Merge master into staging-next

28 files changed, 441 insertions, 94 deletions

diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md
index 0edf0b6f019f..bec72cb3c0d3 100644
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -1229,10 +1229,12 @@ in
   in
 
   {
-    haskell = lib.recursiveUpdate prev.haskell {
-      compiler.${ghcName} = prev.haskell.compiler.${ghcName}.override {
-        # Unfortunately, the GHC setting is named differently for historical reasons
-        enableProfiledLibs = enableProfiling;
+    haskell = prev.haskell // {
+      compiler = prev.haskell.compiler // {
+        ${ghcName} = prev.haskell.compiler.${ghcName}.override {
+          # Unfortunately, the GHC setting is named differently for historical reasons
+          enableProfiledLibs = enableProfiling;
+        };
       };
     };
   })
@@ -1244,31 +1246,33 @@ in
   in
 
   {
-    haskell = lib.recursiveUpdate prev.haskell {
-      packages.${ghcName} = prev.haskell.packages.${ghcName}.override {
-        overrides = hfinal: hprev: {
-          mkDerivation = args: hprev.mkDerivation (args // {
-            # Since we are forcing our ideas upon mkDerivation, this change will
-            # affect every package in the package set.
-            enableLibraryProfiling = enableProfiling;
-
-            # To actually use profiling on an executable, executable profiling
-            # needs to be enabled for the executable you want to profile. You
-            # can either do this globally or…
-            enableExecutableProfiling = enableProfiling;
-          });
-
-          # …only for the package that contains an executable you want to profile.
-          # That saves on unnecessary rebuilds for packages that you only depend
-          # on for their library, but also contain executables (e.g. pandoc).
-          my-executable = haskellLib.enableExecutableProfiling hprev.my-executable;
-
-          # If you are disabling profiling to save on build time, but want to
-          # retain the ability to substitute from the binary cache. Drop the
-          # override for mkDerivation above and instead have an override like
-          # this for the specific packages you are building locally and want
-          # to make cheaper to build.
-          my-library = haskellLib.disableLibraryProfiling hprev.my-library;
+    haskell = prev.haskell // {
+      packages = prev.haskell.packages // {
+        ${ghcName} = prev.haskell.packages.${ghcName}.override {
+          overrides = hfinal: hprev: {
+            mkDerivation = args: hprev.mkDerivation (args // {
+              # Since we are forcing our ideas upon mkDerivation, this change will
+              # affect every package in the package set.
+              enableLibraryProfiling = enableProfiling;
+
+              # To actually use profiling on an executable, executable profiling
+              # needs to be enabled for the executable you want to profile. You
+              # can either do this globally or…
+              enableExecutableProfiling = enableProfiling;
+            });
+
+            # …only for the package that contains an executable you want to profile.
+            # That saves on unnecessary rebuilds for packages that you only depend
+            # on for their library, but also contain executables (e.g. pandoc).
+            my-executable = haskellLib.enableExecutableProfiling hprev.my-executable;
+
+            # If you are disabling profiling to save on build time, but want to
+            # retain the ability to substitute from the binary cache. Drop the
+            # override for mkDerivation above and instead have an override like
+            # this for the specific packages you are building locally and want
+            # to make cheaper to build.
+            my-library = haskellLib.disableLibraryProfiling hprev.my-library;
+          };
         };
       };
     };
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 281dd59e3dd3..21633564e80b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10107,6 +10107,12 @@
     githubId = 264372;
     name = "Jan van den Berg";
   };
+  koppor = {
+    email = "kopp.dev@gmail.com";
+    github = "koppor";
+    githubId = 1366654;
+    name = "Oliver Kopp";
+  };
   koral = {
     email = "koral@mailoo.org";
     github = "k0ral";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 7deca72256b9..768e3c54ae1b 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -50,6 +50,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [GNS3](https://www.gns3.com/), a network software emulator. Available as [services.gns3-server](#opt-services.gns3-server.enable).
 
+- [pretalx](https://github.com/pretalx/pretalx), a conference planning tool. Available as [services.pretalx](#opt-services.pretalx.enable).
+
 - [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.
 
 - [ollama](https://ollama.ai), server for running large language models locally.
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix b/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
index 840ce493ee81..452cb154bcf6 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
@@ -3,6 +3,7 @@
 with lib;
 
 let
+  logPrefix = "services.prometheus.exporters.snmp";
   cfg = config.services.prometheus.exporters.snmp;
 
   # This ensures that we can deal with string paths, path types and
diff --git a/nixos/modules/services/web-apps/photoprism.nix b/nixos/modules/services/web-apps/photoprism.nix
index e25b03484424..1716840e84e5 100644
--- a/nixos/modules/services/web-apps/photoprism.nix
+++ b/nixos/modules/services/web-apps/photoprism.nix
@@ -18,6 +18,9 @@ let
     in
     pkgs.writeShellScript "manage" ''
       ${setupEnv}
+      eval "$(${config.systemd.package}/bin/systemctl show -pUID,MainPID photoprism.service | ${pkgs.gnused}/bin/sed "s/UID/ServiceUID/")"
+      exec ${pkgs.util-linux}/bin/nsenter \
+        -t $MainPID -m -S $ServiceUID -G $ServiceUID --wdns=${cfg.storagePath} \
       exec ${cfg.package}/bin/photoprism "$@"
     '';
 in
diff --git a/pkgs/applications/audio/polyphone/default.nix b/pkgs/applications/audio/polyphone/default.nix
index f7008bf66bba..0e73861aa0f4 100644
--- a/pkgs/applications/audio/polyphone/default.nix
+++ b/pkgs/applications/audio/polyphone/default.nix
@@ -29,8 +29,13 @@ mkDerivation rec {
   '';
 
   installPhase = ''
+    runHook preInstall
     install -d $out/bin
     install -m755 bin/polyphone $out/bin/
+
+    install -Dm444 ./contrib/com.polyphone_soundfonts.polyphone.desktop -t $out/share/applications/
+    install -Dm444 ./contrib/polyphone.svg -t $out/share/icons/hicolor/scalable/apps/
+    runHook postInstall
   '';
 
   qmakeFlags = [
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index ab13a68d60e5..724bfcc4ecce 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -9,6 +9,7 @@
 , cereal
 , cgal
 , curl
+, darwin
 , dbus
 , eigen
 , expat
@@ -111,6 +112,8 @@ stdenv.mkDerivation (finalAttrs: {
     catch2
   ] ++ lib.optionals withSystemd [
     systemd
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk_11_0.frameworks.CoreWLAN
   ];
 
   separateDebugInfo = true;
@@ -190,6 +193,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/prusa3d/PrusaSlicer";
     license = licenses.agpl3;
     maintainers = with maintainers; [ moredread tweber tmarkus ];
+    platforms = platforms.unix;
   } // lib.optionalAttrs (stdenv.isDarwin) {
     mainProgram = "PrusaSlicer";
   };
diff --git a/pkgs/applications/networking/cluster/tilt/assets.nix b/pkgs/applications/networking/cluster/tilt/assets.nix
index 0f98bbdb10db..6bc70de3213f 100644
--- a/pkgs/applications/networking/cluster/tilt/assets.nix
+++ b/pkgs/applications/networking/cluster/tilt/assets.nix
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation rec {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/web/yarn.lock";
-    hash = "sha256-UTxglGn3eIgahZg4kxolg2f2MTReCL4r/GyWNg4105E=";
+    hash = "sha256-0JpoAQKRmU7P1bzYNR/vqtPjOOSw8wSlNjXl2f6uBrw=";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/networking/cluster/tilt/default.nix b/pkgs/applications/networking/cluster/tilt/default.nix
index 646f0c9a0a3d..819d3dbc5095 100644
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@@ -5,13 +5,13 @@ let args = rec {
       /* Do not use "dev" as a version. If you do, Tilt will consider itself
         running in development environment and try to serve assets from the
         source tree, which is not there once build completes.  */
-      version = "0.33.6";
+      version = "0.33.10";
 
       src = fetchFromGitHub {
         owner = "tilt-dev";
         repo = "tilt";
         rev = "v${version}";
-        hash = "sha256-WtE8ExUKFRtdYeg0+My/DB+L/qT+J1EaKHKChNjC5oI=";
+        hash = "sha256-LPb2tC3xIGhjiLYkTU+NBIUoqiicO2ORM6Nt1eTnwQs=";
       };
     };
 
diff --git a/pkgs/applications/office/libreoffice/darwin/default.nix b/pkgs/applications/office/libreoffice/darwin/default.nix
index 3f69a7fd54e9..0cec562106ab 100644
--- a/pkgs/applications/office/libreoffice/darwin/default.nix
+++ b/pkgs/applications/office/libreoffice/darwin/default.nix
@@ -75,6 +75,7 @@ stdenvNoCC.mkDerivation {
     homepage = "https://libreoffice.org/";
     license = licenses.lgpl3;
     maintainers = with maintainers; [ tricktron ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-darwin" "aarch64-darwin" ];
   };
 }
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index ee3610c5f6f6..c5534c18d7bb 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -2,7 +2,6 @@
 , lib
 , callPackage
 , fetchurl
-, fetchpatch
 , makeWrapper
 , cmake
 , coreutils
@@ -58,7 +57,7 @@
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "6.30.02";
+  version = "6.30.04";
 
   passthru = {
     tests = import ./tests { inherit callPackage; };
@@ -66,7 +65,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    hash = "sha256-eWWkVtGtHuDV/kdpv1qP7Cka9oTtk9sPMICpw2JDUYM=";
+    hash = "sha256-K0GAtpjznMZdkQhNgzqIRRWzJbxfZzyOOavoGLAl2Mw=";
   };
 
   nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
@@ -110,13 +109,6 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./sw_vers.patch
-
-    # Fix for builtin_llvm=OFF
-    # https://github.com/root-project/root/pull/14238
-    (fetchpatch {
-      url = "https://github.com/root-project/root/commit/1477d3adebf27a19f3a8b85f21c27a0a5649c7ff.diff";
-      hash = "sha256-g+FqXBTWXA7t7F/rMarnmOK2014oCNnNJbHhjH+Tvjw=";
-    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/build-support/testers/hasPkgConfigModules/tester.nix b/pkgs/build-support/testers/hasPkgConfigModules/tester.nix
index 137739a1b48a..bbcc4f0c0f71 100644
--- a/pkgs/build-support/testers/hasPkgConfigModules/tester.nix
+++ b/pkgs/build-support/testers/hasPkgConfigModules/tester.nix
@@ -34,7 +34,7 @@ runCommand testName {
     for moduleName in $moduleNames; do
       echo "checking pkg-config module $moduleName in $buildInputs"
       set +e
-      version="$(pkg-config --modversion $moduleName)"
+      version="$($PKG_CONFIG --modversion $moduleName)"
       r=$?
       set -e
       if [[ $r = 0 ]]; then
@@ -42,7 +42,7 @@ runCommand testName {
         printf '%s\t%s\n' "$moduleName" "$version" >> "$out"
       else
         echo "These modules were available in the input propagation closure:"
-        pkg-config --list-all
+        $PKG_CONFIG --list-all
         echo "❌ pkg-config module $moduleName was not found"
         false
       fi
diff --git a/pkgs/by-name/au/authentik/ldap.nix b/pkgs/by-name/au/authentik/ldap.nix
new file mode 100644
index 000000000000..1745e5556d3c
--- /dev/null
+++ b/pkgs/by-name/au/authentik/ldap.nix
@@ -0,0 +1,18 @@
+{ lib, buildGoModule, authentik }:
+
+buildGoModule {
+  pname = "authentik-ldap-outpost";
+  inherit (authentik) version src;
+
+  vendorHash = "sha256-74rSuZrO5c7mjhHh0iQlJEkOslsFrcDb1aRXXC4RsUM=";
+
+  CGO_ENABLED = 0;
+
+  subPackages = [ "cmd/ldap" ];
+
+  meta = authentik.meta // {
+    description = "The authentik ldap outpost. Needed for the extendal ldap API.";
+    homepage = "https://goauthentik.io/docs/providers/ldap/";
+    mainProgram = "ldap";
+  };
+}
diff --git a/pkgs/by-name/au/authentik/outposts.nix b/pkgs/by-name/au/authentik/outposts.nix
new file mode 100644
index 000000000000..05649628b3e8
--- /dev/null
+++ b/pkgs/by-name/au/authentik/outposts.nix
@@ -0,0 +1,5 @@
+{ callPackage }:
+
+{
+  ldap = callPackage ./ldap.nix { };
+}
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
new file mode 100644
index 000000000000..a4de19b066d7
--- /dev/null
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -0,0 +1,254 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, buildNpmPackage
+, buildGoModule
+, runCommand
+, openapi-generator-cli
+, nodejs
+, python3
+, codespell
+, makeWrapper }:
+
+let
+  version = "2023.10.7";
+
+  src = fetchFromGitHub {
+    owner = "goauthentik";
+    repo = "authentik";
+    rev = "version/${version}";
+    hash = "sha256-+1IdXRt28UZ2KTa0zsmjneNUOcutP99UUwqcYyVyqTI=";
+  };
+
+  meta = with lib; {
+    description = "The authentication glue you need";
+    changelog = "https://github.com/goauthentik/authentik/releases/tag/version%2F${version}";
+    homepage = "https://goauthentik.io/";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jvanbruegge ];
+  };
+
+  website = buildNpmPackage {
+    pname = "authentik-website";
+    inherit version src meta;
+    npmDepsHash = "sha256-4dgFxEvMnp+35nSQNsEchtN1qoS5X2KzEbLPvMnyR+k=";
+
+    NODE_ENV = "production";
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    postPatch = ''
+      cd website
+    '';
+
+    installPhase = ''
+      cp -r help $out
+    '';
+
+    npmInstallFlags = [ "--include=dev" ];
+    npmBuildScript = "build-docs-only";
+  };
+
+  clientapi = stdenvNoCC.mkDerivation {
+    pname = "authentik-client-api";
+    inherit version src meta;
+
+    postPatch = ''
+      rm Makefile
+
+      substituteInPlace ./scripts/api-ts-config.yaml \
+        --replace-fail '/local' "$(pwd)/"
+    '';
+
+    nativeBuildInputs = [ openapi-generator-cli ];
+    buildPhase = ''
+      runHook preBuild
+      openapi-generator-cli generate -i ./schema.yml \
+      -g typescript-fetch -o $out \
+      -c ./scripts/api-ts-config.yaml \
+        --additional-properties=npmVersion=${nodejs.pkgs.npm.version} \
+        --git-repo-id authentik --git-user-id goauthentik
+      runHook postBuild
+    '';
+  };
+
+  webui = buildNpmPackage {
+    pname = "authentik-webui";
+    inherit version meta;
+
+    src = runCommand "authentik-webui-source" {} ''
+      mkdir -p $out/web/node_modules/@goauthentik/
+      cp -r ${src}/web $out/
+      ln -s ${src}/website $out/
+      ln -s ${clientapi} $out/web/node_modules/@goauthentik/api
+    '';
+    npmDepsHash = "sha256-5aCKlArtoEijGqeYiY3zoV0Qo7/Xt5hSXbmy2uYZpok=";
+
+    postPatch = ''
+      cd web
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir $out
+      cp -r dist $out/dist
+      cp -r authentik $out/authentik
+      runHook postInstall
+    '';
+
+    NODE_ENV = "production";
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    npmInstallFlags = [ "--include=dev" ];
+  };
+
+  python = python3.override {
+    self = python;
+    packageOverrides = final: prev: {
+      authentik-django = prev.buildPythonPackage {
+        pname = "authentik-django";
+        inherit version src meta;
+        pyproject = true;
+
+        postPatch = ''
+          substituteInPlace authentik/root/settings.py \
+            --replace-fail 'Path(__file__).absolute().parent.parent.parent' "\"$out\""
+          substituteInPlace authentik/lib/default.yml \
+            --replace-fail '/blueprints' "$out/blueprints"
+          substituteInPlace pyproject.toml \
+            --replace-fail 'dumb-init = "*"' "" \
+            --replace-fail 'djangorestframework-guardian' 'djangorestframework-guardian2'
+        '';
+
+        nativeBuildInputs = [ prev.poetry-core ];
+
+        propagatedBuildInputs = with prev; [
+          argon2-cffi
+          celery
+          channels
+          channels-redis
+          colorama
+          dacite
+          daphne
+          deepmerge
+          defusedxml
+          django
+          django-filter
+          django-guardian
+          django-model-utils
+          django-prometheus
+          django-redis
+          djangorestframework
+          djangorestframework-guardian2
+          docker
+          drf-spectacular
+          duo-client
+          facebook-sdk
+          flower
+          geoip2
+          gunicorn
+          httptools
+          kubernetes
+          ldap3
+          lxml
+          opencontainers
+          packaging
+          paramiko
+          psycopg
+          pycryptodome
+          pydantic
+          pydantic-scim
+          pyjwt
+          pyyaml
+          requests-oauthlib
+          sentry-sdk
+          structlog
+          swagger-spec-validator
+          twilio
+          twisted
+          ua-parser
+          urllib3
+          uvicorn
+          uvloop
+          watchdog
+          webauthn
+          websockets
+          wsproto
+          xmlsec
+          zxcvbn
+          jsonpatch
+        ] ++ [
+          codespell
+        ];
+
+        postInstall = ''
+          mkdir -p $out/web $out/website
+          cp -r lifecycle manage.py $out/${prev.python.sitePackages}/
+          cp -r blueprints $out/
+          cp -r ${webui}/dist ${webui}/authentik $out/web/
+          cp -r ${website} $out/website/help
+          ln -s $out/${prev.python.sitePackages}/lifecycle $out/lifecycle
+        '';
+      };
+    };
+  };
+
+  inherit (python.pkgs) authentik-django;
+
+  proxy = buildGoModule {
+    pname = "authentik-proxy";
+    inherit version src meta;
+
+    postPatch = ''
+      substituteInPlace internal/gounicorn/gounicorn.go \
+        --replace-fail './lifecycle' "${authentik-django}/lifecycle"
+      substituteInPlace web/static.go \
+        --replace-fail './web' "${authentik-django}/web"
+      substituteInPlace internal/web/static.go \
+        --replace-fail './web' "${authentik-django}/web"
+    '';
+
+    CGO_ENABLED = 0;
+
+    vendorHash = "sha256-74rSuZrO5c7mjhHh0iQlJEkOslsFrcDb1aRXXC4RsUM=";
+
+    postInstall = ''
+      mv $out/bin/server $out/bin/authentik
+    '';
+
+    subPackages = [ "cmd/server" ];
+  };
+
+in stdenvNoCC.mkDerivation {
+  pname = "authentik";
+  inherit src version;
+
+  postPatch = ''
+    rm Makefile
+    patchShebangs lifecycle/ak
+
+    # This causes issues in systemd services
+    substituteInPlace lifecycle/ak \
+      --replace-fail 'printf' '>&2 printf' \
+      --replace-fail '> /dev/stderr' ""
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp -r lifecycle/ak $out/bin/
+
+    wrapProgram $out/bin/ak \
+      --prefix PATH : ${lib.makeBinPath [ (python.withPackages (ps: [ps.authentik-django])) proxy ]} \
+      --set TMPDIR /dev/shm \
+      --set PYTHONDONTWRITEBYTECODE 1 \
+      --set PYTHONUNBUFFERED 1
+    runHook postInstall
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  meta = meta // {
+    mainProgram = "ak";
+  };
+}
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
index c024acd63a04..b3c1f63a9286 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
@@ -1 +1 @@
-2024-01-15
+2024-01-31
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
index 1604555b3b72..ac96818227ce 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
@@ -8,8 +8,8 @@ mkDerivation {
   pname = "nixfmt";
   version = "0.5.0";
   src = fetchzip {
-    url = "https://github.com/piegamesde/nixfmt/archive/1eff7a84ac82fbebb5f586244f1c80e1fcc4f494.tar.gz";
-    sha256 = "1pg876sr58h7v087kbjsnfr4pzvqpwzibl06w2468qs1sywmd283";
+    url = "https://github.com/piegamesde/nixfmt/archive/d6930fd0c62c4d7ec9e4a814adc3d2f590d96271.tar.gz";
+    sha256 = "1ijrdzdwricv4asmy296j7gzvhambv96nlxi3qrxb4lj1by6a34m";
   };
   isLibrary = true;
   isExecutable = true;
diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix
index de0313512fff..471a90c0ab29 100644
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.4.18";
+  version = "0.4.22";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     rev = version;
-    hash = "sha256-LOmGxH/czICSii8AkoXi1cQPL+MErV92iUZtJc2eg64=";
+    hash = "sha256-P93wxAApV2iWXSQGXsCPjmvj2gGMwbKw6+yMgiainb4=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
   nativeCheckInputs = [ git dart-sass ];
 
-  vendorHash = "sha256-KMNPw2B4fLaOdSIFHBIAKXUtnu0sMwksJg3RUZKLDsE=";
+  vendorHash = "sha256-FalN3qhw2o9NvSIfEU4juevPAsxQoksNjL3eATf0umU=";
 
   postInstall = ''
     export HOME="$(mktemp -d)"
diff --git a/pkgs/desktops/gnome/core/nautilus/default.nix b/pkgs/desktops/gnome/core/nautilus/default.nix
index 6c96c54f86b5..7e2d44249376 100644
--- a/pkgs/desktops/gnome/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome/core/nautilus/default.nix
@@ -130,5 +130,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = teams.gnome.members;
+    mainProgram = "nautilus";
   };
 })
diff --git a/pkgs/development/compilers/koka/default.nix b/pkgs/development/compilers/koka/default.nix
index aec856e47d68..e3462c826c76 100644
--- a/pkgs/development/compilers/koka/default.nix
+++ b/pkgs/development/compilers/koka/default.nix
@@ -1,15 +1,42 @@
-{ stdenv, pkgsHostTarget, cmake, makeWrapper, mkDerivation, fetchFromGitHub
-, alex, array, base, bytestring, cond, containers, directory, extra
-, filepath, hpack, hspec, hspec-core, isocline, json, lib, mtl
-, parsec, process, regex-compat, text, time }:
+{ stdenv
+, pkgsHostTarget
+, cmake
+, makeWrapper
+, mkDerivation
+, fetchFromGitHub
+, alex
+, lib
+, hpack
+, aeson
+, array
+, async
+, base
+, bytestring
+, co-log-core
+, cond
+, containers
+, directory
+, FloatingHex
+, isocline
+, lens
+, lsp
+, mtl
+, network
+, network-simple
+, parsec
+, process
+, text
+, text-rope
+, time
+}:
 
 let
-  version = "2.4.2";
+  version = "3.0.4";
   src = fetchFromGitHub {
     owner = "koka-lang";
     repo = "koka";
     rev = "v${version}";
-    sha256 = "sha256-sVjaIzOxNuBtDswpDl5gLB10Sw945TQAf2ywrKumqqk=";
+    sha256 = "sha256-U8BW1Aq9t3je0YDV8NkE0MzdnjwXBJQbmekh5ufOs3k=";
     fetchSubmodules = true;
   };
   kklib = stdenv.mkDerivation {
@@ -38,8 +65,28 @@ mkDerivation rec {
   isExecutable = true;
   libraryToolDepends = [ hpack ];
   executableHaskellDepends = [
-    array base bytestring cond containers directory isocline mtl
-    parsec process text time kklib
+    aeson
+    array
+    async
+    base
+    bytestring
+    co-log-core
+    cond
+    containers
+    directory
+    FloatingHex
+    isocline
+    lens
+    lsp
+    mtl
+    network
+    network-simple
+    parsec
+    process
+    text
+    text-rope
+    time
+    kklib
   ];
   executableToolDepends = [ alex makeWrapper ];
   postInstall = ''
diff --git a/pkgs/development/libraries/openvdb/default.nix b/pkgs/development/libraries/openvdb/default.nix
index 530c57877cf8..c5397b259a30 100644
--- a/pkgs/development/libraries/openvdb/default.nix
+++ b/pkgs/development/libraries/openvdb/default.nix
@@ -20,6 +20,11 @@ stdenv.mkDerivation rec
 
   cmakeFlags = [ "-DOPENVDB_CORE_STATIC=OFF" ];
 
+  # error: aligned deallocation function of type 'void (void *, std::align_val_t) noexcept' is only available on macOS 10.13 or newer
+  env = lib.optionalAttrs (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13" && lib.versionAtLeast tbb.version "2021.8.0") {
+    NIX_CFLAGS_COMPILE = "-faligned-allocation";
+  };
+
   postFixup = ''
     substituteInPlace $dev/lib/cmake/OpenVDB/FindOpenVDB.cmake \
       --replace \''${OPENVDB_LIBRARYDIR} $out/lib \
diff --git a/pkgs/development/tools/zed/default.nix b/pkgs/development/tools/zed/default.nix
index 68a84d53a502..6164b6d4c624 100644
--- a/pkgs/development/tools/zed/default.nix
+++ b/pkgs/development/tools/zed/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "zed";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "brimdata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-mBJmAV7ax4F61gP8yeiJj/EQyJi3zaex6jT/CKzR3LU=";
+    sha256 = "sha256-xyTHCBvklK8x6V7WsWDYytnVEfLcja78crvs62WJJ9o=";
   };
 
-  vendorHash = "sha256-BWvMy1dc3PzAc3kDTXtI6Y8kjRGLWR+aUleItg5EgRU=";
+  vendorHash = "sha256-m8GOKBwXlNhjEIkkbaIOAGslX4WRVPZ0OknGEG29b4E=";
 
   subPackages = [ "cmd/zed" "cmd/zq" ];
 
diff --git a/pkgs/games/vintagestory/default.nix b/pkgs/games/vintagestory/default.nix
index 9b06c2b93314..474b5e2ddbac 100644
--- a/pkgs/games/vintagestory/default.nix
+++ b/pkgs/games/vintagestory/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vintagestory";
-  version = "1.19.1";
+  version = "1.19.3";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${version}.tar.gz";
-    hash = "sha256-PrsClGSXTah5kkhww7slfkwpo0gJryf6pm61LsCYbiE=";
+    hash = "sha256-ULxwNdQLQCWJqCTiGtT1X/Y32f406FT/UPAJNBYrV/s=";
   };
 
 
diff --git a/pkgs/os-specific/darwin/airbuddy/default.nix b/pkgs/os-specific/darwin/airbuddy/default.nix
index 303311ccb105..374089c5aa1f 100644
--- a/pkgs/os-specific/darwin/airbuddy/default.nix
+++ b/pkgs/os-specific/darwin/airbuddy/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenvNoCC
 , fetchurl
-, undmg
+, _7zz
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -19,18 +19,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   dontBuild = true;
   dontFixup = true;
 
-  nativeBuildInputs = [ undmg ];
+  nativeBuildInputs = [ _7zz ];
 
-  # AirBuddy.dmg is not HFS formatted, default unpackPhase fails
-  # https://discourse.nixos.org/t/help-with-error-only-hfs-file-systems-are-supported-on-ventura
+  # AirBuddy.dmg is APFS formatted, unpack with 7zz
   unpackCmd = ''
-    mnt=$(mktemp -d)
+    runHook preUnpack
 
-    /usr/bin/hdiutil attach -nobrowse -readonly $src -mountpoint $mnt
+    7zz x $src
 
-    shopt -s extglob
-    DEST="$PWD"
-    (cd "$mnt"; cp -a !(Applications) "$DEST/")
+    runHook postUnpack
   '';
 
   sourceRoot = "AirBuddy.app";
diff --git a/pkgs/os-specific/darwin/aldente/default.nix b/pkgs/os-specific/darwin/aldente/default.nix
index a67efd3367d4..e585d8877803 100644
--- a/pkgs/os-specific/darwin/aldente/default.nix
+++ b/pkgs/os-specific/darwin/aldente/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenvNoCC
 , fetchurl
-, undmg
+, _7zz
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -16,24 +16,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   dontBuild = true;
   dontFixup = true;
 
-  nativeBuildInputs = [ undmg ];
+  nativeBuildInputs = [ _7zz ];
 
-  # AlDente.dmg is not HFS formatted, default unpackPhase fails
-  # https://discourse.nixos.org/t/help-with-error-only-hfs-file-systems-are-supported-on-ventura
+  # AlDente.dmg is APFS formatted, unpack with 7zz
   unpackCmd = ''
-    if ! [[ "$curSrc" =~ \.dmg$ ]]; then return 1; fi
-    mnt=$(mktemp -d -t ci-XXXXXXXXXX)
+    runHook preUnpack
 
-    function finish {
-      /usr/bin/hdiutil detach $mnt -force
-    }
-    trap finish EXIT
+    7zz x $src
 
-    /usr/bin/hdiutil attach -nobrowse -readonly $src -mountpoint $mnt
-
-    shopt -s extglob
-    DEST="$PWD"
-    (cd "$mnt"; cp -a !(Applications) "$DEST/")
+    runHook postUnpack
   '';
 
   sourceRoot = "AlDente.app";
diff --git a/pkgs/servers/dex/default.nix b/pkgs/servers/dex/default.nix
index 7db4d836ee1b..16a792f111f0 100644
--- a/pkgs/servers/dex/default.nix
+++ b/pkgs/servers/dex/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests, testers, dex-oidc }:
 
 buildGoModule rec {
   pname = "dex";
@@ -18,7 +18,7 @@ buildGoModule rec {
   ];
 
   ldflags = [
-    "-w" "-s" "-X github.com/dexidp/dex/version.Version=${src.rev}"
+    "-w" "-s" "-X main.version=${src.rev}"
   ];
 
   postInstall = ''
@@ -26,7 +26,14 @@ buildGoModule rec {
     cp -r $src/web $out/share/web
   '';
 
-  passthru.tests = { inherit (nixosTests) dex-oidc; };
+  passthru.tests = {
+    inherit (nixosTests) dex-oidc;
+    version = testers.testVersion {
+      package = dex-oidc;
+      command = "dex version";
+      version = "v${version}";
+    };
+  };
 
   meta = with lib; {
     description = "OpenID Connect and OAuth2 identity provider with pluggable connectors";
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 9f542ac98e76..b1ad448f0971 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -17,20 +17,20 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.99.0";
+  version = "1.100.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-NS0in7zUkIS+fI5gQEua9y1UXspEHWNCntyZHZCtfPg=";
+    hash = "sha256-6YK/VV0ELvMJoA5ipmoB4S13HqA0UEOnQ6JbQdlkYWU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-FQhHpbp8Rkkqp6Ngly/HP8iWGlWh5CDaztgAwKB/afI=";
+    hash = "sha256-oXIraayA6Dd8aYirRhM9Av8x7bj+WZI6o7dEr9OCtdk=";
   };
 
   postPatch = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f82a065de04a..2de3b5d49b3e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3363,6 +3363,8 @@ with pkgs;
 
   authelia = callPackage ../servers/authelia { };
 
+  authentik-outposts = recurseIntoAttrs (callPackages ../by-name/au/authentik/outposts.nix { });
+
   autoflake = with python3.pkgs; toPythonApplication autoflake;
 
   autospotting = callPackage ../applications/misc/autospotting { };
@@ -35318,7 +35320,9 @@ with pkgs;
 
   printrun = callPackage ../applications/misc/printrun { };
 
-  prusa-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer { };
+  prusa-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer {
+    stdenv = if stdenv.isDarwin then overrideLibcxx darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv;
+  };
 
   super-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer/super-slicer.nix { };