Merge master into staging-next

11 files changed, 266 insertions, 159 deletions

diff --git a/pkgs/development/interpreters/elixir/generic-builder.nix b/pkgs/development/interpreters/elixir/generic-builder.nix
index 9007ab12d754..348d054a6c77 100644
--- a/pkgs/development/interpreters/elixir/generic-builder.nix
+++ b/pkgs/development/interpreters/elixir/generic-builder.nix
@@ -20,7 +20,7 @@
 } @ args:
 
 let
-  inherit (lib) getVersion versionAtLeast optional;
+  inherit (lib) getVersion versionAtLeast optional concatStringsSep;
 
 in
 assert versionAtLeast (getVersion erlang) minimumOTPVersion;
@@ -36,7 +36,12 @@ stdenv.mkDerivation ({
   LANG = "C.UTF-8";
   LC_TYPE = "C.UTF-8";
 
-  buildFlags = optional debugInfo "ERL_COMPILER_OPTIONS=debug_info";
+  ERLC_OPTS =
+    let
+      erlc_opts = [ "deterministic" ]
+        ++ optional debugInfo "debug_info";
+    in
+    "[${concatStringsSep "," erlc_opts}]";
 
   preBuild = ''
     patchShebangs ${escriptPath} || true
diff --git a/pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py b/pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py
index 970da7c5c5a4..d9b539926b83 100755
--- a/pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py
+++ b/pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py
@@ -12,23 +12,24 @@ to update all non-pinned libraries in that folder.
 """
 
 import argparse
+import collections
 import json
 import logging
 import os
 import re
-import requests
+import subprocess
 from concurrent.futures import ThreadPoolExecutor as Pool
-from packaging.version import Version as _Version
-from packaging.version import InvalidVersion
+from typing import Any, Optional
+
+import requests
 from packaging.specifiers import SpecifierSet
-from typing import Optional, Any
-import collections
-import subprocess
+from packaging.version import InvalidVersion
+from packaging.version import Version as _Version
 
 INDEX = "https://pypi.io/pypi"
 """url of PyPI"""
 
-EXTENSIONS = ['tar.gz', 'tar.bz2', 'tar', 'zip', '.whl']
+EXTENSIONS = ["tar.gz", "tar.bz2", "tar", "zip", ".whl"]
 """Permitted file extensions. These are evaluated from left to right and the first occurance is returned."""
 
 PRERELEASES = False
@@ -37,13 +38,16 @@ BULK_UPDATE = False
 
 GIT = "git"
 
-NIXPKGS_ROOT = subprocess.check_output(["git", "rev-parse", "--show-toplevel"]).decode('utf-8').strip()
+NIXPKGS_ROOT = (
+    subprocess.check_output(["git", "rev-parse", "--show-toplevel"])
+    .decode("utf-8")
+    .strip()
+)
 
 logging.basicConfig(level=logging.INFO)
 
 
 class Version(_Version, collections.abc.Sequence):
-
     def __init__(self, version):
         super().__init__(version)
         # We cannot use `str(Version(0.04.21))` because that becomes `0.4.21`
@@ -65,7 +69,7 @@ def _get_values(attribute, text):
 
     :returns: List of matches.
     """
-    regex = fr'{re.escape(attribute)}\s+=\s+"(.*)";'
+    regex = rf'{re.escape(attribute)}\s+=\s+"(.*)";'
     regex = re.compile(regex)
     values = regex.findall(text)
     return values
@@ -73,14 +77,19 @@ def _get_values(attribute, text):
 
 def _get_attr_value(attr_path: str) -> Optional[Any]:
     try:
-        response = subprocess.check_output([
-            "nix",
-            "--extra-experimental-features", "nix-command",
-            "eval",
-            "-f", f"{NIXPKGS_ROOT}/default.nix",
-            "--json",
-            f"{attr_path}"
-        ])
+        response = subprocess.check_output(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command",
+                "eval",
+                "-f",
+                f"{NIXPKGS_ROOT}/default.nix",
+                "--json",
+                f"{attr_path}",
+            ],
+            stderr=subprocess.DEVNULL,
+        )
         return json.loads(response.decode())
     except (subprocess.CalledProcessError, ValueError):
         return None
@@ -100,12 +109,13 @@ def _get_unique_value(attribute, text):
     else:
         raise ValueError("no value found for {}".format(attribute))
 
+
 def _get_line_and_value(attribute, text, value=None):
     """Match attribute in text. Return the line and the value of the attribute."""
     if value is None:
-        regex = rf'({re.escape(attribute)}\s+=\s+\"(.*)\";)'
+        regex = rf"({re.escape(attribute)}\s+=\s+\"(.*)\";)"
     else:
-        regex = rf'({re.escape(attribute)}\s+=\s+\"({re.escape(value)})\";)'
+        regex = rf"({re.escape(attribute)}\s+=\s+\"({re.escape(value)})\";)"
     regex = re.compile(regex)
     results = regex.findall(text)
     n = len(results)
@@ -138,7 +148,7 @@ def _fetch_page(url):
 
 def _fetch_github(url):
     headers = {}
-    token = os.environ.get('GITHUB_API_TOKEN')
+    token = os.environ.get("GITHUB_API_TOKEN")
     if token:
         headers["Authorization"] = f"token {token}"
     r = requests.get(url, headers=headers)
@@ -151,31 +161,26 @@ def _fetch_github(url):
 
 def _hash_to_sri(algorithm, value):
     """Convert a hash to its SRI representation"""
-    return subprocess.check_output([
-        "nix",
-        "hash",
-        "to-sri",
-        "--type", algorithm,
-        value
-    ]).decode().strip()
+    return (
+        subprocess.check_output(["nix", "hash", "to-sri", "--type", algorithm, value])
+        .decode()
+        .strip()
+    )
 
 
 def _skip_bulk_update(attr_name: str) -> bool:
-    return bool(_get_attr_value(
-        f"{attr_name}.skipBulkUpdate"
-    ))
+    return bool(_get_attr_value(f"{attr_name}.skipBulkUpdate"))
 
 
 SEMVER = {
-    'major' : 0,
-    'minor' : 1,
-    'patch' : 2,
+    "major": 0,
+    "minor": 1,
+    "patch": 2,
 }
 
 
 def _determine_latest_version(current_version, target, versions):
-    """Determine latest version, given `target`.
-    """
+    """Determine latest version, given `target`."""
     current_version = Version(current_version)
 
     def _parse_versions(versions):
@@ -193,7 +198,7 @@ def _determine_latest_version(current_version, target, versions):
     if len(ceiling) == 0:
         ceiling = None
     else:
-        ceiling[-1]+=1
+        ceiling[-1] += 1
         ceiling = Version(".".join(map(str, ceiling)))
 
     # We do not want prereleases
@@ -210,17 +215,19 @@ def _get_latest_version_pypi(package, extension, current_version, target):
     url = "{}/{}/json".format(INDEX, package)
     json = _fetch_page(url)
 
-    versions = json['releases'].keys()
+    versions = json["releases"].keys()
     version = _determine_latest_version(current_version, target, versions)
 
     try:
-        releases = json['releases'][version]
+        releases = json["releases"][version]
     except KeyError as e:
-        raise KeyError('Could not find version {} for {}'.format(version, package)) from e
+        raise KeyError(
+            "Could not find version {} for {}".format(version, package)
+        ) from e
     for release in releases:
-        if release['filename'].endswith(extension):
+        if release["filename"].endswith(extension):
             # TODO: In case of wheel we need to do further checks!
-            sha256 = release['digests']['sha256']
+            sha256 = release["digests"]["sha256"]
             break
     else:
         sha256 = None
@@ -240,33 +247,40 @@ def _get_latest_version_github(package, extension, current_version, target):
     attr_path = os.environ.get("UPDATE_NIX_ATTR_PATH", f"python3Packages.{package}")
     try:
         homepage = subprocess.check_output(
-            ["nix", "eval", "-f", f"{NIXPKGS_ROOT}/default.nix", "--raw", f"{attr_path}.src.meta.homepage"])\
-            .decode('utf-8')
+            [
+                "nix",
+                "eval",
+                "-f",
+                f"{NIXPKGS_ROOT}/default.nix",
+                "--raw",
+                f"{attr_path}.src.meta.homepage",
+            ]
+        ).decode("utf-8")
     except Exception as e:
         raise ValueError(f"Unable to determine homepage: {e}")
-    owner_repo = homepage[len("https://github.com/"):]  # remove prefix
+    owner_repo = homepage[len("https://github.com/") :]  # remove prefix
     owner, repo = owner_repo.split("/")
 
     url = f"https://api.github.com/repos/{owner}/{repo}/releases"
     all_releases = _fetch_github(url)
-    releases = list(filter(lambda x: not x['prerelease'], all_releases))
+    releases = list(filter(lambda x: not x["prerelease"], all_releases))
 
     if len(releases) == 0:
         raise ValueError(f"{homepage} does not contain any stable releases")
 
-    versions = map(lambda x: strip_prefix(x['tag_name']), releases)
+    versions = map(lambda x: strip_prefix(x["tag_name"]), releases)
     version = _determine_latest_version(current_version, target, versions)
 
-    release = next(filter(lambda x: strip_prefix(x['tag_name']) == version, releases))
-    prefix = get_prefix(release['tag_name'])
+    release = next(filter(lambda x: strip_prefix(x["tag_name"]) == version, releases))
+    prefix = get_prefix(release["tag_name"])
 
     # some attributes require using the fetchgit
     git_fetcher_args = []
-    if (_get_attr_value(f"{attr_path}.src.fetchSubmodules")):
+    if _get_attr_value(f"{attr_path}.src.fetchSubmodules"):
         git_fetcher_args.append("--fetch-submodules")
-    if (_get_attr_value(f"{attr_path}.src.fetchLFS")):
+    if _get_attr_value(f"{attr_path}.src.fetchLFS"):
         git_fetcher_args.append("--fetch-lfs")
-    if (_get_attr_value(f"{attr_path}.src.leaveDotGit")):
+    if _get_attr_value(f"{attr_path}.src.leaveDotGit"):
         git_fetcher_args.append("--leave-dotGit")
 
     if git_fetcher_args:
@@ -274,8 +288,10 @@ def _get_latest_version_github(package, extension, current_version, target):
         cmd = [
             "nix-prefetch-git",
             f"https://github.com/{owner}/{repo}.git",
-            "--hash", algorithm,
-            "--rev", f"refs/tags/{release['tag_name']}"
+            "--hash",
+            algorithm,
+            "--rev",
+            f"refs/tags/{release['tag_name']}",
         ]
         cmd.extend(git_fetcher_args)
         response = subprocess.check_output(cmd)
@@ -283,45 +299,60 @@ def _get_latest_version_github(package, extension, current_version, target):
         hash = _hash_to_sri(algorithm, document[algorithm])
     else:
         try:
-            hash = subprocess.check_output([
-                "nix-prefetch-url",
-                "--type", "sha256",
-                "--unpack",
-                f"{release['tarball_url']}"
-            ], stderr=subprocess.DEVNULL).decode('utf-8').strip()
+            hash = (
+                subprocess.check_output(
+                    [
+                        "nix-prefetch-url",
+                        "--type",
+                        "sha256",
+                        "--unpack",
+                        f"{release['tarball_url']}",
+                    ],
+                    stderr=subprocess.DEVNULL,
+                )
+                .decode("utf-8")
+                .strip()
+            )
         except (subprocess.CalledProcessError, UnicodeError):
             # this may fail if they have both a branch and a tag of the same name, attempt tag name
-            tag_url = str(release['tarball_url']).replace("tarball","tarball/refs/tags")
-            hash = subprocess.check_output([
-                "nix-prefetch-url",
-                "--type", "sha256",
-                "--unpack",
-                tag_url
-            ], stderr=subprocess.DEVNULL).decode('utf-8').strip()
+            tag_url = str(release["tarball_url"]).replace(
+                "tarball", "tarball/refs/tags"
+            )
+            hash = (
+                subprocess.check_output(
+                    ["nix-prefetch-url", "--type", "sha256", "--unpack", tag_url],
+                    stderr=subprocess.DEVNULL,
+                )
+                .decode("utf-8")
+                .strip()
+            )
 
     return version, hash, prefix
 
 
 FETCHERS = {
-    'fetchFromGitHub'   :   _get_latest_version_github,
-    'fetchPypi'         :   _get_latest_version_pypi,
-    'fetchurl'          :   _get_latest_version_pypi,
+    "fetchFromGitHub": _get_latest_version_github,
+    "fetchPypi": _get_latest_version_pypi,
+    "fetchurl": _get_latest_version_pypi,
 }
 
 
-DEFAULT_SETUPTOOLS_EXTENSION = 'tar.gz'
+DEFAULT_SETUPTOOLS_EXTENSION = "tar.gz"
 
 
 FORMATS = {
-    'setuptools'        :   DEFAULT_SETUPTOOLS_EXTENSION,
-    'wheel'             :   'whl',
-    'pyproject'         :   'tar.gz',
-    'flit'              :   'tar.gz'
+    "setuptools": DEFAULT_SETUPTOOLS_EXTENSION,
+    "wheel": "whl",
+    "pyproject": "tar.gz",
+    "flit": "tar.gz",
 }
 
+
 def _determine_fetcher(text):
     # Count occurrences of fetchers.
-    nfetchers = sum(text.count('src = {}'.format(fetcher)) for fetcher in FETCHERS.keys())
+    nfetchers = sum(
+        text.count("src = {}".format(fetcher)) for fetcher in FETCHERS.keys()
+    )
     if nfetchers == 0:
         raise ValueError("no fetcher.")
     elif nfetchers > 1:
@@ -329,7 +360,7 @@ def _determine_fetcher(text):
     else:
         # Then we check which fetcher to use.
         for fetcher in FETCHERS.keys():
-            if 'src = {}'.format(fetcher) in text:
+            if "src = {}".format(fetcher) in text:
                 return fetcher
 
 
@@ -341,47 +372,46 @@ def _determine_extension(text, fetcher):
     - fetchurl, we determine the extension from the url.
     - fetchFromGitHub we simply use `.tar.gz`.
     """
-    if fetcher == 'fetchPypi':
+    if fetcher == "fetchPypi":
         try:
-            src_format = _get_unique_value('format', text)
+            src_format = _get_unique_value("format", text)
         except ValueError:
-            src_format = None   # format was not given
+            src_format = None  # format was not given
 
         try:
-            extension = _get_unique_value('extension', text)
+            extension = _get_unique_value("extension", text)
         except ValueError:
-            extension = None    # extension was not given
+            extension = None  # extension was not given
 
         if extension is None:
             if src_format is None:
-                src_format = 'setuptools'
-            elif src_format == 'other':
+                src_format = "setuptools"
+            elif src_format == "other":
                 raise ValueError("Don't know how to update a format='other' package.")
             extension = FORMATS[src_format]
 
-    elif fetcher == 'fetchurl':
-        url = _get_unique_value('url', text)
+    elif fetcher == "fetchurl":
+        url = _get_unique_value("url", text)
         extension = os.path.splitext(url)[1]
-        if 'pypi' not in url:
-            raise ValueError('url does not point to PyPI.')
+        if "pypi" not in url:
+            raise ValueError("url does not point to PyPI.")
 
-    elif fetcher == 'fetchFromGitHub':
+    elif fetcher == "fetchFromGitHub":
         extension = "tar.gz"
 
     return extension
 
 
 def _update_package(path, target):
-
     # Read the expression
-    with open(path, 'r') as f:
+    with open(path, "r") as f:
         text = f.read()
 
     # Determine pname. Many files have more than one pname
-    pnames = _get_values('pname', text)
+    pnames = _get_values("pname", text)
 
     # Determine version.
-    version = _get_unique_value('version', text)
+    version = _get_unique_value("version", text)
 
     # First we check how many fetchers are mentioned.
     fetcher = _determine_fetcher(text)
@@ -393,8 +423,12 @@ def _update_package(path, target):
     for pname in pnames:
         if BULK_UPDATE and _skip_bulk_update(f"python3Packages.{pname}"):
             raise ValueError(f"Bulk update skipped for {pname}")
+        elif _get_attr_value(f"python3Packages.{pname}.cargoDeps") is not None:
+            raise ValueError(f"Cargo dependencies are unsupported, skipping {pname}")
         try:
-            new_version, new_sha256, prefix = FETCHERS[fetcher](pname, extension, version, target)
+            new_version, new_sha256, prefix = FETCHERS[fetcher](
+                pname, extension, version, target
+            )
             successful_fetch = True
             break
         except ValueError:
@@ -411,7 +445,7 @@ def _update_package(path, target):
     if not new_sha256:
         raise ValueError("no file available for {}.".format(pname))
 
-    text = _replace_value('version', new_version, text)
+    text = _replace_value("version", new_version, text)
 
     # hashes from pypi are 16-bit encoded sha256's, normalize it to sri to avoid merge conflicts
     # sri hashes have been the default format since nix 2.4+
@@ -421,16 +455,16 @@ def _update_package(path, target):
     if old_hash := _get_attr_value(f"python3Packages.{pname}.src.outputHash"):
         # fetchers can specify a sha256, or a sri hash
         try:
-            text = _replace_value('hash', sri_hash, text, old_hash)
+            text = _replace_value("hash", sri_hash, text, old_hash)
         except ValueError:
-            text = _replace_value('sha256', sri_hash, text, old_hash)
+            text = _replace_value("sha256", sri_hash, text, old_hash)
     else:
         raise ValueError(f"Unable to retrieve old hash for {pname}")
 
-    if fetcher == 'fetchFromGitHub':
+    if fetcher == "fetchFromGitHub":
         # in the case of fetchFromGitHub, it's common to see `rev = version;` or `rev = "v${version}";`
         # in which no string value is meant to be substituted. However, we can just overwrite the previous value.
-        regex = r'(rev\s+=\s+[^;]*;)'
+        regex = r"(rev\s+=\s+[^;]*;)"
         regex = re.compile(regex)
         matches = regex.findall(text)
         n = len(matches)
@@ -442,30 +476,33 @@ def _update_package(path, target):
             match = matches[0]
             text = text.replace(match, f'rev = "refs/tags/{prefix}${{version}}";')
             # incase there's no prefix, just rewrite without interpolation
-            text = text.replace('"${version}";', 'version;')
+            text = text.replace('"${version}";', "version;")
 
-    with open(path, 'w') as f:
+    with open(path, "w") as f:
         f.write(text)
 
-        logging.info("Path {}: updated {} from {} to {}".format(path, pname, version, new_version))
+        logging.info(
+            "Path {}: updated {} from {} to {}".format(
+                path, pname, version, new_version
+            )
+        )
 
     result = {
-        'path'  : path,
-        'target': target,
-        'pname': pname,
-        'old_version'   : version,
-        'new_version'   : new_version,
+        "path": path,
+        "target": target,
+        "pname": pname,
+        "old_version": version,
+        "new_version": new_version,
         #'fetcher'       : fetcher,
-        }
+    }
 
     return result
 
 
 def _update(path, target):
-
     # We need to read and modify a Nix expression.
     if os.path.isdir(path):
-        path = os.path.join(path, 'default.nix')
+        path = os.path.join(path, "default.nix")
 
     # If a default.nix does not exist, we quit.
     if not os.path.isfile(path):
@@ -485,32 +522,41 @@ def _update(path, target):
 
 
 def _commit(path, pname, old_version, new_version, pkgs_prefix="python: ", **kwargs):
-    """Commit result.
-    """
+    """Commit result."""
+
+    msg = f"{pkgs_prefix}{pname}: {old_version} -> {new_version}"
 
-    msg = f'{pkgs_prefix}{pname}: {old_version} -> {new_version}'
+    if changelog := _get_attr_value(f"{pkgs_prefix}{pname}.meta.changelog"):
+        msg += f"\n\n{changelog}"
 
     try:
-        subprocess.check_call([GIT, 'add', path])
-        subprocess.check_call([GIT, 'commit', '-m', msg])
+        subprocess.check_call([GIT, "add", path])
+        subprocess.check_call([GIT, "commit", "-m", msg])
     except subprocess.CalledProcessError as e:
-        subprocess.check_call([GIT, 'checkout', path])
-        raise subprocess.CalledProcessError(f'Could not commit {path}') from e
+        subprocess.check_call([GIT, "checkout", path])
+        raise subprocess.CalledProcessError(f"Could not commit {path}") from e
 
     return True
 
 
 def main():
-
     epilog = """
 environment variables:
   GITHUB_API_TOKEN\tGitHub API token used when updating github packages
     """
-    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter, epilog=epilog)
-    parser.add_argument('package', type=str, nargs='+')
-    parser.add_argument('--target', type=str, choices=SEMVER.keys(), default='major')
-    parser.add_argument('--commit', action='store_true', help='Create a commit for each package update')
-    parser.add_argument('--use-pkgs-prefix', action='store_true', help='Use python3Packages.${pname}: instead of python: ${pname}: when making commits')
+    parser = argparse.ArgumentParser(
+        formatter_class=argparse.RawDescriptionHelpFormatter, epilog=epilog
+    )
+    parser.add_argument("package", type=str, nargs="+")
+    parser.add_argument("--target", type=str, choices=SEMVER.keys(), default="major")
+    parser.add_argument(
+        "--commit", action="store_true", help="Create a commit for each package update"
+    )
+    parser.add_argument(
+        "--use-pkgs-prefix",
+        action="store_true",
+        help="Use python3Packages.${pname}: instead of python: ${pname}: when making commits",
+    )
 
     args = parser.parse_args()
     target = args.target
@@ -545,6 +591,5 @@ environment variables:
     logging.info("{} package(s) updated".format(count))
 
 
-
-if __name__ == '__main__':
+if __name__ == "__main__":
     main()
diff --git a/pkgs/development/libraries/mlt/default.nix b/pkgs/development/libraries/mlt/default.nix
index ed803772f730..ded5a5990a60 100644
--- a/pkgs/development/libraries/mlt/default.nix
+++ b/pkgs/development/libraries/mlt/default.nix
@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlt";
-  version = "7.20.0";
+  version = "7.22.0";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "mlt";
     rev = "v${version}";
-    hash = "sha256-5yELGA3U/YkINEtRyr/tb3HjWMQjqKIWjUbH7ZFMgLU=";
+    hash = "sha256-vJKpeEdQIWBQRRdDui5ibSZtD8qUlDZBD+UQE+0cQqk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/tiledb/default.nix b/pkgs/development/libraries/tiledb/default.nix
index ae182ff46136..f8540d4ffaa0 100644
--- a/pkgs/development/libraries/tiledb/default.nix
+++ b/pkgs/development/libraries/tiledb/default.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "tiledb";
-  version = "2.18.0";
+  version = "2.18.2";
 
   src = fetchFromGitHub {
     owner = "TileDB-Inc";
     repo = "TileDB";
     rev = version;
-    hash = "sha256-y5/kXODzkNKmMn8P+WOOWGy9Htd0nhXbUxmfw/SqSYY=";
+    hash = "sha256-uLiXhigYz3v7NgY38twot3sBHxZS5QCrOiPfME4wWzE=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/black/default.nix b/pkgs/development/python-modules/black/default.nix
index 76890aeda286..52cc36e989cc 100644
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "black";
-  version = "23.9.1";
+  version = "23.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JLaz/1xtnqCKiIj2l36uhY4fNA1yYM9W1wpJgjI2ti0=";
+    hash = "sha256-TGiFWCX/Qy0ZcimEb5cbxNZmbOkEkuWwIBO8rKTZqwU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index 0ea8de9a4c7c..ed4f7a9162a7 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "5.0b1";
+  version = "5.0rc1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yIY15zPwoO9GwhljXiHI9ZeOsqFMORgiRlRUG8XVcDA=";
+    hash = "sha256-pLt3plnaAyt0GpXcuVeGTzaVJ10dWB73Y3IUMA+qrzA=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/fontawesomefree/default.nix b/pkgs/development/python-modules/fontawesomefree/default.nix
index 437259ff6d3e..dea884ab0b30 100644
--- a/pkgs/development/python-modules/fontawesomefree/default.nix
+++ b/pkgs/development/python-modules/fontawesomefree/default.nix
@@ -5,7 +5,7 @@
 
 buildPythonPackage rec {
   pname = "fontawesomefree";
-  version = "6.4.2";
+  version = "6.5.1";
   format = "wheel";
 
   # they only provide a wheel
@@ -13,7 +13,7 @@ buildPythonPackage rec {
     inherit pname version format;
     dist = "py3";
     python = "py3";
-    hash = "sha256-zq/378T8Odrf88P/cpinoQlUAxENNz8iRWuxw0q22wI=";
+    hash = "sha256-jexKLuN7+OUzeeu/DTjO/sTgbHySJ/Wa8527exYygXs=";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/glfw/default.nix b/pkgs/development/python-modules/glfw/default.nix
index db9f369a3497..d39daf9e9dc2 100644
--- a/pkgs/development/python-modules/glfw/default.nix
+++ b/pkgs/development/python-modules/glfw/default.nix
@@ -20,10 +20,8 @@ buildPythonPackage rec {
   };
 
   # Patch path to GLFW shared object
-  patches = [ ./search-path.patch ];
-
   postPatch = ''
-    substituteInPlace glfw/library.py --replace "@GLFW@" '${glfw3}/lib'
+    substituteInPlace glfw/library.py --replace "_get_library_search_paths()," "[ '${glfw3}/lib' ],"
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/glfw/search-path.patch b/pkgs/development/python-modules/glfw/search-path.patch
deleted file mode 100644
index 0c4a42ceb362..000000000000
--- a/pkgs/development/python-modules/glfw/search-path.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff --git a/glfw/library.py b/glfw/library.py
-index 20387e1..9bdd62a 100644
---- a/glfw/library.py
-+++ b/glfw/library.py
-@@ -189,5 +189,4 @@ elif sys.platform == 'win32':
-         except OSError:
-             pass
- else:
--    glfw = _load_library(['glfw', 'glfw3'], ['.so', '.dylib'],
--                          _get_library_search_paths(), _glfw_get_version)
-+    glfw = _load_library(['glfw', 'glfw3'], ['.so', '.dylib'], ['@GLFW@'], _glfw_get_version)
diff --git a/pkgs/development/python-modules/mujoco/default.nix b/pkgs/development/python-modules/mujoco/default.nix
new file mode 100644
index 000000000000..2392de3847bd
--- /dev/null
+++ b/pkgs/development/python-modules/mujoco/default.nix
@@ -0,0 +1,70 @@
+{ buildPythonPackage
+, cmake
+, fetchPypi
+, glfw
+, lib
+, mujoco
+, numpy
+, perl
+, pkgs
+, pybind11
+, python
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "mujoco";
+  version = "3.0.1";
+
+  pyproject = true;
+
+  # We do not fetch from the repository because the PyPi tarball is
+  # impurely build via
+  # <https://github.com/google-deepmind/mujoco/blob/main/python/make_sdist.sh>
+  # in the project's CI.
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-pftecOk4q19qKBHs9hBBVenI+SgJg9VT7vc6NKuiY0s=";
+  };
+
+  nativeBuildInputs = [ cmake setuptools ];
+  dontUseCmakeConfigure = true;
+  buildInputs = [ mujoco pybind11 ];
+  propagatedBuildInputs = [ glfw numpy ];
+
+  pythonImportsCheck = [ "${pname}" ];
+
+  env.MUJOCO_PATH = "${mujoco}";
+  env.MUJOCO_PLUGIN_PATH = "${mujoco}/lib";
+  env.MUJOCO_CMAKE_ARGS = "-DMUJOCO_SIMULATE_USE_SYSTEM_GLFW=ON";
+
+  preConfigure =
+    # Use system packages for pybind
+    ''
+      ${perl}/bin/perl -0777 -i -pe "s/(findorfetch\(.{3}USE_SYSTEM_PACKAGE.{3})(OFF)(.{3}PACKAGE_NAME.{3}pybind11.*\))/\1ON\3/gms" mujoco/CMakeLists.txt
+    '' +
+    # Use non-system eigen3, lodepng, abseil: Remove mirror info and prefill
+    # dependency directory. $build from setuptools.
+    (let
+      # E.g. 3.11.2 -> "311"
+      pythonVersionMajorMinor = with lib.versions;
+        "${major python.pythonVersion}${minor python.pythonVersion}";
+    in ''
+      ${perl}/bin/perl -0777 -i -pe "s/GIT_REPO\n.*\n.*GIT_TAG\n.*\n//gm" mujoco/CMakeLists.txt
+      ${perl}/bin/perl -0777 -i -pe "s/(FetchContent_Declare\(\n.*lodepng\n.*)(GIT_REPO.*\n.*GIT_TAG.*\n)(.*\))/\1\3/gm" mujoco/simulate/CMakeLists.txt
+
+      build="/build/${pname}-${version}/build/temp.linux-x86_64-cpython-${pythonVersionMajorMinor}/"
+      mkdir -p $build/_deps
+      ln -s ${mujoco.pin.lodepng} $build/_deps/lodepng-src
+      ln -s ${mujoco.pin.eigen3} $build/_deps/eigen-src
+      ln -s ${mujoco.pin.abseil-cpp} $build/_deps/abseil-cpp-src
+    '');
+
+  meta = with lib; {
+    description =
+      "Python bindings for MuJoCo: a general purpose physics simulator.";
+    homepage = "https://mujoco.org/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ tmplt ];
+  };
+}
diff --git a/pkgs/development/tools/fsautocomplete/deps.nix b/pkgs/development/tools/fsautocomplete/deps.nix
index fdd669cf90ab..b807457ad01e 100644
--- a/pkgs/development/tools/fsautocomplete/deps.nix
+++ b/pkgs/development/tools/fsautocomplete/deps.nix
@@ -78,9 +78,9 @@
   (fetchNuGet { pname = "McMaster.NETCore.Plugins"; version = "1.4.0"; sha256 = "1k2qz0qnf2b1kfwbzcynivy93jm7dcwl866d0fl7qlgq5vql7niy"; })
   (fetchNuGet { pname = "MessagePack"; version = "2.5.108"; sha256 = "0cnaz28lhrdmavnxjkakl9q8p2yv8mricvp1b0wxdfnz8v41gwzs"; })
   (fetchNuGet { pname = "MessagePack.Annotations"; version = "2.5.108"; sha256 = "0nb1fx8dwl7304kw0bc375bvlhb7pg351l4cl3vqqd7d8zqjwx5v"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "6.0.24"; sha256 = "0lriw4f48f0q2vyagbngnffshdismn3msn7d6dj0lb2xdkzsz1f1"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.24"; sha256 = "08670zhn2ywkwy0d7sj89rikxccy5qg0vsjwpbypvzndawng0bb9"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.24"; sha256 = "0knx6lhlqxn3lkgakpab0663788q0si00m9ga7wdn2mzqq0s9yx0"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "6.0.25"; sha256 = "1vrmqn5j6ibwkqasbf7x7n4w5jdclnz3giymiwvym2wa0y5zc59q"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.25"; sha256 = "0mgcs4si7mwd0f555s1vg17pf4nqfaijd1pci359l1pgrmv70rrg"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.25"; sha256 = "0wvzhqhlmlbnpa18qp8m3wcrlcgj3ckvp3iv2n7g8vb60c3238aq"; })
   (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "7.0.0"; sha256 = "1waiggh3g1cclc81gmjrqbh128kwfjky3z79ma4bd2ms9pa3gvfm"; })
   (fetchNuGet { pname = "Microsoft.Bcl.HashCode"; version = "1.1.0"; sha256 = "1ggsadahlp76zcn1plapszd5v5ja8rh479fwrahqd3knql4dfnr0"; })
   (fetchNuGet { pname = "Microsoft.Build"; version = "17.2.0"; sha256 = "09hs74nr0kv83wc1way9x7vq3nmxbr2s4vdy99hx78kj25pylcr7"; })
@@ -121,11 +121,11 @@
   (fetchNuGet { pname = "Microsoft.NET.StringTools"; version = "17.4.0"; sha256 = "1smx30nq22plrn2mw4wb5vfgxk6hyx12b60c4wabmpnr81lq3nzv"; })
   (fetchNuGet { pname = "Microsoft.NET.StringTools"; version = "17.6.3"; sha256 = "0g5jdg0jp844a2ygwlm04igsxkrihqcq2rpmfx722nrv3vrk0r0z"; })
   (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.4.1"; sha256 = "02p1j9fncd4fb2hyp51kw49d0dz30vvazhzk24c9f5ccc00ijpra"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "6.0.24"; sha256 = "1vyy01i4w2wcx82mrjjsbp98v9sjn1cwhdvkhrw8yrrb04lcxbir"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.24"; sha256 = "02l6javfqwsaialkimmpsq3v4dhb1j4sxy19yvr5w5sdjmq1jh5y"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "6.0.24"; sha256 = "1fy1hr14igy4lix4vmwkjj13cbyjjfhx8izch9cd9hc4f1y25767"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.24"; sha256 = "1zcn4px94z67j60cidynm5ab8cln1rrxabv7c24mlajqnkfw14sb"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.24"; sha256 = "0rylvdvdc5rdmw2vcqi0fdzmiwwa1pwlqiavqnb2pslhhq8qg4mh"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "6.0.25"; sha256 = "052388yjivzkfllkss0nljbzmjx787jqdjsbb6ls855sp6wh9xfd"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.25"; sha256 = "103xy6kncjwbbchfnpqvsjpjy92x3dralcg9pw939jp0dwggwarz"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "6.0.25"; sha256 = "0jfhmfxpx1h4f3axgf60gc8d4cnlvbb853400kag6nk0875hr0x1"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.25"; sha256 = "0jpcmva1l8z36r4phz055l7fz9s6z8pv8pqc4ia69mhhgvr0ks7y"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.25"; sha256 = "012jml0bqxbspahf1j4bvvd91pz85hsbcyhq00gxczcazhxpkhz4"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "7.0.4"; sha256 = "0afmivk3m0hmwsiqnl87frzi7g57aiv5fwnjds0icl66djpb6zsm"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "5.0.0"; sha256 = "0z3qyv7qal5irvabc8lmkh58zsl42mrzd1i0sssvzhv4q4kl3cg6"; })
   (fetchNuGet { pname = "Microsoft.NETFramework.ReferenceAssemblies"; version = "1.0.3"; sha256 = "0hc4d4d4358g5192mf8faijwk0bpf9pjwcfd3h85sr67j0zhj6hl"; })