Merge master into staging-next

2022-05-12 18:02:25 +00:00 · 2022-05-12 18:02:25 +00:00 · 6b23d26afc
commit 6b23d26afc
parent fda107c3ec 5eb5ae4261
55 changed files with 1019 additions and 483 deletions
--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -339,9 +339,10 @@ rec {

  /* Translate a Nix value into a shell variable declaration, with proper escaping.

-     Supported value types are strings (mapped to regular variables), lists of strings
-     (mapped to Bash-style arrays) and attribute sets of strings (mapped to Bash-style
-     associative arrays). Note that "strings" include string-coercible values like paths.
+     The value can be a string (mapped to a regular variable), a list of strings
+     (mapped to a Bash-style array) or an attribute set of strings (mapped to a
+     Bash-style associative array). Note that "string" includes string-coercible
+     values like paths or derivations.

     Strings are translated into POSIX sh-compatible code; lists and attribute sets
     assume a shell that understands Bash syntax (e.g. Bash or ZSH).
@ -356,7 +357,7 @@ rec {
  */
  toShellVar = name: value:
    lib.throwIfNot (isValidPosixName name) "toShellVar: ${name} is not a valid shell variable name" (
-    if isAttrs value then
+    if isAttrs value && ! isCoercibleToString value then
      "declare -A ${name}=(${
        concatStringsSep " " (lib.mapAttrsToList (n: v:
          "[${escapeShellArg n}]=${escapeShellArg v}"
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -269,6 +269,15 @@ runTests {
          strings
          possibly newlines
        '';
+        drv = {
+          outPath = "/drv";
+          foo = "ignored attribute";
+        };
+        path = /path;
+        stringable = {
+          __toString = _: "hello toString";
+          bar = "ignored attribute";
+        };
      }}
    '';
    expected = ''
@ -277,6 +286,9 @@ runTests {
      declare -A assoc=(['with some']='strings
      possibly newlines
      ')
+      drv='/drv'
+      path='/path'
+      stringable='hello toString'
    '';
  };

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -9695,6 +9695,12 @@
    githubId = 14935550;
    name = "Brad Pfannmuller";
  };
+  parras = {
+    email = "c@philipp-arras.de";
+    github = "phiadaarr";
+    githubId = 33826198;
+    name = "Philipp Arras";
+  };
  pashashocky = {
    email = "pashashocky@gmail.com";
    github = "pashashocky";
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -2297,6 +2297,14 @@
          package has been updated to 6.0.0 and now requires .NET 6.0.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>phpPackages.box</literal> package has been
+          updated from 2.7.5 to 3.16.0. See the
+          <link xlink:href="https://github.com/box-project/box/blob/master/UPGRADE.md#from-27-to-30">upgrade
+          guide</link> for more details.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>zrepl</literal> package has been updated from
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -827,6 +827,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The `vscode-extensions.ionide.ionide-fsharp` package has been updated to 6.0.0 and now requires .NET 6.0.

+- The `phpPackages.box` package has been updated from 2.7.5 to 3.16.0. See the [upgrade guide](https://github.com/box-project/box/blob/master/UPGRADE.md#from-27-to-30) for more details.
+
 - The `zrepl` package has been updated from 0.4.0 to 0.5:

  - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
--- a/nixos/modules/services/backup/automysqlbackup.nix
+++ b/nixos/modules/services/backup/automysqlbackup.nix
@ -112,7 +112,7 @@ in

    services.mysql.ensureUsers = optional (config.services.mysql.enable && cfg.config.mysql_dump_host == "localhost") {
      name = user;
-      ensurePermissions = { "*.*" = "SELECT, SHOW VIEW, TRIGGER, LOCK TABLES"; };
+      ensurePermissions = { "*.*" = "SELECT, SHOW VIEW, TRIGGER, LOCK TABLES, EVENT"; };
    };

  };
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -1384,6 +1384,18 @@ final: prev:
    meta.homepage = "https://github.com/neoclide/coc.nvim/";
  };

+  coconut-vim = buildVimPluginFrom2Nix {
+    pname = "coconut.vim";
+    version = "2017-10-10";
+    src = fetchFromGitHub {
+      owner = "manicmaniac";
+      repo = "coconut.vim";
+      rev = "cea47739aab9f163d240d1609e7eea326fd55072";
+      sha256 = "03rq3lpplgywvm620jzx085l74180163q8gls4gjrad2fgm9n96n";
+    };
+    meta.homepage = "https://github.com/manicmaniac/coconut.vim/";
+  };
+
  codi-vim = buildVimPluginFrom2Nix {
    pname = "codi.vim";
    version = "2022-04-30";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -116,6 +116,7 @@ https://github.com/iamcco/coc-spell-checker/,,
 https://github.com/coc-extensions/coc-svelte/,,
 https://github.com/iamcco/coc-tailwindcss/,,
 https://github.com/neoclide/coc.nvim/,release,
+https://github.com/manicmaniac/coconut.vim/,HEAD,
 https://github.com/metakirby5/codi.vim/,,
 https://github.com/tjdevries/colorbuddy.nvim/,,
 https://github.com/lilydjwg/colorizer/,,
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -73,6 +73,7 @@
      productTargetPath = "product/community/target/products/org.jkiss.dbeaver.core.product";

      platformMap = {
+        aarch64-darwin = "aarch64";
        aarch64-linux = "aarch64";
        x86_64-darwin = "x86_64";
        x86_64-linux  = "x86_64";
@ -127,7 +128,7 @@
      Teradata, Firebird, Derby, etc.
    '';
    license = licenses.asl20;
-    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
    maintainers = with maintainers; [ jojosch mkg20001 ];
  };
 }
--- a/pkgs/applications/misc/joshuto/default.nix
+++ b/pkgs/applications/misc/joshuto/default.nix
@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, stdenv, SystemConfiguration }:
+{ lib, rustPlatform, fetchFromGitHub, stdenv, SystemConfiguration, Foundation }:

 rustPlatform.buildRustPackage rec {
  pname = "joshuto";
@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "sha256-vhTfAoAwDJ9BjhgUEkV2H+KAetJR1YqwaZ7suF6yMXA=";

-  buildInputs = lib.optional stdenv.isDarwin SystemConfiguration;
+  buildInputs = lib.optionals stdenv.isDarwin [ SystemConfiguration Foundation ];

  meta = with lib; {
    description = "Ranger-like terminal file manager written in Rust";
--- a/pkgs/applications/misc/twitch-chat-downloader/default.nix
+++ b/pkgs/applications/misc/twitch-chat-downloader/default.nix
@ -9,16 +9,22 @@

 buildPythonApplication rec {
  pname = "twitch-chat-downloader";
-  version = "3.2.1";
+  version = "3.2.2";

  src = fetchPypi {
    inherit version;
    pname = "tcd";
-    sha256 = "f9b5ea2ad3badb7deffdd9604368ccb54170cd7929efbaa2d7b534e089ae6338";
+    sha256 = "ee6a8e22c54ccfd29988554b13fe56b2a1bf524e110fa421d77e27baa8dcaa19";
  };

  postPatch = ''
-    substituteInPlace setup.py --replace "'pipenv>=2020.5.28'," ""
+    substituteInPlace setup.py \
+      --replace "'pipenv==2022.4.30'," "" \
+      --replace "setuptools==62.1." "setuptools" \
+      --replace "requests==2.27.1" "requests" \
+      --replace "twitch-python==0.0.20" "twitch-python" \
+      --replace "pytz==2022.1" "pytz" \
+      --replace "python-dateutil==2.8.2" "python-dateutil"
  '';

  propagatedBuildInputs = [ requests twitch-python pytz python-dateutil ];
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -90,11 +90,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.38.111";
+  version = "1.38.115";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-sUTQktCQOVyXbw58u9ilFZaKg6D24Okpa+rUIO56ors=";
+    sha256 = "sha256-YQpFsB3VVzsOa7PoZ+TLv10Dzm9z819cmyw7atnG/Cs=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -45,9 +45,9 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "101.0.4951.54",
-    "sha256": "1d808a7mvg0nd0mm20c1ny5kdvb2xvrs8vz4nnk456ix8pywcv62",
-    "sha256bin64": "1m6s6xf2wvz535w6jskk3pnibvsjpzmbxvd9rlxmqr08y219gp5y",
+    "version": "101.0.4951.64",
+    "sha256": "1xyqm32y9v1hn8ji6qfw6maynqgg3266j58dq4x4aqsm2gj9cn4w",
+    "sha256bin64": "14ijrj7h2y72ppyysz6jv40c01lbnan7z69cl24asch2zjlgwv8v",
    "deps": {
      "gn": {
        "version": "2022-03-14",
@ -56,8 +56,8 @@
        "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3"
      },
      "ungoogled-patches": {
-        "rev": "101.0.4951.54-1",
-        "sha256": "0zhzy7llqddvym992pwhkgqh2f6ywjqqg0bhahl6c0np95gzhpbs"
+        "rev": "101.0.4951.64-1",
+        "sha256": "0k7w6xvjf1yzyak9ywvcdw762d8zbx6d8haz35q87jz0mxfn2mr3"
      }
    }
  }
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -1,29 +1,125 @@
-{ stdenv, fetchurl, lib, pam, python3, libxslt, perl, ArchiveZip, box2d, gettext
-, IOCompress, zlib, libjpeg, expat, freetype, libwpd
-, libxml2, db, curl, fontconfig, libsndfile, neon
-, bison, flex, zip, unzip, gtk3, libmspack, getopt, file, cairo, which
-, icu, boost, jdk, ant, cups, xorg, fontforge, jre_minimal
-, openssl, gperf, cppunit, poppler, util-linux
-, librsvg, libGLU, libGL, bsh, CoinMP, libwps, libabw, libmysqlclient
-, autoconf, automake, openldap, bash, hunspell, librdf_redland, nss, nspr
-, libwpg, dbus-glib, clucene_core, libcdr, lcms
-, unixODBC, mdds, sane-backends, mythes, libexttextcat, libvisio
-, fontsConf, pkg-config, bluez5, libtool, carlito
-, libatomic_ops, graphite2, harfbuzz, libodfgen, libzmf
-, librevenge, libe-book, libmwaw, glm, gst_all_1
-, gdb, commonsLogging, librdf_rasqal, wrapGAppsHook
-, gnome, glib, ncurses, libepoxy, gpgme, abseil-cpp
+{ stdenv
+, fetchurl
+, lib
+, pam
+, python3
+, libxslt
+, perl
+, ArchiveZip
+, box2d
+, gettext
+, IOCompress
+, zlib
+, libjpeg
+, expat
+, freetype
+, libwpd
+, libxml2
+, db
+, curl
+, fontconfig
+, libsndfile
+, neon
+, bison
+, flex
+, zip
+, unzip
+, gtk3
+, libmspack
+, getopt
+, file
+, cairo
+, which
+, icu
+, boost
+, jdk
+, ant
+, cups
+, xorg
+, fontforge
+, jre_minimal
+, openssl
+, gperf
+, cppunit
+, poppler
+, util-linux
+, librsvg
+, libGLU
+, libGL
+, bsh
+, CoinMP
+, libwps
+, libabw
+, libmysqlclient
+, autoconf
+, automake
+, openldap
+, bash
+, hunspell
+, librdf_redland
+, nss
+, nspr
+, libwpg
+, dbus-glib
+, clucene_core
+, libcdr
+, lcms
+, unixODBC
+, mdds
+, sane-backends
+, mythes
+, libexttextcat
+, libvisio
+, fontsConf
+, pkg-config
+, bluez5
+, libtool
+, carlito
+, libatomic_ops
+, graphite2
+, harfbuzz
+, libodfgen
+, libzmf
+, librevenge
+, libe-book
+, libmwaw
+, glm
+, gst_all_1
+, gdb
+, commonsLogging
+, librdf_rasqal
+, wrapGAppsHook
+, gnome
+, glib
+, ncurses
+, libepoxy
+, gpgme
+, abseil-cpp
 , langs ? [ "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sl" "uk" "zh-CN" ]
 , withHelp ? true
-, kdeIntegration ? false, mkDerivation ? null, qtbase ? null, qtx11extras ? null
-, ki18n ? null, kconfig ? null, kcoreaddons ? null, kio ? null, kwindowsystem ? null
+, kdeIntegration ? false
+, mkDerivation ? null
+, qtbase ? null
+, qtx11extras ? null
+, ki18n ? null
+, kconfig ? null
+, kcoreaddons ? null
+, kio ? null
+, kwindowsystem ? null
 , wrapQtAppsHook ? null
 , variant ? "fresh"
+, symlinkJoin
 } @ args:

 assert builtins.elem variant [ "fresh" "still" ];

 let
+  inherit (lib)
+    flatten flip
+    concatMapStrings concatMapStringsSep concatStringsSep
+    getDev getLib
+    optional optionals optionalString;
+
  jre' = jre_minimal.override {
    modules = [ "java.base" "java.desktop" "java.logging" ];
  };
@ -34,27 +130,43 @@ let

  inherit (primary-src) major minor subdir version;

-  langsSpaces = lib.concatStringsSep " " langs;
+  langsSpaces = concatStringsSep " " langs;

  mkDrv = if kdeIntegration then mkDerivation else stdenv.mkDerivation;

  srcs = {
    third_party =
-      map (x : ((fetchurl {inherit (x) url sha256 name;}) // {inherit (x) md5name md5;}))
-      (importVariant "download.nix" ++ [
-        (rec {
-          name = "unowinreg.dll";
-          url = "https://dev-www.libreoffice.org/extern/${md5name}";
-          sha256 = "1infwvv1p6i21scywrldsxs22f62x85mns4iq8h6vr6vlx3fdzga";
-          md5 = "185d60944ea767075d27247c3162b3bc";
-          md5name = "${md5}-${name}";
-        })
-      ]);
+      map (x: ((fetchurl { inherit (x) url sha256 name; }) // { inherit (x) md5name md5; }))
+        (importVariant "download.nix" ++ [
+          (rec {
+            name = "unowinreg.dll";
+            url = "https://dev-www.libreoffice.org/extern/${md5name}";
+            sha256 = "1infwvv1p6i21scywrldsxs22f62x85mns4iq8h6vr6vlx3fdzga";
+            md5 = "185d60944ea767075d27247c3162b3bc";
+            md5name = "${md5}-${name}";
+          })
+        ]);

    translations = primary-src.translations;
    help = primary-src.help;
  };
-in (mkDrv rec {
+
+  # See `postPatch` for details
+  kdeDeps = symlinkJoin {
+    name = "libreoffice-kde-dependencies-${version}";
+    paths = flatten (map (e: [ (getDev e) (getLib e) ]) [
+      qtbase
+      qtx11extras
+      kconfig
+      kcoreaddons
+      ki18n
+      kio
+      kwindowsystem
+    ]);
+  };
+
+in
+(mkDrv rec {
  pname = "libreoffice";
  inherit version;

@ -71,10 +183,10 @@ in (mkDrv rec {

  postUnpack = ''
    mkdir -v $sourceRoot/${tarballPath}
-  '' + (lib.flip lib.concatMapStrings srcs.third_party (f: ''
-      ln -sfv ${f} $sourceRoot/${tarballPath}/${f.md5name}
-      ln -sfv ${f} $sourceRoot/${tarballPath}/${f.name}
-    ''))
+  '' + (flip concatMapStrings srcs.third_party (f: ''
+    ln -sfv ${f} $sourceRoot/${tarballPath}/${f.md5name}
+    ln -sfv ${f} $sourceRoot/${tarballPath}/${f.name}
+  ''))
  + ''
    ln -sv ${srcs.help} $sourceRoot/${tarballPath}/${srcs.help.name}
    ln -svf ${srcs.translations} $sourceRoot/${tarballPath}/${srcs.translations.name}
@ -97,16 +209,20 @@ in (mkDrv rec {

  ### QT/KDE
  #
-  # We have to resort to the ugly patching of configure.ac as it assumes that
-  # the first directory that contains headers and libraries during the check
-  # contains all the relevant headers/libs which doesn't work with both as they
-  # are in multiple directories due to each having their own derivation.
-  postPatch = let
-    inc = e: path:
-      "${lib.getDev e}/include/KF5/${path}";
-    libs = list:
-      lib.concatMapStringsSep " " (e: "-L${lib.getLib e}/lib") list;
-  in ''
+  # configure.ac assumes that the first directory that contains headers and
+  # libraries during its checks contains *all* the relevant headers/libs which
+  # obviously doesn't work for us, so we have 2 options:
+  #
+  # 1. patch configure.ac in order to specify the direct paths to various Qt/KDE
+  # dependencies which is ugly and brittle, or
+  #
+  # 2. use symlinkJoin to pull in the relevant dependencies and just patch in
+  # that path which is *also* ugly, but far less likely to break
+  #
+  # The 2nd option is not very Nix'y, but I'll take robust over nice any day.
+  # Additionally, it's much easier to fix if LO breaks on the next upgrade (just
+  # add the missing dependencies to it).
+  postPatch = ''
    substituteInPlace shell/source/unix/exec/shellexec.cxx \
      --replace /usr/bin/xdg-open ${if kdeIntegration then "kde-open5" else "xdg-open"}

@ -119,21 +235,12 @@ in (mkDrv rec {
    substituteInPlace configure.ac --replace \
      'GPGMEPP_CFLAGS=-I/usr/include/gpgme++' \
      'GPGMEPP_CFLAGS=-I${gpgme.dev}/include/gpgme++'
-  '' + lib.optionalString kdeIntegration ''
-      substituteInPlace configure.ac \
-        --replace kcoreaddons_version.h KCoreAddons/kcoreaddons_version.h \
-        --replace '$QT5INC'             ${qtbase.dev}/include \
-        --replace '$QT5LIB'             ${qtbase.out}/lib \
-        --replace '-I$qt5_incdir '      '-I${qtx11extras.dev}/include '\
-        --replace '-L$qt5_libdir '      '${libs [ qtbase qtx11extras ]} ' \
-        --replace '$KF5INC'             ${kcoreaddons.dev}/include \
-        --replace '$KF5LIB'             ${kcoreaddons.out}/lib \
-        --replace '$kf5_incdir/KCore'   ${inc kcoreaddons "KCore"} \
-        --replace '$kf5_incdir/KI18n'   ${inc ki18n "KI18n"} \
-        --replace '$kf5_incdir/KConfig' ${inc kconfig "KConfig"} \
-        --replace '$kf5_incdir/KWindow' ${inc kwindowsystem "KWindow"} \
-        --replace '$kf5_incdir/KIO'     ${inc kio "KIO"} \
-        --replace '-L$kf5_libdir '      '${libs [ kconfig kcoreaddons ki18n kio kwindowsystem ]} '
+  '' + optionalString kdeIntegration ''
+    substituteInPlace configure.ac \
+      --replace '$QT5INC ' '$QT5INC ${kdeDeps}/include ' \
+      --replace '$QT5LIB ' '$QT5LIB ${kdeDeps}/lib ' \
+      --replace '$KF5INC ' '$KF5INC ${kdeDeps}/include ${kdeDeps}/include/KF5 '\
+      --replace '$KF5LIB ' '$KF5LIB ${kdeDeps}/lib '
  '';

  dontUseCmakeConfigure = true;
@ -239,18 +346,16 @@ in (mkDrv rec {
    ''
    # This to avoid using /lib:/usr/lib at linking
    + ''
-    sed -i '/gb_LinkTarget_LDFLAGS/{ n; /rpath-link/d;}' solenv/gbuild/platform/unxgcc.mk
+      sed -i '/gb_LinkTarget_LDFLAGS/{ n; /rpath-link/d;}' solenv/gbuild/platform/unxgcc.mk

-    find -name "*.cmd" -exec sed -i s,/lib:/usr/lib,, {} \;
+      find -name "*.cmd" -exec sed -i s,/lib:/usr/lib,, {} \;
    '';

  makeFlags = [ "SHELL=${bash}/bin/bash" ];

  enableParallelBuilding = true;

-  buildPhase = ''
-    make build-nocheck
-  '';
+  buildTargets = [ "build-nocheck" ];

  doCheck = true;

@ -278,19 +383,18 @@ in (mkDrv rec {

    mkdir -p $dev
    cp -r include $dev
-  '' + lib.optionalString kdeIntegration ''
-      for prog in $out/bin/*
-      do
-        wrapQtApp $prog
-      done
+  '' + optionalString kdeIntegration ''
+    for prog in $out/bin/*; do
+      wrapQtApp $prog
+    done
  '';

  dontWrapQtApps = true;

  configureFlags = [
    (if withHelp then "" else "--without-help")
-    "--with-boost=${boost.dev}"
-    "--with-boost-libdir=${boost.out}/lib"
+    "--with-boost=${getDev boost}"
+    "--with-boost-libdir=${getLib boost}/lib"
    "--with-beanshell-jar=${bsh}"
    "--with-vendor=NixOS"
    "--disable-report-builder"
@ -299,7 +403,7 @@ in (mkDrv rec {
    "--enable-dbus"
    "--enable-release-build"
    "--enable-epm"
-    "--with-ant-home=${ant}/lib/ant"
+    "--with-ant-home=${getLib ant}/lib/ant"
    "--with-system-cairo"
    "--with-system-libs"
    "--with-system-headers"
@ -347,44 +451,128 @@ in (mkDrv rec {
    # https://github.com/NixOS/nixpkgs/commit/5c5362427a3fa9aefccfca9e531492a8735d4e6f
    "--without-system-orcus"
    "--without-system-xmlsec"
-  ] ++ lib.optionals kdeIntegration [
+  ] ++ optionals kdeIntegration [
    "--enable-kf5"
    "--enable-qt5"
    "--enable-gtk3-kde5"
  ];

-  checkPhase = ''
-    make unitcheck
-    make slowcheck
-  '';
+  checkTarget = concatStringsSep " " [
+    "unitcheck"
+    "slowcheck"
+  ];

  nativeBuildInputs = [
-    gdb fontforge autoconf automake bison pkg-config libtool jdk
-  ] ++ lib.optional (!kdeIntegration) wrapGAppsHook
-    ++ lib.optional kdeIntegration wrapQtAppsHook;
+    autoconf
+    automake
+    bison
+    fontforge
+    gdb
+    jdk
+    libtool
+    pkg-config
+  ]
+  ++ [ (if kdeIntegration then wrapQtAppsHook else wrapGAppsHook) ];

-  buildInputs = with xorg;
-    [ ant ArchiveZip boost box2d cairo clucene_core
-      IOCompress cppunit cups curl db dbus-glib expat file flex fontconfig
-      freetype getopt gperf gtk3
-      hunspell icu jre' lcms libcdr libexttextcat unixODBC libjpeg
-      libmspack librdf_redland librsvg libsndfile libvisio libwpd libwpg libX11
-      libXaw libXext libXi libXinerama libxml2 libxslt libXtst
-      libXdmcp libpthreadstubs libGLU libGL mythes
-      glib libmysqlclient
-      neon nspr nss openldap openssl pam perl pkg-config poppler
-      python3 sane-backends unzip which zip zlib
-      mdds bluez5 libwps libabw libzmf
-      libxshmfence libatomic_ops graphite2 harfbuzz gpgme util-linux
-      librevenge libe-book libmwaw glm ncurses libepoxy
-      libodfgen CoinMP librdf_rasqal gnome.adwaita-icon-theme gettext abseil-cpp
-    ]
-    ++ (with gst_all_1; [
-      gstreamer
-      gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly
-      gst-libav
-    ])
-    ++ lib.optional kdeIntegration [ qtbase qtx11extras kcoreaddons kio ];
+  buildInputs = with xorg; [
+    ArchiveZip
+    CoinMP
+    IOCompress
+    abseil-cpp
+    ant
+    bluez5
+    boost
+    box2d
+    cairo
+    clucene_core
+    cppunit
+    cups
+    curl
+    db
+    dbus-glib
+    expat
+    file
+    flex
+    fontconfig
+    freetype
+    getopt
+    gettext
+    glib
+    glm
+    gnome.adwaita-icon-theme
+    gperf
+    gpgme
+    graphite2
+    gtk3
+    harfbuzz
+    hunspell
+    icu
+    jre'
+    lcms
+    libGL
+    libGLU
+    libX11
+    libXaw
+    libXdmcp
+    libXext
+    libXi
+    libXinerama
+    libXtst
+    libabw
+    libatomic_ops
+    libcdr
+    libe-book
+    libepoxy
+    libexttextcat
+    libjpeg
+    libmspack
+    libmwaw
+    libmysqlclient
+    libodfgen
+    libpthreadstubs
+    librdf_rasqal
+    librdf_redland
+    librevenge
+    librsvg
+    libsndfile
+    libvisio
+    libwpd
+    libwpg
+    libwps
+    libxml2
+    libxshmfence
+    libxslt
+    libzmf
+    mdds
+    mythes
+    ncurses
+    neon
+    nspr
+    nss
+    openldap
+    openssl
+    pam
+    perl
+    pkg-config
+    poppler
+    python3
+    sane-backends
+    unixODBC
+    unzip
+    util-linux
+    which
+    zip
+    zlib
+  ]
+  ++ (with gst_all_1; [
+    gst-libav
+    gst-plugins-bad
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-ugly
+    gstreamer
+  ])
+  ++ optionals kdeIntegration [ qtbase qtx11extras kcoreaddons kio ];

  passthru = {
    inherit srcs;
--- a/pkgs/applications/science/math/ripser/default.nix
+++ b/pkgs/applications/science/math/ripser/default.nix
@ -1,5 +1,4 @@
-{ lib, stdenv, fetchurl, fetchFromGitHub
-, assembleReductionMatrix ? false
+{ lib, stdenv, fetchFromGitHub
 , useCoefficients ? false
 , indicateProgress ? false
 , useGoogleHashmap ? false, sparsehash ? null
@ -14,7 +13,7 @@ assert useGoogleHashmap -> sparsehash != null;

 let
  inherit (lib) optional;
-  version = "1.0";
+  version = "1.2.1";
 in
 stdenv.mkDerivation {
  pname = "ripser";
@ -23,25 +22,17 @@ stdenv.mkDerivation {
  src = fetchFromGitHub {
    owner = "Ripser";
    repo = "ripser";
-    rev = "f69c6af6ca6883dd518c48faf41cf8901c379598";
-    sha256 = "1mw2898s7l29hgajsaf75bs9bjn2sn4g2mvmh41a602jpwp9r0rz";
+    rev = "v${version}";
+    sha256 = "sha256-BxmkPQ/nl5cF+xwQMTjXnLgkLgdmT/39y7Kzl2wDfpE=";
  };

-  #Patch from dev branch to make compilation work.
-  #Will be removed when it gets merged into master.
-  patches = [(fetchurl {
-    url = "https://github.com/Ripser/ripser/commit/dc78d8ce73ee35f3828f0aad67a4e53620277ebf.patch";
-    sha256 = "1y93aqpqz8fm1cxxrf90dhh67im3ndkr8dnxgbw5y96296n4r924";
-  })];
-
  buildInputs = optional useGoogleHashmap sparsehash;

  buildFlags = [
    "-std=c++11"
-    "-Ofast"
+    "-O3"
    "-D NDEBUG"
  ]
-  ++ optional assembleReductionMatrix "-D ASSEMBLE_REDUCTION_MATRIX"
  ++ optional useCoefficients "-D USE_COEFFICIENTS"
  ++ optional indicateProgress "-D INDICATE_PROGRESS"
  ++ optional useGoogleHashmap "-D USE_GOOGLE_HASHMAP"
--- a/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
@ -2,49 +2,41 @@
 , stdenv
 , fetchFromGitHub
 , nix-update-script
-, pkg-config
 , meson
 , ninja
-, vala
-, desktop-file-utils
-, libxml2
-, gtk3
+, pkg-config
 , python3
-, granite
+, vala
+, wrapGAppsHook4
+, granite7
+, gtk4
 , libgee
-, libhandy
-, appstream
-, wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
  pname = "elementary-calculator";
-  version = "1.7.2";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "calculator";
    rev = version;
-    sha256 = "sha256-U0wXrw9ZJwkqZAtTTHmTzqYhwF9V2JZEZZdDak3kPIc=";
+    sha256 = "sha256-NE7x5vSfwakwJJe2VGRFiYc7GCB1M6xU5945EC6Em34=";
  };

  nativeBuildInputs = [
-    appstream
-    desktop-file-utils
-    libxml2
    meson
    ninja
    pkg-config
    python3
    vala
-    wrapGAppsHook
+    wrapGAppsHook4
  ];

  buildInputs = [
-    granite
-    gtk3
+    granite7
+    gtk4
    libgee
-    libhandy
  ];

  postPatch = ''
--- a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
@ -30,13 +30,13 @@

 stdenv.mkDerivation rec {
  pname = "elementary-greeter";
-  version = "6.0.2";
+  version = "6.1.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "greeter";
    rev = version;
-    sha256 = "sha256-0chBM8JuCYgZXHneiSxSICZwBVm2Vgx+bas9wUjbnyg=";
+    sha256 = "sha256-CY+dPSyQ/ovSdI80uEipDdnWy1KjbZnwpn9sd8HrbPQ=";
  };

  patches = [
--- a/pkgs/development/compilers/alan/2.nix
+++ b/pkgs/development/compilers/alan/2.nix
@ -14,6 +14,10 @@ stdenv.mkDerivation rec {

  makefile = "Makefile.unix";

+  # Add a workarounf for -fno-common tollchains like upstream gcc-10.
+  # alan-3 is already fixed, but the backport is nontrivial.
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
  installPhase = ''
    mkdir -p $out/bin $out/share/alan2
    cp compiler/alan $out/bin/alan2
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@ -54,11 +54,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.18.1";
+  version = "1.18.2";

  src = fetchurl {
    url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-79Q+DxQC4IO3OgPURLe2V2u0xTmsRiCLY6kWtprKQIg=";
+    sha256 = "sha256-LETQPqLDQJITerkZumAvLCYaA40I60aFKKPzoo5WZ+I=";
  };

  # perl is used for testing go vet
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@ -289,6 +289,7 @@ package-maintainers:
    - candid
    - leb128-cereal
    - tasty-expected-failure
+    - lhs2tex
  pacien:
    - ldgallery-compiler
  peti:
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@ -169570,6 +169570,7 @@ self: {
       ];
       description = "Preprocessor for typesetting Haskell sources with LaTeX";
       license = "GPL";
+       maintainers = with lib.maintainers; [ nomeata ];
     }) {};

  "lhslatex" = callPackage
--- a/pkgs/development/libraries/xgboost/default.nix
+++ b/pkgs/development/libraries/xgboost/default.nix
@ -25,7 +25,13 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-h7zcHCOxe1h7HRB6idtjf4HUBEoHC4V2pqbN9hpe00g=";
  };

-  nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.isDarwin llvmPackages.openmp;
+  nativeBuildInputs = [
+    cmake
+  ] ++ lib.optionals stdenv.isDarwin [
+    llvmPackages.openmp
+  ] ++ lib.optionals cudaSupport [
+    cudaPackages.autoAddOpenGLRunpathHook
+  ];

  buildInputs = [ gtest ] ++ lib.optional cudaSupport cudaPackages.cudatoolkit
                ++ lib.optional ncclSupport cudaPackages.nccl;
@ -37,6 +43,12 @@ stdenv.mkDerivation rec {

  inherit doCheck;

+  # By default, cmake build will run ctests with all checks enabled
+  # If we're building with cuda, we run ctest manually so that we can skip the GPU tests
+  checkPhase = lib.optionalString cudaSupport ''
+    ctest --force-new-ctest-process ${lib.optionalString cudaSupport "-E TestXGBoostLib"}
+  '';
+
  installPhase = let
    libname = "libxgboost${stdenv.hostPlatform.extensions.sharedLibrary}";
  in ''
--- a/pkgs/development/php-packages/box/default.nix
+++ b/pkgs/development/php-packages/box/default.nix
@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
 let
  pname = "box";
-  version = "2.7.5";
+  version = "3.16.0";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
-    url = "https://github.com/box-project/box2/releases/download/${version}/box-${version}.phar";
-    sha256 = "1zmxdadrv0i2l8cz7xb38gnfmfyljpsaz2nnkjzqzksdmncbgd18";
+    url = "https://github.com/box-project/box/releases/download/${version}/box.phar";
+    sha256 = "sha256-9QjijzCdfpWjGb3NXxPc+7GOuRy3psrJtpvHeZ14vfk=";
  };

  dontUnpack = true;
@ -27,7 +27,7 @@ mkDerivation {
  meta = with lib; {
    description = "An application for building and managing Phars";
    license = licenses.mit;
-    homepage = "https://box-project.github.io/box2/";
+    homepage = "https://github.com/box-project/box";
    maintainers = with maintainers; [ jtojnar ] ++ teams.php.members;
  };
 }
--- a/pkgs/development/php-packages/php-parallel-lint/default.nix
+++ b/pkgs/development/php-packages/php-parallel-lint/default.nix
@ -1,16 +1,16 @@
 { mkDerivation, fetchFromGitHub, makeWrapper, lib, php }:
 let
  pname = "php-parallel-lint";
-  version = "1.0.0";
+  version = "1.3.2";
 in
 mkDerivation {
  inherit pname version;

  src = fetchFromGitHub {
-    owner = "JakubOnderka";
+    owner = "php-parallel-lint";
    repo = "PHP-Parallel-Lint";
    rev = "v${version}";
-    sha256 = "16nv8yyk2z3l213dg067l6di4pigg5rd8yswr5xgd18jwbys2vnw";
+    sha256 = "sha256-pTHH19HwqyOj5pSmH7l0JlntNVtMdu4K9Cl+qyrrg9U=";
  };

  nativeBuildInputs = [
@ -38,7 +38,7 @@ mkDerivation {
  meta = with lib; {
    description = "Tool to check syntax of PHP files faster than serial check with fancier output";
    license = licenses.bsd2;
-    homepage = "https://github.com/JakubOnderka/PHP-Parallel-Lint";
+    homepage = "https://github.com/php-parallel-lint/PHP-Parallel-Lint";
    maintainers = with maintainers; [ jtojnar ] ++ teams.php.members;
  };
 }
--- a/pkgs/development/python-modules/boolean-py/default.nix
+++ b/pkgs/development/python-modules/boolean-py/default.nix
@ -1,21 +1,36 @@
-{ lib, buildPythonPackage, fetchFromGitHub
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
-  pname = "boolean.py";
-  version = "3.8";
+  pname = "boolean-py";
+  version = "4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "bastikr";
    repo = "boolean.py";
    rev = "v${version}";
-    sha256 = "02jznrfrihhk69ai1vnh26s3rshl4kfc2id7li6xccavc2ws5y3b";
+    hash = "sha256-i6aNzGDhZip9YHXLiuh9crGm2qT2toBU2xze4PDLleg=";
  };

+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "boolean"
+  ];
+
  meta = with lib; {
-    homepage = "https://github.com/bastikr/boolean.py";
    description = "Implements boolean algebra in one module";
+    homepage = "https://github.com/bastikr/boolean.py";
    license = licenses.bsd2;
+    maintainers = with maintainers; [ ];
  };
-
 }
--- a/pkgs/development/python-modules/chainer/default.nix
+++ b/pkgs/development/python-modules/chainer/default.nix
@ -8,7 +8,6 @@ buildPythonPackage rec {
  version = "7.8.1";
  disabled = !isPy3k; # python2.7 abandoned upstream

-  # no tests in Pypi tarball
  src = fetchFromGitHub {
    owner = "chainer";
    repo = "chainer";
@ -16,11 +15,6 @@ buildPythonPackage rec {
    sha256 = "1n07zjzc4g92m1sbgxvnansl0z00y4jnhma2mw06vnahs7s9nrf6";
  };

-  checkInputs = [
-    pytestCheckHook
-    mock
-  ];
-
  propagatedBuildInputs = [
    filelock
    protobuf
@ -28,11 +22,19 @@ buildPythonPackage rec {
    typing-extensions
  ] ++ lib.optionals cudaSupport [ cupy ];

+  checkInputs = [
+    pytestCheckHook
+    mock
+  ];
+
  pytestFlagsArray = [ "tests/chainer_tests/utils_tests" ];

-  # cf. https://github.com/chainer/chainer/issues/8621
  preCheck = ''
+    # cf. https://github.com/chainer/chainer/issues/8621
    export CHAINER_WARN_VERSION_MISMATCH=0
+
+    # ignore pytest warnings not listed
+    rm setup.cfg
  '';

  disabledTests = [
--- a/pkgs/development/python-modules/clickgen/default.nix
+++ b/pkgs/development/python-modules/clickgen/default.nix
@ -1,5 +1,8 @@
 { lib
+, stdenv
 , buildPythonPackage
+, pythonOlder
+, pythonAtLeast
 , fetchFromGitHub
 , pillow
 , libX11
@ -11,26 +14,38 @@

 buildPythonPackage rec {
  pname = "clickgen";
-  version = "1.1.9";
+  version = "1.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8" || pythonAtLeast "3.10";

  src = fetchFromGitHub {
    owner = "ful1e5";
    repo = "clickgen";
    rev = "v${version}";
-    sha256 = "108f3sbramd3hhs4d84s3i3lbwllfrkvjakjq4gdmbw6xpilvm0l";
+    sha256 = "sha256-01c8SVy+J004dq5KCUe62w7i/xUTxTfl/IpvUtGQgw0=";
  };

  buildInputs = [ libXcursor libX11 libpng ];

  propagatedBuildInputs = [ pillow ];

-  pythonImportsCheck = [ "clickgen" ];
+  checkInputs = [ pytestCheckHook ];

-  postInstall = ''
-    install -m644 clickgen/xcursorgen.so $out/${python.sitePackages}/clickgen/xcursorgen.so
+  postBuild = ''
+    # Needs to build xcursorgen.so
+    cd src/xcursorgen
+    make
+    cd ../..
  '';

-  checkInputs = [ pytestCheckHook ];
+  postInstall = ''
+    install -m644 src/xcursorgen/xcursorgen.so $out/${python.sitePackages}/clickgen/xcursorgen.so
+    # Copying scripts directory needed by clickgen script at $out/bin/
+    cp -R src/clickgen/scripts $out/${python.sitePackages}/clickgen/scripts
+  '';
+
+  pythonImportsCheck = [ "clickgen" ];

  meta = with lib; {
    homepage = "https://github.com/ful1e5/clickgen";
@ -41,5 +56,8 @@ buildPythonPackage rec {
    '';
    license = licenses.mit;
    maintainers = with maintainers; [ AdsonCicilioti ];
+    # fails with:
+    # ld: unknown option: -zdefs
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/development/python-modules/datatable/default.nix
+++ b/pkgs/development/python-modules/datatable/default.nix
@ -61,5 +61,8 @@ buildPythonPackage rec {
    homepage = "https://github.com/h2oai/datatable";
    license = licenses.mpl20;
    maintainers = with maintainers; [ abbradar ];
+    # uses custom build system and adds -Wunused-variable -Werror
+    # warning: ‘dt::expr::doc_first’ defined but not used [-Wunused-variable]
+    broken = true;
  };
 }
--- a/pkgs/development/python-modules/ducc0/default.nix
+++ b/pkgs/development/python-modules/ducc0/default.nix
@ -0,0 +1,30 @@
+{ lib, buildPythonPackage, fetchFromGitLab, pythonOlder, pytestCheckHook, pybind11, numpy }:
+
+buildPythonPackage rec {
+  pname = "ducc0";
+  version = "0.23.0";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.mpcdf.mpg.de";
+    owner = "mtr";
+    repo = "ducc";
+    rev = "ducc0_${lib.replaceStrings ["."] ["_"] version}";
+    sha256 = "dOc3TihtoRuLfniC9zQ1MEbnvGJHzFZfZ8+J8Dnw6Lk=";
+  };
+
+  buildInputs = [ pybind11 ];
+  propagatedBuildInputs = [ numpy ];
+
+  checkInputs = [ pytestCheckHook ];
+  pytestFlagsArray = [ "python/test" ];
+  pythonImportsCheck = [ "ducc0" ];
+
+  meta = with lib; {
+    homepage = "https://gitlab.mpcdf.mpg.de/mtr/ducc";
+    description = "Efficient algorithms for Fast Fourier transforms and more";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ parras ];
+  };
+}
--- a/pkgs/development/python-modules/httpie-ntlm/default.nix
+++ b/pkgs/development/python-modules/httpie-ntlm/default.nix
@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, httpie
+, requests_ntlm
+}:
+
+buildPythonPackage rec {
+  pname = "httpie-ntlm";
+  version = "1.0.2";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "b1f757180c0bd60741ea16cf91fc53d47df402a5c287c4a61a14b335ea0552b3";
+  };
+
+  propagatedBuildInputs = [ httpie requests_ntlm ];
+
+  # Package have no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "httpie_ntlm" ];
+
+  meta = with lib; {
+    description = "NTLM auth plugin for HTTPie";
+    homepage = "https://github.com/httpie/httpie-ntlm";
+    license = licenses.bsdOriginal;
+    maintainers = with maintainers; [ kfollesdal ];
+  };
+}
--- a/pkgs/development/python-modules/httpie/default.nix
+++ b/pkgs/development/python-modules/httpie/default.nix
@ -1,20 +1,38 @@
 { lib
+, buildPythonPackage
 , fetchFromGitHub
 , installShellFiles
-, python3
 , pandoc
+, pythonOlder
+# BuildInputs
+, charset-normalizer
+, defusedxml
+, multidict
+, pygments
+, requests
+, requests-toolbelt
+, setuptools
+, rich
+, pysocks
+# CheckInputs
+, pytest-httpbin
+, pytest-lazy-fixture
+, pytest-mock
+, pytestCheckHook
+, responses
+, werkzeug
 }:

-python3.pkgs.buildPythonApplication rec {
+buildPythonPackage rec {
  pname = "httpie";
-  version = "3.1.0";
+  version = "3.2.1";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "httpie";
    repo = "httpie";
    rev = version;
-    hash = "sha256-x7Zucb2i8D4Xbn77eBzSxOAcc2fGg5MFKFiyJhytQ0s=";
+    hash = "sha256-WEe8zSlNckl7bPBi6u8mHQ1/xPw3kE81F8Xr15TchgM=";
  };

  nativeBuildInputs = [
@ -22,7 +40,7 @@ python3.pkgs.buildPythonApplication rec {
    pandoc
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = [
    charset-normalizer
    defusedxml
    multidict
@ -30,15 +48,17 @@ python3.pkgs.buildPythonApplication rec {
    requests
    requests-toolbelt
    setuptools
+    rich
+    pysocks
  ];

-  checkInputs = with python3.pkgs; [
-    mock
-    pytest
+  checkInputs = [
    pytest-httpbin
    pytest-lazy-fixture
+    pytest-mock
    pytestCheckHook
    responses
+    werkzeug
  ];

  postInstall = ''
@ -58,15 +78,6 @@ python3.pkgs.buildPythonApplication rec {
    "tests"
  ];

-  disabledTests = [
-    "test_chunked"
-    "test_verbose_chunked"
-    "test_multipart_chunked"
-    "test_request_body_from_file_by_path_chunked"
-    # Part of doctest
-    "httpie.encoding.detect_encoding"
-  ];
-
  pythonImportsCheck = [
    "httpie"
  ];
--- a/pkgs/development/python-modules/license-expression/default.nix
+++ b/pkgs/development/python-modules/license-expression/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "license-expression";
-  version = "21.6.14";
+  version = "30.0.0";

  disabled = pythonOlder "3.6";

@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "nexB";
    repo = "license-expression";
    rev = "v${version}";
-    sha256 = "sha256-hwfYKKalo8WYFwPCsRRXNz+/F8/42PXA8jxbIQjJH/g=";
+    hash = "sha256-tGXNZm9xH8sXa7dtBFsTzGgT+hfbmkwps7breR7KUWU=";
  };

  dontConfigure = true;
@ -34,10 +34,12 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [ "license_expression" ];
+  pythonImportsCheck = [
+    "license_expression"
+  ];

  meta = with lib; {
-    description = "Utility library to parse, normalize and compare License expressions for Python";
+    description = "Utility library to parse, normalize and compare License expressions";
    homepage = "https://github.com/nexB/license-expression";
    license = licenses.asl20;
    maintainers = with maintainers; [ fab ];
--- a/pkgs/development/python-modules/pip-tools/default.nix
+++ b/pkgs/development/python-modules/pip-tools/default.nix
@ -8,6 +8,7 @@
 , click
 , setuptools-scm
 , pep517
+, stdenv
 }:

 buildPythonPackage rec {
@ -26,6 +27,11 @@ buildPythonPackage rec {
    pytest-xdist
  ];

+  preCheck = lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+    # https://github.com/python/cpython/issues/74570#issuecomment-1093748531
+    export no_proxy='*';
+  '';
+
  nativeBuildInputs = [
    setuptools-scm
  ];
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "plugwise";
-  version = "0.18.1";
+  version = "0.18.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = "python-plugwise";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-jdRwaw5hPP8VCmCp3l5idjzrHJ2vLhYpC6yPCmOF56Y=";
+    sha256 = "sha256-l97GF5dZlwps2mhw84A+8IBmTmvnaJ/5MeWYdeAu4Zw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/default.nix
@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "Shapely";
-  version = "1.8.1.post1";
+  version = "1.8.2";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-k/8G/wX74r6EO5PHsa2CkuVuZlugG0cI91rop1eXLp8=";
+    sha256 = "sha256-Vyr51QBv1eMhPjfuVIkSsDQfsmck1tyKTjlQwQGX67Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/shapely/library-paths.patch
+++ b/pkgs/development/python-modules/shapely/library-paths.patch
@ -1,201 +1,31 @@
 diff --git a/shapely/geos.py b/shapely/geos.py
-index 13ab835..1abdb5e 100644
+index 88c5f53..1ccd6e4 100644
 --- a/shapely/geos.py
 +++ b/shapely/geos.py
-@@ -55,174 +55,21 @@ def load_dll(libname, fallbacks=None, mode=DEFAULT_MODE):
-             "Could not find lib {} or load any of its variants {}.".format(
-                 libname, fallbacks or []))
+@@ -96,6 +96,7 @@ if sys.platform.startswith('linux'):
+         alt_paths = [
+             'libgeos_c.so.1',
+             'libgeos_c.so',
+            '@libgeos_c@',
+         ]
+         _lgeos = load_dll('geos_c', fallbacks=alt_paths)
 
-_lgeos = None
- def exists_conda_env():
-     """Does this module exist in a conda environment?"""
-     return os.path.exists(os.path.join(sys.prefix, 'conda-meta'))
+@@ -160,6 +161,7 @@ elif sys.platform == 'darwin':
+             "/usr/local/lib/libgeos_c.dylib",
+             # homebrew Apple Silicon
+             "/opt/homebrew/lib/libgeos_c.dylib",
+            "@libgeos_c@",
+         ]
+         _lgeos = load_dll('geos_c', fallbacks=alt_paths)
 
-
-if sys.platform.startswith('linux'):
-    # Test to see if we have a wheel repaired by auditwheel which contains its
-    # own libgeos_c. Note: auditwheel 3.1 changed the location of libs.
-    geos_whl_so = glob.glob(
-        os.path.abspath(os.path.join(os.path.dirname(__file__), ".libs/libgeos*.so*"))
-    ) or glob.glob(
-        os.path.abspath(
-            os.path.join(
-                os.path.dirname(__file__), "..", "Shapely.libs", "libgeos*.so*"
-            )
-        )
-    )
-
-    if len(geos_whl_so) > 0:
-        # We have observed problems with CDLL of libgeos_c not automatically
-        # loading the sibling c++ library since the change made by auditwheel
-        # 3.1, so we explicitly load them both.
-        geos_whl_so = sorted(geos_whl_so)
-        CDLL(geos_whl_so[0])
-        _lgeos = CDLL(geos_whl_so[-1])
-        LOG.debug("Found GEOS DLL: %r, using it.", _lgeos)
-
-    elif hasattr(sys, 'frozen'):
-        geos_pyinstaller_so = glob.glob(os.path.join(sys.prefix, 'libgeos_c-*.so.*'))
-        if len(geos_pyinstaller_so) >= 1:
-            _lgeos = CDLL(geos_pyinstaller_so[0])
-            LOG.debug("Found GEOS DLL: %r, using it.", _lgeos)
-    elif exists_conda_env():
-        # conda package.
-        _lgeos = CDLL(os.path.join(sys.prefix, 'lib', 'libgeos_c.so'))
-    else:
-        alt_paths = [
-            'libgeos_c.so.1',
-            'libgeos_c.so',
-        ]
-        _lgeos = load_dll('geos_c', fallbacks=alt_paths)
-
-+_lgeos = CDLL('@libgeos_c@')
-+if sys.platform == 'darwin':
-     # ctypes.CDLL(None) internally calls dlopen(NULL), and as the dlopen
-     # manpage says, "If filename is NULL, then the returned handle is for the
-     # main program". This way we can let the linker do the work to figure out
-     # which libc Python is actually using.
-     free = CDLL(None).free
-    free.argtypes = [c_void_p]
-    free.restype = None
-
-elif sys.platform == 'darwin':
-    # Test to see if we have a delocated wheel with a GEOS dylib.
-    dylib_path = os.path.abspath(
-        os.path.join(os.path.dirname(__file__), ".dylibs/*.dylib")
-    )
-    LOG.debug("Formed path for globbing: dylib_path=%r", dylib_path)
-
-    geos_whl_dylib = glob.glob(dylib_path)
-    LOG.debug("Globbed: geos_whl_dylib=%r", geos_whl_dylib)
-
-    if len(geos_whl_dylib) > 0:
-        handle = CDLL(None)
-        if hasattr(handle, "initGEOS_r"):
-            LOG.debug("GEOS already loaded")
-            _lgeos = handle
-        else:
-            geos_whl_dylib = sorted(geos_whl_dylib)
-            CDLL(geos_whl_dylib[0])
-            _lgeos = CDLL(geos_whl_dylib[-1])
-            LOG.debug("Found GEOS DLL: %r, using it.", _lgeos)
-
-    elif exists_conda_env():
-        # conda package.
-        _lgeos = CDLL(os.path.join(sys.prefix, 'lib', 'libgeos_c.dylib'))
-    else:
-        if hasattr(sys, 'frozen'):
-            try:
-                # .app file from py2app
-                alt_paths = [os.path.join(
-                    os.environ['RESOURCEPATH'], '..', 'Frameworks',
-                    'libgeos_c.dylib')]
-            except KeyError:
-                alt_paths = [
-                    # binary from pyinstaller
-                    os.path.join(sys.executable, 'libgeos_c.dylib'),
-                    # .app from cx_Freeze
-                    os.path.join(os.path.dirname(sys.executable), 'libgeos_c.1.dylib')]
-                if hasattr(sys, '_MEIPASS'):
-                    alt_paths.append(
-                        os.path.join(sys._MEIPASS, 'libgeos_c.1.dylib'))
-        else:
-            alt_paths = [
-                # The Framework build from Kyng Chaos
-                "/Library/Frameworks/GEOS.framework/Versions/Current/GEOS",
-                # macports
-                '/opt/local/lib/libgeos_c.dylib',
-                # homebrew Intel
-                '/usr/local/lib/libgeos_c.dylib',
-                # homebrew Apple Silicon
-                '/opt/homebrew/lib/libgeos_c.dylib',
-            ]
-        _lgeos = load_dll('geos_c', fallbacks=alt_paths)
-
-    free = CDLL(None).free
-    free.argtypes = [c_void_p]
-    free.restype = None
-
-elif sys.platform == 'win32':
-    _conda_dll_path = os.path.join(sys.prefix, 'Library', 'bin', 'geos_c.dll')
-    if exists_conda_env() and os.path.exists(_conda_dll_path):
-        _lgeos = CDLL(_conda_dll_path)
-    else:
-        geos_whl_dll = glob.glob(
-            os.path.abspath(
-                os.path.join(
-                    os.path.dirname(__file__), "..", "Shapely.libs", "geos*.dll"
-                )
-            )
-        )
-
-        if len(geos_whl_dll) > 0:
-            geos_whl_dll = sorted(geos_whl_dll)
-            # CDLL(geos_whl_so[0])
-            _lgeos = CDLL(geos_whl_dll[-1])
-            LOG.debug("Found GEOS DLL: %r, using it.", _lgeos)
-        else:
-            try:
-                egg_dlls = os.path.abspath(
-                    os.path.join(os.path.dirname(__file__), "DLLs")
-                )
-                if hasattr(sys, "_MEIPASS"):
-                    wininst_dlls = sys._MEIPASS
-                elif hasattr(sys, "frozen"):
-                    wininst_dlls = os.path.normpath(
-                        os.path.abspath(sys.executable + "../../DLLS")
-                    )
-                else:
-                    wininst_dlls = os.path.abspath(os.__file__ + "../../../DLLs")
-                original_path = os.environ["PATH"]
-                os.environ["PATH"] = "%s;%s;%s" % (
-                    egg_dlls,
-                    wininst_dlls,
-                    original_path,
-                )
-                _lgeos = load_dll("geos_c.dll")
-
-            except (ImportError, WindowsError, OSError):
-                raise
-
-        def free(m):
-            try:
-                cdll.msvcrt.free(m)
-            except WindowsError:
-                # XXX: See http://trac.gispython.org/projects/PCL/ticket/149
-                pass
-
-elif sys.platform == 'sunos5':
-    _lgeos = load_dll('geos_c', fallbacks=['libgeos_c.so.1', 'libgeos_c.so'])
-    free.restype = None
-    free.argtypes = [c_void_p]
-    free.restype = None
-
-else:  # other *nix systems
-    _lgeos = load_dll('geos_c', fallbacks=['libgeos_c.so.1', 'libgeos_c.so'])
-    free = CDLL(None).free
-    free.argtypes = [c_void_p]
-    free.restype = None
-+else:
-+    free = CDLL('@libc@').free
-+free.argtypes = [c_void_p]
-+free.restype = None
- 
- 
- def _geos_version():
 diff --git a/tests/test_dlls.py b/tests/test_dlls.py
-index c71da8e..fae9da6 100644
+index c71da8e..c36262c 100644
 --- a/tests/test_dlls.py
 +++ b/tests/test_dlls.py
-@@ -12,10 +12,4 @@ class LoadingTestCase(unittest.TestCase):
-     @unittest.skipIf(sys.platform == "win32", "FIXME: adapt test for win32")
-     def test_fallbacks(self):
-         load_dll('geos_c', fallbacks=[
-            os.path.join(sys.prefix, "lib", "libgeos_c.dylib"), # anaconda (Mac OS X)
-            '/opt/local/lib/libgeos_c.dylib',     # MacPorts
-            '/usr/local/lib/libgeos_c.dylib',     # homebrew (Mac OS X)
-            '/opt/homebrew/lib/libgeos_c.dylib',  # homebrew (macOS)
-            os.path.join(sys.prefix, "lib", "libgeos_c.so"), # anaconda (Linux)
-            'libgeos_c.so.1',
+@@ -18,4 +18,5 @@ class LoadingTestCase(unittest.TestCase):
+             '/opt/homebrew/lib/libgeos_c.dylib',  # homebrew (macOS)
+             os.path.join(sys.prefix, "lib", "libgeos_c.so"), # anaconda (Linux)
+             'libgeos_c.so.1',
 -            'libgeos_c.so'])
+            'libgeos_c.so',
 +            '@libgeos_c@'])
--- a/pkgs/development/tools/misc/libtree/default.nix
+++ b/pkgs/development/tools/misc/libtree/default.nix
@ -13,39 +13,25 @@

 stdenv.mkDerivation rec {
  pname = "libtree";
-  version = "2.0.0";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "haampie";
    repo = "libtree";
    rev = "v${version}";
-    sha256 = "sha256-j54fUwMkX4x4MwL8gMraguK9GqQRBjCC+W6ojFnQdHQ=";
+    sha256 = "sha256-C5QlQsBL9Als80Tv13ex2XS5Yj50Ht8eDfGYAtnh/HI=";
  };

-  patches = [
-    # add missing include
-    # https://github.com/haampie/libtree/pull/42
-    (fetchpatch {
-      url = "https://github.com/haampie/libtree/commit/219643ff6edcae42c9546b8ba38cfec9d19b034e.patch";
-      sha256 = "sha256-vdFmmBdBiOT3QBcwd3SuiolcaFTFAb88kU1KN8229K0=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace src/main.cpp \
-      --replace "std::string strip = \"strip\";" "std::string strip = \"${binutils}/bin/strip\";" \
-      --replace "std::string chrpath = \"chrpath\";" "std::string chrpath = \"${chrpath}/bin/chrpath\";"
-  '';
-
-  nativeBuildInputs = [ cmake ];
-
  buildInputs = [ cxxopts elfio termcolor ];

-  doCheck = true;
+  makeFlags = [ "PREFIX=$(out)" ];

+  # note: "make check" returns exit code 0 even when the tests fail.
+  # This has been reported upstream:
+  #  https://github.com/haampie/libtree/issues/77
  checkInputs = [ gtest ];
-
-  cmakeFlags = [ "-DLIBTREE_BUILD_TESTS=ON" ];
+  checkTarget = [ "check" ];
+  doCheck = true;

  meta = with lib; {
    description = "Tree ldd with an option to bundle dependencies into a single folder";
--- a/pkgs/games/0verkill/default.nix
+++ b/pkgs/games/0verkill/default.nix
@ -27,6 +27,9 @@ gccStdenv.mkDerivation rec {
    autoupdate
  '';

+  # The code needs an update for gcc-10:
+  #   https://github.com/hackndev/0verkill/issues/7
+  NIX_CFLAGS_COMPILE = "-fcommon";
  hardeningDisable = [ "all" ]; # Someday the upstream will update the code...

  meta = with lib; {
--- a/pkgs/servers/ombi/default.nix
+++ b/pkgs/servers/ombi/default.nix
@ -10,14 +10,14 @@ let
    "Unsupported system: ${stdenv.hostPlatform.system}");

  hash = {
-    x64-linux_hash = "sha256-O/dfLZst7RFnqDZj8UX6ejL2EBjGnCBY3e8JB3peRgY=";
-    arm64-linux_hash = "sha256-DkCOK1A7L1gMqY/XPIJFFz7qvUvxA6aJa24Hrh3dT/U=";
-    x64-osx_hash = "sha256-4N0/FTVhxUooauhh+7u527aViSBILiCb+a4cI17QTAg=";
+    x64-linux_hash = "sha256-8Y6I6vitkgIV6WMXF1YXzgRfhJd/O6hcdpC9yZLpDA4=";
+    arm64-linux_hash = "sha256-OXbJbwjNDd3GNL4bvuZLwNOjfAp8YBnJiylid0w8kLI=";
+    x64-osx_hash = "sha256-BoYqplC8ahMhpgntZVozyPCp08YqmiZ3ED7TgKlXPXc=";
  }."${arch}-${os}_hash";

 in stdenv.mkDerivation rec {
  pname = "ombi";
-  version = "4.10.2";
+  version = "4.16.12";

  sourceRoot = ".";

--- a/pkgs/tools/admin/bubblewrap/default.nix
+++ b/pkgs/tools/admin/bubblewrap/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "bubblewrap";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "bubblewrap";
    rev = "v${version}";
-    sha256 = "sha256-YmK/Tq9/JTJr5gLNKEH5t6TvvXlNSTDz5Ui7d3ewv2s=";
+    hash = "sha256-J+VFla3sWO+DfB2IxxrKzbiG+KWFJr9caf8sTHyWXY4=";
  };

  postPatch = ''
--- a/pkgs/tools/admin/salt/0001-Fix-Jinja2-3.1.0.patch
+++ b/pkgs/tools/admin/salt/0001-Fix-Jinja2-3.1.0.patch
@ -0,0 +1,38 @@
+From 0a763a13ef55964395dff60283ececc16f957792 Mon Sep 17 00:00:00 2001
+From: Derek Kulinski <d@kulinski.us>
+Date: Sun, 8 May 2022 01:30:39 -0700
+Subject: [PATCH] Fix Jinja2 3.1.0
+
+---
+ salt/utils/jinja.py | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/salt/utils/jinja.py b/salt/utils/jinja.py
+index 0cb70bf64a..322c2f7f46 100644
+--- a/salt/utils/jinja.py
+++ b/salt/utils/jinja.py
+@@ -25,10 +25,11 @@ import salt.utils.json
+ import salt.utils.stringutils
+ import salt.utils.url
+ import salt.utils.yaml
+-from jinja2 import BaseLoader, Markup, TemplateNotFound, nodes
+from jinja2 import BaseLoader, TemplateNotFound, nodes
+ from jinja2.environment import TemplateModule
+ from jinja2.exceptions import TemplateRuntimeError
+ from jinja2.ext import Extension
+from markupsafe import Markup
+ from salt.exceptions import TemplateError
+ from salt.utils.decorators.jinja import jinja_filter, jinja_global, jinja_test
+ from salt.utils.odict import OrderedDict
+@@ -706,7 +707,7 @@ def method_call(obj, f_name, *f_args, **f_kwargs):
+     return getattr(obj, f_name, lambda *args, **kwargs: None)(*f_args, **f_kwargs)
+ 
+ 
+-@jinja2.contextfunction
+@jinja2.pass_context
+ def show_full_context(ctx):
+     return salt.utils.data.simple_types_filter(
+         {key: value for key, value in ctx.items()}
+-- 
+2.35.1
+
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@ -6,30 +6,16 @@
 , extraInputs ? []
 }:

-let
-  py = python3.override {
-    packageOverrides = self: super: {
-      # Incompatible with pyzmq 22
-      pyzmq = super.pyzmq.overridePythonAttrs (oldAttrs: rec {
-        version = "21.0.2";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "CYwTxhmJE8KgaQI1+nTS5JFhdV9mtmO+rsiWUVVMx5w=";
-        };
-      });
-   };
-  };
-in
-py.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "salt";
  version = "3004.1";

-  src = py.pkgs.fetchPypi {
+  src = python3.pkgs.fetchPypi {
    inherit pname version;
    hash = "sha256-fzRKJDJkik8HjapazMaNzf/hCVzqE+wh5QQTVg8Ewpg=";
  };

-  propagatedBuildInputs = with py.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
    distro
    jinja2
    markupsafe
@ -39,18 +25,46 @@ py.pkgs.buildPythonApplication rec {
    pyyaml
    pyzmq
    requests
-    tornado
  ] ++ extraInputs;

-  patches = [ ./fix-libcrypto-loading.patch ];
+  patches = [
+    ./fix-libcrypto-loading.patch
+
+    # Bug in 3004.1: https://github.com/saltstack/salt/pull/61856
+    ./0001-Fix-Jinja2-3.1.0.patch
+  ];

  postPatch = ''
    substituteInPlace "salt/utils/rsax931.py" \
      --subst-var-by "libcrypto" "${lib.getLib openssl}/lib/libcrypto.so"
    substituteInPlace requirements/base.txt \
      --replace contextvars ""
+
+    # Don't require optional dependencies on Darwin, let's use
+    # `extraInputs` like on any other platform
+    echo -n > "requirements/darwin.txt"
+
+    # Bug in 3004.1: https://github.com/saltstack/salt/pull/61839
+    substituteInPlace "salt/utils/entrypoints.py" \
+      --replace 'if sys.version_info >= (3, 10):' 'if False:'
+
+    # Bug in 3004.1: https://github.com/saltstack/salt/issues/61865
+    substituteInPlace "salt/transport/tcp.py" \
+      --replace 'payload = self.pack_publish(package)' 'package = self.pack_publish(package)'
+
+    # 3004.1: requirement of pyzmq was restricted to <22.0.0; looks like that req was incorrect
+    # https://github.com/saltstack/salt/commit/070597e525bb7d56ffadede1aede325dfb1b73a4
+    # https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259279
+    # https://github.com/saltstack/salt/pull/61163
+    substituteInPlace "requirements/zeromq.txt" \
+      --replace 'pyzmq<=20.0.0 ; python_version < "3.6"' "" \
+      --replace 'pyzmq>=17.0.0,<22.0.0 ; python_version < "3.9"' 'pyzmq>=17.0.0 ; python_version < "3.9"' \
+      --replace 'pyzmq>19.0.2,<22.0.0 ; python_version >= "3.9"' 'pyzmq>19.0.2 ; python_version >= "3.9"'
  '';

+  # Don't use fixed dependencies on Darwin
+  USE_STATIC_REQUIREMENTS = "0";
+
  # The tests fail due to socket path length limits at the very least;
  # possibly there are more issues but I didn't leave the test suite running
  # as is it rather long.
--- a/pkgs/tools/backup/zbackup/default.nix
+++ b/pkgs/tools/backup/zbackup/default.nix
@ -20,6 +20,10 @@ stdenv.mkDerivation rec {
    ./protobuf-api-change.patch
  ];

+  # zbackup uses dynamic exception specifications which are not
+  # allowed in C++17
+  NIX_CFLAGS_COMPILE = [ "--std=c++14" ];
+
  buildInputs = [ zlib openssl protobuf lzo libunwind ];
  nativeBuildInputs = [ cmake protobufc ];

--- a/pkgs/tools/misc/bat/default.nix
+++ b/pkgs/tools/misc/bat/default.nix
@ -12,15 +12,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "bat";
-  version = "0.20.0";
+  version = "0.21.0";

  src = fetchFromGitHub {
    owner = "sharkdp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-U+EHOZntZsHfvLapLpbiIKXSm8Qc1BRqCTR/AFe6yfQ=";
+    sha256 = "sha256-eCk0oOHGZNqgqz+JJfIhjWdLgBTpBig+mggi1c3EUDk=";
  };
-  cargoSha256 = "sha256-eSBcrKjgCz8mApLJnpNyWVC8pQVUX8dPiYJDIK470U8=";
+  cargoSha256 = "sha256-kYZxtiK9hnHBOMvRoHZK5kyXO9cg/gHBYuaITqKUpbE=";

  nativeBuildInputs = [ pkg-config installShellFiles makeWrapper ];

--- a/pkgs/tools/misc/dotter/default.nix
+++ b/pkgs/tools/misc/dotter/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, rustPlatform, which }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, CoreServices, which }:

 rustPlatform.buildRustPackage rec {
  pname = "dotter";
@ -13,6 +13,8 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-JpMEC2HjAQLQiXHSE6L0HBDc0vLhd465wDK2+35aBXA=";

+  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
+
  checkInputs = [ which ];

  meta = with lib; {
--- a/pkgs/tools/misc/esptool/default.nix
+++ b/pkgs/tools/misc/esptool/default.nix
@ -2,19 +2,27 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "esptool";
-  version = "3.3";
+  version = "3.3.1";

  src = fetchFromGitHub {
    owner = "espressif";
    repo = "esptool";
    rev = "v${version}";
-    sha256 = "sha256-CmGie+M3AboOk8X+LkRhIxTRQZgDlklouzmz8kiIZuI=";
+    hash = "sha256-9WmiLji7Zoad5WIzgkpvkI9t96sfdkCtFh6zqVxF7qo=";
  };

-  checkInputs = with python3.pkgs;
-    [ flake8 flake8-future-import flake8-import-order openssl ];
-  propagatedBuildInputs = with python3.pkgs;
-    [ pyserial pyaes ecdsa reedsolo bitstring cryptography ];
+  postPatch = ''
+    substituteInPlace test/test_imagegen.py \
+      --replace "sys.executable, ESPTOOL_PY" "ESPTOOL_PY"
+  '';
+
+  propagatedBuildInputs = with python3.pkgs; [
+    bitstring
+    cryptography
+    ecdsa
+    pyserial
+    reedsolo
+  ];

  # wrapPythonPrograms will overwrite esptool.py with a bash script,
  # but espefuse.py tries to import it. Since we don't add any binary paths,
@ -28,6 +36,23 @@ python3.pkgs.buildPythonApplication rec {
    done
  '';

+  checkInputs = with python3.pkgs; [
+    pyelftools
+  ];
+
+  # tests mentioned in `.github/workflows/test_esptool.yml`
+  checkPhase = ''
+    runHook preCheck
+
+    export ESPTOOL_PY=$out/bin/esptool.py
+    ${python3.interpreter} test/test_imagegen.py
+    ${python3.interpreter} test/test_espsecure.py
+    ${python3.interpreter} test/test_merge_bin.py
+    ${python3.interpreter} test/test_modules.py
+
+    runHook postCheck
+  '';
+
  meta = with lib; {
    description = "ESP8266 and ESP32 serial bootloader utility";
    homepage = "https://github.com/espressif/esptool";
--- a/pkgs/tools/misc/nb/default.nix
+++ b/pkgs/tools/misc/nb/default.nix
@ -0,0 +1,67 @@
+{ stdenv, lib, fetchFromGitHub, installShellFiles }:
+
+stdenv.mkDerivation rec {
+  pname = "nb";
+  version = "6.10.1";
+
+  src = fetchFromGitHub {
+    owner = "xwmx";
+    repo = "nb";
+    rev = version;
+    sha256 = "00c0k12yc2vqx0am1mhcjbn7fh3dab2zixslyh1smzcww275rk59";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin/
+    mv nb $out/bin/
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    installShellCompletion etc/nb-completion.{bash,zsh}
+  '';
+
+  meta = with lib; {
+    description = "A command line note-taking, bookmarking, archiving, and knowledge base application";
+    longDescription = ''
+      `nb` creates notes in text-based formats like Markdown, Emacs Org mode,
+      and LaTeX, can work with files in any format, can import and export notes
+      to many document formats, and can create private, password-protected
+      encrypted notes and bookmarks. With `nb`, you can write notes using Vim,
+      Emacs, VS Code, Sublime Text, and any other text editor you like. `nb`
+      works in any standard Linux / Unix environment, including macOS and
+      Windows via WSL. Optional dependencies can be installed to enhance
+      functionality, but `nb` works great without them.
+
+      `nb` is also a powerful text-based CLI bookmarking system. Page
+      information is automatically downloaded, compiled, and saved into normal
+      Markdown documents made for humans, so bookmarks are easy to edit just
+      like any other note.
+
+      `nb` uses Git in the background to automatically record changes and sync
+      notebooks with remote repositories. `nb` can also be configured to sync
+      notebooks using a general purpose syncing utility like Dropbox so notes
+      can be edited in other apps on any device.
+
+      `nb` is designed to be portable, future-focused, and vendor independent,
+      providing a full-featured and intuitive experience within a highly
+      composable user-centric text interface. The entire program is a single
+      well-tested shell script that can be installed, copied, or curled almost
+      anywhere and just work, using progressive enhancement for various
+      experience improvements in more capable environments. `nb` works great
+      whether you have one notebook with just a few notes or dozens of
+      notebooks containing thousands of notes, bookmarks, and other items. `nb`
+      makes it easy to incorporate other tools, writing apps, and workflows.
+      `nb` can be used a little, a lot, once in a while, or for just a subset
+      of features. `nb` is flexible.
+    '';
+    homepage = "https://xwmx.github.io/nb/";
+    license = licenses.agpl3Plus;
+    maintainers = [ maintainers.toonn ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/tools/networking/aircrack-ng/default.nix
+++ b/pkgs/tools/networking/aircrack-ng/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "aircrack-ng";
-  version = "1.6";
+  version = "1.7";

  src = fetchurl {
    url = "https://download.aircrack-ng.org/aircrack-ng-${version}.tar.gz";
-    sha256 = "0ix2k64qg7x3w0bzdsbk1m50kcpq1ws59g3zkwiafvpwdr4gs2sg";
+    sha256 = "1hsq1gwmafka4bahs6rc8p98yi542h9a502h64bjlygpr3ih99q5";
  };

  nativeBuildInputs = [ pkg-config makeWrapper autoreconfHook ];
--- a/pkgs/tools/networking/httpie/strip-venv.patch
+++ b/pkgs/tools/networking/httpie/strip-venv.patch
@ -1,22 +0,0 @@
-diff --git a/tests/test_docs.py b/tests/test_docs.py
-index 340e64d..a6b4dc9 100644
--- a/tests/test_docs.py
-+++ b/tests/test_docs.py
-@@ -42,15 +42,10 @@ assert filenames
- # HACK: hardcoded paths, venv should be irrelevant, etc.
- # TODO: simplify by using the Python API instead of a subprocess
- #       then we wont’t need the paths.
-VENV_BIN = Path(__file__).parent.parent / 'venv/bin'
-VENV_PYTHON = VENV_BIN / 'python'
-VENV_RST2PSEUDOXML = VENV_BIN / 'rst2pseudoxml.py'
-+VENV_PYTHON = 'python'
-+VENV_RST2PSEUDOXML = 'rst2pseudoxml.py'
- 
- 
-@pytest.mark.skipif(
-    not VENV_RST2PSEUDOXML.exists(),
-    reason='docutils not installed',
-)
- @pytest.mark.parametrize('filename', filenames)
- def test_rst_file_syntax(filename):
-     p = subprocess.Popen(
--- a/pkgs/tools/security/yubihsm-connector/default.nix
+++ b/pkgs/tools/security/yubihsm-connector/default.nix
@ -0,0 +1,40 @@
+{ lib, libusb1, buildGoModule, fetchFromGitHub, pkg-config }:
+
+buildGoModule rec {
+  pname = "yubihsm-connector";
+  version = "3.0.2";
+
+  src = fetchFromGitHub {
+    owner = "Yubico";
+    repo = "yubihsm-connector";
+    rev = version;
+    sha256 = "FQ64tSZN55QpXjMZITzlWOPTKSgnoCpkRngQUQHVavc=";
+  };
+
+  vendorSha256 = "kVBzdJk/1LvjdUtLqHAw9ZxDfCo3mBWVMYG/nQXpDrk=";
+
+  patches = [
+    # Awaiting a new release to fix the upstream lockfile
+    # https://github.com/Yubico/yubihsm-connector/issues/36
+    ./lockfile-fix.patch
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libusb1
+  ];
+
+  preBuild = ''
+    go generate
+  '';
+
+  meta = with lib; {
+    description = "yubihsm-connector performs the communication between the YubiHSM 2 and applications that use it";
+    homepage = "https://developers.yubico.com/yubihsm-connector/";
+    maintainers = with maintainers; [ matthewcroughan ];
+    license = licenses.asl20;
+  };
+}
--- a/pkgs/tools/security/yubihsm-connector/lockfile-fix.patch
+++ b/pkgs/tools/security/yubihsm-connector/lockfile-fix.patch
@ -0,0 +1,115 @@
+diff --git a/go.mod b/go.mod
+index ac22dc6..0ef56b2 100644
+--- a/go.mod
+++ b/go.mod
+@@ -1,21 +1,32 @@
+ module github.com/Yubico/yubihsm-connector
+
+go 1.17
+
+ require (
+ 	github.com/google/gousb v1.1.0
+ 	github.com/google/uuid v1.1.1
+ 	github.com/kardianos/service v1.0.0
+	github.com/notdpate/evloghook v0.0.0-20180503050227-f202fa6c9ebb
+	github.com/sirupsen/logrus v1.4.2
+	github.com/spf13/cobra v0.0.5
+	github.com/spf13/viper v1.4.0
+	gopkg.in/yaml.v2 v2.2.2
+)
+
+require (
+	github.com/fsnotify/fsnotify v1.4.7 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+ 	github.com/konsorten/go-windows-terminal-sequences v1.0.2 // indirect
+ 	github.com/magiconair/properties v1.8.1 // indirect
+-	github.com/notdpate/evloghook v0.0.0-20180503050227-f202fa6c9ebb
+	github.com/mitchellh/mapstructure v1.1.2 // indirect
+ 	github.com/pelletier/go-toml v1.4.0 // indirect
+-	github.com/sirupsen/logrus v1.4.2
+ 	github.com/spf13/afero v1.2.2 // indirect
+-	github.com/spf13/cobra v0.0.5
+	github.com/spf13/cast v1.3.0 // indirect
+ 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+-	github.com/spf13/viper v1.4.0
+	github.com/spf13/pflag v1.0.3 // indirect
+ 	github.com/stretchr/testify v1.4.0 // indirect
+ 	golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3 // indirect
+ 	golang.org/x/text v0.3.2 // indirect
+ 	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+-	gopkg.in/yaml.v2 v2.2.2
+ )
+diff --git a/go.sum b/go.sum
+index 71df42d..8d977ff 100644
+--- a/go.sum
+++ b/go.sum
+@@ -1,4 +1,5 @@
+ cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
+ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+ github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+@@ -16,6 +17,7 @@ github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7
+ github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+ github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
+ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+ github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+ github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
+@@ -45,6 +47,7 @@ github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgf
+ github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+ github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
+ github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+ github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
+ github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+@@ -53,10 +56,13 @@ github.com/kardianos/service v1.0.0/go.mod h1:8CzDhVuCuugtsHyZoTvsOBuvonN/UDBvl0
+ github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
+ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+ github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2 h1:DB17ag19krx9CFsz4o3enTrPXyIXCl+2iCXH/aMAp9s=
+ github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+ github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+ github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+ github.com/magiconair/properties v1.8.1 h1:ZC2Vc7/ZFkGmsVC9KvOjumD+G5lXy2RtTKyzRKO2BQ4=
+@@ -66,12 +72,14 @@ github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrk
+ github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
+ github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+ github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/notdpate/evloghook v0.0.0-20180503050227-f202fa6c9ebb h1:GFmMJZvdCkRfbfo07+lUKrB+jh2cJ+a2l6qD/3hxZ6M=
+ github.com/notdpate/evloghook v0.0.0-20180503050227-f202fa6c9ebb/go.mod h1:ukoRZyzBppMQypxM7KqEvHc4DB5uNW6NXFp1sVeXamM=
+ github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+ github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+ github.com/pelletier/go-toml v1.4.0 h1:u3Z1r+oOXJIkxqw34zVhyPgjBsm6X2wn21NWs/HfSeg=
+ github.com/pelletier/go-toml v1.4.0/go.mod h1:PN7xzY2wHTK0K9p34ErDQMlFxa51Fk0OUruD3k1mMwo=
+ github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+ github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
+@@ -107,6 +115,7 @@ github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/y
+ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+ github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+ github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+ github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
+@@ -156,6 +165,7 @@ google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ij
+ gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+ gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+ gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
+ gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
+
+
--- a/pkgs/tools/security/yubihsm-shell/default.nix
+++ b/pkgs/tools/security/yubihsm-shell/default.nix
@ -0,0 +1,59 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, openssl
+, libusb1
+, libedit
+, curl
+, gengetopt
+, pkg-config
+, pcsclite
+, help2man
+}:
+
+stdenv.mkDerivation rec {
+  pname = "yubihsm-shell";
+  version = "2.3.1";
+
+  src = fetchFromGitHub {
+    owner = "Yubico";
+    repo = "yubihsm-shell";
+    rev = version;
+    sha256 = "D0kXiwc+i6mKA4oHuHjgXUmLMsmY5o/VI+1aCWtNjC0=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    help2man
+    gengetopt
+  ];
+
+  buildInputs = [
+    libusb1
+    libedit
+    curl
+    pcsclite
+    openssl
+  ];
+
+  cmakeFlags = [
+    # help2man fails without this
+    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
+  ];
+
+  postPatch = ''
+    # Can't find libyubihsm at runtime because of dlopen() in C code
+    substituteInPlace lib/yubihsm.c \
+      --replace "libyubihsm_usb.so" "$out/lib/libyubihsm_usb.so" \
+      --replace "libyubihsm_http.so" "$out/lib/libyubihsm_http.so"
+  '';
+
+  meta = with lib; {
+    description = "yubihsm-shell and libyubihsm";
+    homepage = "https://github.com/Yubico/yubihsm-shell";
+    maintainers = with maintainers; [ matthewcroughan ];
+    license = licenses.asl20;
+  };
+}
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -2143,7 +2143,9 @@ with pkgs;

  doona = callPackage ../tools/security/doona { };

-  dotter = callPackage ../tools/misc/dotter { };
+  dotter = callPackage ../tools/misc/dotter {
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
+  };

  droidcam = callPackage ../applications/video/droidcam { };

@ -6966,7 +6968,7 @@ with pkgs;

  httpdump = callPackage ../tools/security/httpdump { };

-  httpie = callPackage ../tools/networking/httpie { };
+  httpie = with python3Packages; toPythonApplication httpie;

  httping = callPackage ../tools/networking/httping {};

@ -7327,7 +7329,7 @@ with pkgs;
  jo = callPackage ../development/tools/jo { };

  joshuto = callPackage ../applications/misc/joshuto {
-    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
+    inherit (darwin.apple_sdk.frameworks) SystemConfiguration Foundation;
  };

  jrnl = callPackage ../applications/misc/jrnl { };
@ -8664,6 +8666,8 @@ with pkgs;

  nomino = callPackage ../tools/misc/nomino { };

+  nb = callPackage ../tools/misc/nb { };
+
  notable = callPackage ../applications/misc/notable { };

  nth = with python3Packages; toPythonApplication name-that-hash;
@ -13019,6 +13023,8 @@ with pkgs;

  stylish-cabal = haskell.lib.compose.justStaticExecutables haskellPackages.stylish-cabal;

+  lhs2tex = haskellPackages.lhs2tex;
+
  all-cabal-hashes = callPackage ../data/misc/hackage { };

  purescript = callPackage ../development/compilers/purescript/purescript { };
@ -21169,6 +21175,8 @@ with pkgs;

  xgboost = callPackage ../development/libraries/xgboost { };

+  xgboostWithCuda = xgboost.override { cudaSupport = true; };
+
  xgeometry-select = callPackage ../tools/X11/xgeometry-select { };

  # Avoid using this. It isn't really a wrapper anymore, but we keep the name.
@ -21217,6 +21225,8 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) PCSC;
  };

+  yubihsm-connector = callPackage ../tools/security/yubihsm-connector { };
+
  yubikey-manager = callPackage ../tools/misc/yubikey-manager { };

  yubikey-manager-qt = libsForQt5.callPackage ../tools/misc/yubikey-manager-qt { };
@ -21229,6 +21239,8 @@ with pkgs;

  yubikey-touch-detector = callPackage ../tools/security/yubikey-touch-detector { };

+  yubihsm-shell = callPackage ../tools/security/yubihsm-shell { };
+
  zchunk = callPackage ../development/libraries/zchunk { };

  zeitgeist = callPackage ../development/libraries/zeitgeist { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -2544,6 +2544,8 @@ in {

  dtlssocket = callPackage ../development/python-modules/dtlssocket { };

+  ducc0 = callPackage ../development/python-modules/ducc0 { };
+
  duckdb = callPackage ../development/python-modules/duckdb {
    inherit (pkgs) duckdb;
  };
@ -3939,8 +3941,12 @@ in {

  httpcore = callPackage ../development/python-modules/httpcore { };

+  httpie = callPackage ../development/python-modules/httpie { };
+
  http-ece = callPackage ../development/python-modules/http-ece { };

+  httpie-ntlm = callPackage ../development/python-modules/httpie-ntlm { };
+
  httplib2 = callPackage ../development/python-modules/httplib2 { };

  http-message-signatures = callPackage ../development/python-modules/http-message-signatures { };
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@ -203,6 +203,7 @@ let
        koka
        krank
        lambdabot
+        lhs2tex
        madlang
        matterhorn
        mueval