Merge staging-next into staging

25 files changed, 352 insertions, 120 deletions

diff --git a/pkgs/applications/editors/orbiton/default.nix b/pkgs/applications/editors/orbiton/default.nix
index 05f8c9a2ce5d6..d02aaf2dd03d9 100644
--- a/pkgs/applications/editors/orbiton/default.nix
+++ b/pkgs/applications/editors/orbiton/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "orbiton";
-  version = "2.62.6";
+  version = "2.62.7";
 
   src = fetchFromGitHub {
     owner = "xyproto";
     repo = "orbiton";
     rev = "v${version}";
-    hash = "sha256-wSefvbpqxEbzgReOBPcot+VeXazwK/NPzh+wmmYhrls=";
+    hash = "sha256-NQBFplrYh33zcKfXrcZpWrF3Uac7YXdxh3D+wixEzP0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/file-managers/clifm/default.nix b/pkgs/applications/file-managers/clifm/default.nix
index c4c2d9e6528b5..f07309a8ad806 100644
--- a/pkgs/applications/file-managers/clifm/default.nix
+++ b/pkgs/applications/file-managers/clifm/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clifm";
-  version = "1.10";
+  version = "1.13";
 
   src = fetchFromGitHub {
     owner = "leo-arch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kXnI8a1nGKBDc+isv9RYvputKk+/FHmM9j+G4UnI5Z4=";
+    sha256 = "sha256-Y9z3HT36Z1fwweOnniRgyNQX1cbrLSGGgB5UAxkq9mI=";
   };
 
   buildInputs = [ libcap acl file readline ];
diff --git a/pkgs/applications/networking/p2p/zeronet-conservancy/default.nix b/pkgs/applications/networking/p2p/zeronet-conservancy/default.nix
index e1a2a38264477..c8ac75683ae29 100644
--- a/pkgs/applications/networking/p2p/zeronet-conservancy/default.nix
+++ b/pkgs/applications/networking/p2p/zeronet-conservancy/default.nix
@@ -6,29 +6,33 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "zeronet-conservancy";
-  version = "0.7.8.1";
+  version = "0.7.10";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "zeronet-conservancy";
     repo = "zeronet-conservancy";
     rev = "v${version}";
-    sha256 = "sha256-+wZiwUy5bmW8+3h4SuvNN8I6mCIPOlOeFmiXlMu12OU=";
+    sha256 = "sha256-ZQYdK0B0z0cXTx7ujFngW3wSa/j8sEuwHB+BC5Xqq8o=";
   };
 
   propagatedBuildInputs = with python3Packages; [
     gevent msgpack base58 merkletools rsa pysocks pyasn1 websocket-client
     gevent-websocket rencode bitcoinlib maxminddb pyopenssl rich defusedxml
-    pyaes
+    pyaes coincurve
   ];
 
   buildPhase = ''
+    runHook preBuild
     ${python3Packages.python.pythonForBuild.interpreter} -O -m compileall .
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/share
     cp -r plugins src *.py $out/share/
+    runHook postInstall
   '';
 
   postFixup = ''
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 70aaa32526e7b..b93d7d6606c49 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -67,7 +67,7 @@
 , sdl2Support        ? true,           SDL2
 , sixelSupport       ? false,          libsixel
 , speexSupport       ? true,           speex
-, swiftSupport       ? stdenv.isDarwin && stdenv.isAarch64, swift
+, swiftSupport       ? stdenv.isDarwin, swift
 , theoraSupport      ? true,           libtheora
 , vaapiSupport       ? x11Support || waylandSupport, libva
 , vapoursynthSupport ? false,          vapoursynth
@@ -82,7 +82,20 @@ let
   inherit (darwin.apple_sdk_11_0.frameworks)
     AVFoundation CoreFoundation CoreMedia Cocoa CoreAudio MediaPlayer Accelerate;
   luaEnv = lua.withPackages (ps: with ps; [ luasocket ]);
-in stdenv.mkDerivation (finalAttrs: {
+
+  overrideSDK = platform: version:
+    platform // lib.optionalAttrs (platform ? darwinMinVersion) {
+      darwinMinVersion = version;
+    };
+
+  stdenv' = if swiftSupport && stdenv.isDarwin && stdenv.isx86_64
+    then stdenv.override (old: {
+      buildPlatform = overrideSDK old.buildPlatform "10.15";
+      hostPlatform = overrideSDK old.hostPlatform "10.15";
+      targetPlatform = overrideSDK old.targetPlatform "10.15";
+    })
+    else stdenv;
+in stdenv'.mkDerivation (finalAttrs: {
   pname = "mpv";
   version = "0.35.1";
 
diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index fbc4482536f1f..7b994433840b0 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -23,6 +23,7 @@ let
     "test_exec.py"
     "test_hooks.py"
     "test_hostname.py"
+    "test_oci_features"
     "test_paths.py"
     "test_pid.py"
     "test_pid_file.py"
@@ -38,13 +39,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.8.5";
+  version = "1.8.6";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    hash = "sha256-T51dVNtqQbXoPshlAkBzJOGTNTPM+AlqRYbqS8GX2NE=";
+    hash = "sha256-qPbJ8h/s4E7EmNlgBdrNZ0AW0D/N7PkK57C1cXjuM9U=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/aioslimproto/default.nix b/pkgs/development/python-modules/aioslimproto/default.nix
index c2cdb28e399a2..af681eec8ad40 100644
--- a/pkgs/development/python-modules/aioslimproto/default.nix
+++ b/pkgs/development/python-modules/aioslimproto/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aioslimproto";
-  version = "2.3.2";
+  version = "2.3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-vKIqBbWQNgv1v73P6K51K+yaqXgC1BtllZ59yTNPr2g=";
+    hash = "sha256-d+PEzCF1Cw/7NmumxIRRlr3hojpNsZM/JMQ0KWdosXk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bluetooth-data-tools/default.nix b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
index 729547d17237b..918cba4f54b1a 100644
--- a/pkgs/development/python-modules/bluetooth-data-tools/default.nix
+++ b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-data-tools";
-  version = "1.6.0";
+  version = "1.6.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Doz8T7XuX/8JFu1yutTUxrtvasDLWD3Fp/+JMLEUIQM=";
+    hash = "sha256-A3zdM2kVmz8cUix9JT8cnIABZK64r6yiZisvb8A1RSQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
index 85a6b7b5a0edb..bae4dc5a71d92 100644
--- a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
+++ b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-bluetooth";
-  version = "1.10.0";
+  version = "1.10.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-g8vdg7YU3rkXW85U4w9Hvb6u9uvoDphbkIlVXchCRxQ=";
+    hash = "sha256-zNhqiWYZ3tv6lwYgmi6Yue+mFcgk7Y1dDMbzWlsvVJM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/language-servers/millet/Cargo.lock b/pkgs/development/tools/language-servers/millet/Cargo.lock
index 44ac46ca3f4e9..96f0e67abb303 100644
--- a/pkgs/development/tools/language-servers/millet/Cargo.lock
+++ b/pkgs/development/tools/language-servers/millet/Cargo.lock
@@ -28,11 +28,12 @@ dependencies = [
 
 [[package]]
 name = "analysis"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "config",
  "diagnostic",
  "elapsed",
+ "fast-hash",
  "fmt-util",
  "input",
  "mlb-statics",
@@ -114,7 +115,7 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chain-map"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -127,7 +128,7 @@ source = "git+https://github.com/azdavis/language-util.git#f2c149459f0544fb6a8e1
 
 [[package]]
 name = "cm-syntax"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "lex-util",
  "paths",
@@ -156,7 +157,7 @@ dependencies = [
 
 [[package]]
 name = "config"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "fast-hash",
  "serde",
@@ -184,7 +185,7 @@ checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
 
 [[package]]
 name = "cov-mark"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -411,7 +412,7 @@ dependencies = [
 
 [[package]]
 name = "input"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "cm-syntax",
  "config",
@@ -459,7 +460,7 @@ checksum = "3752f229dcc5a481d60f385fa479ff46818033d881d2d801aa27dffcfb5e8306"
 
 [[package]]
 name = "lang-srv"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "analysis",
  "anyhow",
@@ -487,7 +488,7 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "lex-util"
-version = "0.12.7"
+version = "0.12.8"
 
 [[package]]
 name = "libc"
@@ -559,7 +560,7 @@ dependencies = [
 
 [[package]]
 name = "millet-cli"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "analysis",
  "codespan-reporting",
@@ -577,7 +578,7 @@ dependencies = [
 
 [[package]]
 name = "millet-ls"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "env_logger",
@@ -597,7 +598,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-hir"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "fast-hash",
  "paths",
@@ -608,7 +609,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-statics"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "config",
  "diagnostic",
@@ -632,7 +633,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-syntax"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "lex-util",
  "paths",
@@ -695,7 +696,7 @@ checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "panic-hook"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "better-panic",
 ]
@@ -898,7 +899,7 @@ dependencies = [
 
 [[package]]
 name = "slash-var-path"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -906,14 +907,14 @@ dependencies = [
 
 [[package]]
 name = "sml-comment"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "sml-syntax",
 ]
 
 [[package]]
 name = "sml-dynamics"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "fast-hash",
  "fmt-util",
@@ -924,7 +925,7 @@ dependencies = [
 
 [[package]]
 name = "sml-dynamics-tests"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "config",
  "pretty_assertions",
@@ -940,7 +941,7 @@ dependencies = [
 
 [[package]]
 name = "sml-file-syntax"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "config",
  "elapsed",
@@ -954,7 +955,7 @@ dependencies = [
 
 [[package]]
 name = "sml-fixity"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -963,7 +964,7 @@ dependencies = [
 
 [[package]]
 name = "sml-hir"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "la-arena",
  "sml-lab",
@@ -974,7 +975,7 @@ dependencies = [
 
 [[package]]
 name = "sml-hir-lower"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "config",
  "cov-mark",
@@ -989,14 +990,14 @@ dependencies = [
 
 [[package]]
 name = "sml-lab"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-lex"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "cov-mark",
  "diagnostic",
@@ -1011,7 +1012,7 @@ source = "git+https://github.com/azdavis/sml-libs.git#3948485e5bf5649e50271caf3e
 
 [[package]]
 name = "sml-naive-fmt"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "fast-hash",
  "sml-comment",
@@ -1020,11 +1021,11 @@ dependencies = [
 
 [[package]]
 name = "sml-namespace"
-version = "0.12.7"
+version = "0.12.8"
 
 [[package]]
 name = "sml-parse"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "diagnostic",
  "event-parse",
@@ -1036,14 +1037,14 @@ dependencies = [
 
 [[package]]
 name = "sml-path"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-scon"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "num-bigint",
  "num-traits",
@@ -1052,7 +1053,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "chain-map",
  "config",
@@ -1075,7 +1076,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics-types"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "chain-map",
  "code-h2-md-map",
@@ -1094,7 +1095,7 @@ dependencies = [
 
 [[package]]
 name = "sml-symbol-kind"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "sml-namespace",
  "sml-statics-types",
@@ -1102,7 +1103,7 @@ dependencies = [
 
 [[package]]
 name = "sml-syntax"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "code-h2-md-map",
  "fast-hash",
@@ -1113,7 +1114,7 @@ dependencies = [
 
 [[package]]
 name = "sml-ty-var-scope"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "fast-hash",
  "sml-hir",
@@ -1171,7 +1172,7 @@ dependencies = [
 
 [[package]]
 name = "tests"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "analysis",
  "cm-syntax",
@@ -1515,7 +1516,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "0.12.7"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "flate2",
diff --git a/pkgs/development/tools/language-servers/millet/default.nix b/pkgs/development/tools/language-servers/millet/default.nix
index 017474c692706..d28677fc3a8ff 100644
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.12.7";
+  version = "0.12.8";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-W1Iq9vd7rkqx+0d+BIUnSxLQZG7X6K4JkGKc7zJSEIQ=";
+    hash = "sha256-H44aQGrLv/A1yo44DaR9FJ0ReXiHU4SQ3zLoEkxF9M8=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 08dfc02cbd15c..bf1787e23ae86 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "17.12.0";
+  version = "18.1.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-evZ8o6KMbnhVGY7gGicvs5hYxxHGxfkGAtcZPQd0Bvc=";
+    hash = "sha256-qK9hjsWhVTzxFo4SSvKb5IgZteVabWlCtoetu9v9xIE=";
   };
 
-  vendorHash = "sha256-sdUvtp/qXneP1z2MnV2XNGbBV/LXgAug5ueO83foNCA=";
+  vendorHash = "sha256-cATGMi/nL8dvlsR+cuvKH6Y9eR3UqcVjvZAj35Ydn2c=";
 
   sourceRoot = "source/src";
 
diff --git a/pkgs/servers/http/tengine/default.nix b/pkgs/servers/http/tengine/default.nix
index 5b1edb5a2d86c..e80185ac5cbb4 100644
--- a/pkgs/servers/http/tengine/default.nix
+++ b/pkgs/servers/http/tengine/default.nix
@@ -10,14 +10,14 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  version = "2.4.1";
+  version = "3.0.0";
   pname = "tengine";
 
   src = fetchFromGitHub {
     owner = "alibaba";
     repo = pname;
     rev = version;
-    hash = "sha256-h9PFzJc/29WFe4mW+xpJAL1Z2XqBxMEtQeN5DMgOVBA=";
+    hash = "sha256-nUwPT7374dfE/T6yuCUynObq6LxBHDp90Dj2JGwJ4+M=";
   };
 
   buildInputs =
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 7d4c10688b80b..02bf8cbd4e6c3 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -18,14 +18,11 @@
 
 buildGoModule rec {
   pname = "lxd-unwrapped";
-  version = "5.15";
+  version = "5.16";
 
   src = fetchurl {
-    urls = [
-      "https://linuxcontainers.org/downloads/lxd/lxd-${version}.tar.gz"
-      "https://github.com/lxc/lxd/releases/download/lxd-${version}/lxd-${version}.tar.gz"
-    ];
-    hash = "sha256-ez/875yu0XYu5ORf4ak6RN1jWGxuGk0n9023zJkoluM=";
+    url = "https://github.com/canonical/lxd/releases/download/lxd-${version}/lxd-${version}.tar.gz";
+    hash = "sha256-evtNPZvnx8rzr/tJkEp0E7BhUBWHBSJdMtZJQk3VZI8=";
   };
 
   vendorHash = null;
@@ -35,7 +32,7 @@ buildGoModule rec {
       --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
   '';
 
-  excludedPackages = [ "test" "lxd/db/generate" ];
+  excludedPackages = [ "test" "lxd/db/generate" "lxd-agent" "lxd-migrate" ];
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [
@@ -52,10 +49,15 @@ buildGoModule rec {
   tags = [ "libsqlite3" ];
 
   preBuild = ''
-    # required for go-dqlite. See: https://github.com/lxc/lxd/pull/8939
+    # required for go-dqlite. See: https://github.com/canonical/lxd/pull/8939
     export CGO_LDFLAGS_ALLOW="(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"
   '';
 
+  # build static binaries: https://github.com/canonical/lxd/blob/6fd175c45e65cd475d198db69d6528e489733e19/Makefile#L43-L51
+  postBuild = ''
+    make lxd-agent lxd-migrate
+  '';
+
   preCheck =
     let skippedTests = [
       "TestValidateConfig"
@@ -78,14 +80,14 @@ buildGoModule rec {
   passthru.tests.lxd-ui = nixosTests.lxd-ui;
   passthru.ui = callPackage ./ui.nix { };
   passthru.updateScript = gitUpdater {
-    url = "https://github.com/lxc/lxd.git";
+    url = "https://github.com/canonical/lxd.git";
     rev-prefix = "lxd-";
   };
 
   meta = with lib; {
     description = "Daemon based on liblxc offering a REST API to manage containers";
-    homepage = "https://linuxcontainers.org/lxd/";
-    changelog = "https://github.com/lxc/lxd/releases/tag/lxd-${version}";
+    homepage = "https://ubuntu.com/lxd";
+    changelog = "https://github.com/canonical/lxd/releases/tag/lxd-${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ marsam adamcstephens ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/admin/lxd/ui.nix b/pkgs/tools/admin/lxd/ui.nix
index 3ffcb00a9e378..a6d41659a9da3 100644
--- a/pkgs/tools/admin/lxd/ui.nix
+++ b/pkgs/tools/admin/lxd/ui.nix
@@ -33,8 +33,7 @@ mkYarnPackage rec {
 
   meta = {
     description = "Web user interface for LXD.";
-    homepage = "https://linuxcontainers.org/lxd/";
-    changelog = "https://github.com/canonical/lxd-ui";
+    homepage = "https://github.com/canonical/lxd-ui";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ jnsgruk ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/tools/filesystems/dwarfs/default.nix b/pkgs/tools/filesystems/dwarfs/default.nix
index cd774395c2c1d..e5804f3785296 100644
--- a/pkgs/tools/filesystems/dwarfs/default.nix
+++ b/pkgs/tools/filesystems/dwarfs/default.nix
@@ -7,7 +7,7 @@
 , boost
 , cmake
 , double-conversion
-, fmt_8
+, fmt
 , fuse3
 , glog
 , gtest
@@ -20,30 +20,27 @@
 , pkg-config
 , ronn
 , xxHash
+, utf8cpp
 , zstd
 }:
 
 stdenv.mkDerivation rec {
   pname = "dwarfs";
-  version = "0.6.2";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "mhx";
     repo = "dwarfs";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-fA/3AooDndqYiK215cu/zTqCqeccHnwIX2CfJ9sC+Fc=";
+    hash = "sha256-DcPRrATI2cpLZWAL+sSCoXvJ1R0O3yHqhlJW1aEpDpA=";
   };
 
-  patches = with lib.versions; [
-    (substituteAll {
+  patches = [
+    (with lib.versions; substituteAll {
       src = ./version_info.patch;
 
-      gitRev = "v${version}";
-      gitDesc = "v${version}";
-      gitBranch = "v${version}";
-      gitId = "v${version}"; # displayed as version number
-
+      versionFull = version; # displayed as version number (with v prepended)
       versionMajor = major version;
       versionMinor = minor version;
       versionPatch = patch version;
@@ -54,14 +51,11 @@ stdenv.mkDerivation rec {
     "-DPREFER_SYSTEM_ZSTD=ON"
     "-DPREFER_SYSTEM_XXHASH=ON"
     "-DPREFER_SYSTEM_GTEST=ON"
+    "-DPREFER_SYSTEM_LIBFMT=ON"
 
     # may be added under an option in the future
     # "-DWITH_LEGACY_FUSE=ON"
     "-DWITH_TESTS=ON"
-
-    # temporary hack until folly builds work on aarch64,
-    # see https://github.com/facebook/folly/issues/1880
-    "-DCMAKE_LIBRARY_ARCHITECTURE=${if stdenv.isx86_64 then "x86_64" else "dummy"}"
   ];
 
   nativeBuildInputs = [
@@ -74,12 +68,13 @@ stdenv.mkDerivation rec {
   buildInputs = [
     # dwarfs
     boost
-    fmt_8
+    fmt
     fuse3
     jemalloc
     libarchive
     lz4
     xxHash
+    utf8cpp
     zstd
 
     # folly
@@ -92,9 +87,9 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
   nativeCheckInputs = [ gtest ];
-  # this fails inside of the sandbox due to missing access
+  # these fail inside of the sandbox due to missing access
   # to the FUSE device
-  GTEST_FILTER = "-tools.everything";
+  GTEST_FILTER = "-dwarfs/tools_test.end_to_end/*:dwarfs/tools_test.mutating_ops/*";
 
   meta = with lib; {
     description = "A fast high compression read-only file system";
diff --git a/pkgs/tools/filesystems/dwarfs/version_info.patch b/pkgs/tools/filesystems/dwarfs/version_info.patch
index 59936302ace01..8d62bd8d22957 100644
--- a/pkgs/tools/filesystems/dwarfs/version_info.patch
+++ b/pkgs/tools/filesystems/dwarfs/version_info.patch
@@ -1,6 +1,24 @@
+diff --git a/cmake/package_version.cmake b/cmake/package_version.cmake
+new file mode 100644
+index 0000000..d4fdb9c
+--- /dev/null
++++ b/cmake/package_version.cmake
+@@ -0,0 +1,12 @@
++# autogenerated code, do not modify
++
++set(PRJ_GIT_REV "v@versionFull@")
++set(PRJ_GIT_DESC "v@versionFull@")
++set(PRJ_GIT_BRANCH "HEAD")
++set(PRJ_GIT_ID "v@versionFull@")
++set(PRJ_GIT_RELEASE_TAG "v@versionFull@")
++set(PRJ_VERSION_FULL "@versionFull@")
++set(PRJ_VERSION_SHORT "@versionFull@")
++set(PRJ_VERSION_MAJOR "@versionMajor@")
++set(PRJ_VERSION_MINOR "@versionMinor@")
++set(PRJ_VERSION_PATCH "@versionPatch@")
 diff --git a/include/dwarfs/version.h b/include/dwarfs/version.h
-new file mode 100755
-index 0000000..9b12c59
+new file mode 100644
+index 0000000..54cf86a
 --- /dev/null
 +++ b/include/dwarfs/version.h
 @@ -0,0 +1,16 @@
@@ -21,8 +39,8 @@ index 0000000..9b12c59
 +
 +} // namespace dwarfs
 diff --git a/src/dwarfs/version.cpp b/src/dwarfs/version.cpp
-new file mode 100755
-index 0000000..3af0215
+new file mode 100644
+index 0000000..5759120
 --- /dev/null
 +++ b/src/dwarfs/version.cpp
 @@ -0,0 +1,12 @@
@@ -32,9 +50,9 @@ index 0000000..3af0215
 +
 +namespace dwarfs {
 +
-+char const* PRJ_GIT_REV = "@gitRev@";
-+char const* PRJ_GIT_DESC = "@gitDesc@";
-+char const* PRJ_GIT_BRANCH = "@gitBranch@";
-+char const* PRJ_GIT_ID = "@gitId@";
++char const* PRJ_GIT_REV = "@versionFull@";
++char const* PRJ_GIT_DESC = "v@versionFull@";
++char const* PRJ_GIT_BRANCH = "HEAD";
++char const* PRJ_GIT_ID = "v@versionFull@";
 +
 +} // namespace dwarfs
diff --git a/pkgs/tools/misc/debian-devscripts/default.nix b/pkgs/tools/misc/debian-devscripts/default.nix
index 6109ef3b0c08f..e1ee9757fe89a 100644
--- a/pkgs/tools/misc/debian-devscripts/default.nix
+++ b/pkgs/tools/misc/debian-devscripts/default.nix
@@ -76,6 +76,6 @@ in stdenv.mkDerivation rec {
     description = "Debian package maintenance scripts";
     license = licenses.free; # Mix of public domain, Artistic+GPL, GPL1+, GPL2+, GPL3+, and GPL2-only... TODO
     maintainers = with maintainers; [raskin];
-    platforms = with platforms; linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/nix/devour-flake/default.nix b/pkgs/tools/nix/devour-flake/default.nix
new file mode 100644
index 0000000000000..a42483653550f
--- /dev/null
+++ b/pkgs/tools/nix/devour-flake/default.nix
@@ -0,0 +1,27 @@
+{ writeShellApplication
+, fetchFromGitHub
+, nix
+}:
+
+let
+  devour-flake = fetchFromGitHub {
+    owner = "srid";
+    repo = "devour-flake";
+    rev = "v2";
+    hash = "sha256-CZedJtbZlWAbv/b/aYgOEFd9vcTBn/oJNI3p29UitLk=";
+  };
+in
+writeShellApplication {
+  name = "devour-flake";
+  runtimeInputs = [ nix ];
+  text = ''
+    FLAKE="$1"
+    shift 1 || true
+
+    nix build ${devour-flake}#default \
+      "$@" \
+      -L --no-link --print-out-paths \
+      --override-input flake "$FLAKE" \
+      | xargs cat
+  '';
+}
diff --git a/pkgs/tools/nix/nixci/default.nix b/pkgs/tools/nix/nixci/default.nix
new file mode 100644
index 0000000000000..0d881d6976edc
--- /dev/null
+++ b/pkgs/tools/nix/nixci/default.nix
@@ -0,0 +1,38 @@
+{ lib, stdenv
+, rustPlatform
+, fetchCrate
+, libiconv
+, openssl
+, pkg-config
+, Security
+, devour-flake
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nixci";
+  version = "0.1.3";
+
+  src = fetchCrate {
+    inherit version;
+    pname = "nixci";
+    hash = "sha256-sM/1G1mf+msWbG4CX/pZNt4FmSKR2hWXdcq5h7W1AM0=";
+  };
+
+  cargoHash = "sha256-PKBNQKuWV4PE7iSKr+LugayroFjDBT4/vyyjJiw/E+I=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libiconv openssl ]
+    ++ lib.optionals stdenv.isDarwin [ Security ];
+
+  # The rust program expects an environment (at build time) that points to the
+  # devour-flake executable.
+  DEVOUR_FLAKE = lib.getExe devour-flake;
+
+  meta = with lib; {
+    description = "Define and build CI for Nix projects anywhere";
+    homepage = "https://github.com/srid/nixci";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ srid ];
+    mainProgram = "nixci";
+  };
+}
diff --git a/pkgs/tools/nix/web-devmode.nix b/pkgs/tools/nix/web-devmode.nix
new file mode 100644
index 0000000000000..6ebdc31118f0e
--- /dev/null
+++ b/pkgs/tools/nix/web-devmode.nix
@@ -0,0 +1,117 @@
+{
+  pkgs,
+  # arguments to `nix-build`, e.g. `"foo.nix -A bar"`
+  buildArgs,
+  # what path to open a browser at
+  open,
+}: let
+  inherit (pkgs) lib;
+
+  error_page = pkgs.writeShellScriptBin "error_page" ''
+    echo "<!DOCTYPE html>
+    <html>
+    <head>
+      <style>
+        @media (prefers-color-scheme: dark) {
+          :root { filter: invert(100%); }
+        }
+      </style>
+    </head>
+    <body><pre>$1</pre></body>
+    </html>"
+  '';
+
+  # The following would have been simpler:
+  # 1. serve from `$serve`
+  # 2. pass each build a `--out-link $serve/result`
+  # But that way live-server does not seem to detect changes and therefore no
+  # auto-reloads occur.
+  # Instead, we copy the contents of each build to the `$serve` directory.
+  # Using rsync here, instead of `cp`, to get as close to an atomic
+  # directory copy operation as possible. `--delay-updates` should
+  # also go towards that.
+  build_and_copy = pkgs.writeShellScriptBin "build_and_copy" ''
+    set -euxo pipefail
+
+    set +e
+    stderr=$(2>&1 nix-build --out-link $out_link ${buildArgs})
+    exit_status=$?
+    set -e
+
+    if [ $exit_status -eq 0 ];
+    then
+      # setting permissions to be able to clean up
+      ${lib.getBin pkgs.rsync}/bin/rsync \
+        --recursive \
+        --chmod=u=rwX \
+        --delete-before \
+        --delay-updates \
+        $out_link/ \
+        $serve/
+    else
+      set +x
+      ${lib.getBin error_page}/bin/error_page "$stderr" > $error_page_absolute
+      set -x
+
+      ${lib.getBin pkgs.findutils}/bin/find $serve \
+        -type f \
+        ! -name $error_page_relative \
+        -delete
+    fi
+  '';
+
+  # https://watchexec.github.io/
+  watcher = pkgs.writeShellScriptBin "watcher" ''
+    set -euxo pipefail
+
+    ${lib.getBin pkgs.watchexec}/bin/watchexec \
+      --shell=none \
+      --restart \
+      --print-events \
+      ${lib.getBin build_and_copy}/bin/build_and_copy
+  '';
+
+  # A Rust alternative to live-server exists, but it was not in nixpkgs.
+  # `--no-css-inject`: without this it seems that only CSS is auto-reloaded.
+  # https://www.npmjs.com/package/live-server
+  server = pkgs.writeShellScriptBin "server" ''
+    set -euxo pipefail
+
+    ${lib.getBin pkgs.nodePackages_latest.live-server}/bin/live-server \
+      --host=127.0.0.1 \
+      --verbose \
+      --no-css-inject \
+      --entry-file=$error_page_relative \
+      --open=${open} \
+      $serve
+  '';
+
+  devmode =
+    pkgs.writeShellScriptBin "devmode"
+    ''
+      set -euxo pipefail
+
+      function handle_exit {
+        rm -rf "$tmpdir"
+      }
+
+      tmpdir=$(mktemp -d)
+      trap handle_exit EXIT
+
+      export out_link="$tmpdir/result"
+      export serve="$tmpdir/serve"
+      mkdir $serve
+      export error_page_relative=error.html
+      export error_page_absolute=$serve/$error_page_relative
+      ${lib.getBin error_page}/bin/error_page "building …" > $error_page_absolute
+
+      ${lib.getBin pkgs.parallel}/bin/parallel \
+        --will-cite \
+        --line-buffer \
+        --tagstr '{/}' \
+        ::: \
+        "${lib.getBin watcher}/bin/watcher" \
+        "${lib.getBin server}/bin/server"
+    '';
+in
+  devmode
diff --git a/pkgs/tools/security/enc/default.nix b/pkgs/tools/security/enc/default.nix
index 00d6d0211f80c..646d7c80559eb 100644
--- a/pkgs/tools/security/enc/default.nix
+++ b/pkgs/tools/security/enc/default.nix
@@ -7,17 +7,16 @@
 
 buildGoModule rec {
   pname = "enc";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "life4";
     repo = "enc";
-    rev = "v${version}";
-    sha256 = "Tt+J/MnYJNewSl5UeewS0b47NGW2yzfcVHA5+9UQWSs=";
+    rev = version;
+    hash = "sha256-kVK/+pR3Rzg7oCjHKr+i+lK6nhqlBN6Wj92i4SKU2l0=";
   };
-  vendorSha256 = "lB6GkE6prfBG7OCOJ1gm23Ee5+nAgmJg8I9Nqe1fsRw=";
 
-  proxyVendor = true;
+  vendorHash = "sha256-6LNo4iBZDc0DTn8f/2PdCb6CNFCjU6o1xDkB5m/twJk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/text/difftastic/Cargo.lock b/pkgs/tools/text/difftastic/Cargo.lock
index 2711be4d25836..25e3c8e41fe29 100644
--- a/pkgs/tools/text/difftastic/Cargo.lock
+++ b/pkgs/tools/text/difftastic/Cargo.lock
@@ -187,9 +187,9 @@ dependencies = [
 
 [[package]]
 name = "crossterm"
-version = "0.25.0"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e64e6c0fbe2c17357405f7c758c1ef960fce08bdfb2c03d88d2a18d7e09c4b67"
+checksum = "a84cda67535339806297f1b331d6dd6320470d2a0fe65381e79ee9e156dd3d13"
 dependencies = [
  "bitflags",
  "crossterm_winapi",
@@ -217,7 +217,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f877be4f7c9f246b183111634f75baa039715e3f46ce860677d3b19a69fb229c"
 dependencies = [
  "quote",
- "syn",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -234,7 +234,7 @@ checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
 
 [[package]]
 name = "difftastic"
-version = "0.48.0"
+version = "0.49.0"
 dependencies = [
  "assert_cmd",
  "bumpalo",
@@ -621,9 +621,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.39"
+version = "1.0.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c54b25569025b7fc9651de43004ae593a75ad88543b17178aa5e1b9c4f15f56f"
+checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
 dependencies = [
  "unicode-ident",
 ]
@@ -636,9 +636,9 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
 name = "quote"
-version = "1.0.18"
+version = "1.0.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1feb54ed693b93a84e14094943b84b7c4eae204c512b7ccb95ab0c66d278ad1"
+checksum = "50f3b39ccfb720540debaa0164757101c08ecb8d326b15358ce76a62c7e85965"
 dependencies = [
  "proc-macro2",
 ]
@@ -774,24 +774,24 @@ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
 name = "strum"
-version = "0.24.1"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "063e6045c0e62079840579a7e47a355ae92f60eb74daaf156fb1e84ba164e63f"
+checksum = "290d54ea6f91c969195bdbcd7442c8c2a2ba87da8bf60a7ee86a235d4bc1e125"
 dependencies = [
  "strum_macros",
 ]
 
 [[package]]
 name = "strum_macros"
-version = "0.24.3"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e385be0d24f186b4ce2f9982191e7101bb737312ad61c1f2f984f34bcf85d59"
+checksum = "6069ca09d878a33f883cc06aaa9718ede171841d3832450354410b718b097232"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
  "rustversion",
- "syn",
+ "syn 2.0.27",
 ]
 
 [[package]]
@@ -806,6 +806,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "syn"
+version = "2.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b60f673f44a8255b9c8c657daf66a596d435f2da81a555b06dc644d080ba45e0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
 name = "termcolor"
 version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/pkgs/tools/text/difftastic/default.nix b/pkgs/tools/text/difftastic/default.nix
index 86b8fd3eacd1f..3842fb6b14734 100644
--- a/pkgs/tools/text/difftastic/default.nix
+++ b/pkgs/tools/text/difftastic/default.nix
@@ -16,13 +16,13 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "difftastic";
-  version = "0.48.0";
+  version = "0.49.0";
 
   src = fetchFromGitHub {
     owner = "wilfred";
     repo = pname;
     rev = version;
-    hash = "sha256-kCCORQKqt9rDydxvddD30RMQ1eS73rgvJzCCx93lRuI=";
+    hash = "sha256-jFBvMRkuAaQAi/28BBf/9cm6FcNMOYS5M69YoSXsX4Q=";
   };
 
   cargoLock = {
diff --git a/pkgs/tools/virtualization/distrobuilder/default.nix b/pkgs/tools/virtualization/distrobuilder/default.nix
index a6ae67b07e7bf..ac65ea3f54b9d 100644
--- a/pkgs/tools/virtualization/distrobuilder/default.nix
+++ b/pkgs/tools/virtualization/distrobuilder/default.nix
@@ -38,7 +38,7 @@ buildGoModule rec {
 
   patches = [
     # go.mod update: needed to to include a newer lxd which contains
-    # https://github.com/lxc/lxd/commit/d83f061a21f509d42b7a334b97403d2a019a7b52
+    # https://github.com/canonical/lxd/commit/d83f061a21f509d42b7a334b97403d2a019a7b52
     # which is needed to fix the build w/glibc-2.36.
     (fetchpatch {
       url = "https://github.com/lxc/distrobuilder/commit/5346bcc77dd7f141a36a8da851f016d0b929835e.patch";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3515a5d73bc60..dce1ef52a2054 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -577,6 +577,8 @@ with pkgs;
 
   dec-decode = callPackage ../development/tools/dec-decode { };
 
+  devour-flake = callPackage ../tools/nix/devour-flake { };
+
   dnf5 = callPackage ../tools/package-management/dnf5 { };
 
   dsq = callPackage ../tools/misc/dsq { };
@@ -33599,6 +33601,7 @@ with pkgs;
   } // (config.mplayer or {}));
 
   mpv-unwrapped = darwin.apple_sdk_11_0.callPackage ../applications/video/mpv {
+    stdenv = if stdenv.isDarwin then swiftPackages.stdenv else stdenv;
     inherit lua;
   };
 
@@ -40316,6 +40319,10 @@ with pkgs;
 
   alejandra = callPackage ../tools/nix/alejandra { };
 
+  nixci = callPackage ../tools/nix/nixci {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   nixfmt = haskellPackages.nixfmt.bin;
 
   nixpkgs-fmt = callPackage ../tools/nix/nixpkgs-fmt { };