Merge master into staging-next

2022-03-21 00:02:21 +00:00 · 2022-03-21 00:02:21 +00:00 · 523c6a19e0
commit 523c6a19e0
parent 6620842e30 76760f593d
63 changed files with 1237 additions and 215 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -836,6 +836,16 @@
          <literal>systemd.nspawn.&lt;name&gt;.execConfig.PrivateUsers = false</literal>
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The Tor SOCKS proxy is now actually disabled if
+          <literal>services.tor.client.enable</literal> is set to
+          <literal>false</literal> (the default). If you are using this
+          functionality but didn’t change the setting or set it to
+          <literal>false</literal>, you now need to set it to
+          <literal>true</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The terraform 0.12 compatibility has been removed and the
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -324,6 +324,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `systemd-nspawn@.service` settings have been reverted to the default systemd behaviour. User namespaces are now activated by default. If you want to keep running nspawn containers without user namespaces you need to set `systemd.nspawn.<name>.execConfig.PrivateUsers = false`

+- The Tor SOCKS proxy is now actually disabled if `services.tor.client.enable` is set to `false` (the default). If you are using this functionality but didn't change the setting or set it to `false`, you now need to set it to `true`.
+
 - The terraform 0.12 compatibility has been removed and the `terraform.withPlugins` and `terraform-providers.mkProvider` implementations simplified. Providers now need to be stored under
 `$out/libexec/terraform-providers/<registry>/<owner>/<name>/<version>/<os>_<arch>/terraform-provider-<name>_v<version>` (which mkProvider does).

--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@ -910,6 +910,11 @@ in
        ORPort = mkForce [];
        PublishServerDescriptor = mkForce false;
      })
+      (mkIf (!cfg.client.enable) {
+        # Make sure application connections via SOCKS are disabled
+        # when services.tor.client.enable is false
+        SOCKSPort = mkForce [ 0 ];
+      })
      (mkIf cfg.client.enable (
        { SOCKSPort = [ cfg.client.socksListenAddress ];
        } // optionalAttrs cfg.client.transparentProxy.enable {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -286,6 +286,7 @@ in
  mailhog = handleTest ./mailhog.nix {};
  man = handleTest ./man.nix {};
  mariadb-galera = handleTest ./mysql/mariadb-galera.nix {};
+  mastodon = handleTestOn ["x86_64-linux" "i686-linux" "aarch64-linux"] ./web-apps/mastodon.nix {};
  matomo = handleTest ./matomo.nix {};
  matrix-appservice-irc = handleTest ./matrix-appservice-irc.nix {};
  matrix-conduit = handleTest ./matrix-conduit.nix {};
--- a/nixos/tests/web-apps/mastodon.nix
+++ b/nixos/tests/web-apps/mastodon.nix
@ -0,0 +1,170 @@
+import ../make-test-python.nix ({pkgs, ...}:
+let
+  test-certificates = pkgs.runCommandLocal "test-certificates" { } ''
+    mkdir -p $out
+    echo insecure-root-password > $out/root-password-file
+    echo insecure-intermediate-password > $out/intermediate-password-file
+    ${pkgs.step-cli}/bin/step certificate create "Example Root CA" $out/root_ca.crt $out/root_ca.key --password-file=$out/root-password-file --profile root-ca
+    ${pkgs.step-cli}/bin/step certificate create "Example Intermediate CA 1" $out/intermediate_ca.crt $out/intermediate_ca.key --password-file=$out/intermediate-password-file --ca-password-file=$out/root-password-file --profile intermediate-ca --ca $out/root_ca.crt --ca-key $out/root_ca.key
+  '';
+
+  hosts = ''
+    192.168.2.10 ca.local
+    192.168.2.11 mastodon.local
+  '';
+
+in
+{
+  name = "mastodon";
+  meta.maintainers = with pkgs.lib.maintainers; [ erictapen izorkin ];
+
+  nodes = {
+    ca = { pkgs, ... }: {
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.10"; prefixLength = 24; }
+          ];
+        };
+        extraHosts = hosts;
+      };
+      services.step-ca = {
+        enable = true;
+        address = "0.0.0.0";
+        port = 8443;
+        openFirewall = true;
+        intermediatePasswordFile = "${test-certificates}/intermediate-password-file";
+        settings = {
+          dnsNames = [ "ca.local" ];
+          root = "${test-certificates}/root_ca.crt";
+          crt = "${test-certificates}/intermediate_ca.crt";
+          key = "${test-certificates}/intermediate_ca.key";
+          db = {
+            type = "badger";
+            dataSource = "/var/lib/step-ca/db";
+          };
+          authority = {
+            provisioners = [
+              {
+                type = "ACME";
+                name = "acme";
+              }
+            ];
+          };
+        };
+      };
+    };
+
+    server = { pkgs, ... }: {
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.11"; prefixLength = 24; }
+          ];
+        };
+        extraHosts = hosts;
+        firewall.allowedTCPPorts = [ 80 443 ];
+      };
+
+      security = {
+        acme = {
+          acceptTerms = true;
+          defaults.server = "https://ca.local:8443/acme/acme/directory";
+          defaults.email = "mastodon@mastodon.local";
+        };
+        pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
+      };
+
+      services.redis.servers.mastodon = {
+        enable = true;
+        bind = "127.0.0.1";
+        port = 31637;
+      };
+
+      services.mastodon = {
+        enable = true;
+        configureNginx = true;
+        localDomain = "mastodon.local";
+        enableUnixSocket = false;
+        redis = {
+          createLocally = true;
+          host = "127.0.0.1";
+          port = 31637;
+        };
+        database = {
+          createLocally = true;
+          host = "/run/postgresql";
+          port = 5432;
+        };
+        smtp = {
+          createLocally = false;
+          fromAddress = "mastodon@mastodon.local";
+        };
+        extraConfig = {
+          EMAIL_DOMAIN_ALLOWLIST = "example.com";
+        };
+      };
+    };
+
+    client = { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.jq ];
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.12"; prefixLength = 24; }
+          ];
+        };
+        extraHosts = hosts;
+      };
+
+      security = {
+        pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    ca.wait_for_unit("step-ca.service")
+    ca.wait_for_open_port(8443)
+
+    server.wait_for_unit("nginx.service")
+    server.wait_for_unit("redis-mastodon.service")
+    server.wait_for_unit("postgresql.service")
+    server.wait_for_unit("mastodon-sidekiq.service")
+    server.wait_for_unit("mastodon-streaming.service")
+    server.wait_for_unit("mastodon-web.service")
+    server.wait_for_open_port(55000)
+    server.wait_for_open_port(55001)
+
+    # Check Mastodon version from remote client
+    client.succeed("curl --fail https://mastodon.local/api/v1/instance | jq -r '.version' | grep '${pkgs.mastodon.version}'")
+
+    # Check using admin CLI
+    # Check Mastodon version
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl version' | grep '${pkgs.mastodon.version}'")
+
+    # Manage accounts
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks add example.com'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks list' | grep 'example.com'")
+    server.fail("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks list' | grep 'mastodon.local'")
+    server.fail("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts create alice --email=alice@example.com'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks remove example.com'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts create bob --email=bob@example.com'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts approve bob'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts delete bob'")
+
+    # Manage IP access
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl ip_blocks add 192.168.0.0/16 --severity=no_access'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl ip_blocks export' | grep '192.168.0.0/16'")
+    server.fail("su - mastodon -s /bin/sh -c 'mastodon-env tootctl p_blocks export' | grep '172.16.0.0/16'")
+    client.fail("curl --fail https://mastodon.local/about")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl ip_blocks remove 192.168.0.0/16'")
+    client.succeed("curl --fail https://mastodon.local/about")
+
+    ca.shutdown()
+    server.shutdown()
+    client.shutdown()
+  '';
+})
--- a/pkgs/applications/audio/cider/default.nix
+++ b/pkgs/applications/audio/cider/default.nix
@ -0,0 +1,30 @@
+{ appimageTools, lib, fetchurl }:
+
+appimageTools.wrapType2 rec {
+  pname = "cider";
+  version = "1.3.1308";
+
+  src = fetchurl {
+    url = "https://1308-429851205-gh.circle-artifacts.com/0/%7E/Cider/dist/artifacts/Cider-${version}.AppImage";
+    sha256 = "1lbyvn1c8155p039qfzx7jwad7km073phkmrzjm0w3ahdpwz3wgi";
+  };
+
+  extraInstallCommands =
+    let contents = appimageTools.extract { inherit pname version src; };
+    in ''
+      mv $out/bin/${pname}-${version} $out/bin/${pname}
+
+      install -m 444 -D ${contents}/${pname}.desktop -t $out/share/applications
+      substituteInPlace $out/share/applications/${pname}.desktop \
+        --replace 'Exec=AppRun' 'Exec=${pname}'
+      cp -r ${contents}/usr/share/icons $out/share
+    '';
+
+  meta = with lib; {
+    description = "A new look into listening and enjoying Apple Music in style and performance.";
+    homepage = "https://github.com/ciderapp/Cider";
+    license = licenses.agpl3;
+    maintainers = [ maintainers.cigrainger ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/audio/eteroj.lv2/default.nix
+++ b/pkgs/applications/audio/eteroj.lv2/default.nix
@ -1,23 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libuv, lv2 }:
-
-stdenv.mkDerivation rec {
-  pname = "eteroj.lv2";
-  version = "0.4.0";
-
-  src = fetchFromGitHub {
-    owner  = "OpenMusicKontrollers";
-    repo   = pname;
-    rev    = version;
-    sha256 = "0lzdk7hlz3vqgshrfpj0izjad1fmsnzk2vxqrry70xgz8xglvnmn";
-  };
-
-  buildInputs = [ libuv lv2 ];
-  nativeBuildInputs = [ cmake pkg-config ];
-
-  meta = with lib; {
-    description = "OSC injection/ejection from/to UDP/TCP/Serial for LV2";
-    homepage = "https://open-music-kontrollers.ch/lv2/eteroj";
-    license = licenses.artistic2;
-    maintainers = with maintainers; [ magnetophon ];
-  };
-}
--- a/pkgs/applications/audio/lv2lint/default.nix
+++ b/pkgs/applications/audio/lv2lint/default.nix
@ -0,0 +1,22 @@
+{ stdenv, lib, fetchurl, pkg-config, meson, ninja, lv2, lilv, curl, libelf }:
+
+stdenv.mkDerivation rec {
+  pname = "lv2lint";
+  version = "0.14.0";
+
+  src = fetchurl {
+    url = "https://git.open-music-kontrollers.ch/lv2/${pname}/snapshot/${pname}-${version}.tar.xz";
+    sha256 = "sha256-yPKM7RToLNBT+AXSjfxxpncESmv89/wcGCt//pnEGqI=";
+  };
+
+  nativeBuildInputs = [ pkg-config meson ninja ];
+  buildInputs = [ lv2 lilv curl libelf ];
+
+  meta = with lib; {
+    description = "Check whether a given LV2 plugin is up to the specification";
+    homepage = "https://open-music-kontrollers.ch/lv2/${pname}:";
+    license = licenses.artistic2;
+    maintainers = [ maintainers.magnetophon ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/audio/open-music-kontrollers/eteroj.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/eteroj.nix
@ -0,0 +1,10 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "eteroj";
+  version = "0.10.0";
+
+  sha256 = "18iv1sdwm0g6b53shsylj6bf3svmvvy5xadhfsgb4xg39qr07djz";
+
+  description = "OSC injection/ejection from/to UDP/TCP/Serial for LV2";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/generic.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/generic.nix
@ -0,0 +1,37 @@
+{ stdenv, lib, fetchurl, pkg-config, meson, ninja, libGLU, lv2, serd, sord, libX11, libXext, glew, lv2lint
+, pname, version, sha256, description
+, url ? "https://git.open-music-kontrollers.ch/lv2/${pname}.lv2/snapshot/${pname}.lv2-${version}.tar.xz"
+, additionalBuildInputs ? []
+, postPatch ? ""
+, ...
+}:
+
+stdenv.mkDerivation {
+  inherit pname;
+
+  inherit version;
+
+  inherit postPatch;
+
+  src = fetchurl {
+    url = url;
+    sha256 = sha256;
+  };
+  nativeBuildInputs = [ pkg-config meson ninja ];
+  buildInputs = [
+    lv2
+    sord
+    libX11
+    libXext
+    glew
+    lv2lint
+  ] ++ additionalBuildInputs;
+
+  meta = with lib; {
+    description = description;
+    homepage = "https://open-music-kontrollers.ch/lv2/${pname}:";
+    license = licenses.artistic2;
+    maintainers = [ maintainers.magnetophon ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/audio/open-music-kontrollers/jit.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/jit.nix
@ -0,0 +1,12 @@
+{ callPackage, lv2, fontconfig, libvterm-neovim, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "jit";
+  version = "unstable-2021-08-15";
+  url = "https://git.open-music-kontrollers.ch/lv2/${pname}.lv2/snapshot/${pname}.lv2-1f5d6935049fc0dd5a4dc257b84b36d2048f2d83.tar.xz";
+  sha256 = "sha256-XGICowVb0JgLJpn2h9GtViobYTdmo1LJ7/JFEyVsIqU=";
+
+  additionalBuildInputs = [ lv2 fontconfig libvterm-neovim ];
+
+  description = "A Just-in-Time C/Rust compiler embedded in an LV2 plugin";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/mephisto.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/mephisto.nix
@ -0,0 +1,17 @@
+{ callPackage, faust, fontconfig, cmake, libvterm-neovim, libevdev, libglvnd, fira-code, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "mephisto";
+  version = "0.16.0";
+
+  sha256 = "0vgr3rsvdj4w0xpc5iqpvyqilk42wr9zs8bg26sfv3f2wi4hb6gx";
+
+  additionalBuildInputs = [ faust fontconfig cmake libvterm-neovim libevdev libglvnd fira-code ];
+
+  # see: https://github.com/OpenMusicKontrollers/mephisto.lv2/issues/6
+  postPatch = ''
+    sed -i 's/llvm-c-dsp/llvm-dsp-c/g' mephisto.c
+  '';
+
+  description = "A Just-in-time FAUST embedded in an LV2 plugin";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/midi_matrix.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/midi_matrix.nix
@ -0,0 +1,10 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "midi_matrix";
+  version = "0.30.0";
+
+  sha256 = "1nwmfxdzk4pvbwcgi3d7v4flqc10bmi2fxhrhrpfa7cafqs40ib6";
+
+  description = "An LV2 MIDI channel matrix patcher";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/moony.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/moony.nix
@ -0,0 +1,13 @@
+{ callPackage, cairo, libvterm-neovim, robodoc, cmake, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "moony";
+  version = "0.40.0";
+
+  sha256 = "sha256-9a3gR3lV8xFFTDZD+fJPCALVztgmggzyIpsPZCOw/uY=";
+
+  additionalBuildInputs = [ cairo libvterm-neovim robodoc cmake ];
+
+  description = "Realtime Lua as programmable glue in LV2";
+
+})
--- a/pkgs/applications/audio/open-music-kontrollers/orbit.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/orbit.nix
@ -0,0 +1,12 @@
+{ callPackage, zlib, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "orbit";
+  version = "unstable-2021-04-13";
+  url = "https://git.open-music-kontrollers.ch/lv2/${pname}.lv2/snapshot/${pname}.lv2-f4aa620fc8d77418856581a6a955192af15b3860.tar.xz";
+  sha256 = "0z8d8h2w8fb2zx84n697jvy32dc0vf60jyiyh4gm22prgr2dvgkc";
+
+  additionalBuildInputs = [ zlib ];
+
+  description = "An LV2 time event manipulation plugin bundle";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/patchmatrix.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/patchmatrix.nix
@ -0,0 +1,13 @@
+{ callPackage, libjack2, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "patchmatrix";
+  version = "0.26.0";
+
+  url = "https://git.open-music-kontrollers.ch/lad/${pname}/snapshot/${pname}-${version}.tar.xz";
+  sha256 = "sha256-cqPHCnrAhHB6a0xmPUYOAsZfLsqnGpXEuGR1W6i6W7I=";
+
+  additionalBuildInputs = [ libjack2 ];
+
+  description = "A JACK patchbay in flow matrix style";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/router.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/router.nix
@ -0,0 +1,11 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "router";
+  version = "unstable-2021-04-13";
+
+  url = "https://git.open-music-kontrollers.ch/lv2/${pname}.lv2/snapshot/${pname}.lv2-7d754dd64c540d40b828166401617715dc235ca3.tar.xz";
+  sha256 = "sha256-LjaW5Xdxfjzd6IJ2ptHzmHt7fhU1HQo7ubZ4USVqRE8=";
+
+  description = "An atom/audio/CV router LV2 plugin bundle";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/sherlock.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/sherlock.nix
@ -0,0 +1,12 @@
+{ callPackage, sratom, flex, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "sherlock";
+  version = "0.28.0";
+
+  sha256 = "07zj88s1593fpw2s0r3ix7cj2icfd9zyirsyhr2i8l6d30b6n6fb";
+
+  additionalBuildInputs = [ sratom flex ];
+
+  description = "Plugins for visualizing LV2 atom, MIDI and OSC events";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/synthpod.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/synthpod.nix
@ -0,0 +1,13 @@
+{ callPackage, lilv, libjack2, alsa-lib, zita-alsa-pcmi, libxcb, xcbutilxrm, sratom, gtk2, qt5,  libvterm-neovim, robodoc, cmake,... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "synthpod";
+  version = "unstable-2021-10-22";
+
+  url = "https://git.open-music-kontrollers.ch/lv2/synthpod/snapshot/synthpod-6f284bdad882037a522c120af92b96d8abf2de60.tar.xz";
+  sha256 = "sha256-59WBlOKum5Pcmq2CfFfRHCNEa8uPCoBk0kSjFlIcypw=";
+
+  additionalBuildInputs = [ lilv libjack2 alsa-lib zita-alsa-pcmi libxcb xcbutilxrm sratom gtk2 qt5.qtbase qt5.wrapQtAppsHook libvterm-neovim robodoc cmake ];
+
+  description = "Lightweight Nonlinear LV2 Plugin Container";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/vm.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/vm.nix
@ -0,0 +1,10 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "vm";
+  version = "0.14.0";
+
+  sha256 = "013gq7jn556nkk1nq6zzh9nmp3fb36jd7ndzvyq3qryw7khzkagc";
+
+  description = "A programmable virtual machine LV2 plugin";
+})
--- a/pkgs/applications/audio/patchmatrix/default.nix
+++ b/pkgs/applications/audio/patchmatrix/default.nix
@ -1,45 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, libjack2
-, lv2
-, meson
-, ninja
-, pkg-config
-, glew
-, xorg
-}:
-
-stdenv.mkDerivation rec {
-  pname = "patchmatrix";
-  version = "0.26.0";
-
-  src = fetchFromGitHub {
-    owner = "OpenMusicKontrollers";
-    repo = pname;
-    rev = version;
-    hash = "sha256-rR3y5rGzmib//caPmhthvMelAdHRvV0lMRfvcj9kcCg=";
-  };
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    glew
-    libjack2
-    lv2
-    xorg.libX11
-    xorg.libXext
-  ];
-
-  meta = with lib; {
-    description = "A JACK patchbay in flow matrix style";
-    homepage = "https://github.com/OpenMusicKontrollers/patchmatrix";
-    license = licenses.artistic2;
-    maintainers = with maintainers; [ pennae ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "pt2-clone";
-  version = "1.42";
+  version = "1.43";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${version}";
-    sha256 = "sha256-CwnEvQsxrYStJ4RxnE0lHt1fBHQEZrjSldnQnTOPaE0=";
+    sha256 = "sha256-+sHGjgDqizv/9n0dDj8knsl+4MBfO3/pMkmD+MPsuNM=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -8,13 +8,13 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "polkadot";
-  version = "0.9.16";
+  version = "0.9.17";

  src = fetchFromGitHub {
    owner = "paritytech";
    repo = "polkadot";
    rev = "v${version}";
-    sha256 = "sha256-NXuYUmo80rrBZCcuISKon48SKyyJrkzCEhggxaJNfBM=";
+    sha256 = "sha256-m47Y4IXGc43XLs5d6ehlD0A53BWC5kO3K2BS/xbYgl8=";

    # see the comment below on fakeGit for how this is used
    leaveDotGit = true;
@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
    '';
  };

-  cargoSha256 = "sha256-PIORMTzQbMdlrKwuF4MiGrLlg2nQpgLRsaHHeiCbqrg=";
+  cargoSha256 = "sha256-JBacioy2woAfKQuK6tXU9as4DNc+3uY3F3GWksCf6WU=";

  nativeBuildInputs =
    let
--- a/pkgs/applications/emulators/vice/default.nix
+++ b/pkgs/applications/emulators/vice/default.nix
@ -23,6 +23,108 @@
 , file
 }:

+let
+  desktopItems = [
+    (makeDesktopItem {
+      name = "x128";
+      exec = "x128";
+      comment = "VICE: C128 Emulator";
+      desktopName = "VICE: C128 Emulator";
+      genericName = "Commodore 128 emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "x64";
+      exec = "x64";
+      comment = "VICE: C64 Emulator";
+      desktopName = "VICE: C64 Emulator";
+      genericName = "Commodore 64 emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "x64dtv";
+      exec = "x64dtv";
+      comment = "VICE: C64 DTV Emulator";
+      desktopName = "VICE: C64 DTV Emulator";
+      genericName = "Commodore 64 DTV emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "x64sc";
+      exec = "x64sc";
+      comment = "VICE: C64 SC Emulator";
+      desktopName = "VICE: C64 SC Emulator";
+      genericName = "Commodore 64 SC emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xcbm2";
+      exec = "xcbm2";
+      comment = "VICE: CBM-II B-Model Emulator";
+      desktopName = "VICE: CBM-II B-Model Emulator";
+      genericName = "CBM-II B-Model Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xcbm5x0";
+      exec = "xcbm5x0";
+      comment = "VICE: CBM-II P-Model Emulator";
+      desktopName = "VICE: CBM-II P-Model Emulator";
+      genericName = "CBM-II P-Model Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xpet";
+      exec = "xpet";
+      comment = "VICE: PET Emulator";
+      desktopName = "VICE: PET Emulator";
+      genericName = "Commodore PET Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xplus4";
+      exec = "xplus4";
+      comment = "VICE: PLUS4 Emulator";
+      desktopName = "VICE: PLUS4 Emulator";
+      genericName = "Commodore PLUS4 Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xscpu64";
+      exec = "xscpu64";
+      comment = "VICE: SCPU64 Emulator";
+      desktopName = "VICE: SCPU64 Emulator";
+      genericName = "Commodore SCPU64 Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xvic";
+      exec = "xvic";
+      comment = "VICE: VIC-20 Emulator";
+      desktopName = "VICE: VIC-20 Emulator";
+      genericName = "Commodore VIC-20 Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "vsid";
+      exec = "vsid";
+      comment = "VSID: The SID Emulator";
+      desktopName = "VSID: The SID Emulator";
+      genericName = "SID Emulator";
+      categories = [ "System" ];
+    })
+  ];
+in
 stdenv.mkDerivation rec {
  pname = "vice";
  version = "3.6.1";
@ -59,15 +161,6 @@ stdenv.mkDerivation rec {
  dontDisableStatic = true;
  configureFlags = [ "--enable-fullscreen" "--enable-gnomeui" "--disable-pdf-docs" ];

-  desktopItem = makeDesktopItem {
-    name = "vice";
-    exec = "x64";
-    comment = "Commodore 64 emulator";
-    desktopName = "VICE";
-    genericName = "Commodore 64 emulator";
-    categories = [ "Emulator" ];
-  };
-
  preBuild = ''
    for i in src/resid src/resid-dtv
    do
@ -77,12 +170,15 @@ stdenv.mkDerivation rec {
  '';

  postInstall = ''
-    mkdir -p $out/share/applications
-    cp ${desktopItem}/share/applications/* $out/share/applications
+    for app in ${toString desktopItems}
+    do
+        mkdir -p $out/share/applications
+        cp $app/share/applications/* $out/share/applications
+    done
  '';

  meta = {
-    description = "Commodore 64, 128 and other emulators";
+    description = "Emulators for a variety of 8-bit Commodore computers";
    homepage = "https://vice-emu.sourceforge.io/";
    license = lib.licenses.gpl2Plus;
    maintainers = [ lib.maintainers.sander ];
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@ -46,9 +46,9 @@ in rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the SHA256 for staging as well.
-    version = "7.2";
+    version = "7.4";
    url = "https://dl.winehq.org/wine/source/7.x/wine-${version}.tar.xz";
-    sha256 = "sha256-38ZBUjyNvGZBaLYXREFjPZcSdUVr9n3i3KqZyNql7hU=";
+    sha256 = "sha256-co6GbW5JzpKioMUUMz6f8Ivb9shvXvTmGAFDuNK31BY=";
    inherit (stable) gecko32 gecko64 patches;

    mono = fetchurl rec {
@ -61,7 +61,7 @@ in rec {
  staging = fetchFromGitHub rec {
    # https://github.com/wine-staging/wine-staging/releases
    inherit (unstable) version;
-    sha256 = "sha256-Ec9rienlsDg+2QkJqPrGorDb5NycG1/iGWhnqLZOrwg=";
+    sha256 = "0vlj3b8bnidyhlgkjrnlbah3878zjy3s557vbp16qka42zjaa51q";
    owner = "wine-staging";
    repo = "wine-staging";
    rev = "v${version}";
--- a/pkgs/applications/emulators/wine/vkd3d.nix
+++ b/pkgs/applications/emulators/wine/vkd3d.nix
@ -1,16 +1,18 @@
-{ lib, stdenv, fetchurl, moltenvk, vulkan-headers, spirv-headers, vulkan-loader }:
+{ lib, stdenv, fetchurl, moltenvk, vulkan-headers, spirv-headers, vulkan-loader, flex, bison }:

 #TODO: unstable

 stdenv.mkDerivation rec {
  pname = "vkd3d";
-  version = "1.2";
+  version = "1.3";

  src = fetchurl {
    url = "https://dl.winehq.org/vkd3d/source/vkd3d-${version}.tar.xz";
-    sha256 = "0szr1lw3xbgi9qjm13d1q4gyzzwv8i5wfxiwjg6dmwphrc7h6jxh";
+    sha256 = "134b347806d34a4d2b39ea29ff1c2b38443793803a3adc50800855bb929fb8b2";
  };

+  nativeBuildInputs = [ flex bison ];
+
  buildInputs = [ vulkan-headers spirv-headers ]
    ++ [ (if stdenv.isDarwin then moltenvk else vulkan-loader) ];

--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -10,18 +10,19 @@

 python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "474";
+  version = "477";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    rev = "v${version}";
-    sha256 = "sha256-NeTHq8zlgBajw/eogwpabqeU0b7cp83Frqy6kisrths=";
+    sha256 = "sha256-/Gehlk+eMBPA+OT7xsTri6PDi2PBmzjckMVbqPGXT64=";
  };

  nativeBuildInputs = [
    wrapQtAppsHook
+    python3Packages.mkdocs-material
  ];

  propagatedBuildInputs = with python3Packages; [
@ -85,6 +86,7 @@ python3Packages.buildPythonPackage rec {
    # Move the hydrus module and related directories
    mkdir -p $out/${python3Packages.python.sitePackages}
    mv {hydrus,static} $out/${python3Packages.python.sitePackages}
+    mkdocs build -d help
    mv help $out/doc/

    # install the hydrus binaries
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -1,11 +1,11 @@
 { config, stdenv, lib, fetchurl, fetchzip, boost, cmake, ffmpeg, gettext, glew
 , ilmbase, libXi, libX11, libXext, libXrender
 , libjpeg, libpng, libsamplerate, libsndfile
-, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimagedenoise, openimageio2, openjpeg, python39Packages
+, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimagedenoise, openimageio2, openjpeg, python310Packages
 , openvdb, libXxf86vm, tbb, alembic
-, zlib, fftw, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
+, zlib, zstd, fftw, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
 , jackaudioSupport ? false, libjack2
-, cudaSupport ? config.cudaSupport or false, cudatoolkit
+, cudaSupport ? config.cudaSupport or false, cudatoolkit_11
 , colladaSupport ? true, opencollada
 , spaceNavSupport ? stdenv.isLinux, libspnav
 , makeWrapper
@ -17,30 +17,31 @@

 with lib;
 let
-  python = python39Packages.python;
+  python = python310Packages.python;
  optix = fetchzip {
-    url = "https://developer.download.nvidia.com/redist/optix/v7.0/OptiX-7.0.0-include.zip";
-    sha256 = "1b3ccd3197anya2bj3psxdrvrpfgiwva5zfv2xmyrl73nb2dvfr7";
+    # url taken from the archlinux blender PKGBUILD
+    url = "https://developer.download.nvidia.com/redist/optix/v7.3/OptiX-7.3.0-Include.zip";
+    sha256 = "0max1j4822mchj0xpz9lqzh91zkmvsn4py0r174cvqfz8z8ykjk8";
  };

 in
 stdenv.mkDerivation rec {
  pname = "blender";
-  version = "2.93.5";
+  version = "3.1.0";

  src = fetchurl {
    url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    sha256 = "1fsw8w80h8k5w4zmy659bjlzqyn5i198hi1kbpzfrdn8psxg2bfj";
+    sha256 = "1d0476bzcz86lwdnyjn7hyzkmhfiqh47ls5h09jlbm7v7k9x69hw";
  };

  patches = lib.optional stdenv.isDarwin ./darwin.patch;

-  nativeBuildInputs = [ cmake makeWrapper python39Packages.wrapPython llvmPackages.llvm.dev ]
+  nativeBuildInputs = [ cmake makeWrapper python310Packages.wrapPython llvmPackages.llvm.dev ]
    ++ optionals cudaSupport [ addOpenGLRunpath ];
  buildInputs =
    [ boost ffmpeg gettext glew ilmbase
      freetype libjpeg libpng libsamplerate libsndfile libtiff
-      opencolorio openexr openimagedenoise openimageio2 openjpeg python zlib fftw jemalloc
+      opencolorio openexr openimagedenoise openimageio2 openjpeg python zlib zstd fftw jemalloc
      alembic
      (opensubdiv.override { inherit cudaSupport; })
      tbb
@ -62,10 +63,10 @@ stdenv.mkDerivation rec {
      llvmPackages.openmp SDL Cocoa CoreGraphics ForceFeedback OpenAL OpenGL
    ])
    ++ optional jackaudioSupport libjack2
-    ++ optional cudaSupport cudatoolkit
+    ++ optional cudaSupport cudatoolkit_11
    ++ optional colladaSupport opencollada
    ++ optional spaceNavSupport libspnav;
-  pythonPath = with python39Packages; [ numpy requests ];
+  pythonPath = with python310Packages; [ numpy requests ];

  postPatch = ''
    # allow usage of dynamically linked embree
@ -84,7 +85,7 @@ stdenv.mkDerivation rec {
        --replace '${"$"}{LIBDIR}/opencollada' \
                  '${opencollada}' \
        --replace '${"$"}{PYTHON_LIBPATH}/site-packages/numpy' \
-                  '${python39Packages.numpy}/${python.sitePackages}/numpy'
+                  '${python310Packages.numpy}/${python.sitePackages}/numpy'
    '' else ''
      substituteInPlace extern/clew/src/clew.c --replace '"libOpenCL.so"' '"${ocl-icd}/lib/libOpenCL.so"'
    '');
@ -106,8 +107,8 @@ stdenv.mkDerivation rec {
      "-DPYTHON_VERSION=${python.pythonVersion}"
      "-DWITH_PYTHON_INSTALL=OFF"
      "-DWITH_PYTHON_INSTALL_NUMPY=OFF"
-      "-DPYTHON_NUMPY_PATH=${python39Packages.numpy}/${python.sitePackages}"
-      "-DPYTHON_NUMPY_INCLUDE_DIRS=${python39Packages.numpy}/${python.sitePackages}/numpy/core/include"
+      "-DPYTHON_NUMPY_PATH=${python310Packages.numpy}/${python.sitePackages}"
+      "-DPYTHON_NUMPY_INCLUDE_DIRS=${python310Packages.numpy}/${python.sitePackages}/numpy/core/include"
      "-DWITH_PYTHON_INSTALL_REQUESTS=OFF"
      "-DWITH_OPENVDB=ON"
      "-DWITH_TBB=ON"
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -6,7 +6,7 @@
 , dbus
 , dbus-glib
 , desktop-file-utils
-, fetchzip
+, fetchFromGitea
 , ffmpeg
 , fontconfig
 , freetype
@ -44,12 +44,15 @@ assert with lib.strings; (

 stdenv.mkDerivation rec {
  pname = "palemoon";
-  version = "29.4.4";
+  version = "30.0.0";

-  src = fetchzip {
-    name = "${pname}-${version}";
-    url = "http://archive.palemoon.org/source/${pname}-${version}.source.tar.xz";
-    sha256 = "sha256-0R0IJd4rd7NqnxQxkHSx10cNlwECqpKgJnlfYAMx4wc=";
+  src = fetchFromGitea {
+    domain = "repo.palemoon.org";
+    owner = "MoonchildProductions";
+    repo = "Pale-Moon";
+    rev = "${version}_Release";
+    fetchSubmodules = true;
+    sha256 = "02qdw8b7hphphc66m3m14r4pmcfiq2c5z4jcscm2nymy18ycb10f";
  };

  nativeBuildInputs = [
@ -137,24 +140,15 @@ stdenv.mkDerivation rec {

    ./mach install

-    # Fix missing icon due to wrong WMClass
-    # https://forum.palemoon.org/viewtopic.php?f=3&t=26746&p=214221#p214221
-    substituteInPlace ./palemoon/branding/official/palemoon.desktop \
-      --replace 'StartupWMClass="pale moon"' 'StartupWMClass=Pale moon'
+    # Install official branding stuff (desktop file & icons)
    desktop-file-install --dir=$out/share/applications \
-      ./palemoon/branding/official/palemoon.desktop
-
-    # Install official branding icons
+      ./other-licenses/branding/palemoon/official/palemoon.desktop
    for iconname in default{16,22,24,32,48,256} mozicon128; do
      n=''${iconname//[^0-9]/}
      size=$n"x"$n
-      install -Dm644 ./palemoon/branding/official/$iconname.png $out/share/icons/hicolor/$size/apps/palemoon.png
+      install -Dm644 ./other-licenses/branding/palemoon/official/$iconname.png $out/share/icons/hicolor/$size/apps/palemoon.png
    done

-    # Remove unneeded SDK data from installation
-    # https://forum.palemoon.org/viewtopic.php?f=37&t=26796&p=214676#p214729
-    rm -rf $out/{include,share/idl,lib/palemoon-devel-${version}}
-
    runHook postInstall
  '';

--- a/pkgs/applications/networking/browsers/palemoon/mozconfig
+++ b/pkgs/applications/networking/browsers/palemoon/mozconfig
@ -12,7 +12,7 @@ _BUILD_64=@build64@
 _GTK_VERSION=@gtkversion@

 # Standard build options for Pale Moon
-ac_add_options --enable-application=palemoon
+ac_add_options --enable-application=browser
 ac_add_options --enable-optimize="-O2 -w"
 ac_add_options --enable-default-toolkit=cairo-gtk$_GTK_VERSION
 ac_add_options --enable-jemalloc
@ -20,8 +20,6 @@ ac_add_options --enable-strip
 ac_add_options --enable-devtools
 ac_add_options --enable-av1

-ac_add_options --disable-eme
-ac_add_options --disable-webrtc
 ac_add_options --disable-gamepad
 ac_add_options --disable-tests
 ac_add_options --disable-debug
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -40,8 +40,13 @@ buildGoModule rec {
        ${rcloneBin}/bin/rclone genautocomplete $shell rclone.$shell
        installShellCompletion rclone.$shell
      done
-    '' + lib.optionalString (enableCmount && !stdenv.isDarwin) ''
-      wrapProgram $out/bin/rclone --prefix LD_LIBRARY_PATH : "${fuse}/lib"
+    '' + lib.optionalString (enableCmount && !stdenv.isDarwin)
+      # use --suffix here to ensure we don't shadow /run/wrappers/bin/fusermount,
+      # as the setuid wrapper is required as non-root on NixOS.
+      ''
+      wrapProgram $out/bin/rclone \
+                  --suffix PATH : "${lib.makeBinPath [ fuse ] }" \
+                  --prefix LD_LIBRARY_PATH : "${fuse}/lib"
    '';

  meta = with lib; {
--- a/pkgs/applications/version-management/meld/default.nix
+++ b/pkgs/applications/version-management/meld/default.nix
@ -1,5 +1,6 @@
 { lib
 , fetchurl
+, fetchpatch
 , gettext
 , itstool
 , python3
@ -27,6 +28,16 @@ python3.pkgs.buildPythonApplication rec {
    sha256 = "cP6Y65Ms4h1nFw47D2pzF+gT6GLemJM+pROYLpoDMgI=";
  };

+  patches = [
+    # Pull upstream fix for meson-0.60:
+    #  https://gitlab.gnome.org/GNOME/meld/-/merge_requests/78
+    (fetchpatch {
+      name = "meson-0.60.patch";
+      url  = "https://gitlab.gnome.org/GNOME/meld/-/commit/cc7746c141d976a4779cf868774fae1fe7627a6d.patch";
+      sha256 = "sha256-4uJZyF00Z6svzrOebByZV1hutCZRkIQYC4rUxQr5fdQ=";
+    })
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/applications/virtualization/singularity/default.nix
+++ b/pkgs/applications/virtualization/singularity/default.nix
@ -15,11 +15,11 @@ with lib;

 buildGoPackage rec {
  pname = "singularity";
-  version = "3.8.6";
+  version = "3.8.7";

  src = fetchurl {
    url = "https://github.com/hpcng/singularity/releases/download/v${version}/singularity-${version}.tar.gz";
-    sha256 = "sha256-u1o7dnCsnHpLPOWyyfPWtb5g4hsI0zjJ39q7eyqZ9Sg=";
+    sha256 = "sha256-Myny5YP4SoNDyywDgKHWy86vrn0eYztcvK33FD6shZs=";
  };

  goPackagePath = "github.com/sylabs/singularity";
--- a/pkgs/applications/window-managers/i3/wsr.nix
+++ b/pkgs/applications/window-managers/i3/wsr.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "i3wsr";
-  version = "2.0.1";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "roosta";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-JzQWfC0kmnMArpIAE5fgb3YLmXktSCH5aUdrQH9pCbo=";
+    sha256 = "sha256-mwPU700eqyFYihWP1m3y56zXnX16sjSNzB6XNlCttBU=";
  };

-  cargoSha256 = "sha256-ZvSdJLaw1nfaqpTBKIiHiXvNFSZhsmLk0PBrV6ykv/w=";
+  cargoSha256 = "sha256-f0Yby/2g7apkqx0iCcd/QkQgMVYZDUQ1vWw8RCXQ9Z4=";

  nativeBuildInputs = [ python3 ];
  buildInputs = [ libxcb ];
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@ -384,6 +384,18 @@ in package-set { inherit pkgs lib callPackage; } self // {
        # for the "shellFor" environment (ensuring that any test/benchmark
        # dependencies for "foo" will be available within the nix-shell).
      , genericBuilderArgsModifier ? (args: args)
+
+        # Extra dependencies, in the form of cabal2nix build attributes.
+        #
+        # An example use case is when you have Haskell scripts that use
+        # libraries that don't occur in your packages' dependencies.
+        #
+        # Example:
+        #
+        #   extraDependencies = p: {
+        #     libraryHaskellDepends = [ p.releaser ];
+        #   };
+      , extraDependencies ? p: {}
      , ...
      } @ args:
      let
@ -474,7 +486,7 @@ in package-set { inherit pkgs lib callPackage; } self // {
        # See the Note in `zipperCombinedPkgs` for what gets filtered out from
        # each of these dependency lists.
        packageInputs =
-          pkgs.lib.zipAttrsWith (_name: zipperCombinedPkgs) cabalDepsForSelected;
+          pkgs.lib.zipAttrsWith (_name: zipperCombinedPkgs) (cabalDepsForSelected ++ [ (extraDependencies self) ]);

        # A attribute set to pass to `haskellPackages.mkDerivation`.
        #
@ -514,7 +526,7 @@ in package-set { inherit pkgs lib callPackage; } self // {
        # pkgWithCombinedDepsDevDrv :: Derivation
        pkgWithCombinedDepsDevDrv = pkgWithCombinedDeps.envFunc { inherit withHoogle; };

-        mkDerivationArgs = builtins.removeAttrs args [ "genericBuilderArgsModifier" "packages" "withHoogle" "doBenchmark" ];
+        mkDerivationArgs = builtins.removeAttrs args [ "genericBuilderArgsModifier" "packages" "withHoogle" "doBenchmark" "extraDependencies" ];

      in pkgWithCombinedDepsDevDrv.overrideAttrs (old: mkDerivationArgs // {
        nativeBuildInputs = old.nativeBuildInputs ++ mkDerivationArgs.nativeBuildInputs or [];
--- a/pkgs/development/python-modules/aioridwell/default.nix
+++ b/pkgs/development/python-modules/aioridwell/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "aioridwell";
-  version = "2021.12.2";
+  version = "2022.03.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "bachya";
    repo = pname;
    rev = version;
-    sha256 = "sha256-QFUXWleHRMBgaRsMNt2xFb3XcbCNI2kKQHKCBrUuG6Q=";
+    hash = "sha256-UiHT1YbBb9UTughVw2oJxRtvhUDVqQWqEcXMEXwy2cI=";
  };

  nativeBuildInputs = [
@ -49,12 +49,6 @@ buildPythonPackage rec {
    types-pytz
  ];

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'titlecase = "^2.3"' 'titlecase = "*"' \
-      --replace 'pytz = "^2021.3"' 'pytz = "*"'
-  '';
-
  disabledTests = [
    # AssertionError: assert datetime.date(...
    "test_get_next_pickup_event"
--- a/pkgs/development/python-modules/azure-core/default.nix
+++ b/pkgs/development/python-modules/azure-core/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
+{ lib, stdenv, buildPythonPackage, fetchPypi, isPy27
 , aiodns
 , aiohttp
 , flask
@ -51,7 +51,18 @@ buildPythonPackage rec {

  pytestFlagsArray = [ "tests/" ];
  # disable tests which touch network
-  disabledTests = [ "aiohttp" "multipart_send" "response" "request" "timeout" ];
+  disabledTests = [
+    "aiohttp"
+    "multipart_send"
+    "response"
+    "request"
+    "timeout"
+  # disable 8 tests failing on some darwin machines with errors:
+  # azure.core.polling.base_polling.BadStatus: Invalid return status 403 for 'GET' operation
+  # azure.core.exceptions.HttpResponseError: Operation returned an invalid status 'Forbidden'
+  ] ++ lib.optional stdenv.isDarwin [
+    "location_polling_fail"
+  ];
  disabledTestPaths = [
    # requires testing modules which aren't published, and likely to create cyclic dependencies
    "tests/test_connection_string_parsing.py"
--- a/pkgs/development/python-modules/elementpath/default.nix
+++ b/pkgs/development/python-modules/elementpath/default.nix
@ -6,7 +6,7 @@

 buildPythonPackage rec {
  pname = "elementpath";
-  version = "2.4.0";
+  version = "2.5.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -15,7 +15,7 @@ buildPythonPackage rec {
    owner = "sissaschool";
    repo = "elementpath";
    rev = "v${version}";
-    sha256 = "1f3w5zyvrkl4gab81i5z9b41ybs54b37znj5r7hrcf25x8hrqgvv";
+    sha256 = "sha256-I2Vg0rpCFH1Z+N+JgtDv2se6lXsggzOsJn3Fj252aTQ=";
  };

  # avoid circular dependency with xmlschema which directly depends on this
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "hahomematic";
-  version = "0.37.7";
+  version = "0.38.2";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "danielperna84";
    repo = pname;
    rev = version;
-    sha256 = "sha256-rVtXfoQ/1GAc6ugT/jduoMacCDjrlGagWhK1rYgl/1Q=";
+    sha256 = "sha256-oyO4+zxyhr2azUdeNfw0WjgN6LFxi3+svJ/B/tUEqjQ=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/invoke/default.nix
+++ b/pkgs/development/python-modules/invoke/default.nix
@ -2,15 +2,19 @@
 , bash
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "invoke";
-  version = "1.6.0";
+  version = "1.7.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "374d1e2ecf78981da94bfaf95366216aaec27c2d6a7b7d5818d92da55aa258d3";
+    hash = "sha256-4zLkneQEY/IBYxX1HfQjE4VXcr6GQ1aGFWvBj0W1zGw=";
  };

  patchPhase = ''
@ -20,8 +24,14 @@ buildPythonPackage rec {
  # errors with vendored libs
  doCheck = false;

-  meta = {
+  pythonImportsCheck = [
+    "invoke"
+  ];
+
+  meta = with lib; {
    description = "Pythonic task execution";
-    license = lib.licenses.bsd2;
+    homepage = "https://www.pyinvoke.org/";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/limnoria/default.nix
+++ b/pkgs/development/python-modules/limnoria/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "limnoria";
-  version = "2022.2.3";
+  version = "2022.3.17";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Jc11hS+WrRnjgYOUpc+GdkRoNV/DUJhQK6rI2lUkEIA=";
+    hash = "sha256-sSZFbEDlkc+F0PIwvseVEBoQQZVTFypW2nvLmPDD4u0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mkdocs-material/default.nix
+++ b/pkgs/development/python-modules/mkdocs-material/default.nix
@ -0,0 +1,41 @@
+{ lib, callPackage, buildPythonApplication, fetchFromGitHub
+, jinja2
+, markdown
+, mkdocs
+, mkdocs-material-extensions
+, pygments
+, pymdown-extensions
+}:
+
+buildPythonApplication rec {
+  pname = "mkdocs-material";
+  version = "8.2.5";
+
+  src = fetchFromGitHub {
+    owner = "squidfunk";
+    repo = pname;
+    rev = version;
+    sha256 = "0v30x2cgc5i307p0hsy5h58pfd8w6xpnvimsb75614xlmx3ycaqd";
+  };
+
+  propagatedBuildInputs = [
+    jinja2
+    markdown
+    mkdocs
+    mkdocs-material-extensions
+    pygments
+    pymdown-extensions
+  ];
+
+  # No tests for python
+  doCheck = false;
+
+  pythonImportsCheck = [ "mkdocs" ];
+
+  meta = with lib; {
+    description = "Material for mkdocs";
+    homepage = "https://squidfunk.github.io/mkdocs-material/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
--- a/pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix
+++ b/pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix
@ -0,0 +1,24 @@
+{ lib, fetchFromGitHub, buildPythonPackage }:
+
+buildPythonPackage rec {
+  pname = "mkdocs-material-extensions";
+  version = "1.0.3";
+
+  src = fetchFromGitHub {
+    owner = "facelessuser";
+    repo = pname;
+    rev = version;
+    sha256 = "1mvc13lz16apnli2qcqf0dvlm8mshy47jmz2vp72lja6x8jfq2p3";
+  };
+
+  doCheck = false; # Circular dependency
+
+  pythonImportsCheck = [ "materialx" ];
+
+  meta = with lib; {
+    description = "Markdown extension resources for MkDocs Material";
+    homepage = "https://github.com/facelessuser/mkdocs-material-extensions";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
--- a/pkgs/development/python-modules/pyaussiebb/default.nix
+++ b/pkgs/development/python-modules/pyaussiebb/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pyaussiebb";
-  version = "0.0.13";
+  version = "0.0.14";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "yaleman";
    repo = "aussiebb";
    rev = "v${version}";
-    hash = "sha256-8DX7GwSnpiqUO20a6oLMMTkpTUxWTb8LMD4Uk0lyAOY=";
+    hash = "sha256-Z+xLCKnUnBAH9nm0YR11zx1lyNrIb8BZLFmaZdpnfdw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/qiling/default.nix
+++ b/pkgs/development/python-modules/qiling/default.nix
@ -8,6 +8,7 @@
 , multiprocess
 , pefile
 , pyelftools
+, pythonOlder
 , python-registry
 , pyyaml
 , unicorn
@ -15,12 +16,14 @@

 buildPythonPackage rec {
  pname = "qiling";
-  version = "1.4.1";
+  version = "1.4.2";
  format = "setuptools";

+  disabled = pythonOlder "3.7";
+
  src = fetchPypi {
    inherit pname version;
-    sha256 = "e72dc5856cbda975f962ddf063063a32bd6c3b825f75e0795e94ba6840a7d45f";
+    hash = "sha256-myUGzNP4bf90d2gY5ZlYbVlTG640dj/Qha8/aMydvuw=";
  };

  propagatedBuildInputs = [
@ -35,11 +38,6 @@ buildPythonPackage rec {
    unicorn
  ];

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "pefile==2021.5.24" "pefile>=2021.5.24"
-  '';
-
  # Tests are broken (attempt to import a file that tells you not to import it,
  # amongst other things)
  doCheck = false;
--- a/pkgs/development/tools/allure/default.nix
+++ b/pkgs/development/tools/allure/default.nix
@ -0,0 +1,39 @@
+{ lib, stdenv, makeWrapper, fetchurl, jre }:
+
+let
+  pname = "allure";
+  version = "2.17.3";
+in
+stdenv.mkDerivation rec {
+  inherit pname version;
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ jre ];
+
+  src = fetchurl {
+    url = "https://github.com/allure-framework/allure2/releases/download/${version}/allure-${version}.tgz";
+    sha256 = "sha256-WGeCzWwyLEb4WmlA6Vs8L2TL3NTL6sky5TLeiwV8iJY=";
+  };
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p "$out/share"
+    cd "$out/share"
+    tar xvzf $src
+    mkdir -p "$out/bin"
+    makeWrapper $out/share/${pname}-${version}/bin/allure $out/bin/${pname} \
+      --prefix PATH : "${jre}/bin"
+  '';
+
+  dontCheck = true;
+
+  meta = with lib; {
+    homepage = "https://docs.qameta.io/allure/";
+    description = "Allure Report is a flexible, lightweight multi-language test reporting tool.";
+    longDescription = "Allure Report is a flexible, lightweight multi-language test reporting tool. It provides clear graphical reports and allows everyone involved in the development process to extract the maximum of information from the everyday testing process";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ happysalada ];
+  };
+}
+
--- a/pkgs/development/tools/rover/default.nix
+++ b/pkgs/development/tools/rover/default.nix
@ -0,0 +1,56 @@
+{ lib
+, callPackage
+, fetchFromGitHub
+, perl
+, rustPlatform
+, librusty_v8 ? callPackage ./librusty_v8.nix { }
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rover";
+  version = "0.4.8";
+
+  src = fetchFromGitHub {
+    owner = "apollographql";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-9o2bGa9vxN7EprKgsy9TI7AFmwjo1OT1pDyiLierTq0=";
+  };
+
+  cargoSha256 = "sha256-4oNuyZ1xNK2jP9QFEcthCjEQRyvFykd5N0j5KCXrzVY=";
+
+  # The v8 package will try to download a `librusty_v8.a` release at build time
+  # to our read-only filesystem. To avoid this we pre-download the file and
+  # export it via RUSTY_V8_ARCHIVE
+  RUSTY_V8_ARCHIVE = librusty_v8;
+
+  nativeBuildInputs = [
+    perl
+  ];
+
+  # The rover-client's build script (crates/rover-client/build.rs) will try to
+  # download the API's graphql schema at build time to our read-only filesystem.
+  # To avoid this we pre-download it to a location the build script checks.
+  preBuild = ''
+    mkdir crates/rover-client/.schema
+    cp ${./schema}/etag.id        crates/rover-client/.schema/
+    cp ${./schema}/schema.graphql crates/rover-client/.schema/
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  # Some tests try to write configuration data to a location in the user's home
+  # directory. Since this would be /homeless-shelter during the build, point at
+  # a writeable location instead.
+  preCheck = ''
+    export APOLLO_CONFIG_HOME="$PWD"
+  '';
+
+  meta = with lib; {
+    description = "A CLI for managing and maintaining graphs with Apollo Studio";
+    homepage = "https://www.apollographql.com/docs/rover";
+    license = licenses.mit;
+    maintainers = [ maintainers.ivanbrennan ];
+    platforms = ["x86_64-linux"];
+  };
+}
--- a/pkgs/development/tools/rover/librusty_v8.nix
+++ b/pkgs/development/tools/rover/librusty_v8.nix
@ -0,0 +1,17 @@
+{ rust, stdenv, fetchurl }:
+
+let
+  arch = rust.toRustTarget stdenv.hostPlatform;
+  fetch_librusty_v8 = args: fetchurl {
+    name = "librusty_v8-${args.version}";
+    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${arch}.a";
+    sha256 = args.shas.${stdenv.hostPlatform.system};
+    meta = { inherit (args) version; };
+  };
+in
+fetch_librusty_v8 {
+  version = "0.38.1";
+  shas = {
+    x86_64-linux = "sha256-vRkb5ZrIOYSKa84UbsJD+Oua0wve7f1Yf3kMg/kkYSY=";
+  };
+}
--- a/pkgs/development/tools/rover/schema/etag.id
+++ b/pkgs/development/tools/rover/schema/etag.id
@ -0,0 +1 @@
+1bdcf8916afc3cea660add457724dddd70154904f4e360e15da27fa7d5c43cd0
--- a/pkgs/development/tools/rover/schema/schema.graphql
+++ b/pkgs/development/tools/rover/schema/schema.graphql
--- a/pkgs/development/tools/rover/update.sh
+++ b/pkgs/development/tools/rover/update.sh
@ -0,0 +1,96 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnugrep gnused jq nix-prefetch
+
+set -eu -o pipefail
+
+dirname=$(realpath "$(dirname "$0")")
+nixpkgs=$(realpath "${dirname}/../../../..")
+
+old_rover_version=$(nix eval --raw -f "$nixpkgs" rover.version)
+rover_url=https://api.github.com/repos/apollographql/rover/releases/latest
+rover_tag=$(curl "$rover_url" | jq --raw-output ".tag_name")
+rover_version="$(expr "$rover_tag" : 'v\(.*\)')"
+
+if [[ "$old_rover_version" == "$rover_version" ]]; then
+    echo "rover is up-to-date: ${old_rover_version}"
+    exit 0
+fi
+
+echo "Fetching rover"
+rover_tar_url="https://github.com/apollographql/rover/archive/refs/tags/${rover_tag}.tar.gz"
+{
+    read rover_hash
+    read repo
+} < <(nix-prefetch-url "$rover_tar_url" --unpack --type sha256 --print-path)
+
+# Convert hash to SRI representation
+rover_sri_hash=$(nix hash to-sri --type sha256 "$rover_hash")
+
+# Identify librusty version and hash
+librusty_version=$(
+    sed --quiet '/^name = "v8"$/{n;p}' "${repo}/Cargo.lock" \
+        | grep --only-matching --perl-regexp '^version = "\K[^"]+'
+)
+librusty_arch=x86_64-unknown-linux-gnu
+librusty_url="https://github.com/denoland/rusty_v8/releases/download/v${librusty_version}/librusty_v8_release_${librusty_arch}.a"
+echo "Fetching librusty"
+librusty_hash=$(nix-prefetch-url "$librusty_url" --type sha256)
+librusty_sri_hash=$(nix hash to-sri --type sha256 "$librusty_hash")
+
+# Update rover version.
+sed --in-place \
+    "s|version = \"[0-9.]*\"|version = \"$rover_version\"|" \
+    "$dirname/default.nix"
+
+# Update rover hash.
+sed --in-place \
+    "s|sha256 = \"[a-zA-Z0-9\/+-=]*\"|sha256 = \"$rover_sri_hash\"|" \
+    "$dirname/default.nix"
+
+# Clear cargoSha256.
+sed --in-place \
+    "s|cargoSha256 = \".*\"|cargoSha256 = \"sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\"|" \
+    "$dirname/default.nix"
+
+# Update cargoSha256
+echo "Computing cargoSha256"
+cargoSha256=$(
+    nix-prefetch "{ sha256 }: (import $nixpkgs {}).rover.cargoDeps.overrideAttrs (_: { outputHash = sha256; })"
+)
+sed --in-place \
+    "s|cargoSha256 = \".*\"|cargoSha256 = \"$cargoSha256\"|" \
+    "$dirname/default.nix"
+
+# Update librusty version
+sed --in-place \
+    "s|version = \"[0-9.]*\"|version = \"$librusty_version\"|" \
+    "$dirname/librusty_v8.nix"
+
+# Update librusty hash
+sed --in-place \
+    "s|x86_64-linux = \"[^\"]*\"|x86_64-linux = \"$librusty_sri_hash\"|" \
+    "$dirname/librusty_v8.nix"
+
+# Update apollo api schema info
+response="$(mktemp)"
+schemaUrl=https://graphql.api.apollographql.com/api/schema
+
+mkdir -p "$dirname"/schema
+
+# Fetch schema info
+echo "Fetching Apollo GraphQL schema"
+# include response headers, and append terminating newline to response body
+curl --include --write-out "\n" "$schemaUrl" > "$response"
+
+# Parse response headers and write the etag to schema/etag.id
+grep \
+    --max-count=1 \
+    --only-matching \
+    --perl-regexp \
+    '^etag: \K\S*' \
+    "$response" \
+    > "$dirname"/schema/etag.id
+
+# Discard headers and blank line (terminated by carriage return), and write the
+# response body to schema/schema.graphql
+sed '1,/^\r/d' "$response" > "$dirname"/schema/schema.graphql
--- a/pkgs/development/tools/wrangler/default.nix
+++ b/pkgs/development/tools/wrangler/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "wrangler";
-  version = "1.19.8";
+  version = "1.19.9";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-vJjAN7RmB1J4k7p2emfbjJxkpfph6piinmqVTR67HW0=";
+    sha256 = "sha256-cuntghTMGrAcrPunyi9ZWlxDcryYv7R6S3V8WJjEUtQ=";
  };

-  cargoSha256 = "sha256-dDQvcYnceBPDc+yeePjZ1k4a2ujCSh1hJMYFjPGw/bE=";
+  cargoSha256 = "sha256-gao8vCfzb81GUte6WAt2x/pxecg443bpQxvUSQCXL40=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "yq-go";
-  version = "4.22.1";
+  version = "4.23.1";

  src = fetchFromGitHub {
    owner = "mikefarah";
    repo = "yq";
    rev = "v${version}";
-    sha256 = "sha256-+yVf9pSK2cH/d5fdaGSBrjce8vVqE9XMpZSI8s4xoJI=";
+    sha256 = "sha256-vYitX3Gvffo/MbSYAJv5HV74IcYZK7hIEd1xRQf/COU=";
  };

-  vendorSha256 = "sha256-F11FnDYJ59aKrdRXDPpKlhX52yQXdaN1sblSkVI2j9w=";
+  vendorSha256 = "sha256-R40zU0jOc/eIFVDsWG3+4o51iro7Sd7jwtyH/fpWVZs=";

  doCheck = false;

--- a/pkgs/games/rare/default.nix
+++ b/pkgs/games/rare/default.nix
@ -0,0 +1,64 @@
+{ lib, fetchPypi, buildPythonApplication, makeDesktopItem, copyDesktopItems, qt5
+, pillow, psutil, pypresence, pyqt5, python, qtawesome, requests }:
+
+buildPythonApplication rec {
+  pname = "rare";
+  version = "1.8.8";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "Rare";
+    sha256 = "sha256-00CtvBqSrT9yJUHZ5529VrIQtCOYkHRc8+rJHmrTSpg=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    qt5.wrapQtAppsHook
+  ];
+
+  propagatedBuildInputs = [
+    pillow
+    psutil
+    pypresence
+    pyqt5
+    qtawesome
+    requests
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      exec = "rare";
+      icon = "Rare";
+      comment = meta.description;
+      desktopName = "Rare";
+      genericName = "Rare (Epic Games Launcher Open Source Alternative)";
+    })
+  ];
+
+  dontWrapQtApps = true;
+
+  preBuild = ''
+    # Solves "PermissionError: [Errno 13] Permission denied: '/homeless-shelter'"
+    export HOME=$(mktemp -d)
+  '';
+
+  postInstall = ''
+    install -Dm644 $out/${python.sitePackages}/rare/resources/images/Rare.png -t $out/share/pixmaps/
+  '';
+
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
+
+  # Project has no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "GUI for Legendary, an Epic Games Launcher open source alternative";
+    homepage = "https://github.com/Dummerle/Rare";
+    maintainers = with maintainers; [ wolfangaukang ];
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/servers/mastodon/default.nix
+++ b/pkgs/servers/mastodon/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, nodejs-slim, mkYarnPackage, fetchFromGitHub, fetchpatch, bundlerEnv
+{ lib, stdenv, nodejs-slim, mkYarnPackage, fetchFromGitHub, fetchpatch, bundlerEnv, nixosTests
 , yarn, callPackage, imagemagick, ffmpeg, file, ruby_3_0, writeShellScript

  # Allow building a fork or custom version of Mastodon:
@ -119,6 +119,8 @@ stdenv.mkDerivation rec {
    ln -s ${run-streaming} $out/run-streaming.sh
  '';

+  passthru.tests.mastodon = nixosTests.mastodon;
+
  meta = with lib; {
    description = "Self-hosted, globally interconnected microblogging software based on ActivityPub";
    homepage = "https://joinmastodon.org";
--- a/pkgs/test/haskell/shellFor/default.nix
+++ b/pkgs/test/haskell/shellFor/default.nix
@ -2,6 +2,7 @@

 (haskellPackages.shellFor {
  packages = p: [ p.constraints p.linear ];
+  extraDependencies = p: { libraryHaskellDepends = [ p.releaser ]; };
  nativeBuildInputs = [ cabal-install ];
  phases = [ "unpackPhase" "buildPhase" "installPhase" ];
  unpackPhase = ''
@ -16,6 +17,16 @@
    export HOME=$(mktemp -d)
    mkdir -p $HOME/.cabal
    touch $HOME/.cabal/config
+
+    # Check extraDependencies.libraryHaskellDepends arg
+    ghci <<EOF
+    :m + Releaser.Primitives
+    :m + System.IO
+    writeFile "done" "done"
+    EOF
+    [[ done == $(cat done) ]]
+
+    # Check packages arg
    cabal v2-build --offline --verbose constraints linear --ghc-options="-O0 -j$NIX_BUILD_CORES"
  '';
  installPhase = ''
--- a/pkgs/tools/filesystems/squashfs/darwin.patch
+++ b/pkgs/tools/filesystems/squashfs/darwin.patch
@ -5,7 +5,7 @@ with BSD-specific changes omitted.
 See also https://github.com/plougher/squashfs-tools/pull/69.

 diff --git a/squashfs-tools/action.c b/squashfs-tools/action.c
-index 4b06ccb..3cad2ab 100644
+index ea2f604..9c979f8 100644
 --- a/squashfs-tools/action.c
 +++ b/squashfs-tools/action.c
@@ -39,6 +39,10 @@
@ -19,7 +19,7 @@ index 4b06ccb..3cad2ab 100644
 #include "squashfs_fs.h"
 #include "mksquashfs.h"
 #include "action.h"
-@@ -2414,9 +2418,12 @@ static char *get_start(char *s, int n)
+@@ -2415,9 +2419,12 @@ static char *get_start(char *s, int n)
 
 static int subpathname_fn(struct atom *atom, struct action_data *action_data)
 {
@ -34,7 +34,7 @@ index 4b06ccb..3cad2ab 100644
 
 /*
 diff --git a/squashfs-tools/info.c b/squashfs-tools/info.c
-index fe23d78..5c2f835 100644
+index 216b979..eea2ec9 100644
 --- a/squashfs-tools/info.c
 +++ b/squashfs-tools/info.c
@@ -144,31 +144,22 @@ void dump_state()
@ -89,7 +89,7 @@ index fe23d78..5c2f835 100644
 }
 
 diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
-index a45b77f..3607448 100644
+index 843f9f4..ed2c3a6 100644
 --- a/squashfs-tools/mksquashfs.c
 +++ b/squashfs-tools/mksquashfs.c
@@ -35,7 +35,12 @@
@ -117,7 +117,7 @@ index a45b77f..3607448 100644
 
 #ifndef linux
 #include <sys/sysctl.h>
-@@ -5022,6 +5030,7 @@ static void initialise_threads(int readq, int fragq, int bwriteq, int fwriteq,
+@@ -5064,6 +5072,7 @@ static void initialise_threads(int readq, int fragq, int bwriteq, int fwriteq,
 	sigemptyset(&sigmask);
 	sigaddset(&sigmask, SIGQUIT);
 	sigaddset(&sigmask, SIGHUP);
@ -125,7 +125,7 @@ index a45b77f..3607448 100644
 	if(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) != 0)
 		BAD_ERROR("Failed to set signal mask in intialise_threads\n");
 
-@@ -5760,6 +5769,35 @@ static int get_physical_memory()
+@@ -5802,6 +5811,35 @@ static int get_physical_memory()
 	long long page_size = sysconf(_SC_PAGESIZE);
 	int phys_mem;
 
@ -161,7 +161,7 @@ index a45b77f..3607448 100644
 	if(num_pages == -1 || page_size == -1) {
 		struct sysinfo sys;
 		int res = sysinfo(&sys);
-@@ -5772,6 +5810,7 @@ static int get_physical_memory()
+@@ -5814,6 +5852,7 @@ static int get_physical_memory()
 	}
 
 	phys_mem = num_pages * page_size >> 20;
@ -170,7 +170,7 @@ index a45b77f..3607448 100644
 	if(phys_mem < SQUASHFS_LOWMEM)
 		BAD_ERROR("Mksquashfs requires more physical memory than is "
 diff --git a/squashfs-tools/read_xattrs.c b/squashfs-tools/read_xattrs.c
-index 4debedf..3257c30 100644
+index 2067f80..ca8b7f4 100644
 --- a/squashfs-tools/read_xattrs.c
 +++ b/squashfs-tools/read_xattrs.c
@@ -31,13 +31,13 @@
@ -186,11 +186,11 @@ index 4debedf..3257c30 100644
 
 -#include <stdlib.h>
 -
- extern int read_fs_bytes(int, long long, int, void *);
+ extern int read_fs_bytes(int, long long, long long, void *);
 extern int read_block(int, long long, long long *, int, void *);
 
 diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
-index 727f1d5..c1a6183 100644
+index d434b42..1208e45 100644
 --- a/squashfs-tools/unsquashfs.c
 +++ b/squashfs-tools/unsquashfs.c
@@ -32,8 +32,12 @@
@ -206,7 +206,7 @@ index 727f1d5..c1a6183 100644
 #include <sys/types.h>
 #include <sys/time.h>
 #include <sys/resource.h>
-@@ -1175,7 +1179,7 @@ int create_inode(char *pathname, struct inode *i)
+@@ -1182,7 +1186,7 @@ int create_inode(char *pathname, struct inode *i)
 			break;
 		case SQUASHFS_SYMLINK_TYPE:
 		case SQUASHFS_LSYMLINK_TYPE: {
@ -215,7 +215,7 @@ index 727f1d5..c1a6183 100644
 				{ i->time, 0 },
 				{ i->time, 0 }
 			};
-@@ -1194,8 +1198,7 @@ int create_inode(char *pathname, struct inode *i)
+@@ -1201,8 +1205,7 @@ int create_inode(char *pathname, struct inode *i)
 				goto failed;
 			}
 
@ -225,7 +225,7 @@ index 727f1d5..c1a6183 100644
 			if(res == -1) {
 				EXIT_UNSQUASH_STRICT("create_inode: failed to"
 					" set time on %s, because %s\n",
-@@ -2683,6 +2686,7 @@ void initialise_threads(int fragment_buffer_size, int data_buffer_size, int cat_
+@@ -2687,6 +2690,7 @@ void initialise_threads(int fragment_buffer_size, int data_buffer_size, int cat_
 		sigemptyset(&sigmask);
 		sigaddset(&sigmask, SIGQUIT);
 		sigaddset(&sigmask, SIGHUP);
@ -234,7 +234,7 @@ index 727f1d5..c1a6183 100644
 			EXIT_UNSQUASH("Failed to set signal mask in initialise_threads\n");
 
 diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
-index 934618b..0e680ab 100644
+index 1099678..5b6a038 100644
 --- a/squashfs-tools/unsquashfs.h
 +++ b/squashfs-tools/unsquashfs.h
@@ -46,6 +46,10 @@
@ -249,7 +249,7 @@ index 934618b..0e680ab 100644
 #include "squashfs_fs.h"
 #include "unsquashfs_error.h"
 diff --git a/squashfs-tools/unsquashfs_info.c b/squashfs-tools/unsquashfs_info.c
-index c8e2b9b..7d4f7af 100644
+index e906eaf..f1e68c2 100644
 --- a/squashfs-tools/unsquashfs_info.c
 +++ b/squashfs-tools/unsquashfs_info.c
@@ -96,31 +96,22 @@ void dump_state()
@ -304,7 +304,7 @@ index c8e2b9b..7d4f7af 100644
 }
 
 diff --git a/squashfs-tools/unsquashfs_xattr.c b/squashfs-tools/unsquashfs_xattr.c
-index 7742dfe..f8cd3b6 100644
+index 61910e1..73e0090 100644
 --- a/squashfs-tools/unsquashfs_xattr.c
 +++ b/squashfs-tools/unsquashfs_xattr.c
@@ -27,6 +27,11 @@
@ -320,7 +320,7 @@ index 7742dfe..f8cd3b6 100644
 
 extern int root_process;
 diff --git a/squashfs-tools/xattr.c b/squashfs-tools/xattr.c
-index 64dfd82..d82d186 100644
+index b1c0089..6d7ed98 100644
 --- a/squashfs-tools/xattr.c
 +++ b/squashfs-tools/xattr.c
@@ -22,6 +22,14 @@
@ -353,5 +353,5 @@ index 64dfd82..d82d186 100644
 #include "squashfs_swap.h"
 #include "mksquashfs.h"
 -- 
-2.23.0
+2.35.1

--- a/pkgs/tools/filesystems/squashfs/default.nix
+++ b/pkgs/tools/filesystems/squashfs/default.nix
@ -2,44 +2,43 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
-, zlib
-, xz
+, help2man
 , lz4
 , lzo
-, zstd
 , nixosTests
+, which
+, xz
+, zlib
+, zstd
 }:

 stdenv.mkDerivation rec {
  pname = "squashfs";
-  version = "4.5";
+  version = "4.5.1";

  src = fetchFromGitHub {
    owner = "plougher";
    repo = "squashfs-tools";
    rev = version;
-    sha256 = "1nanwz5qvsakxfm37md5i7xqagv69nfik9hpj8qlp6ymw266vgxr";
+    sha256 = "sha256-Y3ZPjeE9HN1F+NtGe6EchYziWrTPVQ4SuKaCvNbXMKI=";
  };

  patches = [
    # This patch adds an option to pad filesystems (increasing size) in
    # exchange for better chunking / binary diff calculation.
    ./4k-align.patch
-    # Otherwise sizes of some files may break in our ISO; see
-    # https://github.com/NixOS/nixpkgs/issues/132286
-    (fetchpatch {
-      url = "https://github.com/plougher/squashfs-tools/commit/19b161c1cd3e31f7a396ea92dea4390ad43f27b9.diff";
-      sha256 = "15ng8m2my3a6a9hnfx474bip2vwdh08hzs2k0l5gwd36jv2z1h3f";
-    })
  ] ++ lib.optional stdenv.isDarwin ./darwin.patch;

-  buildInputs = [ zlib xz zstd lz4 lzo ];
+  buildInputs = [ zlib xz zstd lz4 lzo which help2man ];

  preBuild = ''
    cd squashfs-tools
  '' ;

-  installFlags = [ "INSTALL_DIR=${placeholder "out"}/bin" ];
+  installFlags = [
+    "INSTALL_DIR=${placeholder "out"}/bin"
+    "INSTALL_MANPAGES_DIR=${placeholder "out"}/share/man/man1"
+  ];

  makeFlags = [
    "XZ_SUPPORT=1"
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@ -2,7 +2,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "dua";
-  version = "2.17.0";
+  version = "2.17.1";

  buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];

@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
    owner = "Byron";
    repo = "dua-cli";
    rev = "v${version}";
-    sha256 = "sha256-yac/WUVL10JU1V5f9LYh57yYzZ2JMf24jMd8Mun7OMU=";
+    sha256 = "sha256-58l0E5wwRKbF/ja3fmMMBIONjuwVOxlwdKRT5BeO9MQ=";
    # Remove unicode file names which leads to different checksums on HFS+
    # vs. other filesystems because of unicode normalisation.
    extraPostFetch = ''
@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
    '';
  };

-  cargoSha256 = "sha256-Q0ZLMbnQeG/64QvAIPpa3k+lI6dbSSQcdYb5e2rX8U0=";
+  cargoSha256 = "sha256-nft0wrgTMrI8Tav6NcqPwSF8Q367twIOr1voBsW2488=";

  doCheck = false;

--- a/pkgs/tools/misc/opentelemetry-collector/contrib.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "opentelemetry-collector-contrib";
-  version = "0.46.0";
+  version = "0.47.0";

  src = fetchFromGitHub {
    owner = "open-telemetry";
    repo = "opentelemetry-collector-contrib";
    rev = "v${version}";
-    sha256 = "sha256-VD/gN9lUwzhRTfr8rAQld+4sN+deYhUlNvCphtZncDU=";
+    sha256 = "sha256-IbpQd01uU6/Ihli+gVDjTB8T8cj//XHoZYcDjXD635Q=";
  };
  # proxy vendor to avoid hash missmatches between linux and macOS
  proxyVendor = true;
-  vendorSha256 = "sha256-ojNDDPCo6TGp8BYio/pYykXSLjC5Qplw0WFD9UIiYM4=";
+  vendorSha256 = "sha256-1svBCXfutjXfXfVqVHUTAt9T1ON/qbiS+VCt5kP/YIc=";

  subPackages = [ "cmd/otelcontribcol" ];

--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -308,6 +308,7 @@ mapAliases ({
  epoxy = libepoxy; # Added 2021-11-11
  esniper = throw "esniper has been removed because upstream no longer maintains it (and it no longer works)"; # Added 2021-04-12
  etcdctl = throw "'etcdctl' has been renamed to/replaced by 'etcd'"; # Converted to throw 2022-02-22
+  eteroj.lv2 = throw "'eteroj.lv2' has been renamed to/replaced by 'open-music-kontrollers.eteroj'"; # Added 2022-03-09
  euca2tools = throw "euca2ools has been removed because it is unmaintained upstream and still uses python2"; # Added 2022-01-01
  evilvte = throw "evilvte has been removed from nixpkgs for being unmaintained with security issues and dependant on an old version of vte which was removed"; # Added 2022-01-14
  evolution_data_server = throw "'evolution_data_server' has been renamed to/replaced by 'evolution-data-server'"; # Converted to throw 2022-02-22
@ -855,6 +856,7 @@ mapAliases ({
  parity = openethereum; # Added 2020-08-01
  parity-ui = throw "parity-ui was removed because it was broken and unmaintained by upstream"; # Added 2022-01-10
  parquet-cpp = throw "'parquet-cpp' has been renamed to/replaced by 'arrow-cpp'"; # Converted to throw 2022-02-22
+  patchmatrix = throw "'patchmatrix' has been renamed to/replaced by 'open-music-kontrollers.patchmatrix'"; # Added 2022-03-09
  pass-otp = throw "'pass-otp' has been renamed to/replaced by 'pass.withExtensions'"; # Converted to throw 2022-02-22
  pdfmod = throw "pdfmod has been removed"; # Added 2022-01-15
  pdfread = throw "pdfread has been remove because it is unmaintained for years and the sources are no longer available"; # Added 2021-07-22
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1041,6 +1041,8 @@ with pkgs;

  albert = libsForQt5.callPackage ../applications/misc/albert {};

+  allure = callPackage ../development/tools/allure {};
+
  aquosctl = callPackage ../tools/misc/aquosctl { };

  arch-install-scripts = callPackage ../tools/misc/arch-install-scripts {};
@ -3745,6 +3747,8 @@ with pkgs;

  psrecord = python3Packages.callPackage ../tools/misc/psrecord {};

+  rare = python3Packages.callPackage ../games/rare { };
+
  reg = callPackage ../tools/virtualization/reg { };

  river = callPackage ../applications/window-managers/river { };
@ -4162,6 +4166,8 @@ with pkgs;
    stdenv = gcc9Stdenv;
  };

+  cider = callPackage ../applications/audio/cider { };
+
  isolyzer = callPackage ../tools/cd-dvd/isolyzer { };

  isomd5sum = callPackage ../tools/cd-dvd/isomd5sum { };
@ -19996,6 +20002,8 @@ with pkgs;

  ronn = callPackage ../development/tools/ronn { };

+  rover = callPackage ../development/tools/rover { };
+
  rshell = python3.pkgs.callPackage ../development/embedded/rshell { };

  rttr = callPackage ../development/libraries/rttr { };
@ -25506,8 +25514,6 @@ with pkgs;

  espeakedit = callPackage ../applications/audio/espeak/edit.nix { };

-  eteroj.lv2 = libsForQt5.callPackage ../applications/audio/eteroj.lv2 { };
-
  etebase-server = with python3Packages; toPythonApplication etebase-server;

  etesync-dav = callPackage ../applications/misc/etesync-dav {};
@ -27380,6 +27386,8 @@ with pkgs;

  lv2bm = callPackage ../applications/audio/lv2bm { };

+  lv2lint = callPackage ../applications/audio/lv2lint/default.nix { };
+
  lv2-cpp-tools = callPackage ../applications/audio/lv2-cpp-tools { };

  lxi-tools = callPackage ../tools/networking/lxi-tools { };
@ -28190,6 +28198,20 @@ with pkgs;

  openjump = callPackage ../applications/misc/openjump { };

+  open-music-kontrollers = lib.recurseIntoAttrs {
+    eteroj = callPackage ../applications/audio/open-music-kontrollers/eteroj.nix { };
+    jit = callPackage ../applications/audio/open-music-kontrollers/jit.nix { };
+    mephisto = callPackage ../applications/audio/open-music-kontrollers/mephisto.nix { };
+    midi_matrix = callPackage ../applications/audio/open-music-kontrollers/midi_matrix.nix { };
+    moony = callPackage ../applications/audio/open-music-kontrollers/moony.nix { };
+    orbit = callPackage ../applications/audio/open-music-kontrollers/orbit.nix { };
+    patchmatrix = callPackage ../applications/audio/open-music-kontrollers/patchmatrix.nix { };
+    router = callPackage ../applications/audio/open-music-kontrollers/router.nix { };
+    sherlock = callPackage ../applications/audio/open-music-kontrollers/sherlock.nix { };
+    synthpod = callPackage ../applications/audio/open-music-kontrollers/synthpod.nix { };
+    vm = callPackage ../applications/audio/open-music-kontrollers/vm.nix { };
+  };
+
  openorienteering-mapper = libsForQt5.callPackage ../applications/gis/openorienteering-mapper { };

  openscad = libsForQt5.callPackage ../applications/graphics/openscad {};
@ -28291,8 +28313,6 @@ with pkgs;

  capture = callPackage ../tools/misc/capture {};

-  patchmatrix = callPackage ../applications/audio/patchmatrix { };
-
  pbrt = callPackage ../applications/graphics/pbrt { };

  pcloud = callPackage ../applications/networking/pcloud { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -5159,6 +5159,8 @@ in {
  mizani = callPackage ../development/python-modules/mizani { };

  mkdocs = callPackage ../development/python-modules/mkdocs { };
+  mkdocs-material = callPackage ../development/python-modules/mkdocs-material { };
+  mkdocs-material-extensions = callPackage ../development/python-modules/mkdocs-material/mkdocs-material-extensions.nix { };

  mkl-service = callPackage ../development/python-modules/mkl-service { };
				`@ -0,0 +1 @@`
				`1bdcf8916afc3cea660add457724dddd70154904f4e360e15da27fa7d5c43cd0`