Merge master into haskell-updates

.github/ISSUE_TEMPLATE/bug_report.md

@@ -7,33 +7,38 @@ assignees: ''
 
 ---
 
-**Describe the bug**
+### Describe the bug
 A clear and concise description of what the bug is.
 
-**To Reproduce**
+### Steps To Reproduce
 Steps to reproduce the behavior:
 1. ...
 2. ...
 3. ...
 
-**Expected behavior**
+### Expected behavior
 A clear and concise description of what you expected to happen.
 
-**Screenshots**
+### Screenshots
 If applicable, add screenshots to help explain your problem.
 
-**Additional context**
+### Additional context
 Add any other context about the problem here.
 
-**Notify maintainers**
+### Notify maintainers
 <!--
 Please @ people who are in the `meta.maintainers` list of the offending package or module.
 If in doubt, check `git blame` for whoever last touched something.
 -->
 
-**Metadata**
+### Metadata
 Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.
 
+```console
+[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
+output here
+```
+
 Maintainer information:
 ```yaml
 # a list of nixpkgs attributes affected by the problem

lib/types.nix

@@ -287,6 +287,13 @@ rec {
       merge = mergeEqualOption;
     };
 
+    nonEmptyStr = mkOptionType {
+      name = "nonEmptyStr";
+      description = "non-empty string";
+      check = x: str.check x && builtins.match "[ \t\n]*" x == null;
+      inherit (str) merge;
+    };
+
     strMatching = pattern: mkOptionType {
       name = "strMatching ${escapeNixString pattern}";
       description = "string matching the pattern ${pattern}";

maintainers/maintainer-list.nix

@@ -5791,6 +5791,12 @@
     githubId = 278013;
     name = "Tomasz Kontusz";
   };
+  kurnevsky = {
+    email = "kurnevsky@gmail.com";
+    github = "kurnevsky";
+    githubId = 2943605;
+    name = "Evgeny Kurnevsky";
+  };
   kuznero = {
     email = "roman@kuznero.com";
     github = "kuznero";
@@ -5918,6 +5924,12 @@
     githubId = 1104419;
     name = "Lucas Hoffmann";
   };
+  lde = {
+    email = "lilian.deloche@puck.fr";
+    github = "lde";
+    githubId = 1447020;
+    name = "Lilian Deloche";
+  };
   ldelelis = {
     email = "ldelelis@est.frba.utn.edu.ar";
     github = "ldelelis";
@@ -10128,6 +10140,12 @@
     githubId = 1829294;
     name = "Steve Chávez";
   };
+  stevebob = {
+    email = "stephen@sherra.tt";
+    github = "stevebob";
+    githubId = 417118;
+    name = "Stephen Sherratt";
+  };
   steveej = {
     email = "mail@stefanjunker.de";
     github = "steveej";

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -617,6 +617,77 @@
           be removed in 22.05.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The order of NSS (host) modules has been brought in line with
+          upstream recommendations:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              The <literal>myhostname</literal> module is placed before
+              the <literal>resolve</literal> (optional) and
+              <literal>dns</literal> entries, but after
+              <literal>file</literal> (to allow overriding via
+              <literal>/etc/hosts</literal> /
+              <literal>networking.extraHosts</literal>, and prevent ISPs
+              with catchall-DNS resolvers from hijacking
+              <literal>.localhost</literal> domains)
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>mymachines</literal> module, which provides
+              hostname resolution for local containers (registered with
+              <literal>systemd-machined</literal>) is placed to the
+              front, to make sure its mappings are preferred over other
+              resolvers.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              If systemd-networkd is enabled, the
+              <literal>resolve</literal> module is placed before
+              <literal>files</literal> and
+              <literal>myhostname</literal>, as it provides the same
+              logic internally, with caching.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>mdns(_minimal)</literal> module has been
+              updated to the new priorities.
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          If you use your own NSS host modules, make sure to update your
+          priorities according to these rules:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              NSS modules which should be queried before
+              <literal>resolved</literal> DNS resolution should use
+              mkBefore.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              NSS modules which should be queried after
+              <literal>resolved</literal>, <literal>files</literal> and
+              <literal>myhostname</literal>, but before
+              <literal>dns</literal> should use the default priority
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              NSS modules which should come after <literal>dns</literal>
+              should use mkAfter.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
     </itemizedlist>
   </section>
 </section>

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -155,3 +155,27 @@ pt-services.clipcat.enable).
 - The wordpress module provides a new interface which allows to use different webservers with the new option [`services.wordpress.webserver`](options.html#opt-services.wordpress.webserver).  Currently `httpd` and `nginx` are supported. The definitions of wordpress sites should now be set in [`services.wordpress.sites`](options.html#opt-services.wordpress.sites).
 
   Sites definitions that use the old interface are automatically migrated in the new option. This backward compatibility will be removed in 22.05.
+
+- The order of NSS (host) modules has been brought in line with upstream
+  recommendations:
+
+  - The `myhostname` module is placed before the `resolve` (optional) and `dns`
+    entries, but after `file` (to allow overriding via `/etc/hosts` /
+    `networking.extraHosts`, and prevent ISPs with catchall-DNS resolvers from
+    hijacking `.localhost` domains)
+  - The `mymachines` module, which provides hostname resolution for local
+    containers (registered with `systemd-machined`) is placed to the front, to
+    make sure its mappings are preferred over other resolvers.
+  - If systemd-networkd is enabled, the `resolve` module is placed before
+    `files` and `myhostname`, as it provides the same logic internally, with
+    caching.
+  - The `mdns(_minimal)` module has been updated to the new priorities.
+
+  If you use your own NSS host modules, make sure to update your priorities
+  according to these rules:
+
+  - NSS modules which should be queried before `resolved` DNS resolution should
+    use mkBefore.
+  - NSS modules which should be queried after `resolved`, `files` and
+    `myhostname`, but before `dns` should use the default priority
+  - NSS modules which should come after `dns` should use mkAfter.

nixos/modules/config/nsswitch.nix

@@ -124,8 +124,8 @@ with lib;
       group = mkBefore [ "files" ];
       shadow = mkBefore [ "files" ];
       hosts = mkMerge [
-        (mkBefore [ "files" ])
-        (mkAfter [ "dns" ])
+        (mkOrder 998 [ "files" ])
+        (mkOrder 1499 [ "dns" ])
       ];
       services = mkBefore [ "files" ];
     };

nixos/modules/config/swap.nix

@@ -127,6 +127,15 @@ let
         '';
       };
 
+      options = mkOption {
+        default = [ "defaults" ];
+        example = [ "nofail" ];
+        type = types.listOf types.nonEmptyStr;
+        description = ''
+          Options used to mount the swap.
+        '';
+      };
+
       deviceName = mkOption {
         type = types.str;
         internal = true;
@@ -215,7 +224,7 @@ in
                   fi
                 ''}
                 ${optionalString sw.randomEncryption.enable ''
-                  cryptsetup plainOpen -c ${sw.randomEncryption.cipher} -d ${sw.randomEncryption.source} ${sw.device} ${sw.deviceName}
+                  cryptsetup plainOpen -c ${sw.randomEncryption.cipher} -d ${sw.randomEncryption.source} ${optionalString (sw.discardPolicy != null) "--allow-discards"} ${sw.device} ${sw.deviceName}
                   mkswap ${sw.realDevice}
                 ''}
               '';

nixos/modules/hardware/sensor/iio.nix

@@ -9,7 +9,7 @@ with lib;
     hardware.sensor.iio = {
       enable = mkOption {
         description = ''
-          Enable this option to support IIO sensors.
+          Enable this option to support IIO sensors with iio-sensor-proxy.
 
           IIO sensors are used for orientation and ambient light
           sensors on some mobile devices.

nixos/modules/services/misc/klipper.nix

@@ -2,7 +2,13 @@
 with lib;
 let
   cfg = config.services.klipper;
-  format = pkgs.formats.ini { mkKeyValue = generators.mkKeyValueDefault {} ":"; };
+  format = pkgs.formats.ini {
+    # https://github.com/NixOS/nixpkgs/pull/121613#issuecomment-885241996
+    listToValue = l:
+      if builtins.length l == 1 then generators.mkValueStringDefault {} (head l)
+      else lib.concatMapStrings (s: "\n  ${generators.mkValueStringDefault {} s}") l;
+    mkKeyValue = generators.mkKeyValueDefault {} ":";
+  };
 in
 {
   ##### interface

nixos/modules/services/networking/avahi-daemon.nix

@@ -240,8 +240,8 @@ in
 
     system.nssModules = optional cfg.nssmdns pkgs.nssmdns;
     system.nssDatabases.hosts = optionals cfg.nssmdns (mkMerge [
-      (mkOrder 900 [ "mdns_minimal [NOTFOUND=return]" ]) # must be before resolve
-      (mkOrder 1501 [ "mdns" ]) # 1501 to ensure it's after dns
+      (mkBefore [ "mdns_minimal [NOTFOUND=return]" ]) # before resolve
+      (mkAfter [ "mdns" ]) # after dns
     ]);
 
     environment.systemPackages = [ pkgs.avahi ];

nixos/modules/services/web-apps/nextcloud.nix

@@ -699,7 +699,6 @@ in {
         };
         extraConfig = ''
           index index.php index.html /index.php$request_uri;
-          expires 1m;
           add_header X-Content-Type-Options nosniff;
           add_header X-XSS-Protection "1; mode=block";
           add_header X-Robots-Tag none;

nixos/modules/system/boot/resolved.nix

@@ -140,7 +140,8 @@ in
 
     # add resolve to nss hosts database if enabled and nscd enabled
     # system.nssModules is configured in nixos/modules/system/boot/systemd.nix
-    system.nssDatabases.hosts = optional config.services.nscd.enable "resolve [!UNAVAIL=return]";
+    # added with order 501 to allow modules to go before with mkBefore
+    system.nssDatabases.hosts = (mkOrder 501 ["resolve [!UNAVAIL=return]"]);
 
     systemd.additionalUpstreamSystemUnits = [
       "systemd-resolved.service"

nixos/modules/system/boot/systemd.nix

@@ -925,9 +925,8 @@ in
     system.nssModules = [ systemd.out ];
     system.nssDatabases = {
       hosts = (mkMerge [
-        [ "mymachines" ]
-        (mkOrder 1600 [ "myhostname" ] # 1600 to ensure it's always the last
-      )
+        (mkOrder 400 ["mymachines"]) # 400 to ensure it comes before resolve (which is mkBefore'd)
+        (mkOrder 999 ["myhostname"]) # after files (which is 998), but before regular nss modules
       ]);
       passwd = (mkMerge [
         (mkAfter [ "systemd" ])

nixos/modules/tasks/filesystems.nix

@@ -255,7 +255,7 @@ in
         # https://wiki.archlinux.org/index.php/fstab#Filepath_spaces
         escape = string: builtins.replaceStrings [ " " "\t" ] [ "\\040" "\\011" ] string;
         swapOptions = sw: concatStringsSep "," (
-          [ "defaults" ]
+          sw.options
           ++ optional (sw.priority != null) "pri=${toString sw.priority}"
           ++ optional (sw.discardPolicy != null) "discard${optionalString (sw.discardPolicy != "both") "=${toString sw.discardPolicy}"}"
         );

nixos/tests/all-tests.nix

@@ -440,6 +440,7 @@ in
   txredisapi = handleTest ./txredisapi.nix {};
   tuptime = handleTest ./tuptime.nix {};
   turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix {};
+  tuxguitar = handleTest ./tuxguitar.nix {};
   ucarp = handleTest ./ucarp.nix {};
   ucg = handleTest ./ucg.nix {};
   udisks2 = handleTest ./udisks2.nix {};

nixos/tests/chromium.nix

@@ -239,7 +239,8 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
 
 
     with test_new_win("gpu_info", "chrome://gpu", "chrome://gpu"):
-        pass
+        # To check the text rendering (catches regressions like #131074):
+        machine.wait_for_text("Graphics Feature Status")
 
 
     machine.shutdown()

nixos/tests/grocy.nix

@@ -40,7 +40,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
 
     assert task_name == "Test Task"
 
-    machine.succeed("curl -sSfI http://localhost/api/tasks 2>&1 | grep '401 Unauthorized'")
+    machine.succeed("curl -sSI http://localhost/api/tasks 2>&1 | grep '401 Unauthorized'")
 
     machine.shutdown()
   '';

nixos/tests/tuxguitar.nix

@@ -0,0 +1,24 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "tuxguitar";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ asbachb ];
+  };
+
+  machine = { config, pkgs, ... }: {
+    imports = [
+      ./common/x11.nix
+    ];
+
+    services.xserver.enable = true;
+
+    environment.systemPackages = [ pkgs.tuxguitar ];
+  };
+
+  testScript = ''
+    machine.wait_for_x()
+    machine.succeed("tuxguitar &")
+    machine.wait_for_window("TuxGuitar - Untitled.tg")
+    machine.sleep(1)
+    machine.screenshot("tuxguitar")
+  '';
+})

pkgs/applications/audio/deadbeef/plugins/statusnotifier.nix

@@ -0,0 +1,39 @@
+{ lib, stdenv, fetchFromGitHub, pkg-config, deadbeef, gtk3, perl
+, libdbusmenu-glib }:
+
+stdenv.mkDerivation rec {
+  pname = "deadbeef-statusnotifier-plugin";
+  version = "1.6";
+
+  src = fetchFromGitHub {
+    owner = "vovochka404";
+    repo = "deadbeef-statusnotifier-plugin";
+    rev = "v${version}";
+    sha256 = "sha256-6WEbY59vPNrL3W5GUwFQJimmSS+td8Ob+G46fPAxfV4=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ deadbeef gtk3 libdbusmenu-glib ];
+
+  buildFlags = [ "gtk3" ];
+
+  postPatch = ''
+    substituteInPlace tools/glib-mkenums \
+      --replace /usr/bin/perl "${perl}/bin/perl"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/lib/deadbeef
+    cp build/sni_gtk3.so $out/lib/deadbeef
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "DeaDBeeF StatusNotifier Plugin";
+    homepage = "https://github.com/vovochka404/deadbeef-statusnotifier-plugin";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.kurnevsky ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/blockchains/go-ethereum.nix

@@ -9,17 +9,17 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.10.5";
+  version = "1.10.6";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256:1226picbgnph71fk2y0n1hyfrh6m8sh54kgn3pmikydnw176k9j1";
+    sha256 = "sha256-4lapkoxSKdXlD6rmUxnlSKrfH+DeV6/wV05CqJjuzjA=";
   };
 
   runVend = true;
-  vendorSha256 = "sha256:1nf2gamamlgr2sl5ibib5wai1pipj66xhbhnb4s4480j5pbv9a76";
+  vendorSha256 = "sha256-5qi01y0SIEI0WRYu2I2RN94QFS8rrlioFvnRqqp6wtk=";
 
   doCheck = false;
 

pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix

@@ -2885,10 +2885,10 @@
       elpaBuild {
         pname = "pyim";
         ename = "pyim";
-        version = "3.9.2";
+        version = "3.9.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/pyim-3.9.2.tar";
-          sha256 = "18m5wni1zns8fad2ll9flbfgxfy14gi03apnycajdbqxsqfp65j9";
+          url = "https://elpa.gnu.org/packages/pyim-3.9.3.tar";
+          sha256 = "0rjaimvbh0fadbqiq4ggyxr0y4pfzld76wb64v7l5874qczn8dfr";
         };
         packageRequires = [ async emacs xr ];
         meta = {

pkgs/applications/editors/emacs/elisp-packages/org-generated.nix

@@ -4,10 +4,10 @@
       elpaBuild {
         pname = "org";
         ename = "org";
-        version = "20210712";
+        version = "20210719";
         src = fetchurl {
-          url = "https://orgmode.org/elpa/org-20210712.tar";
-          sha256 = "0xdxzfk7hvsmlyivn61ivci6hy2alxg2ysdm5xad4xxz337jrj7x";
+          url = "https://orgmode.org/elpa/org-20210719.tar";
+          sha256 = "1aravj0krdi8bnfinfj1d92vq3g06djxcnpipibkrw9ggk0d01d6";
         };
         packageRequires = [];
         meta = {
@@ -19,10 +19,10 @@
       elpaBuild {
         pname = "org-plus-contrib";
         ename = "org-plus-contrib";
-        version = "20210712";
+        version = "20210719";
         src = fetchurl {
-          url = "https://orgmode.org/elpa/org-plus-contrib-20210712.tar";
-          sha256 = "1cdpwsfjmjplyik1r9kl4lvd5lm52zrixlfg2ml1mhh28s680k0q";
+          url = "https://orgmode.org/elpa/org-plus-contrib-20210719.tar";
+          sha256 = "1knjkf365cnjd8sdhaisjx0n6n0l2zfpql1b2gzw0gj62kbpl476";
         };
         packageRequires = [];
         meta = {

pkgs/applications/editors/music/tuxguitar/default.nix

@@ -1,16 +1,16 @@
-{ lib, stdenv, fetchurl, swt, jdk, makeWrapper, alsa-lib, jack2, fluidsynth, libpulseaudio }:
+{ lib, stdenv, fetchurl, swt, jre, makeWrapper, alsa-lib, jack2, fluidsynth, libpulseaudio }:
 
 let metadata = assert stdenv.hostPlatform.system == "i686-linux" || stdenv.hostPlatform.system == "x86_64-linux";
   if stdenv.hostPlatform.system == "i686-linux" then
-    { arch = "x86"; sha256 = "27675c358db237df74d20e8676000c25a87b9de0bb0a6d1c325e8d6db807d296"; }
+    { arch = "x86"; sha256 = "afa4b1116aee18e3ddd93132467809d0bcf03715cf9ad55b895f021a13e1cb8a"; }
   else
-    { arch = "x86_64"; sha256 = "298555a249adb3ad72f3aef72a124e30bfa01cd069c7b5d152a738140e7903a2"; };
+    { arch = "x86_64"; sha256 = "55ab653c601727a2077080e7ea4d76fe7a897379934ed9a5b544e20d490f53f9"; };
 in stdenv.mkDerivation rec {
-  version = "1.5.2";
+  version = "1.5.4";
   pname = "tuxguitar";
 
   src = fetchurl {
-    url = "mirror://sourceforge/tuxguitar/${pname}-${version}-linux-${metadata.arch}.tar.gz";
+    url = "mirror://sourceforge/${pname}/${pname}-${version}-linux-${metadata.arch}.tar.gz";
     sha256 = metadata.sha256;
   };
 
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
     ln -s $out/share $out/bin/share
 
     wrapProgram $out/bin/tuxguitar \
-      --set JAVA "${jdk}/bin/java" \
+      --set JAVA "${jre}/bin/java" \
       --prefix LD_LIBRARY_PATH : "$out/lib/:${lib.makeLibraryPath [ swt alsa-lib jack2 fluidsynth libpulseaudio ]}" \
       --prefix CLASSPATH : "${swt}/jars/swt.jar:$out/lib/tuxguitar.jar:$out/lib/itext.jar"
   '';

pkgs/applications/misc/bemenu/default.nix

@@ -11,13 +11,13 @@ assert x11Support -> xorg != null;
 
 stdenv.mkDerivation rec {
   pname = "bemenu";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "Cloudef";
     repo = pname;
     rev = version;
-    sha256 = "sha256-2xmi/Mh5iU50yc2R1x1yzP8Xaz+mUgLnH73tAeLwxI8=";
+    sha256 = "sha256-U4IMfDvQ0rfEJhE3Uext2c/Cs0mjy1tw+k8uk441Ag8=";
   };
 
   nativeBuildInputs = [ pkg-config pcre ];

pkgs/applications/misc/bottles/default.nix

@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "bottles";
-  version = "3.1.6";
+  version = "2021.7.14-treviso";
 
   src = fetchFromGitHub {
     owner = "bottlesdevs";
     repo = pname;
     rev = version;
-    sha256 = "1izks01010akjf83xvi70dr4yzgk6yr84kd0slzz22yq204pdh5m";
+    sha256 = "0xhfk1ll8vacgrr0kkhynq4bryjhfjs29j824bark5mj9b6lkbix";
   };
 
   postPatch = ''
@@ -44,6 +44,8 @@ python3Packages.buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = with python3Packages; [
+    pyyaml
+    requests
     pycairo
     pygobject3
     lxml

pkgs/applications/misc/gpu-burn/default.nix

@@ -0,0 +1,45 @@
+{ lib, stdenv, fetchFromGitHub, addOpenGLRunpath, cudatoolkit }:
+
+stdenv.mkDerivation rec {
+  pname = "gpu-burn";
+  version = "unstable-2021-04-29";
+
+  src = fetchFromGitHub {
+    owner = "wilicc";
+    repo = "gpu-burn";
+    rev = "1e9a84f4bec3b0835c00daace45d79ed6c488edb";
+    sha256 = "sha256-x+kta81Z08PsBgbf+fzRTXhNXUPBd5w8bST/T5nNiQA=";
+  };
+
+  postPatch = ''
+    substituteInPlace gpu_burn-drv.cpp \
+      --replace "const char *kernelFile = \"compare.ptx\";" \
+                "const char *kernelFile = \"$out/share/compare.ptx\";"
+  '';
+
+  buildInputs = [ cudatoolkit ];
+
+  nativeBuildInputs = [ addOpenGLRunpath ];
+
+  makeFlags = [ "CUDAPATH=${cudatoolkit}" ];
+
+  LDFLAGS = "-L${cudatoolkit}/lib/stubs";
+
+  installPhase = ''
+    mkdir -p $out/{bin,share}
+    cp gpu_burn $out/bin/
+    cp compare.ptx $out/share/
+  '';
+
+  postFixup = ''
+    addOpenGLRunpath $out/bin/gpu_burn
+  '';
+
+  meta = with lib; {
+    homepage = "http://wili.cc/blog/gpu-burn.html";
+    description = "Multi-GPU CUDA stress test";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ elohmeier ];
+    license = licenses.bsd2;
+  };
+}

pkgs/applications/misc/privacyidea/default.nix

@@ -12,18 +12,27 @@ let
           sha256 = "ebbb777cbf9312359b897bf81ba00dae0f5cb69fba2a18265dcc18a6f5ef7519";
         };
       });
+      flask_migrate = super.flask_migrate.overridePythonAttrs (oldAttrs: rec {
+        version = "2.7.0";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "ae2f05671588762dd83a21d8b18c51fe355e86783e24594995ff8d7380dffe38";
+        };
+      });
+      werkzeug = self.callPackage ../../../development/python-modules/werkzeug/1.nix { };
+      flask = self.callPackage ../../../development/python-modules/flask/1.nix { };
     };
   };
 in
 python3'.pkgs.buildPythonPackage rec {
   pname = "privacyIDEA";
-  version = "3.6";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yywkQ3TdBzRMbJGY0Seaprztgt0JrCAbgqosMQ5fcQM=";
+    sha256 = "sha256-NRfTEZ/6K6xLP+wcT6o54wqk/EyWTiiC9W1KDgaAEbg=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/browsers/chromium/browser.nix

@@ -84,7 +84,7 @@ mkChromiumDerivation (base: rec {
       else "https://www.chromium.org/";
     maintainers = with maintainers; if ungoogled
       then [ squalus primeos ]
-      else [ primeos thefloweringash bendlas ];
+      else [ primeos thefloweringash ];
     license = if enableWideVine then licenses.unfree else licenses.bsd3;
     platforms = platforms.linux;
     mainProgram = "chromium";

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "90.0.1";
+    ffversion = "90.0.2";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "9f87c3f3dad33e42a7a9d2161d7f23ff2e7184b2274f9081511c7982957ae9954784bd844a2348ff4744231415aac195d1f12971392db90be0375b4738acb590";
+      sha512 = "4fda0b1e666fb0b1d846708fad2b48a5b53d48e7fc2a5da1f234b5b839c55265b41f6509e6b506d5e8a7455f816dfa5ab538589bc9e83b7e3846f0f72210513e";
     };
 
     meta = {

pkgs/applications/networking/cluster/argocd/default.nix

@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.0.4";
-  commit = "0842d448107eb1397b251e63ec4d4bc1b4efdd6e";
+  version = "2.0.5";
+  commit = "4c94d886f56bcb2f9d5b3251fdc049c2d1354b88";
   tag = "v${version}";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = tag;
-    sha256 = "sha256-SKSAJtp20f6A+CvrsBEmbcNJAKI5b4Wm4K0cr/lGo64=";
+    sha256 = "sha256-8YymSR15e+6gGGqr5CH4ERHN8RO3wd9NJkM9K7InlFU=";
   };
 
-  vendorSha256 = "sha256-RbEqivzTpXVQp4zl0zZWAh6qCr2KZSJ6Bj2pZaClQaQ=";
+  vendorSha256 = "sha256-9dVkGl0gjjMehG2nt1eNpNT5fD9GbJ1mNMzYS8FTm08=";
 
   nativeBuildInputs = [ packr makeWrapper installShellFiles ];
 

pkgs/applications/networking/cluster/k3s/default.nix

@@ -44,12 +44,21 @@ with lib;
 # Those pieces of software we entirely ignore upstream's handling of, and just
 # make sure they're in the path if desired.
 let
-  k3sVersion = "1.21.2+k3s1";     # k3s git tag
-  k3sCommit = "5a67e8dc473f8945e8e181f6f0b0dbbc387f6fca"; # k3s git commit at the above version
+  k3sVersion = "1.21.3+k3s1";     # k3s git tag
+  k3sCommit = "1d1f220fbee9cdeb5416b76b707dde8c231121f2"; # k3s git commit at the above version
 
   traefikChartVersion = "9.18.2"; # taken from ./scripts/download at TRAEFIK_VERSION
-  k3sRootVersion = "0.8.1";       # taken from ./scripts/download at ROOT_VERSION
+  k3sRootVersion = "0.9.1";       # taken from ./scripts/download at ROOT_VERSION
   k3sCNIVersion = "0.8.6-k3s1";   # taken from ./scripts/version.sh at VERSION_CNIPLUGINS
+
+  baseMeta = {
+    description = "A lightweight Kubernetes distribution";
+    license = licenses.asl20;
+    homepage = "https://k3s.io";
+    maintainers = with maintainers; [ euank superherointj ];
+    platforms = platforms.linux;
+  };
+
   # bundled into the k3s binary
   traefikChart = fetchurl {
     url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
@@ -67,7 +76,7 @@ let
   k3sRoot = fetchzip {
     # Note: marked as apache 2.0 license
     url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
-    sha256 = "sha256-r3Nkzl9ccry7cgD3YWlHvEWOsWnnFGIkyRH9sx12gks=";
+    sha256 = "sha256-qI84KYJKY/T6pqWZW9lOTq5NzZiu//v1zrMzUCiRTGQ=";
     stripRoot = false;
   };
   k3sPlugins = buildGoPackage rec {
@@ -84,12 +93,8 @@ let
       sha256 = "sha256-uAy17eRRAXPCcnh481KxFMvFQecnnBs24jn5YnVNfY4=";
     };
 
-    meta = {
+    meta = baseMeta // {
       description = "CNI plugins, as patched by rancher for k3s";
-      license = licenses.asl20;
-      homepage = "https://k3s.io";
-      maintainers = [ maintainers.euank ];
-      platforms = platforms.linux;
     };
   };
   # Grab this separately from a build because it's used by both stages of the
@@ -97,7 +102,7 @@ let
   k3sRepo = fetchgit {
     url = "https://github.com/k3s-io/k3s";
     rev = "v${k3sVersion}";
-    sha256 = "sha256-ZRkdHQ4RJ6XqE+DKE6wwpxetuKDG3k/4HaHyFxHev1U=";
+    sha256 = "sha256-K4HVXFp5cpByEO4dUwmpzOuhsGh1k7X6k5aShCorTjg=";
   };
   # Stage 1 of the k3s build:
   # Let's talk about how k3s is structured.
@@ -161,12 +166,8 @@ let
       popd
     '';
 
-    meta = {
+    meta = baseMeta // {
       description = "The various binaries that get packaged into the final k3s binary";
-      license = licenses.asl20;
-      homepage = "https://k3s.io";
-      maintainers = [ maintainers.euank ];
-      platforms = platforms.linux;
     };
   };
   k3sBin = buildGoPackage rec {
@@ -228,12 +229,8 @@ let
       popd
     '';
 
-    meta = {
+    meta = baseMeta // {
       description = "The k3s go binary which is used by the final wrapped output below";
-      license = licenses.asl20;
-      homepage = "https://k3s.io";
-      maintainers = [ maintainers.euank ];
-      platforms = platforms.linux;
     };
   };
 in
@@ -241,7 +238,7 @@ stdenv.mkDerivation rec {
   pname = "k3s";
   version = k3sVersion;
 
-  # Important utilities used by  the kubelet, see
+  # Important utilities used by the kubelet, see
   # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
   # Note the list in that issue is stale and some aren't relevant for k3s.
   k3sRuntimeDeps = [
@@ -279,11 +276,10 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = {
-    description = "A lightweight Kubernetes distribution";
-    license = licenses.asl20;
-    homepage = "https://k3s.io";
-    maintainers = [ maintainers.euank ];
-    platforms = platforms.linux;
-  };
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/k3s --version | grep v${k3sVersion} > /dev/null
+  '';
+
+  meta = baseMeta;
 }

pkgs/applications/networking/instant-messengers/slack/default.nix

@@ -50,8 +50,12 @@ let
   x86_64-linux-version = "4.17.0";
   x86_64-linux-sha256 = "07ccms58pq27ilkyhcf6cgwb7qrddwil5kgy8yv95ljikqzi5rxi";
 
+  aarch64-darwin-version = "4.17.0";
+  aarch64-darwin-sha256 = "1a5crmnbz8ng3z2pk5zw17dds9d5fyir4rkvv611fn858kq5fv46";
+
   version = {
     x86_64-darwin = x86_64-darwin-version;
+    aarch64-darwin = aarch64-darwin-version;
     x86_64-linux = x86_64-linux-version;
   }.${system} or throwSystem;
 
@@ -64,6 +68,10 @@ let
           url = "${base}/releases/macos/${version}/prod/x64/Slack-${version}-macOS.dmg";
           sha256 = x86_64-darwin-sha256;
         };
+        aarch64-darwin = fetchurl {
+          url = "${base}/releases/macos/${version}/prod/arm64/Slack-${version}-macOS.dmg";
+          sha256 = aarch64-darwin-sha256;
+        };
         x86_64-linux = fetchurl {
           url = "${base}/linux_releases/slack-desktop-${version}-amd64.deb";
           sha256 = x86_64-linux-sha256;
@@ -75,7 +83,7 @@ let
     homepage = "https://slack.com";
     license = licenses.unfree;
     maintainers = with maintainers; [ mmahut ];
-    platforms = [ "x86_64-darwin" "x86_64-linux" ];
+    platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-darwin"];
   };
 
   linux = stdenv.mkDerivation rec {

pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -1,11 +1,11 @@
 { mkDerivation, lib, fetchFromGitHub, callPackage, fetchpatch
-, pkg-config, cmake, ninja, python3, wrapGAppsHook, wrapQtAppsHook, removeReferencesTo
+, pkg-config, cmake, ninja, python3, wrapGAppsHook, wrapQtAppsHook
 , qtbase, qtimageformats, gtk3, libsForQt5, lz4, xxHash
 , ffmpeg, openalSoft, minizip, libopus, alsa-lib, libpulseaudio, range-v3
 , tl-expected, hunspell, glibmm, webkitgtk, jemalloc
-, libtgvoip, rnnoise, abseil-cpp, extra-cmake-modules
+, rnnoise, extra-cmake-modules
 # Transitive dependencies:
-, pcre, xorg, util-linux, libselinux, libsepol, epoxy
+, pcre, xorg, util-linuxMinimal, libselinux, libsepol, epoxy
 , at-spi2-core, libXtst, libthai, libdatrie
 , xdg-utils, libsysprof-capture, libpsl, brotli
 }:
@@ -46,22 +46,33 @@ in mkDerivation rec {
   postPatch = ''
     substituteInPlace Telegram/CMakeLists.txt \
       --replace '"''${TDESKTOP_LAUNCHER_BASENAME}.appdata.xml"' '"''${TDESKTOP_LAUNCHER_BASENAME}.metainfo.xml"'
+
+    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
+      --replace '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
+    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioOutputALSA.cpp \
+      --replace '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
+    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
+      --replace '"libpulse.so.0"' '"${libpulseaudio}/lib/libpulse.so.0"'
   '';
 
   # We want to run wrapProgram manually (with additional parameters)
   dontWrapGApps = true;
   dontWrapQtApps = true;
 
-  nativeBuildInputs = [ pkg-config cmake ninja python3 wrapGAppsHook wrapQtAppsHook removeReferencesTo ];
+  nativeBuildInputs = [
+    pkg-config cmake ninja python3 wrapGAppsHook wrapQtAppsHook
+    extra-cmake-modules
+  ];
 
   buildInputs = [
     qtbase qtimageformats gtk3 libsForQt5.kwayland libsForQt5.libdbusmenu lz4 xxHash
     ffmpeg openalSoft minizip libopus alsa-lib libpulseaudio range-v3
     tl-expected hunspell glibmm webkitgtk jemalloc
-    libtgvoip rnnoise abseil-cpp extra-cmake-modules
+    rnnoise
     tg_owt
     # Transitive dependencies:
-    pcre xorg.libpthreadstubs xorg.libXdmcp util-linux libselinux libsepol epoxy
+    util-linuxMinimal # Required for libmount thus not nativeBuildInputs.
+    pcre xorg.libpthreadstubs xorg.libXdmcp libselinux libsepol epoxy
     at-spi2-core libXtst libthai libdatrie libsysprof-capture libpsl brotli
   ];
 
@@ -70,19 +81,17 @@ in mkDerivation rec {
     # We're allowed to used the API ID of the Snap package:
     "-DTDESKTOP_API_ID=611335"
     "-DTDESKTOP_API_HASH=d524b414d21f4d37f08684c1df41ac9c"
-    #"-DDESKTOP_APP_SPECIAL_TARGET=\"\"" # TODO: Error when set to "": Bad special target '""'
-    "-DTDESKTOP_LAUNCHER_BASENAME=telegramdesktop" # Note: This is the default
+    # See: https://github.com/NixOS/nixpkgs/pull/130827#issuecomment-885212649
+    "-DDESKTOP_APP_USE_PACKAGED_FONTS=OFF"
   ];
 
   # Note: The following packages could be packaged system-wide, but it's
   # probably best to use the bundled ones from tdesktop (Arch does this too):
   # rlottie:
-  # - CMake flag: "-DTDESKTOP_USE_PACKAGED_TGVOIP=ON"
   # - Sources (problem: there are no stable releases!):
   #   - desktop-app (tdesktop): https://github.com/desktop-app/rlottie
   #   - upstream: https://github.com/Samsung/rlottie
   # libtgvoip:
-  # - CMake flag: "-DDESKTOP_APP_USE_PACKAGED_RLOTTIE=ON"
   # - Sources  (problem: the stable releases might be too old!):
   #   - tdesktop: https://github.com/telegramdesktop/libtgvoip
   #   - upstream: https://github.com/grishka/libtgvoip
@@ -113,10 +122,10 @@ in mkDerivation rec {
       Desktop client for the Telegram messenger, based on the Telegram API and
       the MTProto secure protocol.
     '';
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     platforms = platforms.linux;
     homepage = "https://desktop.telegram.org/";
-    changelog = "https://github.com/telegramdesktop/tdesktop/releases/tag/v{version}";
-    maintainers = with maintainers; [ primeos abbradar ];
+    changelog = "https://github.com/telegramdesktop/tdesktop/releases/tag/v${version}";
+    maintainers = with maintainers; [ primeos abbradar oxalica ];
   };
 }

pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix

@@ -1,9 +1,9 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch
 , pkg-config, cmake, ninja, yasm
 , libjpeg, openssl, libopus, ffmpeg, alsa-lib, libpulseaudio, protobuf
-, xorg, libXtst, libXcomposite, libXdamage, libXext, libXrender, libXrandr
+, openh264, usrsctp, libevent, libvpx
 , glib, abseil-cpp, pcre, util-linuxMinimal, libselinux, libsepol, pipewire
-, libXi
+, xorg, libX11, libXtst, libXcomposite, libXdamage, libXext, libXrender, libXrandr, libXi
 }:
 
 stdenv.mkDerivation {
@@ -24,15 +24,23 @@ stdenv.mkDerivation {
 
   buildInputs = [
     libjpeg openssl libopus ffmpeg alsa-lib libpulseaudio protobuf
-    xorg.libX11 libXtst libXcomposite libXdamage libXext libXrender libXrandr
+    openh264 usrsctp libevent libvpx
+    libX11 libXtst libXcomposite libXdamage libXext libXrender libXrandr libXi
     glib abseil-cpp pcre util-linuxMinimal libselinux libsepol pipewire
-    libXi
   ];
 
   cmakeFlags = [
-    # Building as a shared library isn't officially supported and currently broken:
+    # Building as a shared library isn't officially supported and may break at any time.
     "-DBUILD_SHARED_LIBS=OFF"
   ];
 
-  meta.license = lib.licenses.bsd3;
+  propagatedBuildInputs = [
+    # Required for linking downstream binaries.
+    abseil-cpp openh264 usrsctp libevent libvpx
+  ];
+
+  meta = with lib; {
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ oxalica ];
+  };
 }

pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py

@@ -71,7 +71,3 @@ if __name__ == "__main__":
     tg_owt_hash = nix_prefetch_git('https://github.com/desktop-app/tg_owt.git', tg_owt_ref)
     update_file('tg_owt.nix', tg_owt_version, tg_owt_hash, tg_owt_ref)
     tg_owt_ref = github_api_request('repos/desktop-app/tg_owt/commits/master')['sha']
-    libtgvoip_ref = github_api_request(f'repos/telegramdesktop/tdesktop/contents/Telegram/ThirdParty/libtgvoip?ref={tdesktop_tag}')['sha']
-    libtgvoip_version = get_commit_date('telegramdesktop/libtgvoip', libtgvoip_ref)
-    libtgvoip_hash = nix_prefetch_url(f'https://github.com/telegramdesktop/libtgvoip/archive/{libtgvoip_ref}.tar.gz', unpack=True)
-    update_file('../../../../../development/libraries/libtgvoip/default.nix', libtgvoip_version, libtgvoip_hash, libtgvoip_ref)

pkgs/applications/networking/ipfs/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ipfs";
-  version = "0.9.0";
+  version = "0.9.1";
   rev = "v${version}";
 
   # go-ipfs makes changes to it's source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/go-ipfs/releases/download/${rev}/go-ipfs-source.tar.gz";
-    sha256 = "sha256:1fyffnw1d860w7gwm6ijbgrh68297z5bmvww8yqfshm3xgvcs6bf";
+    sha256 = "sha256-RliyIEtNgwzbLVwl6T38VIbhc12CZMBc3LZ6T/llaHc=";
   };
 
   # tarball contains multiple files/directories
@@ -29,10 +29,13 @@ buildGoModule rec {
 
   postInstall = ''
     install --mode=444 -D misc/systemd/ipfs.service $out/etc/systemd/system/ipfs.service
+    install --mode=444 -D misc/systemd/ipfs-hardened.service $out/etc/systemd/system/ipfs-hardened.service
     install --mode=444 -D misc/systemd/ipfs-api.socket $out/etc/systemd/system/ipfs-api.socket
     install --mode=444 -D misc/systemd/ipfs-gateway.socket $out/etc/systemd/system/ipfs-gateway.socket
     substituteInPlace $out/etc/systemd/system/ipfs.service \
       --replace /usr/bin/ipfs $out/bin/ipfs
+    substituteInPlace $out/etc/systemd/system/ipfs-hardened.service \
+      --replace /usr/bin/ipfs $out/bin/ipfs
   '';
 
   meta = with lib; {

pkgs/applications/office/libreoffice/src-fresh/download.nix

@@ -161,11 +161,11 @@
     md5name = "e61677e8799ce6e55b25afc11aa5339113f6a49cff031f336e32fa58635b1a4a-libetonyek-0.1.9.tar.xz";
   }
   {
-    name = "expat-2.2.8.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/expat-2.2.8.tar.bz2";
-    sha256 = "9a130948b05a82da34e4171d5f5ae5d321d9630277af02c8fa51e431f6475102";
+    name = "expat-2.4.1.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/expat-2.4.1.tar.bz2";
+    sha256 = "2f9b6a580b94577b150a7d5617ad4643a4301a6616ff459307df3e225bcfbf40";
     md5 = "";
-    md5name = "9a130948b05a82da34e4171d5f5ae5d321d9630277af02c8fa51e431f6475102-expat-2.2.8.tar.bz2";
+    md5name = "2f9b6a580b94577b150a7d5617ad4643a4301a6616ff459307df3e225bcfbf40-expat-2.4.1.tar.bz2";
   }
   {
     name = "Firebird-3.0.0.32483-0.tar.bz2";
@@ -567,11 +567,11 @@
     md5name = "2d84360b03042178def1d9ff538acacaed2b3a27411db7b2874f1612ed71abc8-xmlsec1-1.2.30.tar.gz";
   }
   {
-    name = "libxml2-2.9.10.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libxml2-2.9.10.tar.gz";
-    sha256 = "aafee193ffb8fe0c82d4afef6ef91972cbaf5feea100edc2f262750611b4be1f";
+    name = "libxml2-2.9.12.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libxml2-2.9.12.tar.gz";
+    sha256 = "c8d6681e38c56f172892c85ddc0852e1fd4b53b4209e7f4ebf17f7e2eae71d92";
     md5 = "";
-    md5name = "aafee193ffb8fe0c82d4afef6ef91972cbaf5feea100edc2f262750611b4be1f-libxml2-2.9.10.tar.gz";
+    md5name = "c8d6681e38c56f172892c85ddc0852e1fd4b53b4209e7f4ebf17f7e2eae71d92-libxml2-2.9.12.tar.gz";
   }
   {
     name = "libxslt-1.1.34.tar.gz";

pkgs/applications/office/libreoffice/src-fresh/primary.nix

@@ -8,7 +8,7 @@ rec {
 
   major = "7";
   minor = "1";
-  patch = "4";
+  patch = "5";
   tweak = "2";
 
   subdir = "${major}.${minor}.${patch}";
@@ -17,13 +17,13 @@ rec {
 
   src = fetchurl {
     url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "1jsskhnlyra7q6d12kkc8dxq5fgrnd8grl32bdck7j9hkwv6d13m";
+    sha256 = "1kl54ddpvmrcs4r1vd4dfzg5a8im0kijhaqdg37zvgb5fqv31bxf";
   };
 
   # FIXME rename
   translations = fetchSrc {
     name = "translations";
-    sha256 = "0cslzhp5ic1w7hnl6wbyxrxhczdmap1g1hh1nj9sgpw9iqdryqj7";
+    sha256 = "0nf5s012l7mkpd1srvijl9q6x8f7svm6i84bj75dwyvipkg40rxq";
   };
 
   # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@@ -31,6 +31,6 @@ rec {
 
   help = fetchSrc {
     name = "help";
-    sha256 = "091yhm1qkxgvv130a1yzmmikchvxvp8109mcdrlpybp4gc276l8q";
+    sha256 = "1m1hxbhrkaynpcps77rym1d0kwl380jv1p7b6ibfl4by0ii2j16a";
   };
 }

pkgs/applications/science/machine-learning/nengo-gui/default.nix

@@ -0,0 +1,26 @@
+{ lib, fetchFromGitHub, python3Packages }:
+
+python3Packages.buildPythonPackage rec {
+  pname = "nengo-gui";
+  version = "0.4.8";
+
+  src = fetchFromGitHub {
+    owner = "nengo";
+    repo = "nengo-gui";
+    rev = "v${version}";
+    sha256 = "1awb0h2l6yifb77zah7a4qzxqvkk4ac5fynangalidr10sk9rzk3";
+  };
+
+  propagatedBuildInputs = with python3Packages; [ nengo ];
+
+  # checks req missing:
+  #   pyimgur
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Nengo interactive visualizer";
+    homepage    = "https://nengo.ai/";
+    license     = licenses.unfreeRedistributable;
+    maintainers = with maintainers; [ arjix ];
+  };
+}

pkgs/applications/terminal-emulators/foot/default.nix

@@ -2,6 +2,7 @@
 , lib
 , fetchzip
 , fetchurl
+, fetchpatch
 , runCommandNoCC
 , fcft
 , freetype
@@ -98,6 +99,15 @@ stdenv.mkDerivation rec {
     sha256 = "1k0alz991cslls4926c5gq02pdq0vfw9jfpprh2a1vb59xgikv7h";
   };
 
+  patches = [
+    # Fixes PGO builds with clang
+    (fetchpatch {
+      url = "https://codeberg.org/dnkl/foot/commit/2acd4b34c57659d86dca76c58e4363de9b0a1f17.patch";
+      sha256 = "13xi9ppaqx2p88cxbh6801ry9ral70ylh40agn6ij7pklybs4d7s";
+      includes = [ "pgo/pgo.c" ];
+    })
+  ];
+
   depsBuildBuild = [
     pkg-config
   ];

pkgs/applications/version-management/fossil/default.nix

@@ -18,10 +18,7 @@ stdenv.mkDerivation rec {
   version = "2.15.1";
 
   src = fetchurl {
-    urls =
-      [
-        "https://www.fossil-scm.org/index.html/uv/fossil-src-${version}.tar.gz"
-      ];
+    url = "https://www.fossil-scm.org/index.html/uv/fossil-src-${version}.tar.gz";
     name = "${pname}-${version}.tar.gz";
     sha256 = "sha256-gNJ5I8ZjsqLHEPiujNVJhi4E+MBChXBidMNK48jKF9E=";
   };

pkgs/applications/version-management/git-and-tools/git-machete/default.nix

@@ -1,6 +1,9 @@
 { lib, buildPythonApplication, fetchPypi
 , installShellFiles, pbr
-, flake8, mock, pycodestyle, pylint, tox }:
+, flake8, mock, pycodestyle, pylint, tox
+, nix-update-script
+, testVersion, git-machete
+}:
 
 buildPythonApplication rec {
   pname = "git-machete";
@@ -23,6 +26,18 @@ buildPythonApplication rec {
       installShellCompletion --zsh --name _git-machete completion/git-machete.completion.zsh
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+
+    tests = {
+      version = testVersion {
+        package = git-machete;
+      };
+    };
+  };
+
   meta = with lib; {
     homepage = "https://github.com/VirtusLab/git-machete";
     description = "Git repository organizer and rebase/merge workflow automation tool";

pkgs/applications/version-management/git-and-tools/git-sync/default.nix

@@ -28,11 +28,14 @@ stdenv.mkDerivation rec {
     gnused
   ];
 
-  fixupPhase = ''
-    patchShebangs $out/bin
+  postFixup = ''
+    wrap_path="${wrapperPath}":$out/bin
 
     wrapProgram $out/bin/git-sync \
-      --prefix PATH : "${wrapperPath}"
+      --prefix PATH : $wrap_path
+
+    wrapProgram $out/bin/git-sync-on-inotify \
+      --prefix PATH : $wrap_path
   '';
 
   meta = {

pkgs/data/fonts/tempora-lgc/default.nix

@@ -25,7 +25,6 @@ stdenv.mkDerivation {
   name = "tempora-lgc";
   inherit nativeBuildInputs;
   inherit srcs;
-  phases = "installPhase";
   installPhase = ''
     mkdir -p "$out/share/fonts/opentype/public"
     cp ${toString srcs} "$out/share/fonts/opentype/public"

pkgs/data/themes/matcha/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "matcha-gtk-theme";
-  version = "2021-07-08";
+  version = "2021-07-20";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "sha256-iTwPN31JvpFlCBWikOeSTda2wBEtg6ygy8o6ovqHPCw=";
+    sha256 = "0shdkwpqj3fw5qr99ww4z5dyrpa2pq79s0i02p9j3v6w6aca2gic";
   };
 
   buildInputs = [ gdk-pixbuf librsvg ];

pkgs/desktops/pantheon/apps/appcenter/default.nix

@@ -7,7 +7,6 @@
 , elementary-gtk-theme
 , elementary-icon-theme
 , fetchFromGitHub
-, fetchpatch
 , flatpak
 , gettext
 , glib
@@ -15,6 +14,7 @@
 , gtk3
 , json-glib
 , libgee
+, libhandy
 , libsoup
 , libxml2
 , meson
@@ -25,30 +25,20 @@
 , python3
 , vala
 , polkit
-, libhandy_0
 , wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "appcenter";
-  version = "3.5.1";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "MsaXdmL+M+NYAJrrwluleeNxqQg0soFbO/G/FqibBFI=";
+    sha256 = "0kwqgilhyrj2nbvw5y34nzch5h9jnrg1a1n333qdsx4ax6yrxh4j";
   };
 
-  patches = [
-    # Allow build with appstream 0.14.x
-    # https://github.com/elementary/appcenter/pull/1493
-    (fetchpatch {
-      url = "https://github.com/elementary/appcenter/commit/5807dd13fe3c715f26225aed8d7a0abdea0c2a64.patch";
-      sha256 = "BvEahG9lU9ZdgooFDFhm5evRvnKVcmcHLdmZPb85gbo=";
-    })
-  ];
-
   passthru = {
     updateScript = nix-update-script {
       attrPath = "pantheon.${pname}";
@@ -78,7 +68,7 @@ stdenv.mkDerivation rec {
     gtk3
     json-glib
     libgee
-    libhandy_0 # doesn't support libhandy-1 yet
+    libhandy
     libsoup
     libxml2
     packagekit

pkgs/development/interpreters/erlang/R24.nix

@@ -3,6 +3,6 @@
 # How to obtain `sha256`:
 # nix-prefetch-url --unpack https://github.com/erlang/otp/archive/OTP-${version}.tar.gz
 mkDerivation {
-  version = "24.0.3";
-  sha256 = "KVMISrWNBkk+w37gB4M5TQkgm4odZ+GqLvKN4stzOUI=";
+  version = "24.0.4";
+  sha256 = "OeXXNaVJh5el+V+5ukcNOAgDmkJuGy1lYLpUTd1yxHM=";
 }

pkgs/development/libraries/agda/cubical/default.nix

@@ -1,16 +1,14 @@
 { lib, mkDerivation, fetchFromGitHub, ghc, glibcLocales }:
 
 mkDerivation rec {
-
-  # Version 0.2 is meant to be used with the Agda 2.6.1 compiler.
   pname = "cubical";
-  version = "0.2";
+  version = "0.3pred5030a9";
 
   src = fetchFromGitHub {
     repo = pname;
     owner = "agda";
-    rev = "v${version}";
-    sha256 = "07qlp2f189jvzbn3aqvpqk2zxpkmkxhhkjsn62iq436kxqj3z6c2";
+    rev = "d5030a9c89070255fc575add4e9f37b97e6a0c0c";
+    sha256 = "18achbxap4ikydigmz3m3xjfn3i9dw4rn8yih82vrlc01j02nqpi";
   };
 
   LC_ALL = "en_US.UTF-8";

pkgs/development/libraries/armadillo/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "10.5.3";
+  version = "10.6.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-5sUdjVKm94ucZFn2mGE1CT4O5wWmdDBxEPYXXyzV7jc=";
+    sha256 = "sha256-HQbDI31lx7xGHqEvT9/YtaabapZbSQCucJYM6SCIF58=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/fcft/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fcft";
-  version = "2.4.3";
+  version = "2.4.4";
 
   src = fetchzip {
     url = "https://codeberg.org/dnkl/fcft/archive/${version}.tar.gz";
-    sha256 = "0hxvd6xbvgq1rk8851gswffmvh3fv41lyvz4fhwzln7m12759yw8";
+    sha256 = "0ycc2xy9jhxcxwbfk9d4jdxgf2zsc664phbf859kshb822m3jf57";
   };
 
   depsBuildBuild = [ pkg-config ];

pkgs/development/libraries/intel-media-driver/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
-  version = "21.2.3";
+  version = "21.3.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "media-driver";
     rev    = "intel-media-${version}";
-    sha256 = "0nldd1yfyvwnpkh0v3ni09z2zwmj84px0pcd1w50brvny36r814c";
+    sha256 = "1byliq1c80xfklm3d2d910j1i7s7pfi3i3c6baigag1kzgc0apd0";
   };
 
   cmakeFlags = [

pkgs/development/libraries/libmwaw/default.nix

@@ -21,6 +21,7 @@ stdenv.mkDerivation {
   src = fetchurl {
     inherit (s) url sha256;
   };
+  enableParallelBuilding = true;
   meta = {
     inherit (s) version;
     description = "Import library for some old mac text documents";

pkgs/development/libraries/libtgvoip/default.nix

@@ -1,48 +0,0 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch
-, pkg-config, autoreconfHook
-, openssl, libopus, alsa-lib, libpulseaudio
-}:
-
-with lib;
-
-stdenv.mkDerivation rec {
-  pname = "libtgvoip";
-  version = "unstable-2021-07-13";
-
-  src = fetchFromGitHub {
-    owner = "telegramdesktop";
-    repo = "libtgvoip";
-    rev = "f321e7c8cc086bac6ae06fa0934aac7d9833a310";
-    sha256 = "1gk5nsqhbnn1cdh83b70qr3d3v2c1bncylvgn77vvj8vnyjlmnfq";
-  };
-
-  # To fix the build without external webrtc:
-  patches = [
-    (fetchpatch {
-      # Use methods from updated webrtc.
-      url = "https://github.com/telegramdesktop/libtgvoip/commit/13a5fcb16b04472d808ce122abd695dbf5d206cd.patch";
-      sha256 = "0wapqvml3yyv5dlp2q8iih5rfvfnkngll69krhnw5xsdjy22sp7r";
-      revert = true;
-    })
-    (fetchpatch {
-      # Allow working with external webrtc.
-      url = "https://github.com/telegramdesktop/libtgvoip/commit/6e82b6e45664c1f80b9039256c99bebc76d34672.patch";
-      sha256 = "0m87ixja70vnm80a9z4gxk0yl7n64y59smczxb88lxnj6kdgih7x";
-      revert = true;
-    })
-  ];
-
-  outputs = [ "out" "dev" ];
-
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
-  buildInputs = [ openssl libopus alsa-lib libpulseaudio ];
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "VoIP library for Telegram clients";
-    license = licenses.unlicense;
-    platforms = platforms.linux;
-    homepage = "https://github.com/telegramdesktop/libtgvoip";
-    maintainers = with maintainers; [ ilya-fedin ];
-  };
-}

pkgs/development/libraries/pipewire/default.nix

@@ -48,7 +48,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.31";
+    version = "0.3.32";
 
     outputs = [
       "out"
@@ -66,7 +66,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "1dirz69ami7bcgy6hhh0ffi9gzwcy9idg94nvknwvwkjw4zm8m79";
+      sha256 = "0f5hkypiy1qjqj3frzz128668hzbi0fqmj0j21z7rp51y62dapnp";
     };
 
     patches = [

pkgs/development/libraries/tezos-rust-libs/default.nix

@@ -19,10 +19,11 @@ rustPlatform.buildRustPackage rec {
   '';
 
   postInstall = ''
-    mkdir $out/lib/tezos-rust-libs
     cp -r rustc-bls12-381/include $out/include
-    cp $out/lib/librustc_bls12_381.a $out/lib/tezos-rust-libs
-    cp $out/lib/librustzcash.a $out/lib/tezos-rust-libs
+    cp -r librustzcash/include $out
+    cp -r $out/lib $out/tmp
+    mkdir $out/lib/tezos-rust-libs
+    mv $out/tmp/ $out/lib/tezos-rust-libs/
   '';
 
   doCheck = true;

pkgs/development/libraries/webkitgtk/default.nix

@@ -63,7 +63,7 @@ assert enableGeoLocation -> geoclue2 != null;
 
 stdenv.mkDerivation rec {
   pname = "webkitgtk";
-  version = "2.32.1";
+  version = "2.32.3";
 
   outputs = [ "out" "dev" ];
 
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "05v9hgpkc6mi2klrd8nqql1n8xzq8rgdz3hvyy369xkhgwqifq8k";
+    sha256 = "sha256-wfSW9axlTv5M72L71PL77u8mWgfF50GeXSkAv+6lLLw=";
   };
 
   patches = lib.optionals stdenv.isLinux [

pkgs/development/mobile/gomobile/default.nix

@@ -3,21 +3,20 @@
 , xcodeWrapper ? xcodeenv.composeXcodeWrapper xcodeWrapperArgs
 , androidPkgs ? androidenv.composeAndroidPackages {
     includeNDK = true;
-    ndkVersion = "21.3.6528147"; # WARNING: 22.0.7026061 is broken.
+    ndkVersion = "22.1.7171670";
   } }:
 
 buildGoModule {
   pname = "gomobile";
-  version = "unstable-2020-06-22";
+  version = "unstable-2021-06-14";
 
-  vendorSha256 = "1n1338vqkc1n8cy94501n7jn3qbr28q9d9zxnq2b4rxsqjfc9l94";
+  vendorSha256 = "1irgkgv72rakg7snk1bnp10ibr64ykz9l40s59l4fnl63zsh12a0";
 
   src = fetchgit {
-    # WARNING: Next commit removes support for ARM 32 bit builds for iOS
-    rev = "33b80540585f2b31e503da24d6b2a02de3c53ff5";
+    rev = "7c8f154d100840bc5828285bb390bbae1cb5a98c";
     name = "gomobile";
     url = "https://go.googlesource.com/mobile";
-    sha256 = "0c9map2vrv34wmaycsv71k4day3b0z5p16yzxmlp8amvqb38zwlm";
+    sha256 = "1w9mra1mqf60iafp0ywvja5196fjsjyfhvz4yizqq4qkyll5qmj1";
   };
 
   subPackages = [ "bind" "cmd/gobind" "cmd/gomobile" ];
@@ -25,8 +24,6 @@ buildGoModule {
   # Fails with: go: cannot find GOROOT directory
   doCheck = false;
 
-  patches = [ ./resolve-nix-android-sdk.patch ];
-
   nativeBuildInputs = [ makeWrapper ]
     ++ lib.optionals stdenv.isDarwin [ xcodeWrapper ];
 
@@ -48,8 +45,8 @@ buildGoModule {
     wrapProgram $out/bin/gomobile \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ zlib ]}" \
       --prefix PATH : "${androidPkgs.androidsdk}/bin" \
-      --set ANDROID_HOME "${androidPkgs.androidsdk}/libexec/android-sdk" \
-      --set GOPATH $out
+      --set ANDROID_NDK_HOME "${androidPkgs.androidsdk}/libexec/android-sdk/ndk-bundle" \
+      --set ANDROID_HOME "${androidPkgs.androidsdk}/libexec/android-sdk"
   '';
 
   meta = with lib; {

pkgs/development/mobile/gomobile/resolve-nix-android-sdk.patch

@@ -1,15 +0,0 @@
-diff --git a/cmd/gomobile/bind_androidapp.go b/cmd/gomobile/bind_androidapp.go
-index 3b01adc..76216fa 100644
---- a/cmd/gomobile/bind_androidapp.go
-+++ b/cmd/gomobile/bind_androidapp.go
-@@ -372,6 +372,10 @@ func androidAPIPath() (string, error) {
- 	var apiVer int
- 	for _, fi := range fis {
- 		name := fi.Name()
-+		// Resolve symlinked directories (this is how the Nix Android SDK package is built)
-+		if fi2, err := os.Stat(filepath.Join(sdkDir.Name(), name)); err == nil {
-+			fi = fi2
-+		}
- 		if !fi.IsDir() || !strings.HasPrefix(name, "android-") {
- 			continue
- 		}

pkgs/development/ocaml-modules/hack_parallel/default.nix

@@ -0,0 +1,26 @@
+{ lib, fetchFromGitHub, buildDunePackage, core, core_kernel, pkg-config, sqlite
+}:
+buildDunePackage rec {
+  pname = "hack_parallel";
+  version = "1.0.1";
+  useDune2 = true;
+  minimumOcamlVersion = "4.04.1";
+
+  src = fetchFromGitHub {
+    owner = "rvantonder";
+    repo = "hack_parallel";
+    rev = version;
+    sha256 = "0qjlkw35r4q2cm0n2x0i73zvx1xgrp6axaia2nm8zxpm49mid629";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ core core_kernel sqlite ];
+
+  meta = {
+    description =
+      "Core parallel and shared memory library used by Hack, Flow, and Pyre";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/rvantonder/hack_parallel";
+  };
+}

pkgs/development/ocaml-modules/mparser/default.nix

@@ -1,25 +1,21 @@
-{ stdenv, lib, fetchzip, ocaml, findlib, ocamlbuild }:
+{ lib, fetchFromGitHub, buildDunePackage }:
 
-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-mparser-1.2.3";
-  src = fetchzip {
-    url = "https://github.com/cakeplus/mparser/archive/1.2.3.tar.gz";
-    sha256 = "1f8vpagmv0jdm50pxs2xwh2xcmvgaprx4kw871hlml9ahsflxgnw";
+buildDunePackage rec {
+  pname = "mparser";
+  version = "1.3";
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "murmour";
+    repo = "mparser";
+    rev = version;
+    sha256 = "16j19v16r42gcsii6a337zrs5cxnf12ig0vaysxyr7sq5lplqhkx";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
-
-  configurePhase = "ocaml setup.ml -configure";
-  buildPhase = "ocaml setup.ml -build";
-  installPhase = "ocaml setup.ml -install";
-
-  createFindlibDestdir = true;
-
   meta = {
     description = "A simple monadic parser combinator OCaml library";
     license = lib.licenses.lgpl21Plus;
-    homepage = "https://github.com/cakeplus/mparser";
+    homepage = "https://github.com/murmour/mparser";
     maintainers = [ lib.maintainers.vbgl ];
-    inherit (ocaml.meta) platforms;
   };
 }

pkgs/development/ocaml-modules/mparser/pcre.nix

@@ -0,0 +1,12 @@
+{ fetchFromGitHub, buildDunePackage, ocaml_pcre, mparser }:
+
+buildDunePackage rec {
+  pname = "mparser-pcre";
+  useDune2 = true;
+
+  inherit (mparser) src version;
+
+  propagatedBuildInputs = [ ocaml_pcre mparser ];
+
+  meta = mparser.meta // { description = "PCRE-based regular expressions"; };
+}

pkgs/development/ocaml-modules/parany/default.nix

@@ -2,15 +2,16 @@
 
 buildDunePackage rec {
   pname = "parany";
-  version = "8.0.0";
+  version = "12.0.3";
 
   useDune2 = true;
+  minimumOCamlVersion = "4.03.0";
 
   src = fetchFromGitHub {
     owner = "UnixJunkie";
-    repo   = pname;
-    rev    = "v${version}";
-    sha256 = "19yz1yqyqx6gawy93jlh3x6vji2p9qsy6nsbj65q5pii8p1fjlsm";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1j962ak68kvv62bczjqxwlwvdgcvjfcs36qwq12nnm0pwlzkhg33";
   };
 
   propagatedBuildInputs = [ ocamlnet cpu ];

pkgs/development/ocaml-modules/tezos/base.nix

@@ -0,0 +1,33 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-crypto
+, tezos-micheline
+, ptime
+, ezjsonm
+, ipaddr
+, qcheck-alcotest
+, crowbar
+}:
+
+buildDunePackage {
+  pname = "tezos-base";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-crypto
+    tezos-micheline
+    ptime
+    ezjsonm
+    ipaddr
+  ];
+
+  checkInputs = [
+    qcheck-alcotest
+    crowbar
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: meta-package and pervasive type definitions for Tezos";
+  };
+}

pkgs/development/ocaml-modules/tezos/clic.nix

@@ -0,0 +1,25 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-stdlib-unix
+, alcotest
+, alcotest-lwt
+}:
+
+buildDunePackage {
+  pname = "tezos-clic";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-stdlib-unix
+  ];
+
+  checkInputs = [
+    alcotest
+    alcotest-lwt
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: library of auto-documented command-line-parsing combinators";
+  };
+}

pkgs/development/ocaml-modules/tezos/crypto.nix

@@ -0,0 +1,38 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-clic
+, tezos-rpc
+, bls12-381
+, hacl-star
+, secp256k1-internal
+, uecc
+, ringo
+, ff
+, alcotest
+, alcotest-lwt
+}:
+
+buildDunePackage {
+  pname = "tezos-crypto";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-clic
+    tezos-rpc
+    bls12-381
+    hacl-star
+    secp256k1-internal
+    uecc
+    ringo
+  ];
+
+  checkInputs = [
+    alcotest
+    alcotest-lwt
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: library with all the cryptographic primitives used by Tezos";
+  };
+}

pkgs/development/ocaml-modules/tezos/error-monad.nix

@@ -0,0 +1,30 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, data-encoding
+, lwt
+, lwt-canceler
+, alcotest
+, alcotest-lwt
+}:
+
+buildDunePackage {
+  pname = "tezos-error-monad";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-stdlib
+    data-encoding
+    lwt
+    lwt-canceler
+  ];
+
+  checkInputs = [
+    alcotest
+    alcotest-lwt
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: error monad";
+  };
+}

pkgs/development/ocaml-modules/tezos/event-logging.nix

@@ -0,0 +1,22 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-lwt-result-stdlib
+, lwt_log
+, alcotest
+, alcotest-lwt
+}:
+
+buildDunePackage {
+  pname = "tezos-event-logging";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-lwt-result-stdlib
+    lwt_log
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: event logging library";
+  };
+}

pkgs/development/ocaml-modules/tezos/lmdb.nix

@@ -0,0 +1,51 @@
+{ lib
+, fetchFromGitLab
+, pkg-config
+, buildDunePackage
+, lmdb
+, rresult
+, cstruct
+, alcotest
+}:
+
+buildDunePackage rec {
+  pname = "tezos-lmdb";
+  version = "7.4";
+  src = fetchFromGitLab {
+    owner = "tezos";
+    repo = "tezos";
+    rev = "v${version}";
+    sha256 = "18q02j74aa8mxv233kvyb62xbhjngzpgppp6kgr4m53d7a78wgsm";
+  };
+
+  useDune2 = true;
+
+  preBuild = ''
+    rm dune
+    rm -rf src
+    rm -rf docs
+    ls vendors | grep -v ocaml-lmdb |xargs rm -rf
+  '';
+
+  buildInputs = [
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    rresult
+    lmdb
+  ];
+
+  checkInputs = [
+    cstruct
+    alcotest
+  ];
+
+  doCheck = false;
+
+  meta = {
+    description = "Legacy Tezos OCaml binding to LMDB (Consider ocaml-lmdb instead)";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.ulrikstrid ];
+  };
+}

pkgs/development/ocaml-modules/tezos/lwt-result-stdlib.nix

@@ -0,0 +1,32 @@
+{ lib
+, buildDunePackage
+, ocaml
+, tezos-stdlib
+, tezos-error-monad
+, alcotest
+, alcotest-lwt
+, crowbar
+}:
+
+if lib.versionAtLeast ocaml.version "4.12" then
+  throw "tezos-lwt-result-stdlib-${tezos-stdlib.version} is not available for OCaml > 4.10"
+else
+
+buildDunePackage {
+  pname = "tezos-lwt-result-stdlib";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-error-monad
+  ];
+
+  checkInputs = [
+    alcotest
+    alcotest-lwt
+    crowbar
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: error-aware stdlib replacement";
+  };
+}

pkgs/development/ocaml-modules/tezos/micheline.nix

@@ -0,0 +1,28 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-error-monad
+, uutf
+, alcotest
+, alcotest-lwt
+, ppx_inline_test
+}:
+
+buildDunePackage {
+  pname = "tezos-micheline";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-error-monad
+    uutf
+  ];
+
+  checkInputs = [
+    alcotest
+    alcotest-lwt
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: internal AST and parser for the Michelson language";
+  };
+}

pkgs/development/ocaml-modules/tezos/p2p-services.nix

@@ -0,0 +1,18 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-base
+}:
+
+buildDunePackage {
+  pname = "tezos-p2p-services";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-base
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: descriptions of RPCs exported by `tezos-p2p`";
+  };
+}

pkgs/development/ocaml-modules/tezos/p2p.nix

@@ -0,0 +1,25 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-p2p-services
+, alcotest-lwt
+, lwt-watcher
+}:
+
+buildDunePackage {
+  pname = "tezos-p2p";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-p2p-services
+    lwt-watcher
+  ];
+
+  checkInputs = [
+    alcotest-lwt
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: library for a pool of P2P connections";
+  };
+}

pkgs/development/ocaml-modules/tezos/protocol-008-PtEdo2Zk-parameters.nix

@@ -0,0 +1,19 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-protocol-008-PtEdo2Zk
+, qcheck-alcotest
+}:
+
+buildDunePackage {
+  pname = "tezos-protocol-008-PtEdo2Zk-parameters";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-protocol-008-PtEdo2Zk
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos/Protocol: parameters";
+  };
+}

pkgs/development/ocaml-modules/tezos/protocol-008-PtEdo2Zk.nix

@@ -0,0 +1,23 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-protocol-compiler
+}:
+
+buildDunePackage {
+  pname = "tezos-protocol-008-PtEdo2Zk";
+  inherit (tezos-stdlib) version src useDune2 doCheck;
+
+  preBuild = ''
+    rm -rf vendors
+    substituteInPlace src/proto_008_PtEdo2Zk/lib_protocol/dune.inc --replace "-nostdlib" ""
+  '';
+
+  propagatedBuildInputs = [
+    tezos-protocol-compiler
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos/Protocol: economic-protocol definition";
+  };
+}

pkgs/development/ocaml-modules/tezos/protocol-compiler.nix

@@ -0,0 +1,29 @@
+{ lib
+, buildDunePackage
+, ocaml
+, tezos-stdlib
+, tezos-protocol-environment
+, ocp-ocamlres
+, pprint
+}:
+
+if lib.versionAtLeast ocaml.version "4.12" then
+  throw "tezos-protocol-compiler-${tezos-stdlib.version} is not available for OCaml > 4.10"
+else
+
+buildDunePackage {
+  pname = "tezos-protocol-compiler";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  minimalOCamlVersion = "4.09";
+
+  propagatedBuildInputs = [
+    tezos-protocol-environment
+    ocp-ocamlres
+    pprint
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: economic-protocol compiler";
+  };
+}

pkgs/development/ocaml-modules/tezos/protocol-demo-noops.nix

@@ -0,0 +1,18 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-protocol-compiler
+}:
+
+buildDunePackage {
+  pname = "tezos-protocol-demo-noops";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-protocol-compiler
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos/Protocol: demo_noops economic-protocol definition";
+  };
+}

pkgs/development/ocaml-modules/tezos/protocol-environment-packer.nix

@@ -0,0 +1,15 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+}:
+
+buildDunePackage {
+  pname = "tezos-protocol-environment-packer";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  minimalOCamlVersion = "4.03";
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: sigs/structs packer for economic protocol environment";
+  };
+}

pkgs/development/ocaml-modules/tezos/protocol-environment-sigs.nix

@@ -0,0 +1,30 @@
+{ lib
+, buildDunePackage
+, ocaml
+, tezos-stdlib
+, tezos-protocol-environment-packer
+, zarith
+}:
+
+buildDunePackage {
+  pname = "tezos-protocol-environment-sigs";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-protocol-environment-packer
+  ];
+
+  checkInputs = [
+    tezos-stdlib
+  ];
+
+  postPatch = ''
+    cp -f ${zarith}/lib/ocaml/${ocaml.version}/site-lib/zarith/z.mli ./src/lib_protocol_environment/sigs/v1/z.mli
+    sed -i 's/out_channel/Stdlib.out_channel/g' ./src/lib_protocol_environment/sigs/v1/z.mli
+    sed -i 's/Buffer/Stdlib.Buffer/g' ./src/lib_protocol_environment/sigs/v1/z.mli
+  '';
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: restricted typing environment for the economic protocols";
+  };
+}

pkgs/development/ocaml-modules/tezos/protocol-environment-structs.nix

@@ -0,0 +1,20 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-crypto
+, tezos-protocol-environment-packer
+}:
+
+buildDunePackage {
+  pname = "tezos-protocol-environment-structs";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-crypto
+    tezos-protocol-environment-packer
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: restricted typing environment for the economic protocols";
+  };
+}

pkgs/development/ocaml-modules/tezos/protocol-environment.nix

@@ -0,0 +1,33 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-base
+, tezos-sapling
+, tezos-protocol-environment-sigs
+, tezos-protocol-environment-structs
+, zarith
+, alcotest-lwt
+, crowbar
+}:
+
+buildDunePackage {
+  pname = "tezos-protocol-environment";
+  inherit (tezos-stdlib) version src useDune2 doCheck preBuild;
+
+  propagatedBuildInputs = [
+    tezos-sapling
+    tezos-base
+    tezos-protocol-environment-sigs
+    tezos-protocol-environment-structs
+    zarith # this might break, since they actually want 1.11
+  ];
+
+  checkInputs = [
+    alcotest-lwt
+    crowbar
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: custom economic-protocols environment implementation for `tezos-client` and testing";
+  };
+}

pkgs/development/ocaml-modules/tezos/requester.nix

@@ -0,0 +1,27 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-base
+, tezos-test-services
+, lwt-watcher
+, alcotest-lwt
+}:
+
+buildDunePackage {
+  pname = "tezos-requester";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-base
+    lwt-watcher
+  ];
+
+  checkInputs = [
+    alcotest-lwt
+    tezos-test-services
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: generic resource fetching service";
+  };
+}

pkgs/development/ocaml-modules/tezos/rpc.nix

@@ -0,0 +1,22 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-error-monad
+, resto
+, resto-directory
+}:
+
+buildDunePackage {
+  pname = "tezos-rpc";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-error-monad
+    resto
+    resto-directory
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: library of auto-documented RPCs (service and hierarchy descriptions)";
+  };
+}

pkgs/development/ocaml-modules/tezos/sapling.nix

@@ -0,0 +1,31 @@
+{ lib
+, buildDunePackage
+, ocaml
+, tezos-stdlib
+, tezos-crypto
+, tezos-rust-libs
+, alcotest-lwt
+}:
+
+buildDunePackage {
+  pname = "tezos-sapling";
+  inherit (tezos-stdlib) version src useDune2 preBuild;
+
+  propagatedBuildInputs = [
+    tezos-crypto
+    tezos-rust-libs
+  ];
+
+  checkInputs = [
+    alcotest-lwt
+  ];
+
+  doCheck = false;
+
+  # This is a hack to work around the hack used in the dune files
+  OPAM_SWITCH_PREFIX = "${tezos-rust-libs}";
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos/Protocol: economic-protocol definition";
+  };
+}

pkgs/development/ocaml-modules/tezos/shell-services.nix

@@ -0,0 +1,22 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-workers
+, tezos-p2p-services
+, tezos-version
+}:
+
+buildDunePackage {
+  pname = "tezos-shell-services";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-workers
+    tezos-p2p-services
+    tezos-version
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: descriptions of RPCs exported by `tezos-shell`";
+  };
+}

pkgs/development/ocaml-modules/tezos/stdlib-unix.nix

@@ -0,0 +1,30 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-event-logging
+, lwt
+, ptime
+, mtime
+, ipaddr
+, re
+, alcotest
+, alcotest-lwt
+}:
+
+buildDunePackage {
+  pname = "tezos-stdlib-unix";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-event-logging
+    lwt
+    ptime
+    mtime
+    ipaddr
+    re
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: yet-another local-extension of the OCaml standard library (unix-specific fragment)";
+  };
+}

pkgs/development/ocaml-modules/tezos/stdlib.nix

@@ -0,0 +1,53 @@
+{ lib
+, fetchFromGitLab
+, buildDunePackage
+, hex
+, lwt
+, zarith
+, alcotest
+, alcotest-lwt
+, crowbar
+, bigstring
+, lwt_log
+}:
+
+buildDunePackage rec {
+  pname = "tezos-stdlib";
+  version = "8.3";
+  src = fetchFromGitLab {
+    owner = "tezos";
+    repo = "tezos";
+    rev = "v${version}";
+    sha256 = "12cv2cssnw60jbpnh6xjysxgsgcj7d72454k4zs2b8fjx7mkgksk";
+  };
+
+  minimalOCamlVersion = "4.0.8";
+
+  useDune2 = true;
+
+  preBuild = ''
+    rm -rf vendors
+  '';
+
+  propagatedBuildInputs = [
+    hex
+    lwt
+    zarith
+  ];
+
+  checkInputs = [
+    alcotest
+    alcotest-lwt
+    crowbar
+    bigstring
+    lwt_log
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "Tezos: yet-another local-extension of the OCaml standard library";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.ulrikstrid ];
+  };
+}

pkgs/development/ocaml-modules/tezos/test-services.nix

@@ -0,0 +1,20 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-base
+, alcotest-lwt
+}:
+
+buildDunePackage {
+  pname = "tezos-test-services";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-base
+    alcotest-lwt
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: Alcotest-based test services";
+  };
+}

pkgs/development/ocaml-modules/tezos/version.nix

@@ -0,0 +1,18 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-base
+}:
+
+buildDunePackage {
+  pname = "tezos-version";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-base
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: version information generated from Git";
+  };
+}

pkgs/development/ocaml-modules/tezos/workers.nix

@@ -0,0 +1,18 @@
+{ lib
+, buildDunePackage
+, tezos-stdlib
+, tezos-base
+}:
+
+buildDunePackage {
+  pname = "tezos-workers";
+  inherit (tezos-stdlib) version src useDune2 preBuild doCheck;
+
+  propagatedBuildInputs = [
+    tezos-base
+  ];
+
+  meta = tezos-stdlib.meta // {
+    description = "Tezos: worker library";
+  };
+}

pkgs/development/python-modules/ailment/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.0.9031";
+  version = "9.0.9166";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xyNTcGTGH8030CJif6an+kDZIfOUVDMiRhFamVajAzk=";
+    sha256 = "09qbqn57h92f81xv35f645ai7nkkqf7cidkg3qrwfpxcwc2g9kdz";
   };
 
   propagatedBuildInputs = [ pyvex ];

pkgs/development/python-modules/aioesphomeapi/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "4.1.0";
+  version = "5.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0210l2d5g76pllr2vh990k9shfv3zrknx5d2dmgqb5y90142cp76";
+    sha256 = "sha256-2IxXhAysQiqqEd4Mfjgc5vX0+D60rof2nPJDXy9tRVs=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/aiohomekit/default.nix

@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, commentjson
 , cryptography
 , fetchFromGitHub
 , poetry-core
@@ -11,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "0.4.2";
+  version = "0.5.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Jc2k";
     repo = pname;
     rev = version;
-    sha256 = "12v9szalh3yzfqgmspk4ch8l38kzmhwzjn9jvsq632n4zhjd7qg4";
+    sha256 = "sha256-Fo9KWBcN6Y/fa7vkWugSer5L7+hOWz99+hw6Hz1LAMM=";
   };
 
   nativeBuildInputs = [
@@ -26,6 +27,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    commentjson
     cryptography
     zeroconf
   ];

pkgs/development/python-modules/aionotion/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aionotion";
-  version = "3.0.1";
+  version = "3.0.2";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "1ydrazg7gcwf53006n1fvxh9zm77by6zi36haq1bmy5skqccyiki";
+    sha256 = "1328g2245h9gcrnzrbcxaxw78723d0skznrrj8k77fbijxdc4kwv";
   };
 
   nativeBuildInputs = [ poetry-core ];

pkgs/development/python-modules/aiorecollect/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "aiorecollect";
-  version = "1.0.5";
+  version = "1.0.6";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "0h76l0pahnmls0radknzm8dw79qx9dv0xhxqnn6011j9fwyviyqm";
+    sha256 = "0vm19rcy14fdsfddjskxh0nlph10jrj3qh6xqwv73wgcmbdpr91i";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/angr/default.nix

@@ -43,14 +43,14 @@ in
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.0.9031";
+  version = "9.0.9166";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qWAz9SHfQU0cdk4yVekJn5OIDPJPbi63CDdlHDq1Opw=";
+    sha256 = "1h1jb57zp8wy24xy60j76sl4hrzhhwfsvfx26zhbnhqzmwghpd5x";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/angrop/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "angrop";
-  version = "9.0.9031";
+  version = "9.0.9166";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3q/3iFR0FFOcvgmNVXtgi1Spu5xfXNJFy+QoIh8amOY=";
+    sha256 = "1myrzp5axg0dj7kxqc2mz3kfqlds3vzvavcncrj5y9xpx8m7l71m";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/archinfo/default.nix

@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.0.9031";
+  version = "9.0.9166";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-pzBMyw5FwQV1FyhvOxUq39s96p0KKSrkEvJzhJQdS4E=";
+    sha256 = "0y77lyz019rm9zgxpam6dbb006c7j66hwy985h3fg6nbz74pcml5";
   };
 
   checkInputs = [

pkgs/development/python-modules/async-upnp-client/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "async-upnp-client";
-  version = "0.19.0";
+  version = "0.19.1";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "StevenLooman";
     repo = "async_upnp_client";
     rev = version;
-    sha256 = "0xj3j54nasl59gs1k84h3fixjsaqn7whg33h6wi99l5yfbwfqv8p";
+    sha256 = "sha256-qxEn9UrQuwRaP7sZlu3854gDI7Gqku055DF8KvsU6p4=";
   };
 
   propagatedBuildInputs = [