Merge master into staging-next

2024-11-27 01:13:05 +00:00 · 2022-05-30 12:01:31 +00:00 · 2022-05-30 12:01:31 +00:00 · 76b451751c
commit 76b451751c
parent bde8bf2c6b 90ce1f86b9
57 changed files with 484 additions and 539 deletions
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@ -249,3 +249,31 @@ Unfree package that cannot be redistributed. You can build it yourself, but you
 ### `lib.licenses.unfreeRedistributableFirmware`, `"unfree-redistributable-firmware"` {#lib.licenses.unfreeredistributablefirmware-unfree-redistributable-firmware}

 This package supplies unfree, redistributable firmware. This is a separate value from `unfree-redistributable` because not everybody cares whether firmware is free.
+
+## Source provenance {#sec-meta-sourceProvenance}
+
+The value of a package's `meta.sourceProvenance` attribute specifies the provenance of the package's derivation outputs.
+
+If a package contains elements that are not built from the original source by a nixpkgs derivation, the `meta.sourceProvenance` attribute should be a list containing one or more value from `lib.sourceTypes` defined in [`nixpkgs/lib/source-types.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/source-types.nix).
+
+Adding this information helps users who have needs related to build transparency and supply-chain security to gain some visibility into their installed software or set policy to allow or disallow installation based on source provenance.
+
+The presence of a particular `sourceType` in a package's `meta.sourceProvenance` list indicates that the package contains some components falling into that category, though the *absence* of that `sourceType` does not *guarantee* the absence of that category of `sourceType` in the package's contents. A package with no `meta.sourceProvenance` set implies it has no *known* `sourceType`s other than `fromSource`.
+
+The meaning of the `meta.sourceProvenance` attribute does not depend on the value of the `meta.license` attribute.
+
+### `lib.sourceTypes.fromSource` {#lib.sourceTypes.fromSource}
+
+Package elements which are produced by a nixpkgs derivation which builds them from source code.
+
+### `lib.sourceTypes.binaryNativeCode` {#lib.sourceTypes.binaryNativeCode}
+
+Native code to be executed on the target system's CPU, built by a third party. This includes packages which wrap a downloaded AppImage or Debian package.
+
+### `lib.sourceTypes.binaryFirmware` {#lib.sourceTypes.binaryFirmware}
+
+Code to be executed on a peripheral device or embedded controller, built by a third party.
+
+### `lib.sourceTypes.binaryBytecode` {#lib.sourceTypes.binaryBytecode}
+
+Code to run on a VM interpreter or JIT compiled into bytecode by a third party. This includes packages which download Java `.jar` files from another source.
--- a/lib/default.nix
+++ b/lib/default.nix
@ -36,6 +36,7 @@ let

    # constants
    licenses = callLibs ./licenses.nix;
+    sourceTypes = callLibs ./source-types.nix;
    systems = callLibs ./systems;

    # serialization
--- a/lib/source-types.nix
+++ b/lib/source-types.nix
@ -0,0 +1,19 @@
+{ lib }:
+
+let
+  defaultSourceType = tname: {
+    shortName = tname;
+    isSource = false;
+  };
+in lib.mapAttrs (tname: tset: defaultSourceType tname // tset) {
+
+  fromSource = {
+    isSource = true;
+  };
+
+  binaryNativeCode = {};
+
+  binaryBytecode = {};
+
+  binaryFirmware = {};
+}
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -932,7 +932,7 @@ in
        # System Call Filtering
        SystemCallArchitectures = "native";
        SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ]
-          ++ optionals ((cfg.package != pkgs.tengine) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ];
+          ++ optionals ((cfg.package != pkgs.tengine) && (cfg.package != pkgs.openresty) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ];
      };
    };

--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -14,6 +14,8 @@ extraUtils="@extraUtils@"
 export LD_LIBRARY_PATH=@extraUtils@/lib
 export PATH=@extraUtils@/bin
 ln -s @extraUtils@/bin /bin
+# hardcoded in util-linux's mount helper search path `/run/wrappers/bin:/run/current-system/sw/bin:/sbin`
+ln -s @extraUtils@/bin /sbin

 # Copy the secrets to their needed location
 if [ -d "@extraUtils@/secrets" ]; then
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -31,6 +31,9 @@ let
  # mounting `/`, like `/` on a loopback).
  fileSystems = filter utils.fsNeededForBoot config.system.build.fileSystems;

+  # Determine whether zfs-mount(8) is needed.
+  zfsRequiresMountHelper = any (fs: lib.elem "zfsutil" fs.options) fileSystems;
+
  # A utility for enumerating the shared-library dependencies of a program
  findLibs = pkgs.buildPackages.writeShellScriptBin "find-libs" ''
    set -euo pipefail
@ -107,6 +110,22 @@ let
        copy_bin_and_libs $BIN
      done

+      ${optionalString zfsRequiresMountHelper ''
+        # Filesystems using the "zfsutil" option are mounted regardless of the
+        # mount.zfs(8) helper, but it is required to ensure that ZFS properties
+        # are used as mount options.
+        #
+        # BusyBox does not use the ZFS helper in the first place.
+        # util-linux searches /sbin/ as last path for helpers (stage-1-init.sh
+        # must symlink it to the store PATH).
+        # Without helper program, both `mount`s silently fails back to internal
+        # code, using default options and effectively ignore security relevant
+        # ZFS properties such as `setuid=off` and `exec=off` (unless manually
+        # duplicated in `fileSystems.*.options`, defeating "zfsutil"'s purpose).
+        copy_bin_and_libs ${pkgs.util-linux}/bin/mount
+        copy_bin_and_libs ${pkgs.zfs}/bin/mount.zfs
+      ''}
+
      # Copy some util-linux stuff.
      copy_bin_and_libs ${pkgs.util-linux}/sbin/blkid

@ -204,24 +223,29 @@ let

      # Run patchelf to make the programs refer to the copied libraries.
      find $out/bin $out/lib -type f | while read i; do
-        if ! test -L $i; then
-          nuke-refs -e $out $i
-        fi
+        nuke-refs -e $out $i
      done

      find $out/bin -type f | while read i; do
-        if ! test -L $i; then
-          echo "patching $i..."
-          patchelf --set-interpreter $out/lib/ld*.so.? --set-rpath $out/lib $i || true
-        fi
+        echo "patching $i..."
+        patchelf --set-interpreter $out/lib/ld*.so.? --set-rpath $out/lib $i || true
+      done
+
+      find $out/lib -type f \! -name 'ld*.so.?' | while read i; do
+        echo "patching $i..."
+        patchelf --set-rpath $out/lib $i
      done

      if [ -z "${toString (pkgs.stdenv.hostPlatform != pkgs.stdenv.buildPlatform)}" ]; then
      # Make sure that the patchelf'ed binaries still work.
      echo "testing patched programs..."
      $out/bin/ash -c 'echo hello world' | grep "hello world"
-      export LD_LIBRARY_PATH=$out/lib
-      $out/bin/mount --help 2>&1 | grep -q "BusyBox"
+      ${if zfsRequiresMountHelper then ''
+        $out/bin/mount -V 1>&1 | grep -q "mount from util-linux"
+        $out/bin/mount.zfs -h 2>&1 | grep -q "Usage: mount.zfs"
+      '' else ''
+        $out/bin/mount --help 2>&1 | grep -q "BusyBox"
+      ''}
      $out/bin/blkid -V 2>&1 | grep -q 'libblkid'
      $out/bin/udevadm --version
      $out/bin/dmsetup --version 2>&1 | tee -a log | grep -q "version:"
@ -260,8 +284,6 @@ let
    } ''
      mkdir -p $out

-      echo 'ENV{LD_LIBRARY_PATH}="${extraUtils}/lib"' > $out/00-env.rules
-
      cp -v ${udev}/lib/udev/rules.d/60-cdrom_id.rules $out/
      cp -v ${udev}/lib/udev/rules.d/60-persistent-storage.rules $out/
      cp -v ${udev}/lib/udev/rules.d/75-net-description.rules $out/
--- a/nixos/modules/virtualisation/vmware-guest.nix
+++ b/nixos/modules/virtualisation/vmware-guest.nix
@ -64,7 +64,6 @@ in
    environment.etc.vmware-tools.source = "${open-vm-tools}/etc/vmware-tools/*";

    services.xserver = mkIf (!cfg.headless) {
-      videoDrivers = mkOverride 50 [ "vmware" ];
      modules = [ xf86inputvmmouse ];

      config = ''
--- a/pkgs/applications/audio/clementine/clementine-spotify-blob.patch
+++ b/pkgs/applications/audio/clementine/clementine-spotify-blob.patch
@ -1,13 +0,0 @@
-diff --git a/src/internet/spotify/spotifyservice.cpp b/src/internet/spotify/spotifyservice.cpp
-index 88c7383..6e0893c 100644
--- a/src/internet/spotify/spotifyservice.cpp
-+++ b/src/internet/spotify/spotifyservice.cpp
-@@ -94,7 +94,7 @@ SpotifyService::SpotifyService(Application* app, InternetModel* parent)
-   system_blob_path_ = QCoreApplication::applicationDirPath() +
-                       "/../PlugIns/clementine-spotifyblob";
- #else
-  system_blob_path_ = QCoreApplication::applicationDirPath() +
-+  system_blob_path_ = qgetenv("CLEMENTINE_SPOTIFYBLOB") +
-                       "/clementine-spotifyblob" CMAKE_EXECUTABLE_SUFFIX;
- #endif
- 
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@ -23,7 +23,6 @@
 , libpulseaudio
 , gvfs
 , libcdio
-, libspotify
 , pcre
 , projectm
 , protobuf
@ -49,7 +48,8 @@ let
  withMTP = config.clementine.mtp or true;
  withCD = config.clementine.cd or true;
  withCloud = config.clementine.cloud or true;
-
+in mkDerivation {
+  pname = "clementine";
  version = "unstable-2022-04-11";

  src = fetchFromGitHub {
@ -59,10 +59,6 @@ let
    sha256 = "06fcbs3wig3mh711iypyj49qm5246f7qhvgvv8brqfrd8cqyh6qf";
  };

-  patches = [
-    ./clementine-spotify-blob.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    pkg-config
@ -101,6 +97,8 @@ let

    alsa-lib
  ]
+  # gst_plugins needed for setup-hooks
+  ++ gst_plugins
  ++ lib.optionals (withIpod) [ libgpod libplist usbmuxd ]
  ++ lib.optionals (withMTP) [ libmtp ]
  ++ lib.optionals (withCD) [ libcdio ]
@ -115,74 +113,25 @@ let
      -e 's,libprotobuf.a,protobuf,g'
  '';

-  free = mkDerivation {
-    pname = "clementine-free";
-    inherit version;
-    inherit src patches nativeBuildInputs postPatch;
+  preConfigure = ''
+    rm -rf ext/{,lib}clementine-spotifyblob
+  '';

-    # gst_plugins needed for setup-hooks
-    buildInputs = buildInputs ++ gst_plugins;
+  cmakeFlags = [
+    "-DUSE_SYSTEM_PROJECTM=ON"
+    "-DSPOTIFY_BLOB=OFF"
+  ];

-    preConfigure = ''
-      rm -rf ext/{,lib}clementine-spotifyblob
-    '';
+  postInstall = ''
+    wrapProgram $out/bin/clementine \
+      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
+  '';

-    cmakeFlags = [
-      "-DUSE_SYSTEM_PROJECTM=ON"
-      "-DSPOTIFY_BLOB=OFF"
-    ];
-
-    passthru.unfree = unfree;
-
-    postInstall = ''
-      wrapProgram $out/bin/clementine \
-        --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
-    '';
-
-    meta = with lib; {
-      homepage = "https://www.clementine-player.org";
-      description = "A multiplatform music player";
-      license = licenses.gpl3Plus;
-      platforms = platforms.linux;
-      maintainers = [ maintainers.ttuegel ];
-    };
+  meta = with lib; {
+    homepage = "https://www.clementine-player.org";
+    description = "A multiplatform music player";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.ttuegel ];
  };
-
-  # Unfree Spotify blob for Clementine
-  unfree = mkDerivation {
-    pname = "clementine-blob";
-    inherit version;
-    # Use the same patches and sources as Clementine
-    inherit src nativeBuildInputs patches postPatch;
-
-    buildInputs = buildInputs ++ [ libspotify ];
-    # Only build and install the Spotify blob
-    preBuild = ''
-      cd ext/clementine-spotifyblob
-    '';
-    postInstall = ''
-      mkdir -p $out/libexec/clementine
-      mv $out/bin/clementine-spotifyblob $out/libexec/clementine
-      rmdir $out/bin
-
-      makeWrapper ${free}/bin/clementine $out/bin/clementine \
-        --set CLEMENTINE_SPOTIFYBLOB $out/libexec/clementine
-
-      mkdir -p $out/share
-      for dir in applications icons kde4; do
-        ln -s "${free}/share/$dir" "$out/share/$dir"
-      done
-    '';
-
-    meta = with lib; {
-      homepage = "https://www.clementine-player.org";
-      description = "Spotify integration for Clementine";
-      # The blob itself is Apache-licensed, although libspotify is unfree.
-      license = licenses.asl20;
-      platforms = platforms.linux;
-      maintainers = [ maintainers.ttuegel ];
-    };
-  };
-
-in
-free
+}
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@ -33,10 +33,6 @@ lib.makeScope newScope (self: with self; {

  mopidy-soundcloud = callPackage ./soundcloud.nix { };

-  mopidy-spotify = callPackage ./spotify.nix { };
-
-  mopidy-spotify-tunigo = callPackage ./spotify-tunigo.nix { };
-
  mopidy-tunein = callPackage ./tunein.nix { };

  mopidy-youtube = callPackage ./youtube.nix { };
--- a/pkgs/applications/audio/mopidy/spotify-tunigo.nix
+++ b/pkgs/applications/audio/mopidy/spotify-tunigo.nix
@ -1,23 +0,0 @@
-{ lib, fetchFromGitHub, pythonPackages, mopidy, mopidy-spotify }:
-
-pythonPackages.buildPythonApplication rec {
-  pname = "mopidy-spotify-tunigo";
-  version = "1.0.0";
-
-  src = fetchFromGitHub {
-    owner = "trygveaa";
-    repo = "mopidy-spotify-tunigo";
-    rev = "v${version}";
-    sha256 = "1jwk0b2iz4z09qynnhcr07w15lx6i1ra09s9lp48vslqcf2fp36x";
-  };
-
-  propagatedBuildInputs = [ mopidy mopidy-spotify pythonPackages.tunigo ];
-
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Mopidy extension for providing the browse feature of Spotify";
-    license = licenses.asl20;
-    maintainers = [ maintainers.spwhitt ];
-  };
-}
--- a/pkgs/applications/audio/mopidy/spotify.nix
+++ b/pkgs/applications/audio/mopidy/spotify.nix
@ -1,25 +0,0 @@
-{ lib, fetchFromGitHub, pythonPackages, mopidy }:
-
-pythonPackages.buildPythonApplication rec {
-  pname = "mopidy-spotify";
-  version = "4.1.1";
-
-  src = fetchFromGitHub {
-    owner = "mopidy";
-    repo = "mopidy-spotify";
-    rev = "v${version}";
-    sha256 = "1qsac2yy26cdlsmxd523v8ayacs0s6jj9x79sngwap781i63zqrm";
-  };
-
-  propagatedBuildInputs = [ mopidy pythonPackages.pyspotify ];
-
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://www.mopidy.com/";
-    description = "Mopidy extension for playing music from Spotify";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ rski ];
-    hydraPlatforms = [ ];
-  };
-}
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -49,10 +49,10 @@
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.168.0",
-    "sha256": "sha256-NN4dqEywcoP4tk2J6RfWqoGw+95bIEoxb4YpwPtoTZ0=",
-    "vendorSha256": "sha256-qZNYfSlUkCu7FudbKF4IOgK1xWM5LqUghclOeGOxYXg=",
-    "version": "1.168.0"
+    "rev": "v1.169.0",
+    "sha256": "sha256-rtQN1l6OMEN/fudg67BFmk/OpwMVxxDM36zks3WvyUM=",
+    "vendorSha256": "sha256-bSJDPNkO8MQT1/coyHSCWNQ8zudrX+2KNwsASGeKh8s=",
+    "version": "1.169.0"
  },
  "ansible": {
    "owner": "nbering",
@ -103,10 +103,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v4.15.1",
-    "sha256": "sha256-o8yUcjw4X+Vx49hV+0guccueWoHvpxSs+sMsbAoAw9o=",
-    "vendorSha256": "sha256-l7Fe5hhEvJ5DiZ3t79sZYIt+6eZkjjf7Npmr8p2/e/4=",
-    "version": "4.15.1"
+    "rev": "v4.16.0",
+    "sha256": "sha256-PHm2MR1JDH3RnMqX3FjbjVFNTPD8CX2K7eemJ9ZMiJU=",
+    "vendorSha256": "sha256-UBOvQexfbSUh/9XKCvOYoMVH+QYLiwcdlZ8mcjy2AKU=",
+    "version": "4.16.0"
  },
  "azuread": {
    "owner": "hashicorp",
@ -121,10 +121,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
    "repo": "terraform-provider-azurerm",
-    "rev": "v3.7.0",
-    "sha256": "sha256-dvkR2nEtf4HvLTIoa++4PI5oNOPuJzI4obxdI4meKG4=",
+    "rev": "v3.8.0",
+    "sha256": "sha256-PqupNzZlcgqld25dFN0GHNM7YJ8zSuZ04cz40dUMv/0=",
    "vendorSha256": null,
-    "version": "3.7.0"
+    "version": "3.8.0"
  },
  "azurestack": {
    "owner": "hashicorp",
@ -145,22 +145,23 @@
    "version": "0.8.0"
  },
  "baiducloud": {
+    "deleteVendor": true,
    "owner": "baidubce",
    "provider-source-address": "registry.terraform.io/baidubce/baiducloud",
    "repo": "terraform-provider-baiducloud",
-    "rev": "v1.12.0",
-    "sha256": "1m7cw08ld073q1dsa7njshps21nc71gsz0kp6qj0p638zqx62xn7",
-    "vendorSha256": null,
-    "version": "1.12.0"
+    "rev": "v1.12.5",
+    "sha256": "sha256-SR2LYwxeGR9UJLj8+13+UtgXynLquttDGvIIQqxvbcY=",
+    "vendorSha256": "sha256-pA2dAC8AasWLTlC+SddS4kWT16FqcyBrtdVMV9k/FtE=",
+    "version": "1.12.5"
  },
  "bigip": {
    "owner": "F5Networks",
    "provider-source-address": "registry.terraform.io/F5Networks/bigip",
    "repo": "terraform-provider-bigip",
-    "rev": "v1.13.1",
-    "sha256": "sha256-nNcOHTFJrvvjKAZUsb1IVTp71/Xk5OuSzihPyi08anw=",
+    "rev": "v1.14.0",
+    "sha256": "sha256-Z3YqiKGlMrn55ZZsRjuvKAFRNW1G2D2Iczlk42yHk34=",
    "vendorSha256": null,
-    "version": "1.13.1"
+    "version": "1.14.0"
  },
  "bitbucket": {
    "owner": "DrFaust92",
@ -184,10 +185,10 @@
    "owner": "buildkite",
    "provider-source-address": "registry.terraform.io/buildkite/buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v0.9.0",
-    "sha256": "sha256-k7caRT/9YA198I6K3Qv3UcyQiULpOvJ3Smc816sKHkQ=",
+    "rev": "v0.11.0",
+    "sha256": "sha256-BpQpMAecpknI8b1q6XuZPty8I/AUTAwQWm5Y28XJ+G4=",
    "vendorSha256": "sha256-smBADIbH/t2IUt2w0VQ2BOU6iAuxVRa1yu4C5P2VeIo=",
-    "version": "0.9.0"
+    "version": "0.11.0"
  },
  "checkly": {
    "owner": "checkly",
@ -221,10 +222,10 @@
    "owner": "cloudamqp",
    "provider-source-address": "registry.terraform.io/cloudamqp/cloudamqp",
    "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.16.0",
-    "sha256": "sha256-swE4Nr1cQzNQOq8q6o0nZhhYRtgAwTfx6Epm76Jjjqg=",
-    "vendorSha256": "sha256-oPeldPn30uS5Yl6IfXVPy2R7/wsAdZsEbbhVnVHQVwk=",
-    "version": "1.16.0"
+    "rev": "v1.17.2",
+    "sha256": "sha256-/17CEejRGgLAJfAt4bOijpNVZhR2Tt9sXxBcfcC8EDQ=",
+    "vendorSha256": "sha256-tPYbkQz7he5V5+z3Swt9ch9Sdr1xqgbpDHasd4xB1B8=",
+    "version": "1.17.2"
  },
  "cloudflare": {
    "owner": "cloudflare",
@ -294,10 +295,10 @@
    "owner": "DataDog",
    "provider-source-address": "registry.terraform.io/DataDog/datadog",
    "repo": "terraform-provider-datadog",
-    "rev": "v3.11.0",
-    "sha256": "sha256-9ugNj/D6VPaERckV0cCPlBjNtzS9tLJj+rc/8MhxCVU=",
-    "vendorSha256": "sha256-XxOOOljx+p4onI6SF8UY+gy7x7G2pduEqODT1UX4zfg=",
-    "version": "3.11.0"
+    "rev": "v3.12.0",
+    "sha256": "sha256-17VtO+dHYMVvbG8cOVRx5qKPvmOoUGkNUl4aHrdsemQ=",
+    "vendorSha256": "sha256-Od80m/RsxUQpyalF4jN1Hv6/+kVwYEmqeJyiTbEwC2g=",
+    "version": "3.12.0"
  },
  "dhall": {
    "owner": "awakesecurity",
@ -312,10 +313,10 @@
    "owner": "digitalocean",
    "provider-source-address": "registry.terraform.io/digitalocean/digitalocean",
    "repo": "terraform-provider-digitalocean",
-    "rev": "v2.19.0",
-    "sha256": "sha256-I1BcBsl9liyg9XVd30q6Un+B8km7dpLhLMn1Vgn21dk=",
+    "rev": "v2.20.0",
+    "sha256": "sha256-1RgQgxGORVvXovx4Ovm5SUsGgMD7CJjgHsgzw+bO8U4=",
    "vendorSha256": null,
-    "version": "2.19.0"
+    "version": "2.20.0"
  },
  "dme": {
    "owner": "DNSMadeEasy",
@ -375,10 +376,10 @@
    "owner": "exoscale",
    "provider-source-address": "registry.terraform.io/exoscale/exoscale",
    "repo": "terraform-provider-exoscale",
-    "rev": "v0.35.0",
-    "sha256": "sha256-iIClnbCldGnihpML9xF0kyR4viXZzAsTF8MFT53wg+A=",
+    "rev": "v0.36.0",
+    "sha256": "sha256-cziPxZrvmv3Lpqn2kCwy8DGwOhQCTPcHZg22hYSBW0A=",
    "vendorSha256": null,
-    "version": "0.35.0"
+    "version": "0.36.0"
  },
  "external": {
    "owner": "hashicorp",
@ -429,39 +430,39 @@
    "owner": "integrations",
    "provider-source-address": "registry.terraform.io/integrations/github",
    "repo": "terraform-provider-github",
-    "rev": "v4.25.0",
-    "sha256": "sha256-9sZYg/gpCq2qpUhhFQjLVZLlNnYWaCz5K4/+TvCD/qk=",
+    "rev": "v4.26.0",
+    "sha256": "sha256-VH5AFT0wDFZ9MJtv+/KlcXD43Tg3QuDHI3vOw6qQoOU=",
    "vendorSha256": null,
-    "version": "4.25.0"
+    "version": "4.26.0"
  },
  "gitlab": {
    "owner": "gitlabhq",
    "provider-source-address": "registry.terraform.io/gitlabhq/gitlab",
    "repo": "terraform-provider-gitlab",
-    "rev": "v3.14.0",
-    "sha256": "sha256-KUlFEVeST/ujerpkjHYzdROwkFD4ASx0juHOKWKM14o=",
-    "vendorSha256": "sha256-M03+MK7YB3IPHA/w+yrO6YohPzknCmhguO5b25qzDzw=",
-    "version": "3.14.0"
+    "rev": "v3.15.0",
+    "sha256": "sha256-UF0yhgynqgW9dnVae19yaDqPsmanyGOgmwU9YaTTYMo=",
+    "vendorSha256": "sha256-wstFJ0eOIutyexhEvxvdUCAMOW+bPZnc+Ec9C4T5BuI=",
+    "version": "3.15.0"
  },
  "google": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.21.0",
-    "sha256": "sha256-xintCclIhM2FqmbYoWTPGq/twkUH3M2ebc/b0SZ/hXY=",
-    "vendorSha256": "sha256-B3JiVeCzeCtsAvQiHayZY3pahN4bwizE6d99Qw2VYK8=",
-    "version": "4.21.0"
+    "rev": "v4.22.0",
+    "sha256": "sha256-L85rh/UNXBO64VBJUNePMrAgTAKJMghH9LeQgYNhuqg=",
+    "vendorSha256": "sha256-wc+B0PPgq+m/Kxkaappf8jiLhm3ch8yP+KqGzzlmwFI=",
+    "version": "4.22.0"
  },
  "google-beta": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.21.0",
-    "sha256": "sha256-3oViGAFwUTBC4tMUlnjUDHdmk+sxtCeVZNbYGGwHhwU=",
-    "vendorSha256": "sha256-B3JiVeCzeCtsAvQiHayZY3pahN4bwizE6d99Qw2VYK8=",
-    "version": "4.21.0"
+    "rev": "v4.22.0",
+    "sha256": "sha256-D21cdG3dPNOJjGS+x4Yb2cwsmzrwnkg0ByQGRjuMZcI=",
+    "vendorSha256": "sha256-wc+B0PPgq+m/Kxkaappf8jiLhm3ch8yP+KqGzzlmwFI=",
+    "version": "4.22.0"
  },
  "googleworkspace": {
    "owner": "hashicorp",
@ -476,10 +477,10 @@
    "owner": "grafana",
    "provider-source-address": "registry.terraform.io/grafana/grafana",
    "repo": "terraform-provider-grafana",
-    "rev": "v1.22.0",
-    "sha256": "sha256-0OkFf2YiwJHwXheYkN1HA1DG5vadyhZOzVjmu0BNDHI=",
-    "vendorSha256": "sha256-Pd4cSmDzRhu8MD2osXg6mVYiKG2VM6MQ67aC6jDy59U=",
-    "version": "1.22.0"
+    "rev": "v1.23.0",
+    "sha256": "sha256-5cOl+HmMKcEA8MOjopH1h8BGuI2wa8QWHUNs3JoFFP0=",
+    "vendorSha256": "sha256-nnJNYi16nqddMQRCXy9TzsRFGsPOPCF0cWmCDB2m5xM=",
+    "version": "1.23.0"
  },
  "gridscale": {
    "owner": "gridscale",
@ -692,10 +693,10 @@
    "owner": "logicmonitor",
    "provider-source-address": "registry.terraform.io/logicmonitor/logicmonitor",
    "repo": "terraform-provider-logicmonitor",
-    "rev": "v2.0.1",
-    "sha256": "sha256-LW88NTWwzGrpOpliVqc1AOjxaZ4p/8gq9twEpjY3FzE=",
+    "rev": "v2.0.2",
+    "sha256": "sha256-F22tBNnH8dvSjrd0Wx+bAfiiQ9emJjHGXn3x4mQKH5E=",
    "vendorSha256": null,
-    "version": "2.0.1"
+    "version": "2.0.2"
  },
  "lxd": {
    "owner": "terraform-lxd",
@ -782,10 +783,10 @@
    "owner": "newrelic",
    "provider-source-address": "registry.terraform.io/newrelic/newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v2.45.1",
-    "sha256": "sha256-KA4uvhK54JgzjAeIMvlLWQjul8ZZFbvmXyQTqOonxYY=",
-    "vendorSha256": "sha256-8nEbs5lDpXZ49QkIC1oRxZm+gVGx9xqDHe6jK8wWOA8=",
-    "version": "2.45.1"
+    "rev": "v2.46.1",
+    "sha256": "sha256-XWCvgBIFOY9fX+WwCoPalHDmFozAm2LPL+R+znDs1XA=",
+    "vendorSha256": "sha256-bRegJiWC3NvFBEEOAnSbZBT71W0Yeor+bmtXf7lLr78=",
+    "version": "2.46.1"
  },
  "nomad": {
    "owner": "hashicorp",
@ -800,10 +801,10 @@
    "owner": "ns1-terraform",
    "provider-source-address": "registry.terraform.io/ns1-terraform/ns1",
    "repo": "terraform-provider-ns1",
-    "rev": "v1.12.6",
-    "sha256": "sha256-nP951YipGzsweJvV2PE0UlWGP+cAM6s18F5MCcxTxeo=",
+    "rev": "v1.12.7",
+    "sha256": "sha256-pzFfU/fs+c0AjY63CmKeKEKrnf+PF1cfG5P4euFY4ns=",
    "vendorSha256": "sha256-MaJHCxvD9BM5G8wJbSo06+TIPvJTlXzQ+l9Kdbg0QQw=",
-    "version": "1.12.6"
+    "version": "1.12.7"
  },
  "nsxt": {
    "owner": "vmware",
@ -837,19 +838,19 @@
    "owner": "oracle",
    "provider-source-address": "registry.terraform.io/oracle/oci",
    "repo": "terraform-provider-oci",
-    "rev": "v4.76.0",
-    "sha256": "sha256-sJ837jK/iYOC3dPFHoix1fiiSFMCNSqYEus9VlhXqMg=",
+    "rev": "v4.77.0",
+    "sha256": "sha256-FUCqNugAdJtTv7HtPH8ji56423iyWYPnDVGtOgJWatg=",
    "vendorSha256": null,
-    "version": "4.76.0"
+    "version": "4.77.0"
  },
  "okta": {
    "owner": "okta",
    "provider-source-address": "registry.terraform.io/okta/okta",
    "repo": "terraform-provider-okta",
-    "rev": "v3.27.0",
-    "sha256": "sha256-DDNq4Yvx45ynNePg8bW8tQ6LuyvUfudxY+M88+pIXMQ=",
-    "vendorSha256": "sha256-but/2CF3OW2aefUIy5XnDvhtXYqfCkHIrS1EDQoD9jM=",
-    "version": "3.27.0"
+    "rev": "v3.28.0",
+    "sha256": "sha256-1lTmXcBdCwQFDyO6ABByGl1klvTU8r6DpOrCX0l/aTU=",
+    "vendorSha256": "sha256-uI+C8LFw+R0np2dN1aUbcR2shVNhg6fiBICr0aWyngY=",
+    "version": "3.28.0"
  },
  "oktaasa": {
    "owner": "oktadeveloper",
@ -882,10 +883,10 @@
    "owner": "opentelekomcloud",
    "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.29.3",
-    "sha256": "sha256-rFaryW9yibw5whTYOb7kDF45l5NI9bdZvVQezIqudE8=",
-    "vendorSha256": "sha256-FOcddb1+uG5avqYZMvzR1UXDvtDDwtxBzf7FsN6ZROM=",
-    "version": "1.29.3"
+    "rev": "v1.29.4",
+    "sha256": "sha256-ZsrCmg/7Flef8tU7ZTI+MnorJbafnY63mf1/anxwMaQ=",
+    "vendorSha256": "sha256-jxtkF3VXrsfF/Dpp7mDz+3XYootoxQX3YSp9bX7j6Cg=",
+    "version": "1.29.4"
  },
  "opsgenie": {
    "owner": "opsgenie",
@ -963,10 +964,10 @@
    "owner": "rancher",
    "provider-source-address": "registry.terraform.io/rancher/rancher2",
    "repo": "terraform-provider-rancher2",
-    "rev": "v1.23.0",
-    "sha256": "sha256-GmesO28YUaaBBTr+hbn8OxDf4oABQFEw8wPzA9LtFyM=",
-    "vendorSha256": "sha256-kTPL/db/wBzLWaqib6WQPokuuT2bcDyBgEvfm8xjhuw=",
-    "version": "1.23.0"
+    "rev": "v1.24.0",
+    "sha256": "sha256-rNoz34ogNcthKBO26OL4TkIOyD95amPT2ByC6afqV1w=",
+    "vendorSha256": "sha256-cSf/peZBChjrElkwAK4eoczll1fyDvfnxm16wF/pqTs=",
+    "version": "1.24.0"
  },
  "random": {
    "owner": "hashicorp",
@ -1017,10 +1018,10 @@
    "owner": "jianyuan",
    "provider-source-address": "registry.terraform.io/jianyuan/sentry",
    "repo": "terraform-provider-sentry",
-    "rev": "v0.7.0",
-    "sha256": "09rxgq4m28nhwg6y51m5sq3d12lx7r1q3k76zrd5gpbxagqhvhkr",
-    "vendorSha256": "1wh2nf5q69j1p568c0q5yhlkd8ij3r8jg2769qy51wsj3bbv0wcj",
-    "version": "0.7.0"
+    "rev": "v0.8.0",
+    "sha256": "sha256-3PTM3GOImwO/yqzR6tOuwU0f+74DfK4RQSBY0vmH3qs=",
+    "vendorSha256": "sha256-naMuvrVIJp82NIFoR1oEEN6cZFqG4craDh8YU3+NSf0=",
+    "version": "0.8.0"
  },
  "shell": {
    "owner": "scottwinkler",
@ -1071,10 +1072,10 @@
    "owner": "spotinst",
    "provider-source-address": "registry.terraform.io/spotinst/spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.74.0",
-    "sha256": "sha256-wdhpkQM7J4WO4nN+0R8XfgbuusK0zDzSDy/DyOB8GcI=",
-    "vendorSha256": "sha256-OT5YuAlZNRCvwvZpCrhtKj4YiosEuHrTLQkWFYuKZrw=",
-    "version": "1.74.0"
+    "rev": "v1.75.0",
+    "sha256": "sha256-4MQVttAyt6o0fFKOLFnMlBS6iN51LdaM5ajEnpDmQXE=",
+    "vendorSha256": "sha256-oTtu/h7Fu+UtjQeOmxnHQr39dUIpsFST8zkejyuN3ig=",
+    "version": "1.75.0"
  },
  "stackpath": {
    "owner": "stackpath",
@ -1261,10 +1262,10 @@
    "owner": "vmware",
    "provider-source-address": "registry.terraform.io/vmware/wavefront",
    "repo": "terraform-provider-wavefront",
-    "rev": "v3.0.2",
-    "sha256": "sha256-HCo6Hw724kQrPOCHoyByThq7L5NIZ/0AHmnQD27RUFA=",
-    "vendorSha256": "sha256-PdSW3tyQUWbBiaM9U3NsqX/j4fMw9ZmjEDdyjxmRfD0=",
-    "version": "3.0.2"
+    "rev": "v3.1.0",
+    "sha256": "sha256-Q9ikBBlqprdu4BheItrWBoWqODgMXLgbtSg9RHtejBE=",
+    "vendorSha256": "sha256-sUzlDapp1smQ4lbgvsz22y3/fGkfJdHBlK7HNfihYpI=",
+    "version": "3.1.0"
  },
  "yandex": {
    "owner": "yandex-cloud",
--- a/pkgs/applications/networking/cluster/terraform-providers/update-provider
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-provider
@ -129,7 +129,7 @@ if [[ ${old_version} == "${version}" && ${force} != 1 && -z ${vendorSha256} && $
  echo_provider "already at version ${version}"
  exit
 fi
-if [[ ${version} =~ (alpha|beta|pre) && ${force} != 1 ]]; then
+if [[ ${version} =~ [[:alpha:]] && ${force} != 1 ]]; then
  echo_provider "not updating to unstable version ${version}"
  exit
 fi
--- a/pkgs/applications/networking/gopher/geomyidae/default.nix
+++ b/pkgs/applications/networking/gopher/geomyidae/default.nix
@ -0,0 +1,24 @@
+{ lib, stdenv, fetchurl, libressl,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "geomyidae";
+  version = "0.50.1";
+
+  src = fetchurl {
+    url = "gopher://bitreich.org/9/scm/geomyidae/tag/geomyidae-v${version}.tar.gz";
+    sha512 = "2a71b12f51c2ef8d6e791089f9eea49eb90a36be45b874d4234eba1e673186be945711be1f92508190f5c0a6f502f132c4b7cb82caf805a39a3f31903032ac47";
+  };
+
+  buildInputs = [ libressl ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = with lib; {
+    description = "A gopher daemon for Linux/BSD";
+    homepage = "gopher://bitreich.org/1/scm/geomyidae";
+    license = licenses.mit;
+    maintainers = [ maintainers.athas ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@ -22,11 +22,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gajim";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchurl {
    url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    sha256 = "sha256:0mbx7s1d2xgk7bkhwqcdss6ynshkqdiwh3qgv7d45frb4c3k33l2";
+    sha256 = "sha256:151lbz9092z8r2yva5039g867chcid3n804jk7hjawrd9vnw81az";
  };

  buildInputs = [
--- a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
@ -28,11 +28,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-remote-desktop";
-  version = "42.1.1";
+  version = "42.2";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-pEZqYsL+7GLn9XLwkpxY24iyXWCVuv5LFZHpnPqaDuY=";
+    hash = "sha256-wcy82MpwN+9ttz9r8rXdOKM2t9gKKpyY32/4g4eP+dU=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-shell-extensions";
-  version = "42.1";
+  version = "42.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell-extensions/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "LYjv61d+2viqrkMcd5um5uuWHuvd8FzKLsyhqgTbekA=";
+    sha256 = "ZXGEQKocLxe7CSIv+AJpn2Qf1RJ5Ih8EyxkZOWjsCzA=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gnome-shell";
-  version = "42.1";
+  version = "42.2";

  outputs = [ "out" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "9e6KYVj6EiYnQScmy4gATn4tBGrcMiFQViROWbdAY+o=";
+    sha256 = "Z+sTzRdeIDGoOMzqkukDdK4OnMumFoP7rNZ/9q/dWQ4=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@ -46,13 +46,13 @@

 let self = stdenv.mkDerivation rec {
  pname = "mutter";
-  version = "42.1";
+  version = "42.2";

  outputs = [ "out" "dev" "man" ];

  src = fetchurl {
    url = "mirror://gnome/sources/mutter/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "cZQhi/7EW5o+/avOb4RQ7Uw5dyIaHqQBTC5Fii/poVQ=";
+    sha256 = "vTDXi+fRcAE6CovMg3zsXubETXcP8AZ03N/CizQms0w=";
  };

  patches = [
--- a/pkgs/development/compilers/blueprint/default.nix
+++ b/pkgs/development/compilers/blueprint/default.nix
@ -0,0 +1,51 @@
+{ python3
+, stdenv
+, fetchFromGitLab
+, gobject-introspection
+, lib
+, meson
+, ninja
+}:
+
+stdenv.mkDerivation rec {
+  pname = "blueprint-compiler";
+  version = "unstable-2022-05-27";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "jwestman";
+    repo = pname;
+    rev = "cebd9ecadc53790cd547392899589dd5de0ac552";
+    sha256 = "sha256-mNR0ooJSRBIXy2E4avXYEdO1aSST+j41TsVg8+kitwo=";
+  };
+
+  # Requires pythonfuzz, which I've found difficult to package
+  doCheck = false;
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    python3.pkgs.wrapPython
+  ];
+
+  buildInputs = [
+    python3
+  ];
+
+  propagatedBuildInputs = [
+    # So that the compiler can find GIR and .ui files
+    gobject-introspection
+  ];
+
+  postFixup = ''
+    wrapPythonPrograms
+  '';
+
+  meta = with lib; {
+    description = "A markup language for GTK user interface files";
+    homepage = "https://gitlab.gnome.org/jwestman/blueprint-compiler";
+    license = licenses.lgpl3Plus;
+    maintainers = [ maintainers.ranfdev ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@ -1,5 +1,7 @@
 { fetchFromGitHub
-, lib, stdenv
+, lib
+, stdenv
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , gettext
@ -21,6 +23,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-Hfn0dfXihtUfO3R+qJaetrPwupcIwblvi1DQdHCF1s8=";
  };

+  patches = [
+    (fetchpatch {
+      name = "parenthesize-memcpy-calls-clang.patch";
+      url = "https://github.com/liblouis/liblouis/commit/528f38938e9f539a251d9de92ad1c1b90401c4d0.patch";
+      sha256 = "0hlhqsvd5wflg70bd7bmssnchk8znzbr93in0zpspzbyap6xz112";
+    })
+  ];
+
  outputs = [ "out" "dev" "man" "info" "doc" ];

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libspotify/default.nix
+++ b/pkgs/development/libraries/libspotify/default.nix
@ -1,91 +0,0 @@
-{ lib, stdenv, fetchurl, libspotify, alsa-lib, readline, pkg-config, apiKey ? null, unzip, gnused }:
-
-let
-  version = "12.1.51";
-  isLinux = (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "i686-linux");
-in
-
-if (stdenv.hostPlatform.system != "x86_64-linux" && stdenv.hostPlatform.system != "x86_64-darwin" && stdenv.hostPlatform.system != "i686-linux")
-then throw "Check https://developer.spotify.com/technologies/libspotify/ for a tarball for your system and add it here"
-else stdenv.mkDerivation {
-  pname = "libspotify";
-  inherit version;
-
-  src =
-    if stdenv.hostPlatform.system == "x86_64-linux" then
-      fetchurl {
-        url    = "https://developer.spotify.com/download/libspotify/libspotify-${version}-Linux-x86_64-release.tar.gz";
-        sha256 = "0n0h94i4xg46hfba95n3ypah93crwb80bhgsg00f6sms683lx8a3";
-      }
-    else if stdenv.hostPlatform.system == "x86_64-darwin" then
-      fetchurl {
-        url    = "https://developer.spotify.com/download/libspotify/libspotify-${version}-Darwin-universal.zip";
-        sha256 = "1gcgrc8arim3hnszcc886lmcdb4iigc08abkaa02l6gng43ky1c0";
-      }
-    else if stdenv.hostPlatform.system == "i686-linux" then
-      fetchurl {
-        url    = "https://developer.spotify.com/download/libspotify/libspotify-${version}-Linux-i686-release.tar.gz";
-        sha256 = "1bjmn64gbr4p9irq426yap4ipq9rb84zsyhjjr7frmmw22xb86ll";
-      }
-    else
-      null;
-
-  dontBuild = true;
-
-  installPhase = if (isLinux)
-    then "installPhase"
-    else ''
-      mkdir -p "$out"/include/libspotify
-      mv -v libspotify.framework/Versions/Current/Headers/api.h \
-        "$out"/include/libspotify
-      mkdir -p "$out"/lib
-      mv -v libspotify.framework/Versions/Current/libspotify \
-        "$out"/lib/libspotify.dylib
-      mkdir -p "$out"/share/man
-      mv -v man3 "$out"/share/man
-    '';
-
-
-  # darwin-specific
-  nativeBuildInputs = lib.optional (stdenv.hostPlatform.system == "x86_64-darwin") unzip;
-
-  # linux-specific
-  installFlags = lib.optional isLinux
-    "prefix=$(out)";
-  patchPhase = lib.optionalString isLinux
-    "${gnused}/bin/sed -i 's/ldconfig//' Makefile";
-  postInstall = lib.optionalString isLinux
-    "mv -v share $out";
-
-  passthru = {
-    samples = if apiKey == null
-      then throw ''
-        Please visit ${libspotify.meta.homepage} to get an api key then set config.libspotify.apiKey accordingly
-      '' else stdenv.mkDerivation {
-        pname = "libspotify-samples";
-        inherit version;
-        src = libspotify.src;
-  nativeBuildInputs = [ pkg-config ];
-        buildInputs = [ libspotify readline ]
-          ++ lib.optional (!stdenv.isDarwin) alsa-lib;
-        postUnpack = "sourceRoot=$sourceRoot/share/doc/libspotify/examples";
-        patchPhase = "cp ${apiKey} appkey.c";
-        installPhase = ''
-          mkdir -p $out/bin
-          install -m 755 jukebox/jukebox $out/bin
-          install -m 755 spshell/spshell $out/bin
-          install -m 755 localfiles/posix_stu $out/bin
-        '';
-        meta = libspotify.meta // { description = "Spotify API library samples"; };
-      };
-
-    inherit apiKey;
-  };
-
-  meta = with lib; {
-    description = "Spotify API library";
-    homepage    = "https://developer.spotify.com/technologies/libspotify";
-    maintainers = with maintainers; [ lovek323 ];
-    license     = licenses.unfree;
-  };
-}
--- a/pkgs/development/python-modules/brother/default.nix
+++ b/pkgs/development/python-modules/brother/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "brother";
-  version = "1.2.2";
+  version = "1.2.3";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "bieniu";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-pxFp/CSoskAx6DdZlkBRvocUJ5Kt5ymPwxpLhT743uE=";
+    hash = "sha256-+o6hv63u6FBEu57mD02lss0LQPwgBnXsP8CKQ+/74/Q=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@ -57,11 +57,6 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  postPatch = ''
-    substituteInPlace requirements/default.txt \
-      --replace "setuptools>=59.1.1,<59.7.0" "setuptools"
-  '';
-
  disabledTestPaths = [
    # test_eventlet touches network
    "t/unit/concurrency/test_eventlet.py"
--- a/pkgs/development/python-modules/codespell/default.nix
+++ b/pkgs/development/python-modules/codespell/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonApplication, fetchFromGitHub, pytestCheckHook, pytest-cov, pytest-dependency, aspell-python, aspellDicts, chardet }:
+{ lib, buildPythonApplication, fetchFromGitHub, pytestCheckHook, pytest-dependency, aspell-python, aspellDicts, chardet }:

 buildPythonApplication rec {
  pname = "codespell";
@ -11,7 +11,13 @@ buildPythonApplication rec {
    sha256 = "sha256-BhYVztSr2MalILEcOcvMl07CObYa73o3kW8S/idqAO8=";
  };

-  checkInputs = [ aspell-python chardet pytestCheckHook pytest-cov pytest-dependency ];
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "--cov=codespell_lib" "" \
+      --replace "--cov-report=" ""
+  '';
+
+  checkInputs = [ aspell-python chardet pytestCheckHook pytest-dependency ];

  preCheck = ''
    export ASPELL_CONF="dict-dir ${aspellDicts.en}/lib/aspell"
--- a/pkgs/development/python-modules/coqui-trainer/default.nix
+++ b/pkgs/development/python-modules/coqui-trainer/default.nix
@ -15,7 +15,7 @@

 let
  pname = "coqui-trainer";
-  version = "0.0.5";
+  version = "0.0.11";
 in
 buildPythonPackage {
  inherit pname version;
@ -27,7 +27,7 @@ buildPythonPackage {
    owner = "coqui-ai";
    repo = "Trainer";
    rev = "v${version}";
-    hash = "sha256-NsgCh+N2qWmRkTOjXqisVCP5aInH2zcNz6lsnIfVLiY=";
+    hash = "sha256-ujuQ9l6NOpDb2TdQbRcOM+j91RfbE8wCL9C0PID8g8Q=";
  };

  patches = [
--- a/pkgs/development/python-modules/elasticsearch-dsl/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
@ -1,9 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
 , elasticsearch
-, ipaddress
 , python-dateutil
 , six
 }:
@ -17,8 +15,7 @@ buildPythonPackage rec {
    sha256 = "c4a7b93882918a413b63bed54018a1685d7410ffd8facbc860ee7fd57f214a6d";
  };

-  propagatedBuildInputs = [ elasticsearch python-dateutil six ]
-                          ++ lib.optional (!isPy3k) ipaddress;
+  propagatedBuildInputs = [ elasticsearch python-dateutil six ];

  # ImportError: No module named test_elasticsearch_dsl
  # Tests require a local instance of elasticsearch
--- a/pkgs/development/python-modules/fake_factory/default.nix
+++ b/pkgs/development/python-modules/fake_factory/default.nix
@ -1,37 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, python
-, six
-, python-dateutil
-, ipaddress
-, mock
-}:
-
-buildPythonPackage rec {
-  pname = "fake-factory";
-  version = "9999.9.9";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "f5bd18deb22ad8cb4402513c025877bc6b50de58902d686b6b21ba8981dce260";
-  };
-
-  propagatedBuildInputs = [ six python-dateutil ipaddress mock ];
-
-  # fake-factory is depreciated and single test will always fail
-  doCheck = false;
-
-  checkPhase = ''
-    ${python.interpreter} -m unittest faker.tests
-  '';
-
-  meta = with lib; {
-    description = "A Python package that generates fake data for you";
-    homepage    = "https://pypi.python.org/pypi/fake-factory";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ lovek323 ];
-    platforms   = platforms.unix;
-  };
-
-}
--- a/pkgs/development/python-modules/flask-httpauth/default.nix
+++ b/pkgs/development/python-modules/flask-httpauth/default.nix
@ -2,14 +2,14 @@

 buildPythonPackage rec {
  pname = "flask-httpauth";
-  version = "4.6.0";
+  version = "4.7.0";

  disabled = python.pythonOlder "3";

  src = fetchPypi {
    pname = "Flask-HTTPAuth";
    version = version;
-    sha256 = "sha256-IHbPhuhMaqRC7gM0S/91Hq4TPTWhpIkx5vmfFHFhtVs=";
+    sha256 = "sha256-9xmee60g1baLPwtivd/KdjfFUIfp0C9gWuJuDeR5/ZQ=";
  };

  checkInputs = [ pytestCheckHook ];
--- a/pkgs/development/python-modules/geoip2/default.nix
+++ b/pkgs/development/python-modules/geoip2/default.nix
@ -4,6 +4,7 @@
 , mocket
 , requests
 , requests-mock
+, urllib3
 , pytestCheckHook
 }:

@ -21,7 +22,7 @@ buildPythonPackage rec {
    substituteInPlace requirements.txt --replace "requests>=2.24.0,<3.0.0" "requests"
  '';

-  propagatedBuildInputs = [ aiohttp requests maxminddb ];
+  propagatedBuildInputs = [ aiohttp maxminddb requests urllib3 ];

  checkInputs = [
    mocket
@ -32,7 +33,7 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "geoip2" ];

  meta = with lib; {
-    description = "Python client for GeoIP2 webservice client and database reader";
+    description = "GeoIP2 webservice client and database reader";
    homepage = "https://github.com/maxmind/GeoIP2-python";
    license = licenses.asl20;
    maintainers = with maintainers; [ ];
--- a/pkgs/development/python-modules/gpsoauth/default.nix
+++ b/pkgs/development/python-modules/gpsoauth/default.nix
@ -1,41 +1,33 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, cffi
-, cryptography
-, enum34
-, idna
-, ipaddress
-, ndg-httpsclient
-, pyopenssl
-, pyasn1
-, pycparser
 , pycryptodomex
+, pythonOlder
 , requests
-, six
 }:

 buildPythonPackage rec {
  version = "1.0.0";
  pname = "gpsoauth";

+  disabled = pythonOlder "3.8";
+
  src = fetchPypi {
    inherit pname version;
    sha256 = "1c4d6a980625b8ab6f6f1cf3e30d9b10a6c61ababb2b60bfe4870649e9c82be0";
  };

-  propagatedBuildInputs = [ cffi cryptography enum34 idna ipaddress ndg-httpsclient pyopenssl pyasn1 pycparser pycryptodomex requests six ];
+  propagatedBuildInputs = [ pycryptodomex requests ];

-  # no tests executed
+  # upstream tests are not very comprehensive
  doCheck = false;

  pythonImportsCheck = [ "gpsoauth" ];

  meta = with lib; {
-    description = "A python client library for Google Play Services OAuth";
+    description = "Library for Google Play Services OAuth";
    homepage = "https://github.com/simon-weber/gpsoauth";
    license = licenses.mit;
    maintainers = with maintainers; [ jgillich ];
  };
-
 }
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "hahomematic";
-  version = "1.5.4";
+  version = "1.6.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "danielperna84";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-V9wQXXPeoplxVcFDIhQcJFnKkewwDEaoQfTsQ7IyjOU=";
+    sha256 = "sha256-/v0om2SbikNpMCvJhwIGlWSiZilhnJi7qj8SCV+zHCU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/kubernetes/default.nix
+++ b/pkgs/development/python-modules/kubernetes/default.nix
@ -12,6 +12,8 @@
 , pyyaml
 , requests
 , requests-oauthlib
+, setuptools
+, six
 , urllib3
 , websocket-client

@ -22,7 +24,7 @@

 buildPythonPackage rec {
  pname = "kubernetes";
-  version = "20.13.0";
+  version = "23.6.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -31,8 +33,7 @@ buildPythonPackage rec {
    owner = "kubernetes-client";
    repo = "python";
    rev = "v${version}";
-    sha256 = "sha256-zZb5jEQEluY1dfa7UegW+P7MV86ESqOey7kkC74ETlM=";
-    fetchSubmodules = true;
+    sha256 = "sha256-d6S7cMTiwIgqOcN9j3yeEXUNSro9I2b8HLJw1oGKjWI=";
  };

  propagatedBuildInputs = [
@ -43,6 +44,8 @@ buildPythonPackage rec {
    pyyaml
    requests
    requests-oauthlib
+    setuptools
+    six
    urllib3
    websocket-client
  ];
@ -65,6 +68,6 @@ buildPythonPackage rec {
    description = "Kubernetes Python client";
    homepage = "https://github.com/kubernetes-client/python";
    license = licenses.asl20;
-    maintainers = with maintainers; [ lsix ];
+    maintainers = with maintainers; [ lsix SuperSandro2000 ];
  };
 }
--- a/pkgs/development/python-modules/mail-parser/default.nix
+++ b/pkgs/development/python-modules/mail-parser/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, python, pythonOlder, glibcLocales, fetchFromGitHub, six, simplejson }:
+{ lib, buildPythonPackage, python, glibcLocales, fetchFromGitHub, six, simplejson }:

 buildPythonPackage rec {
  pname = "mail-parser";
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pglast";
-  version = "3.10";
+  version = "3.11";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-rkoCtcBe5LBTTpmd+cj6s80UWXyTpMk74FipyK0t5go=";
+    hash = "sha256-JvWYrfo4HmvzwJ4vi8iGMfUKTMmpN6FS8fx2McKDj3Y=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pims/default.nix
+++ b/pkgs/development/python-modules/pims/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pims";
-  version = "0.6.0";
+  version = "0.6.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,8 +19,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "soft-matter";
    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-F4UWbD9fOfvaZwYcY1l7XOzVKZyqqTGTqVJoNPo1Ozg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QdllA1QTSJ8vWaSJ0XoUanX53sb4RaOmdXBCFEsoWMU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pynetgear/default.nix
+++ b/pkgs/development/python-modules/pynetgear/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "pynetgear";
-  version = "0.10.2";
+  version = "0.10.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "MatMaul";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-/JynomaMARuE3svTdnnczHmP839S0EXLbE7xG9dYEv0=";
+    sha256 = "sha256-CuKV4a3f5FlkDRAOv6H7k5oGTiT8rRhE+NosKpvZj6g=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pysaml2/default.nix
+++ b/pkgs/development/python-modules/pysaml2/default.nix
@ -14,6 +14,7 @@
 , pytz
 , requests
 , responses
+, setuptools
 , six
 , substituteAll
 , xmlschema
@ -36,11 +37,12 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    cryptography
-    python-dateutil
    defusedxml
    pyopenssl
+    python-dateutil
    pytz
    requests
+    setuptools
    six
    xmlschema
  ] ++ lib.optionals (pythonOlder "3.9") [
--- a/pkgs/development/python-modules/pyspotify/default.nix
+++ b/pkgs/development/python-modules/pyspotify/default.nix
@ -1,45 +0,0 @@
-{ lib
-, stdenv
-, buildPythonPackage
-, fetchFromGitHub
-, cffi
-, libspotify
-}:
-
-buildPythonPackage rec {
-  pname = "pyspotify";
-  version = "2.1.3";
-
-  src = fetchFromGitHub {
-    owner = "mopidy";
-    repo = "pyspotify";
-    rev = "v${version}";
-    sha256 = "sha256-CjIRwSlR5HPOJ9tp7lrdcDPiKH3p/PxvEJ8sqVD5s3Q=";
-  };
-
-  propagatedBuildInputs = [ cffi ];
-  buildInputs = [ libspotify ];
-
-  # python zip complains about old timestamps
-  preConfigure = ''
-    find -print0 | xargs -0 touch
-  '';
-
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    find "$out" -name _spotify.so -exec \
-        install_name_tool -change \
-        @loader_path/../Frameworks/libspotify.framework/libspotify \
-        ${libspotify}/lib/libspotify.dylib \
-        {} \;
-  '';
-
-  # There are no tests
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "http://pyspotify.mopidy.com";
-    description = "A Python interface to Spotify’s online music streaming service";
-    license = licenses.unfree;
-    maintainers = with maintainers; [ lovek323 ];
-  };
-}
--- a/pkgs/development/python-modules/sphinxcontrib-spelling/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-spelling/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "sphinxcontrib-spelling";
-  version = "7.4.0";
+  version = "7.4.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-GLsQu912pXRg7dejBka9lXZt+oxv50/T7J2ZQ2BlmGA=";
+    hash = "sha256-OpbyKqxq9JQHOvrLmI2U2NfCtgJ7IFA6jyDa4ysQw74=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/structlog/default.nix
+++ b/pkgs/development/python-modules/structlog/default.nix
@ -5,7 +5,6 @@
 , pytest-asyncio
 , pretend
 , freezegun
-, twisted
 , simplejson
 , six
 , pythonAtLeast
@ -16,7 +15,6 @@ buildPythonPackage rec {
  version = "21.5.0";
  format = "flit";

-  # sdist is missing conftest.py
  src = fetchFromGitHub {
    owner = "hynek";
    repo = "structlog";
@ -24,12 +22,14 @@ buildPythonPackage rec {
    sha256 = "0bc5lj0732j0hjq89llgrncyzs6k3aaffvg07kr3la44w0hlrb4l";
  };

-  checkInputs = [ pytestCheckHook pytest-asyncio pretend freezegun simplejson twisted ];
  propagatedBuildInputs = [ six ];

-  meta = {
+  checkInputs = [ pytestCheckHook pytest-asyncio pretend freezegun simplejson ];
+
+  meta = with lib; {
    description = "Painless structural logging";
    homepage = "https://github.com/hynek/structlog";
-    license = lib.licenses.asl20;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@ -17,7 +17,7 @@
 , scikit-learn
 , pillow
 , pyyaml
-, torch
+, pytorch
 , tokenizers
 , tqdm
 }:
@ -67,7 +67,7 @@ buildPythonPackage rec {
      # tf2onnx
    ];
    torch = [
-      torch
+      pytorch
    ];
    tokenizers = [
      tokenizers
--- a/pkgs/development/python-modules/wordcloud/default.nix
+++ b/pkgs/development/python-modules/wordcloud/default.nix
@ -1,35 +1,44 @@
-{ lib, buildPythonPackage, fetchFromGitHub
+{ lib
+, buildPythonPackage
+, cython
+, fetchFromGitHub
+, fetchpatch
 , matplotlib
 , mock
 , numpy
 , pillow
-, cython
-, pytest-cov
-, pytest
-, fetchpatch
+, pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
-  pname = "word_cloud";
+  pname = "wordcloud";
  version = "1.8.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

-  # tests are not included in pypi tarball
  src = fetchFromGitHub {
    owner = "amueller";
    repo = pname;
    rev = version;
-    sha256 = "sha256-4EFQfv+Jn9EngUAyDoJP0yv9zr9Tnbrdwq1YzDacB9Q=";
+    hash = "sha256-4EFQfv+Jn9EngUAyDoJP0yv9zr9Tnbrdwq1YzDacB9Q=";
  };

-  nativeBuildInputs = [ cython ];
-  propagatedBuildInputs = [ matplotlib numpy pillow ];
+  nativeBuildInputs = [
+    cython
+  ];

-  # Tests require extra dependencies
-  checkInputs = [ mock pytest pytest-cov ];
+  propagatedBuildInputs = [
+    matplotlib
+    numpy
+    pillow
+  ];

-  checkPhase = ''
-    PATH=$out/bin:$PATH pytest test
-  '';
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];

  patches = [
    (fetchpatch {
@ -39,8 +48,26 @@ buildPythonPackage rec {
    })
  ];

+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace " --cov --cov-report xml --tb=short" ""
+  '';
+
+  preCheck = ''
+    cd test
+  '';
+
+  pythonImportsCheck = [
+    "wordcloud"
+  ];
+
+  disabledTests = [
+    # Don't tests CLI
+    "test_cli_as_executable"
+  ];
+
  meta = with lib; {
-    description = "A little word cloud generator in Python";
+    description = "Word cloud generator in Python";
    homepage = "https://github.com/amueller/word_cloud";
    license = licenses.mit;
    maintainers = with maintainers; [ jm2dev ];
--- a/pkgs/development/tools/misc/hydra/unstable.nix
+++ b/pkgs/development/tools/misc/hydra/unstable.nix
@ -239,7 +239,7 @@ stdenv.mkDerivation rec {
  doCheck = true;

  passthru = {
-    inherit perlDeps;
+    inherit nix perlDeps;
    tests.basic = nixosTests.hydra.hydra_unstable;
  };

--- a/pkgs/os-specific/linux/bpftrace/default.nix
+++ b/pkgs/os-specific/linux/bpftrace/default.nix
@ -4,12 +4,31 @@
 , libelf, libbfd, libbpf, libopcodes, bcc
 , cereal, asciidoctor
 , nixosTests
+, util-linux
 }:

 stdenv.mkDerivation rec {
  pname = "bpftrace";
  version = "0.14.1";

+  # Cherry-picked from merged PR, remove this hook on next update
+  # https://github.com/iovisor/bpftrace/pull/2242
+  # Cannot `fetchpatch` such pure renaming diff since
+  # https://github.com/iovisor/bpftrace/commit/2df807dbae4037aa8bf0afc03f52fb3f6321c62a.patch
+  # does not contain any diff in unified format but just this instead:
+  #   ...
+  #   man/man8/{bashreadline.8 => bashreadline.bt.8}     | 0
+  #   ...
+  #   35 files changed, 0 insertions(+), 0 deletions(-)
+  #   rename man/man8/{bashreadline.8 => bashreadline.bt.8} (100%)
+  #   ...
+  # on witch `fetchpatch` fails with
+  #   error: Normalized patch '/build/patch' is empty (while the fetched file was not)!
+  #   Did you maybe fetch a HTML representation of a patch instead of a raw patch?
+  postUnpack = ''
+    rename .8 .bt.8 "$sourceRoot"/man/man8/*.8
+  '';
+
  src = fetchFromGitHub {
    owner  = "iovisor";
    repo   = "bpftrace";
@ -29,7 +48,7 @@ stdenv.mkDerivation rec {
      cereal asciidoctor
    ];

-  nativeBuildInputs = [ cmake pkg-config flex bison llvmPackages.llvm.dev ];
+  nativeBuildInputs = [ cmake pkg-config flex bison llvmPackages.llvm.dev util-linux ];

  # tests aren't built, due to gtest shenanigans. see:
  #
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@ -1,6 +1,6 @@
-{ callPackage, openssl_3_0, ... }@args:
+{ callPackage, ... }@args:

-callPackage ./generic.nix (args // { openssl = openssl_3_0; }) {
-  version = "1.21.6";
-  sha256 = "1bh52jqqcaj5wlh2kvhxr00jhk2hnk8k97ki4pwyj4c8920p1p36";
+callPackage ./generic.nix args {
+  version = "1.22.0";
+  sha256 = "0lzb4sn8hv491zad9kbpvka3m5ayjf1pxqbwllri980idyd5cgdk";
 }
--- a/pkgs/servers/http/nginx/quic.nix
+++ b/pkgs/servers/http/nginx/quic.nix
@ -6,8 +6,8 @@
 callPackage ./generic.nix args {
  src = fetchhg {
    url = "https://hg.nginx.org/nginx-quic";
-    rev = "55b38514729b"; # branch=quic
-    sha256 = "sha256-EJ3Fuxb4Z43I5eSb3mzzIOBfppAZ4Adv1yVZWbVCv0A=";
+    rev = "5b1011b5702b"; # branch=quic
+    sha256 = "sha256-q1gsJ6CJ7SD1XLitygnRusJ+exFPFg+B3wdsN+NvuL8=";
  };

  preConfigure = ''
--- a/pkgs/servers/http/nginx/stable.nix
+++ b/pkgs/servers/http/nginx/stable.nix
@ -1,13 +1,6 @@
-{ callPackage, fetchpatch, ... } @ args:
+{ callPackage, ... } @ args:

 callPackage ./generic.nix args {
-  version = "1.20.2";
-  sha256 = "0hjsyjzd35qyw49w210f67g678kvzinw4kg1acb0l6c2fxspd24m";
-  extraPatches = [
-    (fetchpatch {
-      name = "CVE-2021-3618.patch";
-      url = "https://github.com/nginx/nginx/commit/173f16f736c10eae46cd15dd861b04b82d91a37a.patch";
-      sha256 = "0cnxmbkp6ip61w7y1ihhnvziiwzz3p3wi2vpi5c7yaj5m964k5db";
-    })
-  ];
+  version = "1.22.0";
+  sha256 = "0lzb4sn8hv491zad9kbpvka3m5ayjf1pxqbwllri980idyd5cgdk";
 }
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@ -20,6 +20,9 @@ let
  allowUnfree = config.allowUnfree
    || builtins.getEnv "NIXPKGS_ALLOW_UNFREE" == "1";

+  allowNonSource = config.allowNonSource or true
+    || builtins.getEnv "NIXPKGS_ALLOW_NONSOURCE" == "1";
+
  allowlist = config.allowlistedLicenses or config.whitelistedLicenses or [];
  blocklist = config.blocklistedLicenses or config.blacklistedLicenses or [];

@ -86,12 +89,39 @@ let
    allowInsecurePredicate attrs ||
    builtins.getEnv "NIXPKGS_ALLOW_INSECURE" == "1";

-  showLicense = license: toString (map (l: l.shortName or "unknown") (lib.lists.toList license));
+
+  isNonSource = sourceTypes: lib.lists.any (t: !t.isSource) sourceTypes;
+
+  hasNonSourceProvenance = attrs:
+    (attrs ? meta.sourceProvenance) &&
+    isNonSource (lib.lists.toList attrs.meta.sourceProvenance);
+
+  # Allow granular checks to allow only some non-source-built packages
+  # Example:
+  # {pkgs, ...}:
+  # {
+  #   allowNonSource = false;
+  #   allowNonSourcePredicate = with lib.lists; pkg: !(any (p: !p.isSource && p!=lib.sourceTypes.binaryFirmware) (toList pkg.meta.sourceProvenance));
+  # }
+  allowNonSourcePredicate = config.allowNonSourcePredicate or (x: false);
+
+  # Check whether non-source packages are allowed and if not, whether the
+  # package has non-source provenance and is not explicitly allowed by the
+  # `allowNonSourcePredicate` function.
+  hasDeniedNonSourceProvenance = attrs:
+    hasNonSourceProvenance attrs &&
+    !allowNonSource &&
+    !allowNonSourcePredicate attrs;
+
+  showLicenseOrSourceType = value: toString (map (v: v.shortName or "unknown") (lib.lists.toList value));
+  showLicense = showLicenseOrSourceType;
+  showSourceType = showLicenseOrSourceType;

  pos_str = meta: meta.position or "«unknown-file»";

  remediation = {
-    unfree = remediate_allowlist "Unfree" remediate_unfree_predicate;
+    unfree = remediate_allowlist "Unfree" (remediate_predicate "allowUnfreePredicate");
+    non-source = remediate_allowlist "NonSource" (remediate_predicate "allowNonSourcePredicate");
    broken = remediate_allowlist "Broken" (x: "");
    unsupported = remediate_allowlist "UnsupportedSystem" (x: "");
    blocklisted = x: "";
@ -104,17 +134,19 @@ let
    Unfree = "NIXPKGS_ALLOW_UNFREE";
    Broken = "NIXPKGS_ALLOW_BROKEN";
    UnsupportedSystem = "NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM";
+    NonSource = "NIXPKGS_ALLOW_NONSOURCE";
  }.${allow_attr};
  remediation_phrase = allow_attr: {
    Unfree = "unfree packages";
    Broken = "broken packages";
    UnsupportedSystem = "packages that are unsupported for this system";
+    NonSource = "packages not built from source";
  }.${allow_attr};
-  remediate_unfree_predicate = attrs:
+  remediate_predicate = predicateConfigAttr: attrs:
    ''

      Alternatively you can configure a predicate to allow specific packages:
-        { nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+        { nixpkgs.config.${predicateConfigAttr} = pkg: builtins.elem (lib.getName pkg) [
            "${lib.getName attrs}"
          ];
        }
@ -226,6 +258,7 @@ let
    downloadPage = str;
    changelog = either (listOf str) str;
    license = either (listOf lib.types.attrs) (either lib.types.attrs str);
+    sourceProvenance = either (listOf lib.types.attrs) lib.types.attrs;
    maintainers = listOf (attrsOf str);
    priority = int;
    platforms = listOf str;
@ -288,6 +321,7 @@ let
  checkValidity = attrs:
    {
      unfree = hasUnfreeLicense attrs;
+      nonSource = hasNonSourceProvenance attrs;
      broken = isMarkedBroken attrs;
      unsupported = hasUnsupportedPlatform attrs;
      insecure = isMarkedInsecure attrs;
@ -296,6 +330,8 @@ let
      { valid = "no"; reason = "unfree"; errormsg = "has an unfree license (‘${showLicense attrs.meta.license}’)"; }
    else if hasBlocklistedLicense attrs then
      { valid = "no"; reason = "blocklisted"; errormsg = "has a blocklisted license (‘${showLicense attrs.meta.license}’)"; }
+    else if hasDeniedNonSourceProvenance attrs then
+      { valid = "no"; reason = "non-source"; errormsg = "contains elements not built from source (‘${showSourceType attrs.meta.sourceProvenance}’)"; }
    else if !allowBroken && attrs.meta.broken or false then
      { valid = "no"; reason = "broken"; errormsg = "is marked as broken"; }
    else if !allowUnsupportedSystem && hasUnsupportedPlatform attrs then
--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@ -31,14 +31,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "tts";
-  version = "0.6.1";
+  version = "0.6.2";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "coqui-ai";
    repo = "TTS";
    rev = "v${version}";
-    sha256 = "sha256-YzMR/Tl1UvjdSqV/h4lYR6DuarEqEIM7RReqYznFU4Q=";
+    sha256 = "sha256-n27a1s3Dpe5Hd3JryD4fPAjRcNc0YR1fpop+uhYA6sQ=";
  };

  postPatch = let
@ -132,6 +132,8 @@ python.pkgs.buildPythonApplication rec {
  ];

  disabledTestPaths = [
+    # Requires network acccess to download models
+    "tests/aux_tests/test_remove_silence_vad_script.py"
    # phonemes mismatch between espeak-ng and gruuts phonemizer
    "tests/text_tests/test_phonemizer.py"
    # no training, it takes too long
@ -146,7 +148,6 @@ python.pkgs.buildPythonApplication rec {
    "tests/tts_tests/test_tacotron2_d-vectors_train.py"
    "tests/tts_tests/test_tacotron2_speaker_emb_train.py"
    "tests/tts_tests/test_tacotron2_train.py"
-    "tests/tts_tests/test_tacotron2_train_fsspec_path.py"
    "tests/tts_tests/test_tacotron_train.py"
    "tests/tts_tests/test_vits_d-vectors_train.py"
    "tests/tts_tests/test_vits_multilingual_speaker_emb_train.py"
--- a/pkgs/tools/misc/gh-cal/default.nix
+++ b/pkgs/tools/misc/gh-cal/default.nix
@ -2,7 +2,7 @@
 , stdenv
 , fetchCrate
 , rustPlatform
-, pkgconfig
+, pkg-config
 , openssl
 , Security
 }:
@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "sha256-73gqk0DjhaLGIEP5VQQlubPomxHQyg4RnY5XTgE7msQ=";

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];

  meta = with lib; {
--- a/pkgs/tools/virtualization/cri-tools/default.nix
+++ b/pkgs/tools/virtualization/cri-tools/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "cri-tools";
-  version = "1.24.1";
+  version = "1.24.2";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-7WZ7Kb3Rx/hq7LYaDN/B9CpPgr9+aR5+FKDG7G/JydA=";
+    sha256 = "sha256-uhLaBX5vgQO/RkZUrP2uAubavq5MBvr3TRsGYchfR5s=";
  };

  vendorSha256 = null;
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -193,6 +193,7 @@ mapAliases ({
  clawsMail = throw "'clawsMail' has been renamed to/replaced by 'claws-mail'"; # Converted to throw 2022-02-22
  cldr-emoji-annotation = throw "'cldr-emoji-annotation' has been removed, as it was unmaintained; use 'cldr-annotations' instead"; # Added 2022-04-03
  clearsilver = throw "clearsilver has been removed: abandoned by upstream"; # Added 2022-03-15
+  clementineUnfree = throw "clementineUnfree has been removed because Spotify stopped supporting libspotify"; # added 2022-05-29
  clutter_gtk = throw "'clutter_gtk' has been renamed to/replaced by 'clutter-gtk'"; # Converted to throw 2022-02-22
  cmakeWithQt4Gui = throw "cmakeWithQt4Gui has been removed in favor of cmakeWithGui (Qt 5)"; # Added 2021-05
  codimd = hedgedoc; # Added 2020-11-29
@ -698,6 +699,7 @@ mapAliases ({
  libressl_3_2 = throw "'libressl_3_2' has reached end-of-life "; # Added 2022-03-19
  librsync_0_9 = throw "librsync_0_9 has been removed"; # Added 2021-07-24
  libseat = seatd; # Added 2021-06-24
+  libspotify = throw "libspotify has been removed because Spotify stopped supporting it"; # added 2022-05-29
  libstdcxxHook = throw "libstdcxx hook has been removed because cc-wrapper is now directly aware of the c++ standard library intended to be used"; # Added 2020-06-22
  libsysfs = throw "'libsysfs' has been renamed to/replaced by 'sysfsutils'"; # Converted to throw 2022-02-22
  libtidy = throw "'libtidy' has been renamed to/replaced by 'html-tidy'"; # Converted to throw 2022-02-22
@ -842,6 +844,8 @@ mapAliases ({
  mopidy-gmusic = throw "mopidy-gmusic has been removed because Google Play Music was discontinued"; # Added 2021-03-07
  mopidy-local-images = throw "mopidy-local-images has been removed as it's unmaintained. Its functionality has been merged into the mopidy-local extension"; # Added 2020-10-18
  mopidy-local-sqlite = throw "mopidy-local-sqlite has been removed as it's unmaintained. Its functionality has been merged into the mopidy-local extension"; # Added 2020-10-18
+  mopidy-spotify = throw "mopidy-spotify has been removed because Spotify stopped supporting libspotify"; # added 2022-05-29
+  mopidy-spotify-tunigo = throw "mopidy-spotify-tunigo has been removed because Spotify stopped supporting libspotify"; # added 2022-05-29

  morituri = throw "'morituri' has been renamed to/replaced by 'whipper'"; # Converted to throw 2022-02-22
  mozart-binary = mozart2-binary; # Added 2019-09-23
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -4625,8 +4625,6 @@ with pkgs;
    protobuf = protobuf3_19;
  };

-  clementineUnfree = clementine.unfree;
-
  mellowplayer = libsForQt5.callPackage ../applications/audio/mellowplayer { };

  ciopfs = callPackage ../tools/filesystems/ciopfs { };
@ -12336,6 +12334,8 @@ with pkgs;

  binaryen = callPackage ../development/compilers/binaryen { };

+  blueprint-compiler = callPackage ../development/compilers/blueprint { };
+
  bluespec = callPackage ../development/compilers/bluespec {
    gmp-static = gmp.override { withStatic = true; };
    tex = texlive.combined.scheme-full;
@ -17342,6 +17342,8 @@ with pkgs;

  geoipjava = callPackage ../development/libraries/java/geoipjava { };

+  geomyidae = callPackage ../applications/networking/gopher/geomyidae { };
+
  geos = callPackage ../development/libraries/geos { };

  geos39 = callPackage ../development/libraries/geos/3.9.nix { };
@ -22045,6 +22047,7 @@ with pkgs;

  nginxQuic = callPackage ../servers/http/nginx/quic.nix {
    zlib = zlib-ng.override { withZlibCompat = true; };
+    pcre = pcre2;
    withPerl = false;
    # We don't use `with` statement here on purpose!
    # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334
@ -22055,6 +22058,8 @@ with pkgs;

  nginxStable = callPackage ../servers/http/nginx/stable.nix {
    zlib = zlib-ng.override { withZlibCompat = true; };
+    openssl = openssl_3_0;
+    pcre = pcre2;
    withPerl = false;
    # We don't use `with` statement here on purpose!
    # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334
@ -22063,6 +22068,8 @@ with pkgs;

  nginxMainline = callPackage ../servers/http/nginx/mainline.nix {
    zlib = zlib-ng.override { withZlibCompat = true; };
+    openssl = openssl_3_0;
+    pcre = pcre2;
    withKTLS = true;
    withPerl = false;
    # We don't use `with` statement here on purpose!
@ -28218,8 +28225,6 @@ with pkgs;
    mopidy-scrobbler
    mopidy-somafm
    mopidy-soundcloud
-    mopidy-spotify
-    mopidy-spotify-tunigo
    mopidy-subidy
    mopidy-tunein
    mopidy-youtube
@ -29720,8 +29725,6 @@ with pkgs;

  spotify = callPackage ../applications/audio/spotify/wrapper.nix { };

-  libspotify = callPackage ../development/libraries/libspotify (config.libspotify or {});
-
  sourcetrail = let
    llvmPackages = llvmPackages_10;
  in libsForQt5.callPackage ../development/tools/sourcetrail {
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@ -68,6 +68,7 @@ mapAliases ({
  dogpile_cache = dogpile-cache; # added 2021-10-28
  dogpile-core = throw "dogpile-core is no longer maintained, use dogpile-cache instead"; # added 2021-11-20
  eebrightbox = throw "eebrightbox is unmaintained upstream and has therefore been removed"; # added 2022-02-03
+  fake_factory = throw "fake_factory has been removed because it is unused and deprecated by upstream since 2016."; # added 2022-05-30
  faulthandler = throw "faulthandler is built into ${python.executable}"; # added 2021-07-12
  flask_testing = flask-testing; # added 2022-04-25
  flask_wtf = flask-wtf; # added 2022-05-24
@ -112,6 +113,7 @@ mapAliases ({
  pymssql = throw "pymssql has been abandoned upstream."; # added 2020-05-04
  pyreadability = readability-lxml; # added 2022-05-24
  pysmart-smartx = pysmart; # added 2021-10-22
+  pyspotify = throw "pyspotify has been removed because Spotify stopped supporting libspotify"; # added 2022-05-29
  pytest_6 = pytest; # added 2022-02-10
  pytestcov = pytest-cov; # added 2021-01-04
  pytest-pep8 = pytestpep8; # added 2021-01-04
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -2891,8 +2891,6 @@ in {

  factory_boy = callPackage ../development/python-modules/factory_boy { };

-  fake_factory = callPackage ../development/python-modules/fake_factory { };
-
  fake-useragent = callPackage ../development/python-modules/fake-useragent { };

  faker = callPackage ../development/python-modules/faker { };
@ -8081,8 +8079,6 @@ in {

  pyspnego = callPackage ../development/python-modules/pyspnego { };

-  pyspotify = callPackage ../development/python-modules/pyspotify { };
-
  pysptk = callPackage ../development/python-modules/pysptk { };

  pysqlcipher3 = callPackage ../development/python-modules/pysqlcipher3 {