Merge master into haskell-updates

2021-09-09 00:06:35 +00:00 · 2021-09-09 00:06:35 +00:00 · 6c413ed5bf
commit 6c413ed5bf
parent 314256eb0f 2d42e76e5b
104 changed files with 4853 additions and 3905 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1520,12 +1520,6 @@
    githubId = 355401;
    name = "Brian Hicks";
  };
-  bricewge = {
-    email = "bricewge@gmail.com";
-    github = "bricewge";
-    githubId = 5525646;
-    name = "Brice Waegeneire";
-  };
  Br1ght0ne = {
    email = "brightone@protonmail.com";
    github = "Br1ght0ne";
@ -7683,6 +7677,12 @@
    githubId = 2590830;
    name = "Sage Raflik";
  };
+  neosimsim = {
+    email = "me@abn.sh";
+    github = "neosimsim";
+    githubId = 1771772;
+    name = "Alexander Ben Nasrallah";
+  };
  nequissimus = {
    email = "tim@nequissimus.com";
    github = "nequissimus";
@ -11321,10 +11321,14 @@
    name = "Jos van den Oever";
  };
  vanilla = {
-    email = "neko@hydev.org";
+    email = "osu_vanilla@126.com";
    github = "VergeDX";
    githubId = 25173827;
    name = "Vanilla";
+    keys = [{
+      longkeyid = "rsa4096/0x4DFA2BDD7305E739";
+      fingerprint = "5C16 5178 7DE2 EE5A AF98  3EA3 4DFA 2BDD 7305 E739";
+    }];
  };
  vanschelven = {
    email = "klaas@vanschelven.com";
--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@ -1,11 +1,10 @@
 use strict;
+use warnings;
 use File::Path qw(make_path);
 use File::Slurp;
+use Getopt::Long;
 use JSON;

-make_path("/var/lib/nixos", { mode => 0755 });
-
-
 # Keep track of deleted uids and gids.
 my $uidMapFile = "/var/lib/nixos/uid-map";
 my $uidMap = -e $uidMapFile ? decode_json(read_file($uidMapFile)) : {};
@ -13,12 +12,19 @@ my $uidMap = -e $uidMapFile ? decode_json(read_file($uidMapFile)) : {};
 my $gidMapFile = "/var/lib/nixos/gid-map";
 my $gidMap = -e $gidMapFile ? decode_json(read_file($gidMapFile)) : {};

+my $is_dry = ($ENV{'NIXOS_ACTION'} // "") eq "dry-activate";
+GetOptions("dry-activate" => \$is_dry);
+make_path("/var/lib/nixos", { mode => 0755 }) unless $is_dry;

 sub updateFile {
    my ($path, $contents, $perms) = @_;
+    return if $is_dry;
    write_file($path, { atomic => 1, binmode => ':utf8', perms => $perms // 0644 }, $contents) or die;
 }

+sub nscdInvalidate {
+    system("nscd", "--invalidate", $_[0]) unless $is_dry;
+}

 sub hashPassword {
    my ($password) = @_;
@ -28,6 +34,14 @@ sub hashPassword {
    return crypt($password, '$6$' . $salt . '$');
 }

+sub dry_print {
+    if ($is_dry) {
+        print STDERR ("$_[1] $_[2]\n")
+    } else {
+        print STDERR ("$_[0] $_[2]\n")
+    }
+}
+

 # Functions for allocating free GIDs/UIDs. FIXME: respect ID ranges in
 # /etc/login.defs.
@ -51,7 +65,7 @@ sub allocGid {
    my ($name) = @_;
    my $prevGid = $gidMap->{$name};
    if (defined $prevGid && !defined $gidsUsed{$prevGid}) {
-        print STDERR "reviving group '$name' with GID $prevGid\n";
+        dry_print("reviving", "would revive", "group '$name' with GID $prevGid");
        $gidsUsed{$prevGid} = 1;
        return $prevGid;
    }
@ -63,15 +77,14 @@ sub allocUid {
    my ($min, $max, $up) = $isSystemUser ? (400, 999, 0) : (1000, 29999, 1);
    my $prevUid = $uidMap->{$name};
    if (defined $prevUid && $prevUid >= $min && $prevUid <= $max && !defined $uidsUsed{$prevUid}) {
-        print STDERR "reviving user '$name' with UID $prevUid\n";
+        dry_print("reviving", "would revive", "user '$name' with UID $prevUid");
        $uidsUsed{$prevUid} = 1;
        return $prevUid;
    }
    return allocId(\%uidsUsed, \%uidsPrevUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
 }

-
-# Read the declared users/groups.
+# Read the declared users/groups
 my $spec = decode_json(read_file($ARGV[0]));

 # Don't allocate UIDs/GIDs that are manually assigned.
@ -134,7 +147,7 @@ foreach my $g (@{$spec->{groups}}) {
    if (defined $existing) {
        $g->{gid} = $existing->{gid} if !defined $g->{gid};
        if ($g->{gid} != $existing->{gid}) {
-            warn "warning: not applying GID change of group ‘$name’ ($existing->{gid} -> $g->{gid})\n";
+            dry_print("warning: not applying", "warning: would not apply", "GID change of group ‘$name’ ($existing->{gid} -> $g->{gid})");
            $g->{gid} = $existing->{gid};
        }
        $g->{password} = $existing->{password}; # do we want this?
@ -163,7 +176,7 @@ foreach my $name (keys %groupsCur) {
    my $g = $groupsCur{$name};
    next if defined $groupsOut{$name};
    if (!$spec->{mutableUsers} || defined $declGroups{$name}) {
-        print STDERR "removing group ‘$name’\n";
+        dry_print("removing group", "would remove group", "‘$name’");
    } else {
        $groupsOut{$name} = $g;
    }
@ -175,7 +188,7 @@ my @lines = map { join(":", $_->{name}, $_->{password}, $_->{gid}, $_->{members}
    (sort { $a->{gid} <=> $b->{gid} } values(%groupsOut));
 updateFile($gidMapFile, to_json($gidMap));
 updateFile("/etc/group", \@lines);
-system("nscd --invalidate group");
+nscdInvalidate("group");

 # Generate a new /etc/passwd containing the declared users.
 my %usersOut;
@ -196,7 +209,7 @@ foreach my $u (@{$spec->{users}}) {
    if (defined $existing) {
        $u->{uid} = $existing->{uid} if !defined $u->{uid};
        if ($u->{uid} != $existing->{uid}) {
-            warn "warning: not applying UID change of user ‘$name’ ($existing->{uid} -> $u->{uid})\n";
+            dry_print("warning: not applying", "warning: would not apply", "UID change of user ‘$name’ ($existing->{uid} -> $u->{uid})");
            $u->{uid} = $existing->{uid};
        }
    } else {
@ -211,7 +224,7 @@ foreach my $u (@{$spec->{users}}) {

    # Ensure home directory incl. ownership and permissions.
    if ($u->{createHome}) {
-        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home};
+        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home} and ! $is_dry;
        chown $u->{uid}, $u->{gid}, $u->{home};
        chmod 0700, $u->{home};
    }
@ -250,7 +263,7 @@ foreach my $name (keys %usersCur) {
    my $u = $usersCur{$name};
    next if defined $usersOut{$name};
    if (!$spec->{mutableUsers} || defined $declUsers{$name}) {
-        print STDERR "removing user ‘$name’\n";
+        dry_print("removing user", "would remove user", "‘$name’");
    } else {
        $usersOut{$name} = $u;
    }
@ -261,7 +274,7 @@ foreach my $name (keys %usersCur) {
    (sort { $a->{uid} <=> $b->{uid} } (values %usersOut));
 updateFile($uidMapFile, to_json($uidMap));
 updateFile("/etc/passwd", \@lines);
-system("nscd --invalidate passwd");
+nscdInvalidate("passwd");


 # Rewrite /etc/shadow to add new accounts or remove dead ones.
@ -293,7 +306,7 @@ updateFile("/etc/shadow", \@shadowNew, 0640);
    my $uid = getpwnam "root";
    my $gid = getgrnam "shadow";
    my $path = "/etc/shadow";
-    chown($uid, $gid, $path) || die "Failed to change ownership of $path: $!";
+    (chown($uid, $gid, $path) || die "Failed to change ownership of $path: $!") unless $is_dry;
 }

 # Rewrite /etc/subuid & /etc/subgid to include default container mappings
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -561,14 +561,16 @@ in {
      shadow.gid = ids.gids.shadow;
    };

-    system.activationScripts.users = stringAfter [ "stdio" ]
-      ''
+    system.activationScripts.users = {
+      supportsDryActivation = true;
+      text = ''
        install -m 0700 -d /root
        install -m 0755 -d /home

        ${pkgs.perl.withPackages (p: [ p.FileSlurp p.JSON ])}/bin/perl \
        -w ${./update-users-groups.pl} ${spec}
      '';
+    };

    # for backwards compatibility
    system.activationScripts.groups = stringAfter [ "users" ] "";
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@ -675,6 +675,33 @@ in {
        User = "grafana";
        RuntimeDirectory = "grafana";
        RuntimeDirectoryMode = "0755";
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        UMask = "0027";
      };
      preStart = ''
        ln -fs ${cfg.package}/share/grafana/conf ${cfg.dataDir}
--- a/nixos/modules/system/activation/activation-script.nix
+++ b/nixos/modules/system/activation/activation-script.nix
@ -17,6 +17,41 @@ let
    '';
  });

+  systemActivationScript = set: onlyDry: let
+    set' = filterAttrs (_: v: onlyDry -> v.supportsDryActivation) (mapAttrs (_: v: if isString v then (noDepEntry v) // { supportsDryActivation = false; } else v) set);
+    withHeadlines = addAttributeName set';
+  in
+    ''
+      #!${pkgs.runtimeShell}
+
+      systemConfig='@out@'
+
+      export PATH=/empty
+      for i in ${toString path}; do
+          PATH=$PATH:$i/bin:$i/sbin
+      done
+
+      _status=0
+      trap "_status=1 _localstatus=\$?" ERR
+
+      # Ensure a consistent umask.
+      umask 0022
+
+      ${textClosureMap id (withHeadlines) (attrNames withHeadlines)}
+
+    '' + optionalString (!onlyDry) ''
+      # Make this configuration the current configuration.
+      # The readlink is there to ensure that when $systemConfig = /system
+      # (which is a symlink to the store), /run/current-system is still
+      # used as a garbage collection root.
+      ln -sfn "$(readlink -f "$systemConfig")" /run/current-system
+
+      # Prevent the current configuration from being garbage-collected.
+      ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
+
+      exit $_status
+    '';
+
  path = with pkgs; map getBin
    [ coreutils
      gnugrep
@ -28,7 +63,7 @@ let
      util-linux # needed for mount and mountpoint
    ];

-  scriptType = with types;
+  scriptType = withDry: with types;
    let scriptOptions =
      { deps = mkOption
          { type = types.listOf types.str;
@ -39,6 +74,19 @@ let
          { type = types.lines;
            description = "The content of the script.";
          };
+      } // optionalAttrs withDry {
+        supportsDryActivation = mkOption
+          { type = types.bool;
+            default = false;
+            description = ''
+              Whether this activation script supports being dry-activated.
+              These activation scripts will also be executed on dry-activate
+              activations with the environment variable
+              <literal>NIXOS_ACTION</literal> being set to <literal>dry-activate
+              </literal>.  it's important that these activation scripts  don't
+              modify anything about the system when the variable is set.
+            '';
+          };
      };
    in either str (submodule { options = scriptOptions; });

@ -74,47 +122,19 @@ in
        idempotent and fast.
      '';

-      type = types.attrsOf scriptType;
-
-      apply = set: {
-        script =
-          ''
-            #! ${pkgs.runtimeShell}
-
-            systemConfig=@out@
-
-            export PATH=/empty
-            for i in ${toString path}; do
-                PATH=$PATH:$i/bin:$i/sbin
-            done
-
-            _status=0
-            trap "_status=1 _localstatus=\$?" ERR
-
-            # Ensure a consistent umask.
-            umask 0022
-
-            ${
-              let
-                set' = mapAttrs (n: v: if isString v then noDepEntry v else v) set;
-                withHeadlines = addAttributeName set';
-              in textClosureMap id (withHeadlines) (attrNames withHeadlines)
-            }
-
-            # Make this configuration the current configuration.
-            # The readlink is there to ensure that when $systemConfig = /system
-            # (which is a symlink to the store), /run/current-system is still
-            # used as a garbage collection root.
-            ln -sfn "$(readlink -f "$systemConfig")" /run/current-system
-
-            # Prevent the current configuration from being garbage-collected.
-            ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
-
-            exit $_status
-          '';
+      type = types.attrsOf (scriptType true);
+      apply = set: set // {
+        script = systemActivationScript set false;
      };
    };

+    system.dryActivationScript = mkOption {
+      description = "The shell script that is to be run when dry-activating a system.";
+      readOnly = true;
+      internal = true;
+      default = systemActivationScript (removeAttrs config.system.activationScripts [ "script" ]) true;
+    };
+
    system.userActivationScripts = mkOption {
      default = {};

@ -137,7 +157,7 @@ in
        idempotent and fast.
      '';

-      type = with types; attrsOf scriptType;
+      type = with types; attrsOf (scriptType false);

      apply = set: {
        script = ''
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -36,6 +36,8 @@ EOF
    exit 1;
 }

+$ENV{NIXOS_ACTION} = $action;
+
 # This is a NixOS installation if it has /etc/NIXOS or a proper
 # /etc/os-release.
 die "This is not a NixOS installation!\n" unless
@ -360,6 +362,10 @@ if ($action eq "dry-activate") {
        if scalar @unitsToStopFiltered > 0;
    print STDERR "would NOT stop the following changed units: ", join(", ", sort(keys %unitsToSkip)), "\n"
        if scalar(keys %unitsToSkip) > 0;
+
+    print STDERR "would activate the configuration...\n";
+    system("$out/dry-activate", "$out");
+
    print STDERR "would restart systemd\n" if $restartSystemd;
    print STDERR "would restart the following units: ", join(", ", sort(keys %unitsToRestart)), "\n"
        if scalar(keys %unitsToRestart) > 0;
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@ -56,9 +56,11 @@ let
      ''}

      echo "$activationScript" > $out/activate
+      echo "$dryActivationScript" > $out/dry-activate
      substituteInPlace $out/activate --subst-var out
-      chmod u+x $out/activate
-      unset activationScript
+      substituteInPlace $out/dry-activate --subst-var out
+      chmod u+x $out/activate $out/dry-activate
+      unset activationScript dryActivationScript

      cp ${config.system.build.bootStage2} $out/init
      substituteInPlace $out/init --subst-var-by systemConfig $out
@ -108,6 +110,7 @@ let
      config.system.build.installBootLoader
      or "echo 'Warning: do not know how to make this configuration bootable; please enable a boot loader.' 1>&2; true";
    activationScript = config.system.activationScripts.script;
+    dryActivationScript = config.system.dryActivationScript;
    nixosLabel = config.system.nixos.label;

    configurationName = config.boot.loader.grub.configurationName;
--- a/nixos/modules/tasks/lvm.nix
+++ b/nixos/modules/tasks/lvm.nix
@ -46,22 +46,32 @@ in {
        kernelModules = [ "dm-snapshot" "dm-thin-pool" ];

        extraUtilsCommands = ''
-          copy_bin_and_libs ${pkgs.thin-provisioning-tools}/bin/pdata_tools
-          copy_bin_and_libs ${pkgs.thin-provisioning-tools}/bin/thin_check
+          for BIN in ${pkgs.thin-provisioning-tools}/bin/*; do
+            copy_bin_and_libs $BIN
+          done
+        '';
+
+        extraUtilsCommandsTest = ''
+          ls ${pkgs.thin-provisioning-tools}/bin/ | grep -v pdata_tools | while read BIN; do
+            $out/bin/$(basename $BIN) --help > /dev/null
+          done
        '';
      };

-      environment.etc."lvm/lvm.conf".text = ''
-        global/thin_check_executable = "${pkgs.thin-provisioning-tools}/bin/thin_check"
-      '';
+      environment.etc."lvm/lvm.conf".text = concatMapStringsSep "\n"
+        (bin: "global/${bin}_executable = ${pkgs.thin-provisioning-tools}/bin/${bin}")
+        [ "thin_check" "thin_dump" "thin_repair" "cache_check" "cache_dump" "cache_repair" ];
    })
    (mkIf (cfg.dmeventd.enable || cfg.boot.thin.enable) {
      boot.initrd.preLVMCommands = ''
          mkdir -p /etc/lvm
          cat << EOF >> /etc/lvm/lvm.conf
-          ${optionalString cfg.boot.thin.enable ''
-            global/thin_check_executable = "$(command -v thin_check)"
-          ''}
+          ${optionalString cfg.boot.thin.enable (
+            concatMapStringsSep "\n"
+              (bin: "global/${bin}_executable = $(command -v ${bin})")
+              [ "thin_check" "thin_dump" "thin_repair" "cache_check" "cache_dump" "cache_repair" ]
+            )
+          }
          ${optionalString cfg.dmeventd.enable ''
            dmeventd/executable = "$(command -v false)"
            activation/monitoring = 0
--- a/nixos/tests/miniflux.nix
+++ b/nixos/tests/miniflux.nix
@ -11,7 +11,7 @@ in
 with lib;
 {
  name = "miniflux";
-  meta.maintainers = with pkgs.lib.maintainers; [ bricewge ];
+  meta.maintainers = with pkgs.lib.maintainers; [ ];

  nodes = {
    default =
--- a/nixos/tests/mutable-users.nix
+++ b/nixos/tests/mutable-users.nix
@ -12,6 +12,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
    };
    mutable = { ... }: {
      users.mutableUsers = true;
+      users.users.dry-test.isNormalUser = true;
    };
  };

@ -41,5 +42,32 @@ import ./make-test-python.nix ({ pkgs, ...} : {
            "${mutableSystem}/bin/switch-to-configuration test"
        )
        assert "/run/wrappers/" in machine.succeed("which passwd")
+
+    with subtest("dry-activation does not change files"):
+        machine.succeed('test -e /home/dry-test')  # home was created
+        machine.succeed('rm -rf /home/dry-test')
+
+        files_to_check = ['/etc/group',
+                          '/etc/passwd',
+                          '/etc/shadow',
+                          '/etc/subuid',
+                          '/etc/subgid',
+                          '/var/lib/nixos/uid-map',
+                          '/var/lib/nixos/gid-map',
+                          '/var/lib/nixos/declarative-groups',
+                          '/var/lib/nixos/declarative-users'
+                         ]
+        expected_hashes = {}
+        expected_stats = {}
+        for file in files_to_check:
+            expected_hashes[file] = machine.succeed(f"sha256sum {file}")
+            expected_stats[file] = machine.succeed(f"stat {file}")
+
+        machine.succeed("/run/current-system/bin/switch-to-configuration dry-activate")
+
+        machine.fail('test -e /home/dry-test')  # home was not recreated
+        for file in files_to_check:
+            assert machine.succeed(f"sha256sum {file}") == expected_hashes[file]
+            assert machine.succeed(f"stat {file}") == expected_stats[file]
  '';
 })
--- a/pkgs/applications/audio/exaile/default.nix
+++ b/pkgs/applications/audio/exaile/default.nix
@ -0,0 +1,107 @@
+{ stdenv, lib, fetchFromGitHub
+, gobject-introspection, makeWrapper, wrapGAppsHook
+, gtk3, gst_all_1, python3
+, gettext, gnome, help2man, keybinder3, libnotify, librsvg, streamripper, udisks, webkitgtk
+, iconTheme ? gnome.adwaita-icon-theme
+, deviceDetectionSupport ? true
+, documentationSupport ? true
+, notificationSupport ? true
+, scalableIconSupport ? true
+, translationSupport ? true
+, bpmCounterSupport ? false
+, ipythonSupport ? false
+, lastfmSupport ? false
+, lyricsManiaSupport ? false
+, lyricsWikiSupport ? false
+, multimediaKeySupport ? false
+, musicBrainzSupport ? false
+, podcastSupport ? false
+, streamripperSupport ? false
+, wikipediaSupport ? false
+, fetchpatch
+}:
+
+stdenv.mkDerivation rec {
+  pname = "exaile";
+  version = "4.1.1";
+
+  src = fetchFromGitHub {
+    owner = "exaile";
+    repo = pname;
+    rev = version;
+    sha256 = "0s29lm0i4slgaw5l5s9a2zx0b83xac43rnil5cvyi210dxm5s048";
+  };
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/exaile/exaile/pull/751.patch";
+      sha256 = "sha256-jCJh85Z3HQcyS4ntQP5HwYJgM7WNHcWzjf0BdNJitsM=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    makeWrapper
+    wrapGAppsHook
+  ] ++ lib.optionals documentationSupport [
+    help2man
+    python3.pkgs.sphinx
+    python3.pkgs.sphinx_rtd_theme
+  ] ++ lib.optional translationSupport gettext;
+
+  buildInputs = [
+    iconTheme
+    gtk3
+  ] ++ (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+  ]) ++ (with python3.pkgs; [
+    bsddb3
+    dbus-python
+    mutagen
+    pygobject3
+    pycairo
+    gst-python
+  ]) ++ lib.optional deviceDetectionSupport udisks
+  ++ lib.optional notificationSupport libnotify
+  ++ lib.optional scalableIconSupport librsvg
+  ++ lib.optional bpmCounterSupport gst_all_1.gst-plugins-bad
+  ++ lib.optional ipythonSupport python3.pkgs.ipython
+  ++ lib.optional lastfmSupport python3.pkgs.pylast
+  ++ lib.optional (lyricsManiaSupport || lyricsWikiSupport) python3.pkgs.lxml
+  ++ lib.optional lyricsWikiSupport python3.pkgs.beautifulsoup4
+  ++ lib.optional multimediaKeySupport keybinder3
+  ++ lib.optional musicBrainzSupport python3.pkgs.musicbrainzngs
+  ++ lib.optional podcastSupport python3.pkgs.feedparser
+  ++ lib.optional wikipediaSupport webkitgtk;
+
+  checkInputs = with python3.pkgs; [
+    mox3
+    pytest
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  doCheck = true;
+  preCheck = ''
+    substituteInPlace Makefile --replace "PYTHONPATH=$(shell pwd)" "PYTHONPATH=$PYTHONPATH:$(shell pwd)"
+    export PYTEST="py.test"
+    export XDG_CACHE_HOME=$(mktemp -d)
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/exaile \
+      --set PYTHONPATH $PYTHONPATH \
+      ${lib.optionalString streamripperSupport "--prefix PATH : ${lib.makeBinPath [ streamripper ]}"}
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.exaile.org/";
+    description = "A music player with a simple interface and powerful music management capabilities";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ ryneeverett ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@ -25,7 +25,7 @@

 python3.pkgs.buildPythonApplication rec  {
  pname = "lollypop";
-  version = "1.4.17";
+  version = "1.4.23";

  format = "other";
  doCheck = false;
@ -34,7 +34,7 @@ python3.pkgs.buildPythonApplication rec  {
    url = "https://gitlab.gnome.org/World/lollypop";
    rev = "refs/tags/${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-GrznUXIYUTYOKQ1znsCqmBdm5YImCABMK2NGRtx5fSk=";
+    sha256 = "sha256-wwdH3gMpYt40VGqrL1XfB1dOfg45zLKtTEI23AwjCis=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cni-plugins";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "containernetworking";
    repo = "plugins";
    rev = "v${version}";
-    sha256 = "sha256-RcDZW/iOAcJodGiuzmeZk3obtD0/mQoMF9vL0xNehbQ=";
+    sha256 = "sha256-zIL9KG1WL+DlgC5c+b9gV1i7mB0Ge8bapcuSV4GNIck=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/gnome-network-displays/default.nix
+++ b/pkgs/applications/networking/gnome-network-displays/default.nix
@ -21,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-network-displays";
-  version = "0.90.4";
+  version = "0.90.5";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "04snnfz5jxxpjkrwa7dchc2h4shszi8mq9g3ihvsvipgzjw3d498";
+    sha256 = "sha256-2SBVQK4fJeK8Y2UrrL0g5vQIerDdGE1nhFc6ke4oIpI=";
  };

  patches = [
@ -36,11 +36,6 @@ stdenv.mkDerivation rec {
      url = "https://gitlab.gnome.org/GNOME/gnome-network-displays/-/commit/ef3f3ff565acd8238da46de604a1e750d4f02f07.diff";
      sha256 = "1ljiwgqia6am4lansg70qnwkch9mp1fr6bga98s5fwyiaw6b6f4p";
    })
-    # Fixes an upstream bug: https://gitlab.gnome.org/GNOME/gnome-network-displays/-/issues/147
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-network-displays/-/commit/23164b58f4d5dd59de988525906d6e5e82c5a63c.patch";
-      sha256 = "0x32dvkzv9m04q41aicscpf4aspghx81a65462kjqnsavi64lga5";
-    })
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -4,16 +4,16 @@ let
  common = { stname, target, postInstall ? "" }:
    buildGoModule rec {
      pname = stname;
-      version = "1.18.1";
+      version = "1.18.2";

      src = fetchFromGitHub {
        owner  = "syncthing";
        repo   = "syncthing";
        rev    = "v${version}";
-        sha256 = "1sm4d0pjgk0spz9pddqb3i8hli10pibd5xs18mhcwrhnxj2xky1y";
+        sha256 = "1r5vd501p3ydi6rr2k4cqdl3pixdr79lfwpnc90xmd1i6mlyxrma";
      };

-      vendorSha256 = "1qqpxm4s1s2yp1zmi4m25y1a6r7kxc5rmvfsg50jmqsfnwligpz6";
+      vendorSha256 = "1v8hdr2na7bndx6q1kk0dkg1v9149gbhxcva1wq075xjl0kw21ip";

      doCheck = false;

--- a/pkgs/applications/version-management/blackbox/default.nix
+++ b/pkgs/applications/version-management/blackbox/default.nix
@ -24,7 +24,8 @@ stdenv.mkDerivation rec {

  buildInputs = [ gnupg ];

-  doCheck = true;
+  # https://github.com/NixOS/nixpkgs/issues/134445
+  doCheck = !stdenv.isDarwin && stdenv.isx86_64;

  checkInputs = [
    expect
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@ -46,13 +46,13 @@ let
 in
 mkDerivation rec {
  pname = "obs-studio";
-  version = "27.0.0";
+  version = "27.0.1";

  src = fetchFromGitHub {
    owner = "obsproject";
    repo = "obs-studio";
    rev = version;
-    sha256 = "1n71705b9lbdff3svkmgwmbhlhhxvi8ajxqb74lm07v56a5bvi6p";
+    sha256 = "04fzsr9yizmxy0r7z2706crvnsnybpnv5kgfn77znknxxjacfhkn";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/video/xine-ui/default.nix
+++ b/pkgs/applications/video/xine-ui/default.nix
@ -51,6 +51,11 @@ stdenv.mkDerivation rec {
  LIRC_CFLAGS="-I${lirc}/include";
  LIRC_LIBS="-L ${lirc}/lib -llirc_client";

+  postInstall = ''
+    substituteInPlace $out/share/applications/xine.desktop \
+      --replace "MimeType=;" "MimeType="
+  '';
+
  meta = with lib; {
    homepage = "http://xinehq.de/";
    description = "Xlib-based frontend for Xine video player";
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@ -6,7 +6,7 @@

 buildGoPackage rec {
  pname = "docker-slim";
-  version = "1.36.2";
+  version = "1.36.4";

  goPackagePath = "github.com/docker-slim/docker-slim";

@ -14,7 +14,7 @@ buildGoPackage rec {
    owner = "docker-slim";
    repo = "docker-slim";
    rev = version;
-    sha256 = "sha256-Q8M8+krPC6WRDCxe88gzX5bDG8x6sJ8TduTKjA85WFA=";
+    sha256 = "0hgiigai5jpczjll4s4r4jzbq272s3p8f0r6mj4r3mjjs89hkqz1";
  };

  subPackages = [ "cmd/docker-slim" "cmd/docker-slim-sensor" ];
@ -38,7 +38,7 @@ buildGoPackage rec {
  meta = with lib; {
    description = "Minify and secure Docker containers";
    homepage = "https://dockersl.im/";
-    changelog = "https://github.com/docker-slim/docker-slim/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/docker-slim/docker-slim/raw/${version}/CHANGELOG.md";
    license = licenses.asl20;
    maintainers = with maintainers; [ Br1ght0ne marsam mbrgm ];
  };
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@ -200,6 +200,11 @@ in stdenv.mkDerivation {
      done
    ''}

+    # https://github.com/NixOS/nixpkgs/issues/137104
+    ${optionalString (enableHardening || headless) ''
+      rm $libexec/components/VBoxREM.so
+    ''}
+
    cp -rv out/linux.*/${buildType}/bin/src "$modsrc"
  '';

--- a/pkgs/build-support/coq/default.nix
+++ b/pkgs/build-support/coq/default.nix
@ -57,7 +57,8 @@ let
    ] "") + optionalString (v == null) "-broken";
  append-version = p: n: p + display-pkg n "" coqPackages.${n}.version + "-";
  prefix-name = foldl append-version "" namePrefix;
-  var-coqlib-install = (optionalString (versions.isGe "8.7" coq.coq-version) "COQMF_") + "COQLIB";
+  var-coqlib-install =
+    (optionalString (versions.isGe "8.7" coq.coq-version || coq.coq-version == "dev") "COQMF_") + "COQLIB";
  useDune2 = args.useDune2 or (useDune2ifVersion fetched.version);
 in

--- a/pkgs/build-support/mkshell/default.nix
+++ b/pkgs/build-support/mkshell/default.nix
@ -14,8 +14,9 @@
 , ...
 }@attrs:
 let
-  mergeInputs = name: lib.concatLists (lib.catAttrs name
-    ([ attrs ] ++ inputsFrom));
+  mergeInputs = name:
+    (attrs.${name} or []) ++
+    (lib.subtractLists inputsFrom (lib.flatten (lib.catAttrs name inputsFrom)));

  rest = builtins.removeAttrs attrs [
    "packages"
--- a/pkgs/data/themes/solarc/default.nix
+++ b/pkgs/data/themes/solarc/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation {
    description = "Solarized version of the Arc theme";
    homepage = "https://github.com/schemar/solarc-theme";
    license = licenses.gpl3;
-    maintainers = [ maintainers.bricewge ];
+    maintainers = [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/compilers/hip/default.nix
+++ b/pkgs/development/compilers/hip/default.nix
@ -0,0 +1,166 @@
+{ stdenv
+, binutils-unwrapped
+, clang
+, clang-unwrapped
+, cmake
+, compiler-rt
+, fetchFromGitHub
+, fetchpatch
+, file
+, lib
+, lld
+, llvm
+, makeWrapper
+, perl
+, python
+, rocclr
+, rocm-comgr
+, rocm-device-libs
+, rocm-opencl-runtime
+, rocm-runtime
+, rocm-thunk
+, rocminfo
+, writeText
+}:
+
+stdenv.mkDerivation rec {
+  name = "hip";
+  version = "4.3.1";
+  src = fetchFromGitHub {
+    owner = "ROCm-Developer-Tools";
+    repo = "HIP";
+    rev = "rocm-${version}";
+    sha256 = "sha256-dUdP32H0u6kVItS+VUE549vvxkV1mSN84HvyfeK2hEE=";
+  };
+
+  # FIXME: https://github.com/ROCm-Developer-Tools/HIP/issues/2317
+  postPatch = ''
+    cp ${rocm-opencl-runtime.src}/amdocl/cl_vk_amd.hpp amdocl/
+  '';
+
+  nativeBuildInputs = [ cmake python makeWrapper ];
+  propagatedBuildInputs = [
+    clang
+    compiler-rt
+    lld
+    llvm
+    rocclr
+    rocm-comgr
+    rocm-device-libs
+    rocm-runtime
+    rocm-thunk
+    rocminfo
+  ];
+
+  preConfigure = ''
+    export HIP_CLANG_PATH=${clang}/bin
+    export DEVICE_LIB_PATH=${rocm-device-libs}/lib
+  '';
+
+  # The patch version is the last two digits of year + week number +
+  # day in the week: date -d "2021-07-25" +%y%U%w
+  workweek = "21300";
+
+  cmakeFlags = [
+    "-DHSA_PATH=${rocm-runtime}"
+    "-DHIP_COMPILER=clang"
+    "-DHIP_PLATFORM=amd"
+    "-DHIP_VERSION_GITDATE=${workweek}"
+    "-DCMAKE_C_COMPILER=${clang}/bin/clang"
+    "-DCMAKE_CXX_COMPILER=${clang}/bin/clang++"
+    "-DLLVM_ENABLE_RTTI=ON"
+    "-DLIBROCclr_STATIC_DIR=${rocclr}/lib/cmake"
+    "-DROCclr_DIR=${rocclr}"
+    "-DHIP_CLANG_ROOT=${clang-unwrapped}"
+  ];
+
+  patches = [
+    (fetchpatch {
+      name = "no-git-during-build";
+      url = "https://github.com/acowley/HIP/commit/310b7e972cfb23216250c0240ba6134741679aee.patch";
+      sha256 = "08ky7v1yvajabn9m5x3afzrnz38gnrgc7vgqlbyr7s801c383ha1";
+    })
+    (fetchpatch {
+      name = "use-PATH-when-compiling-pch";
+      url = "https://github.com/acowley/HIP/commit/bfb4dd1eafa9714a2c05a98229cc35ffa3429b37.patch";
+      sha256 = "1wp0m32df7pf4rhx3k5n750fd7kz10zr60z0wllb0mw6h00w6xpz";
+    })
+  ];
+
+  # - fix bash paths
+  # - fix path to rocm_agent_enumerator
+  # - fix hcc path
+  # - fix hcc version parsing
+  # - add linker flags for libhsa-runtime64 and hc_am since libhip_hcc
+  #   refers to them.
+  prePatch = ''
+    for f in $(find bin -type f); do
+      sed -e 's,#!/usr/bin/perl,#!${perl}/bin/perl,' \
+          -e 's,#!/bin/bash,#!${stdenv.shell},' \
+          -i "$f"
+    done
+
+    for f in $(find . -regex '.*\.cpp\|.*\.h\(pp\)?'); do
+      if grep -q __hcc_workweek__ "$f" ; then
+        substituteInPlace "$f" --replace '__hcc_workweek__' '${workweek}'
+      fi
+    done
+
+    sed 's,#!/usr/bin/python,#!${python}/bin/python,' -i hip_prof_gen.py
+
+    sed -e 's,$ROCM_AGENT_ENUM = "''${ROCM_PATH}/bin/rocm_agent_enumerator";,$ROCM_AGENT_ENUM = "${rocminfo}/bin/rocm_agent_enumerator";,' \
+        -e "s,^\($HIP_LIB_PATH=\).*$,\1\"$out/lib\";," \
+        -e 's,^\($HIP_CLANG_PATH=\).*$,\1"${clang}/bin";,' \
+        -e 's,^\($DEVICE_LIB_PATH=\).*$,\1"${rocm-device-libs}/amdgcn/bitcode";,' \
+        -e 's,^\($HIP_COMPILER=\).*$,\1"clang";,' \
+        -e 's,^\($HIP_RUNTIME=\).*$,\1"ROCclr";,' \
+        -e 's,^\([[:space:]]*$HSA_PATH=\).*$,\1"${rocm-runtime}";,'g \
+        -e 's,\([[:space:]]*$HOST_OSNAME=\).*,\1"nixos";,' \
+        -e 's,\([[:space:]]*$HOST_OSVER=\).*,\1"${lib.versions.majorMinor lib.version}";,' \
+        -e 's,^\([[:space:]]*\)$HIP_CLANG_INCLUDE_PATH = abs_path("$HIP_CLANG_PATH/../lib/clang/$HIP_CLANG_VERSION/include");,\1$HIP_CLANG_INCLUDE_PATH = "${clang-unwrapped}/lib/clang/$HIP_CLANG_VERSION/include";,' \
+        -e 's,^\([[:space:]]*$HIPCXXFLAGS .= " -isystem $HIP_CLANG_INCLUDE_PATH\)";,\1 -isystem ${rocm-runtime}/include";,' \
+        -e 's,\($HIPCXXFLAGS .= " -isystem \\"$HIP_INCLUDE_PATH\\"\)" ;,\1 --rocm-path=${rocclr}";,' \
+        -e "s,\$HIP_PATH/\(bin\|lib\),$out/\1,g" \
+        -e "s,^\$HIP_LIB_PATH=\$ENV{'HIP_LIB_PATH'};,\$HIP_LIB_PATH=\"$out/lib\";," \
+        -e 's,`file,`${file}/bin/file,g' \
+        -e 's,`readelf,`${binutils-unwrapped}/bin/readelf,' \
+        -e 's, ar , ${binutils-unwrapped}/bin/ar ,g' \
+        -i bin/hipcc
+
+    sed -e 's,^\($HSA_PATH=\).*$,\1"${rocm-runtime}";,' \
+        -e 's,^\($HIP_CLANG_PATH=\).*$,\1"${clang}/bin";,' \
+        -e 's,^\($HIP_PLATFORM=\).*$,\1"amd";,' \
+        -e 's,$HIP_CLANG_PATH/llc,${llvm}/bin/llc,' \
+        -e 's, abs_path, Cwd::abs_path,' \
+        -i bin/hipconfig
+
+    sed -e 's, abs_path, Cwd::abs_path,' -i bin/hipvars.pm
+
+    sed -e 's|_IMPORT_PREFIX}/../include|_IMPORT_PREFIX}/include|g' \
+        -e 's|''${HIP_CLANG_ROOT}/lib/clang/\*/include|${clang-unwrapped}/lib/clang/*/include|' \
+        -i hip-config.cmake.in
+  '';
+
+  preInstall = ''
+    mkdir -p $out/lib/cmake
+  '';
+
+  # The upstream ROCclr setup wants everything built into the same
+  # ROCclr output directory. We copy things into the HIP output
+  # directory, since it is downstream of ROCclr in terms of dependency
+  # direction. Thus we have device-libs and rocclr pieces in the HIP
+  # output directory.
+  postInstall = ''
+    mkdir -p $out/share
+    mv $out/lib/cmake $out/share/
+    mv $out/cmake/* $out/share/cmake/hip
+    mkdir -p $out/lib
+    ln -s ${rocm-device-libs}/lib $out/lib/bitcode
+    mkdir -p $out/include
+    ln -s ${clang-unwrapped}/lib/clang/11.0.0/include $out/include/clang
+    ln -s ${rocclr}/lib/*.* $out/lib
+    ln -s ${rocclr}/include/* $out/include
+    wrapProgram $out/bin/hipcc --set HIP_PATH $out --set HSA_PATH ${rocm-runtime} --set HIP_CLANG_PATH ${clang}/bin --prefix PATH : ${lld}/bin --set NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt} 1 --prefix NIX_LDFLAGS ' ' -L${compiler-rt}/lib --prefix NIX_LDFLAGS_FOR_TARGET ' ' -L${compiler-rt}/lib
+    wrapProgram $out/bin/hipconfig --set HIP_PATH $out --set HSA_PATH ${rocm-runtime} --set HIP_CLANG_PATH ${clang}/bin
+  '';
+}
--- a/pkgs/development/compilers/llvm/rocm/clang.nix
+++ b/pkgs/development/compilers/llvm/rocm/clang.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchFromGitHub
 , cmake
 , python3
@ -65,7 +66,7 @@ stdenv.mkDerivation rec {
    description = "ROCm fork of the clang C/C++/Objective-C/Objective-C++ LLVM compiler frontend";
    homepage = "https://llvm.org/";
    license = with licenses; [ ncsa ];
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ acowley danieldk lovesegfault ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/compilers/llvm/rocm/compiler-rt/compiler-rt-codesign.patch
+++ b/pkgs/development/compilers/llvm/rocm/compiler-rt/compiler-rt-codesign.patch
@ -0,0 +1,33 @@
+From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Tue, 19 Sep 2017 13:13:06 -0500
+Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
+ needs it
+
+---
+ cmake/Modules/AddCompilerRT.cmake |  8 ------
+ test/asan/CMakeLists.txt          | 52 ---------------------------------------
+ test/tsan/CMakeLists.txt          | 47 -----------------------------------
+ 3 files changed, 107 deletions(-)
+
+diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
+index bc5fb9ff7..b64eb4246 100644
+--- a/cmake/Modules/AddCompilerRT.cmake
+++ b/cmake/Modules/AddCompilerRT.cmake
+@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
+         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
+         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
+       endif()
+-      if(APPLE)
+-        # Ad-hoc sign the dylibs
+-        add_custom_command(TARGET ${libname}
+-          POST_BUILD  
+-          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
+-          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
+-        )
+-      endif()
+     endif()
+     install(TARGETS ${libname}
+       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
+2.14.1
+
--- a/pkgs/development/compilers/llvm/rocm/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/compiler-rt/default.nix
@ -0,0 +1,65 @@
+{ stdenv, lib, version, src, cmake, python3, llvm, libcxxabi }:
+stdenv.mkDerivation rec {
+  pname = "compiler-rt";
+  inherit version src;
+
+  nativeBuildInputs = [ cmake python3 llvm ];
+
+  NIX_CFLAGS_COMPILE = [
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
+  ];
+
+  cmakeFlags = [
+    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
+    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
+    "-DCOMPILER_RT_BUILD_XRAY=OFF"
+    "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+    "-DCMAKE_C_COMPILER_WORKS=ON"
+    "-DCMAKE_CXX_COMPILER_WORKS=ON"
+    "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
+    "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
+    "-DCOMPILER_RT_BUILD_BUILTINS=ON"
+    "-DCMAKE_C_FLAGS=-nodefaultlibs"
+    #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
+    "-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY"
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  patches = [
+    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+  ];
+
+
+  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
+  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
+  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
+  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
+  # a flag and turn the flag off during the stdenv build.
+  postPatch = lib.optionalString (!stdenv.isDarwin) ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+  '';
+
+  # Hack around weird upsream RPATH bug
+  postInstall = ''
+    ln -s "$out/lib"/*/* "$out/lib"
+    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbegin.o
+    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtend.o
+    ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/crtbeginS.o
+    ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/crtendS.o
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "ROCm fork of the LLVM Compiler runtime libraries";
+    homepage = "https://github.com/RadeonOpenCompute/llvm-project";
+    license = licenses.ncsa;
+    maintainers = with maintainers; [ acowley danieldk lovesegfault ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/compilers/llvm/rocm/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/default.nix
@ -1,12 +1,12 @@
-{ lib, buildPackages, fetchFromGitHub, callPackage, wrapCCWith }:
+{ stdenv, lib, buildPackages, fetchFromGitHub, callPackage, wrapCCWith, overrideCC }:

 let
-  version = "4.1.0";
+  version = "4.3.1";
  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
    repo = "llvm-project";
    rev = "rocm-${version}";
-    hash = "sha256-DlId/dF5r0ULl2omYPCyu1Ic3XKlLL7ndiCA0RaF264=";
+    hash = "sha256-7XVtHcrTpw+NYUvuKQFWWFE0FlOTt8EnfZpvepQqE1c=";
  };
 in rec {
  clang = wrapCCWith rec {
@ -15,8 +15,25 @@ in rec {
      clang_version=`${cc}/bin/clang -v 2>&1 | grep "clang version " | grep -E -o "[0-9.-]+"`
      rsrc="$out/resource-root"
      mkdir "$rsrc"
-      ln -s "${lib.getLib cc}/lib/clang/$clang_version/include" "$rsrc"
+      ln -s "${cc}/lib/clang/$clang_version/include" "$rsrc"
+      ln -s "${compiler-rt}/lib" "$rsrc/lib"
      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+      echo "--gcc-toolchain=${stdenv.cc.cc}" >> $out/nix-support/cc-cflags
+      echo "-Wno-unused-command-line-argument" >> $out/nix-support/cc-cflags
+      rm $out/nix-support/add-hardening.sh
+      touch $out/nix-support/add-hardening.sh
+    '';
+  };
+
+  clangNoCompilerRt = wrapCCWith rec {
+    cc = clang-unwrapped;
+    extraBuildCommands = ''
+      clang_version=`${cc}/bin/clang -v 2>&1 | grep "clang version " | grep -E -o "[0-9.-]+"`
+      rsrc="$out/resource-root"
+      mkdir "$rsrc"
+      ln -s "${cc}/lib/clang/$clang_version/include" "$rsrc"
+      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+      echo "--gcc-toolchain=${stdenv.cc.cc}" >> $out/nix-support/cc-cflags
      echo "-Wno-unused-command-line-argument" >> $out/nix-support/cc-cflags
      rm $out/nix-support/add-hardening.sh
      touch $out/nix-support/add-hardening.sh
@ -28,10 +45,15 @@ in rec {
    src = "${src}/clang";
  };

-  lld = callPackage ./lld {
+  compiler-rt = callPackage ./compiler-rt {
+    inherit version llvm;
+    src = "${src}/compiler-rt";
+    stdenv = overrideCC stdenv clangNoCompilerRt;
+  };
+
+  lld = callPackage ./lld.nix {
    inherit llvm version;
    src = "${src}/lld";
-    buildLlvmTools = buildPackages.llvmPackages_rocm;
  };

  llvm = callPackage ./llvm {
--- a/pkgs/development/compilers/llvm/rocm/lld/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/lld/default.nix
@ -1,5 +1,5 @@
-{ lib, stdenv
-, buildLlvmTools
+{ stdenv
+, lib
 , cmake
 , libxml2
 , llvm
@ -14,18 +14,13 @@ stdenv.mkDerivation rec {
  pname = "lld";

  nativeBuildInputs = [ cmake ];
+
  buildInputs = [ libxml2 llvm ];

-
-  cmakeFlags = [
-    "-DLLVM_MAIN_SRC_DIR=${llvm.src}"
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-    "-DLLVM_CONFIG_PATH=${llvm.dev}/bin/llvm-config-native"
-  ];
-
  outputs = [ "out" "dev" ];

+  cmakeFlags = [ "-DLLVM_MAIN_SRC_DIR=${llvm.src}" ];
+
  postInstall = ''
    moveToOutput include "$dev"
    moveToOutput lib "$dev"
@ -39,7 +34,7 @@ stdenv.mkDerivation rec {
    description = "ROCm fork of the LLVM Linker";
    homepage = "https://github.com/RadeonOpenCompute/llvm-project";
    license = licenses.ncsa;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ acowley danieldk lovesegfault ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/compilers/llvm/rocm/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/llvm/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchFromGitHub
 , cmake
 , python3
@ -91,7 +92,7 @@ in stdenv.mkDerivation rec {
    description = "ROCm fork of the LLVM compiler infrastructure";
    homepage = "https://github.com/RadeonOpenCompute/llvm-project";
    license = with licenses; [ ncsa ];
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ acowley danieldk lovesegfault ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/compilers/zig/default.nix
+++ b/pkgs/development/compilers/zig/default.nix
@ -11,13 +11,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "zig";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "ziglang";
    repo = pname;
    rev = version;
-    hash = "sha256-bILjcKX8jPl2n1HRYvYRb7jJkobwqmSJ+hHXSn9n2ag=";
+    hash = "sha256-zMSOH8ZWcvzHRwOgGIbLO9Q6jf1P5QL5KCMD+frp+JA=";
  };

  nativeBuildInputs = [
@ -51,8 +51,7 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    maintainers = with maintainers; [ andrewrk AndersonTorres ];
    platforms = platforms.unix;
-    # See https://github.com/NixOS/nixpkgs/issues/86299
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin; # See https://github.com/NixOS/nixpkgs/issues/86299
  };
 }

--- a/pkgs/development/coq-modules/corn/default.nix
+++ b/pkgs/development/coq-modules/corn/default.nix
@ -5,13 +5,12 @@ with lib; mkCoqDerivation rec {
  inherit version;
  defaultVersion = switch coq.coq-version [
    { case = "8.6"; out = "8.8.1"; }
-    { case = (versions.range "8.7" "8.12"); out = "8.12.0"; }
-    { case = (versions.range "8.13" "8.13"); out = "c366d3f01ec1812b145117a4da940518b092d3a6"; }
+    { case = (versions.range "8.7" "8.13"); out = "8.13.0"; }
  ] null;
  release = {
    "8.8.1".sha256 = "0gh32j0f18vv5lmf6nb87nr5450w6ai06rhrnvlx2wwi79gv10wp";
    "8.12.0".sha256 = "0b92vhyzn1j6cs84z2182fn82hxxj0bqq7hk6cs4awwb3vc7dkhi";
-    "c366d3f01ec1812b145117a4da940518b092d3a6".sha256 = "1wzr7mdsnf1rq7q0dvmv55vxzysy85b00ahwbs868bl7m8fk8x5b";
+    "8.13.0".sha256 = "1wzr7mdsnf1rq7q0dvmv55vxzysy85b00ahwbs868bl7m8fk8x5b";
  };

  preConfigure = "patchShebangs ./configure.sh";
--- a/pkgs/development/coq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
@ -8,6 +8,7 @@ let mca = mkCoqDerivation {
  pname = "analysis";
  owner = "math-comp";

+  release."0.3.10".sha256 = "sha256-FBH2c8QRibq5Ycw/ieB8mZl0fDiPrYdIzZ6W/A3pIhI=";
  release."0.3.9".sha256 = "sha256-uUU9diBwUqBrNRLiDc0kz0CGkwTZCUmigPwLbpDOeg4=";
  release."0.3.6".sha256 = "0g2j7b2hca4byz62ssgg90bkbc8wwp7xkb2d3225bbvihi92b4c5";
  release."0.3.4".sha256 = "18mgycjgg829dbr7ps77z6lcj03h3dchjbj5iir0pybxby7gd45c";
@ -17,7 +18,7 @@ let mca = mkCoqDerivation {

  inherit version;
  defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.11" "8.13") "1.12.0" ];             out = "0.3.9"; }
+      { cases = [ (range "8.11" "8.13") "1.12.0" ];             out = "0.3.10"; }
      { cases = [ (range "8.11" "8.13") "1.11.0" ];             out = "0.3.4"; }
      { cases = [ (range "8.10" "8.12") "1.11.0" ];             out = "0.3.3"; }
      { cases = [ (range "8.10" "8.11") "1.11.0" ];             out = "0.3.1"; }
--- a/pkgs/development/libraries/botan/2.0.nix
+++ b/pkgs/development/libraries/botan/2.0.nix
@ -1,10 +1,19 @@
-{ callPackage, ... } @ args:
+{ callPackage, fetchpatch, ... } @ args:

 callPackage ./generic.nix (args // {
  baseVersion = "2.18";
-  revision = "0";
-  sha256 = "09z3fy31q1pvnvpy4fswrsl2aq8ksl94lbh5rl7b6nqc3qp8ar6c";
+  revision = "1";
+  sha256 = "0adf53drhk1hlpfih0175c9081bqpclw6p2afn51cmx849ib9izq";
  postPatch = ''
    sed -e 's@lang_flags "@&--std=c++11 @' -i src/build-data/cc/{gcc,clang}.txt
  '';
+  extraPatches = [
+    (fetchpatch {
+      name = "CVE-2021-40529.patch";
+      url = "https://github.com/randombit/botan/commit/9a23e4e3bc3966340531f2ff608fa9d33b5185a2.patch";
+      sha256 = "1ax1n2l9zh0hk35vkkywgkhzpdk76xb9apz2wm3h9kjvjs9acr3y";
+      # our source tarball doesn't include the tests
+      excludes = [ "src/tests/*" ];
+    })
+  ];
 })
--- a/pkgs/development/libraries/botan/default.nix
+++ b/pkgs/development/libraries/botan/default.nix
@ -10,6 +10,7 @@ callPackage ./generic.nix (args // {
    sed -e 's@lang_flags "@&--std=c++11 @' -i src/build-data/cc/{gcc,clang}.txt
  '';
  knownVulnerabilities = [
+    "CVE-2021-40529"
    # https://botan.randombit.net/security.html#id1
    "2020-03-24: Side channel during CBC padding"
  ];
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@ -3,6 +3,7 @@
 , baseVersion, revision, sha256
 , sourceExtension ? "tar.xz"
 , extraConfigureFlags ? ""
+, extraPatches ? [ ]
 , postPatch ? null
 , knownVulnerabilities ? [ ]
 , CoreServices
@ -22,6 +23,7 @@ stdenv.mkDerivation rec {
    ];
    inherit sha256;
  };
+  patches = extraPatches;
  inherit postPatch;

  buildInputs = [ python3 bzip2 zlib gmp openssl boost ]
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "grpc";
-  version = "1.39.1"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
+  version = "1.40.0"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too

  src = fetchFromGitHub {
    owner = "grpc";
    repo = "grpc";
    rev = "v${version}";
-    sha256 = "1yrr04g6faphh4hwzryqrwzgcr0hqqh05x9mc3vhpzmdkrrbz4zn";
+    sha256 = "08l2dyf3g3zrffy60ycid6jngvhfaghg792yrkfjcpcif5dqfd9f";
    fetchSubmodules = true;
  };

--- a/pkgs/development/libraries/ip2location-c/default.nix
+++ b/pkgs/development/libraries/ip2location-c/default.nix
@ -1,15 +1,23 @@
-{ lib, stdenv, fetchurl, autoreconfHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+}:

 stdenv.mkDerivation rec {
  pname = "ip2location-c";
-  version = "7.0.2"; # meta.homepage might change after a major update
+  version = "8.4.0";

-  src = fetchurl {
-    sha256 = "1gs43qgcyfn83abrkhvvw1s67d1sbkbj3hab9m17ysn6swafiycx";
-    url = "https://www.ip2location.com/downloads/ip2location-c-${version}.tar.gz";
+  src = fetchFromGitHub {
+    owner = "chrislim2888";
+    repo = "IP2Location-C-Library";
+    rev = version;
+    sha256 = "0rqjgmv62s7abiiqi3ff3ff838qx4pzr509irmzvqlflnkxxi0q6";
  };

-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+  ];

  enableParallelBuilding = true;

@ -25,8 +33,9 @@ stdenv.mkDerivation rec {
      weather, MCC, MNC, mobile brand name, elevation and usage type of
      any IP address or host name in the IP2Location databases.
    '';
-    homepage = "http://www.ip2location.com/developers/c-7";
+    homepage = "https://www.ip2location.com/developers/c";
    license = with licenses; [ gpl3Plus lgpl3Plus ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/libspng/default.nix
+++ b/pkgs/development/libraries/libspng/default.nix
@ -0,0 +1,56 @@
+{ lib
+, fetchFromGitHub
+, stdenv
+, zlib
+, ninja
+, meson
+, pkg-config
+, cmake
+, libpng
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libspng";
+  version = "0.7.0-rc3";
+
+  src = fetchFromGitHub {
+    owner = "randy408";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0n91mr06sr34cqq91738251iaw21h5c4jgjpn0kqfx69ywxcl9fj";
+  };
+
+  doCheck = true;
+
+  mesonBuildType = "release";
+
+  mesonFlags = [
+    # this is required to enable testing
+    # https://github.com/randy408/libspng/blob/bc383951e9a6e04dbc0766f6737e873e0eedb40b/tests/README.md#testing
+    "-Ddev_build=true"
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  checkInputs = [
+    cmake
+    libpng
+  ];
+
+  buildInputs = [
+    pkg-config
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    ninja
+    meson
+  ];
+
+  meta = with lib; {
+    description = "Simple, modern libpng alternative";
+    homepage = "https://github.com/randy408/libspng";
+    license = with licenses; [ bsd2 ];
+    maintainers = with maintainers; [ humancalico ];
+  };
+}
--- a/pkgs/development/libraries/libxc/default.nix
+++ b/pkgs/development/libraries/libxc/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libxc";
-  version = "5.1.5";
+  version = "5.1.6";

  src = fetchFromGitLab {
    owner = "libxc";
    repo = "libxc";
    rev = version;
-    sha256 = "0cy3x2zn1bldc5i0rzislfbc8h4nqgds445jkfqjv0d1shvdy0zn";
+    sha256 = "07iljmv737kx24kd33x9ndf5l854mwslg9x2psqm12k07jmq9wjw";
  };

  buildInputs = [ gfortran ];
--- a/pkgs/development/libraries/rocclr/default.nix
+++ b/pkgs/development/libraries/rocclr/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "rocclr";
-  version = "4.1.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "ROCm-Developer-Tools";
    repo = "ROCclr";
    rev = "rocm-${version}";
-    hash = "sha256-2DI/PL29aiZcxOrGZBzXwAnNgZQpSDjyyGKgl+vDErk=";
+    hash = "sha256-3lk7Zucoam+11gFBzg/TWQI1L8uAlxTrPz/mDwTwod4=";
  };

  nativeBuildInputs = [ cmake rocm-cmake ];
@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
    description = "Radeon Open Compute common language runtime";
    homepage = "https://github.com/ROCm-Developer-Tools/ROCclr";
    license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ lovesegfault ];
    # rocclr seems to have some AArch64 ifdefs, but does not seem
    # to be supported yet by the build infrastructure. Recheck in
    # the future.
--- a/pkgs/development/libraries/rocm-comgr/default.nix
+++ b/pkgs/development/libraries/rocm-comgr/default.nix
@ -1,21 +1,21 @@
-{ lib, stdenv, fetchFromGitHub, cmake, clang, device-libs, lld, llvm }:
+{ lib, stdenv, fetchFromGitHub, cmake, clang, rocm-device-libs, lld, llvm }:

 stdenv.mkDerivation rec {
  pname = "rocm-comgr";
-  version = "4.1.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
    repo = "ROCm-CompilerSupport";
    rev = "rocm-${version}";
-    hash = "sha256-LbQqyJxRqb6vpXiYSkRlF1FeqXJJXktPafGmYDDK02U=";
+    hash = "sha256-wHSAhp1cqR9xOreGt2M2Td/ELCuLEHjpMRRkqE9dUy0=";
  };

  sourceRoot = "source/lib/comgr";

  nativeBuildInputs = [ cmake ];

-  buildInputs = [ clang device-libs lld llvm ];
+  buildInputs = [ clang rocm-device-libs lld llvm ];

  cmakeFlags = [
    "-DCLANG=${clang}/bin/clang"
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
    description = "APIs for compiling and inspecting AMDGPU code objects";
    homepage = "https://github.com/RadeonOpenCompute/ROCm-CompilerSupport/tree/amd-stg-open/lib/comgr";
    license = licenses.ncsa;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ lovesegfault ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/rocm-device-libs/default.nix
+++ b/pkgs/development/libraries/rocm-device-libs/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "rocm-device-libs";
-  version = "4.1.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
    repo = "ROCm-Device-Libs";
    rev = "rocm-${version}";
-    hash = "sha256-9p6PIXdHFIgHgNWZzqVz5O9i2Np0z/iyxodG2cLrpGs=";
+    hash = "sha256-fPD9vevO2UDaFaclSI0CC/lRfM5WemWmxP1K5ajXHbk=";
  };

  nativeBuildInputs = [ cmake ];
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
    description = "Set of AMD-specific device-side language runtime libraries";
    homepage = "https://github.com/RadeonOpenCompute/ROCm-Device-Libs";
    license = licenses.ncsa;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ lovesegfault ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/rocm-opencl-icd/default.nix
+++ b/pkgs/development/libraries/rocm-opencl-icd/default.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "OpenCL ICD definition for AMD GPUs using the ROCm stack";
    license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ lovesegfault ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/rocm-opencl-runtime/default.nix
+++ b/pkgs/development/libraries/rocm-opencl-runtime/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchFromGitHub
 , addOpenGLRunpath
 , cmake
@ -21,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "rocm-opencl-runtime";
-  version = "4.1.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
    repo = "ROCm-OpenCL-Runtime";
    rev = "rocm-${version}";
-    hash = "sha256-+6h1E5uWNKjjaeO5ZIi854CWYi0QGQ5mVUHdi9+4vX4=";
+    hash = "sha256-4+PNxRqvAvU0Nj2igYl3WiS5h5HGV63J+cHbIVW89LE=";
  };

  nativeBuildInputs = [ cmake rocm-cmake ];
@ -77,7 +78,7 @@ stdenv.mkDerivation rec {
    description = "OpenCL runtime for AMD GPUs, part of the ROCm stack";
    homepage = "https://github.com/RadeonOpenCompute/ROCm-OpenCL-Runtime";
    license = with licenses; [ asl20 mit ];
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ acowley danieldk lovesegfault ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/rocm-runtime/default.nix
+++ b/pkgs/development/libraries/rocm-runtime/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchFromGitHub
 , addOpenGLRunpath
 , clang-unwrapped
@ -6,25 +7,26 @@
 , xxd
 , elfutils
 , llvm
+, numactl
 , rocm-device-libs
 , rocm-thunk }:

 stdenv.mkDerivation rec {
  pname = "rocm-runtime";
-  version = "4.1.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
    repo = "ROCR-Runtime";
    rev = "rocm-${version}";
-    hash = "sha256-Jxg3n203tV0L+UrmeQEuzX0TKpFu5An2cnuEA/F/SNY=";
+    hash = "sha256-B67v9B8LXDbWNxYNRxM3dgFFLjFSyJmm0zd3G5Bgvek=";
  };

  sourceRoot = "source/src";

  nativeBuildInputs = [ cmake xxd ];

-  buildInputs = [ clang-unwrapped elfutils llvm ];
+  buildInputs = [ clang-unwrapped elfutils llvm numactl ];

  cmakeFlags = [
   "-DBITCODE_DIR=${rocm-device-libs}/amdgcn/bitcode"
@ -43,6 +45,6 @@ stdenv.mkDerivation rec {
    description = "Platform runtime for ROCm";
    homepage = "https://github.com/RadeonOpenCompute/ROCR-Runtime";
    license = with licenses; [ ncsa ];
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ danieldk lovesegfault ];
  };
 }
--- a/pkgs/development/libraries/rocm-thunk/default.nix
+++ b/pkgs/development/libraries/rocm-thunk/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "rocm-thunk";
-  version = "4.1.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
    repo = "ROCT-Thunk-Interface";
    rev = "rocm-${version}";
-    hash = "sha256-gdto7BbrSRa3UiRNvTW1KLkHyjrcxdah4+L+1Gdm0wA=";
+    hash = "sha256-jpwFL4UbEnWkw1AiM4U1s1t7GiqzBeOwa55VpnOG2Dk=";
  };

  preConfigure = ''
@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
    description = "Radeon open compute thunk interface";
    homepage = "https://github.com/RadeonOpenCompute/ROCT-Thunk-Interface";
    license = with licenses; [ bsd2 mit ];
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ lovesegfault ];
  };
 }
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/python-modules/denonavr/default.nix
+++ b/pkgs/development/python-modules/denonavr/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "denonavr";
-  version = "0.10.8";
+  version = "0.10.9";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "scarface-4711";
    repo = pname;
    rev = version;
-    sha256 = "02q76mbmg2rkm4shy2apwbw9pvicy9j5v4zgpjwzxif9yf7m8aqk";
+    sha256 = "sha256-Y0sFRKnKZAdP95EyE3h1g92AJeT0Xkshjjwfv/vnfW8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dnachisel/default.nix
+++ b/pkgs/development/python-modules/dnachisel/default.nix
@ -15,13 +15,13 @@

 buildPythonPackage rec {
  pname = "dnachisel";
-  version = "3.2.7";
+  version = "3.2.8";

  src = fetchFromGitHub {
    owner = "Edinburgh-Genome-Foundry";
    repo = "DnaChisel";
    rev = "v${version}";
-    sha256 = "1zhq7cai47649njjp3m8zaglsv9ci6ci855dymyip8qx5ppnkfj0";
+    sha256 = "17jldscmsq5lwp3pnjlxg56k3vfpr7rj4qbcbzkzhphifrfgm729";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/elementpath/default.nix
+++ b/pkgs/development/python-modules/elementpath/default.nix
@ -1,15 +1,20 @@
-{ lib, buildPythonPackage, fetchFromGitHub, isPy27 }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+}:

 buildPythonPackage rec {
-  version = "2.3.0";
+  version = "2.3.1";
  pname = "elementpath";
-  disabled = isPy27; # uses incompatible class syntax
+
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "sissaschool";
    repo = "elementpath";
    rev = "v${version}";
-    sha256 = "1zghj0v1s03ahynx7sczag7iaam757ypwl1lm0ym6j37dnq8vnxk";
+    sha256 = "1imjilhmbw08469irlbr3am5zksbg327n7mznxfixrigq9d65qx6";
  };

  # avoid circular dependency with xmlschema which directly depends on this
--- a/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/pkgs/development/python-modules/google-cloud-asset/default.nix
@ -17,11 +17,11 @@

 buildPythonPackage rec {
  pname = "google-cloud-asset";
-  version = "3.4.0";
+  version = "3.5.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "bd1fe84efd2e45042d95c7e5713e0a0365ec8138df062c07fab761233202ab6f";
+    sha256 = "7d7218ffdd17d64184e1de69ef016f1f070bb0c888785510c4731948b078067d";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/google-resumable-media/default.nix
+++ b/pkgs/development/python-modules/google-resumable-media/default.nix
@ -12,11 +12,11 @@

 buildPythonPackage rec {
  pname = "google-resumable-media";
-  version = "2.0.1";
+  version = "2.0.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "cac55be7802e3424b8f022d8a572a8349327e7ce8494eee5e0f4df02458b1813";
+    sha256 = "36d682161fdcbfa29681212c210fabecbf6849a505a0cbc54b7f70a10a5278a2";
  };

  propagatedBuildInputs = [ google-auth google-crc32c requests ];
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "grpcio-tools";
-  version = "1.39.0";
+  version = "1.40.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "39dfe7415bc0d3860fdb8dd90607594b046b88b57dbe64284efa4820f951c805";
+    sha256 = "d440f2bc089ff628618c536904d5bc39d0b44f7afdda4c4c1ecd15fcf385bfba";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/python-modules/karton-core/default.nix
+++ b/pkgs/development/python-modules/karton-core/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "karton-core";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitHub {
    owner = "CERT-Polska";
    repo = "karton";
    rev = "v${version}";
-    sha256 = "08j1bm9g58576sswcrpfczaki24nlqqaypp7qv1rxxwsyp5pq6h6";
+    sha256 = "sha256-pIYDY+pie4xqH11UHBal7/+MVmJDgNCFVpSD9we9ZPA=";
  };

  propagatedBuildInputs = [ minio redis ];
--- a/pkgs/development/python-modules/mediafile/default.nix
+++ b/pkgs/development/python-modules/mediafile/default.nix
@ -1,8 +1,5 @@
 { buildPythonPackage
-, enum34
-, fetchpatch
 , fetchPypi
-, isPy27
 , lib
 , mutagen
 , six
@ -10,30 +7,14 @@

 buildPythonPackage rec {
  pname = "mediafile";
-  version = "0.6.0";
+  version = "0.8.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-o/tSAHu8FTr6LZoMHvegr9uCZovNLHS9KkP2U9y4uko=";
+    sha256 = "sha256-19K5DZMstRWu/6+N/McEdM1swedI5qr15kmnIAMA60Y=";
  };

-  propagatedBuildInputs = [ mutagen six ] ++ lib.optional isPy27 enum34;
-
-  # NB: Remove in the next release
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/beetbox/mediafile/commit/0ff753d493a1a7f406cb3378545ffe2c85a9afa3.patch";
-      sha256 = "sha256-AQ7YedoYPmLqt4a/odgghIKOY61i9YfA0To0RVFqlk8=";
-    })
-    (fetchpatch {
-      url = "https://github.com/beetbox/mediafile/commit/f0fb4e5111d9dfaa3b38d196ec41fcd237d97953.patch";
-      sha256 = "sha256-5O6RiAqkQEz3Bvqjwwv/LOS33nSIBnT2H/vasGGVrpI=";
-    })
-    (fetchpatch {
-      url = "https://github.com/beetbox/mediafile/commit/d2fc3b59f77c515b02dfe7ad936f89264375d2b4.patch";
-      sha256 = "sha256-SMH0XhCaKLDNB4M8VmZWfGuuelfY5xladZyQYtXtP18=";
-    })
-  ];
+  propagatedBuildInputs = [ mutagen six ];

  meta = with lib; {
    description = "MediaFile is a simple interface to the metadata tags for many audio file formats.";
--- a/pkgs/development/python-modules/mysql-connector/0001-Revert-Fix-MacOS-wheels-platform-tag.patch
+++ b/pkgs/development/python-modules/mysql-connector/0001-Revert-Fix-MacOS-wheels-platform-tag.patch
@ -0,0 +1,36 @@
+From c5d32ef5d656b0aa4b2c1fc61c901d40bf2fb96a Mon Sep 17 00:00:00 2001
+From: Alexander Ben Nasrallah <me@abn.sh>
+Date: Mon, 19 Jul 2021 17:24:41 +0200
+Subject: [PATCH] Revert "Fix MacOS wheels platform tag"
+
+This reverts commit d1e89fd3d7391084cdf35b0806cb5d2a4b413654.
+---
+ cpydist/__init__.py | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/cpydist/__init__.py b/cpydist/__init__.py
+index 0e7f341..2619d7a 100644
+--- a/cpydist/__init__.py
+++ b/cpydist/__init__.py
+@@ -41,7 +41,7 @@ from distutils.command.install import install
+ from distutils.command.install_lib import install_lib
+ from distutils.core import Command
+ from distutils.dir_util import mkpath, remove_tree
+-from distutils.sysconfig import get_config_vars, get_python_version
+from distutils.sysconfig import get_python_version
+ from distutils.version import LooseVersion
+ from subprocess import check_call, Popen, PIPE
+ 
+@@ -57,9 +57,6 @@ version_py = os.path.join("lib", "mysql", "connector", "version.py")
+ with open(version_py, "rb") as fp:
+     exec(compile(fp.read(), version_py, "exec"))
+ 
+-if "MACOSX_DEPLOYMENT_TARGET" in get_config_vars():
+-    get_config_vars()["MACOSX_DEPLOYMENT_TARGET"] = "11.0"
+-
+ COMMON_USER_OPTIONS = [
+     ("byte-code-only", None,
+      "remove Python .py files; leave byte code .pyc only"),
+-- 
+2.31.1
+
--- a/pkgs/development/python-modules/mysql-connector/default.nix
+++ b/pkgs/development/python-modules/mysql-connector/default.nix
@ -13,6 +13,15 @@ in buildPythonPackage rec {
    sha256 = "1zb5wf65rnpbk0lw31i4piy0bq09hqa62gx7bh241zc5310zccc7";
  };

+  patches = [
+    # mysql-connector overrides MACOSX_DEPLOYMENT_TARGET to 11.
+    # This makes the installation with nixpkgs fail. I suspect, that's
+    # because stdenv.targetPlatform.darwinSdkVersion is (currently) set to
+    # 10.12. The patch reverts
+    # https://github.com/mysql/mysql-connector-python/commit/d1e89fd3d7391084cdf35b0806cb5d2a4b413654
+    ./0001-Revert-Fix-MacOS-wheels-platform-tag.patch
+  ];
+
  propagatedBuildInputs = with py.pkgs; [ protobuf dnspython ];

  # Tests are failing (TODO: unknown reason)
@ -31,6 +40,6 @@ in buildPythonPackage rec {
    homepage = "https://github.com/mysql/mysql-connector-python";
    changelog = "https://raw.githubusercontent.com/mysql/mysql-connector-python/${version}/CHANGES.txt";
    license = [ lib.licenses.gpl2Only ];
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ neosimsim turion ];
  };
 }
--- a/pkgs/development/python-modules/numpy-stl/default.nix
+++ b/pkgs/development/python-modules/numpy-stl/default.nix
@ -11,11 +11,11 @@

 buildPythonPackage rec {
  pname = "numpy-stl";
-  version = "2.16.2";
+  version = "2.16.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "3e635b6fb6112a3c5e00e9e20eedab93b9b0c45ff1cc34eb7bdc0b3e922e2d77";
+    sha256 = "95890627001efb2cb8d17418730cdc1bdd64b8dbb9862b01a8e0359d79fe863e";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pomegranate/default.nix
+++ b/pkgs/development/python-modules/pomegranate/default.nix
@ -31,6 +31,10 @@ buildPythonPackage rec {
      url = "https://github.com/jmschrei/pomegranate/commit/42d14bebc44ffd4a778b2a6430aa845591b7c3b7.patch";
      sha256 = "0f9cx0fj9xkr3hch7jyrn76zjypilh5bqw734caaw6g2m49lvbff";
    })
+  ] ++ [
+    # Likely an upstream test bug and not a real problem:
+    #   https://github.com/jmschrei/pomegranate/issues/939
+    ./disable-failed-on-nextworkx-2.6.patch
  ] ;

  propagatedBuildInputs = [ numpy scipy cython networkx joblib pyyaml ];
--- a/pkgs/development/python-modules/pomegranate/disable-failed-on-nextworkx-2.6.patch
+++ b/pkgs/development/python-modules/pomegranate/disable-failed-on-nextworkx-2.6.patch
@ -0,0 +1,26 @@
+Test started failing after upgrading networkx 2.5.1 -> 2.6.2:
+    https://github.com/jmschrei/pomegranate/issues/939
+
+Failures look benigh.
+--- a/tests/test_bayesian_network.py
+++ b/tests/test_bayesian_network.py
+@@ -1057,7 +1057,8 @@ def test_exact_structure_learning_exclude_edges():
+         assert_not_equal(model.structure[-2], (d-1,))
+         assert_equal(model.structure[-2], (1,))
+ 
+-def test_exact_dp_structure_learning_exclude_edges():
+# disabled for https://github.com/jmschrei/pomegranate/issues/939
+def disabled_exact_dp_structure_learning_exclude_edges():
+     for X in datasets:
+         X = X.copy()
+         X[:,1] = X[:,-1]
+@@ -1139,7 +1140,8 @@ def test_constrained_parents_structure_learning_exclude_edges():
+     assert_equal(model.structure[7], (2,))
+     assert_equal(model.structure[4], (0,))
+ 
+-def test_constrained_slap_structure_learning_exclude_edges():
+# disabled for https://github.com/jmschrei/pomegranate/issues/939
+def disabled_constrained_slap_structure_learning_exclude_edges():
+     for X in datasets:
+         X = X.copy()
+         X[:,1] = X[:,-1]
--- a/pkgs/development/python-modules/pubnub/default.nix
+++ b/pkgs/development/python-modules/pubnub/default.nix
@ -13,13 +13,13 @@

 buildPythonPackage rec {
  pname = "pubnub";
-  version = "5.2.0";
+  version = "5.2.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = "python";
    rev = "v${version}";
-    sha256 = "1jd3rr8dydfaxz5g8idpwacp4bnbmhg74dwz7qwmzn34336s4ji6";
+    sha256 = "151f9vhgjlr3maniry3vin8vxvz7h8kxnfby9zgsrlvjs4nfgdf9";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyfma/default.nix
+++ b/pkgs/development/python-modules/pyfma/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "pyfma";
-  version = "0.1.4";
+  version = "0.1.6";
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "nschloe";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "1wkcl41j2d1yflc5dl30ys1yxx68w9zn3vj8brwkm1ar9jnfmg4h";
+    rev = version;
+    sha256 = "12i68jj9n1qj9phjnj6f0kmfhlsd3fqjlk9p6d4gs008azw5m8yn";
  };
  format = "pyproject";

--- a/pkgs/development/python-modules/pymazda/default.nix
+++ b/pkgs/development/python-modules/pymazda/default.nix
@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "pymazda";
-  version = "0.2.0";
+  version = "0.2.1";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-tEe70gvEglxqECiPjS3k29zZi70OSGMv6JxhrXqPhnY=";
+    sha256 = "sha256-Dg7oVNEjKZB6zksm1We2JGBW+cGkOOQOP3bS4CNL4q8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/python-nomad/default.nix
+++ b/pkgs/development/python-modules/python-nomad/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "python-nomad";
-  version = "1.3.0";
+  version = "1.4.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "67731d050472923581c43a39a8f01567468e8b3c8e83465b762c99eb0e5e23bc";
+    sha256 = "087a7d5d2af9fd8ce5da70d29e4b456c6b8b0ea3cd16613ed50f6eb8ad6cdba6";
  };

  propagatedBuildInputs = [ requests ];
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@ -24,13 +24,13 @@

 buildPythonPackage rec {
  pname = "trezor";
-  version = "0.12.3";
+  version = "0.12.4";

  disabled = !isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "02c39c333435b8f6dc62cc79bb5bf35fc7f0eb144a1a748be3b7c065ee3e85ae";
+    sha256 = "3e180d9f9f8b69176b5ef36311b6161f5b793b538eb2dfd4babbb4d3fb1e374e";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/development/python-modules/xmlschema/default.nix
+++ b/pkgs/development/python-modules/xmlschema/default.nix
@ -1,34 +1,48 @@
-{ lib, buildPythonPackage, fetchFromGitHub
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
 , elementpath
 , lxml
-, pytest
+, pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
-  version = "1.7.0";
+  version = "1.7.1";
  pname = "xmlschema";

+  disabled = pythonOlder "3.6";
+
  src = fetchFromGitHub {
    owner = "sissaschool";
    repo = "xmlschema";
    rev = "v${version}";
-    sha256 = "0vf0gj1sbv9f7gjm3zbyl0b8pkrn00yzx57ddff0h2kazv8jlpwi";
+    sha256 = "124wq44aqzxrh92ylm44rry9dsyb68drgzbhzacrm511n1j0ziww";
  };

-  propagatedBuildInputs = [ elementpath ];
+  propagatedBuildInputs = [
+    elementpath
+  ];

-  checkInputs = [ lxml pytest ];
+  checkInputs = [
+    lxml
+    pytestCheckHook
+  ];

  # Ignore broken fixtures, and tests for files which don't exist.
  # For darwin, we need to explicity say we can't reach network
-  checkPhase = ''
-    pytest tests \
-      --ignore=tests/test_factory.py \
-      --ignore=tests/test_schemas.py \
-      --ignore=tests/test_memory.py \
-      --ignore=tests/test_validation.py \
-      -k 'not element_tree_import_script and not export_remote'
-  '';
+  disabledTests = [
+    "export_remote"
+    "element_tree_import_script"
+  ];
+
+  disabledTestPaths = [
+    "tests/test_schemas.py"
+    "tests/test_memory.py"
+    "tests/test_validation.py"
+  ];
+
+  pythonImportsCheck = [ "xmlschema" ];

  meta = with lib; {
    description = "XML Schema validator and data conversion library for Python";
--- a/pkgs/development/tools/build-managers/rocm-cmake/default.nix
+++ b/pkgs/development/tools/build-managers/rocm-cmake/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "rocm-cmake";
-  version = "4.1.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
    repo = "rocm-cmake";
    rev = "rocm-${version}";
-    hash = "sha256-uK060F7d7/pTCNbGqdKCzxgPrPPbGjNwuUOt176z7EM=";
+    hash = "sha256-BhpYOL7+IlBpkzeFjfy6KLO7ail472KQWFfQX/sXLGo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/tools/continuous-integration/drone-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone-cli/default.nix
@ -21,7 +21,7 @@ buildGoModule rec {
  };

  meta = with lib; {
-    maintainers = with maintainers; [ bricewge ];
+    maintainers = with maintainers; [ ];
    license = licenses.asl20;
    description = "Command line client for the Drone continuous integration server";
  };
--- a/pkgs/development/tools/htmlq/default.nix
+++ b/pkgs/development/tools/htmlq/default.nix
@ -0,0 +1,26 @@
+{ lib, stdenv, fetchFromGitHub, rustPlatform, Security }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "htmlq";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "mgdm";
+    repo = "htmlq";
+    rev = "v${version}";
+    sha256 = "sha256-Q2zjrHKFWowx2yB1cdGxPnNnc8yQJz65HaX0yIqbHks=";
+  };
+
+  cargoSha256 = "sha256-pPtKPVSdEtEPmQPpNRJ4uyguDRAW0YvKgdUw5OAtbjA=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Like jq, but for HTML";
+    homepage = "https://github.com/mgdm/htmlq";
+    license = licenses.mit;
+    maintainers = with maintainers; [ siraben nerdypepper ];
+  };
+}
--- a/pkgs/development/tools/luaformatter/default.nix
+++ b/pkgs/development/tools/luaformatter/default.nix
@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
    description = "Code formatter for Lua";
    homepage = "https://github.com/Koihik/LuaFormatter";
    license = licenses.asl20;
+    platforms = platforms.all;
    maintainers = with maintainers; [ figsoda SuperSandro2000 ];
    mainProgram = "lua-format";
  };
--- a/pkgs/development/tools/ocaml/dune/2.nix
+++ b/pkgs/development/tools/ocaml/dune/2.nix
@ -6,11 +6,11 @@ else

 stdenv.mkDerivation rec {
  pname = "dune";
-  version = "2.9.0";
+  version = "2.9.1";

  src = fetchurl {
    url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    sha256 = "07m476kgagpd6kzm3jq30yfxqspr2hychah0xfqs14z82zxpq8dv";
+    sha256 = "09lzq04b642iy0ljp59p32lgk3q8iphjh8fkdp69q29l5frgwx5k";
  };

  buildInputs = [ ocaml findlib ];
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
  meta = {
    homepage = "https://dune.build/";
    description = "A composable build system";
-    changelog = "https://github.com/ocaml/dune/blob/${version}/CHANGES.md";
+    changelog = "https://github.com/ocaml/dune/raw/${version}/CHANGES.md";
    maintainers = [ lib.maintainers.vbgl lib.maintainers.marsam ];
    license = lib.licenses.mit;
    inherit (ocaml.meta) platforms;
--- a/pkgs/development/tools/rocminfo/default.nix
+++ b/pkgs/development/tools/rocminfo/default.nix
@ -0,0 +1,38 @@
+{ stdenv, lib, fetchFromGitHub, fetchpatch, cmake, rocm-runtime, python3, rocm-cmake, busybox, gnugrep
+  # rocminfo requires that the calling user have a password and be in
+  # the video group. If we let rocm_agent_enumerator rely upon
+  # rocminfo's output, then it, too, has those requirements. Instead,
+  # we can specify the GPU targets for this system (e.g. "gfx803" for
+  # Polaris) such that no system call is needed for downstream
+  # compilers to determine the desired target.
+, defaultTargets ? []}:
+stdenv.mkDerivation rec {
+  version = "4.3.1";
+  pname = "rocminfo";
+  src = fetchFromGitHub {
+    owner = "RadeonOpenCompute";
+    repo = "rocminfo";
+    rev = "rocm-${version}";
+    sha256 = "sha256-n80tiSVaPTFl4imZvoFENM4KhPLxgDKz5VlOvhEYlV0=";
+  };
+
+  enableParallelBuilding = true;
+  buildInputs = [ cmake rocm-cmake rocm-runtime ];
+  cmakeFlags = [
+    "-DROCM_DIR=${rocm-runtime}"
+    "-DROCRTST_BLD_TYPE=Release"
+  ];
+
+  prePatch = ''
+    sed 's,#!/usr/bin/env python3,#!${python3}/bin/python,' -i rocm_agent_enumerator
+    sed 's,lsmod | grep ,${busybox}/bin/lsmod | ${gnugrep}/bin/grep ,' -i rocminfo.cc
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp rocminfo $out/bin
+    cp rocm_agent_enumerator $out/bin
+  '' + lib.optionalString (defaultTargets != []) ''
+    echo '${lib.concatStringsSep "\n" defaultTargets}' > $out/bin/target.lst
+  '';
+}
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@ -6,14 +6,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "rust-analyzer-unwrapped";
-  version = "2021-08-30";
-  cargoSha256 = "sha256-ba/4mQSBJin3yoIZjzFTiEIRY2eWFQI2pY1dOCZ1ALw=";
+  version = "2021-09-06";
+  cargoSha256 = "sha256-CTCDSoViyVMHxUKQz8fE+r3rkXf7yRgzZ90fZmMtcNM=";

  src = fetchFromGitHub {
    owner = "rust-analyzer";
    repo = "rust-analyzer";
    rev = version;
-    sha256 = "sha256-mgwoJfvO3W4MYk6ikgck14e+hMjA2D+4lpnkAEeLEWA=";
+    sha256 = "sha256-TacpTVvHAIs4kZ5vibj8luy/kryYwxY+OXFNPnqiXP0=";
  };

  patches = [
--- a/pkgs/development/web/nodejs/v16.nix
+++ b/pkgs/development/web/nodejs/v16.nix
@ -8,7 +8,7 @@ let
 in
  buildNodejs {
    inherit enableNpm;
-    version = "16.8.0";
-    sha256 = "14k3njj382im3q4k6dhsxdk07gs81hw2k0nrixfvlw1964k04ydq";
+    version = "16.9.0";
+    sha256 = "0vv6igmnz4fkr4i8gczxxw2qgcvydkpy71w3lskah8zw1lh69rqs";
    patches = [ ./disable-darwin-v8-system-instrumentation.patch ];
  }
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@ -3106,6 +3106,18 @@ final: prev:
    meta.homepage = "https://github.com/wfxr/minimap.vim/";
  };

+  minsnip-nvim = buildVimPluginFrom2Nix {
+    pname = "minsnip.nvim";
+    version = "2021-09-06";
+    src = fetchFromGitHub {
+      owner = "jose-elias-alvarez";
+      repo = "minsnip.nvim";
+      rev = "0bcc73cb716b07d4286ef714f5a07d94204d484c";
+      sha256 = "0k6dmqmw52scvwfr5w8dg7388cy95vdvgfw3f4prwyls60i9x55w";
+    };
+    meta.homepage = "https://github.com/jose-elias-alvarez/minsnip.nvim/";
+  };
+
  mkdx = buildVimPluginFrom2Nix {
    pname = "mkdx";
    version = "2021-07-05";
@ -3482,12 +3494,12 @@ final: prev:
    pname = "neorg";
    version = "2021-09-05";
    src = fetchFromGitHub {
-      owner = "vhyrro";
+      owner = "nvim-neorg";
      repo = "neorg";
      rev = "47a0a3d91ddde94488ccd03d38b5beeb296d3148";
      sha256 = "0n8scyjy3wx2l3anl3dyipx7rlayrjb5dlri2r81dr1s77vkch83";
    };
-    meta.homepage = "https://github.com/vhyrro/neorg/";
+    meta.homepage = "https://github.com/nvim-neorg/neorg/";
  };

  neoscroll-nvim = buildVimPluginFrom2Nix {
@ -4114,6 +4126,18 @@ final: prev:
    meta.homepage = "https://github.com/ishan9299/nvim-solarized-lua/";
  };

+  nvim-spectre = buildVimPluginFrom2Nix {
+    pname = "nvim-spectre";
+    version = "2021-09-05";
+    src = fetchFromGitHub {
+      owner = "windwp";
+      repo = "nvim-spectre";
+      rev = "0f10e9fe2553cb8c0a1512924a2639035559e0bd";
+      sha256 = "15bahq0gspjl263bjlpd199brf3ns126j2mrlfxsqzlcnc53y7za";
+    };
+    meta.homepage = "https://github.com/windwp/nvim-spectre/";
+  };
+
  nvim-terminal-lua = buildVimPluginFrom2Nix {
    pname = "nvim-terminal.lua";
    version = "2019-10-17";
--- a/pkgs/misc/vim-plugins/overrides.nix
+++ b/pkgs/misc/vim-plugins/overrides.nix
@ -431,6 +431,10 @@ self: super: {
    dependencies = with self; [ popfix ];
  });

+  nvim-spectre = super.nvim-spectre.overrideAttrs (old: {
+    dependencies = with self; [ plenary-nvim ];
+  });
+
  # Usage:
  # pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [ p.tree-sitter-c p.tree-sitter-java ... ])
  # or for all grammars:
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@ -283,6 +283,7 @@ joonty/vim-xdebug
 joosepalviste/nvim-ts-context-commentstring@main
 josa42/coc-lua
 josa42/vim-lightline-coc
+jose-elias-alvarez/minsnip.nvim@main
 jose-elias-alvarez/null-ls.nvim@main
 joshdick/onedark.vim@main
 jpalardy/vim-slime@main
@ -511,6 +512,7 @@ nvim-lua/lsp-status.nvim
 nvim-lua/lsp_extensions.nvim
 nvim-lua/plenary.nvim
 nvim-lua/popup.nvim
+nvim-neorg/neorg@main
 nvim-telescope/telescope-dap.nvim
 nvim-telescope/telescope-frecency.nvim
 nvim-telescope/telescope-fzf-native.nvim@main
@ -789,7 +791,6 @@ urbit/hoon.vim
 Valloric/MatchTagAlways
 Valodim/deoplete-notmuch
 vhda/verilog_systemverilog.vim
-vhyrro/neorg@main
 vigoux/LanguageTool.nvim
 vim-airline/vim-airline
 vim-airline/vim-airline-themes
@ -858,6 +859,7 @@ wincent/command-t
 wincent/ferret
 wincent/terminus
 windwp/nvim-autopairs
+windwp/nvim-spectre
 winston0410/cmd-parser.nvim
 winston0410/range-highlight.nvim
 wlangstroth/vim-racket
--- a/pkgs/misc/vscode-extensions/rust-analyzer/build-deps/package.json
+++ b/pkgs/misc/vscode-extensions/rust-analyzer/build-deps/package.json
@ -1,6 +1,6 @@
 {
  "name": "rust-analyzer",
-  "version": "0.2.727",
+  "version": "0.2.735",
  "dependencies": {
    "https-proxy-agent": "^5.0.0",
    "node-fetch": "^2.6.1",
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@ -59,5 +59,6 @@ stdenv.mkDerivation {
    platforms = [ "x86_64-linux" "i686-linux" ];
    homepage = "https://github.com/Bumblebee-Project/bbswitch";
    maintainers = with maintainers; [ abbradar ];
+    license = licenses.gpl2Plus;
  };
 }
--- a/pkgs/os-specific/linux/ddcci/default.nix
+++ b/pkgs/os-specific/linux/ddcci/default.nix
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
    description = "Kernel module driver for DDC/CI monitors";
    homepage = "https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux";
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ bricewge ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
    broken = kernel.kernelOlder "5.1";
  };
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18298";
-    sha256 = "027fp6h7295cc9m5g46phqd6hixcnvihpfsyrnzvsxz6pkvjzpw4";
+    rev = "18314";
+    sha256 = "0fic073zafwdsw7i0j4z57a4aknk8kpgnbrxpbi181n5axdlm99k";
  }
 , ...
 }:
--- a/pkgs/os-specific/linux/perf-tools/default.nix
+++ b/pkgs/os-specific/linux/perf-tools/default.nix
@ -39,6 +39,6 @@ stdenv.mkDerivation {
    homepage = "https://github.com/brendangregg/perf-tools";
    description = "Performance analysis tools based on Linux perf_events (aka perf) and ftrace";
    maintainers = [ maintainers.eelco ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
  };
 }
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , pkg-config
 , libxslt
@ -16,13 +17,13 @@

 stdenv.mkDerivation {
  pname = "upower";
-  version = "0.99.11";
+  version = "0.99.13";

  outputs = [ "out" "dev" ];

  src = fetchurl {
-    url = "https://gitlab.freedesktop.org/upower/upower/uploads/93cfe7c8d66ed486001c4f3f55399b7a/upower-0.99.11.tar.xz";
-    sha256 = "1vxxvmz2cxb1qy6ibszaz5bskqdy9nd9fxspj9fv3gfmrjzzzdb4";
+    url = "https://gitlab.freedesktop.org/upower/upower/uploads/177df5b9f9b76f25a2ad9da41aa0c1fa/upower-0.99.13.tar.xz";
+    sha256 = "sha256-XK1w+RVAzH3BIcsX4K1kXl5mPIaC9gp75C7jjNeyPXo=";
  };

  nativeBuildInputs = [
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@ -12,11 +12,11 @@ let
 in
 buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.41.1";
+  version = "1.42.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1vaym6mxnwg2xdqjcigi2sb0kkdi0ly5d5ghakfsysxcfn08d1z8";
+    sha256 = "sha256-wJFjjm9apRqjk5eN/kIEgecHgm/XLbtwXHEpM2pmvO8=";
  };

  patches = [
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "grafana";
-  version = "8.1.2";
+  version = "8.1.3";

  excludedPackages = "\\(alert_webhook_listener\\|clean-swagger\\|release_publisher\\|slow_proxy\\|slow_proxy_mac\\|macaron\\)";

@ -10,12 +10,12 @@ buildGoModule rec {
    rev = "v${version}";
    owner = "grafana";
    repo = "grafana";
-    sha256 = "sha256-xlERuPkhPEHbfX7bVoc9CjqYe/P0Miiyu5c067LLS1M=";
+    sha256 = "sha256-gJO21qTTiP6/8Oln0w89UYEYWb6pIlXvKfiALAUAjnM=";
  };

  srcStatic = fetchurl {
    url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-0fzCwkVHrBFiSKxvyTK0Xu8wHpyo58u+a9c7daaUCc0=";
+    sha256 = "sha256-1ZZMZEErt/OD55mEu/mF2XrsZcDVk700jRkTcYK14rE=";
  };

  vendorSha256 = "sha256-DFD6orsM5oDOLgHbCbrD+zNKVGbQT3Izm1VtNCZO40I=";
--- a/pkgs/servers/sql/postgresql/ext/pgvector.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvector.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "pgvector";
-  version = "0.1.7";
+  version = "0.1.8";

  src = fetchFromGitHub {
    owner = "ankane";
    repo = pname;
    rev = "v${version}";
-    sha256 = "07m1nn640by5q22q2s1nlmjp14q5ffbyib28kjzlss0mq8acb439";
+    sha256 = "0kq28k96y5r0k6nhz78c3frqzhf8d1af54dqbpayn7fgvdl0vlm2";
  };

  buildInputs = [ postgresql ];
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@ -5,15 +5,15 @@
 , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert }:

 stdenv.mkDerivation rec {
-  version = "2021-08-27";
+  version = "2021-09-07";
  pname = "oh-my-zsh";
-  rev = "190325049ef93731ab28295dbedf36d44ab33d7a";
+  rev = "450acc0113b114352ce3b94870fe63fc461844bd";

  src = fetchFromGitHub {
    inherit rev;
    owner = "ohmyzsh";
    repo = "ohmyzsh";
-    sha256 = "x+cGlYjTgs7Esb4NNSBcKhoDb1SuEQxONt/sSHeVj0M=";
+    sha256 = "SWUr+EJ4tfzj0bVstSexMOdN3fv37PuRUmbB1C7YRlI=";
  };

  installPhase = ''
--- a/pkgs/tools/audio/beets/plugins/extrafiles.nix
+++ b/pkgs/tools/audio/beets/plugins/extrafiles.nix
@ -14,6 +14,7 @@ pythonPackages.buildPythonApplication rec {
  postPatch = ''
    sed -i -e '/install_requires/,/\]/{/beets/d}' setup.py
    sed -i -e '/namespace_packages/d' setup.py
+    sed -i -e 's/mediafile~=0.6.0/mediafile>=0.6.0/' setup.py
  '';

  nativeBuildInputs = [ beets ];
--- a/pkgs/tools/backup/mylvmbackup/default.nix
+++ b/pkgs/tools/backup/mylvmbackup/default.nix
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
  version = "0.16";

  src = fetchurl {
-    url = "${meta.homepage}/${pname}-${version}.tar.gz";
+    url = "https://www.lenzg.net/mylvmbackup/${pname}-${version}.tar.gz";
    sha256 = "sha256-vb7M3EPIrxIz6jUwm241fzaEz2czqdCObrFgSOSgJRU=";
  };

--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@ -9,11 +9,11 @@
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python3Packages.buildPythonApplication rec {
  pname = "diffoscope";
-  version = "182";
+  version = "183";

  src = fetchurl {
    url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "sha256-atWyVMewm+I/SDdE9+z1JYLLVOFDsgps2BL9WgZLlVA=";
+    sha256 = "sha256-XFFrRmCpE2UvZRCELfPaotLklyjLiCDWkyFWkISOHZM=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/tools/misc/etcher/default.nix
+++ b/pkgs/tools/misc/etcher/default.nix
@ -10,7 +10,7 @@

 let
  sha256 = {
-    "x86_64-linux" = "sha256-FRZTUOlOK1bIbrHdR9yQv45zMhby3tWbMPpaPPq3L9s=";
+    "x86_64-linux" = "sha256-Tasynkzyy8UIalQn6qhIuPWDflf4pL76D2czgEijrPw=";
    "i686-linux" = "0z6y45sz086njpywg7f0jn6n02qynb1qbi889g2kcgwbfjvmcpm1";
  }."${stdenv.system}";

@ -25,7 +25,7 @@ in

 stdenv.mkDerivation rec {
  pname = "etcher";
-  version = "1.5.121";
+  version = "1.5.122";

  src = fetchurl {
    url = "https://github.com/balena-io/etcher/releases/download/v${version}/balena-etcher-electron_${version}_${arch}.deb";
--- a/pkgs/tools/networking/ipv6calc/default.nix
+++ b/pkgs/tools/networking/ipv6calc/default.nix
@ -1,20 +1,33 @@
-{ lib, stdenv, fetchurl, getopt, ip2location-c, openssl, perl
-, libmaxminddb ? null, geolite-legacy ? null }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, getopt
+, ip2location-c
+, openssl
+, perl
+, libmaxminddb ? null
+, geolite-legacy ? null
+}:

 stdenv.mkDerivation rec {
  pname = "ipv6calc";
-  version = "2.2.0";
+  version = "3.2.0";

-  src = fetchurl {
-    urls = [
-      "https://www.deepspace6.net/ftp/pub/ds6/sources/ipv6calc/${pname}-${version}.tar.gz"
-      "ftp://ftp.deepspace6.net/pub/ds6/sources/ipv6calc/${pname}-${version}.tar.gz"
-      "ftp://ftp.bieringer.de/pub/linux/IPv6/ipv6calc/${pname}-${version}.tar.gz"
-    ];
-    sha256 = "18acy0sy3n6jcjjwpxskysinw06czyayx1q4rqc7zc3ic4pkad8r";
+  src = fetchFromGitHub {
+    owner = "pbiering";
+    repo = pname;
+    rev = version;
+    sha256 = "1iis7qw803k9z52j30hn9sv8c3b0xyr9v7kb4fvcyiry1iaxcgfk";
  };

-  buildInputs = [ libmaxminddb geolite-legacy getopt ip2location-c openssl perl ];
+  buildInputs = [
+    libmaxminddb
+    geolite-legacy
+    getopt
+    ip2location-c
+    openssl
+    perl
+  ];

  postPatch = ''
    patchShebangs *.sh */*.sh
@ -30,9 +43,13 @@ stdenv.mkDerivation rec {
    "--disable-bundled-md5"
    "--disable-dynamic-load"
    "--enable-shared"
-  ] ++ lib.optional (libmaxminddb != null) "--enable-mmdb"
-    ++ lib.optional (geolite-legacy != null) "--with-geoip-db=${geolite-legacy}/share/GeoIP"
-    ++ lib.optional (ip2location-c != null) "--enable-ip2location";
+  ] ++ lib.optional (libmaxminddb != null) [
+    "--enable-mmdb"
+  ] ++ lib.optional (geolite-legacy != null) [
+    "--with-geoip-db=${geolite-legacy}/share/GeoIP"
+  ] ++ lib.optional (ip2location-c != null) [
+    "--enable-ip2location"
+  ];

  enableParallelBuilding = true;

@ -47,7 +64,8 @@ stdenv.mkDerivation rec {
      Now only one utiltity is needed to do a lot.
    '';
    homepage = "http://www.deepspace6.net/projects/ipv6calc.html";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/tools/networking/spoof-mac/default.nix
+++ b/pkgs/tools/networking/spoof-mac/default.nix
@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchFromGitHub, docopt }:
+
+buildPythonPackage rec {
+  pname = "spoof-mac";
+  version = "unstable-2018-01-27";
+
+  src = fetchFromGitHub {
+    owner = "feross";
+    repo = "SpoofMAC";
+    rev = "2cfc796150ef48009e9b765fe733e37d82c901e0";
+    sha256 = "sha256-Qiu0URjUyx8QDVQQUFGxPax0J80e2m4+bPJeqFoKxX8=";
+  };
+
+  propagatedBuildInputs = [ docopt ];
+
+  # No tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Change your MAC address for debugging purposes";
+    homepage = "https://github.com/feross/SpoofMAC";
+    license = licenses.mit;
+    maintainers = with maintainers; [ siraben ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/tools/security/age/default.nix
+++ b/pkgs/tools/security/age/default.nix
@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:

 buildGoModule rec {
  pname = "age";
@ -13,9 +13,15 @@ buildGoModule rec {
  };

  ldflags = [
-    "-X main.Version=${version}"
+    "-s" "-w" "-X main.Version=${version}"
  ];

+  nativeBuildInputs = [ installShellFiles ];
+
+  preInstall = ''
+    installManPage doc/*.1
+  '';
+
  doInstallCheck = true;
  installCheckPhase = ''
    if [[ "$("$out/bin/${pname}" --version)" == "${version}" ]]; then
--- a/pkgs/tools/system/foreman/Gemfile.lock
+++ b/pkgs/tools/system/foreman/Gemfile.lock
@ -1,15 +1,13 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    foreman (0.78.0)
-      thor (~> 0.19.1)
-    thor (0.19.1)
+    foreman (0.87.2)

 PLATFORMS
-  ruby
+  x86_64-linux

 DEPENDENCIES
  foreman

 BUNDLED WITH
-   2.1.4
+   2.2.20
--- a/pkgs/tools/system/foreman/gemset.nix
+++ b/pkgs/tools/system/foreman/gemset.nix
@ -1,18 +1,12 @@
 {
-  thor = {
-    version = "0.19.1";
-    source = {
-      type = "gem";
-      remotes = ["https://rubygems.org"];
-      sha256 = "08p5gx18yrbnwc6xc0mxvsfaxzgy2y9i78xq7ds0qmdm67q39y4z";
-    };
-  };
  foreman = {
-    version = "0.78.0";
+    groups = ["default"];
+    platforms = [];
    source = {
-      type = "gem";
      remotes = ["https://rubygems.org"];
-      sha256 = "1caz8mi7gq1hs4l1flcyyw1iw1bdvdbhppsvy12akr01k3s17xaq";
+      sha256 = "0szgxvnzwkzrfbq5dkwa98mig78aqglfy6irdsvq1gq045pbq9r7";
+      type = "gem";
    };
+    version = "0.87.2";
  };
 }
--- a/pkgs/tools/system/gdu/default.nix
+++ b/pkgs/tools/system/gdu/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "gdu";
-  version = "5.6.2";
+  version = "5.7.0";

  src = fetchFromGitHub {
    owner = "dundee";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-9Qdl+5BvzYbBw90+9V5bKBrikxlxMt7UxMQ54XwgbTk=";
+    sha256 = "sha256-zotCn8J6zQtHd/YDT87l6Vh4Xh51tOJENBCdxZ5rqWU=";
  };

-  vendorSha256 = "sha256-TxtYsM1qtpvI5IbkM3vicCgJ0+EqelFJ8Vc6+Ff5wd8=";
+  vendorSha256 = "sha256-TBWhF2YmlJPNFr3sKSFhuzoBD0Hp1tnYAMJDUwO/QFM=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/system/rocm-smi/default.nix
+++ b/pkgs/tools/system/rocm-smi/default.nix
@ -1,17 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python3 }:
+{ lib, stdenv, fetchFromGitHub, cmake, wrapPython }:

 stdenv.mkDerivation rec {
  pname = "rocm-smi";
-  version = "4.1.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
    repo = "rocm_smi_lib";
    rev = "rocm-${version}";
-    hash = "sha256-LEaC1XhmyoVWrpL05MhgN02LVT2rLKdnw9g2QdfM/uE=";
+    hash = "sha256-Ckno73Otkc9rHEUkSgNoOui+6ZHGUF+B9iAoe0NQH0c=";
  };

-  nativeBuildInputs = [ cmake python3.pkgs.wrapPython ];
+  nativeBuildInputs = [ cmake wrapPython ];

  postPatch = ''
    # Upstream ROCm is installed in an /opt directory. For this reason,
@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
    description = "System management interface for AMD GPUs supported by ROCm";
    homepage = "https://github.com/RadeonOpenCompute/ROC-smi";
    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ lovesegfault ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/tools/text/difftastic/default.nix
+++ b/pkgs/tools/text/difftastic/default.nix
@ -2,22 +2,22 @@

 rustPlatform.buildRustPackage rec {
  pname = "difftastic";
-  version = "0.6";
+  version = "0.8";

  src = fetchFromGitHub {
    owner = "wilfred";
    repo = pname;
    rev = version;
-    sha256 = "WFvxdRCbTBW1RGn2SvAo2iXn82OO/Z06cZQkIu4eiew=";
+    sha256 = "0103py4v4v7xqv85yiczhd9w9h1aa54svhhdibvbl6x4b35y2mk5";
  };

-  cargoSha256 = "2hRUfIxNVs4uSrEESas3wvvVsZHVocP8aiO7K0NZ+mY=";
+  cargoSha256 = "1k0d7yadicfzfc2m1aqs4c4a2k3srb54fpwarc3kwn26v3vfjai1";

  meta = with lib; {
    description = "A syntax-aware diff";
    homepage = "https://github.com/Wilfred/difftastic";
+    changelog = "https://github.com/Wilfred/difftastic/raw/${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ ethancedwards8 ];
-    platforms = platforms.unix;
  };
 }
--- a/Show More
+++ b/Show More