Merge remote-tracking branch 'origin/master' into haskell-updates,

2020-10-15 19:39:16 +02:00 · 2020-10-15 19:39:16 +02:00 · 56bc587444
commit 56bc587444
parent b18f75c8a3 7ce8117238
583 changed files with 16784 additions and 12546 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -192,6 +192,7 @@
 /nixos/tests/php                         @NixOS/php
 /pkgs/build-support/build-pecl.nix       @NixOS/php
 /pkgs/development/interpreters/php       @NixOS/php
+/pkgs/development/php-packages           @NixOS/php
 /pkgs/top-level/php-packages.nix         @NixOS/php

 # Podman, CRI-O modules and related
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@ -10,7 +10,7 @@ jobs:
    - uses: actions/checkout@v2
      with:
        fetch-depth: 0
-    - uses: technote-space/get-diff-action@v3.1.0
+    - uses: technote-space/get-diff-action@v4.0.0
    - name: Fetch editorconfig-checker
      if: env.GIT_DIFF
      env:
--- a/doc/languages-frameworks/agda.section.md
+++ b/doc/languages-frameworks/agda.section.md
@ -12,12 +12,13 @@ Agda can be installed from `agda`:
 $ nix-env -iA agda
 ```

-To use agda with libraries, the `agda.withPackages` function can be used. This function either takes:
-+ A list of packages,
-+ or a function which returns a list of packages when given the `agdaPackages` attribute set,
-+ or an attribute set containing a list of packages and a GHC derivation for compilation (see below).
+To use Agda with libraries, the `agda.withPackages` function can be used. This function either takes:

-For example, suppose we wanted a version of agda which has access to the standard library. This can be obtained with the expressions:
+* A list of packages,
+* or a function which returns a list of packages when given the `agdaPackages` attribute set,
+* or an attribute set containing a list of packages and a GHC derivation for compilation (see below).
+
+For example, suppose we wanted a version of Agda which has access to the standard library. This can be obtained with the expressions:

 ```
 agda.withPackages [ agdaPackages.standard-library ]
@ -33,18 +34,19 @@ or can be called as in the [Compiling Agda](#compiling-agda) section.

 If you want to use a library in your home directory (for instance if it is a development version) then typecheck it manually (using `agda.withPackages` if necessary) and then override the `src` attribute of the package to point to your local repository.

-Agda will not by default use these libraries. To tell agda to use the library we have some options:
- Call `agda` with the library flag:
+Agda will not by default use these libraries. To tell Agda to use the library we have some options:
+
+* Call `agda` with the library flag:
 ```
 $ agda -l standard-library -i . MyFile.agda
 ```
- Write a `my-library.agda-lib` file for the project you are working on which may look like:
+* Write a `my-library.agda-lib` file for the project you are working on which may look like:
 ```
 name: my-library
 include: .
 depend: standard-library
 ```
- Create the file `~/.agda/defaults` and add any libraries you want to use by default.
+* Create the file `~/.agda/defaults` and add any libraries you want to use by default.

 More information can be found in the [official Agda documentation on library management](https://agda.readthedocs.io/en/v2.6.1/tools/package-system.html).

@ -60,12 +62,13 @@ agda.withPackages {
 ```

 ## Writing Agda packages
-To write a nix derivation for an agda library, first check that the library has a `*.agda-lib` file.
+To write a nix derivation for an Agda library, first check that the library has a `*.agda-lib` file.

 A derivation can then be written using `agdaPackages.mkDerivation`. This has similar arguments to `stdenv.mkDerivation` with the following additions:
-+ `everythingFile` can be used to specify the location of the `Everything.agda` file, defaulting to `./Everything.agda`. If this file does not exist then either it should be patched in or the `buildPhase` should be overridden (see below).
-+ `libraryName` should be the name that appears in the `*.agda-lib` file, defaulting to `pname`.
-+ `libraryFile` should be the file name of the `*.agda-lib` file, defaulting to `${libraryName}.agda-lib`.
+
+* `everythingFile` can be used to specify the location of the `Everything.agda` file, defaulting to `./Everything.agda`. If this file does not exist then either it should be patched in or the `buildPhase` should be overridden (see below).
+* `libraryName` should be the name that appears in the `*.agda-lib` file, defaulting to `pname`.
+* `libraryFile` should be the file name of the `*.agda-lib` file, defaulting to `${libraryName}.agda-lib`.

 ### Building Agda packages
 The default build phase for `agdaPackages.mkDerivation` simply runs `agda` on the `Everything.agda` file.
@ -74,12 +77,14 @@ Additionally, a `preBuild` or `configurePhase` can be used if there are steps th
 `agda` and the Agda libraries contained in `buildInputs` are made available during the build phase.

 ### Installing Agda packages
-The default install phase copies agda source files, agda interface files (`*.agdai`) and `*.agda-lib` files to the output directory.
+The default install phase copies Agda source files, Agda interface files (`*.agdai`) and `*.agda-lib` files to the output directory.
 This can be overridden.

-By default, agda sources are files ending on  `.agda`, or literate agda files ending on `.lagda`, `.lagda.tex`, `.lagda.org`, `.lagda.md`, `.lagda.rst`. The list of recognised agda source extensions can be extended by setting the `extraExtensions` config variable.
+By default, Agda sources are files ending on `.agda`, or literate Agda files ending on `.lagda`, `.lagda.tex`, `.lagda.org`, `.lagda.md`, `.lagda.rst`. The list of recognised Agda source extensions can be extended by setting the `extraExtensions` config variable.

-To add an agda package to `nixpkgs`, the derivation should be written to `pkgs/development/libraries/agda/${library-name}/` and an entry should be added to `pkgs/top-level/agda-packages.nix`. Here it is called in a scope with access to all other agda libraries, so the top line of the `default.nix` can look like:
+## Adding Agda packages to Nixpkgs
+
+To add an Agda package to `nixpkgs`, the derivation should be written to `pkgs/development/libraries/agda/${library-name}/` and an entry should be added to `pkgs/top-level/agda-packages.nix`. Here it is called in a scope with access to all other Agda libraries, so the top line of the `default.nix` can look like:
 ```
 { mkDerivation, standard-library, fetchFromGitHub }:
 ```
@ -103,4 +108,4 @@ mkDerivation {
 ```
 This library has a file called `.agda-lib`, and so we give an empty string to `libraryFile` as nothing precedes `.agda-lib` in the filename. This file contains `name: IAL-1.3`, and so we let `libraryName =  "IAL-1.3"`. This library does not use an `Everything.agda` file and instead has a Makefile, so there is no need to set `everythingFile` and we set a custom `buildPhase`.

-When writing an agda package it is essential to make sure that no `.agda-lib` file gets added to the store as a single file (for example by using `writeText`). This causes agda to think that the nix store is a agda library and it will attempt to write to it whenever it typechecks something. See [https://github.com/agda/agda/issues/4613](https://github.com/agda/agda/issues/4613).
+When writing an Agda package it is essential to make sure that no `.agda-lib` file gets added to the store as a single file (for example by using `writeText`). This causes Agda to think that the nix store is a Agda library and it will attempt to write to it whenever it typechecks something. See [https://github.com/agda/agda/issues/4613](https://github.com/agda/agda/issues/4613).
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -755,8 +755,8 @@ and in this case the `python38` interpreter is automatically used.

 ### Interpreters

-Versions 2.7, 3.6, 3.7 and 3.8 of the CPython interpreter are available as
-respectively `python27`, `python36`, `python37` and `python38`. The
+Versions 2.7, 3.6, 3.7, 3.8 and 3.9 of the CPython interpreter are available as
+respectively `python27`, `python36`, `python37`, `python38` and `python39`. The
 aliases `python2` and `python3` correspond to respectively `python27` and
 `python38`. The default interpreter, `python`, maps to `python2`. The PyPy
 interpreters compatible with Python 2.7 and 3 are available as `pypy27` and
--- a/doc/stdenv/stdenv.xml
+++ b/doc/stdenv/stdenv.xml
@ -1833,6 +1833,19 @@ addEnvHooks "$hostOffset" myBashFunction
      </para>
     </listitem>
    </varlistentry>
+    <varlistentry>
+     <term>
+      <literal>move-systemd-user-units.sh</literal>
+     </term>
+     <listitem>
+      <para>
+       This setup hook moves any systemd user units installed in the lib
+       subdirectory into share. In addition, a link is provided from share to
+       lib for compatibility. This is needed for systemd to find user services
+       when installed into the user profile.
+      </para>
+     </listitem>
+    </varlistentry>
    <varlistentry>
     <term>
      <literal>set-source-date-epoch-to-latest.sh</literal>
--- a/flake.nix
+++ b/flake.nix
@ -45,7 +45,7 @@
              modules ++ [
                {
                  system.nixos.versionSuffix =
-                    ".${final.substring 0 8 (self.lastModifiedDate or self.lastModified)}.${self.shortRev or "dirty"}";
+                    ".${final.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")}.${self.shortRev or "dirty"}";
                  system.nixos.revision = final.mkIf (self ? rev) self.rev;

                  system.build = {
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@ -179,8 +179,8 @@ rec {
  iphone64 = {
    config = "aarch64-apple-ios";
    # config = "aarch64-apple-darwin14";
-    sdkVer = "12.4";
-    xcodeVer = "10.3";
+    sdkVer = "13.2";
+    xcodeVer = "11.3.1";
    xcodePlatform = "iPhoneOS";
    useiOSPrebuilt = true;
    platform = {};
@ -189,8 +189,8 @@ rec {
  iphone32 = {
    config = "armv7a-apple-ios";
    # config = "arm-apple-darwin10";
-    sdkVer = "12.4";
-    xcodeVer = "10.3";
+    sdkVer = "13.2";
+    xcodeVer = "11.3.1";
    xcodePlatform = "iPhoneOS";
    useiOSPrebuilt = true;
    platform = {};
@ -199,8 +199,8 @@ rec {
  iphone64-simulator = {
    config = "x86_64-apple-ios";
    # config = "x86_64-apple-darwin14";
-    sdkVer = "12.4";
-    xcodeVer = "10.3";
+    sdkVer = "13.2";
+    xcodeVer = "11.3.1";
    xcodePlatform = "iPhoneSimulator";
    useiOSPrebuilt = true;
    platform = {};
@ -209,8 +209,8 @@ rec {
  iphone32-simulator = {
    config = "i686-apple-ios";
    # config = "i386-apple-darwin11";
-    sdkVer = "12.4";
-    xcodeVer = "10.3";
+    sdkVer = "13.2";
+    xcodeVer = "11.3.1";
    xcodePlatform = "iPhoneSimulator";
    useiOSPrebuilt = true;
    platform = {};
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2395,6 +2395,12 @@
    githubId = 984691;
    name = "Evan Danaher";
  };
+  edcragg = {
+    email = "ed.cragg@eipi.xyz";
+    github = "nuxeh";
+    githubId = 1516017;
+    name = "Ed Cragg";
+  };
  edef = {
    email = "edef@edef.eu";
    github = "edef1c";
@ -2723,6 +2729,12 @@
    githubId = 1847524;
    name = "Evan Stoll";
  };
+  evax = {
+    email = "nixos@evax.fr";
+    github = "evax";
+    githubId = 599997;
+    name = "evax";
+  };
  evck = {
    email = "eric@evenchick.com";
    github = "ericevenchick";
@ -3319,6 +3331,12 @@
    githubId = 10654650;
    name = "Guillaume Koenig";
  };
+  guserav = {
+    email = "guserav@users.noreply.github.com";
+    github = "guserav";
+    githubId = 28863828;
+    name = "guserav";
+  };
  guyonvarch = {
    email = "joris@guyonvarch.me";
    github = "guyonvarch";
@ -4268,6 +4286,12 @@
    githubId = 39434424;
    name = "Felix Springer";
  };
+  justinas = {
+    email = "justinas@justinas.org";
+    github = "justinas";
+    githubId = 662666;
+    name = "Justinas Stankevičius";
+  };
  justinlovinger = {
    email = "git@justinlovinger.com";
    github = "JustinLovinger";
@ -6237,6 +6261,12 @@
    githubId = 40049608;
    name = "Andy Chun";
  };
+  norfair = {
+    email = "syd@cs-syd.eu";
+    github = "NorfairKing";
+    githubId = 3521180;
+    name = "Tom Sydney Kerckhove";
+  };
  notthemessiah = {
    email = "brian.cohen.88@gmail.com";
    github = "notthemessiah";
@ -6371,6 +6401,12 @@
    githubId = 1538622;
    name = "Michael Reilly";
  };
+  onny = {
+    email = "onny@project-insanity.org";
+    github = "onny";
+    githubId = 757752;
+    name = "Jonas Heinrich";
+  };
  OPNA2608 = {
    email = "christoph.neidahl@gmail.com";
    github = "OPNA2608";
@ -9100,6 +9136,12 @@
    githubId = 508305;
    name = "Jaroslavas Pocepko";
  };
+  vonfry = {
+    email = "nixos@vonfry.name";
+    github = "Vonfry";
+    githubId = 3413119;
+    name = "Vonfry";
+  };
  vozz = {
    email = "oliver.huntuk@gmail.com";
    name = "Oliver Hunt";
@ -9218,6 +9260,12 @@
    githubId = 1322287;
    name = "William O'Hanley";
  };
+  wolfangaukang = {
+    email = "liquid.query960@4wrd.cc";
+    github = "wolfangaukang";
+    githubId = 8378365;
+    name = "P. R. d. O.";
+  };
  womfoo = {
    email = "kranium@gikos.net";
    github = "womfoo";
--- a/nixos/doc/manual/development/meta-attributes.xml
+++ b/nixos/doc/manual/development/meta-attributes.xml
@ -57,7 +57,7 @@
      linkend="ch-configuration"/>. Changes to a module documentation
    have to be checked to not break building the NixOS manual:
   </para>
-<screen><prompt>$ </prompt>nix-build nixos/release.nix -A manual</screen>
+<screen><prompt>$ </prompt>nix-build nixos/release.nix -A manual.x86_64-linux</screen>
  </callout>
 </calloutlist>
 </section>
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -64,6 +64,12 @@
     Python 3 now defaults to Python 3.8 instead of 3.7.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     Python 3.5 has reached its upstream EOL at the end of September 2020: it
+     has been removed from the list of available packages.
+    </para>
+   </listitem>
   <listitem>
    <para>
     Two new options, <link linkend="opt-services.openssh.authorizedKeysCommand">authorizedKeysCommand</link>
@ -226,28 +232,6 @@ GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' WITH GRANT OPTION;
       <filename>testing-python.nix</filename> respectively.
     </para>
   </listitem>
-   <listitem>
-     <para>
-       The Mediatomb service declares new options. It also adapts existing
-       options to make the configuration generation lazy. The existing option
-       <literal>customCfg</literal> (defaults to false), when enabled, stops
-       the service configuration generation completely. It then expects the
-       users to provide their own correct configuration at the right location
-       (whereas the configuration was generated and not used at all before).
-       The new option <literal>transcodingOption</literal> (defaults to no)
-       allows a generated configuration. It makes the mediatomb service pulls
-       the necessary runtime dependencies in the nix store (whereas it was
-       generated with hardcoded values before). The new option
-       <literal>mediaDirectories</literal> allows the users to declare autoscan
-       media directories from their nixos configuration:
-       <programlisting>
-       services.mediatomb.mediaDirectories = [
-         { path = "/var/lib/mediatomb/pictures"; recursive = false; hidden-files = false; }
-         { path = "/var/lib/mediatomb/audio"; recursive = true; hidden-files = false; }
-       ];
-       </programlisting>
-    </para>
-   </listitem>
  </itemizedlist>
 </section>

@ -605,8 +589,8 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
   <listitem>
     <para>
       In addition to the hostname, the fully qualified domain name (FQDN),
-       which consists of <literal>${cfg.hostName}</literal> and
-       <literal>${cfg.domain}</literal> is now added to
+       which consists of <literal>${networking.hostName}</literal> and
+       <literal>${networking.domain}</literal> is now added to
       <literal>/etc/hosts</literal>, to allow local FQDN resolution, as used by the
       <literal>hostname --fqdn</literal> command and other applications that
       try to determine the FQDN. These new entries take precedence over entries
@ -626,6 +610,10 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
       or digit, and have as interior characters only letters, digits, and
       hyphen. The maximum length is 63 characters. Additionally it is
       recommended to only use lower-case characters.
+       If (e.g. for legacy reasons) a FQDN is required as the Linux kernel network node hostname
+       (<literal>uname --nodename</literal>) the option
+       <literal>boot.kernel.sysctl."kernel.hostname"</literal>
+       can be used as a workaround (but be aware of the 64 character limit).
     </para>
   </listitem>
   <listitem>
@ -861,6 +849,13 @@ CREATE ROLE postgres LOGIN SUPERUSER;
     functionally redundent.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The <literal>hardware.nvidia.optimus_prime.enable</literal> service has been renamed to
+     <literal>hardware.nvidia.prime.sync.enable</literal> and has many new enhancements.
+     Related nvidia prime settings may have also changed.
+    </para>
+   </listitem>
   <listitem>
    <para>
     The package <package>nextcloud17</package> has been removed and <package>nextcloud18</package> was marked as insecure
@ -888,19 +883,9 @@ CREATE ROLE postgres LOGIN SUPERUSER;
   </listitem>
   <listitem>
    <para>
-       The mediatomb service is now using the new and maintained <literal>gerbera</literal>
-       <literal>gerbera</literal> fork instead of the unmaintained
-       <literal>mediatomb</literal> package. If you want to keep the old
-       behavior, you must declare it with:
-       <programlisting>
-       services.mediatomb.package = pkgs.mediatomb;
-       </programlisting>
-       One new option <literal>openFirewall</literal> has been introduced which
-       defaults to false. If you relied on the service declaration to add the
-       firewall rules itself before, you should now declare it with:
-       <programlisting>
-       services.mediatomb.openFirewall = true;
-       </programlisting>
+      The GNOME desktop manager no longer default installs <package>gnome3.epiphany</package>.
+      It was chosen to do this as it has a usability breaking issue (see issue <link xlink:href="https://github.com/NixOS/nixpkgs/issues/98819">#98819</link>)
+      that makes it unsuitable to be a default app.
    </para>
   </listitem>
  </itemizedlist>
@ -1132,8 +1117,10 @@ services.transmission.settings.rpc-bind-address = "0.0.0.0";
   </listitem>
   <listitem>
    <para>
-     The <literal>fontconfig</literal> module stopped generating fontconfig 2.10.x config and cache.
-     Fontconfig 2.10.x was removed from Nixpkgs - it hasn't been used in any nixpkgs package anymore.
+     The <literal>fontconfig</literal> module stopped generating config and cache files for fontconfig 2.10.x, the <filename>/etc/fonts/fonts.conf</filename> now belongs to the latest fontconfig, just like on other Linux distributions, and we will <link xlink:href="https://github.com/NixOS/nixpkgs/pull/95358">no longer</link> be versioning the config directories.
+    </para>
+    <para>
+     Fontconfig 2.10.x was removed from Nixpkgs since it hasn’t been used in any Nixpkgs package for years now.
    </para>
   </listitem>
   <listitem>
@ -1223,5 +1210,20 @@ services.transmission.settings.rpc-bind-address = "0.0.0.0";
    </para>
   </listitem>
  </itemizedlist>
+  <itemizedlist>
+    <listitem>
+      <para>
+        For AMD GPUs, Vulkan can now be used by adding <literal>amdvlk</literal>
+        to <literal>hardware.opengl.extraPackages</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Similarly, still for AMD GPUs, the ROCm OpenCL stack can now be used by adding
+        <literal>rocm-opencl-icd</literal> to
+        <literal>hardware.opengl.extraPackages</literal>.
+      </para>
+    </listitem>
+  </itemizedlist>
 </section>
 </section>
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@ -63,6 +63,17 @@
        <literal>systemd-journal2gelf</literal> no longer parses json and expects the receiving system to handle it. How to achieve this with Graylog is described in this <link xlink:href="https://github.com/parse-nl/SystemdJournal2Gelf/issues/10">GitHub issue</link>.
      </para>
   </listitem>
+   <listitem>
+    <para>
+     If the <varname>services.dbus</varname> module is enabled, then
+     the user D-Bus session is now always socket activated. The
+     associated options <varname>services.dbus.socketActivated</varname>
+     and <varname>services.xserver.startDbusSession</varname> have
+     therefore been removed and you will receive a warning if
+     they are present in your configuration. This change makes the
+     user D-Bus session available also for non-graphical logins.
+    </para>
+   </listitem>
   <listitem>
    <para>
     The option <option>fonts.enableFontDir</option> has been renamed to
@ -71,6 +82,17 @@
     for consistency with other X11 resources.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      A number of options have been renamed in the kicad interface. <literal>oceSupport</literal>
+      has been renamed to <literal>withOCE</literal>, <literal>withOCCT</literal> has been renamed
+      to <literal>withOCC</literal>, <literal>ngspiceSupport</literal> has been renamed to
+      <literal>withNgspice</literal>, and <literal>scriptingSupport</literal> has been renamed to
+      <literal>withScripting</literal>. Additionally, <literal>kicad/base.nix</literal> no longer
+      provides default argument values since these are provided by
+      <literal>kicad/default.nix</literal>.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/config/system-path.nix
+++ b/nixos/modules/config/system-path.nix
@ -142,6 +142,7 @@ in
        "/share/kservices5"
        "/share/kservicetypes5"
        "/share/kxmlgui5"
+        "/share/systemd"
      ];

    system.path = pkgs.buildEnv {
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -442,6 +442,7 @@
  ./services/misc/dysnomia.nix
  ./services/misc/disnix.nix
  ./services/misc/docker-registry.nix
+  ./services/misc/domoticz.nix
  ./services/misc/errbot.nix
  ./services/misc/etcd.nix
  ./services/misc/ethminer.nix
@ -466,6 +467,7 @@
  ./services/misc/irkerd.nix
  ./services/misc/jackett.nix
  ./services/misc/jellyfin.nix
+  ./services/misc/klipper.nix
  ./services/misc/logkeys.nix
  ./services/misc/leaps.nix
  ./services/misc/lidarr.nix
--- a/nixos/modules/programs/vim.nix
+++ b/nixos/modules/programs/vim.nix
@ -14,10 +14,20 @@ in {
        using the EDITOR environment variable.
      '';
    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.vim;
+      defaultText = "pkgs.vim";
+      example = "pkgs.vimHugeX";
+      description = ''
+        vim package to use.
+      '';
+    };
  };

  config = mkIf cfg.defaultEditor {
-        environment.systemPackages = [ pkgs.vim ];
+    environment.systemPackages = [ cfg.package ];
    environment.variables = { EDITOR = mkOverride 900 "vim"; };
  };
 }
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@ -122,19 +122,22 @@ let
      "--email" data.email
      "--key-type" data.keyType
    ] ++ protocolOpts
-      ++ optionals data.ocspMustStaple [ "--must-staple" ]
      ++ optionals (acmeServer != null) [ "--server" acmeServer ]
      ++ concatMap (name: [ "-d" name ]) extraDomains
      ++ data.extraLegoFlags;

+    # Although --must-staple is common to both modes, it is not declared as a
+    # mode-agnostic argument in lego and thus must come after the mode.
    runOpts = escapeShellArgs (
      commonOpts
      ++ [ "run" ]
+      ++ optionals data.ocspMustStaple [ "--must-staple" ]
      ++ data.extraLegoRunFlags
    );
    renewOpts = escapeShellArgs (
      commonOpts
      ++ [ "renew" "--reuse-key" ]
+      ++ optionals data.ocspMustStaple [ "--must-staple" ]
      ++ data.extraLegoRenewFlags
    );

--- a/nixos/modules/security/systemd-confinement.nix
+++ b/nixos/modules/security/systemd-confinement.nix
@ -160,7 +160,7 @@ in {
              + " the 'users.users' option instead as this combination is"
              + " currently not supported.";
    }
-    { assertion = !cfg.serviceConfig.ProtectSystem or false;
+    { assertion = cfg.serviceConfig ? ProtectSystem -> cfg.serviceConfig.ProtectSystem == false;
      message = "${whatOpt "ProtectSystem"}. ProtectSystem is not compatible"
              + " with service confinement as it fails to remount /usr within"
              + " our chroot. Please disable the option.";
--- a/nixos/modules/services/misc/domoticz.nix
+++ b/nixos/modules/services/misc/domoticz.nix
@ -0,0 +1,51 @@
+{ lib, pkgs, config, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.domoticz;
+  pkgDesc = "Domoticz home automation";
+
+in {
+
+  options = {
+
+    services.domoticz = {
+      enable = mkEnableOption pkgDesc;
+
+      bind = mkOption {
+        type = types.str;
+        default = "0.0.0.0";
+        description = "IP address to bind to.";
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = 8080;
+        description = "Port to bind to for HTTP, set to 0 to disable HTTP.";
+      };
+
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services."domoticz" = {
+      description = pkgDesc;
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        StateDirectory = "domoticz";
+        Restart = "always";
+        ExecStart = ''
+          ${pkgs.domoticz}/bin/domoticz -noupdates -www ${toString cfg.port} -wwwbind ${cfg.bind} -sslwww 0 -userdata /var/lib/domoticz -approot ${pkgs.domoticz}/share/domoticz/ -pidfile /var/run/domoticz.pid
+        '';
+      };
+    };
+
+  };
+
+}
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -73,6 +73,11 @@ let

  redisConfig.production.url = cfg.redisUrl;

+  pagesArgs = [
+    "-pages-domain" gitlabConfig.production.pages.host
+    "-pages-root" "${gitlabConfig.production.shared.path}/pages"
+  ] ++ cfg.pagesExtraArgs;
+
  gitlabConfig = {
    # These are the default settings from config/gitlab.example.yml
    production = flip recursiveUpdate cfg.extraConfig {
@ -236,6 +241,13 @@ in {
        description = "Reference to the gitaly package";
      };

+      packages.pages = mkOption {
+        type = types.package;
+        default = pkgs.gitlab-pages;
+        defaultText = "pkgs.gitlab-pages";
+        description = "Reference to the gitlab-pages package";
+      };
+
      statePath = mkOption {
        type = types.str;
        default = "/var/gitlab/state";
@ -451,6 +463,12 @@ in {
        };
      };

+      pagesExtraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [ "-listen-proxy" "127.0.0.1:8090" ];
+        description = "Arguments to pass to the gitlab-pages daemon";
+      };
+
      secrets.secretFile = mkOption {
        type = with types; nullOr path;
        default = null;
@ -754,6 +772,26 @@ in {
      };
    };

+    systemd.services.gitlab-pages = mkIf (gitlabConfig.production.pages.enabled or false) {
+      description = "GitLab static pages daemon";
+      after = [ "network.target" "redis.service" "gitlab.service" ]; # gitlab.service creates configs
+      wantedBy = [ "multi-user.target" ];
+
+      path = [ pkgs.unzip ];
+
+      serviceConfig = {
+        Type = "simple";
+        TimeoutSec = "infinity";
+        Restart = "on-failure";
+
+        User = cfg.user;
+        Group = cfg.group;
+
+        ExecStart = "${cfg.packages.pages}/bin/gitlab-pages ${escapeShellArgs pagesArgs}";
+        WorkingDirectory = gitlabEnv.HOME;
+      };
+    };
+
    systemd.services.gitlab-workhorse = {
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@ -0,0 +1,59 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.services.klipper;
+  package = pkgs.klipper;
+  format = pkgs.formats.ini { mkKeyValue = generators.mkKeyValueDefault {} ":"; };
+in
+{
+  ##### interface
+  options = {
+    services.klipper = {
+      enable = mkEnableOption "Klipper, the 3D printer firmware";
+
+      octoprintIntegration = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Allows Octoprint to control Klipper.";
+      };
+
+      settings = mkOption {
+        type = format.type;
+        default = { };
+        description = ''
+          Configuration for Klipper. See the <link xlink:href="https://www.klipper3d.org/Overview.html#configuration-and-tuning-guides">documentation</link>
+          for supported values.
+        '';
+      };
+    };
+  };
+
+  ##### implementation
+  config = mkIf cfg.enable {
+    assertions = [{
+      assertion = cfg.octoprintIntegration -> config.services.octoprint.enable;
+      message = "Option klipper.octoprintIntegration requires Octoprint to be enabled on this system. Please enable services.octoprint to use it.";
+    }];
+
+    environment.etc."klipper.cfg".source = format.generate "klipper.cfg" cfg.settings;
+
+    systemd.services.klipper = {
+      description = "Klipper 3D Printer Firmware";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        ExecStart = "${package}/lib/klipper/klippy.py --input-tty=/run/klipper/tty /etc/klipper.cfg";
+        RuntimeDirectory = "klipper";
+        SupplementaryGroups = [ "dialout" ];
+        WorkingDirectory = "${package}/lib";
+      } // (if cfg.octoprintIntegration then {
+        Group = config.services.octoprint.group;
+        User = config.services.octoprint.user;
+      } else {
+        DynamicUser = true;
+        User = "klipper";
+      });
+    };
+  };
+}
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@ -239,7 +239,7 @@ in

    system.nssModules = optional cfg.nssmdns pkgs.nssmdns;
    system.nssDatabases.hosts = optionals cfg.nssmdns (mkMerge [
-      [ "mdns_minimal [NOTFOUND=return]" ]
+      (mkOrder 900 [ "mdns_minimal [NOTFOUND=return]" ]) # must be before resolve
      (mkOrder 1501 [ "mdns" ]) # 1501 to ensure it's after dns
    ]);

--- a/nixos/modules/services/networking/dnsdist.nix
+++ b/nixos/modules/services/networking/dnsdist.nix
@ -35,25 +35,18 @@ in {
    };
  };

-  config = mkIf config.services.dnsdist.enable {
+  config = mkIf cfg.enable {
+    systemd.packages = [ pkgs.dnsdist ];
+
    systemd.services.dnsdist = {
-      description = "dnsdist load balancer";
      wantedBy = [ "multi-user.target" ];
-      after = ["network.target"];

      serviceConfig = {
-        Restart="on-failure";
-        RestartSec="1";
        DynamicUser = true;
-        StartLimitInterval="0";
-        PrivateDevices=true;
-        AmbientCapabilities="CAP_NET_BIND_SERVICE";
-        CapabilityBoundingSet="CAP_NET_BIND_SERVICE";
-        ExecStart = "${pkgs.dnsdist}/bin/dnsdist --supervised --disable-syslog --config ${configFile}";
-        ProtectHome=true;
-        RestrictAddressFamilies="AF_UNIX AF_INET AF_INET6";
-        LimitNOFILE="16384";
-        TasksMax="8192";
+
+        # upstream overrides for better nixos compatibility
+        ExecStartPre = [ "" "${pkgs.dnsdist}/bin/dnsdist --check-config --config ${configFile}" ];
+        ExecStart = [ "" "${pkgs.dnsdist}/bin/dnsdist --supervised --disable-syslog --config ${configFile}" ];
      };
    };
  };
--- a/nixos/modules/services/system/dbus.nix
+++ b/nixos/modules/services/system/dbus.nix
@ -19,6 +19,12 @@ in

 {

+  imports = [
+    (mkRemovedOptionModule
+      [ "services" "dbus" "socketActivated" ]
+      "The user D-Bus session is now always socket activated and this option can safely be removed.")
+  ];
+
  ###### interface

  options = {
@ -51,14 +57,6 @@ in
          <filename><replaceable>pkg</replaceable>/share/dbus-1/services</filename>
        '';
      };
-
-      socketActivated = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Make the user instance socket activated.
-        '';
-      };
    };
  };

@ -108,7 +106,7 @@ in
        reloadIfChanged = true;
        restartTriggers = [ configDir ];
      };
-      sockets.dbus.wantedBy = mkIf cfg.socketActivated [ "sockets.target" ];
+      sockets.dbus.wantedBy = [ "sockets.target" ];
    };

    environment.pathsToLink = [ "/etc/dbus-1" "/share/dbus-1" ];
--- a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
+++ b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
@ -167,8 +167,8 @@ in {
    services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
      ${poolName} = {
        user = "icingaweb2";
+        phpPackage = pkgs.php.withExtensions ({ enabled, all }: [ all.imagick ] ++ enabled);
        phpOptions = ''
-          extension = ${pkgs.phpPackages.imagick}/lib/php/extensions/imagick.so
          date.timezone = "${cfg.timezone}"
        '';
        settings = mapAttrs (name: mkDefault) {
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -374,7 +374,9 @@ in
        baobab
        cheese
        eog
-        epiphany
+        /* Not in good standing on nixos:
+         * https://github.com/NixOS/nixpkgs/issues/98819
+        /* epiphany */
        gedit
        gnome-calculator
        gnome-calendar
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -37,13 +37,6 @@ let
      . /etc/profile
      cd "$HOME"

-      ${optionalString cfg.startDbusSession ''
-        if test -z "$DBUS_SESSION_BUS_ADDRESS"; then
-          /run/current-system/systemd/bin/systemctl --user start dbus.socket
-          export `/run/current-system/systemd/bin/systemctl --user show-environment | grep '^DBUS_SESSION_BUS_ADDRESS'`
-        fi
-      ''}
-
      ${optionalString cfg.displayManager.job.logToJournal ''
        if [ -z "$_DID_SYSTEMD_CAT" ]; then
          export _DID_SYSTEMD_CAT=1
--- a/nixos/modules/services/x11/window-managers/xmonad.nix
+++ b/nixos/modules/services/x11/window-managers/xmonad.nix
@ -4,13 +4,15 @@ with lib;
 let
  inherit (lib) mkOption mkIf optionals literalExample;
  cfg = config.services.xserver.windowManager.xmonad;
-  xmonad = pkgs.xmonad-with-packages.override {
+
+  xmonad-vanilla = pkgs.xmonad-with-packages.override {
    ghcWithPackages = cfg.haskellPackages.ghcWithPackages;
    packages = self: cfg.extraPackages self ++
                     optionals cfg.enableContribAndExtras
                     [ self.xmonad-contrib self.xmonad-extras ];
  };
-  xmonadBin = pkgs.writers.writeHaskell "xmonad" {
+
+  xmonad-config = pkgs.writers.writeHaskellBin "xmonad" {
    ghc = cfg.haskellPackages.ghc;
    libraries = [ cfg.haskellPackages.xmonad ] ++
                cfg.extraPackages cfg.haskellPackages ++
@ -19,8 +21,10 @@ let
    inherit (cfg) ghcArgs;
  } cfg.config;

-in
-{
+  xmonad = if (cfg.config != null) then xmonad-config else xmonad-vanilla;
+in {
+  meta.maintainers = with maintainers; [ lassulus xaverdh ];
+
  options = {
    services.xserver.windowManager.xmonad = {
      enable = mkEnableOption "xmonad";
@ -62,19 +66,50 @@ in
        default = null;
        type = with lib.types; nullOr (either path str);
        description = ''
-          Configuration from which XMonad gets compiled. If no value
-          is specified, the xmonad config from $HOME/.xmonad is taken.
-          If you use xmonad --recompile, $HOME/.xmonad will be taken as
-          the configuration, but on the next restart of display-manager
-          this config will be reapplied.
+          Configuration from which XMonad gets compiled. If no value is
+          specified, a vanilla xmonad binary is put in PATH, which will
+          attempt to recompile and exec your xmonad config from $HOME/.xmonad.
+          This setup is then analogous to other (non-NixOS) linux distributions.
+
+          If you do set this option, you likely want to use "launch" as your
+          entry point for xmonad (as in the example), to avoid xmonads
+          recompilation logic on startup. Doing so will render the default
+          "mod+q" restart key binding dysfunctional though, because that attempts
+          to call your binary with the "--restart" command line option, unless
+          you implement that yourself. You way mant to bind "mod+q" to
+          <literal>(restart "xmonad" True)</literal> instead, which will just restart
+          xmonad from PATH. This allows e.g. switching to the new xmonad binary,
+          after rebuilding your system with nixos-rebuild.
+
+          If you actually want to run xmonad with a config specified here, but
+          also be able to recompile and restart it from a copy of that source in
+          $HOME/.xmonad on the fly, you will have to implement that yourself
+          using something like "compileRestart" from the example.
+          This should allow you to switch at will between the local xmonad and
+          the one NixOS puts in your PATH.
        '';
        example = ''
          import XMonad
+          import XMonad.Util.EZConfig (additionalKeys)
+          import Text.Printf (printf)
+          import System.Posix.Process (executeFile)
+          import System.Info (arch,os)
+          import System.Environment (getArgs)
+          import System.FilePath ((</>))
+
+          compiledConfig = printf "xmonad-%s-%s" arch os
+
+          compileRestart = whenX (recompile True) . catchIO $ do
+              dir  <- getXMonadDataDir
+              args <- getArgs
+              executeFile (dir </> compiledConfig) False args Nothing

          main = launch defaultConfig
              { modMask = mod4Mask -- Use Super instead of Alt
-                 , terminal = "urxvt"
-                 }
+              , terminal = "urxvt" }
+              `additionalKeys`
+              [ ( (mod4Mask,xK_r), compileRestart )
+              , ( (mod4Mask,xK_q), restart "xmonad" True ) ]
        '';
      };

@ -101,10 +136,8 @@ in
    services.xserver.windowManager = {
      session = [{
        name = "xmonad";
-        start = let
-          xmonadCommand = if (cfg.config != null) then xmonadBin else "${xmonad}/bin/xmonad";
-        in ''
-           systemd-cat -t xmonad -- ${xmonadCommand} ${lib.escapeShellArgs cfg.xmonadCliArgs} &
+        start = ''
+           systemd-cat -t xmonad -- ${xmonad}/bin/xmonad ${lib.escapeShellArgs cfg.xmonadCliArgs} &
           waitPID=$!
        '';
      }];
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -152,6 +152,9 @@ in
      ./desktop-managers/default.nix
      (mkRemovedOptionModule [ "services" "xserver" "startGnuPGAgent" ]
        "See the 16.09 release notes for more information.")
+      (mkRemovedOptionModule
+        [ "services" "xserver" "startDbusSession" ]
+        "The user D-Bus session is now always socket activated and this option can safely be removed.")
      (mkRemovedOptionModule ["services" "xserver" "useXFS" ]
        "Use services.xserver.fontPath instead of useXFS")
    ];
@ -299,14 +302,6 @@ in
        description = "DPI resolution to use for X server.";
      };

-      startDbusSession = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Whether to start a new DBus session when you log in with dbus-launch.
-        '';
-      };
-
      updateDbusEnvironment = mkOption {
        type = types.bool;
        default = false;
@ -716,7 +711,7 @@ in

    system.extraDependencies = singleton (pkgs.runCommand "xkb-validated" {
      inherit (cfg) xkbModel layout xkbVariant xkbOptions;
-      nativeBuildInputs = [ pkgs.xkbvalidate ];
+      nativeBuildInputs = with pkgs.buildPackages; [ xkbvalidate ];
      preferLocalBuild = true;
    } ''
      xkbvalidate "$xkbModel" "$layout" "$xkbVariant" "$xkbOptions"
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@ -200,9 +200,7 @@ def main():
    else:
        # Update bootloader to latest if needed
        systemd_version = subprocess.check_output(["@systemd@/bin/bootctl", "--version"], universal_newlines=True).split()[1]
-        # Ideally this should use check_output as well, but as a temporary
-        # work-around for #97433 we ignore any errors.
-        sdboot_status = subprocess.run(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "status"], universal_newlines=True, stdout=subprocess.PIPE).stdout
+        sdboot_status = subprocess.check_output(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "status"], universal_newlines=True)

        # See status_binaries() in systemd bootctl.c for code which generates this
        m = re.search("^\W+File:.*/EFI/(BOOT|systemd)/.*\.efi \(systemd-boot (\d+)\)$",
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -391,6 +391,10 @@ in
        end with a letter or digit, and have as interior characters only
        letters, digits, and hyphen. The maximum length is 63 characters.
        Additionally it is recommended to only use lower-case characters.
+        If (e.g. for legacy reasons) a FQDN is required as the Linux kernel
+        network node hostname (uname --nodename) the option
+        boot.kernel.sysctl."kernel.hostname" can be used as a workaround (but
+        the 64 character limit still applies).
      '';
    };

@ -470,7 +474,7 @@ in

    networking.search = mkOption {
      default = [];
-      example = [ "example.com" "local.domain" ];
+      example = [ "example.com" "home.arpa" ];
      type = types.listOf types.str;
      description = ''
        The list of search paths used when resolving domain names.
@ -479,7 +483,7 @@ in

    networking.domain = mkOption {
      default = null;
-      example = "home";
+      example = "home.arpa";
      type = types.nullOr types.str;
      description = ''
        The domain.  It can be left empty if it is auto-detected through DHCP.
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@ -97,6 +97,19 @@ in import ./make-test-python.nix ({ lib, ... }: {
        };
      };

+      # Test OCSP Stapling
+      specialisation.ocsp-stapling.configuration = { pkgs, ... }: {
+        security.acme.certs."a.example.test" = {
+          ocspMustStaple = true;
+        };
+        services.nginx.virtualHosts."a.example.com" = {
+          extraConfig = ''
+            ssl_stapling on;
+            ssl_stapling_verify on;
+          '';
+        };
+      };
+
      # Test using Apache HTTPD
      specialisation.httpd-aliases.configuration = { pkgs, config, lib, ... }: {
        services.nginx.enable = lib.mkForce false;
@ -163,6 +176,7 @@ in import ./make-test-python.nix ({ lib, ... }: {

  testScript = {nodes, ...}:
    let
+      caDomain = nodes.acme.config.test-support.acme.caDomain;
      newServerSystem = nodes.webserver.config.system.build.toplevel;
      switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
    in
@ -246,6 +260,22 @@ in import ./make-test-python.nix ({ lib, ... }: {
              return check_connection_key_bits(node, domain, bits, retries - 1)


+      def check_stapling(node, domain, retries=3):
+          assert retries >= 0
+
+          # Pebble doesn't provide a full OCSP responder, so just check the URL
+          result = node.succeed(
+              "openssl s_client -CAfile /tmp/ca.crt"
+              f" -servername {domain} -connect {domain}:443 < /dev/null"
+              " | openssl x509 -noout -ocsp_uri"
+          )
+          print("OCSP Responder URL:", result)
+
+          if "${caDomain}:4002" not in result.lower():
+              time.sleep(1)
+              return check_stapling(node, domain, retries - 1)
+
+
      client.start()
      dnsserver.start()

@ -253,7 +283,7 @@ in import ./make-test-python.nix ({ lib, ... }: {
      client.wait_for_unit("default.target")

      client.succeed(
-          'curl --data \'{"host": "acme.test", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'
+          'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'
      )

      acme.start()
@ -262,8 +292,8 @@ in import ./make-test-python.nix ({ lib, ... }: {
      acme.wait_for_unit("default.target")
      acme.wait_for_unit("pebble.service")

-      client.succeed("curl https://acme.test:15000/roots/0 > /tmp/ca.crt")
-      client.succeed("curl https://acme.test:15000/intermediate-keys/0 >> /tmp/ca.crt")
+      client.succeed("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")
+      client.succeed("curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt")

      with subtest("Can request certificate with HTTPS-01 challenge"):
          webserver.wait_for_unit("acme-finished-a.example.test.target")
@ -290,6 +320,11 @@ in import ./make-test-python.nix ({ lib, ... }: {
          check_connection_key_bits(client, "a.example.test", "384")
          webserver.succeed("grep testing /var/lib/acme/a.example.test/test")

+      with subtest("Correctly implements OCSP stapling"):
+          switch_to(webserver, "ocsp-stapling")
+          webserver.wait_for_unit("acme-finished-a.example.test.target")
+          check_stapling(client, "a.example.test")
+
      with subtest("Can request certificate with HTTPS-01 when nginx startup is delayed"):
          switch_to(webserver, "slow-startup")
          webserver.wait_for_unit("acme-finished-slow.example.com.target")
--- a/nixos/tests/agda.nix
+++ b/nixos/tests/agda.nix
@ -31,7 +31,7 @@ in
    machine.succeed('echo "import IO" > TestIO.agda')
    machine.succeed("agda -l standard-library -i . TestIO.agda")

-    # # Hello world
+    # Hello world
    machine.succeed(
        "cp ${hello-world} HelloWorld.agda"
    )
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -26,6 +26,7 @@ in
  agda = handleTest ./agda.nix {};
  atd = handleTest ./atd.nix {};
  avahi = handleTest ./avahi.nix {};
+  avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
  babeld = handleTest ./babeld.nix {};
  bazarr = handleTest ./bazarr.nix {};
  bcachefs = handleTestOn ["x86_64-linux"] ./bcachefs.nix {}; # linux-4.18.2018.10.12 is unsupported on aarch64
@ -112,6 +113,7 @@ in
  fontconfig-default-fonts = handleTest ./fontconfig-default-fonts.nix {};
  freeswitch = handleTest ./freeswitch.nix {};
  fsck = handleTest ./fsck.nix {};
+  ft2-clone = handleTest ./ft2-clone.nix {};
  gerrit = handleTest ./gerrit.nix {};
  gotify-server = handleTest ./gotify-server.nix {};
  grocy = handleTest ./grocy.nix {};
--- a/nixos/tests/avahi.nix
+++ b/nixos/tests/avahi.nix
@ -1,5 +1,11 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+# bool: whether to use networkd in the tests
+, networkd ? false }:
+
 # Test whether `avahi-daemon' and `libnss-mdns' work as expected.
-import ./make-test-python.nix ({ pkgs, ... } : {
+import ./make-test-python.nix ({ ... } : {
  name = "avahi";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ eelco ];
@ -17,6 +23,11 @@ import ./make-test-python.nix ({ pkgs, ... } : {
        publish.workstation = true;
        extraServiceFiles.ssh = "${pkgs.avahi}/etc/avahi/services/ssh.service";
      };
+    } // pkgs.lib.optionalAttrs (networkd) {
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+      };
    };
  in {
    one = cfg;
--- a/nixos/tests/cagebreak.nix
+++ b/nixos/tests/cagebreak.nix
@ -5,7 +5,6 @@ let
    workspaces 1
    escape C-t
    bind t exec env DISPLAY=:0 ${pkgs.xterm}/bin/xterm -cm -pc
-    bind a exec ${pkgs.alacritty}/bin/alacritty
  '';
 in
 {
@ -20,7 +19,7 @@ in
  in {
    imports = [ ./common/user-account.nix ];

-    environment.systemPackages = [ pkgs.cagebreak ];
+    environment.systemPackages = [ pkgs.cagebreak pkgs.wallutils ];
    services.xserver = {
      enable = true;
      displayManager.autoLogin = {
@ -32,7 +31,7 @@ in
      manage = "desktop";
      name = "cagebreak";
      start = ''
-        export XDG_RUNTIME_DIR=/run/user/${toString alice.uid}
+        export XDG_RUNTIME_DIR="/run/user/${toString alice.uid}"
        ${pkgs.cagebreak}/bin/cagebreak &
        waitPID=$!
      '';
@ -74,24 +73,20 @@ in

  testScript = { nodes, ... }: let
    user = nodes.machine.config.users.users.alice;
+    XDG_RUNTIME_DIR = "/run/user/${toString user.uid}";
  in ''
    start_all()
    machine.wait_for_unit("multi-user.target")
-    machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
+    machine.wait_for_file("${XDG_RUNTIME_DIR}/wayland-0")

-    with subtest("ensure wayland works with alacritty"):
-        machine.send_key("ctrl-t")
-        machine.send_key("a")
-        machine.wait_until_succeeds("pgrep alacritty")
-        machine.wait_for_text("alice@machine")
-        machine.screenshot("screen")
-        machine.send_key("ctrl-d")
+    with subtest("ensure wayland works with wayinfo from wallutils"):
+        machine.succeed("env XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR} wayinfo")

    with subtest("ensure xwayland works with xterm"):
        machine.send_key("ctrl-t")
        machine.send_key("t")
        machine.wait_until_succeeds("pgrep xterm")
-        machine.wait_for_text("alice@machine")
+        machine.wait_for_text("${user.name}@machine")
        machine.screenshot("screen")
        machine.send_key("ctrl-d")
  '';
--- a/nixos/tests/common/acme/server/default.nix
+++ b/nixos/tests/common/acme/server/default.nix
@ -70,7 +70,7 @@ let
    privateKey = testCerts.${domain}.key;
    httpPort = 80;
    tlsPort = 443;
-    ocspResponderURL = "http://0.0.0.0:4002";
+    ocspResponderURL = "http://${domain}:4002";
    strict = true;
  };

--- a/nixos/tests/ft2-clone.nix
+++ b/nixos/tests/ft2-clone.nix
@ -0,0 +1,35 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "ft2-clone";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  machine = { config, pkgs, ... }: {
+    imports = [
+      ./common/x11.nix
+    ];
+
+    services.xserver.enable = true;
+    sound.enable = true;
+    environment.systemPackages = [ pkgs.ft2-clone ];
+  };
+
+  enableOCR = true;
+
+  testScript =
+    ''
+      machine.wait_for_x()
+      # Add a dummy sound card, or the program won't start
+      machine.execute("modprobe snd-dummy")
+
+      machine.execute("ft2-clone &")
+
+      machine.wait_for_window(r"Fasttracker")
+      machine.sleep(5)
+      # One of the few words that actually get recognized
+      if "Songlen" not in machine.get_screen_text():
+          raise Exception("Program did not start successfully")
+      machine.screenshot("screen")
+    '';
+})
+
--- a/nixos/tests/systemd-networkd-vrf.nix
+++ b/nixos/tests/systemd-networkd-vrf.nix
@ -38,14 +38,14 @@ in {
          matchConfig.Name = "vrf1";
          networkConfig.IPForward = "yes";
          routes = [
-            { routeConfig = { Destination = "192.168.1.2"; Metric = "100"; }; }
+            { routeConfig = { Destination = "192.168.1.2"; Metric = 100; }; }
          ];
        };
        networks."10-vrf2" = {
          matchConfig.Name = "vrf2";
          networkConfig.IPForward = "yes";
          routes = [
-            { routeConfig = { Destination = "192.168.2.3"; Metric = "100"; }; }
+            { routeConfig = { Destination = "192.168.2.3"; Metric = 100; }; }
          ];
        };

--- a/nixos/tests/xmonad.nix
+++ b/nixos/tests/xmonad.nix
@ -14,9 +14,16 @@ import ./make-test-python.nix ({ pkgs, ...} : {
      extraPackages = with pkgs.haskellPackages; haskellPackages: [ xmobar ];
      config = ''
        import XMonad
+        import XMonad.Operations (restart)
        import XMonad.Util.EZConfig
-        main = launch $ def `additionalKeysP` myKeys
-        myKeys = [ ("M-C-x", spawn "xterm") ]
+        import XMonad.Util.SessionStart
+
+        main = launch $ def { startupHook = startup } `additionalKeysP` myKeys
+
+        startup = isSessionStart >>= \sessInit ->
+          if sessInit then setSessionStarted else spawn "xterm"
+
+        myKeys = [ ("M-C-x", spawn "xterm"), ("M-q", restart "xmonad" True) ]
      '';
    };
  };
@ -30,12 +37,11 @@ import ./make-test-python.nix ({ pkgs, ...} : {
    machine.send_key("alt-ctrl-x")
    machine.wait_for_window("${user.name}.*machine")
    machine.sleep(1)
-    machine.screenshot("terminal")
-    machine.wait_until_succeeds("xmonad --restart")
+    machine.screenshot("terminal1")
+    machine.send_key("alt-q")
    machine.sleep(3)
-    machine.send_key("alt-shift-ret")
    machine.wait_for_window("${user.name}.*machine")
    machine.sleep(1)
-    machine.screenshot("terminal")
+    machine.screenshot("terminal2")
  '';
 })
--- a/pkgs/applications/audio/a2jmidid/default.nix
+++ b/pkgs/applications/audio/a2jmidid/default.nix
@ -1,38 +1,24 @@
-{ stdenv, fetchurl, fetchpatch, makeWrapper, pkgconfig, alsaLib, dbus, libjack2
-, wafHook
-, python2Packages}:
+{ stdenv, fetchFromGitHub, fetchpatch, makeWrapper, pkgconfig, alsaLib, dbus, libjack2
+, python3Packages , meson, ninja }:

-let
-  inherit (python2Packages) python dbus-python;
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "a2jmidid";
-  version = "8";
+  version = "9";

-  src = fetchurl {
-    url = "https://github.com/linuxaudio/a2jmidid/archive/7383d268c4bfe85df9f10df6351677659211d1ca.tar.gz";
-    sha256 = "06dgf5655znbvrd7fhrv8msv6zw8vk0hjqglcqkh90960mnnmwz7";
+  src = fetchFromGitHub {
+    owner = "linuxaudio";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-WNt74tSWV8bY4TnpLp86PsnrjkqWynJJt3Ra4gZl2fQ=";
  };

-  nativeBuildInputs = [ pkgconfig makeWrapper wafHook ];
-  buildInputs = [ alsaLib dbus libjack2 python dbus-python ];
-
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/linuxaudio/a2jmidid/commit/24e3b8e543256ae8fdfb4b75eb9fd775f07c46e2.diff";
-      sha256 = "1nxrvnhxlgqc9wbxnp1gnpw4wjyzxvymwcg1gh2nqzmssgfykfkc";
-    })
-    (fetchpatch {
-      url = "https://github.com/linuxaudio/a2jmidid/commit/7f82da7eb2f540a94db23331be98d42a58ddc269.diff";
-      sha256 = "1nab9zf0agbcj5pvhl90pz0cx1d204d4janqflc5ymjhy8jyrsdv";
-    })
-    (fetchpatch {
-      url = "https://github.com/linuxaudio/a2jmidid/commit/c07775d021a71cb91bf64ce1391cf525415cb060.diff";
-      sha256 = "172v9hri03qdqi8a3zsg227k5qxldd8v5bj4jk7fyk5jf50fcxga";
-    })
-  ];
+  nativeBuildInputs = [ pkgconfig makeWrapper meson ninja ];
+  buildInputs = [ alsaLib dbus libjack2 ] ++
+                (with python3Packages; [ python dbus-python ]);

  postInstall = ''
    wrapProgram $out/bin/a2j_control --set PYTHONPATH $PYTHONPATH
+    substituteInPlace $out/bin/a2j --replace "a2j_control" "$out/bin/a2j_control"
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@ -1,8 +1,10 @@
 { stdenv
 , fetchFromGitHub
 , cmake
+, nixosTests
 , alsaLib
 , SDL2
+, libiconv
 }:

 stdenv.mkDerivation rec {
@ -17,7 +19,13 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ cmake ];
-  buildInputs = [ SDL2 ] ++ stdenv.lib.optional stdenv.isLinux alsaLib;
+  buildInputs = [ SDL2 ]
+    ++ stdenv.lib.optional stdenv.isLinux alsaLib
+    ++ stdenv.lib.optional stdenv.isDarwin libiconv;
+
+  passthru.tests = {
+    ft2-clone-starts = nixosTests.ft2-clone;
+  };

  meta = with stdenv.lib; {
    description = "A highly accurate clone of the classic Fasttracker II software for MS-DOS";
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@ -2,11 +2,12 @@
 , makeWrapper, pkgconfig, perlPackages
 }:

-stdenv.mkDerivation {
-  name = "jamin-0.95.0";
+stdenv.mkDerivation rec {
+  version = "0.95.0";
+  name = "jamin-${version}";

  src = fetchurl {
-    url = "mirror://sourceforge/jamin/jamin-0.95.0.tar.gz";
+    url = "mirror://sourceforge/jamin/jamin-${version}.tar.gz";
    sha256 = "0g5v74cm0q3p3pzl6xmnp4rqayaymfli7c6z8s78h9rgd24fwbvn";
  };

--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl
-, pkgconfig, cmake, python, ffmpeg_3, phonon, automoc4
+, pkgconfig, cmake, python3, ffmpeg_3, phonon, automoc4
 , chromaprint, docbook_xml_dtd_45, docbook_xsl, libxslt
 , id3lib, taglib, mp4v2, flac, libogg, libvorbis
 , zlib, readline , qtbase, qttools, qtmultimedia, qtquickcontrols
@ -7,18 +7,17 @@
 }:

 stdenv.mkDerivation rec {
-
  pname = "kid3";
-  version = "3.8.3";
+  version = "3.8.4";

  src = fetchurl {
    url = "mirror://sourceforge/project/kid3/kid3/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0i0c4bmsm36jj1v535kil47ig0ig70ykrzcw2f56spr25xns06ka";
+    sha256 = "sha256-WYuEOqMu2VMOv6mkVCRXnmInFER/DWfPNqYuaTJ3vAc=";
  };

  nativeBuildInputs = [ wrapQtAppsHook ];
-  buildInputs = with stdenv.lib;
-  [ pkgconfig cmake python ffmpeg_3 phonon automoc4
+  buildInputs = [
+    pkgconfig cmake python3 ffmpeg_3 phonon automoc4
    chromaprint docbook_xml_dtd_45 docbook_xsl libxslt
    id3lib taglib mp4v2 flac libogg libvorbis zlib readline
    qtbase qttools qtmultimedia qtquickcontrols ];
@ -35,34 +34,33 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "A simple and powerful audio tag editor";
    longDescription = ''
-      If you want to easily tag multiple MP3, Ogg/Vorbis, FLAC, MPC,
-      MP4/AAC, MP2, Opus, Speex, TrueAudio, WavPack, WMA, WAV and AIFF
-      files (e.g. full albums) without typing the same information
-      again and again and have control over both ID3v1 and ID3v2 tags,
-      then Kid3 is the program you are looking for.
+      If you want to easily tag multiple MP3, Ogg/Vorbis, FLAC, MPC, MP4/AAC,
+      MP2, Opus, Speex, TrueAudio, WavPack, WMA, WAV and AIFF files (e.g. full
+      albums) without typing the same information again and again and have
+      control over both ID3v1 and ID3v2 tags, then Kid3 is the program you are
+      looking for.

      With Kid3 you can:
      - Edit ID3v1.1 tags;
      - Edit all ID3v2.3 and ID3v2.4 frames;
      - Convert between ID3v1.1, ID3v2.3 and ID3v2.4 tags
-      - Edit tags in MP3, Ogg/Vorbis, FLAC, MPC, MP4/AAC, MP2, Opus,
-        Speex, TrueAudio, WavPack, WMA, WAV, AIFF files and tracker
-        modules (MOD, S3M, IT, XM);
-      -  Edit tags of multiple files, e.g. the artist, album, year and
-         genre of all files of an album typically have the same values
-         and can be set together;
+      - Edit tags in MP3, Ogg/Vorbis, FLAC, MPC, MP4/AAC, MP2, Opus, Speex,
+        TrueAudio, WavPack, WMA, WAV, AIFF files and tracker modules (MOD, S3M,
+        IT, XM);
+      - Edit tags of multiple files, e.g. the artist, album, year and genre of
+        all files of an album typically have the same values and can be set
+        together;
      - Generate tags from filenames;
      - Generate tags from the contents of tag fields;
      - Generate filenames from tags;
      - Rename and create directories from tags;
      - Generate playlist files;
      - Automatically convert upper and lower case and replace strings;
-      - Import from gnudb.org, TrackType.org, MusicBrainz, Discogs,
-        Amazon and other sources of album data;
-      - Export tags as CSV, HTML, playlists, Kover XML and in other
-        formats;
-      - Edit synchronized lyrics and event timing codes, import and
-        export LRC files
+      - Import from gnudb.org, TrackType.org, MusicBrainz, Discogs, Amazon and
+        other sources of album data;
+      - Export tags as CSV, HTML, playlists, Kover XML and in other formats;
+      - Edit synchronized lyrics and event timing codes, import and export
+        LRC files.
    '';
    homepage = "http://kid3.sourceforge.net/";
    license = licenses.lgpl2Plus;
--- a/pkgs/applications/audio/mamba/default.nix
+++ b/pkgs/applications/audio/mamba/default.nix
@ -5,6 +5,7 @@
 , fluidsynth
 , libX11
 , libjack2
+, alsaLib
 , liblo
 , libsigcxx
 , libsmf
@ -12,18 +13,18 @@

 stdenv.mkDerivation rec {
  pname = "mamba";
-  version = "1.5";
+  version = "1.6";

  src = fetchFromGitHub {
    owner = "brummer10";
    repo = "Mamba";
    rev = "v${version}";
-    sha256 = "1l74ckqqrccgsdy430pfsbv4fbzny7zivx399bi2jk1lv06p4h9a";
+    sha256 = "02w47347cbfqxybh908ww5ifd9jcns8v0msycq59y9q7x0a2h6fh";
    fetchSubmodules = true;
  };

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ cairo fluidsynth libX11 libjack2 liblo libsigcxx libsmf ];
+  buildInputs = [ cairo fluidsynth libX11 libjack2 alsaLib liblo libsigcxx libsmf ];

  makeFlags = [ "PREFIX=$(out)" ];

--- a/pkgs/applications/audio/mopidy/mpris.nix
+++ b/pkgs/applications/audio/mopidy/mpris.nix
@ -2,12 +2,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "mopidy-mpris";
-  version = "3.0.1";
+  version = "3.0.2";

  src = python3Packages.fetchPypi {
    inherit version;
    pname = "Mopidy-MPRIS";
-    sha256 = "0qk46aq5r92qgkldzl41x09naww1gv92l4c4hknyl7yymyvm9lr2";
+    sha256 = "0mmdaikw00f43gzjdbvlcvzff6yppm7v8mv012r79adzd992q9y0";
  };

  propagatedBuildInputs = [
@ -18,7 +18,7 @@ python3Packages.buildPythonApplication rec {
  doCheck = false;

  meta = with stdenv.lib; {
-    homepage = https://www.mopidy.com/;
+    homepage = "https://www.mopidy.com/";
    description = "Mopidy extension for controlling Mopidy through D-Bus using the MPRIS specification";
    license = licenses.asl20;
    maintainers = [ maintainers.nickhu ];
--- a/pkgs/applications/audio/mopidy/musicbox-webclient.nix
+++ b/pkgs/applications/audio/mopidy/musicbox-webclient.nix
@ -2,13 +2,13 @@

 pythonPackages.buildPythonApplication rec {
  pname = "mopidy-musicbox-webclient";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "pimusicbox";
    repo = "mopidy-musicbox-webclient";
    rev = "v${version}";
-    sha256 = "1jcfrwsi7axiph3jplqzmcqia9pc46xb2yf13d8h6lnh3h49rwvz";
+    sha256 = "0784s32pap9rbki3f0f7swaf6946sdv4xzidns13jmw9ilifk5z4";
  };

  propagatedBuildInputs = [ mopidy ];
--- a/pkgs/applications/audio/ocenaudio/default.nix
+++ b/pkgs/applications/audio/ocenaudio/default.nix
@ -0,0 +1,54 @@
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, qt5
+, libjack2
+, alsaLib
+, bzip2
+, libpulseaudio }:
+
+stdenv.mkDerivation rec {
+  pname = "ocenaudio";
+  version = "3.9.2";
+
+  src = fetchurl {
+    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
+    sha256 = "1fvpba3dnzb7sm6gp0znbrima02ckfiy2zwb66x1gr05y9a56inv";
+  };
+
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    qt5.qtbase
+    libjack2
+    libpulseaudio
+    bzip2
+    alsaLib
+  ];
+
+  buildInputs = [ dpkg ];
+
+  dontUnpack = true;
+  dontBuild = true;
+  dontStrip = true;
+
+  installPhase = ''
+    mkdir -p $out
+    dpkg -x $src $out
+    cp -av $out/opt/ocenaudio/* $out
+    rm -rf $out/opt
+
+    # Create symlink bzip2 library
+    ln -s ${bzip2.out}/lib/libbz2.so.1 $out/libbz2.so.1.0
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Cross-platform, easy to use, fast and functional audio editor";
+    homepage = "https://www.ocenaudio.com";
+    license = licenses.unfree;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ onny ];
+  };
+}
--- a/pkgs/applications/audio/padthv1/default.nix
+++ b/pkgs/applications/audio/padthv1/default.nix
@ -1,15 +1,15 @@
-{ stdenv, fetchurl, pkgconfig, libjack2, alsaLib, libsndfile, liblo, lv2, qt5, fftw, mkDerivation }:
+{ stdenv, fetchurl, pkgconfig, libjack2, alsaLib, libsndfile, liblo, lv2, qt5, fftwFloat, mkDerivation }:

 mkDerivation rec {
  pname = "padthv1";
-  version = "0.9.16";
+  version = "0.9.17";

  src = fetchurl {
    url = "mirror://sourceforge/padthv1/${pname}-${version}.tar.gz";
-    sha256 = "1f2v60dpja0rnml60g463fjiz0f84v32yjwpvr56z79h1i6fssmv";
+    sha256 = "098fk8fwcgssnfr1gilqg8g17zvch62lrn3rqsswpzbr3an5adb3";
  };

-  buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools fftw ];
+  buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools fftwFloat ];

  nativeBuildInputs = [ pkgconfig ];

--- a/pkgs/applications/audio/qmidinet/default.nix
+++ b/pkgs/applications/audio/qmidinet/default.nix
@ -1,12 +1,12 @@
 { mkDerivation, lib, fetchurl, pkgconfig, qtbase, qttools, alsaLib, libjack2 }:

 mkDerivation rec {
-  version = "0.6.2";
+  version = "0.6.3";
  pname = "qmidinet";

  src = fetchurl {
    url = "mirror://sourceforge/qmidinet/${pname}-${version}.tar.gz";
-    sha256 = "0siqzyhwg3l9av7jbca3bqdww7xspjlpi9ya4mkj211xc3a3a1d6";
+    sha256 = "04jbvnf6yp9l0bhl1ym6zqkmaz8c2az3flq7qgflaxzj3isns1p1";
  };

  hardeningDisable = [ "format" ];
--- a/pkgs/applications/audio/spectmorph/default.nix
+++ b/pkgs/applications/audio/spectmorph/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "spectmorph";
-  version = "0.5.1";
+  version = "0.5.2";
  src = fetchurl {
    url = "http://spectmorph.org/files/releases/${pname}-${version}.tar.bz2";
-    sha256 = "06jrfx5g9c56swxn78lix0gyrjkhi21l9wqs56knp8iqcgfi3m0s";
+    sha256 = "0yrq7mknhk096wfsx0q3b6wwa2w5la0rxa113di26rrrw136xl1f";
  };

  buildInputs = [  libjack2 lv2 glib qt5.qtbase libao cairo libsndfile fftwFloat ];
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@ -1,7 +1,7 @@
 { fetchurl, stdenv, squashfsTools, xorg, alsaLib, makeWrapper, openssl, freetype
 , glib, pango, cairo, atk, gdk-pixbuf, gtk2, cups, nspr, nss, libpng, libnotify
 , libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg_3, curl, zlib, gnome3
-, at-spi2-atk, at-spi2-core, libpulseaudio
+, at-spi2-atk, at-spi2-core, libpulseaudio, libdrm, mesa
 }:

 let
@ -10,15 +10,14 @@ let
  # If an update breaks things, one of those might have valuable info:
  # https://aur.archlinux.org/packages/spotify/
  # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.1.26.501.gbe11e53b-15";
+  version = "1.1.42.622.gbd112320-37";
  # To get the latest stable revision:
  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
  # To get general information:
  # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
  # More examples of api usage:
  # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "41";
-
+  rev = "42";

  deps = [
    alsaLib
@ -36,10 +35,12 @@ let
    gdk-pixbuf
    glib
    gtk2
+    libdrm
    libgcrypt
    libnotify
    libpng
    libpulseaudio
+    mesa
    nss
    pango
    stdenv.cc.cc
@ -77,7 +78,7 @@ stdenv.mkDerivation {
  # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
  src = fetchurl {
    url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    sha512 = "41bc8d20388bab39058d0709d99b1c8e324ea37af217620797356b8bc0b24aedbe801eaaa6e00a93e94e26765602e5dc27ad423ce2e777b4bec1b92daf04f81e";
+    sha512 = "06371c6a285aba916a779cd9f2a933f97db8fb38393545baa94c8984302e003c559af7b1b35afd7df5f2c35e379e2cb80c00facf527bc22df09061cdb67d9d7a";
  };

  buildInputs = [ squashfsTools makeWrapper ];
--- a/pkgs/applications/audio/wolf-shaper/default.nix
+++ b/pkgs/applications/audio/wolf-shaper/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "wolf-shaper";
-  version = "0.1.7";
+  version = "0.1.8";

  src = fetchFromGitHub {
    owner = "pdesaulniers";
    repo = "wolf-shaper";
    rev = "v${version}";
-    sha256 = "0lllgcbnnh1m95bp29hh17x170hl7170zizjrvy892qfkn36830d";
+    sha256 = "1j9xmh1nkf45ay1c5dz2g165qvrwlanzcq6mvb3nfxar265drd9q";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/audio/xtuner/default.nix
+++ b/pkgs/applications/audio/xtuner/default.nix
@ -0,0 +1,39 @@
+{ stdenv
+, fetchFromGitHub
+, pkg-config
+, cairo
+, libX11
+, libjack2
+, liblo
+, libsigcxx
+, zita-resampler
+, fftwFloat
+}:
+
+stdenv.mkDerivation rec {
+  pname = "xtuner";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "brummer10";
+    repo = "XTuner";
+    rev = "v${version}";
+    sha256 = "1i5chfnf3hcivwzni9z6cn9pb68qmwsx8bf4z7d29a5vig8kbhrv";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ cairo libX11 libjack2 liblo libsigcxx zita-resampler fftwFloat ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/brummer10/XTuner";
+    description = "Tuner for Jack Audio Connection Kit";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ magnetophon ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/zam-plugins/default.nix
+++ b/pkgs/applications/audio/zam-plugins/default.nix
@ -1,14 +1,15 @@
-{ stdenv, fetchgit , boost, libX11, libGL, liblo, libjack2, ladspaH, lv2, pkgconfig, rubberband, libsndfile, fftwFloat, libsamplerate }:
+{ stdenv, fetchFromGitHub, boost, libX11, libGL, liblo, libjack2, ladspaH, lv2, pkgconfig, rubberband, libsndfile, fftwFloat, libsamplerate }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "zam-plugins";
-  version = "3.12";
+  version = "3.13";

-  src = fetchgit {
-    url = "https://github.com/zamaudio/zam-plugins.git";
-    deepClone = true;
-    rev = "87fdee6e87dbee75c1088e2327ea59c1ab1522e4";
-    sha256 = "0kz0xygff3ca1v9nqi0dvrzy9whbzqxrls5b7hydi808d795893n";
+  src = fetchFromGitHub {
+    owner = "zamaudio";
+    repo = pname;
+    rev = version;
+    sha256 = "02blg0iqich4vx5z1ahj6avkh83yqszdiq83p9jd5qwm0i4llqjq";
+    fetchSubmodules = true;
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -9,9 +9,9 @@ let
    inherit buildFHSUserEnv;
  };
  stableVersion = {
-    version = "4.0.1.0"; # "Android Studio 4.0.1"
-    build = "193.6626763";
-    sha256Hash = "15vm7fvi8c286wx9f28z6ysvm8wqqda759qql0zy9simwx22gy7j";
+    version = "4.1.0.19"; # "Android Studio 4.1.0"
+    build = "201.6858069";
+    sha256Hash = "sha256-S5Uh/EpjE61l/z4UsPP7UEJ9Rk/hQidVVWX0bg/60gI=";
  };
  betaVersion = {
    version = "4.1.0.18"; # "Android Studio 4.1 RC 3"
--- a/pkgs/applications/editors/glow/default.nix
+++ b/pkgs/applications/editors/glow/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "glow";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "glow";
    rev = "v${version}";
-    sha256 = "05scgdivb0hf0lfznikn20b6pgb479jhs24hgf5f5i60v37v930y";
+    sha256 ="0jyl5ln7c2naawmw7bljzrldr96xyb5rbis6y6blmyghr0vx07zb";
  };

-  vendorSha256 = "180g6d9w3lfmxj4843kqvq4ikg8lwmwprgfxdgz1lzvjmbfjj3g9";
+  vendorSha256 = "0z3r8fvpy36ybgb18sr0lril1sg8z7s99xv1a6g1v3zdnj3zimav";

  doCheck = false;

--- a/pkgs/applications/editors/kile/default.nix
+++ b/pkgs/applications/editors/kile/default.nix
@ -22,12 +22,11 @@
 }:

 mkDerivation rec {
-  name = "kile-2.9.92";
+  name = "kile-2.9.93";

  src = fetchurl {
    url = "mirror://sourceforge/kile/${name}.tar.bz2";
-    sha256 = "177372dc25b1d109e037a7dbfc64b5dab2efe538320c87f4a8ceada21e9097f2";
-
+    sha256 = "BEmSEv/LJPs6aCkUmnyuTGrV15WYXwgIANbfcviMXfA=";
  };

  nativeBuildInputs = [ extra-cmake-modules wrapGAppsHook ];
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@ -1,7 +1,7 @@
 { stdenv, lib, makeDesktopItem
 , unzip, libsecret, libXScrnSaver, wrapGAppsHook
 , gtk2, atomEnv, at-spi2-atk, autoPatchelfHook
-, systemd, fontconfig
+, systemd, fontconfig, libdbusmenu

 # Attributes inherit from specific versions
 , version, src, meta, sourceRoot
@ -62,7 +62,7 @@ in
      else [ gtk2 at-spi2-atk wrapGAppsHook ] ++ atomEnv.packages)
        ++ [ libsecret libXScrnSaver ];

-    runtimeDependencies = lib.optional (stdenv.isLinux) [ (lib.getLib systemd) fontconfig.lib ];
+    runtimeDependencies = lib.optional (stdenv.isLinux) [ (lib.getLib systemd) fontconfig.lib libdbusmenu ];

    nativeBuildInputs = lib.optional (!stdenv.isDarwin) autoPatchelfHook;

--- a/pkgs/applications/editors/vscode/update-vscode.sh
+++ b/pkgs/applications/editors/vscode/update-vscode.sh
@ -8,10 +8,6 @@ if [ ! -f "$ROOT/vscode.nix" ]; then
  echo "ERROR: cannot find vscode.nix in $ROOT"
  exit 1
 fi
-if [ ! -f "$ROOT/vscodium.nix" ]; then
-  echo "ERROR: cannot find vscodium.nix in $ROOT"
-  exit 1
-fi

 # VSCode

@ -26,16 +22,3 @@ sed -i "s/x86_64-linux = \".\{52\}\"/x86_64-linux = \"${VSCODE_LINUX_SHA256}\"/"
 VSCODE_DARWIN_URL="https://vscode-update.azurewebsites.net/${VSCODE_VER}/darwin/stable"
 VSCODE_DARWIN_SHA256=$(nix-prefetch-url ${VSCODE_DARWIN_URL})
 sed -i "s/x86_64-darwin = \".\{52\}\"/x86_64-darwin = \"${VSCODE_DARWIN_SHA256}\"/" "$ROOT/vscode.nix"
-
-# VSCodium
-
-VSCODIUM_VER=$(curl -Ls -w %{url_effective} -o /dev/null https://github.com/VSCodium/vscodium/releases/latest | awk -F'/' '{print $NF}')
-sed -i "s/version = \".*\"/version = \"${VSCODIUM_VER}\"/" "$ROOT/vscodium.nix"
-
-VSCODIUM_LINUX_URL="https://github.com/VSCodium/vscodium/releases/download/${VSCODIUM_VER}/VSCodium-linux-x64-${VSCODIUM_VER}.tar.gz"
-VSCODIUM_LINUX_SHA256=$(nix-prefetch-url ${VSCODIUM_LINUX_URL})
-sed -i "s/x86_64-linux = \".\{52\}\"/x86_64-linux = \"${VSCODIUM_LINUX_SHA256}\"/" "$ROOT/vscodium.nix"
-
-VSCODIUM_DARWIN_URL="https://github.com/VSCodium/vscodium/releases/download/${VSCODIUM_VER}/VSCodium-darwin-${VSCODIUM_VER}.zip"
-VSCODIUM_DARWIN_SHA256=$(nix-prefetch-url ${VSCODIUM_DARWIN_URL})
-sed -i "s/x86_64-darwin = \".\{52\}\"/x86_64-darwin = \"${VSCODIUM_DARWIN_SHA256}\"/" "$ROOT/vscodium.nix"
--- a/pkgs/applications/editors/vscode/update-vscodium.sh
+++ b/pkgs/applications/editors/vscode/update-vscodium.sh
@ -0,0 +1,23 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnugrep gnused gawk
+
+set -eou pipefail
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+if [ ! -f "$ROOT/vscodium.nix" ]; then
+  echo "ERROR: cannot find vscodium.nix in $ROOT"
+  exit 1
+fi
+
+# VSCodium
+
+VSCODIUM_VER=$(curl -Ls -w %{url_effective} -o /dev/null https://github.com/VSCodium/vscodium/releases/latest | awk -F'/' '{print $NF}')
+sed -i "s/version = \".*\"/version = \"${VSCODIUM_VER}\"/" "$ROOT/vscodium.nix"
+
+VSCODIUM_LINUX_URL="https://github.com/VSCodium/vscodium/releases/download/${VSCODIUM_VER}/VSCodium-linux-x64-${VSCODIUM_VER}.tar.gz"
+VSCODIUM_LINUX_SHA256=$(nix-prefetch-url ${VSCODIUM_LINUX_URL})
+sed -i "s/x86_64-linux = \".\{52\}\"/x86_64-linux = \"${VSCODIUM_LINUX_SHA256}\"/" "$ROOT/vscodium.nix"
+
+VSCODIUM_DARWIN_URL="https://github.com/VSCodium/vscodium/releases/download/${VSCODIUM_VER}/VSCodium-darwin-${VSCODIUM_VER}.zip"
+VSCODIUM_DARWIN_SHA256=$(nix-prefetch-url ${VSCODIUM_DARWIN_URL})
+sed -i "s/x86_64-darwin = \".\{52\}\"/x86_64-darwin = \"${VSCODIUM_DARWIN_SHA256}\"/" "$ROOT/vscodium.nix"
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -11,8 +11,8 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "19y25yfkls53w4qlmipfvjig7zykgwx1010ny58k339fv181vdyq";
-    x86_64-darwin = "1ak3pfvwdg51hcv2kyqpnhzkl7k23k5qk197sf6rv02kgwan7pxl";
+    x86_64-linux = "0fhwqif9021sg22n8qqn3m2fml7sjb03ydgbakg1021i3y8zl599";
+    x86_64-darwin = "1bsvkwymihkv0azf0mmy0f58zsxs6w13in6lfxzaz7s695csn9s0";
  }.${system};

  sourceRoot = {
@ -27,7 +27,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.49.3";
+    version = "1.50.0";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/gis/grass/default.nix
+++ b/pkgs/applications/gis/grass/default.nix
@ -3,6 +3,8 @@
 , proj, gdal, geos, sqlite, postgresql, libmysqlclient, python2Packages, libLAS, proj-datumgrid
 }:

+let inherit (stdenv) lib; in
+
 stdenv.mkDerivation rec {
  name = "grass";
  version = "7.6.1";
@ -42,7 +44,7 @@ stdenv.mkDerivation rec {
    "--with-postgres-libs=${postgresql.lib}/lib/"
    # it complains about missing libmysqld but doesn't really seem to need it
    "--with-mysql"
-    "--with-mysql-includes=${libmysqlclient}/include/mysql"
+    "--with-mysql-includes=${lib.getDev libmysqlclient}/include/mysql"
    "--with-mysql-libs=${libmysqlclient}/lib/mysql"
    "--with-blas"
    "--with-liblas=${libLAS}/bin/liblas-config"
--- a/pkgs/applications/gis/openorienteering-mapper/default.nix
+++ b/pkgs/applications/gis/openorienteering-mapper/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , mkDerivation
 , fetchFromGitHub
+, substituteAll
 , gdal
 , cmake
 , ninja
@ -18,7 +19,7 @@

 mkDerivation rec {
  pname = "OpenOrienteering-Mapper";
-  version = "0.9.3";
+  version = "0.9.4";

  buildInputs = [
    gdal
@ -37,18 +38,14 @@ mkDerivation rec {
    owner = "OpenOrienteering";
    repo = "mapper";
    rev = "v${version}";
-    sha256 = "05bliglpc8170px6k9lfrp9ylpnb2zf47gnjns9b2bif8dv8zq0l";
+    sha256 = "13k9dirqm74lknhr8w121zr1hjd9gm1y73cj4rrj98rx44dzmk7b";
  };

-  patches = [
+  patches = (substituteAll {
    # See https://github.com/NixOS/nixpkgs/issues/86054
-    ./fix-qttranslations-path.diff
-  ];
-
-  postPatch = ''
-    substituteInPlace src/util/translation_util.cpp \
-      --subst-var-by qttranslations ${qttranslations}
-  '';
+    src = ./fix-qttranslations-path.diff;
+    inherit qttranslations;
+  });

  cmakeFlags = [
    # Building the manual and bundling licenses fails
--- a/pkgs/applications/gis/zombietrackergps/default.nix
+++ b/pkgs/applications/gis/zombietrackergps/default.nix
@ -0,0 +1,57 @@
+{ mkDerivation
+, lib
+, fetchFromGitLab
+, qmake
+, qtbase
+, qtcharts
+, qtsvg
+, marble
+, qtwebengine
+, ldutils
+}:
+
+mkDerivation rec {
+  pname = "zombietrackergps";
+  version = "1.01";
+
+  src = fetchFromGitLab {
+    owner = "ldutils-projects";
+    repo = pname;
+    rev = "v_${version}";
+    sha256 = "0h354ydbahy8rpkmzh5ym5bddbl6irjzklpcg6nbkv6apry84d48";
+  };
+
+  buildInputs = [
+    ldutils
+    qtbase
+    qtcharts
+    qtsvg
+    marble.dev
+    qtwebengine
+  ];
+
+  nativeBuildInputs = [
+    qmake
+  ];
+
+  prePatch = ''
+    sed -ie "s,INCLUDEPATH += /usr/include/libldutils,INCLUDEPATH += ${ldutils}," ZombieTrackerGPS.pro
+  '';
+
+  preConfigure = ''
+    export LANG=en_US.UTF-8
+    export INSTALL_ROOT=$out
+  '';
+
+  postConfigure = ''
+    substituteInPlace Makefile --replace '$(INSTALL_ROOT)' ""
+  '';
+
+  meta = with lib; {
+    description = "GPS track manager for Qt using KDE Marble maps";
+    homepage = "https://gitlab.com/ldutils-projects/zombietrackergps";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ sohalt ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/graphics/f3d/default.nix
+++ b/pkgs/applications/graphics/f3d/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitLab, cmake, vtk_9, libX11, libGL, Cocoa, OpenGL }:
+
+stdenv.mkDerivation rec {
+  pname = "f3d";
+  version = "1.0.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.kitware.com";
+    owner = "f3d";
+    repo = "f3d";
+    rev = "v${version}";
+    sha256 = "0a6r0jspkhl735f6zmnhby1g4dlmjqd5izgsp5yfdcdhqj4j63mg";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ vtk_9 ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ libGL libX11 ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Cocoa OpenGL ];
+
+  meta = with stdenv.lib; {
+    description = "Fast and minimalist 3D viewer using VTK";
+    homepage = "https://kitware.github.io/F3D";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ bcdarwin ];
+    platforms = with platforms; unix;
+  };
+}
--- a/pkgs/applications/graphics/lazpaint/default.nix
+++ b/pkgs/applications/graphics/lazpaint/default.nix
@ -7,24 +7,24 @@ let
  bgrabitmap = fetchFromGitHub {
    owner = "bgrabitmap";
    repo = "bgrabitmap";
-    rev = "v11.1";
-    sha256 = "0bcmiiwly4a7w8p3m5iskzvk8rz87qhc0gcijrdvwg87cafd88gz";
+    rev = "v11.2.4";
+    sha256 = "1zk88crfn07md16wg6af4i8nlx4ikkhxq9gfk49jirwimgwbf1md";
  };
  bgracontrols = fetchFromGitHub {
    owner = "bgrabitmap";
    repo = "bgracontrols";
-    rev = "v6.7.2";
-    sha256 = "0cwxzv0rl6crkf6f67mvga5cn5pyhr6ksm8cqhpxjiqi937dnyxx";
+    rev = "v6.9";
+    sha256 = "0hwjlqlwqs4fqxlgay84hccs1lm3c6i9nmq9sxzrip410mggnjyw";
  };
 in stdenv.mkDerivation rec {
  pname = "lazpaint";
-  version = "7.1.3";
+  version = "7.1.4";

  src = fetchFromGitHub {
    owner = "bgrabitmap";
    repo = "lazpaint";
    rev = "v${version}";
-    sha256 = "1sfb5hmhzscz3nv4cmc192jimkg70l4z3q3yxkivhw1hwwsv9cbg";
+    sha256 = "19b0wrjjyvz3g2d2gdsz8ihc1clda5v22yb597an8j9sblp9m0nf";
  };

  nativeBuildInputs = [ lazarus fpc makeWrapper ];
--- a/pkgs/applications/graphics/vuescan/default.nix
+++ b/pkgs/applications/graphics/vuescan/default.nix
@ -0,0 +1,107 @@
+{ stdenv
+, fetchurl
+, gnutar
+, autoPatchelfHook
+, glibc
+, gtk2
+, xorg
+, libgudev
+, undmg
+}:
+
+let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "Unsupported system: ${system}";
+
+  pname = "vuescan";
+
+  # Minor versions are released using the same file name
+  version = "9.7";
+  versionString = builtins.replaceStrings ["."] [""] version;
+
+  src = let
+    base = "https://www.hamrick.com/files/";
+  in {
+    x86_64-darwin = fetchurl {
+      url = "${base}/vuex64${versionString}.dmg";
+      sha256 = "045ihd2pj0zmzjfwn2qmv5114yvs9vf6mw6sf4x3hwcdmpk40sfh";
+    };
+    i686-darwin = fetchurl {
+      url = "${base}/vuex32${versionString}.dmg";
+      sha256 = "0nny1jm3s1nr7xm03mcy3zgxvslznnvc8a5gn93gjww6gwg9rcn6";
+    };
+    x86_64-linux = fetchurl {
+      url = "${base}/vuex64${versionString}.tgz";
+      sha256 = "0jkj92w3y66dcxwq3kkg7vhqxljwf9dqs563xbkh1r7piyjfwycm";
+    };
+    i686-linux = fetchurl {
+      url = "${base}/vuex32${versionString}.tgz";
+      sha256 = "03qac9c0sg21jwz91nzzwk3ml8byv06ay9wiq00dl62nmhs20r5m";
+    };
+    aarch64-linux = fetchurl {
+      url = "${base}/vuea64${versionString}.tgz";
+      sha256 = "17viy7kcb78j0p3ik99psabmkgpwpmgvk96wjhn9aar48gpyr1wj";
+    };
+    armv6l-linux = fetchurl {
+      url = "${base}/vuea32${versionString}.tgz";
+      sha256 = "0m7sp18bdf2l2yf3q3z6c3i0bm4mq2h4ndm6qfvyknip0h11gv7i";
+    };
+  }.${system} or throwSystem;
+
+  meta = with stdenv.lib; {
+    description = "Scanner software supporting a wide range of devices";
+    homepage = "https://hamrick.com/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ evax ];
+    platforms = [
+      "x86_64-darwin" "i686-darwin"
+      "x86_64-linux" "i686-linux"
+      "aarch64-linux" "armv6l-linux"
+    ];
+  };
+
+  linux = stdenv.mkDerivation rec {
+    inherit pname version src meta;
+
+    # Stripping the binary breaks the license form
+    dontStrip = true;
+
+    nativeBuildInputs = [
+      gnutar
+      autoPatchelfHook
+    ];
+
+    buildInputs = [
+      glibc
+      gtk2
+      xorg.libSM
+      libgudev
+    ];
+
+    unpackPhase = ''
+      tar xfz $src
+    '';
+
+    installPhase = ''
+      install -m755 -D VueScan/vuescan $out/bin/vuescan
+    '';
+  };
+
+  darwin = stdenv.mkDerivation {
+    inherit pname version src meta;
+
+    nativeBuildInputs = [ undmg ];
+
+    sourceRoot = {
+      x86_64-darwin = "vuex64${versionString}.dmg";
+      i686-darwin = "vuex32${versionString}.dmg";
+    }.${system} or throwSystem;
+
+    installPhase = ''
+      mkdir -p $out/Applications/VueScan.app
+      cp -R . $out/Applications/VueScan.app
+    '';
+  };
+in if stdenv.isDarwin
+  then darwin
+  else linux
--- a/pkgs/applications/misc/dupeguru/default.nix
+++ b/pkgs/applications/misc/dupeguru/default.nix
@ -1,4 +1,4 @@
-{stdenv, python3Packages, gettext, qt5, fetchFromGitHub}:
+{stdenv, python3Packages, fetchpatch, gettext, qt5, fetchFromGitHub}:

 python3Packages.buildPythonApplication rec {
  pname = "dupeguru";
@ -14,6 +14,15 @@ python3Packages.buildPythonApplication rec {
    fetchSubmodules = true;
  };

+  patches = [
+    # already merged to master, remove next version bump
+    (fetchpatch {
+      name = "remove-m-from-so-var.patch";
+      url = "https://github.com/arsenetar/dupeguru/commit/bd0f53bcbe463c48fe141b73af13542da36d82ba.patch";
+      sha256 = "07iisz8kcr7v8lb21inzj1avlpfhh9k8wcivbd33w49cr3mmnr26";
+    })
+  ];
+
  nativeBuildInputs = [
    gettext
    python3Packages.pyqt5
@ -58,6 +67,5 @@ python3Packages.buildPythonApplication rec {
    license = licenses.bsd3;
    platforms = platforms.linux;
    maintainers = [ maintainers.novoxudonoser ];
-    broken = true; # mv: cannot stat '_block.cpython-38m*.so': No such file or directory
  };
 }
--- a/pkgs/applications/misc/foot/default.nix
+++ b/pkgs/applications/misc/foot/default.nix
@ -5,12 +5,12 @@

 stdenv.mkDerivation rec {
  pname = "foot";
-  version = "1.4.4";
+  version = "1.5.1";

  src = fetchgit {
    url = "https://codeberg.org/dnkl/foot.git";
-    rev = "${version}";
-    sha256 = "1cr4sz075v18clh8nlvgyxlbvfkhbsg0qrqgnclip5rwa24ry1lg";
+    rev = version;
+    sha256 = "sha256-GAk2qkrgCNILJOeRcn1NT4t3w+R6WFTZ1goOhBEwKwc=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -2,16 +2,21 @@

 python3Packages.buildPythonApplication rec {
  pname = "gallery_dl";
-  version = "1.15.0";
+  version = "1.15.1";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "1g9hmb5637x8bhm2wzarqnxzj0i93fcdm1myvld2d97a2d32hy6m";
+    sha256 = "1pysh0gz3f3dxk5bfkzaii4myrgik396mf6vlks50inpbnslmqsl";
  };

-  doCheck = false;
  propagatedBuildInputs = with python3Packages; [ requests ];

+  checkInputs = with python3Packages; [ pytestCheckHook ];
+  pytestFlagsArray = [
+    # requires network access
+    "--ignore=test/test_results.py"
+  ];
+
  meta = {
    description = "Command-line program to download image-galleries and -collections from several image hosting sites";
    homepage = "https://github.com/mikf/gallery-dl";
--- a/pkgs/applications/misc/gnome-passwordsafe/default.nix
+++ b/pkgs/applications/misc/gnome-passwordsafe/default.nix
@ -0,0 +1,80 @@
+{ stdenv
+, meson
+, ninja
+, pkg-config
+, gettext
+, fetchFromGitLab
+, python3
+, libhandy
+, libpwquality
+, wrapGAppsHook
+, gtk3
+, glib
+, gdk-pixbuf
+, gobject-introspection
+, desktop-file-utils
+, appstream-glib }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "gnome-passwordsafe";
+  version = "3.99.2";
+  format = "other";
+  strictDeps = false; # https://github.com/NixOS/nixpkgs/issues/56943
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "PasswordSafe";
+    rev = version;
+    sha256 = "0pi2l4gwf8paxm858mxrcsk5nr0c0zw5ycax40mghndb6b1qmmhf";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    gettext
+    pkg-config
+    wrapGAppsHook
+    desktop-file-utils
+    appstream-glib
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    gtk3
+    glib
+    gdk-pixbuf
+    libhandy
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pygobject3
+    construct
+
+    # pykeepass 3.2.1 changed some exception types, and is not backwards compatible.
+    # Remove override once the MR is merged upstream.
+    # https://gitlab.gnome.org/World/PasswordSafe/-/merge_requests/79
+    (pykeepass.overridePythonAttrs (old: rec {
+      version = "3.2.0";
+      src = fetchPypi {
+        pname = "pykeepass";
+        inherit version;
+        sha256 = "1ysjn92bixq8wkwhlbhrjj9z0h80qnlnj7ks5478ndkzdw5gxvm1";
+      };
+      propagatedBuildInputs = old.propagatedBuildInputs ++ [ pycryptodome ];
+    }))
+
+  ] ++ [
+    libpwquality # using the python bindings
+  ];
+
+  meta = with stdenv.lib; {
+    broken = stdenv.hostPlatform.isStatic; # libpwquality doesn't provide bindings when static
+    description = "Password manager for GNOME which makes use of the KeePass v.4 format";
+    homepage = "https://gitlab.gnome.org/World/PasswordSafe";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mvnetbiz ];
+  };
+}
+
--- a/pkgs/applications/misc/golden-cheetah/default.nix
+++ b/pkgs/applications/misc/golden-cheetah/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, mkDerivation
+{ stdenv, fetchFromGitHub, fetchpatch, mkDerivation
 , qtbase, qtsvg, qtserialport, qtwebengine, qtmultimedia, qttools
 , qtconnectivity, qtcharts, libusb-compat-0_1
 , yacc, flex, zlib, qmake, makeDesktopItem, makeWrapper
@ -16,13 +16,13 @@ let
  };
 in mkDerivation rec {
  pname = "golden-cheetah";
-  version = "3.5-RC2X";
+  version = "3.5";

  src = fetchFromGitHub {
    owner = "GoldenCheetah";
    repo = "GoldenCheetah";
    rev = "V${version}";
-    sha256 = "1d85700gjbcw2badwz225rjdr954ai89900vp8sal04sk79wbr6g";
+    sha256 = "1lyd0b2s3s9c2ppj7l4hf3s4gfzscaaam2pbiaby714bi9nr0ka7";
  };

  buildInputs = [
@ -31,6 +31,15 @@ in mkDerivation rec {
  ];
  nativeBuildInputs = [ flex makeWrapper qmake yacc ];

+  patches = [
+    # allow building with bison 3.7
+    # PR at https://github.com/GoldenCheetah/GoldenCheetah/pull/3590
+    (fetchpatch {
+      url = "https://github.com/GoldenCheetah/GoldenCheetah/commit/e1f42f8b3340eb4695ad73be764332e75b7bce90.patch";
+      sha256 = "1h0y9vfji5jngqcpzxna5nnawxs77i1lrj44w8a72j0ah0sznivb";
+    })
+  ];
+
  NIX_LDFLAGS = "-lz";

  qtWrapperArgs = [ "--set LD_LIBRARY_PATH ${zlib.out}/lib" ];
--- a/pkgs/applications/misc/googler/default.nix
+++ b/pkgs/applications/misc/googler/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "googler";
-  version = "4.2";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "jarun";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0c480wzc7q4pks1f6mnayr580c73jhzshliz4hgznzc7zwcdf41w";
+    sha256 = "04wa0mlbfjnzwham2dpd9lch7800js4vp3ikgjl4qnwilvr1lw74";
  };

  buildInputs = [ python ];
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    homepage = "https://github.com/jarun/googler";
    description = "Google Search, Google Site Search, Google News from the terminal";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ koral filalex77 ];
    platforms = python.meta.platforms;
  };
--- a/pkgs/applications/misc/gsimplecal/default.nix
+++ b/pkgs/applications/misc/gsimplecal/default.nix
@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
    sha256 = "1sa05ifjp41xipfspk5n6l3wzpzmp3i45q88l01p4l6k6drsq336";
  };

+  postPatch = ''
+    sed -ie '/sys\/sysctl.h/d' src/Unique.cpp
+  '';
+
  enableParallelBuilding = true;

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/misc/ipmiview/default.nix
+++ b/pkgs/applications/misc/ipmiview/default.nix
@ -13,12 +13,12 @@

 stdenv.mkDerivation rec {
  pname = "IPMIView";
-  version = "2.16.0";
-  buildVersion = "190815";
+  version = "2.17.0";
+  buildVersion = "200505";

  src = fetchurl {
    url = "https://www.supermicro.com/wftp/utility/IPMIView/Linux/IPMIView_${version}_build.${buildVersion}_bundleJRE_Linux_x64.tar.gz";
-    sha256 = "0qw9zfnj0cyvab7ndamlw2y0gpczjhh1jkz8340kl42r2xmhkvpl";
+    sha256 = "0ba0694krj2q77zwdn22v2qzjdy52a7ryhgc3m51s7p17ahigz97";
  };

  nativeBuildInputs = [ patchelf makeWrapper ];
@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
    patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ libX11 libXext libXrender libXtst libXi ]}" ./jre/lib/amd64/libawt_xawt.so
    patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ freetype ]}" ./jre/lib/amd64/libfontmanager.so
    patchelf --set-rpath "${gcc-unwrapped.lib}/lib" ./libiKVM64.so
+    patchelf --set-rpath "${gcc-unwrapped.lib}/lib" ./libiKVM_v11_64.so
    patchelf --set-rpath "${gcc.cc}/lib:$out/jre/lib/amd64/jli" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/java
    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./BMCSecurity/${stunnelBinary}
  '';
@ -41,7 +42,7 @@ stdenv.mkDerivation rec {
    exec = "IPMIView";
    desktopName = name;
    genericName = "Supermicro BMC manager";
-    categories = "Network;Configuration";
+    categories = "Network";
  };

  installPhase = ''
@ -60,7 +61,7 @@ stdenv.mkDerivation rec {
      --add-flags "-jar $out/IPMIView20.jar" \
      --run 'WORK_DIR=''${XDG_DATA_HOME:-~/.local/share}/ipmiview
             mkdir -p $WORK_DIR
-             ln -snf '$out'/iKVM.jar '$out'/libiKVM* '$out'/libSharedLibrary* $WORK_DIR
+             ln -snf '$out'/iKVM.jar '$out'/iKVM_ssl.jar '$out'/libiKVM* '$out'/libSharedLibrary* $WORK_DIR
             cd $WORK_DIR'
  '';

--- a/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/pkgs/applications/misc/joplin-desktop/default.nix
@ -2,7 +2,7 @@

 let
  pname = "joplin-desktop";
-  version = "1.1.4";
+  version = "1.2.6";
  name = "${pname}-${version}";

  inherit (stdenv.hostPlatform) system;
@ -16,8 +16,8 @@ let
  src = fetchurl {
    url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}.${suffix}";
    sha256 = {
-      x86_64-linux = "1jgmjwjl2y3nrywnwidpk6p31sypy3gjghmzzqkrgjpf77ccbssm";
-      x86_64-darwin = "1v06k4qrk3n1ncgpmnqp4axmn7gvs3mgbvf8n6ldhgjhj3hq9day";
+      x86_64-linux = "14svzfhszb0pnsajbydsic0rdc64zp6csqjp6k2p2i20jf0c0im6";
+      x86_64-darwin = "1wdv8idnvn5567xdmsaa3f7skv48i9q6jqd4pgv8pz1zkhiqj0wi";
    }.${system} or throwSystem;
  };

--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@ -1,15 +1,15 @@
 { stdenv, fetchurl, fetchsvn, makeWrapper, unzip, jre, libXxf86vm }:
 let
  pname = "josm";
-  version = "17013";
+  version = "17084";
  srcs = {
    jar = fetchurl {
      url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      sha256 = "0dgfiqk5bcbs03llkffm6h96zcqa19azbanac883g26f6z6j9b8j";
+      sha256 = "0avzpzmvv371jpbph9xpq0ia2nikha2aib9v10hr2f9q7vka9zx4";
    };
    macosx = fetchurl {
      url = "https://josm.openstreetmap.de/download/macosx/josm-macosx-${version}.zip";
-      sha256 = "1mzaxcswmxah0gc9cifgaazwisr5cbanf4bspv1ra8xwzj5mdss6";
+      sha256 = "1vd2r4sshjpd6ic460cdil75skrm6f6q48lm6n3g1ywkn4mx63p1";
    };
    pkg = fetchsvn {
      url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
--- a/pkgs/applications/misc/koreader/default.nix
+++ b/pkgs/applications/misc/koreader/default.nix
@ -0,0 +1,52 @@
+{ stdenv
+, fetchurl
+, makeWrapper
+, dpkg
+, luajit
+, gtk3-x11
+, SDL2
+, glib
+, noto-fonts
+, nerdfonts }:
+let font-droid = nerdfonts.override { fonts = [ "DroidSansMono" ]; };
+in stdenv.mkDerivation rec {
+  pname = "koreader";
+  version = "2020.09";
+
+  src = fetchurl {
+    url =
+      "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
+    sha256 = "12kiw3mw8g8d9fb8ywd4clm2bgblhq2gqcxzadwpmf0wxq7p0v8z";
+  };
+
+  sourceRoot = ".";
+  nativeBuildInputs = [ makeWrapper dpkg ];
+  buildInputs = [ luajit gtk3-x11 SDL2 glib ];
+  unpackCmd = "dpkg-deb -x ${src} .";
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out
+    cp -R usr/* $out/
+    cp ${luajit}/bin/luajit $out/lib/koreader/luajit
+    find $out -xtype l -delete
+    for i in ${noto-fonts}/share/fonts/truetype/noto/*; do
+        ln -s "$i" $out/lib/koreader/fonts/noto/
+    done
+    ln -s "${font-droid}/share/fonts/opentype/NerdFonts/Droid Sans Mono Nerd Font Complete Mono.otf" $out/lib/koreader/fonts/droid/DroidSansMono.ttf
+    wrapProgram $out/bin/koreader --prefix LD_LIBRARY_PATH : ${
+      stdenv.lib.makeLibraryPath [ gtk3-x11 SDL2 glib ]
+    }
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/koreader/koreader";
+    description =
+      "An ebook reader application supporting PDF, DjVu, EPUB, FB2 and many more formats, running on Cervantes, Kindle, Kobo, PocketBook and Android devices";
+    platforms = intersectLists platforms.x86_64 platforms.linux;
+    license = licenses.agpl3;
+    maintainers = [ maintainers.contrun ];
+  };
+}
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@ -255,13 +255,13 @@ in {

  displaylayerprogress = buildPlugin rec {
    pname = "OctoPrint-DisplayLayerProgress";
-    version = "1.23.2";
+    version = "1.24.0";

    src = fetchFromGitHub {
      owner = "OllisGit";
      repo = pname;
      rev = version;
-      sha256 = "0yv8gy5dq0rl7zxkvqa98az391aiixl8wbzkyvbmpjar9r6whdzm";
+      sha256 = "1lbivg3rcjzv8zqvp8n8gcaczxdm7gvd5ihjb6jq0fgf958lv59n";
    };

    meta = with stdenv.lib; {
@ -272,15 +272,34 @@ in {
    };
  };

+  octoklipper = buildPlugin rec {
+    pname = "OctoKlipper";
+    version = "0.3.2";
+
+    src = fetchFromGitHub {
+      owner = "AliceGrey";
+      repo = "OctoprintKlipperPlugin";
+      rev = version;
+      sha256 = "15yg2blbgqp2gdpsqqm8qiiznq5qaq8wss07jimkl0865vrvlz7l";
+    };
+
+    meta = with stdenv.lib; {
+      description = "A plugin for a better integration of Klipper into OctoPrint";
+      homepage = "https://github.com/AliceGrey/OctoprintKlipperPlugin";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ lovesegfault ];
+    };
+  };
+
  octoprint-dashboard = buildPlugin rec {
    pname = "OctoPrint-Dashboard";
-    version = "1.13.0";
+    version = "1.15.1";

    src = fetchFromGitHub {
      owner = "StefanCohen";
      repo = pname;
      rev = version;
-      sha256 = "1879l05gkkryvhxkmhr3xvd10d4m7i0cr3jk1gdcv47xwyr6q9pf";
+      sha256 = "1psk069g8xdpgbzmna51dh978vrildh33dn7kbbi5y31ry5c3gx6";
    };

    meta = with stdenv.lib; {
--- a/pkgs/applications/misc/orpie/default.nix
+++ b/pkgs/applications/misc/orpie/default.nix
@ -1,21 +1,30 @@
-{ stdenv, fetchurl, ocamlPackages, ncurses, gsl }:
+{ lib, fetchFromGitHub, ocamlPackages }:

-stdenv.mkDerivation rec {
+ocamlPackages.buildDunePackage rec {
  pname = "orpie";
-  version = "1.5.2";
+  version = "1.6.1";

-  src = fetchurl {
-    url = "http://pessimization.com/software/orpie/${pname}-${version}.tar.gz";
-    sha256 = "0v9xgpcf186ni55rkmx008msyszw0ypd6rd98hgwpih8yv3pymfy";
+  src = fetchFromGitHub {
+    owner = "pelzlpj";
+    repo = pname;
+    rev = "release-${version}";
+    sha256 = "1rx2nl6cdv609pfymnbq53pi3ql5fr4kda8x10ycd9xq2gc4f21g";
  };

-  buildInputs = [ ncurses gsl ] ++ (with ocamlPackages; [ ocaml camlp4 ]);
+  preConfigure = ''
+    patchShebangs scripts
+    substituteInPlace scripts/compute_prefix \
+      --replace '"topfind"' \
+      '"${ocamlPackages.findlib}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/topfind"'
+    export PREFIX=$out
+  '';
+
+  buildInputs = with ocamlPackages; [ curses camlp5 num gsl ];

  meta = {
-    homepage = "https://github.com/pelzlpj/orpie";
-    description = "A fullscreen RPN calculator for the console";
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = with stdenv.lib.maintainers; [ obadz ];
+    inherit (src.meta) homepage;
+    description = "A Curses-based RPN calculator";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ obadz ];
  };
 }
--- a/pkgs/applications/misc/prusa-slicer/super-slicer.nix
+++ b/pkgs/applications/misc/prusa-slicer/super-slicer.nix
@ -3,7 +3,7 @@
 }:
 let
  appname = "SuperSlicer";
-  version = "2.2.53.1";
+  version = "2.2.54.0";
  pname = "super-slicer";
  description = "PrusaSlicer fork with more features and faster development cycle";
  override = super: {
@ -12,7 +12,7 @@ let
    src = fetchFromGitHub {
      owner = "supermerill";
      repo = "SuperSlicer";
-      sha256 = "sha256-CAhwmQ63N/XJYToTnIV84lNnjDGNbkmYPzNKNL/wVxs=";
+      sha256 = "sha256-vvuUecysSdBvGBKOariQnsGJ9/Qccwp/lSq8WCED+Uk=";
      rev = version;
    };

@ -23,8 +23,7 @@ let

    postInstall = ''
      mkdir -p "$out/share/pixmaps/"
-      # Change slic3r++ to SuperSlicer at the next release!
-      ln -s "$out/share/slic3r++/icons/Slic3r.png" "$out/share/pixmaps/${appname}.png"
+      ln -s "$out/share/SuperSlicer/icons/Slic3r.png" "$out/share/pixmaps/${appname}.png"
      mkdir -p "$out/share/applications"
      cp "$desktopItem"/share/applications/* "$out/share/applications/"
    '';
--- a/pkgs/applications/misc/smos/default.nix
+++ b/pkgs/applications/misc/smos/default.nix
@ -0,0 +1,26 @@
+{ stdenv
+, fetchurl
+, unzip
+}:
+
+stdenv.mkDerivation rec {
+  name = "smos-${version}";
+  version = "0.1.0";
+
+  src = fetchurl {
+    url = "https://github.com/NorfairKing/smos/releases/download/v${version}/smos-release.zip";
+    sha256 = "sha256:07yavk7xl92yjwwjdig90yq421n8ldv4fjfw7izd4hfpzw849a12";
+  };
+
+  phases = [ "unpackPhase" ];
+  unpackCmd = "${unzip}/bin/unzip -d $out $curSrc";
+  sourceRoot = ".";
+
+  meta = with stdenv.lib; {
+    description = "A comprehensive self-management system";
+    homepage = https://smos.online;
+    license = licenses.mit;
+    maintainers = with maintainers; [ norfair ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
--- a/pkgs/applications/misc/st/default.nix
+++ b/pkgs/applications/misc/st/default.nix
@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
  inherit patches;

  configFile = optionalString (conf!=null) (writeText "config.def.h" conf);
-  postPatch = optionalString (conf!=null) "cp ${configFile} config.def.h";
+
+  postPatch = optionalString (conf!=null) "cp ${configFile} config.def.h"
+            + optionalString stdenv.isDarwin ''
+    substituteInPlace config.mk --replace "-lrt" ""
+  '';

  nativeBuildInputs = [ pkgconfig ncurses ];
  buildInputs = [ libX11 libXft ] ++ extraLibs;
@ -28,7 +32,7 @@ stdenv.mkDerivation rec {
    homepage = "https://st.suckless.org/";
    description = "Simple Terminal for X from Suckless.org Community";
    license = licenses.mit;
-    maintainers = with maintainers; [andsild];
-    platforms = platforms.linux;
+    maintainers = with maintainers; [ andsild ];
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/applications/misc/stretchly/default.nix
+++ b/pkgs/applications/misc/stretchly/default.nix
@ -1,23 +1,33 @@
-{ stdenv, lib, fetchurl, makeWrapper, wrapGAppsHook, electron_7
+{ stdenv
+, lib
+, fetchurl
+, makeWrapper
+, electron_9
 , common-updater-scripts
 , writeShellScript
+, jq
+, makeDesktopItem
 }:

 let
-  electron = electron_7;
+  electron = electron_9;
 in
 stdenv.mkDerivation rec {
+
  pname = "stretchly";
-  version = "0.21.1";
+  version = "1.2.0";

  src = fetchurl {
    url = "https://github.com/hovancik/stretchly/releases/download/v${version}/stretchly-${version}.tar.xz";
-    sha256 = "0776pywyqylwd33m85l4wdr89x0q9xkrjgliag10fp1bswz844lf";
+    sha256 = "07v9yk9qgya9ladfgbfkwwnbzvczs1cv6yn3zrg9rviyv8zlqjls";
  };

-  nativeBuildInputs = [
-    wrapGAppsHook
-  ];
+  icon = fetchurl {
+    url = "https://raw.githubusercontent.com/hovancik/stretchly/v${version}/stretchly_128x128.png";
+    sha256 = "0whfg1fy2hjyk1lzpryikc1aj8agsjhfrb0bf7ggl6r9m8s1rvdl";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];

  installPhase = ''
    runHook preInstall
@ -25,15 +35,15 @@ stdenv.mkDerivation rec {
    mkdir -p $out/bin $out/share/${pname}/
    mv resources/app.asar $out/share/${pname}/

+    mkdir -p $out/share/applications
+    ln -s ${desktopItem}/share/applications/* $out/share/applications/
+
    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/app.asar \
-      "''${gappsWrapperArgs[@]}" \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}"
+      --add-flags $out/share/${pname}/app.asar

    runHook postInstall
  '';

-
  passthru = {
    updateScript = writeShellScript "update-stretchly" ''
      set -eu -o pipefail
@ -47,6 +57,15 @@ stdenv.mkDerivation rec {
    '';
  };

+  desktopItem = makeDesktopItem {
+    name = pname;
+    exec = pname;
+    icon = icon;
+    desktopName = "Stretchly";
+    genericName = "Stretchly";
+    categories = "Utility;";
+  };
+
  meta = with stdenv.lib; {
    description = "A break time reminder app";
    longDescription = ''
@ -59,7 +78,7 @@ stdenv.mkDerivation rec {
    homepage = "https://hovancik.net/stretchly";
    downloadPage = "https://hovancik.net/stretchly/downloads/";
    license = licenses.bsd2;
-    maintainers = with maintainers; [ cdepillabout ];
+    maintainers = with maintainers; [ _1000101 ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/tellico/default.nix
+++ b/pkgs/applications/misc/tellico/default.nix
@ -18,20 +18,21 @@
 , poppler
 , makeWrapper
 , kdoctools
+, taglib
 }:

 mkDerivation rec {
  name = "tellico";
-  version = "3.3.0";
+  version = "3.3.3";

  src = fetchurl {
-    url = "https://tellico-project.org/files/tellico-${lib.versions.majorMinor version}.tar.xz";
-    sha256 = "1digkpvzrsbv5znf1cgzs6zkmysfz6lzs12n12mrrpgkcdxc426y";
-  };
-
-  patches = [
-    ./hex.patch
+    # version 3.3.0 just uses 3.3 in its name
+    urls = [
+      "https://tellico-project.org/files/tellico-${version}.tar.xz"
+      "https://tellico-project.org/files/tellico-${lib.versions.majorMinor version}.tar.xz"
    ];
+    sha256 = "sha256-9cdbUTa2Mt3/yNylOSdGjgDETD74sR0dU4C58uW0Y6o=";
+  };

  nativeBuildInputs = [
    cmake
@ -41,27 +42,28 @@ mkDerivation rec {
  ];

  buildInputs = [
-    kdelibs4support
-    solid
-    kxmlgui
-    karchive
-    kfilemetadata
-    khtml
-    knewstuff
-    libksane
    cmake
    exempi
    extra-cmake-modules
-    libcdio
+    karchive
    kdeApplications.libkcddb
+    kdelibs4support
+    kfilemetadata
+    khtml
+    knewstuff
+    kxmlgui
+    libcdio
+    libksane
    poppler
+    solid
+    taglib
  ];

-  meta = {
+  meta = with lib; {
    description = "Collection management software, free and simple";
    homepage = "https://tellico-project.org/";
-    maintainers = with lib.maintainers; [ numkem ];
-    license = with lib.licenses; [ gpl2 gpl3 ];
-    platforms = lib.platforms.linux;
+    license = with licenses; [ gpl2 gpl3 ];
+    maintainers = with maintainers; [ numkem ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/tzupdate/default.nix
+++ b/pkgs/applications/misc/tzupdate/default.nix
@ -5,11 +5,11 @@ let
 in
 buildPythonApplication rec {
  pname = "tzupdate";
-  version = "2.0.0";
+  version = "2.1.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "12jvyza9pfhazkzq94nizacknnp32lf7kalrjmpz1z2bqqxhx0fm";
+    sha256 = "5b55795c390e4ccc90e649c8cc387447daaf30a21d68f7196b49824cbcba8adc";
  };

  propagatedBuildInputs = [ requests ];
--- a/pkgs/applications/misc/upwork/default.nix
+++ b/pkgs/applications/misc/upwork/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "upwork";
-  version = "5.3.3-883";
+  version = "5.4.7.1";

  src = fetchurl {
-    url = "https://updates-desktopapp.upwork.com/binaries/v5_3_3_883_1f817bc1fefd44e7/upwork_5.3.3.883_amd64.deb";
-    sha256 = "072zns79w4h46bvbj23rvr8i12sf2l378ry0z3hchwcimkrph9wx";
+    url = "https://updates-desktopapp.upwork.com/binaries/v5_4_7_1_81f361962c74427d/${pname}_5.4.7.1_amd64.deb";
+    sha256 = "c443724d37bca942ca126b8b207846a5adb94a92ff9490370f2fe055feee347b";
  };

  dontWrapGApps = true;
@ -50,6 +50,6 @@ stdenv.mkDerivation rec {
    description = "Online freelancing platform desktop application for time tracking";
    homepage = "https://www.upwork.com/ab/downloads/";
    license = licenses.unfree;
-    maintainers = with maintainers; [ zakkor ];
+    maintainers = with maintainers; [ zakkor wolfangaukang ];
  };
 }
--- a/pkgs/applications/misc/wtf/default.nix
+++ b/pkgs/applications/misc/wtf/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "wtf";
-  version = "0.32.0";
+  version = "0.33.0";

  src = fetchFromGitHub {
    owner = "wtfutil";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1055shnf716ga46wwcaffdpgc1glr8vrqrbs2sqbkr3wjan6n0nw";
+    sha256 = "0dszc3igfvlb6dgf5whyhw72id39lqqmgpd42kyqx5yjf5dw2wg7";
   };

-  vendorSha256 = "0l1q29mdb13ir7n1x65jfnrmy1lamlsa6hm2jagf6yjbm6wf1kw4";
+  vendorSha256 = "1wcqk8lfv3jq7dfaj9dj8bzsmq2qislzs1m38gx1hh4jwg1rn2cn";

  doCheck = false;

--- a/pkgs/applications/networking/Sylk/default.nix
+++ b/pkgs/applications/networking/Sylk/default.nix
@ -2,7 +2,7 @@

 let
  pname = "Sylk";
-  version = "2.9.0";
+  version = "2.9.1";
 in

 appimageTools.wrapType2 rec {
@ -10,7 +10,7 @@ appimageTools.wrapType2 rec {

  src = fetchurl {
    url = "http://download.ag-projects.com/Sylk/Sylk-${version}-x86_64.AppImage";
-    hash = "sha256-vhLZkU4MNAlITsJD+xYPDxeimGw6nHn/Rb5nu35uOfQ=";
+    hash = "sha256-Y1FR1tYZTxhMFn6NL578otitmOsngMJBPK/9cpCqE/Q=";
  };

  profile = ''
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@ -13,7 +13,7 @@ mkChromiumDerivation (base: rec {

  installPhase = ''
    mkdir -p "$libExecPath"
-    cp -v "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
+    cp -v "$buildPath/"*.so "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
    cp -v "$buildPath/icudtl.dat" "$libExecPath/"
    cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
    cp -v "$buildPath/chrome" "$libExecPath/$packageName"
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -13,10 +13,9 @@
 , bison, gperf
 , glib, gtk3, dbus-glib
 , glibc
-, xorg
 , libXScrnSaver, libXcursor, libXtst, libGLU, libGL
 , protobuf, speechd, libXdamage, cups
-, ffmpeg_3, libxslt, libxml2, at-spi2-core
+, ffmpeg, libxslt, libxml2, at-spi2-core
 , jre8
 , pipewire_0_2

@ -77,11 +76,16 @@ let
    in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));

  gnSystemLibraries = [
-    "flac" "libwebp" "libxslt" "opus" "snappy" "libpng"
-    # "zlib" # version 77 reports unresolved dependency on //third_party/zlib:zlib_config
-    # "libjpeg" # fails with multiple undefined references to chromium_jpeg_*
+    "ffmpeg"
+    "flac"
+    "libjpeg"
+    "libpng"
+    "libwebp"
+    "libxslt"
+    "opus"
+    "snappy"
+    "zlib"
    # "re2" # fails with linker errors
-    # "ffmpeg" # https://crbug.com/731766
    # "harfbuzz-ng" # in versions over 63 harfbuzz and freetype are being built together
                    # so we can't build with one from system and other from source
  ];
@ -96,7 +100,7 @@ let
    libpng libcap
    xdg_utils minizip libwebp
    libusb1 re2 zlib
-    ffmpeg_3 libxslt libxml2
+    ffmpeg libxslt libxml2
    nasm
    # harfbuzz # in versions over 63 harfbuzz and freetype are being built together
               # so we can't build with one from system and other from source
@ -131,7 +135,6 @@ let
      ninja which python2Packages.python perl pkgconfig
      python2Packages.ply python2Packages.jinja2 nodejs
      gnutar python2Packages.setuptools
-      (xorg.xcbproto.override { python = python2Packages.python; })
    ];

    buildInputs = defaultDependencies ++ [
@ -150,13 +153,9 @@ let
      ++ optional pulseSupport libpulseaudio
      ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];

-    patches = optionals (versionRange "68" "86") [
-      ./patches/nix_plugin_paths_68.patch
-    ] ++ [
-      ./patches/remove-webp-include-69.patch
+    patches = [
      ./patches/no-build-timestamps.patch
      ./patches/widevine-79.patch
-      ./patches/dont-use-ANGLE-by-default.patch
      # Unfortunately, chromium regularly breaks on major updates and
      # then needs various patches backported in order to be compiled with GCC.
      # Good sources for such patches and other hints:
@ -166,18 +165,18 @@ let
      #
      # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
      # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
-    ] ++ optionals (useVaapi && versionRange "68" "86") [ # Improvements for the VA-API build:
-      ./patches/enable-vdpau-support-for-nvidia.patch # https://aur.archlinux.org/cgit/aur.git/tree/vdpau-support.patch?h=chromium-vaapi
-      ./patches/enable-video-acceleration-on-linux.patch # Can be controlled at runtime (i.e. without rebuilding Chromium)
+    ] ++ optionals (useVaapi) [
+      # Check for enable-accelerated-video-decode on Linux:
+      (githubPatch "54deb9811ca9bd2327def5c05ba6987b8c7a0897" "11jvxjlkzz1hm0pvfyr88j7z3zbwzplyl5idkx92l2lzv4459c8d")
    ];

-    postPatch = optionalString (!versionRange "0" "86") ''
+    postPatch = ''
      # Required for patchShebangs (unsupported interpreter directive, basename: invalid option -- '*', etc.):
      substituteInPlace native_client/SConstruct \
        --replace "#! -*- python -*-" ""
      substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
        --replace "/usr/bin/env -S make -f" "/usr/bin/make -f"
-    '' + ''
+
      # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
      substituteInPlace sandbox/linux/suid/client/setuid_sandbox_host.cc \
        --replace \
@ -195,11 +194,6 @@ let
          '/usr/share/locale/' \
          '${glibc}/share/locale/'

-      substituteInPlace ui/gfx/x/BUILD.gn \
-        --replace \
-          '/usr/share/xcb' \
-          '${xorg.xcbproto}/share/xcb/'
-
      sed -i -e 's@"\(#!\)\?.*xdg-@"\1${xdg_utils}/bin/xdg-@' \
        chrome/browser/shell_integration_linux.cc

@ -272,6 +266,7 @@ let
      is_clang = stdenv.cc.isClang;
      clang_use_chrome_plugins = false;
      blink_symbol_level = 0;
+      symbol_level = 0;
      fieldtrial_testing_like_official_build = true;

      # Google API keys, see:
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@ -1,5 +1,5 @@
 { newScope, config, stdenv, fetchurl, makeWrapper
-, llvmPackages_10, llvmPackages_11, ed, gnugrep, coreutils, xdg_utils
+, llvmPackages_11, ed, gnugrep, coreutils, xdg_utils
 , glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
 , libva ? null
 , pipewire_0_2
@ -15,7 +15,7 @@
 , enablePepperFlash ? false
 , enableWideVine ? false
 , useVaapi ? false # Deprecated, use enableVaapi instead!
-, enableVaapi ? false # Disabled by default due to unofficial support and issues on radeon
+, enableVaapi ? false # Disabled by default due to unofficial support
 , useOzone ? false
 , cupsSupport ? true
 , pulseSupport ? config.pulseaudio or stdenv.isLinux
@ -23,7 +23,7 @@
 }:

 let
-  llvmPackages = llvmPackages_10;
+  llvmPackages = llvmPackages_11;
  stdenv = llvmPackages.stdenv;

  callPackage = newScope chromium;
@ -37,16 +37,6 @@ let
      inherit channel gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs
              cupsSupport pulseSupport useOzone;
      # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
-      gnChromium = gn.overrideAttrs (oldAttrs: {
-        version = "2020-05-19";
-        src = fetchgit {
-          url = "https://gn.googlesource.com/gn";
-          rev = "d0a6f072070988e7b038496c4e7d6c562b649732";
-          sha256 = "0197msabskgfbxvhzq73gc3wlr3n9cr4bzrhy5z5irbvy05lxk17";
-        };
-      });
-    } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "86") {
-      llvmPackages = llvmPackages_11;
      gnChromium = gn.overrideAttrs (oldAttrs: {
        version = "2020-07-20";
        src = fetchgit {
@ -56,7 +46,6 @@ let
        };
      });
    } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "87") {
-      llvmPackages = llvmPackages_11;
      useOzone = true; # YAY: https://chromium-review.googlesource.com/c/chromium/src/+/2382834 \o/
      gnChromium = gn.overrideAttrs (oldAttrs: {
        version = "2020-08-17";
@ -163,8 +152,8 @@ let
      Chromium's useVaapi was replaced by enableVaapi and you don't need to pass
      "--ignore-gpu-blacklist" anymore (also no rebuilds are required anymore).
    '' else lib.optionalString
-      (!enableVaapi)
-      "--add-flags --disable-accelerated-video-decode --add-flags --disable-accelerated-video-encode";
+      (enableVaapi)
+      "--add-flags --enable-accelerated-video-decode";
 in stdenv.mkDerivation {
  name = "chromium${suffix}-${version}";
  inherit version;
--- a/pkgs/applications/networking/browsers/chromium/patches/dont-use-ANGLE-by-default.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/dont-use-ANGLE-by-default.patch
@ -1,26 +0,0 @@
-A field trial currently enables the passthrough command decoder, which causes
-gl_factory.cc to try kGLImplementationEGLANGLE first, which causes Chromium to fail
-to load libGLESv2.so on NixOS.  It somehow does not try kGLImplementationDesktopGL,
-and so there is no GL support at all.
-
-Revert to using the validating command decoder, which prevents gl_factory.cc
-from touching allowed_impls, allowing it to successfully use kGLImplementationDesktopGL.
-
-diff --git a/ui/gl/gl_utils.cc b/ui/gl/gl_utils.cc
-index 697cbed5fe2d..8419bdb21a2f 100644
--- a/ui/gl/gl_utils.cc
-+++ b/ui/gl/gl_utils.cc
-@@ -71,9 +71,10 @@ bool UsePassthroughCommandDecoder(const base::CommandLine* command_line) {
-   } else if (switch_value == kCmdDecoderValidatingName) {
-     return false;
-   } else {
-    // Unrecognized or missing switch, use the default.
-    return base::FeatureList::IsEnabled(
-        features::kDefaultPassthroughCommandDecoder);
-+    // Ignore the field trial that enables it; disable it until
-+    // gl_factory.cc kGLImplementationEGLANGLE issues are sorted
-+    // out on NixOS.
-+    return false;
-   }
- }
- }
--- a/pkgs/applications/networking/browsers/chromium/patches/enable-vdpau-support-for-nvidia.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/enable-vdpau-support-for-nvidia.patch
@ -1,65 +0,0 @@
--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
-+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
-@@ -641,6 +641,7 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
-   // |vpp_vaapi_wrapper_| for VaapiPicture to DownloadFromSurface() the VA's
-   // internal decoded frame.
-   if (buffer_allocation_mode_ != BufferAllocationMode::kNone &&
-+      buffer_allocation_mode_ != BufferAllocationMode::kWrapVdpau &&
-       !vpp_vaapi_wrapper_) {
-     vpp_vaapi_wrapper_ = VaapiWrapper::Create(
-         VaapiWrapper::kVideoProcess, VAProfileNone,
-@@ -665,7 +666,8 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
-     PictureBuffer buffer = buffers[i];
-     buffer.set_size(requested_pic_size_);
-     std::unique_ptr<VaapiPicture> picture = vaapi_picture_factory_->Create(
-        (buffer_allocation_mode_ == BufferAllocationMode::kNone)
-+        ((buffer_allocation_mode_ == BufferAllocationMode::kNone) ||
-+         (buffer_allocation_mode_ == BufferAllocationMode::kWrapVdpau))
-             ? vaapi_wrapper_
-             : vpp_vaapi_wrapper_,
-         make_context_current_cb_, bind_image_cb_, buffer);
-@@ -1093,6 +1095,12 @@ VaapiVideoDecodeAccelerator::GetSupportedProfiles() {
-
- VaapiVideoDecodeAccelerator::BufferAllocationMode
- VaapiVideoDecodeAccelerator::DecideBufferAllocationMode() {
-+  // NVIDIA blobs use VDPAU
-+  if (VaapiWrapper::GetImplementationType() == VAImplementation::kNVIDIAVDPAU) {
-+    LOG(INFO) << "VA-API driver on VDPAU backend";
-+    return BufferAllocationMode::kWrapVdpau;
-+  }
-+
-   // TODO(crbug.com/912295): Enable a better BufferAllocationMode for IMPORT
-   // |output_mode_| as well.
-   if (output_mode_ == VideoDecodeAccelerator::Config::OutputMode::IMPORT)
--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.h
-+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.h
-@@ -204,6 +204,7 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
-     // Using |client_|s provided PictureBuffers and as many internally
-     // allocated.
-     kNormal,
-+    kWrapVdpau,
-   };
-
-   // Decides the concrete buffer allocation mode, depending on the hardware
--- a/media/gpu/vaapi/vaapi_wrapper.cc
-+++ b/media/gpu/vaapi/vaapi_wrapper.cc
-@@ -131,6 +131,9 @@ media::VAImplementation VendorStringToImplementationType(
-   } else if (base::StartsWith(va_vendor_string, "Intel iHD driver",
-                               base::CompareCase::SENSITIVE)) {
-     return media::VAImplementation::kIntelIHD;
-+  } else if (base::StartsWith(va_vendor_string, "Splitted-Desktop Systems VDPAU",
-+                              base::CompareCase::SENSITIVE)) {
-+    return media::VAImplementation::kNVIDIAVDPAU;
-   }
-   return media::VAImplementation::kOther;
- }
--- a/media/gpu/vaapi/vaapi_wrapper.h
-+++ b/media/gpu/vaapi/vaapi_wrapper.h
-@@ -79,6 +79,7 @@ enum class VAImplementation {
-   kIntelIHD,
-   kOther,
-   kInvalid,
-+  kNVIDIAVDPAU,
- };
-
- // This class handles VA-API calls and ensures proper locking of VA-API calls
--- a/pkgs/applications/networking/browsers/chromium/patches/enable-video-acceleration-on-linux.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/enable-video-acceleration-on-linux.patch
@ -1,48 +0,0 @@
-From b2144fd28e09cd52e7a88a62a9d9b54cf9922f9f Mon Sep 17 00:00:00 2001
-From: Michael Weiss <dev.primeos@gmail.com>
-Date: Tue, 14 Apr 2020 14:16:10 +0200
-Subject: [PATCH] Enable accelerated video decode on Linux
-
-This will enable accelerated video decode on Linux by default (i.e.
-without "--ignore-gpu-blacklist"), but on NixOS we'll provide
-"--disable-accelerated-video-decode" and
-"--disable-accelerated-video-encode" by default to avoid regressions
-(e.g. VA-API doesn't work properly for some radeon drivers).
-
-Video acceleration can then be enabled via:
-chromium.override { enableVaapi = true; }
-without rebuilding Chromium.
---
- gpu/config/software_rendering_list.json | 16 ----------------
- 1 file changed, 16 deletions(-)
-
-diff --git a/gpu/config/software_rendering_list.json b/gpu/config/software_rendering_list.json
-index 22712bdbf38f..a06dd19a50e4 100644
--- a/gpu/config/software_rendering_list.json
-+++ b/gpu/config/software_rendering_list.json
-@@ -336,22 +336,6 @@
-       ]
-     },
-     {
-      "id": 48,
-      "description": "Accelerated video decode is unavailable on Linux",
-      "cr_bugs": [137247, 1032907],
-      "os": {
-        "type": "linux"
-      },
-      "exceptions": [
-        {
-          "machine_model_name": ["Chromecast"]
-        }
-      ],
-      "features": [
-        "accelerated_video_decode"
-      ]
-    },
-    {
-       "id": 50,
-       "description": "Disable VMware software renderer on older Mesa",
-       "cr_bugs": [145531, 332596, 571899, 629434],
-- 
-2.11.0
-
--- a/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_68.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_68.patch
@ -1,61 +0,0 @@
-diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc
-index f4e119d..d9775bd 100644
--- a/chrome/common/chrome_paths.cc
-+++ b/chrome/common/chrome_paths.cc
-@@ -68,21 +68,14 @@ static base::LazyInstance<base::FilePath>
-     g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER;
- 
- // Gets the path for internal plugins.
-bool GetInternalPluginsDirectory(base::FilePath* result) {
-#if defined(OS_MACOSX)
-  // If called from Chrome, get internal plugins from a subdirectory of the
-  // framework.
-  if (base::mac::AmIBundled()) {
-    *result = chrome::GetFrameworkBundlePath();
-    DCHECK(!result->empty());
-    *result = result->Append("Internet Plug-Ins");
-    return true;
-  }
-  // In tests, just look in the module directory (below).
-#endif
-
-  // The rest of the world expects plugins in the module directory.
-  return base::PathService::Get(base::DIR_MODULE, result);
-+bool GetInternalPluginsDirectory(base::FilePath* result,
-+                                 const std::string& ident) {
-+  std::string full_env = std::string("NIX_CHROMIUM_PLUGIN_PATH_") + ident;
-+  const char* value = getenv(full_env.c_str());
-+  if (value == NULL)
-+      return base::PathService::Get(base::DIR_MODULE, result);
-+  else
-+      *result = base::FilePath(value);
- }
- 
- // Gets the path for bundled implementations of components. Note that these
-@@ -272,7 +265,7 @@ bool PathProvider(int key, base::FilePath* result) {
-       create_dir = true;
-       break;
-     case chrome::DIR_INTERNAL_PLUGINS:
-      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "ALL"))
-         return false;
-       break;
-     case chrome::DIR_COMPONENTS:
-@@ -280,7 +273,7 @@ bool PathProvider(int key, base::FilePath* result) {
-         return false;
-       break;
-     case chrome::DIR_PEPPER_FLASH_PLUGIN:
-      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "PEPPERFLASH"))
-         return false;
-       cur = cur.Append(kPepperFlashBaseDirectory);
-       break;
-@@ -358,7 +351,7 @@ bool PathProvider(int key, base::FilePath* result) {
-         cur = cur.DirName();
-       }
- #else
-      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "PNACL"))
-         return false;
- #endif
-       cur = cur.Append(FILE_PATH_LITERAL("pnacl"));
--- a/pkgs/applications/networking/browsers/chromium/patches/remove-webp-include-69.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/remove-webp-include-69.patch
@ -1,11 +0,0 @@
--- a/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
-+++ b/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
-@@ -13,7 +13,7 @@
-
- #include "jpeglib.h"  // for JPEG_MAX_DIMENSION
-
-#include "third_party/libwebp/src/webp/encode.h"  // for WEBP_MAX_DIMENSION
-+#define WEBP_MAX_DIMENSION 16383
-
- namespace blink {
-
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@ -44,11 +44,11 @@ let

  flash = stdenv.mkDerivation rec {
    pname = "flashplayer-ppapi";
-    version = "32.0.0.433";
+    version = "32.0.0.445";

    src = fetchzip {
      url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1wfwnmai6wnwi6cfxwqix6n471jjyl6nc7p67sa7cfqwg16b53kx";
+      sha256 = "1r9vd210d2qp501q40pjx60mzah08rg0f8jk5rpp52ddajwggalv";
      stripRoot = false;
    };

--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,17 +1,17 @@
 {
  "stable": {
-    "version": "85.0.4183.121",
-    "sha256": "0a1xn39kmvyfpal6pgnylpy30z0322p3v7sx6vxi0r2naiz58670",
-    "sha256bin64": "08vqf1v91703aik47344bl409rsl4myar9bsd2lsvzqncncwsaca"
+    "version": "86.0.4240.75",
+    "sha256": "1ddw4p9zfdzhi5hrd8x14k4w326znljzprnpfi2f917rlpnl2ynx",
+    "sha256bin64": "17isxkd80rccqim6izzl08vw4yr52qsk6djp1rmhhijzg9rsvghz"
  },
  "beta": {
-    "version": "86.0.4240.42",
-    "sha256": "06cfhiym9xmz2q86v6b6xcicrrp2pmr7karavylzz4fqvwd2v6fa",
-    "sha256bin64": "1z5zmdc2i31iimps7p5z43vv4qi83c8ljb7x68zc1rvf8x62p7xj"
+    "version": "86.0.4240.75",
+    "sha256": "1ddw4p9zfdzhi5hrd8x14k4w326znljzprnpfi2f917rlpnl2ynx",
+    "sha256bin64": "16snxdka5bkbvybx6x0dzgfbfaifv0jcc1dcny6vlqqp2fmb2v39"
  },
  "dev": {
-    "version": "87.0.4263.3",
-    "sha256": "1ybfrlm4417lpbg5qcwhq5p6nnxrw68wzyy5zvb1sg1ma8s9hhkk",
-    "sha256bin64": "1f7a272kalglmdwmrrzb4iw3crvvpv3mhxca5jh75qpldn4gby6m"
+    "version": "87.0.4278.0",
+    "sha256": "1ywmv4iwn2as7vk2n0pslnmr300fl5y809ynxiw5xqcx9j6i8w85",
+    "sha256bin64": "15dvwvk6l6n7l04085hr48hlvsijypasyk7d8iq3s6cxai3wx4cl"
  }
 }
--- a/pkgs/applications/networking/browsers/elinks/debian-patches.nix
+++ b/pkgs/applications/networking/browsers/elinks/debian-patches.nix
@ -1,34 +0,0 @@
-# Generated by debian-patches.sh from debian-patches.txt
-let
-  prefix = "https://sources.debian.org/data/main/e/elinks/0.13.2-1/debian/patches";
-in
-[
-  {
-    url = "${prefix}/03_459467_ui.leds.enable_0.diff";
-    sha256 = "0l35lglmnvyzz3xyy18nksra14gsp7yc67rskbzmr61szg8b9jqr";
-  }
-  {
-    url = "${prefix}/04_436817_nostrip.diff";
-    sha256 = "0ixvxaba1ww375gpdh7r67srp3xsfb5vyz2sfv1pgj6mczwg8v24";
-  }
-  {
-    url = "${prefix}/07_617713_cache_control.diff";
-    sha256 = "0drn4r33ywvmihr0drsp2jwz7mlf5z5fv8ra7fpkdavx45xqaf15";
-  }
-  {
-    url = "${prefix}/10-reproducible-build.diff";
-    sha256 = "024yp3xsh0hw29l1wikfmk9j3mqval6pdr4xi7rzffrlaknh58h5";
-  }
-  {
-    url = "${prefix}/14_debug_disable_Werror.diff";
-    sha256 = "0s620r88ikfljflb5nd133cww2wc0i85ag8lzpvrsmg0q00hfmax";
-  }
-  {
-    url = "${prefix}/16_POST_BUFFER_SIZE.diff";
-    sha256 = "17vkvy0d0rabmgk8iqwgdsrgjn6dbb9cf6760qbz82zlb37s09nh";
-  }
-  {
-    url = "${prefix}/11-reproducible-build.diff";
-    sha256 = "1z17g9z68lh12fs6fkralfghh8bs1bs5mlq83d15l4bn3za3s0sl";
-  }
-]
--- a/pkgs/applications/networking/browsers/elinks/debian-patches.txt
+++ b/pkgs/applications/networking/browsers/elinks/debian-patches.txt
@ -1,8 +0,0 @@
-elinks/0.13.2-1
-03_459467_ui.leds.enable_0.diff
-04_436817_nostrip.diff
-07_617713_cache_control.diff
-10-reproducible-build.diff
-14_debug_disable_Werror.diff
-16_POST_BUFFER_SIZE.diff
-11-reproducible-build.diff
--- a/Show More
+++ b/Show More