Merge branch 'master' into haskell-updates

doc/languages-frameworks/gnome.section.md

@@ -68,7 +68,7 @@ preFixup = ''
 
 Fortunately, there is [`wrapGAppsHook`]{#ssec-gnome-hooks-wrapgappshook}. It works in conjunction with other setup hooks that populate environment variables, and it will then wrap all executables in `bin` and `libexec` directories using said variables.
 
-For convenience, it also adds `dconf.lib` for a GIO module implementing a GSettings backend using `dconf`, `gtk3` for GSettings schemas, and `librsvg` for GdkPixbuf loader to the closure. In case you are packaging a program without a graphical interface, you might want to use [`wrapGAppsNoGuiHook`]{#ssec-gnome-hooks-wrapgappsnoguihook}, which runs the same script as `wrapGAppsHook` but does not bring `gtk3` and `librsvg` into the closure.
+For convenience, it also adds `dconf.lib` for a GIO module implementing a GSettings backend using `dconf`, `gtk3` for GSettings schemas, and `librsvg` for GdkPixbuf loader to the closure. There is also [`wrapGAppsHook4`]{#ssec-gnome-hooks-wrapgappshook4}, which replaces GTK 3 with GTK 4. And in case you are packaging a program without a graphical interface, you might want to use [`wrapGAppsNoGuiHook`]{#ssec-gnome-hooks-wrapgappsnoguihook}, which runs the same script as `wrapGAppsHook` but does not bring `gtk3` and `librsvg` into the closure.
 
 - `wrapGAppsHook` itself will add the package’s `share` directory to `XDG_DATA_DIRS`.
 

lib/customisation.nix

@@ -219,16 +219,17 @@ rec {
 
   /* Like the above, but aims to support cross compilation. It's still ugly, but
      hopefully it helps a little bit. */
-  makeScopeWithSplicing = splicePackages: newScope: otherSplices: keep: f:
+  makeScopeWithSplicing = splicePackages: newScope: otherSplices: keep: extra: f:
     let
-      spliced = splicePackages {
+      spliced0 = splicePackages {
         pkgsBuildBuild = otherSplices.selfBuildBuild;
         pkgsBuildHost = otherSplices.selfBuildHost;
         pkgsBuildTarget = otherSplices.selfBuildTarget;
         pkgsHostHost = otherSplices.selfHostHost;
         pkgsHostTarget = self; # Not `otherSplices.selfHostTarget`;
         pkgsTargetTarget = otherSplices.selfTargetTarget;
-      } // keep self;
+      };
+      spliced = extra spliced0 // spliced0 // keep self;
       self = f self // {
         newScope = scope: newScope (spliced // scope);
         callPackage = newScope spliced; # == self.newScope {};
@@ -239,6 +240,7 @@ rec {
           newScope
           otherSplices
           keep
+          extra
           (lib.fixedPoints.extends g f);
         packages = f;
       };

lib/modules.nix

@@ -23,6 +23,7 @@ let
     isAttrs
     isBool
     isFunction
+    isList
     isString
     length
     mapAttrs
@@ -127,7 +128,7 @@ rec {
         let collected = collectModules
           (specialArgs.modulesPath or "")
           (modules ++ [ internalModule ])
-          ({ inherit lib options config; } // specialArgs);
+          ({ inherit lib options config specialArgs; } // specialArgs);
         in mergeModules prefix (reverseList collected);
 
       options = merged.matchedOptions;
@@ -188,6 +189,9 @@ rec {
       loadModule = args: fallbackFile: fallbackKey: m:
         if isFunction m || isAttrs m then
           unifyModuleSyntax fallbackFile fallbackKey (applyIfFunction fallbackKey m args)
+        else if isList m then
+          let defs = [{ file = fallbackFile; value = m; }]; in
+          throw "Module imports can't be nested lists. Perhaps you meant to remove one level of lists? Definitions: ${showDefs defs}"
         else unifyModuleSyntax (toString m) (toString m) (applyIfFunction (toString m) (import m) args);
 
       /*
@@ -295,13 +299,11 @@ rec {
       # a module will resolve strictly the attributes used as argument but
       # not their values.  The values are forwarding the result of the
       # evaluation of the option.
-      requiredArgs = builtins.attrNames (lib.functionArgs f);
       context = name: ''while evaluating the module argument `${name}' in "${key}":'';
-      extraArgs = builtins.listToAttrs (map (name: {
-        inherit name;
-        value = builtins.addErrorContext (context name)
-          (args.${name} or config._module.args.${name});
-      }) requiredArgs);
+      extraArgs = builtins.mapAttrs (name: _:
+        builtins.addErrorContext (context name)
+          (args.${name} or config._module.args.${name})
+      ) (lib.functionArgs f);
 
       # Note: we append in the opposite order such that we can add an error
       # context on the explicited arguments of "args" too. This update

lib/strings.nix

@@ -659,7 +659,7 @@ rec {
      Example:
        isStorePath "/nix/store/d945ibfx9x185xf04b890y4f9g3cbb63-python-2.7.11/bin/python"
        => false
-       isStorePath "/nix/store/d945ibfx9x185xf04b890y4f9g3cbb63-python-2.7.11/"
+       isStorePath "/nix/store/d945ibfx9x185xf04b890y4f9g3cbb63-python-2.7.11"
        => true
        isStorePath pkgs.python
        => true
@@ -667,7 +667,7 @@ rec {
        => false
   */
   isStorePath = x:
-    if isCoercibleToString x then
+    if !(isList x) && isCoercibleToString x then
       let str = toString x; in
       substring 0 1 str == "/"
       && dirOf str == storeDir

lib/tests/modules.sh

@@ -175,6 +175,9 @@ checkConfigOutput "true" config.submodule.config ./declare-submoduleWith-noshort
 ## submoduleWith should merge all modules in one swoop
 checkConfigOutput "true" config.submodule.inner ./declare-submoduleWith-modules.nix
 checkConfigOutput "true" config.submodule.outer ./declare-submoduleWith-modules.nix
+# Should also be able to evaluate the type name (which evaluates freeformType,
+# which evaluates all the modules defined by the type)
+checkConfigOutput "submodule" options.submodule.type.description ./declare-submoduleWith-modules.nix
 
 ## Paths should be allowed as values and work as expected
 checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.nix

lib/tests/modules/declare-submoduleWith-modules.nix

@@ -8,9 +8,6 @@
             default = false;
           };
         }
-        {
-          outer = true;
-        }
       ];
     };
     default = {};
@@ -25,6 +22,7 @@
     })
     {
       inner = true;
+      outer = true;
     }
   ];
 }

lib/types.nix

@@ -147,9 +147,13 @@ rec {
     , # The deprecation message to display when this type is used by an option
       # If null, the type isn't deprecated
       deprecationMessage ? null
+    , # The types that occur in the definition of this type. This is used to
+      # issue deprecation warnings recursively. Can also be used to reuse
+      # nested types
+      nestedTypes ? {}
     }:
     { _type = "option-type";
-      inherit name check merge emptyValue getSubOptions getSubModules substSubModules typeMerge functor deprecationMessage;
+      inherit name check merge emptyValue getSubOptions getSubModules substSubModules typeMerge functor deprecationMessage nestedTypes;
       description = if description == null then name else description;
     };
 
@@ -365,6 +369,7 @@ rec {
       getSubModules = elemType.getSubModules;
       substSubModules = m: listOf (elemType.substSubModules m);
       functor = (defaultFunctor name) // { wrapped = elemType; };
+      nestedTypes.elemType = elemType;
     };
 
     nonEmptyListOf = elemType:
@@ -389,6 +394,7 @@ rec {
       getSubModules = elemType.getSubModules;
       substSubModules = m: attrsOf (elemType.substSubModules m);
       functor = (defaultFunctor name) // { wrapped = elemType; };
+      nestedTypes.elemType = elemType;
     };
 
     # A version of attrsOf that's lazy in its values at the expense of
@@ -413,6 +419,7 @@ rec {
       getSubModules = elemType.getSubModules;
       substSubModules = m: lazyAttrsOf (elemType.substSubModules m);
       functor = (defaultFunctor name) // { wrapped = elemType; };
+      nestedTypes.elemType = elemType;
     };
 
     # TODO: drop this in the future:
@@ -421,6 +428,7 @@ rec {
       deprecationMessage = "Mixing lists with attribute values is no longer"
         + " possible; please use `types.attrsOf` instead. See"
         + " https://github.com/NixOS/nixpkgs/issues/1800 for the motivation.";
+      nestedTypes.elemType = elemType;
     };
 
     # Value of given type but with no merging (i.e. `uniq list`s are not concatenated).
@@ -433,6 +441,7 @@ rec {
       getSubModules = elemType.getSubModules;
       substSubModules = m: uniq (elemType.substSubModules m);
       functor = (defaultFunctor name) // { wrapped = elemType; };
+      nestedTypes.elemType = elemType;
     };
 
     # Null or value of ...
@@ -451,6 +460,7 @@ rec {
       getSubModules = elemType.getSubModules;
       substSubModules = m: nullOr (elemType.substSubModules m);
       functor = (defaultFunctor name) // { wrapped = elemType; };
+      nestedTypes.elemType = elemType;
     };
 
     functionTo = elemType: mkOptionType {
@@ -535,6 +545,9 @@ rec {
         substSubModules = m: submoduleWith (attrs // {
           modules = m;
         });
+        nestedTypes = lib.optionalAttrs (freeformType != null) {
+          freeformType = freeformType;
+        };
         functor = defaultFunctor name // {
           type = types.submoduleWith;
           payload = {
@@ -596,6 +609,8 @@ rec {
            then functor.type mt1 mt2
            else null;
       functor = (defaultFunctor name) // { wrapped = [ t1 t2 ]; };
+      nestedTypes.left = t1;
+      nestedTypes.right = t2;
     };
 
     # Any of the types in the given list
@@ -627,6 +642,8 @@ rec {
         substSubModules = m: coercedTo coercedType coerceFunc (finalType.substSubModules m);
         typeMerge = t1: t2: null;
         functor = (defaultFunctor name) // { wrapped = finalType; };
+        nestedTypes.coercedType = coercedType;
+        nestedTypes.finalType = finalType;
       };
 
     # Obsolete alternative to configOf.  It takes its option

maintainers/scripts/update.nix

@@ -1,5 +1,6 @@
 { package ? null
 , maintainer ? null
+, predicate ? null
 , path ? null
 , max-workers ? null
 , include-overlays ? false
@@ -69,6 +70,11 @@ let
    */
   packagesWith = packagesWithPath [];
 
+  /* Recursively find all packages in `pkgs` with updateScript matching given predicate.
+   */
+  packagesWithUpdateScriptMatchingPredicate = cond:
+    packagesWith (path: pkg: builtins.hasAttr "updateScript" pkg && cond path pkg);
+
   /* Recursively find all packages in `pkgs` with updateScript by given maintainer.
    */
   packagesWithUpdateScriptAndMaintainer = maintainer':
@@ -79,7 +85,7 @@ let
         else
           builtins.getAttr maintainer' lib.maintainers;
     in
-      packagesWith (path: pkg: builtins.hasAttr "updateScript" pkg &&
+      packagesWithUpdateScriptMatchingPredicate (path: pkg:
                          (if builtins.hasAttr "maintainers" pkg.meta
                            then (if builtins.isList pkg.meta.maintainers
                                    then builtins.elem maintainer pkg.meta.maintainers
@@ -120,6 +126,8 @@ let
   packages =
     if package != null then
       [ (packageByName package pkgs) ]
+    else if predicate != null then
+      packagesWithUpdateScriptMatchingPredicate predicate pkgs
     else if maintainer != null then
       packagesWithUpdateScriptAndMaintainer maintainer pkgs
     else if path != null then
@@ -139,6 +147,10 @@ let
 
     to run update script for specific package, or
 
+        % nix-shell maintainers/scripts/update.nix --arg predicate '(path: pkg: builtins.isList pkg.updateScript && builtins.length pkg.updateScript >= 1 && (let script = builtins.head pkg.updateScript; in builtins.isAttrs script && script.name == "gnome-update-script"))'
+
+    to run update script for all packages matching given predicate, or
+
         % nix-shell maintainers/scripts/update.nix --argstr path gnome3
 
     to run update script for all package under an attribute path.

maintainers/scripts/update.py

@@ -39,6 +39,9 @@ async def run_update_script(nixpkgs_root: str, merge_lock: asyncio.Lock, temp_di
     if temp_dir is not None:
         worktree, _branch = temp_dir
 
+        # Ensure the worktree is clean before update.
+        await check_subprocess('git', 'reset', '--hard', '--quiet', 'HEAD', cwd=worktree)
+
         # Update scripts can use $(dirname $0) to get their location but we want to run
         # their clones in the git worktree, not in the main nixpkgs repo.
         update_script_command = map(lambda arg: re.sub(r'^{0}'.format(re.escape(nixpkgs_root)), worktree, arg), update_script_command)

nixos/doc/manual/release-notes/rl-2105.xml

@@ -27,7 +27,7 @@
     <para>The default Linux kernel was updated to the 5.10 LTS series, coming from the 5.4 LTS series.</para>
    </listitem>
    <listitem>
-    <para>GNOME desktop environment was upgraded to 3.38, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.38/">release notes</link>.</para>
+    <para>GNOME desktop environment was upgraded to 40, see the release notes for <link xlink:href="https://help.gnome.org/misc/release-notes/40.0/">40.0</link> and <link xlink:href="https://help.gnome.org/misc/release-notes/3.38/">3.38</link>.</para>
    </listitem>
    <listitem>
     <para>

nixos/lib/test-driver/test-driver.py

@@ -735,6 +735,7 @@ class Machine:
         shell_path = os.path.join(self.state_dir, "shell")
         self.shell_socket = create_socket(shell_path)
 
+        display_available = any(x in os.environ for x in ["DISPLAY", "WAYLAND_DISPLAY"])
         qemu_options = (
             " ".join(
                 [
@@ -744,7 +745,7 @@ class Machine:
                     "-device virtio-serial",
                     "-device virtconsole,chardev=shell",
                     "-device virtio-rng-pci",
-                    "-serial stdio" if "DISPLAY" in os.environ else "-nographic",
+                    "-serial stdio" if display_available else "-nographic",
                 ]
             )
             + " "

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -162,12 +162,14 @@ let
   isolinuxCfg = concatStringsSep "\n"
     ([ baseIsolinuxCfg ] ++ optional config.boot.loader.grub.memtest86.enable isolinuxMemtest86Entry);
 
+  refindBinary = if targetArch == "x64" || targetArch == "aa64" then "refind_${targetArch}.efi" else null;
+
   # Setup instructions for rEFInd.
   refind =
-    if targetArch == "x64" then
+    if refindBinary != null then
       ''
       # Adds rEFInd to the ISO.
-      cp -v ${pkgs.refind}/share/refind/refind_x64.efi $out/EFI/boot/
+      cp -v ${pkgs.refind}/share/refind/${refindBinary} $out/EFI/boot/
       ''
     else
       "# No refind for ${targetArch}"
@@ -186,7 +188,10 @@ let
 
     # Fonts can be loaded?
     # (This font is assumed to always be provided as a fallback by NixOS)
-    if loadfont (hd0)/EFI/boot/unicode.pf2; then
+    if loadfont /EFI/boot/unicode.pf2; then
+      set with_fonts=true
+    fi
+    if [ "\$textmode" != "true" -a "\$with_fonts" == "true" ]; then
       # Use graphical term, it can be either with background image or a theme.
       # input is "console", while output is "gfxterm".
       # This enables "serial" input and output only when possible.
@@ -207,11 +212,11 @@ let
     ${ # When there is a theme configured, use it, otherwise use the background image.
     if config.isoImage.grubTheme != null then ''
       # Sets theme.
-      set theme=(hd0)/EFI/boot/grub-theme/theme.txt
+      set theme=/EFI/boot/grub-theme/theme.txt
       # Load theme fonts
-      $(find ${config.isoImage.grubTheme} -iname '*.pf2' -printf "loadfont (hd0)/EFI/boot/grub-theme/%P\n")
+      $(find ${config.isoImage.grubTheme} -iname '*.pf2' -printf "loadfont /EFI/boot/grub-theme/%P\n")
     '' else ''
-      if background_image (hd0)/EFI/boot/efi-background.png; then
+      if background_image /EFI/boot/efi-background.png; then
         # Black background means transparent background when there
         # is a background image set... This seems undocumented :(
         set color_normal=black/black
@@ -264,6 +269,8 @@ let
 
     cat <<EOF > $out/EFI/boot/grub.cfg
 
+    set with_fonts=false
+    set textmode=false
     # If you want to use serial for "terminal_*" commands, you need to set one up:
     #   Example manual configuration:
     #    → serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1
@@ -273,8 +280,28 @@ let
     export with_serial
     clear
     set timeout=10
+
+    # This message will only be viewable when "gfxterm" is not used.
+    echo ""
+    echo "Loading graphical boot menu..."
+    echo ""
+    echo "Press 't' to use the text boot menu on this console..."
+    echo ""
+
     ${grubMenuCfg}
 
+    hiddenentry 'Text mode' --hotkey 't' {
+      loadfont /EFI/boot/unicode.pf2
+      set textmode=true
+      terminal_output gfxterm console
+    }
+    hiddenentry 'GUI mode' --hotkey 'g' {
+      $(find ${config.isoImage.grubTheme} -iname '*.pf2' -printf "loadfont /EFI/boot/grub-theme/%P\n")
+      set textmode=false
+      terminal_output gfxterm
+    }
+
+
     # If the parameter iso_path is set, append the findiso parameter to the kernel
     # line. We need this to allow the nixos iso to be booted from grub directly.
     if [ \''${iso_path} ] ; then
@@ -337,11 +364,15 @@ let
       }
     }
 
-    menuentry 'rEFInd' --class refind {
-      # UUID is hard-coded in the derivation.
-      search --set=root --no-floppy --fs-uuid 1234-5678
-      chainloader (\$root)/EFI/boot/refind_x64.efi
-    }
+    ${lib.optionalString (refindBinary != null) ''
+    # GRUB apparently cannot do "chainloader" operations on "CD".
+    if [ "\$root" != "cd0" ]; then
+      menuentry 'rEFInd' --class refind {
+        # \$root defaults to the drive the EFI is found on.
+        chainloader (\$root)/EFI/boot/${refindBinary}
+      }
+    fi
+    ''}
     menuentry 'Firmware Setup' --class settings {
       fwsetup
       clear

nixos/modules/services/misc/disnix.nix

@@ -37,7 +37,7 @@ in
       enableProfilePath = mkEnableOption "exposing the Disnix profiles in the system's PATH";
 
       profiles = mkOption {
-        type = types.listOf types.string;
+        type = types.listOf types.str;
         default = [ "default" ];
         example = [ "default" ];
         description = "Names of the Disnix profiles to expose in the system's PATH";
@@ -53,6 +53,7 @@ in
 
     environment.systemPackages = [ pkgs.disnix ] ++ optional cfg.useWebServiceInterface pkgs.DisnixWebService;
     environment.variables.PATH = lib.optionals cfg.enableProfilePath (map (profileName: "/nix/var/nix/profiles/disnix/${profileName}/bin" ) cfg.profiles);
+    environment.variables.DISNIX_REMOTE_CLIENT = lib.optionalString (cfg.enableMultiUser) "disnix-client";
 
     services.dbus.enable = true;
     services.dbus.packages = [ pkgs.disnix ];

nixos/modules/services/misc/home-assistant.nix

@@ -298,7 +298,7 @@ in {
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
-        ProcSubset = "pid";
+        ProcSubset = "all";
         ProtectSystem = "strict";
         RemoveIPC = true;
         ReadWritePaths = let
@@ -308,9 +308,10 @@ in {
           allowPaths = if isList value then value else singleton value;
         in [ "${cfg.configDir}" ] ++ allowPaths;
         RestrictAddressFamilies = [
-          "AF_UNIX"
           "AF_INET"
           "AF_INET6"
+          "AF_NETLINK"
+          "AF_UNIX"
         ] ++ optionals (useComponent "bluetooth_tracker" || useComponent "bluetooth_le_tracker") [
           "AF_BLUETOOTH"
         ];

nixos/modules/services/monitoring/netdata.nix

@@ -149,8 +149,9 @@ in {
       description = "Real time performance monitoring";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      path = (with pkgs; [ curl gawk which ]) ++ lib.optional cfg.python.enable
-        (pkgs.python3.withPackages cfg.python.extraPackages);
+      path = (with pkgs; [ curl gawk iproute2 which ])
+        ++ lib.optional cfg.python.enable (pkgs.python3.withPackages cfg.python.extraPackages)
+        ++ lib.optional config.virtualisation.libvirtd.enable (config.virtualisation.libvirtd.package);
       environment = {
         PYTHONPATH = "${cfg.package}/libexec/netdata/python.d/python_modules";
       } // lib.optionalAttrs (!cfg.enableAnalyticsReporting) {
@@ -182,6 +183,9 @@ in {
         ConfigurationDirectory = "netdata";
         ConfigurationDirectoryMode = "0755";
         # Capabilities
+        AmbientCapabilities = [
+          "CAP_SETUID"            # is required for cgroups and cgroups-network plugins
+        ];
         CapabilityBoundingSet = [
           "CAP_DAC_OVERRIDE"      # is required for freeipmi and slabinfo plugins
           "CAP_DAC_READ_SEARCH"   # is required for apps plugin
@@ -191,6 +195,8 @@ in {
           "CAP_SYS_PTRACE"        # is required for apps plugin
           "CAP_SYS_RESOURCE"      # is required for ebpf plugin
           "CAP_NET_RAW"           # is required for fping app
+          "CAP_SYS_CHROOT"        # is required for cgroups plugin
+          "CAP_SETUID"            # is required for cgroups and cgroups-network plugins
         ];
         # Sandboxing
         ProtectSystem = "full";

nixos/modules/services/monitoring/prometheus/default.nix

@@ -112,7 +112,7 @@ let
           http://tools.ietf.org/html/rfc4366#section-3.1
         '';
       };
-      name = mkOpt types.string ''
+      name = mkOpt types.str ''
         Name of the remote read config, which if specified must be unique among remote read configs.
         The name will be used in metrics and logging in place of a generated value to help users distinguish between
         remote read configs.
@@ -174,7 +174,7 @@ let
       write_relabel_configs = mkOpt (types.listOf promTypes.relabel_config) ''
         List of remote write relabel configurations.
       '';
-      name = mkOpt types.string ''
+      name = mkOpt types.str ''
         Name of the remote write config, which if specified must be unique among remote write configs.
         The name will be used in metrics and logging in place of a generated value to help users distinguish between
         remote write configs.

nixos/modules/services/networking/wpa_supplicant.nix

@@ -3,6 +3,10 @@
 with lib;
 
 let
+  package = if cfg.allowAuxiliaryImperativeNetworks
+    then pkgs.wpa_supplicant_ro_ssids
+    else pkgs.wpa_supplicant;
+
   cfg = config.networking.wireless;
   configFile = if cfg.networks != {} || cfg.extraConfig != "" || cfg.userControlled.enable then pkgs.writeText "wpa_supplicant.conf" ''
     ${optionalString cfg.userControlled.enable ''
@@ -47,6 +51,16 @@ in {
         description = "Force a specific wpa_supplicant driver.";
       };
 
+      allowAuxiliaryImperativeNetworks = mkEnableOption "support for imperative & declarative networks" // {
+        description = ''
+          Whether to allow configuring networks "imperatively" (e.g. via
+          <package>wpa_supplicant_gui</package>) and declaratively via
+          <xref linkend="opt-networking.wireless.networks" />.
+
+          Please note that this adds a custom patch to <package>wpa_supplicant</package>.
+        '';
+      };
+
       networks = mkOption {
         type = types.attrsOf (types.submodule {
           options = {
@@ -211,9 +225,9 @@ in {
       message = ''options networking.wireless."${name}".{psk,pskRaw,auth} are mutually exclusive'';
     });
 
-    environment.systemPackages =  [ pkgs.wpa_supplicant ];
+    environment.systemPackages = [ package ];
 
-    services.dbus.packages = [ pkgs.wpa_supplicant ];
+    services.dbus.packages = [ package ];
     services.udev.packages = [ pkgs.crda ];
 
     # FIXME: start a separate wpa_supplicant instance per interface.
@@ -230,13 +244,17 @@ in {
       wantedBy = [ "multi-user.target" ];
       stopIfChanged = false;
 
-      path = [ pkgs.wpa_supplicant ];
+      path = [ package ];
 
-      script = ''
+      script = let
+        configStr = if cfg.allowAuxiliaryImperativeNetworks
+          then "-c /etc/wpa_supplicant.conf -I ${configFile}"
+          else "-c ${configFile}";
+      in ''
         if [ -f /etc/wpa_supplicant.conf -a "/etc/wpa_supplicant.conf" != "${configFile}" ]
         then echo >&2 "<3>/etc/wpa_supplicant.conf present but ignored. Generated ${configFile} is used instead."
         fi
-        iface_args="-s -u -D${cfg.driver} -c ${configFile}"
+        iface_args="-s -u -D${cfg.driver} ${configStr}"
         ${if ifaces == [] then ''
           for i in $(cd /sys/class/net && echo *); do
             DEVTYPE=

nixos/modules/services/torrent/transmission.nix

@@ -402,6 +402,7 @@ in
           mr ${getLib pkgs.util-linuxMinimal.out}/lib/libuuid.so*,
           mr ${getLib pkgs.xz}/lib/liblzma*.so*,
           mr ${getLib pkgs.zlib}/lib/libz*.so*,
+          mr ${getLib pkgs.brotli}/lib/libbrotli*.so*,
 
           r @{PROC}/sys/kernel/random/uuid,
           r @{PROC}/sys/vm/overcommit_memory,

nixos/modules/services/web-apps/keycloak.nix

@@ -168,10 +168,15 @@ in
       type = lib.types.str;
       default = "keycloak";
       description = ''
-        Username to use when connecting to the database.
-        This is also used for automatic provisioning of the database.
-        Changing this after the initial installation doesn't delete the
-        old user and can cause further problems.
+        Username to use when connecting to an external or manually
+        provisioned database; has no effect when a local database is
+        automatically provisioned.
+
+        To use this with a local database, set <xref
+        linkend="opt-services.keycloak.databaseCreateLocally" /> to
+        <literal>false</literal> and create the database and user
+        manually. The database should be called
+        <literal>keycloak</literal>.
       '';
     };
 
@@ -588,8 +593,8 @@ in
             PSQL=${config.services.postgresql.package}/bin/psql
 
             db_password="$(<'${cfg.databasePasswordFile}')"
-            $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${cfg.databaseUsername}'" | grep -q 1 || $PSQL -tAc "CREATE ROLE ${cfg.databaseUsername} WITH LOGIN PASSWORD '$db_password' CREATEDB"
-            $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "keycloak" OWNER "${cfg.databaseUsername}"'
+            $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='keycloak'" | grep -q 1 || $PSQL -tAc "CREATE ROLE keycloak WITH LOGIN PASSWORD '$db_password' CREATEDB"
+            $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "keycloak" OWNER "keycloak"'
           '';
         };
 
@@ -607,9 +612,9 @@ in
             set -eu
 
             db_password="$(<'${cfg.databasePasswordFile}')"
-            ( echo "CREATE USER IF NOT EXISTS '${cfg.databaseUsername}'@'localhost' IDENTIFIED BY '$db_password';"
+            ( echo "CREATE USER IF NOT EXISTS 'keycloak'@'localhost' IDENTIFIED BY '$db_password';"
               echo "CREATE DATABASE keycloak CHARACTER SET utf8 COLLATE utf8_unicode_ci;"
-              echo "GRANT ALL PRIVILEGES ON keycloak.* TO '${cfg.databaseUsername}'@'localhost';"
+              echo "GRANT ALL PRIVILEGES ON keycloak.* TO 'keycloak'@'localhost';"
             ) | ${config.services.mysql.package}/bin/mysql -N
           '';
         };

nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -273,6 +273,7 @@ in
       services.accounts-daemon.enable = true;
       services.dleyna-renderer.enable = mkDefault true;
       services.dleyna-server.enable = mkDefault true;
+      services.power-profiles-daemon.enable = mkDefault true;
       services.gnome3.at-spi2-core.enable = true;
       services.gnome3.evolution-data-server.enable = true;
       services.gnome3.gnome-keyring.enable = true;
@@ -365,10 +366,10 @@ in
         gnome-bluetooth
         gnome-color-manager
         gnome-control-center
-        gnome-getting-started-docs
         gnome-shell
         gnome-shell-extensions
         gnome-themes-extra
+        pkgs.gnome-tour # GNOME Shell detects the .desktop file on first log-in.
         pkgs.nixos-artwork.wallpapers.simple-dark-gray
         pkgs.nixos-artwork.wallpapers.simple-dark-gray-bottom
         pkgs.gnome-user-docs

nixos/modules/services/x11/display-managers/gdm.nix

@@ -218,14 +218,14 @@ in
     # We duplicate upstream's udev rules manually to make wayland with nvidia configurable
     services.udev.extraRules = ''
       # disable Wayland on Cirrus chipsets
-      ATTR{vendor}=="0x1013", ATTR{device}=="0x00b8", ATTR{subsystem_vendor}=="0x1af4", ATTR{subsystem_device}=="0x1100", RUN+="${gdm}/libexec/gdm-disable-wayland"
+      ATTR{vendor}=="0x1013", ATTR{device}=="0x00b8", ATTR{subsystem_vendor}=="0x1af4", ATTR{subsystem_device}=="0x1100", RUN+="${gdm}/libexec/gdm-runtime-config set daemon WaylandEnable false"
       # disable Wayland on Hi1710 chipsets
-      ATTR{vendor}=="0x19e5", ATTR{device}=="0x1711", RUN+="${gdm}/libexec/gdm-disable-wayland"
+      ATTR{vendor}=="0x19e5", ATTR{device}=="0x1711", RUN+="${gdm}/libexec/gdm-runtime-config set daemon WaylandEnable false"
       ${optionalString (!cfg.gdm.nvidiaWayland) ''
-        DRIVER=="nvidia", RUN+="${gdm}/libexec/gdm-disable-wayland"
+        DRIVER=="nvidia", RUN+="${gdm}/libexec/gdm-runtime-config set daemon WaylandEnable false"
       ''}
       # disable Wayland when modesetting is disabled
-      IMPORT{cmdline}="nomodeset", RUN+="${gdm}/libexec/gdm-disable-wayland"
+      IMPORT{cmdline}="nomodeset", RUN+="${gdm}/libexec/gdm-runtime-config set daemon WaylandEnable false"
     '';
 
     systemd.user.services.dbus.wantedBy = [ "default.target" ];

nixos/modules/system/activation/top-level.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, modules, baseModules, ... }:
+{ config, lib, pkgs, modules, baseModules, specialArgs, ... }:
 
 with lib;
 
@@ -13,7 +13,7 @@ let
   # !!! fix this
   children = mapAttrs (childName: childConfig:
       (import ../../../lib/eval-config.nix {
-        inherit baseModules;
+        inherit baseModules specialArgs;
         system = config.nixpkgs.initialSystem;
         modules =
            (optionals childConfig.inheritParentConfig modules)

nixos/tests/all-tests.nix

@@ -387,6 +387,7 @@ in
   sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
   sudo = handleTest ./sudo.nix {};
+  sway = handleTest ./sway.nix {};
   switchTest = handleTest ./switch-test.nix {};
   sympa = handleTest ./sympa.nix {};
   syncthing = handleTest ./syncthing.nix {};

nixos/tests/installed-tests/default.nix

@@ -97,6 +97,7 @@ in
   gsconnect = callInstalledTest ./gsconnect.nix {};
   ibus = callInstalledTest ./ibus.nix {};
   libgdata = callInstalledTest ./libgdata.nix {};
+  librsvg = callInstalledTest ./librsvg.nix {};
   glib-testing = callInstalledTest ./glib-testing.nix {};
   libjcat = callInstalledTest ./libjcat.nix {};
   libxmlb = callInstalledTest ./libxmlb.nix {};

nixos/tests/installed-tests/librsvg.nix

@@ -0,0 +1,9 @@
+{ pkgs, makeInstalledTest, ... }:
+
+makeInstalledTest {
+  tested = pkgs.librsvg;
+
+  testConfig = {
+    virtualisation.memorySize = 2047;
+  };
+}

nixos/tests/keycloak.nix

@@ -20,6 +20,7 @@ let
           services.keycloak = {
             enable = true;
             inherit frontendUrl databaseType initialAdminPassword;
+            databaseUsername = "bogus";
             databasePasswordFile = pkgs.writeText "dbPassword" "wzf6vOCbPp6cqTH";
           };
           environment.systemPackages = with pkgs; [

nixos/tests/sway.nix

@@ -0,0 +1,92 @@
+import ./make-test-python.nix ({ pkgs, lib, ...} :
+
+{
+  name = "sway";
+  meta = {
+    maintainers = with lib.maintainers; [ primeos synthetica ];
+  };
+
+  machine = { config, ... }: {
+    # Automatically login on tty1 as a normal user:
+    imports = [ ./common/user-account.nix ];
+    services.getty.autologinUser = "alice";
+
+    environment = {
+      # For glinfo and wayland-info:
+      systemPackages = with pkgs; [ mesa-demos wayland-utils ];
+      # Use a fixed SWAYSOCK path (for swaymsg):
+      variables."SWAYSOCK" = "/tmp/sway-ipc.sock";
+      # For convenience:
+      shellAliases = {
+        test-x11 = "glinfo | head -n 3 | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
+        test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
+      };
+    };
+
+    # Automatically configure and start Sway when logging in on tty1:
+    programs.bash.loginShellInit = ''
+      if [ "$(tty)" = "/dev/tty1" ]; then
+        set -e
+
+        mkdir -p ~/.config/sway
+        sed s/Mod4/Mod1/ /etc/sway/config > ~/.config/sway/config
+
+        sway --validate
+        sway && touch /tmp/sway-exit-ok
+      fi
+    '';
+
+    programs.sway.enable = true;
+
+    virtualisation.memorySize = 1024;
+    # Need to switch to a different VGA card / GPU driver than the default one (std) so that Sway can launch:
+    virtualisation.qemu.options = [ "-vga virtio" ];
+  };
+
+  enableOCR = true;
+
+  testScript = { nodes, ... }: ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+
+    # To check the version:
+    print(machine.succeed("sway --version"))
+
+    # Wait for Sway to complete startup:
+    machine.wait_for_file("/run/user/1000/wayland-1")
+    machine.wait_for_file("/tmp/sway-ipc.sock")
+
+    # Test XWayland:
+    machine.succeed(
+        "su - alice -c 'swaymsg exec WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY=invalid alacritty'"
+    )
+    machine.wait_for_text("alice@machine")
+    machine.send_chars("test-x11\n")
+    machine.wait_for_file("/tmp/test-x11-exit-ok")
+    print(machine.succeed("cat /tmp/test-x11.out"))
+    machine.screenshot("alacritty_glinfo")
+    machine.succeed("pkill alacritty")
+
+    # Start a terminal (Alacritty) on workspace 3:
+    machine.send_key("alt-3")
+    machine.succeed(
+        "su - alice -c 'swaymsg exec WINIT_UNIX_BACKEND=wayland DISPLAY=invalid alacritty'"
+    )
+    machine.wait_for_text("alice@machine")
+    machine.send_chars("test-wayland\n")
+    machine.wait_for_file("/tmp/test-wayland-exit-ok")
+    print(machine.succeed("cat /tmp/test-wayland.out"))
+    machine.screenshot("alacritty_wayland_info")
+    machine.send_key("alt-shift-q")
+    machine.wait_until_fails("pgrep alacritty")
+
+    # Test swaynag:
+    machine.send_key("alt-shift-e")
+    machine.wait_for_text("You pressed the exit shortcut.")
+    machine.screenshot("sway_exit")
+
+    # Exit Sway and verify process exit status 0:
+    machine.succeed("su - alice -c 'swaymsg exit || true'")
+    machine.wait_for_file("/tmp/sway-exit-ok")
+  '';
+})

nixos/tests/wmderland.nix

@@ -1,6 +1,6 @@
 import ./make-test-python.nix ({ pkgs, ...} : {
   name = "wmderland";
-  meta = with pkgs.stdenv.lib.maintainers; {
+  meta = with pkgs.lib.maintainers; {
     maintainers = [ takagiy ];
   };
 

pkgs/applications/audio/audacity/default.nix

@@ -28,6 +28,7 @@
 , ffmpeg
 , soundtouch
 , pcre /*, portaudio - given up fighting their portaudio.patch */
+, linuxHeaders
 , at-spi2-core ? null
 , dbus ? null
 , epoxy ? null
@@ -41,24 +42,35 @@
 }:
 
 # TODO
-# - as of 2.4.2, GTK2 is still the recommended version ref https://www.audacityteam.org/download/source/ check if that changes in future versions
+# - as of 3.0.2, GTK2 is still the recommended version ref https://www.audacityteam.org/download/source/ check if that changes in future versions
 # - detach sbsms
 
+let
+  wxGTK-audacity = wxGTK.overrideAttrs (oldAttrs: rec {
+    src = fetchFromGitHub {
+      owner = "audacity";
+      repo = "wxWidgets";
+      rev = "07e7d832c7a337aedba3537b90b2c98c4d8e2985";
+      sha256 = "1mawnkcrmqj98jp0jxlnh9xkc950ca033ccb51c7035pzmi9if9a";
+      fetchSubmodules = true;
+    };
+  });
+in
 stdenv.mkDerivation rec {
   pname = "audacity";
-  version = "2.4.2";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "audacity";
     repo = "audacity";
     rev = "Audacity-${version}";
-    sha256 = "sha256-hpRTo5B0EMyzORopsNPOgv6mohBkwJfWfCLnPvFmdFI=";
+    sha256 = "035qq2ff16cdl2cb9iply2bfjmhfl1dpscg79x6c9l0i9m8k41zj";
   };
 
   patches = [
     (fetchpatch {
-      url = "https://github.com/audacity/audacity/commit/a070b5d8a8ba10fb86edba6aeb8fdab0f66ba408.patch";
-      sha256 = "sha256-8UZupGcN+/tytAhyy5T1P0nufvsQPeyLgOUMGt7l8Oc=";
+      url = "https://github.com/audacity/audacity/commit/007852e51fcbb5f1f359d112f28b8984a604dac6.patch";
+      sha256 = "0zp2iydd46analda9cfnbmzdkjphz5m7dynrdj5qdnmq6j3px9fw";
       name = "audacity_xdg_paths.patch";
     })
   ];
@@ -68,6 +80,10 @@ stdenv.mkDerivation rec {
     touch src/RevisionIdent.h
   '';
 
+  preConfigure = ''
+    substituteInPlace src/FileNames.cpp --replace /usr/include/linux/magic.h ${linuxHeaders}/include/linux/magic.h
+  '';
+
   # workaround for a broken cmake. Drop it with a later version to see if it works.
   # https://github.com/NixOS/nixpkgs/issues/94905
   cmakeFlags = lib.optional stdenv.isLinux "-DCMAKE_OSX_ARCHITECTURES=";
@@ -86,7 +102,14 @@ stdenv.mkDerivation rec {
     "-lswscale"
   ];
 
-  nativeBuildInputs = [ cmake gettext pkg-config python3 ];
+  nativeBuildInputs = [
+    cmake
+    gettext
+    pkg-config
+    python3
+  ] ++ lib.optionals stdenv.isLinux [
+    linuxHeaders
+  ];
 
   buildInputs = [
     alsaLib
@@ -110,8 +133,8 @@ stdenv.mkDerivation rec {
     sratom
     suil
     twolame
-    wxGTK
-    wxGTK.gtk
+    wxGTK-audacity
+    wxGTK-audacity.gtk
   ] ++ lib.optionals stdenv.isLinux [
     at-spi2-core
     dbus

pkgs/applications/audio/clementine/default.nix

@@ -1,5 +1,5 @@
 { lib, mkDerivation, fetchFromGitHub, fetchpatch, boost, cmake, chromaprint, gettext, gst_all_1, liblastfm
-, qtbase, qtx11extras
+, qtbase, qtx11extras, qttools
 , taglib, fftw, glew, qjson, sqlite, libgpod, libplist, usbmuxd, libmtp
 , libpulseaudio, gvfs, libcdio, libechonest, libspotify, pcre, projectm, protobuf
 , qca2, pkg-config, sparsehash, config, makeWrapper, gst_plugins }:
@@ -45,6 +45,7 @@ let
     qjson
     qtbase
     qtx11extras
+    qttools
     sqlite
     taglib
   ]

pkgs/applications/audio/mousai/default.nix

@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mousai";
-  version = "0.3.1";
+  version = "0.3.2";
 
   format = "other";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "SeaDve";
     repo = "Mousai";
     rev = "v${version}";
-    sha256 = "0x57dci0prhlj79h74yh79cazn48rn0bckz5j3z4njk4fwc3fvfx";
+    sha256 = "sha256-sBB2kqlC+2qPgQinhGxY8lq9unxgQoOOhDP5o1pUWMo=";
   };
 
   postPatch = ''

pkgs/applications/audio/pianobar/default.nix

@@ -1,16 +1,17 @@
-{ fetchurl, lib, stdenv, pkg-config, libao, json_c, libgcrypt, ffmpeg_3, curl }:
+{ fetchurl, lib, stdenv, pkg-config, libao, json_c, libgcrypt, ffmpeg, curl }:
 
 stdenv.mkDerivation rec {
-  name = "pianobar-2020.11.28";
+  pname = "pianobar";
+  version = "2020.11.28";
 
   src = fetchurl {
-    url = "http://6xq.net/projects/pianobar/${name}.tar.bz2";
+    url = "https://6xq.net/projects/pianobar/${pname}-${version}.tar.bz2";
     sha256 = "1znlwybfpxsjqr1jmr8j0ci8wzmpzmk2yxb0qcx9w9a8nnbgnfv5";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    libao json_c libgcrypt ffmpeg_3 curl
+    libao json_c libgcrypt ffmpeg curl
   ];
 
   makeFlags = [ "PREFIX=$(out)" ];

pkgs/applications/audio/picard/default.nix

@@ -1,4 +1,9 @@
-{ lib, python3Packages, fetchFromGitHub, gettext, chromaprint, qt5
+{ lib
+, python3Packages
+, fetchFromGitHub
+, gettext
+, chromaprint
+, qt5
 , enablePlayback ? true
 , gst_all_1
 }:
@@ -10,43 +15,45 @@ let
   else
     pythonPackages.pyqt5
   ;
-in pythonPackages.buildPythonApplication rec {
+in
+pythonPackages.buildPythonApplication rec {
   pname = "picard";
-  version = "2.5.6";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "metabrainz";
     repo = pname;
     rev = "release-${version}";
-    sha256 = "1mkbg44bm642mlpfxsdlw947var6a3sf9m6c897b4n0742hsdkbc";
+    sha256 = "1dhkdzc3601rhg8pqljbv3dz7j0mx75brpfhlizhgwgv65qk3ifj";
   };
 
   nativeBuildInputs = [ gettext qt5.wrapQtAppsHook qt5.qtbase ]
-    ++ lib.optionals (pyqt5.multimediaEnabled) [
-      qt5.qtmultimedia.bin
-      gst_all_1.gstreamer
-      gst_all_1.gst-vaapi
-      gst_all_1.gst-libav
-      gst_all_1.gst-plugins-base
-      gst_all_1.gst-plugins-good
-    ]
+  ++ lib.optionals (pyqt5.multimediaEnabled) [
+    qt5.qtmultimedia.bin
+    gst_all_1.gst-libav
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-vaapi
+    gst_all_1.gstreamer
+  ]
   ;
 
   propagatedBuildInputs = with pythonPackages; [
-    pyqt5
-    mutagen
     chromaprint
-    discid
     dateutil
+    discid
+    fasteners
+    mutagen
+    pyqt5
   ];
 
   # In order to spare double wrapping, we use:
   preFixup = ''
     makeWrapperArgs+=("''${qtWrapperArgs[@]}")
   ''
-    + lib.optionalString (pyqt5.multimediaEnabled) ''
-      makeWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
-    ''
+  + lib.optionalString (pyqt5.multimediaEnabled) ''
+    makeWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
+  ''
   ;
 
   meta = with lib; {

pkgs/applications/audio/sound-juicer/default.nix

@@ -1,28 +1,58 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, gtk3, intltool, itstool, libxml2, brasero
-, libcanberra-gtk3, gnome3, gst_all_1, libmusicbrainz5, libdiscid, isocodes
-, gsettings-desktop-schemas, wrapGAppsHook }:
+{ lib
+, stdenv
+, fetchurl
+, meson
+, ninja
+, pkg-config
+, glib
+, gtk3
+, itstool
+, libxml2
+, brasero
+, libcanberra-gtk3
+, gnome3
+, gst_all_1
+, libmusicbrainz5
+, libdiscid
+, isocodes
+, gsettings-desktop-schemas
+, wrapGAppsHook
+}:
 
-let
+stdenv.mkDerivation rec {
   pname = "sound-juicer";
-  version = "3.24.0";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  version = "3.38.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "19qg4xv0f9rkq34lragkmhii1llxsa87llbl28i759b0ks4f6sny";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "08d5d81rz9sj3m5paw8fwbgxmhlbr7bcjdzpmzj832qvg8smydxf";
   };
 
-  nativeBuildInputs = [ pkg-config intltool itstool libxml2 wrapGAppsHook ];
-  buildInputs = [
-    glib gtk3 brasero libcanberra-gtk3 gnome3.adwaita-icon-theme
-    gsettings-desktop-schemas libmusicbrainz5 libdiscid isocodes
-    gst_all_1.gstreamer gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good gst_all_1.gst-plugins-bad
-    gst_all_1.gst-libav
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    itstool
+    libxml2
+    wrapGAppsHook
   ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=format-nonliteral";
+  buildInputs = [
+    glib
+    gtk3
+    brasero
+    libcanberra-gtk3
+    gnome3.adwaita-icon-theme
+    gsettings-desktop-schemas
+    libmusicbrainz5
+    libdiscid
+    isocodes
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-libav
+  ];
 
   passthru = {
     updateScript = gnome3.updateScript {
@@ -34,7 +64,7 @@ in stdenv.mkDerivation rec {
     description = "A Gnome CD Ripper";
     homepage = "https://wiki.gnome.org/Apps/SoundJuicer";
     maintainers = [ maintainers.bdimcheff ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }

pkgs/applications/audio/sublime-music/default.nix

@@ -1,5 +1,4 @@
 { fetchFromGitLab
-, fetchpatch
 , lib
 , python3Packages
 , gobject-introspection
@@ -16,26 +15,16 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "sublime-music";
-  version = "0.11.11";
+  version = "0.11.12";
   format = "pyproject";
 
   src = fetchFromGitLab {
     owner = "sublime-music";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-r4Tn/7CGDny8Aa4kF4PM5ZKMYthMJ7801X3zPdvXh4Q=";
+    sha256 = "sha256-fcEdpht+xKJRTaD3gKoRdf6O2SAPlZHZ61Jy8bdTKjs=";
   };
 
-  patches = [
-    # Switch to poetry-core:
-    # https://gitlab.com/sublime-music/sublime-music/-/merge_requests/60
-    (fetchpatch {
-      name = "use-poetry-core.patch";
-      url = "https://gitlab.com/sublime-music/sublime-music/-/commit/9b0af19dbdfdcc5a0fa23e73bb34c7135a8c2855.patch";
-      sha256 = "sha256-cXG0RvrnBpme6yKWM0nfqMqoK0qPT6spflJ9AaaslVg=";
-    })
-  ];
-
   nativeBuildInputs = [
     gobject-introspection
     python3Packages.poetry-core

pkgs/applications/audio/sunvox/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://www.warmplace.ru/soft/sunvox/sunvox-${version}.zip";
-    sha256 = "0lqzr68n2c6aifw2vbyars91wn1chmgb9xfdk463g4vjqiava3ih";
+    sha256 = "10lqbm1grw0sqasx7i6528cishv5ksdf9zbb3ygxd8c1iwaxzhb9";
   };
 
   nativeBuildInputs = [ unzip ];
@@ -44,7 +44,5 @@ stdenv.mkDerivation rec {
     homepage = "http://www.warmplace.ru/soft/sunvox/";
     maintainers = with maintainers; [ puffnfresh ];
     platforms = [ "i686-linux" "x86_64-linux" ];
-    # hash mismatch
-    broken = true;
   };
 }

pkgs/applications/audio/transcribe/default.nix

@@ -0,0 +1,64 @@
+{ stdenv, fetchzip, lib, wrapGAppsHook, alsaLib, atk, cairo, gdk-pixbuf
+, glib, gst_all_1,  gtk3, libSM, libX11, libpng12, pango, zlib }:
+
+stdenv.mkDerivation rec {
+  pname = "transcribe";
+  version = "9.00";
+
+  src = if stdenv.hostPlatform.system == "x86_64-linux" then
+    fetchzip {
+      url = "https://www.seventhstring.com/xscribe/downlo/xscsetup-9.00.0.tar.gz";
+      sha256 = "0mgjx0hnps3jmc2d9hkskxbmwcqf7f9jx595j5sc501br1l84sdf";
+    }
+  else throw "Platform not supported";
+
+  nativeBuildInputs = [ wrapGAppsHook ];
+
+  buildInputs = with gst_all_1; [ gst-plugins-base gst-plugins-good
+    gst-plugins-bad gst-plugins-ugly ];
+
+  dontPatchELF = true;
+
+  libPath = with gst_all_1; lib.makeLibraryPath [
+    stdenv.cc.cc glib gtk3 atk pango cairo gdk-pixbuf alsaLib
+    libX11 libSM libpng12 gstreamer gst-plugins-base zlib
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/libexec $out/share/doc
+    cp transcribe $out/libexec
+    cp xschelp.htb readme_gtk.html $out/share/doc
+    cp -r gtkicons $out/share/icons
+    ln -s $out/share/doc/xschelp.htb $out/libexec
+    patchelf \
+      --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
+      $out/libexec/transcribe
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH_1_0"
+      --prefix LD_LIBRARY_PATH : "${libPath}"
+    )
+  '';
+
+  postFixup = ''
+    ln -s $out/libexec/transcribe $out/bin/
+  '';
+
+  meta = with lib; {
+    description = "Software to help transcribe recorded music";
+    longDescription = ''
+      The Transcribe! application is an assistant for people who want
+      to work out a piece of music from a recording, in order to write
+      it out, or play it themselves, or both. It doesn't do the
+      transcribing for you, but it is essentially a specialised player
+      program which is optimised for the purpose of transcription. It
+      has many transcription-specific features not found on
+      conventional music players.
+    '';
+    homepage = "https://www.seventhstring.com/xscribe/";
+    license = licenses.unfree;
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/backup/deja-dup/default.nix

@@ -12,7 +12,7 @@
 , coreutils
 , libsoup
 , libsecret
-, libhandy_0
+, libhandy
 , wrapGAppsHook
 , libgpgerror
 , json-glib
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation rec {
   pname = "deja-dup";
-  version = "42.6";
+  version = "42.7";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = pname;
     rev = version;
-    sha256 = "0grwlfakrnr9ij7h8lsfazlws6qix8pl50dr94cpxnnbjga9xn9z";
+    sha256 = "1q66wccnph78cp1r5mln2iq4bcqdrrchxq3c1pjrzkmzwc6l93gz";
   };
 
   patches = [
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     glib
     gtk3
     libsecret
-    libhandy_0
+    libhandy
     libgpgerror
     json-glib
   ];

pkgs/applications/blockchains/go-ethereum.nix

@@ -8,17 +8,17 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.10.2";
+  version = "1.10.3";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PJaJ9fCva9UUBcQrnVa2c7dk4koi6AyX6bj3JStUMwM=";
+    sha256 = "sha256-85aUR7MvaPeRilC+4oj6XW2IEUvxRUsVz63tQ/Jc7xw=";
   };
 
   runVend = true;
-  vendorSha256 = "sha256-qLpwrV9NkmUO0yoK2/gwb5oe/lky/w/P0QVoFSTNuMU=";
+  vendorSha256 = "sha256-8zhVQ8FUdzog7h9RBfuq8uBp0zjulXbDOLAPljp4deA=";
 
   doCheck = false;
 

pkgs/applications/blockchains/openethereum/default.nix

@@ -10,26 +10,20 @@
 , darwin
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage.override { stdenv = stdenv; } rec {
   pname = "openethereum";
-  version = "3.2.4";
+  version = "3.2.5";
 
   src = fetchFromGitHub {
     owner = "openethereum";
     repo = "openethereum";
     rev = "v${version}";
-    sha256 = "143w0b0ff1s73qzr844l25w90d2y2z0b3w2fr5kkbc1wsnpcq7jp";
+    sha256 = "1g48fkznvr9fs3j9zy2d9pcwnahmyghxg2b9bsn2mxpyczmfqrki";
   };
 
-  cargoSha256 = "1gm02pcfll362add8a0dcb0sk0mag8z0q23b87yb6fs870bqvhib";
+  cargoSha256 = "02nlm5ariv4dr6b3rckzs7hw1xrl83yvhimrzb0g5l0j0sxh1nhc";
 
-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
-  nativeBuildInputs = [
-    cmake
-    llvmPackages.clang
-    llvmPackages.libclang
-    pkg-config
-  ];
+  nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isLinux [ systemd ]

pkgs/applications/blockchains/polkadot/default.nix

@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "0.8.30";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot";
     rev = "v${version}";
-    sha256 = "sha256-9GCk1gqlQJhuoiKRi7J1qcJlZjlq2ObGicp5tGGDhrY=";
+    sha256 = "sha256-Y52VFTjRFyC38ZNt6NMtVRA2pn6Y4B/NC4EEuDvIFQQ=";
   };
 
-  cargoSha256 = "sha256-pWqbcargCEkisdGnj08VQdRqjocR7zZhWukhYjfZDqI=";
+  cargoSha256 = "sha256-0GrExza6uPF/eFWrXlM4MpCD7TMk2y+uEc5SDj/UQkg=";
 
   nativeBuildInputs = [ clang ];
 
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
     description = "Polkadot Node Implementation";
     homepage = "https://polkadot.network";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ akru andresilva asymmetric RaghavSood ];
+    maintainers = with maintainers; [ akru andresilva asymmetric FlorianFranzen RaghavSood ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/blockchains/turbo-geth.nix

@@ -2,28 +2,29 @@
 
 buildGoModule rec {
   pname = "turbo-geth";
-  version = "2021.02.01";
+  version = "2021.04.05";
 
   src = fetchFromGitHub {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9z0Hogu/VgGxvgQMKIImv+qyTqTmR40JS4NNIOk5EZI=";
+    sha256 = "sha256-RTPNJASNFyZ6tDJj0WOqALyxRsOLJzPy0qA1c2sSxys=";
   };
 
-  vendorSha256 = "sha256-Ho68+SzYELQN4DE57LNSXeHIu43zAOb7HK/jx7PFdXk=";
+  vendorSha256 = "01c7lb6n00ws60dfybir0z5dbn6h68p5s4hbq0ga2g7drf3l3y0p";
   runVend = true;
 
   subPackages = [
     "cmd/tg"
-    "cmd/restapi"
+    "cmd/evm"
     "cmd/rpcdaemon"
+    "cmd/rlpdump"
   ];
 
   meta = with lib; {
     homepage = "https://github.com/ledgerwatch/turbo-geth/";
     description = "Ethereum node and geth fork focused on scalability and modularity";
-    license = with licenses; [ lgpl3 gpl3 ];
+    license = with licenses; [ lgpl3Plus gpl3Plus ];
     maintainers = with maintainers; [ xwvvvvwx ];
   };
 }

pkgs/applications/editors/emacs/generic.nix

@@ -94,8 +94,8 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
         ]));
     in ''
       substituteInPlace lisp/emacs-lisp/comp.el --replace \
-        "(defcustom comp-native-driver-options nil" \
-        "(defcustom comp-native-driver-options '(${backendPath})"
+        "(defcustom native-comp-driver-options nil" \
+        "(defcustom native-comp-driver-options '(${backendPath})"
     ''))
     ""
   ];
@@ -175,7 +175,7 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
           (comp-trampoline-compile (intern (pop argv))))"
     mkdir -p $out/share/emacs/native-lisp
     $out/bin/emacs --batch \
-      --eval "(add-to-list 'comp-eln-load-path \"$out/share/emacs/native-lisp\")" \
+      --eval "(add-to-list 'native-comp-eln-load-path \"$out/share/emacs/native-lisp\")" \
       -f batch-native-compile $out/share/emacs/site-lisp/site-start.el
   '';
 

pkgs/applications/editors/emacs/site-start.el

@@ -47,11 +47,11 @@ least specific (the system profile)"
 ;;; Set up native-comp load path.
 (when (featurep 'comp)
   ;; Append native-comp subdirectories from `NIX_PROFILES'.
-  (setq comp-eln-load-path
+  (setq native-comp-eln-load-path
         (append (mapcar (lambda (profile-dir)
                           (concat profile-dir "/share/emacs/native-lisp/"))
                         (nix--profile-paths))
-                comp-eln-load-path)))
+                native-comp-eln-load-path)))
 
 ;;; Make `woman' find the man pages
 (defvar woman-manpath)

pkgs/applications/editors/gnome-builder/default.nix

@@ -39,11 +39,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-builder";
-  version = "3.38.2";
+  version = "3.40.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "jFNco64yoZC1TZbTIHGVf+wBYYQHo2JRiMZFHngzYTs=";
+    sha256 = "16kikslvcfjqj4q3j857mq9i8cyd965b3lvfzcwijc91x3ylr15j";
   };
 
   nativeBuildInputs = [
@@ -99,7 +99,6 @@ stdenv.mkDerivation rec {
   '';
 
   mesonFlags = [
-    "-Dpython_libprefix=${python3.libPrefix}"
     "-Ddocs=true"
 
     # Making the build system correctly detect clang header and library paths
@@ -135,7 +134,10 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  passthru.updateScript = gnome3.updateScript { packageName = pname; };
+  passthru.updateScript = gnome3.updateScript {
+    packageName = pname;
+    versionPolicy = "odd-unstable";
+  };
 
   meta = with lib; {
     description = "An IDE for writing GNOME-based software";

pkgs/applications/editors/gnome-latex/default.nix

@@ -1,21 +1,49 @@
-{ lib, stdenv, fetchurl, wrapGAppsHook, gsettings-desktop-schemas, gspell, gtksourceview4, libgee
-, tepl, amtk, gnome3, glib, pkg-config, intltool, itstool, libxml2 }:
-let
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, autoreconfHook
+, gtk-doc
+, vala
+, gobject-introspection
+, wrapGAppsHook
+, gsettings-desktop-schemas
+, gspell
+, gtksourceview4
+, libgee
+, tepl
+, amtk
+, gnome3
+, glib
+, pkg-config
+, intltool
+, itstool
+, libxml2
+}:
+
+stdenv.mkDerivation rec {
   version = "3.38.0";
   pname = "gnome-latex";
-in stdenv.mkDerivation {
-  name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0xqd49pgi82dygqnxj08i1v22b0vwwhx3zvdinhrx4jny339yam8";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
-  configureFlags = ["--disable-dconf-migration"];
+  patches = [
+    # Fix build with latest tepl.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/Archive/gnome-latex/commit/e1b01186f8a4e5d3fee4c9ccfbedd6d098517df9.patch";
+      sha256 = "H8cbp5hDZoXytEdKE2D/oYHNKIbEFwxQoEaC4JMfGHY=";
+    })
+  ];
 
   nativeBuildInputs = [
     pkg-config
+    autoreconfHook
+    gtk-doc
+    vala
+    gobject-introspection
     wrapGAppsHook
     itstool
     intltool
@@ -33,9 +61,18 @@ in stdenv.mkDerivation {
     tepl
   ];
 
+  configureFlags = [
+    "--disable-dconf-migration"
+  ];
+
   doCheck = true;
 
-  passthru.updateScript = gnome3.updateScript { packageName = pname; };
+  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+
+  passthru.updateScript = gnome3.updateScript {
+    packageName = pname;
+    versionPolicy = "odd-unstable";
+  };
 
   meta = with lib; {
     homepage = "https://wiki.gnome.org/Apps/GNOME-LaTeX";

pkgs/applications/editors/neovim/utils.nix

@@ -58,10 +58,11 @@ let
       # add to nvim's 'embedded rc' this:
       #    let g:<key>_host_prog=$out/bin/nvim-<key>
       # Or this:
-      #    let g:loaded_${prog}_provider=1
+      #    let g:loaded_${prog}_provider=0
       # While the latter tells nvim that this provider is not available
       hostprog_check_table = {
         node = withNodeJs;
+        python = false;
         python3 = withPython3;
         ruby = withRuby;
       };
@@ -107,7 +108,7 @@ let
       if withProg then
         "let g:${prog}_host_prog='${placeholder "out"}/bin/nvim-${prog}'"
       else
-        "let g:loaded_${prog}_provider=1"
+        "let g:loaded_${prog}_provider=0"
     ;
 
   # to keep backwards compatibility

pkgs/applications/graphics/ImageMagick/7.0.nix

@@ -2,6 +2,8 @@
 , bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg, djvulibre
 , lcms2, openexr, libpng, librsvg, libtiff, libxml2, openjpeg, libwebp, libheif
 , ApplicationServices
+, Foundation
+, testVersion, imagemagick
 }:
 
 let
@@ -50,7 +52,10 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isMinGW)
       [ openexr librsvg openjpeg ]
-    ++ lib.optional stdenv.isDarwin ApplicationServices;
+    ++ lib.optionals stdenv.isDarwin [
+      ApplicationServices
+      Foundation
+    ];
 
   propagatedBuildInputs =
     [ bzip2 freetype libjpeg lcms2 ]
@@ -72,6 +77,9 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests.version =
+    testVersion { package = imagemagick; };
+
   meta = with lib; {
     homepage = "http://www.imagemagick.org/";
     description = "A software suite to create, edit, compose, or convert bitmap images";

pkgs/applications/graphics/gimp/default.nix

@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , substituteAll
 , autoreconfHook
 , pkg-config
@@ -34,6 +33,7 @@
 , libexif
 , gettext
 , makeWrapper
+, gtk-doc
 , xorg
 , glib-networking
 , libmypaint
@@ -53,13 +53,13 @@ let
   python = python2.withPackages (pp: [ pp.pygtk ]);
 in stdenv.mkDerivation rec {
   pname = "gimp";
-  version = "2.10.22";
+  version = "2.10.24";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "1fqqyshakvdarf1jipk2n33ibqr23ni22z3d8srq13bpydblpf1d";
+    sha256 = "17lq6ns5qhspd171zqh76yf98xnn5n0hcl7hbhbx63cc6ribf6xx";
   };
 
   patches = [
@@ -73,12 +73,6 @@ in stdenv.mkDerivation rec {
     # Use absolute paths instead of relying on PATH
     # to make sure plug-ins are loaded by the correct interpreter.
     ./hardcode-plugin-interpreters.patch
-
-    # Fix crash without dot.
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gimp/-/commit/f83fd22c4b8701ffc4ce14383e5e22756a4bce04.patch";
-      sha256 = "POuvBhOSStO7hBGp4HgNx5F9pElFRoqN3W+i3u4zOnk=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -87,6 +81,7 @@ in stdenv.mkDerivation rec {
     intltool
     gettext
     makeWrapper
+    gtk-doc
   ];
 
   buildInputs = [

pkgs/applications/graphics/gnome-photos/default.nix

@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchurl
-, fetchpatch
 , at-spi2-core
 , babl
 , dbus
@@ -22,6 +21,7 @@
 , gtk3
 , itstool
 , libdazzle
+, libhandy
 , libgdata
 , libxml2
 , meson
@@ -36,32 +36,17 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-photos";
-  version = "3.38.0";
+  version = "40.0";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1i64w69kk3sdf9vn7npnwrhy8qjwn0vizq200x3pgmbrfm3kjzv6";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
+    sha256 = "1bzi79plw6ji6qlckhxnwfnswy6jpnhzmmyanml2i2xg73hp6bg0";
   };
 
   patches = [
     ./installed-tests-path.patch
-
-    # Port to Tracker 3
-    # https://gitlab.gnome.org/GNOME/gnome-photos/-/merge_requests/135
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-photos/commit/f39a85bb1a82093f4ba615494ff7e95609674fc2.patch";
-      sha256 = "M5r5WuB1JpUBVN3KxNvpMiPWj0pIpT+ImQMOiGtUgT4=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-photos/commit/3d847ff80d429cadf0bc59aa50caa37bf27c0201.patch";
-      sha256 = "zGjSL1qpWVJ/5Ifgh2CbhFSBR/WDAra8F+YUOemyxyU=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-photos/commit/2eb923726147b05c936dee64b205d833525db1df.patch";
-      sha256 = "vCA6NXHzmNf2GoLqzWwIyziC6puJgJ0QTLeKWsAEFAE=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -99,6 +84,7 @@ stdenv.mkDerivation rec {
     gsettings-desktop-schemas
     gtk3
     libdazzle
+    libhandy
     libgdata
     tracker
     tracker-miners # For 'org.freedesktop.Tracker.Miner.Files' GSettings schema

pkgs/applications/graphics/gthumb/default.nix

@@ -32,11 +32,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gthumb";
-  version = "3.10.2";
+  version = "3.11.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "/erkKBg3j5s8qwBgTu61t8Cnpez+ad4IuZOGd0ZDXJM=";
+    sha256 = "11bvcimamdcksgqj1ymh54yzhpwc5j8glda8brqqhwq3h2wj0j9d";
   };
 
   nativeBuildInputs = [
@@ -97,6 +97,7 @@ stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
+      versionPolicy = "odd-unstable";
     };
   };
 

pkgs/applications/graphics/hydrus/default.nix

@@ -9,14 +9,14 @@
 
 pythonPackages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "436";
+  version = "438";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "v${version}";
-    sha256 = "sha256-FXm8VUEY0OZ6/dc/qNwOXekhv5H2C9jjg/eNDoMvMn0==";
+    sha256 = "sha256-iBJkbVUlsjt26SbDe92eIrWKQwWBhkjjeLM14Pm/obc=";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/inkscape/default.nix

@@ -5,6 +5,7 @@
 , cmake
 , double-conversion
 , fetchurl
+, fetchpatch
 , gettext
 , gdl
 , ghostscript
@@ -71,6 +72,13 @@ stdenv.mkDerivation rec {
       # e.g., those from the "Effects" menu.
       python3 = "${python3Env}/bin/python";
     })
+
+    # Fix build with glib 2.68
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/2790
+    (fetchpatch {
+      url = "https://gitlab.com/inkscape/inkscape/-/commit/eb24388f1730918edd9565d9e5d09340ec0b3b08.patch";
+      sha256 = "d2FHRWcOzi0Vsr6t0MuLu3rWpvhFKuuvoXd4/NKUSJI=";
+    })
   ];
 
   postPatch = ''

pkgs/applications/kde/k3b.nix

@@ -4,7 +4,7 @@
 , flac, lame, libmad, libmpcdec, libvorbis
 , libsamplerate, libsndfile, taglib
 , cdparanoia, cdrdao, cdrtools, dvdplusrwtools, libburn, libdvdcss, libdvdread, vcdimager
-, ffmpeg_3, libmusicbrainz3, normalize, sox, transcode, kinit
+, ffmpeg, libmusicbrainz3, normalize, sox, transcode, kinit
 }:
 
 mkDerivation {
@@ -25,7 +25,7 @@ mkDerivation {
     # cd/dvd
     cdparanoia libdvdcss libdvdread
     # others
-    ffmpeg_3 libmusicbrainz3 shared-mime-info
+    ffmpeg libmusicbrainz3 shared-mime-info
   ];
   propagatedUserEnvPkgs = [ (lib.getBin kinit) ];
   postFixup =

pkgs/applications/misc/1password-gui/default.nix

@@ -1,6 +1,6 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
-, appimageTools
 , makeWrapper
 , electron_11
 , openssl
@@ -8,21 +8,15 @@
 
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "8.0.30";
+  version = "8.0.33-53.BETA";
 
   src = fetchurl {
-    url = "https://onepassword.s3.amazonaws.com/linux/appimage/${pname}-${version}.AppImage";
-    hash = "sha256-j+fp/f8nta+OOuOFU4mmUrGYlVmAqdaXO4rLJ0in+m8=";
+    url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
+    hash = "sha256-YUYER+UiM1QEDgGl0P9bIT65YVacUnuGtQVkV91teEU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
-  appimageContents = appimageTools.extractType2 {
-    name = "${pname}-${version}";
-    inherit src;
-  };
-
-  dontUnpack = true;
   dontConfigure = true;
   dontBuild = true;
 
@@ -35,20 +29,33 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin $out/share/1password
 
     # Applications files.
-    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
+    cp -a {locales,resources} $out/share/${pname}
+    install -Dm0755 -t $out/share/${pname} {1Password-BrowserSupport,1Password-KeyringHelper}
 
     # Desktop file.
-    install -Dt $out/share/applications ${appimageContents}/${pname}.desktop
+    install -Dt $out/share/applications resources/${pname}.desktop
     substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
+      --replace 'Exec=/opt/1Password/${pname}' 'Exec=${pname}'
 
     # Icons.
-    cp -a ${appimageContents}/usr/share/icons $out/share
+    cp -a resources/icons $out/share
 
     # Wrap the application with Electron.
     makeWrapper "${electron_11}/bin/electron" "$out/bin/${pname}" \
       --add-flags "$out/share/${pname}/resources/app.asar" \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
+
+    # Set the interpreter for the helper binaries and wrap them with
+    # the runtime libraries.
+    interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
+    patchelf --set-interpreter $interp \
+      $out/share/$pname/{1Password-BrowserSupport,1Password-KeyringHelper}
+
+    wrapProgram $out/share/${pname}/1Password-BrowserSupport \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
+
+    wrapProgram $out/share/${pname}/1Password-KeyringHelper \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
   '';
 
   passthru.updateScript = ./update.sh;

pkgs/applications/misc/1password-gui/update.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p curl gnused common-updater-scripts
 
-version="$(curl -sL https://onepassword.s3.amazonaws.com/linux/debian/dists/edge/main/binary-amd64/Packages | sed -r -n 's/^Version: (.*)-[0-9]+/\1/p' | head -n1)"
+version="$(curl -sL https://onepassword.s3.amazonaws.com/linux/debian/dists/edge/main/binary-amd64/Packages | sed -r -n 's/^Version: (.*)/\1/p' | head -n1)"
 update-source-version _1password-gui "$version"

pkgs/applications/misc/1password/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "1.8.0";
+  version = "1.9.1";
   src =
     if stdenv.isLinux then fetchzip {
       url = {
@@ -11,14 +11,14 @@ stdenv.mkDerivation rec {
         "aarch64-linux" = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_arm_v${version}.zip";
       }.${stdenv.hostPlatform.system};
       sha256 = {
-        "i686-linux" = "teoxscan+EZ76Q0sfKT6nt1w/LSsmDoiN2oh+NGO/4A=";
-        "x86_64-linux" = "nRK2GSwhQe5OgcAdR1fg0vUp3fzEkhwU/teIwsEEemw=";
-        "aarch64-linux" = "0932bspm1likky1n0rg15d01gspkm1fns2ma82qyb91yr6d18ddk";
+        "i686-linux" = "1x5khnp6yqrjf513x3y6l38rb121nib7d4aiz4cz7fh029kxjhd1";
+        "x86_64-linux" = "1ar8lzkndl7xzcinv93rzg8q25vb23fggbjkhgchgc5x9wkwk8hw";
+        "aarch64-linux" = "1q81pk6qmp96p1dbhx1ijln8f54rac8r81d4ghqx9v756s9szrr1";
       }.${stdenv.hostPlatform.system};
       stripRoot = false;
     } else fetchurl {
       url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_darwin_amd64_v${version}.pkg";
-      sha256 = "0pycia75vdfh6gxfd2hr32cxrryfxydid804n0v76l2fpr9v9v3d";
+      sha256 = "0904wwy3wdhfvbkvpdap8141a9gqmn0dw45ikrzsqpg7pv1r2zch";
     };
 
   buildInputs = lib.optionals stdenv.isDarwin [ xar cpio ];

pkgs/applications/misc/devdocs-desktop/default.nix

@@ -1,13 +1,13 @@
 { lib, appimageTools, fetchurl, gsettings-desktop-schemas, gtk3 }:
 
 let
-  version = "0.7.1";
+  version = "0.7.2";
   pname = "devdocs-desktop";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/egoist/devdocs-desktop/releases/download/v${version}/DevDocs-${version}.AppImage";
-    sha256 = "5bba99a34c90a65eff67aface0b7446cbf43d620a1c195f27e7bb33ab6d3d0c2";
+    sha256 = "sha256-4ugpzh0Dweae6tKb6uqRhEW9HT+iVIo8MQRbVKTdRFw=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/misc/djvulibre/CVE-2019-15142.patch

@@ -1,72 +0,0 @@
-commit 970fb11a296b5bbdc5e8425851253d2c5913c45e
-Author: Leon Bottou <leon@bottou.org>
-Date:   Tue Mar 26 20:36:31 2019 -0400
-
-    Fix bug#296
-
-diff --git a/libdjvu/DjVmDir.cpp b/libdjvu/DjVmDir.cpp
-index a6a39e0..0a0fac6 100644
---- a/libdjvu/DjVmDir.cpp
-+++ b/libdjvu/DjVmDir.cpp
-@@ -299,42 +299,44 @@ DjVmDir::decode(const GP<ByteStream> &gstr)
-          memcpy((char*) strings+strings_size, buffer, length);
-       }
-       DEBUG_MSG("size of decompressed names block=" << strings.size() << "\n");
--      if (strings[strings.size()-1] != 0)
--        {
--         int strings_size=strings.size();
--         strings.resize(strings_size+1);
--         strings[strings_size] = 0;
--        }
-+      int strings_size=strings.size();
-+      strings.resize(strings_size+3);
-+      memset((char*) strings+strings_size, 0, 4);
-       
--         // Copy names into the files
-+      // Copy names into the files
-       const char * ptr=strings;
-       for(pos=files_list;pos;++pos)
-       {
-          GP<File> file=files_list[pos];
--
-+         if (ptr >= (const char*)strings + strings_size)
-+           G_THROW( "DjVu document is corrupted (DjVmDir)" );
-          file->id=ptr;
-          ptr+=file->id.length()+1;
-          if (file->flags & File::HAS_NAME)
-          {
--            file->name=ptr;
--            ptr+=file->name.length()+1;
--         } else
-+           file->name=ptr;
-+           ptr+=file->name.length()+1;
-+         }
-+         else
-          {
-             file->name=file->id;
-          }
-          if (file->flags & File::HAS_TITLE)
-          {
--            file->title=ptr;
--       ptr+=file->title.length()+1;
--         } else
--       file->title=file->id;
--   /* msr debug:  multipage file, file->title is null.  
-+           file->title=ptr;
-+           ptr+=file->title.length()+1;
-+         }
-+         else
-+         {
-+           file->title=file->id;
-+         }
-+         /* msr debug:  multipage file, file->title is null.  
-          DEBUG_MSG(file->name << ", " << file->id << ", " << file->title << ", " <<
-                    file->offset << ", " << file->size << ", " <<
-                    file->is_page() << "\n"); */
-       }
- 
--         // Check that there is only one file with SHARED_ANNO flag on
-+      // Check that there is only one file with SHARED_ANNO flag on
-       int shared_anno_cnt=0;
-       for(pos=files_list;pos;++pos)
-       {

pkgs/applications/misc/djvulibre/CVE-2019-15143.patch

@@ -1,39 +0,0 @@
-commit b1f4e1b2187d9e5010cd01ceccf20b4a11ce723f
-Author: Leon Bottou <leon@bottou.org>
-Date:   Tue Mar 26 20:45:46 2019 -0400
-
-    fix for bug #297
-
-diff --git a/libdjvu/DjVmDir.cpp b/libdjvu/DjVmDir.cpp
-index 0a0fac6..5a49015 100644
---- a/libdjvu/DjVmDir.cpp
-+++ b/libdjvu/DjVmDir.cpp
-@@ -309,7 +309,7 @@ DjVmDir::decode(const GP<ByteStream> &gstr)
-       {
-          GP<File> file=files_list[pos];
-          if (ptr >= (const char*)strings + strings_size)
--           G_THROW( "DjVu document is corrupted (DjVmDir)" );
-+           G_THROW( ByteStream::EndOfFile );
-          file->id=ptr;
-          ptr+=file->id.length()+1;
-          if (file->flags & File::HAS_NAME)
-diff --git a/libdjvu/GBitmap.cpp b/libdjvu/GBitmap.cpp
-index 0e487f0..c2fdbe4 100644
---- a/libdjvu/GBitmap.cpp
-+++ b/libdjvu/GBitmap.cpp
-@@ -890,11 +890,13 @@ GBitmap::read_rle_raw(ByteStream &bs)
-   int c = 0;
-   while (n >= 0)
-     {
--      bs.read(&h, 1);
-+      if (bs.read(&h, 1) <= 0)
-+        G_THROW( ByteStream::EndOfFile );
-       int x = h;
-       if (x >= (int)RUNOVERFLOWVALUE)
-         {
--          bs.read(&h, 1);
-+          if (bs.read(&h, 1) <= 0)
-+            G_THROW( ByteStream::EndOfFile );
-           x = h + ((x - (int)RUNOVERFLOWVALUE) << 8);
-         }
-       if (c+x > ncolumns)

pkgs/applications/misc/djvulibre/CVE-2019-15144.patch

@@ -1,111 +0,0 @@
-commit e15d51510048927f172f1bf1f27ede65907d940d
-Author: Leon Bottou <leon@bottou.org>
-Date:   Mon Apr 8 22:25:55 2019 -0400
-
-    bug 299 fixed
-
-diff --git a/libdjvu/GContainer.h b/libdjvu/GContainer.h
-index 96b067c..0140211 100644
---- a/libdjvu/GContainer.h
-+++ b/libdjvu/GContainer.h
-@@ -550,52 +550,61 @@ public:
- template <class TYPE> void
- GArrayTemplate<TYPE>::sort(int lo, int hi)
- {
--  if (hi <= lo)
--    return;
--  if (hi > hibound || lo<lobound)
--    G_THROW( ERR_MSG("GContainer.illegal_subscript") );
-   TYPE *data = (TYPE*)(*this);
--  // Test for insertion sort
--  if (hi <= lo + 50)
-+  while(true)
-     {
--      for (int i=lo+1; i<=hi; i++)
-+      if (hi <= lo)
-+        return;
-+      if (hi > hibound || lo<lobound)
-+        G_THROW( ERR_MSG("GContainer.illegal_subscript") );
-+      // Test for insertion sort
-+      if (hi <= lo + 50)
-         {
--          int j = i;
--          TYPE tmp = data[i];
--          while ((--j>=lo) && !(data[j]<=tmp))
--            data[j+1] = data[j];
--          data[j+1] = tmp;
-+          for (int i=lo+1; i<=hi; i++)
-+            {
-+              int j = i;
-+              TYPE tmp = data[i];
-+              while ((--j>=lo) && !(data[j]<=tmp))
-+                data[j+1] = data[j];
-+              data[j+1] = tmp;
-+            }
-+          return;
-         }
--      return;
--    }
--  // -- determine suitable quick-sort pivot
--  TYPE tmp = data[lo];
--  TYPE pivot = data[(lo+hi)/2];
--  if (pivot <= tmp)
--    { tmp = pivot; pivot=data[lo]; }
--  if (data[hi] <= tmp)
--    { pivot = tmp; }
--  else if (data[hi] <= pivot)
--    { pivot = data[hi]; }
--  // -- partition set
--  int h = hi;
--  int l = lo;
--  while (l < h)
--    {
--      while (! (pivot <= data[l])) l++;
--      while (! (data[h] <= pivot)) h--;
--      if (l < h)
-+      // -- determine median-of-three pivot
-+      TYPE tmp = data[lo];
-+      TYPE pivot = data[(lo+hi)/2];
-+      if (pivot <= tmp)
-+        { tmp = pivot; pivot=data[lo]; }
-+      if (data[hi] <= tmp)
-+        { pivot = tmp; }
-+      else if (data[hi] <= pivot)
-+        { pivot = data[hi]; }
-+      // -- partition set
-+      int h = hi;
-+      int l = lo;
-+      while (l < h)
-         {
--          tmp = data[l];
--          data[l] = data[h];
--          data[h] = tmp;
--          l = l+1;
--          h = h-1;
-+          while (! (pivot <= data[l])) l++;
-+          while (! (data[h] <= pivot)) h--;
-+          if (l < h)
-+            {
-+              tmp = data[l];
-+              data[l] = data[h];
-+              data[h] = tmp;
-+              l = l+1;
-+              h = h-1;
-+            }
-+        }
-+      // -- recurse, small partition first
-+      //    tail-recursion elimination
-+      if (h - lo <= hi - l) {
-+        sort(lo,h);
-+        lo = l; // sort(l,hi)
-+      } else {
-+        sort(l,hi);
-+        hi = h; // sort(lo,h)
-       }
-     }
--  // -- recursively restart
--  sort(lo, h);
--  sort(l, hi);
- }
- 
- template<class TYPE> inline TYPE&

pkgs/applications/misc/djvulibre/CVE-2019-15145.patch

@@ -1,28 +0,0 @@
-commit 9658b01431cd7ff6344d7787f855179e73fe81a7
-Author: Leon Bottou <leon@bottou.org>
-Date:   Mon Apr 8 22:55:38 2019 -0400
-
-    fix bug #298
-
-diff --git a/libdjvu/GBitmap.h b/libdjvu/GBitmap.h
-index e8e0c9b..ca89a19 100644
---- a/libdjvu/GBitmap.h
-+++ b/libdjvu/GBitmap.h
-@@ -566,7 +566,7 @@ GBitmap::operator[](int row)
- {
-   if (!bytes) 
-     uncompress();
--  if (row<0 || row>=nrows) {
-+  if (row<0 || row>=nrows || !bytes) {
- #ifndef NDEBUG
-     if (zerosize < bytes_per_row + border)
-       G_THROW( ERR_MSG("GBitmap.zero_small") );
-@@ -581,7 +581,7 @@ GBitmap::operator[](int row) const
- {
-   if (!bytes) 
-     ((GBitmap*)this)->uncompress();
--  if (row<0 || row>=nrows) {
-+  if (row<0 || row>=nrows || !bytes) {
- #ifndef NDEBUG
-     if (zerosize < bytes_per_row + border)
-       G_THROW( ERR_MSG("GBitmap.zero_small") );

pkgs/applications/misc/djvulibre/CVE-2019-18804.patch

@@ -1,32 +0,0 @@
-commit c8bec6549c10ffaa2f2fbad8bbc629efdf0dd125
-Author: Leon Bottou <leon@bottou.org>
-Date:   Thu Oct 17 22:20:31 2019 -0400
-
-    Fixed bug 309
-
-diff --git a/libdjvu/IW44EncodeCodec.cpp b/libdjvu/IW44EncodeCodec.cpp
-index 00752a0..f81eaeb 100644
---- a/libdjvu/IW44EncodeCodec.cpp
-+++ b/libdjvu/IW44EncodeCodec.cpp
-@@ -405,7 +405,7 @@ filter_fv(short *p, int w, int h, int rowsize, int scale)
-   int y = 0;
-   int s = scale*rowsize;
-   int s3 = s+s+s;
--  h = ((h-1)/scale)+1;
-+  h = (h>0) ? ((h-1)/scale)+1 : 0;
-   y += 1;
-   p += s;
-   while (y-3 < h)
-diff --git a/tools/ddjvu.cpp b/tools/ddjvu.cpp
-index 6d0df3b..7109952 100644
---- a/tools/ddjvu.cpp
-+++ b/tools/ddjvu.cpp
-@@ -279,7 +279,7 @@ render(ddjvu_page_t *page, int pageno)
-       prect.h = (ih * 100) / dpi;
-     }
-   /* Process aspect ratio */
--  if (flag_aspect <= 0)
-+  if (flag_aspect <= 0 && iw>0 && ih>0)
-     {
-       double dw = (double)iw / prect.w;
-       double dh = (double)ih / prect.h;

pkgs/applications/misc/djvulibre/default.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "djvulibre";
-  version = "3.5.27";
+  version = "3.5.28";
 
   src = fetchurl {
     url = "mirror://sourceforge/djvu/${pname}-${version}.tar.gz";
-    sha256 = "0psh3zl9dj4n4r3lx25390nx34xz0bg0ql48zdskhq354ljni5p6";
+    sha256 = "1p1fiygq9ny8aimwc4vxwjc6k9ykgdsq1sq06slfbzalfvm0kl7w";
   };
 
   outputs = [ "bin" "dev" "out" ];
@@ -24,21 +24,10 @@ stdenv.mkDerivation rec {
     libiconv
   ];
 
-  patches = [
-    ./CVE-2019-18804.patch
-    # This one is needed to make the following
-    # two CVE patches apply cleanly
-    ./fix_hongfuzz_crash.patch
-    ./CVE-2019-15142.patch
-    ./CVE-2019-15143.patch
-    ./CVE-2019-15144.patch
-    ./CVE-2019-15145.patch
-  ];
-
   meta = with lib; {
     description = "The big set of CLI tools to make/modify/optimize/show/export DJVU files";
     homepage = "http://djvu.sourceforge.net";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ Anton-Latukha ];
     platforms = platforms.all;
   };

pkgs/applications/misc/djvulibre/fix_hongfuzz_crash.patch

@@ -1,51 +0,0 @@
-commit 89d71b01d606e57ecec2c2930c145bb20ba5bbe3
-Author: Leon Bottou <leon@bottou.org>
-Date:   Fri Jul 13 08:46:22 2018 -0400
-
-    fix hongfuzz crash.
-
-diff --git a/libdjvu/DjVmDir.cpp b/libdjvu/DjVmDir.cpp
-index d322323..a6a39e0 100644
---- a/libdjvu/DjVmDir.cpp
-+++ b/libdjvu/DjVmDir.cpp
-@@ -299,7 +299,13 @@ DjVmDir::decode(const GP<ByteStream> &gstr)
-          memcpy((char*) strings+strings_size, buffer, length);
-       }
-       DEBUG_MSG("size of decompressed names block=" << strings.size() << "\n");
--   
-+      if (strings[strings.size()-1] != 0)
-+        {
-+         int strings_size=strings.size();
-+         strings.resize(strings_size+1);
-+         strings[strings_size] = 0;
-+        }
-+      
-          // Copy names into the files
-       const char * ptr=strings;
-       for(pos=files_list;pos;++pos)
-diff --git a/libdjvu/miniexp.cpp b/libdjvu/miniexp.cpp
-index 6a5cd90..828addc 100644
---- a/libdjvu/miniexp.cpp
-+++ b/libdjvu/miniexp.cpp
-@@ -1065,7 +1065,7 @@ print_c_string(const char *s, char *d, int flags, size_t len)
-       c = (unsigned char)(*s++);
-       if (char_quoted(c, flags))
-         {
--          char buffer[10];
-+          char buffer[16]; /* 10+1 */
-           static const char *tr1 = "\"\\tnrbf";
-           static const char *tr2 = "\"\\\t\n\r\b\f";
-           buffer[0] = buffer[1] = 0;
-diff --git a/tools/csepdjvu.cpp b/tools/csepdjvu.cpp
-index 7ed13ad..fab9472 100644
---- a/tools/csepdjvu.cpp
-+++ b/tools/csepdjvu.cpp
-@@ -1834,7 +1834,7 @@ main(int argc, const char **argv)
-                 ByteStream::create(GURL::Filename::UTF8(arg),"rb");
-               BufferByteStream ibs(*fbs);
-               do {
--                char pagename[16];
-+                char pagename[20];
-                 sprintf(pagename, "p%04d.djvu", ++pageno);
-                 if (opts.verbose > 1)
-                   DjVuPrintErrorUTF8("%s","--------------------\n");

pkgs/applications/misc/font-manager/default.nix

@@ -1,20 +1,61 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, gettext, python3,
-  pkg-config, libxml2, json-glib , sqlite, itstool, yelp-tools,
-  vala, gtk3, gnome3, desktop-file-utils, wrapGAppsHook, gobject-introspection,
-  libsoup, webkitgtk
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, fetchpatch
+, ninja
+, gettext
+, python3
+, pkg-config
+, libxml2
+, json-glib
+, sqlite
+, itstool
+, yelp-tools
+, vala
+, gsettings-desktop-schemas
+, gtk3
+, gnome3
+, desktop-file-utils
+, wrapGAppsHook
+, gobject-introspection
+, libsoup
+, glib-networking
+, webkitgtk
 }:
 
 stdenv.mkDerivation rec {
   pname = "font-manager";
-  version = "0.8.5-1";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "FontManager";
     repo = "master";
     rev = version;
-    sha256 = "1p0hfnf06892hn25a6zv8fnhbh4ln11nn2fv1vjqs63rr59fprbk";
+    sha256 = "0a18rbdy9d0fj0vnsc2rm7xlh17vjqn4kdyrq0ldzlzkb6zbdk2k";
   };
 
+  patches = [
+    # Fix some Desktop Settings with GNOME 40.
+    # https://github.com/FontManager/font-manager/issues/215
+    (fetchpatch {
+      url = "https://github.com/FontManager/font-manager/commit/b28f325d7951a66ebf1a2a432ee09fd22048a033.patch";
+      sha256 = "dKbrXGb9a4JuG/4x9vprMlh5J17HKJFifRWq9BWp1ow=";
+    })
+    (fetchpatch {
+      url = "https://github.com/FontManager/font-manager/commit/2147204d4c4c6b58161230500186c3a5d4eeb1c1.patch";
+      sha256 = "2/PFLwf7h76fIIN4+lyjg/L0KVU1hhRQCfwCAGDpb00=";
+    })
+    (fetchpatch {
+      url = "https://github.com/FontManager/font-manager/commit/3abc541ef8606727c72af7631c021809600336ac.patch";
+      sha256 = "rJPnW+7uuFLxTf5tk+Rzo+xkw2+uzU6BkzPXLeR/RGc=";
+    })
+    (fetchpatch {
+      url = "https://github.com/FontManager/font-manager/commit/03a822f0d7b72442cd2ffcc8668da265d3535e0d.patch";
+      sha256 = "3Z2UqK5VV2bIwpGd1tA7fivd7ooIuV6CxTJhzgOAkIM=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     meson
@@ -34,12 +75,18 @@ stdenv.mkDerivation rec {
     libxml2
     json-glib
     sqlite
+    gsettings-desktop-schemas # for font settings
     gtk3
     gnome3.adwaita-icon-theme
     libsoup
+    glib-networking # for SSL so that Google Fonts can load
     webkitgtk
   ];
 
+  mesonFlags = [
+    "-Dreproducible=true" # Do not hardcode build directory…
+  ];
+
   postPatch = ''
     chmod +x meson_post_install.py
     patchShebangs meson_post_install.py

pkgs/applications/misc/free42/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "free42";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchFromGitHub {
     owner = "thomasokken";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dU8c+tpt+4nCWQj3P2rl6CJNtWFcXaYb3ZESg8hAllQ=";
+    sha256 = "sha256-2TOYvZBI2EW9xjbjA4Bh+TgjbyEXRzOByalLYBW8Ba8=";
   };
 
   nativeBuildInputs = [ copyDesktopItems pkg-config ];

pkgs/applications/misc/fuzzel/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fuzzel";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchzip {
     url = "https://codeberg.org/dnkl/fuzzel/archive/${version}.tar.gz";
-    sha256 = "sha256-n2eXS4NdOBgn48KOJ+0sQeNMKL7OxB8tUB99narQG0o=";
+    sha256 = "sha256-Zg9KrRf2ntg2FU6lhllt/Fd63KJak6zB7hu4ujj/9AI=";
   };
 
   nativeBuildInputs = [ pkg-config meson ninja scdoc git ];

pkgs/applications/misc/gnome-multi-writer/default.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-multi-writer";
-  version = "3.32.1";
+  version = "3.35.90";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1apdd8yi12zagf82k376a9wmdm27wzwdxpm2wf2pnwkaf786rmdw";
+    sha256 = "07vgzjjdrxcp7h73z13h9agafxb4vmqx5i81bcfyw0ilw9kkdzmp";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/gxkb/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gxkb";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "zen-tools";
     repo = "gxkb";
     rev = "v${version}";
-    sha256 = "sha256-pRVzhNoTMtiwqaxCGVImbvdRmLbZ2bst1IdMA2IKpYc=";
+    sha256 = "sha256-KIlosBNfGSYCgtxBuSVeSfHaLsANdLgG/P5UtAL6Hms=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];

pkgs/applications/misc/hello/default.nix

@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+, testVersion
+, hello
+}:
 
 stdenv.mkDerivation rec {
   pname = "hello";
@@ -11,6 +16,9 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests.version =
+    testVersion { package = hello; };
+
   meta = with lib; {
     description = "A program that produces a familiar, friendly greeting";
     longDescription = ''

pkgs/applications/misc/hugo/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.82.1";
+  version = "0.83.1";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6poWFcApwCos3XvS/Wq1VJyf5xTUWtqWNFXIhjNsXVs=";
+    sha256 = "sha256-c9T3a6J78uLumBTy/DgE4gbxCmEXVGKd9JyF9dyrL6g=";
   };
 
-  vendorSha256 = "sha256-pJBm+yyy1DbH28oVBQA+PHSDtSg3RcgbRlurrwnnEls=";
+  vendorSha256 = "sha256-ddCyMmZ5RIZWzT2RYNnSW795oR7PIRudl3QTjsXtBGk=";
 
   doCheck = false;
 

pkgs/applications/misc/kratos/default.nix

@@ -0,0 +1,42 @@
+{ fetchFromGitHub, buildGoModule, lib, stdenv }:
+
+buildGoModule rec {
+  pname = "kratos";
+  version = "0.6.0-alpha.1";
+
+  src = fetchFromGitHub {
+    owner = "ory";
+    repo = "kratos";
+    rev = "v${version}";
+    sha256 = "0lnrm7ma203b5a0vxgm9zqsbs3nigx0kng5zymrjvrzll1gd79wm";
+  };
+
+  vendorSha256 = "16qg44k97l6719hib8vbv0j15x6gvs9d6738d2y990a2qiqbsqpw";
+
+  subPackages = [ "." ];
+
+  buildFlags = [ "-tags sqlite" ];
+
+  doCheck = false;
+
+  preBuild = ''
+    # Patch shebangs
+    files=(
+       test/e2e/run.sh
+       script/testenv.sh
+       script/test-envs.sh
+       persistence/sql/migratest/update_fixtures.sh
+    )
+    patchShebangs "''${files[@]}"
+
+    # patchShebangs doesn't work for this Makefile, do it manually
+    substituteInPlace Makefile --replace '/bin/bash' '${stdenv.shell}'
+  '';
+
+  meta = with lib; {
+    maintainers = with maintainers; [ mrmebelman ];
+    homepage = "https://www.ory.sh/kratos/";
+    license = licenses.asl20;
+    description = "An API-first Identity and User Management system that is built according to cloud architecture best practices";
+  };
+}

pkgs/applications/misc/moonlight-embedded/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, perl
 , alsaLib, libevdev, libopus, udev, SDL2
-, ffmpeg_3, pkg-config, xorg, libvdpau, libpulseaudio, libcec
+, ffmpeg, pkg-config, xorg, libvdpau, libpulseaudio, libcec
 , curl, expat, avahi, enet, libuuid, libva
 }:
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [
     alsaLib libevdev libopus udev SDL2
-    ffmpeg_3 pkg-config xorg.libxcb libvdpau libpulseaudio libcec
+    ffmpeg pkg-config xorg.libxcb libvdpau libpulseaudio libcec
     xorg.libpthreadstubs curl expat avahi enet libuuid libva
   ];
 

pkgs/applications/misc/orca/default.nix

@@ -35,13 +35,13 @@
 
 buildPythonApplication rec {
   pname = "orca";
-  version = "3.38.2";
+  version = "40.0";
 
   format = "other";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "UAX/LhHdH3E/WswZA6JwEZvFjDD9uMn4K8rHFJfGwjw=";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
+    sha256 = "0hq0zdcn80ficpcffbk667907v6m7dih3dhyc7ss01mrj3iyw000";
   };
 
   patches = [

pkgs/applications/misc/orca/fix-paths.patch

@@ -1,6 +1,8 @@
+diff --git a/src/orca/debug.py b/src/orca/debug.py
+index e79482ed4..cbf3a24ec 100644
 --- a/src/orca/debug.py
 +++ b/src/orca/debug.py
-@@ -474,7 +474,7 @@
+@@ -502,7 +502,7 @@ def traceit(frame, event, arg):
      return traceit
  
  def getOpenFDCount(pid):
@@ -9,7 +11,7 @@
      procs = procs.decode('UTF-8').split('\n')
      files = list(filter(lambda s: s and s[0] == 'f' and s[1:].isdigit(), procs))
  
-@@ -482,7 +482,7 @@
+@@ -510,7 +510,7 @@ def getOpenFDCount(pid):
  
  def getCmdline(pid):
      try:
@@ -18,7 +20,7 @@
          cmdline = openFile.read()
          openFile.close()
      except:
-@@ -492,7 +492,7 @@
+@@ -520,7 +520,7 @@ def getCmdline(pid):
      return cmdline
  
  def pidOf(procName):
@@ -27,9 +29,11 @@
                                  shell=True,
                                  stdout=subprocess.PIPE).stdout
      pids = openFile.read()
+diff --git a/src/orca/orca.py b/src/orca/orca.py
+index 2fe0a0bf2..087526556 100644
 --- a/src/orca/orca.py
 +++ b/src/orca/orca.py
-@@ -239,7 +239,7 @@
+@@ -285,7 +285,7 @@ def updateKeyMap(keyboardEvent):
  
  def _setXmodmap(xkbmap):
      """Set the keyboard map using xkbcomp."""
@@ -38,7 +42,7 @@
          stdin=subprocess.PIPE, stdout=None, stderr=None)
      p.communicate(xkbmap)
  
-@@ -297,7 +297,7 @@
+@@ -363,7 +363,7 @@ def _storeXmodmap(keyList):
      """
  
      global _originalXmodmap
@@ -47,7 +51,7 @@
  
  def _restoreXmodmap(keyList=[]):
      """Restore the original xmodmap values for the keys in keyList.
-@@ -309,7 +309,7 @@
+@@ -375,7 +375,7 @@ def _restoreXmodmap(keyList=[]):
  
      global _capsLockCleared
      _capsLockCleared = False
@@ -56,9 +60,11 @@
          stdin=subprocess.PIPE, stdout=None, stderr=None)
      p.communicate(_originalXmodmap)
  
+diff --git a/src/orca/orca_bin.py.in b/src/orca/orca_bin.py.in
+index 8c9d40153..eec0d5437 100644
 --- a/src/orca/orca_bin.py.in
 +++ b/src/orca/orca_bin.py.in
-@@ -59,7 +59,7 @@
+@@ -62,7 +62,7 @@ class ListApps(argparse.Action):
                  name = "[DEAD]"
  
              try:
@@ -67,12 +73,12 @@
              except:
                  cmdline = '(exception encountered)'
              else:
-@@ -192,7 +192,7 @@
+@@ -197,7 +197,7 @@ def inGraphicalDesktop():
  def otherOrcas():
      """Returns the pid of any other instances of Orca owned by this user."""
  
--    openFile = subprocess.Popen('pgrep -u %s orca' % os.getuid(),
-+    openFile = subprocess.Popen('@pgrep@ -u %s orca' % os.getuid(),
+-    openFile = subprocess.Popen('pgrep -u %s -x orca' % os.getuid(),
++    openFile = subprocess.Popen('@pgrep@ -u %s -x orca' % os.getuid(),
                                  shell=True,
                                  stdout=subprocess.PIPE).stdout
      pids = openFile.read()

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "91.0.4472.27",
-    "sha256": "09mhrzfza9a2zfsnxskbdbk9cwxnswgprhnyv3pj0f215cva20sq",
-    "sha256bin64": "1iwjf993pmhm9r92h4hskfxqc9fhky3aabvmdsqys44251j3hvwg",
+    "version": "91.0.4472.38",
+    "sha256": "13kikqyxs7p25j7mxnr42614y92vmwsjqfd51dwdjh7wc2hb644a",
+    "sha256bin64": "1kjawp7q6r1r50h69jwrw84gqrya1jc8bq6x7bdplxlzgvy9qs3z",
     "deps": {
       "gn": {
         "version": "2021-04-06",
@@ -31,15 +31,15 @@
     }
   },
   "dev": {
-    "version": "92.0.4491.6",
-    "sha256": "0dwmcqzr7ysy7555l5amzppz8rxgxbgf6fy8lq4ykn2abx4m8n8a",
-    "sha256bin64": "041j6nm49w03qadwlsav50avdp6pwf1a8asybgvkjaxy4fpck376",
+    "version": "92.0.4496.0",
+    "sha256": "1kk1bybl6nx3z80agyljsvdb7yi3nna14aag71xhv4n6pygqfgdi",
+    "sha256bin64": "0b12ab20g5vay9x8j1zpj9zapdmm3him7rrm15jvsdakn60czdpr",
     "deps": {
       "gn": {
-        "version": "2021-04-06",
+        "version": "2021-04-29",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "dba01723a441c358d843a575cb7720d54ddcdf92",
-        "sha256": "199xkks67qrn0xa5fhp24waq2vk8qb78a96cb3kdd8v1hgacgb8x"
+        "rev": "6771ce569fb4803dad7a427aa2e2c23e960b917e",
+        "sha256": "0lv1zs38qr862hwxrd3g6wz3l6v8j6p7b60nxyc5fhiglqxqz0im"
       }
     }
   },

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "88.0";
+    ffversion = "88.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "f58f44f2f0d0f54eae5ab4fa439205feb8b9209b1bf2ea2ae0c9691e9e583bae2cbd4033edb5bdf4e37eda5b95fca688499bed000fe26ced8ff4bbc49347ce31";
+      sha512 = "e2d7fc950ba49f225c83ee1d799d6318fcf16c33a3b7f40b85c49d5b7865f7e632c703e5fd227a303b56e2565d0796283ebb12d7fd1a02781dcaa45e84cea934";
     };
 
     meta = {
@@ -32,10 +32,10 @@ rec {
 
   firefox-esr-78 = common rec {
     pname = "firefox-esr";
-    ffversion = "78.10.0esr";
+    ffversion = "78.10.1esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "5e2cf137dc781855542c29df6152fa74ba749801640ade3cf01487ce993786b87a4f603d25c0af9323e67c7e15c75655523428c1c1426527b8623c7ded9f5946";
+      sha512 = "a22773d9b3f0dca253805257f358a906769d23f15115e3a8851024f701e27dee45f056f7d34ebf1fcde0a3f91ec299639c2a12556e938a232cdea9e59835fde1";
     };
 
     meta = {

pkgs/applications/networking/browsers/opera/default.nix

@@ -30,6 +30,7 @@
 , libnotify
 , libpulseaudio
 , libuuid
+, libxshmfence
 , mesa
 , nspr
 , nss
@@ -49,11 +50,11 @@ let
 in stdenv.mkDerivation rec {
 
   pname = "opera";
-  version = "68.0.3618.63";
+  version = "76.0.4017.94";
 
   src = fetchurl {
     url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    sha256 = "1643043ywz94x2yr7xyw7krfq53iwkr8qxlbydzq6zb2zina7jxd";
+    sha256 = "sha256-vjSfzkl1jIQ9P1ARDa0eOuD8CmKHIEZ+IwMB2wIVjE8=";
   };
 
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
@@ -94,6 +95,7 @@ in stdenv.mkDerivation rec {
     libnotify
     libuuid
     libxcb
+    libxshmfence
     mesa
     nspr
     nss

pkgs/applications/networking/browsers/vieb/default.nix

@@ -2,13 +2,13 @@
 
 mkYarnPackage rec {
   pname = "vieb";
-  version = "3.4.0";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "jelmerro";
     repo = pname;
     rev = version;
-    sha256 = "0h5yzmvs9zhhpg9l7rrgwd4rqd9n00n2ifwqf05kpymzliy6xsnk";
+    sha256 = "sha256-7/oB2Inj+iMXzigqbCNJUY7dNrFBals2BOOl+Lp+ESs=";
   };
 
   packageJSON = ./package.json;
@@ -51,8 +51,8 @@ mkYarnPackage rec {
   meta = with lib; {
     homepage = "https://vieb.dev/";
     description = "Vim Inspired Electron Browser";
-    maintainers = with maintainers; [ gebner ];
+    maintainers = with maintainers; [ gebner fortuneteller2k ];
     platforms = platforms.unix;
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
   };
 }

pkgs/applications/networking/browsers/vieb/package.json

@@ -1,11 +1,13 @@
 {
   "name": "vieb",
   "productName": "Vieb",
-  "version": "3.4.0",
+  "version": "4.5.1",
   "description": "Vim Inspired Electron Browser",
+  "bin": "app.js",
   "main": "app/index.js",
   "scripts": {
-    "test": "jest -u && eslint .",
+    "test": "jest --coverage --collectCoverageFrom 'app/**/*.js' -u && eslint app && echo 'All good :)'",
+    "dev": "electron app --datafolder ./ViebData/",
     "start": "electron app",
     "build": "node build.js",
     "buildall": "node build.js --linux --win --mac",
@@ -16,24 +18,29 @@
   "repository": "https://github.com/Jelmerro/Vieb",
   "homepage": "https://vieb.dev",
   "keywords": [
+    "Vim",
     "Electron",
     "Browser",
     "Internet"
   ],
   "author": "Jelmer van Arnhem",
   "email": "Jelmerro@users.noreply.github.com",
-  "license": "GPL-3.0+",
+  "license": "GPL-3.0-or-later",
   "devDependencies": {
-    "archiver": "^5.2.0",
-    "electron": "^11.2.1",
-    "electron-builder": "^22.10.4",
-    "eslint": "^7.19.0",
-    "jest": "^26.6.3"
+    "archiver": "5.3.0",
+    "electron": "12.0.5",
+    "electron-builder": "22.10.5",
+    "eslint": "7.25.0",
+    "eslint-plugin-compat": "^3.9.0",
+    "jest": "26.6.3"
   },
   "dependencies": {
-    "@cliqz/adblocker-electron": "^1.20.0",
-    "darkreader": "^4.9.27",
-    "is-svg": "^4.2.1",
-    "rimraf": "^3.0.2"
-  }
+    "7zip-bin": "5.1.1",
+    "@cliqz/adblocker-electron": "1.20.4",
+    "is-svg": "4.3.1",
+    "rimraf": "3.0.2"
+  },
+  "browserslist": [
+    "last 2 Chrome versions"
+  ]
 }

pkgs/applications/networking/calls/default.nix

@@ -17,6 +17,7 @@
 , desktop-file-utils
 , appstream-glib
 , libpeas
+, libgdata
 , dbus
 , vala
 , wrapGAppsHook
@@ -65,6 +66,7 @@ stdenv.mkDerivation rec {
     callaudiod
     gtk3
     libpeas
+    libgdata # required by some dependency transitively
   ];
 
   checkInputs = [

pkgs/applications/networking/cluster/kubecfg/default.nix

@@ -1,6 +1,6 @@
 { lib, buildGoPackage, fetchFromGitHub, ... }:
 
-let version = "0.18.0"; in
+let version = "0.19.0"; in
 
 buildGoPackage {
   pname = "kubecfg";
@@ -10,7 +10,7 @@ buildGoPackage {
     owner = "bitnami";
     repo = "kubecfg";
     rev = "v${version}";
-    sha256 = "sha256-TJbuJZDj9ZwEaN8LV/M30+5+IgN8EZCTTBBDB0OgdEE=";
+    sha256 = "sha256-G3yLpo/6hv6t3i6b/KMgoZqltyGDddg/SsNPF8hNeUg=";
   };
 
   goPackagePath = "github.com/bitnami/kubecfg";

pkgs/applications/networking/cluster/lens/default.nix

@@ -2,12 +2,12 @@
 
 let
   pname = "lens";
-  version = "4.2.0";
+  version = "4.2.4";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/lensapp/lens/releases/download/v${version}/Lens-${version}.x86_64.AppImage";
-    sha256 = "0g60d1h2dn41qdzdnqavwknqynjqil7s8kcqy01h021r81rdpn2q";
+    sha256 = "0fzhv8brwwl1ihx6jqq4pi77489hr6f9hpppqq3n8d2imjsqgvlw";
     name="${pname}.AppImage";
   };
 

pkgs/applications/networking/cluster/nerdctl/default.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "nerdctl";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-It/p2Hk4/fkYgHTPynf7p7zs4ajjo0Fv3yTzhrWUusE=";
+    sha256 = "sha256-Lu1LJ57jF4lMIfQn/zyT2cc/mkc3RPPlu4gI7qv8blI=";
   };
 
-  vendorSha256 = "sha256-Vg6SHyQkeUvd2hT0JV32y+F0t/qb81MrgOFcr785a8M=";
+  vendorSha256 = "sha256-fEzA/+iKye8lzH4JoXLPqnwjrXPPNuL8gPPbkYJ1glw=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 

pkgs/applications/networking/cluster/terraform/default.nix

@@ -164,9 +164,9 @@ in rec {
   });
 
   terraform_0_15 = pluggable (generic {
-    version = "0.15.1";
-    sha256 = "02bqg05wsqld9xybvg7swvmympq5bggkw8vcq91z6vkpawm8z3kg";
-    vendorSha256 = "1lnz6b2kjilidvs4flx9vj5j6dxliqdxni96fn2537nqaz4hc7l2";
+    version = "0.15.3";
+    sha256 = "12dny8f89ry75ljarhdqlwgzv6py75s1wcmb62n5fp9nk03bjf2p";
+    vendorSha256 = "13ap1arn81lcxry08j42ck6lgvdcvdxgah6d40pmpkzkw9jcf55b";
     patches = [ ./provider-path-0_15.patch ];
     passthru = { inherit plugins; };
   });

pkgs/applications/networking/gopher/sacc/default.nix

@@ -15,6 +15,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
 
+  CFLAGS = lib.optionals stdenv.isDarwin [
+    "-D_DARWIN_C_SOURCE"
+  ];
+
   postPatch = ''
     substituteInPlace config.mk \
       --replace curses ncurses \

pkgs/applications/networking/instant-messengers/gajim/default.nix

@@ -20,11 +20,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "1.2.2";
+  version = "1.3.2";
 
   src = fetchurl {
     url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    sha256 = "1gfcp3b5nq43xxz5my8vfhfxnnli726j3hzcgwh9fzrzzd9ic3gx";
+    sha256 = "1vjzv8zg9s393xw81klcgbkn4h6j2blzla9iil5kqfrw7wmldskh";
   };
 
   buildInputs = [
@@ -55,6 +55,9 @@ python3.pkgs.buildPythonApplication rec {
   checkInputs = [ xvfb_run dbus.daemon ];
 
   checkPhase = ''
+    # https://dev.gajim.org/gajim/gajim/-/issues/10478
+    rm test/lib/gajim_mocks.py test/unit/test_gui_interface.py
+
     xvfb-run dbus-run-session \
       --config-file=${dbus.daemon}/share/dbus-1/session.conf \
       ${python3.interpreter} setup.py test

pkgs/applications/networking/instant-messengers/kdeltachat/default.nix

@@ -0,0 +1,41 @@
+{ lib
+, mkDerivation
+, fetchFromSourcehut
+, cmake
+, extra-cmake-modules
+, pkg-config
+, kirigami2
+, libdeltachat
+, qtmultimedia
+}:
+
+mkDerivation rec {
+  pname = "kdeltachat";
+  version = "unstable-2021-05-03";
+
+  src = fetchFromSourcehut {
+    owner = "~link2xt";
+    repo = "kdeltachat";
+    rev = "dd7455764074c0864234a6a25ab6f87e8d5c3121";
+    sha256 = "1vsy2jcisvf9mndxlwif3ghv1n2gz5ycr1qh72kgski38qan621v";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    pkg-config
+  ];
+
+  buildInputs = [
+    kirigami2
+    libdeltachat
+    qtmultimedia
+  ];
+
+  meta = with lib; {
+    description = "Delta Chat client using Kirigami framework";
+    homepage = "https://git.sr.ht/~link2xt/kdeltachat";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

pkgs/applications/networking/instant-messengers/pidgin-plugins/sipe/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pidgin, intltool, libxml2, gmime, nss }:
+{ lib, stdenv, fetchurl, fetchpatch, pidgin, intltool, libxml2, gmime, nss }:
 
 stdenv.mkDerivation rec {
   pname = "pidgin-sipe";
@@ -9,6 +9,20 @@ stdenv.mkDerivation rec {
     sha256 = "0262sz00iqxylx0xfyr48xikhiqzr8pg7b4b7vwj5iv4qxpxv939";
   };
 
+  patches = [
+    # add sipe_utils_memdup() function
+    (fetchpatch {
+      url = "https://repo.or.cz/siplcs.git/patch/567d0ddc0692adfef5f15d0d383825a9b2ea4b49";
+      sha256 = "24L8ZfoOGc3JoTCGxuTNjuHzt5QgFDu1+vSoJpGvde4=";
+    })
+    # replace g_memdup() with sipe_utils_memdup()
+    # g_memdup is deprecatein newer Glib
+    (fetchpatch {
+      url = "https://repo.or.cz/siplcs.git/patch/583a734e63833f03d11798b7b0d59a17d08ae60f";
+      sha256 = "Ai6Czpy/FYvBi4GZR7yzch6OcouJgfreI9HcojhGVV4=";
+    })
+  ];
+
   nativeBuildInputs = [ intltool ];
   buildInputs = [ pidgin gmime libxml2 nss ];
   enableParallelBuilding = true;

pkgs/applications/networking/instant-messengers/pidgin/default.nix

@@ -76,8 +76,11 @@ let unwrapped = stdenv.mkDerivation rec {
 
   doInstallCheck = stdenv.hostPlatform == stdenv.buildPlatform;
   # In particular, this detects missing python imports in some of the tools.
-  postInstallCheck = ''
-    for f in "''${!outputBin}"/bin/{purple-remote,pidgin}; do
+  postFixup = let
+    # TODO: python is a script, so it doesn't work as interpreter on darwin
+    binsToTest = lib.optionalString stdenv.isLinux "purple-remote," + "pidgin,finch";
+  in lib.optionalString doInstallCheck ''
+    for f in "''${!outputBin}"/bin/{${binsToTest}}; do
       echo "Testing: $f --help"
       "$f" --help
     done

pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.38.3";
+  version = "3.40.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1s2jpviliazmhnpkh8dc57ga3c3612f2rnc0nfya5ndbi6lpzxhi";
+    sha256 = "1kgxdacqqcq8yfkij6vyqlk5r4yqvw7gh7mxqii670hrn1mb2s50";
   };
 
   nativeBuildInputs = [ cmake gettext intltool pkg-config ];
@@ -19,23 +19,17 @@ stdenv.mkDerivation rec {
     libmspack
   ];
 
-  # Building with libmspack as reccommended: https://wiki.gnome.org/Apps/Evolution/Building#Build_evolution-ews
   cmakeFlags = [
+    # Building with libmspack as recommended: https://wiki.gnome.org/Apps/Evolution/Building#Build_evolution-ews
     "-DWITH_MSPACK=ON"
+    # don't try to install into ${evolution}
+    "-DFORCE_INSTALL_PREFIX=ON"
   ];
 
-  PKG_CONFIG_EVOLUTION_SHELL_3_0_ERRORDIR = "${placeholder "out"}/share/evolution/errors";
-  PKG_CONFIG_EVOLUTION_SHELL_3_0_PRIVLIBDIR = "${placeholder "out"}/lib/evolution";
-  PKG_CONFIG_CAMEL_1_2_CAMEL_PROVIDERDIR = "${placeholder "out"}/lib/evolution-data-server/camel-providers";
-  PKG_CONFIG_LIBEDATA_BOOK_1_2_BACKENDDIR = "${placeholder "out"}/lib/evolution-data-server/addressbook-backends";
-  PKG_CONFIG_LIBEDATA_CAL_2_0_BACKENDDIR = "${placeholder "out"}/lib/evolution-data-server/calendar-backends";
-  PKG_CONFIG_LIBEBACKEND_1_2_MODULEDIR = "${placeholder "out"}/lib/evolution-data-server/registry-modules";
-  PKG_CONFIG_EVOLUTION_SHELL_3_0_MODULEDIR = "${placeholder "out"}/lib/evolution/modules";
-  PKG_CONFIG_EVOLUTION_DATA_SERVER_1_2_PRIVDATADIR = "${placeholder "out"}/share/evolution-data-server";
-
    passthru = {
     updateScript = gnome3.updateScript {
       packageName = "evolution-ews";
+      versionPolicy = "odd-unstable";
     };
   };
 

pkgs/applications/networking/mailreaders/evolution/evolution/default.nix

@@ -42,11 +42,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.38.4";
+  version = "3.40.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "NB+S0k4rRMJ4mwA38aiU/xZUh9qksAuA+uMTii4Fr9Q=";
+    sha256 = "07n4sbgsh0y9hrn52ymvy45ah65ll55gglgvqqi3h9nhkyy64y9g";
   };
 
   nativeBuildInputs = [
@@ -114,13 +114,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  patches = [
-    ./moduledir_from_env.patch
-  ];
-
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = "evolution";
+      versionPolicy = "odd-unstable";
     };
   };
 

pkgs/applications/networking/mailreaders/evolution/evolution/moduledir_from_env.patch

@@ -1,21 +0,0 @@
-diff --git a/src/shell/main.c b/src/shell/main.c
-index 5d089225ca..030908d684 100644
---- a/src/shell/main.c
-+++ b/src/shell/main.c
-@@ -407,7 +407,15 @@ create_default_shell (void)
- 	}
-
- 	/* Load all shared library modules. */
--	module_types = e_module_load_all_in_directory (EVOLUTION_MODULEDIR);
-+	const gchar *modules_directory = EVOLUTION_MODULEDIR;
-+	const gchar *modules_directory_env;
-+
-+	modules_directory_env = g_getenv ("EVOLUTION_MODULEDIR");
-+	if (modules_directory_env &&
-+	    g_file_test (modules_directory_env, G_FILE_TEST_IS_DIR))
-+		modules_directory = g_strdup (modules_directory_env);
-+
-+	module_types = e_module_load_all_in_directory (modules_directory);
- 	g_list_free_full (module_types, (GDestroyNotify) g_type_module_unuse);
-
- 	flags = G_APPLICATION_HANDLES_OPEN |

pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix

@@ -10,13 +10,7 @@ symlinkJoin {
     for i in $out/bin/* $out/libexec/**; do
     if [ ! -d $i ]; then
       echo wrapping $i
-      wrapProgram $i \
-        --set LD_LIBRARY_PATH "$out/lib" \
-        --set EDS_ADDRESS_BOOK_MODULES "$out/lib/evolution-data-server/addressbook-backends/" \
-        --set EDS_CALENDAR_MODULES "$out/lib/evolution-data-server/calendar-backends/" \
-        --set EDS_CAMEL_PROVIDER_DIR "$out/lib/evolution-data-server/camel-providers/" \
-        --set EDS_REGISTRY_MODULES "$out/lib/evolution-data-server/registry-modules/" \
-        --set EVOLUTION_MODULEDIR "$out/lib/evolution/modules"
+      wrapProgram $i --set EDS_EXTRA_PREFIXES "${lib.concatStringsSep ":" plugins}"
     fi
     done
 

pkgs/applications/networking/mailreaders/himalaya/default.nix

@@ -11,16 +11,20 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "himalaya";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "soywod";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-s2QZSusJLeo4WIorSj+e1yYqWXFqTt8YF6/Tyz9fHeY=";
+    sha256 = "sha256:0m95gjdzh94vsbs7cdxlczk29m536acwlg4y55j7rz9cdcjfvzkj";
   };
 
-  cargoSha256 = "sha256-u9dLqr5CnrgYiDWAiW9u1zcUWmprOiq5+TfafO8M+WU=";
+  cargoSha256 = "sha256:0bz91vs5i3qb8rd9yfajavb4lyp24cxmxalzkg2chii4ckr8d3ph";
+
+  # use --lib flag to avoid test with imap server
+  # https://github.com/soywod/himalaya/issues/145
+  cargoTestFlags = [ "--lib" ];
 
   nativeBuildInputs = [ ]
     ++ lib.optionals (enableCompletions) [ installShellFiles ]

pkgs/applications/networking/mailreaders/mutt/default.nix

@@ -27,11 +27,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "2.0.6";
+  version = "2.0.7";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "165mpivdhvhavglykwlz0hss2akxd6i6l40rgxs29mjzi52irqw1";
+    sha256 = "sha256-lXaIxqUhVhmS1PLyfPn+sjnHxsAELGBhwOR0p90mzJE=";
   };
 
   patches = optional smimeSupport (fetchpatch {