Merge remote-tracking branch 'nixpkgs/staging-next' into staging

Conflicts: pkgs/development/python-modules/cupy/default.nix pkgs/development/python-modules/staticjinja/default.nix
2025-02-20 02:55:39 +00:00 · 2022-01-24 15:39:34 +00:00 · 2022-01-24 15:39:34 +00:00 · 1a60dd2adc
commit 1a60dd2adc
parent c0398d7617 2f14e11f3a
378 changed files with 9966 additions and 6483 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -280,6 +280,12 @@
 # terraform providers
 /pkgs/applications/networking/cluster/terraform-providers @zowoq

+# kubernetes
+/nixos/doc/manual/configuration/kubernetes.chapter.md @zowoq
+/nixos/modules/services/cluster/kubernetes            @zowoq
+/nixos/tests/kubernetes                               @zowoq
+/pkgs/applications/networking/cluster/kubernetes      @zowoq
+
 # Matrix
 /pkgs/servers/heisenbridge                                 @piegamesde
 /pkgs/servers/matrix-conduit                               @piegamesde @pstn
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -67,6 +67,11 @@ in mkLicense lset) ({
    free = false;
  };

+  aom = {
+    fullName = "Alliance for Open Media Patent License 1.0";
+    url = "https://aomedia.org/license/patent-license/";
+  };
+
  apsl20 = {
    spdxId = "APSL-2.0";
    fullName = "Apple Public Source License 2.0";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -515,6 +515,8 @@
  };
  algorith = {
    email = "dries_van_daele@telenet.be";
+    github = "DriesVanDaele";
+    githubId = 1141488;
    name = "Dries Van Daele";
  };
  alibabzo = {
@ -4571,6 +4573,12 @@
    githubId = 343415;
    name = "Greg Roodt";
  };
+  gruve-p = {
+    email = "groestlcoin@gmail.com";
+    github = "gruve-p";
+    githubId = 11212268;
+    name = "gruve-p";
+  };
  gschwartz = {
    email = "gsch@pennmedicine.upenn.edu";
    github = "GregorySchwartz";
@ -5709,6 +5717,24 @@
    githubId = 8900;
    name = "Johan Magnus Jonsson";
  };
+  jmc-figueira = {
+    email = "business+nixos@jmc-figueira.dev";
+    github = "jmc-figueira";
+    githubId = 6634716;
+    name = "João Figueira";
+    keys = [
+      # GitHub signing key
+      {
+        longkeyid = "rsa4096/0xDC7AE56AE98E02D7";
+        fingerprint = "EC08 7AA3 DEAD A972 F015  6371 DC7A E56A E98E 02D7";
+      }
+      # Email encryption
+      {
+        longkeyid = "ed25519/0x197F9A632D139E30";
+        fingerprint = "816D 23F5 E672 EC58 7674  4A73 197F 9A63 2D13 9E30";
+      }
+    ];
+  };
  jmettes = {
    email = "jonathan@jmettes.com";
    github = "jmettes";
@ -11016,7 +11042,7 @@
    name = "Yann Hodique";
  };
  sikmir = {
-    email = "sikmir@gmail.com";
+    email = "sikmir@disroot.org";
    github = "sikmir";
    githubId = 688044;
    name = "Nikolay Korotkiy";
@ -11848,6 +11874,12 @@
    githubId = 378734;
    name = "TG ⊗ Θ";
  };
+  tgunnoe = {
+    email = "t@gvno.net";
+    github = "tgunnoe";
+    githubId = 7254833;
+    name = "Taylor Gunnoe";
+  };
  th0rgal = {
    email = "thomas.marchand@tuta.io";
    github = "Th0rgal";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -166,6 +166,17 @@ with lib.maintainers; {
    scope = "Maintain Jitsi.";
  };

+  kubernetes = {
+    members = [
+      johanot
+      offline
+      saschagrunert
+      srhb
+      zowoq
+    ];
+    scope = "Maintain the Kubernetes package and module";
+  };
+
  kodi = {
    members = [
      aanderse
@ -229,6 +240,7 @@ with lib.maintainers; {
  php = {
    members = [
      aanderse
+      drupol
      etu
      globin
      ma27
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -279,6 +279,14 @@
          <literal>virtualisation.docker.daemon.settings</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The backward compatibility in
+          <literal>services.wordpress</literal> to configure sites with
+          the old interface has been removed. Please use
+          <literal>services.wordpress.sites</literal> instead.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The backward compatibility in
@ -402,6 +410,24 @@
          <literal>~/.local/share/polymc/polymc.cfg</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The terraform 0.12 compatibility has been removed and the
+          <literal>terraform.withPlugins</literal> and
+          <literal>terraform-providers.mkProvider</literal>
+          implementations simplified. Providers now need to be stored
+          under
+          <literal>$out/libexec/terraform-providers/&lt;registry&gt;/&lt;owner&gt;/&lt;name&gt;/&lt;version&gt;/&lt;os&gt;_&lt;arch&gt;/terraform-provider-&lt;name&gt;_v&lt;version&gt;</literal>
+          (which mkProvider does).
+        </para>
+        <para>
+          This breaks back-compat so it’s not possible to mix-and-match
+          with previous versions of nixpkgs. In exchange, it now becomes
+          possible to use the providers from
+          <link xlink:href="https://github.com/numtide/nixpkgs-terraform-providers-bin">nixpkgs-terraform-providers-bin</link>
+          directly.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>pkgs.noto-fonts-cjk</literal> is now deprecated in
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -92,6 +92,10 @@ In addition to numerous new and upgraded packages, this release has the followin

 - If you previously used `/etc/docker/daemon.json`, you need to incorporate the changes into the new option `virtualisation.docker.daemon.settings`.

+- The backward compatibility in `services.wordpress` to configure sites with
+  the old interface has been removed. Please use `services.wordpress.sites`
+  instead.
+
 - The backward compatibility in `services.dokuwiki` to configure sites with the
  old interface has been removed. Please use `services.dokuwiki.sites` instead.

@ -126,6 +130,11 @@ In addition to numerous new and upgraded packages, this release has the followin

 - MultiMC has been replaced with the fork PolyMC due to upstream developers being hostile to 3rd party package maintainers. PolyMC removes all MultiMC branding and is aimed at providing proper 3rd party packages like the one contained in Nixpkgs. This change affects the data folder where game instances and other save and configuration files are stored. Users with existing installations should rename `~/.local/share/multimc` to `~/.local/share/polymc`. The main config file's path has also moved from `~/.local/share/multimc/multimc.cfg` to `~/.local/share/polymc/polymc.cfg`.

+- The terraform 0.12 compatibility has been removed and the `terraform.withPlugins` and `terraform-providers.mkProvider` implementations simplified. Providers now need to be stored under
+`$out/libexec/terraform-providers/<registry>/<owner>/<name>/<version>/<os>_<arch>/terraform-provider-<name>_v<version>` (which mkProvider does).
+
+  This breaks back-compat so it's not possible to mix-and-match with previous versions of nixpkgs. In exchange, it now becomes possible to use the providers from [nixpkgs-terraform-providers-bin](https://github.com/numtide/nixpkgs-terraform-providers-bin) directly.
+
 - `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans`
  and `pkgs.noto-fonts-cjk-serif` because they each have different release
  schedules. To maintain compatibility with prior releases of Nixpkgs,
--- a/nixos/lib/make-iso9660-image.sh
+++ b/nixos/lib/make-iso9660-image.sh
@ -105,6 +105,7 @@ mkdir -p $out/iso
 # version-5 UUID's work)
 xorriso="xorriso
 -boot_image any gpt_disk_guid=$(uuid -v 5 daed2280-b91e-42c0-aed6-82c825ca41f3 $out | tr -d -)
+ -volume_date all_file_dates =$SOURCE_DATE_EPOCH
 -as mkisofs
 -iso-level 3
 -volid ${volumeID}
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@ -734,13 +734,13 @@ in
        { source = config.system.build.squashfsStore;
          target = "/nix-store.squashfs";
        }
-        { source = config.isoImage.splashImage;
-          target = "/isolinux/background.png";
-        }
        { source = pkgs.writeText "version" config.system.nixos.label;
          target = "/version.txt";
        }
      ] ++ optionals canx86BiosBoot [
+        { source = config.isoImage.splashImage;
+          target = "/isolinux/background.png";
+        }
        { source = pkgs.substituteAll  {
            name = "isolinux.cfg";
            src = pkgs.writeText "isolinux.cfg-in" isolinuxCfg;
@ -761,6 +761,9 @@ in
        { source = (pkgs.writeTextDir "grub/loopback.cfg" "source /EFI/boot/grub.cfg") + "/grub";
          target = "/boot/grub";
        }
+        { source = config.isoImage.efiSplashImage;
+          target = "/EFI/boot/efi-background.png";
+        }
      ] ++ optionals (config.boot.loader.grub.memtest86.enable && canx86BiosBoot) [
        { source = "${pkgs.memtest86plus}/memtest.bin";
          target = "/boot/memtest.bin";
@ -769,10 +772,6 @@ in
        { source = config.isoImage.grubTheme;
          target = "/EFI/boot/grub-theme";
        }
-      ] ++ [
-        { source = config.isoImage.efiSplashImage;
-          target = "/EFI/boot/efi-background.png";
-        }
      ];

    boot.loader.timeout = 10;
--- a/nixos/modules/installer/sd-card/sd-image-riscv64-qemu-installer.nix
+++ b/nixos/modules/installer/sd-card/sd-image-riscv64-qemu-installer.nix
@ -0,0 +1,10 @@
+{
+  imports = [
+    ../../profiles/installation-device.nix
+    ./sd-image-riscv64-qemu.nix
+  ];
+
+  # the installation media is also the installation target,
+  # so we don't want to provide the installation configuration.nix.
+  installer.cloneConfig = false;
+}
--- a/nixos/modules/misc/locate.nix
+++ b/nixos/modules/misc/locate.nix
@ -5,11 +5,14 @@ with lib;
 let
  cfg = config.services.locate;
  isMLocate = hasPrefix "mlocate" cfg.locate.name;
+  isPLocate = hasPrefix "plocate" cfg.locate.name;
+  isMorPLocate = (isMLocate || isPLocate);
  isFindutils = hasPrefix "findutils" cfg.locate.name;
-in {
+in
+{
  imports = [
    (mkRenamedOptionModule [ "services" "locate" "period" ] [ "services" "locate" "interval" ])
-    (mkRemovedOptionModule [ "services" "locate" "includeStore" ] "Use services.locate.prunePaths" )
+    (mkRemovedOptionModule [ "services" "locate" "includeStore" ] "Use services.locate.prunePaths")
  ];

  options.services.locate = with types; {
@ -163,7 +166,16 @@ in {

    prunePaths = mkOption {
      type = listOf path;
-      default = [ "/tmp" "/var/tmp" "/var/cache" "/var/lock" "/var/run" "/var/spool" "/nix/store" "/nix/var/log/nix" ];
+      default = [
+        "/tmp"
+        "/var/tmp"
+        "/var/cache"
+        "/var/lock"
+        "/var/run"
+        "/var/spool"
+        "/nix/store"
+        "/nix/var/log/nix"
+      ];
      description = ''
        Which paths to exclude from indexing
      '';
@ -188,26 +200,38 @@ in {
  };

  config = mkIf cfg.enable {
-    users.groups = mkIf isMLocate { mlocate = {}; };
+    users.groups = mkMerge [
+      (mkIf isMLocate { mlocate = { }; })
+      (mkIf isPLocate { plocate = { }; })
+    ];

-    security.wrappers = mkIf isMLocate {
-      locate = {
-        group = "mlocate";
-        owner = "root";
-        permissions = "u+rx,g+x,o+x";
-        setgid = true;
-        setuid = false;
-        source = "${cfg.locate}/bin/locate";
+    security.wrappers =
+      let
+        common = {
+          owner = "root";
+          permissions = "u+rx,g+x,o+x";
+          setgid = true;
+          setuid = false;
+        };
+        mlocate = (mkIf isMLocate {
+          group = "mlocate";
+          source = "${cfg.locate}/bin/locate";
+        });
+        plocate = (mkIf isPLocate {
+          group = "plocate";
+          source = "${cfg.locate}/bin/plocate";
+        });
+      in
+      mkIf isMorPLocate {
+        locate = mkMerge [ common mlocate plocate ];
+        plocate = (mkIf isPLocate (mkMerge [ common plocate ]));
      };
-    };

    nixpkgs.config = { locate.dbfile = cfg.output; };

    environment.systemPackages = [ cfg.locate ];

-    environment.variables = mkIf (!isMLocate)
-      { LOCATE_PATH = cfg.output;
-      };
+    environment.variables = mkIf (!isMorPLocate) { LOCATE_PATH = cfg.output; };

    environment.etc = {
      # write /etc/updatedb.conf for manual calls to `updatedb`
@ -221,57 +245,65 @@ in {
      };
    };

-    warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support the services.locate.localuser option; updatedb will run as root. (Silence with services.locate.localuser = null.)"
-            ++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component"
-            ++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";
+    warnings = optional (isMorPLocate && cfg.localuser != null)
+      "mlocate does not support the services.locate.localuser option; updatedb will run as root. (Silence with services.locate.localuser = null.)"
+    ++ optional (isFindutils && cfg.pruneNames != [ ])
+      "findutils locate does not support pruning by directory component"
+    ++ optional (isFindutils && cfg.pruneBindMounts)
+      "findutils locate does not support skipping bind mounts";

-    systemd.services.update-locatedb =
-      { description = "Update Locate Database";
-        path = mkIf (!isMLocate) [ pkgs.su ];
+    systemd.services.update-locatedb = {
+      description = "Update Locate Database";
+      path = mkIf (!isMorPLocate) [ pkgs.su ];

-        # mlocate's updatedb takes flags via a configuration file or
-        # on the command line, but not by environment variable.
-        script =
-          if isMLocate
-          then let toFlags = x: optional (cfg.${x} != [])
-                                         "--${lib.toLower x} '${concatStringsSep " " cfg.${x}}'";
-                   args = concatLists (map toFlags ["pruneFS" "pruneNames" "prunePaths"]);
-               in ''
+      # mlocate's updatedb takes flags via a configuration file or
+      # on the command line, but not by environment variable.
+      script =
+        if isMorPLocate then
+          let
+            toFlags = x:
+              optional (cfg.${x} != [ ])
+                "--${lib.toLower x} '${concatStringsSep " " cfg.${x}}'";
+            args = concatLists (map toFlags [ "pruneFS" "pruneNames" "prunePaths" ]);
+          in
+          ''
            exec ${cfg.locate}/bin/updatedb \
              --output ${toString cfg.output} ${concatStringsSep " " args} \
              --prune-bind-mounts ${if cfg.pruneBindMounts then "yes" else "no"} \
              ${concatStringsSep " " cfg.extraFlags}
          ''
-          else ''
-            exec ${cfg.locate}/bin/updatedb \
-              ${optionalString (cfg.localuser != null && ! isMLocate) "--localuser=${cfg.localuser}"} \
-              --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags}
-          '';
-        environment = optionalAttrs (!isMLocate) {
-          PRUNEFS = concatStringsSep " " cfg.pruneFS;
-          PRUNEPATHS = concatStringsSep " " cfg.prunePaths;
-          PRUNENAMES = concatStringsSep " " cfg.pruneNames;
-          PRUNE_BIND_MOUNTS = if cfg.pruneBindMounts then "yes" else "no";
-        };
-        serviceConfig.Nice = 19;
-        serviceConfig.IOSchedulingClass = "idle";
-        serviceConfig.PrivateTmp = "yes";
-        serviceConfig.PrivateNetwork = "yes";
-        serviceConfig.NoNewPrivileges = "yes";
-        serviceConfig.ReadOnlyPaths = "/";
-        # Use dirOf cfg.output because mlocate creates temporary files next to
-        # the actual database. We could specify and create them as well,
-        # but that would make this quite brittle when they change something.
-        # NOTE: If /var/cache does not exist, this leads to the misleading error message:
-        # update-locatedb.service: Failed at step NAMESPACE spawning …/update-locatedb-start: No such file or directory
-        serviceConfig.ReadWritePaths = dirOf cfg.output;
+        else ''
+          exec ${cfg.locate}/bin/updatedb \
+            ${optionalString (cfg.localuser != null && !isMorPLocate) "--localuser=${cfg.localuser}"} \
+            --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags}
+        '';
+      environment = optionalAttrs (!isMorPLocate) {
+        PRUNEFS = concatStringsSep " " cfg.pruneFS;
+        PRUNEPATHS = concatStringsSep " " cfg.prunePaths;
+        PRUNENAMES = concatStringsSep " " cfg.pruneNames;
+        PRUNE_BIND_MOUNTS = if cfg.pruneBindMounts then "yes" else "no";
      };
+      serviceConfig.Nice = 19;
+      serviceConfig.IOSchedulingClass = "idle";
+      serviceConfig.PrivateTmp = "yes";
+      serviceConfig.PrivateNetwork = "yes";
+      serviceConfig.NoNewPrivileges = "yes";
+      serviceConfig.ReadOnlyPaths = "/";
+      # Use dirOf cfg.output because mlocate creates temporary files next to
+      # the actual database. We could specify and create them as well,
+      # but that would make this quite brittle when they change something.
+      # NOTE: If /var/cache does not exist, this leads to the misleading error message:
+      # update-locatedb.service: Failed at step NAMESPACE spawning …/update-locatedb-start: No such file or directory
+      serviceConfig.ReadWritePaths = dirOf cfg.output;
+    };

-    systemd.timers.update-locatedb = mkIf (cfg.interval != "never")
-      { description = "Update timer for locate database";
-        partOf      = [ "update-locatedb.service" ];
-        wantedBy    = [ "timers.target" ];
-        timerConfig.OnCalendar = cfg.interval;
-      };
+    systemd.timers.update-locatedb = mkIf (cfg.interval != "never") {
+      description = "Update timer for locate database";
+      partOf = [ "update-locatedb.service" ];
+      wantedBy = [ "timers.target" ];
+      timerConfig.OnCalendar = cfg.interval;
+    };
  };
+
+  meta.maintainers = with lib.maintainers; [ SuperSandro2000 ];
 }
--- a/nixos/modules/programs/sway.nix
+++ b/nixos/modules/programs/sway.nix
@ -90,10 +90,10 @@ in {
    extraPackages = mkOption {
      type = with types; listOf package;
      default = with pkgs; [
-        swaylock swayidle alacritty dmenu
+        swaylock swayidle foot dmenu
      ];
      defaultText = literalExpression ''
-        with pkgs; [ swaylock swayidle alacritty dmenu ];
+        with pkgs; [ swaylock swayidle foot dmenu ];
      '';
      example = literalExpression ''
        with pkgs; [
--- a/nixos/modules/services/audio/roon-server.nix
+++ b/nixos/modules/services/audio/roon-server.nix
@ -51,7 +51,10 @@ in {
    };

    networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPortRanges = [{ from = 9100; to = 9200; }];
+      allowedTCPPortRanges = [
+        { from = 9100; to = 9200; }
+        { from = 9330; to = 9332; }
+      ];
      allowedUDPPorts = [ 9003 ];
      extraCommands = ''
        iptables -A INPUT -s 224.0.0.0/4 -j ACCEPT
--- a/nixos/modules/services/misc/n8n.nix
+++ b/nixos/modules/services/misc/n8n.nix
@ -43,6 +43,7 @@ in
        # This folder must be writeable as the application is storing
        # its data in it, so the StateDirectory is a good choice
        N8N_USER_FOLDER = "/var/lib/n8n";
+        HOME = "/var/lib/n8n";
        N8N_CONFIG_FILES = "${configFile}";
      };
      serviceConfig = {
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@ -1,20 +1,14 @@
 { config, pkgs, lib, ... }:

-let
-  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption types;
-  inherit (lib) any attrValues concatMapStringsSep flatten literalExpression;
-  inherit (lib) filterAttrs mapAttrs mapAttrs' mapAttrsToList nameValuePair optional optionalAttrs optionalString;
+with lib;

-  cfg = migrateOldAttrs config.services.wordpress;
+let
+  cfg = config.services.wordpress;
  eachSite = cfg.sites;
  user = "wordpress";
  webserver = config.services.${cfg.webserver};
  stateDir = hostName: "/var/lib/wordpress/${hostName}";

-  # Migrate config.services.wordpress.<hostName> to config.services.wordpress.sites.<hostName>
-  oldSites = filterAttrs (o: _: o != "sites" && o != "webserver");
-  migrateOldAttrs = cfg: cfg // { sites = cfg.sites // oldSites cfg; };
-
  pkg = hostName: cfg: pkgs.stdenv.mkDerivation rec {
    pname = "wordpress-${hostName}";
    version = src.version;
@ -266,36 +260,29 @@ in
 {
  # interface
  options = {
-    services.wordpress = mkOption {
-      type = types.submodule {
-        # Used to support old interface
-        freeformType = types.attrsOf (types.submodule siteOpts);
+    services.wordpress = {

-        # New interface
-        options.sites = mkOption {
-          type = types.attrsOf (types.submodule siteOpts);
-          default = {};
-          description = "Specification of one or more WordPress sites to serve";
-        };
-
-        options.webserver = mkOption {
-          type = types.enum [ "httpd" "nginx" "caddy" ];
-          default = "httpd";
-          description = ''
-            Whether to use apache2 or nginx for virtual host management.
-
-            Further nginx configuration can be done by adapting <literal>services.nginx.virtualHosts.&lt;name&gt;</literal>.
-            See <xref linkend="opt-services.nginx.virtualHosts"/> for further information.
-
-            Further apache2 configuration can be done by adapting <literal>services.httpd.virtualHosts.&lt;name&gt;</literal>.
-            See <xref linkend="opt-services.httpd.virtualHosts"/> for further information.
-          '';
-        };
+      sites = mkOption {
+        type = types.attrsOf (types.submodule siteOpts);
+        default = {};
+        description = "Specification of one or more WordPress sites to serve";
      };
-      default = {};
-      description = "Wordpress configuration";
-    };

+      webserver = mkOption {
+        type = types.enum [ "httpd" "nginx" "caddy" ];
+        default = "httpd";
+        description = ''
+          Whether to use apache2 or nginx for virtual host management.
+
+          Further nginx configuration can be done by adapting <literal>services.nginx.virtualHosts.&lt;name&gt;</literal>.
+          See <xref linkend="opt-services.nginx.virtualHosts"/> for further information.
+
+          Further apache2 configuration can be done by adapting <literal>services.httpd.virtualHosts.&lt;name&gt;</literal>.
+          See <xref linkend="opt-services.httpd.virtualHosts"/> for further information.
+        '';
+      };
+
+    };
  };

  # implementation
@ -312,8 +299,6 @@ in
        }) eachSite);


-    warnings = mapAttrsToList (hostName: _: ''services.wordpress."${hostName}" is deprecated use services.wordpress.sites."${hostName}"'') (oldSites cfg);
-
    services.mysql = mkIf (any (v: v.database.createLocally) (attrValues eachSite)) {
      enable = true;
      package = mkDefault pkgs.mariadb;
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@ -271,7 +271,7 @@ def main() -> None:
            if os.readlink(system_dir(*gen)) == args.default_config:
                write_loader_conf(*gen)
        except OSError as e:
-            print("ignoring profile '{}' in the list of boot entries because of the following error:\n{}".format(profile, e), file=sys.stderr)
+            print("ignoring generation '{}' in the list of boot entries because of the following error:\n{}".format(*gen, e), file=sys.stderr)

    for root, _, files in os.walk('@efiSysMountPoint@/efi/nixos/.extra-files', topdown=False):
        relative_root = root.removeprefix("@efiSysMountPoint@/efi/nixos/.extra-files").removeprefix("/")
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -181,7 +181,6 @@ in
  hadoop.all = handleTestOn [ "x86_64-linux" ] ./hadoop/hadoop.nix {};
  hadoop.hdfs = handleTestOn [ "x86_64-linux" ] ./hadoop/hdfs.nix {};
  hadoop.yarn = handleTestOn [ "x86_64-linux" ] ./hadoop/yarn.nix {};
-  handbrake = handleTestOn ["x86_64-linux"] ./handbrake.nix {};
  haproxy = handleTest ./haproxy.nix {};
  hardened = handleTest ./hardened.nix {};
  hedgedoc = handleTest ./hedgedoc.nix {};
--- a/nixos/tests/boot-stage1.nix
+++ b/nixos/tests/boot-stage1.nix
@ -33,6 +33,8 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        #include <linux/sched/signal.h>
        #endif

+        MODULE_LICENSE("GPL");
+
        struct task_struct *canaryTask;

        static int kcanary(void *nothing)
--- a/nixos/tests/handbrake.nix
+++ b/nixos/tests/handbrake.nix
@ -1,33 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ... }:
-
-let
-  # Download Big Buck Bunny example, licensed under CC Attribution 3.0.
-  testMkv = pkgs.fetchurl {
-    url = "https://github.com/Matroska-Org/matroska-test-files/blob/cf0792be144ac470c4b8052cfe19bb691993e3a2/test_files/test1.mkv?raw=true";
-    sha256 = "1hfxbbgxwfkzv85pvpvx55a72qsd0hxjbm9hkl5r3590zw4s75h9";
-    name = "test1.mkv";
-  };
-
-in
-{
-  name = "handbrake";
-
-  meta = {
-    maintainers = with pkgs.lib.maintainers; [ ];
-  };
-
-  machine = { pkgs, ... }: {
-    environment.systemPackages = with pkgs; [ handbrake ];
-  };
-
-  testScript = ''
-    # Test MP4 and MKV transcoding. Since this is a short clip, transcoding typically
-    # only takes a few seconds.
-    start_all()
-
-    machine.succeed("HandBrakeCLI -i ${testMkv} -o test.mp4 -e x264 -q 20 -B 160")
-    machine.succeed("test -e test.mp4")
-    machine.succeed("HandBrakeCLI -i ${testMkv} -o test.mkv -e x264 -q 20 -B 160")
-    machine.succeed("test -e test.mkv")
-  '';
-})
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@ -671,8 +671,6 @@ in {
          "modprobe bcache",
          "udevadm settle",
          "make-bcache -B /dev/vda4 -C /dev/vda3",
-          "echo /dev/vda3 > /sys/fs/bcache/register",
-          "echo /dev/vda4 > /sys/fs/bcache/register",
          "udevadm settle",
          "mkfs.ext3 -L nixos /dev/bcache0",
          "mount LABEL=nixos /mnt",
--- a/nixos/tests/jibri.nix
+++ b/nixos/tests/jibri.nix
@ -63,7 +63,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        """sleep 15 && curl -H "Content-Type: application/json" -X POST http://localhost:2222/jibri/api/v1.0/stopService -d '{"sessionId": "RecordTest","callParams":{"callUrlInfo":{"baseUrl": "https://machine","callName": "TestCall"}},"callLoginParams":{"domain": "recorder.machine", "username": "recorder", "password": "'"$(cat /var/lib/jitsi-meet/jibri-recorder-secret)"'" },"sinkType": "file"}'"""
    )
    machine.wait_until_succeeds(
-        "cat /var/log/jitsi/jibri/log.0.txt | grep -q 'Recording finalize script finished with exit value 0'", timeout=36
+        "cat /var/log/jitsi/jibri/log.0.txt | grep -q 'Finalize script finished with exit value 0'", timeout=36
    )
  '';
 })
--- a/nixos/tests/sway.nix
+++ b/nixos/tests/sway.nix
@ -1,4 +1,4 @@
-import ./make-test-python.nix ({ pkgs, lib, ...} :
+import ./make-test-python.nix ({ pkgs, lib, ... }:

 {
  name = "sway";
@ -13,19 +13,38 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :

    environment = {
      # For glinfo and wayland-info:
-      systemPackages = with pkgs; [ mesa-demos wayland-utils ];
+      systemPackages = with pkgs; [ mesa-demos wayland-utils alacritty ];
      # Use a fixed SWAYSOCK path (for swaymsg):
      variables = {
        "SWAYSOCK" = "/tmp/sway-ipc.sock";
-        "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
+        # TODO: Investigate if we can get hardware acceleration to work (via
+        # virtio-gpu and Virgil). We currently have to use the Pixman software
+        # renderer since the GLES2 renderer doesn't work inside the VM (even
+        # with WLR_RENDERER_ALLOW_SOFTWARE):
+        # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
+        "WLR_RENDERER" = "pixman";
      };
      # For convenience:
      shellAliases = {
-        test-x11 = "glinfo | head -n 3 | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
+        test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
        test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
      };
+
+      # To help with OCR:
+      etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
+        main = {
+          font = "inconsolata:size=14";
+        };
+        colors = rec {
+          foreground = "000000";
+          background = "ffffff";
+          regular2 = foreground;
+        };
+      };
    };

+    fonts.fonts = [ pkgs.inconsolata ];
+
    # Automatically configure and start Sway when logging in on tty1:
    programs.bash.loginShellInit = ''
      if [ "$(tty)" = "/dev/tty1" ]; then
@ -61,7 +80,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
    machine.wait_for_file("/run/user/1000/wayland-1")
    machine.wait_for_file("/tmp/sway-ipc.sock")

-    # Test XWayland:
+    # Test XWayland (foot does not support X):
    machine.succeed(
        "su - alice -c 'swaymsg exec WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY=invalid alacritty'"
    )
@ -69,21 +88,22 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
    machine.send_chars("test-x11\n")
    machine.wait_for_file("/tmp/test-x11-exit-ok")
    print(machine.succeed("cat /tmp/test-x11.out"))
+    machine.copy_from_vm("/tmp/test-x11.out")
    machine.screenshot("alacritty_glinfo")
    machine.succeed("pkill alacritty")

-    # Start a terminal (Alacritty) on workspace 3:
+    # Start a terminal (foot) on workspace 3:
    machine.send_key("alt-3")
-    machine.succeed(
-        "su - alice -c 'swaymsg exec WINIT_UNIX_BACKEND=wayland DISPLAY=invalid alacritty'"
-    )
+    machine.sleep(3)
+    machine.send_key("alt-ret")
    machine.wait_for_text("alice@machine")
    machine.send_chars("test-wayland\n")
    machine.wait_for_file("/tmp/test-wayland-exit-ok")
    print(machine.succeed("cat /tmp/test-wayland.out"))
-    machine.screenshot("alacritty_wayland_info")
+    machine.copy_from_vm("/tmp/test-wayland.out")
+    machine.screenshot("foot_wayland_info")
    machine.send_key("alt-shift-q")
-    machine.wait_until_fails("pgrep alacritty")
+    machine.wait_until_fails("pgrep foot")

    # Test gpg-agent starting pinentry-gnome3 via D-Bus (tests if
    # $WAYLAND_DISPLAY is correctly imported into the D-Bus user env):
@ -104,9 +124,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
    # Exit Sway and verify process exit status 0:
    machine.succeed("su - alice -c 'swaymsg exit || true'")
    machine.wait_until_fails("pgrep -x sway")
-
-    # TODO: Sway currently segfaults after "swaymsg exit" but only in this VM test:
-    # machine # [  104.090032] sway[921]: segfault at 3f800008 ip 00007f7dbdc25f10 sp 00007ffe282182f8 error 4 in libwayland-server.so.0.1.0[7f7dbdc1f000+8000]
-    # machine.wait_for_file("/tmp/sway-exit-ok")
+    machine.wait_for_file("/tmp/sway-exit-ok")
  '';
 })
--- a/nixos/tests/wordpress.nix
+++ b/nixos/tests/wordpress.nix
@ -15,15 +15,12 @@ import ./make-test-python.nix ({ pkgs, ... }:
      services.httpd.adminAddr = "webmaster@site.local";
      services.httpd.logPerVirtualHost = true;

-      services.wordpress = {
-        # Test support for old interface
+      services.wordpress.sites = {
        "site1.local" = {
          database.tablePrefix = "site1_";
        };
-        sites = {
-          "site2.local" = {
-            database.tablePrefix = "site2_";
-          };
+        "site2.local" = {
+          database.tablePrefix = "site2_";
        };
      };

--- a/pkgs/applications/audio/indicator-sound-switcher/default.nix
+++ b/pkgs/applications/audio/indicator-sound-switcher/default.nix
@ -0,0 +1,62 @@
+{ python3Packages
+, lib
+, fetchFromGitHub
+, perlPackages
+, gettext
+, gtk3
+, gobject-introspection
+, intltool, wrapGAppsHook, glib
+, librsvg
+, libayatana-appindicator-gtk3
+, libpulseaudio
+, keybinder3
+, gdk-pixbuf
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "indicator-sound-switcher";
+  version = "2.3.6";
+
+  src = fetchFromGitHub {
+    owner = "yktoo";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "APU8Y0xUhRd9RbMSG9TD0TBvFLu/VlLGauf56z8gZDw=";
+  };
+
+  postPatch = ''
+    substituteInPlace lib/indicator_sound_switcher/lib_pulseaudio.py \
+      --replace "CDLL('libpulse.so.0')" "CDLL('${libpulseaudio}/lib/libpulse.so')"
+  '';
+
+  nativeBuildInputs = [
+    gettext
+    intltool
+    wrapGAppsHook
+    glib
+    gdk-pixbuf
+  ];
+
+  buildInputs = [
+    librsvg
+  ];
+
+  propagatedBuildInputs = [
+    python3Packages.setuptools
+    python3Packages.pygobject3
+    gtk3
+    gobject-introspection
+    librsvg
+    libayatana-appindicator-gtk3
+    libpulseaudio
+    keybinder3
+  ];
+
+  meta = with lib; {
+    description = "Sound input/output selector indicator for Linux";
+    homepage = "https://yktoo.com/en/software/sound-switcher-indicator/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ alexnortung ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/audio/mpc/default.nix
+++ b/pkgs/applications/audio/mpc/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@ -20,6 +21,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-2FjYBfak0IjibuU+CNQ0y9Ei8hTZhynS/BK2DNerhVw=";
  };

+  patches = [
+    # fix the build with meson 0.60 (https://github.com/MusicPlayerDaemon/mpc/pull/76)
+    (fetchpatch {
+      url = "https://github.com/MusicPlayerDaemon/mpc/commit/b656ca4b6c2a0d5b6cebd7f7daa679352f664e0e.patch";
+      sha256 = "sha256-fjjSlCKxgkz7Em08CaK7+JAzl8YTzLcpGGMz2HJlsVw=";
+    })
+  ];
+
  buildInputs = [ libmpdclient ] ++ lib.optionals stdenv.isDarwin [ libiconv ];

  nativeBuildInputs = [ meson ninja pkg-config sphinx ];
@ -28,7 +37,7 @@ stdenv.mkDerivation rec {
    description = "A minimalist command line interface to MPD";
    homepage = "https://www.musicpd.org/clients/mpc/";
    license = licenses.gpl2;
-    maintainers = with maintainers; [ algorith ];
+    maintainers = with maintainers; [ algorith ncfavier ];
    platforms = with platforms; linux ++ darwin;
  };
 }
--- a/pkgs/applications/audio/parlatype/default.nix
+++ b/pkgs/applications/audio/parlatype/default.nix
@ -40,8 +40,6 @@ stdenv.mkDerivation rec {
    hicolor-icon-theme
  ];

-  mesonFlags = [ "-Dlibreoffice=false" ];
-
  postPatch = ''
    chmod +x data/meson_post_install.py
    patchShebangs data/meson_post_install.py
--- a/pkgs/applications/audio/qpwgraph/default.nix
+++ b/pkgs/applications/audio/qpwgraph/default.nix
@ -5,14 +5,14 @@

 mkDerivation rec {
  pname = "qpwgraph";
-  version = "0.1.1";
+  version = "0.2.0";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "rncbc";
    repo = "qpwgraph";
    rev = "v${version}";
-    sha256 = "sha256-r3FoAV0wah9fwnqyMyu8927c4Uj0zZoQNvLoXP5AP/E=";
+    sha256 = "sha256-SGx80fMFomNEa/jgH8Yeof+f7zXCDxx3Yqd0GxHZGMw=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/applications/audio/zrythm/default.nix
+++ b/pkgs/applications/audio/zrythm/default.nix
@ -13,7 +13,6 @@
 , curl
 , dconf
 , libepoxy
-, ffmpeg
 , fftw
 , fftwFloat
 , flex
@ -95,7 +94,6 @@ stdenv.mkDerivation rec {
    curl
    dconf
    libepoxy
-    ffmpeg
    fftw
    fftwFloat
    flex
@ -133,10 +131,9 @@ stdenv.mkDerivation rec {
  ];

  mesonFlags = [
-    "-Denable_ffmpeg=true"
-    "-Denable_rtmidi=true"
-    "-Denable_rtaudio=true"
-    "-Denable_sdl=true"
+    "-Drtmidi=enabled"
+    "-Drtaudio=enabled"
+    "-Dsdl=enabled"
    "-Dcarla=enabled"
    "-Dmanpage=true"
    # "-Duser_manual=true" # needs sphinx-intl
--- a/pkgs/applications/blockchains/groestlcoin/default.nix
+++ b/pkgs/applications/blockchains/groestlcoin/default.nix
@ -0,0 +1,93 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, util-linux
+, hexdump
+, autoSignDarwinBinariesHook
+, wrapQtAppsHook ? null
+, boost
+, libevent
+, miniupnpc_2
+, zeromq
+, zlib
+, db53
+, sqlite
+, qrencode
+, qtbase ? null
+, qttools ? null
+, python3
+, withGui ? false
+, withWallet ? true
+}:
+
+let
+  version = "22.0";
+  desktop = fetchurl {
+    url = "https://raw.githubusercontent.com/Groestlcoin/packaging/${version}/debian/groestlcoin-qt.desktop";
+    sha256 = "0mxwq4jvcip44a796iwz7n1ljkhl3a4p47z7qlsxcfxw3zmm0k0k";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = if withGui then "groestlcoin" else "groestlcoind";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "Groestlcoin";
+    repo = "groestlcoin";
+    rev = "v${version}";
+    sha256 = "104zzcigpk976iqyinjn6mw3l36zb1if7249iz44ds1zaxv3g1v1";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ]
+    ++ lib.optionals stdenv.isLinux [ util-linux ]
+    ++ lib.optionals stdenv.isDarwin [ hexdump ]
+    ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [ autoSignDarwinBinariesHook ]
+    ++ lib.optionals withGui [ wrapQtAppsHook ];
+
+  buildInputs = [ boost libevent miniupnpc_2 zeromq zlib ]
+    ++ lib.optionals withWallet [ db53 sqlite ]
+    ++ lib.optionals withGui [ qrencode qtbase qttools ];
+
+  postInstall = lib.optionalString withGui ''
+    install -Dm644 ${desktop} $out/share/applications/groestlcoin-qt.desktop
+    substituteInPlace $out/share/applications/groestlcoin-qt.desktop --replace "Icon=groestlcoin128" "Icon=groestlcoin"
+    install -Dm644 share/pixmaps/groestlcoin256.png $out/share/pixmaps/groestlcoin.png
+  '';
+
+  configureFlags = [
+    "--with-boost-libdir=${boost.out}/lib"
+    "--disable-bench"
+  ] ++ lib.optionals (!withWallet) [
+    "--disable-wallet"
+  ] ++ lib.optionals withGui [
+    "--with-gui=qt5"
+    "--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin"
+  ];
+
+  checkInputs = [ python3 ];
+
+  checkFlags = [ "LC_ALL=en_US.UTF-8" ]
+    # QT_PLUGIN_PATH needs to be set when executing QT, which is needed when testing Groestlcoin's GUI.
+    # See also https://github.com/NixOS/nixpkgs/issues/24256
+    ++ lib.optional withGui "QT_PLUGIN_PATH=${qtbase}/${qtbase.qtPluginPrefix}";
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Peer-to-peer electronic cash system";
+    longDescription = ''
+      Groestlcoin is a free open source peer-to-peer electronic cash system that is
+      completely decentralized, without the need for a central server or trusted
+      parties. Users hold the crypto keys to their own money and transact directly
+      with each other, with the help of a P2P network to check for double-spending.
+    '';
+    homepage = "https://groestlcoin.org/";
+    downloadPage = "https://github.com/Groestlcoin/groestlcoin/releases/tag/v{version}/";
+    maintainers = with maintainers; [ gruve-p ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@ -0,0 +1,61 @@
+{ stdenv
+, fetchFromGitHub
+, lib
+, rustPlatform
+, Security
+, curl
+, pkg-config
+, openssl
+, llvmPackages
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "snarkos";
+  version = "unstable-2021-01-21";
+
+  src = fetchFromGitHub {
+    owner = "AleoHQ";
+    repo = "snarkOS";
+    rev = "7068dc0394139c887f5187288ca2af54bc729614";
+    sha256 = "sha256-fgdIJX/Ep3amPAjo00BtNGSXhaItw41S1XliDXk6b7k=";
+  };
+
+  cargoSha256 = "sha256-bax7cnqVY49rdcWs73+KqW+dzPebKLlsbPvOM1d25zA=";
+
+  # buildAndTestSubdir = "cli";
+
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config llvmPackages.clang ];
+
+  # Needed to get openssl-sys to use pkg-config.
+  OPENSSL_NO_VENDOR = 1;
+  OPENSSL_LIB_DIR = "${openssl.out}/lib";
+  OPENSSL_DIR="${lib.getDev openssl}";
+
+  LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
+
+  # TODO check why rust compilation fails by including the rocksdb from nixpkgs
+  # Used by build.rs in the rocksdb-sys crate. If we don't set these, it would
+  # try to build RocksDB from source.
+  # ROCKSDB_INCLUDE_DIR="${rocksdb}/include";
+  # ROCKSDB_LIB_DIR="${rocksdb}/lib";
+
+  buildInputs = lib.optionals stdenv.isDarwin [ Security curl ];
+
+  # some tests are flaky and some need network access
+  # TODO finish filtering the tests to enable them
+  doCheck = !stdenv.isLinux;
+  # checkFlags = [
+  #   # tries to make a network access
+  #   "--skip=rpc::rpc::tests::test_send_transaction_large"
+  #   # flaky test
+  #   "--skip=helpers::block_requests::tests::test_block_requests_case_2ca"
+  # ];
+
+
+  meta = with lib; {
+    description = "A Decentralized Operating System for Zero-Knowledge Applications";
+    homepage = "https://snarkos.org";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ happysalada ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/editors/rehex/default.nix
+++ b/pkgs/applications/editors/rehex/default.nix
@ -2,8 +2,10 @@
 , stdenv
 , fetchFromGitHub
 , pkg-config
+, which
 , capstone
 , jansson
+, libunistring
 , lua5_3
 , wxGTK31
 , Carbon
@ -15,30 +17,33 @@

 stdenv.mkDerivation rec {
  pname = "rehex";
-  version = "0.3.92";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "solemnwarning";
    repo = pname;
    rev = version;
-    sha256 = "sha256-yZvJlomUpJwDJOBVSl49lU+JE1YMMs/BSzHepXoFlIY=";
+    hash = "sha256-NuWWaYABQDaS9wkwmXkBJWHzLFJbUUCiePNQNo4yZrk=";
  };

  postPatch = ''
-    substituteInPlace Makefile.osx --replace 'iconutil -c icns -o $@ $(ICONSET)' \
-      'png2icns $@ $(ICONSET)/icon_16x16.png $(ICONSET)/icon_32x32.png $(ICONSET)/icon_128x128.png $(ICONSET)/icon_256x256.png $(ICONSET)/icon_512x512.png'
+    # See https://github.com/solemnwarning/rehex/pull/148
+    substituteInPlace Makefile.osx \
+      --replace '$(filter-out %@2x.png,$(wildcard $(ICONSET)/*.png))' 'res/icon{16,32,128,256,512}.png'
  '';

-  nativeBuildInputs = [ pkg-config ]
+  nativeBuildInputs = [ pkg-config which ]
    ++ lib.optionals stdenv.isDarwin [ libicns ];

-  buildInputs = [ capstone jansson lua5_3 ]
+  buildInputs = [ capstone jansson libunistring lua5_3 ]
    ++ lib.optionals (!stdenv.isDarwin) [ wxGTK31 ]
    ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa IOKit wxmac ];

-  makeFlags = [ "prefix=$(out)" ]
+  makeFlags = [ "prefix=${placeholder "out"}" ]
    ++ lib.optionals stdenv.isDarwin [ "-f Makefile.osx" ];

+  enableParallelBuilding = true;
+
  meta = with lib; {
    description = "Reverse Engineers' Hex Editor";
    longDescription = ''
@ -46,7 +51,8 @@ stdenv.mkDerivation rec {
      engineering, and everything else.
    '';
    homepage = "https://github.com/solemnwarning/rehex";
-    license = licenses.gpl2;
+    changelog = "https://github.com/solemnwarning/rehex/raw/${version}/CHANGES.txt";
+    license = licenses.gpl2Only;
    maintainers = with maintainers; [ markus1189 SuperSandro2000 ];
    platforms = platforms.all;
  };
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, libtool
+{ lib, stdenv, fetchFromGitHub, pkg-config, libtool
 , bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg, djvulibre
 , lcms2, openexr, libjxl, libpng, liblqr1, libraw, librsvg, libtiff, libxml2, openjpeg, libwebp, libheif
 , ApplicationServices
@ -18,11 +18,13 @@ in

 stdenv.mkDerivation rec {
  pname = "imagemagick";
-  version = "7.1.0-19";
+  version = "7.1.0-20";

-  src = fetchurl {
-    url = "https://download.imagemagick.org/ImageMagick/download/releases/ImageMagick-${version}.tar.xz";
-    hash = "sha256-P9eRdKsPMLwWQ68+ZU8dL/zDqVVCY5gRVWiLT0n3/Xc=";
+  src = fetchFromGitHub {
+    owner = "ImageMagick";
+    repo = "ImageMagick";
+    rev = version;
+    sha256 = "0r8zmk2cfmf09l94hqzfz4aspnzn178ggdbgm7w4hr0p864cbvc3";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "drawio";
-  version = "16.1.2";
+  version = "16.4.0";

  src = fetchurl {
    url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/drawio-x86_64-${version}.rpm";
-    sha256 = "b86ff3f77b17e7da66979fe8ea878685c0018273f5d0302f10d3094d502452ee";
+    sha256 = "624f776478b6960adb1be565077f79aed72c95de5e995fc1216b78978c9c6857";
  };

  nativeBuildInputs = [
@ -86,6 +86,12 @@ stdenv.mkDerivation rec {
      --replace /opt/drawio/drawio $out/bin/drawio
  '';

+  doInstallCheckPhase = true;
+
+  installCheckPhase = ''
+    $out/bin/drawio --help > /dev/null
+  '';
+
  meta = with lib; {
    description = "A desktop application for creating diagrams";
    homepage = "https://about.draw.io/";
--- a/pkgs/applications/misc/artha/default.nix
+++ b/pkgs/applications/misc/artha/default.nix
@ -1,21 +1,17 @@
 { lib, stdenv, autoreconfHook, fetchurl, dbus-glib, gtk2, pkg-config, wordnet }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "artha";
-  version = "1.0.3";
+  version = "1.0.5";

  src = fetchurl {
-    url = "mirror://sourceforge/artha/1.0.3/artha-1.0.3.tar.bz2";
-    sha256 = "0qr4ihl7ma3cq82xi1fpzvf74mm9vsg0j035xvmcp3r6rmw2fycx";
+    url = "mirror://sourceforge/artha/${version}/artha-${version}.tar.bz2";
+    sha256 = "034r7vfk5y7705k068cdlq52ikp6ip10w6047a5zjdakbn55c3as";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
  buildInputs = [ dbus-glib gtk2 wordnet ];

-  patches = [
-    ./gio-underlink.patch
-  ];
-
  meta = with lib; {
    description = "An offline thesaurus based on WordNet";
    homepage = "http://artha.sourceforge.net";
--- a/pkgs/applications/misc/artha/gio-underlink.patch
+++ b/pkgs/applications/misc/artha/gio-underlink.patch
@ -1,13 +0,0 @@
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 0236d72..bcc1182 100644
--- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -38,7 +38,7 @@ artha_LDADD = libwni.a $(WORDNET_LIB)
- 
- if POSIX
- AM_CFLAGS += @libdbus_CFLAGS@
-artha_LDADD += -lX11 -ldbus-1 -ldbus-glib-1 -lgtk-x11-2.0 \
-+artha_LDADD += -lX11 -ldbus-1 -ldbus-glib-1 -lgio-2.0 -lgtk-x11-2.0 \
- 		-lgdk-x11-2.0 -lgmodule-2.0 -lgobject-2.0 -lglib-2.0
- else
- artha_LDADD += @GTK_LIBS@
--- a/pkgs/applications/misc/ausweisapp2/default.nix
+++ b/pkgs/applications/misc/ausweisapp2/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "AusweisApp2";
-  version = "1.22.2";
+  version = "1.22.3";

  src = fetchFromGitHub {
    owner = "Governikus";
    repo = "AusweisApp2";
    rev = version;
-    sha256 = "sha256-Oci1y6//45Gep4IS6Ym+v9MPCP5mOswAiWPkXqd+zR0=";
+    sha256 = "sha256-Zh1rWMdRXPj/+80Sqvp9cbV5sDrNVBebPRGTTWM1DLk=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/applications/misc/buku/default.nix
+++ b/pkgs/applications/misc/buku/default.nix
@ -1,4 +1,4 @@
-{ lib, python3, fetchFromGitHub }:
+{ lib, python3, fetchFromGitHub, withServer ? false }:

 let
  python3' = python3.override {
@ -19,6 +19,21 @@ let
      });
    };
  };
+  serverRequire = with python3'.pkgs; [
+    requests
+    flask
+    flask-admin
+    flask-api
+    flask-bootstrap
+    flask-paginate
+    flask-reverse-proxy-fix
+    flask_wtf
+    arrow
+    werkzeug
+    click
+    vcrpy
+    toml
+  ];
 in
 with python3'.pkgs; buildPythonApplication rec {
  version = "4.6";
@ -32,40 +47,29 @@ with python3'.pkgs; buildPythonApplication rec {
  };

  checkInputs = [
-    pytest-cov
    hypothesis
    pytest
    pytest-vcr
-    pylint
-    flake8
    pyyaml
    mypy-extensions
+    click
  ];

  propagatedBuildInputs = [
    cryptography
    beautifulsoup4
-    requests
+    certifi
    urllib3
-    flask
-    flask-admin
-    flask-api
-    flask-bootstrap
-    flask-paginate
-    flask-reverse-proxy-fix
-    flask_wtf
-    arrow
-    werkzeug
-    click
    html5lib
-    vcrpy
-    toml
-  ];
+  ] ++ lib.optionals withServer serverRequire;

  postPatch = ''
    # Jailbreak problematic dependencies
    sed -i \
      -e "s,'PyYAML.*','PyYAML',g" \
+      -e "/'pytest-cov/d" \
+      -e "/'pylint/d" \
+      -e "/'flake8/d" \
      setup.py
  '';

@ -80,6 +84,8 @@ with python3'.pkgs; buildPythonApplication rec {
      --replace "self.assertEqual(url, \"https://www.google.com\")" ""
    substituteInPlace setup.py \
      --replace mypy-extensions==0.4.1 mypy-extensions>=0.4.1
+  '' + lib.optionalString (!withServer) ''
+    rm tests/test_{server,views}.py
  '';

  postInstall = ''
@ -89,6 +95,8 @@ with python3'.pkgs; buildPythonApplication rec {
    cp auto-completion/zsh/* $out/share/zsh/site-functions
    cp auto-completion/bash/* $out/share/bash-completion/completions
    cp auto-completion/fish/* $out/share/fish/vendor_completions.d
+  '' + lib.optionalString (!withServer) ''
+    rm $out/bin/bukuserver
  '';

  meta = with lib; {
@ -99,4 +107,3 @@ with python3'.pkgs; buildPythonApplication rec {
    maintainers = with maintainers; [ matthiasbeyer infinisil ma27 ];
  };
 }
-
--- a/pkgs/applications/misc/clifm/default.nix
+++ b/pkgs/applications/misc/clifm/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "clifm";
-  version = "1.3";
+  version = "1.4";

  src = fetchFromGitHub {
    owner = "leo-arch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-nYBGM3gUj1NGrxNLt0xpNl00cgS2Ecs3kYjZapiJT48=";
+    sha256 = "sha256-62WxvJsXkzvDqFGFpid9VDB1mARgllkKnb6mFC5pdl8=";
  };

  buildInputs = [ libcap acl file readline ];
--- a/pkgs/applications/misc/firefly-desktop/default.nix
+++ b/pkgs/applications/misc/firefly-desktop/default.nix
@ -0,0 +1,34 @@
+{ lib, fetchurl, appimageTools }:
+
+let
+  pname = "firefly-desktop";
+  version = "1.2.0";
+  src = fetchurl {
+    url = "https://github.com/iotaledger/firefly/releases/download/desktop-${version}/${pname}-${version}.AppImage";
+    sha256 = "f3162efcf0407614fd1351af50e95ef180400b747a5cc6b82bc840828a15548d";
+  };
+  appimageContents = appimageTools.extractType2 { inherit pname version src; };
+
+in appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libsecret ];
+
+  extraInstallCommands = ''
+    mkdir -p $out/share/applications $out/share/pixmaps
+    mv $out/bin/${pname}-${version} $out/bin/firefly-desktop
+    cp ${appimageContents}/desktop.desktop $out/share/applications/firefly-desktop.desktop
+    substituteInPlace $out/share/applications/firefly-desktop.desktop \
+      --replace 'Exec=AppRun' 'Exec=firefly-desktop' \
+      --replace 'Icon=desktop' 'Icon=firefly-desktop'
+    cp ${appimageContents}/desktop.png $out/share/pixmaps/firefly-desktop.png
+  '';
+
+  meta = with lib; {
+    description = "IOTA's New Wallet";
+    homepage = "https://firefly.iota.org";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/misc/iptsd/default.nix
+++ b/pkgs/applications/misc/iptsd/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
      --replace "install_dir: rulesdir" "install_dir: datadir" \
  '';
  mesonFlags = [
-    "-Dsystemd=true"
+    "-Dservice_manager=systemd"
    "-Dsample_config=false"
    "-Ddebug_tool=false"
  ];
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@ -18,13 +18,13 @@

 mkDerivation rec {
  pname = "qcad";
-  version = "3.27.1.0";
+  version = "3.27.1.3";

  src = fetchFromGitHub {
    owner = "qcad";
    repo = "qcad";
    rev = "v${version}";
-    sha256 = "sha256-tydgSfS1MF322sgWULMEZ8P6YIaN1QoeJiia0wbsgjo=";
+    sha256 = "sha256-DHDfDwGrYMRd5gxFaPL06B/wssQho9420MxUg8fI2r0=";
  };

  patches = [
--- a/pkgs/applications/misc/rivercarro/default.nix
+++ b/pkgs/applications/misc/rivercarro/default.nix
@ -0,0 +1,51 @@
+{ lib
+, stdenv
+, fetchFromSourcehut
+, zig
+, river
+, wayland
+, pkg-config
+, scdoc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rivercarro";
+  version = "0.1.1";
+
+  src = fetchFromSourcehut {
+    owner = "~novakane";
+    repo = pname;
+    fetchSubmodules = true;
+    rev = "v${version}";
+    sha256 = "0h1wvl6rlrpr67zl51x71hy7nwkfd5kfv5p2mql6w5fybxxyqnpm";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    river
+    scdoc
+    wayland
+    zig
+  ];
+
+  dontConfigure = true;
+
+  preBuild = ''
+    export HOME=$TMPDIR
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    zig build -Drelease-safe -Dcpu=baseline -Dman-pages --prefix $out install
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://git.sr.ht/~novakane/rivercarro";
+    description = "A layout generator for river Wayland compositor, fork of rivertile";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ kraem ];
+  };
+}
+
--- a/pkgs/applications/misc/ttyper/default.nix
+++ b/pkgs/applications/misc/ttyper/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ttyper";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "max-niederman";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-UptjgFGp4QNG8eLuqBzg/Kd5p5Rms3yT172hbf/2hi4=";
+    sha256 = "sha256-e001uftwIwnCpjf4OH89QWaYyT99aMZhCPqDxyAsHyU=";
  };

-  cargoSha256 = "sha256-N10X5eJlpDKmCEffEXpkAejS32Lz183Lup0mmLMwOSU=";
+  cargoSha256 = "sha256-RvqktyPZtdKC8RVtLWpT1YYsdgyfHaL7W3+vO8RgG/8=";

  meta = with lib; {
    description = "Terminal-based typing test";
--- a/pkgs/applications/misc/zettlr/default.nix
+++ b/pkgs/applications/misc/zettlr/default.nix
@ -10,11 +10,11 @@
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
 let
  pname = "zettlr";
-  version = "2.0.2";
+  version = "2.1.2";
  name = "${pname}-${version}";
  src = fetchurl {
    url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
-    sha256 = "sha256-AUGfD7FFB5+pfKyIqvychD4mvFU+GTRneQTRI+8bwBM=";
+    sha256 = "sha256-gfq5eXSoEfOb3FVAv/iDDSGeEeZxFRp4BFtwf87WQGE=";
  };
  appimageContents = appimageTools.extractType2 {
    inherit name src;
--- a/pkgs/applications/misc/zola/default.nix
+++ b/pkgs/applications/misc/zola/default.nix
@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "zola";
-  version = "0.15.2";
+  version = "0.15.3";

  src = fetchFromGitHub {
    owner = "getzola";
    repo = "zola";
    rev = "v${version}";
-    sha256 = "sha256-X4J3T/ob0NfCFxddadBtsPsDhfvesg6/sBJybWeubMM=";
+    sha256 = "sha256-LK8twqWaS+SQ3oqvMGE7oP/IJNLvQ45Pu92pkbSKzDs=";
  };

-  cargoSha256 = "sha256-0tynm/DTX2oiqZOdWjRBGPk8IPIN07x2+FCXQmQ4Fzo=";
+  cargoSha256 = "sha256-7W0vjbAWZl/eKBZvUWWWolEOh8aQeKegt823EebcKMQ=";

  nativeBuildInputs = [
    cmake
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -93,11 +93,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.34.80";
+  version = "1.34.81";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "2N+dXQGVfm3GsaKKo3EBxLu+cu08OjlrqkgXX9knFys=";
+    sha256 = "bMNk1l3MguQho0vck78U1e3A+/571DyoWSKKerQVE7s=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "2.2.2";
-  commit = "03b17e0233e64787ffb5fcf65c740cc2a20822ba";
+  version = "2.2.3";
+  commit = "afbd59ba636cfd999fe6ead8a84323413882e230";
  tag = "v${version}";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = tag;
-    sha256 = "sha256-xExtGKM3iNgX849xmLcgIwRbXJSJnGDuVhRMkti+Mkc=";
+    sha256 = "sha256-Lw4/VmwD/IF2GEFzQP1kerXrST1kvWvG2nr/br/tO0w=";
  };

  vendorSha256 = "sha256-BVhts+gOM6nhcR1lkFzy7OJnainLXw5YdeseBBRF2xE=";
--- a/pkgs/applications/networking/cluster/krane/Gemfile.lock
+++ b/pkgs/applications/networking/cluster/krane/Gemfile.lock
@ -1,41 +1,42 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    activesupport (6.1.4.1)
+    activesupport (7.0.1)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 1.6, < 2)
      minitest (>= 5.1)
      tzinfo (~> 2.0)
-      zeitwerk (~> 2.3)
    addressable (2.8.0)
      public_suffix (>= 2.0.2, < 5.0)
-    cgi (0.3.1)
    colorize (0.8.1)
    concurrent-ruby (1.1.9)
-    date (3.2.2)
    domain_name (0.5.20190701)
      unf (>= 0.0.5, < 1.0.0)
-    ejson (1.3.0)
-    faraday (1.8.0)
+    ejson (1.3.1)
+    faraday (1.9.3)
      faraday-em_http (~> 1.0)
      faraday-em_synchrony (~> 1.0)
      faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.1)
+      faraday-net_http_persistent (~> 1.0)
      faraday-patron (~> 1.0)
      faraday-rack (~> 1.0)
-      multipart-post (>= 1.2, < 3)
+      faraday-retry (~> 1.0)
      ruby2_keywords (>= 0.0.4)
    faraday-em_http (1.0.0)
    faraday-em_synchrony (1.0.0)
    faraday-excon (1.1.0)
    faraday-httpclient (1.0.1)
+    faraday-multipart (1.0.3)
+      multipart-post (>= 1.2, < 3)
    faraday-net_http (1.0.1)
    faraday-net_http_persistent (1.2.0)
    faraday-patron (1.0.0)
    faraday-rack (1.0.0)
-    ffi (1.15.4)
+    faraday-retry (1.0.3)
+    ffi (1.15.5)
    ffi-compiler (1.0.1)
      ffi (>= 1.0.0)
      rake
@ -59,36 +60,34 @@ GEM
      ffi-compiler (>= 1.0, < 2.0)
    i18n (1.8.11)
      concurrent-ruby (~> 1.0)
-    jsonpath (0.9.9)
+    jsonpath (1.1.0)
      multi_json
-      to_regexp (~> 0.2.1)
    jwt (2.3.0)
-    krane (2.3.4)
+    krane (2.4.0)
      activesupport (>= 5.0)
-      cgi
      colorize (~> 0.8)
      concurrent-ruby (~> 1.1)
-      date
      ejson (~> 1.0)
      googleauth (~> 0.8)
-      jsonpath (~> 0.9.6)
-      kubeclient (~> 4.3)
+      jsonpath (~> 1.0)
+      kubeclient (~> 4.9)
      oj (~> 3.0)
      statsd-instrument (>= 2.8, < 4)
      thor (>= 1.0, < 2.0)
-    kubeclient (4.7.0)
+    kubeclient (4.9.2)
      http (>= 3.0, < 5.0)
+      jsonpath (~> 1.0)
      recursive-open-struct (~> 1.1, >= 1.1.1)
      rest-client (~> 2.0)
    memoist (0.16.2)
    mime-types (3.4.1)
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2021.1115)
-    minitest (5.14.4)
+    mime-types-data (3.2022.0105)
+    minitest (5.15.0)
    multi_json (1.15.0)
    multipart-post (2.1.1)
    netrc (0.11.0)
-    oj (3.13.9)
+    oj (3.13.11)
    os (1.1.4)
    public_suffix (4.0.6)
    rake (13.0.6)
@ -105,14 +104,12 @@ GEM
      jwt (>= 1.5, < 3.0)
      multi_json (~> 1.10)
    statsd-instrument (3.1.2)
-    thor (1.1.0)
-    to_regexp (0.2.1)
+    thor (1.2.1)
    tzinfo (2.0.4)
      concurrent-ruby (~> 1.0)
    unf (0.1.4)
      unf_ext
    unf_ext (0.0.8)
-    zeitwerk (2.5.1)

 PLATFORMS
  ruby
--- a/pkgs/applications/networking/cluster/krane/gemset.nix
+++ b/pkgs/applications/networking/cluster/krane/gemset.nix
@ -1,14 +1,14 @@
 {
  activesupport = {
-    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
+    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19gx1jcq46x9d1pi1w8xq0bgvvfw239y4lalr8asm291gj3q3ds4";
+      sha256 = "02lys9pnb99hsczs551iqzjn008i8k7c728xxba7acfi9rdw9pa6";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "7.0.1";
  };
  addressable = {
    dependencies = ["public_suffix"];
@ -21,16 +21,6 @@
    };
    version = "2.8.0";
  };
-  cgi = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1vy8g58ns18x3dl566wg5rp4hymlx9584ddf75isdyig0yxjl0sn";
-      type = "gem";
-    };
-    version = "0.3.1";
-  };
  colorize = {
    groups = ["default"];
    platforms = [];
@ -51,16 +41,6 @@
    };
    version = "1.1.9";
  };
-  date = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0j1ghv5lqpn8jdvvci2fqvl30j4x31hhgzzc0mj54cga1sgh97n7";
-      type = "gem";
-    };
-    version = "3.2.2";
-  };
  domain_name = {
    dependencies = ["unf"];
    groups = ["default"];
@ -77,21 +57,21 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "09584dhklhnxvgrf1b1lvb1illhzg79rsd9sgbpzrawiir789ksy";
+      sha256 = "0gmfyyzzvb9k5nm1a5x83d7krajfghghfsakhxmdpvncyj2vnrpa";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "1.3.1";
  };
  faraday = {
-    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "faraday-rack" "multipart-post" "ruby2_keywords"];
+    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-multipart" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "faraday-rack" "faraday-retry" "ruby2_keywords"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0afhlqgby2cizcwgh7h2sq5f77q01axjbdl25bsvfwsry9n7gyyi";
+      sha256 = "0y32gj994ll3zlcqjmwp78r7s03iiwayij6fz2pjpkfywgvp71s6";
      type = "gem";
    };
-    version = "1.8.0";
+    version = "1.9.3";
  };
  faraday-em_http = {
    groups = ["default"];
@ -133,6 +113,17 @@
    };
    version = "1.0.1";
  };
+  faraday-multipart = {
+    dependencies = ["multipart-post"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03qfi9020ynf7hkdiaq01sd2mllvw7fg4qiin3pk028b4wv23j3j";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
  faraday-net_http = {
    groups = ["default"];
    platforms = [];
@ -173,15 +164,25 @@
    };
    version = "1.0.0";
  };
+  faraday-retry = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "153i967yrwnswqgvnnajgwp981k9p50ys1h80yz3q94rygs59ldd";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
  ffi = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ssxcywmb3flxsjdg13is6k01807zgzasdhj4j48dm7ac59cmksn";
+      sha256 = "1862ydmclzy1a0cjbvm8dz7847d9rch495ib0zb64y84d3xd4bkg";
      type = "gem";
    };
-    version = "1.15.4";
+    version = "1.15.5";
  };
  ffi-compiler = {
    dependencies = ["ffi" "rake"];
@ -270,15 +271,15 @@
    version = "1.8.11";
  };
  jsonpath = {
-    dependencies = ["multi_json" "to_regexp"];
+    dependencies = ["multi_json"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zim5bl7zsbccd502iy63f7c3b6dw0a820z7q8kpv66hncavb7gp";
+      sha256 = "12hjsr0plnx6v0bh1rhhimfi7z3rqm19xb47ybdkc1h9yhynnmdq";
      type = "gem";
    };
-    version = "0.9.9";
+    version = "1.1.0";
  };
  jwt = {
    groups = ["default"];
@ -291,26 +292,26 @@
    version = "2.3.0";
  };
  krane = {
-    dependencies = ["activesupport" "cgi" "colorize" "concurrent-ruby" "date" "ejson" "googleauth" "jsonpath" "kubeclient" "oj" "statsd-instrument" "thor"];
+    dependencies = ["activesupport" "colorize" "concurrent-ruby" "ejson" "googleauth" "jsonpath" "kubeclient" "oj" "statsd-instrument" "thor"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07pij3z7kz7n0nvf8xwcaackck8wyjwldjva7215k2dm8csdzaih";
+      sha256 = "1xnf0cw5i1i8l5nm1c9z02h184ad6hvy7fydr4bdzckjkyinamv9";
      type = "gem";
    };
-    version = "2.3.4";
+    version = "2.4.0";
  };
  kubeclient = {
-    dependencies = ["http" "recursive-open-struct" "rest-client"];
+    dependencies = ["http" "jsonpath" "recursive-open-struct" "rest-client"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1k4w7h6fywhccv7fskwks9p71fvbh00qyvcx8cc4bnvwjn43680w";
+      sha256 = "0kld1w4706dfd6jx3snsi4h2pvqfazz1fni5al2ln60s3b8sybq4";
      type = "gem";
    };
-    version = "4.7.0";
+    version = "4.9.2";
  };
  memoist = {
    groups = ["default"];
@ -338,20 +339,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "03m3fkix2haah20kvh1jgv262yg9jlzn6wq0y31kafxk8fysfy27";
+      sha256 = "003gd7mcay800k2q4pb2zn8lwwgci4bhi42v2jvlidm8ksx03i6q";
      type = "gem";
    };
-    version = "3.2021.1115";
+    version = "3.2022.0105";
  };
  minitest = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19z7wkhg59y8abginfrm2wzplz7py3va8fyngiigngqvsws6cwgl";
+      sha256 = "06xf558gid4w8lwx13jwfdafsch9maz8m0g85wnfymqj63x5nbbd";
      type = "gem";
    };
-    version = "5.14.4";
+    version = "5.15.0";
  };
  multi_json = {
    groups = ["default"];
@ -388,10 +389,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1hcmczbp9afxijzg0gvp9milyzk15phfmbpmmsj5ppmziwkdls16";
+      sha256 = "0bm8sdh7vz7ss3y21v961rd8nww23w5g4yhgvnd7jk331kdjyyzl";
      type = "gem";
    };
-    version = "3.13.9";
+    version = "3.13.11";
  };
  os = {
    groups = ["default"];
@ -480,20 +481,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18yhlvmfya23cs3pvhr1qy38y41b6mhr5q9vwv5lrgk16wmf3jna";
+      sha256 = "0inl77jh4ia03jw3iqm5ipr76ghal3hyjrd6r8zqsswwvi9j2xdi";
      type = "gem";
    };
-    version = "1.1.0";
-  };
-  to_regexp = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1rgabfhnql6l4fx09mmj5d0vza924iczqf2blmn82l782b6qqi9v";
-      type = "gem";
-    };
-    version = "0.2.1";
+    version = "1.2.1";
  };
  tzinfo = {
    dependencies = ["concurrent-ruby"];
@ -527,14 +518,4 @@
    };
    version = "0.0.8";
  };
-  zeitwerk = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "18l4r6layck0d80ydc692mv1lxak5xbf6w2paj1x7m2ggbggzxgj";
-      type = "gem";
-    };
-    version = "2.5.1";
-  };
 }
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
    description = "Production-Grade Container Scheduling and Management";
    license = licenses.asl20;
    homepage = "https://kubernetes.io";
-    maintainers = with maintainers; [ johanot offline saschagrunert ];
+    maintainers = with maintainers; [ ] ++ teams.kubernetes.members;
    platforms = platforms.unix;
  };

--- a/pkgs/applications/networking/cluster/kubernetes/kubectl.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/kubectl.nix
--- a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
@ -19,8 +19,6 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ autoPatchelfHook ] ++ (if stdenv.isDarwin then [ unzip ] else [ dpkg ]);

-  buildInputs = [ awscli ];
-
  unpackPhase = if stdenv.isDarwin then "unzip $src" else "dpkg-deb -x $src .";

  installPhase = ''
--- a/pkgs/applications/networking/cluster/starboard/default.nix
+++ b/pkgs/applications/networking/cluster/starboard/default.nix
@ -1,20 +1,32 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:

 buildGoModule rec {
  pname = "starboard";
-  version = "0.12.0";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-6QIQsxqTKERo5x2Knv4IBeNt5KjvfoW0ryFJLlALqrA=";
+    sha256 = "sha256-/k9lQS3oPOYxhaaXuaDwPnai7byDkge4yBu7/9g4RUE=";
+    # populate values that require us to use git. By doing this in postFetch we
+    # can delete .git afterwards and maintain better reproducibility of the src.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      commit="$(git rev-parse HEAD)"
+      source_date_epoch=$(git log --date=format:'%Y-%m-%dT%H:%M:%SZ' -1 --pretty=%ad)
+      substituteInPlace "$out/cmd/starboard/main.go" \
+        --replace 'commit  = "none"' "commit  = \"$commit\"" \
+        --replace 'date    = "unknown"' "date    = \"$source_date_epoch\""
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
  };
+  vendorSha256 = "sha256-7SVEyyJRE7oYIhuENraZy0aieIAoFFWtq4mrSXxURlQ=";

-  vendorSha256 = "sha256-r6wMSeW5Et6hYwoEKufmcOmucuHlYuBDOMuXXMT4W2Y=";
+  nativeBuildInputs = [ installShellFiles ];

-  # Don't build and check the integration tests
-  excludedPackages = "itest";
+  subPackages = [ "cmd/starboard" ];

  ldflags = [
    "-s" "-w" "-X main.version=v${version}"
@ -23,6 +35,20 @@ buildGoModule rec {
  preCheck = ''
    # Remove test that requires networking
    rm pkg/plugin/aqua/client/client_integration_test.go
+
+    # Feed in all but the integration tests for testing
+    # This is because subPackages above limits what is built to just what we
+    # want but also limits the tests
+    getGoDirs() {
+      go list ./... | grep -v itest
+    }
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd starboard \
+      --bash <($out/bin/starboard completion bash) \
+      --fish <($out/bin/starboard completion fish) \
+      --zsh <($out/bin/starboard completion zsh)
  '';

  doInstallCheck = true;
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -19,7 +19,8 @@ let
    , vendorSha256 ? throw "vendorSha256 missing: please use `buildGoModule`" /* added 2022/01 */
    , deleteVendor ? false
    , proxyVendor ? false
-    , provider-source-address
+    , # Looks like "registry.terraform.io/vancluever/acme"
+      provider-source-address
    }@attrs:
    buildGoModule {
      pname = repo;
@ -34,9 +35,15 @@ let
        inherit owner repo rev sha256;
      };

-      # Terraform allow checking the provider versions, but this breaks
-      # if the versions are not provided via file paths.
-      postBuild = "mv $NIX_BUILD_TOP/go/bin/${repo}{,_v${version}}";
+      # Move the provider to libexec
+      postInstall = ''
+        dir=$out/libexec/terraform-providers/${provider-source-address}/${version}/''${GOOS}_''${GOARCH}
+        mkdir -p "$dir"
+        mv $out/bin/* "$dir/terraform-provider-$(basename ${provider-source-address})_${version}"
+        rmdir $out/bin
+      '';
+
+      # Keep the attributes around for later consumption
      passthru = attrs;
    };

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -40,10 +40,10 @@
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.152.0",
-    "sha256": "1childp3dkdi6raya1865inkky2qx1jav95yq9c57gz20zs27x8a",
+    "rev": "v1.153.0",
+    "sha256": "1h37sxzkngmikvmyj9isx45vcpd31ml47f4r6ii1h2l69182hsqs",
    "vendorSha256": "18chs2723i2cxhhm649mz52pp6wrfqzxgk12zxq9idrhicchqnzg",
-    "version": "1.152.0"
+    "version": "1.153.0"
  },
  "ansible": {
    "owner": "nbering",
@ -67,10 +67,10 @@
    "owner": "alexkappa",
    "provider-source-address": "registry.terraform.io/alexkappa/auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v0.25.0",
-    "sha256": "0ibscxhwj92k8p43apnxyl9sly7pldv0lgcikjfjj352084q4k62",
+    "rev": "v0.26.1",
+    "sha256": "03nzwsda6n1nycpk2w87b8fj6aqzid8i2fa29qd9skwplm7hyjfk",
    "vendorSha256": "0k6lylkcdvm0piaic8hdbhg1jf1vzc897w1sq7v57brx7586h3sc",
-    "version": "0.25.0"
+    "version": "0.26.1"
  },
  "avi": {
    "owner": "vmware",
@ -94,10 +94,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v3.72.0",
-    "sha256": "0xkwqh7akc7rf047w6by4368n2bpn4lijk9j6j3wsgbaffw0xjlb",
-    "vendorSha256": "0apvp3vb3qx2l6698x4ai3spz40l6mb3z8gn45ms2vlxcwp2wf7y",
-    "version": "3.72.0"
+    "rev": "v3.73.0",
+    "sha256": "0la188dljw15l09j2farlhgri0vhrlbmsay7q1ar2y4ralqlsgl8",
+    "vendorSha256": "1h2x1318ax4qdy261wm8pqxq21ra50hymcykhw6mhj5lqxcb5r5z",
+    "version": "3.73.0"
  },
  "azuread": {
    "owner": "hashicorp",
@ -112,10 +112,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
    "repo": "terraform-provider-azurerm",
-    "rev": "v2.92.0",
-    "sha256": "0p4vxda4n7895xp7aqg4zqddynjn7hnzsc8am83y8hf9hbfaji8q",
+    "rev": "v2.93.0",
+    "sha256": "0akacaih0smdjxh9ssdir1j248m5bpcc4wpwhykb7922yvj581ds",
    "vendorSha256": null,
-    "version": "2.92.0"
+    "version": "2.93.0"
  },
  "azurestack": {
    "owner": "hashicorp",
@ -139,10 +139,10 @@
    "owner": "F5Networks",
    "provider-source-address": "registry.terraform.io/F5Networks/bigip",
    "repo": "terraform-provider-bigip",
-    "rev": "v1.12.1",
-    "sha256": "0dpgxcdcpv6y25ffs0gp2pvq8z9yfh7hdqll25d0b09z0pqgb61q",
+    "rev": "v1.12.2",
+    "sha256": "08qs8psr4wy5f9qiv7chkmmsls19dwj2p2k6fqxdrd6pj2154rcg",
    "vendorSha256": null,
-    "version": "1.12.1"
+    "version": "1.12.2"
  },
  "brightbox": {
    "owner": "brightbox",
@ -248,10 +248,10 @@
    "owner": "DataDog",
    "provider-source-address": "registry.terraform.io/DataDog/datadog",
    "repo": "terraform-provider-datadog",
-    "rev": "v3.7.0",
-    "sha256": "0fynbn0zbplslbvqz0jij4gm8q6ydg697x7nh5rzw89dy26l2f8g",
-    "vendorSha256": "0ngvbc9h3csl811g40q707flf4dl1hal95hpkxsvz7p71s3371q8",
-    "version": "3.7.0"
+    "rev": "v3.8.1",
+    "sha256": "0mvl80dsqzab1r3p5n446737dadzfbsyfbdy2w2xvmz4fgx6aklh",
+    "vendorSha256": "0p8czqb4hn5z9bfgsfajdpx46hwil0ax75j8xljlh1ccvpp2rvyz",
+    "version": "3.8.1"
  },
  "dhall": {
    "owner": "awakesecurity",
@ -347,10 +347,10 @@
    "owner": "fastly",
    "provider-source-address": "registry.terraform.io/fastly/fastly",
    "repo": "terraform-provider-fastly",
-    "rev": "v0.40.0",
-    "sha256": "11gf1xmj0qgn3hfw4hviqnfc23rrfd3qxz82idff4f1i7c5kym1i",
+    "rev": "v0.41.0",
+    "sha256": "096dwysa1awyb4a1fay9sw1i784cki8q4x141f9gan5w1qwns89y",
    "vendorSha256": null,
-    "version": "0.40.0"
+    "version": "0.41.0"
  },
  "flexibleengine": {
    "owner": "FlexibleEngineCloud",
@ -383,10 +383,10 @@
    "owner": "integrations",
    "provider-source-address": "registry.terraform.io/integrations/github",
    "repo": "terraform-provider-github",
-    "rev": "v4.19.1",
-    "sha256": "0dixdw0215ksa76871mac60k7y0vm111f3jay9njsa1ljz8rwhnd",
+    "rev": "v4.19.2",
+    "sha256": "0k6w1wxx9a67wkgh4j4aswbpcnlnjcvqnfi0gy2rw9kqbyxb9j0m",
    "vendorSha256": null,
-    "version": "4.19.1"
+    "version": "4.19.2"
  },
  "gitlab": {
    "owner": "gitlabhq",
@ -402,20 +402,20 @@
    "provider-source-address": "registry.terraform.io/hashicorp/google",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.6.0",
-    "sha256": "0vi0crc4i5myzw17knvb3zz0yjpg7v1qvp9rjrb0q6v89nafr30c",
-    "vendorSha256": "17rlq86zl83cav8pinr8am3wkmva4slab2izmxddhiw3na60a4la",
-    "version": "4.6.0"
+    "rev": "v4.7.0",
+    "sha256": "15w69dyr0s818as7v8pwzdbfs82l23qn846a7xlihw2g49xk0cah",
+    "vendorSha256": "144kv885w2gfsljj8vx7q9pgrpyshpn392162ljzpjb6qx3qzzxj",
+    "version": "4.7.0"
  },
  "google-beta": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.6.0",
-    "sha256": "0kbdpyln8yy3128g43y134v5li9k5a6mb2fwa0jl8zffmhfc209k",
-    "vendorSha256": "17rlq86zl83cav8pinr8am3wkmva4slab2izmxddhiw3na60a4la",
-    "version": "4.6.0"
+    "rev": "v4.7.0",
+    "sha256": "0jnz05yvhlawgc188xazv1fvqsqvpm867xf3i93xpl248pr1vqlf",
+    "vendorSha256": "144kv885w2gfsljj8vx7q9pgrpyshpn392162ljzpjb6qx3qzzxj",
+    "version": "4.7.0"
  },
  "grafana": {
    "owner": "grafana",
@ -430,10 +430,10 @@
    "owner": "gridscale",
    "provider-source-address": "registry.terraform.io/gridscale/gridscale",
    "repo": "terraform-provider-gridscale",
-    "rev": "v1.13.0",
-    "sha256": "0m4n1ih7fzwxrnd3b70i4xl0nrwbpw8f6hh1fpa02jv7znpdp7l8",
+    "rev": "v1.14.0",
+    "sha256": "1syi3hvmff8dkbh538r4acbr5r72nmd073fvr52zcn0a9bc3q9np",
    "vendorSha256": null,
-    "version": "1.13.0"
+    "version": "1.14.0"
  },
  "hcloud": {
    "owner": "hetznercloud",
@ -583,19 +583,19 @@
    "owner": "launchdarkly",
    "provider-source-address": "registry.terraform.io/launchdarkly/launchdarkly",
    "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.3.0",
-    "sha256": "1yvxzhwx5nm53gjaqxzsfkc8khgyi2va1a9kjwmkhzqghzl4w5nw",
-    "vendorSha256": "0pmnhlfmi9i6xblz62ysnw02p4i8iz6naqpna99gbgyllnj5asdg",
-    "version": "2.3.0"
+    "rev": "v2.4.1",
+    "sha256": "1smrdhg6fn9lzrlh0mz822zibnvd1487w5qn38l71ark9dadahqv",
+    "vendorSha256": "13vcxvw56bn7mdz917lvdryd2d7mcvi83ykbzjfbpxr4lzrrm9qw",
+    "version": "2.4.1"
  },
  "libvirt": {
    "owner": "dmacvicar",
    "provider-source-address": "registry.terraform.io/dmacvicar/libvirt",
    "repo": "terraform-provider-libvirt",
-    "rev": "v0.6.12",
-    "sha256": "1kqpy1cr7vg4iclxwd7wa4fmhw63l3z5gn07knfx9in7nm380pyn",
-    "vendorSha256": "0l9wr4g77chmshcfibdbl23rs8y8bxgiar4n152gkr0z12jvr5iq",
-    "version": "0.6.12"
+    "rev": "v0.6.13",
+    "sha256": "1fvxvijl5vjx7gb4w19pf4gcq97pisiznr2n72ybpma46c2clx2h",
+    "vendorSha256": "0rck411b4dh2zh4m4m6h2d03zlv5wm94li9dq5ggr0lspfx6nv1i",
+    "version": "0.6.13"
  },
  "linode": {
    "owner": "linode",
@ -638,10 +638,10 @@
    "owner": "terraform-lxd",
    "provider-source-address": "registry.terraform.io/terraform-lxd/lxd",
    "repo": "terraform-provider-lxd",
-    "rev": "v1.6.0",
-    "sha256": "07h159mjbddkf3ishhdknqn10pyb2wh9yavjps5mwmdbiii6qpvy",
+    "rev": "v1.7.0",
+    "sha256": "1fg9ad6zmkkg8j4sqfan3ibjjb73digg10k5h8xaii778r9bh311",
    "vendorSha256": "11x12jxh4q99hinpljqfchysgkhch93sgv0mz065ws20y0dxzfvs",
-    "version": "1.6.0"
+    "version": "1.7.0"
  },
  "mailgun": {
    "owner": "wgebis",
@ -766,10 +766,10 @@
    "owner": "terraform-providers",
    "provider-source-address": "registry.terraform.io/hashicorp/oci",
    "repo": "terraform-provider-oci",
-    "rev": "v4.59.0",
-    "sha256": "12i4j95g08c887xxplc90hcxwsrpwcn5qjyy5inazr21vqscjx2h",
+    "rev": "v4.60.0",
+    "sha256": "02wxisy2c9g6kkg6wrgv99qfrds26xwqfj2m3v97y0ldpi2fhbpa",
    "vendorSha256": null,
-    "version": "4.59.0"
+    "version": "4.60.0"
  },
  "okta": {
    "owner": "okta",
@ -803,10 +803,10 @@
    "owner": "OpenNebula",
    "provider-source-address": "registry.terraform.io/OpenNebula/opennebula",
    "repo": "terraform-provider-opennebula",
-    "rev": "v0.3.0",
-    "sha256": "110mzxr2mk9hzw7nfisyl4in7r7q4m280szzgc3bzlp9sjvqgg3y",
-    "vendorSha256": "1wp9dk5kcrkmcx7mh5inbq3zd7qwp8sbl9hc0svaf44mf1p9446w",
-    "version": "0.3.0"
+    "rev": "v0.4.0",
+    "sha256": "1r6v1ksis0h9mairvn9mwk49dkn6s6ixi8j0jaz9w173lx5si917",
+    "vendorSha256": "0qyzavig8wnnjzm63pny5azywqyrnjm978yg5y0sr6zw8wghjd15",
+    "version": "0.4.0"
  },
  "openstack": {
    "owner": "terraform-provider-openstack",
@ -821,10 +821,10 @@
    "owner": "opentelekomcloud",
    "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.27.2",
-    "sha256": "1icfsjpch6plp9qbx0snn55kvkba0kvnd0skwdhzxi66xcdw0s9b",
-    "vendorSha256": "0dc4l5swfw666mpm5q67gm45abkm9zsvibqrja910h6rrp387576",
-    "version": "1.27.2"
+    "rev": "v1.27.3",
+    "sha256": "17n1vy9h2blw9k3p82sbcz9zbj4hilg33qga5n09nq2ngafagazg",
+    "vendorSha256": "12ahdbb83gxb9dcax635ngr54cqvnydr7l65h5dvv7b2gfldb1ki",
+    "version": "1.27.3"
  },
  "opsgenie": {
    "owner": "opsgenie",
@ -1055,10 +1055,10 @@
    "owner": "tencentcloudstack",
    "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.61.1",
-    "sha256": "1v6b8ldg6pkphqy5aphdhig1q3iizzfrj611k39lyk1q3q914yf4",
+    "rev": "v1.61.2",
+    "sha256": "1i9jyz4r344swdvnnpgz2s1ds5b5s2hif3bjr82mmfd7gshyagnq",
    "vendorSha256": null,
-    "version": "1.61.1"
+    "version": "1.61.2"
  },
  "tfe": {
    "owner": "hashicorp",
@ -1128,10 +1128,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/vault",
    "repo": "terraform-provider-vault",
-    "rev": "v3.1.1",
-    "sha256": "15fwc0sfdpcl85194gq6r97y18ggh61wbyh6lq7nrprwn2xvjch9",
-    "vendorSha256": "1q2yfmg6g3bl6h0vzanz7874xc4g7ggmysh2dqryijvr4kccnari",
-    "version": "3.1.1"
+    "rev": "v3.2.1",
+    "sha256": "0y8vvc5mckzjs24x36rihl1vdvh9k2kazn5lsqvq6apv36kg5vw4",
+    "vendorSha256": "0j5kz5jvyds701gq89v8dcsvm67kbfxxgzjvmn74ms3nrkx8hr84",
+    "version": "3.2.1"
  },
  "vcd": {
    "owner": "vmware",
@ -1192,10 +1192,10 @@
    "owner": "vultr",
    "provider-source-address": "registry.terraform.io/vultr/vultr",
    "repo": "terraform-provider-vultr",
-    "rev": "v2.8.1",
-    "sha256": "1dhfxr6a4kj1llalfw76w36iw6vcdk1p0nb90kfkpg2sh58a6rid",
+    "rev": "v2.9.0",
+    "sha256": "0hx1n1wcjx40s94bysr14j0w4bc1xzkrrmkpjcwwbqywn75p6ggw",
    "vendorSha256": null,
-    "version": "2.8.1"
+    "version": "2.9.0"
  },
  "wavefront": {
    "owner": "vmware",
@ -1210,9 +1210,9 @@
    "owner": "yandex-cloud",
    "provider-source-address": "registry.terraform.io/yandex-cloud/yandex",
    "repo": "terraform-provider-yandex",
-    "rev": "v0.69.0",
-    "sha256": "0k4py0asibcpfl9w8q0bn3rfjxhxf6cs3g53j35qij3gakqf1w2i",
+    "rev": "v0.70.0",
+    "sha256": "0dmhzjwcd0j7rfczxahami23yjcc0pr10m12iig3z4hj9kgikzvy",
    "vendorSha256": "0zx2lq9va0llrjlf3lk8pnx6f5knmi4jjxrnll89kp01imydjqv8",
-    "version": "0.69.0"
+    "version": "0.70.0"
  }
 }
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -1,5 +1,6 @@
 { stdenv
 , lib
+, buildEnv
 , buildGoModule
 , fetchFromGitHub
 , makeWrapper
@ -62,9 +63,9 @@ let
          babariviere
          kalbasit
          marsam
+          maxeaubrey
          timstott
          zimbatm
-          maxeaubrey
          zowoq
        ];
      };
@ -76,39 +77,6 @@ let
        let
          actualPlugins = plugins terraform.plugins;

-          # Make providers available in Terraform 0.13 and 0.12 search paths.
-          pluginDir = lib.concatMapStrings
-            (pl:
-              let
-                inherit (pl) version GOOS GOARCH;
-
-                pname = pl.pname or (throw "${pl.name} is missing a pname attribute");
-
-                # This is just the name, without the terraform-provider- prefix
-                plugin_name = lib.removePrefix "terraform-provider-" pname;
-
-                slug = pl.passthru.provider-source-address or "registry.terraform.io/nixpkgs/${plugin_name}";
-
-                shim = writeText "shim" ''
-                  #!${runtimeShell}
-                  exec ${pl}/bin/${pname}_v${version} "$@"
-                '';
-              in
-              ''
-                TF_0_13_PROVIDER_PATH=$out/plugins/${slug}/${version}/${GOOS}_${GOARCH}/${pname}_v${version}
-                mkdir -p "$(dirname $TF_0_13_PROVIDER_PATH)"
-
-                cp ${shim} "$TF_0_13_PROVIDER_PATH"
-                chmod +x "$TF_0_13_PROVIDER_PATH"
-
-                TF_0_12_PROVIDER_PATH=$out/plugins/${pname}_v${version}
-
-                cp ${shim} "$TF_0_12_PROVIDER_PATH"
-                chmod +x "$TF_0_12_PROVIDER_PATH"
-              ''
-            )
-            actualPlugins;
-
          # Wrap PATH of plugins propagatedBuildInputs, plugins may have runtime dependencies on external binaries
          wrapperInputs = lib.unique (lib.flatten
            (lib.catAttrs "propagatedBuildInputs"
@ -134,18 +102,16 @@ let
          terraform.overrideAttrs
            (orig: { passthru = orig.passthru // passthru; })
        else
-          lib.appendToName "with-plugins" (stdenv.mkDerivation {
+          lib.appendToName "with-plugins" (buildEnv {
            inherit (terraform) name meta;
+            paths = actualPlugins;
            nativeBuildInputs = [ makeWrapper ];
-
-            buildCommand = pluginDir + ''
-              mkdir -p $out/bin/
+            postBuild = ''
+              mkdir -p $out/bin
              makeWrapper "${terraform}/bin/terraform" "$out/bin/terraform" \
-                --set NIX_TERRAFORM_PLUGIN_DIR $out/plugins \
+                --set NIX_TERRAFORM_PLUGIN_DIR $out/libexec/terraform-providers \
                --prefix PATH : "${lib.makeBinPath wrapperInputs}"
            '';
-
-            inherit passthru;
          });
    in
    withPlugins (_: [ ]);
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.35.20";
+  version = "0.36.0";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-iSD036rDZvvMUGMHnjKh69eVUVQakI8muSCCq2ytODM=";
+    sha256 = "sha256-HUhV6FcLd75ZOPKw9Fl+7KUsSVG7HpQ6X2JZo9C9eeA=";
  };

  vendorSha256 = "sha256-tNgEepKqwiqXhmoRCIEg7VJw7Y0TGt+R+6dZzd8aECg=";
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "rssguard";
-  version = "4.0.4";
+  version = "4.1.2";

  src = fetchFromGitHub {
    owner = "martinrotter";
    repo = pname;
    rev = version;
-    sha256 = "sha256-c6+SlZx3ACG0nJRW+zcDDzVd/oSLAdSaq2fHrPpt6zw=";
+    sha256 = "sha256-aG7Wkn2CHe7Dumskd0+DMja95lzvBWnFXACSqfU7Ow0=";
  };

  buildInputs =  [ qtwebengine qttools ];
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -2,14 +2,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.2.11";
+  version = "3.2.13";

  # Fetch from GitHub in order to use `requirements.in`
  src = fetchFromGitHub {
    owner = "flexget";
    repo = "flexget";
    rev = "v${version}";
-    sha256 = "1l9xy8k0imfdg4r03k659f85z945bksx672gqhkchf2svi2vnvql";
+    sha256 = "0pk6f9vrj01a91h86d5mvngwvxq9r6idbrfax1nfsissvssy6p07";
  };

  postPatch = ''
--- a/pkgs/applications/networking/giara/default.nix
+++ b/pkgs/applications/networking/giara/default.nix
@ -1,22 +1,24 @@
 { lib
 , fetchFromGitLab
+, fetchpatch
 , meson
 , gobject-introspection
 , pkg-config
 , ninja
 , python3
-, wrapGAppsHook
-, gtk3
+, wrapGAppsHook4
+, gtk4
 , gdk-pixbuf
 , webkitgtk
-, gtksourceview4
-, libhandy
+, gtksourceview5
 , glib-networking
+, libadwaita
+, appstream
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "giara";
-  version = "0.3";
+  version = "1.0";

  format = "other";

@ -25,24 +27,25 @@ python3.pkgs.buildPythonApplication rec {
    owner = "World";
    repo = pname;
    rev = version;
-    sha256 = "004qmkfrgd37axv0b6hfh6v7nx4pvy987k5yv4bmlmkj9sbqm6f9";
+    hash = "sha256-xDIzgr8zYal0r0sASWqiSZANCMC52LrVmLjlnGAd2Mg=";
  };

  nativeBuildInputs = [
+    appstream
    meson
    gobject-introspection
    pkg-config
    ninja
-    wrapGAppsHook
+    wrapGAppsHook4
  ];

  buildInputs = [
-    gtk3
+    gtk4
    gdk-pixbuf
    webkitgtk
-    gtksourceview4
-    libhandy
+    gtksourceview5
    glib-networking
+    libadwaita
  ];

  pythonPath = with python3.pkgs; [
@ -55,6 +58,21 @@ python3.pkgs.buildPythonApplication rec {
    beautifulsoup4
  ];

+  patches = [
+    # Proper support for gtk4 and libadwaita
+    # @TODO: Remove when bumping the version.
+    (fetchpatch {
+      name = "giara-gtk4-libadwaita.patch";
+      url = "https://gitlab.gnome.org/World/giara/-/commit/6204427f8b8e3d8c72b669717a3f129ffae401d9.patch";
+      sha256 = "sha256-E8kbVsACPD2gkfNrzYUy0+1U7+/pIkUu4rCkX+xY0us=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace meson_post_install.py \
+      --replace "gtk-update-icon-cache" "gtk4-update-icon-cache"
+  '';
+
  # Fix setup-hooks https://github.com/NixOS/nixpkgs/issues/56943
  strictDeps = false;

--- a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
@ -8,13 +8,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "deltachat-cursed";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "adbenitez";
    repo = "deltachat-cursed";
    rev = "v${version}";
-    sha256 = "0zzzrzc8yxw6ffwfirbrr5ahbidbvlwdvgdg82zjsdjjbarxph8c";
+    hash = "sha256-IZrTPnj6eX1qgEPnEiD9qmVkwn1SMK38gVKAJFgZNfw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -7,7 +7,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.79.0.95";
+  version = "8.80.0.143";

  rpath = lib.makeLibraryPath [
    alsa-lib
@ -69,7 +69,7 @@ let
          "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
          "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
        ];
-        sha256 = "sha256-a6ZtgA0cMAuNVQWAeiIDJ2noPhXjV8KPE8ibkGR7Dns=";
+        sha256 = "sha256-SLypP+ZRHMWeB3KuvmmYb0Y1T3ipSpWNiYYQIzMCDDY=";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/irc/catgirl/default.nix
+++ b/pkgs/applications/networking/irc/catgirl/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "catgirl";
-  version = "2.0";
+  version = "2.0a";

  src = fetchurl {
    url = "https://git.causal.agency/catgirl/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-rk6nvfyaFxJ/7JN92L5tDraTngffVb6u/U7dbNjK9jI=";
+    sha256 = "sha256-AbzzTqaulPDplntwRYw4fVxZXUIJ2L0MKZvyWq4lvro=";
  };

  # catgirl's configure script uses pkg-config --variable exec_prefix openssl
--- a/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/pkgs/applications/networking/irc/hexchat/default.nix
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
    done
  '';

-  mesonFlags = [ "-Dwith-lua=lua" "-Dwith-text=true" ];
+  mesonFlags = [ "-Dwith-lua=lua" "-Dtext-frontend=true" ];

  postInstall = ''
    wrapProgram $out/bin/hexchat --prefix PYTHONPATH : "$PYTHONPATH"
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "evolution-ews";
-  version = "3.42.1";
+  version = "3.42.3";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "nCvGMSfDS0GUQfF8zomVq+gKf9H72X896zptRy9/Xy0=";
+    sha256 = "qgi2ycWlzY4PaiEMHu0Rd3bN2aqFcLtxkII1MzZXls4=";
  };

  nativeBuildInputs = [ cmake gettext intltool pkg-config ];
--- a/pkgs/applications/networking/n8n/default.nix
+++ b/pkgs/applications/networking/n8n/default.nix
@ -1,8 +1,9 @@
-{ pkgs, nodejs, stdenv, lib, ... }:
+{ pkgs, nodejs-14_x, stdenv, lib }:

 let
  nodePackages = import ./node-composition.nix {
-    inherit pkgs nodejs;
+    inherit pkgs;
+    nodejs = nodejs-14_x;
    inherit (stdenv.hostPlatform) system;
  };
 in
@ -10,9 +11,10 @@ nodePackages.n8n.override {
  nativeBuildInputs = with pkgs.nodePackages; [
    node-pre-gyp
  ];
+
  meta = with lib; {
    description = "Free and open fair-code licensed node based Workflow Automation Tool";
-    maintainers = with maintainers; [ freezeboy ];
+    maintainers = with maintainers; [ freezeboy k900 ];
    license = licenses.asl20;
  };
 }
--- a/pkgs/applications/networking/n8n/generate-dependencies.sh
+++ b/pkgs/applications/networking/n8n/generate-dependencies.sh
@ -1,7 +1,19 @@
 #!/usr/bin/env nix-shell
 #! nix-shell -i bash -p nodePackages.node2nix

+# --strip-optional-dependencies to get rid of deprecated build deps:
+#
+# n8n
+# -> n8n-nodes-base
+#    -> ssh2-sftp-client
+#       -> ssh2
+#          -> cpu-features
+#             -> node-gyp@3.8.0 -> python2
+#             -> cmake
+
 node2nix \
+  --14 \
+  --strip-optional-dependencies \
  --node-env node-env.nix \
  --input package.json \
  --output node-packages.nix \
--- a/pkgs/applications/networking/n8n/node-composition.nix
+++ b/pkgs/applications/networking/n8n/node-composition.nix
@ -6,7 +6,7 @@

 let
  nodeEnv = import ./node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
    inherit pkgs nodejs;
    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
  };
--- a/pkgs/applications/networking/n8n/node-env.nix
+++ b/pkgs/applications/networking/n8n/node-env.nix
@ -1,6 +1,6 @@
 # This file originates from node2nix

-{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile}:
+{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:

 let
  # Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
@ -40,36 +40,22 @@ let
      '';
    };

-  includeDependencies = {dependencies}:
-    lib.optionalString (dependencies != [])
-      (lib.concatMapStrings (dependency:
-        ''
-          # Bundle the dependencies of the package
-          mkdir -p node_modules
-          cd node_modules
+  # Common shell logic
+  installPackage = writeShellScript "install-package" ''
+    installPackage() {
+      local packageName=$1 src=$2

-          # Only include dependencies if they don't exist. They may also be bundled in the package.
-          if [ ! -e "${dependency.name}" ]
-          then
-              ${composePackage dependency}
-          fi
+      local strippedName

-          cd ..
-        ''
-      ) dependencies);
-
-  # Recursively composes the dependencies of a package
-  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
-    builtins.addErrorContext "while evaluating node package '${packageName}'" ''
-      DIR=$(pwd)
+      local DIR=$PWD
      cd $TMPDIR

-      unpackFile ${src}
+      unpackFile $src

      # Make the base dir in which the target dependency resides first
-      mkdir -p "$(dirname "$DIR/${packageName}")"
+      mkdir -p "$(dirname "$DIR/$packageName")"

-      if [ -f "${src}" ]
+      if [ -f "$src" ]
      then
          # Figure out what directory has been unpacked
          packageDir="$(find . -maxdepth 1 -type d | tail -1)"
@ -79,28 +65,53 @@ let
          chmod -R u+w "$packageDir"

          # Move the extracted tarball into the output folder
-          mv "$packageDir" "$DIR/${packageName}"
-      elif [ -d "${src}" ]
+          mv "$packageDir" "$DIR/$packageName"
+      elif [ -d "$src" ]
      then
          # Get a stripped name (without hash) of the source directory.
          # On old nixpkgs it's already set internally.
          if [ -z "$strippedName" ]
          then
-              strippedName="$(stripHash ${src})"
+              strippedName="$(stripHash $src)"
          fi

          # Restore write permissions to make building work
          chmod -R u+w "$strippedName"

          # Move the extracted directory into the output folder
-          mv "$strippedName" "$DIR/${packageName}"
+          mv "$strippedName" "$DIR/$packageName"
      fi

-      # Unset the stripped name to not confuse the next unpack step
-      unset strippedName
+      # Change to the package directory to install dependencies
+      cd "$DIR/$packageName"
+    }
+  '';

-      # Include the dependencies of the package
-      cd "$DIR/${packageName}"
+  # Bundle the dependencies of the package
+  #
+  # Only include dependencies if they don't exist. They may also be bundled in the package.
+  includeDependencies = {dependencies}:
+    lib.optionalString (dependencies != []) (
+      ''
+        mkdir -p node_modules
+        cd node_modules
+      ''
+      + (lib.concatMapStrings (dependency:
+        ''
+          if [ ! -e "${dependency.name}" ]; then
+              ${composePackage dependency}
+          fi
+        ''
+      ) dependencies)
+      + ''
+        cd ..
+      ''
+    );
+
+  # Recursively composes the dependencies of a package
+  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
+    builtins.addErrorContext "while evaluating node package '${packageName}'" ''
+      installPackage "${packageName}" "${src}"
      ${includeDependencies { inherit dependencies; }}
      cd ..
      ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
@ -391,13 +402,14 @@ let
    , dontStrip ? true
    , unpackPhase ? "true"
    , buildPhase ? "true"
+    , meta ? {}
    , ... }@args:

    let
-      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" ];
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
    in
    stdenv.mkDerivation ({
-      name = "node_${name}-${version}";
+      name = "${name}-${version}";
      buildInputs = [ tarWrapper python nodejs ]
        ++ lib.optional (stdenv.isLinux) utillinux
        ++ lib.optional (stdenv.isDarwin) libtool
@ -414,6 +426,8 @@ let
      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];

      installPhase = ''
+        source ${installPackage}
+
        # Create and enter a root node_modules/ folder
        mkdir -p $out/lib/node_modules
        cd $out/lib/node_modules
@ -446,6 +460,11 @@ let
        # Run post install hook, if provided
        runHook postInstall
      '';
+
+      meta = {
+        # default to Node.js' platforms
+        platforms = nodejs.meta.platforms;
+      } // meta;
    } // extraArgs);

  # Builds a node environment (a node_modules folder and a set of binaries)
@ -486,6 +505,8 @@ let
        passAsFile = [ "includeScript" "pinpointDependenciesScript" ];

        installPhase = ''
+          source ${installPackage}
+
          mkdir -p $out/${packageName}
          cd $out/${packageName}

--- a/pkgs/applications/networking/n8n/node-packages.nix
+++ b/pkgs/applications/networking/n8n/node-packages.nix
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@ -8,7 +8,7 @@
 , flask
 , flask-httpauth
 , flask-socketio
-, stem
+, cepa
 , psutil
 , pyqt5
 , pycrypto
@ -21,15 +21,16 @@
 , unidecode
 , tor
 , obfs4
+, snowflake
 }:

 let
-  version = "2.4";
+  version = "2.5";
  src = fetchFromGitHub {
    owner = "onionshare";
    repo = "onionshare";
    rev = "v${version}";
-    sha256 = "sha256-Lclm7mIkaAkQpWcNILTRJtLA43dpiyHtWAeHS2r3+ZQ=";
+    sha256 = "xCAM+tjjyDg/gqAXr4YNPhM8R3n9r895jktisAGlpZo=";
  };
  meta = with lib; {
    description = "Securely and anonymously send and receive files";
@ -55,16 +56,9 @@ let
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ lourkeur ];
  };
-  stem' = stem.overridePythonAttrs (_: rec {
-    version = "1.8.1";

-    src = fetchFromGitHub {
-      owner = "onionshare";
-      repo = "stem";
-      rev = version;
-      sha256 = "Dzpvx7CgAr5OtGmfubWAYDLqq5LkGqcwjr3bxpfL/3A=";
-    };
-  });
+  # TODO: package meek https://support.torproject.org/glossary/meek/
+  meek = "/meek-not-available";

 in
 rec {
@ -76,7 +70,7 @@ rec {
      # hardcode store paths of dependencies
      (substituteAll {
        src = ./fix-paths.patch;
-        inherit tor obfs4;
+        inherit tor meek obfs4 snowflake;
        inherit (tor) geoip;
      })
    ];
@ -86,7 +80,7 @@ rec {
      flask
      flask-httpauth
      flask-socketio
-      stem'
+      cepa
      psutil
      pycrypto
      pynacl
@ -109,8 +103,6 @@ rec {
    '';

    disabledTests = [
-      "test_firefox_like_behavior"
-      "test_if_unmodified_since"
      "test_get_tor_paths_linux"  # expects /usr instead of /nix/store
    ] ++ lib.optionals stdenv.isDarwin [
      # on darwin (and only on darwin) onionshare attempts to discover
@ -123,12 +115,12 @@ rec {
  onionshare-gui = buildPythonApplication {
    pname = "onionshare";
    inherit version meta;
-    src = "${src}/desktop/src";
+    src = "${src}/desktop";
    patches = [
      # hardcode store paths of dependencies
      (substituteAll {
        src = ./fix-paths-gui.patch;
-        inherit tor obfs4;
+        inherit tor meek obfs4 snowflake;
        inherit (tor) geoip;
      })
    ];
--- a/pkgs/applications/networking/onionshare/fix-paths-gui.patch
+++ b/pkgs/applications/networking/onionshare/fix-paths-gui.patch
@ -1,25 +1,46 @@
 --- a/onionshare/gui_common.py
 +++ b/onionshare/gui_common.py
-@@ -391,29 +391,10 @@ class GuiCommon:
+@@ -410,52 +410,12 @@ class GuiCommon:
         }
 
     def get_tor_paths(self):
 -        if self.common.platform == "Linux":
-            tor_path = shutil.which("tor")
-            obfs4proxy_file_path = shutil.which("obfs4proxy")
-            prefix = os.path.dirname(os.path.dirname(tor_path))
-            tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
-            tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
-        elif self.common.platform == "Windows":
+-            base_path = self.get_resource_path("tor")
+-            if base_path and os.path.isdir(base_path):
+-                self.common.log(
+-                    "GuiCommon", "get_tor_paths", "using paths in resources"
+-                )
+-                tor_path = os.path.join(base_path, "tor")
+-                tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-                tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-                obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-                snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-                meek_client_file_path = os.path.join(base_path, "meek-client")
+-            else:
+-                # Fallback to looking in the path
+-                self.common.log("GuiCommon", "get_tor_paths", "using paths from PATH")
+-                tor_path = shutil.which("tor")
+-                obfs4proxy_file_path = shutil.which("obfs4proxy")
+-                snowflake_file_path = shutil.which("snowflake-client")
+-                meek_client_file_path = shutil.which("meek-client")
+-                prefix = os.path.dirname(os.path.dirname(tor_path))
+-                tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
+-                tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-
+-        if self.common.platform == "Windows":
 -            base_path = self.get_resource_path("tor")
 -            tor_path = os.path.join(base_path, "Tor", "tor.exe")
 -            obfs4proxy_file_path = os.path.join(base_path, "Tor", "obfs4proxy.exe")
+-            snowflake_file_path = os.path.join(base_path, "Tor", "snowflake-client.exe")
+-            meek_client_file_path = os.path.join(base_path, "Tor", "meek-client.exe")
 -            tor_geo_ip_file_path = os.path.join(base_path, "Data", "Tor", "geoip")
 -            tor_geo_ipv6_file_path = os.path.join(base_path, "Data", "Tor", "geoip6")
 -        elif self.common.platform == "Darwin":
 -            base_path = self.get_resource_path("tor")
 -            tor_path = os.path.join(base_path, "tor")
 -            obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-            snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-            meek_client_file_path = os.path.join(base_path, "meek-client")
 -            tor_geo_ip_file_path = os.path.join(base_path, "geoip")
 -            tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
 -        elif self.common.platform == "BSD":
@ -27,10 +48,14 @@
 -            tor_geo_ip_file_path = "/usr/local/share/tor/geoip"
 -            tor_geo_ipv6_file_path = "/usr/local/share/tor/geoip6"
 -            obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
+-            meek_client_file_path = "/usr/local/bin/meek-client"
+-            snowflake_file_path = "/usr/local/bin/snowflake-client"
 +        tor_path = "@tor@/bin/tor"
 +        tor_geo_ip_file_path = "@geoip@/share/tor/geoip"
 +        tor_geo_ipv6_file_path = "@geoip@/share/tor/geoip6"
 +        obfs4proxy_file_path = "@obfs4@/bin/obfs4proxy"
+        meek_client_file_path = "@meek@/bin/meek-client"
+        snowflake_file_path = "@snowflake@/bin/snowflake-client"
 
         return (
             tor_path,
--- a/pkgs/applications/networking/onionshare/fix-paths.patch
+++ b/pkgs/applications/networking/onionshare/fix-paths.patch
@ -1,41 +1,76 @@
 --- a/onionshare_cli/common.py
 +++ b/onionshare_cli/common.py
-@@ -308,33 +308,10 @@ class Common:
+@@ -318,67 +318,12 @@ class Common:
         return path
-
+ 
     def get_tor_paths(self):
 -        if self.platform == "Linux":
 -            tor_path = shutil.which("tor")
 -            if not tor_path:
 -                raise CannotFindTor()
 -            obfs4proxy_file_path = shutil.which("obfs4proxy")
+-            snowflake_file_path = shutil.which("snowflake-client")
+-            meek_client_file_path = shutil.which("meek-client")
 -            prefix = os.path.dirname(os.path.dirname(tor_path))
 -            tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
 -            tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
 -        elif self.platform == "Windows":
+-            # In Windows, the Tor binaries are in the onionshare package, not the onionshare_cli package
 -            base_path = self.get_resource_path("tor")
+-            base_path = base_path.replace("onionshare_cli", "onionshare")
 -            tor_path = os.path.join(base_path, "Tor", "tor.exe")
+-
+-            # If tor.exe isn't there, mayber we're running from the source tree
+-            if not os.path.exists(tor_path):
+-                base_path = os.path.join(os.getcwd(), "onionshare", "resources", "tor")
+-
+-                tor_path = os.path.join(base_path, "Tor", "tor.exe")
+-                if not os.path.exists(tor_path):
+-                    raise CannotFindTor()
+-
 -            obfs4proxy_file_path = os.path.join(base_path, "Tor", "obfs4proxy.exe")
+-            snowflake_file_path = os.path.join(base_path, "Tor", "snowflake-client.exe")
+-            meek_client_file_path = os.path.join(base_path, "Tor", "meek-client.exe")
 -            tor_geo_ip_file_path = os.path.join(base_path, "Data", "Tor", "geoip")
 -            tor_geo_ipv6_file_path = os.path.join(base_path, "Data", "Tor", "geoip6")
+-
 -        elif self.platform == "Darwin":
-            tor_path = shutil.which("tor")
-            if not tor_path:
-                raise CannotFindTor()
-            obfs4proxy_file_path = shutil.which("obfs4proxy")
-            prefix = os.path.dirname(os.path.dirname(tor_path))
-            tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
-            tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-            # Let's see if we have tor binaries in the onionshare GUI package
+-            base_path = self.get_resource_path("tor")
+-            base_path = base_path.replace("onionshare_cli", "onionshare")
+-            tor_path = os.path.join(base_path, "tor")
+-            if os.path.exists(tor_path):
+-                obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-                snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-                meek_client_file_path = os.path.join(base_path, "meek-client")
+-                tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-                tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-            else:
+-                # Fallback to looking in the path
+-                tor_path = shutil.which("tor")
+-                if not os.path.exists(tor_path):
+-                    raise CannotFindTor()
+-
+-                obfs4proxy_file_path = shutil.which("obfs4proxy")
+-                snowflake_file_path = shutil.which("snowflake-client")
+-                meek_client_file_path = shutil.which("meek-client")
+-                prefix = os.path.dirname(os.path.dirname(tor_path))
+-                tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
+-                tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-
 -        elif self.platform == "BSD":
 -            tor_path = "/usr/local/bin/tor"
 -            tor_geo_ip_file_path = "/usr/local/share/tor/geoip"
 -            tor_geo_ipv6_file_path = "/usr/local/share/tor/geoip6"
 -            obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
+-            snowflake_file_path = "/usr/local/bin/snowflake-client"
+-            meek_client_file_path = "/usr/local/bin/meek-client"
 +        tor_path = "@tor@/bin/tor"
 +        tor_geo_ip_file_path = "@geoip@/share/tor/geoip"
 +        tor_geo_ipv6_file_path = "@geoip@/share/tor/geoip6"
 +        obfs4proxy_file_path = "@obfs4@/bin/obfs4proxy"
-
+        snowflake_file_path = "@snowflake@/bin/snowflake-client"
+        meek_client_file_path = "@meek@/bin/meek-client"
+ 
         return (
             tor_path,
-
--- a/pkgs/applications/networking/owncloud-client/default.nix
+++ b/pkgs/applications/networking/owncloud-client/default.nix
@ -2,11 +2,11 @@

 mkDerivation rec {
  pname = "owncloud-client";
-  version = "2.9.2.6206";
+  version = "2.10.0.6519";

  src = fetchurl {
    url = "https://download.owncloud.com/desktop/ownCloud/stable/${version}/source/ownCloud-${version}.tar.xz";
-    sha256 = "sha256-i6TmJFEuH4A1jTyoKiJoVU7yC+AXZIH4miYSk3XzVEo=";
+    sha256 = "sha256-HDH8s/VPeOAbkyrfE7hbhePhtWcx1IUdlhDCnodomh8=";
  };

  nativeBuildInputs = [ pkg-config cmake extra-cmake-modules ];
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@ -1,9 +1,42 @@
-{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, alsa-lib, ffmpeg, glib, openssl
-, pcre, zlib, libX11, libXcursor, libXdamage, libXext, libXi, libXinerama
-, libXrandr, libXrender, libXv, libXtst, libxkbcommon, libxkbfile, wayland
-, gstreamer, gst-plugins-base, gst-plugins-good, libunwind, orc, libxslt, cairo
-, libusb1, libpulseaudio, cups, pcsclite, systemd, libjpeg_turbo
-, buildServer ? true, nocaps ? false
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkg-config
+, alsa-lib
+, ffmpeg
+, glib
+, openssl
+, pcre
+, zlib
+, libX11
+, libXcursor
+, libXdamage
+, libXext
+, libXi
+, libXinerama
+, libXrandr
+, libXrender
+, libXv
+, libXtst
+, libxkbcommon
+, libxkbfile
+, wayland
+, gstreamer
+, gst-plugins-base
+, gst-plugins-good
+, libunwind
+, orc
+, libxslt
+, cairo
+, libusb1
+, libpulseaudio
+, cups
+, pcsclite
+, systemd
+, libjpeg_turbo
+, buildServer ? true
+, nocaps ? false
 }:

 let
@ -16,15 +49,16 @@ let
    }
  ];

-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
  pname = "freerdp";
-  version = "2.4.1";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "FreeRDP";
    repo = "FreeRDP";
    rev = version;
-    sha256 = "sha256-0wwIuE6Gv8khhLAbWSHOBfHGrTUjR4f/C5bzYJpvWIQ=";
+    sha256 = "sha256-OLz/f4E+Haumw5Jaw+F1hiHz0jfcywhfK3fEUgLorao=";
  };

  postPatch = ''
@ -47,40 +81,39 @@ in stdenv.mkDerivation rec {
      --replace "RDP_SCANCODE_CAPSLOCK" "RDP_SCANCODE_LCONTROL"
  '';

-  buildInputs = with lib;
-    [
-      alsa-lib
-      cairo
-      cups
-      ffmpeg
-      glib
-      gst-plugins-base
-      gst-plugins-good
-      gstreamer
-      libX11
-      libXcursor
-      libXdamage
-      libXext
-      libXi
-      libXinerama
-      libXrandr
-      libXrender
-      libXtst
-      libXv
-      libjpeg_turbo
-      libpulseaudio
-      libunwind
-      libusb1
-      libxkbcommon
-      libxkbfile
-      libxslt
-      openssl
-      orc
-      pcre
-      pcsclite
-      wayland
-      zlib
-    ] ++ optional stdenv.isLinux systemd;
+  buildInputs = [
+    alsa-lib
+    cairo
+    cups
+    ffmpeg
+    glib
+    gst-plugins-base
+    gst-plugins-good
+    gstreamer
+    libX11
+    libXcursor
+    libXdamage
+    libXext
+    libXi
+    libXinerama
+    libXrandr
+    libXrender
+    libXtst
+    libXv
+    libjpeg_turbo
+    libpulseaudio
+    libunwind
+    libusb1
+    libxkbcommon
+    libxkbfile
+    libxslt
+    openssl
+    orc
+    pcre
+    pcsclite
+    wayland
+    zlib
+  ] ++ lib.optional stdenv.isLinux systemd;

  nativeBuildInputs = [ cmake pkg-config ];

@ -88,18 +121,18 @@ in stdenv.mkDerivation rec {

  cmakeFlags = [ "-DCMAKE_INSTALL_LIBDIR=lib" ]
    ++ lib.mapAttrsToList (k: v: "-D${k}=${if v then "ON" else "OFF"}") {
-      BUILD_TESTING = doCheck;
-      WITH_CUNIT = doCheck;
-      WITH_CUPS = (cups != null);
-      WITH_OSS = false;
-      WITH_PCSC = (pcsclite != null);
-      WITH_PULSE = (libpulseaudio != null);
-      WITH_SERVER = buildServer;
-      WITH_SSE2 = stdenv.isx86_64;
-      WITH_VAAPI = true;
-      WITH_JPEG = (libjpeg_turbo != null);
-      WITH_CAIRO = (cairo != null);
-    };
+    BUILD_TESTING = doCheck;
+    WITH_CUNIT = doCheck;
+    WITH_CUPS = (cups != null);
+    WITH_OSS = false;
+    WITH_PCSC = (pcsclite != null);
+    WITH_PULSE = (libpulseaudio != null);
+    WITH_SERVER = buildServer;
+    WITH_SSE2 = stdenv.isx86_64;
+    WITH_VAAPI = true;
+    WITH_JPEG = (libjpeg_turbo != null);
+    WITH_CAIRO = (cairo != null);
+  };

  meta = with lib; {
    description = "A Remote Desktop Protocol Client";
--- a/pkgs/applications/office/gtg/default.nix
+++ b/pkgs/applications/office/gtg/default.nix
@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , meson
 , python3Packages
 , ninja
@ -25,6 +26,13 @@ python3Packages.buildPythonApplication rec {
    sha256 = "0b2slm7kjq6q8c7v4m7aqc8m1ynjxn3bl7445srpv1xc0dilq403";
  };

+  patches = [
+    # fix build with meson 0.60 (https://github.com/getting-things-gnome/gtg/pull/729)
+    (fetchpatch {
+      url = "https://github.com/getting-things-gnome/gtg/commit/1809d10663ae3d8f69c04138b66f9b4e66ee14f6.patch";
+      sha256 = "sha256-bYr5PAsuvcSqTf0vaJj2APtuBrwHdhXJxtXoAb7CfGk=";
+    })
+  ];

  nativeBuildInputs = [
    meson
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "qownnotes";
-  version = "22.1.7";
+  version = "22.1.9";

  src = fetchurl {
    url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
    # Fetch the checksum of current version with curl:
    # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "7ac13816e47e23e8469f47b6d48a29f7e98416de0fa9ef77eb3da63b191829f3";
+    sha256 = "sha256-vUYfZpqOe7cZJxrNPXN2gCyNRNqC2/NA83+UCL9+mq0=";
  };

  nativeBuildInputs = [ qmake qttools ];
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "super-productivity";
-  version = "7.9.2";
+  version = "7.10.0";

  src = fetchurl {
    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "sha256-qeHFFG1Y8qZwFvo3CFIs1+BKQo287HJfOnKKguUOlu8=";
+    sha256 = "sha256-Aa0orJpsin7XntUVpW6VLcbGiTSeyySDCGNFOERtgvg=";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/science/astronomy/gprojector/default.nix
+++ b/pkgs/applications/science/astronomy/gprojector/default.nix
@ -0,0 +1,51 @@
+{ stdenvNoCC
+, lib
+, fetchzip
+, jre
+, makeDesktopItem
+, copyDesktopItems
+, makeWrapper
+, extraJavaArgs ? "-Xms512M -Xmx2000M"
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "gprojector";
+  version = "3.0.2";
+
+  src = fetchzip {
+    url = "https://www.giss.nasa.gov/tools/gprojector/download/G.ProjectorJ-${version}.tgz";
+    sha256 = "sha256-IvGZOYt2d8aWtlAJJzVrwkqOOhaUHUmEDlMeD/0NdwU=";
+  };
+
+  desktopItems = [ (makeDesktopItem {
+    name = "gprojector";
+    exec = "gprojector";
+    desktopName = "G.Projector";
+    comment = meta.description;
+    categories = "Science;";
+    extraEntries = "StartupWMClass = gov-nasa-giss-projector-GProjector";
+  }) ];
+
+  buildInputs = [ jre ];
+  nativeBuildInputs = [ makeWrapper copyDesktopItems ];
+
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share
+    cp -r $src/jars $out/share/java
+    makeWrapper ${jre}/bin/java $out/bin/gprojector --add-flags "-jar $out/share/java/G.Projector.jar" --add-flags "${extraJavaArgs}"
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "G.Projector transforms an input map image into any of about 200 global and regional map projections";
+    homepage = "https://www.giss.nasa.gov/tools/gprojector/";
+    maintainers = with lib.maintainers; [ alyaeanyx ];
+    license = lib.licenses.unfree;
+    inherit (jre.meta) platforms;
+  };
+}
--- a/pkgs/applications/science/biology/deeptools/default.nix
+++ b/pkgs/applications/science/biology/deeptools/default.nix
@ -2,13 +2,13 @@
 with python.pkgs;
 buildPythonApplication rec {
  pname = "deepTools";
-  version = "3.5.0";
+  version = "3.5.1";

  src = fetchFromGitHub {
    owner = "deeptools";
    repo = "deepTools";
    rev = version;
-    sha256 = "1bz8ln32mfc9k8l9wgp034vw80dxh6f92dfqxhcrpggk4akwj6ml";
+    sha256 = "07v8vb2x4b0mgw0mvcj91vj1fqbcwizwsniysl2cvmv93gad8gbp";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/science/biology/sambamba/default.nix
+++ b/pkgs/applications/science/biology/sambamba/default.nix
@ -1,27 +1,27 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, python3, which, ldc, zlib }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, python3
+, which
+, ldc
+, zlib
+, lz4
+}:

 stdenv.mkDerivation rec {
  pname = "sambamba";
-  version = "0.8.1";
+  version = "0.8.2";

  src = fetchFromGitHub {
    owner = "biod";
    repo = "sambamba";
    rev = "v${version}";
-    sha256 = "0f4qngnys2zjb0ri54k6kxqnssg938mnnscs4z9713hjn41rk7yd";
+    sha256 = "sha256-FEa9QjQoGNUOAtMNMZcqpTKMKVtXoBuOomTy0mpos/0=";
    fetchSubmodules = true;
  };

-  patches = [
-    # make ldc 1.27.1 compatible
-    (fetchpatch {
-      url = "https://github.com/biod/sambamba/pull/480/commits/b5c80feb62683d24ec0529f685a1d7a36962a1d4.patch";
-      sha256 = "0yr9baxqbhyb4scwcwczk77z8gazhkl60jllhz9dnrb7p5qsvs7r";
-    })
-  ];
-
  nativeBuildInputs = [ which python3 ldc ];
-  buildInputs = [ zlib ];
+  buildInputs = [ zlib lz4 ];

  # Upstream's install target is broken; copy manually
  installPhase = ''
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@ -54,16 +54,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "alacritty";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "alacritty";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-kgZEbOGmO+uRKaWR+oQBiGkBzDSuCznUyWNUoMICHhk=";
+    sha256 = "sha256-eVPy47T2wcsN7NxtwMoyuC6loBVXsoJjJ/2q31i3vxQ=";
  };

-  cargoSha256 = "sha256-JqnYMDkagWNGliUxi5eqJN92ULsvT7Fwmah8um1xaRw=";
+  cargoSha256 = "sha256-RY+qidm7NZFKq6P8qVaMpxYfTfHpZac2YJwuNbOJwoM=";

  nativeBuildInputs = [
    cmake
@ -88,19 +88,13 @@ rustPlatform.buildRustPackage rec {

  outputs = [ "out" "terminfo" ];

-  patches = [
-    # Handle PTY EIO error for Rust 1.55+
-    (fetchpatch {
-      url = "https://github.com/alacritty/alacritty/commit/58985a4dcbe464230b5d2566ee68e2d34a1788c8.patch";
-      sha256 = "sha256-Z6589yRrQtpx3/vNqkMiGgGsLysd/QyfaX7trqX+k5c=";
-    })
-  ];
-
  postPatch = ''
    substituteInPlace alacritty/src/config/ui_config.rs \
      --replace xdg-open ${xdg-utils}/bin/xdg-open
  '';

+  checkFlags = [ "--skip=term::test::mock_term" ]; # broken on aarch64
+
  postInstall = (
    if stdenv.isDarwin then ''
      mkdir $out/Applications
@ -126,6 +120,7 @@ rustPlatform.buildRustPackage rec {

    install -dm 755 "$out/share/man/man1"
    gzip -c extra/alacritty.man > "$out/share/man/man1/alacritty.1.gz"
+    gzip -c extra/alacritty-msg.man > "$out/share/man/man1/alacritty-msg.1.gz"

    install -Dm 644 alacritty.yml $out/share/doc/alacritty.yml

--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "14.6.2",
-  "repo_hash": "0n7l1f1w70nqb9ackcmi1yhx69a32zlkxa962v67782nn2vdcbiz",
+  "version": "14.6.3",
+  "repo_hash": "sha256-M8A6ZF1t+N48OTBhVwvOweITmavrl9+Z1Yqw4lxLk38=",
  "yarn_hash": "1kcjbf8xn3bwac2s9i2i7dpgbkwcjh09wvgbgysm5yffpdswg6nl",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v14.6.2-ee",
+  "rev": "v14.6.3-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "14.6.2",
+    "GITALY_SERVER_VERSION": "14.6.3",
    "GITLAB_PAGES_VERSION": "1.49.0",
    "GITLAB_SHELL_VERSION": "13.22.1",
-    "GITLAB_WORKHORSE_VERSION": "14.6.2"
+    "GITLAB_WORKHORSE_VERSION": "14.6.3"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -33,7 +33,7 @@ let
      };
  };

-  version = "14.6.2";
+  version = "14.6.3";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in

@ -45,7 +45,7 @@ buildGoModule {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-a9qFAtQP5QtI+E6V3LBYAMYQbvhgOcn75l+6pSQPZ+0=";
+    sha256 = "sha256-b4gNIYMtwsV2qv3mjKYDnCCGGmQseoqaTGN7k9mR1B8=";
  };

  vendorSha256 = "sha256-ZLd4E3+e25Hqmd6ZyF3X6BveMEg7OF0FX9IvNBWn3v0=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "14.6.2";
+  version = "14.6.3";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@ -10,7 +10,10 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, nixosTests
+  # For tests
+, testVersion
+, runCommand
+, fetchurl
  # Main build tools
 , pkg-config
 , autoconf
@ -103,7 +106,7 @@ let
  inherit (lib) optional optionals optionalString versions;

 in
-stdenv.mkDerivation rec {
+let self = stdenv.mkDerivation rec {
  pname = "handbrake";
  inherit version src;

@ -211,7 +214,23 @@ stdenv.mkDerivation rec {
  makeFlags = [ "--directory=build" ];

  passthru.tests = {
-    basic-conversion = nixosTests.handbrake;
+    basic-conversion =
+      let
+        # Big Buck Bunny example, licensed under CC Attribution 3.0.
+        testMkv = fetchurl {
+          url = "https://github.com/Matroska-Org/matroska-test-files/blob/cf0792be144ac470c4b8052cfe19bb691993e3a2/test_files/test1.mkv?raw=true";
+          sha256 = "1hfxbbgxwfkzv85pvpvx55a72qsd0hxjbm9hkl5r3590zw4s75h9";
+        };
+      in
+      runCommand "${pname}-${version}-basic-conversion" { nativeBuildInputs = [ self ]; } ''
+        mkdir -p $out
+        cd $out
+        HandBrakeCLI -i ${testMkv} -o test.mp4 -e x264 -q 20 -B 160
+        test -e test.mp4
+        HandBrakeCLI -i ${testMkv} -o test.mkv -e x264 -q 20 -B 160
+        test -e test.mkv
+      '';
+    version = testVersion { package = self; command = "HandBrakeCLI --version"; };
  };

  meta = with lib; {
@ -230,4 +249,5 @@ stdenv.mkDerivation rec {
    platforms = with platforms; unix;
    broken = stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13";
  };
-}
+};
+in self
--- a/pkgs/applications/video/streamlink/default.nix
+++ b/pkgs/applications/video/streamlink/default.nix
@ -6,11 +6,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "streamlink";
-  version = "3.0.3";
+  version = "3.1.0";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "sha256-oEK9p6OuqGSm2JdgfnJ+N0sJtRq6wCoVCGcU0GNEMLI=";
+    sha256 = "sha256-T2M0vg+BYIdr21CcdrrBf7bVVlZU+tKJWG2xfBMoMlg=";
  };

  checkInputs = with python3Packages; [
@ -32,10 +32,6 @@ python3Packages.buildPythonApplication rec {
    ffmpeg
  ];

-  postPatch = ''
-    substituteInPlace setup.cfg --replace 'lxml >=4.6.4,<5.0' 'lxml'
-  '';
-
  meta = with lib; {
    homepage = "https://streamlink.github.io/";
    description = "CLI for extracting streams from various websites to video player of your choosing";
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@ -62,16 +62,14 @@
 , systemd
 , taglib
 , unzip
-, wayland
-, wayland-protocols
 , xorg
 , zlib
-
 , chromecastSupport ? true, libmicrodns, protobuf
 , jackSupport ? false
 , onlyLibVLC ? false
 , skins2Support ? !onlyLibVLC, freetype
-, withQt5 ? true, qtbase, qtsvg, qtx11extras, wrapQtAppsHook
+, waylandSupport ? true, wayland, wayland-protocols
+, withQt5 ? true, qtbase, qtsvg, qtwayland, qtx11extras, wrapQtAppsHook
 }:

 # chromecastSupport requires TCP port 8010 to be open for it to work.
@ -148,8 +146,6 @@ stdenv.mkDerivation rec {
    srt
    systemd
    taglib
-    wayland
-    wayland-protocols
    zlib
  ]
  ++ (with xorg; [
@ -162,8 +158,15 @@ stdenv.mkDerivation rec {
  ++ optional (!hostIsAarch) live555
  ++ optional jackSupport libjack2
  ++ optionals chromecastSupport [ libmicrodns protobuf ]
-  ++ optionals skins2Support (with xorg; [ freetype libXext libXinerama libXpm ])
-  ++ optionals withQt5 [ qtbase qtsvg qtx11extras ];
+  ++ optionals skins2Support (with xorg; [
+    freetype
+    libXext
+    libXinerama
+    libXpm
+  ])
+  ++ optionals waylandSupport [ wayland wayland-protocols ]
+  ++ optionals withQt5 [ qtbase qtsvg qtx11extras ]
+  ++ optional (waylandSupport && withQt5) qtwayland;

  nativeBuildInputs = [
    autoreconfHook
@ -172,7 +175,8 @@ stdenv.mkDerivation rec {
    removeReferencesTo
    unzip
  ]
-  ++ optionals withQt5 [ wrapQtAppsHook ];
+  ++ optionals withQt5 [ wrapQtAppsHook ]
+  ++ optionals waylandSupport [ wayland wayland-protocols ];

  enableParallelBuilding = true;

@ -210,9 +214,11 @@ stdenv.mkDerivation rec {
  configureFlags = [
    "--enable-srt" # Explicit enable srt to ensure the patch is applied.
    "--with-kde-solid=$out/share/apps/solid/actions"
-  ] ++ optional onlyLibVLC "--disable-vlc"
-    ++ optional skins2Support "--enable-skins2"
-    ++ optionals chromecastSupport [
+  ]
+  ++ optional onlyLibVLC "--disable-vlc"
+  ++ optional skins2Support "--enable-skins2"
+  ++ optional waylandSupport "--enable-wayland"
+  ++ optionals chromecastSupport [
    "--enable-sout"
    "--enable-chromecast"
    "--enable-microdns"
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "sway-unwrapped";
-  version = "1.6.1";
+  version = "1.7";

  src = fetchFromGitHub {
    owner = "swaywm";
    repo = "sway";
    rev = version;
-    sha256 = "0j4sdbsrlvky1agacc0pcz9bwmaxjmrapjnzscbd2i0cria2fc5j";
+    sha256 = "0ss3l258blyf2d0lwd7pi7ga1fxfj8pxhag058k7cmjhs3y30y5l";
  };

  patches = [
--- a/pkgs/build-support/libredirect/default.nix
+++ b/pkgs/build-support/libredirect/default.nix
@ -44,7 +44,7 @@ else stdenv.mkDerivation rec {
      -isystem ${llvmPackages_13.clang.libc}/include \
      -isystem ${llvmPackages_13.libclang.lib}/lib/clang/*/include \
      -L${llvmPackages_13.clang.libc}/lib \
-      -Wl,-install_name,$out/lib/$libName \
+      -Wl,-install_name,$libName \
      -Wall -std=c99 -O3 -fPIC libredirect.c \
      -ldl -shared -o "$libName"
    '' else if stdenv.isDarwin then ''
@ -75,6 +75,12 @@ else stdenv.mkDerivation rec {

    install -vD "$libName" "$out/lib/$libName"

+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+    # dylib will be rejected unless dylib rpath gets explictly set
+    install_name_tool \
+      -change $libName $out/lib/$libName \
+      $out/lib/$libName
+  '' + ''
    # Provide a setup hook that injects our library into every process.
    mkdir -p "$hook/nix-support"
    cat <<SETUP_HOOK > "$hook/nix-support/setup-hook"
--- a/pkgs/data/misc/hackage/pin.json
+++ b/pkgs/data/misc/hackage/pin.json
@ -1,6 +1,6 @@
 {
-  "commit": "0b85617478c8c03b4db538b5dc1774f9fa5bf41c",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/0b85617478c8c03b4db538b5dc1774f9fa5bf41c.tar.gz",
-  "sha256": "1r2w0cysn4x8hzw0989p9cmqvyqkjs4phy8iisphczw30s02zc27",
-  "msg": "Update from Hackage at 2022-01-14T12:47:41Z"
+  "commit": "6f406277d7106375f7148466c985061d20cb028b",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/6f406277d7106375f7148466c985061d20cb028b.tar.gz",
+  "sha256": "0jvxybgv975lmk268x12dlp8xxv12vmpwc00k3nv6qqp0xd9bwla",
+  "msg": "Update from Hackage at 2022-01-18T22:54:05Z"
 }
--- a/pkgs/desktops/arcan/xarcan/default.nix
+++ b/pkgs/desktops/arcan/xarcan/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , arcan
 , audit
 , dbus
@ -46,6 +47,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-UTIVDKnYD/q0K6G7NJUKh1tHcqnsuiJ/cQxWuPMJ2G4=";
  };

+  patches = [
+    # fix build with meson 0.60
+    (fetchpatch {
+      url = "https://github.com/letoram/xarcan/commit/b67e514dbb59bffc23b75d47ca7f24e96c4aeb05.patch";
+      sha256 = "sha256-tSQmNy1Id6nDIN+03dc1+rEEF8fMq0yJBiscNM60xic=";
+    })
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/desktops/gnome/extensions/collisions.json
+++ b/pkgs/desktops/gnome/extensions/collisions.json
@ -24,6 +24,10 @@
      "ShutdownTimer@neumann",
      "ShutdownTimer@deminder"
    ],
+    "bottompanel": [
+      "bottompanel@tmoer93",
+      "bottom-panel@sulincix"
+    ],
    "noannoyance": [
      "noannoyance@sindex.com",
      "noannoyance@daase.net"
@ -71,6 +75,10 @@
      "noannoyance@sindex.com",
      "noannoyance@daase.net"
    ],
+    "fuzzy-clock": [
+      "fuzzy-clock@keepawayfromfire.co.uk",
+      "FuzzyClock@johngoetz"
+    ],
    "panel-date-format": [
      "panel-date-format@keiii.github.com",
      "panel-date-format@atareao.es"
@ -105,6 +113,14 @@
      "lockkeys@vaina.lt",
      "lockkeys@fawtytoo"
    ],
+    "shutdowntimer": [
+      "ShutdownTimer@neumann",
+      "ShutdownTimer@deminder"
+    ],
+    "fuzzy-clock": [
+      "fuzzy-clock@keepawayfromfire.co.uk",
+      "FuzzyClock@johngoetz"
+    ],
    "disable-unredirect-fullscreen-windows": [
      "unredirect@vaina.lt",
      "unredirect@aunetx"
--- a/pkgs/desktops/gnome/extensions/extensionRenames.nix
+++ b/pkgs/desktops/gnome/extensions/extensionRenames.nix
@ -21,6 +21,16 @@
  "unredirect@vaina.lt" = "disable-unredirect-fullscreen-windows";
  "unredirect@aunetx" = "disable-unredirect-fullscreen-windows-2";

+  "fuzzy-clock@keepawayfromfire.co.uk" = "fuzzy-clock-2";
+  "FuzzyClock@johngoetz" = "fuzzy-clock";
+
+  # At the moment, ShutdownTimer@deminder is a fork of ShutdownTimer@neumann which adds new features
+  # there seem to be upstream plans, so this should be checked periodically:
+  # https://github.com/Deminder/ShutdownTimer https://github.com/neumann-d/ShutdownTimer/pull/46
+  "ShutdownTimer@neumann" = null;
+  "shutdown-timer-gnome-shell-extension" = "shutdowntimer-2";
+  "ShutdownTimer@deminder" = "shutdowntimer";
+
  # ############################################################################
  # These are conflicts for older extensions (i.e. they don't support the latest GNOME version).
  # Make sure to move them up once they are updated
@ -33,13 +43,6 @@
  "Hide_Activities@shay.shayel.org" = "hide-activities-button";
  "hide-activities-button@nmingori.gnome-shell-extensions.org" = "hide-activities-button-2";

-  # At the moment, ShutdownTimer@deminder is a fork of ShutdownTimer@neumann which adds new features
-  # there seem to be upstream plans, so this should be checked periodically:
-  # https://github.com/Deminder/ShutdownTimer https://github.com/neumann-d/ShutdownTimer/pull/46
-  "ShutdownTimer@neumann" = null;
-  "shutdown-timer-gnome-shell-extension" = "shutdowntimer-2";
-  "ShutdownTimer@deminder" = "shutdowntimer";
-
  "noannoyance@sindex.com" = "noannoyance";
  "noannoyance@daase.net" = "noannoyance-2";

@ -54,6 +57,9 @@

  # ####### GNOME 3.38 #######

+  "bottompanel@tmoer93" = "bottompanel";
+  "bottom-panel@sulincix" = "bottompanel-2";
+
  # See https://github.com/pbxqdown/gnome-shell-extension-transparent-window/issues/12#issuecomment-800765381
  "transparent-window@pbxqdown.github.com" = "transparent-window";
  "transparentwindows.mdirshad07" = null;
--- a/pkgs/desktops/gnome/extensions/extensions.json
+++ b/pkgs/desktops/gnome/extensions/extensions.json
--- a/pkgs/desktops/gnome/extensions/pop-shell/default.nix
+++ b/pkgs/desktops/gnome/extensions/pop-shell/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-shell-extension-pop-shell";
-  version = "unstable-2021-11-30";
+  version = "unstable-2022-01-14";

  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "shell";
-    rev = "4b65ee865d01436ec75a239a0586a2fa6051b8c3";
-    sha256 = "DHmp3kzBgbyxRe0TjER/CAqyUmD9LeRqAFQ9apQDzfk=";
+    rev = "21745c4a8076ad52c9ccc77ca5726f5c7b83de6c";
+    sha256 = "sha256-d6NRNbTimwtGVLhcpdFD1AuignVii/xi3YtMWzkS/v0=";
  };

  nativeBuildInputs = [ glib nodePackages.typescript gjs ];
--- a/pkgs/development/beam-modules/elvis-erlang/default.nix
+++ b/pkgs/development/beam-modules/elvis-erlang/default.nix
@ -8,10 +8,10 @@ in rebar3Relx rec {
  releaseType = "escript";
  # The package name "elvis" is already taken
  pname = "elvis-erlang";
-  version = "1.0.1";
+  version = "1.1.0";
  src = fetchFromGitHub {
    inherit owner repo;
-    sha256 = "139mgd4cwc0vazxfnssyym61jd9g45wn1nc53mjfzx5dkrrn4dc5";
+    sha256 = "6vNxr3AYpFuXaIVH9bWw7K5KiF1swfI+CSI43RoMQEA=";
    rev = version;
  };
  beamDeps = builtins.attrValues (import ./rebar-deps.nix {
--- a/pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix
+++ b/pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix
@ -26,11 +26,11 @@ let
    };
    parse_trans = builder {
      name = "parse_trans";
-      version = "3.4.0";
+      version = "3.4.1";
      src = fetchHex {
        pkg = "parse_trans";
-        version = "3.4.0";
-        sha256 = "sha256-+Z42iDC+pEVSIk434ElDpUh08IuFkEhd6NE4MrY6LcM=";
+        version = "3.4.1";
+        sha256 = "sha256-YgpAbOddragnuC5FPBnPBndr4mb1pnz/NOHvLLtg5Jo=";
      };
      beamDeps = [ ];
    };
@ -66,11 +66,11 @@ let
    };
    certifi = builder {
      name = "certifi";
-      version = "2.6.1";
+      version = "2.8.0";
      src = fetchHex {
        pkg = "certifi";
-        version = "2.6.1";
-        sha256 = "sha256-UkyXtJkbOEndXBemMSI4licsawr0RneLpGdaHf9Tu34=";
+        version = "2.8.0";
+        sha256 = "sha256-asfvwcb4YAsI1iUpLUu/WE4UhHzhtrXETZg9Jz4Ql+o=";
      };
      beamDeps = [ ];
    };
@ -146,11 +146,11 @@ let
    };
    elvis_core = builder {
      name = "elvis_core";
-      version = "1.1.2";
+      version = "1.3.1";
      src = fetchHex {
        pkg = "elvis_core";
-        version = "1.1.2";
-        sha256 = "sha256-xO5Cp6fC/FZ/Pqa1FQFkzWgpDxEA6bGaTPiG2Kocpzw=";
+        version = "1.3.1";
+        sha256 = "sha256-eoiQv4GFoyUs1OvYJv5fita5MCTt+IV26yeunl3BnWk=";
      };
      beamDeps = [ katana_code zipper ];
    };
--- a/pkgs/development/beam-modules/mix-release.nix
+++ b/pkgs/development/beam-modules/mix-release.nix
@ -4,6 +4,7 @@
 , version
 , src
 , nativeBuildInputs ? [ ]
+, buildInputs ? [ ]
 , meta ? { }
 , enableDebugInfo ? false
 , mixEnv ? "prod"
@ -27,7 +28,7 @@ assert mixNixDeps != { } -> mixFodDeps == null;
 stdenv.mkDerivation (overridable // {
  # rg is used as a better grep to search for erlang references in the final release
  nativeBuildInputs = nativeBuildInputs ++ [ erlang hex elixir makeWrapper git ripgrep ];
-  buildInputs = builtins.attrValues mixNixDeps;
+  buildInputs = buildInputs ++ builtins.attrValues mixNixDeps;

  MIX_ENV = mixEnv;
  MIX_DEBUG = if enableDebugInfo then 1 else 0;
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@ -6,69 +6,29 @@
 , python3
 , spirv-headers
 , spirv-tools
-, argSpirv-tools ? null
-, argSpirv-headers ? null
 }:
-# glslang requires custom versions of spirv-tools and spirb-headers.
-# The exact versions are taken from:
-# https://github.com/KhronosGroup/glslang/blob/${version}/known_good.json
-
-let
-  localSpirv-tools = if argSpirv-tools == null
-    then spirv-tools.overrideAttrs (_: {
-      src = fetchFromGitHub {
-        owner = "KhronosGroup";
-        repo = "SPIRV-Tools";
-        rev = "b27b1afd12d05bf238ac7368bb49de73cd620a8e";
-        sha256 = "0v26ws6qx23jn4dcpsq6rqmdxgyxpl5pcvfm90wb3nz6iqbqx294";
-      };
-    })
-    else argSpirv-tools;
-
-  localSpirv-headers = if argSpirv-headers == null
-    then spirv-headers.overrideAttrs (_: {
-      src = fetchFromGitHub {
-        owner = "KhronosGroup";
-        repo = "SPIRV-Headers";
-        rev = "f027d53ded7e230e008d37c8b47ede7cd308e19d";
-        sha256 = "12gp2mqcar6jj57jw9isfr62yn72kmvdcl0zga4gvrlyfhnf582q";
-      };
-    })
-    else argSpirv-headers;
-in
-
 stdenv.mkDerivation rec {
  pname = "glslang";
-  version = "11.1.0";
+  version = "1.2.198.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "glslang";
-    rev = version;
-    sha256 = "1j81pghy7whyr8ygk7lx6g6qph61rky7fkkc8xp87c7n695a48rw";
+    rev = "sdk-${version}";
+    sha256 = "sha256-FRiqsfoyjUW2kbbphxcy0Hn0TLVaszatM/nnWBrchRY=";
  };

  # These get set at all-packages, keep onto them for child drvs
  passthru = {
-    spirv-tools = localSpirv-tools;
-    spirv-headers = localSpirv-headers;
+    spirv-tools = spirv-tools;
+    spirv-headers = spirv-headers;
  };

  nativeBuildInputs = [ cmake python3 bison jq ];

  postPatch = ''
-    cp --no-preserve=mode -r "${localSpirv-tools.src}" External/spirv-tools
-    ln -s "${localSpirv-headers.src}" External/spirv-tools/external/spirv-headers
-  '';
-
-  # Ensure spirv-headers and spirv-tools match exactly to what is expected
-  preConfigure = ''
-    HEADERS_COMMIT=$(jq -r < known_good.json '.commits|map(select(.name=="spirv-tools/external/spirv-headers"))[0].commit')
-    TOOLS_COMMIT=$(jq -r < known_good.json '.commits|map(select(.name=="spirv-tools"))[0].commit')
-    if [ "$HEADERS_COMMIT" != "${localSpirv-headers.src.rev}" ] || [ "$TOOLS_COMMIT" != "${localSpirv-tools.src.rev}" ]; then
-      echo "ERROR: spirv-tools commits do not match expected versions: expected tools at $TOOLS_COMMIT, headers at $HEADERS_COMMIT";
-      exit 1;
-    fi
+    cp --no-preserve=mode -r "${spirv-tools.src}" External/spirv-tools
+    ln -s "${spirv-headers.src}" External/spirv-tools/external/spirv-headers
  '';

  meta = with lib; {
--- a/pkgs/development/compilers/ligo/default.nix
+++ b/pkgs/development/compilers/ligo/default.nix
@ -6,12 +6,12 @@

 coq.ocamlPackages.buildDunePackage rec {
  pname = "ligo";
-  version = "0.27.0";
+  version = "0.34.0";
  src = fetchFromGitLab {
    owner = "ligolang";
    repo = "ligo";
    rev = version;
-    sha256 = "sha256-OUrjMlAWxTPs56ltMt0I/XR9GScD6upXU2arT99u8hk=";
+    sha256 = "sha256-MHkIr+XkW/zrRt+Cg48q4fOWTkNGH0hbf+oU7cAivNE=";
  };

  # The build picks this up for ligo --version
@ -31,6 +31,7 @@ coq.ocamlPackages.buildDunePackage rec {
    tezos-base
    tezos-shell-services
    tezos-010-PtGRANAD-test-helpers
+    tezos-011-PtHangz2-test-helpers
    tezos-protocol-010-PtGRANAD-parameters
    tezos-protocol-010-PtGRANAD
    tezos-protocol-environment
@ -42,6 +43,8 @@ coq.ocamlPackages.buildDunePackage rec {
    data-encoding
    bisect_ppx
    cmdliner
+    core
+    ocaml-recovery-parser
  ];

  checkInputs = [
@ -49,7 +52,7 @@ coq.ocamlPackages.buildDunePackage rec {
    coq.ocamlPackages.ca-certs
  ];

-  doCheck = true;
+  doCheck = false; # Tests fail, but could not determine the reason

  meta = with lib; {
    homepage = "https://ligolang.org/";
--- a/Show More
+++ b/Show More