Merge master into haskell-updates

2024-11-16 23:03:40 +01:00 · 2021-08-21 00:05:38 +00:00 · 2021-08-21 00:05:38 +00:00 · 4492115291
commit 4492115291
parent 79f38d76c2 a2c7af0f68
170 changed files with 11481 additions and 1577 deletions
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@ -56,6 +56,7 @@ rec {
    isNone         = { kernel = kernels.none; };

    isAndroid      = [ { abi = abis.android; } { abi = abis.androideabi; } ];
+    isGnu          = with abis; map (a: { abi = a; }) [ gnuabi64 gnu gnueabi gnueabihf ];
    isMusl         = with abis; map (a: { abi = a; }) [ musl musleabi musleabihf ];
    isUClibc       = with abis; map (a: { abi = a; }) [ uclibc uclibceabi uclibceabihf ];

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -6656,6 +6656,16 @@
    githubId = 775189;
    name = "Jordi Masip";
  };
+  matdsoupe = {
+    github = "matdsoupe";
+    githubId = 44469426;
+    name = "Matheus de Souza Pessanha";
+    email = "matheus_pessanha2001@outlook.com";
+    keys = [{
+      longkeyid = "rsa4096/0x2671964AB1E06A08";
+      fingerprint = "2F32 CFEF E11A D73B A740  FA47 2671 964A B1E0 6A08";
+    }];
+  };
  matejc = {
    email = "cotman.matej@gmail.com";
    github = "matejc";
@ -6862,16 +6872,6 @@
      fingerprint = "D709 03C8 0BE9 ACDC 14F0  3BFB 77BF E531 397E DE94";
    }];
  };
-  mdsp = {
-    github = "Mdsp9070";
-    githubId = 44469426;
-    name = "Matheus de Souza Pessanha";
-    email = "matheus_pessanha2001@outlook.com";
-    keys = [{
-      longkeyid = "rsa4096/6DFD656220A3B849";
-      fingerprint = "2D4D 488F 17FB FF75 664E  C016 6DFD 6562 20A3 B849";
-    }];
-  };
  meatcar = {
    email = "nixpkgs@denys.me";
    github = "meatcar";
@ -11812,6 +11812,12 @@
    githubId = 26011724;
    name = "Burim Augustin Berisa";
  };
+  yl3dy = {
+    email = "aleksandr.kiselyov@gmail.com";
+    github = "yl3dy";
+    githubId = 1311192;
+    name = "Alexander Kiselyov";
+  };
  yochai = {
    email = "yochai@titat.info";
    github = "yochai";
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -779,6 +779,16 @@ Superuser created successfully.
          group.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The fontconfig service’s dpi option has been removed.
+          Fontconfig should use Xft settings by default so there’s no
+          need to override one value in multiple places. The user can
+          set DPI via ~/.Xresources properly, or at the system level per
+          monitor, or as a last resort at the system level with
+          <literal>services.xserver.dpi</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>yambar</literal> package has been split into
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -223,6 +223,10 @@ subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable

 - The `openrazer` and `openrazer-daemon` packages as well as the `hardware.openrazer` module now require users to be members of the `openrazer` group instead of `plugdev`. With this change, users no longer need be granted the entire set of `plugdev` group permissions, which can include permissions other than those required by `openrazer`. This is desirable from a security point of view. The setting [`harware.openrazer.users`](options.html#opt-services.hardware.openrazer.users) can be used to add users to the `openrazer` group.

+- The fontconfig service's dpi option has been removed.
+  Fontconfig should use Xft settings by default so there's no need to override one value in multiple places.
+  The user can set DPI via ~/.Xresources properly, or at the system level per monitor, or as a last resort at the system level with `services.xserver.dpi`.
+
 - The `yambar` package has been split into `yambar` and `yambar-wayland`, corresponding to the xorg and wayland backend respectively. Please switch to `yambar-wayland` if you are on wayland.

 - The `services.minio` module gained an additional option `consoleAddress`, that
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@ -89,9 +89,7 @@ CHAR_TO_KEY = {
    ")": "shift-0x0B",
 }

-# Forward references
-log: "Logger"
-machines: "List[Machine]"
+global log, machines, test_script


 def eprint(*args: object, **kwargs: Any) -> None:
@ -103,7 +101,6 @@ def make_command(args: list) -> str:


 def create_vlan(vlan_nr: str) -> Tuple[str, str, "subprocess.Popen[bytes]", Any]:
-    global log
    log.log("starting VDE switch for network {}".format(vlan_nr))
    vde_socket = tempfile.mkdtemp(
        prefix="nixos-test-vde-", suffix="-vde{}.ctl".format(vlan_nr)
@ -246,6 +243,9 @@ def _perform_ocr_on_screenshot(


 class Machine:
+    def __repr__(self) -> str:
+        return f"<Machine '{self.name}'>"
+
    def __init__(self, args: Dict[str, Any]) -> None:
        if "name" in args:
            self.name = args["name"]
@ -910,29 +910,25 @@ class Machine:


 def create_machine(args: Dict[str, Any]) -> Machine:
-    global log
    args["log"] = log
    return Machine(args)


 def start_all() -> None:
-    global machines
    with log.nested("starting all VMs"):
        for machine in machines:
            machine.start()


 def join_all() -> None:
-    global machines
    with log.nested("waiting for all VMs to finish"):
        for machine in machines:
            machine.wait_for_shutdown()


 def run_tests(interactive: bool = False) -> None:
-    global machines
    if interactive:
-        ptpython.repl.embed(globals(), locals())
+        ptpython.repl.embed(test_symbols(), {})
    else:
        test_script()
        # TODO: Collect coverage data
@ -942,12 +938,10 @@ def run_tests(interactive: bool = False) -> None:


 def serial_stdout_on() -> None:
-    global log
    log._print_serial_logs = True


 def serial_stdout_off() -> None:
-    global log
    log._print_serial_logs = False


@ -989,6 +983,39 @@ def subtest(name: str) -> Iterator[None]:
    return False


+def _test_symbols() -> Dict[str, Any]:
+    general_symbols = dict(
+        start_all=start_all,
+        test_script=globals().get("test_script"),  # same
+        machines=globals().get("machines"),  # without being initialized
+        log=globals().get("log"),  # extracting those symbol keys
+        os=os,
+        create_machine=create_machine,
+        subtest=subtest,
+        run_tests=run_tests,
+        join_all=join_all,
+        retry=retry,
+        serial_stdout_off=serial_stdout_off,
+        serial_stdout_on=serial_stdout_on,
+        Machine=Machine,  # for typing
+    )
+    return general_symbols
+
+
+def test_symbols() -> Dict[str, Any]:
+
+    general_symbols = _test_symbols()
+
+    machine_symbols = {m.name: machines[idx] for idx, m in enumerate(machines)}
+    print(
+        "additionally exposed symbols:\n    "
+        + ", ".join(map(lambda m: m.name, machines))
+        + ",\n    "
+        + ", ".join(list(general_symbols.keys()))
+    )
+    return {**general_symbols, **machine_symbols}
+
+
 if __name__ == "__main__":
    arg_parser = argparse.ArgumentParser(prog="nixos-test-driver")
    arg_parser.add_argument(
@ -1028,12 +1055,9 @@ if __name__ == "__main__":
    )

    args = arg_parser.parse_args()
-    global test_script
    testscript = pathlib.Path(args.testscript).read_text()

-    def test_script() -> None:
-        with log.nested("running the VM test script"):
-            exec(testscript, globals())
+    global log, machines, test_script

    log = Logger()

@ -1062,6 +1086,11 @@ if __name__ == "__main__":
                process.terminate()
        log.close()

+    def test_script() -> None:
+        with log.nested("running the VM test script"):
+            symbols = test_symbols()  # call eagerly
+            exec(testscript, symbols, None)
+
    interactive = args.interactive or (not bool(testscript))
    tic = time.time()
    run_tests(interactive)
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@ -42,7 +42,9 @@ rec {
        python <<EOF
        from pydoc import importfile
        with open('driver-symbols', 'w') as fp:
-          fp.write(','.join(dir(importfile('${testDriverScript}'))))
+          t = importfile('${testDriverScript}')
+          test_symbols = t._test_symbols()
+          fp.write(','.join(test_symbols.keys()))
        EOF
      '';

--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -78,14 +78,6 @@ let
        </edit>
      </match>

-      ${optionalString (cfg.dpi != 0) ''
-      <match target="pattern">
-        <edit name="dpi" mode="assign">
-          <double>${toString cfg.dpi}</double>
-        </edit>
-      </match>
-      ''}
-
    </fontconfig>
  '';

@ -237,6 +229,7 @@ in
    (mkRemovedOptionModule [ "fonts" "fontconfig" "hinting" "style" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
+    (mkRemovedOptionModule [ "fonts" "fontconfig" "dpi" ] "Use display server-specific options")
  ] ++ lib.forEach [ "enable" "substitutions" "preset" ]
     (opt: lib.mkRemovedOptionModule [ "fonts" "fontconfig" "ultimate" "${opt}" ] ''
       The fonts.fontconfig.ultimate module and configuration is obsolete.
@ -282,15 +275,6 @@ in
          '';
        };

-        dpi = mkOption {
-          type = types.int;
-          default = 0;
-          description = ''
-            Force DPI setting. Setting to <literal>0</literal> disables DPI
-            forcing; the DPI detected for the display will be used.
-          '';
-        };
-
        localConf = mkOption {
          type = types.lines;
          default = "";
--- a/nixos/modules/config/system-environment.nix
+++ b/nixos/modules/config/system-environment.nix
@ -65,42 +65,40 @@ in
  };

  config = {
+    environment.etc."pam/environment".text = let
+      suffixedVariables =
+        flip mapAttrs cfg.profileRelativeSessionVariables (envVar: suffixes:
+          flip concatMap cfg.profiles (profile:
+            map (suffix: "${profile}${suffix}") suffixes
+          )
+        );

-    system.build.pamEnvironment =
-      let
-        suffixedVariables =
-          flip mapAttrs cfg.profileRelativeSessionVariables (envVar: suffixes:
-            flip concatMap cfg.profiles (profile:
-              map (suffix: "${profile}${suffix}") suffixes
-            )
-          );
+      # We're trying to use the same syntax for PAM variables and env variables.
+      # That means we need to map the env variables that people might use to their
+      # equivalent PAM variable.
+      replaceEnvVars = replaceStrings ["$HOME" "$USER"] ["@{HOME}" "@{PAM_USER}"];

-        # We're trying to use the same syntax for PAM variables and env variables.
-        # That means we need to map the env variables that people might use to their
-        # equivalent PAM variable.
-        replaceEnvVars = replaceStrings ["$HOME" "$USER"] ["@{HOME}" "@{PAM_USER}"];
+      pamVariable = n: v:
+        ''${n}   DEFAULT="${concatStringsSep ":" (map replaceEnvVars (toList v))}"'';

-        pamVariable = n: v:
-          ''${n}   DEFAULT="${concatStringsSep ":" (map replaceEnvVars (toList v))}"'';
-
-        pamVariables =
-          concatStringsSep "\n"
-          (mapAttrsToList pamVariable
-          (zipAttrsWith (n: concatLists)
-            [
-              # Make sure security wrappers are prioritized without polluting
-              # shell environments with an extra entry. Sessions which depend on
-              # pam for its environment will otherwise have eg. broken sudo. In
-              # particular Gnome Shell sometimes fails to source a proper
-              # environment from a shell.
-              { PATH = [ config.security.wrapperDir ]; }
-
-              (mapAttrs (n: toList) cfg.sessionVariables)
-              suffixedVariables
-            ]));
-      in
-        pkgs.writeText "pam-environment" "${pamVariables}\n";
+      pamVariables =
+        concatStringsSep "\n"
+        (mapAttrsToList pamVariable
+        (zipAttrsWith (n: concatLists)
+          [
+            # Make sure security wrappers are prioritized without polluting
+            # shell environments with an extra entry. Sessions which depend on
+            # pam for its environment will otherwise have eg. broken sudo. In
+            # particular Gnome Shell sometimes fails to source a proper
+            # environment from a shell.
+            { PATH = [ config.security.wrapperDir ]; }

+            (mapAttrs (n: toList) cfg.sessionVariables)
+            suffixedVariables
+          ]));
+    in ''
+      ${pamVariables}
+    '';
  };

 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -767,6 +767,7 @@
  ./services/networking/namecoind.nix
  ./services/networking/nar-serve.nix
  ./services/networking/nat.nix
+  ./services/networking/nats.nix
  ./services/networking/ndppd.nix
  ./services/networking/nebula.nix
  ./services/networking/networkmanager.nix
@ -995,7 +996,7 @@
  ./services/web-apps/youtrack.nix
  ./services/web-apps/zabbix.nix
  ./services/web-servers/apache-httpd/default.nix
-  ./services/web-servers/caddy.nix
+  ./services/web-servers/caddy/default.nix
  ./services/web-servers/darkhttpd.nix
  ./services/web-servers/fcgiwrap.nix
  ./services/web-servers/hitch/default.nix
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -475,7 +475,7 @@ let

          # Session management.
          ${optionalString cfg.setEnvironment ''
-            session required pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
+            session required pam_env.so conffile=/etc/pam/environment readenv=0
          ''}
          session required pam_unix.so
          ${optionalString cfg.setLoginUid
--- a/nixos/modules/services/networking/nats.nix
+++ b/nixos/modules/services/networking/nats.nix
@ -0,0 +1,159 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.nats;
+
+  format = pkgs.formats.json { };
+
+  configFile = format.generate "nats.conf" cfg.settings;
+
+in {
+
+  ### Interface
+
+  options = {
+    services.nats = {
+      enable = mkEnableOption "NATS messaging system";
+
+      user = mkOption {
+        type = types.str;
+        default = "nats";
+        description = "User account under which NATS runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "nats";
+        description = "Group under which NATS runs.";
+      };
+
+      serverName = mkOption {
+        default = "nats";
+        example = "n1-c3";
+        type = types.str;
+        description = ''
+          Name of the NATS server, must be unique if clustered.
+        '';
+      };
+
+      jetstream = mkEnableOption "JetStream";
+
+      port = mkOption {
+        default = 4222;
+        example = 4222;
+        type = types.port;
+        description = ''
+          Port on which to listen.
+        '';
+      };
+
+      dataDir = mkOption {
+        default = "/var/lib/nats";
+        type = types.path;
+        description = ''
+          The NATS data directory. Only used if JetStream is enabled, for
+          storing stream metadata and messages.
+
+          If left as the default value this directory will automatically be
+          created before the NATS server starts, otherwise the sysadmin is
+          responsible for ensuring the directory exists with appropriate
+          ownership and permissions.
+        '';
+      };
+
+      settings = mkOption {
+        default = { };
+        type = format.type;
+        example = literalExample ''
+          {
+            jetstream = {
+              max_mem = "1G";
+              max_file = "10G";
+            };
+          };
+        '';
+        description = ''
+          Declarative NATS configuration. See the
+          <link xlink:href="https://docs.nats.io/nats-server/configuration">
+          NATS documentation</link> for a list of options.
+        '';
+      };
+    };
+  };
+
+  ### Implementation
+
+  config = mkIf cfg.enable {
+    services.nats.settings = {
+      server_name = cfg.serverName;
+      port = cfg.port;
+      jetstream = optionalAttrs cfg.jetstream { store_dir = cfg.dataDir; };
+    };
+
+    systemd.services.nats = {
+      description = "NATS messaging system";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = mkMerge [
+        (mkIf (cfg.dataDir == "/var/lib/nats") {
+          StateDirectory = "nats";
+          StateDirectoryMode = "0750";
+        })
+        {
+          Type = "simple";
+          ExecStart = "${pkgs.nats-server}/bin/nats-server -c ${configFile}";
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          ExecStop = "${pkgs.coreutils}/bin/kill -SIGINT $MAINPID";
+          Restart = "on-failure";
+
+          User = cfg.user;
+          Group = cfg.group;
+
+          # Hardening
+          CapabilityBoundingSet = "";
+          LimitNOFILE = 800000; # JetStream requires 2 FDs open per stream.
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          ReadOnlyPaths = [ ];
+          ReadWritePaths = [ cfg.dataDir ];
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+          UMask = "0077";
+        }
+      ];
+    };
+
+    users.users = mkIf (cfg.user == "nats") {
+      nats = {
+        description = "NATS daemon user";
+        isSystemUser = true;
+        group = cfg.group;
+        home = cfg.dataDir;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "nats") { nats = { }; };
+  };
+
+}
--- a/nixos/modules/services/wayland/cage.nix
+++ b/nixos/modules/services/wayland/cage.nix
@ -82,7 +82,7 @@ in {
      auth    required pam_unix.so nullok
      account required pam_unix.so
      session required pam_unix.so
-      session required pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
+      session required pam_env.so conffile=/etc/pam/environment readenv=0
      session required ${pkgs.systemd}/lib/security/pam_systemd.so
    '';

--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@ -4,7 +4,17 @@ with lib;

 let
  cfg = config.services.caddy;
-  configFile = pkgs.writeText "Caddyfile" cfg.config;
+  vhostToConfig = vhostName: vhostAttrs: ''
+    ${vhostName} ${builtins.concatStringsSep " " vhostAttrs.serverAliases} {
+      ${vhostAttrs.extraConfig}
+    }
+  '';
+  configFile = pkgs.writeText "Caddyfile" (builtins.concatStringsSep "\n"
+    ([ cfg.config ] ++ (mapAttrsToList vhostToConfig cfg.virtualHosts)));
+
+  formattedConfig = pkgs.runCommand "formattedCaddyFile" { } ''
+    ${cfg.package}/bin/caddy fmt ${configFile} > $out
+  '';

  tlsConfig = {
    apps.tls.automation.policies = [{
@ -17,7 +27,7 @@ let

  adaptedConfig = pkgs.runCommand "caddy-config-adapted.json" { } ''
    ${cfg.package}/bin/caddy adapt \
-      --config ${configFile} --adapter ${cfg.adapter} > $out
+      --config ${formattedConfig} --adapter ${cfg.adapter} > $out
  '';
  tlsJSON = pkgs.writeText "tls.json" (builtins.toJSON tlsConfig);

@ -68,6 +78,27 @@ in
      '';
    };

+    virtualHosts = mkOption {
+      type = types.attrsOf (types.submodule (import ./vhost-options.nix {
+        inherit config lib;
+      }));
+      default = { };
+      example = literalExample ''
+        {
+          "hydra.example.com" = {
+            serverAliases = [ "www.hydra.example.com" ];
+            extraConfig = ''''''
+              encode gzip
+              log
+              root /srv/http
+            '''''';
+          };
+        };
+      '';
+      description = "Declarative vhost config";
+    };
+
+
    user = mkOption {
      default = "caddy";
      type = types.str;
--- a/nixos/modules/services/web-servers/caddy/vhost-options.nix
+++ b/nixos/modules/services/web-servers/caddy/vhost-options.nix
@ -0,0 +1,28 @@
+# This file defines the options that can be used both for the Nginx
+# main server configuration, and for the virtual hosts.  (The latter
+# has additional options that affect the web server as a whole, like
+# the user/group to run under.)
+
+{ lib, ... }:
+
+with lib;
+{
+  options = {
+    serverAliases = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "www.example.org" "example.org" ];
+      description = ''
+        Additional names of virtual hosts served by this virtual host configuration.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        These lines go into the vhost verbatim
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -18,7 +18,6 @@ let

  fontconfig = config.fonts.fontconfig;
  xresourcesXft = pkgs.writeText "Xresources-Xft" ''
-    ${optionalString (fontconfig.dpi != 0) ''Xft.dpi: ${toString fontconfig.dpi}''}
    Xft.antialias: ${if fontconfig.antialias then "1" else "0"}
    Xft.rgba: ${fontconfig.subpixel.rgba}
    Xft.lcdfilter: lcd${fontconfig.subpixel.lcdfilter}
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -314,7 +314,7 @@ in
        password required       pam_deny.so

        session  required       pam_succeed_if.so audit quiet_success user = gdm
-        session  required       pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
+        session  required       pam_env.so conffile=/etc/pam/environment readenv=0
        session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so
        session  optional       pam_keyinit.so force revoke
        session  optional       pam_permit.so
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@ -284,7 +284,7 @@ in
        password required       pam_deny.so

        session  required       pam_succeed_if.so audit quiet_success user = lightdm
-        session  required       pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
+        session  required       pam_env.so conffile=/etc/pam/environment readenv=0
        session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so
        session  optional       pam_keyinit.so force revoke
        session  optional       pam_permit.so
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@ -229,7 +229,7 @@ in
        password required       pam_deny.so

        session  required       pam_succeed_if.so audit quiet_success user = sddm
-        session  required       pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
+        session  required       pam_env.so conffile=/etc/pam/environment readenv=0
        session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so
        session  optional       pam_keyinit.so force revoke
        session  optional       pam_permit.so
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -297,7 +297,11 @@ in
      dpi = mkOption {
        type = types.nullOr types.int;
        default = null;
-        description = "DPI resolution to use for X server.";
+        description = ''
+          Force global DPI resolution to use for X server. It's recommended to
+          use this only when DPI is detected incorrectly; also consider using
+          <literal>Monitor</literal> section in configuration file instead.
+        '';
      };

      updateDbusEnvironment = mkOption {
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -243,9 +243,13 @@ while (my ($unit, $state) = each %{$activePrev}) {
                            foreach my $socket (@sockets) {
                                if (defined $activePrev->{$socket}) {
                                    $unitsToStop{$socket} = 1;
-                                    $unitsToStart{$socket} = 1;
-                                    recordUnit($startListFile, $socket);
-                                    $socketActivated = 1;
+                                    # Only restart sockets that actually
+                                    # exist in new configuration:
+                                    if (-e "$out/etc/systemd/system/$socket") {
+                                        $unitsToStart{$socket} = 1;
+                                        recordUnit($startListFile, $socket);
+                                        $socketActivated = 1;
+                                    }
                                }
                            }
                        }
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -70,7 +70,10 @@ let

      # Journal.
      "systemd-journald.socket"
+      "systemd-journald@.socket"
+      "systemd-journald-varlink@.socket"
      "systemd-journald.service"
+      "systemd-journald@.service"
      "systemd-journal-flush.service"
      "systemd-journal-catalog-update.service"
      ] ++ (optional (!config.boot.isContainer) "systemd-journald-audit.socket") ++ [
@ -1181,6 +1184,8 @@ in
    systemd.services."user-runtime-dir@".restartIfChanged = false;
    systemd.services.systemd-journald.restartTriggers = [ config.environment.etc."systemd/journald.conf".source ];
    systemd.services.systemd-journald.stopIfChanged = false;
+    systemd.services."systemd-journald@".restartTriggers = [ config.environment.etc."systemd/journald.conf".source ];
+    systemd.services."systemd-journald@".stopIfChanged = false;
    systemd.targets.local-fs.unitConfig.X-StopOnReconfiguration = true;
    systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true;
    systemd.targets.network-online.wantedBy = [ "multi-user.target" ];
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -283,6 +283,7 @@ in
  nat.firewall = handleTest ./nat.nix { withFirewall = true; };
  nat.firewall-conntrack = handleTest ./nat.nix { withFirewall = true; withConntrackHelpers = true; };
  nat.standalone = handleTest ./nat.nix { withFirewall = false; };
+  nats = handleTest ./nats.nix {};
  navidrome = handleTest ./navidrome.nix {};
  ncdns = handleTest ./ncdns.nix {};
  ndppd = handleTest ./ndppd.nix {};
--- a/nixos/tests/caddy.nix
+++ b/nixos/tests/caddy.nix
@ -43,49 +43,64 @@ import ./make-test-python.nix ({ pkgs, ... }: {
          }
        '';
      };
+      specialisation.multiple-configs.configuration = {
+        services.caddy.virtualHosts = {
+          "http://localhost:8080" = { };
+          "http://localhost:8081" = { };
+        };
+      };
    };
-  };

-  testScript = { nodes, ... }: let
-    etagSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/etag";
-    justReloadSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/config-reload";
-  in ''
-    url = "http://localhost/example.html"
-    webserver.wait_for_unit("caddy")
-    webserver.wait_for_open_port("80")
+    testScript = { nodes, ... }:
+      let
+        etagSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/etag";
+        justReloadSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/config-reload";
+        multipleConfigs = "${nodes.webserver.config.system.build.toplevel}/specialisation/multiple-configs";
+      in
+      ''
+        url = "http://localhost/example.html"
+        webserver.wait_for_unit("caddy")
+        webserver.wait_for_open_port("80")


-    def check_etag(url):
-        etag = webserver.succeed(
-            "curl --fail -v '{}' 2>&1 | sed -n -e \"s/^< [Ee][Tt][Aa][Gg]: *//p\"".format(
-                url
+        def check_etag(url):
+            etag = webserver.succeed(
+                "curl --fail -v '{}' 2>&1 | sed -n -e \"s/^< [Ee][Tt][Aa][Gg]: *//p\"".format(
+                    url
+                )
            )
-        )
-        etag = etag.replace("\r\n", " ")
-        http_code = webserver.succeed(
-            "curl --fail --silent --show-error -o /dev/null -w \"%{{http_code}}\" --head -H 'If-None-Match: {}' {}".format(
-                etag, url
+            etag = etag.replace("\r\n", " ")
+            http_code = webserver.succeed(
+                "curl --fail --silent --show-error -o /dev/null -w \"%{{http_code}}\" --head -H 'If-None-Match: {}' {}".format(
+                    etag, url
+                )
            )
-        )
-        assert int(http_code) == 304, "HTTP code is {}, expected 304".format(http_code)
-        return etag
+            assert int(http_code) == 304, "HTTP code is {}, expected 304".format(http_code)
+            return etag


-    with subtest("check ETag if serving Nix store paths"):
-        old_etag = check_etag(url)
-        webserver.succeed(
-            "${etagSystem}/bin/switch-to-configuration test >&2"
-        )
-        webserver.sleep(1)
-        new_etag = check_etag(url)
-        assert old_etag != new_etag, "Old ETag {} is the same as {}".format(
-            old_etag, new_etag
-        )
+        with subtest("check ETag if serving Nix store paths"):
+            old_etag = check_etag(url)
+            webserver.succeed(
+                "${etagSystem}/bin/switch-to-configuration test >&2"
+            )
+            webserver.sleep(1)
+            new_etag = check_etag(url)
+            assert old_etag != new_etag, "Old ETag {} is the same as {}".format(
+                old_etag, new_etag
+            )

-    with subtest("config is reloaded on nixos-rebuild switch"):
-        webserver.succeed(
-            "${justReloadSystem}/bin/switch-to-configuration test >&2"
-        )
-        webserver.wait_for_open_port("8080")
-  '';
-})
+        with subtest("config is reloaded on nixos-rebuild switch"):
+            webserver.succeed(
+                "${justReloadSystem}/bin/switch-to-configuration test >&2"
+            )
+            webserver.wait_for_open_port("8080")
+
+        with subtest("multiple configs are correctly merged"):
+            webserver.succeed(
+                "${multipleConfigs}/bin/switch-to-configuration test >&2"
+            )
+            webserver.wait_for_open_port("8080")
+            webserver.wait_for_open_port("8081")
+      '';
+  })
--- a/nixos/tests/common/ec2.nix
+++ b/nixos/tests/common/ec2.nix
@ -23,6 +23,7 @@ with pkgs.lib;
      testScript = ''
        import os
        import subprocess
+        import tempfile

        image_dir = os.path.join(
            os.environ.get("TMPDIR", tempfile.gettempdir()), "tmp", "vm-state-machine"
--- a/nixos/tests/nats.nix
+++ b/nixos/tests/nats.nix
@ -0,0 +1,65 @@
+let
+
+  port = 4222;
+  username = "client";
+  password = "password";
+  topic = "foo.bar";
+
+in import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "nats";
+  meta = with pkgs.lib; { maintainers = with maintainers; [ c0deaddict ]; };
+
+  nodes = let
+    client = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [ natscli ];
+    };
+  in {
+    server = { pkgs, ... }: {
+      networking.firewall.allowedTCPPorts = [ port ];
+      services.nats = {
+        inherit port;
+        enable = true;
+        settings = {
+          authorization = {
+            users = [{
+              user = username;
+              inherit password;
+            }];
+          };
+        };
+      };
+    };
+
+    client1 = client;
+    client2 = client;
+  };
+
+  testScript = let file = "/tmp/msg";
+  in ''
+    def nats_cmd(*args):
+        return (
+            "nats "
+            "--server=nats://server:${toString port} "
+            "--user=${username} "
+            "--password=${password} "
+            "{}"
+        ).format(" ".join(args))
+
+    start_all()
+    server.wait_for_unit("nats.service")
+
+    client1.fail("test -f ${file}")
+
+    # Subscribe on topic on client1 and echo messages to file.
+    client1.execute("({} | tee ${file} &)".format(nats_cmd("sub", "--raw", "${topic}")))
+
+    # Give client1 some time to subscribe.
+    client1.execute("sleep 2")
+
+    # Publish message on client2.
+    client2.execute(nats_cmd("pub", "${topic}", "hello"))
+
+    # Check if message has been received.
+    client1.succeed("grep -q hello ${file}")
+  '';
+})
--- a/nixos/tests/nsd.nix
+++ b/nixos/tests/nsd.nix
@ -85,6 +85,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : {
        self = clientv4 if type == 4 else clientv6
        out = self.succeed(f"host -{type} -t {rr} {query}").rstrip()
        self.log(f"output: {out}")
+        import re
        assert re.search(
            expected, out
        ), f"DNS IPv{type} query on {query} gave '{out}' instead of '{expected}'"
--- a/nixos/tests/postgresql.nix
+++ b/nixos/tests/postgresql.nix
@ -61,6 +61,7 @@ let

      with subtest("Postgresql survives restart (bug #1735)"):
          machine.shutdown()
+          import time
          time.sleep(2)
          machine.start()
          machine.wait_for_unit("postgresql")
--- a/nixos/tests/turbovnc-headless-server.nix
+++ b/nixos/tests/turbovnc-headless-server.nix
@ -57,6 +57,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
            else:
                if check_success():
                    return
+            import time
            time.sleep(retry_sleep)

        if not check_success():
--- a/pkgs/applications/editors/bluej/default.nix
+++ b/pkgs/applications/editors/bluej/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "bluej";
-  version = "5.0.1";
+  version = "5.0.2";
  src = fetchurl {
    # We use the deb here. First instinct might be to go for the "generic" JAR
    # download, but that is actually a graphical installer that is much harder
    # to unpack than the deb.
    url = "https://www.bluej.org/download/files/BlueJ-linux-${builtins.replaceStrings ["."] [""] version}.deb";
-    sha256 = "sha256-KhNhJ2xsw1g2yemwP6NQmJvk4cxZAQQNPEUBuLso5qM=";
+    sha256 = "sha256-9sWfVQF/wCiVDKBmesMpM+5BHjFUPszm6U1SgJNQ8lE=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/default.nix
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/default.nix
@ -0,0 +1,73 @@
+{ pkgs
+, stdenv
+, lib
+, jre
+, fetchFromGitHub
+, writeShellScript
+, runCommand
+, imagemagick
+}:
+
+# To test:
+# $(nix-build --no-out-link -E 'with import <nixpkgs> {}; jupyter.override { definitions = { clojure = clojupyter.definition; }; }')/bin/jupyter-notebook
+
+let
+  cljdeps = import ./deps.nix { inherit pkgs; };
+  classp  = cljdeps.makeClasspaths {};
+
+  shellScript = writeShellScript "clojupyter" ''
+    ${jre}/bin/java -cp ${classp} clojupyter.kernel.core "$@"
+  '';
+
+  pname = "clojupyter";
+  version = "0.3.2";
+
+  meta = with lib; {
+    description = "A Jupyter kernel for Clojure";
+    homepage = "https://github.com/clojupyter/clojupyter";
+    license = licenses.mit;
+    maintainers = with maintainers; [ thomasjm ];
+    platforms = jre.meta.platforms;
+  };
+
+  sizedLogo = size: stdenv.mkDerivation {
+    name = "clojupyter-logo-${size}x${size}.png";
+
+    src = fetchFromGitHub {
+      owner = "clojupyter";
+      repo = "clojupyter";
+      rev = "0.3.2";
+      sha256 = "1wphc7h74qlm9bcv5f95qhq1rq9gmcm5hvjblb01vffx996vr6jz";
+    };
+
+    buildInputs = [ imagemagick ];
+
+    dontConfigure = true;
+    dontInstall = true;
+
+    buildPhase = ''
+      convert ./resources/clojupyter/assets/logo-64x64.png -resize ${size}x${size} $out
+    '';
+
+    inherit meta;
+  };
+
+in
+
+rec {
+  launcher = runCommand "clojupyter" { inherit pname version meta shellScript; } ''
+    mkdir -p $out/bin
+    ln -s $shellScript $out/bin/clojupyter
+  '';
+
+  definition = {
+    displayName = "Clojure";
+    argv = [
+      "${launcher}/bin/clojupyter"
+      "{connection_file}"
+    ];
+    language = "clojure";
+    logo32 = sizedLogo "32";
+    logo64 = sizedLogo "64";
+  };
+}
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.edn
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.edn
@ -0,0 +1 @@
+{:deps {clojupyter/clojupyter {:mvn/version "0.3.2"}}}
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.nix
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.nix
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/update.sh
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/update.sh
@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+### To update clj2nix
+# $ nix-prefetch-github hlolli clj2nix
+
+nix-shell --run "clj2nix deps.edn deps.nix" -E '
+with import ../../../../.. { };
+mkShell {
+  buildInputs = [(callPackage (fetchFromGitHub {
+    owner = "hlolli";
+    repo = "clj2nix";
+    rev = "b9a28d4a920d5d680439b1b0d18a1b2c56d52b04";
+    sha256 = "0d8xlja62igwg757lab9ablz1nji8cp9p9x3j0ihqvp1y48w2as3";
+  }) {})];
+}
+'
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -14,17 +14,17 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "14j1bss4bqw39ijmyh0kyr5xgzq61bc0if7g94jkvdbngz6fa25f";
-    x86_64-darwin = "0922r49475j1i8jrx5935bly7cv26hniz9iqf30qj6qs6d8kibci";
-    aarch64-linux = "11kkys3fsf4a4hvqv524fkdl686addd3ygzz0mav09xh8wjqbisw";
-    aarch64-darwin = "1xk56ww2ndksi6sqnr42zcqx2fl52aip3jb4fmdmqg1cvllfx0sd";
-    armv7l-linux = "1jiyjknl2xxivifixcwvyi6qsq7kr71gbalzdj6xca2i6pc1gbvp";
+    x86_64-linux = "0i2pngrp2pcas99wkay7ahrcn3gl47gdjjaq7ladr879ypldh24v";
+    x86_64-darwin = "1pni2cd5s6m9jxwpja4ma9xlr1q3xl46w8pim3971dw3xi5r29pg";
+    aarch64-linux = "0j71ha2df99583w8r2l1hppn6wx8ll80flwcj5xzj7icv3mq8x7v";
+    aarch64-darwin = "0vhp1z890mvs8hnwf43bfv74a7y0pv5crjn53rbiy0il1ihs1498";
+    armv7l-linux = "07yb0ia1rnbav3gza2y53yd3bcxqmngddd4jz6p4y0m539znl817";
  }.${system};
 in
  callPackage ./generic.nix rec {
    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.59.0";
+    version = "1.59.1";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -13,10 +13,10 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0yx0h7rd8v9j3yq863dj78bm587s8lpisbn1skb5whv6qv88x7c0";
-    x86_64-darwin = "1b5jr08cgl49rh26id8iwi64d32ssr7kis72zcqg0jkw7larxvvh";
-    aarch64-linux = "1a62krnilfi7nr7mmxyv3danj7h2yfdwg784q8vhrdjyqjd8gjbs";
-    armv7l-linux = "1axazx7hf6iw0dq1m2049kfrmk8jndycz9pcn3csj6rm65plg746";
+    x86_64-linux = "1z8sxdzwbjip8csrili5l36v1kl3iq8fw19dhfnkjs3fl0sn360k";
+    x86_64-darwin = "0sp5k4pk9yjx16c79hqrwn64f2ab82iizm1cy93y9rr2r3px1yga";
+    aarch64-linux = "03qm5008knigsahs6zz5c614g1kid3k0ndg8vb0flfwmdrajrdw3";
+    armv7l-linux = "0sls3m5zwz6w01k7jym0vwbz006bkwv23yba7gf1gg84vbqgpb1x";
  }.${system};

  sourceRoot = {
@ -31,7 +31,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.59.0";
+    version = "1.59.1";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/graphics/akira/default.nix
+++ b/pkgs/applications/graphics/akira/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "akira";
-  version = "0.0.15";
+  version = "0.0.16";

  src = fetchFromGitHub {
    owner = "akiraux";
    repo = "Akira";
    rev = "v${version}";
-    sha256 = "sha256-2GhpxajymLVAl2P6vZ0+nuZK3ZRRktFswWkj7TP8eHI=";
+    sha256 = "sha256-qrqmSCwA0kQVFD1gzutks9gMr7My7nw/KJs/VPisa0w=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/firestarter/default.nix
+++ b/pkgs/applications/misc/firestarter/default.nix
@ -1,32 +1,83 @@
-{ lib, stdenv, fetchFromGitHub, glibc, python3, cudatoolkit,
-  withCuda ? true
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchzip
+, cmake
+, glibc_multi
+, glibc
+, git
+, pkg-config
+, cudatoolkit
+, withCuda ? false
+, linuxPackages
 }:

-with lib;
+let
+  hwloc = stdenv.mkDerivation rec {
+    pname = "hwloc";
+    version = "2.2.0";
+
+    src = fetchzip {
+      url = "https://download.open-mpi.org/release/hwloc/v${lib.versions.majorMinor version}/hwloc-${version}.tar.gz";
+      sha256 = "1ibw14h9ppg8z3mmkwys8vp699n85kymdz20smjd2iq9b67y80b6";
+    };
+
+    configureFlags = [
+      "--enable-static"
+      "--disable-libudev"
+      "--disable-shared"
+      "--disable-doxygen"
+      "--disable-libxml2"
+      "--disable-cairo"
+      "--disable-io"
+      "--disable-pci"
+      "--disable-opencl"
+      "--disable-cuda"
+      "--disable-nvml"
+      "--disable-gl"
+      "--disable-libudev"
+      "--disable-plugin-dlopen"
+      "--disable-plugin-ltdl"
+    ];
+
+    nativeBuildInputs = [ pkg-config ];
+
+    enableParallelBuilding = true;
+
+    outputs = [ "out" "lib" "dev" "doc" "man" ];
+  };
+
+in
 stdenv.mkDerivation rec {
  pname = "firestarter";
-  version = "1.7.4";
+  version = "2.0";

  src = fetchFromGitHub {
    owner = "tud-zih-energy";
    repo = "FIRESTARTER";
    rev = "v${version}";
-    sha256 = "0zqfqb7hf48z39g1qhbl1iraf8rz4d629h1q6ikizckpzfq23kd0";
+    sha256 = "1ik6j1lw5nldj4i3lllrywqg54m9i2vxkxsb2zr4q0d2rfywhn23";
+    fetchSubmodules = true;
  };

-  nativeBuildInputs = [ python3 ];
-  buildInputs = [ glibc.static ] ++ optionals withCuda [ cudatoolkit ];
-  preBuild = ''
-    mkdir -p build
-    cd build
-    python ../code-generator.py ${optionalString withCuda "--enable-cuda"}
-  '';
-  makeFlags = optionals withCuda [ "LINUX_CUDA_PATH=${cudatoolkit}" ];
-  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake git pkg-config ];
+
+  buildInputs = [ hwloc ] ++ (if withCuda then
+    [ glibc_multi cudatoolkit linuxPackages.nvidia_x11 ]
+  else
+    [ glibc.static ]);
+
+  cmakeFlags = [
+    "-DFIRESTARTER_BUILD_HWLOC=OFF"
+    "-DCMAKE_C_COMPILER_WORKS=1"
+    "-DCMAKE_CXX_COMPILER_WORKS=1"
+  ] ++ lib.optionals withCuda [
+    "-DFIRESTARTER_BUILD_TYPE=FIRESTARTER_CUDA"
+  ];

  installPhase = ''
    mkdir -p $out/bin
-    cp FIRESTARTER $out/bin/firestarter
+    cp src/FIRESTARTER${lib.optionalString withCuda "_CUDA"} $out/bin/
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/lsd2dsl/default.nix
+++ b/pkgs/applications/misc/lsd2dsl/default.nix
@ -1,23 +1,33 @@
-{ stdenv, mkDerivation, lib, fetchFromGitHub, cmake
+{ lib, stdenv, mkDerivation, fetchFromGitHub
+, makeDesktopItem, copyDesktopItems, cmake
 , boost, libvorbis, libsndfile, minizip, gtest, qtwebkit }:

 mkDerivation rec {
  pname = "lsd2dsl";
-  version = "0.5.2";
+  version = "0.5.4";

  src = fetchFromGitHub {
    owner = "nongeneric";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0s0la6zkg584is93p4nj1ha3pbnvadq84zgsv8nym3r35n7k8czi";
+    sha256 = "sha256-PLgfsVVrNBTxI4J0ukEOFRoBkbmB55/sLNn5KyiHeAc=";
  };

-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.isLinux copyDesktopItems;

  buildInputs = [ boost libvorbis libsndfile minizip gtest qtwebkit ];

  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=missing-braces";

+  desktopItems = lib.singleton (makeDesktopItem {
+    name = "lsd2dsl";
+    exec = "lsd2dsl-qtgui";
+    desktopName = "lsd2dsl";
+    genericName = "lsd2dsl";
+    comment = meta.description;
+    categories = "Dictionary;FileTools;Qt;";
+  });
+
  installPhase = ''
    install -Dm755 console/lsd2dsl gui/lsd2dsl-qtgui -t $out/bin
  '' + lib.optionalString stdenv.isDarwin ''
@ -33,6 +43,6 @@ mkDerivation rec {
    '';
    license = licenses.mit;
    maintainers = with maintainers; [ sikmir ];
-    platforms = with platforms; linux ++ darwin;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/moonlight-embedded/default.nix
+++ b/pkgs/applications/misc/moonlight-embedded/default.nix
@ -1,18 +1,18 @@
 { lib, stdenv, fetchFromGitHub, cmake, perl
 , alsa-lib, libevdev, libopus, udev, SDL2
 , ffmpeg, pkg-config, xorg, libvdpau, libpulseaudio, libcec
-, curl, expat, avahi, enet, libuuid, libva
+, curl, expat, avahi, libuuid, libva
 }:

 stdenv.mkDerivation rec {
  pname = "moonlight-embedded";
-  version = "2.4.11";
+  version = "2.5.1";

  src = fetchFromGitHub {
-    owner = "irtimmer";
+    owner = "moonlight-stream";
    repo = "moonlight-embedded";
    rev = "v${version}";
-    sha256 = "19wm4gizj8q6j4jwqfcn3bkhms97d8afwxmqjmjnqqxzpd2gxc16";
+    sha256 = "0wn6yjpqyjv52278xsx1ivnqrwca4fnk09a01fwzk4adpry1q9ck";
    fetchSubmodules = true;
  };

@ -22,13 +22,13 @@ stdenv.mkDerivation rec {
  buildInputs = [
    alsa-lib libevdev libopus udev SDL2
    ffmpeg pkg-config xorg.libxcb libvdpau libpulseaudio libcec
-    xorg.libpthreadstubs curl expat avahi enet libuuid libva
+    xorg.libpthreadstubs curl expat avahi libuuid libva
  ];

  meta = with lib; {
    description = "Open source implementation of NVIDIA's GameStream";
-    homepage = "https://github.com/irtimmer/moonlight-embedded";
-    license = licenses.gpl3;
+    homepage = "https://github.com/moonlight-stream/moonlight-embedded";
+    license = licenses.gpl3Plus;
    maintainers = [ maintainers.globin ];
    platforms = platforms.linux;
  };
--- a/pkgs/applications/misc/taskwarrior-tui/default.nix
+++ b/pkgs/applications/misc/taskwarrior-tui/default.nix
@ -5,19 +5,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "taskwarrior-tui";
-  version = "0.10.4";
+  version = "0.13.29";

  src = fetchFromGitHub {
    owner = "kdheepak";
    repo = "taskwarrior-tui";
    rev = "v${version}";
-    sha256 = "1rs6xpnmqzp45jkdzi8x06i8764gk7zl86sp6s0hiirbfqf7vwsy";
+    sha256 = "sha256-56+/WQESbf31UkJU4xONLY2T+WQVM0bI/x1yLZr3elI=";
  };

  # Because there's a test that requires terminal access
  doCheck = false;

-  cargoSha256 = "1c9vw1n6h7irwim1zf3mr0g520jnlvfqdy7y9v9g9xpkvbjr7ich";
+  cargoSha256 = "sha256-8am66wP2751AAMbWDBKZ89mAgr2poq3CU+aJF+I8/fs=";

  meta = with lib; {
    description = "A terminal user interface for taskwarrior ";
--- a/pkgs/applications/misc/tint2/default.nix
+++ b/pkgs/applications/misc/tint2/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "tint2";
-  version = "17.0";
+  version = "17.0.1";

  src = fetchFromGitLab {
    owner = "o9000";
    repo = "tint2";
    rev = version;
-    sha256 = "1gy5kki7vqrj43yl47cw5jqwmj45f7a8ppabd5q5p1gh91j7klgm";
+    sha256 = "sha256-yiXdG0qYcdol2pA1L9ii4XiLZyyUAl8/EJop48OLoXs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/vym/default.nix
+++ b/pkgs/applications/misc/vym/default.nix
@ -39,8 +39,6 @@ mkDerivation rec {
    install -Dm755 -t $out/share/man/man1 doc/*.1.gz
  '';

-  dontGzipMan = true;
-
  meta = with lib; {
    description = "A mind-mapping software";
    longDescription = ''
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -169,9 +169,9 @@ let
      ./patches/no-build-timestamps.patch
      # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags:
      ./patches/widevine-79.patch
+    ] ++ lib.optionals (versionRange "91" "94") [
      # Fix the build by adding a missing dependency (s. https://crbug.com/1197837):
      ./patches/fix-missing-atspi2-dependency.patch
-    ] ++ lib.optionals (versionRange "91" "94.0.4583.0") [
      # Required as dependency for the next patch:
      (githubPatch {
        # Reland "Reland "Linux sandbox syscall broker: use struct kernel_stat""
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -31,15 +31,15 @@
    }
  },
  "dev": {
-    "version": "94.0.4603.0",
-    "sha256": "1mhb7y7mhjbi5m79izcqvc6pjmgxvlk9vvr273k29gr2zq2m2fv3",
-    "sha256bin64": "1rqprc2vkyygwwwjk25xa2av30bqbx5dzs6nwhnzsdqwic5wdbbz",
+    "version": "94.0.4606.12",
+    "sha256": "1yv34wahg1f0l35kvlm3x17wvqdg8yyzmjj6naz2lnl5qai89zr8",
+    "sha256bin64": "19z9yzj6ig5ym8f9zzs8b4yixkspc0x62sz526r39803pbgs7s7i",
    "deps": {
      "gn": {
-        "version": "2021-07-31",
+        "version": "2021-08-11",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "eea3906f0e2a8d3622080127d2005ff214d51383",
-        "sha256": "1wc969jrivb502c45wdcbgh0c5888nqxla05is9bimkrk9rqppw3"
+        "rev": "69ec4fca1fa69ddadae13f9e6b7507efa0675263",
+        "sha256": "031znmkbm504iim5jvg3gmazj4qnkfc7zg8aymjsij18fhf7piz0"
      }
    }
  },
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@ -75,6 +75,10 @@ let

  suffix = if channel != "stable" then "-" + channel else "";

+  crashpadHandlerBinary = if lib.versionAtLeast version "94"
+    then "chrome_crashpad_handler"
+    else "crashpad_handler";
+
 in stdenv.mkDerivation {
  inherit version;

@ -146,7 +150,7 @@ in stdenv.mkDerivation {
      --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
      --add-flags ${escapeShellArg commandLineArgs}

-    for elf in $out/share/google/$appname/{chrome,chrome-sandbox,crashpad_handler,nacl_helper}; do
+    for elf in $out/share/google/$appname/{chrome,chrome-sandbox,${crashpadHandlerBinary},nacl_helper}; do
      patchelf --set-rpath $rpath $elf
      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $elf
    done
--- a/pkgs/applications/networking/cluster/dnsname-cni/default.nix
+++ b/pkgs/applications/networking/cluster/dnsname-cni/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "cni-plugin-dnsname";
-  version = "1.2.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "dnsname";
    rev = "v${version}";
-    sha256 = "sha256-hHkQOHDso92gXFCz40iQ7j2cHTEAMsaeW8MCJV2Otqo=";
+    sha256 = "sha256-kebN1OLMOrBKBz4aBV0VYm+LmLm6S0mKnVgG2u5I+d4=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/networking/cluster/docker-machine/xhyve.nix
+++ b/pkgs/applications/networking/cluster/docker-machine/xhyve.nix
@ -17,7 +17,7 @@ buildGoPackage rec {
    export CGO_CFLAGS=-I$(pwd)/go/src/${goPackagePath}/vendor/github.com/jceel/lib9p
    export CGO_LDFLAGS=$(pwd)/go/src/${goPackagePath}/vendor/build/lib9p/lib9p.a
  '';
-  buildFlags = "--tags lib9p";
+  tags = [ "lib9p" ];

  src = fetchFromGitHub {
    rev    = "v${version}";
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@ -20,13 +20,13 @@ buildGoModule rec {

  subPackages = ["cmd"];

-  preBuild = ''
-    export buildFlagsArray+=("-ldflags=-X main.kubeBuilderVersion=v${version} \
-        -X main.goos=$GOOS \
-        -X main.goarch=$GOARCH \
-        -X main.gitCommit=v${version} \
-        -X main.buildDate=v${version}")
-  '';
+  ldflags = [
+    "-X main.kubeBuilderVersion=v${version}"
+    "-X main.goos=${go.GOOS}"
+    "-X main.goarch=${go.GOARCH}"
+    "-X main.gitCommit=v${version}"
+    "-X main.buildDate=v${version}"
+  ];

  doCheck = true;

--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "nerdctl";
-  version = "0.11.0";
+  version = "0.11.1";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-uYiGerxZb5GW1dOcflERF3wvgJ8VOtRmQkyzC/ztwjk=";
+    sha256 = "sha256-r9VJQUmwe4UGCLmzxG2t9XHQ7KUeJxmEuAwxssPArcM=";
  };

-  vendorSha256 = "sha256-kGSibuXutyOvDkmajIQ0AqrwR3VUiWoM1Y2zk3MwwyU=";
+  vendorSha256 = "sha256-KnXxp/6L09a34cnv4h7vpPhNO6EGmeEC6c1ydyYXkxU=";

  nativeBuildInputs = [ makeWrapper installShellFiles ];

--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@ -83,8 +83,6 @@ stdenv.mkDerivation rec {
    moveToOutput bin/notmuch-emacs-mua $emacs
  '';

-  dontGzipMan = true; # already compressed
-
  passthru = {
    pythonSourceRoot = "notmuch-${version}/bindings/python";
    inherit version;
--- a/pkgs/applications/science/electronics/openroad/default.nix
+++ b/pkgs/applications/science/electronics/openroad/default.nix
@ -0,0 +1,94 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, bison
+, cmake
+, doxygen
+, flex
+, git
+, python3
+, swig4
+, boost172
+, cimg
+, eigen
+, lcov
+, lemon-graph
+, libjpeg
+, pcre
+, qtbase
+, readline
+, spdlog
+, tcl
+, tcllib
+, xorg
+, yosys
+, zlib
+}:
+
+mkDerivation rec {
+  pname = "openroad";
+  version = "2.0";
+
+  src = fetchFromGitHub {
+    owner = "The-OpenROAD-Project";
+    repo = "OpenROAD";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "1p677xh16wskfj06jnplhpc3glibhdaqxmk0j09832chqlryzwyx";
+  };
+
+  nativeBuildInputs = [
+    bison
+    cmake
+    doxygen
+    flex
+    git
+    swig4
+  ];
+
+  buildInputs = [
+    boost172
+    cimg
+    eigen
+    lcov
+    lemon-graph
+    libjpeg
+    pcre
+    python3
+    qtbase
+    readline
+    spdlog
+    tcl
+    tcllib
+    yosys
+    xorg.libX11
+    zlib
+  ];
+
+  postPatch = ''
+    patchShebangs --build etc/find_messages.py
+  '';
+
+  # Enable output images from the placer.
+  cmakeFlags = [ "-DUSE_CIMG_LIB=ON" ];
+
+  # Resynthesis needs access to the Yosys binaries.
+  qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ yosys ]}" ];
+
+  # Upstream uses vendored package versions for some dependencies, so regression testing is prudent
+  # to see if there are any breaking changes in unstable that should be vendored as well.
+  doCheck = false; # Disabled pending upstream release with fix for rcx log file creation.
+  checkPhase = ''
+    # Regression tests must be run from the project root not from within the CMake build directory.
+    cd ..
+    test/regression
+  '';
+
+  meta = with lib; {
+    description = "OpenROAD's unified application implementing an RTL-to-GDS flow";
+    homepage = "https://theopenroadproject.org";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ trepetti ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/science/math/colpack/default.nix
+++ b/pkgs/applications/science/math/colpack/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:

 stdenv.mkDerivation rec {

@ -12,20 +12,32 @@ stdenv.mkDerivation rec {
    sha256 = "1p05vry940mrjp6236c0z83yizmw9pk6ly2lb7d8rpb7j9h03glr";
  };

-  buildInputs = [ autoconf automake gettext libtool ];
+  nativeBuildInputs = [ autoreconfHook ];

-  configurePhase = ''
-    autoreconf -vif
-    ./configure --prefix=$out --enable-openmp
+  configureFlags = [
+    "--enable-openmp=${if stdenv.isLinux then "yes" else "no"}"
+    "--enable-examples=no"
+  ];
+
+  postInstall = ''
+    # Remove libtool archive
+    rm $out/lib/*.la
+
+    # Remove compiled examples (Basic examples get compiled anyway)
+    rm -r $out/examples
+
+    # Copy the example sources (Basic tree contains scripts and object files)
+    mkdir -p $out/share/ColPack/examples/Basic
+    cp SampleDrivers/Basic/*.cpp $out/share/ColPack/examples/Basic
+    cp -r SampleDrivers/Matrix* $out/share/ColPack/examples
  '';

  meta = with lib; {
    description = "A package comprising of implementations of algorithms for
    vertex coloring and derivative computation";
    homepage = "http://cscapes.cs.purdue.edu/coloringpage/software.htm#functionalities";
-    license = licenses.lgpl3;
-    platforms = platforms.linux;
+    license = licenses.lgpl3Plus;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ edwtjo ];
  };
-
 }
--- a/pkgs/applications/terminal-emulators/aminal/default.nix
+++ b/pkgs/applications/terminal-emulators/aminal/default.nix
@ -33,9 +33,9 @@ buildGoPackage rec {
    sha256 = "0syv9md7blnl6i19zf8s1xjx5vfz6s755fxyg2ply0qc1pwhsj8n";
  };

-  preBuild = ''
-    buildFlagsArray=("-ldflags=-X ${goPackagePath}/version.Version=${version}")
-  '';
+  ldflags = [
+    "-X ${goPackagePath}/version.Version=${version}"
+  ];

  meta = with lib; {
    description = "Golang terminal emulator from scratch";
--- a/pkgs/applications/terminal-emulators/hyper/default.nix
+++ b/pkgs/applications/terminal-emulators/hyper/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, dpkg, atk, glib, pango, gdk-pixbuf, gnome2, gtk3, cairo
+{ stdenv, lib, fetchurl, dpkg, atk, glib, pango, gdk-pixbuf, gtk3, cairo
 , freetype, fontconfig, dbus, libXi, libXcursor, libXdamage, libXrandr, libXcomposite
 , libXext, libXfixes, libXrender, libX11, libXtst, libXScrnSaver, libxcb, nss, nspr
 , alsa-lib, cups, expat, udev, libpulseaudio, at-spi2-atk, at-spi2-core, libxshmfence
@ -6,7 +6,7 @@

 let
  libPath = lib.makeLibraryPath [
-    stdenv.cc.cc gtk3 gnome2.GConf atk glib pango gdk-pixbuf cairo freetype fontconfig dbus
+    stdenv.cc.cc gtk3 atk glib pango gdk-pixbuf cairo freetype fontconfig dbus
    libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes libxcb
    libXrender libX11 libXtst libXScrnSaver nss nspr alsa-lib cups expat udev libpulseaudio
    at-spi2-atk at-spi2-core libxshmfence libdrm libxkbcommon mesa
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -750,6 +750,9 @@ rec {
        root:x:0:
        nobody:x:65534:
      '')
+      (writeTextDir "etc/nsswitch.conf" ''
+        hosts: files dns
+      '')
      (runCommand "var-empty" { } ''
        mkdir -p $out/var/empty
      '')
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@ -10,7 +10,6 @@
 , importCargoLock
 , rustPlatform
 , callPackage
-, remarshal
 , git
 , rust
 , rustc
--- a/pkgs/data/themes/marwaita-pop_os/default.nix
+++ b/pkgs/data/themes/marwaita-pop_os/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , gdk-pixbuf
 , gtk-engine-murrine
@ -8,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "marwaita-pop_os";
-  version = "1.1";
+  version = "10.3";

  src = fetchFromGitHub {
    owner = "darkomarko42";
    repo = pname;
    rev = version;
-    sha256 = "1nwfyy3jnfsdlqgj7ig9gbawazdm76g02b0hrfsll17j5498d59y";
+    sha256 = "1j6d91kx6iw8sy35rhhjvwb3qz60bvf7a7g7q2i0sznzdicrwsq6";
  };

  buildInputs = [
--- a/pkgs/data/themes/vimix/default.nix
+++ b/pkgs/data/themes/vimix/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "vimix-gtk-themes";
-  version = "2021-08-09";
+  version = "2021-08-17";

  src = fetchFromGitHub {
    owner = "vinceliuice";
    repo = pname;
    rev = version;
-    sha256 = "0j6sq7z4zqc9q4hqcq4y9vh4qpgl0v1i353l6rcd6bh1r594rwjm";
+    sha256 = "1pn737w99j4ij8qkgw0rrzhbcqzni73z5wnkfqgqqbhj38rafbpv";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/sushi/default.nix
+++ b/pkgs/desktops/gnome/core/sushi/default.nix
@ -23,11 +23,11 @@

 stdenv.mkDerivation rec {
  pname = "sushi";
-  version = "3.38.0";
+  version = "3.38.1";

  src = fetchurl {
    url = "mirror://gnome/sources/sushi/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0vlqqk916dymv4asbyvalp1m096a5hh99nx23i4xavzvgygh4h2h";
+    sha256 = "8+bRDIFVKNA6Zl+v0VwHGeAXqBOXWzrzIHYZnjeIiOk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/gcc-arm-embedded/10/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/10/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , ncurses5
 , python27
@ -6,22 +7,21 @@

 stdenv.mkDerivation rec {
  pname = "gcc-arm-embedded";
-  version = "10.2.1";
-  release = "10-2020-q4-major";
-  subdir = "10-2020q4";
+  version = "10.3.1";
+  release = "10.3-2021.07";

  suffix = {
    aarch64-linux = "aarch64-linux";
-    x86_64-darwin = "mac";
+    x86_64-darwin = "mac-10.14.6";
    x86_64-linux  = "x86_64-linux";
  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

  src = fetchurl {
-    url = "https://developer.arm.com/-/media/Files/downloads/gnu-rm/${subdir}/gcc-arm-none-eabi-${release}-${suffix}.tar.bz2";
+    url = "https://developer.arm.com/-/media/Files/downloads/gnu-rm/${release}/gcc-arm-none-eabi-${release}-${suffix}.tar.bz2";
    sha256 = {
-      aarch64-linux = "0spkbh7vnda1w0nvavk342nb24nqxn8kln3k9j85mzil560qqg9l";
-      x86_64-darwin = "1h5xn0npwkilqxg7ifrymsl7kjpafr9r9gjqgcpb0kjxavijvldy";
-      x86_64-linux  = "066nvhg5zdf3jvy9w23y439ghf1hvbicdyrrw9957gwb8ym4q4r1";
+      aarch64-linux = "0y4nyrff5bq90v44z2h90gqgl18bs861i9lygx4z89ym85jycx9s";
+      x86_64-darwin = "1r3yidmgx1xq1f19y2c5njf2g95vs9cssmmsxsb68qm192r58i8a";
+      x86_64-linux  = "1skcalz1sr0hhpjcl8qjsqd16n2w0zrbnlrbr8sx0g728kiqsnwc";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

--- a/pkgs/development/compilers/gcc-arm-embedded/6/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/6/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , ncurses5
 , python27
--- a/pkgs/development/compilers/gcc-arm-embedded/7/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/7/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , ncurses5
 , python27
--- a/pkgs/development/compilers/gcc-arm-embedded/8/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/8/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , ncurses5
 , python27
--- a/pkgs/development/compilers/gcc-arm-embedded/9/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/9/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , ncurses5
 , python27
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@ -1,284 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, tzdata
-, iana-etc
-, runCommand
-, perl
-, which
-, pkg-config
-, patch
-, procps
-, pcre
-, cacert
-, Security
-, Foundation
-, mailcap
-, runtimeShell
-, buildPackages
-, pkgsBuildTarget
-, fetchpatch
-, callPackage
-}:
-
-let
-  go_bootstrap = buildPackages.callPackage ./bootstrap.nix { };
-
-  goBootstrap = runCommand "go-bootstrap" { } ''
-    mkdir $out
-    cp -rf ${go_bootstrap}/* $out/
-    chmod -R u+w $out
-    find $out -name "*.c" -delete
-    cp -rf $out/bin/* $out/share/go/bin/
-  '';
-
-  goarch = platform: {
-    "i686" = "386";
-    "x86_64" = "amd64";
-    "aarch64" = "arm64";
-    "arm" = "arm";
-    "armv5tel" = "arm";
-    "armv6l" = "arm";
-    "armv7l" = "arm";
-    "powerpc64le" = "ppc64le";
-    "mips" = "mips";
-  }.${platform.parsed.cpu.name} or (throw "Unsupported system");
-
-  # We need a target compiler which is still runnable at build time,
-  # to handle the cross-building case where build != host == target
-  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
-in
-
-stdenv.mkDerivation rec {
-  pname = "go";
-  version = "1.14.15";
-
-  src = fetchurl {
-    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0jci03f5z09xibbdqg4lnv2k3crhal1phzwr6lc4ajp514i3plby";
-  };
-
-  # perl is used for testing go vet
-  nativeBuildInputs = [ perl which pkg-config patch procps ];
-  buildInputs = [ cacert pcre ]
-    ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
-    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
-
-  depsTargetTargetPropagated = lib.optionals stdenv.isDarwin [ Security Foundation ];
-
-  hardeningDisable = [ "all" ];
-
-  prePatch = ''
-    patchShebangs ./ # replace /bin/bash
-
-    # This source produces shell script at run time,
-    # and thus it is not corrected by patchShebangs.
-    substituteInPlace misc/cgo/testcarchive/carchive_test.go \
-      --replace '#!/usr/bin/env bash' '#!${runtimeShell}'
-
-    # Patch the mimetype database location which is missing on NixOS.
-    # but also allow static binaries built with NixOS to run outside nix
-    sed -i 's,\"/etc/mime.types,"${mailcap}/etc/mime.types\"\,\n\t&,' src/mime/type_unix.go
-
-    # Disabling the 'os/http/net' tests (they want files not available in
-    # chroot builds)
-    rm src/net/{listen,parse}_test.go
-    rm src/syscall/exec_linux_test.go
-
-    # !!! substituteInPlace does not seems to be effective.
-    # The os test wants to read files in an existing path. Just don't let it be /usr/bin.
-    sed -i 's,/usr/bin,'"`pwd`", src/os/os_test.go
-    sed -i 's,/bin/pwd,'"`type -P pwd`", src/os/os_test.go
-    # Disable the unix socket test
-    sed -i '/TestShutdownUnix/aif true \{ return\; \}' src/net/net_test.go
-    # Disable the hostname test
-    sed -i '/TestHostname/aif true \{ return\; \}' src/os/os_test.go
-    # ParseInLocation fails the test
-    sed -i '/TestParseInSydney/aif true \{ return\; \}' src/time/format_test.go
-    # Remove the api check as it never worked
-    sed -i '/src\/cmd\/api\/run.go/ireturn nil' src/cmd/dist/test.go
-    # Remove the coverage test as we have removed this utility
-    sed -i '/TestCoverageWithCgo/aif true \{ return\; \}' src/cmd/go/go_test.go
-    # Remove the timezone naming test
-    sed -i '/TestLoadFixed/aif true \{ return\; \}' src/time/time_test.go
-    # Remove disable setgid test
-    sed -i '/TestRespectSetgidDir/aif true \{ return\; \}' src/cmd/go/internal/work/build_test.go
-    # Remove cert tests that conflict with NixOS's cert resolution
-    sed -i '/TestEnvVars/aif true \{ return\; \}' src/crypto/x509/root_unix_test.go
-    # TestWritevError hangs sometimes
-    sed -i '/TestWritevError/aif true \{ return\; \}' src/net/writev_test.go
-    # TestVariousDeadlines fails sometimes
-    sed -i '/TestVariousDeadlines/aif true \{ return\; \}' src/net/timeout_test.go
-
-    sed -i 's,/etc/protocols,${iana-etc}/etc/protocols,' src/net/lookup_unix.go
-    sed -i 's,/etc/services,${iana-etc}/etc/services,' src/net/port_unix.go
-
-    # Disable cgo lookup tests not works, they depend on resolver
-    rm src/net/cgo_unix_test.go
-
-  '' + lib.optionalString stdenv.isLinux ''
-    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
-    # that run outside a nix server
-    sed -i 's,\"/usr/share/zoneinfo/,"${tzdata}/share/zoneinfo/\"\,\n\t&,' src/time/zoneinfo_unix.go
-
-  '' + lib.optionalString stdenv.isAarch32 ''
-    echo '#!${runtimeShell}' > misc/cgo/testplugin/test.bash
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace src/race.bash --replace \
-      "sysctl machdep.cpu.extfeatures | grep -qv EM64T" true
-    sed -i 's,strings.Contains(.*sysctl.*,true {,' src/cmd/dist/util.go
-    sed -i 's,"/etc","'"$TMPDIR"'",' src/os/os_test.go
-    sed -i 's,/_go_os_test,'"$TMPDIR"'/_go_os_test,' src/os/path_test.go
-
-    sed -i '/TestChdirAndGetwd/aif true \{ return\; \}' src/os/os_test.go
-    sed -i '/TestCredentialNoSetGroups/aif true \{ return\; \}' src/os/exec/exec_posix_test.go
-    sed -i '/TestRead0/aif true \{ return\; \}' src/os/os_test.go
-    sed -i '/TestSystemRoots/aif true \{ return\; \}' src/crypto/x509/root_darwin_test.go
-
-    sed -i '/TestGoInstallRebuildsStalePackagesInOtherGOPATH/aif true \{ return\; \}' src/cmd/go/go_test.go
-    sed -i '/TestBuildDashIInstallsDependencies/aif true \{ return\; \}' src/cmd/go/go_test.go
-
-    sed -i '/TestDisasmExtld/aif true \{ return\; \}' src/cmd/objdump/objdump_test.go
-
-    sed -i 's/unrecognized/unknown/' src/cmd/link/internal/ld/lib.go
-
-    # TestCurrent fails because Current is not implemented on Darwin
-    sed -i 's/TestCurrent/testCurrent/g' src/os/user/user_test.go
-    sed -i 's/TestLookup/testLookup/g' src/os/user/user_test.go
-
-    touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd
-  '';
-
-  patches = [
-    ./remove-tools-1.11.patch
-    ./ssl-cert-file-1.13.patch
-    ./remove-test-pie-1.14.patch
-    ./creds-test.patch
-    ./go-1.9-skip-flaky-19608.patch
-    ./go-1.9-skip-flaky-20072.patch
-    ./skip-external-network-tests.patch
-    ./skip-nohup-tests.patch
-    ./go_no_vendor_checks-1_14.patch
-
-    # support TZ environment variable starting with colon
-    (fetchpatch {
-      name = "tz-support-colon.patch";
-      url = "https://github.com/golang/go/commit/58fe2cd4022c77946ce4b598cf3e30ccc8367143.patch";
-      sha256 = "0vphwiqrm0qykfj3rfayr65qzk22fksg7qkamvaz0lmf6fqvbd2f";
-    })
-
-    # fix rare TestDontCacheBrokenHTTP2Conn failure
-    (fetchpatch {
-      url = "https://github.com/golang/go/commit/ea1437a8cdf6bb3c2d2447833a5d06dbd75f7ae4.patch";
-      sha256 = "1lyzy4nf8c34a966vw45j3j7hzpvncq2gqspfxffzkyh17xd8sgy";
-    })
-  ] ++ [
-    # breaks under load: https://github.com/golang/go/issues/25628
-    (if stdenv.isAarch32
-    then ./skip-test-extra-files-on-aarch32-1.14.patch
-    else ./skip-test-extra-files-on-386-1.14.patch)
-  ];
-
-  postPatch = ''
-    find . -name '*.orig' -exec rm {} ';'
-  '';
-
-  GOOS = stdenv.targetPlatform.parsed.kernel.name;
-  GOARCH = goarch stdenv.targetPlatform;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
-  GOHOSTARCH = goarch stdenv.buildPlatform;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET =
-    if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${targetCC}/bin/${targetCC.targetPrefix}cc"
-    else
-      null;
-  CXX_FOR_TARGET =
-    if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${targetCC}/bin/${targetCC.targetPrefix}c++"
-    else
-      null;
-
-  GOARM = toString (lib.intersectLists [ (stdenv.hostPlatform.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
-  GO386 = 387; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-  # Hopefully avoids test timeouts on Hydra
-  GO_TEST_TIMEOUT_SCALE = 3;
-
-  # Indicate that we are running on build infrastructure
-  # Some tests assume things like home directories and users exists
-  GO_BUILDER_NAME = "nix";
-
-  GOROOT_BOOTSTRAP = "${goBootstrap}/share/go";
-
-  postConfigure = ''
-    export GOCACHE=$TMPDIR/go-cache
-    # this is compiled into the binary
-    export GOROOT_FINAL=$out/share/go
-
-    export PATH=$(pwd)/bin:$PATH
-
-    ${lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform) ''
-    # Independent from host/target, CC should produce code for the building system.
-    # We only set it when cross-compiling.
-    export CC=${buildPackages.stdenv.cc}/bin/cc
-    ''}
-    ulimit -a
-  '';
-
-  postBuild = ''
-    (cd src && ./make.bash)
-  '';
-
-  doCheck = stdenv.hostPlatform == stdenv.targetPlatform && !stdenv.isDarwin;
-
-  checkPhase = ''
-    runHook preCheck
-    (cd src && HOME=$TMPDIR GOCACHE=$TMPDIR/go-cache ./run.bash --no-rebuild)
-    runHook postCheck
-  '';
-
-  preInstall = ''
-    rm -r pkg/obj
-    # Contains the wrong perl shebang when cross compiling,
-    # since it is not used for anything we can deleted as well.
-    rm src/regexp/syntax/make_perl_groups.pl
-  '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
-    mv bin/*_*/* bin
-    rmdir bin/*_*
-    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
-    ''}
-  '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
-    rm -rf bin/*_*
-    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
-    ''}
-  '' else "");
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $GOROOT_FINAL
-    cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
-    runHook postInstall
-  '';
-
-  disallowedReferences = [ goBootstrap ];
-
-  meta = with lib; {
-    homepage = "http://golang.org/";
-    description = "The Go Programming language";
-    license = licenses.bsd3;
-    maintainers = teams.golang.members;
-    platforms = platforms.linux ++ platforms.darwin;
-    knownVulnerabilities = [
-      "Support for Go 1.14 ended with the release of Go 1.16: https://golang.org/doc/devel/release.html#policy"
-    ];
-  };
-}
--- a/pkgs/development/compilers/go/go_no_vendor_checks-1_14.patch
+++ b/pkgs/development/compilers/go/go_no_vendor_checks-1_14.patch
@ -1,23 +0,0 @@
-Starting from go1.14, go verifes that vendor/modules.txt matches the requirements
-and replacements listed in the main module go.mod file, and it is a hard failure if
-vendor/modules.txt is missing.
-
-Relax module consistency checks and switch back to pre go1.14 behaviour if
-vendor/modules.txt is missing regardless of go version requirement in go.mod.
-
-This has been ported from FreeBSD: https://reviews.freebsd.org/D24122
-See https://github.com/golang/go/issues/37948 for discussion.
-
-diff --git a/src/cmd/go/internal/modload/init.go b/src/cmd/go/internal/modload/init.go
-index 71f68efbcc..3c566d04dd 100644
--- a/src/cmd/go/internal/modload/init.go
-+++ b/src/cmd/go/internal/modload/init.go
-@@ -133,7 +133,7 @@ func checkVendorConsistency() {
- 	readVendorList()
-
- 	pre114 := false
-	if modFile.Go == nil || semver.Compare("v"+modFile.Go.Version, "v1.14") < 0 {
-+	if modFile.Go == nil || semver.Compare("v"+modFile.Go.Version, "v1.14") < 0 || (os.Getenv("GO_NO_VENDOR_CHECKS") == "1" && len(vendorMeta) == 0) {
- 		// Go versions before 1.14 did not include enough information in
- 		// vendor/modules.txt to check for consistency.
- 		// If we know that we're on an earlier version, relax the consistency check.
--- a/pkgs/development/compilers/go/remove-test-pie-1.14.patch
+++ b/pkgs/development/compilers/go/remove-test-pie-1.14.patch
@ -1,34 +0,0 @@
-diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
-index 56bdfcac19..d7d67ab94d 100644
--- a/src/cmd/dist/test.go
-+++ b/src/cmd/dist/test.go
-@@ -580,29 +580,6 @@ func (t *tester) registerTests() {
- 		})
- 	}
- 
-	// Test internal linking of PIE binaries where it is supported.
-	if goos == "linux" && (goarch == "amd64" || goarch == "arm64") {
-		t.tests = append(t.tests, distTest{
-			name:    "pie_internal",
-			heading: "internal linking of -buildmode=pie",
-			fn: func(dt *distTest) error {
-				t.addCmd(dt, "src", t.goTest(), "reflect", "-buildmode=pie", "-ldflags=-linkmode=internal", t.timeout(60))
-				return nil
-			},
-		})
-		// Also test a cgo package.
-		if t.cgoEnabled && t.internalLink() {
-			t.tests = append(t.tests, distTest{
-				name:    "pie_internal_cgo",
-				heading: "internal linking of -buildmode=pie",
-				fn: func(dt *distTest) error {
-					t.addCmd(dt, "src", t.goTest(), "os/user", "-buildmode=pie", "-ldflags=-linkmode=internal", t.timeout(60))
-					return nil
-				},
-			})
-		}
-	}
-
- 	// sync tests
- 	if goos != "js" { // js doesn't support -cpu=10
- 		t.tests = append(t.tests, distTest{
--- a/pkgs/development/compilers/go/skip-external-network-tests.patch
+++ b/pkgs/development/compilers/go/skip-external-network-tests.patch
@ -1,26 +0,0 @@
-diff --git a/src/cmd/go/go_test.go b/src/cmd/go/go_test.go
-index 85cae90..94b4edd 100644
--- a/src/cmd/go/go_test.go
-+++ b/src/cmd/go/go_test.go
-@@ -4946,6 +4946,8 @@ func TestBuildmodePIE(t *testing.T) {
- }
- 
- func TestExecBuildX(t *testing.T) {
-+	t.Skipf("skipping, test requires networking")
-+
- 	tooSlow(t)
- 	if !canCgo {
- 		t.Skip("skipping because cgo not enabled")
-diff --git a/src/net/dial_test.go b/src/net/dial_test.go
-index 00a84d1..27f9ec9 100644
--- a/src/net/dial_test.go
-+++ b/src/net/dial_test.go
-@@ -968,6 +968,8 @@ func TestDialerControl(t *testing.T) {
- // mustHaveExternalNetwork is like testenv.MustHaveExternalNetwork
- // except that it won't skip testing on non-iOS builders.
- func mustHaveExternalNetwork(t *testing.T) {
-+	t.Skipf("Nix sandbox does not have networking")
-+
- 	t.Helper()
- 	ios := runtime.GOOS == "darwin" && (runtime.GOARCH == "arm" || runtime.GOARCH == "arm64")
- 	if testenv.Builder() == "" || ios {
--- a/pkgs/development/compilers/go/ssl-cert-file-1.13.patch
+++ b/pkgs/development/compilers/go/ssl-cert-file-1.13.patch
@ -1,64 +0,0 @@
-diff --git a/src/crypto/x509/root_cgo_darwin.go b/src/crypto/x509/root_cgo_darwin.go
-index 255a8d3525..a467255a54 100644
--- a/src/crypto/x509/root_cgo_darwin.go
-+++ b/src/crypto/x509/root_cgo_darwin.go
-@@ -280,6 +280,8 @@ int CopyPEMRoots(CFDataRef *pemRoots, CFDataRef *untrustedPemRoots, bool debugDa
- import "C"
- import (
- 	"errors"
-+	"io/ioutil"
-+	"os"
- 	"unsafe"
- )
- 
-@@ -295,6 +297,13 @@ func loadSystemRoots() (*CertPool, error) {
- 	buf := C.GoBytes(unsafe.Pointer(C.CFDataGetBytePtr(data)), C.int(C.CFDataGetLength(data)))
- 	roots := NewCertPool()
- 	roots.AppendCertsFromPEM(buf)
-+	if file := os.Getenv("NIX_SSL_CERT_FILE"); file != "" {
-+		data, err := ioutil.ReadFile(file)
-+		if err == nil {
-+			roots.AppendCertsFromPEM(data)
-+			return roots, nil
-+		}
-+	}
- 
- 	if C.CFDataGetLength(untrustedData) == 0 {
- 		return roots, nil
-diff --git a/src/crypto/x509/root_darwin.go b/src/crypto/x509/root_darwin.go
-index 2f6a8b8d60..b81889fe69 100644
--- a/src/crypto/x509/root_darwin.go
-+++ b/src/crypto/x509/root_darwin.go
-@@ -92,6 +92,14 @@ func execSecurityRoots() (*CertPool, error) {
- 		verifyCh    = make(chan rootCandidate)
- 	)
- 
-+	if file := os.Getenv("NIX_SSL_CERT_FILE"); file != "" {
-+		data, err := ioutil.ReadFile(file)
-+		if err == nil {
-+			roots.AppendCertsFromPEM(data)
-+			return roots, nil
-+		}
-+	}
-+
- 	// Using 4 goroutines to pipe into verify-cert seems to be
- 	// about the best we can do. The verify-cert binary seems to
- 	// just RPC to another server with coarse locking anyway, so
-diff --git a/src/crypto/x509/root_unix.go b/src/crypto/x509/root_unix.go
-index 48de50b4ea..750e12c6b4 100644
--- a/src/crypto/x509/root_unix.go
-+++ b/src/crypto/x509/root_unix.go
-@@ -38,6 +38,13 @@ func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate
- 
- func loadSystemRoots() (*CertPool, error) {
- 	roots := NewCertPool()
-+	if file := os.Getenv("NIX_SSL_CERT_FILE"); file != "" {
-+		data, err := ioutil.ReadFile(file)
-+		if err == nil {
-+			roots.AppendCertsFromPEM(data)
-+			return roots, nil
-+		}
-+	}
- 
- 	files := certFiles
- 	if f := os.Getenv(certFileEnv); f != "" {
--- a/pkgs/development/compilers/rust/default.nix
+++ b/pkgs/development/compilers/rust/default.nix
@ -38,8 +38,11 @@
      "armv5tel" = "armv5te";
      "riscv64" = "riscv64gc";
    }.${cpu.name} or cpu.name;
+    vendor_ = platform.rustc.platform.vendor or {
+      "w64" = "pc";
+    }.${vendor.name} or vendor.name;
  in platform.rustc.config
-    or "${cpu_}-${vendor.name}-${kernel.name}${lib.optionalString (abi.name != "unknown") "-${abi.name}"}";
+    or "${cpu_}-${vendor_}-${kernel.name}${lib.optionalString (abi.name != "unknown") "-${abi.name}"}";

  # Returns the name of the rust target if it is standard, or the json file
  # containing the custom target spec.
--- a/pkgs/development/compilers/scala/2.x.nix
+++ b/pkgs/development/compilers/scala/2.x.nix
@ -1,5 +1,5 @@
-{ stdenv, lib, fetchurl, makeWrapper, jre, gnugrep, coreutils
-, writeScript, common-updater-scripts, git, gnused, nix, nixfmt, majorVersion }:
+{ stdenv, lib, fetchurl, makeWrapper, jre, gnugrep, coreutils, writeScript
+, common-updater-scripts, git, gnused, nix, nixfmt, majorVersion }:

 with lib;

@ -20,8 +20,8 @@ let
    };

    "2.12" = {
-      version = "2.12.13";
-      sha256 = "17548sx7liskkadqiqaajmwp2w7bh9m2d8hp2mwyg8yslmjx4pcc";
+      version = "2.12.14";
+      sha256 = "/X4+QDIogBOinAoUR8WX+vew5Jl2LA2YHbIQmel4BCY=";
      pname = "scala_2_12";
    };

--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@ -12,12 +12,13 @@
 , swig
 , bash
 , libxml2
-, clang
-, python
+, clang_10
+, python3
 , ncurses
 , libuuid
 , libbsd
 , icu
+, libgcc
 , autoconf
 , libtool
 , automake
@ -35,9 +36,14 @@
 }:

 let
-  version = "5.1.1";
+  version = "5.4.2";

-  fetch = { repo, sha256, fetchSubmodules ? false }:
+  # These dependency versions can be found in utils/update_checkout/update-checkout-config.json.
+  swiftArgumentParserVersion = "0.3.0";
+  yamsVersion = "3.0.1";
+  swiftFormatVersion = "0.50400.0";
+
+  fetchSwiftRelease = { repo, sha256, fetchSubmodules ? false }:
    fetchFromGitHub {
      owner = "apple";
      inherit repo sha256 fetchSubmodules;
@ -45,63 +51,87 @@ let
      name = "${repo}-${version}-src";
    };

+  # Sources based on utils/update_checkout/update_checkout-config.json.
  sources = {
-    llvm = fetch {
-      repo = "swift-llvm";
-      sha256 = "00ldd9dby6fl6nk3z17148fvb7g9x4jkn1afx26y51v8rwgm1i7f";
+    swift = fetchSwiftRelease {
+      repo = "swift";
+      sha256 = "0qrkqkwpmk312fi12kwwyihin01qb7sphhdz5c6an8j1rjfd9wbv";
    };
-    compilerrt = fetch {
-      repo = "swift-compiler-rt";
-      sha256 = "1431f74l0n2dxn728qp65nc6hivx88fax1wzfrnrv19y77br05wj";
-    };
-    clang = fetch {
-      repo = "swift-clang";
-      sha256 = "0n7k6nvzgqp6h6bfqcmna484w90db3zv4sh5rdh89wxyhdz6rk4v";
-    };
-    clangtools = fetch {
-      repo = "swift-clang-tools-extra";
-      sha256 = "0snp2rpd60z239pr7fxpkj332rkdjhg63adqvqdkjsbrxcqqcgqa";
-    };
-    indexstore = fetch {
-      repo = "indexstore-db";
-      sha256 = "1gwkqkdmpd5hn7555dpdkys0z50yh00hjry2886h6rx7avh5p05n";
-    };
-    sourcekit = fetch {
-      repo = "sourcekit-lsp";
-      sha256 = "0k84ssr1k7grbvpk81rr21ii8csnixn9dp0cga98h6i1gshn8ml4";
-    };
-    cmark = fetch {
+    cmark = fetchSwiftRelease {
      repo = "swift-cmark";
-      sha256 = "079smm79hbwr06bvghd2sb86b8gpkprnzlyj9kh95jy38xhlhdnj";
+      sha256 = "0340j9x2n40yx61ma2pgqfbn3a9ijrh20iwzd1zxqq87rr76hh3z";
    };
-    lldb = fetch {
-      repo = "swift-lldb";
-      sha256 = "0j787475f0nlmvxqblkhn3yrvn9qhcb2jcijwijxwq95ar2jdygs";
-    };
-    llbuild = fetch {
+    llbuild = fetchSwiftRelease {
      repo = "swift-llbuild";
-      sha256 = "1n2s5isxyl6b6ya617gdzjbw68shbvd52vsfqc1256rk4g448v8b";
+      sha256 = "0d7sj5a9b5c1ry2209cpccic5radf9s48sp1lahqzmd1pdx3n7pi";
    };
-    pm = fetch {
+    argumentParser = fetchFromGitHub {
+      owner = "apple";
+      repo = "swift-argument-parser";
+      rev = swiftArgumentParserVersion;
+      sha256 = "15vv7hnffa84142q97dwjcn196p2bg8nfh89d6nnix0i681n1qfd";
+      name = "swift-argument-parser-${swiftArgumentParserVersion}";
+    };
+    driver = fetchSwiftRelease {
+      repo = "swift-driver";
+      sha256 = "1j08273haqv7786rkwsmw7g103glfwy1d2807490id9lagq3r66z";
+    };
+    toolsSupportCore = fetchSwiftRelease {
+      repo = "swift-tools-support-core";
+      sha256 = "07gm28ki4px7xzrplvk9nd1pp5r9nyi87l21i0rcbb3r6wrikxb4";
+    };
+    swiftpm = fetchSwiftRelease {
      repo = "swift-package-manager";
-      sha256 = "1a49jmag5mpld9zr96g8a773334mrz1c4nyw38gf4p6sckf4jp29";
+      sha256 = "05linnzlidxamzl3723zhyrfm24pk2cf1x66a3nk0cxgnajw0vzx";
    };
-    xctest = fetch {
+    syntax = fetchSwiftRelease {
+      repo = "swift-syntax";
+      sha256 = "1y9agx9bg037xjhkwc28xm28kjyqydgv21s4ijgy5l51yg1g0daj";
+    };
+    # TODO: possibly re-add stress-tester.
+    corelibsXctest = fetchSwiftRelease {
      repo = "swift-corelibs-xctest";
-      sha256 = "0rxy9sq7i0s0kxfkz0hvdp8zyb40h31f7g4m0kry36qk82gzzh89";
+      sha256 = "00c68580yr12yxshl0hxyhp8psm15fls3c7iqp52hignyl4v745r";
    };
-    foundation = fetch {
+    corelibsFoundation = fetchSwiftRelease {
      repo = "swift-corelibs-foundation";
-      sha256 = "1iiiijsnys0r3hjcj1jlkn3yszzi7hwb2041cnm5z306nl9sybzp";
+      sha256 = "1jyadm2lm7hhik8n8wacfiffpdwqsgnilwmcw22qris5s2drj499";
    };
-    libdispatch = fetch {
+    corelibsLibdispatch = fetchSwiftRelease {
      repo = "swift-corelibs-libdispatch";
-      sha256 = "0laqsizsikyjhrzn0rghvxd8afg4yav7cbghvnf7ywk9wc6kpkmn";
+      sha256 = "1s46c0hrxi42r43ff5f1pq2imb3hs05adfpwfxkilgqyb5svafsp";
      fetchSubmodules = true;
    };
-    swift = fetch {
-      repo = "swift";
-      sha256 = "0m4r1gzrnn0s1c7haqq9dlmvpqxbgbkbdfmq6qaph869wcmvdkvy";
+    # TODO: possibly re-add integration-tests.
+    # Linux does not support Xcode playgrounds.
+    # We provide our own ninja.
+    # We provider our own icu.
+    yams = fetchFromGitHub {
+      owner = "jpsim";
+      repo = "Yams";
+      rev = yamsVersion;
+      sha256 = "13md54y7lalrpynrw1s0w5yw6rrjpw46fml9dsk2m3ph1bnlrqrq";
+      name = "Yams-${yamsVersion}";
+    };
+    # We provide our own CMake.
+    indexstoreDb = fetchSwiftRelease {
+      repo = "indexstore-db";
+      sha256 = "1ap3hiq2jd3cn10d8d674xysq27by878mvq087a80681r8cdivn3";
+    };
+    sourcekitLsp = fetchSwiftRelease {
+      repo = "sourcekit-lsp";
+      sha256 = "02m9va0lsn2hnwkmgrbgj452sbyaswwmq14lqvxgnb7gssajv4gc";
+    };
+    format = fetchFromGitHub {
+      owner = "apple";
+      repo = "swift-format";
+      rev = swiftFormatVersion;
+      sha256 = "0skmmggsh31f3rnqcrx43178bc7scrjihibnwn68axagasgbqn4k";
+      name = "swift-format-${swiftFormatVersion}-src";
+    };
+    llvmProject = fetchSwiftRelease {
+      repo = "llvm-project";
+      sha256 = "166hd9d2i55zj70xjb1qmbblbfyk8hdb2qv974i07j6cvynn30lm";
    };
  };

@ -112,6 +142,7 @@ let
    libblocksruntime
    libbsd
    libedit
+    libgcc
    libuuid
    libxml2
    ncurses
@ -119,6 +150,8 @@ let
    swig
  ];

+  python = (python3.withPackages (ps: [ps.six]));
+
  cmakeFlags = [
    "-DGLIBC_INCLUDE_PATH=${stdenv.cc.libc.dev}/include"
    "-DC_INCLUDE_DIRS=${lib.makeSearchPathOutput "dev" "include" devInputs}:${libxml2.dev}/include/libxml2"
@ -136,6 +169,7 @@ stdenv.mkDerivation {
    cmake
    coreutils
    findutils
+    git
    gnumake
    libtool
    makeWrapper
@ -147,11 +181,12 @@ stdenv.mkDerivation {
    which
  ];
  buildInputs = devInputs ++ [
-    clang
+    clang_10
  ];

-  # TODO: Revisit what's propagated and how
+  # TODO: Revisit what needs to be propagated and how.
  propagatedBuildInputs = [
+    libgcc
    libgit2
    python
  ];
@ -164,32 +199,33 @@ stdenv.mkDerivation {
    cd src
    export SWIFT_SOURCE_ROOT=$PWD

-    cp -r ${sources.llvm} llvm
-    cp -r ${sources.compilerrt} compiler-rt
-    cp -r ${sources.clang} clang
-    cp -r ${sources.clangtools} clang-tools-extra
-    cp -r ${sources.indexstore} indexstore-db
-    cp -r ${sources.sourcekit} sourcekit-lsp
-    cp -r ${sources.cmark} cmark
-    cp -r ${sources.lldb} lldb
-    cp -r ${sources.llbuild} llbuild
-    cp -r ${sources.pm} swiftpm
-    cp -r ${sources.xctest} swift-corelibs-xctest
-    cp -r ${sources.foundation} swift-corelibs-foundation
-    cp -r ${sources.libdispatch} swift-corelibs-libdispatch
    cp -r ${sources.swift} swift
+    cp -r ${sources.cmark} cmark
+    cp -r ${sources.llbuild} llbuild
+    cp -r ${sources.argumentParser} swift-argument-parser
+    cp -r ${sources.driver} swift-driver
+    cp -r ${sources.toolsSupportCore} swift-tools-support-core
+    cp -r ${sources.swiftpm} swiftpm
+    cp -r ${sources.syntax} swift-syntax
+    # TODO: possibly re-add stress-tester.
+    cp -r ${sources.corelibsXctest} swift-corelibs-xctest
+    cp -r ${sources.corelibsFoundation} swift-corelibs-foundation
+    cp -r ${sources.corelibsLibdispatch} swift-corelibs-libdispatch
+    # TODO: possibly re-add integration-tests.
+    cp -r ${sources.yams} yams
+    cp -r ${sources.indexstoreDb} indexstore-db
+    cp -r ${sources.sourcekitLsp} sourcekit-lsp
+    cp -r ${sources.format} swift-format
+    cp -r ${sources.llvmProject} llvm-project

    chmod -R u+w .
  '';

  patchPhase = ''
-    # Glibc 2.31 fix
-    patch -p1 -i ${./patches/swift-llvm.patch}
-
-    # Just patch all the things for now, we can focus this later
+    # Just patch all the things for now, we can focus this later.
    patchShebangs $SWIFT_SOURCE_ROOT

-    # TODO eliminate use of env.
+    # TODO: eliminate use of env.
    find -type f -print0 | xargs -0 sed -i \
      -e 's|/usr/bin/env|${coreutils}/bin/env|g' \
      -e 's|/usr/bin/make|${gnumake}/bin/make|g' \
@ -197,16 +233,13 @@ stdenv.mkDerivation {
      -e 's|/bin/cp|${coreutils}/bin/cp|g' \
      -e 's|/usr/bin/file|${file}/bin/file|g'

-    substituteInPlace swift/stdlib/public/Platform/CMakeLists.txt \
-      --replace '/usr/include' "${stdenv.cc.libc.dev}/include"
-    substituteInPlace swift/utils/build-script-impl \
-      --replace '/usr/include/c++' "${gccForLibs}/include/c++"
-    patch -p1 -d swift -i ${./patches/glibc-arch-headers.patch}
+    # Build configuration patches.
    patch -p1 -d swift -i ${./patches/0001-build-presets-linux-don-t-require-using-Ninja.patch}
    patch -p1 -d swift -i ${./patches/0002-build-presets-linux-allow-custom-install-prefix.patch}
    patch -p1 -d swift -i ${./patches/0003-build-presets-linux-don-t-build-extra-libs.patch}
    patch -p1 -d swift -i ${./patches/0004-build-presets-linux-plumb-extra-cmake-options.patch}
-
+    substituteInPlace swift/cmake/modules/SwiftConfigureSDK.cmake \
+      --replace '/usr/include' "${stdenv.cc.libc.dev}/include"
    sed -i swift/utils/build-presets.ini \
      -e 's/^test-installable-package$/# \0/' \
      -e 's/^test$/# \0/' \
@ -214,41 +247,37 @@ stdenv.mkDerivation {
      -e 's/^long-test$/# \0/' \
      -e 's/^stress-test$/# \0/' \
      -e 's/^test-optimized$/# \0/' \
-      \
      -e 's/^swift-install-components=autolink.*$/\0;editor-integration/'

-    substituteInPlace clang/lib/Driver/ToolChains/Linux.cpp \
-      --replace 'SysRoot + "/lib' '"${glibc}/lib" "'
-    substituteInPlace clang/lib/Driver/ToolChains/Linux.cpp \
-      --replace 'SysRoot + "/usr/lib' '"${glibc}/lib" "'
-    patch -p1 -d clang -i ${./patches/llvm-toolchain-dir.patch}
-    patch -p1 -d clang -i ${./purity.patch}
+    # LLVM toolchain patches.
+    patch -p1 -d llvm-project/clang -i ${./patches/0005-clang-toolchain-dir.patch}
+    patch -p1 -d llvm-project/clang -i ${./patches/0006-clang-purity.patch}
+    substituteInPlace llvm-project/clang/lib/Driver/ToolChains/Linux.cpp \
+      --replace 'SysRoot + "/lib' '"${glibc}/lib" "' \
+      --replace 'SysRoot + "/usr/lib' '"${glibc}/lib" "' \
+      --replace 'LibDir = "lib";' 'LibDir = "${glibc}/lib";' \
+      --replace 'LibDir = "lib64";' 'LibDir = "${glibc}/lib";' \
+      --replace 'LibDir = X32 ? "libx32" : "lib64";' 'LibDir = "${glibc}/lib";'

-    # Workaround hardcoded dep on "libcurses" (vs "libncurses"):
+    # Substitute ncurses for curses in llbuild.
    sed -i 's/curses/ncurses/' llbuild/*/*/CMakeLists.txt
-    # uuid.h is not part of glibc, but of libuuid
+    sed -i 's/curses/ncurses/' llbuild/*/*/*/CMakeLists.txt
+
+    # uuid.h is not part of glibc, but of libuuid.
    sed -i 's|''${GLIBC_INCLUDE_PATH}/uuid/uuid.h|${libuuid.dev}/include/uuid/uuid.h|' swift/stdlib/public/Platform/glibc.modulemap.gyb

-    # Compatibility with glibc 2.30
-    # Adapted from https://github.com/apple/swift-package-manager/pull/2408
-    patch -p1 -d swiftpm -i ${./patches/swift-package-manager-glibc-2.30.patch}
-    # https://github.com/apple/swift/pull/27288
-    patch -p1 -d swift -i ${fetchpatch {
-      url = "https://github.com/apple/swift/commit/f968f4282d53f487b29cf456415df46f9adf8748.patch";
-      sha256 = "1aa7l66wlgip63i4r0zvi9072392bnj03s4cn12p706hbpq0k37c";
-    }}
-
+    # Support library build script patches.
    PREFIX=''${out/#\/}
-    substituteInPlace indexstore-db/Utilities/build-script-helper.py \
-      --replace usr "$PREFIX"
-    substituteInPlace sourcekit-lsp/Utilities/build-script-helper.py \
-      --replace usr "$PREFIX"
+    substituteInPlace swift/utils/swift_build_support/swift_build_support/products/benchmarks.py \
+      --replace \
+      "'--toolchain', toolchain_path," \
+      "'--toolchain', '/build/install/$PREFIX',"
+    substituteInPlace swift/benchmark/scripts/build_script_helper.py \
+      --replace \
+      "swiftbuild_path = os.path.join(args.toolchain, \"usr\", \"bin\", \"swift-build\")" \
+      "swiftbuild_path = os.path.join(args.toolchain, \"bin\", \"swift-build\")"
    substituteInPlace swift-corelibs-xctest/build_script.py \
      --replace usr "$PREFIX"
-    substituteInPlace swift-corelibs-foundation/CoreFoundation/PlugIn.subproj/CFBundle_InfoPlist.c \
-      --replace "if !TARGET_OS_ANDROID" "if TARGET_OS_MAC || TARGET_OS_BSD"
-    substituteInPlace swift-corelibs-foundation/CoreFoundation/PlugIn.subproj/CFBundle_Resources.c \
-      --replace "if !TARGET_OS_ANDROID" "if TARGET_OS_MAC || TARGET_OS_BSD"
  '';

  configurePhase = ''
@ -265,17 +294,15 @@ stdenv.mkDerivation {
  '';

  buildPhase = ''
-    # explicitly include C++ headers to prevent errors where stdlib.h is not found from cstdlib
-    export NIX_CFLAGS_COMPILE="$(< ${clang}/nix-support/libcxx-cxxflags) $NIX_CFLAGS_COMPILE"
-    # During the Swift build, a full local LLVM build is performed and the resulting clang is invoked.
-    # This compiler is not using the Nix wrappers, so it needs some help to find things.
-    export NIX_LDFLAGS_BEFORE="-rpath ${gccForLibs.lib}/lib -L${gccForLibs.lib}/lib $NIX_LDFLAGS_BEFORE"
-    # However, we want to use the wrapped compiler whenever possible.
-    export CC="${clang}/bin/clang"
+    # Explicitly include C++ headers to prevent errors where stdlib.h is not found from cstdlib.
+    export NIX_CFLAGS_COMPILE="$(< ${clang_10}/nix-support/libcxx-cxxflags) $NIX_CFLAGS_COMPILE"

-    # fix for https://bugs.llvm.org/show_bug.cgi?id=39743
-    # see also https://forums.swift.org/t/18138/15
-    export CCC_OVERRIDE_OPTIONS="#x-fmodules s/-fmodules-cache-path.*//"
+    # During the Swift build, a full local LLVM build is performed and the resulting clang is
+    # invoked. This compiler is not using the Nix wrappers, so it needs some help to find things.
+    export NIX_LDFLAGS_BEFORE="-rpath ${gccForLibs.lib}/lib -L${gccForLibs.lib}/lib $NIX_LDFLAGS_BEFORE"
+
+    # However, we want to use the wrapped compiler whenever possible.
+    export CC="${clang_10}/bin/clang"

    $SWIFT_SOURCE_ROOT/swift/utils/build-script \
      --preset=buildbot_linux \
@ -290,14 +317,31 @@ stdenv.mkDerivation {
  checkInputs = [ file ];

  checkPhase = ''
-    # FIXME: disable non-working tests
-    rm $SWIFT_SOURCE_ROOT/swift/test/Driver/static-stdlib-linux.swift  # static linkage of libatomic.a complains about missing PIC
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/Python/build_swift.swift  # install_prefix not passed properly
+    # Remove compiler build system tests which fail due to our modified default build profile and
+    # nixpkgs-provided version of CMake.
+    rm $SWIFT_SOURCE_ROOT/swift/validation-test/BuildSystem/infer_implies_install_all.test
+    rm $SWIFT_SOURCE_ROOT/swift/validation-test/BuildSystem/infer_dumps_deps_if_verbose_build.test

-    # match the swift wrapper in the install phase
-    export LIBRARY_PATH=${icu}/lib:${libuuid.out}/lib
+    # This test apparently requires Python 2 (strings are assumed to be bytes-like), but the build
+    # process overall now otherwise requires Python 3 (which is what we have updated to). A fix PR
+    # has been submitted upstream.
+    rm $SWIFT_SOURCE_ROOT/swift/validation-test/SIL/verify_all_overlays.py

-    checkTarget=check-swift-all
+    # TODO: consider fixing and re-adding. This test fails due to a non-standard "install_prefix".
+    rm $SWIFT_SOURCE_ROOT/swift/validation-test/Python/build_swift.swift
+
+    # We cannot handle the SDK location being in "Weird Location" due to Nix isolation.
+    rm $SWIFT_SOURCE_ROOT/swift/test/DebugInfo/compiler-flags.swift
+
+    # TODO: Fix issue with ld.gold invoked from script finding crtbeginS.o and crtendS.o.
+    rm $SWIFT_SOURCE_ROOT/swift/test/IRGen/ELF-remove-autolink-section.swift
+
+    # TODO: consider using stress-tester and integration-test.
+
+    # Match the wrapped version of Swift to be installed.
+    export LIBRARY_PATH=${icu}/lib:${libgcc}/lib:${libuuid.out}/lib:$l
+
+    checkTarget=check-swift-all-${stdenv.hostPlatform.parsed.kernel.name}-${stdenv.hostPlatform.parsed.cpu.name}
    ninjaFlags='-C buildbot_linux/swift-${stdenv.hostPlatform.parsed.kernel.name}-${stdenv.hostPlatform.parsed.cpu.name}'
    ninjaCheckPhase
  '';
@ -305,19 +349,26 @@ stdenv.mkDerivation {
  installPhase = ''
    mkdir -p $out

-    # Extract the generated tarball into the store
+    # Extract the generated tarball into the store.
    tar xf $INSTALLABLE_PACKAGE -C $out --strip-components=3 ''${out/#\/}
    find $out -type d -empty -delete

-    # fix installation weirdness, also present in Apple’s official tarballs
+    # Fix installation weirdness, also present in Apple’s official tarballs.
    mv $out/local/include/indexstore $out/include
    rmdir $out/local/include $out/local
    rm -r $out/bin/sdk-module-lists $out/bin/swift-api-checker.py

    wrapProgram $out/bin/swift \
+      --set CC $out/bin/clang \
      --suffix C_INCLUDE_PATH : $out/lib/swift/clang/include \
      --suffix CPLUS_INCLUDE_PATH : $out/lib/swift/clang/include \
-      --suffix LIBRARY_PATH : ${icu}/lib:${libuuid.out}/lib
+      --suffix LIBRARY_PATH : ${icu}/lib:${libgcc}/lib:${libuuid.out}/lib
+
+    wrapProgram $out/bin/swiftc \
+      --set CC $out/bin/clang \
+      --suffix C_INCLUDE_PATH : $out/lib/swift/clang/include \
+      --suffix CPLUS_INCLUDE_PATH : $out/lib/swift/clang/include \
+      --suffix LIBRARY_PATH : ${icu}/lib:${libgcc}/lib:${libuuid.out}/lib
  '';

  # Hack to avoid build and install directories in RPATHs.
@ -326,14 +377,11 @@ stdenv.mkDerivation {
  meta = with lib; {
    description = "The Swift Programming Language";
    homepage = "https://github.com/apple/swift";
-    maintainers = with maintainers; [ dtzWill ];
+    maintainers = with maintainers; [ dtzWill trepetti ];
    license = licenses.asl20;
-    # Swift doesn't support 32bit Linux, unknown on other platforms.
+    # Swift doesn't support 32-bit Linux, unknown on other platforms.
    platforms = platforms.linux;
    badPlatforms = platforms.i686;
-    broken = true; # 2021-01-29
-    knownVulnerabilities = [
-      "CVE-2020-9861"
-    ];
+    timeout = 86400; # 24 hours.
  };
 }
--- a/pkgs/development/compilers/swift/patches/0001-build-presets-linux-don-t-require-using-Ninja.patch
+++ b/pkgs/development/compilers/swift/patches/0001-build-presets-linux-don-t-require-using-Ninja.patch
@ -2,12 +2,12 @@ Don't build Ninja, we use our own.

 --- a/utils/build-presets.ini
 +++ b/utils/build-presets.ini
-@@ -745,7 +745,7 @@ swiftpm
- 
+@@ -779,7 +779,7 @@ swiftpm
+
 dash-dash
- 
+
 -build-ninja
 +# build-ninja
+ install-llvm
 install-swift
 install-lldb
- install-llbuild
--- a/pkgs/development/compilers/swift/patches/0002-build-presets-linux-allow-custom-install-prefix.patch
+++ b/pkgs/development/compilers/swift/patches/0002-build-presets-linux-allow-custom-install-prefix.patch
@ -1,8 +1,8 @@
-allow custom install prefix
+Use custom install prefix.

--- a/utils/build-presets.ini	2019-04-11 14:51:40.060259462 +0200
-+++ b/utils/build-presets.ini	2019-04-11 15:16:17.471137969 +0200
-@@ -752,7 +752,7 @@
+--- a/utils/build-presets.ini
+++ b/utils/build-presets.ini
+@@ -788,7 +788,7 @@
 install-swiftpm
 install-xctest
 install-libicu
--- a/pkgs/development/compilers/swift/patches/0003-build-presets-linux-don-t-build-extra-libs.patch
+++ b/pkgs/development/compilers/swift/patches/0003-build-presets-linux-don-t-build-extra-libs.patch
@ -1,17 +1,17 @@
 Disable targets, where we use Nix packages.

--- a/utils/build-presets.ini	2019-04-11 15:19:57.845178834 +0200
-+++ b/utils/build-presets.ini	2019-04-11 15:27:42.041297057 +0200
-@@ -740,8 +740,6 @@
+--- a/utils/build-presets.ini
+++ b/utils/build-presets.ini
+@@ -776,8 +776,6 @@
 llbuild
 swiftpm
 xctest
 -libicu
 -libcxx
- 
+
 dash-dash
- 
-@@ -751,9 +749,7 @@
+
+@@ -785,9 +785,7 @@
 install-llbuild
 install-swiftpm
 install-xctest
--- a/pkgs/development/compilers/swift/patches/0004-build-presets-linux-plumb-extra-cmake-options.patch
+++ b/pkgs/development/compilers/swift/patches/0004-build-presets-linux-plumb-extra-cmake-options.patch
@ -1,11 +1,11 @@
-plumb extra-cmake-options
+Plumb extra-cmake-options.

 --- a/utils/build-presets.ini
 +++ b/utils/build-presets.ini
-@@ -766,6 +766,8 @@ install-destdir=%(install_destdir)s
+@@ -812,6 +812,8 @@
 # Path to the .tar.gz package we would create.
 installable-package=%(installable_package)s
- 
+
 +extra-cmake-options=%(extra_cmake_options)s
 +
 [preset: buildbot_linux]
--- a/pkgs/development/compilers/swift/patches/0005-clang-toolchain-dir.patch
+++ b/pkgs/development/compilers/swift/patches/0005-clang-toolchain-dir.patch
@ -0,0 +1,13 @@
+Use the Nix include dirs and gcc runtime dir, when no sysroot is configured.
+
+--- a/lib/Driver/ToolChains/Linux.cpp
+++ b/lib/Driver/ToolChains/Linux.cpp
+@@ -574,7 +574,7 @@
+
+   // Check for configure-time C include directories.
+   StringRef CIncludeDirs(C_INCLUDE_DIRS);
+-  if (CIncludeDirs != "") {
+  if (CIncludeDirs != "" && (SysRoot.empty() || SysRoot == "/")) {
+     SmallVector<StringRef, 5> dirs;
+     CIncludeDirs.split(dirs, ":");
+     for (StringRef dir : dirs) {
--- a/pkgs/development/compilers/swift/patches/0006-clang-purity.patch
+++ b/pkgs/development/compilers/swift/patches/0006-clang-purity.patch
@ -0,0 +1,16 @@
+Apply the "purity" patch (updated for 5.4.2).
+
+--- a/lib/Driver/ToolChains/Gnu.cpp
+++ b/lib/Driver/ToolChains/Gnu.cpp
+@@ -488,11 +488,5 @@
+     if (Args.hasArg(options::OPT_rdynamic))
+       CmdArgs.push_back("-export-dynamic");
+-
+-    if (!Args.hasArg(options::OPT_shared) && !IsStaticPIE) {
+-      CmdArgs.push_back("-dynamic-linker");
+-      CmdArgs.push_back(Args.MakeArgString(Twine(D.DyldPrefix) +
+-                                           ToolChain.getDynamicLinker(Args)));
+-    }
+   }
+
+   CmdArgs.push_back("-o");
--- a/pkgs/development/compilers/swift/patches/glibc-arch-headers.patch
+++ b/pkgs/development/compilers/swift/patches/glibc-arch-headers.patch
@ -1,13 +0,0 @@
-The Nix glibc headers do not use include/x86_64-linux-gnu subdirectories.
-
--- swift/stdlib/public/Platform/CMakeLists.txt	2019-04-09 20:14:44.493801403 +0200
-+++ swift/stdlib/public/Platform/CMakeLists.txt	2019-04-09 20:14:44.577800593 +0200
-@@ -77,7 +77,7 @@
-     endif()
- 
-     set(GLIBC_INCLUDE_PATH "${GLIBC_SYSROOT_RELATIVE_INCLUDE_PATH}")
-    set(GLIBC_ARCH_INCLUDE_PATH "${GLIBC_SYSROOT_RELATIVE_ARCH_INCLUDE_PATH}")
-+    set(GLIBC_ARCH_INCLUDE_PATH "${GLIBC_SYSROOT_RELATIVE_INCLUDE_PATH}")
- 
-     if(NOT "${SWIFT_SDK_${sdk}_ARCH_${arch}_PATH}" STREQUAL "/" AND NOT "${sdk}" STREQUAL "ANDROID")
-       set(GLIBC_INCLUDE_PATH "${SWIFT_SDK_${sdk}_ARCH_${arch}_PATH}${GLIBC_INCLUDE_PATH}")
--- a/pkgs/development/compilers/swift/patches/llvm-toolchain-dir.patch
+++ b/pkgs/development/compilers/swift/patches/llvm-toolchain-dir.patch
@ -1,24 +0,0 @@
-Use the Nix include dirs and gcc runtime dir, when no sysroot is configured.
-
--- clang/lib/Driver/ToolChains/Linux.cpp	2018-10-05 18:01:15.731109551 +0200
-+++ clang/lib/Driver/ToolChains/Linux.cpp	2018-10-05 18:00:27.959509924 +0200
-@@ -665,7 +665,7 @@
- 
-   // Check for configure-time C include directories.
-   StringRef CIncludeDirs(C_INCLUDE_DIRS);
-  if (CIncludeDirs != "") {
-+  if (CIncludeDirs != "" && (SysRoot.empty() || SysRoot == "/")) {
-     SmallVector<StringRef, 5> dirs;
-     CIncludeDirs.split(dirs, ":");
-     for (StringRef dir : dirs) {
--- clang/lib/Driver/ToolChains/Gnu.cpp	2019-10-26 09:49:27.003752743 +0200
-+++ clang/lib/Driver/ToolChains/Gnu.cpp	2019-10-26 09:50:49.067236497 +0200
-@@ -1743,7 +1743,7 @@
-   // If we have a SysRoot, ignore GCC_INSTALL_PREFIX.
-   // GCC_INSTALL_PREFIX specifies the gcc installation for the default
-   // sysroot and is likely not valid with a different sysroot.
-  if (!SysRoot.empty())
-+  if (!(SysRoot.empty() || SysRoot == "/"))
-     return "";
- 
-   return GCC_INSTALL_PREFIX;
--- a/pkgs/development/compilers/swift/patches/swift-llvm.patch
+++ b/pkgs/development/compilers/swift/patches/swift-llvm.patch
@ -1,48 +0,0 @@
-diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cc b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
-index bc6675bf4..2f3514b64 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
-+++ b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
-@@ -1129,8 +1129,9 @@ CHECK_SIZE_AND_OFFSET(ipc_perm, uid);
- CHECK_SIZE_AND_OFFSET(ipc_perm, gid);
- CHECK_SIZE_AND_OFFSET(ipc_perm, cuid);
- CHECK_SIZE_AND_OFFSET(ipc_perm, cgid);
-#if !defined(__aarch64__) || !SANITIZER_LINUX || __GLIBC_PREREQ (2, 21)
-/* On aarch64 glibc 2.20 and earlier provided incorrect mode field.  */
-+#if !SANITIZER_LINUX || __GLIBC_PREREQ (2, 31)
-+/* glibc 2.30 and earlier provided 16-bit mode field instead of 32-bit
-+   on many architectures.  */
- CHECK_SIZE_AND_OFFSET(ipc_perm, mode);
- #endif
- 
-diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
-index de69852d3..652d5cb3b 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
-+++ b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
-@@ -204,26 +204,13 @@ namespace __sanitizer {
-     u64 __unused1;
-     u64 __unused2;
- #elif defined(__sparc__)
-#if defined(__arch64__)
-     unsigned mode;
-    unsigned short __pad1;
-#else
-    unsigned short __pad1;
-    unsigned short mode;
-     unsigned short __pad2;
-#endif
-     unsigned short __seq;
-     unsigned long long __unused1;
-     unsigned long long __unused2;
-#elif defined(__mips__) || defined(__aarch64__) || defined(__s390x__)
-    unsigned int mode;
-    unsigned short __seq;
-    unsigned short __pad1;
-    unsigned long __unused1;
-    unsigned long __unused2;
- #else
-    unsigned short mode;
-    unsigned short __pad1;
-+    unsigned int mode;
-     unsigned short __seq;
-     unsigned short __pad2;
- #if defined(__x86_64__) && !defined(_LP64)
--- a/pkgs/development/compilers/swift/patches/swift-package-manager-glibc-2.30.patch
+++ b/pkgs/development/compilers/swift/patches/swift-package-manager-glibc-2.30.patch
@ -1,25 +0,0 @@
-diff --git a/Sources/Basic/Process.swift b/Sources/Basic/Process.swift
-index f388c769..8f208691 100644
--- a/Sources/Basic/Process.swift
-+++ b/Sources/Basic/Process.swift
-@@ -322,7 +322,10 @@ public final class Process: ObjectIdentifierProtocol {
-         defer { posix_spawn_file_actions_destroy(&fileActions) }
- 
-         // Workaround for https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=89e435f3559c53084498e9baad22172b64429362
-        let devNull = strdup("/dev/null")
-+        // Change allowing for newer version of glibc
-+        guard let devNull = strdup("/dev/null") else {
-+            throw SystemError.posix_spawn(0, arguments)
-+        }
-         defer { free(devNull) }
-         // Open /dev/null as stdin.
-         posix_spawn_file_actions_addopen(&fileActions, 0, devNull, O_RDONLY, 0)
-@@ -348,7 +351,7 @@ public final class Process: ObjectIdentifierProtocol {
- 
-         let argv = CStringArray(arguments)
-         let env = CStringArray(environment.map({ "\($0.0)=\($0.1)" }))
-        let rv = posix_spawnp(&processID, argv.cArray[0], &fileActions, &attributes, argv.cArray, env.cArray)
-+        let rv = posix_spawnp(&processID, argv.cArray[0]!, &fileActions, &attributes, argv.cArray, env.cArray)
- 
-         guard rv == 0 else {
-             throw SystemError.posix_spawn(rv, arguments)
--- a/pkgs/development/compilers/swift/purity.patch
+++ b/pkgs/development/compilers/swift/purity.patch
@ -1,18 +0,0 @@
-"purity" patch for 5.0
-
--- a/lib/Driver/ToolChains/Gnu.cpp
-+++ b/lib/Driver/ToolChains/Gnu.cpp
-@@ -402,13 +402,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
-   if (!Args.hasArg(options::OPT_static)) {
-     if (Args.hasArg(options::OPT_rdynamic))
-       CmdArgs.push_back("-export-dynamic");
-
-    if (!Args.hasArg(options::OPT_shared)) {
-      const std::string Loader =
-          D.DyldPrefix + ToolChain.getDynamicLinker(Args);
-      CmdArgs.push_back("-dynamic-linker");
-      CmdArgs.push_back(Args.MakeArgString(Loader));
-    }
-   }
- 
-   CmdArgs.push_back("-o");
--- a/pkgs/development/java-modules/m2install.nix
+++ b/pkgs/development/java-modules/m2install.nix
@ -12,10 +12,10 @@ let
 in stdenv.mkDerivation {
  inherit name m2Path m2File src;

+  dontUnpack = true;
+
  installPhase = ''
    mkdir -p $out/m2/$m2Path
    cp $src $out/m2/$m2Path/$m2File
  '';
-
-  phases = "installPhase";
 }
--- a/pkgs/development/libraries/appstream-glib/default.nix
+++ b/pkgs/development/libraries/appstream-glib/default.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "hughsie";
    repo = "appstream-glib";
-    rev = "${lib.replaceStrings ["-"] ["_"] pname}-${lib.replaceStrings ["."] ["_"] version}";
+    rev = "${lib.replaceStrings ["-"] ["_"] pname}_${lib.replaceStrings ["."] ["_"] version}";
    sha256 = "12s7d3nqjs1fldnppbg2mkjg4280f3h8yzj3q1hiz3chh1w0vjbx";
  };

--- a/pkgs/development/libraries/boost/1.71.nix
+++ b/pkgs/development/libraries/boost/1.71.nix
@ -1,15 +0,0 @@
-{ callPackage, fetchurl, fetchpatch, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "1.71.0";
-
-  src = fetchurl {
-    #url = "mirror://sourceforge/boost/boost_1_71_0.tar.bz2";
-    urls = [
-      "mirror://sourceforge/boost/boost_1_71_0.tar.bz2"
-      "https://dl.bintray.com/boostorg/release/1.71.0/source/boost_1_71_0.tar.bz2"
-    ];
-    # SHA256 from http://www.boost.org/users/history/version_1_71_0.html
-    sha256 = "d73a8da01e8bf8c7eda40b4c84915071a8c8a0df4a6734537ddde4a8580524ee";
-  };
-})
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-media-driver";
-  version = "21.3.1";
+  version = "21.3.2";

  src = fetchFromGitHub {
    owner  = "intel";
    repo   = "media-driver";
    rev    = "intel-media-${version}";
-    sha256 = "0f6lgnca68aj9gdbxla2mwgap33ksdgiss0m7dk35r0slgf0hdxr";
+    sha256 = "0d2w1wmq6w2hjyja7zn9f3glykk14mvphj00dbqkbsla311gkqw4";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/science/networking/ns-3/default.nix
+++ b/pkgs/development/libraries/science/networking/ns-3/default.nix
@ -1,6 +1,5 @@
 { stdenv
 , fetchFromGitLab
-, fetchpatch
 , python
 , wafHook

@ -39,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "ns-3";
-  version = "33";
+  version = "34";

  src = fetchFromGitLab {
    owner = "nsnam";
    repo   = "ns-3-dev";
    rev    = "ns-3.${version}";
-    sha256 = "0ds8h0f2qcb0gc2a8bk38cbhdb122i4sbg589bjn59rblzw0hkq4";
+    sha256 = "sha256-udP7U+pHnNUdo35d9sN1o+aR9ctw9fgU3UunCjisGUI=";
  };

  nativeBuildInputs = [ wafHook python ];
@ -98,14 +97,6 @@ stdenv.mkDerivation rec {
    ${pythonEnv.interpreter} ./test.py --nowaf
  '';

-  patches = [
-    (fetchpatch {
-      name = "upstream-issue-336.patch";
-      url = "https://gitlab.com/nsnam/ns-3-dev/-/commit/673004edae1112e6cb249b698aad856d728530fb.patch";
-      sha256 = "0q96ividinbh9xlws014b2ir6gaavygnln5ca9m1db06m4vfwhng";
-    })
-  ];
-
  # strictoverflow prevents clang from discovering pyembed when bindings
  hardeningDisable = [ "fortify" "strictoverflow"];

--- a/pkgs/development/libraries/sope/default.nix
+++ b/pkgs/development/libraries/sope/default.nix
@ -1,21 +1,21 @@
-{ gnustep, lib, fetchFromGitHub , libxml2, openssl_1_1
+{ gnustep, lib, fetchFromGitHub , libxml2, openssl
 , openldap, mariadb, libmysqlclient, postgresql }:
 with lib;

 gnustep.stdenv.mkDerivation rec {
  pname = "sope";
-  version = "5.1.1";
+  version = "5.2.0";

  src = fetchFromGitHub {
    owner = "inverse-inc";
    repo = pname;
    rev = "SOPE-${version}";
-    sha256 = "0pap7c38kgadyp1a6qkmf9xhk69ybpmhfd4kc2n5nafhdbvks985";
+    sha256 = "14s9rcnglkwl0nmbmpdxxbiqqnr3m8n7x69idm1crgbbjkj4gi68";
  };

  hardeningDisable = [ "format" ];
  nativeBuildInputs = [ gnustep.make ];
-  buildInputs = flatten ([ gnustep.base libxml2 openssl_1_1 ]
+  buildInputs = flatten ([ gnustep.base libxml2 openssl ]
    ++ optional (openldap != null) openldap
    ++ optionals (mariadb != null) [ libmysqlclient mariadb ]
    ++ optional (postgresql != null) postgresql);
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -68,6 +68,7 @@
 , "coc-wxml"
 , "coc-yaml"
 , "coc-yank"
+, "code-theme-converter"
 , "coffee-script"
 , "coinmon"
 , "configurable-http-proxy"
@ -229,12 +230,13 @@
 , "snyk"
 , "socket.io"
 , "speed-test"
+, "sql-formatter"
 , "ssb-server"
 , "stackdriver-statsd-backend"
 , "stf"
 , "stylelint"
-, "svelte-language-server"
 , "svelte-check"
+, "svelte-language-server"
 , "svgo"
 , "swagger"
 , {"tedicross": "git+https://github.com/TediCross/TediCross.git#v0.8.7"}
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/python-modules/aioitertools/default.nix
+++ b/pkgs/development/python-modules/aioitertools/default.nix
@ -11,12 +11,12 @@

 buildPythonPackage rec {
  pname = "aioitertools";
-  version = "0.7.1";
+  version = "0.8.0";
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "18ql6k2j1839jf2rmmmm29v6fb7mr59l75z8nlf0sadmydy6r9al";
+    sha256 = "8b02facfbc9b0f1867739949a223f3d3267ed8663691cc95abd94e2c1d8c2b46";
  };

  propagatedBuildInputs = [ typing-extensions ];
--- a/pkgs/development/python-modules/aiotractive/default.nix
+++ b/pkgs/development/python-modules/aiotractive/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "aiotractive";
-  version = "0.5.2";
+  version = "0.5.3";
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "zhulik";
    repo = pname;
-    rev = "v.${version}";
-    sha256 = "04qdjyxq35063jpn218vw94a4r19fknk1q2kkxr8gnaabkpkjrnf";
+    rev = "v${version}";
+    sha256 = "1rkylzbxxy3p744q1iqcvpnkn12ra6ja16vhqzidn702n4h5377j";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/alectryon/default.nix
+++ b/pkgs/development/python-modules/alectryon/default.nix
@ -1,4 +1,5 @@
-{ lib, buildPythonPackage, fetchPypi, pygments, dominate, beautifulsoup4, docutils, sphinx }:
+{ lib, buildPythonPackage, fetchPypi, fetchpatch
+, pygments, dominate, beautifulsoup4, docutils, sphinx }:

 buildPythonPackage rec {
  pname = "alectryon";
@ -10,6 +11,13 @@ buildPythonPackage rec {
    sha256 = "sha256:0mca25jv917myb4n91ccpl5fz058aiqsn8cniflwfw5pp6lqnfg7";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/cpitclaudel/alectryon/commit/c779def3fa268e703d4e0ff8ae0b2981e194b269.patch";
+      sha256 = "0xsz56ibq8xj7gg530pfm1jmxbxw4r6v8xvzj5k1wdry83srqi65";
+     })
+   ];
+
  propagatedBuildInputs = [
    pygments
    dominate
--- a/pkgs/development/python-modules/ansible/base.nix
+++ b/pkgs/development/python-modules/ansible/base.nix
@ -28,11 +28,11 @@ let
 in
 buildPythonPackage rec {
  pname = "ansible-base";
-  version = "2.10.12";
+  version = "2.10.13";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-qWVW4tI5+Sg+FWVNQMGqhmgqTntD9Qtf8CK8jkK2mHg=";
+    sha256 = "sha256-0sKbGUblrgh4SgdiuMSMMvg15GSNb5l6bCqBt4/0860=";
  };

  # ansible_connection is already wrapped, so don't pass it through
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@ -23,17 +23,17 @@

 let
  ansible-collections = callPackage ./collections.nix {
-    version = "4.2.0";
-    sha256 = "1l30j97q24klylchvbskdmp1xllswn9xskjvg4l0ra6pzfgq2zbk";
+    version = "4.4.0";
+    sha256 = "031n22j0lsmh69x6i6gkva81j68b4yzh1pbg3q2h4bknl85q46ag";
  };
 in
 buildPythonPackage rec {
  pname = "ansible-core";
-  version = "2.11.3";
+  version = "2.11.4";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-DO0bT2cZftsntQk0yV1MtkTG1jXXLH+CbEQl3+RTdnQ=";
+    sha256 = "sha256-Iuqnwt/myHXprjgDI/HLpiWcYFCl5MiBn4X5KzaD6kk=";
  };

  # ansible_connection is already wrapped, so don't pass it through
--- a/pkgs/development/python-modules/ansible/legacy.nix
+++ b/pkgs/development/python-modules/ansible/legacy.nix
@ -18,11 +18,11 @@

 buildPythonPackage rec {
  pname = "ansible";
-  version = "2.9.24";
+  version = "2.9.25";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-DC9Tt75z3cNCPZZY/NGQeYl9Wx/FM8StVQ21ixea64o=";
+    sha256 = "sha256-i88sL1xgnluREUyosOQibWA7h/K+cdyzOOi30626oo8=";
  };

  prePatch = ''
--- a/pkgs/development/python-modules/aws-lambda-builders/default.nix
+++ b/pkgs/development/python-modules/aws-lambda-builders/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "aws-lambda-builders";
-  version = "1.4.0";
+  version = "1.6.0";

  # No tests available in PyPI tarball
  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-lambda-builders";
    rev = "v${version}";
-    sha256 = "0g7qj74mgazc7y1w0d9vs276vmfb3svi5whn2c87bryhrwq650vf";
+    sha256 = "sha256-H25Y1gusV+sSX0f6ii49bE36CgM1E3oWsX8AiVH85Y4=";
  };

  # Package is not compatible with Python 3.5
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@ -10,11 +10,11 @@

 buildPythonPackage rec {
  pname = "aws-sam-translator";
-  version = "1.37.0";
+  version = "1.38.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0p2qd8gwxsfq17nmrlkpf31aqbfzjrwjk3n4p8vhci8mm11dk138";
+    sha256 = "sha256-Dsrdqc9asjGPV/ElMYGiFR5MU8010hcXqSPAdaWmXLY=";
  };

  # Tests are not included in the PyPI package
--- a/pkgs/development/python-modules/cattrs/default.nix
+++ b/pkgs/development/python-modules/cattrs/default.nix
@ -1,14 +1,14 @@
 { lib
 , attrs
-, bson
-, pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
 , hypothesis
 , immutables
+, motor
 , msgpack
 , poetry-core
 , pytestCheckHook
+, pythonOlder
 , pyyaml
 , tomlkit
 , ujson
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "cattrs";
-  version = "1.7.0";
+  version = "1.8.0";
  format = "pyproject";

  # https://cattrs.readthedocs.io/en/latest/history.html#id33:
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "Tinche";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-7F4S4IeApbULXhkEZ0oab3Y7sk20Ag2fCYxsyi4WbWw=";
+    sha256 = "sha256-CKAsvRKS8kmLcyPA753mh6d3S04ObzO7xLPpmlmxrxI=";
  };

  nativeBuildInputs = [
@ -39,9 +39,9 @@ buildPythonPackage rec {
  ];

  checkInputs = [
-    bson
    hypothesis
    immutables
+    motor
    msgpack
    pytestCheckHook
    pyyaml
@ -59,6 +59,10 @@ buildPythonPackage rec {
      --replace "from orjson import loads as orjson_loads" ""
  '';

+  preCheck = ''
+    export HOME=$(mktemp -d);
+  '';
+
  disabledTestPaths = [
    # Don't run benchmarking tests
    "bench/test_attrs_collections.py"
--- a/Show more
+++ b/Show more
				`@ -0,0 +1 @@`
				`{:deps {clojupyter/clojupyter {:mvn/version "0.3.2"}}}`