Merge master into haskell-updates

2022-04-14 00:14:06 +00:00 · 2022-04-14 00:14:06 +00:00 · f5195ae7f5
commit f5195ae7f5
parent ca1481350b e10c716ece
97 changed files with 3335 additions and 2926 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -1915,7 +1915,10 @@
        <para>
          <literal>services.xserver.desktopManager.xfce</literal> now
          includes Xfce’s screen locker,
-          <literal>xfce4-screensaver</literal>.
+          <literal>xfce4-screensaver</literal> that is enabled by
+          default. You can disable it by setting
+          <literal>false</literal> to
+          <link linkend="opt-services.xserver.desktopManager.xfce.enableScreensaver">services.xserver.desktopManager.xfce.enableScreensaver</link>.
        </para>
      </listitem>
      <listitem>
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -650,7 +650,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 - xfsprogs was update to version 5.15, which enables inobtcount and bigtime by default on filesystem creation. Support for these features was added in kernel 5.10 and deemed stable in kernel 5.15.
  If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than 5.10, you need to format them with `mkfs.xfs -m bigtime=0 -m inobtcount=0`.

- `services.xserver.desktopManager.xfce` now includes Xfce's screen locker, `xfce4-screensaver`.
+- `services.xserver.desktopManager.xfce` now includes Xfce's screen locker, `xfce4-screensaver` that is enabled by default. You can disable it by setting `false` to [services.xserver.desktopManager.xfce.enableScreensaver](#opt-services.xserver.desktopManager.xfce.enableScreensaver).

 - The `hadoop` package has added support for `aarch64-linux` and `aarch64-darwin` as of 3.3.1 ([#158613](https://github.com/NixOS/nixpkgs/pull/158613)).

--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@ -194,6 +194,22 @@ rec {
      (( ! $inherit_errexit_enabled )) && shopt -u inherit_errexit
    '';

+  /* Remove packages of packagesToRemove from packages, based on their names.
+     Relies on package names and has quadratic complexity so use with caution!
+
+     Type:
+       removePackagesByName :: [package] -> [package] -> [package]
+
+     Example:
+       removePackagesByName [ nautilus file-roller ] [ file-roller totem ]
+       => [ nautilus ]
+  */
+  removePackagesByName = packages: packagesToRemove:
+    let
+      namesToRemove = map lib.getName packagesToRemove;
+    in
+      lib.filter (x: !(builtins.elem (lib.getName x) namesToRemove)) packages;
+
  systemdUtils = {
    lib = import ./systemd-lib.nix { inherit lib config pkgs; };
    unitOptions = import ./systemd-unit-options.nix { inherit lib systemdUtils; };
--- a/nixos/modules/config/terminfo.nix
+++ b/nixos/modules/config/terminfo.nix
@ -1,9 +1,33 @@
 # This module manages the terminfo database
 # and its integration in the system.
-{ config, ... }:
+{ config, lib, pkgs, ... }:
+
+with lib;
+
 {
+
+  options.environment.enableAllTerminfo = with lib; mkOption {
+    default = false;
+    type = types.bool;
+    description = ''
+      Whether to install all terminfo outputs
+    '';
+  };
+
  config = {

+    # can be generated with: filter (drv: (builtins.tryEval (drv ? terminfo)).value) (attrValues pkgs)
+    environment.systemPackages = mkIf config.environment.enableAllTerminfo (map (x: x.terminfo) (with pkgs; [
+      alacritty
+      foot
+      kitty
+      mtm
+      rxvt-unicode-unwrapped
+      rxvt-unicode-unwrapped-emoji
+      termite
+      wezterm
+    ]));
+
    environment.pathsToLink = [
      "/share/terminfo"
    ];
--- a/nixos/modules/services/databases/cockroachdb.nix
+++ b/nixos/modules/services/databases/cockroachdb.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:

 with lib;

@ -6,46 +6,44 @@ let
  cfg = config.services.cockroachdb;
  crdb = cfg.package;

-  escape    = builtins.replaceStrings ["%"] ["%%"];
-  ifNotNull = v: s: optionalString (v != null) s;
-
-  startupCommand = lib.concatStringsSep " "
-    [ # Basic startup
-      "${crdb}/bin/cockroach start"
+  startupCommand = utils.escapeSystemdExecArgs
+    ([
+      # Basic startup
+      "${crdb}/bin/cockroach"
+      "start"
      "--logtostderr"
      "--store=/var/lib/cockroachdb"
-      (ifNotNull cfg.locality "--locality='${cfg.locality}'")

      # WebUI settings
-      "--http-addr='${cfg.http.address}:${toString cfg.http.port}'"
+      "--http-addr=${cfg.http.address}:${toString cfg.http.port}"

      # Cluster listen address
-      "--listen-addr='${cfg.listen.address}:${toString cfg.listen.port}'"
+      "--listen-addr=${cfg.listen.address}:${toString cfg.listen.port}"

-      # Cluster configuration
-      (ifNotNull cfg.join "--join=${cfg.join}")
-
-      # Cache and memory settings. Must be escaped.
-      "--cache='${escape cfg.cache}'"
-      "--max-sql-memory='${escape cfg.maxSqlMemory}'"
+      # Cache and memory settings.
+      "--cache=${cfg.cache}"
+      "--max-sql-memory=${cfg.maxSqlMemory}"

      # Certificate/security settings.
      (if cfg.insecure then "--insecure" else "--certs-dir=${cfg.certsDir}")
-    ];
+    ]
+    ++ lib.optional (cfg.join != null) "--join=${cfg.join}"
+    ++ lib.optional (cfg.locality != null) "--locality=${cfg.locality}"
+    ++ cfg.extraArgs);

-    addressOption = descr: defaultPort: {
-      address = mkOption {
-        type = types.str;
-        default = "localhost";
-        description = "Address to bind to for ${descr}";
-      };
-
-      port = mkOption {
-        type = types.port;
-        default = defaultPort;
-        description = "Port to bind to for ${descr}";
-      };
+  addressOption = descr: defaultPort: {
+    address = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = "Address to bind to for ${descr}";
    };
+
+    port = mkOption {
+      type = types.port;
+      default = defaultPort;
+      description = "Port to bind to for ${descr}";
+    };
+  };
 in

 {
@ -159,6 +157,16 @@ in
          only contain open source features and open source code).
        '';
      };
+
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "--advertise-addr" "[fe80::f6f2:::]" ];
+        description = ''
+          Extra CLI arguments passed to <command>cockroach start</command>.
+          For the full list of supported argumemnts, check <link xlink:href="https://www.cockroachlabs.com/docs/stable/cockroach-start.html#flags"/>
+        '';
+      };
    };
  };

--- a/nixos/modules/services/networking/shellhub-agent.nix
+++ b/nixos/modules/services/networking/shellhub-agent.nix
@ -1,31 +1,37 @@
 { config, lib, pkgs, ... }:

 with lib;
+
 let
  cfg = config.services.shellhub-agent;
-in {
-
+in
+{
  ###### interface

  options = {

    services.shellhub-agent = {

-      enable = mkOption {
-        type = types.bool;
-        default = false;
+      enable = mkEnableOption "ShellHub Agent daemon";
+
+      package = mkPackageOption pkgs "shellhub-agent" { };
+
+      preferredHostname = mkOption {
+        type = types.str;
+        default = "";
        description = ''
-          Whether to enable the ShellHub Agent daemon, which allows
-          secure remote logins.
+          Set the device preferred hostname. This provides a hint to
+          the server to use this as hostname if it is available.
        '';
      };

-      package = mkOption {
-        type = types.package;
-        default = pkgs.shellhub-agent;
-        defaultText = literalExpression "pkgs.shellhub-agent";
+      keepAliveInterval = mkOption {
+        type = types.int;
+        default = 30;
        description = ''
-          Which ShellHub Agent package to use.
+          Determine the interval to send the keep alive message to
+          the server. This has a direct impact of the bandwidth
+          used by the device.
        '';
      };

@ -74,9 +80,13 @@ in {
        "time-sync.target"
      ];

-      environment.SERVER_ADDRESS = cfg.server;
-      environment.PRIVATE_KEY = cfg.privateKey;
-      environment.TENANT_ID = cfg.tenantId;
+      environment = {
+        SHELLHUB_SERVER_ADDRESS = cfg.server;
+        SHELLHUB_PRIVATE_KEY = cfg.privateKey;
+        SHELLHUB_TENANT_ID = cfg.tenantId;
+        SHELLHUB_KEEPALIVE_INTERVAL = toString cfg.keepAliveInterval;
+        SHELLHUB_PREFERRED_HOSTNAME = cfg.preferredHostname;
+      };

      serviceConfig = {
        # The service starts sessions for different users.
@ -85,7 +95,6 @@ in {
        ExecStart = "${cfg.package}/bin/agent";
      };
    };
-
-    environment.systemPackages = [ cfg.package ];
  };
 }
+
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@ -196,7 +196,7 @@ in
      programs.evince.enable = mkDefault true;
      programs.file-roller.enable = mkDefault true;

-      environment.systemPackages = (with pkgs // pkgs.gnome // pkgs.cinnamon; pkgs.gnome.removePackagesByName [
+      environment.systemPackages = with pkgs // pkgs.gnome // pkgs.cinnamon; lib.utils.removePackagesByName [
        # cinnamon team apps
        bulky
        blueberry
@ -212,7 +212,7 @@ in
        # external apps shipped with linux-mint
        hexchat
        gnome-calculator
-      ] config.environment.cinnamon.excludePackages);
+      ] config.environment.cinnamon.excludePackages;
    })
  ];
 }
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@ -42,7 +42,8 @@ let
     chmod -R a+w $out/share/gsettings-schemas/nixos-gsettings-overrides
     cat - > $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas/nixos-defaults.gschema.override <<- EOF
       [org.gnome.desktop.background]
-       picture-uri='file://${pkgs.nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}'
+       picture-uri='file://${pkgs.nixos-artwork.wallpapers.simple-blue.gnomeFilePath}'
+       picture-uri-dark='file://${pkgs.nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}'

       [org.gnome.desktop.screensaver]
       picture-uri='file://${pkgs.nixos-artwork.wallpapers.simple-dark-gray-bottom.gnomeFilePath}'
@ -455,7 +456,7 @@ in
    (mkIf serviceCfg.core-utilities.enable {
      environment.systemPackages =
        with pkgs.gnome;
-        removePackagesByName
+        lib.utils.removePackagesByName
          ([
            baobab
            cheese
@ -515,7 +516,7 @@ in
    })

    (mkIf serviceCfg.games.enable {
-      environment.systemPackages = (with pkgs.gnome; removePackagesByName [
+      environment.systemPackages = with pkgs.gnome; lib.utils.removePackagesByName [
        aisleriot
        atomix
        five-or-more
@ -536,12 +537,12 @@ in
        quadrapassel
        swell-foop
        tali
-      ] config.environment.gnome.excludePackages);
+      ] config.environment.gnome.excludePackages;
    })

    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/3.38.0/elements/core/meta-gnome-core-developer-tools.bst
    (mkIf serviceCfg.core-developer-tools.enable {
-      environment.systemPackages = (with pkgs.gnome; removePackagesByName [
+      environment.systemPackages = with pkgs.gnome; lib.utils.removePackagesByName [
        dconf-editor
        devhelp
        pkgs.gnome-builder
@ -550,7 +551,7 @@ in
        # in default configurations.
        # https://github.com/NixOS/nixpkgs/issues/60908
        /* gnome-boxes */
-      ] config.environment.gnome.excludePackages);
+      ] config.environment.gnome.excludePackages;

      services.sysprof.enable = notExcluded pkgs.sysprof;
    })
--- a/nixos/modules/services/x11/desktop-managers/lxqt.nix
+++ b/nixos/modules/services/x11/desktop-managers/lxqt.nix
@ -51,7 +51,7 @@ in
    environment.systemPackages =
      pkgs.lxqt.preRequisitePackages ++
      pkgs.lxqt.corePackages ++
-      (pkgs.gnome.removePackagesByName
+      (lib.utils.removePackagesByName
        pkgs.lxqt.optionalPackages
        config.environment.lxqt.excludePackages);

--- a/nixos/modules/services/x11/desktop-managers/mate.nix
+++ b/nixos/modules/services/x11/desktop-managers/mate.nix
@ -47,7 +47,7 @@ in
    # Debugging
    environment.sessionVariables.MATE_SESSION_DEBUG = mkIf cfg.debug "1";

-    environment.systemPackages = pkgs.gnome.removePackagesByName
+    environment.systemPackages = lib.utils.removePackagesByName
      (pkgs.mate.basePackages ++
      pkgs.mate.extraPackages ++
      [
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, utils, pkgs, ... }:

 with lib;

@ -214,7 +214,7 @@ in
        elementary-settings-daemon
        pantheon-agent-geoclue2
        pantheon-agent-polkit
-      ]) ++ (gnome.removePackagesByName [
+      ]) ++ (utils.removePackagesByName [
        gnome.gnome-font-viewer
        gnome.gnome-settings-daemon338
      ] config.environment.pantheon.excludePackages);
@ -272,7 +272,7 @@ in
    })

    (mkIf serviceCfg.apps.enable {
-      environment.systemPackages = with pkgs.pantheon; pkgs.gnome.removePackagesByName ([
+      environment.systemPackages = with pkgs.pantheon; utils.removePackagesByName ([
        elementary-calculator
        elementary-calendar
        elementary-camera
--- a/nixos/modules/services/x11/desktop-managers/xfce.nix
+++ b/nixos/modules/services/x11/desktop-managers/xfce.nix
@ -66,6 +66,12 @@ in
        default = true;
        description = "Enable the XFWM (default) window manager.";
      };
+
+      enableScreensaver = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Enable the XFCE screensaver.";
+      };
    };
  };

@ -99,7 +105,6 @@ in
      ristretto
      xfce4-appfinder
      xfce4-notifyd
-      xfce4-screensaver
      xfce4-screenshooter
      xfce4-session
      xfce4-settings
@ -123,7 +128,7 @@ in
      ] ++ optionals (!cfg.noDesktop) [
        xfce4-panel
        xfdesktop
-      ];
+      ] ++ optional cfg.enableScreensaver xfce4-screensaver;

    environment.pathsToLink = [
      "/share/xfce4"
@ -169,6 +174,6 @@ in
      xfce4-notifyd
    ];

-    security.pam.services.xfce4-screensaver.unixAuth = true;
+    security.pam.services.xfce4-screensaver.unixAuth = cfg.enableScreensaver;
  };
 }
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, utils, pkgs, ... }:

 with lib;

@ -181,6 +181,13 @@ in
        '';
      };

+      excludePackages = mkOption {
+        default = [];
+        example = literalExpression "[ pkgs.xterm ]";
+        type = types.listOf types.package;
+        description = "Which X11 packages to exclude from the default environment";
+      };
+
      exportConfiguration = mkOption {
        type = types.bool;
        default = false;
@ -655,7 +662,7 @@ in
          ${cfgPath}.source = xorg.xf86inputevdev.out + "/share" + cfgPath;
        });

-    environment.systemPackages =
+    environment.systemPackages = utils.removePackagesByName
      [ xorg.xorgserver.out
        xorg.xrandr
        xorg.xrdb
@ -671,7 +678,7 @@ in
        pkgs.xdg-utils
        xorg.xf86inputevdev.out # get evdev.4 man page
        pkgs.nixos-icons # needed for gnome and pantheon about dialog, nixos-manual and maybe more
-      ]
+      ] config.services.xserver.excludePackages
      ++ optional (elem "virtualbox" cfg.videoDrivers) xorg.xrefresh;

    environment.pathsToLink = [ "/share/X11" ];
--- a/nixos/tests/all-terminfo.nix
+++ b/nixos/tests/all-terminfo.nix
@ -0,0 +1,31 @@
+import ./make-test-python.nix ({ pkgs, ... }: rec {
+  name = "all-terminfo";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jkarlson ];
+  };
+
+  nodes.machine = { pkgs, config, lib, ... }:
+    let
+      infoFilter = name: drv:
+        let
+          o = builtins.tryEval drv;
+        in
+        o.success && lib.isDerivation o.value && o.value ? outputs && builtins.elem "terminfo" o.value.outputs;
+      terminfos = lib.filterAttrs infoFilter pkgs;
+      excludedTerminfos = lib.filterAttrs (_: drv: !(builtins.elem drv.terminfo config.environment.systemPackages)) terminfos;
+      includedOuts = lib.filterAttrs (_: drv: builtins.elem drv.out config.environment.systemPackages) terminfos;
+    in
+    {
+      environment = {
+        enableAllTerminfo = true;
+        etc."terminfo-missing".text = builtins.concatStringsSep "\n" (builtins.attrNames excludedTerminfos);
+        etc."terminfo-extra-outs".text = builtins.concatStringsSep "\n" (builtins.attrNames includedOuts);
+      };
+    };
+
+  testScript =
+    ''
+      machine.fail("grep . /etc/terminfo-missing >&2")
+      machine.fail("grep . /etc/terminfo-extra-outs >&2")
+    '';
+})
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -35,6 +35,7 @@ in
  agate = handleTest ./web-servers/agate.nix {};
  agda = handleTest ./agda.nix {};
  airsonic = handleTest ./airsonic.nix {};
+  allTerminfo = handleTest ./all-terminfo.nix {};
  amazon-init-shell = handleTest ./amazon-init-shell.nix {};
  apfs = handleTest ./apfs.nix {};
  apparmor = handleTest ./apparmor.nix {};
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@ -25,7 +25,7 @@

 python3.pkgs.buildPythonApplication rec  {
  pname = "lollypop";
-  version = "1.4.26";
+  version = "1.4.31";

  format = "other";
  doCheck = false;
@ -34,7 +34,7 @@ python3.pkgs.buildPythonApplication rec  {
    url = "https://gitlab.gnome.org/World/lollypop";
    rev = "refs/tags/${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-Q/z9oET06DimMRZl03TgjEeheoVHtIkH+Z69qWZetcI=";
+    sha256 = "sha256-kWqTDhk7QDmN0yr6x8ER5oHkUAkP3i5yOabnNXSHSqA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/blockchains/lightning-loop/default.nix
+++ b/pkgs/applications/blockchains/lightning-loop/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "lightning-loop";
-  version = "0.17.0-beta";
+  version = "0.18.0-beta";

  src = fetchFromGitHub {
    owner = "lightninglabs";
    repo = "loop";
    rev = "v${version}";
-    sha256 = "0hjawagn1dfgj67i52bvf3phvm9f9708z3jqs6cvyz0w7vp107py";
+    sha256 = "1kg5nlvb4lb3cjn84wcylhq0l73d2n6rg4n1srnxmgs96v41y78f";
  };

-  vendorSha256 = "1fpc73hwdn3baz5ykrykvqdr5861gj9p6liy8qll5525kdv560f6";
+  vendorSha256 = "0q3wbjfaqdj29sjlhx6fhc0p4d12aa31s6ia36jalcvf659ybb0l";

  subPackages = [ "cmd/loop" "cmd/loopd" ];

--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -956,6 +956,7 @@ https://github.com/tpope/vim-vinegar/,,
 https://github.com/triglav/vim-visual-increment/,,
 https://github.com/mg979/vim-visual-multi/,,
 https://github.com/thinca/vim-visualstar/,,
+https://github.com/ngemily/vim-vp4/,HEAD,
 https://github.com/hrsh7th/vim-vsnip/,,
 https://github.com/hrsh7th/vim-vsnip-integ/,,
 https://github.com/posva/vim-vue/,,
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "drawio";
-  version = "17.2.4";
+  version = "17.4.2";

  src = fetchurl {
    url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/drawio-x86_64-${version}.rpm";
-    sha256 = "sha256-dKl7DxNneoQEL+QhZmpfQCd15RoeDRnkZt3sv8t2KM4=";
+    sha256 = "294f99d9060bc394490b20d2ddab75ed5c0166d7960850f065eb8897ef31a2e3";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/geeqie/default.nix
+++ b/pkgs/applications/graphics/geeqie/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "geeqie";
-  version = "1.7.2";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "BestImageViewer";
    repo = "geeqie";
    rev = "v${version}";
-    sha256 = "sha256-Abr7trlms6bxOAqE6xNKRv51TBGNilNdBhUZUg7OTKY=";
+    sha256 = "sha256-O+yz/uNxueR+naEJG8EZ+k/JutRjJ5wwbB9DYb8YNLw=";
  };

  patches = [
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@ -11,6 +11,7 @@

 buildDotnetModule rec {
  pname = "archisteamfarm";
+  # nixpkgs-update: no auto update
  version = "5.2.2.4";

  src = fetchFromGitHub {
--- a/pkgs/applications/misc/gsctl/default.nix
+++ b/pkgs/applications/misc/gsctl/default.nix
@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, kubectl, stdenv }:

 buildGoModule rec {
  pname = "gsctl";
@ -13,10 +13,16 @@ buildGoModule rec {

  vendorSha256 = "sha256-NeRABlKUpD2ZHRid/vu34Dh9uHZ+7IXWFPX8jkexUog=";

-  ldflags =
-    [ "-s" "-w" "-X github.com/giantswarm/gsctl/buildinfo.Version=${version}" ];
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/giantswarm/gsctl/buildinfo.Version=${version}"
+  ];

-  doCheck = false;
+  checkInputs = [
+    kubectl
+  ];
+
+  doCheck = !stdenv.isDarwin;

  meta = with lib; {
    description = "The Giant Swarm command line interface";
--- a/pkgs/applications/misc/zettlr/default.nix
+++ b/pkgs/applications/misc/zettlr/default.nix
@ -10,11 +10,11 @@
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
 let
  pname = "zettlr";
-  version = "2.2.4";
+  version = "2.2.5";
  name = "${pname}-${version}";
  src = fetchurl {
    url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
-    sha256 = "sha256-lzXciToyUsHl8WV0IvdP6R2pYegL7/G04YPLb6gbCgQ=";
+    sha256 = "sha256-KP3lt0CweT1f/BR3IpnjwCqNvhFbrpz9KLg6K8OMs+I=";
  };
  appimageContents = appimageTools.extractType2 {
    inherit name src;
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -46,12 +46,12 @@ assert with lib.strings; (

 stdenv.mkDerivation rec {
  pname = "palemoon";
-  version = "29.4.5.1";
+  version = "29.4.6";

  src = fetchzip {
    name = "${pname}-${version}";
    url = "http://archive.palemoon.org/source/${pname}-${version}.source.tar.xz";
-    sha256 = "sha256-IC7E88dECAz2diVLEEdjMltpNMBhPTlPvbz05BniBMI=";
+    sha256 = "sha256-6bI3AnIhp0x3BCgTvmbOXDBGrJXg3cN+AmwI8XCKD8g=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@ -79,7 +79,7 @@ in mkDerivationWith python3Packages.buildPythonApplication rec {
  postPatch = ''
    substituteInPlace qutebrowser/misc/quitter.py --subst-var-by qutebrowser "$out/bin/qutebrowser"

-    sed -i "s,/usr/share/,$out/share/,g" qutebrowser/utils/standarddir.py
+    sed -i "s,/usr,$out,g" qutebrowser/utils/standarddir.py
  '' + lib.optionalString withPdfReader ''
    sed -i "s,/usr/share/pdf.js,${pdfjs},g" qutebrowser/browser/pdfjs.py
  '';
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@ -1,22 +1,33 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, stdenv }:

 buildGoModule rec {
  pname = "cloudflared";
-  version = "2022.4.0";
+  version = "2022.4.1";

  src = fetchFromGitHub {
    owner  = "cloudflare";
    repo   = "cloudflared";
    rev    = version;
-    hash   = "sha256-+40OK2q4WdvlLhoPfZH6q+pghgS7ZLmaZl2VbZK4rdA=";
+    hash   = "sha256-dgvXbWtLP6sXBlqcx/xpw9LIbcE4VlYZQO5rrS34+9I=";
  };

  vendorSha256 = null;

-  doCheck = false;
-
  ldflags = [ "-X main.Version=${version}" ];

+  preCheck = ''
+    # Workaround for: sshgen_test.go:74: mkdir /homeless-shelter/.cloudflared: no such file or directory
+    export HOME="$(mktemp -d)";
+
+    # Workaround for: protocol_test.go:11:
+    #   lookup protocol-v2.argotunnel.com on [::1]:53: read udp [::1]:51876->[::1]:53: read: connection refused
+
+    substituteInPlace "edgediscovery/protocol_test.go" \
+      --replace "TestProtocolPercentage" "SkipProtocolPercentage"
+  '';
+
+  doCheck = !stdenv.isDarwin;
+
  meta = with lib; {
    description = "CloudFlare Tunnel daemon (and DNS-over-HTTPS client)";
    homepage    = "https://www.cloudflare.com/products/tunnel";
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@ -46,12 +46,12 @@ with lib;
 # Those pieces of software we entirely ignore upstream's handling of, and just
 # make sure they're in the path if desired.
 let
-  k3sVersion = "1.23.4+k3s1";     # k3s git tag
-  k3sCommit = "43b1cb48200d8f6af85c16ed944d68fcc96b6506"; # k3s git commit at the above version
-  k3sRepoSha256 = "1sn7rd5hqfqvwj036blk0skmq6r8igbmiqk1dnpaqnkkddpzdgmc";
-  k3sVendorSha256 = "sha256-1/kQvNqFUWwch1JH+twWzBdjNYseoZyVObB1+s9WPM4=";
+  k3sVersion = "1.23.5+k3s1";     # k3s git tag
+  k3sCommit = "313aaca547f030752788dce696fdf8c9568bc035"; # k3s git commit at the above version
+  k3sRepoSha256 = "0vk72609cyyh64irp14jp2zspnxw34jm710cbwgklx0ch6kiz88d";
+  k3sVendorSha256 = "sha256-d7kQsJi/eQbaTUDglp3gFpc5Im6CyD9coKeM3kMrbjI=";

-  k3sServerVendorSha256 = "sha256-2KIFff43jfqWdxX61aWofrjmc5mMkr5aEJRFdGpLyU8=";
+  k3sServerVendorSha256 = "sha256-E3USXNuXY0lzZH+t3O7BOQ8rKNNQ6avOMItgOEi1cEg=";

  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
@ -68,8 +68,8 @@ let

  # taken from go.mod, the 'github.com/containerd/containerd' line
  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
-  containerdVersion = "1.5.9-k3s1";
-  containerdSha256 = "09wfy20z3c9fnla353pibpsb10xzl0f4xwp8qdjh3fwa1q2626gg";
+  containerdVersion = "1.5.10-k3s1";
+  containerdSha256 = "1ff2sfaqpjimq7w0lprci6ibyi6v65ap6b9sr6b0j12gqr2sqwa5";

  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
  criCtlVersion = "1.22.0-k3s1";
@ -228,9 +228,24 @@ buildGoModule rec {

  patches = [
    ./patches/0001-scrips-download-strip-downloading-just-package-CRD.patch
-    ./patches/0002-Don-t-build-a-static-binary-in-package-cli.patch
  ];

+  postPatch = ''
+    # Nix prefers dynamically linked binaries over static binary.
+
+    substituteInPlace scripts/package-cli \
+      --replace '"$LDFLAGS $STATIC" -o' \
+                '"$LDFLAGS" -o' \
+      --replace "STATIC=\"-extldflags \'-static\'\"" \
+                ""
+
+    # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
+
+    substituteInPlace scripts/package-cli \
+      --replace '"''${GO}" generate' \
+                'GOFLAGS="" "''${GO}" generate'
+  '';
+
  # Important utilities used by the kubelet, see
  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
  # Note the list in that issue is stale and some aren't relevant for k3s.
--- a/pkgs/applications/networking/cluster/k3s/patches/0002-Don-t-build-a-static-binary-in-package-cli.patch
+++ b/pkgs/applications/networking/cluster/k3s/patches/0002-Don-t-build-a-static-binary-in-package-cli.patch
@ -1,37 +0,0 @@
-From 49c000c7c5dd7a502a2be4c638d2c32b65673c00 Mon Sep 17 00:00:00 2001
-From: Euan Kemp <euank@euank.com>
-Date: Sun, 6 Feb 2022 23:13:00 -0800
-Subject: [PATCH] Don't build a static binary in package-cli
-
-since nixpkgs prefers dynamically linked binaries.
-
-Also remove "trimpath" for the 'go generate' step because the codegen
-they use doesn't work with trimpath set.
---
- scripts/package-cli | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/scripts/package-cli b/scripts/package-cli
-index 28927327b7..95dbb469f1 100755
--- a/scripts/package-cli
-+++ b/scripts/package-cli
-@@ -48,14 +48,13 @@ fi
- 
- CMD_NAME=dist/artifacts/k3s${BIN_SUFFIX}
- 
-"${GO}" generate
-+GOFLAGS="" "${GO}" generate
- LDFLAGS="
-     -X github.com/rancher/k3s/pkg/version.Version=$VERSION
-     -X github.com/rancher/k3s/pkg/version.GitCommit=${COMMIT:0:8}
-     -w -s
- "
-STATIC="-extldflags '-static'"
-CGO_ENABLED=0 "${GO}" build -ldflags "$LDFLAGS $STATIC" -o ${CMD_NAME} ./cmd/k3s/main.go
-+CGO_ENABLED=0 "${GO}" build -ldflags "$LDFLAGS" -o ${CMD_NAME} ./cmd/k3s/main.go
- 
- stat ${CMD_NAME}
- 
-- 
-2.34.1
-
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -471,6 +471,15 @@
    "vendorSha256": "sha256-HrsjhaMlzs+uel5tBlxJD69Kkjl+4qVisWWREANBx40=",
    "version": "5.0.2"
  },
+  "htpasswd": {
+    "owner": "loafoe",
+    "provider-source-address": "registry.terraform.io/loafoe/htpasswd",
+    "repo": "terraform-provider-htpasswd",
+    "rev": "v1.0.1",
+    "sha256": "sha256-RUkPIsKVMooGy2hYsNFkctMFdJ8MEbtbMB9Qak6HJgQ=",
+    "vendorSha256": "sha256-4P3IX7KGDqcWVYRiD6tXoEjF/phI89rz5QdR09xtnAo=",
+    "version": "1.0.1"
+  },
  "http": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/http",
--- a/pkgs/applications/networking/instant-messengers/kaidan/default.nix
+++ b/pkgs/applications/networking/instant-messengers/kaidan/default.nix
@ -12,6 +12,7 @@
 , knotifications
 , zxing-cpp
 , qxmpp
+, sonnet
 , gst_all_1
 }:

@ -38,6 +39,7 @@ mkDerivation rec {
    knotifications
    zxing-cpp
    qxmpp
+    sonnet
    gstreamer
    gst-plugins-bad
    gst-plugins-base
--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "ipfs";
-  version = "0.12.1"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.12.2"; # When updating, also check if the repo version changed and adjust repoVersion below
  rev = "v${version}";

  repoVersion = "12"; # Also update ipfs-migrator when changing the repo version
@ -10,7 +10,7 @@ buildGoModule rec {
  # go-ipfs makes changes to it's source tarball that don't match the git source.
  src = fetchurl {
    url = "https://github.com/ipfs/go-ipfs/releases/download/${rev}/go-ipfs-source.tar.gz";
-    sha256 = "sha256-fUExCvE6x5VFBl66y52DGvr8ZNSXZ6MYpVQP/D7X328=";
+    sha256 = "sha256-66NNLMSfeBHQh/QlnETB/ssra9CKbD+jtaJuX+14x00=";
  };

  # tarball contains multiple files/directories
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@ -27,11 +27,11 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "mutt";
-  version = "2.2.2";
+  version = "2.2.3";

  src = fetchurl {
    url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "1k0ghbpc4gn3sydbw10xv9djin9grk1pkxdwynrw0iknyc68gphh";
+    sha256 = "12cds5qm0x51wj1bz1a2f4q4qwbyfssq9pnisxz48ks5mg6xv2lp";
  };

  patches = optional smimeSupport (fetchpatch {
--- a/pkgs/applications/terminal-emulators/wezterm/default.nix
+++ b/pkgs/applications/terminal-emulators/wezterm/default.nix
@ -100,7 +100,10 @@ rustPlatform.buildRustPackage rec {
    ln -s $out/bin/{wezterm,wezterm-mux-server,wezterm-gui,strip-ansi-escapes} "$OUT_APP"
  '';

-  passthru.tests.test = nixosTests.terminal-emulators.wezterm;
+  passthru.tests = {
+    all-terminfo = nixosTests.allTerminfo;
+    test = nixosTests.terminal-emulators.wezterm;
+  };

  meta = with lib; {
    description = "A GPU-accelerated cross-platform terminal emulator and multiplexer written by @wez and implemented in Rust";
--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gh";
-  version = "2.7.0";
+  version = "2.8.0";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-edlGJD+80k1ySpyNcKc5c2O0MX+S4fQgH5mwHQUxXM8=";
+    sha256 = "sha256-oPLnc3Fv8oGbfQMujcVIwKJrQ3vCV9yIB4rUtjeVOV0=";
  };

  vendorSha256 = "sha256-YLkNua0Pz0gVIYnWOzOlV5RuLBaoZ4l7l1Pf4QIfUVQ=";
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@ -120,12 +120,12 @@ let

 in {
  subversion_1_10 = common {
-    version = "1.10.7";
-    sha256 = "1nhrd8z6c94sc0ryrzpyd98qdn5a5g3x0xv1kdb9da4drrk8y2ww";
+    version = "1.10.8";
+    sha256 = "sha256-CnO6MSe1ov/7j+4rcCmE8qgI3nEKjbKLfdQBDYvlDlo=";
  };

  subversion = common {
-    version = "1.14.1";
-    sha256 = "1ag1hvcm9q92kgalzbbgcsq9clxnzmbj9nciz9lmabjx4lyajp9c";
+    version = "1.14.2";
+    sha256 = "sha256-yRMOjQt1copm8OcDj8dwUuZxgw14W1YWqtU7SBDTzCg=";
  };
 }
--- a/pkgs/applications/video/celluloid/default.nix
+++ b/pkgs/applications/video/celluloid/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "celluloid";
-  version = "0.22";
+  version = "0.23";

  src = fetchFromGitHub {
    owner = "celluloid-player";
    repo = "celluloid";
    rev = "v${version}";
-    hash = "sha256-QGN8YLtyb9YVNDK2ZDQwHJVg6UTIQssfNK9lQqxMNKQ=";
+    hash = "sha256-YKDud/UJJx9ko5k+Oux8mUUme0MXaRMngESE14Hhxv8=";
  };

  nativeBuildInputs = [
@ -46,8 +46,6 @@ stdenv.mkDerivation rec {

  postPatch = ''
    patchShebangs meson-post-install.py src/generate-authors.py
-    # Remove this for next release
-    substituteInPlace meson-post-install.py --replace "gtk-update-icon-cache" "gtk4-update-icon-cache"
  '';

  doCheck = true;
--- a/pkgs/applications/virtualization/crosvm/Cargo.lock
+++ b/pkgs/applications/virtualization/crosvm/Cargo.lock
@ -106,9 +106,9 @@ checksum = "30696a84d817107fc028e049980e09d5e140e8da8f1caeb17e8e950658a3cea9"

 [[package]]
 name = "async-trait"
-version = "0.1.52"
+version = "0.1.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061a7acccaa286c011ddc30970520b98fa40e00c9d644633fb26b5fc63a265e3"
+checksum = "ed6aa3524a2dfcf9fe180c51eae2b58738348d819517ceadf95789c51fff7600"
 dependencies = [
 "proc-macro2",
 "quote",
@ -141,6 +141,13 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"

+[[package]]
+name = "balloon_control"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "base"
 version = "0.1.0"
@ -360,6 +367,7 @@ dependencies = [
 "argh",
 "async-task",
 "audio_streams",
+ "balloon_control",
 "base",
 "bit_field",
 "cros_async",
@ -578,9 +586,9 @@ dependencies = [

 [[package]]
 name = "getrandom"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d39cd93900197114fa1fcb7ae84ca742095eed9442088988ae74fa744e930e77"
+checksum = "9be70c98951c83b8d2f8f60d7065fa6d5146873094452a1008da8c2f1e4205ad"
 dependencies = [
 "cfg-if 1.0.0",
 "libc",
@ -726,9 +734,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"

 [[package]]
 name = "libc"
-version = "0.2.120"
+version = "0.2.121"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad5c14e80759d0939d013e6ca49930e59fc53dd8e5009132f76240c179380c09"
+checksum = "efaa7b300f3b5fe8eb6bf21ce3895e1751d9665086af2d64b42f19701015ff4f"

 [[package]]
 name = "libcras"
@ -763,9 +771,9 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.14"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
+checksum = "6389c490849ff5bc16be905ae24bc913a9c8892e19b2341dbc175e14c341c2b8"
 dependencies = [
 "cfg-if 1.0.0",
 ]
@ -854,9 +862,9 @@ dependencies = [

 [[package]]
 name = "paste"
-version = "1.0.6"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0744126afe1a6dd7f394cb50a716dbe086cb06e255e53d8d0185d82828358fb5"
+checksum = "0c520e05135d6e763148b6426a837e239041653ba7becd2e538c076c738025fc"

 [[package]]
 name = "pin-project-lite"
@ -872,9 +880,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"

 [[package]]
 name = "pkg-config"
-version = "0.3.24"
+version = "0.3.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58893f751c9b0412871a09abd62ecd2a00298c6c83befa223ef98c52aef40cbe"
+checksum = "1df8c4ec4b0627e53bdf214615ad287367e482558cf84b109250b37464dc03ae"

 [[package]]
 name = "poll_token_derive"
@ -964,9 +972,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "864d3e96a899863136fc6e99f3d7cae289dafe43bf2c5ac19b70df7210c0a145"
+checksum = "632d02bff7f874a36f33ea8bb416cd484b90cc66c1194b1a1110d067a7013f58"
 dependencies = [
 "proc-macro2",
 ]
@ -1088,9 +1096,9 @@ dependencies = [

 [[package]]
 name = "redox_syscall"
-version = "0.2.11"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8380fe0152551244f0747b1bf41737e0f8a74f97a14ccefd1148187271634f3c"
+checksum = "62f25bc4c7e55e0b0b7a1d43fb893f4fa1361d0abe38b9ce4f323c2adfe6ef42"
 dependencies = [
 "bitflags",
 ]
@ -1209,9 +1217,9 @@ dependencies = [

 [[package]]
 name = "slab"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9def91fd1e018fe007022791f865d0ccc9b3a0d5001e01aabb8b40e46000afb5"
+checksum = "eb703cfe953bccee95685111adeedb76fabe4e97549a58d16f03ea7b9367bb32"

 [[package]]
 name = "smallvec"
@ -1221,9 +1229,9 @@ checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"

 [[package]]
 name = "syn"
-version = "1.0.88"
+version = "1.0.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebd69e719f31e88618baa1eaa6ee2de5c9a1c004f1e9ecdb58e8352a13f20a01"
+checksum = "704df27628939572cd88d33f171cd6f896f4eaca85252c6e0a72d8d8287ee86f"
 dependencies = [
 "proc-macro2",
 "quote",
@ -1376,6 +1384,7 @@ dependencies = [
 name = "vm_control"
 version = "0.1.0"
 dependencies = [
+ "balloon_control",
 "base",
 "data_model",
 "gdbstub_arch",
@ -1426,9 +1435,9 @@ checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"

 [[package]]
 name = "which"
-version = "4.2.4"
+version = "4.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a5a7e487e921cf220206864a94a89b6c6905bfc19f1057fa26a4cb360e5c1d2"
+checksum = "5c4fb54e6113b6a8772ee41c3404fb0301ac79604489467e0a9ce1f3e97c24ae"
 dependencies = [
 "either",
 "lazy_static",
--- a/pkgs/applications/virtualization/crosvm/generate-cargo.sh
+++ b/pkgs/applications/virtualization/crosvm/generate-cargo.sh
@ -0,0 +1,7 @@
+dir="$(mktemp -d)" &&
+    cd "$dir" &&
+    unpackPhase &&
+    cd "${sourceRoot:-}" &&
+    cargo generate-lockfile &&
+    mv Cargo.lock "$1"
+rm -rf "$dir"
--- a/pkgs/applications/virtualization/crosvm/update.py
+++ b/pkgs/applications/virtualization/crosvm/update.py
@ -5,9 +5,10 @@
 import base64
 import json
 import re
+import shlex
 import subprocess
 from codecs import iterdecode
-from os.path import dirname, splitext
+from os.path import abspath, dirname, splitext
 from lxml import etree
 from lxml.etree import HTMLParser
 from urllib.request import urlopen
@ -78,7 +79,14 @@ argv = ['nix-instantiate', '--eval', '--json', '-A', 'crosvm.meta.position']
 position = json.loads(subprocess.check_output(argv).decode('utf-8'))
 filename = re.match(r'[^:]*', position)[0]

-# Finally, write the output.
+# Write the output.
 with open(dirname(filename) + '/upstream-info.json', 'w') as out:
    json.dump(data, out, indent=2)
    out.write('\n')
+
+# Generate a Cargo.lock
+run = ['.',
+       dirname(abspath(__file__)) + '/generate-cargo.sh',
+       dirname(filename) + '/Cargo.lock']
+expr = '(import ./. {}).crosvm.overrideAttrs (_: { dontCargoSetupPostUnpack = true; })'
+subprocess.run(['nix-shell', '-E', expr, '--run', shlex.join(run)])
--- a/pkgs/applications/virtualization/crosvm/upstream-info.json
+++ b/pkgs/applications/virtualization/crosvm/upstream-info.json
@ -1,11 +1,11 @@
 {
-  "version": "99.14468.0.0-rc1",
+  "version": "100.14526.0.0-rc1",
  "src": {
    "url": "https://chromium.googlesource.com/chromiumos/platform/crosvm",
-    "rev": "410ea3a1980bfe96968a7dfb7a7d203d43b186b2",
-    "date": "2022-01-11T00:01:17-08:00",
-    "path": "/nix/store/y2rpzh1any8c4nwnwkvir7241kbcj8fn-crosvm-410ea3a",
-    "sha256": "1bgwndh2f60ka1f8c8yqnqqkra510ai9miyfvvm0b3dnsdpy77kd",
+    "rev": "bdf5e4d4379030cfa2d0510328b8acce73162217",
+    "date": "2022-02-14T19:13:41+00:00",
+    "path": "/nix/store/xw31chiwnpzgcp07nf448g2npcwiwkkm-crosvm-bdf5e4d",
+    "sha256": "0mrnjyyqmz24z1yvdq2mysmhmz0577k8kf9y4v51g7860crqp9ji",
    "fetchLFS": false,
    "fetchSubmodules": true,
    "deepClone": false,
--- a/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome/core/epiphany/default.nix
@ -40,11 +40,11 @@

 stdenv.mkDerivation rec {
  pname = "epiphany";
-  version = "42.0";
+  version = "42.1";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Pb+owA5Ft/ROGCTQHw/r6DcHtfuTMMJhFz9ot/A81eM=";
+    sha256 = "aKzDxcYpF/G0ORaltGvsE29bMH8DqtpY23QMeLED8Dg=";
  };

  patches = lib.optionals withPantheon [
--- a/pkgs/desktops/gnome/default.nix
+++ b/pkgs/desktops/gnome/default.nix
@ -3,21 +3,6 @@
 lib.makeScope pkgs.newScope (self: with self; {
  updateScript = callPackage ./update.nix { };

-  /* Remove packages of packagesToRemove from packages, based on their names
-
-     Type:
-       removePackagesByName :: [package] -> [package] -> [package]
-
-     Example:
-       removePackagesByName [ nautilus file-roller ] [ file-roller totem ]
-       => [ nautilus ]
-  */
-  removePackagesByName = packages: packagesToRemove:
-    let
-      namesToRemove = map lib.getName packagesToRemove;
-    in
-      lib.filter (x: !(builtins.elem (lib.getName x) namesToRemove)) packages;
-
  libsoup = pkgs.libsoup.override { gnomeSupport = true; };
  libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };

--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@ -55,11 +55,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.18";
+  version = "1.18.1";

  src = fetchurl {
    url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-OPQj20zINIg/K1I0QoL6ejn7uTZQ3GKhH98L5kCb2tY=";
+    sha256 = "sha256-79Q+DxQC4IO3OgPURLe2V2u0xTmsRiCLY6kWtprKQIg=";
  };

  # perl is used for testing go vet
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@ -84,7 +84,7 @@ let
    # TODO: make this unconditional
  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    "address-model=${toString stdenv.hostPlatform.parsed.cpu.bits}"
-    "architecture=${toString stdenv.hostPlatform.parsed.cpu.family}"
+    "architecture=${if stdenv.hostPlatform.isMips64 then "mips64" else toString stdenv.hostPlatform.parsed.cpu.family}"
    "binary-format=${toString stdenv.hostPlatform.parsed.kernel.execFormat.name}"
    "target-os=${toString stdenv.hostPlatform.parsed.kernel.name}"

@ -92,7 +92,8 @@ let
    # https://www.boost.org/doc/libs/1_66_0/libs/context/doc/html/context/architectures.html
    "abi=${if stdenv.hostPlatform.parsed.cpu.family == "arm" then "aapcs"
           else if stdenv.hostPlatform.isWindows then "ms"
-           else if stdenv.hostPlatform.isMips then "o32"
+           else if stdenv.hostPlatform.isMips32 then "o32"
+           else if stdenv.hostPlatform.isMips64n64 then "n64"
           else "sysv"}"
  ] ++ optional (link != "static") "runtime-link=${runtime-link}"
    ++ optional (variant == "release") "debug-symbols=off"
@ -133,6 +134,13 @@ stdenv.mkDerivation {
      sha256 = "15d2a636hhsb1xdyp44x25dyqfcaws997vnp9kl1mhzvxjzz7hb0";
      stripLen = 1;
    })
+  ++ optional (versionAtLeast version "1.65" && versionOlder version "1.70") (fetchpatch {
+    # support for Mips64n64 appeared in boost-context 1.70; this patch won't apply to pre-1.65 cleanly
+    url = "https://github.com/boostorg/context/commit/e3f744a1862164062d579d1972272d67bdaa9c39.patch";
+    sha256 = "sha256-qjQy1b4jDsIRrI+UYtcguhvChrMbGWO0UlEzEJHYzRI=";
+    stripLen = 1;
+    extraPrefix = "libs/context/";
+  })
  ++ optional (and (versionAtLeast version "1.70") (!versionAtLeast version "1.73")) ./cmake-paths.patch
  ++ optional (versionAtLeast version "1.73") ./cmake-paths-173.patch
  ++ optional (version == "1.77.0") (fetchpatch {
@ -150,6 +158,14 @@ stdenv.mkDerivation {
                 ++ optional ((versionOlder version "1.57") || version == "1.58") "x86_64-darwin"
                 ++ optionals (versionOlder version "1.73") lib.platforms.riscv;
    maintainers = with maintainers; [ hjones2199 ];
+
+    broken =
+      # boost-context lacks support for the N32 ABI on mips64.  The build
+      # will succeed, but packages depending on boost-context will fail with
+      # a very cryptic error message.
+      stdenv.hostPlatform.isMips64n32 ||
+      # the patch above does not apply cleanly to pre-1.65 boost
+      (stdenv.hostPlatform.isMips64n64 && (versionOlder version "1.65"));
  };

  preConfigure = optionalString useMpi ''
--- a/pkgs/development/libraries/protobuf/2.5.nix
+++ b/pkgs/development/libraries/protobuf/2.5.nix
@ -1,10 +0,0 @@
-{ callPackage, fetchurl, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "2.5.0";
-  # make sure you test also -A pythonPackages.protobuf
-  src = fetchurl {
-    url = "http://protobuf.googlecode.com/files/${version}.tar.bz2";
-    sha256 = "0xxn9gxhvsgzz2sgmihzf6pf75clr05mqj6218camwrwajpcbgqk";
-  };
-})
--- a/pkgs/development/libraries/protobuf/generic.nix
+++ b/pkgs/development/libraries/protobuf/generic.nix
@ -1,61 +0,0 @@
-{ lib, stdenv, version, src
-, autoreconfHook, zlib, gtest
-, ...
-}:
-
-stdenv.mkDerivation {
-  pname = "protobuf";
-  inherit version;
-
-  inherit src;
-
-  postPatch = ''
-    rm -rf gtest
-    cp -r ${gtest.src}/googletest gtest
-    chmod -R a+w gtest
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace src/google/protobuf/testing/googletest.cc \
-      --replace 'tmpnam(b)' '"'$TMPDIR'/foo"'
-  '';
-
-  outputs = [ "out" "lib" ];
-
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ zlib ];
-
-  # The generated C++ code uses static initializers which mutate a global data
-  # structure. This causes problems for an executable when:
-  #
-  # 1) it dynamically links to two libs, both of which contain generated C++ for
-  #    the same proto file, and
-  # 2) the two aforementioned libs both dynamically link to libprotobuf.
-  #
-  # One solution is to statically link libprotobuf, that way the global
-  # variables are not shared; in fact, this is necessary for the python Mesos
-  # binding to not crash, as the python lib contains two C extensions which
-  # both refer to the same proto schema.
-  #
-  # See: https://github.com/NixOS/nixpkgs/pull/19064#issuecomment-255082684
-  #      https://github.com/google/protobuf/issues/1489
-  dontDisableStatic = true;
-  configureFlags = [
-    "CFLAGS=-fPIC"
-    "CXXFLAGS=-fPIC"
-  ];
-
-  doCheck = true;
-
-  meta = {
-    description = "Protocol Buffers - Google's data interchange format";
-    longDescription =
-      '' Protocol Buffers are a way of encoding structured data in an
-         efficient yet extensible format.  Google uses Protocol Buffers for
-         almost all of its internal RPC protocols and file formats.
-      '';
-    license = "mBSD";
-    homepage = "https://developers.google.com/protocol-buffers/";
-    platforms = lib.platforms.unix;
-  };
-
-  passthru.version = version;
-}
--- a/pkgs/development/libraries/qca-qt5/2.3.2.nix
+++ b/pkgs/development/libraries/qca-qt5/2.3.2.nix
@ -0,0 +1,30 @@
+{ lib, stdenv, fetchurl, cmake, openssl, pkg-config, qtbase }:
+
+stdenv.mkDerivation rec {
+  pname = "qca-qt5";
+  version = "2.3.2";
+
+  src = fetchurl {
+    url = "http://download.kde.org/stable/qca/${version}/qca-${version}.tar.xz";
+    sha256 = "sha256-RpdgAjfEvDqXnofSzIBiTyewYoDmNfXZDsfdTSqfYG0=";
+  };
+
+  buildInputs = [ openssl qtbase ];
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  dontWrapQtApps = true;
+
+  # tells CMake to use this CA bundle file if it is accessible
+  preConfigure = "export QC_CERTSTORE_PATH=/etc/ssl/certs/ca-certificates.crt";
+
+  # tricks CMake into using this CA bundle file if it is not accessible (in a sandbox)
+  cmakeFlags = [ "-Dqca_CERTSTORE=/etc/ssl/certs/ca-certificates.crt" ];
+
+  meta = with lib; {
+    description = "Qt 5 Cryptographic Architecture";
+    homepage = "http://delta.affinix.com/qca";
+    maintainers = with maintainers; [ ttuegel ];
+    license = licenses.lgpl21Plus;
+    platforms = with platforms; unix;
+  };
+}
--- a/pkgs/development/libraries/qca-qt5/default.nix
+++ b/pkgs/development/libraries/qca-qt5/default.nix
@ -26,5 +26,8 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ ttuegel ];
    license = licenses.lgpl21Plus;
    platforms = with platforms; unix;
+    # until macOS SDK supports Qt 5.15, 2.3.2 is the highest version of qca-qt5
+    # that works on darwin
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/development/node-packages/default.nix
+++ b/pkgs/development/node-packages/default.nix
@ -459,6 +459,14 @@ let
      '';
    });

+    ts-node = super.ts-node.overrideAttrs (oldAttrs: {
+      buildInputs = oldAttrs.buildInputs ++ [ pkgs.makeWrapper ];
+      postInstall = ''
+        wrapProgram "$out/bin/ts-node" \
+        --prefix NODE_PATH : ${self.typescript}/lib/node_modules
+      '';
+    });
+
    typescript = super.typescript.overrideAttrs (oldAttrs: {
      meta = oldAttrs.meta // { mainProgram = "tsc"; };
    });
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -347,6 +347,7 @@
 , "titanium"
 , "triton"
 , "tsun"
+, "ts-node"
 , "ttf2eot"
 , "typescript"
 , "typescript-language-server"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "appthreat-vulnerability-db";
-  version = "2.0.1";
+  version = "2.0.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,8 +22,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "AppThreat";
    repo = "vulnerability-db";
-    rev = "v${version}";
-    sha256 = "sha256-fqpBnxcRBBXsjJepxDuoDbT3hk5rXAvky11sIvQS9XI=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Ozf3qmD9JRH19N/eERhDHz4LUoWwCVepLbSRCg6lWnQ=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/apycula/default.nix
+++ b/pkgs/development/python-modules/apycula/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "apycula";
-  version = "0.3";
+  version = "0.3.1";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -20,7 +20,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit version;
    pname = "Apycula";
-    hash = "sha256-Ncecrn5fQW0iAgrE3P7GZTx8E1TiFqiDMhZQSPrDvdk=";
+    hash = "sha256-RoWZt2Ox0XjJ6vmuCCcNCTMfwZnwJ6fSx71fmipmu2c=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/chex/default.nix
+++ b/pkgs/development/python-modules/chex/default.nix
@ -12,16 +12,14 @@

 buildPythonPackage rec {
  pname = "chex";
-  # As of 2021-12-29, the latest official version has broken tests with jax 0.2.26:
-  # `AttributeError: module 'jax.interpreters.xla' has no attribute 'xb'`
-  version = "unstable-2021-12-16";
+  version = "0.1.2";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "deepmind";
    repo = pname;
-    rev = "5adc10e0b4218f8ec775567fca38b68bbad42a3a";
-    sha256 = "00xib6zv9pwid2q7wcr109qj3fa3g3b852skz8444kw7r0qxy7z3";
+    rev = "v${version}";
+    hash = "sha256-NtZYOHByKBcKmhRaNULwaQqxfoPRmgbtJ3cFHNfy4E8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dm-haiku/default.nix
+++ b/pkgs/development/python-modules/dm-haiku/default.nix
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "deepmind";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-qvKMeGPiWXvvyV+GZdTWdsC6Wp08AmP8nDtWk7sZtqM=";
+    hash = "sha256-qvKMeGPiWXvvyV+GZdTWdsC6Wp08AmP8nDtWk7sZtqM=";
  };

  propagatedBuildInputs = [
@ -32,6 +32,7 @@ buildPythonPackage rec {
  checkInputs = [
    chex
    cloudpickle
+    dill
    dm-tree
    jaxlib
    pytest-xdist
@ -55,6 +56,11 @@ buildPythonPackage rec {
    "haiku/_src/integration/jax2tf_test.py"
  ];

+  disabledTests = [
+    # See https://github.com/deepmind/dm-haiku/issues/366.
+    "test_jit_Recurrent"
+  ];
+
  meta = with lib; {
    description = "Haiku is a simple neural network library for JAX developed by some of the authors of Sonnet.";
    homepage = "https://github.com/deepmind/dm-haiku";
--- a/pkgs/development/python-modules/geocachingapi/default.nix
+++ b/pkgs/development/python-modules/geocachingapi/default.nix
@ -3,19 +3,23 @@
 , backoff
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 , setuptools-scm
 , yarl
 }:

 buildPythonPackage rec {
  pname = "geocachingapi";
-  version = "0.1.0";
+  version = "0.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "Sholofly";
    repo = "geocachingapi-python";
-    rev = version;
-    sha256 = "1vdknsxd7rvw6g5lwxlxj97l9ic8cch8rdki3aczs6xzw5adxhcs";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-Aj1fZ0dGlV7ynoZ7QwGrbku+IpOCx85wE19JDJaaYmc=";
  };

  nativeBuildInputs = [
@ -33,7 +37,9 @@ buildPythonPackage rec {
  # Tests require a token and network access
  doCheck = false;

-  pythonImportsCheck = [ "geocachingapi" ];
+  pythonImportsCheck = [
+    "geocachingapi"
+  ];

  meta = with lib; {
    description = "Python API to control the Geocaching API";
--- a/pkgs/development/python-modules/luxtronik/default.nix
+++ b/pkgs/development/python-modules/luxtronik/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "luxtronik";
-  version = "0.3.11";
+  version = "0.3.12";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "Bouni";
    repo = "python-luxtronik";
    rev = version;
-    sha256 = "sha256-pngtkEuWmOD1MG7/Bh+8iqCxU0l/fGHA8uZxYoxOE5Y=";
+    sha256 = "sha256-qQwMahZ3EzXzI7FyTL71WzDpLqmIgVYxiJ0IGvlw8dY=";
  };

  # Project has no tests
--- a/pkgs/development/python-modules/magicgui/default.nix
+++ b/pkgs/development/python-modules/magicgui/default.nix
@ -9,20 +9,29 @@
 , pyside2
 , psygnal
 , docstring-parser
+, napari # a reverse-dependency, for tests
 }: buildPythonPackage rec {
  pname = "magicgui";
  version = "0.3.7";
+
+  format = "pyproject";
+
  src = fetchFromGitHub {
    owner = "napari";
    repo = "magicgui";
    rev = "v${version}";
    sha256 = "sha256-LYXNNr5lS3ibQk2NIopZkB8kzC7j3yY8moGMk0Gr+hU=";
  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
  nativeBuildInputs = [ setuptools-scm ];
  propagatedBuildInputs = [ typing-extensions qtpy pyside2 psygnal docstring-parser ];
  checkInputs = [ pytestCheckHook pytest-mypy-plugins ];
+
  doCheck = false; # Reports "Fatal Python error"
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  passthru.tests = { inherit napari; };

  meta = with lib; {
    description = "Build GUIs from python functions, using magic.  (napari/magicgui)";
--- a/pkgs/development/python-modules/napari-npe2/default.nix
+++ b/pkgs/development/python-modules/napari-npe2/default.nix
@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, appdirs
+, pyyaml
+, pytomlpp
+, pydantic
+, magicgui
+, typer
+, setuptools-scm
+, napari # reverse dependency, for tests
+}:
+
+let
+  pname = "napari-npe2";
+  version = "0.3.0";
+in
+buildPythonPackage {
+  inherit pname version;
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "napari";
+    repo = "npe2";
+    rev = "v${version}";
+    hash = "sha256-IyDUeztWQ8JWXDo//76iHzAlWWaZP6/0lwCh0eZAZsM=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    # npe2 *can* build without it,
+    # but then setuptools refuses to acknowledge it when building napari
+    setuptools-scm
+  ];
+  propagatedBuildInputs = [
+    appdirs
+    pyyaml
+    pytomlpp
+    pydantic
+    magicgui
+    typer
+  ];
+
+  passthru.tests = { inherit napari; };
+
+  meta = with lib; {
+    description = "Yet another plugin system for napari (the image visualizer)";
+    homepage = "https://github.com/napari/npe2";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ SomeoneSerge ];
+  };
+}
--- a/pkgs/development/python-modules/napari/default.nix
+++ b/pkgs/development/python-modules/napari/default.nix
@ -6,7 +6,7 @@
 , superqt
 , typing-extensions
 , tifffile
-, napari-plugin-engine
+, napari-npe2
 , pint
 , pyyaml
 , numpydoc
@ -29,15 +29,24 @@
 }: mkDerivationWith buildPythonPackage rec {
  pname = "napari";
  version = "0.4.14";
+
+  format = "pyproject";
+
  src = fetchFromGitHub {
    owner = "napari";
    repo = pname;
    rev = "v${version}";
    sha256 = "sha256-uDDj5dzsT4tRVV0Y+CYegiCpLM77XFaXEXEZXTnX808=";
  };
-  nativeBuildInputs = [ setuptools-scm wrapQtAppsHook ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+    wrapQtAppsHook
+  ];
  propagatedBuildInputs = [
-    napari-plugin-engine
+    napari-npe2
    cachey
    napari-svg
    napari-console
@ -60,7 +69,7 @@
    jsonschema
    scipy
  ];
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
  dontUseSetuptoolsCheck = true;
  postFixup = ''
    wrapQtApp $out/bin/napari
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "openai";
-  version = "0.16.0";
+  version = "0.18.0";

  disabled = pythonOlder "3.7.1";

@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "openai";
    repo = "openai-python";
    rev = "v${version}";
-    sha256 = "sha256-9BxFOiGIf3Cy7OU0as6onV5ltECInM9wwCr+qCMuPbU=";
+    sha256 = "sha256-MC3xTiQJrUyfRbnv7jigIal3/paK08bzy+mJI/j7fxo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "pex";
-  version = "2.1.78";
+  version = "2.1.79";
  format = "flit";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-1bWAEMMBjmyLS1W+VWgD9BsZq5f0DmEOQryXH9vupCY=";
+    hash = "sha256-XIqof/RZL1dmfPU6NVtkf18zrkG5RPOesGfsDDrPhQ8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@ -6,12 +6,12 @@

 buildPythonPackage rec {
  pname = "phonenumbers";
-  version = "8.12.44";
+  version = "8.12.46";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-Js/QJX0XBP4viMr/LKq7cNFqh3seZbaq5R+fu+EKqM4=";
+    sha256 = "sha256-HEQPYzbLSYk/8agybHC032k4Aq6YHyEPVFzUIVrEgTM=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/renault-api/default.nix
+++ b/pkgs/development/python-modules/renault-api/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "renault-api";
-  version = "0.1.10";
+  version = "0.1.11";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "hacf-fr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-PXycRRUrKIkU/MgQbW4BjvBhpEi6InY5jZHPw4Nyv2s=";
+    sha256 = "sha256-71UFVXfww3wgSO2qoRCuV80+33B91Bjl2+nuuCbQRLg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/rtsp-to-webrtc/default.nix
+++ b/pkgs/development/python-modules/rtsp-to-webrtc/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "rtsp-to-webrtc";
-  version = "0.5.0";
+  version = "0.5.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "allenporter";
    repo = "rtsp-to-webrtc-client";
    rev = version;
-    hash = "sha256-ry6xNymWgkkvYXliVLUFOUiPz8gbCsQDrSuGmCaH4ZE=";
+    hash = "sha256-miMBN/8IO4v03mMoclCa3GFl6HCS3Sh6z2HOQ39MRZY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/shiboken2/default.nix
+++ b/pkgs/development/python-modules/shiboken2/default.nix
@ -34,6 +34,6 @@ stdenv.mkDerivation {
    license = with licenses; [ gpl2 lgpl21 ];
    homepage = "https://wiki.qt.io/Qt_for_Python";
    maintainers = with maintainers; [ gebner ];
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin || python.isPy310;
  };
 }
--- a/pkgs/development/python-modules/tensorflow-datasets/default.nix
+++ b/pkgs/development/python-modules/tensorflow-datasets/default.nix
@ -9,6 +9,8 @@
 , future
 , imagemagick
 , importlib-resources
+, jax
+, jaxlib
 , jinja2
 , langdetect
 , lib
@ -78,6 +80,8 @@ buildPythonPackage rec {
    beautifulsoup4
    ffmpeg
    imagemagick
+    jax
+    jaxlib
    jinja2
    langdetect
    matplotlib
@ -119,6 +123,9 @@ buildPythonPackage rec {
    # Requires `tensorflow_io` which is not packaged in `nixpkgs`.
    "tensorflow_datasets/image/lsun_test.py"

+    # Requires `envlogger` which is not packaged in `nixpkgs`.
+    "tensorflow_datasets/rlds/robosuite_panda_pick_place_can/robosuite_panda_pick_place_can_test.py"
+
    # Fails with `TypeError: Constant constructor takes either 0 or 2 positional arguments`
    # deep in TF AutoGraph. Doesn't reproduce in Docker with Ubuntu 22.04 => might be related
    # to the differences in some of the dependencies?
--- a/pkgs/development/python-modules/tldextract/default.nix
+++ b/pkgs/development/python-modules/tldextract/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname   = "tldextract";
-  version = "3.2.0";
+  version = "3.2.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-PUtqIQVgC30CkOoje/MLaw3HY+UPy+QOhJoBm9bby/8=";
+    sha256 = "sha256-rJMEzfgLCcN+6pZXmeDZrAqhzLZTH65Uiqvgm68aJUk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/zha-quirks/default.nix
+++ b/pkgs/development/python-modules/zha-quirks/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "zha-quirks";
-  version = "0.0.69";
+  version = "0.0.72";

  src = fetchFromGitHub {
    owner = "zigpy";
    repo = "zha-device-handlers";
    rev = version;
-    sha256 = "sha256-qPqgla+NFtZ85i+GB0lRRsoNImVghJsJfww7j8yQcFs=";
+    sha256 = "sha256-tVCvmQR9tGhSDB4OztNaSCj2BTxPdrX3Gw9WZopRo8k=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "zigpy";
-  version = "0.44.1";
+  version = "0.44.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "zigpy";
    repo = "zigpy";
    rev = version;
-    sha256 = "sha256-7X3uaxzvVMhSucCGA+rZsgt+fJSNjYQkJLpCGyHOIlc=";
+    sha256 = "sha256-E6SeuVu5UdWL5Tx39UQymNhABltR+qVHANYWuCh+h6I=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/appthreat-depscan/default.nix
+++ b/pkgs/development/tools/appthreat-depscan/default.nix
@ -5,13 +5,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "appthreat-depscan";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchFromGitHub {
    owner = "AppThreat";
    repo = "dep-scan";
-    rev = "v${version}";
-    hash = "sha256-hRmTx0qs/QnDLl4KhGbKw5Mucq4wQCaCIkeObrZlJSI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6ifpPNBcqaNGVQjZQ3G48QuwTRRn4zL3awa06yOeveU=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
@ -26,12 +26,12 @@
 }:

 let
-  version = "5.0.0";
+  version = "5.1.1";
  sourceRoot = ".";

  src = fetchurl {
    url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    sha256 = "By3WLSN9vBHgusAuEY2MLbTQujugnxoOseKkYPuEGds=";
+    sha256 = "f107wdNEaSskAPN2X9S1wLY26056insXkjCVx7VqT3g=";
  };

  # Update with `eval $(nix-build -A bazel.updater)`,
--- a/pkgs/development/tools/build-managers/bazel/bazel_5/src-deps.json
+++ b/pkgs/development/tools/build-managers/bazel/bazel_5/src-deps.json
@ -15,6 +15,14 @@
            "https://github.com/bazelbuild/stardoc/archive/1ef781ced3b1443dca3ed05dec1989eca1a4e1cd.tar.gz"
        ]
    },
+    "20211102.0.tar.gz": {
+        "name": "20211102.0.tar.gz",
+        "sha256": "dcf71b9cba8dc0ca9940c4b316a0c796be8fab42b070bb6b7cab62b48f0e66c4",
+        "urls": [
+            "https://mirror.bazel.build/github.com/abseil/abseil-cpp/archive/refs/tags/20211102.0.tar.gz",
+            "https://github.com/abseil/abseil-cpp/archive/refs/tags/20211102.0.tar.gz"
+        ]
+    },
    "2de300726a1ba2de9a468468dc5ff9ed17a3215f.tar.gz": {
        "name": "2de300726a1ba2de9a468468dc5ff9ed17a3215f.tar.gz",
        "sha256": "6a5f67874af66b239b709c572ac1a5a00fdb1b29beaf13c3e6f79b1ba10dc7c4",
@ -47,14 +55,6 @@
            "https://github.com/bazelbuild/rules_proto/archive/7e4afce6fe62dbff0a4a03450143146f9f2d7488.tar.gz"
        ]
    },
-    "997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz": {
-        "name": "997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz",
-        "sha256": "35f22ef5cb286f09954b7cc4c85b5a3f6221c9d4df6b8c4a1e9d399555b366ee",
-        "urls": [
-            "https://mirror.bazel.build/github.com/abseil/abseil-cpp/archive/997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz",
-            "https://github.com/abseil/abseil-cpp/archive/997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz"
-        ]
-    },
    "aecba11114cf1fac5497aeb844b6966106de3eb6.tar.gz": {
        "name": "aecba11114cf1fac5497aeb844b6966106de3eb6.tar.gz",
        "sha256": "9f385e146410a8150b6f4cb1a57eab7ec806ced48d427554b1e754877ff26c3e",
@ -282,7 +282,8 @@
            "-p1"
        ],
        "patches": [
-            "//third_party/grpc:grpc_1.41.0.patch"
+            "//third_party/grpc:grpc_1.41.0.patch",
+            "//third_party/grpc:grpc_1.41.0.win_arm64.patch"
        ],
        "sha256": "e5fb30aae1fa1cffa4ce00aa0bbfab908c0b899fcf0bbc30e268367d660d8656",
        "strip_prefix": "grpc-1.41.0",
@ -292,14 +293,14 @@
        ]
    },
    "com_google_absl": {
-        "generator_function": "grpc_deps",
+        "generator_function": "dist_http_archive",
        "generator_name": "com_google_absl",
        "name": "com_google_absl",
-        "sha256": "35f22ef5cb286f09954b7cc4c85b5a3f6221c9d4df6b8c4a1e9d399555b366ee",
-        "strip_prefix": "abseil-cpp-997aaf3a28308eba1b9156aa35ab7bca9688e9f6",
+        "sha256": "dcf71b9cba8dc0ca9940c4b316a0c796be8fab42b070bb6b7cab62b48f0e66c4",
+        "strip_prefix": "abseil-cpp-20211102.0",
        "urls": [
-            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/abseil/abseil-cpp/archive/997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz",
-            "https://github.com/abseil/abseil-cpp/archive/997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz"
+            "https://mirror.bazel.build/github.com/abseil/abseil-cpp/archive/refs/tags/20211102.0.tar.gz",
+            "https://github.com/abseil/abseil-cpp/archive/refs/tags/20211102.0.tar.gz"
        ]
    },
    "com_google_googleapis": {
@ -772,6 +773,13 @@
            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-4.2.1.tar"
        ]
    },
+    "microsoft-jdk-11.0.13.8.1-windows-aarch64.zip": {
+        "name": "microsoft-jdk-11.0.13.8.1-windows-aarch64.zip",
+        "sha256": "b8a28e6e767d90acf793ea6f5bed0bb595ba0ba5ebdf8b99f395266161e53ec2",
+        "urls": [
+            "https://mirror.bazel.build/aka.ms/download-jdk/microsoft-jdk-11.0.13.8.1-windows-aarch64.zip"
+        ]
+    },
    "opencensus_proto": {
        "generator_function": "grpc_deps",
        "generator_name": "opencensus_proto",
@ -820,6 +828,15 @@
            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-win_x64.zip"
        ]
    },
+    "openjdk11_windows_arm64_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk11_windows_arm64_archive",
+        "sha256": "b8a28e6e767d90acf793ea6f5bed0bb595ba0ba5ebdf8b99f395266161e53ec2",
+        "strip_prefix": "jdk-11.0.13+8",
+        "urls": [
+            "https://mirror.bazel.build/aka.ms/download-jdk/microsoft-jdk-11.0.13.8.1-windows-aarch64.zip"
+        ]
+    },
    "openjdk15_darwin_aarch64_archive": {
        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
        "name": "openjdk15_darwin_aarch64_archive",
@ -940,6 +957,18 @@
            "https://cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-win_x64.zip"
        ]
    },
+    "openjdk17_windows_arm64_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "generator_function": "dist_http_archive",
+        "generator_name": "openjdk17_windows_arm64_archive",
+        "name": "openjdk17_windows_arm64_archive",
+        "sha256": "811d7e7591bac4f081dfb00ba6bd15b6fc5969e1f89f0f327ef75147027c3877",
+        "strip_prefix": "zulu17.30.15-ca-jdk17.0.1-win_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip"
+        ]
+    },
    "openjdk_linux": {
        "downloaded_file_path": "zulu-linux.tar.gz",
        "name": "openjdk_linux",
@ -1063,6 +1092,14 @@
            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-win_x64-allmodules-b23d4e05466f2aa1fdcd72d3d3a8e962206b64bf-1581689080.zip"
        ]
    },
+    "openjdk_win_arm64_vanilla": {
+        "downloaded_file_path": "zulu-win-arm64.zip",
+        "name": "openjdk_win_arm64_vanilla",
+        "sha256": "811d7e7591bac4f081dfb00ba6bd15b6fc5969e1f89f0f327ef75147027c3877",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip"
+        ]
+    },
    "openjdk_win_minimal": {
        "downloaded_file_path": "zulu-win-minimal.zip",
        "name": "openjdk_win_minimal",
@ -1472,6 +1509,25 @@
            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-win_x64.zip"
        ]
    },
+    "remotejdk11_win_arm64_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "generator_function": "dist_http_archive",
+        "generator_name": "remotejdk11_win_arm64_for_testing",
+        "name": "remotejdk11_win_arm64_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "b8a28e6e767d90acf793ea6f5bed0bb595ba0ba5ebdf8b99f395266161e53ec2",
+        "strip_prefix": "jdk-11.0.13+8",
+        "urls": [
+            "https://mirror.bazel.build/aka.ms/download-jdk/microsoft-jdk-11.0.13.8.1-windows-aarch64.zip"
+        ]
+    },
    "remotejdk11_win_for_testing": {
        "build_file": "@local_jdk//:BUILD.bazel",
        "name": "remotejdk11_win_for_testing",
@ -1768,6 +1824,26 @@
            "https://cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-macosx_x64.tar.gz"
        ]
    },
+    "remotejdk17_win_arm64_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "generator_function": "dist_http_archive",
+        "generator_name": "remotejdk17_win_arm64_for_testing",
+        "name": "remotejdk17_win_arm64_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "811d7e7591bac4f081dfb00ba6bd15b6fc5969e1f89f0f327ef75147027c3877",
+        "strip_prefix": "zulu17.30.15-ca-jdk17.0.1-win_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip"
+        ]
+    },
    "remotejdk17_win_for_testing": {
        "build_file": "@local_jdk//:BUILD.bazel",
        "name": "remotejdk17_win_for_testing",
@ -1986,5 +2062,13 @@
        "urls": [
            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-win_x64.zip"
        ]
+    },
+    "zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip": {
+        "name": "zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip",
+        "sha256": "811d7e7591bac4f081dfb00ba6bd15b6fc5969e1f89f0f327ef75147027c3877",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip"
+        ]
    }
 }
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
@ -3,16 +3,16 @@
  nixosTests }:
 buildGoModule rec {
  pname = "buildkite-agent";
-  version = "3.35.1";
+  version = "3.35.2";

  src = fetchFromGitHub {
    owner = "buildkite";
    repo = "agent";
    rev = "v${version}";
-    sha256 = "sha256-fa32tKOlRuKTONiMboX7CUxeknePsNRC7jlBvAtXmus=";
+    sha256 = "sha256-BpfWeSEX4N77yXfWKpH7KWKsncdOYquxF+L+g13DdiA=";
  };

-  vendorSha256 = "sha256-YnOOJDzdirikFbS9451A/TWOSWv04QsqO68/cSXK82k=";
+  vendorSha256 = "sha256-E51LBpNN/N3wH1LMxv/+nnwpQAxHhyDW2jgVIDkNeQ4=";

  postPatch = ''
    substituteInPlace bootstrap/shell/shell.go --replace /bin/bash ${bash}/bin/bash
--- a/pkgs/development/tools/continuous-integration/dagger/default.nix
+++ b/pkgs/development/tools/continuous-integration/dagger/default.nix
@ -0,0 +1,28 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "dagger";
+  version = "0.2.6";
+
+  src = fetchFromGitHub {
+    owner = "dagger";
+    repo = "dagger";
+    rev = "v${version}";
+    sha256 = "sha256-3rkHWWpZGUL+7DoUtwY3v2tlcNXdbfVqs+u1wq3jNVI=";
+  };
+
+  vendorSha256 = "sha256-DKjVY2G+sG5CjwN262aZkH90fosuBCKHlB8sRbILjaI=";
+
+  subPackages = [
+    "cmd/dagger"
+  ];
+
+  ldflags = [ "-s" "-w" "-X go.dagger.io/dagger/version.Revision=${version}" ];
+
+  meta = with lib; {
+    description = "A portable devkit for CICD pipelines";
+    homepage = "https://dagger.io";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jfroche ];
+  };
+}
--- a/pkgs/development/tools/misc/pkgconf/default.nix
+++ b/pkgs/development/tools/misc/pkgconf/default.nix
@ -1,31 +1,35 @@
-{ lib, stdenv, fetchurl, removeReferencesTo }:
+{ lib
+, stdenv
+, fetchurl
+, removeReferencesTo
+}:

 stdenv.mkDerivation rec {
  pname = "pkgconf";
  version = "1.8.0";

-  nativeBuildInputs = [ removeReferencesTo ];
+  src = fetchurl {
+    url = "https://distfiles.dereferenced.org/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-75x+YYIrfLg1bm6eHcpY2VVvMgDXisqzXkNH6dTCu68=";
+  };

  outputs = [ "out" "lib" "dev" "man" "doc" ];

+  nativeBuildInputs = [ removeReferencesTo ];
+
  enableParallelBuilding = true;

-  src = fetchurl {
-    url = "https://distfiles.dereferenced.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-75x+YYIrfLg1bm6eHcpY2VVvMgDXisqzXkNH6dTCu68=";
-  };
-
-  # Debian has outputs like these too:
-  # https://packages.debian.org/source/buster/pkgconf, so take it this
-  # reference removing is safe.
+  # Debian has outputs like these too
+  # (https://packages.debian.org/source/bullseye/pkgconf), so it is safe to
+  # remove those references
  postFixup = ''
+    remove-references-to \
+      -t "${placeholder "out"}" \
+      "${placeholder "lib"}"/lib/*
    remove-references-to \
      -t "${placeholder "dev"}" \
      "${placeholder "lib"}"/lib/* \
      "${placeholder "out"}"/bin/*
-    remove-references-to \
-      -t "${placeholder "out"}" \
-      "${placeholder "lib"}"/lib/*
  ''
  # Move back share/aclocal. Yes, this normally goes in the dev output for good
  # reason, but in this case the dev output is for the `libpkgconf` library,
@ -37,10 +41,19 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
+    homepage = "https://github.com/pkgconf/pkgconf";
    description = "Package compiler and linker metadata toolkit";
-    homepage = "https://git.dereferenced.org/pkgconf/pkgconf";
-    platforms = platforms.all;
+    longDescription = ''
+      pkgconf is a program which helps to configure compiler and linker flags
+      for development libraries. It is similar to pkg-config from
+      freedesktop.org.
+
+      libpkgconf is a library which provides access to most of pkgconf's
+      functionality, to allow other tooling such as compilers and IDEs to
+      discover and use libraries configured by pkgconf.
+    '';
    license = licenses.isc;
-    maintainers = with maintainers; [ zaninime ];
+    maintainers = with maintainers; [ zaninime AndersonTorres ];
+    platforms = platforms.all;
  };
 }
--- a/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
+++ b/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
@ -0,0 +1,74 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, which
+, pkg-config
+, glib
+, gtk3
+, iw
+, makeWrapper
+, qrencode
+, hostapd }:
+
+stdenv.mkDerivation rec {
+  pname = "linux-wifi-hotspot";
+  version = "4.4.0";
+
+  src = fetchFromGitHub {
+    owner = "lakinduakash";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-XCgYWOX7QSdANG6DqYk0yZZqnvZGDl3GaF9KtYRmpJ0=";
+  };
+
+  nativeBuildInputs = [
+    which
+    pkg-config
+    makeWrapper
+    qrencode
+    hostapd
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+  ];
+
+  outputs = [ "out" ];
+
+  postPatch = ''
+    substituteInPlace ./src/scripts/Makefile \
+      --replace "etc" "$out/etc"
+    substituteInPlace ./src/scripts/wihotspot \
+      --replace "/usr" "$out"
+    substituteInPlace ./src/scripts/create_ap.service \
+      --replace "/usr/bin/create_ap" "$out/bin/create_cap" \
+      --replace "/etc/create_ap.conf" "$out/etc/create_cap.conf"
+  '';
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/create_ap \
+      --prefix PATH : ${lib.makeBinPath [ hostapd ]}
+
+    wrapProgram $out/bin/wihotspot-gui \
+      --prefix PATH : ${lib.makeBinPath [ iw ]} \
+      --prefix PATH : "${placeholder "out"}/bin"
+
+    wrapProgram $out/bin/wihotspot \
+      --prefix PATH : ${lib.makeBinPath [ iw ]} \
+      --prefix PATH : "${placeholder "out"}/bin"
+  '';
+
+  meta = with lib; {
+    description = "Feature-rich wifi hotspot creator for Linux which provides both GUI and command-line interface";
+    homepage = "https://github.com/lakinduakash/linux-wifi-hotspot";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ onny ];
+    platforms = platforms.unix;
+  };
+
+}
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2022.4.0";
+  version = "2022.4.3";
  components = {
    "abode" = ps: with ps; [
      abodepy
@ -2138,7 +2138,7 @@
    "remote" = ps: with ps; [
    ];
    "remote_rpi_gpio" = ps: with ps; [
-    ]; # missing inputs: gpiozero
+    ]; # missing inputs: gpiozero pigpio
    "renault" = ps: with ps; [
      renault-api
    ];
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -50,6 +50,9 @@ let
      hass-nabucasa = super.hass-nabucasa.overridePythonAttrs (oldAttrs: {
        doCheck = false; # requires aiohttp>=1.0.0
      });
+      rtsp-to-webrtc = super.rtsp-to-webrtc.overridePythonAttrs (oldAttrs: {
+        doCheck = false; # requires pytest-aiohttp>=1.0.0
+      });
      snitun = super.snitun.overridePythonAttrs (oldAttrs: {
        doCheck = false; # requires aiohttp>=1.0.0
      });
@ -58,19 +61,6 @@ let
      });
    })

-    (self: super: {
-      aioairzone = super.aioairzone.overridePythonAttrs (oldAttrs: rec {
-        version = "0.2.3";
-        src = fetchFromGitHub {
-          owner = "Noltari";
-          repo = "aioairzone";
-          rev = version;
-          hash = "sha256-vy6NqtlWv2El259rC+Nm0gs/rsY+s8xe7Z+wXvT1Ing=";
-        };
-      });
-    })
-
-
    (self: super: {
      huawei-lte-api = super.huawei-lte-api.overridePythonAttrs (oldAttrs: rec {
        version = "1.4.18";
@ -178,7 +168,7 @@ let
  extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.4.0";
+  hassVersion = "2022.4.3";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@ -196,7 +186,7 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = version;
-    hash = "sha256-b/YwcbcQuRIue4fr4+yF2EEXLvmnI7e3xfyz52flwJw=";
+    hash = "sha256-kubW0JhG9ervVHVl65YmD5jd/0oWenacAyfSP0EPmsU=";
  };

  # leave this in, so users don't have to constantly update their downstream patch handling
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@ -247,7 +247,7 @@ def main() -> None:
        f.write("  ];\n")
        f.write("}\n")

-    supported_components = reduce(lambda n, c: n + (build_inputs[c][1] == []),
+    supported_components = reduce(lambda n, c: n + (build_inputs[c][2] == []),
                                  components.keys(), 0)
    total_components = len(components)
    print(f"{supported_components} / {total_components} components supported, "
--- a/pkgs/servers/roundcube/plugins/carddav/default.nix
+++ b/pkgs/servers/roundcube/plugins/carddav/default.nix
@ -2,10 +2,10 @@

 roundcubePlugin rec {
  pname = "carddav";
-  version = "3.0.3";
+  version = "4.3.0";

  src = fetchzip {
-    url = "https://github.com/blind-coder/rcmcarddav/releases/download/v${version}/carddav-${version}.tar.bz2";
-    sha256 = "0scqxqfwv9r4ggaammmjp51mj50qc5p4jmjliwjvcwyjr36wjq3z";
+    url = "https://github.com/mstilkerich/rcmcarddav/releases/download/v${version}/carddav-v${version}.tar.gz";
+    sha256 = "1jk1whx155svfalf1kq8vavn7jsswmzx4ax5zbj01783rqyxkkd5";
  };
 }
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "syft";
-  version = "0.43.2";
+  version = "0.44.0";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-vGzS5Tpg+3f+ydsNbYza4FnCLBv6hMT3RGdlHrKjtfE=";
+    sha256 = "sha256-w5/lTGkwH6cLzbj6/ZUJyFtwx9EyA5Q7hs/CwtsdsJA=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/tools/audio/mpris-scrobbler/default.nix
+++ b/pkgs/tools/audio/mpris-scrobbler/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "mpris-scrobbler";
-  version = "0.4.0.1";
+  version = "0.4.90";

  src = fetchFromGitHub {
    owner  = "mariusor";
    repo   = "mpris-scrobbler";
    rev    = "v${version}";
-    sha256 = "0jzmgcb9a19hl8y7iwy8l3cc2vgzi0scw7r5q72kszfyxn0yk2gs";
+    sha256 = "sha256-+Y5d7yFOnSk2gQS/m/01ofbNeDCLXb+cTTlHj4bgO0M=";
  };

  postPatch = ''
--- a/pkgs/tools/filesystems/squashfs-tools-ng/default.nix
+++ b/pkgs/tools/filesystems/squashfs-tools-ng/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "squashfs-tools-ng";
-  version = "1.1.3";
+  version = "1.1.4";

  src = fetchurl {
    url = "https://infraroot.at/pub/squashfs/squashfs-tools-ng-${version}.tar.xz";
-    sha256 = "sha256-q84Pz5qK4cM1Lk5eh+Gwd/VEEdpRczLqg7XnzpSN1w0=";
+    sha256 = "06pnr3ilywqxch942l8xdg7k053xrqjkkziivx9h89bvy5j7hgvg";
  };

  nativeBuildInputs = [ doxygen graphviz pkg-config perl ];
--- a/pkgs/tools/graphics/quirc/0001-dont-build-demos.patch
+++ b/pkgs/tools/graphics/quirc/0001-dont-build-demos.patch
@ -0,0 +1,29 @@
+diff --git a/Makefile b/Makefile
+index 2d5b745..ecef988 100644
+--- a/Makefile
+++ b/Makefile
+@@ -37,7 +37,7 @@ DEMO_UTIL_OBJ = \
+ 
+ OPENCV_CFLAGS != pkg-config --cflags opencv4
+ OPENCV_LIBS != pkg-config --libs opencv4
+-QUIRC_CXXFLAGS = $(QUIRC_CFLAGS) $(OPENCV_CFLAGS) --std=c++17
+QUIRC_CXXFLAGS = $(QUIRC_CFLAGS) --std=c++17
+ 
+ .PHONY: all v4l sdl opencv install uninstall clean
+ 
+@@ -85,14 +85,11 @@ libquirc.so.$(LIB_VERSION): $(LIB_OBJ)
+ .cxx.o:
+ 	$(CXX) $(QUIRC_CXXFLAGS) -o $@ -c $<
+ 
+-install: libquirc.a libquirc.so.$(LIB_VERSION) quirc-demo quirc-scanner
+install: libquirc.a libquirc.so.$(LIB_VERSION)
+ 	install -o root -g root -m 0644 lib/quirc.h $(DESTDIR)$(PREFIX)/include
+ 	install -o root -g root -m 0644 libquirc.a $(DESTDIR)$(PREFIX)/lib
+ 	install -o root -g root -m 0755 libquirc.so.$(LIB_VERSION) \
+ 		$(DESTDIR)$(PREFIX)/lib
+-	install -o root -g root -m 0755 quirc-demo $(DESTDIR)$(PREFIX)/bin
+-	# install -o root -g root -m 0755 quirc-demo-opencv $(DESTDIR)$(PREFIX)/bin
+-	install -o root -g root -m 0755 quirc-scanner $(DESTDIR)$(PREFIX)/bin
+ 
+ uninstall:
+ 	rm -f $(DESTDIR)$(PREFIX)/include/quirc.h
--- a/pkgs/tools/graphics/quirc/default.nix
+++ b/pkgs/tools/graphics/quirc/default.nix
@ -1,24 +1,33 @@
-{ lib, stdenv, fetchFromGitHub
-, SDL_gfx, SDL, libjpeg, libpng, pkg-config
-}:
+{ lib, stdenv, fetchFromGitHub, SDL_gfx, SDL, libjpeg, libpng, opencv
+, pkg-config }:

 stdenv.mkDerivation {
  pname = "quirc";
-  version = "2020-04-16";
+  version = "2021-10-08";

  src = fetchFromGitHub {
    owner = "dlbeer";
    repo = "quirc";
-    rev = "ed455904f35270888bc902b9e8c0c9b3184a8302";
-    sha256 = "1kqqvcnxcaxdgls9sibw5pqjz3g1gys2v64i4kfqp8wfcgd9771q";
+    rev = "516d91a94d880ca1006fc1d57f318bdff8411f0d";
+    sha256 = "0jkaz5frm6jr9bxyfympvzh180nczrfvvb3z3qhk21djlas6nr5f";
  };

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ SDL SDL_gfx libjpeg libpng ];
+  buildInputs = [ SDL SDL_gfx libjpeg libpng opencv ];

  makeFlags = [ "PREFIX=$(out)" ];
  NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL -I${SDL_gfx}/include/SDL";

+  # Disable building of linux-only demos on darwin systems
+  patches = lib.optionals stdenv.isDarwin [ ./0001-dont-build-demos.patch ];
+
+  buildPhase = lib.optionalString stdenv.isDarwin ''
+    runHook preBuild
+    make libquirc.so
+    make qrtest
+    runHook postBuild
+  '';
+
  configurePhase = ''
    runHook preConfigure

@ -27,6 +36,7 @@ stdenv.mkDerivation {

    runHook postConfigure
  '';
+
  preInstall = ''
    mkdir -p "$out"/{bin,lib,include}

@ -37,7 +47,7 @@ stdenv.mkDerivation {
  meta = {
    description = "A small QR code decoding library";
    license = lib.licenses.isc;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.raskin ];
+    platforms = lib.platforms.linux ++ [ "x86_64-darwin" "aarch64-darwin" ];
  };
 }
--- a/pkgs/tools/misc/atuin/default.nix
+++ b/pkgs/tools/misc/atuin/default.nix
@ -26,15 +26,10 @@ rustPlatform.buildRustPackage rec {
  buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security SystemConfiguration ];

  postInstall = ''
-    HOME=$(mktemp -d)
-    for shell in bash fish zsh; do
-      $out/bin/atuin gen-completions -s $shell -o .
-    done
-
    installShellCompletion --cmd atuin \
-      --bash atuin.bash \
-      --fish atuin.fish \
-      --zsh _atuin
+      --bash <($out/bin/atuin gen-completions -s bash) \
+      --fish <($out/bin/atuin gen-completions -s fish) \
+      --zsh <($out/bin/atuin gen-completions -s zsh)
  '';

  meta = with lib; {
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@ -15,14 +15,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "broot";
-  version = "1.9.1";
+  version = "1.11.1";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-oIStnwbfp48QHkSlXgveH9AM2fmmrrSmwdvXxvbV/tg=";
+    sha256 = "sha256-MbyfdzeBo12/7M1F/J7upBQGB/tv1M4sZ+90i/vcLjs=";
  };

-  cargoHash = "sha256-DOPFVa2w+ldG7fnundBGb+jM0t2E2jS0nJIIzekD2QE=";
+  cargoHash = "sha256-GDU7tL+NDKk46DYnZajcAoPMZxGCrg/IS4xhSZrB6Cs=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/tools/misc/calamares/default.nix
+++ b/pkgs/tools/misc/calamares/default.nix
@ -6,12 +6,12 @@

 mkDerivation rec {
  pname = "calamares";
-  version = "3.2.54";
+  version = "3.2.55";

  # release including submodule
  src = fetchurl {
    url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-TfdLbDsjjPC/8BoEVm4mXePxQ8KX+9jgwKqUR1lcyOk=";
+    sha256 = "sha256-1xf02rjy6+83zbU2yxGUGjcIGJfYS8ryqi4CBzrh7kI=";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules ];
--- a/pkgs/tools/networking/telepresence2/default.nix
+++ b/pkgs/tools/networking/telepresence2/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "telepresence2";
-  version = "2.4.10";
+  version = "2.5.4";

  src = fetchFromGitHub {
    owner = "telepresenceio";
    repo = "telepresence";
    rev = "v${version}";
-    sha256 = "sha256-OM0kMQYYHjk17x4VmrIXyTq/DxXnTrt6oRHEdV+1+Ns=";
+    sha256 = "sha256-v6E1v89cVL4N8eKJ5pKU6BwQWZF5lLs4VLGhUS5J1rA=";
  };

  # The Helm chart is go:embed'ed as a tarball in the binary.
@ -21,7 +21,7 @@ buildGoModule rec {
    go run ./build-aux/package_embedded_chart/main.go ${src.rev}
  '';

-  vendorSha256 = "sha256-J7Qj0g479K6k0pXmZzQ3T4VG4Vdj7Sc9Xhuy4Ke/xkU=";
+  vendorSha256 = "sha256-RDXP7faijMujAV19l9NmI4xk0Js6DE5YZoHRo2GHyoU=";

  ldflags = [
    "-s" "-w" "-X=github.com/telepresenceio/telepresence/v2/pkg/version.Version=${src.rev}"
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "exploitdb";
-  version = "2022-04-08";
+  version = "2022-04-12";

  src = fetchFromGitHub {
    owner = "offensive-security";
    repo = pname;
    rev = version;
-    sha256 = "sha256-yZ/4ULiNekedF0wUwowq5wcen52NbIsbSzINhKuStzo=";
+    sha256 = "sha256-Ucbw09oFklulyXr8mGO5RskKNZx0rPTA6hPJgYByPAI=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "nuclei";
-  version = "2.6.5";
+  version = "2.6.6";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-g78sZDhV2+MgoFkJIrE2RbVLa/aPjbKFFRyKj594Hb0=";
+    sha256 = "sha256-IZxLnJyfF4MF2aTFYDyZoWdhvrd1cUJkGsASqo9KAyk=";
  };

-  vendorSha256 = "sha256-/umoSOQ0ehQplxU8OTGJVmTgO+8xPZxVwRBfM67zMh8=";
+  vendorSha256 = "sha256-oiRpxCAdxDjlUUHqRmpAHypmESQJpziOmBtTwKig7nk=";

  modRoot = "./v2";
  subPackages = [
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -2858,6 +2858,8 @@ with pkgs;

  daemontools = callPackage ../tools/admin/daemontools { };

+  dagger = callPackage ../development/tools/continuous-integration/dagger { };
+
  dale = callPackage ../development/compilers/dale { };

  damon = callPackage ../tools/admin/damon { };
@ -15548,7 +15550,7 @@ with pkgs;

  pmccabe = callPackage ../development/tools/misc/pmccabe { };

-  pkgconf-unwrapped = callPackage ../development/tools/misc/pkgconf {};
+  pkgconf-unwrapped = callPackage ../development/tools/misc/pkgconf { };
  pkgconf = callPackage ../build-support/pkg-config-wrapper {
    pkg-config = pkgconf-unwrapped;
    baseBinName = "pkgconf";
@ -19726,7 +19728,6 @@ with pkgs;
  protobuf3_7 = callPackage ../development/libraries/protobuf/3.7.nix { };
  protobuf3_6 = callPackage ../development/libraries/protobuf/3.6.nix { };
  protobuf3_1 = callPackage ../development/libraries/protobuf/3.1.nix { };
-  protobuf2_5 = callPackage ../development/libraries/protobuf/2.5.nix { };

  protobufc = callPackage ../development/libraries/protobufc/1.3.nix { };

@ -22699,6 +22700,8 @@ with pkgs;

  linuxConsoleTools = callPackage ../os-specific/linux/consoletools { };

+  linux-wifi-hotspot = callPackage ../os-specific/linux/linux-wifi-hotspot { };
+
  linthesia = callPackage ../games/linthesia/default.nix { };

  libreelec-dvb-firmware = callPackage ../os-specific/linux/firmware/libreelec-dvb-firmware { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -5429,6 +5429,8 @@ in {

  napari-console = callPackage ../development/python-modules/napari-console { };

+  napari-npe2 = callPackage ../development/python-modules/napari-npe2 { };
+
  napari-plugin-engine = callPackage ../development/python-modules/napari-plugin-engine { };

  napari-svg = callPackage ../development/python-modules/napari-svg { };
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@ -176,6 +176,9 @@ in (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdParty // kdeGea

  qca-qt5 = callPackage ../development/libraries/qca-qt5 { };

+  # Until macOS SDK allows for Qt 5.15, darwin is limited to 2.3.2
+  qca-qt5_2_3_2 = callPackage ../development/libraries/qca-qt5/2.3.2.nix { };
+
  qcoro = callPackage ../development/libraries/qcoro { };

  qcsxcad = callPackage ../development/libraries/science/electronics/qcsxcad { };