Merge master into staging-next

2024-11-23 23:43:30 +00:00 · 2022-05-13 18:01:23 +00:00 · 2022-05-13 18:01:23 +00:00 · bcb22e9a7b
commit bcb22e9a7b
parent 477cc9463d 197681059f
108 changed files with 3175 additions and 666 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -331,6 +331,14 @@
          <link linkend="opt-services.tetrd.enable">services.tetrd</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://upterm.dev">uptermd</link>, an
+          open-source solution for sharing terminal sessions instantly
+          over the public internet via secure tunnels. Available at
+          <link linkend="opt-services.uptermd.enable">services.uptermd</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://github.com/mbrubeck/agate">agate</link>,
@ -1879,6 +1887,37 @@
          during the time when the timer was inactive.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          Mastodon now uses <literal>services.redis.servers</literal> to
+          start a new redis server, instead of using a global redis
+          server. This improves compatibility with other services that
+          use redis.
+        </para>
+        <para>
+          Note that this will recreate the redis database, although
+          according to the
+          <link xlink:href="https://docs.joinmastodon.org/admin/backups/">Mastodon
+          docs</link>, this is almost harmless:
+        </para>
+        <blockquote>
+          <para>
+            Losing the Redis database is almost harmless: The only
+            irrecoverable data will be the contents of the Sidekiq
+            queues and scheduled retries of previously failed jobs. The
+            home and list feeds are stored in Redis, but can be
+            regenerated with tootctl.
+          </para>
+        </blockquote>
+        <para>
+          If you do want to save the redis database, you can use the
+          following commands:
+        </para>
+        <programlisting language="bash">
+redis-cli save
+cp /var/lib/redis/dump.rdb &quot;/var/lib/redis-mastodon/dump.rdb&quot;
+</programlisting>
+      </listitem>
      <listitem>
        <para>
          If you are using Wayland you can choose to use the Ozone
@ -2413,6 +2452,14 @@
          desktop environments as needed.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>mercury</literal> was updated to 22.01.1, which has
+          some breaking changes
+          (<link xlink:href="https://dl.mercurylang.org/release/release-notes-22.01.html">Mercury
+          22.01 news</link>).
+        </para>
+      </listitem>
      <listitem>
        <para>
          xfsprogs was update to version 5.15, which enables inobtcount
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -101,6 +101,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable).

+- [uptermd](https://upterm.dev), an open-source solution for sharing terminal sessions instantly over the public internet via secure tunnels. Available at [services.uptermd](#opt-services.uptermd.enable).
+
 - [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](options.html#opt-services.agate.enable).

 - [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](options.html#opt-services.archisteamfarm.enable).
@ -699,6 +701,20 @@ In addition to numerous new and upgraded packages, this release has the followin
  By default auto-upgrade will now run immediately if it would have been triggered at least
  once during the time when the timer was inactive.

+- Mastodon now uses `services.redis.servers` to start a new redis server, instead of using a global redis server. 
+  This improves compatibility with other services that use redis.
+  
+  Note that this will recreate the redis database, although according to the [Mastodon docs](https://docs.joinmastodon.org/admin/backups/), 
+  this is almost harmless:
+  > Losing the Redis database is almost harmless: The only irrecoverable data will be the contents of the Sidekiq queues and scheduled retries of previously failed jobs. 
+  >  The home and list feeds are stored in Redis, but can be regenerated with tootctl.
+  
+  If you do want to save the redis database, you can use the following commands:
+  ```bash
+  redis-cli save
+  cp /var/lib/redis/dump.rdb "/var/lib/redis-mastodon/dump.rdb"
+  ```
+
 - If you are using Wayland you can choose to use the Ozone Wayland support
  in Chrome and several Electron apps by setting the environment variable
  `NIXOS_OZONE_WL=1` (for example via
@ -860,6 +876,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The polkit service, available at `security.polkit.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed.

+- `mercury` was updated to 22.01.1, which has some breaking changes ([Mercury 22.01 news](https://dl.mercurylang.org/release/release-notes-22.01.html)).
+
 - xfsprogs was update to version 5.15, which enables inobtcount and bigtime by default on filesystem creation. Support for these features was added in kernel 5.10 and deemed stable in kernel 5.15.
  If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than 5.10, you need to format them with `mkfs.xfs -m bigtime=0 -m inobtcount=0`.

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -937,6 +937,7 @@
  ./services/networking/unifi.nix
  ./services/video/unifi-video.nix
  ./services/video/rtsp-simple-server.nix
+  ./services/networking/uptermd.nix
  ./services/networking/v2ray.nix
  ./services/networking/vsftpd.nix
  ./services/networking/wasabibackend.nix
--- a/nixos/modules/services/networking/uptermd.nix
+++ b/nixos/modules/services/networking/uptermd.nix
@ -0,0 +1,106 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.uptermd;
+in
+{
+  options = {
+    services.uptermd = {
+      enable = mkEnableOption "uptermd";
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the firewall for the port in <option>services.uptermd.port</option>.
+        '';
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 2222;
+        description = ''
+          Port the server will listen on.
+        '';
+      };
+
+      listenAddress = mkOption {
+        type = types.str;
+        default = "[::]";
+        example = "127.0.0.1";
+        description = ''
+          Address the server will listen on.
+        '';
+      };
+
+      hostKey = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/run/keys/upterm_host_ed25519_key";
+        description = ''
+          Path to SSH host key. If not defined, an ed25519 keypair is generated automatically.
+        '';
+      };
+
+      extraFlags = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "--debug" ];
+        description = ''
+          Extra flags passed to the uptermd command.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+
+    systemd.services.uptermd = {
+      description = "Upterm Daemon";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      path = [ pkgs.openssh ];
+
+      preStart = mkIf (cfg.hostKey == null) ''
+        if ! [ -f ssh_host_ed25519_key ]; then
+          ssh-keygen \
+            -t ed25519 \
+            -f ssh_host_ed25519_key \
+            -N ""
+        fi
+      '';
+
+      serviceConfig = {
+        StateDirectory = "uptermd";
+        WorkingDirectory = "/var/lib/uptermd";
+        ExecStart = "${pkgs.upterm}/bin/uptermd --ssh-addr ${cfg.listenAddress}:${toString cfg.port} --private-key ${if cfg.hostKey == null then "ssh_host_ed25519_key" else cfg.hostKey} ${concatStringsSep " " cfg.extraFlags}";
+
+        # Hardening
+        AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+        PrivateUsers = cfg.port >= 1024;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "@system-service";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/web-apps/atlassian/confluence.nix
+++ b/nixos/modules/services/web-apps/atlassian/confluence.nix
@ -189,6 +189,8 @@ in
        User = cfg.user;
        Group = cfg.group;
        PrivateTmp = true;
+        Restart = "on-failure";
+        RestartSec = "10";
        ExecStart = "${pkg}/bin/start-confluence.sh -fg";
        ExecStop = "${pkg}/bin/stop-confluence.sh";
      };
--- a/nixos/modules/services/web-apps/atlassian/crowd.nix
+++ b/nixos/modules/services/web-apps/atlassian/crowd.nix
@ -157,6 +157,8 @@ in
        User = cfg.user;
        Group = cfg.group;
        PrivateTmp = true;
+        Restart = "on-failure";
+        RestartSec = "10";
        ExecStart = "${pkg}/start_crowd.sh -fg";
      };
    };
--- a/nixos/modules/services/web-apps/atlassian/jira.nix
+++ b/nixos/modules/services/web-apps/atlassian/jira.nix
@ -197,6 +197,8 @@ in
        User = cfg.user;
        Group = cfg.group;
        PrivateTmp = true;
+        Restart = "on-failure";
+        RestartSec = "10";
        ExecStart = "${pkg}/bin/start-jira.sh -fg";
        ExecStop = "${pkg}/bin/stop-jira.sh";
      };
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@ -294,7 +294,7 @@ in {
        port = lib.mkOption {
          description = "Redis port.";
          type = lib.types.port;
-          default = 6379;
+          default = 31637;
        };
      };

@ -605,8 +605,10 @@ in {
      enable = true;
      hostname = lib.mkDefault "${cfg.localDomain}";
    };
-    services.redis = lib.mkIf (cfg.redis.createLocally && cfg.redis.host == "127.0.0.1") {
+    services.redis.servers.mastodon = lib.mkIf (cfg.redis.createLocally && cfg.redis.host == "127.0.0.1") {
      enable = true;
+      port = cfg.redis.port;
+      bind = "127.0.0.1";
    };
    services.postgresql = lib.mkIf databaseActuallyCreateLocally {
      enable = true;
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -575,6 +575,7 @@ in
  unifi = handleTest ./unifi.nix {};
  unit-php = handleTest ./web-servers/unit-php.nix {};
  upnp = handleTest ./upnp.nix {};
+  uptermd = handleTest ./uptermd.nix {};
  usbguard = handleTest ./usbguard.nix {};
  user-activation-scripts = handleTest ./user-activation-scripts.nix {};
  uwsgi = handleTest ./uwsgi.nix {};
--- a/nixos/tests/uptermd.nix
+++ b/nixos/tests/uptermd.nix
@ -0,0 +1,62 @@
+import ./make-test-python.nix ({ pkgs, ...}:
+
+let
+  client = {pkgs, ...}:{
+    environment.systemPackages = [ pkgs.upterm ];
+  };
+in
+{
+  name = "uptermd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fleaz ];
+  };
+
+  nodes = {
+    server = {config, ...}: {
+      services.uptermd = {
+        enable = true;
+        openFirewall = true;
+        port = 1337;
+      };
+    };
+    client1 = client;
+    client2 = client;
+  };
+
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("uptermd.service")
+    server.wait_for_unit("network-online.target")
+
+    # Add SSH hostkeys from the server to both clients
+    # uptermd needs an '@cert-authority entry so we need to modify the known_hosts file
+    client1.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
+    client1.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
+    client2.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
+    client2.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
+
+    client1.wait_for_unit("multi-user.target")
+    client1.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    client1.wait_until_tty_matches(1, "login: ")
+    client1.send_chars("root\n")
+    client1.wait_until_succeeds("pgrep -u root bash")
+
+    client1.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
+    client1.send_chars("TERM=xterm upterm host --server ssh://server:1337 --force-command hostname -- bash > /tmp/session-details\n")
+    client1.wait_for_file("/tmp/session-details")
+    client1.send_key("q")
+
+    # uptermd can't connect if we don't have a keypair
+    client2.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
+
+    # Grep the ssh connect command from the output of 'upterm host'
+    ssh_command = client1.succeed("grep 'SSH Session' /tmp/session-details | cut -d':' -f2-").strip()
+
+    # Connect with client2. Because we used '--force-command hostname' we should get "client1" as the output
+    output = client2.succeed(ssh_command)
+
+    assert output.strip() == "client1"
+  '';
+})
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@ -84,6 +84,7 @@ let
    gettext
    glew
    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-bad
    gst_all_1.gstreamer
    gvfs
    libechonest
--- a/pkgs/applications/audio/noisetorch/default.nix
+++ b/pkgs/applications/audio/noisetorch/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "NoiseTorch";
-  version = "0.11.4";
+  version = "0.11.5";

  src = fetchFromGitHub {
    owner = "lawl";
    repo = "NoiseTorch";
    rev = version;
-    sha256 = "sha256-3+Yk7dqD7eyvd1I5CMmrg085ZtFxD2EnGqL5ttwx8eM=";
+    sha256 = "sha256-j/6XB3vA5LvTuCxmeB0HONqEDzYg210AWW/h3nCGOD8=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/backup/vorta/default.nix
+++ b/pkgs/applications/backup/vorta/default.nix
@ -8,13 +8,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "vorta";
-  version = "0.8.3";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "borgbase";
    repo = "vorta";
-    rev = "v${version}";
-    sha256 = "06sb24pimq9ckdkp9hzp4r9d3i21kxacsx5b7x9q99qcwf7h6372";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-eS/+7s9KgGCEhA6NgIzPlGM1daP+Ir2d1mmqse4YbIE=";
  };

  nativeBuildInputs = [ wrapQtAppsHook ];
--- a/pkgs/applications/editors/pinegrow/default.nix
+++ b/pkgs/applications/editors/pinegrow/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
  version = "6.5";

  src = fetchurl {
-    url = "https://github.com/Pinegrow/PinegrowReleases/releases/download/pg${version}/PinegrowLinux64.${version}.zip";
+    url = "https://download.pinegrow.com/PinegrowLinux64.${version}.zip";
    sha256 = "1l7cf5jgidpykaf68mzf92kywl1vxwl3fg43ibgr2rg4cnl1g82b";
  };

--- a/pkgs/applications/editors/vscode/extensions/rust-analyzer/build-deps/package.json
+++ b/pkgs/applications/editors/vscode/extensions/rust-analyzer/build-deps/package.json
@ -1,19 +1,19 @@
 {
  "name": "rust-analyzer",
-  "version": "0.2.975",
+  "version": "0.2.1048",
  "dependencies": {
-    "vscode-languageclient": "8.0.0-next.8",
+    "vscode-languageclient": "8.0.0-next.14",
    "d3": "^7.3.0",
-    "d3-graphviz": "^4.0.0",
+    "d3-graphviz": "^4.1.0",
    "@types/node": "~14.17.5",
-    "@types/vscode": "~1.63.0",
-    "@typescript-eslint/eslint-plugin": "^5.10.0",
-    "@typescript-eslint/parser": "^5.10.0",
-    "@vscode/test-electron": "^2.1.1",
-    "eslint": "^8.7.0",
+    "@types/vscode": "~1.66.0",
+    "@typescript-eslint/eslint-plugin": "^5.16.0",
+    "@typescript-eslint/parser": "^5.16.0",
+    "@vscode/test-electron": "^2.1.3",
+    "eslint": "^8.11.0",
    "tslib": "^2.3.0",
-    "typescript": "^4.5.5",
+    "typescript": "^4.6.3",
    "typescript-formatter": "^7.2.2",
-    "vsce": "^2.6.7"
+    "vsce": "^2.7.0"
  }
 }
--- a/pkgs/applications/editors/vscode/extensions/rust-analyzer/update.sh
+++ b/pkgs/applications/editors/vscode/extensions/rust-analyzer/update.sh
@ -5,7 +5,7 @@ set -euo pipefail
 cd "$(dirname "$0")"
 nixpkgs=../../../../../../
 node_packages="$nixpkgs/pkgs/development/node-packages"
-owner=rust-analyzer
+owner=rust-lang
 repo=rust-analyzer
 ver=$(
    curl -s "https://api.github.com/repos/$owner/$repo/releases" |
@ -22,7 +22,7 @@ if [[ "$(nix-instantiate --eval --strict -E "(builtins.compareVersions \"$req_vs
    exit 1
 fi

-extension_ver=$(curl "https://github.com/rust-analyzer/rust-analyzer/releases/download/$ver/rust-analyzer-linux-x64.vsix" -L |
+extension_ver=$(curl "https://github.com/$owner/$repo/releases/download/$ver/rust-analyzer-linux-x64.vsix" -L |
    bsdtar -xf - --to-stdout extension/package.json | # Use bsdtar to extract vsix(zip).
    jq --raw-output '.version')
 echo "Extension version: $extension_ver"
--- a/pkgs/applications/emulators/yuzu/compatibility-list.json
+++ b/pkgs/applications/emulators/yuzu/compatibility-list.json
--- a/pkgs/applications/emulators/yuzu/default.nix
+++ b/pkgs/applications/emulators/yuzu/default.nix
@ -1,22 +1,27 @@
 { branch ? "mainline"
 , libsForQt5
 , fetchFromGitHub
+, fetchurl
 }:

 let
-  # Fetched from https://api.yuzu-emu.org/gamedb, last updated 2022-03-23.
+  # Fetched from https://api.yuzu-emu.org/gamedb, last updated 2022-05-12
  # Please make sure to update this when updating yuzu!
-  compat-list = ./compatibility-list.json;
+  compat-list = fetchurl {
+    name = "yuzu-compat-list";
+    url = "https://web.archive.org/web/20220512184801/https://api.yuzu-emu.org/gamedb";
+    sha256 = "sha256-anOmO7NscHDsQxT03+YbJEyBkXjhcSVGgKpDwt//GHw=";
+  };
 in {
  mainline = libsForQt5.callPackage ./generic.nix rec {
    pname = "yuzu-mainline";
-    version = "992";
+    version = "1014";

    src = fetchFromGitHub {
      owner = "yuzu-emu";
      repo = "yuzu-mainline";
      rev = "mainline-0-${version}";
-      sha256 = "1x3fwwdw86jvygbzy9k99j6avfsd867ywm2x25izw10jznpsaixs";
+      sha256 = "1x3d1fjssadv4kybc6mk153jlvncsfgm5aipkq5n5i8sr7mmr3nw";
      fetchSubmodules = true;
    };

@ -25,13 +30,13 @@ in {

  early-access = libsForQt5.callPackage ./generic.nix rec {
    pname = "yuzu-ea";
-    version = "2690";
+    version = "2725";

    src = fetchFromGitHub {
      owner = "pineappleEA";
      repo = "pineapple-src";
      rev = "EA-${version}";
-      sha256 = "0zm06clbdh9cccq9932q9v976q7sjknynkdvvp04h1wcskmrxi3c";
+      sha256 = "1nmcl9y9chr7cdvnra5zs1v42d3i801hmsjdlz3fmp15n04bcjmp";
      fetchSubmodules = true;
    };

--- a/pkgs/applications/emulators/yuzu/generic.nix
+++ b/pkgs/applications/emulators/yuzu/generic.nix
@ -45,6 +45,12 @@
 stdenv.mkDerivation rec {
  inherit pname version src;

+  # Replace icons licensed under CC BY-ND 3.0 with free ones to allow
+  # for binary redistribution: https://github.com/yuzu-emu/yuzu/pull/8104
+  # The patch hosted on GitHub has the binary information stripped, so
+  # it has been regenerated with "git format-patch --text --full-index --binary"
+  patches = [ ./yuzu-free-icons.patch ];
+
  nativeBuildInputs = [
    cmake
    doxygen
@ -145,10 +151,11 @@ stdenv.mkDerivation rec {
    platforms = [ "x86_64-linux" ];
    license = with licenses; [
      gpl3Plus
-      # Icons
-      cc-by-nd-30 cc0
+      # Icons. Note that this would be cc0 and cc-by-nd-30 without the "yuzu-free-icons" patch
+      asl20 mit cc0
    ];
    maintainers = with maintainers; [
+      ashley
      ivar
      joshuafern
      sbruder
--- a/pkgs/applications/emulators/yuzu/update.sh
+++ b/pkgs/applications/emulators/yuzu/update.sh
@ -23,21 +23,6 @@ getLocalHash() {
    popd >/dev/null
 }

-updateCompatList() {
-    NEW_COMPAT_LIST="$(curl -s "https://api.yuzu-emu.org/gamedb")"
-
-    if [[ "$(cat ./compatibility-list.json)" = "${NEW_COMPAT_LIST}" ]]; then
-        echo "Compatibility list is already up to date!"
-    else
-        local TODAY="$(date +"%Y-%m-%d")"
-
-        echo "Compatibility list: updated to $TODAY"
-        echo "${NEW_COMPAT_LIST}" > ./compatibility-list.json
-
-        sed -i -e "s/last updated .*/last updated $TODAY./" ./default.nix
-    fi
-}
-
 updateMainline() {
    OLD_MAINLINE_VERSION="$(getLocalVersion "yuzu-mainline")"
    OLD_MAINLINE_HASH="$(getLocalHash "yuzu-mainline")"
@ -90,13 +75,10 @@ updateEarlyAccess() {

 if [[ "$BRANCH" = "mainline" ]]; then
    updateMainline
-    updateCompatList
 elif [[ "$BRANCH" = "early-access" ]]; then
    updateEarlyAccess
-    updateCompatList
 else
    KEEP_GOING=1
    updateMainline
    updateEarlyAccess
-    updateCompatList
 fi
--- a/pkgs/applications/emulators/yuzu/yuzu-free-icons.patch
+++ b/pkgs/applications/emulators/yuzu/yuzu-free-icons.patch
--- a/pkgs/applications/misc/rofimoji/default.nix
+++ b/pkgs/applications/misc/rofimoji/default.nix
@ -15,13 +15,14 @@

 buildPythonApplication rec {
  pname = "rofimoji";
-  version = "5.1.0";
+  version = "5.4.0";
+  format = "pyproject";

  src = fetchFromGitHub {
    owner = "fdw";
    repo = "rofimoji";
    rev = version;
-    sha256 = "sha256-bLV0hYDjVH11euvNHUHZFcCVywuceRljkCqyX4aANVs=";
+    sha256 = "sha256-D45XGnKWHUsE0DQThITBcgpghelsfGkSEIdg9jvOJlw=";
  };

  # `rofi` and the `waylandSupport` and `x11Support` dependencies
--- a/pkgs/applications/networking/compactor/default.nix
+++ b/pkgs/applications/networking/compactor/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub
 , asciidoctor, autoreconfHook, pkg-config
-, boost, libctemplate, libmaxminddb, libpcap, libtins, openssl, protobuf, xz, zlib
+, boost, libctemplate, libmaxminddb, libpcap, libtins, openssl, protobuf, xz, zlib, catch2
 , cbor-diag, cddl, diffutils, file, mktemp, netcat, tcpdump, wireshark-cli
 }:

@ -35,6 +35,7 @@ stdenv.mkDerivation rec {

  postPatch = ''
    patchShebangs test-scripts/
+    cp ${catch2}/include/catch2/catch.hpp tests/catch.hpp
  '';

  preConfigure = ''
--- a/pkgs/applications/networking/p2p/mldonkey/default.nix
+++ b/pkgs/applications/networking/p2p/mldonkey/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocamlPackages, zlib }:
+{ lib, stdenv, fetchurl, fetchpatch, ocamlPackages, zlib }:

 stdenv.mkDerivation rec {
  pname = "mldonkey";
@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
    sha256 = "b926e7aa3de4b4525af73c88f1724d576b4add56ef070f025941dd51cb24a794";
  };

+  patches = [
+    # Fixes C++17 compat
+    (fetchpatch {
+      url = "https://github.com/ygrek/mldonkey/pull/66/commits/20ff84c185396f3d759cf4ef46b9f0bd33a51060.patch";
+      hash = "sha256-MCqx0jVfOaLkZhhv0b1cTdO6BK2/f6TxTWmx+NZjXME=";
+    })
+  ];
+
  preConfigure = ''
    substituteInPlace Makefile --replace '+camlp4' \
      '${ocamlPackages.camlp4}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/camlp4'
--- a/pkgs/applications/science/biology/bayescan/default.nix
+++ b/pkgs/applications/science/biology/bayescan/default.nix
@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
    cp -r ../*pdf ../input_examples ../"R functions" $out/share/doc/bayescan
  '';

+  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+
  meta = with lib; {
    description = "Detecting natural selection from population-based genetic data";
    homepage = "http://cmpg.unibe.ch/software/BayeScan";
--- a/pkgs/applications/science/chemistry/openmolcas/MKL-MPICH.patch
+++ b/pkgs/applications/science/chemistry/openmolcas/MKL-MPICH.patch
@ -0,0 +1,24 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 276ae4e..5e56176 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -1304,9 +1304,9 @@ if (LINALG STREQUAL "MKL")
+       endif ()
+     else ()
+       if (ADDRMODE EQUAL 64)
+-        set (libpath "${MKLROOT}/lib/intel64")
+        set (libpath "${MKLROOT}/lib")
+       elseif (ADDRMODE EQUAL 32)
+-        set (libpath "${MKLROOT}/lib/ia32")
+        set (libpath "${MKLROOT}/lib")
+       endif ()
+     endif ()
+     set (MKL_LIBRARY_PATH ${libpath} CACHE PATH "location of MKL libraries." FORCE)
+@@ -1380,7 +1380,7 @@ if (LINALG STREQUAL "MKL")
+     find_library (LIBMKL_BLACS NAMES "mkl_blacs_intelmpi_ilp64"
+                   PATHS ${MKL_LIBRARY_PATH} NO_DEFAULT_PATH)
+   elseif (MPI_IMPLEMENTATION STREQUAL "mpich")
+-    find_library (LIBMKL_BLACS NAMES "mkl_blacs_ilp64"
+    find_library (LIBMKL_BLACS NAMES "mkl_blacs_intelmpi_ilp64"
+                   PATHS ${MKL_LIBRARY_PATH} NO_DEFAULT_PATH)
+   endif ()
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@ -1,30 +1,35 @@
 { lib, stdenv, fetchFromGitLab, cmake, gfortran, perl
-, openblas, hdf5-cpp, python3, texlive
-, armadillo, mpi, globalarrays, openssh
-, makeWrapper
+, blas-ilp64, hdf5-cpp, python3, texlive
+, armadillo, libxc, makeWrapper
+# Note that the CASPT2 module is broken with MPI
+# See https://gitlab.com/Molcas/OpenMolcas/-/issues/169
+, enableMpi ? false
+, mpi, globalarrays
 } :

-let
-  version = "21.10";
-  # The tag keeps moving, fix a hash instead
-  gitLabRev = "117305462bac932106e8e3a0347238b768bcb058";
+assert blas-ilp64.isILP64;
+assert lib.elem blas-ilp64.passthru.implementation [ "openblas" "mkl" ];

-  python = python3.withPackages (ps : with ps; [ six pyparsing ]);
+let
+  python = python3.withPackages (ps : with ps; [ six pyparsing numpy h5py ]);

 in stdenv.mkDerivation {
  pname = "openmolcas";
-  inherit version;
+  version = "22.02";

  src = fetchFromGitLab {
    owner = "Molcas";
    repo = "OpenMolcas";
-    rev = gitLabRev;
-    sha256 = "sha256-GMi2dsNBog+TmpmP6fhQcp6Z5Bh2LelV//MqLnvRP5c=";
+    # The tag keeps moving, fix a hash instead
+    rev = "f8df69cf87b241a15ebc82d72a8f9a031a385dd4"; # 2022-02-10
+    sha256 = "0p2xj8kgqdk5kb1jv5k77acbiqkbl2sh971jnz9p00cmbh556r6a";
  };

  patches = [
    # Required to handle openblas multiple outputs
    ./openblasPath.patch
+    # Required for MKL builds
+    ./MKL-MPICH.patch
  ];

  nativeBuildInputs = [
@ -36,27 +41,35 @@ in stdenv.mkDerivation {
  ];

  buildInputs = [
-    openblas
+    blas-ilp64.passthru.provider
    hdf5-cpp
    python
    armadillo
+    libxc
+  ] ++ lib.optionals enableMpi [
    mpi
    globalarrays
-    openssh
  ];

+  passthru = lib.optionalAttrs enableMpi { inherit mpi; };
+
  cmakeFlags = [
    "-DOPENMP=ON"
-    "-DGA=ON"
-    "-DMPI=ON"
    "-DLINALG=OpenBLAS"
    "-DTOOLS=ON"
    "-DHDF5=ON"
    "-DFDE=ON"
-    "-DOPENBLASROOT=${openblas.dev}"
+    "-DEXTERNAL_LIBXC=${libxc}"
+  ] ++ lib.optionals (blas-ilp64.passthru.implementation == "openblas") [
+    "-DOPENBLASROOT=${blas-ilp64.passthru.provider.dev}" "-DLINALG=OpenBLAS"
+  ] ++ lib.optionals (blas-ilp64.passthru.implementation == "mkl") [
+    "-DMKLROOT=${blas-ilp64.passthru.provider}" "-DLINALG=MKL"
+  ] ++ lib.optionals enableMpi [
+    "-DGA=ON"
+    "-DMPI=ON"
  ];

-  preConfigure = ''
+  preConfigure = lib.optionalString enableMpi ''
    export GAROOT=${globalarrays};
  '';

@ -68,6 +81,8 @@ in stdenv.mkDerivation {

  postInstall = ''
    mv $out/pymolcas $out/bin
+    find $out/Tools -type f -exec mv \{} $out/bin \;
+    rm -r $out/Tools
  '';

  postFixup = ''
@ -84,6 +99,7 @@ in stdenv.mkDerivation {
    maintainers = [ maintainers.markuskowa ];
    license = licenses.lgpl21Only;
    platforms = [ "x86_64-linux" ];
+    mainProgram = "pymolcas";
  };
 }

--- a/pkgs/applications/science/logic/aspino/default.nix
+++ b/pkgs/applications/science/logic/aspino/default.nix
@ -9,13 +9,13 @@ in

 stdenv.mkDerivation {
  pname = "aspino";
-  version = "unstable-2017-03-09";
+  version = "unstable-2018-03-24";

  src = fetchFromGitHub {
    owner = "alviano";
    repo = "aspino";
-    rev = "e31c3b4e5791a454e6602439cb26bd98d23c4e78";
-    sha256 = "0annsjs2prqmv1lbs0lxr7yclfzh47xg9zyiq6mdxcc02rxsi14f";
+    rev = "4d7483e328bdf9a00ef1eb7f2868e7b0f2a82d56";
+    hash = "sha256-R1TpBDGdq+NQQzmzqk0wYaz2Hns3qru0AkAyFPQasPA=";
  };

  buildInputs = [ zlib boost ];
--- a/pkgs/applications/science/math/mathematica/10.nix
+++ b/pkgs/applications/science/math/mathematica/10.nix
@ -1,19 +1,30 @@
-{ lib, stdenv
-, coreutils
+{ lib
 , patchelf
 , requireFile
+, stdenv
+# arguments from default.nix
+, lang
+, meta
+, name
+, src
+, version
+# dependencies
 , alsa-lib
+, coreutils
+, cudaPackages
 , fontconfig
 , freetype
 , gcc
 , glib
+, libuuid
+, libxml2
 , ncurses
 , opencv2
 , openssl
 , unixODBC
 , xorg
-, libxml2
-, libuuid
+# options
+, cudaSupport
 }:

 let
@ -24,20 +35,10 @@ let
      throw "Mathematica requires i686-linux or x86_64 linux";
 in
 stdenv.mkDerivation rec {
-  version = "10.0.2";
+  inherit meta src version;

  pname = "mathematica";

-  src = requireFile rec {
-    name = "Mathematica_${version}_LINUX.sh";
-    message = ''
-      This nix expression requires that ${name} is
-      already part of the store. Find the file on your Mathematica CD
-      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
-    '';
-    sha256 = "1d2yaiaikzcacjamlw64g3xkk81m3pb4vz4an12cv8nb7kb20x9l";
-  };
-
  buildInputs = [
    coreutils
    patchelf
@ -127,10 +128,4 @@ stdenv.mkDerivation rec {

  # we did this in prefixup already
  dontPatchELF = true;
-
-  meta = {
-    description = "Wolfram Mathematica computational software system";
-    homepage = "http://www.wolfram.com/mathematica/";
-    license = lib.licenses.unfree;
-  };
 }
--- a/pkgs/applications/science/math/mathematica/11.nix
+++ b/pkgs/applications/science/math/mathematica/11.nix
@ -1,14 +1,26 @@
-{ lib, stdenv
-, coreutils
+{ lib
 , patchelf
 , requireFile
-, callPackage
+, stdenv
+# arguments from default.nix
+, lang
+, meta
+, name
+, src
+, version
+# dependencies
 , alsa-lib
+, coreutils
+, cudaPackages
 , dbus
 , fontconfig
 , freetype
 , gcc
 , glib
+, libGL
+, libGLU
+, libuuid
+, libxml2
 , ncurses
 , opencv2
 , openssl
@ -16,23 +28,12 @@
 , xkeyboard_config
 , xorg
 , zlib
-, libxml2
-, libuuid
-, lang ? "en"
-, libGL
-, libGLU
+# options
+, cudaSupport
 }:

-let
-  l10n =
-    import ./l10ns.nix {
-      lib = lib;
-      inherit requireFile lang;
-      majorVersion = "11";
-    };
-in
 stdenv.mkDerivation rec {
-  inherit (l10n) version name src;
+  inherit meta name src version;

  buildInputs = [
    coreutils
@ -141,10 +142,4 @@ stdenv.mkDerivation rec {

  # we did this in prefixup already
  dontPatchELF = true;
-
-  meta = {
-    description = "Wolfram Mathematica computational software system";
-    homepage = "http://www.wolfram.com/mathematica/";
-    license = lib.licenses.unfree;
-  };
 }
--- a/pkgs/applications/science/math/mathematica/9.nix
+++ b/pkgs/applications/science/math/mathematica/9.nix
@ -1,9 +1,17 @@
 { lib
-, stdenv
-, coreutils
 , patchelf
 , requireFile
+, stdenv
+# arguments from default.nix
+, lang
+, meta
+, name
+, src
+, version
+# dependencies
 , alsa-lib
+, coreutils
+, cudaPackages
 , fontconfig
 , freetype
 , gcc
@ -13,6 +21,8 @@
 , openssl
 , unixODBC
 , xorg
+# options
+, cudaSupport
 }:

 let
@ -23,18 +33,8 @@ let
      throw "Mathematica requires i686-linux or x86_64 linux";
 in
 stdenv.mkDerivation rec {
+  inherit meta src version;
  pname = "mathematica";
-  version = "9.0.0";
-
-  src = requireFile {
-    name = "Mathematica_${version}_LINUX.sh";
-    message = ''
-      This nix expression requires that Mathematica_9.0.0_LINUX.sh is
-      already part of the store. Find the file on your Mathematica CD
-      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
-    '';
-    sha256 = "106zfaplhwcfdl9rdgs25x83xra9zcny94gb22wncbfxvrsk3a4q";
-  };

  buildInputs = [
    coreutils
@ -114,10 +114,4 @@ stdenv.mkDerivation rec {

  # we did this in prefixup already
  dontPatchELF = true;
-
-  meta = {
-    description = "Wolfram Mathematica computational software system";
-    homepage = "http://www.wolfram.com/mathematica/";
-    license = lib.licenses.unfree;
-  };
 }
--- a/pkgs/applications/science/math/mathematica/default.nix
+++ b/pkgs/applications/science/math/mathematica/default.nix
@ -1,173 +1,48 @@
-{ lib
-, stdenv
-, autoPatchelfHook
-, buildEnv
-, makeWrapper
-, requireFile
-, alsa-lib
-, cups
-, dbus
-, flite
-, fontconfig
-, freetype
-, gcc-unwrapped
-, glib
-, gmpxx
-, keyutils
-, libGL
-, libGLU
-, libpcap
-, libtins
-, libuuid
-, libxkbcommon
-, libxml2
-, llvmPackages_12
-, matio
-, mpfr
-, ncurses
-, opencv4
-, openjdk11
-, openssl
-, pciutils
-, tre
-, unixODBC
-, xkeyboard_config
-, xorg
-, zlib
+{ callPackage
+, config
+, lib
+, cudaPackages
+, cudaSupport ? config.cudaSupport or false
 , lang ? "en"
+, version ? null
 }:

-let
-  l10n = import ./l10ns.nix {
-    inherit lib requireFile lang;
-  };
-in stdenv.mkDerivation {
-  inherit (l10n) version name src;
+let versions = callPackage ./versions.nix { };

-  nativeBuildInputs = [
-    autoPatchelfHook
-    makeWrapper
-  ];
+    matching-versions =
+      lib.sort (v1: v2: lib.versionAtLeast v1.version v2.version) (lib.filter
+        (v: v.lang == lang
+            && (if version == null then true else isMatching v.version version))
+        versions);

-  buildInputs = [
-    alsa-lib
-    cups.lib
-    dbus
-    flite
-    fontconfig
-    freetype
-    glib
-    gmpxx
-    keyutils.lib
-    libGL
-    libGLU
-    libpcap
-    libtins
-    libuuid
-    libxkbcommon
-    libxml2
-    llvmPackages_12.libllvm.lib
-    matio
-    mpfr
-    ncurses
-    opencv4
-    openjdk11
-    openssl
-    pciutils
-    tre
-    unixODBC
-    xkeyboard_config
-  ] ++ (with xorg; [
-    libICE
-    libSM
-    libX11
-    libXScrnSaver
-    libXcomposite
-    libXcursor
-    libXdamage
-    libXext
-    libXfixes
-    libXi
-    libXinerama
-    libXmu
-    libXrandr
-    libXrender
-    libXtst
-    libxcb
-  ]);
+    found-version =
+      if matching-versions == []
+      then throw ("No registered Mathematica version found to match"
+                  + " version=${version} and language=${lang}")
+      else lib.head matching-versions;

-  wrapProgramFlags = [
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gcc-unwrapped.lib zlib ]}"
-    "--prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}"
-    # Fix libQt errors - #96490
-    "--set USE_WOLFRAM_LD_LIBRARY_PATH 1"
-    # Fix xkeyboard config path for Qt
-    "--set QT_XKB_CONFIG_ROOT ${xkeyboard_config}/share/X11/xkb"
-  ];
+    specific-drv = ./. + "/(lib.versions.major found-version.version).nix";

-  unpackPhase = ''
-    runHook preUnpack
+    real-drv = if lib.pathExists specific-drv
+               then specific-drv
+               else ./generic.nix;

-    # Find offset from file
-    offset=$(${stdenv.shell} -c "$(grep -axm1 -e 'offset=.*' $src); echo \$offset" $src)
-    tail -c +$(($offset + 1)) $src | tar -xf -
+    isMatching = v1: v2:
+      let as      = lib.splitVersion v1;
+          bs      = lib.splitVersion v2;
+          n       = lib.min (lib.length as) (lib.length bs);
+          sublist = l: lib.sublist 0 n l;
+      in lib.compareLists lib.compare (sublist as) (sublist bs) == 0;

-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    cd "$TMPDIR/Unix/Installer"
-
-    mkdir -p "$out/lib/udev/rules.d"
-
-    # Patch MathInstaller's shebangs and udev rules dir
-    patchShebangs MathInstaller
-    substituteInPlace MathInstaller \
-      --replace /etc/udev/rules.d $out/lib/udev/rules.d
-
-    # Remove PATH restriction, root and avahi daemon checks, and hostname call
-    sed -i '
-      s/^PATH=/# &/
-      s/isRoot="false"/# &/
-      s/^checkAvahiDaemon$/# &/
-      s/`hostname`/""/
-    ' MathInstaller
-
-    # NOTE: some files placed under HOME may be useful
-    XDG_DATA_HOME="$out/share" HOME="$TMPDIR/home" vernierLink=y \
-      ./MathInstaller -execdir="$out/bin" -targetdir="$out/libexec/Mathematica" -auto -verbose -createdir=y
-
-    # Check if MathInstaller produced any errors
-    errLog="$out/libexec/Mathematica/InstallErrors"
-    if [ -f "$errLog" ]; then
-      echo "Installation errors:"
-      cat "$errLog"
-      return 1
-    fi
-
-    runHook postInstall
-  '';
-
-  preFixup = ''
-    for bin in $out/libexec/Mathematica/Executables/*; do
-      wrapProgram "$bin" ''${wrapProgramFlags[@]}
-    done
-  '';
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  # This is primarily an IO bound build; there's little benefit to building remotely
-  preferLocalBuild = true;
-
-  # All binaries are already stripped
-  dontStrip = true;
-
-  # NOTE: Some deps are still not found; ignore for now
-  autoPatchelfIgnoreMissingDeps = true;
+in

+callPackage real-drv {
+  inherit cudaSupport cudaPackages;
+  inherit (found-version) version lang src;
+  name = ("mathematica"
+          + lib.optionalString cudaSupport "-cuda"
+          + "-${found-version.version}"
+          + lib.optionalString (lang != "en") "-${lang}");
  meta = with lib; {
    description = "Wolfram Mathematica computational software system";
    homepage = "http://www.wolfram.com/mathematica/";
--- a/pkgs/applications/science/math/mathematica/generic.nix
+++ b/pkgs/applications/science/math/mathematica/generic.nix
@ -0,0 +1,192 @@
+{ addOpenGLRunpath
+, autoPatchelfHook
+, lib
+, makeWrapper
+, requireFile
+, runCommand
+, stdenv
+, symlinkJoin
+# arguments from default.nix
+, lang
+, meta
+, name
+, src
+, version
+# dependencies
+, alsa-lib
+, cudaPackages
+, cups
+, dbus
+, flite
+, fontconfig
+, freetype
+, gcc-unwrapped
+, glib
+, gmpxx
+, keyutils
+, libGL
+, libGLU
+, libpcap
+, libtins
+, libuuid
+, libxkbcommon
+, libxml2
+, llvmPackages_12
+, matio
+, mpfr
+, ncurses
+, opencv4
+, openjdk11
+, openssl
+, pciutils
+, tre
+, unixODBC
+, xkeyboard_config
+, xorg
+, zlib
+# options
+, cudaSupport
+}:
+
+let cudaEnv = symlinkJoin {
+      name = "mathematica-cuda-env";
+      paths = with cudaPackages; [
+        cuda_cudart cuda_nvcc libcublas libcufft libcurand libcusparse
+      ];
+      postBuild = ''
+        ln -s ${addOpenGLRunpath.driverLink}/lib/libcuda.so $out/lib
+        ln -s lib $out/lib64
+      '';
+    };
+
+in stdenv.mkDerivation {
+  inherit meta name src version;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ] ++ lib.optional cudaSupport addOpenGLRunpath;
+
+  buildInputs = [
+    alsa-lib
+    cups.lib
+    dbus
+    flite
+    fontconfig
+    freetype
+    glib
+    gmpxx
+    keyutils.lib
+    libGL
+    libGLU
+    libpcap
+    libtins
+    libuuid
+    libxkbcommon
+    libxml2
+    llvmPackages_12.libllvm.lib
+    matio
+    mpfr
+    ncurses
+    opencv4
+    openjdk11
+    openssl
+    pciutils
+    tre
+    unixODBC
+    xkeyboard_config
+  ] ++ (with xorg; [
+    libICE
+    libSM
+    libX11
+    libXScrnSaver
+    libXcomposite
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXinerama
+    libXmu
+    libXrandr
+    libXrender
+    libXtst
+    libxcb
+  ]) ++ lib.optional cudaSupport cudaEnv;
+
+  wrapProgramFlags = [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gcc-unwrapped.lib zlib ]}"
+    "--prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}"
+    # Fix libQt errors - #96490
+    "--set USE_WOLFRAM_LD_LIBRARY_PATH 1"
+    # Fix xkeyboard config path for Qt
+    "--set QT_XKB_CONFIG_ROOT ${xkeyboard_config}/share/X11/xkb"
+  ] ++ lib.optionals cudaSupport [
+    "--set CUDA_PATH ${cudaEnv}"
+    "--set NVIDIA_DRIVER_LIBRARY_PATH ${addOpenGLRunpath.driverLink}/lib/libnvidia-tls.so"
+    "--set CUDA_LIBRARY_PATH ${addOpenGLRunpath.driverLink}/lib/libcuda.so"
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    # Find offset from file
+    offset=$(${stdenv.shell} -c "$(grep -axm1 -e 'offset=.*' $src); echo \$offset" $src)
+    tail -c +$(($offset + 1)) $src | tar -xf -
+
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cd "$TMPDIR/Unix/Installer"
+
+    mkdir -p "$out/lib/udev/rules.d"
+
+    # Patch MathInstaller's shebangs and udev rules dir
+    patchShebangs MathInstaller
+    substituteInPlace MathInstaller \
+      --replace /etc/udev/rules.d $out/lib/udev/rules.d
+
+    # Remove PATH restriction, root and avahi daemon checks, and hostname call
+    sed -i '
+      s/^PATH=/# &/
+      s/isRoot="false"/# &/
+      s/^checkAvahiDaemon$/# &/
+      s/`hostname`/""/
+    ' MathInstaller
+
+    # NOTE: some files placed under HOME may be useful
+    XDG_DATA_HOME="$out/share" HOME="$TMPDIR/home" vernierLink=y \
+      ./MathInstaller -execdir="$out/bin" -targetdir="$out/libexec/Mathematica" -auto -verbose -createdir=y
+
+    # Check if MathInstaller produced any errors
+    errLog="$out/libexec/Mathematica/InstallErrors"
+    if [ -f "$errLog" ]; then
+      echo "Installation errors:"
+      cat "$errLog"
+      return 1
+    fi
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    for bin in $out/libexec/Mathematica/Executables/*; do
+      wrapProgram "$bin" ''${wrapProgramFlags[@]}
+    done
+  '';
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  # This is primarily an IO bound build; there's little benefit to building remotely
+  preferLocalBuild = true;
+
+  # All binaries are already stripped
+  dontStrip = true;
+
+  # NOTE: Some deps are still not found; ignore for now
+  autoPatchelfIgnoreMissingDeps = true;
+}
--- a/pkgs/applications/science/math/mathematica/l10ns.nix
+++ b/pkgs/applications/science/math/mathematica/l10ns.nix
@ -1,106 +0,0 @@
-{ lib
-, requireFile
-, lang
-, majorVersion ? null
-}:
-
-let allVersions = with lib; flip map
-  # N.B. Versions in this list should be ordered from newest to oldest.
-  [
-    {
-      version = "13.0.1";
-      lang = "en";
-      language = "English";
-      sha256 = "3672a920c1b4af1afd480733f6d67665baf8258757dfe59a6ed6d7440cf26dba";
-      installer = "Mathematica_13.0.1_BNDL_LINUX.sh";
-    }
-    {
-      version = "13.0.0";
-      lang = "en";
-      language = "English";
-      sha256 = "15bbad39a5995031325d1d178f63b00e71706d3ec9001eba6d1681fbc991d3e1";
-      installer = "Mathematica_13.0.0_BNDL_LINUX.sh";
-    }
-    {
-      version = "12.3.1";
-      lang = "en";
-      language = "English";
-      sha256 = "51b9cab12fd91b009ea7ad4968a2c8a59e94dc55d2e6cc1d712acd5ba2c4d509";
-      installer = "Mathematica_12.3.1_LINUX.sh";
-    }
-    {
-      version = "12.3.0";
-      lang = "en";
-      language = "English";
-      sha256 = "045df045f6e796ded59f64eb2e0f1949ac88dcba1d5b6e05fb53ea0a4aed7215";
-      installer = "Mathematica_12.3.0_LINUX.sh";
-    }
-    {
-      version = "12.2.0";
-      lang = "en";
-      language = "English";
-      sha256 = "3b6676a203c6adb7e9c418a5484b037974287b5be09c64e7dfea74ddc0e400d7";
-      installer = "Mathematica_12.2.0_LINUX.sh";
-    }
-    {
-      version = "12.1.1";
-      lang = "en";
-      language = "English";
-      sha256 = "02mk8gmv8idnakva1nc7r7mx8ld02lk7jgsj1zbn962aps3bhixd";
-      installer = "Mathematica_12.1.1_LINUX.sh";
-    }
-    {
-      version = "12.1.0";
-      lang = "en";
-      language = "English";
-      sha256 = "15m9l20jvkxh5w6mbp81ys7mx2lx5j8acw5gz0il89lklclgb8z7";
-      installer = "Mathematica_12.1.0_LINUX.sh";
-    }
-    {
-      version = "12.0.0";
-      lang = "en";
-      language = "English";
-      sha256 = "b9fb71e1afcc1d72c200196ffa434512d208fa2920e207878433f504e58ae9d7";
-      installer = "Mathematica_12.0.0_LINUX.sh";
-    }
-    {
-      version = "11.3.0";
-      lang = "en";
-      language = "English";
-      sha256 = "0fcfe208c1eac8448e7be3af0bdb84370b17bd9c5d066c013928c8ee95aed10e";
-      installer = "Mathematica_11.3.0_LINUX.sh";
-    }
-    {
-      version = "11.2.0";
-      lang = "ja";
-      language = "Japanese";
-      sha256 = "916392edd32bed8622238df435dd8e86426bb043038a3336f30df10d819b49b1";
-      installer = "Mathematica_11.2.0_ja_LINUX.sh";
-    }
-  ]
-  ({ version, lang, language, sha256, installer }: {
-    inherit version lang;
-    name = "mathematica-${version}" + optionalString (lang != "en") "-${lang}";
-    src = requireFile {
-      name = installer;
-      message = ''
-        This nix expression requires that ${installer} is
-        already part of the store. Find the file on your Mathematica CD
-        and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
-      '';
-      inherit sha256;
-    };
-  });
-minVersion =
-  with lib;
-  if majorVersion == null
-  then elemAt (builtins.splitVersion (elemAt allVersions 0).version) 0
-  else majorVersion;
-maxVersion = toString (1 + builtins.fromJSON minVersion);
-in
-with lib;
-findFirst (l: (l.lang == lang
-               && l.version >= minVersion
-               && l.version < maxVersion))
-          (throw "Version ${minVersion} in language ${lang} not supported")
-          allVersions
--- a/pkgs/applications/science/math/mathematica/versions.nix
+++ b/pkgs/applications/science/math/mathematica/versions.nix
@ -0,0 +1,103 @@
+{ lib, requireFile }:
+
+let versions = [
+  {
+    version = "13.0.1";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-NnKpIMG0rxr9SAcz9tZ2Zbr4JYdX3+WabtbXRAzybbo=";
+    installer = "Mathematica_13.0.1_BNDL_LINUX.sh";
+  }
+  {
+    version = "13.0.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-FbutOaWZUDEyXR0Xj2OwDnFwbT7JAB66bRaB+8mR0+E=";
+    installer = "Mathematica_13.0.0_BNDL_LINUX.sh";
+  }
+  {
+    version = "12.3.1";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-UbnKsS/ZGwCep61JaKLIpZ6U3FXS5swdcSrNW6LE1Qk=";
+    installer = "Mathematica_12.3.1_LINUX.sh";
+  }
+  {
+    version = "12.3.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-BF3wRfbnlt7Vn2TrLg8ZSayI3LodW24F+1PqCkrtchU=";
+    installer = "Mathematica_12.3.0_LINUX.sh";
+  }
+  {
+    version = "12.2.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-O2Z2ogPGrbfpxBilSEsDeXQoe1vgnGTn3+p03cDkANc=";
+    installer = "Mathematica_12.2.0_LINUX.sh";
+  }
+  {
+    version = "12.1.1";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-rUe4hr5KmGTXD1I/eSYVoFHU68mH2aD2VLZFtOtDswo=";
+    installer = "Mathematica_12.1.1_LINUX.sh";
+  }
+  {
+    version = "12.1.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-56P1KKOTJkQj+K9wppAsnYpej/YB3VUNL7DPLYGgqZY=";
+    installer = "Mathematica_12.1.0_LINUX.sh";
+  }
+  {
+    version = "12.0.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-uftx4a/MHXLCABlv+kNFEtII+ikg4geHhDP1BOWK6dc=";
+    installer = "Mathematica_12.0.0_LINUX.sh";
+  }
+  {
+    version = "11.3.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-D8/iCMHqyESOe+OvC9uENwsXvZxdBmwBOSjI7pWu0Q4=";
+    installer = "Mathematica_11.3.0_LINUX.sh";
+  }
+  {
+    version = "11.2.0";
+    lang = "ja";
+    language = "Japanese";
+    sha256 = "sha256-kWOS7dMr7YYiI430Nd2OhkJrsEMDijM28w3xDYGbSbE=";
+    installer = "Mathematica_11.2.0_ja_LINUX.sh";
+  }
+  {
+    version = "9.0.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-mKgxdd7dLWa5EOuR5C37SeU+UC9Cv5YTbY5xSK9y34A=";
+    installer = "Mathematica_9.0.0_LINUX.sh";
+  }
+  {
+    version = "10.0.2";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-NHUg1jzLos1EsIr8TdYdNaA5+3jEcFqVZIr9GVVUXrQ=";
+    installer = "Mathematica_10.0.2_LINUX.sh";
+  }
+];
+
+in
+
+lib.flip map versions ({ version, lang, language, sha256, installer }: {
+  inherit version lang;
+  src = requireFile {
+    name = installer;
+    message = ''
+      This nix expression requires that ${installer} is
+      already part of the store. Find the file on your Mathematica CD
+      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
+    '';
+    inherit sha256;
+  };
+})
--- a/pkgs/data/fonts/ibm-plex/default.nix
+++ b/pkgs/data/fonts/ibm-plex/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "6.0.0";
+  version = "6.0.1";

 in fetchzip {
  name = "ibm-plex-${version}";
@ -13,7 +13,7 @@ in fetchzip {
    unzip -j $downloadedFile "OpenType/*/*.otf" -x "OpenType/IBM-Plex-Sans-JP/unhinted/*" -d $out/share/fonts/opentype
  '';

-  sha256 = "0zv9kw4hmchf374pl0iajzybmx5wklsplg56j115m46i4spij6mr";
+  sha256 = "sha256-HxO0L5Q6WJQBqtg64cczzuRcSYi4jEqbOzEWxDmqFp8=";

  meta = with lib; {
    description = "IBM Plex Typeface";
--- a/pkgs/data/fonts/public-sans/default.nix
+++ b/pkgs/data/fonts/public-sans/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "2.000";
+  version = "2.001";
 in fetchzip {
  name = "public-sans-${version}";

@ -13,11 +13,12 @@ in fetchzip {
    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
  '';

-  sha256 = "0r34h9mim5c3h48cpq2m2ixkdqhv3i594pip10pavkmskldpbha5";
+  sha256 = "sha256-Ba7D4J72GZQsGn0KINRib9BmHsAnoEsAwAOC+M3CkMU=";

  meta = with lib; {
    description = "A strong, neutral, principles-driven, open source typeface for text or display";
    homepage = "https://public-sans.digital.gov/";
+    changelog = "https://github.com/uswds/public-sans/raw/v${version}/FONTLOG.txt";
    license = licenses.ofl;
    maintainers = with maintainers; [ dtzWill ];
    platforms = platforms.all;
--- a/pkgs/data/themes/flat-remix-gnome/default.nix
+++ b/pkgs/data/themes/flat-remix-gnome/default.nix
@ -7,25 +7,25 @@
 let
  # make install will use dconf to find desktop background file uri.
  # consider adding an args to allow specify pictures manually.
-  # https://github.com/daniruiz/flat-remix-gnome/blob/20220422/Makefile#L38
+  # https://github.com/daniruiz/flat-remix-gnome/blob/20220510/Makefile#L38
  fake-dconf = writeScriptBin "dconf" "echo -n";
 in
 stdenv.mkDerivation rec {
  pname = "flat-remix-gnome";
-  version = "20220422";
+  version = "20220510";

  src = fetchFromGitHub {
    owner = "daniruiz";
    repo = pname;
    rev = version;
-    hash = "sha256-W/BNn10SggtBacelNljPh42jVMBfykJFRWBCaj/ar7U=";
+    hash = "sha256-sqHX3APeblZai6NBgY+bnRnkzn6CGXwppiQ4pb8HTTw=";
  };

  nativeBuildInputs = [ glib fake-dconf ];
  makeFlags = [ "PREFIX=$(out)" ];
  preInstall = ''
    # make install will back up this file, it will fail if the file doesn't exist.
-    # https://github.com/daniruiz/flat-remix-gnome/blob/20220422/Makefile#L56
+    # https://github.com/daniruiz/flat-remix-gnome/blob/20220510/Makefile#L56
    mkdir -p $out/share/gnome-shell/
    touch $out/share/gnome-shell/gnome-shell-theme.gresource
  '';
--- a/pkgs/development/compilers/crystal/build-package.nix
+++ b/pkgs/development/compilers/crystal/build-package.nix
@ -72,16 +72,17 @@ stdenv.mkDerivation (mkDerivationArgs // {

  PREFIX = placeholder "out";

-  buildInputs = args.buildInputs or [ ] ++ [ crystal ]
-    ++ lib.optional (format != "crystal") shards;
+  strictDeps = true;
+  buildInputs = args.buildInputs or [ ] ++ [ crystal ];

  nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [
+    crystal
    git
    installShellFiles
    removeReferencesTo
    pkg-config
    which
-  ];
+  ] ++ lib.optional (format != "crystal") shards;

  buildPhase = args.buildPhase or (lib.concatStringsSep "\n" ([
    "runHook preBuild"
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@ -145,9 +145,10 @@ let
        export CRYSTAL_CACHE_DIR=$TMP
      '';

-      buildInputs = commonBuildInputs extraBuildInputs;

+      strictDeps = true;
      nativeBuildInputs = [ binary makeWrapper which pkg-config llvmPackages.llvm ];
+      buildInputs = commonBuildInputs extraBuildInputs;

      makeFlags = [
        "CRYSTAL_CONFIG_VERSION=${version}"
--- a/pkgs/development/compilers/mercury/default.nix
+++ b/pkgs/development/compilers/mercury/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "mercury";
-  version = "20.06.1";
+  version = "22.01.1";

  src = fetchurl {
    url    = "https://dl.mercurylang.org/release/mercury-srcdist-${version}.tar.gz";
-    sha256 = "ef093ae81424c4f3fe696eff9aefb5fb66899e11bb17ae0326adfb70d09c1c1f";
+    sha256 = "sha256-Cg0ixQtpmus6Q3fuc45OLheKCCTiTW3z1XJzxQ1OL6c=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/interpreters/php/8.0.nix
+++ b/pkgs/development/interpreters/php/8.0.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.0.18";
-    sha256 = "sha256-gm7jSIGhw0lnjU98xV/5FB+hQRNE5LuPldD5IjvOtVo=";
+    version = "8.0.19";
+    sha256 = "66Dmf9r2kEsuS4TgZL4KDWGyy2SiP4GgypsaUbw6gzA=";
  });

 in
--- a/pkgs/development/interpreters/php/8.1.nix
+++ b/pkgs/development/interpreters/php/8.1.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.1.5";
-    sha256 = "sha256-gn3lZ3HDq4MToGmBLxX27EmYnVEK69Dc4YCDnG2Nb/M=";
+    version = "8.1.6";
+    sha256 = "ezUzBLdAdVT3DT4QGiJqH8It7K5cTELtJwxOOJv6G2Y=";
  });

 in
--- a/pkgs/development/libraries/boost/1.79.nix
+++ b/pkgs/development/libraries/boost/1.79.nix
@ -0,0 +1,14 @@
+{ callPackage, fetchurl, fetchpatch, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  version = "1.79.0";
+
+  src = fetchurl {
+    urls = [
+      "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
+      "https://dl.bintray.com/boostorg/release/${version}/source/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
+    ];
+    # SHA256 from http://www.boost.org/users/history/version_1_79_0.html
+    sha256 = "475d589d51a7f8b3ba2ba4eda022b170e562ca3b760ee922c146b6c65856ef39";
+  };
+})
--- a/pkgs/development/libraries/boost/default.nix
+++ b/pkgs/development/libraries/boost/default.nix
@ -46,4 +46,5 @@ in {
  boost175 = makeBoost ./1.75.nix;
  boost177 = makeBoost ./1.77.nix;
  boost178 = makeBoost ./1.78.nix;
+  boost179 = makeBoost ./1.79.nix;
 }
--- a/pkgs/development/libraries/boringssl/default.nix
+++ b/pkgs/development/libraries/boringssl/default.nix
@ -26,6 +26,8 @@ buildGoModule {
  # (if we use postConfigure then cmake will loop runHook postConfigure)
  preBuild = ''
    cmakeConfigurePhase
+  '' + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    export GOARCH=$(go env GOHOSTARCH)
  '';

  buildPhase = ''
--- a/pkgs/development/libraries/libbtbb/default.nix
+++ b/pkgs/development/libraries/libbtbb/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake }:
+{ stdenv, lib, fetchFromGitHub, cmake, CoreServices }:

 stdenv.mkDerivation rec {
  pname = "libbtbb";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    sha256 = "1byv8174xam7siakr1p0523x97wkh0fmwmq341sd3g70qr2g767d";
  };

-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals stdenv.isDarwin [ CoreServices ];

  meta = with lib; {
    description = "Bluetooth baseband decoding library";
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@ -17,7 +17,7 @@
 , rust
 , cargo
 , gi-docgen
-, python3
+, python3Packages
 , gnome
 , vala
 , withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
    pkg-config
    rustc
    cargo
-    python3.pkgs.docutils
+    python3Packages.docutils
    vala
    rustPlatform.cargoSetupHook
  ] ++ lib.optionals withIntrospection [
@ -125,7 +125,7 @@ stdenv.mkDerivation rec {
    mv $GDK_PIXBUF/loaders.cache.tmp $GDK_PIXBUF/loaders.cache
  '';

-  postFixup = ''
+  postFixup = lib.optionalString withIntrospection ''
    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
    moveToOutput "share/doc" "$devdoc"
  '';
--- a/pkgs/development/libraries/protobuf/3.10.nix
+++ b/pkgs/development/libraries/protobuf/3.10.nix
@ -1,6 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic-v3.nix {
-  version = "3.10.1";
-  sha256 = "1kbi2i1m5c7ss02ip8h0bdzvns4dgxx30a5c0iiph8g2ns02lr33";
-}
--- a/pkgs/development/libraries/protobuf/3.12.nix
+++ b/pkgs/development/libraries/protobuf/3.12.nix
@ -1,6 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic-v3.nix {
-  version = "3.12.4";
-  sha256 = "1gzvnd0g5hmx5ln39w7p4z4qphw87ksgsa1fgbpvi8d0asmwab2p";
-}
--- a/pkgs/development/libraries/protobuf/3.13.nix
+++ b/pkgs/development/libraries/protobuf/3.13.nix
@ -1,6 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic-v3.nix {
-  version = "3.13.0.1";
-  sha256 = "1r3hvbvjjww6pdk0mlg1lym7avxn8851xm8dg98bf4zq4vyrcw12";
-}
--- a/pkgs/development/libraries/protobuf/3.14.nix
+++ b/pkgs/development/libraries/protobuf/3.14.nix
@ -1,6 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic-v3.nix {
-  version = "3.14.0";
-  sha256 = "1k4kkb78kdbz732wsph07v3zy3cz7l1msk2byrfvp0nb02sfl3a4";
-}
--- a/pkgs/development/libraries/protobuf/3.15.nix
+++ b/pkgs/development/libraries/protobuf/3.15.nix
@ -1,6 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic-v3.nix {
-  version = "3.15.8";
-  sha256 = "1q3k8axhq6g8fqczmd6kbgzpdplrrgygppym4x1l99lzhplx9rqv";
-}
--- a/pkgs/development/libraries/protobuf/3.16.nix
+++ b/pkgs/development/libraries/protobuf/3.16.nix
@ -1,6 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic-v3.nix {
-  version = "3.16.1";
-  sha256 = "sha256-eOwUyZtrmyh3HwLQ1kLnk+briaXQPrlUqtbFol/nGBo=";
-}
--- a/pkgs/development/libraries/protobuf/3.18.nix
+++ b/pkgs/development/libraries/protobuf/3.18.nix
@ -1,6 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic-v3.nix {
-  version = "3.18.2";
-  sha256 = "sha256-IXxVTZOAKVMuGCJtD32rVQRBJRWUJMEK2d+fPEmgzRU=";
-}
--- a/pkgs/development/libraries/protobuf/3.6.nix
+++ b/pkgs/development/libraries/protobuf/3.6.nix
@ -1,6 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic-v3.nix {
-  version = "3.6.1.3";
-  sha256 = "1spj0d4flx6h3phxx3sg9r00yv734hina3365avkcz9brnm089c1";
-}
--- a/pkgs/development/libraries/protobuf/3.9.nix
+++ b/pkgs/development/libraries/protobuf/3.9.nix
@ -1,6 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic-v3.nix {
-  version = "3.9.2";
-  sha256 = "080zxa9w1pxp5y05aiwc0c8mlqkkh98wmid4l7m99cliphsd4qnn";
-}
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@ -120314,7 +120314,7 @@ in
  "rust-analyzer-build-deps-../../applications/editors/vscode/extensions/rust-analyzer/build-deps" = nodeEnv.buildNodePackage {
    name = "rust-analyzer";
    packageName = "rust-analyzer";
-    version = "0.2.975";
+    version = "0.2.1048";
    src = ../../applications/editors/vscode/extensions/rust-analyzer/build-deps;
    dependencies = [
      sources."@eslint/eslintrc-1.2.3"
--- a/pkgs/development/ocaml-modules/reperf/default.nix
+++ b/pkgs/development/ocaml-modules/reperf/default.nix
@ -17,7 +17,7 @@ buildDunePackage rec {

  nativeBuildInputs = [ reason ];

-  buildInputs = [
+  propagatedBuildInputs = [
    printbox-text
  ];

--- a/pkgs/development/ocaml-modules/telegraml/default.nix
+++ b/pkgs/development/ocaml-modules/telegraml/default.nix
@ -0,0 +1,34 @@
+{ batteries
+, buildDunePackage
+, cohttp-lwt-unix
+, fetchFromGitHub
+, lib
+, logs
+, yojson
+}:
+
+buildDunePackage rec {
+  pname = "telegraml";
+  version = "unstable-2021-06-17";
+
+  src = fetchFromGitHub {
+    owner = "nv-vn";
+    repo = "TelegraML";
+    rev = "3e28933a287e5eacd34c46b434c487f155397abc";
+    sha256 = "sha256-2bMHARatwl8Zl/fWppvwbH6Ut+igJVKzwyQb8Q4gem4=";
+  };
+
+  propagatedBuildInputs = [
+    batteries
+    cohttp-lwt-unix
+    logs
+    yojson
+  ];
+
+  meta = with lib; {
+    description = "An OCaml library implementing the Telegram bot API";
+    homepage = "https://github.com/nv-vn/TelegraML/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ superherointj ];
+  };
+}
--- a/pkgs/development/python-modules/enhancements/default.nix
+++ b/pkgs/development/python-modules/enhancements/default.nix
@ -0,0 +1,43 @@
+{ lib
+, argcomplete
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, typeguard
+}:
+
+buildPythonPackage rec {
+  pname = "enhancements";
+  version = "0.4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "ssh-mitm";
+    repo = "python-enhancements";
+    rev = version;
+    hash = "sha256-Nff44WAQwSbkRpUHb9ANsQWWH2B819gtwQdXAjWJJls=";
+  };
+
+  propagatedBuildInputs = [
+    argcomplete
+    typeguard
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "enhancements"
+  ];
+
+  meta = with lib; {
+    description = "Library which extends various Python classes";
+    homepage = "https://enhancements.readthedocs.io";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/invoke/default.nix
+++ b/pkgs/development/python-modules/invoke/default.nix
@ -7,17 +7,15 @@

 buildPythonPackage rec {
  pname = "invoke";
-  version = "1.7.0";
+  version = "1.7.1";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
-
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-4zLkneQEY/IBYxX1HfQjE4VXcr6GQ1aGFWvBj0W1zGw=";
+    hash = "sha256-e23q9YXu4KhIIF0LjAAUub9vKHqOt5iBimQt/x3xSxk=";
  };

-  patchPhase = ''
+  postPatch = ''
    sed -e 's|/bin/bash|${bash}/bin/bash|g' -i invoke/config.py
  '';

--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "losant-rest";
-  version = "1.16.1";
+  version = "1.16.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "Losant";
    repo = "losant-rest-python";
    rev = "v${version}";
-    sha256 = "sha256-mdSqGeVfZTSW65eQiYerjlq6afq2dyYjUi38DVsI6wQ=";
+    sha256 = "sha256-OR5SegUfui5g11QZZJzAq8nhp7bFjS4Ip2gMjfx7tpA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/nose-randomly/default.nix
+++ b/pkgs/development/python-modules/nose-randomly/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , nose
@ -16,7 +17,10 @@ buildPythonPackage rec {

  checkInputs = [ numpy nose ];

-  checkPhase = ''
+  checkPhase = if stdenv.isDarwin then ''
+    # Work around "OSError: AF_UNIX path too long"
+    TMPDIR="/tmp" nosetests
+  '' else ''
    nosetests
  '';

--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@ -35,7 +35,7 @@ buildPythonPackage rec {
    rm scipy/linalg/tests/test_lapack.py
  '';

-  doCheck = true;
+  doCheck = !(stdenv.isx86_64 && stdenv.isDarwin);

  preConfigure = ''
    sed -i '0,/from numpy.distutils.core/s//import setuptools;from numpy.distutils.core/' setup.py
--- a/pkgs/development/python-modules/ssh-mitm/default.nix
+++ b/pkgs/development/python-modules/ssh-mitm/default.nix
@ -0,0 +1,58 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, colored
+, enhancements
+, packaging
+, paramiko
+, pytz
+, pyyaml
+, requests
+, rich
+, sshpubkeys
+, typeguard
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "ssh-mitm";
+  version = "2.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    hash = "sha256-1Vx68ISsT2Vrzy3YBqDqcGEHXHzdKR8jTtBH9SNXT2s=";
+  };
+
+  propagatedBuildInputs = [
+    colored
+    enhancements
+    packaging
+    paramiko
+    pytz
+    pyyaml
+    requests
+    rich
+    sshpubkeys
+    typeguard
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "sshmitm"
+  ];
+
+  meta = with lib; {
+    description = "Tool for SSH security audits";
+    homepage = "https://github.com/ssh-mitm/ssh-mitm";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/uasiren/default.nix
+++ b/pkgs/development/python-modules/uasiren/default.nix
@ -0,0 +1,58 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# build time
+, setuptools-scm
+
+# propagates
+, aiohttp
+
+# tests
+, pytestCheckHook
+}:
+
+let
+  pname = "uasiren";
+  version = "0.0.1";
+in
+
+buildPythonPackage {
+  inherit pname version;
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "PaulAnnekov";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-NHrnG5Vhz+JZgcTJyfIgGz0Ye+3dFVv2zLCCqw2++oM=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "uasiren"
+    "uasiren.client"
+  ];
+
+  meta = with lib; {
+    changelog = "https://github.com/PaulAnnekov/uasiren/releases/tag/v${version}";
+    description = "Implements siren.pp.ua API - public wrapper for api.ukrainealarm.com API that returns info about Ukraine air-raid alarms";
+    homepage = "https://github.com/PaulAnnekov/uasiren";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
+
--- a/pkgs/development/python-modules/weconnect-mqtt/default.nix
+++ b/pkgs/development/python-modules/weconnect-mqtt/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "weconnect-mqtt";
-  version = "0.33.0";
+  version = "0.34.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "tillsteinbach";
    repo = "WeConnect-mqtt";
    rev = "v${version}";
-    sha256 = "sha256-m8T1ngTcqwrel4EW8jvXg7RH+TtYyZRvIR33kzgda7E=";
+    sha256 = "sha256-Gj+hXgGkOqKnZ4W2iZ9P6JN3lYMoREMSF/wfGwLL/tc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/weconnect/default.nix
+++ b/pkgs/development/python-modules/weconnect/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "weconnect";
-  version = "0.39.0";
+  version = "0.40.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "tillsteinbach";
    repo = "WeConnect-python";
    rev = "v${version}";
-    sha256 = "sha256-O5Dh0RWvSXCIF0savyNG5XDhGqCTJZHQpJM4VEX+S9w=";
+    sha256 = "sha256-NXINATb8/yDPnpwQEbPhuazdTlsZqv7BUPzedIg0IV4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -32,13 +32,13 @@ with py.pkgs;

 buildPythonApplication rec {
  pname = "checkov";
-  version = "2.0.1136";
+  version = "2.0.1140";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = version;
-    hash = "sha256-J9ZY0Sy8XWSQ4l1uTeZq3PATVyHXs2tmX/VOUzZKak4=";
+    hash = "sha256-aGO5mjBsUwpLIv73pZH1la6tyGByznTrjkW9dojkXwg=";
  };

  nativeBuildInputs = with py.pkgs; [
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "tfsec";
-  version = "1.20.2";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-1zMFetWPfSJn0QSomLf9yHjbjNyKzUKOfKIBEKUWxIs=";
+    sha256 = "sha256-z2RVMPZykz2FUsmn5sQs3fAK/h+cWv+A/56rhOlHkGA=";
  };

  ldflags = [
@ -21,7 +21,7 @@ buildGoModule rec {
    # "-extldflags '-fno-PIC -static'"
  ];

-  vendorSha256 = "sha256-klgETD1hw9XPJfgiI3sRlYqfhVoh/fhComkCs4BhSI4=";
+  vendorSha256 = "sha256-R5sks8mbY3JpKcVl7XBKst/QI8ZWIqXAR3D6/eflV1Q=";

  subPackages = [
    "cmd/tfsec"
--- a/pkgs/development/tools/kube-linter/default.nix
+++ b/pkgs/development/tools/kube-linter/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kube-linter";
-  version = "0.2.6";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "stackrox";
    repo = pname;
-    rev = "${version}";
-    sha256 = "nBF/AX4hgZxIj9/RYowpHX1eAJMMhvU7wunvEXWnO80=";
+    rev = version;
+    sha256 = "ZqnD9zsh+r1RL34o1nAkvO1saKe721ZJ2+DgBjmsH58=";
  };

-  vendorSha256 = "HJW28BZ9qFLtdH1qdW8/K4TzHA2ptekXaMF0XnMKbOY=";
+  vendorSha256 = "sha256-tm1+2jsktNrw8S7peJz7w8k3+JwAYUgKfKWuQ8zIfvk=";

  ldflags = [
    "-s" "-w" "-X golang.stackrox.io/kube-linter/internal/version.version=${version}"
@ -26,6 +26,6 @@ buildGoModule rec {
    description = "A static analysis tool that checks Kubernetes YAML files and Helm charts";
    homepage = "https://kubelinter.io";
    license = licenses.asl20;
-    maintainers = with maintainers; [ mtesseract ];
+    maintainers = with maintainers; [ mtesseract stehessel ];
  };
 }
--- a/pkgs/development/tools/oq/default.nix
+++ b/pkgs/development/tools/oq/default.nix
@ -18,7 +18,8 @@ crystal.buildCrystalPackage rec {
  };

  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ jq libxml2 ];
+  buildInputs = [ libxml2 ];
+  checkInputs = [ jq ];

  format = "shards";

--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
@ -1,9 +1,9 @@
 {
  "url": "https://github.com/ram02z/tree-sitter-fish",
-  "rev": "d482d70ea8e191c05b2c1b613ed6fdff30a14da0",
-  "date": "2022-03-14T15:15:13+00:00",
-  "path": "/nix/store/5ajcf2hl1hph7iky6lwp5vh7a49k587s-tree-sitter-fish",
-  "sha256": "0idnm9lrvj1jhrvrgcddppkc09hr7inciz6k02d0nnxv8pqaw3w6",
+  "rev": "8a3571fc4a702b216ff918a08c9c5895df7ea06c",
+  "date": "2022-05-12T18:32:55+01:00",
+  "path": "/nix/store/vyfppzpljszmwwrk1gdg132c4nswy048-tree-sitter-fish",
+  "sha256": "1svca1agsr29ypn6pz44lwxg4b6a1k5qsm983czk3h16z5igka05",
  "fetchLFS": false,
  "fetchSubmodules": false,
  "deepClone": false,
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
@ -1,9 +1,9 @@
 {
  "url": "https://github.com/tree-sitter/tree-sitter-json",
-  "rev": "137e1ce6a02698fc246cdb9c6b886ed1de9a1ed8",
-  "date": "2022-04-21T11:20:07-07:00",
-  "path": "/nix/store/5f0z08shhb8d03ab4zlaq9ss4dim6k9f-tree-sitter-json",
-  "sha256": "1amiaiizd4mvmnbwqbr8lmisi9831di8r8xck9wyi5sfj3nd8hai",
+  "rev": "67d33d619e4fb729432a6d9aff1f7b08bb563728",
+  "date": "2022-05-12T23:07:45-07:00",
+  "path": "/nix/store/k42yw134pyyxwf5zca5ycagsnin7k967-tree-sitter-json",
+  "sha256": "1rbrb87gsy2l27vn0zmncrqpjnsp6k6yd2b0gwhl0l4flqas7qb4",
  "fetchLFS": false,
  "fetchSubmodules": false,
  "deepClone": false,
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
@ -1,9 +1,9 @@
 {
  "url": "https://github.com/cstrahan/tree-sitter-nix",
-  "rev": "6d6aaa50793b8265b6a8b6628577a0083d3b923d",
-  "date": "2021-11-29T00:27:21-06:00",
-  "path": "/nix/store/6cjadxvqbrh205lsqnk2rnzq3badxdxv-tree-sitter-nix",
-  "sha256": "0cbk6dqppasrvnm87pwfgm718z6b0xmy9m7zj8ysil0h8bklz1w9",
+  "rev": "470b15a60520ff7b86f51732b8d8f1118c86041e",
+  "date": "2022-03-18T01:42:08-05:00",
+  "path": "/nix/store/c5y76kz7wmfq05hfw4xpqz2ahcdy924f-tree-sitter-nix",
+  "sha256": "1hl0mpy0i6r160v6v3nflrdi5fnmd8i5zbx963h5nj9fg4srkb5r",
  "fetchLFS": false,
  "fetchSubmodules": false,
  "deepClone": false,
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
@ -1,9 +1,9 @@
 {
  "url": "https://github.com/6cdh/tree-sitter-scheme",
-  "rev": "aee42e302f36045cdc671223ce10a069203fd604",
-  "date": "2022-04-21T11:07:14+08:00",
-  "path": "/nix/store/jviqv18g5yszjcqmv48rpml6z4q4ccv8-tree-sitter-scheme",
-  "sha256": "1piw1g5w29jxhwrvivpmdkyr2vbi8fpj2idzk8bwvplzbb6hfr7x",
+  "rev": "27fb77db05f890c2823b4bd751c6420378df146b",
+  "date": "2022-05-12T23:43:19+08:00",
+  "path": "/nix/store/8h41l86z17msbbdsqrdr45lcys6r9a83-tree-sitter-scheme",
+  "sha256": "15ziav4gas038442yl8f4yz3a2r7grccwyfcyydxw0xpsjnsn5c2",
  "fetchLFS": false,
  "fetchSubmodules": false,
  "deepClone": false,
--- a/pkgs/development/tools/rust/cargo-bolero/Cargo.lock
+++ b/pkgs/development/tools/rust/cargo-bolero/Cargo.lock
@ -0,0 +1,751 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "addr2line"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ecd88a8c8378ca913a680cd98f0f13ac67383d35993f86c90a70e3f137816b"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "ansi_term"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08f9b8508dccb7687a1d6c4ce66b2b0ecef467c94667de27d8d7fe1f8d2a9cdc"
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "backtrace"
+version = "0.3.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11a17d453482a265fd5f8479f2a3f405566e6ca627837aaddb85af8b1ab8ef61"
+dependencies = [
+ "addr2line",
+ "cc",
+ "cfg-if 1.0.0",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e11e16035ea35e4e5997b393eacbf6f63983188f7a2ad25bfb13465f5ad59de"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bolero"
+version = "0.6.2"
+dependencies = [
+ "bolero-afl",
+ "bolero-engine",
+ "bolero-generator",
+ "bolero-honggfuzz",
+ "bolero-libfuzzer",
+ "cfg-if 1.0.0",
+ "libtest-mimic",
+ "rand",
+]
+
+[[package]]
+name = "bolero-afl"
+version = "0.6.2"
+dependencies = [
+ "bolero-engine",
+ "cc",
+]
+
+[[package]]
+name = "bolero-engine"
+version = "0.6.2"
+dependencies = [
+ "anyhow",
+ "backtrace",
+ "bolero-generator",
+ "lazy_static",
+ "pretty-hex",
+ "rand",
+]
+
+[[package]]
+name = "bolero-generator"
+version = "0.6.2"
+dependencies = [
+ "bolero-generator-derive",
+ "byteorder",
+ "either",
+ "rand",
+ "rand_core",
+]
+
+[[package]]
+name = "bolero-generator-derive"
+version = "0.6.2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "bolero-honggfuzz"
+version = "0.6.2"
+dependencies = [
+ "bolero-engine",
+]
+
+[[package]]
+name = "bolero-libfuzzer"
+version = "0.6.2"
+dependencies = [
+ "bolero-engine",
+ "cc",
+]
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "cargo-bolero"
+version = "0.6.2"
+dependencies = [
+ "anyhow",
+ "bit-set",
+ "bolero",
+ "bolero-afl",
+ "bolero-honggfuzz",
+ "humantime",
+ "rustc_version",
+ "serde",
+ "serde_json",
+ "structopt",
+ "tempfile",
+]
+
+[[package]]
+name = "cc"
+version = "1.0.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+
+[[package]]
+name = "cfg-if"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clap"
+version = "2.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
+dependencies = [
+ "ansi_term",
+ "atty",
+ "bitflags",
+ "strsim",
+ "textwrap",
+ "unicode-width",
+ "vec_map",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b153fe7cbef478c567df0f972e02e6d736db11affe43dfc9c56a9374d1adfb87"
+dependencies = [
+ "crossbeam-utils 0.7.2",
+ "maybe-uninit",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aaa7bd5fb665c6864b5f963dd9097905c54125909c7aa94c9e18507cdbe6c53"
+dependencies = [
+ "cfg-if 1.0.0",
+ "crossbeam-utils 0.8.8",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6455c0ca19f0d2fbf751b908d5c55c1f5cbc65e03c4225427254b46890bdde1e"
+dependencies = [
+ "cfg-if 1.0.0",
+ "crossbeam-epoch",
+ "crossbeam-utils 0.8.8",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1145cf131a2c6ba0615079ab6a638f7e1973ac9c2634fcbeaaad6114246efe8c"
+dependencies = [
+ "autocfg",
+ "cfg-if 1.0.0",
+ "crossbeam-utils 0.8.8",
+ "lazy_static",
+ "memoffset",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3c7c73a2d1e9fc0886a08b93e98eb643461230d5f1925e4036204d5f2e261a8"
+dependencies = [
+ "autocfg",
+ "cfg-if 0.1.10",
+ "lazy_static",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf124c720b7686e3c2663cf54062ab0f68a88af2fb6a030e87e30bf721fcb38"
+dependencies = [
+ "cfg-if 1.0.0",
+ "lazy_static",
+]
+
+[[package]]
+name = "either"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
+
+[[package]]
+name = "fastrand"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3fcf0cee53519c866c09b5de1f6c56ff9d647101f81c1964fa632e148896cdf"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9be70c98951c83b8d2f8f60d7065fa6d5146873094452a1008da8c2f1e4205ad"
+dependencies = [
+ "cfg-if 1.0.0",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "gimli"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78cc372d058dcf6d5ecd98510e7fbc9e5aec4d21de70f65fea8fecebcd881bd4"
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if 1.0.0",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aab8fc367588b89dcee83ab0fd66b72b50b72fa1904d7095045ace2b0c81c35"
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.125"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5916d2ae698f6de9bfb891ad7a8d65c09d232dc58cc4ac433c7da3b2fd84bc2b"
+
+[[package]]
+name = "libtest-mimic"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08a7b8ac1f53f7be8d895ce6f7f534e49581c85c499b47429634b2cb2995e2ae"
+dependencies = [
+ "crossbeam-channel 0.4.4",
+ "rayon",
+ "structopt",
+ "termcolor",
+]
+
+[[package]]
+name = "maybe-uninit"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60302e4db3a61da70c0cb7991976248362f30319e88850c487b9b95bbf059e00"
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "memoffset"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2b29bd4bc3f33391105ebee3589c19197c4271e3e5a9ec9bfe8127eeff8f082"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "object"
+version = "0.28.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e42c982f2d955fac81dd7e1d0e1426a7d702acd9c98d19ab01083a6a0328c424"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
+
+[[package]]
+name = "pretty-hex"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5c99d529f0d30937f6f4b8a86d988047327bb88d04d2c4afc356de74722131"
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9027b48e9d4c9175fa2218adf3557f91c1137021739951d4932f5f8268ac48aa"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1feb54ed693b93a84e14094943b84b7c4eae204c512b7ccb95ab0c66d278ad1"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rayon"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd249e82c21598a9a426a4e00dd7adc1d640b22445ec8545feef801d1a74c221"
+dependencies = [
+ "autocfg",
+ "crossbeam-deque",
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f51245e1e62e1f1629cbfec37b5793bbabcaeb90f30e94d2ba03564687353e4"
+dependencies = [
+ "crossbeam-channel 0.5.4",
+ "crossbeam-deque",
+ "crossbeam-utils 0.8.8",
+ "num_cpus",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62f25bc4c7e55e0b0b7a1d43fb893f4fa1361d0abe38b9ce4f323c2adfe6ef42"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef03e0a2b150c7a90d01faf6254c9c48a41e95fb2a8c2ac1c6f0d2b9aefc342"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b4b750c782965c211b42f022f59af1fbceabdd026623714f104152f1ec149f"
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "semver"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cb243bdfdb5936c8dc3c45762a19d12ab4550cdc753bc247637d4ec35a040fd"
+
+[[package]]
+name = "serde"
+version = "1.0.137"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61ea8d54c77f8315140a05f4c7237403bf38b72704d031543aa1d16abbf517d1"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.137"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f26faba0c3959972377d3b2d306ee9f71faee9714294e41bb777f83f88578be"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b7ce2b32a1aed03c558dc61a5cd328f15aff2dbc17daad8fb8af04d2100e15c"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "strsim"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+
+[[package]]
+name = "structopt"
+version = "0.3.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c6b5c64445ba8094a6ab0c3cd2ad323e07171012d9c98b0b15651daf1787a10"
+dependencies = [
+ "clap",
+ "lazy_static",
+ "structopt-derive",
+]
+
+[[package]]
+name = "structopt-derive"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcb5ae327f9cc13b68763b5749770cb9e048a99bd9dfdfa58d0cf05d5f64afe0"
+dependencies = [
+ "heck",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.93"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04066589568b72ec65f42d65a1a52436e954b168773148893c020269563decf2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
+dependencies = [
+ "cfg-if 1.0.0",
+ "fastrand",
+ "libc",
+ "redox_syscall",
+ "remove_dir_all",
+ "winapi",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e8820f5d777f6224dc4be3632222971ac30164d4a258d595640799554ebfd99"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "957e51f3646910546462e67d5f7599b9e4fb8acdd304b087a6494730f9eebf04"
+
+[[package]]
+name = "vec_map"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
--- a/pkgs/development/tools/rust/cargo-bolero/default.nix
+++ b/pkgs/development/tools/rust/cargo-bolero/default.nix
@ -0,0 +1,25 @@
+{ lib, fetchFromGitHub, rustPlatform, stdenv, libbfd, libopcodes, libunwind }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-bolero";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "camshaft";
+    repo = "bolero";
+    rev = "${pname}-v${version}";
+    sha256 = "1p8g8av0l1qsmq09m0nwyyryk1v5bbah5izl4hf80ivi41mywkyi";
+  };
+
+  cargoLock.lockFile = ./Cargo.lock;
+  postPatch = "cp ${./Cargo.lock} Cargo.lock";
+
+  buildInputs = [ libbfd libopcodes libunwind ];
+
+  meta = with lib; {
+    description = "Fuzzing and property testing front-end framework for Rust";
+    homepage = "https://github.com/camshaft/cargo-bolero";
+    license = with licenses; [ mit ];
+    maintainers = [ maintainers.ekleog ];
+  };
+}
--- a/pkgs/development/tools/scry/default.nix
+++ b/pkgs/development/tools/scry/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, crystal, coreutils, makeWrapper }:
+{ lib, fetchFromGitHub, crystal, coreutils, makeWrapper, bash }:

 crystal.buildCrystalPackage rec {
  pname = "scry";
@ -19,6 +19,7 @@ crystal.buildCrystalPackage rec {
  format = "shards";

  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bash ];

  shardsFile = ./shards.nix;

--- a/pkgs/development/tools/vagrant/gemset_libvirt.nix
+++ b/pkgs/development/tools/vagrant/gemset_libvirt.nix
@ -14,10 +14,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1yff4s5b8wcrk9ldils2k84l46m9nxr0my0wxchzdmgjbjdfsvww";
+      sha256 = "1rv2hq29lx2337214a1p2qy70fi77ch6p0p77nw9h6x84q028qr0";
      type = "gem";
    };
-    version = "0.92.0";
+    version = "0.92.3";
  };
  fog-core = {
    dependencies = ["builder" "excon" "formatador" "mime-types"];
@ -130,10 +130,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1p6b3q411h2mw4dsvhjrp1hh66hha5cm69fqg85vn2lizz71n6xz";
+      sha256 = "11w59ga9324yx6339dgsflz3dsqq2mky1qqdwcg6wi5s1bf2yldi";
      type = "gem";
    };
-    version = "1.13.3";
+    version = "1.13.6";
  };
  racc = {
    groups = ["default"];
@ -171,9 +171,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07fhsgqx9iyni41z1lhfmm4wq6cbiyydkmvmib28jbgyznlxjmzv";
+      sha256 = "1j31y6sjhslj5yr0ssvb36ngm7prfsbdfj6131757jl0l0ri8pyv";
      type = "gem";
    };
-    version = "0.7.0";
+    version = "0.8.2";
  };
 }
--- a/pkgs/misc/drivers/sc-controller/default.nix
+++ b/pkgs/misc/drivers/sc-controller/default.nix
@ -8,13 +8,13 @@

 buildPythonApplication rec {
  pname = "sc-controller";
-  version = "0.4.8.6";
+  version = "0.4.8.7";

  src = fetchFromGitHub {
    owner  = "Ryochan7";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "1fgizgzm79zl9r2kkwvh1gf9lnxaix15283xxk6bz843inr8b88k";
+    sha256 = "03514sb1spaxdr7x1gq7b54z74in4kd060adj6sq1xjj6d9b297i";
  };

  # see https://github.com/NixOS/nixpkgs/issues/56943
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -2,61 +2,61 @@
    "4.14": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.14.277-hardened1.patch",
-            "sha256": "1jjbywmwglnsj80dbic14bip6wfllsgqgw7lcn9s8n12mdr42ps2",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.277-hardened1/linux-hardened-4.14.277-hardened1.patch"
+            "name": "linux-hardened-4.14.278-hardened1.patch",
+            "sha256": "10sihdsfc7zcn2n70gym790ql5lkgiy1q7lv7vavyxbg3j6yzayb",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.278-hardened1/linux-hardened-4.14.278-hardened1.patch"
        },
-        "sha256": "058vzn1gcsc194hgwrj78afawz2anm7ga8a1x5m5i4cw8p1arp73",
-        "version": "4.14.277"
+        "sha256": "1glb6z3nicd2lzhvwcqj54642agk0bbg022wnc3ckld5ngpd9miw",
+        "version": "4.14.278"
    },
    "4.19": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.19.241-hardened1.patch",
-            "sha256": "1ynhclfiswgbm0kdg7nvx4lizixhfskbj91imklsy0mp5brgfpbz",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.241-hardened1/linux-hardened-4.19.241-hardened1.patch"
+            "name": "linux-hardened-4.19.242-hardened1.patch",
+            "sha256": "05fmppfvimppvqi1ghvg43jz8sdd56dffvy9sazpl53vpz3bysy6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.242-hardened1/linux-hardened-4.19.242-hardened1.patch"
        },
-        "sha256": "04zyi22c2d91k7v2w0s8v112cqqf24km599mn18k2nafq79njqjc",
-        "version": "4.19.241"
+        "sha256": "18k5fbzclk7g657bs8idwqjk7hakzx6256b1a3506sy29q4zvg2r",
+        "version": "4.19.242"
    },
    "5.10": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.10.114-hardened1.patch",
-            "sha256": "0ml5ghywz550d5vj1qfw0528ax7pilnf5rvwn4780gqnkn44nbcd",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.114-hardened1/linux-hardened-5.10.114-hardened1.patch"
+            "name": "linux-hardened-5.10.115-hardened1.patch",
+            "sha256": "09sgj4wrsi5j5hz8k3zs8zxq4g0a27dnhpjs1nxvqdz6b8f4xkap",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.115-hardened1/linux-hardened-5.10.115-hardened1.patch"
        },
-        "sha256": "09h5ngcl8clsvsv11q6ksvgcs01whlwbbrlpj1jz8mg3gjsrzl07",
-        "version": "5.10.114"
+        "sha256": "0w9gwizyqjgsj93dqqvlh6bqkmpzjajhj09319nqncc95yrigr7m",
+        "version": "5.10.115"
    },
    "5.15": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.15.38-hardened1.patch",
-            "sha256": "0nrwxi48v8ij1sfh15qkiil2i28vqy24gr9ciklbdl5kgy3glvf4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.38-hardened1/linux-hardened-5.15.38-hardened1.patch"
+            "name": "linux-hardened-5.15.39-hardened1.patch",
+            "sha256": "137zp9z15adf464awh5cl371qvhv2c79yfnva3k31zp0ivjb7kgg",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.39-hardened1/linux-hardened-5.15.39-hardened1.patch"
        },
-        "sha256": "0lhhl766mrl2mbbvn7gkajfzja4v1f96xm9qq3z8pf4h1515shby",
-        "version": "5.15.38"
+        "sha256": "1bfpiyccjggysd04flaana0x69n1lcpckzpw1v6kh3ly9xil31l8",
+        "version": "5.15.39"
    },
    "5.17": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.17.6-hardened1.patch",
-            "sha256": "100lvwzrjq6v69faaydyn3cm03l0kq36hjiyid3iwi035a2vljy8",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.17.6-hardened1/linux-hardened-5.17.6-hardened1.patch"
+            "name": "linux-hardened-5.17.7-hardened1.patch",
+            "sha256": "0p2s6blyzi0ynfrqm5l8ayh41kjkrmznlly6znh3djc1k3l5fc8v",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.17.7-hardened1/linux-hardened-5.17.7-hardened1.patch"
        },
-        "sha256": "035i9i0gg3fxi5ighjrya97592sk0i4xagra6a8m8nxyh21z3k34",
-        "version": "5.17.6"
+        "sha256": "16ccf7n6fns9z93c65lchn5v3fgl9c5vkr1v6p0c1xifn7v7xxi2",
+        "version": "5.17.7"
    },
    "5.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.4.192-hardened1.patch",
-            "sha256": "1i0x4f51qlq3bi7zfk8xvjgrl758y8nidb6wp3f507w6ic1757hg",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.192-hardened1/linux-hardened-5.4.192-hardened1.patch"
+            "name": "linux-hardened-5.4.193-hardened1.patch",
+            "sha256": "1c24chfjkv5yk3gzawxygfl6l58i7a6l2swdk35g5sv8s6p0a9jl",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.193-hardened1/linux-hardened-5.4.193-hardened1.patch"
        },
-        "sha256": "14wyvacajnj6fnxqrash7b8inq0lgmglydqa30kb21zva88jwj1j",
-        "version": "5.4.192"
+        "sha256": "187jfk9hf52n5z9yv56vq1knp3kdcbyk5w5k98ziwcbdjm1x65hd",
+        "version": "5.4.193"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.14.277";
+  version = "4.14.278";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "058vzn1gcsc194hgwrj78afawz2anm7ga8a1x5m5i4cw8p1arp73";
+    sha256 = "1glb6z3nicd2lzhvwcqj54642agk0bbg022wnc3ckld5ngpd9miw";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.19.241";
+  version = "4.19.242";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "04zyi22c2d91k7v2w0s8v112cqqf24km599mn18k2nafq79njqjc";
+    sha256 = "18k5fbzclk7g657bs8idwqjk7hakzx6256b1a3506sy29q4zvg2r";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:

 buildLinux (args // rec {
-  version = "4.9.312";
+  version = "4.9.313";
  extraMeta.branch = "4.9";
  extraMeta.broken = stdenv.isAarch64;

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "09y6wl4j3y46fza6kmssibmxspxx0i44fqrhc2cyvrm2bgxv2bzs";
+    sha256 = "1p3vr1h01ph6x0pxrr6y6k5c4nrhvq650dfngv5mkrgsc5w7ffz0";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.10.114";
+  version = "5.10.115";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "09h5ngcl8clsvsv11q6ksvgcs01whlwbbrlpj1jz8mg3gjsrzl07";
+    sha256 = "0w9gwizyqjgsj93dqqvlh6bqkmpzjajhj09319nqncc95yrigr7m";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.15.38";
+  version = "5.15.39";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -15,6 +15,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0lhhl766mrl2mbbvn7gkajfzja4v1f96xm9qq3z8pf4h1515shby";
+    sha256 = "1bfpiyccjggysd04flaana0x69n1lcpckzpw1v6kh3ly9xil31l8";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.17.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.17.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.17.6";
+  version = "5.17.7";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "035i9i0gg3fxi5ighjrya97592sk0i4xagra6a8m8nxyh21z3k34";
+    sha256 = "16ccf7n6fns9z93c65lchn5v3fgl9c5vkr1v6p0c1xifn7v7xxi2";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.4.192";
+  version = "5.4.193";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "14wyvacajnj6fnxqrash7b8inq0lgmglydqa30kb21zva88jwj1j";
+    sha256 = "187jfk9hf52n5z9yv56vq1knp3kdcbyk5w5k98ziwcbdjm1x65hd";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-zen.nix
+++ b/pkgs/os-specific/linux/kernel/linux-zen.nix
@ -2,7 +2,7 @@

 let
  # having the full version string here makes it easier to update
-  modDirVersion = "5.17.5-zen1";
+  modDirVersion = "5.17.7-zen1";
  parts = lib.splitString "-" modDirVersion;
  version = lib.elemAt parts 0;
  suffix = lib.elemAt parts 1;
@ -20,7 +20,7 @@ buildLinux (args // {
    owner = "zen-kernel";
    repo = "zen-kernel";
    inherit rev;
-    sha256 = "sha256-DWkdnSG+4qMAFdGDmtEItaQZnIiorxLYMqdq5eBqQfs=";
+    sha256 = "sha256-sjXe+L9ZTtHDPLFY5d7Ui0NU0s7fw0qLfXIDnRxpKvE=";
  };

  structuredExtraConfig = with lib.kernel; {
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2022.5.3";
+  version = "2022.5.4";
  components = {
    "abode" = ps: with ps; [
      abodepy
@ -2826,7 +2826,7 @@
    "uk_transport" = ps: with ps; [
    ];
    "ukraine_alarm" = ps: with ps; [
-      ukrainealarm
+      uasiren
    ];
    "unifi" = ps: with ps; [
      aiounifi
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -179,7 +179,7 @@ let
  extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.5.3";
+  hassVersion = "2022.5.4";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@ -197,7 +197,7 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = version;
-    hash = "sha256-g15bMS6xOz6w7JLSVP/tqlKBGWkFsG093GF7fcoHvlg=";
+    hash = "sha256-5juHG1bVeFYrjpAAlt3GoCRmBvyCSOdnSw1WuaNWF8w=";
  };

  # leave this in, so users don't have to constantly update their downstream patch handling
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@ -135,6 +135,8 @@ makeOverlayable (overrideAttrs:
 , # TODO(@Ericson2314): Make always true and remove
  strictDeps ? if config.strictDepsByDefault then true else stdenv.hostPlatform != stdenv.buildPlatform

+, enableParallelBuilding ? config.enableParallelBuildingByDefault
+
 , meta ? {}
 , passthru ? {}
 , pos ? # position used in error messages and for meta.position
@ -383,7 +385,7 @@ else let
          llvm-config = 'llvm-config-native'
        '';
      in [ "--cross-file=${crossFile}" ] ++ mesonFlags;
-    } // lib.optionalAttrs (attrs.enableParallelBuilding or false) {
+    } // lib.optionalAttrs (enableParallelBuilding) {
      enableParallelChecking = attrs.enableParallelChecking or true;
    } // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != [] || stdenv.hostPlatform.isMusl) {
      NIX_HARDENING_ENABLE = enabledHardeningOptions;
--- a/pkgs/tools/backup/restic/rest-server.nix
+++ b/pkgs/tools/backup/restic/rest-server.nix
@ -1,22 +1,27 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:

 buildGoModule rec {
  pname = "restic-rest-server";
  version = "0.11.0";
+  owner = "restic";
+  repo = "rest-server";

  src = fetchFromGitHub {
-    owner = "restic";
-    repo = "rest-server";
+    inherit owner repo;
    rev = "v${version}";
    hash = "sha256-ninPODztNzvB2js9cuNAuExQLK/OGOu80ZNW0BPrdds=";
  };

  vendorSha256 = "sha256-8x5qYvIX/C5BaewrTNVbIIadL+7XegbRUZiEDWmJM+c=";

-  preCheck = ''
-    substituteInPlace cmd/rest-server/main_test.go \
-      --replace "/tmp/restic" "/build/restic"
-  '';
+  patches = [
+    (fetchpatch {
+      name = "backport_rest-server_tests_os.TempDir.patch";
+      url = "https://github.com/${owner}/${repo}/commit/a87a50ad114bdaddc895413396438df6ea0affbb.patch";
+      sha256 = "sha256-O6ENxTK2fCVTZZKTFHrvZ+3dT8TbgbIE0o3sYE/RUqc=";
+    })
+
+  ];

  meta = with lib; {
    inherit (src.meta) homepage;
--- a/pkgs/tools/misc/kakoune-cr/default.nix
+++ b/pkgs/tools/misc/kakoune-cr/default.nix
@ -1,4 +1,4 @@
-{ lib, crystal, fetchFromGitHub, fetchurl, jq }:
+{ lib, crystal, fetchFromGitHub, fetchurl, jq, bash }:
 let
  icon = fetchurl {
    url = "https://github.com/mawww/kakoune/raw/master/doc/kakoune_logo.svg";
@ -16,6 +16,7 @@ crystal.buildCrystalPackage rec {
    hash = "sha256-xFrxbnZl/49vGKdkESPa6LpK0ckq4Jv5GNLL/G0qA1w=";
  };

+  buildInputs = [ bash ];
  propagatedUserEnvPkgs = [ jq ];

  format = "shards";
--- a/pkgs/tools/misc/qflipper/default.nix
+++ b/pkgs/tools/misc/qflipper/default.nix
@ -19,12 +19,14 @@
 , qtquickcontrols2
 , qtgraphicaleffects
 , qtwayland
+, nix-update-script
 }:
 let
-  version = "1.0.1";
+  pname = "qFlipper";
+  version = "1.0.2";
+  sha256 = "sha256-CJQOEUwYPNd4x+uBINrxeYVITtYrsEFaYLHQh2l12kA=";
  timestamp = "99999999999";
  commit = "nix-${version}";
-  hash = "sha256-vHBlrtQ06kjjXXGL/jSdpAPHgqb7Vn1c6jXZVXwxHPQ=";

  udev_rules = ''
    #Flipper Zero serial port
@ -35,15 +37,14 @@ let

 in
 mkDerivation {
-  pname = "qFlipper";
-  inherit version;
+  inherit pname version;

  src = fetchFromGitHub {
    owner = "flipperdevices";
    repo = "qFlipper";
    rev = version;
-    inherit hash;
    fetchSubmodules = true;
+    inherit sha256;
  };

  nativeBuildInputs = [
@ -96,6 +97,10 @@ mkDerivation {
    EOF
  '';

+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
  meta = with lib; {
    description = "Cross-platform desktop tool to manage your flipper device";
    homepage = "https://flipperzero.one/";
--- a/pkgs/tools/misc/upterm/default.nix
+++ b/pkgs/tools/misc/upterm/default.nix
@ -2,6 +2,7 @@
 , buildGo118Module
 , fetchFromGitHub
 , installShellFiles
+, nixosTests
 }:

 buildGo118Module rec {
@ -29,6 +30,8 @@ buildGo118Module rec {

  doCheck = true;

+  passthru.tests = { inherit (nixosTests) uptermd; };
+
  __darwinAllowLocalNetworking = true;

  meta = with lib; {
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -89,12 +89,12 @@ in lib.makeExtensible (self: {

  unstable = lib.lowPrio (common rec {
    version = "2.8";
-    suffix = "pre20220505_${lib.substring 0 7 src.rev}";
+    suffix = "pre20220512_${lib.substring 0 7 src.rev}";
    src = fetchFromGitHub {
      owner = "NixOS";
      repo = "nix";
-      rev = "f4102de84ba4dd3b845a3e34fabab5400e066ad0";
-      sha256 = "sha256-g3GDM8MSzJ27hJoGWj2QGjINZP/I1KCJpZZn+iPMmfM=";
+      rev = "d354fc30b9768ea3dc737a88b57bf5e26d98135b";
+      sha256 = "sha256-wwhezwy3HKeHKJX48ps2qD46f6bL9GDxsFE2QJ+qPHQ=";
    };
  });
 })
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"

-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.1.41"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.1.42"
--- a/Show More
+++ b/Show More