Merge master into haskell-updates

2025-01-18 19:03:28 +00:00 · 2021-09-16 00:06:30 +00:00 · 2021-09-16 00:06:30 +00:00 · b7d0ebd8f8
commit b7d0ebd8f8
parent 1f06456eab 78230d1c42
749 changed files with 7248 additions and 4552 deletions
--- a/doc/builders/packages/linux.section.md
+++ b/doc/builders/packages/linux.section.md
@ -16,7 +16,7 @@ How to add a new (major) version of the Linux kernel to Nixpkgs:

 1.  Copy the old Nix expression (e.g. `linux-2.6.21.nix`) to the new one (e.g. `linux-2.6.22.nix`) and update it.

-2.  Add the new kernel to `all-packages.nix` (e.g., create an attribute `kernel_2_6_22`).
+2.  Add the new kernel to the `kernels` attribute set in `linux-kernels.nix` (e.g., create an attribute `kernel_2_6_22`).

 3.  Now we’re going to update the kernel configuration. First unpack the kernel. Then for each supported platform (`i686`, `x86_64`, `uml`) do the following:

@ -36,6 +36,6 @@ How to add a new (major) version of the Linux kernel to Nixpkgs:

    5.  Copy `.config` over the new config file (e.g. `config-2.6.22-i686-smp`).

-4.  Test building the kernel: `nix-build -A kernel_2_6_22`. If it compiles, ship it! For extra credit, try booting NixOS with it.
+4.  Test building the kernel: `nix-build -A linuxKernel.kernels.kernel_2_6_22`. If it compiles, ship it! For extra credit, try booting NixOS with it.

-5.  It may be that the new kernel requires updating the external kernel modules and kernel-dependent packages listed in the `linuxPackagesFor` function in `all-packages.nix` (such as the NVIDIA drivers, AUFS, etc.). If the updated packages aren’t backwards compatible with older kernels, you may need to keep the older versions around.
+5.  It may be that the new kernel requires updating the external kernel modules and kernel-dependent packages listed in the `linuxPackagesFor` function in `linux-kernels.nix` (such as the NVIDIA drivers, AUFS, etc.). If the updated packages aren’t backwards compatible with older kernels, you may need to keep the older versions around.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -462,6 +462,12 @@
    githubId = 2335822;
    name = "Alexandre Esteves";
  };
+  alexnortung = {
+    name = "alexnortung";
+    email = "alex_nortung@live.dk";
+    github = "alexnortung";
+    githubId = 1552267;
+  };
  alexvorobiev = {
    email = "alexander.vorobiev@gmail.com";
    github = "alexvorobiev";
--- a/nixos/doc/manual/configuration/linux-kernel.chapter.md
+++ b/nixos/doc/manual/configuration/linux-kernel.chapter.md
@ -5,13 +5,18 @@ option `boot.kernelPackages`. For instance, this selects the Linux 3.10
 kernel:

 ```nix
-boot.kernelPackages = pkgs.linuxPackages_3_10;
+boot.kernelPackages = pkgs.linuxKernel.packages.linux_3_10;
 ```

 Note that this not only replaces the kernel, but also packages that are
 specific to the kernel version, such as the NVIDIA video drivers. This
 ensures that driver packages are consistent with the kernel.

+While `pkgs.linuxKernel.packages` contains all available kernel packages,
+you may want to use one of the unversioned `pkgs.linuxPackages_*` aliases
+such as `pkgs.linuxPackages_latest`, that are kept up to date with new
+versions.
+
 The default Linux kernel configuration should be fine for most users.
 You can see the configuration of your current kernel with the following
 command:
@ -25,14 +30,13 @@ If you want to change the kernel configuration, you can use the
 instance, to enable support for the kernel debugger KGDB:

 ```nix
-nixpkgs.config.packageOverrides = pkgs:
-  { linux_3_4 = pkgs.linux_3_4.override {
-      extraConfig =
-        ''
-          KGDB y
-        '';
-    };
+nixpkgs.config.packageOverrides = pkgs: pkgs.lib.recursiveUpdate pkgs {
+  linuxKernel.kernels.linux_5_10 = pkgs.linuxKernel.kernels.linux_5_10.override {
+    extraConfig = ''
+      KGDB y
+    '';
  };
+};
 ```

 `extraConfig` takes a list of Linux kernel configuration options, one
@ -72,16 +76,17 @@ available parameters, run `sysctl -a`.

 The first step before compiling the kernel is to generate an appropriate
 `.config` configuration. Either you pass your own config via the
-`configfile` setting of `linuxManualConfig`:
+`configfile` setting of `linuxKernel.manualConfig`:

 ```nix
-custom-kernel = super.linuxManualConfig {
-  inherit (super) stdenv hostPlatform;
-  inherit (linux_4_9) src;
-  version = "${linux_4_9.version}-custom";
+custom-kernel = let base_kernel = linuxKernel.kernels.linux_4_9;
+  in super.linuxKernel.manualConfig {
+    inherit (super) stdenv hostPlatform;
+    inherit (base_kernel) src;
+    version = "${base_kernel.version}-custom";

-  configfile = /home/me/my_kernel_config;
-  allowImportFromDerivation = true;
+    configfile = /home/me/my_kernel_config;
+    allowImportFromDerivation = true;
 };
 ```

--- a/nixos/doc/manual/from_md/configuration/linux-kernel.chapter.xml
+++ b/nixos/doc/manual/from_md/configuration/linux-kernel.chapter.xml
@ -6,7 +6,7 @@
    selects the Linux 3.10 kernel:
  </para>
  <programlisting language="bash">
-boot.kernelPackages = pkgs.linuxPackages_3_10;
+boot.kernelPackages = pkgs.linuxKernel.packages.linux_3_10;
 </programlisting>
  <para>
    Note that this not only replaces the kernel, but also packages that
@ -14,6 +14,13 @@ boot.kernelPackages = pkgs.linuxPackages_3_10;
    drivers. This ensures that driver packages are consistent with the
    kernel.
  </para>
+  <para>
+    While <literal>pkgs.linuxKernel.packages</literal> contains all
+    available kernel packages, you may want to use one of the
+    unversioned <literal>pkgs.linuxPackages_*</literal> aliases such as
+    <literal>pkgs.linuxPackages_latest</literal>, that are kept up to
+    date with new versions.
+  </para>
  <para>
    The default Linux kernel configuration should be fine for most
    users. You can see the configuration of your current kernel with the
@ -29,14 +36,13 @@ zcat /proc/config.gz
    enable support for the kernel debugger KGDB:
  </para>
  <programlisting language="bash">
-nixpkgs.config.packageOverrides = pkgs:
-  { linux_3_4 = pkgs.linux_3_4.override {
-      extraConfig =
-        ''
-          KGDB y
-        '';
-    };
+nixpkgs.config.packageOverrides = pkgs: pkgs.lib.recursiveUpdate pkgs {
+  linuxKernel.kernels.linux_5_10 = pkgs.linuxKernel.kernels.linux_5_10.override {
+    extraConfig = ''
+      KGDB y
+    '';
  };
+};
 </programlisting>
  <para>
    <literal>extraConfig</literal> takes a list of Linux kernel
@ -82,16 +88,17 @@ boot.kernel.sysctl.&quot;net.ipv4.tcp_keepalive_time&quot; = 120;
      The first step before compiling the kernel is to generate an
      appropriate <literal>.config</literal> configuration. Either you
      pass your own config via the <literal>configfile</literal> setting
-      of <literal>linuxManualConfig</literal>:
+      of <literal>linuxKernel.manualConfig</literal>:
    </para>
    <programlisting language="bash">
-custom-kernel = super.linuxManualConfig {
-  inherit (super) stdenv hostPlatform;
-  inherit (linux_4_9) src;
-  version = &quot;${linux_4_9.version}-custom&quot;;
+custom-kernel = let base_kernel = linuxKernel.kernels.linux_4_9;
+  in super.linuxKernel.manualConfig {
+    inherit (super) stdenv hostPlatform;
+    inherit (base_kernel) src;
+    version = &quot;${base_kernel.version}-custom&quot;;

-  configfile = /home/me/my_kernel_config;
-  allowImportFromDerivation = true;
+    configfile = /home/me/my_kernel_config;
+    allowImportFromDerivation = true;
 };
 </programlisting>
    <para>
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -983,6 +983,20 @@ Superuser created successfully.
  <section xml:id="sec-release-21.11-notable-changes">
    <title>Other Notable Changes</title>
    <itemizedlist>
+      <listitem>
+        <para>
+          The linux kernel package infrastructure was moved out of
+          <literal>all-packages.nix</literal>, and restructured. Linux
+          related functions and attributes now live under the
+          <literal>pkgs.linuxKernel</literal> attribute set. In
+          particular the versioned <literal>linuxPackages_*</literal>
+          package sets (such as <literal>linuxPackages_5_4</literal>)
+          and kernels from <literal>pkgs</literal> were moved there and
+          now live under <literal>pkgs.linuxKernel.packages.*</literal>.
+          The unversioned ones (such as
+          <literal>linuxPackages_latest</literal>) remain untouched.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The setting
@ -1171,6 +1185,24 @@ Superuser created successfully.
          but instead use more of the YAML-specific syntax.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          MariaDB was upgraded from 10.5.x to 10.6.x. Please read the
+          <link xlink:href="https://mariadb.com/kb/en/changes-improvements-in-mariadb-106/">upstream
+          release notes</link> for changes and upgrade instructions.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The MariaDB C client library, also known as libmysqlclient or
+          mariadb-connector-c, was upgraded from 3.1.x to 3.2.x. While
+          this should hopefully not have any impact, this upgrade comes
+          with some changes to default behavior, so you might want to
+          review the
+          <link xlink:href="https://mariadb.com/kb/en/changes-and-improvements-in-mariadb-connector-c-32/">upstream
+          release notes</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          GNOME desktop environment now enables
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -302,6 +302,9 @@ To be able to access the web UI this port needs to be opened in the firewall.

 ## Other Notable Changes {#sec-release-21.11-notable-changes}

+- The linux kernel package infrastructure was moved out of `all-packages.nix`, and restructured. Linux related functions and attributes now live under the `pkgs.linuxKernel` attribute set.
+  In particular the versioned `linuxPackages_*` package sets (such as `linuxPackages_5_4`) and kernels from `pkgs` were moved there and now live under `pkgs.linuxKernel.packages.*`. The unversioned ones (such as `linuxPackages_latest`) remain untouched.
+
 - The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.

  However, if [`services.fail2ban.enable`](options.html#opt-services.fail2ban.enable) is `true`, the `fail2ban` will override the verbosity to `"VERBOSE"`, so that `fail2ban` can observe the failed login attempts from the SSH logs.
@ -352,6 +355,10 @@ To be able to access the web UI this port needs to be opened in the firewall.

 - `lib.formats.yaml`'s `generate` will not generate JSON anymore, but instead use more of the YAML-specific syntax.

+- MariaDB was upgraded from 10.5.x to 10.6.x. Please read the [upstream release notes](https://mariadb.com/kb/en/changes-improvements-in-mariadb-106/) for changes and upgrade instructions.
+
+- The MariaDB C client library, also known as libmysqlclient or mariadb-connector-c, was upgraded from 3.1.x to 3.2.x. While this should hopefully not have any impact, this upgrade comes with some changes to default behavior, so you might want to review the [upstream release notes](https://mariadb.com/kb/en/changes-and-improvements-in-mariadb-connector-c-32/).
+
 - GNOME desktop environment now enables `QGnomePlatform` as the Qt platform theme, which should avoid crashes when opening file chooser dialogs in Qt apps by using XDG desktop portal. Additionally, it will make the apps fit better visually.

 - `rofi` has been updated from '1.6.1' to '1.7.0', one important thing is the removal of the old xresources based configuration setup. Read more [in rofi's changelog](https://github.com/davatorium/rofi/blob/cb12e6fc058f4a0f4f/Changelog#L1).
--- a/nixos/modules/installer/cd-dvd/system-tarball-fuloong2f.nix
+++ b/nixos/modules/installer/cd-dvd/system-tarball-fuloong2f.nix
@ -93,7 +93,7 @@ in
  boot.initrd.availableKernelModules =
    [ "vfat" "reiserfs" ];

-  boot.kernelPackages = pkgs.linuxPackages_3_10;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_3_10;
  boot.kernelParams = [ "console=tty1" ];

  boot.postBootCommands =
--- a/nixos/modules/installer/cd-dvd/system-tarball-pc.nix
+++ b/nixos/modules/installer/cd-dvd/system-tarball-pc.nix
@ -114,7 +114,7 @@ in
  # To be able to use the systemTarball to catch troubles.
  boot.crashDump = {
    enable = true;
-    kernelPackages = pkgs.linuxPackages_3_4;
+    kernelPackages = pkgs.linuxKernel.packages.linux_3_4;
  };

  # No grub for the tarball.
--- a/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix
+++ b/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix
@ -111,7 +111,7 @@ in
      # "console=ttyS0,115200n8"  # serial console
    ];

-  boot.kernelPackages = pkgs.linuxPackages_3_4;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_3_4;

  boot.supportedFilesystems = [ "reiserfs" ];

--- a/nixos/modules/installer/sd-card/sd-image-raspberrypi.nix
+++ b/nixos/modules/installer/sd-card/sd-image-raspberrypi.nix
@ -12,7 +12,7 @@
  boot.loader.generic-extlinux-compatible.enable = true;

  boot.consoleLogLevel = lib.mkDefault 7;
-  boot.kernelPackages = pkgs.linuxPackages_rpi1;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_rpi1;

  sdImage = {
    populateFirmwareCommands = let
--- a/nixos/modules/security/lock-kernel-modules.nix
+++ b/nixos/modules/security/lock-kernel-modules.nix
@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, pkgs, lib, ... }:

 with lib;

@ -13,7 +13,7 @@ with lib;
      default = false;
      description = ''
        Disable kernel module loading once the system is fully initialised.
-        Module loading is disabled until the next reboot.  Problems caused
+        Module loading is disabled until the next reboot. Problems caused
        by delayed module loading can be fixed by adding the module(s) in
        question to <option>boot.kernelModules</option>.
      '';
@ -29,20 +29,30 @@ with lib;
            else [ x.fsType ]
        else []) config.system.build.fileSystems;

-    systemd.services.disable-kernel-module-loading = rec {
+    systemd.services.disable-kernel-module-loading = {
      description = "Disable kernel module loading";

+      wants = [ "systemd-udevd.service" ];
      wantedBy = [ config.systemd.defaultUnit ];

-      after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy;
+      before = [ config.systemd.defaultUnit ];
+      after =
+        [ "firewall.service"
+          "systemd-modules-load.service"
+        ];

      unitConfig.ConditionPathIsReadWrite = "/proc/sys/kernel";

-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStart = "/bin/sh -c 'echo -n 1 >/proc/sys/kernel/modules_disabled'";
-      };
+      serviceConfig =
+        { Type = "oneshot";
+          RemainAfterExit = true;
+          TimeoutSec = 180;
+        };
+
+      script = ''
+        ${pkgs.udev}/bin/udevadm settle
+        echo -n 1 >/proc/sys/kernel/modules_disabled
+      '';
    };
  };
 }
--- a/nixos/modules/services/backup/automysqlbackup.nix
+++ b/nixos/modules/services/backup/automysqlbackup.nix
@ -73,6 +73,7 @@ in
    services.automysqlbackup.config = mapAttrs (name: mkDefault) {
      mysql_dump_username = user;
      mysql_dump_host = "localhost";
+      mysql_dump_socket = "/run/mysqld/mysqld.sock";
      backup_dir = "/var/backup/mysql";
      db_exclude = [ "information_schema" "performance_schema" ];
      mailcontent = "stdout";
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -821,6 +821,40 @@ in {
        '';
      };

+      logrotate = {
+        enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = ''
+            Enable rotation of log files.
+          '';
+        };
+
+        frequency = mkOption {
+          type = types.str;
+          default = "daily";
+          description = "How often to rotate the logs.";
+        };
+
+        keep = mkOption {
+          type = types.int;
+          default = 30;
+          description = "How many rotations to keep.";
+        };
+
+        extraConfig = mkOption {
+          type = types.lines;
+          default = ''
+            copytruncate
+            compress
+          '';
+          description = ''
+            Extra logrotate config options for this path. Refer to
+            <link xlink:href="https://linux.die.net/man/8/logrotate"/> for details.
+          '';
+        };
+      };
+
      extraConfig = mkOption {
        type = types.attrs;
        default = {};
@ -932,6 +966,21 @@ in {
      ensureUsers = singleton { name = cfg.databaseUsername; };
    };

+    # Enable rotation of log files
+    services.logrotate = {
+      enable = cfg.logrotate.enable;
+      paths = {
+        gitlab = {
+          path = "${cfg.statePath}/log/*.log";
+          user = cfg.user;
+          group = cfg.group;
+          frequency = cfg.logrotate.frequency;
+          keep = cfg.logrotate.keep;
+          extraConfig = cfg.logrotate.extraConfig;
+        };
+      };
+    };
+
    # The postgresql module doesn't currently support concepts like
    # objects owners and extensions; for now we tack on what's needed
    # here.
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -174,9 +174,6 @@ in
      "systemd-machined.service"
      # setSessionScript wants AccountsService
      "accounts-daemon.service"
-      # Failed to open gpu '/dev/dri/card0': GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: Operation not permitted
-      # https://github.com/NixOS/nixpkgs/pull/25311#issuecomment-609417621
-      "systemd-udev-settle.service"
    ];

    systemd.services.display-manager.after = [
@ -186,7 +183,6 @@ in
      "getty@tty${gdm.initialVT}.service"
      "plymouth-quit.service"
      "plymouth-start.service"
-      "systemd-udev-settle.service"
    ];
    systemd.services.display-manager.conflicts = [
      "getty@tty${gdm.initialVT}.service"
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@ -47,7 +47,7 @@ in
      # We don't want to evaluate all of linuxPackages for the manual
      # - some of it might not even evaluate correctly.
      defaultText = "pkgs.linuxPackages";
-      example = literalExample "pkgs.linuxPackages_2_6_25";
+      example = literalExample "pkgs.linuxKernel.packages.linux_5_10";
      description = ''
        This option allows you to override the Linux kernel used by
        NixOS.  Since things like external kernel module packages are
--- a/nixos/modules/system/boot/tmp.nix
+++ b/nixos/modules/system/boot/tmp.nix
@ -2,6 +2,9 @@

 with lib;

+let
+  cfg = config.boot;
+in
 {

  ###### interface
@ -24,18 +27,28 @@ with lib;
      '';
    };

+    boot.tmpOnTmpfsSize = mkOption {
+      type = types.oneOf [ types.str types.types.ints.positive ];
+      default = "50%";
+      description = ''
+        Size of tmpfs in percentage.
+        Percentage is defined by systemd.
+      '';
+    };
+
  };

  ###### implementation

  config = {

-    systemd.mounts = mkIf config.boot.tmpOnTmpfs [
+    # When changing remember to update /tmp mount in virtualisation/qemu-vm.nix
+    systemd.mounts = mkIf cfg.tmpOnTmpfs [
      {
        what = "tmpfs";
        where = "/tmp";
        type = "tmpfs";
-        mountConfig.Options = [ "mode=1777" "strictatime" "rw" "nosuid" "nodev" "size=50%" ];
+        mountConfig.Options = [ "mode=1777" "strictatime" "rw" "nosuid" "nodev" "size=${toString cfg.tmpOnTmpfsSize}" ];
      }
    ];

--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -686,7 +686,7 @@ in
            fsType = "tmpfs";
            neededForBoot = true;
            # Sync with systemd's tmp.mount;
-            options = [ "mode=1777" "strictatime" "nosuid" "nodev" ];
+            options = [ "mode=1777" "strictatime" "nosuid" "nodev" "size=${toString config.boot.tmpOnTmpfsSize}" ];
          };
        "/tmp/xchg" =
          { device = "xchg";
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "pt2-clone";
-  version = "1.32";
+  version = "1.33";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${version}";
-    sha256 = "sha256-U1q4xCOzV7n31WgCTGlEXvZaUT/TP797cOAHkecQaLo=";
+    sha256 = "sha256-XPQRFbIgSU3oCTbLe4gYkMNBvcLZdJvU/YQHtUvgt9k=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/blockchains/chia/default.nix
+++ b/pkgs/applications/blockchains/chia/default.nix
@ -26,6 +26,13 @@ let chia = python3Packages.buildPythonApplication rec {
    })
  ];

+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "==" ">="
+
+    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt mozilla-ca/cacert.pem
+  '';
+
  nativeBuildInputs = [
    python3Packages.setuptools-scm
  ];
@ -75,17 +82,6 @@ let chia = python3Packages.buildPythonApplication rec {
    "test_using_legacy_keyring"
  ];

-  postPatch = ''
-    # tweak version requirements to what's available in Nixpkgs
-    substituteInPlace setup.py \
-      --replace "aiohttp==3.7.4" "aiohttp>=3.7.4" \
-      --replace "sortedcontainers==2.3.0" "sortedcontainers>=2.3.0" \
-      --replace "click==7.1.2" "click>=7.1.2" \
-      --replace "clvm==0.9.7" "clvm>=0.9.7" \
-
-    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt mozilla-ca/cacert.pem
-  '';
-
  preCheck = ''
    export HOME=`mktemp -d`
  '';
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@ -6,20 +6,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "electrs";
-  version = "0.8.10";
+  version = "0.8.11";

  src = fetchFromGitHub {
    owner = "romanz";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0q7mvpflnzzm88jbsdxgvhk9jr5mvn23hhj2iwy2grnfngxsmz3y";
+    sha256 = "024sdyvrx7s4inldamq4c8lv0iijjyd18j1mm9x6xf2clmvicaa6";
  };

  # needed for librocksdb-sys
  nativeBuildInputs = [ llvmPackages.clang ];
  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";

-  cargoSha256 = "0i8npa840g4kz50n6x40z22x9apq8snw6xgjz4vn2kh67xc4c738";
+  cargoSha256 = "0yl50ryxidbs9wkabz919mgbmsgsqjp1bjw792l1lkgncq8z9r5b";

  meta = with lib; {
    description = "An efficient re-implementation of Electrum Server in Rust";
--- a/pkgs/applications/editors/emacs/elisp-packages/ement/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/ement/default.nix
@ -0,0 +1,32 @@
+{ trivialBuild
+, lib
+, fetchFromGitHub
+, curl
+, plz
+, cl-lib
+, ts
+}:
+
+trivialBuild {
+  pname = "ement";
+  version = "unstable-2021-09-08";
+
+  packageRequires = [
+    plz
+    cl-lib
+    ts
+  ];
+
+  src = fetchFromGitHub {
+    owner = "alphapapa";
+    repo = "ement.el";
+    rev = "468aa9b0526aaa054f059c63797aa3d9ea13611d";
+    sha256 = "sha256-0FCAu253iTSf9qcsmoJxKlzfd5eYc8eJXUxG6+0eg/I=";
+  };
+
+  meta = {
+    description = "Ement.el is a Matrix client for Emacs";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
@ -264,6 +264,8 @@

  emacspeak = callPackage ./emacspeak { };

+  ement = callPackage ./ement { };
+
  ess-R-object-popup = callPackage ./ess-R-object-popup { };

  font-lock-plus = callPackage ./font-lock-plus { };
@ -284,6 +286,8 @@

  perl-completion = callPackage ./perl-completion { };

+  plz = callPackage ./plz { };
+
  pod-mode = callPackage ./pod-mode { };

  power-mode = callPackage ./power-mode { };
--- a/pkgs/applications/editors/emacs/elisp-packages/plz/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/plz/default.nix
@ -0,0 +1,23 @@
+{ trivialBuild, lib, fetchFromGitHub, curl }:
+
+trivialBuild {
+  pname = "plz";
+  version = "unstable-2021-08-22";
+
+  src = fetchFromGitHub {
+    owner = "alphapapa";
+    repo = "plz.el";
+    rev = "7e456638a651bab3a814e3ea81742dd917509cbb";
+    sha256 = "sha256-8kn9ax1AVF6f9iCTqvVeJZihs03pYAhLjUDooG/ubxY=";
+  };
+
+  postPatch = ''
+    substituteInPlace ./plz.el --replace 'plz-curl-program "curl"' 'plz-curl-program "${curl}/bin/curl"'
+  '';
+
+  meta = {
+    description = "plz is an HTTP library for Emacs";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.2567";
+  version = "8.2.3337";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    sha256 = "sha256-FS3TZX7FKnnNpGYKbng2LIfWA9z2jqg7d2HC6t3xYTU=";
+    sha256 = "sha256-iwSGcLeqXH0bVIXEI5OnotG88Uv8ntycisD9EcHjz/c=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -14,17 +14,17 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0g49765pnimh107pw3q7dlgd6jcmr5gagsvxrdx8i93mbxb0xm0c";
-    x86_64-darwin = "1837fcpllblm970jxsal0ahxsnjmsgydy6g6qn51hp7f797gi7zb";
-    aarch64-linux = "1bpmgv6hjyb7jl9v8qyqiyr0brl4xq3wnls2v9hirja6ls1x14cx";
-    aarch64-darwin = "0qksfscbiyr2ynw3j86g8wm7myyabkjwx03ik3z6rrv7dffb5yii";
-    armv7l-linux = "063p2wy1wl57p43f3md0wp2d981nnb650hyqs9rgqm4mlk2s168g";
+    x86_64-linux = "10iai5k0hvyvishp4gbamvsn9ff8dfm6kvql08h3plr8zrvmaian";
+    x86_64-darwin = "1cspla4cxw0l5cg44qywv3jgwyk2g7sx5lk1s4xhbrqz76knzcr7";
+    aarch64-linux = "1dc4gfaxlrsd637d8w2c5h4l8c96phv14pmkhmyc1jp1a0q6d5ja";
+    aarch64-darwin = "06d8ng6k62mh1qhba0c6nj2lag4vi7i50d2sx3nk8r2v8azwyrmk";
+    armv7l-linux = "030c8az831n73w35xfbjpympwvfprf1h4lxy8j5sysm4fbpzi03m";
  }.${system};
 in
  callPackage ./generic.nix rec {
    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.60.0";
+    version = "1.60.1";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@ -10,11 +10,11 @@

 mkDerivation rec {
  pname = "krita";
-  version = "4.4.5";
+  version = "4.4.7";

  src = fetchurl {
    url = "https://download.kde.org/stable/${pname}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-S/1ygIcNEGCgDREj2Db8Gltb+KAoZ2Z58CaM1ef7dWg=";
+    sha256 = "sha256-I6fFxPRCcRU5dyFXZPvGvTb9MuGikrvTaGCXpp4LRRk=";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules python3Packages.sip_4 makeWrapper ];
--- a/pkgs/applications/kde/akonadi-contacts.nix
+++ b/pkgs/applications/kde/akonadi-contacts.nix
@ -3,8 +3,8 @@
  extra-cmake-modules,
  qtwebengine,
  grantlee, grantleetheme,
-  kdbusaddons, ki18n, kiconthemes, kio, kitemmodels, ktextwidgets, prison,
-  akonadi, akonadi-mime, kcontacts, kmime, libkleo,
+  kcmutils, kdbusaddons, ki18n, kiconthemes, kio, kitemmodels, ktextwidgets,
+  prison, akonadi, akonadi-mime, kcontacts, kmime, libkleo,
 }:

 mkDerivation {
@ -17,7 +17,7 @@ mkDerivation {
  buildInputs = [
    qtwebengine
    grantlee grantleetheme
-    kdbusaddons ki18n kiconthemes kio kitemmodels ktextwidgets prison
+    kcmutils kdbusaddons ki18n kiconthemes kio kitemmodels ktextwidgets prison
    akonadi-mime kcontacts kmime libkleo
  ];
  propagatedBuildInputs = [ akonadi ];
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/release-service/21.04.0/src -A '*.tar.xz' )
+WGET_ARGS=( http://download.kde.org/stable/release-service/21.08.0/src -A '*.tar.xz' )
--- a/pkgs/applications/kde/kdeconnect-kde.nix
+++ b/pkgs/applications/kde/kdeconnect-kde.nix
@ -19,12 +19,15 @@
 , makeWrapper
 , pulseaudio-qt
 , qca-qt5
+, qqc2-desktop-style
 , qtgraphicaleffects
 , qtmultimedia
 , qtquickcontrols2
 , qtx11extras
 , breeze-icons
 , sshfs
+, wayland
+, wayland-scanner
 }:

 mkDerivation {
@ -46,10 +49,13 @@ mkDerivation {
    libfakekey
    pulseaudio-qt
    qca-qt5
+    qqc2-desktop-style
    qtgraphicaleffects
    qtmultimedia
    qtquickcontrols2
    qtx11extras
+    wayland
+    wayland-scanner
    # otherwise buttons are blank on non-kde
    breeze-icons
  ];
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/cobalt/default.nix
+++ b/pkgs/applications/misc/cobalt/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cobalt";
-  version = "0.17.0";
+  version = "0.17.4";

  src = fetchFromGitHub {
    owner = "cobalt-org";
    repo = "cobalt.rs";
    rev = "v${version}";
-    sha256 = "sha256-IeO50/f+DX9ujZy1+cU1j+nnSl3lpf/nPOu5YBGcCSc=";
+    sha256 = "sha256-uZcs3VkmpasFwgB7m1spTHi2W86tJt2kWlRTXAotvvo=";
  };

-  cargoSha256 = "sha256-ECgCxR5nsHCeQ3Qc7GWm/lMbmtU2fbAF42nrn2LEcyw=";
+  cargoSha256 = "sha256-U2TVg2/SIOxaWs4EehTpcu47uDO/EA2dJK56k3I6F+0=";

  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];

--- a/pkgs/applications/misc/cointop/default.nix
+++ b/pkgs/applications/misc/cointop/default.nix
@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "cointop";
-  version = "1.6.6";
+  version = "1.6.8";

  src = fetchFromGitHub {
    owner = "miguelmota";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-cn2TtXIxBnEZyWAdtf9ING9I/53z6D8UPVxnFVSkGgo=";
+    sha256 = "sha256-uENfTj+pJjX4t+yrd7zrn3LHRbJJSZFCN1N6Ce47wcE=";
  };

  goPackagePath = "github.com/miguelmota/cointop";
--- a/pkgs/applications/misc/moolticute/default.nix
+++ b/pkgs/applications/misc/moolticute/default.nix
@ -9,13 +9,13 @@

 mkDerivation rec {
  pname = "moolticute";
-  version = "0.45.0";
+  version = "0.50.0";

  src = fetchFromGitHub {
    owner = "mooltipass";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-azJ63NI0wzzv3acgoPaeF+lTM1WKpXg595FrK908k1U=";
+    sha256 = "sha256-/luba+qYRATP3EjNMB+GIRP6JQOlADsvpF8PzRFqFlM=";
  };

  outputs = [ "out" "udev" ];
--- a/pkgs/applications/misc/numberstation/default.nix
+++ b/pkgs/applications/misc/numberstation/default.nix
@ -15,7 +15,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "numberstation";
-  version = "0.4.0";
+  version = "0.5.0";

  format = "other";

@ -23,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "~martijnbraam";
    repo = "numberstation";
    rev = version;
-    sha256 = "038yyffqknr274f7jh5z12y68pjxr37f8y2cn2pwhf605jmbmpwv";
+    sha256 = "1hh66i0rfm85a97iajxlh965wk68hn0kkfgi9cljjkqf98xiy0bb";
  };

  postPatch = ''
@ -63,6 +63,6 @@ python3.pkgs.buildPythonApplication rec {
    description = "TOTP Authentication application for mobile";
    homepage = "https://sr.ht/~martijnbraam/numberstation/";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ dotlambda ];
+    maintainers = with maintainers; [ dotlambda tomfitzhenry ];
  };
 }
--- a/pkgs/applications/misc/obinskit/default.nix
+++ b/pkgs/applications/misc/obinskit/default.nix
@ -4,7 +4,7 @@
 , libxkbcommon
 , systemd
 , xorg
-, electron_3
+, electron_11
 , makeWrapper
 , makeDesktopItem
 }:
@ -17,15 +17,15 @@ let
    genericName = "Obinskit keyboard configurator";
    categories = "Utility";
  };
-  electron = electron_3;
+  electron = electron_11;
 in
 stdenv.mkDerivation rec {
  pname = "obinskit";
-  version = "1.1.4";
+  version = "1.1.8";

  src = fetchurl {
    url = "http://releases.obins.net/occ/linux/tar/ObinsKit_${version}_x64.tar.gz";
-    sha256 = "0q422rmfn4k4ww1qlgrwdmxz4l10dxkd6piynbcw5cr4i5icnh2l";
+    sha256 = "MgasbgexOdscQrUte/6OzCSrc74RvaBq44oHplQA/Gc=";
  };

  unpackPhase = "tar -xzf $src";
@ -51,12 +51,12 @@ stdenv.mkDerivation rec {
  postFixup = ''
    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
      --add-flags $out/opt/obinskit/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib libxkbcommon (lib.getLib systemd) xorg.libXt ]}"
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib libxkbcommon (lib.getLib systemd) xorg.libXt xorg.libXtst ]}"
  '';

  meta = with lib; {
    description = "Graphical configurator for Anne Pro and Anne Pro II keyboards";
-    homepage = "http://en.obins.net/obinskit/"; # https is broken
+    homepage = "https://www.hexcore.xyz/obinskit";
    license = licenses.unfree;
    maintainers = with maintainers; [ shou ];
    platforms = [ "x86_64-linux" ];
--- a/pkgs/applications/misc/plover/default.nix
+++ b/pkgs/applications/misc/plover/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchurl, python27Packages, python36Packages, wmctrl,
+{ lib, fetchurl, python27Packages, python3Packages, wmctrl,
  qtbase, mkDerivationWith }:

 {
@ -24,9 +24,9 @@
    ];
  };

-  dev = with python36Packages; mkDerivationWith buildPythonPackage rec {
+  dev = with python3Packages; mkDerivationWith buildPythonPackage rec {
    pname = "plover";
-    version = "4.0.0.dev8";
+    version = "4.0.0.dev10";

    meta = with lib; {
      description = "OpenSteno Plover stenography software";
@ -36,7 +36,7 @@

    src = fetchurl {
      url    = "https://github.com/openstenoproject/plover/archive/v${version}.tar.gz";
-      sha256 = "1wxkmik1zyw5gqig5r0cas5v6f5408fbnximzw610rdisqy09rxp";
+      sha256 = "sha256-Eun+ZgmOIjYw6FS/2OGoBvYh52U/Ue0+NtIqrvV2Tqc=";
    };

    # I'm not sure why we don't find PyQt5 here but there's a similar
--- a/pkgs/applications/misc/variety/default.nix
+++ b/pkgs/applications/misc/variety/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub
-, python37Packages
+, python3Packages
 , fehSupport ? false, feh
 , imagemagickSupport ? true, imagemagick
 , intltool
@ -13,7 +13,7 @@
 , makeWrapper
 }:

-with python37Packages;
+with python3Packages;

 buildPythonApplication rec {
  pname = "variety";
--- a/pkgs/applications/misc/xcruiser/default.nix
+++ b/pkgs/applications/misc/xcruiser/default.nix
@ -12,8 +12,10 @@ stdenv.mkDerivation {
  buildInputs = [ libXt libXaw libXpm libXext ];

  makeFlags = [
-    "BINDIR=$(out)/bin"
-    "XAPPLOADDIR=$(out)/etc/X11/app-defaults"
+    "BINDIR=${placeholder "out"}/bin"
+    "CONFDIR=${placeholder "out"}/etc/X11"
+    "LIBDIR=${placeholder "out"}/lib/X11"
+    "XAPPLOADDIR=${placeholder "out"}/etc/X11/app-defaults"
  ];

  meta = with lib; {
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "xmrig";
-  version = "6.14.0";
+  version = "6.14.1";

  src = fetchFromGitHub {
    owner = "xmrig";
    repo = "xmrig";
    rev = "v${version}";
-    sha256 = "sha256-h+Y7hXkenoLT83eG0w6YEfOuEocejXgvqRMq1DwWwT0=";
+    sha256 = "sha256-JJ20LKA4gnPXO6d2Cegr3I67k+ZZc69hdL1dTUIF5OM=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/xmrig/moneroocean.nix
+++ b/pkgs/applications/misc/xmrig/moneroocean.nix
@ -2,13 +2,13 @@

 xmrig.overrideAttrs (oldAttrs: rec {
  pname = "xmrig-mo";
-  version = "6.14.1-mo2";
+  version = "6.15.0-mo1";

  src = fetchFromGitHub {
    owner = "MoneroOcean";
    repo = "xmrig";
    rev = "v${version}";
-    sha256 = "sha256-bfD/zxUo4ZDLRDpFbD/FCAvBISHvhRaYXwwiYFd10No=";
+    sha256 = "sha256-2JT315JbjiU8gAwROZL820MYC/v3MPtJVsN+vsf4KDQ=";
  };

  meta = with lib; {
--- a/pkgs/applications/misc/xxkb/default.nix
+++ b/pkgs/applications/misc/xxkb/default.nix
@ -24,7 +24,9 @@ stdenv.mkDerivation rec {

  makeFlags = [
    "BINDIR=${placeholder "out"}/bin"
+    "CONFDIR=${placeholder "out"}/etc/X11"
    "PIXMAPDIR=${placeholder "out"}/share/xxkb"
+    "LIBDIR=${placeholder "out"}/lib/X11"
    "XAPPLOADDIR=${placeholder "out"}/etc/X11/app-defaults"
    "MANDIR=${placeholder "man"}/share/man"
  ];
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@ -32,8 +32,7 @@
 , openssl
 , pango
 , procps
-, python37
-, python37Packages
+, python3
 , stdenv
 , systemd
 , xdg-utils
@ -101,8 +100,8 @@ stdenv.mkDerivation rec {
  dontBuild = true;

  buildInputs = [
-    python37
-    python37Packages.dbus-python
+    python3
+    python3.pkgs.dbus-python
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/networking/browsers/telescope/default.nix
+++ b/pkgs/applications/networking/browsers/telescope/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "telescope";
-  version = "0.5.1";
+  version = "0.5.2";

  src = fetchFromGitHub {
    owner = "omar-polo";
    repo = pname;
    rev = version;
-    sha256 = "0dd09r7b2gm9nv1q67yq4zk9f4v0fwqr5lw51crki9ii82gmj2h8";
+    sha256 = "sha256-AdbFJfoicQUgJ9kesIWZ9ygttyjjDeC0UHRI98GwoZ8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cloudflared";
-  version = "2021.8.7";
+  version = "2021.9.0";

  src = fetchFromGitHub {
    owner  = "cloudflare";
    repo   = "cloudflared";
    rev    = version;
-    sha256 = "sha256-Q8Xjo60lR1x7Y9/jcxXX32IxVVlHmkr4ekIwWTgdwps=";
+    sha256 = "sha256-djgMTCDIVcaPI6to/pPN2hPi1tsKPxRCT30EL0OOEQU=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@ -10,11 +10,14 @@
 , wrapGAppsHook
 , evolution-data-server
 , feedbackd
+, glibmm
+, gspell
 , gtk3
 , json-glib
 , libgcrypt
 , libhandy
 , libphonenumber
+, modemmanager
 , olm
 , pidgin
 , protobuf
@ -24,14 +27,14 @@

 stdenv.mkDerivation rec {
  pname = "chatty";
-  version = "0.3.4";
+  version = "0.4.0";

  src = fetchFromGitLab {
    domain = "source.puri.sm";
    owner = "Librem5";
    repo = "chatty";
    rev = "v${version}";
-    sha256 = "0910f5bw75ph576gxbsd6ysdwnlk4ysdp0pml2i3mjqpcbkqfs3w";
+    sha256 = "12k1a5xrwd6zk4x0m53hbzggk695z3bpbzy1wcikzy0jvch7h13d";
  };

  postPatch = ''
@ -51,11 +54,14 @@ stdenv.mkDerivation rec {
  buildInputs = [
    evolution-data-server
    feedbackd
+    glibmm
+    gspell
    gtk3
    json-glib
    libgcrypt
    libhandy
    libphonenumber
+    modemmanager
    olm
    pidgin
    protobuf
--- a/pkgs/applications/networking/instant-messengers/session-desktop-appimage/default.nix
+++ b/pkgs/applications/networking/instant-messengers/session-desktop-appimage/default.nix
@ -0,0 +1,23 @@
+{ lib
+, fetchurl
+, appimageTools
+}:
+
+let
+  version = "1.7.1";
+in
+appimageTools.wrapType2 {
+  name = "session-desktop-appimage-${version}";
+  src = fetchurl {
+    url = "https://github.com/oxen-io/session-desktop/releases/download/v${version}/session-desktop-linux-x86_64-${version}.AppImage";
+    sha256 = "126dx37099pjaqgfv5gbmvn5iiwv2a8lvfbqy5i9h1w1gqnihwq6";
+  };
+
+  meta = with lib; {
+    description = "Onion routing based messenger";
+    homepage = "https://getsession.org/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ alexnortung ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@ -81,9 +81,9 @@ stdenv.mkDerivation rec {
      mv * $out/lib/teamspeak/

      # Make a desktop item
-      mkdir -p $out/share/applications/ $out/share/icons/
+      mkdir -p $out/share/applications/ $out/share/icons/hicolor/64x64/apps/
      unzip ${pluginsdk}
-      cp pluginsdk/docs/client_html/images/logo.png $out/share/icons/teamspeak.png
+      cp pluginsdk/docs/client_html/images/logo.png $out/share/icons/hicolor/64x64/apps/teamspeak.png
      cp ${desktopItem}/share/applications/* $out/share/applications/

      # Make a symlink to the binary from bin.
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "nextdns";
-  version = "1.36.0";
+  version = "1.37.2";

  src = fetchFromGitHub {
    owner = "nextdns";
    repo = "nextdns";
    rev = "v${version}";
-    sha256 = "sha256-aYWnopMRN0CDFpiWymhFT+f7vbKaP2HpjekVIr2rsME=";
+    sha256 = "sha256-R0n/wRCaQ8WvQer3bBLUmOdIojtfjXU0bs0pTn7L0lc=";
  };

  vendorSha256 = "sha256-YZm+DUrH+1xdJrGjmlajbcsnqVODVbZKivVjmqZ2e48=";
--- a/pkgs/applications/networking/p2p/gnunet/default.nix
+++ b/pkgs/applications/networking/p2p/gnunet/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "gnunet";
-  version = "0.15.0";
+  version = "0.15.3";

  src = fetchurl {
    url = "mirror://gnu/gnunet/${pname}-${version}.tar.gz";
-    sha256 = "sha256-zKI9b7QIkKXrLMrkuPfnTI5OhNP8ovQZ13XLSljdmmc=";
+    sha256 = "sha256-1iZpqPQeB46qIgznejL08/gB4wmTV66McFSY/nOITsU=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -12,13 +12,13 @@ assert trackerSearch -> (python3 != null);
 with lib;
 mkDerivation rec {
  pname = "qbittorrent";
-  version = "4.3.5";
+  version = "4.3.8";

  src = fetchFromGitHub {
    owner = "qbittorrent";
    repo = "qBittorrent";
    rev = "release-${version}";
-    sha256 = "1vdk42f8rxffyfydjk5cgzg5gl88ng2pynlyxw5ajh08wvkkjzgy";
+    sha256 = "sha256-on5folzKuRoVlvDOpme+aWxUKUC5PnO+N3L51qwG2gY=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/office/khronos/default.nix
+++ b/pkgs/applications/office/khronos/default.nix
@ -9,21 +9,22 @@
 , pantheon
 , python3
 , glib
-, gtk3
+, gtk4
 , json-glib
+, libadwaita
 , libgee
 , wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
  pname = "khronos";
-  version = "1.0.8";
+  version = "3.5.9";

  src = fetchFromGitHub {
    owner = "lainsce";
    repo = pname;
    rev = version;
-    sha256 = "0d5ma1d86lh2apagwrwk0d1v1cm3fifjivhf530nlznb67vi1x80";
+    sha256 = "sha256-3FatmyANB/tNYSN2hu5IVkyCy0YrC3uA2d/3+5u48w8=";
  };

  nativeBuildInputs = [
@ -38,15 +39,16 @@ stdenv.mkDerivation rec {

  buildInputs = [
    glib
-    gtk3
+    gtk4
    json-glib
+    libadwaita
    libgee
    pantheon.granite
  ];

  postPatch = ''
-    chmod +x meson/post_install.py
-    patchShebangs meson/post_install.py
+    chmod +x build-aux/post_install.py
+    patchShebangs build-aux/post_install.py
  '';

  passthru = {
@ -60,6 +62,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/lainsce/khronos";
    maintainers = with maintainers; [ xiorcale ] ++ pantheon.maintainers;
    platforms = platforms.linux;
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
  };
 }
--- a/pkgs/applications/radio/pyradio/default.nix
+++ b/pkgs/applications/radio/pyradio/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyradio";
-  version = "0.8.7.2";
+  version = "0.8.9.9";

  src = fetchFromGitHub {
    owner = "coderholic";
    repo = pname;
    rev = version;
-    sha256 = "0h2sxaqpmc1d1kpvpbcs9wymgzhx25x0x9p7dbyfw9r90i6123q1";
+    sha256 = "04asw5alkkf2q5iixswarj6ddb0y4a6ixm7cckl6204jiyxpv6kc";
  };

  checkPhase = ''
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "picard-tools";
-  version = "2.26.0";
+  version = "2.26.2";

  src = fetchurl {
    url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "sha256-sz/7MtcCJlUlrNy16W1YB/zXMhYeLLbQOIOdzNsGW7w=";
+    sha256 = "sha256-mfqxaZpzX9BIoFl1okN3TxzJnoepsoMR1KqHLQY5BHQ=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/science/logic/opensmt/default.nix
+++ b/pkgs/applications/science/logic/opensmt/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "opensmt";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "usi-verification-and-security";
    repo = "opensmt";
    rev = "v${version}";
-    sha256 = "sha256-m8TpMBY1r0h8GJTHM4FLBuZtX+WK/Q7RTXUnNmUWV+o=";
+    sha256 = "sha256-StnEvkSSKDHGYXIQsDUu9T9Ztl+RtDTP47JvnRyH0bE=";
  };

  nativeBuildInputs = [ cmake bison flex ];
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , makeWrapper
 , cmake
 , git
@ -15,6 +16,7 @@
 , libGLU
 , libGL
 , libxml2
+, llvm_9
 , lz4
 , xz
 , pcre
@ -29,6 +31,7 @@
 , libjpeg
 , libtiff
 , libpng
+, tbb
 , Cocoa
 , CoreSymbolication
 , OpenGL
@ -37,11 +40,11 @@

 stdenv.mkDerivation rec {
  pname = "root";
-  version = "6.24.02";
+  version = "6.24.06";

  src = fetchurl {
    url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    sha256 = "sha256-BQfhCV4nnMxyQPZR0llmAkMlF5+oWhJZtpS1ZyOtfBw=";
+    sha256 = "sha256-kH9p9LrKHk8w7rSXlZjKdZm2qoA8oEboDiW2u6oO9SI=";
  };

  nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
@ -53,6 +56,7 @@ stdenv.mkDerivation rec {
    zlib
    zstd
    libxml2
+    llvm_9
    lz4
    xz
    gsl
@ -64,6 +68,7 @@ stdenv.mkDerivation rec {
    libpng
    nlohmann_json
    python.pkgs.numpy
+    tbb
  ]
  ++ lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext libGLU libGL ]
  ++ lib.optionals (stdenv.isDarwin) [ Cocoa CoreSymbolication OpenGL ]
@ -71,8 +76,23 @@ stdenv.mkDerivation rec {

  patches = [
    ./sw_vers.patch
+
+    # Fix builtin_llvm=OFF support
+    (fetchpatch {
+      url = "https://github.com/root-project/root/commit/0cddef5d3562a89fe254e0036bb7d5ca8a5d34d2.diff";
+      excludes = [ "interpreter/cling/tools/plugins/clad/CMakeLists.txt" ];
+      sha256 = "sha256-VxWUbxRHB3O6tERFQdbGI7ypDAZD3sjSi+PYfu1OAbM=";
+    })
  ];

+  # Fix build against vanilla LLVM 9
+  postPatch = ''
+    sed \
+      -e '/#include "llvm.*RTDyldObjectLinkingLayer.h"/i#define private protected' \
+      -e '/#include "llvm.*RTDyldObjectLinkingLayer.h"/a#undef private' \
+      -i interpreter/cling/lib/Interpreter/IncrementalJIT.h
+  '';
+
  preConfigure = ''
    rm -rf builtins/*
    substituteInPlace cmake/modules/SearchInstalledSoftware.cmake \
@ -99,6 +119,7 @@ stdenv.mkDerivation rec {
    "-DCMAKE_CXX_STANDARD=17"
    "-DCMAKE_INSTALL_LIBDIR=lib"
    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-Dbuiltin_llvm=OFF"
    "-Dbuiltin_nlohmannjson=OFF"
    "-Dbuiltin_openui5=OFF"
    "-Dalien=OFF"
@ -112,7 +133,7 @@ stdenv.mkDerivation rec {
    "-Dfftw3=OFF"
    "-Dfitsio=OFF"
    "-Dfortran=OFF"
-    "-Dimt=OFF"
+    "-Dimt=ON"
    "-Dgfal=OFF"
    "-Dgviz=OFF"
    "-Dhdfs=OFF"
--- a/pkgs/applications/science/physics/xfitter/default.nix
+++ b/pkgs/applications/science/physics/xfitter/default.nix
@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, apfel, apfelgrid, applgrid, blas, gfortran, lhapdf, lapack, libyaml, lynx
 , mela, root5, qcdnum, which, libtirpc
+, memorymappingHook, memstreamHook
 }:

 stdenv.mkDerivation rec {
@ -36,9 +37,8 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ gfortran which ];
  buildInputs =
-    [ apfel apfelgrid applgrid blas lhapdf lapack mela root5 qcdnum ]
-    # pdf2yaml requires fmemopen and open_memstream which are not readily available on Darwin
-    ++ lib.optional (!stdenv.isDarwin) libyaml
+    [ apfel apfelgrid applgrid blas lhapdf libyaml lapack mela root5 qcdnum ]
+    ++ lib.optionals (stdenv.system == "x86_64-darwin") [ memorymappingHook memstreamHook ]
    ++ lib.optional (stdenv.hostPlatform.libc == "glibc") libtirpc
    ;
  propagatedBuildInputs = [ lynx ];
--- a/pkgs/applications/version-management/git-and-tools/bump2version/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/bump2version/default.nix
@ -1,22 +1,37 @@
-{ buildPythonApplication, fetchFromGitHub, isPy27, pytest, testfixtures, lib }:
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, testfixtures
+}:

 buildPythonApplication rec {
  pname = "bump2version";
-  version = "1.0.0";
-  disabled = isPy27;
+  version = "1.0.1";
+
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "c4urself";
    repo = pname;
-    rev = "refs/tags/v${version}";
-    sha256 = "10p7rg569rk3qvzs5kjj17894bqlsg3ihhbln6ciwwfhkfq1kpja";
+    rev = "v${version}";
+    sha256 = "sha256-j6HKi3jTwSgGBrA8PCJJNg+yQqRMo1aqaLgPGf4KAKU=";
  };

-  checkInputs = [ pytest testfixtures ];
-  # X's in pytest are git tests which won't run in sandbox
-  checkPhase = ''
-    pytest tests/ -k 'not usage_string_fork'
-  '';
+  checkInputs = [
+    pytestCheckHook
+    testfixtures
+  ];
+
+  disabledTests = [
+    # X's in pytest are git tests which won't run in sandbox
+    "usage_string_fork"
+    "test_usage_string"
+    "test_defaults_in_usage_with_config"
+  ];
+
+  pythonImportsCheck = [ "bumpversion" ];

  meta = with lib; {
    description = "Version-bump your software with a single command";
--- a/pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv, Security }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, libiconv, Security }:

 rustPlatform.buildRustPackage rec {
  pname = "git-interactive-rebase-tool";
@ -11,7 +11,15 @@ rustPlatform.buildRustPackage rec {
    sha256 = "sha256-DYl/GUbeNtKmXoR3gq8mK8EfsZNVNlrdngAwfzG+epw=";
  };

-  cargoSha256 = "sha256-1joMWPfn0s+pLsO6NHMT6AoXZ33R8MY2AWSrROY2mw8=";
+  cargoPatches = [
+    # update git2 crate to fix a compile error
+    (fetchpatch {
+      url = "https://github.com/MitMaro/git-interactive-rebase-tool/commit/f4d3026f23118d29a263bbca6c83f963e76c34c4.patch";
+      sha256 = "sha256-6ErPRcPbPRXbEslNiNInbbUhbOWb9ZRll7ZDRgTpWS4=";
+    })
+  ];
+
+  cargoSha256 = "sha256-2aHW9JIiqkO0X0B0D44tSZ8QkmKH/QZoYvKNEQWldo4=";

  buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];

--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.32.0";
+  version = "2.33.0";
  svn = subversionClient.override { perlBindings = perlSupport; };

  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@ -37,7 +37,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "08rnm3ipjqdd2n31dw7mxl3iv9g4nxgc409krmz892a37kd43a38";
+    sha256 = "0kqcs8nj5h7rh3q86pw5777awq7gn77lgxk88ynjl1rfz2snlg5z";
  };

  outputs = [ "out" ] ++ lib.optional withManual "doc";
@ -297,6 +297,8 @@ stdenv.mkDerivation {
    disable_test t0001-init 'shared overrides system'
    disable_test t0001-init 'init honors global core.sharedRepository'
    disable_test t1301-shared-repo
+    # git-completion.bash: line 405: compgen: command not found:
+    disable_test t9902-completion 'option aliases are shown with GIT_COMPLETION_SHOW_ALL'

    # Our patched gettext never fallbacks
    disable_test t0201-gettext-fallbacks
--- a/pkgs/applications/version-management/git-and-tools/git/git-send-email-honor-PATH.patch
+++ b/pkgs/applications/version-management/git-and-tools/git/git-send-email-honor-PATH.patch
@ -1,28 +1,31 @@
 diff --git a/Documentation/git-send-email.txt b/Documentation/git-send-email.txt
-index 1afe9fc858..05dd7c3a90 100644
+index 3db4eab4ba..39bc0e77c9 100644
 --- a/Documentation/git-send-email.txt
 +++ b/Documentation/git-send-email.txt
-@@ -215,8 +215,7 @@ a password is obtained using 'git-credential'.
- 	specify a full pathname of a sendmail-like program instead;
- 	the program must support the `-i` option.  Default value can
- 	be specified by the `sendemail.smtpServer` configuration
-	option; the built-in default is to search for `sendmail` in
-	`/usr/sbin`, `/usr/lib` and $PATH if such program is
-+	option; the built-in default is to search in $PATH if such program is
- 	available, falling back to `localhost` otherwise.
- 
- --smtp-server-port=<port>::
+@@ -220,9 +220,9 @@ a password is obtained using 'git-credential'.
+ --smtp-server=<host>::
+ 	If set, specifies the outgoing SMTP server to use (e.g.
+ 	`smtp.example.com` or a raw IP address).  If unspecified, and if
+-	`--sendmail-cmd` is also unspecified, the default is to search
+-	for `sendmail` in `/usr/sbin`, `/usr/lib` and $PATH if such a
+-	program is available, falling back to `localhost` otherwise.
+	`--sendmail-cmd` is also unspecified, the default is to search for
+	`sendmail` in $PATH if such a program is available, falling back to
+	`localhost` otherwise.
+ +
+ For backward compatibility, this option can also specify a full pathname
+ of a sendmail-like program instead; the program must support the `-i`
 diff --git a/git-send-email.perl b/git-send-email.perl
-index 8eb63b5a2f..74a61d8213 100755
+index e65d969d0b..508d49483d 100755
 --- a/git-send-email.perl
 +++ b/git-send-email.perl
-@@ -956,8 +956,7 @@ sub expand_one_alias {
+@@ -1066,8 +1066,7 @@ sub expand_one_alias {
 }
 
- if (!defined $smtp_server) {
+ if (!defined $sendmail_cmd && !defined $smtp_server) {
 -	my @sendmail_paths = qw( /usr/sbin/sendmail /usr/lib/sendmail );
 -	push @sendmail_paths, map {"$_/sendmail"} split /:/, $ENV{PATH};
 +	my @sendmail_paths = map {"$_/sendmail"} split /:/, $ENV{PATH};
 	foreach (@sendmail_paths) {
 		if (-x $_) {
- 			$smtp_server = $_;
+ 			$sendmail_cmd = $_;
--- a/pkgs/applications/version-management/git-and-tools/gitui/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, libiconv, perl, python3, Security, AppKit, openssl, xclip }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, libiconv, perl, python3, Security, AppKit, openssl, xclip, pkg-config }:
 rustPlatform.buildRustPackage rec {
  pname = "gitui";
  version = "0.17.1";
@ -12,11 +12,14 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "sha256-9uRvxax0SrvRkD89mbZPxsfRItde11joA/ZgnXK9XBE=";

-  nativeBuildInputs = [ python3 perl ];
+  nativeBuildInputs = [ python3 perl pkg-config ];
  buildInputs = [ openssl ]
    ++ lib.optional stdenv.isLinux xclip
    ++ lib.optionals stdenv.isDarwin [ libiconv Security AppKit ];

+  # Needed to get openssl-sys to use pkg-config.
+  OPENSSL_NO_VENDOR = 1;
+
  meta = with lib; {
    description = "Blazing fast terminal-ui for git written in rust";
    homepage = "https://github.com/extrawurst/gitui";
--- a/pkgs/applications/version-management/git-and-tools/radicle-upstream/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/radicle-upstream/default.nix
@ -2,17 +2,17 @@

 let
  pname = "radicle-upstream";
-  version = "0.2.9";
+  version = "0.2.10";
  name = "${pname}-${version}";

  srcs = {
    x86_64-linux = fetchurl {
      url = "https://releases.radicle.xyz/radicle-upstream-${version}.AppImage";
-      sha256 = "sha256-chju3ZEFFLOzE9FakUK2izm/5ejELdL/iWMtM3bRpWY=";
+      sha256 = "sha256-iZC7FzYaQsCoAq/soi5g2oo/Xd2PtZgO/wR8zDgN4Fk=";
    };
    x86_64-darwin = fetchurl {
      url = "https://releases.radicle.xyz/radicle-upstream-${version}.dmg";
-      sha256 = "sha256-OOqe4diRcJWHHOa6jBpljPoA3FQOKlghMhKGQ242GnM=";
+      sha256 = "sha256-gc5OrNu7t0VJrjLQO7+7TWvEj7D51WmMJfL/KQDMgvA=";
    };
  };
  src = srcs.${stdenv.hostPlatform.system};
--- a/pkgs/applications/version-management/git-and-tools/thicket/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/thicket/default.nix
@ -8,13 +8,13 @@ let

 in crystal.buildCrystalPackage rec {
  pname = "thicket";
-  version = "0.1.4";
+  version = "0.1.5";

  src = fetchFromGitHub {
    owner = "taylorthurlow";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-A89E0CbV7VFB7W4ycFcZloP0J/d42agEuD+hs9a6a6E=";
+    sha256 = "sha256-7X1RKj/FWgJdgA7P746hU0ndUM49fH79ZNRSkvNZYFg=";
  };

  format = "shards";
--- a/pkgs/applications/video/streamlink/default.nix
+++ b/pkgs/applications/video/streamlink/default.nix
@ -1,35 +1,33 @@
 { lib
-, python3
-, fetchFromGitHub
+, python3Packages
 , rtmpdump
 , ffmpeg
 }:

-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "streamlink";
-  version = "2.3.0";
+  version = "2.4.0";

-  src = fetchFromGitHub {
-    owner = "streamlink";
-    repo = "streamlink";
-    rev = version;
-    sha256 = "sha256-lsurDFvVHn1rxR3bgG7BY512ISavpja36/UaKXauf+g=";
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "e95588e222d1a7bd51e3171cd4bce84fd6f646418537aff37993d40f597810af";
  };

-  checkInputs = with python3.pkgs; [
+  checkInputs = with python3Packages; [
    pytestCheckHook
    mock
    requests-mock
    freezegun
  ];

-  propagatedBuildInputs = (with python3.pkgs; [
+  propagatedBuildInputs = (with python3Packages; [
    pycryptodome
    requests
    iso-639
    iso3166
    websocket-client
    isodate
+    lxml
  ]) ++ [
    rtmpdump
    ffmpeg
@ -38,11 +36,11 @@ python3.pkgs.buildPythonApplication rec {
  # note that upstream currently uses requests 2.25.1 in Windows builds
  postPatch = ''
    substituteInPlace setup.py \
-      --replace 'requests>=2.26.0,<3.0' 'requests>=2.25.1,<3.0'
+      --replace 'requests>=2.26.0,<3.0' 'requests'
  '';

  meta = with lib; {
-    homepage = "https://github.com/streamlink/streamlink";
+    homepage = "https://streamlink.github.io/";
    description = "CLI for extracting streams from various websites to video player of your choosing";
    longDescription = ''
      Streamlink is a CLI utility that pipes videos from online
@ -51,6 +49,7 @@ python3.pkgs.buildPythonApplication rec {

      Streamlink is a fork of the livestreamer project.
    '';
+    changelog = "https://github.com/streamlink/streamlink/raw/${version}/CHANGELOG.md";
    license = licenses.bsd2;
    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ dezgeg zraexy DeeUnderscore ];
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -50,12 +50,12 @@ stdenv.mkDerivation rec {
    sha256 = "1f9hz8rf12jm8baa7kda34yl4hyl0xh0c4ap03krfjx23i3img47";
  };

-  nativeBuildInputs = [ python python.pkgs.sphinx pkg-config flex bison meson ninja ]
+  nativeBuildInputs = [ makeWrapper python python.pkgs.sphinx pkg-config flex bison meson ninja ]
    ++ lib.optionals gtkSupport [ wrapGAppsHook ]
    ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];

  buildInputs = [ zlib glib perl pixman
-    vde2 texinfo makeWrapper lzo snappy
+    vde2 texinfo lzo snappy
    gnutls nettle curl
  ]
    ++ lib.optionals ncursesSupport [ ncurses ]
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , asciidoc
 , cmake
 , expat
@ -48,6 +49,15 @@ stdenv.mkDerivation rec {
    hash = "sha256-R06tiWS9z6K5Nbi+vvk7DyozpcFdrHleMeh7Iq/FfHQ=";
  };

+  patches = [
+    # https://github.com/ice-wm/icewm/pull/57
+    # Fix trailing -I that leads to "to generate dependencies you must specify either '-M' or '-MM'"
+    (fetchpatch {
+      url = "https://github.com/ice-wm/icewm/pull/57/commits/ebd2c45341cc31755758a423392a0f78a64d2d37.patch";
+      sha256 = "16m9znd3ijcfl7la3l27ac3clx8l9qng3fprkpxqcifd89ny1ml5";
+    })
+  ];
+
  nativeBuildInputs = [
    asciidoc
    cmake
--- a/pkgs/applications/window-managers/yabar/build.nix
+++ b/pkgs/applications/window-managers/yabar/build.nix
@ -19,16 +19,33 @@ stdenv.mkDerivation {

  hardeningDisable = [ "format" ];

-  nativeBuildInputs = [ pkg-config ];
+  strictDeps = true;
+  depsBuildBuild = [
+    pkg-config
+  ];
+  nativeBuildInputs = [
+    pkg-config
+    asciidoc
+    docbook_xsl
+    libxslt
+    makeWrapper
+    libconfig
+    pango
+  ];
  buildInputs = [
-    cairo gdk-pixbuf libconfig pango xcbutilwm docbook_xsl
-    alsa-lib wirelesstools asciidoc libxslt makeWrapper
+    cairo
+    gdk-pixbuf
+    libconfig
+    pango
+    xcbutilwm
+    alsa-lib
+    wirelesstools
  ];

  postPatch = ''
    substituteInPlace ./Makefile \
      --replace "\$(shell git describe)" "${version}" \
-      --replace "a2x" "${asciidoc}/bin/a2x --no-xmllint"
+      --replace "a2x" "a2x --no-xmllint"
  '';

  makeFlags = [ "DESTDIR=$(out)" "PREFIX=/" ];
--- a/pkgs/build-support/alternatives/blas/default.nix
+++ b/pkgs/build-support/alternatives/blas/default.nix
@ -31,7 +31,6 @@ let
                       else stdenv.hostPlatform.extensions.sharedLibrary;


-  isILP64 = blasProvider.blas64 or false;
  blasImplementation = lib.getName blasProvider;

 in
--- a/pkgs/build-support/buildenv/builder.pl
+++ b/pkgs/build-support/buildenv/builder.pl
@ -10,7 +10,11 @@ use JSON::PP;

 STDOUT->autoflush(1);

+$SIG{__WARN__} = sub { warn "warning: ", @_ };
+$SIG{__DIE__}  = sub { die "error: ", @_ };
+
 my $out = $ENV{"out"};
+my $extraPrefix = $ENV{"extraPrefix"};

 my @pathsToLink = split ' ', $ENV{"pathsToLink"};

@ -88,6 +92,10 @@ sub findFilesInDir {
 sub checkCollision {
    my ($path1, $path2) = @_;

+    if (! -e $path1 || ! -e $path2) {
+        return 0;
+    }
+
    my $stat1 = (stat($path1))[2];
    my $stat2 = (stat($path2))[2];

@ -101,6 +109,11 @@ sub checkCollision {
    return compare($path1, $path2) == 0;
 }

+sub prependDangling {
+    my $path = shift;
+    return (-l $path && ! -e $path ? "dangling symlink " : "") . "`$path'";
+}
+
 sub findFiles {
    my ($relName, $target, $baseName, $ignoreCollisions, $checkCollisionContents, $priority) = @_;

@ -125,12 +138,21 @@ sub findFiles {
    # symlink to a file (not a directory) in a lower-priority package,
    # overwrite it.
    if (!defined $oldTarget || ($priority < $oldPriority && ($oldTarget ne "" && ! -d $oldTarget))) {
+        # If target is a dangling symlink, emit a warning.
+        if (-l $target && ! -e $target) {
+            my $link = readlink $target;
+            warn "creating dangling symlink `$out$extraPrefix/$relName' -> `$target' -> `$link'\n";
+        }
        $symlinks{$relName} = [$target, $priority];
        return;
    }

    # If target already exists and both targets resolves to the same path, skip
-    if (defined $oldTarget && $oldTarget ne "" && abs_path($target) eq abs_path($oldTarget)) {
+    if (
+        defined $oldTarget && $oldTarget ne "" &&
+        defined abs_path($target) && defined abs_path($oldTarget) &&
+        abs_path($target) eq abs_path($oldTarget)
+    ) {
        # Prefer the target that is not a symlink, if any
        if (-l $oldTarget && ! -l $target) {
            $symlinks{$relName} = [$target, $priority];
@ -144,14 +166,25 @@ sub findFiles {
        return;
    }

+    # If target is supposed to be a directory but it isn't, die with an error message
+    # instead of attempting to recurse into it, only to fail then.
+    # This happens e.g. when pathsToLink contains a non-directory path.
+    if ($oldTarget eq "" && ! -d $target) {
+        die "not a directory: `$target'\n";
+    }
+
    unless (-d $target && ($oldTarget eq "" || -d $oldTarget)) {
+        # Prepend "dangling symlink" to paths if applicable.
+        my $targetRef = prependDangling($target);
+        my $oldTargetRef = prependDangling($oldTarget);
+
        if ($ignoreCollisions) {
-            warn "collision between `$target' and `$oldTarget'\n" if $ignoreCollisions == 1;
+            warn "collision between $targetRef and $oldTargetRef\n" if $ignoreCollisions == 1;
            return;
        } elsif ($checkCollisionContents && checkCollision($oldTarget, $target)) {
            return;
        } else {
-            die "collision between `$target' and `$oldTarget'\n";
+            die "collision between $targetRef and $oldTargetRef\n";
        }
    }

@ -224,7 +257,6 @@ while (scalar(keys %postponed) > 0) {


 # Create the symlinks.
-my $extraPrefix = $ENV{"extraPrefix"};
 my $nrLinks = 0;
 foreach my $relName (sort keys %symlinks) {
    my ($target, $priority) = @{$symlinks{$relName}};
--- a/pkgs/build-support/ocaml/default.nix
+++ b/pkgs/build-support/ocaml/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, writeText, ocaml, findlib, ocamlbuild, camlp4 }:

-{ name, version, buildInputs ? [],
+{ name, version, nativeBuildInputs ? [],
  createFindlibDestdir ?  true,
  dontStrip ? true,
  minimumSupportedOcamlVersion ? null,
@ -19,7 +19,7 @@ in
 stdenv.mkDerivation (args // {
  name = "ocaml-${name}-${version}";

-  buildInputs = [ ocaml findlib ocamlbuild camlp4 ] ++ buildInputs;
+  nativeBuildInputs = [ ocaml findlib ocamlbuild camlp4 ] ++ nativeBuildInputs;

  setupHook = if setupHook == null && hasSharedObjects
  then writeText "setupHook.sh" ''
--- a/pkgs/build-support/ocaml/dune.nix
+++ b/pkgs/build-support/ocaml/dune.nix
@ -1,6 +1,6 @@
 { lib, stdenv, ocaml, findlib, dune_1, dune_2 }:

-{ pname, version, buildInputs ? [], enableParallelBuilding ? true, ... }@args:
+{ pname, version, nativeBuildInputs ? [], enableParallelBuilding ? true, ... }@args:

 let Dune = if args.useDune2 or false then dune_2 else dune_1; in

@ -12,6 +12,8 @@ else
 stdenv.mkDerivation ({

  inherit enableParallelBuilding;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];

  buildPhase = ''
    runHook preBuild
@ -33,7 +35,7 @@ stdenv.mkDerivation ({

  name = "ocaml${ocaml.version}-${pname}-${version}";

-  buildInputs = [ ocaml Dune findlib ] ++ buildInputs;
+  nativeBuildInputs = [ ocaml Dune findlib ] ++ nativeBuildInputs;

  meta = (args.meta or {}) // { platforms = args.meta.platforms or ocaml.meta.platforms; };

--- a/pkgs/build-support/setup-hooks/autoreconf.sh
+++ b/pkgs/build-support/setup-hooks/autoreconf.sh
@ -1,4 +1,4 @@
-preConfigurePhases+=" autoreconfPhase"
+preConfigurePhases="${preConfigurePhases:-} autoreconfPhase"

 autoreconfPhase() {
    runHook preAutoreconf
--- a/pkgs/build-support/setup-hooks/reproducible-builds.sh
+++ b/pkgs/build-support/setup-hooks/reproducible-builds.sh
@ -2,8 +2,9 @@
 # This should ensure that it is deterministic across rebuilds of the same
 # derivation and not easily collide with other builds.
 # We also truncate the hash so that it cannot cause reference cycles.
-export NIX_CFLAGS_COMPILE+=" -frandom-seed=$(
+NIX_CFLAGS_COMPILE="${NIX_CFLAGS_COMPILE:-} -frandom-seed=$(
    outbase="${out##*/}"
    randomseed="${outbase:0:10}"
    echo $randomseed
 )"
+export NIX_CFLAGS_COMPILE
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@ -14,7 +14,7 @@ _separateDebugInfo() {
    dst="$dst/lib/debug/.build-id"

    # Find executables and dynamic libraries.
-    local i magic
+    local i
    while IFS= read -r -d $'\0' i; do
        if ! isELF "$i"; then continue; fi

--- a/pkgs/data/fonts/openmoji/default.nix
+++ b/pkgs/data/fonts/openmoji/default.nix
@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, scfbuild
+, nodejs
+, nodePackages
+, python3Packages
+, variant ? "color" # "color" or "black"
+}:
+
+let
+  filename = builtins.replaceStrings
+    [ "color"              "black"              ]
+    [ "OpenMoji-Color.ttf" "OpenMoji-Black.ttf" ]
+    variant;
+
+in stdenv.mkDerivation rec {
+  pname = "openmoji";
+  version = "13.1.0";
+
+  src = fetchFromGitHub {
+    owner = "hfg-gmuend";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-7G6a+LFq79njyPhnDhhSJ98Smw5fWlfcsFj6nWBPsSk=";
+  };
+
+  nativeBuildInputs = [
+    scfbuild
+    nodejs
+    nodePackages.glob
+    nodePackages.lodash
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    node helpers/generate-font-glyphs.js
+
+    cd font
+    scfbuild -c scfbuild-${variant}.yml
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    install -Dm644 ${filename} $out/share/fonts/truetype/${filename}
+  '';
+
+  meta = with lib; {
+    license = licenses.cc-by-sa-40;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+    homepage = "https://openmoji.org/";
+    downloadPage = "https://github.com/hfg-gmuend/openmoji/releases";
+    description = "Open-source emojis for designers, developers and everyone else";
+  };
+}
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@ -1,28 +1,17 @@
-{ lib, stdenv, fetchurl, nss, python3
-, blacklist ? []
+{ lib
+, stdenv
+, fetchurl
+, nss
+, python3
+, blacklist ? [ ]

-# Used for tests only
+  # Used for tests only
 , runCommand
 , cacert
 , openssl
 }:

-with lib;
-
 let
-  version = "3.66";
-
-  underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
-in
-
-stdenv.mkDerivation {
-  name = "nss-cacert-${version}";
-
-  src = fetchurl {
-    url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz";
-    sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
-  };
-
  certdata2pem = fetchurl {
    name = "certdata2pem.py";
    urls = [
@ -31,6 +20,16 @@ stdenv.mkDerivation {
    ];
    sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy";
  };
+in
+
+stdenv.mkDerivation rec {
+  pname = "nss-cacert";
+  version = "3.66";
+
+  src = fetchurl {
+    url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
+    sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
+  };

  outputs = [ "out" "unbundled" ];

@ -40,11 +39,11 @@ stdenv.mkDerivation {
    ln -s nss/lib/ckfw/builtins/certdata.txt

    cat << EOF > blacklist.txt
-    ${concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
+    ${lib.concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
    EOF

    # copy from the store, otherwise python will scan it for imports
-    cat "$certdata2pem" > certdata2pem.py
+    cat "${certdata2pem}" > certdata2pem.py
  '';

  buildPhase = ''
@ -63,61 +62,66 @@ stdenv.mkDerivation {
    # install individual certs in unbundled output
    mkdir -pv $unbundled/etc/ssl/certs
    cp -v *.crt $unbundled/etc/ssl/certs
-    rm -f $unbundled/etc/ssl/certs/ca-bundle.crt  # not wanted in unbundled
+    rm $unbundled/etc/ssl/certs/ca-bundle.crt  # not wanted in unbundled
  '';

  setupHook = ./setup-hook.sh;

-  passthru.updateScript = ./update.sh;
-  passthru.tests = {
-    # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
-    blacklist-utf8 = let
-      blacklistCAToFingerprint = {
-        # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
-        "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
-        "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
-      };
-      mapBlacklist = f: concatStringsSep "\n" (mapAttrsToList f blacklistCAToFingerprint);
-    in runCommand "verify-the-cacert-filter-output" {
-      cacert = cacert.unbundled;
-      cacertWithExcludes = (cacert.override {
-        blacklist = builtins.attrNames blacklistCAToFingerprint;
-      }).unbundled;
+  passthru = {
+    updateScript = ./update.sh;
+    tests = {
+      # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
+      blacklist-utf8 =
+        let
+          blacklistCAToFingerprint = {
+            # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
+            "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
+            "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
+          };
+          mapBlacklist = f: lib.concatStringsSep "\n" (lib.mapAttrsToList f blacklistCAToFingerprint);
+        in
+        runCommand "verify-the-cacert-filter-output"
+          {
+            cacert = cacert.unbundled;
+            cacertWithExcludes = (cacert.override {
+              blacklist = builtins.attrNames blacklistCAToFingerprint;
+            }).unbundled;

-      nativeBuildInputs = [ openssl ];
-    } ''
-      isPresent() {
-        # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
-        for f in $1/etc/ssl/certs/*.crt; do
-          fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
-          if [[ "x$fingerprint" == "x$3" ]]; then
-            return 0
-          fi
-        done
-        return 1
-      }
+            nativeBuildInputs = [ openssl ];
+          } ''
+          isPresent() {
+            # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
+            for f in $1/etc/ssl/certs/*.crt; do
+              fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
+              if [[ "x$fingerprint" == "x$3" ]]; then
+                return 0
+              fi
+            done
+            return 1
+          }

-      # Ensure that each certificate is in the main "cacert".
-      ${mapBlacklist (caName: caFingerprint: ''
-        isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
-          echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
-          exit 1
-        })
-      '')}
+          # Ensure that each certificate is in the main "cacert".
+          ${mapBlacklist (caName: caFingerprint: ''
+            isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
+              echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
+              exit 1
+            })
+          '')}

-      # Ensure that each certificate is NOT in the "cacertWithExcludes".
-      ${mapBlacklist (caName: caFingerprint: ''
-        isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
-          echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
-          exit 1
-        })
-      '')}
+          # Ensure that each certificate is NOT in the "cacertWithExcludes".
+          ${mapBlacklist (caName: caFingerprint: ''
+            isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
+              echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
+              exit 1
+            })
+          '')}

-      touch $out
-    '';
+          touch $out
+        '';
+    };
  };

-  meta = {
+  meta = with lib; {
    homepage = "https://curl.haxx.se/docs/caextract.html";
    description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
    platforms = platforms.all;
--- a/pkgs/data/misc/mobile-broadband-provider-info/default.nix
+++ b/pkgs/data/misc/mobile-broadband-provider-info/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mobile-broadband-provider-info";
-  version = "20201225";
+  version = "20210805";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1g9x2i4xjm2sagaha07n9psacbylrwfrmfqkp17gjwhpyi6w0zqd";
+    sha256 = "sha256-a/ihVY6lVBr7xve0QV50zJ9aqYKbE07Ks+8ch0ElaLw=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/apps/file-roller/default.nix
+++ b/pkgs/desktops/gnome/apps/file-roller/default.nix
@ -25,10 +25,11 @@ stdenv.mkDerivation rec {
    patchShebangs data/set-mime-type-entry.py
  '';

-  postFixup = ''
+  preFixup = ''
    # Workaround because of https://gitlab.gnome.org/GNOME/file-roller/issues/40
-    wrapProgram "$out/bin/file-roller" \
+    gappsWrapperArgs+=(
      --prefix PATH : ${lib.makeBinPath [ unzip ]}
+    )
  '';

  passthru = {
--- a/pkgs/desktops/gnome/core/yelp-xsl/default.nix
+++ b/pkgs/desktops/gnome/core/yelp-xsl/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "yelp-xsl";
-  version = "40.0";
+  version = "40.2";

  src = fetchurl {
    url = "mirror://gnome/sources/yelp-xsl/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Nh7NTTP8zbO7CKaH9g5cPpCdLp47Ai2ETgSYINDPYrA=";
+    sha256 = "sha256-kZxVL4RqrsdB/lHVr0FrRpvNslx37/w7WhWktLf/gU4=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/extensions/arcmenu/default.nix
+++ b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-shell-extension-arcmenu";
-  version = "12";
+  version = "14";

  src = fetchFromGitLab {
    owner = "arcmenu";
    repo = "ArcMenu";
    rev = "v${version}";
-    sha256 = "sha256-R1OUDf/YMyMlxwXM9rNsrasPumHEoYhJK0evnYGeIkA=";
+    sha256 = "sha256-Iobu5eNWSvAiTRe6wyx/0PgUtB9QIC9KdH0M1xhsM1I=";
  };

  patches = [
--- a/pkgs/development/compilers/ecl/default.nix
+++ b/pkgs/development/compilers/ecl/default.nix
@ -16,7 +16,7 @@ let
    url="https://common-lisp.net/project/ecl/static/files/release/${name}.tgz";
    sha256="000906nnq25177bgsfndiw3iqqgrjc9spk10hzk653sbz3f7anmi";
  };
-  buildInputs = [
+  nativeBuildInputs = [
    libtool autoconf automake texinfo makeWrapper
  ];
  propagatedBuildInputs = [
@ -29,7 +29,7 @@ let
 in
 stdenv.mkDerivation {
  inherit (s) name version;
-  inherit buildInputs propagatedBuildInputs;
+  inherit nativeBuildInputs propagatedBuildInputs;

  src = fetchurl {
    inherit (s) url sha256;
--- a/pkgs/development/compilers/ghc/8.10.7.nix
+++ b/pkgs/development/compilers/ghc/8.10.7.nix
@ -129,7 +129,8 @@ let
  # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
  # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
  # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl && !targetPlatform.isWindows);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);

  runtimeDeps = [
    targetPackages.stdenv.cc.bintools
--- a/pkgs/development/compilers/ghc/8.8.4.nix
+++ b/pkgs/development/compilers/ghc/8.8.4.nix
@ -137,7 +137,8 @@ let
  # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
  # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
  # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl && !targetPlatform.isWindows);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);

  runtimeDeps = [
    targetPackages.stdenv.cc.bintools
--- a/pkgs/development/compilers/ghc/9.0.1.nix
+++ b/pkgs/development/compilers/ghc/9.0.1.nix
@ -123,7 +123,8 @@ let
  # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
  # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
  # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);

  runtimeDeps = [
    targetPackages.stdenv.cc.bintools
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@ -133,7 +133,8 @@ let
  # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
  # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
  # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);

  runtimeDeps = [
    targetPackages.stdenv.cc.bintools
--- a/pkgs/development/compilers/llvm/12/compiler-rt/darwin-targetconditionals.patch
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/darwin-targetconditionals.patch
@ -1,71 +0,0 @@
-diff --git a/lib/sanitizer_common/sanitizer_mac.cpp b/lib/sanitizer_common/sanitizer_mac.cpp
--- a/lib/sanitizer_common/sanitizer_mac.cpp
-+++ b/lib/sanitizer_common/sanitizer_mac.cpp
-@@ -613,9 +613,15 @@ HandleSignalMode GetHandleSignalMode(int signum) {
- // Offset example:
- // XNU 17 -- macOS 10.13 -- iOS 11 -- tvOS 11 -- watchOS 4
- constexpr u16 GetOSMajorKernelOffset() {
-  if (TARGET_OS_OSX) return 4;
-  if (TARGET_OS_IOS || TARGET_OS_TV) return 6;
-  if (TARGET_OS_WATCH) return 13;
-+#if TARGET_OS_OSX
-+  return 4;
-+#endif
-+#if TARGET_OS_IOS || TARGET_OS_TV
-+  return 6;
-+#endif
-+#if TARGET_OS_WATCH
-+  return 13;
-+#endif
- }
- 
- using VersStr = char[64];
-@@ -627,13 +633,13 @@ static uptr ApproximateOSVersionViaKernelVersion(VersStr vers) {
-   u16 os_major = kernel_major - offset;
- 
-   const char *format = "%d.0";
-  if (TARGET_OS_OSX) {
-    if (os_major >= 16) {  // macOS 11+
-      os_major -= 5;
-    } else {  // macOS 10.15 and below
-      format = "10.%d";
-    }
-+#if TARGET_OS_OSX
-+  if (os_major >= 16) {  // macOS 11+
-+    os_major -= 5;
-+  } else {  // macOS 10.15 and below
-+    format = "10.%d";
-   }
-+#endif
-   return internal_snprintf(vers, sizeof(VersStr), format, os_major);
- }
- 
-@@ -681,15 +687,14 @@ void ParseVersion(const char *vers, u16 *major, u16 *minor) {
- // Aligned versions example:
- // macOS 10.15 -- iOS 13 -- tvOS 13 -- watchOS 6
- static void MapToMacos(u16 *major, u16 *minor) {
-  if (TARGET_OS_OSX)
-    return;
-
-  if (TARGET_OS_IOS || TARGET_OS_TV)
-+#if !TARGET_OS_OSX
-+#if TARGET_OS_IOS || TARGET_OS_TV
-     *major += 2;
-  else if (TARGET_OS_WATCH)
-+#elif TARGET_OS_WATCH
-     *major += 9;
-  else
-+#else
-     UNREACHABLE("unsupported platform");
-+#endif
- 
-   if (*major >= 16) {  // macOS 11+
-     *major -= 5;
-@@ -697,6 +702,7 @@ static void MapToMacos(u16 *major, u16 *minor) {
-     *minor = *major;
-     *major = 10;
-   }
-+#endif
- }
- 
- static MacosVersion GetMacosAlignedVersionInternal() {
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@ -59,8 +59,6 @@ stdenv.mkDerivation {
    # extra `/`.
    ./normalize-var.patch
  ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    # Prevent a compilation error on darwin
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
--- a/pkgs/development/compilers/mit-scheme/default.nix
+++ b/pkgs/development/compilers/mit-scheme/default.nix
@ -62,10 +62,10 @@ stdenv.mkDerivation {
    runHook postInstall
  '';

-  postFixup =
-    '' wrapProgram $out/bin/mit-scheme${arch} --set MITSCHEME_LIBRARY_PATH \
-         $out/lib/mit-scheme${arch}
-    '';
+  postFixup = ''
+    wrapProgram $out/bin/mit-scheme${arch}-${version} --set MITSCHEME_LIBRARY_PATH \
+      $out/lib/mit-scheme${arch}-${version}
+  '';

  nativeBuildInputs = [ makeWrapper gnum4 texinfo texLive automake ghostscript autoconf libtool ];

--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@ -3,7 +3,7 @@
 let
  versionNoPatch = "${toString major_version}.${toString minor_version}";
  version = "${versionNoPatch}.${toString patch_version}";
-  safeX11 = stdenv: !(stdenv.isAarch32 || stdenv.isMips);
+  safeX11 = stdenv: !(stdenv.isAarch32 || stdenv.isMips || stdenv.hostPlatform.isStatic);
 in

 { lib, stdenv, fetchurl, ncurses, buildEnv, libunwind
@ -13,7 +13,7 @@ in
 , spaceTimeSupport ? false
 }:

-assert useX11 -> !stdenv.isAarch32 && !stdenv.isMips;
+assert useX11 -> safeX11 stdenv;
 assert aflSupport -> lib.versionAtLeast version "4.05";
 assert flambdaSupport -> lib.versionAtLeast version "4.03";
 assert spaceTimeSupport -> lib.versionAtLeast version "4.04";
@ -44,6 +44,8 @@ stdenv.mkDerivation (args // {

  inherit src;

+  strictDeps = true;
+
  prefixKey = "-prefix ";
  configureFlags =
    let flags = new: old:
@ -56,7 +58,15 @@ stdenv.mkDerivation (args // {
  ++ optional aflSupport (flags "--with-afl" "-afl-instrument")
  ++ optional flambdaSupport (flags "--enable-flambda" "-flambda")
  ++ optional spaceTimeSupport (flags "--enable-spacetime" "-spacetime")
-  ;
+  ++ optional (stdenv.hostPlatform.isStatic && (lib.versionOlder version "4.08")) "-no-shared-libs"
+  ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && lib.versionOlder version "4.08") [
+    "-host ${stdenv.hostPlatform.config}"
+    "-target ${stdenv.targetPlatform.config}"
+  ];
+  dontAddStaticConfigureFlags = lib.versionOlder version "4.08";
+  configurePlatforms = lib.optionals (lib.versionAtLeast version "4.08") [ "host" "target" ];
+  # x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
+  hardeningDisable = lib.optional (lib.versionAtLeast version "4.09" && stdenv.hostPlatform.isMusl) "pie";

  buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
  buildInputs = optional (!lib.versionAtLeast version "4.07") ncurses
@ -70,6 +80,8 @@ stdenv.mkDerivation (args // {
    # Do what upstream does by default now: https://github.com/ocaml/ocaml/pull/10176
    # This is required for aarch64-darwin, everything else works as is.
    AS="${stdenv.cc}/bin/cc -c" ASPP="${stdenv.cc}/bin/cc -c"
+  '' + optionalString (lib.versionOlder version "4.08" && stdenv.hostPlatform.isStatic) ''
+    configureFlagsArray+=("-cc" "$CC" "-as" "$AS" "-partialld" "$LD -r")
  '';
  postBuild = ''
    mkdir -p $out/include
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@ -24,6 +24,11 @@ let

    dontUseCmakeConfigure = true;

+    postPatch = ''
+      substituteInPlace buildSrc/linux.gradle \
+        --replace ', "-Werror=implicit-function-declaration"' ""
+    '';
+
    config = writeText "gradle.properties" (''
      CONF = Release
      JDK_HOME = ${openjdk11-bootstrap.home}
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@ -12,6 +12,11 @@ in stdenv.mkDerivation rec {
    sha256 = "1w0qmyj3v9sb2g7ff39pp38b9850y9hyy0bag26ifrby5f7ksvm6";
  };

+  postPatch = lib.optionalString stdenv.isAarch32 ''
+    # https://gitlab.freedesktop.org/gstreamer/orc/-/issues/20
+    sed -i '/exec_opcodes_sys/d' testsuite/meson.build
+  '';
+
  outputs = [ "out" "dev" ]
     ++ optional buildDevDoc "devdoc"
  ;
--- a/pkgs/development/compilers/rust/1_54.nix
+++ b/pkgs/development/compilers/rust/1_54.nix
@ -20,8 +20,8 @@
 } @ args:

 import ./default.nix {
-  rustcVersion = "1.53.0";
-  rustcSha256 = "1f95p259dfp5ca118bg107rj3rqwlswy65dxn3hg8sqgl4wwmxsw";
+  rustcVersion = "1.54.0";
+  rustcSha256 = "0xk9dhfff16caambmwij67zgshd8v9djw6ha0fnnanlv7rii31dc";

  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
  llvmSharedForHost = pkgsBuildHost.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
@ -34,24 +34,24 @@ import ./default.nix {

  # Note: the version MUST be one version prior to the version we're
  # building
-  bootstrapVersion = "1.52.1";
+  bootstrapVersion = "1.53.0";

  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
  bootstrapHashes = {
-    i686-unknown-linux-gnu = "c91f0431c8137a4e98e097ab47b49846820531aafb6e9c249b71b770771832e9";
-    x86_64-unknown-linux-gnu = "617ae06e212cb65bc4abbf52b158b0328b9f1a6c2f822c27c95b274d6fbc0627";
-    x86_64-unknown-linux-musl = "c3eae6e78ee29e03416897f89b54448b2a03d063f07a78cde41757ad2e02c2f0";
-    arm-unknown-linux-gnueabihf = "ef412d923a0c5a9fa54422f40cde62f2e85a62339057cb8b986a545b108d3347";
-    armv7-unknown-linux-gnueabihf = "ec47b3f5c801f8a4df7180e088dcc1817ee160df34ef64ddac4fa50f714f119f";
-    aarch64-unknown-linux-gnu = "17d9aa7bb73b819ef70d81013498727b7218533ee6cf3bd802c4eac29137fbcb";
-    aarch64-unknown-linux-musl = "f2bae2b32f05a90eec041352d9329deb3e907f5560b9fda525788df3b8008b6b";
-    x86_64-apple-darwin = "cfa73228ea54e2c94f75d1b142ea41444c463f4ee8562a3eca1b11b2fe8af95a";
-    aarch64-apple-darwin = "217e9723f828c5359467d69b363a342d702bdcbbcc4107be907e6bc4531f4912";
-    powerpc64le-unknown-linux-gnu = "f258c5d7d6d9022108672b7383412d930a5f59d7644d148e413c3ab0ae45604f";
-    riscv64gc-unknown-linux-gnu = "c1c98ccc8bb4147a819411a10162c8f8ce1aaa5c65cf2c74802dce4dacd6e64b";
+    i686-unknown-linux-gnu = "4ebeeba05448b9484bb2845dba2ff4c0e2b7208fa8b08bef2b2ca3b171d0db99";
+    x86_64-unknown-linux-gnu = "5e9e556d2ccce27aa8f01a528f1348bf8cdd34496c35ec2abf131660b9792fed";
+    x86_64-unknown-linux-musl = "908b6163b62660f289bcd1eda1a0eb6d849b4b29da12546d24a033e5718e93ff";
+    arm-unknown-linux-gnueabihf = "6ae3108f4a0b0478c76f5dbaf1827c9e4a983fa78a9f973b24d501e693cfdcab";
+    armv7-unknown-linux-gnueabihf = "886e78f7c5bd92e16322ca3af70d1899c064837343cdfeb9a216b76edfd18157";
+    aarch64-unknown-linux-gnu = "cba81d5c3d16deee04098ea18af8636bc7415315a44c9e44734fd669aa778040";
+    aarch64-unknown-linux-musl = "a0065a6313bf370f2844af6f3b47fe292360e9cca3da31b5f6cb32db311ba686";
+    x86_64-apple-darwin = "940a4488f907b871f9fb1be309086509e4a48efb19303f8b5fe115c6f12abf43";
+    aarch64-apple-darwin = "c519da905514c05240a8fe39e459de2c4ef5943535e3655502e8fb756070aee1";
+    powerpc64le-unknown-linux-gnu = "9f6c17427d1023b10694e4ba60d6d9deec0aeb07d051f99763789ed18e07e2e6";
+    riscv64gc-unknown-linux-gnu = "6ae23ac00269df72b0790f10f2d9a98d03acf542c6090f4d30a87365fafd14ed";
  };

-  selectRustPackage = pkgs: pkgs.rust_1_53;
+  selectRustPackage = pkgs: pkgs.rust_1_54;

  rustcPatches = [
  ];
--- a/pkgs/development/compilers/yasm/default.nix
+++ b/pkgs/development/compilers/yasm/default.nix
@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl}:

 stdenv.mkDerivation rec {
-  name = "yasm-1.3.0";
+  pname = "yasm";
+  version = "1.3.0";

  src = fetchurl {
-    url = "https://www.tortall.net/projects/yasm/releases/${name}.tar.gz";
+    url = "https://www.tortall.net/projects/yasm/releases/yasm-${version}.tar.gz";
    sha256 = "0gv0slmm0qpq91za3v2v9glff3il594x5xsrbgab7xcmnh0ndkix";
  };

--- a/pkgs/development/coq-modules/ceres/default.nix
+++ b/pkgs/development/coq-modules/ceres/default.nix
@ -0,0 +1,19 @@
+{ lib, mkCoqDerivation, coq, version ? null }:
+
+with lib;
+mkCoqDerivation {
+
+  pname = "ceres";
+  repo = "coq-ceres";
+  owner = "Lysxia";
+
+  inherit version;
+  defaultVersion = if versions.isGe "8.8" coq.version then "0.4.0" else null;
+  release."0.4.0".sha256 = "sha256:0zwp3pn6fdj0qdig734zdczrls886al06mxqhhabms0jvvqijmbi";
+
+  meta = {
+    description = "Library for serialization to S-expressions";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Zimmi48 ];
+  };
+}
--- a/pkgs/development/coq-modules/parsec/default.nix
+++ b/pkgs/development/coq-modules/parsec/default.nix
@ -0,0 +1,22 @@
+{ lib, mkCoqDerivation, coq, ceres, coq-ext-lib, version ? null }:
+
+with lib;
+mkCoqDerivation {
+
+  pname = "parsec";
+  repo = "coq-parsec";
+  owner = "liyishuai";
+
+  propagatedBuildInputs = [ ceres coq-ext-lib ];
+  releaseRev = (v: "v${v}");
+
+  inherit version;
+  defaultVersion = if versions.isGe "8.12" coq.version then "0.1.0" else null;
+  release."0.1.0".sha256 = "sha256:01avfcqirz2b9wjzi9iywbhz9szybpnnj3672dgkfsimyg9jgnsr";
+
+  meta = {
+    description = "Library for serialization to S-expressions";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Zimmi48 ];
+  };
+}
--- a/pkgs/development/embedded/platformio/chrootenv.nix
+++ b/pkgs/development/embedded/platformio/chrootenv.nix
@ -23,7 +23,8 @@ in buildFHSUserEnv {
  name = "platformio";

  targetPkgs = pio-pkgs;
-  multiPkgs = pio-pkgs;
+  # disabled temporarily because fastdiff no longer support 32bit
+  # multiPkgs = pio-pkgs;

  meta = with lib; {
    description = "An open source ecosystem for IoT development";
--- a/pkgs/development/embedded/platformio/core.nix
+++ b/pkgs/development/embedded/platformio/core.nix
@ -1,5 +1,6 @@
 { stdenv, lib, python3
 , fetchFromGitHub
+, fetchPypi
 , git
 , spdx-license-list-data
 , version, src
@ -20,6 +21,15 @@ let
        doCheck = false;
      });

+      ajsonrpc = super.ajsonrpc.overridePythonAttrs (oldAttrs: rec {
+        pname = "ajsonrpc";
+        version = "1.1.0";
+        src = fetchPypi {
+          inherit pname version;
+          sha256 = "sha256-CgHCtW0gxZho7ZavvEaODNc+KbFW4sAsHtM2Xk5Cuaw=";
+        };
+      });
+
      click = super.click.overridePythonAttrs (oldAttrs: rec {
        version = "7.1.2";
        src = oldAttrs.src.override {
@ -28,6 +38,18 @@ let
        };
      });

+      starlette = super.starlette.overridePythonAttrs (oldAttrs: rec {
+        pname = "starlette";
+        version = "0.14.2";
+        src = fetchFromGitHub {
+          owner = "encode";
+          repo = pname;
+          rev = version;
+          sha256 = "sha256-Ki5jTEr5w6CrGK6F60E9uvdUlGx8pxdHMpxHvj9D4js=";
+        };
+        doCheck = false;
+      });
+
      uvicorn = super.uvicorn.overridePythonAttrs (oldAttrs: rec {
        version = "0.13.2";
        src = fetchFromGitHub {
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@ -86,6 +86,8 @@ let

    configureScript = optionalString (!crossCompiling) "${stdenv.shell} ./Configure";

+    dontAddStaticConfigureFlags = true;
+
    dontAddPrefix = !crossCompiling;

    enableParallelBuilding = !crossCompiling;
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -26,10 +26,10 @@
 , sourceVersion
 , sha256
 , passthruFun
-, static ? false
+, static ? stdenv.hostPlatform.isStatic
 , stripBytecode ? reproducibleBuild
 , rebuildBytecode ? true
-, reproducibleBuild ? true
+, reproducibleBuild ? false
 , enableOptimizations ? false
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:
@ -48,6 +48,8 @@ assert lib.assertMsg (reproducibleBuild -> stripBytecode)
 assert lib.assertMsg (reproducibleBuild -> (!enableOptimizations))
  "Deterministic builds are not achieved when optimizations are enabled.";

+assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
+  "Deterministic builds are not achieved when (default unoptimized) bytecode is created.";

 with lib;

@ -185,8 +187,9 @@ let

  configureFlags = optionals enableOptimizations [
    "--enable-optimizations"
-  ] ++ [
+  ] ++ optionals (!static) [
    "--enable-shared"
+  ] ++ [
    "--with-threads"
    "--enable-unicode=ucs${toString ucsEncoding}"
  ] ++ optionals (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) [
@ -224,6 +227,7 @@ let
  ++ optional stdenv.hostPlatform.isLinux "ac_cv_func_lchmod=no"
  ++ optional static "LDFLAGS=-static";

+  strictDeps = true;
  buildInputs =
    optional (stdenv ? cc && stdenv.cc.libc != null) stdenv.cc.libc ++
    [ bzip2 openssl zlib ]
@ -296,8 +300,10 @@ in with passthru; stdenv.mkDerivation ({
        # First we delete all old bytecode.
        find $out -name "*.pyc" -delete
        '' + optionalString rebuildBytecode ''
-        # Then, we build for the two optimization levels.
-        # We do not build unoptimized bytecode, because its not entirely deterministic yet.
+        # We build 3 levels of optimized bytecode. Note the default level, without optimizations,
+        # is not reproducible yet. https://bugs.python.org/issue29708
+        # Not creating bytecode will result in a large performance loss however, so we do build it.
+        find $out -name "*.py" | ${pythonForBuildInterpreter} -m compileall -q -f -x "lib2to3" -i -
        find $out -name "*.py" | ${pythonForBuildInterpreter} -O  -m compileall -q -f -x "lib2to3" -i -
        find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i -
      '' + optionalString stdenv.hostPlatform.isCygwin ''
--- a/pkgs/development/interpreters/python/cpython/3.9/darwin-tcl-tk.patch
+++ b/pkgs/development/interpreters/python/cpython/3.9/darwin-tcl-tk.patch
@ -0,0 +1,15 @@
+diff --git a/setup.py b/setup.py
+index 04eb6b2..2e1160d 100644
+--- a/setup.py
+++ b/setup.py
+@@ -1981,8 +1981,8 @@ class PyBuildExt(build_ext):
+         # Rather than complicate the code below, detecting and building
+         # AquaTk is a separate method. Only one Tkinter will be built on
+         # Darwin - either AquaTk, if it is found, or X11 based Tk.
+-        if (MACOS and self.detect_tkinter_darwin()):
+-            return True
+        # if (MACOS and self.detect_tkinter_darwin()):
+        #     return True
+ 
+         # Assume we haven't found any of the libraries or include files
+         # The versions with dots are used on Unix, and the versions without
--- a/Show More
+++ b/Show More