Merge staging-next into staging

2025-02-17 09:34:36 +00:00 · 2020-11-01 10:11:12 +01:00 · 2020-11-01 10:11:12 +01:00 · 83dde6c52c
commit 83dde6c52c
parent b57adad085 7a8d5dc8a6
362 changed files with 5122 additions and 3783 deletions
--- a/doc/contributing/coding-conventions.xml
+++ b/doc/contributing/coding-conventions.xml
@ -522,6 +522,16 @@ args.stdenv.mkDerivation (args // {
         </para>
        </listitem>
       </varlistentry>
+       <varlistentry>
+        <term>
+         If it’s a <emphasis>terminal emulator</emphasis>:
+        </term>
+        <listitem>
+         <para>
+          <filename>applications/terminal-emulators</filename> (e.g. <filename>alacritty</filename> or <filename>rxvt</filename> or <filename>termite</filename>)
+         </para>
+        </listitem>
+       </varlistentry>
       <varlistentry>
        <term>
         If it’s for <emphasis>video playback / editing</emphasis>:
--- a/doc/languages-frameworks/vim.section.md
+++ b/doc/languages-frameworks/vim.section.md
@ -265,6 +265,20 @@ To add a new plugin, run `./update.py --add "[owner]/[name]"`. **NOTE**: This sc

 Finally, there are some plugins that are also packaged in nodePackages because they have Javascript-related build steps, such as running webpack. Those plugins are not listed in `vim-plugin-names` or managed by `update.py` at all, and are included separately in `overrides.nix`. Currently, all these plugins are related to the `coc.nvim` ecosystem of Language Server Protocol integration with vim/neovim.

+## Updating plugins in nixpkgs
+
+Run the update script with a GitHub API token that has at least `public_repo` access. Running the script without the token is likely to result in rate-limiting (429 errors). For steps on creating an API token, please refer to [GitHub's token documentation](https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token).
+
+```sh
+GITHUB_API_TOKEN=my_token ./pkgs/misc/vim-plugins/update.py
+```
+
+Alternatively, set the number of processes to a lower count to avoid rate-limiting.
+
+```sh
+./pkgs/misc/vim-plugins/update.py --proc 1
+```
+
 ## Important repositories

 - [vim-pi](https://bitbucket.org/vimcommunity/vim-pi) is a plugin repository
--- a/lib/sources.nix
+++ b/lib/sources.nix
@ -6,6 +6,7 @@ let
    hasContext
    match
    readDir
+    split
    storeDir
    tryEval
    ;
@ -15,7 +16,6 @@ let
    isString
    pathExists
    readFile
-    split
    ;
 in
 rec {
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1303,10 +1303,12 @@
    name = "Vladimir Serov";
    keys = [
      # compare with https://keybase.io/cab404
-      { longkeyid = "1BB96810926F4E715DEF567E6BA7C26C3FDF7BB3";
+      {
+        longkeyid = "1BB96810926F4E715DEF567E6BA7C26C3FDF7BB3";
        fingerprint = "rsa3072/0xCBDECF658C38079E";
      }
-      { longkeyid = "1EBC648C64D6045463013B3EB7EFFC271D55DB8A";
+      {
+        longkeyid = "1EBC648C64D6045463013B3EB7EFFC271D55DB8A";
        fingerprint = "ed25519/0xB7EFFC271D55DB8A";
      }
    ];
@ -1431,10 +1433,12 @@
    githubId = 2054509;
    name = "Constantine Evans";
    keys = [
-      { longkeyid = "rsa4096/0xB67DB1D20A93A9F9";
+      {
+        longkeyid = "rsa4096/0xB67DB1D20A93A9F9";
        fingerprint = "32B1 6EE7 DBA5 16DE 526E  4C5A B67D B1D2 0A93 A9F9";
      }
-      { longkeyid = "rsa4096/0x1A1D58B86AE2AABD";
+      {
+        longkeyid = "rsa4096/0x1A1D58B86AE2AABD";
        fingerprint = "669C 1D24 5A87 DB34 6BE4  3216 1A1D 58B8 6AE2 AABD";
      }
    ];
@ -4373,7 +4377,7 @@
    name = "Jeff Zellner";
  };
  kaction = {
-    name  = "Dmitry Bogatov";
+    name = "Dmitry Bogatov";
    email = "KAction@disroot.org";
    github = "kaction";
    githubId = 44864956;
@ -5685,12 +5689,6 @@
    githubId = 1387206;
    name = "Mike Sperber";
  };
-  mildlyincompetent = {
-    email = "nix@kch.dev";
-    github = "mildlyincompetent";
-    githubId = 19479662;
-    name = "Kajetan Champlewski";
-  };
  millerjason = {
    email = "mailings-github@millerjason.com";
    github = "millerjason";
@ -6615,6 +6613,12 @@
    githubId = 131844;
    name = "Igor Pashev";
  };
+  pasqui23 = {
+    email = "p3dimaria@hotmail.it";
+    github = "pasqui23";
+    githubId = 6931743;
+    name = "pasqui23";
+  };
  patryk27 = {
    email = "wychowaniec.patryk@gmail.com";
    github = "Patryk27";
@ -7006,7 +7010,7 @@
  purcell = {
    email = "steve@sanityinc.com";
    github = "purcell";
-    githubId =	5636;
+    githubId = 5636;
    name = "Steve Purcell";
  };
  puzzlewolf = {
@ -7275,10 +7279,12 @@
    github = "rissson";
    githubId = 18313093;
    keys = [
-      { longkeyid = "rsa4096/0xF6FD87B15C263EC9";
+      {
+        longkeyid = "rsa4096/0xF6FD87B15C263EC9";
        fingerprint = "8A0E 6A7C 08AB B9DE 67DE  2A13 F6FD 87B1 5C26 3EC9";
      }
-      { longkeyid = "ed25519/0xBBB7A6801DF1E03F";
+      {
+        longkeyid = "ed25519/0xBBB7A6801DF1E03F";
        fingerprint = "C0A7 A9BB 115B C857 4D75  EA99 BBB7 A680 1DF1 E03F";
      }
    ];
@ -8358,7 +8364,7 @@
    name = "Szczyp";
  };
  szlend = {
-    email = "pub+nix@zlender.si";
+    email = "pub.nix@zlender.si";
    github = "szlend";
    githubId = 7301807;
    name = "Simon Žlender";
@ -9244,6 +9250,12 @@
    email = "kirill.wedens@gmail.com";
    name = "wedens";
  };
+  wheelsandmetal = {
+    email = "jakob@schmutz.co.uk";
+    github = "wheelsandmetal";
+    githubId = 13031455;
+    name = "Jakob Schmutz";
+  };
  WhittlesJr = {
    email = "alex.joseph.whitt@gmail.com";
    github = "WhittlesJr";
@ -9328,7 +9340,7 @@
    email = "worldofpeace@protonmail.ch";
    github = "worldofpeace";
    githubId = 28888242;
-    name = "worldofpeace";
+    name = "WORLDofPEACE";
  };
  wscott = {
    email = "wsc9tt@gmail.com";
@ -9749,7 +9761,7 @@
    name = "Asad Saeeduddin";
  };
  ngerstle = {
-    name  = "Nicholas Gerstle";
+    name = "Nicholas Gerstle";
    email = "ngerstle@gmail.com";
    github = "ngerstle";
    githubId = 1023752;
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@ -63,6 +63,7 @@ let
    "--stringparam html.script './highlightjs/highlight.pack.js ./highlightjs/loader.js'"
    "--param xref.with.number.and.title 1"
    "--param toc.section.depth 0"
+    "--param generate.consistent.ids 1"
    "--stringparam admon.style ''"
    "--stringparam callout.graphics.extension .svg"
    "--stringparam current.docid manual"
--- a/nixos/doc/manual/man-nixos-install.xml
+++ b/nixos/doc/manual/man-nixos-install.xml
@ -49,6 +49,12 @@
    <option>--flake</option> <replaceable>flake-uri</replaceable>
   </arg>

+   <arg>
+    <group choice='req'>
+     <arg choice='plain'><option>--impure</option></arg>
+    </group>
+   </arg>
+
   <arg>
     <arg choice='plain'>
       <option>--channel</option>
@ -100,6 +106,12 @@
    </arg>
   </arg>

+   <arg>
+    <arg choice='plain'>
+     <option>--keep-going</option>
+    </arg>
+   </arg>
+
   <arg>
    <arg choice='plain'>
     <option>--help</option>
@ -295,6 +307,17 @@
     </para>
    </listitem>
   </varlistentry>
+   <varlistentry>
+    <term>
+     <option>--keep-going</option>
+    </term>
+    <listitem>
+     <para>
+      Causes Nix to continue building derivations as far as possible
+      in the face of failed builds.
+     </para>
+    </listitem>
+   </varlistentry>
   <varlistentry>
    <term>
     <option>--help</option>
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -1618,7 +1618,7 @@ services.transmission.settings.rpc-bind-address = "0.0.0.0";
      nixpkgs. It was a work in progress to package the
      <link xlink:href="https://www.deepin.org/en/dde/">Deepin Desktop Environment (DDE)</link>,
      including libraries, tools and applications, and it was still
-      missing a service to lauch the desktop environment. It has shown
+      missing a service to launch the desktop environment. It has shown
      to no longer be a feasible goal due to reasons discussed in
      <link xlink:href="https://github.com/NixOS/nixpkgs/issues/94870">issue #94870</link>.
      The package <literal>netease-cloud-music</literal> has also been
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@ -135,6 +135,14 @@
     to <package>nextcloud20</package>.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     NixOS now emits a deprecation warning if systemd's <literal>StartLimitInterval</literal> setting is used in a <literal>serviceConfig</literal> section instead of in a <literal>unitConfig</literal>; that setting is deprecated and now undocumented for the service section by systemd upstream, but still effective and somewhat buggy there, which can be confusing. See <link xlink:href="https://github.com/NixOS/nixpkgs/issues/45785">#45785</link> for details.
+    </para>
+    <para>
+     All services should use <xref linkend="opt-systemd.services._name_.startLimitIntervalSec" /> or <literal>StartLimitIntervalSec</literal> in <xref linkend="opt-systemd.services._name_.unitConfig" /> instead.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@ -28,6 +28,9 @@
  #   partition of reasonable size is created in addition to the root partition.
  # For "legacy", the msdos partition table is used and a single large root
  #   partition is created.
+  # For "legacy+gpt", the GPT partition table is used, a 1MiB no-fs partition for
+  #   use by the bootloader is created, and a single large root partition is
+  #   created.
  # For "hybrid", the GPT partition table is used and a mandatory ESP
  #   partition of reasonable size is created in addition to the root partition.
  #   Also a legacy MBR will be present.
@ -54,7 +57,7 @@
  format ? "raw"
 }:

-assert partitionTableType == "legacy" || partitionTableType == "efi" || partitionTableType == "hybrid" || partitionTableType == "none";
+assert partitionTableType == "legacy" || partitionTableType == "legacy+gpt" || partitionTableType == "efi" || partitionTableType == "hybrid" || partitionTableType == "none";
 # We use -E offset=X below, which is only supported by e2fsprogs
 assert partitionTableType != "none" -> fsType == "ext4";

@ -75,6 +78,7 @@ let format' = format; in let

  rootPartition = { # switch-case
    legacy = "1";
+    "legacy+gpt" = "2";
    efi = "2";
    hybrid = "3";
  }.${partitionTableType};
@ -85,6 +89,16 @@ let format' = format; in let
        mklabel msdos \
        mkpart primary ext4 1MiB -1
    '';
+    "legacy+gpt" = ''
+      parted --script $diskImage -- \
+        mklabel gpt \
+        mkpart no-fs 1MB 2MB \
+        set 1 bios_grub on \
+        align-check optimal 1 \
+        mkpart primary ext4 2MB -1 \
+        align-check optimal 2 \
+        print
+    '';
    efi = ''
      parted --script $diskImage -- \
        mklabel gpt \
--- a/nixos/maintainers/scripts/ec2/amazon-image.nix
+++ b/nixos/maintainers/scripts/ec2/amazon-image.nix
@ -57,7 +57,7 @@ in {
    inherit (cfg) contents format name;
    pkgs = import ../../../.. { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package
    partitionTableType = if config.ec2.efi then "efi"
-                         else if config.ec2.hvm then "legacy"
+                         else if config.ec2.hvm then "legacy+gpt"
                         else "none";
    diskSize = cfg.sizeMB;
    fsType = "ext4";
--- a/nixos/maintainers/scripts/ec2/create-amis.sh
+++ b/nixos/maintainers/scripts/ec2/create-amis.sh
@ -1,13 +1,15 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -p awscli -p jq -p qemu -i bash
+# shellcheck shell=bash

 # Uploads and registers NixOS images built from the
 # <nixos/release.nix> amazonImage attribute. Images are uploaded and
 # registered via a home region, and then copied to other regions.

-# The home region requires an s3 bucket, and a "vmimport" IAM role
-# with access to the S3 bucket.  Configuration of the vmimport role is
-# documented in
+# The home region requires an s3 bucket, and an IAM role named "vmimport"
+# (by default) with access to the S3 bucket. The name can be
+# configured with the "service_role_name" variable. Configuration of the
+# vmimport role is documented in
 # https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-image-import.html

 # set -x
@ -17,6 +19,7 @@ set -euo pipefail
 state_dir=$HOME/amis/ec2-images
 home_region=eu-west-1
 bucket=nixos-amis
+service_role_name=vmimport

 regions=(eu-west-1 eu-west-2 eu-west-3 eu-central-1 eu-north-1
         us-east-1 us-east-2 us-west-1 us-west-2
@ -64,7 +67,7 @@ image_logical_bytes=$(read_image_info .logical_bytes)

 # Derived attributes

-image_logical_gigabytes=$((($image_logical_bytes-1)/1024/1024/1024+1)) # Round to the next GB
+image_logical_gigabytes=$(((image_logical_bytes-1)/1024/1024/1024+1)) # Round to the next GB

 case "$image_system" in
    aarch64-linux)
@ -100,7 +103,7 @@ write_state() {
    local type=$2
    local val=$3

-    mkdir -p $state_dir
+    mkdir -p "$state_dir"
    echo "$val" > "$state_dir/$state_key.$type"
 }

@ -110,8 +113,8 @@ wait_for_import() {
    local state snapshot_id
    log "Waiting for import task $task_id to be completed"
    while true; do
-        read state progress snapshot_id < <(
-            aws ec2 describe-import-snapshot-tasks --region $region --import-task-ids "$task_id" | \
+        read -r state progress snapshot_id < <(
+            aws ec2 describe-import-snapshot-tasks --region "$region" --import-task-ids "$task_id" | \
                jq -r '.ImportSnapshotTasks[].SnapshotTaskDetail | "\(.Status) \(.Progress) \(.SnapshotId)"'
        )
        log " ... state=$state progress=$progress snapshot_id=$snapshot_id"
@ -125,6 +128,8 @@ wait_for_import() {
                ;;
            *)
                log "Unexpected snapshot import state: '${state}'"
+                log "Full response: "
+                aws ec2 describe-import-snapshot-tasks --region "$region" --import-task-ids "$task_id" >&2
                exit 1
                ;;
        esac
@ -138,8 +143,8 @@ wait_for_image() {
    log "Waiting for image $ami_id to be available"

    while true; do
-        read state < <(
-            aws ec2 describe-images --image-ids "$ami_id" --region $region | \
+        read -r state < <(
+            aws ec2 describe-images --image-ids "$ami_id" --region "$region" | \
                jq -r ".Images[].State"
        )
        log " ... state=$state"
@ -163,7 +168,7 @@ make_image_public() {
    local region=$1
    local ami_id=$2

-    wait_for_image $region "$ami_id"
+    wait_for_image "$region" "$ami_id"

    log "Making image $ami_id public"

@ -177,27 +182,30 @@ upload_image() {
    local aws_path=${image_file#/}

    local state_key="$region.$image_label.$image_system"
-    local task_id=$(read_state "$state_key" task_id)
-    local snapshot_id=$(read_state "$state_key" snapshot_id)
-    local ami_id=$(read_state "$state_key" ami_id)
+    local task_id
+    task_id=$(read_state "$state_key" task_id)
+    local snapshot_id
+    snapshot_id=$(read_state "$state_key" snapshot_id)
+    local ami_id
+    ami_id=$(read_state "$state_key" ami_id)

    if [ -z "$task_id" ]; then
        log "Checking for image on S3"
        if ! aws s3 ls --region "$region" "s3://${bucket}/${aws_path}" >&2; then
            log "Image missing from aws, uploading"
-            aws s3 cp --region $region "$image_file" "s3://${bucket}/${aws_path}" >&2
+            aws s3 cp --region "$region" "$image_file" "s3://${bucket}/${aws_path}" >&2
        fi

        log "Importing image from S3 path s3://$bucket/$aws_path"

-        task_id=$(aws ec2 import-snapshot --disk-container "{
+        task_id=$(aws ec2 import-snapshot --role-name "$service_role_name" --disk-container "{
          \"Description\": \"nixos-image-${image_label}-${image_system}\",
          \"Format\": \"vhd\",
          \"UserBucket\": {
              \"S3Bucket\": \"$bucket\",
              \"S3Key\": \"$aws_path\"
          }
-        }" --region $region | jq -r '.ImportTaskId')
+        }" --region "$region" | jq -r '.ImportTaskId')

        write_state "$state_key" task_id "$task_id"
    fi
@ -221,16 +229,16 @@ upload_image() {
            --virtualization-type hvm
        )

-        block_device_mappings+=(DeviceName=/dev/sdb,VirtualName=ephemeral0)
-        block_device_mappings+=(DeviceName=/dev/sdc,VirtualName=ephemeral1)
-        block_device_mappings+=(DeviceName=/dev/sdd,VirtualName=ephemeral2)
-        block_device_mappings+=(DeviceName=/dev/sde,VirtualName=ephemeral3)
+        block_device_mappings+=("DeviceName=/dev/sdb,VirtualName=ephemeral0")
+        block_device_mappings+=("DeviceName=/dev/sdc,VirtualName=ephemeral1")
+        block_device_mappings+=("DeviceName=/dev/sdd,VirtualName=ephemeral2")
+        block_device_mappings+=("DeviceName=/dev/sde,VirtualName=ephemeral3")

        ami_id=$(
            aws ec2 register-image \
                --name "$image_name" \
                --description "$image_description" \
-                --region $region \
+                --region "$region" \
                --architecture $amazon_arch \
                --block-device-mappings "${block_device_mappings[@]}" \
                "${extra_flags[@]}" \
@ -240,7 +248,7 @@ upload_image() {
        write_state "$state_key" ami_id "$ami_id"
    fi

-    make_image_public $region "$ami_id"
+    make_image_public "$region" "$ami_id"

    echo "$ami_id"
 }
@ -268,7 +276,7 @@ copy_to_region() {
        write_state "$state_key" ami_id "$ami_id"
    fi

-    make_image_public $region "$ami_id"
+    make_image_public "$region" "$ami_id"

    echo "$ami_id"
 }
--- a/nixos/modules/config/fonts/fontdir.nix
+++ b/nixos/modules/config/fonts/fontdir.nix
@ -8,7 +8,7 @@ let

  x11Fonts = pkgs.runCommand "X11-fonts" { preferLocalBuild = true; } ''
    mkdir -p "$out/share/X11/fonts"
-    font_regexp='.*\.\(ttf\|otf\|pcf\|pfa\|pfb\|bdf\)\(\.gz\)?'
+    font_regexp='.*\.\(ttf\|ttc\|otf\|pcf\|pfa\|pfb\|bdf\)\(\.gz\)?'
    find ${toString config.fonts.fonts} -regex "$font_regexp" \
      -exec ln -sf -t "$out/share/X11/fonts" '{}' \;
    cd "$out/share/X11/fonts"
--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@ -64,7 +64,7 @@ while [ "$#" -gt 0 ]; do
        --no-bootloader)
            noBootLoader=1
            ;;
-        --show-trace)
+        --show-trace|--impure|--keep-going)
            extraBuildFlags+=("$i")
            ;;
        --help)
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -468,7 +468,7 @@ in
      #minecraft = 114; # unused
      vault = 115;
      #ripped = 116; # unused
-      #murmur = 117; # unused
+      murmur = 117;
      foundationdb = 118;
      newrelic = 119;
      starbound = 120;
--- a/nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix
+++ b/nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix
@ -25,19 +25,18 @@ in
  ];

  config = mkIf cfg.enable {
-
    systemd.services.hercules-ci-agent = {
      wantedBy = [ "multi-user.target" ];
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      path = [ config.nix.package ];
+      startLimitBurst = 30 * 1000000; # practically infinite
      serviceConfig = {
        User = "hercules-ci-agent";
        ExecStart = command;
        ExecStartPre = testCommand;
        Restart = "on-failure";
        RestartSec = 120;
-        StartLimitBurst = 30 * 1000000; # practically infinite
      };
    };

--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@ -69,11 +69,16 @@ in
        type = types.lines;
        default = "";
        description = ''
-          Defines how users authenticate themselves to the server. By
-          default, "trust" access to local users will always be granted
-          along with any other custom options. If you do not want this,
-          set this option using "lib.mkForce" to override this
-          behaviour.
+          Defines how users authenticate themselves to the server. See the
+          <link xlink:href="https://www.postgresql.org/docs/current/auth-pg-hba-conf.html">
+          PostgreSQL documentation for pg_hba.conf</link>
+          for details on the expected format of this option. By default,
+          peer based authentication will be used for users connecting
+          via the Unix socket, and md5 password authentication will be
+          used for users connecting via TCP. Any added rules will be
+          inserted above the default rules. If you'd like to replace the
+          default rules entirely, you can use <function>lib.mkForce</function> in your
+          module.
        '';
      };

--- a/nixos/modules/services/databases/victoriametrics.nix
+++ b/nixos/modules/services/databases/victoriametrics.nix
@ -40,10 +40,10 @@ let cfg = config.services.victoriametrics; in
    systemd.services.victoriametrics = {
      description = "VictoriaMetrics time series database";
      after = [ "network.target" ];
+      startLimitBurst = 5;
      serviceConfig = {
        Restart = "on-failure";
        RestartSec = 1;
-        StartLimitBurst = 5;
        StateDirectory = "victoriametrics";
        DynamicUser = true;
        ExecStart = ''
--- a/nixos/modules/services/hardware/lcd.nix
+++ b/nixos/modules/services/hardware/lcd.nix
@ -151,14 +151,13 @@ in with lib; {
        description = "LCDproc - client";
        after = [ "lcdd.service" ];
        wantedBy = [ "lcd.target" ];
+        # Allow restarting for eternity
+        startLimitIntervalSec = lib.mkIf cfg.client.restartForever 0;
        serviceConfig = serviceCfg // {
          ExecStart = "${pkg}/bin/lcdproc -f -c ${clientCfg}";
          # If the server is being restarted at the same time, the client will
          # fail as it cannot connect, so space it out a bit.
          RestartSec = "5";
-          # Allow restarting for eternity
-          StartLimitIntervalSec = lib.mkIf cfg.client.restartForever "0";
-          StartLimitBurst = lib.mkIf cfg.client.restartForever "0";
        };
      };
    };
--- a/nixos/modules/services/hardware/undervolt.nix
+++ b/nixos/modules/services/hardware/undervolt.nix
@ -3,7 +3,12 @@
 with lib;
 let
  cfg = config.services.undervolt;
-  cliArgs = lib.cli.toGNUCommandLineShell {} {
+
+  mkPLimit = limit: window:
+    if (isNull limit && isNull window) then null
+    else assert asserts.assertMsg (!isNull limit && !isNull window) "Both power limit and window must be set";
+      "${toString limit} ${toString window}";
+  cliArgs = lib.cli.toGNUCommandLine {} {
    inherit (cfg)
      verbose
      temp
@ -21,6 +26,9 @@ let

    temp-bat = cfg.tempBat;
    temp-ac = cfg.tempAc;
+
+    power-limit-long = mkPLimit cfg.p1.limit cfg.p1.window;
+    power-limit-short = mkPLimit cfg.p2.limit cfg.p2.window;
  };
 in
 {
@ -104,6 +112,40 @@ in
      '';
    };

+    p1.limit = mkOption {
+      type = with types; nullOr int;
+      default = null;
+      description = ''
+        The P1 Power Limit in Watts.
+        Both limit and window must be set.
+      '';
+    };
+    p1.window = mkOption {
+      type = with types; nullOr (oneOf [ float int ]);
+      default = null;
+      description = ''
+        The P1 Time Window in seconds.
+        Both limit and window must be set.
+      '';
+    };
+
+    p2.limit = mkOption {
+      type = with types; nullOr int;
+      default = null;
+      description = ''
+        The P2 Power Limit in Watts.
+        Both limit and window must be set.
+      '';
+    };
+    p2.window = mkOption {
+      type = with types; nullOr (oneOf [ float int ]);
+      default = null;
+      description = ''
+        The P2 Time Window in seconds.
+        Both limit and window must be set.
+      '';
+    };
+
    useTimer = mkOption {
      type = types.bool;
      default = false;
@ -133,7 +175,7 @@ in
      serviceConfig = {
        Type = "oneshot";
        Restart = "no";
-        ExecStart = "${pkgs.undervolt}/bin/undervolt ${cliArgs}";
+        ExecStart = "${pkgs.undervolt}/bin/undervolt ${toString cliArgs}";
      };
    };

--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@ -427,12 +427,12 @@ in
      wantedBy = [ "multi-user.target" ];
      restartTriggers = [ cfg.configFile modulesDir ];

+      startLimitIntervalSec = 60;  # 1 min
      serviceConfig = {
        ExecStart = "${dovecotPkg}/sbin/dovecot -F";
        ExecReload = "${dovecotPkg}/sbin/doveadm reload";
        Restart = "on-failure";
        RestartSec = "1s";
-        StartLimitInterval = "1min";
        RuntimeDirectory = [ "dovecot2" ];
      };

--- a/nixos/modules/services/misc/autorandr.nix
+++ b/nixos/modules/services/misc/autorandr.nix
@ -37,9 +37,9 @@ in {
      description = "Autorandr execution hook";
      after = [ "sleep.target" ];

+      startLimitIntervalSec = 5;
+      startLimitBurst = 1;
      serviceConfig = {
-        StartLimitInterval = 5;
-        StartLimitBurst = 1;
        ExecStart = "${pkgs.autorandr}/bin/autorandr --batch --change --default ${cfg.defaultTarget}";
        Type = "oneshot";
        RemainAfterExit = false;
--- a/nixos/modules/services/misc/cgminer.nix
+++ b/nixos/modules/services/misc/cgminer.nix
@ -126,12 +126,12 @@ in
        GPU_USE_SYNC_OBJECTS = "1";
      };

+      startLimitIntervalSec = 60;  # 1 min
      serviceConfig = {
        ExecStart = "${pkgs.cgminer}/bin/cgminer --syslog --text-only --config ${cgminerConfig}";
        User = cfg.user;
        RestartSec = "30s";
        Restart = "always";
-        StartLimitInterval = "1m";
      };
    };

--- a/nixos/modules/services/misc/safeeyes.nix
+++ b/nixos/modules/services/misc/safeeyes.nix
@ -32,14 +32,14 @@ in
      wantedBy = [ "graphical-session.target" ];
      partOf   = [ "graphical-session.target" ];

+      startLimitIntervalSec = 350;
+      startLimitBurst = 10;
      serviceConfig = {
        ExecStart = ''
          ${pkgs.safeeyes}/bin/safeeyes
        '';
        Restart = "on-failure";
        RestartSec = 3;
-        StartLimitInterval = 350;
-        StartLimitBurst = 10;
      };
    };

--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@ -45,7 +45,7 @@ let

  cmdlineArgs = cfg.extraFlags ++ [
    "--storage.tsdb.path=${workingDir}/data/"
-    "--config.file=${prometheusYml}"
+    "--config.file=/run/prometheus/prometheus-substituted.yaml"
    "--web.listen-address=${cfg.listenAddress}:${builtins.toString cfg.port}"
    "--alertmanager.notification-queue-capacity=${toString cfg.alertmanagerNotificationQueueCapacity}"
    "--alertmanager.timeout=${toString cfg.alertmanagerTimeout}s"
@ -522,6 +522,45 @@ in {
      '';
    };

+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/root/prometheus.env";
+      description = ''
+        Environment file as defined in <citerefentry>
+        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
+        </citerefentry>.
+
+        Secrets may be passed to the service without adding them to the
+        world-readable Nix store, by specifying placeholder variables as
+        the option value in Nix and setting these variables accordingly in the
+        environment file.
+
+        Environment variables from this file will be interpolated into the
+        config file using envsubst with this syntax:
+        <literal>$ENVIRONMENT ''${VARIABLE}</literal>
+
+        <programlisting>
+          # Example scrape config entry handling an OAuth bearer token
+          {
+            job_name = "home_assistant";
+            metrics_path = "/api/prometheus";
+            scheme = "https";
+            bearer_token = "\''${HOME_ASSISTANT_BEARER_TOKEN}";
+            [...]
+          }
+        </programlisting>
+
+        <programlisting>
+          # Content of the environment file
+          HOME_ASSISTANT_BEARER_TOKEN=someoauthbearertoken
+        </programlisting>
+
+        Note that this file needs to be available on the host on which
+        <literal>Prometheus</literal> is running.
+      '';
+    };
+
    configText = mkOption {
      type = types.nullOr types.lines;
      default = null;
@ -662,12 +701,19 @@ in {
    systemd.services.prometheus = {
      wantedBy = [ "multi-user.target" ];
      after    = [ "network.target" ];
+      preStart = ''
+         ${lib.getBin pkgs.envsubst}/bin/envsubst -o "/run/prometheus/prometheus-substituted.yaml" \
+                                                  -i "${prometheusYml}"
+      '';
      serviceConfig = {
        ExecStart = "${cfg.package}/bin/prometheus" +
          optionalString (length cmdlineArgs != 0) (" \\\n  " +
            concatStringsSep " \\\n  " cmdlineArgs);
        User = "prometheus";
        Restart  = "always";
+        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+        RuntimeDirectory = "prometheus";
+        RuntimeDirectoryMode = "0700";
        WorkingDirectory = workingDir;
        StateDirectory = cfg.stateDir;
      };
--- a/nixos/modules/services/monitoring/teamviewer.nix
+++ b/nixos/modules/services/monitoring/teamviewer.nix
@ -31,14 +31,14 @@ in
      after = [ "NetworkManager-wait-online.service" "network.target" ];
      preStart = "mkdir -pv /var/lib/teamviewer /var/log/teamviewer";

+      startLimitIntervalSec = 60;
+      startLimitBurst = 10;
      serviceConfig = {
        Type = "forking";
        ExecStart = "${pkgs.teamviewer}/bin/teamviewerd -d";
        PIDFile = "/run/teamviewerd.pid";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        Restart = "on-abort";
-        StartLimitInterval = "60";
-        StartLimitBurst = "10";
      };
    };
  };
--- a/nixos/modules/services/network-filesystems/ceph.nix
+++ b/nixos/modules/services/network-filesystems/ceph.nix
@ -28,6 +28,9 @@ let

    # Don't start services that are not yet initialized
    unitConfig.ConditionPathExists = "/var/lib/${stateDirectory}/keyring";
+    startLimitBurst =
+      if daemonType == "osd" then 30 else if lib.elem daemonType ["mgr" "mds"] then 3 else 5;
+    startLimitIntervalSec = 60 * 30;  # 30 mins

    serviceConfig = {
      LimitNOFILE = 1048576;
@ -39,8 +42,6 @@ let
      ProtectHome = "true";
      ProtectSystem = "full";
      Restart = "on-failure";
-      StartLimitBurst = "5";
-      StartLimitInterval = "30min";
      StateDirectory = stateDirectory;
      User = "ceph";
      Group = if daemonType == "osd" then "disk" else "ceph";
@ -48,13 +49,10 @@ let
                    -f --cluster ${clusterName} --id ${daemonId}'';
    } // optionalAttrs (daemonType == "osd") {
      ExecStartPre = ''${ceph.lib}/libexec/ceph/ceph-osd-prestart.sh --id ${daemonId} --cluster ${clusterName}'';
-      StartLimitBurst = "30";
      RestartSec = "20s";
      PrivateDevices = "no"; # osd needs disk access
    } // optionalAttrs ( daemonType == "mon") {
      RestartSec = "10";
-    } // optionalAttrs (lib.elem daemonType ["mgr" "mds"]) {
-      StartLimitBurst = "3";
    };
  });

--- a/nixos/modules/services/networking/babeld.nix
+++ b/nixos/modules/services/networking/babeld.nix
@ -87,9 +87,37 @@ in
      description = "Babel routing daemon";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.babeld}/bin/babeld -c ${configFile}";
+      serviceConfig = {
+        ExecStart = "${pkgs.babeld}/bin/babeld -c ${configFile} -I /run/babeld/babeld.pid -S /var/lib/babeld/state";
+        CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
+        IPAddressAllow = [ "fe80::/64" "ff00::/8" "::1/128" "127.0.0.0/8" ];
+        IPAddressDeny = "any";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        MemoryDenyWriteExecute = true;
+        ProtectSystem = "strict";
+        ProtectClock = true;
+        ProtectKernelTunables = false; # Couldn't write sysctl: Read-only file system
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [ "AF_NETLINK" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = false; # kernel_route(ADD): Operation not permitted
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" ];
+        UMask = "0177";
+        RuntimeDirectory = "babeld";
+        StateDirectory = "babeld";
+      };
    };
-
  };
-
 }
--- a/nixos/modules/services/networking/blockbook-frontend.nix
+++ b/nixos/modules/services/networking/blockbook-frontend.nix
@ -158,15 +158,21 @@ let
        type = types.attrs;
        default = {};
        example = literalExample '' {
-          alternative_estimate_fee = "whatthefee-disabled";
-          alternative_estimate_fee_params = "{\"url\": \"https://whatthefee.io/data.json\", \"periodSeconds\": 60}";
-          fiat_rates = "coingecko";
-          fiat_rates_params = "{\"url\": \"https://api.coingecko.com/api/v3\", \"coin\": \"bitcoin\", \"periodSeconds\": 60}";
-          coin_shortcut = "BTC";
-          coin_label = "Bitcoin";
-          xpub_magic = 76067358;
-          xpub_magic_segwit_p2sh = 77429938;
-          xpub_magic_segwit_native = 78792518;
+          "alternative_estimate_fee" = "whatthefee-disabled";
+          "alternative_estimate_fee_params" = "{\"url\": \"https://whatthefee.io/data.json\", \"periodSeconds\": 60}";
+          "fiat_rates" = "coingecko";
+          "fiat_rates_params" = "{\"url\": \"https://api.coingecko.com/api/v3\", \"coin\": \"bitcoin\", \"periodSeconds\": 60}";
+          "coin_shortcut" = "BTC";
+          "coin_label" = "Bitcoin";
+          "parse" = true;
+          "subversion" = "";
+          "address_format" = "";
+          "xpub_magic" = 76067358;
+          "xpub_magic_segwit_p2sh" = 77429938;
+          "xpub_magic_segwit_native" = 78792518;
+          "mempool_workers" = 8;
+          "mempool_sub_workers" = 2;
+          "block_addresses_to_keep" = 300;
        }'';
        description = ''
          Additional configurations to be appended to <filename>coin.conf</filename>.
--- a/nixos/modules/services/networking/cjdns.nix
+++ b/nixos/modules/services/networking/cjdns.nix
@ -264,10 +264,10 @@ in
         ''
      );

+      startLimitIntervalSec = 0;
      serviceConfig = {
        Type = "forking";
        Restart = "always";
-        StartLimitInterval = 0;
        RestartSec = 1;
        CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW CAP_SETUID";
        ProtectSystem = true;
--- a/nixos/modules/services/networking/dnsdist.nix
+++ b/nixos/modules/services/networking/dnsdist.nix
@ -41,6 +41,7 @@ in {
    systemd.services.dnsdist = {
      wantedBy = [ "multi-user.target" ];

+      startLimitIntervalSec = 0;
      serviceConfig = {
        DynamicUser = true;

--- a/nixos/modules/services/networking/mullvad-vpn.nix
+++ b/nixos/modules/services/networking/mullvad-vpn.nix
@ -29,9 +29,9 @@ with lib;
        # Needed for ping
        "/run/wrappers"
      ];
+      startLimitBurst = 5;
+      startLimitIntervalSec = 20;
      serviceConfig = {
-        StartLimitBurst = 5;
-        StartLimitIntervalSec = 20;
        ExecStart = "${pkgs.mullvad-vpn}/bin/mullvad-daemon -v --disable-stdout-timestamps";
        Restart = "always";
        RestartSec = 1;
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@ -278,6 +278,10 @@ in
      home            = "/var/lib/murmur";
      createHome      = true;
      uid             = config.ids.uids.murmur;
+      group           = "murmur";
+    };
+    users.groups.murmur = {
+      gid             = config.ids.gids.murmur;
    };

    systemd.services.murmur = {
@ -300,6 +304,7 @@ in
        RuntimeDirectory = "murmur";
        RuntimeDirectoryMode = "0700";
        User = "murmur";
+        Group = "murmur";
      };
    };
  };
--- a/nixos/modules/services/networking/namecoind.nix
+++ b/nixos/modules/services/networking/namecoind.nix
@ -165,6 +165,8 @@ in
      after    = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

+      startLimitIntervalSec = 120;
+      startLimitBurst = 5;
      serviceConfig = {
        User  = "namecoin";
        Group = "namecoin";
@ -176,8 +178,6 @@ in
        TimeoutStopSec     = "60s";
        TimeoutStartSec    = "2s";
        Restart            = "always";
-        StartLimitInterval = "120s";
-        StartLimitBurst    = "5";
      };

      preStart = optionalString (cfg.wallet != "${dataDir}/wallet.dat")  ''
--- a/nixos/modules/services/networking/nextdns.nix
+++ b/nixos/modules/services/networking/nextdns.nix
@ -28,9 +28,9 @@ in {
      environment = {
        SERVICE_RUN_MODE = "1";
      };
+      startLimitIntervalSec = 5;
+      startLimitBurst = 10;
      serviceConfig = {
-        StartLimitInterval = 5;
-        StartLimitBurst = 10;
        ExecStart = "${pkgs.nextdns}/bin/nextdns run ${escapeShellArgs config.services.nextdns.arguments}";
        RestartSec = 120;
        LimitMEMLOCK = "infinity";
--- a/nixos/modules/services/networking/nix-store-gcs-proxy.nix
+++ b/nixos/modules/services/networking/nix-store-gcs-proxy.nix
@ -42,9 +42,9 @@ in
      description = "A HTTP nix store that proxies requests to Google Storage";
      wantedBy = ["multi-user.target"];

+      startLimitIntervalSec = 10;
      serviceConfig = {
        RestartSec = 5;
-        StartLimitInterval = 10;
        ExecStart = ''
          ${pkgs.nix-store-gcs-proxy}/bin/nix-store-gcs-proxy \
            --bucket-name ${cfg.bucketName} \
--- a/nixos/modules/services/networking/nsd.nix
+++ b/nixos/modules/services/networking/nsd.nix
@ -916,14 +916,14 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

+      startLimitBurst = 4;
+      startLimitIntervalSec = 5 * 60;  # 5 mins
      serviceConfig = {
        ExecStart = "${nsdPkg}/sbin/nsd -d -c ${nsdEnv}/nsd.conf";
        StandardError = "null";
        PIDFile = pidFile;
        Restart = "always";
        RestartSec = "4s";
-        StartLimitBurst = 4;
-        StartLimitInterval = "5min";
      };

      preStart = ''
--- a/nixos/modules/services/networking/supybot.nix
+++ b/nixos/modules/services/networking/supybot.nix
@ -103,6 +103,8 @@ in
        rm -f '${cfg.stateDir}/supybot.cfg.bak'
      '';

+      startLimitIntervalSec = 5 * 60;  # 5 min
+      startLimitBurst = 1;
      serviceConfig = {
        ExecStart = "${pyEnv}/bin/supybot ${cfg.stateDir}/supybot.cfg";
        PIDFile = "/run/supybot.pid";
@ -110,8 +112,6 @@ in
        Group = "supybot";
        UMask = "0007";
        Restart = "on-abort";
-        StartLimitInterval = "5m";
-        StartLimitBurst = "1";

        NoNewPrivileges = true;
        PrivateDevices = true;
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@ -17,6 +17,7 @@ in {
  };

  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.tailscale ]; # for the CLI
    systemd.services.tailscale = {
      description = "Tailscale client daemon";

@ -24,10 +25,7 @@ in {
      wants = [ "network-pre.target" ];
      wantedBy = [ "multi-user.target" ];

-      unitConfig = {
-        StartLimitIntervalSec = 0;
-        StartLimitBurst = 0;
-      };
+      startLimitIntervalSec = 0;

      serviceConfig = {
        ExecStart =
--- a/nixos/modules/services/security/vault.nix
+++ b/nixos/modules/services/security/vault.nix
@ -131,6 +131,8 @@ in

      restartIfChanged = false; # do not restart on "nixos-rebuild switch". It would seal the storage and disrupt the clients.

+      startLimitIntervalSec = 60;
+      startLimitBurst = 3;
      serviceConfig = {
        User = "vault";
        Group = "vault";
@ -145,8 +147,6 @@ in
        KillSignal = "SIGINT";
        TimeoutStopSec = "30s";
        Restart = "on-failure";
-        StartLimitInterval = "60s";
-        StartLimitBurst = 3;
      };

      unitConfig.RequiresMountsFor = optional (cfg.storagePath != null) cfg.storagePath;
--- a/nixos/modules/services/web-apps/moinmoin.nix
+++ b/nixos/modules/services/web-apps/moinmoin.nix
@ -224,6 +224,8 @@ in
              chmod -R u+w ${dataDir}/${wikiIdent}/underlay
            '';

+            startLimitIntervalSec = 30;
+
            serviceConfig = {
              User = user;
              Group = group;
@ -237,7 +239,6 @@ in

              Restart = "on-failure";
              RestartSec = "2s";
-              StartLimitIntervalSec = "30s";

              StateDirectory = "moin/${wikiIdent}";
              StateDirectoryMode = "0750";
--- a/nixos/modules/services/web-apps/shiori.nix
+++ b/nixos/modules/services/web-apps/shiori.nix
@ -37,11 +37,60 @@ in {
      description = "Shiori simple bookmarks manager";
      wantedBy = [ "multi-user.target" ];

+      environment.SHIORI_DIR = "/var/lib/shiori";
+
      serviceConfig = {
        ExecStart = "${package}/bin/shiori serve --address '${address}' --port '${toString port}'";
+
        DynamicUser = true;
-        Environment = "SHIORI_DIR=/var/lib/shiori";
        StateDirectory = "shiori";
+        # As the RootDirectory
+        RuntimeDirectory = "shiori";
+
+        # Security options
+
+        BindReadOnlyPaths = [
+          "/nix/store"
+
+          # For SSL certificates, and the resolv.conf
+          "/etc"
+        ];
+
+        CapabilityBoundingSet = "";
+
+        DeviceAllow = "";
+
+        LockPersonality = true;
+
+        MemoryDenyWriteExecute = true;
+
+        PrivateDevices = true;
+        PrivateUsers = true;
+
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+
+        RestrictNamespaces = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+
+        RootDirectory = "/run/shiori";
+
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+
+          "~@chown" "~@cpu-emulation" "~@debug" "~@ipc" "~@keyring" "~@memlock"
+          "~@module" "~@obsolete" "~@privileged" "~@process" "~@raw-io"
+          "~@resources" "~@setuid"
+        ];
      };
    };
  };
--- a/nixos/modules/services/web-servers/caddy.nix
+++ b/nixos/modules/services/web-servers/caddy.nix
@ -24,6 +24,10 @@ let
    ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${adaptedConfig} ${tlsJSON} > $out
  '';
 in {
+  imports = [
+    (mkRemovedOptionModule [ "services" "caddy" "agree" ] "this option is no longer necessary for Caddy 2")
+  ];
+
  options.services.caddy = {
    enable = mkEnableOption "Caddy web server";

@ -66,12 +70,6 @@ in {
      description = "Email address (for Let's Encrypt certificate)";
    };

-    agree = mkOption {
-      default = false;
-      type = types.bool;
-      description = "Agree to Let's Encrypt Subscriber Agreement";
-    };
-
    dataDir = mkOption {
      default = "/var/lib/caddy";
      type = types.path;
@ -103,6 +101,8 @@ in {
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ]; # systemd-networkd-wait-online.service
      wantedBy = [ "multi-user.target" ];
+      startLimitIntervalSec = 14400;
+      startLimitBurst = 10;
      serviceConfig = {
        ExecStart = "${cfg.package}/bin/caddy run --config ${configJSON}";
        ExecReload = "${cfg.package}/bin/caddy reload --config ${configJSON}";
@ -110,8 +110,6 @@ in {
        User = "caddy";
        Group = "caddy";
        Restart = "on-abnormal";
-        StartLimitIntervalSec = 14400;
-        StartLimitBurst = 10;
        AmbientCapabilities = "cap_net_bind_service";
        CapabilityBoundingSet = "cap_net_bind_service";
        NoNewPrivileges = true;
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -693,6 +693,8 @@ in
        ${cfg.preStart}
        ${execCommand} -t
      '';
+
+      startLimitIntervalSec = 60;
      serviceConfig = {
        ExecStart = execCommand;
        ExecReload = [
@ -701,7 +703,6 @@ in
        ];
        Restart = "always";
        RestartSec = "10s";
-        StartLimitInterval = "1min";
        # User and group
        User = cfg.user;
        Group = cfg.group;
--- a/nixos/modules/services/web-servers/traefik.nix
+++ b/nixos/modules/services/web-servers/traefik.nix
@ -136,6 +136,8 @@ in {
      description = "Traefik web server";
      after = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];
+      startLimitIntervalSec = 86400;
+      startLimitBurst = 5;
      serviceConfig = {
        ExecStart =
          "${cfg.package}/bin/traefik --configfile=${staticConfigFile}";
@ -143,8 +145,6 @@ in {
        User = "traefik";
        Group = cfg.group;
        Restart = "on-failure";
-        StartLimitInterval = 86400;
-        StartLimitBurst = 5;
        AmbientCapabilities = "cap_net_bind_service";
        CapabilityBoundingSet = "cap_net_bind_service";
        NoNewPrivileges = true;
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -678,14 +678,14 @@ in

        script = "${cfg.displayManager.job.execCmd}";

+        # Stop restarting if the display manager stops (crashes) 2 times
+        # in one minute. Starting X typically takes 3-4s.
+        startLimitIntervalSec = 30;
+        startLimitBurst = 3;
        serviceConfig = {
          Restart = "always";
          RestartSec = "200ms";
          SyslogIdentifier = "display-manager";
-          # Stop restarting if the display manager stops (crashes) 2 times
-          # in one minute. Starting X typically takes 3-4s.
-          StartLimitInterval = "30s";
-          StartLimitBurst = "3";
        };
      };

--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -648,11 +648,13 @@ let
          "RapidCommit"
          "ForceDHCPv6PDOtherInformation"
          "PrefixDelegationHint"
+          "RouteMetric"
        ])
        (assertValueOneOf "UseDNS" boolValues)
        (assertValueOneOf "UseNTP" boolValues)
        (assertValueOneOf "RapidCommit" boolValues)
        (assertValueOneOf "ForceDHCPv6PDOtherInformation" boolValues)
+        (assertInt "RouteMetric")
      ];

      sectionDHCPServer = checkUnitConfig "DHCPServer" [
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -120,7 +120,7 @@ eval "exec $logOutFd>&1 $logErrFd>&2"
 if test -w /dev/kmsg; then
    tee -i < /tmp/stage-1-init.log.fifo /proc/self/fd/"$logOutFd" | while read -r line; do
        if test -n "$line"; then
-            echo "<7>stage-1-init: $line" > /dev/kmsg
+            echo "<7>stage-1-init: [$(date)] $line" > /dev/kmsg
        fi
    done &
 else
@ -356,6 +356,7 @@ mountFS() {
    case $options in
        *x-nixos.autoresize*)
            if [ "$fsType" = ext2 -o "$fsType" = ext3 -o "$fsType" = ext4 ]; then
+                modprobe "$fsType"
                echo "resizing $device..."
                e2fsck -fp "$device"
                resize2fs "$device"
--- a/nixos/modules/system/boot/systemd-unit-options.nix
+++ b/nixos/modules/system/boot/systemd-unit-options.nix
@ -210,12 +210,21 @@ in rec {
      '';
    };

+    startLimitBurst = mkOption {
+       type = types.int;
+       description = ''
+         Configure unit start rate limiting. Units which are started
+         more than startLimitBurst times within an interval time
+         interval are not permitted to start any more.
+       '';
+    };
+
    startLimitIntervalSec = mkOption {
       type = types.int;
       description = ''
         Configure unit start rate limiting. Units which are started
-         more than burst times within an interval time interval are
-         not permitted to start any more.
+         more than startLimitBurst times within an interval time
+         interval are not permitted to start any more.
       '';
    };

@ -245,8 +254,7 @@ in rec {
    serviceConfig = mkOption {
      default = {};
      example =
-        { StartLimitInterval = 10;
-          RestartSec = 5;
+        { RestartSec = 5;
        };
      type = types.addCheck (types.attrsOf unitOption) checkService;
      description = ''
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -243,6 +243,8 @@ let
          OnFailure = toString config.onFailure; }
        // optionalAttrs (options.startLimitIntervalSec.isDefined) {
          StartLimitIntervalSec = toString config.startLimitIntervalSec;
+        } // optionalAttrs (options.startLimitBurst.isDefined) {
+          StartLimitBurst = toString config.startLimitBurst;
        };
    };
  };
@ -884,14 +886,25 @@ in

  config = {

-    warnings = concatLists (mapAttrsToList (name: service:
-      let
-        type = service.serviceConfig.Type or "";
-        restart = service.serviceConfig.Restart or "no";
-      in optional
-      (type == "oneshot" && (restart == "always" || restart == "on-success"))
-      "Service '${name}.service' with 'Type=oneshot' cannot have 'Restart=always' or 'Restart=on-success'")
-      cfg.services);
+    warnings = concatLists (
+      mapAttrsToList
+        (name: service:
+          let
+            type = service.serviceConfig.Type or "";
+            restart = service.serviceConfig.Restart or "no";
+            hasDeprecated = builtins.hasAttr "StartLimitInterval" service.serviceConfig;
+          in
+            concatLists [
+              (optional (type == "oneshot" && (restart == "always" || restart == "on-success"))
+                "Service '${name}.service' with 'Type=oneshot' cannot have 'Restart=always' or 'Restart=on-success'"
+              )
+              (optional hasDeprecated
+                "Service '${name}.service' uses the attribute 'StartLimitInterval' in the Service section, which is deprecated. See https://github.com/NixOS/nixpkgs/issues/45786."
+              )
+            ]
+        )
+        cfg.services
+    );

    system.build.units = cfg.units;

--- a/nixos/modules/virtualisation/amazon-image.nix
+++ b/nixos/modules/virtualisation/amazon-image.nix
@ -48,7 +48,7 @@ in
    ];
    boot.initrd.kernelModules = [ "xen-blkfront" "xen-netfront" ];
    boot.initrd.availableKernelModules = [ "ixgbevf" "ena" "nvme" ];
-    boot.kernelParams = mkIf cfg.hvm [ "console=ttyS0" ];
+    boot.kernelParams = mkIf cfg.hvm [ "console=ttyS0" "random.trust_cpu=on" ];

    # Prevent the nouveau kernel module from being loaded, as it
    # interferes with the nvidia/nvidia-uvm modules needed for CUDA.
--- a/nixos/tests/firefox.nix
+++ b/nixos/tests/firefox.nix
@ -11,26 +11,105 @@ import ./make-test-python.nix ({ pkgs, esr ? false, ... }: {
      environment.systemPackages =
        (if esr then [ pkgs.firefox-esr ] else [ pkgs.firefox ])
        ++ [ pkgs.xdotool ];
+
+      # Need some more memory to record audio.
+      virtualisation.memorySize = "500";
+
+      # Create a virtual sound device, with mixing
+      # and all, for recording audio.
+      boot.kernelModules = [ "snd-aloop" ];
+      sound.enable = true;
+      sound.extraConfig = ''
+        pcm.!default {
+          type plug
+          slave.pcm pcm.dmixer
+        }
+        pcm.dmixer {
+          type dmix
+          ipc_key 1
+          slave {
+            pcm "hw:Loopback,0,0"
+            rate 48000
+            periods 128
+            period_time 0
+            period_size 1024
+            buffer_size 8192
+          }
+        }
+        pcm.recorder {
+          type hw
+          card "Loopback"
+          device 1
+          subdevice 0
+        }
+      '';
+
+      systemd.services.audio-recorder = {
+        description = "Record NixOS test audio to /tmp/record.wav";
+        script = "${pkgs.alsaUtils}/bin/arecord -D recorder -f S16_LE -r48000 /tmp/record.wav";
+      };
+
    };

  testScript = ''
+      from contextlib import contextmanager
+
+
+      @contextmanager
+      def audio_recording(machine: Machine) -> None:
+          """
+          Perform actions while recording the
+          machine audio output.
+          """
+          machine.systemctl("start audio-recorder")
+          yield
+          machine.systemctl("stop audio-recorder")
+
+
+      def wait_for_sound(machine: Machine) -> None:
+          """
+          Wait until any sound has been emitted.
+          """
+          machine.wait_for_file("/tmp/record.wav")
+          while True:
+              # Get at most 2M of the recording
+              machine.execute("tail -c 2M /tmp/record.wav > /tmp/last")
+              # Get the exact size
+              size = int(machine.succeed("stat -c '%s' /tmp/last").strip())
+              # Compare it against /dev/zero using `cmp` (skipping 50B of WAVE header).
+              # If some non-NULL bytes are found it returns 1.
+              status, output = machine.execute(
+                  f"cmp -i 50 -n {size - 50} /tmp/last /dev/zero 2>&1"
+              )
+              if status == 1:
+                  break
+              machine.sleep(2)
+
+
      machine.wait_for_x()

-      with subtest("wait until Firefox has finished loading the Valgrind docs page"):
+      with subtest("Wait until Firefox has finished loading the Valgrind docs page"):
          machine.execute(
              "xterm -e 'firefox file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html' &"
          )
          machine.wait_for_window("Valgrind")
          machine.sleep(40)

+      with subtest("Check whether Firefox can play sound"):
+          with audio_recording(machine):
+              machine.succeed(
+                  "firefox file://${pkgs.sound-theme-freedesktop}/share/sounds/freedesktop/stereo/phone-incoming-call.oga &"
+              )
+              wait_for_sound(machine)
+          machine.copy_from_vm("/tmp/record.wav")
+
+      with subtest("Close sound test tab"):
+          machine.execute("xdotool key ctrl+w")
+
      with subtest("Close default browser prompt"):
          machine.execute("xdotool key space")

-      with subtest("Hide default browser window"):
-          machine.sleep(2)
-          machine.execute("xdotool key F12")
-
-      with subtest("wait until Firefox draws the developer tool panel"):
+      with subtest("Wait until Firefox draws the developer tool panel"):
          machine.sleep(10)
          machine.succeed("xwininfo -root -tree | grep Valgrind")
          machine.screenshot("screen")
--- a/pkgs/applications/audio/opustags/default.nix
+++ b/pkgs/applications/audio/opustags/default.nix
@ -1,13 +1,13 @@
 { stdenv, lib, cmake, pkgconfig, libogg, fetchFromGitHub, libiconv }:
 stdenv.mkDerivation rec {
  pname = "opustags";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "fmang";
    repo = "opustags";
    rev = version;
-    sha256 = "09z0cdg20algaj2yyhfz3hxh1biwjjvzx1pc2vdc64n8lkswqsc1";
+    sha256 = "1y0czl72paawy342ff9ickaamkih43k59yfcdw7bnddypyfa7nbg";
  };

  buildInputs = [ libogg ];
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergo";
-  version = "3.3.4";
+  version = "3.3.5";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "0psq0nxb4c0fsxjzjxb4sy6lh4kj4w8aizd81r92fdv8izbm25sk";
+    sha256 = "0bxzpwwb42bppqli3zggx3lah7g6kwmy6k6k6dinypj6x0bafqcg";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -2,12 +2,12 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.14.0";
+  version = "2.15.0";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    sha256 = "057g77nd8qxi8dw9sp7x068wsxmrpnsdfrca876f0bpw7lpb0bqq";
+    sha256 = "06sm4ah05j0f3bxb1sbdi8mazmxk166y2gaycll6p2xhd105ins3";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@ -27,13 +27,13 @@ in

 stdenv.mkDerivation rec {
  pname = "monero-gui";
-  version = "0.17.1.0";
+  version = "0.17.1.1";

  src = fetchFromGitHub {
    owner  = "monero-project";
    repo   = "monero-gui";
    rev    = "v${version}";
-    sha256 = "07r78ipv4g3i6z822kq380vi3qwlb958rccsy6lyybkhj9y0rx84";
+    sha256 = "0aqhp4rmqsgwjb875kgh6qwz0wyyiag1fksyic9cnhgg5j5y95nx";
  };

  nativeBuildInputs = [
@ -75,11 +75,7 @@ stdenv.mkDerivation rec {
                'add_subdirectory(monero EXCLUDE_FROM_ALL)'
  '';

-  preConfigure = ''
-    # because $out needs to be expanded
-    cmakeFlagsArray+=("-DCMAKE_INSTALL_PREFIX=$out/bin")
-    cmakeFlagsArray+=("-DARCH=${arch}")
-  '';
+  cmakeFlags = [ "-DARCH=${arch}" ];

  desktopItem = makeDesktopItem {
    name = "monero-wallet-gui";
--- a/pkgs/applications/blockchains/monero/default.nix
+++ b/pkgs/applications/blockchains/monero/default.nix
@ -17,13 +17,13 @@ assert trezorSupport -> all (x: x!=null) [ libusb1 protobuf python3 ];

 stdenv.mkDerivation rec {
  pname = "monero";
-  version = "0.17.1.0";
+  version = "0.17.1.1";

  src = fetchFromGitHub {
    owner = "monero-project";
    repo = "monero";
    rev = "v${version}";
-    sha256 = "1cngniv7sndy8r0fcfgk737640k53q3kwd36g891p5igcb985qdw";
+    sha256 = "18x27dm24k04vx0yz57zi02rk0wrmbn4wr8alqf48dq6z9wr0fhp";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -19,9 +19,9 @@ let
    sha256Hash = "sha256-qbxmR9g8DSKzcP09bJuc+am79BSXWG39UQxFEb1bZ88=";
  };
  latestVersion = { # canary & dev
-    version = "4.2.0.14"; # "Android Studio 4.2 Canary 14"
-    build = "202.6907010";
-    sha256Hash = "sha256-A6nl4uN25CWOjpwBvOQG26EZnJP5tNvSrGtoF+IQmtY=";
+    version = "4.2.0.15"; # "Android Studio 4.2 Canary 15"
+    build = "202.6922807";
+    sha256Hash = "sha256-PXFNnPSJbdp9NtkMDR3Vq+vpWqd85Io2FmXPhRLRk/8=";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/marker/default.nix
+++ b/pkgs/applications/editors/marker/default.nix
@ -0,0 +1,49 @@
+{ stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook
+, gtk3
+, gtksourceview
+, gtkspell3
+, webkitgtk
+, pandoc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "marker";
+  version = "2020.04.04";
+
+  src = fetchFromGitHub {
+    owner = "fabiocolacio";
+    repo = "Marker";
+    rev = "${version}";
+    fetchSubmodules = true;
+    sha256 = "1iy7izyprf050bix8am1krqivgyxnhx3jm775v8f80cgbqxy7m5r";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    gtksourceview
+    gtkspell3
+    webkitgtk
+    pandoc
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://fabiocolacio.github.io/Marker/";
+    description = "Markdown editor for the Linux desktop";
+    maintainers = with maintainers; [ trepetti ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    changelog = "https://github.com/fabiocolacio/Marker/releases/tag/${version}";
+  };
+}
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@ -0,0 +1,159 @@
+{ lib
+, vimUtils
+, nodejs
+, neovim-unwrapped
+, bundlerEnv
+, ruby
+, pythonPackages
+, python3Packages
+, writeText
+, wrapNeovimUnstable
+}:
+let
+  # returns everything needed for the caller to wrap its own neovim:
+  # - the generated content of the future init.vim
+  # - the arguments to wrap neovim with
+  # The caller is responsible for writing the init.vim and adding it to the wrapped
+  # arguments (["-u" writeText "init.vim" GENERATEDRC)]).
+  # This makes it possible to write the config anywhere: on a per-project basis
+  # .nvimrc or in $XDG_CONFIG_HOME/nvim/init.vim to avoid sideeffects.
+  # Indeed, note that wrapping with `-u init.vim` has sideeffects like .nvimrc wont be loaded
+  # anymore, $MYVIMRC wont be set etc
+  makeNeovimConfig =
+    {
+    withPython2 ? false
+    /* the function you would have passed to python.withPackages */
+    , extraPython2Packages ? (_: [ ])
+    ,  withPython3 ? true
+    /* the function you would have passed to python3.withPackages */
+    , extraPython3Packages ? (_: [ ])
+    , withNodeJs ? false
+    , withRuby ? true
+
+    # same values as in vimUtils.vimrcContent
+    , configure ? { }
+
+    # for forward compability, when adding new environments, haskell etc.
+    , ...
+    }:
+    let
+      rubyEnv = bundlerEnv {
+        name = "neovim-ruby-env";
+        gemdir = ./ruby_provider;
+        postBuild = ''
+          ln -sf ${ruby}/bin/* $out/bin
+        '';
+      };
+
+
+      requiredPlugins = vimUtils.requiredPlugins configure;
+      getDeps = attrname: map (plugin: plugin.${attrname} or (_: [ ]));
+
+      pluginPython2Packages = getDeps "pythonDependencies" requiredPlugins;
+      python2Env = pythonPackages.python.withPackages (ps:
+        [ ps.pynvim ]
+        ++ (extraPython2Packages ps)
+        ++ (lib.concatMap (f: f ps) pluginPython2Packages));
+
+      pluginPython3Packages = getDeps "python3Dependencies" requiredPlugins;
+      python3Env = python3Packages.python.withPackages (ps:
+        [ ps.pynvim ]
+        ++ (extraPython3Packages ps)
+        ++ (lib.concatMap (f: f ps) pluginPython3Packages));
+
+
+      # Mapping a boolean argument to a key that tells us whether to add or not to
+      # add to nvim's 'embedded rc' this:
+      #    let g:<key>_host_prog=$out/bin/nvim-<key>
+      # Or this:
+      #    let g:loaded_${prog}_provider=1
+      # While the latter tells nvim that this provider is not available
+      hostprog_check_table = {
+        node = withNodeJs;
+        python = withPython2;
+        python3 = withPython3;
+        ruby = withRuby;
+      };
+      ## Here we calculate all of the arguments to the 1st call of `makeWrapper`
+      # We start with the executable itself NOTE we call this variable "initial"
+      # because if configure != {} we need to call makeWrapper twice, in order to
+      # avoid double wrapping, see comment near finalMakeWrapperArgs
+      makeWrapperArgs =
+        let
+          binPath = lib.makeBinPath (lib.optionals withRuby [ rubyEnv ] ++ lib.optionals withNodeJs [ nodejs ]);
+
+          flags = lib.concatLists (lib.mapAttrsToList (
+              prog: withProg: [
+                "--cmd" (genProviderSettings prog withProg)
+              ]
+            )
+            hostprog_check_table);
+        in
+        [
+          "--argv0" "$0" "--add-flags" (lib.escapeShellArgs flags)
+        ] ++ lib.optionals withRuby [
+          "--set" "GEM_HOME" "${rubyEnv}/${rubyEnv.ruby.gemPath}"
+        ] ++ lib.optionals (binPath != "") [
+          "--suffix" "PATH" ":" binPath
+        ];
+
+      manifestRc = vimUtils.vimrcContent (configure // { customRC = ""; });
+      neovimRcContent = vimUtils.vimrcContent configure;
+    in
+    {
+      wrapperArgs = makeWrapperArgs;
+      inherit neovimRcContent;
+      inherit manifestRc;
+      inherit rubyEnv;
+      inherit python2Env;
+      inherit python3Env;
+    };
+
+    genProviderSettings = prog: withProg:
+      if withProg then
+        "let g:${prog}_host_prog='${placeholder "out"}/bin/nvim-${prog}'"
+      else
+        "let g:loaded_${prog}_provider=1"
+    ;
+
+  # to keep backwards compatibility
+  legacyWrapper = neovim: {
+    extraMakeWrapperArgs ? ""
+    , withPython ? true
+    /* the function you would have passed to python.withPackages */
+    , extraPythonPackages ? (_: [])
+    /* the function you would have passed to python.withPackages */
+    , withPython3 ? true,  extraPython3Packages ? (_: [])
+    , withNodeJs ? false
+    , withRuby ? true
+    , vimAlias ? false
+    , viAlias ? false
+    , configure ? {}
+  }:
+    let
+      /* for compatibility with passing extraPythonPackages as a list; added 2018-07-11 */
+      compatFun = funOrList: (if builtins.isList funOrList then
+        (_: lib.warn "passing a list as extraPythonPackages to the neovim wrapper is deprecated, pass a function as to python.withPackages instead" funOrList)
+      else funOrList);
+
+      res = makeNeovimConfig {
+        withPython2 = withPython;
+        extraPythonPackages = compatFun extraPythonPackages;
+        inherit withPython3;
+        extraPython3Packages = compatFun extraPython3Packages;
+        inherit withNodeJs withRuby;
+
+        inherit configure;
+      };
+    in
+    wrapNeovimUnstable neovim (res // {
+      wrapperArgs = lib.escapeShellArgs (
+        res.wrapperArgs ++ [ "--add-flags" "-u ${writeText "init.vim" res.neovimRcContent}" ])
+        + " " + extraMakeWrapperArgs
+      ;
+  });
+in
+{
+  inherit makeNeovimConfig;
+  inherit legacyWrapper;
+}
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@ -13,124 +13,41 @@ neovim:

 let
  wrapper = {
-      extraMakeWrapperArgs ? ""
-    , withPython ? true,  extraPythonPackages ? (_: []) /* the function you would have passed to python.withPackages */
-    , withPython3 ? true,  extraPython3Packages ? (_: []) /* the function you would have passed to python.withPackages */
+      # should contain all args but the binary
+      wrapperArgs ? ""
+    , manifestRc ? null
+    , withPython2 ? true, python2Env ? null
+    , withPython3 ? true,  python3Env ? null
    , withNodeJs? false
-    , withRuby ? true
+    , withRuby ? true, rubyEnv ? null
    , vimAlias ? false
    , viAlias ? false
-    , configure ? {}
+    , ...
  }:
  let

-  rubyEnv = bundlerEnv {
-    name = "neovim-ruby-env";
-    gemdir = ./ruby_provider;
-    postBuild = ''
-      ln -sf ${ruby}/bin/* $out/bin
-    '';
-  };
-
-  /* for compatibility with passing extraPythonPackages as a list; added 2018-07-11 */
-  compatFun = funOrList: (if builtins.isList funOrList then
-    (_: lib.warn "passing a list as extraPythonPackages to the neovim wrapper is deprecated, pass a function as to python.withPackages instead" funOrList)
-    else funOrList);
-  extraPythonPackagesFun = compatFun extraPythonPackages;
-  extraPython3PackagesFun = compatFun extraPython3Packages;
-
-  requiredPlugins = vimUtils.requiredPlugins configure;
-  getDeps = attrname: map (plugin: plugin.${attrname} or (_:[]));
-
-  pluginPythonPackages = getDeps "pythonDependencies" requiredPlugins;
-  pythonEnv = pythonPackages.python.withPackages(ps:
-        [ ps.pynvim ]
-        ++ (extraPythonPackagesFun ps)
-        ++ (concatMap (f: f ps) pluginPythonPackages));
-
-  pluginPython3Packages = getDeps "python3Dependencies" requiredPlugins;
-  python3Env = python3Packages.python.withPackages (ps:
-        [ ps.pynvim ]
-        ++ (extraPython3PackagesFun ps)
-        ++ (concatMap (f: f ps) pluginPython3Packages));
-
-  binPath = makeBinPath (optionals withRuby [rubyEnv] ++ optionals withNodeJs [nodejs]);
-
-  # Mapping a boolean argument to a key that tells us whether to add or not to
-  # add to nvim's 'embedded rc' this:
-  #
-  #    let g:<key>_host_prog=$out/bin/nvim-<key>
-  #
-  # Or this:
-  #
-  #    let g:loaded_${prog}_provider=1
-  #
-  # While the later tells nvim that this provider is not available
-  #
-  hostprog_check_table = {
-    node = withNodeJs;
-    python = withPython;
-    python3 = withPython3;
-    ruby = withRuby;
-  };
-  ## Here we calculate all of the arguments to the 1st call of `makeWrapper`
-  # We start with the executable itself NOTE we call this variable "initial"
-  # because if configure != {} we need to call makeWrapper twice, in order to
-  # avoid double wrapping, see comment near finalMakeWrapperArgs
-  initialMakeWrapperArgs =
-    let
-      flags = lib.concatLists (lib.mapAttrsToList (
-        prog:
-        withProg:
-        [
-          "--cmd"
-          (if withProg then
-            "let g:${prog}_host_prog='${placeholder "out"}/bin/nvim-${prog}'"
-          else
-            "let g:loaded_${prog}_provider=1"
-            )
-        ]
-      ) hostprog_check_table);
-    in [
-      "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim"
-      "--argv0" "$0"
-      "--add-flags" (lib.escapeShellArgs flags)
-    ] ++ lib.optionals withRuby [
-      "--set" "GEM_HOME" "${rubyEnv}/${rubyEnv.ruby.gemPath}"
-    ] ++ lib.optionals (binPath != "") [
-      "--suffix" "PATH" ":" binPath
-    ];
  # If configure != {}, we can't generate the rplugin.vim file with e.g
  # NVIM_SYSTEM_RPLUGIN_MANIFEST *and* NVIM_RPLUGIN_MANIFEST env vars set in
  # the wrapper. That's why only when configure != {} (tested both here and
  # when postBuild is evaluated), we call makeWrapper once to generate a
  # wrapper with most arguments we need, excluding those that cause problems to
  # generate rplugin.vim, but still required for the final wrapper.
-  finalMakeWrapperArgs = initialMakeWrapperArgs
-    # this relies on a patched neovim, see
-    # https://github.com/neovim/neovim/issues/9413
-    ++ lib.optionals (configure != {}) [
-      "--set" "NVIM_SYSTEM_RPLUGIN_MANIFEST" "${placeholder "out"}/rplugin.vim"
-      "--add-flags" "-u ${configFile}"
-    ];
-   configFile = writeText "init.vim" "${vimUtils.vimrcContent configure}";
+  finalMakeWrapperArgs =
+    [ "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim" ] ++
+      [ "--set" "NVIM_SYSTEM_RPLUGIN_MANIFEST" "${placeholder "out"}/rplugin.vim" ];
  in
  symlinkJoin {
      name = "neovim-${stdenv.lib.getVersion neovim}";
      # Remove the symlinks created by symlinkJoin which we need to perform
      # extra actions upon
-      postBuild = ''
-        rm $out/bin/nvim
-        makeWrapper ${lib.escapeShellArgs initialMakeWrapperArgs} ${extraMakeWrapperArgs}
-      ''
-      + lib.optionalString stdenv.isLinux ''
+      postBuild = lib.optionalString stdenv.isLinux ''
        rm $out/share/applications/nvim.desktop
        substitute ${neovim}/share/applications/nvim.desktop $out/share/applications/nvim.desktop \
          --replace 'TryExec=nvim' "TryExec=$out/bin/nvim" \
          --replace 'Name=Neovim' 'Name=WrappedNeovim'
      ''
-      + optionalString withPython ''
-        makeWrapper ${pythonEnv}/bin/python $out/bin/nvim-python --unset PYTHONPATH
+      + optionalString withPython2 ''
+        makeWrapper ${python2Env}/bin/python $out/bin/nvim-python --unset PYTHONPATH
      ''
      + optionalString withPython3 ''
        makeWrapper ${python3Env}/bin/python3 $out/bin/nvim-python3 --unset PYTHONPATH
@ -147,9 +64,14 @@ let
      + optionalString viAlias ''
        ln -s $out/bin/nvim $out/bin/vi
      ''
-      + optionalString (configure != {}) ''
+      + optionalString (manifestRc != null) (let
+        manifestWrapperArgs =
+          [ "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim-wrapper" ];
+      in ''
        echo "Generating remote plugin manifest"
        export NVIM_RPLUGIN_MANIFEST=$out/rplugin.vim
+        makeWrapper ${lib.escapeShellArgs manifestWrapperArgs} ${wrapperArgs}
+
        # Some plugins assume that the home directory is accessible for
        # initializing caches, temporary files, etc. Even if the plugin isn't
        # actively used, it may throw an error as soon as Neovim is launched
@ -165,8 +87,8 @@ let
        # (swap/viminfo) and redirect errors to stderr.
        # Only display the log on error since it will contain a few normally
        # irrelevant messages.
-        if ! $out/bin/nvim \
-          -u ${vimUtils.vimrcFile (configure // { customRC = ""; })} \
+        if ! $out/bin/nvim-wrapper \
+          -u ${writeText "manifest.vim" manifestRc} \
          -i NONE -n \
          -E -V1rplugins.log -s \
          +UpdateRemotePlugins +quit! > outfile 2>&1; then
@ -174,7 +96,11 @@ let
          echo -e "\nGenerating rplugin.vim failed!"
          exit 1
        fi
-        makeWrapper ${lib.escapeShellArgs finalMakeWrapperArgs} ${extraMakeWrapperArgs}
+        rm "${placeholder "out"}/bin/nvim-wrapper"
+      '')
+      + ''
+        rm $out/bin/nvim
+        makeWrapper ${lib.escapeShellArgs finalMakeWrapperArgs} ${wrapperArgs}
      '';

    paths = [ neovim ];
@ -182,7 +108,7 @@ let
    preferLocalBuild = true;

    buildInputs = [makeWrapper];
-    passthru = { unwrapped = neovim; inherit configFile; };
+    passthru = { unwrapped = neovim; };

    meta = neovim.meta // {
      # To prevent builds on hydra
--- a/pkgs/applications/editors/textadept/default.nix
+++ b/pkgs/applications/editors/textadept/default.nix
@ -1,6 +1,7 @@
 { lib, stdenv, fetchhg, fetchurl, gtk2, glib, pkgconfig, unzip, ncurses, zip }:
+
 stdenv.mkDerivation rec {
-  version = "10.2";
+  version = "10.8";
  pname = "textadept";

  nativeBuildInputs = [ pkgconfig ];
@ -11,7 +12,7 @@ stdenv.mkDerivation rec {
  src = fetchhg {
    url = "http://foicica.com/hg/textadept";
    rev = "textadept_${version}";
-    sha256 = "0fai8xqddkkprmbf0cf8wwgv7ccfdb1iyim30nppm2m16whkc8fl";
+    sha256 = "sha256-dEZSx2tuHTWYhk9q5iGlrWTAvDvKaM8HaHwXcFcv33s=";
  };

  preConfigure =
@ -19,10 +20,6 @@ stdenv.mkDerivation rec {
      "ln -s ${fetchurl params} $PWD/src/${name}"
    ) (import ./deps.nix)) + ''

-    # work around trying to download stuff in `make deps`
-    function wget() { true; }
-    export -f wget
-
    cd src
    make deps
  '';
@ -31,12 +28,17 @@ stdenv.mkDerivation rec {
    make curses
  '';

+  preInstall = ''
+    mkdir -p $out/share/applications
+    mkdir -p $out/share/pixmaps
+  '';
+
  postInstall = ''
    make curses install PREFIX=$out MAKECMDGOALS=curses
  '';

  makeFlags = [
-    "PREFIX=$(out)"
+    "PREFIX=$(out) WGET=true PIXMAPS_DIR=$(out)/share/pixmaps"
  ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/editors/textadept/deps.nix
+++ b/pkgs/applications/editors/textadept/deps.nix
@ -1,23 +1,23 @@
 {
-    "542782a4df7d.zip" = {
-      url = "http://foicica.com/hg/scintilla/archive/542782a4df7d.zip";
-      sha256 = "1qwxxcj86z9y7ij05j60lcp1awy2c9ck0vnn9z6c732sqjza0zx5";
+    "99fa62b828ee.zip" = {
+      url = "http://foicica.com/hg/scintilla/archive/99fa62b828ee.zip";
+      sha256 = "sha256-QO4iGhx72CfB1/0Pp/Qab92qm98VZn/EkrHZGndoHVc=";
    };
    "lua-5.3.5.tar.gz" = {
      url = "http://www.lua.org/ftp/lua-5.3.5.tar.gz";
      sha256 = "1b2qn2rv96nmbm6zab4l877bd4zq7wpwm8drwjiy2ih4jqzysbhc";
    };
-    "lpeg-1.0.0.tar.gz" = {
-      url = "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.0.tar.gz";
-      sha256 = "13mz18s359wlkwm9d9iqlyyrrwjc6iqfpa99ai0icam2b3khl68h";
+    "lpeg-1.0.2.tar.gz" = {
+      url = "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz";
+      sha256 = "sha256-SNZldgUbbHg4j6rQm3BJMJMmRYj80PJY3aqxzdShX/4=";
    };
-    "v_1_6_3.zip" = {
-      url = "https://github.com/keplerproject/luafilesystem/archive/v_1_6_3.zip";
-      sha256 = "044s125im2irb4i42nnc5shvjj25fp4vsdbzd6b0va5igj0f6h4y";
+    "v1_7_0_2.zip" = {
+      url = "https://github.com/keplerproject/luafilesystem/archive/v1_7_0_2.zip";
+      sha256 = "sha256-kXSriR8dOStCpYeyr7c3+VZez4qGDS5aK/9FeFj1hHg=";
    };
-    "6435a42450c7.zip" = {
-      url = "http://foicica.com/hg/gtdialog/archive/6435a42450c7.zip";
-      sha256 = "1vxn89sif3qccksb6x5iprysqhjg69g7nyxlgrg31q397dmsg1ym";
+    "db67f8a489e8.zip" = {
+      url = "http://foicica.com/hg/gtdialog/archive/db67f8a489e8.zip";
+      sha256 = "sha256-UIvjbDrg3jyz7t2tm4y1zzH/TG6Kqaz3LE5y2U6OHuM=";
    };
    "cdk-5.0-20150928.tgz" = {
      url = "http://invisible-mirror.net/archives/cdk/cdk-5.0-20150928.tgz";
--- a/pkgs/applications/editors/uemacs/default.nix
+++ b/pkgs/applications/editors/uemacs/default.nix
@ -1,38 +0,0 @@
-{ stdenv, fetchgit, ncurses }:
-
-stdenv.mkDerivation {
-  pname = "uemacs";
-  version = "2014-12-08";
-
-  src = fetchgit {
-    url = "git://git.kernel.org/pub/scm/editors/uemacs/uemacs.git";
-    rev = "8841922689769960fa074fbb053cb8507f2f3ed9";
-    sha256 = "14yq7kpkax111cg6k7i3mnqk7sq7a65krq6qizzj7vvnm7bsj3sd";
-  };
-
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace "-lcurses" "-lncurses" \
-      --replace "CFLAGS=-O2" "CFLAGS+=" \
-      --replace "BINDIR=/usr/bin" "BINDIR=$out/bin" \
-      --replace "LIBDIR=/usr/lib" "LIBDIR=$out/share/uemacs"
-    substituteInPlace epath.h \
-      --replace "/usr/global/lib/" "$out/share/uemacs/" \
-      --replace "/usr/local/bin/" "$out/bin/" \
-      --replace "/usr/local/lib/" "$out/share/uemacs/" \
-      --replace "/usr/local/" "$out/bin/" \
-      --replace "/usr/lib/" "$out/share/uemacs/"
-    mkdir -p $out/bin $out/share/uemacs
-  '';
-
-  buildInputs = [ ncurses ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://git.kernel.org/cgit/editors/uemacs/uemacs.git";
-    description = "Torvalds Micro-emacs fork";
-    longDescription = ''
-      uEmacs/PK 4.0 is a full screen editor based on MicroEMACS 3.9e
-    '';
-    license = licenses.unfree;
-  };
-}
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@ -107,6 +107,7 @@ let
      kcharselect = callPackage ./kcharselect.nix {};
      kcolorchooser = callPackage ./kcolorchooser.nix {};
      kdebugsettings = callPackage ./kdebugsettings.nix {};
+      kdeconnect-kde = callPackage ./kdeconnect-kde.nix {};
      kdegraphics-mobipocket = callPackage ./kdegraphics-mobipocket.nix {};
      kdegraphics-thumbnailers = callPackage ./kdegraphics-thumbnailers.nix {};
      kdenetwork-filesharing = callPackage ./kdenetwork-filesharing.nix {};
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=(http://download.kde.org/stable/release-service/20.08.1/src)
+WGET_ARGS=(http://download.kde.org/stable/release-service/20.08.2/src)
--- a/pkgs/applications/misc/kdeconnect/default.nix
+++ b/pkgs/applications/misc/kdeconnect/default.nix
@ -1,39 +1,32 @@
 { mkDerivation
-, lib
-, fetchurl
-, fetchpatch
 , extra-cmake-modules
+, fetchpatch
 , kcmutils
 , kconfigwidgets
 , kdbusaddons
 , kdoctools
-, kiconthemes
 , ki18n
-, knotifications
-, qca-qt5
-, libfakekey
-, libXtst
-, qtx11extras
-, qtmultimedia
-, qtgraphicaleffects
-, sshfs
-, makeWrapper
-, kwayland
+, kiconthemes
 , kio
-, kpeoplevcard
-, kpeople
 , kirigami2
+, knotifications
+, kpeople
+, kpeoplevcard
+, kwayland
+, lib
+, libXtst
+, libfakekey
+, makeWrapper
 , pulseaudio-qt
+, qca-qt5
+, qtgraphicaleffects
+, qtmultimedia
+, qtx11extras
+, sshfs
 }:

-mkDerivation rec {
-  pname = "kdeconnect";
-  version = "20.08.2";
-
-  src = fetchurl {
-    url = "https://download.kde.org/stable/release-service/${version}/src/${pname}-kde-${version}.tar.xz";
-    sha256 = "0rzfnkgkv759d4pa16qk0sw87wqzwgkd99yzrzfy2zcq423f6hvd";
-  };
+mkDerivation {
+  name = "kdeconnect-kde";

  patches = [
    # https://invent.kde.org/network/kdeconnect-kde/-/merge_requests/328
@ -44,39 +37,36 @@ mkDerivation rec {
  ];

  buildInputs = [
-    libfakekey
-    libXtst
-    qtmultimedia
-    qtgraphicaleffects
-    pulseaudio-qt
-    kpeoplevcard
-    kpeople
-    kirigami2
-    ki18n
-    kiconthemes
    kcmutils
    kconfigwidgets
    kdbusaddons
-    knotifications
-    qca-qt5
-    qtx11extras
-    makeWrapper
-    kwayland
+    ki18n
+    kiconthemes
    kio
+    kirigami2
+    knotifications
+    kpeople
+    kpeoplevcard
+    kwayland
+    libXtst
+    libfakekey
+    pulseaudio-qt
+    qca-qt5
+    qtgraphicaleffects
+    qtmultimedia
+    qtx11extras
  ];

-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools makeWrapper ];

-  postInstall = ''
-    wrapProgram $out/libexec/kdeconnectd --prefix PATH : ${lib.makeBinPath [ sshfs ]}
-  '';
-
-  enableParallelBuilding = true;
+  qtWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [ sshfs ]}"
+  ];

  meta = with lib; {
    description = "KDE Connect provides several features to integrate your phone and your computer";
-    homepage    = "https://community.kde.org/KDEConnect";
-    license     = with licenses; [ gpl2 ];
+    homepage = "https://community.kde.org/KDEConnect";
+    license = with licenses; [ gpl2 ];
    maintainers = with maintainers; [ fridh ];
  };
 }
--- a/pkgs/applications/kde/okular.nix
+++ b/pkgs/applications/kde/okular.nix
@ -4,7 +4,7 @@
  breeze-icons, chmlib ? null, discount, djvulibre, ebook_tools, kactivities,
  karchive, kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons,
  kdbusaddons, kdegraphics-mobipocket, kiconthemes, kjs, khtml, kio, kparts,
-  kpty, kwallet, kwindowsystem, libkexiv2, libspectre, libzip, phonon, poppler,
+  kpty, kpurpose, kwallet, kwindowsystem, libkexiv2, libspectre, libzip, phonon, poppler,
  qca-qt5, qtdeclarative, qtsvg, threadweaver, kcrash
 }:

@ -14,7 +14,7 @@ mkDerivation {
  buildInputs = [
    breeze-icons discount djvulibre ebook_tools kactivities karchive kbookmarks
    kcompletion kconfig kconfigwidgets kcoreaddons kdbusaddons
-    kdegraphics-mobipocket kiconthemes kjs khtml kio kparts kpty kwallet
+    kdegraphics-mobipocket kiconthemes kjs khtml kio kparts kpty kpurpose kwallet
    kwindowsystem libkexiv2 libspectre libzip phonon poppler qca-qt5
    qtdeclarative qtsvg threadweaver kcrash
  ] ++ lib.optional (!stdenv.isAarch64) chmlib;
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/archiver/default.nix
+++ b/pkgs/applications/misc/archiver/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "archiver";
-  version = "3.3.2";
+  version = "3.4.0";

  src = fetchFromGitHub {
    owner = "mholt";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1fi86g27c660g3mv9c5rfm0mmvh5q08704c19xnvrpwlg65glqrz";
+    sha256 = "16jawybywqfkp68035bnf206a2w4khjw239saa429a21lxrfyk4a";
  };

-  vendorSha256 = "1rqhra3rfarq8f750zszkrm0jcsxa4sjbfpmcdlj5z000df699zq";
+  vendorSha256 = "0m89ibj3dm58j49d99dhkn0ryivnianxz7lkpkvhs0cdbzzc02az";

  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version} -X main.commit=${src.rev} -X main.date=unknown" ];

--- a/pkgs/applications/misc/batsignal/default.nix
+++ b/pkgs/applications/misc/batsignal/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "batsignal";
-  version = "1.1.2";
+  version = "1.1.3";

  src = fetchFromGitHub {
    owner = "electrickite";
    repo = "batsignal";
    rev = "${version}";
-    sha256 = "0ss5dw7wpqsf96dig6r7x4fhf6brmjdy54jyyf5nk1h9kzw4d69r";
+    sha256 = "12hj0j18db34x0xzgj6xmhvxm966d05z0rl3d9rlrcd2q96lilwf";
  };

  buildInputs = [ libnotify glib ];
--- a/pkgs/applications/misc/clipcat/default.nix
+++ b/pkgs/applications/misc/clipcat/default.nix
@ -0,0 +1,64 @@
+{ lib, fetchFromGitHub, installShellFiles, rustPlatform, rustfmt, xorg
+, pkgconfig, llvmPackages, clang, protobuf, python3 }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "clipcat";
+  version = "0.4.19";
+
+  src = fetchFromGitHub {
+    owner = "xrelkd";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1lhnm521qqy3aw2iyk1dv4yc5ms0c5x5iipx96bz6v6y0cnmf4kw";
+  };
+
+  cargoSha256 = "04iflyvz8g53z658rkxafiyi2m9kzxwl3p1xgkjq7vacmz5jk15c";
+
+  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+
+  # needed for internal protobuf c wrapper library
+  PROTOC = "${protobuf}/bin/protoc";
+  PROTOC_INCLUDE = "${protobuf}/include";
+
+  nativeBuildInputs = [
+    pkgconfig
+
+    clang
+    llvmPackages.libclang
+
+    rustfmt
+    protobuf
+
+    python3
+
+    installShellFiles
+  ];
+  buildInputs = [ xorg.libxcb ];
+
+  cargoBuildFlags = [ "--features=all" ];
+
+  postInstall = ''
+    installShellCompletion --bash --name clipcatd             completions/bash-completion/completions/clipcatd
+    installShellCompletion --fish --name clipcatd.fish        completions/fish/completions/clipcatd.fish
+    installShellCompletion --zsh  --name _clipcatd            completions/zsh/site-functions/_clipcatd
+
+    installShellCompletion --bash --name clipcatctl           completions/bash-completion/completions/clipcatctl
+    installShellCompletion --fish --name clipcatctl.fish      completions/fish/completions/clipcatctl.fish
+    installShellCompletion --zsh  --name _clipcatctl          completions/zsh/site-functions/_clipcatctl
+
+    installShellCompletion --bash --name clipcat-menu         completions/bash-completion/completions/clipcat-menu
+    installShellCompletion --fish --name clipcat-menu.fish    completions/fish/completions/clipcat-menu.fish
+    installShellCompletion --zsh  --name _clipcat-menu        completions/zsh/site-functions/_clipcat-menu
+
+    installShellCompletion --bash --name clipcat-notify       completions/bash-completion/completions/clipcat-notify
+    installShellCompletion --fish --name clipcat-notify.fish  completions/fish/completions/clipcat-notify.fish
+    installShellCompletion --zsh  --name _clipcat-notify      completions/zsh/site-functions/_clipcat-notify
+  '';
+
+  meta = with lib; {
+    description = "Clipboard Manager written in Rust Programming Language";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ xrelkd ];
+  };
+}
--- a/pkgs/applications/misc/dstask/default.nix
+++ b/pkgs/applications/misc/dstask/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "dstask";
-  version = "0.22";
+  version = "0.23";

  src = fetchFromGitHub {
    owner = "naggie";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0vwkar827ncwmva091q37gq8fvs9jz1765zdxrcvhczlj5a0qdgi";
+    sha256 = "15hr0ivwvm2lzpi8l5y5a3hya3i7r85pxna961m24gd4f8gs4cjl";
  };

  # Set vendorSha256 to null because dstask vendors its dependencies (meaning
--- a/pkgs/applications/misc/electrum/ltc.nix
+++ b/pkgs/applications/misc/electrum/ltc.nix
@ -27,6 +27,8 @@ python3Packages.buildPythonApplication rec {
    dnspython
    jsonrpclib-pelix
    pysocks
+    trezor
+    btchip
  ];

  preBuild = ''
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "gallery_dl";
-  version = "1.15.1";
+  version = "1.15.2";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "1pysh0gz3f3dxk5bfkzaii4myrgik396mf6vlks50inpbnslmqsl";
+    sha256 = "0f2d1ixg0ir7ispxxggv378dc0m55k9y19075swf893maxf07f35";
  };

  propagatedBuildInputs = with python3Packages; [ requests ];
@ -15,6 +15,7 @@ python3Packages.buildPythonApplication rec {
  pytestFlagsArray = [
    # requires network access
    "--ignore=test/test_results.py"
+    "--ignore=test/test_downloader.py"
  ];

  meta = {
--- a/pkgs/applications/misc/geoipupdate/default.nix
+++ b/pkgs/applications/misc/geoipupdate/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "geoipupdate";
-  version = "4.3.0";
+  version = "4.5.0";

  src = fetchFromGitHub {
    owner = "maxmind";
    repo = "geoipupdate";
    rev = "v${version}";
-    sha256 = "08h14bf4z2gx9sy34jpi2pvxv3i8g9ypl222hzdjsp2ixhl0jia9";
+    sha256 = "0lhz7i4lprsik3s41y19vphsyc29vz6cbxikmvkmy6xjn40khjfr";
  };

-  vendorSha256 = "0q4byhvs1c1xm4qjvs2vyf98vdv121qn0z51arcf7k4ayrys5xcx";
+  vendorSha256 = "1f858k8cl0dgiw124jv0p9jhi9aqxnc3nmc7hksw70fla2nzjrv0";

  doCheck = false;

--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.76.5";
+  version = "0.77.0";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0p7zz9cif1vihhs21nvh4n3y1p2cwpga59rilpam7yvza4nzx7ay";
+    sha256 = "1vjqddcbk8afqkjzrj9wwvz697bxhv9vz0rk2vj2ji6lz1slhc56";
  };

-  vendorSha256 = "0kiqy8n2df52gsgsbmr96rph8lpnw06g622123hlwk7kqg0z9ifh";
+  vendorSha256 = "03xv188jw5scqd6a8xd2s13vkn721d37bgs6a6rik7pgqmjh46c6";

  doCheck = false;

--- a/pkgs/applications/misc/jotta-cli/default.nix
+++ b/pkgs/applications/misc/jotta-cli/default.nix
@ -5,10 +5,10 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "jotta-cli";
-  version = "0.6.24251";
+  version = "0.7.33634";
  src = fetchzip {
      url = "https://repo.jotta.us/archives/linux/${arch}/jotta-cli-${version}_linux_${arch}.tar.gz";
-      sha256 = "0f26fg5fqpz0f6jxp72cj5f2kf76jah5iaqlqsl87250y0hm330g";
+      sha256 = "0apbdk4fvmn52w9qyh6hvpk3k0sa810jvvndpsbysnlmi7gv5w62";
      stripRoot = false;
    };

--- a/pkgs/applications/misc/peaclock/default.nix
+++ b/pkgs/applications/misc/peaclock/default.nix
@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, cmake, libpthreadstubs, icu }:
+
+stdenv.mkDerivation rec {
+  pname = "peaclock";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "octobanana";
+    repo = pname;
+    rev = version;
+    sha256 = "1582vgslhpgbvcd7ipgf1d1razrvgpq1f93q069yr2bbk6xn8i16";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ libpthreadstubs icu ];
+
+  meta = with stdenv.lib; {
+    description = "A clock, timer, and stopwatch for the terminal";
+    homepage = "https://octobanana.com/software/peaclock";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ djanatyn ];
+  };
+}
--- a/pkgs/applications/misc/prusa-slicer/super-slicer.nix
+++ b/pkgs/applications/misc/prusa-slicer/super-slicer.nix
@ -3,7 +3,7 @@
 }:
 let
  appname = "SuperSlicer";
-  version = "2.2.54.1";
+  version = "2.2.54.2";
  pname = "super-slicer";
  description = "PrusaSlicer fork with more features and faster development cycle";
  override = super: {
@ -12,7 +12,7 @@ let
    src = fetchFromGitHub {
      owner = "supermerill";
      repo = "SuperSlicer";
-      sha256 = "sha256-0NWrck9nqAlc8xX3nTrRlnzjso4MRRjJSW7bUvCX6Y4=";
+      sha256 = "sha256-ThmsxFXI1uReK+JwpHrIWzHpBdIOP77kDjv+QaK+Azk=";
      rev = version;
    };

--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@ -20,14 +20,14 @@
 }:

 mkDerivation rec {
-  version = "0.11.0";
+  version = "1.0.0";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${version}";
-    sha256 = "1lpjrij6y8l738hd7bfig0piglqinnqbadidzw9k0nm53bh4pqrr";
+    sha256 = "sha256-mB23UOUrOfEmbFfVsAXyi3iod0NAfp/sl7Gkklqfmbo=";
  };

  buildInputs = [ qtbase cpp-utilities qtutilities ]
--- a/pkgs/applications/misc/teleprompter/default.nix
+++ b/pkgs/applications/misc/teleprompter/default.nix
@ -1,15 +1,15 @@
-{ lib, stdenv, fetchurl, electron_4, makeDesktopItem, makeWrapper, nodePackages, autoPatchelfHook}:
+{ lib, stdenv, fetchurl, electron_10, makeDesktopItem, makeWrapper, nodePackages, autoPatchelfHook}:

 let
-  electron = electron_4;
+  electron = electron_10;
 in
 stdenv.mkDerivation rec {
  pname = "teleprompter";
-  version = "2.3.4";
+  version = "2.4.0";

  src = fetchurl {
-    url = "mirror://sourceforge/teleprompter-imaginary-films/imaginary-${pname}-${version}-64bit.tar.gz";
-    sha256 = "084ml2l3qg46bsazaapyxdx4zavvxp0j4ycsdpdwk3f94g9xb120";
+    url = "https://github.com/ImaginarySense/Imaginary-Teleprompter-Electron/releases/download/${lib.versions.majorMinor version}/imaginary-teleprompter-${version}.tar.gz";
+    sha256 = "bgdtK8l5d26avv1WUw9cfOgZrIL1q/a9890Ams4yidQ=";
  };

  dontBuild = true;
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "The most complete, free, teleprompter app on the web";
-    license = [ licenses.gpl3 ];
+    license = [ licenses.gpl3Plus ];
    homepage = "https://github.com/ImaginarySense/Teleprompter-Core";
    platforms = platforms.linux;
    maintainers = with maintainers; [ Scriptkiddi ];
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@ -14,7 +14,6 @@
 , proprietaryCodecs ? true
 , enablePepperFlash ? false
 , enableWideVine ? false
-, useVaapi ? false # Deprecated, use enableVaapi instead!
 , enableVaapi ? false # Disabled by default due to unofficial support
 , useOzone ? false
 , cupsSupport ? true
@ -148,13 +147,6 @@ let
      ''
    else browser;

-  optionalVaapiFlags = if useVaapi # TODO: Remove after 20.09:
-    then throw ''
-      Chromium's useVaapi was replaced by enableVaapi and you don't need to pass
-      "--ignore-gpu-blacklist" anymore (also no rebuilds are required anymore).
-    '' else lib.optionalString
-      (enableVaapi)
-      "--add-flags --enable-accelerated-video-decode";
 in stdenv.mkDerivation {
  name = "chromium${suffix}-${version}";
  inherit version;
@ -181,7 +173,7 @@ in stdenv.mkDerivation {

    eval makeWrapper "${browserBinary}" "$out/bin/chromium" \
      --add-flags ${escapeShellArg (escapeShellArg commandLineArgs)} \
-      ${optionalVaapiFlags} \
+      ${lib.optionalString enableVaapi "--add-flags --enable-accelerated-video-decode"} \
      ${concatMapStringsSep " " getWrapperFlags chromium.plugins.enabled}

    ed -v -s "$out/bin/chromium" << EOF
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -333,6 +333,7 @@ buildStdenv.mkDerivation ({
    version = ffversion;
    isFirefox3Like = true;
    gtk = gtk2;
+    inherit alsaSupport;
    inherit nspr;
    inherit ffmpegSupport;
    inherit gssSupport;
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -2,7 +2,7 @@

 ## various stuff that can be plugged in
 , flashplayer, hal-flash
-, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2, libglvnd
+, ffmpeg, xorg, alsaLib, libpulseaudio, libcanberra-gtk2, libglvnd
 , gnome3/*.gnome-shell*/
 , browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow
 , tridactyl-native
@ -39,6 +39,7 @@ let
      enableAdobeFlash = cfg.enableAdobeFlash or false;
      ffmpegSupport = browser.ffmpegSupport or false;
      gssSupport = browser.gssSupport or false;
+      alsaSupport = browser.alsaSupport or false;

      plugins =
        let
@ -76,6 +77,7 @@ let
            (with xorg; [ stdenv.cc libX11 libXxf86dga libXxf86vm libXext libXt alsaLib zlib ])
            ++ lib.optional (enableAdobeFlash && (cfg.enableAdobeFlashDRM or false)) hal-flash
            ++ lib.optional (config.pulseaudio or true) libpulseaudio
+            ++ lib.optional alsaSupport alsaLib
            ++ pkcs11Modules;
      gtk_modules = [ libcanberra-gtk2 ];

--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@ -150,7 +150,10 @@ in stdenv.mkDerivation {
    description = "A freeware web browser developed by Google";
    homepage = "https://www.google.com/chrome/browser/";
    license = licenses.unfree;
-    maintainers = [ maintainers.msteen ];
+    maintainers = with maintainers; [ primeos msteen ];
+    # Note from primeos: By updating Chromium I also update Google Chrome and
+    # will try to merge PRs and respond to issues but I'm not actually using
+    # Google Chrome. msteen is the actual user/maintainer.
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cloudflared";
-  version = "2020.10.0";
+  version = "2020.10.2";

  src = fetchFromGitHub {
    owner  = "cloudflare";
    repo   = "cloudflared";
    rev    = version;
-    sha256 = "1ssmyll13pf19fxq34iw4x7ps8p4mcg9nwlx00hp5sahhwx4iz01";
+    sha256 = "0ppl74gb46r2x65hl7z1hjdqlr8la0pvhy8af8isk11sbxmprqjj";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/cluster/atlantis/default.nix
+++ b/pkgs/applications/networking/cluster/atlantis/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "atlantis";
-  version = "0.15.0";
+  version = "0.15.1";

  src = fetchFromGitHub {
    owner = "runatlantis";
    repo = "atlantis";
    rev = "v${version}";
-    sha256 = "0nb0dm4yn6f5pw7clgb2d1khcwcxiidqyc0sdh38wwqg0zyil0cz";
+    sha256 = "0xxg48f28ac7x6kap6w1hgsimdc604ivkck4dx7p5p7xd3s7gld5";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@ -9,6 +9,7 @@
 , buildGoPackage
 , git
 , runc
+, kmod
 , libseccomp
 , pkgconfig
 , ethtool
@ -226,6 +227,7 @@ stdenv.mkDerivation rec {
  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
  # Note the list in that issue is stale and some aren't relevant for k3s.
  k3sRuntimeDeps = [
+    kmod
    socat
    iptables
    iproute
--- a/pkgs/applications/networking/cluster/terraform-providers/cloudfoundry/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/cloudfoundry/default.nix
@ -0,0 +1,29 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "terraform-provider-cloudfoundry";
+  version = "0.12.6";
+
+  src = fetchFromGitHub {
+    owner = "cloudfoundry-community";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0n5ybpzk6zkrnd9vpmbjlkm8fdp7nbfr046wih0jk72pmiyrcygi";
+  };
+
+  vendorSha256 = "01lfsd9aw9w3kr1a2a5b7ac6d8jaij83lhxl4y4qsnjlqk86fbxq";
+
+  # needs a running cloudfoundry
+  doCheck = false;
+
+  postInstall = "mv $out/bin/terraform-provider-cloudfoundry{,_v${version}}";
+
+  passthru = { provider-source-address = "registry.terraform.io/cloudfoundry-community/cloudfoundry"; };
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/cloudfoundry-community/terraform-provider-cloudfoundry";
+    description = "Terraform provider for cloudfoundry";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ ris ];
+  };
+}
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -161,6 +161,7 @@ let

    # Packages that don't fit the default model
    ansible = callPackage ./ansible {};
+    cloudfoundry = callPackage ./cloudfoundry {};
    elasticsearch = callPackage ./elasticsearch {};
    gandi = callPackage ./gandi {};
    keycloak = callPackage ./keycloak {};
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -934,6 +934,14 @@
    "sha256": "1cl83afm00fflsd3skynjvncid3r74fkxfznrs1v8qypcg1j79g1",
    "version": "0.18.0"
  },
+  "time": {
+    "owner": "hashicorp",
+    "provider-source-address": "registry.terraform.io/hashicorp/time",
+    "repo": "terraform-provider-time",
+    "rev": "v0.6.0",
+    "sha256": "0fb81hisjicib9rzbn51jqfrchyjd3hzq98adnf22cbra8wlnxlm",
+    "version": "0.6.0"
+  },
  "tls": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/tls",
--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@ -39,11 +39,12 @@

 stdenv.mkDerivation rec {
  pname = "bluejeans";
-  version = "2.4.0";
+  version = "2.17.0";
+  buildNumber = "11";

  src = fetchurl {
-    url = "https://swdl.bluejeans.com/desktop-app/linux/${version}/BlueJeans.rpm";
-    sha256 = "180hc854ngwfn6y6nsrfn74rv78cxhq6sgshrca5zqv6wq3l98g0";
+    url = "https://swdl.bluejeans.com/desktop-app/linux/${version}/BlueJeans_${version}.${buildNumber}.rpm";
+    sha256 = "1h5jbnp5bwy6bpma9a1ia08v7bpz09fm66jsip470k1r7vjjwa68";
  };

  nativeBuildInputs = [ rpmextract makeWrapper ];
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
@ -2,7 +2,7 @@
  "name": "element-desktop",
  "productName": "Element",
  "main": "src/electron-main.js",
-  "version": "1.7.10",
+  "version": "1.7.12",
  "description": "A feature-rich client for Matrix.org",
  "author": "Element",
  "repository": {
@ -62,7 +62,7 @@
  },
  "build": {
    "appId": "im.riot.app",
-    "electronVersion": "10.1.1",
+    "electronVersion": "10.1.3",
    "files": [
      "package.json",
      {
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop-yarndeps.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-yarndeps.nix
@ -4394,11 +4394,11 @@
      };
    }
    {
-      name = "npm_user_validate___npm_user_validate_1.0.0.tgz";
+      name = "npm_user_validate___npm_user_validate_1.0.1.tgz";
      path = fetchurl {
-        name = "npm_user_validate___npm_user_validate_1.0.0.tgz";
-        url  = "https://registry.yarnpkg.com/npm-user-validate/-/npm-user-validate-1.0.0.tgz";
-        sha1 = "8ceca0f5cea04d4e93519ef72d0557a75122e951";
+        name = "npm_user_validate___npm_user_validate_1.0.1.tgz";
+        url  = "https://registry.yarnpkg.com/npm-user-validate/-/npm-user-validate-1.0.1.tgz";
+        sha1 = "31428fc5475fe8416023f178c0ab47935ad8c561";
      };
    }
    {
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@ -8,12 +8,12 @@

 let
  executableName = "element-desktop";
-  version = "1.7.10";
+  version = "1.7.12";
  src = fetchFromGitHub {
    owner = "vector-im";
    repo = "riot-desktop";
    rev = "v${version}";
-    sha256 = "06ygqfhbsld4s274kakb6a5nx75jki44r8lwk3n0pi5mnkn626gl";
+    sha256 = "08d9llrglap5bbicdkbdl9l71wba2kkyhdyd0a4iqdz3l2jvv698";
  };
  electron = electron_9;

--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@ -12,11 +12,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "element-web";
-  version = "1.7.10";
+  version = "1.7.12";

  src = fetchurl {
    url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1xcvydjpdp6cy5g0da5yaa49gjxsmf4hsyi2q4l3p8qvs4qajn0r";
+    sha256 = "173hdg09cw13vqh0lvz6kl0mq4i3rsacjxhspkpydh2qd1g3hjrs";
  };

  installPhase = ''
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@ -60,6 +60,9 @@ python3.pkgs.buildPythonApplication rec {
      ${python3.interpreter} setup.py test
  '';

+  # necessary for wrapGAppsHook
+  strictDeps = false;
+
  meta = {
    homepage = "http://gajim.org/";
    description = "Jabber client written in PyGTK";
--- a/pkgs/applications/networking/instant-messengers/skype-call-recorder/conference.patch
+++ b/pkgs/applications/networking/instant-messengers/skype-call-recorder/conference.patch
@ -1,148 +0,0 @@
-From abd67f1d44eef81baf2e9729f95e002c4ecc7350 Mon Sep 17 00:00:00 2001
-From: jlh <jlh@gmx.ch>
-Date: Fri, 16 Oct 2009 17:40:54 +0200
-Subject: [PATCH] Rudimentary support for recording hosted conference calls
-
---
- call.cpp |   37 +++++++++++++++++++++++++++++++++++--
- call.h   |   11 ++++++++++-
- 2 files changed, 45 insertions(+), 3 deletions(-)
-
-diff --git a/call.cpp b/call.cpp
-index c2b02f2..663c1c1 100644
--- a/call.cpp
-+++ b/call.cpp
-@@ -90,9 +90,10 @@ void AutoSync::reset() {
- 
- // Call class
- 
-Call::Call(QObject *p, Skype *sk, CallID i) :
-	QObject(p),
-+Call::Call(CallHandler *h, Skype *sk, CallID i) :
-+	QObject(h),
- 	skype(sk),
-+	handler(h),
- 	id(i),
- 	status("UNKNOWN"),
- 	writer(NULL),
-@@ -119,6 +120,13 @@ Call::Call(QObject *p, Skype *sk, CallID i) :
- 		debug(QString("Call %1: cannot get partner display name").arg(id));
- 		displayName = "Unnamed Caller";
- 	}
-+
-+	// Skype does not properly send updates when the CONF_ID property
-+	// changes.  since we need this information, check it now on all calls
-+	handler->updateConfIDs();
-+	// this call isn't yet in the list of calls, thus we need to
-+	// explicitely check its CONF_ID
-+	updateConfID();
- }
- 
- Call::~Call() {
-@@ -134,6 +142,10 @@ Call::~Call() {
- 	// QT takes care of deleting servers and sockets
- }
- 
-+void Call::updateConfID() {
-+	confID = skype->getObject(QString("CALL %1 CONF_ID").arg(id)).toLong();
-+}
-+
- bool Call::okToDelete() const {
- 	// this is used for checking whether past calls may now be deleted.
- 	// when a past call hasn't been decided yet whether it should have been
-@@ -270,6 +282,11 @@ void Call::startRecording(bool force) {
- 	if (isRecording)
- 		return;
- 
-+	if (handler->isConferenceRecording(confID)) {
-+		debug(QString("Call %1: call is part of a conference that is already being recorded").arg(id));
-+		return;
-+	}
-+
- 	if (force) {
- 		emit showLegalInformation();
- 	} else {
-@@ -589,6 +606,22 @@ CallHandler::~CallHandler() {
- 	delete legalInformationDialog;
- }
- 
-+void CallHandler::updateConfIDs() {
-+	QList<Call *> list = calls.values();
-+	for (int i = 0; i < list.size(); i++)
-+		list.at(i)->updateConfID();
-+}
-+
-+bool CallHandler::isConferenceRecording(CallID id) const {
-+	QList<Call *> list = calls.values();
-+	for (int i = 0; i < list.size(); i++) {
-+		Call *c = list.at(i);
-+		if (c->getConfID() == id && c->getIsRecording())
-+			return true;
-+	}
-+	return false;
-+}
-+
- void CallHandler::callCmd(const QStringList &args) {
- 	CallID id = args.at(0).toInt();
- 
-diff --git a/call.h b/call.h
-index cb8396d..b746f46 100644
--- a/call.h
-+++ b/call.h
-@@ -43,6 +43,8 @@ class QTcpServer;
- class QTcpSocket;
- class LegalInformationDialog;
- 
-+class CallHandler;
-+
- typedef int CallID;
- 
- class AutoSync {
-@@ -68,18 +70,21 @@ private:
- class Call : public QObject {
- 	Q_OBJECT
- public:
-	Call(QObject *, Skype *, CallID);
-+	Call(CallHandler *, Skype *, CallID);
- 	~Call();
- 	void startRecording(bool = false);
- 	void stopRecording(bool = true);
-+	void updateConfID();
- 	bool okToDelete() const;
- 	void setStatus(const QString &);
- 	QString getStatus() const { return status; }
- 	bool statusDone() const;
- 	bool statusActive() const;
- 	CallID getID() const { return id; }
-+	CallID getConfID() const { return confID; }
- 	void removeFile();
- 	void hideConfirmation(int);
-+	bool getIsRecording() const { return isRecording; }
- 
- signals:
- 	void startedCall(int, const QString &);
-@@ -99,10 +104,12 @@ private:
- 
- private:
- 	Skype *skype;
-+	CallHandler *handler;
- 	CallID id;
- 	QString status;
- 	QString skypeName;
- 	QString displayName;
-+	CallID confID;
- 	AudioFileWriter *writer;
- 	bool isRecording;
- 	int stereo;
-@@ -140,6 +147,8 @@ class CallHandler : public QObject {
- public:
- 	CallHandler(QObject *, Skype *);
- 	~CallHandler();
-+	void updateConfIDs();
-+	bool isConferenceRecording(CallID) const;
- 	void callCmd(const QStringList &);
- 
- signals:
-- 
-1.6.5.GIT
-
--- a/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
@ -1,28 +0,0 @@
-{ stdenv, fetchurl, cmake, lame, id3lib, libvorbis, qt4, libogg }:
-
-stdenv.mkDerivation {
-  name = "skype-call-recorder-0.8";
-  src = fetchurl {
-    url = "https://atdot.ch/scr/files/0.8/skype-call-recorder-0.8.tar.gz";
-    sha256 = "1iijkhq3aj9gr3bx6zl8ryvzkqcdhsm9yisimakwq0lnw0lgf5di";
-  };
-
-  # Keep an rpath reference to the used libogg
-  prePatch = ''
-    sed -i -e '/ADD_EXECUTABLE/aSET(LIBRARIES ''${LIBRARIES} ogg)' CMakeLists.txt
-  '';
-
-  # Better support for hosted conferences
-  patches = [ ./conference.patch ];
-
-  buildInputs = [ cmake lame id3lib libvorbis qt4 libogg ];
-  NIX_LDFLAGS = "-lvorbis";
-
-  meta = {
-    homepage = "http://atdot.ch/scr/";
-    description = "Open source tool to record your Skype calls on Linux";
-    license = stdenv.lib.licenses.gpl2Plus;
-    platforms = with stdenv.lib.platforms; linux;
-    maintainers = with stdenv.lib.maintainers; [viric];
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -40,8 +40,8 @@ let

  pname = "slack";
  version = {
-    x86_64-darwin = "4.9.0";
-    x86_64-linux = "4.9.1";
+    x86_64-darwin = "4.10.3";
+    x86_64-linux = "4.10.3";
  }.${system} or throwSystem;

  src = let
@ -49,11 +49,11 @@ let
  in {
    x86_64-darwin = fetchurl {
      url = "${base}/releases/macos/${version}/prod/x64/Slack-${version}-macOS.dmg";
-      sha256 = "007fflncvvclj4agb6g5hc5k9j5hhz1rpvlcfd8w31rn1vad4abk";
+      sha256 = "0r77l57vr603xamich4h4gbdd5vdcj0sjs6yjpymfx9s0f98v8bb";
    };
    x86_64-linux = fetchurl {
      url = "${base}/linux_releases/slack-desktop-${version}-amd64.deb";
-      sha256 = "1n8br5vlcnf13b8m6727hy4bkmd6wayss96ck4ba9zsjiyj7v74i";
+      sha256 = "1gnjj2iyk8cwjajg8h9qpmzx10j4qjxjzciq8csg45qfzwkr3drf";
    };
  }.${system} or throwSystem;

--- a/Show More
+++ b/Show More