fs::read_to_string(path.join("package-lock.json"));
+
+        let package_json_path = path.join("package.json");
+        let mut package_json: Map<String, Value> =
+            serde_json::from_str(&fs::read_to_string(package_json_path)?)?;
+
+        if let Some(scripts) = package_json
+            .get_mut("scripts")
+            .and_then(Value::as_object_mut)
+        {
+            // https://github.com/npm/pacote/blob/272edc1bac06991fc5f95d06342334bbacfbaa4b/lib/git.js#L166-L172
+            for typ in [
+                "postinstall",
+                "build",
+                "preinstall",
+                "install",
+                "prepack",
+                "prepare",
+            ] {
+                if scripts.contains_key(typ) && lockfile_contents.is_err() && !force_git_deps {
+                    bail!("Git dependency {} contains install scripts, but has no lockfile, which is something that will probably break. Open an issue if you can't feasibly patch this dependency out, and we'll come up with a workaround.\nIf you'd like to attempt to try to use this dependency anyways, set `forceGitDeps = true`.", pkg.name);
+                }
+            }
+        }
+
+        if let Ok(lockfile_contents) = lockfile_contents {
+            new.append(&mut lockfile(&lockfile_contents, force_git_deps)?);
+        }
+    }
+
+    packages.append(&mut new);
+
+    packages.par_sort_by(|x, y| {
+        x.url
+            .partial_cmp(&y.url)
+            .expect("resolved should be comparable")
+    });
+
+    packages.dedup_by(|x, y| x.url == y.url);
+
+    Ok(packages)
+}
+
+#[derive(Debug)]
+pub struct Package {
+    pub name: String,
+    pub url: Url,
+    specifics: Specifics,
+}
+
+#[derive(Debug)]
+enum Specifics {
+    Registry { integrity: String },
+    Git { workdir: TempDir },
+}
+
+impl Package {
+    fn from_lock(pkg: lock::Package) -> anyhow::Result<Package> {
+        let mut resolved = match pkg
+            .resolved
+            .expect("at this point, packages should have URLs")
+        {
+            UrlOrString::Url(u) => u,
+            UrlOrString::String(_) => panic!("at this point, all packages should have URLs"),
+        };
+
+        let specifics = match get_hosted_git_url(&resolved)? {
+            Some(hosted) => {
+                let mut body = ureq::get(hosted.as_str()).call()?.into_reader();
+
+                let workdir = tempdir()?;
+
+                let tar_path = workdir.path().join("package");
+
+                fs::create_dir(&tar_path)?;
+
+                let mut cmd = Command::new("tar")
+                    .args(["--extract", "--gzip", "--strip-components=1", "-C"])
+                    .arg(&tar_path)
+                    .stdin(Stdio::piped())
+                    .spawn()?;
+
+                io::copy(&mut body, &mut cmd.stdin.take().unwrap())?;
+
+                let exit = cmd.wait()?;
+
+                if !exit.success() {
+                    bail!(
+                        "failed to extract tarball for {}: tar exited with status code {}",
+                        pkg.name.unwrap(),
+                        exit.code().unwrap()
+                    );
+                }
+
+                resolved = hosted;
+
+                Specifics::Git { workdir }
+            }
+            None => Specifics::Registry {
+                integrity: get_ideal_hash(
+                    &pkg.integrity
+                        .expect("non-git dependencies should have assosciated integrity"),
+                )?
+                .to_string(),
+            },
+        };
+
+        Ok(Package {
+            name: pkg.name.unwrap(),
+            url: resolved,
+            specifics,
+        })
+    }
+
+    pub fn tarball(&self) -> anyhow::Result<Vec<u8>> {
+        match &self.specifics {
+            Specifics::Registry { .. } => {
+                let mut body = Vec::new();
+
+                ureq::get(self.url.as_str())
+                    .call()?
+                    .into_reader()
+                    .read_to_end(&mut body)?;
+
+                Ok(body)
+            }
+            Specifics::Git { workdir } => Ok(Command::new("tar")
+                .args([
+                    "--sort=name",
+                    "--mtime=@0",
+                    "--owner=0",
+                    "--group=0",
+                    "--numeric-owner",
+                    "--format=gnu",
+                    "-I",
+                    "gzip -n -9",
+                    "--create",
+                    "-C",
+                ])
+                .arg(workdir.path())
+                .arg("package")
+                .output()?
+                .stdout),
+        }
+    }
+
+    pub fn integrity(&self) -> Option<String> {
+        match &self.specifics {
+            Specifics::Registry { integrity } => Some(integrity.clone()),
+            Specifics::Git { .. } => None,
+        }
+    }
+}
+
+#[allow(clippy::case_sensitive_file_extension_comparisons)]
+fn get_hosted_git_url(url: &Url) -> anyhow::Result<Option<Url>> {
+    if ["git", "git+ssh", "git+https", "ssh"].contains(&url.scheme()) {
+        let mut s = url
+            .path_segments()
+            .ok_or_else(|| anyhow!("bad URL: {url}"))?;
+
+        let mut get_url = || match url.host_str()? {
+            "github.com" => {
+                let user = s.next()?;
+                let mut project = s.next()?;
+                let typ = s.next();
+                let mut commit = s.next();
+
+                if typ.is_none() {
+                    commit = url.fragment();
+                } else if typ.is_some() && typ != Some("tree") {
+                    return None;
+                }
+
+                if project.ends_with(".git") {
+                    project = project.strip_suffix(".git")?;
+                }
+
+                let commit = commit.unwrap();
+
+                Some(
+                    Url::parse(&format!(
+                        "https://codeload.github.com/{user}/{project}/tar.gz/{commit}"
+                    ))
+                    .ok()?,
+                )
+            }
+            "bitbucket.org" => {
+                let user = s.next()?;
+                let mut project = s.next()?;
+                let aux = s.next();
+
+                if aux == Some("get") {
+                    return None;
+                }
+
+                if project.ends_with(".git") {
+                    project = project.strip_suffix(".git")?;
+                }
+
+                let commit = url.fragment()?;
+
+                Some(
+                    Url::parse(&format!(
+                        "https://bitbucket.org/{user}/{project}/get/{commit}.tar.gz"
+                    ))
+                    .ok()?,
+                )
+            }
+            "gitlab.com" => {
+                /* let path = &url.path()[1..];
+
+                if path.contains("/~/") || path.contains("/archive.tar.gz") {
+                    return None;
+                }
+
+                let user = s.next()?;
+                let mut project = s.next()?;
+
+                if project.ends_with(".git") {
+                    project = project.strip_suffix(".git")?;
+                }
+
+                let commit = url.fragment()?;
+
+                Some(
+                    Url::parse(&format!(
+                    "https://gitlab.com/{user}/{project}/repository/archive.tar.gz?ref={commit}"
+                ))
+                    .ok()?,
+                ) */
+
+                // lmao: https://github.com/npm/hosted-git-info/pull/109
+                None
+            }
+            "git.sr.ht" => {
+                let user = s.next()?;
+                let mut project = s.next()?;
+                let aux = s.next();
+
+                if aux == Some("archive") {
+                    return None;
+                }
+
+                if project.ends_with(".git") {
+                    project = project.strip_suffix(".git")?;
+                }
+
+                let commit = url.fragment()?;
+
+                Some(
+                    Url::parse(&format!(
+                        "https://git.sr.ht/{user}/{project}/archive/{commit}.tar.gz"
+                    ))
+                    .ok()?,
+                )
+            }
+            _ => None,
+        };
+
+        match get_url() {
+            Some(u) => Ok(Some(u)),
+            None => Err(anyhow!("This lockfile either contains a Git dependency with an unsupported host, or a malformed URL in the lockfile: {url}"))
+        }
+    } else {
+        Ok(None)
+    }
+}
+
+fn get_ideal_hash(integrity: &str) -> anyhow::Result<&str> {
+    let split: Vec<_> = integrity.split_ascii_whitespace().collect();
+
+    if split.len() == 1 {
+        Ok(split[0])
+    } else {
+        for hash in ["sha512-", "sha1-"] {
+            if let Some(h) = split.iter().find(|s| s.starts_with(hash)) {
+                return Ok(h);
+            }
+        }
+
+        Err(anyhow!("not sure which hash to select out of {split:?}"))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{get_hosted_git_url, get_ideal_hash};
+    use url::Url;
+
+    #[test]
+    fn hosted_git_urls() {
+        for (input, expected) in [
+            (
+                "git+ssh://git@github.com/castlabs/electron-releases.git#fc5f78d046e8d7cdeb66345a2633c383ab41f525",
+                Some("https://codeload.github.com/castlabs/electron-releases/tar.gz/fc5f78d046e8d7cdeb66345a2633c383ab41f525"),
+            ),
+            (
+                "git+ssh://bitbucket.org/foo/bar#branch",
+                Some("https://bitbucket.org/foo/bar/get/branch.tar.gz")
+            ),
+            (
+                "git+ssh://git.sr.ht/~foo/bar#branch",
+                Some("https://git.sr.ht/~foo/bar/archive/branch.tar.gz")
+            ),
+        ] {
+            assert_eq!(
+                get_hosted_git_url(&Url::parse(input).unwrap()).unwrap(),
+                expected.map(|u| Url::parse(u).unwrap())
+            );
+        }
+
+        assert!(
+            get_hosted_git_url(&Url::parse("ssh://git@gitlab.com/foo/bar.git#fix/bug").unwrap())
+                .is_err(),
+            "GitLab URLs should be marked as invalid (lol)"
+        );
+    }
+
+    #[test]
+    fn ideal_hashes() {
+        for (input, expected) in [
+            ("sha512-foo sha1-bar", Some("sha512-foo")),
+            ("sha1-bar md5-foo", Some("sha1-bar")),
+            ("sha1-bar", Some("sha1-bar")),
+            ("sha512-foo", Some("sha512-foo")),
+            ("foo-bar sha1-bar", Some("sha1-bar")),
+            ("foo-bar baz-foo", None),
+        ] {
+            assert_eq!(get_ideal_hash(input).ok(), expected);
+        }
+    }
+}
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/tests.rs b/pkgs/build-support/node/fetch-npm-deps/src/tests.rs
deleted file mode 100644
index a3317207c42..00000000000
--- a/pkgs/build-support/node/fetch-npm-deps/src/tests.rs
+++ /dev/null
@@ -1,141 +0,0 @@
-use super::{
-    fixup_lockfile, get_hosted_git_url, get_ideal_hash, get_initial_url, to_new_packages,
-    OldPackage, Package, UrlOrString,
-};
-use serde_json::json;
-use std::collections::HashMap;
-use url::Url;
-
-#[test]
-fn hosted_git_urls() {
-    for (input, expected) in [
-        (
-            "git+ssh://git@github.com/castlabs/electron-releases.git#fc5f78d046e8d7cdeb66345a2633c383ab41f525",
-            Some("https://codeload.github.com/castlabs/electron-releases/tar.gz/fc5f78d046e8d7cdeb66345a2633c383ab41f525"),
-        ),
-        (
-            "https://user@github.com/foo/bar#fix/bug",
-            Some("https://codeload.github.com/foo/bar/tar.gz/fix/bug")
-        ),
-        (
-            "https://github.com/eligrey/classList.js/archive/1.2.20180112.tar.gz",
-            None
-        ),
-        (
-            "git+ssh://bitbucket.org/foo/bar#branch",
-            Some("https://bitbucket.org/foo/bar/get/branch.tar.gz")
-        ),
-        (
-            "ssh://git@gitlab.com/foo/bar.git#fix/bug",
-            Some("https://gitlab.com/foo/bar/repository/archive.tar.gz?ref=fix/bug")
-        ),
-        (
-            "git+ssh://git.sr.ht/~foo/bar#branch",
-            Some("https://git.sr.ht/~foo/bar/archive/branch.tar.gz")
-        ),
-    ] {
-        assert_eq!(
-            get_hosted_git_url(&Url::parse(input).unwrap()),
-            expected.map(|u| Url::parse(u).unwrap())
-        );
-    }
-}
-
-#[test]
-fn ideal_hashes() {
-    for (input, expected) in [
-        ("sha512-foo sha1-bar", Some("sha512-foo")),
-        ("sha1-bar md5-foo", Some("sha1-bar")),
-        ("sha1-bar", Some("sha1-bar")),
-        ("sha512-foo", Some("sha512-foo")),
-        ("foo-bar sha1-bar", Some("sha1-bar")),
-        ("foo-bar baz-foo", None),
-    ] {
-        assert_eq!(get_ideal_hash(input).ok(), expected);
-    }
-}
-
-#[test]
-fn git_shorthand_v1() -> anyhow::Result<()> {
-    let old = {
-        let mut o = HashMap::new();
-        o.insert(
-            String::from("sqlite3"),
-            OldPackage {
-                version: UrlOrString::Url(
-                    Url::parse(
-                        "github:mapbox/node-sqlite3#593c9d498be2510d286349134537e3bf89401c4a",
-                    )
-                    .unwrap(),
-                ),
-                bundled: false,
-                resolved: None,
-                integrity: None,
-                dependencies: None,
-            },
-        );
-        o
-    };
-
-    let initial_url = get_initial_url()?;
-
-    let new = to_new_packages(old, &initial_url)?;
-
-    assert_eq!(new.len(), 1, "new packages map should contain 1 value");
-    assert_eq!(new.into_values().next().unwrap(), Package {
-        resolved: Some(UrlOrString::Url(Url::parse("git+ssh://git@github.com/mapbox/node-sqlite3.git#593c9d498be2510d286349134537e3bf89401c4a").unwrap())),
-        integrity: None
-    });
-
-    Ok(())
-}
-
-#[test]
-fn lockfile_fixup() -> anyhow::Result<()> {
-    let input = json!({
-        "lockfileVersion": 2,
-        "name": "foo",
-        "packages": {
-            "": {
-
-            },
-            "foo": {
-                "resolved": "https://github.com/NixOS/nixpkgs",
-                "integrity": "aaa"
-            },
-            "bar": {
-                "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
-                "integrity": "bbb"
-            }
-        }
-    });
-
-    let expected = json!({
-        "lockfileVersion": 2,
-        "name": "foo",
-        "packages": {
-            "": {
-
-            },
-            "foo": {
-                "resolved": "https://github.com/NixOS/nixpkgs",
-                "integrity": "aaa"
-            },
-            "bar": {
-                "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
-            }
-        }
-    });
-
-    assert_eq!(
-        fixup_lockfile(input.as_object().unwrap().clone())?,
-        Some(expected.as_object().unwrap().clone())
-    );
-
-    assert_eq!(
-        fixup_lockfile(json!({"lockfileVersion": 1}).as_object().unwrap().clone())?,
-        None
-    );
-
-    Ok(())
-}
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 2cd30af56b7..73a3f12b20c 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -158,6 +158,15 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
 
   meta = {
     # default to Rust's platforms
-    platforms = rustc.meta.platforms;
+    platforms = rustc.meta.platforms ++ [
+      # Platforms without host tools from
+      # https://doc.rust-lang.org/nightly/rustc/platform-support.html
+      "armv7a-darwin"
+      "armv5tel-linux" "armv6l-linux" "armv7a-linux" "m68k-linux"
+      "riscv32-linux"
+      "armv6l-netbsd"
+      "x86_64-redox"
+      "wasm32-wasi"
+    ];
   } // meta;
 })
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index d18a9d24dfa..33458c428d2 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -11,7 +11,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "22.0.2";
+  version = "22.1.0";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
diff --git a/pkgs/data/fonts/iosevka/variants.nix b/pkgs/data/fonts/iosevka/variants.nix
index c75708299a5..b8a40ce5e86 100644
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "0dj0fk40impvlnbgmpnhndhad841sbk7056nyaxagiz12qq6rrii";
-  iosevka-aile = "01r6gdl2s93mhsr7ipq8ir6sy7srpyn8w09yd06hqh26ps40ki2b";
-  iosevka-curly = "0d0wsb5fpknxix6qng6mzkfdj2abm8hq067bqvbqhrdwhvbl83x9";
-  iosevka-curly-slab = "1hh9ck2pbsjaj81hivq9b7wqxb03mr6hsargw6gic4qn6pkk4l3n";
-  iosevka-etoile = "0p85jw25pkhndcdi56l9yg1hm4rsdjvy713q89dygrn5678nw74w";
-  iosevka-slab = "11vf6w59pcs71liw0k0nrhaw61nbn4n68vrj1b4rymc7mdaxfp1i";
-  iosevka-ss01 = "0hiffyfhfwwy55i1rvr78mvlmgx3c4czfx0lf4vmq2c6c4bldbf7";
-  iosevka-ss02 = "1z796x3a7hv05wir06rcj8i1l99169a7wab9j3ibb819pdycs5v7";
-  iosevka-ss03 = "1jjmg538avphd3djdjy521q0lbn7ip97qpf479kgvcr1hhv606kl";
-  iosevka-ss04 = "09xfsnl5dqzind60wip38pr0j9db47prbcgndfh283jcaysh5c0b";
-  iosevka-ss05 = "1mj4q45ifxvgwrrrmlv46p9cliznc4z2vipdf6k8b05ad71n7gab";
-  iosevka-ss06 = "02hn8dajvn5x303fv5gfl95hhsvql4h8525hd9k3a93g9qj13ib8";
-  iosevka-ss07 = "1hki40chpp3bnz6ksbly8lpjiqywdhgkqpc2h25lksdg8hwd8mcb";
-  iosevka-ss08 = "16bpzbcq2i0flw48ch2dfxljgscrm2fxfrcb2112wjv8zvi593hd";
-  iosevka-ss09 = "0ajm1gn45zklijyijxvib0iy47q7jvgmp2kdgmsa5zwwvnh8fipb";
-  iosevka-ss10 = "1g1if97w5mzzvm8y141rsqby90pmvc4whxxrjvdpmv94yb2biryp";
-  iosevka-ss11 = "0icx5cflzk05h51i4i7p5wbdkrpnyfn9r89rsvrd22vxc038xhmg";
-  iosevka-ss12 = "1var71j3pfa2fakrmm0c5sgiznbnqnxsnnkmpcb2xpjy4q68xfq1";
-  iosevka-ss13 = "0mpidl1hickx60zmza94002721jfs169b5a1l6vxwi5x6vk5329v";
-  iosevka-ss14 = "15z0ipnx2spgsp68465x7c8fkvb4hjnyl8pmfj2izn6jmgsrlc4x";
-  iosevka-ss15 = "0fyw53nvv45z55x2cnm9kcdcbiw1nykycychkih2fwlydm67vj0d";
-  iosevka-ss16 = "18lja4xw63i013ndqhm7kr7ggpbwc5zsxam7xib258nfhyx548ff";
-  iosevka-ss17 = "1h2q2v93504539imbn0gbkxi9jw71hisl6px87hs3sh6lmm5kjfm";
-  iosevka-ss18 = "085j759av6pspqn3sajrc12w74m7h5y64vdi1spmgd97dnj1gz6q";
-  sgr-iosevka = "1ykc80hgc9pipqvqw4m3mqj37rhf6hskgds42kxqzxdn194072m1";
-  sgr-iosevka-aile = "0c1jhff87hg4hxwrrp1vxx8gq1bkl9q85py1fz7gb3xdbim54s3z";
-  sgr-iosevka-curly = "0zb3y46wbsjb847s31s56gjf9sj8ikp8qvsg1fm2m01idv6f21ig";
-  sgr-iosevka-curly-slab = "113wmkzaaqp1yw95ld2j4l1f7yw9miq4bv4zjf9jib4ss6yjq97v";
-  sgr-iosevka-etoile = "1pgsh5myw2ihnlk6qkxr7p46sg1402mqvqn7bi2ch8gd472gijck";
-  sgr-iosevka-fixed = "1jf1icg1mqv1059p9msvk64j09apcqc9alvzrrxdqblw9b2ckrkj";
-  sgr-iosevka-fixed-curly = "1p3m6i1cbphxqrwyj2n0d7zwx9f75nvdsdfyyh8wvap88xwm0ggf";
-  sgr-iosevka-fixed-curly-slab = "0lgvai6293ddxckr9yvymi704pymcyp3ks4yx3jn207f70mpdg41";
-  sgr-iosevka-fixed-slab = "17935bvl9yly24g95wi2g4faahnj98z3dkb1a6dkb4frjq1nif2m";
-  sgr-iosevka-fixed-ss01 = "0wqpm57zcis9h8pzwvyjw8gggrwfgzlc3zd9c3shh7mpzx6zcj88";
-  sgr-iosevka-fixed-ss02 = "00jlapqakmpjcdycvdlhlm46iyvr05b8qskl6m7fxqg46dvnzz9z";
-  sgr-iosevka-fixed-ss03 = "1qd9wybq9miazkqkpis61s07yak7pn2lfawws421ynfgbb5r7987";
-  sgr-iosevka-fixed-ss04 = "0dbrimliy072mqg1gys9cmbl0ac56iavjnl73d14mxc77ciavkkl";
-  sgr-iosevka-fixed-ss05 = "1xfhvbzi91gddql6q1byyi40s9n6ym517c2pf6zpirnk6a7415k6";
-  sgr-iosevka-fixed-ss06 = "0ibji574aifh7pqpdgnmgmp3k784swjdvly9292sd758mlh8j5sa";
-  sgr-iosevka-fixed-ss07 = "1ixx123q5w7pbp9sgm84bhmzi7zy0h1ki3plm891mfv64pkbg42w";
-  sgr-iosevka-fixed-ss08 = "00jwiwbgrj6yxqjdp4g8cbsq2jk5pz6h401mh7y6wp2j3y2xrrkb";
-  sgr-iosevka-fixed-ss09 = "0jikxfir5md9qp5j1lhk1l9vjx2m15ncy9nkvb50mm32b6y5x3ph";
-  sgr-iosevka-fixed-ss10 = "0ampkjvr8qyadfc0yvmyvac7gnm1xi441vz1pf8n2qniypy29bgj";
-  sgr-iosevka-fixed-ss11 = "1nchlqkilglymydj33jzgp9wfivja2x3p8app3g9rgcsncsgjyc8";
-  sgr-iosevka-fixed-ss12 = "1wpza8g4as1p4cd8g0lv20m2k57f22kazp2w7810k2wzv06613jq";
-  sgr-iosevka-fixed-ss13 = "0phh86fk0l37998vxakz0vsxwsj1lbbzls23q56x7hgynnh8nr3x";
-  sgr-iosevka-fixed-ss14 = "1x1hmfj692ify57lffg08pa2420fgx0amha1kdzyyxf87s3maqx8";
-  sgr-iosevka-fixed-ss15 = "0qbf0b92668pxhjx778nnm5mj2w65c02k3cwk4f4x8vwkagwq2jp";
-  sgr-iosevka-fixed-ss16 = "0wmlcckbyrr1sspqfp5r6rymy5myy53q02fl7agv1c7bwfx9iycr";
-  sgr-iosevka-fixed-ss17 = "1rrkyv919m86biydl8jivfyn7wf8cna5c3b8rwv80ihz131zgj6z";
-  sgr-iosevka-fixed-ss18 = "1s5gj3iyyfgkkxy23yzbibwrzw4s2x9xprc5hhzyh2r10zvib5cf";
-  sgr-iosevka-slab = "1313y3nma1pqxm73yksw1b4vkvbwnv434hvkpqk1gp232j3i6dw2";
-  sgr-iosevka-ss01 = "137lmgn490vyl2y7aa5pqa66rsdwrsd4z8nz22fsks3p1pzm3fc7";
-  sgr-iosevka-ss02 = "1rhc76hfm204l5bmp1jdi74f0ay34g9q2rzi7lz5jirjjinnvadj";
-  sgr-iosevka-ss03 = "1gpb5vcx624gi0jjrj8p7jpm6r2465gpbn3khq46f9557ril4m5y";
-  sgr-iosevka-ss04 = "0kf1pmq2ffiam4zllj6x1dzd738zi9a843fz6jkpjbf9fascad9z";
-  sgr-iosevka-ss05 = "1xibjsa438lwk4y4bf0r7gjqy5czp7j7fml08f492jb1dwz7vqhq";
-  sgr-iosevka-ss06 = "1mk6haqj77b7r8cazkhf0bzd5w9ln2s6chsr12pd6bzmvphvzrzi";
-  sgr-iosevka-ss07 = "087030ckif8w4mv7j9y4pirfia5g8dh385awpqc6fffls9l0l0zh";
-  sgr-iosevka-ss08 = "0gzgsl7li9i1hl0ffw81j4w2ps3wy4kq986fwcwhgk7n9cy9rg97";
-  sgr-iosevka-ss09 = "1hsdgsg5y40bxwjkhm2q7jmjcjffsyjwa741n7fkfaqrqwl6273g";
-  sgr-iosevka-ss10 = "0ayspdypq0n7j8nbx17lxzki84icy5bzk88xq6akp7g6n035vw37";
-  sgr-iosevka-ss11 = "0kf2a1765qrmd5ba3s3hw8hxgzbcqi9dwb754yid18kiipl3lp4l";
-  sgr-iosevka-ss12 = "02d8i8qizfd1akhp0857y5i60hq3y4dj2dg2aq9pf4ldydcvc16g";
-  sgr-iosevka-ss13 = "0aw77vcfmr868vyff01cqln09xb1f30lwcsg4mqg2ym2ibp0xv71";
-  sgr-iosevka-ss14 = "1s1y5hww1vlqavgp4rr36bdvdicx7azw0yyrgv401i5w1p5z0088";
-  sgr-iosevka-ss15 = "1wb8s43hjw36x99sh610ms5x04nb6pi9z7i0dcpch7x9g2kk9ydh";
-  sgr-iosevka-ss16 = "1fwgskyl6ys383sa6fkkmdpw61m0d5nxc2vrhw56wysfvrz2cfa8";
-  sgr-iosevka-ss17 = "1zvzwy90gkaiq9ij9030wssnrjrkx9xkddwghaa1s2p9bdyfnf8x";
-  sgr-iosevka-ss18 = "12ijnkr69hahk8ghgibz438ar3yfky4kzwb9r08y43zjvycf2qhg";
-  sgr-iosevka-term = "13dvkydib9gv7308i093zpxpr40cr3admq0c4gg6ki3ix7cml3ac";
-  sgr-iosevka-term-curly = "0991m6p3b4kiyw0rgvxswwn263i7if7nznbivyzdsj1dgp3b2pkr";
-  sgr-iosevka-term-curly-slab = "1qbhhd4w2nxga2j7llsn8w3qa66rfw4nqylsw6dknqfhf34ba2mq";
-  sgr-iosevka-term-slab = "0g0dy4nrgy1a3xdbc5nxyh7y8j7plkbk09bid8rq51rdsljzp1hg";
-  sgr-iosevka-term-ss01 = "1smlqzqvp8by7rz5g5nbywyg740v9fhyiy3khn9rx5szyj92pmrb";
-  sgr-iosevka-term-ss02 = "1caxixkzbjapdr3k1ki1wfvcgs74mng0h15y00msfga1pjbj41vw";
-  sgr-iosevka-term-ss03 = "1fsbzb57jx2qcdmixxpgpqm8x1rlvc5vzkgx2w9z83nrll3iba5n";
-  sgr-iosevka-term-ss04 = "0zmpgsb0x8d8pggliqyl79hnxv5ivir0d8z2bg5zy1cw5ryzz94w";
-  sgr-iosevka-term-ss05 = "17d8ak2xnmp0g37b5ly3qik38mmmblrdqgmixp4i91wldf66h58c";
-  sgr-iosevka-term-ss06 = "0vv5gga66c5rs2vl4ncid403yqx7nwjfkr4mr5krlpc6lhs7wzhk";
-  sgr-iosevka-term-ss07 = "0mjpm4x0gy4749fnha26xssm7aw72sh7rgf3jf46pmqz40ya829b";
-  sgr-iosevka-term-ss08 = "1hw3cjfr3wwmjvi84vdn32kpk6x9zyqi43ib9nva7db4if39vf7s";
-  sgr-iosevka-term-ss09 = "1049yb11dlxc7d97hw51mzssrc0ips2dll8wglinp0l23y1nhf2s";
-  sgr-iosevka-term-ss10 = "0nzgcr2rlcgzfidnpix1dxyqiz273xmhfipfkflz5plpqvscd0c1";
-  sgr-iosevka-term-ss11 = "135crs740qprnzk0mycp83vw9x1m8za6w51syvvx8h0vncsc8g6b";
-  sgr-iosevka-term-ss12 = "1a2qrp44i4gqqpn2ycmslnm2g92v79v4hsim2ssiia474s5qn41z";
-  sgr-iosevka-term-ss13 = "18dbgl28iykw1hqcmanvpkc8zk12547rgw8zisr4vwqck8an50vb";
-  sgr-iosevka-term-ss14 = "0474ricwyvcmk9baxmd3gq1p6zrgnj59p0bbrsfc142ixqgkc0pp";
-  sgr-iosevka-term-ss15 = "1g8pjbyxnhvx62g96zlfpbq2kdc329j0pcr8iib7isyhijh4ygcx";
-  sgr-iosevka-term-ss16 = "199jhbfh2zbmp07jzi2wm8a63zhmasf4a04bp9i13pqwxz9hic7i";
-  sgr-iosevka-term-ss17 = "1lyv2hpmyalrwbhcxjqw9lzil9dfhrf971vazg366wngwn027sp2";
-  sgr-iosevka-term-ss18 = "1wszzj13gv3kc488yg9bshrf98db86xi0958g9l2y9l137h4frbz";
+  iosevka = "1f0l3d6j936799szy243k58rk28qbrgvgi35g0w6bfsra25lycq2";
+  iosevka-aile = "0prhfpz0ib7cbpi1kznb6yrp0wqjnsh39hymzha6lm0pa7py1r36";
+  iosevka-curly = "0yzdm4ypfk60zvl54fhsmi9xs1bg08pac0srs9nggicp5zswixb3";
+  iosevka-curly-slab = "175d96yzrqdjg7ic88dacvs7hz8daskn1a9vrqks132rr6a26xvw";
+  iosevka-etoile = "1n5xcnq6vbks53vfaxkm1ykpfcsbw1q3zmkrlrwsdd0zdxjsy1fx";
+  iosevka-slab = "07z3r27px5hsnz9rac290f2xraavflxqnd2ppmjiwz1yg9ch80d9";
+  iosevka-ss01 = "1fd5pjyxrqna98nghsp6rxbaqhmxch89s3jdvqdmpwj87jb6dkcc";
+  iosevka-ss02 = "13i8cqdh8g3wv8686g09aazjly157wvzgf5a6n1az4kcax9cawi3";
+  iosevka-ss03 = "1l1dkk6321czqrd7if4wwmps9r6in88952i1hqgjqr3r797x4k8p";
+  iosevka-ss04 = "1798nzr27pv9dpmjgp9bbivg9dcnk3cz603k3n3igmp8rb4rhz5f";
+  iosevka-ss05 = "0csxpmh6ymkgfhzl5x370y4qdl92cjhas25782n8carg16bc854f";
+  iosevka-ss06 = "12kmb4g0f31jr0d2gr66xjcjjqsmbr5hs0ynqbcsdpk4x58lv4y7";
+  iosevka-ss07 = "1fwdiyzs5prggzld9zip2bqzhngljwsy33cdbfq9526qakbxi67g";
+  iosevka-ss08 = "0yha45vyl0kdl593f04m26sl92vhklr1afd7yhmlkmhhhqp6bs9n";
+  iosevka-ss09 = "0av1npxxky47239x64rbrv7q7gb2lrgyzkaw1mqhafg6yzjn9iq5";
+  iosevka-ss10 = "0w3j04sjkrsd91vl7gyxbjjm76xx64p7b5c97p04xsa09gaig7i9";
+  iosevka-ss11 = "1vv20s4kp3mhngdpxzxwa1hldahxm1cxybnf1hzgd79a1162blhx";
+  iosevka-ss12 = "1yh200azn914s8lyzv8ga68ixxrqhcxx1rywxm3cpmm8iisvjf4y";
+  iosevka-ss13 = "0yvnzz53x0np7w53r5989chs9fcv81mckbf41z519r8l30m31bbj";
+  iosevka-ss14 = "17cv02gbzn0v8c8apdh7dd5s3y2qb9cydr8g5rbczzpvywixxrwr";
+  iosevka-ss15 = "04iqvjx0nkzikar4ivi7zswqvpcd954khmjjx8vicq3x56wggj8z";
+  iosevka-ss16 = "1q3krbi3vh8ry35s24cja77a8430x4n8i4anf8v7rh45sns37fmj";
+  iosevka-ss17 = "0vyzhix547j7yq717ffns6pd5mgis5sbxl85c1qf3nhij8czqg6l";
+  iosevka-ss18 = "0qikq8p8kvxw9lmrgzlm1g26bz3lppbc8jcgl8417jz400npfqg9";
+  sgr-iosevka = "095nwxsgwj671m962ix8qva5himdva0iqv9b5lapgb7acidrj8m7";
+  sgr-iosevka-aile = "1fkl0v7rclia5lwfm7f3vc3gkgnd88gf00icm6qka1xylzk8z83l";
+  sgr-iosevka-curly = "0q7dakcldx7j2cvn8hz079j81y5ab6ziqz6jr51w1whzb46al7rq";
+  sgr-iosevka-curly-slab = "0pw3fbygsgdw0isnv18axh49yxyfjdav6xizrvg6x4y8hispx0xp";
+  sgr-iosevka-etoile = "1fs22ap272hkf1wfymhbvgdpsrnxwadp8z6lv2hv5wy8ibc0ccia";
+  sgr-iosevka-fixed = "0bgag04jidcdj0gmsppc2lhvawpvylxs645sgxjj8bljy6480s96";
+  sgr-iosevka-fixed-curly = "0hgablbcb0wrpdkxw78pyvyni7dh457nwb10acwjxy6lbsshd88z";
+  sgr-iosevka-fixed-curly-slab = "1nb3izaq3slaxypylz3l6r8xjg7yy0yan08nsw8zny5lp0kaiqw9";
+  sgr-iosevka-fixed-slab = "16cc32ysmvifx736alp8bmcb9sjs1426sv72qydy99dafw34xhmm";
+  sgr-iosevka-fixed-ss01 = "0vvjj3dsfj8a60pg1qf7hcm6livsjc40xr0sfc9z1hx3dwjqpvlh";
+  sgr-iosevka-fixed-ss02 = "1yy9hqfdb897wi3nl5ny5j5i56jggbppx4ddckfa62a4jxvfks58";
+  sgr-iosevka-fixed-ss03 = "0qhk1w3gsd3qriyk9k33sfq46h9hn5zy9zk9cpd429z0xdps49kc";
+  sgr-iosevka-fixed-ss04 = "02psmn72r1mkza8n7p4sgrag7iz5zylnw03hnq6fnc4bqnn29gph";
+  sgr-iosevka-fixed-ss05 = "1w3jjjr8vvzjihpai9mivkcm2wngag6iva120zsqgb2n2k1z31bp";
+  sgr-iosevka-fixed-ss06 = "1icabqjnnsj59m4lg3qk820kdsq7hhl3gngfm5x4br43h031cdc7";
+  sgr-iosevka-fixed-ss07 = "0j9l18w7xxdgnw728zyphb52a76rbhb8cv388yc94wldzcmsk1jb";
+  sgr-iosevka-fixed-ss08 = "0js9pf92pgd944dywya1yjdx99sz56ra0nwxs9n9g0zn1rj5czwv";
+  sgr-iosevka-fixed-ss09 = "06bnyhx5rhkqjiwkjy1rxx6mby16wkyb1r4l3lkln5v6v0sfixfp";
+  sgr-iosevka-fixed-ss10 = "13y3vvcrm2v78bmadk051zr3izl0hpcxmfag34cikapzmf9vzxn3";
+  sgr-iosevka-fixed-ss11 = "1rwjzdz2ab90rv5p8hh870x9knhilqh0iiwfkyx8kjp7s9shhncp";
+  sgr-iosevka-fixed-ss12 = "0fj2szv0g2dclf7yhi8xc9hkgz1mw7kpc62hcvs3044ciga9cxrv";
+  sgr-iosevka-fixed-ss13 = "1z6rpf9l6yadzqgrdcyi75vd8mh75b6dx7d9bh06n8sjr5amhav5";
+  sgr-iosevka-fixed-ss14 = "0cp58j9c7fkm0q0ym99rhg7ljvzympwks4wk7l8vhh0wp2hfw78h";
+  sgr-iosevka-fixed-ss15 = "1fzs0c12abrf81yy1254nfiaq5q2rgvnv1yhqh985jmwcr010n83";
+  sgr-iosevka-fixed-ss16 = "16wffgq3b9d290kkbb6xa6z9aphn2d1wzqsqfr4mrkbhpwchbh0i";
+  sgr-iosevka-fixed-ss17 = "030l59270vyjhik8cn2jphdvd6vphr9ac8kqzx3bdbf1wgsr4sir";
+  sgr-iosevka-fixed-ss18 = "06qym0ffxy6j9hagpd3vrf6j5bd83ch150wkqg9rkg1i26q71v36";
+  sgr-iosevka-slab = "0mbdgpxkb3s4a8x0dvnjwqg3za0hl73n3a5vrmy8p694bnx1mi7r";
+  sgr-iosevka-ss01 = "0ilr1jiqmjmjfv4py1q3pdn3j20nh8j99629gq9g1zb82x1c9g9l";
+  sgr-iosevka-ss02 = "0l4cbx4v8zffbbq1lklk8knn0w6j9gjdp1f780k6x0z0jz3dxvdw";
+  sgr-iosevka-ss03 = "0dpl84ybj2h6nv03yy4vrwwksx4zms1c8fgr238w1nbhd7lnlyrv";
+  sgr-iosevka-ss04 = "0xlyjxsz6zc3gljvw0rsfgyv9xg1kvgsy2ibd2950vlxk2c597jb";
+  sgr-iosevka-ss05 = "02vfkdjq01jxjcvcnxs8g2snmq2gg56448yk0l0gna9mi1hagsk3";
+  sgr-iosevka-ss06 = "0b75h0al34f6w0s94i5c88pzs4zjl2iinkwjx855a036mdcqkz1l";
+  sgr-iosevka-ss07 = "1grqjqn9gckpgrrch9xa05ljpwr1rdr4lczsn89irhjz102s0bik";
+  sgr-iosevka-ss08 = "1mzbaslpy7pscmyiiz0k7czw3kjjc9an7mdb4yh99bpxwaskiv3k";
+  sgr-iosevka-ss09 = "1d7r2cv1w9q5h1frvzylizwimp8r6bdpg3fckcrdrfxsl0xfdffc";
+  sgr-iosevka-ss10 = "1jr01z6s476aggnnki0q4x24z35jx03fl4fh1l44pf3rckz7c0m9";
+  sgr-iosevka-ss11 = "05kybk7wskrg2i58h9n31sj1g6m93dcbbxr38y9nfcxb02cdbxp3";
+  sgr-iosevka-ss12 = "0pzrn3b5qj2q7k7slwvvz31j566l8xbmgk6kv324r3r19xcmsx31";
+  sgr-iosevka-ss13 = "1cgn33g39pnjkh452r396cyw00iskrr73k2jghw2ywb8ard024gc";
+  sgr-iosevka-ss14 = "0q74z4p3ybhaha4z6myasxyidy464vmccqk0bji6ks6fdklh2l3m";
+  sgr-iosevka-ss15 = "13gcgv08pwsbnr51b67w5hb9x5vcz7ridxjzwcnjhavssq3qn02x";
+  sgr-iosevka-ss16 = "1lkxrvd328ww8xi2189333p40awk7bb4d5k0mpcibp1r2hqbhx3x";
+  sgr-iosevka-ss17 = "0q4j381k2nz88y2nszd90ynmqyzna5il7j5illhdjk9dyp936f1p";
+  sgr-iosevka-ss18 = "16hdbvx9pa5z03i3dv8x40x6d8nvgxn4vga8sgdgpd2d5k8ibcq5";
+  sgr-iosevka-term = "0a16brmr2xsm48bcd5rrsv1c7b4yhvnkrlqp14p0fawyfs05bk5v";
+  sgr-iosevka-term-curly = "0a53j231zd1nkirp3fg6m72455gmkn0ipvdqswkkipxp5llbxkhx";
+  sgr-iosevka-term-curly-slab = "1ypbffwg7pihq5ywy59y3f2d8dw8p5lzk2284336z3a7i8kzmhpq";
+  sgr-iosevka-term-slab = "0rcf9i8fibrvmhzmm192crl7jlv7bwda7b12865w4g719a8ksdsv";
+  sgr-iosevka-term-ss01 = "0h12vz7qkl6xflffiqjqqkd1ziqkg2pi1s8pk28ak706fv4k203n";
+  sgr-iosevka-term-ss02 = "19d3hqlwv7pi9xyh9amshirbj6ypg6ka5g6hz9dmmh0pmwhcvpjs";
+  sgr-iosevka-term-ss03 = "09b3ghyvrjx8dnh8i9ly3cmkbpl10gn1283q9bjamcc8niva6g36";
+  sgr-iosevka-term-ss04 = "0l27i49myv81x09bj8ii732zc6473psa58ls2zgvd7yz2bihi3ar";
+  sgr-iosevka-term-ss05 = "0421p4y94zxwvc7qyl4zgxld3jrx12wsjirmvfxvfndn0f4dwqyk";
+  sgr-iosevka-term-ss06 = "0dl62wnqfqrryp0hrj073yvvy225swv9kcldhygapi16mw97v30b";
+  sgr-iosevka-term-ss07 = "03sipvjji22g0gajj0vxkmsc81fd173bb816vjv56fh489g04hn3";
+  sgr-iosevka-term-ss08 = "0j0y2dzn6a8r0yg40kajzrhyvl5yf2b8hm7n9970h0gl3rrk5pxa";
+  sgr-iosevka-term-ss09 = "1y37cr436hwb1iqqsybg0w595kbn0373hm0zmwcsmsxb25166lcf";
+  sgr-iosevka-term-ss10 = "1ngyppn90nn8f59xkh63ifl077w0zldjxzxjw8skx2jhj2kis537";
+  sgr-iosevka-term-ss11 = "193snjki9wd6cjpd754g7pvhlyg3yizlcjhcw9x0zx60830xcbd3";
+  sgr-iosevka-term-ss12 = "000maksimlm3gapp8d3cwymkmkg4n0dcwxvlxwgi2a6f5rwgfm8n";
+  sgr-iosevka-term-ss13 = "09yfj7kxd0p2w1dd1n8hwr3j2plqiq7l17rhh0lys1clyw1jrph8";
+  sgr-iosevka-term-ss14 = "16fipp8pka2187mclsf24sxx7idcqh4nn4z63glrg6695g8r0vd0";
+  sgr-iosevka-term-ss15 = "0yaj5all8jljzyhd5qmgvmiwv7whx4f9zvxgv3l53xxww5i5yhiz";
+  sgr-iosevka-term-ss16 = "163g9mj2n8z21nr5yslnq8m4m7j4aq7q918zs8nd5hggjzhqpy9y";
+  sgr-iosevka-term-ss17 = "07zicd0f8bclwxfkvxy6x6bhccz3334wmgfxqpzx36sshyhvfihg";
+  sgr-iosevka-term-ss18 = "1qwxyyqv483p05mvkar9vb2m349is0qgdijri8ipran73w363fhc";
 }
diff --git a/pkgs/data/fonts/sarasa-gothic/default.nix b/pkgs/data/fonts/sarasa-gothic/default.nix
index 3498e840eae..417008490bc 100644
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sarasa-gothic";
-  version = "0.40.5";
+  version = "0.40.6";
 
   src = fetchurl {
     # Use the 'ttc' files here for a smaller closure size.
     # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
     url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-    hash = "sha256-bs3o8+LyCTCZvUYigUWfSmjFrzPg7nLzElZYxDEsQ9k=";
+    hash = "sha256-AHslDiYBQXcxo8XVh1GMZDR8LJXvzJHl4hrisfhltEM=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/development/compilers/cmdstan/default.nix b/pkgs/development/compilers/cmdstan/default.nix
index 9470db3d38c..5af4699eff5 100644
--- a/pkgs/development/compilers/cmdstan/default.nix
+++ b/pkgs/development/compilers/cmdstan/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "cmdstan";
-  version = "2.31.0";
+  version = "2.32.0";
 
   src = fetchFromGitHub {
     owner = "stan-dev";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-Uh/ZhEnbhQwC8xGFjDzH9No3VRgVbHYk2KoC+e3YhJw=";
+    hash = "sha256-H8JXOqiSG9N+DD84S3iYvXnSgKUJuf7UZ7qT05Ti8xQ=";
   };
 
   nativeBuildInputs = [ stanc ];
diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
index 642bcff6469..2cc1844801f 100644
--- a/pkgs/development/compilers/flutter/default.nix
+++ b/pkgs/development/compilers/flutter/default.nix
@@ -1,25 +1,26 @@
-{ callPackage, fetchurl, dart }:
+{ callPackage, fetchzip, dart }:
 let
-  mkFlutter = opts: callPackage (import ./flutter.nix opts) { };
+  mkFlutter = { version, engineVersion, patches, dart, src }: callPackage ./flutter.nix { inherit version engineVersion patches dart src; };
+  wrapFlutter = flutter: callPackage ./wrapper.nix { inherit flutter; };
   getPatches = dir:
     let files = builtins.attrNames (builtins.readDir dir);
     in map (f: dir + ("/" + f)) files;
-  flutterDrv = { version, pname, dartVersion, hash, dartHash, patches }: mkFlutter {
-    inherit version pname patches;
+  flutterDrv = { version, engineVersion, dartVersion, hash, dartHash, patches }: mkFlutter {
+    inherit version engineVersion patches;
     dart = dart.override {
       version = dartVersion;
       sources = {
-        "${dartVersion}-x86_64-linux" = fetchurl {
+        "${dartVersion}-x86_64-linux" = fetchzip {
           url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
           sha256 = dartHash.x86_64-linux;
         };
-        "${dartVersion}-aarch64-linux" = fetchurl {
+        "${dartVersion}-aarch64-linux" = fetchzip {
           url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-linux-arm64-release.zip";
           sha256 = dartHash.aarch64-linux;
         };
       };
     };
-    src = fetchurl {
+    src = fetchzip {
       url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${version}-stable.tar.xz";
       sha256 = hash;
     };
@@ -28,27 +29,27 @@ let
   flutter3Patches = getPatches ./patches/flutter3;
 in
 {
-  inherit mkFlutter flutterDrv flutter2Patches flutter3Patches;
+  inherit mkFlutter wrapFlutter flutterDrv flutter3Patches flutter2Patches;
   stable = flutterDrv {
-    pname = "flutter";
-    version = "3.3.8";
-    dartVersion = "2.18.4";
-    hash = "sha256-QH+10F6a0XYEvBetiAi45Sfy7WTdVZ1i8VOO4JuSI24=";
+    version = "3.7.12";
+    engineVersion = "1a65d409c7a1438a34d21b60bf30a6fd5db59314";
+    dartVersion = "2.19.6";
+    hash = "sha256-5ExDBQXIpoZ5NwS66seY3m9/V8xDiyq/RdzldAyHdEE=";
     dartHash = {
-      x86_64-linux = "sha256-lFw+KaxzhuAMnu6ypczINqywzpiD+8Kd+C/UHJDrO9Y=";
-      aarch64-linux = "sha256-snlFTY4oJ4ALGLc210USbI2Z///cx1IVYUWm7Vo5z2I=";
+      x86_64-linux = "sha256-4ezRuwhQHVCxZg5WbzU/tBUDvZVpfCo6coDE4K0UzXo=";
+      aarch64-linux = "sha256-pYmClIqOo0sRPOkrcF4xQbo0mHlrr1TkhT1fnNyYNck=";
     };
     patches = flutter3Patches;
   };
 
   v2 = flutterDrv {
-    pname = "flutter";
     version = "2.10.5";
+    engineVersion = "57d3bac3dd5cb5b0e464ab70e7bc8a0d8cf083ab";
     dartVersion = "2.16.2";
-    hash = "sha256-DTZwxlMUYk8NS1SaWUJolXjD+JnRW73Ps5CdRHDGnt0=";
+    hash = "sha256-MxaWvlcCfXN8gsC116UMzqb4LgixHL3YjrGWy7WYgW4=";
     dartHash = {
-      x86_64-linux = "sha256-egrYd7B4XhkBiHPIFE2zopxKtQ58GqlogAKA/UeiXnI=";
-      aarch64-linux = "sha256-vmerjXkUAUnI8FjK+62qLqgETmA+BLPEZXFxwYpI+KY=";
+      x86_64-linux = "sha256-vxKxysg6e3Qxtlp4dLxOZaBtgHGtl7XYd73zFZd9yJc=";
+      aarch64-linux = "sha256-ZfpR6fj/a9Bsgrg31Z/uIJaCHIWtcQH3VTTVkDJKkwA=";
     };
     patches = flutter2Patches;
   };
diff --git a/pkgs/development/compilers/flutter/engine-artifacts/default.nix b/pkgs/development/compilers/flutter/engine-artifacts/default.nix
new file mode 100644
index 00000000000..214a195e0c4
--- /dev/null
+++ b/pkgs/development/compilers/flutter/engine-artifacts/default.nix
@@ -0,0 +1,128 @@
+{ lib
+, stdenv
+, hostPlatform
+, engineVersion
+, fetchzip
+, autoPatchelfHook
+
+, gtk3
+}:
+
+let
+  hashes = (import ./hashes.nix).${engineVersion} or
+    (throw "There are no known artifact hashes for Flutter engine version ${engineVersion}.");
+
+  artifacts =
+    {
+      common = {
+        flutter_patched_sdk = { archive = "flutter_patched_sdk.zip"; };
+        flutter_patched_sdk_product = { archive = "flutter_patched_sdk_product.zip"; };
+      };
+      platform = {
+        android =
+          (lib.genAttrs
+            [ "arm" "arm64" "x64" ]
+            (arch:
+              {
+                base = [
+                  { archive = "artifacts.zip"; }
+                ];
+                variants = lib.genAttrs [ "profile" "release" ]
+                  (variant: [
+                    { archive = "artifacts.zip"; }
+                    { archive = "${lib.toLower hostPlatform.uname.system}-x64.zip"; }
+                  ]);
+              })) //
+          {
+            "x86" = {
+              base = [
+                { archive = "artifacts.zip"; }
+              ];
+              variants.jit-release = [
+                { archive = "artifacts.zip"; }
+              ];
+            };
+          };
+
+        linux = lib.genAttrs
+          [ "arm64" "x64" ]
+          (arch:
+            let
+              linux-flutter-gtk = {
+                archive = "linux-${arch}-flutter-gtk.zip";
+                buildInputs = [ gtk3 ];
+              };
+            in
+            {
+              base = [
+                ({ archive = "artifacts.zip"; } // lib.optionalAttrs (arch == "arm64") {
+                  # For some reason, the arm64 artifacts are missing shader code.
+                  postPatch = ''
+                    if [ -d shader_lib ]; then
+                      The shader_lib directory has been included in the artifact archive.
+                      This patch should be removed.
+                    fi
+                    ln -s ${lib.findSingle
+                      (pkg: lib.getName pkg == "flutter-artifact-linux-x64-artifacts")
+                      (throw "Could not find the x64 artifact archive.")
+                      (throw "Could not find the correct x64 artifact archive.")
+                      artifactDerivations.platform.linux.x64.base
+                    }/shader_lib .
+                  '';
+                })
+                { archive = "font-subset.zip"; }
+                linux-flutter-gtk
+              ];
+              variants = lib.genAttrs [ "debug" "profile" "release" ] (variant: [
+                linux-flutter-gtk
+              ]);
+            });
+      };
+    };
+
+  mkArtifactDerivation = { platform ? null, variant ? null, archive, ... }@args:
+    let
+      artifactDirectory = if platform == null then null else "${platform}${lib.optionalString (variant != null) "-${variant}"}";
+      archiveBasename = lib.removeSuffix ".${(lib.last (lib.splitString "." archive))}" archive;
+    in
+    stdenv.mkDerivation ({
+      pname = "flutter-artifact${lib.optionalString (platform != null) "-${artifactDirectory}"}-${archiveBasename}";
+      version = engineVersion;
+
+      src = fetchzip {
+        url = "https://storage.googleapis.com/flutter_infra_release/flutter/${engineVersion}${lib.optionalString (platform != null) "/${artifactDirectory}"}/${archive}";
+        stripRoot = false;
+        hash = (if artifactDirectory == null then hashes else hashes.${artifactDirectory}).${archive};
+      };
+
+      nativeBuildInputs = [ autoPatchelfHook ];
+
+      installPhase = "cp -r . $out";
+    } // args);
+
+  artifactDerivations = {
+    common = builtins.mapAttrs (name: mkArtifactDerivation) artifacts.common;
+    platform =
+      builtins.mapAttrs
+        (os: architectures:
+          builtins.mapAttrs
+            (architecture: variants: {
+              base = map
+                (args: mkArtifactDerivation ({
+                  platform = "${os}-${architecture}";
+                } // args))
+                variants.base;
+              variants = builtins.mapAttrs
+                (variant: variantArtifacts: map
+                  (args: mkArtifactDerivation ({
+                    platform = "${os}-${architecture}";
+                    inherit variant;
+                  } // args))
+                  variantArtifacts)
+                variants.variants;
+            })
+            architectures)
+        artifacts.platform;
+  };
+in
+artifactDerivations
diff --git a/pkgs/development/compilers/flutter/engine-artifacts/hashes.nix b/pkgs/development/compilers/flutter/engine-artifacts/hashes.nix
new file mode 100644
index 00000000000..e3453748b05
--- /dev/null
+++ b/pkgs/development/compilers/flutter/engine-artifacts/hashes.nix
@@ -0,0 +1,144 @@
+{
+  "1a65d409c7a1438a34d21b60bf30a6fd5db59314" = {
+    "flutter_patched_sdk.zip" = "sha256-Pvsjttm5OwpJ/pW4UQXvvEiJYCM5CoZZfVXz5jef37k=";
+    "flutter_patched_sdk_product.zip" = "sha256-fhj2uUOrLwrzHrM6RNVpPNize5Qu6mLQDcSzLT2TbRA=";
+    "android-arm" = {
+      "artifacts.zip" = "sha256-KDMiI6SQoZHfFV5LJJZ7VOGyEKC4UxzRc777j4BbXgM=";
+    };
+    "android-arm-profile" = {
+      "artifacts.zip" = "sha256-MErLoGJWXg4yJ6b6c5bqP8Nat6O7eYSfM71mMNAAQf4=";
+      "linux-x64.zip" = "sha256-0TZQ05HR7NRqHzeoHZ/sOrjKiSvCpMUH85YXXzV4URg=";
+    };
+    "android-arm-release" = {
+      "artifacts.zip" = "sha256-hU4S4FOqUGokByZ47nzOqQ4A9QFshruqrpJvJUBHUho=";
+      "linux-x64.zip" = "sha256-AqNlqjOht+c2sdW5ReoF66ZJWJl1W4vGKbQ3YyderRY=";
+    };
+    "android-arm64" = {
+      "artifacts.zip" = "sha256-ApNg3Uu9gyGNsx7sdpTCz1yADVAI5ZuNHgvgiuH9IpQ=";
+    };
+    "android-arm64-profile" = {
+      "artifacts.zip" = "sha256-D/8+WKPIkOaV3PwkCHiJROFlokm4lWWmtPQb93Yqwr0=";
+      "linux-x64.zip" = "sha256-S0RHLov6/C22VvGdvZV87Ybaxun8YBrw1gTgNklRcM0=";
+    };
+    "android-arm64-release" = {
+      "artifacts.zip" = "sha256-OoYqHtwmT+VWJ+G+sMXM5+ux3h1Fnyo9Vj2za9cm5eE=";
+      "linux-x64.zip" = "sha256-NuXclg1a+Ofw5AWJ1tajpn2jYEZw6DluWxrFVL8rPfg=";
+    };
+    "android-x86" = {
+      "artifacts.zip" = "sha256-nN66nIrcbJHq2S4oIT5e2NCv7mS5Kw+HBv3ReHs+d3Y=";
+    };
+    "android-x86-jit-release" = {
+      "artifacts.zip" = "sha256-A8F6K78Ykp1rMsUmjD7B9nFFPAubZnqAqgWSzbNCRwk=";
+    };
+    "android-x64" = {
+      "artifacts.zip" = "sha256-hrBvnzCj/24h5kat96avlgXi6WhMsos5aPlkgxOYo8Q=";
+    };
+    "android-x64-profile" = {
+      "artifacts.zip" = "sha256-xzSj/2ah9aQoosaNGkSWFP3bMNJqRSFc0+78XEBHwzM=";
+      "linux-x64.zip" = "sha256-HfBiz1JWlBQ8KEfmf8uDlVzFlDt3+VF2VeY82tsMjHs=";
+    };
+    "android-x64-release" = {
+      "artifacts.zip" = "sha256-TcfMeA+8Uf9yRrYdEIsjip0cKmSUm2Ow1tkoE9803XY=";
+      "linux-x64.zip" = "sha256-D6efb6pj9+xjPnJu3O+ZCmwfatBzasuFZEFRntAiU9U=";
+    };
+    "linux-arm64" = {
+      "artifacts.zip" = "sha256-xyKVaEFb5gVkVrPzDrOql5BmXGO0FnCSeXOoQ10ZFrw=";
+      "font-subset.zip" = "sha256-Ulwb6q2SzB4suMJhAM3zAwWOzlEImlu9Ha+w5u4QqIU=";
+      "linux-arm64-flutter-gtk.zip" = "sha256-SiYOH++py4zeoD3BkNayqy/C9Zz9OiYQ5+u+pDLIpWg=";
+    };
+    "linux-arm64-debug" = {
+      "linux-arm64-flutter-gtk.zip" = "sha256-SiYOH++py4zeoD3BkNayqy/C9Zz9OiYQ5+u+pDLIpWg=";
+    };
+    "linux-arm64-profile" = {
+      "linux-arm64-flutter-gtk.zip" = "sha256-xB0eqrBYD7vhOwYUgJwNaBftNZJgdwxA9AUpEfX0iFs=";
+    };
+    "linux-arm64-release" = {
+      "linux-arm64-flutter-gtk.zip" = "sha256-aHLKV129WIRsLUG6xTMwCKB4eXD3jonqinjI8KSsOus=";
+    };
+    "linux-x64" = {
+      "artifacts.zip" = "sha256-+zIABFXUpiqn3OMoLcU4NDLxZ1y9z0r46iCTNRHAkz8=";
+      "font-subset.zip" = "sha256-W4SRPvA4rraVqN1ehbY6MFL7ZIWDHVJhjlLtxyUJJKY=";
+      "linux-x64-flutter-gtk.zip" = "sha256-boICnuJF4zqGb7kaN5haO/df9hC9KeJidt3uIK06S7M=";
+    };
+    "linux-x64-debug" = {
+      "linux-x64-flutter-gtk.zip" = "sha256-boICnuJF4zqGb7kaN5haO/df9hC9KeJidt3uIK06S7M=";
+    };
+    "linux-x64-profile" = {
+      "linux-x64-flutter-gtk.zip" = "sha256-RAsgupVF18IxLaP8tJ7XRQ8y/um46nlpA8fDITPwLqY=";
+    };
+    "linux-x64-release" = {
+      "linux-x64-flutter-gtk.zip" = "sha256-RAsgupVF18IxLaP8tJ7XRQ8y/um46nlpA8fDITPwLqY=";
+    };
+  };
+  "57d3bac3dd5cb5b0e464ab70e7bc8a0d8cf083ab" = {
+    "flutter_patched_sdk.zip" = "sha256-A/y5Y+Aw0CUhXABbdyQcGCSnSbO7Ask+71m8LZDSjH4=";
+    "flutter_patched_sdk_product.zip" = "sha256-VPxF4NrTUhFbpztyPnLEiC9Cy0kDDbYvy21kA5ES4HM=";
+    "android-arm" = {
+      "artifacts.zip" = "sha256-3igOO+rgFh0fNTIIiiucqSmqC+NKFPG5H1CnIa9bDcM=";
+    };
+    "android-arm-profile" = {
+      "artifacts.zip" = "sha256-qai254LNrQXJBsaoQgXao6mBpzzcYHh4sUESurSyxNA=";
+      "linux-x64.zip" = "sha256-hBkntf1fX5w752ly6lVUHm6wEM/4ep9guJGma3SKjxU=";
+    };
+    "android-arm-release" = {
+      "artifacts.zip" = "sha256-7yuXIJyErb1PZyk56+TtlJY0o1EOwmdAvpVfGGAteuA=";
+      "linux-x64.zip" = "sha256-v/jBnE662XOX/fOhYbve7ZiQwVu0haIMOD532Vdj9Yw=";
+    };
+    "android-arm64" = {
+      "artifacts.zip" = "sha256-Llxu8+SkYEtnoiMf01rffPpF/AjrlV+QPuAW850oMzo=";
+    };
+    "android-arm64-profile" = {
+      "artifacts.zip" = "sha256-su4U80supv8Q+2kE/5FTybiA5NFbKNMHqdB0NHCqrVI=";
+      "linux-x64.zip" = "sha256-yGt0SztNxYHDwZ1DwzLg5REE8rmMRKNn7GfCQ+GEHBw=";
+    };
+    "android-arm64-release" = {
+      "artifacts.zip" = "sha256-+p1+SXSEglR3jqWc/jKgmtR9nOGgMRGC+anoTs1kRc8=";
+      "linux-x64.zip" = "sha256-5UiG5gxOso8NO+7nkb6bjxW8e/Tr7mlvPRUagSRTCNs=";
+    };
+    "android-x86" = {
+      "artifacts.zip" = "sha256-Cbo17VYWaclyO1RLHkwjbqoFVZ283IgGdN0uDdiWvQs=";
+    };
+    "android-x86-jit-release" = {
+      "artifacts.zip" = "sha256-gSPm2tClTj2vEYtGKgobD/mebWLNlDp8nEoFX0rhEOk=";
+    };
+    "android-x64" = {
+      "artifacts.zip" = "sha256-PVb1aKMMTlDT41O2MZRAUjCq8h+m/s2h5qOnEFPd77w=";
+    };
+    "android-x64-profile" = {
+      "artifacts.zip" = "sha256-gZSSRCDy42AMLMiu/KH7YsDuFVaxRcoyXzUgV8V025Y=";
+      "linux-x64.zip" = "sha256-9+LCjeI18u/GlPDMIl6Jx6b++lc90fJ5tVBlDR+ctDs=";
+    };
+    "android-x64-release" = {
+      "artifacts.zip" = "sha256-rsS08VP86/b2S0TEYusCEJBvS4BuevsmV9REAxRgJIc=";
+      "linux-x64.zip" = "sha256-H4nFCJ+iCUzIwHogYzS+h33eDMaFnz71dcDLSQW1aPg=";
+    };
+    "linux-arm64" = {
+      "artifacts.zip" = "sha256-kCxsKQQQX6wzhD46bfoflKdz3AYYkoSyavhfyTDuHLU=";
+      "font-subset.zip" = "sha256-Yk6JsNWe7ftEQU/TsjDUZSFeLzeIbcS63lhl8fsWsdk=";
+      "linux-arm64-flutter-gtk.zip" = "sha256-girVdkXrTO5tssoi+eKwG9ykstCR/VOx8zWtcAz8AKM=";
+    };
+    "linux-arm64-debug" = {
+      "linux-arm64-flutter-gtk.zip" = "sha256-girVdkXrTO5tssoi+eKwG9ykstCR/VOx8zWtcAz8AKM=";
+    };
+    "linux-arm64-profile" = {
+      "linux-arm64-flutter-gtk.zip" = "sha256-VL5cwYaZ1FOJ3TwJzbgvHDQwkU9NrHGnf/tQhZ/dAGg=";
+    };
+    "linux-arm64-release" = {
+      "linux-arm64-flutter-gtk.zip" = "sha256-27hy7mLFCLkqJbn+5p5eJdYnfBKTyfFe98iUMmKyz4g=";
+    };
+    "linux-x64" = {
+      "artifacts.zip" = "sha256-JgEX+rKxdcWBBaxyR42eC7qOAvaawF9M2+rfaD4IgeA=";
+      "font-subset.zip" = "sha256-5EoxBrxSjaLLd+rKrxVYNoUZaejk0qcQ5LVsmqtKc2g=";
+      "linux-x64-flutter-gtk.zip" = "sha256-MH5HDPoXXi/KpQLQ0U1tQzZ0sbZx1RVhZtQ7L+WhZgk=";
+    };
+    "linux-x64-debug" = {
+      "linux-x64-flutter-gtk.zip" = "sha256-MH5HDPoXXi/KpQLQ0U1tQzZ0sbZx1RVhZtQ7L+WhZgk=";
+    };
+    "linux-x64-profile" = {
+      "linux-x64-flutter-gtk.zip" = "sha256-r2hB/AKrB5vNga2fve4tTM4j+Zp9KDqNlTjKQhQvbaI=";
+    };
+    "linux-x64-release" = {
+      "linux-x64-flutter-gtk.zip" = "sha256-muREs2iUiHCZM+SGN5q3HRRGnejJapKN582Aeog49MI=";
+    };
+  };
+}
diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
index f755d3118af..92d635be967 100644
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@@ -1,190 +1,196 @@
-{ pname
-, version
+{ version
+, engineVersion
 , patches
 , dart
 , src
-}:
+, includedEngineArtifacts ? {
+    common = [
+      "flutter_patched_sdk"
+      "flutter_patched_sdk_product"
+    ];
+    platform = {
+      android = lib.optionalAttrs stdenv.hostPlatform.isx86_64
+        ((lib.genAttrs [ "arm" "arm64" "x64" ] (architecture: [ "profile" "release" ])) // { x86 = [ "jit-release" ]; });
+      linux = lib.optionals stdenv.hostPlatform.isLinux
+        (lib.genAttrs ((lib.optional stdenv.hostPlatform.isx86_64 "x64") ++ (lib.optional stdenv.hostPlatform.isAarch64 "arm64"))
+          (architecture: [ "debug" "profile" "release" ]));
+    };
+  }
 
-{ bash
-, buildFHSEnv
-, cacert
-, git
-, runCommand
-, stdenv
 , lib
-, alsa-lib
-, dbus
-, expat
-, libpulseaudio
-, libuuid
-, libX11
-, libxcb
-, libXcomposite
-, libXcursor
-, libXdamage
-, libXfixes
-, libXrender
-, libXtst
-, libXi
-, libXext
-, libGL
-, nspr
-, nss
-, systemd
-, which
 , callPackage
-}:
-let
-  drvName = "flutter-${version}";
-  flutter = stdenv.mkDerivation {
-    name = "${drvName}-unwrapped";
-
-    buildInputs = [ git ];
-
-    inherit src patches version;
-
-    postPatch = ''
-      patchShebangs --build ./bin/
-    '';
-
-    buildPhase = ''
-      export FLUTTER_ROOT="$(pwd)"
-      export FLUTTER_TOOLS_DIR="$FLUTTER_ROOT/packages/flutter_tools"
-      export SCRIPT_PATH="$FLUTTER_TOOLS_DIR/bin/flutter_tools.dart"
-
-      export SNAPSHOT_PATH="$FLUTTER_ROOT/bin/cache/flutter_tools.snapshot"
-      export STAMP_PATH="$FLUTTER_ROOT/bin/cache/flutter_tools.stamp"
-
-      export DART_SDK_PATH="${dart}"
-
-      HOME=../.. # required for pub upgrade --offline, ~/.pub-cache
-                 # path is relative otherwise it's replaced by /build/flutter
-
-      pushd "$FLUTTER_TOOLS_DIR"
-      ${dart}/bin/dart pub get --offline
-      popd
-
-      local revision="$(cd "$FLUTTER_ROOT"; git rev-parse HEAD)"
-      ${dart}/bin/dart --snapshot="$SNAPSHOT_PATH" --packages="$FLUTTER_TOOLS_DIR/.dart_tool/package_config.json" "$SCRIPT_PATH"
-      echo "$revision" > "$STAMP_PATH"
-      echo -n "${version}" > version
-
-      rm -r bin/cache/{artifacts,dart-sdk,downloads}
-      rm bin/cache/*.stamp
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out
-      cp -r . $out
-      mkdir -p $out/bin/cache/
-      ln -sf ${dart} $out/bin/cache/dart-sdk
-
-      runHook postInstall
-    '';
-
-    doInstallCheck = true;
-    nativeInstallCheckInputs = [ which ];
-    installCheckPhase = ''
-      runHook preInstallCheck
-
-      export HOME="$(mktemp -d)"
-      $out/bin/flutter config --android-studio-dir $HOME
-      $out/bin/flutter config --android-sdk $HOME
-      $out/bin/flutter --version | fgrep -q '${version}'
-
-      runHook postInstallCheck
-    '';
-  };
-
-  # Wrap flutter inside an fhs user env to allow execution of binary,
-  # like adb from $ANDROID_HOME or java from android-studio.
-  fhsEnv = buildFHSEnv {
-    name = "${drvName}-fhs-env";
-    multiPkgs = pkgs: [
-      # Flutter only use these certificates
-      (runCommand "fedoracert" { } ''
-        mkdir -p $out/etc/pki/tls/
-        ln -s ${cacert}/etc/ssl/certs $out/etc/pki/tls/certs
-      '')
-      pkgs.zlib
-    ];
-    targetPkgs = pkgs:
-      with pkgs; [
-        bash
-        curl
-        dart
-        git
-        unzip
-        which
-        xz
-
-        # flutter test requires this lib
-        libGLU
-
-        # for android emulator
-        alsa-lib
-        dbus
-        expat
-        libpulseaudio
-        libuuid
-        libX11
-        libxcb
-        libXcomposite
-        libXcursor
-        libXdamage
-        libXext
-        libXfixes
-        libXi
-        libXrender
-        libXtst
-        libGL
-        nspr
-        nss
-        systemd
-      ];
-  };
+, stdenv
+, runCommandLocal
+, symlinkJoin
+, lndir
+, git
+, which
+}@args:
 
-in
 let
-self = (self:
-runCommand drvName
-{
-  startScript = ''
-    #!${bash}/bin/bash
-    export PUB_CACHE=''${PUB_CACHE:-"$HOME/.pub-cache"}
-    export ANDROID_EMULATOR_USE_SYSTEM_LIBS=1
-    ${fhsEnv}/bin/${drvName}-fhs-env ${flutter}/bin/flutter --no-version-check "$@"
-  '';
-  preferLocalBuild = true;
-  allowSubstitutes = false;
-  passthru = {
-    unwrapped = flutter;
-    inherit dart;
-    mkFlutterApp = callPackage ../../../build-support/flutter {
-      flutter = self;
+  engineArtifactDirectory =
+    let
+      engineArtifacts = callPackage ./engine-artifacts { inherit engineVersion; };
+    in
+    runCommandLocal "flutter-engine-artifacts-${version}" { }
+      (
+        let
+          mkCommonArtifactLinkCommand = { artifact }:
+            ''
+              mkdir -p $out/common
+              ${lndir}/bin/lndir -silent ${artifact} $out/common
+            '';
+          mkPlatformArtifactLinkCommand = { artifact, os, architecture, variant ? null }:
+            let
+              artifactDirectory = "${os}-${architecture}${lib.optionalString (variant != null) "-${variant}"}";
+            in
+            ''
+              mkdir -p $out/${artifactDirectory}
+                ${lndir}/bin/lndir -silent ${artifact} $out/${artifactDirectory}
+            '';
+        in
+        ''
+          ${
+            builtins.concatStringsSep "\n"
+              ((map (name: mkCommonArtifactLinkCommand {
+                artifact = engineArtifacts.common.${name};
+              }) (if includedEngineArtifacts ? common then includedEngineArtifacts.common else [ ])) ++
+              (builtins.foldl' (commands: os: commands ++
+                (builtins.foldl' (commands: architecture: commands ++
+                  (builtins.foldl' (commands: variant: commands ++
+                    (map (artifact: mkPlatformArtifactLinkCommand {
+                      inherit artifact os architecture variant;
+                    }) engineArtifacts.platform.${os}.${architecture}.variants.${variant}))
+                  (map (artifact: mkPlatformArtifactLinkCommand {
+                    inherit artifact os architecture;
+                  }) engineArtifacts.platform.${os}.${architecture}.base)
+                  includedEngineArtifacts.platform.${os}.${architecture}))
+                [] (builtins.attrNames includedEngineArtifacts.platform.${os})))
+              [] (builtins.attrNames (if includedEngineArtifacts ? platform then includedEngineArtifacts.platform else { }))))
+          }
+        ''
+      );
+
+  unwrapped =
+    stdenv.mkDerivation {
+      name = "flutter-${version}-unwrapped";
+      inherit src patches version;
+
+      outputs = [ "out" "cache" ];
+
+      buildInputs = [ git ];
+
+      preConfigure = ''
+        if [ "$(< bin/internal/engine.version)" != '${engineVersion}' ]; then
+          echo 1>&2 "The given engine version (${engineVersion}) does not match the version required by the Flutter SDK ($(< bin/internal/engine.version))."
+          exit 1
+        fi
+      '';
+
+      postPatch = ''
+        patchShebangs --build ./bin/
+      '';
+
+      buildPhase = ''
+        export FLUTTER_ROOT="$(pwd)"
+        export FLUTTER_TOOLS_DIR="$FLUTTER_ROOT/packages/flutter_tools"
+        export SCRIPT_PATH="$FLUTTER_TOOLS_DIR/bin/flutter_tools.dart"
+
+        export SNAPSHOT_PATH="$FLUTTER_ROOT/bin/cache/flutter_tools.snapshot"
+        export STAMP_PATH="$FLUTTER_ROOT/bin/cache/flutter_tools.stamp"
+
+        export DART_SDK_PATH="${dart}"
+
+        # The Flutter tool compilation requires dependencies to be cached, as there is no Internet access.
+        # Dart expects package caches to be mutable, and does not support composing cache directories.
+        # The packages cached during the build therefore cannot be easily used. They are provided through
+        # the derivation's "cache" output, though, in case they are needed.
+        #
+        # Note that non-cached packages will normally be fetched from the Internet when they are needed, so Flutter
+        # will function without an existing package cache as long as it has an Internet connection.
+        export PUB_CACHE="$cache"
+
+        if [ -d .pub-preload-cache ]; then
+          ${dart}/bin/dart pub cache preload .pub-preload-cache/*
+        elif [ -d .pub-cache ]; then
+          mv .pub-cache "$PUB_CACHE"
+        else
+          echo 'ERROR: Failed to locate the Dart package cache required to build the Flutter tool.'
+          exit 1
+        fi
+
+        pushd "$FLUTTER_TOOLS_DIR"
+        ${dart}/bin/dart pub get --offline
+        popd
+
+        local revision="$(cd "$FLUTTER_ROOT"; git rev-parse HEAD)"
+        ${dart}/bin/dart --snapshot="$SNAPSHOT_PATH" --packages="$FLUTTER_TOOLS_DIR/.dart_tool/package_config.json" "$SCRIPT_PATH"
+        echo "$revision" > "$STAMP_PATH"
+        echo -n "${version}" > version
+
+        # Certain prebuilts should be replaced with Nix-built (or at least Nix-patched) equivalents.
+        rm -r \
+          bin/cache/dart-sdk \
+          bin/cache/artifacts/engine
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        mkdir -p $out
+        cp -r . $out
+        ln -sf ${dart} $out/bin/cache/dart-sdk
+        ln -sf ${engineArtifactDirectory} $out/bin/cache/artifacts/engine
+
+        runHook postInstall
+      '';
+
+      doInstallCheck = true;
+      nativeInstallCheckInputs = [ which ];
+      installCheckPhase = ''
+        runHook preInstallCheck
+
+        export HOME="$(mktemp -d)"
+        $out/bin/flutter config --android-studio-dir $HOME
+        $out/bin/flutter config --android-sdk $HOME
+        $out/bin/flutter --version | fgrep -q '${version}'
+
+        runHook postInstallCheck
+      '';
+
+      passthru = {
+        inherit dart;
+
+        # The derivation containing the original Flutter SDK files.
+        # When other derivations wrap this one, any unmodified files
+        # found here should be included as-is, for tooling compatibility.
+        sdk = unwrapped;
+        buildFlutterApplication = callPackage ../../../build-support/flutter {
+          # Package a minimal version of Flutter that only uses Linux desktop release artifacts.
+          flutter = callPackage ./wrapper.nix {
+            flutter = callPackage ./flutter.nix (args // {
+              includedEngineArtifacts = {
+                common = [ "flutter_patched_sdk_product" ];
+                platform.linux = lib.optionals stdenv.hostPlatform.isLinux
+                  (lib.genAttrs ((lib.optional stdenv.hostPlatform.isx86_64 "x64") ++ (lib.optional stdenv.hostPlatform.isAarch64 "arm64"))
+                    (architecture: [ "release" ]));
+              };
+            });
+          };
+        };
+      };
+
+      meta = with lib; {
+        description = "Flutter is Google's SDK for building mobile, web and desktop with Dart";
+        longDescription = ''
+          Flutter is Google’s UI toolkit for building beautiful,
+          natively compiled applications for mobile, web, and desktop from a single codebase.
+        '';
+        homepage = "https://flutter.dev";
+        license = licenses.bsd3;
+        platforms = [ "x86_64-linux" "aarch64-linux" ];
+        maintainers = with maintainers; [ babariviere ericdallo FlafyDev gilice hacker1024 ];
+      };
     };
-  };
-  meta = with lib; {
-    description = "Flutter is Google's SDK for building mobile, web and desktop with Dart";
-    longDescription = ''
-      Flutter is Google’s UI toolkit for building beautiful,
-      natively compiled applications for mobile, web, and desktop from a single codebase.
-    '';
-    homepage = "https://flutter.dev";
-    license = licenses.bsd3;
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ babariviere ericdallo h7x4 ];
-  };
-} ''
-  mkdir -p $out/bin
-
-  mkdir -p $out/bin/cache/
-  ln -sf ${dart} $out/bin/cache/dart-sdk
-
-  echo -n "$startScript" > $out/bin/${pname}
-  chmod +x $out/bin/${pname}
-'') self;
 in
-self
+unwrapped
diff --git a/pkgs/development/compilers/flutter/package-overrides/default.nix b/pkgs/development/compilers/flutter/package-overrides/default.nix
new file mode 100644
index 00000000000..4a3fcd1cded
--- /dev/null
+++ b/pkgs/development/compilers/flutter/package-overrides/default.nix
@@ -0,0 +1,4 @@
+{ callPackage }:
+
+{
+}
diff --git a/pkgs/development/compilers/flutter/patches/flutter2/copy-without-perms.patch b/pkgs/development/compilers/flutter/patches/flutter2/copy-without-perms.patch
new file mode 100644
index 00000000000..f262f04bc94
--- /dev/null
+++ b/pkgs/development/compilers/flutter/patches/flutter2/copy-without-perms.patch
@@ -0,0 +1,17 @@
+diff --git a/packages/flutter_tools/lib/src/build_system/targets/assets.dart b/packages/flutter_tools/lib/src/build_system/targets/assets.dart
+index 68a4cd0257..1e212b9b0d 100644
+--- a/packages/flutter_tools/lib/src/build_system/targets/assets.dart
++++ b/packages/flutter_tools/lib/src/build_system/targets/assets.dart
+@@ -101,7 +101,11 @@ Future<Depfile> copyAssets(Environment environment, Directory outputDirectory, {
+             outputPath: file.path,
+             relativePath: entry.key,
+           )) {
+-            await (content.file as File).copy(file.path);
++             // Not using File.copy because it preserves permissions.
++             final sourceFile = content.file as File;
++             final destinationFile = file;
++ 
++             await destinationFile.writeAsBytes(await sourceFile.readAsBytes(), flush: true);
+           }
+         } else {
+           await file.writeAsBytes(await entry.value.contentsAsBytes());
diff --git a/pkgs/development/compilers/flutter/patches/flutter2/disable-auto-update.patch b/pkgs/development/compilers/flutter/patches/flutter2/disable-auto-update.patch
index e799f6e1550..33805b7a54d 100644
--- a/pkgs/development/compilers/flutter/patches/flutter2/disable-auto-update.patch
+++ b/pkgs/development/compilers/flutter/patches/flutter2/disable-auto-update.patch
@@ -34,3 +34,16 @@ index 396756808e..d324a6df59 100644
  
          // See if the user specified a specific device.
          globals.deviceManager?.specifiedDeviceId = topLevelResults['device-id'] as String?;
+
+diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
+index defc86cc20..6c0824c965 100644
+--- a/packages/flutter_tools/lib/src/cache.dart
++++ b/packages/flutter_tools/lib/src/cache.dart
+@@ -666,6 +666,7 @@ class Cache {
+ 
+   /// Update the cache to contain all `requiredArtifacts`.
+   Future<void> updateAll(Set<DevelopmentArtifact> requiredArtifacts) async {
++    return;
+     if (!_lockEnabled) {
+       return;
+     }
diff --git a/pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch b/pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch
index a81d2def242..efab81d2fc0 100644
--- a/pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch
+++ b/pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch
@@ -1,31 +1,5 @@
-diff --git a/packages/flutter_tools/lib/src/asset.dart b/packages/flutter_tools/lib/src/asset.dart
-index ed42baea29..12941f733a 100644
---- a/packages/flutter_tools/lib/src/asset.dart
-+++ b/packages/flutter_tools/lib/src/asset.dart
-@@ -11,11 +11,11 @@ import 'base/file_system.dart';
- import 'base/logger.dart';
- import 'base/platform.dart';
- import 'build_info.dart';
--import 'cache.dart';
- import 'convert.dart';
- import 'dart/package_map.dart';
- import 'devfs.dart';
- import 'flutter_manifest.dart';
-+import 'globals.dart' as globals;
- import 'license_collector.dart';
- import 'project.dart';
- 
-@@ -504,7 +504,7 @@ class ManifestAssetBundle implements AssetBundle {
-         }
-         final Uri entryUri = _fileSystem.path.toUri(asset);
-         result.add(_Asset(
--          baseDir: _fileSystem.path.join(Cache.flutterRoot!, 'bin', 'cache', 'artifacts', 'material_fonts'),
-+          baseDir: _fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'artifacts', 'material_fonts'),
-           relativeUri: Uri(path: entryUri.pathSegments.last),
-           entryUri: entryUri,
-           package: null,
 diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
-index defc86cc20..7fdf14d112 100644
+index dd80b1e46e..8e54517765 100644
 --- a/packages/flutter_tools/lib/src/cache.dart
 +++ b/packages/flutter_tools/lib/src/cache.dart
 @@ -22,6 +22,7 @@ import 'base/user_messages.dart';
@@ -36,7 +10,7 @@ index defc86cc20..7fdf14d112 100644
  
  const String kFlutterRootEnvironmentVariableName = 'FLUTTER_ROOT'; // should point to //flutter/ (root of flutter/flutter repo)
  const String kFlutterEngineEnvironmentVariableName = 'FLUTTER_ENGINE'; // should point to //engine/src/ (root of flutter/engine repo)
-@@ -322,8 +323,13 @@ class Cache {
+@@ -318,8 +319,13 @@ class Cache {
        return;
      }
      assert(_lock == null);
@@ -51,7 +25,7 @@ index defc86cc20..7fdf14d112 100644
      try {
        _lock = lockFile.openSync(mode: FileMode.write);
      } on FileSystemException catch (e) {
-@@ -382,8 +388,7 @@ class Cache {
+@@ -378,8 +384,7 @@ class Cache {
  
    String get devToolsVersion {
      if (_devToolsVersion == null) {
@@ -61,12 +35,3 @@ index defc86cc20..7fdf14d112 100644
        if (!devToolsDir.existsSync()) {
          throw Exception('Could not find directory at ${devToolsDir.path}');
        }
-@@ -536,7 +541,7 @@ class Cache {
-     if (_rootOverride != null) {
-       return _fileSystem.directory(_fileSystem.path.join(_rootOverride!.path, 'bin', 'cache'));
-     } else {
--      return _fileSystem.directory(_fileSystem.path.join(flutterRoot!, 'bin', 'cache'));
-+      return _fileSystem.directory(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter'));
-     }
-   }
- 
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/copy-without-perms.patch b/pkgs/development/compilers/flutter/patches/flutter3/copy-without-perms.patch
new file mode 100644
index 00000000000..281b3840891
--- /dev/null
+++ b/pkgs/development/compilers/flutter/patches/flutter3/copy-without-perms.patch
@@ -0,0 +1,17 @@
+diff --git a/packages/flutter_tools/lib/src/build_system/targets/assets.dart b/packages/flutter_tools/lib/src/build_system/targets/assets.dart
+index 5f458bd53e..7a6c59f98d 100644
+--- a/packages/flutter_tools/lib/src/build_system/targets/assets.dart
++++ b/packages/flutter_tools/lib/src/build_system/targets/assets.dart
+@@ -128,7 +128,11 @@ Future<Depfile> copyAssets(
+               break;
+           }
+           if (doCopy) {
+-            await (content.file as File).copy(file.path);
++            // Not using File.copy because it preserves permissions.
++            final sourceFile = content.file as File;
++            final destinationFile = file;
++
++            await destinationFile.writeAsBytes(await sourceFile.readAsBytes(), flush: true);
+           }
+         } else {
+           await file.writeAsBytes(await entry.value.contentsAsBytes());
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch b/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
index 21b676a2af3..87461904613 100644
--- a/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
+++ b/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
@@ -34,3 +34,16 @@ index 738fef987d..03a152e64f 100644
  
          // See if the user specified a specific device.
          globals.deviceManager?.specifiedDeviceId = topLevelResults['device-id'] as String?;
+
+diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
+index dd80b1e46e..8e54517765 100644
+--- a/packages/flutter_tools/lib/src/cache.dart
++++ b/packages/flutter_tools/lib/src/cache.dart
+@@ -668,6 +668,7 @@
+ 
+   /// Update the cache to contain all `requiredArtifacts`.
+   Future<void> updateAll(Set<DevelopmentArtifact> requiredArtifacts, {bool offline = false}) async {
++    return;
+     if (!_lockEnabled) {
+       return;
+     }
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/dont-validate-executable-location.patch b/pkgs/development/compilers/flutter/patches/flutter3/dont-validate-executable-location.patch
new file mode 100644
index 00000000000..5f391265ce1
--- /dev/null
+++ b/pkgs/development/compilers/flutter/patches/flutter3/dont-validate-executable-location.patch
@@ -0,0 +1,12 @@
+diff --git a/packages/flutter_tools/lib/src/doctor.dart b/packages/flutter_tools/lib/src/doctor.dart
+index 651dc6cf36..236eb370e1 100644
+--- a/packages/flutter_tools/lib/src/doctor.dart
++++ b/packages/flutter_tools/lib/src/doctor.dart
+@@ -515,7 +515,6 @@ class FlutterValidator extends DoctorValidator {
+       final String flutterRoot = _flutterRoot();
+       messages.add(_getFlutterVersionMessage(frameworkVersion, versionChannel, flutterRoot));
+ 
+-      _validateRequiredBinaries(flutterRoot).forEach(messages.add);
+       messages.add(_getFlutterUpstreamMessage(version));
+       if (gitUrl != null) {
+         messages.add(ValidationMessage(_userMessages.flutterGitUrl(gitUrl)));
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch b/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
index 008c5959e5b..efab81d2fc0 100644
--- a/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
+++ b/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
@@ -1,26 +1,3 @@
-diff --git a/packages/flutter_tools/lib/src/artifacts.dart b/packages/flutter_tools/lib/src/artifacts.dart
-diff --git a/packages/flutter_tools/lib/src/asset.dart b/packages/flutter_tools/lib/src/asset.dart
-index 9dd7272fbe..642c8e48e4 100644
---- a/packages/flutter_tools/lib/src/asset.dart
-+++ b/packages/flutter_tools/lib/src/asset.dart
-@@ -16,6 +16,7 @@ import 'convert.dart';
- import 'dart/package_map.dart';
- import 'devfs.dart';
- import 'flutter_manifest.dart';
-+import 'globals.dart' as globals;
- import 'license_collector.dart';
- import 'project.dart';
- 
-@@ -530,8 +531,7 @@ class ManifestAssetBundle implements AssetBundle {
-         final Uri entryUri = _fileSystem.path.toUri(asset);
-         result.add(_Asset(
-           baseDir: _fileSystem.path.join(
--            Cache.flutterRoot!,
--            'bin', 'cache', 'artifacts', 'material_fonts',
-+            globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'artifacts', 'material_fonts',
-           ),
-           relativeUri: Uri(path: entryUri.pathSegments.last),
-           entryUri: entryUri,
 diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
 index dd80b1e46e..8e54517765 100644
 --- a/packages/flutter_tools/lib/src/cache.dart
@@ -58,141 +35,3 @@ index dd80b1e46e..8e54517765 100644
        if (!devToolsDir.existsSync()) {
          throw Exception('Could not find directory at ${devToolsDir.path}');
        }
-@@ -532,7 +537,7 @@ class Cache {
-     if (_rootOverride != null) {
-       return _fileSystem.directory(_fileSystem.path.join(_rootOverride!.path, 'bin', 'cache'));
-     } else {
--      return _fileSystem.directory(_fileSystem.path.join(flutterRoot!, 'bin', 'cache'));
-+      return _fileSystem.directory(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter'));
-     }
-   }
- 
-index c539d67156..4e0a64f7a9 100644
---- a/packages/flutter_tools/lib/src/artifacts.dart
-+++ b/packages/flutter_tools/lib/src/artifacts.dart
-@@ -346,10 +346,10 @@ class CachedArtifacts implements Artifacts {
-   ) {
-     switch (artifact) {
-       case HostArtifact.engineDartSdkPath:
--        final String path = _dartSdkPath(_cache);
-+        final String path = _dartSdkPath(_fileSystem);
-         return _fileSystem.directory(path);
-       case HostArtifact.engineDartBinary:
--        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', _hostArtifactToFileName(artifact, _platform));
-+        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', _hostArtifactToFileName(artifact, _platform));
-         return _fileSystem.file(path);
-       case HostArtifact.flutterWebSdk:
-         final String path = _getFlutterWebSdkPath();
-@@ -398,7 +398,7 @@ class CachedArtifacts implements Artifacts {
-       case HostArtifact.dart2jsSnapshot:
-       case HostArtifact.dartdevcSnapshot:
-       case HostArtifact.kernelWorkerSnapshot:
--        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-+        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-         return _fileSystem.file(path);
-       case HostArtifact.iosDeploy:
-         final String artifactFileName = _hostArtifactToFileName(artifact, _platform);
-@@ -465,11 +465,13 @@ class CachedArtifacts implements Artifacts {
-   String _getAndroidArtifactPath(Artifact artifact, TargetPlatform platform, BuildMode mode) {
-     final String engineDir = _getEngineArtifactsPath(platform, mode)!;
-     switch (artifact) {
-+      case Artifact.frontendServerSnapshotForEngineDartSdk:
-+        assert(mode != BuildMode.debug, 'Artifact $artifact only available in non-debug mode.');
-+        return _fileSystem.path.join(engineDir, _artifactToFileName(artifact));
-       case Artifact.genSnapshot:
-         assert(mode != BuildMode.debug, 'Artifact $artifact only available in non-debug mode.');
-         final String hostPlatform = getNameForHostPlatform(getCurrentHostPlatform());
-         return _fileSystem.path.join(engineDir, hostPlatform, _artifactToFileName(artifact));
--      case Artifact.frontendServerSnapshotForEngineDartSdk:
-       case Artifact.constFinder:
-       case Artifact.flutterFramework:
-       case Artifact.flutterMacOSFramework:
-@@ -497,13 +499,13 @@ class CachedArtifacts implements Artifacts {
-     switch (artifact) {
-       case Artifact.genSnapshot:
-       case Artifact.flutterXcframework:
-+      case Artifact.frontendServerSnapshotForEngineDartSdk:
-         final String artifactFileName = _artifactToFileName(artifact)!;
-         final String engineDir = _getEngineArtifactsPath(platform, mode)!;
-         return _fileSystem.path.join(engineDir, artifactFileName);
-       case Artifact.flutterFramework:
-         final String engineDir = _getEngineArtifactsPath(platform, mode)!;
-         return _getIosEngineArtifactPath(engineDir, environmentType, _fileSystem);
--      case Artifact.frontendServerSnapshotForEngineDartSdk:
-       case Artifact.constFinder:
-       case Artifact.flutterMacOSFramework:
-       case Artifact.flutterPatchedSdkPath:
-@@ -586,14 +588,10 @@ class CachedArtifacts implements Artifacts {
-         // For script snapshots any gen_snapshot binary will do. Returning gen_snapshot for
-         // android_arm in profile mode because it is available on all supported host platforms.
-         return _getAndroidArtifactPath(artifact, TargetPlatform.android_arm, BuildMode.profile);
--      case Artifact.frontendServerSnapshotForEngineDartSdk:
--        return _fileSystem.path.join(
--          _dartSdkPath(_cache), 'bin', 'snapshots',
--          _artifactToFileName(artifact),
--        );
-       case Artifact.flutterTester:
-       case Artifact.vmSnapshotData:
-       case Artifact.isolateSnapshotData:
-+      case Artifact.frontendServerSnapshotForEngineDartSdk:
-       case Artifact.icuData:
-         final String engineArtifactsPath = _cache.getArtifactDirectory('engine').path;
-         final String platformDirName = _enginePlatformDirectoryName(platform);
-@@ -776,7 +774,7 @@ class CachedLocalEngineArtifacts implements LocalEngineArtifacts {
-         final String path = _fileSystem.path.join(_hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-         return _fileSystem.file(path);
-       case HostArtifact.dartdevcSnapshot:
--        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-+        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-         return _fileSystem.file(path);
-       case HostArtifact.kernelWorkerSnapshot:
-         final String path = _fileSystem.path.join(_hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-@@ -901,9 +899,7 @@ class CachedLocalEngineArtifacts implements LocalEngineArtifacts {
-       case Artifact.windowsCppClientWrapper:
-         return _fileSystem.path.join(_hostEngineOutPath, artifactFileName);
-       case Artifact.frontendServerSnapshotForEngineDartSdk:
--        return _fileSystem.path.join(
--          _hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', artifactFileName,
--        );
-+        return _fileSystem.path.join(_hostEngineOutPath, 'gen', artifactFileName);
-     }
-   }
- 
-@@ -1011,8 +1007,8 @@ class OverrideArtifacts implements Artifacts {
- }
- 
- /// Locate the Dart SDK.
--String _dartSdkPath(Cache cache) {
--  return cache.getRoot().childDirectory('dart-sdk').path;
-+String _dartSdkPath(FileSystem fileSystem) {
-+  return fileSystem.path.join(Cache.flutterRoot!, 'bin', 'cache', 'dart-sdk');
- }
- 
- class _TestArtifacts implements Artifacts {
-diff --git a/packages/flutter_tools/test/general.shard/artifacts_test.dart b/packages/flutter_tools/test/general.shard/artifacts_test.dart
-index aed3eb9285..81b8362648 100644
---- a/packages/flutter_tools/test/general.shard/artifacts_test.dart
-+++ b/packages/flutter_tools/test/general.shard/artifacts_test.dart
-@@ -141,10 +141,6 @@ void main() {
-         artifacts.getArtifactPath(Artifact.flutterTester, platform: TargetPlatform.linux_arm64),
-         fileSystem.path.join('root', 'bin', 'cache', 'artifacts', 'engine', 'linux-arm64', 'flutter_tester'),
-       );
--      expect(
--        artifacts.getArtifactPath(Artifact.frontendServerSnapshotForEngineDartSdk),
--        fileSystem.path.join('root', 'bin', 'cache', 'dart-sdk', 'bin', 'snapshots', 'frontend_server.dart.snapshot')
--      );
-     });
- 
-     testWithoutContext('precompiled web artifact paths are correct', () {
-@@ -310,11 +306,6 @@ void main() {
-         artifacts.getHostArtifact(HostArtifact.engineDartSdkPath).path,
-         fileSystem.path.join('/out', 'host_debug_unopt', 'dart-sdk'),
-       );
--      expect(
--        artifacts.getArtifactPath(Artifact.frontendServerSnapshotForEngineDartSdk),
--        fileSystem.path.join('/out', 'host_debug_unopt', 'dart-sdk', 'bin',
--          'snapshots', 'frontend_server.dart.snapshot')
--      );
-       expect(
-         artifacts.getHostArtifact(HostArtifact.impellerc).path,
-         fileSystem.path.join('/out', 'host_debug_unopt', 'impellerc'),
diff --git a/pkgs/development/compilers/flutter/sdk-symlink.nix b/pkgs/development/compilers/flutter/sdk-symlink.nix
new file mode 100644
index 00000000000..6fb4f5edc0e
--- /dev/null
+++ b/pkgs/development/compilers/flutter/sdk-symlink.nix
@@ -0,0 +1,24 @@
+{ symlinkJoin }: flutter:
+
+let
+  self =
+    symlinkJoin {
+      name = "${flutter.name}-sdk-links";
+      paths = [ flutter flutter.sdk ];
+
+      passthru = flutter.passthru // {
+        # Update the SDK attribute.
+        # This allows any modified SDK files to be included
+        # in future invocations.
+        sdk = self;
+      };
+
+      meta = flutter.meta // {
+        longDescription = ''
+          ${flutter.meta.longDescription}
+          Modified binaries are linked into the original SDK directory for use with tools that use the whole SDK.
+        '';
+      };
+    };
+in
+self
diff --git a/pkgs/development/compilers/flutter/wrapper.nix b/pkgs/development/compilers/flutter/wrapper.nix
new file mode 100644
index 00000000000..4ea17924ecb
--- /dev/null
+++ b/pkgs/development/compilers/flutter/wrapper.nix
@@ -0,0 +1,110 @@
+{ lib
+, stdenv
+, callPackage
+, flutter
+, supportsLinuxDesktop ? stdenv.isLinux
+, extraPkgConfigPackages ? [ ]
+, extraLibraries ? [ ]
+, extraIncludes ? [ ]
+, extraCxxFlags ? [ ]
+, extraCFlags ? [ ]
+, extraLinkerFlags ? [ ]
+, makeWrapper
+, runCommandLocal
+, writeShellScript
+, git
+, which
+, pkg-config
+, atk
+, cairo
+, gdk-pixbuf
+, glib
+, gtk3
+, harfbuzz
+, libepoxy
+, pango
+, libX11
+, xorgproto
+, libdeflate
+, zlib
+, cmake
+, ninja
+, clang
+}:
+
+let
+  # By default, Flutter stores downloaded files (such as the Pub cache) in the SDK directory.
+  # Wrap it to ensure that it does not do that, preferring home directories instead.
+  immutableFlutter = writeShellScript "flutter_immutable" ''
+    export PUB_CACHE=''${PUB_CACHE:-"$HOME/.pub-cache"}
+    ${flutter}/bin/flutter "$@"
+  '';
+
+  # Tools that the Flutter tool depends on.
+  tools = [ git which ];
+
+  # Libraries that Flutter apps depend on at runtime.
+  appRuntimeDeps = lib.optionals supportsLinuxDesktop [
+    atk
+    cairo
+    gdk-pixbuf
+    glib
+    gtk3
+    harfbuzz
+    libepoxy
+    pango
+    libX11
+    libdeflate
+  ];
+
+  # Development packages required for compilation.
+  appBuildDeps =
+    let
+      # https://discourse.nixos.org/t/handling-transitive-c-dependencies/5942/3
+      deps = pkg: builtins.filter lib.isDerivation ((pkg.buildInputs or [ ]) ++ (pkg.propagatedBuildInputs or [ ]));
+      collect = pkg: lib.unique ([ pkg ] ++ deps pkg ++ builtins.concatMap collect (deps pkg));
+    in
+    builtins.concatMap collect appRuntimeDeps;
+
+  # Some header files and libraries are not properly located by the Flutter SDK.
+  # They must be manually included.
+  appStaticBuildDeps = (lib.optionals supportsLinuxDesktop [ libX11 xorgproto zlib ]) ++ extraLibraries;
+
+  # Tools used by the Flutter SDK to compile applications.
+  buildTools = lib.optionals supportsLinuxDesktop [
+    pkg-config
+    cmake
+    ninja
+    clang
+  ];
+
+  # Nix-specific compiler configuration.
+  pkgConfigPackages = map (lib.getOutput "dev") (appBuildDeps ++ extraPkgConfigPackages);
+  includeFlags = map (pkg: "-isystem ${lib.getOutput "dev" pkg}/include") (appStaticBuildDeps ++ extraIncludes);
+  linkerFlags = (map (pkg: "-rpath,${lib.getOutput "lib" pkg}/lib") appRuntimeDeps) ++ extraLinkerFlags;
+in
+(callPackage ./sdk-symlink.nix { }) (runCommandLocal "flutter-wrapped"
+{
+  nativeBuildInputs = [ makeWrapper ];
+
+  passthru = flutter.passthru // {
+    inherit (flutter) version;
+    unwrapped = flutter;
+  };
+
+  inherit (flutter) meta;
+} ''
+  for path in ${builtins.concatStringsSep " " (builtins.foldl' (paths: pkg: paths ++ (map (directory: "'${pkg}/${directory}/pkgconfig'") ["lib" "share"])) [ ] pkgConfigPackages)}; do
+    addToSearchPath FLUTTER_PKG_CONFIG_PATH "$path"
+  done
+
+  mkdir -p $out/bin
+  makeWrapper '${immutableFlutter}' $out/bin/flutter \
+    --set-default ANDROID_EMULATOR_USE_SYSTEM_LIBS 1 \
+    --prefix PATH : '${lib.makeBinPath (tools ++ buildTools)}' \
+    --prefix PKG_CONFIG_PATH : "$FLUTTER_PKG_CONFIG_PATH" \
+    --prefix LIBRARY_PATH : '${lib.makeLibraryPath appStaticBuildDeps}' \
+    --prefix CXXFLAGS "''\t" '${builtins.concatStringsSep " " (includeFlags ++ extraCxxFlags)}' \
+    --prefix CFLAGS "''\t" '${builtins.concatStringsSep " " (includeFlags ++ extraCFlags)}' \
+    --prefix LDFLAGS "''\t" '${builtins.concatStringsSep " " (map (flag: "-Wl,${flag}") linkerFlags)}'
+'')
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index a1c61897993..75e8a451105 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -232,6 +232,19 @@ in stdenv.mkDerivation rec {
     description = "A safe, concurrent, practical language";
     maintainers = with maintainers; [ cstrahan globin havvy ] ++ teams.rust.members;
     license = [ licenses.mit licenses.asl20 ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = [
+      # Platforms with host tools from
+      # https://doc.rust-lang.org/nightly/rustc/platform-support.html
+      "x86_64-darwin" "i686-darwin" "aarch64-darwin"
+      "i686-freebsd13" "x86_64-freebsd13"
+      "x86_64-solaris"
+      "aarch64-linux" "armv7l-linux" "i686-linux" "mipsel-linux"
+      "mips64el-linux" "powerpc64-linux" "powerpc64le-linux"
+      "riscv64-linux" "s390x-linux" "x86_64-linux"
+      "aarch64-netbsd" "armv7l-netbsd" "i686-netbsd" "powerpc-netbsd"
+      "x86_64-netbsd"
+      "i686-openbsd" "x86_64-openbsd"
+      "i686-windows" "x86_64-windows"
+    ];
   };
 }
diff --git a/pkgs/development/compilers/stanc/default.nix b/pkgs/development/compilers/stanc/default.nix
index b4d0c5e6823..3b35e3d214c 100644
--- a/pkgs/development/compilers/stanc/default.nix
+++ b/pkgs/development/compilers/stanc/default.nix
@@ -5,7 +5,7 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "stanc";
-  version = "2.31.0";
+  version = "2.32.0";
 
   minimalOCamlVersion = "4.12";
 
@@ -13,7 +13,7 @@ ocamlPackages.buildDunePackage rec {
     owner = "stan-dev";
     repo = "stanc3";
     rev = "v${version}";
-    hash = "sha256-5GOyKVt3LHN1D6UysOZT8isVQLKexwEcK0rwI45dDcg=";
+    hash = "sha256-DZJb5Zcfki6vev1n+9zyokQTxEounCvTeYyH4BvSTZ0=";
   };
 
   # Error: This expression has type [ `Use_Sys_unix ]
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 7a3297ba7f0..a3b736a6d9e 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "7.0.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-vbsjUJH6wHmSTwUV5tXrTUljPJNLTms8K6EyWi0mipA=";
+    hash = "sha256-NSD0xWqxRVFiearYRZFIllizsRHPylWYNzcNoC6+Cpg=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-eTm0FfWiNpEwj2egLrQGPA1lZ0K5GfVOeULsbNyf18Q=";
+  cargoHash = "sha256-v0DLbYM9EoIcj0JEH+LWrMx14gLRfCLW8wYDFKdFNCs=";
 
   cargoBuildFlags = [
     "--package wasmtime-cli"
diff --git a/pkgs/development/libraries/epoll-shim/default.nix b/pkgs/development/libraries/epoll-shim/default.nix
index 311496fe07b..ae2c22afd63 100644
--- a/pkgs/development/libraries/epoll-shim/default.nix
+++ b/pkgs/development/libraries/epoll-shim/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "epoll-shim";
-  version = "unstable-2023-02-05";
+  version = "0.0.20230411";
 
   src = fetchFromGitHub {
     owner = "jiixyj";
     repo = finalAttrs.pname;
-    rev = "702e845d7850e30a7b9e29f759c9c8f7bb40784b";
-    hash = "sha256-QfBnF0/P2KjQggEdJCdqVJDeV/+iaN0OZIwIGyIyr68=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-TOfybtUEp+EtY2l/UGwVFIESDe9kELJCZHlcz22Cmi8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index d90abc0068d..65bb57e0667 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -63,7 +63,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk4";
-  version = "4.10.1";
+  version = "4.10.3";
 
   outputs = [ "out" "dev" ] ++ lib.optionals x11Support [ "devdoc" ];
   outputBin = "dev";
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    sha256 = "6PysBLx3FbnaZnyRGl7o8mLiANHWpQrfI2RcqM/NAxE=";
+    sha256 = "RUVEGteeN3624KcFAm3HpGiG5GobA020CRKQnagBzqk=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libadwaita/default.nix b/pkgs/development/libraries/libadwaita/default.nix
index daf02487d08..772096c8f23 100644
--- a/pkgs/development/libraries/libadwaita/default.nix
+++ b/pkgs/development/libraries/libadwaita/default.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libadwaita";
-  version = "1.3.1";
+  version = "1.3.2";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc"; # demo app
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "libadwaita";
     rev = version;
-    hash = "sha256-RIJtlSBZX4+rMOGQaFn31CCEKkWtPjtzO4fcX+iApvs=";
+    hash = "sha256-9Qha8xN3lC/t5dQNYPbgMX6HAKgEk80pyycrd5MGYLo=";
   };
 
   depsBuildBuild = [
@@ -70,10 +70,10 @@ stdenv.mkDerivation rec {
     xvfb-run
   ];
 
-  # Tests had to be disabled on Darwin because they fail with the same error as https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264947 on Hydra:
+  # Tests had to be disabled on Darwin because test-button-content fails
   #
-  # In file included from ../tests/test-style-manager.c:10:
-  # ../src/adw-settings-private.h:16:10: fatal error: 'adw-enums-private.h' file not found
+  # not ok /Adwaita/ButtonContent/style_class_button - Gdk-FATAL-CRITICAL:
+  # gdk_macos_monitor_get_workarea: assertion 'GDK_IS_MACOS_MONITOR (self)' failed
   doCheck = !stdenv.isDarwin;
 
   checkPhase = ''
diff --git a/pkgs/development/libraries/libwpe/fdo.nix b/pkgs/development/libraries/libwpe/fdo.nix
index ce385f24c20..3e2fada38c3 100644
--- a/pkgs/development/libraries/libwpe/fdo.nix
+++ b/pkgs/development/libraries/libwpe/fdo.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wpebackend-fdo";
-  version = "1.14.0";
+  version = "1.14.2";
 
   src = fetchurl {
     url = "https://wpewebkit.org/releases/wpebackend-fdo-${version}.tar.xz";
-    sha256 = "51sMsscUVEhBboaWAT2Ig/Z1xmwR7XUOBoZe/sWAkVU=";
+    sha256 = "k8l2aumGTurq7isKdPIsvKCN9CwaG9tVsIbyUo44DTg=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 51a0a300586..2d6948d2ada 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -71,7 +71,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.40.0";
+  version = "2.40.1";
   name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "6.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";
 
   outputs = [ "out" "dev" "devdoc" ];
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pGB+ob+JZp6JscssY/quxRP5PeCbauYMxx1qiqt6s5M=";
+    hash = "sha256-ZOUmmE+M0hYe8DrpSa+ZwAL/Mz1hXmOGtGAWSjwbfvY=";
   };
 
   patches = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/python-modules/accelerate/default.nix b/pkgs/development/python-modules/accelerate/default.nix
new file mode 100644
index 00000000000..be841e9bb4d
--- /dev/null
+++ b/pkgs/development/python-modules/accelerate/default.nix
@@ -0,0 +1,74 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, setuptools
+, numpy
+, packaging
+, psutil
+, pyyaml
+, torch
+, evaluate
+, parameterized
+, transformers
+}:
+
+buildPythonPackage rec {
+  pname = "accelerate";
+  version = "0.18.0";
+  format = "pyproject";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "huggingface";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fCIvVbMaWAWzRfPc5/1CZq3gZ8kruuk9wBt8mzLHmyw=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    numpy
+    packaging
+    psutil
+    pyyaml
+    torch
+  ];
+
+  nativeCheckInputs = [
+    evaluate
+    parameterized
+    pytestCheckHook
+    transformers
+  ];
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    export PATH=$out/bin:$PATH
+  '';
+  pytestFlagsArray = [ "tests" ];
+  disabledTests = [
+    # try to download data:
+    "FeatureExamplesTests"
+    "test_infer_auto_device_map_on_t0pp"
+  ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [
+    # usual aarch64-linux RuntimeError: DataLoader worker (pid(s) <...>) exited unexpectedly
+    "CheckpointTest"
+  ];
+  # numerous instances of torch.multiprocessing.spawn.ProcessRaisedException:
+  doCheck = !stdenv.isDarwin;
+  pythonImportsCheck = [
+    "accelerate"
+  ];
+
+  meta = with lib; {
+    homepage = "https://huggingface.co/docs/accelerate";
+    description = "A simple way to train and use PyTorch models with multi-GPU, TPU, mixed-precision";
+    changelog = "https://github.com/huggingface/accelerate/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bcdarwin ];
+    mainProgram = "accelerate";
+  };
+}
diff --git a/pkgs/development/python-modules/catboost/default.nix b/pkgs/development/python-modules/catboost/default.nix
index 9c4b4d8049e..1939b7c13a6 100644
--- a/pkgs/development/python-modules/catboost/default.nix
+++ b/pkgs/development/python-modules/catboost/default.nix
@@ -5,7 +5,8 @@
 
 buildPythonPackage rec {
   pname = "catboost";
-  version = "1.1.1";
+  # nixpkgs-update: no auto update
+  version = "1.0.5";
 
   disabled = pythonOlder "3.4";
 
@@ -13,7 +14,7 @@ buildPythonPackage rec {
     owner = "catboost";
     repo = "catboost";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bqnUHTTRan/spA5y4LRt/sIUYpP3pxzdN/4wHjzgZVY=";
+    hash = "sha256-ILemeZUBI9jPb9G6F7QX/T1HaVhQ+g6y7YmsT6DFCJk";
   };
 
   nativeBuildInputs = [ clang_12 ];
@@ -41,6 +42,11 @@ buildPythonPackage rec {
   dontUseSetuptoolsCheck = true;
   pythonImportsCheck = [ "catboost" ];
 
+  passthru = {
+    # Do not update to catboost 1.1.x because the patch doesn't apply cleanly
+    skipBulkUpdate = true;
+  };
+
   meta = with lib; {
     description = "High-performance library for gradient boosting on decision trees.";
     longDescription = ''
diff --git a/pkgs/development/python-modules/docformatter/default.nix b/pkgs/development/python-modules/docformatter/default.nix
index 11958148d87..61180107894 100644
--- a/pkgs/development/python-modules/docformatter/default.nix
+++ b/pkgs/development/python-modules/docformatter/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "docformatter";
-  version = "1.6.2";
+  version = "1.6.3";
 
   disabled = pythonOlder "3.7";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-fQm+eMA1p7uCVgQ3Hbm3UY1mhROsThtgkjRRPg3XcsI=";
+    hash = "sha256-MyrLzEVuNsAZCnRXWDGK7jFAu8woZUSrN6ml1yiadF0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/elmax-api/default.nix b/pkgs/development/python-modules/elmax-api/default.nix
index a57225d41db..415211cb362 100644
--- a/pkgs/development/python-modules/elmax-api/default.nix
+++ b/pkgs/development/python-modules/elmax-api/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "elmax-api";
-  version = "0.0.3";
+  version = "0.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "albertogeniola";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZqPDnIiFzxS6nU19bfEgnqEsuz7oI+Z4ac6br6Gr4Vk=";
+    hash = "sha256-+dR1ccRa4G91yFeSwjgdZ1lEXV/PIgnKN8e9tfy5fTU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gehomesdk/default.nix b/pkgs/development/python-modules/gehomesdk/default.nix
index 7c83f062307..060b921a38b 100644
--- a/pkgs/development/python-modules/gehomesdk/default.nix
+++ b/pkgs/development/python-modules/gehomesdk/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "gehomesdk";
-  version = "0.5.8";
+  version = "0.5.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-x83CmOAZFaIDv4bzO01YZxVPVM/cwUpJtKdCWOxH/O4=";
+    hash = "sha256-V8vwsLIO44q2ms/segTZ70DUVb7BNuxYZ8vX9KPNP4c=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 445bba54943..5458986e7f1 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2023.4.0";
+  version = "2023.4.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-IR8Sx9rb6vPA/wIZVCwOl2bKxwWbogW4Xry14yxb2Ic=";
+    hash = "sha256-cMrp0IewFezXpuXDnXDoDmEge/2NWRlhqkBmIwBjlrE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/markdown-it-py/default.nix b/pkgs/development/python-modules/markdown-it-py/default.nix
index e0c9946a3ba..38d92159f3b 100644
--- a/pkgs/development/python-modules/markdown-it-py/default.nix
+++ b/pkgs/development/python-modules/markdown-it-py/default.nix
@@ -16,6 +16,7 @@
 , sphinx-book-theme
 , sphinx-copybutton
 , sphinx-design
+, stdenv
 , pytest-regressions
 , pytestCheckHook
 , pythonOlder
@@ -52,6 +53,7 @@ buildPythonPackage rec {
   preCheck = ''
     rm -r benchmarking
   '';
+  doCheck = !stdenv.isi686;
 
   pythonImportsCheck = [
     "markdown_it"
diff --git a/pkgs/development/python-modules/mdit-py-plugins/default.nix b/pkgs/development/python-modules/mdit-py-plugins/default.nix
index 0128b5eec23..772d9547088 100644
--- a/pkgs/development/python-modules/mdit-py-plugins/default.nix
+++ b/pkgs/development/python-modules/mdit-py-plugins/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "mdit-py-plugins";
-  version = "0.3.4";
+  version = "0.3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "executablebooks";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-BvxqMSl8YXD84O6qjDI0VZgZpqL0UL0vYDMKxCc9qtI=";
+    hash = "sha256-U6Qh/1GklW9ZXBXmjPLuxga0JS/Cyga1iorcMEA+WP8=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +42,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Collection of core plugins for markdown-it-py";
     homepage = "https://github.com/executablebooks/mdit-py-plugins";
+    changelog = "https://github.com/executablebooks/mdit-py-plugins/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ AluisioASG ];
   };
diff --git a/pkgs/development/python-modules/peft/default.nix b/pkgs/development/python-modules/peft/default.nix
new file mode 100644
index 00000000000..24a0fe78064
--- /dev/null
+++ b/pkgs/development/python-modules/peft/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, setuptools
+, numpy
+, packaging
+, psutil
+, pyyaml
+, torch
+, transformers
+, accelerate
+}:
+
+buildPythonPackage rec {
+  pname = "peft";
+  version = "0.2.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "huggingface";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-NPpY29HMQe5KT0JdlLAXY9MVycDslbP2i38NSTirB3I=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    numpy
+    packaging
+    psutil
+    pyyaml
+    torch
+    transformers
+    accelerate
+  ];
+
+  doCheck = false;  # tried to download pretrained model
+  pythonImportsCheck = [
+    "peft"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/huggingface/peft";
+    description = "State-of-the art parameter-efficient fine tuning";
+    changelog = "https://github.com/huggingface/peft/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
diff --git a/pkgs/development/python-modules/safetensors/default.nix b/pkgs/development/python-modules/safetensors/default.nix
new file mode 100644
index 00000000000..407dc5bebbe
--- /dev/null
+++ b/pkgs/development/python-modules/safetensors/default.nix
@@ -0,0 +1,79 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, h5py
+, numpy
+, pythonOlder
+, pytestCheckHook
+, rustPlatform
+, setuptools-rust
+, torch
+, libiconv
+}:
+
+buildPythonPackage rec {
+  pname = "safetensors";
+  version = "0.3.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "huggingface";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Qpb5lTw1WEME9tWEGfxC8l8dK9mGMH2rz+O+xGCrUxw";
+  };
+
+  patches = [
+    # remove after next release
+    (fetchpatch {
+      name = "commit-cargo-lockfile";
+      relative = "bindings/python";
+      url = "https://github.com/huggingface/safetensors/commit/a7061b4235b59312010b2dd6f9597381428ee9a2.patch";
+      hash = "sha256-iH4vQOL2LU93kd0dSS8/JJxKGb+kDstqnExjYSSwi78";
+    })
+  ];
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src patches;
+    sourceRoot = "source/bindings/python";
+    hash = "sha256-tC0XawmKWNGCaByHQfJEfmHM3m/qgTuIpcRaEFJC6dM";
+  };
+
+  sourceRoot = "source/bindings/python";
+
+  nativeBuildInputs = with rustPlatform; [
+    setuptools-rust
+    rust.cargo
+    rust.rustc
+    cargoSetupHook
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
+
+  nativeCheckInputs = [
+    h5py numpy pytestCheckHook torch
+  ];
+  pytestFlagsArray = [ "tests" ];
+  # don't require PaddlePaddle (not in Nixpkgs), Flax, or Tensorflow (onerous) to run tests:
+  disabledTestPaths = [
+    "tests/test_flax_comparison.py"
+    "tests/test_paddle_comparison.py"
+    "tests/test_tf_comparison.py"
+  ];
+
+  pythonImportsCheck = [
+    "safetensors"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/huggingface/safetensors";
+    description = "Fast (zero-copy) and safe (unlike pickle) format for storing tensors";
+    changelog = "https://github.com/huggingface/safetensors/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
diff --git a/pkgs/development/python-modules/syncedlyrics/default.nix b/pkgs/development/python-modules/syncedlyrics/default.nix
index f69ce5fe83e..48330988df8 100644
--- a/pkgs/development/python-modules/syncedlyrics/default.nix
+++ b/pkgs/development/python-modules/syncedlyrics/default.nix
@@ -3,7 +3,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
-, pytestCheckHook
 , pythonOlder
 , pythonRelaxDepsHook
 , rapidfuzz
@@ -12,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "syncedlyrics";
-  version = "0.4.0";
+  version = "0.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +20,7 @@ buildPythonPackage rec {
     owner = "rtcq";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-dH9irIah9CdZ9Kv7bIymP1o5ifWEYCiSqegUpu8Y+Tg=";
+    hash = "sha256-79dy1f5Pd/JGIpH/71E6IBg+AtR4zgHL4b/GRH1AFp0=";
   };
 
   nativeBuildInputs = [
@@ -39,18 +38,13 @@ buildPythonPackage rec {
     beautifulsoup4
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  # Tests require network access
+  doCheck = false;
 
   pythonImportsCheck = [
     "syncedlyrics"
   ];
 
-  pytestFlagsArray = [
-    "test.py::test_all_providers"
-  ];
-
   meta = with lib; {
     description = "Module to get LRC format (synchronized) lyrics";
     homepage = "https://github.com/rtcq/syncedlyrics";
diff --git a/pkgs/development/python-modules/ttp-templates/default.nix b/pkgs/development/python-modules/ttp-templates/default.nix
index 364041704d5..77acc320fe8 100644
--- a/pkgs/development/python-modules/ttp-templates/default.nix
+++ b/pkgs/development/python-modules/ttp-templates/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "ttp-templates";
-  version = "0.3.4";
+  version = "0.3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
diff --git a/pkgs/development/python-modules/yalexs/default.nix b/pkgs/development/python-modules/yalexs/default.nix
index e319e2d93fb..52d5be83808 100644
--- a/pkgs/development/python-modules/yalexs/default.nix
+++ b/pkgs/development/python-modules/yalexs/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs";
-  version = "1.3.0";
+  version = "1.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-5UmuQsA5pPzgP+uCkykWQBCPY437cxblGCiZxEYQzGg=";
+    hash = "sha256-CqonGKcbAg0Edqw3WosK2vEJ0DxOMZNSNO5RkecECa0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/bear/default.nix b/pkgs/development/tools/build-managers/bear/default.nix
index 3132678eade..468cec56791 100644
--- a/pkgs/development/tools/build-managers/bear/default.nix
+++ b/pkgs/development/tools/build-managers/bear/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bear";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "rizsotto";
     repo = pname;
     rev = version;
-    sha256 = "sha256-EiAGM2tfzHp2rTAsf+mrfQ7VfX0NTFakcLVpT/plqh8=";
+    sha256 = "sha256-x46BS+By5Zj5xeYRD45eXRDCAOqwpkkivVyJPnhkAMc=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/tools/goda/default.nix b/pkgs/development/tools/goda/default.nix
index 65086bb44d5..edf37fa5167 100644
--- a/pkgs/development/tools/goda/default.nix
+++ b/pkgs/development/tools/goda/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "goda";
-  version = "0.5.6";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "loov";
     repo = "goda";
     rev = "v${version}";
-    sha256 = "sha256-l9ehpDAqZqNV+07ENXJ2GJEY6bb6W37Ls6UqjE9DEWQ=";
+    sha256 = "sha256-kilFb/2wXdzn/gXy9mBg0PZH8rd+MFIom4AGAZLgnBo=";
   };
 
-  vendorSha256 = "sha256-BYYuB4ZlCWD8NILkf4qrgM4q72ZTy7Ze3ICUXdoI5Ms=";
+  vendorSha256 = "sha256-FYjlOYB0L4l6gF8hYtJroV1qMQD0ZmKWXBarjyConRs=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/development/tools/jql/default.nix b/pkgs/development/tools/jql/default.nix
index fdc2d011d6f..758e5c9120e 100644
--- a/pkgs/development/tools/jql/default.nix
+++ b/pkgs/development/tools/jql/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jql";
-  version = "6.0.5";
+  version = "6.0.6";
 
   src = fetchFromGitHub {
     owner = "yamafaktory";
     repo = pname;
     rev = "jql-v${version}";
-    hash = "sha256-MdIYU6/j+hpFBcaZ1IiW6ImeWD3mmYezGEpZBbWmRzs=";
+    hash = "sha256-0Tg8vqlTngLfmp0HDxR5ymmLXw16J9pQJfOCOZrRreE=";
   };
 
-  cargoHash = "sha256-vb7HyumsLYN9rZTD8KxzV+1SN5F2rLhuullYDwRt7wM=";
+  cargoHash = "sha256-w51soAdIdNuJzQpvQZQZuxbxlClEWYdT/v0ZOnVvsTA=";
 
   meta = with lib; {
     description = "A JSON Query Language CLI tool built with Rust";
diff --git a/pkgs/development/tools/misc/sccache/default.nix b/pkgs/development/tools/misc/sccache/default.nix
index 7c307c503fe..0a5bcb699ea 100644
--- a/pkgs/development/tools/misc/sccache/default.nix
+++ b/pkgs/development/tools/misc/sccache/default.nix
@@ -1,17 +1,17 @@
 { lib, fetchFromGitHub, rustPlatform, pkg-config, openssl, stdenv, Security }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.4.1";
+  version = "0.4.2";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
     rev = "v${version}";
-    sha256 = "sha256-omov7/o1ToWJBTsDXTp3FNLk7PuWGL3J6pNz6n47taU=";
+    sha256 = "sha256-OXCR052syGpqeIHviKAqS5LEAt8epdlFFarkVdmfa0I=";
   };
 
-  cargoSha256 = "sha256-UkccHrs3q4MlIaK/lo+bPC9Jy/JCBjGzo8jgjZsvEIc=";
+  cargoSha256 = "sha256-hYNnzVhw0yCqgRcRJCZusuY+g+MZn1DD5pfDTJlTv+w=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
diff --git a/pkgs/development/tools/mongosh/source.json b/pkgs/development/tools/mongosh/source.json
index fda52f4e77c..9f590bcb9b2 100644
--- a/pkgs/development/tools/mongosh/source.json
+++ b/pkgs/development/tools/mongosh/source.json
@@ -2,5 +2,5 @@
   "version": "1.8.0",
   "integrity": "sha512-9pHLqfYMWwP1L2t83TK5k6ho1faz+jFD9zXxnTtgnyu0c/uC39nx+tJT9AsxNZpY+GlhshDu1YcJm45f8l3gIw==",
   "filename": "mongosh-1.8.0.tgz",
-  "deps": "sha256-8v4E9wNv3+JCGm7mUEA+z+g/4X37ACwVsn+9Cv7N+4o="
+  "deps": "sha256-ewl5q6ZxlQN030AmObP42E5KpUisrdYHOsg8whUIUZA="
 }
diff --git a/pkgs/development/tools/okteto/default.nix b/pkgs/development/tools/okteto/default.nix
index 5282ecac886..c0b2035c7da 100644
--- a/pkgs/development/tools/okteto/default.nix
+++ b/pkgs/development/tools/okteto/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.14.3";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    hash = "sha256-E96IAAbWmFIQILUU3WLjX6NAXzwIkrbEgKUs4wrh8z4=";
+    hash = "sha256-+fIVkkx4UVmHnAQT2nXmBARvUsemiD42LZI3kmt/nX4=";
   };
 
-  vendorHash = "sha256-b2qxvP9spXEJVYOq7o0VG2WOxzUchwtLaY97/2IYoV4=";
+  vendorHash = "sha256-dZ6gzW5R5na5qcHFQqQvKfYb0Bu0kVvVMOaRdtTgkhE=";
 
   postPatch = ''
     # Disable some tests that need file system & network access.
diff --git a/pkgs/development/tools/rust/cargo-careful/default.nix b/pkgs/development/tools/rust/cargo-careful/default.nix
index 5e8d5c504f7..d197e0c7f4d 100644
--- a/pkgs/development/tools/rust/cargo-careful/default.nix
+++ b/pkgs/development/tools/rust/cargo-careful/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-careful";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "RalfJung";
     repo = "cargo-careful";
     rev = "v${version}";
-    hash = "sha256-+rj9f4uCNDWwX+0Dsr7dwoeQunvsniG61+W9ehs0KDY=";
+    hash = "sha256-oYwbRww+NFPV9q26vfuTdxTBp0kzWdgWl6MAXhir2lc=";
   };
 
-  cargoHash = "sha256-dxb+euJ5PCdDjfne+iUTgsdOSt2HLiItHrVwHx4588c=";
+  cargoHash = "sha256-8b718qYPFFstjl2LQ23IoQDikF9YV1Ao+pDg2tiXxsc=";
 
   meta = with lib; {
     description = "A tool to execute Rust code carefully, with extra checking along the way";
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index f2a02845b34..ee59039d370 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.33.2";
+  version = "4.33.3";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    hash = "sha256-z4TSc6thjWoaucx2RBDDqK+f6689cympifGzzF4N07E=";
+    hash = "sha256-hsADk1h9bxqgvIddU0JTIv/uSJnukoJb39i0tngnImE=";
   };
 
-  vendorHash = "sha256-aaQxW8fvDaOb49rsTw92WVWgtbJJHH7e92ChuhKI4ME=";
+  vendorHash = "sha256-EW2coQdrFfs6xYeJb+6gab8+CVT3O8x4cSRuj1o+3ok=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/os-specific/darwin/sketchybar/default.nix b/pkgs/os-specific/darwin/sketchybar/default.nix
index 5468e7a2a33..6d478d8ab33 100644
--- a/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -10,13 +10,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sketchybar";
-  version = "2.14.4";
+  version = "2.15.1";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
     rev = "v${version}";
-    hash = "sha256-snB1DII04OeoPbLzblfgdaM1hdXL62u/g/0CNLmqrxo=";
+    hash = "sha256-0jCVDaFc7ZvA8apeHRoQvPhAlaGlBHzqUkS9or88PcM=";
   };
 
   buildInputs = [ Carbon Cocoa CoreWLAN DisplayServices SkyLight ];
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
index 04fb8b0fe37..13421c5cc8b 100644
--- a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
@@ -1,17 +1,15 @@
 { lib
 , flutter2
 , fetchFromGitHub
-, stdenv
 }:
 
-flutter2.mkFlutterApp {
+flutter2.buildFlutterApplication {
   pname = "firmware-updater";
   version = "unstable";
 
-  vendorHash =
-    if stdenv.system == "aarch64-linux"
-    then "sha256-+ACmcIKXtGtaYBuwc7jY9hEdIS9qxQCbuxRKJQohX5A="
-    else "sha256-nPblucEpNCBJYpIqx1My6SWq8CjXYuHDG/uphdcrWjQ=";
+  pubspecLockFile = ./pubspec.lock;
+  depsListFile = ./deps.json;
+  vendorHash = "sha256-kKfe+7obb2fihrca+mjCM2+51wNkbPLEPFLpXzK5Wvc=";
 
   src = fetchFromGitHub {
     owner = "canonical";
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/deps.json b/pkgs/os-specific/linux/firmware/firmware-updater/deps.json
new file mode 100644
index 00000000000..9264a9fb70e
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/deps.json
@@ -0,0 +1,763 @@
+[
+  {
+    "name": "firmware_updater",
+    "version": "0.0.0",
+    "kind": "root",
+    "source": "root",
+    "dependencies": [
+      "collection",
+      "dio",
+      "flutter",
+      "flutter_html",
+      "flutter_localizations",
+      "fwupd",
+      "path",
+      "provider",
+      "yaru",
+      "yaru_icons",
+      "yaru_widgets",
+      "flutter_lints",
+      "flutter_test"
+    ]
+  },
+  {
+    "name": "flutter_test",
+    "version": "0.0.0",
+    "kind": "dev",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "test_api",
+      "path",
+      "fake_async",
+      "clock",
+      "stack_trace",
+      "vector_math",
+      "async",
+      "boolean_selector",
+      "characters",
+      "charcode",
+      "collection",
+      "matcher",
+      "material_color_utilities",
+      "meta",
+      "source_span",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph",
+      "typed_data"
+    ]
+  },
+  {
+    "name": "typed_data",
+    "version": "1.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "collection",
+    "version": "1.15.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "term_glyph",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "string_scanner",
+    "version": "1.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "charcode",
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_span",
+    "version": "1.8.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "path",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "path",
+    "version": "1.8.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "charcode",
+    "version": "1.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "stream_channel",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "async",
+    "version": "2.8.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "meta",
+    "version": "1.7.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "material_color_utilities",
+    "version": "0.1.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "matcher",
+    "version": "0.12.11",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "stack_trace",
+    "version": "1.10.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "characters",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "boolean_selector",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "vector_math",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "clock",
+    "version": "1.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "fake_async",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "collection"
+    ]
+  },
+  {
+    "name": "test_api",
+    "version": "0.4.8",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "boolean_selector",
+      "collection",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph",
+      "matcher"
+    ]
+  },
+  {
+    "name": "flutter",
+    "version": "0.0.0",
+    "kind": "direct",
+    "source": "sdk",
+    "dependencies": [
+      "characters",
+      "collection",
+      "material_color_utilities",
+      "meta",
+      "typed_data",
+      "vector_math",
+      "sky_engine"
+    ]
+  },
+  {
+    "name": "sky_engine",
+    "version": "0.0.99",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_lints",
+    "version": "1.0.4",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "lints"
+    ]
+  },
+  {
+    "name": "lints",
+    "version": "1.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "yaru_widgets",
+    "version": "1.0.8",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "yaru_icons",
+    "version": "0.1.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "yaru",
+    "version": "0.2.5",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "provider",
+    "version": "6.0.5",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "flutter",
+      "nested"
+    ]
+  },
+  {
+    "name": "nested",
+    "version": "1.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "fwupd",
+    "version": "0.2.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "dbus",
+      "meta"
+    ]
+  },
+  {
+    "name": "dbus",
+    "version": "0.7.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "ffi",
+      "meta",
+      "xml"
+    ]
+  },
+  {
+    "name": "xml",
+    "version": "5.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta",
+      "petitparser"
+    ]
+  },
+  {
+    "name": "petitparser",
+    "version": "4.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "ffi",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "args",
+    "version": "2.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_localizations",
+    "version": "0.0.0",
+    "kind": "direct",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "intl",
+      "characters",
+      "clock",
+      "collection",
+      "material_color_utilities",
+      "meta",
+      "path",
+      "typed_data",
+      "vector_math"
+    ]
+  },
+  {
+    "name": "intl",
+    "version": "0.17.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "path"
+    ]
+  },
+  {
+    "name": "flutter_html",
+    "version": "2.2.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "html",
+      "csslib",
+      "flutter_layout_grid",
+      "video_player",
+      "chewie",
+      "webview_flutter",
+      "chewie_audio",
+      "flutter_svg",
+      "flutter_math_fork",
+      "collection",
+      "numerus",
+      "flutter"
+    ]
+  },
+  {
+    "name": "numerus",
+    "version": "1.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_math_fork",
+    "version": "0.5.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_svg",
+      "provider",
+      "meta",
+      "collection",
+      "tuple"
+    ]
+  },
+  {
+    "name": "tuple",
+    "version": "2.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_svg",
+    "version": "0.23.0+1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "meta",
+      "path_drawing",
+      "vector_math",
+      "xml"
+    ]
+  },
+  {
+    "name": "path_drawing",
+    "version": "0.5.1+1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "vector_math",
+      "meta",
+      "path_parsing",
+      "flutter"
+    ]
+  },
+  {
+    "name": "path_parsing",
+    "version": "0.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "vector_math",
+      "meta"
+    ]
+  },
+  {
+    "name": "chewie_audio",
+    "version": "1.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "cupertino_icons",
+      "flutter",
+      "video_player"
+    ]
+  },
+  {
+    "name": "video_player",
+    "version": "2.5.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "html",
+      "video_player_android",
+      "video_player_avfoundation",
+      "video_player_platform_interface",
+      "video_player_web"
+    ]
+  },
+  {
+    "name": "video_player_web",
+    "version": "2.0.13",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_web_plugins",
+      "video_player_platform_interface"
+    ]
+  },
+  {
+    "name": "video_player_platform_interface",
+    "version": "6.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "plugin_platform_interface"
+    ]
+  },
+  {
+    "name": "plugin_platform_interface",
+    "version": "2.1.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "flutter_web_plugins",
+    "version": "0.0.0",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "js",
+      "characters",
+      "collection",
+      "material_color_utilities",
+      "meta",
+      "typed_data",
+      "vector_math"
+    ]
+  },
+  {
+    "name": "js",
+    "version": "0.6.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "video_player_avfoundation",
+    "version": "2.3.8",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "video_player_platform_interface"
+    ]
+  },
+  {
+    "name": "video_player_android",
+    "version": "2.3.10",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "video_player_platform_interface"
+    ]
+  },
+  {
+    "name": "html",
+    "version": "0.15.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "csslib",
+      "source_span"
+    ]
+  },
+  {
+    "name": "csslib",
+    "version": "0.17.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "cupertino_icons",
+    "version": "1.0.5",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "webview_flutter",
+    "version": "2.8.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "webview_flutter_android",
+      "webview_flutter_platform_interface",
+      "webview_flutter_wkwebview"
+    ]
+  },
+  {
+    "name": "webview_flutter_wkwebview",
+    "version": "2.7.5",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "path",
+      "webview_flutter_platform_interface"
+    ]
+  },
+  {
+    "name": "webview_flutter_platform_interface",
+    "version": "1.9.5",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "meta",
+      "plugin_platform_interface"
+    ]
+  },
+  {
+    "name": "webview_flutter_android",
+    "version": "2.8.14",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "webview_flutter_platform_interface"
+    ]
+  },
+  {
+    "name": "chewie",
+    "version": "1.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "cupertino_icons",
+      "flutter",
+      "provider",
+      "video_player",
+      "wakelock"
+    ]
+  },
+  {
+    "name": "wakelock",
+    "version": "0.6.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "meta",
+      "wakelock_macos",
+      "wakelock_platform_interface",
+      "wakelock_web",
+      "wakelock_windows"
+    ]
+  },
+  {
+    "name": "wakelock_windows",
+    "version": "0.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "wakelock_platform_interface",
+      "win32"
+    ]
+  },
+  {
+    "name": "win32",
+    "version": "2.5.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "ffi"
+    ]
+  },
+  {
+    "name": "wakelock_platform_interface",
+    "version": "0.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "meta"
+    ]
+  },
+  {
+    "name": "wakelock_web",
+    "version": "0.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_web_plugins",
+      "js",
+      "wakelock_platform_interface"
+    ]
+  },
+  {
+    "name": "wakelock_macos",
+    "version": "0.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_web_plugins",
+      "wakelock_platform_interface"
+    ]
+  },
+  {
+    "name": "flutter_layout_grid",
+    "version": "1.0.6",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "collection",
+      "meta",
+      "quiver"
+    ]
+  },
+  {
+    "name": "quiver",
+    "version": "3.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "matcher"
+    ]
+  },
+  {
+    "name": "dio",
+    "version": "4.0.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "http_parser",
+      "path"
+    ]
+  },
+  {
+    "name": "http_parser",
+    "version": "4.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner",
+      "typed_data"
+    ]
+  }
+]
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock b/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock
new file mode 100644
index 00000000000..c9e9a204447
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock
@@ -0,0 +1,493 @@
+# Generated by pub
+# See https://dart.dev/tools/pub/glossary#lockfile
+packages:
+  args:
+    dependency: transitive
+    description:
+      name: args
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.3.1"
+  async:
+    dependency: transitive
+    description:
+      name: async
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.8.2"
+  boolean_selector:
+    dependency: transitive
+    description:
+      name: boolean_selector
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.1.0"
+  characters:
+    dependency: transitive
+    description:
+      name: characters
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.2.0"
+  charcode:
+    dependency: transitive
+    description:
+      name: charcode
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.3.1"
+  chewie:
+    dependency: transitive
+    description:
+      name: chewie
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.4.0"
+  chewie_audio:
+    dependency: transitive
+    description:
+      name: chewie_audio
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.3.0"
+  clock:
+    dependency: transitive
+    description:
+      name: clock
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.1.0"
+  collection:
+    dependency: "direct main"
+    description:
+      name: collection
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.15.0"
+  csslib:
+    dependency: transitive
+    description:
+      name: csslib
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.17.2"
+  cupertino_icons:
+    dependency: transitive
+    description:
+      name: cupertino_icons
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.0.5"
+  dbus:
+    dependency: transitive
+    description:
+      name: dbus
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.7.3"
+  dio:
+    dependency: "direct main"
+    description:
+      name: dio
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "4.0.6"
+  fake_async:
+    dependency: transitive
+    description:
+      name: fake_async
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.2.0"
+  ffi:
+    dependency: transitive
+    description:
+      name: ffi
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.2.1"
+  flutter:
+    dependency: "direct main"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_html:
+    dependency: "direct main"
+    description:
+      name: flutter_html
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.2.1"
+  flutter_layout_grid:
+    dependency: transitive
+    description:
+      name: flutter_layout_grid
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.0.6"
+  flutter_lints:
+    dependency: "direct dev"
+    description:
+      name: flutter_lints
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.0.4"
+  flutter_localizations:
+    dependency: "direct main"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_math_fork:
+    dependency: transitive
+    description:
+      name: flutter_math_fork
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.5.0"
+  flutter_svg:
+    dependency: transitive
+    description:
+      name: flutter_svg
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.23.0+1"
+  flutter_test:
+    dependency: "direct dev"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_web_plugins:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  fwupd:
+    dependency: "direct main"
+    description:
+      name: fwupd
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.2.2"
+  html:
+    dependency: transitive
+    description:
+      name: html
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.15.1"
+  http_parser:
+    dependency: transitive
+    description:
+      name: http_parser
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "4.0.2"
+  intl:
+    dependency: transitive
+    description:
+      name: intl
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.17.0"
+  js:
+    dependency: transitive
+    description:
+      name: js
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.6.3"
+  lints:
+    dependency: transitive
+    description:
+      name: lints
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.0.1"
+  matcher:
+    dependency: transitive
+    description:
+      name: matcher
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.12.11"
+  material_color_utilities:
+    dependency: transitive
+    description:
+      name: material_color_utilities
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.1.3"
+  meta:
+    dependency: transitive
+    description:
+      name: meta
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.7.0"
+  nested:
+    dependency: transitive
+    description:
+      name: nested
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.0.0"
+  numerus:
+    dependency: transitive
+    description:
+      name: numerus
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.1.1"
+  path:
+    dependency: "direct main"
+    description:
+      name: path
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.8.0"
+  path_drawing:
+    dependency: transitive
+    description:
+      name: path_drawing
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.5.1+1"
+  path_parsing:
+    dependency: transitive
+    description:
+      name: path_parsing
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.2.1"
+  petitparser:
+    dependency: transitive
+    description:
+      name: petitparser
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "4.4.0"
+  plugin_platform_interface:
+    dependency: transitive
+    description:
+      name: plugin_platform_interface
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.1.3"
+  provider:
+    dependency: "direct main"
+    description:
+      name: provider
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "6.0.5"
+  quiver:
+    dependency: transitive
+    description:
+      name: quiver
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "3.1.0"
+  sky_engine:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.99"
+  source_span:
+    dependency: transitive
+    description:
+      name: source_span
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.8.1"
+  stack_trace:
+    dependency: transitive
+    description:
+      name: stack_trace
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.10.0"
+  stream_channel:
+    dependency: transitive
+    description:
+      name: stream_channel
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.1.0"
+  string_scanner:
+    dependency: transitive
+    description:
+      name: string_scanner
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.1.0"
+  term_glyph:
+    dependency: transitive
+    description:
+      name: term_glyph
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.2.0"
+  test_api:
+    dependency: transitive
+    description:
+      name: test_api
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.4.8"
+  tuple:
+    dependency: transitive
+    description:
+      name: tuple
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.0.1"
+  typed_data:
+    dependency: transitive
+    description:
+      name: typed_data
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.3.0"
+  vector_math:
+    dependency: transitive
+    description:
+      name: vector_math
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.1.1"
+  video_player:
+    dependency: transitive
+    description:
+      name: video_player
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.5.1"
+  video_player_android:
+    dependency: transitive
+    description:
+      name: video_player_android
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.3.10"
+  video_player_avfoundation:
+    dependency: transitive
+    description:
+      name: video_player_avfoundation
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.3.8"
+  video_player_platform_interface:
+    dependency: transitive
+    description:
+      name: video_player_platform_interface
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "6.0.1"
+  video_player_web:
+    dependency: transitive
+    description:
+      name: video_player_web
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.0.13"
+  wakelock:
+    dependency: transitive
+    description:
+      name: wakelock
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.6.2"
+  wakelock_macos:
+    dependency: transitive
+    description:
+      name: wakelock_macos
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.4.0"
+  wakelock_platform_interface:
+    dependency: transitive
+    description:
+      name: wakelock_platform_interface
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.3.0"
+  wakelock_web:
+    dependency: transitive
+    description:
+      name: wakelock_web
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.4.0"
+  wakelock_windows:
+    dependency: transitive
+    description:
+      name: wakelock_windows
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.2.0"
+  webview_flutter:
+    dependency: transitive
+    description:
+      name: webview_flutter
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.8.0"
+  webview_flutter_android:
+    dependency: transitive
+    description:
+      name: webview_flutter_android
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.8.14"
+  webview_flutter_platform_interface:
+    dependency: transitive
+    description:
+      name: webview_flutter_platform_interface
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.9.5"
+  webview_flutter_wkwebview:
+    dependency: transitive
+    description:
+      name: webview_flutter_wkwebview
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.7.5"
+  win32:
+    dependency: transitive
+    description:
+      name: win32
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.5.2"
+  xml:
+    dependency: transitive
+    description:
+      name: xml
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "5.3.1"
+  yaru:
+    dependency: "direct main"
+    description:
+      name: yaru
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.2.5"
+  yaru_icons:
+    dependency: "direct main"
+    description:
+      name: yaru_icons
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.1.3"
+  yaru_widgets:
+    dependency: "direct main"
+    description:
+      name: yaru_widgets
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.0.8"
+sdks:
+  dart: ">=2.15.0 <3.0.0"
+  flutter: ">=2.10.0"
diff --git a/pkgs/servers/monitoring/prometheus/promscale/0001-remove-jaeger-test-dep.patch b/pkgs/servers/monitoring/prometheus/promscale/0001-remove-jaeger-test-dep.patch
deleted file mode 100644
index 9266a9aca53..00000000000
--- a/pkgs/servers/monitoring/prometheus/promscale/0001-remove-jaeger-test-dep.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-
-A Promscale test has a dependency on a package which was not intended to be
-vendored, so `go mod vendor` breaks. The dependency is not required to build
-Promscale, so it can be removed.
-
-diff --git a/pkg/tests/end_to_end_tests/trace_query_integration_test.go b/pkg/tests/end_to_end_tests/trace_query_integration_test.go
-index 84a0d08..efbe5e1 100644
---- a/pkg/tests/end_to_end_tests/trace_query_integration_test.go
-+++ b/pkg/tests/end_to_end_tests/trace_query_integration_test.go
-@@ -24,7 +24,6 @@ import (
- 	ingstr "github.com/timescale/promscale/pkg/pgmodel/ingestor"
- 	"github.com/timescale/promscale/pkg/pgxconn"
- 
--	jaegerQueryApp "github.com/jaegertracing/jaeger/cmd/query/app"
- 	jaegerQueryService "github.com/jaegertracing/jaeger/cmd/query/app/querysvc"
- 	jaegerJSONModel "github.com/jaegertracing/jaeger/model/json"
- )
diff --git a/pkgs/servers/monitoring/prometheus/promscale/default.nix b/pkgs/servers/monitoring/prometheus/promscale/default.nix
index fbd1661c5f8..7dcc5f01e47 100644
--- a/pkgs/servers/monitoring/prometheus/promscale/default.nix
+++ b/pkgs/servers/monitoring/prometheus/promscale/default.nix
@@ -7,20 +7,16 @@
 
 buildGoModule rec {
   pname = "promscale";
-  version = "0.10.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = pname;
     rev = version;
-    sha256 = "sha256-KF+aD9vJYqNJkJftx27ZsxmOIXZ/2ciKwjwcTw0GBvY=";
+    sha256 = "sha256-JizUI9XRzOEHF1kAblYQRYB11z9KWX7od3lPiRN+JNI=";
   };
 
-  patches = [
-    ./0001-remove-jaeger-test-dep.patch
-  ];
-
-  vendorSha256 = "sha256-/cjRM8CrOKnx0BcRu2+MLV28MYLOrG5x1DN24mRUJzQ=";
+  vendorSha256 = "sha256-lnyKsipr/f9W9LWLb2lizKGLvIbS3XnSlOH1u1B87OY=";
 
   ldflags = [
     "-s"
@@ -28,7 +24,11 @@ buildGoModule rec {
     "-X github.com/timescale/promscale/pkg/version.Version=${version}"
     "-X github.com/timescale/promscale/pkg/version.CommitHash=${src.rev}"
   ];
-
+  preBuild = ''
+    # Without this build fails with
+    # main module (github.com/timescale/promscale) does not contain package github.com/timescale/promscale/migration-tool/cmd/prom-migrator
+    rm -r migration-tool
+  '';
   checkPhase = ''
     runHook preCheck
 
@@ -51,6 +51,6 @@ buildGoModule rec {
     changelog = "https://github.com/timescale/promscale/blob/${version}/CHANGELOG.md";
     license = licenses.asl20;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ _0x4A6F ];
+    maintainers = with maintainers; [ _0x4A6F anpin ];
   };
 }
diff --git a/pkgs/servers/simple-http-server/default.nix b/pkgs/servers/simple-http-server/default.nix
index e59b9d73d5a..f2d8309d090 100644
--- a/pkgs/servers/simple-http-server/default.nix
+++ b/pkgs/servers/simple-http-server/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "simple-http-server";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "TheWaWaR";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-b+z3rio+kg1Z0B4pqhTlCTtzXgAeCAhinSa9dkIwcaY=";
+    sha256 = "sha256-Xi5tJIfK4zjckKERhxHuDqeyOB9Dxul/eFLKOtpgR/w=";
   };
 
-  cargoSha256 = "sha256-teBqgQloI/13F7K/+EBKFcHWqcK1wJrNUu5LO8nwQbo=";
+  cargoSha256 = "sha256-wv1hlBTQe1Mm67J2FqrrXSSlZkFPB0TzKc5VUMMfUIQ=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/servers/sql/postgresql/ext/promscale_extension.nix b/pkgs/servers/sql/postgresql/ext/promscale_extension.nix
new file mode 100644
index 00000000000..e031bb4c021
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/ext/promscale_extension.nix
@@ -0,0 +1,60 @@
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, buildPgxExtension
+, postgresql
+, stdenv
+, nixosTests
+}:
+
+buildPgxExtension rec {
+  inherit postgresql;
+
+  pname = "promscale_extension";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "timescale";
+    repo = "promscale_extension";
+    rev = version;
+    sha256 = "sha256-vyEfQMGguHrHYdBEEmbev29L2uCa/4xL9DpGIniUwfI=";
+  };
+
+  cargoSha256 = "sha256-VK9DObkg4trcGUXxxISCd0zqU3vc1Qt6NxqpgKIARCQ=";
+
+  cargoPatches = [
+    # there is a duplicate definition in the lock file which fails to build with buildRustPackage
+    (fetchpatch {
+      name = "cargo-vendor.patch";
+      url = "https://github.com/timescale/promscale_extension/commit/3048bd959430e9abc2c1d5c772ab6b4fc1dc6a95.patch";
+      hash = "sha256-xTk4Ml8GN06QlJdrvAdVK21r30ZR/S83y5A5jJPdOw4=";
+    })
+  ];
+
+  preBuild = ''
+    patchShebangs create-upgrade-symlinks.sh extract-extension-version.sh
+    ## Hack to boostrap the build because some pgx commands require this file. It gets re-generated later.
+    cp templates/promscale.control ./promscale.control
+  '';
+  postInstall = ''
+    ln -s $out/lib/promscale-${version}.so $out/lib/promscale.so
+  '';
+  passthru.tests = {
+    promscale = nixosTests.promscale;
+  };
+
+  # tests take really long
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Promscale is an open source observability backend for metrics and traces powered by SQL";
+    homepage = "https://github.com/timescale/promscale_extension";
+    maintainers = with maintainers; [ anpin ];
+    platforms = postgresql.meta.platforms;
+    license = licenses.unfree;
+
+    # as it needs to be used with timescaledb, simply use the condition from there
+    broken = versionOlder postgresql.version "12"
+             || versionAtLeast postgresql.version "15";
+  };
+}
diff --git a/pkgs/servers/sql/postgresql/packages.nix b/pkgs/servers/sql/postgresql/packages.nix
index 211a54bb552..c94b91f02e2 100644
--- a/pkgs/servers/sql/postgresql/packages.nix
+++ b/pkgs/servers/sql/postgresql/packages.nix
@@ -71,6 +71,8 @@ self: super: {
 
     pg_safeupdate = super.callPackage ./ext/pg_safeupdate.nix { };
 
+    promscale_extension = super.callPackage ./ext/promscale_extension.nix { };
+
     repmgr = super.callPackage ./ext/repmgr.nix { };
 
     rum = super.callPackage ./ext/rum.nix { };
diff --git a/pkgs/tools/backup/rustic-rs/default.nix b/pkgs/tools/backup/rustic-rs/default.nix
index def401ca187..1e7d7939fbc 100644
--- a/pkgs/tools/backup/rustic-rs/default.nix
+++ b/pkgs/tools/backup/rustic-rs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rustic-rs";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "rustic-rs";
     repo = "rustic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-r1h21J+pR8HiFfSxBwTVhuPFtc7HP+XnI3Xtx4oRKzY=";
+    hash = "sha256-DL6IpWUGZT5kqnJVFehjMZAmBp2shUZSA5KvJDa9FFY=";
   };
 
-  cargoHash = "sha256-HiGBp79bxxZaupPo5s6cjXa4Q83O9i8VLzB9psjKSfo=";
+  cargoHash = "sha256-K4bj0jE+PuOL2mEeVEI84On17Jyw7PKtNPQzDKMvY+c=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/graphics/gmic-qt/default.nix b/pkgs/tools/graphics/gmic-qt/default.nix
index d81fe16a910..fa974aa97c8 100644
--- a/pkgs/tools/graphics/gmic-qt/default.nix
+++ b/pkgs/tools/graphics/gmic-qt/default.nix
@@ -108,5 +108,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.lilyinstarlight ];
     platforms = platforms.unix;
+    mainProgram = "gmic_qt";
   };
 }
diff --git a/pkgs/tools/misc/boxxy/default.nix b/pkgs/tools/misc/boxxy/default.nix
index 1de9bd0469d..d9a694f27c5 100644
--- a/pkgs/tools/misc/boxxy/default.nix
+++ b/pkgs/tools/misc/boxxy/default.nix
@@ -1,23 +1,23 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
-, stdenv
 , pkg-config
 , oniguruma
+, stdenv
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "boxxy";
-  version = "0.6.4";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "queer";
     repo = "boxxy";
     rev = "v${version}";
-    hash = "sha256-OUnvjn58jVMg4wYwoSMsqQvy5yveF+KeRjkjvB1W/Q4=";
+    hash = "sha256-QbXR79jmTlrqFlg5ZpXJXO/YljcCrwGrucRwASA5aK0=";
   };
 
-  cargoHash = "sha256-UhtxvEK3hknBdLS1eOlEPng+THoPuhYGIFhYz4LpF5E=";
+  cargoHash = "sha256-Mc6UjO3/XGIz25tHQFjRT/xf3KMfr/miiZDIR9lHnGY=";
 
   nativeBuildInputs = [
     pkg-config
@@ -27,7 +27,9 @@ rustPlatform.buildRustPackage rec {
     oniguruma
   ];
 
-  RUSTONIG_SYSTEM_LIBONIG = true;
+  env = {
+    RUSTONIG_SYSTEM_LIBONIG = true;
+  };
 
   meta = with lib; {
     description = "Puts bad Linux applications in a box with only their files";
diff --git a/pkgs/tools/misc/flashrom-stable/default.nix b/pkgs/tools/misc/flashrom-stable/default.nix
new file mode 100644
index 00000000000..168b355475b
--- /dev/null
+++ b/pkgs/tools/misc/flashrom-stable/default.nix
@@ -0,0 +1,46 @@
+{ fetchgit
+, installShellFiles
+, lib
+, libftdi1
+, libgpiod
+, libjaylink
+, libusb1
+, pciutils
+, pkg-config
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "flashrom-stable";
+  version = "1.1";
+
+  src = fetchgit {
+    url = "https://review.coreboot.org/flashrom-stable";
+    rev = "272aae888ce5abf5e999d750ee4577407db32246";
+    hash = "sha256-DR4PAING69+TMsyycGxt1cu0ba1tTlG36+H/pJ0oP4E=";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+  ];
+
+  buildInputs = [
+    libftdi1
+    libgpiod
+    libjaylink
+    libusb1
+    pciutils
+  ];
+
+  makeFlags = [ "PREFIX=$(out)" "libinstall" ];
+
+  meta = with lib; {
+    homepage = "https://www.flashrom.org";
+    description = "Utility for reading, writing, erasing and verifying flash ROM chips.";
+    license = with licenses; [ gpl2 gpl2Plus ];
+    maintainers = with maintainers; [ felixsinger ];
+    platforms = platforms.all;
+    broken = stdenv.isDarwin; # requires DirectHW
+  };
+}
diff --git a/pkgs/tools/misc/gh-dash/default.nix b/pkgs/tools/misc/gh-dash/default.nix
index 131db58c0b8..8d2d7258071 100644
--- a/pkgs/tools/misc/gh-dash/default.nix
+++ b/pkgs/tools/misc/gh-dash/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gh-dash";
-  version = "3.7.6";
+  version = "3.7.7";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "gh-dash";
     rev = "v${version}";
-    hash = "sha256-EYDSfxFOnMuPDZaG1CYQtYLNe6afm/2YYlQPheAKXDg=";
+    hash = "sha256-Ih9Vdt/ds8f37n7onWhvfrgMrE2iXQPwSTgxrui5TYY=";
   };
 
-  vendorHash = "sha256-66GxD48fCWUWMyZ3GiivWNtz0mgI4JHMcvNwHGFTRfU=";
+  vendorHash = "sha256-ZpX+0AyHFWOb75jlIS5/BqKpRkqNpE4SkOJ01CqO/0w=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/security/cosign/default.nix b/pkgs/tools/security/cosign/default.nix
index 5997d5eb33c..5193e3af4c8 100644
--- a/pkgs/tools/security/cosign/default.nix
+++ b/pkgs/tools/security/cosign/default.nix
@@ -13,13 +13,13 @@
 }:
 buildGoModule rec {
   pname = "cosign";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-x03I86WJT+dLToeGzIaPrLJK0G7siVZuJHjE1WjZao0=";
+    hash = "sha256-jJHLCN9hEQy4ijFm6g2E9WvTT43kvPhdRW1aczvEcFs=";
   };
 
   buildInputs =
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
 
-  vendorHash = "sha256-eTyFIuq9G9/0t5ePZNsBpKJ/lcUU0ryqzg6i+nqbHc4=";
+  vendorHash = "sha256-X5CY8U3IgxWD3zpb1f9R9Xk/25x1zxfYXkvXbelFBQc=";
 
   subPackages = [
     "cmd/cosign"
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index b58190c23b3..8bd0c529f39 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-04-22";
+  version = "2023-04-24";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-HE8L7+/41GMxQeMeei4CEBSbr+CzNkew843dK34D48k=";
+    hash = "sha256-RJYyFHTt7Cm6N+ZTD7D6GW/gKhwPhOMriV2+/lFWN10=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index fe28b723b1a..7595e891610 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.12"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.13"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index dfdc81bf957..8a748567b1f 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: a78862340cacb90e2d27b6f7ae670387081a0276
-  ref: refs/tags/6.3.12
+  revision: f58dd240e0c900976bc0609096b3b2e9965f70cb
+  ref: refs/tags/6.3.13
   specs:
-    metasploit-framework (6.3.12)
+    metasploit-framework (6.3.13)
       actionpack (~> 7.0)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
@@ -12,6 +12,7 @@ GIT
       aws-sdk-s3
       bcrypt
       bcrypt_pbkdf
+      bootsnap
       bson
       chunky_png
       dnsruby
@@ -32,7 +33,7 @@ GIT
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.123)
+      metasploit-payloads (= 2.0.126)
       metasploit_data_models
       metasploit_payloads-mettle (= 1.0.20)
       mqtt
@@ -129,7 +130,7 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.748.0)
+    aws-partitions (1.752.0)
     aws-sdk-core (3.171.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
@@ -144,7 +145,7 @@ GEM
     aws-sdk-kms (1.63.0)
       aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.120.1)
+    aws-sdk-s3 (1.121.0)
       aws-sdk-core (~> 3, >= 3.165.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.4)
@@ -153,6 +154,8 @@ GEM
     bcrypt (3.1.18)
     bcrypt_pbkdf (1.1.0)
     bindata (2.4.15)
+    bootsnap (1.16.0)
+      msgpack (~> 1.2)
     bson (4.15.0)
     builder (3.2.4)
     chunky_png (1.4.0)
@@ -238,7 +241,7 @@ GEM
       activemodel (~> 7.0)
       activesupport (~> 7.0)
       railties (~> 7.0)
-    metasploit-payloads (2.0.123)
+    metasploit-payloads (2.0.126)
     metasploit_data_models (6.0.2)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
@@ -288,9 +291,9 @@ GEM
       hashery (~> 2.0)
       ruby-rc4
       ttfunk
-    pg (1.4.6)
+    pg (1.5.1)
     public_suffix (5.0.1)
-    puma (6.2.1)
+    puma (6.2.2)
       nio4r (~> 2.0)
     racc (1.6.2)
     rack (2.2.6.4)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index f2ae0baa3a8..a47cad064f1 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.3.12";
+  version = "6.3.13";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-+ZWH/rOFm6jSEUT6SGnIJ8rBY2GvNc2tDxHH9+TAwiQ=";
+    sha256 = "sha256-bmp5H7awE8ZaLrPt9UEXeK6haaLzejsIq8jk1bbnv/c=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 63e95598142..b3ac89b5ad6 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12pi6xcvwaplzgy24vqiw2q9aaxs5r8gl92kv2gy6riqldgs10gi";
+      sha256 = "18ndv604p1p3gkyy0d958jx2wp74d100q6vbc6ak70a7bv93wqsg";
       type = "gem";
     };
-    version = "1.748.0";
+    version = "1.752.0";
   };
   aws-sdk-core = {
     groups = ["default"];
@@ -154,10 +154,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mapdzm97rv22pca1hvvshwsafa12gd2yv2fcy63dfjn5vjjq893";
+      sha256 = "1s5v3799pi7ik53gv7dl02am5pngv6x4azzwx9my09nll4q3lfk8";
       type = "gem";
     };
-    version = "1.120.1";
+    version = "1.121.0";
   };
   aws-sigv4 = {
     groups = ["default"];
@@ -199,6 +199,16 @@
     };
     version = "2.4.15";
   };
+  bootsnap = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vcg52gwl64xhhal6kwk1pc01y1klzdlnv1awyk89kb91z010x7q";
+      type = "gem";
+    };
+    version = "1.16.0";
+  };
   bson = {
     groups = ["default"];
     platforms = [];
@@ -614,12 +624,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "a78862340cacb90e2d27b6f7ae670387081a0276";
-      sha256 = "0962q3jggiqi1ynwsddgc5iw3ji7r1lliyj4279ai6w5ngz8g5gr";
+      rev = "f58dd240e0c900976bc0609096b3b2e9965f70cb";
+      sha256 = "1xxzwyvdbr68mc43nypkl9ls3bkq2x0zbvdk5rdcc4xhnqgpjskf";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.3.12";
+    version = "6.3.13";
   };
   metasploit-model = {
     groups = ["default"];
@@ -636,10 +646,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ay75vrp7cpxzl1cny3fikgyg4wsg1fz3qqfafrysz0wfmqlkpyp";
+      sha256 = "1dncaysx2llgcy5a4vgv93hbp3cmiqa36ch229vmshfr296vfqr8";
       type = "gem";
     };
-    version = "2.0.123";
+    version = "2.0.126";
   };
   metasploit_data_models = {
     groups = ["default"];
@@ -917,10 +927,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07m6lxljabw9kyww5k5lgsxsznsm1v5l14r1la09gqka9b5kv3yr";
+      sha256 = "0ihx7icaib5hfr51s44aw63y7g8za3gkqk3diwp75hzkbgjj9hrc";
       type = "gem";
     };
-    version = "1.4.6";
+    version = "1.5.1";
   };
   public_suffix = {
     groups = ["default"];
@@ -937,10 +947,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qqd5lb3mamh53ssx0xavmspg4blhq6hd1kipksw20bq71xcklf5";
+      sha256 = "0yf4jmkyy8das7pj1xzwllfvzkhq2p6p534j61d9h4wz3nfyf0s5";
       type = "gem";
     };
-    version = "6.2.1";
+    version = "6.2.2";
   };
   racc = {
     groups = ["default"];
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index 4a7f1baa0c2..c7fa5479121 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -36,11 +36,11 @@ let
 in
 with localPython.pkgs; buildPythonApplication rec {
   pname = "awsebcli";
-  version = "3.20.5";
+  version = "3.20.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EoSEanwGvP3RcemXrVy7iAGrY/vMC6LbwcrXj2OsF8Q=";
+    hash = "sha256-9n6nObYoZlOKgQvSdNqHLRr+RlDoKfR3fgD7Xa9wPzM=";
   };
 
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 4f00b0e30c9..28e9c8e40df 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -782,7 +782,7 @@ mapAliases ({
   keepnote = throw "keepnote has been removed from nixpkgs, as it is stuck on python2"; # Added 2022-01-01
   kerberos = libkrb5; # moved from top-level 2021-03-14
   kexectools = kexec-tools; # Added 2021-09-03
-  kexpand = "kexpand awless has been dropped due to the lack of maintanence from upstream since 2017"; # Added 2022-06-01
+  kexpand = throw "kexpand awless has been dropped due to the lack of maintanence from upstream since 2017"; # Added 2022-06-01
   keybase-go = throw "'keybase-go' has been renamed to/replaced by 'keybase'"; # Converted to throw 2022-02-22
   keysmith = libsForQt5.kdeGear.keysmith; # Added 2021-07-14
   kgx = gnome-console; # Added 2022-02-19
@@ -814,9 +814,9 @@ mapAliases ({
   letsencrypt = throw "'letsencrypt' has been renamed to/replaced by 'certbot'"; # Converted to throw 2022-02-22
   libGL_driver = throw "'libGL_driver' has been renamed to/replaced by 'mesa.drivers'"; # Converted to throw 2022-02-22
   libaudit = throw "'libaudit' has been renamed to/replaced by 'audit'"; # Converted to throw 2022-02-22
-  libayatana-indicator-gtk2 = "'libayatana-indicator-gtk2' has been removed from nixpkgs, as gtk2 is deprecated"; # Added 2022-10-18
+  libayatana-indicator-gtk2 = throw "'libayatana-indicator-gtk2' has been removed from nixpkgs, as gtk2 is deprecated"; # Added 2022-10-18
   libayatana-indicator-gtk3 = libayatana-indicator; # Added 2022-10-18
-  libayatana-appindicator-gtk2 = "'libayatana-appindicator-gtk2' has been removed from nixpkgs, as gtk2 is deprecated"; # Added 2022-10-18
+  libayatana-appindicator-gtk2 = throw "'libayatana-appindicator-gtk2' has been removed from nixpkgs, as gtk2 is deprecated"; # Added 2022-10-18
   libayatana-appindicator-gtk3 = libayatana-appindicator; # Added 2022-10-18
   libbencodetools = bencodetools; # Added 2022-07-30
   libbluedevil = throw "'libbluedevil' (Qt4) is unmaintained and unused since 'kde4.bluedevil's removal in 2017"; # Added 2022-06-14
@@ -1628,7 +1628,7 @@ mapAliases ({
   torchPackages = throw "torchPackages has been removed, as the upstream project has been abandoned"; # Added 2020-03-28
   trang = throw "'trang' has been renamed to/replaced by 'jing-trang'"; # Converted to throw 2022-02-22
   transfig = fig2dev; # Added 2022-02-15
-  transmission-remote-cli = "transmission-remote-cli has been removed, as the upstream project has been abandoned. Please use tremc instead"; # Added 2020-10-14
+  transmission-remote-cli = throw "transmission-remote-cli has been removed, as the upstream project has been abandoned. Please use tremc instead"; # Added 2020-10-14
   transmission_gtk = throw "'transmission_gtk' has been renamed to/replaced by 'transmission-gtk'"; # Converted to throw 2022-02-22
   transmission_remote_gtk = throw "'transmission_remote_gtk' has been renamed to/replaced by 'transmission-remote-gtk'"; # Converted to throw 2022-02-22
   transporter = throw "transporter has been removed. It was archived upstream, so it's considered abandoned";
@@ -1823,10 +1823,6 @@ mapAliases ({
   zeromq3 = throw "zeromq3 has been deprecated by zeromq4";
   jzmq = throw "jzmq has been removed from nixpkgs, as it was unmaintained";
 
-  avian = throw ''
-    The package doesn't compile anymore on NixOS and both development &
-    maintenance is abandoned by upstream.
-  ''; # Cleanup before 21.11, Added 2021-05-07
   ant-dracula-theme = throw "ant-dracula-theme is now dracula-theme, and theme name is Dracula instead of Ant-Dracula";
   dina-font-pcf = dina-font; # Added 2020-02-09
   dnscrypt-proxy = throw "dnscrypt-proxy has been removed. Please use dnscrypt-proxy2"; # Added 2020-02-02
@@ -1860,12 +1856,7 @@ mapAliases ({
     Its new location is obs-studio-plugins.wlrobs.
   ''; # Added 2021-06-01
 
-  oraclejdk8psu = throw "The *psu versions of oraclejdk are no longer provided by upstream"; # Cleanup before 20.09
-  oraclejre8psu = oraclejdk8psu; # Cleanup before 20.09
-  oraclejdk8psu_distro = oraclejdk8psu; # Cleanup before 20.09
   posix_man_pages = man-pages-posix; # Added 2021-04-15
-  riot-desktop = throw "riot-desktop is now element-desktop!"; # Cleanup before 21.05
-  riot-web = throw "riot-web is now element-web"; # Cleanup before 21.05
   sqldeveloper_18 = throw "sqldeveloper_18 is not maintained anymore!"; # Added 2020-02-04
   todolist = throw "todolist is now ultralist"; # Added 2020-12-27
   tor-browser-bundle = throw "tor-browser-bundle was removed because it was out of date and inadequately maintained. Please use tor-browser-bundle-bin instead"; # Added 2020-01-10
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a709b6877de..739980d2809 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7462,6 +7462,8 @@ with pkgs;
 
   flashrom = callPackage ../tools/misc/flashrom { };
 
+  flashrom-stable = callPackage ../tools/misc/flashrom-stable { };
+
   flent = python3Packages.callPackage ../applications/networking/flent { };
 
   flexoptix-app = callPackage ../tools/misc/flexoptix-app { };
@@ -14649,8 +14651,10 @@ with pkgs;
 
   flutterPackages =
     recurseIntoAttrs (callPackage ../development/compilers/flutter { });
-  flutter = flutterPackages.stable;
-  flutter2 = flutterPackages.v2;
+  flutter-unwrapped = flutterPackages.stable;
+  flutter2-unwrapped = flutterPackages.v2;
+  flutter = flutterPackages.wrapFlutter flutter-unwrapped;
+  flutter2 = flutterPackages.wrapFlutter flutter2-unwrapped;
 
   fnm = callPackage ../development/tools/fnm {
     inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation Security;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7517b55ec3f..4b427b1dada 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -22,6 +22,8 @@ self: super: with self; {
 
   accessible-pygments = callPackage ../development/python-modules/accessible-pygments { };
 
+  accelerate = callPackage ../development/python-modules/accelerate { };
+
   accuweather = callPackage ../development/python-modules/accuweather { };
 
   accupy = callPackage ../development/python-modules/accupy { };
@@ -7213,6 +7215,8 @@ self: super: with self; {
 
   pefile = callPackage ../development/python-modules/pefile { };
 
+  peft = callPackage ../development/python-modules/peft { };
+
   pelican = callPackage ../development/python-modules/pelican {
     inherit (pkgs) glibcLocales git;
   };
@@ -10539,6 +10543,8 @@ self: super: with self; {
 
   safeio = callPackage ../development/python-modules/safeio { };
 
+  safetensors = callPackage ../development/python-modules/safetensors { };
+
   safety = callPackage ../development/python-modules/safety { };
 
   sagemaker = callPackage ../development/python-modules/sagemaker { };