Merge master into haskell-updates

45 files changed, 451 insertions, 218 deletions

diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index b7804f708228..6fb609699bad 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -17,12 +17,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.59.0";
+  version = "1.61.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    sha256 = "sha256-HsfvLxXyYvzUL+FO/i8iRbyQV8OFF3Cx8/g8/9aJE2M=";
+    sha256 = "sha256-3zuaruaveUeJ7uKP5fMiDFPOGKcs6aTNuGOuhxV6nss=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/compilers/fasm/bin.nix b/pkgs/development/compilers/fasm/bin.nix
index e894d2607bc0..f23e9540928a 100644
--- a/pkgs/development/compilers/fasm/bin.nix
+++ b/pkgs/development/compilers/fasm/bin.nix
@@ -1,24 +1,28 @@
 { stdenvNoCC, lib, fetchurl }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "fasm-bin";
-
-  version = "1.73.31";
+  version = "1.73.32";
 
   src = fetchurl {
-    url = "https://flatassembler.net/fasm-${version}.tgz";
-    sha256 = "sha256-jzjLIayR+xulSGKhvQ9VxWhZC6qRZ/4IHSe3lD8LD+M=";
+    url = "https://flatassembler.net/fasm-${finalAttrs.version}.tgz";
+    hash = "sha256-WVXL4UNWXa9e7K3MSS0CXK3lczgog9V4XUoYChvvym8=";
   };
 
   installPhase = ''
+    runHook preInstall
+
     install -D fasm${lib.optionalString stdenvNoCC.isx86_64 ".x64"} $out/bin/fasm
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "x86(-64) macro assembler to binary, MZ, PE, COFF, and ELF";
     homepage = "https://flatassembler.net/download.php";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ orivej ];
+    license = lib.licenses.bsd2;
+    mainProgram = "fasm";
+    maintainers = with lib.maintainers; [ orivej ];
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
-}
+})
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 5ecb89a3a264..580821cc0d2c 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -281,7 +281,7 @@ in let
     # Has to be in tools despite mostly being a library,
     # because we use a native helper executable from a
     # non-cross build in cross builds.
-    libclc = callPackage ./libclc {
+    libclc = callPackage ../common/libclc.nix {
       inherit buildLlvmTools;
     };
   });
diff --git a/pkgs/development/compilers/llvm/17/default.nix b/pkgs/development/compilers/llvm/17/default.nix
index 8109f27586cb..2c422da8f9f8 100644
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ b/pkgs/development/compilers/llvm/17/default.nix
@@ -269,6 +269,12 @@ in let
       nixSupport.cc-cflags = [ "-fno-exceptions" ];
     });
 
+    # Has to be in tools despite mostly being a library,
+    # because we use a native helper executable from a
+    # non-cross build in cross builds.
+    libclc = callPackage ../common/libclc.nix {
+      inherit buildLlvmTools;
+    };
   });
 
   libraries = lib.makeExtensible (libraries: let
diff --git a/pkgs/development/compilers/llvm/16/libclc/default.nix b/pkgs/development/compilers/llvm/common/libclc.nix
index 2ceca9aaf7fd..c91930963b20 100644
--- a/pkgs/development/compilers/llvm/16/libclc/default.nix
+++ b/pkgs/development/compilers/llvm/common/libclc.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./libclc-gnu-install-dirs.patch
+    ./libclc/libclc-gnu-install-dirs.patch
   ];
 
   # cmake expects all required binaries to be in the same place, so it will not be able to find clang without the patch
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
       --replace 'find_program( LLVM_OPT opt PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
                 'find_program( LLVM_OPT opt PATHS "${buildLlvmTools.llvm}/bin" NO_DEFAULT_PATH )' \
       --replace 'find_program( LLVM_SPIRV llvm-spirv PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                'find_program( LLVM_SPIRV llvm-spirv PATHS "${buildPackages.spirv-llvm-translator}/bin" NO_DEFAULT_PATH )'
+                'find_program( LLVM_SPIRV llvm-spirv PATHS "${buildPackages.spirv-llvm-translator.override { inherit (buildLlvmTools) llvm; }}/bin" NO_DEFAULT_PATH )'
   '' + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     substituteInPlace CMakeLists.txt \
       --replace 'COMMAND prepare_builtins' 'COMMAND ${buildLlvmTools.libclc.dev}/bin/prepare_builtins'
@@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     homepage = "http://libclc.llvm.org/";
     description = "Implementation of the library requirements of the OpenCL C programming language";
     license = licenses.mit;
diff --git a/pkgs/development/compilers/llvm/16/libclc/libclc-gnu-install-dirs.patch b/pkgs/development/compilers/llvm/common/libclc/libclc-gnu-install-dirs.patch
index 1e5108a27c38..1e5108a27c38 100644
--- a/pkgs/development/compilers/llvm/16/libclc/libclc-gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/common/libclc/libclc-gnu-install-dirs.patch
diff --git a/pkgs/development/compilers/vlang/default.nix b/pkgs/development/compilers/vlang/default.nix
index 2a8ea72b9f5b..66b871559057 100644
--- a/pkgs/development/compilers/vlang/default.nix
+++ b/pkgs/development/compilers/vlang/default.nix
@@ -1,20 +1,21 @@
 { lib, stdenv, fetchFromGitHub, glfw, freetype, openssl, makeWrapper, upx, boehmgc, xorg, binaryen, darwin }:
 
 let
-  version = "weekly.2023.44";
+  version = "0.4.3";
   ptraceSubstitution = ''
     #include <sys/types.h>
     #include <sys/ptrace.h>
   '';
-  # Required for bootstrap.
+  # vc is the V compiler's source translated to C (needed for boostrap).
+  # So we fix its rev to correspond to the V version.
   vc = stdenv.mkDerivation {
     pname = "v.c";
-    version = "unstable-2023-10-30";
+    version = "0.4.3";
     src = fetchFromGitHub {
       owner = "vlang";
       repo = "vc";
-      rev = "66b89ab916c13c5781753797d1f4ff08e427bb6b";
-      hash = "sha256-5Y7/rlcoIHjbf79A1rqFysNFc5+p6CY09MRPQalo7Ak=";
+      rev = "5e691a82c01957870b451e06216a9fb3a4e83a18";
+      hash = "sha256-Ti2b88NDG1pppj34BeK8+UsT2HiG/jcAF2mHgiBBRaI=";
     };
 
     # patch the ptrace reference for darwin
@@ -30,8 +31,8 @@ let
   markdown = fetchFromGitHub {
     owner = "vlang";
     repo = "markdown";
-    rev = "61c47ea0a6c0c79e973a119dcbab3b8fdd0973ca";
-    hash = "sha256-XBD30Pc9CGXzU1Gy6U0pDpTozYVwfgAvZRjIsnXp8ZM=";
+    rev = "0c280130cb7ec410b7d21810d1247956c15b72fc";
+    hash = "sha256-Fmhkrg9DBiWxInostNp+WfA3V5GgEIs5+KIYrqZosqY=";
   };
   boehmgcStatic = boehmgc.override {
     enableStatic = true;
@@ -45,7 +46,7 @@ stdenv.mkDerivation {
     owner = "vlang";
     repo = "v";
     rev = version;
-    hash = "sha256-1yFuheSyKfvm4GqKIbXycdzKx3XcD9LSmmuKlcJmteg=";
+    hash = "sha256-ZFBQD7SP38VnEMoOnwr/n8zZuLtR7GR3OCYhvfz3apI=";
   };
 
   propagatedBuildInputs = [ glfw freetype openssl ]
@@ -76,11 +77,6 @@ stdenv.mkDerivation {
     cp -r ${boehmgcStatic}/lib/* ./thirdparty/tcc/lib
   '';
 
-  # vcreate_test.v requires git, so we must remove it when building the tools.
-  preInstall = ''
-    mv cmd/tools/vcreate/vcreate_test.v $HOME/vcreate_test.v
-  '';
-
   installPhase = ''
     runHook preInstall
 
@@ -102,11 +98,6 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  # Return vcreate_test.v and vtest.v, so the user can use it.
-  postInstall = ''
-    cp $HOME/vcreate_test.v $out/lib/cmd/tools/vcreate_test.v
-  '';
-
   meta = with lib; {
     homepage = "https://vlang.io/";
     description = "Simple, fast, safe, compiled language for developing maintainable software";
diff --git a/pkgs/development/coq-modules/metacoq/default.nix b/pkgs/development/coq-modules/metacoq/default.nix
index 9ab49f8e0861..5695bcf2ee99 100644
--- a/pkgs/development/coq-modules/metacoq/default.nix
+++ b/pkgs/development/coq-modules/metacoq/default.nix
@@ -5,7 +5,7 @@ with builtins // lib;
 let
   repo  = "metacoq";
   owner = "MetaCoq";
-  defaultVersion = with versions; lib.switch coq.coq-version [
+  defaultVersion = with versions; switch coq.coq-version [
       { case = "8.11"; out = "1.0-beta2-8.11"; }
       { case = "8.12"; out = "1.0-beta2-8.12"; }
       # Do not provide 8.13 because it does not compile with equations 1.3 provided by default (only 1.2.3)
@@ -13,6 +13,8 @@ let
       { case = "8.14"; out = "1.1-8.14"; }
       { case = "8.15"; out = "1.1-8.15"; }
       { case = "8.16"; out = "1.1-8.16"; }
+      { case = "8.17"; out = "1.2.1-8.17"; }
+      { case = "8.18"; out = "1.2.1-8.18"; }
     ] null;
   release = {
     "1.0-beta2-8.11".sha256 = "sha256-I9YNk5Di6Udvq5/xpLSNflfjRyRH8fMnRzbo3uhpXNs=";
@@ -24,11 +26,15 @@ let
     "1.1-8.14".sha256 = "sha256-6vViCNQl6BnGgOHX3P/OLfFXN4aUfv4RbDokfz2BgQI=";
     "1.1-8.15".sha256 = "sha256-qCD3wFW4E+8vSVk4XoZ0EU4PVya0al+JorzS9nzmR/0=";
     "1.1-8.16".sha256 = "sha256-cTK4ptxpPPlqxAhasZFX3RpSlsoTZwhTqs2A3BZy9sA=";
+    "1.2.1-8.17".sha256 = "sha256-FP4upuRsG8B5Q5FIr76t+ecRirrOUX0D1QiLq0/zMyE=";
+    "1.2.1-8.18".sha256 = "sha256-49g5db2Bv8HpltptJdxA7zrmgNFGC6arx5h2mKHhrko=";
   };
   releaseRev = v: "v${v}";
 
   # list of core metacoq packages sorted by dependency order
-  packages = [ "template-coq" "pcuic" "safechecker" "erasure" "all" ];
+  packages = if versionAtLeast coq.coq-version "8.17"
+     then [ "utils" "common" "template-coq" "pcuic" "safechecker" "template-pcuic" "erasure" "quotation" "safechecker-plugin" "erasure-plugin" "all" ]
+     else [ "template-coq" "pcuic" "safechecker" "erasure" "all" ];
 
   template-coq = metacoq_ "template-coq";
 
@@ -47,7 +53,16 @@ let
         mlPlugin = true;
         propagatedBuildInputs = [ equations coq.ocamlPackages.zarith ] ++ metacoq-deps;
 
-        patchPhase =  ''
+        patchPhase =  if versionAtLeast coq.coq-version "8.17" then ''
+          patchShebangs ./configure.sh
+          patchShebangs ./template-coq/update_plugin.sh
+          patchShebangs ./template-coq/gen-src/to-lower.sh
+          patchShebangs ./safechecker-plugin/clean_extraction.sh
+          patchShebangs ./erasure-plugin/clean_extraction.sh
+          echo "CAMLFLAGS+=-w -60 # Unused module" >> ./safechecker/Makefile.plugin.local
+          sed -i -e 's/mv $i $newi;/mv $i tmp; mv tmp $newi;/' ./template-coq/gen-src/to-lower.sh ./safechecker-plugin/clean_extraction.sh ./erasure-plugin/clean_extraction.sh
+        '' else ''
+          patchShebangs ./configure.sh
           patchShebangs ./template-coq/update_plugin.sh
           patchShebangs ./template-coq/gen-src/to-lower.sh
           patchShebangs ./pcuic/clean_extraction.sh
@@ -59,7 +74,7 @@ let
 
         configurePhase = optionalString (package == "all") pkgallMake + ''
           touch ${pkgpath}/metacoq-config
-        '' + optionalString (elem package ["safechecker" "erasure"]) ''
+        '' + optionalString (elem package ["safechecker" "erasure" "template-pcuic" "quotation" "safechecker-plugin" "erasure-plugin"]) ''
           echo  "-I ${template-coq}/lib/coq/${coq.coq-version}/user-contrib/MetaCoq/Template/" > ${pkgpath}/metacoq-config
         '' + optionalString (package == "single") ''
           ./configure.sh local
diff --git a/pkgs/development/cuda-modules/README.md b/pkgs/development/cuda-modules/README.md
index f4844c46a2c2..76732c5ddfb3 100644
--- a/pkgs/development/cuda-modules/README.md
+++ b/pkgs/development/cuda-modules/README.md
@@ -1,32 +1,97 @@
-# cuda-modules
+# Cuda modules
 
 > [!NOTE]
-> This document is meant to help CUDA maintainers understand the structure of the CUDA packages in Nixpkgs. It is not meant to be a user-facing document.
+> This document is meant to help CUDA maintainers understand the structure of
+> the CUDA packages in Nixpkgs. It is not meant to be a user-facing document.
 > For a user-facing document, see [the CUDA section of the manual](../../../doc/languages-frameworks/cuda.section.md).
 
-The files in this directory are added (in some way) to the `cudaPackages` package set by [cuda-packages.nix](../../top-level/cuda-packages.nix).
+The files in this directory are added (in some way) to the `cudaPackages`
+package set by [cuda-packages.nix](../../top-level/cuda-packages.nix).
 
 ## Top-level files
 
-Top-level nix files are included in the initial creation of the `cudaPackages` scope. These are typically required for the creation of the finalized `cudaPackages` scope:
+Top-level nix files are included in the initial creation of the `cudaPackages`
+scope. These are typically required for the creation of the finalized
+`cudaPackages` scope:
 
 - `backend-stdenv.nix`: Standard environment for CUDA packages.
 - `flags.nix`: Flags set, or consumed by, NVCC in order to build packages.
 - `gpus.nix`: A list of supported NVIDIA GPUs.
-- `nvcc-compatibilities.nix`: NVCC releases and the version range of GCC/Clang they support.
+- `nvcc-compatibilities.nix`: NVCC releases and the version range of GCC/Clang
+    they support.
 
 ## Top-level directories
 
 - `cuda`: CUDA redistributables! Provides extension to `cudaPackages` scope.
-- `cudatoolkit`: monolothic CUDA Toolkit run-file installer. Provides extension to `cudaPackages` scope.
+- `cudatoolkit`: monolothic CUDA Toolkit run-file installer. Provides extension
+    to `cudaPackages` scope.
 - `cudnn`: NVIDIA cuDNN library.
 - `cutensor`: NVIDIA cuTENSOR library.
 - `generic-builders`:
-  - Contains a builder `manifest.nix` which operates on the `Manifest` type defined in `modules/generic/manifests`. Most packages are built using this builder.
-  - Contains a builder `multiplex.nix` which leverages the Manifest builder. In short, the Multiplex builder adds multiple versions of a single package to single instance of the CUDA Packages package set. It is used primarily for packages like `cudnn` and `cutensor`.
-- `modules`: Nixpkgs modules to check the shape and content of CUDA redistributable and feature manifests. These modules additionally use shims provided by some CUDA packages to allow them to re-use the `genericManifestBuilder`, even if they don't have manifest files of their own. `cudnn` and `tensorrt` are examples of packages which provide such shims. These modules are further described in the [Modules](./modules/README.md) documentation.
+  - Contains a builder `manifest.nix` which operates on the `Manifest` type
+      defined in `modules/generic/manifests`. Most packages are built using this
+      builder.
+  - Contains a builder `multiplex.nix` which leverages the Manifest builder. In
+      short, the Multiplex builder adds multiple versions of a single package to
+      single instance of the CUDA Packages package set. It is used primarily for
+      packages like `cudnn` and `cutensor`.
+- `modules`: Nixpkgs modules to check the shape and content of CUDA
+    redistributable and feature manifests. These modules additionally use shims
+    provided by some CUDA packages to allow them to re-use the
+    `genericManifestBuilder`, even if they don't have manifest files of their
+    own. `cudnn` and `tensorrt` are examples of packages which provide such
+    shims. These modules are further described in the
+    [Modules](./modules/README.md) documentation.
 - `nccl`: NVIDIA NCCL library.
 - `nccl-tests`: NVIDIA NCCL tests.
 - `saxpy`: Example CMake project that uses CUDA.
 - `setup-hooks`: Nixpkgs setup hooks for CUDA.
 - `tensorrt`: NVIDIA TensorRT library.
+
+## Distinguished packages
+
+### Cuda compatibility
+
+[Cuda Compatibility](https://docs.nvidia.com/deploy/cuda-compatibility/),
+available as `cudaPackages.cuda_compat`, is a component which makes it possible
+to run applications built against a newer CUDA toolkit (for example CUDA 12) on
+a machine with an older CUDA driver (for example CUDA 11), which isn't possible
+out of the box. At the time of writing, Cuda Compatibility is only available on
+the Nvidia Jetson architecture, but Nvidia might release support for more
+architectures in the future.
+
+As Cuda Compatibility strictly increases the range of supported applications, we
+try our best to enable it by default on supported platforms.
+
+#### Functioning
+
+`cuda_compat` simply provides a new `libcuda.so` (and associated variants) that
+needs to be used in place of the default CUDA driver's `libcuda.so`. However,
+the other shared libraries of the default driver must still be accessible:
+`cuda_compat` isn't a complete drop-in replacement for the driver (and that's
+the point, otherwise, it would just be a newer driver).
+
+Nvidia's recommendation is to set `LD_LIBRARY_PATH` to points to `cuda_compat`'s
+driver. This is fine for a manual, one-shot usage, but in general setting
+`LD_LIBRARY_PATH` is a red flag. This is global state which short-circuits most
+of other dynamic libraries resolution mechanisms and can break things in
+non-obvious ways, especially with other Nix-built software.
+
+#### Cuda compat with Nix
+
+Since `cuda_compat` is a known derivation, the easy way to do this in Nix would
+be to add `cuda_compat` as a dependency of CUDA libraries and applications and
+let Nix does its magic by filling the `DT_RUNPATH` fields. However,
+`cuda_compat` itself depends on `libnvrm_mem` and `libnvrm_gpu` which are loaded
+dynamically at runtime from `/run/opengl-driver`. This doesn't please the Nix
+sandbox when building, which can't find those (a second minor issue is that
+`addOpenGLRunpathHook` prepends the `/run/opengl-driver` path, so that would
+still take precedence).
+
+The current solution is to do something similar to `addOpenGLRunpathHook`: the
+`addCudaCompatRunpathHook` prepends to the path to `cuda_compat`'s `libcuda.so`
+to the `DT_RUNPATH` of whichever package includes the hook as a dependency, and
+we include the hook by default for packages in `cudaPackages` (by adding it as a
+inputs in `genericManifestBuilder`). We also make sure it's included after
+`addOpenGLRunpathHook`, so that it appears _before_ in the `DT_RUNPATH` and
+takes precedence.
diff --git a/pkgs/development/cuda-modules/cuda/overrides.nix b/pkgs/development/cuda-modules/cuda/overrides.nix
index 061d5da16bb5..fd32978bfb59 100644
--- a/pkgs/development/cuda-modules/cuda/overrides.nix
+++ b/pkgs/development/cuda-modules/cuda/overrides.nix
@@ -45,7 +45,7 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
   cuda_compat = prev.cuda_compat.overrideAttrs (
     prevAttrs: {
       env.autoPatchelfIgnoreMissingDeps =
-        prevAttrs.env.autoPatchelfIgnoreMissingDeps + " libnvrm_gpu.so libnvrm_mem.so";
+        prevAttrs.env.autoPatchelfIgnoreMissingDeps + " libnvrm_gpu.so libnvrm_mem.so libnvdla_runtime.so";
       # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
       brokenConditions = prevAttrs.brokenConditions // {
         "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" =
diff --git a/pkgs/development/cuda-modules/generic-builders/manifest.nix b/pkgs/development/cuda-modules/generic-builders/manifest.nix
index 7ddecb7ed723..c7ff0f53bb74 100644
--- a/pkgs/development/cuda-modules/generic-builders/manifest.nix
+++ b/pkgs/development/cuda-modules/generic-builders/manifest.nix
@@ -1,6 +1,7 @@
 {
   # General callPackage-supplied arguments
   autoAddOpenGLRunpathHook,
+  autoAddCudaCompatRunpathHook,
   autoPatchelfHook,
   backendStdenv,
   fetchurl,
@@ -126,6 +127,14 @@ backendStdenv.mkDerivation (
       # Check e.g. with `patchelf --print-rpath path/to/my/binary
       autoAddOpenGLRunpathHook
       markForCudatoolkitRootHook
+    ]
+    # autoAddCudaCompatRunpathHook depends on cuda_compat and would cause
+    # infinite recursion if applied to `cuda_compat` itself (beside the fact
+    # that it doesn't make sense in the first place)
+    ++ lib.optionals (pname != "cuda_compat" && flags.isJetsonBuild) [
+      # autoAddCudaCompatRunpathHook must appear AFTER autoAddOpenGLRunpathHook.
+      # See its documentation in ./setup-hooks/extension.nix.
+      autoAddCudaCompatRunpathHook
     ];
 
     buildInputs =
diff --git a/pkgs/development/cuda-modules/modules/README.md b/pkgs/development/cuda-modules/modules/README.md
index 31aa343bd9d5..7db8435c9dc8 100644
--- a/pkgs/development/cuda-modules/modules/README.md
+++ b/pkgs/development/cuda-modules/modules/README.md
@@ -1,27 +1,56 @@
 # Modules
 
-Modules as they are used in `modules` exist primarily to check the shape and content of CUDA redistributable and feature manifests. They are ultimately meant to reduce the repetitive nature of repackaging CUDA redistributables.
+Modules as they are used in `modules` exist primarily to check the shape and
+content of CUDA redistributable and feature manifests. They are ultimately meant
+to reduce the repetitive nature of repackaging CUDA redistributables.
 
-Building most redistributables follows a pattern of a manifest indicating which packages are available at a location, their versions, and their hashes. To avoid creating builders for each and every derivation, modules serve as a way for us to use a single `genericManifestBuilder` to build all redistributables.
+Building most redistributables follows a pattern of a manifest indicating which
+packages are available at a location, their versions, and their hashes. To avoid
+creating builders for each and every derivation, modules serve as a way for us
+to use a single `genericManifestBuilder` to build all redistributables.
 
 ## `generic`
 
-The modules in `generic` are reusable components meant to check the shape and content of NVIDIA's CUDA redistributable manifests, our feature manifests (which are derived from NVIDIA's manifests), or hand-crafted Nix expressions describing available packages. They are used by the `genericManifestBuilder` to build CUDA redistributables.
-
-Generally, each package which relies on manifests or Nix release expressions will create an alias to the relevant generic module. For example, the [module for CUDNN](./cudnn/default.nix) aliases the generic module for release expressions, while the [module for CUDA redistributables](./cuda/default.nix) aliases the generic module for manifests.
-
-Alternatively, additional fields or values may need to be configured to account for the particulars of a package. For example, while the release expressions for [CUDNN](./cudnn/releases.nix) and [TensorRT](./tensorrt/releases.nix) are very close, they differ slightly in the fields they have. The [module for CUDNN](./modules/cudnn/default.nix) is able to use the generic module for release expressions, while the [module for TensorRT](./modules/tensorrt/default.nix) must add additional fields to the generic module.
+The modules in `generic` are reusable components meant to check the shape and
+content of NVIDIA's CUDA redistributable manifests, our feature manifests (which
+are derived from NVIDIA's manifests), or hand-crafted Nix expressions describing
+available packages. They are used by the `genericManifestBuilder` to build CUDA
+redistributables.
+
+Generally, each package which relies on manifests or Nix release expressions
+will create an alias to the relevant generic module. For example, the [module
+for CUDNN](./cudnn/default.nix) aliases the generic module for release
+expressions, while the [module for CUDA redistributables](./cuda/default.nix)
+aliases the generic module for manifests.
+
+Alternatively, additional fields or values may need to be configured to account
+for the particulars of a package. For example, while the release expressions for
+[CUDNN](./cudnn/releases.nix) and [TensorRT](./tensorrt/releases.nix) are very
+close, they differ slightly in the fields they have. The [module for
+CUDNN](./modules/cudnn/default.nix) is able to use the generic module for
+release expressions, while the [module for
+TensorRT](./modules/tensorrt/default.nix) must add additional fields to the
+generic module.
 
 ### `manifests`
 
-The modules in `generic/manifests` define the structure of NVIDIA's CUDA redistributable manifests and our feature manifests.
+The modules in `generic/manifests` define the structure of NVIDIA's CUDA
+redistributable manifests and our feature manifests.
 
-NVIDIA's redistributable manifests are retrieved from their web server, while the feature manifests are produced by [`cuda-redist-find-features`](https://github.com/connorbaker/cuda-redist-find-features).
+NVIDIA's redistributable manifests are retrieved from their web server, while
+the feature manifests are produced by
+[`cuda-redist-find-features`](https://github.com/connorbaker/cuda-redist-find-features).
 
 ### `releases`
 
-The modules in `generic/releases` define the structure of our hand-crafted Nix expressions containing information necessary to download and repackage CUDA redistributables. These expressions are created when NVIDIA-provided manifests are unavailable or otherwise unusable. For example, though CUDNN has manifests, a bug in NVIDIA's CI/CD causes manifests for different versions of CUDA to use the same name, which leads to the manifests overwriting each other.
+The modules in `generic/releases` define the structure of our hand-crafted Nix
+expressions containing information necessary to download and repackage CUDA
+redistributables. These expressions are created when NVIDIA-provided manifests
+are unavailable or otherwise unusable. For example, though CUDNN has manifests,
+a bug in NVIDIA's CI/CD causes manifests for different versions of CUDA to use
+the same name, which leads to the manifests overwriting each other.
 
 ### `types`
 
-The modules in `generic/types` define reusable types used in both `generic/manifests` and `generic/releases`.
+The modules in `generic/types` define reusable types used in both
+`generic/manifests` and `generic/releases`.
diff --git a/pkgs/development/cuda-modules/setup-hooks/auto-add-cuda-compat-runpath.sh b/pkgs/development/cuda-modules/setup-hooks/auto-add-cuda-compat-runpath.sh
new file mode 100644
index 000000000000..537daad2f00e
--- /dev/null
+++ b/pkgs/development/cuda-modules/setup-hooks/auto-add-cuda-compat-runpath.sh
@@ -0,0 +1,27 @@
+# shellcheck shell=bash
+# Patch all dynamically linked, ELF files with the CUDA driver (libcuda.so)
+# coming from the cuda_compat package by adding it to the RUNPATH.
+echo "Sourcing auto-add-cuda-compat-runpath-hook"
+
+elfHasDynamicSection() {
+    patchelf --print-rpath "$1" >& /dev/null
+}
+
+autoAddCudaCompatRunpathPhase() (
+  local outputPaths
+  mapfile -t outputPaths < <(for o in $(getAllOutputNames); do echo "${!o}"; done)
+  find "${outputPaths[@]}" -type f -executable -print0  | while IFS= read -rd "" f; do
+    if isELF "$f"; then
+      # patchelf returns an error on statically linked ELF files
+      if elfHasDynamicSection "$f" ; then
+        echo "autoAddCudaCompatRunpathHook: patching $f"
+        local origRpath="$(patchelf --print-rpath "$f")"
+        patchelf --set-rpath "@libcudaPath@:$origRpath" "$f"
+      elif (( "${NIX_DEBUG:-0}" >= 1 )) ; then
+        echo "autoAddCudaCompatRunpathHook: skipping a statically-linked ELF file $f"
+      fi
+    fi
+  done
+)
+
+postFixupHooks+=(autoAddCudaCompatRunpathPhase)
diff --git a/pkgs/development/cuda-modules/setup-hooks/extension.nix b/pkgs/development/cuda-modules/setup-hooks/extension.nix
index 762dad9ea876..930730ce6c06 100644
--- a/pkgs/development/cuda-modules/setup-hooks/extension.nix
+++ b/pkgs/development/cuda-modules/setup-hooks/extension.nix
@@ -44,4 +44,26 @@ final: _: {
           ./auto-add-opengl-runpath-hook.sh
       )
       {};
+
+  # autoAddCudaCompatRunpathHook hook must be added AFTER `setupCudaHook`. Both
+  # hooks prepend a path with `libcuda.so` to the `DT_RUNPATH` section of
+  # patched elf files, but `cuda_compat` path must take precedence (otherwise,
+  # it doesn't have any effect) and thus appear first. Meaning this hook must be
+  # executed last.
+  autoAddCudaCompatRunpathHook =
+    final.callPackage
+      (
+        {makeSetupHook, cuda_compat}:
+        makeSetupHook
+          {
+            name = "auto-add-cuda-compat-runpath-hook";
+            substitutions = {
+              # Hotfix Ofborg evaluation
+              libcudaPath = if final.flags.isJetsonBuild then "${cuda_compat}/compat" else null;
+            };
+            meta.broken = !final.flags.isJetsonBuild;
+          }
+          ./auto-add-cuda-compat-runpath.sh
+      )
+      {};
 }
diff --git a/pkgs/development/embedded/xc3sprog/default.nix b/pkgs/development/embedded/xc3sprog/default.nix
index 393a11f8a448..fa9ceffafbbb 100644
--- a/pkgs/development/embedded/xc3sprog/default.nix
+++ b/pkgs/development/embedded/xc3sprog/default.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     # file RPATH_CHANGE could not write new RPATH
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    # fix build with gcc 11+
+    "-DCMAKE_CXX_STANDARD=14"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/interpreters/clisp/default.nix b/pkgs/development/interpreters/clisp/default.nix
index 127541c727ec..0ff0f6a49816 100644
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
   };
 
   strictDeps = true;
-  nativeBuildInputs = lib.optionals stdenv.isDarwin [ autoconf269 automake libtool ];
+  nativeBuildInputs = [ autoconf269 automake libtool ];
   buildInputs = [libsigsegv]
   ++ lib.optional (gettext != null) gettext
   ++ lib.optional (ncurses != null) ncurses
@@ -81,6 +81,7 @@ stdenv.mkDerivation {
   postPatch = ''
     sed -e 's@9090@64237@g' -i tests/socket.tst
     sed -i 's@/bin/pwd@${coreutils}&@' src/clisp-link.in
+    sed -i 's@1\.16\.2@${automake.version}@' src/aclocal.m4
     find . -type f | xargs sed -e 's/-lICE/-lXau &/' -i
   '';
 
diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index 002ce4fa97ff..fb788377107e 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -164,7 +164,7 @@ builder rec {
       foreign function call interface, and powerful string processing.
     '';
     license = licenses.lgpl3Plus;
-    maintainers = with maintainers; [ ludo lovek323 vrthra ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/interpreters/python/python-packages-base.nix b/pkgs/development/interpreters/python/python-packages-base.nix
index b5afaf34ce61..2126b796ca9d 100644
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@@ -47,9 +47,6 @@ let
     toPythonModule = x: x;  # Application does not provide modules.
   }));
 
-  # See build-setupcfg/default.nix for documentation.
-  buildSetupcfg = import ../../../build-support/build-setupcfg lib self;
-
   # Check whether a derivation provides a Python module.
   hasPythonModule = drv: drv?pythonModule && drv.pythonModule == python;
 
@@ -92,13 +89,11 @@ let
   disabledIf = x: drv: if x then disabled drv else drv;
 
 in {
-
   inherit lib pkgs stdenv;
   inherit (python.passthru) isPy27 isPy37 isPy38 isPy39 isPy310 isPy311 isPy3k isPyPy pythonAtLeast pythonOlder;
   inherit buildPythonPackage buildPythonApplication;
   inherit hasPythonModule requiredPythonModules makePythonPath disabled disabledIf;
   inherit toPythonModule toPythonApplication;
-  inherit buildSetupcfg;
 
   python = toPythonModule python;
   # Dont take pythonPackages from "global" pkgs scope to avoid mixing python versions
diff --git a/pkgs/development/interpreters/rakudo/zef.nix b/pkgs/development/interpreters/rakudo/zef.nix
index 66ee788ca430..2ce4a164f7e6 100644
--- a/pkgs/development/interpreters/rakudo/zef.nix
+++ b/pkgs/development/interpreters/rakudo/zef.nix
@@ -1,35 +1,50 @@
-{ lib, stdenv, fetchFromGitHub, rakudo, makeWrapper }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, rakudo
+, makeBinaryWrapper
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zef";
-  version = "0.21.0";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "ugexe";
     repo = "zef";
-    rev = "v${version}";
-    sha256 = "sha256-QVUnn9G28epoUEcK8mwm8S2wDQ/tv5B3Zds7bTUFwlw=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ji+KTxAOPZhuGryK0+svsVkU+HC1egKZWOboSBUON+s=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ rakudo ];
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [
+    rakudo
+  ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p "$out"
     # TODO: Find better solution. zef stores cache stuff in $HOME with the
     # default config.
     env HOME=$TMPDIR ${rakudo}/bin/raku -I. ./bin/zef --/depends --/test-depends --/build-depends --install-to=$out install .
+
+    runHook postInstall
   '';
 
   postFixup =''
     wrapProgram $out/bin/zef --prefix RAKUDOLIB , "inst#$out"
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Raku / Perl6 Module Management";
     homepage    = "https://github.com/ugexe/zef";
-    license     = licenses.artistic2;
-    platforms   = platforms.unix;
-    maintainers = with maintainers; [ sgo ];
+    license     = lib.licenses.artistic2;
+    mainProgram = "zef";
+    maintainers = with lib.maintainers; [ sgo ];
+    platforms   = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/dsdcc/default.nix b/pkgs/development/libraries/dsdcc/default.nix
index e97b36c033ff..9397c747e667 100644
--- a/pkgs/development/libraries/dsdcc/default.nix
+++ b/pkgs/development/libraries/dsdcc/default.nix
@@ -1,20 +1,32 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
-, mbelib, serialdv
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, mbelib
+, serialdv
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dsdcc";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "f4exb";
     repo = "dsdcc";
-    rev = "v${version}";
-    sha256 = "sha256-EsjmU0LQOXnOoTFrnn63hAbvqbE6NVlSQTngot5Zuf4=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-DMCk29O2Lmt2tjo6j5e4ZdZeDL3ZFUh66Sm6TGrIaeU=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ mbelib serialdv ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    mbelib
+    serialdv
+  ];
 
   cmakeFlags = [
     "-DUSE_MBELIB=ON"
@@ -25,11 +37,12 @@ stdenv.mkDerivation rec {
       --replace '=''${exec_prefix}//' '=/'
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Digital Speech Decoder (DSD) rewritten as a C++ library";
     homepage = "https://github.com/f4exb/dsdcc";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ alexwinter ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3;
+    mainProgram = "dsdccx";
+    maintainers = with lib.maintainers; [ alexwinter ];
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index 0c44b99db8d9..005890a3d4a6 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -54,14 +54,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flatpak";
-  version = "1.14.4";
+  version = "1.14.5";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [ "out" "dev" "man" "doc" "devdoc" "installedTests" ];
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-ijTb0LZ8Q051mLmOxpCVPQRvDbJuSArq+0bXKuxxZ5k="; # Taken from https://github.com/flatpak/flatpak/releases/
+    sha256 = "sha256-W3DGTOesE04eoIARJW5COuXFTydyl0QVg/d9AT8n/6w="; # Taken from https://github.com/flatpak/flatpak/releases/
   };
 
   patches = [
diff --git a/pkgs/development/libraries/flatpak/fix-test-paths.patch b/pkgs/development/libraries/flatpak/fix-test-paths.patch
index da1475009009..ebbcbde5e951 100644
--- a/pkgs/development/libraries/flatpak/fix-test-paths.patch
+++ b/pkgs/development/libraries/flatpak/fix-test-paths.patch
@@ -63,7 +63,7 @@ index afa11a6b..5b12055f 100755
  flatpak build-finish ${DIR} >&2
  mkdir -p repos
 diff --git a/tests/make-test-runtime.sh b/tests/make-test-runtime.sh
-index 4ba950df..fd50fab3 100755
+index 6345ff58..fd50fab3 100755
 --- a/tests/make-test-runtime.sh
 +++ b/tests/make-test-runtime.sh
 @@ -28,9 +28,10 @@ EOF
@@ -78,7 +78,7 @@ index 4ba950df..fd50fab3 100755
  mkdir -p ${DIR}/usr/bin
  mkdir -p ${DIR}/usr/lib
  ln -s ../lib ${DIR}/usr/lib64
-@@ -40,40 +41,17 @@ if test -f /sbin/ldconfig.real; then
+@@ -40,46 +41,17 @@ if test -f /sbin/ldconfig.real; then
  else
      cp "$(type -P ldconfig)" "${DIR}/usr/bin"
  fi
@@ -89,6 +89,12 @@ index 4ba950df..fd50fab3 100755
 -    local f=$1
 -    shift
 -
+-    # Check if the program is installed
+-    if ! command -v "${f}" &> /dev/null; then
+-        echo "${f} not found"
+-        exit 1
+-    fi
+-
 -    if grep -qFe "${f}" $BINS; then
 -        # Already handled
 -        return 0
@@ -129,7 +135,7 @@ index 4ba950df..fd50fab3 100755
  done
  ln -s bash ${DIR}/usr/bin/sh
  
-@@ -84,11 +62,13 @@ echo "Hello world, from a runtime$EXTRA"
+@@ -90,11 +62,13 @@ echo "Hello world, from a runtime$EXTRA"
  EOF
  chmod a+x ${DIR}/usr/bin/runtime_hello.sh
  
diff --git a/pkgs/development/libraries/flatpak/unset-env-vars.patch b/pkgs/development/libraries/flatpak/unset-env-vars.patch
index fec0573ed950..2a88d24f4916 100644
--- a/pkgs/development/libraries/flatpak/unset-env-vars.patch
+++ b/pkgs/development/libraries/flatpak/unset-env-vars.patch
@@ -1,11 +1,11 @@
 diff --git a/common/flatpak-run.c b/common/flatpak-run.c
-index 8fa8c0e0..e1cdeba0 100644
+index 6f54a9d0..102d9b90 100644
 --- a/common/flatpak-run.c
 +++ b/common/flatpak-run.c
-@@ -1900,6 +1900,7 @@ static const ExportData default_exports[] = {
-   {"XKB_CONFIG_ROOT", NULL},
-   {"GIO_EXTRA_MODULES", NULL},
+@@ -1902,6 +1902,7 @@ static const ExportData default_exports[] = {
    {"GDK_BACKEND", NULL},
+   {"VK_DRIVER_FILES", NULL},
+   {"VK_ICD_FILENAMES", NULL},
 +  {"GDK_PIXBUF_MODULE_FILE", NULL},
  };
  
diff --git a/pkgs/development/libraries/gensio/default.nix b/pkgs/development/libraries/gensio/default.nix
index 3dac6d6804e3..cd20eab42a62 100644
--- a/pkgs/development/libraries/gensio/default.nix
+++ b/pkgs/development/libraries/gensio/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gensio";
-  version = "2.7.7";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "cminyard";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fm850eDqKhvjwU5RwdwAro4R23yRn41ePn5++8MXHZ0=";
+    sha256 = "sha256-SwY9FAUljaxap2ZlPS3JJ8VkYiJFWoSLU1miEQIEerE=";
   };
 
   passthru = {
diff --git a/pkgs/development/libraries/ode/default.nix b/pkgs/development/libraries/ode/default.nix
index d35976932663..6ae60b7b2d3a 100644
--- a/pkgs/development/libraries/ode/default.nix
+++ b/pkgs/development/libraries/ode/default.nix
@@ -1,18 +1,33 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+, darwin
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ode";
   version = "0.16.4";
 
   src = fetchurl {
-    url = "https://bitbucket.org/odedevs/${pname}/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-cQN7goHGyGsKVXKfkNXbaXq+TL7B2BGBV+ANSOwlNGc=";
+    url = "https://bitbucket.org/odedevs/ode/downloads/ode-${finalAttrs.version}.tar.gz";
+    hash = "sha256-cQN7goHGyGsKVXKfkNXbaXq+TL7B2BGBV+ANSOwlNGc=";
   };
 
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.GLUT
+  ];
+
+  env.CXXFLAGS = lib.optionalString stdenv.cc.isClang (toString [
+    "-std=c++14"
+    "-Wno-error=c++11-narrowing"
+  ]);
+
   meta = with lib; {
     description = "Open Dynamics Engine";
     homepage = "https://www.ode.org";
-    platforms = platforms.linux;
-    license = with licenses; [ bsd3 lgpl21 lgpl3 zlib ];
+    license = with licenses; [ bsd3 lgpl21Only lgpl3Only zlib ];
+    maintainers = with maintainers; [ wegank ];
+    platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/phonon/default.nix b/pkgs/development/libraries/phonon/default.nix
index dc95b4ed8266..dd20b6dcebe6 100644
--- a/pkgs/development/libraries/phonon/default.nix
+++ b/pkgs/development/libraries/phonon/default.nix
@@ -50,7 +50,11 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  env.NIX_CFLAGS_COMPILE = "-fPIC";
+  env.NIX_CFLAGS_COMPILE = toString ([
+    "-fPIC"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error=enum-constexpr-conversion"
+  ]);
 
   cmakeBuildType = if debug then "Debug" else "Release";
 
diff --git a/pkgs/development/libraries/physics/apfel/cmake.patch b/pkgs/development/libraries/physics/apfel/cmake.patch
new file mode 100644
index 000000000000..5bc342aeb48c
--- /dev/null
+++ b/pkgs/development/libraries/physics/apfel/cmake.patch
@@ -0,0 +1,14 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -46,8 +46,8 @@ message(STATUS "APFEL: APFEL_DOWNLOAD_PDFS=${APFEL_DOWNLOAD_PDFS}")
+ # CONFIG SCRIPT ========================================================
+ set(prefix ${CMAKE_INSTALL_PREFIX})
+ set(exec_prefix "${prefix}")
+-set(includedir "${prefix}/${CMAKE_INSTALL_INCLUDEDIR}")
+-set(libdir "${prefix}/${CMAKE_INSTALL_LIBDIR}")
++set(includedir "${CMAKE_INSTALL_FULL_INCLUDEDIR}")
++set(libdir "${CMAKE_INSTALL_FULL_LIBDIR}")
+ set(PACKAGE_VERSION "${apfel_VERSION}")
+ configure_file("${PROJECT_SOURCE_DIR}/bin/apfel-config.in" "${PROJECT_BINARY_DIR}/bin/apfel-config")
+ configure_file("${PROJECT_SOURCE_DIR}/bin/apfel.in" "${PROJECT_BINARY_DIR}/bin/apfel")
diff --git a/pkgs/development/libraries/physics/apfel/default.nix b/pkgs/development/libraries/physics/apfel/default.nix
index c0860d9a1baf..ae48fb90ac83 100644
--- a/pkgs/development/libraries/physics/apfel/default.nix
+++ b/pkgs/development/libraries/physics/apfel/default.nix
@@ -1,28 +1,59 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, gfortran, lhapdf, python3, zlib }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, gfortran
+, lhapdf
+, python3
+, swig
+, zlib
+}:
 
 stdenv.mkDerivation rec {
   pname = "apfel";
-  version = "3.0.6";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "scarrazza";
     repo = "apfel";
     rev = version;
-    sha256 = "sha256-fRdJ+C92tEC75iUwP9Tmm/EswrlA52eUo5fBjfieH9o=";
+    hash = "sha256-RXzHcLgitIk+6pINqcvpQv7QpDpAuFrOHKqjwZ0K5zI=";
   };
 
-  # needed for aarch64-darwin
-  nativeBuildInputs = [ autoreconfHook ];
+  patches = [
+    # https://github.com/scarrazza/apfel/pull/54
+    ./cmake.patch
+  ];
 
-  buildInputs = [ gfortran lhapdf python3 zlib ];
+  nativeBuildInputs = [
+    cmake
+    swig
+  ];
+  buildInputs = [
+    gfortran
+    lhapdf
+    python3
+    zlib
+  ];
 
-  enableParallelBuilding = true;
+  cmakeFlags = [
+    "-DAPFEL_DOWNLOAD_PDFS=OFF"
+    "-DAPFEL_Python_SITEARCH=autoprefix"
+  ];
+
+  doCheck = true;
+  nativeCheckInputs = [
+    lhapdf.pdf_sets.NNPDF23_nlo_as_0118
+    lhapdf.pdf_sets.NNPDF31_nnlo_as_0118
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-DAPFEL_VERSION=${version}";
 
   meta = with lib; {
     description = "A PDF Evolution Library";
-    license     = licenses.gpl3Plus;
-    homepage    = "https://apfel.mi.infn.it/";
-    platforms   = platforms.unix;
+    homepage = "https://apfel.mi.infn.it/";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ veprbl ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/physics/lhapdf/default.nix b/pkgs/development/libraries/physics/lhapdf/default.nix
index 00f548806fc5..0482846f077a 100644
--- a/pkgs/development/libraries/physics/lhapdf/default.nix
+++ b/pkgs/development/libraries/physics/lhapdf/default.nix
@@ -1,30 +1,14 @@
-{ lib, stdenv, fetchurl, fetchpatch, python, makeWrapper }:
+{ lib, stdenv, fetchurl, python, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "lhapdf";
-  version = "6.5.3";
+  version = "6.5.4";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/lhapdf/LHAPDF-${version}.tar.gz";
-    sha256 = "sha256-V0Nc1pXilwZdU+ab0pCQdlyTSTa2qXX/jFWXZvIjA1k=";
+    sha256 = "sha256-JEOksyzDsFl8gki9biVwOs6ckaeiU8X2CxtUKO+chp4=";
   };
 
-  patches = [
-    # avoid silent compilation failures
-    (fetchpatch {
-      name = "lhapdf-propagate_returncode.patch";
-      url = "https://gitlab.com/hepcedar/lhapdf/-/commit/2806ac795c7e4a69281d9c2a6a8bba5423f37e74.diff";
-      hash = "sha256-j8txlt0n5gpUy9zeuWKx+KRXL3HMMaGcwOxr908966k=";
-    })
-
-    # workaround "ld: -stack_size option can only be used when linking a main executable" on darwin
-    (fetchpatch {
-      name = "lhapdf-Wl_stack_size.patch";
-      url = "https://gitlab.com/hepcedar/lhapdf/-/commit/463764d6613837b6ab57ecaf13bc61be2349e5e4.diff";
-      hash = "sha256-AbDs7gtU5HsJG5n/solMzu2bjX1juxfUIqIt5KmNffU=";
-    })
-  ];
-
   # The Apple SDK only exports locale_t from xlocale.h whereas glibc
   # had decided that xlocale.h should be a part of locale.h
   postPatch = lib.optionalString (stdenv.isDarwin && stdenv.cc.isGNU) ''
diff --git a/pkgs/development/libraries/physics/yoda/default.nix b/pkgs/development/libraries/physics/yoda/default.nix
index da6c21db0ff0..68f4e3714e09 100644
--- a/pkgs/development/libraries/physics/yoda/default.nix
+++ b/pkgs/development/libraries/physics/yoda/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , python
 , root
 , makeWrapper
@@ -11,22 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yoda";
-  version = "1.9.8";
+  version = "1.9.9";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/yoda/YODA-${version}.tar.bz2";
-    hash = "sha256-e8MGJGirulCv8+y4sizmdxlgNgCYkGiO9FM6qn+S5uQ=";
+    hash = "sha256-68rVU2mhztzuOi3gWUB8hRZSukRJURP1wJ2MLlf1Fqo=";
   };
 
-  patches = [
-    # A bugfix https://gitlab.com/hepcedar/yoda/-/merge_requests/116
-    (fetchpatch {
-      url = "https://gitlab.com/hepcedar/yoda/-/commit/ba1275033522c66bc473dfeffae1a7971e985611.diff";
-      hash = "sha256-/8UJuypiQzywarE+o3BEMtqM+f+YzkHylugi+xTJf+w=";
-      excludes = [ "ChangeLog" ];
-    })
-  ];
-
   nativeBuildInputs = with python.pkgs; [
     cython
     makeWrapper
diff --git a/pkgs/development/libraries/tdlib/default.nix b/pkgs/development/libraries/tdlib/default.nix
index 575aef5ba4f3..f1c1c85caf0b 100644
--- a/pkgs/development/libraries/tdlib/default.nix
+++ b/pkgs/development/libraries/tdlib/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "tdlib";
-  version = "1.8.21";
+  version = "1.8.22";
 
   src = fetchFromGitHub {
     owner = "tdlib";
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     # The tdlib authors do not set tags for minor versions, but
     # external programs depending on tdlib constrain the minor
     # version, hence we set a specific commit with a known version.
-    rev = "3870c29b158b75ca5e48e0eebd6b5c3a7994a000";
-    hash = "sha256-MCzgovcEZa34ZkwbbwfXHm2qitHwL2Tpr8p7+PxNhYk=";
+    rev = "24893faf75d84b2b885f3f7aeb9d5a3c056fa7be";
+    hash = "sha256-4cfnre71+rQSuPrtFJMzIEPYVCZH/W142b4Pn2NxvqI=";
   };
 
   buildInputs = [ gperf openssl readline zlib ];
diff --git a/pkgs/development/python-modules/awscrt/default.nix b/pkgs/development/python-modules/awscrt/default.nix
index 9d739c81f700..dc499f2bcb6c 100644
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "awscrt";
-  version = "0.19.18";
+  version = "0.19.19";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NQtu/Y6+4ILqPz5SxZo8PsWUza8B24tIU9zrn+yQyJ0=";
+    hash = "sha256-HBURU13uFGpsJqOC7T6tViWaEFs7fX2CNVOuVn0Djf4=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index edfad3b6c247..3deec8ee65de 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-data";
-  version = "2.22.6";
+  version = "2.23.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc-data";
     rev = "refs/tags/${version}";
-    hash = "sha256-oHW80TqQe7LCvBpdB0kW8+vKCZ36/zXEssp7+kHUrTA=";
+    hash = "sha256-UsWMlwG1g59I+TIn1uwp6vyzVIBtj1lfchp+3SYognc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index da1fec16d121..c1b57bab97e7 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.1.31";
+  version = "3.1.33";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-XEkP9J9TkArbjoG/j54o2AxAd/2v60iJ8iQp28k9Pf0=";
+    hash = "sha256-NcjzKA/QvxIoZMzgMmyAQm4KI8kCsj+K9wcI1n+HPbc=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/azure-static-sites-client/versions.json b/pkgs/development/tools/azure-static-sites-client/versions.json
index 55c30a12addf..76bdb693e4aa 100644
--- a/pkgs/development/tools/azure-static-sites-client/versions.json
+++ b/pkgs/development/tools/azure-static-sites-client/versions.json
@@ -1,58 +1,58 @@
 [
   {
     "version": "latest",
-    "buildId": "1.0.024941",
-    "publishDate": "2023-10-31T04:54:50.5527205Z",
+    "buildId": "1.0.025241",
+    "publishDate": "2023-11-30T02:51:40.8356813Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/linux/StaticSitesClient",
-        "sha": "bea23499732d615698baf4c9dcafe717fdd4ba8344f2d96740233b0380df79b6"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/linux/StaticSitesClient",
+        "sha": "e4ccb44c516e03e6dcc2a26a35ffd4c84a61dfea581990dd5c0edb7c12662db0"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/windows/StaticSitesClient.exe",
-        "sha": "a93aa5ec2a17280f3c9c8252948f8c68050c8852770322758ffa3187b6bce1dd"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/windows/StaticSitesClient.exe",
+        "sha": "4146ac01a488910d6ea066e1c46505048b0c9af2e74ef273c4236b387796712d"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/macOS/StaticSitesClient",
-        "sha": "57ea66c930aafbf4dea82216e51128b3315ec2db3ab385d41e8d912a3adab2c0"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/macOS/StaticSitesClient",
+        "sha": "05b213d7861454368d2c9801b0ccc75cfd13cb48f8e121fffaa2ab7e9b5671cd"
       }
     }
   },
   {
     "version": "stable",
-    "buildId": "1.0.024941",
-    "publishDate": "2023-10-31T04:54:50.5527205Z",
+    "buildId": "1.0.025241",
+    "publishDate": "2023-11-30T02:51:40.8356813Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/linux/StaticSitesClient",
-        "sha": "bea23499732d615698baf4c9dcafe717fdd4ba8344f2d96740233b0380df79b6"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/linux/StaticSitesClient",
+        "sha": "e4ccb44c516e03e6dcc2a26a35ffd4c84a61dfea581990dd5c0edb7c12662db0"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/windows/StaticSitesClient.exe",
-        "sha": "a93aa5ec2a17280f3c9c8252948f8c68050c8852770322758ffa3187b6bce1dd"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/windows/StaticSitesClient.exe",
+        "sha": "4146ac01a488910d6ea066e1c46505048b0c9af2e74ef273c4236b387796712d"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/macOS/StaticSitesClient",
-        "sha": "57ea66c930aafbf4dea82216e51128b3315ec2db3ab385d41e8d912a3adab2c0"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/macOS/StaticSitesClient",
+        "sha": "05b213d7861454368d2c9801b0ccc75cfd13cb48f8e121fffaa2ab7e9b5671cd"
       }
     }
   },
   {
     "version": "backup",
-    "buildId": "1.0.024871",
-    "publishDate": "2023-10-24T04:09:23.7109231Z",
+    "buildId": "1.0.025142",
+    "publishDate": "2023-11-20T09:32:48.489649Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/linux/StaticSitesClient",
-        "sha": "13d1c02e43dec373be04152f7f8e71974f080440cb9480c3ccb4f83c8c6f036a"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025142/linux/StaticSitesClient",
+        "sha": "f36cce34f04b045e3ea5de5c201ce6663925d9680e3b5986b417534898b995b2"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/windows/StaticSitesClient.exe",
-        "sha": "868f221ea77b13cea8c6c41edbecea53bf5171d42dc9376f34615e544a3874f0"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025142/windows/StaticSitesClient.exe",
+        "sha": "1e8932e2c4189d40657db888f82dfb030c2d41951421dd9a68712960e7c7fa7b"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/macOS/StaticSitesClient",
-        "sha": "63c9027a7b5e597ae9e0ad8311b31a587bd977ed758555784d08cc3ff35e80a4"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025142/macOS/StaticSitesClient",
+        "sha": "891faef16ae06fc609f787ffce7d6a1816e24fddfcaef9bc10e3b50208fe29aa"
       }
     }
   }
diff --git a/pkgs/development/tools/glamoroustoolkit/default.nix b/pkgs/development/tools/glamoroustoolkit/default.nix
index 73c2dab8f342..99b9f528df46 100644
--- a/pkgs/development/tools/glamoroustoolkit/default.nix
+++ b/pkgs/development/tools/glamoroustoolkit/default.nix
@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glamoroustoolkit";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchzip {
     url = "https://github.com/feenkcom/gtoolkit-vm/releases/download/v${finalAttrs.version}/GlamorousToolkit-x86_64-unknown-linux-gnu.zip";
     stripRoot = false;
-    hash = "sha256-263Bl5zd2k5DAPB/Ar8QMpthMiAv7BUSZ5+G03ZL5m0=";
+    hash = "sha256-WcAOGPWbY3sCcwmSHTjZvO3ASYYPv1T0iEA5C/VXL9I=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];
diff --git a/pkgs/development/tools/htmlq/default.nix b/pkgs/development/tools/htmlq/default.nix
index 1adcaf954d04..6a5015c600fc 100644
--- a/pkgs/development/tools/htmlq/default.nix
+++ b/pkgs/development/tools/htmlq/default.nix
@@ -22,5 +22,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/mgdm/htmlq";
     license = licenses.mit;
     maintainers = with maintainers; [ siraben nerdypepper ];
+    mainProgram = "htmlq";
   };
 }
diff --git a/pkgs/development/tools/language-servers/pylyzer/default.nix b/pkgs/development/tools/language-servers/pylyzer/default.nix
index b00ab1ccf0cf..3f48b0b9d824 100644
--- a/pkgs/development/tools/language-servers/pylyzer/default.nix
+++ b/pkgs/development/tools/language-servers/pylyzer/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pylyzer";
-  version = "0.0.50";
+  version = "0.0.51";
 
   src = fetchFromGitHub {
     owner = "mtshiba";
     repo = "pylyzer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-w6CXKBbELkPNido0bldMDqoLZbqLd0gKBv576uLAX3Y=";
+    hash = "sha256-TKAmIy5dP2m1iokxSqfxTj79UDkW00+se/NDGS3euwA=";
   };
 
-  cargoHash = "sha256-/s6ZXvgFXED17CwdmR8lLZDQ3otV334U4Uly90MPV1Y=";
+  cargoHash = "sha256-035ueF42g6By+6TOGEultc8n350g3mRT00raQgWIcUM=";
 
   nativeBuildInputs = [
     git
diff --git a/pkgs/development/tools/misc/blackfire/php-probe.nix b/pkgs/development/tools/misc/blackfire/php-probe.nix
index 39f5dd5185f4..960928c24552 100644
--- a/pkgs/development/tools/misc/blackfire/php-probe.nix
+++ b/pkgs/development/tools/misc/blackfire/php-probe.nix
@@ -9,6 +9,8 @@
 , common-updater-scripts
 }:
 
+assert lib.assertMsg (!php.ztsSupport) "blackfire only supports non zts versions of PHP";
+
 let
   phpMajor = lib.versions.majorMinor php.version;
 
diff --git a/pkgs/development/tools/misc/hydra/unstable.nix b/pkgs/development/tools/misc/hydra/unstable.nix
index 544a0221737e..8ee7c7f6fb92 100644
--- a/pkgs/development/tools/misc/hydra/unstable.nix
+++ b/pkgs/development/tools/misc/hydra/unstable.nix
@@ -43,6 +43,7 @@
 , cacert
 , glibcLocales
 , fetchFromGitHub
+, fetchpatch2
 , nixosTests
 }:
 
@@ -132,6 +133,17 @@ stdenv.mkDerivation rec {
     hash = "sha256-FjyMb5ZbPa2GLrRuFMUP/foKb0KvXFKThvgc9faFIw8=";
   };
 
+  patches = [
+    # hydra-eval-jobs: don't use restrict-eval for Flakes
+    # https://github.com/NixOS/hydra/pull/1257
+    # should be removed when https://github.com/NixOS/nix/pull/9547
+    # lands in the nix version used by hydra
+    (fetchpatch2 {
+      url = "https://github.com/NixOS/hydra/commit/9370b0ef977bff7e84ac07a81a0e31e75989276b.patch";
+      hash = "sha256-BRenC0lpWPgzfx42MPJBQ9VBamh5hZXuuVe6TXYKkdE=";
+    })
+  ];
+
   buildInputs = [
     unzip
     libpqxx
diff --git a/pkgs/development/tools/misc/mdctags/default.nix b/pkgs/development/tools/misc/mdctags/default.nix
index 7d8992b4e201..acd6d39e97f6 100644
--- a/pkgs/development/tools/misc/mdctags/default.nix
+++ b/pkgs/development/tools/misc/mdctags/default.nix
@@ -18,5 +18,6 @@ rustPlatform.buildRustPackage {
     homepage = "https://github.com/wsdjeg/mdctags.rs";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ pacien ];
+    mainProgram = "mdctags";
   };
 }
diff --git a/pkgs/development/tools/misc/pest-ide-tools/default.nix b/pkgs/development/tools/misc/pest-ide-tools/default.nix
index 3398810dace4..162817c68357 100644
--- a/pkgs/development/tools/misc/pest-ide-tools/default.nix
+++ b/pkgs/development/tools/misc/pest-ide-tools/default.nix
@@ -1,9 +1,11 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , rustPlatform
 , nix-update-script
 , pkg-config
 , openssl
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,7 +20,11 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-SymtMdj7QVOEiSeTjmVidejFeGK8swnM6nfT7u18URs=";
   };
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/development/tools/setupcfg2nix/default.nix b/pkgs/development/tools/setupcfg2nix/default.nix
deleted file mode 100644
index 4cc1ec320ccd..000000000000
--- a/pkgs/development/tools/setupcfg2nix/default.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ buildSetupcfg, fetchFromGitHub, lib }:
-
-buildSetupcfg rec {
-  info = import ./info.nix;
-  src = fetchFromGitHub {
-    owner = "target";
-    repo = "setupcfg2nix";
-    rev = info.version;
-    sha256 = "1rj227vxybwp9acwnpwg9np964b1qcw2av3qmx00isnrw5vcps8m";
-  };
-  application = true;
-  meta = {
-    description = "Generate nix expressions from setup.cfg for a python package";
-    homepage = "https://github.com/target/setupcfg2nix";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-    maintainers = [ lib.maintainers.shlevy ];
-  };
-}
diff --git a/pkgs/development/tools/setupcfg2nix/info.nix b/pkgs/development/tools/setupcfg2nix/info.nix
deleted file mode 100644
index 17e888fee416..000000000000
--- a/pkgs/development/tools/setupcfg2nix/info.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  pname = "setupcfg2nix";
-  version = "2.0.1";
-  install_requires = [
-    "setuptools"
-  ];
-}
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index ada98eb33b47..350211001ad9 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.40.4";
+  version = "4.40.5";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    hash = "sha256-cEOOaQAduL9a+EwWigzPDN1ABM6wEjEc8dV4ESFkMXA=";
+    hash = "sha256-CCgertXgnA6q259Ngmy4EBD6GDuvSb0bREDddR2ht8E=";
   };
 
-  vendorHash = "sha256-kFDW8HrBhSuflAbuC6Zs/61OLXPsfPQfYU7Laa7eK9c=";
+  vendorHash = "sha256-SQGJj5syay4LllqmK/cRoZbprgDQhLGdQM3T1m/dZsI=";
 
   nativeBuildInputs = [ installShellFiles ];