Merge master into haskell-updates

doc/languages-frameworks/beam.section.md

@@ -68,27 +68,107 @@ Erlang.mk functions similarly to Rebar3, except we use `buildErlangMk` instead o
 
 `mixRelease` is used to make a release in the mix sense. Dependencies will need to be fetched with `fetchMixDeps` and passed to it.
 
-#### mixRelease - Elixir Phoenix example {#mixrelease---elixir-phoenix-example}
+#### mixRelease - Elixir Phoenix example {#mix-release-elixir-phoenix-example}
 
-Here is how your `default.nix` file would look.
+there are 3 steps, frontend dependencies (javascript), backend dependencies (elixir) and the final derivation that puts both of those together
+
+##### mixRelease - Frontend dependencies (javascript) {#mix-release-javascript-deps}
+
+for phoenix projects, inside of nixpkgs you can either use yarn2nix (mkYarnModule) or node2nix. An example with yarn2nix can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39). An example with node2nix will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)
+
+##### mixRelease - backend dependencies (mix) {#mix-release-mix-deps}
+
+There are 2 ways to package backend dependencies. With mix2nix and with a fixed-output-derivation (FOD).
+
+###### mix2nix {#mix2nix}
+
+mix2nix is a cli tool available in nixpkgs. it will generate a nix expression from a mix.lock file. It is quite standard in the 2nix tool series.
+
+Note that currently mix2nix can't handle git dependencies inside the mix.lock file. If you have git dependencies, you can either add them manually (see [example](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/pleroma/default.nix#L20)) or use the FOD method.
+
+The advantage of using mix2nix is that nix will know your whole dependency graph. On a dependency update, this won't trigger a full rebuild and download of all the dependencies, where FOD will do so.
+
+practical steps:
+
+- run `mix2nix > mix_deps.nix` in the upstream repo.
+- pass `mixNixDeps = with pkgs; import ./mix_deps.nix { inherit lib beamPackages; };` as an argument to mixRelease.
+
+If there are git depencencies.
+
+- You'll need to fix the version artificially in mix.exs and regenerate the mix.lock with fixed version (on upstream). This will enable you to run `mix2nix > mix_deps.nix`.
+- From the mix_deps.nix file, remove the dependencies that had git versions and pass them as an override to the import function.
+
+```nix
+  mixNixDeps = import ./mix.nix {
+    inherit beamPackages lib;
+    overrides = (final: prev: {
+      # mix2nix does not support git dependencies yet,
+      # so we need to add them manually
+      prometheus_ex = beamPackages.buildMix rec {
+        name = "prometheus_ex";
+        version = "3.0.5";
+
+        # Change the argument src with the git src that you actually need
+        src = fetchFromGitLab {
+          domain = "git.pleroma.social";
+          group = "pleroma";
+          owner = "elixir-libraries";
+          repo = "prometheus.ex";
+          rev = "a4e9beb3c1c479d14b352fd9d6dd7b1f6d7deee5";
+          sha256 = "1v0q4bi7sb253i8q016l7gwlv5562wk5zy3l2sa446csvsacnpjk";
+        };
+        # you can re-use the same beamDeps argument as generated
+        beamDeps = with final; [ prometheus ];
+      };
+  });
+};
+```
+
+You will need to run the build process once to fix the sha256 to correspond to your new git src.
+
+###### FOD {#fixed-output-derivation}
+
+A fixed output derivation will download mix dependencies from the internet. To ensure reproducibility, a hash will be supplied. Note that mix is relatively reproducible. An FOD generating a different hash on each run hasn't been observed (as opposed to npm where the chances are relatively high). See [elixir_ls](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/beam-modules/elixir_ls.nix) for a usage example of FOD.
+
+Practical steps
+
+- start with the following argument to mixRelease
+
+```nix
+  mixFodDeps = fetchMixDeps {
+    pname = "mix-deps-${pname}";
+    inherit src version;
+    sha256 = lib.fakeSha256;
+  };
+```
+
+The first build will complain about the sha256 value, you can replace with the suggested value after that.
+
+Note that if after you've replaced the value, nix suggests another sha256, then mix is not fetching the dependencies reproducibly. An FOD will not work in that case and you will have to use mix2nix.
+
+##### mixRelease - example {#mix-release-example}
+
+Here is how your `default.nix` file would look for a phoenix project.
 
 ```nix
 with import <nixpkgs> { };
 
 let
+  # beam.interpreters.erlangR23 is available if you need a particular version
   packages = beam.packagesWith beam.interpreters.erlang;
+
+  pname = "your_project";
+  version = "0.0.1";
+
   src = builtins.fetchgit {
     url = "ssh://git@github.com/your_id/your_repo";
     rev = "replace_with_your_commit";
   };
 
-  pname = "your_project";
-  version = "0.0.1";
-  mixEnv = "prod";
-
+  # if using mix2nix you can use the mixNixDeps attribute
   mixFodDeps = packages.fetchMixDeps {
     pname = "mix-deps-${pname}";
-    inherit src mixEnv version;
+    inherit src version;
     # nix will complain and tell you the right value to replace this with
     sha256 = lib.fakeSha256;
     # if you have build time environment variables add them here
@@ -97,45 +177,19 @@ let
 
   nodeDependencies = (pkgs.callPackage ./assets/default.nix { }).shell.nodeDependencies;
 
-  frontEndFiles = stdenvNoCC.mkDerivation {
-    pname = "frontend-${pname}";
-
-    nativeBuildInputs = [ nodejs ];
-
-    inherit version src;
-
-    buildPhase = ''
-      cp -r ./assets $TEMPDIR
-
-      mkdir -p $TEMPDIR/assets/node_modules/.cache
-      cp -r ${nodeDependencies}/lib/node_modules $TEMPDIR/assets
-      export PATH="${nodeDependencies}/bin:$PATH"
-
-      cd $TEMPDIR/assets
-      webpack --config ./webpack.config.js
-      cd ..
-    '';
-
-    installPhase = ''
-      cp -r ./priv/static $out/
-    '';
-
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-    # nix will complain and tell you the right value to replace this with
-    outputHash = lib.fakeSha256;
-
-    impureEnvVars = lib.fetchers.proxyImpureEnvVars;
-  };
-
-
 in packages.mixRelease {
-  inherit src pname version mixEnv mixFodDeps;
+  inherit src pname version mixFodDeps;
   # if you have build time environment variables add them here
   MY_ENV_VAR="my_value";
-  preInstall = ''
-    mkdir -p ./priv/static
-    cp -r ${frontEndFiles} ./priv/static
+
+  postBuild = ''
+    ln -sf ${nodeDependencies}/lib/node_modules assets/node_modules
+    npm run deploy --prefix ./assets
+
+    # for external task you need a workaround for the no deps check flag
+    # https://github.com/phoenixframework/phoenix/issues/2690
+    mix do deps.loadpaths --no-deps-check, phx.digest
+    mix phx.digest --no-deps-check
   '';
 }
 ```
@@ -165,6 +219,8 @@ in
   systemd.services.${release_name} = {
     wantedBy = [ "multi-user.target" ];
     after = [ "network.target" "postgresql.service" ];
+    # note that if you are connecting to a postgres instance on a different host
+    # postgresql.service should not be included in the requires.
     requires = [ "network-online.target" "postgresql.service" ];
     description = "my app";
     environment = {
@@ -201,6 +257,7 @@ in
     path = [ pkgs.bash ];
   };
 
+  # in case you have migration scripts or you want to use a remote shell
   environment.systemPackages = [ release ];
 }
 ```
@@ -215,16 +272,11 @@ Usually, we need to create a `shell.nix` file and do our development inside of t
 { pkgs ? import <nixpkgs> {} }:
 
 with pkgs;
-
 let
-
-  elixir = beam.packages.erlangR22.elixir_1_9;
-
+  elixir = beam.packages.erlangR24.elixir_1_12;
 in
 mkShell {
   buildInputs = [ elixir ];
-
-  ERL_INCLUDE_PATH="${erlang}/lib/erlang/usr/include";
 }
 ```
 
@@ -264,6 +316,7 @@ let
     # TODO: not sure how to make hex available without installing it afterwards.
     mix local.hex --if-missing
     export LANG=en_US.UTF-8
+    # keep your shell history in iex
     export ERL_AFLAGS="-kernel shell_history enabled"
 
     # postges related

maintainers/maintainer-list.nix

@@ -7445,6 +7445,16 @@
     name = "Maxim Schuwalow";
     email = "maxim.schuwalow@gmail.com";
   };
+  msfjarvis = {
+    github = "msfjarvis";
+    githubId = 3348378;
+    name = "Harsh Shandilya";
+    email = "nixos@msfjarvis.dev";
+    keys = [{
+      longkeyid = "rsa4096/0xB7843F823355E9B9";
+      fingerprint = "8F87 050B 0F9C B841 1515  7399 B784 3F82 3355 E9B9";
+    }];
+  };
   msiedlarek = {
     email = "mikolaj@siedlarek.pl";
     github = "msiedlarek";

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -22,7 +22,7 @@
       </listitem>
       <listitem>
         <para>
-          kOps now defaults to 1.21.0, which uses containerd as the
+          kOps now defaults to 1.21.1, which uses containerd as the
           default runtime.
         </para>
       </listitem>

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -7,7 +7,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 ## Highlights {#sec-release-21.11-highlights}
 
 - PHP now defaults to PHP 8.0, updated from 7.4.
-- kOps now defaults to 1.21.0, which uses containerd as the default runtime.
+
+- kOps now defaults to 1.21.1, which uses containerd as the default runtime.
 
 - `python3` now defaults to Python 3.9, updated from Python 3.8.
 

nixos/modules/hardware/video/nvidia.nix

@@ -143,6 +143,15 @@ in
       '';
     };
 
+    hardware.nvidia.nvidiaSettings = mkOption {
+      default = true;
+      type = types.bool;
+      description = ''
+        Whether to add nvidia-settings, NVIDIA's GUI configuration tool, to
+        systemPackages.
+      '';
+    };
+
     hardware.nvidia.nvidiaPersistenced = mkOption {
       default = false;
       type = types.bool;
@@ -279,7 +288,8 @@ in
     hardware.opengl.extraPackages = optional offloadCfg.enable nvidia_x11.out;
     hardware.opengl.extraPackages32 = optional offloadCfg.enable nvidia_x11.lib32;
 
-    environment.systemPackages = [ nvidia_x11.bin nvidia_x11.settings ]
+    environment.systemPackages = [ nvidia_x11.bin ]
+      ++ optionals nvidiaSettings [ nvidia_x11.settings ]
       ++ optionals nvidiaPersistencedEnabled [ nvidia_x11.persistenced ];
 
     systemd.packages = optional cfg.powerManagement.enable nvidia_x11.out;

nixos/modules/services/audio/roon-bridge.nix

@@ -14,9 +14,6 @@ in {
         default = false;
         description = ''
           Open ports in the firewall for the bridge.
-
-          UDP: 9003
-          TCP: 9100 - 9200
         '';
       };
       user = mkOption {
@@ -54,10 +51,15 @@ in {
     };
 
     networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPortRanges = [
-        { from = 9100; to = 9200; }
-      ];
+      allowedTCPPortRanges = [{ from = 9100; to = 9200; }];
       allowedUDPPorts = [ 9003 ];
+      extraCommands = ''
+        iptables -A INPUT -s 224.0.0.0/4 -j ACCEPT
+        iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
+        iptables -A INPUT -s 240.0.0.0/5 -j ACCEPT
+        iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT
+        iptables -A INPUT -m pkttype --pkt-type broadcast -j ACCEPT
+      '';
     };
 
 

nixos/modules/services/audio/roon-server.nix

@@ -14,9 +14,6 @@ in {
         default = false;
         description = ''
           Open ports in the firewall for the server.
-
-          UDP: 9003
-          TCP: 9100 - 9200
         '';
       };
       user = mkOption {
@@ -54,10 +51,15 @@ in {
     };
 
     networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPortRanges = [
-        { from = 9100; to = 9200; }
-      ];
+      allowedTCPPortRanges = [{ from = 9100; to = 9200; }];
       allowedUDPPorts = [ 9003 ];
+      extraCommands = ''
+        iptables -A INPUT -s 224.0.0.0/4 -j ACCEPT
+        iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
+        iptables -A INPUT -s 240.0.0.0/5 -j ACCEPT
+        iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT
+        iptables -A INPUT -m pkttype --pkt-type broadcast -j ACCEPT
+      '';
     };
 
 

nixos/modules/services/network-filesystems/ipfs.nix

@@ -14,10 +14,12 @@ let
 
   splitMulitaddr = addrRaw: lib.tail (lib.splitString "/" addrRaw);
 
-  multiaddrToListenStream = addrRaw: let
+  multiaddrToListenStream = addrRaw:
+    let
       addr = splitMulitaddr addrRaw;
       s = builtins.elemAt addr;
-    in if s 0 == "ip4" && s 2 == "tcp"
+    in
+    if s 0 == "ip4" && s 2 == "tcp"
     then "${s 1}:${s 3}"
     else if s 0 == "ip6" && s 2 == "tcp"
     then "[${s 1}]:${s 3}"
@@ -25,16 +27,19 @@ let
     then "/${lib.concatStringsSep "/" (lib.tail addr)}"
     else null; # not valid for listen stream, skip
 
-  multiaddrToListenDatagram = addrRaw: let
+  multiaddrToListenDatagram = addrRaw:
+    let
       addr = splitMulitaddr addrRaw;
       s = builtins.elemAt addr;
-    in if s 0 == "ip4" && s 2 == "udp"
+    in
+    if s 0 == "ip4" && s 2 == "udp"
     then "${s 1}:${s 3}"
     else if s 0 == "ip6" && s 2 == "udp"
     then "[${s 1}]:${s 3}"
     else null; # not valid for listen datagram, skip
 
-in {
+in
+{
 
   ###### interface
 
@@ -65,7 +70,8 @@ in {
 
       dataDir = mkOption {
         type = types.str;
-        default = if versionAtLeast config.system.stateVersion "17.09"
+        default =
+          if versionAtLeast config.system.stateVersion "17.09"
           then "/var/lib/ipfs"
           else "/var/lib/ipfs/.ipfs";
         description = "The data dir for IPFS";
@@ -83,6 +89,12 @@ in {
         description = "Whether IPFS should try to mount /ipfs and /ipns at startup.";
       };
 
+      autoMigrate = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether IPFS should try to run the fs-repo-migration at startup.";
+      };
+
       ipfsMountDir = mkOption {
         type = types.str;
         default = "/ipfs";
@@ -137,7 +149,7 @@ in {
           These are applied last, so may override configuration set by other options in this module.
           Keep in mind that this configuration is stateful; i.e., unsetting anything in here does not reset the value to the default!
         '';
-        default = {};
+        default = { };
         example = {
           Datastore.StorageMax = "100GB";
           Discovery.MDNS.Enabled = false;
@@ -153,7 +165,7 @@ in {
       extraFlags = mkOption {
         type = types.listOf types.str;
         description = "Extra flags passed to the IPFS daemon";
-        default = [];
+        default = [ ];
       };
 
       localDiscovery = mkOption {
@@ -168,7 +180,7 @@ in {
         type = types.nullOr types.int;
         default = null;
         description = "The fdlimit for the IPFS systemd unit or <literal>null</literal> to have the daemon attempt to manage it";
-        example = 64*1024;
+        example = 64 * 1024;
       };
 
       startWhenNeeded = mkOption {
@@ -186,6 +198,9 @@ in {
     environment.systemPackages = [ cfg.package ];
     environment.variables.IPFS_PATH = cfg.dataDir;
 
+    # https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size
+    boot.kernel.sysctl."net.core.rmem_max" = mkDefault 2500000;
+
     programs.fuse = mkIf cfg.autoMount {
       userAllowOther = true;
     };
@@ -234,6 +249,8 @@ in {
         ipfs --offline config Mounts.FuseAllowOther --json true
         ipfs --offline config Mounts.IPFS ${cfg.ipfsMountDir}
         ipfs --offline config Mounts.IPNS ${cfg.ipnsMountDir}
+      '' + optionalString cfg.autoMigrate ''
+        ${pkgs.ipfs-migrator}/bin/fs-repo-migrations -y
       '' + concatStringsSep "\n" (collect
         isString
         (mapAttrsRecursive
@@ -245,14 +262,15 @@ in {
               EOF
               ipfs --offline config --json "${concatStringsSep "." path}" "$value"
             '')
-              ({ Addresses.API = cfg.apiAddress;
+          ({
+            Addresses.API = cfg.apiAddress;
             Addresses.Gateway = cfg.gatewayAddress;
             Addresses.Swarm = cfg.swarmAddress;
           } //
           cfg.extraConfig))
       );
       serviceConfig = {
-        ExecStart = ["" "${cfg.package}/bin/ipfs daemon ${ipfsFlags}"];
+        ExecStart = [ "" "${cfg.package}/bin/ipfs daemon ${ipfsFlags}" ];
         User = cfg.user;
         Group = cfg.group;
       } // optionalAttrs (cfg.serviceFdlimit != null) { LimitNOFILE = cfg.serviceFdlimit; };
@@ -263,12 +281,16 @@ in {
     systemd.sockets.ipfs-gateway = {
       wantedBy = [ "sockets.target" ];
       socketConfig = {
-        ListenStream = let
+        ListenStream =
+          let
             fromCfg = multiaddrToListenStream cfg.gatewayAddress;
-          in [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
-        ListenDatagram = let
+          in
+          [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
+        ListenDatagram =
+          let
             fromCfg = multiaddrToListenDatagram cfg.gatewayAddress;
-          in [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
+          in
+          [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
       };
     };
 
@@ -276,9 +298,11 @@ in {
       wantedBy = [ "sockets.target" ];
       # We also include "%t/ipfs.sock" because there is no way to put the "%t"
       # in the multiaddr.
-      socketConfig.ListenStream = let
+      socketConfig.ListenStream =
+        let
           fromCfg = multiaddrToListenStream cfg.apiAddress;
-        in [ "" "%t/ipfs.sock" ] ++ lib.optional (fromCfg != null) fromCfg;
+        in
+        [ "" "%t/ipfs.sock" ] ++ lib.optional (fromCfg != null) fromCfg;
     };
 
   };

nixos/modules/services/networking/syncthing.nix

@@ -37,7 +37,7 @@ let
     do sleep 1; done
 
     curl() {
-        ${pkgs.curl}/bin/curl -sS -H "X-API-Key: $api_key" \
+        ${pkgs.curl}/bin/curl -sSLk -H "X-API-Key: $api_key" \
             --retry 1000 --retry-delay 1 --retry-all-errors \
             "$@"
     }

nixos/modules/services/web-apps/nextcloud.xml

@@ -84,28 +84,31 @@
 </para>
 
  </section>
- <section xml:id="module-services-nextcloud-pitfalls-during-upgrade">
-  <title>Pitfalls</title>
 
+ <section xml:id="module-services-nextcloud-pitfalls-during-upgrade">
+  <title>Common problems</title>
+  <itemizedlist>
+   <listitem>
+    <formalpara>
+     <title>General notes</title>
      <para>
       Unfortunately Nextcloud appears to be very stateful when it comes to
       managing its own configuration. The config file lives in the home directory
       of the <literal>nextcloud</literal> user (by default
       <literal>/var/lib/nextcloud/config/config.php</literal>) and is also used to
-   track several states of the application (e.g. whether installed or not).
+      track several states of the application (e.g., whether installed or not).
      </para>
-
+    </formalpara>
     <para>
      All configuration parameters are also stored in
-   <literal>/var/lib/nextcloud/config/override.config.php</literal> which is generated by
-   the module and linked from the store to ensure that all values from <literal>config.php</literal>
-   can be modified by the module.
-   However <literal>config.php</literal> manages the application's state and shouldn't be touched
-   manually because of that.
+     <filename>/var/lib/nextcloud/config/override.config.php</filename> which is generated by
+     the module and linked from the store to ensure that all values from
+     <filename>config.php</filename> can be modified by the module.
+     However <filename>config.php</filename> manages the application's state and shouldn't be
+     touched manually because of that.
     </para>
-
     <warning>
-   <para>Don't delete <literal>config.php</literal>! This file
+     <para>Don't delete <filename>config.php</filename>! This file
      tracks the application's state and a deletion can cause unwanted
      side-effects!</para>
     </warning>
@@ -115,9 +118,12 @@
      maintenance:install</literal>! This command tries to install the application
      and can cause unwanted side-effects!</para>
     </warning>
-
+   </listitem>
+   <listitem>
+    <formalpara>
+     <title>Multiple version upgrades</title>
      <para>
-   Nextcloud doesn't allow to move more than one major-version forward. If you're e.g. on
+      Nextcloud doesn't allow to move more than one major-version forward. E.g., if you're on
       <literal>v16</literal>, you cannot upgrade to <literal>v18</literal>, you need to upgrade to
       <literal>v17</literal> first. This is ensured automatically as long as the
       <link linkend="opt-system.stateVersion">stateVersion</link> is declared properly. In that case
@@ -125,6 +131,46 @@
       release) will be selected by default and the module will generate a warning that reminds
       the user to upgrade to latest Nextcloud <emphasis>after</emphasis> that deploy.
      </para>
+    </formalpara>
+   </listitem>
+   <listitem>
+    <formalpara>
+     <title><literal>Error: Command "upgrade" is not defined.</literal></title>
+     <para>
+      This error usually occurs if the initial installation
+      (<command>nextcloud-occ maintenance:install</command>) has failed. After that, the application
+      is not installed, but the upgrade is attempted to be executed. Further context can
+      be found in <link xlink:href="https://github.com/NixOS/nixpkgs/issues/111175">NixOS/nixpkgs#111175</link>.
+     </para>
+    </formalpara>
+    <para>
+     First of all, it makes sense to find out what went wrong by looking at the logs
+     of the installation via <command>journalctl -u nextcloud-setup</command> and try to fix
+     the underlying issue.
+    </para>
+    <itemizedlist>
+     <listitem>
+      <para>
+       If this occurs on an <emphasis>existing</emphasis> setup, this is most likely because
+       the maintenance mode is active. It can be deactivated by running
+       <command>nextcloud-occ maintenance:mode --off</command>. It's advisable though to
+       check the logs first on why the maintenance mode was activated.
+      </para>
+     </listitem>
+     <listitem>
+      <warning><para>Only perform the following measures on
+      <emphasis>freshly installed instances!</emphasis></para></warning>
+      <para>
+       A re-run of the installer can be forced by <emphasis>deleting</emphasis>
+       <filename>/var/lib/nextcloud/config/config.php</filename>. This is the only time
+       advisable because the fresh install doesn't have any state that can be lost.
+       In case that doesn't help, an entire re-creation can be forced via
+       <command>rm -rf ~nextcloud/</command>.
+      </para>
+     </listitem>
+    </itemizedlist>
+   </listitem>
+  </itemizedlist>
  </section>
 
  <section xml:id="module-services-nextcloud-httpd">

pkgs/applications/editors/kakoune/default.nix

@@ -1,25 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, ncurses, asciidoc, docbook_xsl, libxslt, pkg-config }:
+{ lib, stdenv, fetchFromGitHub }:
 
 with lib;
 
 stdenv.mkDerivation rec {
   pname = "kakoune-unwrapped";
-  version = "2020.09.01";
+  version = "2021.08.28";
   src = fetchFromGitHub {
     repo = "kakoune";
     owner = "mawww";
     rev = "v${version}";
-    sha256 = "091qzk0qs7hql0q51hix99srgma35mhdnjfd5ncfba1bmc1h8x5i";
+    sha256 = "13kc68vkrzg89khir6ayyxgbnmz16dhippcnw09hhzxivf5ayzpy";
   };
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ ncurses asciidoc docbook_xsl libxslt ];
-  makeFlags = [ "debug=no" ];
-
-  postPatch = ''
-    export PREFIX=$out
-    cd src
-    sed -ie 's#--no-xmllint#--no-xmllint --xsltproc-opts="--nonet"#g' Makefile
-  '';
+  makeFlags = [ "debug=no" "PREFIX=${placeholder "out"}" ];
 
   preConfigure = ''
     export version="v${version}"

pkgs/applications/misc/merkaartor/default.nix

@@ -23,7 +23,7 @@ mkDerivation rec {
     owner = "openstreetmap";
     repo = "merkaartor";
     rev = version;
-    sha256 = "sha256-Gx+gnVbSY8JnG03kO5vVQNlSZRl/hrKTdDbh7lyIMbA=";
+    sha256 = "sha256-I3QNCXzwhEFa8aOdwl3UJV8MLZ9caN9wuaaVrGFRvbQ=";
   };
 
   nativeBuildInputs = [ qmake qttools ];

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    version = "91.0.1";
+    version = "91.0.2";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "9388789bfe3dca596542b082d0eca7b1a6d1bbbf69eb97cc445f563d1a5ff0c9b530f3be02ee290805e311b0fcb392a4f5341e9f256d9764a787b43b232bdf67";
+      sha512 = "82084799524db6661d97d9942a01ca9edec2fae6b503c9dd2d79fca78bfef4ee0a888e5f5cf4cfa2b91d9c9392658bb8218bae2b9bec0fbcacfe73a174a4dbe7";
     };
 
     meta = {

pkgs/applications/networking/cluster/kops/default.nix

@@ -65,8 +65,8 @@ rec {
   };
 
   kops_1_21 = mkKops rec {
-    version = "1.21.0";
-    sha256 = "sha256-T2i3qpg3GC7yaYCGrN1V5XXrUyT+Ce9Q4aV00gQJ7gM=";
+    version = "1.21.1";
+    sha256 = "sha256-/C/fllgfAovHuyGRY+LM09bsUpYdA8zDw1w0b9HnlBc=";
     rev = "v${version}";
   };
 }

pkgs/applications/networking/cluster/nomad/1.0.nix

@@ -6,6 +6,6 @@
 
 callPackage ./generic.nix {
   inherit buildGoPackage nvidia_x11 nvidiaGpuSupport;
-  version = "1.0.9";
-  sha256 = "0ml6l5xq1310ib5zqfdwlxmsmhpc5ybd05z7pc6zgxbma1brxdv4";
+  version = "1.0.10";
+  sha256 = "1yd4j35dmxzg9qapqyq3g3hnhxi5c4f57q43xbim8255bjyn94f0";
 }

pkgs/applications/networking/cluster/nomad/1.1.nix

@@ -6,7 +6,7 @@
 
 callPackage ./genericModule.nix {
   inherit buildGoModule nvidia_x11 nvidiaGpuSupport;
-  version = "1.1.3";
-  sha256 = "0jpc8ff56k9q2kv9l86y3p8h3gqbvx6amvs0cw8sp4i7dqd2ihz2";
-  vendorSha256 = "0az4gr7292lfr5wrwbkdknrigqm15lkbnf5mh517hl3yzv4pb8yr";
+  version = "1.1.4";
+  sha256 = "182f3sxw751s8qg16vbssplhl92i9gshgzvflwwvnxraz2795y7l";
+  vendorSha256 = "1nddknnsvb05sapbj1c52cv2fmibvdg48f88malxqblzw33wfziq";
 }

pkgs/applications/networking/instant-messengers/element/element-desktop-package.json

@@ -2,7 +2,7 @@
   "name": "element-desktop",
   "productName": "Element",
   "main": "lib/electron-main.js",
-  "version": "1.8.1",
+  "version": "1.8.2",
   "description": "A feature-rich client for Matrix.org",
   "author": "Element",
   "repository": {
@@ -57,7 +57,7 @@
     "allchange": "^1.0.0",
     "asar": "^2.0.1",
     "chokidar": "^3.5.2",
-    "electron": "^13.1.7",
+    "electron": "^13.1.9",
     "electron-builder": "22.11.4",
     "electron-builder-squirrel-windows": "22.11.4",
     "electron-devtools-installer": "^3.1.1",
@@ -83,7 +83,7 @@
   },
   "build": {
     "appId": "im.riot.app",
-    "electronVersion": "13.1.6",
+    "electronVersion": "13.1.9",
     "files": [
       "package.json",
       {

pkgs/applications/networking/instant-messengers/element/element-desktop-yarndeps.nix

@@ -2002,11 +2002,11 @@
       };
     }
     {
-      name = "electron___electron_13.1.7.tgz";
+      name = "electron___electron_13.1.9.tgz";
       path = fetchurl {
-        name = "electron___electron_13.1.7.tgz";
-        url  = "https://registry.yarnpkg.com/electron/-/electron-13.1.7.tgz";
-        sha1 = "7e17f5c93a8d182a2a486884fed3dc34ab101be9";
+        name = "electron___electron_13.1.9.tgz";
+        url  = "https://registry.yarnpkg.com/electron/-/electron-13.1.9.tgz";
+        sha1 = "668e2632b81e9fa21edfd32876282d3e2ff7fd76";
       };
     }
     {

pkgs/applications/networking/instant-messengers/element/element-desktop.nix

@@ -19,12 +19,12 @@
 
 let
   executableName = "element-desktop";
-  version = "1.8.1";
+  version = "1.8.2";
   src = fetchFromGitHub {
     owner = "vector-im";
     repo = "element-desktop";
     rev = "v${version}";
-    sha256 = "sha256-FIKbyfnRuHBbmtjwxNC//n5UiGTCQNr+PeiZEi3+RGI=";
+    sha256 = "sha256-6DPMfx3LF45YWn2do02zDMLYZGBgBrOMJx3XBAO0ZyM=";
   };
   electron_exec = if stdenv.isDarwin then "${electron}/Applications/Electron.app/Contents/MacOS/Electron" else "${electron}/bin/electron";
 in

pkgs/applications/networking/instant-messengers/element/element-web.nix

@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "element-web";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchurl {
     url = "https://github.com/vector-im/element-web/releases/download/v${version}/element-v${version}.tar.gz";
-    sha256 = "sha256-C2oWYpPxMeSgGKyjUe6Ih13ggZliN4bmAX5cakzW1u8=";
+    sha256 = "sha256-SgVxYPmdgFn6Nll1a6b1Sn2H5I0Vkjorn3gA9d5FamQ=";
   };
 
   installPhase = ''

pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix

@@ -1,13 +1,13 @@
 { lib, stdenv, fetchurl, dpkg
 , alsa-lib, atk, cairo, cups, curl, dbus, expat, fontconfig, freetype, gdk-pixbuf, glib, glibc, gnome2, gnome
 , gtk3, libappindicator-gtk3, libnotify, libpulseaudio, libsecret, libv4l, nspr, nss, pango, systemd, wrapGAppsHook, xorg
-, at-spi2-atk, libuuid, at-spi2-core, libdrm, mesa, libxkbcommon }:
+, at-spi2-atk, libuuid, at-spi2-core, libdrm, mesa, libxkbcommon, libxshmfence }:
 
 let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.69.0.77";
+  version = "8.75.0.140";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
@@ -45,6 +45,7 @@ let
     libdrm
     mesa
     libxkbcommon
+    libxshmfence
     xorg.libxkbfile
     xorg.libX11
     xorg.libXcomposite
@@ -68,7 +69,7 @@ let
           "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
           "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
         ];
-        sha256 = "PaqlPp+BRS0cH7XI4x1/5HqYti63rQThmTtPaghIQH0=";
+        sha256 = "sha256-z3xsl53CSJthSd/BMbMD7RdYQ4z9oI/Rb9jUvd82H4E=";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
@@ -121,7 +122,7 @@ in stdenv.mkDerivation {
     description = "Linux client for skype";
     homepage = "https://www.skype.com";
     license = licenses.unfree;
-    maintainers = with lib.maintainers; [ panaeon jraygauthier ];
+    maintainers = with maintainers; [ panaeon jraygauthier ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/applications/office/onlyoffice-bin/default.nix

@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , fetchurl
-# Alphabetic ordering below
+  # Alphabetic ordering below
 , alsa-lib
 , at-spi2-atk
 , atk
@@ -70,13 +70,14 @@ let
     pulseaudio
   ];
 
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
   pname = "onlyoffice-desktopeditors";
-  version = "6.2.0";
+  version = "6.3.1";
   minor = null;
   src = fetchurl {
     url = "https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v${version}/onlyoffice-desktopeditors_amd64.deb";
-    sha256 = "sha256-nKmWxaVVul/rGDIh3u9zCpKu7U0nmrntFFf96xQyzdg=";
+    sha256 = "sha256-WCjCljA7yB7Zm/I4rDZnfgaUQpDUKwbUvL7hkIG8cVM=";
   };
 
   nativeBuildInputs = [
@@ -160,6 +161,8 @@ in stdenv.mkDerivation rec {
     gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : "${runtimeLibs}" )
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
     homepage = "https://www.onlyoffice.com/";

pkgs/applications/office/onlyoffice-bin/update.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+version="$(curl -sL "https://api.github.com/repos/ONLYOFFICE/DesktopEditors/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
+update-source-version onlyoffice-bin "$version"

pkgs/applications/science/math/sage/sage-src.nix

@@ -13,19 +13,41 @@ let
   # Fetch a diff between `base` and `rev` on sage's git server.
   # Used to fetch trac tickets by setting the `base` to the last release and the
   # `rev` to the last commit of the ticket.
-  fetchSageDiff = { base, name, rev, sha256, ...}@args: (
+  fetchSageDiff = { base, name, rev, sha256, squashed ? false, ...}@args: (
     fetchpatch ({
       inherit name sha256;
 
-      # We used to use
-      # "https://git.sagemath.org/sage.git/patch?id2=${base}&id=${rev}"
-      # but the former way does not squash multiple patches together.
-      url = "https://github.com/sagemath/sage/compare/${base}...${rev}.diff";
+      # There are three places to get changes from:
+      #
+      # 1) From Sage's Trac. Contains all release tags (like "9.4") and all developer
+      # branches (wip patches from tickets), but exports each commit as a separate
+      # patch, so merge commits can lead to conflicts. Used if squashed == false.
+      #
+      # 2) From GitHub's sagemath/sage repo. This lets us use a GH feature that allows
+      # us to choose between a .patch file, with one patch per commit, or a .diff file,
+      # which squashes all commits into a single diff. This is used if squashed ==
+      # true. This repo has all release tags. However, it has no developer branches, so
+      # this option can't be used if a change wasn't yet shipped in a (possibly beta)
+      # release.
+      #
+      # 3) From GitHub's sagemath/sagetrac-mirror repo. Mirrors all developer branches,
+      # but has no release tags. The only use case not covered by 1 or 2 is when we need
+      # to apply a patch from an open ticket that contains merge commits.
+      #
+      # Item 3 could cover all use cases if the sagemath/sagetrack-mirror repo had
+      # release tags, but it requires a sha instead of a release number in "base", which
+      # is inconvenient.
+      urls = if squashed
+             then [
+               "https://github.com/sagemath/sage/compare/${base}...${rev}.diff"
+               "https://github.com/sagemath/sagetrac-mirror/compare/${base}...${rev}.diff"
+             ]
+             else [ "https://git.sagemath.org/sage.git/patch?id2=${base}&id=${rev}" ];
 
       # We don't care about sage's own build system (which builds all its dependencies).
       # Exclude build system changes to avoid conflicts.
       excludes = [ "build/*" ];
-    } // builtins.removeAttrs args [ "rev" "base" "sha256" ])
+    } // builtins.removeAttrs args [ "rev" "base" "sha256" "squashed" ])
   );
 in
 stdenv.mkDerivation rec {
@@ -80,6 +102,14 @@ stdenv.mkDerivation rec {
     # now set the cache dir to be within the .sage directory. This is not
     # strictly necessary, but keeps us from littering in the user's HOME.
     ./patches/sympow-cache.patch
+
+    # https://trac.sagemath.org/ticket/32305
+    (fetchSageDiff {
+      base = "9.4";
+      name = "networkx-2.6-upgrade.patch";
+      rev = "9808325853ba9eb035115e5b056305a1c9d362a0";
+      sha256 = "sha256-gJSqycCtbAVr5qnVEbHFUvIuTOvaxFIeffpzd6nH4DE=";
+    })
   ];
 
   patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;

pkgs/applications/version-management/git-and-tools/git-branchless/default.nix

@@ -2,9 +2,13 @@
 
 , coreutils
 , git
+, libiconv
 , ncurses
 , rustPlatform
 , sqlite
+, stdenv
+, Security
+, SystemConfiguration
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -33,6 +37,10 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     ncurses
     sqlite
+  ] ++ lib.optionals (stdenv.isDarwin) [
+    Security
+    SystemConfiguration
+    libiconv
   ];
 
   preCheck = ''
@@ -44,6 +52,6 @@ rustPlatform.buildRustPackage rec {
     description = "A suite of tools to help you visualize, navigate, manipulate, and repair your commit history";
     homepage = "https://github.com/arxanas/git-branchless";
     license = licenses.asl20;
-    maintainers = with maintainers; [ nh2 ];
+    maintainers = with maintainers; [ msfjarvis nh2 ];
   };
 }

pkgs/applications/window-managers/stalonetray/default.nix

@@ -1,29 +1,51 @@
-{ lib, stdenv, fetchurl, libX11, xorgproto }:
+{ autoreconfHook
+, docbook_xml_dtd_44
+, docbook-xsl-ns
+, fetchFromGitHub
+, lib
+, libX11
+, libXpm
+, libxslt
+, stdenv
+}:
 
 stdenv.mkDerivation rec {
   pname = "stalonetray";
-  version = "0.8.3";
+  version = "0.8.4";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/stalonetray/${pname}-${version}.tar.bz2";
-    sha256 = "0k7xnpdb6dvx25d67v0crlr32cdnzykdsi9j889njiididc8lm1n";
+  src = fetchFromGitHub {
+    owner = "kolbusa";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-grxPqSYPLUstLIOKqzMActaSQ2ftYrjbalfR4HcPDRY=";
   };
 
-  buildInputs = [ libX11 xorgproto ];
+  preConfigure =
+    let
+      db_root = "${docbook-xsl-ns}/share/xml/docbook-xsl-ns";
+      ac_str = "AC_SUBST(DOCBOOK_ROOT)";
+      ac_str_sub = "DOCBOOK_ROOT=${db_root}; ${ac_str}";
+    in
+      ''
+        substituteInPlace configure.ac --replace '${ac_str}' '${ac_str_sub}'
+      '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    docbook-xsl-ns
+    docbook_xml_dtd_44
+    libX11
+    libXpm
+    libxslt
+  ];
 
   hardeningDisable = [ "format" ];
 
   meta = with lib; {
     description = "Stand alone tray";
-    homepage = "http://stalonetray.sourceforge.net";
-    license = licenses.gpl2;
+    homepage = "https://github.com/kolbusa/stalonetray";
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ raskin ];
   };
-
-  passthru = {
-    updateInfo = {
-      downloadPage = "https://sourceforge.net/projects/stalonetray/files/";
-    };
-  };
 }

pkgs/development/compilers/bluespec/default.nix

@@ -1,67 +1,46 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoconf
 , automake
 , fontconfig
-, gmp-static
-, gperf
 , libX11
-, libpoly
 , perl
 , flex
 , bison
 , pkg-config
-, itktcl
-, incrtcl
 , tcl
 , tk
-, verilog
 , xorg
 , yices
 , zlib
 , ghc
-}:
+, gmp-static
+, verilog
+, asciidoctor
+, tex }:
 
 let
-  ghcWithPackages = ghc.withPackages (g: (with g; [old-time regex-compat syb split ]));
+  ghcWithPackages = ghc.withPackages (g: (with g; [ old-time regex-compat syb split ]));
+
 in stdenv.mkDerivation rec {
   pname = "bluespec";
-  version = "unstable-2021.03.29";
+  version = "2021.07";
 
   src = fetchFromGitHub {
     owner = "B-Lang-org";
     repo = "bsc";
-      rev    = "00185f7960bd1bd5554a1167be9f37e1f18ac454";
-      sha256 = "1bcdhql4cla137d8xr8m2h21dyxv0jpjpalpr5mgj2jxqfsmkbrn";
+    rev = version;
+    sha256 = "0gw8wyp65lpkyfhv3laazz9qypdl8qkp1j7cqp0gv11592a9p5qw";
   };
 
   enableParallelBuilding = true;
 
+  outputs = [ "out" "doc" ];
+
+  # https://github.com/B-Lang-org/bsc/pull/278
   patches = [ ./libstp_stub_makefile.patch ];
 
-  buildInputs = yices.buildInputs ++ [
-    zlib
-    tcl tk
-    libX11 # tcltk
-    xorg.libXft
-    fontconfig
-  ];
-
-  nativeBuildInputs = [
-    automake autoconf
-    perl
-    flex
-    bison
-    pkg-config
-    ghcWithPackages
-  ];
-
-  checkInputs = [
-    verilog
-  ];
-
-
   postUnpack = ''
     mkdir -p $sourceRoot/src/vendor/yices/v2.6/yices2
     # XXX: only works because yices.src isn't a tarball.
@@ -79,21 +58,61 @@ in stdenv.mkDerivation rec {
     substituteInPlace src/comp/Makefile \
       --replace 'BINDDIR' 'BINDIR' \
       --replace 'install-bsc install-bluetcl' 'install-bsc install-bluetcl $(UTILEXES) install-utils'
+
     # allow running bsc to bootstrap
-    export LD_LIBRARY_PATH=/build/source/inst/lib/SAT
+    export LD_LIBRARY_PATH=$PWD/inst/lib/SAT
   '';
 
+  buildInputs = yices.buildInputs ++ [
+    fontconfig
+    libX11 # tcltk
+    tcl
+    tk
+    xorg.libXft
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    automake
+    autoconf
+    asciidoctor
+    bison
+    flex
+    ghcWithPackages
+    perl
+    pkg-config
+    tex
+  ];
+
   makeFlags = [
+    "release"
     "NO_DEPS_CHECKS=1" # skip the subrepo check (this deriviation uses yices.src instead of the subrepo)
     "NOGIT=1" # https://github.com/B-Lang-org/bsc/issues/12
     "LDCONFIG=ldconfig" # https://github.com/B-Lang-org/bsc/pull/43
     "STP_STUB=1"
   ];
 
-  installPhase = "mv inst $out";
-
   doCheck = true;
 
+  checkInputs = [
+    gmp-static
+    verilog
+  ];
+
+  checkTarget = "check-smoke";
+
+  installPhase = ''
+    mkdir -p $out
+    mv inst/bin $out
+    mv inst/lib $out
+
+    # fragile, I know..
+    mkdir -p $doc/share/doc/bsc
+    mv inst/README $doc/share/doc/bsc
+    mv inst/ReleaseNotes.* $doc/share/doc/bsc
+    mv inst/doc/*.pdf $doc/share/doc/bsc
+  '';
+
   meta = {
     description = "Toolchain for the Bluespec Hardware Definition Language";
     homepage = "https://github.com/B-Lang-org/bsc";

pkgs/development/libraries/grilo/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, gettext, vala, glib, liboauth, gtk3
+{ lib, stdenv, fetchurl, fetchpatch, meson, ninja, pkg-config, gettext, vala, glib, liboauth, gtk3
 , gtk-doc, docbook_xsl, docbook_xml_dtd_43
 , libxml2, gnome, gobject-introspection, libsoup, totem-pl-parser }:
 
@@ -16,6 +16,14 @@ in stdenv.mkDerivation rec {
     sha256 = "0ywjvh7xw4ql1q4fvl0q5n06n08pga1g1nc9l7c3x5214gr3fj6i";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-39365.patch";
+      url = "https://gitlab.gnome.org/GNOME/grilo/-/commit/cd2472e506dafb1bb8ae510e34ad4797f63e263e.patch";
+      sha256 = "1i1p21vlms43iawg4dl1dibnpsbnkx27kcfvllnx76q07bfrpwzm";
+    })
+  ];
+
   setupHook = ./setup-hook.sh;
 
   mesonFlags = [

pkgs/development/libraries/libe57format/default.nix

@@ -5,20 +5,17 @@
   boost,
   xercesc,
   icu,
-
-  dos2unix,
-  fetchpatch,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libe57format";
-  version = "2.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "asmaloney";
     repo = "libE57Format";
     rev = "v${version}";
-    sha256 = "05z955q68wjbd9gc5fw32nqg69xc82n2x75j5vchxzkgnn3adcpi";
+    sha256 = "15l23spjvak5h3n7aj3ggy0c3cwcg8mvnc9jlbd9yc2ra43bx7bp";
   };
 
   nativeBuildInputs = [
@@ -36,31 +33,6 @@ stdenv.mkDerivation rec {
     xercesc
   ];
 
-  # TODO: Remove CMake patching when https://github.com/asmaloney/libE57Format/pull/60 is available.
-
-  # GNU patch cannot patch `CMakeLists.txt` that has CRLF endings,
-  # see https://unix.stackexchange.com/questions/239364/how-to-fix-hunk-1-failed-at-1-different-line-endings-message/243748#243748
-  # so convert it first.
-  prePatch = ''
-    ${dos2unix}/bin/dos2unix CMakeLists.txt
-  '';
-  patches = [
-    (fetchpatch {
-      name = "libE57Format-cmake-Fix-config-filename.patch";
-      url = "https://github.com/asmaloney/libE57Format/commit/279d8d6b60ee65fb276cdbeed74ac58770a286f9.patch";
-      sha256 = "0fbf92hs1c7yl169i7zlbaj9yhrd1yg3pjf0wsqjlh8mr5m6rp14";
-    })
-  ];
-  # It appears that while the patch has
-  #     diff --git a/cmake/E57Format-config.cmake b/cmake/e57format-config.cmake
-  #     similarity index 100%
-  #     rename from cmake/E57Format-config.cmake
-  #     rename to cmake/e57format-config.cmake
-  # GNU patch doesn't interpret that.
-  postPatch = ''
-    mv cmake/E57Format-config.cmake cmake/e57format-config.cmake
-  '';
-
   # The build system by default builds ONLY static libraries, and with
   # `-DE57_BUILD_SHARED=ON` builds ONLY shared libraries, see:
   #     https://github.com/asmaloney/libE57Format/issues/48
@@ -79,7 +51,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Library for reading & writing the E57 file format (fork of E57RefImpl)";
+    description = "Library for reading & writing the E57 file format";
     homepage = "https://github.com/asmaloney/libE57Format";
     license = licenses.boost;
     maintainers = with maintainers; [ chpatrick nh2 ];

pkgs/development/libraries/qt-5/5.12/default.nix

@@ -127,6 +127,8 @@ let
       callPackage = self.newScope { inherit qtCompatVersion qtModule srcs; };
     in {
 
+      inherit callPackage qtCompatVersion qtModule srcs;
+
       mkDerivationWith =
         import ../mkDerivation.nix
         { inherit lib; inherit debug; inherit (self) wrapQtAppsHook; };

pkgs/development/libraries/qt-5/5.14/default.nix

@@ -139,6 +139,8 @@ let
       callPackage = self.newScope { inherit qtCompatVersion qtModule srcs; };
     in {
 
+      inherit callPackage qtCompatVersion qtModule srcs;
+
       mkDerivationWith =
         import ../mkDerivation.nix
         { inherit lib; inherit debug; inherit (self) wrapQtAppsHook; };

pkgs/development/libraries/qt-5/5.15/default.nix

@@ -165,6 +165,8 @@ let
       callPackage = self.newScope { inherit qtCompatVersion qtModule srcs; };
     in {
 
+      inherit callPackage qtCompatVersion qtModule srcs;
+
       mkDerivationWith =
         import ../mkDerivation.nix
         { inherit lib; inherit debug; inherit (self) wrapQtAppsHook; };

pkgs/development/libraries/tclap/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tclap";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/tclap/${pname}-${version}.tar.gz";
-    sha256 = "sha256-GefbUoFUDxVDSHcLw6dIRXX09Umu+OAKq8yUs5X3c8k=";
+    sha256 = "sha256-Y0xbWduxzLydal9t5JSiV+KaP1nctvwwRF/zm0UYhXQ=";
   };
 
   meta = with lib; {

pkgs/development/libraries/usbredir/default.nix

@@ -22,12 +22,15 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    glib
     meson
     ninja
     pkg-config
   ];
 
+  buildInputs = [
+    glib
+  ];
+
   propagatedBuildInputs = [
     libusb1
   ];

pkgs/development/ocaml-modules/uunf/default.nix

@@ -56,5 +56,8 @@ stdenv.mkDerivation {
     platforms = ocaml.meta.platforms or [];
     license = licenses.bsd3;
     maintainers = [ maintainers.vbgl ];
+    # See https://github.com/dbuenzli/uunf/issues/15#issuecomment-903151264
+    broken = lib.versions.majorMinor ocaml.version == "4.08"
+      && stdenv.hostPlatform.isAarch64;
   };
 }

pkgs/development/python-modules/coqpit/default.nix

@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "coqpit";
-  version = "0.0.10";
+  version = "0.0.13";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "coqui-ai";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1gcj5sffcmlvhhk6wbvmxppjpckb90q1avc07jbnb1vvrb2h9lr0";
+    sha256 = "sha256-YzCO/i0SMyXRAgiZ8Y97bHHuGFeSF8GqUjvNoHLwXZQ=";
   };
 
   checkInputs = [

pkgs/development/python-modules/karton-dashboard/default.nix

@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "karton-dashboard";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0qygv9lkd1jad5b4l0zz6hsi7m8q0fmpwaa6hpp7p9x6ql7gnyl8";
+    sha256 = "sha256-C1wtpHyuTlNS6Se1rR0RGUl3xht4aphAtddKlIsOAkI=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pg8000/default.nix

@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pg8000";
-  version = "1.21.0";
+  version = "1.21.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1msj0vk14fbsis8yfk0my1ygpcli9jz3ivwdi9k6ii5i6330i4f9";
+    sha256 = "sha256-HMvuyTtw4uhTLfOr3caQXHghkJyW3Oqu91G1fFKRhpo=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pyupgrade/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyupgrade";
-  version = "2.24.0";
+  version = "2.25.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "asottile";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vWju0D5O3RtDiv9uYQqd9kEwTIcV9QTHYXM/icB/rM0=";
+    sha256 = "0mbx5gv6ns896mxzml8q9r9dn5wvnrb7gc5iw49fdwbb0yw9yhyx";
   };
 
   checkInputs = [ pytestCheckHook ];

pkgs/development/python-modules/scramp/default.nix

@@ -2,23 +2,32 @@
 , asn1crypto
 , buildPythonPackage
 , fetchFromGitHub
+, pytest-mock
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "scramp";
-  version = "1.4.0";
+  version = "1.4.1";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "tlocke";
     repo = "scramp";
     rev = version;
-    sha256 = "sha256-aXuRIW/3qBzan8z3EzSSxqaZfa3WnPhlviNa2ugIjik=";
+    sha256 = "sha256-HEt2QxNHX9Oqx+o0++ZtS61SVHra3nLAqv7NbQWVV+E=";
   };
 
-  propagatedBuildInputs = [ asn1crypto ];
+  propagatedBuildInputs = [
+    asn1crypto
+  ];
 
-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    pytest-mock
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "scramp" ];
 

pkgs/development/tools/continuous-integration/jenkins/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jenkins";
-  version = "2.289.3";
+  version = "2.303.1";
 
   src = fetchurl {
     url = "http://mirrors.jenkins.io/war-stable/${version}/jenkins.war";
-    sha256 = "11wb4kqy1hja2fgnqsr6p0khdyvinclprxz9z5m58czrsllzsvcr";
+    sha256 = "0rf06axz1hxssg942w2g66avak30jy6rfdwxynhriqv3vrf17bja";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/tools/flawfinder/default.nix

@@ -1,16 +1,15 @@
 { lib
 , fetchurl
-, installShellFiles
 , python3
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flawfinder";
-  version = "2.0.18";
+  version = "2.0.19";
 
   src = fetchurl {
     url = "https://dwheeler.com/flawfinder/flawfinder-${version}.tar.gz";
-    sha256 = "1hk2y13fd2a5gf42a1hk45hw6pbls715wi9k1yh3c3wyhvbyylba";
+    sha256 = "sha256-/lUJgdNwq/oKKWcTRswLA4Ipqb2QsjnqsPAfEiEt9hg=";
   };
 
   # Project is using a combination of bash/Python for the tests

pkgs/development/tools/rust/cargo-expand/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.8";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    sha256 = "sha256-UkNO2uNiyN6xB74dNMiWZUCH6qq6P6u95wTq8xRvxsQ=";
+    sha256 = "sha256-wDuCmiQzyY/Ydr67fYb0yZaSWvuYwW91j0CoqbUFFpg=";
   };
 
-  cargoSha256 = "sha256-JTjPdTG8KGYVkiCkTqRiJyTpm7OpZkbW10EKSp9lLJ4=";
+  cargoSha256 = "sha256-5KCGXJzk5VStby/JzjXJvDSrhFlB8YJHMcQNL8GxkLI=";
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 

pkgs/games/anki/bin.nix

@@ -3,15 +3,23 @@
 let
   pname = "anki-bin";
   # Update hashes for both Linux and Darwin!
-  version = "2.1.46";
+  version = "2.1.47";
+
+  sources = {
+    linux = fetchurl {
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux.tar.bz2";
+      sha256 = "sha256-cObvjXeDUDslfAhMOrlqyjidri6N7xLR2+LRz3hTdfg=";
+    };
+    darwin = fetchurl {
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac.dmg";
+      sha256 = "sha256-TwYrI9gSabJ5icOsygtEJRymkrSgCD8jDXMtpaJXgWg=";
+    };
+  };
 
   unpacked = stdenv.mkDerivation {
     inherit pname version;
 
-    src = fetchurl {
-      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux.tar.bz2";
-      sha256 = "1jzpf42fqhfbjr95k7bpsnf34sfinamp6v828y0sapa4gzfvwkkz";
-    };
+    src = sources.linux;
 
     installPhase = ''
       runHook preInstall
@@ -32,6 +40,8 @@ let
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
     maintainers = with maintainers; [ atemu ];
   };
+
+  passthru = { inherit sources; };
 in
 
 if stdenv.isLinux then buildFHSUserEnv (appimageTools.defaultFhsEnvArgs // {
@@ -51,14 +61,11 @@ if stdenv.isLinux then buildFHSUserEnv (appimageTools.defaultFhsEnvArgs // {
       $out/share/
   '';
 
-  inherit meta;
+  inherit meta passthru;
 }) else stdenv.mkDerivation {
-  inherit pname version;
+  inherit pname version passthru;
 
-  src = fetchurl {
-    url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac.dmg";
-    sha256 = "003cmh5qdj5mkrpm51n0is872faj99dqfkaaxyyrn6x03s36l17y";
-  };
+  src = sources.darwin;
 
   nativeBuildInputs = [ undmg ];
   sourceRoot = ".";

pkgs/os-specific/linux/ddcci/default.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
       --replace depmod \#
   '';
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "KVER=${kernel.modDirVersion}"
     "KERNEL_MODLIB=$(out)/lib/modules/${kernel.modDirVersion}"

pkgs/os-specific/linux/nvidia-x11/builder.sh

@@ -17,10 +17,8 @@ buildPhase() {
         # Create the module.
         echo "Building linux driver against kernel: $kernel";
         cd kernel
-        sysSrc=$(echo $kernel/lib/modules/$kernelVersion/source)
-        sysOut=$(echo $kernel/lib/modules/$kernelVersion/build)
         unset src # used by the nv makefile
-        make IGNORE_PREEMPT_RT_PRESENCE=1 NV_BUILD_SUPPORTS_HMM=1 SYSSRC=$sysSrc SYSOUT=$sysOut module -j$NIX_BUILD_CORES
+        make $makeFlags -j $NIX_BUILD_CORES module
 
         cd ..
     fi

pkgs/os-specific/linux/nvidia-x11/generic.nix

@@ -75,6 +75,13 @@ let
     kernel = if libsOnly then null else kernel.dev;
     kernelVersion = if libsOnly then null else kernel.modDirVersion;
 
+    makeFlags = optionals (!libsOnly) (kernel.makeFlags ++ [
+      "IGNORE_PREEMPT_RT_PRESENCE=1"
+      "NV_BUILD_SUPPORTS_HMM=1"
+      "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+      "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    ]);
+
     hardeningDisable = [ "pic" "format" ];
 
     dontStrip = true;

pkgs/os-specific/linux/nvidia-x11/persistenced.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ m4 ];
   buildInputs = [ libtirpc ];
 
+  inherit (nvidia_x11) makeFlags;
+
   installFlags = [ "PREFIX=$(out)" ];
 
   postFixup = ''

pkgs/os-specific/linux/nvidia-x11/settings.nix

@@ -24,7 +24,7 @@ let
       cd src/libXNVCtrl
     '';
 
-    makeFlags = [
+    makeFlags = nvidia_x11.makeFlags ++ [
       "OUTPUTDIR=." # src/libXNVCtrl
     ];
 
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
              ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook ];
 
   enableParallelBuilding = true;
-  makeFlags = [ "NV_USE_BUNDLED_LIBJANSSON=0" ];
+  makeFlags = nvidia_x11.makeFlags ++ [ "NV_USE_BUNDLED_LIBJANSSON=0" ];
   installFlags = [ "PREFIX=$(out)" ];
 
   postPatch = lib.optionalString nvidia_x11.useProfiles ''
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
   preBuild = ''
     if [ -e src/libXNVCtrl/libXNVCtrl.a ]; then
       ( cd src/libXNVCtrl
-        make
+        make $makeFlags
       )
     fi
   '';

pkgs/os-specific/linux/rtw88/default.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation {
     license = with licenses; [ bsd3 gpl2Only ];
     maintainers = with maintainers; [ tvorog ];
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "4.14";
+    broken = kernel.kernelOlder "4.14" || kernel.kernelAtLeast "5.14";
     priority = -1;
   };
 }

pkgs/os-specific/linux/xmm7360-pci/default.nix

@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     license = licenses.isc;
     maintainers = with maintainers; [ flokli hexa ];
     platforms = platforms.linux;
+    broken = kernel.kernelAtLeast "5.14";
   };
 }

pkgs/os-specific/linux/zfs/default.nix

@@ -210,13 +210,14 @@ in {
 
   zfsUnstable = common {
     # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.14";
+    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.15";
     latestCompatibleLinuxPackages = linuxPackages_5_13;
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2.1.0";
+    version = "unstable-2021-08-30";
+    rev = "3b89d9518df2c7fd747e349873a3d4d498beb20e";
 
-    sha256 = "sha256-YdY4SStXZGBBdAHdM3R/unco7ztxI3s0/buPSNSeh5o=";
+    sha256 = "sha256-wVbjpVrPQmhJmMqdGUf0IwlCIoOsT7Zfj5lxSKcOsgg=";
 
     isUnstable = true;
   };

pkgs/servers/caddy/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "caddy";
-  version = "2.4.3";
+  version = "2.4.4";
 
   subPackages = [ "cmd/caddy" ];
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "caddyserver";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Z3BVx7gCkls5Hy+H6lA3DOBequRutwa2F34FDt9n+8I=";
+    sha256 = "sha256-POdDORICDE49BQ5LLTs4GTb1VoSXZD4K4MpRkVoj+AY=";
   };
 
-  vendorSha256 = "sha256-Zwpakw/vyDVngc1Bn+RdRPECNweruwGxsT4dfvMELkQ=";
+  vendorSha256 = "sha256-JAQaxEmdX0fpDahe55pEKnUW64k8JjrytkBrXpQJz3I=";
 
   passthru.tests = { inherit (nixosTests) caddy; };
 

pkgs/servers/matrix-synapse/default.nix

@@ -12,11 +12,11 @@ let
 in
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.41.0";
+  version = "1.41.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KLsTr8dKp8k7TcrC598ApDib7P0m9evmfdl8jbsZLdc=";
+    sha256 = "1vaym6mxnwg2xdqjcigi2sb0kkdi0ly5d5ghakfsysxcfn08d1z8";
   };
 
   patches = [

pkgs/servers/nextcloud/default.nix

@@ -54,8 +54,8 @@ in {
   };
 
   nextcloud22 = generic {
-    version = "22.1.0";
-    sha256 = "sha256-SCCAj3mRRoU2BOH6J9fykkSQGKRNxzv5KKl7AgKDGLo=";
+    version = "22.1.1";
+    sha256 = "sha256-5VtuuXf7U5CB4zp9jxluOEMOszfMdr8DeaZjpJf73ls=";
   };
   # tip: get she sha with:
   # curl 'https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2.sha256'

pkgs/servers/plex/raw.nix

@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.24.0.4930-ab6e1a058";
+  version = "1.24.1.4931-1a38e63c6";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "0fhbm2ykk2nx1j619kpzgw32rgbh2snh8g25m7k42cpmg4a3zz4m";
+    sha256 = "1vsg90rlhynfk8wlbf080fv9wah7w8244pl878hjbi6yrjmz2s7g";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "0h1vk8ads1jrb5adcpfrz1qdf60jw4wiss9zzcyamfry1ir94n3r";
+    sha256 = "08xai0jcpmj1hwkkkgc87v9xwszd5bvwhn36kp6v73jnv1l5cmqb";
   };
 
   outputs = [ "out" "basedb" ];

pkgs/shells/zsh/oh-my-zsh/default.nix

@@ -5,15 +5,15 @@
 , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert }:
 
 stdenv.mkDerivation rec {
-  version = "2021-08-18";
+  version = "2021-08-27";
   pname = "oh-my-zsh";
-  rev = "cbb534267aca09fd123635fc39a7d00c0e21a5f7";
+  rev = "190325049ef93731ab28295dbedf36d44ab33d7a";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    sha256 = "LbgqdIGVvcTUSDVSyH8uJmfuT0ymJvf04AL91HjNWwQ=";
+    sha256 = "x+cGlYjTgs7Esb4NNSBcKhoDb1SuEQxONt/sSHeVj0M=";
   };
 
   installPhase = ''

pkgs/tools/audio/tts/default.nix

@@ -16,20 +16,22 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "tts";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "coqui-ai";
     repo = "TTS";
     rev = "v${version}";
-    sha256 = "sha256-FlxR1bPkUZT3SPuWiK0oAuI9dKfurEZurB0NhyDgOyY=";
+    sha256 = "sha256-7YMNxZ15qQowEE0tE6x/LbtirNGp7h9OLyS1JSl9x2A=";
   };
 
   postPatch = ''
-    sed -i -e 's!librosa==[^"]*!librosa!' requirements.txt
-    sed -i -e 's!numba==[^"]*!numba!' requirements.txt
-    sed -i -e 's!numpy==[^"]*!numpy!' requirements.txt
-    sed -i -e 's!umap-learn==[^"]*!umap-learn!' requirements.txt
+    sed -i requirements.txt \
+      -e 's!librosa==[^"]*!librosa!' \
+      -e 's!mecab-python3==[^"]*!mecab-python3!' \
+      -e 's!numba==[^"]*!numba!' \
+      -e 's!numpy==[^"]*!numpy!' \
+      -e 's!umap-learn==[^"]*!umap-learn!'
   '';
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/tools/backup/duplicati/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "duplicati";
-  version = "2.0.6.1";
+  version = "2.0.6.3";
   channel = "beta";
-  build_date = "2021-05-03";
+  build_date = "2021-06-17";
 
   src = fetchzip {
     url = "https://github.com/duplicati/duplicati/releases/download/v${version}-${version}_${channel}_${build_date}/duplicati-${version}_${channel}_${build_date}.zip";
-    sha256 = "09537hswpicsx47vfdm78j3h7vvjd7nqjd2461jrln57nl7v7dac";
+    sha256 = "sha256-usMwlmer6rLgP46wGVkaAIocUW4MjuEpVWdX7rRcghg=";
     stripRoot = false;
   };
 

pkgs/tools/filesystems/tar2ext4/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tar2ext4";
-  version = "0.8.20";
+  version = "0.8.21";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "hcsshim";
     rev = "v${version}";
-    sha256 = "sha256-X7JsUFL9NkNT7ihE5olrqMUP8RnoVC10KLrQeT/OU3o=";
+    sha256 = "sha256-oYCL6agif/BklMY5/ub6PExS6D/ZlTxi1QaabMOsEfw=";
   };
 
   sourceRoot = "source/cmd/tar2ext4";

pkgs/tools/misc/android-tools/default.nix

@@ -1,8 +1,12 @@
 { lib, stdenv, fetchurl, fetchpatch
-, cmake, perl, go
+, cmake, perl, go, python3
 , protobuf, zlib, gtest, brotli, lz4, zstd, libusb1, pcre2, fmt_7
 }:
 
+let
+  pythonEnv = python3.withPackages(ps: [ ps.protobuf ]);
+in
+
 stdenv.mkDerivation rec {
   pname = "android-tools";
   version = "31.0.2";
@@ -23,8 +27,13 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    sed -i -E "0,/import api_pb2/ s//from google.protobuf import api_pb2/" vendor/avb/aftltool.py
+  '';
+
   nativeBuildInputs = [ cmake perl go ];
   buildInputs = [ protobuf zlib gtest brotli lz4 zstd libusb1 pcre2 fmt_7 ];
+  propagatedBuildInputs = [ pythonEnv ];
 
   # Don't try to fetch any Go modules via the network:
   GOFLAGS = [ "-mod=vendor" ];
@@ -33,6 +42,12 @@ stdenv.mkDerivation rec {
     export GOCACHE=$TMPDIR/go-cache
   '';
 
+  postInstall = ''
+    install -Dm755 ../vendor/avb/aftltool.py -t $out/bin
+    install -Dm755 ../vendor/avb/avbtool.py -t $out/bin
+    install -Dm755 ../vendor/mkbootimg/mkbootimg.py $out/bin/mkbootimg
+  '';
+
   meta = with lib; {
     description = "Android SDK platform tools";
     longDescription = ''

pkgs/tools/misc/logstash/7.x.nix

@@ -24,8 +24,7 @@ let
       x86_64-linux = "sha256-jiV2yGPwPgZ5plo3ftImVDLSOsk/XBzFkeeALSObLhU=";
       x86_64-darwin = "sha256-UYG+GGr23eAc2GgNX/mXaGU0WKMjiQMPpD1wUvAVz0A=";
     };
-in
-stdenv.mkDerivation rec {
+  this = stdenv.mkDerivation rec {
     version = elk7Version;
     pname = "logstash${optionalString (!enableUnfree) "-oss"}";
 
@@ -74,4 +73,6 @@ stdenv.mkDerivation rec {
           elk = nixosTests.elk.ELK-7;
         }
       );
-}
+  };
+in
+this

pkgs/tools/misc/pspg/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "4.5.0";
+  version = "5.3.4";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-RWezBNqjKybMtfpxPhDg2ysb4ksKphTPdTNTwCe4pas=";
+    sha256 = "sha256-wju69kC6koYy2yABjx7/rWsuJXV1vjwSBztNlu13TJs=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/tools/networking/networkmanager/applet/default.nix

@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "network-manager-applet";
-  version = "1.22.0";
+  version = "1.24.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-xw2AtI1AqcuZ7JZ8xDifZ+fwMBUopp1IFXIEEzGmRr4=";
+    sha256 = "sha256-ufS8pdA1Jxjge3OF+xlam7yP1oa3lZt0E3hU1SqrnFg=";
   };
 
   mesonFlags = [

pkgs/tools/networking/offlineimap/default.nix

@@ -1,17 +1,40 @@
-{ lib, fetchFromGitHub, python2Packages,
-  asciidoc, cacert, libxml2, libxslt, docbook_xsl }:
+{ lib
+, fetchFromGitHub
+, python2Packages
+, asciidoc
+, cacert
+, docbook_xsl
+, installShellFiles
+, libxml2
+, libxslt
+}:
 
 python2Packages.buildPythonApplication rec {
-  version = "7.3.3";
+  version = "7.3.4";
   pname = "offlineimap";
 
   src = fetchFromGitHub {
     owner = "OfflineIMAP";
     repo = "offlineimap";
     rev = "v${version}";
-    sha256 = "1gg8ry67i20qapj4z20am9bm67m2q28kixcj7ja75m897vhzarnq";
+    sha256 = "sha256-sra2H0+5+LAIU3+uJnii+AYA05nuDyKVMW97rbaFOfI=";
   };
 
+  nativeBuildInputs = [
+    asciidoc
+    docbook_xsl
+    installShellFiles
+    libxml2
+    libxslt
+  ];
+
+  propagatedBuildInputs = with python2Packages; [
+    six
+    kerberos
+    rfc6555
+    pysocks
+  ];
+
   postPatch = ''
     # Skip xmllint to stop failures due to no network access
     sed -i docs/Makefile -e "s|a2x -v -d |a2x -L -v -d |"
@@ -20,21 +43,19 @@ python2Packages.buildPythonApplication rec {
     sed -i offlineimap/utils/distro.py -e '/def get_os_sslcertfile():/a\ \ \ \ return "${cacert}/etc/ssl/certs/ca-bundle.crt"'
   '';
 
-  doCheck = false;
-
-  nativeBuildInputs = [ asciidoc libxml2 libxslt docbook_xsl ];
-  propagatedBuildInputs = with python2Packages; [ six kerberos rfc6555 pysocks ];
-
   postInstall = ''
     make -C docs man
-    install -D -m 644 docs/offlineimap.1 ''${!outputMan}/share/man/man1/offlineimap.1
-    install -D -m 644 docs/offlineimapui.7 ''${!outputMan}/share/man/man7/offlineimapui.7
+    installManPage docs/offlineimap.1
+    installManPage docs/offlineimapui.7
   '';
 
-  meta = {
+  # Test requires credentials
+  doCheck = false;
+
+  meta = with lib; {
     description = "Synchronize emails between two repositories, so that you can read the same mailbox from multiple computers";
     homepage = "http://offlineimap.org";
-    license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ endocrimes ];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ endocrimes ];
   };
 }

pkgs/tools/networking/spoofer/default.nix

@@ -6,11 +6,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "spoofer";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchurl {
     url = "https://www.caida.org/projects/spoofer/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-+4FNC+rMxIoVXlW7HnBXUg0P4FhNvMTAqJ9c7lXQ6vE=";
+    sha256 = "sha256-6ov1dZbxmBRIhfIzUaxiaHUeiU6SbNKhiQX1W4lmhD8=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/tools/networking/ssldump/default.nix

@@ -1,30 +1,52 @@
-{ lib, stdenv, fetchFromGitHub, openssl, libpcap }:
+{ lib
+, stdenv
+, autoreconfHook
+, fetchFromGitHub
+, json_c
+, libnet
+, libpcap
+, openssl
+}:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "ssldump";
-  version = "1.1";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "adulau";
     repo = "ssldump";
-    rev = "7491b9851505acff95b2c68097e9b9f630d418dc";
-    sha256 = "1j3rln86khdnc98v50hclvqaq83a24c1rfzbcbajkbfpr4yxpnpd";
+    rev = "v${version}";
+    sha256 = "1xnlfqsl93nxbcv4x4xsgxa6mnhcx37hijrpdb7vzla6q7xvg8qr";
   };
 
-  buildInputs = [ libpcap openssl ];
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    json_c
+    libnet
+    libpcap
+    openssl
+  ];
+
   prePatch = ''
     sed -i -e 's|#include.*net/bpf.h|#include <pcap/bpf.h>|' \
       base/pcap-snoop.c
   '';
-  configureFlags = [ "--with-pcap-lib=${libpcap}/lib"
+
+  configureFlags = [
+    "--with-pcap-lib=${libpcap}/lib"
     "--with-pcap-inc=${libpcap}/include"
     "--with-openssl-lib=${openssl}/lib"
-                     "--with-openssl-inc=${openssl}/include" ];
-  meta = {
+    "--with-openssl-inc=${openssl}/include"
+  ];
+
+  meta = with lib; {
     description = "An SSLv3/TLS network protocol analyzer";
     homepage = "http://ssldump.sourceforge.net";
     license = "BSD-style";
-    maintainers = with lib.maintainers; [ aycanirican ];
-    platforms = lib.platforms.linux;
+    maintainers = with maintainers; [ aycanirican ];
+    platforms = platforms.linux;
   };
 }

pkgs/tools/nix/nixos-install-tools/default.nix

@@ -7,6 +7,7 @@
   #       https://github.com/NixOS/nixpkgs/pull/119942
   nixos-install-tools,
   runCommand,
+  nixosTests,
 }:
 let
   inherit (nixos {}) config;
@@ -40,6 +41,7 @@ in
   };
 
   passthru.tests = {
+    nixos-tests = lib.recurseIntoAttrs nixosTests.installer;
     nixos-install-help = runCommand "test-nixos-install-help" {
       nativeBuildInputs = [
         man

pkgs/tools/security/hashcat/default.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname   = "hashcat";
-  version = "6.2.3";
+  version = "6.2.4";
 
   src = fetchurl {
     url = "https://hashcat.net/files/hashcat-${version}.tar.gz";
-    sha256 = "sha256-wL4cZpPuHzXHvvH3m/njCpVPcX70LQDjd4eq7/MnHlE=";
+    sha256 = "sha256-kCA5b/kzaT4xC0ebZB6G8Xg9mBnWDR2Qd1KtjSSmDDE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/tools/security/sequoia/default.nix

@@ -102,7 +102,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A cool new OpenPGP implementation";
     homepage = "https://sequoia-pgp.org/";
-    license = licenses.gpl3;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ minijackson doronbehar ];
   };
 }

pkgs/tools/security/vault/vault-bin.nix

@@ -1,26 +1,26 @@
 { lib, stdenv, fetchurl, unzip, makeWrapper, gawk, glibc }:
 
 let
-  version = "1.8.1";
+  version = "1.8.2";
 
   sources = let
     base = "https://releases.hashicorp.com/vault/${version}";
   in {
     x86_64-linux = fetchurl {
       url = "${base}/vault_${version}_linux_amd64.zip";
-      sha256 = "sha256-u0EfK7rXnC5PBkDx09XvUOK9p9T0CHWlaRfJX/eDwts=";
+      sha256 = "sha256-10ck1swivx4cfFGQCbAXaAms9vHCDuVhB94Mq1TNhGM=";
     };
     i686-linux = fetchurl {
       url = "${base}/vault_${version}_linux_386.zip";
-      sha256 = "11khjx5lrb7zmrahkniqwn4ad98yjy2fm0miz63nzpq85c0yrjdn";
+      sha256 = "0v8l056xs88mjpcfpi9k8chv0zk7lf80gkj580z3d37h2yr2b1gg";
     };
     x86_64-darwin = fetchurl {
       url = "${base}/vault_${version}_darwin_amd64.zip";
-      sha256 = "02gqavhg3pk6jkdmn1yp9pl3pv4ni2sg56q218gs8gbbypj22wpq";
+      sha256 = "1xabbndnx85zbhbwid30q0jii41hmwwlqrxz4a0rllqshvmq4fg3";
     };
     aarch64-linux = fetchurl {
       url = "${base}/vault_${version}_linux_arm64.zip";
-      sha256 = "0500nc8v7hwnrckz4fkf5fpqcg3i45q25lz4lghzkcabnss4qand";
+      sha256 = "00p2540bdhw46licab401vbwdyvp1hkngssx6nh99igj14sl60qa";
     };
   };
 

pkgs/tools/system/stress-ng/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "stress-ng";
-  version = "0.12.11";
+  version = "0.13.00";
 
   src = fetchurl {
     url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-lxOTB1Mhwkw9V2ms+rtwWRHR9BHO1ZN7fP6lhSjBtOY=";
+    sha256 = "sha256-HO/kowV8FSKxRuYvYbgM5uLpnaLYXr4lvAP8RSKOWM0=";
   };
 
   postPatch = ''

pkgs/top-level/all-packages.nix

@@ -5255,7 +5255,9 @@ with pkgs;
 
   git-big-picture = callPackage ../applications/version-management/git-and-tools/git-big-picture { };
 
-  git-branchless = callPackage ../applications/version-management/git-and-tools/git-branchless { };
+  git-branchless = callPackage ../applications/version-management/git-and-tools/git-branchless {
+    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
+  };
 
   inherit (haskellPackages) git-brunch;
 
@@ -10818,6 +10820,7 @@ with pkgs;
 
   bluespec = callPackage ../development/compilers/bluespec {
     gmp-static = gmp.override { withStatic = true; };
+    tex = texlive.combined.scheme-full;
   };
 
   cakelisp = callPackage ../development/compilers/cakelisp { };

pkgs/top-level/stage.nix

@@ -15,7 +15,7 @@
   # Utility functions, could just import but passing in for efficiency
   lib
 
-, # Use to reevaluate Nixpkgs; a dirty hack that should be removed
+, # Use to reevaluate Nixpkgs
   nixpkgsFun
 
   ## Other parameters
@@ -218,7 +218,7 @@ let
     appendOverlays = extraOverlays:
       if extraOverlays == []
       then self
-      else import ./stage.nix (args // { overlays = args.overlays ++ extraOverlays; });
+      else nixpkgsFun { overlays = args.overlays ++ extraOverlays; };
 
     # NOTE: each call to extend causes a full nixpkgs rebuild, adding ~130MB
     #       of allocations. DO NOT USE THIS IN NIXPKGS.