Merge staging-next into staging

nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -1538,6 +1538,13 @@
           configuration.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          A new module was added for the Envoy reverse proxy, providing
+          the options <literal>services.envoy.enable</literal> and
+          <literal>services.envoy.settings</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The option <literal>services.duplicati.dataDir</literal> has

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -547,6 +547,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
 
+- A new module was added for the Envoy reverse proxy, providing the options `services.envoy.enable` and `services.envoy.settings`.
+
 - The option `services.duplicati.dataDir` has been added to allow changing the location of duplicati's files.
 
 - The options `boot.extraModprobeConfig` and `boot.blacklistedKernelModules` now also take effect in the initrd by copying the file `/etc/modprobe.d/nixos.conf` into the initrd.

nixos/modules/module-list.nix

@@ -753,6 +753,7 @@
   ./services/networking/ncdns.nix
   ./services/networking/nomad.nix
   ./services/networking/ejabberd.nix
+  ./services/networking/envoy.nix
   ./services/networking/epmd.nix
   ./services/networking/ergo.nix
   ./services/networking/ergochat.nix

nixos/modules/services/networking/envoy.nix

@@ -0,0 +1,84 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.envoy;
+  format = pkgs.formats.json { };
+  conf = format.generate "envoy.json" cfg.settings;
+  validateConfig = file:
+    pkgs.runCommand "validate-envoy-conf" { } ''
+      ${pkgs.envoy}/bin/envoy --log-level error --mode validate -c "${file}"
+      cp "${file}" "$out"
+    '';
+
+in
+
+{
+  options.services.envoy = {
+    enable = mkEnableOption "Envoy reverse proxy";
+
+    settings = mkOption {
+      type = format.type;
+      default = { };
+      example = literalExpression ''
+        {
+          admin = {
+            access_log_path = "/dev/null";
+            address = {
+              socket_address = {
+                protocol = "TCP";
+                address = "127.0.0.1";
+                port_value = 9901;
+              };
+            };
+          };
+          static_resources = {
+            listeners = [];
+            clusters = [];
+          };
+        }
+      '';
+      description = ''
+        Specify the configuration for Envoy in Nix.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.envoy ];
+    systemd.services.envoy = {
+      description = "Envoy reverse proxy";
+      after = [ "network-online.target" ];
+      requires = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.envoy}/bin/envoy -c ${validateConfig conf}";
+        DynamicUser = true;
+        Restart = "no";
+        CacheDirectory = "envoy";
+        LogsDirectory = "envoy";
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK AF_XDP";
+        SystemCallArchitectures = "native";
+        LockPersonality = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        PrivateUsers = false;  # breaks CAP_NET_BIND_SERVICE
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "ptraceable";
+        ProtectHostname = true;
+        ProtectSystem = "strict";
+        UMask = "0066";
+        SystemCallFilter = "~@clock @module @mount @reboot @swap @obsolete @cpu-emulation";
+      };
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -142,6 +142,7 @@ in
   engelsystem = handleTest ./engelsystem.nix {};
   enlightenment = handleTest ./enlightenment.nix {};
   env = handleTest ./env.nix {};
+  envoy = handleTest ./envoy.nix {};
   ergo = handleTest ./ergo.nix {};
   ergochat = handleTest ./ergochat.nix {};
   etc = pkgs.callPackage ../modules/system/etc/test.nix { inherit evalMinimalConfig; };

nixos/tests/envoy.nix

@@ -0,0 +1,33 @@
+import ./make-test-python.nix ({ pkgs, lib, ...} : {
+  name = "envoy";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ cameronnemo ];
+  };
+
+  nodes.machine = { pkgs, ... }: {
+    services.envoy.enable = true;
+    services.envoy.settings = {
+      admin = {
+        access_log_path = "/dev/null";
+        address = {
+          socket_address = {
+            protocol = "TCP";
+            address = "127.0.0.1";
+            port_value = 9901;
+          };
+        };
+      };
+      static_resources = {
+        listeners = [];
+        clusters = [];
+      };
+    };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("envoy.service")
+    machine.wait_for_open_port(9901)
+    machine.wait_until_succeeds("curl -fsS localhost:9901/ready")
+  '';
+})

nixos/tests/keycloak.nix

@@ -143,7 +143,7 @@ let
           # post url.
           keycloak.succeed(
               "curl -sSf -c cookie '${frontendUrl}/realms/${realm.realm}/protocol/openid-connect/auth?client_id=${client.name}&redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob&scope=openid+email&response_type=code&response_mode=query&nonce=qw4o89g3qqm' >login_form",
-              "tidy -q -m login_form || true",
+              "tidy -asxml -q -m login_form || true",
               "xml sel -T -t -m \"_:html/_:body/_:div/_:div/_:div/_:div/_:div/_:div/_:form[@id='kc-form-login']\" -v @action login_form >form_post_url",
           )
 
@@ -151,7 +151,7 @@ let
           # the HTML, then extract the authorization code.
           keycloak.succeed(
               "curl -sSf -L -b cookie -d 'username=${user.username}' -d 'password=${password}' -d 'credentialId=' \"$(<form_post_url)\" >auth_code_html",
-              "tidy -q -m auth_code_html || true",
+              "tidy -asxml -q -m auth_code_html || true",
               "xml sel -T -t -m \"_:html/_:body/_:div/_:div/_:div/_:div/_:div/_:input[@id='code']\" -v @value auth_code_html >auth_code",
           )
 

pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchurl {
     url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "sha256-kkpb8tLuj4QO+TBW2yNDugS4c6dCQ9Lddv6Z8NS0uio=";
+    sha256 = "sha256-cpEV0EWW9vd2ZE+RaqN9fhyy7axgPlx4PmlOeX3TSfY=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];

pkgs/applications/audio/dragonfly-reverb/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dragonfly-reverb";
-  version = "3.2.5";
+  version = "3.2.6";
 
   src = fetchFromGitHub {
     owner = "michaelwillis";
     repo = "dragonfly-reverb";
     rev = version;
-    sha256 = "14kia9wjs0nqfx4psnr3vf4x6hihkf80gb0mjzmdnnnk4cnrdydm";
+    sha256 = "sha256-hTapy/wXt1rRZVdkx2RDW8LS/DcY30p+WaAWgemGqVo=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -45,9 +45,9 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "100.0.4896.60",
+    "version": "100.0.4896.75",
-    "sha256": "1p7zggnhsz9gj3zil0nyas4ym5bd94vs0z6mdg7r1l0s0vrsaphf",
+    "sha256": "1h60l1g340gvm4lz2lps6dqpvahpzn24hz47y2qvc6mavx9d6ki4",
-    "sha256bin64": "07wavs9r6ilwx5rzyqvydcjskg6sml5b8m6mw7qzykvhs8bnvfh5",
+    "sha256bin64": "0nrrkgwcnqg4l8x1nk1rdxnv9xa0c24ync1yls7s9rc34wkk8sc5",
     "deps": {
       "gn": {
         "version": "2022-01-21",
@@ -56,8 +56,8 @@
         "sha256": "1dzdvcn2r5c9giknvasf3y5y4901kav7igivjvrpww66ywsj8fzr"
       },
       "ungoogled-patches": {
-        "rev": "100.0.4896.60-1",
+        "rev": "100.0.4896.75-1",
-        "sha256": "02q7ghxynkgkbilcb8bx8q26s80fvd4hbc58zq74pnzpmn7qi342"
+        "sha256": "0s31dclgk3x9302wr5yij77361bqam2sfki39p651gwysfizb73n"
       }
     }
   }

pkgs/applications/networking/cluster/istioctl/default.nix

@@ -37,7 +37,7 @@ buildGoModule rec {
     description = "Istio configuration command line utility for service operators to debug and diagnose their Istio mesh";
     homepage = "https://istio.io/latest/docs/reference/commands/istioctl";
     license = licenses.asl20;
-    maintainers = with maintainers; [ veehaitch ];
+    maintainers = with maintainers; [ superherointj bryanasdev000 veehaitch ];
     platforms = platforms.unix;
   };
 }

pkgs/applications/networking/cluster/sonobuoy/default.nix

@@ -1,11 +1,11 @@
 { lib, buildGoModule, fetchFromGitHub }:
 
 # SHA of ${version} for the tool's help output. Unfortunately this is needed in build flags.
-let rev = "1005bee8fff1b8daa30ddbcca717d03384630a71";
+let rev = "51c79060fc1433233eb43842de564f0f2e47be86";
 in
 buildGoModule rec {
   pname = "sonobuoy";
-  version = "0.56.3"; # Do not forget to update `rev` above
+  version = "0.56.4"; # Do not forget to update `rev` above
 
   ldflags =
     let t = "github.com/vmware-tanzu/sonobuoy";
@@ -20,10 +20,10 @@ buildGoModule rec {
     owner = "vmware-tanzu";
     repo = "sonobuoy";
     rev = "v${version}";
-    sha256 = "sha256-7yN3/bGjcntzMQRbB//fmqvD7me/xKLytfF+mQ1fcfc=";
+    sha256 = "sha256-6kHqfWDrZL3J5SrZ3JK50Z2Sw8mwM0zrfaKWo22g27A=";
   };
 
-  vendorSha256 = "sha256-qKXm39CwrTcXENIMh2BBS3MUlhJvmTTA3UzZNpF0PCc=";
+  vendorSha256 = "sha256-8n4a1PLUYDU46lVegQoOCmmRSR1XfnjgEGZ+R5f36Ic=";
 
   subPackages = [ "." ];
 

pkgs/applications/virtualization/docker/compose.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    sha256 = "sha256-dHq1t1ebPSAS5H14Kd03xCiHV9UhAH0dIxikQK0rHQk=";
+    sha256 = "sha256-6yc+7Fc22b8xN8thRrxxpjdEz19aBYCWxgkh/nra784=";
   };
 
   vendorSha256 = "sha256-N+paN3zEXzzUFb2JPVIDZYZ0h0iu7naiw4pSVnGsuKQ=";

pkgs/desktops/gnome/apps/gedit/default.nix

@@ -5,6 +5,7 @@
 , python3
 , pkg-config
 , gtk3
+, gtk-mac-integration
 , glib
 , adwaita-icon-theme
 , libpeas
@@ -24,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gedit";
-  version = "41.0";
+  version = "42.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gedit/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "epsYsViAjRiSmJFl83BsTxooKXkHmrdFinnTwkrU3rU=";
+    sha256 = "qHmR9Clh609qvNuqu3hHYMI66u765jY9PiGmHpxFhDc=";
   };
 
   patches = [
@@ -59,6 +60,8 @@ stdenv.mkDerivation rec {
     gtksourceview4
     libpeas
     libsoup
+  ] ++ lib.optionals stdenv.isDarwin [
+    gtk-mac-integration
   ];
 
   postPatch = ''

pkgs/desktops/gnome/core/sushi/default.nix

@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sushi";
-  version = "41.1";
+  version = "41.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/sushi/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "JifbYWLnV3hZDAfhZbLzbqJNEjGlE7FkAj/G3fx1xKM=";
+    sha256 = "tZ+0LJllxzYfdilt0qNARatlUGXqQUPeWsiyygyq6l4=";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/elm/default.nix

@@ -80,11 +80,23 @@ let
       # We need attoparsec < 0.14 to build elm for now
       attoparsec = self.attoparsec_0_13_2_5;
 
+      # aeson 2.0.3.0 does not build with attoparsec_0_13_2_5
+      aeson = self.aeson_1_5_6_0;
+
       # Needed for elm-format
       indents = self.callPackage ./packages/indents.nix {};
       bimap = self.callPackage ./packages/bimap.nix {};
       avh4-lib = doJailbreak (self.callPackage ./packages/avh4-lib.nix {});
       elm-format-lib = doJailbreak (self.callPackage ./packages/elm-format-lib.nix {});
+      # We need tasty-hspec < 1.1.7 and hspec-golden < 0.2 to build elm-format-lib
+      tasty-hspec = self.tasty-hspec_1_1_6;
+      hspec-golden = self.hspec-golden_0_1_0_3;
+
+      # We need hspec hspec_core, hspec_discover < 2.8 for tasty-hspec == 1.1.6
+      hspec = self.hspec_2_7_10;
+      hspec-core = self.hspec-core_2_7_10;
+      hspec-discover = self.hspec-discover_2_7_10;
+
       elm-format-test-lib = self.callPackage ./packages/elm-format-test-lib.nix {};
       elm-format-markdown = self.callPackage ./packages/elm-format-markdown.nix {};
     };

pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml

@@ -129,6 +129,11 @@ extra-packages:
   - relude == 0.7.0.0                   # 2022-02-25: Needed for ema 0.6
   - SVGFonts < 1.8                      # 2022-03-19: Needed for Chart-diagrams 1.9.3
   - clay < 0.14                         # 2022-03-20: Needed for neuron 1.0.0.0
+  - hspec-golden == 0.1.*               # 2022-04-07: Needed for elm-format
+  - tasty-hspec == 1.1.6                # 2022-04-07: Needed for elm-format
+  - hspec < 2.8                         # 2022-04-07: Needed for tasty-hspec 1.1.6
+  - hspec-core < 2.8                    # 2022-04-07: Needed for tasty-hspec 1.1.6
+  - hspec-discover < 2.8                # 2022-04-07: Needed for tasty-hspec 1.1.6
 
 package-maintainers:
   abbradar:

pkgs/development/haskell-modules/hackage-packages.nix

@@ -143724,6 +143724,22 @@ self: {
        broken = true;
      }) {};
 
+  "hspec_2_7_10" = callPackage
+    ({ mkDerivation, base, hspec-core, hspec-discover
+     , hspec-expectations, QuickCheck
+     }:
+     mkDerivation {
+       pname = "hspec";
+       version = "2.7.10";
+       sha256 = "0z0lwrmrqkglr78n6k2c36n4h68142bh785ys0x4jaibjshvs6rw";
+       libraryHaskellDepends = [
+         base hspec-core hspec-discover hspec-expectations QuickCheck
+       ];
+       description = "A Testing Framework for Haskell";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "hspec" = callPackage
     ({ mkDerivation, base, hspec-core, hspec-discover
      , hspec-expectations, QuickCheck
@@ -143810,6 +143826,34 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "hspec-core_2_7_10" = callPackage
+    ({ mkDerivation, ansi-terminal, array, base, call-stack, clock
+     , deepseq, directory, filepath, hspec-expectations, hspec-meta
+     , HUnit, process, QuickCheck, quickcheck-io, random, setenv
+     , silently, stm, temporary, tf-random, transformers
+     }:
+     mkDerivation {
+       pname = "hspec-core";
+       version = "2.7.10";
+       sha256 = "12k9yp5gznrda449ir60d5wv3xl7nnyffkb5mhfc0svw9f8lxlv1";
+       libraryHaskellDepends = [
+         ansi-terminal array base call-stack clock deepseq directory
+         filepath hspec-expectations HUnit QuickCheck quickcheck-io random
+         setenv stm tf-random transformers
+       ];
+       testHaskellDepends = [
+         ansi-terminal array base call-stack clock deepseq directory
+         filepath hspec-expectations hspec-meta HUnit process QuickCheck
+         quickcheck-io random setenv silently stm temporary tf-random
+         transformers
+       ];
+       testToolDepends = [ hspec-meta ];
+       testTarget = "--test-option=--skip --test-option='Test.Hspec.Core.Runner.hspecResult runs specs in parallel'";
+       description = "A Testing Framework for Haskell";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "hspec-core" = callPackage
     ({ mkDerivation, ansi-terminal, array, base, base-orphans
      , call-stack, clock, deepseq, directory, filepath
@@ -143885,6 +143929,27 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "hspec-discover_2_7_10" = callPackage
+    ({ mkDerivation, base, directory, filepath, hspec-meta, QuickCheck
+     }:
+     mkDerivation {
+       pname = "hspec-discover";
+       version = "2.7.10";
+       sha256 = "13yzvd3b679skvs1insk4s0wc4zvmz6hs38kc8q0j6vzqq06smqa";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [ base directory filepath ];
+       executableHaskellDepends = [ base directory filepath ];
+       testHaskellDepends = [
+         base directory filepath hspec-meta QuickCheck
+       ];
+       testToolDepends = [ hspec-meta ];
+       description = "Automatically discover and run Hspec tests";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ maralorn ];
+     }) {};
+
   "hspec-discover" = callPackage
     ({ mkDerivation, base, directory, filepath, hspec-meta, mockery
      , QuickCheck
@@ -144065,6 +144130,24 @@ self: {
        broken = true;
      }) {};
 
+  "hspec-golden_0_1_0_3" = callPackage
+    ({ mkDerivation, base, directory, hspec, hspec-core
+     , optparse-applicative, silently
+     }:
+     mkDerivation {
+       pname = "hspec-golden";
+       version = "0.1.0.3";
+       sha256 = "1d5ab34n0f1wk1q86qlb7x2b49abzzh08jh7j52nbrvnxld2j64l";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [ base directory hspec-core ];
+       executableHaskellDepends = [ base directory optparse-applicative ];
+       testHaskellDepends = [ base directory hspec hspec-core silently ];
+       description = "Golden tests for hspec";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "hspec-golden" = callPackage
     ({ mkDerivation, base, directory, filepath, hspec, hspec-core
      , optparse-applicative, silently
@@ -266999,6 +267082,25 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "tasty-hspec_1_1_6" = callPackage
+    ({ mkDerivation, base, hspec, hspec-core, QuickCheck, tasty
+     , tasty-quickcheck, tasty-smallcheck
+     }:
+     mkDerivation {
+       pname = "tasty-hspec";
+       version = "1.1.6";
+       sha256 = "02s82ijs2ringqxsqbm7m3vcy5brmwxa617azxv0v2phi3rdkjvl";
+       revision = "1";
+       editedCabalFile = "0za15rg0szacxq9yfxxjzddr77ai7ng5827a20pj9dr5anjlnajj";
+       libraryHaskellDepends = [
+         base hspec hspec-core QuickCheck tasty tasty-quickcheck
+         tasty-smallcheck
+       ];
+       description = "Hspec support for the Tasty test framework";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "tasty-hspec" = callPackage
     ({ mkDerivation, base, hspec, hspec-core, QuickCheck, tasty
      , tasty-quickcheck, tasty-smallcheck

pkgs/development/libraries/amdvlk/default.nix

@@ -22,13 +22,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "amdvlk";
-  version = "2022.Q1.3";
+  version = "2022.Q2.1";
 
   src = fetchRepoProject {
     name = "${pname}-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${version}";
-    sha256 = "UBvHWgC/s00XPn87DAmQ65NszFMoZSXwbrVG064HFng=";
+    sha256 = "MJTpPzmIcTf4/RNte1oDYmn6/wLUJrHM2igrGgXIVqI=";
   };
 
   buildInputs = [

pkgs/development/libraries/flint/default.nix

@@ -42,6 +42,8 @@ stdenv.mkDerivation rec {
     "--with-blas=${openblas}"
   ];
 
+  enableParallelBuilding = true;
+
   doCheck = true;
 
   meta = with lib; {

pkgs/development/libraries/science/math/petsc/default.nix

@@ -18,11 +18,11 @@ assert petsc-withp4est -> p4est.mpiSupport;
 
 stdenv.mkDerivation rec {
   pname = "petsc";
-  version = "3.16.5";
+  version = "3.17.0";
 
   src = fetchurl {
     url = "http://ftp.mcs.anl.gov/pub/petsc/release-snapshots/petsc-${version}.tar.gz";
-    sha256 = "sha256-fehXDuuUBidS2CqDII/Cuvx3s/UVAjpMFNj/lEDmbKw=";
+    sha256 = "sha256-ltWspoThzhQliRpiDSeHc8JWEcsUQWWpOxdTEjjqr4o=";
   };
 
   mpiSupport = !withp4est || p4est.mpiSupport;

pkgs/development/python-modules/aioswitcher/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "aioswitcher";
-  version = "2.0.8";
+  version = "2.0.9";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "TomerFi";
     repo = pname;
-    rev = version;
+    rev = "refs/tags/${version}";
-    sha256 = "sha256-4+XGSaHZNYjId0bTOwCkYpb1K/pM8WtN5/NI+GVaI7M=";
+    sha256 = "sha256-vsMQG664ySMQfdl4tGJKMY0MZXVl39QaFxu7kMtZWCM=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/azure-eventgrid/default.nix

@@ -5,16 +5,20 @@
 , azure-common
 , azure-core
 , msrestazure
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "azure-eventgrid";
-  version = "4.7.1";
+  version = "4.8.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "b96afc0317c764c2c428512485305ec5748698081cb6bc70dcaa903b0ac04754";
+    hash = "sha256-8jEtTQTUJLSa2iuA/Sgirgcm8kbwWOT11O1n46CLouw=";
   };
 
   propagatedBuildInputs = [
@@ -26,7 +30,10 @@ buildPythonPackage rec {
 
   # has no tests
   doCheck = false;
-  pythonImportsCheck = [ "azure.eventgrid" ];
+
+  pythonImportsCheck = [
+    "azure.eventgrid"
+  ];
 
   meta = with lib; {
     description = "A fully-managed intelligent event routing service that allows for uniform event consumption using a publish-subscribe model";

pkgs/development/python-modules/azure-mgmt-storage/default.nix

@@ -3,18 +3,20 @@
 , fetchPypi
 , azure-mgmt-common
 , azure-mgmt-core
-, isPy3k
+, pythonOlder
 }:
 
 buildPythonPackage rec {
-  version = "19.1.0";
+  version = "20.0.0";
   pname = "azure-mgmt-storage";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "sha256-Seoi8A4JZaNVCvNKQcGh06SBaQ9lAMeOhUCIAvVtdBY=";
+    hash = "sha256-buR2tWIv9vWVTt7m6w2N1CezIXAihVrfHshjPKBM3uI=";
   };
 
   propagatedBuildInputs = [
@@ -22,9 +24,13 @@ buildPythonPackage rec {
     azure-mgmt-core
   ];
 
-  pythonNamespaces = [ "azure.mgmt" ];
+  pythonNamespaces = [
+    "azure.mgmt"
+  ];
 
-  pythonImportsCheck = [ "azure.mgmt.storage" ];
+  pythonImportsCheck = [
+    "azure.mgmt.storage"
+  ];
 
   # has no tests
   doCheck = false;

pkgs/development/python-modules/google-cloud-pubsub/default.nix

@@ -10,16 +10,19 @@
 , mock
 , proto-plus
 , pytest-asyncio
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.11.0";
+  version = "2.12.0";
   format = "setuptools";
 
+  disabled = pythonOlder "3.6";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-btPJ2X+I0f8C3YDB9bZwPv7HWnqsq9koWsT+CyK1AgM=";
+    hash = "sha256-5RoIpyVm/y2+6pN4mJPWHbVUwxH6yWI/vIuCVNJU2aw=";
   };
 
   propagatedBuildInputs = [
@@ -47,7 +50,9 @@ buildPythonPackage rec {
     "tests/unit/pubsub_v1"
   ];
 
-  pythonImportsCheck = [ "google.cloud.pubsub" ];
+  pythonImportsCheck = [
+    "google.cloud.pubsub"
+  ];
 
   meta = with lib; {
     description = "Google Cloud Pub/Sub API client library";

pkgs/development/python-modules/west/default.nix

@@ -1,16 +1,24 @@
-{ lib, fetchPypi, buildPythonPackage, isPy3k
+{ lib
-, colorama, configobj, packaging, pyyaml, pykwalify
+, buildPythonPackage
+, colorama
+, configobj
+, fetchPypi
+, packaging
+, pykwalify
+, pythonOlder
+, pyyaml
 }:
 
 buildPythonPackage rec {
-  version = "0.12.0";
   pname = "west";
+  version = "0.13.0";
+  format = "setuptools";
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d7ce0d719fd218fee5983442fe93a33a21a6be6a736915a7ffbe75369714e9ce";
+    hash = "sha256-jlOmeIM6NfgYykjhgs7KpnAXFMbT/lpbT/bBaJ2CGY4=";
   };
 
   propagatedBuildInputs = [
@@ -24,12 +32,12 @@ buildPythonPackage rec {
   # pypi package does not include tests (and for good reason):
   # tests run under 'tox' and have west try to git clone repos (not sandboxable)
   doCheck = false;
+
   pythonImportsCheck = [
     "west"
   ];
 
   meta = with lib; {
-    homepage = "https://github.com/zephyrproject-rtos/west";
     description = "Zephyr RTOS meta tool";
     longDescription = ''
       West lets you manage multiple Git repositories under a single directory using a single file,
@@ -47,6 +55,7 @@ buildPythonPackage rec {
       For more details, see Multiple Repository Management in the west documentation
       (https://docs.zephyrproject.org/latest/guides/west/repo-tool.html).
     '';
+    homepage = "https://github.com/zephyrproject-rtos/west";
     license = licenses.asl20;
     maintainers = with maintainers; [ siriobalmelli ];
   };

pkgs/development/python-modules/yq/default.nix

@@ -4,6 +4,7 @@
 , substituteAll
 , argcomplete
 , pyyaml
+, toml
 , xmltodict
 , jq
 , setuptools-scm
@@ -26,11 +27,6 @@ buildPythonPackage rec {
     })
   ];
 
-  postPatch = ''
-    substituteInPlace test/test.py \
-      --replace "expect_exit_codes={0} if sys.stdin.isatty() else {2}" "expect_exit_codes={0}"
-  '';
-
   nativeBuildInputs = [
     setuptools-scm
   ];
@@ -38,6 +34,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     pyyaml
     xmltodict
+    toml
     argcomplete
   ];
 
@@ -49,13 +46,8 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "yq" ];
 
-  doInstallCheck = true;
-  installCheckPhase = ''
-    echo '{"hello":{"foo":"bar"}}' | $out/bin/yq -y . | grep 'foo: bar'
-  '';
-
   meta = with lib; {
-    description = "Command-line YAML processor - jq wrapper for YAML documents";
+    description = "Command-line YAML/XML/TOML processor - jq wrapper for YAML, XML, TOML documents";
     homepage = "https://github.com/kislyuk/yq";
     license = licenses.asl20;
     maintainers = with maintainers; [ womfoo SuperSandro2000 ];

pkgs/servers/http/envoy/default.nix

@@ -127,8 +127,9 @@ buildBazelPackage rec {
   ];
 
   passthru.tests = {
-    # No tests for Envoy itself (yet), but it's tested as a core component of Pomerium.
+    envoy = nixosTests.envoy;
-    inherit (nixosTests) pomerium;
+    # tested as a core component of Pomerium
+    pomerium = nixosTests.pomerium;
   };
 
   meta = with lib; {

pkgs/servers/keycloak/default.nix

@@ -19,11 +19,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname   = "keycloak";
-  version = "16.1.0";
+  version = "17.0.1";
 
   src = fetchzip {
-    url    = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
+    url    = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-legacy-${version}.zip";
-    sha256 = "sha256-QVFu3f+mwafoNUttLEVMdoZHMJjjH/TpZAGV7ZvIvh0=";
+    sha256 = "sha256-oqANNk7T6+CAS818v3I1QNsuxetL/JFZMqxouRn+kdE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/servers/mastodon/default.nix

@@ -1,6 +1,7 @@
 { lib, stdenv, nodejs-slim, mkYarnPackage, fetchFromGitHub, bundlerEnv, nixosTests
 , yarn, callPackage, imagemagick, ffmpeg, file, ruby_3_0, writeShellScript
 , fetchYarnDeps, fixup_yarn_lock
+, fetchpatch
 
   # Allow building a fork or custom version of Mastodon:
 , pname ? "mastodon"
@@ -21,6 +22,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Ngfs15YKLfSBOKju3BzpZFnenB370jId2G1g9Qy1y5w=";
   };
 
+  patches = [
+    # Fix indexing statuses in ElasticSearch
+    (fetchpatch {
+      url = "https://github.com/mastodon/mastodon/commit/ef196c913c77338be5ebb1e02af2f6225f857080.patch";
+      sha256 = "sha256-uw8m6j4BzMQtev0LNLeIHW0xOJEmj3JikT/6gVfmvzs=";
+    })
+  ];
+
   mastodon-gems = bundlerEnv {
     name = "${pname}-gems-${version}";
     inherit version;

pkgs/servers/matrix-synapse/default.nix

@@ -11,11 +11,11 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.55.2";
+  version = "1.56.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MCdwatNo4cDAaq9a3UFwSLJzT1ZxhoYqPOu/a957D2Y=";
+    sha256 = "sha256-MWMCGgsWJqIO4xefIHxp/mtR7yxLrJOfTsb2hxlGeiY=";
   };
 
   buildInputs = [ openssl ];

pkgs/shells/zsh/oh-my-zsh/default.nix

@@ -5,15 +5,15 @@
 , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert }:
 
 stdenv.mkDerivation rec {
-  version = "2022-04-04";
+  version = "2022-04-06";
   pname = "oh-my-zsh";
-  rev = "4d9e5ce9a7d8db3c3aadcae81580a5c3ff5a0e8b";
+  rev = "b3999a4b156185b617a5608317497399f88dc8fe";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    sha256 = "Plg7mr6ZOSzUpq5XMFkebVpCjdtwe237+4sVdtL+kLM=";
+    sha256 = "yXM+fLdNWOrUU03K7527NgtaAwSql5r0wPaWgUZqGhY=";
   };
 
   installPhase = ''

pkgs/tools/admin/eksctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.90.0";
+  version = "0.91.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-XQZ32Gg/LZCDuSmtGvDEYCuzvq39zzq3yGGTYSKZyXI=";
+    sha256 = "sha256-Hz/joHOzy71ZtbpoTjomccSgc49VyWACTC9EwSiDpzc=";
   };
 
-  vendorSha256 = "sha256-IYqeuyNPRQBMwuZMW4InKfHpOLhleM5Mz5Oauw4nK6M=";
+  vendorSha256 = "sha256-rkEVtIHXD5lXj8r89vhoWhJZF3unvwB43Zz3jBHRjYU=";
 
   doCheck = false;
 

pkgs/tools/admin/pebble/default.nix

@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "pebble";
-  version = "2.3.0";
+  version = "2.3.1";
 
   goPackagePath = "github.com/letsencrypt/${pname}";
 
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "letsencrypt";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1piwzzfqsdx6s2niczzp4mf4r3qn9nfdgpn7882g52cmmm0vzks2";
+    sha256 = "sha256-S9+iRaTSRt4F6yMKK0OJO6Zto9p0dZ3q/mULaipudVo=";
   };
 
   passthru.tests = {

pkgs/tools/misc/sfeed/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "sfeed";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchgit {
     url = "git://git.codemadness.org/sfeed";
     rev = version;
-    sha256 = "sha256-XOBzvVOOv84LzFNiLOnmJWm552igGLNFB2i3eMeWaW8=";
+    sha256 = "sha256-fn+PE0WwBdllsO1gXbM2Ftdrl8ua/v50Ny4C/J4OK8Q=";
   };
 
   buildInputs = [ ncurses ];

pkgs/tools/networking/amass/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "amass";
-  version = "3.19.0";
+  version = "3.19.1";
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "Amass";
     rev = "v${version}";
-    sha256 = "sha256-mhz+SjJwVsosbfJLnFUBt4y6W+afQFokciuBrFpfC48=";
+    sha256 = "sha256-URl0I2jtiw27IZSkxa0JR313+Et6OIZPB9SeRf2tqnk=";
   };
 
-  vendorSha256 = "sha256-DGeMSyyucdU1FGRfil3I12UZ4DR1nQWD9oEDRhWQQzo=";
+  vendorSha256 = "sha256-emWAUxgM8HrDo5ThzqNlinUg6aEwh5TyOOTEQjM53wc=";
 
   outputs = [ "out" "wordlists" ];
 

pkgs/tools/networking/corerad/default.nix

@@ -2,18 +2,16 @@
 
 buildGo118Module rec {
   pname = "corerad";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "mdlayher";
     repo = "corerad";
     rev = "v${version}";
-    sha256 = "sha256-2XPWexpr3xGwnvjT08BVq6uf1haPuZGwKswiy/1Z8vE=";
+    sha256 = "sha256-1v7jAYLIflXIKY0zltzkre4sNv9qqWxFGWrQuOBr2s0=";
   };
 
-  vendorSha256 = "sha256-+9KjgbKuAJexdGEKu9hIsHfHsVbKeB5ZtSgFzM2/bOI=";
+  vendorSha256 = "sha256-oS9nI1BELDLFksN+NbLT1Eklg67liOvcRbxtGdYGJJA=";
-
-  doCheck = false;
 
   # Since the tarball pulled from GitHub doesn't contain git tag information,
   # we fetch the expected tag's timestamp from a file in the root of the
@@ -36,5 +34,6 @@ buildGo118Module rec {
     description = "Extensible and observable IPv6 NDP RA daemon";
     license = licenses.asl20;
     maintainers = with maintainers; [ mdlayher ];
+    platforms = platforms.linux;
   };
 }

pkgs/tools/security/gitleaks/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.5.1";
+  version = "8.6.1";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lx7xjOajFyeetnGcJwX66pIcZw2A7+QGWb5crCoA83g=";
+    sha256 = "sha256-rXnP9vU8kHkMPl7Xur4pf3rvw12ADtkZxZnBO1LaFzs=";
   };
 
   vendorSha256 = "sha256-gelUrZOYiThO0+COIv9cOgho/tjv7ZqSKOktWIbdADw=";

pkgs/top-level/all-packages.nix

@@ -23038,7 +23038,9 @@ with pkgs;
 
   golint = callPackage ../development/tools/golint { };
 
-  golangci-lint = callPackage ../development/tools/golangci-lint { };
+  golangci-lint = callPackage ../development/tools/golangci-lint {
+    buildGoModule = buildGo118Module;
+  };
 
   gocyclo = callPackage ../development/tools/gocyclo { };