Merge master into haskell-updates

2024-11-19 08:36:41 +01:00 · 2022-08-19 00:15:34 +00:00 · 2022-08-19 00:15:34 +00:00 · 1d12f3c5e7
commit 1d12f3c5e7
parent f5cc8339a4 5efa052928
153 changed files with 2254 additions and 892 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1359,6 +1359,12 @@
    githubId = 9315;
    name = "Zhong Jianxin";
  };
+  a-kenji = {
+    email = "aks.kenji@protonmail.com";
+    github = "a-kenji";
+    githubId = 65275785;
+    name = "Alexander Kenji Berthold";
+  };
  b4dm4n = {
    email = "fabianm88@gmail.com";
    github = "B4dM4n";
@ -13504,6 +13510,15 @@
    githubId = 619015;
    name = "Svintsov Dmitry";
  };
+  urandom = {
+    email = "colin@urandom.co.uk";
+    github = "arnottcr";
+    githubId = 2526260;
+    keys = [{
+      fingerprint = "04A3 A2C6 0042 784A AEA7  D051 0447 A663 F7F3 E236";
+    }];
+    name = "Colin Arnott";
+  };
  urbas = {
    email = "matej.urbas@gmail.com";
    github = "urbas";
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -2130,6 +2130,13 @@ sudo mkdir /var/lib/redis-peertube
 sudo cp /var/lib/redis/dump.rdb /var/lib/redis-peertube/dump.rdb
 </programlisting>
      </listitem>
+      <listitem>
+        <para>
+          Added the <literal>keter</literal> NixOS module. Keter reverse
+          proxies requests to your loaded application based on virtual
+          hostnames.
+        </para>
+      </listitem>
      <listitem>
        <para>
          If you are using Wayland you can choose to use the Ozone
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -778,6 +778,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  sudo mkdir /var/lib/redis-peertube
  sudo cp /var/lib/redis/dump.rdb /var/lib/redis-peertube/dump.rdb
  ```
+- Added the `keter` NixOS module. Keter reverse proxies requests to your loaded application based on virtual hostnames.

 - If you are using Wayland you can choose to use the Ozone Wayland support
  in Chrome and several Electron apps by setting the environment variable
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1138,6 +1138,7 @@
  ./services/web-servers/pomerium.nix
  ./services/web-servers/unit/default.nix
  ./services/web-servers/tomcat.nix
+  ./services/web-servers/keter
  ./services/web-servers/traefik.nix
  ./services/web-servers/trafficserver/default.nix
  ./services/web-servers/ttyd.nix
--- a/nixos/modules/services/misc/sssd.nix
+++ b/nixos/modules/services/misc/sssd.nix
@ -3,6 +3,10 @@ with lib;
 let
  cfg = config.services.sssd;
  nscd = config.services.nscd;
+
+  dataDir = "/var/lib/sssd";
+  settingsFile = "${dataDir}/sssd.conf";
+  settingsFileUnsubstituted = pkgs.writeText "${dataDir}/sssd-unsubstituted.conf" cfg.config;
 in {
  options = {
    services.sssd = {
@ -47,6 +51,30 @@ in {
          Kerberos will be configured to cache credentials in SSS.
        '';
      };
+      environmentFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = ''
+          Environment file as defined in <citerefentry>
+          <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
+          </citerefentry>.
+
+          Secrets may be passed to the service without adding them to the world-readable
+          Nix store, by specifying placeholder variables as the option value in Nix and
+          setting these variables accordingly in the environment file.
+
+          <programlisting>
+            # snippet of sssd-related config
+            [domain/LDAP]
+            ldap_default_authtok = $SSSD_LDAP_DEFAULT_AUTHTOK
+          </programlisting>
+
+          <programlisting>
+            # contents of the environment file
+            SSSD_LDAP_DEFAULT_AUTHTOK=verysecretpassword
+          </programlisting>
+        '';
+      };
    };
  };
  config = mkMerge [
@ -60,22 +88,29 @@ in {
        wants = [ "nss-user-lookup.target" ];
        restartTriggers = [
          config.environment.etc."nscd.conf".source
-          config.environment.etc."sssd/sssd.conf".source
+          settingsFileUnsubstituted
        ];
        script = ''
          export LDB_MODULES_PATH+="''${LDB_MODULES_PATH+:}${pkgs.ldb}/modules/ldb:${pkgs.sssd}/modules/ldb"
          mkdir -p /var/lib/sss/{pubconf,db,mc,pipes,gpo_cache,secrets} /var/lib/sss/pipes/private /var/lib/sss/pubconf/krb5.include.d
-          ${pkgs.sssd}/bin/sssd -D
+          ${pkgs.sssd}/bin/sssd -D -c ${settingsFile}
        '';
        serviceConfig = {
          Type = "forking";
          PIDFile = "/run/sssd.pid";
+          StateDirectory = baseNameOf dataDir;
+          # We cannot use LoadCredential here because it's not available in ExecStartPre
+          EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
        };
-      };
-
-      environment.etc."sssd/sssd.conf" = {
-        text = cfg.config;
-        mode = "0400";
+        preStart = ''
+          [ -f ${settingsFile} ] && rm -f ${settingsFile}
+          old_umask=$(umask)
+          umask 0177
+          ${pkgs.envsubst}/bin/envsubst \
+            -o ${settingsFile} \
+            -i ${settingsFileUnsubstituted}
+          umask $old_umask
+        '';
      };

      system.nssModules = [ pkgs.sssd ];
--- a/nixos/modules/services/web-servers/keter/bundle.nix
+++ b/nixos/modules/services/web-servers/keter/bundle.nix
@ -0,0 +1,40 @@
+/* This makes a keter bundle as described on the github page:
+  https://github.com/snoyberg/keter#bundling-your-app-for-keter
+*/
+{ keterDomain
+, keterExecutable
+, gnutar
+, writeTextFile
+, lib
+, stdenv
+, ...
+}:
+
+let
+  str.stanzas = [{
+    # we just use nix as an absolute path so we're not bundling any binaries
+    type = "webapp";
+    /* Note that we're not actually putting the executable in the bundle,
+      we already can use the nix store for copying, so we just
+      symlink to the app. */
+    exec = keterExecutable;
+    host = keterDomain;
+  }];
+  configFile = writeTextFile {
+    name = "keter.yml";
+    text = (lib.generators.toYAML { } str);
+  };
+
+in
+stdenv.mkDerivation {
+  name = "keter-bundle";
+  buildCommand = ''
+    mkdir -p config
+    cp ${configFile} config/keter.yaml
+
+    echo 'create a gzipped tarball'
+    mkdir -p $out
+    tar -zcvf $out/bundle.tar.gz.keter ./.
+  '';
+  buildInputs = [ gnutar ];
+}
--- a/nixos/modules/services/web-servers/keter/default.nix
+++ b/nixos/modules/services/web-servers/keter/default.nix
@ -0,0 +1,162 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.keter;
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [ jappie ];
+  };
+
+  options.services.keter = {
+    enable = lib.mkEnableOption ''keter, a web app deployment manager.
+Note that this module only support loading of webapps:
+Keep an old app running and swap the ports when the new one is booted.
+'';
+
+    keterRoot = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/keter";
+      description = "Mutable state folder for keter";
+    };
+
+    keterPackage = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.haskellPackages.keter;
+      defaultText = lib.literalExpression "pkgs.haskellPackages.keter";
+      description = "The keter package to be used";
+    };
+
+    globalKeterConfig = lib.mkOption {
+      type = lib.types.attrs;
+      default = {
+        ip-from-header = true;
+        listeners = [{
+          host = "*4";
+          port = 6981;
+        }];
+      };
+      # You want that ip-from-header in the nginx setup case
+      # so it's not set to 127.0.0.1.
+      # using a port above 1024 allows you to avoid needing CAP_NET_BIND_SERVICE
+      defaultText = lib.literalExpression ''
+        {
+          ip-from-header = true;
+          listeners = [{
+            host = "*4";
+            port = 6981;
+          }];
+        }
+      '';
+      description = "Global config for keter";
+    };
+
+    bundle = {
+      appName = lib.mkOption {
+        type = lib.types.str;
+        default = "myapp";
+        description = "The name keter assigns to this bundle";
+      };
+
+      executable = lib.mkOption {
+        type = lib.types.path;
+        description = "The executable to be run";
+      };
+
+      domain = lib.mkOption {
+        type = lib.types.str;
+        default = "example.com";
+        description = "The domain keter will bind to";
+      };
+
+      publicScript = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          Allows loading of public environment variables,
+          these are emitted to the log so it shouldn't contain secrets.
+        '';
+        example = "ADMIN_EMAIL=hi@example.com";
+      };
+
+      secretScript = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "Allows loading of private environment variables";
+        example = "MY_AWS_KEY=$(cat /run/keys/AWS_ACCESS_KEY_ID)";
+      };
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      incoming = "${cfg.keterRoot}/incoming";
+
+
+      globalKeterConfigFile = pkgs.writeTextFile {
+        name = "keter-config.yml";
+        text = (lib.generators.toYAML { } (cfg.globalKeterConfig // { root = cfg.keterRoot; }));
+      };
+
+      # If things are expected to change often, put it in the bundle!
+      bundle = pkgs.callPackage ./bundle.nix
+        (cfg.bundle // { keterExecutable = executable; keterDomain = cfg.bundle.domain; });
+
+      # This indirection is required to ensure the nix path
+      # gets copied over to the target machine in remote deployments.
+      # Furthermore, it's important that we use exec to
+      # run the binary otherwise we get process leakage due to this
+      # being executed on every change.
+      executable = pkgs.writeShellScript "bundle-wrapper" ''
+        set -e
+        ${cfg.bundle.secretScript}
+        set -xe
+        ${cfg.bundle.publicScript}
+        exec ${cfg.bundle.executable}
+      '';
+
+    in
+    {
+      systemd.services.keter = {
+        description = "keter app loader";
+        script = ''
+          set -xe
+          mkdir -p ${incoming}
+          { tail -F ${cfg.keterRoot}/log/keter/current.log -n 0 & ${cfg.keterPackage}/bin/keter ${globalKeterConfigFile}; }
+        '';
+        wantedBy = [ "multi-user.target" "nginx.service" ];
+
+        serviceConfig = {
+          Restart = "always";
+          RestartSec = "10s";
+        };
+
+        after = [
+          "network.target"
+          "local-fs.target"
+          "postgresql.service"
+        ];
+      };
+
+      # On deploy this will load our app, by moving it into the incoming dir
+      # If the bundle content changes, this will run again.
+      # Because the bundle content contains the nix path to the exectuable,
+      # we inherit nix based cache busting.
+      systemd.services.load-keter-bundle = {
+        description = "load keter bundle into incoming folder";
+        after = [ "keter.service" ];
+        wantedBy = [ "multi-user.target" ];
+        # we can't override keter bundles because it'll stop the previous app
+        # https://github.com/snoyberg/keter#deploying
+        script = ''
+          set -xe
+          cp ${bundle}/bundle.tar.gz.keter ${incoming}/${cfg.bundle.appName}.keter
+        '';
+        path = [
+          executable
+          cfg.bundle.executable
+        ]; # this is a hack to get the executable copied over to the machine.
+      };
+    }
+  );
+}
--- a/nixos/modules/services/web-servers/minio.nix
+++ b/nixos/modules/services/web-servers/minio.nix
@ -102,7 +102,7 @@ in

    systemd.services.minio = {
      description = "Minio Object Storage";
-      after = [ "network.target" ];
+      after = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        ExecStart = "${cfg.package}/bin/minio server --json --address ${cfg.listenAddress} --console-address ${cfg.consoleAddress} --config-dir=${cfg.configDir} ${toString cfg.dataDir}";
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@ -293,7 +293,7 @@ in
        # Copy default libvirt network config .xml files to /var/lib
        # Files modified by the user will not be overwritten
        for i in $(cd ${cfg.package}/var/lib && echo \
-            libvirt/qemu/networks/*.xml libvirt/qemu/networks/autostart/*.xml \
+            libvirt/qemu/networks/*.xml \
            libvirt/nwfilter/*.xml );
        do
            mkdir -p /var/lib/$(dirname $i) -m 755
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -267,6 +267,7 @@ in {
  kerberos = handleTest ./kerberos/default.nix {};
  kernel-generic = handleTest ./kernel-generic.nix {};
  kernel-latest-ath-user-regd = handleTest ./kernel-latest-ath-user-regd.nix {};
+  keter = handleTest ./keter.nix {};
  kexec = handleTest ./kexec.nix {};
  keycloak = discoverTests (import ./keycloak.nix);
  keymap = handleTest ./keymap.nix {};
--- a/nixos/tests/keter.nix
+++ b/nixos/tests/keter.nix
@ -0,0 +1,42 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+let
+  port = 81;
+in
+{
+  name = "keter";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jappie ];
+  };
+
+
+  nodes.machine = { config, pkgs, ... }: {
+    services.keter = {
+      enable = true;
+
+      globalKeterConfig = {
+        listeners = [{
+          host = "*4";
+          inherit port;
+        }];
+      };
+      bundle = {
+        appName = "test-bundle";
+        domain = "localhost";
+        executable = pkgs.writeShellScript "run" ''
+          ${pkgs.python3}/bin/python -m http.server $PORT
+        '';
+      };
+    };
+  };
+
+  testScript =
+    ''
+      machine.wait_for_unit("keter.service")
+
+      machine.wait_for_open_port(${toString port})
+      machine.wait_for_console_text("Activating app test-bundle with hosts: localhost")
+
+
+      machine.succeed("curl --fail http://localhost:${toString port}/")
+    '';
+})
--- a/nixos/tests/sssd-ldap.nix
+++ b/nixos/tests/sssd-ldap.nix
@ -28,7 +28,7 @@ in import ./make-test-python.nix ({pkgs, ...}: {
            attrs = {
              objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
              olcDatabase = "{1}mdb";
-              olcDbDirectory = "/var/db/openldap";
+              olcDbDirectory = "/var/lib/openldap/db";
              olcSuffix = dbSuffix;
              olcRootDN = "cn=${ldapRootUser},${dbSuffix}";
              olcRootPW = ldapRootPassword;
@ -67,6 +67,8 @@ in import ./make-test-python.nix ({pkgs, ...}: {

    services.sssd = {
      enable = true;
+      # just for testing purposes, don't put this into the Nix store in production!
+      environmentFile = "${pkgs.writeText "ldap-root" "LDAP_BIND_PW=${ldapRootPassword}"}";
      config = ''
        [sssd]
        config_file_version = 2
@ -80,7 +82,7 @@ in import ./make-test-python.nix ({pkgs, ...}: {
        ldap_search_base = ${dbSuffix}
        ldap_default_bind_dn = cn=${ldapRootUser},${dbSuffix}
        ldap_default_authtok_type = password
-        ldap_default_authtok = ${ldapRootPassword}
+        ldap_default_authtok = $LDAP_BIND_PW
      '';
    };
  };
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -7673,6 +7673,18 @@ final: prev:
    meta.homepage = "https://github.com/tremor-rs/tremor-vim/";
  };

+  trim-nvim = buildVimPluginFrom2Nix {
+    pname = "trim.nvim";
+    version = "2022-06-16";
+    src = fetchFromGitHub {
+      owner = "cappyzawa";
+      repo = "trim.nvim";
+      rev = "ab366eb0dd7b3faeaf90a0ec40c993ff18d8c068";
+      sha256 = "0lxc593rys5yi35iabqgqxi18lsk2jp78f3wdksmkxclf9j7xmbw";
+    };
+    meta.homepage = "https://github.com/cappyzawa/trim.nvim/";
+  };
+
  trouble-nvim = buildVimPluginFrom2Nix {
    pname = "trouble.nvim";
    version = "2022-05-09";
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -103,6 +103,7 @@
 , golint
 , gomodifytags
 , gopls
+, gotags
 , gotools
 , iferr
 , impl
@ -1045,7 +1046,7 @@ self: super: {
        gomodifytags
        gopls
        # gorename
-        # gotags
+        gotags
        gotools
        # guru
        iferr
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -643,6 +643,7 @@ https://github.com/folke/tokyonight.nvim/,,
 https://github.com/markonm/traces.vim/,,
 https://github.com/tjdevries/train.nvim/,,
 https://github.com/tremor-rs/tremor-vim/,,
+https://github.com/cappyzawa/trim.nvim/,,
 https://github.com/folke/trouble.nvim/,,
 https://github.com/jgdavey/tslime.vim/,,
 https://github.com/Quramy/tsuquyomi/,,
--- a/pkgs/applications/emulators/ryujinx/default.nix
+++ b/pkgs/applications/emulators/ryujinx/default.nix
@ -14,17 +14,25 @@
 , gdk-pixbuf
 , wrapGAppsHook
 , vulkan-loader
+, libICE
+, libSM
+, libXi
+, libXcursor
+, libXext
+, libXrandr
+, fontconfig
+, glew
 }:

 buildDotnetModule rec {
  pname = "ryujinx";
-  version = "1.1.213"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.223"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml

  src = fetchFromGitHub {
    owner = "Ryujinx";
    repo = "Ryujinx";
-    rev = "e8f1ca84277240c4d6215eb9cd85713aab73e2f7";
-    sha256 = "0ha5wn9h9rqxbkjbz7sm5m8q3rbsiiddh72wx0s3sga5w8054cb3";
+    rev = "951700fdd8f54fb34ffe8a3fb328a68b5bf37abe";
+    sha256 = "0kzchsxir8wh74rxvp582mci855hbd0vma6yhcc9vpz0zmhi2cpf";
  };

  projectFile = "Ryujinx.sln";
@ -34,7 +42,7 @@ buildDotnetModule rec {

  # TODO: Add the headless frontend. Currently errors on the following:
  # System.Exception: SDL2 initlaization failed with error "No available video device"
-  executables = [ "Ryujinx" ];
+  executables = [ "Ryujinx" "Ryujinx.Ava" ];

  nativeBuildInputs = [
    wrapGAppsHook
@ -56,12 +64,28 @@ buildDotnetModule rec {
    pulseaudio
    vulkan-loader
    ffmpeg
+
+    # Avalonia UI
+    libICE
+    libSM
+    libXi
+    libXcursor
+    libXext
+    libXrandr
+    fontconfig
+    glew
  ];

  patches = [
    ./appdir.patch # Ryujinx attempts to write to the nix store. This patch redirects it to "~/.config/Ryujinx" on Linux.
  ];

+  makeWrapperArgs = [
+    # Without this Ryujinx fails to start on wayland. See https://github.com/Ryujinx/Ryujinx/issues/2714
+    "--set GDK_BACKEND x11"
+    "--set SDL_VIDEODRIVER x11"
+  ];
+
  preInstall = ''
    # workaround for https://github.com/Ryujinx/Ryujinx/issues/2349
    mkdir -p $out/lib/sndio-6
--- a/pkgs/applications/emulators/ryujinx/deps.nix
+++ b/pkgs/applications/emulators/ryujinx/deps.nix
@ -41,9 +41,6 @@
  (fetchNuGet { pname = "LibHac"; version = "0.16.1"; sha256 = "131qnqa1asdmymwdvpjza6w646b05jzn1cxjdxgwh7qdcdb77xyx"; })
  (fetchNuGet { pname = "MicroCom.CodeGenerator.MSBuild"; version = "0.10.4"; sha256 = "1bdgy6g15d1mln1xpvs6sy0l2zvfs4hxw6nc3qm16qb8hdgvb73y"; })
  (fetchNuGet { pname = "MicroCom.Runtime"; version = "0.10.4"; sha256 = "0ccbzp0d01dcahm7ban7xyh1rk7k2pkml3l5i7s85cqk5lnczpw2"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.6"; sha256 = "0ndah9cqkgswhi60wrnni10j1d2hdg8jljij83lk1wbfqbng86jm"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-x64"; version = "6.0.6"; sha256 = "0i00xs472gpxbrwx593z520sp8nv3lmqi8z3zrj9cshqckq8knnx"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x64"; version = "6.0.6"; sha256 = "1i66xw8h6qw1p0yf09hdy6l42bkhw3qi8q6zi7933mdkd4r3qr9n"; })
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "2.9.6"; sha256 = "18mr1f0wpq0fir8vjnq0a8pz50zpnblr7sabff0yqx37c975934a"; })
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.3"; sha256 = "09m4cpry8ivm9ga1abrxmvw16sslxhy2k5sl14zckhqb1j164im6"; })
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "3.4.0"; sha256 = "12rn6gl4viycwk3pz5hp5df63g66zvba4hnkwr3f0876jj5ivmsw"; })
@ -64,11 +61,6 @@
  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "6.15.0"; sha256 = "0jn9a20a2zixnkm3bmpmvmiv7mk0hqdlnpi0qgjkg1nir87czm19"; })
  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "6.15.0"; sha256 = "1nbgydr45f7lp980xyrkzpyaw2mkkishjwp3slgxk7f0mz6q8i1v"; })
  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "16.8.0"; sha256 = "1ln2mva7j2mpsj9rdhpk8vhm3pgd8wn563xqdcwd38avnhp74rm9"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "6.0.6"; sha256 = "12b6ya9q5wszfq6yp38lpan8zws95gbp1vs9pydk3v82gai336r3"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "6.0.6"; sha256 = "186ammhxnkh4m68f1s70rca23025lwzhxnc7m82wjg18rwz2vnkl"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.6"; sha256 = "0fjbjh7yxqc9h47ix37y963xi9f9y99jvl26cw3x3kvjlb8x0bgj"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "6.0.6"; sha256 = "0l15md6rzr2dvwvnk8xj1qz1dcjcbmp0aglnflrj8av60g5r1kwd"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x64"; version = "6.0.6"; sha256 = "1a6hvkiy2z6z7v7rw1q61qqlw7w0hzc4my3rm94kwgjcv5qkpr5k"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.0.0"; sha256 = "1fk2fk2639i7nzy58m9dvpdnzql4vb8yl8vr19r2fp8lmj9w2jr0"; })
--- a/pkgs/applications/emulators/ryujinx/updater.sh
+++ b/pkgs/applications/emulators/ryujinx/updater.sh
@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=./. -i bash -p coreutils gnused curl common-updater-scripts nuget-to-nix nix-prefetch-git jq dotnet-sdk_6
+#! nix-shell -I nixpkgs=./. -i bash -p coreutils gnused curl common-updater-scripts nix-prefetch-git jq
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"

@ -75,16 +75,4 @@ fi

 echo "building Nuget lockfile"

-STORE_SRC="$(nix-build . -A ryujinx.src --no-out-link)"
-SRC="$(mktemp -d /tmp/ryujinx-src.XXX)"
-cp -rT "$STORE_SRC" "$SRC"
-chmod -R +w "$SRC"
-pushd "$SRC"
-
-mkdir nuget_tmp.packages
-DOTNET_CLI_TELEMETRY_OPTOUT=1 dotnet restore Ryujinx.sln --packages nuget_tmp.packages
-
-nuget-to-nix ./nuget_tmp.packages >"$DEPS_FILE"
-
-popd
-rm -r "$SRC"
+$(nix-build -A ryujinx.fetch-deps --no-out-link) "$DEPS_FILE"
--- a/pkgs/applications/file-managers/mc/default.nix
+++ b/pkgs/applications/file-managers/mc/default.nix
@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, buildPackages
 , pkg-config
 , glib
 , gpm
@ -31,6 +32,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-6ZTZvppxcumsSkrWIQeSH2qjEuZosFbf5bi867r1OAM=";
  };

+  patches = [
+    # Add support for PERL_FOR_BUILD to fix cross-compilation:
+    #   https://midnight-commander.org/ticket/4399
+    (fetchurl {
+      url = "https://midnight-commander.org/raw-attachment/ticket/4399/0001-configure.ac-introduce-PERL_FOR_BUILD.patch";
+      hash = "sha256-i4cbg/pner+yPfgmP04DEIvpNDlM9YDca1TNBdhWhwI=";
+    })
+  ];
+
  nativeBuildInputs = [ pkg-config autoreconfHook unzip ]
    # The preFixup hook rewrites the binary, which invaliates the code
    # signature. Add the fixup hook to sign the output.
@ -52,7 +62,16 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  configureFlags = [ "PERL=${perl}/bin/perl" ];
+  configureFlags = [
+    # used for vfs helpers at run time:
+    "PERL=${perl}/bin/perl"
+    # used for .hlp generation at build time:
+    "PERL_FOR_BUILD=${buildPackages.perl}/bin/perl"
+
+    # configure arguments have a bunch of build-only dependencies.
+    # Avoid their retention in final closure.
+    "--disable-configure-args"
+  ];

  postPatch = ''
    substituteInPlace src/filemanager/ext.c \
@ -62,11 +81,6 @@ stdenv.mkDerivation rec {
      --replace /bin/cat ${coreutils}/bin/cat
  '';

-  preFixup = ''
-    # remove unwanted build-dependency references
-    sed -i -e "s!PKG_CONFIG_PATH=''${PKG_CONFIG_PATH}!PKG_CONFIG_PATH=$(echo "$PKG_CONFIG_PATH" | sed -e 's/./0/g')!" $out/bin/mc
-  '';
-
  postFixup = lib.optionalString (!stdenv.isDarwin) ''
    # libX11.so is loaded dynamically so autopatch doesn't detect it
    patchelf \
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -46,13 +46,13 @@ in

 stdenv.mkDerivation rec {
  pname = "imagemagick";
-  version = "7.1.0-45";
+  version = "7.1.0-46";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = version;
-    hash = "sha256-fiygwb15dbMyTZ62iWbhWaHpdmoK4rKeb46v0sojgpc=";
+    hash = "sha256-yts86tQMPgdF9Zk1vljVza21mlx1g3XcoHjvtsMoZhA=";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
--- a/pkgs/applications/kde/messagelib.nix
+++ b/pkgs/applications/kde/messagelib.nix
@ -1,12 +1,11 @@
 {
  mkDerivation, lib, kdepimTeam,
-  cmake_3_23,
  extra-cmake-modules, kdoctools,
  akonadi, akonadi-mime, akonadi-notes, akonadi-search, gpgme, grantlee,
  grantleetheme, karchive, kcodecs, kconfig, kconfigwidgets, kcontacts,
  kiconthemes, kidentitymanagement, kio, kjobwidgets, kldap,
  kmailtransport, kmbox, kmime, kwindowsystem, libgravatar, libkdepim, libkleo,
-  pimcommon, qca-qt5, qtwebengine, syntax-highlighting
+  pimcommon, qca-qt5, qtwebengine, syntax-highlighting, fetchpatch
 }:

 mkDerivation {
@ -15,7 +14,18 @@ mkDerivation {
    license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
    maintainers = kdepimTeam;
  };
-  nativeBuildInputs = [ (extra-cmake-modules.override { cmake = cmake_3_23; }) kdoctools ];
+  patches = [
+    # fix compatibility with cmake 3.24
+    (fetchpatch {
+      url = "https://invent.kde.org/pim/messagelib/-/commit/6eaef36d42bdb05f3.patch";
+      hash = "sha256-H0ayU81HxX5moHOQ3hDW7tg824oqK1p9atrBhuvZ8K8=";
+    })
+    (fetchpatch {
+      url = "https://invent.kde.org/pim/messagelib/-/commit/3edc93673f94604c2.patch";
+      hash = "sha256-tBFWCfttjDjyQyWnKdhVfLY6QsixzqqYuvD77GVH080=";
+    })
+  ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  buildInputs = [
    akonadi-notes akonadi-search gpgme grantlee grantleetheme karchive kcodecs
    kconfig kconfigwidgets kiconthemes kio kjobwidgets kldap
--- a/pkgs/applications/misc/batsignal/default.nix
+++ b/pkgs/applications/misc/batsignal/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "batsignal";
-  version = "1.5.1";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "electrickite";
    repo = "batsignal";
    rev = version;
-    sha256 = "sha256-lXxHvcUlIl5yb4QBJ/poLdTbwBMBlDYmTz4tSdNtCyY=";
+    sha256 = "sha256-uDfC/PqT1Bb8np0l2DDIZUoNP9QpjxZH5v1hK2k1Miw=";
  };

  buildInputs = [ libnotify glib ];
--- a/pkgs/applications/misc/kanboard/default.nix
+++ b/pkgs/applications/misc/kanboard/default.nix
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Kanban project management software";
-    homepage = "https://kanboard.net";
+    homepage = "https://kanboard.org";
    license = licenses.mit;
    maintainers = with maintainers; [ lheckemann ];
  };
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "logseq";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchurl {
    url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    sha256 = "sha256-eHSZqWQWPX5gavzUwsI3VMsD2Ov0h/fVPqnA92dzKH4=";
+    sha256 = "sha256-sJ0zaP3zhmcFKK97Bhist98xDuC/jpoN/5Vp1FIWp5M=";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/misc/tickrs/default.nix
+++ b/pkgs/applications/misc/tickrs/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "tickrs";
-  version = "0.14.4";
+  version = "0.14.6";

  src = fetchFromGitHub {
    owner = "tarkah";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-OOsBo+NCfn++2XyfQVoeEPcbSv645Ng7g9s4W7X2xg4=";
+    sha256 = "sha256-tsPCx/4ap2udfZHRK5ebxRYEBYw2W6EgnDI6P3riV04=";
  };

-  cargoSha256 = "sha256-HAkJKqoz4vrY4mGFSz6sylV6DdrjWvPfwb4BiLWEyKY=";
+  cargoSha256 = "sha256-xpUI8IflLqBrwsU5YccGzQlPUJT46GJa5AdsIv9qfjU=";

  nativeBuildInputs = [ perl ];

--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,8 +1,8 @@
 {
  "stable": {
-    "version": "104.0.5112.79",
-    "sha256": "1wxb3nl080wgg1g61g3pgzz3gaawg442iv8pxqhnayacm3qn5ilw",
-    "sha256bin64": "1m09bbh6a4sm5i0n8z2wy0hb8s7w0c2d335mpyrmndzs45py5ggx",
+    "version": "104.0.5112.101",
+    "sha256": "0nrghgngxdn9richjnxii9y94dg5zpwc3gd3vx609r4xaphibw30",
+    "sha256bin64": "1cj2mi3g5wl376wc52jgqg28h7izbsqm2gji526zkhmgb7rwq4sw",
    "deps": {
      "gn": {
        "version": "2022-06-08",
@ -19,9 +19,9 @@
    }
  },
  "beta": {
-    "version": "105.0.5195.28",
-    "sha256": "14hy1f59ypsvqmrp0k4kv5cfcw48dizw4nkmigaxxv4bnmpwlcy1",
-    "sha256bin64": "0rgv1r94z91khzwmf1scnnsz9yqks6ygicl7bdsdbckw69njq91z",
+    "version": "105.0.5195.37",
+    "sha256": "0ffzphr66z3g3l695b5liswpfp0577knn06mzdmwq9x1lk87cwiq",
+    "sha256bin64": "1cfkjzqwj4s5djzl2rka9kbc28i6zph0xqv1534cb68hzgwy171a",
    "deps": {
      "gn": {
        "version": "2022-07-11",
@ -45,8 +45,8 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "104.0.5112.81",
-    "sha256": "0x17jzzvn2aqx3ahqyi6ijyn70sn79kg648r0ks9m5gib1bbgf0y",
+    "version": "104.0.5112.102",
+    "sha256": "0sjpmfln6c96c2i83q8c2v1jfii8527951nbnyqi0g4wam5jqrfj",
    "sha256bin64": null,
    "deps": {
      "gn": {
@ -56,8 +56,8 @@
        "sha256": "1q06vsz9b4bb764wy1wy8n177z2pgpm97kq3rl1hmq185mz5fhra"
      },
      "ungoogled-patches": {
-        "rev": "104.0.5112.81-1",
-        "sha256": "0dvwh470h06x5a4p8kw22pi4lvch16knh90i2kh10y0wfggqz78w"
+        "rev": "104.0.5112.102-1",
+        "sha256": "06l6af4a6ywjn6x02dgb5ywk057p30rylrvr483iwvrj4jlhqvii"
      }
    }
  }
--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "kubeone";
-  version = "1.4.6";
+  version = "1.4.7";

  src = fetchFromGitHub {
    owner = "kubermatic";
    repo = "kubeone";
    rev = "v${version}";
-    sha256 = "sha256-2abuKLAqOaRceokmNb7YG0qg/iYbPhSTG75Rs5mwHDU=";
+    sha256 = "sha256-SgberbjqIf+5bfE+gM7+lxl25aQVs2tJBNrPgkzowJ4=";
  };

  vendorSha256 = "sha256-kI5i1us3Ooh603HOz9Y+HlfPUy/1J8z89/jvKEenpLw=";
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.154";
+  version = "1.2.160";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    sha256 = "sha256-5tiJRxE8W2nvkQdJ3jL8P0+7LXEfNOdL15LdDjlDWpc=";
+    sha256 = "sha256-UeZpH6A/N+frShOOVeRCsIXdBKiI0chsxQvsGJF5JwE=";
  };

  vendorSha256 = "sha256-XpSAFiweD2oUKleD6ztDp1+3PpfUWXfGaaE/9mzRrUQ=";
--- a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
+++ b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
@ -11,19 +11,19 @@
 , aiofiles
 , notify2
 , dbus-python
-, xdg
+, pyxdg
 , python-olm
 }:

 buildPythonApplication rec {
  pname = "matrix-commander";
-  version = "2.37.3";
+  version = "3.5.0";

  src = fetchFromGitHub {
    owner = "8go";
    repo = "matrix-commander";
    rev = "v${version}";
-    sha256 = "sha256-X5tCPR0EqY1dxViwh8/tEjJM2oo81L3H703pPzWzUv8=";
+    sha256 = "sha256-/hNTaajZTyeIcGILIXqUVbBvZ8AUNZKBDsZ4Gr5RL2o=";
  };

  format = "pyproject";
@ -49,7 +49,7 @@ buildPythonApplication rec {
    aiofiles
    notify2
    dbus-python
-    xdg
+    pyxdg
    python-olm
  ];

--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "signal-cli";
-  version = "0.10.10";
+  version = "0.10.11";

  # Building from source would be preferred, but is much more involved.
  src = fetchurl {
    url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}-Linux.tar.gz";
-    sha256 = "sha256-VXL4eeBK8hY5gw8tAdqKQGOc+z1AOAPDyHfBe/fDONc=";
+    sha256 = "sha256-tBgtSYKSoyze9qFWpy6IUdwMU9KCLZGEIpOkjLdHsHM=";
  };

  buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -7,7 +7,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.87.0.403";
+  version = "8.87.0.406";

  rpath = lib.makeLibraryPath [
    alsa-lib
@ -68,7 +68,7 @@ let
          "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
          "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
        ];
-        sha256 = "sha256-ibugr15eRQ2gbvX8wmk2lFioLPST9ljAuWcJHCoi9l8=";
+        sha256 = "sha256-lWnQIdMmfz90h3tOWkQv0vo3HnRi3z6W27vK28+Ksjo=";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -41,12 +41,12 @@

 stdenv.mkDerivation rec {
  pname = "zotero";
-  version = "6.0.10";
+  version = "6.0.12";

  src = fetchurl {
    url =
      "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "sha256-+RFTFOZVf0w9HBlk05pEsssiFlEaPJ9XTq29QpuIil8=";
+    sha256 = "sha256-RIPFn0fLk2CbOoiZ4a5ungnbvfRWFQQUypCYVvVIQms=";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
--- a/pkgs/applications/science/logic/cbmc/0001-Do-not-download-sources-in-cmake.patch
+++ b/pkgs/applications/science/logic/cbmc/0001-Do-not-download-sources-in-cmake.patch
@ -0,0 +1,49 @@
+From fbc1488e8da0175e9c9bdf5892f8a65c71f2a266 Mon Sep 17 00:00:00 2001
+From: Jiajie Chen <c@jia.je>
+Date: Fri, 15 Jul 2022 18:33:15 +0800
+Subject: [PATCH] Do not download sources in cmake
+
+---
+ src/solvers/CMakeLists.txt | 20 +-------------------
+ 1 file changed, 1 insertion(+), 19 deletions(-)
+
+diff --git a/src/solvers/CMakeLists.txt b/src/solvers/CMakeLists.txt
+index 744def486..5b719a78a 100644
+--- a/src/solvers/CMakeLists.txt
+++ b/src/solvers/CMakeLists.txt
+@@ -106,31 +106,13 @@ elseif("${sat_impl}" STREQUAL "glucose")
+ elseif("${sat_impl}" STREQUAL "cadical")
+     message(STATUS "Building solvers with cadical")
+ 
+-    download_project(PROJ cadical
+-        URL https://github.com/arminbiere/cadical/archive/rel-1.4.1.tar.gz
+-        PATCH_COMMAND true
+-        COMMAND CXX=${CMAKE_CXX_COMPILER} ./configure -O3 -s CXXFLAGS=-std=c++14
+-        URL_MD5 b44874501a175106424f4bd5de29aa59
+-    )
+-
+     message(STATUS "Building CaDiCaL")
+-    execute_process(COMMAND make -j WORKING_DIRECTORY ${cadical_SOURCE_DIR})
+ 
+     target_compile_definitions(solvers PUBLIC
+         SATCHECK_CADICAL HAVE_CADICAL
+     )
+ 
+-    add_library(cadical STATIC IMPORTED)
+-
+-    set_target_properties(
+-        cadical
+-        PROPERTIES IMPORTED_LOCATION ${cadical_SOURCE_DIR}/build/libcadical.a
+-    )
+-
+-    target_include_directories(solvers
+-      PUBLIC
+-      ${cadical_SOURCE_DIR}/src
+-    )
+    target_include_directories(solvers PUBLIC ${cadical_INCLUDE_DIR})
+ 
+     target_link_libraries(solvers cadical)
+ elseif("${sat_impl}" STREQUAL "ipasir-cadical")
+-- 
+2.35.1
+
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@ -0,0 +1,82 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, testers
+, bison
+, cadical
+, cbmc
+, cmake
+, flex
+, makeWrapper
+, perl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cbmc";
+  version = "5.63.0";
+
+  src = fetchFromGitHub {
+    owner = "diffblue";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "sha256-4tn3wsmaYdo5/QaZc3MLxVGF0x8dmRKeygF/8A+Ww1o=";
+  };
+
+  nativeBuildInputs = [
+    bison
+    cmake
+    flex
+    perl
+    makeWrapper
+  ];
+
+  buildInputs = [ cadical ];
+
+  # do not download sources
+  # link existing cadical instead
+  patches = [
+    ./0001-Do-not-download-sources-in-cmake.patch
+  ];
+
+  postPatch = ''
+    # do not hardcode gcc
+    substituteInPlace "scripts/bash-autocomplete/extract_switches.sh" \
+      --replace "gcc" "$CC" \
+      --replace "g++" "$CXX"
+    # fix library_check.sh interpreter error
+    patchShebangs .
+  '' + lib.optionalString (!stdenv.cc.isGNU) ''
+    # goto-gcc rely on gcc
+    substituteInPlace "regression/CMakeLists.txt" \
+      --replace "add_subdirectory(goto-gcc)" ""
+  '';
+
+  postInstall = ''
+    # goto-cc expects ls_parse.py in PATH
+    mkdir -p $out/share/cbmc
+    mv $out/bin/ls_parse.py $out/share/cbmc/ls_parse.py
+    chmod +x $out/share/cbmc/ls_parse.py
+    wrapProgram $out/bin/goto-cc \
+      --prefix PATH : "$out/share/cbmc" \
+  '';
+
+  # fix "argument unused during compilation"
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
+    "-Wno-unused-command-line-argument";
+
+  # TODO: add jbmc support
+  cmakeFlags = [ "-DWITH_JBMC=OFF" "-Dsat_impl=cadical" "-Dcadical_INCLUDE_DIR=${cadical.dev}/include" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = cbmc;
+    command = "cbmc --version";
+  };
+
+  meta = with lib; {
+    description = "CBMC is a Bounded Model Checker for C and C++ programs";
+    homepage = "http://www.cprover.org/cbmc/";
+    license = licenses.bsdOriginal;
+    maintainers = with maintainers; [ jiegec ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/science/logic/fast-downward/default.nix
+++ b/pkgs/applications/science/logic/fast-downward/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "fast-downward";
-  version = "21.12.0";
+  version = "22.06.0";

  src = fetchFromGitHub {
    owner = "aibasel";
    repo = "downward";
    rev = "release-${version}";
-    sha256 = "sha256-qc+SaUpIYm7bnOZlHH2mdvUaMBB+VRyOCQM/BOoOaPE=";
+    sha256 = "sha256-WzxLUuwZy+oNqmgj0n4Pe1QBYXXAaJqYhT+JSLbmyiM=";
  };

  nativeBuildInputs = [ cmake python3.pkgs.wrapPython ];
--- a/pkgs/applications/science/machine-learning/streamlit/default.nix
+++ b/pkgs/applications/science/machine-learning/streamlit/default.nix
@ -6,16 +6,11 @@

  # Build inputs
  altair,
-  astor,
-  base58,
  blinker,
-  boto3,
-  botocore,
  click,
  cachetools,
-  enum-compat,
-  future,
  GitPython,
+  importlib-metadata,
  jinja2,
  pillow,
  pyarrow,
@ -23,6 +18,8 @@
  pympler,
  protobuf,
  requests,
+  rich,
+  semver,
  setuptools,
  toml,
  tornado,
@ -31,36 +28,23 @@
  watchdog,
 }:

-let
-  click_7 = click.overridePythonAttrs(old: rec {
-    version = "7.1.2";
-    src = old.src.override {
-      inherit version;
-      sha256 = "d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a";
-    };
-  });
-in buildPythonApplication rec {
+buildPythonApplication rec {
  pname = "streamlit";
-  version = "1.2.0";
-  format = "wheel"; # the only distribution available
+  version = "1.11.1";
+  format = "wheel";  # source currently requires pipenv

  src = fetchPypi {
    inherit pname version format;
-    sha256 = "1dzb68a8n8wvjppcmqdaqnh925b2dg6rywv51ac9q09zjxb6z11n";
+    hash = "sha256-+GGuL3UngPDgLOGx9QXUdRJsTswhTg7d6zuvhpp0Mo0=";
  };

  propagatedBuildInputs = [
    altair
-    astor
-    base58
    blinker
-    boto3
-    botocore
    cachetools
-    click_7
-    enum-compat
-    future
+    click
    GitPython
+    importlib-metadata
    jinja2
    pillow
    protobuf
@ -68,6 +52,8 @@ in buildPythonApplication rec {
    pydeck
    pympler
    requests
+    rich
+    semver
    setuptools
    toml
    tornado
--- a/pkgs/applications/version-management/git-and-tools/ghr/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/ghr/default.nix
@ -1,25 +1,31 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, testers
+, ghr
+}:

 buildGoModule rec {
  pname = "ghr";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "tcnksm";
    repo = "ghr";
    rev = "v${version}";
-    sha256 = "sha256-pF1TPvQLPa5BbXZ9rRCq7xWofXCBRa9CDgNxX/kaTMo=";
+    sha256 = "sha256-947hTRfx3GM6qKDYvlKEmofqPdcmwx9V/zISkcSKALM=";
  };

-  vendorSha256 = "sha256-+e9Q4Pw9pJyOXVz85KhOSuybj1PBcJi51fGR3a2Gixk=";
+  vendorSha256 = "sha256-OpWp3v1nxHJpEh2jW8MYnbaq66wx9b3DlaKzeti5N3w=";

  # Tests require a Github API token, and networking
  doCheck = false;
  doInstallCheck = true;

-  installCheckPhase = ''
-    $out/bin/ghr --version
-  '';
+  passthru.tests.testVersion = testers.testVersion {
+    package = ghr;
+    version = "ghr version v${version}";
+  };

  meta = with lib; {
    homepage = "https://github.com/tcnksm/ghr";
--- a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
@ -12,13 +12,13 @@

 buildPythonApplication rec {
  pname = "git-machete";
-  version = "3.11.6";
+  version = "3.12.0";

  src = fetchFromGitHub {
    owner = "virtuslab";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-W2OYJO3UnBcZRoIyTRj3Wz7J91zDWrrYPH5OnYvXi24=";
+    sha256 = "sha256-o4OVA9cv+/JLiTUnDEAI/yj+YmOulFrX5XmlRZAb2vw=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@ -14,12 +14,12 @@

 buildGoPackage rec {
  pname = "gitea";
-  version = "1.17.0";
+  version = "1.17.1";

  # not fetching directly from the git repo, because that lacks several vendor files for the web UI
  src = fetchurl {
    url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "sha256-oBbAg2xQ58dLBCjhcKMoUf32ckoFfnFQHL3z3pAKW1Y=";
+    sha256 = "sha256-ttfhsIiCl5VcqfK7ap/CA7bqXxrc4cTVIX+M2S4YanY=";
  };

  patches = [
--- a/pkgs/applications/version-management/gitoxide/default.nix
+++ b/pkgs/applications/version-management/gitoxide/default.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitoxide";
-  version = "0.13.0";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "Byron";
    repo = "gitoxide";
    rev = "v${version}";
-    sha256 = "sha256-NdZ39F6nSuLZNOdoxRs79OR6I3oFASXHzm/hecDyxNI=";
+    sha256 = "sha256-lppg5x2VMzRo4SqAFgtiklc1WfTXi/jty92Z91CxZPM=";
  };

-  cargoSha256 = "sha256-6uRLW1KJF0yskEfWm9ERQIDgVnerAhQFbMaxhnEDIOc=";
+  cargoSha256 = "sha256-j4riS3OzfbEriAlqcjq6GcyTrK5sjFEopMesmWTGxp4=";

  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = if stdenv.isDarwin
--- a/pkgs/applications/virtualization/crosvm/Cargo.lock
+++ b/pkgs/applications/virtualization/crosvm/Cargo.lock
@ -12,6 +12,7 @@ dependencies = [
 "devices",
 "hypervisor",
 "kernel_cmdline",
+ "kernel_loader",
 "kvm",
 "kvm_sys",
 "libc",
@ -42,6 +43,15 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "android_system_properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7ed72e1635e121ca3e79420540282af22da58be50de153d36f81ddc6b83aa9e"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "ansi_term"
 version = "0.12.1"
@ -53,9 +63,9 @@ dependencies = [

 [[package]]
 name = "anyhow"
-version = "1.0.58"
+version = "1.0.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb07d2053ccdbe10e2af2995a2f116c1330396493dc1269f6a91d0ae82e19704"
+checksum = "508b352bb5c066aac251f6daf6b36eccd03e8a88e8081cd44959ea277a3af9a8"

 [[package]]
 name = "arch"
@ -98,8 +108,17 @@ dependencies = [
 "argh_shared",
 "heck",
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
+]
+
+[[package]]
+name = "argh_helpers"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.21",
+ "syn 1.0.99",
 ]

 [[package]]
@ -120,13 +139,13 @@ checksum = "7a40729d2133846d9ed0ea60a8b9541bccddab49cd30f0715a1da672fe9a2524"

 [[package]]
 name = "async-trait"
-version = "0.1.56"
+version = "0.1.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96cf8829f67d2eab0b2dfa42c5d0ef737e0724e4a82b01b3e292456202b19716"
+checksum = "76464446b8bc32758d7e88ee1a804d9914cd9b1cb264c029899680b0be29826f"
 dependencies = [
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
 ]

 [[package]]
@ -177,13 +196,15 @@ name = "base"
 version = "0.1.0"
 dependencies = [
 "audio_streams",
- "base_poll_token_derive",
+ "base_event_token_derive",
 "cfg-if",
 "chrono",
 "data_model",
+ "env_logger",
 "lazy_static",
 "libc",
 "log",
+ "once_cell",
 "rand 0.8.5",
 "regex",
 "remain",
@ -193,17 +214,18 @@ dependencies = [
 "sync",
 "tempfile",
 "thiserror",
+ "uuid",
 "win_util",
 "winapi",
 ]

 [[package]]
-name = "base_poll_token_derive"
+name = "base_event_token_derive"
 version = "0.1.0"
 dependencies = [
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
 ]

 [[package]]
@ -218,8 +240,8 @@ name = "bit_field_derive"
 version = "0.1.0"
 dependencies = [
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
 ]

 [[package]]
@ -228,6 +250,28 @@ version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

+[[package]]
+name = "broker_ipc"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "metrics",
+ "serde",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37ccbd214614c6783386c1af30caf03192f17891059cecc394b4fb119e363de3"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
 [[package]]
 name = "cbindgen"
 version = "0.20.0"
@ -239,10 +283,10 @@ dependencies = [
 "indexmap",
 "log",
 "proc-macro2",
- "quote",
+ "quote 1.0.21",
 "serde",
 "serde_json",
- "syn",
+ "syn 1.0.99",
 "tempfile",
 "toml",
 ]
@ -261,14 +305,17 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

 [[package]]
 name = "chrono"
-version = "0.4.19"
+version = "0.4.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "670ad68c9088c2a963aaa298cb369688cf3f9465ce5e2d4ca10e6e0098a1ce73"
+checksum = "bfd4d1b31faaa3a89d7934dbded3111da0d2ef28e3ebccdb4f0179f5929d1ef1"
 dependencies = [
- "libc",
+ "iana-time-zone",
+ "js-sys",
 "num-integer",
 "num-traits",
+ "serde",
 "time",
+ "wasm-bindgen",
 "winapi",
 ]

@ -302,6 +349,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fb58b6451e8c2a812ad979ed1d83378caa5e927eef2622017a45f251457c2c9d"

+[[package]]
+name = "core-foundation-sys"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
+
 [[package]]
 name = "crc32fast"
 version = "1.3.2"
@ -351,9 +404,9 @@ dependencies = [

 [[package]]
 name = "crossbeam-utils"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d82ee10ce34d7bc12c2122495e7593a9c41347ecdd64185af4ecf72cb1a7f83"
+checksum = "51887d4adc7b564537b15adcfb307936f8075dfcd5f00dde9a9f1d29383682bc"
 dependencies = [
 "cfg-if",
 "once_cell",
@ -367,10 +420,13 @@ dependencies = [
 "acpi_tables",
 "anyhow",
 "arch",
+ "argh",
+ "argh_helpers",
 "assertions",
 "audio_streams",
 "base",
 "bit_field",
+ "broker_ipc",
 "cfg-if",
 "crosvm_plugin",
 "data_model",
@ -388,6 +444,7 @@ dependencies = [
 "libc",
 "libcras",
 "log",
+ "metrics",
 "minijail",
 "net_util",
 "p9",
@ -477,6 +534,16 @@ dependencies = [
 "winapi",
 ]

+[[package]]
+name = "derive-into-owned"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "576fce04d31d592013a5887ba8d9c3830adff329e5096d7e1eb5e8e61262ca62"
+dependencies = [
+ "quote 0.3.15",
+ "syn 0.11.11",
+]
+
 [[package]]
 name = "devices"
 version = "0.1.0"
@ -513,6 +580,7 @@ dependencies = [
 "power_monitor",
 "protobuf",
 "protos",
+ "rand 0.7.3",
 "remain",
 "resources",
 "rutabaga_gfx",
@ -541,6 +609,7 @@ version = "0.1.0"
 dependencies = [
 "async-trait",
 "base",
+ "cfg-if",
 "crc32fast",
 "cros_async",
 "data_model",
@ -549,6 +618,7 @@ dependencies = [
 "protobuf",
 "protos",
 "remain",
+ "serde",
 "tempfile",
 "thiserror",
 "uuid",
@ -569,24 +639,43 @@ checksum = "3f107b87b6afc2a64fd13cac55fe06d6c8859f12d4b14cbcdd2c67d0976781be"

 [[package]]
 name = "enumn"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "052bc8773a98bd051ff37db74a8a25f00e6bfa2cbd03373390c72e9f7afbf344"
+checksum = "038b1afa59052df211f9efd58f8b1d84c242935ede1c3dbaed26b018a9e06ae2"
 dependencies = [
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b2cf0344971ee6c64c31be0d530793fba457d322dfec2810c453d0ef228f9c3"
+dependencies = [
+ "atty",
+ "humantime",
+ "log",
+ "regex",
+ "termcolor",
 ]

 [[package]]
 name = "fastrand"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3fcf0cee53519c866c09b5de1f6c56ff9d647101f81c1964fa632e148896cdf"
+checksum = "a7a407cfaa3385c4ae6b23e84623d48c2798d06e3e6a1878f7f59f17b3f86499"
 dependencies = [
 "instant",
 ]

+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
 [[package]]
 name = "fuchsia-cprng"
 version = "0.1.1"
@ -663,8 +752,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33c1e13800337f4d4d7a316bf45a567dbcb6ffe087f16424852d97e97a91f512"
 dependencies = [
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
 ]

 [[package]]
@ -721,6 +810,17 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "getrandom"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.7"
@ -748,9 +848,9 @@ dependencies = [

 [[package]]
 name = "hashbrown"
-version = "0.12.2"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "607c8a29735385251a339424dd462993c0fed8fa09d378f259377df08c126022"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"

 [[package]]
 name = "heck"
@ -770,22 +870,46 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
 [[package]]
 name = "hypervisor"
 version = "0.1.0"
 dependencies = [
 "base",
 "bit_field",
+ "bitflags",
 "data_model",
 "downcast-rs",
 "enumn",
+ "fnv",
 "kvm",
 "kvm_sys",
 "libc",
 "memoffset 0.6.5",
 "serde",
 "sync",
+ "tempfile",
 "vm_memory",
+ "win_util",
+ "winapi",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "808cf7d67cf4a22adc5be66e75ebdf769b3f2ea032041437a7061f97a63dad4b"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "js-sys",
+ "wasm-bindgen",
+ "winapi",
 ]

 [[package]]
@ -814,7 +938,6 @@ dependencies = [
 "anyhow",
 "arch",
 "base",
- "crosvm",
 "libc",
 "tempfile",
 ]
@ -843,9 +966,18 @@ dependencies = [

 [[package]]
 name = "itoa"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112c678d4050afce233f4f2852bb2eb519230b3cf12f33585275537d7e41578d"
+checksum = "6c8af84674fe1f223a982c933a0ee1086ac4d4052aa0fb8060c12c6ad838e754"
+
+[[package]]
+name = "js-sys"
+version = "0.3.59"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "258451ab10b34f8af53416d1fdab72c22e805f0c92a1136d59470ec0b11138b2"
+dependencies = [
+ "wasm-bindgen",
+]

 [[package]]
 name = "kernel_cmdline"
@ -898,9 +1030,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"

 [[package]]
 name = "libc"
-version = "0.2.126"
+version = "0.2.131"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "349d5a591cd28b49e1d1037471617a32ddcda5731b99419008085f72d5a53836"
+checksum = "04c3b4822ccebfa39c02fc03d1534441b22ead323fa0f48bb7ddd8e6ba076a40"

 [[package]]
 name = "libcras"
@ -915,6 +1047,15 @@ dependencies = [
 "pkg-config",
 ]

+[[package]]
+name = "libslirp-sys"
+version = "4.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2772370ce9b7fa05c7eae0bd033005e139a64d52cee498a7905b3eb5d243c5f4"
+dependencies = [
+ "pkg-config",
+]
+
 [[package]]
 name = "libvda"
 version = "0.1.0"
@ -972,6 +1113,25 @@ dependencies = [
 "autocfg 1.1.0",
 ]

+[[package]]
+name = "metrics"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "cfg-if",
+ "chrono",
+ "lazy_static",
+ "libc",
+ "protobuf",
+ "protoc-rust",
+ "serde",
+ "serde_json",
+ "sync",
+ "winapi",
+ "wmi",
+]
+
 [[package]]
 name = "minijail"
 version = "0.2.3"
@ -1006,10 +1166,16 @@ dependencies = [
 "cros_async",
 "data_model",
 "libc",
+ "libslirp-sys",
+ "metrics",
 "net_sys",
+ "pcap-file",
 "remain",
 "serde",
+ "smallvec",
 "thiserror",
+ "virtio_sys",
+ "winapi",
 ]

 [[package]]
@ -1057,9 +1223,20 @@ dependencies = [

 [[package]]
 name = "paste"
-version = "1.0.7"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c520e05135d6e763148b6426a837e239041653ba7becd2e538c076c738025fc"
+checksum = "9423e2b32f7a043629287a536f21951e8c6a82482d0acb1eeebfc90bc2225b22"
+
+[[package]]
+name = "pcap-file"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ad13fed1a83120159aea81b265074f21d753d157dd16b10cc3790ecba40a341"
+dependencies = [
+ "byteorder",
+ "derive-into-owned",
+ "thiserror",
+]

 [[package]]
 name = "pin-project-lite"
@ -1099,9 +1276,9 @@ checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"

 [[package]]
 name = "proc-macro2"
-version = "1.0.40"
+version = "1.0.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd96a1e8ed2596c337f8eae5f24924ec83f5ad5ab21ea8e455d3566c69fbcaf7"
+checksum = "0a2ca2c61bc9f3d74d2886294ab7b9853abd9c1ad903a3ac7815c58989bb7bab"
 dependencies = [
 "unicode-ident",
 ]
@ -1111,6 +1288,10 @@ name = "protobuf"
 version = "2.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf7e6d18738ecd0902d30d1ad232c9125985a3422929b16c65517b38adc14f96"
+dependencies = [
+ "serde",
+ "serde_derive",
+]

 [[package]]
 name = "protobuf-codegen"
@ -1163,9 +1344,15 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.20"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bcdf212e9776fbcb2d23ab029360416bb1706b1aea2d1a5ba002727cbcab804"
+checksum = "7a6e920b65c65f10b2ae65c831a81a073a89edd28c7cce89475bff467ab4167a"
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
 dependencies = [
 "proc-macro2",
 ]
@ -1180,7 +1367,7 @@ dependencies = [
 "libc",
 "rand_chacha 0.1.1",
 "rand_core 0.4.2",
- "rand_hc",
+ "rand_hc 0.1.0",
 "rand_isaac",
 "rand_jitter",
 "rand_os",
@ -1189,6 +1376,19 @@ dependencies = [
 "winapi",
 ]

+[[package]]
+name = "rand"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+dependencies = [
+ "getrandom 0.1.16",
+ "libc",
+ "rand_chacha 0.2.2",
+ "rand_core 0.5.1",
+ "rand_hc 0.2.0",
+]
+
 [[package]]
 name = "rand"
 version = "0.8.5"
@ -1210,6 +1410,16 @@ dependencies = [
 "rand_core 0.3.1",
 ]

+[[package]]
+name = "rand_chacha"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.5.1",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@ -1235,13 +1445,22 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"

+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+dependencies = [
+ "getrandom 0.1.16",
+]
+
 [[package]]
 name = "rand_core"
 version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
 dependencies = [
- "getrandom",
+ "getrandom 0.2.7",
 ]

 [[package]]
@ -1253,6 +1472,15 @@ dependencies = [
 "rand_core 0.3.1",
 ]

+[[package]]
+name = "rand_hc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+dependencies = [
+ "rand_core 0.5.1",
+]
+
 [[package]]
 name = "rand_isaac"
 version = "0.1.1"
@ -1317,9 +1545,9 @@ dependencies = [

 [[package]]
 name = "redox_syscall"
-version = "0.2.13"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62f25bc4c7e55e0b0b7a1d43fb893f4fa1361d0abe38b9ce4f323c2adfe6ef42"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
 dependencies = [
 "bitflags",
 ]
@ -1343,13 +1571,13 @@ checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"

 [[package]]
 name = "remain"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c35270ea384ac1762895831cc8acb96f171468e52cec82ed9186f9416209fa4"
+checksum = "06df529c0d271b27ac4a2c260f5ce2914b60bd44702cecec7b9f271adbdde23b"
 dependencies = [
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
 ]

 [[package]]
@ -1382,15 +1610,16 @@ dependencies = [
 "libc",
 "pkg-config",
 "remain",
+ "serde",
 "sync",
 "thiserror",
 ]

 [[package]]
 name = "ryu"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3f6f92acf49d1b98f7a81226834412ada05458b7364277387724a237f062695"
+checksum = "4501abdff3ae82a1c1b477a17252eb69cee9e66eb915c1abaa4f44d873df9f09"

 [[package]]
 name = "scudo"
@ -1414,29 +1643,29 @@ dependencies = [

 [[package]]
 name = "serde"
-version = "1.0.139"
+version = "1.0.143"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0171ebb889e45aa68b44aee0859b3eede84c6f5f5c228e6f140c0b2a0a46cad6"
+checksum = "53e8e5d5b70924f74ff5c6d64d9a5acd91422117c60f48c4e07855238a254553"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.139"
+version = "1.0.143"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1d3230c1de7932af58ad8ffbe1d784bd55efd5a9d84ac24f69c72d83543dfb"
+checksum = "d3d8e8de557aee63c26b85b947f5e59b690d0454c753f3adeb5cd7835ab88391"
 dependencies = [
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
 ]

 [[package]]
 name = "serde_json"
-version = "1.0.82"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82c2c1fdcd807d1098552c5b9a36e425e42e9fbd7c6a37a8425f390f781f7fa7"
+checksum = "38dd04e3c8279e75b31ef29dbdceebfe5ad89f4d0937213c53f7d49d01b3d5a7"
 dependencies = [
 "itoa",
 "ryu",
@ -1448,6 +1677,7 @@ name = "serde_keyvalue"
 version = "0.1.0"
 dependencies = [
 "argh",
+ "num-traits",
 "remain",
 "serde",
 "serde_keyvalue_derive",
@ -1460,15 +1690,18 @@ version = "0.1.0"
 dependencies = [
 "argh",
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
 ]

 [[package]]
 name = "slab"
-version = "0.4.6"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb703cfe953bccee95685111adeedb76fabe4e97549a58d16f03ea7b9367bb32"
+checksum = "4614a76b2a8be0058caa9dbbaf66d988527d86d003c11a94fbd335d7661edcef"
+dependencies = [
+ "autocfg 1.1.0",
+]

 [[package]]
 name = "smallvec"
@ -1484,12 +1717,23 @@ checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"

 [[package]]
 name = "syn"
-version = "1.0.98"
+version = "0.11.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c50aef8a904de4c23c788f104b7dddc7d6f79c647c7c8ce4cc8f73eb0ca773dd"
+checksum = "d3b891b9015c88c576343b9b3e41c2c11a51c219ef067b264bd9c8aa9b441dad"
+dependencies = [
+ "quote 0.3.15",
+ "synom",
+ "unicode-xid",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58dbef6ec655055e20b86b15a8cc6d439cca19b667537ac6a1369572d151ab13"
 dependencies = [
 "proc-macro2",
- "quote",
+ "quote 1.0.21",
 "unicode-ident",
 ]

@ -1497,6 +1741,15 @@ dependencies = [
 name = "sync"
 version = "0.1.0"

+[[package]]
+name = "synom"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a393066ed9010ebaed60b9eafa373d4b1baac186dd7e008555b0f702b51945b6"
+dependencies = [
+ "unicode-xid",
+]
+
 [[package]]
 name = "system_api"
 version = "0.1.0"
@ -1515,6 +1768,15 @@ dependencies = [
 "winapi",
 ]

+[[package]]
+name = "termcolor"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "terminal_size"
 version = "0.1.17"
@ -1536,22 +1798,22 @@ dependencies = [

 [[package]]
 name = "thiserror"
-version = "1.0.31"
+version = "1.0.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd829fe32373d27f76265620b5309d0340cb8550f523c1dda251d6298069069a"
+checksum = "f5f6586b7f764adc0231f4c79be7b920e766bb2f3e51b3661cdb263828f19994"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "1.0.31"
+version = "1.0.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0396bc89e626244658bef819e22d0cc459e795a5ebe878e6ec336d1674a8d79a"
+checksum = "12bafc5b54507e0149cdf1b145a5d80ab80a90bcd9275df43d4fff68460f6c21"
 dependencies = [
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
 ]

 [[package]]
@ -1605,9 +1867,9 @@ dependencies = [

 [[package]]
 name = "unicode-ident"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15c61ba63f9235225a22310255a29b806b907c9b8c964bcbd0a2c70f3f2deea7"
+checksum = "c4f5b37a154999a8f3f98cc23a628d850e154479cd94decf3414696e12e31aaf"

 [[package]]
 name = "unicode-segmentation"
@ -1621,6 +1883,12 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"

+[[package]]
+name = "unicode-xid"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c1f860d7d29cf02cb2f3f359fd35991af3d30bac52c57d265a3c461074cb4dc"
+
 [[package]]
 name = "usb_sys"
 version = "0.1.0"
@ -1647,7 +1915,7 @@ version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
 dependencies = [
- "getrandom",
+ "getrandom 0.2.7",
 ]

 [[package]]
@ -1712,6 +1980,7 @@ version = "0.1.0"
 dependencies = [
 "base",
 "bitflags",
+ "cfg-if",
 "cros_async",
 "data_model",
 "libc",
@ -1737,6 +2006,12 @@ dependencies = [
 "thiserror",
 ]

+[[package]]
+name = "wasi"
+version = "0.9.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+
 [[package]]
 name = "wasi"
 version = "0.10.0+wasi-snapshot-preview1"
@ -1749,6 +2024,60 @@ version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"

+[[package]]
+name = "wasm-bindgen"
+version = "0.2.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7652e3f6c4706c8d9cd54832c4a4ccb9b5336e2c3bd154d5cccfbf1c1f5f7d"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "662cd44805586bd52971b9586b1df85cdbbd9112e4ef4d8f41559c334dc6ac3f"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote 1.0.21",
+ "syn 1.0.99",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b260f13d3012071dfb1512849c033b1925038373aea48ced3012c09df952c602"
+dependencies = [
+ "quote 1.0.21",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be8e654bdd9b79216c2929ab90721aa82faf65c48cdf08bdc4e7f51357b80da"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.21",
+ "syn 1.0.99",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6598dd0bd3c7d51095ff6531a5b23e02acdc81804e30d8f07afb77b7215a140a"
+
 [[package]]
 name = "which"
 version = "4.2.5"
@ -1760,6 +2089,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "widestring"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17882f045410753661207383517a6f62ec3dbeb6a4ed2acce01f0728238d1983"
+
 [[package]]
 name = "win_util"
 version = "0.1.0"
@ -1787,6 +2122,15 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"

+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
@ -1816,7 +2160,7 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f757e7665f81f33ace9f89b0f0fc3a7c770e24ff4fa1475c6503bb35b4524893"
 dependencies = [
- "syn",
+ "syn 1.0.99",
 "windows_gen",
 ]

@ -1825,8 +2169,22 @@ name = "wire_format_derive"
 version = "0.1.0"
 dependencies = [
 "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.21",
+ "syn 1.0.99",
+]
+
+[[package]]
+name = "wmi"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "757a458f9bfab0542c11feed99bd492cbe23add50515bd8eecf8c6973673d32d"
+dependencies = [
+ "chrono",
+ "log",
+ "serde",
+ "thiserror",
+ "widestring",
+ "winapi",
 ]

 [[package]]
@ -1846,6 +2204,7 @@ dependencies = [
 "kernel_loader",
 "libc",
 "minijail",
+ "once_cell",
 "remain",
 "resources",
 "sync",
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@ -1,19 +1,28 @@
 { stdenv, lib, rustPlatform, fetchgit
-, minijail-tools, pkg-config, wayland-scanner
+, minijail-tools, pkg-config, protobuf, wayland-scanner
 , libcap, libdrm, libepoxy, minijail, virglrenderer, wayland, wayland-protocols
 }:

-rustPlatform.buildRustPackage rec {
-  pname = "crosvm";
-  version = "103.3";
-
+let
  src = fetchgit {
    url = "https://chromium.googlesource.com/crosvm/crosvm";
-    rev = "e7db3a5cc78ca90ab06aadd5f08bb151090269b6";
-    sha256 = "0hyz0mg5fn6hi97awfpxfykgv68m935r037sdf85v3vcwjy5n5ki";
+    rev = "265aab613b1eb31598ea0826f04810d9f010a2c6";
+    sha256 = "OzbtPHs6BWK83RZ/6eCQHA61X6SY8FoBkaN70a37pvc=";
    fetchSubmodules = true;
  };

+  # use vendored virglrenderer
+  virglrenderer' = virglrenderer.overrideAttrs (oa: {
+    src = "${src}/third_party/virglrenderer";
+  });
+in
+
+rustPlatform.buildRustPackage rec {
+  pname = "crosvm";
+  version = "104.0";
+
+  inherit src;
+
  separateDebugInfo = true;

  patches = [
@ -22,10 +31,10 @@ rustPlatform.buildRustPackage rec {

  cargoLock.lockFile = ./Cargo.lock;

-  nativeBuildInputs = [ minijail-tools pkg-config wayland-scanner ];
+  nativeBuildInputs = [ minijail-tools pkg-config protobuf wayland-scanner ];

  buildInputs = [
-    libcap libdrm libepoxy minijail virglrenderer wayland wayland-protocols
+    libcap libdrm libepoxy minijail virglrenderer' wayland wayland-protocols
  ];

  arch = stdenv.hostPlatform.parsed.cpu.name;
@ -43,13 +52,16 @@ rustPlatform.buildRustPackage rec {
        compile_seccomp_policy \
            --default-action trap $policy ''${policy%.policy}.bpf
    done
+
+    substituteInPlace seccomp/$arch/*.policy \
+      --replace "@include $(pwd)/seccomp/$arch/" "@include $out/share/policy/"
  '';

  buildFeatures = [ "default" "virgl_renderer" "virgl_renderer_next" ];

  postInstall = ''
    mkdir -p $out/share/policy/
-    cp -v seccomp/$arch/*.bpf $out/share/policy/
+    cp -v seccomp/$arch/*.{policy,bpf} $out/share/policy/
  '';

  passthru.updateScript = ./update.py;
--- a/pkgs/build-support/dotnet/build-dotnet-module/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenvNoCC, linkFarmFromDrvs, callPackage, nuget-to-nix, writeScript, makeWrapper, fetchurl, xml2, dotnetCorePackages, dotnetPackages, mkNugetSource, mkNugetDeps, cacert, srcOnly, symlinkJoin }:
+{ lib, stdenvNoCC, linkFarmFromDrvs, callPackage, nuget-to-nix, writeShellScript, makeWrapper, fetchurl, xml2, dotnetCorePackages, dotnetPackages, mkNugetSource, mkNugetDeps, cacert, srcOnly, symlinkJoin, coreutils }:

 { name ? "${args.pname}-${args.version}"
 , pname ? name
@ -136,12 +136,14 @@ in stdenvNoCC.mkDerivation (args // {

    fetch-deps = let
      exclusions = dotnet-sdk.passthru.packages { fetchNuGet = attrs: attrs.pname; };
-    in writeScript "fetch-${pname}-deps" ''
+    in writeShellScript "fetch-${pname}-deps" ''
      set -euo pipefail
+      export PATH="${lib.makeBinPath [ coreutils dotnet-sdk nuget-to-nix ]}"
+
      cd "$(dirname "''${BASH_SOURCE[0]}")"

      export HOME=$(mktemp -d)
-      deps_file="/tmp/${pname}-deps.nix"
+      deps_file="''${1:-/tmp/${pname}-deps.nix}"

      store_src="${srcOnly args}"
      src="$(mktemp -d /tmp/${pname}.XXX)"
@ -157,7 +159,7 @@ in stdenvNoCC.mkDerivation (args // {
      mkdir -p "$HOME/nuget_pkgs"

      for project in "${lib.concatStringsSep "\" \"" ((lib.toList projectFile) ++ lib.optionals (testProjectFile != "") (lib.toList testProjectFile))}"; do
-        ${dotnet-sdk}/bin/dotnet restore "$project" \
+        dotnet restore "$project" \
          ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
          -p:ContinuousIntegrationBuild=true \
          -p:Deterministic=true \
@ -169,7 +171,7 @@ in stdenvNoCC.mkDerivation (args // {
      echo "${lib.concatStringsSep "\n" exclusions}" > "$HOME/package_exclusions"

      echo "Writing lockfile..."
-      ${nuget-to-nix}/bin/nuget-to-nix "$HOME/nuget_pkgs" "$HOME/package_exclusions" > "$deps_file"
+      nuget-to-nix "$HOME/nuget_pkgs" "$HOME/package_exclusions" > "$deps_file"
      echo "Succesfully wrote lockfile to: $deps_file"
    '';
  } // args.passthru or {};
--- a/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
+++ b/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
@ -10,7 +10,7 @@ if [ $# -eq 0 ]; then
 fi

 pkgs=$1
-exclusions=$2
+exclusions="${2:-/dev/null}"
 tmpfile=$(mktemp /tmp/nuget-to-nix.XXXXXX)
 trap "rm -f ${tmpfile}" EXIT

--- a/pkgs/data/icons/numix-icon-theme/default.nix
+++ b/pkgs/data/icons/numix-icon-theme/default.nix
@ -1,25 +1,43 @@
-{ lib, stdenvNoCC, fetchFromGitHub, gtk3, gnome-icon-theme, hicolor-icon-theme }:
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gtk3
+, adwaita-icon-theme
+, breeze-icons
+, gnome-icon-theme
+, hicolor-icon-theme
+, gitUpdater
+}:

 stdenvNoCC.mkDerivation rec {
  pname = "numix-icon-theme";
-  version = "21.10.31";
+  version = "22.08.16";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-wyVvXifdbKR2aiBMrki8y/H0khH4eFD1RHVSC+jAT28=";
+    sha256 = "sha256-EveIr5XYyQYhz0AqZQBql3j0LnD8taNdzB/6IV7Mz2k=";
  };

-  nativeBuildInputs = [ gtk3 ];
+  nativeBuildInputs = [
+    gtk3
+  ];

-  propagatedBuildInputs = [ gnome-icon-theme hicolor-icon-theme ];
+  propagatedBuildInputs = [
+    adwaita-icon-theme
+    breeze-icons
+    gnome-icon-theme
+    hicolor-icon-theme
+  ];

  dontDropIconThemeCache = true;

  installPhase = ''
    runHook preInstall

+    substituteInPlace Numix/index.theme --replace Breeze breeze
+
    mkdir -p $out/share/icons
    cp -a Numix{,-Light} $out/share/icons/

@ -30,6 +48,8 @@ stdenvNoCC.mkDerivation rec {
    runHook postInstall
  '';

+  passthru.updateScript = gitUpdater { inherit pname version; };
+
  meta = with lib; {
    description = "Numix icon theme";
    homepage = "https://numixproject.github.io";
--- a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
@ -1,14 +1,31 @@
-{ lib, mkXfceDerivation, exo, gtk3, libsoup, libxfce4ui, libxfce4util, xfce4-panel, glib-networking }:
+{ lib
+, mkXfceDerivation
+, exo
+, glib-networking
+, gtk3
+, libsoup
+, libxfce4ui
+, libxfce4util
+, xfce4-panel
+}:

 mkXfceDerivation {
  category = "apps";
  pname = "xfce4-screenshooter";
-  version = "1.9.10";
+  version = "1.9.11";
  odd-unstable = false;

-  sha256 = "sha256-i3QdQij58JYv3fWdESUeTV0IW3A8RVGNtmuxUc6FUMg=";
+  sha256 = "sha256-sW0SEXypCcly7MlO9lnxHTkYwIiRt+gOME5UQ++Y3JQ=";

-  buildInputs = [ exo gtk3 libsoup libxfce4ui libxfce4util xfce4-panel glib-networking ];
+  buildInputs = [
+    exo
+    glib-networking
+    gtk3
+    libsoup
+    libxfce4ui
+    libxfce4util
+    xfce4-panel
+  ];

  meta = with lib; {
    description = "Screenshot utility for the Xfce desktop";
--- a/pkgs/desktops/xfce/applications/xfdashboard/default.nix
+++ b/pkgs/desktops/xfce/applications/xfdashboard/default.nix
@ -18,11 +18,10 @@
 mkXfceDerivation {
  category = "apps";
  pname = "xfdashboard";
-  version = "0.9.5";
+  version = "1.0.0";
  rev-prefix = "";
-  odd-unstable = false;

-  sha256 = "sha256-nb1zY78MUjEOJF59MYIOY1rxo3JFmzH9yTJVUGsOwOA=";
+  sha256 = "sha256-iC41I0u9id9irUNyjuvRRzSldF3dzRYkaxb/fgptnq4=";

  buildInputs = [
    clutter
--- a/pkgs/desktops/xfce/core/tumbler/default.nix
+++ b/pkgs/desktops/xfce/core/tumbler/default.nix
@ -14,9 +14,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "tumbler";
-  version = "4.16.0";
+  version = "4.16.1";

-  sha256 = "sha256-JLcmYjStF9obDoRHsxnZ1e9HPTeJUVKjnn5Ip1BBmPw=";
+  sha256 = "sha256-f2pCItNHTB0ggovIddpwNWEhaohfxD2otN8x9VfwR4k=";

  buildInputs = [
    ffmpegthumbnailer
--- a/pkgs/development/compilers/llvm/14/compiler-rt/armv7l.patch
+++ b/pkgs/development/compilers/llvm/14/compiler-rt/armv7l.patch
@ -0,0 +1,31 @@
+diff -ur compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake
+--- compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake	2020-03-24 00:01:02.000000000 +0900
+++ compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake	2020-05-10 03:42:00.883450706 +0900
+@@ -37,6 +37,6 @@
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv8m.main armv8.1m.main)
+set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l armv8m.main armv8.1m.main)
+ set(HEXAGON hexagon)
+ set(X86 i386)
+ set(X86_64 x86_64)
+diff -ur compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt
+--- compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt	2020-03-24 00:01:02.000000000 +0900
+++ compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt	2020-05-10 03:44:49.468579650 +0900
+@@ -555,6 +555,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
+set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
+@@ -705,7 +705,7 @@
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+-      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em|armv8m.main|armv8.1m.main)$")
+      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em|armv8m.main|armv8.1m.main)$")
+         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
+         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
+         if(NOT COMPILER_RT_HAS_${arch}_VFP)
--- a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
@ -73,7 +73,8 @@ stdenv.mkDerivation {
    # extra `/`.
    ./normalize-var.patch
  ] # Prevent a compilation error on darwin
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch;
+    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
+    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@ -11,8 +11,8 @@
 let
  version = {
    feature = "17";
-    interim = ".0.3";
-    build = "7";
+    interim = ".0.4";
+    build = "8";
  };

  openjdk = stdenv.mkDerivation {
@ -23,7 +23,7 @@ let
      owner = "openjdk";
      repo = "jdk${version.feature}u";
      rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      sha256 = "qxiKz8HCNZXFdfgfiA16q5z0S65cZE/u7e+QxLlplWo=";
+      sha256 = "drbljLz82ZyK29lIDLPqCkwqpBdgU/7zCTZ0ceeb1SI=";
    };

    nativeBuildInputs = [ pkg-config autoconf unzip ];
--- a/pkgs/development/coq-modules/coq-record-update/default.nix
+++ b/pkgs/development/coq-modules/coq-record-update/default.nix
@ -1,12 +1,13 @@
-{ lib, mkCoqDerivation, coq, version ? null , paco, coq-ext-lib }:
+{ lib, mkCoqDerivation, coq, version ? null }:

 with lib; mkCoqDerivation rec {
  pname = "coq-record-update";
  owner = "tchajed";
  inherit version;
  defaultVersion = with versions; switch coq.coq-version [
-    { case = range "8.10" "8.16";  out = "0.3.0"; }
+    { case = range "8.10" "8.16";  out = "0.3.1"; }
  ] null;
+  release."0.3.1".sha256 = "sha256-DyGxO2tqmYZZluXN6Oy5Tw6fuLMyuyxonj8CCToWKkk=";
  release."0.3.0".sha256 = "1ffr21dd6hy19gxnvcd4if2450iksvglvkd6q5713fajd72hmc0z";
  releaseRev = v: "v${v}";
  buildFlags = "NO_TEST=1";
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "janet";
-  version = "1.23.0";
+  version = "1.24.0";

  src = fetchFromGitHub {
    owner = "janet-lang";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-FQZ9I9ROC1gWGfMCxsNMN3g/arenRtC6LHsOIAKGyuE=";
+    sha256 = "sha256-scc29tS3jiGacHp90tGmn/qnbLscJ4sAOCm8IteXfh4=";
  };

  # This release fails the test suite on darwin, remove when debugged.
--- a/pkgs/development/libraries/cpptoml/default.nix
+++ b/pkgs/development/libraries/cpptoml/default.nix
@ -22,8 +22,6 @@ stdenv.mkDerivation rec {
    "-DCPPTOML_BUILD_EXAMPLES=OFF"
  ];

-  outputs = [ "out" ];
-
  meta = with lib; {
    description = "C++ TOML configuration library";
    homepage = "https://github.com/skystrife/cpptoml";
--- a/pkgs/development/libraries/entt/default.nix
+++ b/pkgs/development/libraries/entt/default.nix
@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
  pname = "entt";
-  version = "3.10.0";
+  version = "3.10.3";

  src = fetchFromGitHub {
    owner = "skypjack";
    repo = "entt";
    rev = "v${version}";
-    sha256 = "sha256-/4lc+/YiLPxrn+7Z67sEapYY0ocLWHPC8yeYD2VI+64=";
+    sha256 = "sha256-pewAwvNRCBS6rm3AmHthiayGfP71lqkAO+x6rT957Xg=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@ -64,8 +64,12 @@ callPackage ./common.nix { inherit stdenv; } {
    # store path than that determined when built (as a source for the
    # bootstrap-tools tarball)
    # Building from a proper gcc staying in the path where it was installed,
-    # libgcc_s will not be at {gcc}/lib, and gcc's libgcc will be found without
+    # libgcc_s will now be at {gcc}/lib, and gcc's libgcc will be found without
    # any special hack.
+    # TODO: remove this hack. Things that rely on this hack today:
+    # - dejagnu: during linux bootstrap tcl SIGSEGVs
+    # - clang-wrapper in cross-compilation
+    # Last attempt: https://github.com/NixOS/nixpkgs/pull/36948
    preInstall = ''
      if [ -f ${stdenv.cc.cc}/lib/libgcc_s.so.1 ]; then
          mkdir -p $out/lib
--- a/pkgs/development/libraries/hmat-oss/default.nix
+++ b/pkgs/development/libraries/hmat-oss/default.nix
@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, blas
+, lapack
+}:
+
+
+stdenv.mkDerivation rec {
+  pname = "hmat-oss";
+  version = "1.7.1";
+
+  src = fetchFromGitHub {
+    owner = "jeromerobert";
+    repo = "hmat-oss";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-Xc8AbeyEtM6R5I4HdgF4XR5/b8ZYBOv34kY1xrYk/Jw=";
+  };
+
+  cmakeFlags = [
+    "-DHMAT_GIT_VERSION=OFF"
+  ];
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ blas lapack ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "A hierarchical matrix C/C++ library";
+    homepage = "https://github.com/jeromerobert/hmat-oss";
+    license = licenses.gpl2;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ gdinh ];
+  };
+}
--- a/pkgs/development/libraries/ldns/default.nix
+++ b/pkgs/development/libraries/ldns/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ldns";
-  version = "1.8.1";
+  version = "1.8.3";

  src = fetchurl {
    url = "https://www.nlnetlabs.nl/downloads/ldns/${pname}-${version}.tar.gz";
-    sha256 = "sha256-lYIpq85NOqoZp1wNEnZmVksXIWkCGG6VLKSu9Hxtf6M=";
+    sha256 = "sha256-w/ct0QNrKQfjpW5qz537LlUSVrPBu9l4eULe7rcOeGA=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/libbdplus/default.nix
+++ b/pkgs/development/libraries/libbdplus/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "libbdplus";
-  version  = "0.1.2";
+  version  = "0.2.0";

  src = fetchurl {
    url = "http://get.videolan.org/libbdplus/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "02n87lysqn4kg2qk7d1ffrp96c44zkdlxdj0n16hbgrlrpiwlcd6";
+    sha256 = "sha256-uT7qPq7zPW6RVdLDSwaMUFSTqlpJNuYydPQ0KrD0Clg=";
  };

  buildInputs = [ libgcrypt libgpg-error gettext ];
--- a/pkgs/development/libraries/libportal/default.nix
+++ b/pkgs/development/libraries/libportal/default.nix
@ -30,11 +30,13 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-wDDE43UC6FBgPYLS+WWExeheURCH/3fCKu5oJg7GM+A=";
  };

+  # TODO: remove on 0.7
  patches = [
+    # https://github.com/flatpak/libportal/pull/107
    (fetchpatch {
-      name = "fix-build-on-darwin.patch";
-      url = "https://github.com/flatpak/libportal/pull/106/commits/73f63ee57669c4fa604a7772484cd235d4fb612c.patch";
-      sha256 = "sha256-c9WUQPhn4IA3X1ie7SwnxuZXdvpPkpGdU4xgDwKN/L0=";
+      name = "check-presence-of-sys-vfs-h.patch";
+      url = "https://github.com/flatpak/libportal/commit/e91a5d2ceb494ca0dd67295736e671b0142c7540.patch";
+      sha256 = "sha256-uFyhlU2fJgW4z0I31fABdc+pimLFYkqM4lggSIFs1tw=";
    })
  ];

--- a/pkgs/development/libraries/libyang/default.nix
+++ b/pkgs/development/libraries/libyang/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "libyang";
-  version = "2.0.194";
+  version = "2.0.231";

  src = fetchFromGitHub {
    owner = "CESNET";
    repo = "libyang";
    rev = "v${version}";
-    sha256 = "sha256-5dgSBXJIeGXT+jGqT2MFqtsEFcIn+ULjybnyXz+95Gk=";
+    sha256 = "sha256-IntucM8ABJsJNH7XnZ59McwmfSIimclrWzSz4NKdMrE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libzip/default.nix
+++ b/pkgs/development/libraries/libzip/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "libzip";
-  version = "1.8.0";
+  version = "1.9.2";

  src = fetchurl {
    url = "https://libzip.org/download/${pname}-${version}.tar.gz";
-    sha256 = "17l3ygrnbszm3b99dxmw94wcaqpbljzg54h4c0y8ss8aij35bvih";
+    sha256 = "sha256-/Wp/dF3j1pz1YD7cnLM9KJDwGY5BUlXQmHoM8Q2CTG8=";
  };

  outputs = [ "out" "dev" "man" ];
--- a/pkgs/development/libraries/nanoflann/default.nix
+++ b/pkgs/development/libraries/nanoflann/default.nix
@ -1,14 +1,14 @@
 {lib, stdenv, fetchFromGitHub, cmake}:

 stdenv.mkDerivation rec {
-  version = "1.4.2";
+  version = "1.4.3";
  pname = "nanoflann";

  src = fetchFromGitHub {
    owner = "jlblancoc";
    repo = "nanoflann";
    rev = "v${version}";
-    sha256 = "sha256-znIX1S0mfOqLYPIcyVziUM1asBjENPEAdafLud1CfFI=";
+    sha256 = "sha256-NcewcNQcI1CjMNibRF9HCoE2Ibs0/Hy4eOkJ20W3wLo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@ -5,6 +5,6 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert

 import ./generic.nix {
-  version = "3.81";
-  hash = "sha256-qL9fO7YXBo1X57FfPZ1SjxCa8NV98uqrBRm2Qj7czKY=";
+  version = "3.82";
+  hash = "sha256-Mr9nO3LC+ZU+07THAzq/WmytMChUokrliMV1plZ8FXM=";
 }
--- a/pkgs/development/libraries/physics/geant4/default.nix
+++ b/pkgs/development/libraries/physics/geant4/default.nix
@ -88,11 +88,11 @@ stdenv.mkDerivation rec {
  ];
  dontWrapQtApps = true; # no binaries

-  buildInputs = [ clhep libGLU xlibsWrapper libXmu ]
+  buildInputs = [ libGLU xlibsWrapper libXmu ]
    ++ lib.optionals enableInventor [ libXpm coin3d soxt motif ]
    ++ lib.optionals enablePython [ boost_python python3 ];

-  propagatedBuildInputs = [ expat xercesc zlib libGL ]
+  propagatedBuildInputs = [ clhep expat xercesc zlib libGL ]
    ++ lib.optionals enableXM [ motif ]
    ++ lib.optionals enableQt [ qtbase ];

--- a/pkgs/development/libraries/pugixml/default.nix
+++ b/pkgs/development/libraries/pugixml/default.nix
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-Udjx84mhLPJ1bU5WYDo73PAeeufS+vBLXZP0YbBvqLE=";
  };

-  outputs = if shared then [ "out" "dev" ] else [ "out" ];
+  outputs = [ "out" ] ++ lib.optionals shared [ "dev" ];

  nativeBuildInputs = [ cmake validatePkgConfig ];

--- a/pkgs/development/libraries/socket_wrapper/default.nix
+++ b/pkgs/development/libraries/socket_wrapper/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "socket_wrapper";
-  version = "1.3.3";
+  version = "1.3.4";

  src = fetchurl {
    url = "mirror://samba/cwrap/socket_wrapper-${version}.tar.gz";
-    sha256 = "sha256-G42i+w7n3JkPvOc039I+frzDnq1GGGyQqUkMFdoebhM=";
+    sha256 = "sha256-dmYeXGXbe05WiT2ZDrH4aCmymDjj8SqrZyEc3d0Uf0Y=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/spectra/default.nix
+++ b/pkgs/development/libraries/spectra/default.nix
@ -0,0 +1,30 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, eigen
+}:
+
+stdenv.mkDerivation rec {
+  pname = "spectra";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "yixuan";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-HaJmMo4jYmO/j53/nHrL3bvdQMAvp4Nuhhe8Yc7pL88=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  propagatedBuildInputs = [ eigen ];
+
+  meta = with lib; {
+    homepage = "https://spectralib.org/";
+    description = "A C++ library for large scale eigenvalue problems, built on top of Eigen";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ vonfry ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/ocaml-modules/cmdliner/1_1.nix
+++ b/pkgs/development/ocaml-modules/cmdliner/1_1.nix
@ -1,5 +1,8 @@
 { lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, result }:

+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.08")
+  "cmdliner 1.1 is not available for OCaml ${ocaml.version}"
+
 stdenv.mkDerivation rec {
  pname = "cmdliner";
  version = "1.1.1";
@ -9,7 +12,6 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-oa6Hw6eZQO+NHdWfdED3dtHckm4BmEbdMiAuRkYntfs=";
  };

-  minimalOCamlVersion = "4.08";
  nativeBuildInputs = [ ocaml ];

  makeFlags = [ "PREFIX=$(out)" ];
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, unzip, lib, php }:
 let
  pname = "composer";
-  version = "2.3.10";
+  version = "2.4.0";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://getcomposer.org/download/${version}/composer.phar";
-    sha256 = "2AgnLyhPqOD4tHBwPhQ4rI82IDC7ydEuKVMCd9dnr/A=";
+    sha256 = "HNx090llkI0OmNAP7so3wjuG2lEXCjoRoVONif9E1N0=";
  };

  dontUnpack = true;
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "adafruit-platformdetect";
-  version = "3.27.0";
+  version = "3.27.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -15,7 +15,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "Adafruit-PlatformDetect";
    inherit version;
-    hash = "sha256-Ez3VQO52GgPhTXr1xlxr4BvouI41PVzppkutiqVjrUI=";
+    hash = "sha256-HAymQ08RauE8oATYzKE+UaqMsmNK3O+VyLLd6w/jPFc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aiocoap/default.nix
+++ b/pkgs/development/python-modules/aiocoap/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "aiocoap";
-  version = "0.4.3";
+  version = "0.4.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "chrysn";
    repo = pname;
    rev = version;
-    sha256 = "sha256-fTRDx9VEXDoMKM78YYL+mBEdvhbLtHiHdo66kwRnNhA=";
+    sha256 = "sha256-m/tU1qf+CB9/2eoXktpBSgwjj8lMuMQ/WGYL6HhMNxA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/asdf/default.nix
+++ b/pkgs/development/python-modules/asdf/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage rec {
  pname = "asdf";
-  version = "2.12.0";
+  version = "2.12.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-WRSDTQd7o79ouar9xka58nzl5W4cJBFn1GHe5DsQI+k=";
+    hash = "sha256-0qXRYWXKC17JiL1D+jjuGVoOGAJuGbJje7OZyd2k3o8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/backports-cached-property/default.nix
+++ b/pkgs/development/python-modules/backports-cached-property/default.nix
@ -0,0 +1,46 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder
+, setuptools-scm, wheel
+, pytestCheckHook, pytest-mock, pytest-sugar
+}:
+
+buildPythonPackage rec {
+  pname = "backports-cached-property";
+  version = "1.0.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "penguinolog";
+    repo = "backports.cached_property";
+    rev = version;
+    sha256 = "sha256-rdgKbVQaELilPrN4ve8RbbaLiT14Xex0esy5vUX2ZBc=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    wheel
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-mock
+    pytest-sugar
+  ];
+
+  pythonImportsCheck = [
+    "backports.cached_property"
+  ];
+
+  meta = with lib; {
+    description = "Python 3.8 functools.cached_property backport to python 3.6";
+    homepage = "https://github.com/penguinolog/backports.cached_property";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
--- a/pkgs/development/python-modules/bluetooth-adapters/default.nix
+++ b/pkgs/development/python-modules/bluetooth-adapters/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "bluetooth-adapters";
-  version = "0.1.3";
+  version = "0.2.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-c96HgcmyiDwvcq8OsZ5s65VmAihz6KtCviP2h6Iu1Fo=";
+    hash = "sha256-S6ZTUGBLCZ4gaiKTxC8xa4KDBl/zoZQ2vlFuXdcwLmk=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/censys/default.nix
+++ b/pkgs/development/python-modules/censys/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "censys";
-  version = "2.1.7";
+  version = "2.1.8";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "censys";
    repo = "censys-python";
    rev = "v${version}";
-    hash = "sha256-1GJef+6Aqah9W9yPwqD8QCh0sNn/X9UwlzmsCk51QMY=";
+    hash = "sha256-iPCFflibEqA286j+7Vp4ZQaO9e6Bp+o7A/a7DELJcxA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cwcwidth/default.nix
+++ b/pkgs/development/python-modules/cwcwidth/default.nix
@ -2,12 +2,12 @@

 buildPythonPackage rec {
  pname = "cwcwidth";
-  version = "0.1.6";
+  version = "0.1.7";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1b31da599c9f0cf41f39ed10c1ceaa01d6024e31c6cd9aea2885b1f2a6d15fba";
+    sha256 = "sha256-wNZH4S46SxWogeHYT3lpN1FmSEieARJXI33CF51rGVE=";
  };

  nativeBuildInputs = [ cython ];
--- a/pkgs/development/python-modules/discordpy/default.nix
+++ b/pkgs/development/python-modules/discordpy/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "discord.py";
-  version = "1.7.3";
+  version = "2.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "Rapptz";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-eKXCzGFSzxpdZed4/4G6uJ96s5yCm6ci8K8XYR1zQlE=";
+    sha256 = "sha256-BhxXsNRgs/ihnlTxNwYTjRwPvneyDF8Q0wS3qr2BG9Q=";
  };

  propagatedBuildInputs = [
@ -34,8 +34,6 @@ buildPythonPackage rec {
  patchPhase = ''
    substituteInPlace "discord/opus.py" \
      --replace "ctypes.util.find_library('opus')" "'${libopus}/lib/libopus.so.0'"
-    substituteInPlace requirements.txt \
-      --replace "aiohttp>=3.6.0,<3.8.0" "aiohttp>=3.6.0,<4"
  '' + lib.optionalString withVoice ''
    substituteInPlace "discord/player.py" \
      --replace "executable='ffmpeg'" "executable='${ffmpeg}/bin/ffmpeg'"
--- a/pkgs/development/python-modules/ezyrb/default.nix
+++ b/pkgs/development/python-modules/ezyrb/default.nix
@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, future
+, numpy
+, scipy
+, matplotlib
+, scikit-learn
+, pytorch
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "ezyrb";
+  version = "1.3.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "mathLab";
+    repo = "EZyRB";
+    rev = "v${version}";
+    sha256 = "sha256-tFkz+j97m+Bgk/87snQMXtgZnykiWYyWJJLaqwRKiaY=";
+  };
+
+  propagatedBuildInputs = [
+    future
+    numpy
+    scipy
+    matplotlib
+    scikit-learn
+    pytorch
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "ezyrb"
+  ];
+
+  disabledTestPaths = [
+    # Exclude long tests
+    "tests/test_podae.py"
+  ];
+
+  meta = with lib; {
+    description = "Easy Reduced Basis method";
+    homepage = "https://mathlab.github.io/EZyRB/";
+    downloadPage = "https://github.com/mathLab/EZyRB/releases";
+    license = licenses.mit;
+    maintainers = with maintainers; [ yl3dy ];
+  };
+}
--- a/pkgs/development/python-modules/fipy/default.nix
+++ b/pkgs/development/python-modules/fipy/default.nix
@ -3,27 +3,27 @@
 , numpy
 , scipy
 , pyamg
-, pysparse
 , future
 , matplotlib
 , tkinter
 , mpi4py
 , scikit-fmm
-, isPy27
 , gmsh
 , python
 , stdenv
 , openssh
-, fetchurl
+, fetchFromGitHub
 }:

 buildPythonPackage rec {
  pname = "fipy";
-  version = "3.4.2.1";
+  version = "3.4.3";

-  src = fetchurl {
-    url = "https://github.com/usnistgov/fipy/releases/download/${version}/FiPy-${version}.tar.gz";
-    sha256 = "0v5yk9b4hksy3176w4vm4gagb9kxqgv75zcyswlqvl371qwy1grk";
+  src = fetchFromGitHub {
+    owner = "usnistgov";
+    repo = "fipy";
+    rev = version;
+    sha256 = "sha256-oTg/5fGXqknWBh1ShdAOdOwX7lVDieIoM5aALcOWFqY=";
  };

  propagatedBuildInputs = [
@ -36,14 +36,7 @@ buildPythonPackage rec {
    future
    scikit-fmm
    openssh
-  ] ++ lib.optionals isPy27 [ pysparse ]
-  ++ lib.optionals (!stdenv.isDarwin) [ gmsh ];
-
-  # Reading version string from Gmsh is broken in latest release of FiPy
-  # This issue is repaired on master branch of FiPy
-  # Fixed with: https://github.com/usnistgov/fipy/pull/848/files
-  # Remove patch with next release.
-  patches = [ ./gmsh.patch ];
+  ] ++ lib.optionals (!stdenv.isDarwin) [ gmsh ];

  checkInputs = lib.optionals (!stdenv.isDarwin) [ gmsh ];

@ -52,6 +45,8 @@ buildPythonPackage rec {
    ${python.interpreter} setup.py test --modules
  '';

+  pythonImportsCheck = [ "fipy" ];
+
  meta = with lib; {
    homepage = "https://www.ctcms.nist.gov/fipy/";
    description = "A Finite Volume PDE Solver Using Python";
--- a/pkgs/development/python-modules/fipy/gmsh.patch
+++ b/pkgs/development/python-modules/fipy/gmsh.patch
@ -1,182 +0,0 @@
-diff --git a/fipy/meshes/gmshMesh.py b/fipy/meshes/gmshMesh.py
-index fc3ff6c8..d529d532 100755
--- a/fipy/meshes/gmshMesh.py
-+++ b/fipy/meshes/gmshMesh.py
-@@ -13,11 +13,11 @@ import sys
- import tempfile
- from textwrap import dedent
- import warnings
-from distutils.version import StrictVersion
- 
- from fipy.tools import numerix as nx
- from fipy.tools import parallelComm
- from fipy.tools import serialComm
-+from fipy.tools.version import Version, parse_version
- from fipy.tests.doctestPlus import register_skipper
- 
- from fipy.meshes.mesh import Mesh
-@@ -38,7 +38,7 @@ def _checkForGmsh():
-     hasGmsh = True
-     try:
-         version = _gmshVersion(communicator=parallelComm)
-        hasGmsh = version >= StrictVersion("2.0")
-+        hasGmsh = version >= Version("2.0")
-     except Exception:
-         hasGmsh = False
-     return hasGmsh
-@@ -68,6 +68,7 @@ def gmshVersion(communicator=parallelComm):
-         while True:
-             try:
-                 # gmsh returns version in stderr (Why?!?)
-+                # (newer versions of gmsh return the version in stdout)
-                 # spyder on Windows throws
-                 #   OSError: [WinError 6] The handle is invalid
-                 # if we don't PIPE stdout, too
-@@ -77,8 +78,11 @@ def gmshVersion(communicator=parallelComm):
-                 break
- 
-             try:
-                out, verStr = p.communicate()
-                verStr = verStr.decode('ascii').strip()
-+                out, err = p.communicate()
-+                verStr = err.decode('ascii').strip()
-+                if not verStr:
-+                    # newer versions of gmsh return the version in stdout
-+                    verStr = out.decode('ascii').strip()
-                 break
-             except IOError:
-                 # some weird conflict with things like PyQT can cause
-@@ -93,12 +97,12 @@ def gmshVersion(communicator=parallelComm):
- def _gmshVersion(communicator=parallelComm):
-     version = gmshVersion(communicator) or "0.0"
-     try:
-        version = StrictVersion(version)
-+        version = parse_version(version)
-     except ValueError:
-         # gmsh returns the version string in stderr,
-         # which means it's often unparsable due to irrelevant warnings
-         # assume it's OK and move on
-        version = StrictVersion("3.0")
-+        version = Version("3.0")
- 
-     return version
- 
-@@ -133,7 +137,7 @@ def openMSHFile(name, dimensions=None, coordDimensions=None, communicator=parall
- 
-     # Enforce gmsh version to be either >= 2 or 2.5, based on Nproc.
-     version = _gmshVersion(communicator=communicator)
-    if version < StrictVersion("2.0"):
-+    if version < Version("2.0"):
-         raise EnvironmentError("Gmsh version must be >= 2.0.")
- 
-     # If we're being passed a .msh file, leave it be. Otherwise,
-@@ -176,9 +180,11 @@ def openMSHFile(name, dimensions=None, coordDimensions=None, communicator=parall
-             gmshFlags = ["-%d" % dimensions, "-nopopup"]
- 
-             if communicator.Nproc > 1:
-                if not (StrictVersion("2.5") < version <= StrictVersion("4.0")):
-                    warnstr = "Cannot partition with Gmsh version < 2.5 or >= 4.0. " \
-                               + "Reverting to serial."
-+                if  ((version < Version("2.5"))
-+                     or (Version("4.0") <= version < Version("4.5.2"))):
-+                    warnstr = ("Cannot partition with Gmsh version < 2.5 "
-+                               "or 4.0 <= version < 4.5.2. "
-+                               "Reverting to serial.")
-                     warnings.warn(warnstr, RuntimeWarning, stacklevel=2)
-                     communicator = serialComm
- 
-@@ -188,13 +194,13 @@ def openMSHFile(name, dimensions=None, coordDimensions=None, communicator=parall
-                         raise ValueError("'dimensions' must be specified to generate a mesh from a geometry script")
-                 else: # gmsh version is adequate for partitioning
-                     gmshFlags += ["-part", "%d" % communicator.Nproc]
-                    if version >= StrictVersion("4.0"):
-+                    if version >= Version("4.0"):
-                         # Gmsh 4.x needs to be told to generate ghost cells
-                        # Unfortunately, the ghosts are broken
-+                        # Unfortunately, the ghosts are broken in Gmsh 4.0--4.5.1
-                         # https://gitlab.onelab.info/gmsh/gmsh/issues/733
-                         gmshFlags += ["-part_ghosts"]
- 
-            gmshFlags += ["-format", "msh2"]
-+            gmshFlags += ["-format", "msh2", "-smooth", "8"]
- 
-             if background is not None:
-                 if communicator.procID == 0:
-@@ -1387,6 +1393,11 @@ class _GmshTopology(_MeshTopology):
- class Gmsh2D(Mesh2D):
-     """Construct a 2D Mesh using Gmsh
- 
-+    If called in parallel, the mesh will be partitioned based on the value
-+    of `parallelComm.Nproc`.  If an `MSH` file is supplied, it must have
-+    been previously partitioned with the number of partitions matching
-+    `parallelComm.Nproc`.
-+
-     >>> radius = 5.
-     >>> side = 4.
-     >>> squaredCircle = Gmsh2D('''
-@@ -1875,6 +1886,11 @@ class Gmsh2D(Mesh2D):
- class Gmsh2DIn3DSpace(Gmsh2D):
-     """Create a topologically 2D Mesh in 3D coordinates using Gmsh
- 
-+    If called in parallel, the mesh will be partitioned based on the value
-+    of `parallelComm.Nproc`.  If an `MSH` file is supplied, it must have
-+    been previously partitioned with the number of partitions matching
-+    `parallelComm.Nproc`.
-+
-     Parameters
-     ----------
-     arg : str
-@@ -1959,6 +1975,11 @@ class Gmsh2DIn3DSpace(Gmsh2D):
- class Gmsh3D(Mesh):
-     """Create a 3D Mesh using Gmsh
- 
-+    If called in parallel, the mesh will be partitioned based on the value
-+    of `parallelComm.Nproc`.  If an `MSH` file is supplied, it must have
-+    been previously partitioned with the number of partitions matching
-+    `parallelComm.Nproc`.
-+
-     Parameters
-     ----------
-     arg : str
-@@ -2225,7 +2246,7 @@ class GmshGrid2D(Gmsh2D):
-         width  = nx * dx
-         numLayers = int(ny / float(dy))
- 
-        if _gmshVersion() < StrictVersion("2.7"):
-+        if _gmshVersion() < Version("2.7"):
-             # kludge: must offset cellSize by `eps` to work properly
-             eps = float(dx)/(nx * 10)
-         else:
-@@ -2299,7 +2320,7 @@ class GmshGrid3D(Gmsh3D):
-         width  = nx * dx
-         depth  = nz * dz
- 
-        if _gmshVersion() < StrictVersion("2.7"):
-+        if _gmshVersion() < Version("2.7"):
-             # kludge: must offset cellSize by `eps` to work properly
-             eps = float(dx)/(nx * 10)
-         else:
-diff --git a/fipy/tools/version.py b/fipy/tools/version.py
-new file mode 100644
-index 00000000..93d89c18
--- /dev/null
-+++ b/fipy/tools/version.py
-@@ -0,0 +1,18 @@
-+"""Shim for version checking
-+
-+`distutils.version` is deprecated, but `packaging.version` is unavailable
-+in Python 2.7
-+"""
-+from __future__ import unicode_literals
-+
-+__docformat__ = 'restructuredtext'
-+
-+
-+__all__ = ["Version", "parse_version"]
-+from future.utils import text_to_native_str
-+__all__ = [text_to_native_str(n) for n in __all__]
-+
-+try:
-+    from packaging.version import Version, parse as parse_version
-+except ImportError:
-+    from distutils.version import StrictVersion as Version, StrictVersion as parse_version    
--- a/pkgs/development/python-modules/grpclib/default.nix
+++ b/pkgs/development/python-modules/grpclib/default.nix
@ -0,0 +1,51 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, pythonOlder
+, h2
+, multidict
+, pytestCheckHook
+, pytest-asyncio
+, async-timeout
+, faker
+, googleapis-common-protos
+, certifi
+}:
+let
+  pname = "grpclib";
+  version = "0.4.3";
+in
+buildPythonPackage {
+  inherit pname version;
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "vmagamedov";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-zjctvsuX5yJl1EXIAaiukWGYJbdgU7OZllgOYAmp1b4=";
+  };
+
+  propagatedBuildInputs = [
+    h2
+    multidict
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    async-timeout
+    faker
+    googleapis-common-protos
+    certifi
+  ];
+
+  pythonImportsCheck = [ "grpclib" ];
+
+  meta = with lib; {
+    description = "Pure-Python gRPC implementation for asyncio";
+    homepage = "https://github.com/vmagamedov/grpclib";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ nikstur ];
+  };
+}
--- a/pkgs/development/python-modules/humanize/default.nix
+++ b/pkgs/development/python-modules/humanize/default.nix
@ -11,7 +11,7 @@
 }:

 buildPythonPackage rec {
-  version = "4.2.3";
+  version = "4.3.0";
  pname = "humanize";
  format = "pyproject";

@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "python-humanize";
    repo = pname;
    rev = version;
-    hash = "sha256-cAlNtN9sUnDAkCQj2bJfT72B2TQDYRBB4P4NJY9mUU0=";
+    hash = "sha256-sccv3HtCgG/znZs/sfmeeOHK3xchv9zRrNX/SxyEbCQ=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@ -8,9 +8,11 @@
 , binutils
 , buildBazelPackage
 , buildPythonPackage
+, cctools
 , cython
 , fetchFromGitHub
 , git
+, IOKit
 , jsoncpp
 , pybind11
 , setuptools
@ -55,8 +57,11 @@ let
    homepage = "https://github.com/google/jax";
    license = licenses.asl20;
    maintainers = with maintainers; [ ndl ];
-    platforms = [ "x86_64-linux" "aarch64-darwin" "x86_64-darwin"];
-    hydraPlatforms = ["x86_64-linux" ]; # Don't think anybody is checking the darwin builds
+    platforms = platforms.unix;
+    # aarch64-darwin is broken because of https://github.com/bazelbuild/rules_cc/pull/136
+    # however even with that fix applied, it doesn't work for everyone:
+    # https://github.com/NixOS/nixpkgs/pull/184395#issuecomment-1207287129
+    broken = stdenv.isAarch64;
  };

  cudatoolkit_joined = symlinkJoin {
@ -117,6 +122,8 @@ let
    ] ++ lib.optionals cudaSupport [
      cudatoolkit
      cudnn
+    ] ++ lib.optionals stdenv.isDarwin [
+      IOKit
    ];

    postPatch = ''
@ -201,9 +208,7 @@ let

    # Make sure Bazel knows about our configuration flags during fetching so that the
    # relevant dependencies can be downloaded.
-    bazelFetchFlags = bazel-build.bazelBuildFlags;
-
-    bazelBuildFlags = [
+    bazelFlags = [
      "-c opt"
    ] ++ lib.optional (stdenv.targetPlatform.isx86_64 && stdenv.targetPlatform.isUnix) [
      "--config=avx_posix"
@ -211,6 +216,11 @@ let
      "--config=cuda"
    ] ++ lib.optional mklSupport [
      "--config=mkl_open_source_only"
+    ] ++ lib.optionals stdenv.cc.isClang [
+      # bazel depends on the compiler frontend automatically selecting these flags based on file
+      # extension but our clang doesn't.
+      # https://github.com/NixOS/nixpkgs/issues/150655
+      "--cxxopt=-x" "--cxxopt=c++" "--host_cxxopt=-x" "--host_cxxopt=c++"
    ];

    fetchAttrs = {
@ -218,7 +228,7 @@ let
        if cudaSupport then
          "sha256-Ald+vplRx/DDG/7TfHAqD4Gktb1BGnf7FSCCJzSI0eo="
        else
-          "sha256-6acSbBNcUBw177HMVOmpV7pUfP1aFSe5cP6/zWFdGFo=";
+          "sha256-eK5IjTAncDarkWYKnXrEo7kw7J7iOH7in2L2GabnFYo=";
    };

    buildAttrs = {
@ -226,8 +236,8 @@ let

      # Note: we cannot do most of this patching at `patch` phase as the deps are not available yet.
      # 1) Fix pybind11 include paths.
-      # 2) Force static protobuf linkage to prevent crashes on loading multiple extensions
-      #    in the same python program due to duplicate protobuf DBs.
+      # 2) Link protobuf from nixpkgs (through TF_SYSTEM_LIBS when using gcc) to prevent crashes on
+      #    loading multiple extensions in the same python program due to duplicate protobuf DBs.
      # 3) Patch python path in the compiler driver.
      # 4) Patch tensorflow sources to work with later versions of protobuf. See
      #    https://github.com/google/jax/issues/9534. Note that this should be
@ -236,13 +246,25 @@ let
        for src in ./jaxlib/*.{cc,h}; do
          sed -i 's@include/pybind11@pybind11@g' $src
        done
-        sed -i 's@-lprotobuf@-l:libprotobuf.a@' ../output/external/org_tensorflow/third_party/systemlibs/protobuf.BUILD
-        sed -i 's@-lprotoc@-l:libprotoc.a@' ../output/external/org_tensorflow/third_party/systemlibs/protobuf.BUILD
        substituteInPlace ../output/external/org_tensorflow/tensorflow/compiler/xla/python/pprof_profile_builder.cc \
          --replace "status.message()" "std::string{status.message()}"
+        substituteInPlace ../output/external/rules_cc/cc/private/toolchain/osx_cc_wrapper.sh.tpl \
+          --replace "/usr/bin/install_name_tool" "${cctools}/bin/install_name_tool"
+        substituteInPlace ../output/external/rules_cc/cc/private/toolchain/unix_cc_configure.bzl \
+          --replace "/usr/bin/libtool" "${cctools}/bin/libtool"
      '' + lib.optionalString cudaSupport ''
        patchShebangs ../output/external/org_tensorflow/third_party/gpus/crosstool/clang/bin/crosstool_wrapper_driver_is_not_gcc.tpl
-      '';
+      '' + lib.optionalString stdenv.isDarwin ''
+        # Framework search paths aren't added by bintools hook
+        # https://github.com/NixOS/nixpkgs/pull/41914
+        export NIX_LDFLAGS+=" -F${IOKit}/Library/Frameworks"
+      '' + (if stdenv.cc.isGNU then ''
+        sed -i 's@-lprotobuf@-l:libprotobuf.a@' ../output/external/org_tensorflow/third_party/systemlibs/protobuf.BUILD
+        sed -i 's@-lprotoc@-l:libprotoc.a@' ../output/external/org_tensorflow/third_party/systemlibs/protobuf.BUILD
+      '' else if stdenv.cc.isClang then ''
+        sed -i 's@-lprotobuf@${pkgs.protobuf}/lib/libprotobuf.a@' ../output/external/org_tensorflow/third_party/systemlibs/protobuf.BUILD
+        sed -i 's@-lprotoc@${pkgs.protobuf}/lib/libprotoc.a@' ../output/external/org_tensorflow/third_party/systemlibs/protobuf.BUILD
+      '' else throw "Unsupported stdenv.cc: ${stdenv.cc}");

      installPhase = ''
        ./bazel-bin/build/build_wheel --output_path=$out --cpu=${stdenv.targetPlatform.linuxArch}
@ -251,13 +273,21 @@ let

    inherit meta;
  };
+  platformTag =
+    if stdenv.targetPlatform.isLinux then
+      "manylinux2010_${stdenv.targetPlatform.linuxArch}"
+    else if stdenv.system == "x86_64-darwin" then
+      "macosx_10_9_${stdenv.targetPlatform.linuxArch}"
+    else if stdenv.system == "aarch64-darwin" then
+      "macosx_11_0_${stdenv.targetPlatform.linuxArch}"
+    else throw "Unsupported target platform: ${stdenv.targetPlatform}";

 in
 buildPythonPackage {
  inherit meta pname version;
  format = "wheel";

-  src = "${bazel-build}/jaxlib-${version}-cp${builtins.replaceStrings ["."] [""] python.pythonVersion}-none-manylinux2010_${stdenv.targetPlatform.linuxArch}.whl";
+  src = "${bazel-build}/jaxlib-${version}-cp${builtins.replaceStrings ["."] [""] python.pythonVersion}-none-${platformTag}.whl";

  # Note that cudatoolkit is necessary since jaxlib looks for "ptxas" in $PATH.
  # See https://github.com/NixOS/nixpkgs/pull/164176#discussion_r828801621 for
--- a/pkgs/development/python-modules/js2py/default.nix
+++ b/pkgs/development/python-modules/js2py/default.nix
@ -0,0 +1,37 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, tzlocal
+, six
+, pyjsparser
+}:
+
+buildPythonPackage rec {
+  pname = "js2py";
+  version = "0.71";
+
+  src = fetchFromGitHub {
+    owner = "PiotrDabkowski";
+    repo = "Js2Py";
+    rev = "5f665f60083a9796ec33861240ce31d6d2b844b6";
+    sha256 = "sha256-1omTV7zkYSQfxhkNgI4gtXTenWt9J1r3VARRHoRsSfc=";
+  };
+
+  propagatedBuildInputs = [
+    pyjsparser
+    six
+    tzlocal
+  ];
+
+  # Test require network connection
+  doCheck = false;
+
+  pythonImportsCheck = [ "js2py" ];
+
+  meta = with lib; {
+    description = "JavaScript to Python Translator & JavaScript interpreter written in 100% pure Python";
+    homepage = "https://github.com/PiotrDabkowski/Js2Py";
+    license = licenses.mit;
+    maintainers = with maintainers; [ onny ];
+  };
+}
--- a/pkgs/development/python-modules/lark/default.nix
+++ b/pkgs/development/python-modules/lark/default.nix
@ -4,6 +4,7 @@
 , python
 , regex
 , pytestCheckHook
+, js2py
 }:

 buildPythonPackage rec {
@ -27,10 +28,9 @@ buildPythonPackage rec {
    "lark.grammars"
  ];

-  checkInputs = [ pytestCheckHook ];
-
-  disabledTestPaths = [
-    "tests/test_nearley/test_nearley.py"  # requires unpackaged Js2Py library
+  checkInputs = [
+    js2py
+    pytestCheckHook
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/nbclassic/default.nix
+++ b/pkgs/development/python-modules/nbclassic/default.nix
@ -1,8 +1,8 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
-, python
+, fetchPypi
 , notebook
+, notebook-shim
 , pythonOlder
 , jupyter_server
 , pytestCheckHook
@ -14,23 +14,13 @@ buildPythonPackage rec {
  version = "0.4.3";
  disabled = pythonOlder "3.6";

-  # tests only on github
-  src = fetchFromGitHub {
-    owner = "jupyterlab";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-5sof5EOqzK7kNHSXp7eJl3ZagZRWF74e08ahqJId2Z8=";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-8DERss66ppuINwp7I7GbKzfJu3F2fxgozf16BH6ujt0=";
  };

-  propagatedBuildInputs = [ jupyter_server notebook ];
+  propagatedBuildInputs = [ jupyter_server notebook notebook-shim ];

-  preCheck = ''
-    cd nbclassic
-    mv conftest.py tests
-    cd tests
-
-    export PYTHONPATH=$out/${python.sitePackages}:$PYTHONPATH
-  '';
  checkInputs = [
    pytestCheckHook
    pytest-tornasync
--- a/pkgs/development/python-modules/notebook-shim/default.nix
+++ b/pkgs/development/python-modules/notebook-shim/default.nix
@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, jupyter_server
+, pytestCheckHook
+, pytest-tornasync
+}:
+
+buildPythonPackage rec {
+  pname = "notebook-shim";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jupyter";
+    repo = "notebook_shim";
+    rev = "v${version}";
+    sha256 = "sha256-5oIYj8SdC4E0N/yFxsmD2p4VkStHvqrVqAwb/htyPm4=";
+  };
+
+  propagatedBuildInputs = [ jupyter_server ];
+
+  preCheck = ''
+    mv notebook_shim/conftest.py notebook_shim/tests
+    cd notebook_shim/tests
+  '';
+
+  # TODO: understand & possibly fix why tests fail. On github most testfiles
+  # have been comitted with msgs "wip" though.
+  doCheck = false;
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-tornasync
+  ];
+
+  pythonImportsCheck = [ "notebook_shim" ];
+
+  meta = with lib; {
+    description = "Switch frontends to Jupyter Server";
+    longDescription = ''
+      This project provides a way for JupyterLab and other frontends to switch
+      to Jupyter Server for their Python Web application backend.
+    '';
+    homepage = "https://github.com/jupyter/notebook_shim";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ friedelino ];
+  };
+}
--- a/pkgs/development/python-modules/papermill/default.nix
+++ b/pkgs/development/python-modules/papermill/default.nix
@ -1,54 +1,69 @@
 { lib
-, buildPythonPackage
-, fetchPypi
 , ansiwrap
+, azure-datalake-store
+, azure-storage-blob
+, boto3
+, buildPythonPackage
 , click
-, future
-, pyyaml
-, nbformat
-, nbconvert
-, nbclient
-, six
-, tqdm
-, jupyter-client
-, requests
 , entrypoints
-, tenacity
-, futures ? null
-, backports_tempfile
-, isPy27
-, pytestCheckHook
+, fetchPypi
+, gcsfs
+, nbclient
+, nbformat
+, pyarrow
+, PyGithub
 , pytest-mock
+, pytestCheckHook
+, pythonOlder
+, pyyaml
+, requests
+, tenacity
+, tqdm
 }:

 buildPythonPackage rec {
  pname = "papermill";
-  version = "2.3.4";
+  version = "2.4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "be12d2728989c0ae17b42fcb05b623500004e94b34f56bd153355ccebb84a59a";
+    hash = "sha256-b4+KmwazlnfyB8CRAMjThrz1kvDLvdqfD1DoFEVpdic=";
  };

  propagatedBuildInputs = [
    ansiwrap
    click
-    future
    pyyaml
    nbformat
-    nbconvert
    nbclient
-    six
    tqdm
-    jupyter-client
    requests
    entrypoints
    tenacity
-  ] ++ lib.optionals isPy27 [
-    futures
-    backports_tempfile
  ];

+  passthru.optional-dependencies = {
+    azure = [
+      azure-datalake-store
+      azure-storage-blob
+    ];
+    gcs = [
+      gcsfs
+    ];
+    github = [
+      PyGithub
+    ];
+    hdfs = [
+      pyarrow
+    ];
+    s3 = [
+      boto3
+    ];
+  };
+
  checkInputs = [
    pytestCheckHook
    pytest-mock
@ -58,13 +73,17 @@ buildPythonPackage rec {
    export HOME=$(mktemp -d)
  '';

-  # the test suite depends on cloud resources azure/aws
+  # The test suite depends on cloud resources azure/aws
  doCheck = false;

+  pythonImportsCheck = [
+    "papermill"
+  ];
+
  meta = with lib; {
-    description = "Parametrize and run Jupyter and nteract Notebooks";
+    description = "Parametrize and run Jupyter and interact with notebooks";
    homepage = "https://github.com/nteract/papermill";
    license = licenses.bsd3;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
  };
 }
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "peaqevcore";
-  version = "5.2.0";
+  version = "5.4.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-8zllJh34tAymjW3OaFNiDuChdk/og09l51OFlt0jNqs=";
+    hash = "sha256-WeAYa1Iggog5VX1oiANZCeVpuEF5JdabdUjQ+fkAwxE=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pydmd/default.nix
+++ b/pkgs/development/python-modules/pydmd/default.nix
@ -8,6 +8,7 @@
 , pytestCheckHook
 , pythonOlder
 , scipy
+, ezyrb
 }:

 buildPythonPackage rec {
@ -29,6 +30,7 @@ buildPythonPackage rec {
    matplotlib
    numpy
    scipy
+    ezyrb
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/pyjsparser/default.nix
+++ b/pkgs/development/python-modules/pyjsparser/default.nix
@ -0,0 +1,36 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, pytestCheckHook
+, js2py
+}:
+
+let pyjsparser = buildPythonPackage rec {
+  pname = "pyjsparser";
+  version = "2.7.1";
+
+  src = fetchFromGitHub {
+    owner = "PiotrDabkowski";
+    repo = pname;
+    rev = "5465d037b30e334cb0997f2315ec1e451b8ad4c1";
+    sha256 = "sha256-Hqay9/qsjUfe62U7Q79l0Yy01L2Bnj5xNs6427k3Br8=";
+  };
+
+  checkInputs = [ pytestCheckHook js2py ];
+
+  # escape infinite recursion with js2py
+  doCheck = false;
+
+  passthru.tests = {
+    check = pyjsparser.overridePythonAttrs (_: { doCheck = true; });
+  };
+
+  pythonImportsCheck = [ "pyjsparser" ];
+
+  meta = with lib; {
+    description = "Fast javascript parser (based on esprima.js)";
+    homepage = "https://github.com/PiotrDabkowski/pyjsparser";
+    license = licenses.mit;
+    maintainers = with maintainers; [ onny ];
+  };
+}; in pyjsparser
--- a/pkgs/development/python-modules/pymavlink/default.nix
+++ b/pkgs/development/python-modules/pymavlink/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "pymavlink";
-  version = "2.4.31";
+  version = "2.4.34";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-p7cvwMpW1fS9Ml72vsD9L35wqPjtsQHW5lclw5SJ4P0=";
+    sha256 = "sha256-2JPBjEXiJWDJJPwS7SjNr3L4Ct+U44QaJiiv8MtSnEk=";
  };

  propagatedBuildInputs = [ future lxml ];
--- a/pkgs/development/python-modules/pypoolstation/default.nix
+++ b/pkgs/development/python-modules/pypoolstation/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "pypoolstation";
-  version = "0.4.8";
+  version = "0.4.9";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "PyPoolstation";
    inherit version;
-    sha256 = "sha256-6Fdam/LS3Nicrhe5jHHvaKCpE0HigfOVszjb5c1VM3Y=";
+    sha256 = "sha256-2smgsR5f2fzmutr4EjhyrFWrO9odTba0ux+0B6k3+9Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyshark/default.nix
+++ b/pkgs/development/python-modules/pyshark/default.nix
@ -20,8 +20,6 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "KimiNewt";
    repo = pname;
-    # 0.4.5 was the last release which was tagged
-    # https://github.com/KimiNewt/pyshark/issues/541
    rev = "refs/tags/v${version}";
    hash = "sha256-byll2GWY2841AAf8Xh+KfaCOtMGVKabTsLCe3gCdZ1o=";
  };
@ -36,7 +34,7 @@ buildPythonPackage rec {
  ];

  preCheck = ''
-    export HOME=$TMPDIR
+    export HOME=$(mktemp -d)
  '';

  checkInputs = [
--- a/pkgs/development/python-modules/pysma/default.nix
+++ b/pkgs/development/python-modules/pysma/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "pysma";
-  version = "0.6.11";
+  version = "0.6.12";
  format = "setuptools";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-x0sFJAdueSny0XoaOYbYLN8ZRS5B/iEVT62mqd4Voe4=";
+    sha256 = "sha256-uxMxqx5qbahMvTm3akiOTODhKLNVhHzBAUsOcZo/35I=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/qcengine/default.nix
+++ b/pkgs/development/python-modules/qcengine/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "qcengine";
-  version = "0.24.0";
+  version = "0.24.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-T6/gC3HHCnI3O1Gkj/MdistL93bwymtEfNF6PmA7TN0=";
+    hash = "sha256-KUOGbGQd1ffXNkQiW8yeUxValCOAfd8nBv9nnk9giVU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/recordlinkage/default.nix
+++ b/pkgs/development/python-modules/recordlinkage/default.nix
@ -0,0 +1,53 @@
+{ lib
+, bottleneck
+, buildPythonPackage
+, fetchPypi
+, jellyfish
+, joblib
+, networkx
+, numexpr
+, numpy
+, pandas
+, pyarrow
+, pytest
+, scikit-learn
+, scipy
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "recordlinkage";
+  version = "0.14";
+
+  disabled = pythonOlder "3.7";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-kuY2MUuwaLb228kwkJmOnnU+OolZcvGlhKTTiama+T4=";
+  };
+
+  propagatedBuildInputs = [
+    pyarrow
+    jellyfish
+    numpy
+    pandas
+    scipy
+    scikit-learn
+    joblib
+    networkx
+    bottleneck
+    numexpr
+  ];
+
+  # pytestCheckHook does not work
+  # Reusing their CI setup which involves 'rm -rf recordlinkage' in preCheck phase do not work too.
+  checkInputs = [ pytest ];
+
+  pythonImportsCheck = [ "recordlinkage" ];
+
+  meta = with lib; {
+    description = "Library to link records in or between data sources";
+    homepage = "https://recordlinkage.readthedocs.io/";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.raitobezarius ];
+  };
+}
--- a/pkgs/development/python-modules/strawberry-graphql/default.nix
+++ b/pkgs/development/python-modules/strawberry-graphql/default.nix
@ -0,0 +1,39 @@
+{ lib, buildPythonPackage, fetchFromGitHub, poetry, pythonOlder
+, click, backports-cached-property, graphql-core, pygments, python-dateutil, python-multipart, typing-extensions
+, aiohttp, asgiref, chalice, django, fastapi, flask, pydantic, sanic, starlette, uvicorn
+}:
+
+buildPythonPackage rec {
+  pname = "strawberry-graphql";
+  version = "0.125.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "strawberry-graphql";
+    repo = "strawberry";
+    rev = version;
+    sha256 = "sha256-8ERmG10qNiYg9Zr8oUZk/Uz68sCE+oWrqmJ5kUMqbRo=";
+  };
+
+  nativeBuildInputs = [
+    poetry
+  ];
+
+  propagatedBuildInputs = [
+    click backports-cached-property graphql-core pygments python-dateutil python-multipart typing-extensions
+    aiohttp asgiref chalice django fastapi flask pydantic sanic starlette uvicorn
+  ];
+
+  pythonImportsCheck = [
+    "strawberry"
+  ];
+
+  meta = with lib; {
+    description = "A GraphQL library for Python that leverages type annotations";
+    homepage = "https://strawberry.rocks";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
--- a/pkgs/development/python-modules/striprtf/default.nix
+++ b/pkgs/development/python-modules/striprtf/default.nix
@ -5,12 +5,12 @@

 buildPythonPackage rec {
  pname = "striprtf";
-  version = "0.0.20";
+  version = "0.0.21";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-8eMeMrazl1o9XcIyWICDg6ycRMtFMfgTUNz51w9hAmc=";
+    sha256 = "sha256-/wqYbdJ+OI/RTODnKB34e7zADHzCPEX0LkTausqFNtY=";
  };

  pythonImportsCheck = [
--- a/Show more
+++ b/Show more