Merge remote-tracking branch 'origin/master' into staging-next

Conflicts:
- pkgs/development/python-modules/flask-security-too/default.nix

32 files changed, 360 insertions, 342 deletions

diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
deleted file mode 100644
index 5b3cbdd4cc81..000000000000
--- a/pkgs/development/compilers/go/1.20.nix
+++ /dev/null
@@ -1,189 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, tzdata
-, substituteAll
-, iana-etc
-, Security
-, Foundation
-, xcbuild
-, mailcap
-, buildPackages
-, pkgsBuildTarget
-, threadsCross
-, testers
-, skopeo
-, buildGo120Module
-}:
-
-let
-  useGccGoBootstrap = stdenv.buildPlatform.isMusl || stdenv.buildPlatform.isRiscV;
-  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo12 else buildPackages.callPackage ./bootstrap117.nix { };
-
-  skopeoTest = skopeo.override { buildGoModule = buildGo120Module; };
-
-  goarch = platform: {
-    "aarch64" = "arm64";
-    "arm" = "arm";
-    "armv5tel" = "arm";
-    "armv6l" = "arm";
-    "armv7l" = "arm";
-    "i686" = "386";
-    "mips" = "mips";
-    "mips64el" = "mips64le";
-    "mipsel" = "mipsle";
-    "powerpc64le" = "ppc64le";
-    "riscv64" = "riscv64";
-    "s390x" = "s390x";
-    "x86_64" = "amd64";
-  }.${platform.parsed.cpu.name} or (throw "Unsupported system: ${platform.parsed.cpu.name}");
-
-  # We need a target compiler which is still runnable at build time,
-  # to handle the cross-building case where build != host == target
-  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
-
-  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "go";
-  version = "1.20.14";
-
-  src = fetchurl {
-    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-Gu8yGg4+OLfpHS1+tkBAZmyr3Md9OD3jyVItDWm2f04=";
-  };
-
-  strictDeps = true;
-  buildInputs = [ ]
-    ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
-    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
-
-  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [ Foundation Security xcbuild ];
-
-  depsBuildTarget = lib.optional isCross targetCC;
-
-  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
-
-  postPatch = ''
-    patchShebangs .
-  '';
-
-  patches = [
-    (substituteAll {
-      src = ./iana-etc-1.17.patch;
-      iana = iana-etc;
-    })
-    # Patch the mimetype database location which is missing on NixOS.
-    # but also allow static binaries built with NixOS to run outside nix
-    (substituteAll {
-      src = ./mailcap-1.17.patch;
-      inherit mailcap;
-    })
-    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
-    # that run outside a nix server
-    (substituteAll {
-      src = ./tzdata-1.19.patch;
-      inherit tzdata;
-    })
-    ./remove-tools-1.11.patch
-    ./go_no_vendor_checks-1.16.patch
-  ];
-
-  GOOS = stdenv.targetPlatform.parsed.kernel.name;
-  GOARCH = goarch stdenv.targetPlatform;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
-  GOHOSTARCH = goarch stdenv.buildPlatform;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET =
-    if isCross then
-      "${targetCC}/bin/${targetCC.targetPrefix}cc"
-    else
-      null;
-  CXX_FOR_TARGET =
-    if isCross then
-      "${targetCC}/bin/${targetCC.targetPrefix}c++"
-    else
-      null;
-
-  GOARM = toString (lib.intersectLists [ (stdenv.hostPlatform.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
-  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-
-  GOROOT_BOOTSTRAP = if useGccGoBootstrap then goBootstrap else "${goBootstrap}/share/go";
-
-  buildPhase = ''
-    runHook preBuild
-    export GOCACHE=$TMPDIR/go-cache
-    # this is compiled into the binary
-    export GOROOT_FINAL=$out/share/go
-
-    export PATH=$(pwd)/bin:$PATH
-
-    ${lib.optionalString isCross ''
-    # Independent from host/target, CC should produce code for the building system.
-    # We only set it when cross-compiling.
-    export CC=${buildPackages.stdenv.cc}/bin/cc
-    ''}
-    ulimit -a
-
-    pushd src
-    ./make.bash
-    popd
-    runHook postBuild
-  '';
-
-  preInstall = ''
-    # Contains the wrong perl shebang when cross compiling,
-    # since it is not used for anything we can deleted as well.
-    rm src/regexp/syntax/make_perl_groups.pl
-  '' + (if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then ''
-    mv bin/*_*/* bin
-    rmdir bin/*_*
-    ${lib.optionalString (!(finalAttrs.GOHOSTARCH == finalAttrs.GOARCH && finalAttrs.GOOS == finalAttrs.GOHOSTOS)) ''
-      rm -rf pkg/${finalAttrs.GOHOSTOS}_${finalAttrs.GOHOSTARCH} pkg/tool/${finalAttrs.GOHOSTOS}_${finalAttrs.GOHOSTARCH}
-    ''}
-  '' else lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
-    rm -rf bin/*_*
-    ${lib.optionalString (!(finalAttrs.GOHOSTARCH == finalAttrs.GOARCH && finalAttrs.GOOS == finalAttrs.GOHOSTOS)) ''
-      rm -rf pkg/${finalAttrs.GOOS}_${finalAttrs.GOARCH} pkg/tool/${finalAttrs.GOOS}_${finalAttrs.GOARCH}
-    ''}
-  '');
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $GOROOT_FINAL
-    cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    mkdir -p $out/bin
-    ln -s $GOROOT_FINAL/bin/* $out/bin
-    runHook postInstall
-  '';
-
-  disallowedReferences = [ goBootstrap ];
-
-  passthru = {
-    inherit goBootstrap skopeoTest;
-    tests = {
-      skopeo = testers.testVersion { package = skopeoTest; };
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-        command = "go version";
-        version = "go${finalAttrs.version}";
-      };
-    };
-  };
-
-  meta = with lib; {
-    changelog = "https://go.dev/doc/devel/release#go${lib.versions.majorMinor finalAttrs.version}";
-    description = "The Go Programming language";
-    homepage = "https://go.dev/";
-    license = licenses.bsd3;
-    maintainers = teams.golang.members;
-    platforms = platforms.darwin ++ platforms.linux;
-    mainProgram = "go";
-  };
-})
diff --git a/pkgs/development/libraries/duckdb/default.nix b/pkgs/development/libraries/duckdb/default.nix
index e6645480d2b2..be1a20987881 100644
--- a/pkgs/development/libraries/duckdb/default.nix
+++ b/pkgs/development/libraries/duckdb/default.nix
@@ -15,32 +15,22 @@
 
 let
   enableFeature = yes: if yes then "ON" else "OFF";
+  versions = lib.importJSON ./versions.json;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "duckdb";
-  version = "0.10.0";
+  inherit (versions) rev version;
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-qGUq0iYTaLNHKqbXNLRmvqHMqunvIlP991IKb4qdSt4=";
+    # to update run:
+    # nix-shell maintainers/scripts/update.nix --argstr path duckdb
+    inherit (versions) hash;
+    owner = "duckdb";
+    repo = "duckdb";
+    rev = "refs/tags/v${finalAttrs.version}";
   };
 
-  patches = [
-    # remove calls to git and set DUCKDB_VERSION to version
-    (substituteAll {
-      src = ./version.patch;
-      version = "v${version}";
-    })
-    # add missing file needed for httpfs compile
-    # remove on next update
-    (fetchpatch {
-      name = "missing-httpfs-file.patch";
-      url = "https://github.com/duckdb/duckdb/commit/3d7aa3ed46ecf5f18122559e385b75f1f5e9aba8.patch";
-      hash = "sha256-Q4IHCpMpxn86OquUZdEF7P0nHEPOcWS0TQijTkvBYbQ=";
-    })
-  ];
+  outputs = [ "out" "lib" "dev" ];
 
   nativeBuildInputs = [ cmake ninja python3 ];
   buildInputs = [ openssl ]
@@ -48,22 +38,22 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withOdbc [ unixODBC ];
 
   cmakeFlags = [
-    "-DDUCKDB_EXTENSION_CONFIGS=${src}/.github/config/in_tree_extensions.cmake"
+    "-DDUCKDB_EXTENSION_CONFIGS=${finalAttrs.src}/.github/config/in_tree_extensions.cmake"
     "-DBUILD_ODBC_DRIVER=${enableFeature withOdbc}"
     "-DJDBC_DRIVER=${enableFeature withJdbc}"
-  ] ++ lib.optionals doInstallCheck [
+    "-DOVERRIDE_GIT_DESCRIBE=v${finalAttrs.version}-0-g${finalAttrs.rev}"
+  ] ++ lib.optionals finalAttrs.doInstallCheck [
     # development settings
     "-DBUILD_UNITTESTS=ON"
   ];
 
-  doInstallCheck = true;
-
-  preInstallCheck = ''
-    export HOME="$(mktemp -d)"
-  '' + lib.optionalString stdenv.isDarwin ''
-    export DYLD_LIBRARY_PATH="$out/lib''${DYLD_LIBRARY_PATH:+:}''${DYLD_LIBRARY_PATH}"
+  postInstall = ''
+    mkdir -p $lib
+    mv $out/lib $lib
   '';
 
+  doInstallCheck = true;
+
   installCheckPhase =
     let
       excludes = map (pattern: "exclude:'${pattern}'") ([
@@ -105,26 +95,29 @@ stdenv.mkDerivation rec {
         "test/sql/copy/csv/auto/test_csv_auto.test"
         # test expects installed file timestamp to be > 2024
         "test/sql/table_function/read_text_and_blob.test"
-        # can re-enable next update (broken for 0.10.0)
-        "test/sql/secrets/create_secret_non_writable_persistent_dir.test"
-        # https://github.com/duckdb/duckdb/issues/10722
-        "test/sql/types/nested/list/list_aggregate_dict.test"
+        # fails with Out of Memory Error
+        "test/sql/copy/parquet/batched_write/batch_memory_usage.test"
+        # wants http connection
+        "test/sql/copy/csv/test_mixed_lines.test"
       ] ++ lib.optionals stdenv.isAarch64 [
         "test/sql/aggregate/aggregates/test_kurtosis.test"
         "test/sql/aggregate/aggregates/test_skewness.test"
         "test/sql/function/list/aggregates/skewness.test"
       ]);
+      LD_LIBRARY_PATH = lib.optionalString stdenv.isDarwin "DY" + "LD_LIBRARY_PATH";
     in
     ''
       runHook preInstallCheck
 
-      ./test/unittest ${toString excludes}
+      HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}
 
       runHook postInstallCheck
     '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
-    changelog = "https://github.com/duckdb/duckdb/releases/tag/v${version}";
+    changelog = "https://github.com/duckdb/duckdb/releases/tag/v${finalAttrs.version}";
     description = "Embeddable SQL OLAP Database Management System";
     homepage = "https://duckdb.org/";
     license = licenses.mit;
@@ -132,4 +125,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ costrouc cpcloud ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/duckdb/update.sh b/pkgs/development/libraries/duckdb/update.sh
new file mode 100755
index 000000000000..f3acd176ee86
--- /dev/null
+++ b/pkgs/development/libraries/duckdb/update.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p cacert curl jq moreutils nix-prefetch
+# shellcheck shell=bash
+
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+nixpkgs=$(while [[ ! -e .git ]]; do [[ ${PWD} != / ]] || exit 1; cd ..; done; echo "${PWD}")
+
+repo=duckdb
+owner=duckdb
+
+msg() {
+    echo "$*" >&2
+}
+
+json_get() {
+    jq -r "$1" < 'versions.json'
+}
+
+json_set() {
+    jq --arg x "$2" "$1 = \$x" < 'versions.json' | sponge 'versions.json'
+}
+
+get_latest() {
+    curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s \
+        "https://api.github.com/repos/${owner}/${repo}/releases/latest" | jq -r .tag_name
+}
+
+get_sha() {
+    curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s \
+        "https://api.github.com/repos/${owner}/${repo}/git/ref/tags/$1" | jq -r .object.sha
+}
+
+tag=$(get_latest)
+version=${tag/v/}
+
+[[ ${version} = $(json_get .version) ]] && { msg "${version} is up to date"; exit 0; }
+
+sha=$(get_sha "${tag}")
+sri=$(nix-prefetch -I nixpkgs="${nixpkgs}" -E "duckdb.overrideAttrs { version = \"${version}\"; }")
+
+json_set ".version" "${version}"
+json_set ".rev" "${sha}"
+json_set ".hash" "${sri}"
diff --git a/pkgs/development/libraries/duckdb/version.patch b/pkgs/development/libraries/duckdb/version.patch
deleted file mode 100644
index 122ad4295d41..000000000000
--- a/pkgs/development/libraries/duckdb/version.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 2b49e11288..0a4a69b9a0 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -244,52 +244,7 @@ if(${CMAKE_SYSTEM_NAME} STREQUAL "SunOS")
-   set(SUN TRUE)
- endif()
- 
--find_package(Git)
--if(Git_FOUND)
--  if (NOT DEFINED GIT_COMMIT_HASH)
--    execute_process(
--            COMMAND ${GIT_EXECUTABLE} log -1 --format=%h
--            WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
--            RESULT_VARIABLE GIT_RESULT
--            OUTPUT_VARIABLE GIT_COMMIT_HASH
--            OUTPUT_STRIP_TRAILING_WHITESPACE)
--  endif()
--  execute_process(
--          COMMAND ${GIT_EXECUTABLE} describe --tags --abbrev=0
--          WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
--          OUTPUT_VARIABLE GIT_LAST_TAG
--          OUTPUT_STRIP_TRAILING_WHITESPACE)
--  execute_process(
--          COMMAND ${GIT_EXECUTABLE} describe --tags --long
--          WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
--          OUTPUT_VARIABLE GIT_ITERATION
--          OUTPUT_STRIP_TRAILING_WHITESPACE)
--else()
--  message("Git NOT FOUND")
--endif()
--
--if(GIT_RESULT EQUAL "0")
--  string(REGEX REPLACE "v([0-9]+).[0-9]+.[0-9]+" "\\1" DUCKDB_MAJOR_VERSION "${GIT_LAST_TAG}")
--  string(REGEX REPLACE "v[0-9]+.([0-9]+).[0-9]+" "\\1" DUCKDB_MINOR_VERSION "${GIT_LAST_TAG}")
--  string(REGEX REPLACE "v[0-9]+.[0-9]+.([0-9]+)" "\\1" DUCKDB_PATCH_VERSION "${GIT_LAST_TAG}")
--  string(REGEX REPLACE ".*-([0-9]+)-.*" "\\1" DUCKDB_DEV_ITERATION "${GIT_ITERATION}")
--
--  if(DUCKDB_DEV_ITERATION EQUAL 0)
--    # on a tag; directly use the version
--    set(DUCKDB_VERSION "${GIT_LAST_TAG}")
--  else()
--    # not on a tag, increment the patch version by one and add a -devX suffix
--    math(EXPR DUCKDB_PATCH_VERSION "${DUCKDB_PATCH_VERSION}+1")
--    set(DUCKDB_VERSION "v${DUCKDB_MAJOR_VERSION}.${DUCKDB_MINOR_VERSION}.${DUCKDB_PATCH_VERSION}-dev${DUCKDB_DEV_ITERATION}")
--  endif()
--else()
--  # fallback for when building from tarball
--  set(DUCKDB_MAJOR_VERSION 0)
--  set(DUCKDB_MINOR_VERSION 0)
--  set(DUCKDB_PATCH_VERSION 1)
--  set(DUCKDB_DEV_ITERATION 0)
--  set(DUCKDB_VERSION "v${DUCKDB_MAJOR_VERSION}.${DUCKDB_MINOR_VERSION}.${DUCKDB_PATCH_VERSION}-dev${DUCKDB_DEV_ITERATION}")
--endif()
-+set(DUCKDB_VERSION "@version@")
- 
- message(STATUS "git hash ${GIT_COMMIT_HASH}, version ${DUCKDB_VERSION}")
- 
diff --git a/pkgs/development/libraries/duckdb/versions.json b/pkgs/development/libraries/duckdb/versions.json
new file mode 100644
index 000000000000..efb151413e3d
--- /dev/null
+++ b/pkgs/development/libraries/duckdb/versions.json
@@ -0,0 +1,5 @@
+{
+  "version": "0.10.1",
+  "rev": "4a89d97db8a5a23a15f3025c8d2d2885337c2637",
+  "hash": "sha256-/j/DaUzsfACI5Izr4lblkYmIEmKsOXr760UTwC0l/qg="
+}
diff --git a/pkgs/development/libraries/yyjson/default.nix b/pkgs/development/libraries/yyjson/default.nix
index b0e17fffad2a..86a286ef2e2d 100644
--- a/pkgs/development/libraries/yyjson/default.nix
+++ b/pkgs/development/libraries/yyjson/default.nix
@@ -19,11 +19,11 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
   ];
 
-  meta = with lib; {
+  meta = {
     description = "The fastest JSON library in C";
     homepage = "https://github.com/ibireme/yyjson";
     changelog = "https://github.com/ibireme/yyjson/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ federicoschonborn ];
   };
 })
diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 2b26ba64c15b..73cc1f35c657 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -362,7 +362,7 @@ let
 
   nyxt-gtk = build-asdf-system {
     pname = "nyxt";
-    version = "3.11.4";
+    version = "3.11.5";
 
     lispLibs = (with super; [
       alexandria
@@ -445,6 +445,8 @@ let
                     "slynk/profiler" "slynk/stickers" "slynk/indentation"
                     "slynk/retro" ];
       }))
+      iterate
+      symbol-munger
     ]) ++ (with self; [
       history-tree
       nhooks
@@ -457,7 +459,6 @@ let
       nfiles
       cl-containers
       # remove this override after quicklisp one is updated.
-      # Because of building failure with new sbcl, the slime version is different from the nyxt pinned one
       (swank.overrideAttrs (final: prev: {
         src = pkgs.fetchFromGitHub {
           owner = "slime";
@@ -472,8 +473,8 @@ let
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "nyxt";
-      rev = "3.11.4";
-      hash = "sha256-5LhpcuQTioOXZtzwN9B1vWo/xsYXxn9fSKRCdhSPM7A=";
+      rev = "3.11.5";
+      hash = "sha256-l3igC4jfCvx7Q0WO2Zf2ByWLz7sCteYdW1rNvwrc97g=";
     };
 
     nativeBuildInputs = [ pkgs.makeWrapper ];
diff --git a/pkgs/development/python-modules/aiocurrencylayer/default.nix b/pkgs/development/python-modules/aiocurrencylayer/default.nix
index 39fb1deeb9b3..427992c58823 100644
--- a/pkgs/development/python-modules/aiocurrencylayer/default.nix
+++ b/pkgs/development/python-modules/aiocurrencylayer/default.nix
@@ -11,16 +11,16 @@
 
 buildPythonPackage rec {
   pname = "aiocurrencylayer";
-  version = "1.0.5";
-  format = "pyproject";
+  version = "1.0.6";
+  pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "home-assistant-ecosystem";
-    repo = pname;
+    repo = "aiocurrencylayer";
     rev = "refs/tags/${version}";
-    hash = "sha256-468OBQV7ISnPRUfi/CM3dCh1ez0jwSVnM6DduPvAgPI=";
+    hash = "sha256-VOzgWN+dDPaGEcahFPSWjBR989b9eNkx4zcnI9o2Xiw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/app-model/default.nix b/pkgs/development/python-modules/app-model/default.nix
index 014fa13d6e2d..a3af5ba33b86 100644
--- a/pkgs/development/python-modules/app-model/default.nix
+++ b/pkgs/development/python-modules/app-model/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "app-model";
-  version = "0.2.4";
+  version = "0.2.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pyapp-kit";
     repo = "app-model";
     rev = "refs/tags/v${version}";
-    hash = "sha256-idie99ditHJG/6rv97LDaF71iTjjgJyhLiTrbkQmbts=";
+    hash = "sha256-lnsaplJJk+c0hdHyQPH98ssppxBXqj/O0K6xlRfk+Oc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/diffusers/default.nix b/pkgs/development/python-modules/diffusers/default.nix
index fe5b9a04b273..4580f8b10ab7 100644
--- a/pkgs/development/python-modules/diffusers/default.nix
+++ b/pkgs/development/python-modules/diffusers/default.nix
@@ -39,7 +39,7 @@
 
 buildPythonPackage rec {
   pname = "diffusers";
-  version = "0.27.0";
+  version = "0.27.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -48,7 +48,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "diffusers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-h7IdukvQr+B/Au70nK0Qc4FpkDiCMsIZuPAWsiCdnUo=";
+    hash = "sha256-GwFibsxMhWqirFn5cG9GfDZAtVWRx+BCqDBiQV6wuYU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index fd197f9305d6..83fd0bbb6908 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -14,7 +14,7 @@
 }:
 
 buildPythonPackage rec {
-  inherit (duckdb) patches pname src version;
+  inherit (duckdb) patches pname rev src version;
   pyproject = true;
 
   postPatch = (duckdb.postPatch or "") + ''
@@ -31,8 +31,11 @@ buildPythonPackage rec {
   env = {
     BUILD_HTTPFS = 1;
     DUCKDB_BUILD_UNITY = 1;
+    OVERRIDE_GIT_DESCRIBE="v${version}-0-g${rev}";
   };
 
+  dontPretendSetuptoolsSCMVersion = true;
+
   nativeBuildInputs = [
     pybind11
     setuptools-scm
diff --git a/pkgs/development/python-modules/durus/default.nix b/pkgs/development/python-modules/durus/default.nix
index 096007c97b21..43884551c731 100644
--- a/pkgs/development/python-modules/durus/default.nix
+++ b/pkgs/development/python-modules/durus/default.nix
@@ -1,11 +1,12 @@
 { stdenv, lib, buildPythonPackage, fetchPypi }:
 
 buildPythonPackage rec {
-  pname = "Durus";
+  pname = "durus";
   version = "4.2";
 
   src = fetchPypi {
-    inherit version pname;
+    pname = "Durus";
+    inherit version;
     sha256 = "sha256:1gzxg43zawwgqjrfixvcrilwpikb1ix9b7710rsl5ffk7q50yi3c";
   };
 
diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security-too/default.nix
index 060d8bd549de..e922b3d54341 100644
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@@ -3,7 +3,6 @@
 , fetchPypi
 , pythonOlder
 , setuptools
-, fetchpatch
 
 # extras: babel
 , babel
@@ -43,13 +42,12 @@
 , peewee
 , pony
 , pytestCheckHook
-, python-dateutil
 , zxcvbn
 }:
 
 buildPythonPackage rec {
   pname = "flask-security-too";
-  version = "5.4.1";
+  version = "5.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -57,7 +55,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Flask-Security-Too";
     inherit version;
-    hash = "sha256-Ay7+gk+zuUlXtw0LDdsnvSa22z+yE6VR1guu9QmiFvw=";
+    hash = "sha256-dzVHHC5Lsh6rUC+cOyNEe/uHVTzkObhFffgSvFOfKoI=";
   };
 
   nativeBuildInputs = [
@@ -106,8 +104,8 @@ buildPythonPackage rec {
     peewee
     pony
     pytestCheckHook
-    python-dateutil
     zxcvbn
+    freezegun
   ]
   ++ passthru.optional-dependencies.babel
   ++ passthru.optional-dependencies.common
diff --git a/pkgs/development/python-modules/frozenlist2/default.nix b/pkgs/development/python-modules/frozenlist2/default.nix
new file mode 100644
index 000000000000..2cbac731c577
--- /dev/null
+++ b/pkgs/development/python-modules/frozenlist2/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "frozenlist2";
+  version = "1.0.0";
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "rohanpm";
+    repo = "frozenlist2";
+    rev = "v${version}";
+    hash = "sha256-fF0oFZ2q1wRH7IKBlCjm3Za4xtEMSHyEaGL09rHgtTY=";
+  };
+
+  propagatedBuildInputs = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [ "frozenlist2" ];
+
+  meta = with lib; {
+    description = "An immutable list for Python";
+    homepage = "https://github.com/rohanpm/frozenlist2";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ t4ccer ];
+  };
+}
diff --git a/pkgs/development/python-modules/graphlib-backport/default.nix b/pkgs/development/python-modules/graphlib-backport/default.nix
new file mode 100644
index 000000000000..54d166a88ba2
--- /dev/null
+++ b/pkgs/development/python-modules/graphlib-backport/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, setuptools
+, poetry-core
+}:
+
+buildPythonPackage rec {
+  pname = "graphlib-backport";
+  version = "1.1.0";
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "mariushelf";
+    repo = "graphlib_backport";
+    rev = version;
+    hash = "sha256-ssJLtBQH8sSnccgcAKLKfYpPyw5U0RIm1F66/Er81lo=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml        \
+      --replace 'poetry>=1.0' 'poetry-core' \
+      --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
+  '';
+
+  propagatedBuildInputs = [
+    setuptools
+    poetry-core
+  ];
+
+  pythonImportsCheck = [ "graphlib" ];
+
+  meta = with lib; {
+    description = "Backport of the Python 3.9 graphlib module for Python 3.6+";
+    homepage = "https://github.com/mariushelf/graphlib_backport";
+    license = licenses.psfl;
+    maintainers = with maintainers; [ t4ccer ];
+  };
+}
diff --git a/pkgs/development/python-modules/greatfet/default.nix b/pkgs/development/python-modules/greatfet/default.nix
index 7859d2f4c087..7f7c53f70ea3 100644
--- a/pkgs/development/python-modules/greatfet/default.nix
+++ b/pkgs/development/python-modules/greatfet/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub, buildPythonPackage, isPy3k, future, pyusb, ipython, pygreat }:
 
 buildPythonPackage rec {
-  pname = "GreatFET";
+  pname = "greatfet";
   version = "2019.5.1.dev0";
 
   src = fetchFromGitHub {
@@ -30,5 +30,3 @@ buildPythonPackage rec {
     maintainers = with lib.maintainers; [ mog ];
   };
 }
-
-
diff --git a/pkgs/development/python-modules/in-n-out/default.nix b/pkgs/development/python-modules/in-n-out/default.nix
index b35e4588a4dd..39c7a3f7de88 100644
--- a/pkgs/development/python-modules/in-n-out/default.nix
+++ b/pkgs/development/python-modules/in-n-out/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "in-n-out";
-  version = "0.1.9";
+  version = "0.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "in_n_out";
     inherit version;
-    hash = "sha256-if65ROQg+vQtPCVCFFaBtNVxRDVZMsK4WWlfzcT5oto=";
+    hash = "sha256-hKJb2/DKl2Dd+rgndujNJWddriHKDpVuIKwOcwL8oZ8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/opensfm/default.nix b/pkgs/development/python-modules/opensfm/default.nix
index 2c9c57500ecb..674ec572e140 100644
--- a/pkgs/development/python-modules/opensfm/default.nix
+++ b/pkgs/development/python-modules/opensfm/default.nix
@@ -43,12 +43,12 @@ let
     else ceres-solver;
 in
 buildPythonPackage rec {
-  pname = "OpenSfM";
+  pname = "opensfm";
   version = "unstable-2023-12-09";
 
   src = fetchFromGitHub {
     owner = "mapillary";
-    repo = pname;
+    repo = "OpenSfM";
     rev = "7f170d0dc352340295ff480378e3ac37d0179f8e";
     sha256 = "sha256-l/HTVenC+L+GpMNnDgnSGZ7+Qd2j8b8cuTs3SmORqrg=";
   };
diff --git a/pkgs/development/python-modules/pluthon/default.nix b/pkgs/development/python-modules/pluthon/default.nix
new file mode 100644
index 000000000000..51f73a7381c6
--- /dev/null
+++ b/pkgs/development/python-modules/pluthon/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, setuptools
+, pythonOlder
+# Python deps
+, uplc
+, graphlib-backport
+, ordered-set
+}:
+
+buildPythonPackage rec {
+  pname = "pluthon";
+  version = "0.4.6";
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "OpShin";
+    repo = "pluthon";
+    rev = version;
+    hash = "sha256-ZmBkbglSbBfVhA4yP0tJdwpJiFpJ7vX0A321ldQF0lA=";
+  };
+
+  propagatedBuildInputs = [
+    setuptools
+    uplc
+    ordered-set
+  ] ++ lib.optionals (pythonOlder "3.9") graphlib-backport;
+
+  pythonImportsCheck = [ "pluthon" ];
+
+  meta = with lib; {
+    description = "Pluto-like programming language for Cardano Smart Contracts in Python";
+    homepage = "https://github.com/OpShin/pluthon";
+    license = licenses.mit;
+    maintainers = with maintainers; [ t4ccer ];
+  };
+}
diff --git a/pkgs/development/python-modules/pycardano/default.nix b/pkgs/development/python-modules/pycardano/default.nix
index 118e4ed66b5e..75bef6723d5d 100644
--- a/pkgs/development/python-modules/pycardano/default.nix
+++ b/pkgs/development/python-modules/pycardano/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonRelaxDepsHook
 # Python deps
 , blockfrost-python
 , cachetools
@@ -41,6 +42,10 @@ in buildPythonPackage rec {
     hash = "sha256-LP/W8IC2del476fGFq10VMWwMrbAoCCcZOngA8unBM0=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
   propagatedBuildInputs = [
     blockfrost-python
     cachetools
@@ -58,6 +63,8 @@ in buildPythonPackage rec {
     websocket-client
   ];
 
+  pythonRelaxDeps = [ "typeguard" ];
+
   pythonImportsCheck = [ "pycardano" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/python-secp256k1-cardano/default.nix b/pkgs/development/python-modules/python-secp256k1-cardano/default.nix
new file mode 100644
index 000000000000..d5becf5d8626
--- /dev/null
+++ b/pkgs/development/python-modules/python-secp256k1-cardano/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, fetchFromGitHub
+, python3
+, pkg-config
+}:
+
+python3.pkgs.buildPythonPackage {
+  pname = "python-secp256k1-cardano";
+  version = "0.2.3";
+
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "OpShin";
+    repo = "python-secp256k1";
+    rev = "5a8f761a4b9a1594653cc4deebadc3398b07533c"; # No tags in repo
+    hash = "sha256-6bE4/G2gW2F8h5FWtI3TZ6FtijsB/slvFT/SIVv7VIY=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  propagatedBuildInputs = with python3.pkgs; [ cffi secp256k1 ];
+
+  nativeCheckInputs = [ python3.pkgs.pytestCheckHook ];
+
+  # Tests expect .so files and are failing
+  doCheck = false;
+
+  preConfigure = ''
+    cp -r ${python3.pkgs.secp256k1.src} libsecp256k1
+    export INCLUDE_DIR=${python3.pkgs.secp256k1}/include
+    export LIB_DIR=${python3.pkgs.secp256k1}/lib
+  '';
+
+  meta = {
+    homepage = "https://github.com/OpShin/python-secp256k1";
+    description = "A fork of python-secp256k1, fixing the commit hash of libsecp256k1 to a Cardano compatible version";
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ t4ccer ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-stdnum/default.nix b/pkgs/development/python-modules/python-stdnum/default.nix
index f251b47c6086..d8bdc0574dc9 100644
--- a/pkgs/development/python-modules/python-stdnum/default.nix
+++ b/pkgs/development/python-modules/python-stdnum/default.nix
@@ -3,26 +3,31 @@
 , fetchPypi
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , zeep
 }:
 
 buildPythonPackage rec {
   pname = "python-stdnum";
-  version = "1.19";
-  format = "setuptools";
+  version = "1.20";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ez7IL1Y5DqdMGQVp6Y8vsUuGmAix1UeFcI8i0P6tiz8=";
+    hash = "sha256-rSos8usCXeQIIQI182tK4xJS3jGGJAzKqBJuEXy4JpA=";
   };
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace " --cov=stdnum --cov-report=term-missing:skip-covered --cov-report=html" ""
+      --replace-fail " --cov=stdnum --cov-report=term-missing:skip-covered --cov-report=html" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/sanic-auth/default.nix b/pkgs/development/python-modules/sanic-auth/default.nix
index 813df37a84e5..23b38820ff22 100644
--- a/pkgs/development/python-modules/sanic-auth/default.nix
+++ b/pkgs/development/python-modules/sanic-auth/default.nix
@@ -7,12 +7,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Sanic-Auth";
+  pname = "sanic-auth";
   version = "0.3.0";
   format = "setuptools";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Sanic-Auth";
+    inherit version;
     sha256 = "0dc24ynqjraqwgvyk0g9bj87zgpq4xnssl24hnsn7l5vlkmk8198";
   };
 
diff --git a/pkgs/development/python-modules/socksipy-branch/default.nix b/pkgs/development/python-modules/socksipy-branch/default.nix
index abfee3718b53..e9266bb27fe6 100644
--- a/pkgs/development/python-modules/socksipy-branch/default.nix
+++ b/pkgs/development/python-modules/socksipy-branch/default.nix
@@ -4,11 +4,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "SocksiPy-branch";
+  pname = "socksipy-branch";
   version = "1.01";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "SocksiPy-branch";
+    inherit version;
     sha256 = "01l41v4g7fy9fzvinmjxy6zcbhgqaif8dhdqm4w90fwcw9h51a8p";
   };
 
diff --git a/pkgs/development/python-modules/torchmetrics/default.nix b/pkgs/development/python-modules/torchmetrics/default.nix
index 19885c488c5e..e5c05c6dd497 100644
--- a/pkgs/development/python-modules/torchmetrics/default.nix
+++ b/pkgs/development/python-modules/torchmetrics/default.nix
@@ -20,7 +20,7 @@
 
 let
   pname = "torchmetrics";
-  version = "1.3.1";
+  version = "1.3.2";
 in
 buildPythonPackage {
   inherit pname version;
@@ -32,7 +32,7 @@ buildPythonPackage {
     owner = "Lightning-AI";
     repo = "torchmetrics";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZFpLoF4t1ld2c3exX9H8AYG0XQM7MKmWe/I8XZmdrZw=";
+    hash = "sha256-0lverGF8HVlnwWmnCjScWoSfWPLZlMF2cHDG+uxNCCQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ufoprocessor/default.nix b/pkgs/development/python-modules/ufoprocessor/default.nix
index 540aadd90132..dda782897b8d 100644
--- a/pkgs/development/python-modules/ufoprocessor/default.nix
+++ b/pkgs/development/python-modules/ufoprocessor/default.nix
@@ -5,11 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "ufoProcessor";
+  pname = "ufoprocessor";
   version = "1.9.0";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "ufoProcessor";
+    inherit version;
     sha256 = "0ns11aamgavgsfj8qf5kq7dvzmgl0mhr1cbych2f075ipfdvva5s";
     extension = "zip";
   };
diff --git a/pkgs/development/python-modules/uplc/default.nix b/pkgs/development/python-modules/uplc/default.nix
new file mode 100644
index 000000000000..a3aa8d10e7ad
--- /dev/null
+++ b/pkgs/development/python-modules/uplc/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, pythonRelaxDepsHook
+# Python deps
+, frozenlist2
+, python-secp256k1-cardano
+, setuptools
+, poetry-core
+, frozendict
+, cbor2
+, rply
+, pycardano
+}:
+
+buildPythonPackage rec {
+  pname = "uplc";
+  version = "0.6.9";
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "OpShin";
+    repo = "uplc";
+    rev = version;
+    hash = "sha256-djJMNXijMVzMVzw8NZSe3YFRGyAPqdvr0P374Za5XkU=";
+  };
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = [
+    setuptools
+    poetry-core
+    frozendict
+    cbor2
+    frozenlist2
+    rply
+    pycardano
+    python-secp256k1-cardano
+  ];
+
+  pythonRelaxDeps = [ "pycardano" "rply" ];
+
+  pythonImportsCheck = [ "uplc" ];
+
+  meta = with lib; {
+    description = "Python implementation of untyped plutus language core";
+    homepage = "https://opshin.dev";
+    license = licenses.mit;
+    maintainers = with maintainers; [ t4ccer ];
+    mainProgram = "opshin";
+  };
+}
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index f433a398d6e3..45de779fcdaf 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -312,8 +312,8 @@ in
           cp -R ext/fast_mmaped_file_rs $out
         '';
       };
-      hash = if lib.versionAtLeast attrs.version "1.1.0"
-        then "sha256-tSyoCEBtMMkFfPynaMx8oc9bO7I+Pf6Y/f3Ld8uwlEE="
+      hash = if lib.versionAtLeast attrs.version "1.1.1"
+        then "sha256-RsN5XWX7Mj2ORccM0eczY+44WXsbXNTnJVcCMvnOATk="
         else "sha256-XuQZPbFWqPHlrJvllkvLl1FjKeoAUbi8oKDrS2rY1KM=";
     };
     nativeBuildInputs = [
diff --git a/pkgs/development/tools/earthly/default.nix b/pkgs/development/tools/earthly/default.nix
index 5845586a5b3e..0e3413043b54 100644
--- a/pkgs/development/tools/earthly/default.nix
+++ b/pkgs/development/tools/earthly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "earthly";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "earthly";
     repo = "earthly";
     rev = "v${version}";
-    hash = "sha256-vNgRI/LQZPILwYdIGk6BB+Yb36rEHv6kHZARq0+TF9Q=";
+    hash = "sha256-APmWF3RrUvXqfvs8MpOMeV3Q6N6GRJXd/sTd9EmIGnQ=";
   };
 
-  vendorHash = "sha256-14aaGrEJBdSo1hZf37xUO2S/q6YlaSqJuQCzP/PVkr8=";
+  vendorHash = "sha256-cdq0gbaTY7IXSoqZcxqkN5in5xtZZTaP0MQRypqJoCU=";
   subPackages = [ "cmd/earthly" "cmd/debugger" ];
 
   CGO_ENABLED = 0;
diff --git a/pkgs/development/tools/goconvey/default.nix b/pkgs/development/tools/goconvey/default.nix
index 66b913c1d642..0ec9afb6101c 100644
--- a/pkgs/development/tools/goconvey/default.nix
+++ b/pkgs/development/tools/goconvey/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "goconvey";
-  version = "1.8.1";
+  version = "1.8.1-unstable-2024-03-06";
 
   excludedPackages = "web/server/watch/integration_testing";
 
   src = fetchFromGitHub {
     owner = "smartystreets";
     repo = "goconvey";
-    rev = "v${version}";
-    hash = "sha256-6SrlPsOqRxNNwEYx2t1v+rEHnQ58GvJtjo87SZo/Omk=";
+    rev = "a50310f1e3e53e63e2d23eb904f853aa388a5988";
+    hash = "sha256-w5eX/n6Wu2gYgCIhgtjqH3lNckWIDaN4r80cJW3JqFo=";
   };
 
-  vendorHash = "sha256-020bxa0LErrvRKe3HirCWZDaBQFfKsWgl4mxfLtl1lg=";
+  vendorHash = "sha256-P4J/CZY95ks08DC+gSqG+eanL3zoiaoz1d9/ZvBoc9Q=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/development/tools/gomacro/default.nix b/pkgs/development/tools/gomacro/default.nix
index 0317f40712eb..1b2a45da7a42 100644
--- a/pkgs/development/tools/gomacro/default.nix
+++ b/pkgs/development/tools/gomacro/default.nix
@@ -2,17 +2,16 @@
 
 buildGoModule rec {
   pname = "gomacro";
-  rev = "b4c3ab9b218fd12f22759354f4f3e37635828d1f";
-  version = "20210131-${lib.strings.substring 0 7 rev}";
+  version = "2.7-unstable-2024-01-07";
 
   src = fetchFromGitHub {
     owner = "cosmos72";
     repo = "gomacro";
-    inherit rev;
-    hash = "sha256-zxiEt/RR7g5Q0wMLuRaybnT5dFfPCyvt0PvDjL9BJDI=";
+    rev = "bf232d031933810d4a5382e17ce6c4b042a24304";
+    hash = "sha256-16u3eByFmnY12M2CEhSJKLIT0KP9nbvTv+BnqWwNTcg=";
   };
 
-  vendorHash = "sha256-fQYuav0pT+/fGq0fmOWlsiVxA9tGV4JV8X7G3E6BZMU=";
+  vendorHash = "sha256-ok71QlBHGasGVt+CGwGqhgmx5JLkQcdlU/KX+W1A5Ws=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/tools/semantic-release/default.nix b/pkgs/development/tools/semantic-release/default.nix
index 51d692ecb693..7f55da0e2ff7 100644
--- a/pkgs/development/tools/semantic-release/default.nix
+++ b/pkgs/development/tools/semantic-release/default.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "semantic-release";
-  version = "23.0.3";
+  version = "23.0.5";
 
   src = fetchFromGitHub {
     owner = "semantic-release";
     repo = "semantic-release";
     rev = "v${version}";
-    hash = "sha256-Oi0WlGcgVx/ykp6laR20RosF+1P3jAEXBS1F43KGsUM=";
+    hash = "sha256-/VOa/V6kly92JjhW5a0b9xNdxVYCPYRJx5IiwmQ2d1U=";
   };
 
-  npmDepsHash = "sha256-fPONvfJK4cnKG6qYHh8WRN1ZCcIZxe2PVaXuMGHFB3Y=";
+  npmDepsHash = "sha256-CG2LcIAfX5dfJz0oSMwt83ra804U/qLpnNDilSEgRSI=";
 
   dontNpmBuild = true;