Merge staging-next into staging

2021-05-03 18:25:49 +00:00 · 2021-05-03 18:25:49 +00:00 · 5e177b16b1
commit 5e177b16b1
parent 7b413bfff9 ab8749a05c
60 changed files with 840 additions and 260 deletions
--- a/lib/types.nix
+++ b/lib/types.nix
@ -337,7 +337,7 @@ rec {
    };

    shellPackage = package // {
-      check = x: (package.check x) && (hasAttr "shellPath" x);
+      check = x: isDerivation x && hasAttr "shellPath" x;
    };

    path = mkOptionType {
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -135,6 +135,7 @@ with lib.maintainers; {
      mguentner
      ekleog
      ralith
+      mjlbach
    ];
    scope = "Maintain the ecosystem around Matrix, a decentralized messenger.";
  };
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@ -333,6 +333,17 @@
      <literal>vim</literal> and <literal>neovim</literal> switched to Python 3, dropping all Python 2 support.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     <link linkend="opt-networking.wireguard.interfaces">networking.wireguard.interfaces.&lt;name&gt;.generatePrivateKeyFile</link>,
+     which is off by default, had a <literal>chmod</literal> race condition
+     fixed. As an aside, the parent directory's permissions were widened,
+     and the key files were made owner-writable.
+     This only affects newly created keys.
+     However, if the exact permissions are important for your setup, read
+     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/121294">#121294</link>.
+    </para>
+   </listitem>
   <listitem>
     <para>
      <link linkend="opt-boot.zfs.forceImportAll">boot.zfs.forceImportAll</link>
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -510,6 +510,7 @@
  ./services/misc/mame.nix
  ./services/misc/matrix-appservice-discord.nix
  ./services/misc/matrix-appservice-irc.nix
+  ./services/misc/matrix-dendrite.nix
  ./services/misc/matrix-synapse.nix
  ./services/misc/mautrix-telegram.nix
  ./services/misc/mbpfan.nix
--- a/nixos/modules/services/cluster/kubernetes/apiserver.nix
+++ b/nixos/modules/services/cluster/kubernetes/apiserver.nix
@ -145,7 +145,7 @@ in
    extraOpts = mkOption {
      description = "Kubernetes apiserver extra command line options.";
      default = "";
-      type = str;
+      type = separatedString " ";
    };

    extraSANs = mkOption {
--- a/nixos/modules/services/cluster/kubernetes/controller-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/controller-manager.nix
@ -38,7 +38,7 @@ in
    extraOpts = mkOption {
      description = "Kubernetes controller manager extra command line options.";
      default = "";
-      type = str;
+      type = separatedString " ";
    };

    featureGates = mkOption {
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@ -142,7 +142,7 @@ in
    extraOpts = mkOption {
      description = "Kubernetes kubelet extra command line options.";
      default = "";
-      type = str;
+      type = separatedString " ";
    };

    featureGates = mkOption {
--- a/nixos/modules/services/cluster/kubernetes/proxy.nix
+++ b/nixos/modules/services/cluster/kubernetes/proxy.nix
@ -25,7 +25,7 @@ in
    extraOpts = mkOption {
      description = "Kubernetes proxy extra command line options.";
      default = "";
-      type = str;
+      type = separatedString " ";
    };

    featureGates = mkOption {
--- a/nixos/modules/services/cluster/kubernetes/scheduler.nix
+++ b/nixos/modules/services/cluster/kubernetes/scheduler.nix
@ -21,7 +21,7 @@ in
    extraOpts = mkOption {
      description = "Kubernetes scheduler extra command line options.";
      default = "";
-      type = str;
+      type = separatedString " ";
    };

    featureGates = mkOption {
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -773,7 +773,7 @@ in
        };

      services.postfix.config = (mapAttrs (_: v: mkDefault v) {
-        compatibility_level  = "9999";
+        compatibility_level  = pkgs.postfix.version;
        mail_owner           = cfg.user;
        default_privs        = "nobody";

--- a/nixos/modules/services/misc/matrix-dendrite.nix
+++ b/nixos/modules/services/misc/matrix-dendrite.nix
@ -0,0 +1,181 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.matrix-dendrite;
+  settingsFormat = pkgs.formats.yaml { };
+  configurationYaml = settingsFormat.generate "dendrite.yaml" cfg.settings;
+  workingDir = "/var/lib/matrix-dendrite";
+in
+{
+  options.services.matrix-dendrite = {
+    enable = lib.mkEnableOption "matrix.org dendrite";
+    httpPort = lib.mkOption {
+      type = lib.types.nullOr lib.types.port;
+      default = 8008;
+      description = ''
+        The port to listen for HTTP requests on.
+      '';
+    };
+    httpsPort = lib.mkOption {
+      type = lib.types.nullOr lib.types.port;
+      default = null;
+      description = ''
+        The port to listen for HTTPS requests on.
+      '';
+    };
+    tlsCert = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      example = "/var/lib/matrix-dendrite/server.cert";
+      default = null;
+      description = ''
+        The path to the TLS certificate.
+
+        <programlisting>
+          nix-shell -p matrix-dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
+        </programlisting>
+      '';
+    };
+    tlsKey = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      example = "/var/lib/matrix-dendrite/server.key";
+      default = null;
+      description = ''
+        The path to the TLS key.
+
+        <programlisting>
+          nix-shell -p matrix-dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
+        </programlisting>
+      '';
+    };
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      example = "/var/lib/matrix-dendrite/registration_secret";
+      default = null;
+      description = ''
+        Environment file as defined in <citerefentry>
+        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
+        </citerefentry>.
+        Secrets may be passed to the service without adding them to the world-readable
+        Nix store, by specifying placeholder variables as the option value in Nix and
+        setting these variables accordingly in the environment file. Currently only used
+        for the registration secret to allow secure registration when
+        client_api.registration_disabled is true.
+
+        <programlisting>
+          # snippet of dendrite-related config
+          services.matrix-dendrite.settings.client_api.registration_shared_secret = "$REGISTRATION_SHARED_SECRET";
+        </programlisting>
+
+        <programlisting>
+          # content of the environment file
+          REGISTRATION_SHARED_SECRET=verysecretpassword
+        </programlisting>
+
+        Note that this file needs to be available on the host on which
+        <literal>dendrite</literal> is running.
+      '';
+    };
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        options.global = {
+          server_name = lib.mkOption {
+            type = lib.types.str;
+            example = "example.com";
+            description = ''
+              The domain name of the server, with optional explicit port.
+              This is used by remote servers to connect to this server.
+              This is also the last part of your UserID.
+            '';
+          };
+          private_key = lib.mkOption {
+            type = lib.types.path;
+            example = "${workingDir}/matrix_key.pem";
+            description = ''
+              The path to the signing private key file, used to sign
+              requests and events.
+
+              <programlisting>
+                nix-shell -p matrix-dendrite --command "generate-keys --private-key matrix_key.pem"
+              </programlisting>
+            '';
+          };
+          trusted_third_party_id_servers = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            example = [ "matrix.org" ];
+            default = [ "matrix.org" "vector.im" ];
+            description = ''
+              Lists of domains that the server will trust as identity
+              servers to verify third party identifiers such as phone
+              numbers and email addresses
+            '';
+          };
+        };
+        options.client_api = {
+          registration_disabled = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+            description = ''
+              Whether to disable user registration to the server
+              without the shared secret.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Configuration for dendrite, see:
+        <link xlink:href="https://github.com/matrix-org/dendrite/blob/master/dendrite-config.yaml"/>
+        for available options with which to populate settings.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [{
+      assertion = cfg.httpsPort != null -> (cfg.tlsCert != null && cfg.tlsKey != null);
+      message = ''
+        If Dendrite is configured to use https, tlsCert and tlsKey must be provided.
+
+        nix-shell -p matrix-dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
+      '';
+    }];
+
+    systemd.services.matrix-dendrite = {
+      description = "Dendrite Matrix homeserver";
+      after = [
+        "network.target"
+      ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        StateDirectory = "matrix-dendrite";
+        WorkingDirectory = workingDir;
+        RuntimeDirectory = "matrix-dendrite";
+        RuntimeDirectoryMode = "0700";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        ExecStartPre =
+          if (cfg.environmentFile != null) then ''
+            ${pkgs.envsubst}/bin/envsubst \
+              -i ${configurationYaml} \
+              -o /run/matrix-dendrite/dendrite.yaml
+          '' else ''
+            ${pkgs.coreutils}/bin/cp ${configurationYaml} /run/matrix-dendrite/dendrite.yaml
+          '';
+        ExecStart = lib.strings.concatStringsSep " " ([
+          "${pkgs.matrix-dendrite}/bin/dendrite-monolith-server"
+          "--config /run/matrix-dendrite/dendrite.yaml"
+        ] ++ lib.optionals (cfg.httpPort != null) [
+          "--http-bind-address :${builtins.toString cfg.httpPort}"
+        ] ++ lib.optionals (cfg.httpsPort != null) [
+          "--https-bind-address :${builtins.toString cfg.httpsPort}"
+          "--tls-cert ${cfg.tlsCert}"
+          "--tls-key ${cfg.tlsKey}"
+        ]);
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        Restart = "on-failure";
+      };
+    };
+  };
+  meta.maintainers = lib.teams.matrix.members;
+}
--- a/nixos/modules/services/misc/pinnwand.nix
+++ b/nixos/modules/services/misc/pinnwand.nix
@ -24,55 +24,80 @@ in
        Your <filename>pinnwand.toml</filename> as a Nix attribute set. Look up
        possible options in the <link xlink:href="https://github.com/supakeen/pinnwand/blob/master/pinnwand.toml-example">pinnwand.toml-example</link>.
      '';
-      default = {
-        # https://github.com/supakeen/pinnwand/blob/master/pinnwand.toml-example
-        database_uri = "sqlite:///var/lib/pinnwand/pinnwand.db";
-        preferred_lexeres = [];
-        paste_size = 262144;
-        paste_help = ''
-          <p>Welcome to pinnwand, this site is a pastebin. It allows you to share code with others. If you write code in the text area below and press the paste button you will be given a link you can share with others so they can view your code as well.</p><p>People with the link can view your pasted code, only you can remove your paste and it expires automatically. Note that anyone could guess the URI to your paste so don't rely on it being private.</p>
-        '';
-        footer = ''
-          View <a href="//github.com/supakeen/pinnwand" target="_BLANK">source code</a>, the <a href="/removal">removal</a> or <a href="/expiry">expiry</a> stories, or read the <a href="/about">about</a> page.
-        '';
-      };
+      default = {};
    };
  };

  config = mkIf cfg.enable {
-    systemd.services.pinnwand = {
-      description = "Pinnwannd HTTP Server";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
+    services.pinnwand.settings = {
+      database_uri = mkDefault "sqlite:////var/lib/pinnwand/pinnwand.db";
+      paste_size = mkDefault 262144;
+      paste_help = mkDefault ''
+        <p>Welcome to pinnwand, this site is a pastebin. It allows you to share code with others. If you write code in the text area below and press the paste button you will be given a link you can share with others so they can view your code as well.</p><p>People with the link can view your pasted code, only you can remove your paste and it expires automatically. Note that anyone could guess the URI to your paste so don't rely on it being private.</p>
+      '';
+      footer = mkDefault ''
+        View <a href="//github.com/supakeen/pinnwand" target="_BLANK">source code</a>, the <a href="/removal">removal</a> or <a href="/expiry">expiry</a> stories, or read the <a href="/about">about</a> page.
+      '';
+    };
+
+    systemd.services = let
+      hardeningOptions = {
+        User = "pinnwand";
+        DynamicUser = true;

-      unitConfig.Documentation = "https://pinnwand.readthedocs.io/en/latest/";
-      serviceConfig = {
-        ExecStart = "${pkgs.pinnwand}/bin/pinnwand --configuration-path ${configFile} http --port ${toString(cfg.port)}";
        StateDirectory = "pinnwand";
        StateDirectoryMode = "0700";

        AmbientCapabilities = [];
        CapabilityBoundingSet = "";
        DevicePolicy = "closed";
-        DynamicUser = true;
        LockPersonality = true;
        MemoryDenyWriteExecute = true;
        PrivateDevices = true;
        PrivateUsers = true;
+        ProcSubset = "pid";
        ProtectClock = true;
        ProtectControlGroups = true;
-        ProtectKernelLogs = true;
        ProtectHome = true;
        ProtectHostname = true;
+        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
-        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
        RestrictNamespaces = true;
        RestrictRealtime = true;
        SystemCallArchitectures = "native";
        SystemCallFilter = "@system-service";
        UMask = "0077";
      };
+
+      command = "${pkgs.pinnwand}/bin/pinnwand --configuration-path ${configFile}";
+    in {
+      pinnwand = {
+        description = "Pinnwannd HTTP Server";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+
+        unitConfig.Documentation = "https://pinnwand.readthedocs.io/en/latest/";
+
+        serviceConfig = {
+          ExecStart = "${command} http --port ${toString(cfg.port)}";
+        } // hardeningOptions;
+      };
+
+      pinnwand-reaper = {
+        description = "Pinnwand Reaper";
+        startAt = "daily";
+
+        serviceConfig = {
+          ExecStart = "${command} -vvvv reap";  # verbosity increased to show number of deleted pastes
+        } // hardeningOptions;
+      };
    };
  };
 }
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@ -246,12 +246,15 @@ let
        };

        script = ''
-          mkdir --mode 0644 -p "${dirOf values.privateKeyFile}"
+          set -e
+
+          # If the parent dir does not already exist, create it.
+          # Otherwise, does nothing, keeping existing permisions intact.
+          mkdir -p --mode 0755 "${dirOf values.privateKeyFile}"
+
          if [ ! -f "${values.privateKeyFile}" ]; then
-            touch "${values.privateKeyFile}"
-            chmod 0600 "${values.privateKeyFile}"
-            wg genkey > "${values.privateKeyFile}"
-            chmod 0400 "${values.privateKeyFile}"
+            # Write private key file with atomically-correct permissions.
+            (set -e; umask 077; wg genkey > "${values.privateKeyFile}")
          fi
        '';
      };
--- a/nixos/modules/services/security/oauth2_proxy_nginx.nix
+++ b/nixos/modules/services/security/oauth2_proxy_nginx.nix
@ -23,7 +23,8 @@ in
  config.services.oauth2_proxy = mkIf (cfg.virtualHosts != [] && (hasPrefix "127.0.0.1:" cfg.proxy)) {
    enable = true;
  };
-  config.services.nginx = mkMerge ((optional (cfg.virtualHosts != []) {
+  config.services.nginx = mkIf config.services.oauth2_proxy.enable (mkMerge
+  ((optional (cfg.virtualHosts != []) {
    recommendedProxySettings = true; # needed because duplicate headers
  }) ++ (map (vhost: {
    virtualHosts.${vhost} = {
@ -60,5 +61,5 @@ in
      '';

    };
-  }) cfg.virtualHosts));
+  }) cfg.virtualHosts)));
 }
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -666,6 +666,7 @@ in
    # The default max inotify watches is 8192.
    # Nowadays most apps require a good number of inotify watches,
    # the value below is used by default on several other distros.
+    boot.kernel.sysctl."fs.inotify.max_user_instances" = mkDefault 524288;
    boot.kernel.sysctl."fs.inotify.max_user_watches" = mkDefault 524288;

    systemd.defaultUnit = mkIf cfg.autorun "graphical.target";
--- a/nixos/modules/virtualisation/amazon-init.nix
+++ b/nixos/modules/virtualisation/amazon-init.nix
@ -16,6 +16,16 @@ let

    userData=/etc/ec2-metadata/user-data

+    # Check if user-data looks like a shell script and execute it with the
+    # runtime shell if it does. Otherwise treat it as a nixos configuration
+    # expression
+    if IFS= LC_ALL=C read -rN2 shebang < $userData && [ "$shebang" = '#!' ]; then
+      # NB: we cannot chmod the $userData file, this is why we execute it via
+      # `pkgs.runtimeShell`. This means we have only limited support for shell
+      # scripts compatible with the `pkgs.runtimeShell`.
+      exec ${pkgs.runtimeShell} $userData
+    fi
+
    if [ -s "$userData" ]; then
      # If the user-data looks like it could be a nix expression,
      # copy it over. Also, look for a magic three-hash comment and set
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -24,6 +24,7 @@ in
  _3proxy = handleTest ./3proxy.nix {};
  acme = handleTest ./acme.nix {};
  agda = handleTest ./agda.nix {};
+  amazon-init-shell = handleTest ./amazon-init-shell.nix {};
  ammonite = handleTest ./ammonite.nix {};
  apparmor = handleTest ./apparmor.nix {};
  atd = handleTest ./atd.nix {};
--- a/nixos/tests/amazon-init-shell.nix
+++ b/nixos/tests/amazon-init-shell.nix
@ -0,0 +1,40 @@
+# This test verifies that the amazon-init service can treat the `user-data` ec2
+# metadata file as a shell script. If amazon-init detects that `user-data` is a
+# script (based on the presence of the shebang #! line) it executes it and
+# exits.
+# Note that other tests verify that amazon-init can treat user-data as a nixos
+# configuration expression.
+
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+makeTest {
+  name = "amazon-init";
+  meta = with maintainers; {
+    maintainers = [ urbas ];
+  };
+  machine = { ... }:
+  {
+    imports = [ ../modules/profiles/headless.nix ../modules/virtualisation/amazon-init.nix ];
+    services.openssh.enable = true;
+    networking.hostName = "";
+    environment.etc."ec2-metadata/user-data" = {
+      text = ''
+        #!/usr/bin/bash
+
+        echo successful > /tmp/evidence
+      '';
+    };
+  };
+  testScript = ''
+    # To wait until amazon-init terminates its run
+    unnamed.wait_for_unit("amazon-init.service")
+
+    unnamed.succeed("grep -q successful /tmp/evidence")
+  '';
+}
--- a/nixos/tests/cage.nix
+++ b/nixos/tests/cage.nix
@ -18,6 +18,10 @@ import ./make-test-python.nix ({ pkgs, ...} :
    };

    virtualisation.memorySize = 1024;
+    # Need to switch to a different VGA card / GPU driver because Cage segfaults with the default one (std):
+    # machine # [   14.355893] .cage-wrapped[736]: segfault at 20 ip 00007f035fa0d8c7 sp 00007ffce9e4a2f0 error 4 in libwlroots.so.8[7f035fa07000+5a000]
+    # machine # [   14.358108] Code: 4f a8 ff ff eb aa 0f 1f 44 00 00 c3 0f 1f 80 00 00 00 00 41 54 49 89 f4 55 31 ed 53 48 89 fb 48 8d 7f 18 48 8d 83 b8 00 00 00 <80> 7f 08 00 75 0d 48 83 3f 00 0f 85 91 00 00 00 48 89 fd 48 83 c7
+    virtualisation.qemu.options = [ "-vga virtio" ];
  };

  enableOCR = true;
@ -25,11 +29,6 @@ import ./make-test-python.nix ({ pkgs, ...} :
  testScript = { nodes, ... }: let
    user = nodes.machine.config.users.users.alice;
  in ''
-    # Need to switch to a different VGA card / GPU driver because Cage segfaults with the default one (std):
-    # machine # [   14.355893] .cage-wrapped[736]: segfault at 20 ip 00007f035fa0d8c7 sp 00007ffce9e4a2f0 error 4 in libwlroots.so.8[7f035fa07000+5a000]
-    # machine # [   14.358108] Code: 4f a8 ff ff eb aa 0f 1f 44 00 00 c3 0f 1f 80 00 00 00 00 41 54 49 89 f4 55 31 ed 53 48 89 fb 48 8d 7f 18 48 8d 83 b8 00 00 00 <80> 7f 08 00 75 0d 48 83 3f 00 0f 85 91 00 00 00 48 89 fd 48 83 c7
-    os.environ["QEMU_OPTS"] = "-vga virtio"
-
    with subtest("Wait for cage to boot up"):
        start_all()
        machine.wait_for_file("/run/user/${toString user.uid}/wayland-0.lock")
--- a/nixos/tests/gitdaemon.nix
+++ b/nixos/tests/gitdaemon.nix
@ -18,6 +18,11 @@ in {

        environment.systemPackages = [ pkgs.git ];

+        systemd.tmpfiles.rules = [
+          # type path mode user group age arg
+          " d    /git 0755 root root  -   -"
+        ];
+
        services.gitDaemon = {
          enable = true;
          basePath = "/git";
@ -35,7 +40,6 @@ in {

    with subtest("create project.git"):
        server.succeed(
-            "mkdir /git",
            "git init --bare /git/project.git",
            "touch /git/project.git/git-daemon-export-ok",
        )
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@ -75,7 +75,7 @@ let
    else ''
      def assemble_qemu_flags():
          flags = "-cpu max"
-          ${if system == "x86_64-linux"
+          ${if (system == "x86_64-linux" || system == "i686-linux")
            then ''flags += " -m 1024"''
            else ''flags += " -m 768 -enable-kvm -machine virt,gic-version=host"''
          }
--- a/nixos/tests/os-prober.nix
+++ b/nixos/tests/os-prober.nix
@ -69,6 +69,9 @@ in {
      imports = [ ../modules/profiles/installation-device.nix
                  ../modules/profiles/base.nix ];
      virtualisation.memorySize = 1300;
+      # To add the secondary disk:
+      virtualisation.qemu.options = [ "-drive index=2,file=${debianImage}/disk-image.qcow2,read-only,if=virtio" ];
+
      # The test cannot access the network, so any packages
      # nixos-rebuild needs must be included in the VM.
      system.extraDependencies = with pkgs;
@ -95,11 +98,6 @@ in {
  });

  testScript = ''
-    # hack to add the secondary disk
-    os.environ[
-        "QEMU_OPTS"
-    ] = "-drive index=2,file=${debianImage}/disk-image.qcow2,read-only,if=virtio"
-
    machine.start()
    machine.succeed("udevadm settle")
    machine.wait_for_unit("multi-user.target")
--- a/nixos/tests/pinnwand.nix
+++ b/nixos/tests/pinnwand.nix
@ -61,7 +61,7 @@ in
    client.wait_until_succeeds("ping -c1 server")

    # make sure pinnwand is listening
-    server.wait_until_succeeds("ss -lnp | grep ${toString port}")
+    server.wait_for_open_port(${toString port})

    # send the contents of /etc/machine-id
    response = client.succeed("steck paste /etc/machine-id")
@ -75,6 +75,12 @@ in
        if line.startswith("Removal link:"):
            removal_link = line.split(":", 1)[1]

+
+    # start the reaper, it shouldn't do anything meaningful here
+    server.systemctl("start pinnwand-reaper.service")
+    server.wait_until_fails("systemctl is-active -q pinnwand-reaper.service")
+    server.log(server.execute("journalctl -u pinnwand-reaper -e --no-pager")[1])
+
    # check whether paste matches what we sent
    client.succeed(f"curl {raw_url} > /tmp/machine-id")
    client.succeed("diff /tmp/machine-id /etc/machine-id")
@ -82,5 +88,7 @@ in
    # remove paste and check that it's not available any more
    client.succeed(f"curl {removal_link}")
    client.fail(f"curl --fail {raw_url}")
+
+    server.log(server.succeed("systemd-analyze security pinnwand"))
  '';
 })
--- a/nixos/tests/rspamd.nix
+++ b/nixos/tests/rspamd.nix
@ -25,6 +25,7 @@ let
    machine = {
      services.rspamd.enable = true;
      networking.enableIPv6 = enableIPv6;
+      virtualisation.memorySize = 1024;
    };
    testScript = ''
      start_all()
@ -68,6 +69,7 @@ in
          group = "rspamd";
        }];
      };
+      virtualisation.memorySize = 1024;
    };

    testScript = ''
@ -116,6 +118,7 @@ in
          '';
        };
      };
+      virtualisation.memorySize = 1024;
    };

    testScript = ''
@ -221,6 +224,7 @@ in
          rspamd_logger.infox(rspamd_config, 'Work dammit!!!')
        '';
      };
+      virtualisation.memorySize = 1024;
    };
    testScript = ''
      ${initMachine}
@ -287,6 +291,7 @@ in
        postfix.enable = true;
        workers.rspamd_proxy.type = "rspamd_proxy";
      };
+      virtualisation.memorySize = 1024;
    };
    testScript = ''
      ${initMachine}
--- a/pkgs/applications/audio/bucklespring/default.nix
+++ b/pkgs/applications/audio/bucklespring/default.nix
@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "bucklespring";
-  version = "unstable-2021-01-21";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "zevv";
    repo = pname;
-    rev = "d63100c4561dd7c57efe6440c12fa8d9e9604145";
+    rev = version;
    sha256 = "114dib4npb7r1z2zd1fwsx71xbf9r6psxqd7n7590cwz1w3r51mz";
  };

--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@ -4,7 +4,7 @@
 , boost
 , curl
 , fetchFromGitHub
-, ffmpeg_3
+, ffmpeg
 , lame
 , libev
 , libmicrohttpd
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "musikcube";
-  version = "0.96.5";
+  version = "0.96.7";

  src = fetchFromGitHub {
    owner = "clangen";
    repo = pname;
    rev = version;
-    sha256 = "sha256-GxMQPP8i/NWvduf10f+xVyuG666pChj9RsiF4jfygyY=";
+    sha256 = "1y00vwn1h10cfflxrm5bk271ak9gilhjycgi44hlkkhmf5bdgn35";
  };

  nativeBuildInputs = [
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
    alsaLib
    boost
    curl
-    ffmpeg_3
+    ffmpeg
    lame
    libev
    libmicrohttpd
--- a/pkgs/applications/editors/emacs-modes/emacs2nix.nix
+++ b/pkgs/applications/editors/emacs-modes/emacs2nix.nix
@ -4,8 +4,8 @@ let
  src = pkgs.fetchgit {
    url = "https://github.com/ttuegel/emacs2nix.git";
    fetchSubmodules = true;
-    rev = "b815a9323c1f58f6c163a1f968939c57a8b6cfa0";
-    sha256 = "183xlmhjmj4z2zssc0pw990h7bf3bam8zqswnf1zcsyp8z7yrl5g";
+    rev = "860da04ca91cbb69c9b881a54248d16bdaaf9923";
+    sha256 = "1r3xmyk9rfgx7ln69dk8mgbnh3awcalm3r1c5ia2shlsrymvv1df";
  };

 in pkgs.mkShell {
--- a/pkgs/applications/editors/emacs-modes/update-melpa.el
+++ b/pkgs/applications/editors/emacs-modes/update-melpa.el
@ -99,7 +99,10 @@ return Promise to resolve in that process."
            ("github"    (list "nix-prefetch-url"
                               "--unpack" (concat "https://github.com/" repo "/archive/" commit ".tar.gz")))
            ("gitlab"    (list "nix-prefetch-url"
-                               "--unpack" (concat "https://gitlab.com/" repo "/repository/archive.tar.gz?ref=" commit)))
+                               "--unpack" (concat "https://gitlab.com/api/v4/projects/"
+                                                  (url-hexify-string repo)
+                                                  "/repository/archive.tar.gz?ref="
+                                                  commit)))
            ("bitbucket" (list "nix-prefetch-hg"
                               (concat "https://bitbucket.com/" repo) commit))
            ("hg"        (list "nix-prefetch-hg"
--- a/pkgs/applications/misc/authenticator/default.nix
+++ b/pkgs/applications/misc/authenticator/default.nix
@ -0,0 +1,99 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, fetchpatch
+, appstream-glib
+, desktop-file-utils
+, meson
+, ninja
+, pkg-config
+, python3
+, rustPlatform
+, wrapGAppsHook
+, gdk-pixbuf
+, glib
+, gst_all_1
+, gtk4
+, libadwaita
+, openssl
+, sqlite
+, wayland
+, zbar
+}:
+
+stdenv.mkDerivation rec {
+  pname = "authenticator";
+  version = "4.0.3";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "Authenticator";
+    rev = version;
+    sha256 = "0fvs76f3fm5pxn7wg6sjbqpgip5w2j7xrh4siasdcl2bx6vsld8b";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    sha256 = "1s97jyszxf24rs3ni11phiyvmp1wm8sicb0rh1jgwz4bn1cnakx4";
+  };
+
+  postPatch = ''
+    patchShebangs build-aux
+  '';
+
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    meson
+    ninja
+    pkg-config
+    python3
+    wrapGAppsHook
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
+
+  buildInputs = [
+    gdk-pixbuf
+    glib
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+
+    # gst-plugins-good needs gtk4 support:
+    # https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/merge_requests/767
+    # We copy the way it is built from the Flatpak:
+    # https://gitlab.gnome.org/World/Authenticator/-/blob/master/build-aux/com.belmoussaoui.Authenticator.Devel.json
+    (gst_all_1.gst-plugins-good.overrideAttrs (old: {
+      patches = old.patches or [ ] ++ [
+        "${src}/build-aux/767.patch"
+      ];
+      mesonFlags = old.mesonFlags ++ [
+        "-Dgtk3=disabled"
+        "-Dgtk4=enabled"
+        "-Dgtk4-experiments=true"
+      ];
+      buildInputs = old.buildInputs ++ [
+        gtk4
+      ];
+    }))
+
+    (gst_all_1.gst-plugins-bad.override { enableZbar = true; })
+    gtk4
+    libadwaita
+    openssl
+    sqlite
+    wayland
+    zbar
+  ];
+
+  meta = with lib; {
+    description = "Two-factor authentication code generator for GNOME";
+    homepage = "https://gitlab.gnome.org/World/Authenticator";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -18,11 +18,11 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "3.7.2218.45-1";
+  version = "3.8.2259.37-1";

  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "11q3whw01nbwvzccgn55b4lkr7dzlql961406r6by8xqvf8zgmp4";
+    sha256 = "1lpia3jm6l2yvbhrw5khws28n653w22bszzd44y6zv6zwbw7y127";
  };

  unpackPhase = ''
@ -47,6 +47,7 @@ in stdenv.mkDerivation rec {
    + ":$out/opt/${vivaldiName}/lib";

  buildPhase = ''
+    runHook preBuild
    echo "Patching Vivaldi binaries"
    patchelf \
      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
@ -56,12 +57,14 @@ in stdenv.mkDerivation rec {
    ln -s ${vivaldi-ffmpeg-codecs}/lib/libffmpeg.so opt/${vivaldiName}/libffmpeg.so.''${version%\.*\.*}
  '' + ''
    echo "Finished patching Vivaldi binaries"
+    runHook postBuild
  '';

  dontPatchELF = true;
  dontStrip    = true;

  installPhase = ''
+    runHook preInstall
    mkdir -p "$out"
    cp -r opt "$out"
    mkdir "$out/bin"
@ -84,6 +87,8 @@ in stdenv.mkDerivation rec {
      ${lib.optionalString enableWidevine "--suffix LD_LIBRARY_PATH : ${libPath}"}
  '' + lib.optionalString enableWidevine ''
    ln -sf ${vivaldi-widevine}/share/google/chrome/WidevineCdm $out/opt/${vivaldiName}/WidevineCdm
+  '' + ''
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
@ -2,7 +2,7 @@
 , pkg-config, cmake, ninja, python3, wrapGAppsHook, wrapQtAppsHook
 , qtbase, qtimageformats, gtk3, libsForQt5, lz4, xxHash
 , ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
-, tl-expected, hunspell, glibmm
+, tl-expected, hunspell, glibmm, webkitgtk
 # Transitive dependencies:
 , pcre, xorg, util-linux, libselinux, libsepol, epoxy
 , at-spi2-core, libXtst, libthai, libdatrie
@ -14,13 +14,13 @@ let
  tg_owt = callPackage ../tdesktop/tg_owt.nix {};
 in mkDerivation rec {
  pname = "kotatogram-desktop";
-  version = "1.4";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "kotatogram";
    repo = "kotatogram-desktop";
    rev = "k${version}";
-    sha256 = "0nhyjqxrbqiik4sgzplmpgx8msf8rykjiik0c2zr61rjm4fngkb3";
+    sha256 = "07z56gz3sk45n5j0gw9p9mxrbwixxsmp7lvqc6lqnxmglz6knc1d";
    fetchSubmodules = true;
  };

@ -38,7 +38,7 @@ in mkDerivation rec {
  buildInputs = [
    qtbase qtimageformats gtk3 libsForQt5.kwayland libsForQt5.libdbusmenu lz4 xxHash
    ffmpeg openalSoft minizip libopus alsaLib libpulseaudio range-v3
-    tl-expected hunspell glibmm
+    tl-expected hunspell glibmm webkitgtk
    tg_owt
    # Transitive dependencies:
    pcre xorg.libXdmcp util-linux libselinux libsepol epoxy
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -29,11 +29,11 @@
 assert pulseaudioSupport -> libpulseaudio != null;

 let
-  version = "5.6.16775.0418";
+  version = "5.6.16888.0424";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.pkg.tar.xz";
-      sha256 = "twtxzniojgyLTx6Kda8Ej96uyw2JQB/jIhLdTgTqpCo=";
+      sha256 = "H/G9cSVmxYM0AVfrdpXzm7ohssDbKq2xdvIBc4d+elc=";
    };
  };

--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@ -1,7 +1,7 @@
 { lib, stdenv, requireFile, makeWrapper, autoPatchelfHook, wrapGAppsHook, which, more
 , file, atk, alsaLib, cairo, fontconfig, gdk-pixbuf, glib, gnome3, gtk2-x11, gtk3
 , heimdal, krb5, libsoup, libvorbis, speex, openssl, zlib, xorg, pango, gtk2
-, gnome2, nss, nspr, gtk_engines, freetype, dconf, libpng12, libxml2
+, gnome2, mesa, nss, nspr, gtk_engines, freetype, dconf, libpng12, libxml2
 , libjpeg, libredirect, tzdata, cacert, systemd, libcxxabi, libcxx, e2fsprogs, symlinkJoin
 , libpulseaudio, pcsclite

@ -84,6 +84,7 @@ stdenv.mkDerivation rec {
    libsoup
    libvorbis
    libxml2
+    mesa
    nspr
    nss
    openssl'
--- a/pkgs/applications/science/misc/rink/default.nix
+++ b/pkgs/applications/science/misc/rink/default.nix
@ -1,17 +1,17 @@
 { lib, fetchFromGitHub, rustPlatform, openssl, pkg-config, ncurses }:

 rustPlatform.buildRustPackage rec {
-  version = "0.6.0";
+  version = "0.6.1";
  pname = "rink";

  src = fetchFromGitHub {
    owner = "tiffany352";
    repo = "rink-rs";
    rev = "v${version}";
-    sha256 = "sha256-3uhKevuUVh7AObn2GDW2T+5wttX20SbVP+sFaFj3Jmk=";
+    sha256 = "1h93xlavcjvx588q8wkpbzph88yjjhhvzcfxr5nicdca0jnha5ch";
  };

-  cargoSha256 = "sha256-luJzIGdcitH+PNgr86AYX6wKEkQlsRhwwylo+hzeovE=";
+  cargoSha256 = "0x4rvfnw3gl2aj6i006nkk3y1f8skyv8g0ss3z2v6qj9nhs7pyir";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ncurses ];
--- a/pkgs/desktops/lxqt/lxqt-powermanagement/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-powermanagement/default.nix
@ -18,13 +18,13 @@

 mkDerivation rec {
  pname = "lxqt-powermanagement";
-  version = "0.17.0";
+  version = "0.17.1";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    sha256 = "1ikkksg5k7jwph7060h8wyk7bdsywvhl47zp23j5gcig0nk62ggf";
+    sha256 = "04prx15l05kw97mwajc8yi2s7p3n6amzs5jnnmh9payxzp6glzmk";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/lxqt/obconf-qt/default.nix
+++ b/pkgs/desktops/lxqt/obconf-qt/default.nix
@ -15,13 +15,13 @@

 mkDerivation rec {
  pname = "obconf-qt";
-  version = "0.16.0";
+  version = "0.16.1";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    sha256 = "0kk5scp1j0hqi27q3yl9cg73ybxzm22nj96pa8adhdn4shg9bpac";
+    sha256 = "1nw2r3h7ynmygpslnzjn40vvickd988nm31wy2b645xcck89q4rm";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-session-manager/default.nix
+++ b/pkgs/desktops/mate/mate-session-manager/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-session-manager";
-  version = "1.24.2";
+  version = "1.24.3";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1jcb5k2fx2rwwbrslgv1xlzaiwiwjnxjwnp503qf8cg89w69q2vb";
+    sha256 = "18mhv8dq18hvx28gi88c9499s3s1nsq55m64sas8fqlvnp2sx84h";
  };

  patches = [
--- a/pkgs/development/interpreters/mujs/default.nix
+++ b/pkgs/development/interpreters/mujs/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mujs";
-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchurl {
    url = "https://mujs.com/downloads/mujs-${version}.tar.xz";
-    sha256 = "sha256-meYfyWGfHVULVjVyA7NJ2Ih9CjbffblWc1yijU/3e7A=";
+    sha256 = "sha256-cZ6IK7fZhkDvoWM4Hpto7xzjXIekIuKqQZDJ5AIlh10=";
  };

  buildInputs = [ readline ];
--- a/pkgs/development/libraries/libadwaita/default.nix
+++ b/pkgs/development/libraries/libadwaita/default.nix
@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, docbook-xsl-nons
+, gtk-doc
+, meson
+, ninja
+, pkg-config
+, sassc
+, vala
+, gobject-introspection
+, gtk4
+, xvfb_run
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libadwaita";
+  version = "unstable-2021-05-01";
+
+  outputs = [ "out" "dev" "devdoc" ];
+  outputBin = "dev";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "libadwaita";
+    rev = "8d66b987a19979d9d7b85dacc6bad5ce0c8743fe";
+    sha256 = "0i3wav6jsyi4w4i2r1rad769m5y5s9djj4zqb7dfyh0bad24ba3q";
+  };
+
+  nativeBuildInputs = [
+    docbook-xsl-nons
+    gtk-doc
+    meson
+    ninja
+    pkg-config
+    sassc
+    vala
+  ];
+
+  mesonFlags = [
+    "-Dgtk_doc=true"
+  ];
+
+  buildInputs = [
+    gobject-introspection
+    gtk4
+  ];
+
+  checkInputs = [
+    xvfb_run
+  ];
+
+  doCheck = true;
+
+  checkPhase = ''
+    xvfb-run meson test
+  '';
+
+  meta = with lib; {
+    description = "Library to help with developing UI for mobile devices using GTK/GNOME";
+    homepage = "https://gitlab.gnome.org/GNOME/libadwaita";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ dotlambda ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/openscenegraph/default.nix
+++ b/pkgs/development/libraries/openscenegraph/default.nix
@ -11,7 +11,7 @@
  curlSupport ? true, curl,
  colladaSupport ? false, opencollada,
  opencascadeSupport ? false, opencascade,
-  ffmpegSupport ? false, ffmpeg_3,
+  ffmpegSupport ? false, ffmpeg,
  nvttSupport ? false, nvidia-texture-tools,
  freetypeSupport ? true, freetype,
  svgSupport ? false, librsvg,
@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
    ++ lib.optional curlSupport curl
    ++ lib.optional colladaSupport opencollada
    ++ lib.optional opencascadeSupport opencascade
-    ++ lib.optional ffmpegSupport ffmpeg_3
+    ++ lib.optional ffmpegSupport ffmpeg
    ++ lib.optional nvttSupport nvidia-texture-tools
    ++ lib.optional freetypeSupport freetype
    ++ lib.optional svgSupport librsvg
--- a/pkgs/development/python-modules/pytmx/default.nix
+++ b/pkgs/development/python-modules/pytmx/default.nix
@ -5,20 +5,26 @@

 buildPythonPackage rec {
  pname = "pytmx";
-  version = "3.24.0";
+  version = "3.25";

  disabled = isPy27;

  src = fetchFromGitHub {
-    # The release was not git tagged.
    owner = "bitcraft";
    repo = "PyTMX";
-    rev = "eb96efea30d57b731654b2a167d86b8b553b147d";
-    sha256 = "1g1j4w75zw76p5f8m5v0hdigdlva2flf0ngyk8nvqcwzcl5vq5wc";
+    rev = version;
+    sha256 = "0v07zhvzvl2qcqhjzgfzm8hgayq38gaqcxxkyhlq9n0hlk93nm97";
  };

  propagatedBuildInputs = [ pygame pyglet pysdl2 six ];

+  pythonImportsCheck = [
+    "pytmx.pytmx"
+    "pytmx.util_pygame"
+    "pytmx.util_pyglet"
+    "pytmx.util_pysdl2"
+  ];
+
  checkPhase = ''
    # Change into the test directory due to a relative resource path.
    cd tests/pytmx
@ -28,7 +34,7 @@ buildPythonPackage rec {
  meta = with lib; {
    homepage = "https://github.com/bitcraft/PyTMX";
    description = "Python library to read Tiled Map Editor's TMX maps";
-    license = licenses.lgpl3;
+    license = licenses.lgpl3Plus;
    maintainers = with maintainers; [ oxzi ];
  };
 }
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@ -86,22 +86,22 @@ rec {
    headers = "0yx8mkrm15ha977hzh7g2sc5fab9sdvlk1bk3yxignhxrqqbw885";
  };

-  electron_10 = mkElectron "10.4.3" {
-    x86_64-linux = "48793fc6c6d3bfb8df81cd29f6c52e68c8c6b901693c6ba4ed505799fa673e9f";
-    x86_64-darwin = "28cbacf51e0528e0d4ba30a2c56efd6a8e7f836104786733aae0c5fc99dc2615";
-    i686-linux = "b9b7fd9b91630350dafe97a31c918f941ab15b044f0b4e9b2a705482447fe78f";
-    armv7l-linux = "b1e1b4d0620eae647915c95d21656d21c00efe89f44198938d9fd9fba045e39c";
-    aarch64-linux = "aa9177becf787920cef4cde27a6ed08e2e23976678162a3cd6b77615b1582c05";
-    headers = "0phv08myxq226blrqzg3fza3mh3ivgfmcja98b7377pc3x7bv76g";
+  electron_10 = mkElectron "10.4.4" {
+    x86_64-linux = "e82d347ff4753fd4296550e403390c7a9c448d150ea6bb05bd245fd43ac5a708";
+    x86_64-darwin = "b8f01dedbd81c58e1dc0fafd316e4c1be07681f7e6d42d3f6f3947cf78d9a8fa";
+    i686-linux = "2e7847c902e174496e152030932a921ca1cfb2ffcb556e2a01b08d8235eb333d";
+    armv7l-linux = "303c246816bff2dc7aeb26d37d99fe82e4bbe484e3e96f42731f6350498b1af2";
+    aarch64-linux = "21ba3370b01870fc498d7e180d034a3e3b59a84af231d2dcd82984d6d09fd5da";
+    headers = "0qxzsycpdq1g8a2yaw7g43da1f8ijpbhj97vvxza8nnvxiay5apf";
  };

-  electron_11 = mkElectron "11.4.3" {
-    x86_64-linux = "222e7aa51d5516796d532f784c574f07315bad4bf29efb0ce687014f93ba5fa5";
-    x86_64-darwin = "6cccbaf8dca7eb3819b0ac3044686f6705c5d51c88ee1361d8573c2b83c8dc0a";
-    i686-linux = "1910729fd6088e9c914db9fdd6c42ce6747fcb048947dd83fa2cdf564c786353";
-    armv7l-linux = "e0e1375bdb79a6917467490683e49bb59da9260b73d7b710a5e4e4535c1c5e80";
-    aarch64-linux = "9fb287ed8bcc7782775bd615fe1c31db4a8b6d548209fd15ef5312ac72a04d07";
-    headers = "00gln9jlb621gvxx1z7s212wakjbdigdqv02vx1pjvkg62aazg8j";
+  electron_11 = mkElectron "11.4.4" {
+    x86_64-linux = "154ae71e674b37b6cb5ec56e0f569435cb9303a5b0c0608bd2e1d026803be1a5";
+    x86_64-darwin = "783962e25433178a1e41b895dbbebc7b82efbe819dbd08c9314d2f4547c73e05";
+    i686-linux = "fcfeba63e490648156f01bbe51f27123f93762713f6ab5e4433dc9c232708a25";
+    armv7l-linux = "3b98dabbce5a5a8ba66d2f909174b792eeccddd95fd4396a596130f6817ec0d3";
+    aarch64-linux = "cf886b382f4e3815487ee1403d4bb6ff434ecd9625e61c9ecf082f482c88617e";
+    headers = "1wjcygxy6lvmf1lw857rcd499jk8103nvld0q3jj4r90gwbdhfi3";
  };

  electron_12 = mkElectron "12.0.5" {
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@ -2,12 +2,12 @@

 {
  hydra-unstable = callPackage ./common.nix {
-    version = "2021-03-29";
+    version = "2021-04-29";
    src = fetchFromGitHub {
      owner = "NixOS";
      repo = "hydra";
-      rev = "9bb04ed97af047968196bad1728f927f7a6d905f";
-      sha256 = "sha256-gN/zNI2hGDMnYUjeGnU7SAuXP4KCmNqG+AYOVfINaQE=";
+      rev = "6047b1dd04d44acff9343b6b971ab609b73099d5";
+      sha256 = "sha256-E7JOHhSd4gIzE6FvSZVMxZE9WagbBkrfZVoibkanaYE=";
    };
    nix = nixFlakes;

--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@ -142,6 +142,7 @@ in
      license = licenses.mit;
      maintainers = with maintainers; [ goibhniu gilligan cko marsam ];
      platforms = platforms.linux ++ platforms.darwin;
+      mainProgram = "node";
    };

    passthru.python = python; # to ensure nodeEnv uses the same version
--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@ -16,13 +16,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "osu-lazer";
-  version = "2021.410.0";
+  version = "2021.502.0";

  src = fetchFromGitHub {
    owner = "ppy";
    repo = "osu";
    rev = version;
-    sha256 = "twKg9iZdY+zgwEQeHMOlRZKXxAHic7GnoqH0jOdW7fw=";
+    sha256 = "IOneihYQry0pRXYaxZuVLIj2Ydei//khvpqwiJoakZ8=";
  };

  patches = [ ./bypass-tamper-detection.patch ];
--- a/pkgs/games/osu-lazer/deps.nix
+++ b/pkgs/games/osu-lazer/deps.nix
@ -26,8 +26,8 @@
  })
  (fetchNuGet {
    name = "Humanizer";
-    version = "2.8.26";
-    sha256 = "11kddzyzqpq9gkz0hmrblq494nh86va6wxx6z89xi6w1f4vj15ak";
+    version = "2.9.9";
+    sha256 = "07ql79qz4m7cdr6g0f0dxjywrv70xzpzz45gch73x1ad4vwc5n4m";
  })
  (fetchNuGet {
    name = "Humanizer.Core";
@ -36,228 +36,243 @@
  })
  (fetchNuGet {
    name = "Humanizer.Core";
-    version = "2.8.26";
-    sha256 = "1v8xd12yms4qq1md4vh6faxicmqrvahqdd7sdkyzrphab9v44nsm";
+    version = "2.9.9";
+    sha256 = "05sn5l0qg5bi8qxqxlch88zlk79z9pbh6jwln7b3yxnp4hkj4kvm";
  })
  (fetchNuGet {
    name = "Humanizer.Core.af";
-    version = "2.8.26";
-    sha256 = "0znrq4frlkq1qi20301hlzxa6mdc275fa1i1a1i8ldgk9cjq94k9";
+    version = "2.9.9";
+    sha256 = "0l51ll73gjjarpyknj81v8f64mg0f0zlc7q3sgcz4fkmj6n0wxb3";
  })
  (fetchNuGet {
    name = "Humanizer.Core.ar";
-    version = "2.8.26";
-    sha256 = "1hi7mln48p1nmxlgdq725s4cvla9nlkvbmrsql1rfjjlsy8hn6n7";
+    version = "2.9.9";
+    sha256 = "1akrcrxl01phzp1cyhknwcmghhmr808dzv9aj8vzjmyq67p8mnja";
  })
  (fetchNuGet {
    name = "Humanizer.Core.az";
-    version = "2.8.26";
-    sha256 = "0av7ycrqwvmikqia3z3qkp9967zilrhayny17zkm0d0mnjq62vs6";
+    version = "2.9.9";
+    sha256 = "0jsxjvhmgwngx5b1yki5g6ns7yhzn3m5invzlnl79dh09krx9pg4";
  })
  (fetchNuGet {
    name = "Humanizer.Core.bg";
-    version = "2.8.26";
-    sha256 = "13j6zk2cmk7a119azxlpjhfwykrzk0vkf5a799fb2fzkvhnj4hkg";
+    version = "2.9.9";
+    sha256 = "0l32vi52qkvx267qnykid5965199h6rcy5r04gmkv3lg2ydds0ig";
  })
  (fetchNuGet {
    name = "Humanizer.Core.bn-BD";
-    version = "2.8.26";
-    sha256 = "0h619sksggfi7dnaycz6bj9aiqdgn0d8dpgjgdl73crw52lr70p9";
+    version = "2.9.9";
+    sha256 = "1yivbxcxh15jgy8j5fzrd40c9k75wmcd9wdy1333zwcyrwqzpx7v";
  })
  (fetchNuGet {
    name = "Humanizer.Core.cs";
-    version = "2.8.26";
-    sha256 = "11bh3k15388bi5wizaihnwqk7wb4n7q636fqjllwdhjggqrsc3f6";
+    version = "2.9.9";
+    sha256 = "05ysribnj8b2q2fcm33lcgz7mcdgx5q53w6vihyjc5s6zmlfqqfr";
  })
  (fetchNuGet {
    name = "Humanizer.Core.da";
-    version = "2.8.26";
-    sha256 = "09b3x3bw3cgby9qvaccnqz2y6d8gl3497dh7q0dk1iznsxbk4x4m";
+    version = "2.9.9";
+    sha256 = "0d6swwliw0cbb03vjv2i1n8vcclwzragi1ik3m6ysbwm1m0sip5v";
  })
  (fetchNuGet {
    name = "Humanizer.Core.de";
-    version = "2.8.26";
-    sha256 = "1pyp2a9my20wlwjjzv563kshl9fpjb2kd4cw41l4wvsz1bsq3l22";
+    version = "2.9.9";
+    sha256 = "085ijfkbz4q6q90z0qc4k5hsv2acdlhli8whiikil9mlrjsjrqhi";
  })
  (fetchNuGet {
    name = "Humanizer.Core.el";
-    version = "2.8.26";
-    sha256 = "0v3sdcxca4dam1y5yjh9n6v711ys0zdv38hr4kij35s6277ls6lb";
+    version = "2.9.9";
+    sha256 = "1f5fr6l8f4brva1jxx6migv9yhp98svwkzly1b2b6n43ngppn4jd";
  })
  (fetchNuGet {
    name = "Humanizer.Core.es";
-    version = "2.8.26";
-    sha256 = "0wh9qvqf80cngwsz2jnrsjpmaax4xa2xp8bbk5xs480kp071z37q";
+    version = "2.9.9";
+    sha256 = "0nwwxhp2wgq424fy2mjrgsjsm86y818zl64k6zibkcnfldm8als6";
  })
  (fetchNuGet {
    name = "Humanizer.Core.fa";
-    version = "2.8.26";
-    sha256 = "00v56ddjfv6sr6w5246gn5z0padwswvnngp8mdl7gjfg5ycmbkl1";
+    version = "2.9.9";
+    sha256 = "1268lf9lxxnnax0ivyghh707fy50z09qds2jlh53dw1q0lxqgp50";
  })
  (fetchNuGet {
    name = "Humanizer.Core.fi-FI";
-    version = "2.8.26";
-    sha256 = "1pgs0j5ri50a6vhljplhrlc8jj1hrd9ggxkj60d9v5kk9xibzzyd";
+    version = "2.9.9";
+    sha256 = "1cjs78z1lc7a42b1wvcpxpydyv65rvyfvfic8k0d2flwcv98i7z2";
  })
  (fetchNuGet {
    name = "Humanizer.Core.fr";
-    version = "2.8.26";
-    sha256 = "0kkhgy3yn8vfqlx3dhb9m3cazkgfxarknam4macng9y17l7wj83m";
+    version = "2.9.9";
+    sha256 = "1al0xbg6p0287v60a4s6k7vgsng6k4m0scwlshmqsqxmvfsa1wk3";
  })
  (fetchNuGet {
    name = "Humanizer.Core.fr-BE";
-    version = "2.8.26";
-    sha256 = "13spcx07hph366qk073pz63s56nadaac7l4mr4a66gbpqd3814kb";
+    version = "2.9.9";
+    sha256 = "0jvi063lsrzds52zvq4w4qx6khkjcn5k8mp4014pzlphfhvlfbcl";
  })
  (fetchNuGet {
    name = "Humanizer.Core.he";
-    version = "2.8.26";
-    sha256 = "1ccn82aj3rhrhsa3kvkrmjw0p687icxlfja8ngbh7sby4cszx9bk";
+    version = "2.9.9";
+    sha256 = "1azymmsf79dyl8ihx8kn19mymx98sjknaqrqf043fy8qwirll1wm";
  })
  (fetchNuGet {
    name = "Humanizer.Core.hr";
-    version = "2.8.26";
-    sha256 = "12ii79bhai3kv7zr3k9k9dh569r6p3m4l4gj25cln2isr4wdi5r9";
+    version = "2.9.9";
+    sha256 = "1ygi02nxssn1wrdzammr5km7ak5h8yxghfvbcmy559npg0gy2gya";
  })
  (fetchNuGet {
    name = "Humanizer.Core.hu";
-    version = "2.8.26";
-    sha256 = "0cibbdxiqhwrjmxlr805mg3l9v0fl2ydx4m50608rkysjq6vxx7y";
+    version = "2.9.9";
+    sha256 = "0nimza5dngvl6yyigavr1rk5068yf2fmq3w3nm128plbnc8ynxfr";
  })
  (fetchNuGet {
    name = "Humanizer.Core.hy";
-    version = "2.8.26";
-    sha256 = "15aikm04f74abm4ak8rvnnkrlcz155gibn1y81pbgsyn7yrh84v3";
+    version = "2.9.9";
+    sha256 = "0v11hfh39mzm27dshmakhdnbpgzg660mskn1pkmmfdprka970cfj";
  })
  (fetchNuGet {
    name = "Humanizer.Core.id";
-    version = "2.8.26";
-    sha256 = "1i9gpzdfhmbvrqg858kqz5461sp3sh60g16dmcmyi1ik0qlspijn";
+    version = "2.9.9";
+    sha256 = "012bhisp75s4wv37ra692bfsvibnqgbfyipb2hw0743dqcy2mah2";
  })
  (fetchNuGet {
    name = "Humanizer.Core.it";
-    version = "2.8.26";
-    sha256 = "01j7qskmqcxsakbx3bkxcjyzrh6nxi2v6kfzsfb0vf980qqq331l";
+    version = "2.9.9";
+    sha256 = "1jj7qbia4b09hsyll524mpz67vy4z25zazwc1g10yi1sjsyah92f";
  })
  (fetchNuGet {
    name = "Humanizer.Core.ja";
-    version = "2.8.26";
-    sha256 = "07d19ns4a4pa2k4vdc1af7wj10gaflq1ny4mx6y574afkdi8v6d5";
+    version = "2.9.9";
+    sha256 = "1wqxw815287jlg6a6x3ffjhxvpa5al94jh3qkai2rw5kggcqzws4";
+  })
+  (fetchNuGet {
+    name = "Humanizer.Core.ko-KR";
+    version = "2.9.9";
+    sha256 = "1azggn1i8gnvc89kh7mv165bd2c7fwp1m1h9k6fcdk36kl4xxb97";
+  })
+  (fetchNuGet {
+    name = "Humanizer.Core.ku";
+    version = "2.9.9";
+    sha256 = "1qpwancwa6hgafrcdpbdb00vq08hrk77wjl64dvcjsx010n4c0fc";
  })
  (fetchNuGet {
    name = "Humanizer.Core.lv";
-    version = "2.8.26";
-    sha256 = "1pm64sj65nmngyfa3hjcw67icfmlzr232hmgpnw7306sb7dxmnfv";
+    version = "2.9.9";
+    sha256 = "1k6gxlzkpfmp8khn0dl0bfw878qpdff6zjqbirgpvlc57d00bws4";
  })
  (fetchNuGet {
    name = "Humanizer.Core.ms-MY";
-    version = "2.8.26";
-    sha256 = "1yx4cc023kc4k14abk2ycmjy6y2xaknaz4zria7xsadf0fabd1jc";
+    version = "2.9.9";
+    sha256 = "0p0lc3qkq5f8354g77xgy8qc9wyc509rca8xrzgc2lpzbvb4v008";
  })
  (fetchNuGet {
    name = "Humanizer.Core.mt";
-    version = "2.8.26";
-    sha256 = "0iai35pzka9g6c3sgswki06fk6gdnq8kc88wyb4pcciivazz31px";
+    version = "2.9.9";
+    sha256 = "0qn2c583lbc5qg0i1inqjb7zn8vcmvmjy8k70ngb6qyl1navmvcm";
  })
  (fetchNuGet {
    name = "Humanizer.Core.nb";
-    version = "2.8.26";
-    sha256 = "0xprhiyjyq6mpha2lrav59n1f48508ddvm9nmdk5sm5k26ff3l90";
+    version = "2.9.9";
+    sha256 = "12b7dx6jp5fcwsn54i7w1qz8y3cwbl8n8hia75iy9acd9l328shk";
  })
  (fetchNuGet {
    name = "Humanizer.Core.nb-NO";
-    version = "2.8.26";
-    sha256 = "160c98wfh7d2xlvlra4x5rdj4klgcjwcy3gkb4ipg655byn2m1j2";
+    version = "2.9.9";
+    sha256 = "04f47z9klpj6dq1gqlbcgyrli2s3rjci75i8lrng63vjjqi7jpqh";
  })
  (fetchNuGet {
    name = "Humanizer.Core.nl";
-    version = "2.8.26";
-    sha256 = "067pqm4i1mk83fqqr0bvzrchrvxwdnff18z3djgagclh1i4xqlvk";
+    version = "2.9.9";
+    sha256 = "19l4ik73500k2nxpcpylawy1aimb0awd82521abry3az4kc1lf29";
  })
  (fetchNuGet {
    name = "Humanizer.Core.pl";
-    version = "2.8.26";
-    sha256 = "1r1bbqb990war1hiag5f88yxw0k9jiid1ihb4s5bc1lzs3vfsb6x";
+    version = "2.9.9";
+    sha256 = "0hdh6gvz00xbrfyypwlbaw14409p75wqxraih2ckw23g8ci404l3";
  })
  (fetchNuGet {
    name = "Humanizer.Core.pt";
-    version = "2.8.26";
-    sha256 = "1bik0vjjdzw51yl11ng9gsi3ihz50ibwh1gdhh2vd13jxjzb512p";
+    version = "2.9.9";
+    sha256 = "03xplyqms9hpkl2bzhnqij3il78adi8a4azrs658rslpl8fl7ksd";
  })
  (fetchNuGet {
    name = "Humanizer.Core.ro";
-    version = "2.8.26";
-    sha256 = "12f2hry6x1p1mgx6g4kpig2jpybx52ibghvhdhjbbfhy32gv8dr0";
+    version = "2.9.9";
+    sha256 = "0x8qjkp8w32bhwr6509zpxlkvxb9izkgzq411hmh2sx4hrr90pzc";
  })
  (fetchNuGet {
    name = "Humanizer.Core.ru";
-    version = "2.8.26";
-    sha256 = "1hri12kwymzvdqcr66l8yiqiw3pmf9fk492z10yqljm576kyshgg";
+    version = "2.9.9";
+    sha256 = "0s2f9wxqwy281zw7aiswvfk8dg0i278g4z2l3bqn9iyijqm47zxx";
  })
  (fetchNuGet {
    name = "Humanizer.Core.sk";
-    version = "2.8.26";
-    sha256 = "07jfgk67axw97b85dn4bwpjwf3swd74j9hdd870qps12xfp98i9j";
+    version = "2.9.9";
+    sha256 = "0nq27nx6xq81d5avriphm7s926xm34306v7l7c88n71kn097jzl9";
  })
  (fetchNuGet {
    name = "Humanizer.Core.sl";
-    version = "2.8.26";
-    sha256 = "060xbzwb7p9ypbqfklih2zal2rh6h55gq4hv3i6alvlbd3vsx29n";
+    version = "2.9.9";
+    sha256 = "0dwszkm2xd4ysh3rrjx1zran09hl532hjrppfckqyy6n65b4axyf";
  })
  (fetchNuGet {
    name = "Humanizer.Core.sr";
-    version = "2.8.26";
-    sha256 = "0i2c24qmqnhp85b088qlbagxd48hcl0v1ly4m7hfbvx5s7fg8riv";
+    version = "2.9.9";
+    sha256 = "1vmfs9jp8ljlh6965pmb4afbcc9c4zlg5dn1pgbjc4miiwj6vc73";
  })
  (fetchNuGet {
    name = "Humanizer.Core.sr-Latn";
-    version = "2.8.26";
-    sha256 = "1911a69sqssh9f007vmxbgyj4ym2ym4423xvw6cmbfhjcrhkfpbi";
+    version = "2.9.9";
+    sha256 = "1dakb2zcaxmm9qw8fnsz5z12mmbjgx7jm9plxbm7jidjn7z271yl";
  })
  (fetchNuGet {
    name = "Humanizer.Core.sv";
-    version = "2.8.26";
-    sha256 = "056h8n9i18yl78f9ppzn2kkrz2cs46aqv0j5y8xq360zarggh0nm";
+    version = "2.9.9";
+    sha256 = "0jys46lz25yxx70w7y2623iabv3clf3lix8jzl8r68rj0lw6pxdz";
+  })
+  (fetchNuGet {
+    name = "Humanizer.Core.th-TH";
+    version = "2.9.9";
+    sha256 = "0r37ckvh68xvlyszgx94a8xxmya5cqiqnvdg5syw04lj0rshc3jb";
  })
  (fetchNuGet {
    name = "Humanizer.Core.tr";
-    version = "2.8.26";
-    sha256 = "0dk8ga3fpxifxxkz0n68654h65cvrx00hy7q00m5vgvmcp70gxxn";
+    version = "2.9.9";
+    sha256 = "1dnba6wbf6r5a1gmf7a7136qhy1w8izbh6wimmmwqsch2sk4ng4f";
  })
  (fetchNuGet {
    name = "Humanizer.Core.uk";
-    version = "2.8.26";
-    sha256 = "0bnj5xqlcqp4n8i04ra78dax4854zbf2jsygvb4lpiayyyaj2bxw";
+    version = "2.9.9";
+    sha256 = "1z0kdp2qkiyb4dhy22rqfik2b2c899nzkfh10907gp9827rdz3b9";
  })
  (fetchNuGet {
    name = "Humanizer.Core.uz-Cyrl-UZ";
-    version = "2.8.26";
-    sha256 = "1bbf6mxas6brjw7rjljq5saz6v3ic6zbvm1b3c1jbk0hc0qkd7c8";
+    version = "2.9.9";
+    sha256 = "1rnqa7w8s44fnqpw4g2drcwyajd5zhmwkqipi5zfhh0bcdnj9hxx";
  })
  (fetchNuGet {
    name = "Humanizer.Core.uz-Latn-UZ";
-    version = "2.8.26";
-    sha256 = "1bfgfihpynax30g9kq8kra7c4jxps2ccxsxrs9gls47xbs35cw2f";
+    version = "2.9.9";
+    sha256 = "1i1c6dy4bdglgyhv8g13lwqlis1snl7zcpdrvidw40f74ch0zq0g";
  })
  (fetchNuGet {
    name = "Humanizer.Core.vi";
-    version = "2.8.26";
-    sha256 = "1vm765nvkp6wyfwlcgppimjrk04lkg8lscch3n1i1i5hlqxrs9ch";
+    version = "2.9.9";
+    sha256 = "0ji0lmcm073x9fyigrw3b500drz268jarv6vfxpwxbzxd3mvnrys";
  })
  (fetchNuGet {
    name = "Humanizer.Core.zh-CN";
-    version = "2.8.26";
-    sha256 = "1qyl12rdh4iv1k1qcivcmxxnh8y93ainf22pmch8vvw9yjhs1y7s";
+    version = "2.9.9";
+    sha256 = "10iyrahi7rdp8lq4rxb2k9pny7da2aw9xfy2la8jdjrjgmqwffsi";
  })
  (fetchNuGet {
    name = "Humanizer.Core.zh-Hans";
-    version = "2.8.26";
-    sha256 = "1gqv3dyk236wlp5wb7kd4qnyrmp3cy36ycykl7zr91s25cdls5vy";
+    version = "2.9.9";
+    sha256 = "0f92fvzgcifaf2b64x8v52xckp1qxg88djlb9vlj083f6x29ick5";
  })
  (fetchNuGet {
    name = "Humanizer.Core.zh-Hant";
-    version = "2.8.26";
-    sha256 = "1rhzbiqbx04l3kvzjklix90fxyc6vvmmw0p564ajdiximivs0pbh";
+    version = "2.9.9";
+    sha256 = "0v9vqn6h467q7fy3xwabnqw48p48ilwkfg62b65j0q76ppnvsnvj";
  })
  (fetchNuGet {
    name = "JetBrains.Annotations";
@ -301,53 +316,53 @@
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.Connections.Abstractions";
-    version = "5.0.4";
-    sha256 = "002a3cvarwvvyic65khwavjxqsqjlnbgqc11sdyj3li15fxflk5g";
+    version = "5.0.5";
+    sha256 = "0qi4q54v7qiyc7xjbby88vmg1zcnb39sg8g1s7h0dnvapa436jv5";
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.Http.Connections.Client";
-    version = "5.0.4";
-    sha256 = "1s19hx083c0r98wi6a8gqb3j3xjlrp9rkmvbpdxikzw8z4bnrjpn";
+    version = "5.0.5";
+    sha256 = "1lpsjv6475p2vdvwv9wwmpzxc0r9bfya15nc5xqiv8m9z8d4sxlh";
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.Http.Connections.Common";
-    version = "5.0.4";
-    sha256 = "132ahfq7m369iss4ka402fj24rjdnhia41b94l3l135zplzlsl5n";
+    version = "5.0.5";
+    sha256 = "1knfn9d1wsczaic3vlnracmj5frpaxwx15x7j06kgi2kl6j2hbc7";
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.Http.Features";
-    version = "5.0.4";
-    sha256 = "064n12ydyngh5q3y597x5cmciib74mpnhkvxicqp0kmgqsixkc7b";
+    version = "5.0.5";
+    sha256 = "011xdkqna8q0r2h9i1f646rkfjbl9qbaq56a487zagp8plwxvaxl";
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.SignalR.Client";
-    version = "5.0.4";
-    sha256 = "0rpafasicnqng7ylx29hyslwp6g2j1l92szs0n9j98siscap17qg";
+    version = "5.0.5";
+    sha256 = "0r16n5c4im7gkfrhx2miiz9w58j0z87wjysbi4rsdav94hmkvgj4";
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.SignalR.Client.Core";
-    version = "5.0.4";
-    sha256 = "1fwy2akhgphx72hc3rlax08aiaabvm9fi6jfj2r1dyzb2plcgig3";
+    version = "5.0.5";
+    sha256 = "11phwns2sn44vfd3vn6c0lh3aiiysfpav7rmv4cmjkxp3jmpay8r";
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.SignalR.Common";
-    version = "5.0.4";
-    sha256 = "1dy00sf695sz842rlvgbyj2krgiqprx8qcdci8lz388rwp17drk2";
+    version = "5.0.5";
+    sha256 = "0am84ckim30djh4inv7mqph50axik79dwbfyrzlnaxcd3jr73c8c";
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.SignalR.Protocols.Json";
-    version = "5.0.4";
-    sha256 = "0xp6ihjq835iqiiaxjl501pfplkqhd40kqxkazfj1icryls8hzhq";
+    version = "5.0.5";
+    sha256 = "1z8d2dsgj9bh9a2xcz5xlrw4iijgmrm1midkdqni9b4nypbyraf6";
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.SignalR.Protocols.MessagePack";
-    version = "5.0.4";
-    sha256 = "1bvy4pvp3kxl75mbgy7saapjcnczylrqhf8ry0s66r12f7bzjki8";
+    version = "5.0.5";
+    sha256 = "0p52j1mrihvm4y4yp2rnimp4vdypn0hbba0p79vp617jj17vs45l";
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.SignalR.Protocols.NewtonsoftJson";
-    version = "5.0.4";
-    sha256 = "1gbkgc3cqv7q10k9hrjfj1ixpwx7b4n0x2f7sn9snsh977w7209j";
+    version = "5.0.5";
+    sha256 = "0jllzr9sba5m9ccdslr4dysmxzrfzy9zvianmqhmj4is6dg2krfs";
  })
  (fetchNuGet {
    name = "Microsoft.Bcl.AsyncInterfaces";
@ -574,6 +589,11 @@
    version = "5.0.0";
    sha256 = "0swqcknyh87ns82w539z1mvy804pfwhgzs97cr3nwqk6g5s42gd6";
  })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Primitives";
+    version = "5.0.1";
+    sha256 = "01ar5ba2sal9wnpa1xnnikhgb37vzhg2cspz45wf760jflpai2vv";
+  })
  (fetchNuGet {
    name = "Microsoft.NETCore.App.Runtime.linux-x64";
    version = "5.0.5";
@ -629,6 +649,11 @@
    version = "0.9.6.1";
    sha256 = "1fr7969h5q611l5227xw6nvv5rzap76vbpk0wg9hxbcxk3hn7szf";
  })
+  (fetchNuGet {
+    name = "Mono.Posix.NETStandard";
+    version = "1.0.0";
+    sha256 = "0xlja36hwpjm837haq15mjh2prcf68lyrmn72nvgpz8qnf9vappw";
+  })
  (fetchNuGet {
    name = "NETStandard.Library";
    version = "1.6.0";
@ -706,23 +731,23 @@
  })
  (fetchNuGet {
    name = "NUnit";
-    version = "3.13.1";
-    sha256 = "07156gr0yl9rqhyj44cp1xz9jpngbl5kb7ci3qfy9fcp01dczmm9";
+    version = "3.13.2";
+    sha256 = "00bkjgarkwbj497da9d7lajala1ns67h1kx53w4bapwkf32jlcvn";
  })
  (fetchNuGet {
    name = "OpenTabletDriver";
-    version = "0.5.2.3";
-    sha256 = "1qz5vmdwmfw8glkm6r7n06srcvrz5c3cwld1wv6xw4sagvwf0b6g";
+    version = "0.5.3.1";
+    sha256 = "16xw8w943x9gvnnpbryahff5azzy8n26j2igyqgv88m352jd9rb8";
  })
  (fetchNuGet {
    name = "OpenTabletDriver.Plugin";
-    version = "0.5.2.3";
-    sha256 = "0i03n5aydn0rv1v2y9c1cm9a2ss9y7p7l92k1x2yb6mwbx6vkpda";
+    version = "0.5.3.1";
+    sha256 = "17dxsvcz9g8kzydk5xlfz9kfxl62x9wi20609rh76wjd881bg1br";
  })
  (fetchNuGet {
    name = "ppy.osu.Framework";
-    version = "2021.410.0";
-    sha256 = "1vwdrspdpal44hyspv3rsax8mkszvbnc2xl1xswczx9mzj6qs4by";
+    version = "2021.427.0";
+    sha256 = "18n9g21y7asgr51fskfk3m0sx07y1mwrsdq4s065i8yk8d412mh7";
  })
  (fetchNuGet {
    name = "ppy.osu.Framework.NativeLibs";
@ -731,8 +756,8 @@
  })
  (fetchNuGet {
    name = "ppy.osu.Game.Resources";
-    version = "2021.410.0";
-    sha256 = "1a5qia4595n0b21dj63sl71ar56m9x1glqwky7a9bb0dqpvfivya";
+    version = "2021.422.0";
+    sha256 = "1zw0197k6wmmjqjh022q3302mrwn59msx06y66378pahmhrr0sjc";
  })
  (fetchNuGet {
    name = "ppy.osuTK.NS20";
@ -856,8 +881,8 @@
  })
  (fetchNuGet {
    name = "Sentry";
-    version = "3.2.0";
-    sha256 = "1hhgc4sqd7nampqydpdwfrc04hhqlkbv4p4w8cq6dswp5rf5k89b";
+    version = "3.3.4";
+    sha256 = "188rlyg6xfmgk6ypyg1mmbvm8d64q3wfjn3h0ays73b9wlypk8x6";
  })
  (fetchNuGet {
    name = "SharpCompress";
@ -866,8 +891,8 @@
  })
  (fetchNuGet {
    name = "SharpCompress";
-    version = "0.28.1";
-    sha256 = "1h7gx7apafdd0jnv12fppca9b6cpq205kjkcipclxp1lli0i7qvw";
+    version = "0.28.2";
+    sha256 = "0pj30qm48m9vpq3i8wx9x11ficv36ki1973dk0873vqgvw8fwjj4";
  })
  (fetchNuGet {
    name = "SharpFNT";
@ -1604,6 +1629,11 @@
    version = "5.0.0";
    sha256 = "144pgy65jc3bkar7d4fg1c0rq6qmkx68gj9k1ldk97558w22v1r1";
  })
+  (fetchNuGet {
+    name = "System.Text.Encodings.Web";
+    version = "5.0.1";
+    sha256 = "00yg63qnp94q2qryxxggzigi276bibb8b3b96gcvsyrxy7b703n9";
+  })
  (fetchNuGet {
    name = "System.Text.Json";
    version = "5.0.0";
@ -1611,8 +1641,8 @@
  })
  (fetchNuGet {
    name = "System.Text.Json";
-    version = "5.0.1";
-    sha256 = "1j7via4spxy73ipng754wdz1nb882gsb9qh26jqlql66vzbbm3j3";
+    version = "5.0.2";
+    sha256 = "0vd0wd29cdhgcjngl9sw391sn2s8xm974y15zvym0whsdgjwiqfx";
  })
  (fetchNuGet {
    name = "System.Text.RegularExpressions";
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, buildPackages, fetchurl, fetchFromGitLab
+{ stdenv, lib, buildPackages, fetchurl, fetchFromGitLab, fetchpatch
 , enableStatic ? stdenv.hostPlatform.isStatic
 , enableMinimal ? false
 # Allow forcing musl without switching stdenv itself, e.g. for our bootstrapping:
@ -49,6 +49,9 @@ in

 stdenv.mkDerivation rec {
  pname = "busybox";
+  # TODO: When bumping to next version, remove the patch
+  # for CVE-2021-28831 (assuming the patch was included in
+  # the next upstream release)
  version = "1.32.1";

  # Note to whoever is updating busybox: please verify that:
@ -64,6 +67,11 @@ stdenv.mkDerivation rec {

  patches = [
    ./busybox-in-store.patch
+    (fetchpatch {
+      name = "CVE-2021-28831.patch";
+      url = "https://git.busybox.net/busybox/patch/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd";
+      sha256 = "0y79flfbk45krwn963nnbqc21a88bsz4k4asqwvcnfk2lkciadxm";
+    }) # TODO: Removing when bumping the version
  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;

  postPatch = "patchShebangs .";
--- a/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/pkgs/os-specific/linux/cifs-utils/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "cifs-utils";
-  version = "6.12";
+  version = "6.13";

  src = fetchurl {
    url = "mirror://samba/pub/linux-cifs/cifs-utils/${pname}-${version}.tar.bz2";
-    sha256 = "1vw570pvir73kl4y6fhd6ns936ankimkhb1ii43yh8lr0p1xqbcj";
+    sha256 = "sha256-Q9h4bIYTysz6hJEwgcHWK8JAlXWFTPiVsFtIrwhj0FY=";
  };

  nativeBuildInputs = [ autoreconfHook docutils pkg-config ];
--- a/pkgs/servers/matrix-dendrite/default.nix
+++ b/pkgs/servers/matrix-dendrite/default.nix
@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub}:
+
+buildGoModule rec {
+  pname = "matrix-dendrite";
+  version = "0.3.11";
+
+  src = fetchFromGitHub {
+    owner = "matrix-org";
+    repo = "dendrite";
+    rev = "v${version}";
+    sha256 = "15xqd4yhsnnpz5n90fbny9i8lp7ki2z3fbpbd8cvsp49347rm483";
+  };
+
+  vendorSha256 = "1l1wydvi0yalas79cvhrqg563cvs57hg9rv6qnkw879r6smb2x1n";
+
+  meta = with lib; {
+    homepage = "https://matrix.org";
+    description = "Dendrite is a second-generation Matrix homeserver written in Go!";
+    license = licenses.asl20;
+    maintainers = teams.matrix.members;
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/servers/mautrix-signal/default.nix
+++ b/pkgs/servers/mautrix-signal/default.nix
@ -37,7 +37,7 @@ python3Packages.buildPythonPackage rec {
    # Make a little wrapper for running mautrix-signal with its dependencies
    echo "$mautrixSignalScript" > $out/bin/mautrix-signal
    echo "#!/bin/sh
-      exec python -m mautrix_signal \"$@\"
+      exec python -m mautrix_signal \"\$@\"
    " > $out/bin/mautrix-signal
    chmod +x $out/bin/mautrix-signal
    wrapProgram $out/bin/mautrix-signal \
--- a/pkgs/tools/admin/lego/default.nix
+++ b/pkgs/tools/admin/lego/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "lego";
-  version = "4.2.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "go-acme";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-S9I6b9+FngX0/W5t3EHG+H1ULsZKoQw1/S4HnSITYG0=";
+    sha256 = "0mmr7fcqgbmr0b1fc49p6wjn7axxayyj420fxhhdvkd4nv8fxh1q";
  };

-  vendorSha256 = "sha256-dVGSMPhAvN/kWgv3XHS+lOZdcbDNL44ELkv7fHAJWlI=";
+  vendorSha256 = "04d141kjzqcjiwv6sd0sbrgsr7a99dvblm19gwzczljkfgi60q8w";

  doCheck = false;

--- a/pkgs/tools/graphics/agi/default.nix
+++ b/pkgs/tools/graphics/agi/default.nix
@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "agi";
-  version = "1.1.0-dev-20210423";
+  version = "1.1.0-dev-20210430";

  src = fetchzip {
    url = "https://github.com/google/agi-dev-releases/releases/download/v${version}/agi-${version}-linux.zip";
-    sha256 = "sha256-49ZKqG+CiQkdoBMLdYrN5fMnJH5TtXdUknQLQB2UG04=";
+    sha256 = "sha256-Sb2N3GPS+A55O39/kqua7M18O1F76zz6sNFghSFRBmk=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/graphics/xcolor/default.nix
+++ b/pkgs/tools/graphics/xcolor/default.nix
@ -0,0 +1,26 @@
+{ lib, rustPlatform, fetchFromGitHub, pkg-config, libX11, libXcursor, libxcb, python3 }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "xcolor";
+  version = "unstable-2021-02-02";
+
+  src = fetchFromGitHub {
+    owner = "Soft";
+    repo = pname;
+    rev = "0e99e67cd37000bf563aa1e89faae796ec25f163";
+    sha256 = "sha256-rHqK05dN5lrvDNbRCWGghI7KJwWzNCuRDEThEeMzmio=";
+  };
+
+  cargoSha256 = "sha256-lHOT/P1Sh1b53EkPIQM3l9Tozdqh60qlUDdjthj32jM=";
+
+  nativeBuildInputs = [ pkg-config python3 ];
+
+  buildInputs = [ libX11 libXcursor libxcb ];
+
+  meta = with lib; {
+    description = "Lightweight color picker for X11";
+    homepage = "https://github.com/Soft/xcolor";
+    maintainers = with lib.maintainers; [ fortuneteller2k ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/tools/misc/handlr/default.nix
+++ b/pkgs/tools/misc/handlr/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "handlr";
-  version = "0.6.3";
+  version = "0.6.4";

  src = fetchFromGitHub {
    owner = "chmln";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-OtU6sL2Bbbec0gHxk3bl5Inn+ZmNYiHgpSF0gjDuRSg=";
+    sha256 = "sha256-UYcJtBwbUDqDiRoj5PmO+urURfd7S7fSx2XhQRBrKTE=";
  };

-  cargoSha256 = "sha256-bX7QWV1R+pLxvghpaV10LeROv4wBVfZhHyrPCIgqETA=";
+  cargoSha256 = "sha256-xDQV8wVlzItz0lzR1nVRPVsg7nSf/khUhevDlGgSO3g=";

  nativeBuildInputs = [ shared-mime-info ];

--- a/pkgs/tools/misc/rename/default.nix
+++ b/pkgs/tools/misc/rename/default.nix
@ -1,19 +1,19 @@
 { lib, fetchFromGitHub, perlPackages }:

-perlPackages.buildPerlPackage {
+perlPackages.buildPerlPackage rec {
  pname = "rename";
-  version = "1.9";
+  version = "1.11";
  outputs = [ "out" ];
  src = fetchFromGitHub {
    owner = "pstray";
    repo = "rename";
-    rev = "d46f1d0ced25dc5849acb5d5974a3e2e9d97d536";
-    sha256 = "0qahs1cqfaci2hdf1xncrz4k0z5skkfr43apnm3kybs7za33apzw";
+    rev = "v${version}";
+    sha256 = "SK6wS3IxjCftuDiiZU27TFnn9GVd137zmzvGH88cNLI=";
  };
  meta = with lib; {
    description = "Rename files according to a Perl rewrite expression";
    homepage = "https://github.com/pstray/rename";
-    maintainers = with maintainers; [ mkg ];
+    maintainers = with maintainers; [ mkg cyplo ];
    license = with licenses; [ gpl1Plus ];
  };
 }
--- a/pkgs/tools/misc/ytfzf/default.nix
+++ b/pkgs/tools/misc/ytfzf/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "ytfzf";
-  version = "1.1.4";
+  version = "1.1.5";

  src = fetchFromGitHub {
    owner = "pystardust";
    repo = "ytfzf";
    rev = "v${version}";
-    sha256 = "sha256-zRzd+rZxT5IJoFJl9sutTdQC4eMDUCBld5bTGfQWtco=";
+    sha256 = "sha256-NkJjh/Ys0Ypm8NTy/ZrQ4hIAjP5VGrpU73wjAMsZnAc=";
  };

  patches = [
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -215,13 +215,13 @@ in rec {
  nixUnstable = lib.lowPrio (callPackage common rec {
    pname = "nix";
    version = "2.4${suffix}";
-    suffix = "pre20210326_dd77f71";
+    suffix = "pre20210503_6d2553a";

    src = fetchFromGitHub {
      owner = "NixOS";
      repo = "nix";
-      rev = "dd77f71afe6733e9790dd001125c423cb648b7ce";
-      sha256 = "rVHzrsCtdiWjyLuHnDplG2mx+7dw5VyzZ9ReXxuCvHY=";
+      rev = "6d2553ae1496288554e871c530836428f405fd67";
+      sha256 = "sha256-YeSeyOKhBAXHlkzo4mwYr8QIjIP9AgdpJ7YdhqOO2CA=";
    };

    inherit storeDir stateDir confDir boehmgc;
--- a/pkgs/tools/security/clevis/default.nix
+++ b/pkgs/tools/security/clevis/default.nix
@ -1,5 +1,6 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, asciidoc
-, jansson, jose, cryptsetup, curl, libpwquality, luksmeta
+, makeWrapper, jansson, jose, cryptsetup, curl, libpwquality, luksmeta
+, coreutils, tpm2-tools
 }:

 stdenv.mkDerivation rec {
@ -13,8 +14,21 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-m1UhyjD5ydSgCTBu6sECLlxFx0rnQxFnBA7frbdUqU8=";
  };

-  nativeBuildInputs = [ meson ninja pkg-config asciidoc ];
-  buildInputs = [ jansson jose cryptsetup curl libpwquality luksmeta ];
+  postPatch = ''
+    for f in $(find src/ -type f); do
+      grep -q "/bin/cat" "$f" && substituteInPlace "$f" \
+        --replace '/bin/cat' '${coreutils}/bin/cat' || true
+    done
+  '';
+
+  postInstall = ''
+    # We wrap the main clevis binary entrypoint but not the sub-binaries.
+    wrapProgram $out/bin/clevis \
+      --prefix PATH ':' "${tpm2-tools}/bin:${jose}/bin:${placeholder "out"}/bin"
+  '';
+
+  nativeBuildInputs = [ meson ninja pkg-config asciidoc makeWrapper ];
+  buildInputs = [ jansson jose cryptsetup curl libpwquality luksmeta tpm2-tools ];

  outputs = [ "out" "man" ];

--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@ -6,7 +6,7 @@
 , pkg-config
 , Security
 , withPCRE2 ? true
-, pcre2 ? null
+, pcre2
 }:

 rustPlatform.buildRustPackage rec {
@ -26,8 +26,8 @@ rustPlatform.buildRustPackage rec {

  nativeBuildInputs = [ asciidoctor installShellFiles ]
    ++ lib.optional withPCRE2 pkg-config;
-  buildInputs = (lib.optional withPCRE2 pcre2)
-    ++ (lib.optional stdenv.isDarwin Security);
+  buildInputs = lib.optional withPCRE2 pcre2
+    ++ lib.optional stdenv.isDarwin Security;

  preFixup = ''
    installManPage $releaseDir/build/ripgrep-*/out/rg.1
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1085,6 +1085,8 @@ in

  audiowaveform = callPackage ../tools/audio/audiowaveform { };

+  authenticator = callPackage ../applications/misc/authenticator { };
+
  autoflake = callPackage ../development/tools/analysis/autoflake { };

  autospotting = callPackage ../applications/misc/autospotting { };
@ -6098,6 +6100,8 @@ in
    inherit (darwin.apple_sdk.frameworks) Security;
  };

+  matrix-dendrite = callPackage ../servers/matrix-dendrite { };
+
  /* Python 3.8 is currently broken with matrix-synapse since `python38Packages.bleach` fails
    (https://github.com/NixOS/nixpkgs/issues/76093) */
  matrix-synapse = callPackage ../servers/matrix-synapse { /*python3 = python38;*/ };
@ -15328,6 +15332,8 @@ in

  libacr38u = callPackage ../tools/security/libacr38u { };

+  libadwaita = callPackage ../development/libraries/libadwaita { };
+
  libaec = callPackage ../development/libraries/libaec { };

  libagar = callPackage ../development/libraries/libagar { };
@ -31287,5 +31293,7 @@ in

  lc3tools = callPackage ../development/tools/lc3tools {};

+  xcolor = callPackage ../tools/graphics/xcolor { };
+
  zktree = callPackage ../applications/misc/zktree {};
 }