Merge remote-tracking branch 'origin/staging-next' into staging

2024-11-19 00:08:32 +01:00 · 2022-05-23 17:35:37 +02:00 · 2022-05-23 17:35:37 +02:00 · 1923b68bda
commit 1923b68bda
parent 736fdef658 f51499324c
123 changed files with 1163 additions and 376 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -982,12 +982,13 @@ in python.withPackages(ps: [ps.blaze])).env
 #### Optional extra dependencies

 Some packages define optional dependencies for additional features. With
-`setuptools` this is called `extras_require` and `flit` calls it `extras-require`. A
+`setuptools` this is called `extras_require` and `flit` calls it
+`extras-require`, while PEP 621 calls these `optional-dependencies`. A
 method for supporting this is by declaring the extras of a package in its
 `passthru`, e.g. in case of the package `dask`

 ```nix
-passthru.extras-require = {
+passthru.optional-dependencies = {
  complete = [ distributed ];
 };
 ```
@ -997,7 +998,7 @@ and letting the package requiring the extra add the list to its dependencies
 ```nix
 propagatedBuildInputs = [
  ...
-] ++ dask.extras-require.complete;
+] ++ dask.optional-dependencies.complete;
 ```

 Note this method is preferred over adding parameters to builders, as that can
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@ -41,7 +41,7 @@ let
    # none
    "aarch64_be-none" "aarch64-none" "arm-none" "armv6l-none" "avr-none" "i686-none"
    "msp430-none" "or1k-none" "m68k-none" "powerpc-none" "powerpcle-none"
-    "riscv32-none" "riscv64-none" "s390-none" "s390x-none" "vc4-none"
+    "riscv32-none" "riscv64-none" "rx-none" "s390-none" "s390x-none" "vc4-none"
    "x86_64-none"

    # OpenBSD
@ -76,6 +76,7 @@ in {
  riscv         = filterDoubles predicates.isRiscV;
  riscv32       = filterDoubles predicates.isRiscV32;
  riscv64       = filterDoubles predicates.isRiscV64;
+  rx            = filterDoubles predicates.isRx;
  vc4           = filterDoubles predicates.isVc4;
  or1k          = filterDoubles predicates.isOr1k;
  m68k          = filterDoubles predicates.isM68k;
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@ -145,6 +145,11 @@ rec {
    libc = "newlib";
  };

+  rx-embedded = {
+    config = "rx-none-elf";
+    libc = "newlib";
+  };
+
  msp430 = {
    config = "msp430-elf";
    libc = "newlib";
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@ -26,6 +26,7 @@ rec {
    isRiscV        = { cpu = { family = "riscv"; }; };
    isRiscV32      = { cpu = { family = "riscv"; bits = 32; }; };
    isRiscV64      = { cpu = { family = "riscv"; bits = 64; }; };
+    isRx           = { cpu = { family = "rx"; }; };
    isSparc        = { cpu = { family = "sparc"; }; };
    isWasm         = { cpu = { family = "wasm"; }; };
    isMsp430       = { cpu = { family = "msp430"; }; };
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@ -116,6 +116,7 @@ rec {

    alpha    = { bits = 64; significantByte = littleEndian; family = "alpha"; };

+    rx       = { bits = 32; significantByte = littleEndian; family = "rx"; };
    msp430   = { bits = 16; significantByte = littleEndian; family = "msp430"; };
    avr      = { bits = 8; family = "avr"; };

--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@ -223,10 +223,10 @@ foreach my $u (@{$spec->{users}}) {
    }

    # Ensure home directory incl. ownership and permissions.
-    if ($u->{createHome}) {
-        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home} and ! $is_dry;
+    if ($u->{createHome} and !$is_dry) {
+        make_path($u->{home}, { mode => oct($u->{homeMode}) }) if ! -e $u->{home};
        chown $u->{uid}, $u->{gid}, $u->{home};
-        chmod 0700, $u->{home};
+        chmod oct($u->{homeMode}), $u->{home};
    }

    if (defined $u->{passwordFile}) {
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -48,7 +48,7 @@ let
    services such as SSH, or indirectly via <command>su</command> or
    <command>sudo</command>). This should only be used for e.g. bootable
    live systems. Note: this is different from setting an empty password,
-    which ca be achieved using <option>users.users.&lt;name?&gt;.password</option>.
+    which can be achieved using <option>users.users.&lt;name?&gt;.password</option>.

    If set to <literal>null</literal> (default) this user will not
    be able to log in using a password (i.e. via <command>login</command>
@ -139,6 +139,12 @@ let
        description = "The user's home directory.";
      };

+      homeMode = mkOption {
+        type = types.strMatching "[0-7]{1,5}";
+        default = "700";
+        description = "The user's home directory mode in numeric format. See chmod(1). The mode is only applied if <option>users.users.&lt;name&gt;.createHome</option> is true.";
+      };
+
      cryptHomeLuks = mkOption {
        type = with types; nullOr str;
        default = null;
@ -319,6 +325,7 @@ let
          group = mkDefault "users";
          createHome = mkDefault true;
          home = mkDefault "/home/${config.name}";
+          homeMode = mkDefault "700";
          useDefaultShell = mkDefault true;
          isSystemUser = mkDefault false;
        })
@ -430,7 +437,7 @@ let
    inherit (cfg) mutableUsers;
    users = mapAttrsToList (_: u:
      { inherit (u)
-          name uid group description home createHome isSystemUser
+          name uid group description home homeMode createHome isSystemUser
          password passwordFile hashedPassword
          autoSubUidGidRange subUidRanges subGidRanges
          initialPassword initialHashedPassword;
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@ -199,6 +199,7 @@ let
    allow_anonymous = 1;
    allow_zero_length_clientid = 1;
    auto_id_prefix = 1;
+    bind_interface = 1;
    cafile = 1;
    capath = 1;
    certfile = 1;
@ -295,7 +296,7 @@ let
  };

  listenerAsserts = prefix: listener:
-    assertKeysValid prefix freeformListenerKeys listener.settings
+    assertKeysValid "${prefix}.settings" freeformListenerKeys listener.settings
    ++ userAsserts prefix listener.users
    ++ imap0
      (i: v: authAsserts "${prefix}.authPlugins.${toString i}" v)
@ -397,7 +398,7 @@ let
  };

  bridgeAsserts = prefix: bridge:
-    assertKeysValid prefix freeformBridgeKeys bridge.settings
+    assertKeysValid "${prefix}.settings" freeformBridgeKeys bridge.settings
    ++ [ {
      assertion = length bridge.addresses > 0;
      message = "Bridge ${prefix} needs remote broker addresses";
@ -526,7 +527,7 @@ let

  globalAsserts = prefix: cfg:
    flatten [
-      (assertKeysValid prefix freeformGlobalKeys cfg.settings)
+      (assertKeysValid "${prefix}.settings" freeformGlobalKeys cfg.settings)
      (imap0 (n: l: listenerAsserts "${prefix}.listener.${toString n}" l) cfg.listeners)
      (mapAttrsToList (n: b: bridgeAsserts "${prefix}.bridge.${n}" b) cfg.bridges)
    ];
@ -629,9 +630,10 @@ in
               ]));
        RemoveIPC = true;
        RestrictAddressFamilies = [
-          "AF_UNIX"  # for sd_notify() call
+          "AF_UNIX"
          "AF_INET"
          "AF_INET6"
+          "AF_NETLINK"
        ];
        RestrictNamespaces = true;
        RestrictRealtime = true;
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -35,11 +35,11 @@ let
      "nss-lookup.target"
      "nss-user-lookup.target"
      "time-sync.target"
-    ] ++ (optionals cfg.package.withCryptsetup [
+    ] ++ optionals cfg.package.withCryptsetup [
      "cryptsetup.target"
      "cryptsetup-pre.target"
      "remote-cryptsetup.target"
-    ]) ++ [
+    ] ++ [
      "sigpwr.target"
      "timers.target"
      "paths.target"
@ -133,20 +133,27 @@ let

      # Slices / containers.
      "slices.target"
+    ] ++ optionals cfg.package.withImportd [
+      "systemd-importd.service"
+    ] ++ optionals cfg.package.withMachined [
      "machine.slice"
      "machines.target"
-      "systemd-importd.service"
      "systemd-machined.service"
+    ] ++ [
      "systemd-nspawn@.service"

      # Misc.
      "systemd-sysctl.service"
+    ] ++ optionals cfg.package.withTimedated [
      "dbus-org.freedesktop.timedate1.service"
-      "dbus-org.freedesktop.locale1.service"
-      "dbus-org.freedesktop.hostname1.service"
      "systemd-timedated.service"
+    ] ++ optionals cfg.package.withLocaled [
+      "dbus-org.freedesktop.locale1.service"
      "systemd-localed.service"
+    ] ++ optionals cfg.package.withHostnamed [
+      "dbus-org.freedesktop.hostname1.service"
      "systemd-hostnamed.service"
+    ] ++ [
      "systemd-exit.service"
      "systemd-update-done.service"
    ] ++ cfg.additionalUpstreamSystemUnits;
--- a/nixos/modules/system/boot/systemd/logind.nix
+++ b/nixos/modules/system/boot/systemd/logind.nix
@ -81,8 +81,11 @@ in
      "systemd-logind.service"
      "autovt@.service"
      "systemd-user-sessions.service"
+    ] ++ optionals config.systemd.package.withImportd [
      "dbus-org.freedesktop.import1.service"
+    ] ++ optionals config.systemd.package.withMachined [
      "dbus-org.freedesktop.machine1.service"
+    ] ++ [
      "dbus-org.freedesktop.login1.service"
      "user@.service"
      "user-runtime-dir@.service"
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -365,6 +365,7 @@ in
  nginx = handleTest ./nginx.nix {};
  nginx-auth = handleTest ./nginx-auth.nix {};
  nginx-etag = handleTest ./nginx-etag.nix {};
+  nginx-http3 = handleTest ./nginx-http3.nix {};
  nginx-modsecurity = handleTest ./nginx-modsecurity.nix {};
  nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
  nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {};
@ -579,6 +580,7 @@ in
  uptermd = handleTest ./uptermd.nix {};
  usbguard = handleTest ./usbguard.nix {};
  user-activation-scripts = handleTest ./user-activation-scripts.nix {};
+  user-home-mode = handleTest ./user-home-mode.nix {};
  uwsgi = handleTest ./uwsgi.nix {};
  v2ray = handleTest ./v2ray.nix {};
  vault = handleTest ./vault.nix {};
--- a/nixos/tests/mosquitto.nix
+++ b/nixos/tests/mosquitto.nix
@ -4,6 +4,7 @@ let
  port = 1888;
  tlsPort = 1889;
  anonPort = 1890;
+  bindTestPort = 1891;
  password = "VERY_secret";
  hashedPassword = "$7$101$/WJc4Mp+I+uYE9sR$o7z9rD1EYXHPwEP5GqQj6A7k4W1yVbePlb8TqNcuOLV9WNCiDgwHOB0JHC1WCtdkssqTBduBNUnUGd6kmZvDSw==";
  topic = "test/foo";
@ -125,6 +126,10 @@ in {
              };
            };
          }
+          {
+            settings.bind_interface = "eth0";
+            port = bindTestPort;
+          }
        ];
      };
    };
@ -134,6 +139,8 @@ in {
  };

  testScript = ''
+    import json
+
    def mosquitto_cmd(binary, user, topic, port):
        return (
            "mosquitto_{} "
@ -162,6 +169,27 @@ in {
    start_all()
    server.wait_for_unit("mosquitto.service")

+    with subtest("bind_interface"):
+        addrs = dict()
+        for iface in json.loads(server.succeed("ip -json address show")):
+            for addr in iface['addr_info']:
+                # don't want to deal with multihoming here
+                assert addr['local'] not in addrs
+                addrs[addr['local']] = (iface['ifname'], addr['family'])
+
+        # mosquitto grabs *one* random address per type for bind_interface
+        (has4, has6) = (False, False)
+        for line in server.succeed("ss -HlptnO sport = ${toString bindTestPort}").splitlines():
+            items = line.split()
+            if "mosquitto" not in items[5]: continue
+            listener = items[3].rsplit(':', maxsplit=1)[0].strip('[]')
+            assert listener in addrs
+            assert addrs[listener][0] == "eth0"
+            has4 |= addrs[listener][1] == 'inet'
+            has6 |= addrs[listener][1] == 'inet6'
+        assert has4
+        assert has6
+
    with subtest("check passwords"):
        client1.succeed(publish("-m test", "password_store"))
        client1.succeed(publish("-m test", "password_file"))
--- a/nixos/tests/nginx-http3.nix
+++ b/nixos/tests/nginx-http3.nix
@ -0,0 +1,90 @@
+import ./make-test-python.nix ({lib, pkgs, ...}:
+let
+  hosts = ''
+    192.168.2.101 acme.test
+  '';
+
+in
+{
+  name = "nginx-http3";
+  meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
+
+  nodes = {
+    server = { pkgs, ... }: {
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.101"; prefixLength = 24; }
+          ];
+        };
+        extraHosts = hosts;
+        firewall.allowedTCPPorts = [ 443 ];
+        firewall.allowedUDPPorts = [ 443 ];
+      };
+
+      security.pki.certificates = [
+        (builtins.readFile ./common/acme/server/ca.cert.pem)
+      ];
+
+      services.nginx = {
+        enable = true;
+        package = pkgs.nginxQuic;
+
+        virtualHosts."acme.test" = {
+          onlySSL = true;
+          sslCertificate = ./common/acme/server/acme.test.cert.pem;
+          sslCertificateKey = ./common/acme/server/acme.test.key.pem;
+          http2 = true;
+          http3 = true;
+          reuseport = true;
+          root = lib.mkForce (pkgs.runCommandLocal "testdir2" {} ''
+            mkdir "$out"
+            cat > "$out/index.html" <<EOF
+            <html><body>Hello World!</body></html>
+            EOF
+            cat > "$out/example.txt" <<EOF
+            Check http3 protocol.
+            EOF
+          '');
+        };
+      };
+    };
+
+    client = { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.curlHTTP3 ];
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.201"; prefixLength = 24; }
+          ];
+        };
+        extraHosts = hosts;
+      };
+
+      security.pki.certificates = [
+        (builtins.readFile ./common/acme/server/ca.cert.pem)
+      ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    # Check http connections
+    client.succeed("curl --verbose --http3 https://acme.test | grep 'Hello World!'")
+
+    # Check downloadings
+    client.succeed("curl --verbose --http3 https://acme.test/example.txt --output /tmp/example.txt")
+    client.succeed("cat /tmp/example.txt | grep 'Check http3 protocol.'")
+
+    # Check header reading
+    client.succeed("curl --verbose --http3 --head https://acme.test | grep 'content-type'")
+
+    # Check change User-Agent
+    client.succeed("curl --verbose --http3 --user-agent 'Curl test 3.0' https://acme.test")
+    server.succeed("cat /var/log/nginx/access.log | grep 'Curl test 3.0'")
+
+    server.shutdown()
+    client.shutdown()
+  '';
+})
--- a/nixos/tests/user-home-mode.nix
+++ b/nixos/tests/user-home-mode.nix
@ -0,0 +1,27 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "user-home-mode";
+  meta = with lib.maintainers; { maintainers = [ fbeffa ]; };
+
+  nodes.machine = {
+    users.users.alice = {
+      initialPassword = "pass1";
+      isNormalUser = true;
+    };
+    users.users.bob = {
+      initialPassword = "pass2";
+      isNormalUser = true;
+      homeMode = "750";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("getty@tty1.service")
+    machine.wait_until_tty_matches(1, "login: ")
+    machine.send_chars("alice\n")
+    machine.wait_until_tty_matches(1, "Password: ")
+    machine.send_chars("pass1\n")
+    machine.succeed('[ "$(stat -c %a /home/alice)" == "700" ]')
+    machine.succeed('[ "$(stat -c %a /home/bob)" == "750" ]')
+  '';
+})
--- a/pkgs/applications/audio/mpg321/default.nix
+++ b/pkgs/applications/audio/mpg321/default.nix
@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
      url = "https://sources.debian.org/data/main/m/mpg321/0.3.2-3/debian/patches/handle_illegal_bitrate_value.patch";
      sha256 = "15simp5fjvm9b024ryfh441rkh2d5bcrizqkzlrh07n9sm7fkw6x";
    })
+    # Apple defines semun already. Skip redefining it to fix build errors.
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/Homebrew/formula-patches/85fa66a9/mpg321/0.3.2.patch";
+      sha256 = "sha256-qFYpKpE9PZSzOJrnsQINZi6FvUVX0anRyOvlF5eOYqE=";
+    })
  ];

  hardeningDisable = [ "format" ];
@ -37,6 +42,6 @@ stdenv.mkDerivation rec {
    description = "Command-line MP3 player";
    homepage = "http://mpg321.sourceforge.net/";
    license = licenses.gpl2;
-    platforms = platforms.gnu ++ platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/blockchains/sparrow/default.nix
+++ b/pkgs/applications/blockchains/sparrow/default.nix
@ -0,0 +1,232 @@
+{ stdenv
+, lib
+, makeWrapper
+, fetchurl
+, makeDesktopItem
+, copyDesktopItems
+, autoPatchelfHook
+, openjdk17
+, gtk3
+, gsettings-desktop-schemas
+, writeScript
+, bash
+, gnugrep
+, tor
+, zlib
+, openimajgrabber
+, hwi
+, imagemagick
+}:
+
+let
+  pname = "sparrow";
+  version = "1.6.4";
+
+  src = fetchurl {
+    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
+    sha256 = "1wdibpbhv3g6qk42ddfc5vyqkkwprczy45w5wi115qg3g1rf1in7";
+  };
+
+  launcher = writeScript "sparrow" ''
+    #! ${bash}/bin/bash
+    params=(
+      --module-path @out@/lib:@jdkModules@/modules
+      --add-opens javafx.graphics/com.sun.javafx.css=org.controlsfx.controls
+      --add-opens javafx.graphics/javafx.scene=org.controlsfx.controls
+      --add-opens javafx.controls/com.sun.javafx.scene.control.behavior=org.controlsfx.controls
+      --add-opens javafx.controls/com.sun.javafx.scene.control.inputmap=org.controlsfx.controls
+      --add-opens javafx.graphics/com.sun.javafx.scene.traversal=org.controlsfx.controls
+      --add-opens javafx.base/com.sun.javafx.event=org.controlsfx.controls
+      --add-opens javafx.controls/javafx.scene.control.cell=com.sparrowwallet.sparrow
+      --add-opens org.controlsfx.controls/impl.org.controlsfx.skin=com.sparrowwallet.sparrow
+      --add-opens org.controlsfx.controls/impl.org.controlsfx.skin=javafx.fxml
+      --add-opens javafx.graphics/com.sun.javafx.tk=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.javafx.tk.quantum=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.glass.ui=centerdevice.nsmenufx
+      --add-opens javafx.controls/com.sun.javafx.scene.control=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.javafx.menu=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.glass.ui=com.sparrowwallet.sparrow
+      --add-opens javafx.graphics/com.sun.javafx.application=com.sparrowwallet.sparrow
+      --add-opens java.base/java.net=com.sparrowwallet.sparrow
+      --add-opens java.base/java.io=com.google.gson
+      --add-reads com.sparrowwallet.merged.module=java.desktop
+      --add-reads com.sparrowwallet.merged.module=java.sql
+      --add-reads com.sparrowwallet.merged.module=com.sparrowwallet.sparrow
+      --add-reads com.sparrowwallet.merged.module=logback.classic
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.databind
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.annotation
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.core
+      --add-reads com.sparrowwallet.merged.module=co.nstant.in.cbor
+      -m com.sparrowwallet.sparrow
+    )
+
+    XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS ${openjdk17}/bin/java ''${params[@]} $@
+  '';
+
+  torWrapper = writeScript "tor-wrapper" ''
+    #! ${bash}/bin/bash
+
+    exec ${tor}/bin/tor "$@"
+  '';
+
+  jdk-modules = stdenv.mkDerivation {
+    name = "jdk-modules";
+    nativeBuildInputs = [ openjdk17 ];
+    dontUnpack = true;
+
+    buildPhase = ''
+      # Extract the JDK's JIMAGE and generate a list of modules.
+      mkdir modules
+      pushd modules
+      jimage extract ${openjdk17}/lib/openjdk/lib/modules
+      ls | xargs -d " " -- echo > ../manifest.txt
+      popd
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp manifest.txt $out/
+      cp -r modules/ $out/
+    '';
+  };
+
+  sparrow-modules = stdenv.mkDerivation {
+    pname = "sparrow-modules";
+    inherit version src;
+    nativeBuildInputs = [ makeWrapper gnugrep openjdk17 autoPatchelfHook stdenv.cc.cc.lib zlib ];
+
+    buildPhase = ''
+      # Extract Sparrow's JIMAGE and generate a list of them.
+      mkdir modules
+      pushd modules
+      jimage extract ../lib/runtime/lib/modules
+
+      # Delete JDK modules
+      cat ${jdk-modules}/manifest.txt | xargs -I {} -- rm -fR {}
+
+      # Delete unneeded native libs.
+
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-aarch64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-arm
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-armel
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-mips64el
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-ppc
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-ppc64le
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-s390x
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/openbsd-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/openbsd-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-sparc
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-sparcv9
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-x86
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_armel
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_armhf
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x86
+      rm com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x64/OpenIMAJGrabber.so
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_arm32_armel
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armel
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armhf
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_x86
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x64
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x86
+      rm -fR com.sparrowwallet.merged.module/linux-aarch64
+      rm -fR com.sparrowwallet.merged.module/linux-arm
+      rm -fR com.sparrowwallet.merged.module/linux-x86
+      rm com.sparrowwallet.sparrow/native/linux/x64/hwi
+
+      ls | xargs -d " " -- echo > ../manifest.txt
+      find . | grep "\.so$" | xargs -- chmod ugo+x
+      popd
+
+      # Replace the embedded Tor binary (which is in a Tar archive)
+      # with one from Nixpkgs.
+      cp ${torWrapper} ./tor
+      tar -cJf tor.tar.xz tor
+      cp tor.tar.xz modules/netlayer.jpms/native/linux/x64/tor.tar.xz
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp manifest.txt $out/
+      cp -r modules/ $out/
+      ln -s ${openimajgrabber}/lib/OpenIMAJGrabber.so $out/modules/com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x64/OpenIMAJGrabber.so
+      ln -s ${hwi}/bin/hwi $out/modules/com.sparrowwallet.sparrow/native/linux/x64/hwi
+    '';
+  };
+
+  # To use the udev rules for connected hardware wallets,
+  # add "pkgs.sparrow" to "services.udev.packages" and add user accounts to the user group "plugdev".
+  udev-rules = stdenv.mkDerivation {
+    name = "sparrow-udev";
+
+    src = let version = "2.0.2"; in
+      fetchurl {
+        url = "https://github.com/bitcoin-core/HWI/releases/download/${version}/hwi-${version}.tar.gz";
+        sha256 = "sha256-di1fRsMbwpHcBFNTCVivfxpwhUoUKLA3YTnJxKq/jHM=";
+      };
+
+    installPhase = ''
+      mkdir -p $out/etc/udev/rules.d
+      cp -a hwilib/udev/* $out/etc/udev/rules.d
+      rm $out/etc/udev/rules.d/README.md
+    '';
+  };
+in
+stdenv.mkDerivation rec {
+  inherit pname version src;
+  nativeBuildInputs = [ makeWrapper copyDesktopItems ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Sparrow";
+      exec = pname;
+      icon = pname;
+      desktopName = "Sparrow Bitcoin Wallet";
+      genericName = "Bitcoin Wallet";
+      categories = [ "Finance" ];
+    })
+  ];
+
+  sparrow-icons = stdenv.mkDerivation {
+    inherit version src;
+    pname = "sparrow-icons";
+    nativeBuildInputs = [ imagemagick ];
+
+    installPhase = ''
+      for n in 16 24 32 48 64 96 128 256; do
+        size=$n"x"$n
+        mkdir -p $out/hicolor/$size/apps
+        convert lib/Sparrow.png -resize $size $out/hicolor/$size/apps/sparrow.png
+        done;
+    '';
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out
+    ln -s ${sparrow-modules}/modules $out/lib
+    install -D -m 777 ${launcher} $out/bin/sparrow
+    substituteAllInPlace $out/bin/sparrow
+    substituteInPlace $out/bin/sparrow --subst-var-by jdkModules ${jdk-modules}
+
+    mkdir -p $out/share/icons
+    ln -s ${sparrow-icons}/hicolor $out/share/icons
+
+    mkdir -p $out/etc/udev
+    ln -s ${udev-rules}/etc/udev/rules.d $out/etc/udev/rules.d
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A modern desktop Bitcoin wallet application supporting most hardware wallets and built on common standards such as PSBT, with an emphasis on transparency and usability.";
+    homepage = "https://sparrowwallet.com";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ emmanuelrosa _1000101 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/blockchains/sparrow/openimajgrabber.nix
+++ b/pkgs/applications/blockchains/sparrow/openimajgrabber.nix
@ -0,0 +1,40 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, libv4l
+}:
+stdenv.mkDerivation rec {
+  pname = "openimajgrabber";
+  version = "1.3.10";
+
+  src = fetchFromGitHub {
+    owner = "openimaj";
+    repo = "openimaj";
+    rev = "openimaj-${version}";
+    sha256 = "sha256-Y8707ovE7f6Fk3cJ+PtwvzNpopgH5vlF55m2Xm4hjYM=";
+  };
+
+  buildInputs = [ libv4l ];
+
+  # These build instructions come from build.sh
+  buildPhase = ''
+    pushd hardware/core-video-capture/src-native/linux
+    g++ -fPIC -g -c OpenIMAJGrabber.cpp
+    g++ -fPIC -g -c capture.cpp
+    g++ -shared -Wl,-soname,OpenIMAJGrabber.so -o OpenIMAJGrabber.so OpenIMAJGrabber.o capture.o -lv4l2 -lrt -lv4lconvert
+    popd
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp hardware/core-video-capture/src-native/linux/OpenIMAJGrabber.so $out/lib
+  '';
+
+  meta = with lib; {
+    description = "A collection of libraries and tools for multimedia (images, text, video, audio, etc.) content analysis and content generation. This package only builds the OpenIMAJGrabber for Linux.";
+    homepage = "http://www.openimaj.org";
+    license = licenses.bsd0;
+    maintainers = with maintainers; [ emmanuelrosa _1000101 ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/editors/notepad-next/default.nix
+++ b/pkgs/applications/editors/notepad-next/default.nix
@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchFromGitHub, qmake, libsForQt5 }:
+{ mkDerivation, lib, fetchFromGitHub, qmake, libsForQt5, stdenv }:

 mkDerivation rec {
  pname = "notepad-next";
@ -32,5 +32,6 @@ mkDerivation rec {
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = [ maintainers.sebtm ];
+    broken = stdenv.isAarch64;
  };
 }
--- a/pkgs/applications/graphics/scantailor/advanced.nix
+++ b/pkgs/applications/graphics/scantailor/advanced.nix
@ -4,21 +4,21 @@

 mkDerivation rec {
  pname = "scantailor-advanced";
-  version = "1.0.16";
+  version = "1.0.18";

  src = fetchFromGitHub {
-    owner = "4lex4";
+    owner = "vigri";
    repo = "scantailor-advanced";
    rev = "v${version}";
-    sha256 = "0lc9lzbpiy5hgimyhl4s4q67pb9gacpy985gl6iy8pl79zxhmcyp";
+    sha256 = "sha256-4/QSjgHvRgIduS/AXbT7osRTdOdgR7On3CbjRnGbwHU=";
  };

  nativeBuildInputs = [ cmake qttools ];
  buildInputs = [ libjpeg libpng libtiff boost qtbase ];

  meta = with lib; {
-    homepage = "https://github.com/4lex4/scantailor-advanced";
-    description = "Interactive post-processing tool for scanned pages";
+    homepage = "https://github.com/vigri/scantailor-advanced";
+    description = "Interactive post-processing tool for scanned pages (vigri's fork)";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ jfrankenau ];
    platforms = with platforms; gnu ++ linux ++ darwin;
--- a/pkgs/applications/misc/openambit/default.nix
+++ b/pkgs/applications/misc/openambit/default.nix
@ -1,5 +1,6 @@
 { cmake
 , fetchFromGitHub
+, fetchpatch
 , lib
 , libusb1
 , mkDerivation
@ -21,6 +22,16 @@ mkDerivation rec {
    sha256 = "1074kvkamwnlkwdajsw1799wddcfkjh2ay6l842r0s4cvrxrai85";
  };

+  patches = [
+    # Pull upstream patch for -fno-common toolchain support:
+    #   https://github.com/openambitproject/openambit/pull/244
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/openambitproject/openambit/commit/b6d97eab417977b6dbe355e0b071d0a56cc3df6b.patch";
+      sha256 = "1p0dg902mlcfjvs01dxl9wv2b50ayp4330p38d14q87mn0c2xl5d";
+    })
+  ];
+
  nativeBuildInputs = [ cmake qttools ];
  buildInputs = [ libusb1 python3 qtbase udev zlib ];

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -49,10 +49,10 @@
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.167.0",
-    "sha256": "sha256-l2wCcYcAlKQTKkD+3yFi4zBkMVpq27Ygld1UjeD6IHM=",
+    "rev": "v1.168.0",
+    "sha256": "sha256-NN4dqEywcoP4tk2J6RfWqoGw+95bIEoxb4YpwPtoTZ0=",
    "vendorSha256": "sha256-qZNYfSlUkCu7FudbKF4IOgK1xWM5LqUghclOeGOxYXg=",
-    "version": "1.167.0"
+    "version": "1.168.0"
  },
  "ansible": {
    "owner": "nbering",
@ -103,10 +103,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v4.14.0",
-    "sha256": "sha256-9xJVJw2kIutmmiKGvRBKS+/oyGSq0dipeCn2Gmtk1AU=",
-    "vendorSha256": "sha256-+YINrbj52ionuQbcgck6Dp2h88+LS5tXPmoVHXCAXOk=",
-    "version": "4.14.0"
+    "rev": "v4.15.1",
+    "sha256": "sha256-o8yUcjw4X+Vx49hV+0guccueWoHvpxSs+sMsbAoAw9o=",
+    "vendorSha256": "sha256-l7Fe5hhEvJ5DiZ3t79sZYIt+6eZkjjf7Npmr8p2/e/4=",
+    "version": "4.15.1"
  },
  "azuread": {
    "owner": "hashicorp",
@ -121,10 +121,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
    "repo": "terraform-provider-azurerm",
-    "rev": "v3.6.0",
-    "sha256": "sha256-brC9HZbyettgvwuFjrPxeRg/msQ1leD7F/h9aUxXAYo=",
+    "rev": "v3.7.0",
+    "sha256": "sha256-dvkR2nEtf4HvLTIoa++4PI5oNOPuJzI4obxdI4meKG4=",
    "vendorSha256": null,
-    "version": "3.6.0"
+    "version": "3.7.0"
  },
  "azurestack": {
    "owner": "hashicorp",
@ -203,10 +203,10 @@
    "owner": "CheckPointSW",
    "provider-source-address": "registry.terraform.io/CheckPointSW/checkpoint",
    "repo": "terraform-provider-checkpoint",
-    "rev": "v1.7.0",
-    "sha256": "1msd3qjrrhl0v3m7n9ybkwxki5wpchzjswd2dcifbif4k8pcs470",
-    "vendorSha256": "0yaxgyzwja5dl4p7w8q77ash75xwsf05kq88nvmdf94lvspfnwlq",
-    "version": "1.7.0"
+    "rev": "v1.8.0",
+    "sha256": "sha256-+lcJr7C7FsvSzkfFwEfTrJedx6vMvOrTjNA+JTWBI4c=",
+    "vendorSha256": "sha256-mHLrrt6UJNfqtgjhWYDTvJcDtToHI34uoa0oyb9/XXk=",
+    "version": "1.8.0"
  },
  "ciscoasa": {
    "owner": "CiscoDevNet",
@ -230,10 +230,10 @@
    "owner": "cloudflare",
    "provider-source-address": "registry.terraform.io/cloudflare/cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v3.14.0",
-    "sha256": "sha256-WjtAqL4gzr7NdRLf7mr6OULee35kyyZpr5crR514Mak=",
-    "vendorSha256": "sha256-xqjhSu1bUSpQ1A2Ga2IS2fdyIXcnt/nbQNXhcxVi22Q=",
-    "version": "3.14.0"
+    "rev": "v3.15.0",
+    "sha256": "sha256-y1UbirPJG9Behsr/VdILoVHIM2z9pF6iyEwXgDKbDaw=",
+    "vendorSha256": "sha256-R8B5fmjRBB2q12tzWbzOzzSOC0mNJNV1JiVjddDa11c=",
+    "version": "3.15.0"
  },
  "cloudfoundry": {
    "owner": "cloudfoundry-community",
@ -257,10 +257,10 @@
    "owner": "cloudscale-ch",
    "provider-source-address": "registry.terraform.io/cloudscale-ch/cloudscale",
    "repo": "terraform-provider-cloudscale",
-    "rev": "v3.2.0",
-    "sha256": "1bczibhv2jr2h5mrqs41s6dlsi7i2pbrlbxv4m49q2xlq9lza4yk",
+    "rev": "v4.0.0",
+    "sha256": "sha256-Eo7zT/KiJdzo7fhAcCg6EV29ENM/XSBumAHmL9J8agU=",
    "vendorSha256": null,
-    "version": "3.2.0"
+    "version": "4.0.0"
  },
  "constellix": {
    "deleteVendor": true,
@ -429,10 +429,10 @@
    "owner": "integrations",
    "provider-source-address": "registry.terraform.io/integrations/github",
    "repo": "terraform-provider-github",
-    "rev": "v4.24.1",
-    "sha256": "sha256-1fwHMN2HIVl+8ZL7OtP1U5ORc41e7Tm3qEpMqIgWL20=",
+    "rev": "v4.25.0",
+    "sha256": "sha256-9sZYg/gpCq2qpUhhFQjLVZLlNnYWaCz5K4/+TvCD/qk=",
    "vendorSha256": null,
-    "version": "4.24.1"
+    "version": "4.25.0"
  },
  "gitlab": {
    "owner": "gitlabhq",
@ -448,20 +448,20 @@
    "provider-source-address": "registry.terraform.io/hashicorp/google",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.20.0",
-    "sha256": "sha256-eZNa6V3aVtEgTZgTNgB4EUK3S6iKfk9qI7OnAQ5Mbp4=",
-    "vendorSha256": "sha256-l2OviwplP/Sg2ShaEA88pMwVTkREnLkFAzterjr2kvU=",
-    "version": "4.20.0"
+    "rev": "v4.21.0",
+    "sha256": "sha256-xintCclIhM2FqmbYoWTPGq/twkUH3M2ebc/b0SZ/hXY=",
+    "vendorSha256": "sha256-B3JiVeCzeCtsAvQiHayZY3pahN4bwizE6d99Qw2VYK8=",
+    "version": "4.21.0"
  },
  "google-beta": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.20.0",
-    "sha256": "sha256-Dr3G7KskfL+4WNOPL3SZCKf+Lo6wP3XS1JrlC6Mv3O8=",
-    "vendorSha256": "sha256-l2OviwplP/Sg2ShaEA88pMwVTkREnLkFAzterjr2kvU=",
-    "version": "4.20.0"
+    "rev": "v4.21.0",
+    "sha256": "sha256-3oViGAFwUTBC4tMUlnjUDHdmk+sxtCeVZNbYGGwHhwU=",
+    "vendorSha256": "sha256-B3JiVeCzeCtsAvQiHayZY3pahN4bwizE6d99Qw2VYK8=",
+    "version": "4.21.0"
  },
  "googleworkspace": {
    "owner": "hashicorp",
@ -566,10 +566,10 @@
    "owner": "IBM-Cloud",
    "provider-source-address": "registry.terraform.io/IBM-Cloud/ibm",
    "repo": "terraform-provider-ibm",
-    "rev": "v1.41.0",
-    "sha256": "sha256-5kHoTmQlEzTSjDnAJPdEN2y+DF9gB2BHJFHEYLh6h48=",
+    "rev": "v1.41.1",
+    "sha256": "sha256-eTwv7dtuFe7oEFFqnmpJMN2d/P5ow8HH1rXCE6xBEi4=",
    "vendorSha256": "sha256-8s32A0qgODZZy3rSrHnnBkQyKLBj0fcCBJ9ja9gXc5Q=",
-    "version": "1.41.0"
+    "version": "1.41.1"
  },
  "icinga2": {
    "owner": "Icinga",
@ -593,10 +593,10 @@
    "owner": "Mongey",
    "provider-source-address": "registry.terraform.io/Mongey/kafka",
    "repo": "terraform-provider-kafka",
-    "rev": "v0.5.0",
-    "sha256": "sha256-1SZkCuAmYlfzYVpS+qrNN+vl3zrFZGUgdrrgKj0VRUE=",
-    "vendorSha256": "sha256-6wccODr/eJUh5eeDGDCuuK2pCFmvPlXWmdAUnjBHJ5E=",
-    "version": "0.5.0"
+    "rev": "v0.5.1",
+    "sha256": "sha256-bKbY2cOIORy3D9yCBqVuKUZb650sx+87d4wtUB3dPdg=",
+    "vendorSha256": "sha256-03QV6C2DEN5xwMwABwSvv5Ts6pTHQDBP2zUUqIcOtVQ=",
+    "version": "0.5.1"
  },
  "kafka-connect": {
    "owner": "Mongey",
@ -683,10 +683,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/local",
    "repo": "terraform-provider-local",
-    "rev": "v2.2.2",
-    "sha256": "sha256-JpTdRi9EagrnhYnlq6sl6+t4SE6i7T7YrGTsYCDync8=",
-    "vendorSha256": "sha256-Ha/MGbXwwhbVxaHbkU2xBhyNcDxLivk7vYQjfVzWOcY=",
-    "version": "2.2.2"
+    "rev": "v2.2.3",
+    "sha256": "sha256-l9XQpIMMar7ForZuBcGOmqrRuSnthIrilr4CHJ5SiaU=",
+    "vendorSha256": "sha256-5rqn9/NE7Q0VI6SRd2VFKJl4npz9Y0Qp1pEpfj9KxrQ=",
+    "version": "2.2.3"
  },
  "logicmonitor": {
    "owner": "logicmonitor",
@ -764,10 +764,10 @@
    "owner": "NaverCloudPlatform",
    "provider-source-address": "registry.terraform.io/NaverCloudPlatform/ncloud",
    "repo": "terraform-provider-ncloud",
-    "rev": "v2.2.8",
-    "sha256": "sha256-G12/+tNSMEPCPCJH//MhRKJoRSex3mS7BZt0C2o0pF0=",
-    "vendorSha256": "sha256-ovHg4GcbMzjEi+qJBpdqhR0YUakZCdnpc10SCu8FP8I=",
-    "version": "2.2.8"
+    "rev": "v2.2.9",
+    "sha256": "sha256-D9B3IJZZOCR/kzFee3sBPEbDcAL33kIef/NAYDuJv7U=",
+    "vendorSha256": "sha256-DPK/RF63rz5AQY/LybT8I6z6vSvqrFqypslhquRrgfg=",
+    "version": "2.2.9"
  },
  "netlify": {
    "owner": "AegirHealth",
@ -837,19 +837,19 @@
    "owner": "oracle",
    "provider-source-address": "registry.terraform.io/oracle/oci",
    "repo": "terraform-provider-oci",
-    "rev": "v4.75.0",
-    "sha256": "sha256-tcDo7yvlobHf4+0BuPdifrkA8UPhI0txRCBgToTjIcw=",
+    "rev": "v4.76.0",
+    "sha256": "sha256-sJ837jK/iYOC3dPFHoix1fiiSFMCNSqYEus9VlhXqMg=",
    "vendorSha256": null,
-    "version": "4.75.0"
+    "version": "4.76.0"
  },
  "okta": {
    "owner": "okta",
    "provider-source-address": "registry.terraform.io/okta/okta",
    "repo": "terraform-provider-okta",
-    "rev": "v3.26.0",
-    "sha256": "sha256-Mnc3JZtKNOB9VpsjXq8WiZz0+zmTmFRfOY23F186tw4=",
-    "vendorSha256": "sha256-LHiOQNFkMajqytrv387yIhAyCQCaG2Kw5OCI8Xe7u2k=",
-    "version": "3.26.0"
+    "rev": "v3.27.0",
+    "sha256": "sha256-DDNq4Yvx45ynNePg8bW8tQ6LuyvUfudxY+M88+pIXMQ=",
+    "vendorSha256": "sha256-but/2CF3OW2aefUIy5XnDvhtXYqfCkHIrS1EDQoD9jM=",
+    "version": "3.27.0"
  },
  "oktaasa": {
    "owner": "oktadeveloper",
@ -891,10 +891,10 @@
    "owner": "opentelekomcloud",
    "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.29.2",
-    "sha256": "sha256-V5EGRd5/JmCDaF1fQkpwHA4DNVFKwvGnMR/AyKvgLtk=",
+    "rev": "v1.29.3",
+    "sha256": "sha256-rFaryW9yibw5whTYOb7kDF45l5NI9bdZvVQezIqudE8=",
    "vendorSha256": "sha256-FOcddb1+uG5avqYZMvzR1UXDvtDDwtxBzf7FsN6ZROM=",
-    "version": "1.29.2"
+    "version": "1.29.3"
  },
  "opsgenie": {
    "owner": "opsgenie",
@ -927,10 +927,10 @@
    "owner": "PagerDuty",
    "provider-source-address": "registry.terraform.io/PagerDuty/pagerduty",
    "repo": "terraform-provider-pagerduty",
-    "rev": "v2.4.1",
-    "sha256": "sha256-2Ot6TxWN+t33EfT5wmkkPjj9DUrPum9whl5wimgjAp0=",
+    "rev": "v2.4.2",
+    "sha256": "sha256-xCmfykHQvQ/O+8ZGe2s5Ic4n9aZvlQ34bpnVbJDCn98=",
    "vendorSha256": null,
-    "version": "2.4.1"
+    "version": "2.4.2"
  },
  "panos": {
    "owner": "PaloAltoNetworks",
@ -990,10 +990,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/random",
    "repo": "terraform-provider-random",
-    "rev": "v3.1.3",
-    "sha256": "sha256-q4j3DXbLiVeSyWGywwLiJspmE08ip3zL8vabfVDWnUo=",
-    "vendorSha256": "sha256-sg89QS0ncCrBGoLvsWFlyCYwNZHNG6iadNJIHWRmhXE=",
-    "version": "3.1.3"
+    "rev": "v3.2.0",
+    "sha256": "sha256-acB1BHGxquiK137OfTe31pUGHdWp7xxlv5BINNzNLSs=",
+    "vendorSha256": "sha256-MMUit5RxsymBNX9fH8B6D2gJ/k5zaN6FCyP9N/+TV+E=",
+    "version": "3.2.0"
  },
  "rundeck": {
    "owner": "rundeck",
@ -1026,10 +1026,10 @@
    "owner": "selectel",
    "provider-source-address": "registry.terraform.io/selectel/selectel",
    "repo": "terraform-provider-selectel",
-    "rev": "v3.8.2",
-    "sha256": "sha256-Lp2ptLuN/+/fcqeSbIMmL4dmOCoplyZeA10wAsCnYlg=",
+    "rev": "v3.8.4",
+    "sha256": "sha256-27Sdez4coJ4Enc1zTg4lr1SzlW3r6wCjciC5ID8vo0w=",
    "vendorSha256": "sha256-kmsO9jFoR/93PkOeIo0pkS/OjE+m3QbIspobAv/9+KI=",
-    "version": "3.8.2"
+    "version": "3.8.4"
  },
  "sentry": {
    "owner": "jianyuan",
@ -1089,10 +1089,10 @@
    "owner": "spotinst",
    "provider-source-address": "registry.terraform.io/spotinst/spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.73.3",
-    "sha256": "sha256-J7hswjjyWOZrsqnhMGAyXnvrVwLRY9jGIdtwN7Dympc=",
-    "vendorSha256": "sha256-szdzI/42RExYQlHnm178RM3wlKOLax+nwgRVzonxXoI=",
-    "version": "1.73.3"
+    "rev": "v1.74.0",
+    "sha256": "sha256-wdhpkQM7J4WO4nN+0R8XfgbuusK0zDzSDy/DyOB8GcI=",
+    "vendorSha256": "sha256-OT5YuAlZNRCvwvZpCrhtKj4YiosEuHrTLQkWFYuKZrw=",
+    "version": "1.74.0"
  },
  "stackpath": {
    "owner": "stackpath",
@ -1116,10 +1116,10 @@
    "owner": "SumoLogic",
    "provider-source-address": "registry.terraform.io/SumoLogic/sumologic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v2.15.0",
-    "sha256": "sha256-VAYU1v5uCIcbeLri6tG5RIAgDP4SzZxQDtK9P5gdSPc=",
+    "rev": "v2.16.0",
+    "sha256": "sha256-27+ofT5p073s2kEk87P/Witw5x9sVKOYrlBXp6/xKxk=",
    "vendorSha256": "sha256-7DGY+L41bJJrtLwdWgu2aMCefgcmtR6tmH12foi68Kc=",
-    "version": "2.15.0"
+    "version": "2.16.0"
  },
  "template": {
    "owner": "hashicorp",
@ -1134,10 +1134,10 @@
    "owner": "tencentcloudstack",
    "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.72.3",
-    "sha256": "sha256-NfrLaKPIAMWeRNVdWEg4wn7pFoLO1Hv3HsxFKkVewPc=",
+    "rev": "v1.72.5",
+    "sha256": "sha256-4ZnhE2Woy+CquDsqJvJMUib48eRJ9OWTrO/14NkI6iM=",
    "vendorSha256": null,
-    "version": "1.72.3"
+    "version": "1.72.5"
  },
  "tfe": {
    "owner": "hashicorp",
@ -1170,10 +1170,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/tls",
    "repo": "terraform-provider-tls",
-    "rev": "v3.3.0",
-    "sha256": "sha256-7A9AXZxTIltZdXXIpMpQGYKwgSdU6kRRNuvVaNtMFGw=",
-    "vendorSha256": "sha256-bj2KpPFFnev5DAND9/HyUC4kOORAvnnpSihUECcHB/8=",
-    "version": "3.3.0"
+    "rev": "v3.4.0",
+    "sha256": "sha256-14sKHnmUfDbXceH+bfSPuA1TKo6Q6kkazYwHC15D4vY=",
+    "vendorSha256": "sha256-o7QvF6Z/HCyb/EBr0m90B63AVKqxteQEBXe+OuovnYg=",
+    "version": "3.4.0"
  },
  "triton": {
    "deleteVendor": true,
@ -1207,19 +1207,19 @@
    "owner": "cloudposse",
    "provider-source-address": "registry.terraform.io/cloudposse/utils",
    "repo": "terraform-provider-utils",
-    "rev": "0.17.23",
-    "sha256": "sha256-/m2K91I1BtzfKTO6sbYL6r0N6GGtd4Ux+GSL0Ut4GUg=",
-    "vendorSha256": "sha256-Rmv3B8Sczvohlfwu248a1pi1VmFGNCB77/IFTBKKeiM=",
-    "version": "0.17.23"
+    "rev": "0.17.24",
+    "sha256": "sha256-/pM6PuvFsmRpBz5pqOy6mVlkbq+9IRlHug/DdoKjt4U=",
+    "vendorSha256": "sha256-4/Djmg6cONkJg1wH7M4Y2mZccbwyUXEvZ2bdBYEnV9w=",
+    "version": "0.17.24"
  },
  "vault": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/vault",
    "repo": "terraform-provider-vault",
-    "rev": "v3.5.0",
-    "sha256": "sha256-Ap96unJFTJ8HKcIs3LYSHfTXszh1gAcZSTEWpS2W2AQ=",
-    "vendorSha256": "sha256-UvczG/31YPIxPBZhwoBC3QS+QA8PRtRqgA/0W8tcXD0=",
-    "version": "3.5.0"
+    "rev": "v3.6.0",
+    "sha256": "sha256-eeE6ThAz7RwePS65RZXbz+PUfm/KlE+f+nJWvLTCSmA=",
+    "vendorSha256": "sha256-KSGhIoUKadAuiMQkJEyYCDt7GXZ9deiV14LV4gEOpVg=",
+    "version": "3.6.0"
  },
  "vcd": {
    "owner": "vmware",
@ -1234,10 +1234,10 @@
    "owner": "Venafi",
    "provider-source-address": "registry.terraform.io/Venafi/venafi",
    "repo": "terraform-provider-venafi",
-    "rev": "v0.15.5",
-    "sha256": "sha256-aNh9P7QqhmdywP47mddcGSDRxkwkrus14tku/xrQcz8=",
-    "vendorSha256": "sha256-SKdSjBXLX344zt0GeGBLNp8cFw+PO9ObT9jC+dHp/h8=",
-    "version": "0.15.5"
+    "rev": "v0.16.0",
+    "sha256": "sha256-oGpIa+Up1bv6tf5ibna0DEwIxrZyAefqA8LSAy57QrE=",
+    "vendorSha256": "sha256-F0lMZVMNJ/1SHX8e5v4waQPqZjan/Ll+db+dseZ+dsc=",
+    "version": "0.16.0"
  },
  "vercel": {
    "owner": "ondrejsika",
@ -1261,10 +1261,10 @@
    "owner": "vmware",
    "provider-source-address": "registry.terraform.io/vmware/vra7",
    "repo": "terraform-provider-vra7",
-    "rev": "v3.0.4",
-    "sha256": "1w16cl27fqpzy1v6cdp61shgrmj787fdfjwhr719n57hqax4pck5",
+    "rev": "v3.0.5",
+    "sha256": "sha256-4YhaABbuG4GhWYEiGrUvf4H/8dd7wWHY08CkTWCqgr8=",
    "vendorSha256": null,
-    "version": "3.0.4"
+    "version": "3.0.5"
  },
  "vsphere": {
    "owner": "hashicorp",
@ -1279,10 +1279,10 @@
    "owner": "vultr",
    "provider-source-address": "registry.terraform.io/vultr/vultr",
    "repo": "terraform-provider-vultr",
-    "rev": "v2.11.0",
-    "sha256": "sha256-5TtrjWQ6AXYCjOi6Qe3oJVp011s87XyU2CYnXb7hFII=",
+    "rev": "v2.11.1",
+    "sha256": "sha256-EAkFlmQFPq9pSQ591GkX7um8tcBEGIJuiLuL5d9A8Ag=",
    "vendorSha256": null,
-    "version": "2.11.0"
+    "version": "2.11.1"
  },
  "wavefront": {
    "owner": "vmware",
--- a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
@ -5,13 +5,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "deltachat-cursed";
-  version = "0.3.1";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "adbenitez";
    repo = "deltachat-cursed";
    rev = "v${version}";
-    hash = "sha256-IZrTPnj6eX1qgEPnEiD9qmVkwn1SMK38gVKAJFgZNfw=";
+    hash = "sha256-li6HsatiRJPVKKBBHyWhq2b8HhvDrOUiVT2tSupjuag=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/syncplay/default.nix
+++ b/pkgs/applications/networking/syncplay/default.nix
@ -14,7 +14,7 @@ buildPythonApplication rec {
  };

  propagatedBuildInputs = [ twisted certifi ]
-    ++ twisted.extras-require.tls
+    ++ twisted.optional-dependencies.tls
    ++ lib.optional enableGUI pyside2;
  nativeBuildInputs = lib.optionals enableGUI [ qt5.wrapQtAppsHook ];

--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@ -122,7 +122,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec {
    threadpoolctl
    tika
    tqdm
-    twisted.extras-require.tls
+    twisted.optional-dependencies.tls
    txaio
    tzlocal
    urllib3
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@ -16,12 +16,12 @@ with lib;

 buildGoPackage rec {
  pname = "gitea";
-  version = "1.16.7";
+  version = "1.16.8";

  # not fetching directly from the git repo, because that lacks several vendor files for the web UI
  src = fetchurl {
    url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "sha256-UVmbFtHC4W3WF+DptdHMMUoe8UE5TVgoM9QRuczSrEg=";
+    sha256 = "sha256-W/AbRfnEQfnTjXJ8wTKEFOTld4rFsBvJiXnYK8Ugoj0=";
  };

  unpackPhase = ''
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@ -1,6 +1,5 @@
 { stdenv
 , lib
-, darwin
 , makeSetupHook
 , dieHook
 , writeShellScript
@ -12,7 +11,7 @@
 makeSetupHook {
  deps = [ dieHook ]
    # https://github.com/NixOS/nixpkgs/issues/148189
-    ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) darwin.cctools;
+    ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) cc;

  substitutions = {
    cc = "${cc}/bin/cc ${lib.escapeShellArgs (map (s: "-fsanitize=${s}") sanitizers)}";
--- a/pkgs/development/compilers/crystal/build-package.nix
+++ b/pkgs/development/compilers/crystal/build-package.nix
@ -24,6 +24,7 @@
  # Specify binaries to build in the form { foo.src = "src/foo.cr"; }
  # The default `crystal build` options can be overridden with { foo.options = [ "--optionname" ]; }
 , crystalBinaries ? { }
+, enableParallelBuilding ? true
 , ...
 }@args:

@ -51,6 +52,20 @@ let

  buildDirectly = shardsFile == null || crystalBinaries != { };

+  mkCrystalBuildArgs = bin: attrs:
+    lib.concatStringsSep " " ([
+      "crystal"
+      "build"
+    ] ++ lib.optionals enableParallelBuilding [
+      "--threads"
+      "$NIX_BUILD_CORES"
+    ] ++ [
+      "-o"
+      bin
+      (attrs.src or (throw "No source file for crystal binary ${bin} provided"))
+      (lib.concatStringsSep " " (attrs.options or defaultOptions))
+    ]);
+
 in
 stdenv.mkDerivation (mkDerivationArgs // {

@ -72,6 +87,7 @@ stdenv.mkDerivation (mkDerivationArgs // {

  PREFIX = placeholder "out";

+  inherit enableParallelBuilding;
  strictDeps = true;
  buildInputs = args.buildInputs or [ ] ++ [ crystal ];

@ -88,16 +104,7 @@ stdenv.mkDerivation (mkDerivationArgs // {
    "runHook preBuild"
  ] ++ lib.optional (format == "make")
    "make \${buildTargets:-build} $makeFlags"
-  ++ lib.optionals (format == "crystal") (lib.mapAttrsToList
-    (bin: attrs: ''
-      crystal ${lib.escapeShellArgs ([
-        "build"
-        "-o"
-        bin
-        (attrs.src or (throw "No source file for crystal binary ${bin} provided"))
-      ] ++ (attrs.options or defaultOptions))}
-    '')
-    crystalBinaries)
+  ++ lib.optionals (format == "crystal") (lib.mapAttrsToList mkCrystalBuildArgs crystalBinaries)
  ++ lib.optional (format == "shards")
    "shards build --local --production ${lib.concatStringsSep " " (args.options or defaultOptions)}"
  ++ [ "runHook postBuild" ]));
--- a/pkgs/development/compilers/miranda/default.nix
+++ b/pkgs/development/compilers/miranda/default.nix
@ -52,6 +52,11 @@ stdenv.mkDerivation rec {
    })
  ];

+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: types.o:(.bss+0x11b0): multiple definition of `current_file'; y.tab.o:(.bss+0x70): first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
  makeFlags = [
    "CC=${stdenv.cc.targetPrefix}cc"
    "CFLAGS=-O2"
--- a/pkgs/development/embedded/platformio/core.nix
+++ b/pkgs/development/embedded/platformio/core.nix
@ -9,32 +9,13 @@
 let
  python = python3.override {
    packageOverrides = self: super: {
-      semantic-version = super.semantic-version.overridePythonAttrs (oldAttrs: rec {
-        version = "2.9.0";
-        src = fetchPypi {
-          pname = "semantic_version";
-          version = version;
-          sha256 = "1chjd8019wnwb5mnd4x4jw9f8nhzg0xnapsdznk0fpiyamrlixdb";
-        };
-      });
-
      starlette = super.starlette.overridePythonAttrs (oldAttrs: rec {
-        version = "0.18.0";
+        version = "0.20.0";
        src = fetchFromGitHub {
          owner = "encode";
          repo = "starlette";
          rev = version;
-          sha256 = "1dpj33cggjjvpd3qdf6hv04z5ckcn9f5dfn98p5a8hx262kgsr9p";
-        };
-      });
-
-      uvicorn = super.uvicorn.overridePythonAttrs (oldAttrs: rec {
-        version = "0.17.0";
-        src = fetchFromGitHub {
-          owner = "encode";
-          repo = "uvicorn";
-          rev = version;
-          sha256 = "142x8skb1yfys6gndfaay2r240j56dkr006p49pw4y9i0v85kynp";
+          sha256 = "sha256-bSgPjKqM262PSufz1LHwrdM+uU8xO55Mifv66HRN02Y=";
        };
      });
    };
@ -75,6 +56,8 @@ with python.pkgs; buildPythonApplication rec {
  ];

  pytestFlagsArray = (map (e: "--deselect tests/${e}") [
+    "commands/pkg/test_exec.py::test_pkg_specified"
+    "commands/pkg/test_exec.py::test_unrecognized_options"
    "commands/test_ci.py::test_ci_boards"
    "commands/test_ci.py::test_ci_build_dir"
    "commands/test_ci.py::test_ci_keep_build_dir"
@ -84,6 +67,7 @@ with python.pkgs; buildPythonApplication rec {
    "commands/test_init.py::test_init_duplicated_boards"
    "commands/test_init.py::test_init_enable_auto_uploading"
    "commands/test_init.py::test_init_ide_atom"
+    "commands/test_init.py::test_init_ide_clion"
    "commands/test_init.py::test_init_ide_eclipse"
    "commands/test_init.py::test_init_ide_vscode"
    "commands/test_init.py::test_init_incorrect_board"
@ -112,9 +96,6 @@ with python.pkgs; buildPythonApplication rec {
    "commands/test_lib_complex.py::test_lib_show"
    "commands/test_lib_complex.py::test_lib_stats"
    "commands/test_lib_complex.py::test_search"
-    "commands/test_test.py::test_local_env"
-    "commands/test_test.py::test_multiple_env_build"
-    "commands/test_test.py::test_setup_teardown_are_compilable"
    "package/test_manager.py::test_download"
    "package/test_manager.py::test_install_force"
    "package/test_manager.py::test_install_from_registry"
@ -132,12 +113,21 @@ with python.pkgs; buildPythonApplication rec {
    "test_misc.py::test_platformio_cli"
    "test_pkgmanifest.py::test_packages"
  ]) ++ (map (e: "--ignore=tests/${e}") [
+    "commands/pkg/test_install.py"
+    "commands/pkg/test_list.py"
+    "commands/pkg/test_outdated.py"
+    "commands/pkg/test_search.py"
+    "commands/pkg/test_show.py"
+    "commands/pkg/test_uninstall.py"
+    "commands/pkg/test_update.py"
    "commands/test_boards.py"
    "commands/test_check.py"
    "commands/test_platform.py"
+    "commands/test_run.py"
+    "commands/test_test.py"
    "commands/test_update.py"
-    "test_maintenance.py"
    "test_ino2cpp.py"
+    "test_maintenance.py"
  ]) ++ [
    "tests"
  ];
--- a/pkgs/development/embedded/platformio/default.nix
+++ b/pkgs/development/embedded/platformio/default.nix
@ -4,14 +4,14 @@
 let
  callPackage = newScope self;

-  version = "5.2.5";
+  version = "6.0.1";

  # pypi tarballs don't contain tests - https://github.com/platformio/platformio-core/issues/1964
  src = fetchFromGitHub {
    owner = "platformio";
    repo = "platformio-core";
    rev = "v${version}";
-    sha256 = "1x1jqprwzpb09ca953rqbh2jvizh7bz8yj30krphb6007bnjilwy";
+    sha256 = "sha256-noLdQctAaMNmfuxI3iybHFx3Q9aTr3gZaUZ+/uO+fnA=";
  };

  self = {
--- a/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
+++ b/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
@ -6,7 +6,7 @@ index 416dccfd..896c3649 100644
     @staticmethod
     @memoized(expire="1h")
     def load_spdx_licenses():
-        version = "3.16"
+-        version = "3.17"
 -        spdx_data_url = (
 -            "https://raw.githubusercontent.com/spdx/license-list-data/"
 -            "v%s/json/licenses.json" % version
--- a/pkgs/development/interpreters/falcon/default.nix
+++ b/pkgs/development/interpreters/falcon/default.nix
@ -1,6 +1,6 @@
-{ lib, gccStdenv, fetchFromGitHub, cmake, pkg-config, pcre, zlib, sqlite }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, pcre, zlib, sqlite }:

-gccStdenv.mkDerivation {
+stdenv.mkDerivation {
  pname = "falcon";
  version = "unstable-2018-10-23";

--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@ -1,10 +1,11 @@
 # similar to interpreters/python/default.nix
-{ stdenv, lib, callPackage, fetchurl, fetchpatch }:
+{ stdenv, lib, callPackage, fetchurl, fetchpatch, makeBinaryWrapper }:

 rec {
  lua5_4 = callPackage ./interpreter.nix {
    sourceVersion = { major = "5"; minor = "4"; patch = "3"; };
    hash = "1yxvjvnbg4nyrdv10bq42gz6dr66pyan28lgzfygqfwy2rv24qgq";
+    makeWrapper = makeBinaryWrapper;

    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch;
  };
@ -16,6 +17,7 @@ rec {
  lua5_3 = callPackage ./interpreter.nix {
    sourceVersion = { major = "5"; minor = "3"; patch = "6"; };
    hash = "0q3d8qhd7p0b7a4mh9g7fxqksqfs6mr1nav74vq26qvkp2dxcpzw";
+    makeWrapper = makeBinaryWrapper;

    patches =
      lib.optionals stdenv.isDarwin [ ./5.2.darwin.patch ];
@ -29,6 +31,7 @@ rec {
  lua5_2 = callPackage ./interpreter.nix {
    sourceVersion = { major = "5"; minor = "2"; patch = "4"; };
    hash = "0jwznq0l8qg9wh5grwg07b5cy3lzngvl5m2nl1ikp6vqssmf9qmr";
+    makeWrapper = makeBinaryWrapper;
    patches = lib.optional stdenv.isDarwin ./5.2.darwin.patch;
  };

@ -40,6 +43,7 @@ rec {
  lua5_1 = callPackage ./interpreter.nix {
    sourceVersion = { major = "5"; minor = "1"; patch = "5"; };
    hash = "2640fc56a795f29d28ef15e13c34a47e223960b0240e8cb0a82d9b0738695333";
+    makeWrapper = makeBinaryWrapper;
    patches = (lib.optional stdenv.isDarwin ./5.1.darwin.patch)
      ++ [ ./CVE-2014-5461.patch ];
  };
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@ -126,6 +126,7 @@ self = stdenv.mkDerivation rec {
  passthru = rec {
    buildEnv = callPackage ./wrapper.nix {
      lua = self;
+      inherit makeWrapper;
      inherit (luaPackages) requiredLuaModules;
    };
    withPackages = import ./with-packages.nix { inherit buildEnv luaPackages;};
--- a/pkgs/development/libraries/gecode/default.nix
+++ b/pkgs/development/libraries/gecode/default.nix
@ -1,4 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, bison, flex, perl, gmp, mpfr, enableGist ? true, qtbase }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, bison
+, flex
+, perl
+, gmp
+, mpfr
+, qtbase
+, enableGist ? true
+}:

 stdenv.mkDerivation rec {
  pname = "gecode";
@ -11,6 +22,15 @@ stdenv.mkDerivation rec {
    sha256 = "0b1cq0c810j1xr2x9y9996p894571sdxng5h74py17c6nr8c6dmk";
  };

+  patches = [
+    # https://github.com/Gecode/gecode/pull/74
+    (fetchpatch {
+      name = "fix-const-weights-clang.patch";
+      url = "https://github.com/Gecode/gecode/commit/c810c96b1ce5d3692e93439f76c4fa7d3daf9fbb.patch";
+      sha256 = "0270msm22q5g5sqbdh8kmrihlxnnxqrxszk9a49hdxd72736p4fc";
+    })
+  ];
+
  enableParallelBuilding = true;
  dontWrapQtApps = true;
  nativeBuildInputs = [ bison flex ];
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -5,6 +5,7 @@
 , llvmPackages, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
 , libglvnd, libunwind
+, vulkan-loader
 , galliumDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
@ -144,7 +145,9 @@ self = stdenv.mkDerivation {
    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal ]
    ++ lib.optionals stdenv.isDarwin [ libunwind ]
    ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped ]
-    ++ lib.optional withValgrind valgrind-light;
+    ++ lib.optional withValgrind valgrind-light
+    # Mesa will not build zink when gallium-drivers=auto
+    ++ lib.optional (elem "zink" galliumDrivers) vulkan-loader;

  depsBuildBuild = [ pkg-config ];

--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@ -68,6 +68,9 @@ stdenv.mkDerivation rec {
    # contrib modules require these
    "moduledir=${placeholder "out"}/lib/modules"
    "mandir=${placeholder "out"}/share/man"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    # Can be unconditional, doing it like this to prevent a mass rebuild.
+    "STRIP_OPTS="
  ];

  extraContribModules = [
--- a/pkgs/development/libraries/pe-parse/default.nix
+++ b/pkgs/development/libraries/pe-parse/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake }:
+{ stdenv, lib, fetchFromGitHub, cmake, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "pe-parse";
@ -11,10 +11,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-HwWlMRhpB/sa/JRyAZF7LZzkXCCyuxB+gtDAfHt7e6k=";
  };

-  nativeBuildInputs = [ cmake ];
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/trailofbits/pe-parse/commit/eecdb3d36eb44e306398a2e66e85490f9bdcc74c.patch";
+      hash = "sha256-pd6D/JMctiQqJxnJU9Nm/GDVf4/CaIGeXx1UfdcCupo=";
+    })
+  ];

-  # See https://github.com/trailofbits/pe-parse/issues/169
-  NIX_CFLAGS_COMPILE = "-Wno-sign-conversion";
+  nativeBuildInputs = [ cmake ];

  doInstallCheck = true;
  installCheckPhase = ''
--- a/pkgs/development/ocaml-modules/faraday/default.nix
+++ b/pkgs/development/ocaml-modules/faraday/default.nix
@ -2,7 +2,7 @@

 buildDunePackage rec {
  pname = "faraday";
-  version = "0.7.2";
+  version = "0.8.1";

  useDune2 = true;

@ -12,7 +12,7 @@ buildDunePackage rec {
    owner = "inhabitedtype";
    repo = pname;
    rev = version;
-    sha256 = "0gdysszzk6b6npic4nhpdnz2nbq7rma6aml0rbn113bfh0rmb36x";
+    sha256 = "sha256-eeR+nst/r2iFxCDmRS+LGr3yl/o27DcsS30YAu1GJmc=";
  };

  checkInputs = [ alcotest ];
--- a/pkgs/development/ocaml-modules/hacl_x25519/default.nix
+++ b/pkgs/development/ocaml-modules/hacl_x25519/default.nix
@ -3,11 +3,11 @@

 buildDunePackage rec {
  pname = "hacl_x25519";
-  version = "0.2.0";
+  version = "0.2.2";

  src = fetchurl {
    url = "https://github.com/mirage/hacl/releases/download/v${version}/${pname}-v${version}.tbz";
-    sha256 = "0ppq56i2yhxzz38w120aynnkx10kncl86zvqip9zx0v4974k3k4x";
+    sha256 = "sha256-gWdUqOj5c50ObZjO1uULAmoo1ZIyRFxQUaZuQzLMVy0=";
  };

  useDune2 = true;
--- a/pkgs/development/php-packages/grpc/default.nix
+++ b/pkgs/development/php-packages/grpc/default.nix
@ -0,0 +1,20 @@
+{ buildPecl, zlib, lib }:
+
+buildPecl {
+  pname = "grpc";
+
+  version = "1.45.0";
+  sha256 = "sha256-SPnECBZ80sXfXYiVJjGfOsSxZBBZnasO9pPu9Q5klIg";
+
+  doCheck = true;
+  checkTarget = "test";
+
+  nativeBuildInputs = [ zlib ];
+
+  meta = with lib; {
+    description = "A high performance, open source, general RPC framework that puts mobile and HTTP/2 first.";
+    license = licenses.asl20;
+    homepage = "https://github.com/grpc/grpc/tree/master/src/php/ext/grpc";
+    maintainers = teams.php.members;
+  };
+}
--- a/pkgs/development/python-modules/Mako/default.nix
+++ b/pkgs/development/python-modules/Mako/default.nix
@ -30,7 +30,7 @@ buildPythonPackage rec {
    markupsafe
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    babel = [
      babel
    ];
@ -39,7 +39,7 @@ buildPythonPackage rec {
  checkInputs = [
    pytestCheckHook
    mock
-  ] ++ passthru.extras-require.babel;
+  ] ++ passthru.optional-dependencies.babel;

  disabledTests = lib.optionals isPyPy [
    # https://github.com/sqlalchemy/mako/issues/315
--- a/pkgs/development/python-modules/adb-shell/default.nix
+++ b/pkgs/development/python-modules/adb-shell/default.nix
@ -33,7 +33,7 @@ buildPythonPackage rec {
    rsa
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    async = [
      aiofiles
    ];
@ -47,8 +47,8 @@ buildPythonPackage rec {
    pycryptodome
    pytestCheckHook
  ]
-  ++ passthru.extras-require.async
-  ++ passthru.extras-require.usb;
+  ++ passthru.optional-dependencies.async
+  ++ passthru.optional-dependencies.usb;

  disabledTests = lib.optionals (pythonAtLeast "3.10") [
    # Tests are failing with Python 3.10
--- a/pkgs/development/python-modules/airtouch4pyapi/default.nix
+++ b/pkgs/development/python-modules/airtouch4pyapi/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , numpy
 , pythonOlder
 }:
@ -20,6 +21,14 @@ buildPythonPackage rec {
    sha256 = "17c7fm72p085pg9msvsfdggbskvm12a6jlb5bw1cndrqsqcrxywx";
  };

+  patches = [
+    # https://github.com/LonePurpleWolf/airtouch4pyapi/pull/10
+    (fetchpatch {
+      url = "https://github.com/LonePurpleWolf/airtouch4pyapi/commit/5b5d91fad63495c83422e7a850897946ac95b25d.patch";
+      hash = "sha256-tVlCLXuOJSqjbs0jj0iHCIXWZE8wmMV3ChzmE6uq3SM=";
+    })
+  ];
+
  propagatedBuildInputs = [
    numpy
  ];
--- a/pkgs/development/python-modules/androidtv/default.nix
+++ b/pkgs/development/python-modules/androidtv/default.nix
@ -28,19 +28,19 @@ buildPythonPackage rec {
    pure-python-adb
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    async = [
      aiofiles
    ];
-    inherit (adb-shell.extras-require) usb;
+    inherit (adb-shell.optional-dependencies) usb;
  };

  checkInputs = [
    mock
    pytestCheckHook
  ]
-  ++ passthru.extras-require.async
-  ++ passthru.extras-require.usb;
+  ++ passthru.optional-dependencies.async
+  ++ passthru.optional-dependencies.usb;

  disabledTests = [
    # Requires git but fails anyway
--- a/pkgs/development/python-modules/autobahn/default.nix
+++ b/pkgs/development/python-modules/autobahn/default.nix
@ -68,8 +68,8 @@ buildPythonPackage rec {
    mock
    pytest-asyncio
    pytestCheckHook
-  ] ++ passthru.extras-require.scram
-  ++ passthru.extras-require.serialization;
+  ] ++ passthru.optional-dependencies.scram
+  ++ passthru.optional-dependencies.serialization;

  postPatch = ''
    substituteInPlace setup.py \
@ -89,7 +89,7 @@ buildPythonPackage rec {
    "autobahn"
  ];

-  passthru.extras-require = rec {
+  passthru.optional-dependencies = rec {
    all = accelerate ++ compress ++ encryption ++ nvx ++ serialization ++ scram ++ twisted ++ ui ++ xbr;
    accelerate = [ /* wsaccel */ ];
    compress = [ python-snappy ];
--- a/pkgs/development/python-modules/beautifultable/default.nix
+++ b/pkgs/development/python-modules/beautifultable/default.nix
@ -3,17 +3,21 @@
 , fetchFromGitHub
 , wcwidth
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "beautifultable";
-  version = "1.0.1";
+  version = "1.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "pri22296";
    repo = pname;
    rev = "v${version}";
-    sha256 = "12ci6jy8qmbphsvzvj98466nlhclfzs0a0pmbsv3mf5bfcdwvbh7";
+    hash = "sha256-/SReCEvSwiNjBoz/3tGJ9zUNBAag4mLsHlUXwm47zCw=";
  };

  propagatedBuildInputs = [
@ -24,9 +28,13 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pytestFlagsArray = [ "test.py" ];
+  pytestFlagsArray = [
+    "test.py"
+  ];

-  pythonImportsCheck = [ "beautifultable" ];
+  pythonImportsCheck = [
+    "beautifultable"
+  ];

  meta = with lib; {
    description = "Python package for printing visually appealing tables";
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@ -54,7 +54,7 @@ let
      pyyaml
    ]
      # tls
-      ++ twisted.extras-require.tls;
+      ++ twisted.optional-dependencies.tls;

    checkInputs = [
      treq
--- a/pkgs/development/python-modules/clize/default.nix
+++ b/pkgs/development/python-modules/clize/default.nix
@ -40,7 +40,7 @@ buildPythonPackage rec {
    six
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    datetime = [
      python-dateutil
    ];
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@ -98,7 +98,7 @@ buildPythonPackage rec {
    "dask.diagnostics"
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    complete = [ distributed ];
  };

--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@ -46,7 +46,7 @@ buildPythonPackage rec {
    param
    pyct
    scipy
-  ] ++ dask.extras-require.complete;
+  ] ++ dask.optional-dependencies.complete;

  checkInputs = [
    pytestCheckHook
--- a/pkgs/development/python-modules/django_modelcluster/default.nix
+++ b/pkgs/development/python-modules/django_modelcluster/default.nix
@ -27,11 +27,11 @@ buildPythonPackage rec {
    pytz
  ];

-  passthru.extras-require.taggit = [
+  passthru.optional-dependencies.taggit = [
    django-taggit
  ];

-  checkInputs = passthru.extras-require.taggit;
+  checkInputs = passthru.optional-dependencies.taggit;

  checkPhase = ''
    runHook preCheck
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@ -49,7 +49,7 @@ buildPythonPackage rec {
    pytest-asyncio
    sqlalchemy
    trio
-  ] ++ passlib.extras-require.bcrypt;
+  ] ++ passlib.optional-dependencies.bcrypt;

  patches = [
    # Bump starlette, https://github.com/tiangolo/fastapi/pull/4483
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@ -63,7 +63,7 @@ buildPythonPackage rec {
    passlib
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    babel = [
      babel
      flask-babel
@ -95,10 +95,10 @@ buildPythonPackage rec {
    pytestCheckHook
    zxcvbn
  ]
-  ++ passthru.extras-require.babel
-  ++ passthru.extras-require.common
-  ++ passthru.extras-require.fsqla
-  ++ passthru.extras-require.mfa;
+  ++ passthru.optional-dependencies.babel
+  ++ passthru.optional-dependencies.common
+  ++ passthru.optional-dependencies.fsqla
+  ++ passthru.optional-dependencies.mfa;


  pythonImportsCheck = [ "flask_security" ];
--- a/pkgs/development/python-modules/httpcore/default.nix
+++ b/pkgs/development/python-modules/httpcore/default.nix
@ -42,7 +42,7 @@ buildPythonPackage rec {
    sniffio
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    http2 = [ h2 ];
    socks = [ socksio ];
  };
@ -56,8 +56,8 @@ buildPythonPackage rec {
    trio
    trustme
    uvicorn
-  ] ++ passthru.extras-require.http2
-    ++ passthru.extras-require.socks;
+  ] ++ passthru.optional-dependencies.http2
+    ++ passthru.optional-dependencies.socks;

  pythonImportsCheck = [ "httpcore" ];

--- a/pkgs/development/python-modules/httpx-socks/default.nix
+++ b/pkgs/development/python-modules/httpx-socks/default.nix
@ -38,7 +38,7 @@ buildPythonPackage rec {
    python-socks
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    asyncio = [ async-timeout ];
    trio = [ trio ];
  };
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@ -49,7 +49,7 @@ buildPythonPackage rec {
    async_generator
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    http2 = [ h2 ];
    socks = [ socksio ];
    brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
@ -63,9 +63,9 @@ buildPythonPackage rec {
    trustme
    typing-extensions
    uvicorn
-  ] ++ passthru.extras-require.http2
-    ++ passthru.extras-require.brotli
-    ++ passthru.extras-require.socks;
+  ] ++ passthru.optional-dependencies.http2
+    ++ passthru.optional-dependencies.brotli
+    ++ passthru.optional-dependencies.socks;

  postPatch = ''
    substituteInPlace setup.py \
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@ -99,7 +99,7 @@ buildPythonPackage rec {
    pytest-mock
    pytest-randomly
    pytest-xdist
-  ] ++ lib.concatMap (name: passthru.extras-require.${name}) testBackends;
+  ] ++ lib.concatMap (name: passthru.optional-dependencies.${name}) testBackends;

  preBuild = ''
    # setup.py exists only for developer convenience and is automatically generated
@ -139,7 +139,7 @@ buildPythonPackage rec {
  ] ++ map (backend: "ibis.backends.${backend}") testBackends;

  passthru = {
-    extras-require = {
+    optional-dependencies = {
      clickhouse = [ clickhouse-cityhash clickhouse-driver lz4 ];
      dask = [ dask pyarrow ];
      datafusion = [ datafusion ];
--- a/pkgs/development/python-modules/ldaptor/default.nix
+++ b/pkgs/development/python-modules/ldaptor/default.nix
@ -27,7 +27,7 @@ buildPythonPackage rec {
    six
    twisted
    zope_interface
-  ] ++ twisted.extras-require.tls;
+  ] ++ twisted.optional-dependencies.tls;

  checkInputs = [
    twisted
--- a/pkgs/development/python-modules/lektor/default.nix
+++ b/pkgs/development/python-modules/lektor/default.nix
@ -62,7 +62,6 @@ buildPythonPackage rec {
  checkInputs = [
    pytest-click
    pytest-mock
-    pytest-pylint
    pytestCheckHook
  ];

--- a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
@ -25,8 +25,8 @@ buildPythonPackage rec {
    six
    twisted
    autobahn
-  ] ++ autobahn.extras-require.twisted
-  ++ twisted.extras-require.tls;
+  ] ++ autobahn.optional-dependencies.twisted
+  ++ twisted.optional-dependencies.tls;

  checkInputs = [
    treq
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@ -42,8 +42,8 @@ buildPythonPackage rec {
    click
    humanize
    txtorcon
-  ] ++ autobahn.extras-require.twisted
-  ++ twisted.extras-require.tls;
+  ] ++ autobahn.optional-dependencies.twisted
+  ++ twisted.optional-dependencies.tls;

  checkInputs = [
    mock
--- a/pkgs/development/python-modules/pamqp/default.nix
+++ b/pkgs/development/python-modules/pamqp/default.nix
@ -1,28 +1,46 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, mock
-, nose
-, pep8
-, pylint
-, mccabe
+, pythonOlder
+, fetchFromGitHub
+, pytestCheckHook
 }:

 buildPythonPackage rec {
  version = "3.1.0";
  pname = "pamqp";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "e4f0886d72c6166637a5513626148bf5a7e818073a558980e9aaed8b4ccf30da";
+  disabled = pythonOlder "3.7";
+
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "gmr";
+    repo = "pamqp";
+    rev = version;
+    hash = "sha256-qiYfQsyYvG6pyRFDt3pyYKNNWNP88maj+VAeGD68OmY=";
  };

-  buildInputs = [ mock nose pep8 pylint mccabe ];
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pamqp.base"
+    "pamqp.body"
+    "pamqp.commands"
+    "pamqp.common"
+    "pamqp.decode"
+    "pamqp.encode"
+    "pamqp.exceptions"
+    "pamqp.frame"
+    "pamqp.header"
+    "pamqp.heartbeat"
+  ];

  meta = with lib; {
    description = "RabbitMQ Focused AMQP low-level library";
-    homepage = "https://pypi.python.org/pypi/pamqp";
+    homepage = "https://github.com/gmr/pamqp";
    license = licenses.bsd3;
+    maintainers = with maintainers; [ dotlambda ];
  };
-
 }
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@ -16,7 +16,7 @@ buildPythonPackage rec {
    sha256 = "defd50f72b65c5402ab2c573830a6978e5f202ad0d984793c8dde2c4152ebe04";
  };

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    argon2 = [ argon2-cffi ];
    bcrypt = [ bcrypt ];
    totp = [ cryptography ];
@ -24,9 +24,9 @@ buildPythonPackage rec {

  checkInputs = [
    pytestCheckHook
-  ] ++ passthru.extras-require.argon2
-    ++ passthru.extras-require.bcrypt
-    ++ passthru.extras-require.totp;
+  ] ++ passthru.optional-dependencies.argon2
+    ++ passthru.optional-dependencies.bcrypt
+    ++ passthru.optional-dependencies.totp;

  meta = with lib; {
    description = "A password hashing library for Python";
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, pulumi
+, parver
+, semver
+, isPy27
+}:
+
+buildPythonPackage rec {
+  pname = "pulumi-aws";
+  # version is independant of pulumi's.
+  version = "5.3.0";
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "pulumi";
+    repo = "pulumi-aws";
+    rev = "v${version}";
+    sha256 = "sha256-LrWiNYJeQQvXJDOxklRO86VSiaadvkOepQVPhh2BBkk=";
+  };
+
+  propagatedBuildInputs = [
+    pulumi
+    parver
+    semver
+  ];
+
+  postPatch = ''
+    cd sdk/python
+  '';
+
+  # checks require cloud resources
+  doCheck = false;
+  pythonImportsCheck = ["pulumi_aws"];
+
+  meta = with lib; {
+    description = "Pulumi python amazon web services provider";
+    homepage = "https://github.com/pulumi/pulumi-aws";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ costrouc ];
+  };
+}
--- a/pkgs/development/python-modules/pulumi/default.nix
+++ b/pkgs/development/python-modules/pulumi/default.nix
@ -0,0 +1,89 @@
+{ lib
+, buildPythonPackage
+, fetchpatch
+, fetchFromGitHub
+, protobuf
+, dill
+, grpcio
+, pulumi-bin
+, isPy27
+, semver
+, pyyaml
+, six
+
+
+# for tests
+, tox
+, go
+, pulumictl
+, bash
+, pylint
+, pytest
+, pytest-timeout
+, coverage
+, black
+, wheel
+, pytest-asyncio
+
+, mypy
+}:
+let
+  data = import ./data.nix {};
+in
+buildPythonPackage rec {
+  pname = "pulumi";
+  version = pulumi-bin.version;
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "pulumi";
+    repo = "pulumi";
+    rev = "v${pulumi-bin.version}";
+    sha256 = "sha256-vqEZEHTpJV65a3leWwYhyi3dzAsN67BXOvk5hnTPeuI=";
+  };
+
+  propagatedBuildInputs = [
+    semver
+    protobuf
+    dill
+    grpcio
+    pyyaml
+    six
+  ];
+
+  checkInputs = [
+    pulumi-bin
+    pulumictl
+    mypy
+    bash
+    go
+    tox
+    pytest
+    pytest-timeout
+    coverage
+    pytest-asyncio
+    wheel
+    black
+  ];
+
+  pythonImportsCheck = ["pulumi"];
+
+  postPatch = ''
+    cp README.md sdk/python/lib
+    patchShebangs .
+    cd sdk/python/lib
+
+    substituteInPlace setup.py \
+      --replace "{VERSION}" "${version}"
+  '';
+
+  # disabled because tests try to fetch go packages from the net
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Modern Infrastructure as Code. Any cloud, any language";
+    homepage = "https://github.com/pulumi/pulumi";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ teto ];
+  };
+}
--- a/pkgs/development/python-modules/pure-python-adb/default.nix
+++ b/pkgs/development/python-modules/pure-python-adb/default.nix
@ -17,7 +17,7 @@ buildPythonPackage rec {
    sha256 = "0kdr7w2fhgjpcf1k3l6an9im583iqkr6v8hb4q1zw30nh3bqkk0f";
  };

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    async = [
      aiofiles
    ];
@ -28,7 +28,7 @@ buildPythonPackage rec {
  checkInputs = [
    pytestCheckHook
  ]
-  ++ passthru.extras-require.async;
+  ++ passthru.optional-dependencies.async;

  pythonImportsCheck = [
    "ppadb.client"
--- a/pkgs/development/python-modules/pygatt/default.nix
+++ b/pkgs/development/python-modules/pygatt/default.nix
@ -25,7 +25,7 @@ buildPythonPackage rec {
    pyserial
  ];

-  passthru.extras-require.GATTTOOL = [
+  passthru.optional-dependencies.GATTTOOL = [
    pexpect
  ];

@ -34,7 +34,7 @@ buildPythonPackage rec {
    nose
    pytestCheckHook
  ]
-  ++ passthru.extras-require.GATTTOOL;
+  ++ passthru.optional-dependencies.GATTTOOL;

  postPatch = ''
    # Not support for Python < 3.4
--- a/pkgs/development/python-modules/pyglet/default.nix
+++ b/pkgs/development/python-modules/pyglet/default.nix
@ -18,13 +18,13 @@
 }:

 buildPythonPackage rec {
-  version = "1.5.24";
+  version = "1.5.26";
  pname = "pyglet";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-W0pNXlrVSUbjFJLqxn9ykuUaZXckRkGidxgPkKAZKo4=";
+    sha256 = "sha256-7oxeC1uH34QYjiDlUpguuo2gCUS0xVYPHP3VyXFNGbA=";
    extension = "zip";
  };

--- a/pkgs/development/python-modules/python-barcode/default.nix
+++ b/pkgs/development/python-modules/python-barcode/default.nix
@ -23,7 +23,7 @@ buildPythonPackage rec {
    setuptools-scm
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    images = [
      pillow
    ];
@ -38,7 +38,7 @@ buildPythonPackage rec {

  checkInputs = [
    pytestCheckHook
-  ] ++ passthru.extras-require.images;
+  ] ++ passthru.optional-dependencies.images;

  pythonImportsCheck = [ "barcode" ];

--- a/pkgs/development/python-modules/python-glanceclient/default.nix
+++ b/pkgs/development/python-modules/python-glanceclient/default.nix
@ -11,6 +11,7 @@
 , oslo-i18n
 , wrapt
 , pyopenssl
+, pythonOlder
 , stestr
 , testscenarios
 , ddt
@ -19,11 +20,14 @@

 buildPythonApplication rec {
  pname = "python-glanceclient";
-  version = "3.6.0";
+  version = "4.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-gi1IYtWJL2pltoKTRy5gsHTRwHlp0GHoBMbh1UP5g9o=";
+    hash = "sha256-a3tFLmSKuaKbBQy32EkU7sPIEQtN5gaDqoGT03gka+w=";
  };

  postPatch = ''
@ -54,7 +58,9 @@ buildPythonApplication rec {
    stestr run
  '';

-  pythonImportsCheck = [ "glanceclient" ];
+  pythonImportsCheck = [
+    "glanceclient"
+  ];

  meta = with lib; {
    description = "Python bindings for the OpenStack Images API";
--- a/pkgs/development/python-modules/pytile/default.nix
+++ b/pkgs/development/python-modules/pytile/default.nix
@ -4,7 +4,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
-, pylint
 , pytest-aiohttp
 , pytest-asyncio
 , pytestCheckHook
@ -31,7 +30,6 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    aiohttp
-    pylint
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/pytradfri/default.nix
+++ b/pkgs/development/python-modules/pytradfri/default.nix
@ -21,7 +21,7 @@ buildPythonPackage rec {
    hash = "sha256-12ol+2CnoPfkxmDGJJAkoafHGpQuWC4lh0N7lSvx2DE=";
  };

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    async = [
      aiocoap
      dtlssocket
@ -31,7 +31,7 @@ buildPythonPackage rec {
  checkInputs = [
    pytestCheckHook
  ]
-  ++ passthru.extras-require.async;
+  ++ passthru.optional-dependencies.async;

  pythonImportsCheck = [
    "pytradfri"
--- a/pkgs/development/python-modules/pywemo/default.nix
+++ b/pkgs/development/python-modules/pywemo/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "pywemo";
-  version = "0.8.0";
+  version = "0.8.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -21,8 +21,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
-    rev = version;
-    hash = "sha256-bGoqhrjoRKUGPBNfmr2XP+1HL5mdRi6XoCi0BdvY9x8=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-kkZmn+rGRZGh9WmrHAmpqxTjw6MyCSWCeesJ0JGarKM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/rasterio/default.nix
+++ b/pkgs/development/python-modules/rasterio/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
@ -17,6 +18,7 @@
 , matplotlib
 , numpy
 , snuggs
+, setuptools

 # tests
 , hypothesis
@ -55,6 +57,7 @@ buildPythonPackage rec {
    matplotlib
    numpy
    snuggs
+    setuptools # needs pkg_resources at runtime
  ];

  preCheck = ''
@ -73,10 +76,19 @@ buildPythonPackage rec {
    "-m 'not network'"
  ];

+  disabledTests = lib.optionals stdenv.isDarwin [
+    "test_reproject_error_propagation"
+  ];
+
  pythonImportsCheck = [
    "rasterio"
  ];

+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/rio --version | grep ${version} > /dev/null
+  '';
+
  meta = with lib; {
    description = "Python package to read and write geospatial raster data";
    homepage = "https://rasterio.readthedocs.io/en/latest/";
--- a/pkgs/development/python-modules/rdflib/default.nix
+++ b/pkgs/development/python-modules/rdflib/default.nix
@ -43,7 +43,7 @@ buildPythonPackage rec {
    importlib-metadata
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    html = [
      html5lib
    ];
@ -55,8 +55,8 @@ buildPythonPackage rec {
  checkInputs = [
    pytestCheckHook
  ]
-  ++ passthru.extras-require.networkx
-  ++ passthru.extras-require.html;
+  ++ passthru.optional-dependencies.networkx
+  ++ passthru.optional-dependencies.html;

  pytestFlagsArray = [
    # requires network access
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@ -40,7 +40,7 @@ buildPythonPackage rec {
    importlib-metadata
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    hidredis = [
      hiredis
    ];
--- a/pkgs/development/python-modules/relatorio/default.nix
+++ b/pkgs/development/python-modules/relatorio/default.nix
@ -27,14 +27,14 @@ buildPythonPackage rec {
    lxml
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    chart = [ /* pycha */ pyyaml ];
    fodt = [ python-magic ];
  };

  checkInputs = [
    pytestCheckHook
-  ] ++ passthru.extras-require.fodt;
+  ] ++ passthru.optional-dependencies.fodt;

  pythonImportsCheck = [ "relatorio" ];

--- a/pkgs/development/python-modules/requests-aws4auth/default.nix
+++ b/pkgs/development/python-modules/requests-aws4auth/default.nix
@ -28,13 +28,13 @@ buildPythonPackage rec {
    six
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    httpx = [ httpx ];
  };

  checkInputs = [
    pytestCheckHook
-  ] ++ passthru.extras-require.httpx;
+  ] ++ passthru.optional-dependencies.httpx;

  pythonImportsCheck = [
    "requests_aws4auth"
--- a/pkgs/development/python-modules/samsungctl/default.nix
+++ b/pkgs/development/python-modules/samsungctl/default.nix
@ -15,7 +15,7 @@ buildPythonPackage rec {
    sha256 = "0ipz3fd65rqkxlb02sql0awc3vnslrwb2pfrsnpfnf8bfgxpbh9g";
  };

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    websocket = [
      websocket-client
    ];
--- a/pkgs/development/python-modules/samsungtvws/default.nix
+++ b/pkgs/development/python-modules/samsungtvws/default.nix
@ -39,7 +39,7 @@ buildPythonPackage rec {
    websocket-client
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    async = [
      aiohttp
      websockets
@ -55,8 +55,8 @@ buildPythonPackage rec {
    pytest-asyncio
    pytestCheckHook
  ]
-  ++ passthru.extras-require.async
-  ++ passthru.extras-require.encrypted;
+  ++ passthru.optional-dependencies.async
+  ++ passthru.optional-dependencies.encrypted;

  pythonImportsCheck = [ "samsungtvws" ];

--- a/pkgs/development/python-modules/ssh-mitm/default.nix
+++ b/pkgs/development/python-modules/ssh-mitm/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "ssh-mitm";
-  version = "2.0.2";
+  version = "2.0.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = version;
-    hash = "sha256-cFahID4+PMQPG/pDAR0bU5MZAa8LsNiirxrzGi2c/EE=";
+    hash = "sha256-TU+jrPZtE9SasUudg1BujvIi3uH+WRdW2TReTFYtntc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/treq/default.nix
+++ b/pkgs/development/python-modules/treq/default.nix
@ -20,7 +20,7 @@ buildPythonPackage rec {
    requests
    incremental
    twisted
-  ] ++ twisted.extras-require.tls;
+  ] ++ twisted.optional-dependencies.tls;

  checkInputs = [
    httpbin
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@ -53,9 +53,9 @@ buildPythonPackage rec {
    weasyprint
    gevent
    pillow
-  ] ++ relatorio.extras-require.fodt
-    ++ passlib.extras-require.bcrypt
-    ++ passlib.extras-require.argon2
+  ] ++ relatorio.optional-dependencies.fodt
+    ++ passlib.optional-dependencies.bcrypt
+    ++ passlib.optional-dependencies.argon2
    ++ lib.optional withPostgresql psycopg2;

  checkPhase = ''
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@ -117,8 +117,9 @@ buildPythonPackage rec {
    git
    glibcLocales
    pyhamcrest
-  ] ++ passthru.extras-require.conch
-  ++ passthru.extras-require.tls;
+  ]
+  ++ passthru.optional-dependencies.conch
+  ++ passthru.optional-dependencies.tls;

  checkPhase = ''
    export SOURCE_DATE_EPOCH=315532800
@ -128,8 +129,9 @@ buildPythonPackage rec {
  '';

  passthru = {
-    extras-require = {
+    optional-dependencies = rec {
      conch = [ appdirs bcrypt cryptography pyasn1 ];
+      conch_nacl = conch ++ [ pynacl ];
      contextvars = lib.optionals (pythonOlder "3.7") [ contextvars ];
      http2 = [ h2 priority ];
      serial = [ pyserial ];
--- a/pkgs/development/python-modules/txtorcon/default.nix
+++ b/pkgs/development/python-modules/txtorcon/default.nix
@ -13,7 +13,7 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    incremental twisted automat zope_interface
-  ] ++ twisted.extras-require.tls
+  ] ++ twisted.optional-dependencies.tls
  ++ lib.optionals (!isPy3k) [ ipaddress ];

  checkInputs = [ pytestCheckHook mock lsof GeoIP ];
--- a/pkgs/development/python-modules/vivisect/default.nix
+++ b/pkgs/development/python-modules/vivisect/default.nix
@ -43,9 +43,9 @@ buildPythonPackage rec {
    cxxfilt
    msgpack
    pycparser
-  ] ++ lib.optionals (withGui) passthru.extras-require.gui;
+  ] ++ lib.optionals (withGui) passthru.optional-dependencies.gui;

-  passthru.extras-require.gui = [
+  passthru.optional-dependencies.gui = [
    pyqt5
    pyqtwebengine
  ];
--- a/pkgs/development/python-modules/volvooncall/default.nix
+++ b/pkgs/development/python-modules/volvooncall/default.nix
@ -33,7 +33,7 @@ buildPythonPackage rec {
    aiohttp
  ];

-  passthru.extras-require = {
+  passthru.optional-dependencies = {
    console = [
      certifi
      docopt
@ -49,7 +49,7 @@ buildPythonPackage rec {
    asynctest
    pytest-asyncio
    pytestCheckHook
-  ] ++ passthru.extras-require.mqtt;
+  ] ++ passthru.optional-dependencies.mqtt;

  pythonImportsCheck = [ "volvooncall" ];

--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -32,13 +32,13 @@ with py.pkgs;

 buildPythonApplication rec {
  pname = "checkov";
-  version = "2.0.1147";
+  version = "2.0.1153";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = version;
-    hash = "sha256-tk0vPkKBiGezlHEngqJBekltbpeGa2YwFnc/Ua/YMRo=";
+    hash = "sha256-9J7KvHUT6u8Dl9ElUmUgu/EC9p2gx52AB9prMFmyX2k=";
  };

  nativeBuildInputs = with py.pkgs; [
--- a/pkgs/development/tools/devpi-server/default.nix
+++ b/pkgs/development/tools/devpi-server/default.nix
@ -46,7 +46,7 @@ buildPythonApplication rec {
    pyramid
    strictyaml
    waitress
-  ] ++ passlib.extras-require.argon2;
+  ] ++ passlib.optional-dependencies.argon2;

  checkInputs = [
    beautifulsoup4
--- a/pkgs/development/tools/parsing/hammer/default.nix
+++ b/pkgs/development/tools/parsing/hammer/default.nix
@ -1,33 +1,38 @@
-{ lib, stdenv, fetchFromGitHub, glib, pkg-config, scons }:
+{ fetchFromGitLab
+, glib
+, lib
+, pkg-config
+, scons
+, stdenv
+}:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "hammer";
-  version = "e7aa734";
+  version = "nightly_20220416";

-  src = fetchFromGitHub {
-    owner = "UpstandingHackers";
+  src = fetchFromGitLab {
+    domain = "gitlab.special-circumstanc.es";
+    owner = "hammer";
    repo = "hammer";
-    rev = "47f34b81e4de834fd3537dd71928c4f3cdb7f533";
-    sha256 = "sha256-aNSmbSgcABF9T1HoFhCnkmON4hY2MtUs7dW38+HigAY=";
+    rev = version;
+    sha256 = "sha256-xMZhUnycGeHkNZfHQ2d9mETti8HwGHZNskFqh9f0810=";
  };

  nativeBuildInputs = [ pkg-config scons ];
  buildInputs = [ glib ];

-  strictDeps = true;
-
  meta = with lib; {
    description = "A bit-oriented parser combinator library";
    longDescription = ''
-      Hammer is a parsing library. Like many modern parsing libraries,
-      it provides a parser combinator interface for writing grammars
-      as inline domain-specific languages, but Hammer also provides a
-      variety of parsing backends. It's also bit-oriented rather than
-      character-oriented, making it ideal for parsing binary data such
-      as images, network packets, audio, and executables.
+      Hammer is a parsing library. Like many modern parsing libraries, it
+      provides a parser combinator interface for writing grammars as inline
+      domain-specific languages, but Hammer also provides a variety of parsing
+      backends. It's also bit-oriented rather than character-oriented, making it
+      ideal for parsing binary data such as images, network packets, audio, and
+      executables.
    '';
-    homepage = "https://github.com/UpstandingHackers/hammer";
+    homepage = "https://gitlab.special-circumstanc.es/hammer/hammer";
    license = licenses.gpl2;
-    platforms = platforms.linux;
+    maintainers = with maintainers; [ azahi ];
  };
 }
--- a/pkgs/development/tools/rust/sqlx-cli/default.nix
+++ b/pkgs/development/tools/rust/sqlx-cli/default.nix
@ -1,17 +1,17 @@
-{ stdenv, lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, SystemConfiguration, CoreFoundation, Security, libiconv }:
+{ stdenv, lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, SystemConfiguration, CoreFoundation, Security, libiconv, testers, sqlx-cli }:

 rustPlatform.buildRustPackage rec {
  pname = "sqlx-cli";
-  version = "0.5.11";
+  version = "0.5.13";

  src = fetchFromGitHub {
    owner = "launchbadge";
    repo = "sqlx";
    rev = "v${version}";
-    sha256 = "sha256-Tz7YzGkQUwH0U14dvsttP2GpnM9kign6L9PkAVs3dEc=";
+    sha256 = "sha256-uUIvzUDDv6WUA25zMhaL2Tn3wHTu/IRgzmnB119BLvk=";
  };

-  cargoSha256 = "sha256-EKuRaVxwotgTPj95GJnrQGbulsFPClSettwS5f0TzoM=";
+  cargoSha256 = "sha256-IHbOuW2FPt2cH0/ld28fp1uBrJadVsJ8izG0JrZy488=";

  doCheck = false;
  cargoBuildFlags = [ "-p sqlx-cli" ];
@ -20,6 +20,11 @@ rustPlatform.buildRustPackage rec {
  buildInputs = lib.optionals stdenv.isLinux [ openssl ]
    ++ lib.optionals stdenv.isDarwin [ SystemConfiguration CoreFoundation Security libiconv ];

+  passthru.tests.version = testers.testVersion {
+    package = sqlx-cli;
+    command = "sqlx --version";
+  };
+
  meta = with lib; {
    description =
      "SQLx's associated command-line utility for managing databases, migrations, and enabling offline mode with sqlx::query!() and friends.";
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -684,7 +684,7 @@ stdenv.mkDerivation {
    # runtime; otherwise we can't and we need to reboot.
    interfaceVersion = 2;

-    inherit withCryptsetup util-linux kmod kbd;
+    inherit withCryptsetup withHostnamed withImportd withLocaled withMachined withTimedated util-linux kmod kbd;

    tests = {
      inherit (nixosTests) switchTest;
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -118,9 +118,9 @@
      androidtv
      pure-python-adb
    ]
-    ++ adb-shell.extras-require.async
-    ++ androidtv.extras-require.async
-    ++ pure-python-adb.extras-require.async;
+    ++ adb-shell.optional-dependencies.async
+    ++ androidtv.optional-dependencies.async
+    ++ pure-python-adb.optional-dependencies.async;
    "anel_pwrctrl" = ps: with ps; [
    ]; # missing inputs: anel_pwrctrl-homeassistant
    "anthemav" = ps: with ps; [
@ -279,7 +279,7 @@
    "bluetooth_le_tracker" = ps: with ps; [
      pygatt
    ]
-    ++ pygatt.extras-require.GATTTOOL;
+    ++ pygatt.optional-dependencies.GATTTOOL;
    "bluetooth_tracker" = ps: with ps; [
      bt-proximity
      pybluez
@ -2273,9 +2273,9 @@
      wakeonlan
      zeroconf
    ]
-    ++ samsungctl.extras-require.websocket
-    ++ samsungtvws.extras-require.async
-    ++ samsungtvws.extras-require.encrypted;
+    ++ samsungctl.optional-dependencies.websocket
+    ++ samsungtvws.optional-dependencies.async
+    ++ samsungtvws.optional-dependencies.encrypted;
    "satel_integra" = ps: with ps; [
    ]; # missing inputs: satel_integra
    "scene" = ps: with ps; [
@ -2388,7 +2388,7 @@
    "skybeacon" = ps: with ps; [
      pygatt
    ]
-    ++ pygatt.extras-require.GATTTOOL;
+    ++ pygatt.optional-dependencies.GATTTOOL;
    "skybell" = ps: with ps; [
      skybellpy
    ];
@ -2769,7 +2769,7 @@
    "tradfri" = ps: with ps; [
      pytradfri
    ]
-    ++ pytradfri.extras-require.async;
+    ++ pytradfri.optional-dependencies.async;
    "trafikverket_ferry" = ps: with ps; [
      pytrafikverket
    ];
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -282,9 +282,6 @@ in python.pkgs.buildPythonApplication rec {
    respx
    stdlib-list
    tqdm
-    # required by tests/pylint
-    astroid
-    pylint
    # required by tests/auth/mfa_modules
    pyotp
  ] ++ lib.concatMap (component: getPackages component python.pkgs) [
@ -308,6 +305,8 @@ in python.pkgs.buildPythonApplication rec {
  ];

  disabledTestPaths = [
+    # we don't care about code quality
+    "tests/pylint"
    # don't bulk test all components
    "tests/components"
    # pyotp since v2.4.0 complains about the short mock keys, hass pins v2.3.0
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@ -103,13 +103,13 @@ def repository_root() -> str:
    return os.path.abspath(sys.argv[0] + "/../../../..")


-# For a package attribute and and an extra, check if the package exposes it via passthru.extras-require
+# For a package attribute and and an extra, check if the package exposes it via passthru.optional-dependencies
 def has_extra(package: str, extra: str):
    cmd = [
        "nix-instantiate",
        repository_root(),
        "-A",
-        f"{package}.extras-require.{extra}",
+        f"{package}.optional-dependencies.{extra}",
    ]
    try:
        subprocess.run(
@ -209,7 +209,7 @@ def main() -> None:
                attr_paths.append(pname)
                for extra in extras:
                    # Check if package advertises extra requirements
-                    extra_attr = f"{pname}.extras-require.{extra}"
+                    extra_attr = f"{pname}.optional-dependencies.{extra}"
                    if has_extra(attr_path, extra):
                        extra_attrs.append(extra_attr)
                    else:
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@ -71,7 +71,6 @@ in lib.listToAttrs (map (component: lib.nameValuePair component (

    meta = old.meta // {
      broken = lib.elem component [
-        "airtouch4"
        "bsblan"
        "dnsip"
        "efergy"
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@ -165,7 +165,7 @@ stdenv.mkDerivation {
  passthru = {
    modules = modules;
    tests = {
-      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-pubhtml nginx-sandbox nginx-sso;
+      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-http3 nginx-pubhtml nginx-sandbox nginx-sso;
      variants = lib.recurseIntoAttrs nixosTests.nginx-variants;
      acme-integration = nixosTests.acme;
    } // passthru.tests;
--- a/pkgs/servers/radicale/3.x.nix
+++ b/pkgs/servers/radicale/3.x.nix
@ -21,7 +21,7 @@ python3.pkgs.buildPythonApplication rec {
    vobject
    python-dateutil
    pytz # https://github.com/Kozea/Radicale/issues/816
-  ] ++ passlib.extras-require.bcrypt;
+  ] ++ passlib.optional-dependencies.bcrypt;

  checkInputs = with python3.pkgs; [
    pytestCheckHook
--- a/pkgs/servers/roon-bridge/default.nix
+++ b/pkgs/servers/roon-bridge/default.nix
@ -11,7 +11,7 @@
 }:
 stdenv.mkDerivation rec {
  pname = "roon-bridge";
-  version = "1.8-918";
+  version = "1.8-943";

  src =
    let
@ -21,11 +21,11 @@ stdenv.mkDerivation rec {
      {
        x86_64-linux = fetchurl {
          url = "http://download.roonlabs.com/builds/RoonBridge_linuxx64_${urlVersion}.tar.bz2";
-          hash = "sha256-Tx8KmGKh6BNoo2RKJm0HfPHRXiFsz+FtX5gQZ1FCEEg=";
+          hash = "sha256-knmy2zlRh+ehvYKHC7UN60pMCt8bYPuo9kTz2m0pOW0";
        };
        aarch64-linux = fetchurl {
          url = "http://download.roonlabs.com/builds/RoonBridge_linuxarmv8_${urlVersion}.tar.bz2";
-          hash = "sha256-UkdAs+/l9c4j8PNlAZfNNCJogjxZItcDikS+tOjYjA0=";
+          hash = "sha256-urMhtBUjP4HpV9EDZOLLnfnMqhmsWPx0M2+Xdvc8YnU=";
        };
      }.${system} or (throw "Unsupposed system: ${system}");

--- a/Show more
+++ b/Show more