Merge #135477: branch 'staging-next'

2024-11-29 02:13:23 +00:00 · 2021-09-15 08:35:08 +02:00 · 2021-09-15 08:35:08 +02:00 · ff94eef5c1
commit ff94eef5c1
parent 42e33503ec 5663f4625d
642 changed files with 6486 additions and 4090 deletions
--- a/doc/builders/packages/linux.section.md
+++ b/doc/builders/packages/linux.section.md
@ -16,7 +16,7 @@ How to add a new (major) version of the Linux kernel to Nixpkgs:

 1.  Copy the old Nix expression (e.g. `linux-2.6.21.nix`) to the new one (e.g. `linux-2.6.22.nix`) and update it.

-2.  Add the new kernel to `all-packages.nix` (e.g., create an attribute `kernel_2_6_22`).
+2.  Add the new kernel to the `kernels` attribute set in `linux-kernels.nix` (e.g., create an attribute `kernel_2_6_22`).

 3.  Now we’re going to update the kernel configuration. First unpack the kernel. Then for each supported platform (`i686`, `x86_64`, `uml`) do the following:

@ -36,6 +36,6 @@ How to add a new (major) version of the Linux kernel to Nixpkgs:

    5.  Copy `.config` over the new config file (e.g. `config-2.6.22-i686-smp`).

-4.  Test building the kernel: `nix-build -A kernel_2_6_22`. If it compiles, ship it! For extra credit, try booting NixOS with it.
+4.  Test building the kernel: `nix-build -A linuxKernel.kernels.kernel_2_6_22`. If it compiles, ship it! For extra credit, try booting NixOS with it.

-5.  It may be that the new kernel requires updating the external kernel modules and kernel-dependent packages listed in the `linuxPackagesFor` function in `all-packages.nix` (such as the NVIDIA drivers, AUFS, etc.). If the updated packages aren’t backwards compatible with older kernels, you may need to keep the older versions around.
+5.  It may be that the new kernel requires updating the external kernel modules and kernel-dependent packages listed in the `linuxPackagesFor` function in `linux-kernels.nix` (such as the NVIDIA drivers, AUFS, etc.). If the updated packages aren’t backwards compatible with older kernels, you may need to keep the older versions around.
--- a/nixos/doc/manual/configuration/linux-kernel.chapter.md
+++ b/nixos/doc/manual/configuration/linux-kernel.chapter.md
@ -5,13 +5,18 @@ option `boot.kernelPackages`. For instance, this selects the Linux 3.10
 kernel:

 ```nix
-boot.kernelPackages = pkgs.linuxPackages_3_10;
+boot.kernelPackages = pkgs.linuxKernel.packages.linux_3_10;
 ```

 Note that this not only replaces the kernel, but also packages that are
 specific to the kernel version, such as the NVIDIA video drivers. This
 ensures that driver packages are consistent with the kernel.

+While `pkgs.linuxKernel.packages` contains all available kernel packages,
+you may want to use one of the unversioned `pkgs.linuxPackages_*` aliases
+such as `pkgs.linuxPackages_latest`, that are kept up to date with new
+versions.
+
 The default Linux kernel configuration should be fine for most users.
 You can see the configuration of your current kernel with the following
 command:
@ -25,14 +30,13 @@ If you want to change the kernel configuration, you can use the
 instance, to enable support for the kernel debugger KGDB:

 ```nix
-nixpkgs.config.packageOverrides = pkgs:
-  { linux_3_4 = pkgs.linux_3_4.override {
-      extraConfig =
-        ''
-          KGDB y
-        '';
-    };
+nixpkgs.config.packageOverrides = pkgs: pkgs.lib.recursiveUpdate pkgs {
+  linuxKernel.kernels.linux_5_10 = pkgs.linuxKernel.kernels.linux_5_10.override {
+    extraConfig = ''
+      KGDB y
+    '';
  };
+};
 ```

 `extraConfig` takes a list of Linux kernel configuration options, one
@ -72,16 +76,17 @@ available parameters, run `sysctl -a`.

 The first step before compiling the kernel is to generate an appropriate
 `.config` configuration. Either you pass your own config via the
-`configfile` setting of `linuxManualConfig`:
+`configfile` setting of `linuxKernel.manualConfig`:

 ```nix
-custom-kernel = super.linuxManualConfig {
-  inherit (super) stdenv hostPlatform;
-  inherit (linux_4_9) src;
-  version = "${linux_4_9.version}-custom";
+custom-kernel = let base_kernel = linuxKernel.kernels.linux_4_9;
+  in super.linuxKernel.manualConfig {
+    inherit (super) stdenv hostPlatform;
+    inherit (base_kernel) src;
+    version = "${base_kernel.version}-custom";

-  configfile = /home/me/my_kernel_config;
-  allowImportFromDerivation = true;
+    configfile = /home/me/my_kernel_config;
+    allowImportFromDerivation = true;
 };
 ```

--- a/nixos/doc/manual/from_md/configuration/linux-kernel.chapter.xml
+++ b/nixos/doc/manual/from_md/configuration/linux-kernel.chapter.xml
@ -6,7 +6,7 @@
    selects the Linux 3.10 kernel:
  </para>
  <programlisting language="bash">
-boot.kernelPackages = pkgs.linuxPackages_3_10;
+boot.kernelPackages = pkgs.linuxKernel.packages.linux_3_10;
 </programlisting>
  <para>
    Note that this not only replaces the kernel, but also packages that
@ -14,6 +14,13 @@ boot.kernelPackages = pkgs.linuxPackages_3_10;
    drivers. This ensures that driver packages are consistent with the
    kernel.
  </para>
+  <para>
+    While <literal>pkgs.linuxKernel.packages</literal> contains all
+    available kernel packages, you may want to use one of the
+    unversioned <literal>pkgs.linuxPackages_*</literal> aliases such as
+    <literal>pkgs.linuxPackages_latest</literal>, that are kept up to
+    date with new versions.
+  </para>
  <para>
    The default Linux kernel configuration should be fine for most
    users. You can see the configuration of your current kernel with the
@ -29,14 +36,13 @@ zcat /proc/config.gz
    enable support for the kernel debugger KGDB:
  </para>
  <programlisting language="bash">
-nixpkgs.config.packageOverrides = pkgs:
-  { linux_3_4 = pkgs.linux_3_4.override {
-      extraConfig =
-        ''
-          KGDB y
-        '';
-    };
+nixpkgs.config.packageOverrides = pkgs: pkgs.lib.recursiveUpdate pkgs {
+  linuxKernel.kernels.linux_5_10 = pkgs.linuxKernel.kernels.linux_5_10.override {
+    extraConfig = ''
+      KGDB y
+    '';
  };
+};
 </programlisting>
  <para>
    <literal>extraConfig</literal> takes a list of Linux kernel
@ -82,16 +88,17 @@ boot.kernel.sysctl.&quot;net.ipv4.tcp_keepalive_time&quot; = 120;
      The first step before compiling the kernel is to generate an
      appropriate <literal>.config</literal> configuration. Either you
      pass your own config via the <literal>configfile</literal> setting
-      of <literal>linuxManualConfig</literal>:
+      of <literal>linuxKernel.manualConfig</literal>:
    </para>
    <programlisting language="bash">
-custom-kernel = super.linuxManualConfig {
-  inherit (super) stdenv hostPlatform;
-  inherit (linux_4_9) src;
-  version = &quot;${linux_4_9.version}-custom&quot;;
+custom-kernel = let base_kernel = linuxKernel.kernels.linux_4_9;
+  in super.linuxKernel.manualConfig {
+    inherit (super) stdenv hostPlatform;
+    inherit (base_kernel) src;
+    version = &quot;${base_kernel.version}-custom&quot;;

-  configfile = /home/me/my_kernel_config;
-  allowImportFromDerivation = true;
+    configfile = /home/me/my_kernel_config;
+    allowImportFromDerivation = true;
 };
 </programlisting>
    <para>
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -983,6 +983,20 @@ Superuser created successfully.
  <section xml:id="sec-release-21.11-notable-changes">
    <title>Other Notable Changes</title>
    <itemizedlist>
+      <listitem>
+        <para>
+          The linux kernel package infrastructure was moved out of
+          <literal>all-packages.nix</literal>, and restructured. Linux
+          related functions and attributes now live under the
+          <literal>pkgs.linuxKernel</literal> attribute set. In
+          particular the versioned <literal>linuxPackages_*</literal>
+          package sets (such as <literal>linuxPackages_5_4</literal>)
+          and kernels from <literal>pkgs</literal> were moved there and
+          now live under <literal>pkgs.linuxKernel.packages.*</literal>.
+          The unversioned ones (such as
+          <literal>linuxPackages_latest</literal>) remain untouched.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The setting
@ -1171,6 +1185,24 @@ Superuser created successfully.
          but instead use more of the YAML-specific syntax.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          MariaDB was upgraded from 10.5.x to 10.6.x. Please read the
+          <link xlink:href="https://mariadb.com/kb/en/changes-improvements-in-mariadb-106/">upstream
+          release notes</link> for changes and upgrade instructions.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The MariaDB C client library, also known as libmysqlclient or
+          mariadb-connector-c, was upgraded from 3.1.x to 3.2.x. While
+          this should hopefully not have any impact, this upgrade comes
+          with some changes to default behavior, so you might want to
+          review the
+          <link xlink:href="https://mariadb.com/kb/en/changes-and-improvements-in-mariadb-connector-c-32/">upstream
+          release notes</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          GNOME desktop environment now enables
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -302,6 +302,9 @@ To be able to access the web UI this port needs to be opened in the firewall.

 ## Other Notable Changes {#sec-release-21.11-notable-changes}

+- The linux kernel package infrastructure was moved out of `all-packages.nix`, and restructured. Linux related functions and attributes now live under the `pkgs.linuxKernel` attribute set.
+  In particular the versioned `linuxPackages_*` package sets (such as `linuxPackages_5_4`) and kernels from `pkgs` were moved there and now live under `pkgs.linuxKernel.packages.*`. The unversioned ones (such as `linuxPackages_latest`) remain untouched.
+
 - The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.

  However, if [`services.fail2ban.enable`](options.html#opt-services.fail2ban.enable) is `true`, the `fail2ban` will override the verbosity to `"VERBOSE"`, so that `fail2ban` can observe the failed login attempts from the SSH logs.
@ -352,6 +355,10 @@ To be able to access the web UI this port needs to be opened in the firewall.

 - `lib.formats.yaml`'s `generate` will not generate JSON anymore, but instead use more of the YAML-specific syntax.

+- MariaDB was upgraded from 10.5.x to 10.6.x. Please read the [upstream release notes](https://mariadb.com/kb/en/changes-improvements-in-mariadb-106/) for changes and upgrade instructions.
+
+- The MariaDB C client library, also known as libmysqlclient or mariadb-connector-c, was upgraded from 3.1.x to 3.2.x. While this should hopefully not have any impact, this upgrade comes with some changes to default behavior, so you might want to review the [upstream release notes](https://mariadb.com/kb/en/changes-and-improvements-in-mariadb-connector-c-32/).
+
 - GNOME desktop environment now enables `QGnomePlatform` as the Qt platform theme, which should avoid crashes when opening file chooser dialogs in Qt apps by using XDG desktop portal. Additionally, it will make the apps fit better visually.

 - `rofi` has been updated from '1.6.1' to '1.7.0', one important thing is the removal of the old xresources based configuration setup. Read more [in rofi's changelog](https://github.com/davatorium/rofi/blob/cb12e6fc058f4a0f4f/Changelog#L1).
--- a/nixos/modules/installer/cd-dvd/system-tarball-fuloong2f.nix
+++ b/nixos/modules/installer/cd-dvd/system-tarball-fuloong2f.nix
@ -93,7 +93,7 @@ in
  boot.initrd.availableKernelModules =
    [ "vfat" "reiserfs" ];

-  boot.kernelPackages = pkgs.linuxPackages_3_10;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_3_10;
  boot.kernelParams = [ "console=tty1" ];

  boot.postBootCommands =
--- a/nixos/modules/installer/cd-dvd/system-tarball-pc.nix
+++ b/nixos/modules/installer/cd-dvd/system-tarball-pc.nix
@ -114,7 +114,7 @@ in
  # To be able to use the systemTarball to catch troubles.
  boot.crashDump = {
    enable = true;
-    kernelPackages = pkgs.linuxPackages_3_4;
+    kernelPackages = pkgs.linuxKernel.packages.linux_3_4;
  };

  # No grub for the tarball.
--- a/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix
+++ b/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix
@ -111,7 +111,7 @@ in
      # "console=ttyS0,115200n8"  # serial console
    ];

-  boot.kernelPackages = pkgs.linuxPackages_3_4;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_3_4;

  boot.supportedFilesystems = [ "reiserfs" ];

--- a/nixos/modules/installer/sd-card/sd-image-raspberrypi.nix
+++ b/nixos/modules/installer/sd-card/sd-image-raspberrypi.nix
@ -12,7 +12,7 @@
  boot.loader.generic-extlinux-compatible.enable = true;

  boot.consoleLogLevel = lib.mkDefault 7;
-  boot.kernelPackages = pkgs.linuxPackages_rpi1;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_rpi1;

  sdImage = {
    populateFirmwareCommands = let
--- a/nixos/modules/services/backup/automysqlbackup.nix
+++ b/nixos/modules/services/backup/automysqlbackup.nix
@ -73,6 +73,7 @@ in
    services.automysqlbackup.config = mapAttrs (name: mkDefault) {
      mysql_dump_username = user;
      mysql_dump_host = "localhost";
+      mysql_dump_socket = "/run/mysqld/mysqld.sock";
      backup_dir = "/var/backup/mysql";
      db_exclude = [ "information_schema" "performance_schema" ];
      mailcontent = "stdout";
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@ -47,7 +47,7 @@ in
      # We don't want to evaluate all of linuxPackages for the manual
      # - some of it might not even evaluate correctly.
      defaultText = "pkgs.linuxPackages";
-      example = literalExample "pkgs.linuxPackages_2_6_25";
+      example = literalExample "pkgs.linuxKernel.packages.linux_5_10";
      description = ''
        This option allows you to override the Linux kernel used by
        NixOS.  Since things like external kernel module packages are
--- a/pkgs/applications/blockchains/chia/default.nix
+++ b/pkgs/applications/blockchains/chia/default.nix
@ -26,6 +26,13 @@ let chia = python3Packages.buildPythonApplication rec {
    })
  ];

+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "==" ">="
+
+    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt mozilla-ca/cacert.pem
+  '';
+
  nativeBuildInputs = [
    python3Packages.setuptools-scm
  ];
@ -75,17 +82,6 @@ let chia = python3Packages.buildPythonApplication rec {
    "test_using_legacy_keyring"
  ];

-  postPatch = ''
-    # tweak version requirements to what's available in Nixpkgs
-    substituteInPlace setup.py \
-      --replace "aiohttp==3.7.4" "aiohttp>=3.7.4" \
-      --replace "sortedcontainers==2.3.0" "sortedcontainers>=2.3.0" \
-      --replace "click==7.1.2" "click>=7.1.2" \
-      --replace "clvm==0.9.7" "clvm>=0.9.7" \
-
-    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt mozilla-ca/cacert.pem
-  '';
-
  preCheck = ''
    export HOME=`mktemp -d`
  '';
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.2567";
+  version = "8.2.3337";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    sha256 = "sha256-FS3TZX7FKnnNpGYKbng2LIfWA9z2jqg7d2HC6t3xYTU=";
+    sha256 = "sha256-iwSGcLeqXH0bVIXEI5OnotG88Uv8ntycisD9EcHjz/c=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@ -10,11 +10,11 @@

 mkDerivation rec {
  pname = "krita";
-  version = "4.4.5";
+  version = "4.4.7";

  src = fetchurl {
    url = "https://download.kde.org/stable/${pname}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-S/1ygIcNEGCgDREj2Db8Gltb+KAoZ2Z58CaM1ef7dWg=";
+    sha256 = "sha256-I6fFxPRCcRU5dyFXZPvGvTb9MuGikrvTaGCXpp4LRRk=";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules python3Packages.sip_4 makeWrapper ];
--- a/pkgs/applications/kde/akonadi-contacts.nix
+++ b/pkgs/applications/kde/akonadi-contacts.nix
@ -3,8 +3,8 @@
  extra-cmake-modules,
  qtwebengine,
  grantlee, grantleetheme,
-  kdbusaddons, ki18n, kiconthemes, kio, kitemmodels, ktextwidgets, prison,
-  akonadi, akonadi-mime, kcontacts, kmime, libkleo,
+  kcmutils, kdbusaddons, ki18n, kiconthemes, kio, kitemmodels, ktextwidgets,
+  prison, akonadi, akonadi-mime, kcontacts, kmime, libkleo,
 }:

 mkDerivation {
@ -17,7 +17,7 @@ mkDerivation {
  buildInputs = [
    qtwebengine
    grantlee grantleetheme
-    kdbusaddons ki18n kiconthemes kio kitemmodels ktextwidgets prison
+    kcmutils kdbusaddons ki18n kiconthemes kio kitemmodels ktextwidgets prison
    akonadi-mime kcontacts kmime libkleo
  ];
  propagatedBuildInputs = [ akonadi ];
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/release-service/21.04.0/src -A '*.tar.xz' )
+WGET_ARGS=( http://download.kde.org/stable/release-service/21.08.0/src -A '*.tar.xz' )
--- a/pkgs/applications/kde/kdeconnect-kde.nix
+++ b/pkgs/applications/kde/kdeconnect-kde.nix
@ -19,12 +19,15 @@
 , makeWrapper
 , pulseaudio-qt
 , qca-qt5
+, qqc2-desktop-style
 , qtgraphicaleffects
 , qtmultimedia
 , qtquickcontrols2
 , qtx11extras
 , breeze-icons
 , sshfs
+, wayland
+, wayland-scanner
 }:

 mkDerivation {
@ -46,10 +49,13 @@ mkDerivation {
    libfakekey
    pulseaudio-qt
    qca-qt5
+    qqc2-desktop-style
    qtgraphicaleffects
    qtmultimedia
    qtquickcontrols2
    qtx11extras
+    wayland
+    wayland-scanner
    # otherwise buttons are blank on non-kde
    breeze-icons
  ];
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/moolticute/default.nix
+++ b/pkgs/applications/misc/moolticute/default.nix
@ -9,13 +9,13 @@

 mkDerivation rec {
  pname = "moolticute";
-  version = "0.45.0";
+  version = "0.50.0";

  src = fetchFromGitHub {
    owner = "mooltipass";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-azJ63NI0wzzv3acgoPaeF+lTM1WKpXg595FrK908k1U=";
+    sha256 = "sha256-/luba+qYRATP3EjNMB+GIRP6JQOlADsvpF8PzRFqFlM=";
  };

  outputs = [ "out" "udev" ];
--- a/pkgs/applications/misc/plover/default.nix
+++ b/pkgs/applications/misc/plover/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchurl, python27Packages, python36Packages, wmctrl,
+{ lib, fetchurl, python27Packages, python3Packages, wmctrl,
  qtbase, mkDerivationWith }:

 {
@ -24,9 +24,9 @@
    ];
  };

-  dev = with python36Packages; mkDerivationWith buildPythonPackage rec {
+  dev = with python3Packages; mkDerivationWith buildPythonPackage rec {
    pname = "plover";
-    version = "4.0.0.dev8";
+    version = "4.0.0.dev10";

    meta = with lib; {
      description = "OpenSteno Plover stenography software";
@ -36,7 +36,7 @@

    src = fetchurl {
      url    = "https://github.com/openstenoproject/plover/archive/v${version}.tar.gz";
-      sha256 = "1wxkmik1zyw5gqig5r0cas5v6f5408fbnximzw610rdisqy09rxp";
+      sha256 = "sha256-Eun+ZgmOIjYw6FS/2OGoBvYh52U/Ue0+NtIqrvV2Tqc=";
    };

    # I'm not sure why we don't find PyQt5 here but there's a similar
--- a/pkgs/applications/misc/variety/default.nix
+++ b/pkgs/applications/misc/variety/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub
-, python37Packages
+, python3Packages
 , fehSupport ? false, feh
 , imagemagickSupport ? true, imagemagick
 , intltool
@ -13,7 +13,7 @@
 , makeWrapper
 }:

-with python37Packages;
+with python3Packages;

 buildPythonApplication rec {
  pname = "variety";
--- a/pkgs/applications/misc/xcruiser/default.nix
+++ b/pkgs/applications/misc/xcruiser/default.nix
@ -12,8 +12,10 @@ stdenv.mkDerivation {
  buildInputs = [ libXt libXaw libXpm libXext ];

  makeFlags = [
-    "BINDIR=$(out)/bin"
-    "XAPPLOADDIR=$(out)/etc/X11/app-defaults"
+    "BINDIR=${placeholder "out"}/bin"
+    "CONFDIR=${placeholder "out"}/etc/X11"
+    "LIBDIR=${placeholder "out"}/lib/X11"
+    "XAPPLOADDIR=${placeholder "out"}/etc/X11/app-defaults"
  ];

  meta = with lib; {
--- a/pkgs/applications/misc/xxkb/default.nix
+++ b/pkgs/applications/misc/xxkb/default.nix
@ -24,7 +24,9 @@ stdenv.mkDerivation rec {

  makeFlags = [
    "BINDIR=${placeholder "out"}/bin"
+    "CONFDIR=${placeholder "out"}/etc/X11"
    "PIXMAPDIR=${placeholder "out"}/share/xxkb"
+    "LIBDIR=${placeholder "out"}/lib/X11"
    "XAPPLOADDIR=${placeholder "out"}/etc/X11/app-defaults"
    "MANDIR=${placeholder "man"}/share/man"
  ];
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@ -32,8 +32,7 @@
 , openssl
 , pango
 , procps
-, python37
-, python37Packages
+, python3
 , stdenv
 , systemd
 , xdg-utils
@ -101,8 +100,8 @@ stdenv.mkDerivation rec {
  dontBuild = true;

  buildInputs = [
-    python37
-    python37Packages.dbus-python
+    python3
+    python3.pkgs.dbus-python
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/version-management/git-and-tools/bump2version/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/bump2version/default.nix
@ -1,22 +1,37 @@
-{ buildPythonApplication, fetchFromGitHub, isPy27, pytest, testfixtures, lib }:
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, testfixtures
+}:

 buildPythonApplication rec {
  pname = "bump2version";
-  version = "1.0.0";
-  disabled = isPy27;
+  version = "1.0.1";
+
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "c4urself";
    repo = pname;
-    rev = "refs/tags/v${version}";
-    sha256 = "10p7rg569rk3qvzs5kjj17894bqlsg3ihhbln6ciwwfhkfq1kpja";
+    rev = "v${version}";
+    sha256 = "sha256-j6HKi3jTwSgGBrA8PCJJNg+yQqRMo1aqaLgPGf4KAKU=";
  };

-  checkInputs = [ pytest testfixtures ];
-  # X's in pytest are git tests which won't run in sandbox
-  checkPhase = ''
-    pytest tests/ -k 'not usage_string_fork'
-  '';
+  checkInputs = [
+    pytestCheckHook
+    testfixtures
+  ];
+
+  disabledTests = [
+    # X's in pytest are git tests which won't run in sandbox
+    "usage_string_fork"
+    "test_usage_string"
+    "test_defaults_in_usage_with_config"
+  ];
+
+  pythonImportsCheck = [ "bumpversion" ];

  meta = with lib; {
    description = "Version-bump your software with a single command";
--- a/pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv, Security }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, libiconv, Security }:

 rustPlatform.buildRustPackage rec {
  pname = "git-interactive-rebase-tool";
@ -11,7 +11,15 @@ rustPlatform.buildRustPackage rec {
    sha256 = "sha256-DYl/GUbeNtKmXoR3gq8mK8EfsZNVNlrdngAwfzG+epw=";
  };

-  cargoSha256 = "sha256-1joMWPfn0s+pLsO6NHMT6AoXZ33R8MY2AWSrROY2mw8=";
+  cargoPatches = [
+    # update git2 crate to fix a compile error
+    (fetchpatch {
+      url = "https://github.com/MitMaro/git-interactive-rebase-tool/commit/f4d3026f23118d29a263bbca6c83f963e76c34c4.patch";
+      sha256 = "sha256-6ErPRcPbPRXbEslNiNInbbUhbOWb9ZRll7ZDRgTpWS4=";
+    })
+  ];
+
+  cargoSha256 = "sha256-2aHW9JIiqkO0X0B0D44tSZ8QkmKH/QZoYvKNEQWldo4=";

  buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];

--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.32.0";
+  version = "2.33.0";
  svn = subversionClient.override { perlBindings = perlSupport; };

  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@ -37,7 +37,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "08rnm3ipjqdd2n31dw7mxl3iv9g4nxgc409krmz892a37kd43a38";
+    sha256 = "0kqcs8nj5h7rh3q86pw5777awq7gn77lgxk88ynjl1rfz2snlg5z";
  };

  outputs = [ "out" ] ++ lib.optional withManual "doc";
@ -297,6 +297,8 @@ stdenv.mkDerivation {
    disable_test t0001-init 'shared overrides system'
    disable_test t0001-init 'init honors global core.sharedRepository'
    disable_test t1301-shared-repo
+    # git-completion.bash: line 405: compgen: command not found:
+    disable_test t9902-completion 'option aliases are shown with GIT_COMPLETION_SHOW_ALL'

    # Our patched gettext never fallbacks
    disable_test t0201-gettext-fallbacks
--- a/pkgs/applications/version-management/git-and-tools/git/git-send-email-honor-PATH.patch
+++ b/pkgs/applications/version-management/git-and-tools/git/git-send-email-honor-PATH.patch
@ -1,28 +1,31 @@
 diff --git a/Documentation/git-send-email.txt b/Documentation/git-send-email.txt
-index 1afe9fc858..05dd7c3a90 100644
+index 3db4eab4ba..39bc0e77c9 100644
 --- a/Documentation/git-send-email.txt
 +++ b/Documentation/git-send-email.txt
-@@ -215,8 +215,7 @@ a password is obtained using 'git-credential'.
- 	specify a full pathname of a sendmail-like program instead;
- 	the program must support the `-i` option.  Default value can
- 	be specified by the `sendemail.smtpServer` configuration
-	option; the built-in default is to search for `sendmail` in
-	`/usr/sbin`, `/usr/lib` and $PATH if such program is
-+	option; the built-in default is to search in $PATH if such program is
- 	available, falling back to `localhost` otherwise.
- 
- --smtp-server-port=<port>::
+@@ -220,9 +220,9 @@ a password is obtained using 'git-credential'.
+ --smtp-server=<host>::
+ 	If set, specifies the outgoing SMTP server to use (e.g.
+ 	`smtp.example.com` or a raw IP address).  If unspecified, and if
+-	`--sendmail-cmd` is also unspecified, the default is to search
+-	for `sendmail` in `/usr/sbin`, `/usr/lib` and $PATH if such a
+-	program is available, falling back to `localhost` otherwise.
+	`--sendmail-cmd` is also unspecified, the default is to search for
+	`sendmail` in $PATH if such a program is available, falling back to
+	`localhost` otherwise.
+ +
+ For backward compatibility, this option can also specify a full pathname
+ of a sendmail-like program instead; the program must support the `-i`
 diff --git a/git-send-email.perl b/git-send-email.perl
-index 8eb63b5a2f..74a61d8213 100755
+index e65d969d0b..508d49483d 100755
 --- a/git-send-email.perl
 +++ b/git-send-email.perl
-@@ -956,8 +956,7 @@ sub expand_one_alias {
+@@ -1066,8 +1066,7 @@ sub expand_one_alias {
 }
 
- if (!defined $smtp_server) {
+ if (!defined $sendmail_cmd && !defined $smtp_server) {
 -	my @sendmail_paths = qw( /usr/sbin/sendmail /usr/lib/sendmail );
 -	push @sendmail_paths, map {"$_/sendmail"} split /:/, $ENV{PATH};
 +	my @sendmail_paths = map {"$_/sendmail"} split /:/, $ENV{PATH};
 	foreach (@sendmail_paths) {
 		if (-x $_) {
- 			$smtp_server = $_;
+ 			$sendmail_cmd = $_;
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -50,12 +50,12 @@ stdenv.mkDerivation rec {
    sha256 = "1f9hz8rf12jm8baa7kda34yl4hyl0xh0c4ap03krfjx23i3img47";
  };

-  nativeBuildInputs = [ python python.pkgs.sphinx pkg-config flex bison meson ninja ]
+  nativeBuildInputs = [ makeWrapper python python.pkgs.sphinx pkg-config flex bison meson ninja ]
    ++ lib.optionals gtkSupport [ wrapGAppsHook ]
    ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];

  buildInputs = [ zlib glib perl pixman
-    vde2 texinfo makeWrapper lzo snappy
+    vde2 texinfo lzo snappy
    gnutls nettle curl
  ]
    ++ lib.optionals ncursesSupport [ ncurses ]
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , asciidoc
 , cmake
 , expat
@ -48,6 +49,15 @@ stdenv.mkDerivation rec {
    hash = "sha256-R06tiWS9z6K5Nbi+vvk7DyozpcFdrHleMeh7Iq/FfHQ=";
  };

+  patches = [
+    # https://github.com/ice-wm/icewm/pull/57
+    # Fix trailing -I that leads to "to generate dependencies you must specify either '-M' or '-MM'"
+    (fetchpatch {
+      url = "https://github.com/ice-wm/icewm/pull/57/commits/ebd2c45341cc31755758a423392a0f78a64d2d37.patch";
+      sha256 = "16m9znd3ijcfl7la3l27ac3clx8l9qng3fprkpxqcifd89ny1ml5";
+    })
+  ];
+
  nativeBuildInputs = [
    asciidoc
    cmake
--- a/pkgs/applications/window-managers/yabar/build.nix
+++ b/pkgs/applications/window-managers/yabar/build.nix
@ -19,16 +19,33 @@ stdenv.mkDerivation {

  hardeningDisable = [ "format" ];

-  nativeBuildInputs = [ pkg-config ];
+  strictDeps = true;
+  depsBuildBuild = [
+    pkg-config
+  ];
+  nativeBuildInputs = [
+    pkg-config
+    asciidoc
+    docbook_xsl
+    libxslt
+    makeWrapper
+    libconfig
+    pango
+  ];
  buildInputs = [
-    cairo gdk-pixbuf libconfig pango xcbutilwm docbook_xsl
-    alsa-lib wirelesstools asciidoc libxslt makeWrapper
+    cairo
+    gdk-pixbuf
+    libconfig
+    pango
+    xcbutilwm
+    alsa-lib
+    wirelesstools
  ];

  postPatch = ''
    substituteInPlace ./Makefile \
      --replace "\$(shell git describe)" "${version}" \
-      --replace "a2x" "${asciidoc}/bin/a2x --no-xmllint"
+      --replace "a2x" "a2x --no-xmllint"
  '';

  makeFlags = [ "DESTDIR=$(out)" "PREFIX=/" ];
--- a/pkgs/build-support/buildenv/builder.pl
+++ b/pkgs/build-support/buildenv/builder.pl
@ -10,7 +10,11 @@ use JSON::PP;

 STDOUT->autoflush(1);

+$SIG{__WARN__} = sub { warn "warning: ", @_ };
+$SIG{__DIE__}  = sub { die "error: ", @_ };
+
 my $out = $ENV{"out"};
+my $extraPrefix = $ENV{"extraPrefix"};

 my @pathsToLink = split ' ', $ENV{"pathsToLink"};

@ -88,6 +92,10 @@ sub findFilesInDir {
 sub checkCollision {
    my ($path1, $path2) = @_;

+    if (! -e $path1 || ! -e $path2) {
+        return 0;
+    }
+
    my $stat1 = (stat($path1))[2];
    my $stat2 = (stat($path2))[2];

@ -101,6 +109,11 @@ sub checkCollision {
    return compare($path1, $path2) == 0;
 }

+sub prependDangling {
+    my $path = shift;
+    return (-l $path && ! -e $path ? "dangling symlink " : "") . "`$path'";
+}
+
 sub findFiles {
    my ($relName, $target, $baseName, $ignoreCollisions, $checkCollisionContents, $priority) = @_;

@ -125,12 +138,21 @@ sub findFiles {
    # symlink to a file (not a directory) in a lower-priority package,
    # overwrite it.
    if (!defined $oldTarget || ($priority < $oldPriority && ($oldTarget ne "" && ! -d $oldTarget))) {
+        # If target is a dangling symlink, emit a warning.
+        if (-l $target && ! -e $target) {
+            my $link = readlink $target;
+            warn "creating dangling symlink `$out$extraPrefix/$relName' -> `$target' -> `$link'\n";
+        }
        $symlinks{$relName} = [$target, $priority];
        return;
    }

    # If target already exists and both targets resolves to the same path, skip
-    if (defined $oldTarget && $oldTarget ne "" && abs_path($target) eq abs_path($oldTarget)) {
+    if (
+        defined $oldTarget && $oldTarget ne "" &&
+        defined abs_path($target) && defined abs_path($oldTarget) &&
+        abs_path($target) eq abs_path($oldTarget)
+    ) {
        # Prefer the target that is not a symlink, if any
        if (-l $oldTarget && ! -l $target) {
            $symlinks{$relName} = [$target, $priority];
@ -144,14 +166,25 @@ sub findFiles {
        return;
    }

+    # If target is supposed to be a directory but it isn't, die with an error message
+    # instead of attempting to recurse into it, only to fail then.
+    # This happens e.g. when pathsToLink contains a non-directory path.
+    if ($oldTarget eq "" && ! -d $target) {
+        die "not a directory: `$target'\n";
+    }
+
    unless (-d $target && ($oldTarget eq "" || -d $oldTarget)) {
+        # Prepend "dangling symlink" to paths if applicable.
+        my $targetRef = prependDangling($target);
+        my $oldTargetRef = prependDangling($oldTarget);
+
        if ($ignoreCollisions) {
-            warn "collision between `$target' and `$oldTarget'\n" if $ignoreCollisions == 1;
+            warn "collision between $targetRef and $oldTargetRef\n" if $ignoreCollisions == 1;
            return;
        } elsif ($checkCollisionContents && checkCollision($oldTarget, $target)) {
            return;
        } else {
-            die "collision between `$target' and `$oldTarget'\n";
+            die "collision between $targetRef and $oldTargetRef\n";
        }
    }

@ -224,7 +257,6 @@ while (scalar(keys %postponed) > 0) {


 # Create the symlinks.
-my $extraPrefix = $ENV{"extraPrefix"};
 my $nrLinks = 0;
 foreach my $relName (sort keys %symlinks) {
    my ($target, $priority) = @{$symlinks{$relName}};
--- a/pkgs/build-support/ocaml/default.nix
+++ b/pkgs/build-support/ocaml/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, writeText, ocaml, findlib, ocamlbuild, camlp4 }:

-{ name, version, buildInputs ? [],
+{ name, version, nativeBuildInputs ? [],
  createFindlibDestdir ?  true,
  dontStrip ? true,
  minimumSupportedOcamlVersion ? null,
@ -19,7 +19,7 @@ in
 stdenv.mkDerivation (args // {
  name = "ocaml-${name}-${version}";

-  buildInputs = [ ocaml findlib ocamlbuild camlp4 ] ++ buildInputs;
+  nativeBuildInputs = [ ocaml findlib ocamlbuild camlp4 ] ++ nativeBuildInputs;

  setupHook = if setupHook == null && hasSharedObjects
  then writeText "setupHook.sh" ''
--- a/pkgs/build-support/ocaml/dune.nix
+++ b/pkgs/build-support/ocaml/dune.nix
@ -1,6 +1,6 @@
 { lib, stdenv, ocaml, findlib, dune_1, dune_2 }:

-{ pname, version, buildInputs ? [], enableParallelBuilding ? true, ... }@args:
+{ pname, version, nativeBuildInputs ? [], enableParallelBuilding ? true, ... }@args:

 let Dune = if args.useDune2 or false then dune_2 else dune_1; in

@ -12,6 +12,8 @@ else
 stdenv.mkDerivation ({

  inherit enableParallelBuilding;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];

  buildPhase = ''
    runHook preBuild
@ -33,7 +35,7 @@ stdenv.mkDerivation ({

  name = "ocaml${ocaml.version}-${pname}-${version}";

-  buildInputs = [ ocaml Dune findlib ] ++ buildInputs;
+  nativeBuildInputs = [ ocaml Dune findlib ] ++ nativeBuildInputs;

  meta = (args.meta or {}) // { platforms = args.meta.platforms or ocaml.meta.platforms; };

--- a/pkgs/build-support/setup-hooks/autoreconf.sh
+++ b/pkgs/build-support/setup-hooks/autoreconf.sh
@ -1,4 +1,4 @@
-preConfigurePhases+=" autoreconfPhase"
+preConfigurePhases="${preConfigurePhases:-} autoreconfPhase"

 autoreconfPhase() {
    runHook preAutoreconf
--- a/pkgs/build-support/setup-hooks/reproducible-builds.sh
+++ b/pkgs/build-support/setup-hooks/reproducible-builds.sh
@ -2,8 +2,9 @@
 # This should ensure that it is deterministic across rebuilds of the same
 # derivation and not easily collide with other builds.
 # We also truncate the hash so that it cannot cause reference cycles.
-export NIX_CFLAGS_COMPILE+=" -frandom-seed=$(
+NIX_CFLAGS_COMPILE="${NIX_CFLAGS_COMPILE:-} -frandom-seed=$(
    outbase="${out##*/}"
    randomseed="${outbase:0:10}"
    echo $randomseed
 )"
+export NIX_CFLAGS_COMPILE
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@ -14,7 +14,7 @@ _separateDebugInfo() {
    dst="$dst/lib/debug/.build-id"

    # Find executables and dynamic libraries.
-    local i magic
+    local i
    while IFS= read -r -d $'\0' i; do
        if ! isELF "$i"; then continue; fi

--- a/pkgs/data/fonts/openmoji/default.nix
+++ b/pkgs/data/fonts/openmoji/default.nix
@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, scfbuild
+, nodejs
+, nodePackages
+, python3Packages
+, variant ? "color" # "color" or "black"
+}:
+
+let
+  filename = builtins.replaceStrings
+    [ "color"              "black"              ]
+    [ "OpenMoji-Color.ttf" "OpenMoji-Black.ttf" ]
+    variant;
+
+in stdenv.mkDerivation rec {
+  pname = "openmoji";
+  version = "13.1.0";
+
+  src = fetchFromGitHub {
+    owner = "hfg-gmuend";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-7G6a+LFq79njyPhnDhhSJ98Smw5fWlfcsFj6nWBPsSk=";
+  };
+
+  nativeBuildInputs = [
+    scfbuild
+    nodejs
+    nodePackages.glob
+    nodePackages.lodash
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    node helpers/generate-font-glyphs.js
+
+    cd font
+    scfbuild -c scfbuild-${variant}.yml
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    install -Dm644 ${filename} $out/share/fonts/truetype/${filename}
+  '';
+
+  meta = with lib; {
+    license = licenses.cc-by-sa-40;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+    homepage = "https://openmoji.org/";
+    downloadPage = "https://github.com/hfg-gmuend/openmoji/releases";
+    description = "Open-source emojis for designers, developers and everyone else";
+  };
+}
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@ -1,28 +1,17 @@
-{ lib, stdenv, fetchurl, nss, python3
-, blacklist ? []
+{ lib
+, stdenv
+, fetchurl
+, nss
+, python3
+, blacklist ? [ ]

-# Used for tests only
+  # Used for tests only
 , runCommand
 , cacert
 , openssl
 }:

-with lib;
-
 let
-  version = "3.66";
-
-  underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
-in
-
-stdenv.mkDerivation {
-  name = "nss-cacert-${version}";
-
-  src = fetchurl {
-    url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz";
-    sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
-  };
-
  certdata2pem = fetchurl {
    name = "certdata2pem.py";
    urls = [
@ -31,6 +20,16 @@ stdenv.mkDerivation {
    ];
    sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy";
  };
+in
+
+stdenv.mkDerivation rec {
+  pname = "nss-cacert";
+  version = "3.66";
+
+  src = fetchurl {
+    url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
+    sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
+  };

  outputs = [ "out" "unbundled" ];

@ -40,11 +39,11 @@ stdenv.mkDerivation {
    ln -s nss/lib/ckfw/builtins/certdata.txt

    cat << EOF > blacklist.txt
-    ${concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
+    ${lib.concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
    EOF

    # copy from the store, otherwise python will scan it for imports
-    cat "$certdata2pem" > certdata2pem.py
+    cat "${certdata2pem}" > certdata2pem.py
  '';

  buildPhase = ''
@ -63,61 +62,66 @@ stdenv.mkDerivation {
    # install individual certs in unbundled output
    mkdir -pv $unbundled/etc/ssl/certs
    cp -v *.crt $unbundled/etc/ssl/certs
-    rm -f $unbundled/etc/ssl/certs/ca-bundle.crt  # not wanted in unbundled
+    rm $unbundled/etc/ssl/certs/ca-bundle.crt  # not wanted in unbundled
  '';

  setupHook = ./setup-hook.sh;

-  passthru.updateScript = ./update.sh;
-  passthru.tests = {
-    # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
-    blacklist-utf8 = let
-      blacklistCAToFingerprint = {
-        # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
-        "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
-        "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
-      };
-      mapBlacklist = f: concatStringsSep "\n" (mapAttrsToList f blacklistCAToFingerprint);
-    in runCommand "verify-the-cacert-filter-output" {
-      cacert = cacert.unbundled;
-      cacertWithExcludes = (cacert.override {
-        blacklist = builtins.attrNames blacklistCAToFingerprint;
-      }).unbundled;
+  passthru = {
+    updateScript = ./update.sh;
+    tests = {
+      # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
+      blacklist-utf8 =
+        let
+          blacklistCAToFingerprint = {
+            # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
+            "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
+            "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
+          };
+          mapBlacklist = f: lib.concatStringsSep "\n" (lib.mapAttrsToList f blacklistCAToFingerprint);
+        in
+        runCommand "verify-the-cacert-filter-output"
+          {
+            cacert = cacert.unbundled;
+            cacertWithExcludes = (cacert.override {
+              blacklist = builtins.attrNames blacklistCAToFingerprint;
+            }).unbundled;

-      nativeBuildInputs = [ openssl ];
-    } ''
-      isPresent() {
-        # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
-        for f in $1/etc/ssl/certs/*.crt; do
-          fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
-          if [[ "x$fingerprint" == "x$3" ]]; then
-            return 0
-          fi
-        done
-        return 1
-      }
+            nativeBuildInputs = [ openssl ];
+          } ''
+          isPresent() {
+            # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
+            for f in $1/etc/ssl/certs/*.crt; do
+              fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
+              if [[ "x$fingerprint" == "x$3" ]]; then
+                return 0
+              fi
+            done
+            return 1
+          }

-      # Ensure that each certificate is in the main "cacert".
-      ${mapBlacklist (caName: caFingerprint: ''
-        isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
-          echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
-          exit 1
-        })
-      '')}
+          # Ensure that each certificate is in the main "cacert".
+          ${mapBlacklist (caName: caFingerprint: ''
+            isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
+              echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
+              exit 1
+            })
+          '')}

-      # Ensure that each certificate is NOT in the "cacertWithExcludes".
-      ${mapBlacklist (caName: caFingerprint: ''
-        isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
-          echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
-          exit 1
-        })
-      '')}
+          # Ensure that each certificate is NOT in the "cacertWithExcludes".
+          ${mapBlacklist (caName: caFingerprint: ''
+            isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
+              echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
+              exit 1
+            })
+          '')}

-      touch $out
-    '';
+          touch $out
+        '';
+    };
  };

-  meta = {
+  meta = with lib; {
    homepage = "https://curl.haxx.se/docs/caextract.html";
    description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
    platforms = platforms.all;
--- a/pkgs/data/misc/mobile-broadband-provider-info/default.nix
+++ b/pkgs/data/misc/mobile-broadband-provider-info/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mobile-broadband-provider-info";
-  version = "20201225";
+  version = "20210805";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1g9x2i4xjm2sagaha07n9psacbylrwfrmfqkp17gjwhpyi6w0zqd";
+    sha256 = "sha256-a/ihVY6lVBr7xve0QV50zJ9aqYKbE07Ks+8ch0ElaLw=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/yelp-xsl/default.nix
+++ b/pkgs/desktops/gnome/core/yelp-xsl/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "yelp-xsl";
-  version = "40.0";
+  version = "40.2";

  src = fetchurl {
    url = "mirror://gnome/sources/yelp-xsl/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Nh7NTTP8zbO7CKaH9g5cPpCdLp47Ai2ETgSYINDPYrA=";
+    sha256 = "sha256-kZxVL4RqrsdB/lHVr0FrRpvNslx37/w7WhWktLf/gU4=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/extensions/arcmenu/default.nix
+++ b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-shell-extension-arcmenu";
-  version = "12";
+  version = "14";

  src = fetchFromGitLab {
    owner = "arcmenu";
    repo = "ArcMenu";
    rev = "v${version}";
-    sha256 = "sha256-R1OUDf/YMyMlxwXM9rNsrasPumHEoYhJK0evnYGeIkA=";
+    sha256 = "sha256-Iobu5eNWSvAiTRe6wyx/0PgUtB9QIC9KdH0M1xhsM1I=";
  };

  patches = [
--- a/pkgs/development/compilers/ghc/8.10.7.nix
+++ b/pkgs/development/compilers/ghc/8.10.7.nix
@ -129,7 +129,8 @@ let
  # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
  # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
  # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl && !targetPlatform.isWindows);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);

  runtimeDeps = [
    targetPackages.stdenv.cc.bintools
--- a/pkgs/development/compilers/ghc/8.8.4.nix
+++ b/pkgs/development/compilers/ghc/8.8.4.nix
@ -137,7 +137,8 @@ let
  # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
  # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
  # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl && !targetPlatform.isWindows);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);

  runtimeDeps = [
    targetPackages.stdenv.cc.bintools
--- a/pkgs/development/compilers/ghc/9.0.1.nix
+++ b/pkgs/development/compilers/ghc/9.0.1.nix
@ -123,7 +123,8 @@ let
  # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
  # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
  # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);

  runtimeDeps = [
    targetPackages.stdenv.cc.bintools
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@ -133,7 +133,8 @@ let
  # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
  # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
  # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);

  runtimeDeps = [
    targetPackages.stdenv.cc.bintools
--- a/pkgs/development/compilers/llvm/12/compiler-rt/darwin-targetconditionals.patch
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/darwin-targetconditionals.patch
@ -1,71 +0,0 @@
-diff --git a/lib/sanitizer_common/sanitizer_mac.cpp b/lib/sanitizer_common/sanitizer_mac.cpp
--- a/lib/sanitizer_common/sanitizer_mac.cpp
-+++ b/lib/sanitizer_common/sanitizer_mac.cpp
-@@ -613,9 +613,15 @@ HandleSignalMode GetHandleSignalMode(int signum) {
- // Offset example:
- // XNU 17 -- macOS 10.13 -- iOS 11 -- tvOS 11 -- watchOS 4
- constexpr u16 GetOSMajorKernelOffset() {
-  if (TARGET_OS_OSX) return 4;
-  if (TARGET_OS_IOS || TARGET_OS_TV) return 6;
-  if (TARGET_OS_WATCH) return 13;
-+#if TARGET_OS_OSX
-+  return 4;
-+#endif
-+#if TARGET_OS_IOS || TARGET_OS_TV
-+  return 6;
-+#endif
-+#if TARGET_OS_WATCH
-+  return 13;
-+#endif
- }
- 
- using VersStr = char[64];
-@@ -627,13 +633,13 @@ static uptr ApproximateOSVersionViaKernelVersion(VersStr vers) {
-   u16 os_major = kernel_major - offset;
- 
-   const char *format = "%d.0";
-  if (TARGET_OS_OSX) {
-    if (os_major >= 16) {  // macOS 11+
-      os_major -= 5;
-    } else {  // macOS 10.15 and below
-      format = "10.%d";
-    }
-+#if TARGET_OS_OSX
-+  if (os_major >= 16) {  // macOS 11+
-+    os_major -= 5;
-+  } else {  // macOS 10.15 and below
-+    format = "10.%d";
-   }
-+#endif
-   return internal_snprintf(vers, sizeof(VersStr), format, os_major);
- }
- 
-@@ -681,15 +687,14 @@ void ParseVersion(const char *vers, u16 *major, u16 *minor) {
- // Aligned versions example:
- // macOS 10.15 -- iOS 13 -- tvOS 13 -- watchOS 6
- static void MapToMacos(u16 *major, u16 *minor) {
-  if (TARGET_OS_OSX)
-    return;
-
-  if (TARGET_OS_IOS || TARGET_OS_TV)
-+#if !TARGET_OS_OSX
-+#if TARGET_OS_IOS || TARGET_OS_TV
-     *major += 2;
-  else if (TARGET_OS_WATCH)
-+#elif TARGET_OS_WATCH
-     *major += 9;
-  else
-+#else
-     UNREACHABLE("unsupported platform");
-+#endif
- 
-   if (*major >= 16) {  // macOS 11+
-     *major -= 5;
-@@ -697,6 +702,7 @@ static void MapToMacos(u16 *major, u16 *minor) {
-     *minor = *major;
-     *major = 10;
-   }
-+#endif
- }
- 
- static MacosVersion GetMacosAlignedVersionInternal() {
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@ -59,8 +59,6 @@ stdenv.mkDerivation {
    # extra `/`.
    ./normalize-var.patch
  ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    # Prevent a compilation error on darwin
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@ -3,7 +3,7 @@
 let
  versionNoPatch = "${toString major_version}.${toString minor_version}";
  version = "${versionNoPatch}.${toString patch_version}";
-  safeX11 = stdenv: !(stdenv.isAarch32 || stdenv.isMips);
+  safeX11 = stdenv: !(stdenv.isAarch32 || stdenv.isMips || stdenv.hostPlatform.isStatic);
 in

 { lib, stdenv, fetchurl, ncurses, buildEnv, libunwind
@ -13,7 +13,7 @@ in
 , spaceTimeSupport ? false
 }:

-assert useX11 -> !stdenv.isAarch32 && !stdenv.isMips;
+assert useX11 -> safeX11 stdenv;
 assert aflSupport -> lib.versionAtLeast version "4.05";
 assert flambdaSupport -> lib.versionAtLeast version "4.03";
 assert spaceTimeSupport -> lib.versionAtLeast version "4.04";
@ -44,6 +44,8 @@ stdenv.mkDerivation (args // {

  inherit src;

+  strictDeps = true;
+
  prefixKey = "-prefix ";
  configureFlags =
    let flags = new: old:
@ -56,7 +58,15 @@ stdenv.mkDerivation (args // {
  ++ optional aflSupport (flags "--with-afl" "-afl-instrument")
  ++ optional flambdaSupport (flags "--enable-flambda" "-flambda")
  ++ optional spaceTimeSupport (flags "--enable-spacetime" "-spacetime")
-  ;
+  ++ optional (stdenv.hostPlatform.isStatic && (lib.versionOlder version "4.08")) "-no-shared-libs"
+  ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && lib.versionOlder version "4.08") [
+    "-host ${stdenv.hostPlatform.config}"
+    "-target ${stdenv.targetPlatform.config}"
+  ];
+  dontAddStaticConfigureFlags = lib.versionOlder version "4.08";
+  configurePlatforms = lib.optionals (lib.versionAtLeast version "4.08") [ "host" "target" ];
+  # x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
+  hardeningDisable = lib.optional (lib.versionAtLeast version "4.09" && stdenv.hostPlatform.isMusl) "pie";

  buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
  buildInputs = optional (!lib.versionAtLeast version "4.07") ncurses
@ -70,6 +80,8 @@ stdenv.mkDerivation (args // {
    # Do what upstream does by default now: https://github.com/ocaml/ocaml/pull/10176
    # This is required for aarch64-darwin, everything else works as is.
    AS="${stdenv.cc}/bin/cc -c" ASPP="${stdenv.cc}/bin/cc -c"
+  '' + optionalString (lib.versionOlder version "4.08" && stdenv.hostPlatform.isStatic) ''
+    configureFlagsArray+=("-cc" "$CC" "-as" "$AS" "-partialld" "$LD -r")
  '';
  postBuild = ''
    mkdir -p $out/include
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@ -24,6 +24,11 @@ let

    dontUseCmakeConfigure = true;

+    postPatch = ''
+      substituteInPlace buildSrc/linux.gradle \
+        --replace ', "-Werror=implicit-function-declaration"' ""
+    '';
+
    config = writeText "gradle.properties" (''
      CONF = Release
      JDK_HOME = ${openjdk11-bootstrap.home}
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@ -12,6 +12,11 @@ in stdenv.mkDerivation rec {
    sha256 = "1w0qmyj3v9sb2g7ff39pp38b9850y9hyy0bag26ifrby5f7ksvm6";
  };

+  postPatch = lib.optionalString stdenv.isAarch32 ''
+    # https://gitlab.freedesktop.org/gstreamer/orc/-/issues/20
+    sed -i '/exec_opcodes_sys/d' testsuite/meson.build
+  '';
+
  outputs = [ "out" "dev" ]
     ++ optional buildDevDoc "devdoc"
  ;
--- a/pkgs/development/compilers/rust/1_54.nix
+++ b/pkgs/development/compilers/rust/1_54.nix
@ -20,8 +20,8 @@
 } @ args:

 import ./default.nix {
-  rustcVersion = "1.53.0";
-  rustcSha256 = "1f95p259dfp5ca118bg107rj3rqwlswy65dxn3hg8sqgl4wwmxsw";
+  rustcVersion = "1.54.0";
+  rustcSha256 = "0xk9dhfff16caambmwij67zgshd8v9djw6ha0fnnanlv7rii31dc";

  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
  llvmSharedForHost = pkgsBuildHost.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
@ -34,24 +34,24 @@ import ./default.nix {

  # Note: the version MUST be one version prior to the version we're
  # building
-  bootstrapVersion = "1.52.1";
+  bootstrapVersion = "1.53.0";

  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
  bootstrapHashes = {
-    i686-unknown-linux-gnu = "c91f0431c8137a4e98e097ab47b49846820531aafb6e9c249b71b770771832e9";
-    x86_64-unknown-linux-gnu = "617ae06e212cb65bc4abbf52b158b0328b9f1a6c2f822c27c95b274d6fbc0627";
-    x86_64-unknown-linux-musl = "c3eae6e78ee29e03416897f89b54448b2a03d063f07a78cde41757ad2e02c2f0";
-    arm-unknown-linux-gnueabihf = "ef412d923a0c5a9fa54422f40cde62f2e85a62339057cb8b986a545b108d3347";
-    armv7-unknown-linux-gnueabihf = "ec47b3f5c801f8a4df7180e088dcc1817ee160df34ef64ddac4fa50f714f119f";
-    aarch64-unknown-linux-gnu = "17d9aa7bb73b819ef70d81013498727b7218533ee6cf3bd802c4eac29137fbcb";
-    aarch64-unknown-linux-musl = "f2bae2b32f05a90eec041352d9329deb3e907f5560b9fda525788df3b8008b6b";
-    x86_64-apple-darwin = "cfa73228ea54e2c94f75d1b142ea41444c463f4ee8562a3eca1b11b2fe8af95a";
-    aarch64-apple-darwin = "217e9723f828c5359467d69b363a342d702bdcbbcc4107be907e6bc4531f4912";
-    powerpc64le-unknown-linux-gnu = "f258c5d7d6d9022108672b7383412d930a5f59d7644d148e413c3ab0ae45604f";
-    riscv64gc-unknown-linux-gnu = "c1c98ccc8bb4147a819411a10162c8f8ce1aaa5c65cf2c74802dce4dacd6e64b";
+    i686-unknown-linux-gnu = "4ebeeba05448b9484bb2845dba2ff4c0e2b7208fa8b08bef2b2ca3b171d0db99";
+    x86_64-unknown-linux-gnu = "5e9e556d2ccce27aa8f01a528f1348bf8cdd34496c35ec2abf131660b9792fed";
+    x86_64-unknown-linux-musl = "908b6163b62660f289bcd1eda1a0eb6d849b4b29da12546d24a033e5718e93ff";
+    arm-unknown-linux-gnueabihf = "6ae3108f4a0b0478c76f5dbaf1827c9e4a983fa78a9f973b24d501e693cfdcab";
+    armv7-unknown-linux-gnueabihf = "886e78f7c5bd92e16322ca3af70d1899c064837343cdfeb9a216b76edfd18157";
+    aarch64-unknown-linux-gnu = "cba81d5c3d16deee04098ea18af8636bc7415315a44c9e44734fd669aa778040";
+    aarch64-unknown-linux-musl = "a0065a6313bf370f2844af6f3b47fe292360e9cca3da31b5f6cb32db311ba686";
+    x86_64-apple-darwin = "940a4488f907b871f9fb1be309086509e4a48efb19303f8b5fe115c6f12abf43";
+    aarch64-apple-darwin = "c519da905514c05240a8fe39e459de2c4ef5943535e3655502e8fb756070aee1";
+    powerpc64le-unknown-linux-gnu = "9f6c17427d1023b10694e4ba60d6d9deec0aeb07d051f99763789ed18e07e2e6";
+    riscv64gc-unknown-linux-gnu = "6ae23ac00269df72b0790f10f2d9a98d03acf542c6090f4d30a87365fafd14ed";
  };

-  selectRustPackage = pkgs: pkgs.rust_1_53;
+  selectRustPackage = pkgs: pkgs.rust_1_54;

  rustcPatches = [
  ];
--- a/pkgs/development/compilers/yasm/default.nix
+++ b/pkgs/development/compilers/yasm/default.nix
@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl}:

 stdenv.mkDerivation rec {
-  name = "yasm-1.3.0";
+  pname = "yasm";
+  version = "1.3.0";

  src = fetchurl {
-    url = "https://www.tortall.net/projects/yasm/releases/${name}.tar.gz";
+    url = "https://www.tortall.net/projects/yasm/releases/yasm-${version}.tar.gz";
    sha256 = "0gv0slmm0qpq91za3v2v9glff3il594x5xsrbgab7xcmnh0ndkix";
  };

--- a/pkgs/development/embedded/platformio/chrootenv.nix
+++ b/pkgs/development/embedded/platformio/chrootenv.nix
@ -23,7 +23,8 @@ in buildFHSUserEnv {
  name = "platformio";

  targetPkgs = pio-pkgs;
-  multiPkgs = pio-pkgs;
+  # disabled temporarily because fastdiff no longer support 32bit
+  # multiPkgs = pio-pkgs;

  meta = with lib; {
    description = "An open source ecosystem for IoT development";
--- a/pkgs/development/embedded/platformio/core.nix
+++ b/pkgs/development/embedded/platformio/core.nix
@ -1,5 +1,6 @@
 { stdenv, lib, python3
 , fetchFromGitHub
+, fetchPypi
 , git
 , spdx-license-list-data
 , version, src
@ -20,6 +21,15 @@ let
        doCheck = false;
      });

+      ajsonrpc = super.ajsonrpc.overridePythonAttrs (oldAttrs: rec {
+        pname = "ajsonrpc";
+        version = "1.1.0";
+        src = fetchPypi {
+          inherit pname version;
+          sha256 = "sha256-CgHCtW0gxZho7ZavvEaODNc+KbFW4sAsHtM2Xk5Cuaw=";
+        };
+      });
+
      click = super.click.overridePythonAttrs (oldAttrs: rec {
        version = "7.1.2";
        src = oldAttrs.src.override {
@ -28,6 +38,18 @@ let
        };
      });

+      starlette = super.starlette.overridePythonAttrs (oldAttrs: rec {
+        pname = "starlette";
+        version = "0.14.2";
+        src = fetchFromGitHub {
+          owner = "encode";
+          repo = pname;
+          rev = version;
+          sha256 = "sha256-Ki5jTEr5w6CrGK6F60E9uvdUlGx8pxdHMpxHvj9D4js=";
+        };
+        doCheck = false;
+      });
+
      uvicorn = super.uvicorn.overridePythonAttrs (oldAttrs: rec {
        version = "0.13.2";
        src = fetchFromGitHub {
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@ -86,6 +86,8 @@ let

    configureScript = optionalString (!crossCompiling) "${stdenv.shell} ./Configure";

+    dontAddStaticConfigureFlags = true;
+
    dontAddPrefix = !crossCompiling;

    enableParallelBuilding = !crossCompiling;
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -26,10 +26,10 @@
 , sourceVersion
 , sha256
 , passthruFun
-, static ? false
+, static ? stdenv.hostPlatform.isStatic
 , stripBytecode ? reproducibleBuild
 , rebuildBytecode ? true
-, reproducibleBuild ? true
+, reproducibleBuild ? false
 , enableOptimizations ? false
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:
@ -48,6 +48,8 @@ assert lib.assertMsg (reproducibleBuild -> stripBytecode)
 assert lib.assertMsg (reproducibleBuild -> (!enableOptimizations))
  "Deterministic builds are not achieved when optimizations are enabled.";

+assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
+  "Deterministic builds are not achieved when (default unoptimized) bytecode is created.";

 with lib;

@ -185,8 +187,9 @@ let

  configureFlags = optionals enableOptimizations [
    "--enable-optimizations"
-  ] ++ [
+  ] ++ optionals (!static) [
    "--enable-shared"
+  ] ++ [
    "--with-threads"
    "--enable-unicode=ucs${toString ucsEncoding}"
  ] ++ optionals (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) [
@ -224,6 +227,7 @@ let
  ++ optional stdenv.hostPlatform.isLinux "ac_cv_func_lchmod=no"
  ++ optional static "LDFLAGS=-static";

+  strictDeps = true;
  buildInputs =
    optional (stdenv ? cc && stdenv.cc.libc != null) stdenv.cc.libc ++
    [ bzip2 openssl zlib ]
@ -296,8 +300,10 @@ in with passthru; stdenv.mkDerivation ({
        # First we delete all old bytecode.
        find $out -name "*.pyc" -delete
        '' + optionalString rebuildBytecode ''
-        # Then, we build for the two optimization levels.
-        # We do not build unoptimized bytecode, because its not entirely deterministic yet.
+        # We build 3 levels of optimized bytecode. Note the default level, without optimizations,
+        # is not reproducible yet. https://bugs.python.org/issue29708
+        # Not creating bytecode will result in a large performance loss however, so we do build it.
+        find $out -name "*.py" | ${pythonForBuildInterpreter} -m compileall -q -f -x "lib2to3" -i -
        find $out -name "*.py" | ${pythonForBuildInterpreter} -O  -m compileall -q -f -x "lib2to3" -i -
        find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i -
      '' + optionalString stdenv.hostPlatform.isCygwin ''
--- a/pkgs/development/interpreters/python/cpython/3.9/darwin-tcl-tk.patch
+++ b/pkgs/development/interpreters/python/cpython/3.9/darwin-tcl-tk.patch
@ -0,0 +1,15 @@
+diff --git a/setup.py b/setup.py
+index 04eb6b2..2e1160d 100644
+--- a/setup.py
+++ b/setup.py
+@@ -1981,8 +1981,8 @@ class PyBuildExt(build_ext):
+         # Rather than complicate the code below, detecting and building
+         # AquaTk is a separate method. Only one Tkinter will be built on
+         # Darwin - either AquaTk, if it is found, or X11 based Tk.
+-        if (MACOS and self.detect_tkinter_darwin()):
+-            return True
+        # if (MACOS and self.detect_tkinter_darwin()):
+        #     return True
+ 
+         # Assume we haven't found any of the libraries or include files
+         # The versions with dots are used on Unix, and the versions without
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -35,7 +35,7 @@
 , stripTests ? false
 , stripTkinter ? false
 , rebuildBytecode ? true
-, stripBytecode ? reproducibleBuild
+, stripBytecode ? true
 , includeSiteCustomize ? true
 , static ? stdenv.hostPlatform.isStatic
 , enableOptimizations ? false
@ -48,7 +48,7 @@
 # enabling LTO with musl and dynamic linking fails with a linker error although it should
 # be possible as alpine is doing it: https://github.com/alpinelinux/aports/blob/a8ccb04668c7729e0f0db6c6ff5f25d7519e779b/main/python3/APKBUILD#L82
 , enableLTO ? stdenv.is64bit && stdenv.isLinux && !(stdenv.hostPlatform.isMusl && !stdenv.hostPlatform.isStatic)
-, reproducibleBuild ? true
+, reproducibleBuild ? false
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:

@ -75,6 +75,9 @@ assert lib.assertMsg (reproducibleBuild -> stripBytecode)
 assert lib.assertMsg (reproducibleBuild -> (!enableOptimizations))
  "Deterministic builds are not achieved when optimizations are enabled.";

+assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
+  "Deterministic builds are not achieved when (default unoptimized) bytecode is created.";
+
 with lib;

 let
@ -100,6 +103,8 @@ let

  version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";

+  strictDeps = true;
+
  nativeBuildInputs = optionals (!stdenv.isDarwin) [
    autoreconfHook
  ] ++ optionals (!stdenv.isDarwin && passthru.pythonAtLeast "3.10") [
@ -234,6 +239,9 @@ in with passthru; stdenv.mkDerivation {
      else
        ./3.5/profile-task.patch
    )
+  ] ++ optionals (pythonAtLeast "3.9" && stdenv.isDarwin) [
+    # Stop checking for TCL/TK in global macOS locations
+    ./3.9/darwin-tcl-tk.patch
  ] ++ optionals (isPy3k && hasDistutilsCxxPatch) [
    # Fix for http://bugs.python.org/issue1222585
    # Upstream distutils is calling C compiler to compile C++ code, which
@ -283,10 +291,11 @@ in with passthru; stdenv.mkDerivation {
  PYTHONHASHSEED=0;

  configureFlags = [
-    "--enable-shared"
    "--without-ensurepip"
    "--with-system-expat"
    "--with-system-ffi"
+  ] ++ optionals (!static) [
+    "--enable-shared"
  ] ++ optionals enableOptimizations [
    "--enable-optimizations"
  ] ++ optionals enableLTO [
@ -334,6 +343,8 @@ in with passthru; stdenv.mkDerivation {
  '' + optionalString stdenv.isDarwin ''
    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -msse2"
    export MACOSX_DEPLOYMENT_TARGET=10.6
+    # Override the auto-detection in setup.py, which assumes a universal build
+    export PYTHON_DECIMAL_WITH_MACHINE=${if stdenv.isAarch64 then "uint128" else "x64"}
  '' + optionalString (isPy3k && pythonOlder "3.7") ''
    # Determinism: The interpreter is patched to write null timestamps when compiling Python files
    #   so Python doesn't try to update the bytecode when seeing frozen timestamps in Nix's store.
@ -424,11 +435,14 @@ in with passthru; stdenv.mkDerivation {
    # First we delete all old bytecode.
    find $out -type d -name __pycache__ -print0 | xargs -0 -I {} rm -rf "{}"
    '' + optionalString rebuildBytecode ''
-    # Then, we build for the two optimization levels.
-    # We do not build unoptimized bytecode, because its not entirely deterministic yet.
    # Python 3.7 implements PEP 552, introducing support for deterministic bytecode.
-    # compileall uses this checked-hash method by default when `SOURCE_DATE_EPOCH` is set.
+    # compileall uses the therein introduced checked-hash method by default when
+    # `SOURCE_DATE_EPOCH` is set.
    # We exclude lib2to3 because that's Python 2 code which fails
+    # We build 3 levels of optimized bytecode. Note the default level, without optimizations,
+    # is not reproducible yet. https://bugs.python.org/issue29708
+    # Not creating bytecode will result in a large performance loss however, so we do build it.
+    find $out -name "*.py" | ${pythonForBuildInterpreter} -m compileall -q -f -x "lib2to3" -i -
    find $out -name "*.py" | ${pythonForBuildInterpreter} -O  -m compileall -q -f -x "lib2to3" -i -
    find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i -
  '';
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@ -64,10 +64,10 @@ stdenv.mkDerivation rec {
  # fix build with gcc9, can be removed after bumping to current version
  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];

-  preConfigure =
-    ''
-      rm aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp
-    '';
+  # aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp
+  # aws-cpp-sdk-core-tests/aws/client/AWSClientTest.cpp
+  # seem to have a datarace
+  enableParallelChecking = false;

  postFixupHooks = [
    # This bodge is necessary so that the file that the generated -config.cmake file
--- a/pkgs/development/libraries/boost/default.nix
+++ b/pkgs/development/libraries/boost/default.nix
@ -0,0 +1,47 @@
+{ lib
+, callPackage
+, boost-build
+, fetchurl
+}:
+
+let
+  # for boost 1.55 we need to use 1.56's b2
+  # since 1.55's build system is not working
+  # with our derivation
+  useBoost156 = rec {
+    version = "1.56.0";
+    src = fetchurl {
+      url = "mirror://sourceforge/boost/boost_${lib.replaceStrings ["."] ["_"] version}.tar.bz2";
+      sha256 = "07gz62nj767qzwqm3xjh11znpyph8gcii0cqhnx7wvismyn34iqk";
+    };
+  };
+
+  makeBoost = file:
+    lib.fix (self:
+      callPackage file {
+        boost-build = boost-build.override {
+          # useBoost allows us passing in src and version from
+          # the derivation we are building to get a matching b2 version.
+          useBoost =
+            if lib.versionAtLeast self.version "1.56"
+            then self
+            else useBoost156; # see above
+        };
+      }
+    );
+in {
+  boost155 = makeBoost ./1.55.nix;
+  boost159 = makeBoost ./1.59.nix;
+  boost160 = makeBoost ./1.60.nix;
+  boost165 = makeBoost ./1.65.nix;
+  boost166 = makeBoost ./1.66.nix;
+  boost167 = makeBoost ./1.67.nix;
+  boost168 = makeBoost ./1.68.nix;
+  boost169 = makeBoost ./1.69.nix;
+  boost170 = makeBoost ./1.70.nix;
+  boost171 = makeBoost ./1.71.nix;
+  boost172 = makeBoost ./1.72.nix;
+  boost173 = makeBoost ./1.73.nix;
+  boost174 = makeBoost ./1.74.nix;
+  boost175 = makeBoost ./1.75.nix;
+}
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@ -1,8 +1,9 @@
 { lib, stdenv, icu, expat, zlib, bzip2, python ? null, fixDarwinDylibNames, libiconv
+, boost-build
 , fetchpatch
 , which
-, buildPackages
 , toolset ? /**/ if stdenv.cc.isClang  then "clang"
+            else if stdenv.cc.isGNU    then "gcc"
            else null
 , enableRelease ? true
 , enableDebug ? false
@ -67,6 +68,8 @@ let
    else
      "$NIX_BUILD_CORES";

+  needUserConfig = stdenv.hostPlatform != stdenv.buildPlatform || useMpi || stdenv.isDarwin;
+
  b2Args = concatStringsSep " " ([
    "--includedir=$dev/include"
    "--libdir=$out/lib"
@ -95,7 +98,7 @@ let
    ++ optional (variant == "release") "debug-symbols=off"
    ++ optional (toolset != null) "toolset=${toolset}"
    ++ optional (!enablePython) "--without-python"
-    ++ optional (useMpi || stdenv.hostPlatform != stdenv.buildPlatform) "--user-config=user-config.jam"
+    ++ optional needUserConfig "--user-config=user-config.jam"
    ++ optionals (stdenv.hostPlatform.libc == "msvcrt") [
    "threadapi=win32"
  ] ++ extraB2Args
@ -137,22 +140,39 @@ stdenv.mkDerivation {
    maintainers = with maintainers; [ peti ];
  };

-  preConfigure = ''
-    if test -f tools/build/src/tools/clang-darwin.jam ; then
-        substituteInPlace tools/build/src/tools/clang-darwin.jam \
-          --replace '@rpath/$(<[1]:D=)' "$out/lib/\$(<[1]:D=)";
-    fi;
-  '' + optionalString useMpi ''
+  preConfigure = optionalString useMpi ''
    cat << EOF >> user-config.jam
    using mpi : ${mpi}/bin/mpiCC ;
    EOF
-  '' + optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+  ''
+  # On darwin we need to add the `$out/lib` to the libraries' rpath explicitly,
+  # otherwise the dynamic linker is unable to resolve the reference to @rpath
+  # when the boost libraries want to load each other at runtime.
+  + optionalString (stdenv.isDarwin && enableShared) ''
    cat << EOF >> user-config.jam
-    using gcc : cross : ${stdenv.cc.targetPrefix}c++ ;
+    using clang-darwin : : ${stdenv.cc.targetPrefix}c++
+      : <linkflags>"-rpath $out/lib/"
+      ;
+    EOF
+  ''
+  # b2 has trouble finding the correct compiler and tools for cross compilation
+  # since it apparently ignores $CC, $AR etc. Thus we need to set everything
+  # in user-config.jam. To keep things simple we just set everything in an
+  # uniform way for clang and gcc (which works thanks to our cc-wrapper).
+  # We pass toolset later which will make b2 invoke everything in the right
+  # way -- the other toolset in user-config.jam will be ignored.
+  + optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    cat << EOF >> user-config.jam
+    using gcc : cross : ${stdenv.cc.targetPrefix}c++
+      : <archiver>$AR
+        <ranlib>$RANLIB
+      ;
+
+    using clang : cross : ${stdenv.cc.targetPrefix}c++
+      : <archiver>$AR
+        <ranlib>$RANLIB
+      ;
    EOF
-    # Build b2 with buildPlatform CC/CXX.
-    sed '2i export CC=$CC_FOR_BUILD; export CXX=$CXX_FOR_BUILD' \
-      -i ./tools/build/src/engine/build.sh
  '';

  NIX_CFLAGS_LINK = lib.optionalString stdenv.isDarwin
@ -160,9 +180,8 @@ stdenv.mkDerivation {

  enableParallelBuilding = true;

-  nativeBuildInputs = [ which ]
+  nativeBuildInputs = [ which boost-build ]
    ++ optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
  buildInputs = [ expat zlib bzip2 libiconv ]
    ++ optional (stdenv.hostPlatform == stdenv.buildPlatform) icu
    ++ optional enablePython python
@ -170,16 +189,19 @@ stdenv.mkDerivation {

  configureScript = "./bootstrap.sh";
  configurePlatforms = [];
+  dontDisableStatic = true;
+  dontAddStaticConfigureFlags = true;
  configureFlags = [
    "--includedir=$(dev)/include"
    "--libdir=$(out)/lib"
+    "--with-bjam=b2" # prevent bootstrapping b2 in configurePhase
  ] ++ optional enablePython "--with-python=${python.interpreter}"
-    ++ [ (if stdenv.hostPlatform == stdenv.buildPlatform then "--with-icu=${icu.dev}" else "--without-icu") ]
-    ++ optional (toolset != null) "--with-toolset=${toolset}";
+    ++ optional (toolset != null) "--with-toolset=${toolset}"
+    ++ [ (if stdenv.hostPlatform == stdenv.buildPlatform then "--with-icu=${icu.dev}" else "--without-icu") ];

  buildPhase = ''
    runHook preBuild
-    ./b2 ${b2Args}
+    b2 ${b2Args}
    runHook postBuild
  '';

@ -191,7 +213,7 @@ stdenv.mkDerivation {
    cp -a tools/boostbook/{xsl,dtd} $dev/share/boostbook/

    # Let boost install everything else
-    ./b2 ${b2Args} install
+    b2 ${b2Args} install

    runHook postInstall
  '';
--- a/pkgs/development/libraries/boxfort/default.nix
+++ b/pkgs/development/libraries/boxfort/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, python37Packages }:
+{ lib, stdenv, fetchFromGitHub, meson, ninja, python3Packages }:

 stdenv.mkDerivation rec {
  version = "unstable-2019-10-09";
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    patchShebangs ci/isdir.py
  '';

-  checkInputs = with python37Packages; [ cram ];
+  checkInputs = with python3Packages; [ cram ];

  doCheck = true;

--- a/pkgs/development/libraries/c-ares/default.nix
+++ b/pkgs/development/libraries/c-ares/default.nix
@ -8,13 +8,15 @@
 let self =
 stdenv.mkDerivation rec {
  pname = "c-ares";
-  version = "1.17.1";
+  version = "1.17.2";

  src = fetchurl {
    url = "https://c-ares.haxx.se/download/${pname}-${version}.tar.gz";
-    sha256 = "0h7wjfnk2092glqcp9mqaax7xx0s13m501z1gi0gsjl2vvvd0gfp";
+    sha256 = "sha256-SAPIRM4gzlEO8OuD+OpB+iTsqunSgMRoxYLSuyWzkT0=";
  };

+  enableParallelBuilding = true;
+
  meta = with lib; {
    description = "A C library for asynchronous DNS requests";
    homepage = "https://c-ares.haxx.se";
--- a/pkgs/development/libraries/criterion/default.nix
+++ b/pkgs/development/libraries/criterion/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, boxfort, cmake, libcsptr, pkg-config, gettext
-, dyncall , nanomsg, python37Packages }:
+, dyncall , nanomsg, python3Packages }:

 stdenv.mkDerivation rec {
  version = "2.3.3";
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    nanomsg
  ];

-  checkInputs = with python37Packages; [ cram ];
+  checkInputs = with python3Packages; [ cram ];

  cmakeFlags = [ "-DCTESTS=ON" ];
  doCheck = true;
--- a/pkgs/development/libraries/dav1d/default.nix
+++ b/pkgs/development/libraries/dav1d/default.nix
@ -10,14 +10,14 @@ assert useVulkan -> withExamples;

 stdenv.mkDerivation rec {
  pname = "dav1d";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitLab {
    domain = "code.videolan.org";
    owner = "videolan";
    repo = pname;
    rev = version;
-    sha256 = "0ki3wlyaqr80gl1srbbd18dd5bs1sl9icxym8ar62abpvgzxl5yk";
+    sha256 = "15ngaqyjbwkj0rd9mvxaqf3i9vzsnlrqgr50cnxxjqnpf7xdmslj";
  };

  nativeBuildInputs = [ meson ninja nasm pkg-config ];
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "enchant";
-  version = "2.3.0";
+  version = "2.3.1";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-32gGO2wTskX6ckaw4JigPnT3qRxtiUe8XE9CzlXi5B0=";
+    sha256 = "sha256-e0sa/PLNi/ppHe6mGIQE0zfyMXS7w5ucKt0r80Bzbpw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@ -244,7 +244,7 @@ assert opensslExtlib -> gnutls == null && openssl != null && nonfreeLicensing;

 stdenv.mkDerivation rec {
  pname = "ffmpeg-full";
-  inherit (ffmpeg) src version;
+  inherit (ffmpeg) src version patches;

  prePatch = ''
    patchShebangs .
@ -447,6 +447,14 @@ stdenv.mkDerivation rec {
  buildFlags = [ "all" ]
    ++ optional qtFaststartProgram "tools/qt-faststart"; # Build qt-faststart executable

+  doCheck = true;
+  checkPhase = let
+    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+  in ''
+    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavresample:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
+      make check -j$NIX_BUILD_CORES
+  '';
+
  # Hacky framework patching technique borrowed from the phantomjs2 package
  postInstall = optionalString qtFaststartProgram ''
    cp -a tools/qt-faststart $out/bin/
--- a/pkgs/development/libraries/ffmpeg/2.8.nix
+++ b/pkgs/development/libraries/ffmpeg/2.8.nix
@ -7,4 +7,5 @@ callPackage ./generic.nix (rec {
  knownVulnerabilities = [
    "CVE-2021-30123"
  ];
+  doCheck = false;
 } // args)
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@ -13,6 +13,16 @@ callPackage ./generic.nix (rec {
  darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];

  patches = [
+    (fetchpatch {
+      name = "CVE-2021-33815.patch";
+      url = "https://github.com/FFmpeg/FFmpeg/commit/26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777.patch";
+      sha256 = "0l8dqga5845f7d3wdbvd05i23saldq4pm2cyfdgszbr0c18sxagf";
+    })
+    (fetchpatch {
+      name = "CVE-2021-38114.patch";
+      url = "https://github.com/FFmpeg/FFmpeg/commit/7150f9575671f898382c370acae35f9087a30ba1.patch";
+      sha256 = "0gwkc7v1wsh4j0am2nnskhsca1b5aqzhcfd41sd9mh2swsdyf27i";
+    })
    # Fix incorrect segment length in HLS child playlist with fmp4 segment format
    # FIXME remove in version 4.5
    # https://trac.ffmpeg.org/ticket/9193
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -2,6 +2,7 @@
 , alsa-lib, bzip2, fontconfig, freetype, gnutls, libiconv, lame, libass, libogg
 , libssh, libtheora, libva, libdrm, libvorbis, libvpx, xz, libpulseaudio, soxr
 , x264, x265, xvidcore, zlib, libopus, speex, nv-codec-headers, dav1d
+, srt ? null
 , openglSupport ? false, libGLU ? null, libGL ? null
 , libmfxSupport ? false, intel-media-sdk ? null
 , libaomSupport ? false, libaom ? null
@ -17,7 +18,8 @@
 # Darwin frameworks
 , Cocoa, darwinFrameworks ? [ Cocoa ]
 # Inherit generics
-, branch, sha256, version, patches ? [], knownVulnerabilities ? [], ...
+, branch, sha256, version, patches ? [], knownVulnerabilities ? []
+, doCheck ? true, ...
 }:

 /* Maintainer notes:
@ -94,6 +96,7 @@ stdenv.mkDerivation rec {
    # Build flags
      "--enable-shared"
      (ifMinVer "0.6" "--enable-pic")
+      (ifMinVer "4.0" (enableFeature (srt != null) "libsrt"))
      (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
      "--enable-hardcoded-tables"
    ] ++
@ -171,7 +174,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
-    libvorbis xz soxr x264 x265 xvidcore zlib libopus speex nv-codec-headers
+    libvorbis xz soxr x264 x265 xvidcore zlib libopus speex srt nv-codec-headers
  ] ++ optionals openglSupport [ libGL libGLU ]
    ++ optional libmfxSupport intel-media-sdk
    ++ optional libaomSupport libaom
@ -187,7 +190,13 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  doCheck = false; # fails
+  inherit doCheck;
+  checkPhase = let
+    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+  in ''
+    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavresample:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
+      make check -j$NIX_BUILD_CORES
+  '';

  # ffmpeg 3+ generates pkg-config (.pc) files that don't have the
  # form automatically handled by the multiple-outputs hooks.
--- a/pkgs/development/libraries/glew/default.nix
+++ b/pkgs/development/libraries/glew/default.nix
@ -43,6 +43,9 @@ stdenv.mkDerivation rec {

  makeFlags = [
    "SYSTEM=${if stdenv.hostPlatform.isMinGW then "mingw" else stdenv.hostPlatform.parsed.kernel.name}"
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "LD=${stdenv.cc.targetPrefix}cc"
+    "AR=${stdenv.cc.targetPrefix}ar"
  ];

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/glib-networking/default.nix
+++ b/pkgs/development/libraries/glib-networking/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "glib-networking";
-  version = "2.68.1";
+  version = "2.68.2";

  outputs = [ "out" "installedTests" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0c1vylxly8k7g454g02spi44ybjidlwg461vp713zxd94k8qnpfh";
+    sha256 = "U168BU72l9tWpP/+2RvA4RyO4cmstIqtKMjh1cPVmU8=";
  };

  patches = [
--- a/pkgs/development/libraries/glibc/2.33-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.33-master.patch.gz
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@ -42,7 +42,7 @@

 let
  version = "2.33";
-  patchSuffix = "-47";
+  patchSuffix = "-49";
  sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in

@ -61,7 +61,7 @@ stdenv.mkDerivation ({
    [
      /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
          $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-47-gb5711025bc
+          glibc-2.33-49-g22d37364ae
          $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz

         To compare the archive contents zdiff can be used.
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@ -21,22 +21,10 @@ stdenv.mkDerivation rec {
  };

  patches = [
-    (fetchpatch { # probably included in > 1.16.0
-      name = "test_t-edit-sign.diff"; # we experienced segmentation fault in this test
-      urls = [
-        "https://files.gnupg.net/file/data/w43xz2zf73pnyqk5mm5l/PHID-FILE-hm2x5mjntsdyxrxve5tb/file"
-        "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=patch;h=81a33ea5e1b86d586b956e893a5b25c4cd41c969"
-      ];
-      sha256 = "1xxvv0kc9wdj5hzpddzs3cn8dhmm2cb29224a7h9vairraq5272h";
-    })
-    (fetchpatch { # gpg: Send --with-keygrip when listing keys
-      name = "c4cf527ea227edb468a84bf9b8ce996807bd6992.patch";
-      urls = [
-        "https://files.gnupg.net/file/data/2ufcg7ny5jdnv7hmewb4/PHID-FILE-7iwvryn2btti6txr3bsz/file"
-        "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=patch;h=c4cf527ea227edb468a84bf9b8ce996807bd6992"
-      ];
-      sha256 = "0y0b0lb2nq5p9kx13b59b2jaz157mvflliw1qdvg1v1hynvgb8m4";
-    })
+    # probably included in > 1.16.0
+    ./test_t-edit-sign.diff
+    # https://dev.gnupg.org/rMc4cf527ea227edb468a84bf9b8ce996807bd6992
+    ./fix_gpg_list_keys.diff
    # https://lists.gnupg.org/pipermail/gnupg-devel/2020-April/034591.html
    (fetchpatch {
      name = "0001-Fix-python-tests-on-non-Linux.patch";
--- a/pkgs/development/libraries/gpgme/fix_gpg_list_keys.diff
+++ b/pkgs/development/libraries/gpgme/fix_gpg_list_keys.diff
@ -0,0 +1,12 @@
+diff --git a/src/engine-gpg.c b/src/engine-gpg.c
+index b51ea173..4e74665e 100644
+--- a/src/engine-gpg.c
+++ b/src/engine-gpg.c
+@@ -3005,6 +3005,7 @@ gpg_keylist_build_options (engine_gpg_t gpg, int secret_only,
+   gpg_error_t err;
+ 
+   err = add_arg (gpg, "--with-colons");
+  err = add_arg (gpg, "--with-keygrip");
+ 
+   /* Since gpg 2.1.15 fingerprints are always printed, thus there is
+    * no more need to explicitly request them.  */
--- a/pkgs/development/libraries/gpgme/test_t-edit-sign.diff
+++ b/pkgs/development/libraries/gpgme/test_t-edit-sign.diff
@ -0,0 +1,125 @@
+From 81a33ea5e1b86d586b956e893a5b25c4cd41c969 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Sat, 26 Jun 2021 18:02:47 +0200
+Subject: [PATCH] core: Fix use-after-free issue in test
+
+* tests/gpg/t-edit-sign.c (sign_key, verify_key_signature): New.
+(main): Factored out signing and verifying the result.
+--
+
+Factoring the two steps of the test into different functions fixes the
+use-after-free issue that was caused by accidentaly using a variable
+of the first step in the second step.
+
+GnuPG-bug-id: 5509
+---
+ tests/gpg/t-edit-sign.c | 54 ++++++++++++++++++++++++++++-------------
+ 1 file changed, 37 insertions(+), 17 deletions(-)
+
+diff --git a/tests/gpg/t-edit-sign.c b/tests/gpg/t-edit-sign.c
+index 2f983622..e0494c54 100644
+--- a/tests/gpg/t-edit-sign.c
+++ b/tests/gpg/t-edit-sign.c
+@@ -107,31 +107,19 @@ interact_fnc (void *opaque, const char *status, const char *args, int fd)
+ }
+ 
+ 
+-int
+-main (int argc, char **argv)
+void
+sign_key (const char *key_fpr, const char *signer_fpr)
+ {
+   gpgme_ctx_t ctx;
+   gpgme_error_t err;
+   gpgme_data_t out = NULL;
+-  const char *signer_fpr = "A0FF4590BB6122EDEF6E3C542D727CC768697734"; /* Alpha Test */
+   gpgme_key_t signing_key = NULL;
+-  const char *key_fpr = "D695676BDCEDCC2CDD6152BCFE180B1DA9E3B0B2"; /* Bravo Test */
+   gpgme_key_t key = NULL;
+-  gpgme_key_t signed_key = NULL;
+-  gpgme_user_id_t signed_uid = NULL;
+-  gpgme_key_sig_t key_sig = NULL;
+   char *agent_info;
+-  int mode;
+-
+-  (void)argc;
+-  (void)argv;
+-
+-  init_gpgme (GPGME_PROTOCOL_OpenPGP);
+ 
+   err = gpgme_new (&ctx);
+   fail_if_err (err);
+ 
+-  /* Sign the key */
+   agent_info = getenv("GPG_AGENT_INFO");
+   if (!(agent_info && strchr (agent_info, ':')))
+     gpgme_set_passphrase_cb (ctx, passphrase_cb, 0);
+@@ -159,8 +147,23 @@ main (int argc, char **argv)
+   gpgme_data_release (out);
+   gpgme_key_unref (key);
+   gpgme_key_unref (signing_key);
+  gpgme_release (ctx);
+}
+
+
+void
+verify_key_signature (const char *key_fpr, const char *signer_keyid)
+{
+  gpgme_ctx_t ctx;
+  gpgme_error_t err;
+  gpgme_key_t signed_key = NULL;
+  gpgme_user_id_t signed_uid = NULL;
+  gpgme_key_sig_t key_sig = NULL;
+  int mode;
+
+  err = gpgme_new (&ctx);
+  fail_if_err (err);
+ 
+-  /* Verify the key signature */
+   mode  = gpgme_get_keylist_mode (ctx);
+   mode |= GPGME_KEYLIST_MODE_SIGS;
+   err = gpgme_set_keylist_mode (ctx, mode);
+@@ -168,7 +171,7 @@ main (int argc, char **argv)
+   err = gpgme_get_key (ctx, key_fpr, &signed_key, 0);
+   fail_if_err (err);
+ 
+-  signed_uid = key->uids;
+  signed_uid = signed_key->uids;
+   if (!signed_uid)
+     {
+       fprintf (stderr, "Signed key has no user IDs\n");
+@@ -180,7 +183,7 @@ main (int argc, char **argv)
+       exit (1);
+     }
+   key_sig = signed_uid->signatures->next;
+-  if (strcmp ("2D727CC768697734", key_sig->keyid))
+  if (strcmp (signer_keyid, key_sig->keyid))
+     {
+       fprintf (stderr, "Unexpected key ID in second user ID sig: %s\n",
+                 key_sig->keyid);
+@@ -196,6 +199,23 @@ main (int argc, char **argv)
+ 
+   gpgme_key_unref (signed_key);
+   gpgme_release (ctx);
+}
+
+
+int
+main (int argc, char **argv)
+{
+  const char *signer_fpr = "A0FF4590BB6122EDEF6E3C542D727CC768697734"; /* Alpha Test */
+  const char *signer_keyid = signer_fpr + strlen(signer_fpr) - 16;
+  const char *key_fpr = "D695676BDCEDCC2CDD6152BCFE180B1DA9E3B0B2"; /* Bravo Test */
+
+  (void)argc;
+  (void)argv;
+
+  init_gpgme (GPGME_PROTOCOL_OpenPGP);
+
+  sign_key (key_fpr, signer_fpr);
+  verify_key_signature (key_fpr, signer_keyid);
+ 
+   return 0;
+ }
+-- 
+2.32.0
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@ -107,6 +107,7 @@ stdenv.mkDerivation rec {
    "-Dgl_winsys=${lib.concatStringsSep "," (lib.optional enableX11 "x11" ++ lib.optional enableWayland "wayland" ++ lib.optional enableCocoa "cocoa")}"
  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
    "-Dintrospection=disabled"
+    "-Dtests=disabled"
  ]
  ++ lib.optional (!enableX11) "-Dx11=disabled"
  # TODO How to disable Wayland?
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@ -76,12 +76,7 @@ stdenv.mkDerivation rec {

  patches = [
    ./patches/3.0-immodules.cache.patch
-
-    (fetchpatch {
-      name = "Xft-setting-fallback-compute-DPI-properly.patch";
-      url = "https://bug757142.bugzilla-attachments.gnome.org/attachment.cgi?id=344123";
-      sha256 = "0g6fhqcv8spfy3mfmxpyji93k8d4p4q4fz1v9a1c1cgcwkz41d7p";
-    })
+    ./patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
  ] ++ lib.optionals stdenv.isDarwin [
    # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
    # let’s drop that dependency in similar way to how other parts of the library do it
--- a/pkgs/development/libraries/gtk/patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
+++ b/pkgs/development/libraries/gtk/patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
@ -0,0 +1,34 @@
+From 269f2d80ea41cde17612600841fbdc32e99010f5 Mon Sep 17 00:00:00 2001
+From: Giuseppe Bilotta <giuseppe.bilotta@gmail.com>
+Date: Tue, 24 Jan 2017 12:30:08 +0100
+Subject: [PATCH] Xft setting fallback: compute DPI properly
+
+This is a partial revert of bdf0820c501437a2150d8ff0d5340246e713f73f. If
+the Xft DPI settings are not explicitly set, use the values provided by
+the X server rather than hard-coding the fallback value of 96.
+
+While an auto-configured Xorg already reports 96, this value can be
+overriden by the user, and we should respect the user choice in this
+case. There is no need to require them to set the same value in
+different places (the Xorg DPI settings and Xft.dpi).
+---
+ gdk/x11/gdkxftdefaults.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/gdk/x11/gdkxftdefaults.c b/gdk/x11/gdkxftdefaults.c
+index fa1cfde2ec..c462b78c4b 100644
+--- a/gdk/x11/gdkxftdefaults.c
+++ b/gdk/x11/gdkxftdefaults.c
+@@ -174,7 +174,8 @@ init_xft_settings (GdkScreen *screen)
+     x11_screen->xft_rgba = FC_RGBA_UNKNOWN;
+ 
+   if (!get_double_default (xdisplay, "dpi", &dpi_double))
+-    dpi_double = 96.0;
+    dpi_double = (DisplayHeight(xdisplay, x11_screen->screen_num)*25.4)/
+		    DisplayHeightMM(xdisplay, x11_screen->screen_num);
+ 
+   x11_screen->xft_dpi = (int)(0.5 + PANGO_SCALE * dpi_double);
+ }
+-- 
+2.11.0.616.gd72966cf44.dirty
+
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
    # CPU detection isn't supported on Darwin and breaks the aarch64-darwin build:
    "-DCONFIG_RUNTIME_CPU_DETECT=0"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "-DAS_EXECUTABLE=${stdenv.cc.targetPrefix}as"
  ] ++ lib.optionals stdenv.isAarch32 [
    # armv7l-hf-multiplatform does not support NEON
    # see lib/systems/platform.nix
--- a/pkgs/development/libraries/libbfd/default.nix
+++ b/pkgs/development/libraries/libbfd/default.nix
@ -30,6 +30,7 @@ stdenv.mkDerivation {
  # We update these ourselves
  dontUpdateAutotoolsGnuConfigScripts = true;

+  strictDeps = true;
  nativeBuildInputs = [ autoreconfHook bison ];
  buildInputs = [ libiberty zlib.dev ];

@ -37,9 +38,8 @@ stdenv.mkDerivation {
  configureFlags = [
    "--enable-targets=all" "--enable-64-bit-bfd"
    "--enable-install-libbfd"
-    "--enable-shared"
    "--with-system-zlib"
-  ];
+  ] ++ lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared";

  enableParallelBuilding = true;

--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@ -1,14 +1,10 @@
-{ lib, stdenv, fetchFromGitLab, pkg-config, meson, ninja
+{ lib, stdenv, fetchurl, pkg-config, meson, ninja
 , libevdev, mtdev, udev, libwacom
-, documentationSupport ? false, doxygen ? null, graphviz ? null # Documentation
-, eventGUISupport ? false, cairo ? null, glib ? null, gtk3 ? null # GUI event viewer support
-, testsSupport ? false, check ? null, valgrind ? null, python3 ? null
+, documentationSupport ? false, doxygen, graphviz # Documentation
+, eventGUISupport ? false, cairo, glib, gtk3 # GUI event viewer support
+, testsSupport ? false, check, valgrind, python3
 }:

-assert documentationSupport -> doxygen != null && graphviz != null && python3 != null;
-assert eventGUISupport -> cairo != null && glib != null && gtk3 != null;
-assert testsSupport -> check != null && valgrind != null && python3 != null;
-
 let
  mkFlag = optSet: flag: "-D${flag}=${lib.boolToString optSet}";

@ -24,17 +20,13 @@ let
  else null;
 in

-with lib;
 stdenv.mkDerivation rec {
  pname = "libinput";
-  version = "1.16.4";
+  version = "1.18.1";

-  src = fetchFromGitLab {
-    domain = "gitlab.freedesktop.org";
-    owner = pname;
-    repo = pname;
-    rev = version;
-    sha256 = "1c81429kh9av9fanxmnjw5rvsjbzcyi7d0dx0gkyq5yysmpmrppi";
+  src = fetchurl {
+    url = "https://www.freedesktop.org/software/libinput/libinput-${version}.tar.xz";
+    sha256 = "1jx7y48ym89grjz67jmn80h5j8c36qgwb0h5c703nln2zchl18cw";
  };

  outputs = [ "bin" "out" "dev" ];
@ -48,7 +40,7 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [ pkg-config meson ninja ]
-    ++ optionals documentationSupport [ doxygen graphviz sphinx-build ];
+    ++ lib.optionals documentationSupport [ doxygen graphviz sphinx-build ];

  buildInputs = [
    libevdev
@ -60,8 +52,7 @@ stdenv.mkDerivation rec {
      pyyaml
      setuptools
    ]))
-  ]
-    ++ optionals eventGUISupport [ cairo glib gtk3 ];
+  ] ++ lib.optionals eventGUISupport [ cairo glib gtk3 ];

  checkInputs = [
    check
@ -73,15 +64,19 @@ stdenv.mkDerivation rec {
  patches = [ ./udev-absolute-path.patch ];

  postPatch = ''
-    patchShebangs tools/helper-copy-and-exec-from-tmp.sh
-    patchShebangs test/symbols-leak-test
-    patchShebangs test/check-leftover-udev-rules.sh
-    patchShebangs test/helper-copy-and-exec-from-tmp.sh
+    patchShebangs \
+      tools/helper-copy-and-exec-from-tmp.sh \
+      test/symbols-leak-test \
+      test/check-leftover-udev-rules.sh \
+      test/helper-copy-and-exec-from-tmp.sh
+
+    # Don't create an empty /etc directory.
+    sed -i "/install_subdir('libinput', install_dir : dir_etc)/d" meson.build
  '';

  doCheck = testsSupport && stdenv.hostPlatform == stdenv.buildPlatform;

-  meta = {
+  meta = with lib; {
    description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";
    homepage    = "https://www.freedesktop.org/wiki/Software/libinput/";
    license     = licenses.mit;
--- a/pkgs/development/libraries/liblqr-1/default.nix
+++ b/pkgs/development/libraries/liblqr-1/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, glib }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, glib, Carbon }:

 stdenv.mkDerivation rec {
  pname = "liblqr-1";
@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkg-config ];
+  buildInputs = lib.optionals stdenv.isDarwin [ Carbon ];
  propagatedBuildInputs = [ glib ];

  meta = with lib; {
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@ -1,21 +1,21 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , pkg-config
 , glib
 , python3
 , systemd
-, libgudev
 , withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
 , gobject-introspection
 }:

 stdenv.mkDerivation rec {
  pname = "libmbim";
-  version = "1.24.8";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "sha256-AlkHNhY//xDlcyGR/MwbmSCWlhbdxZYToAMFKhFqPCU=";
+    sha256 = "1kqkx139z62w391bz6lwmcjg7v12jxlcm7hj88222xrcn8k0j7qy";
  };

  outputs = [ "out" "dev" "man" ];
@ -33,7 +33,6 @@ stdenv.mkDerivation rec {

  buildInputs = [
    glib
-    libgudev
    systemd
  ];

@ -43,6 +42,6 @@ stdenv.mkDerivation rec {
    homepage = "https://www.freedesktop.org/wiki/Software/libmbim/";
    description = "Library for talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
    platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
  };
 }
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "libqmi";
-  version = "1.28.6";
+  version = "1.28.8";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "1zg5k8f6l87iy9hmzwckdx532s845z9c5npblmpf1pp17n4r1f6b";
+    sha256 = "sha256-bju70gC8G2SyP2JU/vkhLyaZ7HfPsyB10rpQecc6n3g=";
  };

  nativeBuildInputs = [
@ -64,5 +64,6 @@ stdenv.mkDerivation rec {
      # Tools
      gpl2Plus
    ];
+    changelog = "https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/blob/${version}/NEWS";
  };
 }
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "libsndfile";
-  version = "1.0.30";
+  version = "1.0.31";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
-    rev = "v${version}";
-    sha256 = "1rh79y4s4m2wcm2kahmzs2kijpdpayif2gyca6m71f3k7jbhgcwa";
+    rev = version;
+    sha256 = "1alba3iv8i7i2jb5fd6q5s7j9bcj48sf28nfjd3qigz2n2is5jl2";
  };

  nativeBuildInputs = [ autoreconfHook autogen pkg-config python3 ];
--- a/pkgs/development/libraries/libssh2/1_10.nix
+++ b/pkgs/development/libraries/libssh2/1_10.nix
@ -0,0 +1,10 @@
+{ libssh2, fetchurl }:
+
+libssh2.overrideAttrs (attrs: rec {
+  version = "1.10.0";
+  src = fetchurl {
+    url = with attrs; "${meta.homepage}/download/${pname}-${version}.tar.gz";
+    sha256 = "sha256-LWTpDz3tOUuR06LndMogOkF59prr7gMAPlpvpiHkHVE=";
+  };
+  patches = [];
+})
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "libwacom";
-  version = "1.10";
+  version = "1.11";

  outputs = [ "out" "dev" ];

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    owner = "linuxwacom";
    repo = "libwacom";
    rev = "libwacom-${version}";
-    sha256 = "sha256-Q7b54AMAxdIzN7TUuhIdlrXaVtj2szV4n3y9bAE0LsU=";
+    sha256 = "sha256-HDBWycdZf/pUL7ZzCuF55tfby3GW0WW6Vq3htPWT1v4=";
  };

  nativeBuildInputs = [ pkg-config meson ninja doxygen python3 ];
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@ -2,7 +2,7 @@
 , zlib, xz, libintl, python, gettext, ncurses, findXMLCatalogs
 , pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
 , icuSupport ? false, icu ? null
-, enableShared ? stdenv.hostPlatform.libc != "msvcrt"
+, enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
 , enableStatic ? !enableShared
 }:

@ -40,6 +40,8 @@ stdenv.mkDerivation rec {
    ++ lib.optional pythonSupport "py"
    ++ lib.optional (enableStatic && enableShared) "static";

+  strictDeps = true;
+
  buildInputs = lib.optional pythonSupport python
    ++ lib.optional (pythonSupport && python?isPy2 && python.isPy2) gettext
    ++ lib.optional (pythonSupport && python?isPy3 && python.isPy3) ncurses
--- a/pkgs/development/libraries/lzo/default.nix
+++ b/pkgs/development/libraries/lzo/default.nix
@ -9,12 +9,14 @@ stdenv.mkDerivation rec {
    sha256 = "0wm04519pd3g8hqpjqhfr72q8qmbiwqaxcs3cndny9h86aa95y60";
  };

-  configureFlags = [ "--enable-shared" ];
+  configureFlags = lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared" ;

  enableParallelBuilding = true;

  doCheck = true; # not cross;

+  strictDeps = true;
+
  meta = with lib; {
    description = "Real-time data (de)compression library";
    longDescription = ''
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -31,7 +31,7 @@ with lib;
 let
  # Release calendar: https://www.mesa3d.org/release-calendar.html
  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.1.7";
+  version = "21.2.1";
  branch  = versions.major version;

 self = stdenv.mkDerivation {
@ -45,11 +45,9 @@ self = stdenv.mkDerivation {
      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
    ];
-    sha256 = "1fx7nfvh1drfa6vv34j7ma944qbs014b0jwlbgqlnbjgcl87rrp9";
+    sha256 = "11qpq16xbxymcgiy0wk787dk4yw2pv8fzgj8d92ng6s11dqycr9c";
  };

-  prePatch = "patchShebangs .";
-
  # TODO:
  #  revive ./dricore-gallium.patch when it gets ported (from Ubuntu), as it saved
  #  ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog
@ -64,12 +62,6 @@ self = stdenv.mkDerivation {
      url = "https://gitlab.freedesktop.org/mesa/mesa/commit/aebbf819df6d1e.patch";
      sha256 = "17248hyzg43d73c86p077m4lv1pkncaycr3l27hwv9k4ija9zl8q";
    })
-    # For RISC-V support:
-    (fetchpatch {
-      name = "add-riscv-default-selections.patch";
-      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/9908da1b7a5eaf0156d458e0e24b694c070ba345.patch";
-      sha256 = "036gv95m5gzzs6qpgkydf5fwgdlm7kpbdfalg8vmayghd260rw1w";
-    })
  ] ++ optionals (stdenv.isDarwin && stdenv.isAarch64) [
    # Fix aarch64-darwin build, remove when upstreaam supports it out of the box.
    # See: https://gitlab.freedesktop.org/mesa/mesa/-/issues/1020
@ -77,6 +69,8 @@ self = stdenv.mkDerivation {
  ];

  postPatch = ''
+    patchShebangs .
+
    substituteInPlace meson.build --replace \
      "find_program('pkg-config')" \
      "find_program('${buildPackages.pkg-config.targetPrefix}pkg-config')"
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, cmake
 , SDL
 , ffmpeg
 , frei0r
@ -26,13 +27,13 @@

 mkDerivation rec {
  pname = "mlt";
-  version = "6.24.0";
+  version = "7.0.1";

  src = fetchFromGitHub {
    owner = "mltframework";
    repo = "mlt";
    rev = "v${version}";
-    sha256 = "1my43ica2qax2622307dv4gn3w8hkchy643i9pq8r9yh2hd4pvs9";
+    sha256 = "13c5miph9jjbz69dhy0zvbkk5zbb05dr3vraaci0d5fdbrlhyscf";
  };

  buildInputs = [
@ -56,42 +57,15 @@ mkDerivation rec {
    ladspaPlugins
  ];

-  nativeBuildInputs = [ which ];
+  nativeBuildInputs = [ cmake which ];

  outputs = [ "out" "dev" ];

-  # Mostly taken from:
-  # http://www.kdenlive.org/user-manual/downloading-and-installing-kdenlive/installing-source/installing-mlt-rendering-engine
-  configureFlags = [
-    "--avformat-swscale"
-    "--enable-gpl"
-    "--enable-gpl3"
-    "--enable-opengl"
-  ];
-
-  # mlt is unable to cope with our multi-prefix Qt build
-  # because it does not use CMake or qmake.
-  NIX_CFLAGS_COMPILE = "-I${lib.getDev qtsvg}/include/QtSvg";
-
-  CXXFLAGS = "-std=c++11";
-
  qtWrapperArgs = [
    "--prefix FREI0R_PATH : ${frei0r}/lib/frei0r-1"
    "--prefix LADSPA_PATH : ${ladspaPlugins}/lib/ladspa"
  ];

-  postInstall = ''
-    # Remove an unnecessary reference to movit.dev.
-    s=${movit.dev}/include
-    t=$(for ((i = 0; i < ''${#s}; i++)); do echo -n X; done)
-    sed -i $out/lib/mlt/libmltopengl.so -e "s|$s|$t|g"
-
-    # Remove an unnecessary reference to movit.dev.
-    s=${qtbase.dev}/include
-    t=$(for ((i = 0; i < ''${#s}; i++)); do echo -n X; done)
-    sed -i $out/lib/mlt/libmltqt.so -e "s|$s|$t|g"
-  '';
-
  passthru = {
    inherit ffmpeg;
  };
--- a/pkgs/development/libraries/newt/default.nix
+++ b/pkgs/development/libraries/newt/default.nix
@ -12,16 +12,21 @@ stdenv.mkDerivation rec {
    sha256 = "0cdvbancr7y4nrj8257y5n45hmhizr8isynagy4fpsnpammv8pi6";
  };

-  patchPhase = ''
+  postPatch = ''
    sed -i -e s,/usr/bin/install,install, -e s,-I/usr/include/slang,, Makefile.in po/Makefile

    substituteInPlace configure \
      --replace "/usr/include/python" "${pythonIncludePath}"
    substituteInPlace configure.ac \
      --replace "/usr/include/python" "${pythonIncludePath}"
+
+    substituteInPlace Makefile.in \
+      --replace "ar rv" "${stdenv.cc.targetPrefix}ar rv"
  '';

-  buildInputs = [ slang popt python ];
+  strictDeps = true;
+  nativeBuildInputs = [ python ];
+  buildInputs = [ slang popt ];

  NIX_LDFLAGS = "-lncurses";

--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@ -1,45 +1,39 @@
 { lib, stdenv, fetchFromGitHub, cmake
-, alsaSupport ? !stdenv.isDarwin, alsa-lib ? null
-, pulseSupport ? !stdenv.isDarwin, libpulseaudio ? null
+, alsaSupport ? !stdenv.isDarwin, alsa-lib
+, pulseSupport ? !stdenv.isDarwin, libpulseaudio
 , CoreServices, AudioUnit, AudioToolbox
 }:

-with lib;
-
-assert alsaSupport -> alsa-lib != null;
-assert pulseSupport -> libpulseaudio != null;
-
 stdenv.mkDerivation rec {
-  version = "1.19.1";
  pname = "openal-soft";
+  version = "1.21.1";

  src = fetchFromGitHub {
    owner = "kcat";
    repo = "openal-soft";
-    rev = "${pname}-${version}";
-    sha256 = "0b0g0q1c36nfb289xcaaj3cmyfpiswvvgky3qyalsf9n4dj7vnzi";
+    rev = version;
+    sha256 = "sha256-rgc6kjXaZb6sCR+e9Gu7BEEHIiCHMygpLIeSqgWkuAg=";
  };

  # this will make it find its own data files (e.g. HRTF profiles)
  # without any other configuration
  patches = [ ./search-out.patch ];
  postPatch = ''
-    substituteInPlace Alc/helpers.c \
+    substituteInPlace alc/helpers.cpp \
      --replace "@OUT@" $out
  '';

  nativeBuildInputs = [ cmake ];

-  buildInputs = []
-    ++ optional alsaSupport alsa-lib
-    ++ optional pulseSupport libpulseaudio
-    ++ optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];
+  buildInputs = lib.optional alsaSupport alsa-lib
+    ++ lib.optional pulseSupport libpulseaudio
+    ++ lib.optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];

-  NIX_LDFLAGS = toString ([]
-    ++ optional alsaSupport "-lasound"
-    ++ optional pulseSupport "-lpulse");
+  NIX_LDFLAGS = toString (
+    lib.optional alsaSupport "-lasound"
+    ++ lib.optional pulseSupport "-lpulse");

-  meta = {
+  meta = with lib; {
    description = "OpenAL alternative";
    homepage = "https://kcat.strangesoft.net/openal.html";
    license = licenses.lgpl2;
--- a/pkgs/development/libraries/openal-soft/search-out.patch
+++ b/pkgs/development/libraries/openal-soft/search-out.patch
@ -1,12 +1,12 @@
-diff -Nuar a/Alc/helpers.c b/Alc/helpers.c
--- a/Alc/helpers.c	1970-01-01 00:00:01.000000000 +0000
-+++ b/Alc/helpers.c	1970-01-01 00:00:02.000000000 +0000
-@@ -951,6 +951,8 @@
-             }
-         }
+diff --git a/alc/helpers.cpp b/alc/helpers.cpp
+index 8c1c856..19bbc0f 100644
+--- a/alc/helpers.cpp
+++ b/alc/helpers.cpp
+@@ -402,6 +402,7 @@ al::vector<std::string> SearchDataFiles(const char *ext, const char *subdir)
 
-+        DirectorySearch("@OUT@/share", ext, &results);
-+
-         alstr_reset(&path);
+         DirectorySearch(path.c_str(), ext, &results);
     }
+    DirectorySearch("@OUT@/share/", ext, &results);
 
+     return results;
+ }
--- a/pkgs/development/libraries/science/math/caffe2/default.nix
+++ b/pkgs/development/libraries/science/math/caffe2/default.nix
@ -139,5 +139,9 @@ stdenv.mkDerivation rec {
    platforms = with lib.platforms; linux;
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ yuriaisaka ];
+    # fails to compile with
+    # error: invalid conversion from 'const char*' to 'char*'
+    # TODO: Remove usage of python2, protobuf overwrite
+    broken = true;
  };
 }
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, perl, which
+{ lib, stdenv, fetchFromGitHub, perl, which
 # Most packages depending on openblas expect integer width to match
 # pointer width, but some expect to use 32-bit integers always
 # (for compatibility with reference BLAS).
@ -129,7 +129,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "openblas";
-  version = "0.3.15";
+  version = "0.3.17";

  outputs = [ "out" "dev" ];

@ -137,23 +137,9 @@ stdenv.mkDerivation rec {
    owner = "xianyi";
    repo = "OpenBLAS";
    rev = "v${version}";
-    sha256 = "1qjr02cqncv20abdp1yzr55n7smhx6h9chqvb0xbp18byynvj87w";
+    sha256 = "11j103s851mml6kns781kha0asxjz6b6s1vbv80aq3b6g7p05pms";
  };

-  # remove both patches when updating to 0.3.16
-  patches = [
-    (fetchpatch {
-      name = "riscv64-imin-fix-wrong-comparison.patch";
-      url = "https://github.com/xianyi/OpenBLAS/commit/1e0192a5ccac28fc0c749f49d36ec7eda9757428.patch";
-      sha256 = "0kjkmrj8023vcjxhgin5dqs5w3gf93hzhwdhg0vsjhdra2ghkwzj";
-    })
-    (fetchpatch {
-      name = "riscv64-generic-use-generic-kernel-for-dsdot.patch";
-      url = "https://github.com/xianyi/OpenBLAS/commit/3521cd48cbfb3d50f6ae9a10377382d37075c696.patch";
-      sha256 = "0ljwbldff4db377s8rzmqxrszilqdivy656yqvfq46x5338v3gi0";
-    })
-  ];
-
  inherit blas64;

  # Some hardening features are disabled due to sporadic failures in
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@ -5,6 +5,7 @@
 , freetype
 , cmake
 , static ? stdenv.hostPlatform.isStatic
+, libgcc
 }:

 stdenv.mkDerivation rec {
@ -18,7 +19,9 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkg-config cmake ];
-  buildInputs = [ freetype ];
+  buildInputs = [ freetype ]
+    # On aarch64-darwin libgcc won't even build currently, and it doesn't seem needed.
+    ++ lib.optionals (with stdenv; !cc.isGNU && !(isDarwin && isAarch64)) [ libgcc ];

  patches = lib.optionals stdenv.isDarwin [ ./macosx.patch ];

--- a/Show More
+++ b/Show More