Merge pull request #117015 from NixOS/staging-next

Staging next
2021-03-31 12:42:19 +02:00 · 2021-03-31 12:42:19 +02:00 · 9b9e9cff00
commit 9b9e9cff00
parent 779ef0a43d e880daefc6
192 changed files with 1583 additions and 1000 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -7,8 +7,9 @@
 #### Overview

 Several versions of the Python interpreter are available on Nix, as well as a
-high amount of packages. The attribute `python` refers to the default
-interpreter, which is currently CPython 2.7. It is also possible to refer to
+high amount of packages. The attribute `python3` refers to the default
+interpreter, which is currently CPython 3.8. The attribute `python` refers to
+CPython 2.7 for backwards-compatibility. It is also possible to refer to
 specific versions, e.g. `python38` refers to CPython 3.8, and `pypy` refers to
 the default PyPy interpreter.

@ -762,10 +763,10 @@ and in this case the `python38` interpreter is automatically used.
 Versions 2.7, 3.6, 3.7, 3.8 and 3.9 of the CPython interpreter are available as
 respectively `python27`, `python36`, `python37`, `python38` and `python39`. The
 aliases `python2` and `python3` correspond to respectively `python27` and
-`python38`. The default interpreter, `python`, maps to `python2`. The PyPy
-interpreters compatible with Python 2.7 and 3 are available as `pypy27` and
-`pypy3`, with aliases `pypy2` mapping to `pypy27` and `pypy` mapping to `pypy2`.
-The Nix expressions for the interpreters can be found in
+`python39`. The attribute `python` maps to `python2`. The PyPy interpreters
+compatible with Python 2.7 and 3 are available as `pypy27` and `pypy3`, with
+aliases `pypy2` mapping to `pypy27` and `pypy` mapping to `pypy2`. The Nix
+expressions for the interpreters can be found in
 `pkgs/development/interpreters/python`.

 All packages depending on any Python interpreter get appended
@ -788,6 +789,23 @@ Each interpreter has the following attributes:
 - `executable`. Name of the interpreter executable, e.g. `python3.8`.
 - `pkgs`. Set of Python packages for that specific interpreter. The package set can be modified by overriding the interpreter and passing `packageOverrides`.

+### Optimizations
+
+The Python interpreters are by default not build with optimizations enabled, because
+the builds are in that case not reproducible. To enable optimizations, override the
+interpreter of interest, e.g using
+
+```
+let
+  pkgs = import ./. {};
+  mypython = pkgs.python3.override {
+    enableOptimizations = true;
+    reproducibleBuild = false;
+    self = mypython;
+  };
+in mypython
+```
+
 ### Building packages and applications

 Python libraries and applications that use `setuptools` or
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@ -67,6 +67,12 @@
     for the motivation).
    </para>
   </listitem>
+   <listitem>
+    <para>
+     Python optimizations were disabled again. Builds with optimizations enabled
+     are not reproducible. Optimizations can now be enabled with an option.
+    </para>
+   </listitem>
   <listitem>
    <para>
     <link xlink:href="https://kodi.tv/">Kodi</link> has been updated to version 19.0 "Matrix". See
@ -579,6 +585,11 @@ self: super:
     <xref linkend="opt-services.xserver.videoDrivers" /> no longer uses the deprecated <literal>cirrus</literal> and <literal>vesa</literal> device dependent X drivers by default. It also enables both <literal>amdgpu</literal> and <literal>nouveau</literal> drivers by default now.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The <literal>kindlegen</literal> package is gone, because it is no longer supported or hosted by Amazon. Sadly, its replacement, Kindle Previewer, has no Linux support. However, there are other ways to generate MOBI files. See <link xlink:href="https://github.com/NixOS/nixpkgs/issues/96439">the discussion</link> for more info.
+    </para>
+   </listitem>
   <listitem>
    <para>
      The <package>apacheKafka</package> packages are now built with
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -84,6 +84,7 @@ let
      # Kernel module loading.
      "systemd-modules-load.service"
      "kmod-static-nodes.service"
+      "modprobe@.service"

      # Filesystems.
      "systemd-fsck@.service"
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.1522";
+  version = "8.2.2567";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    sha256 = "0dah3392cq06pagik5y7kcq61mslqvfsh7vqldv3kvhr5ilqb8qy";
+    sha256 = "sha256-FS3TZX7FKnnNpGYKbng2LIfWA9z2jqg7d2HC6t3xYTU=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -14,8 +14,8 @@ let
    else throw "ImageMagick is not supported on this platform.";

  cfg = {
-    version = "7.0.10-61";
-    sha256 = "sha256-c/90N5H9iz5JYmn7/ynHgSOAmO5NTtkxajChZvjfMP8=";
+    version = "7.0.11-3";
+    sha256 = "sha256-y937OxAHNTbWa96oQmTpp/ivxtPVL16hr4SvzZWugQo=";
    patches = [];
  };
 in
@ -84,6 +84,7 @@ stdenv.mkDerivation {
    homepage = "http://www.imagemagick.org/";
    description = "A software suite to create, edit, compose, or convert bitmap images";
    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ erictapen ];
    license = licenses.asl20;
  };
 }
--- a/pkgs/applications/networking/cluster/kubelogin/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubelogin";
-  version = "0.0.7";
+  version = "0.0.8";

  src = fetchFromGitHub {
    owner = "Azure";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0jw8v6ff0iwkwxlhcr35cvhy4zg31dsm1s3q4fxgi901yj1wn6zy";
+    sha256 = "sha256-iR+DomoCErzl9GEE8qTWEkJvbCnw4Ob7R66eluMBNcQ=";
  };

-  vendorSha256 = "0al8y65xvnwl34jkpqyf6zwr21xn30zswknlym9nnn1n47fyayxb";
+  vendorSha256 = "sha256-HXSvZoOX22poOYGghCpXX9BSSR9L6YMqw+7x4WZS39o=";

  buildFlagsArray = ''
    -ldflags=
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -24,7 +24,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.30.1";
+  version = "2.31.0";
  svn = subversionClient.override { perlBindings = perlSupport; };

  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@ -36,7 +36,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0rwlbps9x8kgk2hsm0bvsrkpsk9bnbnz8alknbd7i688jnhai27r";
+    sha256 = "0h4sg3xqa9pd2agrd7m18sqg319ls978d39qswyf30rjvg5n5wg8";
  };

  outputs = [ "out" ] ++ lib.optional withManual "doc";
@ -311,6 +311,9 @@ stdenv.mkDerivation {
    # Tested to fail: 2.18.0
    disable_test t9902-completion "sourcing the completion script clears cached --options"

+    # Flaky tests:
+    disable_test t5319-multi-pack-index
+
    ${lib.optionalString (!perlSupport) ''
      # request-pull is a Bash script that invokes Perl, so it is not available
      # when NO_PERL=1, and the test should be skipped, but the test suite does
@ -336,7 +339,7 @@ stdenv.mkDerivation {
    homepage = "https://git-scm.com/";
    description = "Distributed version control system";
    license = lib.licenses.gpl2;
-    changelog = "https://raw.githubusercontent.com/git/git/${version}/Documentation/RelNotes/${version}.txt";
+    changelog = "https://github.com/git/git/blob/v${version}/Documentation/RelNotes/${version}.txt";

    longDescription = ''
      Git, a popular distributed version control system designed to
--- a/pkgs/build-support/buildenv/default.nix
+++ b/pkgs/build-support/buildenv/default.nix
@ -74,7 +74,7 @@ runCommand name
    preferLocalBuild = true;
    allowSubstitutes = false;
    # XXX: The size is somewhat arbitrary
-    passAsFile = if builtins.stringLength pkgs >= 128*1024 then [ "pkgs" ] else null;
+    passAsFile = if builtins.stringLength pkgs >= 128*1024 then [ "pkgs" ] else [ ];
  }
  ''
    ${buildPackages.perl}/bin/perl -w ${builder}
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@ -132,12 +132,13 @@ if [ "$NIX_ENFORCE_NO_NATIVE_@suffixSalt@" = 1 ]; then
 fi

 if [[ "$isCpp" = 1 ]]; then
-    if [[ "$cppInclude" = 1 ]]; then
-        NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
-    fi
    NIX_CFLAGS_LINK_@suffixSalt@+=" $NIX_CXXSTDLIB_LINK_@suffixSalt@"
 fi

+if [[ "$cppInclude" = 1 ]]; then
+    NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
+fi
+
 source @out@/nix-support/add-hardening.sh

 # Add the flags for the C compiler proper.
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@ -1,27 +1,12 @@
 { lib, stdenv, stdenvNoCC, lndir, runtimeShell }:

-let
-
-  runCommand' = runLocal: stdenv: name: env: buildCommand:
-    stdenv.mkDerivation ({
-      name = lib.strings.sanitizeDerivationName name;
-      inherit buildCommand;
-      passAsFile = [ "buildCommand" ];
-    }
-    // (lib.optionalAttrs runLocal {
-          preferLocalBuild = true;
-          allowSubstitutes = false;
-       })
-    // env);
-
-in
-
 rec {

  /* Run the shell command `buildCommand' to produce a store path named
  * `name'.  The attributes in `env' are added to the environment
-  * prior to running the command. By default `runCommand' runs using
-  * stdenv with no compiler environment. `runCommandCC`
+  * prior to running the command. By default `runCommand` runs in a
+  * stdenv with no compiler environment. `runCommandCC` uses the default
+  * stdenv, `pkgs.stdenv`.
  *
  * Examples:
  * runCommand "name" {envVariable = true;} ''echo hello > $out''
@ -42,13 +27,64 @@ rec {
  runCommand = runCommandNoCC;
  runCommandLocal = runCommandNoCCLocal;

-  runCommandNoCC = runCommand' false stdenvNoCC;
-  runCommandNoCCLocal = runCommand' true stdenvNoCC;
+  runCommandNoCC = name: env: runCommandWith {
+    stdenv = stdenvNoCC;
+    runLocal = false;
+    inherit name;
+    derivationArgs = env;
+  };
+  runCommandNoCCLocal = name: env: runCommandWith {
+    stdenv = stdenvNoCC;
+    runLocal = true;
+    inherit name;
+    derivationArgs = env;
+  };

-  runCommandCC = runCommand' false stdenv;
+  runCommandCC = name: env: runCommandWith {
+    stdenv = stdenv;
+    runLocal = false;
+    inherit name;
+    derivationArgs = env;
+  };
  # `runCommandCCLocal` left out on purpose.
  # We shouldn’t force the user to have a cc in scope.

+  /* Generalized version of the `runCommand`-variants
+   * which does customized behavior via a single
+   * attribute set passed as the first argument
+   * instead of having a lot of variants like
+   * `runCommand*`. Additionally it allows changing
+   * the used `stdenv` freely and has a more explicit
+   * approach to changing the arguments passed to
+   * `stdenv.mkDerivation`.
+   */
+  runCommandWith =
+    let
+      # prevent infinite recursion for the default stdenv value
+      defaultStdenv = stdenv;
+    in
+    { stdenv ? defaultStdenv
+    # which stdenv to use, defaults to a stdenv with a C compiler, pkgs.stdenv
+    , runLocal ? false
+    # whether to build this derivation locally instead of substituting
+    , derivationArgs ? {}
+    # extra arguments to pass to stdenv.mkDerivation
+    , name
+    # name of the resulting derivation
+    }: buildCommand:
+    stdenv.mkDerivation ({
+      name = lib.strings.sanitizeDerivationName name;
+      inherit buildCommand;
+      passAsFile = [ "buildCommand" ]
+        ++ (derivationArgs.passAsFile or []);
+    }
+    // (lib.optionalAttrs runLocal {
+          preferLocalBuild = true;
+          allowSubstitutes = false;
+       })
+    // builtins.removeAttrs derivationArgs [ "passAsFile" ]);
+
+
  /* Writes a text file to the nix store.
   * The contents of text is added to the file in the store.
   *
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@ -10,13 +10,6 @@
 with lib;

 let
-
-  certdata2pem = fetchurl {
-    name = "certdata2pem.py";
-    url = "https://salsa.debian.org/debian/ca-certificates/raw/debian/20170717/mozilla/certdata2pem.py";
-    sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy";
-  };
-
  version = "3.60";
  underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 in
@ -29,6 +22,15 @@ stdenv.mkDerivation {
    sha256 = "hKvVV1q4dMU65RG9Rh5dCGjRobOE7kB1MVTN0dWQ/j0=";
  };

+  certdata2pem = fetchurl {
+    name = "certdata2pem.py";
+    url = [
+      "https://salsa.debian.org/debian/ca-certificates/raw/debian/20170717/mozilla/certdata2pem.py"
+      "https://git.launchpad.net/ubuntu/+source/ca-certificates/plain/mozilla/certdata2pem.py?id=47e49e1e0a8a1ca74deda27f88fe181191562957"
+    ];
+    sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy";
+  };
+
  outputs = [ "out" "unbundled" ];

  nativeBuildInputs = [ python3 ];
@ -40,7 +42,8 @@ stdenv.mkDerivation {
    ${concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
    EOF

-    cat ${certdata2pem} > certdata2pem.py
+    # copy from the store, otherwise python will scan it for imports
+    cat "$certdata2pem" > certdata2pem.py
  '';

  buildPhase = ''
--- a/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix
@ -29,11 +29,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-maps";
-  version = "3.38.2";
+  version = "3.38.4";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0pa6h3md688752l7cjggncnxv13c07nj584gbz9asdblljk3r9x1";
+    sha256 = "sha256-1WQekf/kePsqqcpIliJczxjsLqTZjjV2UXmBin2+RKM=";
  };

  doCheck = true;
--- a/pkgs/desktops/gnome-3/core/dconf-editor/default.nix
+++ b/pkgs/desktops/gnome-3/core/dconf-editor/default.nix
@ -1,15 +1,13 @@
 { lib, stdenv, fetchurl, meson, ninja, vala, libxslt, pkg-config, glib, gtk3, gnome3, python3, dconf
 , libxml2, gettext, docbook_xsl, wrapGAppsHook, gobject-introspection }:

-let
+stdenv.mkDerivation rec {
  pname = "dconf-editor";
-  version = "3.38.0";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  version = "3.38.2";

  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1d1y33c6fm86xz9xbh3bfz4y2pyas01a58lmirmdx0lh6yd292bd";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "sha256-ElPa2H5iE/vzE/+eydxDWKobECYfKAcsHcDgmXuS+DU=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome-3/core/eog/default.nix
+++ b/pkgs/desktops/gnome-3/core/eog/default.nix
@ -28,11 +28,11 @@

 stdenv.mkDerivation rec {
  pname = "eog";
-  version = "3.38.1";
+  version = "3.38.2";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1xqcfil3b68clafnxg1migp54psqh5x6arnlvdqgmvvpq9hwj7dp";
+    sha256 = "sha256-ilT9+T4wag9khToYgxrIwEg4IEdxBqrgvcAKrDc4bw4=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
@ -1,6 +1,5 @@
 { fetchurl
 , fetchFromGitLab
-, fetchpatch
 , lib, stdenv
 , substituteAll
 , accountsservice
@ -70,11 +69,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-control-center";
-  version = "3.38.1";
+  version = "3.38.4";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "09i011hf23s2i4wim43vjys7y4y43cxl3kyvrnrwqvqgc5n0144d";
+    sha256 = "sha256-SdxjeNTTXBxu1ZIk9WNpFsK2+km7+4tW6xmoTW6QzRk=";
  };

  # See https://mail.gnome.org/archives/distributor-list/2020-September/msg00001.html
@ -151,22 +150,6 @@ stdenv.mkDerivation rec {
      inherit glibc libgnomekbd tzdata;
      inherit cups networkmanagerapplet;
    })
-
-    # Fix double free when leaving user accounts panel.
-    # https://gitlab.gnome.org/GNOME/gnome-control-center/merge_requests/853
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-control-center/commit/e80b4b5f58f448c5a3d38721f7bba32c413d46e7.patch";
-      sha256 = "GffsSU/uNS0Fg2lXbOuD/BrWBT4D2VKgWNGifG0FBUw=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-control-center/commit/64686cfee330849945f6ff4dcc43393eb1a6e59c.patch";
-      sha256 = "4VJU0q6qOtGzd/hmDncckInfEjCkC8+lXmDgxwc4VJU=";
-    })
-    # https://gitlab.gnome.org/GNOME/gnome-control-center/-/issues/1173
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-control-center/-/commit/27e1140c9d4ad852b4dc6a132a14cd5532d52997.patch";
-      sha256 = "nU3szjKfXpRek8hhsxiCJNgMeDeIRK3QVo82D9R+kL4=";
-    })
  ];

  postPatch = ''
--- a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-desktop";
-  version = "3.38.2";
+  version = "3.38.4";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-desktop/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1m7iww1zk845szs9s3zc8a1s1wpd6kizndhq7gqy3575c0xgr2w9";
+    sha256 = "sha256-P2A+pb/UdyLJLPybiFRGtGJg6gnIz7Y/a92f7+NC5Iw=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome-3/core/gnome-disk-utility/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-disk-utility/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-disk-utility";
-  version = "3.38.1";
+  version = "3.38.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-disk-utility/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1TuF3BMDobXOHkIcH1xqwLMY4HzZqVk50uHwlZpe19k=";
+    sha256 = "sha256-EL7d5UlL6zTjoiDW8w2TIMiCUv7rhCa9mM760YNteOk=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
@ -37,11 +37,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-initial-setup";
-  version = "3.38.2";
+  version = "3.38.4";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-qliJJ0+LC23moFErR3Qrgqw0ANrsgt1O/+LuonRko7g=";
+    sha256 = "001jdzsvc541qracn68r609pr5qwymrh85xrqmvzzc1dbg5w3mlg";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@ -65,13 +65,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gnome-shell";
-  version = "3.38.2";
+  version = "3.38.3";

  outputs = [ "out" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "05fm7kxyvws2lbb156wfa2wf4xmkxr49rrjxg0yaxf68v000yq2k";
+    sha256 = "sha256-U0W0GMsSqXKVXOXM6u1mYkgAJzNrXFHa6lcwV1tiHO0=";
  };

  patches = [
--- a/pkgs/desktops/gnome-3/core/mutter/default.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/default.nix
@ -42,13 +42,13 @@

 let self = stdenv.mkDerivation rec {
  pname = "mutter";
-  version = "3.38.2";
+  version = "3.38.3";

  outputs = [ "out" "dev" "man" ];

  src = fetchurl {
    url = "mirror://gnome/sources/mutter/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "03a612m0c7v6y72bs3ghmpyk49177fzq6gdy1jrz4608vnalx5yr";
+    sha256 = "sha256-sjIec9Hj/i6Q5jAfQrugf02UvGR1aivxPXWunW+qIB8=";
  };

  patches = [
--- a/pkgs/desktops/gnome-3/core/simple-scan/default.nix
+++ b/pkgs/desktops/gnome-3/core/simple-scan/default.nix
@ -24,11 +24,11 @@

 stdenv.mkDerivation rec {
  pname = "simple-scan";
-  version = "3.38.1";
+  version = "3.38.2";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0grscz96bwj79ka4qvxh8h75avdx6824k8k38ylmaj6xbl6gi0hy";
+    sha256 = "sha256-qI2AcpaCiIZJzfzfqGkrCjSs3ladwICIjyea/DqcTQs=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome-3/core/yelp-xsl/default.nix
+++ b/pkgs/desktops/gnome-3/core/yelp-xsl/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "yelp-xsl";
-  version = "3.38.1";
+  version = "3.38.3";

  src = fetchurl {
    url = "mirror://gnome/sources/yelp-xsl/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0ryzvkcgxp7xi0icmpdl2rinjn904s8imbxdi6wshzxblqymc8dk";
+    sha256 = "sha256-GTtqvUaXt7Qh6Yw21NMTXaCw/bUapT5gLtNo3YTR/QM=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome-3/core/yelp/default.nix
+++ b/pkgs/desktops/gnome-3/core/yelp/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "yelp";
-  version = "3.38.1";
+  version = "3.38.3";

  src = fetchurl {
    url = "mirror://gnome/sources/yelp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "102z8khj82vdp12c3y86hhxwm1x89xpkpc5zs63c7gg21cbrwdbl";
+    sha256 = "sha256-r9RqTQrrRrtCXFIAcdgY+LKzLmnnVqv9mXlodpphVJ0=";
  };

  nativeBuildInputs = [ pkg-config gettext itstool wrapGAppsHook ];
--- a/pkgs/development/compilers/rust/1_50.nix
+++ b/pkgs/development/compilers/rust/1_50.nix
@ -15,7 +15,7 @@
 , CoreFoundation, Security
 , pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
 , makeRustPlatform
-, llvmPackages_5, llvm_11
+, llvmPackages_11, llvm_11
 } @ args:

 import ./default.nix {
@ -26,7 +26,7 @@ import ./default.nix {
  llvmSharedForHost = pkgsBuildHost.llvm_11.override { enableSharedLibraries = true; };
  llvmSharedForTarget = pkgsBuildTarget.llvm_11.override { enableSharedLibraries = true; };

-  llvmBootstrapForDarwin = llvmPackages_5;
+  llvmBootstrapForDarwin = llvmPackages_11;

  # For use at runtime
  llvmShared = llvm_11.override { enableSharedLibraries = true; };
@ -54,4 +54,4 @@ import ./default.nix {
  ];
 }

-(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_5" "llvm_11"])
+(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvm_11"])
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@ -38,6 +38,8 @@ let

        "0.48" = ./disable-graphviz-0.46.1.patch;

+        "0.50" = ./disable-graphviz-0.46.1.patch;
+
      }.${lib.versions.majorMinor version} or (throw "no graphviz patch for this version of vala");

    disableGraphviz = lib.versionAtLeast version "0.38" && !withGraphviz;
@ -108,8 +110,8 @@ in rec {
  };

  vala_0_40 = generic {
-    version = "0.40.18";
-    sha256 = "1f7cdkjdysg4dcri1wbzdddm46amk2s48jkwb5ghpdvhjb4l5j2m";
+    version = "0.40.25";
+    sha256 = "1pxpack8rrmywlf47v440hc6rv3vi8q9c6niwqnwikxvb2pwf3w7";
  };

  vala_0_44 = generic {
@ -118,13 +120,18 @@ in rec {
  };

  vala_0_46 = generic {
-    version = "0.46.5";
-    sha256 = "07fv895sp9wq74b20qig7hic0r4ynrr5pfaqba02r44xb794fy0s";
+    version = "0.46.13";
+    sha256 = "0d7l4vh2xra3q75kw3sy2d9bn5p6s3g3r7j37bdn6ir8l3wp2ivs";
  };

  vala_0_48 = generic {
-    version = "0.48.9";
-    sha256 = "1agyrvslv2yh9ikiw7k5nw6j6il1l2zrzfan0pzdpb9xpg9idslw";
+    version = "0.48.14";
+    sha256 = "0iz3zzimmk5wxvy5bi75v8ckv153gjrz3r5iqvl8xqackzi7v9fw";
+  };
+
+  vala_0_50 = generic {
+    version = "0.50.4";
+    sha256 = "1353j852h04d1x6b4n6lbg3ay40ph0adb9yi25dh74pligx33z2q";
  };

  vala = vala_0_48;
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -27,7 +27,10 @@
 , sha256
 , passthruFun
 , static ? false
-, enableOptimizations ? (!stdenv.isDarwin)
+, stripBytecode ? reproducibleBuild
+, rebuildBytecode ? true
+, reproducibleBuild ? true
+, enableOptimizations ? false
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:

@ -36,12 +39,26 @@ assert x11Support -> tcl != null
                  && xlibsWrapper != null
                  && libX11 != null;

+assert lib.assertMsg (enableOptimizations -> (!stdenv.cc.isClang))
+  "Optimizations with clang are not supported. configure: error: llvm-profdata is required for a --enable-optimizations build but could not be found.";
+
+assert lib.assertMsg (reproducibleBuild -> stripBytecode)
+  "Deterministic builds require stripping bytecode.";
+
+assert lib.assertMsg (reproducibleBuild -> (!enableOptimizations))
+  "Deterministic builds are not achieved when optimizations are enabled.";
+
+
 with lib;

 let
  buildPackages = pkgsBuildHost;
  inherit (passthru) pythonForBuild;

+  pythonForBuildInterpreter = if stdenv.hostPlatform == stdenv.buildPlatform then
+    "$out/bin/python"
+  else pythonForBuild.interpreter;
+
  passthru = passthruFun rec {
    inherit self sourceVersion packageOverrides;
    implementation = "cpython";
@ -272,14 +289,15 @@ in with passthru; stdenv.mkDerivation ({
        # Determinism: Windows installers were not deterministic.
        # We're also not interested in building Windows installers.
        find "$out" -name 'wininst*.exe' | xargs -r rm -f
-      '' + optionalString (stdenv.hostPlatform == stdenv.buildPlatform)
-      ''
-        # Determinism: rebuild all bytecode
-        # We exclude lib2to3 because that's Python 2 code which fails
-        # We rebuild three times, once for each optimization level
-        find $out -name "*.py" | $out/bin/python -m compileall -q -f -x "lib2to3" -i -
-        find $out -name "*.py" | $out/bin/python -O -m compileall -q -f -x "lib2to3" -i -
-        find $out -name "*.py" | $out/bin/python -OO -m compileall -q -f -x "lib2to3" -i -
+      '' + optionalString stripBytecode ''
+        # Determinism: deterministic bytecode
+        # First we delete all old bytecode.
+        find $out -name "*.pyc" -delete
+        '' + optionalString rebuildBytecode ''
+        # Then, we build for the two optimization levels.
+        # We do not build unoptimized bytecode, because its not entirely deterministic yet.
+        find $out -name "*.py" | ${pythonForBuildInterpreter} -O  -m compileall -q -f -x "lib2to3" -i -
+        find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i -
      '' + optionalString stdenv.hostPlatform.isCygwin ''
        cp libpython2.7.dll.a $out/lib
      '';
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -4,6 +4,7 @@
 , libffi
 , gdbm
 , lzma
+, mime-types ? null, mimetypesSupport ? true
 , ncurses
 , openssl
 , readline
@ -11,6 +12,7 @@
 , tcl ? null, tk ? null, tix ? null, libX11 ? null, xorgproto ? null, x11Support ? false
 , bluez ? null, bluezSupport ? false
 , zlib
+, tzdata ? null
 , self
 , configd
 , autoreconfHook
@ -33,12 +35,11 @@
 , stripTests ? false
 , stripTkinter ? false
 , rebuildBytecode ? true
-, stripBytecode ? false
+, stripBytecode ? reproducibleBuild
 , includeSiteCustomize ? true
 , static ? stdenv.hostPlatform.isStatic
-# Not using optimizations on Darwin
-# configure: error: llvm-profdata is required for a --enable-optimizations build but could not be found.
-, enableOptimizations ? (!stdenv.isDarwin)
+, enableOptimizations ? false
+, reproducibleBuild ? true
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:

@ -54,12 +55,25 @@ assert x11Support -> tcl != null

 assert bluezSupport -> bluez != null;

+assert mimetypesSupport -> mime-types != null;
+
+assert lib.assertMsg (enableOptimizations -> (!stdenv.cc.isClang))
+  "Optimizations with clang are not supported. configure: error: llvm-profdata is required for a --enable-optimizations build but could not be found.";
+
+assert lib.assertMsg (reproducibleBuild -> stripBytecode)
+  "Deterministic builds require stripping bytecode.";
+
+assert lib.assertMsg (reproducibleBuild -> (!enableOptimizations))
+  "Deterministic builds are not achieved when optimizations are enabled.";
+
 with lib;

 let
  buildPackages = pkgsBuildHost;
  inherit (passthru) pythonForBuild;

+  tzdataSupport = tzdata != null && passthru.pythonAtLeast "3.9";
+
  passthru = passthruFun rec {
    inherit self sourceVersion packageOverrides;
    implementation = "cpython";
@ -92,7 +106,8 @@ let
    zlib bzip2 expat lzma libffi gdbm sqlite readline ncurses openssl ]
    ++ optionals x11Support [ tcl tk libX11 xorgproto ]
    ++ optionals (bluezSupport && stdenv.isLinux) [ bluez ]
-    ++ optionals stdenv.isDarwin [ configd ]);
+    ++ optionals stdenv.isDarwin [ configd ])
+    ++ optionals tzdataSupport [ tzdata ];  # `zoneinfo` module

  hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);

@ -175,6 +190,9 @@ in with passthru; stdenv.mkDerivation {
    # (since it will do a futile invocation of gcc (!) to find
    # libuuid, slowing down program startup a lot).
    (./. + "/${sourceVersion.major}.${sourceVersion.minor}/no-ldconfig.patch")
+  ] ++ optionals mimetypesSupport [
+    # Make the mimetypes module refer to the right file
+    ./mimetypes.patch
  ] ++ optionals (isPy35 || isPy36) [
    # Determinism: Write null timestamps when compiling python files.
    ./3.5/force_bytecode_determinism.patch
@ -235,6 +253,9 @@ in with passthru; stdenv.mkDerivation {
  postPatch = ''
    substituteInPlace Lib/subprocess.py \
      --replace "'/bin/sh'" "'${bash}/bin/sh'"
+  '' + optionalString mimetypesSupport ''
+    substituteInPlace Lib/mimetypes.py \
+      --replace "@mime-types@" "${mime-types}"
  '' + optionalString (x11Support && (tix != null)) ''
    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
  '';
@ -285,6 +306,8 @@ in with passthru; stdenv.mkDerivation {
    # Never even try to use lchmod on linux,
    # don't rely on detecting glibc-isms.
    "ac_cv_func_lchmod=no"
+  ] ++ optionals tzdataSupport [
+    "--with-tzpath=${tzdata}/share/zoneinfo"
  ] ++ optional static "LDFLAGS=-static";

  preConfigure = ''
@ -304,7 +327,14 @@ in with passthru; stdenv.mkDerivation {

  setupHook = python-setup-hook sitePackages;

-  postInstall = ''
+  postInstall = let
+    # References *not* to nuke from (sys)config files
+    keep-references = concatMapStringsSep " " (val: "-e ${val}") ([
+      (placeholder "out")
+    ] ++ optionals tzdataSupport [
+      tzdata
+    ]);
+  in ''
    # needed for some packages, especially packages that backport functionality
    # to 2.x from 3.x
    for item in $out/lib/${libPrefix}/test/*; do
@ -340,8 +370,8 @@ in with passthru; stdenv.mkDerivation {
    done

    # Further get rid of references. https://github.com/NixOS/nixpkgs/issues/51668
-    find $out/lib/python*/config-* -type f -print -exec nuke-refs -e $out '{}' +
-    find $out/lib -name '_sysconfigdata*.py*' -print -exec nuke-refs -e $out '{}' +
+    find $out/lib/python*/config-* -type f -print -exec nuke-refs ${keep-references} '{}' +
+    find $out/lib -name '_sysconfigdata*.py*' -print -exec nuke-refs ${keep-references} '{}' +

    # Make the sysconfigdata module accessible on PYTHONPATH
    # This allows build Python to import host Python's sysconfigdata
@ -360,18 +390,19 @@ in with passthru; stdenv.mkDerivation {
    '' + optionalString includeSiteCustomize ''
    # Include a sitecustomize.py file
    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
-    '' + optionalString rebuildBytecode ''

-    # Determinism: rebuild all bytecode
-    # We exclude lib2to3 because that's Python 2 code which fails
-    # We rebuild three times, once for each optimization level
+    '' + optionalString stripBytecode ''
+    # Determinism: deterministic bytecode
+    # First we delete all old bytecode.
+    find $out -type d -name __pycache__ -print0 | xargs -0 -I {} rm -rf "{}"
+    '' + optionalString rebuildBytecode ''
+    # Then, we build for the two optimization levels.
+    # We do not build unoptimized bytecode, because its not entirely deterministic yet.
    # Python 3.7 implements PEP 552, introducing support for deterministic bytecode.
-    # This is automatically used when `SOURCE_DATE_EPOCH` is set.
-    find $out -name "*.py" | ${pythonForBuildInterpreter}     -m compileall -q -f -x "lib2to3" -i -
+    # compileall uses this checked-hash method by default when `SOURCE_DATE_EPOCH` is set.
+    # We exclude lib2to3 because that's Python 2 code which fails
    find $out -name "*.py" | ${pythonForBuildInterpreter} -O  -m compileall -q -f -x "lib2to3" -i -
    find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i -
-    '' + optionalString stripBytecode ''
-    find $out -type d -name __pycache__ -print0 | xargs -0 -I {} rm -rf "{}"
  '';

  preFixup = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
--- a/pkgs/development/interpreters/python/cpython/mimetypes.patch
+++ b/pkgs/development/interpreters/python/cpython/mimetypes.patch
@ -0,0 +1,23 @@
+diff --git i/Lib/mimetypes.py w/Lib/mimetypes.py
+index f3343c8..ab5b886 100644
+--- i/Lib/mimetypes.py
+++ w/Lib/mimetypes.py
+@@ -40,16 +40,8 @@
+ ]
+ 
+ knownfiles = [
+-    "/etc/mime.types",
+-    "/etc/httpd/mime.types",                    # Mac OS X
+-    "/etc/httpd/conf/mime.types",               # Apache
+-    "/etc/apache/mime.types",                   # Apache 1
+-    "/etc/apache2/mime.types",                  # Apache 2
+-    "/usr/local/etc/httpd/conf/mime.types",
+-    "/usr/local/lib/netscape/mime.types",
+-    "/usr/local/etc/httpd/conf/mime.types",     # Apache 1.2
+-    "/usr/local/etc/mime.types",                # Apache 1.3
+-    ]
+    "@mime-types@/etc/mime.types",
+]
+ 
+ inited = False
+ _db = None
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -108,6 +108,19 @@ with pkgs;
          python = self;
        };
  };
+
+  sources = {
+    "python38" = {
+      sourceVersion = {
+        major = "3";
+        minor = "8";
+        patch = "8";
+        suffix = "";
+      };
+      sha256 = "fGZCSf935EPW6g5M8OWH6ukYyjxI0IHRkV/iofG8xcw=";
+    };
+  };
+
 in {

  python27 = callPackage ./cpython/2.7 {
@ -149,18 +162,11 @@ in {
    inherit passthruFun;
  };

-  python38 = callPackage ./cpython {
+  python38 = callPackage ./cpython ({
    self = python38;
-    sourceVersion = {
-      major = "3";
-      minor = "8";
-      patch = "8";
-      suffix = "";
-    };
-    sha256 = "fGZCSf935EPW6g5M8OWH6ukYyjxI0IHRkV/iofG8xcw=";
    inherit (darwin) configd;
    inherit passthruFun;
-  };
+  } // sources.python38);

  python39 = callPackage ./cpython {
    self = python39;
@ -189,8 +195,9 @@ in {
  };

  # Minimal versions of Python (built without optional dependencies)
-  python3Minimal = (python38.override {
+  python3Minimal = (callPackage ./cpython ({
    self = python3Minimal;
+    inherit passthruFun;
    pythonAttr = "python3Minimal";
    # strip down that python version as much as possible
    openssl = null;
@ -199,6 +206,7 @@ in {
    gdbm = null;
    sqlite = null;
    configd = null;
+    tzdata = null;
    stripConfig = true;
    stripIdlelib = true;
    stripTests = true;
@ -207,7 +215,8 @@ in {
    stripBytecode = true;
    includeSiteCustomize = false;
    enableOptimizations = false;
-  }).overrideAttrs(old: {
+    mimetypesSupport = false;
+  } // sources.python38)).overrideAttrs(old: {
    pname = "python3-minimal";
    meta = old.meta // {
      maintainers = [];
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@ -6,11 +6,11 @@
 # files.

 stdenv.mkDerivation rec {
-  name = "acl-2.2.53";
+  name = "acl-2.3.0";

  src = fetchurl {
    url = "mirror://savannah/acl/${name}.tar.gz";
-    sha256 = "1ir6my3w74s6nfbgbqgzj6w570sn0qjf3524zx8xh67lqrjrigh6";
+    sha256 = "sha256-vTj9u7A8eTdK9RRn6+VJfLwDNbgld/MMlRpBqVtTMAk=";
  };

  outputs = [ "bin" "dev" "out" "man" "doc" ];
--- a/pkgs/development/libraries/audio/sratom/default.nix
+++ b/pkgs/development/libraries/audio/sratom/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "sratom";
-  version = "0.6.4";
+  version = "0.6.8";

  src = fetchurl {
    url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "0vh0biy3ngpzzgdml309c2mqz8xq9q0hlblczb4c6alhp0a8yv0l";
+    sha256 = "sha256-Ossysa3Forf6za3i4IGLzWxx8j+EoevBeBW7eg0tAt8=";
  };

  nativeBuildInputs = [ pkg-config wafHook python3 ];
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -45,11 +45,11 @@ in

 stdenv.mkDerivation rec {
  pname = "glib";
-  version = "2.66.4";
+  version = "2.66.8";

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "l9+GcOMvn9T3OSsJgOZh3WJQEgFdWDUNoeWOND9K+YQ=";
+    sha256 = "sha256-l7yH3ZE2VYmvXLv+oldIM66nobcYQP02Xs0oUsdrnIs=";
  };

  patches = optionals stdenv.isDarwin [
--- a/pkgs/development/libraries/glib/schema-override-variable.patch
+++ b/pkgs/development/libraries/glib/schema-override-variable.patch
@ -1,12 +1,14 @@
+diff --git a/gio/gsettingsschema.c b/gio/gsettingsschema.c
+index 1282c10a1..feadfe3aa 100644
 --- a/gio/gsettingsschema.c
 +++ b/gio/gsettingsschema.c
-@@ -352,6 +352,9 @@
+@@ -360,6 +360,9 @@ initialise_schema_sources (void)
 
       try_prepend_data_dir (g_get_user_data_dir ());
 
-+      if ((path = g_getenv ("NIX_GSETTINGS_OVERRIDES_DIR")) != NULL)
+      if (!is_setuid && (path = g_getenv ("NIX_GSETTINGS_OVERRIDES_DIR")) != NULL)
 +        try_prepend_dir (path);
 +
-       if ((path = g_getenv ("GSETTINGS_SCHEMA_DIR")) != NULL)
-         try_prepend_dir (path);
- 
+       /* Disallow loading extra schemas if running as setuid, as that could
+        * allow reading privileged files. */
+       if (!is_setuid && (path = g_getenv ("GSETTINGS_SCHEMA_DIR")) != NULL)
--- a/pkgs/development/libraries/glibc/2.32-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.32-master.patch.gz
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@ -42,7 +42,7 @@

 let
  version = "2.32";
-  patchSuffix = "-37";
+  patchSuffix = "-39";
  sha256 = "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn";
 in

@ -63,7 +63,7 @@ stdenv.mkDerivation ({
         and using git or something would complicate bootstrapping.
         Fortunately it's not too big.
          $ git checkout origin/release/2.32/master; git describe
-          glibc-2.32-37-g760e1d2878
+          glibc-2.32-39-g44b3959329
          $ git show --reverse glibc-2.32.. | gzip -n -9 --rsyncable - > 2.32-master.patch.gz
       */
      ./2.32-master.patch.gz
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@ -1,18 +1,20 @@
-{ lib, stdenv, fetchurl, pkg-config, gnum4, glib, libsigcxx, gnome3, darwin }:
+{ lib, stdenv, fetchurl, pkg-config, gnum4, glib, libsigcxx, gnome3, darwin, meson, ninja }:

 stdenv.mkDerivation rec {
  pname = "glibmm";
-  version = "2.64.2";
+  version = "2.64.5";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1v6lp23fr2qh4zshcnm28sn29j3nzgsvcqj2nhmrnvamipjq4lm7";
+    sha256 = "sha256-UI/IbiyRQRmKoWwiWxb9a5EZF8DTgXYCZShE0Jc+o4Y=";
  };

  outputs = [ "out" "dev" ];

  nativeBuildInputs = [
+    meson
    pkg-config
+    ninja
    gnum4
    glib # for glib-compile-schemas
  ];
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@ -8,7 +8,7 @@

 assert guileBindings -> guile != null;
 let
-  version = "3.6.15";
+  version = "3.7.1";

  # XXX: Gnulib's `test-select' fails on FreeBSD:
  # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
@ -23,8 +23,8 @@ stdenv.mkDerivation {
  inherit version;

  src = fetchurl {
-    url = "mirror://gnupg/gnutls/v3.6/gnutls-${version}.tar.xz";
-    sha256 = "0n0m93ymzd0q9hbknxc2ycanz49sqlkyyf73g9fk7n787llc7a0f";
+    url = "mirror://gnupg/gnutls/v3.7/gnutls-${version}.tar.xz";
+    sha256 = "0vxcbig87sdc73h58pmcpbi4al1zgcxid1jn67mhcpna7sbdfxrp";
  };

  outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@ -45,9 +45,7 @@ stdenv.mkDerivation {
  #  - trust-store: default trust store path (/etc/ssl/...) is missing in sandbox (3.5.11)
  #  - psk-file: no idea; it broke between 3.6.3 and 3.6.4
  # Change p11-kit test to use pkg-config to find p11-kit
-  postPatch = lib.optionalString (lib.versionAtLeast version "3.4") ''
-    sed '2iecho "name constraints tests skipped due to datefudge problems"\nexit 0' -i tests/cert-tests/name-constraints
-  '' + lib.optionalString (lib.versionAtLeast version "3.6") ''
+  postPatch = lib.optionalString (lib.versionAtLeast version "3.6") ''
    sed '2iexit 77' -i tests/{pkgconfig,fastopen}.sh
    sed '/^void doit(void)/,/^{/ s/{/{ exit(77);/' -i tests/{trust-store,psk-file}.c
    sed 's:/usr/lib64/pkcs11/ /usr/lib/pkcs11/ /usr/lib/x86_64-linux-gnu/pkcs11/:`pkg-config --variable=p11_module_path p11-kit-1`:' -i tests/p11-kit-trust.sh
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@ -62,7 +62,7 @@ in

 stdenv.mkDerivation rec {
  pname = "gtk+3";
-  version = "3.24.24";
+  version = "3.24.27";

  outputs = [ "out" "dev" ] ++ lib.optional withGtkDoc "devdoc";
  outputBin = "dev";
@ -74,7 +74,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "12ipk1d376bai9v820qzhxba93kkh5abi6mhyqr4hwjvqmkl77fc";
+    sha256 = "09ksflq5j257bf5zn8q2nnf2flicg9qqgfy7za79z7rkf1shc77p";
  };

  patches = [
@ -188,6 +188,8 @@ stdenv.mkDerivation rec {
    moveToOutput bin/gtk-update-icon-cache "$out"
    # Launcher
    moveToOutput bin/gtk-launch "$out"
+    # Broadway daemon
+    moveToOutput bin/broadwayd "$out"

    # TODO: patch glib directly
    for f in $dev/bin/gtk-encode-symbolic-svg; do
@ -226,7 +228,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = "https://www.gtk.org/";
    license = licenses.lgpl2Plus;
-    maintainers = with maintainers; [ raskin lethalman worldofpeace ];
+    maintainers = with maintainers; [ raskin ] ++ teams.gnome.members;
    platforms = platforms.all;
    changelog = "https://gitlab.gnome.org/GNOME/gtk/-/raw/${version}/NEWS";
  };
--- a/pkgs/development/libraries/gtkmm/3.x.nix
+++ b/pkgs/development/libraries/gtkmm/3.x.nix
@ -1,17 +1,17 @@
-{ lib, stdenv, fetchurl, pkg-config, gtk3, glibmm, cairomm, pangomm, atkmm, epoxy, gnome3 }:
+{ lib, stdenv, fetchurl, pkg-config, meson, ninja, python3, gtk3, glibmm, cairomm, pangomm, atkmm, epoxy, gnome3 }:

 stdenv.mkDerivation rec {
  pname = "gtkmm";
-  version = "3.24.2";
+  version = "3.24.3";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1hxdnhavjyvbcpxhd5z17l9fj4182028s66lc0s16qqqrldhjwbd";
+    sha256 = "sha256-YEl8T381TDvSVXSF8CVPi3tM9L68n+4L4mp3dE6s1DU=";
  };

  outputs = [ "out" "dev" ];

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config meson ninja python3 ];
  buildInputs = [ epoxy ];

  propagatedBuildInputs = [ glibmm gtk3 atkmm cairomm pangomm ];
--- a/pkgs/development/libraries/gupnp/default.nix
+++ b/pkgs/development/libraries/gupnp/default.nix
@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@ -20,36 +19,15 @@

 stdenv.mkDerivation rec {
  pname = "gupnp";
-  version = "1.2.0";
+  version = "1.2.4";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0911lv1bivsyv9wwdxm0i1w4r89j0vyyqp200gsfdnzk6v1a4x7x";
+    sha256 = "sha256-96AwfqUfXkTRuDL0k92QRURKOk4hHvhd/Zql3W6up9E=";
  };

-  patches = [
-    # Nix’s pkg-config ignores Requires.private
-    # https://github.com/NixOS/nixpkgs/commit/1e6622f4d5d500d6e701bd81dd4a22977d10637d
-    # We are essentialy reverting the following patch for now
-    # https://bugzilla.gnome.org/show_bug.cgi?id=685477
-    # at least until Requires.internal or something is implemented
-    # https://gitlab.freedesktop.org/pkg-config/pkg-config/issues/7
-    ./fix-requires.patch
-
-    # fix deadlock in gupnp-igd tests
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gupnp/commit/d208562657f62b34759896ca9e974bd582d1f963.patch";
-      sha256 = "02kzsb4glxhgb1npf6qqgafiki0ws75sly5h470431mihc6sgp4f";
-    })
-    # fix breakage in gupnp-igd tests
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gupnp/commit/0648399acb989473119fe59d0b9f65c923e69483.patch";
-      sha256 = "0ba0rngk3a4n3z4dmq06wzgh0n3q9la1nr25qdxqbwlszmxfxpjf";
-    })
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/development/libraries/gupnp/fix-requires.patch
+++ b/pkgs/development/libraries/gupnp/fix-requires.patch
@ -1,26 +0,0 @@
--- a/libgupnp/meson.build
-+++ b/libgupnp/meson.build
-@@ -110,6 +110,7 @@ pkg.generate(
-     libraries : libgupnp,
-     subdirs: 'gupnp-1.2',
-     name : 'gupnp-1.2',
-+    requires: requires,
-     description : 'GObject-based UPnP library',
-     version : meson.project_version(),
-     filebase : 'gupnp-1.2'
--- a/meson.build
-+++ a/meson.build
-@@ -18,6 +18,13 @@ add_global_arguments('-DHAVE_CONFIG_H=1', language : 'c')
- 
- guul = subproject('guul', default_options : ['default_library=static'])
- 
-+requires = [
-+  dependency('glib-2.0', version : '>= 2.44'),
-+  dependency('gssdp-1.2', version : '>= 1.1'),
-+  dependency('libsoup-2.4', version : '>= 2.48.0'),
-+  dependency('libxml-2.0')
-+]
-+
- dependencies = [
-     dependency('glib-2.0', version : '>= 2.44'),
-     dependency('gio-2.0', version : '>= 2.44'),
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@ -11,7 +11,7 @@
 }:

 let
-  version = "2.7.4";
+  version = "2.8.0";
  inherit (lib) optional optionals optionalString;
  mesonFeatureFlag = opt: b:
    "-D${opt}=${if b then "enabled" else "disabled"}";
@ -24,7 +24,7 @@ stdenv.mkDerivation {
    owner  = "harfbuzz";
    repo   = "harfbuzz";
    rev    = version;
-    sha256 = "sha256-uMkniDNBQ2mxDmeM7K/YQtZ3Avh9RVXYe7XsUErGas8=";
+    sha256 = "sha256-JnvOFGK2HWIpzuwgZtyt0IfKfnoXD1LMeVb3RzMmyY4=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/iso-codes/default.nix
+++ b/pkgs/development/libraries/iso-codes/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "iso-codes";
-  version = "4.5.0";
+  version = "4.6.0";

  src = fetchurl {
    url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/${pname}-${version}/${pname}-${pname}-${version}.tar.bz2";
-    sha256 = "17nnyx07q8vbyqsxbvp4m5s2nrc4fxl3dvgbgmkqww2wl4x1fv9y";
+    sha256 = "sha256-Ivd5538QpTFXP2r6ca/g12IZ0ZW1nduu0z4kiSb9Mxs=";
  };

  patchPhase = ''
--- a/pkgs/development/libraries/libipt/default.nix
+++ b/pkgs/development/libraries/libipt/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libipt";
-  version = "2.0.3";
+  version = "2.0.4";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "libipt";
    rev = "v${version}";
-    sha256 = "1i6jmv345rqd88qmap6iqbaph4pkd6wbjgkixf22a80pj7cfm1s4";
+    sha256 = "sha256-KhRmRoIHvpx5rV7roCnUH+a7JtPb6UqD41Wi4wHSR1c=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/libmpc/default.nix
+++ b/pkgs/development/libraries/libmpc/default.nix
@ -8,7 +8,7 @@
 # files.

 let
-  version = "1.2.0";
+  version = "1.2.1";
 in
 stdenv.mkDerivation {
  pname = "libmpc";
@ -16,7 +16,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "mirror://gnu/mpc/mpc-${version}.tar.gz";
-    sha256 = "19pxx3gwhwl588v496g3aylhcw91z1dk1d5x3a8ik71sancjs3z9";
+    sha256 = "0n846hqfqvmsmim7qdlms0qr86f1hck19p12nq3g3z2x74n3sl0p";
  };

  buildInputs = [ gmp mpfr ];
--- a/pkgs/development/libraries/libxkbcommon/default.nix
+++ b/pkgs/development/libraries/libxkbcommon/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "libxkbcommon";
-  version = "1.0.3";
+  version = "1.1.0";

  src = fetchurl {
    url = "https://xkbcommon.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0lmwglj16anhpaq0h830xsl1ivknv75i4lir9bk88aq73s2jy852";
+    sha256 = "0in2fq2x4yhyjmcn9n5n43zsawsdh12d4sm6l57934kgb75gqb21";
  };

  patches = [
--- a/pkgs/development/libraries/nettle/default.nix
+++ b/pkgs/development/libraries/nettle/default.nix
@ -1,10 +1,10 @@
-{ callPackage, fetchurl, ... } @ args:
+{ callPackage, fetchurl }:

-callPackage ./generic.nix (args // rec {
-  version = "3.6";
+callPackage ./generic.nix rec {
+  version = "3.7.2";

  src = fetchurl {
    url = "mirror://gnu/nettle/nettle-${version}.tar.gz";
-    sha256 = "1wg3sprl0bzy49cmbwwm91vw67hk1x5i3ksdygsciyxz587hsk6j";
+    sha256 = "0qpi1qp3bcvqdsaxy2pzg530db95x8qjahkynxgwvr6dy5760ald";
  };
-})
+}
--- a/pkgs/development/libraries/nettle/generic.nix
+++ b/pkgs/development/libraries/nettle/generic.nix
@ -2,9 +2,9 @@

 # Version specific args
 , version, src
-, ...}:
+}:

-stdenv.mkDerivation ({
+stdenv.mkDerivation {
  name = "nettle-${version}";

  inherit src;
@ -16,7 +16,14 @@ stdenv.mkDerivation ({
  nativeBuildInputs = [ gnum4 ];
  propagatedBuildInputs = [ gmp ];

-  configureFlags = [ "--enable-fat" ]; # runtime selection of HW-accelerated code
+  configureFlags =
+    # runtime selection of HW-accelerated code; it's default since 3.7
+    [ "--enable-fat" ]
+    # Make sure the right <gmp.h> is found, and not the incompatible
+    # /usr/include/mp.h from OpenSolaris.  See
+    # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
+    # for details.
+    ++ lib.optional stdenv.isSunOS "--with-include-path=${gmp.dev}/include";

  doCheck = (stdenv.hostPlatform.system != "i686-cygwin" && !stdenv.isDarwin);

@ -53,18 +60,9 @@ stdenv.mkDerivation ({

     license = licenses.gpl2Plus;

-     homepage = "http://www.lysator.liu.se/~nisse/nettle/";
+     homepage = "https://www.lysator.liu.se/~nisse/nettle/";

     platforms = platforms.all;
+     maintainers = [ maintainers.vcunat ];
  };
 }
-
-//
-
-lib.optionalAttrs stdenv.isSunOS {
-  # Make sure the right <gmp.h> is found, and not the incompatible
-  # /usr/include/mp.h from OpenSolaris.  See
-  # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
-  # for details.
-  configureFlags = [ "--with-include-path=${gmp.dev}/include" ];
-})
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "openldap";
-  version = "2.4.57";
+  version = "2.4.58";

  src = fetchurl {
    url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${pname}-${version}.tgz";
-    sha256 = "sha256-x7pH4ebstbQ289Qygd9Xq+/6mSYhQa7IImKLwiD2tFo=";
+    sha256 = "sha256-V7WSVL4V0L9qmrPVFMHAV3ewISMpFTMTSofJRGj49Hs=";
  };

  # TODO: separate "out" and "bin"
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -3,8 +3,17 @@
 , enableSSL2 ? false
 , enableSSL3 ? false
 , static ? stdenv.hostPlatform.isStatic
+# Used to avoid cross compiling perl, for example, in darwin bootstrap tools.
+# This will cause c_rehash to refer to perl via the environment, but otherwise
+# will produce a perfectly functional openssl binary and library.
+, withPerl ? true
 }:

+assert (
+  lib.assertMsg (!withPerl -> stdenv.hostPlatform != stdenv.buildPlatform)
+  "withPerl should not be disabled unless cross compiling"
+);
+
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
 # cgit) that are needed here should be included directly in Nixpkgs as
@ -46,7 +55,10 @@ let
    separateDebugInfo = !(stdenv.hostPlatform.useLLVM or false) && stdenv.cc.isGNU;

    nativeBuildInputs = [ perl ];
-    buildInputs = lib.optional withCryptodev cryptodev;
+    buildInputs = lib.optional withCryptodev cryptodev
+      # perl is included to allow the interpreter path fixup hook to set the
+      # correct interpreter in c_rehash.
+      ++ lib.optional withPerl perl;

    # TODO(@Ericson2314): Improve with mass rebuild
    configurePlatforms = [];
@ -108,12 +120,20 @@ let
          rm "$out/lib/"*.a
      fi

-    '' +
-    ''
      mkdir -p $bin
    '' + lib.optionalString (!stdenv.hostPlatform.isWindows)
+      # Fix bin/c_rehash's perl interpreter line
+      #
+      # - openssl 1_0_2: embeds a reference to buildPackages.perl
+      # - openssl 1_1:   emits "#!/usr/bin/env perl"
+      #
+      # In the case of openssl_1_0_2, reset the invalid reference and let the
+      # interpreter hook take care of it.
+      #
+      # In both cases, if withPerl = false, the intepreter line is expected be
+      # "#!/usr/bin/env perl"
    ''
-      substituteInPlace $out/bin/c_rehash --replace ${buildPackages.perl} ${perl}
+      substituteInPlace $out/bin/c_rehash --replace ${buildPackages.perl}/bin/perl "/usr/bin/env perl"
    '' +
    ''
      mv $out/bin $bin/
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@ -1,57 +1,91 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, cairo, harfbuzz
-, libintl, libthai, gobject-introspection, darwin, fribidi, gnome3
-, gtk-doc, docbook_xsl, docbook_xml_dtd_43, makeFontsConf, freefont_ttf
-, meson, ninja, glib
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, pkg-config
+, cairo
+, harfbuzz
+, libintl
+, libthai
+, gobject-introspection
+, darwin
+, fribidi
+, gnome3
+, gi-docgen
+, makeFontsConf
+, freefont_ttf
+, meson
+, ninja
+, glib
 , x11Support? !stdenv.isDarwin, libXft
 }:

-with lib;
-
-let
+stdenv.mkDerivation rec {
  pname = "pango";
-  version = "1.47.0";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  version = "1.48.3";
+
+  outputs = [ "bin" "out" "dev" "devdoc" ];

  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0ry3j9n0lvdfmjwi2w7wa4gkalnip56kghqq6bh8hcf45xjvh3bk";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0ijbkcs6217ygzphlpi0vajxkccifdbsl0jdjpy8wz11h9f19sin";
  };

-  # FIXME: docs fail on darwin
-  outputs = [ "bin" "dev" "out" ] ++ optional (!stdenv.isDarwin) "devdoc";
+  patches = [
+    # Install developer documentation.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/pango/commit/a2f35860115e8cd44f07d5158e2df059e8163a08.patch";
+      sha256 = "hN7O4DBk4A+TmBl6DGx6RHni5qRBg6akdjv9o3iWKDQ=";
+    })
+  ];

  nativeBuildInputs = [
    meson ninja
    glib # for glib-mkenum
-    pkg-config gobject-introspection gtk-doc docbook_xsl docbook_xml_dtd_43
+    pkg-config
+    gobject-introspection
+    gi-docgen
  ];
+
  buildInputs = [
    fribidi
    libthai
-  ] ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
    ApplicationServices
    Carbon
    CoreGraphics
    CoreText
  ]);
-  propagatedBuildInputs = [ cairo glib libintl harfbuzz ] ++
-    optional x11Support libXft;

-  mesonFlags = [
-    "-Dgtk_doc=${if stdenv.isDarwin then "false" else "true"}"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-Dxft=disabled"  # only works with x11
+  propagatedBuildInputs = [
+    cairo
+    glib
+    libintl
+    harfbuzz
+  ] ++ lib.optionals x11Support [
+    libXft
  ];

-  enableParallelBuilding = true;
+  mesonFlags = [
+    "-Dgtk_doc=true"
+  ] ++ lib.optionals (!x11Support) [
+    "-Dxft=disabled" # only works with x11
+  ];

  # Fontconfig error: Cannot load default config file
  FONTCONFIG_FILE = makeFontsConf {
    fontDirectories = [ freefont_ttf ];
  };

-  doCheck = false; # /layout/valid-1.markup: FAIL
+  doCheck = false; # test-font: FAIL
+
+  postInstall = ''
+    # So that devhelp can find this.
+    # https://gitlab.gnome.org/GNOME/pango/merge_requests/293/diffs#note_1058448
+    mkdir -p "$devdoc/share/devhelp"
+    mv "$out/share/doc/pango/reference" "$devdoc/share/devhelp/books"
+    rmdir -p --ignore-fail-on-non-empty "$out/share/doc/pango"
+  '';

  passthru = {
    updateScript = gnome3.updateScript {
@ -73,7 +107,7 @@ in stdenv.mkDerivation rec {
    homepage = "https://www.pango.org/";
    license = licenses.lgpl2Plus;

-    maintainers = with maintainers; [ raskin ];
+    maintainers = with maintainers; [ raskin ] ++ teams.gnome.members;
    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/development/libraries/pangomm/default.nix
+++ b/pkgs/development/libraries/pangomm/default.nix
@ -1,18 +1,18 @@
-{ lib, stdenv, fetchurl, pkg-config, pango, glibmm, cairomm, gnome3
+{ lib, stdenv, fetchurl, pkg-config, meson, ninja, python3, pango, glibmm, cairomm, gnome3
 , ApplicationServices }:

 stdenv.mkDerivation rec {
  pname = "pangomm";
-  version= "2.42.1";
+  version= "2.42.2";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "03zli5amizhv9bfklwfq7xyf0b5dagchx1lnz9f0v1rhk69h9gql";
+    sha256 = "sha256-GyTJJiSuEnXMtXdYF10198Oa0zQtjAtLpg8NmEnS0Io=";
  };

  outputs = [ "out" "dev" ];

-  nativeBuildInputs = [ pkg-config ] ++ lib.optional stdenv.isDarwin [
+  nativeBuildInputs = [ pkg-config meson ninja python3 ] ++ lib.optional stdenv.isDarwin [
    ApplicationServices
  ];
  propagatedBuildInputs = [ pango glibmm cairomm ];
--- a/pkgs/development/libraries/pmix/default.nix
+++ b/pkgs/development/libraries/pmix/default.nix
@ -3,7 +3,7 @@
 } :

 let
-  version = "3.2.2";
+  version = "3.2.3";

 in stdenv.mkDerivation {
  pname = "pmix";
@ -13,7 +13,7 @@ in stdenv.mkDerivation {
    repo = "openpmix";
    owner = "openpmix";
    rev = "v${version}";
-    sha256 = "1rf82z7h76366qknkmralmslsfmihv0r3ymhbgk1axq97ic3g4d7";
+    sha256 = "sha256-w3j4zgEAn6RxIHAvy0B3MPFTV46ocCvc0Z36tN1T+rc=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/popt/default.nix
+++ b/pkgs/development/libraries/popt/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "popt";
-  version = "1.16";
+  version = "1.18";

  src = fetchurl {
    url = "mirror://debian/pool/main/p/popt/popt_${version}.orig.tar.gz";
-    sha256 = "1j2c61nn2n351nhj4d25mnf3vpiddcykq005w2h6kw79dwlysa77";
+    sha256 = "1lf5zlj5rbg6s4bww7hbhpca97prgprnarx978vcwa0bl81vqnai";
  };

  patches = lib.optionals stdenv.isCygwin [
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@ -42,6 +42,14 @@ let
      USE_OPENMP = true;
    };

+    aarch64-darwin = {
+      BINARY = 64;
+      TARGET = setTarget "VORTEX";
+      DYNAMIC_ARCH = true;
+      USE_OPENMP = false;
+      MACOSX_DEPLOYMENT_TARGET = "11.0";
+    };
+
    aarch64-linux = {
      BINARY = 64;
      TARGET = setTarget "ARMV8";
--- a/pkgs/development/libraries/science/math/suitesparse/default.nix
+++ b/pkgs/development/libraries/science/math/suitesparse/default.nix
@ -12,7 +12,7 @@

 stdenv.mkDerivation rec {
  pname = "suitesparse";
-  version = "5.8.1";
+  version = "5.9.0";

  outputs = [ "out" "dev" "doc" ];

@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
    owner = "DrTimothyAldenDavis";
    repo = "SuiteSparse";
    rev = "v${version}";
-    sha256 = "0qjlyfxs8s48rs63c2fzspisgq1kk4bwkgnhmh125hgkdhrq2w1c";
+    sha256 = "sha256-tvwpSVgZrfYZHXHN8OQF0Y/aJM03JHGPFok7hUqPE/4=";
  };

  nativeBuildInputs = [
@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
    "CUBLAS_LIB=${cudatoolkit}/lib/libcublas.so"
  ] ++ lib.optionals stdenv.isDarwin [
    # Unless these are set, the build will attempt to use `Accelerate` on darwin, see:
-    # https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/v5.8.1/SuiteSparse_config/SuiteSparse_config.mk#L368
+    # https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/v5.9.0/SuiteSparse_config/SuiteSparse_config.mk#L368
    "BLAS=-lblas"
    "LAPACK=-llapack"
  ]
--- a/pkgs/development/libraries/serd/default.nix
+++ b/pkgs/development/libraries/serd/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "serd";
-  version = "0.30.4";
+  version = "0.30.10";

  src = fetchurl {
    url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "168rn3m32c59qbar120f83ibcnnd987ij9p053kybgl7cmm6358c";
+    sha256 = "sha256-r/qA3ux4kh+GM15vw/GLgK7+z0JPaldV6fL6DrBxDt8=";
  };

  nativeBuildInputs = [ pkg-config python3 wafHook ];
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@ -12,12 +12,12 @@ in

 stdenv.mkDerivation rec {
  pname = "sqlite";
-  version = "3.34.1";
+  version = "3.35.2";

  # NB! Make sure to update ./tools.nix src (in the same directory).
  src = fetchurl {
    url = "https://sqlite.org/2021/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "129ynp0qbxrfj1ys9hdi0jk8svds0cwfzl31af7bicqp25cclfra";
+    sha256 = "1bfczv5006ycwr1vw7xbq7cmys0jvfr8awmx7wi1b40zyj0yss8j";
  };

  outputs = [ "bin" "dev" "out" ];
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@ -4,11 +4,11 @@ let
  archiveVersion = import ./archive-version.nix lib;
  mkTool = { pname, makeTarget, description, homepage }: stdenv.mkDerivation rec {
    inherit pname;
-    version = "3.34.1";
+    version = "3.35.2";

    src = assert version == sqlite.version; fetchurl {
      url = "https://sqlite.org/2021/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "0jgzaawf6vn15qyi15b6dlq80sk2gaiwfikingldx5mhjrwj7pfx";
+      sha256 = "00w7qggrdxpcrs4rfpqkjhcghi8pcx6zzjim9wlz6vsrxlr9dwva";
    };

    nativeBuildInputs = [ unzip ];
--- a/pkgs/development/libraries/tracker-miners/default.nix
+++ b/pkgs/development/libraries/tracker-miners/default.nix
@ -48,11 +48,11 @@

 stdenv.mkDerivation rec {
  pname = "tracker-miners";
-  version = "3.0.1";
+  version = "3.0.4";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1kfi5d6pccqx28hbnja6k1mpwjd53k5zs704sg01rlzmbshz1zn6";
+    sha256 = "sha256-E877xx1S93RvPTfQQdjFvBM2pA/13ZK1Nw6GUMJqiY4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchurl
-, fetchpatch
 , gettext
 , meson
 , ninja
@ -30,13 +29,13 @@

 stdenv.mkDerivation rec {
  pname = "tracker";
-  version = "3.0.1";
+  version = "3.0.3";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1rhcs75axga7p7hl37h6jzb2az89jddlcwc7ykrnb2khyhka78rr";
+    sha256 = "sha256-b1yEqzvh7aUgUBsq7XIhYWoM8VKRDFN3V7U4vAXv/KM=";
  };

  patches = [
@ -44,13 +43,6 @@ stdenv.mkDerivation rec {
      src = ./fix-paths.patch;
      inherit asciidoc;
    })
-
-    # Fix consistency error with sqlite 3.34
-    # https://gitlab.gnome.org/GNOME/tracker/merge_requests/353
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/tracker/commit/040e22d005985a19a0dc435a7631f91700804ce4.patch";
-      sha256 = "5OZj17XY8ZnXfMMim25HvGfFKUlsVlVHOUjZKfBKHcs=";
-    })
  ];

  nativeBuildInputs = [
--- a/pkgs/development/libraries/unixODBC/default.nix
+++ b/pkgs/development/libraries/unixODBC/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "unixODBC";
-  version = "2.3.7";
+  version = "2.3.9";

  src = fetchurl {
    url = "ftp://ftp.unixodbc.org/pub/unixODBC/${pname}-${version}.tar.gz";
-    sha256 = "0xry3sg497wly8f7715a7gwkn2k36bcap0mvzjw74jj53yx6kwa5";
+    sha256 = "sha256-UoM+rD1oHIsMmlpl8uvXRbOpZPII/HSPl35EAVoxsgc=";
  };

  configureFlags = [ "--disable-gui" "--sysconfdir=/etc" ];
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "vte";
-  version = "0.62.1";
+  version = "0.62.2";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "139had0zcggzrxx9rjy0a67mahzm474amafh168y11421iyfhsf3";
+    sha256 = "sha256-sDALvPDALfWBKhCjy45P/3I7q5LAjJegqQwWfPVDr/A=";
  };

  passthru = {
--- a/pkgs/development/libraries/xapian/default.nix
+++ b/pkgs/development/libraries/xapian/default.nix
@ -38,5 +38,5 @@ let
    };
  };
 in {
-  xapian_1_4 = generic "1.4.17" "0bjpaavdckl4viznr8gbq476fvg648sj4rks2vacmc51vrb8bsxm";
+  xapian_1_4 = generic "1.4.18" "sha256-GW3btK0QRQEA8JkaWZ5O2UTLrZLkpv6BO+bc4WAkS3c=";
 }
--- a/pkgs/development/python-modules/ansible-lint/default.nix
+++ b/pkgs/development/python-modules/ansible-lint/default.nix
@ -4,52 +4,71 @@
 , isPy27
 , ansible
 , pyyaml
-, setuptools_scm
-, ruamel_yaml
+, ruamel-yaml
 , rich
 , pytestCheckHook
-, pytestcov
-, pytest_xdist
+, pytest-xdist
 , git
+, wcmatch
+, enrich
+, python
 }:

 buildPythonPackage rec {
  pname = "ansible-lint";
-  version = "4.3.7";
-  # pip is not able to import version info on raumel.yaml
+  version = "5.0.2";
  disabled = isPy27;
+  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0kwwv9dv9rgsqvp15r2vma7hii9lkkqn0n2irvp5h32cbhzzq4hh";
+    sha256 = "sha256-vgt/KqNozTPaON/I19SybBZuo7bbl3Duq5dTBTMlj44=";
  };

-  format = "pyproject";
-
-  nativeBuildInputs = [ setuptools_scm ];
-  propagatedBuildInputs = [ pyyaml ansible ruamel_yaml rich ];
-  checkInputs = [ pytestCheckHook pytestcov pytest_xdist git ];
-
  postPatch = ''
-    patchShebangs bin/ansible-lint
-    substituteInPlace setup.cfg \
-      --replace "setuptools_scm_git_archive>=1.0" ""
+    substituteInPlace src/ansiblelint/file_utils.py \
+      --replace 'raise RuntimeError("Unable to determine file type for %s" % pathex)' 'return "playbook"'
  '';

-  # give a hint to setuptools_scm on package version
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="v${version}"
+  buildInputs = [ python ];
+
+  propagatedBuildInputs = [ ansible enrich pyyaml rich ruamel-yaml wcmatch ];
+
+  checkInputs = [ pytestCheckHook pytest-xdist git ];
+
+  preCheck = ''
+    # ansible wants to write to $HOME and crashes if it can't
    export HOME=$(mktemp -d)
+    export PATH=$PATH:${lib.makeBinPath [ ansible ]}
+
+    # create a working ansible-lint executable
+    export PATH=$PATH:$PWD/src/ansiblelint
+    ln -rs src/ansiblelint/__main__.py src/ansiblelint/ansible-lint
+    patchShebangs src/ansiblelint/__main__.py
  '';

-  checkPhase = ''
-    pytest -W ignore::DeprecationWarning -k 'not test_run_playbook_github and not test_run_single_role_path_no_trailing_slash_script'
-  '';
+  disabledTests = [
+    # requires network
+    "test_prerun_reqs_v1"
+    "test_prerun_reqs_v2"
+    # Assertion error with negative numbers; maybe requieres an ansible update?
+    "test_negative"
+    "test_example"
+    "test_playbook"
+    "test_included_tasks"
+    "test_long_line"
+
+    "test_get_yaml_files_umlaut"
+    "test_run_inside_role_dir"
+    "test_role_handler_positive"
+  ];
+
+  makeWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ ansible ]}" ];

  meta = with lib; {
-    homepage = "https://github.com/ansible/ansible-lint";
+    homepage = "https://github.com/ansible-community/ansible-lint";
    description = "Best practices checker for Ansible";
    license = licenses.mit;
-    maintainers = [ maintainers.sengaya ];
+    maintainers = with maintainers; [ sengaya SuperSandro2000 ];
  };
 }
--- a/pkgs/development/python-modules/bracex/default.nix
+++ b/pkgs/development/python-modules/bracex/default.nix
@ -0,0 +1,22 @@
+{ lib, buildPythonPackage, fetchPypi, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "bracex";
+  version = "2.1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-AfcVzQ7XpiLsizIyLnFYE/dXTeUx8Jtw9vOywQ9oJCU=";
+  };
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "bracex" ];
+
+  meta = with lib; {
+    description = "Bash style brace expansion for Python";
+    homepage = "https://github.com/facelessuser/bracex";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
--- a/pkgs/development/python-modules/cachetools/default.nix
+++ b/pkgs/development/python-modules/cachetools/default.nix
@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, isPy27
 , fetchFromGitHub
 , pytestCheckHook
 }:
@ -8,6 +9,8 @@ buildPythonPackage rec {
  pname = "cachetools";
  version = "4.2.1";

+  disabled = isPy27;
+
  src = fetchFromGitHub {
    owner = "tkem";
    repo = pname;
--- a/pkgs/development/python-modules/dateparser/default.nix
+++ b/pkgs/development/python-modules/dateparser/default.nix
@ -1,61 +1,55 @@
-{ lib, fetchPypi, buildPythonPackage
-, nose
-, parameterized
-, mock
-, flake8
-, glibcLocales
-, six
-, jdatetime
-, dateutil
-, umalqurra
-, pytz
-, tzlocal
-, regex
-, ruamel_yaml
-, python
+{ lib
+, buildPythonPackage
 , isPy3k
+, fetchFromGitHub
+, dateutil
+, pytz
+, regex
+, tzlocal
+, hijri-converter
+, convertdate
+, parameterized
+, pytestCheckHook
+, GitPython
+, ruamel_yaml
 }:

 buildPythonPackage rec {
  pname = "dateparser";
  version = "1.0.0";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "159cc4e01a593706a15cd4e269a0b3345edf3aef8bf9278a57dac8adf5bf1e4a";
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "scrapinghub";
+    repo = "dateparser";
+    rev = "v${version}";
+    sha256 = "0i6ci14lqfsqrmaif57dyilrjbxzmbl98hps1b565gkiy1xqmjhl";
  };

-  checkInputs = [
-    flake8
-    nose
-    mock
-    parameterized
-    six
-    glibcLocales
-  ];
-  preCheck =''
-    # skip because of missing convertdate module, which is an extra requirement
-    rm tests/test_jalali.py
-  '';
-
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests
-  '';
-
-  # Strange
-  # AttributeError: 'module' object has no attribute 'config'
-  doCheck = false;
-
  propagatedBuildInputs = [
    # install_requires
    dateutil pytz regex tzlocal
    # extra_requires
-    jdatetime ruamel_yaml umalqurra
+    hijri-converter convertdate
  ];

+  checkInputs = [
+    parameterized
+    pytestCheckHook
+    GitPython
+    ruamel_yaml
+  ];
+
+  # Upstream only runs the tests in tests/ in CI, others use git clone
+  pytestFlagsArray = [ "tests" ];
+
+  pythonImportsCheck = [ "dateparser" ];
+
  meta = with lib; {
    description = "Date parsing library designed to parse dates from HTML pages";
    homepage = "https://github.com/scrapinghub/dateparser";
    license = licenses.bsd3;
+    maintainers = with maintainers; [ dotlambda ];
  };
 }
--- a/pkgs/development/python-modules/dateutil/default.nix
+++ b/pkgs/development/python-modules/dateutil/default.nix
@ -1,4 +1,10 @@
-{ lib, buildPythonPackage, fetchPypi, six, setuptools_scm, pytest }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, six
+}:
+
 buildPythonPackage rec {
  pname = "python-dateutil";
  version = "2.8.1";
@ -8,19 +14,27 @@ buildPythonPackage rec {
    sha256 = "73ebfe9dbf22e832286dafa60473e4cd239f8592f699aa5adaf10050e6e1823c";
  };

-  checkInputs = [ pytest ];
-  propagatedBuildInputs = [ six setuptools_scm ];
+  nativeBuildInputs = [ setuptools-scm ];

-  checkPhase = ''
-    py.test dateutil/test
-  '';
+  propagatedBuildInputs = [ six ];

-  # Requires fixing
+  # cyclic dependency: tests need freezegun, which depends on python-dateutil
  doCheck = false;

+  pythonImportsCheck = [
+    "dateutil.easter"
+    "dateutil.parser"
+    "dateutil.relativedelta"
+    "dateutil.rrule"
+    "dateutil.tz"
+    "dateutil.utils"
+    "dateutil.zoneinfo"
+  ];
+
  meta = with lib; {
    description = "Powerful extensions to the standard datetime module";
-    homepage = "https://pypi.python.org/pypi/python-dateutil";
-    license = "BSD-style";
+    homepage = "https://github.com/dateutil/dateutil/";
+    license = with licenses; [ asl20 bsd3 ];
+    maintainers = with maintainers; [ dotlambda ];
  };
 }
--- a/pkgs/development/python-modules/drf-yasg/default.nix
+++ b/pkgs/development/python-modules/drf-yasg/default.nix
@ -1,13 +1,15 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  inflection,
-  ruamel_yaml,
-  setuptools_scm,
-  six,
-  coreapi,
-  djangorestframework,
+{ lib
+, buildPythonPackage
+, fetchPypi
+, inflection
+, ruamel_yaml
+, setuptools_scm
+, six
+, coreapi
+, djangorestframework
+, pytestCheckHook
+, pytest-django
+, datadiff
 }:

 buildPythonPackage rec {
@ -19,6 +21,11 @@ buildPythonPackage rec {
    sha256 = "d50f197c7f02545d0b736df88c6d5cf874f8fea2507ad85ad7de6ae5bf2d9e5a";
  };

+  postPatch = ''
+    # https://github.com/axnsan12/drf-yasg/pull/710
+    substituteInPlace requirements/base.txt --replace packaging ""
+  '';
+
  nativeBuildInputs = [
    setuptools_scm
  ];
@ -31,6 +38,17 @@ buildPythonPackage rec {
    djangorestframework
  ];

+  checkInputs = [
+    pytestCheckHook
+    pytest-django
+    datadiff
+  ];
+
+  # ImportError: No module named 'testproj.settings'
+  doCheck = false;
+
+  pythonImportsCheck = [ "drf_yasg" ];
+
  meta = with lib; {
    description = "Generation of Swagger/OpenAPI schemas for Django REST Framework";
    homepage = "https://github.com/axnsan12/drf-yasg";
--- a/pkgs/development/python-modules/enrich/default.nix
+++ b/pkgs/development/python-modules/enrich/default.nix
@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi, pytestCheckHook, setuptools-scm, rich, pytest-mock }:
+
+buildPythonPackage rec {
+  pname = "enrich";
+  version = "1.2.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-Dpn/V9h/e13vDKeZF+iPuTUaoNUuIo7ji/982FgxX+Q=";
+  };
+
+  buildInputs = [ setuptools-scm ];
+
+  propagatedBuildInputs = [ rich ];
+
+  checkInputs = [ pytestCheckHook pytest-mock ];
+
+  pythonImportsCheck = [ "enrich" ];
+
+  meta = with lib; {
+    description = "Enrich adds few missing features to the wonderful rich library";
+    homepage = "https://github.com/pycontribs/enrich";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
--- a/pkgs/development/python-modules/google-auth/default.nix
+++ b/pkgs/development/python-modules/google-auth/default.nix
@ -13,6 +13,7 @@
 , responses
 , rsa
 , six
+, pyopenssl
 }:

 buildPythonPackage rec {
@ -24,7 +25,13 @@ buildPythonPackage rec {
    sha256 = "0bmdqkyv8k8n6s8dss4zpbcq1cdxwicpb42kwybd02ia85mh43hb";
  };

-  propagatedBuildInputs = [ pyasn1-modules cachetools rsa six ];
+  propagatedBuildInputs = [
+    cachetools
+    pyasn1-modules
+    rsa
+    six
+    pyopenssl
+  ];

  checkInputs = [
    flask
--- a/pkgs/development/python-modules/graphite-web/default.nix
+++ b/pkgs/development/python-modules/graphite-web/default.nix
@ -1,6 +1,19 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k
-, django, django_tagging, whisper, pycairo, cairocffi, ldap, memcached, pytz, urllib3, scandir
+{ lib, buildPythonPackage, fetchPypi
+, django
+, memcached
+, txamqp
+, django_tagging
+, gunicorn
+, pytz
+, pyparsing
+, cairocffi
+, whisper
+, whitenoise
+, scandir
+, urllib3
+, six
 }:
+
 buildPythonPackage rec {
  pname = "graphite-web";
  version = "1.1.7";
@ -15,8 +28,19 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
-    django django_tagging whisper pycairo cairocffi
-    ldap memcached pytz urllib3 scandir
+    django
+    memcached
+    txamqp
+    django_tagging
+    gunicorn
+    pytz
+    pyparsing
+    cairocffi
+    whisper
+    whitenoise
+    scandir
+    urllib3
+    six
  ];

  # Carbon-s default installation is /opt/graphite. This env variable ensures
@ -28,6 +52,8 @@ buildPythonPackage rec {
      --replace "join(WEBAPP_DIR, 'content')" "join('$out', 'webapp', 'content')"
  '';

+  pythonImportsCheck = [ "graphite" ];
+
  meta = with lib; {
    homepage = "http://graphiteapp.org/";
    description = "Enterprise scalable realtime graphing";
--- a/pkgs/development/python-modules/more-itertools/default.nix
+++ b/pkgs/development/python-modules/more-itertools/default.nix
@ -9,11 +9,11 @@

 buildPythonPackage rec {
  pname = "more-itertools";
-  version = "8.6.0";
+  version = "8.7.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "b3a9005928e5bed54076e6e549c792b306fddfe72b2d1d22dd63d42d5d3899cf";
+    sha256 = "c5d6da9ca3ff65220c3bfd2a8db06d698f05d4d2b9be57e1deb2be5a45019713";
  };

  checkInputs = [ nose ];
@ -25,6 +25,7 @@ buildPythonPackage rec {

  meta = {
    homepage = "https://more-itertools.readthedocs.org";
+    changelog = "https://more-itertools.readthedocs.io/en/stable/versions.html";
    description = "Expansion of the itertools module";
    license = lib.licenses.mit;
  };
--- a/pkgs/development/python-modules/packaging/default.nix
+++ b/pkgs/development/python-modules/packaging/default.nix
@ -5,7 +5,7 @@
 , six
 , pytestCheckHook
 , pretend
-, flit-core
+, setuptools
 }:

 buildPythonPackage rec {
@ -19,7 +19,7 @@ buildPythonPackage rec {
  };

  nativeBuildInputs = [
-    flit-core
+    setuptools
  ];

  propagatedBuildInputs = [ pyparsing six ];
@ -29,10 +29,6 @@ buildPythonPackage rec {
    pretend
  ];

-  checkPhase = ''
-    py.test tests
-  '';
-
  # Prevent circular dependency
  doCheck = false;

--- a/pkgs/development/python-modules/promise/default.nix
+++ b/pkgs/development/python-modules/promise/default.nix
@ -1,41 +1,35 @@
 { buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , lib
-
-, coveralls
-, gevent
+, six
+, pytestCheckHook
 , mock
 , pytest-asyncio
-, pytest-benchmark
-, pytestcov
-, six
 }:

 buildPythonPackage rec {
  pname = "promise";
-  version = "2.3";
+  version = "2.3.0";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1l4kknj97dj5pxfpsz3ln78x9a843561c740b1m4pfi3qlvq7lfz";
+  src = fetchFromGitHub {
+    owner = "syrusakbary";
+    repo = "promise";
+    rev = "v${version}";
+    sha256 = "17mq1bm78xfl0x1g50ng502m5ldq6421rzz35hlqafsj0cq8dkp6";
  };

-  patchPhase = ''
-    substituteInPlace setup.py \
-      --replace '"futures",' ""
-  '';
-
  propagatedBuildInputs = [
-    gevent
    six
  ];

  checkInputs = [
-    coveralls
+    pytestCheckHook
    mock
    pytest-asyncio
-    pytest-benchmark
-    pytestcov
+  ];
+
+  disabledTestPaths = [
+    "tests/test_benchmark.py"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/pylitterbot/default.nix
+++ b/pkgs/development/python-modules/pylitterbot/default.nix
@ -0,0 +1,36 @@
+{ lib
+, authlib
+, buildPythonPackage
+, fetchFromGitHub
+, httpx
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pylitterbot";
+  version = "2021.2.5";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "natekspencer";
+    repo = pname;
+    rev = version;
+    sha256 = "0705bxm0rlpgwg8my7z5pp6y362bs2j53zy1yslha0ya6cgx37g8";
+  };
+
+  propagatedBuildInputs = [
+    authlib
+    httpx
+  ];
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "pylitterbot" ];
+
+  meta = with lib; {
+    description = "Python package for controlling a Litter-Robot";
+    homepage = "https://github.com/natekspencer/pylitterbot";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pytest-aiohttp/default.nix
+++ b/pkgs/development/python-modules/pytest-aiohttp/default.nix
@ -9,7 +9,9 @@ buildPythonPackage rec {
    sha256 = "0kx4mbs9bflycd8x9af0idcjhdgnzri3nw1qb0vpfyb3751qaaf9";
  };

-  propagatedBuildInputs = [ pytest aiohttp ];
+  buildInputs = [ pytest ];
+
+  propagatedBuildInputs = [ aiohttp ];

  # There are no tests
  doCheck = false;
--- a/pkgs/development/python-modules/pytest-ansible/default.nix
+++ b/pkgs/development/python-modules/pytest-ansible/default.nix
@ -21,10 +21,12 @@ buildPythonPackage rec {
    sed -i "s/'setuptools-markdown'//g" setup.py
  '';

+  buildInputs = [ pytest ];
+
  # requires pandoc < 2.0
  # buildInputs = [ setuptools-markdown ];
  checkInputs =  [ mock ];
-  propagatedBuildInputs = [ ansible pytest ];
+  propagatedBuildInputs = [ ansible ];

  # tests not included with release, even on github
  doCheck = false;
--- a/pkgs/development/python-modules/pytest-arraydiff/default.nix
+++ b/pkgs/development/python-modules/pytest-arraydiff/default.nix
@ -16,10 +16,11 @@ buildPythonPackage rec {
    sha256 = "de2d62f53ecc107ed754d70d562adfa7573677a263216a7f19aa332f20dc6c15";
  };

+  buildInputs = [ pytest ];
+
  propagatedBuildInputs = [
    numpy
    six
-    pytest
  ];

  # The tests requires astropy, which itself requires
--- a/pkgs/development/python-modules/pytest-astropy-header/default.nix
+++ b/pkgs/development/python-modules/pytest-astropy-header/default.nix
@ -31,8 +31,7 @@ buildPythonPackage rec {
    })
  ];

-
-  propagatedBuildInputs = [
+  buildInputs = [
    pytest
  ];

--- a/pkgs/development/python-modules/pytest-astropy/default.nix
+++ b/pkgs/development/python-modules/pytest-astropy/default.nix
@ -25,9 +25,10 @@ buildPythonPackage rec {
    setuptools_scm
  ];

+  buildInputs = [ pytest ];
+
  propagatedBuildInputs = [
    hypothesis
-    pytest
    pytest-astropy-header
    pytest-doctestplus
    pytest-filter-subpackage
--- a/pkgs/development/python-modules/pytest-bdd/default.nix
+++ b/pkgs/development/python-modules/pytest-bdd/default.nix
@ -22,7 +22,9 @@ buildPythonPackage rec {
    sha256 = "1yqzz44as4pxffmg4hk9lijvnvlc2chg1maq1fbj5i4k4jpagvjz";
  };

-  propagatedBuildInputs = [ glob2 Mako parse parse-type py pytest six ];
+  buildInputs = [ pytest ];
+
+  propagatedBuildInputs = [ glob2 Mako parse parse-type py six ];

  # Tests require extra dependencies
  checkInputs = [ execnet mock pytest ];
--- a/pkgs/development/python-modules/pytest-benchmark/default.nix
+++ b/pkgs/development/python-modules/pytest-benchmark/default.nix
@ -19,7 +19,9 @@ buildPythonPackage rec {
    sha256 = "1hslzzinpwc1zqhbpllqh3sllmiyk69pcycl7ahr0rz3micgwczj";
  };

-  propagatedBuildInputs = [ pytest py-cpuinfo ] ++ lib.optionals (pythonOlder "3.4") [ pathlib statistics ];
+  buildInputs = [ pytest ];
+
+  propagatedBuildInputs = [ py-cpuinfo ] ++ lib.optionals (pythonOlder "3.4") [ pathlib statistics ];

  meta = {
    description = "Py.test fixture for benchmarking code";
--- a/pkgs/development/python-modules/pytest-black/default.nix
+++ b/pkgs/development/python-modules/pytest-black/default.nix
@ -16,7 +16,9 @@ buildPythonPackage rec {

  nativeBuildInputs = [ setuptools_scm ];

-  propagatedBuildInputs = [ black pytest toml ];
+  buildInputs = [ pytest ];
+
+  propagatedBuildInputs = [ black toml ];

  # does not contain tests
  doCheck = false;
--- a/pkgs/development/python-modules/pytest-check/default.nix
+++ b/pkgs/development/python-modules/pytest-check/default.nix
@ -15,7 +15,7 @@ buildPythonPackage rec {
    sha256 = "1i01i5ab06ic11na13gcacrlcs2ab6rmaii0yz0x06z5ynnljn6s";
  };

-  propagatedBuildInputs = [ pytest ];
+  buildInputs = [ pytest ];
  checkInputs = [ pytestCheckHook ];

  meta = with lib; {
--- a/pkgs/development/python-modules/pytest-click/default.nix
+++ b/pkgs/development/python-modules/pytest-click/default.nix
@ -19,8 +19,9 @@ buildPythonPackage rec {
    sha256 = "197nvlqlyfrqpy5lrkmfh1ywpr6j9zipxl9d7syg2a2n7jz3a8rj";
  };

+  buildInputs = [ pytest ];
+
  propagatedBuildInputs = [
-    pytest
    click
  ];

--- a/pkgs/development/python-modules/pytest-dependency/default.nix
+++ b/pkgs/development/python-modules/pytest-dependency/default.nix
@ -17,7 +17,7 @@ buildPythonPackage rec {
    })
  ];

-  propagatedBuildInputs = [ pytest ];
+  buildInputs = [ pytest ];

  checkInputs = [ pytest ];

--- a/pkgs/development/python-modules/pytest-doctestplus/default.nix
+++ b/pkgs/development/python-modules/pytest-doctestplus/default.nix
@ -17,10 +17,11 @@ buildPythonPackage rec {
    sha256 = "fb083925a17ce636f33997c275f61123e63372c1db11fefac1e991ed25a4ca37";
  };

+  buildInputs = [ pytest ];
+
  propagatedBuildInputs = [
    six
    numpy
-    pytest
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/pytest-factoryboy/default.nix
+++ b/pkgs/development/python-modules/pytest-factoryboy/default.nix
@ -21,10 +21,11 @@ buildPythonPackage rec {
    sha256 = "0v6b4ly0p8nknpnp3f4dbslfsifzzjx2vv27rfylx04kzdhg4m9p";
  };

+  buildInputs = [ pytest ];
+
  propagatedBuildInputs = [
    factory_boy
    inflection
-    pytest
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/pytest-filter-subpackage/default.nix
+++ b/pkgs/development/python-modules/pytest-filter-subpackage/default.nix
@ -21,8 +21,9 @@ buildPythonPackage rec {
    setuptools_scm
  ];

+  buildInputs = [ pytest ];
+
  propagatedBuildInputs = [
-    pytest
    pytest-doctestplus
    pytestcov
    pytestCheckHook
--- a/pkgs/development/python-modules/pytest-flakes/default.nix
+++ b/pkgs/development/python-modules/pytest-flakes/default.nix
@ -15,8 +15,9 @@ buildPythonPackage rec {
    sha256 = "bf070c5485dad82d5b5f5d0eb08d269737e378492d9a68f5223b0a90924c7754";
  };

+  buildInputs = [ pytest ];
+  propagatedBuildInputs = [ pyflakes ];
  checkInputs = [ pytest ];
-  propagatedBuildInputs = [ pytest pyflakes ];

  # no longer passes
  doCheck = false;
--- a/pkgs/development/python-modules/pytest-flask/default.nix
+++ b/pkgs/development/python-modules/pytest-flask/default.nix
@ -12,8 +12,9 @@ buildPythonPackage rec {

  doCheck = false;

+  buildInputs = [ pytest ];
+
  propagatedBuildInputs = [
-    pytest
    flask
    werkzeug
  ];
--- a/pkgs/development/python-modules/pytest-html/default.nix
+++ b/pkgs/development/python-modules/pytest-html/default.nix
@ -12,7 +12,8 @@ buildPythonPackage rec {
  };

  nativeBuildInputs = [ setuptools_scm ];
-  propagatedBuildInputs = [ pytest pytest-metadata ];
+  buildInputs = [ pytest ];
+  propagatedBuildInputs = [ pytest-metadata ];

  meta = with lib; {
    description = "Plugin for generating HTML reports";
--- a/pkgs/development/python-modules/pytest-httpx/default.nix
+++ b/pkgs/development/python-modules/pytest-httpx/default.nix
@ -18,9 +18,10 @@ buildPythonPackage rec {
    sha256 = "08idd3y6khxjqkn46diqvkjvsl4w4pxhl6z1hspbkrj0pqwf9isi";
  };

+  buildInputs = [ pytest ];
+
  propagatedBuildInputs = [
    httpx
-    pytest
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/pytest-metadata/default.nix
+++ b/pkgs/development/python-modules/pytest-metadata/default.nix
@ -11,7 +11,7 @@ buildPythonPackage rec {
  };

  nativeBuildInputs = [ setuptools_scm ];
-  propagatedBuildInputs = [ pytest ];
+  buildInputs = [ pytest ];

  meta = with lib; {
    description = "Plugin for accessing test session metadata";
--- a/pkgs/development/python-modules/pytest-mypy/default.nix
+++ b/pkgs/development/python-modules/pytest-mypy/default.nix
@ -18,7 +18,9 @@ buildPythonPackage rec {

  nativeBuildInputs = [ setuptools_scm ];

-  propagatedBuildInputs = [ pytest mypy filelock ];
+  buildInputs = [ pytest ];
+
+  propagatedBuildInputs = [ mypy filelock ];

  # does not contain tests
  doCheck = false;
--- a/pkgs/development/python-modules/pytest-openfiles/default.nix
+++ b/pkgs/development/python-modules/pytest-openfiles/default.nix
@ -20,8 +20,9 @@ buildPythonPackage rec {

  nativeBuildInputs = [ setuptools_scm ];

+  buildInputs = [ pytest ];
+
  propagatedBuildInputs = [
-    pytest
    psutil
  ];

--- a/pkgs/development/python-modules/pytest-order/default.nix
+++ b/pkgs/development/python-modules/pytest-order/default.nix
@ -17,7 +17,7 @@ buildPythonPackage rec {
    sha256 = "9c9e4f1b060414c642e88ad98ca60f1fd37937debd704bd8f4a2ef8e08b9cb6d";
  };

-  propagatedBuildInputs = [ pytest ];
+  buildInputs = [ pytest ];

  checkInputs = [
    pytestCheckHook
--- a/pkgs/development/python-modules/pytest-pylint/default.nix
+++ b/pkgs/development/python-modules/pytest-pylint/default.nix
@ -21,8 +21,9 @@ buildPythonPackage rec {

  nativeBuildInputs = [ pytestrunner ];

+  buildInputs = [ pytest ];
+
  propagatedBuildInputs = [
-    pytest
    pylint
    six
    toml
--- a/Show More
+++ b/Show More