Merge branch 'master' into haskell-updates

2022-07-22 00:22:27 +02:00 · 2022-07-22 00:22:27 +02:00 · 15924be1b2
parent 8fc4df0415 3debd9a437
commit 15924be1b2
86 changed files with 5001 additions and 3660 deletions
--- a/doc/contributing/submitting-changes.chapter.md
+++ b/doc/contributing/submitting-changes.chapter.md
@ -167,24 +167,30 @@ Packages with automated tests are much more likely to be merged in a timely fash

 ### Tested compilation of all pkgs that depend on this change using `nixpkgs-review` {#submitting-changes-tested-compilation}

-If you are updating a package’s version, you can use nixpkgs-review to make sure all packages that depend on the updated package still compile correctly. The `nixpkgs-review` utility can look for and build all dependencies either based on uncommited changes with the `wip` option or specifying a github pull request number.
+If you are updating a package’s version, you can use `nixpkgs-review` to make sure all packages that depend on the updated package still compile correctly. The `nixpkgs-review` utility can look for and build all dependencies either based on uncommitted changes with the `wip` option or specifying a GitHub pull request number.

-review changes from pull request number 12345:
+Review changes from pull request number 12345:

 ```ShellSession
-nix run nixpkgs.nixpkgs-review -c nixpkgs-review pr 12345
+nix-shell -p nixpkgs-review --run "nixpkgs-review pr 12345"
 ```

-review uncommitted changes:
+Alternatively, with flakes (and analogously for the other commands below):

 ```ShellSession
-nix run nixpkgs.nixpkgs-review -c nixpkgs-review wip
+nix run nixpkgs#nixpkgs-review -- pr 12345
 ```

-review changes from last commit:
+Review uncommitted changes:

 ```ShellSession
-nix run nixpkgs.nixpkgs-review -c nixpkgs-review rev HEAD
+nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
+```
+
+Review changes from last commit:
+
+```ShellSession
+nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"
 ```

 ### Tested execution of all binary files (usually in `./result/bin/`) {#submitting-changes-tested-execution}
--- a/nixos/lib/test-driver/test_driver/vlan.py
+++ b/nixos/lib/test-driver/test_driver/vlan.py
@ -32,8 +32,12 @@ class VLan:
        rootlog.info("start vlan")
        pty_master, pty_slave = pty.openpty()

+        # The --hub is required for the scenario determined by
+        # nixos/tests/networking.nix vlan-ping.
+        # VLAN Tagged traffic (802.1Q) seams to be blocked if a vde_switch is
+        # used without the hub mode (flood packets to all ports).
        self.process = subprocess.Popen(
-            ["vde_switch", "-s", self.socket_dir, "--dirmode", "0700"],
+            ["vde_switch", "-s", self.socket_dir, "--dirmode", "0700", "--hub"],
            stdin=pty_slave,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
@ -50,7 +54,7 @@ class VLan:
        if not (self.socket_dir / "ctl").exists():
            rootlog.error("cannot start vde_switch")

-        rootlog.info(f"running vlan (pid {self.pid})")
+        rootlog.info(f"running vlan (pid {self.pid}; ctl {self.socket_dir})")

    def __del__(self) -> None:
        rootlog.info(f"kill vlan (pid {self.pid})")
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -392,10 +392,9 @@ in
    services.udev.extraRules =
      ''
        # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
-        KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c 195 255'"
-        KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c 195 254'"
-        KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", PROGRAM="${pkgs.gnugrep}/bin/grep 'Device Minor:' /proc/driver/nvidia/gpus/%b/information", \
-          RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia%c{3} c 195 %c{3}"
+        KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 255'"
+        KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'for i in $$(cat /proc/driver/nvidia/gpus/*/information | grep Minor | cut -d \  -f 4); do mknod -m 666 /dev/nvidia$${i} c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) $${i}; done'"
+        KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 254'"
        KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
        KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 1'"
      '' + optionalString cfg.powerManagement.finegrained (
--- a/nixos/modules/services/continuous-integration/github-runner.nix
+++ b/nixos/modules/services/continuous-integration/github-runner.nix
@ -300,7 +300,6 @@ in
        UMask = "0066";
        ProtectProc = "invisible";
        SystemCallFilter = [
-          "~@capset"
          "~@clock"
          "~@cpu-emulation"
          "~@module"
@ -308,6 +307,7 @@ in
          "~@obsolete"
          "~@raw-io"
          "~@reboot"
+          "~capset"
          "~setdomainname"
          "~sethostname"
        ];
--- a/nixos/modules/services/games/minecraft-server.nix
+++ b/nixos/modules/services/games/minecraft-server.nix
@ -22,6 +22,15 @@ let
  '' + concatStringsSep "\n" (mapAttrsToList
    (n: v: "${n}=${cfgToString v}") cfg.serverProperties));

+  stopScript = pkgs.writeShellScript "minecraft-server-stop" ''
+    echo stop > ${config.systemd.sockets.minecraft-server.socketConfig.ListenFIFO}
+
+    # Wait for the PID of the minecraft server to disappear before
+    # returning, so systemd doesn't attempt to SIGKILL it.
+    while kill -0 "$1" 2> /dev/null; do
+      sleep 1s
+    done
+  '';

  # To be able to open the firewall, we need to read out port values in the
  # server properties, but fall back to the defaults when those don't exist.
@ -172,16 +181,35 @@ in {
    };
    users.groups.minecraft = {};

+    systemd.sockets.minecraft-server = {
+      bindsTo = [ "minecraft-server.service" ];
+      socketConfig = {
+        ListenFIFO = "/run/minecraft-server.stdin";
+        SocketMode = "0660";
+        SocketUser = "minecraft";
+        SocketGroup = "minecraft";
+        RemoveOnStop = true;
+        FlushPending = true;
+      };
+    };
+
    systemd.services.minecraft-server = {
      description   = "Minecraft Server Service";
      wantedBy      = [ "multi-user.target" ];
-      after         = [ "network.target" ];
+      requires      = [ "minecraft-server.socket" ];
+      after         = [ "network.target" "minecraft-server.socket" ];

      serviceConfig = {
        ExecStart = "${cfg.package}/bin/minecraft-server ${cfg.jvmOpts}";
+        ExecStop = "${stopScript} $MAINPID";
        Restart = "always";
        User = "minecraft";
        WorkingDirectory = cfg.dataDir;
+
+        StandardInput = "socket";
+        StandardOutput = "journal";
+        StandardError = "journal";
+
        # Hardening
        CapabilityBoundingSet = [ "" ];
        DeviceAllow = [ "" ];
--- a/nixos/modules/services/network-filesystems/glusterfs.nix
+++ b/nixos/modules/services/network-filesystems/glusterfs.nix
@ -159,9 +159,10 @@ in
        install -m 0755 -d /var/log/glusterfs
      ''
      # The copying of hooks is due to upstream bug https://bugzilla.redhat.com/show_bug.cgi?id=1452761
+      # Excludes one hook due to missing SELinux binaries.
      + ''
        mkdir -p /var/lib/glusterd/hooks/
-        ${rsync}/bin/rsync -a ${glusterfs}/var/lib/glusterd/hooks/ /var/lib/glusterd/hooks/
+        ${rsync}/bin/rsync -a --exclude="S10selinux-label-brick.sh" ${glusterfs}/var/lib/glusterd/hooks/ /var/lib/glusterd/hooks/

        ${tlsCmd}
      ''
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@ -143,6 +143,7 @@ in
            disable-logging = true;
            http = ":8080";                   # serve via HTTP...
            socket = "/run/searx/searx.sock"; # ...or UNIX socket
+            chmod-socket = "660";             # allow the searx group to read/write to the socket
          }
        '';
        description = ''
@ -220,7 +221,12 @@ in
        lazy-apps = true;
        enable-threads = true;
        module = "searx.webapp";
-        env = [ "SEARX_SETTINGS_PATH=${cfg.settingsFile}" ];
+        env = [
+          "SEARX_SETTINGS_PATH=${cfg.settingsFile}"
+          # searxng compatiblity https://github.com/searxng/searxng/issues/1519
+          "SEARXNG_SETTINGS_PATH=${cfg.settingsFile}"
+        ];
+        buffer-size = 32768;
        pythonPackages = self: [ cfg.package ];
      } // cfg.uwsgiConfig;
    };
--- a/nixos/modules/tasks/lvm.nix
+++ b/nixos/modules/tasks/lvm.nix
@ -85,13 +85,15 @@ in {
          systemd.initrdBin = lib.mkIf config.boot.initrd.services.lvm.enable [ pkgs.vdo ];

          extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable)''
-            ls ${pkgs.vdo}/bin/ | grep -v adaptLVMVDO | while read BIN; do
+            ls ${pkgs.vdo}/bin/ | while read BIN; do
              copy_bin_and_libs ${pkgs.vdo}/bin/$BIN
            done
+            substituteInPlace $out/bin/vdorecover --replace "${pkgs.bash}/bin/bash" "/bin/sh"
+            substituteInPlace $out/bin/adaptLVMVDO.sh --replace "${pkgs.bash}/bin/bash" "/bin/sh"
          '';

          extraUtilsCommandsTest = mkIf (!config.boot.initrd.systemd.enable)''
-            ls ${pkgs.vdo}/bin/ | grep -v adaptLVMVDO | while read BIN; do
+            ls ${pkgs.vdo}/bin/ | grep -vE '(adaptLVMVDO|vdorecover)' | while read BIN; do
              $out/bin/$(basename $BIN) --help > /dev/null
            done
          '';
--- a/nixos/tests/minecraft-server.nix
+++ b/nixos/tests/minecraft-server.nix
@ -33,5 +33,6 @@ in import ./make-test-python.nix ({ pkgs, ... }: {
    assert "${seed}" in server.succeed(
        "mcrcon -H localhost -P ${toString rcon-port} -p '${rcon-pass}' -c 'seed'"
    )
+    server.succeed("systemctl stop minecraft-server")
  '';
 })
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@ -682,6 +682,46 @@ let
              client2.succeed("ip addr show dev vlan >&2")
        '';
    };
+    vlan-ping = let
+        baseIP = number: "10.10.10.${number}";
+        vlanIP = number: "10.1.1.${number}";
+        baseInterface = "eth1";
+        vlanInterface = "vlan42";
+        node = number: {pkgs, ... }: with pkgs.lib; {
+          virtualisation.vlans = [ 1 ];
+          networking = {
+            #useNetworkd = networkd;
+            useDHCP = false;
+            vlans.${vlanInterface} = { id = 42; interface = baseInterface; };
+            interfaces.${baseInterface}.ipv4.addresses = mkOverride 0 [{ address = baseIP number; prefixLength = 24; }];
+            interfaces.${vlanInterface}.ipv4.addresses = mkOverride 0 [{ address = vlanIP number; prefixLength = 24; }];
+          };
+        };
+
+        serverNodeNum = "1";
+        clientNodeNum = "2";
+
+    in {
+      name = "vlan-ping";
+      nodes.server = node serverNodeNum;
+      nodes.client = node clientNodeNum;
+      testScript = { ... }:
+        ''
+          start_all()
+
+          with subtest("Wait for networking to be configured"):
+              server.wait_for_unit("network.target")
+              client.wait_for_unit("network.target")
+
+          with subtest("Test ping on base interface in setup"):
+              client.succeed("ping -I ${baseInterface} -c 1 ${baseIP serverNodeNum}")
+              server.succeed("ping -I ${baseInterface} -c 1 ${baseIP clientNodeNum}")
+
+          with subtest("Test ping on vlan subinterface in setup"):
+              client.succeed("ping -I ${vlanInterface} -c 1 ${vlanIP serverNodeNum}")
+              server.succeed("ping -I ${vlanInterface} -c 1 ${vlanIP clientNodeNum}")
+        '';
+    };
    virtual = {
      name = "Virtual";
      nodes.machine = {
--- a/pkgs/applications/misc/1password-gui/beta.nix
+++ b/pkgs/applications/misc/1password-gui/beta.nix
@ -44,12 +44,19 @@ let

 in stdenv.mkDerivation rec {
  pname = "1password";
-  version = "8.8.0-165.BETA";
+  version = "8.8.0-215.BETA";

-  src = fetchurl {
-    url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-    sha256 = "sha256-ZpKAkuIMeHEFdz/od/sKDh8VXoWOZYO8GjvMiho3D4A=";
-  };
+  src =
+    if stdenv.hostPlatform.isAarch64 then
+      fetchurl {
+        url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
+        sha256 = "sha256-GjLwLeJ6GE39NFIZ+v83xaUVsgrkKRH3xt60aG/XrDg=";
+      }
+    else
+      fetchurl {
+        url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
+        sha256 = "sha256-TR0evvu5NNR6Kvqj8JlpYuTcK9Rmf1oDFGrfzrGZzo8=";
+      };

  nativeBuildInputs = [ makeWrapper ];

@ -132,6 +139,6 @@ in stdenv.mkDerivation rec {
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
    maintainers = with maintainers; [ timstott savannidgerinel maxeaubrey sebtm ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/networking/p2p/gnunet/default.nix
+++ b/pkgs/applications/networking/p2p/gnunet/default.nix
@ -3,15 +3,15 @@
 , makeWrapper, ncurses, pkg-config, libxml2, sqlite, zlib
 , libpulseaudio, libopus, libogg, jansson, libsodium

-, postgresqlSupport ? false, postgresql }:
+, postgresqlSupport ? true, postgresql }:

 stdenv.mkDerivation rec {
  pname = "gnunet";
-  version = "0.17.1";
+  version = "0.17.2";

  src = fetchurl {
    url = "mirror://gnu/gnunet/${pname}-${version}.tar.gz";
-    sha256 = "sha256-dd4KcV4+lpKGSD7GrkslqHNlZk1CzftgbfjnRqFfEmU=";
+    sha256 = "sha256-OLE7V44kkKmSInV8ZHJ965eTn995cQf5hih8KUTudUE=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/networking/taler/default.nix
+++ b/pkgs/applications/networking/taler/default.nix
@ -1,58 +1,122 @@
-{ lib, stdenv, fetchurl, curl, gnunet, jansson, libgcrypt, libmicrohttpd
-, qrencode, libsodium, libtool, pkg-config, postgresql, sqlite }:
+{ lib, stdenv, fetchgit, curl, gnunet, jansson, libgcrypt, libmicrohttpd_0_9_72
+, qrencode, libsodium, libtool, libunistring, pkg-config, postgresql
+, autoreconfHook, python39, recutils, wget, jq, gettext, texinfo
+}:

 let
-  gnunet' = gnunet.override { postgresqlSupport = true; };
-
-  mkTaler = { pname, version, sha256 }:
-    extraAttrs:
-    stdenv.mkDerivation (extraAttrs // {
-      inherit pname version;
-      src = fetchurl {
-        url = "mirror://gnu/taler/${pname}-${version}.tar.gz";
-        inherit sha256;
-      };
-      enableParallelBuilding = true;
-      meta = with lib; {
-        broken = (stdenv.isLinux && stdenv.isAarch64);
-        description = "Anonymous, taxable payment system.";
-        homepage = "https://taler.net/";
-        license = licenses.agpl3Plus;
-        maintainers = with maintainers; [ ehmry ];
-        platforms = platforms.gnu ++ platforms.linux;
-      };
-    });
+  taler-merchant-backoffice = fetchgit {
+    url = "https://git.taler.net/merchant-backoffice.git";
+    # branch "prebuilt" as of 2022-07-01
+    rev = "1ef7150f32960cb65ebea67839cd5023f29a3d1d";
+    sha256 = "sha256-ZtLYWHi6l5DxFvDm8RFGUD0BiAfJXCZr/ggrP3Uw7/0=";
+  };

 in rec {
-
-  taler-exchange = mkTaler {
+  taler-exchange = stdenv.mkDerivation rec {
    pname = "taler-exchange";
-    version = "0.8.1";
-    sha256 = "sha256-MPt3n1JXd0Y89b1qCuF6YxptSr7henfYp97JTq1Z+x4=";
-  } {
-    buildInputs = [
-      curl
-      jansson
-      libgcrypt
-      libmicrohttpd
-      libsodium
-      libtool
-      postgresql
-      # sqlite
+    version = "unstable-2022-07-17";
+
+    src = fetchgit {
+      url = "https://git.taler.net/exchange.git";
+      rev = "93b45e62eef254eae68bc119b9770e97bae2c9fa";
+      fetchSubmodules = true;
+      sha256 = "sha256-BQxbwEf0wIkBOBVsPgMkMvUj4kFReXMUFTiSG0jXOJ0=";
+    };
+
+    nativeBuildInputs = [
+      autoreconfHook
+      pkg-config
    ];
-    propagatedBuildInputs = [ gnunet' ];
-    patches = [ ./exchange-fix-6665.patch ];
+    buildInputs = [
+      libgcrypt
+      libmicrohttpd_0_9_72
+      jansson
+      libsodium
+      postgresql
+      curl
+      recutils
+      gettext
+      texinfo # Fix 'makeinfo' is missing on your system.
+      libunistring
+      python39.pkgs.jinja2
+    ];
+    propagatedBuildInputs = [ gnunet ];
+
+    configureFlags = [ "--with-gnunet=${gnunet}" ];
+    preConfigure = ''
+      ./contrib/gana-update.sh
+    '';
+
+    enableParallelBuilding = true;
+
+    checkInputs = [ wget curl ];
+    doInstallCheck = true;
+    checkTarget = "check";
+
+    meta = with lib; {
+      description = ''
+        Taler is an electronic payment system providing the ability to pay
+        anonymously using digital cash.  Taler consists of a network protocol
+        definition (using a RESTful API over HTTP), a Exchange (which creates
+        digital coins), a Wallet (which allows customers to manage, store and
+        spend digital coins), and a Merchant website which allows customers to
+        spend their digital coins.  Naturally, each Merchant is different, but
+        Taler includes code examples to help Merchants integrate Taler as a
+        payment system.
+      '';
+      homepage = "https://taler.net/";
+      license = licenses.agpl3Plus;
+      maintainers = with maintainers; [ astro ];
+      platforms = platforms.linux;
+    };
  };

-  taler-merchant = mkTaler {
+  taler-merchant = stdenv.mkDerivation rec {
    pname = "taler-merchant";
-    version = "0.8.0";
-    sha256 = "sha256-scrFLXeoQirGqhc+bSQKRl84PfUvjrp1uxF7pfOIB9Q=";
-  } {
-    nativeBuildInputs = [ pkg-config ];
-    buildInputs = taler-exchange.buildInputs ++ [ qrencode taler-exchange ];
-    propagatedBuildInputs = [ gnunet' ];
-    PKG_CONFIG = "${pkg-config}/bin/pkg-config";
-  };
+    version = "unstable-2022-07-11";

+    src = fetchgit {
+      url = "https://git.taler.net/merchant.git";
+      rev = "60dcacf25e51cc2bff359ea1fc86cdd3d9e6083";
+      sha256 = "sha256-Wn11z6YjnylZl3z2JjBlrtZ1KHfQUHLIYWo5F+mAmNo=";
+    };
+    postUnpack = ''
+      ln -s ${taler-merchant-backoffice}/spa.html $sourceRoot/contrib/
+    '';
+
+    nativeBuildInputs = [ pkg-config autoreconfHook ];
+    buildInputs = taler-exchange.buildInputs ++ [
+      qrencode
+      taler-exchange
+      # for ltdl.h
+      libtool
+    ];
+    propagatedBuildInputs = [ gnunet ];
+
+    configureFlags = [
+      "--with-gnunet=${gnunet}"
+      "--with-exchange=${taler-exchange}"
+    ];
+
+    enableParallelBuilding = true;
+
+    checkInputs = [ jq ];
+    doInstallCheck = true;
+    checkTarget = "check";
+
+    meta = with lib; {
+      description = ''
+        This is the GNU Taler merchant backend. It provides the logic that should run
+        at every GNU Taler merchant.  The GNU Taler merchant is a RESTful backend that
+        can be used to setup orders and process payments.  This component allows
+        merchants to receive payments without invading the customers' privacy. Of
+        course, this applies mostly for digital goods, as the merchant does not need
+        to know the customer's physical address.
+      '';
+      homepage = "https://taler.net/";
+      license = licenses.agpl3Plus;
+      maintainers = with maintainers; [ astro ];
+      platforms = platforms.linux;
+    };
+  };
 }
--- a/pkgs/applications/networking/taler/exchange-fix-6665.patch
+++ b/pkgs/applications/networking/taler/exchange-fix-6665.patch
@ -1,48 +0,0 @@
-commit 9911b327ac299ec7eeae81b98cb520f4153071f2
-Author: Christian Grothoff <christian@grothoff.org>
-Date:   Wed Dec 9 07:25:26 2020 +0100
-
-    fix #6665
-
-diff --git a/src/testing/testing_api_cmd_rewind.c b/src/testing/testing_api_cmd_rewind.c
-index e1b17fa9..979607cd 100644
--- a/src/testing/testing_api_cmd_rewind.c
-+++ b/src/testing/testing_api_cmd_rewind.c
-@@ -24,7 +24,6 @@
-  */
- #include "platform.h"
- #include "taler_exchange_service.h"
-#include "taler/taler_testing_lib.h"
- #include "taler_testing_lib.h"
-
-
-diff --git a/src/testing/testing_api_cmd_twister_exec_client.c b/src/testing/testing_api_cmd_twister_exec_client.c
-index 2cb92a8f..b3903f29 100644
--- a/src/testing/testing_api_cmd_twister_exec_client.c
-+++ b/src/testing/testing_api_cmd_twister_exec_client.c
-@@ -26,7 +26,7 @@
-  */
-
- #include "platform.h"
-#include <taler/taler_testing_lib.h>
-+#include "taler_testing_lib.h"
- #include "taler_twister_testing_lib.h"
-
-
-diff --git a/src/testing/testing_api_trait_uuid.c b/src/testing/testing_api_trait_uuid.c
-index c9b73a5b..4d5003ec 100644
--- a/src/testing/testing_api_trait_uuid.c
-+++ b/src/testing/testing_api_trait_uuid.c
-@@ -22,9 +22,9 @@
-  * @author Jonathan Buchanan
-  */
- #include "platform.h"
-#include <taler/taler_signatures.h>
-#include <taler/taler_exchange_service.h>
-#include <taler/taler_testing_lib.h>
-+#include "taler_signatures.h"
-+#include "taler_exchange_service.h"
-+#include "taler_testing_lib.h"
-
-
- #define TALER_TESTING_TRAIT_UUID "uuid"
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.58.5";
+  version = "0.59.0";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "sha256-7olUx0JmztNb6uFsxKwOkBqkbMEiy2vb+iHqBe5I1PM=";
+    sha256 = "sha256-dPmrj4DM3c9dLldi1ZfoLgchZellart9PfADormj2Gk=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/logic/cvc3/default.nix
+++ b/pkgs/applications/science/logic/cvc3/default.nix
@ -13,6 +13,13 @@ stdenv.mkDerivation rec {

  patches = [ ./cvc3-2.4.1-gccv6-fix.patch ];

+  # fails to configure on darwin due to gmp not found
+  configureFlags = [ "LIBS=-L${gmp}/lib" "CXXFLAGS=-I${gmp.dev}/include" ];
+
+  # disable stackprotector on aarch64-darwin for now
+  # https://github.com/NixOS/nixpkgs/issues/127608
+  hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
+
  postPatch = ''
    sed -e "s@ /bin/bash@bash@g" -i Makefile.std
    find . -exec sed -e "s@/usr/bin/perl@${perl}/bin/perl@g" -i '{}' ';'
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "lean";
-  version = "3.43.0";
+  version = "3.45.0";

  src = fetchFromGitHub {
    owner  = "leanprover-community";
@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
    # from. this is then used to check whether an olean file should be
    # rebuilt. don't use a tag as rev because this will get replaced into
    # src/githash.h.in in preConfigure.
-    rev    = "bfce34363b0efe86e93e3fe75de76ab3740c772d";
-    sha256 = "100mb003zkgrv1wd2agbk41aipk3j78k8zcjbj7pv9ixh02c7ss8";
+    rev    = "22b09be35ef66aece11e6e8f5d114f42b064259b";
+    sha256 = "1i1zpl9m80k64b7ac23gzab55kky4444lvki1isbmd92m3m4bk8x";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/science/misc/boinc/default.nix
+++ b/pkgs/applications/science/misc/boinc/default.nix
@ -4,7 +4,7 @@ sqlite, gtk2, patchelf, libXScrnSaver, libnotify, libX11, libxcb }:

 let
  majorVersion = "7.20";
-  minorVersion = "1";
+  minorVersion = "2";
 in

 stdenv.mkDerivation rec {
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    owner = "BOINC";
    repo = "boinc";
    rev = "client_release/${majorVersion}/${version}";
-    sha256 = "sha256-FRU5s/nvT3VKU78AXYlbzeru7XQwNSqDNMGrdQ3jd1w=";
+    sha256 = "sha256-vMb5Vq/6I6lniG396wd7+FfslsByedMRPIpiItp1d1s=";
  };

  nativeBuildInputs = [ libtool automake autoconf m4 pkg-config ];
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "snakemake";
-  version = "7.8.5";
+  version = "7.9.0";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "snakemake";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-y1rjBp5O0aiVeFlCIw7IK4A3ehOhzy+NKa9/abhFrFo=";
+    hash = "sha256-3kYOo90hr8QRJzwTlmxB1ebcFOcRM4H/+sBYNGdR5WQ=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/applications/search/re-isearch/default.nix
+++ b/pkgs/applications/search/re-isearch/default.nix
@ -0,0 +1,46 @@
+{ stdenv, fetchFromGitHub, lib, db, file, libnsl }:
+
+stdenv.mkDerivation rec {
+  pname = "re-Isearch";
+  version = "unstable-2022-03-24";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "e5953ea6c84285283be3689df7065908369cdbaf";
+    sha256 = "sha256-D0PDqlWzIOHqdS2MlNzR2T5cyhiLcFlf30v6eFokoRQ=";
+  };
+
+  buildinputs = [
+    db
+    file # libmagic
+    libnsl
+  ];
+
+  makeFlags = [
+    "CC=g++" "cc=gcc" "LD=g++"
+    "INSTALL=${placeholder "out"}/bin"
+  ];
+
+  preBuild = ''
+    cd build
+    makeFlagsArray+=(
+      EXTRA_INC="-I${db.dev}/include -I${file}/include"
+      LD_PATH="-L../lib -L${db.out}/lib -L${file}/lib -L${libnsl}/lib"
+    )
+  '';
+
+  preInstall = ''
+    mkdir -p $out/{bin,lib}
+  '';
+  postInstall = ''
+    cp ../lib/*.so $out/lib/
+  '';
+
+  meta = with lib; {
+    description = "Novel multimodal search and retrieval engine";
+    homepage = "https://github.com/re-Isearch/";
+    license = licenses.asl20;
+    maintainers = [ maintainers.astro ];
+  };
+}
--- a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-vkcapture";
-  version = "1.1.3";
+  version = "1.1.4";

  src = fetchFromGitHub {
    owner = "nowrep";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-iIV9ke2yPEt2Lf4bwiEHFip4tLhMS4raWGyCWpao74w=";
+    hash = "sha256-jY78+sfAd62YnCssosLOLfxmdL6zkTEoeE58bQpswG4=";
  };

  nativeBuildInputs = [ cmake ninja ];
@ -30,6 +30,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/nowrep/obs-vkcapture";
    maintainers = with maintainers; [ atila ];
    license = licenses.gpl2Only;
-    platforms = [ "x86_64-linux" "i686-linux" ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/virtualization/crosvm/Cargo.lock
+++ b/pkgs/applications/virtualization/crosvm/Cargo.lock
--- a/pkgs/applications/virtualization/crosvm/default-seccomp-policy-dir.diff
+++ b/pkgs/applications/virtualization/crosvm/default-seccomp-policy-dir.diff
@ -1,15 +1,15 @@
-diff --git a/src/crosvm.rs b/src/crosvm.rs
-index b7055df..5989c87 100644
--- a/src/crosvm.rs
-+++ b/src/crosvm.rs
-@@ -141,7 +141,9 @@ impl Default for Config {
-             x_display: None,
-             shared_dirs: Vec::new(),
-             sandbox: !cfg!(feature = "default-no-sandbox"),
+diff --git i/src/crosvm.rs w/src/crosvm.rs
+index ab7c466b..636dc140 100644
+--- i/src/crosvm.rs
+++ w/src/crosvm.rs
+@@ -345,7 +345,9 @@ impl Default for JailConfig {
+     fn default() -> Self {
+         JailConfig {
+             pivot_root: PathBuf::from(option_env!("DEFAULT_PIVOT_ROOT").unwrap_or("/var/empty")),
 -            seccomp_policy_dir: PathBuf::from(SECCOMP_POLICY_DIR),
 +            seccomp_policy_dir: PathBuf::from(
 +                option_env!("DEFAULT_SECCOMP_POLICY_DIR").unwrap_or(SECCOMP_POLICY_DIR),
 +            ),
             seccomp_log_failures: false,
-             cras_audio: false,
-             cras_capture: false,
+         }
+     }
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@ -55,7 +55,7 @@ in

    meta = with lib; {
      description = "A secure virtual machine monitor for KVM";
-      homepage = "https://chromium.googlesource.com/chromiumos/platform/crosvm/";
+      homepage = "https://chromium.googlesource.com/crosvm/crosvm/";
      maintainers = with maintainers; [ qyliss ];
      license = licenses.bsd3;
      platforms = [ "aarch64-linux" "x86_64-linux" ];
--- a/pkgs/applications/virtualization/crosvm/update.py
+++ b/pkgs/applications/virtualization/crosvm/update.py
@ -1,23 +1,15 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -p nix-prefetch-git "python3.withPackages (ps: with ps; [ lxml ])"
+#! nix-shell -p nix-prefetch-git python3
 #! nix-shell -i python

-import base64
+import csv
 import json
 import re
 import shlex
 import subprocess
-from codecs import iterdecode
 from os.path import abspath, dirname, splitext
-from lxml import etree
-from lxml.etree import HTMLParser
 from urllib.request import urlopen

-git_path = 'chromiumos/platform/crosvm'
-git_root = 'https://chromium.googlesource.com/'
-manifest_versions = f'{git_root}chromiumos/manifest-versions'
-buildspecs_url = f'{manifest_versions}/+/refs/heads/master/full/buildspecs/'
-
 # CrOS version numbers look like this:
 # [<chrome-major-version>.]<tip-build>.<branch-build>.<branch-branch-build>
 #
@ -26,50 +18,37 @@ buildspecs_url = f'{manifest_versions}/+/refs/heads/master/full/buildspecs/'
 # branch branches are used for fixes for specific devices.  So for
 # Chromium OS they will always be 0.  This is a best guess, and is not
 # documented.
-with urlopen('https://cros-updates-serving.appspot.com/') as resp:
-    document = etree.parse(resp, HTMLParser())
-    # bgcolor="lightgreen" is set on the most up-to-date version for
-    # each channel, so find a lightgreen cell in the "Stable" column.
-    (platform_version, chrome_version) = document.xpath("""
-        (//table[@id="cros-updates"]/tr/td[1 + count(
-            //table[@id="cros-updates"]/thead/tr[1]/th[text() = "Stable"]
-            /preceding-sibling::*)
-        ][@bgcolor="lightgreen"])[1]/text()
-    """)
+with urlopen('https://chromiumdash.appspot.com/cros/download_serving_builds_csv?deviceCategory=ChromeOS') as resp:
+    reader = csv.reader(map(bytes.decode, resp))
+    header = reader.__next__()
+    cr_stable_index = header.index('cr_stable')
+    cros_stable_index = header.index('cros_stable')
+    chrome_version = []
+    platform_version = []

-chrome_major_version = re.match(r'\d+', chrome_version)[0]
-chromeos_tip_build = re.match(r'\d+', platform_version)[0]
+    for line in reader:
+        this_chrome_version = list(map(int, line[cr_stable_index].split('.')))
+        this_platform_version = list(map(int, line[cros_stable_index].split('.')))
+        chrome_version = max(chrome_version, this_chrome_version)
+        platform_version = max(platform_version, this_platform_version)

-# Find the most recent buildspec for the stable Chrome version and
-# Chromium OS build number.  Its branch build and branch branch build
-# numbers will (almost?) certainly be 0.  It will then end with an rc
-# number -- presumably these are release candidates, one of which
-# becomes the final release.  Presumably the one with the highest rc
-# number.
-with urlopen(f'{buildspecs_url}{chrome_major_version}/?format=TEXT') as resp:
-    listing = base64.decodebytes(resp.read()).decode('utf-8')
-    buildspecs = [(line.split('\t', 1)[1]) for line in listing.splitlines()]
-    buildspecs = [s for s in buildspecs if s.startswith(chromeos_tip_build)]
-    buildspecs.sort(reverse=True)
-    buildspec = splitext(buildspecs[0])[0]
+chrome_major_version = chrome_version[0]
+chromeos_tip_build = platform_version[0]
+release_branch = f'release-R{chrome_major_version}-{chromeos_tip_build}.B-chromeos'

-# Read the buildspec, and extract the git revision.
-with urlopen(f'{buildspecs_url}{chrome_major_version}/{buildspec}.xml?format=TEXT') as resp:
-    xml = base64.decodebytes(resp.read())
-    root = etree.fromstring(xml)
-    revision = root.find(f'./project[@name="{git_path}"]').get('revision')
-
-# Initialize the data that will be output from this script.  Leave the
-# rc number in buildspec so nobody else is subject to the same level
-# of confusion I have been.
-data = {'version': f'{chrome_major_version}.{buildspec}'}
+# Determine the patch version by counting the commits that have been
+# added to the release branch since it forked off the chromeos branch.
+with urlopen(f'https://chromium.googlesource.com/chromiumos/platform/crosvm/+log/refs/heads/chromeos..refs/heads/{release_branch}?format=JSON') as resp:
+    resp.readline() # Remove )]}' header
+    branch_commits = json.load(resp)['log']
+    data = {'version': f'{chrome_major_version}.{len(branch_commits)}'}

 # Fill in the 'src' key with the output from nix-prefetch-git, which
 # can be passed straight to fetchGit when imported by Nix.
 argv = ['nix-prefetch-git',
        '--fetch-submodules',
-        '--url', git_root + git_path,
-        '--rev', revision]
+        '--url', 'https://chromium.googlesource.com/crosvm/crosvm',
+        '--rev', f'refs/heads/{release_branch}']
 output = subprocess.check_output(argv)
 data['src'] = json.loads(output.decode('utf-8'))

--- a/pkgs/applications/virtualization/crosvm/upstream-info.json
+++ b/pkgs/applications/virtualization/crosvm/upstream-info.json
@ -1,11 +1,11 @@
 {
-  "version": "100.14526.0.0-rc1",
+  "version": "103.3",
  "src": {
-    "url": "https://chromium.googlesource.com/chromiumos/platform/crosvm",
-    "rev": "bdf5e4d4379030cfa2d0510328b8acce73162217",
-    "date": "2022-02-14T19:13:41+00:00",
-    "path": "/nix/store/xw31chiwnpzgcp07nf448g2npcwiwkkm-crosvm-bdf5e4d",
-    "sha256": "0mrnjyyqmz24z1yvdq2mysmhmz0577k8kf9y4v51g7860crqp9ji",
+    "url": "https://chromium.googlesource.com/crosvm/crosvm",
+    "rev": "e7db3a5cc78ca90ab06aadd5f08bb151090269b6",
+    "date": "2022-06-01T00:13:12+00:00",
+    "path": "/nix/store/r08jyffmjdq38f8yy57v8wgfjiil6586-crosvm",
+    "sha256": "0hyz0mg5fn6hi97awfpxfykgv68m935r037sdf85v3vcwjy5n5ki",
    "fetchLFS": false,
    "fetchSubmodules": true,
    "deepClone": false,
--- a/pkgs/applications/window-managers/i3/lock.nix
+++ b/pkgs/applications/window-managers/i3/lock.nix
@ -1,26 +1,21 @@
-{ fetchurl, lib, stdenv, which, pkg-config, libxcb, xcbutilkeysyms, xcbutilimage,
+{ stdenv, lib, fetchFromGitHub, meson, ninja, pkg-config, libxcb, xcbutilkeysyms, xcbutilimage,
  xcbutilxrm, pam, libX11, libev, cairo, libxkbcommon, libxkbfile }:

 stdenv.mkDerivation rec {
  pname = "i3lock";
-  version = "2.13";
+  version = "2.14.1";

-  src = fetchurl {
-    url = "https://i3wm.org/i3lock/${pname}-${version}.tar.bz2";
-    sha256 = "02szjsaz7rqrdkd0r2nwgwa85c4hwfrcskxw7ryk695kmjcfhzv3";
+  src = fetchFromGitHub {
+    owner = "i3";
+    repo = "i3lock";
+    rev = version;
+    sha256 = "sha256-cC908c47fkU6msLqZSxpEbKxO1/PatH81QeuCzBSZGw=";
  };

-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ which libxcb xcbutilkeysyms xcbutilimage xcbutilxrm
+  nativeBuildInputs = [ meson ninja pkg-config ];
+  buildInputs = [ libxcb xcbutilkeysyms xcbutilimage xcbutilxrm
    pam libX11 libev cairo libxkbcommon libxkbfile ];

-  makeFlags = [ "all" ];
-  installFlags = [ "PREFIX=\${out}" "SYSCONFDIR=\${out}/etc" ];
-  postInstall = ''
-    mkdir -p $out/share/man/man1
-    cp *.1 $out/share/man/man1
-  '';
-
  meta = with lib; {
    description = "A simple screen locker like slock";
    longDescription = ''
--- a/pkgs/build-support/make-pkgconfigitem/default.nix
+++ b/pkgs/build-support/make-pkgconfigitem/default.nix
@ -0,0 +1,69 @@
+{ lib, writeTextFile, buildPackages }:
+
+# See https://people.freedesktop.org/~dbn/pkg-config-guide.html#concepts
+{ name # The name of the pc file
+  # keywords
+  # provide a default description for convenience. it's not important but still required by pkg-config.
+, description ? "A pkg-config file for ${name}"
+, url ? ""
+, version ? ""
+, requires ? [ ]
+, requiresPrivate ? [ ]
+, conflicts ? [ ]
+, cflags ? [ ]
+, libs ? [ ]
+, libsPrivate ? [ ]
+, variables ? { }
+}:
+
+let
+  # only 'out' has to be changed, otherwise it would be replaced by the out of the writeTextFile
+  placeholderToSubstVar = builtins.replaceStrings [ "${placeholder "out"}" ] [ "@out@" ];
+
+  replacePlaceholderAndListToString = x:
+    if builtins.isList x
+    then placeholderToSubstVar (builtins.concatStringsSep " " x)
+    else placeholderToSubstVar x;
+
+  keywordsSection =
+    let
+      mustBeAList = attr: attrName: lib.throwIfNot (lib.isList attr) "'${attrName}' must be a list" attr;
+    in
+    {
+      "Name" = name;
+      "Description" = description;
+      "URL" = url;
+      "Version" = version;
+      "Requires" = mustBeAList requires "requires";
+      "Requires.private" = mustBeAList requiresPrivate "requiresPrivate";
+      "Conflicts" = mustBeAList conflicts "conflicts";
+      "Cflags" = mustBeAList cflags "cflags";
+      "Libs" = mustBeAList libs "libs";
+      "Libs.private" = mustBeAList libsPrivate "libsPrivate";
+    };
+
+  renderVariable = name: value:
+    lib.optionalString (value != "" && value != [ ]) "${name}=${replacePlaceholderAndListToString value}";
+  renderKeyword = name: value:
+    lib.optionalString (value != "" && value != [ ]) "${name}: ${replacePlaceholderAndListToString value}";
+
+  renderSomething = renderFunc: attrs:
+    lib.pipe attrs [
+      (lib.mapAttrsToList renderFunc)
+      (builtins.filter (v: v != ""))
+      (builtins.concatStringsSep "\n")
+      (section: ''${section}
+      '')
+    ];
+
+  variablesSectionRendered = renderSomething renderVariable variables;
+  keywordsSectionRendered = renderSomething renderKeyword keywordsSection;
+
+  content = [ variablesSectionRendered keywordsSectionRendered ];
+in
+writeTextFile {
+  name = "${name}.pc";
+  destination = "/lib/pkgconfig/${name}.pc";
+  text = builtins.concatStringsSep "\n" content;
+  checkPhase = ''${buildPackages.pkg-config}/bin/pkg-config --validate "$target"'';
+}
--- a/pkgs/build-support/setup-hooks/copy-pkgconfig-items.sh
+++ b/pkgs/build-support/setup-hooks/copy-pkgconfig-items.sh
@ -0,0 +1,46 @@
+# shellcheck shell=bash
+
+# Setup hook that installs specified pkgconfig items.
+#
+# Example usage in a derivation:
+#
+#   { …, makePkgconfigItem, copyPkgconfigItems, … }:
+#
+#   let pkgconfigItem = makePkgconfigItem { … }; in
+#   stdenv.mkDerivation {
+#     …
+#     nativeBuildInputs = [ copyPkgconfigItems ];
+#
+#     pkgconfigItems =  [ pkgconfigItem ];
+#     …
+#   }
+#
+# This hook will copy files which are either given by full path
+# or all '*.pc' files placed inside the 'lib/pkgconfig'
+# folder of each `pkgconfigItems` argument.
+
+postInstallHooks+=(copyPkgconfigItems)
+
+copyPkgconfigItems() {
+    if [ "${dontCopyPkgconfigItems-}" = 1 ]; then return; fi
+
+    if [ -z "$pkgconfigItems" ]; then
+        return
+    fi
+
+    pkgconfigdir="${!outputDev}/lib/pkgconfig"
+    for pkgconfigItem in $pkgconfigItems; do
+        if [[ -f "$pkgconfigItem" ]]; then
+            substituteAllInPlace "$pkgconfigItem"
+            echo "Copying '$pkgconfigItem' into '${pkgconfigdir}'"
+            install -D -m 444 -t "${pkgconfigdir}" "$pkgconfigItem"
+            substituteAllInPlace "${pkgconfigdir}"/*
+        else
+            for f in "$pkgconfigItem"/lib/pkgconfig/*.pc; do
+                echo "Copying '$f' into '${pkgconfigdir}'"
+                install -D -m 444 -t "${pkgconfigdir}" "$f"
+                substituteAllInPlace "${pkgconfigdir}"/*
+            done
+        fi
+    done
+}
--- a/pkgs/desktops/gnome/extensions/extensions.json
+++ b/pkgs/desktops/gnome/extensions/extensions.json
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@ -1,6 +1,8 @@
 { lib
 , stdenv
 , fetchFromRepoOrCz
+, copyPkgconfigItems
+, makePkgconfigItem
 , perl
 , texinfo
 , which
@ -17,11 +19,32 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
+    copyPkgconfigItems
    perl
    texinfo
    which
  ];

+  pkgconfigItems = [
+    (makePkgconfigItem rec {
+      name = "libtcc";
+      inherit version;
+      cflags = [ "-I${variables.includedir}" ];
+      libs = [
+        "-L${variables.libdir}"
+        "-Wl,--rpath ${variables.libdir}"
+        "-ltcc"
+        "-ldl"
+      ];
+      variables = rec {
+        prefix = "${placeholder "out"}";
+        includedir = "${prefix}/include";
+        libdir = "${prefix}/lib";
+      };
+      description = "Tiny C compiler backend";
+    })
+  ];
+
  postPatch = ''
    patchShebangs texi2pod.pl
  '';
@ -43,17 +66,6 @@ stdenv.mkDerivation rec {
    configureFlagsArray+=("--elfinterp=$(< $NIX_CC/nix-support/dynamic-linker)")
  '';

-  postFixup = ''
-    cat >libtcc.pc <<EOF
-    Name: libtcc
-    Description: Tiny C compiler backend
-    Version: ${version}
-    Libs: -L$out/lib -Wl,--rpath $out/lib -ltcc -ldl
-    Cflags: -I$out/include
-    EOF
-    install -Dt $out/lib/pkgconfig libtcc.pc -m 444
-  '';
-
  outputs = [ "out" "info" "man" ];

  doCheck = true;
--- a/pkgs/development/libraries/cxx-rs/Cargo.lock
+++ b/pkgs/development/libraries/cxx-rs/Cargo.lock
@ -0,0 +1,445 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cc"
+version = "1.0.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+dependencies = [
+ "jobserver",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clang-ast"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c380e0de48337007dfc91b09eb75f567f5f08209437857fbaabbaf2e77e830"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "clap"
+version = "3.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54635806b078b7925d6e36810b1755f2a4b5b4d57560432c1ecf60bcbe10602b"
+dependencies = [
+ "bitflags",
+ "clap_lex",
+ "indexmap",
+ "strsim",
+ "textwrap",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "codespan-reporting"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e"
+dependencies = [
+ "termcolor",
+ "unicode-width",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "cxx"
+version = "1.0.72"
+dependencies = [
+ "cc",
+ "cxx-build",
+ "cxx-gen",
+ "cxx-test-suite",
+ "cxxbridge-flags",
+ "cxxbridge-macro",
+ "link-cplusplus",
+ "rustversion",
+ "trybuild",
+]
+
+[[package]]
+name = "cxx-build"
+version = "1.0.72"
+dependencies = [
+ "cc",
+ "codespan-reporting",
+ "cxx-gen",
+ "once_cell",
+ "pkg-config",
+ "proc-macro2",
+ "quote",
+ "scratch",
+ "syn",
+]
+
+[[package]]
+name = "cxx-gen"
+version = "0.7.72"
+dependencies = [
+ "codespan-reporting",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "cxx-test-suite"
+version = "0.0.0"
+dependencies = [
+ "cxx",
+ "cxx-build",
+ "cxxbridge-flags",
+]
+
+[[package]]
+name = "cxxbridge-cmd"
+version = "1.0.72"
+dependencies = [
+ "clap",
+ "codespan-reporting",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "cxxbridge-flags"
+version = "1.0.72"
+
+[[package]]
+name = "cxxbridge-macro"
+version = "1.0.72"
+dependencies = [
+ "clang-ast",
+ "cxx",
+ "flate2",
+ "memmap",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "syn",
+]
+
+[[package]]
+name = "demo"
+version = "0.0.0"
+dependencies = [
+ "cxx",
+ "cxx-build",
+]
+
+[[package]]
+name = "dissimilar"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c97b9233581d84b8e1e689cdd3a47b6f69770084fc246e86a7f78b0d9c1d4a5"
+
+[[package]]
+name = "flate2"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f82b0f4c27ad9f8bfd1f3208d882da2b09c301bc1c828fd3a00d0216d2fbbff6"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "indexmap"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a35a97730320ffe8e2d410b5d3b69279b98d2c14bdb8b70ea89ecf7888d41e"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112c678d4050afce233f4f2852bb2eb519230b3cf12f33585275537d7e41578d"
+
+[[package]]
+name = "jobserver"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af25a77299a7f711a01975c35a6a424eb6862092cc2d6c72c4ed6cbc56dfc1fa"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349d5a591cd28b49e1d1037471617a32ddcda5731b99419008085f72d5a53836"
+
+[[package]]
+name = "link-cplusplus"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8cae2cd7ba2f3f63938b9c724475dfb7b9861b545a90324476324ed21dbc8c8"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "memmap"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6585fd95e7bb50d6cc31e20d4cf9afb4e2ba16c5846fc76793f11218da9c475b"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f5c75688da582b8ffc1f1799e9db273f32133c49e048f614d22ec3256773ccc"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18a6dbe30758c9f83eb00cbea4ac95966305f5a7772f3f42ebfc7fc7eddbd8e1"
+
+[[package]]
+name = "os_str_bytes"
+version = "6.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "648001efe5d5c0102d8cea768e348da85d90af8ba91f0bea908f157951493cd4"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1df8c4ec4b0627e53bdf214615ad287367e482558cf84b109250b37464dc03ae"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd96a1e8ed2596c337f8eae5f24924ec83f5ad5ab21ea8e455d3566c69fbcaf7"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bcdf212e9776fbcb2d23ab029360416bb1706b1aea2d1a5ba002727cbcab804"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24c8ad4f0c00e1eb5bc7614d236a7f1300e3dbd76b68cac8e06fb00b015ad8d8"
+
+[[package]]
+name = "ryu"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3f6f92acf49d1b98f7a81226834412ada05458b7364277387724a237f062695"
+
+[[package]]
+name = "scratch"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96311ef4a16462c757bb6a39152c40f58f31cd2602a40fceb937e2bc34e6cbab"
+
+[[package]]
+name = "serde"
+version = "1.0.140"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc855a42c7967b7c369eb5860f7164ef1f6f81c20c7cc1141f2a604e18723b03"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.140"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f2122636b9fe3b81f1cb25099fcf2d3f542cdb1d45940d56c713158884a05da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82c2c1fdcd807d1098552c5b9a36e425e42e9fbd7c6a37a8425f390f781f7fa7"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "syn"
+version = "1.0.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c50aef8a904de4c23c788f104b7dddc7d6f79c647c7c8ce4cc8f73eb0ca773dd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1141d4d61095b28419e22cb0bbf02755f5e54e0526f97f1e3d1d160e60885fb"
+
+[[package]]
+name = "toml"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d82e1a7758622a465f8cee077614c73484dac5b836c02ff6a40d5d1010324d7"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "trybuild"
+version = "1.0.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "764b9e244b482a9b81bde596aa37aa6f1347bf8007adab25e59f901b32b4e0a0"
+dependencies = [
+ "dissimilar",
+ "glob",
+ "once_cell",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "termcolor",
+ "toml",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15c61ba63f9235225a22310255a29b806b907c9b8c964bcbd0a2c70f3f2deea7"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
--- a/pkgs/development/libraries/cxx-rs/default.nix
+++ b/pkgs/development/libraries/cxx-rs/default.nix
@ -0,0 +1,54 @@
+{ cxx-rs, fetchFromGitHub, lib, rustPlatform, testers }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cxx-rs";
+  version = "1.0.72";
+
+  src = fetchFromGitHub {
+    owner = "dtolnay";
+    repo = "cxx";
+    rev = version;
+    sha256 = "sha256-+OumeLSgz8kLQKhEc3icCk1q+X+S7Xt+XtAlkx8iguU=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+  '';
+
+  cargoBuildFlags = [
+    "--workspace"
+    "--exclude=demo"
+  ];
+
+  postBuild = ''
+    cargo doc --release
+  '';
+
+  cargoTestFlags = [ "--workspace" ];
+
+  outputs = [ "out" "doc" "dev" ];
+
+  postInstall = ''
+    mkdir -p $doc
+    cp -r ./target/doc/* $doc
+
+    mkdir -p $dev/include/rust
+    install -D -m 0644 ./include/cxx.h $dev/include/rust
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = cxx-rs;
+    command = "cxxbridge --version";
+  };
+
+  meta = with lib; {
+    description = "Safe FFI between Rust and C++";
+    homepage = "https://github.com/dtolnay/cxx";
+    license = licenses.mit;
+    maintainers = with maintainers; [ centromere ];
+  };
+}
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -239,6 +239,7 @@ stdenv.mkDerivation rec {
    '';
    license = licenses.gpl3;
    maintainers = with maintainers; [ ];
+    platforms = platforms.all;
    inherit branch knownVulnerabilities;
  };
 }
--- a/pkgs/development/libraries/libbsd/darwin.patch
+++ b/pkgs/development/libraries/libbsd/darwin.patch
@ -1,8 +1,8 @@
-diff --git c/configure.ac w/configure.ac
-index 09cb310..30c0e2a 100644
--- c/configure.ac
-+++ w/configure.ac
-@@ -110,7 +110,7 @@ AS_CASE([$host_os],
+diff --git a/configure.ac b/configure.ac
+index 5b6d22b..98c449b 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -145,7 +145,7 @@ AS_CASE([$host_os],
 AM_CONDITIONAL([OS_WINDOWS], [test "x$is_windows" = "xyes"])
 
 # Checks for header files.
@ -11,20 +11,51 @@ index 09cb310..30c0e2a 100644
 
 # Checks for typedefs, structures, and compiler characteristics.
 AC_C_INLINE
-@@ -210,7 +210,8 @@ AC_LINK_IFELSE(
+@@ -245,7 +245,9 @@ AC_LINK_IFELSE(
 
 AC_CHECK_FUNCS([clearenv dirfd fopencookie __fpurge \
                 getauxval getentropy getexecname getline \
 -                pstat_getproc sysconf])
 +                pstat_getproc sysconf \
-+		strlcpy strlcat strnstr strmode fpurge])
+		strlcpy strlcat strnstr strmode fpurge \
+		user_from_uid group_from_gid])
 AM_CONDITIONAL([HAVE_GETENTROPY], [test "x$ac_cv_func_getentropy" = "xtrue"])
 
- AC_SUBST([LIBBSD_LIBS])
-diff --git c/include/bsd/string.h w/include/bsd/string.h
+ AC_SUBST([MD5_LIBS])
+diff --git a/include/bsd/grp.h b/include/bsd/grp.h
+index b2705e5..c9423a2 100644
+--- a/include/bsd/grp.h
+++ b/include/bsd/grp.h
+@@ -44,8 +44,10 @@
+ __BEGIN_DECLS
+ int
+ gid_from_group(const char *, gid_t *);
+#if !HAVE_GROUP_FROM_GID
+ const char *
+ group_from_gid(gid_t, int);
+#endif
+ __END_DECLS
+ 
+ #endif
+diff --git a/include/bsd/pwd.h b/include/bsd/pwd.h
+index 798af4b..6ae5244 100644
+--- a/include/bsd/pwd.h
+++ b/include/bsd/pwd.h
+@@ -44,8 +44,10 @@
+ __BEGIN_DECLS
+ int
+ uid_from_user(const char *, uid_t *);
+#if !HAVE_USER_FROM_UID
+ const char *
+ user_from_uid(uid_t, int);
+#endif
+ __END_DECLS
+ 
+ #endif
+diff --git a/include/bsd/string.h b/include/bsd/string.h
 index f987fee..a1e17ed 100644
--- c/include/bsd/string.h
-+++ w/include/bsd/string.h
+--- a/include/bsd/string.h
+++ b/include/bsd/string.h
@@ -41,10 +41,21 @@
 #include <sys/types.h>
 
@ -47,10 +78,10 @@ index f987fee..a1e17ed 100644
 
 #if !defined(__GLIBC__) || \
     (defined(__GLIBC__) && (!__GLIBC_PREREQ(2, 25) || !defined(_GNU_SOURCE)))
-diff --git c/src/fpurge.c w/src/fpurge.c
-index 462535a..a8941db 100644
--- c/src/fpurge.c
-+++ w/src/fpurge.c
+diff --git a/src/fpurge.c b/src/fpurge.c
+index 350f364..ff7f01e 100644
+--- a/src/fpurge.c
+++ b/src/fpurge.c
@@ -26,9 +26,10 @@
 
 #include <errno.h>
@ -100,10 +131,10 @@ index 462535a..a8941db 100644
 #else
 #error "Function fpurge() needs to be ported."
 #endif
-diff --git c/src/funopen.c w/src/funopen.c
+diff --git a/src/funopen.c b/src/funopen.c
 index 1e6f43a..3a3af6a 100644
--- c/src/funopen.c
-+++ w/src/funopen.c
+--- a/src/funopen.c
+++ b/src/funopen.c
@@ -143,6 +143,7 @@ funopen(const void *cookie,
  * they will not add the needed support to implement it. Just ignore this
  * interface there, as it has never been provided anyway.
@ -112,31 +143,32 @@ index 1e6f43a..3a3af6a 100644
 #else
 #error "Function funopen() needs to be ported or disabled."
 #endif
-diff --git c/src/local-link.h w/src/local-link.h
-index 0d4351a..fc520af 100644
--- c/src/local-link.h
-+++ w/src/local-link.h
-@@ -27,6 +27,11 @@
- #ifndef LIBBSD_LOCAL_LINK_H
- #define LIBBSD_LOCAL_LINK_H
+diff --git a/src/local-link.h b/src/local-link.h
+index 6782d9a..fb76098 100644
+--- a/src/local-link.h
+++ b/src/local-link.h
+@@ -29,6 +29,12 @@
+ 
+ #include <sys/cdefs.h>
 
 +#ifdef __MACH__
 +#define libbsd_link_warning(symbol, msg)
 +#define libbsd_symver_default(alias, symbol, version)
 +#define libbsd_symver_variant(alias, symbol, version)
+#define libbsd_symver_weak(alias, symbol, version)
 +#else
 #define libbsd_link_warning(symbol, msg) \
 	static const char libbsd_emit_link_warning_##symbol[] \
- 		__attribute__((__used__,__section__(".gnu.warning." #symbol))) = msg;
-@@ -45,3 +50,4 @@
+ 		__attribute__((__used__,__section__(".gnu.warning." #symbol))) = msg
+@@ -68,3 +74,4 @@
 #endif
 
 #endif
 +#endif
-diff --git c/src/nlist.c w/src/nlist.c
-index d22fa19..f41333f 100644
--- c/src/nlist.c
-+++ w/src/nlist.c
+diff --git a/src/nlist.c b/src/nlist.c
+index 1cb9d18..b476f1e 100644
+--- a/src/nlist.c
+++ b/src/nlist.c
@@ -41,6 +41,7 @@
 #include <unistd.h>
 #include <nlist.h>
@ -144,16 +176,46 @@ index d22fa19..f41333f 100644
 +#if !HAVE_NLIST_H
 #include "local-elf.h"
 
- #ifndef SIZE_T_MAX
-@@ -282,3 +283,4 @@ nlist(const char *name, struct nlist *list)
+ /* Note: This function is used by libkvm0, so we need to export it.
+@@ -277,3 +278,4 @@ nlist(const char *name, struct nlist *list)
 	(void)close(fd);
 	return (n);
 }
 +#endif
-diff --git c/src/readpassphrase.c w/src/readpassphrase.c
+diff --git a/src/pwcache.c b/src/pwcache.c
+index d54daa0..74fde9f 100644
+--- a/src/pwcache.c
+++ b/src/pwcache.c
+@@ -191,6 +191,7 @@ grptb_start(void)
+ 	return 0;
+ }
+ 
+#if !HAVE_USER_FROM_UID
+ /*
+  * user_from_uid()
+  *	caches the name (if any) for the uid. If noname clear, we always
+@@ -251,7 +252,9 @@ user_from_uid(uid_t uid, int noname)
+ 	}
+ 	return ptr->name;
+ }
+#endif
+ 
+#if !HAVE_USER_FROM_UID
+ /*
+  * group_from_gid()
+  *	caches the name (if any) for the gid. If noname clear, we always
+@@ -312,6 +315,7 @@ group_from_gid(gid_t gid, int noname)
+ 	}
+ 	return ptr->name;
+ }
+#endif
+ 
+ /*
+  * uid_from_user()
+diff --git a/src/readpassphrase.c b/src/readpassphrase.c
 index f9f6195..2bc5fb4 100644
--- c/src/readpassphrase.c
-+++ w/src/readpassphrase.c
+--- a/src/readpassphrase.c
+++ b/src/readpassphrase.c
@@ -36,6 +36,14 @@
 #define TCSASOFT 0
 #endif
@ -169,10 +231,10 @@ index f9f6195..2bc5fb4 100644
 static volatile sig_atomic_t signo[_NSIG];
 
 static void handler(int);
-diff --git c/src/setproctitle.c w/src/setproctitle.c
-index ff32aa3..51ed833 100644
--- c/src/setproctitle.c
-+++ w/src/setproctitle.c
+diff --git a/src/setproctitle.c b/src/setproctitle.c
+index d3e1087..0e5f64c 100644
+--- a/src/setproctitle.c
+++ b/src/setproctitle.c
@@ -33,6 +33,10 @@
 #include <string.h>
 #include "local-link.h"
@ -184,7 +246,7 @@ index ff32aa3..51ed833 100644
 static struct {
 	/* Original value. */
 	const char *arg0;
-@@ -287,7 +291,8 @@ libbsd_symver_default(setproctitle, setproctitle_impl, LIBBSD_0.5);
+@@ -291,7 +295,8 @@ libbsd_symver_default(setproctitle, setproctitle_impl, LIBBSD_0.5);
  * in 0.5, make the implementation available in the old version as an alias
  * for code linking against that version, and change the default to use the
  * new version, so that new code depends on the implemented version. */
@ -194,10 +256,10 @@ index ff32aa3..51ed833 100644
 extern __typeof__(setproctitle_impl)
 setproctitle_stub
 	__attribute__((__alias__("setproctitle_impl")));
-diff --git c/src/strlcat.c w/src/strlcat.c
+diff --git a/src/strlcat.c b/src/strlcat.c
 index 14c53a1..5961c17 100644
--- c/src/strlcat.c
-+++ w/src/strlcat.c
+--- a/src/strlcat.c
+++ b/src/strlcat.c
@@ -26,6 +26,7 @@
  * Returns strlen(src) + MIN(dsize, strlen(initial dst)).
  * If retval >= dsize, truncation occurred.
@ -211,10 +273,10 @@ index 14c53a1..5961c17 100644
 	return(dlen + (src - osrc));	/* count does not include NUL */
 }
 +#endif
-diff --git c/src/strlcpy.c w/src/strlcpy.c
+diff --git a/src/strlcpy.c b/src/strlcpy.c
 index e9a7fe4..5137acb 100644
--- c/src/strlcpy.c
-+++ w/src/strlcpy.c
+--- a/src/strlcpy.c
+++ b/src/strlcpy.c
@@ -24,6 +24,7 @@
  * chars will be copied.  Always NUL terminates (unless dsize == 0).
  * Returns strlen(src); if retval >= dsize, truncation occurred.
@ -228,10 +290,10 @@ index e9a7fe4..5137acb 100644
 	return(src - osrc - 1);	/* count does not include NUL */
 }
 +#endif
-diff --git c/src/strmode.c w/src/strmode.c
+diff --git a/src/strmode.c b/src/strmode.c
 index e6afde5..da680c9 100644
--- c/src/strmode.c
-+++ w/src/strmode.c
+--- a/src/strmode.c
+++ b/src/strmode.c
@@ -32,6 +32,7 @@
 #include <sys/stat.h>
 #include <string.h>
--- a/pkgs/development/libraries/libproxy/default.nix
+++ b/pkgs/development/libraries/libproxy/default.nix
@ -5,8 +5,8 @@
 , zlib
 , dbus
 , networkmanager
-, enableJavaScript ? stdenv.isDarwin || lib.meta.availableOn stdenv.hostPlatform spidermonkey_78
-, spidermonkey_78
+, enableJavaScript ? stdenv.isDarwin || lib.meta.availableOn stdenv.hostPlatform duktape
+, duktape
 , pcre
 , gsettings-desktop-schemas
 , glib
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "libproxy";
-  version = "0.4.17";
+  version = "0.4.18";

  src = fetchFromGitHub {
    owner = "libproxy";
    repo = "libproxy";
    rev = version;
-    sha256 = "0v8q4ln0pd5231kidpi8wpwh0chcjwcmawcki53czlpdrc09z96r";
+    hash = "sha256-pqj1LwRdOK2CUu3hYIsogQIXxWzShDuKEbDTbtWkgnQ=";
  };

  outputs = [ "out" "dev" "py3" ];
@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
    python3
    zlib
  ] ++ lib.optionals enableJavaScript [
-    (if stdenv.hostPlatform.isDarwin then JavaScriptCore else spidermonkey_78)
+    (if stdenv.hostPlatform.isDarwin then JavaScriptCore else duktape)
  ] ++ (if stdenv.hostPlatform.isDarwin then [
    SystemConfiguration
    CoreFoundation
--- a/pkgs/development/libraries/science/math/arpack/default.nix
+++ b/pkgs/development/libraries/science/math/arpack/default.nix
@ -45,6 +45,10 @@ stdenv.mkDerivation rec {
    install_name_tool -change libblas.dylib ${blas}/lib/libblas.dylib $out/lib/libarpack.dylib
  '';

+  # disable stackprotector on aarch64-darwin for now
+  # https://github.com/NixOS/nixpkgs/issues/127608
+  hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
+
  meta = {
    homepage = "https://github.com/opencollab/arpack-ng";
    description = ''
--- a/pkgs/development/libraries/stb/default.nix
+++ b/pkgs/development/libraries/stb/default.nix
@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, copyPkgconfigItems, makePkgconfigItem }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "stb";
  version = "unstable-2021-09-10";

@ -11,11 +11,28 @@ stdenv.mkDerivation {
    sha256 = "0qq35cd747lll4s7bmnxb3pqvyp2hgcr9kyf758fax9lx76iwjhr";
  };

+  nativeBuildInputs = [ copyPkgconfigItems ];
+
+  pkgconfigItems = [
+    (makePkgconfigItem rec {
+      name = "stb";
+      version = "1";
+      cflags = [ "-I${variables.includedir}/stb" ];
+      variables = rec {
+        prefix = "${placeholder "out"}";
+        includedir = "${prefix}/include";
+      };
+      inherit (meta) description;
+    })
+  ];
+
  dontBuild = true;

  installPhase = ''
+    runHook preInstall
    mkdir -p $out/include/stb
    cp *.h $out/include/stb/
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "wolfssl";
-  version = "5.3.0";
+  version = "5.4.0";

  src = fetchFromGitHub {
    owner = "wolfSSL";
    repo = "wolfssl";
    rev = "v${version}-stable";
-    sha256 = "sha256-KteArWAgDohlqEYaNfzLPuBn6uy5ABA8vV/LRCVIPGA=";
+    sha256 = "sha256-5a83Mi+S+mASdZ6O2+0I+qulsF6yNUe80a3qZvWmXHw=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/xdg-desktop-portal/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal/default.nix
@ -27,7 +27,7 @@

 stdenv.mkDerivation rec {
  pname = "xdg-desktop-portal";
-  version = "1.14.4";
+  version = "1.14.5";

  outputs = [ "out" "installedTests" ];

@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
    owner = "flatpak";
    repo = pname;
    rev = version;
-    sha256 = "///X0inMi9Znuhjn9n0HlVLa5/kFWpKorKS8RY9WeYM=";
+    sha256 = "sha256-leLCG+ZdQ4zB1LsTN8gZh7yhJ7EZCYYyxwE3hR9vIkM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/cohttp/async.nix
+++ b/pkgs/development/ocaml-modules/cohttp/async.nix
@ -1,6 +1,4 @@
 { lib
-, fetchpatch
-, fetchurl
 , buildDunePackage
 , ppx_sexp_conv
 , base
@ -57,13 +55,6 @@ buildDunePackage {
    core
  ];

-  # Compatibility with core 0.15.  No longer needed after updating cohttp to 5.0.0.
-  patches = fetchpatch {
-    url = "https://github.com/mirage/ocaml-cohttp/commit/5a7124478ed31c6b1fa6a9a50602c2ec839083b5.patch";
-    sha256 = "0i99rl8604xqwb6d0yzk9ws4dflbn0j4hv2nba2qscbqrrn22rw3";
-  };
-  patchFlags = "-p1 -F3";
-
  meta = cohttp.meta // {
    description = "CoHTTP implementation for the Async concurrency library";
  };
--- a/pkgs/development/ocaml-modules/mariadb/default.nix
+++ b/pkgs/development/ocaml-modules/mariadb/default.nix
@ -1,26 +1,32 @@
-{ lib, fetchFromGitHub, buildOasisPackage
+{ lib, fetchurl, stdenv
+, ocaml, findlib, ocamlbuild
 , ctypes, mariadb, libmysqlclient }:

-buildOasisPackage rec {
-  pname = "mariadb";
-  version = "1.1.4";
+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.07")
+  "mariadb is not available for OCaml ${ocaml.version}"

-  minimumOCamlVersion = "4.07.0";
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-mariadb";
+  version = "1.1.6";

-  src = fetchFromGitHub {
-    owner = "andrenth";
-    repo = "ocaml-mariadb";
-    rev = version;
-    sha256 = "1rxqvxr6sv4x2hsi05qm9jz0asaq969m71db4ckl672rcql1kwbr";
+  src = fetchurl {
+    url = "https://github.com/andrenth/ocaml-mariadb/releases/download/${version}/ocaml-mariadb-${version}.tar.gz";
+    sha256 = "sha256-3/C1Gz6luUzS7oaudLlDHMT6JB2v5OdbLVzJhtayHGM=";
  };

+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
  buildInputs = [ mariadb libmysqlclient ];
  propagatedBuildInputs = [ ctypes ];

+  strictDeps = true;
+
+  preInstall = "mkdir -p $OCAMLFIND_DESTDIR/stublibs";
+
  meta = {
    description = "OCaml bindings for MariaDB";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ bcc32 ];
    homepage = "https://github.com/andrenth/ocaml-mariadb";
+    inherit (ocaml.meta) platforms;
  };
 }
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.10";
+  version = "9.2.11";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-l2rnCtzHeK9B/sb8EQUeTRiapE3Dzcysej1zqO0rrV0=";
+    hash = "sha256-hluPbUxkYlbeOsc5uQMXtFjt3wDHq/olUk2SKHPAlVU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -46,7 +46,7 @@ in

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.10";
+  version = "9.2.11";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -55,7 +55,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-GkNpcYY9BEdLlWWOZQt2Ahdp8474RGbvV4UWTdBTKjc=";
+    hash = "sha256-IUuTiRDkQanzcw4iATw5rScl3hoLN/lbHRyflfPyGUc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.10";
+  version = "9.2.11";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-pd7QnJr+XXx+seGDlaLKBIew0Ldcnfsf7d1DgxZFREM=";
+    hash = "sha256-ep0mEOhNe/58l4kYFJIHu/c7wKgnBA0mY0/QAw0EdKM=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.10";
+  version = "9.2.11";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-viQC8FgZ/La3fdlBcFd3Lm+YiiPzNyxw41caRfZU0/I=";
+    hash = "sha256-FNlvmXL4Ko2xnML+h1bVhS/62z6BgJbgyQ2UhcDkB+Y=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -15,7 +15,7 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.10";
+  version = "9.2.11";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
@ -37,7 +37,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-2B+yeQAWVTECW5M4/GFF4wvw3q6y/I6QQC+pYkUObN0=";
+    hash = "sha256-3brrNU3dPID336SGa2vTMHQOqEcoiCmyr+5ol14yDgc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dvc-objects/default.nix
+++ b/pkgs/development/python-modules/dvc-objects/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "dvc-objects";
-  version = "0.0.26";
+  version = "0.1.1";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-g2oKxPQogdfS544fYgKBAxvmJgU35A0ewsPQcX1XOJE=";
+    hash = "sha256-s399GZ/ZuGQcV03NMJMUczEI00m8/xuuFJfzcjuV7T0=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-access-context-manager";
-  version = "0.1.12";
+  version = "0.1.13";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-OHTuAh8JsKnK9sDkXZbx/P9ElrQRSCGBk83wuhL8qEg=";
+    hash = "sha256-AnWAJyvLU4vurVv9uJvi2fkl0Sk1nCK5iNxSplxflHs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@ -14,11 +14,11 @@

 buildPythonPackage rec {
  pname = "google-cloud-spanner";
-  version = "3.16.0";
+  version = "3.17.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-vkjAkxpk50zFVbhvdN76U5n6KbrTXilughac73La9yM=";
+    sha256 = "sha256-OSMlbvkvSzp2xqwPVoe4dfpYn2leox1huqD/WXlXlZk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "identify";
-  version = "2.5.1";
+  version = "2.5.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "pre-commit";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-D66bw014FWGf26rG0e65wg6F/N1bl0z/Uemq+jUxJ74=";
+    sha256 = "sha256-EIr+u8tfvMFLc2A4dIsaMk3ZlpIU5c3FBqyv3mRRfac=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/pivy/default.nix
+++ b/pkgs/development/python-modules/pivy/default.nix
@ -2,13 +2,13 @@

 buildPythonPackage rec {
  pname = "pivy";
-  version = "0.6.6";
+  version = "0.6.7";

  src = fetchFromGitHub {
    owner = "coin3d";
    repo = "pivy";
    rev = version;
-    sha256 = "1xlynrbq22pb252r37r80b3myzap8hzhvknz4zfznfrsg9ykh8k2";
+    sha256 = "mU3QRDJd56gGDWqwcxAN3yUCkAkABP/I9gIBMH2MOXA=";
  };

  dontUseCmakeConfigure = true;
--- a/pkgs/development/python-modules/pydal/default.nix
+++ b/pkgs/development/python-modules/pydal/default.nix
@ -6,12 +6,12 @@

 buildPythonPackage rec {
  pname = "pydal";
-  version = "20220609.1";
+  version = "20220720.1";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-c9cWdQ+V1Phw1cfe5MUif2edXIrFQaDZC9qGBDevedI=";
+    sha256 = "sha256-cKw3thTqQWsTRqJQD9SyaBVBLM9YIqE/y/gIh4FL1bc=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pysigma/default.nix
+++ b/pkgs/development/python-modules/pysigma/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pysigma";
-  version = "0.6.5";
+  version = "0.6.6";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "SigmaHQ";
    repo = "pySigma";
    rev = "refs/tags/v${version}";
-    hash = "sha256-DZ5cnzvcYMiqu8WjIfxQV+1uJeSRGK+nupfWtryoF2E=";
+    hash = "sha256-9t582CuDq7JeCcaPqWZGMUVLx8e78PygfNPp/s7rMA8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pythonix/default.nix
+++ b/pkgs/development/python-modules/pythonix/default.nix
@ -30,7 +30,7 @@ buildPythonPackage rec {
    description = ''
       Eval nix code from python.
    '';
-    maintainers = [ maintainers.mic92 ];
+    maintainers = [ ];
    license = licenses.mit;
  };
 }
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "pyvex";
-  version = "9.2.10";
+  version = "9.2.11";
  format = "pyproject";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-0dUUEhkFedoZLW/HOhJQQgPmfcJbDYtyup4jCZBUhSI=";
+    hash = "sha256-l2lKmgv6FXayX297TH5gwv7vPLTXAneDdVb+mgTERxc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/structlog/default.nix
+++ b/pkgs/development/python-modules/structlog/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "structlog";
-  version = "21.5.0";
+  version = "22.1.0";
  format = "flit";

  src = fetchFromGitHub {
    owner = "hynek";
    repo = "structlog";
-    rev = version;
-    sha256 = "0bc5lj0732j0hjq89llgrncyzs6k3aaffvg07kr3la44w0hlrb4l";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-2sdH6iP+l+6pBNC+sjpAX8bCdCANqqkaqZRmR68uwxY=";
  };

  propagatedBuildInputs = [ six ];
--- a/pkgs/development/tools/metals/default.nix
+++ b/pkgs/development/tools/metals/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "metals";
-  version = "0.11.6";
+  version = "0.11.7";

  deps = stdenv.mkDerivation {
    name = "${pname}-deps-${version}";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    '';
    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash = "sha256-/tFc7xAuUtx2JgEMLhGaq2FXpt7KQNMi82ODr/gTfhM=";
+    outputHash = "sha256-Zc/0kod3JM58WpyxwXiyQdixBHOJV7UDGg1YZtHJ3hw=";
  };

  nativeBuildInputs = [ makeWrapper setJavaClassPath ];
@ -29,23 +29,8 @@ stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out/bin

-    # This variant is not targeted at any particular client, clients are
-    # expected to declare their supported features in initialization options.
    makeWrapper ${jre}/bin/java $out/bin/metals \
      --add-flags "${extraJavaOpts} -cp $CLASSPATH scala.meta.metals.Main"
-
-    # Further variants targeted at clients with featuresets pre-set.
-    makeWrapper ${jre}/bin/java $out/bin/metals-emacs \
-      --add-flags "${extraJavaOpts} -Dmetals.client=emacs -cp $CLASSPATH scala.meta.metals.Main"
-
-    makeWrapper ${jre}/bin/java $out/bin/metals-vim \
-      --add-flags "${extraJavaOpts} -Dmetals.client=coc.nvim -cp $CLASSPATH scala.meta.metals.Main"
-
-    makeWrapper ${jre}/bin/java $out/bin/metals-vim-lsc \
-      --add-flags "${extraJavaOpts} -Dmetals.client=vim-lsc -cp $CLASSPATH scala.meta.metals.Main"
-
-    makeWrapper ${jre}/bin/java $out/bin/metals-sublime \
-      --add-flags "${extraJavaOpts} -Dmetals.client=sublime -cp $CLASSPATH scala.meta.metals.Main"
  '';

  meta = with lib; {
--- a/pkgs/development/tools/rust/cargo-nextest/default.nix
+++ b/pkgs/development/tools/rust/cargo-nextest/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-nextest";
-  version = "0.9.24";
+  version = "0.9.26";

  src = fetchFromGitHub {
    owner = "nextest-rs";
    repo = "nextest";
    rev = "cargo-nextest-${version}";
-    sha256 = "sha256-CGtPftjt09qGbEnI4qGSoRkjMVVTfPHNOzIb4/Hx78g=";
+    sha256 = "sha256-/ij0SOuBJ3nTiv2YZCTTcTluYehkUj7Ks3t5F2mRNcM=";
  };

-  cargoSha256 = "sha256-KAy5BDUrV3Voe3JBDBH2nZVUioRkONFMTdOyPjzx0Sk=";
+  cargoSha256 = "sha256-HeTJKzKVkgxJ/04ry7plKdENdjzC7VpCQwGz5MXXTFY=";

  buildInputs = lib.optionals stdenv.isDarwin [ Security ];

--- a/pkgs/development/tools/rust/sqlx-cli/default.nix
+++ b/pkgs/development/tools/rust/sqlx-cli/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "sqlx-cli";
-  version = "0.5.13";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "launchbadge";
    repo = "sqlx";
    rev = "v${version}";
-    sha256 = "sha256-uUIvzUDDv6WUA25zMhaL2Tn3wHTu/IRgzmnB119BLvk=";
+    sha256 = "sha256-wAPZVDhT6Z8hTOYgbrCGu9uhxNhBLuygAsSpwVGzZxc=";
  };

-  cargoSha256 = "sha256-IHbOuW2FPt2cH0/ld28fp1uBrJadVsJ8izG0JrZy488=";
+  cargoSha256 = "sha256-YUIeph0aacrC4OXb5qcjM5CSvKZEG+gYk6r45urmUeg=";

  doCheck = false;
  cargoBuildFlags = [ "-p sqlx-cli" ];
--- a/pkgs/development/tools/sqlint/Gemfile.lock
+++ b/pkgs/development/tools/sqlint/Gemfile.lock
@ -1,10 +1,10 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    google-protobuf (3.15.6)
-    pg_query (2.0.2)
-      google-protobuf (~> 3.15.5)
-    sqlint (0.2.0)
+    google-protobuf (3.21.2)
+    pg_query (2.1.3)
+      google-protobuf (>= 3.19.2)
+    sqlint (0.2.1)
      pg_query (~> 2)

 PLATFORMS
@ -14,4 +14,4 @@ DEPENDENCIES
  sqlint

 BUNDLED WITH
-   2.1.4
+   2.3.9
--- a/pkgs/development/tools/sqlint/gemset.nix
+++ b/pkgs/development/tools/sqlint/gemset.nix
@ -4,10 +4,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ak5yqqhr04b4x0axzvpw1xzwmxmfcw0gf4r1ijixv15kidhsj3z";
+      sha256 = "1i5g23mjc4fiwymrfkvgcmsym50rapw7vm988fm46rlpg3zijgl1";
      type = "gem";
    };
-    version = "3.15.6";
+    version = "3.21.2";
  };
  pg_query = {
    dependencies = ["google-protobuf"];
@ -15,10 +15,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0bvn0swyzzhl9x8hlgaz7m7s1jqmpdi2c4klarix0hiyapy2il9y";
+      sha256 = "00bhwkhjy6bkp04313m5il7vd165i3fz0x4jissflf66i164ppgk";
      type = "gem";
    };
-    version = "2.0.2";
+    version = "2.1.3";
  };
  sqlint = {
    dependencies = ["pg_query"];
@ -26,9 +26,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ylicsc9x4vpj6ff3hmrm6iz1xswrwwgn1m7ri8nx86ij30w9hkk";
+      sha256 = "1wbsi0ivashmpgavz7j22qns3zcya8j6sd2f9y8hk8bnqx7i3ak0";
      type = "gem";
    };
-    version = "0.2.0";
+    version = "0.2.1";
  };
 }
--- a/pkgs/games/ferium/default.nix
+++ b/pkgs/games/ferium/default.nix
@ -1,19 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, Security }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, Security, installShellFiles }:

 rustPlatform.buildRustPackage rec {
  pname = "ferium";
-  version = "4.1.5";
+  version = "4.1.8";

  src = fetchFromGitHub {
    owner = "gorilla-devs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-NxrV8mi7xsr+x9oOp78DkHoPls0JLm5eol/8q9NwuTs=";
+    sha256 = "sha256-lbzLM/KgknFEaJPs1x92IOJD9MILairCV0qgc/Faooo=";
  };

  buildInputs = lib.optionals stdenv.isDarwin [ Security ];

-  cargoSha256 = "sha256-hR2PKQqSvtSBOOhZKW2IsGGjuU4jCdLMeruAHxErQtU=";
+  cargoSha256 = "sha256-Ra56Go2yReKcEK/rzt07CRekiWUIIDtx+tndw+Txvz4=";

  # Disable the GUI file picker so that GTK/XDG dependencies aren't used
  buildNoDefaultFeatures = true;
@ -21,10 +21,19 @@ rustPlatform.buildRustPackage rec {
  # Requires an internet connection
  doCheck = false;

+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    for shell in bash fish zsh; do
+      $out/bin/ferium complete $shell > ferium.$shell
+      installShellCompletion ferium.$shell
+    done
+  '';
+
  meta = with lib; {
    description = "Fast and multi-source CLI program for managing Minecraft mods and modpacks from Modrinth, CurseForge, and GitHub Releases";
    homepage = "https://github.com/gorilla-devs/ferium";
    license = licenses.mpl20;
-    maintainers = [ maintainers.leo60228 ];
+    maintainers = with maintainers; [ leo60228 imsofi ];
  };
 }
--- a/pkgs/misc/drivers/epson-escpr2/default.nix
+++ b/pkgs/misc/drivers/epson-escpr2/default.nix
@ -2,15 +2,15 @@

 stdenv.mkDerivation rec {
  pname = "epson-inkjet-printer-escpr2";
-  version = "1.1.48";
+  version = "1.1.49";

  src = fetchurl {
    # To find new versions, visit
    # http://download.ebz.epson.net/dsc/search/01/search/?OSC=LX and search for
    # some printer like for instance "WF-7210" to get to the most recent
    # version.
-    url = "https://download3.ebz.epson.net/dsc/f/03/00/13/52/26/977f2b2c13cc185981479fbd225b802c35c92beb/epson-inkjet-printer-escpr2-1.1.48-1lsb3.2.src.rpm";
-    sha256 = "sha256-E+ZZLt7hdXojQkKr0qgdL+UuSZXAESWW9AHIfAX1jK0=";
+    url = "https://download3.ebz.epson.net/dsc/f/03/00/13/76/47/16f624dc1dfad10c3b4eb141c50c651a6360f69a/epson-inkjet-printer-escpr2-1.1.49-1lsb3.2.src.rpm";
+    sha256 = "sha256-WKDOpS7YL7J/IaNQcTjcoyXNXJGOuEexopdhYFubf50=";
  };

  unpackPhase = ''
--- a/pkgs/os-specific/linux/kvdo/default.nix
+++ b/pkgs/os-specific/linux/kvdo/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
    owner = "dm-vdo";
    repo = "kvdo";
    rev = version;
-    sha256 = "1xl7dwcqx00w1gbpb6vlkn8nchyfj1fsc8c06vgda0sgxp7qs5gn";
+    hash = "sha256-4FYTFUIvGjea3bh2GbQYG7hSswVDdNS3S+jWQ9+inpg=";
  };

  dontConfigure = true;
--- a/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/pkgs/os-specific/linux/rtl88x2bu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "rtl88x2bu";
-  version = "${kernel.version}-unstable-2022-02-22";
+  version = "${kernel.version}-unstable-2022-05-23";

  src = fetchFromGitHub {
    owner = "morrownr";
    repo = "88x2bu-20210702";
-    rev = "6a5b7f005c071ffa179b6183ee034c98ed30db80";
-    sha256 = "sha256-BqTyJpICW3D4EfHHoN5svasteJnunu2Uz449u/CmNE0=";
+    rev = "3fbe980a9a8cee223e4671449128212cf7514b3c";
+    sha256 = "1p4bp8g94ny385nl3m2ca824dbm6lhjvh7s5rqyzk220il2sa0nd";
  };

  hardeningDisable = [ "pic" ];
--- a/pkgs/os-specific/linux/vdo/default.nix
+++ b/pkgs/os-specific/linux/vdo/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "vdo";
-  version = "8.1.1.360";  # kvdo uses this!
+  version = "8.2.0.2";  # kvdo uses this!

  src = fetchFromGitHub {
    owner = "dm-vdo";
    repo = pname;
    rev = version;
-    sha256 = "1zp8aaw0diramnlx5z96jcpbm6x0r204xf1vwq6k21rzcazczkwv";
+    hash = "sha256-IP/nL4jQ+rIWuUxXUiBtlIKTMZCNelvxgTfTcaB1it0=";
  };

  nativeBuildInputs = [
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2022.7.4";
+  version = "2022.7.5";
  components = {
    "abode" = ps: with ps; [
      abodepy
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -177,7 +177,7 @@ let
  extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.7.4";
+  hassVersion = "2022.7.5";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@ -195,7 +195,7 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = version;
-    hash = "sha256-TQsIChMoIlTd8+gN4bxiWFId6V2wB1j3XfhXYpYMw9M=";
+    hash = "sha256-fUKT9ZSu8dhwapvdjq50t5kh6ZwGsMteuvCjYpPQNx0=";
  };

  # leave this in, so users don't have to constantly update their downstream patch handling
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@ -4,7 +4,7 @@ buildPythonPackage rec {
  # the frontend version corresponding to a specific home-assistant version can be found here
  # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
  pname = "home-assistant-frontend";
-  version = "20220707.0";
+  version = "20220707.1";
  format = "wheel";

  src = fetchPypi {
@ -12,7 +12,7 @@ buildPythonPackage rec {
    pname = "home_assistant_frontend";
    dist = "py3";
    python = "py3";
-    sha256 = "sha256-ZNaa+YyY77b8Pg462tVewUe+K7ePTflESjZ+ar1cFc4=";
+    sha256 = "sha256-nsQBMERX4DMm1s3jgDwUzWNnqP44S95AM3+RQ8MdCgI=";
  };

  # there is nothing to strip in this package
--- a/pkgs/servers/web-apps/hedgedoc/package.json
+++ b/pkgs/servers/web-apps/hedgedoc/package.json
@ -1,6 +1,6 @@
 {
  "name": "HedgeDoc",
-  "version": "1.9.0",
+  "version": "1.9.4",
  "description": "The best platform to write and share markdown.",
  "main": "app.js",
  "license": "AGPL-3.0",
@ -30,25 +30,25 @@
    "compression": "^1.6.2",
    "connect-flash": "^0.1.1",
    "connect-session-sequelize": "^7.1.2",
-    "cookie": "^0.4.0",
+    "cookie": "^0.5.0",
    "cookie-parser": "^1.4.3",
    "deep-freeze": "^0.0.1",
    "diff-match-patch": "git+https://github.com/hackmdio/diff-match-patch.git",
    "ejs": "^3.0.0",
    "express": ">=4.14",
    "express-session": "^1.14.2",
-    "file-type": "^16.1.0",
-    "formidable": "^1.0.17",
+    "file-type": "^17.0.0",
+    "formidable": "^2.0.0",
    "graceful-fs": "^4.1.11",
    "helmet": "^4.5.0",
-    "i18n": "^0.13.0",
+    "i18n": "^0.15.0",
    "is-svg": "^4.3.1",
    "jsdom-nogyp": "^0.8.3",
    "lodash": "^4.17.20",
    "lutim": "^1.0.2",
    "lz-string": "git+https://github.com/hackmdio/lz-string.git",
-    "mariadb": "^2.1.2",
-    "markdown-it": "^12.0.0",
+    "mariadb": "^3.0.0",
+    "markdown-it": "^13.0.0",
    "markdown-it-abbr": "^1.0.4",
    "markdown-it-container": "^3.0.0",
    "markdown-it-deflist": "^2.0.1",
@ -65,12 +65,12 @@
    "meta-marked": "git+https://github.com/hedgedoc/meta-marked",
    "method-override": "^3.0.0",
    "minimist": "^1.2.0",
-    "minio": "^7.0.19",
+    "minio": "7.0.29",
    "moment": "^2.17.1",
    "morgan": "^1.7.0",
    "mysql2": "^2.0.0",
    "node-fetch": "^2.6.1",
-    "passport": "^0.4.0",
+    "passport": "^0.6.0",
    "passport-dropbox-oauth2": "^1.1.0",
    "passport-facebook": "^3.0.0",
    "passport-github": "^1.1.0",
@ -85,7 +85,7 @@
    "pdfobject": "^2.0.201604172",
    "pg": "^8.2.1",
    "pg-hstore": "^2.3.3",
-    "prom-client": "^13.1.0",
+    "prom-client": "^14.0.0",
    "prometheus-api-metrics": "^3.2.0",
    "randomcolor": "^0.6.0",
    "readline-sync": "^1.4.7",
@ -94,7 +94,7 @@
    "sequelize": "^5.21.1",
    "shortid": "2.2.16",
    "socket.io": "^2.1.1",
-    "sqlite3": "^5.0.0",
+    "sqlite3": "^5.0.8",
    "store": "^2.0.12",
    "string": "^3.3.3",
    "toobusy-js": "^0.5.1",
@ -104,13 +104,8 @@
    "winston": "^3.1.0",
    "xss": "^1.0.3"
  },
-  "resolutions": {
-    "**/tough-cookie": "~2.5.0",
-    "**/minimatch": "^3.0.2",
-    "**/request": "^2.88.0"
-  },
  "engines": {
-    "node": ">=12"
+    "node": "^14.13.1 || 16.x"
  },
  "bugs": "https://github.com/hedgedoc/hedgedoc/issues",
  "keywords": [
@ -139,7 +134,7 @@
    "url": "https://github.com/hedgedoc/hedgedoc.git"
  },
  "devDependencies": {
-    "abcjs": "5.12.0",
+    "abcjs": "6.0.3",
    "babel-cli": "6.26.0",
    "babel-core": "6.26.3",
    "babel-loader": "7.1.5",
@ -153,19 +148,20 @@
    "copy-webpack-plugin": "6.4.1",
    "css-loader": "5.2.7",
    "emojify.js": "1.1.0",
-    "esbuild-loader": "2.15.1",
+    "esbuild-loader": "2.19.0",
    "escape-html": "1.0.3",
-    "eslint": "7.32.0",
-    "eslint-config-standard": "16.0.3",
-    "eslint-plugin-import": "2.24.2",
+    "eslint": "8.19.0",
+    "eslint-config-standard": "17.0.0",
+    "eslint-plugin-import": "2.26.0",
+    "eslint-plugin-n": "15.2.4",
    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "5.1.0",
+    "eslint-plugin-promise": "6.0.0",
    "eslint-plugin-standard": "4.1.0",
    "exports-loader": "1.1.1",
    "expose-loader": "1.0.3",
    "file-loader": "6.2.0",
    "file-saver": "2.0.5",
-    "flowchart.js": "1.15.0",
+    "flowchart.js": "1.17.1",
    "fork-awesome": "1.2.0",
    "gist-embed": "2.6.0",
    "highlight.js": "10.7.3",
@ -174,28 +170,28 @@
    "ionicons": "2.0.1",
    "jquery": "3.6.0",
    "jquery-mousewheel": "3.1.13",
-    "jquery-ui": "1.12.1",
+    "jquery-ui": "1.13.1",
    "js-cookie": "3.0.1",
    "js-sequence-diagrams": "git+https://github.com/hedgedoc/js-sequence-diagrams.git",
    "js-yaml": "3.14.1",
    "jsonlint": "1.6.3",
    "keymaster": "1.6.2",
-    "less": "4.1.1",
+    "less": "4.1.3",
    "less-loader": "7.3.0",
    "list.js": "2.3.1",
    "mathjax": "2.7.9",
-    "mermaid": "8.12.1",
+    "mermaid": "9.1.3",
    "mini-css-extract-plugin": "1.6.2",
-    "mocha": "9.1.1",
+    "mocha": "10.0.0",
    "mock-require": "3.0.3",
    "optimize-css-assets-webpack-plugin": "6.0.1",
-    "prismjs": "1.24.1",
+    "prismjs": "1.28.0",
    "raphael": "2.3.0",
-    "remark-cli": "10.0.0",
-    "remark-preset-lint-markdown-style-guide": "5.0.1",
+    "remark-cli": "11.0.0",
+    "remark-preset-lint-markdown-style-guide": "5.1.2",
    "reveal.js": "3.9.2",
    "select2": "3.5.2-browserify",
-    "socket.io-client": "2.4.0",
+    "socket.io-client": "2.5.0",
    "spin.js": "4.1.1",
    "string-loader": "0.0.1",
    "turndown": "7.1.1",
@ -204,7 +200,7 @@
    "visibilityjs": "2.0.2",
    "viz.js": "1.8.2",
    "webpack": "4.46.0",
-    "webpack-cli": "4.8.0",
+    "webpack-cli": "4.10.0",
    "webpack-merge": "5.8.0",
    "wurl": "2.5.4"
  },
--- a/pkgs/servers/web-apps/hedgedoc/pin.json
+++ b/pkgs/servers/web-apps/hedgedoc/pin.json
@ -1,5 +1,5 @@
 {
-  "version": "1.9.0",
-  "srcHash": "hSKQGkI1+68Zf05RhgRKZo47buyobzjhURSZ30/h0PA=",
-  "yarnHash": "0v51jmmbg8fx66ay2glby0gxw07in95igz325p42g5hjd5kankf6"
+  "version": "1.9.4",
+  "srcHash": "0tOuSVz/b9qYNQppsxREY/emG1F3t5jeEhX4ek7Ktgg=",
+  "yarnHash": "15xakqcgy3amw52p63z9xlbfq2rp6c2ayf46551zx5mnvdp6wz5n"
 }
--- a/pkgs/servers/web-apps/hedgedoc/update.sh
+++ b/pkgs/servers/web-apps/hedgedoc/update.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=../../../../ -i bash -p nix wget prefetch-yarn-deps nix-prefetch-github
+#!nix-shell -I nixpkgs=../../../../ -i bash -p nix wget prefetch-yarn-deps nix-prefetch-github jq

 if [ "$#" -gt 1 ] || [[ "$1" == -* ]]; then
  echo "Regenerates packaging data for the element packages."
--- a/pkgs/servers/web-apps/hedgedoc/yarn.lock
+++ b/pkgs/servers/web-apps/hedgedoc/yarn.lock
--- a/pkgs/servers/web-apps/lemmy/package.json
+++ b/pkgs/servers/web-apps/lemmy/package.json
@ -1,7 +1,7 @@
 {
  "name": "lemmy-ui",
  "description": "An isomorphic UI for lemmy",
-  "version": "0.16.4",
+  "version": "0.16.6",
  "author": "Dessalines <tyhou13@gmx.com>",
  "license": "AGPL-3.0",
  "scripts": {
@ -34,7 +34,7 @@
    "inferno-server": "^7.4.11",
    "isomorphic-cookie": "^1.2.4",
    "jwt-decode": "^3.1.2",
-    "markdown-it": "^13.0.0",
+    "markdown-it": "^13.0.1",
    "markdown-it-container": "^3.0.0",
    "markdown-it-footnote": "^3.0.3",
    "markdown-it-html5-embed": "^1.0.0",
--- a/pkgs/servers/web-apps/lemmy/pin.json
+++ b/pkgs/servers/web-apps/lemmy/pin.json
@ -1,7 +1,7 @@
 {
-  "version": "0.16.4",
-  "serverSha256": "sha256-xbxavlmRm7QTbrAjw6IMgQq8rEgyEHdcj11EhsOY+j0=",
-  "serverCargoSha256": "sha256-vDIaLpw0C6fnv0quH20qRN0I38Br338+MS9YzVfNizU=",
-  "uiSha256": "sha256-GZH/fSYLbxwigrr5LwAzxH4ElDVjTs8Tqqq+xYDFNCU",
-  "uiYarnDepsSha256": "sha256-BQs9UXUT/CcxJ7CdLksYGvGPGAaW7FLUAShLsbPC0jw="
+  "version": "0.16.6",
+  "serverSha256": "sha256-nDmwn3moDFJtYNx/FY3uSpxCwE4Ni4udqF3MX3MNyYM=",
+  "serverCargoSha256": "sha256-f86UE7aVciHaTsK/jzABHEXBh2Pn6ErRBb52lW/f+1E=",
+  "uiSha256": "sha256-ZfD9QaycvjlFlbZNcMEf2bcrszYn8TWuPDYEhW+gITE=",
+  "uiYarnDepsSha256": "sha256-2NiDuqAyZeNn3c3XDeP2m5hHej4w4/gcabxfHgC8PV4="
 }
--- a/pkgs/servers/web-apps/lemmy/server.nix
+++ b/pkgs/servers/web-apps/lemmy/server.nix
@ -47,7 +47,7 @@ rustPlatform.buildRustPackage rec {
    description = "🐀 Building a federated alternative to reddit in rust";
    homepage = "https://join-lemmy.org/";
    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ happysalada ];
+    maintainers = with maintainers; [ happysalada billewanick ];
    mainProgram = "lemmy_server";
  };
 }
--- a/pkgs/servers/web-apps/searxng/default.nix
+++ b/pkgs/servers/web-apps/searxng/default.nix
@ -1,18 +1,17 @@
 { lib
 , python3
-, python3Packages
 , fetchFromGitHub
 }:

-python3Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "searxng";
-  version = "unstable-2022-06-29";
+  version = "unstable-2022-07-15";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
-    rev = "107006515ee9fe9cad9a6f6387db658953d32486";
-    sha256 = "sha256-uV5XiOVuES9wuBx9S8WhM8jhuxRHlSMvW5Ki8WlDwfM=";
+    rev = "7bf4e8d12d1d0ee53bf71f7c3a4010ef936f25d9";
+    sha256 = "sha256-Fuv9AoV9WnI6qMgj4Ve016RF8gaLXYgw89jRROcm/A8=";
  };

  postPatch = ''
@ -23,7 +22,7 @@ python3Packages.buildPythonApplication rec {
    export SEARX_DEBUG="true";
  '';

-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python3.pkgs; [
    babel
    certifi
    python-dateutil
@ -33,7 +32,6 @@ python3Packages.buildPythonApplication rec {
    jinja2
    langdetect
    lxml
-    h2
    pygments
    pyyaml
    redis
@ -42,7 +40,8 @@ python3Packages.buildPythonApplication rec {
    httpx
    httpx-socks
    markdown-it-py
-  ];
+  ] ++ httpx.optional-dependencies.http2
+  ++ httpx-socks.optional-dependencies.asyncio;

  # tests try to connect to network
  doCheck = false;
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@ -6,15 +6,15 @@

 buildGoModule rec {
  pname = "trivy";
-  version = "0.29.2";
+  version = "0.30.0";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-IZ94kYnZ1iNX4sgYF/XvRNvycXJ4fNmRwFgSpYcSopU=";
+    sha256 = "sha256-9omVpLpQvCbGr4abbJvMZxLgvOezofhMSyducS0jcf8=";
  };
-  vendorSha256 = "sha256-C1dOeVt+ocqj3s3tSXn8B/vHTRRWj8XU5RWmlQ0lZdA=";
+  vendorSha256 = "sha256-6WDoXyZirSKjSNCzm6MPLJLHhjNG7PEFBZBWukiWhXE=";

  excludedPackages = "misc";

--- a/pkgs/tools/misc/bash_unit/default.nix
+++ b/pkgs/tools/misc/bash_unit/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "bash_unit";
-  version = "1.9.1";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "pgrange";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-TtpVldIAqyv+apXmbI+1L0NgZxoKdc6Ffrl4WOqRI9c=";
+    sha256 = "sha256-ekkyyp280YRXMuNXbiV78Hrfd/zk2nESE1bRCpUP1eE=";
  };

  installPhase = ''
--- a/pkgs/tools/misc/qflipper/default.nix
+++ b/pkgs/tools/misc/qflipper/default.nix
@ -23,8 +23,8 @@
 }:
 let
  pname = "qFlipper";
-  version = "1.0.2";
-  sha256 = "sha256-CJQOEUwYPNd4x+uBINrxeYVITtYrsEFaYLHQh2l12kA=";
+  version = "1.1.0";
+  sha256 = "sha256-tZ+GXBv+LB1CYhO4hRtZFP25xUAVZaZJoee7Q7RJLp8=";
  timestamp = "99999999999";
  commit = "nix-${version}";

--- a/pkgs/tools/misc/tmuxinator/default.nix
+++ b/pkgs/tools/misc/tmuxinator/default.nix
@ -8,8 +8,8 @@ buildRubyGem rec {
  inherit ruby;
  name = "${gemName}-${version}";
  gemName = "tmuxinator";
-  version = "3.0.1";
-  source.sha256 = "1vm96iyzbcy1388b3zyqivfhs4p63v87mp5qwlr4s8i2haq62xyf";
+  version = "3.0.5";
+  source.sha256 = "1ycsx9mvl0jsds4igi6avxclsyl5lndh1mpj2ykvzfz26wdddg6p";

  erubis = buildRubyGem rec {
    inherit ruby;
@ -23,8 +23,8 @@ buildRubyGem rec {
    inherit ruby;
    name = "ruby${ruby.version}-${gemName}-${version}";
    gemName = "thor";
-    version = "1.0.1";
-    source.sha256 = "1xbhkmyhlxwzshaqa7swy2bx6vd64mm0wrr8g3jywvxy7hg0cwkm";
+    version = "1.2.1";
+    source.sha256 = "0inl77jh4ia03jw3iqm5ipr76ghal3hyjrd6r8zqsswwvi9j2xdi";
  };

  xdg = buildRubyGem rec {
--- a/pkgs/tools/networking/gvproxy/default.nix
+++ b/pkgs/tools/networking/gvproxy/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gvproxy";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "gvisor-tap-vsock";
    rev = "v${version}";
-    sha256 = "sha256-xoPqgt/d0RyDqkRY+ZhP02nKr3uEu8be0Go2H7JRg3k=";
+    sha256 = "sha256-mU5uJ/RnVAbL7M1lcBZKjGvfc2WfbJGyZB+65GrAr5M=";
  };

  vendorSha256 = null;
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "nuclei";
-  version = "2.7.3";
+  version = "2.7.4";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-E0oEB7N1+XyyoGrIgR7IECyKFRV5oDiEwZncVbq5urs=";
+    sha256 = "sha256-J65NAc0yswIgDPHH26mzx2OqMgcMV4n/gVG77Xe64wg=";
  };

-  vendorSha256 = "sha256-oqM/rOaqL/6un9J9OEconmobvzUwmuz0Hi+C7CR8Yak=";
+  vendorSha256 = "sha256-ewKKn+P8W/Fl3VaRiTmbA88DyMLJ38CG2rDExSa3oWw=";

  modRoot = "./v2";
  subPackages = [
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@ -25,16 +25,16 @@ rustPlatform.buildRustPackage rec {
  pname = "sequoia";
  # Upstream has separate version numbering for the library and the CLI frontend.
  # This derivation provides the CLI frontend, and thus uses its version number.
-  version = "0.26.0";
+  version = "0.27.0";

  src = fetchFromGitLab {
    owner = "sequoia-pgp";
    repo = "sequoia";
    rev = "sq/v${version}";
-    sha256 = "1rcbv1s7wpxhrzw082q6vfrq1ja2ssfxn53c90h8fh5wrj7ns751";
+    sha256 = "sha256-KhJAXpj47Tvds5SLYwnsNeIlPf9QEopoCzsvvHgCwaI=";
  };

-  cargoSha256 = "0f3b8rh4pl03n8j9ihazaak214sv1rsksbgrb1nfcy8sq2yqfj4g";
+  cargoSha256 = "sha256-Y7iiZVIT9Vbe4YmTfGTU8p3H3odQKms2FBnnWgvF7mI=";

  nativeBuildInputs = [
    pkg-config
@ -75,7 +75,11 @@ rustPlatform.buildRustPackage rec {
  LIBCLANG_PATH = "${llvmPackages_12.libclang.lib}/lib";

  # Sometimes, tests fail on CI (ofborg) & hydra without this
-  CARGO_TEST_ARGS = "--workspace --exclude sequoia-store";
+  checkFlags = [
+    # doctest for sequoia-ipc fail for some reason
+    "--skip=macros::assert_send_and_sync"
+    "--skip=macros::time_it"
+  ];

  preInstall = lib.optionalString pythonSupport ''
    export installFlags="PYTHONPATH=$PYTHONPATH:$out/${pythonPackages.python.sitePackages}"
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -292,6 +292,8 @@ with pkgs;

  cfn-nag = callPackage ../development/tools/cfn-nag { };

+  cxx-rs = callPackage ../development/libraries/cxx-rs { };
+
  elfcat = callPackage ../tools/misc/elfcat { };

  # Zip file format only allows times after year 1980, which makes e.g. Python
@ -828,6 +830,10 @@ with pkgs;

  makeDesktopItem = callPackage ../build-support/make-desktopitem { };

+  copyPkgconfigItems = makeSetupHook { } ../build-support/setup-hooks/copy-pkgconfig-items.sh;
+
+  makePkgconfigItem = callPackage ../build-support/make-pkgconfigitem { };
+
  makeDarwinBundle = callPackage ../build-support/make-darwin-bundle { };

  makeAutostartItem = callPackage ../build-support/make-startupitem { };
@ -10100,6 +10106,8 @@ with pkgs;

  realvnc-vnc-viewer = callPackage ../tools/admin/realvnc-vnc-viewer {};

+  re-isearch = callPackage ../applications/search/re-isearch { };
+
  reaverwps = callPackage ../tools/networking/reaver-wps {};

  reaverwps-t6x = callPackage ../tools/networking/reaver-wps-t6x {};