Merge master into staging-next

2024-11-20 04:31:52 +00:00 · 2021-10-30 18:00:59 +00:00 · 2021-10-30 18:00:59 +00:00 · 0fa76ebdca
parent 846f94d984 17f73e2261
commit 0fa76ebdca
84 changed files with 1119 additions and 444 deletions
--- a/doc/languages-frameworks/crystal.section.md
+++ b/doc/languages-frameworks/crystal.section.md
@ -4,12 +4,12 @@

 This section uses [Mint](https://github.com/mint-lang/mint) as an example for how to build a Crystal package.

-If the Crystal project has any dependencies, the first step is to get a `shards.nix` file encoding those. Get a copy of the project and go to its root directory such that its `shard.lock` file is in the current directory, then run `crystal2nix` in it
-
+If the Crystal project has any dependencies, the first step is to get a `shards.nix` file encoding those. Get a copy of the project and go to its root directory such that its `shard.lock` file is in the current directory. Executable projects should usually commit the `shard.lock` file, but sometimes that's not the case, which means you need to generate it yourself. With an existing `shard.lock` file, `crystal2nix` can be run.
 ```bash
 $ git clone https://github.com/mint-lang/mint
 $ cd mint
 $ git checkout 0.5.0
+$ if [ ! -f shard.lock ]; then nix-shell -p shards --run "shards lock"; fi
 $ nix-shell -p crystal2nix --run crystal2nix
 ```

--- a/nixos/modules/installer/tools/nixos-enter.sh
+++ b/nixos/modules/installer/tools/nixos-enter.sh
@ -60,6 +60,35 @@ chmod 0755 "$mountPoint/dev" "$mountPoint/sys"
 mount --rbind /dev "$mountPoint/dev"
 mount --rbind /sys "$mountPoint/sys"

+# modified from https://github.com/archlinux/arch-install-scripts/blob/bb04ab435a5a89cd5e5ee821783477bc80db797f/arch-chroot.in#L26-L52
+chroot_add_resolv_conf() {
+    local chrootdir=$1 resolv_conf=$1/etc/resolv.conf
+
+    [[ -e /etc/resolv.conf ]] || return 0
+
+    # Handle resolv.conf as a symlink to somewhere else.
+    if [[ -L $chrootdir/etc/resolv.conf ]]; then
+      # readlink(1) should always give us *something* since we know at this point
+      # it's a symlink. For simplicity, ignore the case of nested symlinks.
+      # We also ignore the possibility if `../`s escaping the root.
+      resolv_conf=$(readlink "$chrootdir/etc/resolv.conf")
+      if [[ $resolv_conf = /* ]]; then
+        resolv_conf=$chrootdir$resolv_conf
+      else
+        resolv_conf=$chrootdir/etc/$resolv_conf
+      fi
+    fi
+
+    # ensure file exists to bind mount over
+    if [[ ! -f $resolv_conf ]]; then
+      install -Dm644 /dev/null "$resolv_conf" || return 1
+    fi
+
+    mount --bind /etc/resolv.conf "$resolv_conf"
+}
+
+chroot_add_resolv_conf "$mountPoint" || print "ERROR: failed to set up resolv.conf"
+
 (
    # If silent, write both stdout and stderr of activation script to /dev/null
    # otherwise, write both streams to stderr of this process
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -992,6 +992,7 @@
  ./services/web-apps/jitsi-meet.nix
  ./services/web-apps/keycloak.nix
  ./services/web-apps/lemmy.nix
+  ./services/web-apps/invidious.nix
  ./services/web-apps/limesurvey.nix
  ./services/web-apps/mastodon.nix
  ./services/web-apps/mattermost.nix
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@ -0,0 +1,263 @@
+{ lib, config, pkgs, options, ... }:
+let
+  cfg = config.services.invidious;
+  # To allow injecting secrets with jq, json (instead of yaml) is used
+  settingsFormat = pkgs.formats.json { };
+  inherit (lib) types;
+
+  settingsFile = settingsFormat.generate "invidious-settings" cfg.settings;
+
+  serviceConfig = {
+    systemd.services.invidious = {
+      description = "Invidious (An alternative YouTube front-end)";
+      wants = [ "network-online.target" ];
+      after = [ "syslog.target" "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      script =
+        let
+          jqFilter = "."
+            + lib.optionalString (cfg.database.host != null) "[0].db.password = \"'\"'\"$(cat ${lib.escapeShellArg cfg.database.passwordFile})\"'\"'\""
+            + " | .[0]"
+            + lib.optionalString (cfg.extraSettingsFile != null) " * .[1]";
+          jqFiles = [ settingsFile ] ++ lib.optional (cfg.extraSettingsFile != null) cfg.extraSettingsFile;
+        in
+        ''
+          export INVIDIOUS_CONFIG="$(${pkgs.jq}/bin/jq -s "${jqFilter}" ${lib.escapeShellArgs jqFiles})"
+          exec ${cfg.package}/bin/invidious
+        '';
+
+      serviceConfig = {
+        RestartSec = "2s";
+        DynamicUser = true;
+
+        CapabilityBoundingSet = "";
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+      };
+    };
+
+    services.invidious.settings = {
+      inherit (cfg) port;
+
+      # Automatically initialises and migrates the database if necessary
+      check_tables = true;
+
+      db = {
+        user = lib.mkDefault "kemal";
+        dbname = lib.mkDefault "invidious";
+        port = cfg.database.port;
+        # Blank for unix sockets, see
+        # https://github.com/will/crystal-pg/blob/1548bb255210/src/pq/conninfo.cr#L100-L108
+        host = if cfg.database.host == null then "" else cfg.database.host;
+        # Not needed because peer authentication is enabled
+        password = lib.mkIf (cfg.database.host == null) "";
+      };
+    } // (lib.optionalAttrs (cfg.domain != null) {
+      inherit (cfg) domain;
+    });
+
+    assertions = [{
+      assertion = cfg.database.host != null -> cfg.database.passwordFile != null;
+      message = "If database host isn't null, database password needs to be set";
+    }];
+  };
+
+  # Settings necessary for running with an automatically managed local database
+  localDatabaseConfig = lib.mkIf cfg.database.createLocally {
+    # Default to using the local database if we create it
+    services.invidious.database.host = lib.mkDefault null;
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = lib.singleton cfg.settings.db.dbname;
+      ensureUsers = lib.singleton {
+        name = cfg.settings.db.user;
+        ensurePermissions = {
+          "DATABASE ${cfg.settings.db.dbname}" = "ALL PRIVILEGES";
+        };
+      };
+      # This is only needed because the unix user invidious isn't the same as
+      # the database user. This tells postgres to map one to the other.
+      identMap = ''
+        invidious invidious ${cfg.settings.db.user}
+      '';
+      # And this specifically enables peer authentication for only this
+      # database, which allows passwordless authentication over the postgres
+      # unix socket for the user map given above.
+      authentication = ''
+        local ${cfg.settings.db.dbname} ${cfg.settings.db.user} peer map=invidious
+      '';
+    };
+
+    systemd.services.invidious-db-clean = {
+      description = "Invidious database cleanup";
+      documentation = [ "https://docs.invidious.io/Database-Information-and-Maintenance.md" ];
+      startAt = lib.mkDefault "weekly";
+      path = [ config.services.postgresql.package ];
+      script = ''
+        psql ${cfg.settings.db.dbname} ${cfg.settings.db.user} -c "DELETE FROM nonces * WHERE expire < current_timestamp"
+        psql ${cfg.settings.db.dbname} ${cfg.settings.db.user} -c "TRUNCATE TABLE videos"
+      '';
+      serviceConfig = {
+        DynamicUser = true;
+        User = "invidious";
+      };
+    };
+
+    systemd.services.invidious = {
+      requires = [ "postgresql.service" ];
+      after = [ "postgresql.service" ];
+
+      serviceConfig = {
+        User = "invidious";
+      };
+    };
+  };
+
+  nginxConfig = lib.mkIf cfg.nginx.enable {
+    services.invidious.settings = {
+      https_only = config.services.nginx.virtualHosts.${cfg.domain}.forceSSL;
+      external_port = 80;
+    };
+
+    services.nginx = {
+      enable = true;
+      virtualHosts.${cfg.domain} = {
+        locations."/".proxyPass = "http://127.0.0.1:${toString cfg.port}";
+
+        enableACME = lib.mkDefault true;
+        forceSSL = lib.mkDefault true;
+      };
+    };
+
+    assertions = [{
+      assertion = cfg.domain != null;
+      message = "To use services.invidious.nginx, you need to set services.invidious.domain";
+    }];
+  };
+in
+{
+  options.services.invidious = {
+    enable = lib.mkEnableOption "Invidious";
+
+    package = lib.mkOption {
+      type = types.package;
+      default = pkgs.invidious;
+      defaultText = "pkgs.invidious";
+      description = "The Invidious package to use.";
+    };
+
+    settings = lib.mkOption {
+      type = settingsFormat.type;
+      default = { };
+      description = ''
+        The settings Invidious should use.
+
+        See <link xlink:href="https://github.com/iv-org/invidious/blob/master/config/config.example.yml">config.example.yml</link> for a list of all possible options.
+      '';
+    };
+
+    extraSettingsFile = lib.mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        A file including Invidious settings.
+
+        It gets merged with the setttings specified in <option>services.invidious.settings</option>
+        and can be used to store secrets like <literal>hmac_key</literal> outside of the nix store.
+      '';
+    };
+
+    # This needs to be outside of settings to avoid infinite recursion
+    # (determining if nginx should be enabled and therefore the settings
+    # modified).
+    domain = lib.mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The FQDN Invidious is reachable on.
+
+        This is used to configure nginx and for building absolute URLs.
+      '';
+    };
+
+    port = lib.mkOption {
+      type = types.port;
+      # Default from https://docs.invidious.io/Configuration.md
+      default = 3000;
+      description = ''
+        The port Invidious should listen on.
+
+        To allow access from outside,
+        you can use either <option>services.invidious.nginx</option>
+        or add <literal>config.services.invidious.port</literal> to <option>networking.firewall.allowedTCPPorts</option>.
+      '';
+    };
+
+    database = {
+      createLocally = lib.mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to create a local database with PostgreSQL.
+        '';
+      };
+
+      host = lib.mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          The database host Invidious should use.
+
+          If <literal>null</literal>, the local unix socket is used. Otherwise
+          TCP is used.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = types.port;
+        default = options.services.postgresql.port.default;
+        description = ''
+          The port of the database Invidious should use.
+
+          Defaults to the the default postgresql port.
+        '';
+      };
+
+      passwordFile = lib.mkOption {
+        type = types.nullOr types.str;
+        apply = lib.mapNullable toString;
+        default = null;
+        description = ''
+          Path to file containing the database password.
+        '';
+      };
+    };
+
+    nginx.enable = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to configure nginx as a reverse proxy for Invidious.
+
+        It serves it under the domain specified in <option>services.invidious.settings.domain</option> with enabled TLS and ACME.
+        Further configuration can be done through <option>services.nginx.virtualHosts.''${config.services.invidious.settings.domain}.*</option>,
+        which can also be used to disable AMCE and TLS.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    serviceConfig
+    localDatabaseConfig
+    nginxConfig
+  ]);
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -173,6 +173,7 @@ in
  hedgedoc = handleTest ./hedgedoc.nix {};
  herbstluftwm = handleTest ./herbstluftwm.nix {};
  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
+  invidious = handleTest ./invidious.nix {};
  oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
  # 9pnet_virtio used to mount /nix partition doesn't support
  # hibernation. This test happens to work on x86_64-linux but
--- a/nixos/tests/invidious.nix
+++ b/nixos/tests/invidious.nix
@ -0,0 +1,81 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "invidious";
+
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ sbruder ];
+  };
+
+  machine = { config, lib, pkgs, ... }: {
+    services.invidious = {
+      enable = true;
+    };
+
+    specialisation = {
+      nginx.configuration = {
+        services.invidious = {
+          nginx.enable = true;
+          domain = "invidious.example.com";
+        };
+        services.nginx.virtualHosts."invidious.example.com" = {
+          forceSSL = false;
+          enableACME = false;
+        };
+        networking.hosts."127.0.0.1" = [ "invidious.example.com" ];
+      };
+      postgres-tcp.configuration = {
+        services.invidious = {
+          database = {
+            createLocally = false;
+            host = "127.0.0.1";
+            passwordFile = toString (pkgs.writeText "database-password" "correct horse battery staple");
+          };
+        };
+        # Normally not needed because when connecting to postgres over TCP/IP
+        # the database is most likely on another host.
+        systemd.services.invidious = {
+          after = [ "postgresql.service" ];
+          requires = [ "postgresql.service" ];
+        };
+        services.postgresql =
+          let
+            inherit (config.services.invidious.settings.db) dbname user;
+          in
+          {
+            enable = true;
+            initialScript = pkgs.writeText "init-postgres-with-password" ''
+              CREATE USER kemal WITH PASSWORD 'correct horse battery staple';
+              CREATE DATABASE invidious;
+              GRANT ALL PRIVILEGES ON DATABASE invidious TO kemal;
+            '';
+          };
+      };
+    };
+  };
+
+  testScript = { nodes, ... }: ''
+    def curl_assert_status_code(url, code, form=None):
+        assert int(machine.succeed(f"curl -s -o /dev/null -w %{{http_code}} {'-F ' + form + ' ' if form else '''}{url}")) == code
+
+
+    def activate_specialisation(name: str):
+        machine.succeed(f"${nodes.machine.config.system.build.toplevel}/specialisation/{name}/bin/switch-to-configuration test >&2")
+
+
+    url = "http://localhost:${toString nodes.machine.config.services.invidious.port}"
+    port = ${toString nodes.machine.config.services.invidious.port}
+
+    machine.wait_for_open_port(port)
+    curl_assert_status_code(f"{url}/search", 200)
+
+    activate_specialisation("nginx")
+    machine.wait_for_open_port(80)
+    curl_assert_status_code("http://invidious.example.com/search", 200)
+
+    # Remove the state so the `initialScript` gets run
+    machine.succeed("systemctl stop postgresql")
+    machine.succeed("rm -r /var/lib/postgresql")
+    activate_specialisation("postgres-tcp")
+    machine.wait_for_open_port(port)
+    curl_assert_status_code(f"{url}/search", 200)
+  '';
+})
--- a/nixos/tests/sssd-ldap.nix
+++ b/nixos/tests/sssd-ldap.nix
@ -1,96 +1,94 @@
-({ pkgs, ... }:
-  let
-    dbDomain = "example.org";
-    dbSuffix = "dc=example,dc=org";
+let
+  dbDomain = "example.org";
+  dbSuffix = "dc=example,dc=org";

-    ldapRootUser = "admin";
-    ldapRootPassword = "foobar";
+  ldapRootUser = "admin";
+  ldapRootPassword = "foobar";

-    testUser = "alice";
-  in import ./make-test-python.nix {
-    name = "sssd-ldap";
+  testUser = "alice";
+in import ./make-test-python.nix ({pkgs, ...}: {
+  name = "sssd-ldap";

-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bbigras ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ bbigras ];
+  };

-    machine = { pkgs, ... }: {
-      services.openldap = {
-        enable = true;
-        settings = {
-          children = {
-            "cn=schema".includes = [
-              "${pkgs.openldap}/etc/schema/core.ldif"
-              "${pkgs.openldap}/etc/schema/cosine.ldif"
-              "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
-              "${pkgs.openldap}/etc/schema/nis.ldif"
-            ];
-            "olcDatabase={1}mdb" = {
-              attrs = {
-                objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
-                olcDatabase = "{1}mdb";
-                olcDbDirectory = "/var/db/openldap";
-                olcSuffix = dbSuffix;
-                olcRootDN = "cn=${ldapRootUser},${dbSuffix}";
-                olcRootPW = ldapRootPassword;
-              };
+  machine = { pkgs, ... }: {
+    services.openldap = {
+      enable = true;
+      settings = {
+        children = {
+          "cn=schema".includes = [
+            "${pkgs.openldap}/etc/schema/core.ldif"
+            "${pkgs.openldap}/etc/schema/cosine.ldif"
+            "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+            "${pkgs.openldap}/etc/schema/nis.ldif"
+          ];
+          "olcDatabase={1}mdb" = {
+            attrs = {
+              objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
+              olcDatabase = "{1}mdb";
+              olcDbDirectory = "/var/db/openldap";
+              olcSuffix = dbSuffix;
+              olcRootDN = "cn=${ldapRootUser},${dbSuffix}";
+              olcRootPW = ldapRootPassword;
            };
          };
        };
-        declarativeContents = {
-          ${dbSuffix} = ''
-            dn: ${dbSuffix}
-            objectClass: top
-            objectClass: dcObject
-            objectClass: organization
-            o: ${dbDomain}
-
-            dn: ou=posix,${dbSuffix}
-            objectClass: top
-            objectClass: organizationalUnit
-
-            dn: ou=accounts,ou=posix,${dbSuffix}
-            objectClass: top
-            objectClass: organizationalUnit
-
-            dn: uid=${testUser},ou=accounts,ou=posix,${dbSuffix}
-            objectClass: person
-            objectClass: posixAccount
-            # userPassword: somePasswordHash
-            homeDirectory: /home/${testUser}
-            uidNumber: 1234
-            gidNumber: 1234
-            cn: ""
-            sn: ""
-          '';
-        };
      };
+      declarativeContents = {
+        ${dbSuffix} = ''
+          dn: ${dbSuffix}
+          objectClass: top
+          objectClass: dcObject
+          objectClass: organization
+          o: ${dbDomain}

-      services.sssd = {
-        enable = true;
-        config = ''
-          [sssd]
-          config_file_version = 2
-          services = nss, pam, sudo
-          domains = ${dbDomain}
+          dn: ou=posix,${dbSuffix}
+          objectClass: top
+          objectClass: organizationalUnit

-          [domain/${dbDomain}]
-          auth_provider = ldap
-          id_provider = ldap
-          ldap_uri = ldap://127.0.0.1:389
-          ldap_search_base = ${dbSuffix}
-          ldap_default_bind_dn = cn=${ldapRootUser},${dbSuffix}
-          ldap_default_authtok_type = password
-          ldap_default_authtok = ${ldapRootPassword}
+          dn: ou=accounts,ou=posix,${dbSuffix}
+          objectClass: top
+          objectClass: organizationalUnit
+
+          dn: uid=${testUser},ou=accounts,ou=posix,${dbSuffix}
+          objectClass: person
+          objectClass: posixAccount
+          # userPassword: somePasswordHash
+          homeDirectory: /home/${testUser}
+          uidNumber: 1234
+          gidNumber: 1234
+          cn: ""
+          sn: ""
        '';
      };
    };

-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("openldap.service")
-      machine.wait_for_unit("sssd.service")
-      machine.succeed("getent passwd ${testUser}")
-    '';
-  }
-)
+    services.sssd = {
+      enable = true;
+      config = ''
+        [sssd]
+        config_file_version = 2
+        services = nss, pam, sudo
+        domains = ${dbDomain}
+
+        [domain/${dbDomain}]
+        auth_provider = ldap
+        id_provider = ldap
+        ldap_uri = ldap://127.0.0.1:389
+        ldap_search_base = ${dbSuffix}
+        ldap_default_bind_dn = cn=${ldapRootUser},${dbSuffix}
+        ldap_default_authtok_type = password
+        ldap_default_authtok = ${ldapRootPassword}
+      '';
+    };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("openldap.service")
+    machine.wait_for_unit("sssd.service")
+    machine.succeed("getent passwd ${testUser}")
+  '';
+})
--- a/pkgs/applications/logging/humioctl/default.nix
+++ b/pkgs/applications/logging/humioctl/default.nix
@ -1,8 +1,8 @@
 { buildGoModule, fetchFromGitHub, installShellFiles, lib }:

 let
-  humioCtlVersion = "0.28.6";
-  sha256 = "sha256-15RRoTr+N+DsILYF1KndAwsW329w+UxHfB1VaWnkEFI=";
+  humioCtlVersion = "0.28.11";
+  sha256 = "sha256-CdGeGpOEWYn7yIWJxWpRrSPHcuult+jtqpjYaSjfBLQ=";
  vendorSha256 = "sha256-fgRQ2n5tzj5s4rT65VIqh61wDwu+x/fWhpaKwyr8XWA=";
 in buildGoModule {
    name = "humioctl-${humioCtlVersion}";
--- a/pkgs/applications/misc/flavours/default.nix
+++ b/pkgs/applications/misc/flavours/default.nix
@ -2,18 +2,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "flavours";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "Misterio77";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1bgi6p7l0bh9k4vkwvngk7q19ynia0z1ninb1cq8qnwwpll6kbya";
+    sha256 = "sha256-77nSz3J/9TsptpSHRFYY8mZAvn+o35gro2OwQkGzEC0=";
  };

  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];

-  cargoSha256 = "07hwxhfcbqbwb3hz18w92h1lhdiwwy7abhwpimzx7syyavp4rmn4";
+  cargoSha256 = "sha256-UukLWMd8+wq5Y0dtePH312c1Nm4ztXPsoPHPN0nUb1w=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/misc/heimer/default.nix
+++ b/pkgs/applications/misc/heimer/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "heimer";
-  version = "2.6.0";
+  version = "2.8.0";

  src = fetchFromGitHub {
    owner = "juzzlin";
    repo = pname;
    rev = version;
-    sha256 = "sha256-VSj6bSb92XMsfvDH+cey2GXLnJajUBaCqLMgkv2fnSo=";
+    sha256 = "sha256-838uH8nTxl3FJvtYrLDmS6tYYRdNnFzftZ5RZE8tVpE=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/networking/browsers/elinks/default.nix
+++ b/pkgs/applications/networking/browsers/elinks/default.nix
@ -13,13 +13,13 @@ assert enablePython -> python != null;

 stdenv.mkDerivation rec {
  pname = "elinks";
-  version = "0.14.2";
+  version = "0.14.3";

  src = fetchFromGitHub {
    owner = "rkd77";
    repo = "felinks";
    rev = "v${version}";
-    sha256 = "sha256-/VsxMpITBDKJqyMwl1oitS8aUM4AziibV/OHRSHbRjg=";
+    sha256 = "sha256-vyzuMU2Qfz8DMRP0+QQmSx8J40ADTMJqg2jQOZJQxUA=";
  };

  buildInputs = [
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "2.1.5";
-  commit = "7af9dfb3524c13e941ab604e36e49a617fe47d2e";
+  version = "2.1.6";
+  commit = "a346cf933e10d872eae26bff8e58c5e7ac40db25";
  tag = "v${version}";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = tag;
-    sha256 = "sha256-dFhbYw7SAo7/eumqIEWpLqgQWFAWeAEvfqWsbya6cCA=";
+    sha256 = "sha256-8DeVO7Wr1bFZXTp2kaEPizDwNU5ZsA1fykccaDUivh8=";
  };

  vendorSha256 = "sha256-N45yRlBGZ/c9ve2YPcWA26pylV8hzxjPh6evKtkgnoc=";
--- a/pkgs/applications/networking/cluster/helmsman/default.nix
+++ b/pkgs/applications/networking/cluster/helmsman/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "helmsman";
-  version = "3.7.5";
+  version = "3.7.7";

  src = fetchFromGitHub {
    owner = "Praqma";
    repo = "helmsman";
    rev = "v${version}";
-    sha256 = "sha256-QJXCVcEf23oaTDemoCV/2aaajbubfXg0AfZrlSTS4Ag=";
+    sha256 = "sha256-duNkvRMq3CKAGDDsrDWKydFZRt6fxuO0uP2Ff3HA+ek=";
  };

  vendorSha256 = "sha256-4imZrZfpR/5tw9ZFSTr7Gx4G9O1iHNE9YRYMOJFKvHU=";
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.35.1";
+  version = "0.35.5";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-DCum3vCrN530Z0VW0WEoLtjN+kre/mU9O+sJxckZgfc=";
+    sha256 = "sha256-VUB1zZwRZ+TUFDcq/lBB9eAeM7d5zWhFy7nxzH5S6oc=";
  };

  vendorSha256 = "sha256-y84EFmoJS4SeA5YFIVFU0iWa5NnjU5yvOj7OFE+jGN0=";
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@ -20,13 +20,13 @@ assert pulseaudioSupport -> libpulseaudio != null;

 gnuradio3_8Minimal.pkgs.mkDerivation rec {
  pname = "gqrx";
-  version = "2.14.4";
+  version = "2.14.6";

  src = fetchFromGitHub {
    owner = "csete";
    repo = "gqrx";
    rev = "v${version}";
-    sha256 = "sha256-mMaxu0jq2GaNLWjLsJQXx+zCxtyiCAZQJJZ8GJtnllQ=";
+    sha256 = "sha256-DMmQXcGPudAVOwuc+LVrcIzfwMMQVBZPbM6Bt1w56D8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/terminal-emulators/hyper/default.nix
+++ b/pkgs/applications/terminal-emulators/hyper/default.nix
@ -15,11 +15,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "hyper";
-  version = "3.1.3";
+  version = "3.1.4";

  src = fetchurl {
    url = "https://github.com/vercel/hyper/releases/download/v${version}/hyper_${version}_amd64.deb";
-    sha256 = "sha256-w+FISIeGf3K1dnykIEzU3KevyaFNl4X0beT6DdLW+zQ=";
+    sha256 = "sha256-4C0vx4m/ojOJl5ownsbasSFiIrJ9kfJJWh0y4j/DGIQ=";
  };

  nativeBuildInputs = [ dpkg ];
--- a/pkgs/applications/window-managers/jwm/jwm-settings-manager.nix
+++ b/pkgs/applications/window-managers/jwm/jwm-settings-manager.nix
@ -1,14 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, gettext, libXpm, libGL, fltk, hicolor-icon-theme, glib, gnome2, which }:
+{ lib, stdenv, fetchbzr, cmake, pkg-config, gettext, libXpm, libGL, fltk, hicolor-icon-theme, glib, gnome2, which }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "jwm-settings-manager";
-  version = "2018-10-19";
+  version = "2019-01-27";

-  src = fetchFromGitHub {
-    owner = "Israel-D";
-    repo = "jwm-settings-manager";
-    rev = "cb32a70563cf1f3927339093481542b85ec3c8c8";
-    sha256 = "0d5bqf74p8zg8azns44g46q973blhmp715k8kcd73x88g7sfir8s";
+  src = fetchbzr {
+    url = "lp:${pname}";
+    rev = "292";
+    sha256 = "1yqc1ac2pbkc88z7p1qags1jygdlr5y1rhc5mx6gapcf54bk0lmi";
  };

  nativeBuildInputs = [
@ -34,6 +33,11 @@ stdenv.mkDerivation {
      --replace 'DESTINATION usr/share' "DESTINATION share"
  '';

+  postConfigure = ''
+    substituteInPlace cmake_install.cmake \
+      --replace "/var/empty" "/usr"
+  '';
+
  meta = with lib; {
    description = "A full configuration manager for JWM";
    homepage = "https://joewing.net/projects/jwm";
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , nix-update-script
 , appstream
 , appstream-glib
@ -30,13 +31,13 @@

 stdenv.mkDerivation rec {
  pname = "appcenter";
-  version = "3.8.1";
+  version = "3.8.2";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "sha256-d7DGyAC8itBxTfuabDPN16W4S4d42s5UPp8AusZfy5k=";
+    sha256 = "sha256-NHKP1vzb8qu+EkUWDvLWLl4U4pW9ZxbE7YFI6Vwesfg=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , nix-update-script
 , pantheon
@ -32,7 +33,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-files";
-  version = "6.0.3";
+  version = "6.0.4";

  repoName = "files";

@ -42,7 +43,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "10hgj5rrqxzk4q8jlhkwwrs4hgyavlhz3z1pqf36y663bq3h0izv";
+    sha256 = "sha256-FH6EYtgKADp8jjBoCwsdRdknlKS9v3iOtPiT3CyEc/8=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix
@ -1,6 +1,6 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , pantheon
 , pkg-config
@ -20,7 +20,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-shortcut-overlay";
-  version = "1.2.0";
+  version = "1.2.1";

  repoName = "shortcut-overlay";

@ -28,22 +28,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1zs2fpx4agr00rsfmpi00nhiw92mlypzm4p9x3g851p24m62fn79";
-  };
-
-  patches = [
-    # Upstream code not respecting our localedir
-    # https://github.com/elementary/shortcut-overlay/pull/100
-    (fetchpatch {
-      url = "https://github.com/elementary/shortcut-overlay/commit/f26e3684568e30cb6e151438e2d86c4d392626bf.patch";
-      sha256 = "0zxyqpk9xbxdm8lmgdwbb4yzzwbjlhypsca3xs34a2pl0b9pcdwd";
-    })
-  ];
-
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
+    sha256 = "sha256-qmqzGCM3cVM6y80pzjm5CCyG6BO6XlKZiODAAEnwVrM=";
  };

  nativeBuildInputs = [
@ -65,6 +50,12 @@ stdenv.mkDerivation rec {
    libhandy
  ];

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
  meta = with lib; {
    description = "A native OS-wide shortcut overlay to be launched by Gala";
    homepage = "https://github.com/elementary/shortcut-overlay";
--- a/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-capnet-assist";
-  version = "2.3.0";
+  version = "2.4.0";

  repoName = "capnet-assist";

@ -27,13 +27,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1gma8a04ndivx1fd3ha9f45r642qq2li80wrd6dsrp4v3vqix9bn";
-  };
-
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
+    sha256 = "sha256-UdkS+w61c8z2TCJyG7YsDb0n0b2LOpFyaHzMbdCJsZI=";
  };

  nativeBuildInputs = [
@ -55,16 +49,17 @@ stdenv.mkDerivation rec {
    webkitgtk
  ];

-  # Not useful here or in elementary - See: https://github.com/elementary/capnet-assist/issues/3
-  patches = [
-    ./remove-capnet-test.patch
-  ];
-
  postPatch = ''
    chmod +x meson/post_install.py
    patchShebangs meson/post_install.py
  '';

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
  meta = with lib; {
    description = "A small WebKit app that assists a user with login when a captive portal is detected";
    homepage = "https://github.com/elementary/capnet-assist";
--- a/pkgs/desktops/pantheon/services/elementary-capnet-assist/remove-capnet-test.patch
+++ b/pkgs/desktops/pantheon/services/elementary-capnet-assist/remove-capnet-test.patch
@ -1,13 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 46c594b..ba0ea10 100644
--- a/meson.build
-+++ b/meson.build
-@@ -33,8 +33,3 @@ meson.add_install_script('meson/post_install.py')
- 
- subdir('data')
- subdir('po')
-
-install_data(
-    '90captive_portal_test',
-    install_dir: join_paths(get_option('sysconfdir'), 'NetworkManager', 'dispatcher.d')
-)
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@ -9,10 +9,19 @@ in
  inherit mkGraal;

  graalvm11-ce = mkGraal rec {
-    version = lib.fileContents ./version;
+    version = "21.3.0";
    javaVersion = "11";
    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
  };

-  # TODO: added graalvm17-ce
+  # TODO: fix aarch64-linux, failing during Native Image compilation
+  # "Caused by: java.io.IOException: Cannot run program
+  # "/nix/store/1q1mif7h3lgxdaxg6j39hli5azikrfla-gcc-wrapper-9.3.0/bin/gcc" (in
+  # directory"/tmp/SVM-4194439592488143713"): error=0, Failed to exec spawn
+  # helper: pid: 19865, exit value: 1"
+  graalvm17-ce = mkGraal rec {
+    version = "21.3.0";
+    javaVersion = "17";
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
 }
--- a/pkgs/development/compilers/graalvm/community-edition/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
@ -4,39 +4,53 @@
  {
    sha256 = {
      "11-linux-aarch64" = "0hsjxp6ly7jsn9k94fddcl7afc5gda66jyppcnfvslishbizqd0i";
+      "17-linux-aarch64" = "09hzl80m7f5ppmcvryz9aq0yw9scdkp5dqhblrqnkzyhvdjl5ycn";
      "11-linux-amd64" = "1ylk5l933z813k0k1xlayiv8fa0f1gmpr66bma51532iy3mch6rs";
+      "17-linux-amd64" = "1xn3shwkai61vvzsg595k8776a21ds00w2pjlscvfcbs1ag07n0i";
      "11-darwin-amd64" = "0qpqnnmqxvxzj3mwz05acpg4n8ffqsz0sji8lbl03fgswpvgfavc";
+      "17-darwin-amd64" = "1akpsrd9r2igcls0cvhpqw3jrnh59m8z80knx83lmj0cj836a8v0";
    }.${javaVersionPlatform} or null;
    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/graalvm-ce-java${javaVersionPlatform}-21.3.0.tar.gz";
  }
  {
    sha256 = {
      "11-linux-aarch64" = "0qlmg5fwvqsb5ab3irj2hrcd5jc94mibnlz1gvzpnq85rw1zcb6h";
+      "17-linux-aarch64" = "0jmarhwngs6vpbcgsix0dxhj42qj9vnk3vln8fhdxmydwnns8r1m";
      "11-linux-amd64" = "0kvnjr55rizy53vn0ff9w27z1qh9d1vp3s7r1kdl0wyhrbhd8n49";
+      "17-linux-amd64" = "0h14sml42jda54agjs1prfnyjaxxsc67350fr51n8p20nl28lj6z";
      "11-darwin-amd64" = "1mg8c8hh8wmbwsisgarmp35jd0dall1fwdv49mggp74hicbc32h3";
+      "17-darwin-amd64" = "0qz0xf2ph9gi45vvri7vphxh35m11nk7sa8nkwxl28l8bza0kb40";
    }.${javaVersionPlatform} or null;
    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/native-image-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
  }
  {
    sha256 = {
      "11-linux-aarch64" = "02rvwl1nng8d3qn226rjx5yq2blxs4yz009ab928qanhmb4vhv8b";
+      "17-linux-aarch64" = "13kaxbgfp9pm6s28i5hfyg957iiwzrxf0ibibkv2yndgj64vj8xg";
      "11-linux-amd64" = "0zz62zr7imjaw9a3j5m66xs7c72cqb1i74ab3rnlh0dgs1mdpljg";
+      "17-linux-amd64" = "1v2iwznlav8dsjj30nlhvsvv7pxmyzkhkp1p7spjjma09d34q4iv";
      "11-darwin-amd64" = "1wiv0299b2xrc229alczmjfj1bsn90p0wdm64rr39xnyyhbqrr80";
+      "17-darwin-amd64" = "095sii8ibjcvvc6wnxk77ax151c4zgj8bpp81q3kyaazgpzvrk5s";
    }.${javaVersionPlatform} or null;
    url = "https://github.com/oracle/truffleruby/releases/download/vm-21.3.0/ruby-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
  }
  {
    sha256 = {
      "11-linux-aarch64" = "1ck4c1z98h1zn4i6xhh1hb6w2jab6n17ddykb72xxw4vig9nhlc7";
+      "17-linux-aarch64" = "0p9gx5iq730br9wvacxs4403anxnjln6mx8v0dl4w4lhikjxsy8x";
      "11-linux-amd64" = "0gy8jj9d9msmj0i44sysiwq3j2k2w2g47fhq6y1aq47n3kmwj9kv";
+      "17-linux-amd64" = "0qk8rgbmnk84isnb33x5bbh17bnnmq9yqasfgy5p953min6pbxj7";
      "11-darwin-amd64" = "0agw6k3jn2jh8wyc9h8rvzlgs96qh4nlj0y8nyzsmidvwq2ahl00";
+      "17-darwin-amd64" = "0l1il0rq48sw6sha9jr0xphjgrm7q0kywy8z94mabm9maqh7l3rn";
    }.${javaVersionPlatform} or null;
    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/wasm-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
  }
  {
    sha256 = {
      "11-linux-amd64" = "1l5av2v459q88zfl83877h7b3426z3d86kp6wqjvz2441brvidi0";
+      "17-linux-amd64" = "100p1cgw0z4yfy4axb3gr32m8jnyx1f8bj6f6kk0mf3l8fv2kb7p";
      "11-darwin-amd64" = "06694n74dzsfwlli1sjdsrfbj9ngw7bhrcayvy4sgy2va5qpdjs0";
+      "17-darwin-amd64" = "1qwg45q0760lsa62h0nk2zdv0r1npr82bh6p1z3md6pjppm7i025";
    }.${javaVersionPlatform} or null;
    url = "https://github.com/graalvm/graalpython/releases/download/vm-21.3.0/python-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
  }
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@ -1,4 +1,4 @@
-{ version, javaVersion, platforms }:
+{ version, javaVersion, platforms, hashes ? import ./hashes.nix }:

 { stdenv, lib, fetchurl, autoPatchelfHook, setJavaClassPath, makeWrapper
 # minimum dependencies
@ -35,9 +35,7 @@ let
        maybeFetchUrl = url: if url.sha256 != null then (fetchurl url) else null;
      in
      (lib.remove null
-        (map
-          maybeFetchUrl
-          (import ./hashes.nix { inherit javaVersionPlatform; })));
+        (map maybeFetchUrl (hashes { inherit javaVersionPlatform; })));

    buildInputs = lib.optionals stdenv.isLinux [
      alsa-lib # libasound.so wanted by lib/libjsound.so
@ -111,12 +109,6 @@ let
    outputs = [ "out" "lib" ];

    installPhase = let
-      nativePRNGWorkaround = path: ''
-        # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
-        substituteInPlace ${path} \
-          --replace file:/dev/random    file:/dev/./urandom \
-          --replace NativePRNGBlocking  SHA1PRNG
-      '';
      copyClibrariesToOut = basepath: ''
        # provide libraries needed for static compilation
        for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
@ -134,25 +126,30 @@ let
      '';
    in {
      "11-linux-amd64" = ''
-        ${nativePRNGWorkaround "$out/conf/security/java.security"}
+        ${copyClibrariesToOut "$out/lib/svm/clibraries"}

+        ${copyClibrariesToLib}
+      '';
+      "17-linux-amd64" = ''
        ${copyClibrariesToOut "$out/lib/svm/clibraries"}

        ${copyClibrariesToLib}
      '';
      "11-linux-aarch64" = ''
-        ${nativePRNGWorkaround "$out/conf/security/java.security"}
-
        ${copyClibrariesToOut "$out/lib/svm/clibraries"}

        ${copyClibrariesToLib}
      '';
-      "11-darwin-amd64" = ''
-        # create empty $lib/lib to avoid breaking builds
-        mkdir -p $lib/lib
-        ${nativePRNGWorkaround "$out/conf/security/java.security"}
+      "17-linux-aarch64" = ''
+        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+
+        ${copyClibrariesToLib}
      '';
+      "11-darwin-amd64" = "";
+      "17-darwin-amd64" = "";
    }.${javaVersionPlatform} + ''
+      # ensure that $lib/lib exists to avoid breaking builds
+      mkdir -p $lib/lib
      # jni.h expects jni_md.h to be in the header search path.
      ln -s $out/include/linux/*_md.h $out/include/
    '';
@ -237,9 +234,12 @@ let
      }

      echo "Testing TruffleRuby"
+      # Hide warnings about wrong locale
+      export LANG=C
+      export LC_ALL=C
      $out/bin/ruby -e 'puts(1 + 1)'
-
-      ${# TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
+      ${# FIXME: irb is broken in all platforms
+        # TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
        # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
        # though `openssl` is in `propagatedBuildInputs`. For more details see:
        # https://github.com/NixOS/nixpkgs/pull/105815
@ -252,7 +252,7 @@ let
          echo '1 + 1' | $out/bin/irb
        ''
      }
-      '';
+    '';

    passthru = {
      home = graalvmXXX-ce;
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -p curl -i bash coreutils nix common-updater-scripts curl jq
+#!nix-shell -p coreutils curl nix jq gnused -i bash

 set -eou pipefail

@ -13,18 +13,23 @@ verlte() {
    [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
 }

-readonly old_version="$(cat version)"
+readonly nixpkgs=../../../../..
+
+readonly old_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm11-ce.version)"

 if [[ -z "${1:-}" ]]; then
-  readonly gh_version="$(curl -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | jq --raw-output .tag_name)"
+  readonly gh_version="$(curl \
+      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+      -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | \
+      jq --raw-output .tag_name)"
  readonly new_version="${gh_version//vm-/}"
 else
  readonly new_version="$1"
 fi

-if verlte "$new_version" "$old_version"; then
-  info "graalvm-ce $old_version is up-to-date. Exiting..."
-  exit 0
+if verlte "$old_version" "$new_version"; then
+  info "graalvm-ce $old_version is up-to-date."
+  [[ -z "${FORCE:-}" ]]  && exit 0
 else
  info "graalvm-ce $old_version is out-of-date. Updating..."
 fi
@ -39,8 +44,11 @@ readonly urls=(

 readonly platforms=(
  "11-linux-aarch64"
+  "17-linux-aarch64"
  "11-linux-amd64"
+  "17-linux-amd64"
  "11-darwin-amd64"
+  "17-darwin-amd64"
 )

 info "Deleting old hashes.nix file..."
@ -66,7 +74,8 @@ done

 echo_file "]"

-info "Updating 'version' file..."
-echo "$new_version" > version
+info "Updating graalvm-ce version..."
+# update-source-version does not work here since it expects src attribute
+sed "s|$old_version|\"$new_version\"|" -i default.nix

 info "Done!"
--- a/pkgs/development/compilers/graalvm/community-edition/version
+++ b/pkgs/development/compilers/graalvm/community-edition/version
@ -1 +0,0 @@
-21.3.0
--- a/pkgs/development/coq-modules/zorns-lemma/default.nix
+++ b/pkgs/development/coq-modules/zorns-lemma/default.nix
@ -1,9 +1,8 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 with lib;

-mkCoqDerivation {
+(mkCoqDerivation {
  pname = "zorns-lemma";
-  repo = "topology";

  releaseRev = v: "v${v}";

@ -38,4 +37,4 @@ mkCoqDerivation {
    maintainers = with maintainers; [ siraben ];
    license = licenses.lgpl21Plus;
  };
-}
+}).overrideAttrs({version, ...}: if versions.isGe "9.0" version then { repo =  "topology"; } else {})
--- a/pkgs/development/interpreters/gnudatalanguage/default.nix
+++ b/pkgs/development/interpreters/gnudatalanguage/default.nix
@ -102,13 +102,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gnudatalanguage";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = "gdl";
    rev = "v${version}";
-    sha256 = "sha256-Y9LVRaWjQqpWqjNngxB406PE/rl/9S8rs0u0CK5ivUA=";
+    sha256 = "sha256-IrCLL8MQp0SkWj7sbfZlma5FrnMbgdl4E/1nPGy0Y60=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/xgboost/default.nix
+++ b/pkgs/development/libraries/xgboost/default.nix
@ -16,14 +16,14 @@ assert ncclSupport -> cudaSupport;

 stdenv.mkDerivation rec {
  pname = "xgboost";
-  version = "1.4.1";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "dmlc";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "12b1417dg8jqyxd72kg5a3xhg5h11vz0k7bkv72mzrv83jvgn5ci";
+    sha256 = "sha256-xrRKpZ6NSBtEL2CBN7KggDwIvQKIPD8EBlA0oCJv8mw=";
  };

  nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.isDarwin llvmPackages.openmp;
--- a/pkgs/development/ocaml-modules/sedlex/default.nix
+++ b/pkgs/development/ocaml-modules/sedlex/default.nix
@ -1,16 +1,18 @@
-{ stdenv, lib, fetchzip, ocaml, findlib, gen, ppx_tools_versioned, ocaml-migrate-parsetree }:
+{ stdenv, lib, fetchFromGitHub, ocaml, findlib, gen, ppx_tools_versioned, ocaml-migrate-parsetree }:

 if !lib.versionAtLeast ocaml.version "4.02"
 then throw "sedlex is not available for OCaml ${ocaml.version}"
 else

 stdenv.mkDerivation rec {
-  name = "ocaml${ocaml.version}-sedlex-${version}";
+  pname = "ocaml${ocaml.version}-sedlex";
  version = "1.99.5";

-  src = fetchzip {
-    url = "https://github.com/ocaml-community/sedlex/archive/fb84e1766fc4b29e79ec40029ffee5cdb37b392f.tar.gz";
-    sha256 = "0phnqyn6mpv5byr1kkphl24y9q9fb2k3xg9yb457h5816q6ya72n";
+  src = fetchFromGitHub {
+    owner = "ocaml-community";
+    repo = "sedlex";
+    rev = "fb84e1766fc4b29e79ec40029ffee5cdb37b392f";
+    sha256 = "sha256-VhzlDTYBFXgKWT69PqZYLuHkiaDwzhmyX2XfaqzHFl4=";
  };

  buildInputs = [ ocaml findlib ];
--- a/pkgs/development/ocaml-modules/sqlite3EZ/default.nix
+++ b/pkgs/development/ocaml-modules/sqlite3EZ/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, twt, ocaml_sqlite3 }:
+{ lib, stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild, twt, ocaml_sqlite3 }:

 assert lib.versionAtLeast (lib.getVersion ocaml) "3.12";

@ -6,12 +6,15 @@ if lib.versionAtLeast ocaml.version "4.06"
 then throw "sqlite3EZ is not available for OCaml ${ocaml.version}"
 else

-stdenv.mkDerivation {
-  name = "ocaml-sqlite3EZ-0.1.0";
+stdenv.mkDerivation rec {
+  pname = "ocaml-sqlite3EZ";
+  version = "0.1.0";

-  src = fetchurl {
-    url = "https://github.com/mlin/ocaml-sqlite3EZ/archive/v0.1.0.tar.gz";
-    sha256 = "8ed2c5d5914a65cbd95589ef11bfb8b38a020eb850cdd49b8adce7ee3a563748";
+  src = fetchFromGitHub {
+    owner = "mlin";
+    repo = "ocaml-sqlite3EZ";
+    rev = "v${version}";
+    sha256 = "sha256-pKysvth0efxJeyJQY2Dnqarg7OtsKyyLnFV/1ZhsfDY=";
  };

  buildInputs = [ ocaml findlib ocamlbuild twt ];
@ -25,6 +28,6 @@ stdenv.mkDerivation {
    description = "A thin wrapper for sqlite3-ocaml with a simplified interface";
    license = licenses.mit;
    maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
  };
 }
--- a/pkgs/development/ocaml-modules/twt/default.nix
+++ b/pkgs/development/ocaml-modules/twt/default.nix
@ -1,11 +1,14 @@
-{ lib, stdenv, fetchzip, ocaml, findlib }:
+{ lib, stdenv, fetchFromGitHub, ocaml, findlib }:

-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-twt-0.94.0";
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-twt";
+  version = "0.94.0";

-  src = fetchzip {
-    url = "https://github.com/mlin/twt/archive/v0.94.0.tar.gz";
-    sha256 = "0298gdgzl4cifxnc1d8sbrvz1lkiq5r5ifkq1fparm6gvqywpf65";
+  src = fetchFromGitHub {
+    owner = "mlin";
+    repo = "twt";
+    rev = "v${version}";
+    sha256 = "sha256-xbjLPd7P1KyuC3i6WHLBcdLwd14atcBsd5ER+l97KAk=";
  };

  buildInputs = [ ocaml findlib ];
@ -26,6 +29,6 @@ stdenv.mkDerivation {
    description = "“The Whitespace Thing” for OCaml";
    license = licenses.mit;
    maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
  };
 }
--- a/pkgs/development/ocaml-modules/typerep/default.nix
+++ b/pkgs/development/ocaml-modules/typerep/default.nix
@ -1,4 +1,4 @@
-{lib, buildOcaml, fetchurl, type_conv}:
+{ lib, buildOcaml, fetchFromGitHub, type_conv }:

 buildOcaml rec {
  name = "typerep";
@ -6,9 +6,11 @@ buildOcaml rec {

  minimumSupportedOcamlVersion = "4.00";

-  src = fetchurl {
-    url = "https://github.com/janestreet/typerep/archive/${version}.tar.gz";
-    sha256 = "4f1ab611a00aaf774e9774b26b687233e0c70d91f684415a876f094a9969eada";
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = "typerep";
+    rev = version;
+    sha256 = "sha256-XCdUZp9Buwmo6qPYAoPD2P/gUgyWHTR7boyecBPKlho=";
  };

  propagatedBuildInputs = [ type_conv ];
--- a/pkgs/development/ocaml-modules/variantslib/default.nix
+++ b/pkgs/development/ocaml-modules/variantslib/default.nix
@ -1,4 +1,4 @@
-{ lib, buildOcaml, ocaml, fetchurl, type_conv }:
+{ lib, buildOcaml, ocaml, fetchFromGitHub, type_conv }:

 if lib.versionAtLeast ocaml.version "4.06"
 then throw "variantslib-109.15.03 is not available for OCaml ${ocaml.version}"
@ -10,9 +10,11 @@ buildOcaml rec {

  minimumSupportedOcamlVersion = "4.00";

-  src = fetchurl {
-    url = "https://github.com/janestreet/variantslib/archive/${version}.tar.gz";
-    sha256 = "a948dcdd4ca54786fe0646386b6e37a9db03bf276c6557ea374d82740bf18055";
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = "variantslib";
+    rev = version;
+    sha256 = "sha256-pz3i3od2CqKSrm7uTQ2jdidFFwx7m7g1QuG4UdLk01k=";
  };

  propagatedBuildInputs = [ type_conv ];
--- a/pkgs/development/ocaml-modules/xml-light/default.nix
+++ b/pkgs/development/ocaml-modules/xml-light/default.nix
@ -1,4 +1,4 @@
-{stdenv, lib, fetchurl, ocaml, findlib}:
+{ stdenv, lib, fetchFromGitHub, ocaml, findlib }:
 let
  pname = "xml-light";
  version = "2.4";
@ -6,9 +6,11 @@ in
 stdenv.mkDerivation {
  name = "ocaml-${pname}-${version}";

-  src = fetchurl {
-    url = "https://github.com/ncannasse/${pname}/archive/${version}.tar.gz";
-    sha256 = "10b55qf6mvdp11ny3h0jv6k6wrs78jr9lhsiswl0xya7z8r8j0a2";
+  src = fetchFromGitHub {
+    owner = "ncannasse";
+    repo = "xml-light";
+    rev = version;
+    sha256 = "sha256-2txmkl/ZN5RGaLQJmr+orqwB4CbFk2RpLJd4gr7kPiE=";
  };

  buildInputs = [ ocaml findlib ];
@ -38,6 +40,6 @@ stdenv.mkDerivation {
    homepage = "http://tech.motion-twin.com/xmllight.html";
    license = lib.licenses.lgpl21;
    maintainers = [ lib.maintainers.romildo ];
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
  };
 }
--- a/pkgs/development/python-modules/audiotools/default.nix
+++ b/pkgs/development/python-modules/audiotools/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , stdenv
 , darwin
 }:
@ -15,9 +15,11 @@ buildPythonPackage rec {
    CoreServices
  ]);

-  src = fetchurl {
-    url = "https://github.com/tuffy/python-audio-tools/archive/v${version}.tar.gz";
-    sha256 = "0ymlxvqkqhzk4q088qwir3dq0zgwqlrrdfnq7f0iq97g05qshm2c";
+  src = fetchFromGitHub {
+    owner = "tuffy";
+    repo = "python-audio-tools";
+    rev = "v3.1.1";
+    sha256 = "sha256-y+EiK9BktyTWowOiJvOb2YjtbPa7R62Wb5zinkyt1OM=";
  };

  meta = {
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@ -12,11 +12,11 @@ buildPythonPackage (rec {
  # there's a clear path forward. See
  # https://github.com/elastic/elasticsearch-py/issues/1639 for more
  # info.
-  version = "7.13.1";
+  version = "7.15.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "d6bcca0b2e5665d08e6fe6fadc2d4d321affd76ce483603078fc9d3ccd2bc0f9";
+    sha256 = "1e9a6302945d98046899a7c9b3d345c881ac7b05ba176d3a49c9d2702b1e8bc8";
  };

  # Check is disabled because running them destroy the content of the local cluster!
--- a/pkgs/development/python-modules/etcd/default.nix
+++ b/pkgs/development/python-modules/etcd/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , simplejson
 , pytz
 , requests
@ -11,9 +11,11 @@ buildPythonPackage rec {
  version = "2.0.8";

  # PyPI package is incomplete
-  src = fetchurl {
-    url = "https://github.com/dsoprea/PythonEtcdClient/archive/${version}.tar.gz";
-    sha256 = "0fi6rxa1yxvz7nwrc7dw6fax3041d6bj3iyhywjgbkg7nadi9i8v";
+  src = fetchFromGitHub {
+    owner = "dsoprea";
+    repo = "PythonEtcdClient";
+    rev = version;
+    sha256 = "sha256-h+jYIRSNdrGkW3tBV1ifIDEXU46EQGyeJoz/Mxym4pI=";
  };

  patchPhase = ''
--- a/pkgs/development/python-modules/gdrivefs/default.nix
+++ b/pkgs/development/python-modules/gdrivefs/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , isPy3k
 , gipc
 , greenlet
@ -16,9 +16,11 @@ buildPythonPackage rec {
  pname = "gdrivefs";
  disabled = isPy3k;

-  src = fetchurl {
-    url = "https://github.com/dsoprea/GDriveFS/archive/${version}.tar.gz";
-    sha256 = "0m45z77idy0bs5fqlz0y534fy28ikamrd321hmqsc3q7d39kqzv0";
+  src = fetchFromGitHub {
+    owner = "dsoprea";
+    repo = "GDriveFS";
+    rev = version;
+    sha256 = "sha256-eDBy2rp3uitUrR9CG75x8mAio8+gaSckA/lEPAWO0Yo=";
  };

  buildInputs = [ gipc greenlet httplib2 six ];
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "identify";
-  version = "2.3.0";
+  version = "2.3.1";


  src = fetchFromGitHub {
    owner = "pre-commit";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-V+pRxdbWPaIVqIJYcrmeZKPmmC1ouRgdFsaVVrDUsQc=";
+    sha256 = "sha256-6sErta+YnaXe7lHR3kR7UAoWuaw8He7e3gCML9vWYj8=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/jsonwatch/default.nix
+++ b/pkgs/development/python-modules/jsonwatch/default.nix
@ -1,18 +1,20 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , six
 , isPyPy
 }:

-buildPythonPackage {
+buildPythonPackage rec {
  pname = "jsonwatch";
  version = "0.2.0";
  disabled = isPyPy; # doesn't find setuptools

-  src = fetchurl {
-    url = "https://github.com/dbohdan/jsonwatch/archive/v0.2.0.tar.gz";
-    sha256 = "04b616ef97b9d8c3887004995420e52b72a4e0480a92dbf60aa6c50317261e06";
+  src = fetchFromGitHub {
+    owner = "dbohdan";
+    repo = "jsonwatch";
+    rev = "v${version}";
+    sha256 = "sha256-yLN6jOxAz+B7zvV3tGT6Nxi17v9ZOtWpbtSi0o1h48U=";
  };

  propagatedBuildInputs = [ six ];
--- a/pkgs/development/python-modules/le/default.nix
+++ b/pkgs/development/python-modules/le/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , isPy3k
 , simplejson
 , psutil
@ -10,9 +10,11 @@ buildPythonPackage rec {
  pname = "le";
  version = "1.4.29";

-  src = fetchurl {
-    url = "https://github.com/logentries/le/archive/v${version}.tar.gz";
-    sha256 = "d29738937cb6e714b6ec2ae74b66b1983482ffd54b4faa40767af18509521d4c";
+  src = fetchFromGitHub {
+    owner = "logentries";
+    repo = "le";
+    rev = "v${version}";
+    sha256 = "sha256-67JPnof0olReu90rM78e1px8NvbGcj8pphFhPaiSVmA=";
  };

  disabled = isPy3k;
--- a/pkgs/development/python-modules/livestreamer-curses/default.nix
+++ b/pkgs/development/python-modules/livestreamer-curses/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , isPyPy
 , livestreamer
 }:
@ -10,9 +10,11 @@ buildPythonPackage rec {
  pname = "livestreamer-curses";
  disabled = isPyPy;

-  src = fetchurl {
-    url = "https://github.com/gapato/livestreamer-curses/archive/v${version}.tar.gz";
-    sha256 = "1v49sym6mrci9dxy0a7cpbp4bv6fg2ijj6rwk4wzg18c2x4qzkhn";
+  src = fetchFromGitHub {
+    owner = "gapato";
+    repo = "livestreamer-curses";
+    rev = "v1.5.2";
+    sha256 = "sha256-Pi0PIOUhMMAWft9ackB04IgF6DyPrXppNqyVjozIjN4=";
  };

  propagatedBuildInputs = [ livestreamer ];
--- a/pkgs/development/python-modules/livestreamer/default.nix
+++ b/pkgs/development/python-modules/livestreamer/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , pkgs
+, fetchFromGitHub
 , isPyPy
 , pycrypto
 , requests
@ -14,9 +15,11 @@ buildPythonPackage rec {
  pname = "livestreamer";
  disabled = isPyPy;

-  src = pkgs.fetchurl {
-    url = "https://github.com/chrippa/livestreamer/archive/v${version}.tar.gz";
-    sha256 = "1fp3d3z2grb1ls97smjkraazpxnvajda2d1g1378s6gzmda2jvjd";
+  src = fetchFromGitHub {
+    owner = "chrippa";
+    repo = "livestreamer";
+    rev = "v1.12.2";
+    sha256 = "sha256-PqqyBh+oMmu7Ynly3fqx/+6mQYX+6SpI0Okj2O+YLz0=";
  };

  nativeBuildInputs = [ pkgs.makeWrapper ];
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@ -4,11 +4,11 @@

 buildPythonPackage rec {
  pname = "mautrix";
-  version = "0.10.10";
+  version = "0.10.11";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "78309702392fe1ced000a23cfacb9bae0511ba533963b82d1d040f4a39924c09";
+    sha256 = "b3905fbd1381031b4c54258fdef9e99dd342c3a211abe0b827b2c480db4b1771";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/millheater/default.nix
+++ b/pkgs/development/python-modules/millheater/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "millheater";
-  version = "0.7.3";
+  version = "0.8.0";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "Danielhiversen";
    repo = "pymill";
    rev = version;
-    sha256 = "sha256-WMw07mNvQdrqm5cf3+YWRZsZQ59vOqYSps26scPFpNI=";
+    sha256 = "sha256-PL9qP6SKE8gsBUdfrPf9Fs+vU/lkpOjmkvq3cWw3Uak=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@ -5,13 +5,13 @@

 buildPythonPackage rec {
  pname = "mitogen";
-  version = "0.3.0rc1";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "mitogen-hq";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0hxb41sshybxjyvyarl2axs0v6w53vqxafgfjrmpp5k20z5kapz4";
+    sha256 = "sha256-SotxlsJDIeFd4BN9C7afyyybET5ST2yaoWVEyT/lr48=";
  };

  # Tests require network access and Docker support
--- a/pkgs/development/python-modules/pep257/default.nix
+++ b/pkgs/development/python-modules/pep257/default.nix
@ -1,11 +1,13 @@
-{ lib, buildPythonPackage, fetchurl, pytest, mock }:
+{ lib, buildPythonPackage, fetchFromGitHub, pytest, mock }:
 buildPythonPackage rec {
  pname = "pep257";
  version = "0.7.0";

-  src = fetchurl {
-    url = "https://github.com/GreenSteam/pep257/archive/${version}.tar.gz";
-    sha256 = "1ldpgil0kaf6wz5gvl9xdx35a62vc6bmgi3wbh9320dj5v2qk4wh";
+  src = fetchFromGitHub {
+    owner = "GreenSteam";
+    repo = "pep257";
+    rev = "0.7.0";
+    sha256 = "sha256-RkE9kkNkRTmZ8zJVwQzMsxU1hcjlxX6UA+ehnareynQ=";
  };

  checkInputs = [ pytest mock ];
--- a/pkgs/development/python-modules/pygmt/default.nix
+++ b/pkgs/development/python-modules/pygmt/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "pygmt";
-  version = "0.4.1";
+  version = "0.5.0";

  disabled = pythonOlder "3.6";

@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "GenericMappingTools";
    repo = "pygmt";
    rev = "v${version}";
-    sha256 = "1jjqijp0dhmc953brlj2pqgswdliz71fi7dzrv6clq2kqzqfjv8c";
+    sha256 = "1mazljxwh162df971cvv7cwnqr300r17qfs7k09s6yd6hajyhz49";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pysma/default.nix
+++ b/pkgs/development/python-modules/pysma/default.nix
@ -9,11 +9,11 @@

 buildPythonPackage rec {
  pname = "pysma";
-  version = "0.6.7";
+  version = "0.6.8";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-8HADY6+qwfzYyEVLQyMiXiUYinADSA1iKUay3YHhNXI=";
+    sha256 = "9490d72596db64d339aefee56940e058fddb52c2f0f5d5cce3c39ef94f39dbb9";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/checkmate/default.nix
+++ b/pkgs/development/tools/checkmate/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "checkmate";
-  version = "0.4.5";
+  version = "0.4.6";

  src = fetchFromGitHub {
    owner = "adedayo";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-0s2WyY17xk/tGIKMUoJYcpOm510PtZZMxLLFdYAZAmI=";
+    sha256 = "sha256-x3R6xkfgFhmR3iGSAXLCUl5wPQ25TqEBI5z9p0I/GoY=";
  };

-  vendorSha256 = "sha256-AEjSuG5qmsyzkEubxKYF1/MTG91Nxdz83X0ucZmZQxU=";
+  vendorSha256 = "sha256-ulXilkDEkvpfCgdJ55gzb8qpcra3s8wSjcEupxWP+h8=";

  subPackages = [ "." ];

--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "fly";
-  version = "7.5.0";
+  version = "7.6.0";

  src = fetchFromGitHub {
    owner = "concourse";
    repo = "concourse";
    rev = "v${version}";
-    sha256 = "sha256-5+zAIvm4RgXc09HwSNlSjChL4NhMMiGDMtAVlmV/BYE=";
+    sha256 = "sha256-Zi+gyO+2AKDgcfgYrzLskJYZ6hQKOVlOL7Y9nxH/pGg=";
  };

-  vendorSha256 = "sha256-Z6zxSbzn1/u+3Z9PeRl6iO0pVlw/lGtFjAuZpGrRDDY=";
+  vendorSha256 = "sha256-OF3parnlTPmcr7tVcc6495sUMRApSpBHHjSE/4EFIxE=";

  doCheck = false;

--- a/pkgs/development/tools/frugal/default.nix
+++ b/pkgs/development/tools/frugal/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "frugal";
-  version = "3.14.9";
+  version = "3.14.10";

  src = fetchFromGitHub {
    owner = "Workiva";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-LyPa6x72dz59TYWYqTrpnqUpXz9Ruf+worLvIfFJRHY=";
+    sha256 = "sha256-K/Nptw0AEP7awS/xXCg6T2Ff3WQc7fKTUB/uEg1WOA4=";
  };

  subPackages = [ "." ];

-  vendorSha256 = "sha256-onbvW3vjuAL+grLfvJR14jxVpoue+YZAeFMOS8ktS1A=";
+  vendorSha256 = "sha256-Z42t9dGlNbSwNy2N/ZoEejkbIEeUUk87mcYhkTnxhpc=";

  meta = with lib; {
    description = "Thrift improved";
--- a/pkgs/development/tools/ginkgo/default.nix
+++ b/pkgs/development/tools/ginkgo/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ginkgo";
-  version = "1.16.4";
+  version = "1.16.5";

  src = fetchFromGitHub {
    owner = "onsi";
    repo = "ginkgo";
    rev = "v${version}";
-    sha256 = "sha256-p9kam1pRP0Am02o7vM+VzeAht+Qtn4DZ12NM8TaA/2Y=";
+    sha256 = "sha256-v2JcH2jqB7ffF0mS6aOHM3bODf9eyGwmigp4kfCxBsI=";
  };
  vendorSha256 = "sha256-tS8YCGVOsfQp02vY6brmE3pxi70GG9DYcp1JDkcVG9Y=";
  doCheck = false;
--- a/pkgs/development/tools/go-migrate/default.nix
+++ b/pkgs/development/tools/go-migrate/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "go-migrate";
-  version = "4.15.0";
+  version = "4.15.1";

  src = fetchFromGitHub {
    owner = "golang-migrate";
    repo = "migrate";
    rev = "v${version}";
-    sha256 = "sha256-fl6gPKZlc8K6yD8xHC6XbmCHUJl6nI+X2I4JmXABWdY=";
+    sha256 = "sha256-t4F4jvXexxCqKINaaczeG/B2vLSG87/qZ+VQitfAF4Y=";
  };

-  vendorSha256 = "sha256-/N1sglGPwb77HLnVOzMYlFPSmeUvWs+wld7Fd7rjWrA=";
+  vendorSha256 = "sha256-qgjU8mUdk8S0VHmWiTK/5euwhRQ4y3o4oRxG2EHF+7E=";

  subPackages = [ "cmd/migrate" ];

--- a/pkgs/development/tools/go-swagger/default.nix
+++ b/pkgs/development/tools/go-swagger/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "go-swagger";
-  version = "0.27.0";
+  version = "0.28.0";

  src = fetchFromGitHub {
    owner = "go-swagger";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-S3/sXmgogxhMv53Gd/ir6ScirYQtt5kn04ZfRiS6NoA=";
+    sha256 = "sha256-Bw84HQxrI8cSBEM1cxXmWCPqKZa5oGsob2iuUsiAZ+A=";
  };

-  vendorSha256 = "sha256-ABGjrMZdgsAaEhJlGbvbX77t7TsodraadNyItESMbEc=";
+  vendorSha256 = "sha256-ZNRJZQ7DwT/+scsbSud/IpSX06veOtJ5Aszj0RbS870=";

  doCheck = false;

--- a/pkgs/development/tools/go-task/default.nix
+++ b/pkgs/development/tools/go-task/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "go-task";
-  version = "3.7.3";
+  version = "3.9.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = "task";
    rev = "v${version}";
-    sha256 = "sha256-/NeOMLfYU37Ra7RG/vofq+45Thky6kfGDcgnQxVLVGo=";
+    sha256 = "sha256-BOOtzI45Vbce2XmcleyDOg/+6YDASCIOBvBytZDK7ZA=";
  };

-  vendorSha256 = "sha256-NU0Mgt8TJE/uE9/f2pFLRT0x6ZgCDbRcomlMFkA+juA=";
+  vendorSha256 = "sha256-N23jdHR+Alo3dYkfZ4ygr5UU2NEO/cgrgN52glU2hd8=";

  doCheck = false;

--- a/pkgs/development/tools/google-java-format/default.nix
+++ b/pkgs/development/tools/google-java-format/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "google-java-format";
-  version = "1.11.0";
+  version = "1.12.0";

  src = fetchurl {
    url = "https://github.com/google/google-java-format/releases/download/v${version}/google-java-format-${version}-all-deps.jar";
-    sha256 = "1ixpg8ljg819fq94mxyypknmslva3rkifphbnq3ic71b7iip6lia";
+    sha256 = "sha256-hdqCubcfBK/KzanQCMLSFUC/T6JZJp77XFYdotThElI=";
  };

  dontUnpack = true;
--- a/pkgs/development/tools/gops/default.nix
+++ b/pkgs/development/tools/gops/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gops";
-  version = "0.3.20";
+  version = "0.3.22";

  src = fetchFromGitHub {
    owner = "google";
    repo = "gops";
    rev = "v${version}";
-    sha256 = "sha256-eHcCi9D5TpRWxC39SnOD2GW3qyNBR69bHb8f/Gb+qAI=";
+    sha256 = "sha256-97D92sWGqtMGzwrQ3NUR7prgsqtJvAQOjYlfmSWIEKo=";
  };

  vendorSha256 = null;
--- a/pkgs/development/tools/metals/default.nix
+++ b/pkgs/development/tools/metals/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "metals";
-  version = "0.10.7";
+  version = "0.10.8";

  deps = stdenv.mkDerivation {
    name = "${pname}-deps-${version}";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    '';
    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash     = "0sk4vwpy06smn0k7035bdz0g2y98l8hxmn4v3gijsqaxvnya36x9";
+    outputHash     = "sha256-xTJ+N/aYMEzAQnu1wwWQ/nGRMYiEMfNPiuUFHcFbU4c=";
  };

  nativeBuildInputs = [ makeWrapper ];
@ -57,6 +57,6 @@ stdenv.mkDerivation rec {
    homepage = "https://scalameta.org/metals/";
    license = licenses.asl20;
    description = "Work-in-progress language server for Scala";
-    maintainers = with maintainers; [ ceedubs tomahna ];
+    maintainers = with maintainers; [ ceedubs fabianhjr tomahna ];
  };
 }
--- a/pkgs/development/tools/rust/cargo-deny/default.nix
+++ b/pkgs/development/tools/rust/cargo-deny/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-deny";
-  version = "0.9.1";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "EmbarkStudios";
    repo = pname;
    rev = version;
-    sha256 = "sha256-v7Gdemn0IeO6lOg/kT6VKuL5ZSOqA9A721Wv5QStO2Q=";
+    sha256 = "sha256-YXIEM8COtjc3yD8gxoeoJwkGyJwMCCn40591iO6ERxc=";
  };

-  cargoSha256 = "sha256-SF7LfxmUMX7f+9BmYTzdjTFplXj5j0e181yRVTIEGH4=";
+  cargoSha256 = "sha256-4PcYnpoRvl01n4Y4usrlLejWwcB5BJnFGqqfbqLD1gI=";

  doCheck = false;

--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.0.241";
+  version = "0.0.250";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    sha256 = "sha256-f+59wWAfdjyNkAUJJdrbK0c0NkPJ/UVToU2dwUlGwOM=";
+    sha256 = "sha256-QhEstfzx0zqC+dDgqfgmi1zOdc491YbzVAgXVaoTVUU=";
  };

  preBuild = ''
@ -17,7 +17,7 @@ buildGoModule rec {

  subPackages = [ "." ];

-  vendorSha256 = "sha256-bhufZQN2vkfU5c/luB/eCxPueIouhAUqnnPXWyJZRac=";
+  vendorSha256 = "sha256-JxEl23bwfvd8jNBYqIXBIu1pNu2rt+jvdEl0RdXCidE=";

  doCheck = false;

--- a/pkgs/misc/emulators/firebird-emu/default.nix
+++ b/pkgs/misc/emulators/firebird-emu/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "firebird-emu";
-  version = "1.4";
+  version = "1.5";

  src = fetchFromGitHub {
    owner = "nspire-emus";
    repo = "firebird";
    rev = "v${version}";
-    sha256 = "0pdca6bgnmzfgf5kp83as99y348gn4plzbxnqxjs61vp489baahq";
+    sha256 = "sha256-T62WB6msdB6/wIulqd/468JrCEiPGUrvtpjkZyo4wiA=";
    fetchSubmodules = true;
  };

--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@ -1,8 +1,8 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, fetchpatch, glibc, augeas, dnsutils, c-ares, curl,
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, glibc, augeas, dnsutils, c-ares, curl,
  cyrus_sasl, ding-libs, libnl, libunistring, nss, samba, nfs-utils, doxygen,
  python, python3, pam, popt, talloc, tdb, tevent, pkg-config, ldb, openldap,
-  pcre, libkrb5, cifs-utils, glib, keyutils, dbus, fakeroot, libxslt, libxml2,
-  libuuid, ldap, systemd, nspr, check, cmocka, uid_wrapper,
+  pcre2, libkrb5, cifs-utils, glib, keyutils, dbus, fakeroot, libxslt, libxml2,
+  libuuid, ldap, systemd, nspr, check, cmocka, uid_wrapper, p11-kit,
  nss_wrapper, ncurses, Po4a, http-parser, jansson,
  docbook_xsl, docbook_xml_dtd_44,
  withSudo ? false }:
@ -12,26 +12,18 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "sssd";
-  version = "1.16.5";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "SSSD";
    repo = pname;
-    rev = "${pname}-${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "0zbs04lkjbp7y92anmafl7gzamcnq1f147p13hc4byyvjk9rg6f7";
+    rev = version;
+    sha256 = "1ik0x0b7s38d7n0aqhl31r0asxw6qcdb31hx9qydk87yg3n6rziv";
  };
-  patches = [
-    # Fix build failure against samba 4.12.0rc1
-    (fetchpatch {
-      url = "https://github.com/SSSD/sssd/commit/bc56b10aea999284458dcc293b54cf65288e325d.patch";
-      sha256 = "0q74sx5n41srq3kdn55l5j1sq4xrjsnl5y4v8yh5mwsijj74yh4g";
-    })
-    # Fix collision with external nss symbol
-    (fetchpatch {
-      url = "https://github.com/SSSD/sssd/commit/fe9eeb51be06059721e873f77092b1e9ba08e6c1.patch";
-      sha256 = "0b83b2w0rnvm26pg03a4lpmkmi7n3gqxg7lk751q61q79gnzrpz4";
-    })
-  ];
+
+  postPatch = ''
+    patchShebangs ./sbus_generate.sh.in
+  '';

  # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h>
  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
@ -64,8 +56,8 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;
  nativeBuildInputs = [ autoreconfHook pkg-config doxygen ];
  buildInputs = [ augeas dnsutils c-ares curl cyrus_sasl ding-libs libnl libunistring nss
-                  samba nfs-utils python python3 popt
-                  talloc tdb tevent ldb pam openldap pcre libkrb5
+                  samba nfs-utils p11-kit python python3 popt
+                  talloc tdb tevent ldb pam openldap pcre2 libkrb5
                  cifs-utils glib keyutils dbus fakeroot libxslt libxml2
                  libuuid ldap systemd nspr check cmocka uid_wrapper
                  nss_wrapper ncurses Po4a http-parser jansson ];
@ -102,6 +94,6 @@ stdenv.mkDerivation rec {
    changelog = "https://sssd.io/release-notes/sssd-${version}.html";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.e-user ];
+    maintainers = with maintainers; [ e-user illustris ];
  };
 }
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@ -1,13 +1,12 @@
 { config, stdenv, lib, fetchurl, fetchpatch
 , perl, pkg-config
 , libcap, libtool, libxml2, openssl, libuv
-, enablePython ? config.bind.enablePython or false, python3 ? null
-, enableSeccomp ? false, libseccomp ? null, buildPackages, nixosTests
+, enableGSSAPI ? true, libkrb5
+, enablePython ? false, python3
+, enableSeccomp ? false, libseccomp
+, buildPackages, nixosTests
 }:

-assert enableSeccomp -> libseccomp != null;
-assert enablePython -> python3 != null;
-
 stdenv.mkDerivation rec {
  pname = "bind";
  version = "9.16.16";
@ -28,6 +27,7 @@ stdenv.mkDerivation rec {
  buildInputs = [ libtool libxml2 openssl libuv ]
    ++ lib.optional stdenv.isLinux libcap
    ++ lib.optional enableSeccomp libseccomp
+    ++ lib.optional enableGSSAPI libkrb5
    ++ lib.optional enablePython (python3.withPackages (ps: with ps; [ ply ]));

  depsBuildBuild = [ buildPackages.stdenv.cc ];
@ -39,7 +39,6 @@ stdenv.mkDerivation rec {
    "--without-atf"
    "--without-dlopen"
    "--without-docbook-xsl"
-    "--without-gssapi"
    "--without-idn"
    "--without-idnlib"
    "--without-lmdb"
@ -53,6 +52,7 @@ stdenv.mkDerivation rec {
    "--with-aes"
  ] ++ lib.optional stdenv.isLinux "--with-libcap=${libcap.dev}"
    ++ lib.optional enableSeccomp "--enable-seccomp"
+    ++ lib.optional enableGSSAPI "--with-gssapi=${libkrb5.dev}"
    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "BUILD_CC=$(CC_FOR_BUILD)";

  postInstall = ''
--- a/pkgs/servers/headscale/default.nix
+++ b/pkgs/servers/headscale/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "headscale";
-  version = "0.10.5";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "juanfont";
    repo = "headscale";
    rev = "v${version}";
-    sha256 = "sha256-cUDLqSMEw1SRMskHx3hhb/y7N7ZQEDEAZ40X5J53Bow=";
+    sha256 = "sha256-grLYyVYlvqBNO5CVRVDTJKEi45Nsc6Bgs8I3pY7pZfg=";
  };

  vendorSha256 = "sha256-t7S1jE76AFFIePrFtvrIQcId7hLeNIAm/eA9AVoFy5E=";
--- a/pkgs/servers/invidious/default.nix
+++ b/pkgs/servers/invidious/default.nix
@ -0,0 +1,99 @@
+{ lib, crystal, fetchFromGitHub, librsvg, pkg-config, libxml2, openssl, sqlite, lsquic, nixosTests }:
+let
+  # When updating, always update the following:
+  #  * the git revision
+  #  * the version attribute
+  #  * the source hash (sha256)
+  # If the shards.lock file changed, also the following:
+  #  * shards.nix (by running `crystal2nix` in invidious’ source tree)
+  #  * If the lsquic.cr dependency changed: lsquic in lsquic.nix (version, sha256)
+  #  * If the lsquic version changed: boringssl' in lsquic.nix (version, sha256)
+  rev = "21b96a31599e890fe063e3e24cf5f3a995779a69";
+in
+crystal.buildCrystalPackage rec {
+  pname = "invidious";
+  version = "unstable-2021-10-15";
+
+  src = fetchFromGitHub {
+    owner = "iv-org";
+    repo = pname;
+    inherit rev;
+    sha256 = "sha256-Rp3YqjHbP6szohlaEpgopFNdLK31yrcHtyKCeVz76CA=";
+  };
+
+  postPatch =
+    let
+      # Replacing by the value (templates) of the variables ensures that building
+      # fails if upstream changes the way the metadata is formatted.
+      branchTemplate = ''{{ "#{`git branch | sed -n '/* /s///p'`.strip}" }}'';
+      commitTemplate = ''{{ "#{`git rev-list HEAD --max-count=1 --abbrev-commit`.strip}" }}'';
+      versionTemplate = ''{{ "#{`git log -1 --format=%ci | awk '{print $1}' | sed s/-/./g`.strip}" }}'';
+      # This always uses the latest commit which invalidates the cache even if
+      # the assets were not changed
+      assetCommitTemplate = ''{{ "#{`git rev-list HEAD --max-count=1 --abbrev-commit -- assets`.strip}" }}'';
+    in
+    ''
+      # Use the version metadata from the derivation instead of using git at
+      # build-time
+      substituteInPlace src/invidious.cr \
+          --replace ${lib.escapeShellArg branchTemplate} '"master"' \
+          --replace ${lib.escapeShellArg commitTemplate} '"${lib.substring 0 7 rev}"' \
+          --replace ${lib.escapeShellArg versionTemplate} '"${lib.replaceChars ["-"] ["."] (lib.substring 9 10 version)}"' \
+          --replace ${lib.escapeShellArg assetCommitTemplate} '"${lib.substring 0 7 rev}"'
+
+      # Patch the assets and locales paths to be absolute
+      substituteInPlace src/invidious.cr \
+          --replace 'public_folder "assets"' 'public_folder "${placeholder "out"}/share/invidious/assets"'
+      substituteInPlace src/invidious/helpers/i18n.cr \
+          --replace 'File.read("locales/' 'File.read("${placeholder "out"}/share/invidious/locales/'
+
+      # Reference sql initialisation/migration scripts by absolute path
+      substituteInPlace src/invidious/helpers/helpers.cr \
+            --replace 'config/sql' '${placeholder "out"}/share/invidious/config/sql'
+
+      substituteInPlace src/invidious/users.cr \
+          --replace 'Process.run(%(rsvg-convert' 'Process.run(%(${lib.getBin librsvg}/bin/rsvg-convert'
+    '';
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libxml2 openssl sqlite ];
+
+  format = "crystal";
+  shardsFile = ./shards.nix;
+  crystalBinaries.invidious.src = "src/invidious.cr";
+
+  postConfigure = ''
+    # lib includes nix store paths which can’t be patched, so the links have to
+    # be dereferenced first.
+    cp -rL lib lib2
+    rm -r lib
+    mv lib2 lib
+    chmod +w -R lib
+    cp ${lsquic}/lib/liblsquic.a lib/lsquic/src/lsquic/ext
+  '';
+
+  postInstall = ''
+    mkdir -p $out/share/invidious/config
+
+    # Copy static parts
+    cp -r assets locales $out/share/invidious
+    cp -r config/sql $out/share/invidious/config
+  '';
+
+  # Invidious tries to open config/config.yml and connect to the database, even
+  # when running --help. This specifies a minimal configuration in an
+  # environment variable. Even though the database is bogus, --help still
+  # works.
+  installCheckPhase = ''
+    INVIDIOUS_CONFIG="database_url: sqlite3:///dev/null" $out/bin/invidious --help
+  '';
+
+  passthru.tests = { inherit (nixosTests) invidious; };
+
+  meta = with lib; {
+    description = "An open source alternative front-end to YouTube";
+    homepage = "https://invidious.io/";
+    license = licenses.agpl3;
+    maintainers = with maintainers; [ infinisil sbruder ];
+  };
+}
--- a/pkgs/servers/invidious/lsquic.nix
+++ b/pkgs/servers/invidious/lsquic.nix
@ -0,0 +1,58 @@
+{ lib, boringssl, stdenv, fetchgit, fetchFromGitHub, cmake, zlib, perl, libevent }:
+let
+  # lsquic requires a specific boringssl version (noted in its README)
+  boringssl' = boringssl.overrideAttrs (old: rec {
+    version = "251b5169fd44345f455438312ec4e18ae07fd58c";
+    src = fetchgit {
+      url = "https://boringssl.googlesource.com/boringssl";
+      rev = version;
+      sha256 = "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A=";
+    };
+  });
+in
+stdenv.mkDerivation rec {
+  pname = "lsquic";
+  version = "2.18.1";
+
+  src = fetchFromGitHub {
+    owner = "litespeedtech";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake perl ];
+  buildInputs = [ boringssl' libevent zlib ];
+
+  cmakeFlags = [
+    "-DBORINGSSL_DIR=${boringssl'}"
+    "-DBORINGSSL_LIB_crypto=${boringssl'}/lib/libcrypto.a"
+    "-DBORINGSSL_LIB_ssl=${boringssl'}/lib/libssl.a"
+    "-DZLIB_LIB=${zlib}/lib/libz.so"
+  ];
+
+  # adapted from lsquic.cr’s Dockerfile
+  # (https://github.com/iv-org/lsquic.cr/blob/master/docker/Dockerfile)
+  installPhase = ''
+    runHook preInstall
+
+    mkdir combinedlib
+    cd combinedlib
+    ar -x ${boringssl'}/lib/libssl.a
+    ar -x ${boringssl'}/lib/libcrypto.a
+    ar -x ../src/liblsquic/liblsquic.a
+    ar rc liblsquic.a *.o
+    ranlib liblsquic.a
+    install -D liblsquic.a $out/lib/liblsquic.a
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A library for QUIC and HTTP/3 (version for Invidious)";
+    homepage = "https://github.com/litespeedtech/lsquic";
+    maintainers = with maintainers; [ infinisil sbruder ];
+    license = with licenses; [ openssl isc mit bsd3 ]; # statically links against boringssl, so has to include its licenses
+  };
+}
--- a/pkgs/servers/invidious/shards.nix
+++ b/pkgs/servers/invidious/shards.nix
@ -0,0 +1,68 @@
+{
+  athena-negotiation = {
+    owner = "athena-framework";
+    repo = "negotiation";
+    rev = "v0.1.1";
+    sha256 = "1vkk59lqrxb0l8kyzs114i3c18zb2bdiah2xhazkk8q7x6fz4yzk";
+  };
+  backtracer = {
+    owner = "sija";
+    repo = "backtracer.cr";
+    rev = "v1.2.1";
+    sha256 = "02r1l7rn2wsljkx495s5s7j04zgn73m2kx0hkzs7620camvlwbqq";
+  };
+  db = {
+    owner = "crystal-lang";
+    repo = "crystal-db";
+    rev = "v0.10.1";
+    sha256 = "03c5h14z6h2mxnx949lihnyqjd19hcj38iasdwq9fp95h8cld376";
+  };
+  exception_page = {
+    owner = "crystal-loot";
+    repo = "exception_page";
+    rev = "v0.2.0";
+    sha256 = "0nlgnh5iykbr1v2132342k2mz6s2laws6nkgqsqlwhhcr4gb4jcx";
+  };
+  kemal = {
+    owner = "kemalcr";
+    repo = "kemal";
+    rev = "v1.1.0";
+    sha256 = "07vlvddy4mba9li2bvskzqzywwq55cyvlgkz13q6dsl4zfgc96ca";
+  };
+  kilt = {
+    owner = "jeromegn";
+    repo = "kilt";
+    rev = "v0.6.1";
+    sha256 = "0dpc15y9m8c5l9zdfif6jlf7zmkrlm9w4m2igi5xa22fdjwamwfp";
+  };
+  lsquic = {
+    owner = "iv-org";
+    repo = "lsquic.cr";
+    rev = "v2.18.1-2";
+    sha256 = "0bljk0pwbjb813dfwrhgi00w2ai09k868xvak4hfzdkbmpc7id6y";
+  };
+  pg = {
+    owner = "will";
+    repo = "crystal-pg";
+    rev = "v0.24.0";
+    sha256 = "07i5bqkv5j6y6f8v5cpqdxc5wzzrvgv3ds24znv4mzv6nc84csn4";
+  };
+  protodec = {
+    owner = "iv-org";
+    repo = "protodec";
+    rev = "v0.1.4";
+    sha256 = "15azh9izxqgwpgkpicmivfdz31wkibnwy09rwhxsg0lyc4wf8xj9";
+  };
+  radix = {
+    owner = "luislavena";
+    repo = "radix";
+    rev = "v0.4.1";
+    sha256 = "1l08cydkdidq9yyil1wl240hvk41iycv04jrg6nx5mkvzw4z1bzg";
+  };
+  sqlite3 = {
+    owner = "crystal-lang";
+    repo = "crystal-sqlite3";
+    rev = "v0.18.0";
+    sha256 = "03nnvpchhq9f9ywsm3pk2rrj4a3figw7xs96zdziwgr5znkz6x93";
+  };
+}
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "telegraf";
-  version = "1.20.2";
+  version = "1.20.3";

  excludedPackages = "test";

@ -12,10 +12,10 @@ buildGoModule rec {
    owner = "influxdata";
    repo = "telegraf";
    rev = "v${version}";
-    sha256 = "sha256-6XPdqTW5dP5nOfV9fdnXkyzWPYEILEx4AF61u691b6c=";
+    sha256 = "sha256-KziXTuj1J3pXJIACiF09En3rRt1BYixj/jAadyaz4ns=";
  };

-  vendorSha256 = "sha256-7Crf2mQy0C7Fw6S7KY3bQj4Cu8GceFxoB7D2Vkv6X9U=";
+  vendorSha256 = "sha256-4L65JT+5GRS7KszuwKdveOlJIrOptPomDuyQ/r434cc=";
  proxyVendor = true;

  ldflags = [
--- a/pkgs/shells/nsh/default.nix
+++ b/pkgs/shells/nsh/default.nix
@ -0,0 +1,29 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nsh";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "nuta";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1479wv8h5l2b0cwp27vpybq50nyvszhjxmn76n2bz3fchr0lrcbp";
+  };
+
+  cargoSha256 = "1kxjr4ymns95g6jz94107nqmd71m2xh8k19gcsy08650gjrn5cz3";
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A command-line shell like fish, but POSIX compatible";
+    homepage = "https://github.com/nuta/nsh";
+    changelog = "https://github.com/nuta/nsh/raw/v${version}/docs/changelog.md";
+    license = [ licenses.cc0 /* or */ licenses.mit ];
+    maintainers = [ maintainers.marsam ];
+  };
+
+  passthru = {
+    shellPath = "/bin/nsh";
+  };
+}
--- a/pkgs/tools/admin/clair/default.nix
+++ b/pkgs/tools/admin/clair/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "clair";
-  version = "4.3.0";
+  version = "4.3.2";

  src = fetchFromGitHub {
    owner = "quay";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-9IRoDvvhUMXTiMl2Jj4NFlTJD7QSXsVxjoDVTlqTsWg=";
+    sha256 = "sha256-E5hMjGsub3HWzvQYLUnSHmSfiW1uaZCyJndyasrjzw8=";
  };

-  vendorSha256 = "sha256-9BG10+aOysFZmGytDhz11u/2uJQq4LnceCsotJIZ62U=";
+  vendorSha256 = "sha256-J0AOgget9SpV+tKhzHINfsc7Vbxc2zVWIeFHruPc2BE=";

  doCheck = false;

--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.69.0";
+  version = "0.70.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = version;
-    sha256 = "sha256-mRY/czMf6KefYCqfCVRtcHuUuqAxyPUd8TJmx7vzOsk=";
+    sha256 = "sha256-wBDG6um7HCFAEyiubnkCxg91sQ6HX0CTpYItwVkMx28=";
  };

  vendorSha256 = "sha256-cUo+tcHhnbJbn3HS/I8lnkvfv+6+htIs1dMtKuEArQg=";
--- a/pkgs/tools/admin/iamy/default.nix
+++ b/pkgs/tools/admin/iamy/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "iamy";
-  version = "2.3.2";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "99designs";
    repo = "iamy";
    rev = "v${version}";
-    sha256 = "1fypc6yjnhlpk7zhb2lvah2ikh2zji9sll55rqjbr3i4j02h484z";
+    sha256 = "sha256-oH3ijZaWXI0TdVQN9gzp5ypWzY7OqSxDh7VBoZo42Cs=";
  };

-  vendorSha256 = "0c4g1zr0wl118g41hqri0vwvfin39yvgs214w3spw8ggjcj6bzph";
+  vendorSha256 = "sha256-/IUYM3pTvcHXw8t5MW6JUEWdxegFuQC8zkiySp8VEgE=";

  doCheck = false;

--- a/pkgs/tools/graphics/argyllcms/default.nix
+++ b/pkgs/tools/graphics/argyllcms/default.nix
@ -13,83 +13,88 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-umY3wQfG26Okqnw+MCUnlwWTAyJ6MR/FHe5oe61KBh0=";
  };

-  # The contents of this file comes from the Jamtop file from the
-  # root of the ArgyllCMS distribution, rewritten to pick up Nixpkgs
-  # library paths. When ArgyllCMS is updated, make sure that changes
-  # in that file is reflected here.
-  jamTop = writeText "argyllcms_jamtop" ''
-    DESTDIR = "/" ;
-    REFSUBDIR = "share/argyllcms" ;
-
-    # Keep this DESTDIR anchored to Jamtop. PREFIX is used literally
-    ANCHORED_PATH_VARS = DESTDIR ;
-
-    # Tell standalone libraries that they are part of Argyll:
-    DEFINES += ARGYLLCMS ;
-
-    # enable serial instruments & support
-    USE_SERIAL = true ;
-
-    # enable fast serial instruments & support
-    USE_FAST_SERIAL = true ;                # (Implicit in USE_SERIAL too)
-
-    # enable USB instruments & support
-    USE_USB = true ;
-
-    # enable dummy Demo Instrument (only if code is available)
-    USE_DEMOINST = true ;
-
-    # enable Video Test Patch Generator and 3DLUT device support
-    # (V2.0.0 and above)
-    USE_VTPGLUT = false ;
-
-    # enable Printer device support
-    USE_PRINTER = false ;
-
-    # enable CMF Measurement device and accessory support (if present)
-    USE_CMFM = false ;
-
-    # Use ArgyllCMS version of libusb (deprecated - don't use)
-    USE_LIBUSB = false ;
-
-    # Compile in graph plotting code (Not fully implemented)
-    USE_PLOT = true ;		# [true]
-
-    JPEGLIB = ;
-    JPEGINC = ;
-    HAVE_JPEG = true ;
-
-    TIFFLIB = ;
-    TIFFINC = ;
-    HAVE_TIFF = true ;
-
-    PNGLIB = ;
-    PNGINC = ;
-    HAVE_PNG = true ;
-
-    ZLIB = ;
-    ZINC = ;
-    HAVE_Z = true ;
-
-    SSLLIB = ;
-    SSLINC = ;
-    HAVE_SSL = true ;
-
-    LINKFLAGS +=
-      ${lib.concatStringsSep " " (map (x: "-L${x}/lib") buildInputs)}
-      -ldl -lrt -lX11 -lXext -lXxf86vm -lXinerama -lXrandr -lXau -lXdmcp -lXss
-      -ljpeg -ltiff -lpng -lssl ;
-  '';
-
  nativeBuildInputs = [ jam unzip ];

-  preConfigure = ''
+  postPatch = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    substituteInPlace Jambase \
+      --replace "-m64" ""
+  '';
+
+  preConfigure = let
+    # The contents of this file comes from the Jamtop file from the
+    # root of the ArgyllCMS distribution, rewritten to pick up Nixpkgs
+    # library paths. When ArgyllCMS is updated, make sure that changes
+    # in that file is reflected here.
+    jamTop = writeText "argyllcms_jamtop" ''
+      DESTDIR = "/" ;
+      REFSUBDIR = "share/argyllcms" ;
+
+      # Keep this DESTDIR anchored to Jamtop. PREFIX is used literally
+      ANCHORED_PATH_VARS = DESTDIR ;
+
+      # Tell standalone libraries that they are part of Argyll:
+      DEFINES += ARGYLLCMS ;
+
+      # enable serial instruments & support
+      USE_SERIAL = true ;
+
+      # enable fast serial instruments & support
+      USE_FAST_SERIAL = true ;                # (Implicit in USE_SERIAL too)
+
+      # enable USB instruments & support
+      USE_USB = true ;
+
+      # enable dummy Demo Instrument (only if code is available)
+      USE_DEMOINST = true ;
+
+      # enable Video Test Patch Generator and 3DLUT device support
+      # (V2.0.0 and above)
+      USE_VTPGLUT = false ;
+
+      # enable Printer device support
+      USE_PRINTER = false ;
+
+      # enable CMF Measurement device and accessory support (if present)
+      USE_CMFM = false ;
+
+      # Use ArgyllCMS version of libusb (deprecated - don't use)
+      USE_LIBUSB = false ;
+
+      # Compile in graph plotting code (Not fully implemented)
+      USE_PLOT = true ;		# [true]
+
+      JPEGLIB = ;
+      JPEGINC = ;
+      HAVE_JPEG = true ;
+
+      TIFFLIB = ;
+      TIFFINC = ;
+      HAVE_TIFF = true ;
+
+      PNGLIB = ;
+      PNGINC = ;
+      HAVE_PNG = true ;
+
+      ZLIB = ;
+      ZINC = ;
+      HAVE_Z = true ;
+
+      SSLLIB = ;
+      SSLINC = ;
+      HAVE_SSL = true ;
+
+      LINKFLAGS +=
+        ${lib.concatStringsSep " " (map (x: "-L${x}/lib") buildInputs)}
+        -ldl -lrt -lX11 -lXext -lXxf86vm -lXinerama -lXrandr -lXau -lXdmcp -lXss
+        -ljpeg -ltiff -lpng -lssl ;
+    '';
+  in ''
    cp ${jamTop} Jamtop
    substituteInPlace Makefile --replace "-j 3" "-j $NIX_BUILD_CORES"
    # Remove tiff, jpg and png to be sure the nixpkgs-provided ones are used
    rm -rf tiff jpg png

-    unset AR
+    export AR="$AR rusc"
  '';

  buildInputs = [
@ -110,6 +115,9 @@ stdenv.mkDerivation rec {
    mkdir -p $out/etc/udev/rules.d
    sed -i '/udev-acl/d' usb/55-Argyll.rules
    cp -v usb/55-Argyll.rules $out/etc/udev/rules.d/
+
+    sed -i -e 's/^CREATED .*/CREATED "'"$(date -d @$SOURCE_DATE_EPOCH)"'"/g' $out/share/argyllcms/RefMediumGamut.gam
+
  '';

  meta = with lib; {
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fend";
-  version = "0.1.24";
+  version = "0.1.26";

  src = fetchFromGitHub {
    owner = "printfn";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Oa/o2Jd0rf+fIVQCaCiSh+tI2KINh1Kx3NTVEULQlzI=";
+    sha256 = "sha256-U5LYjoq11qZYus/McDbtVljj2RSP9MCXXDvOWgbXerk=";
  };

-  cargoSha256 = "sha256-iFGw5mkeRGiMWe5wcrEcmH0WlHJ8p1D0rf1mh+1Mo+w=";
+  cargoSha256 = "sha256-E7by7FJfmOBqDoZLA9s/bj/EHaZ4IsHYTHWcvIuaMNg=";

  doInstallCheck = true;

--- a/pkgs/tools/misc/fselect/default.nix
+++ b/pkgs/tools/misc/fselect/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fselect";
-  version = "0.7.6";
+  version = "0.7.7";

  src = fetchFromGitHub {
    owner = "jhspetersson";
    repo = "fselect";
    rev = version;
-    sha256 = "sha256-uIqkk0aQVPXUWjOWmMTdM28Ihi+mflPpxnXJLFIQYJw=";
+    sha256 = "sha256-1UpY32itljkpkOjcVEcpZ0iN+PciEnG9tOpbInHwNus=";
  };

-  cargoSha256 = "sha256-5LRCLJbLiocB/VDf9MMxyIsERmOvuSAQEe822Dcu2j8=";
+  cargoSha256 = "sha256-M8hnXHVfKK/aQGXlMpuhoTLalpnHjxSkX+LHwpatu90=";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = lib.optional stdenv.isDarwin libiconv;
--- a/pkgs/tools/networking/globalprotect-openconnect/default.nix
+++ b/pkgs/tools/networking/globalprotect-openconnect/default.nix
@ -4,14 +4,14 @@

 stdenv.mkDerivation rec {
  pname = "globalprotect-openconnect";
-  version = "1.2.6";
+  version = "1.3.4";

  src = fetchFromGitHub {
    owner = "yuezk";
    repo = "GlobalProtect-openconnect";
    rev = "c14a6ad1d2b62f8d297bc4cfbcb1dcea4d99112f";
    fetchSubmodules = true;
-    sha256 = "1zkc3vk1j31n2zs5ammzv23dah7x163gfrzz222ynbkvsccrhzrk";
+    sha256 = "sha256-M3+YGdN7LuuFEP9n94YJ/UDVhti/VlX0FzYMGeYebP4=";
  };

  nativeBuildInputs = [ qmake wrapQtAppsHook ];
--- a/pkgs/tools/networking/grpcurl/default.nix
+++ b/pkgs/tools/networking/grpcurl/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "grpcurl";
-  version = "1.8.2";
+  version = "1.8.5";

  src = fetchFromGitHub {
    owner = "fullstorydev";
    repo = "grpcurl";
    rev = "v${version}";
-    sha256 = "sha256-/no8bRGoKibtcjaITUuzwAbX+gPHNJROSf79iuuRwe4=";
+    sha256 = "sha256-73gp3UQk7D3aWK2jtMpiY4tiVhvHkTqZipoynosd3ec=";
  };

  subPackages = [ "cmd/grpcurl" ];

-  vendorSha256 = "sha256-nl8vKVhUMSO20qCDyhNkU5cghNy8vIFqSBvLk59nbWg=";
+  vendorSha256 = "sha256-dHh8zHtU/r6AscInfNfVFd5psys2b6D1FS02lSoiGto=";

  ldflags = [ "-s" "-w" "-X main.version=${version}" ];

--- a/pkgs/tools/networking/hurl/default.nix
+++ b/pkgs/tools/networking/hurl/default.nix
@ -12,13 +12,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "hurl";
-  version = "1.3.1";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "Orange-OpenSource";
    repo = pname;
    rev = version;
-    sha256 = "sha256-BmBqFJ64Nolq+eGZ5D3LQU3Ek2Gs+HpH/bptCQScbIg=";
+    sha256 = "sha256-oa9J51Y6Q0nPxA9SdsEZy7F6EopS5xuh1yWyTD21mGI=";
  };

  nativeBuildInputs = [
@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
  # Tests require network access to a test server
  doCheck = false;

-  cargoSha256 = "sha256-tAg3xwmh7SjJsm9r5TnhXHIDLpUQpz3YDS6gWxFgps4=";
+  cargoSha256 = "sha256-CwChbp6Un9tgJu1vtfhcFclpbvGANLLEX3lwtTQPuSg=";

  postInstall = ''
    python ci/gen_manpage.py docs/hurl.md > hurl.1
--- a/pkgs/tools/security/gpg-tui/default.nix
+++ b/pkgs/tools/security/gpg-tui/default.nix
@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gpg-tui";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = "gpg-tui";
    rev = "v${version}";
-    sha256 = "sha256-UUfZd6wTBoOyBdkidzxa3Fyc3GjeGdCT0n7jKmhdNa0=";
+    sha256 = "sha256-2fTJHcJJzQIAyxLnWdoyR77tA9p/3s3UescypGwKfc0=";
  };

-  cargoSha256 = "sha256-yX/g/An06nx95IaxjfYVUofvDDS2ZjiNAZf3ivi6ZF0=";
+  cargoSha256 = "sha256-8dWMJZiWy0cO0CGAFEmtGYZ8bVK1ZR7qBkjKn6rLC+k=";

  nativeBuildInputs = [
    gpgme # for gpgme-config
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "grype";
-  version = "0.22.0";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-5TOfy7eapkvXwVC4TcSo3mWSAkLqBeVco7SG2H21lRo=";
+    sha256 = "sha256-6OCtyB5hzG3QPmXNlT8VvN8oFjaTeqEAuMFKXG0DvII=";
  };

-  vendorSha256 = "sha256-pgasbJdyTBIYIeaidKYFLy0LqmCTKE7IUkFqddJtcR0=";
+  vendorSha256 = "sha256-kvfzeJoonHI5Z7roHwN1ANYWyKROUd6slRb/VLbU3xo=";

  propagatedBuildInputs = [ docker ];

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -6409,6 +6409,11 @@ with pkgs;

  intermodal = callPackage ../tools/misc/intermodal { };

+  invidious = callPackage ../servers/invidious {
+    # needs a specific version of lsquic
+    lsquic = callPackage ../servers/invidious/lsquic.nix { };
+  };
+
  invoice2data  = callPackage ../tools/text/invoice2data  { };

  inxi = callPackage ../tools/system/inxi { };
@ -12226,6 +12231,7 @@ with pkgs;
      inherit (darwin.apple_sdk.frameworks) Foundation;
    });
  graalvm11-ce = graalvmCEPackages.graalvm11-ce;
+  graalvm17-ce = graalvmCEPackages.graalvm17-ce;

  inherit (callPackages ../development/compilers/graalvm/enterprise-edition.nix { })
    graalvm8-ee
@ -22140,6 +22146,8 @@ with pkgs;
  musl-fts = callPackage ../os-specific/linux/musl-fts { };
  musl-obstack = callPackage ../os-specific/linux/musl-obstack { };

+  nsh = callPackage ../shells/nsh { };
+
  nushell = callPackage ../shells/nushell {
    inherit (darwin.apple_sdk.frameworks) AppKit Security;
  };