Merge branch 'staging-next' into staging

2024-11-26 00:43:20 +00:00 · 2020-09-20 18:41:15 -04:00 · 2020-09-20 18:41:15 -04:00 · 34aaac6d7c
commit 34aaac6d7c
parent 0cc9dd7c16 a930a6d7ee
394 changed files with 17286 additions and 6709 deletions
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@ -50,32 +50,35 @@ in {

  none = [];

-  arm     = filterDoubles predicates.isAarch32;
-  aarch64 = filterDoubles predicates.isAarch64;
-  x86     = filterDoubles predicates.isx86;
-  i686    = filterDoubles predicates.isi686;
-  x86_64  = filterDoubles predicates.isx86_64;
-  mips    = filterDoubles predicates.isMips;
-  riscv   = filterDoubles predicates.isRiscV;
-  vc4     = filterDoubles predicates.isVc4;
-  js      = filterDoubles predicates.isJavaScript;
+  arm           = filterDoubles predicates.isAarch32;
+  aarch64       = filterDoubles predicates.isAarch64;
+  x86           = filterDoubles predicates.isx86;
+  i686          = filterDoubles predicates.isi686;
+  x86_64        = filterDoubles predicates.isx86_64;
+  mips          = filterDoubles predicates.isMips;
+  riscv         = filterDoubles predicates.isRiscV;
+  vc4           = filterDoubles predicates.isVc4;
+  js            = filterDoubles predicates.isJavaScript;

-  cygwin  = filterDoubles predicates.isCygwin;
-  darwin  = filterDoubles predicates.isDarwin;
-  freebsd = filterDoubles predicates.isFreeBSD;
+  bigEndian     = filterDoubles predicates.isBigEndian;
+  littleEndian  = filterDoubles predicates.isLittleEndian;
+
+  cygwin        = filterDoubles predicates.isCygwin;
+  darwin        = filterDoubles predicates.isDarwin;
+  freebsd       = filterDoubles predicates.isFreeBSD;
  # Should be better, but MinGW is unclear.
-  gnu     = filterDoubles (matchAttrs { kernel = parse.kernels.linux; abi = parse.abis.gnu; }) ++ filterDoubles (matchAttrs { kernel = parse.kernels.linux; abi = parse.abis.gnueabi; }) ++ filterDoubles (matchAttrs { kernel = parse.kernels.linux; abi = parse.abis.gnueabihf; });
-  illumos = filterDoubles predicates.isSunOS;
-  linux   = filterDoubles predicates.isLinux;
-  netbsd  = filterDoubles predicates.isNetBSD;
-  openbsd = filterDoubles predicates.isOpenBSD;
-  unix    = filterDoubles predicates.isUnix;
-  wasi    = filterDoubles predicates.isWasi;
-  redox   = filterDoubles predicates.isRedox;
-  windows = filterDoubles predicates.isWindows;
-  genode  = filterDoubles predicates.isGenode;
+  gnu           = filterDoubles (matchAttrs { kernel = parse.kernels.linux; abi = parse.abis.gnu; }) ++ filterDoubles (matchAttrs { kernel = parse.kernels.linux; abi = parse.abis.gnueabi; }) ++ filterDoubles (matchAttrs { kernel = parse.kernels.linux; abi = parse.abis.gnueabihf; });
+  illumos       = filterDoubles predicates.isSunOS;
+  linux         = filterDoubles predicates.isLinux;
+  netbsd        = filterDoubles predicates.isNetBSD;
+  openbsd       = filterDoubles predicates.isOpenBSD;
+  unix          = filterDoubles predicates.isUnix;
+  wasi          = filterDoubles predicates.isWasi;
+  redox         = filterDoubles predicates.isRedox;
+  windows       = filterDoubles predicates.isWindows;
+  genode        = filterDoubles predicates.isGenode;

-  embedded = filterDoubles predicates.isNone;
+  embedded      = filterDoubles predicates.isNone;

  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "armv7a-linux" "aarch64-linux" "powerpc64le-linux"];
 }
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2233,6 +2233,12 @@
      fingerprint = "4749 0887 CF3B 85A1 6355  C671 78C7 DD40 DF23 FB16";
    }];
  };
+  dpercy = {
+    email = "dpercy@dpercy.dev";
+    github = "dpercy";
+    githubId = 349909;
+    name = "David Percy";
+  };
  dpflug = {
    email = "david@pflug.email";
    github = "dpflug";
@ -2799,6 +2805,16 @@
    githubId = 541748;
    name = "Felipe Espinoza";
  };
+  felschr = {
+    email = "dev@felschr.com";
+    github = "felschr";
+    githubId = 3314323;
+    name = "Felix Tenley";
+    keys = [{
+      longkeyid = "ed25519/0x910ACB9F6BD26F58";
+      fingerprint = "6AB3 7A28 5420 9A41 82D9  0068 910A CB9F 6BD2 6F58";
+    }];
+  };
  ffinkdevs = {
    email = "fink@h0st.space";
    github = "ffinkdevs";
@ -4086,12 +4102,6 @@
    githubId = 1843676;
    name = "Jonathan Reeve";
  };
-  joncojonathan = {
-    email = "joncojonathan@gmail.com";
-    github = "joncojonathan";
-    githubId = 11414454;
-    name = "Jonathan Haddock";
-  };
  jonringer = {
    email = "jonringer117@gmail.com";
    github = "jonringer";
@ -5536,10 +5546,14 @@
    name = "Michael Mercier";
  };
  midchildan = {
-    email = "midchildan+nix@gmail.com";
+    email = "git@midchildan.org";
    github = "midchildan";
    githubId = 7343721;
    name = "midchildan";
+    keys = [{
+      longkeyid = "rsa4096/0x186A1EDAC5C63F83";
+      fingerprint = "FEF0 AE2D 5449 3482 5F06  40AA 186A 1EDA C5C6 3F83";
+    }];
  };
  mikefaille = {
    email = "michael@faille.io";
@ -5671,6 +5685,12 @@
    githubId = 622577;
    name = "Michael Lieberman";
  };
+  mlvzk = {
+    name = "mlvzk";
+    email = "mlvzk@users.noreply.github.com";
+    github = "mlvzk";
+    githubId = 44906333;
+  };
  mmahut = {
    email = "marek.mahut@gmail.com";
    github = "mmahut";
@ -5683,6 +5703,12 @@
    githubId = 117842;
    name = "Henri Bourcereau";
  };
+  mmesch = {
+    email = "mmesch@noreply.github.com";
+    github = "mmesch";
+    githubId = 2597803;
+    name = "Matthias Meschede";
+  };
  mmilata = {
    email = "martin@martinmilata.cz";
    github = "mmilata";
@ -5899,6 +5925,12 @@
    githubId = 2176611;
    name = "Marko Poikonen";
  };
+  mtreca = {
+    email = "maxime@treca.dev";
+    name = "Maxime Tréca";
+    github = "mtreca";
+    githubId = 16440823;
+  };
  mtreskin = {
    email = "zerthurd@gmail.com";
    github = "Zert";
@ -6057,6 +6089,16 @@
    githubId = 8214542;
    name = "Nicolò Balzarotti";
  };
+  NieDzejkob = {
+    email = "kuba@kadziolka.net";
+    github = "NieDzejkob";
+    githubId = 23580910;
+    name = "Jakub Kądziołka";
+    keys = [{
+      longkeyid = "rsa4096/0xE315A75846131564";
+      fingerprint = "E576 BFB2 CF6E B13D F571  33B9 E315 A758 4613 1564";
+    }];
+  };
  NikolaMandic = {
    email = "nikola@mandic.email";
    github = "NikolaMandic";
@ -6111,6 +6153,12 @@
    githubId = 6930756;
    name = "Nicolas Mattia";
  };
+  nobbz = {
+    name = "Norbert Melzer";
+    email = "timmelzer+nixpkgs@gmail.com";
+    github = "NobbZ";
+    githubId = 58951;
+  };
  nocent = {
    email = "nocent@protonmail.ch";
    github = "nocent";
@ -7989,6 +8037,12 @@
    githubId = 231788;
    name = "Stephen Weinberg";
  };
+  stephenwithph = {
+    name = "StephenWithPH";
+    email = "StephenWithPH@users.noreply.github.com";
+    github = "StephenWithPH";
+    githubId = 2990492;
+  };
  sterfield = {
    email = "sterfield@gmail.com";
    github = "sterfield";
--- a/maintainers/scripts/build.nix
+++ b/maintainers/scripts/build.nix
@ -13,8 +13,12 @@ let
          let
            result = builtins.tryEval
              (
-                if pkgs.lib.isDerivation pkg && cond name pkg
-                then [ (return name pkg) ]
+                if pkgs.lib.isDerivation pkg && cond name pkg then
+                  # Skip packages whose closure fails on evaluation.
+                  # This happens for pkgs like `python27Packages.djangoql`
+                  # that have disabled Python pkgs as dependencies.
+                  builtins.seq pkg.outPath
+                    [ (return name pkg) ]
                else if pkg.recurseForDerivations or false || pkg.recurseForRelease or false
                then packagesWith cond return pkg
                else [ ]
--- a/nixos/doc/manual/configuration/gpu-accel.xml
+++ b/nixos/doc/manual/configuration/gpu-accel.xml
@ -183,7 +183,12 @@ GPU1:
 	be forced as follows:

 	<programlisting><xref linkend="opt-hardware.opengl.extraPackages"/> = [
-  <package>amdvlk</package>
+  pkgs.<package>amdvlk</package>
+];
+
+# To enable Vulkan support for 32-bit applications, also add:
+<xref linkend="opt-hardware.opengl.extraPackages32"/> = [
+  pkgs.driversi686Linux.<package>amdvlk</package>
 ];

 # For amdvlk
--- a/nixos/doc/manual/development/writing-nixos-tests.xml
+++ b/nixos/doc/manual/development/writing-nixos-tests.xml
@ -43,7 +43,7 @@ xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix">
  console, whether device ownership is correctly maintained when switching
  between consoles, and so on. On the other hand,
  <filename
-xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs.nix">nfs.nix</filename>,
+xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix">nfs/simple.nix</filename>,
  which tests NFS client and server functionality in the Linux kernel
  (including whether locks are maintained across server crashes), requires
  three machines: a server and two clients.
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -26,6 +26,12 @@
   <listitem>
    <para>GNOME desktop environment was upgraded to 3.36, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.36/">release notes</link>.</para>
   </listitem>
+   <listitem>
+     <para>
+     The Cinnamon desktop environment (v4.6) has been added. <varname>services.xserver.desktopManager.cinnamon.enable = true;</varname> to try it out!
+     Remember that, with any new feature it's possible you could run into issues, so please send all support requests to <link xlink:href="https://github.com/NixOS/nixpkgs/issues">github.com/NixOS/nixpkgs</link> to notify the maintainers.
+     </para>
+   </listitem>
   <listitem>
    <para>
      Quickly configure a complete, private, self-hosted video
--- a/nixos/lib/build-vms.nix
+++ b/nixos/lib/build-vms.nix
@ -3,8 +3,10 @@
  minimal ? false
 , # Ignored
  config ? null
-  # Nixpkgs, for qemu, lib and more
-, pkgs
+, # Nixpkgs, for qemu, lib and more
+  pkgs
+, # !!! See comment about args in lib/modules.nix
+  specialArgs ? {}
 , # NixOS configuration to add to the VMs
  extraConfigurations ? []
 }:
@ -31,7 +33,7 @@ rec {
    nodes: configurations:

    import ./eval-config.nix {
-      inherit system;
+      inherit system specialArgs;
      modules = configurations ++ extraConfigurations;
      baseModules =  (import ../modules/module-list.nix) ++
        [ ../modules/virtualisation/qemu-vm.nix
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@ -4,10 +4,12 @@
 , minimal ? false
  # Ignored
 , config ? {}
+  # !!! See comment about args in lib/modules.nix
+, specialArgs ? {}
  # Modules to add to each VM
 , extraConfigurations ? [] }:

-with import ./build-vms.nix { inherit system pkgs minimal extraConfigurations; };
+with import ./build-vms.nix { inherit system pkgs minimal specialArgs extraConfigurations; };
 with pkgs;

 rec {
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -184,7 +184,7 @@ in
      consul = 145;
      mailpile = 146;
      redmine = 147;
-      seeks = 148;
+      #seeks = 148; # removed 2020-06-21
      prosody = 149;
      i2pd = 150;
      systemd-network = 152;
@ -497,7 +497,7 @@ in
      #consul = 145; # unused
      mailpile = 146;
      redmine = 147;
-      seeks = 148;
+      #seeks = 148; # removed 2020-06-21
      prosody = 149;
      i2pd = 150;
      systemd-network = 152;
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -637,7 +637,6 @@
  ./services/networking/gvpe.nix
  ./services/networking/hans.nix
  ./services/networking/haproxy.nix
-  ./services/networking/heyefi.nix
  ./services/networking/hostapd.nix
  ./services/networking/htpdate.nix
  ./services/networking/hylafax/default.nix
@ -725,7 +724,6 @@
  ./services/networking/rxe.nix
  ./services/networking/sabnzbd.nix
  ./services/networking/searx.nix
-  ./services/networking/seeks.nix
  ./services/networking/skydns.nix
  ./services/networking/shadowsocks.nix
  ./services/networking/shairport-sync.nix
@ -838,6 +836,7 @@
  ./services/ttys/gpm.nix
  ./services/ttys/kmscon.nix
  ./services/wayland/cage.nix
+  ./services/video/epgstation/default.nix
  ./services/video/mirakurun.nix
  ./services/web-apps/atlassian/confluence.nix
  ./services/web-apps/atlassian/crowd.nix
@ -1027,6 +1026,7 @@
  ./virtualisation/podman.nix
  ./virtualisation/qemu-guest-agent.nix
  ./virtualisation/railcar.nix
+  ./virtualisation/spice-usb-redirection.nix
  ./virtualisation/virtualbox-guest.nix
  ./virtualisation/virtualbox-host.nix
  ./virtualisation/vmware-guest.nix
--- a/nixos/modules/programs/nm-applet.nix
+++ b/nixos/modules/programs/nm-applet.nix
@ -5,14 +5,25 @@
    maintainers = lib.teams.freedesktop.members;
  };

-  options.programs.nm-applet.enable = lib.mkEnableOption "nm-applet";
+  options.programs.nm-applet = {
+    enable = lib.mkEnableOption "nm-applet";
+
+    indicator = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Whether to use indicator instead of status icon.
+        It is needed for Appindicator environments, like Enlightenment.
+      '';
+    };
+  };

  config = lib.mkIf config.programs.nm-applet.enable {
    systemd.user.services.nm-applet = {
      description = "Network manager applet";
      wantedBy = [ "graphical-session.target" ];
      partOf = [ "graphical-session.target" ];
-      serviceConfig.ExecStart = "${pkgs.networkmanagerapplet}/bin/nm-applet";
+      serviceConfig.ExecStart = "${pkgs.networkmanagerapplet}/bin/nm-applet ${lib.optionalString config.programs.nm-applet.indicator "--indicator"}";
    };

    services.dbus.packages = [ pkgs.gcr ];
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -68,6 +68,8 @@ with lib;
      to handle FIDO security tokens, so this isn't necessary anymore.
    '')

+    (mkRemovedOptionModule [ "services" "seeks" ] "")
+
    # Do NOT add any option renames here, see top of the file
  ];
 }
--- a/nixos/modules/services/hardware/thermald.nix
+++ b/nixos/modules/services/hardware/thermald.nix
@ -23,6 +23,15 @@ in {
        default = null;
        description = "the thermald manual configuration file.";
      };
+
+      adaptive = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable adaptive mode, only working on kernel versions greater than 5.8.
+          Thermald will detect this itself, safe to enable on kernel versions below 5.8.
+        '';
+      };
    };
  };

@ -39,6 +48,7 @@ in {
            --no-daemon \
            ${optionalString cfg.debug "--loglevel=debug"} \
            ${optionalString (cfg.configFile != null) "--config-file ${cfg.configFile}"} \
+            ${optionalString cfg.adaptive "--adaptive"} \
            --dbus-enable
        '';
      };
--- a/nixos/modules/services/misc/calibre-server.nix
+++ b/nixos/modules/services/misc/calibre-server.nix
@ -9,24 +9,42 @@ let
 in

 {
+  imports = [
+    (mkChangedOptionModule [ "services" "calibre-server" "libraryDir" ] [ "services" "calibre-server" "libraries" ]
+      (config:
+        let libraryDir = getAttrFromPath [ "services" "calibre-server" "libraryDir" ] config;
+        in [ libraryDir ]
+      )
+    )
+  ];

  ###### interface

  options = {
-
    services.calibre-server = {

      enable = mkEnableOption "calibre-server";

-      libraryDir = mkOption {
+      libraries = mkOption {
        description = ''
-          The directory where the Calibre library to serve is.
-          '';
-          type = types.path;
+          The directories of the libraries to serve. They must be readable for the user under which the server runs.
+        '';
+        type = types.listOf types.path;
+      };
+
+      user = mkOption {
+        description = "The user under which calibre-server runs.";
+        type = types.str;
+        default = "calibre-server";
+      };
+
+      group = mkOption {
+        description = "The group under which calibre-server runs.";
+        type = types.str;
+        default = "calibre-server";
      };

    };
-
  };


@ -34,29 +52,34 @@ in

  config = mkIf cfg.enable {

-    systemd.services.calibre-server =
-      {
+    systemd.services.calibre-server = {
        description = "Calibre Server";
        after = [ "network.target" ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
-          User = "calibre-server";
+          User = cfg.user;
          Restart = "always";
-          ExecStart = "${pkgs.calibre}/bin/calibre-server ${cfg.libraryDir}";
+          ExecStart = "${pkgs.calibre}/bin/calibre-server ${lib.concatStringsSep " " cfg.libraries}";
        };

      };

    environment.systemPackages = [ pkgs.calibre ];

-    users.users.calibre-server = {
+    users.users = optionalAttrs (cfg.user == "calibre-server") {
+      calibre-server = {
+        home = "/var/lib/calibre-server";
+        createHome = true;
        uid = config.ids.uids.calibre-server;
-        group = "calibre-server";
+        group = cfg.group;
      };
+    };

-    users.groups.calibre-server = {
+    users.groups = optionalAttrs (cfg.group == "calibre-server") {
+      calibre-server = {
        gid = config.ids.gids.calibre-server;
      };
+    };

  };

--- a/nixos/modules/services/monitoring/monit.nix
+++ b/nixos/modules/services/monitoring/monit.nix
@ -4,29 +4,19 @@ with lib;

 let
  cfg = config.services.monit;
-  extraConfig = pkgs.writeText "monitConfig" cfg.extraConfig;
 in

 {
-  imports = [
-    (mkRenamedOptionModule [ "services" "monit" "config" ] ["services" "monit" "extraConfig" ])
-  ];
-
  options.services.monit = {

    enable = mkEnableOption "Monit";

-    configFiles = mkOption {
-      type = types.listOf types.path;
-      default = [];
-      description = "List of paths to be included in the monitrc file";
-    };
-
-    extraConfig = mkOption {
+    config = mkOption {
      type = types.lines;
      default = "";
-      description = "Additional monit config as string";
+      description = "monitrc content";
    };
+
  };

  config = mkIf cfg.enable {
@ -34,7 +24,7 @@ in
    environment.systemPackages = [ pkgs.monit ];

    environment.etc.monitrc = {
-      text = concatMapStringsSep "\n" (path: "include ${path}")  (cfg.configFiles ++ [extraConfig]);
+      text = cfg.config;
      mode = "0400";
    };

@ -53,4 +43,6 @@ in
    };

  };
+
+  meta.maintainers = with maintainers; [ ryantm ];
 }
--- a/nixos/modules/services/networking/heyefi.nix
+++ b/nixos/modules/services/networking/heyefi.nix
@ -1,82 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.heyefi;
-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.heyefi = {
-
-      enable = mkEnableOption "heyefi";
-
-      cardMacaddress = mkOption {
-        default = "";
-        description = ''
-          An Eye-Fi card MAC address.
-          '';
-      };
-
-      uploadKey = mkOption {
-        default = "";
-        description = ''
-          An Eye-Fi card's upload key.
-          '';
-      };
-
-      uploadDir = mkOption {
-        example = "/home/username/pictures";
-        description = ''
-          The directory to upload the files to.
-          '';
-      };
-
-      user = mkOption {
-        default = "root";
-        description = ''
-          heyefi will be run under this user (user must exist,
-          this can be your user name).
-        '';
-      };
-
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-
-    systemd.services.heyefi =
-      {
-        description = "heyefi service";
-        after = [ "network.target" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          User = "${cfg.user}";
-          Restart = "always";
-          ExecStart = "${pkgs.heyefi}/bin/heyefi";
-        };
-
-      };
-
-    environment.etc."heyefi/heyefi.config".text =
-      ''
-        # /etc/heyefi/heyefi.conf: DO NOT EDIT -- this file has been generated automatically.
-        cards = [["${config.services.heyefi.cardMacaddress}","${config.services.heyefi.uploadKey}"]]
-        upload_dir = "${toString config.services.heyefi.uploadDir}"
-      '';
-
-    environment.systemPackages = [ pkgs.heyefi ];
-
-  };
-
-}
--- a/nixos/modules/services/networking/onedrive.nix
+++ b/nixos/modules/services/networking/onedrive.nix
@ -53,7 +53,7 @@ in {
      serviceConfig = {
        Type = "simple";
        ExecStart = ''
-          ${cfg.package}/bin/onedrive --monitor --verbose --confdir=%h/.config/%i
+          ${cfg.package}/bin/onedrive --monitor --confdir=%h/.config/%i
        '';
        Restart="on-failure";
        RestartSec=3;
--- a/nixos/modules/services/networking/seeks.nix
+++ b/nixos/modules/services/networking/seeks.nix
@ -1,75 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.seeks;
-
-  confDir = cfg.confDir;
-
-  seeks = pkgs.seeks.override { seeks_confDir = confDir; };
-
-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.seeks = {
-
-      enable = mkOption {
-        default = false;
-        type = types.bool;
-        description = "
-          Whether to enable the Seeks server.
-        ";
-      };
-
-      confDir = mkOption {
-        default = "";
-        type = types.str;
-        description = "
-          The Seeks server configuration. If it is not specified,
-          a default configuration is used.
-        ";
-      };
-
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = mkIf config.services.seeks.enable {
-
-    users.users.seeks =
-      { uid = config.ids.uids.seeks;
-        description = "Seeks user";
-        createHome = true;
-        home = "/var/lib/seeks";
-      };
-
-    users.groups.seeks =
-      { gid = config.ids.gids.seeks;
-      };
-
-    systemd.services.seeks =
-      {
-        description = "Seeks server, the p2p search engine.";
-        after = [ "network.target" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          User = "seeks";
-          ExecStart = "${seeks}/bin/seeks";
-        };
-      };
-
-    environment.systemPackages = [ seeks ];
-
-  };
-
-}
--- a/nixos/modules/services/networking/shadowsocks.nix
+++ b/nixos/modules/services/networking/shadowsocks.nix
@ -17,7 +17,7 @@ let
    plugin_opts = cfg.pluginOpts;
  } // optionalAttrs (cfg.password != null) {
    password = cfg.password;
-  };
+  } // cfg.extraConfig;

  configFile = pkgs.writeText "shadowsocks.json" (builtins.toJSON opts);

@ -112,6 +112,24 @@ in
          Options to pass to the plugin if one was specified
        '';
      };
+
+      extraConfig = mkOption {
+        type = types.attrs;
+        default = {};
+        example = ''
+          {
+            nameserver = "8.8.8.8";
+          }
+        '';
+        description = ''
+          Additional configuration for shadowsocks that is not covered by the
+          provided options. The provided attrset will be serialized to JSON and
+          has to contain valid shadowsocks options. Unfortunately most
+          additional options are undocumented but it's easy to find out what is
+          available by looking into the source code of
+          <link xlink:href="https://github.com/shadowsocks/shadowsocks-libev/blob/master/src/jconf.c"/>
+        '';
+      };
    };

  };
@ -129,7 +147,7 @@ in
      description = "shadowsocks-libev Daemon";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.shadowsocks-libev cfg.plugin ] ++ optional (cfg.passwordFile != null) pkgs.jq;
+      path = [ pkgs.shadowsocks-libev ] ++ optional (cfg.plugin != null) cfg.plugin ++ optional (cfg.passwordFile != null) pkgs.jq;
      serviceConfig.PrivateTmp = true;
      script = ''
        ${optionalString (cfg.passwordFile != null) ''
--- a/nixos/modules/services/video/epgstation/default.nix
+++ b/nixos/modules/services/video/epgstation/default.nix
@ -0,0 +1,295 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.epgstation;
+
+  username = config.users.users.epgstation.name;
+  groupname = config.users.users.epgstation.group;
+
+  settingsFmt = pkgs.formats.json {};
+  settingsTemplate = settingsFmt.generate "config.json" cfg.settings;
+  preStartScript = pkgs.writeScript "epgstation-prestart" ''
+    #!${pkgs.runtimeShell}
+
+    PASSWORD="$(head -n1 "${cfg.basicAuth.passwordFile}")"
+    DB_PASSWORD="$(head -n1 "${cfg.database.passwordFile}")"
+
+    # setup configuration
+    touch /etc/epgstation/config.json
+    chmod 640 /etc/epgstation/config.json
+    sed \
+      -e "s,@password@,$PASSWORD,g" \
+      -e "s,@dbPassword@,$DB_PASSWORD,g" \
+      ${settingsTemplate} > /etc/epgstation/config.json
+    chown "${username}:${groupname}" /etc/epgstation/config.json
+
+    # NOTE: Use password authentication, since mysqljs does not yet support auth_socket
+    if [ ! -e /var/lib/epgstation/db-created ]; then
+      ${pkgs.mysql}/bin/mysql -e \
+        "GRANT ALL ON \`${cfg.database.name}\`.* TO '${username}'@'localhost' IDENTIFIED by '$DB_PASSWORD';"
+      touch /var/lib/epgstation/db-created
+    fi
+  '';
+
+  streamingConfig = builtins.fromJSON (builtins.readFile ./streaming.json);
+  logConfig = {
+    appenders.stdout.type = "stdout";
+    categories = {
+      default = { appenders = [ "stdout" ]; level = "info"; };
+      system = { appenders = [ "stdout" ]; level = "info"; };
+      access = { appenders = [ "stdout" ]; level = "info"; };
+      stream = { appenders = [ "stdout" ]; level = "info"; };
+    };
+  };
+
+  defaultPassword = "INSECURE_GO_CHECK_CONFIGURATION_NIX\n";
+in
+{
+  options.services.epgstation = {
+    enable = mkEnableOption pkgs.epgstation.meta.description;
+
+    usePreconfiguredStreaming = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Use preconfigured default streaming options.
+
+        Upstream defaults:
+        <link xlink:href="https://github.com/l3tnun/EPGStation/blob/master/config/config.sample.json"/>
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 20772;
+      description = ''
+        HTTP port for EPGStation to listen on.
+      '';
+    };
+
+    socketioPort = mkOption {
+      type = types.port;
+      default = cfg.port + 1;
+      description = ''
+        Socket.io port for EPGStation to listen on.
+      '';
+    };
+
+    clientSocketioPort = mkOption {
+      type = types.port;
+      default = cfg.socketioPort;
+      description = ''
+        Socket.io port that the web client is going to connect to. This may be
+        different from <option>socketioPort</option> if EPGStation is hidden
+        behind a reverse proxy.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Open ports in the firewall for the EPGStation web interface.
+
+        <warning>
+          <para>
+            Exposing EPGStation to the open internet is generally advised
+            against. Only use it inside a trusted local network, or consider
+            putting it behind a VPN if you want remote access.
+          </para>
+        </warning>
+      '';
+    };
+
+    basicAuth = {
+      user = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "epgstation";
+        description = ''
+          Basic auth username for EPGStation. If <literal>null</literal>, basic
+          auth will be disabled.
+
+          <warning>
+            <para>
+              Basic authentication has known weaknesses, the most critical being
+              that it sends passwords over the network in clear text. Use this
+              feature to control access to EPGStation within your family and
+              friends, but don't rely on it for security.
+            </para>
+          </warning>
+        '';
+      };
+
+      passwordFile = mkOption {
+        type = types.path;
+        default = pkgs.writeText "epgstation-password" defaultPassword;
+        example = "/run/keys/epgstation-password";
+        description = ''
+          A file containing the password for <option>basicAuth.user</option>.
+        '';
+      };
+    };
+
+    database =  {
+      name = mkOption {
+        type = types.str;
+        default = "epgstation";
+        description = ''
+          Name of the MySQL database that holds EPGStation's data.
+        '';
+      };
+
+      passwordFile = mkOption {
+        type = types.path;
+        default = pkgs.writeText "epgstation-db-password" defaultPassword;
+        example = "/run/keys/epgstation-db-password";
+        description = ''
+          A file containing the password for the database named
+          <option>database.name</option>.
+        '';
+      };
+    };
+
+    settings = mkOption {
+      description = ''
+        Options to add to config.json.
+
+        Documentation:
+        <link xlink:href="https://github.com/l3tnun/EPGStation/blob/master/doc/conf-manual.md"/>
+      '';
+
+      default = {};
+      example = {
+        recPriority = 20;
+        conflictPriority = 10;
+      };
+
+      type = types.submodule {
+        freeformType = settingsFmt.type;
+
+        options.readOnlyOnce = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Don't reload configuration files at runtime.";
+        };
+
+        options.mirakurunPath = mkOption (let
+          sockPath = config.services.mirakurun.unixSocket;
+        in {
+          type = types.str;
+          default = "http+unix://${replaceStrings ["/"] ["%2F"] sockPath}";
+          example = "http://localhost:40772";
+          description = "URL to connect to Mirakurun.";
+        });
+
+        options.encode = mkOption {
+          type = with types; listOf attrs;
+          description = "Encoding presets for recorded videos.";
+          default = [
+            { name = "H264";
+              cmd = "${pkgs.epgstation}/libexec/enc.sh main";
+              suffix = ".mp4";
+              default = true; }
+            { name = "H264-sub";
+              cmd = "${pkgs.epgstation}/libexec/enc.sh sub";
+              suffix = "-sub.mp4"; }
+          ];
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.etc = {
+      "epgstation/operatorLogConfig.json".text = builtins.toJSON logConfig;
+      "epgstation/serviceLogConfig.json".text = builtins.toJSON logConfig;
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = with cfg; [ port socketioPort ];
+    };
+
+    users.users.epgstation = {
+      description = "EPGStation user";
+      group = config.users.groups.epgstation.name;
+      isSystemUser = true;
+    };
+
+    users.groups.epgstation = {};
+
+    services.mirakurun.enable = mkDefault true;
+
+    services.mysql = {
+      enable = mkDefault true;
+      package = mkDefault pkgs.mysql;
+      ensureDatabases = [ cfg.database.name ];
+      # FIXME: enable once mysqljs supports auth_socket
+      # ensureUsers = [ {
+      #   name = username;
+      #   ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+      # } ];
+    };
+
+    services.epgstation.settings = let
+      defaultSettings = {
+        serverPort = cfg.port;
+        socketioPort = cfg.socketioPort;
+        clientSocketioPort = cfg.clientSocketioPort;
+
+        dbType = mkDefault "mysql";
+        mysql = {
+          user = username;
+          database = cfg.database.name;
+          socketPath = mkDefault "/run/mysqld/mysqld.sock";
+          password = mkDefault "@dbPassword@";
+          connectTimeout = mkDefault 1000;
+          connectionLimit = mkDefault 10;
+        };
+
+        basicAuth = mkIf (cfg.basicAuth.user != null) {
+          user = mkDefault cfg.basicAuth.user;
+          password = mkDefault "@password@";
+        };
+
+        ffmpeg = mkDefault "${pkgs.ffmpeg-full}/bin/ffmpeg";
+        ffprobe = mkDefault "${pkgs.ffmpeg-full}/bin/ffprobe";
+
+        fileExtension = mkDefault ".m2ts";
+        maxEncode = mkDefault 2;
+        maxStreaming = mkDefault 2;
+      };
+    in
+    mkMerge [
+      defaultSettings
+      (mkIf cfg.usePreconfiguredStreaming streamingConfig)
+    ];
+
+    systemd.tmpfiles.rules = [
+      "d '/var/lib/epgstation/streamfiles' - ${username} ${groupname} - -"
+      "d '/var/lib/epgstation/recorded' - ${username} ${groupname} - -"
+      "d '/var/lib/epgstation/thumbnail' - ${username} ${groupname} - -"
+    ];
+
+    systemd.services.epgstation = {
+      description = pkgs.epgstation.meta.description;
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+      ] ++ optional config.services.mirakurun.enable "mirakurun.service"
+        ++ optional config.services.mysql.enable "mysql.service";
+
+      serviceConfig = {
+        ExecStart = "${pkgs.epgstation}/bin/epgstation start";
+        ExecStartPre = "+${preStartScript}";
+        User = username;
+        Group = groupname;
+        StateDirectory = "epgstation";
+        LogsDirectory = "epgstation";
+        ConfigurationDirectory = "epgstation";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/video/epgstation/generate
+++ b/nixos/modules/services/video/epgstation/generate
@ -0,0 +1,31 @@
+#!/usr/bin/env -S nix-build --no-out-link
+
+# Script to generate default streaming configurations for EPGStation. There's
+# no need to run this script directly since generate.sh in the EPGStation
+# package directory would run this script for you.
+#
+# Usage: ./generate | xargs cat > streaming.json
+
+{ pkgs ? (import ../../../../.. {}) }:
+
+let
+  sampleConfigPath = "${pkgs.epgstation.src}/config/config.sample.json";
+  sampleConfig = builtins.fromJSON (builtins.readFile sampleConfigPath);
+  streamingConfig = {
+    inherit (sampleConfig)
+      mpegTsStreaming
+      mpegTsViewer
+      liveHLS
+      liveMP4
+      liveWebM
+      recordedDownloader
+      recordedStreaming
+      recordedViewer
+      recordedHLS;
+  };
+in
+pkgs.runCommand "streaming.json" { nativeBuildInputs = [ pkgs.jq ]; } ''
+  jq . <<<'${builtins.toJSON streamingConfig}' > $out
+''
+
+# vim:set ft=nix:
--- a/nixos/modules/services/video/epgstation/streaming.json
+++ b/nixos/modules/services/video/epgstation/streaming.json
@ -0,0 +1,119 @@
+{
+  "liveHLS": [
+    {
+      "cmd": "%FFMPEG% -re -dual_mono_mode main -i pipe:0 -sn -threads 0 -map 0 -ignore_unknown -max_muxing_queue_size 1024 -f hls -hls_time 3 -hls_list_size 17 -hls_allow_cache 1 -hls_segment_filename %streamFileDir%/stream%streamNum%-%09d.ts -c:a aac -ar 48000 -b:a 192k -ac 2 -c:v libx264 -vf yadif,scale=-2:720 -b:v 3000k -preset veryfast -flags +loop-global_header %OUTPUT%",
+      "name": "720p"
+    },
+    {
+      "cmd": "%FFMPEG% -re -dual_mono_mode main -i pipe:0 -sn -threads 0 -map 0 -ignore_unknown -max_muxing_queue_size 1024 -f hls -hls_time 3 -hls_list_size 17 -hls_allow_cache 1 -hls_segment_filename %streamFileDir%/stream%streamNum%-%09d.ts -c:a aac -ar 48000 -b:a 128k -ac 2 -c:v libx264 -vf yadif,scale=-2:480 -b:v 1500k -preset veryfast -flags +loop-global_header %OUTPUT%",
+      "name": "480p"
+    },
+    {
+      "cmd": "%FFMPEG% -re -dual_mono_mode main -i pipe:0 -sn -threads 0 -map 0 -ignore_unknown -max_muxing_queue_size 1024 -f hls -hls_time 3 -hls_list_size 17 -hls_allow_cache 1 -hls_segment_filename %streamFileDir%/stream%streamNum%-%09d.ts -c:a aac -ar 48000 -b:a 48k -ac 2 -c:v libx264 -vf yadif,scale=-2:180 -b:v 100k -preset veryfast -maxrate 110k -bufsize 1000k -flags +loop-global_header %OUTPUT%",
+      "name": "180p"
+    }
+  ],
+  "liveMP4": [
+    {
+      "cmd": "%FFMPEG% -re -dual_mono_mode main -i pipe:0 -sn -threads 0 -c:a aac -ar 48000 -b:a 192k -ac 2 -c:v libx264 -vf yadif,scale=-2:720 -b:v 3000k -profile:v baseline -preset veryfast -tune fastdecode,zerolatency -movflags frag_keyframe+empty_moov+faststart+default_base_moof -y -f mp4 pipe:1",
+      "name": "720p"
+    },
+    {
+      "cmd": "%FFMPEG% -re -dual_mono_mode main -i pipe:0 -sn -threads 0 -c:a aac -ar 48000 -b:a 128k -ac 2 -c:v libx264 -vf yadif,scale=-2:480 -b:v 1500k -profile:v baseline -preset veryfast -tune fastdecode,zerolatency -movflags frag_keyframe+empty_moov+faststart+default_base_moof -y -f mp4 pipe:1",
+      "name": "480p"
+    }
+  ],
+  "liveWebM": [
+    {
+      "cmd": "%FFMPEG% -re -dual_mono_mode main -i pipe:0 -sn -threads 3 -c:a libvorbis -ar 48000 -b:a 192k -ac 2 -c:v libvpx-vp9 -vf yadif,scale=-2:720 -b:v 3000k -deadline realtime -speed 4 -cpu-used -8 -y -f webm pipe:1",
+      "name": "720p"
+    },
+    {
+      "cmd": "%FFMPEG% -re -dual_mono_mode main -i pipe:0 -sn -threads 2 -c:a libvorbis -ar 48000 -b:a 128k -ac 2 -c:v libvpx-vp9 -vf yadif,scale=-2:480 -b:v 1500k -deadline realtime -speed 4 -cpu-used -8 -y -f webm pipe:1",
+      "name": "480p"
+    }
+  ],
+  "mpegTsStreaming": [
+    {
+      "cmd": "%FFMPEG% -re -dual_mono_mode main -i pipe:0 -sn -threads 0 -c:a aac -ar 48000 -b:a 192k -ac 2 -c:v libx264 -vf yadif,scale=-2:720 -b:v 3000k -preset veryfast -y -f mpegts pipe:1",
+      "name": "720p"
+    },
+    {
+      "cmd": "%FFMPEG% -re -dual_mono_mode main -i pipe:0 -sn -threads 0 -c:a aac -ar 48000 -b:a 128k -ac 2 -c:v libx264 -vf yadif,scale=-2:480 -b:v 1500k -preset veryfast -y -f mpegts pipe:1",
+      "name": "480p"
+    },
+    {
+      "name": "Original"
+    }
+  ],
+  "mpegTsViewer": {
+    "android": "intent://ADDRESS#Intent;package=com.mxtech.videoplayer.ad;type=video;scheme=http;end",
+    "ios": "vlc-x-callback://x-callback-url/stream?url=http://ADDRESS"
+  },
+  "recordedDownloader": {
+    "android": "intent://ADDRESS#Intent;package=com.dv.adm;type=video;scheme=http;end",
+    "ios": "vlc-x-callback://x-callback-url/download?url=http://ADDRESS&filename=FILENAME"
+  },
+  "recordedHLS": [
+    {
+      "cmd": "%FFMPEG% -dual_mono_mode main -i %INPUT% -sn -threads 0 -map 0 -ignore_unknown -max_muxing_queue_size 1024 -f hls -hls_time 3 -hls_list_size 0 -hls_allow_cache 1 -hls_segment_filename %streamFileDir%/stream%streamNum%-%09d.ts -c:a aac -ar 48000 -b:a 192k -ac 2 -c:v libx264 -vf yadif,scale=-2:720 -b:v 3000k -preset veryfast -flags +loop-global_header %OUTPUT%",
+      "name": "720p"
+    },
+    {
+      "cmd": "%FFMPEG% -dual_mono_mode main -i %INPUT% -sn -threads 0 -map 0 -ignore_unknown -max_muxing_queue_size 1024 -f hls -hls_time 3 -hls_list_size 0 -hls_allow_cache 1 -hls_segment_filename %streamFileDir%/stream%streamNum%-%09d.ts -c:a aac -ar 48000 -b:a 128k -ac 2 -c:v libx264 -vf yadif,scale=-2:480 -b:v 1500k -preset veryfast -flags +loop-global_header %OUTPUT%",
+      "name": "480p"
+    },
+    {
+      "cmd": "%FFMPEG% -dual_mono_mode main -i %INPUT% -sn -map 0 -ignore_unknown -max_muxing_queue_size 1024 -f hls -hls_time 3 -hls_list_size 0 -hls_allow_cache 1 -hls_segment_type fmp4 -hls_fmp4_init_filename stream%streamNum%-init.mp4 -hls_segment_filename stream%streamNum%-%09d.m4s -c:a aac -ar 48000 -b:a 128k -ac 2 -c:v libx265 -vf yadif,scale=-2:480 -b:v 350k -preset veryfast -tag:v hvc1 %OUTPUT%",
+      "name": "480p(h265)"
+    }
+  ],
+  "recordedStreaming": {
+    "mp4": [
+      {
+        "ab": "192k",
+        "cmd": "%FFMPEG% -dual_mono_mode main %RE% -i pipe:0 -sn -threads 0 -c:a aac -ar 48000 -ac 2 -c:v libx264 -vf yadif,scale=-2:720 %VB% %VBUFFER% %AB% %ABUFFER% -profile:v baseline -preset veryfast -tune fastdecode,zerolatency -movflags frag_keyframe+empty_moov+faststart+default_base_moof -y -f mp4 pipe:1",
+        "name": "720p",
+        "vb": "3000k"
+      },
+      {
+        "ab": "128k",
+        "cmd": "%FFMPEG% -dual_mono_mode main %RE% -i pipe:0 -sn -threads 0 -c:a aac -ar 48000 -ac 2 -c:v libx264 -vf yadif,scale=-2:360 %VB% %VBUFFER% %AB% %ABUFFER% -profile:v baseline -preset veryfast -tune fastdecode,zerolatency -movflags frag_keyframe+empty_moov+faststart+default_base_moof -y -f mp4 pipe:1",
+        "name": "360p",
+        "vb": "1500k"
+      }
+    ],
+    "mpegTs": [
+      {
+        "ab": "192k",
+        "cmd": "%FFMPEG% -dual_mono_mode main %RE% -i pipe:0 -sn -threads 0 -c:a aac -ar 48000 -ac 2 -c:v libx264 -vf yadif,scale=-2:720 %VB% %VBUFFER% %AB% %ABUFFER% -profile:v baseline -preset veryfast -tune fastdecode,zerolatency -y -f mpegts pipe:1",
+        "name": "720p (H.264)",
+        "vb": "3000k"
+      },
+      {
+        "ab": "128k",
+        "cmd": "%FFMPEG% -dual_mono_mode main %RE% -i pipe:0 -sn -threads 0 -c:a aac -ar 48000 -ac 2 -c:v libx264 -vf yadif,scale=-2:360 %VB% %VBUFFER% %AB% %ABUFFER% -profile:v baseline -preset veryfast -tune fastdecode,zerolatency -y -f mpegts pipe:1",
+        "name": "360p (H.264)",
+        "vb": "1500k"
+      }
+    ],
+    "webm": [
+      {
+        "ab": "192k",
+        "cmd": "%FFMPEG% -dual_mono_mode main %RE% -i pipe:0 -sn -threads 3 -c:a libvorbis -ar 48000 -ac 2 -c:v libvpx-vp9 -vf yadif,scale=-2:720 %VB% %VBUFFER% %AB% %ABUFFER% -deadline realtime -speed 4 -cpu-used -8 -y -f webm pipe:1",
+        "name": "720p",
+        "vb": "3000k"
+      },
+      {
+        "ab": "128k",
+        "cmd": "%FFMPEG% -dual_mono_mode main %RE% -i pipe:0 -sn -threads 2 -c:a libvorbis -ar 48000 -ac 2 -c:v libvpx-vp9 -vf yadif,scale=-2:360 %VB% %VBUFFER% %AB% %ABUFFER% -deadline realtime -speed 4 -cpu-used -8 -y -f webm pipe:1",
+        "name": "360p",
+        "vb": "1500k"
+      }
+    ]
+  },
+  "recordedViewer": {
+    "android": "intent://ADDRESS#Intent;package=com.mxtech.videoplayer.ad;type=video;scheme=http;end",
+    "ios": "infuse://x-callback-url/play?url=http://ADDRESS"
+  }
+}
--- a/nixos/modules/services/video/mirakurun.nix
+++ b/nixos/modules/services/video/mirakurun.nix
@ -18,7 +18,8 @@ in
          type = with types; nullOr port;
          default = 40772;
          description = ''
-            Port to listen on. If null, it won't listen on any port.
+            Port to listen on. If <literal>null</literal>, it won't listen on
+            any port.
          '';
        };

@ -27,6 +28,23 @@ in
          default = false;
          description = ''
            Open ports in the firewall for Mirakurun.
+
+            <warning>
+              <para>
+                Exposing Mirakurun to the open internet is generally advised
+                against. Only use it inside a trusted local network, or
+                consider putting it behind a VPN if you want remote access.
+              </para>
+            </warning>
+          '';
+        };
+
+        unixSocket = mkOption {
+          type = with types; nullOr path;
+          default = "/var/run/mirakurun/mirakurun.sock";
+          description = ''
+            Path to unix socket to listen on. If <literal>null</literal>, it
+            won't listen on any unix sockets.
          '';
        };

@ -121,8 +139,8 @@ in

      services.mirakurun.serverSettings = {
        logLevel = mkDefault 2;
-        path = mkDefault "/var/run/mirakurun/mirakurun.sock";
-        port = mkIf (cfg.port != null) (mkDefault cfg.port);
+        path = mkIf (cfg.unixSocket != null) cfg.unixSocket;
+        port = mkIf (cfg.port != null) cfg.port;
      };

      systemd.tmpfiles.rules = [
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -240,6 +240,8 @@ in
      # Otherwise you can't store NetworkManager Secrets with
      # "Store the password only for this user"
      programs.nm-applet.enable = true;
+      # Pantheon has its own network indicator
+      programs.nm-applet.indicator = false;

      # Shell integration for VTE terminals
      programs.bash.vteIntegration = mkDefault true;
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -309,9 +309,9 @@ in
        ++ lib.optional config.networking.networkmanager.enable plasma-nm
        ++ lib.optional config.hardware.pulseaudio.enable plasma-pa
        ++ lib.optional config.powerManagement.enable powerdevil
-        ++ lib.optional config.services.colord.enable colord-kde
+        ++ lib.optional config.services.colord.enable pkgs.colord-kde
        ++ lib.optionals config.services.samba.enable [ kdenetwork-filesharing pkgs.samba ]
-        ++ lib.optional config.services.xserver.wacom.enable wacomtablet;
+        ++ lib.optional config.services.xserver.wacom.enable pkgs.wacomtablet;

      environment.pathsToLink = [
        # FIXME: modules should link subdirs of `/share` rather than relying on this
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -113,14 +113,14 @@ let
  in concatMapStrings (getAttr "value") monitors;

  configFile = pkgs.runCommand "xserver.conf"
-    { xfs = optionalString (cfg.useXFS != false)
-        ''FontPath "${toString cfg.useXFS}"'';
+    { fontpath = optionalString (cfg.fontPath != null)
+        ''FontPath "${cfg.fontPath}"'';
      inherit (cfg) config;
      preferLocalBuild = true;
    }
      ''
        echo 'Section "Files"' >> $out
-        echo $xfs >> $out
+        echo $fontpath >> $out

        for i in ${toString fontsForXServer}; do
          if test "''${i:0:''${#NIX_STORE}}" == "$NIX_STORE"; then
@ -154,6 +154,8 @@ in
      (mkRemovedOptionModule
        [ "services" "xserver" "startDbusSession" ]
        "The user D-Bus session is now always socket activated and this option can safely be removed.")
+      (mkRemovedOptionModule ["services" "xserver" "useXFS" ]
+        "Use services.xserver.fontPath instead of useXFS")
    ];


@ -476,11 +478,15 @@ in
        description = "Default colour depth.";
      };

-      useXFS = mkOption {
-        # FIXME: what's the type of this option?
-        default = false;
+      fontPath = mkOption {
+        type = types.nullOr types.str;
+        default = null;
        example = "unix/:7100";
-        description = "Determines how to connect to the X Font Server.";
+        description = ''
+          Set the X server FontPath. Defaults to null, which
+          means the compiled in defaults will be used. See
+          man xorg.conf for details.
+        '';
      };

      tty = mkOption {
--- a/nixos/modules/virtualisation/cri-o.nix
+++ b/nixos/modules/virtualisation/cri-o.nix
@ -99,7 +99,6 @@ in
      [crio.runtime]
      cgroup_manager = "systemd"
      log_level = "${cfg.logLevel}"
-      manage_ns_lifecycle = true
      pinns_path = "${cfg.package}/bin/pinns"
      hooks_dir = []

--- a/nixos/modules/virtualisation/spice-usb-redirection.nix
+++ b/nixos/modules/virtualisation/spice-usb-redirection.nix
@ -0,0 +1,24 @@
+{ config, pkgs, lib, ... }:
+{
+  options.virtualisation.spiceUSBRedirection.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    description = ''
+      Install the SPICE USB redirection helper with setuid
+      privileges. This allows unprivileged users to pass USB devices
+      connected to this machine to libvirt VMs, both local and
+      remote. Note that this allows users arbitrary access to USB
+      devices.
+    '';
+  };
+
+  config = lib.mkIf config.virtualisation.spiceUSBRedirection.enable {
+    environment.systemPackages = [ pkgs.spice-gtk ]; # For polkit actions
+    security.wrappers.spice-client-glib-usb-acl-helper ={
+      source = "${pkgs.spice-gtk}/bin/spice-client-glib-usb-acl-helper";
+      capabilities = "cap_fowner+ep";
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.lheckemann ];
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -309,7 +309,7 @@ in
  sanoid = handleTest ./sanoid.nix {};
  sddm = handleTest ./sddm.nix {};
  service-runner = handleTest ./service-runner.nix {};
-  shadowsocks = handleTest ./shadowsocks.nix {};
+  shadowsocks = handleTest ./shadowsocks {};
  shattered-pixel-dungeon = handleTest ./shattered-pixel-dungeon.nix {};
  shiori = handleTest ./shiori.nix {};
  signal-desktop = handleTest ./signal-desktop.nix {};
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@ -219,18 +219,11 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        )

    with subtest("Ensure correct behavior when no store is needed"):
-        # This check tests two requirements simultaneously
-        #  1. buildLayeredImage can build images that don't need a store.
-        #  2. Layers of symlinks are eliminated by the customization layer.
-        #
+        # This check tests that buildLayeredImage can build images that don't need a store.
        docker.succeed(
            "docker load --input='${pkgs.dockerTools.examples.no-store-paths}'"
        )

-        # Busybox will not recognize argv[0] and print an error message with argv[0],
-        # but it confirms that the custom-true symlink is present.
-        docker.succeed("docker run --rm no-store-paths custom-true |& grep custom-true")
-
        # This check may be loosened to allow an *empty* store rather than *no* store.
        docker.succeed("docker run --rm no-store-paths ls /")
        docker.fail("docker run --rm no-store-paths ls /nix/store")
--- a/nixos/tests/shadowsocks/common.nix
+++ b/nixos/tests/shadowsocks/common.nix
@ -1,5 +1,10 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }: {
-    name = "shadowsocks";
+{ name
+, plugin ? null
+, pluginOpts ? ""
+}:
+
+import ../make-test-python.nix ({ pkgs, lib, ... }: {
+    inherit name;
    meta = {
      maintainers = with lib.maintainers; [ hmenke ];
    };
@ -22,8 +27,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
          port = 8488;
          fastOpen = false;
          mode = "tcp_and_udp";
-          plugin = "${pkgs.shadowsocks-v2ray-plugin}/bin/v2ray-plugin";
-          pluginOpts = "server;host=nixos.org";
+        } // lib.optionalAttrs (plugin != null) {
+          inherit plugin;
+          pluginOpts = "server;${pluginOpts}";
        };
        services.nginx = {
          enable = true;
@ -42,10 +48,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
          description = "connect to shadowsocks";
          after = [ "network.target" ];
          wantedBy = [ "multi-user.target" ];
-          path = with pkgs; [
-            shadowsocks-libev
-            shadowsocks-v2ray-plugin
-          ];
+          path = with pkgs; [ shadowsocks-libev ];
          script = ''
            exec ss-local \
                -s 192.168.0.1 \
@ -54,8 +57,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
                -k 'pa$$w0rd' \
                -m chacha20-ietf-poly1305 \
                -a nobody \
-                --plugin "${pkgs.shadowsocks-v2ray-plugin}/bin/v2ray-plugin" \
-                --plugin-opts "host=nixos.org"
+                ${lib.optionalString (plugin != null) ''
+                  --plugin "${plugin}" --plugin-opts "${pluginOpts}"
+                ''}
          '';
        };
      };
--- a/nixos/tests/shadowsocks/default.nix
+++ b/nixos/tests/shadowsocks/default.nix
@ -0,0 +1,16 @@
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../../.. { inherit system config; }
+}:
+
+{
+  "basic" = import ./common.nix {
+    name = "basic";
+  };
+
+  "v2ray-plugin" = import ./common.nix {
+    name = "v2ray-plugin";
+    plugin = "${pkgs.shadowsocks-v2ray-plugin}/bin/v2ray-plugin";
+    pluginOpts = "host=nixos.org";
+  };
+}
--- a/pkgs/applications/audio/mamba/default.nix
+++ b/pkgs/applications/audio/mamba/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "mamba";
-  version = "1.4";
+  version = "1.5";

  src = fetchFromGitHub {
    owner = "brummer10";
    repo = "Mamba";
    rev = "v${version}";
-    sha256 = "08dcm0mmka1lbssrgck66v9l2rk3r4y63ij06aw2f9la8a84y20j";
+    sha256 = "1l74ckqqrccgsdy430pfsbv4fbzny7zivx399bi2jk1lv06p4h9a";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/audio/pulseeffects/default.nix
+++ b/pkgs/applications/audio/pulseeffects/default.nix
@ -44,13 +44,13 @@ let
  ];
 in stdenv.mkDerivation rec {
  pname = "pulseeffects";
-  version = "4.8.0";
+  version = "4.8.1";

  src = fetchFromGitHub {
    owner = "wwmm";
    repo = "pulseeffects";
    rev = "v${version}";
-    sha256 = "9dQNYWBx8iAifRTZr2FRlYv4keZt5Cfahwi/w01duFg=";
+    sha256 = "17yfs3ja7vflywhxbn3n3r8n6hl829x257kzplg2vpppppg6ylj6";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/sonic-lineup/default.nix
+++ b/pkgs/applications/audio/sonic-lineup/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "sonic-lineup";
-  version = "1.0.1";
+  version = "1.1";

  src = fetchurl {
-    url = "https://code.soundsoftware.ac.uk/attachments/download/2610/${pname}-${version}.tar.gz";
-    sha256 = "0w4v5zr81d8fh97y820r0vj1rrbl0kwgvhfkdnyl4hiabs97b1i7";
+    url = "https://code.soundsoftware.ac.uk/attachments/download/2765/${pname}-${version}.tar.gz";
+    sha256 = "0k45k9fawcm4s5yy05x00pgww7j8m7k2cxcc7g0fn9vqy7vcbq9h";
  };

  buildInputs =
--- a/pkgs/applications/audio/transcribe/default.nix
+++ b/pkgs/applications/audio/transcribe/default.nix
@ -1,73 +0,0 @@
-{ stdenv, fetchzip, wrapGAppsHook, alsaLib, atk, cairo, gdk-pixbuf
-, glib, gst_all_1,  gtk3, libSM, libX11, libpng12, pango, zlib }:
-
-stdenv.mkDerivation rec {
-  pname = "transcribe";
-  version = "8.72";
-
-  src = if stdenv.hostPlatform.system == "i686-linux" then
-    fetchzip {
-      url = "https://www.seventhstring.com/xscribe/downlinux32/xscsetup.tar.gz";
-      sha256 = "1h5l7ry9c9awpxfnd29b0wm973ifrhj17xl5d2fdsclw2swsickb";
-    }
-  else if stdenv.hostPlatform.system == "x86_64-linux" then
-    fetchzip {
-      url = "https://www.seventhstring.com/xscribe/downlinux64/xsc64setup.tar.gz";
-      sha256 = "1rpd3ppnx5i5yrnfbjrx7h7dk48kwl99i9lnpa75ap7nxvbiznm0";
-    }
-  else throw "Platform not supported";
-
-  nativeBuildInputs = [ wrapGAppsHook ];
-
-  buildInputs = with gst_all_1; [ gst-plugins-base gst-plugins-good
-    gst-plugins-bad gst-plugins-ugly ];
-
-  dontPatchELF = true;
-
-  libPath = with gst_all_1; stdenv.lib.makeLibraryPath [
-    stdenv.cc.cc glib gtk3 atk pango cairo gdk-pixbuf alsaLib
-    libX11 libSM libpng12 gstreamer gst-plugins-base zlib
-  ];
-
-  installPhase = ''
-    mkdir -p $out/bin $out/libexec $out/share/doc
-    cp transcribe $out/libexec
-    cp xschelp.htb readme_gtk.html $out/share/doc
-    cp -r gtkicons $out/share/icons
-
-    ln -s $out/share/doc/xschelp.htb $out/libexec
-
-    patchelf \
-      --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
-      $out/libexec/transcribe
-  '';
-
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH_1_0"
-      --prefix LD_LIBRARY_PATH : "${libPath}"
-    )
-  '';
-
-  postFixup = ''
-    ln -s $out/libexec/transcribe $out/bin/
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Software to help transcribe recorded music";
-    longDescription = ''
-      The Transcribe! application is an assistant for people who want
-      to work out a piece of music from a recording, in order to write
-      it out, or play it themselves, or both. It doesn't do the
-      transcribing for you, but it is essentially a specialised player
-      program which is optimised for the purpose of transcription. It
-      has many transcription-specific features not found on
-      conventional music players.
-    '';
-    homepage = "https://www.seventhstring.com/xscribe/";
-    license = licenses.unfree;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ michalrus ];
-    broken = true;
-  };
-}
--- a/pkgs/applications/audio/vcv-rack/default.nix
+++ b/pkgs/applications/audio/vcv-rack/default.nix
@ -10,7 +10,7 @@ let
  pfft-source = fetchFromBitbucket {
    owner = "jpommier";
    repo = "pffft";
-    rev = "29e4f76ac53bef048938754f32231d7836401f79";
+    rev = "74d7261be17cf659d5930d4830609406bd7553e3";
    sha256 = "084csgqa6f1a270bhybjayrh3mpyi2jimc87qkdgsqcp8ycsx1l1";
  };
  nanovg-source = fetchFromGitHub {
--- a/pkgs/applications/backup/deja-dup/default.nix
+++ b/pkgs/applications/backup/deja-dup/default.nix
@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = "https://wiki.gnome.org/Apps/DejaDup";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ jtojnar joncojonathan ];
+    maintainers = with maintainers; [ jtojnar ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@ -0,0 +1,66 @@
+{ lib, stdenv, fetchFromGitHub, fetchurl, linkFarmFromDrvs, makeWrapper,
+  dotnetPackages, dotnetCorePackages, writeScript, bash
+}:
+
+let
+  deps = import ./deps.nix {
+    fetchNuGet = { name, version, sha256 }: fetchurl {
+      name = "nuget-${name}-${version}.nupkg";
+      url = "https://www.nuget.org/api/v2/package/${name}/${version}";
+      inherit sha256;
+    };
+  };
+  dotnetSdk = dotnetCorePackages.sdk_3_1;
+in
+
+stdenv.mkDerivation rec {
+  pname = "btcpayserver";
+  version = "1.0.5.5";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "11h1nrmb7f44msbhhiz9ddqh5ss2kz6d8ysnvd070x3xj5krgnxz";
+  };
+
+  nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget ];
+
+  # Due to a bug in btcpayserver, we can't just `dotnet publish` to create a binary.
+  # Build with `dotnet build` instead and add a custom `dotnet run` script.
+  buildPhase = ''
+    export HOME=$TMP/home
+    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
+
+    nuget sources Add -Name tmpsrc -Source $TMP/nuget
+    nuget init ${linkFarmFromDrvs "deps" deps} $TMP/nuget
+
+    dotnet restore --source $TMP/nuget BTCPayServer/BTCPayServer.csproj
+    dotnet build -c Release BTCPayServer/BTCPayServer.csproj
+  '';
+
+  runScript =  ''
+    #!${bash}/bin/bash
+    DOTNET_CLI_TELEMETRY_OPTOUT=1 exec ${dotnetSdk}/bin/dotnet run --no-launch-profile --no-build \
+      -c Release -p @@SHARE@@/BTCPayServer/BTCPayServer.csproj -- "$@"
+  '';
+
+  installPhase = ''
+    cd ..
+    share=$out/share/$pname
+    mkdir -p $share
+    mv -T source $share
+    install -D -m500 <(echo "$runScript" | sed "s|@@SHARE@@|$share|") $out/bin/$pname
+  '';
+
+  dontStrip = true;
+
+  meta = with lib; {
+    description = "Self-hosted, open-source cryptocurrency payment processor";
+    homepage = "https://btcpayserver.org";
+    maintainers = with maintainers; [ kcalvinalvin earvstedt ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/applications/blockchains/btcpayserver/deps.nix
+++ b/pkgs/applications/blockchains/btcpayserver/deps.nix
--- a/pkgs/applications/blockchains/btcpayserver/update.sh
+++ b/pkgs/applications/blockchains/btcpayserver/update.sh
@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+
+"$scriptDir"/../nbxplorer/util/update-common.sh btcpayserver "$scriptDir"/deps.nix
--- a/pkgs/applications/blockchains/nbxplorer/default.nix
+++ b/pkgs/applications/blockchains/nbxplorer/default.nix
@ -0,0 +1,54 @@
+{ lib, stdenv, fetchFromGitHub, fetchurl, linkFarmFromDrvs, makeWrapper,
+  dotnetPackages, dotnetCorePackages
+}:
+
+let
+  deps = import ./deps.nix {
+    fetchNuGet = { name, version, sha256 }: fetchurl {
+      name = "nuget-${name}-${version}.nupkg";
+      url = "https://www.nuget.org/api/v2/package/${name}/${version}";
+      inherit sha256;
+    };
+  };
+  dotnetSdk = dotnetCorePackages.sdk_3_1;
+in
+
+stdenv.mkDerivation rec {
+  pname = "nbxplorer";
+  version = "2.1.42";
+
+  src = fetchFromGitHub {
+    owner = "dgarage";
+    repo = "NBXplorer";
+    rev = "v${version}";
+    sha256 = "01q6n7095rrha00xs3l7igzfb9rd743z8crxa2dcz4q5srapfzpi";
+  };
+
+  nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget makeWrapper ];
+
+  buildPhase = ''
+    export HOME=$TMP/home
+    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
+
+    nuget sources Add -Name tmpsrc -Source $TMP/nuget
+    nuget init ${linkFarmFromDrvs "deps" deps} $TMP/nuget
+
+    dotnet restore --source $TMP/nuget NBXplorer/NBXplorer.csproj
+    dotnet publish --no-restore --output $out/share/$pname -c Release NBXplorer/NBXplorer.csproj
+  '';
+
+  installPhase = ''
+    makeWrapper $out/share/$pname/NBXplorer $out/bin/$pname \
+      --set DOTNET_ROOT "${dotnetSdk}"
+  '';
+
+  dontStrip = true;
+
+  meta = with lib; {
+    description = "Minimalist UTXO tracker for HD Cryptocurrency Wallets";
+    maintainers = with maintainers; [ kcalvinalvin earvstedt ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/applications/blockchains/nbxplorer/deps.nix
+++ b/pkgs/applications/blockchains/nbxplorer/deps.nix
--- a/pkgs/applications/blockchains/nbxplorer/update.sh
+++ b/pkgs/applications/blockchains/nbxplorer/update.sh
@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+
+getVersionFromTags=1 "$scriptDir"/util/update-common.sh nbxplorer "$scriptDir"/deps.nix
--- a/pkgs/applications/blockchains/nbxplorer/util/create-deps.sh
+++ b/pkgs/applications/blockchains/nbxplorer/util/create-deps.sh
@ -0,0 +1,45 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p dotnet-sdk_3
+set -euo pipefail
+
+# Writes deps for dotnet package in $pkgSrc to $depsFile.
+# Expects $pkgSrc to contain a single .sln file.
+
+pkgSrc=$1
+depsFile=$2
+
+sln=$(cd "$pkgSrc"; find * -maxdepth 0 -name '*.sln' | head -1)
+[[ $sln ]] || { echo "No .sln file in $pkgSrc" ; exit 1; }
+
+tmpdir=$(mktemp -d /tmp/$pkgName-src.XXX)
+echo "Using tmp dir: $tmpdir"
+cp -rT "$pkgSrc" "$tmpdir"
+chmod -R +w "$tmpdir"
+
+pushd "$tmpdir" > /dev/null
+mkdir home
+echo "Running dotnet restore for $sln"
+HOME=home DOTNET_CLI_TELEMETRY_OPTOUT=1 \
+  dotnet restore -v normal --no-cache "$sln" > restore_log
+
+echo "{ fetchNuGet }: [" > "$depsFile"
+while read pkgSpec; do
+  { read name; read version; } < <(
+    # Ignore build version part: 1.0.0-beta2+77df2220 -> 1.0.0-beta2
+    sed -nE 's/.*<id>([^<]*).*/\1/p; s/.*<version>([^<+]*).*/\1/p' "$pkgSpec"
+  )
+  sha256=$(nix-hash --type sha256 --flat --base32 "$(dirname "$pkgSpec")"/*.nupkg)
+  cat >> "$depsFile" <<EOF
+  (fetchNuGet {
+    name = "$name";
+    version = "$version";
+    sha256 = "$sha256";
+  })
+EOF
+done < <(find home/.nuget/packages -name '*.nuspec' | LC_ALL=C sort)
+echo "]" >> "$depsFile"
+
+echo "Created $depsFile"
+
+popd > /dev/null
+rm -r $tmpdir
--- a/pkgs/applications/blockchains/nbxplorer/util/update-common.sh
+++ b/pkgs/applications/blockchains/nbxplorer/util/update-common.sh
@ -0,0 +1,51 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_3
+set -euo pipefail
+
+# This script uses the following env vars:
+# getVersionFromTags
+# onlyCreateDeps
+
+pkgName=$1
+depsFile=$2
+
+: ${getVersionFromTags:=}
+: ${onlyCreateDeps:=}
+
+scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+nixpkgs=$(realpath "$scriptDir"/../../../../..)
+
+evalNixpkgs() {
+  nix eval --raw "(with import \"$nixpkgs\" {}; $1)"
+}
+
+getRepo() {
+  url=$(evalNixpkgs $pkgName.src.meta.homepage)
+  echo $(basename $(dirname $url))/$(basename $url)
+}
+
+getLatestVersionTag() {
+  "$nixpkgs"/pkgs/common-updater/scripts/list-git-tags https://github.com/$(getRepo) 2>/dev/null \
+    | sort -V | tail -1 | sed 's|^v||'
+}
+
+if [[ ! $onlyCreateDeps ]]; then
+  oldVersion=$(evalNixpkgs "$pkgName.version")
+  if [[ $getVersionFromTags ]]; then
+    newVersion=$(getLatestVersionTag)
+  else
+    newVersion=$(curl -s "https://api.github.com/repos/$(getRepo)/releases" | jq -r '.[0].name')
+  fi
+
+  if [[ $newVersion == $oldVersion ]]; then
+    echo "nixpkgs already has the latest version $newVersion"
+    echo "Run this script with env var onlyCreateDeps=1 to recreate "$(basename "$depsFile")
+    exit 0
+  else
+    echo "Updating $pkgName: $oldVersion -> $newVersion"
+    (cd "$nixpkgs" && update-source-version "$pkgName" "$newVersion")
+  fi
+fi
+
+storeSrc="$(nix-build "$nixpkgs" -A $pkgName.src --no-out-link)"
+. "$scriptDir"/create-deps.sh "$storeSrc" "$depsFile"
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -14,9 +14,9 @@ let
    sha256Hash = "15vm7fvi8c286wx9f28z6ysvm8wqqda759qql0zy9simwx22gy7j";
  };
  betaVersion = {
-    version = "4.1.0.17"; # "Android Studio 4.1 RC 2"
-    build = "201.6776251";
-    sha256Hash = "sha256-3W+eUcffRk7lZxbvf3X/Np4hkwAUqU51sQ061XR7Ddc=";
+    version = "4.1.0.18"; # "Android Studio 4.1 RC 3"
+    build = "201.6823847";
+    sha256Hash = "sha256-qbxmR9g8DSKzcP09bJuc+am79BSXWG39UQxFEb1bZ88=";
  };
  latestVersion = { # canary & dev
    version = "4.2.0.10"; # "Android Studio 4.2 Canary 10"
--- a/pkgs/applications/editors/jedit/default.nix
+++ b/pkgs/applications/editors/jedit/default.nix
@ -44,12 +44,8 @@ stdenv.mkDerivation {
    mkdir -p $out/share/applications
    mv package-files/linux/deb/jedit.desktop $out/share/applications/jedit.desktop

-    patch package-files/linux/jedit << EOF
-    5a6,8
-    > # specify the correct JAVA_HOME
-    > JAVA_HOME=${jdk.jre.home}/jre
-    > 
-    EOF
+    # specify the correct JAVA_HOME
+    sed -i '1a JAVA_HOME=${jdk}' package-files/linux/jedit
    sed -i "s|/usr/share/jEdit/@jar.filename@|$out/share/jEdit/jedit.jar|g" package-files/linux/jedit
    mkdir -p $out/bin
    cp package-files/linux/jedit $out/bin/jedit
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -268,12 +268,12 @@ in

  clion = buildClion rec {
    name = "clion-${version}";
-    version = "2020.2.1"; /* updated by script */
+    version = "2020.2.3"; /* updated by script */
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "1sma3ay02lajg6q1g3k05gi7jdja7cf9rxb9v0w62s6z87l719bv"; /* updated by script */
+      sha256 = "1kdlmdsfxmwks3rk2dzm5q30vwzpxcwzpyjsir122k36xnqvaqxq"; /* updated by script */
    };
    wmClass = "jetbrains-clion";
    update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@ -281,12 +281,12 @@ in

  datagrip = buildDataGrip rec {
    name = "datagrip-${version}";
-    version = "2020.2.2"; /* updated by script */
+    version = "2020.2.3"; /* updated by script */
    description = "Your Swiss Army Knife for Databases and SQL";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "1bk6z6mirrykypb4j2wa4744v0m9y1n7973qgj6z3dsifrq9q7zc"; /* updated by script */
+      sha256 = "0iv1zmdpbqk8f4cjd6dhgj9mrvxli4dg83jzkhv566sy8wrrx7kb"; /* updated by script */
    };
    wmClass = "jetbrains-datagrip";
    update-channel = "DataGrip RELEASE";
@ -294,12 +294,12 @@ in

  goland = buildGoland rec {
    name = "goland-${version}";
-    version = "2020.2.2"; /* updated by script */
+    version = "2020.2.3"; /* updated by script */
    description = "Up and Coming Go IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "1r6bbx5hsg82l1pa3syfdi8nbsz6rrfszsw4dmwcnxvccp2hs3mh"; /* updated by script */
+      sha256 = "18mzlqibgc6lzwhbmyrni56464qhzla9mss27d45hv0mbv087jn0"; /* updated by script */
    };
    wmClass = "jetbrains-goland";
    update-channel = "GoLand RELEASE";
@ -307,12 +307,12 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2020.2.1"; /* updated by script */
+    version = "2020.2.2"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "055hy5jy5151x3gf8hn7ar36br545qr253fz9wrc3b49wydg01x1"; /* updated by script */
+      sha256 = "0kbn9q7fvhrzb1w6l8i2nv4cx8qrj74jp7fidj9yk8vkv9lfijg6"; /* updated by script */
    };
    wmClass = "jetbrains-idea-ce";
    update-channel = "IntelliJ IDEA RELEASE";
@ -320,12 +320,12 @@ in

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2020.2.1"; /* updated by script */
+    version = "2020.2.2"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "1g18l3malsyn7dij4w83yfcsb8msa0s89mzlld3dby8hr9bq0aqm"; /* updated by script */
+      sha256 = "1196zrcbgrr9271kjrzd2mzvhvxd7hkr1d2a4ij4h8f97qmsd6r6"; /* updated by script */
    };
    wmClass = "jetbrains-idea";
    update-channel = "IntelliJ IDEA RELEASE";
@ -333,12 +333,12 @@ in

  mps = buildMps rec {
    name = "mps-${version}";
-    version = "2020.1.4"; /* updated by script */
+    version = "2020.2"; /* updated by script */
    description = "Create your own domain-specific language";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
-      url = "https://download.jetbrains.com/mps/2020.1/MPS-${version}.tar.gz";
-      sha256 = "1j5n100fl8yvfla2slm95wv499azwzzxigp1kdcaj8xbc0a0mp7c"; /* updated by script */
+      url = "https://download.jetbrains.com/mps/2020.2/MPS-${version}.tar.gz";
+      sha256 = "06c0yv9vvz0y5njh1sghn7ijpn1d81mxsyk5xjpj29bvvg511pjs"; /* updated by script */
    };
    wmClass = "jetbrains-mps";
    update-channel = "MPS RELEASE";
@ -359,12 +359,12 @@ in

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2020.2.1"; /* updated by script */
+    version = "2020.2.2"; /* updated by script */
    description = "PyCharm Community Edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0kml58v6clqj0j0vlvghrywxym2n9h41izazzn4srn7wjj9010fa"; /* updated by script */
+      sha256 = "1a1vhlc2q5n3dxli0x6ppxx3mgary4gpakcxdp9nylmixjzjph6v"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm-ce";
    update-channel = "PyCharm RELEASE";
@ -372,12 +372,12 @@ in

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2020.2.1"; /* updated by script */
+    version = "2020.2.2"; /* updated by script */
    description = "PyCharm Professional Edition";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0ml9fg1dlfg8sdp9n8nlsj7z88dx0ac1kvlpk61p7q5di1lyxc94"; /* updated by script */
+      sha256 = "0v64f5sbv1639d6fjg0shfgdy40f1xc2zbn0jqfrx6xmkg7wgsz9"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm";
    update-channel = "PyCharm RELEASE";
@ -385,12 +385,12 @@ in

  rider = buildRider rec {
    name = "rider-${version}";
-    version = "2020.2.1"; /* updated by script */
+    version = "2020.2.2"; /* updated by script */
    description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "0xrk7n0mprzy7dfkx3vj5wasw5031jl61qkh89y6w031hp77vq7n"; /* updated by script */
+      sha256 = "1v3n4mg8b55ni72bdgsgiwyqcvp9zhqlkqshscwfjggv0iai9r6p"; /* updated by script */
    };
    wmClass = "jetbrains-rider";
    update-channel = "Rider RELEASE";
@ -398,12 +398,12 @@ in

  ruby-mine = buildRubyMine rec {
    name = "ruby-mine-${version}";
-    version = "2020.2.1"; /* updated by script */
+    version = "2020.2.2"; /* updated by script */
    description = "The Most Intelligent Ruby and Rails IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "1pkzql710bc4qdz5pdhh0yx9wkqx85qwkwm1jvvvxbvbsj299vcb"; /* updated by script */
+      sha256 = "11v26hpf891nq5vj8i0ad4shhzpy8b7rvyrkr3l29dwfnd83lgpz"; /* updated by script */
    };
    wmClass = "jetbrains-rubymine";
    update-channel = "RubyMine RELEASE";
@ -411,12 +411,12 @@ in

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2020.2.1"; /* updated by script */
+    version = "2020.2.2"; /* updated by script */
    description = "Professional IDE for Web and JavaScript development";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "1sx67bms90fsc1bf6pqz1rd1x9aysj0xxb8d7cnclz6bv8kzhgfp"; /* updated by script */
+      sha256 = "1w17cf0qj0vyizkzj1frcmi52q5qxbf31msg8df38wy2l8r0b928"; /* updated by script */
    };
    wmClass = "jetbrains-webstorm";
    update-channel = "WebStorm RELEASE";
--- a/pkgs/applications/editors/micro/default.nix
+++ b/pkgs/applications/editors/micro/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  pname = "micro";
-  version = "2.0.5";
+  version = "2.0.7";

  goPackagePath = "github.com/zyedidia/micro";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner = "zyedidia";
    repo = pname;
    rev = "v${version}";
-    sha256 = "12fyyax1mr0n82s5yhmk90iyyzbh32rppkkpj37c25pal73czdhc";
+    sha256 = "07ck1a9arklic3p0z50wcg608cvpba1kljvlfb4fljr6jhv5cmkb";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/editors/micro/deps.nix
+++ b/pkgs/applications/editors/micro/deps.nix
@ -189,6 +189,15 @@
      sha256 = "187i5g88sxfy4vxpm7dw1gwv29pa2qaq475lxrdh5livh69wqfjb";
    };
  }
+  {
+    goPackagePath = "github.com/xo/terminfo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/xo/terminfo";
+      rev = "454e5b68f9e8";
+      sha256 = "0xvjb09nwbanp7ja4560pwb6b2xr9h0axyr7f5clgncca2k4f1pd";
+    };
+  }
  {
    goPackagePath = "github.com/yuin/gopher-lua";
    fetch = {
@ -203,8 +212,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/zyedidia/clipboard";
-      rev = "7c45b8673834";
-      sha256 = "0ag36wd3830d4s6fvpj05v6f662c5rymgdydsj2gq8aaqplfb0v4";
+      rev = "v1.0.3";
+      sha256 = "134vnx0r51f08b37yaymlxlfl14qv6r8yzgqz7dxxn1zw9197b3q";
    };
  }
  {
@ -257,8 +266,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/zyedidia/tcell";
-      rev = "v1.4.7";
-      sha256 = "1ddaznp0haz35mxfjjh2fmamdrlk1igqg65fz22l5r6vvhcdsfxa";
+      rev = "v2.0.2";
+      sha256 = "0fr7zm6zcir2bjll5ycdxy9m98gjr3ins7mzmqpd46b3njzbl75z";
    };
  }
  {
--- a/pkgs/applications/editors/netbeans/default.nix
+++ b/pkgs/applications/editors/netbeans/default.nix
@ -3,7 +3,7 @@
 }:

 let
-  version = "12.0";
+  version = "12.1";
  desktopItem = makeDesktopItem {
    name = "netbeans";
    exec = "netbeans";
@ -19,7 +19,7 @@ stdenv.mkDerivation {
  inherit version;
  src = fetchurl {
    url = "mirror://apache/netbeans/netbeans/${version}/netbeans-${version}-bin.zip";
-    sha512 = "91030c9628a08acd85f1a58a7f71eec2e57dc85841c1c475cc6311335b5d8cdc10c1198274b9668b7f61a28d04b07661247dc1c3e36b8e29214aec3748e499e4";
+    sha512 = "ad4bb5b191c784ed144b0b4831a8b95e0707c362917833c279d3f6fad11d7b3fb1f004f30121a941b694fc2ce323974b15072aa31cb5449111bc5d33d0d77103";
  };

  buildCommand = ''
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "texstudio";
-  version = "3.0.0";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "${pname}-org";
    repo = pname;
    rev = version;
-    sha256 = "1663lgl30698awa7fjplr8rjnf6capqvf8z80lzlnkfl5m9ph0jb";
+    sha256 = "18ad85y4hrsvp7gs50dfg08cz40vbakb9hs8gw4cvi7r17vds5ar";
  };

  nativeBuildInputs = [ qmake wrapQtAppsHook pkgconfig ];
--- a/pkgs/applications/editors/vscode/update.sh
+++ b/pkgs/applications/editors/vscode/update.sh
@ -1,6 +1,8 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p curl gnugrep gnused gawk

+set -eou pipefail
+
 ROOT="$(dirname "$(readlink -f "$0")")"
 if [ ! -f "$ROOT/vscode.nix" ]; then
  echo "ERROR: cannot find vscode.nix in $ROOT"
@ -36,4 +38,4 @@ sed -i "s/x86_64-linux = \".\{52\}\"/x86_64-linux = \"${VSCODIUM_LINUX_SHA256}\"

 VSCODIUM_DARWIN_URL="https://github.com/VSCodium/vscodium/releases/download/${VSCODIUM_VER}/VSCodium-darwin-${VSCODIUM_VER}.zip"
 VSCODIUM_DARWIN_SHA256=$(nix-prefetch-url ${VSCODIUM_DARWIN_URL})
-sed -i "s/x86_64-darwin = \".\{52\}\"/x86_64-darwin = \"${VSCODIUM_DARWIN_SHA256}\"/" "$ROOT/vscodium.nix"
+sed -i "s/x86_64-darwin = \".\{52\}\"/x86_64-darwin = \"${VSCODIUM_DARWIN_SHA256}\"/" "$ROOT/vscodium.nix"
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -11,8 +11,8 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "17frdyli375l20mb7sb5bmw000p9cplj4pagmhnb6nibi9wqypdx";
-    x86_64-darwin = "1dh5k36fjdfwhidlsg1grjwy3s9jik3pg6xpdgi6946vzqv1vxll";
+    x86_64-linux = "10v13j1zg1bpgmr99vqhs1gwcipvnbkln0w6yphwn9440fw9fyp4";
+    x86_64-darwin = "1mgi2awrqsm11l1yb8rgmfrxvjfn9z3qvp5np76vgbaibq2ihh0k";
  }.${system};

  sourceRoot = {
@ -27,7 +27,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.48.2";
+    version = "1.49.1";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/applications/gis/saga/default.nix
@ -6,7 +6,7 @@
 # not native
 , gdal
 , wxGTK31-gtk3
-, proj_5
+, proj
 , dxflib
 , curl
 , libiodbc
@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
    hdf5
    gdal
    wxGTK31-gtk3
-    proj_5
+    proj
    libharu
    opencv
    vigra
--- a/pkgs/applications/graphics/akira/default.nix
+++ b/pkgs/applications/graphics/akira/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "akira";
-  version = "2020-05-01";
+  version = "0.0.13";

  src = fetchFromGitHub {
    owner = "akiraux";
    repo = "Akira";
-    rev = "87c495fa0a686b1e9b84aff7d9c0a9553da2c466";
-    sha256 = "0ikz6dyx0z2wqskas628hbrbhx3z5gy7i4acrvspfhhg6rk88aqd";
+    rev = "v${version}";
+    sha256 = "1i20q78jagy8xky68nmd0n7mqvh88r98kp626rnlgyzvlc3c22cm";
  };

  nativeBuildInputs = [
@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
    description = "Native Linux Design application built in Vala and GTK";
    homepage = "https://github.com/akiraux/Akira";
    license = licenses.gpl3;
-    maintainers = with maintainers; [ filalex77 ] ++ pantheon.maintainers;
+    maintainers = with maintainers; [ filalex77 neonfuz ] ++ pantheon.maintainers;
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/graphics/sane/backends/airscan/default.nix
+++ b/pkgs/applications/graphics/sane/backends/airscan/default.nix
@ -1,17 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, avahi, libsoup, libjpeg, libpng
+{ lib, stdenv, fetchFromGitHub, pkg-config, avahi, libsoup, libjpeg, libpng, gnutls
 , sane-backends, meson, ninja }:
 stdenv.mkDerivation rec {
  pname = "sane-airscan";
-  version = "0.99.8";
+  version = "0.99.16";

  nativeBuildInputs = [ meson ninja pkg-config ];
-  buildInputs = [ avahi libsoup libjpeg libpng sane-backends ];
+  buildInputs = [ avahi libsoup libjpeg libpng gnutls sane-backends ];

  src = fetchFromGitHub {
    owner = "alexpevzner";
    repo = pname;
    rev = version;
-    sha256 = "0sdlnbzhnfn4i5mkqhc8zmjywbbjqkbnsiz2gpqhy6fypshryahz";
+    sha256 = "00lgcdbpns0shwlpkvrpfm4z05s7v5q3al4kcw6ii7xnkzmv1721";
  };

  meta = with lib; {
--- a/pkgs/applications/graphics/ufraw/default.nix
+++ b/pkgs/applications/graphics/ufraw/default.nix
@ -66,6 +66,8 @@ stdenv.mkDerivation {
  meta = with stdenv.lib; {
    homepage = "https://github.com/sergiomb2/ufraw";

+    broken = true; # https://github.com/NixOS/nixpkgs/issues/97946
+
    description = "Utility to read and manipulate raw images from digital cameras";

    longDescription =
--- a/pkgs/applications/graphics/yed/default.nix
+++ b/pkgs/applications/graphics/yed/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "yEd";
-  version = "3.20";
+  version = "3.20.1";

  src = fetchzip {
    url = "https://www.yworks.com/resources/yed/demo/${pname}-${version}.zip";
-    sha256 = "08j8lpn2nd41gavgrj03rlrxl04wcamq1y02f1x1569ykbhycb3m";
+    sha256 = "0sd73s700f3gqq5zq1psrqjg6ff2gv49f8vd37v6bv65vdxqxryq";
  };

  nativeBuildInputs = [ makeWrapper unzip ];
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ArchiSteamFarm";
-  version = "4.2.3.6";
+  version = "4.2.4.0";

  src = fetchurl {
    url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-generic.zip";
-    sha256 = "1a8baxrb8czndxxi16md1nyl2snfx215yvrygdpcblgngkp2z2y9";
+    sha256 = "1nkbyy9gnp8nkr04bbiapwvv2nspnl36fvnzjwaq4a13mj49m5zq";
  };

  nativeBuildInputs = [ unzip makeWrapper jq ];
--- a/pkgs/applications/misc/adobe-reader/default.nix
+++ b/pkgs/applications/misc/adobe-reader/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, libX11, cups, zlib, libxml2, pango, atk, gtk2, glib
-, gdk-pixbuf }:
+, gdk-pixbuf, gdk-pixbuf-xlib }:

 assert stdenv.hostPlatform.system == "i686-linux";

@ -20,7 +20,7 @@ stdenv.mkDerivation {
  # versions.

  libPath = stdenv.lib.makeLibraryPath
-    [ stdenv.cc.cc libX11 zlib libxml2 cups pango atk gtk2 glib gdk-pixbuf ];
+    [ stdenv.cc.cc libX11 zlib libxml2 cups pango atk gtk2 glib gdk-pixbuf gdk-pixbuf-xlib ];

  passthru.mozillaPlugin = "/libexec/adobe-reader/Browser/intellinux";

--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -9,6 +9,7 @@
 , colladaSupport ? true, opencollada
 , makeWrapper
 , pugixml, SDL, Cocoa, CoreGraphics, ForceFeedback, OpenAL, OpenGL
+, embree
 }:

 with lib;
@ -17,11 +18,11 @@ let python = python3Packages.python; in

 stdenv.mkDerivation rec {
  pname = "blender";
-  version = "2.83.5";
+  version = "2.90.0";

  src = fetchurl {
    url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    sha256 = "0xyawly00a59hfdb6b7va84k5fhcv2mxnzd77vs22bzi9y7sap43";
+    sha256 = "08qkvgdfrqh4ljqw5m64bbki1dsfcs4xnwzq6829z3ddhiwrxw84";
  };

  patches = lib.optional stdenv.isDarwin ./darwin.patch;
@ -35,6 +36,7 @@ stdenv.mkDerivation rec {
      (opensubdiv.override { inherit cudaSupport; })
      tbb
      makeWrapper
+      embree
    ]
    ++ (if (!stdenv.isDarwin) then [
      libXi libX11 libXext libXrender
@ -50,8 +52,11 @@ stdenv.mkDerivation rec {
    ++ optional cudaSupport cudatoolkit
    ++ optional colladaSupport opencollada;

-  postPatch =
-    if stdenv.isDarwin then ''
+  postPatch = ''
+    # allow usage of dynamically linked embree
+    rm build_files/cmake/Modules/FindEmbree.cmake
+  '' +
+    (if stdenv.isDarwin then ''
      : > build_files/cmake/platform/platform_apple_xcode.cmake
      substituteInPlace source/creator/CMakeLists.txt \
        --replace '${"$"}{LIBDIR}/python' \
@ -77,7 +82,7 @@ stdenv.mkDerivation rec {
                  'set(OPENEXR_INCLUDE_DIRS "${openexr.dev}/include/OpenEXR") #'
    '' else ''
      substituteInPlace extern/clew/src/clew.c --replace '"libOpenCL.so"' '"${ocl-icd}/lib/libOpenCL.so"'
-    '';
+    '');

  cmakeFlags =
    [
--- a/pkgs/applications/misc/cli-visualizer/default.nix
+++ b/pkgs/applications/misc/cli-visualizer/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fftw, ncurses5, libpulseaudio, makeWrapper }:
+{ stdenv, fetchFromGitHub, cmake, fftw, ncurses5, libpulseaudio, makeWrapper }:

 stdenv.mkDerivation rec {
  version = "1.8";
@ -15,13 +15,13 @@ stdenv.mkDerivation rec {
    sed '1i#include <cmath>' -i src/Transformer/SpectrumCircleTransformer.cpp
  '';

+  nativeBuildInputs = [ cmake ];
+
  buildInputs = [ fftw ncurses5 libpulseaudio makeWrapper ];

  buildFlags = [ "ENABLE_PULSE=1" ];

-  installPhase = ''
-    mkdir -p $out/bin
-    cp build/vis $out/bin/vis
+  postInstall = ''
    # See https://github.com/dpayne/cli-visualizer/issues/62#issuecomment-330738075
    wrapProgram $out/bin/vis --set TERM rxvt-256color
  '';
--- a/pkgs/applications/misc/exercism/default.nix
+++ b/pkgs/applications/misc/exercism/default.nix
@ -21,6 +21,6 @@ buildGoModule rec {
   inherit (src.meta) homepage;
   description = "A Go based command line tool for exercism.io";
   license     = licenses.mit;
-   maintainers = [ maintainers.rbasso ];
+   maintainers = [ maintainers.rbasso maintainers.nobbz ];
  };
 }
--- a/pkgs/applications/misc/gpsprune/default.nix
+++ b/pkgs/applications/misc/gpsprune/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, stdenv, makeDesktopItem, makeWrapper, unzip, jdk11 }:
+{ fetchurl, stdenv, makeDesktopItem, makeWrapper, unzip, jdk }:

 stdenv.mkDerivation rec {
  pname = "gpsprune";
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ jdk11 ];
+  buildInputs = [ jdk ];

  desktopItem = makeDesktopItem {
    name = "gpsprune";
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
  buildCommand = ''
    mkdir -p $out/bin $out/share/java
    cp -v $src $out/share/java/gpsprune.jar
-    makeWrapper ${jdk11}/bin/java $out/bin/gpsprune \
+    makeWrapper ${jdk}/bin/java $out/bin/gpsprune \
      --add-flags "-jar $out/share/java/gpsprune.jar"
    mkdir -p $out/share/applications
    cp $desktopItem/share/applications"/"* $out/share/applications
--- a/pkgs/applications/misc/gramps/default.nix
+++ b/pkgs/applications/misc/gramps/default.nix
@ -13,14 +13,13 @@ in buildPythonApplication rec {
  pname = "gramps";

  nativeBuildInputs = [ wrapGAppsHook gettext ];
-  buildInputs = [ intltool gtk3 gobject-introspection pango gnome3.gexiv2 ] 
+  buildInputs = [ intltool gtk3 gobject-introspection pango gnome3.gexiv2 ]
    # Map support
    ++ stdenv.lib.optional enableOSM osm-gps-map
    # Graphviz support
    ++ stdenv.lib.optional enableGraphviz graphviz
    # Ghostscript support
    ++ stdenv.lib.optional enableGhostscript ghostscript
-    
  ;

  src = fetchFromGitHub {
@ -60,6 +59,5 @@ in buildPythonApplication rec {
    description = "Genealogy software";
    homepage = "https://gramps-project.org";
    license = licenses.gpl2;
-    maintainers = with maintainers; [ joncojonathan ];
  };
 }
--- a/pkgs/applications/misc/heimer/default.nix
+++ b/pkgs/applications/misc/heimer/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "heimer";
-  version = "1.18.0";
+  version = "1.19.0";

  src = fetchFromGitHub {
    owner = "juzzlin";
    repo = pname;
    rev = version;
-    sha256 = "16p18svfcp201gd624wzmf0gpdvywybxp8539igin6s70k6rpc97";
+    sha256 = "18paabqfxz49fahdi4fs5z870aynmyfj3xw8q768qffgc26zhl3m";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@ -1,15 +1,15 @@
 { stdenv, fetchurl, fetchsvn, makeWrapper, unzip, jre, libXxf86vm }:
 let
  pname = "josm";
-  version = "16812";
+  version = "17013";
  srcs = {
    jar = fetchurl {
      url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      sha256 = "1ld0c87mhifbdnlrr7a9jmgn3s5xklzbpwcl1m6j1lc18ajs1awq";
+      sha256 = "0dgfiqk5bcbs03llkffm6h96zcqa19azbanac883g26f6z6j9b8j";
    };
    macosx = fetchurl {
      url = "https://josm.openstreetmap.de/download/macosx/josm-macosx-${version}.zip";
-      sha256 = "0vhawcgzh06k2dfqav28n3sv1ij1ziz6bgi4k7m0diix6ia7hlar";
+      sha256 = "1mzaxcswmxah0gc9cifgaazwisr5cbanf4bspv1ra8xwzj5mdss6";
    };
    pkg = fetchsvn {
      url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
--- a/pkgs/applications/misc/keepass/default.nix
+++ b/pkgs/applications/misc/keepass/default.nix
@ -87,7 +87,7 @@ with builtins; buildDotnetPackage rec {

  dynlibPath = stdenv.lib.makeLibraryPath [ gtk2 ];

-  postInstall = 
+  postInstall =
  let
    extractFDeskIcons = ./extractWinRscIconsToStdFreeDesktopDir.sh;
  in
@ -111,7 +111,7 @@ with builtins; buildDotnetPackage rec {
  meta = {
    description = "GUI password manager with strong cryptography";
    homepage = "http://www.keepass.info/";
-    maintainers = with stdenv.lib.maintainers; [ amorsillo obadz joncojonathan jraygauthier ];
+    maintainers = with stdenv.lib.maintainers; [ amorsillo obadz jraygauthier ];
    platforms = with stdenv.lib.platforms; all;
    license = stdenv.lib.licenses.gpl2;
  };
--- a/pkgs/applications/misc/navi/default.nix
+++ b/pkgs/applications/misc/navi/default.nix
@ -2,21 +2,23 @@

 rustPlatform.buildRustPackage rec {
  pname = "navi";
-  version = "2.10.0";
+  version = "2.12.0";

  src = fetchFromGitHub {
    owner = "denisidoro";
    repo = "navi";
    rev = "v${version}";
-    sha256 = "1fpfc3ikb6rhb8m0dp9ybh46mnqaw361rrsbv6yrivwfm3zc4w2w";
+    sha256 = "0izmf4flwwn2h1wwpsnghb6rd494lj63hhsky1v9v6l1l641had4";
  };

-  cargoSha256 = "0klizxrb92h7qfxs89m08ksdq698wx4kxsdhqhr5ld9dy3b6ks32";
+  cargoSha256 = "19xv9kbmxbp84lj8ycifsdr7sw9vhwgla7cdmrvlhayiq5r04xd7";

  nativeBuildInputs = [ makeWrapper ];

  postInstall = ''
-    wrapProgram $out/bin/navi --prefix PATH : ${lib.makeBinPath [ fzf wget ]}
+    wrapProgram $out/bin/navi \
+      --prefix PATH : "$out/bin" \
+      --prefix PATH : ${lib.makeBinPath [ fzf wget ]}
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/nwg-launchers/default.nix
+++ b/pkgs/applications/misc/nwg-launchers/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "nwg-launchers";
-  version = "0.2.0";
+  version = "0.3.3";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1mlym0mpg6njwgwniwlk95fk6wfwlzq8nwmkb5mkjlm2nqv5bdv1";
+    sha256 = "1p1bwsn7l4vp7y183735pgsfbh7dssdfn0wjzacl4s87arjdcgvb";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/openrgb/default.nix
+++ b/pkgs/applications/misc/openrgb/default.nix
@ -1,19 +1,27 @@
-{ mkDerivation, lib, fetchFromGitHub, qmake, libusb1, hidapi, pkg-config }:
+{ mkDerivation, lib, fetchFromGitHub, qmake, libusb1, hidapi, pkg-config, fetchpatch }:

 mkDerivation rec {
  pname = "openrgb";
-  version = "0.3";
+  version = "0.4";

  src = fetchFromGitHub {
    owner = "CalcProgrammer1";
    repo = "OpenRGB";
    rev = "release_${version}";
-    sha256 = "1931aisdahjr99d4qqk824ib4x19mvhqgqmkm3j6fc5zd2hnw87m";
+    sha256 = "sha256-tHrRG2Zx7NYqn+WPiRpAlWA/QmxuAYidENanTkC1XVw";
  };

  nativeBuildInputs = [ qmake pkg-config ];
  buildInputs = [ libusb1 hidapi ];

+  patches = [
+    # Make build SOURCE_DATE_EPOCH aware, merged in master
+    (fetchpatch {
+      url = "https://gitlab.com/CalcProgrammer1/OpenRGB/-/commit/f1b7b8ba900db58a1119d8d3e21c1c79de5666aa.patch";
+      sha256 = "17m1hn1kjxfcmd4p3zjhmr5ar9ng0zfbllq78qxrfcq1a0xrkybx";
+    })
+  ];
+
  installPhase = ''
    mkdir -p $out/bin
    cp OpenRGB $out/bin
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@ -11,13 +11,13 @@

 mkDerivationWith stdenv.mkDerivation rec {
  pname = "qcad";
-  version = "3.25.0.0";
+  version = "3.25.2.0";

  src = fetchFromGitHub {
    owner = "qcad";
    repo = "qcad";
    rev = "v${version}";
-    sha256 = "07qph2645m1wi9yi04ixdvx8dli03q1vimj3laqdmnpipi54lljc";
+    sha256 = "1lz6q9n2p0l7k8rwqsdj6av9p3426423g5avc4y6s7nbk36280mz";
  };

  patches = [
@ -61,6 +61,10 @@ mkDerivationWith stdenv.mkDerivation rec {
    cp -r plugins $out/lib/plugins
    cp -r patterns $out/lib/patterns

+    # workaround to fix the library browser:
+    rm -r $out/lib/plugins/sqldrivers
+    ln -s -t $out/lib/plugins ${qt5.qtbase}/${qt5.qtbase.qtPluginPrefix}/sqldrivers
+
    install -Dm644 scripts/qcad_icon.svg $out/share/icons/hicolor/scalable/apps/qcad.svg

    runHook postInstall
--- a/pkgs/applications/misc/snowsql/default.nix
+++ b/pkgs/applications/misc/snowsql/default.nix
@ -8,20 +8,17 @@

 stdenv.mkDerivation rec {
  pname = "snowsql";
-  version = "1.2.5";
+  majorVersion = "1.2";
+  version = "${majorVersion}.9";

  src = fetchurl {
-    url = "https://sfc-repo.snowflakecomputing.com/snowsql/bootstrap/1.2/linux_x86_64/snowflake-snowsql-1.2.5-1.x86_64.rpm";
-    sha256 = "c66e2044640197f4a5b5a16b89e8e7c6a816aa539004a0fb016aab185795f2d5";
+    url = "https://sfc-repo.snowflakecomputing.com/snowsql/bootstrap/${majorVersion}/linux_x86_64/snowflake-snowsql-${version}-1.x86_64.rpm";
+    sha256 = "1k9dyr4vyqivpg054kbvs0jdwhbqbmlp9lsyxgazdsviw8ch70c8";
  };

  nativeBuildInputs = [ rpmextract makeWrapper ];

-  libPath =
-    stdenv.lib.makeLibraryPath
-      [
-        openssl
-      ];
+  libPath = stdenv.lib.makeLibraryPath [ openssl ];

  buildCommand = ''
    mkdir -p $out/bin/
@ -37,7 +34,6 @@ stdenv.mkDerivation rec {

    makeWrapper $out/lib64/snowflake/snowsql/snowsql $out/bin/snowsql \
      --set LD_LIBRARY_PATH "${libPath}":"${placeholder "out"}"/lib64/snowflake/snowsql \
-
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/topydo/default.nix
+++ b/pkgs/applications/misc/topydo/default.nix
@ -22,7 +22,14 @@ buildPythonApplication rec {
    watchdog
  ];

-  checkInputs = [ mock freezegun coverage green pylint ];
+  checkInputs = [ mock freezegun pylint ];
+
+  # Skip test that has been reported multiple times upstream without result:
+  # bram85/topydo#271, bram85/topydo#274.
+  checkPhase = ''
+    substituteInPlace test/test_revert_command.py --replace 'test_revert_ls' 'dont_test_revert_ls'
+    python -m unittest discover
+  '';

  LC_ALL="en_US.UTF-8";

--- a/pkgs/applications/misc/zathura/wrapper.nix
+++ b/pkgs/applications/misc/zathura/wrapper.nix
@ -1,21 +1,16 @@
 { symlinkJoin, lib, makeWrapper, zathura_core, file, plugins ? [] }:
-
-let
-  pluginsPath = lib.makeSearchPath "lib/zathura" plugins;
-
-in symlinkJoin {
+symlinkJoin {
  name = "zathura-with-plugins-${zathura_core.version}";

-  paths = with zathura_core; [ man dev out ];
+  paths = with zathura_core; [ man dev out ] ++ plugins;

-  inherit plugins;

  buildInputs = [ makeWrapper ];

  postBuild = ''
    makeWrapper ${zathura_core.bin}/bin/zathura $out/bin/zathura \
      --prefix PATH ":" "${lib.makeBinPath [ file ]}" \
-      --add-flags --plugins-dir=${pluginsPath}
+      --add-flags --plugins-dir="$out/lib/zathura"
  '';

  meta = with lib; {
@ -29,6 +24,6 @@ in symlinkJoin {
    '';
    license = licenses.zlib;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ smironov globin ];
+    maintainers = with maintainers; [ smironov globin TethysSvensson ];
  };
 }
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -17,7 +17,7 @@
 , libXScrnSaver, libXcursor, libXtst, libGLU, libGL
 , protobuf, speechd, libXdamage, cups
 , ffmpeg_3, libxslt, libxml2, at-spi2-core
-, jre
+, jre8
 , pipewire_0_2

 # optional dependencies
@ -50,6 +50,8 @@ with stdenv.lib;
 # see http://www.linuxfromscratch.org/blfs/view/cvs/xsoft/chromium.html

 let
+  jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
+
  # The additional attributes for creating derivations based on the chromium
  # source tree.
  extraAttrs = buildFun base;
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -7,8 +7,8 @@
 , freetype, fontconfig, file, nspr, nss, libnotify
 , yasm, libGLU, libGL, sqlite, unzip, makeWrapper
 , hunspell, libXdamage, libevent, libstartup_notification
-, libvpx, libvpx_1_8
-, icu, icu67, libpng, jemalloc, glib
+, libvpx_1_8
+, icu67, libpng, jemalloc, glib
 , autoconf213, which, gnused, cargo, rustc, llvmPackages
 , rust-cbindgen, nodejs, nasm, fetchpatch
 , debugBuild ? false
@ -112,17 +112,13 @@ stdenv.mkDerivation ({
    xorg.libXext unzip makeWrapper
    libevent libstartup_notification /* cairo */
    libpng jemalloc glib
-    nasm
+    nasm icu67 libvpx_1_8
    # >= 66 requires nasm for the AV1 lib dav1d
    # yasm can potentially be removed in future versions
    # https://bugzilla.mozilla.org/show_bug.cgi?id=1501796
    # https://groups.google.com/forum/#!msg/mozilla.dev.platform/o-8levmLU80/SM_zQvfzCQAJ
    nspr nss
  ]
-  ++ lib.optionals (lib.versionOlder ffversion "75") [ libvpx sqlite ]
-  ++ lib.optional  (lib.versionAtLeast ffversion "75.0") libvpx_1_8
-  ++ lib.optional  (lib.versionOlder ffversion "78") icu
-  ++ lib.optional  (lib.versionAtLeast ffversion "78.0") icu67
  ++ lib.optional  alsaSupport alsaLib
  ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
  ++ lib.optional  gtk3Support gtk3
@ -132,12 +128,10 @@ stdenv.mkDerivation ({
                                     AVFoundation MediaToolbox CoreLocation
                                     Foundation libobjc AddressBook cups ];

-  NIX_CFLAGS_COMPILE = toString ([
+  NIX_CFLAGS_COMPILE = toString [
    "-I${glib.dev}/include/gio-unix-2.0"
    "-I${nss.dev}/include/nss"
-  ]
-  ++ lib.optional (pname == "firefox-esr" && lib.versionOlder ffversion "69")
-    "-Wno-error=format-security");
+  ];

  postPatch = ''
    rm -rf obj-x86_64-pc-linux-gnu
@ -228,16 +222,7 @@ stdenv.mkDerivation ({
    "--with-system-nspr"
    "--with-system-nss"
  ]
-  ++ lib.optionals (lib.versionOlder ffversion "78") [
-    "--with-system-bz2"
-    "--enable-startup-notification"
-    "--disable-gconf"
-  ]
-  ++ lib.optional (lib.versionOlder ffversion "75") "--enable-system-sqlite"
  ++ lib.optional (stdenv.isDarwin) "--disable-xcode-checks"
-  ++ lib.optionals (lib.versionOlder ffversion "69") [
-    "--enable-webrender=build"
-  ]

  ++ flag alsaSupport "alsa"
  ++ flag pulseaudioSupport "pulseaudio"
@ -305,16 +290,13 @@ stdenv.mkDerivation ({
    inherit execdir;
    inherit browserName;
  } // lib.optionalAttrs gtk3Support { inherit gtk3; };
-} //
-lib.optionalAttrs (lib.versionAtLeast ffversion "74") {
-  hardeningDisable = [ "format" ]; # -Werror=format-security
-} //
-# the build system verifies checksums of the bundled rust sources
-# ./third_party/rust is be patched by our libtool fixup code in stdenv
-# unfortunately we can't just set this to `false` when we do not want it.
-# See https://github.com/NixOS/nixpkgs/issues/77289 for more details

-lib.optionalAttrs (lib.versionAtLeast ffversion "72") {
+  hardeningDisable = [ "format" ]; # -Werror=format-security
+
+  # the build system verifies checksums of the bundled rust sources
+  # ./third_party/rust is be patched by our libtool fixup code in stdenv
+  # unfortunately we can't just set this to `false` when we do not want it.
+  # See https://github.com/NixOS/nixpkgs/issues/77289 for more details
  # Ideally we would figure out how to tell the build system to not
  # care about changed hashes as we are already doing that when we
  # fetch the sources. Any further modifications of the source tree
--- a/pkgs/applications/networking/browsers/firefox/no-buildconfig-ffx65.patch
+++ b/pkgs/applications/networking/browsers/firefox/no-buildconfig-ffx65.patch
@ -1,24 +0,0 @@
-Remove about:buildconfig.  If used as-is, it would add unnecessary runtime dependencies.
-diff -ur firefox-65.0-orig/docshell/base/nsAboutRedirector.cpp firefox-65.0/docshell/base/nsAboutRedirector.cpp
--- firefox-65.0-orig/docshell/base/nsAboutRedirector.cpp       2019-01-23 00:48:28.988747428 +0100
-+++ firefox-65.0/docshell/base/nsAboutRedirector.cpp    2019-01-23 00:51:13.378188397 +0100
-@@ -67,8 +67,6 @@
-     {"about", "chrome://global/content/aboutAbout.xhtml", 0},
-     {"addons", "chrome://mozapps/content/extensions/extensions.xul",
-      nsIAboutModule::ALLOW_SCRIPT},
-    {"buildconfig", "chrome://global/content/buildconfig.html",
-     nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT},
-     {"checkerboard", "chrome://global/content/aboutCheckerboard.xhtml",
-      nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
-          nsIAboutModule::ALLOW_SCRIPT},
-diff -ur firefox-65.0-orig/toolkit/content/jar.mn firefox-65.0/toolkit/content/jar.mn
--- firefox-65.0-orig/toolkit/content/jar.mn    2019-01-23 00:48:35.033372506 +0100
-+++ firefox-65.0/toolkit/content/jar.mn 2019-01-23 00:50:45.126565924 +0100
-@@ -36,7 +36,6 @@
-    content/global/plugins.css
-    content/global/browser-child.js
-    content/global/browser-content.js
-*   content/global/buildconfig.html
-    content/global/buildconfig.css
-    content/global/contentAreaUtils.js
-    content/global/datepicker.xhtml
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -61,32 +61,4 @@ rec {
      versionKey = "ffversion";
    };
  };
-
-  firefox-esr-68 = (common rec {
-    pname = "firefox-esr";
-    ffversion = "68.12.0esr";
-    src = fetchurl {
-      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "169y4prlb4mi31jciz89kp35rpb1p2gxrk93qkwfzdk4imi9hk8mi2yvxknpr0rni3bn2x0zgrrc6ccr8swv5895sqvv1sc5r1056w3";
-    };
-
-    patches = [
-      ./no-buildconfig-ffx65.patch
-    ];
-
-    meta = firefox.meta // {
-      description = "A web browser built from Firefox Extended Support Release source tree";
-    };
-    updateScript = callPackage ./update.nix {
-      attrPath = "firefox-esr-68-unwrapped";
-      versionSuffix = "esr";
-      versionKey = "ffversion";
-    };
-  }).override {
-    # Mozilla unfortunately doesn't support building with latest NSS anymore;
-    # instead they provide ESR releases for NSS:
-    # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Releases
-    nss = nss_3_44;
-  };
-
 }
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -16,13 +16,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "palemoon";
-  version = "28.12.0";
+  version = "28.13.0";

  src = fetchFromGitHub {
    owner = "MoonchildProductions";
    repo = "Pale-Moon";
    rev = "${version}_Release";
-    sha256 = "1cc75972nhmxkkynkky1m2fijbf3qlzvpxsd98mxlx0b7h4d3l5l";
+    sha256 = "1lza6239kb32wnwd9cwddn11npg1qx7p69l7qy63h9c59w29iypa";
    fetchSubmodules = true;
  };

@ -88,12 +88,16 @@ in stdenv.mkDerivation rec {
    ac_add_options --disable-debug
    ac_add_options --disable-necko-wifi
    ac_add_options --disable-updater
+
    ac_add_options --with-pthreads

    # Please see https://www.palemoon.org/redist.shtml for restrictions when using the official branding.
    ac_add_options --enable-official-branding
    export MOZILLA_OFFICIAL=1

+    # For versions after 28.12.0
+    ac_add_options --enable-phoenix-extensions
+
    ac_add_options --x-libraries=${lib.makeLibraryPath [ xorg.libX11 ]}

    export MOZ_PKG_SPECIAL=gtk$_GTK_VERSION
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchzip, python3Packages
+{ stdenv, lib, fetchurl, fetchzip, python3
 , mkDerivationWith, wrapQtAppsHook, wrapGAppsHook, qtbase, glib-networking
 , asciidoc, docbook_xml_dtd_45, docbook_xsl, libxml2
 , libxslt, gst_all_1 ? null
@ -10,6 +10,7 @@
 assert withMediaPlayback -> gst_all_1 != null;

 let
+  python3Packages = python3.pkgs;
  pdfjs = let
    version = "2.4.456";
  in
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
@ -1,7 +1,7 @@
-{ stdenv, lib, llvmPackages, gnChromium, ninja, which, nodejs, fetchpatch, gnutar
+{ stdenv, lib, llvmPackages, gnChromium, ninja, which, nodejs, fetchpatch, fetchurl

 # default dependencies
-, bzip2, flac, speex, libopus
+, gnutar, bzip2, flac, speex, libopus
 , libevent, expat, libjpeg, snappy
 , libpng, libcap
 , xdg_utils, yasm, nasm, minizip, libwebp
@ -17,7 +17,7 @@
 , libXScrnSaver, libXcursor, libXtst, libGLU, libGL
 , protobuf, speechd, libXdamage, cups
 , ffmpeg_3, libxslt, libxml2, at-spi2-core
-, jre
+, jre8
 , pipewire_0_2

 # optional dependencies
@ -41,6 +41,7 @@
 , ungoogled-chromium
 , ungoogled ? false

+, channel
 , upstream-info
 }:

@ -51,6 +52,8 @@ with stdenv.lib;
 # see http://www.linuxfromscratch.org/blfs/view/cvs/xsoft/chromium.html

 let
+  jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
+
  # The additional attributes for creating derivations based on the chromium
  # source tree.
  extraAttrs = buildFun base;
@ -110,7 +113,7 @@ let
  versionRange = min-version: upto-version:
    let inherit (upstream-info) version;
        result = versionAtLeast version min-version && versionOlder version upto-version;
-        stable-version = (import ./upstream-info.nix).stable.version;
+        stable-version = (importJSON ./upstream-info.json).stable.version;
    in if versionAtLeast stable-version upto-version
       then warn "chromium: stable version ${stable-version} is newer than a patchset bounded at ${upto-version}. You can safely delete it."
            result
@ -123,10 +126,13 @@ let
    };
  base = rec {
    name = "${packageName}-unwrapped-${version}";
-    inherit (upstream-info) channel version;
-    inherit packageName buildType buildPath;
+    inherit (upstream-info) version;
+    inherit channel packageName buildType buildPath;

-    src = upstream-info.main;
+    src = fetchurl {
+      url = "https://commondatastorage.googleapis.com/chromium-browser-official/chromium-${version}.tar.xz";
+      inherit (upstream-info) sha256;
+    };

    nativeBuildInputs = [
      ninja which python2Packages.python perl pkgconfig
@ -151,8 +157,9 @@ let
      ++ optional pulseSupport libpulseaudio
      ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];

-    patches = [
+    patches = optionals (versionRange "68" "86") [
      ./patches/nix_plugin_paths_68.patch
+    ] ++ [
      ./patches/remove-webp-include-69.patch
      ./patches/no-build-timestamps.patch
      ./patches/widevine-79.patch
@ -166,12 +173,18 @@ let
      #
      # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
      # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
-    ] ++ optionals (useVaapi) [ # Improvements for the VA-API build:
+    ] ++ optionals (useVaapi && versionRange "68" "86") [ # Improvements for the VA-API build:
      ./patches/enable-vdpau-support-for-nvidia.patch # https://aur.archlinux.org/cgit/aur.git/tree/vdpau-support.patch?h=chromium-vaapi
      ./patches/enable-video-acceleration-on-linux.patch # Can be controlled at runtime (i.e. without rebuilding Chromium)
    ];

-    postPatch = ''
+    postPatch = optionalString (!versionRange "0" "86") ''
+      # Required for patchShebangs (unsupported interpreter directive, basename: invalid option -- '*', etc.):
+      substituteInPlace native_client/SConstruct \
+        --replace "#! -*- python -*-" ""
+      substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
+        --replace "/usr/bin/env -S make -f" "/usr/bin/make -f"
+    '' + ''
      # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
      substituteInPlace sandbox/linux/suid/client/setuid_sandbox_host.cc \
        --replace \
@ -300,8 +313,8 @@ let
      use_system_libdrm = true;
      system_wayland_scanner_path = "${wayland}/bin/wayland-scanner";
    } // optionalAttrs ungoogled {
-      closure_compile = false;
      enable_hangout_services_extension = false;
+      enable_js_type_check = false;
      enable_mdns = false;
      enable_nacl_nonsfi = false;
      enable_one_click_signin = false;
@ -313,7 +326,6 @@ let
      google_api_key = "";
      google_default_client_id = "";
      google_default_client_secret = "";
-      optimize_webui = false;
      safe_browsing_mode = 0;
      use_official_google_api_keys = false;
      use_unofficial_version_number = false;
@ -366,9 +378,11 @@ let
      origRpath="$(patchelf --print-rpath "$chromiumBinary")"
      patchelf --set-rpath "${libGL}/lib:$origRpath" "$chromiumBinary"
    '';
+
+    passthru.updateScript = ./update.py;
  };

 # Remove some extraAttrs we supplied to the base attributes already.
 in stdenv.mkDerivation (base // removeAttrs extraAttrs [
  "name" "gnFlags" "buildTargets"
-])
+] // { passthru = base.passthru // (extraAttrs.passthru or {}); })
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/default.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/default.nix
@ -1,5 +1,5 @@
-{ newScope, config, stdenv, llvmPackages_9, llvmPackages_10
-, makeWrapper, ed, gnugrep
+{ newScope, config, stdenv, fetchurl, makeWrapper
+, llvmPackages_10, llvmPackages_11, ed, gnugrep, coreutils, xdg_utils
 , glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
 , libva ? null
 , pipewire_0_2
@ -29,24 +29,16 @@ let

  callPackage = newScope chromium;

-  chromium = {
+  chromium = rec {
    inherit stdenv llvmPackages;

-    upstream-info = (callPackage ./update.nix {}).getChannel channel;
+    upstream-info = (lib.importJSON ./upstream-info.json).${channel};

    mkChromiumDerivation = callPackage ./common.nix ({
-      inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useOzone;
+      inherit channel gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs
+              cupsSupport pulseSupport useOzone;
      inherit ungoogled;
      # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
-      gnChromium = gn.overrideAttrs (oldAttrs: {
-        version = "2020-03-23";
-        src = fetchgit {
-          url = "https://gn.googlesource.com/gn";
-          rev = "5ed3c9cc67b090d5e311e4bd2aba072173e82db9";
-          sha256 = "00y2d35wvqmx9glaqhfb62wdgbfpwr77v0934nnvh9ks71vnsjqy";
-        };
-      });
-    } // lib.optionalAttrs (channel == "dev") {
      gnChromium = gn.overrideAttrs (oldAttrs: {
        version = "2020-05-19";
        src = fetchgit {
@ -55,6 +47,27 @@ let
          sha256 = "0197msabskgfbxvhzq73gc3wlr3n9cr4bzrhy5z5irbvy05lxk17";
        };
      });
+    } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "86") {
+      llvmPackages = llvmPackages_11;
+      gnChromium = gn.overrideAttrs (oldAttrs: {
+        version = "2020-07-20";
+        src = fetchgit {
+          url = "https://gn.googlesource.com/gn";
+          rev = "3028c6a426a4aaf6da91c4ebafe716ae370225fe";
+          sha256 = "0h3wf4152zdvrbb0jbj49q6814lfl3rcy5mj8b2pl9s0ahvkbc6q";
+        };
+      });
+    } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "87") {
+      llvmPackages = llvmPackages_11;
+      useOzone = true; # YAY: https://chromium-review.googlesource.com/c/chromium/src/+/2382834 \o/
+      gnChromium = gn.overrideAttrs (oldAttrs: {
+        version = "2020-08-17";
+        src = fetchgit {
+          url = "https://gn.googlesource.com/gn";
+          rev = "6f13aaac55a977e1948910942675c69f2b4f7a94";
+          sha256 = "01hpma1sllpdx09mvr4d6073sg6zmk6iv44kd3r28khymcj4s251";
+        };
+      });
    });

    browser = callPackage ./browser.nix { inherit channel enableWideVine; };
@ -66,22 +79,33 @@ let
    ungoogled-chromium = callPackage ./ungoogled.nix {};
  };

+  pkgSuffix = if channel == "dev" then "unstable" else channel;
+  pkgName = "google-chrome-${pkgSuffix}";
+  chromeSrc = fetchurl {
+    urls = map (repo: "${repo}/${pkgName}/${pkgName}_${version}-1_amd64.deb") [
+      "https://dl.google.com/linux/chrome/deb/pool/main/g"
+      "http://95.31.35.30/chrome/pool/main/g"
+      "http://mirror.pcbeta.com/google/chrome/deb/pool/main/g"
+      "http://repo.fdzh.org/chrome/deb/pool/main/g"
+    ];
+    sha256 = chromium.upstream-info.sha256bin64;
+  };
+
  mkrpath = p: "${lib.makeSearchPathOutput "lib" "lib64" p}:${lib.makeLibraryPath p}";
-  widevineCdm = let upstream-info = chromium.upstream-info; in stdenv.mkDerivation {
+  widevineCdm = stdenv.mkDerivation {
    name = "chrome-widevine-cdm";

-    # The .deb file for Google Chrome
-    src = upstream-info.binary;
+    src = chromeSrc;

    phases = [ "unpackPhase" "patchPhase" "installPhase" "checkPhase" ];

    unpackCmd = let
      widevineCdmPath =
-        if upstream-info.channel == "stable" then
+        if channel == "stable" then
          "./opt/google/chrome/WidevineCdm"
-        else if upstream-info.channel == "beta" then
+        else if channel == "beta" then
          "./opt/google/chrome-beta/WidevineCdm"
-        else if upstream-info.channel == "dev" then
+        else if channel == "dev" then
          "./opt/google/chrome-unstable/WidevineCdm"
        else
          throw "Unknown chromium channel.";
@ -191,10 +215,13 @@ in stdenv.mkDerivation {
  '' + ''

    # libredirect causes chromium to deadlock on startup
-    export LD_PRELOAD="\$(echo -n "\$LD_PRELOAD" | tr ':' '\n' | ${gnugrep}/bin/grep -v /lib/libredirect\\\\.so$ | tr '\n' ':')"
+    export LD_PRELOAD="\$(echo -n "\$LD_PRELOAD" | ${coreutils}/bin/tr ':' '\n' | ${gnugrep}/bin/grep -v /lib/libredirect\\\\.so$ | ${coreutils}/bin/tr '\n' ':')"

    export XDG_DATA_DIRS=$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH\''${XDG_DATA_DIRS:+:}\$XDG_DATA_DIRS

+    # Mainly for xdg-open but also other xdg-* tools:
+    export PATH="${xdg_utils}/bin\''${PATH:+:}\$PATH"
+
    .
    w
    EOF
@ -214,6 +241,7 @@ in stdenv.mkDerivation {
  passthru = {
    inherit (chromium) upstream-info browser;
    mkDerivation = chromium.mkChromiumDerivation;
-    inherit sandboxExecutableName;
+    inherit chromeSrc sandboxExecutableName;
+    updateScript = ./update.py;
  };
 }
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix
@ -1,6 +1,6 @@
 {
-  "84.0.4147.89" = {
-    rev = "84.0.4147.89-1";
-    sha256 = "1bqvcq3dj6615198j7cz3ylyyic5zpis06capvl6ybl1na3ainb0";
+  "85.0.4183.102" = {
+    rev = "85.0.4183.102-1";
+    sha256 = "1mdx4a5zcs3an9yx1jxx4amq8p9rcj0hv76r8y7nz6cpsfgd9n3y";
  };
 }
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/update.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/update.nix
@ -1,271 +0,0 @@
-let maybePkgs = import ../../../../../. {}; in
-
-{ stdenv     ? maybePkgs.stdenv
-, runCommand ? maybePkgs.runCommand
-, fetchurl   ? maybePkgs.fetchurl
-, writeText  ? maybePkgs.writeText
-, curl       ? maybePkgs.curl
-, cacert     ? maybePkgs.cacert
-, nix        ? maybePkgs.nix
-}:
-
-let
-  inherit (stdenv) lib;
-
-  sources = if builtins.pathExists ./upstream-info.nix
-            then import ./upstream-info.nix
-            else {};
-
-  bucketURL = "https://commondatastorage.googleapis.com/"
-            + "chromium-browser-official";
-
-  mkVerURL = version: "${bucketURL}/chromium-${version}.tar.xz";
-
-  debURL = "https://dl.google.com/linux/chrome/deb/pool/main/g";
-
-  getDebURL = channelName: version: arch: mirror: let
-    packageSuffix = if channelName == "dev" then "unstable" else channelName;
-    packageName = "google-chrome-${packageSuffix}";
-  in "${mirror}/${packageName}/${packageName}_${version}-1_${arch}.deb";
-
-  # Untrusted mirrors, don't try to update from them!
-  debMirrors = [
-    "http://95.31.35.30/chrome/pool/main/g"
-    "http://mirror.pcbeta.com/google/chrome/deb/pool/main/g"
-    "http://repo.fdzh.org/chrome/deb/pool/main/g"
-  ];
-
-in {
-  getChannel = channel: let
-    chanAttrs = builtins.getAttr channel sources;
-  in {
-    inherit channel;
-    inherit (chanAttrs) version;
-
-    main = fetchurl {
-      url = mkVerURL chanAttrs.version;
-      inherit (chanAttrs) sha256;
-    };
-
-    binary = fetchurl (let
-      mkUrls = arch: let
-        mkURLForMirror = getDebURL channel chanAttrs.version arch;
-      in map mkURLForMirror ([ debURL ] ++ debMirrors);
-    in if stdenv.is64bit && chanAttrs ? sha256bin64 then {
-      urls = mkUrls "amd64";
-      sha256 = chanAttrs.sha256bin64;
-    } else if !stdenv.is64bit && chanAttrs ? sha256bin32 then {
-      urls = mkUrls "i386";
-      sha256 = chanAttrs.sha256bin32;
-    } else throw "No Chrome plugins are available for your architecture.");
-  };
-
-  update = let
-    csv2nix = name: src: import (runCommand "${name}.nix" {
-      src = builtins.fetchurl src;
-    } ''
-      esc() { echo "\"$(echo "$1" | sed -e 's/"\\$/\\&/')\""; } # ohai emacs "
-      IFS=, read -r -a headings <<< "$(head -n1 "$src")"
-      echo "[" > "$out"
-      tail -n +2 "$src" | while IFS=, read -r -a line; do
-        echo "  {"
-        for idx in "''${!headings[@]}"; do
-          echo "    $(esc "''${headings[idx]}") = $(esc ''${line[$idx]});"
-        done
-        echo "  }"
-      done >> "$out"
-      echo "]" >> "$out"
-    '');
-
-    channels = lib.fold lib.recursiveUpdate {} (map (attrs: {
-      ${attrs.os}.${attrs.channel} = attrs // {
-        history = let
-          drvName = "omahaproxy-${attrs.os}.${attrs.channel}-info";
-          history = csv2nix drvName "http://omahaproxy.appspot.com/history";
-          cond = h: attrs.os == h.os && attrs.channel == h.channel
-                 && lib.versionOlder h.version attrs.current_version;
-          # Note that this is a *reverse* sort!
-          sorter = a: b: lib.versionOlder b.version a.version;
-          sorted = builtins.sort sorter (lib.filter cond history);
-        in map (lib.flip removeAttrs ["os" "channel"]) sorted;
-        version = attrs.current_version;
-      };
-    }) (csv2nix "omahaproxy-info" "http://omahaproxy.appspot.com/all?csv=1"));
-
-    /*
-      XXX: This is essentially the same as:
-
-        builtins.tryEval (builtins.fetchurl url)
-
-      ... except that tryEval on fetchurl isn't working and doesn't catch
-      errors for fetchurl, so we go for a different approach.
-
-      We only have fixed-output derivations that can have networking access, so
-      we abuse SHA1 and its weaknesses to forge a fixed-output derivation which
-      is not so fixed, because it emits different contents that have the same
-      SHA1 hash.
-
-      Using this method, we can distinguish whether the URL is available or
-      whether it's not based on the actual content.
-
-      So let's use tryEval as soon as it's working with fetchurl in Nix.
-    */
-    tryFetch = url: let
-      # SHA1 hash collisions from https://shattered.io/static/shattered.pdf:
-      collisions = runCommand "sha1-collisions" {
-        outputs = [ "out" "good" "bad" ];
-        base64 = ''
-          QlpoOTFBWSZTWbL5V5MABl///////9Pv///v////+/////HDdK739/677r+W3/75rUNr4
-          Aa/AAAAAAACgEVTRtQDQAaA0AAyGmjTQGmgAAANGgAaMIAYgGgAABo0AAAAAADQAIAGQ0
-          MgDIGmjQA0DRk0AaMQ0DQAGIANGgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk
-          0AaMQ0DQAGIANGgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk0AaMQ0DQAGIAN
-          GgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk0AaMQ0DQAGIANGgAAGRoNGQMRp
-          o0GIGgBoGQAABVTUExEZATTICnkxNR+p6E09JppoyamjGhkm0ammIyaekbUejU9JiGnqZ
-          qaaDxJ6m0JkZMQ2oaYmJ6gxqMyE2TUzJqfItligtJQJfYbl9Zy9QjQuB5mHQRdSSXCCTH
-          MgmSDYmdOoOmLTBJWiCpOhMQYpQlOYpJjn+wQUJSTCEpOMekaFaaNB6glCC0hKEJdHr6B
-          mUIHeph7YxS8WJYyGwgWnMTFJBDFSxSCCYljiEk7HZgJzJVDHJxMgY6tCEIIWgsKSlSZ0
-          S8GckoIIF+551Ro4RCw260VCEpWJSlpWx/PMrLyVoyhWMAneDilBcUIeZ1j6NCkus0qUC
-          Wnahhk5KT4GpWMh3vm2nJWjTL9Qg+84iExBJhNKpbV9tvEN265t3fu/TKkt4rXFTsV+Nc
-          upJXhOhOhJMQQktrqt4K8mSh9M2DAO2X7uXGVL9YQxUtzQmS7uBndL7M6R7vX869VxqPu
-          renSuHYNq1yTXOfNWLwgvKlRlFYqLCs6OChDp0HuTzCWscmGudLyqUuwVGG75nmyZhKpJ
-          yOE/pOZyHyrZxGM51DYIN+Jc8yVJgAykxKCEtW55MlfudLg3KG6TtozalunXrroSxUpVL
-          StWrWLFihMnVpkyZOrQnUrE6xq1CGtJlbAb5ShMbV1CZgqlKC0wCFCpMmUKSEkvFLaZC8
-          wHOCVAlvzaJQ/T+XLb5Dh5TNM67p6KZ4e4ZSGyVENx2O27LzrTIteAreTkMZpW95GS0CE
-          JYhMc4nToTJ0wQhKEyddaLb/rTqmgJSlkpnALxMhlNmuKEpkEkqhKUoEq3SoKUpIQcDgW
-          lC0rYahMmLuPQ0fHqZaF4v2W8IoJ2EhMhYmSw7qql27WJS+G4rUplToFi2rSv0NSrVvDU
-          pltQ8Lv6F8pXyxmFBSxiLSxglNC4uvXVKmAtusXy4YXGX1ixedEvXF1aX6t8adYnYCpC6
-          rW1ZzdZYlCCxKEv8vpbqdSsXl8v1jCQv0KEPxPTa/5rtWSF1dSgg4z4KjfIMNtgwWoWLE
-          sRhKxsSA9ji7V5LRPwtumeQ8V57UtFSPIUmtQdOQfseI2Ly1DMtk4Jl8n927w34zrWG6P
-          i4jzC82js/46Rt2IZoadWxOtMInS2xYmcu8mOw9PLYxQ4bdfFw3ZPf/g2pzSwZDhGrZAl
-          9lqky0W+yeanadC037xk496t0Dq3ctfmqmjgie8ln9k6Q0K1krb3dK9el4Xsu44LpGcen
-          r2eQZ1s1IhOhnE56WnXf0BLWn9Xz15fMkzi4kpVxiTKGEpffErEEMvEeMZhUl6yD1SdeJ
-          YbxzGNM3ak2TAaglLZlDCVnoM6wV5DRrycwF8Zh/fRsdmhkMfAO1duwknrsFwrzePWeMw
-          l107DWzymxdQwiSXx/lncnn75jL9mUzw2bUDqj20LTgtawxK2SlQg1CCZDQMgSpEqLjRM
-          sykM9zbSIUqil0zNk7Nu+b5J0DKZlhl9CtpGKgX5uyp0idoJ3we9bSrY7PupnUL5eWiDp
-          V5mmnNUhOnYi8xyClkLbNmAXyoWk7GaVrM2umkbpqHDzDymiKjetgzTocWNsJ2E0zPcfh
-          t46J4ipaXGCfF7fuO0a70c82bvqo3HceIcRlshgu73seO8BqlLIap2z5jTOY+T2ucCnBt
-          Atva3aHdchJg9AJ5YdKHz7LoA3VKmeqxAlFyEnQLBxB2PAhAZ8KvmuR6ELXws1Qr13Nd1
-          i4nsp189jqvaNzt+0nEnIaniuP1+/UOZdyfoZh57ku8sYHKdvfW/jYSUks+0rK+qtte+p
-          y8jWL9cOJ0fV8rrH/t+85/p1z2N67p/ZsZ3JmdyliL7lrNxZUlx0MVIl6PxXOUuGOeArW
-          3vuEvJ2beoh7SGyZKHKbR2bBWO1d49JDIcVM6lQtu9UO8ec8pOnXmkcponBPLNM2CwZ9k
-          NC/4ct6rQkPkQHMcV/8XckU4UJCy+VeTA==
-        '';
-      } ''
-        echo "$base64" | base64 -d | tar xj
-        mv good.pdf "$good"
-        mv bad.pdf "$bad"
-        touch "$out"
-      '';
-
-      cacheVal = let
-        urlHash = builtins.hashString "sha256" url;
-        timeSlice = builtins.currentTime / 600;
-      in "${urlHash}-${toString timeSlice}";
-
-    in {
-      success = import (runCommand "check-success" {
-        result = stdenv.mkDerivation {
-          name = "tryfetch-${cacheVal}";
-          inherit url;
-
-          outputHash = "d00bbe65d80f6d53d5c15da7c6b4f0a655c5a86a";
-          outputHashMode = "flat";
-          outputHashAlgo = "sha1";
-
-          nativeBuildInputs = [ curl ];
-          preferLocalBuild = true;
-
-          inherit (collisions) good bad;
-
-          buildCommand = ''
-            if SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt" \
-               curl -s -L -f -I "$url" > /dev/null; then
-              cp "$good" "$out"
-            else
-              cp "$bad" "$out"
-            fi
-          '';
-
-          impureEnvVars = lib.fetchers.proxyImpureEnvVars;
-        };
-        inherit (collisions) good;
-      } ''
-        if cmp -s "$result" "$good"; then
-          echo true > "$out"
-        else
-          echo false > "$out"
-        fi
-      '');
-      value = builtins.fetchurl url;
-    };
-
-    fetchLatest = channel: let
-      result = tryFetch (mkVerURL channel.version);
-    in if result.success then result.value else fetchLatest (channel // {
-      version = if channel.history != []
-                then (lib.head channel.history).version
-                else throw "Unfortunately there's no older version than " +
-                           "${channel.version} available for channel " +
-                           "${channel.channel} on ${channel.os}.";
-      history = lib.tail channel.history;
-    });
-
-    getHash = path: import (runCommand "gethash.nix" {
-      inherit path;
-      nativeBuildInputs = [ nix ];
-    } ''
-      sha256="$(nix-hash --flat --base32 --type sha256 "$path")"
-      echo "\"$sha256\"" > "$out"
-    '');
-
-    isLatest = channel: version: let
-      ourVersion = sources.${channel}.version or null;
-    in if ourVersion == null then false
-       else lib.versionOlder version sources.${channel}.version
-         || version == sources.${channel}.version;
-
-    # We only support GNU/Linux right now.
-    linuxChannels = let
-      genLatest = channelName: channel: let
-        newUpstream = {
-          inherit (channel) version;
-          sha256 = getHash (fetchLatest channel);
-        };
-        keepOld = let
-          oldChannel = sources.${channelName};
-        in {
-          inherit (oldChannel) version sha256;
-        } // lib.optionalAttrs (oldChannel ? sha256bin32) {
-          inherit (oldChannel) sha256bin32;
-        } // lib.optionalAttrs (oldChannel ? sha256bin64) {
-          inherit (oldChannel) sha256bin64;
-        };
-      in if isLatest channelName channel.version then keepOld else newUpstream;
-    in lib.mapAttrs genLatest channels.linux;
-
-    getLinuxFlash = channelName: channel: let
-      inherit (channel) version;
-      fetchArch = arch: tryFetch (getDebURL channelName version arch debURL);
-      packages = lib.genAttrs ["i386" "amd64"] fetchArch;
-      isNew = arch: attr: !(builtins.hasAttr attr channel)
-                       && packages.${arch}.success;
-    in channel // lib.optionalAttrs (isNew "i386" "sha256bin32") {
-      sha256bin32 = getHash (packages.i386.value);
-    } // lib.optionalAttrs (isNew "amd64" "sha256bin64") {
-      sha256bin64 = getHash (packages.amd64.value);
-    };
-
-    newChannels = lib.mapAttrs getLinuxFlash linuxChannels;
-
-    dumpAttrs = indent: attrs: let
-      mkVal = val: if lib.isAttrs val then dumpAttrs (indent + 1) val
-                   else "\"${lib.escape ["$" "\\" "\""] (toString val)}\"";
-      mkIndent = level: lib.concatStrings (builtins.genList (_: "  ") level);
-      mkAttr = key: val: "${mkIndent (indent + 1)}${key} = ${mkVal val};\n";
-      attrLines = lib.mapAttrsToList mkAttr attrs;
-    in "{\n" + (lib.concatStrings attrLines) + (mkIndent indent) + "}";
-  in writeText "chromium-new-upstream-info.nix" ''
-    # This file is autogenerated from update.sh in the same directory.
-    ${dumpAttrs 0 newChannels}
-  '';
-}
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/update.py
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/update.py
@ -0,0 +1,77 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python -p python3 nix
+
+import csv
+import json
+import subprocess
+import sys
+
+from codecs import iterdecode
+from collections import OrderedDict
+from os.path import abspath, dirname
+from urllib.request import urlopen
+
+HISTORY_URL = 'https://omahaproxy.appspot.com/history?os=linux'
+DEB_URL = 'https://dl.google.com/linux/chrome/deb/pool/main/g'
+BUCKET_URL = 'https://commondatastorage.googleapis.com/chromium-browser-official'
+
+JSON_PATH = dirname(abspath(__file__)) + '/upstream-info.json'
+
+def load_json(path):
+    with open(path, 'r') as f:
+        return json.load(f)
+
+def nix_prefetch_url(url, algo='sha256'):
+    print(f'nix-prefetch-url {url}')
+    out = subprocess.check_output(['nix-prefetch-url', '--type', algo, url])
+    return out.decode('utf-8').rstrip()
+
+channels = {}
+last_channels = load_json(JSON_PATH)
+
+print(f'GET {HISTORY_URL}', file=sys.stderr)
+with urlopen(HISTORY_URL) as resp:
+    builds = csv.DictReader(iterdecode(resp, 'utf-8'))
+    for build in builds:
+        channel_name = build['channel']
+
+        # If we've already found a newer build for this channel, we're
+        # no longer interested in it.
+        if channel_name in channels:
+            continue
+
+        # If we're back at the last build we used, we don't need to
+        # keep going -- there's no new version available, and we can
+        # just reuse the info from last time.
+        if build['version'] == last_channels[channel_name]['version']:
+            channels[channel_name] = last_channels[channel_name]
+            continue
+
+        channel = {'version': build['version']}
+        suffix = 'unstable' if channel_name == 'dev' else channel_name
+
+        try:
+            channel['sha256'] = nix_prefetch_url(f'{BUCKET_URL}/chromium-{build["version"]}.tar.xz')
+            channel['sha256bin64'] = nix_prefetch_url(f'{DEB_URL}/google-chrome-{suffix}/google-chrome-{suffix}_{build["version"]}-1_amd64.deb')
+        except subprocess.CalledProcessError:
+            # This build isn't actually available yet.  Continue to
+            # the next one.
+            continue
+
+        channels[channel_name] = channel
+
+with open(JSON_PATH, 'w') as out:
+    def get_channel_key(item):
+        channel_name = item[0]
+        if channel_name == 'stable':
+            return 0
+        elif channel_name == 'beta':
+            return 1
+        elif channel_name == 'dev':
+            return 2
+        else:
+            print(f'Error: Unexpected channel: {channel_name}', file=sys.stderr)
+            sys.exit(1)
+    sorted_channels = OrderedDict(sorted(channels.items(), key=get_channel_key))
+    json.dump(sorted_channels, out, indent=2)
+    out.write('\n')
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/update.sh
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/update.sh
@ -1,4 +0,0 @@
-#!/bin/sh -e
-cd "$(dirname "$0")"
-sp="$(nix-build --builders "" -Q --no-out-link update.nix -A update)"
-cat "$sp" > upstream-info.nix
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.json
@ -0,0 +1,17 @@
+{
+  "stable": {
+    "version": "85.0.4183.102",
+    "sha256": "032yh1mfwins7a62zw8kwwq8xw1n52a0a93lqz7qlyjaf9sd8s4a",
+    "sha256bin64": "1i8xaxxnmg80vsia8hxnq58qi9k5nnbrl80d6d23g9lb7dbc9cpm"
+  },
+  "beta": {
+    "version": "86.0.4240.30",
+    "sha256": "1isj0zngb72k1hhn3h0s8mccg1cdmppz1mjmg19f2h306farzmzl",
+    "sha256bin64": "10d8im2adqqnkd6265gngv6xlm5qsz6r13z6cbbchsss0ssr8fxa"
+  },
+  "dev": {
+    "version": "87.0.4252.0",
+    "sha256": "1lxlsdni63zh79hxvpwgmnfn67kgfzhz3yg9bkxghqchqykkz92y",
+    "sha256bin64": "130hf7b35wcxpw05ddbqq89x10c0kays1vb9qg6xhq3zx2mk6ijw"
+  }
+}
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.nix
@ -1,18 +0,0 @@
-# This file is autogenerated from update.sh in the same directory.
-{
-  beta = {
-    sha256 = "0yf6j0459qzr677zsa2apmfz0x0ndlscvwj1a5v40nqjijchv5qp";
-    sha256bin64 = "017ix9a74f2gzlg6in0x6fqgiw8bpk0rypr6wsqqkslywprypjd0";
-    version = "84.0.4147.89";
-  };
-  dev = {
-    sha256 = "1dbbr7s8vbhxd0sk4k2yqp630zp1r4gzkkd2a86pzlzq2mjhsk8a";
-    sha256bin64 = "0bphfwi6nkj9nzrjjaffiv27xfblgdikyifsbjl6vv2pawkh335q";
-    version = "85.0.4183.15";
-  };
-  stable = {
-    sha256 = "0yf6j0459qzr677zsa2apmfz0x0ndlscvwj1a5v40nqjijchv5qp";
-    sha256bin64 = "1hzhgvs2ykqsncpnbnhzh09sw1vlsdfjhs06z5gc80l47brdi3wz";
-    version = "84.0.4147.89";
-  };
-}
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -18,11 +18,11 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "3.1.1929.45-1";
+  version = "3.3.2022.39-1";

  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "0pg16zs9fcr6b360igszpkia3i8i5xf4m0hs1b2a17lf8vkldix9";
+    sha256 = "1d49556l067zilndm1381n1y22076qgww4n6nkscwchik2mj79sy";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/charles/default.nix
+++ b/pkgs/applications/networking/charles/default.nix
@ -3,7 +3,7 @@ stdenv
 , makeWrapper
 , makeDesktopItem
 , fetchurl
-, jre
+, jdk8
 }:

 let
@ -31,7 +31,7 @@ let
      buildInputs = [ makeWrapper ];

      installPhase = ''
-        makeWrapper ${jre}/bin/java $out/bin/charles \
+        makeWrapper ${jdk8.jre}/bin/java $out/bin/charles \
          --add-flags "-Xmx1024M -Dcharles.config='~/.charles.config' -jar $out/share/java/charles.jar"

        for fn in lib/*.jar; do
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -132,8 +132,8 @@ in rec {
  });

  terraform_0_13 = pluggable (generic {
-    version = "0.13.2";
-    sha256 = "04pm57l29j3ai6dvh2343q4yhskkxqj8ayr2hdw2qqjch52p8mrw";
+    version = "0.13.3";
+    sha256 = "1bjgsabkyh3xf4gdp41mwhw6bpmjg45bnq2hk522glk02n2xngpw";
    patches = [ ./provider-path.patch ];
    passthru = { inherit plugins; };
  });
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -1,24 +1,24 @@
-{ stdenv, fetchFromGitHub, buildGoPackage}:
+{ lib, fetchFromGitHub, buildGoModule }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "dnscontrol";
-  version = "3.2.0";
-
-  goPackagePath = "github.com/StackExchange/dnscontrol";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1lrn1whmx9zkyvs505zxrsmnr5s6kpj3kjkr6rblfwdlnadkgfj7";
+    sha256 = "0lldkx906imwm8mxcfafpanbgaqh0sdm3zdkwkn7j0nmngyncx9p";
  };

+  vendorSha256 = "16cc6hb2iwh1zwrrnb7s4dqxqhaj67gq3gfr5xvh5kqafd685hvx";
+
  subPackages = [ "." ];

-  meta = with stdenv.lib; {
+  meta = with lib; {
    description = "Synchronize your DNS to multiple providers from a simple DSL";
    homepage = "https://stackexchange.github.io/dnscontrol/";
    license = licenses.mit;
-    maintainers = with maintainers; [ mmahut ];
+    maintainers = with maintainers; [ mmahut SuperSandro2000 ];
  };
 }
--- a/pkgs/applications/networking/ids/snort/default.nix
+++ b/pkgs/applications/networking/ids/snort/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    "--enable-control-socket"
    "--with-daq-includes=${daq}/includes"
    "--with-daq-libraries=${daq}/lib"
-  ]; 
+  ];

  postInstall = ''
    wrapProgram $out/bin/snort --add-flags "--daq-dir ${daq}/lib/daq --dynamic-preprocessor-lib-dir $out/lib/snort_dynamicpreprocessor/ --dynamic-engine-lib-dir $out/lib/snort_dynamicengine"
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@ -20,11 +20,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "zeek";
-  version = "3.2.0";
+  version = "3.2.1";

  src = fetchurl {
    url = "https://download.zeek.org/zeek-${version}.tar.gz";
-    sha256 = "0ky4485z0gpaj1z75y7jr5bn9wr8x8w3v637aqq4v9a0a5iyagmg";
+    sha256 = "0rybs79h0sq12vsayah8dixqac404z84rlvqynvzf3dh2lwcgg0y";
  };

  nativeBuildInputs = [ cmake flex bison file ];
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
@ -2,7 +2,7 @@
  "name": "element-desktop",
  "productName": "Element",
  "main": "src/electron-main.js",
-  "version": "1.7.5",
+  "version": "1.7.7",
  "description": "A feature-rich client for Matrix.org",
  "author": "Element",
  "repository": {
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop-yarndeps.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-yarndeps.nix
@ -722,11 +722,11 @@
      };
    }
    {
-      name = "bl___bl_4.0.2.tgz";
+      name = "bl___bl_4.0.3.tgz";
      path = fetchurl {
-        name = "bl___bl_4.0.2.tgz";
-        url  = "https://registry.yarnpkg.com/bl/-/bl-4.0.2.tgz";
-        sha1 = "52b71e9088515d0606d9dd9cc7aa48dc1f98e73a";
+        name = "bl___bl_4.0.3.tgz";
+        url  = "https://registry.yarnpkg.com/bl/-/bl-4.0.3.tgz";
+        sha1 = "12d6287adc29080e22a705e5764b2a9522cdc489";
      };
    }
    {
@ -801,14 +801,6 @@
        sha1 = "32713bc028f75c02fdb710d7c7bcec1f2c6070ef";
      };
    }
-    {
-      name = "buffer___buffer_5.4.3.tgz";
-      path = fetchurl {
-        name = "buffer___buffer_5.4.3.tgz";
-        url  = "https://registry.yarnpkg.com/buffer/-/buffer-5.4.3.tgz";
-        sha1 = "3fbc9c69eb713d323e3fc1a895eee0710c072115";
-      };
-    }
    {
      name = "buffer___buffer_5.6.0.tgz";
      path = fetchurl {
@ -4945,22 +4937,6 @@
        sha1 = "1eca1cf711aef814c04f62252a36a62f6cb23b57";
      };
    }
-    {
-      name = "readable_stream___readable_stream_2.3.6.tgz";
-      path = fetchurl {
-        name = "readable_stream___readable_stream_2.3.6.tgz";
-        url  = "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.6.tgz";
-        sha1 = "b11c27d88b8ff1fbe070643cf94b0c79ae1b0aaf";
-      };
-    }
-    {
-      name = "readable_stream___readable_stream_3.4.0.tgz";
-      path = fetchurl {
-        name = "readable_stream___readable_stream_3.4.0.tgz";
-        url  = "https://registry.yarnpkg.com/readable-stream/-/readable-stream-3.4.0.tgz";
-        sha1 = "a51c26754658e0a3c21dbf59163bd45ba6f447fc";
-      };
-    }
    {
      name = "readable_stream___readable_stream_3.6.0.tgz";
      path = fetchurl {
@ -5201,6 +5177,14 @@
        sha1 = "991ec69d296e0313747d59bdfd2b745c35f8828d";
      };
    }
+    {
+      name = "safe_buffer___safe_buffer_5.2.1.tgz";
+      path = fetchurl {
+        name = "safe_buffer___safe_buffer_5.2.1.tgz";
+        url  = "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz";
+        sha1 = "1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6";
+      };
+    }
    {
      name = "safer_buffer___safer_buffer_2.1.2.tgz";
      path = fetchurl {
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@ -8,12 +8,12 @@

 let
  executableName = "element-desktop";
-  version = "1.7.5";
+  version = "1.7.7";
  src = fetchFromGitHub {
    owner = "vector-im";
    repo = "riot-desktop";
    rev = "v${version}";
-    sha256 = "0781yg15bzkw5bpfzbdkqix239djgsc7kjdvbilv1d1xxqz3462y";
+    sha256 = "1h3v3d41ykgwn397nhm9zaqgf3n69zh592sjzrprvk1gsn5kj5h2";
  };
  electron = electron_9;

--- a/Show More
+++ b/Show More