Merge master into haskell-updates

2024-11-25 00:12:56 +00:00 · 2022-02-03 00:09:15 +00:00 · 2022-02-03 00:09:15 +00:00 · 2dfb8125f9
commit 2dfb8125f9
parent fa2bec27de bd05c3d04b
195 changed files with 3379 additions and 2419 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -13620,10 +13620,10 @@
    github = "nagisa";
    githubId = 679122;
  };
-  yevhenshymotiuk = {
+  yshym = {
    name = "Yevhen Shymotiuk";
-    email = "yevhenshymotiuk@gmail.com";
-    github = "yevhenshymotiuk";
+    email = "yshym@pm.me";
+    github = "yshym";
    githubId = 44244245;
  };
  hmenke = {
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@ -543,11 +543,11 @@ class Machine:

        Should only be used during test development, not in the production test."""
        self.connect()
-        self.log("Terminal is ready (there is no prompt):")
+        self.log("Terminal is ready (there is no initial prompt):")

        assert self.shell
        subprocess.run(
-            ["socat", "READLINE", f"FD:{self.shell.fileno()}"],
+            ["socat", "READLINE,prompt=$ ", f"FD:{self.shell.fileno()}"],
            pass_fds=[self.shell.fileno()],
        )

--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -178,11 +178,6 @@ in
      igpuBusId = if pCfg.intelBusId != "" then pCfg.intelBusId else pCfg.amdgpuBusId;
  in mkIf enabled {
    assertions = [
-      {
-        assertion = with config.services.xserver.displayManager; (gdm.enable && gdm.nvidiaWayland) -> cfg.modesetting.enable;
-        message = "You cannot use wayland with GDM without modesetting enabled for NVIDIA drivers, set `hardware.nvidia.modesetting.enable = true`";
-      }
-
      {
        assertion = primeEnabled -> pCfg.intelBusId == "" || pCfg.amdgpuBusId == "";
        message = ''
--- a/nixos/modules/programs/dconf.nix
+++ b/nixos/modules/programs/dconf.nix
@ -60,7 +60,7 @@ in
    environment.systemPackages = [ pkgs.dconf ];

    # Needed for unwrapped applications
-    environment.variables.GIO_EXTRA_MODULES = mkIf cfg.enable [ "${pkgs.dconf.lib}/lib/gio/modules" ];
+    environment.sessionVariables.GIO_EXTRA_MODULES = mkIf cfg.enable [ "${pkgs.dconf.lib}/lib/gio/modules" ];
  };

 }
--- a/nixos/modules/services/computing/slurm/slurm.nix
+++ b/nixos/modules/services/computing/slurm/slurm.nix
@ -362,6 +362,7 @@ in

      wantedBy = [ "multi-user.target" ];
      after = [ "systemd-tmpfiles-clean.service" ];
+      requires = [ "network.target" ];

      serviceConfig = {
        Type = "forking";
@ -371,12 +372,12 @@ in
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        LimitMEMLOCK = "infinity";
      };
-
-      preStart = ''
-        mkdir -p /var/spool
-      '';
    };

+    systemd.tmpfiles.rules = mkIf cfg.client.enable [
+      "d /var/spool/slurmd 755 root root -"
+    ];
+
    services.openssh.forwardX11 = mkIf cfg.client.enable (mkDefault true);

    systemd.services.slurmctld = mkIf (cfg.server.enable) {
--- a/nixos/modules/services/desktops/gnome/glib-networking.nix
+++ b/nixos/modules/services/desktops/gnome/glib-networking.nix
@ -38,7 +38,7 @@ with lib;

    systemd.packages = [ pkgs.glib-networking ];

-    environment.variables.GIO_EXTRA_MODULES = [ "${pkgs.glib-networking.out}/lib/gio/modules" ];
+    environment.sessionVariables.GIO_EXTRA_MODULES = [ "${pkgs.glib-networking.out}/lib/gio/modules" ];

  };

--- a/nixos/modules/services/desktops/gvfs.nix
+++ b/nixos/modules/services/desktops/gvfs.nix
@ -57,7 +57,7 @@ in
    services.udev.packages = [ pkgs.libmtp.out ];

    # Needed for unwrapped applications
-    environment.variables.GIO_EXTRA_MODULES = [ "${cfg.package}/lib/gio/modules" ];
+    environment.sessionVariables.GIO_EXTRA_MODULES = [ "${cfg.package}/lib/gio/modules" ];

  };

--- a/nixos/modules/services/misc/mediatomb.nix
+++ b/nixos/modules/services/misc/mediatomb.nix
@ -217,7 +217,6 @@ in {

      package = mkOption {
        type = types.package;
-        example = literalExpression "pkgs.mediatomb";
        default = pkgs.gerbera;
        defaultText = literalExpression "pkgs.gerbera";
        description = ''
--- a/nixos/modules/services/web-apps/bookstack.nix
+++ b/nixos/modules/services/web-apps/bookstack.nix
@ -385,13 +385,13 @@ in {
                else if isString v then v
                else if true  == v then "true"
                else if false == v then "false"
-                else if isSecret v then v._secret
+                else if isSecret v then hashString "sha256" v._secret
                else throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty {}) v}";
            };
          };
          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.config);
          mkSecretReplacement = file: ''
-            replace-secret ${escapeShellArgs [ file file "${cfg.dataDir}/.env" ]}
+            replace-secret ${escapeShellArgs [ (builtins.hashString "sha256" file) file "${cfg.dataDir}/.env" ]}
          '';
          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
          filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! elem v [ {} null ])) cfg.config;
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -53,6 +53,8 @@ in
      "autoLogin"
      "user"
    ])
+
+    (mkRemovedOptionModule [ "services" "xserver" "displayManager" "gdm" "nvidiaWayland" ] "We defer to GDM whether Wayland should be enabled.")
  ];

  meta = {
@ -83,17 +85,6 @@ in
        default = true;
        description = ''
          Allow GDM to run on Wayland instead of Xserver.
-          Note to enable Wayland with Nvidia the <option>nvidiaWayland</option>
-          must not be disabled.
-        '';
-      };
-
-      nvidiaWayland = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Whether to allow wayland to be used with the proprietary
-          NVidia graphics driver.
        '';
      };

@ -149,7 +140,8 @@ in
        environment = {
          GDM_X_SERVER_EXTRA_ARGS = toString
            (filter (arg: arg != "-terminate") cfg.xserverArgs);
-          XDG_DATA_DIRS = "${cfg.sessionData.desktops}/share/";
+          # GDM is needed for gnome-login.session
+          XDG_DATA_DIRS = "${gdm}/share:${cfg.sessionData.desktops}/share";
        } // optionalAttrs (xSessionWrapper != null) {
          # Make GDM use this wrapper before running the session, which runs the
          # configured setupCommands. This relies on a patched GDM which supports
@ -230,19 +222,6 @@ in

    services.dbus.packages = [ gdm ];

-    # We duplicate upstream's udev rules manually to make wayland with nvidia configurable
-    services.udev.extraRules = ''
-      # disable Wayland on Cirrus chipsets
-      ATTR{vendor}=="0x1013", ATTR{device}=="0x00b8", ATTR{subsystem_vendor}=="0x1af4", ATTR{subsystem_device}=="0x1100", RUN+="${gdm}/libexec/gdm-runtime-config set daemon WaylandEnable false"
-      # disable Wayland on Hi1710 chipsets
-      ATTR{vendor}=="0x19e5", ATTR{device}=="0x1711", RUN+="${gdm}/libexec/gdm-runtime-config set daemon WaylandEnable false"
-      ${optionalString (!cfg.gdm.nvidiaWayland) ''
-        DRIVER=="nvidia", RUN+="${gdm}/libexec/gdm-runtime-config set daemon WaylandEnable false"
-      ''}
-      # disable Wayland when modesetting is disabled
-      IMPORT{cmdline}="nomodeset", RUN+="${gdm}/libexec/gdm-runtime-config set daemon WaylandEnable false"
-    '';
-
    systemd.user.services.dbus.wantedBy = [ "default.target" ];

    programs.dconf.profiles.gdm =
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@ -109,6 +109,10 @@ in
      # Allow very slow start
      DefaultTimeoutStartSec=300
    '';
+    systemd.user.extraConfig = ''
+      # Allow very slow start
+      DefaultTimeoutStartSec=300
+    '';

    boot.consoleLogLevel = 7;

--- a/nixos/tests/unifi.nix
+++ b/nixos/tests/unifi.nix
@ -12,7 +12,7 @@ let
  makeAppTest = unifi: makeTest {
    name = "unifi-controller-${unifi.version}";
    meta = with pkgs.lib.maintainers; {
-      maintainers = [ zhaofengli ];
+      maintainers = [ patryk27 zhaofengli ];
    };

    nodes.server = {
@ -32,4 +32,5 @@ in with pkgs; {
  unifiLTS = makeAppTest unifiLTS;
  unifi5 = makeAppTest unifi5;
  unifi6 = makeAppTest unifi6;
+  unifi7 = makeAppTest unifi7;
 }
--- a/pkgs/applications/audio/munt/default.nix
+++ b/pkgs/applications/audio/munt/default.nix
@ -1,52 +0,0 @@
-{ lib
-, stdenv
-, mkDerivation
-, fetchFromGitHub
-, alsa-lib
-, cmake
-, glib
-, pkg-config
-, qtbase
-, withJack ? stdenv.hostPlatform.isUnix, jack
-}:
-
-mkDerivation rec {
-  pname = "munt";
-  version = "2.5.3";
-
-  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "libmt32emu_${lib.replaceChars [ "." ] [ "_" ] version}";
-    hash = "sha256-n5VV5Swh1tOVQGT3urEKl64A/w7cY95/0y5wC5ZuLm4=";
-  };
-
-  dontFixCmake = true;
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
-
-  buildInputs = [
-    glib
-    qtbase
-  ]
-  ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
-  ++ lib.optional withJack jack;
-
-  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir $out/Applications
-    mv $out/bin/${meta.mainProgram}.app $out/Applications/
-    ln -s $out/{Applications/${meta.mainProgram}.app/Contents/MacOS,bin}/${meta.mainProgram}
-  '';
-
-  meta = with lib; {
-    homepage = "http://munt.sourceforge.net/";
-    description = "An emulator of Roland MT-32, CM-32L, CM-64 and LAPC-I devices";
-    license = with licenses; [ lgpl21 gpl3 ];
-    maintainers = with maintainers; [ OPNA2608 ];
-    platforms = platforms.all;
-    mainProgram = "mt32emu-qt";
-  };
-}
--- a/pkgs/applications/audio/munt/libmt32emu.nix
+++ b/pkgs/applications/audio/munt/libmt32emu.nix
@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libmt32emu";
+  version = "2.5.3";
+
+  src = fetchFromGitHub {
+    owner = "munt";
+    repo = "munt";
+    rev = "${pname}_${lib.replaceChars [ "." ] [ "_" ] version}";
+    hash = "sha256-n5VV5Swh1tOVQGT3urEKl64A/w7cY95/0y5wC5ZuLm4=";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  dontFixCmake = true;
+
+  cmakeFlags = [
+    "-Dmunt_WITH_MT32EMU_SMF2WAV=OFF"
+    "-Dmunt_WITH_MT32EMU_QT=OFF"
+  ];
+
+  meta = with lib; {
+    homepage = "http://munt.sourceforge.net/";
+    description = "A library to emulate Roland MT-32, CM-32L, CM-64 and LAPC-I devices";
+    license = with licenses; [ lgpl21Plus ];
+    maintainers = with maintainers; [ OPNA2608 ];
+    platforms = platforms.unix; # Not tested on ReactOS yet :)
+  };
+}
--- a/pkgs/applications/audio/munt/mt32emu-qt.nix
+++ b/pkgs/applications/audio/munt/mt32emu-qt.nix
@ -0,0 +1,75 @@
+{ lib
+, stdenv
+, mkDerivation
+, fetchFromGitHub
+, alsa-lib
+, cmake
+, libpulseaudio
+, libmt32emu
+, pkg-config
+, portaudio
+, qtbase
+, qtmultimedia
+, withJack ? stdenv.hostPlatform.isUnix, libjack2
+}:
+
+mkDerivation rec {
+  pname = "mt32emu-qt";
+  version = "1.9.0";
+
+  src = fetchFromGitHub {
+    owner = "munt";
+    repo = "munt";
+    rev = "mt32emu_qt_${lib.replaceChars [ "." ] [ "_" ] version}";
+    hash = "sha256-9vapBKpl1NC3mIDetuCb452IHV6c7c7NCzSyiBry5oo=";
+  };
+
+  postPatch = ''
+    sed -i -e '/add_subdirectory(mt32emu)/d' CMakeLists.txt
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    libmt32emu
+    portaudio
+    qtbase
+    qtmultimedia
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+    libpulseaudio
+  ]
+  ++ lib.optional withJack libjack2;
+
+  dontFixCmake = true;
+
+  cmakeFlags = [
+    "-Dmt32emu-qt_USE_PULSEAUDIO_DYNAMIC_LOADING=OFF"
+    "-Dmunt_WITH_MT32EMU_QT=ON"
+    "-Dmunt_WITH_MT32EMU_SMF2WAV=OFF"
+  ];
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir $out/Applications
+    mv $out/bin/${meta.mainProgram}.app $out/Applications/
+    ln -s $out/{Applications/${meta.mainProgram}.app/Contents/MacOS,bin}/${meta.mainProgram}
+  '';
+
+  meta = with lib; {
+    homepage = "http://munt.sourceforge.net/";
+    description = "A synthesizer application built on Qt and libmt32emu";
+    longDescription = ''
+      mt32emu-qt is a synthesiser application that facilitates both realtime
+      synthesis and conversion of pre-recorded SMF files to WAVE making use of
+      the mt32emu library and the Qt framework.
+    '';
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ OPNA2608 ];
+    platforms = platforms.all;
+    mainProgram = "mt32emu-qt";
+  };
+}
--- a/pkgs/applications/audio/munt/mt32emu-smf2wav.nix
+++ b/pkgs/applications/audio/munt/mt32emu-smf2wav.nix
@ -0,0 +1,50 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, glib
+, libmt32emu
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mt32emu-smf2wav";
+  version = "1.7.0";
+
+  src = fetchFromGitHub {
+    owner = "munt";
+    repo = "munt";
+    rev = "mt32emu_smf2wav_${lib.replaceChars [ "." ] [ "_" ] version}";
+    hash = "sha256-FnKlKJxe7P4Yqpv0oVGgV4253dMgSmgtb7EAa2FI+aI=";
+  };
+
+  postPatch = ''
+    sed -i -e '/add_subdirectory(mt32emu)/d' CMakeLists.txt
+  '';
+
+  dontFixCmake = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    libmt32emu
+    glib
+  ];
+
+  cmakeFlags = [
+    "-Dmunt_WITH_MT32EMU_QT=OFF"
+    "-Dmunt_WITH_MT32EMU_SMF2WAV=ON"
+  ];
+
+  meta = with lib; {
+    homepage = "http://munt.sourceforge.net/";
+    description = "Produces a WAVE file from a Standard MIDI file (SMF)";
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ OPNA2608 ];
+    platforms = platforms.all;
+    mainProgram = "mt32emu-smf2wav";
+  };
+}
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -74,7 +74,7 @@ python3.pkgs.buildPythonApplication {
    cp -ar ${tests} $sourceRoot/electrum/tests
  '';

-  prePatch = ''
+  postPatch = ''
    substituteInPlace contrib/requirements/requirements.txt \
      --replace "dnspython>=2.0,<2.1" "dnspython>=2.0"
  '';
--- a/pkgs/applications/misc/hello/default.nix
+++ b/pkgs/applications/misc/hello/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "hello";
-  version = "2.10";
+  version = "2.12";

  src = fetchurl {
    url = "mirror://gnu/hello/${pname}-${version}.tar.gz";
-    sha256 = "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i";
+    sha256 = "1ayhp9v4m4rdhjmnl2bq3cibrbqqkgjbl3s7yk2nhlh8vj3ay16g";
  };

  doCheck = true;
--- a/pkgs/applications/misc/spotify-tray/default.nix
+++ b/pkgs/applications/misc/spotify-tray/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, gtk3 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config, gtk3 }:

 stdenv.mkDerivation rec {
  pname = "spotify-tray";
@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-E86rA8cBjy/bI7sZHlT40o7i23PcONXT5GTHEfcaDf0=";
  };

+  patches = [
+    (fetchpatch {
+      name = "fix-building-with-automake-1.16.5.patch";
+      url = "https://github.com/tsmetana/spotify-tray/commit/1305f473ba4a406e907b98c8255f23154f349613.patch";
+      sha256 = "sha256-u2IopfMzNCu2F06RZoJw3OAsRxxZYdIMnKnyb7/KBgk=";
+    })
+  ];
+
  nativeBuildInputs = [ autoreconfHook pkg-config ];

  buildInputs = [ gtk3 ];
--- a/pkgs/applications/misc/zettlr/default.nix
+++ b/pkgs/applications/misc/zettlr/default.nix
@ -10,11 +10,11 @@
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
 let
  pname = "zettlr";
-  version = "2.1.2";
+  version = "2.1.3";
  name = "${pname}-${version}";
  src = fetchurl {
    url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
-    sha256 = "sha256-gfq5eXSoEfOb3FVAv/iDDSGeEeZxFRp4BFtwf87WQGE=";
+    sha256 = "sha256-prUKMtM9qf34OXaMjuWa1jTZ+2tn99rVJBdqk1El3zs=";
  };
  appimageContents = appimageTools.extractType2 {
    inherit name src;
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,27 +1,27 @@
 {
  "stable": {
-    "version": "97.0.4692.99",
-    "sha256": "1fpc07zvashaqqalwn7wxnswxclrxvhjrxy1rzr6gcq5awhaw6y9",
-    "sha256bin64": "18afashha667rzcscq3frkp5ixa7nrirs7i3061njqi4z9ql0cs8",
+    "version": "98.0.4758.80",
+    "sha256": "0wa1jhsw7qrym4x8wxmdvdvbilb8jdv0mizzib2342l61zi6cwn8",
+    "sha256bin64": "0p2bh45ffgfhyh18bxw8fz4691g25s44lxxj4igk8b0bn71v1pgi",
    "deps": {
      "gn": {
-        "version": "2021-11-03",
+        "version": "2021-12-07",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "90294ccdcf9334ed25a76ac9b67689468e506342",
-        "sha256": "0n0jml8s00ayy186jzrf207hbz70pxiq426znxwxd4gjcp60scsa"
+        "rev": "fc295f3ac7ca4fe7acc6cb5fb052d22909ef3a8f",
+        "sha256": "02bx3bp85kkis704gndb6jvjph7gv3ij746bq4anl30kfrkpcifh"
      }
    },
    "chromedriver": {
-      "version": "97.0.4692.71",
-      "sha256_linux": "0lw74ycw8vh3qz4nxynnvrw8sngy3g0vcaana15y4b2ks73gcvci",
-      "sha256_darwin": "1zv1ndv1d7a29yvg0b242g8dw5f8s9vxhr454zd9vahn0ar4ksbs",
-      "sha256_darwin_aarch64": "0jzn75rrjw3y1bqg0ywfjcm2zn9dd2h3lswih51glvdrlcz3vw2a"
+      "version": "98.0.4758.48",
+      "sha256_linux": "1nk3vki803b30mc7ww911l68jfxmpp6mddyq02a3f68893qa2mcf",
+      "sha256_darwin": "09m5vsqfn6qyn3faf2p0dldll6fracjg6z81xzpyp2bh9zp8vk82",
+      "sha256_darwin_aarch64": "04lnbm9wiaz8dlc4qigxakcwghhjc3wvahvl5j80k8agkbv7fdvi"
    }
  },
  "beta": {
-    "version": "98.0.4758.74",
-    "sha256": "01v9bfq3905zqhyp78zq69ipz2b5ldsrm8yjr9qb6434zrhlcvyb",
-    "sha256bin64": "0p85zanpmlkxc34zhx2rybbwriwqbjmg27rrjcf76gvfljlj3g51",
+    "version": "98.0.4758.80",
+    "sha256": "0wa1jhsw7qrym4x8wxmdvdvbilb8jdv0mizzib2342l61zi6cwn8",
+    "sha256bin64": "12a69cbv2sbrly6g477ln4pssh8n1rdg6mr6cc17iy2jhfihry0q",
    "deps": {
      "gn": {
        "version": "2021-12-07",
@ -32,9 +32,9 @@
    }
  },
  "dev": {
-    "version": "99.0.4844.11",
-    "sha256": "1jkcif839yrhsckx5j1jqsmkhlvhm1gqk3mhvji1mfi4rg1dfd0l",
-    "sha256bin64": "01vl7ah3jkryrfnjidv8yq490hyqll6gd0vddy0b98wgyn3h593h",
+    "version": "99.0.4844.16",
+    "sha256": "0xig6l1yx9glgb1a53idncnqc1imjvbszi5mrp39yvijarmx8s1f",
+    "sha256bin64": "18p2hqykizijb9w96dm8yxwgvpjx37vabyw6n9wc59l6wyhbjkkw",
    "deps": {
      "gn": {
        "version": "2022-01-10",
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "clusterctl";
-  version = "1.0.2";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "cluster-api";
    rev = "v${version}";
-    sha256 = "sha256-esSpCNvgYhuz9i22AU4ZowU5A5ZOPZ15+XHB4OOfTa4=";
+    sha256 = "sha256-mebxbS0PVP2EdYt31G0HQ0Z+wxpXOe9/xaKdH0wwB60=";
  };

-  vendorSha256 = "sha256-VO1Z4NUWrd4JuFYFg0a01psqoIM8ps3vKd0djR5OELU=";
+  vendorSha256 = "sha256-T2a5FBjISXprgMA6ye2xwAFLE62Qb3AUQVjpGtnduU0=";

  subPackages = [ "cmd/clusterctl" ];

--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -168,9 +168,9 @@ rec {
  };

  terraform_1 = mkTerraform {
-    version = "1.1.4";
-    sha256 = "sha256-PzBdo4zqWB9ma+uYFGmZtJNCXlRnAHxQmzWxZFPzHH0=";
-    vendorSha256 = "sha256-Rk2hHtJfaS553MJIea6n51irMas3qcBrWAD+adzTi1Y=";
+    version = "1.1.5";
+    sha256 = "sha256-zIerP8v6ovIx+xwLsSmMFH41l140W9IwQMvomb/pk8E=";
+    vendorSha256 = "sha256-4ctuErxZIaESfIkS7BXI+eQcdatXE/1p20P9f890twM=";
    patches = [ ./provider-path-0_15.patch ];
    passthru = { inherit plugins; };
  };
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@ -5,13 +5,13 @@ buildGoModule rec {
  /* Do not use "dev" as a version. If you do, Tilt will consider itself
    running in development environment and try to serve assets from the
    source tree, which is not there once build completes.  */
-  version = "0.23.5";
+  version = "0.23.9";

  src = fetchFromGitHub {
    owner  = "tilt-dev";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "sha256-qVybS+gRuTezX89NMWYQVWtUH6wnjB11HImejrzVHAc=";
+    sha256 = "sha256-sxOUO5dLWBgNvbi42/aoN4YQStuNuXxWuM3WJxh1ucg=";
  };
  vendorSha256 = null;

--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -11,15 +11,15 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.56";
+  version = "1.2.60";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    sha256 = "sha256-6gDSH/YWkXeYyEwJDYNNCAWTBjwGx7kNcsCqmmwqJy0=";
+    sha256 = "sha256-EEceAIlbwfKD2K0pJxmCRn6+yc5RVBassENuMS48794=";
  };
-  vendorSha256 = "sha256-Cod7nFLu6au0uxrJLBf7SG1YBasRzmDjt+FmtZqMw3U=";
+  vendorSha256 = "sha256-3hNqCIx6S1pEzLMRVmr04pmQrrc3T/Q/FsB/DCAVRCY=";
  proxyVendor = true;

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -2,14 +2,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.2.15";
+  version = "3.2.16";

  # Fetch from GitHub in order to use `requirements.in`
  src = fetchFromGitHub {
    owner = "flexget";
    repo = "flexget";
    rev = "v${version}";
-    sha256 = "0ygkygd0gcldwdx6wl1kbvzi93k75m0v05m614cahh0jc7j27xy7";
+    sha256 = "sha256-4CMAkLMVvahKwwBo9epHiVnOtTK3T6Q8pHXAHSEbxvk=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
@ -2,7 +2,7 @@
  "name": "element-desktop",
  "productName": "Element",
  "main": "lib/electron-main.js",
-  "version": "1.9.9",
+  "version": "1.10.1",
  "description": "A feature-rich client for Matrix.org",
  "author": "Element",
  "repository": {
@ -61,18 +61,19 @@
    "app-builder-lib": "^22.14.10",
    "asar": "^2.0.1",
    "chokidar": "^3.5.2",
-    "electron": "13.5",
+    "electron": "^15.3.5",
    "electron-builder": "22.11.4",
    "electron-builder-squirrel-windows": "22.11.4",
    "electron-devtools-installer": "^3.1.1",
    "electron-notarize": "^1.0.0",
    "eslint": "7.18.0",
    "eslint-config-google": "^0.14.0",
-    "eslint-plugin-matrix-org": "github:matrix-org/eslint-plugin-matrix-org#2306b3d4da4eba908b256014b979f1d3d43d2945",
+    "eslint-plugin-import": "^2.25.4",
+    "eslint-plugin-matrix-org": "^0.4.0",
    "find-npm-prefix": "^1.0.2",
    "fs-extra": "^8.1.0",
    "glob": "^7.1.6",
-    "matrix-web-i18n": "github:matrix-org/matrix-web-i18n",
+    "matrix-web-i18n": "^1.2.0",
    "mkdirp": "^1.0.3",
    "needle": "^2.5.0",
    "node-pre-gyp": "^0.15.0",
--- a/pkgs/applications/networking/instant-messengers/element/pin.json
+++ b/pkgs/applications/networking/instant-messengers/element/pin.json
@ -1,6 +1,6 @@
 {
-  "version": "1.9.9",
-  "desktopSrcHash": "IMqco5HeAgsh1LMBXFH1/HnlIEFEQU0xqnHbTKwHGL4=",
-  "desktopYarnHash": "0zzr14fcyc5q2562x50nvxxda10yr5ihbr12nykzg4j534rgb55y",
-  "webHash": "1i3zka9cfn14rv5wzz969w6dz5dbkw87clrgajs8p1s2l62ac1jf"
+  "version": "1.10.1",
+  "desktopSrcHash": "cA+yXVkfizVRbbykFRhNIbdaGLuEk2IuKFO8YJt78Q4=",
+  "desktopYarnHash": "0kz6vkfxxk4sbr9zpaig1lhsbwj4f57v4f4pr373xxsnk1wagkfn",
+  "webHash": "1g5hw39fr7adazmafpxivfxv28nzcv99r8sihga1j91avf6lxkim"
 }
--- a/pkgs/applications/networking/instant-messengers/teams/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams/default.nix
@ -14,109 +14,150 @@
 , xdg-utils
 , systemd
 , nodePackages
-, enableRectOverlay ? false }:
+, xar
+, cpio
+, makeWrapper
+, enableRectOverlay ? false
+}:

-stdenv.mkDerivation rec {
+let
  pname = "teams";
  version = "1.4.00.26453";
-
-  src = fetchurl {
-    url = "https://packages.microsoft.com/repos/ms-teams/pool/main/t/teams/teams_${version}_amd64.deb";
-    sha256 = "0ndqk893l17m42hf5fiiv6mka0v7v8r54kblvb67jsxajdvva5gf";
-  };
-
-  nativeBuildInputs = [ dpkg autoPatchelfHook wrapGAppsHook nodePackages.asar ];
-
-  unpackCmd = "dpkg -x $curSrc .";
-
-  buildInputs = atomEnv.packages ++ [
-    libuuid
-    at-spi2-atk
-  ];
-
-  runtimeDependencies = [
-    (lib.getLib systemd)
-    pulseaudio
-    libappindicator-gtk3
-  ];
-
-  preFixup = ''
-    gappsWrapperArgs+=(--prefix PATH : "${coreutils}/bin:${gawk}/bin")
-    gappsWrapperArgs+=(--add-flags --disable-namespace-sandbox)
-    gappsWrapperArgs+=(--add-flags --disable-setuid-sandbox)
-  '';
-
-
-  buildPhase = ''
-    runHook preBuild
-
-    asar extract share/teams/resources/app.asar "$TMP/work"
-    substituteInPlace $TMP/work/main.bundle.js \
-        --replace "/usr/share/pixmaps/" "$out/share/pixmaps" \
-        --replace "/usr/bin/xdg-mime" "${xdg-utils}/bin/xdg-mime" \
-        --replace "Exec=/usr/bin/" "Exec=" # Remove usage of absolute path in autostart.
-    asar pack --unpack='{*.node,*.ftz,rect-overlay}' "$TMP/work" share/teams/resources/app.asar
-
-    runHook postBuild
-  '';
-
-  preferLocalBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{opt,bin}
-
-    mv share/teams $out/opt/
-    mv share $out/share
-
-    substituteInPlace $out/share/applications/teams.desktop \
-      --replace /usr/bin/ ""
-
-    ln -s $out/opt/teams/teams $out/bin/
-
-    ${lib.optionalString (!enableRectOverlay) ''
-    # Work-around screen sharing bug
-    # https://docs.microsoft.com/en-us/answers/questions/42095/sharing-screen-not-working-anymore-bug.html
-    rm $out/opt/teams/resources/app.asar.unpacked/node_modules/slimcore/bin/rect-overlay
-    ''}
-
-    runHook postInstall
-  '';
-
-  dontAutoPatchelf = true;
-
-  # Includes runtimeDependencies in the RPATH of the included Node modules
-  # so that dynamic loading works. We cannot use directly runtimeDependencies
-  # here, since the libraries from runtimeDependencies are not propagated
-  # to the dynamically loadable node modules because of a condition in
-  # autoPatchElfHook since *.node modules have Type: DYN (Shared object file)
-  # instead of EXEC or INTERP it expects.
-  # Fixes: https://github.com/NixOS/nixpkgs/issues/85449
-  postFixup = ''
-    autoPatchelf "$out"
-
-    runtime_rpath="${lib.makeLibraryPath runtimeDependencies}"
-
-    for mod in $(find "$out/opt/teams" -name '*.node'); do
-      mod_rpath="$(patchelf --print-rpath "$mod")"
-
-      echo "Adding runtime dependencies to RPATH of Node module $mod"
-      patchelf --set-rpath "$runtime_rpath:$mod_rpath" "$mod"
-    done;
-
-    # fix for https://docs.microsoft.com/en-us/answers/questions/298724/open-teams-meeting-link-on-linux-doens39t-work.html?childToView=309406#comment-309406
-    # while we create the wrapper ourselves, gappsWrapperArgs leads to the same issue
-    # another option would be to introduce gappsWrapperAppendedArgs, to allow control of positioning
-    substituteInPlace "$out/bin/teams" --replace '.teams-wrapped"  --disable-namespace-sandbox --disable-setuid-sandbox "$@"' '.teams-wrapped" "$@" --disable-namespace-sandbox --disable-setuid-sandbox'
-  '';
-
  meta = with lib; {
    description = "Microsoft Teams";
    homepage = "https://teams.microsoft.com";
    downloadPage = "https://teams.microsoft.com/downloads";
    license = licenses.unfree;
-    maintainers = [ maintainers.liff ];
-    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ liff tricktron ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
  };
-}
+
+  linux = stdenv.mkDerivation rec {
+    inherit pname version meta;
+
+    src = fetchurl {
+      url = "https://packages.microsoft.com/repos/ms-teams/pool/main/t/teams/teams_${version}_amd64.deb";
+      sha256 = "0ndqk893l17m42hf5fiiv6mka0v7v8r54kblvb67jsxajdvva5gf";
+    };
+
+    nativeBuildInputs = [ dpkg autoPatchelfHook wrapGAppsHook nodePackages.asar ];
+
+    unpackCmd = "dpkg -x $curSrc .";
+
+    buildInputs = atomEnv.packages ++ [
+      libuuid
+      at-spi2-atk
+    ];
+
+    runtimeDependencies = [
+      (lib.getLib systemd)
+      pulseaudio
+      libappindicator-gtk3
+    ];
+
+    preFixup = ''
+      gappsWrapperArgs+=(--prefix PATH : "${coreutils}/bin:${gawk}/bin")
+      gappsWrapperArgs+=(--add-flags --disable-namespace-sandbox)
+      gappsWrapperArgs+=(--add-flags --disable-setuid-sandbox)
+    '';
+
+
+    buildPhase = ''
+      runHook preBuild
+
+      asar extract share/teams/resources/app.asar "$TMP/work"
+      substituteInPlace $TMP/work/main.bundle.js \
+          --replace "/usr/share/pixmaps/" "$out/share/pixmaps" \
+          --replace "/usr/bin/xdg-mime" "${xdg-utils}/bin/xdg-mime" \
+          --replace "Exec=/usr/bin/" "Exec=" # Remove usage of absolute path in autostart.
+      asar pack --unpack='{*.node,*.ftz,rect-overlay}' "$TMP/work" share/teams/resources/app.asar
+
+      runHook postBuild
+    '';
+
+    preferLocalBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{opt,bin}
+
+      mv share/teams $out/opt/
+      mv share $out/share
+
+      substituteInPlace $out/share/applications/teams.desktop \
+        --replace /usr/bin/ ""
+
+      ln -s $out/opt/teams/teams $out/bin/
+
+      ${lib.optionalString (!enableRectOverlay) ''
+      # Work-around screen sharing bug
+      # https://docs.microsoft.com/en-us/answers/questions/42095/sharing-screen-not-working-anymore-bug.html
+      rm $out/opt/teams/resources/app.asar.unpacked/node_modules/slimcore/bin/rect-overlay
+      ''}
+
+      runHook postInstall
+    '';
+
+    dontAutoPatchelf = true;
+
+    # Includes runtimeDependencies in the RPATH of the included Node modules
+    # so that dynamic loading works. We cannot use directly runtimeDependencies
+    # here, since the libraries from runtimeDependencies are not propagated
+    # to the dynamically loadable node modules because of a condition in
+    # autoPatchElfHook since *.node modules have Type: DYN (Shared object file)
+    # instead of EXEC or INTERP it expects.
+    # Fixes: https://github.com/NixOS/nixpkgs/issues/85449
+    postFixup = ''
+      autoPatchelf "$out"
+
+      runtime_rpath="${lib.makeLibraryPath runtimeDependencies}"
+
+      for mod in $(find "$out/opt/teams" -name '*.node'); do
+        mod_rpath="$(patchelf --print-rpath "$mod")"
+
+        echo "Adding runtime dependencies to RPATH of Node module $mod"
+        patchelf --set-rpath "$runtime_rpath:$mod_rpath" "$mod"
+      done;
+
+      # fix for https://docs.microsoft.com/en-us/answers/questions/298724/open-teams-meeting-link-on-linux-doens39t-work.html?childToView=309406#comment-309406
+      # while we create the wrapper ourselves, gappsWrapperArgs leads to the same issue
+      # another option would be to introduce gappsWrapperAppendedArgs, to allow control of positioning
+      substituteInPlace "$out/bin/teams" --replace '.teams-wrapped"  --disable-namespace-sandbox --disable-setuid-sandbox "$@"' '.teams-wrapped" "$@" --disable-namespace-sandbox --disable-setuid-sandbox'
+    '';
+  };
+
+  appName = "Teams.app";
+
+  darwin = stdenv.mkDerivation {
+    inherit pname version meta;
+
+    src = fetchurl {
+      url = "https://statics.teams.cdn.office.net/production-osx/${version}/Teams_osx.pkg";
+      sha256 = "1mg6a3b3954w4xy5rlcrwxczymygl61dv2rxqp45sjcsh3hp39q0";
+    };
+
+    buildInputs = [ xar cpio makeWrapper ];
+
+    unpackPhase = ''
+      xar -xf $src
+      zcat < Teams_osx_app.pkg/Payload | cpio -i
+    '';
+
+    sourceRoot = "Microsoft\ Teams.app";
+    dontPatch = true;
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/{Applications/${appName},bin}
+      cp -R . $out/Applications/${appName}
+      makeWrapper $out/Applications/${appName}/Contents/MacOS/Teams $out/bin/teams
+      runHook postInstall
+    '';
+  };
+in
+if stdenv.isDarwin
+then darwin
+else linux
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "seaweedfs";
-  version = "2.85";
+  version = "2.88";

  src = fetchFromGitHub {
    owner = "chrislusf";
    repo = "seaweedfs";
    rev = version;
-    sha256 = "sha256-MsPvda+VaqO3tXH26nVukNWcJ1n+/n5Qk7BMr/DAVUk=";
+    sha256 = "sha256-B/gcuga82lZSLPKjYWAiLyvqf1FRQmHJsH2jqLkusjA=";
  };

-  vendorSha256 = "sha256-gK4uHLNcperpG2OVdk7XKCUWCC87cyDBf8qigj/z3jA=";
+  vendorSha256 = "sha256-N7zOrSMrCR/eOH+08TImI1q2AFGUuWN7xIt3CUVB9rM=";

  subPackages = [ "weed" ];

--- a/pkgs/applications/office/gnumeric/default.nix
+++ b/pkgs/applications/office/gnumeric/default.nix
@ -7,11 +7,11 @@ let
  inherit (python3Packages) python pygobject3;
 in stdenv.mkDerivation rec {
  pname = "gnumeric";
-  version = "1.12.50";
+  version = "1.12.51";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "dYgZuhvWmDgp+efG1xp/ogzXWjZSonHluwA9XYvMFLg=";
+    sha256 = "oA5sbk7N2tq9mwrhgBPXsFk3/cuPmq1ac7lZI8eusd0=";
  };

  configureFlags = [ "--disable-component" ];
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@ -33,13 +33,13 @@

 mkDerivation rec {
  pname = "sdrangel";
-  version = "6.18.0";
+  version = "6.18.1";

  src = fetchFromGitHub {
    owner = "f4exb";
    repo = "sdrangel";
    rev = "v${version}";
-    sha256 = "sha256-L/D8uEWiFGkAXcxnwDWcPQmc3FvXrG6xs9japMmTHys=";
+    sha256 = "sha256-gf+RUOcki0pi3UH4NHFsmbTV04HUG16UC4jcUjyeip4=";
    fetchSubmodules = false;
  };

--- a/pkgs/applications/science/logic/anders/default.nix
+++ b/pkgs/applications/science/logic/anders/default.nix
@ -0,0 +1,24 @@
+{ lib, fetchFromGitHub, ocamlPackages }:
+
+ocamlPackages.buildDunePackage rec {
+  pname = "anders";
+  version = "1.1.1";
+
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "groupoid";
+    repo = "anders";
+    rev = "${version}";
+    sha256 = "sha256-JUiZoo2rNLfgs94TlJqUNzul/7ODisCjSFAzhgSp1z4=";
+  };
+
+  buildInputs = with ocamlPackages; [ zarith menhir ];
+
+  meta = with lib; {
+    description = "Modal Homotopy Type System";
+    homepage = "https://homotopy.dev/";
+    license = licenses.isc;
+    maintainers = [ maintainers.suhr ];
+  };
+}
--- a/pkgs/applications/version-management/git-and-tools/gitui/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
@ -1,18 +1,30 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, libiconv, perl, python3, Security, AppKit, openssl, xclip, pkg-config }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, libiconv
+, openssl
+, pkg-config
+, xclip
+, AppKit
+, Security
+}:
+
 rustPlatform.buildRustPackage rec {
  pname = "gitui";
-  version = "0.19.0";
+  version = "0.20.1";

  src = fetchFromGitHub {
    owner = "extrawurst";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-PNyXmXHS8StJhx6Qko7zbXrX1CX3owC1HmyX9VV7tEg=";
+    sha256 = "sha256-zYM0JVhgFnp8JDBx9iEOt029sr8azIPX5jrtvUE/Pn0=";
  };

-  cargoSha256 = "sha256-Q6QUxIe5bkoEcxZZwhJbihaHhSsX8SLqWzmjp8hFsS4=";
+  cargoSha256 = "sha256-kbLI95GzCwm2OKzzpk7jvgtm8vArf29u5BiPRTh2OmE=";
+
+  nativeBuildInputs = [ pkg-config ];

-  nativeBuildInputs = [ python3 perl pkg-config ];
  buildInputs = [ openssl ]
    ++ lib.optional stdenv.isLinux xclip
    ++ lib.optionals stdenv.isDarwin [ libiconv Security AppKit ];
@ -21,7 +33,7 @@ rustPlatform.buildRustPackage rec {
  OPENSSL_NO_VENDOR = 1;

  meta = with lib; {
-    description = "Blazing fast terminal-ui for git written in rust";
+    description = "Blazing fast terminal-ui for Git written in Rust";
    homepage = "https://github.com/extrawurst/gitui";
    license = licenses.mit;
    maintainers = with maintainers; [ Br1ght0ne yanganto ];
--- a/pkgs/applications/virtualization/lima/default.nix
+++ b/pkgs/applications/virtualization/lima/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "lima";
-  version = "0.8.1";
+  version = "0.8.2";

  src = fetchFromGitHub {
    owner = "lima-vm";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-vOoRwV4BO40cUWNxmWubgbN1q7WPKe2vifg8F1duaVA=";
+    sha256 = "sha256-kz+gyl7BuC0G97Lj3T1a859TYhwfAGB1hTiYXq66wwY=";
  };

-  vendorSha256 = "sha256-118TYmpGUNMZgFKsOzqOy71SabG9tN6IeOkpgwVSXTY=";
+  vendorSha256 = "sha256-x0VmidGV9TsGOyL+OTUHXOxJ2cgvIqph56MrwfR2SP4=";

  nativeBuildInputs = [ makeWrapper installShellFiles ];

--- a/pkgs/build-support/fetchpatch/default.nix
+++ b/pkgs/build-support/fetchpatch/default.nix
@ -9,19 +9,24 @@ let
  # 0.3.4 would change hashes: https://github.com/NixOS/nixpkgs/issues/25154
  patchutils = buildPackages.patchutils_0_3_3;
 in
-{ stripLen ? 0, extraPrefix ? null, excludes ? [], includes ? [], revert ? false, ... }@args:
+{ stripLen ? 0
+, extraPrefix ? null
+, excludes ? []
+, includes ? []
+, revert ? false
+, postFetch ? ""
+, ...
+}@args:

-let
-  # Make base-64 encoded SRI hash filename-safe using RFC 4648 §5
-  tmpname = lib.replaceStrings [ "+" "/" "=" ] [ "-" "_" "" ] args.sha256;
-in
 fetchurl ({
  postFetch = ''
-    tmpfile="$TMPDIR/${tmpname}"
+    tmpfile="$TMPDIR/patch"
+
    if [ ! -s "$out" ]; then
      echo "error: Fetched patch file '$out' is empty!" 1>&2
      exit 1
    fi
+
    "${patchutils}/bin/lsdiff" "$out" \
      | sort -u | sed -e 's/[*?]/\\&/g' \
      | xargs -I{} \
@ -33,6 +38,7 @@ fetchurl ({
           --addnewprefix=b/${extraPrefix} \
        ''} \
        --clean "$out" > "$tmpfile"
+
    if [ ! -s "$tmpfile" ]; then
      echo "error: Normalized patch '$tmpfile' is empty (while the fetched file was not)!" 1>&2
      echo "Did you maybe fetch a HTML representation of a patch instead of a raw patch?" 1>&2
@ -40,6 +46,7 @@ fetchurl ({
      cat "$out" 1>&2
      exit 1
    fi
+
    ${patchutils}/bin/filterdiff \
      -p1 \
      ${builtins.toString (builtins.map (x: "-x ${lib.escapeShellArg x}") excludes)} \
@ -56,6 +63,6 @@ fetchurl ({
  '' + lib.optionalString revert ''
    ${patchutils}/bin/interdiff "$out" /dev/null > "$tmpfile"
    mv "$tmpfile" "$out"
-  '' + (args.postFetch or "");
+  '' + postFetch;
  meta.broken = excludes != [] && includes != [];
 } // builtins.removeAttrs args ["stripLen" "extraPrefix" "excludes" "includes" "revert" "postFetch"])
--- a/pkgs/data/fonts/cantarell-fonts/default.nix
+++ b/pkgs/data/fonts/cantarell-fonts/default.nix
@ -1,15 +1,36 @@
-{ lib, stdenv, fetchurl, meson, ninja, gettext, appstream-glib, gnome }:
+{ stdenv
+, lib
+, fetchurl
+, meson
+, ninja
+, python3
+, gettext
+, appstream-glib
+, gnome
+}:

 stdenv.mkDerivation rec {
  pname = "cantarell-fonts";
-  version = "0.301";
+  version = "0.303.1";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "3d35db0ac03f9e6b0d5a53577591b714238985f4cfc31a0aa17f26cd74675e83";
+    sha256 = "+UY6BlnGPlfjgf3XU88ZKSJTlcW0kTWYlCR2GDBTBBE=";
  };

-  nativeBuildInputs = [ meson ninja gettext appstream-glib ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    python3
+    python3.pkgs.psautohint
+    python3.pkgs.cffsubr
+    python3.pkgs.statmake
+    python3.pkgs.ufo2ft
+    python3.pkgs.setuptools
+    python3.pkgs.ufoLib2
+    gettext
+    appstream-glib
+  ];

  # ad-hoc fix for https://github.com/NixOS/nixpkgs/issues/50855
  # until we fix gettext's envHook
@ -19,7 +40,7 @@ stdenv.mkDerivation rec {

  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
-  outputHash = "1sczskw2kv3qy39i9mzw2lkl94a90bjgv5ln9acy5kh4gb2zmy7z";
+  outputHash = "XeqHVdTQ7PTzxkjwfzS/BTR7+k/M69sfUKdRXGOTmZE=";

  passthru = {
    updateScript = gnome.updateScript {
--- a/pkgs/desktops/gnome/core/gdm/default.nix
+++ b/pkgs/desktops/gnome/core/gdm/default.nix
@ -43,13 +43,13 @@ in

 stdenv.mkDerivation rec {
  pname = "gdm";
-  version = "41.0";
+  version = "41.3";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gdm/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "VzjEKTqfWoDUpungb00N8+nzE8p7Yb+02K+rqYPiANw=";
+    sha256 = "uwtlCnzqkPCaMyhPvQKXUxVAfvwY6BQAmFLRvK00N9Q=";
  };

  mesonFlags = [
--- a/pkgs/desktops/gnome/core/gnome-desktop/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-desktop/default.nix
@ -26,13 +26,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-desktop";
-  version = "41.2";
+  version = "41.3";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-desktop/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-NDKe79rK0jMqatuuU4yNpuUiNcd3WpCLfDIECgdT7Go=";
+    sha256 = "sha256-jNHKq5MRgowEUkaMalBnqbxEY4NbI6FL5E6P2bAwAcY=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/gnome-session/ctl.nix
+++ b/pkgs/desktops/gnome/core/gnome-session/ctl.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-session-ctl";
-  version = "40.0";
+  version = "41.3";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = pname;
    rev = version;
-    hash = "sha256-gvBmLx8Qoj1vPsOwaZsd9+pTDvU5D7uUts7ZT1pXwNo=";
+    hash = "sha256-aC0tkTf2lgCRlcbFj1FEOVBm3YUuP+8Yz98W3ZjUydg=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/gnome-session/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-session/default.nix
@ -1,16 +1,42 @@
-{ fetchurl, lib, stdenv, substituteAll, meson, ninja, pkg-config, gnome, glib, gtk3, gsettings-desktop-schemas
-, gnome-desktop, dbus, json-glib, libICE, xmlto, docbook_xsl, docbook_xml_dtd_412, python3
-, libxslt, gettext, makeWrapper, systemd, xorg, libepoxy, gnugrep, bash, gnome-session-ctl }:
+{ fetchurl
+, lib
+, stdenv
+, substituteAll
+, meson
+, ninja
+, pkg-config
+, gnome
+, glib
+, gtk3
+, gsettings-desktop-schemas
+, gnome-desktop
+, dbus
+, json-glib
+, libICE
+, xmlto
+, docbook_xsl
+, docbook_xml_dtd_412
+, python3
+, libxslt
+, gettext
+, makeWrapper
+, systemd
+, xorg
+, libepoxy
+, bash
+, gnome-session-ctl
+}:

 stdenv.mkDerivation rec {
  pname = "gnome-session";
-  version = "40.1.1";
+  # Also bump ./ctl.nix when bumping major version.
+  version = "41.3";

-  outputs = ["out" "sessions"];
+  outputs = [ "out" "sessions" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-session/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "10nzyhmgkrzk6i70kj7690na0hmsv6qy5bmr10akxq9jxqlphy4w";
+    sha256 = "7koikFP1ImJAVIiWCTNbiFKHz2e73g3J/YgrAeybWzk=";
  };

  patches = [
@ -18,22 +44,41 @@ stdenv.mkDerivation rec {
      src = ./fix-paths.patch;
      gsettings = "${glib.bin}/bin/gsettings";
      dbusLaunch = "${dbus.lib}/bin/dbus-launch";
-      grep = "${gnugrep}/bin/grep";
      bash = "${bash}/bin/bash";
    })
  ];

-  mesonFlags = [ "-Dsystemd=true" "-Dsystemd_session=default" ];
-
  nativeBuildInputs = [
-    meson ninja pkg-config gettext makeWrapper
-    xmlto libxslt docbook_xsl docbook_xml_dtd_412 python3
+    meson
+    ninja
+    pkg-config
+    gettext
+    makeWrapper
+    xmlto
+    libxslt
+    docbook_xsl
+    docbook_xml_dtd_412
+    python3
    dbus # for DTD
  ];

  buildInputs = [
-    glib gtk3 libICE gnome-desktop json-glib xorg.xtrans gnome.adwaita-icon-theme
-    gnome.gnome-settings-daemon gsettings-desktop-schemas systemd libepoxy
+    glib
+    gtk3
+    libICE
+    gnome-desktop
+    json-glib
+    xorg.xtrans
+    gnome.adwaita-icon-theme
+    gnome.gnome-settings-daemon
+    gsettings-desktop-schemas
+    systemd
+    libepoxy
+  ];
+
+  mesonFlags = [
+    "-Dsystemd=true"
+    "-Dsystemd_session=default"
  ];

  postPatch = ''
@ -49,17 +94,6 @@ stdenv.mkDerivation rec {
      {} +
  '';

-  # `bin/gnome-session` will reset the environment when run in wayland, we
-  # therefor wrap `libexec/gnome-session-binary` instead which is the actual
-  # binary needing wrapping
-  preFixup = ''
-    wrapProgram "$out/libexec/gnome-session-binary" \
-      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
-      --suffix XDG_DATA_DIRS : "$out/share:$GSETTINGS_SCHEMAS_PATH" \
-      --suffix XDG_DATA_DIRS : "${gnome.gnome-shell}/share"\
-      --suffix XDG_CONFIG_DIRS : "${gnome.gnome-settings-daemon}/etc/xdg"
-  '';
-
  # We move the GNOME sessions to another output since gnome-session is a dependency of
  # GDM itself. If we do not hide them, it will show broken GNOME sessions when GDM is
  # enabled without proper GNOME installation.
@ -72,12 +106,26 @@ stdenv.mkDerivation rec {
    rm -rf $out/libexec/gnome-session-ctl
  '';

+  # `bin/gnome-session` will reset the environment when run in wayland, we
+  # therefor wrap `libexec/gnome-session-binary` instead which is the actual
+  # binary needing wrapping
+  preFixup = ''
+    wrapProgram "$out/libexec/gnome-session-binary" \
+      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
+      --suffix XDG_DATA_DIRS : "$out/share:$GSETTINGS_SCHEMAS_PATH" \
+      --suffix XDG_DATA_DIRS : "${gnome.gnome-shell}/share"\
+      --suffix XDG_CONFIG_DIRS : "${gnome.gnome-settings-daemon}/etc/xdg"
+  '';
+
  passthru = {
    updateScript = gnome.updateScript {
      packageName = "gnome-session";
      attrPath = "gnome.gnome-session";
    };
-    providedSessions = [ "gnome" "gnome-xorg" ];
+    providedSessions = [
+      "gnome"
+      "gnome-xorg"
+    ];
  };

  meta = with lib; {
--- a/pkgs/desktops/gnome/core/gnome-session/fix-paths.patch
+++ b/pkgs/desktops/gnome/core/gnome-session/fix-paths.patch
@ -1,17 +1,10 @@
 diff --git a/gnome-session/gnome-session.in b/gnome-session/gnome-session.in
-index ddd1a591..46a3488b 100755
+index b4b1f8fa..99d52cba 100755
 --- a/gnome-session/gnome-session.in
 +++ b/gnome-session/gnome-session.in
-@@ -3,17 +3,19 @@
- if [ "x$XDG_SESSION_TYPE" = "xwayland" ] &&
+@@ -4,13 +4,15 @@ if [ "x$XDG_SESSION_TYPE" = "xwayland" ] &&
    [ "x$XDG_SESSION_CLASS" != "xgreeter" ] &&
-    [  -n "$SHELL" ] &&
-   grep -q "$SHELL" /etc/shells &&
-   ! (echo "$SHELL" | grep -q "false") &&
-   ! (echo "$SHELL" | grep -q "nologin"); then
-+   @grep@ -q "$SHELL" /etc/shells &&
-+   ! (echo "$SHELL" | @grep@ -q "false") &&
-+   ! (echo "$SHELL" | @grep@ -q "nologin"); then
+    [  -n "$SHELL" ]; then
   if [ "$1" != '-l' ]; then
 -    exec bash -c "exec -l '$SHELL' -c '$0 -l $*'"
 +    # Make sure the shell actually sets up the environment.
@ -28,7 +21,7 @@ index ddd1a591..46a3488b 100755
 REGION=${REGION%\'}
 
 diff --git a/gnome-session/main.c b/gnome-session/main.c
-index 84edfbe5..e5285489 100644
+index a460a849..9d07898f 100644
 --- a/gnome-session/main.c
 +++ b/gnome-session/main.c
@@ -215,7 +215,7 @@ require_dbus_session (int      argc,
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@ -66,13 +66,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gnome-shell";
-  version = "41.2";
+  version = "41.3";

  outputs = [ "out" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "OEZR6wUTk9ur4AbRrQV78p1c1z67h7x3n/Xhwx6AqCc=";
+    sha256 = "Hj36KgvklFQYK0rOd/EdENP1uYjvD8tzK3MTVzlJ3tE=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@ -46,13 +46,13 @@

 let self = stdenv.mkDerivation rec {
  pname = "mutter";
-  version = "41.2";
+  version = "41.3";

  outputs = [ "out" "dev" "man" ];

  src = fetchurl {
    url = "mirror://gnome/sources/mutter/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "AN+oEvHEhtdKK3P0IEWuEYL5JGx3lNZ9dLXlQ+pwBhc=";
+    sha256 = "cZxdEGDrYFwbpkO0hvtXsaPHGX59+DvWwzZvxLaEd+U=";
  };

  patches = [
--- a/pkgs/desktops/gnome/misc/gitg/default.nix
+++ b/pkgs/desktops/gnome/misc/gitg/default.nix
@ -12,11 +12,11 @@
 , bash
 , gobject-introspection
 , libsoup
-, gtksourceview
+, gtksourceview4
 , gsettings-desktop-schemas
 , adwaita-icon-theme
 , gnome
-, gtkspell3
+, gspell
 , shared-mime-info
 , libgee
 , libgit2-glib
@ -29,11 +29,11 @@

 stdenv.mkDerivation rec {
  pname = "gitg";
-  version = "3.32.1";
+  version = "41";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0npg4kqpwl992fgjd2cn3fh84aiwpdp9kd8z7rw2xaj2iazsm914";
+    sha256 = "f7Ybn7EPuqVI0j1wZbq9cq1j5iHeVYQMBlzm45hsRik=";
  };

  nativeBuildInputs = [
@ -52,8 +52,8 @@ stdenv.mkDerivation rec {
    glib
    gsettings-desktop-schemas
    gtk3
-    gtksourceview
-    gtkspell3
+    gtksourceview4
+    gspell
    json-glib
    libdazzle
    libgee
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@ -6,6 +6,7 @@ with builtins; with lib; let
    { case = "8.12"; out = { version = "1.12.0"; };}
    { case = "8.13"; out = { version = "1.13.7"; };}
    { case = "8.14"; out = { version = "1.13.7"; };}
+    { case = "8.15"; out = { version = "1.13.7"; };}
  ] {});
 in mkCoqDerivation {
  pname = "elpi";
@ -13,11 +14,13 @@ in mkCoqDerivation {
  owner = "LPCIC";
  inherit version;
  defaultVersion = lib.switch coq.coq-version [
+    { case = "8.15"; out = "1.12.1"; }
    { case = "8.14"; out = "1.11.2"; }
    { case = "8.13"; out = "1.11.1"; }
    { case = "8.12"; out = "1.8.3_8.12"; }
    { case = "8.11"; out = "1.6.3_8.11"; }
  ] null;
+  release."1.12.1".sha256     = "sha256-4mO6/co7NcIQSGIQJyoO8lNWXr6dqz+bIYPO/G0cPkY=";
  release."1.11.2".sha256     = "0qk5cfh15y2zrja7267629dybd3irvxk1raz7z8qfir25a81ckd4";
  release."1.11.1".sha256     = "10j076vc2hdcbm15m6s7b6xdzibgfcbzlkgjnlkr2vv9k13qf8kc";
  release."1.10.1".sha256     = "1zsyx26dvj7pznfd2msl2w7zbw51q1nsdw0bdvdha6dga7ijf7xk";
--- a/pkgs/development/coq-modules/coqeal/default.nix
+++ b/pkgs/development/coq-modules/coqeal/default.nix
@ -10,7 +10,7 @@ with lib;

  inherit version;
  defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.10" "8.14") (isGe "1.12.0") ]; out = "1.1.0"; }
+      { cases = [ (range "8.10" "8.15") (isGe "1.12.0") ]; out = "1.1.0"; }
      { cases = [ (isGe "8.10") (range "1.11.0" "1.12.0") ]; out = "1.0.5"; }
      { cases = [ (isGe "8.7") "1.11.0" ]; out = "1.0.4"; }
      { cases = [ (isGe "8.7") "1.10.0" ]; out = "1.0.3"; }
--- a/pkgs/development/coq-modules/extructures/default.nix
+++ b/pkgs/development/coq-modules/extructures/default.nix
@ -10,12 +10,14 @@ with lib;

  inherit version;
  defaultVersion = with versions; switch [coq.coq-version ssreflect.version] [
+    { cases = [(isGe "8.11") (isGe "1.12.0") ]; out = "0.3.1"; }
    { cases = [(range "8.11" "8.14") (isLe "1.12.0") ]; out = "0.3.0"; }
    { cases = [(range "8.10" "8.12") (isLe "1.12.0") ]; out = "0.2.2"; }
  ] null;

  releaseRev = v: "v${v}";

+  release."0.3.1".sha256 = "sha256-KcuG/11Yq5ACem4FyVnQqHKvy3tNK7hd0ir2SJzzMN0=";
  release."0.3.0".sha256 = "sha256:14rm0726f1732ldds495qavg26gsn30w6dfdn36xb12g5kzavp38";
  release."0.2.2".sha256 = "sha256:1clzza73gccy6p6l95n6gs0adkqd3h4wgl4qg5l0qm4q140grvm7";

--- a/pkgs/development/coq-modules/flocq/default.nix
+++ b/pkgs/development/coq-modules/flocq/default.nix
@ -7,9 +7,10 @@ with lib; mkCoqDerivation {
  domain = "gitlab.inria.fr";
  inherit version;
  defaultVersion = with versions; switch coq.coq-version [
-    { case = range "8.7" "8.14"; out = "3.4.2"; }
+    { case = range "8.7" "8.15"; out = "3.4.3"; }
    { case = range "8.5" "8.8"; out = "2.6.1"; }
  ] null;
+  release."3.4.3".sha256 = "sha256-YTdWlEmFJjCcHkl47jSOgrGqdXoApJY4u618ofCaCZE=";
  release."3.4.2".sha256 = "1s37hvxyffx8ccc8mg5aba7ivfc39p216iibvd7f2cb9lniqk1pw";
  release."3.3.1".sha256 = "1mk8adhi5hrllsr0hamzk91vf2405sjr4lh5brg9201mcw11abkz";
  release."2.6.1".sha256 = "0q5a038ww5dn72yvwn5298d3ridkcngb1dik8hdyr3xh7gr5qibj";
--- a/pkgs/development/coq-modules/fourcolor/default.nix
+++ b/pkgs/development/coq-modules/fourcolor/default.nix
@ -7,9 +7,12 @@ mkCoqDerivation {

  release."1.2.3".rev    = "v1.2.3";
  release."1.2.3".sha256 = "sha256-gwKfUa74fIP7j+2eQgnLD7AswjCtOFGHGaIWb4qI0n4=";
+  release."1.2.4".rev    = "v1.2.4";
+  release."1.2.4".sha256 = "sha256-iSW2O1kuunvOqTolmGGXmsYTxo2MJYCdW3BnEhp6Ksg=";

  inherit version;
  defaultVersion = with versions; switch [ coq.version mathcomp.version ] [
+    { cases = [ (isGe "8.11") (isGe "1.11.0") ]; out = "1.2.4"; }
    { cases = [ (isLe "8.13") (pred.inter (isGe "1.11.0") (isLt "1.13")) ]; out = "1.2.3"; }
  ] null;

--- a/pkgs/development/coq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/coq-modules/hierarchy-builder/default.nix
@ -5,10 +5,12 @@ with lib; let hb = mkCoqDerivation {
  owner = "math-comp";
  inherit version;
  defaultVersion = with versions; switch coq.coq-version [
+    { case = isGe "8.15"; out = "1.2.1"; }
    { case = range "8.13" "8.14"; out = "1.2.0"; }
    { case = range "8.12" "8.13"; out = "1.1.0"; }
    { case = isEq "8.11";         out = "0.10.0"; }
  ] null;
+  release."1.2.1".sha256  = "sha256-pQYZJ34YzvdlRSGLwsrYgPdz3p/l5f+KhJjkYT08Mj0=";
  release."1.2.0".sha256  = "0sk01rvvk652d86aibc8rik2m8iz7jn6mw9hh6xkbxlsvh50719d";
  release."1.1.0".sha256  = "sha256-spno5ty4kU4WWiOfzoqbXF8lWlNSlySWcRReR3zE/4Q=";
  release."1.0.0".sha256  = "0yykygs0z6fby6vkiaiv3azy1i9yx4rqg8xdlgkwnf2284hffzpp";
--- a/pkgs/development/coq-modules/interval/default.nix
+++ b/pkgs/development/coq-modules/interval/default.nix
@ -6,11 +6,12 @@ mkCoqDerivation rec {
  domain = "gitlab.inria.fr";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.8" "8.14"; out = "4.3.0"; }
+    { case = isGe "8.8"; out = "4.4.0"; }
    { case = range "8.8" "8.12"; out = "4.0.0"; }
    { case = range "8.7" "8.11"; out = "3.4.2"; }
    { case = range "8.5" "8.6";  out = "3.3.0"; }
  ] null;
+  release."4.4.0".sha256 = "sha256-0+9AatTIEsjul0RXoOw6zWGEbGDVmuy7XuyrZNBZ8Kk=";
  release."4.3.0".sha256 = "sha256-k8DLC4HYYpHeEEgXUafS8jkaECqlM+/CoYaInmUTYko=";
  release."4.2.0".sha256 = "sha256-SD5thgpirs3wmZBICjXGpoefg9AAXyExb5t8tz3iZhE=";
  release."4.1.1".sha256 = "sha256-h2NJ6sZt1C/88v7W2xyuftEDoyRt3H6kqm5g2hc1aoU=";
--- a/pkgs/development/coq-modules/mathcomp-abel/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-abel/default.nix
@ -8,7 +8,7 @@ mkCoqDerivation {

  inherit version;
  defaultVersion = with lib; with versions; switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.10" "8.14") (range "1.12.0" "1.13.0") ]; out = "1.2.0"; }
+      { cases = [ (range "8.10" "8.15") (isGe "1.12.0") ];           out = "1.2.0"; }
      { cases = [ (range "8.10" "8.14") (range "1.11.0" "1.12.0") ]; out = "1.1.2"; }
    ] null;

--- a/pkgs/development/coq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
@ -8,6 +8,7 @@ let mca = mkCoqDerivation {
  pname = "analysis";
  owner = "math-comp";

+  release."0.3.13".sha256 = "sha256-Yaztew79KWRC933kGFOAUIIoqukaZOdNOdw4XszR1Hg=";
  release."0.3.10".sha256 = "sha256-FBH2c8QRibq5Ycw/ieB8mZl0fDiPrYdIzZ6W/A3pIhI=";
  release."0.3.9".sha256 = "sha256-uUU9diBwUqBrNRLiDc0kz0CGkwTZCUmigPwLbpDOeg4=";
  release."0.3.6".sha256 = "0g2j7b2hca4byz62ssgg90bkbc8wwp7xkb2d3225bbvihi92b4c5";
@ -18,6 +19,7 @@ let mca = mkCoqDerivation {

  inherit version;
  defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
+      { cases = [ (isGe "8.13") (isGe "1.12.0") ];      out = "0.3.13"; }
      { cases = [ (range "8.11" "8.14") (isGe "1.12.0") ];      out = "0.3.10"; }
      { cases = [ (range "8.11" "8.13") "1.11.0" ];             out = "0.3.4"; }
      { cases = [ (range "8.10" "8.12") "1.11.0" ];             out = "0.3.3"; }
--- a/pkgs/development/coq-modules/mathcomp-finmap/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
@ -7,7 +7,7 @@ with lib; mkCoqDerivation {
  owner = "math-comp";
  inherit version;
  defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
-      { cases = [ (isGe "8.10")          (range "1.11" "1.13") ]; out = "1.5.1"; }
+      { cases = [ (isGe "8.10")          (isGe "1.11") ];         out = "1.5.1"; }
      { cases = [ (range "8.7" "8.11")   "1.11.0" ];              out = "1.5.0"; }
      { cases = [ (isEq "8.11")          (range "1.8" "1.10") ];  out = "1.4.0+coq-8.11"; }
      { cases = [ (range "8.7" "8.11.0") (range "1.8" "1.10") ];  out = "1.4.0"; }
--- a/pkgs/development/coq-modules/mathcomp-word/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-word/default.nix
@ -14,7 +14,7 @@ mkCoqDerivation {

  inherit version;
  defaultVersion = with versions; switch [ coq.version mathcomp.version ] [
-    { cases = [ (range "8.12" "8.14") (range "1.12" "1.13") ]; out = "1.0"; }
+    { cases = [ (range "8.12" "8.14") (isGe "1.12") ]; out = "1.0"; }
  ] null;

  propagatedBuildInputs = [ mathcomp.algebra ];
--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@ -19,7 +19,8 @@ let
  owner = "math-comp";
  withDoc = single && (args.withDoc or false);
  defaultVersion = with versions; switch coq.coq-version [
-      { case = isGe  "8.14";        out = "1.13.0"; }
+      { case = isGe  "8.11";        out = "1.14.0"; }
+      { case = range "8.11" "8.15"; out = "1.13.0"; }
      { case = range "8.10" "8.13"; out = "1.12.0"; }
      { case = range "8.7"  "8.12"; out = "1.11.0"; }
      { case = range "8.7" "8.11";  out = "1.10.0"; }
@ -29,6 +30,7 @@ let
      { case = range "8.5" "8.7";   out = "1.6.4";  }
    ] null;
  release = {
+    "1.14.0".sha256 = "07yamlp1c0g5nahkd2gpfhammcca74ga2s6qr7a3wm6y6j5pivk9";
    "1.13.0".sha256 = "0j4cz2y1r1aw79snkcf1pmicgzf8swbaf9ippz0vg99a572zqzri";
    "1.12.0".sha256 = "1ccfny1vwgmdl91kz5xlmhq4wz078xm4z5wpd0jy5rn890dx03wp";
    "1.11.0".sha256 = "06a71d196wd5k4wg7khwqb7j7ifr7garhwkd54s86i0j7d6nhl3c";
--- a/pkgs/development/coq-modules/multinomials/default.nix
+++ b/pkgs/development/coq-modules/multinomials/default.nix
@ -9,7 +9,7 @@ with lib; mkCoqDerivation {

  inherit version;
  defaultVersion =  with versions; switch [ coq.version mathcomp.version ] [
-      { cases = [ (range "8.10" "8.14") (isGe "1.12.0") ];      out = "1.5.4"; }
+      { cases = [ (isGe "8.10") (isGe "1.12.0") ];      out = "1.5.5"; }
      { cases = [ (range "8.10" "8.12") "1.12.0" ];             out = "1.5.3"; }
      { cases = [ (range "8.7" "8.12")  "1.11.0" ];             out = "1.5.2"; }
      { cases = [ (range "8.7" "8.11")  (range "1.8" "1.10") ]; out = "1.5.0"; }
@ -17,6 +17,7 @@ with lib; mkCoqDerivation {
      { cases = [ "8.6"                 (range "1.6" "1.7") ];  out = "1.1"; }
    ] null;
  release = {
+    "1.5.5".sha256 = "sha256-VdXA51vr7DZl/wT/15YYMywdD7Gh91dMP9t7ij47qNQ=";
    "1.5.4".sha256 = "0s4sbh4y88l125hdxahr56325hdhxxdmqmrz7vv8524llyv3fciq";
    "1.5.3".sha256 = "1462x40y2qydjd2wcg8r6qr8cx3xv4ixzh2h8vp9h7arylkja1qd";
    "1.5.2".sha256 = "15aspf3jfykp1xgsxf8knqkxv8aav2p39c2fyirw7pwsfbsv2c4s";
--- a/pkgs/development/coq-modules/odd-order/default.nix
+++ b/pkgs/development/coq-modules/odd-order/default.nix
@ -5,11 +5,14 @@ mkCoqDerivation {
  pname = "odd-order";
  owner = "math-comp";

+  release."1.13.0".rev    = "mathcomp-odd-order.1.13.0";
+  release."1.13.0".sha256 = "sha256-EzNKR/JzM8T17sMhPhgZNs14e50X4dY3OwFi133IsT0=";
  release."1.12.0".rev    = "mathcomp-odd-order.1.12.0";
  release."1.12.0".sha256 = "sha256-omsfdc294CxKAHNMMeqJCcVimvyRCHgxcQ4NJOWSfNM=";

  inherit version;
  defaultVersion = with versions; switch mathcomp.character.version [
+    { case = (range "1.12.0" "1.14.0"); out = "1.13.0"; }
    { case = (range "1.10.0" "1.12.0"); out = "1.12.0"; }
  ] null;

--- a/pkgs/development/interpreters/spidermonkey/68.nix
+++ b/pkgs/development/interpreters/spidermonkey/68.nix
@ -1,104 +0,0 @@
-{ lib, stdenv, fetchurl, fetchpatch, autoconf213, pkg-config, perl, python2, python3, zip, buildPackages
-, which, readline, zlib, icu, cargo, rustc, llvmPackages }:
-
-with lib;
-
-let
-  python3Env = buildPackages.python3.withPackages (p: [p.six]);
-in stdenv.mkDerivation rec {
-  pname = "spidermonkey";
-  version = "68.12.0";
-
-  src = fetchurl {
-    url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
-    sha256 = "1k17pi4zh9hrvkzbw4rzzw879a15hpvwriylp75wl22rl7r2nsdf";
-  };
-
-  patches = [
-    # Backport a change from Firefox 75 that fixes finding the
-    # location of clang and libclang.
-    (fetchpatch {
-      url = "https://hg.mozilla.org/mozilla-central/raw-rev/ccd1356fc8f1d0bfa9d896e88d3cc924425623da";
-      sha256 = "005g3mfmal9nw32khrgyiv3221z7pazfhhm2qvgc8d48i2yzj3j0";
-    })
-  ];
-
-  outputs = [ "out" "dev" ];
-  setOutputFlags = false; # Configure script only understands --includedir
-
-  nativeBuildInputs = [
-    autoconf213
-    pkg-config
-    perl
-    which
-    python2
-    zip
-    cargo
-    rustc
-    llvmPackages.llvm
-  ];
-
-  buildInputs = [
-    readline
-    zlib
-    icu
-  ];
-
-  preConfigure = ''
-    export CXXFLAGS="-fpermissive"
-    export LIBXUL_DIST=$out
-    export PYTHON3="${python3Env.interpreter}"
-
-    # We can't build in js/src/, so create a build dir
-    mkdir obj
-    cd obj/
-    configureScript=../js/src/configure
-  '';
-
-  configureFlags = [
-    # Reccommended by gjs upstream
-    "--disable-jemalloc"
-    "--enable-unaligned-private-values"
-    "--with-intl-api"
-    "--enable-posix-nspr-emulation"
-    "--with-system-zlib"
-    "--with-system-icu"
-
-    "--enable-shared-js"
-    "--enable-readline"
-    # Fedora and Arch disable optimize, but it doesn't seme to be necessary
-    # It turns on -O3 which some gcc version had a problem with:
-    # https://src.fedoraproject.org/rpms/mozjs38/c/761399aba092bcb1299bb4fccfd60f370ab4216e
-    "--enable-optimize"
-    "--enable-release"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    # Spidermonkey seems to use different host/build terminology for cross
-    # compilation here.
-    "--host=${stdenv.buildPlatform.config}"
-    "--target=${stdenv.hostPlatform.config}"
-  ];
-
-  # mkDerivation by default appends --build/--host to configureFlags when cross compiling
-  # These defaults are bogus for Spidermonkey - avoid passing them by providing an empty list
-  configurePlatforms = [];
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  # Remove unnecessary static lib
-  preFixup = ''
-    moveToOutput bin/js60-config "$dev"
-    rm $out/lib/libjs_static.ajs
-    ln -s $out/bin/js60 $out/bin/js
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "Mozilla's JavaScript engine written in C/C++";
-    homepage = "https://developer.mozilla.org/en/SpiderMonkey";
-    license = licenses.gpl2; # TODO: MPL/GPL/LGPL tri-license.
-    maintainers = [ maintainers.abbradar ];
-    badPlatforms = [ "riscv32-linux" "riscv64-linux" ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/development/libraries/audio/vamp-plugin-sdk/default.nix
+++ b/pkgs/development/libraries/audio/vamp-plugin-sdk/default.nix
@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
  buildInputs = [ libsndfile ];

  enableParallelBuilding = true;
+  makeFlags = [
+    "AR:=$(AR)"
+    "RANLIB:=$(RANLIB)"
+  ] ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "-o test";

  meta = with lib; {
    description = "Audio processing plugin system for plugins that extract descriptive information from audio data";
--- a/pkgs/development/libraries/dbus-cplusplus/default.nix
+++ b/pkgs/development/libraries/dbus-cplusplus/default.nix
@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
  patches = [
    (fetchurl {
      name = "gcc-4.7.patch";
-      url = "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/dev-libs/"
-          + "dbus-c%2B%2B/files/dbus-c%2B%2B-0.9.0-gcc-4.7.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-libs/"
+          + "dbus-c++/files/dbus-c++-0.9.0-gcc-4.7.patch";
      sha256 = "0rwcz9pvc13b3yfr0lkifnfz0vb5q6dg240bzgf37ni4s8rpc72g";
    })
    (fetchurl {
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, ffmpeg, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
+{ lib, stdenv, buildPackages, ffmpeg, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
 /*
 *  Licensing options (yes some are listed twice, filters and such are not listed)
 */
@ -107,7 +107,7 @@
 , opencore-amr ? null # AMR-NB de/encoder & AMR-WB decoder
 #, opencv ? null # Video filtering
 , openglExtlib ? false, libGL ? null, libGLU ? null # OpenGL rendering
-#, openh264 ? null # H.264/AVC encoder
+, openh264 ? null # H.264/AVC encoder
 , openjpeg ? null # JPEG 2000 de/encoder
 , opensslExtlib ? false, openssl ? null
 , libpulseaudio ? null # Pulseaudio input support
@ -164,7 +164,7 @@
 *
 * Not packaged:
 *   aacplus avisynth cdio-paranoia crystalhd libavc1394 libiec61883
- *   libnut libquvi nvenc opencl openh264 oss shine twolame
+ *   libnut libquvi nvenc opencl oss shine twolame
 *   utvideo vo-aacenc vo-amrwbenc xvmc zvbi blackmagic-design-desktop-video
 *
 * Need fixes to support Darwin:
@ -260,7 +260,7 @@ stdenv.mkDerivation rec {

  configurePlatforms = [];
  configureFlags = [
-    "--target_os=${stdenv.hostPlatform.parsed.kernel.name}"
+    "--target_os=${if stdenv.hostPlatform.isMinGW then "mingw64" else stdenv.hostPlatform.parsed.kernel.name}" #mingw32 and mingw64 doesn't have a difference here, it is internally rewritten as mingw32
    "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
    /*
     *  Licensing flags
@ -282,7 +282,7 @@ stdenv.mkDerivation rec {
    (enableFeature hardcodedTablesBuild "hardcoded-tables")
    (enableFeature safeBitstreamReaderBuild "safe-bitstream-reader")
    (if multithreadBuild then (
-       if isCygwin then
+       if stdenv.hostPlatform.isWindows then
         "--disable-pthreads --enable-w32threads"
       else # Use POSIX threads by default
         "--enable-pthreads --disable-w32threads")
@ -382,7 +382,7 @@ stdenv.mkDerivation rec {
    (enableFeature (opencore-amr != null && version3Licensing) "libopencore-amrnb")
    #(enableFeature (opencv != null) "libopencv")
    (enableFeature openglExtlib "opengl")
-    #(enableFeature (openh264 != null) "openh264")
+    (enableFeature (openh264 != null) "libopenh264")
    (enableFeature (openjpeg != null) "libopenjpeg")
    (enableFeature (opensslExtlib && gplLicensing) "openssl")
    (enableFeature (libpulseaudio != null) "libpulse")
@ -420,6 +420,7 @@ stdenv.mkDerivation rec {
  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    "--cross-prefix=${stdenv.cc.targetPrefix}"
    "--enable-cross-compile"
+    "--host-cc=${buildPackages.stdenv.cc}/bin/cc"
  ] ++ optionals stdenv.cc.isClang [
    "--cc=clang"
    "--cxx=clang++"
@ -433,7 +434,7 @@ stdenv.mkDerivation rec {
    libogg libopus librsvg libssh libtheora libvdpau libvorbis libvpx libwebp libX11
    libxcb libXv libXext xz openal openjpeg libpulseaudio rav1e svt-av1 rtmpdump opencore-amr
    samba SDL2 soxr speex srt vid-stab vo-amrwbenc x264 x265 xavs xvidcore
-    zeromq4 zimg zlib
+    zeromq4 zimg zlib openh264
  ] ++ optionals openglExtlib [ libGL libGLU ]
    ++ optionals nonfreeLicensing [ fdk_aac openssl ]
    ++ optional ((isLinux || isFreeBSD) && libva != null) libva
--- a/pkgs/development/libraries/folks/default.nix
+++ b/pkgs/development/libraries/folks/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , pkg-config
 , meson
 , ninja
@ -36,24 +35,15 @@

 stdenv.mkDerivation rec {
  pname = "folks";
-  version = "0.15.3";
+  version = "0.15.4";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Idc3+vCT9L4GVHPucMogiFuaLDaFlB26JMIjn9PFRKU=";
+    sha256 = "5xCZr8noj61OdXrhNLw/1j4SuQGtYrDtVTavt5Ekr18=";
  };

-  patches = [
-    # Fix build with evolution-data-server ≥ 3.41
-    # https://gitlab.gnome.org/GNOME/folks/-/merge_requests/52
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/folks/-/commit/62d588b0c609de17df5b4d1ebfbc67c456267efc.patch";
-      sha256 = "TDL/5kvVwHnvDMuKDdPLQmpmE1FTZhY+7HG8NxKqt5w=";
-    })
-  ];
-
  nativeBuildInputs = [
    gettext
    gobject-introspection
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, libiconv, xz }:
+{ stdenv, lib, fetchurl, fetchpatch, libiconv, xz }:

 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
  };
  patches = [
    ./absolute-paths.diff
-  ];
+  ] ++ lib.optional stdenv.hostPlatform.isWindows (fetchpatch {
+    url = "https://aur.archlinux.org/cgit/aur.git/plain/gettext_formatstring-ruby.patch?h=mingw-w64-gettext&id=e8b577ee3d399518d005e33613f23363a7df07ee";
+    name = "gettext_formatstring-ruby.patch";
+    sha256 = "sha256-6SxZObOMkQDxuKJuJY+mQ/VuJJxSeGbf97J8ZZddCV0=";
+  });

  outputs = [ "out" "man" "doc" "info" ];

--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -93,6 +93,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    libelf setupHook pcre
+  ] ++ optionals (!stdenv.hostPlatform.isWindows) [
    bash gnum4 # install glib-gettextize and m4 macros for other apps to use
  ] ++ optionals stdenv.isLinux [
    libselinux
@ -143,6 +144,9 @@ stdenv.mkDerivation rec {
    patchShebangs glib/gen-unicode-tables.pl
    patchShebangs tests/gen-casefold-txt.py
    patchShebangs tests/gen-casemap-txt.py
+  '' + lib.optionalString stdenv.hostPlatform.isWindows ''
+    substituteInPlace gio/win32/meson.build \
+      --replace "libintl, " ""
  '';

  DETERMINISTIC_BUILD = 1;
--- a/pkgs/development/libraries/glibc/2.33-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.33-master.patch.gz
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@ -44,7 +44,7 @@

 let
  version = "2.33";
-  patchSuffix = "-62";
+  patchSuffix = "-108";
  sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in

@ -63,7 +63,7 @@ stdenv.mkDerivation ({
    [
      /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
          $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-62-gc493f6a0e4
+          glibc-2.33-108-g3e2a15c666
          $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz

         To compare the archive contents zdiff can be used.
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@ -1,5 +1,5 @@
 { config, lib, stdenv, fetchurl, zlib, lzo, libtasn1, nettle, pkg-config, lzip
-, perl, gmp, autoconf, automake, libidn, libiconv
+, perl, gmp, autoconf, automake, libidn2, libiconv
 , unbound, dns-root-data, gettext, util-linux
 , cxxBindings ? !stdenv.hostPlatform.isStatic # tries to link libstdc++.so
 , guileBindings ? config.gnutls.guile or false, guile
@ -21,11 +21,11 @@ in

 stdenv.mkDerivation rec {
  pname = "gnutls";
-  version = "3.7.2";
+  version = "3.7.3";

  src = fetchurl {
    url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    sha256 = "646e6c5a9a185faa4cea796d378a1ba8e1148dbb197ca6605f95986a25af2752";
+    sha256 = "16n4yvw3792gcdxkikjmhddr6cbs4wlk027zfxlhmchsqcxw8ngw";
  };

  outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@ -71,7 +71,7 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  buildInputs = [ lzo lzip libtasn1 libidn zlib gmp libunistring unbound gettext libiconv ]
+  buildInputs = [ lzo lzip libtasn1 libidn2 zlib gmp libunistring unbound gettext libiconv ]
    ++ lib.optional (withP11-kit) p11-kit
    ++ lib.optional (isDarwin && withSecurity) Security
    ++ lib.optional (tpmSupport && stdenv.isLinux) trousers
--- a/pkgs/development/libraries/jitterentropy/default.nix
+++ b/pkgs/development/libraries/jitterentropy/default.nix
@ -1,37 +1,31 @@
 { lib, stdenv, fetchFromGitHub }:
+
 stdenv.mkDerivation rec {
  pname = "jitterentropy";
-  version = "2.2.0";
+  version = "3.3.1";

  src = fetchFromGitHub {
    owner = "smuellerDD";
    repo = "jitterentropy-library";
    rev = "v${version}";
-    sha256 = "0n2l1fxr7bynnarpwdjifb2fvlsq8w5wmfh31yk5nrc756cjlgyw";
+    hash = "sha256-go7eGwBoZ58LkgKL7t8oZSc1cFlE6fPOT/ML3Aa8+CM=";
  };
-  patches = [
-    # Can be removed when upgrading beyond 2.2.0
-    ./reproducible-manpages.patch
-  ];
+
+  outputs = [ "out" "dev" ];

  enableParallelBuilding = true;
-
-  preInstall = ''
-    mkdir -p $out/include
-    substituteInPlace Makefile \
-      --replace "install -m 0755 -s" \
-                'install -m 0755 -s --strip-program $(STRIP)'
-  '';
+  hardeningDisable = [ "fortify" ]; # avoid warnings

  installFlags = [
-    "PREFIX=$(out)"
+    "PREFIX=${placeholder "out"}"
  ];

-  meta = {
+  meta = with lib; {
    description = "Provides a noise source using the CPU execution timing jitter";
    homepage = "https://github.com/smuellerDD/jitterentropy-library";
-    license = with lib.licenses; [ gpl2 bsd3 ];
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ johnazoidberg ];
+    changelog = "https://github.com/smuellerDD/jitterentropy-library/raw/v${version}/CHANGES.md";
+    license = with licenses; [ bsd3 /* OR */ gpl2Only ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ johnazoidberg c0bw3b ];
  };
 }
--- a/pkgs/development/libraries/jitterentropy/reproducible-manpages.patch
+++ b/pkgs/development/libraries/jitterentropy/reproducible-manpages.patch
@ -1,13 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 4ff069b..3b8714a 100644
--- a/Makefile
-+++ b/Makefile
-@@ -58,7 +58,7 @@ cppcheck:
- install:
- 	install -d -m 0755 $(DESTDIR)$(PREFIX)/share/man/man3
- 	install -m 644 doc/$(NAME).3 $(DESTDIR)$(PREFIX)/share/man/man3/
-	gzip -9 $(DESTDIR)$(PREFIX)/share/man/man3/$(NAME).3
-+	gzip -n -9 $(DESTDIR)$(PREFIX)/share/man/man3/$(NAME).3
- 	install -d -m 0755 $(DESTDIR)$(PREFIX)/$(LIBDIR)
- 	install -m 0755 -s lib$(NAME).so.$(LIBVERSION) $(DESTDIR)$(PREFIX)/$(LIBDIR)/
- 	install -d -m 0755 $(DESTDIR)$(PREFIX)/$(INCDIR)
--- a/pkgs/development/libraries/libproxy/default.nix
+++ b/pkgs/development/libraries/libproxy/default.nix
@ -5,8 +5,8 @@
 , zlib
 , dbus
 , networkmanager
-, enableJavaScript ? stdenv.isDarwin || lib.meta.availableOn stdenv.hostPlatform spidermonkey_68
-, spidermonkey_68
+, enableJavaScript ? stdenv.isDarwin || lib.meta.availableOn stdenv.hostPlatform spidermonkey_78
+, spidermonkey_78
 , pcre
 , gsettings-desktop-schemas
 , glib
@ -17,9 +17,7 @@
 , JavaScriptCore
 }:

-let
-  jsRuntime = if stdenv.hostPlatform.isDarwin then JavaScriptCore else spidermonkey_68;
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "libproxy";
  version = "0.4.17";

@ -43,7 +41,7 @@ in stdenv.mkDerivation rec {
    python3
    zlib
  ] ++ lib.optionals enableJavaScript [
-    jsRuntime
+    (if stdenv.hostPlatform.isDarwin then JavaScriptCore else spidermonkey_78)
  ] ++ (if stdenv.hostPlatform.isDarwin then [
    SystemConfiguration
    CoreFoundation
--- a/pkgs/development/libraries/librtlsdr/default.nix
+++ b/pkgs/development/libraries/librtlsdr/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config cmake ];

-  buildInputs = [ libusb1 ];
+  propagatedBuildInputs = [ libusb1 ];

  meta = with lib; {
    description = "Turns your Realtek RTL2832 based DVB dongle into a SDR receiver";
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -33,7 +33,7 @@ with lib;
 let
  # Release calendar: https://www.mesa3d.org/release-calendar.html
  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.3.4";
+  version = "21.3.5";
  branch  = versions.major version;

 self = stdenv.mkDerivation {
@ -47,7 +47,7 @@ self = stdenv.mkDerivation {
      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
    ];
-    sha256 = "0zd6skf9qcwlk1k1ljgwijwlyz5si3pgi0h97gd6kkivm7a4y43p";
+    sha256 = "0k2ary16ixsrp65m2n5djpr51nbwdgzpv81pfrnqbvk44jfjlfyr";
  };

  # TODO:
--- a/pkgs/development/libraries/neon/0.29.nix
+++ b/pkgs/development/libraries/neon/0.29.nix
@ -1,49 +0,0 @@
-{ lib, stdenv, fetchurl, libxml2, pkg-config, perl
-, compressionSupport ? true, zlib ? null
-, sslSupport ? true, openssl ? null
-, static ? false
-, shared ? true
-}:
-
-assert compressionSupport -> zlib != null;
-assert sslSupport -> openssl != null;
-assert static || shared;
-
-let
-   inherit (lib) optionals;
-in
-
-stdenv.mkDerivation rec {
-  version = "0.29.6";
-  pname = "neon";
-
-  src = fetchurl {
-    url = "http://www.webdav.org/neon/${pname}-${version}.tar.gz";
-    sha256 = "0hzbjqdx1z8zw0vmbknf159wjsxbcq8ii0wgwkqhxj3dimr0nr4w";
-  };
-
-  patches = optionals stdenv.isDarwin [ ./0.29.6-darwin-fix-configure.patch ];
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [libxml2 openssl]
-    ++ lib.optional compressionSupport zlib;
-
-  configureFlags = [
-    (lib.enableFeature shared "shared")
-    (lib.enableFeature static "static")
-    (lib.withFeature compressionSupport "zlib")
-    (lib.withFeature sslSupport "ssl")
-  ];
-
-  passthru = {inherit compressionSupport sslSupport;};
-
-  checkInputs = [ perl ];
-  doCheck = false; # fails, needs the net
-
-  meta = with lib; {
-    description = "An HTTP and WebDAV client library";
-    homepage = "http://www.webdav.org/neon/";
-    platforms = platforms.unix;
-    license = licenses.lgpl2;
-  };
-}
--- a/pkgs/development/libraries/neon/0.29.6-darwin-fix-configure.patch
+++ b/pkgs/development/libraries/neon/0.29.6-darwin-fix-configure.patch
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    sha256 = "0y46dbhiblcvg8k41bdydr3fivghwk73z040ki5825d24ynf67ng";
  };

-  patches = optionals stdenv.isDarwin [ ./0.29.6-darwin-fix-configure.patch ];
+  patches = optionals stdenv.isDarwin [ ./darwin-fix-configure.patch ];

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [libxml2 openssl]
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, nasm }:
+{ lib, stdenv, fetchFromGitHub, nasm, windows }:

 stdenv.mkDerivation rec {
  pname = "openh264";
@ -13,10 +13,16 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ nasm ];

+  buildInputs = lib.optional stdenv.hostPlatform.isWindows windows.pthreads;
+
  makeFlags = [
    "PREFIX=${placeholder "out"}"
    "ARCH=${stdenv.hostPlatform.linuxArch}"
-  ];
+  ] ++ lib.optional stdenv.hostPlatform.isWindows "OS=mingw_nt";
+
+  enableParallelBuilding = true;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isWindows "stackprotector";

  meta = with lib; {
    description = "A codec library which supports H.264 encoding and decoding";
--- a/pkgs/development/libraries/qpdf/default.nix
+++ b/pkgs/development/libraries/qpdf/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "qpdf";
-  version = "10.3.2";
+  version = "10.4.0";

  src = fetchFromGitHub {
    owner = "qpdf";
    repo = "qpdf";
    rev = "release-qpdf-${version}";
-    sha256 = "sha256-fhn6hE/MLYiaOxZYfaVcj17V+h8Yvn18QTewS0rPIXE=";
+    sha256 = "sha256-IYXH1Pcd0eRzlbRouAB17wsCUGNuIlJfwJLbXiaC5dk=";
  };

  nativeBuildInputs = [ perl ];
--- a/pkgs/development/libraries/tracker-miners/default.nix
+++ b/pkgs/development/libraries/tracker-miners/default.nix
@ -127,7 +127,6 @@ stdenv.mkDerivation rec {
  passthru = {
    updateScript = gnome.updateScript {
      packageName = pname;
-      versionPolicy = "none";
    };
  };

--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@ -132,7 +132,6 @@ stdenv.mkDerivation rec {
  passthru = {
    updateScript = gnome.updateScript {
      packageName = pname;
-      versionPolicy = "none";
    };
  };

--- a/pkgs/development/libraries/xbase/default.nix
+++ b/pkgs/development/libraries/xbase/default.nix
@ -13,15 +13,15 @@ stdenv.mkDerivation rec {
  patches = [
    ./xbase-fixes.patch
    (fetchurl {
-      url = "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/dev-db/xbase/files/xbase-3.1.2-gcc47.patch?revision=1.1";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-db/xbase/files/xbase-3.1.2-gcc47.patch?id=0b9005ad4b5b743707922877e5157ba6ecdf224f";
      sha256 = "1kpcrkkcqdwl609yd0qxlvp743icz3vni13993sz6fkgn5lah8yl";
    })
    (fetchurl {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-db/xbase/files/xbase-3.1.2-gcc6.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-db/xbase/files/xbase-3.1.2-gcc6.patch?id=0b9005ad4b5b743707922877e5157ba6ecdf224f";
      sha256 = "1994pqiip5njkcmm5czb1bg6zdldkx1mpandgmvzqrja0iacf953";
    })
    (fetchurl {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-db/xbase/files/xbase-3.1.2-gcc7.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-db/xbase/files/xbase-3.1.2-gcc7.patch?id=0b9005ad4b5b743707922877e5157ba6ecdf224f";
      sha256 = "1304gn9dbdv8xf61crkg0fc8cal0h4qkyhlbqa8y618w134cxh1q";
    })
  ];
--- a/pkgs/development/ocaml-modules/phylogenetics/default.nix
+++ b/pkgs/development/ocaml-modules/phylogenetics/default.nix
@ -11,7 +11,7 @@
 , lacaml
 , menhir
 , menhirLib
-, printbox
+, printbox-text
 }:

 buildDunePackage rec {
@ -25,6 +25,11 @@ buildDunePackage rec {
    sha256 = "sha256:0knfh2s0jfnsc0vsq5yw5xla7m7i98xd0qv512dyh3jhkh7m00l9";
  };

+  # Ensure compatibility with printbox ≥ 0.6
+  preConfigure = ''
+    substituteInPlace lib/dune --replace printbox printbox-text
+  '';
+
  minimalOCamlVersion = "4.08";

  checkInputs = [ alcotest bppsuite ];
@ -37,7 +42,7 @@ buildDunePackage rec {
    lacaml
    menhirLib
    ppx_deriving
-    printbox
+    printbox-text
  ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/printbox/default.nix
+++ b/pkgs/development/ocaml-modules/printbox/default.nix
@ -1,21 +1,21 @@
-{ lib, fetchFromGitHub, buildDunePackage, ocaml, uucp, uutf, mdx }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml, mdx }:

 buildDunePackage rec {
  pname = "printbox";
-  version = "0.5";
+  version = "0.6";

  useDune2 = true;

-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.03";

  src = fetchFromGitHub {
    owner = "c-cube";
    repo = pname;
-    rev = version;
-    sha256 = "099yxpp7d9bms6dwzp9im7dv1qb801hg5rx6awpx3rpfl4cvqfn2";
+    rev = "v${version}";
+    sha256 = "sha256:0vqp8j1vp8h8par699nnh31hnikzh6pqn07lqyxw65axqy3sc9dp";
  };

-  checkInputs = [ uucp uutf mdx.bin ];
+  checkInputs = [ mdx.bin ];

  # mdx is not available for OCaml < 4.07
  doCheck = lib.versionAtLeast ocaml.version "4.07";
--- a/pkgs/development/ocaml-modules/printbox/text.nix
+++ b/pkgs/development/ocaml-modules/printbox/text.nix
@ -0,0 +1,14 @@
+{ buildDunePackage, printbox, uucp, uutf, mdx }:
+
+buildDunePackage {
+  pname = "printbox-text";
+  inherit (printbox) src version useDune2 doCheck;
+
+  propagatedBuildInputs = [ printbox uucp uutf ];
+
+  checkInputs = [ mdx.bin ];
+
+  meta = printbox.meta // {
+    description = "Text renderer for printbox, using unicode edges";
+  };
+}
--- a/pkgs/development/perl-modules/findimagedupes/default.nix
+++ b/pkgs/development/perl-modules/findimagedupes/default.nix
@ -0,0 +1,70 @@
+{ lib, stdenv, fetchurl, makeWrapper, perl, perlPackages, installShellFiles }:
+
+stdenv.mkDerivation rec {
+  pname = "findimagedupes";
+  version = "2.19.1";
+
+  # fetching this from GitHub does not contain the correct version number
+  src = fetchurl {
+    url = "http://www.jhnc.org/findimagedupes/findimagedupes-${version}.tar.gz";
+    sha256 = "sha256-5NBPoXNZays5wzpQYar4uZZb0P/zB7fdecE+SjkJjcI=";
+  };
+
+  # Work around the "unpacker appears to have produced no directories"
+  setSourceRoot = "sourceRoot=$(pwd)";
+
+  nativeBuildInputs = [ makeWrapper installShellFiles ];
+
+  buildInputs = [ perl ] ++ (with perlPackages; [
+    DBFile
+    FileMimeInfo
+    FileBaseDir
+    #GraphicsMagick
+    ImageMagick
+    Inline
+    InlineC
+    ParseRecDescent
+  ]);
+
+  # use /tmp as a storage
+  # replace GraphicsMagick with ImageMagick, because perl bindings are not yet available
+  postPatch = ''
+    substituteInPlace findimagedupes \
+      --replace "DIRECTORY => '/usr/local/lib/findimagedupes';" "DIRECTORY => '/tmp';" \
+      --replace "Graphics::Magick" "Image::Magick"
+  '';
+
+  buildPhase = "
+    runHook preBuild
+    ${perl}/bin/pod2man findimagedupes > findimagedupes.1
+    runHook postBuild
+  ";
+
+  installPhase = ''
+    runHook preInstall
+    install -D -m 755 findimagedupes $out/bin/findimagedupes
+    installManPage findimagedupes.1
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/findimagedupes" \
+      --prefix PERL5LIB : "${with perlPackages; makePerlPath [
+        DBFile
+        FileMimeInfo
+        FileBaseDir
+        #GraphicsMagick
+        ImageMagick
+        Inline
+        InlineC
+        ParseRecDescent
+      ]}"
+  '';
+
+  meta = with lib; {
+    homepage = "http://www.jhnc.org/findimagedupes/";
+    description = "Finds visually similar or duplicate images";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ stunkymonkey ];
+  };
+}
--- a/pkgs/development/php-packages/xdebug/default.nix
+++ b/pkgs/development/php-packages/xdebug/default.nix
@ -3,8 +3,8 @@
 buildPecl {
  pname = "xdebug";

-  version = "3.1.2";
-  sha256 = "sha256-CD9r4RAN95zL3wSdr8OTC6s18OuA+bGawa2E+md5zPM=";
+  version = "3.1.3";
+  sha256 = "sha256-N9CmcBlV9bNAbGwye3cCvXwhRi5lbztMziSgUlgBPU4=";

  doCheck = true;
  checkTarget = "test";
--- a/pkgs/development/python-modules/adguardhome/default.nix
+++ b/pkgs/development/python-modules/adguardhome/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "adguardhome";
-  version = "0.5.0";
+  version = "0.5.1";
  format = "pyproject";
  disabled = pythonOlder "3.8";

@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "frenck";
    repo = "python-${pname}";
    rev = "v${version}";
-    sha256 = "sha256-f8uZF4DXbfiL1nL82shjGNpo6lXSUomRgO1YnNT/GDw=";
+    sha256 = "sha256-HAgt52Bo2NOUkpr5xvWTcRyrLKpfcBDlVAZxgDNI7hY=";
  };

  nativeBuildInputs = [ poetry-core ];
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, pythonOlder
+{ lib, stdenv, buildPythonPackage, fetchPypi, fetchpatch, pythonOlder
 , fonttools, defcon, lxml, fs, unicodedata2, zopfli, brotlipy, fontpens
 , brotli, fontmath, mutatormath, booleanoperations
 , ufoprocessor, ufonormalizer, psautohint, tqdm
@ -37,8 +37,15 @@ buildPythonPackage rec {
  patches = [
    # Don't try to install cmake and ninja using pip
    ./no-pypi-build-tools.patch
+
    # Use antlr4 runtime from nixpkgs and link it dynamically
    ./use-dynamic-system-antlr4-runtime.patch
+
+    # Fix compatibility with latest fonttools.
+    (fetchpatch {
+      url = "https://github.com/adobe-type-tools/afdko/commit/120752c50a562e4f6c12ff4be1e3bd96ed664e82.patch";
+      sha256 = "RDGIpNAuCmK+zqZOeOK7ddCjr9BuqPpcnbnxdtoE48M=";
+    })
  ];

  # setup.py will always (re-)execute cmake in buildPhase
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.1.11611";
+  version = "9.1.11752";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-DN4oH3Ajppj3YDDj8O+WxBS2/5qKvmrK0OTLOdhAmww=";
+    hash = "sha256-UbcPxYEyuX8W0uZXeCu00yBshdcPBAQKzZqhAYXTf+8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aladdin-connect/default.nix
+++ b/pkgs/development/python-modules/aladdin-connect/default.nix
@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "aladdin-connect";
-  version = "0.3";
+  version = "0.4";

  src = fetchFromGitHub {
    owner = "shoejosh";
    repo = pname;
    rev = version;
-    sha256 = "0nimd1nw1haxn8s2207fcrmpjyfp6nx97n560l6hzqyqqmf2d1d1";
+    sha256 = "sha256-kLvMpSGa5WyDOH3ejAJyFGsB9IiMXp+nvVxM/ZkxyFw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -46,7 +46,7 @@ in

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.1.11611";
+  version = "9.1.11752";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -55,7 +55,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-oPRytvSOjUoBUSQOFu5B/OljqmAk/rcRBl/oU+aSZjw=";
+    hash = "sha256-4DUM1c3M/naJFqN/gdrX/NnJrY3ElUEOQ34cwcpSC+s=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/angrop/default.nix
+++ b/pkgs/development/python-modules/angrop/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "angrop";
-  version = "9.1.11611";
+  version = "9.1.11752";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-hG/Im+gYBXIs1o7cw6LDS9nb2HPYjnSd7g8bpVG6rkE=";
+    hash = "sha256-nZGAuWp07VMpOvqw38FGSiUhaFjJOfCzOaam4Ex7qbY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.1.11611";
+  version = "9.1.11752";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-yIF9a63p8QnR1FazP/J8j9W8XnYAjWD9AKZHTGc4BfQ=";
+    hash = "sha256-D1YssHa14q2jxn4HtOYZlTdwGPkiiMhWuOh08fj87ic=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "boschshcpy";
-  version = "0.2.28";
+  version = "0.2.29";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "tschamm";
    repo = pname;
    rev = version;
-    sha256 = "sha256-CnfJiYUM8A4QZ6VMtekO8nD5tQ2VL9vMeK6OWYcgwmU=";
+    sha256 = "sha256-x+TXHG7xJWd5t6pKQ/6X48lOuIQWUnEwsySFRh5GJnE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cffsubr/default.nix
+++ b/pkgs/development/python-modules/cffsubr/default.nix
@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fonttools
+, pytestCheckHook
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "cffsubr";
+  version = "0.2.9.post1";
+
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "azFBLc9JyPqEZkvahn4u3cVbb+b6aW/yU8TxOp/y/Fw=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    fonttools
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "cffsubr" ];
+
+  meta = with lib; {
+    description = "Standalone CFF subroutinizer based on AFDKO tx";
+    homepage = "https://github.com/adobe-type-tools/cffsubr";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jtojnar ];
+  };
+}
--- a/pkgs/development/python-modules/chiapos/default.nix
+++ b/pkgs/development/python-modules/chiapos/default.nix
@ -15,12 +15,12 @@

 buildPythonPackage rec {
  pname = "chiapos";
-  version = "1.0.8";
+  version = "1.0.9";
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "64529b7f03e9ec0c1b9be7c7c1f30d4498e5d931ff2dbb10a9cc4597029d69f0";
+    sha256 = "sha256-emEHIR74RiIDK04etO/6G7tjzTufOVl4rLRWbEsQit0=";
  };

  patches = [
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.1.11611";
+  version = "9.1.11752";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-i2JrV9FEQyAzjdQUJb/b9MnET5h4ISTkcwc3n9poqtI=";
+    sha256 = "sha256-Z50oKwS0MZVBEUeXfj9cgtPYXFAYf4i7QkgJiXdWrxo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -15,7 +15,7 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.1.11611";
+  version = "9.1.11752";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
@ -37,7 +37,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-0yuPY90YEgQvtcmQDPqCpBmKf4ZryJocwMr0O1upiS4=";
+    hash = "sha256-pnbFnv/te7U2jB6gNRvE9DQssBkFsara1g6Gtqf+WVo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/compreffor/default.nix
+++ b/pkgs/development/python-modules/compreffor/default.nix
@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, fonttools
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "compreffor";
+  version = "0.5.1.post1";
+
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "Zqia+yP4Dp5VNGeMwv+j04aNm9oVmZ2juehbfEzDfOQ=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    fonttools
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # Tests cannot seem to open the cpython module.
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "compreffor"
+  ];
+
+  meta = with lib; {
+    description = "CFF table subroutinizer for FontTools";
+    homepage = "https://github.com/googlefonts/compreffor";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jtojnar ];
+  };
+}
--- a/Show More
+++ b/Show More