Merge remote-tracking branch 'origin/master' into staging-next

Conflicts: pkgs/applications/terminal-emulators/alacritty/default.nix pkgs/servers/clickhouse/default.nix
2024-11-22 06:53:01 +00:00 · 2021-05-20 09:12:42 -07:00 · 2021-05-20 09:12:42 -07:00 · 14f3686af1
commit 14f3686af1
parent 24f13758b9 8aac6d8daf
120 changed files with 7535 additions and 2303 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -11465,6 +11465,16 @@
    github = "pulsation";
    githubId = 1838397;
  };
+  ydlr = {
+    name = "ydlr";
+    email = "ydlr@ydlr.io";
+    github = "ydlr";
+    githubId = 58453832;
+    keys = [{
+      longkeyid = "rsa4096/0x43AB44130A29AD9D";
+      fingerprint = "FD0A C425 9EF5 4084 F99F 9B47 2ACC 9749 7C68 FAD4";
+    }];
+  };
  zane = {
    name = "Zane van Iperen";
    email = "zane@zanevaniperen.com";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -48,6 +48,14 @@ with lib.maintainers; {
    scope = "Maintain Cinnamon desktop environment and applications made by the LinuxMint team.";
  };

+  chia = {
+    members = [
+      atemu
+      lourkeur
+    ];
+    scope = "Maintain the Chia blockchain and its dependencies";
+  };
+
  deshaw = {
    # Verify additions to this team with at least one already existing member of the team.
    members = [
--- a/nixos/lib/build-vms.nix
+++ b/nixos/lib/build-vms.nix
@ -36,6 +36,13 @@ rec {
        [ ../modules/virtualisation/qemu-vm.nix
          ../modules/testing/test-instrumentation.nix # !!! should only get added for automated test runs
          { key = "no-manual"; documentation.nixos.enable = false; }
+          { key = "no-revision";
+            # Make the revision metadata constant, in order to avoid needless retesting.
+            # The human version (e.g. 21.05-pre) is left as is, because it is useful
+            # for external modules that test with e.g. nixosTest and rely on that
+            # version number.
+            config.system.nixos.revision = "constant-nixos-revision";
+          }
          { key = "nodes"; _module.args.nodes = nodes; }
        ] ++ optional minimal ../modules/testing/minimal-kernel.nix;
    };
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@ -3,6 +3,7 @@ from contextlib import contextmanager, _GeneratorContextManager
 from queue import Queue, Empty
 from typing import Tuple, Any, Callable, Dict, Iterator, Optional, List, Iterable
 from xml.sax.saxutils import XMLGenerator
+from colorama import Style
 import queue
 import io
 import _thread
@ -151,6 +152,8 @@ class Logger:
        self.xml.startDocument()
        self.xml.startElement("logfile", attrs={})

+        self._print_serial_logs = True
+
    def close(self) -> None:
        self.xml.endElement("logfile")
        self.xml.endDocument()
@ -174,15 +177,21 @@ class Logger:
        self.drain_log_queue()
        self.log_line(message, attributes)

-    def enqueue(self, message: Dict[str, str]) -> None:
-        self.queue.put(message)
+    def log_serial(self, message: str, machine: str) -> None:
+        self.enqueue({"msg": message, "machine": machine, "type": "serial"})
+        if self._print_serial_logs:
+            eprint(Style.DIM + "{} # {}".format(machine, message) + Style.RESET_ALL)
+
+    def enqueue(self, item: Dict[str, str]) -> None:
+        self.queue.put(item)

    def drain_log_queue(self) -> None:
        try:
            while True:
                item = self.queue.get_nowait()
-                attributes = {"machine": item["machine"], "type": "serial"}
-                self.log_line(self.sanitise(item["msg"]), attributes)
+                msg = self.sanitise(item["msg"])
+                del item["msg"]
+                self.log_line(msg, item)
        except Empty:
            pass

@ -327,6 +336,9 @@ class Machine:
    def log(self, msg: str) -> None:
        self.logger.log(msg, {"machine": self.name})

+    def log_serial(self, msg: str) -> None:
+        self.logger.log_serial(msg, self.name)
+
    def nested(self, msg: str, attrs: Dict[str, str] = {}) -> _GeneratorContextManager:
        my_attrs = {"machine": self.name}
        my_attrs.update(attrs)
@ -784,8 +796,7 @@ class Machine:
                # Ignore undecodable bytes that may occur in boot menus
                line = _line.decode(errors="ignore").replace("\r", "").rstrip()
                self.last_lines.put(line)
-                eprint("{} # {}".format(self.name, line))
-                self.logger.enqueue({"msg": line, "machine": self.name})
+                self.log_serial(line)

        _thread.start_new_thread(process_serial_output, ())

@ -927,6 +938,16 @@ def run_tests() -> None:
            machine.execute("sync")


+def serial_stdout_on() -> None:
+    global log
+    log._print_serial_logs = True
+
+
+def serial_stdout_off() -> None:
+    global log
+    log._print_serial_logs = False
+
+
@contextmanager
 def subtest(name: str) -> Iterator[None]:
    with log.nested(name):
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@ -25,7 +25,7 @@ rec {
      name = "nixos-test-driver";

      nativeBuildInputs = [ makeWrapper ];
-      buildInputs = [ (python3.withPackages (p: [ p.ptpython ])) ];
+      buildInputs = [ (python3.withPackages (p: [ p.ptpython p.colorama ])) ];
      checkInputs = with python3Packages; [ pylint black mypy ];

      dontUnpack = true;
--- a/nixos/modules/services/cluster/kubernetes/addon-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/addon-manager.nix
@ -62,7 +62,7 @@ in
      '';
    };

-    enable = mkEnableOption "Whether to enable Kubernetes addon manager.";
+    enable = mkEnableOption "Kubernetes addon manager.";
  };

  ###### implementation
--- a/nixos/modules/services/databases/clickhouse.nix
+++ b/nixos/modules/services/databases/clickhouse.nix
@ -42,6 +42,7 @@ with lib;
        User = "clickhouse";
        Group = "clickhouse";
        ConfigurationDirectory = "clickhouse-server";
+        AmbientCapabilities = "CAP_SYS_NICE";
        StateDirectory = "clickhouse";
        LogsDirectory = "clickhouse";
        ExecStart = "${pkgs.clickhouse}/bin/clickhouse-server --config-file=${pkgs.clickhouse}/etc/clickhouse-server/config.xml";
--- a/nixos/modules/services/network-filesystems/netatalk.nix
+++ b/nixos/modules/services/network-filesystems/netatalk.nix
@ -3,43 +3,10 @@
 with lib;

 let
-
  cfg = config.services.netatalk;
-
-  extmapFile = pkgs.writeText "extmap.conf" cfg.extmap;
-
-  afpToString = x: if builtins.typeOf x == "bool"
-                   then boolToString x
-                   else toString x;
-
-  volumeConfig = name:
-    let vol = getAttr name cfg.volumes; in
-    "[${name}]\n " + (toString (
-       map
-         (key: "${key} = ${afpToString (getAttr key vol)}\n")
-         (attrNames vol)
-    ));
-
-  afpConf = ''[Global]
-    extmap file = ${extmapFile}
-    afp port = ${toString cfg.port}
-
-    ${cfg.extraConfig}
-
-    ${if cfg.homes.enable then ''[Homes]
-    ${optionalString (cfg.homes.path != "") "path = ${cfg.homes.path}"}
-    basedir regex = ${cfg.homes.basedirRegex}
-    ${cfg.homes.extraConfig}
-    '' else ""}
-
-     ${toString (map volumeConfig (attrNames cfg.volumes))}
-  '';
-
-  afpConfFile = pkgs.writeText "afp.conf" afpConf;
-
-in
-
-{
+  settingsFormat = pkgs.formats.ini { };
+  afpConfFile = settingsFormat.generate "afp.conf" cfg.settings;
+in {
  options = {
    services.netatalk = {

@ -51,61 +18,24 @@ in
        description = "TCP port to be used for AFP.";
      };

-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
-        example = "uam list = uams_guest.so";
-        description = ''
-          Lines of configuration to add to the <literal>[Global]</literal> section.
-          See <literal>man apf.conf</literal> for more information.
-        '';
-      };
-
-      homes = {
-        enable = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Enable sharing of the UNIX server user home directories.";
-        };
-
-        path = mkOption {
-          type = types.str;
-          default = "";
-          example = "afp-data";
-          description = "Share not the whole user home but this subdirectory path.";
-        };
-
-        basedirRegex = mkOption {
-          example = "/home";
-          type = types.str;
-          description = "Regex which matches the parent directory of the user homes.";
-        };
-
-        extraConfig = mkOption {
-          type = types.lines;
-          default = "";
-          description = ''
-            Lines of configuration to add to the <literal>[Homes]</literal> section.
-            See <literal>man apf.conf</literal> for more information.
-          '';
-         };
-      };
-
-      volumes = mkOption {
+      settings = mkOption {
+        inherit (settingsFormat) type;
        default = { };
-        type = types.attrsOf (types.attrsOf types.unspecified);
-        description =
-          ''
-            Set of AFP volumes to export.
-            See <literal>man apf.conf</literal> for more information.
-          '';
-        example = literalExample ''
-          { srv =
-             { path = "/srv";
-               "read only" = true;
-               "hosts allow" = "10.1.0.0/16 10.2.1.100 2001:0db8:1234::/48";
-             };
-          }
+        example = {
+          Global = { "uam list" = "uams_guest.so"; };
+          Homes = {
+            path = "afp-data";
+            "basedir regex" = "/home";
+          };
+          example-volume = {
+            path = "/srv/volume";
+            "read only" = true;
+          };
+        };
+        description = ''
+          Configuration for Netatalk. See
+          <citerefentry><refentrytitle>afp.conf</refentrytitle>
+          <manvolnum>5</manvolnum></citerefentry>.
        '';
      };

@ -114,18 +44,33 @@ in
        default = "";
        description = ''
          File name extension mappings.
-          See <literal>man extmap.conf</literal> for more information.
+          See <citerefentry><refentrytitle>extmap.conf</refentrytitle>
+          <manvolnum>5</manvolnum></citerefentry>. for more information.
        '';
      };

    };
  };

+  imports = (map (option:
+    mkRemovedOptionModule [ "services" "netatalk" option ]
+    "This option was removed in favor of `services.netatalk.settings`.") [
+      "extraConfig"
+      "homes"
+      "volumes"
+    ]);
+
  config = mkIf cfg.enable {

+    services.netatalk.settings.Global = {
+      "afp port" = toString cfg.port;
+      "extmap file" = "${pkgs.writeText "extmap.conf" cfg.extmap}";
+    };
+
    systemd.services.netatalk = {
      description = "Netatalk AFP fileserver for Macintosh clients";
-      unitConfig.Documentation = "man:afp.conf(5) man:netatalk(8) man:afpd(8) man:cnid_metad(8) man:cnid_dbd(8)";
+      unitConfig.Documentation =
+        "man:afp.conf(5) man:netatalk(8) man:afpd(8) man:cnid_metad(8) man:cnid_dbd(8)";
      after = [ "network.target" "avahi-daemon.service" ];
      wantedBy = [ "multi-user.target" ];

@ -135,12 +80,12 @@ in
        Type = "forking";
        GuessMainPID = "no";
        PIDFile = "/run/lock/netatalk";
-        ExecStartPre = "${pkgs.coreutils}/bin/mkdir -m 0755 -p /var/lib/netatalk/CNID";
-        ExecStart  = "${pkgs.netatalk}/sbin/netatalk -F ${afpConfFile}";
+        ExecStart = "${pkgs.netatalk}/sbin/netatalk -F ${afpConfFile}";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP  $MAINPID";
-        ExecStop   = "${pkgs.coreutils}/bin/kill -TERM $MAINPID";
+        ExecStop = "${pkgs.coreutils}/bin/kill -TERM $MAINPID";
        Restart = "always";
        RestartSec = 1;
+        StateDirectory = [ "netatalk/CNID" ];
      };

    };
--- a/nixos/modules/services/networking/nsd.nix
+++ b/nixos/modules/services/networking/nsd.nix
@ -20,6 +20,15 @@ let

  mkZoneFileName = name: if name == "." then "root" else name;

+  # replaces include: directives for keys with fake keys for nsd-checkconf
+  injectFakeKeys = keys: concatStrings
+    (mapAttrsToList
+      (keyName: keyOptions: ''
+        fakeKey="$(${pkgs.bind}/bin/tsig-keygen -a ${escapeShellArgs [ keyOptions.algorithm keyName ]} | grep -oP "\s*secret \"\K.*(?=\";)")"
+        sed "s@^\s*include:\s*\"${stateDir}/private/${keyName}\"\$@secret: $fakeKey@" -i $out/nsd.conf
+      '')
+      keys);
+
  nsdEnv = pkgs.buildEnv {
    name = "nsd-env";

@ -34,9 +43,9 @@ let
        echo "|- checking zone '$out/zones/$zoneFile'"
        ${nsdPkg}/sbin/nsd-checkzone "$zoneFile" "$zoneFile" || {
          if grep -q \\\\\\$ "$zoneFile"; then
-            echo zone "$zoneFile" contains escaped dollar signes \\\$
-            echo Escaping them is not needed any more. Please make shure \
-                 to unescape them where they prefix a variable name
+            echo zone "$zoneFile" contains escaped dollar signs \\\$
+            echo Escaping them is not needed any more. Please make sure \
+                 to unescape them where they prefix a variable name.
          fi

          exit 1
@ -44,7 +53,14 @@ let
      done

      echo "checking configuration file"
+      # Save original config file including key references...
+      cp $out/nsd.conf{,.orig}
+      # ...inject mock keys into config
+      ${injectFakeKeys cfg.keys}
+      # ...do the checkconf
      ${nsdPkg}/sbin/nsd-checkconf $out/nsd.conf
+      # ... and restore original config file.
+      mv $out/nsd.conf{.orig,}
    '';
  };

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -303,6 +303,7 @@ in
  openarena = handleTest ./openarena.nix {};
  openldap = handleTest ./openldap.nix {};
  opensmtpd = handleTest ./opensmtpd.nix {};
+  opensmtpd-rspamd = handleTest ./opensmtpd-rspamd.nix {};
  openssh = handleTest ./openssh.nix {};
  openstack-image-metadata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).metadata or {};
  openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
--- a/nixos/tests/clickhouse.nix
+++ b/nixos/tests/clickhouse.nix
@ -4,6 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {

  machine = {
    services.clickhouse.enable = true;
+    virtualisation.memorySize = 4096;
  };

  testScript =
--- a/nixos/tests/nsd.nix
+++ b/nixos/tests/nsd.nix
@ -43,6 +43,10 @@ in import ./make-test-python.nix ({ pkgs, ...} : {
      services.nsd.enable = true;
      services.nsd.rootServer = true;
      services.nsd.interfaces = lib.mkForce [];
+      services.nsd.keys."tsig.example.com." = {
+        algorithm = "hmac-sha256";
+        keyFile = pkgs.writeTextFile { name = "tsig.example.com."; text = "aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc="; };
+      };
      services.nsd.zones."example.com.".data = ''
        @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
        ipv4 A 1.2.3.4
@ -51,6 +55,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : {
        ns A 192.168.0.1
        ns AAAA dead:beef::1
      '';
+      services.nsd.zones."example.com.".provideXFR = [ "0.0.0.0 tsig.example.com." ];
      services.nsd.zones."deleg.example.com.".data = ''
        @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
        @ A 9.8.7.6
@ -71,6 +76,10 @@ in import ./make-test-python.nix ({ pkgs, ...} : {
    clientv6.wait_for_unit("network.target")
    server.wait_for_unit("nsd.service")

+    with subtest("server tsig.example.com."):
+        expected_tsig = "  secret: \"aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=\"\n"
+        tsig=server.succeed("cat /var/lib/nsd/private/tsig.example.com.")
+        assert expected_tsig == tsig, f"Expected /var/lib/nsd/private/tsig.example.com. to contain '{expected_tsig}', but found '{tsig}'"

    def assert_host(type, rr, query, expected):
        self = clientv4 if type == 4 else clientv6
--- a/nixos/tests/opensmtpd-rspamd.nix
+++ b/nixos/tests/opensmtpd-rspamd.nix
@ -0,0 +1,142 @@
+import ./make-test-python.nix {
+  name = "opensmtpd-rspamd";
+
+  nodes = {
+    smtp1 = { pkgs, ... }: {
+      imports = [ common/user-account.nix ];
+      networking = {
+        firewall.allowedTCPPorts = [ 25 143 ];
+        useDHCP = false;
+        interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
+          { address = "192.168.1.1"; prefixLength = 24; }
+        ];
+      };
+      environment.systemPackages = [ pkgs.opensmtpd ];
+      services.opensmtpd = {
+        enable = true;
+        extraServerArgs = [ "-v" ];
+        serverConfiguration = ''
+          listen on 0.0.0.0
+          action dovecot_deliver mda \
+            "${pkgs.dovecot}/libexec/dovecot/deliver -d %{user.username}"
+          match from any for local action dovecot_deliver
+
+          action do_relay relay
+          # DO NOT DO THIS IN PRODUCTION!
+          # Setting up authentication requires a certificate which is painful in
+          # a test environment, but THIS WOULD BE DANGEROUS OUTSIDE OF A
+          # WELL-CONTROLLED ENVIRONMENT!
+          match from any for any action do_relay
+        '';
+      };
+      services.dovecot2 = {
+        enable = true;
+        enableImap = true;
+        mailLocation = "maildir:~/mail";
+        protocols = [ "imap" ];
+      };
+    };
+
+    smtp2 = { pkgs, ... }: {
+      imports = [ common/user-account.nix ];
+      virtualisation.memorySize = 512;
+      networking = {
+        firewall.allowedTCPPorts = [ 25 143 ];
+        useDHCP = false;
+        interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
+          { address = "192.168.1.2"; prefixLength = 24; }
+        ];
+      };
+      environment.systemPackages = [ pkgs.opensmtpd ];
+      services.rspamd = {
+        enable = true;
+        locals."worker-normal.inc".text = ''
+          bind_socket = "127.0.0.1:11333";
+        '';
+      };
+      services.opensmtpd = {
+        enable = true;
+        extraServerArgs = [ "-v" ];
+        serverConfiguration = ''
+          filter rspamd proc-exec "${pkgs.opensmtpd-filter-rspamd}/bin/filter-rspamd"
+          listen on 0.0.0.0 filter rspamd
+          action dovecot_deliver mda \
+            "${pkgs.dovecot}/libexec/dovecot/deliver -d %{user.username}"
+          match from any for local action dovecot_deliver
+        '';
+      };
+      services.dovecot2 = {
+        enable = true;
+        enableImap = true;
+        mailLocation = "maildir:~/mail";
+        protocols = [ "imap" ];
+      };
+    };
+
+    client = { pkgs, ... }: {
+      networking = {
+        useDHCP = false;
+        interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
+          { address = "192.168.1.3"; prefixLength = 24; }
+        ];
+      };
+      environment.systemPackages = let
+        sendTestMail = pkgs.writeScriptBin "send-a-test-mail" ''
+          #!${pkgs.python3.interpreter}
+          import smtplib, sys
+
+          with smtplib.SMTP('192.168.1.1') as smtp:
+            smtp.sendmail('alice@[192.168.1.1]', 'bob@[192.168.1.2]', """
+              From: alice@smtp1
+              To: bob@smtp2
+              Subject: Test
+
+              Hello World
+              Here goes the spam test
+              XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
+            """)
+        '';
+
+        checkMailBounced = pkgs.writeScriptBin "check-mail-bounced" ''
+          #!${pkgs.python3.interpreter}
+          import imaplib
+
+          with imaplib.IMAP4('192.168.1.1', 143) as imap:
+            imap.login('alice', 'foobar')
+            imap.select()
+            status, refs = imap.search(None, 'ALL')
+            assert status == 'OK'
+            assert len(refs) == 1
+            status, msg = imap.fetch(refs[0], 'BODY[TEXT]')
+            assert status == 'OK'
+            content = msg[0][1]
+            print("===> content:", content)
+            assert b"An error has occurred while attempting to deliver a message" in content
+        '';
+      in [ sendTestMail checkMailBounced ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    client.wait_for_unit("network-online.target")
+    smtp1.wait_for_unit("opensmtpd")
+    smtp2.wait_for_unit("opensmtpd")
+    smtp2.wait_for_unit("rspamd")
+    smtp2.wait_for_unit("dovecot2")
+
+    # To prevent sporadic failures during daemon startup, make sure
+    # services are listening on their ports before sending requests
+    smtp1.wait_for_open_port(25)
+    smtp2.wait_for_open_port(25)
+    smtp2.wait_for_open_port(143)
+    smtp2.wait_for_open_port(11333)
+
+    client.succeed("send-a-test-mail")
+    smtp1.wait_until_fails("smtpctl show queue | egrep .")
+    client.succeed("check-mail-bounced >&2")
+  '';
+
+  meta.timeout = 1800;
+}
--- a/pkgs/applications/audio/cava/default.nix
+++ b/pkgs/applications/audio/cava/default.nix
@ -3,7 +3,7 @@

 stdenv.mkDerivation rec {
  pname = "cava";
-  version = "0.7.3";
+  version = "0.7.4";

  buildInputs = [
    alsaLib
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    owner = "karlstav";
    repo = "cava";
    rev = version;
-    sha256 = "04j5hb29hivcbk542sfsx9m57dbnj2s6qpvy9fs488zvgjbgxrai";
+    sha256 = "sha256-BlHGst34aUgQcXcuQG43VnKUTclCxfQmWRa6iCud8dc=";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/applications/blockchains/chia/default.nix
+++ b/pkgs/applications/blockchains/chia/default.nix
@ -0,0 +1,69 @@
+{ lib, fetchFromGitHub, python3Packages }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "chia";
+  version = "1.1.5";
+
+  src = fetchFromGitHub {
+    owner = "Chia-Network";
+    repo = "chia-blockchain";
+    rev = version;
+    sha256 = "ZUxWOlJGQpeQCtWt0PSdcbMackHdeuNFkxHvYDPcU8Y=";
+  };
+
+  patches = [
+    # tweak version requirements to what's available in Nixpkgs
+    ./dependencies.patch
+  ];
+
+  nativeBuildInputs = [
+    python3Packages.setuptools-scm
+  ];
+
+  # give a hint to setuptools_scm on package version
+  SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
+
+  propagatedBuildInputs = with python3Packages; [
+    aiohttp
+    aiosqlite
+    bitstring
+    blspy
+    chiapos
+    chiavdf
+    chiabip158
+    click
+    clvm
+    clvm-rs
+    clvm-tools
+    colorlog
+    concurrent-log-handler
+    cryptography
+    keyrings-cryptfile
+    pyyaml
+    setproctitle
+    setuptools # needs pkg_resources at runtime
+    sortedcontainers
+    websockets
+  ];
+
+  checkInputs = [
+    python3Packages.pytestCheckHook
+  ];
+
+  disabledTests = [
+    "test_spend_through_n"
+    "test_spend_zero_coin"
+  ];
+
+  preCheck = ''
+    export HOME=`mktemp -d`
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.chia.net/";
+    description = "Chia is a modern cryptocurrency built from scratch, designed to be efficient, decentralized, and secure.";
+    license = with licenses; [ asl20 ];
+    maintainers = teams.chia.members;
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/blockchains/chia/dependencies.patch
+++ b/pkgs/applications/blockchains/chia/dependencies.patch
@ -0,0 +1,13 @@
+diff --git a/setup.py b/setup.py
+index c5cf95db..b783a9e6 100644
+--- a/setup.py
+++ b/setup.py
+@@ -8,7 +8,7 @@ dependencies = [
+     "clvm==0.9.6",
+     "clvm_rs==0.1.7",
+     "clvm_tools==0.4.3",
+-    "aiohttp==3.7.4",  # HTTP server for full node rpc
+    "aiohttp==3.7.4.post0",  # HTTP server for full node rpc
+     "aiosqlite==0.17.0",  # asyncio wrapper for sqlite, to store blocks
+     "bitstring==3.1.7",  # Binary data management library
+     "colorlog==5.0.1",  # Adds color to logs
--- a/pkgs/applications/misc/bemenu/default.nix
+++ b/pkgs/applications/misc/bemenu/default.nix
@ -11,13 +11,13 @@ assert x11Support -> xorg != null;

 stdenv.mkDerivation rec {
  pname = "bemenu";
-  version = "0.5.0";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "Cloudef";
    repo = pname;
    rev = version;
-    sha256 = "1ifq5bk7782b9m6bl111x33fn38rpppdrww7hfavqia9a9gi2sl5";
+    sha256 = "sha256-yhUc1r7HulOUQvH7fLXaoJa0mKxJwyC3y59pnJcHUpk=";
  };

  nativeBuildInputs = [ pkg-config pcre ];
--- a/pkgs/applications/misc/megacmd/default.nix
+++ b/pkgs/applications/misc/megacmd/default.nix
@ -6,7 +6,9 @@
 , cryptopp
 , curl
 , fetchFromGitHub
-, ffmpeg_3 # build fails with latest ffmpeg, see https://github.com/meganz/MEGAcmd/issues/523
+  # build fails with latest ffmpeg, see https://github.com/meganz/MEGAcmd/issues/523.
+  # to be re-enabled when patch available
+  # , ffmpeg
 , freeimage
 , gcc-unwrapped
 , libmediainfo
@ -44,7 +46,7 @@ stdenv.mkDerivation rec {
    c-ares
    cryptopp
    curl
-    ffmpeg_3
+    # ffmpeg
    freeimage
    gcc-unwrapped
    libmediainfo
@ -67,7 +69,7 @@ stdenv.mkDerivation rec {
    "--with-cares"
    "--with-cryptopp"
    "--with-curl"
-    "--with-ffmpeg"
+    # "--with-ffmpeg"
    "--with-freeimage"
    "--with-libmediainfo"
    "--with-libuv"
--- a/pkgs/applications/misc/remarkable/rmapi/default.nix
+++ b/pkgs/applications/misc/remarkable/rmapi/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "rmapi";
-  version = "0.0.13";
+  version = "0.0.15";

  src = fetchFromGitHub {
    owner = "juruen";
    repo = "rmapi";
    rev = "v${version}";
-    sha256 = "0qq8x37p7yxhcp5d5xss3pv5186xgg0hd6lbkqivhy5yjsd54c7b";
+    sha256 = "sha256-ju54JSd3Zyye5YGLPEOkhY93ONh0b7eDSnvJlIawizE=";
  };

-  vendorSha256 = "1pa75rjns1kknl2gmfprdzc3f2z8dk44jkz6dmf8f3prj0z7x88c";
+  vendorSha256 = "sha256-SE/0a8QUJsWoGwkSiZqYx1eXuOIL3avJujyg8iSdcBU=";

  doCheck = false;

@ -19,7 +19,7 @@ buildGoModule rec {
    description = "A Go app that allows access to the ReMarkable Cloud API programmatically";
    homepage = "https://github.com/juruen/rmapi";
    changelog = "https://github.com/juruen/rmapi/blob/v${version}/CHANGELOG.md";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = [ maintainers.nickhu ];
  };
 }
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "helmfile";
-  version = "0.139.3";
+  version = "0.139.6";

  src = fetchFromGitHub {
    owner = "roboll";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "sha256-Cg4FFTowrWMDfpaMJwrOSs3ykZxH378OMR+1+vJt5e8=";
+    sha256 = "sha256-pAo8MmQqqSICB4rguhkGHJqyB9fBBzpp7NEaa59rVb4=";
  };

  vendorSha256 = "sha256-Hs09CT/KSwYL2AKLseOjWB5Xvvr5TvbzwDywsGQ9kMw=";
--- a/pkgs/applications/networking/cluster/helmsman/default.nix
+++ b/pkgs/applications/networking/cluster/helmsman/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "helmsman";
-  version = "3.6.10";
+  version = "3.6.11";

  src = fetchFromGitHub {
    owner = "Praqma";
    repo = "helmsman";
    rev = "v${version}";
-    sha256 = "sha256-0Epff1NYfZXza27/5RBuICIj2455K31BGFr6PMLkNVE=";
+    sha256 = "sha256-9G/A6eADt9jP0CZC6MTZnQOmGOItJFI0zTfmC7HXSaI=";
  };

  vendorSha256 = "sha256-icX8mOc8g+DhfAjD1pzneLWTXY17lXyAjdPOWAxkHwI=";
--- a/pkgs/applications/networking/cluster/octant/default.nix
+++ b/pkgs/applications/networking/cluster/octant/default.nix
@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
        x86_64-linux = "Linux-64bit";
        aarch64-linux = "Linux-arm64";
        x86_64-darwin = "macOS-64bit";
+        aarch64-darwin = "macOS-arm64";
      }.${system} or (throw "Unsupported system: ${system}");
      fetchsrc = version: sha256: fetchzip {
        url = "https://github.com/vmware-tanzu/octant/releases/download/v${version}/octant_${version}_${suffix}.tar.gz";
@ -21,6 +22,7 @@ stdenv.mkDerivation rec {
      x86_64-linux = "sha256-VFlZP5d6/YhzVIhveqMc4HfapBt0K/XjtqjCQNc514A=";
      aarch64-linux = "sha256-RfdMfimmoHG4ixBtUVJ/V+mDhQ9aD+yeohkeUMUP8Zg=";
      x86_64-darwin = "sha256-2Qgl3RdA4mMRTqR7o3Q86Zip5wtgvFp1vZn689FUtSI=";
+      aarch64-darwin = "sha256-+eZVg+B5YYf+XnDhNd6OU4+yFM9GtyiavcAr/EXh7XE=";
    };

  dontConfigure = true;
@ -59,6 +61,6 @@ stdenv.mkDerivation rec {
    '';
    license = licenses.asl20;
    maintainers = with maintainers; [ jk ];
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
  };
 }
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -164,9 +164,9 @@ in rec {
  });

  terraform_0_15 = pluggable (generic {
-    version = "0.15.3";
-    sha256 = "12dny8f89ry75ljarhdqlwgzv6py75s1wcmb62n5fp9nk03bjf2p";
-    vendorSha256 = "13ap1arn81lcxry08j42ck6lgvdcvdxgah6d40pmpkzkw9jcf55b";
+    version = "0.15.4";
+    sha256 = "14pxnmxy0c7idn8vgns70fxm2835gbz5vd1hmwzvhm394vr62frp";
+    vendorSha256 = "12hrpxay6k3kz89ihyhl91c4lw4wp821ppa245w9977fq09fhnx0";
    patches = [ ./provider-path-0_15.patch ];
    passthru = { inherit plugins; };
  });
--- a/pkgs/applications/networking/cluster/terraform/provider-path-0_15.patch
+++ b/pkgs/applications/networking/cluster/terraform/provider-path-0_15.patch
@ -1,6 +1,6 @@
-diff -Naur terraform.old/command/init.go terraform.new/command/init.go
--- terraform.old/command/init.go
-+++ terraform.new/command/init.go
+diff -Naur terraform.old/internal/command/init.go terraform.new/internal/command/init.go
+--- terraform.old/internal/command/init.go
+++ terraform.new/internal/command/init.go
@@ -3,6 +3,7 @@
 import (
 	"context"
--- a/pkgs/applications/networking/p2p/retroshare/default.nix
+++ b/pkgs/applications/networking/p2p/retroshare/default.nix
@ -1,59 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, libupnp, gpgme, gnome, glib, libssh, pkg-config, protobuf, bzip2
-, libXScrnSaver, speex, curl, libxml2, libxslt, sqlcipher, libmicrohttpd, opencv, qmake, ffmpeg_3
-, qtmultimedia, qtx11extras, qttools }:
-
-stdenv.mkDerivation rec {
-  pname = "retroshare";
-  version = "0.6.2";
-
-  src = fetchFromGitHub {
-    owner = "RetroShare";
-    repo = "RetroShare";
-    rev = "v${version}";
-    sha256 = "0hly2x87wdvqzzwf3wjzi7092bj8fk4xs6302rkm8gp9bkkmiiw8";
-  };
-
-  # NIX_CFLAGS_COMPILE = [ "-I${glib.dev}/include/glib-2.0" "-I${glib.dev}/lib/glib-2.0/include" "-I${libxml2.dev}/include/libxml2" "-I${sqlcipher}/include/sqlcipher" ];
-
-  patchPhase = ''
-    # Fix build error
-    sed -i 's/UpnpString_get_String(es_event->PublisherUrl)/es_event->PublisherUrl/' \
-      libretroshare/src/upnp/UPnPBase.cpp
-  '';
-
-  nativeBuildInputs = [ pkg-config qmake ];
-  buildInputs = [
-    speex libupnp gpgme gnome.libgnome-keyring glib libssh qtmultimedia qtx11extras qttools
-    protobuf bzip2 libXScrnSaver curl libxml2 libxslt sqlcipher libmicrohttpd opencv ffmpeg_3
-  ];
-
-  preConfigure = ''
-    qmakeFlags="$qmakeFlags DESTDIR=$out"
-  '';
-
-  # gui/settings/PluginsPage.h:25:28: fatal error: ui_PluginsPage.h: No such file or directory
-  enableParallelBuilding = false;
-
-  postInstall = ''
-    mkdir -p $out/bin
-    mv $out/RetroShare06-nogui $out/bin/RetroShare-nogui
-    mv $out/RetroShare06 $out/bin/Retroshare
-    ln -s $out/bin/RetroShare-nogui $out/bin/retroshare-nogui
-
-    # plugins
-    mkdir -p $out/share/retroshare
-    mv $out/lib* $out/share/retroshare
-
-    # BT DHT bootstrap
-    cp libbitdht/src/bitdht/bdboot.txt $out/share/retroshare
-  '';
-
-  meta = with lib; {
-    description = "";
-    homepage = "http://retroshare.sourceforge.net/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ ];
-    broken = true; # broken by libupnp: 1.6.21 -> 1.8.3 (#41684)
-  };
-}
--- a/pkgs/applications/networking/sync/onedrive/default.nix
+++ b/pkgs/applications/networking/sync/onedrive/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "onedrive";
-  version = "2.4.10";
+  version = "2.4.11";

  src = fetchFromGitHub {
    owner = "abraunegg";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256:0dvxjkni66g82j9wr6yy07sn7d7yr7bbc0py89pxybvsbid88l65";
+    sha256 = "sha256-ioOrkhVeHHqIjoEXcYo8ATJW+2+nZOehf3XbAJUEXpY=";
  };

  nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkg-config ];
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@ -1,12 +1,13 @@
 { lib, stdenv, fetchFromGitLab, cmake, gfortran, perl
 , openblas, hdf5-cpp, python3, texlive
 , armadillo, mpi, globalarrays, openssh
-, makeWrapper, fetchpatch
+, makeWrapper
 } :

 let
-  version = "20.10";
-  gitLabRev = "v${version}";
+  version = "21.02";
+  # The tag keeps moving, fix a hash instead
+  gitLabRev = "41cee871945ac712e86ee971425a49a8fc60a936";

  python = python3.withPackages (ps : with ps; [ six pyparsing ]);

@ -18,13 +19,13 @@ in stdenv.mkDerivation {
    owner = "Molcas";
    repo = "OpenMolcas";
    rev = gitLabRev;
-    sha256 = "0xr9plgb0cfmxxqmd3wrhvl0hv2jqqfqzxwzs1jysq2m9cxl314v";
+    sha256 = "0cap53gy1wds2qaxbijw09fqhvfxphfkr93nhp9xdq84yxh4wzv6";
  };

  patches = [
    # Required to handle openblas multiple outputs
    ./openblasPath.patch
-];
+  ];

  nativeBuildInputs = [ perl cmake texlive.combined.scheme-minimal makeWrapper ];
  buildInputs = [
@ -57,6 +58,10 @@ in stdenv.mkDerivation {
    export PATH=$PATH:$out/bin
  '';

+  postInstall = ''
+    mv $out/pymolcas $out/bin
+  '';
+
  postFixup = ''
    # Wrong store path in shebang (no Python pkgs), force re-patching
    sed -i "1s:/.*:/usr/bin/env python:" $out/bin/pymolcas
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@ -52,16 +52,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "alacritty";
-  version = "0.7.2";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "alacritty";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-VXV6w4OnhJBmvMKl7CynbhI9LclTKaSr+5DhHXMwSsc=";
+    sha256 = "sha256-9pQqnsLMkzhKTs7WGhf6lac/LGot6EmJQxgFBTrHA4E=";
  };

-  cargoSha256 = "sha256-AYpT6ij0mtRxs4llywDNfZEqxYG6o2yFE9bmhH7fB8s=";
+  cargoSha256 = "sha256-NtDeXS2g+5RzKHJdDrbzL5oReS42SzuEubkfZ4gbkFc=";

  nativeBuildInputs = [
    cmake
@ -86,7 +86,7 @@ rustPlatform.buildRustPackage rec {
  outputs = [ "out" "terminfo" ];

  postPatch = ''
-    substituteInPlace alacritty/src/config/mouse.rs \
+    substituteInPlace alacritty/src/config/ui_config.rs \
      --replace xdg-open ${xdg-utils}/bin/xdg-open
  '';

--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gh";
-  version = "1.10.1";
+  version = "1.10.2";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-ESwgG1sMkR44KpO7k5HNR3gPBgOqIADpS6fSOqqNn2Q=";
+    sha256 = "sha256-hI4kV7Xj0oMEfD6SzZ+KWHmMp9yGtr18HPPwkOpr5JA=";
  };

  vendorSha256 = "sha256-A7Bo0HQ5Z2SXY32jWCYgwvvInD3xYLSXvipzeaQTDiM=";
--- a/pkgs/applications/video/devede/default.nix
+++ b/pkgs/applications/video/devede/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitLab, python3Packages, ffmpeg_3, mplayer, vcdimager, cdrkit, dvdauthor
+{ lib, fetchFromGitLab, python3Packages, ffmpeg, mplayer, vcdimager, cdrkit, dvdauthor
 , gtk3, gettext, wrapGAppsHook, gdk-pixbuf, gobject-introspection }:

 let
@ -30,11 +30,11 @@ in buildPythonApplication rec {
  ];

  buildInputs = [
-    ffmpeg_3
+    ffmpeg
  ];

  propagatedBuildInputs = [
-    gtk3 pygobject3 gdk-pixbuf dbus-python ffmpeg_3 mplayer dvdauthor vcdimager cdrkit urllib3 setuptools
+    gtk3 pygobject3 gdk-pixbuf dbus-python ffmpeg mplayer dvdauthor vcdimager cdrkit urllib3 setuptools
  ];

  postPatch = ''
--- a/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-calculator";
-  version = "1.6.0";
+  version = "1.6.1";

  repoName = "calculator";

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "sha256-kDqUwTi3XnFGUwAjnWcaKqDylUFqpus9WurLoqbV1xk=";
+    sha256 = "sha256-LGY111wPldxuSfqhZ2E2TeJjexcGbfS25RjLw+Wi99c=";
  };

  passthru = {
--- a/pkgs/desktops/plasma-5/default.nix
+++ b/pkgs/desktops/plasma-5/default.nix
@ -139,6 +139,7 @@ let
      plasma-integration = callPackage ./plasma-integration {};
      plasma-nm = callPackage ./plasma-nm {};
      plasma-pa = callPackage ./plasma-pa.nix { inherit gconf; };
+      plasma-sdk = callPackage ./plasma-sdk.nix {};
      plasma-systemmonitor = callPackage ./plasma-systemmonitor.nix { };
      plasma-thunderbolt = callPackage ./plasma-thunderbolt.nix { };
      plasma-vault = callPackage ./plasma-vault {};
--- a/pkgs/desktops/plasma-5/plasma-sdk.nix
+++ b/pkgs/desktops/plasma-5/plasma-sdk.nix
@ -0,0 +1,41 @@
+{ mkDerivation
+, lib
+, extra-cmake-modules
+, karchive
+, kcompletion
+, kconfig
+, kconfigwidgets
+, kcoreaddons
+, kdbusaddons
+, kdeclarative
+, ki18n
+, kiconthemes
+, kio
+, plasma-framework
+, kservice
+, ktexteditor
+, kwidgetsaddons
+, kdoctools
+, qtbase
+}:
+
+mkDerivation {
+  name = "plasma-sdk";
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  buildInputs = [
+    karchive
+    kcompletion
+    kconfig
+    kconfigwidgets
+    kcoreaddons
+    kdbusaddons
+    kdeclarative
+    ki18n
+    kiconthemes
+    kio
+    plasma-framework
+    kservice
+    ktexteditor
+    kwidgetsaddons
+  ];
+}
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, writeText, gradleGen, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsaLib, ffmpeg_3, python, ruby
+, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsaLib, ffmpeg, python, ruby
 , openjdk11-bootstrap }:

 let
@ -19,7 +19,7 @@ let
      sha256 = "1h7qsylr7rnwnbimqjyn3whszp9kv4h3gpicsrb3mradxc9yv194";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsaLib ffmpeg_3 ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsaLib ffmpeg ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python ruby ];

    dontUseCmakeConfigure = true;
--- a/pkgs/development/compilers/solc/default.nix
+++ b/pkgs/development/compilers/solc/default.nix
@ -7,7 +7,7 @@
 , python3
 , z3Support ? true
 , z3 ? null
-, cvc4Support ? true
+, cvc4Support ? gccStdenv.isLinux
 , cvc4 ? null
 , cln ? null
 , gmp ? null
@ -98,7 +98,6 @@ let
      description = "Compiler for Ethereum smart contract language Solidity";
      homepage = "https://github.com/ethereum/solidity";
      license = licenses.gpl3;
-      platforms = with platforms; linux; # darwin is currently broken
      maintainers = with maintainers; [ dbrock akru lionello sifmelcara ];
      inherit version;
    };
--- a/pkgs/development/interpreters/renpy/default.nix
+++ b/pkgs/development/interpreters/renpy/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, python2Packages, pkg-config, SDL2
-, libpng, ffmpeg_3, freetype, glew, libGL, libGLU, fribidi, zlib
+, libpng, ffmpeg, freetype, glew, libGL, libGLU, fribidi, zlib
 , glib
 }:

@ -32,13 +32,13 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
    python cython wrapPython tkinter
-    SDL2 libpng ffmpeg_3 freetype glew libGLU libGL fribidi zlib pygame_sdl2 glib
+    SDL2 libpng ffmpeg freetype glew libGLU libGL fribidi zlib pygame_sdl2 glib
  ];

  pythonPath = [ pygame_sdl2 tkinter ];

  RENPY_DEPS_INSTALL = lib.concatStringsSep "::" (map (path: path) [
-    SDL2 SDL2.dev libpng ffmpeg_3 ffmpeg_3.out freetype glew.dev glew.out libGLU libGL fribidi zlib
+    SDL2 SDL2.dev libpng ffmpeg ffmpeg.out freetype glew.dev glew.out libGLU libGL fribidi zlib
  ]);

  buildPhase = ''
--- a/pkgs/development/libraries/ffmpeg/3.4.nix
+++ b/pkgs/development/libraries/ffmpeg/3.4.nix
@ -9,4 +9,7 @@ callPackage ./generic.nix (rec {
  branch = "3.4.8";
  sha256 = "1d0r4yja2dkkyhdwx1migq46gsrcbajiv66263a5sq5bfr9dqkch";
  darwinFrameworks = [ Cocoa CoreMedia ];
+  knownVulnerabilities = [
+    "CVE-2021-30123"
+  ];
 } // args)
--- a/pkgs/development/libraries/freetds/default.nix
+++ b/pkgs/development/libraries/freetds/default.nix
@ -8,11 +8,11 @@ assert odbcSupport -> unixODBC != null;

 stdenv.mkDerivation rec {
  pname = "freetds";
-  version = "1.2.18";
+  version = "1.2.21";

  src = fetchurl {
    url    = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ENR+YJhs/FH4Fw+p6rpDEU7r3eC6bmscSBPYbwIaqt0=";
+    sha256 = "sha256-pea79tbz3AgWsZy9CDCNJ6CEsEkmqqBaxn+AjqB9PY0=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/ghc_filesystem/default.nix
+++ b/pkgs/development/libraries/ghc_filesystem/default.nix
@ -0,0 +1,22 @@
+{ stdenv, lib, cmake, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "filesystem";
+  version = "1.5.4";
+
+  src = fetchFromGitHub {
+    owner = "gulrak";
+    repo = "filesystem";
+    rev = "v${version}";
+    hash = "sha256-SvNUzKoNiSIM0no+A0NUT6hmeUH9SzgLQLrC5XOC0Ho=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "header-only single-file C++ std::filesystem compatible helper library";
+    homepage = "https://github.com/gulrak/filesystem";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lourkeur ];
+  };
+}
--- a/pkgs/development/libraries/libAfterImage/default.nix
+++ b/pkgs/development/libraries/libAfterImage/default.nix
@ -1,4 +1,6 @@
-{ lib, stdenv, fetchurl, zlib }:
+{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, giflib, libjpeg, libpng, libX11, zlib
+, static ? stdenv.hostPlatform.isStatic
+, withX ? !stdenv.isDarwin }:

 stdenv.mkDerivation {
  pname = "libAfterImage";
@ -13,7 +15,56 @@ stdenv.mkDerivation {
    sha256 = "0n74rxidwig3yhr6fzxsk7y19n1nq1f296lzrvgj5pfiyi9k48vf";
  };

-  buildInputs = [ zlib ];
+  patches = [
+    # add back --with-gif option
+    (fetchpatch {
+      name = "libafterimage-gif.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/libafterimage/files/libafterimage-gif.patch?id=4aa4fca00611b0b3a4007870da43cc5fd63f76c4";
+      sha256 = "16pa94wlqpd7h6mzs4f0qm794yk1xczrwsgf93kdd3g0zbjq3rnr";
+    })
+
+    # fix build with newer giflib
+    (fetchpatch {
+      name = "libafterimage-giflib5-v2.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/libafterimage/files/libafterimage-giflib5-v2.patch?id=4aa4fca00611b0b3a4007870da43cc5fd63f76c4";
+      sha256 = "0qwydqy9bm73cg5n3vm97aj4jfi70p7fxqmfbi54vi78z593brln";
+      stripLen = 1;
+    })
+
+    # fix build with newer libpng
+    (fetchpatch {
+      name = "libafterimage-libpng15.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/libafterimage/files/libafterimage-libpng15.patch?id=4aa4fca00611b0b3a4007870da43cc5fd63f76c4";
+      sha256 = "1qyvf7786hayasfnnilfbri3p99cfz5wjpbli3gdqj2cvk6mpydv";
+    })
+
+    # fix an ldconfig problem
+    (fetchpatch {
+      name = "libafterimage-makefile.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/libafterimage/files/libafterimage-makefile.in.patch?id=4aa4fca00611b0b3a4007870da43cc5fd63f76c4";
+      sha256 = "1n6fniz6dldms615046yhc4mlg9gb53y4yfia8wfz6szgq5zicj4";
+    })
+  ];
+  patchFlags = [ "-p0" ];
+
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ giflib libjpeg libpng zlib ] ++ lib.optional withX libX11;
+
+  preConfigure = ''
+    rm -rf {libjpeg,libpng,libungif,zlib}/
+    substituteInPlace Makefile.in \
+      --replace "include .depend" ""
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile.in \
+      --replace "-soname," "-install_name,$out/lib/"
+  '';
+
+  configureFlags = [
+    "--with-gif"
+    "--disable-mmx-optimization"
+    "--${if static then "enable" else "disable"}-staticlibs"
+    "--${if !static then "enable" else "disable"}-sharedlibs"
+  ] ++ lib.optional withX "--with-x";

  meta = with lib; {
    homepage = "http://www.afterstep.org/afterimage/";
--- a/pkgs/development/libraries/liblinphone/default.nix
+++ b/pkgs/development/libraries/liblinphone/default.nix
@ -46,7 +46,7 @@

 stdenv.mkDerivation rec {
  pname = "liblinphone";
-  version = "4.5.1";
+  version = "4.5.15";

  src = fetchFromGitLab {
    domain = "gitlab.linphone.org";
@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    group = "BC";
    repo = pname;
    rev = version;
-    sha256 = "05ybbxq2yqzy3f3vzq8c3szs3qr0zl64la53icpqnmfakwnps5gs";
+    sha256 = "sha256-lDj2OkWuodPHpvoJ5W2GivzVIeMnprb42kAnJKfKtdg=";
  };

  # Do not build static libraries
--- a/pkgs/development/libraries/opencl-clang/default.nix
+++ b/pkgs/development/libraries/opencl-clang/default.nix
@ -76,6 +76,13 @@ let
        ./opencl-headers-dir.patch
      ];

+      # Uses linker flags that are not supported on Darwin.
+      postPatch = lib.optionalString stdenv.isDarwin ''
+        sed -i -e '/SET_LINUX_EXPORTS_FILE/d' CMakeLists.txt
+        substituteInPlace CMakeLists.txt \
+          --replace '-Wl,--no-undefined' ""
+      '';
+
      nativeBuildInputs = [ cmake git llvm.dev ];

      buildInputs = [ libclang llvm spirv-llvm-translator ];
--- a/pkgs/development/libraries/ucx/default.nix
+++ b/pkgs/development/libraries/ucx/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "ucx";
-  version = "1.10.0";
+  version = "1.10.1";

  src = fetchFromGitHub {
    owner = "openucx";
    repo = "ucx";
    rev = "v${version}";
-    sha256 = "1j2gfw4anixb5ajgiyn7bcca8pgjvsaf0y0b2xz88s9hdx0h6gs9";
+    sha256 = "1jl7wrmcpf6lakpi1gvjcs18cy0mmwgsv5wdd80zyl41cpd8gm8d";
  };

  nativeBuildInputs = [ autoreconfHook doxygen ];
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@ -117,6 +117,8 @@ stdenv.mkDerivation rec {
    license = licenses.mit; # Expat version
    platforms = if withLibraries then platforms.linux else platforms.unix;
    maintainers = with maintainers; [ primeos codyopel qyliss ];
+    # big sur doesn't support gcc stdenv and wayland doesn't build with clang
+    broken = stdenv.isDarwin;
  };

  passthru.version = version;
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@ -7,13 +7,13 @@

 buildPythonPackage rec {
  pname = "aioshelly";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "home-assistant-libs";
    repo = pname;
    rev = version;
-    sha256 = "sha256-vlIon+VAHeJiaSIVMEKEpwQC4gXA52vxfEkiQMC9yiw=";
+    sha256 = "sha256-c4EFR7rcYdrCdM0AfmX/d7cP4woh6P1iAjeSQV9ieKM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/blspy/default.nix
+++ b/pkgs/development/python-modules/blspy/default.nix
@ -0,0 +1,58 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchFromGitHub
+, setuptools-scm
+, substituteAll
+, cmake
+, boost
+, gmp
+, pybind11
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "blspy";
+  version = "1.0.2";
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-N1mk83uZrzSty2DyXfKiVp85z/jmztiUSRXKfNBRJV4=";
+  };
+
+  patches = [
+    # prevent CMake from trying to get libraries on the Internet
+    (substituteAll {
+      src = ./dont_fetch_dependencies.patch;
+      pybind11_src = pybind11.src;
+      relic_src = fetchFromGitHub {
+        owner = "relic-toolkit";
+        repo = "relic";
+        rev = "1885ae3b681c423c72b65ce1fe70910142cf941c"; # pinned by blspy
+        hash = "sha256-tsSZTcssl8t7Nqdex4BesgQ+ACPgTdtHnJFvS9josN0=";
+      };
+    })
+  ];
+
+  nativeBuildInputs = [ cmake setuptools-scm ];
+
+  buildInputs = [ boost gmp.static pybind11 ];
+
+  pythonImportsCheck = [
+    "blspy"
+  ];
+
+  # Note: upstream testsuite is just a single test.py script outside of any framework
+  doCheck = false;
+
+  # CMake needs to be run by setuptools rather than by its hook
+  dontConfigure = true;
+
+  meta = with lib; {
+    description = "BLS signatures with aggregation";
+    homepage = "https://github.com/Chia-Network/bls-signatures/";
+    license = licenses.asl20;
+    maintainers = teams.chia.members;
+  };
+}
--- a/pkgs/development/python-modules/blspy/dont_fetch_dependencies.patch
+++ b/pkgs/development/python-modules/blspy/dont_fetch_dependencies.patch
@ -0,0 +1,38 @@
+diff --git a/python-bindings/CMakeLists.txt b/python-bindings/CMakeLists.txt
+index 255e3bb..5f99c3a 100644
+--- a/python-bindings/CMakeLists.txt
+++ b/python-bindings/CMakeLists.txt
+@@ -6,8 +6,7 @@ include(FetchContent)
+ 
+ FetchContent_Declare(
+   pybind11
+-  GIT_REPOSITORY https://github.com/pybind/pybind11.git
+-  GIT_TAG        v2.6.2
+  SOURCE_DIR @pybind11_src@
+ )
+ FetchContent_MakeAvailable(pybind11 relic)
+ 
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index faecc61..3272116 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -4,18 +4,9 @@ set (CMAKE_CXX_STANDARD 17)
+ # CMake 3.14+
+ include(FetchContent)
+ 
+-if (DEFINED ENV{RELIC_MAIN})
+-  set(RELIC_GIT_TAG "origin/main")
+-else ()
+-  set(RELIC_GIT_TAG "1885ae3b681c423c72b65ce1fe70910142cf941c")
+-endif ()
+-
+-message(STATUS "Relic will be built from: ${RELIC_GIT_TAG}")
+-
+ FetchContent_Declare(
+   relic
+-  GIT_REPOSITORY https://github.com/relic-toolkit/relic.git
+-  GIT_TAG        ${RELIC_GIT_TAG}
+  SOURCE_DIR @relic_src@
+ )
+ FetchContent_MakeAvailable(relic)
+ 
--- a/pkgs/development/python-modules/chiabip158/default.nix
+++ b/pkgs/development/python-modules/chiabip158/default.nix
@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, cmake
+, pybind11
+, pythonOlder
+, pytestCheckHook
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "chiabip158";
+  version = "1.0";
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-dG6A4n30uPswQWY/Wmi75HK4ZMCDNr9Lt05FRWEPYV8=";
+  };
+
+  nativeBuildInputs = [ cmake setuptools-scm ];
+
+  buildInputs = [ pybind11 ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # CMake needs to be run by setuptools rather than by its hook
+  dontConfigure = true;
+
+  meta = with lib; {
+    description = "Chia's implementation of BIP 158";
+    homepage = "https://www.chia.net/";
+    license = licenses.asl20;
+    maintainers = teams.chia.members;
+  };
+}
--- a/pkgs/development/python-modules/chiapos/default.nix
+++ b/pkgs/development/python-modules/chiapos/default.nix
@ -0,0 +1,48 @@
+{ lib
+, substituteAll
+, buildPythonPackage
+, fetchPypi
+, cmake
+, cxxopts
+, ghc_filesystem
+, pybind11
+, pythonOlder
+, psutil
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "chiapos";
+  version = "1.0.1";
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-kJx57EtwPBrGMpjnSzeYYhWqc/g1N1Bg8slW5oZKjg8=";
+  };
+
+  patches = [
+    # prevent CMake from trying to get libraries on the Internet
+    (substituteAll {
+      src = ./dont_fetch_dependencies.patch;
+      inherit cxxopts ghc_filesystem;
+      pybind11_src = pybind11.src;
+    })
+  ];
+
+  nativeBuildInputs = [ cmake setuptools-scm ];
+
+  buildInputs = [ pybind11 ];
+
+  checkInputs = [ psutil ];
+
+  # CMake needs to be run by setuptools rather than by its hook
+  dontConfigure = true;
+
+  meta = with lib; {
+    description = "Chia proof of space library";
+    homepage = "https://www.chia.net/";
+    license = licenses.asl20;
+    maintainers = teams.chia.members;
+  };
+}
--- a/pkgs/development/python-modules/chiapos/dont_fetch_dependencies.patch
+++ b/pkgs/development/python-modules/chiapos/dont_fetch_dependencies.patch
@ -0,0 +1,31 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 9b4a2f5..86f849c 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -18,22 +18,19 @@ include(FetchContent)
+ 
+ FetchContent_Declare(
+   pybind11-src
+-  GIT_REPOSITORY https://github.com/pybind/pybind11.git
+-  GIT_TAG        v2.6.2
+  SOURCE_DIR @pybind11_src@
+ )
+ FetchContent_MakeAvailable(pybind11-src)
+ 
+ FetchContent_Declare(
+   cxxopts
+-  GIT_REPOSITORY https://github.com/jarro2783/cxxopts.git
+-  GIT_TAG        v2.2.1
+  SOURCE_DIR @cxxopts@
+ )
+ FetchContent_MakeAvailable(cxxopts)
+ 
+ FetchContent_Declare(
+   gulrak
+-  GIT_REPOSITORY https://github.com/gulrak/filesystem.git
+-  GIT_TAG        v1.5.4
+  SOURCE_DIR @ghc_filesystem@
+ )
+ FetchContent_MakeAvailable(gulrak)
+ 
+
--- a/pkgs/development/python-modules/chiavdf/default.nix
+++ b/pkgs/development/python-modules/chiavdf/default.nix
@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, substituteAll
+, cmake
+, boost
+, gmp
+, pybind11
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "chiavdf";
+  version = "1.0.1";
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-z0od/VrH580+9641lKNI7jbVMlJZKCWnoT+GljnFxmU=";
+  };
+
+  patches = [
+    # prevent CMake from trying to get libraries on the Internet
+    (substituteAll {
+      src = ./dont_fetch_dependencies.patch;
+      pybind11_src = pybind11.src;
+    })
+  ];
+
+  # x86 instructions are needed for this component
+  BUILD_VDF_CLIENT = lib.optionalString (!stdenv.isx86_64) "N";
+
+  nativeBuildInputs = [ cmake setuptools-scm ];
+
+  buildInputs = [ boost gmp pybind11 ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # CMake needs to be run by setuptools rather than by its hook
+  dontConfigure = true;
+
+  meta = with lib; {
+    description = "Chia verifiable delay function utilities";
+    homepage = "https://www.chia.net/";
+    license = licenses.asl20;
+    maintainers = teams.chia.members;
+  };
+}
--- a/pkgs/development/python-modules/chiavdf/dont_fetch_dependencies.patch
+++ b/pkgs/development/python-modules/chiavdf/dont_fetch_dependencies.patch
@ -0,0 +1,14 @@
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index c975128..a9f6910 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -31,8 +31,7 @@ include(FetchContent)
+ 
+ FetchContent_Declare(
+   pybind11-src
+-  GIT_REPOSITORY https://github.com/pybind/pybind11.git
+-  GIT_TAG        v2.6.2
+  SOURCE_DIR @pybind11_src@
+ )
+ FetchContent_MakeAvailable(pybind11-src)
+ 
--- a/pkgs/development/python-modules/cirq-core/default.nix
+++ b/pkgs/development/python-modules/cirq-core/default.nix
@ -0,0 +1,98 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, matplotlib
+, networkx
+, numpy
+, pandas
+, requests
+, scipy
+, sortedcontainers
+, sympy
+, tqdm
+, typing-extensions
+  # Contrib requirements
+, withContribRequires ? false
+, autoray ? null
+, opt-einsum
+, ply
+, pylatex ? null
+, pyquil ? null
+, quimb ? null
+  # test inputs
+, pytestCheckHook
+, freezegun
+, pytest-asyncio
+}:
+buildPythonPackage rec {
+  pname = "cirq-core";
+  version = "0.11.0";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "quantumlib";
+    repo = "cirq";
+    rev = "v${version}";
+    hash = "sha256-JaKTGnkYhzIFb35SGaho8DRupoT0JFYKA5+rJEq4oXw=";
+  };
+
+  sourceRoot = "source/${pname}";
+
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "matplotlib~=3.0" "matplotlib" \
+      --replace "networkx~=2.4" "networkx" \
+      --replace "numpy~=1.16" "numpy" \
+      --replace "requests~=2.18" "requests"
+  '';
+
+  propagatedBuildInputs = [
+    matplotlib
+    networkx
+    numpy
+    pandas
+    requests
+    scipy
+    sortedcontainers
+    sympy
+    tqdm
+    typing-extensions
+  ] ++ lib.optionals withContribRequires [
+    autoray
+    opt-einsum
+    ply
+    pylatex
+    pyquil
+    quimb
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    freezegun
+  ];
+
+  pytestFlagsArray = lib.optionals (!withContribRequires) [
+    # requires external (unpackaged) libraries, so untested.
+    "--ignore=cirq/contrib/"
+  ];
+  disabledTests = [
+    "test_metadata_search_path" # tries to import flynt, which isn't in Nixpkgs
+    "test_benchmark_2q_xeb_fidelities" # fails due pandas MultiIndex. Maybe issue with pandas version in nix?
+  ] ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+    # Seem to fail due to math issues on aarch64?
+    "expectation_from_wavefunction"
+    "test_single_qubit_op_to_framed_phase_form_output_on_example_case"
+  ];
+
+  meta = with lib; {
+    description = "A framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits.";
+    homepage = "https://github.com/quantumlib/cirq";
+    changelog = "https://github.com/quantumlib/Cirq/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ drewrisinger ];
+  };
+}
--- a/pkgs/development/python-modules/cirq-google/default.nix
+++ b/pkgs/development/python-modules/cirq-google/default.nix
@ -0,0 +1,29 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, cirq-core
+, google-api-core
+, protobuf
+# test inputs
+, pytestCheckHook
+, freezegun
+}:
+
+buildPythonPackage rec {
+  pname = "cirq-google";
+  inherit (cirq-core) version src meta;
+
+  sourceRoot = "source/${pname}";
+
+  postPatch = ''
+    substituteInPlace requirements.txt --replace "protobuf~=3.13.0" "protobuf"
+  '';
+
+  propagatedBuildInputs = [
+    cirq-core
+    google-api-core
+    protobuf
+  ];
+
+  checkInputs = [ pytestCheckHook freezegun ];
+}
--- a/pkgs/development/python-modules/cirq/default.nix
+++ b/pkgs/development/python-modules/cirq/default.nix
@ -1,114 +1,28 @@
-{ stdenv
-, lib
+{ lib
 , buildPythonPackage
-, pythonOlder
-, fetchFromGitHub
-, google-api-core
-, matplotlib
-, networkx
-, numpy
-, pandas
-, protobuf
-, requests
-, scipy
-, sortedcontainers
-, sympy
-, tqdm
-, typing-extensions
+, cirq-core
+, cirq-google
  # test inputs
-, freezegun
 , pytestCheckHook
-, pytest-asyncio
-, pytest-benchmark
-, ply
-, pydot
-, pyyaml
-, pygraphviz
 }:

 buildPythonPackage rec {
  pname = "cirq";
-  version = "0.10.0";
-
-  disabled = pythonOlder "3.6";
-
-  src = fetchFromGitHub {
-    owner = "quantumlib";
-    repo = "cirq";
-    rev = "v${version}";
-    sha256 = "0xinml44n2lfl0q2lb2apmn69gsszlwim83082f66vyk0gpwd4lr";
-  };
-
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "matplotlib~=3.0" "matplotlib" \
-      --replace "networkx~=2.4" "networkx" \
-      --replace "numpy~=1.16" "numpy" \
-      --replace "protobuf~=3.13.0" "protobuf"
-  '';
+  inherit (cirq-core) version src meta;

  propagatedBuildInputs = [
-    google-api-core
-    matplotlib
-    networkx
-    numpy
-    pandas
-    protobuf
-    requests
-    scipy
-    sortedcontainers
-    sympy
-    tqdm
-    typing-extensions
+    cirq-core
+    cirq-google
  ];

  # pythonImportsCheck = [ "cirq" "cirq.Circuit" ];  # cirq's importlib hook doesn't work here
-  checkInputs = [
-    pytestCheckHook
-    freezegun
-    pytest-asyncio
-    pytest-benchmark
-    ply
-    pydot
-    pyyaml
-    pygraphviz
+  checkInputs = [ pytestCheckHook ];
+
+  # Don't run submodule or development tool tests
+  disabledTestPaths = [
+    "cirq-google"
+    "cirq-core"
+    "dev_tools"
  ];

-  pytestFlagsArray = [
-    "--ignore=dev_tools"  # Only needed when developing new code, which is out-of-scope
-    "--ignore=cirq/contrib/"  # requires external (unpackaged) python packages, so untested.
-    "--benchmark-disable" # Don't need to run benchmarks when packaging.
-  ];
-  disabledTests = lib.optionals stdenv.isAarch64 [
-    # Seem to fail due to math issues on aarch64?
-    "expectation_from_wavefunction"
-    "test_single_qubit_op_to_framed_phase_form_output_on_example_case"
-  ] ++ [
-    # slow tests, for quicker building
-    "test_anneal_search_method_calls"
-    "test_density_matrix_from_state_tomography_is_correct"
-    "test_example_runs_qubit_characterizations"
-    "test_example_runs_hello_line_perf"
-    "test_example_runs_bc_mean_field_perf"
-    "test_main_loop"
-    "test_clifford_circuit_2"
-    "test_decompose_specific_matrices"
-    "test_two_qubit_randomized_benchmarking"
-    "test_kak_decomposition_perf"
-    "test_example_runs_simon"
-    "test_decompose_random_unitary"
-    "test_decompose_size_special_unitary"
-    "test_api_retry_5xx_errors"
-    "test_xeb_fidelity"
-    "test_example_runs_phase_estimator_perf"
-    "test_cross_entropy_benchmarking"
-  ];
-
-  meta = with lib; {
-    description = "A framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits.";
-    homepage = "https://github.com/quantumlib/cirq";
-    changelog = "https://github.com/quantumlib/Cirq/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
-  };
 }
--- a/pkgs/development/python-modules/clvm-rs/default.nix
+++ b/pkgs/development/python-modules/clvm-rs/default.nix
@ -0,0 +1,47 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, rustPlatform
+, pythonOlder
+, openssl
+, perl
+}:
+
+buildPythonPackage rec {
+  pname = "clvm_rs";
+  version = "0.1.7";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "Chia-Network";
+    repo = "clvm_rs";
+    rev = version;
+    sha256 = "sha256-ves23q1uQ3lexwK9l1xGRss05jYObJDi/aY9Yvp4aPU=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-3kPzM2EX61ZvU6VKXY1OG/ic+9FU3Et4RuKp+3QYzSo=";
+  };
+
+  format = "pyproject";
+
+  nativeBuildInputs = [
+    perl # used by openssl-sys to configure
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ]);
+
+  buildInputs = [ openssl ];
+
+  pythonImportsCheck = [ "clvm_rs" ];
+
+  meta = with lib; {
+    homepage = "https://chialisp.com/";
+    description = "Rust implementation of clvm";
+    license = licenses.asl20;
+    maintainers = teams.chia.members;
+  };
+}
--- a/pkgs/development/python-modules/clvm-tools/default.nix
+++ b/pkgs/development/python-modules/clvm-tools/default.nix
@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, clvm
+, setuptools-scm
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "clvm_tools";
+  version = "0.4.3";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "Chia-Network";
+    repo = "clvm_tools";
+    rev = version;
+    sha256 = "sha256-bWz3YCrakob/kROq+LOA+yD1wtIbInVrmDqtg4/cV4g=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    clvm
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "clvm_tools"
+  ];
+
+  disabledTests = [
+    "test_cmd_unknown-1_txt"
+  ];
+
+  # give a hint to setuptools_scm on package version
+  SETUPTOOLS_SCM_PRETEND_VERSION="v${version}";
+
+  meta = with lib; {
+    description = "Tools for clvm development";
+    homepage = "https://www.chialisp.com/";
+    license = licenses.asl20;
+    maintainers = teams.chia.members;
+  };
+}
--- a/pkgs/development/python-modules/clvm/default.nix
+++ b/pkgs/development/python-modules/clvm/default.nix
@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, blspy
+, setuptools-scm
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "clvm";
+  version = "0.9.6";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "Chia-Network";
+    repo = "clvm";
+    rev = version;
+    sha256 = "sha256-XBQEilDFhx0kT9bEMD4jX+SDk3cAC1BUCWhbtpgrLcA=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  # give a hint to setuptools_scm on package version
+  SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
+
+  propagatedBuildInputs = [
+    blspy
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # all tests in this file have a circular dependency on clvm-tools
+    "tests/cmds_test.py"
+  ];
+
+  pythonImportsCheck = [
+    "clvm"
+  ];
+
+  meta = with lib; {
+    description = "Chia Lisp virtual machine";
+    homepage = "https://www.chia.net/";
+    license = licenses.asl20;
+    maintainers = teams.chia.members;
+  };
+}
--- a/pkgs/development/python-modules/concurrent-log-handler/default.nix
+++ b/pkgs/development/python-modules/concurrent-log-handler/default.nix
@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, portalocker
+}:
+
+buildPythonPackage rec {
+  pname = "concurrent-log-handler";
+  version = "0.9.19";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-sS95q+0/lBIcJc6cJM21fYiSguxv9h9VNasgaNw31Ak=";
+  };
+
+  propagatedBuildInputs = [
+    portalocker
+  ];
+
+  pythonImportsCheck = [
+    "concurrent_log_handler"
+  ];
+
+  doCheck = false; # upstream has no tests
+
+  meta = with lib; {
+    description = "Python logging handler that allows multiple processes to safely write to the same log file concurrently";
+    homepage = "https://www.chia.net/";
+    license = licenses.asl20;
+    maintainers = teams.chia.members;
+  };
+}
--- a/pkgs/development/python-modules/coqpit/default.nix
+++ b/pkgs/development/python-modules/coqpit/default.nix
@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "coqpit";
+  version = "0.0.6.6";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "coqui-ai";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0wb5wf84i5h4ycm732kn4316v7schhm91s2rrklfw9sny5dqmdnh";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "coqpit"
+    "coqpit.coqpit"
+  ];
+
+  meta = with lib; {
+    description = "Simple but maybe too simple config management through python data classes";
+    longDescription = ''
+      Simple, light-weight and no dependency config handling through python data classes with to/from JSON serialization/deserialization.
+    '';
+    homepage = "https://github.com/coqui-ai/coqpit";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa mic92 ];
+  };
+}
--- a/pkgs/development/python-modules/hdbscan/default.nix
+++ b/pkgs/development/python-modules/hdbscan/default.nix
@ -35,6 +35,12 @@ buildPythonPackage rec {
    rm __init__.py
  '';
  checkInputs = [ pytestCheckHook ];
+  disabledTests = [
+    # known flaky tests: https://github.com/scikit-learn-contrib/hdbscan/issues/420
+    "test_mem_vec_diff_clusters"
+    "test_all_points_mem_vec_diff_clusters"
+    "test_approx_predict_diff_clusters"
+  ];

  meta = with lib; {
    description = "Hierarchical Density-Based Spatial Clustering of Applications with Noise, a clustering algorithm with a scikit-learn compatible API";
--- a/pkgs/development/python-modules/karton-autoit-ripper/default.nix
+++ b/pkgs/development/python-modules/karton-autoit-ripper/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "karton-autoit-ripper";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "CERT-Polska";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0vdsxkbjcr0inpcfjh45gl72ipzklkhgs06fdpkyy9y0cfx3zq7z";
+    sha256 = "1bsqpf9w6d9fjysmnafaglg2w41gsafs2xz4dzcgc7n92shpcs8w";
  };

  propagatedBuildInputs = [
@ -28,7 +28,6 @@ buildPythonPackage rec {
  postPatch = ''
    substituteInPlace requirements.txt \
      --replace "autoit-ripper==1.0.0" "autoit-ripper" \
-      --replace "karton.core==4.0.4" "karton-core" \
      --replace "malduck==3.1.0" "malduck>=3.1.0" \
      --replace "regex==2020.2.20" "regex>=2020.2.20"
  '';
--- a/pkgs/development/python-modules/keyrings-cryptfile/default.nix
+++ b/pkgs/development/python-modules/keyrings-cryptfile/default.nix
@ -0,0 +1,59 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, argon2_cffi
+, keyring
+, pycryptodome
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "keyrings.cryptfile";
+  # NOTE: newer releases are bugged/incompatible
+  # https://github.com/frispete/keyrings.cryptfile/issues/15
+  version = "1.3.4";
+  disabled = pythonOlder "3.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-jW+cKMm+xef8C+fl0CGe+6SEkYBHDjFX2/kLCZ62j6c=";
+  };
+
+  patches = [
+    # upstream setup.cfg has an option that is not supported
+    ./fix-testsuite.patch
+    # change of API in keyrings.testing
+    (fetchpatch {
+      url = "https://github.com/frispete/keyrings.cryptfile/commit/6fb9e45f559b8b69f7a0a519c0bece6324471d79.patch";
+      sha256 = "sha256-1878pMO9Ed1zs1pl+7gMjwx77HbDHdE1CryN8TPfPdU=";
+    })
+  ];
+
+  propagatedBuildInputs = [
+    argon2_cffi
+    keyring
+    pycryptodome
+  ];
+
+  pythonImportsCheck = [
+    "keyrings.cryptfile"
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    "test_set_properties"
+    "UncryptedFileKeyringTestCase"
+  ];
+
+  meta = with lib; {
+    description = "Encrypted file keyring backend";
+    homepage = "https://github.com/frispete/keyrings.cryptfile";
+    license = licenses.mit;
+    maintainers = teams.chia.members;
+  };
+}
--- a/pkgs/development/python-modules/keyrings-cryptfile/fix-testsuite.patch
+++ b/pkgs/development/python-modules/keyrings-cryptfile/fix-testsuite.patch
@ -0,0 +1,14 @@
+diff --git a/setup.cfg b/setup.cfg
+index ec7eb30..7ffd831 100644
+--- a/setup.cfg
+++ b/setup.cfg
+@@ -5,9 +5,6 @@ dists = clean --all sdist bdist_wheel
+ [wheel]
+ universal = 1
+ 
+-[tool:pytest]
+-addopts = -s --cov=keyrings/cryptfile
+-
+ [egg_info]
+ tag_build = 
+ tag_date = 0
--- a/pkgs/development/python-modules/nassl/default.nix
+++ b/pkgs/development/python-modules/nassl/default.nix
@ -90,7 +90,7 @@ buildPythonPackage rec {
      ${opensslLegacyStatic.out}/lib/libcrypto.a \
      deps/openssl-OpenSSL_${legacyOpenSSLVersion}/
    ln -s ${opensslLegacyStatic.out.dev}/include deps/openssl-OpenSSL_${legacyOpenSSLVersion}/include
-    ln -s ${opensslLegacyStatic.bin} deps/openssl-OpenSSL_${legacyOpenSSLVersion}/apps
+    ln -s ${opensslLegacyStatic.bin}/bin deps/openssl-OpenSSL_${legacyOpenSSLVersion}/apps

    mkdir -p deps/openssl-OpenSSL_${modernOpenSSLVersion}/
    cp ${opensslStatic.out}/lib/libssl.a \
--- a/pkgs/development/python-modules/phonemizer/default.nix
+++ b/pkgs/development/python-modules/phonemizer/default.nix
@ -65,6 +65,6 @@ buildPythonApplication rec {
    homepage = "https://github.com/bootphon/phonemizer";
    description = "Simple text to phones converter for multiple languages";
    license = licenses.gpl3;
-    maintainers = with maintainers; [ hexa ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/segments/default.nix
+++ b/pkgs/development/python-modules/segments/default.nix
@ -42,6 +42,6 @@ buildPythonPackage rec {
    description = "Unicode Standard tokenization routines and orthography profile segmentation";
    homepage = "https://github.com/cldf/segments";
    license = licenses.asl20;
-    maintainers = with maintainers; [ hexa ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/vdirsyncer/default.nix
+++ b/pkgs/development/python-modules/vdirsyncer/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , isPy27
 , click
 , click-log
@ -45,6 +46,14 @@ buildPythonPackage rec {
    pytest-subtesthack
  ];

+  patches = [
+    (fetchpatch {
+      name = "update-usage-deprecated-method.patch";
+      url = "https://github.com/pimutils/vdirsyncer/commit/7577fa21177442aacc2d86640ef28cebf1c4aaef.patch";
+      sha256 = "0inkr1wfal20kssij8l5myhpjivxg8wlvhppqc3lvml9d1i75qbh";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace setup.py --replace "click>=5.0,<6.0" "click"
  '';
--- a/pkgs/development/python-modules/ytmusicapi/default.nix
+++ b/pkgs/development/python-modules/ytmusicapi/default.nix
@ -7,13 +7,13 @@

 buildPythonPackage rec {
  pname = "ytmusicapi";
-  version = "0.16.0";
+  version = "0.17.1";

  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-/94/taeBI6xZ3uN/wfMnk/NPmk+j0+aaH8CAZBEsK10=";
+    sha256 = "sha256-b5+AGf9qFqQbx4Rq4RovK2NllYsB+sXVMFU4AvbDkzI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/bacon/default.nix
+++ b/pkgs/development/tools/bacon/default.nix
@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, CoreServices }:

 rustPlatform.buildRustPackage rec {
  pname = "bacon";
@ -13,6 +13,8 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "1pii5ajl3xgylrm20pkwbd1lk7gv0pshl1cxjfna0l63q56v7f21";

+  buildInputs = lib.optional stdenv.isDarwin CoreServices;
+
  meta = with lib; {
    description = "Background rust code checker";
    homepage = "https://github.com/Canop/bacon";
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@ -101,6 +101,7 @@ rec {
    i686-linux = "b76e69ad4b654384b4f1647f0cb362e78c1d99be7b814d7d32abc22294639ace";
    armv7l-linux = "cc4be8e0c348bc8db5002cf6c63c1d02fcb594f1f8bfc358168738c930098857";
    aarch64-linux = "75665dd5b2b9938bb4572344d459db65f46c5f7c637a32946c5a822cc23a77dc";
+    aarch64-darwin = "0c782b1d4eb848bae780f4e3a236caa1671486264c1f8e72fde98f1256d8f9e5";
    headers = "0ip1wxgflifs86vk4xpz1555xa7yjy64ygqgd5a2g723148m52rk";
  };

@ -110,6 +111,7 @@ rec {
    i686-linux = "16023d86b88c7fccafd491c020d064caa2138d6a3493664739714555f72e5b06";
    armv7l-linux = "53cc1250ff62f2353d8dd37552cbd7bdcaaa756106faee8b809303bed00e040a";
    aarch64-linux = "3eddc0c507a43cce4e714bfe509d99218b5ab99f4660dd173aac2a895576dc71";
+    aarch64-darwin = "2bc8f37af68e220f93fb9abc62d1c56d8b64baaf0ef9ef974f24ddcbe4f8b488";
    headers = "1ji9aj7qr4b27m5kprsgsrl21rjphz5bbnmn6q0n2x84l429nyfb";
  };
 }
--- a/pkgs/development/tools/electron/generic.nix
+++ b/pkgs/development/tools/electron/generic.nix
@ -26,7 +26,8 @@ let
    homepage = "https://github.com/electron/electron";
    license = licenses.mit;
    maintainers = with maintainers; [ travisbhartwell manveru prusnak ];
-    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
+    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ]
+      ++ optionals (versionAtLeast version "11.0.0") [ "aarch64-darwin" ];
    knownVulnerabilities = optional (versionOlder version "6.0.0") "Electron version ${version} is EOL";
  };

@ -46,6 +47,7 @@ let
    armv7l-linux = "linux-armv7l";
    aarch64-linux = "linux-arm64";
    x86_64-darwin = "darwin-x64";
+    aarch64-darwin = "darwin-arm64";
  };

  get = as: platform: as.${platform.system} or
--- a/pkgs/development/tools/electron/print-hashes.sh
+++ b/pkgs/development/tools/electron/print-hashes.sh
@ -17,6 +17,7 @@ SYSTEMS=(
    [armv7l-linux]=linux-armv7l
    [aarch64-linux]=linux-arm64
    [x86_64-darwin]=darwin-x64
+    [aarch64-darwin]=darwin-arm64
 )

 hashfile="$(nix-prefetch-url --print-path "https://github.com/electron/electron/releases/download/v${VERSION}/SHASUMS256.txt" 2>/dev/null | tail -n1)"
@ -27,8 +28,10 @@ headers="$(nix-prefetch-url "https://atom.io/download/electron/v${VERSION}/node-
 echo "  electron_${VERSION%%.*} = mkElectron \"${VERSION}\" {"

 for S in "${!SYSTEMS[@]}"; do
-  hash="$(grep " *electron-v${VERSION}-${SYSTEMS[$S]}.zip$" "$hashfile"|cut -f1 -d' ')"
-  echo "    $S = \"$hash\";"
+  hash="$(grep " *electron-v${VERSION}-${SYSTEMS[$S]}.zip$" "$hashfile"|cut -f1 -d' ' || :)"
+  if [[ -n $hash ]]; then
+    echo "    $S = \"$hash\";"
+  fi
 done

 echo "    headers = \"$headers\";"
--- a/pkgs/development/tools/metals/default.nix
+++ b/pkgs/development/tools/metals/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "metals";
-  version = "0.10.2";
+  version = "0.10.3";

  deps = stdenv.mkDerivation {
    name = "${pname}-deps-${version}";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    '';
    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash     = "1yck935pcj9cg3qxzrmvgd16afsckz8wgmzf2rlmii2c1glrbq9c";
+    outputHash     = "1psmsiwd3xlbrvkdvr2zgs2b66kw8w2jvvqa399g7jhixh2fpbx4";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/mix2nix/default.nix
+++ b/pkgs/development/tools/mix2nix/default.nix
@ -0,0 +1,25 @@
+{ stdenv, lib, fetchFromGitHub, elixir, erlang }:
+
+stdenv.mkDerivation rec {
+  pname = "mix2nix";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "ydlr";
+    repo = "mix2nix";
+    rev = version;
+    sha256 = "11qn80im5zfbx25ibxqrgi90mglf8pnsmrqsami633mcf2gvj2hy";
+  };
+
+  nativeBuildInputs = [ elixir ];
+  buildInputs = [ erlang ];
+
+  buildPhase = "mix escript.build";
+  installPhase = "install -Dt $out/bin mix2nix";
+
+  meta = with lib; {
+    description = "Generate nix expressions from mix.lock file.";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ydlr ] ++ teams.beam.members;
+  };
+}
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@ -14,13 +14,13 @@

 buildGoModule rec {
  pname = "skopeo";
-  version = "1.2.3";
+  version = "1.3.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "containers";
    repo = "skopeo";
-    sha256 = "sha256-GhLw8wt5eDixKNGtxGA0Fjw3auQ3AsjKa+0M4mLTQlg=";
+    sha256 = "sha256-ZHEujkl+GUk5WjgDWdbJwOIKuOqJnIpGnvD1SsrHuhI=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/development/tools/yarn2nix-moretea/fetch-source.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/fetch-source.nix
@ -1,10 +0,0 @@
-{ pkgs ? (import ../../../../. {})
-, fetchFromGitHub ? pkgs.fetchFromGitHub
-}:
-
-fetchFromGitHub {
-  owner  = "moretea";
-  repo   = "yarn2nix";
-  rev    = "9e7279edde2a4e0f5ec04c53f5cd64440a27a1ae";
-  sha256 = "0zz2lrwn3y3rb8gzaiwxgz02dvy3s552zc70zvfqc0zh5dhydgn7";
-}
--- a/pkgs/development/tools/yarn2nix-moretea/generate.sh
+++ b/pkgs/development/tools/yarn2nix-moretea/generate.sh
@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-
-###
-### This script runs 'nix-build' with ./fetch-source.nix and copies a subset
-### of the resulting store path into the current working directory.
-###
-### To disable running chmod, you may set the environment
-### variable "FIX_RIGHTS" to "no".
-###
-
-set -euo pipefail
-
-# 'nix-build' command
-NIX_BUILD_BIN="${NIX_BUILD_BIN:-"/usr/bin/env nix-build"}"
-
-# where to place the yarn2nix source
-TARGET_DIR="${TARGET_DIR:-"./yarn2nix"}"
-
-# whether to run 'chmod -R u=rwX,g=rX,o-rwx' on copied files in $TARGET_DIR
-FIX_RIGHTS="${FIX_RIGHTS:-"yes"}"
-
-fetch_git_source() {
-  [[ -f ./fetch-source.nix ]] && ret="$($NIX_BUILD_BIN --no-out-link ./fetch-source.nix)" && ec="$?" || ec="$?"
-  if [[ "$ec" == "0" ]]; then
-    echo "$ret"
-  else
-    printf "error: failed at 'fetch_git_source()' with '%s'" "$ret"
-  fi
-}
-
-result="$(fetch_git_source)"
-if [[ "$result" == "/nix/store"* ]]; then
-  mkdir -p "$TARGET_DIR"
-  cp -Rv \
-    "${result}/"{bin,internal,lib,nix,default.nix,package.json,yarn.nix,yarn.lock,LICENSE.txt} \
-    "$TARGET_DIR"
-  [[ "$FIX_RIGHTS" = "yes" ]] \
-    && chmod -v "u=rwX,g=rX,o-rwx" -R \
-    "$TARGET_DIR/"{bin,internal,lib,nix,default.nix,package.json,yarn.nix,yarn.lock,LICENSE.txt}
-fi
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
@ -22,8 +22,8 @@ function urlToName(url) {
  }

  return url
-    .replace('https://registry.yarnpkg.com/', '') // prevents having long directory names
-    .replace(/[@/:-]/g, '_') // replace @ and : and - characters with underscore
+    .replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
+    .replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
 }

 module.exports = urlToName
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/yarn.lock
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/yarn.lock
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/yarn.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/yarn.nix
--- a/pkgs/development/web/nodejs/v14.nix
+++ b/pkgs/development/web/nodejs/v14.nix
@ -8,7 +8,7 @@ let
 in
  buildNodejs {
    inherit enableNpm;
-    version = "14.16.1";
-    sha256 = "1hxsk83g2plv6vv3ir1ngca0rwqdy3lq70r504d2qv3msszdnjp4";
+    version = "14.17.0";
+    sha256 = "1vf989canwcx0wdpngvkbz2x232yccp7fzs1vcbr60rijgzmpq2n";
    patches = lib.optional stdenv.isDarwin ./bypass-xcodebuild.diff;
  }
--- a/pkgs/development/web/nodejs/v16.nix
+++ b/pkgs/development/web/nodejs/v16.nix
@ -8,6 +8,6 @@ let
 in
  buildNodejs {
    inherit enableNpm;
-    version = "16.1.0";
-    sha256 = "0z0808mw674mshgbmhgngqfkrdix3b61f77xcdz7bwf1j87j7ad0";
+    version = "16.2.0";
+    sha256 = "1krm3cnpbnqg4mfl3cpp8x2i1rr6hba9qbl60wyg5f5g8ac3pyfh";
  }
--- a/pkgs/games/openmw/default.nix
+++ b/pkgs/games/openmw/default.nix
@ -1,5 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, qtbase, openscenegraph, mygui, bullet, ffmpeg_3
-, boost, cmake, SDL2, unshield, openal, libXt, pkg-config }:
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, pkg-config
+, openscenegraph
+, mygui
+, bullet
+, ffmpeg
+, boost
+, SDL2
+, unshield
+, openal
+, libXt
+}:

 let
  openscenegraph_ = openscenegraph.overrideDerivation (self: {
@ -11,9 +24,9 @@ let
      sha256 = "0d74hijzmj82nx3jkv5qmr3pkgvplra0b8fbjx1y3vmzxamb0axd";
    };
  });
-in

-stdenv.mkDerivation rec {
+in
+mkDerivation rec {
  version = "0.46.0";
  pname = "openmw";

@ -25,10 +38,23 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ boost ffmpeg_3 bullet mygui openscenegraph_ SDL2 unshield openal libXt qtbase ];
+
+  buildInputs = [
+    SDL2
+    boost
+    bullet
+    ffmpeg
+    libXt
+    mygui
+    openal
+    openscenegraph_
+    unshield
+  ];

  cmakeFlags = [
    "-DDESIRED_QT_VERSION:INT=5"
+    # as of 0.46, openmw is broken with GLVND
+    "-DOpenGL_GL_PREFERENCE=LEGACY"
  ];

  dontWrapQtApps = true;
@ -37,7 +63,7 @@ stdenv.mkDerivation rec {
    description = "An unofficial open source engine reimplementation of the game Morrowind";
    homepage = "http://openmw.org";
    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
    maintainers = with maintainers; [ abbradar ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/games/openmw/tes3mp.nix
+++ b/pkgs/games/openmw/tes3mp.nix
@ -1,96 +1,134 @@
-{ lib, stdenv, cmake, openmw, fetchFromGitHub, luajit, makeWrapper, mygui }:
+{ lib
+, stdenv
+, cmake
+, openmw
+, fetchFromGitHub
+, formats
+, luajit
+, makeWrapper
+, symlinkJoin
+, mygui
+, crudini
+}:

 # revisions are taken from https://github.com/GrimKriegor/TES3MP-deploy

 let
-  # TES3MP_STABLE_VERSION_FILE
-  compatHash = "292536439eeda58becdb7e441fe2e61ebb74529e";
-  rakNet = fetchFromGitHub {
-    owner = "TES3MP";
-    repo = "CrabNet";
-    # usually fixed:
-    # https://github.com/GrimKriegor/TES3MP-deploy/blob/d2a4a5d3acb64b16d9b8ca85906780aeea8d311b/tes3mp-deploy.sh#L589
-    rev = "4eeeaad2f6c11aeb82070df35169694b4fb7b04b";
-    sha256 = "0p0li9l1i5lcliswm5w9jql0zff9i6fwhiq0bl130m4i7vpr4cr3";
-  };
-  rakNetLibrary = stdenv.mkDerivation {
-    name = "RakNetLibrary";
-    src = rakNet;
-    nativeBuildInputs = [ cmake ];
-    installPhase = ''
-      install -Dm755 lib/libRakNetLibStatic.a $out/lib/libRakNetLibStatic.a
-    '';
-  };
-  coreScripts = fetchFromGitHub {
-    owner = "TES3MP";
-    repo = "CoreScripts";
-    # usually latest in stable branch (e.g. 0.7.0)
-    rev = "24aae91d9ddad38cdb3b0e0a13af59f142803e94";
-    sha256 = "1rfmxxr9ircfagdpbdrzl26msdhx1i3g974cblbv69078cradfh3";
-  };
-  # https://github.com/TES3MP/openmw-tes3mp/issues/555
-  mygui_ = mygui.overrideAttrs (oldAttrs: rec {
-    version = "3.2.2";
+  # raknet could also be split into dev and lib outputs
+  raknet = stdenv.mkDerivation {
+    pname = "raknet";
+    version = "unstable-2018-07-14";

    src = fetchFromGitHub {
-      owner = "MyGUI";
-      repo = "mygui";
-      rev = "MyGUI${version}";
-      sha256 = "1wk7jmwm55rhlqqcyvqsxdmwvl70bysl9azh4kd9n57qlmgk3zmw";
+      owner = "TES3MP";
+      repo = "CrabNet";
+      # usually fixed:
+      # https://github.com/GrimKriegor/TES3MP-deploy/blob/d2a4a5d3acb64b16d9b8ca85906780aeea8d311b/tes3mp-deploy.sh#L589
+      rev = "4eeeaad2f6c11aeb82070df35169694b4fb7b04b";
+      sha256 = "0p0li9l1i5lcliswm5w9jql0zff9i6fwhiq0bl130m4i7vpr4cr3";
+    };
+
+    nativeBuildInputs = [ cmake ];
+
+    installPhase = ''
+      install -Dm555 lib/libRakNetLibStatic.a $out/lib/libRakNetLibStatic.a
+    '';
+  };
+
+  coreScripts = stdenv.mkDerivation {
+    pname = "corescripts";
+    version = "unstable-2020-07-27";
+
+    src = fetchFromGitHub {
+      owner = "TES3MP";
+      repo = "CoreScripts";
+      # usually latest in stable branch (e.g. 0.7.1)
+      rev = "3c2d31595344db586d8585db0ef1fc0da89898a0";
+      sha256 = "sha256-m/pt2Et58HOMc1xqllGf4hjPLXNcc14+X0h84ouZDeg=";
+    };
+
+    buildCommand = ''
+      dir=$out/share/openmw-tes3mp
+      mkdir -p $dir
+      cp -r $src $dir/CoreScripts
+    '';
+  };
+
+  # build an unwrapped version so we don't have to rebuild it all over again in
+  # case the scripts or wrapper scripts change.
+  unwrapped = openmw.overrideAttrs (oldAttrs: rec {
+    pname = "openmw-tes3mp-unwrapped";
+    version = "unstable-2020-08-07";
+
+    src = fetchFromGitHub {
+      owner = "TES3MP";
+      repo = "openmw-tes3mp";
+      # usually latest in stable branch (e.g. 0.7.1)
+      rev = "ce5df6d18546e37aac9746d99c00d27a7f34b00d";
+      sha256 = "sha256-xLslShNA6rVFl9kt6BNGDpSYMpO25jBTCteLJoSTXdg=";
+    };
+
+    nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ makeWrapper ];
+
+    buildInputs = oldAttrs.buildInputs ++ [ luajit ];
+
+    cmakeFlags = oldAttrs.cmakeFlags ++ [
+      "-DBUILD_OPENCS=OFF"
+      "-DRakNet_INCLUDES=${raknet.src}/include"
+      "-DRakNet_LIBRARY_RELEASE=${raknet}/lib/libRakNetLibStatic.a"
+      "-DRakNet_LIBRARY_DEBUG=${raknet}/lib/libRakNetLibStatic.a"
+    ];
+
+    # https://github.com/TES3MP/openmw-tes3mp/issues/552
+    patches = [ ./tes3mp.patch ];
+
+    NIX_CFLAGS_COMPILE = "-fpermissive";
+
+    preConfigure = ''
+      substituteInPlace files/version.in \
+        --subst-var-by OPENMW_VERSION_COMMITHASH ${src.rev}
+    '';
+
+    # move everything that we wrap out of the way
+    postInstall = ''
+      mkdir -p $out/libexec
+      mv $out/bin/tes3mp-* $out/libexec
+    '';
+
+    meta = with lib; {
+      description = "Multiplayer for TES3:Morrowind based on OpenMW";
+      homepage = "https://tes3mp.com/";
+      license = licenses.gpl3Only;
+      maintainers = with maintainers; [ peterhoeg ];
+      platforms = [ "x86_64-linux" "i686-linux" ];
    };
  });
-in openmw.overrideAttrs (oldAttrs: rec {
-  version = "2019-11-19";
-  name = "openmw-tes3mp-${version}";

-  src = fetchFromGitHub {
-    owner = "TES3MP";
-    repo = "openmw-tes3mp";
-    # usually latest in stable branch (e.g. 0.7.0)
-    rev = "ad9ee80641a3e22d0780daca051df7f4e90f3615";
-    sha256 = "03a1vldiv5lk7yq6lhicx3qz8hjfxhind2dj0w9lg5839ljyk6jv";
+  cfgFile = (formats.ini { }).generate "tes3mp-server.cfg" {
+    Plugins.home = "${coreScripts}/share/openmw-tes3mp/CoreScripts";
  };

-  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ makeWrapper ];
-  buildInputs = [ luajit mygui_ ] ++ oldAttrs.buildInputs;
+in
+symlinkJoin rec {
+  name = "openmw-tes3mp-${unwrapped.version}";
+  inherit (unwrapped) version meta;

-  cmakeFlags = oldAttrs.cmakeFlags ++ [
-    "-DBUILD_OPENCS=OFF"
-    "-DRakNet_INCLUDES=${rakNet}/include"
-    "-DRakNet_LIBRARY_RELEASE=${rakNetLibrary}/lib/libRakNetLibStatic.a"
-    "-DRakNet_LIBRARY_DEBUG=${rakNetLibrary}/lib/libRakNetLibStatic.a"
-  ];
+  nativeBuildInputs = [ makeWrapper ];

-  dontWrapQtApps = true;
+  paths = [ unwrapped ];

-  # https://github.com/TES3MP/openmw-tes3mp/issues/552
-  patches = [
-    ./tes3mp.patch
-  ];
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  # crudini --merge will create the file if it doesn't exist
+  postBuild = ''
+    mkdir -p $out/bin

-  preConfigure = ''
-    substituteInPlace files/version.in \
-      --subst-var-by OPENMW_VERSION_COMMITHASH ${compatHash}
-  '';
+    dir=\''${XDG_CONFIG_HOME:-\$HOME/.config}/openmw

-  postInstall = ''
-    # components/process/processinvoker.cpp: path.prepend(QLatin1String("./"))
-    wrapProgram $out/bin/tes3mp-browser \
+    makeWrapper ${unwrapped}/libexec/tes3mp-browser $out/bin/tes3mp-browser \
      --run "cd $out/bin"
-    wrapProgram $out/bin/tes3mp-server \
-      --run "mkdir -p ~/.config/openmw" \
-      --run "cd ~/.config/openmw" \
-      --run "[ -d CoreScripts ] || cp --no-preserve=mode -r ${coreScripts} CoreScripts" \
-      --run "[ -f tes3mp-server.cfg ] || echo \"[Plugins] home = \$HOME/.config/openmw/CoreScripts\" > tes3mp-server.cfg" \
+
+    makeWrapper ${unwrapped}/libexec/tes3mp-server $out/bin/tes3mp-server \
+      --run "mkdir -p $dir" \
+      --run "${crudini}/bin/crudini --merge $dir/${cfgFile.name} < ${cfgFile}" \
      --run "cd $out/bin"
  '';
-
-  meta = with lib; {
-    description = "Multiplayer for TES3:Morrowind based on OpenMW";
-    homepage = "https://tes3mp.com/";
-    license = licenses.gpl3;
-    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ ];
-  };
-})
+}
--- a/pkgs/games/r2mod_cli/default.nix
+++ b/pkgs/games/r2mod_cli/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "r2mod_cli";
-  version = "1.0.7";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "Foldex";
    repo = "r2mod_cli";
    rev = "v${version}";
-    sha256 = "13n2y9gsgb8hnr64y083x9c90j3b4awcmdn81mqmwcydpby3q848";
+    sha256 = "sha256-VNqdVDBR6+eNOeUthPXLfz+0VoaNfSj4f04HLvjg6/0=";
  };

  buildInputs = [ bashInteractive ];
--- a/pkgs/misc/emulators/retroarch/default.nix
+++ b/pkgs/misc/emulators/retroarch/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, which, pkg-config, makeWrapper
-, ffmpeg_3, libGLU, libGL, freetype, libxml2, python3
+, ffmpeg, libGLU, libGL, freetype, libxml2, python3
 , libobjc, AppKit, Foundation
 , alsaLib ? null
 , libdrm ? null
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkg-config wayland ]
                      ++ optional withVulkan makeWrapper;

-  buildInputs = [ ffmpeg_3 freetype libxml2 libGLU libGL python3 SDL2 which ]
+  buildInputs = [ ffmpeg freetype libxml2 libGLU libGL python3 SDL2 which ]
                ++ optional enableNvidiaCgToolkit nvidia_cg_toolkit
                ++ optional withVulkan vulkan-loader
                ++ optionals stdenv.isDarwin [ libobjc AppKit Foundation ]
--- a/pkgs/os-specific/linux/hid-nintendo/default.nix
+++ b/pkgs/os-specific/linux/hid-nintendo/default.nix
@ -0,0 +1,38 @@
+{ lib, stdenv, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "hid-nintendo";
+  version = "3.1";
+
+  src = fetchFromGitHub {
+    owner = "nicman23";
+    repo = "dkms-hid-nintendo";
+    rev = version;
+    sha256 = "sha256-IanH3yHfkQhqtKvKD8lh+muc9yX8XJ5bfdy1Or8Vd5g=";
+  };
+
+  setSourceRoot = ''
+    export sourceRoot=$(pwd)/source/src
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "-C"
+    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(sourceRoot)"
+  ];
+
+  buildFlags = [ "modules" ];
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  meta = with lib; {
+    description = "A Nintendo HID kernel module";
+    homepage = "https://github.com/nicman23/dkms-hid-nintendo";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.rencire ];
+    platforms = platforms.linux;
+    broken = versionOlder kernel.version "4.14";
+  };
+}
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@ -12,15 +12,17 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ bc nukeReferences ];
+
  buildInputs = kernel.moduleBuildDependencies;

  hardeningDisable = [ "pic" "format" ];

  prePatch = ''
-    substituteInPlace ./Makefile --replace /lib/modules/ "${kernel.dev}/lib/modules/"
-    substituteInPlace ./Makefile --replace '$(shell uname -r)' "${kernel.modDirVersion}"
-    substituteInPlace ./Makefile --replace /sbin/depmod \#
-    substituteInPlace ./Makefile --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+    substituteInPlace ./Makefile \
+      --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
+      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
+      --replace /sbin/depmod \# \
+      --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
  '';

  makeFlags = [
@ -45,7 +47,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/gordboy/rtl8812au-5.9.3.2";
    license = licenses.gpl2Only;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ fortuneteller2k ];
    broken = kernel.kernelOlder "4.10" || kernel.isHardened;
  };
 }
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@ -1,13 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc }:
+
 stdenv.mkDerivation rec {
-  name = "rtl8821cu-${kernel.version}-${version}";
-  version = "unstable-2020-12-21";
+  pname = "rtl8821cu";
+  version = "${kernel.version}-unstable-2021-05-19";

  src = fetchFromGitHub {
-    owner = "brektrou";
-    repo = "rtl8821cu";
-    rev = "428a0820487418ec69c0edb91726d1cf19763b1e";
-    sha256 = "1ccl94727yq7gzn37ky91k0736cambgnkaa37r2f2hinpl9qdd8q";
+    owner = "morrownr";
+    repo = "8821cu";
+    rev = "2430c354c9b15fa6193a263c99ce57211d50c66f";
+    sha256 = "sha256-PkrpwebZYh/hBukqDQf6pxfbkVyA+CpYtte5pmzgLtw=";
  };

  hardeningDisable = [ "pic" ];
@ -29,8 +30,8 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Realtek rtl8821cu driver";
-    homepage = "https://github.com/brektrou/rtl8821CU";
-    license = licenses.gpl2;
+    homepage = "https://github.com/morrownr/8821cu";
+    license = licenses.gpl2Only;
    platforms = platforms.linux;
    maintainers = [ maintainers.contrun ];
  };
--- a/pkgs/servers/clickhouse/default.nix
+++ b/pkgs/servers/clickhouse/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, libtool, llvm-bintools, ninja
+{ lib, stdenv, fetchFromGitHub, cmake, libtool, llvm-bintools, ninja
 , boost, brotli, capnproto, cctz, clang-unwrapped, double-conversion
 , icu, jemalloc, libcpuid, libxml2, lld, llvm, lz4, libmysqlclient, openssl, perl
 , poco, protobuf, python3, rapidjson, re2, rdkafka, readline, sparsehash, unixODBC
@ -7,16 +7,16 @@

 stdenv.mkDerivation rec {
  pname = "clickhouse";
-  version = "20.11.4.13";
+  version = "21.3.11.5";

  broken = stdenv.buildPlatform.is32bit; # not supposed to work on 32-bit https://github.com/ClickHouse/ClickHouse/pull/23959#issuecomment-835343685

  src = fetchFromGitHub {
    owner  = "ClickHouse";
    repo   = "ClickHouse";
-    rev    = "v${version}-stable";
+    rev    = "v${version}-lts";
    fetchSubmodules = true;
-    sha256 = "0c87k0xqwj9sc3xy2f3ngfszgjiz4rzd787bdg6fxp94w1adjhny";
+    sha256 = "sha256-V62Z82p21qtvSOsoXM225/Wkc9F+dvVMz0xpVjhgZVo=";
  };

  nativeBuildInputs = [ cmake libtool llvm-bintools ninja ];
@ -27,20 +27,9 @@ stdenv.mkDerivation rec {
    xxHash zstd
  ];

-  patches = [
-    # This patch is only required for 20.11.4.13 - it should be included in the
-    # next stable release from upstream by default
-    (fetchpatch {
-      url = "https://github.com/ClickHouse/ClickHouse/commit/e31753b4db7aa0a72a85757dc11fc403962e30db.patch";
-      sha256 = "12ax02dh9y9k8smkj6v50yfr46iprscbrvd4bb9vfbx8xqgw7grb";
-    })
-  ];
-
  postPatch = ''
    patchShebangs src/

-    substituteInPlace contrib/openssl-cmake/CMakeLists.txt \
-      --replace '/usr/bin/env perl' perl
    substituteInPlace src/Storages/System/StorageSystemLicenses.sh \
      --replace 'git rev-parse --show-toplevel' '$src'
    substituteInPlace utils/check-style/check-duplicate-includes.sh \
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@ -10,11 +10,11 @@ assert enablePython -> python3 != null;

 stdenv.mkDerivation rec {
  pname = "bind";
-  version = "9.16.15";
+  version = "9.16.16";

  src = fetchurl {
    url = "https://downloads.isc.org/isc/bind9/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0fbqisrh84f8wszm94cqp7v8q9r7pql3qyzbay7vz9vqv0rg9dlq";
+    sha256 = "sha256-bJE5Aq34eOfcXiKc6pT678nUD0R3WjAhPt0Ihg92HXs=";
  };

  outputs = [ "out" "lib" "dev" "man" "dnsutils" "host" ];
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "jackett";
-  version = "0.18.15";
+  version = "0.18.95";

  src = fetchurl {
    url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "sha256-z2xmF4FIv+z7ybPE7b8ZeC1+jlFi2H2J7HT09Bqyyhs=";
+    sha256 = "sha256-8TkIixPot4V0h4MBh/+WdrWhjgsqyq9wHQyGyfxqZ6s=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/servers/mail/opensmtpd/default.nix
+++ b/pkgs/servers/mail/opensmtpd/default.nix
@ -62,5 +62,6 @@ stdenv.mkDerivation rec {
  };
  passthru.tests = {
    basic-functionality-and-dovecot-interaction = nixosTests.opensmtpd;
+    rspamd-integration = nixosTests.opensmtpd-rspamd;
  };
 }
--- a/pkgs/servers/mail/opensmtpd/filter-rspamd.nix
+++ b/pkgs/servers/mail/opensmtpd/filter-rspamd.nix
@ -0,0 +1,30 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+,  nixosTests
+}:
+
+buildGoModule rec {
+  pname = "opensmtpd-filter-rspamd";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    owner = "poolpOrg";
+    repo = "filter-rspamd";
+    rev = "v${version}";
+    sha256 = "pcHj4utpf/AIUv8/7mE8BLbE8LYkzNKfc4T4hIHgGeI=";
+  };
+
+  vendorSha256 = "sNF2c+22FMvKoROkA/3KtSnRdJh4YZLaIx35HD896HI=";
+
+  passthru.tests = {
+    opensmtpd-rspamd-integration = nixosTests.opensmtpd-rspamd;
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/poolpOrg/filter-rspamd";
+    description = "OpenSMTPD filter integration for the Rspamd daemon";
+    license = licenses.isc;
+    maintainers = with maintainers; [ Flakebi ];
+  };
+}
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@ -24,6 +24,8 @@ buildPythonApplication rec {
    ./homeserver-script.patch
  ];

+  buildInputs = [ openssl ];
+
  propagatedBuildInputs = [
    setuptools
    bcrypt
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "grafana";
-  version = "7.5.2";
+  version = "7.5.6";

  excludedPackages = [ "release_publisher" ];

@ -10,17 +10,24 @@ buildGoModule rec {
    rev = "v${version}";
    owner = "grafana";
    repo = "grafana";
-    sha256 = "sha256-8Qy5YgJZpvaAjeBAi092Jxg4yAD1fYmMteTRm5b0Q+g=";
+    sha256 = "1683as90p4zkzhaj52vy60bcmpr77zynys87mjzh3s6ks3xfxn2x";
  };

  srcStatic = fetchurl {
    url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-yVswMNOLX/AFtv45TXm8WcHEytyYgtjvi7V0dRewDdc=";
+    sha256 = "1mywvm4d116y56rffiywk1hx6wxj1418gf7q0v0hfdlwk1lqi9nz";
  };

-  vendorSha256 = "sha256-oh3GB6Iaqy05IS2MU5LJqTXnlr0vtkACZA6wpmW7W2Q=";
+  vendorSha256 = "01a5v292x59fmayjkqnf4c8k8viasxr2s2khs4yrv6p829lx3hq2";

+  # grafana-aws-sdk is specified with two versions which causes a problem later:
+  # go: inconsistent vendoring in /build/source:
+  #  github.com/grafana/grafana-aws-sdk@v0.3.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
+  # Remove the older one here to fix this.
  postPatch = ''
+    substituteInPlace go.mod \
+      --replace 'github.com/grafana/grafana-aws-sdk v0.3.0' ""
+
    substituteInPlace pkg/cmd/grafana-server/main.go \
      --replace 'var version = "5.0.0"'  'var version = "${version}"'
  '';
--- a/pkgs/servers/monitoring/prometheus/default.nix
+++ b/pkgs/servers/monitoring/prometheus/default.nix
@ -3,13 +3,13 @@
 }:

 let
-  version = "2.26.0";
+  version = "2.27.1";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "prometheus";
    repo = "prometheus";
-    sha256 = "06zr10zx3f526wcxj77smcl8wk55mhlnikd0b8vbjl9yyb0qc5mz";
+    sha256 = "0836ygyvld5skjycd7366i6vyf451s6cay5ng6c2fwq0skvp2gj2";
  };

  goPackagePath = "github.com/prometheus/prometheus";
@ -31,7 +31,7 @@ in buildGoModule rec {
  pname = "prometheus";
  inherit src version;

-  vendorSha256 = "0h14pmk74lxj7z39jb4xwvx3whwkaxn9686y23sgrpkra5sk6dbm";
+  vendorSha256 = "0dq3p7hga7m1aq78har5rr136hlb0kp8zhh2wzqlkxrk1f33w54p";

  excludedPackages = [ "documentation/prometheus-mixin" ];

--- a/pkgs/servers/monitoring/prometheus/webui-package.json
+++ b/pkgs/servers/monitoring/prometheus/webui-package.json
@ -15,27 +15,18 @@
    "@codemirror/search": "^0.18.2",
    "@codemirror/state": "^0.18.2",
    "@codemirror/view": "^0.18.3",
+    "@forevolve/bootstrap-dark": "^1.0.0",
    "@fortawesome/fontawesome-svg-core": "^1.2.14",
    "@fortawesome/free-solid-svg-icons": "^5.7.1",
    "@fortawesome/react-fontawesome": "^0.1.4",
    "@reach/router": "^1.2.1",
-    "@types/jest": "^26.0.10",
-    "@types/jquery": "^3.5.1",
-    "@types/node": "^12.11.1",
-    "@types/reach__router": "^1.2.6",
-    "@types/react": "^16.8.2",
-    "@types/react-copy-to-clipboard": "^5.0.0",
-    "@types/react-dom": "^16.8.0",
-    "@types/react-resize-detector": "^5.0.0",
-    "@types/sanitize-html": "^1.20.2",
-    "bootstrap": "^4.2.1",
-    "codemirror-promql": "^0.14.0",
+    "bootstrap": "^4.6.0",
+    "codemirror-promql": "^0.15.0",
    "css.escape": "^1.5.1",
    "downshift": "^3.4.8",
    "enzyme-to-json": "^3.4.3",
    "fuzzy": "^0.1.3",
    "i": "^0.3.6",
-    "jest-fetch-mock": "^3.0.3",
    "jquery": "^3.5.1",
    "jquery.flot.tooltip": "^0.9.0",
    "jsdom": "^16.4.0",
@ -48,11 +39,13 @@
    "react-resize-detector": "^5.0.7",
    "react-scripts": "3.4.4",
    "react-test-renderer": "^16.9.0",
-    "reactstrap": "^8.0.1",
-    "sanitize-html": "^1.20.1",
+    "reactstrap": "^8.9.0",
+    "sanitize-html": "^2.3.3",
+    "sass": "1.32.10",
    "tempusdominus-bootstrap-4": "^5.1.2",
    "tempusdominus-core": "^5.0.3",
-    "typescript": "^3.3.3"
+    "typescript": "^3.3.3",
+    "use-media": "^1.4.0"
  },
  "scripts": {
    "start": "react-scripts start",
@ -79,8 +72,17 @@
    "@types/enzyme": "^3.10.3",
    "@types/enzyme-adapter-react-16": "^1.0.5",
    "@types/flot": "0.0.31",
+    "@types/jest": "^26.0.10",
+    "@types/jquery": "^3.5.1",
    "@types/moment-timezone": "^0.5.10",
-    "@types/reactstrap": "^8.0.5",
+    "@types/node": "^12.11.1",
+    "@types/reach__router": "^1.2.6",
+    "@types/react": "^16.8.2",
+    "@types/react-copy-to-clipboard": "^5.0.0",
+    "@types/react-dom": "^16.8.0",
+    "@types/react-resize-detector": "^5.0.0",
+    "@types/reactstrap": "^8.7.2",
+    "@types/sanitize-html": "^1.20.2",
    "@types/sinon": "^9.0.4",
    "@typescript-eslint/eslint-plugin": "2.x",
    "@typescript-eslint/parser": "2.x",
--- a/pkgs/servers/monitoring/prometheus/webui-yarndeps.nix
+++ b/pkgs/servers/monitoring/prometheus/webui-yarndeps.nix
--- a/Show More
+++ b/Show More