Merge branch 'master' into staging-next

; Conflicts: ; pkgs/development/python-modules/aiohttp-socks/default.nix ; pkgs/development/python-modules/emv/default.nix ; pkgs/development/python-modules/mocket/default.nix ; pkgs/development/python-modules/types-protobuf/default.nix
2021-12-31 07:26:03 +01:00 · 2021-12-31 07:26:03 +01:00 · 380c030740
parent f787df200d 03f32c346f
commit 380c030740
190 changed files with 1665 additions and 1775 deletions
--- a/doc/contributing/submitting-changes.chapter.md
+++ b/doc/contributing/submitting-changes.chapter.md
@ -246,11 +246,21 @@ If the branch is already in a broken state, please refrain from adding extra new

 ### Stable release branches {#submitting-changes-stable-release-branches}

-For cherry-picking a commit to a stable release branch (“backporting”), use `git cherry-pick -x <original commit>` so that the original commit id is included in the commit.
+The same staging workflow applies to stable release branches, but the main branch is called `release-*` instead of `master`.

-Add a reason for the backport by using `git cherry-pick -xe <original commit>` instead when it is not obvious from the original commit message. It is not needed when it's a minor version update that includes security and bug fixes but don't add new features or when the commit fixes an otherwise broken package.
+Example branch names: `release-21.11`, `staging-21.11`, `staging-next-21.11`.

-For backporting Pull Requests to stable branches, assign label `backport <branch>` to the original Pull Requests and automation should take care of the rest once the Pull Requests is merged.
+Most changes added to the stable release branches are cherry-picked (“backported”) from the `master` and staging branches.
+
+#### Automatically backporting a Pull Request {#submitting-changes-stable-release-branches-automatic-backports}
+
+Assign label `backport <branch>` (e.g. `backport release-21.11`) to the PR and a backport PR is automatically created after the PR is merged.
+
+#### Manually backporting changes {#submitting-changes-stable-release-branches-manual-backports}
+
+Cherry-pick changes via `git cherry-pick -x <original commit>` so that the original commit id is included in the commit message.
+
+Add a reason for the backport when it is not obvious from the original commit message. You can do this by cherry picking with `git cherry-pick -xe <original commit>`, which allows editing the commit message. This is not needed for minor version updates that include security and bug fixes but don't add new features or when the commit fixes an otherwise broken package.

 Here is an example of a cherry-picked commit message with good reason description:

--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -103,6 +103,12 @@
          new versions will release.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>services.kubernetes.addons.dashboard</literal> was
+          removed due to it being an outdated version.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>wafHook</literal> hook now honors
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -41,6 +41,8 @@ In addition to numerous new and upgraded packages, this release has the followin
  org-contrib, refer to the ones in `pkgs.emacsPackages.elpaPackages` and
  `pkgs.emacsPackages.nongnuPackages` where the new versions will release.

+- `services.kubernetes.addons.dashboard` was removed due to it being an outdated version.
+
 - The `wafHook` hook now honors `NIX_BUILD_CORES` when `enableParallelBuilding` is not set explicitly. Packages can restore the old behaviour by setting `enableParallelBuilding=false`.

 - `pkgs.claws-mail-gtk2`, representing Claws Mail's older release version three, was removed in order to get rid of Python 2.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -296,7 +296,6 @@
  ./services/cluster/hadoop/default.nix
  ./services/cluster/k3s/default.nix
  ./services/cluster/kubernetes/addons/dns.nix
-  ./services/cluster/kubernetes/addons/dashboard.nix
  ./services/cluster/kubernetes/addon-manager.nix
  ./services/cluster/kubernetes/apiserver.nix
  ./services/cluster/kubernetes/controller-manager.nix
--- a/nixos/modules/services/cluster/kubernetes/addon-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/addon-manager.nix
@ -58,7 +58,7 @@ in
            "spec" = { ... };
          };
        }
-        // import <nixpkgs/nixos/modules/services/cluster/kubernetes/dashboard.nix> { cfg = config.services.kubernetes; };
+        // import <nixpkgs/nixos/modules/services/cluster/kubernetes/dns.nix> { cfg = config.services.kubernetes; };
      '';
    };

--- a/nixos/modules/services/cluster/kubernetes/addons/dashboard.nix
+++ b/nixos/modules/services/cluster/kubernetes/addons/dashboard.nix
@ -1,344 +0,0 @@
-{ config, options, pkgs, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.services.kubernetes.addons.dashboard;
-  opt = options.services.kubernetes.addons.dashboard;
-in {
-  imports = [
-    (mkRenamedOptionModule [ "services" "kubernetes" "addons" "dashboard" "enableRBAC" ] [ "services" "kubernetes" "addons" "dashboard" "rbac" "enable" ])
-  ];
-
-  options.services.kubernetes.addons.dashboard = {
-    enable = mkEnableOption "kubernetes dashboard addon";
-
-    extraArgs = mkOption {
-      description = "Extra arguments to append to the dashboard cmdline";
-      type = types.listOf types.str;
-      default = [];
-      example = ["--enable-skip-login"];
-    };
-
-    rbac = mkOption {
-      description = "Role-based access control (RBAC) options";
-      default = {};
-      type = types.submodule {
-        options = {
-          enable = mkOption {
-            description = "Whether to enable role based access control is enabled for kubernetes dashboard";
-            type = types.bool;
-            default = elem "RBAC" config.services.kubernetes.apiserver.authorizationMode;
-            defaultText = literalExpression ''
-              elem "RBAC" config.${options.services.kubernetes.apiserver.authorizationMode}
-            '';
-          };
-
-          clusterAdmin = mkOption {
-            description = "Whether to assign cluster admin rights to the kubernetes dashboard";
-            type = types.bool;
-            default = false;
-          };
-        };
-      };
-    };
-
-    version = mkOption {
-      description = "Which version of the kubernetes dashboard to deploy";
-      type = types.str;
-      default = "v1.10.1";
-    };
-
-    image = mkOption {
-      description = "Docker image to seed for the kubernetes dashboard container.";
-      type = types.attrs;
-      default = {
-        imageName = "k8s.gcr.io/kubernetes-dashboard-amd64";
-        imageDigest = "sha256:0ae6b69432e78069c5ce2bcde0fe409c5c4d6f0f4d9cd50a17974fea38898747";
-        finalImageTag = cfg.version;
-        sha256 = "01xrr4pwgr2hcjrjsi3d14ifpzdfbxzqpzxbk2fkbjb9zkv38zxy";
-      };
-      defaultText = literalExpression ''
-        {
-          imageName = "k8s.gcr.io/kubernetes-dashboard-amd64";
-          imageDigest = "sha256:0ae6b69432e78069c5ce2bcde0fe409c5c4d6f0f4d9cd50a17974fea38898747";
-          finalImageTag = config.${opt.version};
-          sha256 = "01xrr4pwgr2hcjrjsi3d14ifpzdfbxzqpzxbk2fkbjb9zkv38zxy";
-        };
-      '';
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services.kubernetes.kubelet.seedDockerImages = [(pkgs.dockerTools.pullImage cfg.image)];
-
-    services.kubernetes.addonManager.addons = {
-      kubernetes-dashboard-deployment = {
-        kind = "Deployment";
-        apiVersion = "apps/v1";
-        metadata = {
-          labels = {
-            k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-            k8s-app = "kubernetes-dashboard";
-            version = cfg.version;
-            "kubernetes.io/cluster-service" = "true";
-            "addonmanager.kubernetes.io/mode" = "Reconcile";
-          };
-          name = "kubernetes-dashboard";
-          namespace = "kube-system";
-        };
-        spec = {
-          replicas = 1;
-          revisionHistoryLimit = 10;
-          selector.matchLabels.k8s-app = "kubernetes-dashboard";
-          template = {
-            metadata = {
-              labels = {
-                k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-                k8s-app = "kubernetes-dashboard";
-                version = cfg.version;
-                "kubernetes.io/cluster-service" = "true";
-              };
-              annotations = {
-                "scheduler.alpha.kubernetes.io/critical-pod" = "";
-              };
-            };
-            spec = {
-              priorityClassName = "system-cluster-critical";
-              containers = [{
-                name = "kubernetes-dashboard";
-                image = with cfg.image; "${imageName}:${finalImageTag}";
-                ports = [{
-                  containerPort = 8443;
-                  protocol = "TCP";
-                }];
-                resources = {
-                  limits = {
-                    cpu = "100m";
-                    memory = "300Mi";
-                  };
-                  requests = {
-                    cpu = "100m";
-                    memory = "100Mi";
-                  };
-                };
-                args = ["--auto-generate-certificates"] ++ cfg.extraArgs;
-                volumeMounts = [{
-                  name = "tmp-volume";
-                  mountPath = "/tmp";
-                } {
-                  name = "kubernetes-dashboard-certs";
-                  mountPath = "/certs";
-                }];
-                livenessProbe = {
-                  httpGet = {
-                    scheme = "HTTPS";
-                    path = "/";
-                    port = 8443;
-                  };
-                  initialDelaySeconds = 30;
-                  timeoutSeconds = 30;
-                };
-              }];
-              volumes = [{
-                name = "kubernetes-dashboard-certs";
-                secret = {
-                  secretName = "kubernetes-dashboard-certs";
-                };
-              } {
-                name = "tmp-volume";
-                emptyDir = {};
-              }];
-              serviceAccountName = "kubernetes-dashboard";
-              tolerations = [{
-                key = "node-role.kubernetes.io/master";
-                effect = "NoSchedule";
-              } {
-                key = "CriticalAddonsOnly";
-                operator = "Exists";
-              }];
-            };
-          };
-        };
-      };
-
-      kubernetes-dashboard-svc = {
-        apiVersion = "v1";
-        kind = "Service";
-        metadata = {
-          labels = {
-            k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-            k8s-app = "kubernetes-dashboard";
-            "kubernetes.io/cluster-service" = "true";
-            "kubernetes.io/name" = "KubeDashboard";
-            "addonmanager.kubernetes.io/mode" = "Reconcile";
-          };
-          name = "kubernetes-dashboard";
-          namespace  = "kube-system";
-        };
-        spec = {
-          ports = [{
-            port = 443;
-            targetPort = 8443;
-          }];
-          selector.k8s-app = "kubernetes-dashboard";
-        };
-      };
-
-      kubernetes-dashboard-sa = {
-        apiVersion = "v1";
-        kind = "ServiceAccount";
-        metadata = {
-          labels = {
-            k8s-app = "kubernetes-dashboard";
-            k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-            "addonmanager.kubernetes.io/mode" = "Reconcile";
-          };
-          name = "kubernetes-dashboard";
-          namespace = "kube-system";
-        };
-      };
-      kubernetes-dashboard-sec-certs = {
-        apiVersion = "v1";
-        kind = "Secret";
-        metadata = {
-          labels = {
-            k8s-app = "kubernetes-dashboard";
-            # Allows editing resource and makes sure it is created first.
-            "addonmanager.kubernetes.io/mode" = "EnsureExists";
-          };
-          name = "kubernetes-dashboard-certs";
-          namespace = "kube-system";
-        };
-        type = "Opaque";
-      };
-      kubernetes-dashboard-sec-kholder = {
-        apiVersion = "v1";
-        kind = "Secret";
-        metadata = {
-          labels = {
-            k8s-app = "kubernetes-dashboard";
-            # Allows editing resource and makes sure it is created first.
-            "addonmanager.kubernetes.io/mode" = "EnsureExists";
-          };
-          name = "kubernetes-dashboard-key-holder";
-          namespace = "kube-system";
-        };
-        type = "Opaque";
-      };
-      kubernetes-dashboard-cm = {
-        apiVersion = "v1";
-        kind = "ConfigMap";
-        metadata = {
-          labels = {
-            k8s-app = "kubernetes-dashboard";
-            # Allows editing resource and makes sure it is created first.
-            "addonmanager.kubernetes.io/mode" = "EnsureExists";
-          };
-          name = "kubernetes-dashboard-settings";
-          namespace = "kube-system";
-        };
-      };
-    } // (optionalAttrs cfg.rbac.enable
-      (let
-        subjects = [{
-          kind = "ServiceAccount";
-          name = "kubernetes-dashboard";
-          namespace = "kube-system";
-        }];
-        labels = {
-          k8s-app = "kubernetes-dashboard";
-          k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-          "addonmanager.kubernetes.io/mode" = "Reconcile";
-        };
-      in
-        (if cfg.rbac.clusterAdmin then {
-          kubernetes-dashboard-crb = {
-            apiVersion = "rbac.authorization.k8s.io/v1";
-            kind = "ClusterRoleBinding";
-            metadata = {
-              name = "kubernetes-dashboard";
-              inherit labels;
-            };
-            roleRef = {
-              apiGroup = "rbac.authorization.k8s.io";
-              kind = "ClusterRole";
-              name = "cluster-admin";
-            };
-            inherit subjects;
-          };
-        }
-        else
-        {
-          # Upstream role- and rolebinding as per:
-          # https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/alternative/kubernetes-dashboard.yaml
-          kubernetes-dashboard-role = {
-            apiVersion = "rbac.authorization.k8s.io/v1";
-            kind = "Role";
-            metadata = {
-              name = "kubernetes-dashboard-minimal";
-              namespace = "kube-system";
-              inherit labels;
-            };
-            rules = [
-              # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
-              {
-                apiGroups = [""];
-                resources = ["secrets"];
-                verbs = ["create"];
-              }
-              # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
-              {
-                apiGroups = [""];
-                resources = ["configmaps"];
-                verbs = ["create"];
-              }
-              # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
-              {
-                apiGroups = [""];
-                resources = ["secrets"];
-                resourceNames = ["kubernetes-dashboard-key-holder"];
-                verbs = ["get" "update" "delete"];
-              }
-              # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
-              {
-                apiGroups = [""];
-                resources = ["configmaps"];
-                resourceNames = ["kubernetes-dashboard-settings"];
-                verbs = ["get" "update"];
-              }
-              # Allow Dashboard to get metrics from heapster.
-              {
-                apiGroups = [""];
-                resources = ["services"];
-                resourceNames = ["heapster"];
-                verbs = ["proxy"];
-              }
-              {
-                apiGroups = [""];
-                resources = ["services/proxy"];
-                resourceNames = ["heapster" "http:heapster:" "https:heapster:"];
-                verbs = ["get"];
-              }
-            ];
-          };
-
-          kubernetes-dashboard-rb = {
-            apiVersion = "rbac.authorization.k8s.io/v1";
-            kind = "RoleBinding";
-            metadata = {
-              name = "kubernetes-dashboard-minimal";
-              namespace = "kube-system";
-              inherit labels;
-            };
-            roleRef = {
-              apiGroup = "rbac.authorization.k8s.io";
-              kind = "Role";
-              name = "kubernetes-dashboard-minimal";
-            };
-            inherit subjects;
-          };
-        })
-    ));
-  };
-}
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@ -106,6 +106,7 @@ let
 in {

  imports = [
+    (mkRemovedOptionModule [ "services" "kubernetes" "addons" "dashboard" ] "Removed due to it being an outdated version")
    (mkRemovedOptionModule [ "services" "kubernetes" "verbose" ] "")
  ];

--- a/nixos/modules/services/networking/dhcpd.nix
+++ b/nixos/modules/services/networking/dhcpd.nix
@ -28,45 +28,38 @@ let
      }
    '';

-  dhcpdService = postfix: cfg:
-    let
-      configFile =
-        if cfg.configFile != null
-          then cfg.configFile
-          else writeConfig cfg;
-      leaseFile = "/var/lib/dhcpd${postfix}/dhcpd.leases";
-      args = [
-        "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
-        "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
-        "-cf" configFile
-        "-lf" leaseFile
-      ] ++ cfg.extraFlags
-        ++ cfg.interfaces;
-    in
-      optionalAttrs cfg.enable {
-        "dhcpd${postfix}" = {
-          description = "DHCPv${postfix} server";
-          wantedBy = [ "multi-user.target" ];
-          after = [ "network.target" ];
+  dhcpdService = postfix: cfg: optionalAttrs cfg.enable {
+    "dhcpd${postfix}" = {
+      description = "DHCPv${postfix} server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];

-          preStart = "touch ${leaseFile}";
-          serviceConfig = {
-            ExecStart = concatMapStringsSep " " escapeShellArg args;
-            Type = "forking";
-            Restart = "always";
-            DynamicUser = true;
-            User = "dhcpd";
-            Group = "dhcpd";
-            AmbientCapabilities = [
-              "CAP_NET_RAW"          # to send ICMP messages
-              "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67)
-            ];
-            StateDirectory   = "dhcpd${postfix}";
-            RuntimeDirectory = "dhcpd${postfix}";
-            PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
-          };
+      preStart = ''
+        mkdir -m 755 -p ${cfg.stateDir}
+        chown dhcpd:nogroup ${cfg.stateDir}
+        touch ${cfg.stateDir}/dhcpd.leases
+      '';
+
+      serviceConfig =
+        let
+          configFile = if cfg.configFile != null then cfg.configFile else writeConfig cfg;
+          args = [ "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
+                   "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
+                   "-cf" "${configFile}"
+                   "-lf" "${cfg.stateDir}/dhcpd.leases"
+                   "-user" "dhcpd" "-group" "nogroup"
+                 ] ++ cfg.extraFlags
+                   ++ cfg.interfaces;
+
+        in {
+          ExecStart = concatMapStringsSep " " escapeShellArg args;
+          Type = "forking";
+          Restart = "always";
+          RuntimeDirectory = [ "dhcpd${postfix}" ];
+          PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
        };
-      };
+    };
+  };

  machineOpts = { ... }: {

@ -109,6 +102,15 @@ let
      '';
    };

+    stateDir = mkOption {
+      type = types.path;
+      # We use /var/lib/dhcp for DHCPv4 to save backwards compatibility.
+      default = "/var/lib/dhcp${if postfix == "4" then "" else postfix}";
+      description = ''
+        State directory for the DHCP server.
+      '';
+    };
+
    extraConfig = mkOption {
      type = types.lines;
      default = "";
@ -192,13 +194,7 @@ in

  imports = [
    (mkRenamedOptionModule [ "services" "dhcpd" ] [ "services" "dhcpd4" ])
-  ] ++ flip map [ "4" "6" ] (postfix:
-    mkRemovedOptionModule [ "services" "dhcpd${postfix}" "stateDir" ] ''
-      The DHCP server state directory is now managed with the systemd's DynamicUser mechanism.
-      This means the directory is named after the service (dhcpd${postfix}), created under
-      /var/lib/private/ and symlinked to /var/lib/.
-    ''
-  );
+  ];

  ###### interface

@ -214,6 +210,15 @@ in

  config = mkIf (cfg4.enable || cfg6.enable) {

+    users = {
+      users.dhcpd = {
+        isSystemUser = true;
+        group = "dhcpd";
+        description = "DHCP daemon user";
+      };
+      groups.dhcpd = {};
+    };
+
    systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6;

  };
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -398,6 +398,7 @@ in
  proxy = handleTest ./proxy.nix {};
  prowlarr = handleTest ./prowlarr.nix {};
  pt2-clone = handleTest ./pt2-clone.nix {};
+  pulseaudio = discoverTests (import ./pulseaudio.nix);
  qboot = handleTestOn ["x86_64-linux" "i686-linux"] ./qboot.nix {};
  quorum = handleTest ./quorum.nix {};
  rabbitmq = handleTest ./rabbitmq.nix {};
--- a/nixos/tests/kubernetes/base.nix
+++ b/nixos/tests/kubernetes/base.nix
@ -51,7 +51,6 @@ let
              environment.systemPackages = [ kubectl ];
              services.flannel.iface = "eth1";
              services.kubernetes = {
-                addons.dashboard.enable = true;
                proxy.hostname = "${masterName}.${domain}";

                easyCerts = true;
--- a/nixos/tests/pulseaudio.nix
+++ b/nixos/tests/pulseaudio.nix
@ -0,0 +1,71 @@
+let
+  mkTest = { systemWide ? false }:
+    import ./make-test-python.nix ({ pkgs, lib, ... }:
+      let
+        testFile = pkgs.fetchurl {
+          url =
+            "https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3";
+          hash = "sha256-+iggJW8s0/LfA/okfXsB550/55Q0Sq3OoIzuBrzOPJQ=";
+        };
+
+        makeTestPlay = key:
+          { sox, alsa-utils }:
+          pkgs.writeScriptBin key ''
+            set -euxo pipefail
+            ${sox}/bin/play ${testFile}
+            ${sox}/bin/sox ${testFile} -t wav - | ${alsa-utils}/bin/aplay
+            touch /tmp/${key}_success
+          '';
+
+        testers = builtins.mapAttrs makeTestPlay {
+          testPlay = { inherit (pkgs) sox alsa-utils; };
+          testPlay32 = { inherit (pkgs.pkgsi686Linux) sox alsa-utils; };
+        };
+      in {
+        name = "pulseaudio${lib.optionalString systemWide "-systemWide"}";
+        meta = with pkgs.lib.maintainers; {
+          maintainers = [ synthetica ] ++ pkgs.pulseaudio.meta.maintainers;
+        };
+
+        machine = { ... }:
+
+          {
+            imports = [ ./common/wayland-cage.nix ];
+            hardware.pulseaudio = {
+              enable = true;
+              support32Bit = true;
+              inherit systemWide;
+            };
+
+            environment.systemPackages = [ testers.testPlay pkgs.pavucontrol ]
+              ++ lib.optional pkgs.stdenv.isx86_64 testers.testPlay32;
+          } // lib.optionalAttrs systemWide {
+            users.users.alice.extraGroups = [ "audio" ];
+            systemd.services.pulseaudio.wantedBy = [ "multi-user.target" ];
+          };
+
+        enableOCR = true;
+
+        testScript = { ... }: ''
+          machine.wait_until_succeeds("pgrep xterm")
+          machine.wait_for_text("alice@machine")
+
+          machine.send_chars("testPlay \n")
+          machine.wait_for_file("/tmp/testPlay_success")
+          ${lib.optionalString pkgs.stdenv.isx86_64 ''
+            machine.send_chars("testPlay32 \n")
+            machine.wait_for_file("/tmp/testPlay32_success")
+          ''}
+          machine.screenshot("testPlay")
+
+          # Pavucontrol only loads when Pulseaudio is running. If it isn't, the
+          # text "Playback" (one of the tabs) will never show.
+          machine.send_chars("pavucontrol\n")
+          machine.wait_for_text("Playback")
+          machine.screenshot("Pavucontrol")
+        '';
+      });
+in builtins.mapAttrs (key: val: mkTest val) {
+  user = { systemWide = false; };
+  system = { systemWide = true; };
+}
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@ -3,13 +3,13 @@

 buildDotnetModule rec {
  pname = "btcpayserver";
-  version = "1.3.6";
+  version = "1.3.7";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-8SWbbdPx/cC7EWTkSbB/YqR13jaL76fFIjHPGL4rFyk=";
+    sha256 = "sha256-W8WRw42hMNUaQZlfrl73REGIvLcj6Vso9Axx53ENkx0=";
  };

  projectFile = "BTCPayServer/BTCPayServer.csproj";
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergo";
-  version = "4.0.16";
+  version = "4.0.16.2";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-cdfpXJtN/JXQNBnCyTIvJLQQhjzDV3+l4WoASII9uuU=";
+    sha256 = "sha256-nAaNT5Rt/oLBA2pSJSinoLKMYJ0VZmuC0zoMYbMSAJQ=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@ -9,13 +9,13 @@ let

 in buildGoModule rec {
  pname = "go-ethereum";
-  version = "1.10.11";
+  version = "1.10.14";

  src = fetchFromGitHub {
    owner = "ethereum";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-8kPaa2wRKUQBn4LFDnc7tEbLR62f99NS1HIVDeHHzto=";
+    sha256 = "sha256-0DQrcei3FM+X4BYokou7dPNVCcJTbY05YsTvzdtsas8=";
  };

  runVend = true;
--- a/pkgs/applications/blockchains/lightning-loop/default.nix
+++ b/pkgs/applications/blockchains/lightning-loop/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "lightning-loop";
-  version = "0.15.0-beta";
+  version = "0.16.0-beta";

  src = fetchFromGitHub {
    owner = "lightninglabs";
    repo = "loop";
    rev = "v${version}";
-    sha256 = "1yjc04jiam3836w7vn3b1jqj1dq1k8wwfnccir0vh29cn6v0cf63";
+    sha256 = "0q4lk338mr30frilgnjr43gd55z7ryj2s260437b4pnp03hmbf10";
  };

-  vendorSha256 = "0c3ly0s438sr9iql2ps4biaswphp7dfxshddyw5fcm0ajqzvhrmw";
+  vendorSha256 = "14862603rrss14p537j9i7iwflaaprwrnslmqm9hpb7hj52bxqfv";

  subPackages = [ "cmd/loop" "cmd/loopd" ];

--- a/pkgs/applications/blockchains/lightning-pool/default.nix
+++ b/pkgs/applications/blockchains/lightning-pool/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "lightning-pool";
-  version = "0.5.1-alpha";
+  version = "0.5.3-alpha";

  src = fetchFromGitHub {
    owner = "lightninglabs";
    repo = "pool";
    rev = "v${version}";
-    sha256 = "147s0p4arfxl2akzm267p8zfy6hgssym5rwxv78kp8i39mfinpkn";
+    sha256 = "1nc3hksk9qcxrsyqpz9vcfc8x093rc8yx8ppfk177j9fhdnn8bk7";
  };

-  vendorSha256 = "0zd3bwqi0hnk0562x9hd62cwjw1xj386m83jagg41kzz0cpcr7zl";
+  vendorSha256 = "09yxaa74814l1rp0arqhqpplr2j0p8dj81zqcbxlwp5ckjv9r2za";

  subPackages = [ "cmd/pool" "cmd/poold" ];

--- a/pkgs/applications/blockchains/nbxplorer/util/update-common.sh
+++ b/pkgs/applications/blockchains/nbxplorer/util/update-common.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_3 git gnupg nix
+#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_3 git gnupg nixFlakes
 set -euo pipefail

 # This script uses the following env vars:
@ -17,7 +17,7 @@ scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
 nixpkgs=$(realpath "$scriptDir"/../../../../..)

 evalNixpkgs() {
-  nix eval --raw "(with import \"$nixpkgs\" {}; $1)"
+  nix eval --impure --raw --expr "(with import \"$nixpkgs\" {}; $1)"
 }

 getRepo() {
--- a/pkgs/applications/misc/bottles/default.nix
+++ b/pkgs/applications/misc/bottles/default.nix
@ -1,20 +1,21 @@
 { lib, fetchFromGitHub
 , meson, ninja, pkg-config, wrapGAppsHook
-, desktop-file-utils, gsettings-desktop-schemas, libnotify, libhandy
+, desktop-file-utils, gsettings-desktop-schemas, libnotify, libhandy, webkitgtk
 , python3Packages, gettext
-, appstream-glib, gdk-pixbuf, glib, gobject-introspection, gspell, gtk3
+, appstream-glib, gdk-pixbuf, glib, gobject-introspection, gspell, gtk3, gnome
 , steam-run, xdg-utils, pciutils, cabextract, wineWowPackages
+, freetype, p7zip, gamemode
 }:

 python3Packages.buildPythonApplication rec {
  pname = "bottles";
-  version = "2021.7.28-treviso-2";
+  version = "2021.12.28-treviso";

  src = fetchFromGitHub {
    owner = "bottlesdevs";
    repo = pname;
    rev = version;
-    sha256 = "0kvwcajm9izvkwfg7ir7bks39bpc665idwa8mc8d536ajyjriysn";
+    sha256 = "lZbSLLBg7XM6PuOmu5rJ15dg+QHHRcjijRYE6u3WT9Y=";
  };

  postPatch = ''
@ -41,10 +42,13 @@ python3Packages.buildPythonApplication rec {
    gtk3
    libhandy
    libnotify
+    webkitgtk
+    gnome.adwaita-icon-theme
  ];

  propagatedBuildInputs = with python3Packages; [
    pyyaml
+    pytoml
    requests
    pycairo
    pygobject3
@ -53,12 +57,16 @@ python3Packages.buildPythonApplication rec {
    gst-python
    liblarch
    patool
+    markdown
  ] ++ [
    steam-run
    xdg-utils
    pciutils
    cabextract
    wineWowPackages.minimal
+    freetype
+    p7zip
+    gamemode # programs.gamemode.enable
  ];

  format = "other";
@ -66,13 +74,9 @@ python3Packages.buildPythonApplication rec {
  dontWrapGApps = true; # prevent double wrapping

  preConfigure = ''
-    substituteInPlace build-aux/meson/postinstall.py \
-      --replace "'update-desktop-database'" "'${desktop-file-utils}/bin/update-desktop-database'"
-    substituteInPlace src/runner.py \
-      --replace " {runner}" " ${steam-run}/bin/steam-run {runner}" \
-      --replace " {dxvk_setup}" " ${steam-run}/bin/steam-run {dxvk_setup}"
-      substituteInPlace src/runner_utilities.py \
-        --replace " {runner}" " ${steam-run}/bin/steam-run {runner}" \
+    patchShebangs build-aux/meson/postinstall.py
+    substituteInPlace src/backend/runner.py \
+      --replace "{Paths.runners}" "${steam-run}/bin/steam-run {Paths.runners}"
  '';

  preFixup = ''
--- a/pkgs/applications/misc/koreader/default.nix
+++ b/pkgs/applications/misc/koreader/default.nix
@ -13,12 +13,12 @@
 let font-droid = nerdfonts.override { fonts = [ "DroidSansMono" ]; };
 in stdenv.mkDerivation rec {
  pname = "koreader";
-  version = "2021.12";
+  version = "2021.12.1";

  src = fetchurl {
    url =
      "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-    sha256 = "sha256-duOIbYavqmUUkH6RthTYu/SeM8zOeeLm7CIAQwhw6AY=";
+    sha256 = "sha256-Ia0oCSGs6UYcvZVEhNpiOh3D08FgXqjqpgsQJojd3dk=";
  };

  sourceRoot = ".";
--- a/pkgs/applications/misc/mkgmap/default.nix
+++ b/pkgs/applications/misc/mkgmap/default.nix
@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mkgmap";
-  version = "4835";
+  version = "4836";

  src = fetchurl {
    url = "https://www.mkgmap.org.uk/download/mkgmap-r${version}-src.tar.gz";
-    sha256 = "u4qwfL8qp+rUIIYuZmVYjEkh0riL8yeQz0t8j5shT34=";
+    sha256 = "nmEl7pN3LW6nqo5IB6GgzcDMHhdAsMySTdANVbybznY=";
  };

  patches = [
--- a/pkgs/applications/misc/openrgb/default.nix
+++ b/pkgs/applications/misc/openrgb/default.nix
@ -1,18 +1,18 @@
-{ lib, mkDerivation, fetchFromGitLab, qmake, libusb1, hidapi, pkg-config, coreutils }:
+{ lib, mkDerivation, fetchFromGitLab, qmake, libusb1, hidapi, pkg-config, coreutils, mbedtls }:

 mkDerivation rec {
  pname = "openrgb";
-  version = "0.6";
+  version = "0.7";

  src = fetchFromGitLab {
    owner = "CalcProgrammer1";
    repo = "OpenRGB";
    rev = "release_${version}";
-    sha256 = "sha256-x/wGD39Jm/kmcTEZP3BnLXxyv/jkPOJd6mLCO0dp5wM=";
+    sha256 = "0xhfaz0b74nfnh7il2cz5c0338xlzay00g6hc2h3lsncarj8d5n7";
  };

  nativeBuildInputs = [ qmake pkg-config ];
-  buildInputs = [ libusb1 hidapi ];
+  buildInputs = [ libusb1 hidapi mbedtls ];

  installPhase = ''
    runHook preInstall
--- a/pkgs/applications/misc/stog/default.nix
+++ b/pkgs/applications/misc/stog/default.nix
@ -1,32 +1,44 @@
-{ lib, stdenv, fetchFromGitLab, ocaml, findlib, ocf, ptime,
-  uutf, uri, ppx_blob, xtmpl, ocaml_lwt, higlo, omd
+{ lib, buildDunePackage, fetchFromGitLab, ocaml
+, fmt, lwt_ppx, menhir, ocf_ppx, ppx_blob, xtmpl_ppx
+, dune-build-info, dune-site, higlo, logs, lwt, ocf, ptime, uri, uutf, xtmpl
 }:

-stdenv.mkDerivation rec {
+if lib.versionAtLeast ocaml.version "4.13"
+then throw "stog is not available for OCaml ${ocaml.version}"
+else
+
+buildDunePackage rec {
  pname = "stog";
-  version = "0.18.0";
+  version = "0.20.0";
+  useDune2 = true;
+  minimalOCamlVersion = "4.12";
  src = fetchFromGitLab {
    domain = "framagit.org";
    owner = "zoggy";
    repo = "stog";
    rev = version;
-    sha256 = "154gl3ljxqlw8wz1vmsyv8180igrl5bjq0wir7ybrnzq2cdflkv0";
+    sha256 = "sha256:0krj5w4y05bcfx7hk9blmap8avl31gp7yi01lpqzs6ync23mvm0x";
  };

-  buildInputs = [ ocaml uutf ];
-  propagatedBuildInputs = [ findlib omd ppx_blob ocf ptime uri xtmpl ocaml_lwt higlo ];
-
-  createFindlibDestdir = true;
-
-  patches = [ ./install.patch ./uri.patch ];
+  buildInputs = [ fmt lwt_ppx menhir ocf_ppx ppx_blob xtmpl_ppx ];
+  propagatedBuildInputs = [
+    dune-build-info
+    dune-site
+    higlo
+    logs
+    lwt
+    ocf
+    ppx_blob
+    ptime
+    uri
+    uutf
+    xtmpl
+  ];

  meta = with lib; {
    description = "XML documents and web site compiler";
    homepage = "https://www.good-eris.net/stog";
    license = licenses.lgpl3;
-    platforms = ocaml.meta.platforms or [];
    maintainers = with maintainers; [ regnat ];
  };
 }
-
-
--- a/pkgs/applications/misc/stog/install.patch
+++ b/pkgs/applications/misc/stog/install.patch
@ -1,18 +0,0 @@
-diff --git a/src/Makefile b/src/Makefile
-index 736dd037..79a85b9c 100644
--- a/src/Makefile
-+++ b/src/Makefile
-@@ -431,11 +431,12 @@ install-lib:
- install-share:
- 
- install-bin:
-+	mkdir $(out)/bin
- 	$(CP) $(MAIN) $(MAIN_BYTE) $(TMPL) $(TMPL_BYTE) \
- 		$(SERVER) $(SERVER_BYTE) $(OCAML_SESSION) \
- 	  $(MK_STOG) $(MK_STOG_BYTE) $(MK_STOG_OCAML) \
- 	  $(LATEX2STOG) $(LATEX2STOG_BYTE) \
-		`dirname \`which $(OCAMLC)\``/
-+	  $(out)/bin
- 
- uninstall: uninstall-lib uninstall-share uninstall-bin
- 
--- a/pkgs/applications/misc/stog/uri.patch
+++ b/pkgs/applications/misc/stog/uri.patch
@ -1,13 +0,0 @@
-diff --git a/src/stog_url.ml b/src/stog_url.ml
-index 5d30a43f..c67bfc36 100644
--- a/src/stog_url.ml
-+++ b/src/stog_url.ml
-@@ -40,7 +40,7 @@ let of_string s =
-   with _ ->
-     failwith (Printf.sprintf "Malformed URL %S" s)
- ;;
-let to_string = Uri.to_string ;;
-+let to_string u = Uri.to_string u;;
- 
- let path url =
-   let l =
--- a/pkgs/applications/misc/tmatrix/default.nix
+++ b/pkgs/applications/misc/tmatrix/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "tmatrix";
-  version = "1.3";
+  version = "1.4";

  src = fetchFromGitHub {
    owner = "M4444";
    repo = "TMatrix";
    rev = "v${version}";
-    sha256 = "1cvgxmdpdzpl8w4z3sh4g5pbd15rd8s1kcspi9v95yf9rydyy69s";
+    sha256 = "sha256-G3dg0SWfBjCA66TTxkVAcVrFNJOWE9+GJXYKzCUX34w=";
  };

  nativeBuildInputs = [ cmake installShellFiles ];
--- a/pkgs/applications/networking/browsers/elinks/default.nix
+++ b/pkgs/applications/networking/browsers/elinks/default.nix
@ -13,13 +13,13 @@ assert enablePython -> python != null;

 stdenv.mkDerivation rec {
  pname = "elinks";
-  version = "0.14.3";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "rkd77";
    repo = "felinks";
    rev = "v${version}";
-    sha256 = "sha256-vyzuMU2Qfz8DMRP0+QQmSx8J40ADTMJqg2jQOZJQxUA=";
+    sha256 = "sha256-2TF0rbmjwhwV2AVUXjfzoprzpeqrETis3AFhMftpaZQ=";
  };

  buildInputs = [
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -297,10 +297,17 @@ stdenv.mkDerivation rec {
    cp -u --no-preserve=mode,owner "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/bookmarks.html" \
      "\$HOME/TorBrowser/Data/Browser/profile.default/bookmarks.html"

-    # Clear out some files that tend to capture store references but are
-    # easily generated by firefox at startup.
-    rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/{addonStartup.json.lz4,compatibility.ini,extensions.ini,extensions.json}
-    rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/startupCache/*
+    # Clear some files if the last known store path is different from the new one
+    : "\''${KNOWN_STORE_PATH:=\$HOME/known-store-path}"
+    if ! [ "\$KNOWN_STORE_PATH" -ef $out ]; then
+      echo "Cleanup files with outdated store references"
+      ln -Tsf $out "\$KNOWN_STORE_PATH"
+
+      # Clear out some files that tend to capture store references but are
+      # easily generated by firefox at startup.
+      rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/{addonStartup.json.lz4,compatibility.ini,extensions.ini,extensions.json}
+      rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/startupCache/*
+    fi

    # XDG
    : "\''${XDG_RUNTIME_DIR:=/run/user/\$(id -u)}"
--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "kubeone";
-  version = "1.3.2";
+  version = "1.3.3";

  src = fetchFromGitHub {
    owner = "kubermatic";
    repo = "kubeone";
    rev = "v${version}";
-    sha256 = "sha256-Y0IlTOAfwEp8WkFpXSS02vEhCM4+juAY+Nx/e9Vv0F0=";
+    sha256 = "sha256-IgV1ULxwL17ECsm7MdRfQERcEVy9cEft2L7fHP3XCKo=";
  };

  vendorSha256 = "sha256-/rhV7JHuqejCTizcjKIkaJlbRcx7AfMcGqQYo6dlg48=";
--- a/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
@ -13,9 +13,9 @@
 # https://github.com/dmacvicar/terraform-provider-libvirt/tree/main/examples

 let
-  sha256 = "sha256-8GGPd0+qdw7s4cr0RgLoS0Cu4C+RAuuboZzTyYN/kq8=";
-  vendorSha256 = "sha256-fpO2sGM+VUKLmdfJ9CQfTFnCfxVTK2m9Sirj9oerD/I=";
-  version = "0.6.11";
+  sha256 = "sha256-1l+ARrXHxtSdnQfYV/6gw3BYHVH8NN4pi+Ttk1nwF88=";
+  vendorSha256 = "sha256-OJa8pQgf5PlECZZkFV9fyCOdh6CrregY1BWycx7JPFE=";
+  version = "0.6.12";
 in buildGoModule {
  inherit version;
  inherit vendorSha256;
@ -41,7 +41,7 @@ in buildGoModule {
  # Terraform allow checking the provider versions, but this breaks
  # if the versions are not provided via file paths.
  postBuild = "mv $GOPATH/bin/terraform-provider-libvirt{,_v${version}}";
-  
+
  ldflags = [ "-X main.version=${version}" ];
  passthru.provider-source-address = "registry.terraform.io/dmacvicar/libvirt";

@ -50,7 +50,6 @@ in buildGoModule {
  meta = with lib; {
    homepage = "https://github.com/dmacvicar/terraform-provider-libvirt";
    description = "Terraform provider for libvirt";
-    platforms = platforms.linux;
    license = licenses.asl20;
    maintainers = with maintainers; [ mic92 ];
  };
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -1129,10 +1129,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/vault",
    "repo": "terraform-provider-vault",
-    "rev": "v3.0.1",
-    "sha256": "0ppx8kc4zf0yp09vbkmj875sqvklbx0p8a1ganpzdm3462zskra4",
-    "vendorSha256": "03l8bk9jsqf4c7gv0hs1rli7wmlcvpdxmxhra9vndnz6g0jvkvyx",
-    "version": "3.0.1"
+    "rev": "v3.1.1",
+    "sha256": "15fwc0sfdpcl85194gq6r97y18ggh61wbyh6lq7nrprwn2xvjch9",
+    "vendorSha256": "1q2yfmg6g3bl6h0vzanz7874xc4g7ggmysh2dqryijvr4kccnari",
+    "version": "3.1.1"
  },
  "vcd": {
    "owner": "terraform-providers",
--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@ -4,7 +4,7 @@ with ocamlPackages;

 buildDunePackage rec {
  pname = "jackline";
-  version = "unstable-2021-08-10";
+  version = "unstable-2021-12-28";

  minimumOCamlVersion = "4.08";

@ -13,8 +13,8 @@ buildDunePackage rec {
  src = fetchFromGitHub {
    owner  = "hannesm";
    repo   = "jackline";
-    rev    = "73d87e9a62d534566bb0fbe64990d32d75487f11";
-    sha256 = "0wk574rqfg2vqz27nasxzwf67x51pj5fgl4vkc27r741dg4q6c5a";
+    rev    = "ca1012098d123c555e9fa5244466d2e009521700";
+    sha256 = "1j1azskcdrp4g44rv3a4zylkzbzpcs23zzzrx94llbgssw6cd9ih";
  };

  nativeBuildInpts = [
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -7,7 +7,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.79.0.92";
+  version = "8.79.0.95";

  rpath = lib.makeLibraryPath [
    alsa-lib
@ -69,7 +69,7 @@ let
          "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
          "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
        ];
-        sha256 = "sha256-wGt0zNBmJf5NJGGOopWNUoBoy8sr4jWp8UKLd8AudnM=";
+        sha256 = "sha256-a6ZtgA0cMAuNVQWAeiIDJ2noPhXjV8KPE8ibkGR7Dns=";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/remote/teamviewer/default.nix
+++ b/pkgs/applications/networking/remote/teamviewer/default.nix
@ -6,11 +6,11 @@

 mkDerivation rec {
  pname = "teamviewer";
-  version = "15.24.5";
+  version = "15.25.5";

  src = fetchurl {
    url = "https://dl.tvcdn.de/download/linux/version_15x/teamviewer_${version}_amd64.deb";
-    sha256 = "sha256-u4azVjwD5xTc0vWe8tDEx44rBdYFZljZPVQ0yilqeR0=";
+    sha256 = "sha256-LtITPS0bLy85dv/zdOo8JcsEZ0ZgtVmM+CcggaYJxXA=";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -10,7 +10,7 @@ assert withQt  -> qt5  != null;
 with lib;

 let
-  version = "3.4.10";
+  version = "3.6.1";
  variant = if withQt then "qt" else "cli";

 in stdenv.mkDerivation {
@ -20,7 +20,7 @@ in stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "sha256-iqfvSkSuYruNtGPPdh4swDuXMF4Od+1b5T+oNykYfO8=";
+    sha256 = "sha256-BDTtqPtr+I4rQqZ+tdHeJUpn1QW+w7tR/unXyteSWjg=";
  };

  cmakeFlags = [
@ -67,18 +67,18 @@ in stdenv.mkDerivation {
        done
    done
  '' else optionalString withQt ''
-    install -Dm644 -t $out/share/applications ../wireshark.desktop
+    install -Dm644 -t $out/share/applications ../org.wireshark.Wireshark.desktop

    install -Dm644 ../image/wsicon.svg $out/share/icons/wireshark.svg
-    mkdir $dev/include/{epan/{wmem,ftypes,dfilter},wsutil,wiretap} -pv
+    mkdir $dev/include/{epan/{wmem,ftypes,dfilter},wsutil/wmem,wiretap} -pv

    cp config.h $dev/include/wireshark/
    cp ../ws_*.h $dev/include
    cp ../epan/*.h $dev/include/epan/
-    cp ../epan/wmem/*.h $dev/include/epan/wmem/
    cp ../epan/ftypes/*.h $dev/include/epan/ftypes/
    cp ../epan/dfilter/*.h $dev/include/epan/dfilter/
    cp ../wsutil/*.h $dev/include/wsutil/
+    cp ../wsutil/wmem/*.h $dev/include/wsutil/wmem/
    cp ../wiretap/*.h $dev/include/wiretap
  '');

--- a/pkgs/applications/networking/sniffers/wireshark/wireshark-lookup-dumpcap-in-path.patch
+++ b/pkgs/applications/networking/sniffers/wireshark/wireshark-lookup-dumpcap-in-path.patch
@ -11,16 +11,18 @@ Also change execv() to execvp() because we've set argv[0] to "dumpcap"
 and have to enable PATH lookup. Wireshark is not a setuid program, so
 looking in PATH is not a security issue.

+EDITED by teto for wireshark 3.6
+
 Signed-off-by: Franz Pletz <fpletz@fnordicwalking.de>
 ---
 capchild/capture_sync.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

 diff --git a/capchild/capture_sync.c b/capchild/capture_sync.c
-index 970688e..49914d5 100644
--- a/capchild/capture_sync.c
-+++ b/capchild/capture_sync.c
-@@ -332,7 +332,18 @@ init_pipe_args(int *argc) {
+index f31914886a..df29b6f0ab 100644
+--- a/capture/capture_sync.c
+++ b/capture/capture_sync.c
+@@ -187,7 +187,18 @@ init_pipe_args(int *argc) {
 #ifdef _WIN32
     exename = g_strdup_printf("%s\\dumpcap.exe", progfile_dir);
 #else
@ -40,7 +42,7 @@ index 970688e..49914d5 100644
 #endif
 
     /* Make that the first argument in the argument list (argv[0]). */
-@@ -729,7 +740,7 @@ sync_pipe_start(capture_options *capture_opts, capture_session *cap_session, voi
+@@ -572,7 +583,7 @@ sync_pipe_start(capture_options *capture_opts, capture_session *cap_session, inf
          */
         dup2(sync_pipe[PIPE_WRITE], 2);
         ws_close(sync_pipe[PIPE_READ]);
@ -49,7 +51,7 @@ index 970688e..49914d5 100644
         g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
                    argv[0], g_strerror(errno));
         sync_pipe_errmsg_to_parent(2, errmsg, "");
-@@ -997,7 +1008,7 @@ sync_pipe_open_command(char** argv, int *data_read_fd,
+@@ -811,7 +822,7 @@ sync_pipe_open_command(char* const argv[], int *data_read_fd,
         dup2(sync_pipe[PIPE_WRITE], 2);
         ws_close(sync_pipe[PIPE_READ]);
         ws_close(sync_pipe[PIPE_WRITE]);
@ -58,6 +60,3 @@ index 970688e..49914d5 100644
         g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
                    argv[0], g_strerror(errno));
         sync_pipe_errmsg_to_parent(2, errmsg, "");
-- 
-2.6.3
-
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@ -1,15 +1,12 @@
-{ stdenv , lib , fetchurl , appimageTools , makeWrapper , electron_11 }:
+{ stdenv , lib , fetchurl , appimageTools , makeWrapper , electron }:

-let
-  electron = electron_11;
-in
 stdenv.mkDerivation rec {
  pname = "super-productivity";
-  version = "7.6.0";
+  version = "7.9.1";

  src = fetchurl {
    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "f02a451a44f48a8e85a0c1269625d89fb1e0b8a75b7e217d96352064e6464ae5";
+    sha256 = "sha256:0lxnl5ai23dwfsyrkpi9l1a0gl0qn6vp7hzmca77nyx974d6j8m4";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@ -24,13 +24,13 @@ assert !(pulseaudioSupport && portaudioSupport);

 gnuradio3_8Minimal.pkgs.mkDerivation rec {
  pname = "gqrx";
-  version = "2.15";
+  version = "2.15.1";

  src = fetchFromGitHub {
    owner = "gqrx-sdr";
    repo = "gqrx";
    rev = "v${version}";
-    sha256 = "sha256-m3YV5Hbu5+3eS+LOy+x6HjpdiJo1iObbeEKuQXXmAak=";
+    sha256 = "sha256-OL83l3A27rggfGbfLT1CUaPAQHEKXgoGS1jYJZ9eHPQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/urh/default.nix
+++ b/pkgs/applications/radio/urh/default.nix
@ -1,5 +1,6 @@
 { lib, fetchFromGitHub, python3Packages
 , hackrf, rtl-sdr, airspy, limesuite, libiio
+, libbladeRF
 , qt5
 , USRPSupport ? false, uhd }:

@ -15,7 +16,7 @@ python3Packages.buildPythonApplication rec {
  };

  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
-  buildInputs = [ hackrf rtl-sdr airspy limesuite libiio ]
+  buildInputs = [ hackrf rtl-sdr airspy limesuite libiio libbladeRF ]
    ++ lib.optional USRPSupport uhd;

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@ -6,13 +6,13 @@

 mkDerivation rec {
  pname = "stellarium";
-  version = "0.21.2";
+  version = "0.21.3";

  src = fetchFromGitHub {
    owner = "Stellarium";
    repo = "stellarium";
    rev = "v${version}";
-    sha256 = "sha256-bh00o++l3sqELX5kgRhiCcQOLVqvjEyEMcJTnnVPNU8=";
+    sha256 = "sha256-TQMLy5ziBF7YqPDzPwgjY5FHxxMUe7MXo/TGxQ1nGcg=";
  };

  nativeBuildInputs = [ cmake perl wrapQtAppsHook ];
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@ -17,14 +17,14 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "14.32.2";
+  version = "14.32.6";
  pname = "jmol";

  src = let
    baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
  in fetchurl {
    url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-JETS1mxlDyWPC8ngtmYujmfWIdrW9HzkqpX/VZpIMBE=";
+    sha256 = "sha256-b9E/IJfqeA8rBSQogb/ZVBMW3y9bc2dBj/BIl0HWFR8=";
  };

  patchPhase = ''
--- a/pkgs/applications/science/math/singular/default.nix
+++ b/pkgs/applications/science/math/singular/default.nix
@ -47,12 +47,13 @@ stdenv.mkDerivation rec {
  };

  patches = [
+    # fix timeouts when docbuilding with >= 64 cpus
+    # https://github.com/Singular/Singular/issues/1117
+    ./vspace-MAX_PROCESS.patch
+
    # add aarch64 support to cpu-check.m4. copied from redhat.
    ./redhat-aarch64.patch

-    # vspace causes hangs in modstd and other libraries on aarch64
-    ./disable-vspace-on-aarch64.patch
-
    # the newest version of ax-prog-cc-for-build.m4 seems to trigger
    # linker errors. see
    # https://github.com/alsa-project/alsa-firmware/issues/3 for a
--- a/pkgs/applications/science/math/singular/disable-vspace-on-aarch64.patch
+++ b/pkgs/applications/science/math/singular/disable-vspace-on-aarch64.patch
@ -1,15 +0,0 @@
-diff --git a/kernel/mod2.h b/kernel/mod2.h
-index 867fcae47..2abd84f23 100644
--- a/kernel/mod2.h
-+++ b/kernel/mod2.h
-@@ -60,8 +60,10 @@
- 
- /* define for parallel processes with shared memory */
- #ifndef __CCYGWIN__
-+#ifndef SI_CPU_AARCH64
- #define HAVE_VSPACE 1
- #endif
-+#endif
- 
- /*#define PROFILING*/
- #ifdef PROFILING
--- a/pkgs/applications/science/math/singular/vspace-MAX_PROCESS.patch
+++ b/pkgs/applications/science/math/singular/vspace-MAX_PROCESS.patch
@ -0,0 +1,35 @@
+diff --git a/kernel/GBEngine/kChinese.cc b/kernel/GBEngine/kChinese.cc
+index 829a66609..84655caf2 100644
+--- a/kernel/GBEngine/kChinese.cc
+++ b/kernel/GBEngine/kChinese.cc
+@@ -209,6 +209,8 @@ ideal id_ChineseRemainder_0(ideal *xx, number *q, int rl, const ring r)
+     return NULL;
+   }
+   int cpus=(int)(long)feOptValue(FE_OPT_CPUS);
+  if (cpus>=vspace::internals::MAX_PROCESS)
+    cpus=vspace::internals::MAX_PROCESS-1;
+   if ((cpus==1) || (2*cpus>=cnt))
+     /* at least 2 polys for each process, or switch to seriell version */
+     return id_ChineseRemainder(xx,q,rl,r);
+@@ -295,6 +297,8 @@ ideal id_Farey_0(ideal x, number N, const ring r)
+ {
+   int cnt=IDELEMS(x)*x->nrows;
+   int cpus=(int)(long)feOptValue(FE_OPT_CPUS);
+  if (cpus>=vspace::internals::MAX_PROCESS)
+    cpus=vspace::internals::MAX_PROCESS-1;
+   if (2*cpus>=cnt) /* at least 2 polys for each process, 
+                      or switch to seriell version */
+     return id_Farey(x,N,r);
+diff --git a/kernel/GBEngine/kverify.cc b/kernel/GBEngine/kverify.cc
+index 909d84994..aa06d6624 100644
+--- a/kernel/GBEngine/kverify.cc
+++ b/kernel/GBEngine/kverify.cc
+@@ -176,6 +176,8 @@ BOOLEAN kVerify2(ideal F, ideal Q)
+   /*---------------------------------------------------------------------*/
+   BOOLEAN all_okay=TRUE;
+   int cpus=(int)(long)feOptValue(FE_OPT_CPUS);
+  if (cpus>=vspace::internals::MAX_PROCESS)
+    cpus=vspace::internals::MAX_PROCESS-1;
+   int parent_pid=getpid();
+   using namespace vspace;
+   vmem_init();
--- a/pkgs/applications/version-management/git-and-tools/git-chglog/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-chglog/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "git-chglog";
-  version = "0.15.0";
+  version = "0.15.1";

  src = fetchFromGitHub {
    owner = "git-chglog";
    repo = "git-chglog";
    rev = "v${version}";
-    sha256 = "sha256-BiTnPCgymfpPxuy0i8u7JbpbEBeaSIJaikjwsPSA3qc=";
+    sha256 = "sha256-UlhJ004ceXpdB/9296cL2sbBYsjV8D+3YS1vmFgnko8=";
  };

-  vendorSha256 = "sha256-jIq+oacyT71m78iMZwWOBsBVAY/WxgyH9zRr8GiMGTU=";
+  vendorSha256 = "sha256-FLFPcmkrhZ+/UX1xpexsDv3cgC/Ocj4qTFJOX+rmdyQ=";

  ldflags = [ "-s" "-w" "-X=main.Version=v${version}" ];

--- a/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-cliff";
-  version = "0.4.2";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = "git-cliff";
    rev = "v${version}";
-    sha256 = "sha256-FCBNm51QI1jDdq2BZFwZA1kpIfXIvh1ickmY3ZqwGPY=";
+    sha256 = "sha256-1ScZ8pxRN/Eot/Q+HWbWOgDWBmVLjqtPeftRsNQIJEI=";
  };

-  cargoSha256 = "sha256-CBCyujJHWTatJO+Tk6MyOk12B0cY1JSwLQizjcXeQzQ=";
+  cargoSha256 = "sha256-FMlJn/mVcrHhu3gGISb1e7D2mVAocccqXRYZnMVNPqA=";

  # attempts to run the program on .git in src which is not deterministic
  doCheck = false;
--- a/pkgs/applications/video/kodi/addons/inputstream-rtmp/default.nix
+++ b/pkgs/applications/video/kodi/addons/inputstream-rtmp/default.nix
@ -3,13 +3,13 @@
 buildKodiBinaryAddon rec {
  pname = "inputstream-rtmp";
  namespace = "inputstream.rtmp";
-  version = "19.0.0";
+  version = "19.0.1";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = "inputstream.rtmp";
    rev = "${version}-${rel}";
-    sha256 = "sha256-76yGttcLJJ5XJKsFJ3GnEuPs9+9J0Tr8Znm45676OI8=";
+    sha256 = "sha256-BNc9HJ4Yq1WTxTr7AUHBB9yDz8oefy2EtFRwVYVGcaY=";
  };

  extraBuildInputs = [ openssl rtmpdump zlib ];
--- a/pkgs/applications/video/qmplay2/default.nix
+++ b/pkgs/applications/video/qmplay2/default.nix
@ -22,13 +22,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "qmplay2";
-  version = "21.12.07";
+  version = "21.12.24";

  src = fetchFromGitHub {
    owner = "zaps166";
    repo = "QMPlay2";
    rev = version;
-    sha256 = "sha256-iFT88CTz7L7tnNmpe/HaeTrHiE8l0Jk+r0c6O7wJ7N8=";
+    sha256 = "sha256-SHReKh+M1rgSIiweYFgVvwMeKWeQD52S4KxEiTsyHrI=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/video/xine-ui/default.nix
+++ b/pkgs/applications/video/xine-ui/default.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "xine-ui";
-  version = "0.99.12";
+  version = "0.99.13";

  src = fetchurl {
    url = "mirror://sourceforge/xine/${pname}-${version}.tar.xz";
-    sha256 = "10zmmss3hm8gjjyra20qhdc0lb1m6sym2nb2w62bmfk8isfw9gsl";
+    sha256 = "sha256-sjgtB1xysbEAOeDpAxDMhsjZEDWMU1We2C09WEIB9cU=";
  };

  nativeBuildInputs = [
--- a/pkgs/build-support/build-dotnet-module/default.nix
+++ b/pkgs/build-support/build-dotnet-module/default.nix
@ -117,40 +117,42 @@ let
    DOTNET_NOLOGO = true; # This disables the welcome message.
    DOTNET_CLI_TELEMETRY_OPTOUT = true;

-    passthru.fetch-deps = args.passthru.fetch-deps or writeScript "fetch-${args.pname}-deps" ''
-      set -euo pipefail
-      cd "$(dirname "''${BASH_SOURCE[0]}")"
+    passthru = {
+      fetch-deps = writeScript "fetch-${args.pname}-deps" ''
+        set -euo pipefail
+        cd "$(dirname "''${BASH_SOURCE[0]}")"

-      export HOME=$(mktemp -d)
-      deps_file="/tmp/${args.pname}-deps.nix"
+        export HOME=$(mktemp -d)
+        deps_file="/tmp/${args.pname}-deps.nix"

-      store_src="${package.src}"
-      src="$(mktemp -d /tmp/${args.pname}.XXX)"
-      cp -rT "$store_src" "$src"
-      chmod -R +w "$src"
+        store_src="${package.src}"
+        src="$(mktemp -d /tmp/${args.pname}.XXX)"
+        cp -rT "$store_src" "$src"
+        chmod -R +w "$src"

-      trap "rm -rf $src $HOME" EXIT
-      pushd "$src"
+        trap "rm -rf $src $HOME" EXIT
+        pushd "$src"

-      export DOTNET_NOLOGO=1
-      export DOTNET_CLI_TELEMETRY_OPTOUT=1
+        export DOTNET_NOLOGO=1
+        export DOTNET_CLI_TELEMETRY_OPTOUT=1

-      mkdir -p "$HOME/nuget_pkgs"
+        mkdir -p "$HOME/nuget_pkgs"

-      for project in "${lib.concatStringsSep "\" \"" ((lib.toList projectFile) ++ lib.optionals (testProjectFile != "") (lib.toList testProjectFile))}"; do
-        ${dotnet-sdk}/bin/dotnet restore "$project" \
-          ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
-          -p:ContinuousIntegrationBuild=true \
-          -p:Deterministic=true \
-          --packages "$HOME/nuget_pkgs" \
-          "''${dotnetRestoreFlags[@]}" \
-          "''${dotnetFlags[@]}"
-      done
+        for project in "${lib.concatStringsSep "\" \"" ((lib.toList projectFile) ++ lib.optionals (testProjectFile != "") (lib.toList testProjectFile))}"; do
+          ${dotnet-sdk}/bin/dotnet restore "$project" \
+            ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
+            -p:ContinuousIntegrationBuild=true \
+            -p:Deterministic=true \
+            --packages "$HOME/nuget_pkgs" \
+            "''${dotnetRestoreFlags[@]}" \
+            "''${dotnetFlags[@]}"
+        done

-      echo "Writing lockfile..."
-      ${nuget-to-nix}/bin/nuget-to-nix "$HOME/nuget_pkgs" > "$deps_file"
-      echo "Succesfully wrote lockfile to: $deps_file"
-    '';
+        echo "Writing lockfile..."
+        ${nuget-to-nix}/bin/nuget-to-nix "$HOME/nuget_pkgs" > "$deps_file"
+        echo "Succesfully wrote lockfile to: $deps_file"
+      '';
+    } // args.passthru or {};

    configurePhase = args.configurePhase or ''
      runHook preConfigure
--- a/pkgs/build-support/node/fetch-yarn-deps/index.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/index.js
@ -9,6 +9,7 @@ const child_process = require('child_process')
 const path = require('path')
 const lockfile = require('./yarnpkg-lockfile.js')
 const { promisify } = require('util')
+const url = require('url')

 const execFile = promisify(child_process.execFile)

@ -21,15 +22,15 @@ const exec = async (...args) => {
 // This has to match the logic in pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
 // so that fixup_yarn_lock produces the same paths
 const urlToName = url => {
-  const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
+	const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')

-  if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
-    return path.basename(url)
-  } else {
-    return url
-      .replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
-      .replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
-  }
+	if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
+		return path.basename(url)
+	} else {
+		return url
+			.replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
+			.replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
+	}
 }

 const downloadFileHttps = (fileName, url, expectedHash) => {
@ -72,6 +73,23 @@ const downloadGit = async (fileName, url, rev) => {
 	await exec('rm', [ '-rf', fileName + '.tmp', ])
 }

+const isGitUrl = pattern => {
+	// https://github.com/yarnpkg/yarn/blob/3119382885ea373d3c13d6a846de743eca8c914b/src/resolvers/exotics/git-resolver.js#L15-L47
+	const GIT_HOSTS = ['github.com', 'gitlab.com', 'bitbucket.com', 'bitbucket.org']
+	const GIT_PATTERN_MATCHERS = [/^git:/, /^git\+.+:/, /^ssh:/, /^https?:.+\.git$/, /^https?:.+\.git#.+/]
+
+	for (const matcher of GIT_PATTERN_MATCHERS) if (matcher.test(pattern)) return true
+
+	const {hostname, path} = url.parse(pattern)
+	if (hostname && path && GIT_HOSTS.indexOf(hostname) >= 0
+		// only if dependency is pointing to a git repo,
+		// e.g. facebook/flow and not file in a git repo facebook/flow/archive/v1.0.0.tar.gz
+		&& path.split('/').filter(p => !!p).length === 2
+	) return true
+
+	return false
+}
+
 const downloadPkg = (pkg, verbose) => {
 	const [ url, hash ] = pkg.resolved.split('#')
 	if (verbose) console.log('downloading ' + url)
@ -79,12 +97,10 @@ const downloadPkg = (pkg, verbose) => {
 	if (url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')) {
 		const s = url.split('/')
 		downloadGit(fileName, `https://github.com/${s[3]}/${s[4]}.git`, s[6])
+	} else if (isGitUrl(url)) {
+		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
 	} else if (url.startsWith('https://')) {
 		return downloadFileHttps(fileName, url, hash)
-	} else if (url.startsWith('git:')) {
-		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
-	} else if (url.startsWith('git+')) {
-		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
 	} else if (url.startsWith('file:')) {
 		console.warn(`ignoring unsupported file:path url "${url}"`)
 	} else {
--- a/pkgs/development/compilers/carp/default.nix
+++ b/pkgs/development/compilers/carp/default.nix
@ -2,13 +2,13 @@

 haskellPackages.mkDerivation rec {
  pname = "carp";
-  version = "0.5.3";
+  version = "0.5.4";

  src = fetchFromGitHub {
    owner = "carp-lang";
    repo = "Carp";
    rev = "v${version}";
-    sha256 = "08ryk30ii24qsdpdq7bqi406ynv9nr8zy2pcv9n70ar8fxfw0859";
+    sha256 = "sha256-o7NLd7jC1BvcoVzbD18LvHg/SqOnfn9yELUrpg2uZtY=";
  };

  buildTools = [ makeWrapper ];
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@ -1,10 +1,13 @@
 { lib, stdenv, pkgs
-, haskell, haskellPackages, nodejs
+, haskell, haskellPackages, nodejs-14_x
 , fetchurl, fetchpatch, makeWrapper, writeScriptBin
  # Rust dependecies
 , curl, rustPlatform, openssl, pkg-config, Security, darwin
 }:
 let
+  # To controll nodejs version we pass down
+  nodejs = nodejs-14_x;
+
  fetchElmDeps = import ./fetchElmDeps.nix { inherit stdenv lib fetchurl; };

  hsPkgs = haskellPackages.override {
--- a/pkgs/development/compilers/elm/packages/generate-node-packages.sh
+++ b/pkgs/development/compilers/elm/packages/generate-node-packages.sh
@ -4,9 +4,7 @@ ROOT="$(realpath "$(dirname -- "$(readlink -f -- "${BASH_SOURCE[0]}")")"/../../.

 set -eu -o pipefail

-rm -f node-env.nix
 $(nix-build $ROOT -A nodePackages.node2nix --no-out-link)/bin/node2nix \
-    --nodejs-12 \
    -i node-packages.json \
    -o node-packages.nix \
    -c node-composition.nix \
--- a/pkgs/development/compilers/elm/packages/node-packages.nix
+++ b/pkgs/development/compilers/elm/packages/node-packages.nix
--- a/pkgs/development/compilers/fstar/default.nix
+++ b/pkgs/development/compilers/fstar/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "fstar";
-  version = "2021.11.27";
+  version = "2021.12.25";

  src = fetchFromGitHub {
    owner = "FStarLang";
    repo = "FStar";
    rev = "v${version}";
-    sha256 = "sha256-OpY7vDb37ym4srsmD+deXiuofUJKRyKXG7g3zsJKvHo=";
+    sha256 = "RmXKv/admC1w26z/ClNhH11J8n87WTfDr2lYOF6Fx7I=";
  };

  nativeBuildInputs = [ makeWrapper installShellFiles ];
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "gleam";
-  version = "0.18.0";
+  version = "0.18.2";

  src = fetchFromGitHub {
    owner = "gleam-lang";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-S7PYN0iiSXEApIG0Tyb/PJmKjHzjz3S+ToDy+pwPK18=";
+    sha256 = "sha256-uakZmaIkBgC/FTQ7us58pJT6IzpcF1cQxBfehlB3bWk=";
  };

  nativeBuildInputs = [ pkg-config ];
@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl ] ++
    lib.optionals stdenv.isDarwin [ Security libiconv ];

-  cargoSha256 = "sha256-Q5WyKQ4HFOIL1KAQ0QvAbZfy+WRAWf9HxSvSabSz4W4=";
+  cargoSha256 = "sha256-NogDrd7YWl/CV0aCd1jfYWYB9VZG7u890VLEktI3sOQ=";

  meta = with lib; {
    description = "A statically typed language for the Erlang VM";
--- a/pkgs/development/coq-modules/semantics/default.nix
+++ b/pkgs/development/coq-modules/semantics/default.nix
@ -6,6 +6,7 @@ mkCoqDerivation rec {
  owner = "coq-community";
  releaseRev = v: "v${v}";

+  release."8.14.0".sha256 = "sha256-TB12C3hX9XucbsXr+UL+8jM19NOFXASW/lcytwy6uVE=";
  release."8.13.0".sha256 = "sha256-8bDr/Ovl6s8BFaRcHeS5H33/K/pYdeKfSN+krVuKulQ=";
  release."8.11.1".sha256 = "sha256-jTPgcXSNn1G2mMDC7ocFcmqs8svB7Yo1emXP15iuxiU=";
  release."8.9.0".sha256 = "sha256-UBsvzlDEZsZsVkbUI0GbFEhpxnnLCiaqlqDyWVC5I6s=";
@ -15,7 +16,7 @@ mkCoqDerivation rec {

  inherit version;
  defaultVersion = with versions; switch coq.coq-version [
-    { case = range "8.10" "8.13"; out = "8.13.0"; }
+    { case = range "8.10" "8.14"; out = "8.14.0"; }
    { case = "8.9"; out = "8.9.0"; }
    { case = "8.8"; out = "8.8.0"; }
    { case = "8.7"; out = "8.7.0"; }
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "babashka";
-  version = "0.7.0";
+  version = "0.7.3";

  src = fetchurl {
    url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-zSjiHacetJ68U0GciIbuGET9I/51EM8JnPPUGemDfEI=";
+    sha256 = "sha256-zbxFMc02hbsU2ERlUzqMBHwHYfORB7TkMINrKC52PPU=";
  };

  executable = "bb";
--- a/pkgs/development/interpreters/kona/default.nix
+++ b/pkgs/development/interpreters/kona/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "kona";
-  version = "20201009";
+  version = "20211225";

  src = fetchFromGitHub {
    owner = "kevinlawler";
    repo = "kona";
    rev = "Win64-${version}";
-    sha256 = "0v252zds61y01cf29hxznz1zc1724vxmzy059k9jiri4r73k679v";
+    sha256 = "sha256-m3a9conyKN0qHSSAG8zAb3kx8ir+7dqgxm1XGjCQcfk=";
  };

  makeFlags = [ "PREFIX=$(out)" ];
--- a/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/pkgs/development/libraries/intel-gmmlib/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-gmmlib";
-  version = "21.3.3";
+  version = "22.0.1";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "gmmlib";
    rev = "intel-gmmlib-${version}";
-    sha256 = "0hvly3fykhy4m7mzaa7xadaz7jz8krnfgj3zgzl2a2rpzja6frdn";
+    sha256 = "1s46vwcs26hdlsa8h51gq4fyi9i8k5hrcx5ffbv9g7v3x706nplf";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@ -7,13 +7,14 @@
 , libva
 , libpciaccess
 , intel-gmmlib
+, libdrm
 , enableX11 ? stdenv.isLinux
 , libX11
 }:

 stdenv.mkDerivation rec {
  pname = "intel-media-driver";
-  version = "21.4.3";
+  version = "22.1.0";

  outputs = [ "out" "dev" ];

@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
    owner = "intel";
    repo = "media-driver";
    rev = "intel-media-${version}";
-    sha256 = "04r03f48j1nly0j6aq8017va9m3yrnscv6lbrvf3a98fpwk9gc1l";
+    sha256 = "0giba5274kzpjb5rp3d9bbnvcz7fp8ybi4s3hha2idxk0l5yamf1";
  };

  patches = [
@ -43,7 +44,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake pkg-config ];

-  buildInputs = [ libva libpciaccess intel-gmmlib ]
+  buildInputs = [ libva libpciaccess intel-gmmlib libdrm ]
    ++ lib.optional enableX11 libX11;

  postFixup = lib.optionalString enableX11 ''
--- a/pkgs/development/libraries/jemalloc/common.nix
+++ b/pkgs/development/libraries/jemalloc/common.nix
@ -1,59 +0,0 @@
-{ version, sha256 }:
-{ lib, stdenv, fetchurl
-, fetchpatch
-# By default, jemalloc puts a je_ prefix onto all its symbols on OSX, which
-# then stops downstream builds (mariadb in particular) from detecting it. This
-# option should remove the prefix and give us a working jemalloc.
-# Causes segfaults with some software (ex. rustc), but defaults to true for backward
-# compatibility.
-, stripPrefix ? stdenv.hostPlatform.isDarwin
-, disableInitExecTls ? false
-}:
-
-with lib;
-
-stdenv.mkDerivation rec {
-  pname = "jemalloc";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://github.com/jemalloc/jemalloc/releases/download/${version}/${pname}-${version}.tar.bz2";
-    inherit sha256;
-  };
-
-  patches = [
-    # workaround https://github.com/jemalloc/jemalloc/issues/2091
-    (fetchpatch {
-      url = "https://github.com/jemalloc/jemalloc/commit/3b4a03b92b2e415415a08f0150fdb9eeb659cd52.diff";
-      sha256 = "sha256-6AYtADREhfj93ZLk9xnXtjc6vHDU0EKLLOvLd6YdJeI=";
-    })
-  ];
-
-  # see the comment on stripPrefix
-  configureFlags = []
-    ++ optional stripPrefix "--with-jemalloc-prefix="
-    ++ optional disableInitExecTls "--disable-initial-exec-tls"
-    # jemalloc is unable to correctly detect transparent hugepage support on
-    # ARM (https://github.com/jemalloc/jemalloc/issues/526), and the default
-    # kernel ARMv6/7 kernel does not enable it, so we explicitly disable support
-    ++ optionals (stdenv.isAarch32 && versionOlder version "5") [
-      "--disable-thp"
-      "je_cv_thp=no"
-    ]
-  ;
-
-  doCheck = true;
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    homepage = "http://jemalloc.net";
-    description = "General purpose malloc(3) implementation";
-    longDescription = ''
-      malloc(3)-compatible memory allocator that emphasizes fragmentation
-      avoidance and scalable concurrency support.
-    '';
-    license = licenses.bsd2;
-    platforms = platforms.all;
-  };
-}
--- a/pkgs/development/libraries/jemalloc/default.nix
+++ b/pkgs/development/libraries/jemalloc/default.nix
@ -1,4 +1,58 @@
-import ./common.nix {
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+# By default, jemalloc puts a je_ prefix onto all its symbols on OSX, which
+# then stops downstream builds (mariadb in particular) from detecting it. This
+# option should remove the prefix and give us a working jemalloc.
+# Causes segfaults with some software (ex. rustc), but defaults to true for backward
+# compatibility.
+, stripPrefix ? stdenv.hostPlatform.isDarwin
+, disableInitExecTls ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "jemalloc";
  version = "5.2.1";
-  sha256 = "1xl7z0vwbn5iycg7amka9jd6hxd8nmfk7nahi4p9w2bnw9f0wcrl";
+
+  src = fetchurl {
+    url = "https://github.com/jemalloc/jemalloc/releases/download/${version}/${pname}-${version}.tar.bz2";
+    sha256 = "1xl7z0vwbn5iycg7amka9jd6hxd8nmfk7nahi4p9w2bnw9f0wcrl";
+  };
+
+  patches = [
+    # workaround https://github.com/jemalloc/jemalloc/issues/2091
+    (fetchpatch {
+      url = "https://github.com/jemalloc/jemalloc/commit/3b4a03b92b2e415415a08f0150fdb9eeb659cd52.diff";
+      sha256 = "sha256-6AYtADREhfj93ZLk9xnXtjc6vHDU0EKLLOvLd6YdJeI=";
+    })
+  ];
+
+  # see the comment on stripPrefix
+  configureFlags = []
+    ++ lib.optional stripPrefix "--with-jemalloc-prefix="
+    ++ lib.optional disableInitExecTls "--disable-initial-exec-tls"
+    # jemalloc is unable to correctly detect transparent hugepage support on
+    # ARM (https://github.com/jemalloc/jemalloc/issues/526), and the default
+    # kernel ARMv6/7 kernel does not enable it, so we explicitly disable support
+    ++ lib.optionals (stdenv.isAarch32 && lib.versionOlder version "5") [
+      "--disable-thp"
+      "je_cv_thp=no"
+    ]
+  ;
+
+  doCheck = true;
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "http://jemalloc.net";
+    description = "General purpose malloc(3) implementation";
+    longDescription = ''
+      malloc(3)-compatible memory allocator that emphasizes fragmentation
+      avoidance and scalable concurrency support.
+    '';
+    license = licenses.bsd2;
+    platforms = platforms.all;
+  };
 }
--- a/pkgs/development/libraries/jemalloc/jemalloc450.nix
+++ b/pkgs/development/libraries/jemalloc/jemalloc450.nix
@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "4.5.0";
-  sha256 = "10373xhpc10pgmai9fkc1z0rs029qlcb3c0qfnvkbwdlcibdh2cl";
-}
--- a/pkgs/development/libraries/libb64/default.nix
+++ b/pkgs/development/libraries/libb64/default.nix
@ -19,7 +19,11 @@ stdenv.mkDerivation rec {
      url = "https://github.com/libb64/libb64/commit/4fe47c052e9123da8f751545deb48be08c3411f6.patch";
      sha256 = "18b3np3gpyzimqmk6001riqv5n70wfbclky6zzsrvj5zl1dj4ljf";
    })
-  ];
+  ] ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) (fetchpatch {
+    name = "0001-example-Do-not-run-the-tests.patch";
+    url = "https://cgit.openembedded.org/meta-openembedded/plain/meta-oe/recipes-support/libb64/libb64/0001-example-Do-not-run-the-tests.patch?id=484e0de1e4ee107f21ae2a5c5f976ed987978baf";
+    sha256 = "sha256-KTsiIWJe66BKlu/A43FWfW0XAu4E7lWX/RY4NITRrm4=";
+  });

  enableParallelBuilding = true;

--- a/pkgs/development/libraries/libplctag/default.nix
+++ b/pkgs/development/libraries/libplctag/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "libplctag";
-  version = "2.4.7";
+  version = "2.4.8";

  src = fetchFromGitHub {
    owner = "libplctag";
    repo = "libplctag";
    rev = "v${version}";
-    sha256 = "sha256-DLx9VBmyn5L30i6qPK4LD+3cOo7zG2YLOui6+krU9So=";
+    sha256 = "sha256-GVYG+ioqGo0k6ClrJu2mijtuBBFc9l6dNexNDNyh5+8=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/ndn-cxx/default.nix
+++ b/pkgs/development/libraries/ndn-cxx/default.nix
@ -1,11 +1,12 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , doxygen
 , pkg-config
 , python3
 , python3Packages
 , wafHook
-, boost
+, boost175
 , openssl
 , sqlite
 }:
@ -18,19 +19,28 @@ stdenv.mkDerivation rec {
    owner = "named-data";
    repo = "ndn-cxx";
    rev = "${pname}-${version}";
-    sha256 = "1lcaqc79n3d9sip7knddblba17sz18b0w7nlxmj3fz3lb3z9qd51";
+    sha256 = "sha256-oTSc/lh0fDdk7dQeDhYKX5+gFl2t2Xlu1KkNmw7DitE=";
  };

  nativeBuildInputs = [ doxygen pkg-config python3 python3Packages.sphinx wafHook ];

-  buildInputs = [ boost openssl sqlite ];
+  buildInputs = [ boost175 openssl sqlite ];

  wafConfigureFlags = [
    "--with-openssl=${openssl.dev}"
-    "--boost-includes=${boost.dev}/include"
-    "--boost-libs=${boost.out}/lib"
+    "--boost-includes=${boost175.dev}/include"
+    "--boost-libs=${boost175.out}/lib"
+    # "--with-tests" # disabled since upstream tests fail (Net/TestFaceUri/ParseDev Bug #3896)
  ];

+
+  doCheck = false; # disabled since upstream tests fail (Net/TestFaceUri/ParseDev Bug #3896)
+  checkPhase = ''
+    runHook preCheck
+    LD_PRELOAD=build/ndn-cxx.so build/unit-tests
+    runHook postCheck
+  '';
+
  meta = with lib; {
    homepage = "https://named-data.net/";
    description = "A Named Data Neworking (NDN) or Content Centric Networking (CCN) abstraction";
@ -49,6 +59,6 @@ stdenv.mkDerivation rec {
    '';
    license = licenses.lgpl3;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ sjmackenzie ];
+    maintainers = with maintainers; [ sjmackenzie bertof ];
  };
 }
--- a/pkgs/development/libraries/ntirpc/default.nix
+++ b/pkgs/development/libraries/ntirpc/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "ntirpc";
-  version = "3.4";
+  version = "4.0";

  src = fetchFromGitHub {
    owner = "nfs-ganesha";
    repo = "ntirpc";
    rev = "v${version}";
-    sha256 = "1xdwqyc9m4lbsgr7ll1g0f84c2h8jrfkg67cgvsp424i1a7r9mm1";
+    sha256 = "0hffma57b4c7g7862yvfr8bvbsbxh5w383mvjkjv3jpzi01l79yv";
  };

  postPatch = ''
--- a/pkgs/development/libraries/uid_wrapper/default.nix
+++ b/pkgs/development/libraries/uid_wrapper/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "uid_wrapper";
-  version = "1.2.8";
+  version = "1.2.9";

  src = fetchurl {
    url = "mirror://samba/cwrap/uid_wrapper-${version}.tar.gz";
-    sha256 = "0swm9d8l69dw7nbrw6xh7rdy7cfrqflw3hxshicsrhd9v03iwvqf";
+    sha256 = "sha256-fowCQHKCX+hrq0ZZHPS5CeOZz5j1SCL55SdC9CAEcIQ=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/unicorn/default.nix
+++ b/pkgs/development/libraries/unicorn/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "unicorn";
-  version = "2.0.0-rc4";
+  version = "2.0.0-rc5";

  src = fetchFromGitHub {
    owner = "unicorn-engine";
    repo = pname;
    rev = version;
-    sha256 = "sha256-dNBebXp8HVmmY1RVRYuRFoJ3PStCf4taNTeYKi2lhQM=";
+    sha256 = "1q9k8swnq4qsi54zdfaap69z56w3yj4n4ggm9pscmmmr69nply5f";
  };

  nativeBuildInputs = [ pkg-config cmake ];
--- a/pkgs/development/libraries/v8/plv8_6_x.nix
+++ b/pkgs/development/libraries/v8/plv8_6_x.nix
@ -1,189 +0,0 @@
-# NOTE: this expression is NOT exported from the top-level of all-packages.nix,
-# it is exclusively used by the 'plv8' PostgreSQL extension.
-# Since plv8 2.3.2, plv8 no longer requires this specific version, but as of
-# 2019-08-29, nixpkgs does not have v8 6.x, and v8_5 is bumped to 5.4.232, which
-# is a bit outdated.  plv8 3.x is planned to support v8 7.x
-
-{ stdenv, lib, fetchgit, fetchFromGitHub, gn, ninja, python, glib, pkg-config
-, doCheck ? false
-, snapshot ? true
-}:
-
-let
-  arch = if stdenv.isAarch32
-         then if stdenv.is64bit
-              then"arm64"
-              else "arm"
-         else if stdenv.is64bit
-              then"x64"
-              else "ia32";
-  git_url = "https://chromium.googlesource.com";
-
-  # This data is from the DEPS file in the root of a V8 checkout
-  deps = {
-    "base/trace_event/common" = fetchgit {
-      url    = "${git_url}/chromium/src/base/trace_event/common.git";
-      rev    = "0e9a47d74970bee1bbfc063c47215406f8918699";
-      sha256 = "07rbzrlscp8adh4z86yl5jxdnvgkc3xs950xldpk318wf9i3bh6c";
-    };
-    build = fetchgit {
-      url    = "${git_url}/chromium/src/build.git";
-      rev    = "9338ce52d0b9bcef34c38285fbd5023b62739fac";
-      sha256 = "1s2sa8dy3waidsirjylc82ggb18l1108bczjc8z0v4ywyj4k0cvh";
-    };
-    buildtools = fetchgit {
-      url    = "${git_url}/chromium/buildtools.git";
-      rev    = "505de88083136eefd056e5ee4ca0f01fe9b33de8";
-      sha256 = "0vj216nhb803bggsl0hnyagj8njrm96pn8sim6xcnqb7nhz1vabw";
-    };
-    "test/benchmarks/data" = fetchgit {
-      url    = "${git_url}/v8/deps/third_party/benchmarks.git";
-      rev    = "05d7188267b4560491ff9155c5ee13e207ecd65f";
-      sha256 = "0ad2ay14bn67d61ks4dmzadfnhkj9bw28r4yjdjjyzck7qbnzchl";
-    };
-    "test/mozilla/data" = fetchgit {
-      url    = "${git_url}/v8/deps/third_party/mozilla-tests.git";
-      rev    = "f6c578a10ea707b1a8ab0b88943fe5115ce2b9be";
-      sha256 = "0rfdan76yfawqxbwwb35aa57b723j3z9fx5a2w16nls02yk2kqyn";
-    };
-    "test/test262/data" = fetchgit {
-      url    = "${git_url}/external/github.com/tc39/test262.git";
-      rev    = "5d4c667b271a9b39d0de73aef5ffe6879c6f8811";
-      sha256 = "0q9iwb2nkybf9np95wgf5m372aw2lhx9wlsw41a2a80kbkvb2kqg";
-    };
-    "test/test262/harness" = fetchgit {
-      url    = "${git_url}/external/github.com/test262-utils/test262-harness-py.git";
-      rev    = "0f2acdd882c84cff43b9d60df7574a1901e2cdcd";
-      sha256 = "00brj5avp43yamc92kinba2mg3a2x1rcd7wnm7z093l73idprvkp";
-    };
-    "test/wasm-js" = fetchgit {
-      url    = "${git_url}/external/github.com/WebAssembly/spec.git";
-      rev    = "a7e226a92e660a3d5413cfea4269824f513259d2";
-      sha256 = "0z3aybj3ykajwh2bv5fwd6pwqjjsq8dnwrqc2wncb6r9xcjwbgxp";
-    };
-    "testing/gtest" = fetchgit {
-      url    = "${git_url}/external/github.com/google/googletest.git";
-      rev    = "6f8a66431cb592dad629028a50b3dd418a408c87";
-      sha256 = "0bdba2lr6pg15bla9600zg0r0vm4lnrx0wqz84p376wfdxra24vw";
-    };
-    "third_party/icu" = fetchgit {
-      url    = "${git_url}/chromium/deps/icu.git";
-      rev    = "741688ebf328da9adc52505248bf4e2ef868722c";
-      sha256 = "02ifm18qjlrkn5nm2rxkf9yz9bdlyq7c65jfjndv63vi1drqh1r9";
-    };
-    "third_party/instrumented_libraries" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/instrumented_libraries.git";
-      rev    = "28417458ac4dc79f68915079d0f283f682504cc0";
-      sha256 = "1qf5c2946n37p843yriv7xawi6ss6samabghq43s49cgd4wq8dc3";
-    };
-    "third_party/jinja2" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/jinja2.git";
-      rev    = "d34383206fa42d52faa10bb9931d6d538f3a57e0";
-      sha256 = "0d9hyw0bvp3p0dbwy833cm9vdqxcam0qbm9jc561ynphddxlkmgd";
-    };
-    "third_party/markupsafe" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/markupsafe.git";
-      rev    = "8f45f5cfa0009d2a70589bcda0349b8cb2b72783";
-      sha256 = "168ppjmicfdh4i1l0l25s86mdbrz9fgxmiq1rx33x79mph41scfz";
-    };
-    "tools/clang" = fetchgit {
-      url    = "${git_url}/chromium/src/tools/clang.git";
-      rev    = "8688d267571de76a56746324dcc249bf4232b85a";
-      sha256 = "0krq4zz1vnwp064bm517gwr2napy18wyccdh8w5s4qgkjwwxd63s";
-    };
-    "tools/gyp" = fetchgit {
-      url    = "${git_url}/external/gyp.git";
-      rev    = "d61a9397e668fa9843c4aa7da9e79460fe590bfb";
-      sha256 = "1z081h72mjy285jb1kj5xd0pb4p12n9blvsimsavyn3ldmswv0r0";
-    };
-    "tools/luci-go" = fetchgit {
-      url    = "${git_url}/chromium/src/tools/luci-go.git";
-      rev    = "45a8a51fda92e123619a69e7644d9c64a320b0c1";
-      sha256 = "0r7736gqk7r0i7ig0b5ib10d9q8a8xzsmc0f0fbkm9k78v847vpj";
-    };
-    "tools/swarming_client" = fetchgit {
-      url    = "${git_url}/infra/luci/client-py.git";
-      rev    = "4bd9152f8a975d57c972c071dfb4ddf668e02200";
-      sha256 = "03zk91gzvqv01g1vbl8d7h8al7vs4ymrrdc8ipg9wpq52yh65smh";
-    };
-  };
-
-in
-
-stdenv.mkDerivation rec {
-  pname = "v8";
-  version = "6.4.388.40";
-
-  inherit doCheck;
-
-  src = fetchFromGitHub {
-    owner = "v8";
-    repo = "v8";
-    rev = version;
-    sha256 = "1lq239cgqyidrynz8g3wbdv70ymzv6s0ppad8s219gb3jnizm16a";
-  };
-
-  postUnpack = ''
-    ${lib.concatStringsSep "\n" (
-      lib.mapAttrsToList (n: v: ''
-        mkdir -p $sourceRoot/${n}
-        cp -r ${v}/* $sourceRoot/${n}
-      '') deps)}
-  '';
-
-  prePatch = ''
-    # use our gn, not the bundled one
-    sed -i -e 's#gn_path = .*#gn_path = "${gn}/bin/gn"#' tools/mb/mb.py
-
-    # disable tests
-    if [ "$doCheck" = "" ]; then sed -i -e '/"test:gn_all",/d' BUILD.gn; fi
-
-    # disable sysroot usage
-    chmod u+w build/config build/config/sysroot.gni
-    sed -i build/config/sysroot.gni \
-        -e '/use_sysroot =/ { s#\(use_sysroot =\).*#\1 false#; :a  n; /current_cpu/ { s/^/#/; ba };  }'
-
-    # patch shebangs (/usr/bin/env)
-    patchShebangs tools/dev/v8gen.py
-  '';
-
-  configurePhase = ''
-    tools/dev/v8gen.py -vv ${arch}.release -- \
-        is_component_build=true               \
-        ${if snapshot then "v8_use_external_startup_data=false" else "v8_use_snapshot=false"} \
-        is_clang=false                        \
-        linux_use_bundled_binutils=false      \
-        treat_warnings_as_errors=false        \
-        use_custom_libcxx=false               \
-        use_custom_libcxx_for_host=false
-  '';
-
-  nativeBuildInputs = [ gn ninja pkg-config ];
-  buildInputs = [ python glib ];
-
-  buildPhase = ''
-    ninja -C out.gn/${arch}.release/
-  '';
-
-  enableParallelBuilding = true;
-
-  installPhase = ''
-    install -vD out.gn/${arch}.release/d8 "$out/bin/d8"
-    install -vD out.gn/${arch}.release/mksnapshot "$out/bin/mksnapshot"
-    mkdir -p "$out/lib"
-    for f in libicui18n.so libicuuc.so libv8_libbase.so libv8_libplatform.so libv8.so; do
-        install -vD out.gn/${arch}.release/$f "$out/lib/$f"
-    done
-    install -vD out.gn/${arch}.release/icudtl.dat "$out/lib/icudtl.dat"
-    mkdir -p "$out/include"
-    cp -vr include/*.h "$out/include"
-    cp -vr include/libplatform "$out/include"
-  '';
-
-  meta = with lib; {
-    description = "Google's open source JavaScript engine";
-    maintainers = with maintainers; [ cstrahan proglodyte ];
-    platforms = platforms.linux;
-    license = licenses.bsd3;
-  };
-}
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@ -1,21 +1,21 @@
 { lib, buildDunePackage, fetchurl
 , ppx_sexp_conv, ppx_cstruct
 , mirage-crypto, mirage-crypto-rng, mirage-crypto-pk
-, x509, cstruct, cstruct-unix, cstruct-sexp, sexplib
+, x509, cstruct, cstruct-unix, cstruct-sexp, sexplib, eqaf
 , rresult, mtime, logs, fmt, cmdliner, base64, hacl_x25519
 , zarith
 }:

 buildDunePackage rec {
  pname = "awa";
-  version = "0.0.4";
+  version = "0.0.5";

  minimumOCamlVersion = "4.07";
  useDune2 = true;

  src = fetchurl {
-    url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-v${version}.tbz";
-    sha256 = "1l7nsd8jifxjq78xyzcc0z9igc02m2qlvv4cxzsgdim6n1jfzxj2";
+    url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-${version}.tbz";
+    sha256 = "14hqzmikp3hlynhs0wnwj2491106if183swsl7ldk4215a0b7ms4";
  };

  nativeBuildInputs = [ ppx_cstruct ];
@ -24,7 +24,7 @@ buildDunePackage rec {
    mirage-crypto mirage-crypto-rng mirage-crypto-pk x509
    cstruct cstruct-sexp sexplib mtime
    logs base64 hacl_x25519 zarith
-    ppx_sexp_conv
+    ppx_sexp_conv eqaf
  ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@ -1,13 +1,11 @@
 { lib
 , buildDunePackage
 , fetchurl
-, rresult
 , mirage-crypto
 , mirage-clock
 , x509
 , logs
 , fmt
-, hex
 , bos
 , astring
 , cmdliner
@ -16,19 +14,18 @@

 buildDunePackage rec {
  pname = "ca-certs-nss";
-  version = "3.66";
+  version = "3.71.0.1";

  minimumOCamlVersion = "4.08";

  src = fetchurl {
    url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-v${version}.tbz";
-    sha256 = "f0f8035b470f2a48360b92d0e6287f41f98e4ba71576a1cd4c9246c468932f09";
+    sha256 = "b83749d983781631745079dccb7345d9ee1b52c1844ce865e97a25349289a124";
  };

  useDune2 = true;

  propagatedBuildInputs = [
-    rresult
    mirage-crypto
    mirage-clock
    x509
@ -37,7 +34,6 @@ buildDunePackage rec {
  buildInputs = [
    logs
    fmt
-    hex
    bos
    astring
    cmdliner
--- a/pkgs/development/ocaml-modules/conduit/default.nix
+++ b/pkgs/development/ocaml-modules/conduit/default.nix
@ -5,14 +5,14 @@

 buildDunePackage rec {
  pname = "conduit";
-  version = "4.0.1";
+  version = "4.0.2";
  useDune2 = true;

  minimumOCamlVersion = "4.03";

  src = fetchurl {
    url = "https://github.com/mirage/ocaml-conduit/releases/download/v${version}/conduit-v${version}.tbz";
-    sha256 = "500d95bf2a524f4851e94373e32d26b6e99ee04e5134db69fe6e151c3aad9b1f";
+    sha256 = "2a37ffaa352a1e145ef3d80ac28661213c69a741b238623e59f29e3d5a12c537";
  };

  buildInputs = [ ppx_sexp_conv ];
--- a/pkgs/development/ocaml-modules/higlo/default.nix
+++ b/pkgs/development/ocaml-modules/higlo/default.nix
@ -1,27 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, ocaml, findlib, xtmpl, ulex }:
+{ lib, buildDunePackage, fetchFromGitLab, sedlex_2, xtmpl }:

-stdenv.mkDerivation rec {
+buildDunePackage rec {
  pname = "higlo";
-  version = "0.6";
-  src = fetchFromGitHub {
+  version = "0.8";
+  useDune2 = true;
+  src = fetchFromGitLab {
+    domain = "framagit.org";
    owner = "zoggy";
    repo = "higlo";
-    rev = "release-${version}";
-    sha256 = "0m0qyk2ydivai54502s45sdw9w4xr0j3jpwyc4vqk62a7iz9ihxh";
+    rev = version;
+    sha256 = "sha256:09hsbwy5asacgh4gdj0vjpy4kzfnq3qji9szbsbyswsf1nbyczir";
  };

-  buildInputs = [ ocaml findlib ];
-  propagatedBuildInputs = [ xtmpl ulex ];
-
-  createFindlibDestdir = true;
-
-  patches = ./install.patch;
+  propagatedBuildInputs = [ sedlex_2 xtmpl ];

  meta = with lib; {
    description = "OCaml library for syntax highlighting";
-    homepage = "https://zoggy.github.io/higlo/";
+    inherit (src.meta) homepage;
    license = licenses.lgpl3;
-    platforms = ocaml.meta.platforms or [];
    maintainers = with maintainers; [ regnat ];
  };
 }
--- a/pkgs/development/ocaml-modules/higlo/install.patch
+++ b/pkgs/development/ocaml-modules/higlo/install.patch
@ -1,14 +0,0 @@
-diff --git a/Makefile b/Makefile
-index b8c2e01..fcd07ed 100644
--- a/Makefile
-+++ b/Makefile
-@@ -149,7 +149,8 @@ webdoc:
- install: install-lib install-bin
- 
- install-bin:
-	$(CP) $(HIGLO) $(HIGLO_BYTE) $(MK_HIGLO) `dirname \`which ocamlfind\``/
-+	mkdir -p $(out)/bin
-+	$(CP) $(HIGLO) $(HIGLO_BYTE) $(MK_HIGLO) $(out)/bin
- 
- install-lib: higlo.cmo higlo.cmx higlo.cmxs $(HIGLO) $(HIGLO_BYTE)
- 	ocamlfind install higlo META LICENSE \
--- a/pkgs/development/ocaml-modules/iri/default.nix
+++ b/pkgs/development/ocaml-modules/iri/default.nix
@ -1,34 +1,26 @@
-{ stdenv, lib, fetchFromGitLab, ocaml, findlib
-, sedlex, uunf, uutf
+{ lib, buildDunePackage, fetchFromGitLab
+, sedlex_2, uunf, uutf
 }:

-if !lib.versionAtLeast ocaml.version "4.03"
-then throw "iri is not available for OCaml ${ocaml.version}"
-else
-
-stdenv.mkDerivation rec {
-  version = "0.4.0";
-  name = "ocaml${ocaml.version}-iri-${version}";
+buildDunePackage rec {
+  pname = "iri";
+  version = "0.6.0";
+  useDune2 = true;

  src = fetchFromGitLab {
    domain = "framagit.org";
    owner = "zoggy";
    repo = "ocaml-iri";
    rev = version;
-    sha256 = "0fsmfmzmyggm0h77a7mb0n41vqi6q4ln1xzsv72zbvysa7l8w84q";
+    sha256 = "sha256:0zk8nnwcyljkc1a556byncv6cn1vqhk4267z1lm15flh1k7chyax";
  };

-  buildInputs = [ ocaml findlib ];
-
-  propagatedBuildInputs = [ sedlex uunf uutf ];
-
-  createFindlibDestdir = true;
+  propagatedBuildInputs = [ sedlex_2 uunf uutf ];

  meta = {
    description = "IRI (RFC3987) native OCaml implementation";
    license = lib.licenses.lgpl3;
    maintainers = [ lib.maintainers.vbgl ];
    inherit (src.meta) homepage;
-    inherit (ocaml.meta) platforms;
  };
 }
--- a/pkgs/development/ocaml-modules/letsencrypt/app.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/app.nix
@ -12,6 +12,7 @@
 , bos
 , fpath
 , randomconv
+, cstruct
 }:

 buildDunePackage {
@ -37,6 +38,7 @@ buildDunePackage {
    bos
    fpath
    randomconv
+    cstruct
  ];

  meta = letsencrypt.meta // {
--- a/pkgs/development/ocaml-modules/letsencrypt/default.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/default.nix
@ -1,15 +1,14 @@
 { buildDunePackage
 , lib
 , fetchurl
-, astring
 , asn1-combinators
 , uri
-, rresult
 , base64
 , logs
 , fmt
 , lwt
 , mirage-crypto
+, mirage-crypto-ec
 , mirage-crypto-pk
 , mirage-crypto-rng
 , x509
@ -17,15 +16,16 @@
 , ounit
 , ptime
 , domain-name
+, cstruct
 }:

 buildDunePackage rec {
  pname = "letsencrypt";
-  version = "0.3.0";
+  version = "0.4.1";

  src = fetchurl {
    url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-v${version}.tbz";
-    sha256 = "8772b7e6dbda0559a03a7b23b75c1431d42ae09a154eefd64b4c7e23b8d92deb";
+    sha256 = "f90875f5c9bdcab4c8be5ec7ebe9ea763030fa708e02857300996bb16e7c2070";
  };

  minimumOCamlVersion = "4.08";
@ -43,12 +43,12 @@ buildDunePackage rec {
    lwt
    base64
    mirage-crypto
+    mirage-crypto-ec
    mirage-crypto-pk
    asn1-combinators
    x509
    uri
-    rresult
-    astring
+    cstruct
  ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/ocf/default.nix
+++ b/pkgs/development/ocaml-modules/ocf/default.nix
@ -1,37 +1,24 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, ocaml, findlib, ppx_tools, yojson }:
+{ lib, buildDunePackage, fetchFromGitLab, yojson }:

-if lib.versionOlder ocaml.version "4.03"
-|| lib.versionAtLeast ocaml.version "4.08"
-then throw "ocf not supported for ocaml ${ocaml.version}"
-else
-stdenv.mkDerivation rec {
+buildDunePackage rec {
  pname = "ocf";
-  version = "0.5.0";
-  src = fetchFromGitHub {
+  version = "0.8.0";
+  useDune2 = true;
+  minimalOCamlVersion = "4.03";
+  src = fetchFromGitLab {
+    domain = "framagit.org";
    owner = "zoggy";
    repo = "ocf";
-    rev = "release-${version}";
-    sha256 = "1fhq9l2nmr39hxzpavc0jssmba71nnmhsncdn4dsbh2ylv29w56y";
+    rev = version;
+    sha256 = "sha256:00ap3q5yjqmpk87lxqv1j2wkc7583ynhjr1jjrfn9r0j2h9pfd60";
  };

-  buildInputs = [ ocaml findlib ppx_tools ];
  propagatedBuildInputs = [ yojson ];

-  createFindlibDestdir = true;
-
-  dontStrip = true;
-
-  patches = [(fetchpatch {
-    url = "https://github.com/zoggy/ocf/commit/3a231c7a6c5e535a77c25e207af8952793436444.patch";
-    sha256 = "0nc8cggc5gxhch9amaz3s71lxs1xbgi7fs9p90cng04dsgr64xk5";
-  })
-  ];
-
  meta = with lib; {
    description = "OCaml library to read and write configuration options in JSON syntax";
-    homepage = "https://zoggy.github.io/ocf/";
+    homepage = "https://zoggy.frama.io/ocf/";
    license = licenses.lgpl3;
-    platforms = ocaml.meta.platforms or [];
    maintainers = with maintainers; [ regnat ];
  };
 }
--- a/pkgs/development/ocaml-modules/ocf/ppx.nix
+++ b/pkgs/development/ocaml-modules/ocf/ppx.nix
@ -0,0 +1,14 @@
+{ buildDunePackage, ocf, ppxlib }:
+
+buildDunePackage {
+  pname = "ocf_ppx";
+  minimalOCamlVersion = "4.11";
+
+  inherit (ocf) src version useDune2;
+
+  buildInputs = [ ppxlib ocf ];
+
+  meta = ocf.meta // {
+    description = "Preprocessor for Ocf library";
+  };
+}
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@ -7,17 +7,10 @@
 , h2
 , tls-mirage
 , mimic
-, cohttp-lwt
-, letsencrypt
-, emile
 , ke
 , bigstringaf
-, domain-name
-, duration
 , faraday
-, ipaddr
 , tls
-, x509
 , lwt
 , logs
 , fmt
@ -32,11 +25,11 @@

 buildDunePackage rec {
  pname = "paf";
-  version = "0.0.5";
+  version = "0.0.6";

  src = fetchurl {
    url = "https://github.com/dinosaure/paf-le-chien/releases/download/${version}/paf-${version}.tbz";
-    sha256 = "e85a018046eb062d2399fdbe8d9d3400a4d5cd51bb62840446503f557c3eeff1";
+    sha256 = "21adbe0f7f9c0242354fa996468d01bf21d5cbcbdd978c911df8e2e299e8f9ae";
  };

  useDune2 = true;
@ -48,17 +41,10 @@ buildDunePackage rec {
    h2
    tls-mirage
    mimic
-    cohttp-lwt
-    letsencrypt
-    emile
    ke
    bigstringaf
-    domain-name
-    ipaddr
-    duration
    faraday
    tls
-    x509
    cstruct
  ];

--- a/pkgs/development/ocaml-modules/paf/le.nix
+++ b/pkgs/development/ocaml-modules/paf/le.nix
@ -8,6 +8,7 @@
 , mirage-stack
 , mirage-time
 , tls-mirage
+, x509
 }:

 buildDunePackage {
@ -29,6 +30,7 @@ buildDunePackage {
    mirage-stack
    mirage-time
    tls-mirage
+    x509
  ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/tls/async.nix
+++ b/pkgs/development/ocaml-modules/tls/async.nix
@ -1,4 +1,4 @@
-{ lib, buildDunePackage, tls, async, cstruct-async, core, cstruct, mirage-crypto-rng-async, async_find }:
+{ lib, buildDunePackage, tls, async, cstruct-async, core, cstruct, mirage-crypto-rng-async }:

 buildDunePackage rec {
  pname = "tls-async";
@ -12,7 +12,6 @@ buildDunePackage rec {

  propagatedBuildInputs = [
    async
-    async_find
    core
    cstruct
    cstruct-async
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@ -1,15 +1,16 @@
 { lib, fetchurl, buildDunePackage
-, cstruct, cstruct-sexp, domain-name, fmt, ppx_cstruct, ppx_sexp_conv, logs, hkdf, mirage-crypto, mirage-crypto-ec, mirage-crypto-pk, mirage-crypto-rng, ocaml_lwt, ptime, rresult, sexplib, x509
+, cstruct, cstruct-sexp, domain-name, fmt, ppx_cstruct, ppx_sexp_conv, logs, hkdf, mirage-crypto, mirage-crypto-ec, mirage-crypto-pk, mirage-crypto-rng, ocaml_lwt, ptime, sexplib, x509
+, ipaddr, ipaddr-sexp
 , alcotest, cstruct-unix, ounit2, randomconv
 }:

 buildDunePackage rec {
  pname = "tls";
-  version = "0.14.1";
+  version = "0.15.2";

  src = fetchurl {
    url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-v${version}.tbz";
-    sha256 = "58cf2d517d6eac5b1ccc5eeb656da690aef2125a19c1eca3fbececd858046216";
+    sha256 = "b76371757249bbeabb12c333de4ea2a09c095767bdbbc83322538c0da1fc1e36";
  };

  minimumOCamlVersion = "4.08";
@ -30,9 +31,10 @@ buildDunePackage rec {
    mirage-crypto-rng
    ocaml_lwt
    ptime
-    rresult
    sexplib
    x509
+    ipaddr
+    ipaddr-sexp
  ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/x509/default.nix
+++ b/pkgs/development/ocaml-modules/x509/default.nix
@ -1,6 +1,6 @@
 { lib, fetchurl, buildDunePackage
 , alcotest, cstruct-unix
-, asn1-combinators, domain-name, fmt, gmap, pbkdf, rresult, mirage-crypto, mirage-crypto-ec, mirage-crypto-pk
+, asn1-combinators, domain-name, fmt, gmap, pbkdf, mirage-crypto, mirage-crypto-ec, mirage-crypto-pk, ipaddr
 , logs, base64
 }:

@ -8,17 +8,17 @@ buildDunePackage rec {
  minimumOCamlVersion = "4.07";

  pname = "x509";
-  version = "0.14.1";
+  version = "0.15.2";

  src = fetchurl {
    url = "https://github.com/mirleft/ocaml-x509/releases/download/v${version}/x509-v${version}.tbz";
-    sha256 = "d91eb4f2790f9d098713c71cc4b5d12706aedb1795666b5e6d667fe5c262f9c3";
+    sha256 = "4034afdd83a0cb8291b1f809403015da9139bd772813d59d6093e42ec31ba643";
  };

  useDune2 = true;

  buildInputs = [ alcotest cstruct-unix ];
-  propagatedBuildInputs = [ asn1-combinators domain-name fmt gmap mirage-crypto mirage-crypto-pk mirage-crypto-ec pbkdf rresult logs base64 ];
+  propagatedBuildInputs = [ asn1-combinators domain-name fmt gmap mirage-crypto mirage-crypto-pk mirage-crypto-ec pbkdf logs base64 ipaddr ];

  doCheck = true;

--- a/pkgs/development/ocaml-modules/xtmpl/default.nix
+++ b/pkgs/development/ocaml-modules/xtmpl/default.nix
@ -1,39 +1,23 @@
-{ lib, stdenv, fetchFromGitLab, ocaml, findlib, iri, ppx_tools, js_of_ocaml
-, js_of_ocaml-ppx, re }:
+{ lib, buildDunePackage, fetchFromGitLab, iri, re, sedlex_2, uutf }:

-if lib.versionOlder ocaml.version "4.03"
-|| lib.versionAtLeast ocaml.version "4.11"
-then throw "xtmpl not supported for ocaml ${ocaml.version}"
-else
-stdenv.mkDerivation rec {
-  name = "ocaml${ocaml.version}-xtmpl-${version}";
-  version = "0.17.0";
+buildDunePackage rec {
+  pname = "xtmpl";
+  version = "0.19.0";
+  useDune2 = true;
  src = fetchFromGitLab {
    domain = "framagit.org";
    owner = "zoggy";
    repo = "xtmpl";
    rev = version;
-    sha256 = "1hq6y4rhz958q40145k4av8hx8jyvspg78xf741samd7vc3jd221";
+    sha256 = "sha256:0vwj0aayg60wm98d91fg3hmj90730liljy4cn8771dpxvz8m07bw";
  };

-  patches = [ ./jsoo.patch ];
-
-  postPatch = ''
-    substituteInPlace Makefile --replace js_of_ocaml.ppx js_of_ocaml-ppx
-  '';
-
-  buildInputs = [ ocaml findlib ppx_tools js_of_ocaml js_of_ocaml-ppx ];
-  propagatedBuildInputs = [ iri re ];
-
-  createFindlibDestdir = true;
-
-  dontStrip = true;
+  propagatedBuildInputs = [ iri re sedlex_2 uutf ];

  meta = with lib; {
    description = "XML templating library for OCaml";
    homepage = "https://www.good-eris.net/xtmpl/";
    license = licenses.lgpl3;
-    platforms = ocaml.meta.platforms or [];
    maintainers = with maintainers; [ regnat ];
  };
 }
--- a/pkgs/development/ocaml-modules/xtmpl/jsoo.patch
+++ b/pkgs/development/ocaml-modules/xtmpl/jsoo.patch
@ -1,26 +0,0 @@
-diff --git a/xtmpl_js.ml b/xtmpl_js.ml
-index e0d3894..991d1b3 100644
--- a/xtmpl_js.ml
-+++ b/xtmpl_js.ml
-@@ -25,6 +25,8 @@
- 
- (** *)
- 
-+open Js_of_ocaml
-+
- let log s = Firebug.console##log (Js.string s);;
- 
- module X = Xtmpl_rewrite
-diff --git a/xtmpl_js.mli b/xtmpl_js.mli
-index d709896..5ed471c 100644
--- a/xtmpl_js.mli
-+++ b/xtmpl_js.mli
-@@ -25,6 +25,8 @@
- 
- (** Convenient functions to use in JS code *)
- 
-+open Js_of_ocaml
-+
- (** Create a new tree of DOM nodes from a given XML tree.
-   Errors are logged to the firebug console.
-   @param doc Default is [Dom_html.document].
--- a/pkgs/development/ocaml-modules/xtmpl/ppx.nix
+++ b/pkgs/development/ocaml-modules/xtmpl/ppx.nix
@ -0,0 +1,14 @@
+{ buildDunePackage, xtmpl, ppxlib }:
+
+buildDunePackage {
+  pname = "xtmpl_ppx";
+  minimalOCamlVersion = "4.11";
+
+  inherit (xtmpl) src version useDune2;
+
+  buildInputs = [ ppxlib xtmpl ];
+
+  meta = xtmpl.meta // {
+    description = "Xml templating library, ppx extension";
+  };
+}
--- a/pkgs/development/python-modules/Nikola/default.nix
+++ b/pkgs/development/python-modules/Nikola/default.nix
@ -41,12 +41,12 @@

 buildPythonPackage rec {
  pname = "Nikola";
-  version = "8.1.3";
+  version = "8.2.0";
  disabled = pythonOlder "3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "05eac356bb4273cdd05d2dd6ad676226133496c457af91987c3f0d40e2fe57ef";
+    sha256 = "9998fedfcb932e19e3b54faeb497a49cde8b15163af764c5afe5847fef5ec1ff";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/actdiag/default.nix
+++ b/pkgs/development/python-modules/actdiag/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "actdiag";
-  version = "2.0.0";
+  version = "3.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "blockdiag";
    repo = pname;
    rev = version;
-    sha256 = "sha256-pTWunoc6T1m+4SOe0ob0ac4ZwwXsYNZwkdwVtlMZrIo=";
+    sha256 = "sha256-WmprkHOgvlsOIg8H77P7fzEqxGnj6xaL7Df7urRkg3o=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiohttp-socks/default.nix
+++ b/pkgs/development/python-modules/aiohttp-socks/default.nix
@ -14,6 +14,7 @@ buildPythonPackage rec {

  # Checks needs internet access
  doCheck = false;
+  pythonImportsCheck = [ "aiohttp_socks" ];

  disabled = pythonOlder "3.5.3";

--- a/pkgs/development/python-modules/aiomusiccast/default.nix
+++ b/pkgs/development/python-modules/aiomusiccast/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "aiomusiccast";
-  version = "0.14.2";
+  version = "0.14.3";

  format = "pyproject";

@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "vigonotion";
    repo = "aiomusiccast";
    rev = version;
-    sha256 = "sha256-5xIz36FgNwcaesmkYp3EWTxCe/8RaUJOJW9dqK+eang=";
+    hash = "sha256-ELdNxeU9dajWr4VeOyuvNrSi7B+ImVJM/BlZsw3tcKE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , ailment
 , archinfo
 , buildPythonPackage
@ -54,6 +55,8 @@ buildPythonPackage rec {
    sha256 = "sha256-AZlqSalTOQh3QR959ZuanFuTZVKi9valKJ3snsquC/A=";
  };

+  setupPyBuildFlags = lib.optionals stdenv.isLinux [ "--plat-name" "linux" ];
+
  propagatedBuildInputs = [
    ailment
    archinfo
--- a/pkgs/development/python-modules/av/default.nix
+++ b/pkgs/development/python-modules/av/default.nix
@ -9,12 +9,12 @@

 buildPythonPackage rec {
  pname = "av";
-  version = "8.0.3";
+  version = "8.1.0";
  disabled = isPy27; # setup.py no longer compatible

  src = fetchPypi {
    inherit pname version;
-    sha256 = "521814309c91d526b6b5c9517018aef2dd12bc3d86351037db69aa67730692b8";
+    sha256 = "0402169bc27e38e0f44e0e0e1854cf488337e86206b6d25d6dae2bfd7a1a0230";
  };

  checkInputs = [ numpy ];
--- a/pkgs/development/python-modules/blinkpy/default.nix
+++ b/pkgs/development/python-modules/blinkpy/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "blinkpy";
-  version = "0.17.1";
+  version = "0.18.0";

  src = fetchFromGitHub {
    owner = "fronzbot";
    repo = "blinkpy";
    rev = "v${version}";
-    sha256 = "11h4r2vkrlxwjig1lay1n5wpny5isfgz85f7lsn8ndnqa2wpsymp";
+    hash = "sha256-96HoGXVQE5PbUbu0oDOC0es0HXYig4ScTeexiUhGse4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/brother-ql/default.nix
+++ b/pkgs/development/python-modules/brother-ql/default.nix
@ -0,0 +1,37 @@
+{ stdenv
+, fetchPypi
+, buildPythonPackage
+, future
+, packbits
+, pillow
+, pyusb
+, pytest
+, mock
+, click
+, attrs
+, lib
+}:
+
+buildPythonPackage rec {
+  pname = "brother-ql";
+  version = "0.9.4";
+
+  src = fetchPypi {
+    pname = "brother_ql";
+    inherit version;
+    sha256 = "sha256-H1xXoDnwEsnCBDl/RwAB9267dINCHr3phdDLPGFOhmA=";
+  };
+
+  propagatedBuildInputs = [ future packbits pillow pyusb click attrs ];
+
+  meta = with lib; {
+    description = "Python package for the raster language protocol of the Brother QL series label printers";
+    longDescription = ''
+      Python package for the raster language protocol of the Brother QL series label printers
+      (QL-500, QL-550, QL-570, QL-700, QL-710W, QL-720NW, QL-800, QL-820NWB, QL-1050 and more)
+    '';
+    homepage = "https://github.com/pklaus/brother_ql";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ grahamc ];
+  };
+}
--- a/pkgs/development/python-modules/cvxpy/default.nix
+++ b/pkgs/development/python-modules/cvxpy/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "cvxpy";
-  version = "1.1.17";
+  version = "1.1.18";
  format = "pyproject";

  disabled = pythonOlder "3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-M5fTuJ13Dqnw/DWbHJs6/t5qDTvqHP8g4mU7E0Uc24o=";
+    sha256 = "sha256-W67+Hy7Wk3dJspNYbGzk9C7TDniQIj92Ycyyu333C+8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/defcon/default.nix
+++ b/pkgs/development/python-modules/defcon/default.nix
@ -5,13 +5,13 @@

 buildPythonPackage rec {
  pname = "defcon";
-  version = "0.9.0";
+  version = "0.10.0";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "140f51da51e9630a9fa11dfd34376c4e29785fdb0bddc2e371df5b36bec17b76";
+    sha256 = "a009862a0bc3f41f2b1a1b1f80d6aeedb3a17ed77d598da09f5a1bd93e970b3c";
    extension = "zip";
  };

--- a/pkgs/development/python-modules/django-statici18n/default.nix
+++ b/pkgs/development/python-modules/django-statici18n/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "django-statici18n";
-  version = "2.1.1";
+  version = "2.2.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "5c85192fa95e3ef3727517ac104add8959fc0a54be3d13440a8a3319fddbc778";
+    sha256 = "dbcdac190d93e0b4eabcab8875c8eb68795eceb442f926843ec5cbe1432fe628";
  };

  propagatedBuildInputs = [ django django_appconf ];
--- a/Show more
+++ b/Show more