Merge master into haskell-updates

2022-05-24 00:14:13 +00:00 · 2022-05-24 00:14:13 +00:00 · 3b5c6b8b04
parent 366420b0d2 1aacecae97
commit 3b5c6b8b04
253 changed files with 4101 additions and 1045 deletions
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@ -28,14 +28,14 @@ jobs:
        pairs:
          - from: master
            into: haskell-updates
-          - from: release-21.05
-            into: staging-next-21.05
-          - from: staging-next-21.05
-            into: staging-21.05
          - from: release-21.11
            into: staging-next-21.11
          - from: staging-next-21.11
            into: staging-21.11
+          - from: release-22.05
+            into: staging-next-22.05
+          - from: staging-next-22.05
+            into: staging-22.05
    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
    steps:
      - uses: actions/checkout@v3
--- a/.version
+++ b/.version
@ -1 +1 @@
-22.05
+22.11
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@ -869,7 +869,7 @@ makeWrapper $out/bin/foo $wrapperfile --set FOOBAR baz
 makeWrapper $out/bin/foo $wrapperfile --prefix PATH : ${lib.makeBinPath [ hello git ]}
 ```

-There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/build-support/setup-hooks/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
+There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.

 `wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.

--- a/flake.nix
+++ b/flake.nix
@ -11,9 +11,7 @@

      lib = import ./lib;

-      systems = lib.systems.supported.hydra;
-
-      forAllSystems = f: lib.genAttrs systems (system: f system);
+      forAllSystems = f: lib.genAttrs lib.systems.flakeExposed (system: f system);

    in
    {
--- a/lib/generators.nix
+++ b/lib/generators.nix
@ -251,6 +251,16 @@ rec {
    }:
      assert builtins.isInt depthLimit;
      let
+        specialAttrs = [
+          "__functor"
+          "__functionArgs"
+          "__toString"
+          "__pretty"
+        ];
+        stepIntoAttr = evalNext: name:
+          if builtins.elem name specialAttrs
+            then id
+            else evalNext;
        transform = depth:
          if depthLimit != null && depth > depthLimit then
            if throwOnDepthLimit
@ -261,7 +271,7 @@ rec {
          let
            evalNext = x: mapAny (depth + 1) (transform (depth + 1) x);
          in
-            if isAttrs v then mapAttrs (const evalNext) v
+            if isAttrs v then mapAttrs (stepIntoAttr evalNext) v
            else if isList v then map evalNext v
            else transform (depth + 1) v;
      in
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@ -8,7 +8,16 @@ rec {
  platforms = import ./platforms.nix { inherit lib; };
  examples = import ./examples.nix { inherit lib; };
  architectures = import ./architectures.nix { inherit lib; };
-  supported = import ./supported.nix { inherit lib; };
+
+  /* List of all Nix system doubles the nixpkgs flake will expose the package set
+     for. All systems listed here must be supported by nixpkgs as `localSystem`.
+
+     **Warning**: This attribute is considered experimental and is subject to change.
+  */
+  flakeExposed = import ./flake-systems.nix { };
+
+  # TODO(@sternenseemann): remove before 21.11
+  supported = throw "2022-05-23: Use lib.systems.flakeExposed instead of lib.systems.supported.hydra, as lib.systems.supported has been removed";

  # Elaborate a `localSystem` or `crossSystem` so that it contains everything
  # necessary.
@ -25,8 +34,11 @@ rec {
      # Either of these can be losslessly-extracted from `parsed` iff parsing succeeds.
      system = parse.doubleFromSystem final.parsed;
      config = parse.tripleFromSystem final.parsed;
-      # Determine whether we are compatible with the provided CPU
-      isCompatible = platform: parse.isCompatible final.parsed.cpu platform.parsed.cpu;
+      # Determine whether we can execute binaries built for the provided platform.
+      canExecute = platform:
+        parse.isCompatible final.parsed.cpu platform.parsed.cpu
+        && final.parsed.kernel == platform.parsed.kernel;
+      isCompatible = _: throw "2022-05-23: isCompatible has been removed in favor of canExecute, refer to the 22.11 changelog for details";
      # Derived meta-data
      libc =
        /**/ if final.isDarwin              then "libSystem"
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@ -41,7 +41,7 @@ let
    # none
    "aarch64_be-none" "aarch64-none" "arm-none" "armv6l-none" "avr-none" "i686-none"
    "msp430-none" "or1k-none" "m68k-none" "powerpc-none" "powerpcle-none"
-    "riscv32-none" "riscv64-none" "s390-none" "s390x-none" "vc4-none"
+    "riscv32-none" "riscv64-none" "rx-none" "s390-none" "s390x-none" "vc4-none"
    "x86_64-none"

    # OpenBSD
@ -76,6 +76,7 @@ in {
  riscv         = filterDoubles predicates.isRiscV;
  riscv32       = filterDoubles predicates.isRiscV32;
  riscv64       = filterDoubles predicates.isRiscV64;
+  rx            = filterDoubles predicates.isRx;
  vc4           = filterDoubles predicates.isVc4;
  or1k          = filterDoubles predicates.isOr1k;
  m68k          = filterDoubles predicates.isM68k;
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@ -145,6 +145,11 @@ rec {
    libc = "newlib";
  };

+  rx-embedded = {
+    config = "rx-none-elf";
+    libc = "newlib";
+  };
+
  msp430 = {
    config = "msp430-elf";
    libc = "newlib";
--- a/lib/systems/flake-systems.nix
+++ b/lib/systems/flake-systems.nix
@ -0,0 +1,29 @@
+# See [RFC 46] for mandated platform support and ../../pkgs/stdenv for
+# implemented platform support. This list is mainly descriptive, i.e. all
+# system doubles for platforms where nixpkgs can do native compiliation
+# reasonably well are included.
+#
+# [RFC 46]: https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md
+{ }:
+
+[
+  # Tier 1
+  "x86_64-linux"
+  # Tier 2
+  "aarch64-linux"
+  "x86_64-darwin"
+  # Tier 3
+  "armv6l-linux"
+  "armv7l-linux"
+  "i686-linux"
+  "mipsel-linux"
+
+  # Other platforms with sufficient support in stdenv which is not formally
+  # mandated by their platform tier.
+  "aarch64-darwin"
+  "armv5tel-linux"
+  "powerpc64le-linux"
+  "riscv64-linux"
+
+  # "x86_64-freebsd" is excluded because it is mostly broken
+]
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@ -26,6 +26,7 @@ rec {
    isRiscV        = { cpu = { family = "riscv"; }; };
    isRiscV32      = { cpu = { family = "riscv"; bits = 32; }; };
    isRiscV64      = { cpu = { family = "riscv"; bits = 64; }; };
+    isRx           = { cpu = { family = "rx"; }; };
    isSparc        = { cpu = { family = "sparc"; }; };
    isWasm         = { cpu = { family = "wasm"; }; };
    isMsp430       = { cpu = { family = "msp430"; }; };
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@ -116,6 +116,7 @@ rec {

    alpha    = { bits = 64; significantByte = littleEndian; family = "alpha"; };

+    rx       = { bits = 32; significantByte = littleEndian; family = "rx"; };
    msp430   = { bits = 16; significantByte = littleEndian; family = "msp430"; };
    avr      = { bits = 8; family = "avr"; };

@ -147,8 +148,10 @@ rec {
  #   Every CPU is compatible with itself.
  # - (transitivity)
  #   If A is compatible with B and B is compatible with C then A is compatible with C.
-  # - (compatible under multiple endianness)
-  #   CPUs with multiple modes of endianness are pairwise compatible.
+  #
+  # Note: Since 22.11 the archs of a mode switching CPU are no longer considered
+  # pairwise compatible. Mode switching implies that binaries built for A
+  # and B respectively can't be executed at the same time.
  isCompatible = a: b: with cpuTypes; lib.any lib.id [
    # x86
    (b == i386 && isCompatible a i486)
@ -190,22 +193,13 @@ rec {
    (b == aarch64 && a == armv8a)
    (b == armv8a && isCompatible a aarch64)

-    (b == aarch64 && a == aarch64_be)
-    (b == aarch64_be && isCompatible a aarch64)
-
    # PowerPC
    (b == powerpc && isCompatible a powerpc64)
-    (b == powerpcle && isCompatible a powerpc)
-    (b == powerpc && a == powerpcle)
-    (b == powerpc64le && isCompatible a powerpc64)
-    (b == powerpc64 && a == powerpc64le)
+    (b == powerpcle && isCompatible a powerpc64le)

    # MIPS
    (b == mips && isCompatible a mips64)
-    (b == mips && a == mipsel)
-    (b == mipsel && isCompatible a mips)
-    (b == mips64 && a == mips64el)
-    (b == mips64el && isCompatible a mips64)
+    (b == mipsel && isCompatible a mips64el)

    # RISCV
    (b == riscv32 && isCompatible a riscv64)
--- a/lib/systems/supported.nix
+++ b/lib/systems/supported.nix
@ -1,26 +0,0 @@
-# Supported systems according to RFC0046's definition.
-#
-# https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md
-{ lib }:
-rec {
-  # List of systems that are built by Hydra.
-  hydra = tier1 ++ tier2 ++ tier3 ++ [
-    "aarch64-darwin"
-  ];
-
-  tier1 = [
-    "x86_64-linux"
-  ];
-
-  tier2 = [
-    "aarch64-linux"
-    "x86_64-darwin"
-  ];
-
-  tier3 = [
-    "armv6l-linux"
-    "armv7l-linux"
-    "i686-linux"
-    "mipsel-linux"
-  ];
-}
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -674,6 +674,21 @@ runTests {
      expected = false;
    };

+  testWithRecursionDealsWithFunctors =
+    let
+      functor = {
+        __functor = self: { a, b, }: null;
+      };
+      a = {
+        value = "1234";
+        b = functor;
+        c.d = functor;
+      };
+    in {
+      expr = generators.toPretty { } (generators.withRecursion { depthLimit = 1; throwOnDepthLimit = false; } a);
+      expected = "{\n  b = <function, args: {a, b}>;\n  c = {\n    d = \"<unevaluated>\";\n  };\n  value = \"<unevaluated>\";\n}";
+    };
+
  testToPrettyMultiline = {
    expr = mapAttrs (const (generators.toPretty { })) rec {
      list = [ 3 4 [ false ] ];
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@ -195,7 +195,7 @@ rec {
     On each release the first letter is bumped and a new animal is chosen
     starting with that new letter.
  */
-  codeName = "Quokka";
+  codeName = "Raccoon";

  /* Returns the current nixpkgs version suffix as string. */
  versionSuffix =
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3429,6 +3429,12 @@
      fingerprint = "389A 78CB CD88 5E0C 4701  DEB9 FD42 C7D0 D414 94C8";
    }];
  };
+  dukc = {
+    email = "ajieskola@gmail.com";
+    github = "dukc";
+    githubId = 24233408;
+    name = "Ate Eskola";
+  };
  dump_stack = {
    email = "root@dumpstack.io";
    github = "jollheef";
@ -8129,6 +8135,12 @@
    githubId = 1377571;
    name = "Matthew S. Daiter";
  };
+  mdarocha = {
+    email = "marek@mdarocha.pl";
+    github = "mdarocha";
+    githubId = 11572618;
+    name = "Marek Darocha";
+  };
  mdevlamynck = {
    email = "matthias.devlamynck@mailoo.org";
    github = "mdevlamynck";
@ -14607,4 +14619,10 @@
      fingerprint = "41EA 00B4 00F9 6970 1CB2  D3AF EF90 E3E9 8B8F 5C0B";
    }];
  };
+  snpschaaf = {
+    email = "philipe.schaaf@secunet.com";
+    name = "Philippe Schaaf";
+    github = "snpschaaf";
+    githubId = 105843013;
+  };
 }
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -1,9 +1,5 @@
 <section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-22.05">
  <title>Release 22.05 (“Quokka”, 2022.05/??)</title>
-  <para>
-    In addition to numerous new and upgraded packages, this release has
-    the following highlights:
-  </para>
  <itemizedlist spacing="compact">
    <listitem>
      <para>
@ -14,6 +10,10 @@
  </itemizedlist>
  <section xml:id="sec-release-22.05-highlights">
    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following highlights:
+    </para>
    <itemizedlist>
      <listitem>
        <para>
@ -116,6 +116,11 @@
          have been removed.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          PostgreSQL now defaults to major version 14.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The new
@ -583,6 +588,15 @@
          <literal>/etc/containers</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.systems.supported</literal> has been removed, as
+          it was overengineered for determining the systems to support
+          in the nixpkgs flake. The list of systems exposed by the
+          nixpkgs flake can now be accessed as
+          <literal>lib.systems.flakeExposed</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          For new installations
@ -689,6 +703,18 @@
          the IPv6 loopback address (<literal>::1</literal>).
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>openldap</literal> (and therefore the slapd LDAP
+          server) were updated to version 2.6.2. The project introduced
+          backwards-incompatible changes, namely the removal of the bdb,
+          hdb, ndb, and shell backends in slapd. Therefore before
+          updating, dump your database <literal>slapcat -n 1</literal>
+          in LDIF format, and reimport it after updating your
+          <literal>services.openldap.settings</literal>, which
+          represents your <literal>cn=config</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>openssh</literal> has been update to 8.9p1, changing
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -0,0 +1,80 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-22.11">
+  <title>Release 22.11 (“Raccoon”, 2022.11/??)</title>
+  <para>
+    Support is planned until the end of June 2023, handing over to
+    23.05.
+  </para>
+  <section xml:id="sec-release-22.11-highlights">
+    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following highlights:
+    </para>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          During cross-compilation, tests are now executed if the test
+          suite can be executed by the build platform. This is the case
+          when doing “native” cross-compilation where the build and host
+          platforms are largely the same, but the nixpkgs’ cross
+          compilation infrastructure is used, e.g.
+          <literal>pkgsStatic</literal> and <literal>pkgsLLVM</literal>.
+          Another possibility is that the build platform is a superset
+          of the host platform, e.g. when cross-compiling from
+          <literal>x86_64-unknown-linux</literal> to
+          <literal>i686-unknown-linux</literal>. The predicate gating
+          test suite execution is the newly added
+          <literal>canExecute</literal> predicate: You can e.g. check if
+          <literal>stdenv.buildPlatform</literal> can execute binaries
+          built for <literal>stdenv.hostPlatform</literal> (i.e.
+          produced by <literal>stdenv.cc</literal>) by evaluating
+          <literal>stdenv.buildPlatform.canExecute stdenv.hostPlatform</literal>.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-22.11-new-services">
+    <title>New Services</title>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Please remove this line when you add the first item since
+          docbook requires the section to be non-empty
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-22.11-incompatibilities">
+    <title>Backward Incompatibilities</title>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          The <literal>isCompatible</literal> predicate checking CPU
+          compatibility is no longer exposed by the platform sets
+          generated using <literal>lib.systems.elaborate</literal>. In
+          most cases you will want to use the new
+          <literal>canExecute</literal> predicate instead which also
+          considers the kernel / syscall interface. It is briefly
+          described in the release’s
+          <link linkend="sec-release-22.11-highlights">highlights
+          section</link>.
+          <literal>lib.systems.parse.isCompatible</literal> still
+          exists, but has changed semantically: Architectures with
+          differing endianness modes are <emphasis>no longer considered
+          compatible</emphasis>.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-22.11-notable-changes">
+    <title>Other Notable Changes</title>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Please remove this line when you add the first item since
+          docbook requires the section to be non-empty
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+</section>
--- a/nixos/doc/manual/release-notes/release-notes.xml
+++ b/nixos/doc/manual/release-notes/release-notes.xml
@ -8,6 +8,7 @@
  This section lists the release notes for each stable version of NixOS and
  current unstable revision.
 </para>
+ <xi:include href="../from_md/release-notes/rl-2211.section.xml" />
 <xi:include href="../from_md/release-notes/rl-2205.section.xml" />
 <xi:include href="../from_md/release-notes/rl-2111.section.xml" />
 <xi:include href="../from_md/release-notes/rl-2105.section.xml" />
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -1,11 +1,11 @@
 # Release 22.05 (“Quokka”, 2022.05/??) {#sec-release-22.05}

-In addition to numerous new and upgraded packages, this release has the following highlights:
-
 - Support is planned until the end of December 2022, handing over to 22.11.

 ## Highlights {#sec-release-22.05-highlights}

+In addition to numerous new and upgraded packages, this release has the following highlights:
+
 - The `firefox` browser on `x86_64-linux` is now making use of
  profile-guided optimization resulting in a much more responsive
  browsing experience.
@ -45,6 +45,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - Pulseaudio has been upgraded to version 15.0 and now optionally [supports additional Bluetooth audio codecs](https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/15.0/#supportforldacandaptxbluetoothcodecsplussbcxqsbcwithhigher-qualityparameters) like aptX or LDAC, with codec switching support being available in `pavucontrol`. This feature is disabled by default but can be enabled by using `hardware.pulseaudio.package = pkgs.pulseaudioFull;`.
  Existing 3rd party modules that provided similar functionality, like `pulseaudio-modules-bt` or `pulseaudio-hsphfpd` are deprecated and have been removed.

+- PostgreSQL now defaults to major version 14.
+
 - The new [`postgresqlTestHook`](https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook) runs a PostgreSQL server for the duration of package checks.

 - [`kops`](https://kops.sigs.k8s.io) defaults to 1.22.4, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes 1.22. This will increase security by default, but may break some types of workloads. See the [release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) for details.
@ -193,6 +195,8 @@ In addition to numerous new and upgraded packages, this release has the followin
  This is to improve compatibility with `libcontainer` based software such as Podman and Skopeo
  which assumes they have ownership over `/etc/containers`.

+- `lib.systems.supported` has been removed, as it was overengineered for determining the systems to support in the nixpkgs flake. The list of systems exposed by the nixpkgs flake can now be accessed as `lib.systems.flakeExposed`.
+
 - For new installations `virtualisation.oci-containers.backend` is now set to `podman` by default.
  If you still want to use Docker on systems where `system.stateVersion` is set to to `"22.05"` set `virtualisation.oci-containers.backend = "docker";`.Old systems with older `stateVersion`s stay with "docker".

@ -244,6 +248,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - In the ncdns module, the default value of `services.ncdns.address` has been changed to the IPv6 loopback address (`::1`).

+- `openldap` (and therefore the slapd LDAP server) were updated to version 2.6.2. The project introduced backwards-incompatible changes, namely the removal of the bdb, hdb, ndb, and shell backends in slapd. Therefore before updating, dump your database `slapcat -n 1` in LDIF format, and reimport it after updating your `services.openldap.settings`, which represents your `cn=config`.
+
 - `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.

 - `git` no longer hardcodes the path to openssh' ssh binary to reduce the amount of rebuilds. If you are using git with ssh remotes and do not have a ssh binary in your enviroment consider adding `openssh` to it or switching to `gitFull`.
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -0,0 +1,43 @@
+# Release 22.11 (“Raccoon”, 2022.11/??) {#sec-release-22.11}
+
+Support is planned until the end of June 2023, handing over to 23.05.
+
+## Highlights {#sec-release-22.11-highlights}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- During cross-compilation, tests are now executed if the test suite can be executed
+  by the build platform. This is the case when doing “native” cross-compilation
+  where the build and host platforms are largely the same, but the nixpkgs' cross
+  compilation infrastructure is used, e.g. `pkgsStatic` and `pkgsLLVM`. Another
+  possibility is that the build platform is a superset of the host platform, e.g. when
+  cross-compiling from `x86_64-unknown-linux` to `i686-unknown-linux`.
+  The predicate gating test suite execution is the newly added `canExecute`
+  predicate: You can e.g. check if `stdenv.buildPlatform` can execute binaries
+  built for `stdenv.hostPlatform` (i.e. produced by `stdenv.cc`) by evaluating
+  `stdenv.buildPlatform.canExecute stdenv.hostPlatform`.
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+## New Services {#sec-release-22.11-new-services}
+
+- Please remove this line when you add the first item since docbook requires the section to be non-empty
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+## Backward Incompatibilities {#sec-release-22.11-incompatibilities}
+
+- The `isCompatible` predicate checking CPU compatibility is no longer exposed
+  by the platform sets generated using `lib.systems.elaborate`. In most cases
+  you will want to use the new `canExecute` predicate instead which also
+  considers the kernel / syscall interface. It is briefly described in the
+  release's [highlights section](#sec-release-22.11-highlights).
+  `lib.systems.parse.isCompatible` still exists, but has changed semantically:
+  Architectures with differing endianness modes are *no longer considered compatible*.
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+## Other Notable Changes {#sec-release-22.11-notable-changes}
+
+- Please remove this line when you add the first item since docbook requires the section to be non-empty
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@ -223,10 +223,10 @@ foreach my $u (@{$spec->{users}}) {
    }

    # Ensure home directory incl. ownership and permissions.
-    if ($u->{createHome}) {
-        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home} and ! $is_dry;
+    if ($u->{createHome} and !$is_dry) {
+        make_path($u->{home}, { mode => oct($u->{homeMode}) }) if ! -e $u->{home};
        chown $u->{uid}, $u->{gid}, $u->{home};
-        chmod 0700, $u->{home};
+        chmod oct($u->{homeMode}), $u->{home};
    }

    if (defined $u->{passwordFile}) {
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -48,7 +48,7 @@ let
    services such as SSH, or indirectly via <command>su</command> or
    <command>sudo</command>). This should only be used for e.g. bootable
    live systems. Note: this is different from setting an empty password,
-    which ca be achieved using <option>users.users.&lt;name?&gt;.password</option>.
+    which can be achieved using <option>users.users.&lt;name?&gt;.password</option>.

    If set to <literal>null</literal> (default) this user will not
    be able to log in using a password (i.e. via <command>login</command>
@ -139,6 +139,12 @@ let
        description = "The user's home directory.";
      };

+      homeMode = mkOption {
+        type = types.strMatching "[0-7]{1,5}";
+        default = "700";
+        description = "The user's home directory mode in numeric format. See chmod(1). The mode is only applied if <option>users.users.&lt;name&gt;.createHome</option> is true.";
+      };
+
      cryptHomeLuks = mkOption {
        type = with types; nullOr str;
        default = null;
@ -319,6 +325,7 @@ let
          group = mkDefault "users";
          createHome = mkDefault true;
          home = mkDefault "/home/${config.name}";
+          homeMode = mkDefault "700";
          useDefaultShell = mkDefault true;
          isSystemUser = mkDefault false;
        })
@ -430,7 +437,7 @@ let
    inherit (cfg) mutableUsers;
    users = mapAttrsToList (_: u:
      { inherit (u)
-          name uid group description home createHome isSystemUser
+          name uid group description home homeMode createHome isSystemUser
          password passwordFile hashedPassword
          autoSubUidGidRange subUidRanges subGidRanges
          initialPassword initialHashedPassword;
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@ -17,7 +17,7 @@ let
    else if xserverCfg.enable || config.programs.sway.enable then
      "gnome3"
    else
-      null;
+      "curses";

 in

--- a/nixos/modules/services/databases/openldap.nix
+++ b/nixos/modules/services/databases/openldap.nix
@ -268,9 +268,14 @@ in {
    };

    systemd.services.openldap = {
-      description = "LDAP server";
+      description = "OpenLDAP Server Daemon";
+      documentation = [
+        "man:slapd"
+        "man:slapd-config"
+        "man:slapd-mdb"
+      ];
      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [ "network-online.target" ];
      preStart = let
        settingsFile = pkgs.writeText "config.ldif" (lib.concatStringsSep "\n" (attrsToLdif "cn=config" cfg.settings));

@ -306,7 +311,7 @@ in {
          "${openldap}/libexec/slapd" "-u" cfg.user "-g" cfg.group "-F" configDir
          "-h" (lib.concatStringsSep " " cfg.urlList)
        ]);
-        Type = "forking";
+        Type = "notify";
        PIDFile = cfg.settings.attrs.olcPidFile;
      };
    };
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@ -295,7 +295,8 @@ in
      # Note: when changing the default, make it conditional on
      # ‘system.stateVersion’ to maintain compatibility with existing
      # systems!
-      mkDefault (if versionAtLeast config.system.stateVersion "21.11" then pkgs.postgresql_13
+      mkDefault (if versionAtLeast config.system.stateVersion "22.05" then pkgs.postgresql_14
+            else if versionAtLeast config.system.stateVersion "21.11" then pkgs.postgresql_13
            else if versionAtLeast config.system.stateVersion "20.03" then pkgs.postgresql_11
            else if versionAtLeast config.system.stateVersion "17.09" then mkThrow "9_6"
            else mkThrow "9_5");
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@ -199,6 +199,7 @@ let
    allow_anonymous = 1;
    allow_zero_length_clientid = 1;
    auto_id_prefix = 1;
+    bind_interface = 1;
    cafile = 1;
    capath = 1;
    certfile = 1;
@ -295,7 +296,7 @@ let
  };

  listenerAsserts = prefix: listener:
-    assertKeysValid prefix freeformListenerKeys listener.settings
+    assertKeysValid "${prefix}.settings" freeformListenerKeys listener.settings
    ++ userAsserts prefix listener.users
    ++ imap0
      (i: v: authAsserts "${prefix}.authPlugins.${toString i}" v)
@ -397,7 +398,7 @@ let
  };

  bridgeAsserts = prefix: bridge:
-    assertKeysValid prefix freeformBridgeKeys bridge.settings
+    assertKeysValid "${prefix}.settings" freeformBridgeKeys bridge.settings
    ++ [ {
      assertion = length bridge.addresses > 0;
      message = "Bridge ${prefix} needs remote broker addresses";
@ -526,7 +527,7 @@ let

  globalAsserts = prefix: cfg:
    flatten [
-      (assertKeysValid prefix freeformGlobalKeys cfg.settings)
+      (assertKeysValid "${prefix}.settings" freeformGlobalKeys cfg.settings)
      (imap0 (n: l: listenerAsserts "${prefix}.listener.${toString n}" l) cfg.listeners)
      (mapAttrsToList (n: b: bridgeAsserts "${prefix}.bridge.${n}" b) cfg.bridges)
    ];
@ -629,9 +630,10 @@ in
               ]));
        RemoveIPC = true;
        RestrictAddressFamilies = [
-          "AF_UNIX"  # for sd_notify() call
+          "AF_UNIX"
          "AF_INET"
          "AF_INET6"
+          "AF_NETLINK"
        ];
        RestrictNamespaces = true;
        RestrictRealtime = true;
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -633,8 +633,13 @@ in {

      services.nextcloud.phpPackage =
        if versionOlder cfg.package.version "21" then pkgs.php74
-        else if versionOlder cfg.package.version "24" then pkgs.php80
-        else pkgs.php81;
+        # FIXME: Use PHP 8.1 with Nextcloud 24 and higher, once issues like this one are fixed:
+        #
+        # https://github.com/nextcloud/twofactor_totp/issues/1192
+        #
+        # else if versionOlder cfg.package.version "24" then pkgs.php80
+        # else pkgs.php81;
+        else pkgs.php80;
    }

    { assertions = [
--- a/nixos/modules/system/boot/plymouth.nix
+++ b/nixos/modules/system/boot/plymouth.nix
@ -282,18 +282,18 @@ in
      EOF
    '';

-    boot.initrd.extraUtilsCommandsTest = mkIf (!config.boot.initrd.enable) ''
+    boot.initrd.extraUtilsCommandsTest = mkIf (!config.boot.initrd.systemd.enable) ''
      $out/bin/plymouthd --help >/dev/null
      $out/bin/plymouth --help >/dev/null
    '';

-    boot.initrd.extraUdevRulesCommands = mkIf (!config.boot.initrd.enable) ''
+    boot.initrd.extraUdevRulesCommands = mkIf (!config.boot.initrd.systemd.enable) ''
      cp ${config.systemd.package}/lib/udev/rules.d/{70-uaccess,71-seat}.rules $out
      sed -i '/loginctl/d' $out/71-seat.rules
    '';

    # We use `mkAfter` to ensure that LUKS password prompt would be shown earlier than the splash screen.
-    boot.initrd.preLVMCommands = mkIf (!config.boot.initrd.enable) (mkAfter ''
+    boot.initrd.preLVMCommands = mkIf (!config.boot.initrd.systemd.enable) (mkAfter ''
      mkdir -p /etc/plymouth
      mkdir -p /run/plymouth
      ln -s ${configFile} /etc/plymouth/plymouthd.conf
@ -307,12 +307,12 @@ in
      plymouth show-splash
    '');

-    boot.initrd.postMountCommands = mkIf (!config.boot.initrd.enable) ''
+    boot.initrd.postMountCommands = mkIf (!config.boot.initrd.systemd.enable) ''
      plymouth update-root-fs --new-root-dir="$targetRoot"
    '';

    # `mkBefore` to ensure that any custom prompts would be visible.
-    boot.initrd.preFailCommands = mkIf (!config.boot.initrd.enable) (mkBefore ''
+    boot.initrd.preFailCommands = mkIf (!config.boot.initrd.systemd.enable) (mkBefore ''
      plymouth quit --wait
    '');

--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -35,11 +35,11 @@ let
      "nss-lookup.target"
      "nss-user-lookup.target"
      "time-sync.target"
-    ] ++ (optionals cfg.package.withCryptsetup [
+    ] ++ optionals cfg.package.withCryptsetup [
      "cryptsetup.target"
      "cryptsetup-pre.target"
      "remote-cryptsetup.target"
-    ]) ++ [
+    ] ++ [
      "sigpwr.target"
      "timers.target"
      "paths.target"
@ -133,20 +133,27 @@ let

      # Slices / containers.
      "slices.target"
+    ] ++ optionals cfg.package.withImportd [
+      "systemd-importd.service"
+    ] ++ optionals cfg.package.withMachined [
      "machine.slice"
      "machines.target"
-      "systemd-importd.service"
      "systemd-machined.service"
+    ] ++ [
      "systemd-nspawn@.service"

      # Misc.
      "systemd-sysctl.service"
+    ] ++ optionals cfg.package.withTimedated [
      "dbus-org.freedesktop.timedate1.service"
-      "dbus-org.freedesktop.locale1.service"
-      "dbus-org.freedesktop.hostname1.service"
      "systemd-timedated.service"
+    ] ++ optionals cfg.package.withLocaled [
+      "dbus-org.freedesktop.locale1.service"
      "systemd-localed.service"
+    ] ++ optionals cfg.package.withHostnamed [
+      "dbus-org.freedesktop.hostname1.service"
      "systemd-hostnamed.service"
+    ] ++ [
      "systemd-exit.service"
      "systemd-update-done.service"
    ] ++ cfg.additionalUpstreamSystemUnits;
--- a/nixos/modules/system/boot/systemd/logind.nix
+++ b/nixos/modules/system/boot/systemd/logind.nix
@ -81,8 +81,11 @@ in
      "systemd-logind.service"
      "autovt@.service"
      "systemd-user-sessions.service"
+    ] ++ optionals config.systemd.package.withImportd [
      "dbus-org.freedesktop.import1.service"
+    ] ++ optionals config.systemd.package.withMachined [
      "dbus-org.freedesktop.machine1.service"
+    ] ++ [
      "dbus-org.freedesktop.login1.service"
      "user@.service"
      "user-runtime-dir@.service"
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -580,6 +580,7 @@ in
  uptermd = handleTest ./uptermd.nix {};
  usbguard = handleTest ./usbguard.nix {};
  user-activation-scripts = handleTest ./user-activation-scripts.nix {};
+  user-home-mode = handleTest ./user-home-mode.nix {};
  uwsgi = handleTest ./uwsgi.nix {};
  v2ray = handleTest ./v2ray.nix {};
  vault = handleTest ./vault.nix {};
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@ -11,6 +11,8 @@
 with import ../lib/testing-python.nix { inherit system pkgs; };

 let
+  inherit (pkgs) lib;
+
  makeCert = { caName, domain }: pkgs.runCommand "example-cert"
  { buildInputs = [ pkgs.gnutls ]; }
  ''
--- a/nixos/tests/mosquitto.nix
+++ b/nixos/tests/mosquitto.nix
@ -4,6 +4,7 @@ let
  port = 1888;
  tlsPort = 1889;
  anonPort = 1890;
+  bindTestPort = 1891;
  password = "VERY_secret";
  hashedPassword = "$7$101$/WJc4Mp+I+uYE9sR$o7z9rD1EYXHPwEP5GqQj6A7k4W1yVbePlb8TqNcuOLV9WNCiDgwHOB0JHC1WCtdkssqTBduBNUnUGd6kmZvDSw==";
  topic = "test/foo";
@ -125,6 +126,10 @@ in {
              };
            };
          }
+          {
+            settings.bind_interface = "eth0";
+            port = bindTestPort;
+          }
        ];
      };
    };
@ -134,6 +139,8 @@ in {
  };

  testScript = ''
+    import json
+
    def mosquitto_cmd(binary, user, topic, port):
        return (
            "mosquitto_{} "
@ -162,6 +169,27 @@ in {
    start_all()
    server.wait_for_unit("mosquitto.service")

+    with subtest("bind_interface"):
+        addrs = dict()
+        for iface in json.loads(server.succeed("ip -json address show")):
+            for addr in iface['addr_info']:
+                # don't want to deal with multihoming here
+                assert addr['local'] not in addrs
+                addrs[addr['local']] = (iface['ifname'], addr['family'])
+
+        # mosquitto grabs *one* random address per type for bind_interface
+        (has4, has6) = (False, False)
+        for line in server.succeed("ss -HlptnO sport = ${toString bindTestPort}").splitlines():
+            items = line.split()
+            if "mosquitto" not in items[5]: continue
+            listener = items[3].rsplit(':', maxsplit=1)[0].strip('[]')
+            assert listener in addrs
+            assert addrs[listener][0] == "eth0"
+            has4 |= addrs[listener][1] == 'inet'
+            has6 |= addrs[listener][1] == 'inet6'
+        assert has4
+        assert has6
+
    with subtest("check passwords"):
        client1.succeed(publish("-m test", "password_store"))
        client1.succeed(publish("-m test", "password_file"))
--- a/nixos/tests/mysql/mysql-backup.nix
+++ b/nixos/tests/mysql/mysql-backup.nix
@ -51,7 +51,6 @@ let

      # Do a backup and wait for it to start
      master.start_job("mysql-backup.service")
-      master.wait_for_unit("mysql-backup.service")

      # wait for backup to fail, because of database 'doesnotexist'
      master.wait_until_fails("systemctl is-active -q mysql-backup.service")
--- a/nixos/tests/user-home-mode.nix
+++ b/nixos/tests/user-home-mode.nix
@ -0,0 +1,27 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "user-home-mode";
+  meta = with lib.maintainers; { maintainers = [ fbeffa ]; };
+
+  nodes.machine = {
+    users.users.alice = {
+      initialPassword = "pass1";
+      isNormalUser = true;
+    };
+    users.users.bob = {
+      initialPassword = "pass2";
+      isNormalUser = true;
+      homeMode = "750";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("getty@tty1.service")
+    machine.wait_until_tty_matches(1, "login: ")
+    machine.send_chars("alice\n")
+    machine.wait_until_tty_matches(1, "Password: ")
+    machine.send_chars("pass1\n")
+    machine.succeed('[ "$(stat -c %a /home/alice)" == "700" ]')
+    machine.succeed('[ "$(stat -c %a /home/bob)" == "750" ]')
+  '';
+})
--- a/pkgs/applications/audio/mpg321/default.nix
+++ b/pkgs/applications/audio/mpg321/default.nix
@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
      url = "https://sources.debian.org/data/main/m/mpg321/0.3.2-3/debian/patches/handle_illegal_bitrate_value.patch";
      sha256 = "15simp5fjvm9b024ryfh441rkh2d5bcrizqkzlrh07n9sm7fkw6x";
    })
+    # Apple defines semun already. Skip redefining it to fix build errors.
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/Homebrew/formula-patches/85fa66a9/mpg321/0.3.2.patch";
+      sha256 = "sha256-qFYpKpE9PZSzOJrnsQINZi6FvUVX0anRyOvlF5eOYqE=";
+    })
  ];

  hardeningDisable = [ "format" ];
@ -37,6 +42,6 @@ stdenv.mkDerivation rec {
    description = "Command-line MP3 player";
    homepage = "http://mpg321.sourceforge.net/";
    license = licenses.gpl2;
-    platforms = platforms.gnu ++ platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/audio/ocenaudio/default.nix
+++ b/pkgs/applications/audio/ocenaudio/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "ocenaudio";
-  version = "3.11.10";
+  version = "3.11.11";

  src = fetchurl {
    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    sha256 = "sha256-Ah6Ni5EbFdIQ/wN7uGeMrSP5ybQfI4iy9gI1VT5LztU=";
+    sha256 = "sha256-S3Fqg5DjhVoYwfF3A/P7WcOUsU1x+IGwLopyNA3FkRQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/blockchains/sparrow/default.nix
+++ b/pkgs/applications/blockchains/sparrow/default.nix
@ -0,0 +1,232 @@
+{ stdenv
+, lib
+, makeWrapper
+, fetchurl
+, makeDesktopItem
+, copyDesktopItems
+, autoPatchelfHook
+, openjdk17
+, gtk3
+, gsettings-desktop-schemas
+, writeScript
+, bash
+, gnugrep
+, tor
+, zlib
+, openimajgrabber
+, hwi
+, imagemagick
+}:
+
+let
+  pname = "sparrow";
+  version = "1.6.4";
+
+  src = fetchurl {
+    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
+    sha256 = "1wdibpbhv3g6qk42ddfc5vyqkkwprczy45w5wi115qg3g1rf1in7";
+  };
+
+  launcher = writeScript "sparrow" ''
+    #! ${bash}/bin/bash
+    params=(
+      --module-path @out@/lib:@jdkModules@/modules
+      --add-opens javafx.graphics/com.sun.javafx.css=org.controlsfx.controls
+      --add-opens javafx.graphics/javafx.scene=org.controlsfx.controls
+      --add-opens javafx.controls/com.sun.javafx.scene.control.behavior=org.controlsfx.controls
+      --add-opens javafx.controls/com.sun.javafx.scene.control.inputmap=org.controlsfx.controls
+      --add-opens javafx.graphics/com.sun.javafx.scene.traversal=org.controlsfx.controls
+      --add-opens javafx.base/com.sun.javafx.event=org.controlsfx.controls
+      --add-opens javafx.controls/javafx.scene.control.cell=com.sparrowwallet.sparrow
+      --add-opens org.controlsfx.controls/impl.org.controlsfx.skin=com.sparrowwallet.sparrow
+      --add-opens org.controlsfx.controls/impl.org.controlsfx.skin=javafx.fxml
+      --add-opens javafx.graphics/com.sun.javafx.tk=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.javafx.tk.quantum=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.glass.ui=centerdevice.nsmenufx
+      --add-opens javafx.controls/com.sun.javafx.scene.control=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.javafx.menu=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.glass.ui=com.sparrowwallet.sparrow
+      --add-opens javafx.graphics/com.sun.javafx.application=com.sparrowwallet.sparrow
+      --add-opens java.base/java.net=com.sparrowwallet.sparrow
+      --add-opens java.base/java.io=com.google.gson
+      --add-reads com.sparrowwallet.merged.module=java.desktop
+      --add-reads com.sparrowwallet.merged.module=java.sql
+      --add-reads com.sparrowwallet.merged.module=com.sparrowwallet.sparrow
+      --add-reads com.sparrowwallet.merged.module=logback.classic
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.databind
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.annotation
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.core
+      --add-reads com.sparrowwallet.merged.module=co.nstant.in.cbor
+      -m com.sparrowwallet.sparrow
+    )
+
+    XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS ${openjdk17}/bin/java ''${params[@]} $@
+  '';
+
+  torWrapper = writeScript "tor-wrapper" ''
+    #! ${bash}/bin/bash
+
+    exec ${tor}/bin/tor "$@"
+  '';
+
+  jdk-modules = stdenv.mkDerivation {
+    name = "jdk-modules";
+    nativeBuildInputs = [ openjdk17 ];
+    dontUnpack = true;
+
+    buildPhase = ''
+      # Extract the JDK's JIMAGE and generate a list of modules.
+      mkdir modules
+      pushd modules
+      jimage extract ${openjdk17}/lib/openjdk/lib/modules
+      ls | xargs -d " " -- echo > ../manifest.txt
+      popd
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp manifest.txt $out/
+      cp -r modules/ $out/
+    '';
+  };
+
+  sparrow-modules = stdenv.mkDerivation {
+    pname = "sparrow-modules";
+    inherit version src;
+    nativeBuildInputs = [ makeWrapper gnugrep openjdk17 autoPatchelfHook stdenv.cc.cc.lib zlib ];
+
+    buildPhase = ''
+      # Extract Sparrow's JIMAGE and generate a list of them.
+      mkdir modules
+      pushd modules
+      jimage extract ../lib/runtime/lib/modules
+
+      # Delete JDK modules
+      cat ${jdk-modules}/manifest.txt | xargs -I {} -- rm -fR {}
+
+      # Delete unneeded native libs.
+
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-aarch64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-arm
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-armel
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-mips64el
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-ppc
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-ppc64le
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-s390x
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/openbsd-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/openbsd-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-sparc
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-sparcv9
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-x86
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_armel
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_armhf
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x86
+      rm com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x64/OpenIMAJGrabber.so
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_arm32_armel
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armel
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armhf
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_x86
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x64
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x86
+      rm -fR com.sparrowwallet.merged.module/linux-aarch64
+      rm -fR com.sparrowwallet.merged.module/linux-arm
+      rm -fR com.sparrowwallet.merged.module/linux-x86
+      rm com.sparrowwallet.sparrow/native/linux/x64/hwi
+
+      ls | xargs -d " " -- echo > ../manifest.txt
+      find . | grep "\.so$" | xargs -- chmod ugo+x
+      popd
+
+      # Replace the embedded Tor binary (which is in a Tar archive)
+      # with one from Nixpkgs.
+      cp ${torWrapper} ./tor
+      tar -cJf tor.tar.xz tor
+      cp tor.tar.xz modules/netlayer.jpms/native/linux/x64/tor.tar.xz
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp manifest.txt $out/
+      cp -r modules/ $out/
+      ln -s ${openimajgrabber}/lib/OpenIMAJGrabber.so $out/modules/com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x64/OpenIMAJGrabber.so
+      ln -s ${hwi}/bin/hwi $out/modules/com.sparrowwallet.sparrow/native/linux/x64/hwi
+    '';
+  };
+
+  # To use the udev rules for connected hardware wallets,
+  # add "pkgs.sparrow" to "services.udev.packages" and add user accounts to the user group "plugdev".
+  udev-rules = stdenv.mkDerivation {
+    name = "sparrow-udev";
+
+    src = let version = "2.0.2"; in
+      fetchurl {
+        url = "https://github.com/bitcoin-core/HWI/releases/download/${version}/hwi-${version}.tar.gz";
+        sha256 = "sha256-di1fRsMbwpHcBFNTCVivfxpwhUoUKLA3YTnJxKq/jHM=";
+      };
+
+    installPhase = ''
+      mkdir -p $out/etc/udev/rules.d
+      cp -a hwilib/udev/* $out/etc/udev/rules.d
+      rm $out/etc/udev/rules.d/README.md
+    '';
+  };
+in
+stdenv.mkDerivation rec {
+  inherit pname version src;
+  nativeBuildInputs = [ makeWrapper copyDesktopItems ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Sparrow";
+      exec = pname;
+      icon = pname;
+      desktopName = "Sparrow Bitcoin Wallet";
+      genericName = "Bitcoin Wallet";
+      categories = [ "Finance" ];
+    })
+  ];
+
+  sparrow-icons = stdenv.mkDerivation {
+    inherit version src;
+    pname = "sparrow-icons";
+    nativeBuildInputs = [ imagemagick ];
+
+    installPhase = ''
+      for n in 16 24 32 48 64 96 128 256; do
+        size=$n"x"$n
+        mkdir -p $out/hicolor/$size/apps
+        convert lib/Sparrow.png -resize $size $out/hicolor/$size/apps/sparrow.png
+        done;
+    '';
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out
+    ln -s ${sparrow-modules}/modules $out/lib
+    install -D -m 777 ${launcher} $out/bin/sparrow
+    substituteAllInPlace $out/bin/sparrow
+    substituteInPlace $out/bin/sparrow --subst-var-by jdkModules ${jdk-modules}
+
+    mkdir -p $out/share/icons
+    ln -s ${sparrow-icons}/hicolor $out/share/icons
+
+    mkdir -p $out/etc/udev
+    ln -s ${udev-rules}/etc/udev/rules.d $out/etc/udev/rules.d
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A modern desktop Bitcoin wallet application supporting most hardware wallets and built on common standards such as PSBT, with an emphasis on transparency and usability.";
+    homepage = "https://sparrowwallet.com";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ emmanuelrosa _1000101 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/blockchains/sparrow/openimajgrabber.nix
+++ b/pkgs/applications/blockchains/sparrow/openimajgrabber.nix
@ -0,0 +1,40 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, libv4l
+}:
+stdenv.mkDerivation rec {
+  pname = "openimajgrabber";
+  version = "1.3.10";
+
+  src = fetchFromGitHub {
+    owner = "openimaj";
+    repo = "openimaj";
+    rev = "openimaj-${version}";
+    sha256 = "sha256-Y8707ovE7f6Fk3cJ+PtwvzNpopgH5vlF55m2Xm4hjYM=";
+  };
+
+  buildInputs = [ libv4l ];
+
+  # These build instructions come from build.sh
+  buildPhase = ''
+    pushd hardware/core-video-capture/src-native/linux
+    g++ -fPIC -g -c OpenIMAJGrabber.cpp
+    g++ -fPIC -g -c capture.cpp
+    g++ -shared -Wl,-soname,OpenIMAJGrabber.so -o OpenIMAJGrabber.so OpenIMAJGrabber.o capture.o -lv4l2 -lrt -lv4lconvert
+    popd
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp hardware/core-video-capture/src-native/linux/OpenIMAJGrabber.so $out/lib
+  '';
+
+  meta = with lib; {
+    description = "A collection of libraries and tools for multimedia (images, text, video, audio, etc.) content analysis and content generation. This package only builds the OpenIMAJGrabber for Linux.";
+    homepage = "http://www.openimaj.org";
+    license = licenses.bsd0;
+    maintainers = with maintainers; [ emmanuelrosa _1000101 ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@ -345,7 +345,7 @@ rec {
    src = fetchzip {
      url = "https://download.jboss.org/drools/release/${version}/droolsjbpm-tools-distribution-${version}.zip";
      sha512 = "2qzc1iszqfrfnw8xip78n3kp6hlwrvrr708vlmdk7nv525xhs0ssjaxriqdhcr0s6jripmmazxivv3763rnk2bfkh31hmbnckpx4r3m";
-      extraPostFetch = ''
+      postFetch = ''
        # update site is a couple levels deep, alongside some other irrelevant stuff
        cd $out;
        find . -type f -not -path ./binaries/org.drools.updatesite/\* -exec rm {} \;
@ -507,7 +507,7 @@ rec {
      stripRoot = false;
      url = "https://github.com/${owner}/${repo}/archive/${rev}.zip";
      sha256 = "1xfj4j27d1h4bdf2v7f78zi8lz4zkkj7s9kskmsqx5jcs2d459yp";
-      extraPostFetch =
+      postFetch =
        ''
          mv "$out/${repo}-${rev}/releases/local-repo/"* "$out/"
        '';
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@ -108,7 +108,7 @@ let
            hostprog_check_table);
        in
        [
-          "--argv0" "$0" "--add-flags" (lib.escapeShellArgs flags)
+          "--inherit-argv0" "--add-flags" (lib.escapeShellArgs flags)
        ] ++ lib.optionals withRuby [
          "--set" "GEM_HOME" "${rubyEnv}/${rubyEnv.ruby.gemPath}"
        ] ++ lib.optionals (binPath != "") [
--- a/pkgs/applications/editors/notepad-next/default.nix
+++ b/pkgs/applications/editors/notepad-next/default.nix
@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchFromGitHub, qmake, libsForQt5 }:
+{ mkDerivation, lib, fetchFromGitHub, qmake, libsForQt5, stdenv }:

 mkDerivation rec {
  pname = "notepad-next";
@ -32,5 +32,6 @@ mkDerivation rec {
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = [ maintainers.sebtm ];
+    broken = stdenv.isAarch64;
  };
 }
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@ -72,7 +72,7 @@ let
      ++ lib.optionals stdenv.isLinux [
        autoPatchelfHook
        nodePackages.asar
-        (wrapGAppsHook.override { makeBinaryWrapper = makeWrapper; })
+        (wrapGAppsHook.override { inherit makeWrapper; })
      ];

    dontBuild = true;
--- a/pkgs/applications/emulators/box64/default.nix
+++ b/pkgs/applications/emulators/box64/default.nix
@ -0,0 +1,66 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "box64";
+  version = "0.1.8";
+
+  src = fetchFromGitHub {
+    owner = "ptitSeb";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-6k8Enbafnj19ATtgmw8W7LxtRpM3Ousj1bpZbbtq8TM=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    python3
+  ];
+
+  cmakeFlags = [
+    "-DNOGIT=1"
+  ] ++ (
+    if stdenv.hostPlatform.system == "aarch64-linux" then
+      [
+        "-DARM_DYNAREC=ON"
+      ]
+    else [
+      "-DLD80BITS=1"
+      "-DNOALIGN=1"
+    ]
+  );
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm 0755 box64 "$out/bin/box64"
+    runHook postInstall
+  '';
+
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+    ctest
+    runHook postCheck
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/box64 -v
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://box86.org/";
+    description = "Lets you run x86_64 Linux programs on non-x86_64 Linux systems";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gador ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
+}
--- a/pkgs/applications/emulators/citra/default.nix
+++ b/pkgs/applications/emulators/citra/default.nix
@ -1,93 +1,45 @@
-{ lib
-, stdenv
+{ branch
+, libsForQt5
 , fetchFromGitHub
-, cmake
-, wrapQtAppsHook
-, boost17x
-, pkg-config
-, libusb1
-, zstd
-, libressl
-, enableSdl2 ? true, SDL2
-, enableQt ? true, qtbase, qtmultimedia
-, enableQtTranslation ? enableQt, qttools
-, enableWebService ? true
-, enableCubeb ? true, libpulseaudio
-, enableFfmpegAudioDecoder ? true
-, enableFfmpegVideoDumper ? true
-, ffmpeg
-, useDiscordRichPresence ? true, rapidjson
-, enableFdk ? false, fdk_aac
+, fetchurl
 }:
-assert lib.assertMsg (!enableFfmpegAudioDecoder || !enableFdk) "Can't enable both enableFfmpegAudioDecoder and enableFdk";

-stdenv.mkDerivation {
-  pname = "citra";
-  version = "2021-11-01";
+let
+  # Fetched from https://api.citra-emu.org/gamedb, last updated 2022-05-02
+  # Please make sure to update this when updating citra!
+  compat-list = fetchurl {
+    name = "citra-compat-list";
+    url = "https://web.archive.org/web/20220502114622/https://api.citra-emu.org/gamedb/";
+    sha256 = "sha256-blIlaYaUQjw7Azgg+Dd7ZPEQf+ddZMO++Yxinwe+VG0=";
+  };
+in {
+  nightly = libsForQt5.callPackage ./generic.nix rec {
+    pname = "citra-nightly";
+    version = "1765";

-  src = fetchFromGitHub {
-    owner = "citra-emu";
-    repo = "citra";
-    rev = "5a7d80172dd115ad9bc6e8e85cee6ed9511c48d0";
-    sha256 = "sha256-vy2JMizBsnRK9NBEZ1dxT7fP/HFhOZSsC+5P+Dzi27s=";
-    fetchSubmodules = true;
+    src = fetchFromGitHub {
+      owner = "citra-emu";
+      repo = "citra-nightly";
+      rev = "nightly-${version}";
+      sha256 = "0d3dfh63cmsy5idbypdz3ibydmb4a35sfv7qmxxlcpc390pp9cvq";
+      fetchSubmodules = true;
+    };
+
+    inherit branch compat-list;
  };

-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ]
-  ++ lib.optionals enableQt [ wrapQtAppsHook ];
+  canary = libsForQt5.callPackage ./generic.nix rec {
+    pname = "citra-canary";
+    version = "2146";

-  buildInputs = [
-    boost17x
-    libusb1
-  ]
-  ++ lib.optionals enableSdl2 [ SDL2 ]
-  ++ lib.optionals enableQt [ qtbase qtmultimedia ]
-  ++ lib.optionals enableQtTranslation [ qttools ]
-  ++ lib.optionals enableCubeb [ libpulseaudio ]
-  ++ lib.optionals (enableFfmpegAudioDecoder || enableFfmpegVideoDumper) [ ffmpeg ]
-  ++ lib.optionals useDiscordRichPresence [ rapidjson ]
-  ++ lib.optionals enableFdk [ fdk_aac ];
+    src = fetchFromGitHub {
+      owner = "citra-emu";
+      repo = "citra-canary";
+      rev = "canary-${version}";
+      sha256 = "1wnym0nklngimf5gaaa2703nz4g5iy572wlgp88h67rrh9b4f04r";
+      fetchSubmodules = true;
+    };

-  cmakeFlags = [
-    "-DUSE_SYSTEM_BOOST=ON"
-  ]
-  ++ lib.optionals (!enableSdl2) [ "-DENABLE_SDL2=OFF" ]
-  ++ lib.optionals (!enableQt) [ "-DENABLE_QT=OFF" ]
-  ++ lib.optionals enableQtTranslation [ "-DENABLE_QT_TRANSLATION=ON" ]
-  ++ lib.optionals (!enableWebService) [ "-DENABLE_WEB_SERVICE=OFF" ]
-  ++ lib.optionals (!enableCubeb) [ "-DENABLE_CUBEB=OFF" ]
-  ++ lib.optionals enableFfmpegAudioDecoder [ "-DENABLE_FFMPEG_AUDIO_DECODER=ON"]
-  ++ lib.optionals enableFfmpegVideoDumper [ "-DENABLE_FFMPEG_VIDEO_DUMPER=ON" ]
-  ++ lib.optionals useDiscordRichPresence [ "-DUSE_DISCORD_PRESENCE=ON" ]
-  ++ lib.optionals enableFdk [ "-DENABLE_FDK=ON" ];
-
-  postPatch = ''
-    # We already know the submodules are present
-    substituteInPlace CMakeLists.txt \
-      --replace "check_submodules_present()" ""
-
-    # Devendoring
-    rm -rf externals/zstd externals/libressl
-    cp -r ${zstd.src} externals/zstd
-    tar xf ${libressl.src} -C externals/
-    mv externals/${libressl.name} externals/libressl
-    chmod -R a+w externals/zstd
-  '';
-
-  # Fixes https://github.com/NixOS/nixpkgs/issues/171173
-  postInstall = lib.optionalString (enableCubeb && enableSdl2) ''
-    wrapProgram "$out/bin/citra" \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio ]}
-  '';
-
-  meta = with lib; {
-    homepage = "https://citra-emu.org";
-    description = "An open-source emulator for the Nintendo 3DS";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ abbradar ];
-    platforms = platforms.linux;
+    inherit branch compat-list;
  };
-}
+}.${branch}
--- a/pkgs/applications/emulators/citra/generic.nix
+++ b/pkgs/applications/emulators/citra/generic.nix
@ -0,0 +1,107 @@
+{ pname
+, version
+, src
+, branch
+, compat-list
+
+, lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, boost17x
+, pkg-config
+, libusb1
+, zstd
+, libressl
+, enableSdl2 ? true, SDL2
+, enableQt ? true, qtbase, qtmultimedia, wrapQtAppsHook
+, enableQtTranslation ? enableQt, qttools
+, enableWebService ? true
+, enableCubeb ? true, libpulseaudio
+, enableFfmpegAudioDecoder ? true
+, enableFfmpegVideoDumper ? true
+, ffmpeg
+, useDiscordRichPresence ? true, rapidjson
+, enableFdk ? false, fdk_aac
+}:
+assert lib.assertMsg (!enableFfmpegAudioDecoder || !enableFdk) "Can't enable both enableFfmpegAudioDecoder and enableFdk";
+
+stdenv.mkDerivation rec {
+  inherit pname version src;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ] ++ lib.optionals enableQt [ wrapQtAppsHook ];
+
+  buildInputs = [
+    boost17x
+    libusb1
+  ] ++ lib.optionals enableQt [ qtbase qtmultimedia ]
+    ++ lib.optional enableSdl2 SDL2
+    ++ lib.optional enableQtTranslation qttools
+    ++ lib.optional enableCubeb libpulseaudio
+    ++ lib.optional (enableFfmpegAudioDecoder || enableFfmpegVideoDumper) ffmpeg
+    ++ lib.optional useDiscordRichPresence rapidjson
+    ++ lib.optional enableFdk fdk_aac;
+
+  cmakeFlags = [
+    "-DUSE_SYSTEM_BOOST=ON"
+    "-DCITRA_USE_BUNDLED_FFMPEG=OFF"
+    "-DCITRA_USE_BUNDLED_QT=OFF"
+    "-DCITRA_USE_BUNDLED_SDL2=OFF"
+
+    # We dont want to bother upstream with potentially outdated compat reports
+    "-DCITRA_ENABLE_COMPATIBILITY_REPORTING=ON"
+    "-DENABLE_COMPATIBILITY_LIST_DOWNLOAD=OFF" # We provide this deterministically
+  ] ++ lib.optional (!enableSdl2) "-DENABLE_SDL2=OFF"
+    ++ lib.optional (!enableQt) "-DENABLE_QT=OFF"
+    ++ lib.optional enableQtTranslation "-DENABLE_QT_TRANSLATION=ON"
+    ++ lib.optional (!enableWebService) "-DENABLE_WEB_SERVICE=OFF"
+    ++ lib.optional (!enableCubeb) "-DENABLE_CUBEB=OFF"
+    ++ lib.optional enableFfmpegAudioDecoder "-DENABLE_FFMPEG_AUDIO_DECODER=ON"
+    ++ lib.optional enableFfmpegVideoDumper "-DENABLE_FFMPEG_VIDEO_DUMPER=ON"
+    ++ lib.optional useDiscordRichPresence "-DUSE_DISCORD_PRESENCE=ON"
+    ++ lib.optional enableFdk "-DENABLE_FDK=ON";
+
+  postPatch = ''
+    # Prep compatibilitylist
+    ln -s ${compat-list} ./dist/compatibility_list/compatibility_list.json
+
+    # We already know the submodules are present
+    substituteInPlace CMakeLists.txt \
+      --replace "check_submodules_present()" ""
+
+    # Devendoring
+    rm -rf externals/zstd externals/libressl
+    cp -r ${zstd.src} externals/zstd
+    tar xf ${libressl.src} -C externals/
+    mv externals/${libressl.name} externals/libressl
+    chmod -R a+w externals/zstd
+  '';
+
+  # Fixes https://github.com/NixOS/nixpkgs/issues/171173
+  postInstall = lib.optionalString (enableCubeb && enableSdl2) ''
+    wrapProgram "$out/bin/citra" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://citra-emu.org";
+    description = "The ${branch} branch of an open-source emulator for the Ninteno 3DS";
+    longDescription = ''
+      A Nintendo 3DS Emulator written in C++
+      Using the nightly branch is recommended for general usage.
+      Using the canary branch is recommended if you would like to try out
+      experimental features, with a cost of stability.
+    '';
+    mainProgram = if enableQt then "citra-qt" else "citra";
+    platforms = platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [
+      abbradar
+      ashley
+      ivar
+    ];
+  };
+}
--- a/pkgs/applications/emulators/citra/update.sh
+++ b/pkgs/applications/emulators/citra/update.sh
@ -0,0 +1,84 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p nix nix-prefetch-git coreutils curl jq gnused
+
+set -euo pipefail
+
+# Will be replaced with the actual branch when running this from passthru.updateScript
+BRANCH="@branch@"
+
+if [[ ! "$(basename $PWD)" = "citra" ]]; then
+    echo "error: Script must be ran from citra's directory!"
+    exit 1
+fi
+
+getLocalVersion() {
+    pushd ../../../.. >/dev/null
+    nix eval --raw -f default.nix "$1".version
+    popd >/dev/null
+}
+
+getLocalHash() {
+    pushd ../../../.. >/dev/null
+    nix eval --raw -f default.nix "$1".src.drvAttrs.outputHash
+    popd >/dev/null
+}
+
+updateNightly() {
+    OLD_NIGHTLY_VERSION="$(getLocalVersion "citra-nightly")"
+    OLD_NIGHTLY_HASH="$(getLocalHash "citra-nightly")"
+
+    NEW_NIGHTLY_VERSION="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+        "https://api.github.com/repos/citra-emu/citra-nightly/releases?per_page=1" | jq -r '.[0].name' | cut -d"-" -f2 | cut -d" " -f2)"
+
+    if [[ "${OLD_NIGHTLY_VERSION}" = "${NEW_NIGHTLY_VERSION}" ]]; then
+        echo "citra-nightly is already up to date!"
+
+        [ "$KEEP_GOING" ] && return || exit
+    else
+        echo "citra-nightly: ${OLD_NIGHTLY_VERSION} -> ${NEW_NIGHTLY_VERSION}"
+    fi
+
+    echo "  Fetching source code..."
+
+    NEW_NIGHTLY_HASH="$(nix-prefetch-git --quiet --fetch-submodules --rev "nightly-${NEW_NIGHTLY_VERSION}" "https://github.com/citra-emu/citra-nightly" | jq -r '.sha256')"
+
+    echo "  Succesfully fetched. hash: ${NEW_NIGHTLY_HASH}"
+
+    sed -i "s/${OLD_NIGHTLY_VERSION}/${NEW_NIGHTLY_VERSION}/" ./default.nix
+    sed -i "s/${OLD_NIGHTLY_HASH}/${NEW_NIGHTLY_HASH}/" ./default.nix
+}
+
+updateCanary() {
+    OLD_CANARY_VERSION="$(getLocalVersion "citra-canary")"
+    OLD_CANARY_HASH="$(getLocalHash "citra-canary")"
+
+    NEW_CANARY_VERSION="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+        "https://api.github.com/repos/citra-emu/citra-canary/releases?per_page=1" | jq -r '.[0].name' | cut -d"-" -f2 | cut -d" " -f1)"
+
+    if [[ "${OLD_CANARY_VERSION}" = "${NEW_CANARY_VERSION}" ]]; then
+        echo "citra-canary is already up to date!"
+
+        [ "$KEEP_GOING" ] && return || exit
+    else
+        echo "citra-canary: ${OLD_CANARY_VERSION} -> ${NEW_CANARY_VERSION}"
+    fi
+
+    echo "  Fetching source code..."
+
+    NEW_CANARY_HASH="$(nix-prefetch-git --quiet --fetch-submodules --rev "canary-${NEW_CANARY_VERSION}" "https://github.com/citra-emu/citra-canary" | jq -r '.sha256')"
+
+    echo "  Succesfully fetched. hash: ${NEW_CANARY_HASH}"
+
+    sed -i "s/${OLD_CANARY_VERSION}/${NEW_CANARY_VERSION}/" ./default.nix
+    sed -i "s/${OLD_CANARY_HASH}/${NEW_CANARY_HASH}/" ./default.nix
+}
+
+if [[ "$BRANCH" = "nightly" ]]; then
+    updateNightly
+elif [[ "$BRANCH" = "early-access" ]]; then
+    updateCanary
+else
+    KEEP_GOING=1
+    updateNightly
+    updateCanary
+fi
--- a/pkgs/applications/emulators/ryujinx/deps.nix
+++ b/pkgs/applications/emulators/ryujinx/deps.nix
@ -12,9 +12,9 @@
  (fetchNuGet { pname = "GtkSharp"; version = "3.22.25.128"; sha256 = "0z0wx0p3gc02r8d7y88k1rw307sb2vapbr1k1yc5qdc38fxz5jsy"; })
  (fetchNuGet { pname = "GtkSharp.Dependencies"; version = "1.1.1"; sha256 = "0ffywnc3ca1lwhxdnk99l238vsprsrsh678bgm238lb7ja7m52pw"; })
  (fetchNuGet { pname = "LibHac"; version = "0.16.1"; sha256 = "131qnqa1asdmymwdvpjza6w646b05jzn1cxjdxgwh7qdcdb77xyx"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.4"; sha256 = "1fvv5ri32pbl43628zqnim6fbv6hjxf66p0v793xdh57dzkdyh0j"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-x64"; version = "6.0.4"; sha256 = "1m8iaq78kii0z4lxwq1igm8f4yv010blrifab4zp491b0j0qg1d4"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x64"; version = "6.0.4"; sha256 = "1sqv7vhkm4j11rl7mfvs4mmmclcdps2n4pf31ck2mcx54nr4d2kj"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.5"; sha256 = "0br5ms806jsgc2jghcjb6lm2h1ifq8wa3cgxp5ginrhzzj3p145i"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-x64"; version = "6.0.5"; sha256 = "15fbzv7yywhzfmkkrqi9xxwi0h6fy9miz5ihl8j4hd0psqc8wil3"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x64"; version = "6.0.5"; sha256 = "1wl227mbbda039dznl2lvd65kh3k978qa88pa2ayqjx3vb6394q9"; })
  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "16.8.0"; sha256 = "1y05sjk7wgd29a47v1yhn2s1lrd8wgazkilvmjbvivmrrm3fqjs8"; })
  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; sha256 = "0zxc0apx1gcx361jlq8smc9pfdgmyjh6hpka8dypc9w23nlsh6yj"; })
  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.5.0"; sha256 = "01i28nvzccxbqmiz217fxs6hnjwmd5fafs37rd49a6qp53y6623l"; })
@ -23,11 +23,11 @@
  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "6.15.0"; sha256 = "0jn9a20a2zixnkm3bmpmvmiv7mk0hqdlnpi0qgjkg1nir87czm19"; })
  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "6.15.0"; sha256 = "1nbgydr45f7lp980xyrkzpyaw2mkkishjwp3slgxk7f0mz6q8i1v"; })
  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "16.8.0"; sha256 = "1ln2mva7j2mpsj9rdhpk8vhm3pgd8wn563xqdcwd38avnhp74rm9"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "6.0.4"; sha256 = "0vgjwpy55mf6x22a634cdidckyq5hi941i9p10jqyrbnc637frv2"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "6.0.4"; sha256 = "1qasm6j25lmcc4xn7f7s3jli1pypz1kfnj7j9dkjlx9mc8r356zp"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.4"; sha256 = "1gibwhplbanv6bz3l71w8vhzlgqsh21bms30dbf1n60v7p02fl3h"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "6.0.4"; sha256 = "0gkzqsmj12wwdh548rb9drjgmyzvqalmwwq0fzvgj9c7zm1gdndi"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x64"; version = "6.0.4"; sha256 = "1x4ysack9n57h8w1ybfyczkf3w6jsgz7ila0czm2011w4sjnyqj0"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "6.0.5"; sha256 = "1bx0bbzwnbp7r7dcxcq5222zbhmgirs75lcm6azqw5f5qxrvv5x8"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "6.0.5"; sha256 = "19lfp3lbvsvc51q46jwy5l39skx5rfiyhk6f6djdc3g5l55kb871"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.5"; sha256 = "0hzsvhk5hzk0iav7cc2i8dgyx02a5jks2g0jljychw18ck9s2ilg"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "6.0.5"; sha256 = "0xyvhhksdxjdwn1bfkhvxrgyd92p01r9mdjsand05dmba4q7gxqq"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x64"; version = "6.0.5"; sha256 = "1ihlnzp7zclc76d1ig3dc71l0gm7z5lqqwppjj06aa4yhrsa2baj"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.0.0"; sha256 = "1fk2fk2639i7nzy58m9dvpdnzql4vb8yl8vr19r2fp8lmj9w2jr0"; })
--- a/pkgs/applications/emulators/ryujinx/updater.sh
+++ b/pkgs/applications/emulators/ryujinx/updater.sh
@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=./. -i bash -p coreutils gnused curl common-updater-scripts nuget-to-nix nix-prefetch-git jq dotnet-sdk_6
+#! nix-shell -I nixpkgs=../../../.. -i bash -p coreutils gnused curl common-updater-scripts nuget-to-nix nix-prefetch-git jq dotnet-sdk_6
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"

@ -60,14 +60,18 @@ OLD_VERSION="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"

 echo "comparing versions $OLD_VERSION -> $NEW_VERSION"
 if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
-    echo "Already up to date! Doing nothing"
-    exit 0
+    echo "Already up to date!"
+    if [[ "$1" != "--deps-only" ]]; then
+      exit 0
+    fi
 fi

-SHA="$(nix-prefetch-git https://github.com/ryujinx/ryujinx --rev "$COMMIT" --quiet | jq -r '.sha256')"
-
 cd ../../../..
-update-source-version ryujinx "$NEW_VERSION" "$SHA" --rev="$COMMIT"
+
+if [[ "$1" != "--deps-only" ]]; then
+    SHA="$(nix-prefetch-git https://github.com/ryujinx/ryujinx --rev "$COMMIT" --quiet | jq -r '.sha256')"
+    update-source-version ryujinx "$NEW_VERSION" "$SHA" --rev="$COMMIT"
+fi

 echo "building Nuget lockfile"

--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@ -175,9 +175,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
    done
  '';

-  # Until https://github.com/NixOS/nixpkgs/pull/172617 is applied,
-  # parallel builds do not always work because of a bug in dlltool.
-  enableParallelBuilding = false;
+  enableParallelBuilding = true;

  # https://bugs.winehq.org/show_bug.cgi?id=43530
  # https://github.com/NixOS/nixpkgs/issues/31989
--- a/pkgs/applications/graphics/gnuclad/default.nix
+++ b/pkgs/applications/graphics/gnuclad/default.nix
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    sha256 = "0ka2kscpjff7gflsargv3r9fdaxhkf3nym9mfaln3pnq6q7fwdki";
  };

-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  NIX_CFLAGS_COMPILE = lib.optional stdenv.cc.isGNU "-Wno-error=catch-value";

  nativeBuildInputs = [ pkg-config ];

@ -19,6 +19,6 @@ stdenv.mkDerivation rec {
    description = "gnuclad tries to help the environment by creating trees.  Its primary use will be generating cladogram trees for the GNU/Linux distro timeline project";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ mog ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/graphics/scantailor/advanced.nix
+++ b/pkgs/applications/graphics/scantailor/advanced.nix
@ -4,21 +4,21 @@

 mkDerivation rec {
  pname = "scantailor-advanced";
-  version = "1.0.16";
+  version = "1.0.18";

  src = fetchFromGitHub {
-    owner = "4lex4";
+    owner = "vigri";
    repo = "scantailor-advanced";
    rev = "v${version}";
-    sha256 = "0lc9lzbpiy5hgimyhl4s4q67pb9gacpy985gl6iy8pl79zxhmcyp";
+    sha256 = "sha256-4/QSjgHvRgIduS/AXbT7osRTdOdgR7On3CbjRnGbwHU=";
  };

  nativeBuildInputs = [ cmake qttools ];
  buildInputs = [ libjpeg libpng libtiff boost qtbase ];

  meta = with lib; {
-    homepage = "https://github.com/4lex4/scantailor-advanced";
-    description = "Interactive post-processing tool for scanned pages";
+    homepage = "https://github.com/vigri/scantailor-advanced";
+    description = "Interactive post-processing tool for scanned pages (vigri's fork)";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ jfrankenau ];
    platforms = with platforms; gnu ++ linux ++ darwin;
--- a/pkgs/applications/misc/ArchiSteamFarm/deps-aarch64-linux.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps-aarch64-linux.nix
@ -55,12 +55,12 @@
  (fetchNuGet { pname = "Humanizer.Core.zh-Hant"; version = "2.14.1"; sha256 = "0qxjnbdj645l5sd6y3100yyrq1jy5misswg6xcch06x8jv7zaw1p"; })
  (fetchNuGet { pname = "JetBrains.Annotations"; version = "2022.1.0"; sha256 = "0lsqpssain0v9i3jhpi1c42r5s329y31cvqk5x7gqvy17f29y002"; })
  (fetchNuGet { pname = "Markdig.Signed"; version = "0.30.2"; sha256 = "094yy2hfwvnlzap919zmnbfc915v86gd1zb9hfcbfvzbly11rd7s"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm"; version = "6.0.4"; sha256 = "195yldf6ws9qbb2aqrrr9bbaq9f8i0dvyb8jgrvg7jhay8j775ay"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.4"; sha256 = "0s1hkanhfv7virdynxxx28kp3w596iiplvi0jqv3dsr63gl0m0m7"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.4"; sha256 = "1fvv5ri32pbl43628zqnim6fbv6hjxf66p0v793xdh57dzkdyh0j"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-arm64"; version = "6.0.4"; sha256 = "0244kxk61hddbgwkg7d7b3lf3w545w31m7hkmdb09b6jhk0kdf16"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-x64"; version = "6.0.4"; sha256 = "1m8iaq78kii0z4lxwq1igm8f4yv010blrifab4zp491b0j0qg1d4"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x64"; version = "6.0.4"; sha256 = "1sqv7vhkm4j11rl7mfvs4mmmclcdps2n4pf31ck2mcx54nr4d2kj"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm"; version = "6.0.5"; sha256 = "1lmi0jl63377gbrjicfh06jcvgxc3q6x4k7545cby38fbkwnbgic"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.5"; sha256 = "0mjv5w9gia3bb2qg7ahh6j1mgb3fwlr3famxssdy8vq8qgfd1h4h"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.5"; sha256 = "0br5ms806jsgc2jghcjb6lm2h1ifq8wa3cgxp5ginrhzzj3p145i"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-arm64"; version = "6.0.5"; sha256 = "0ns6ibghr8silf6pxd8ibwyflyrpjy3z8yqh4w2sr8yrhmv32d3j"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-x64"; version = "6.0.5"; sha256 = "15fbzv7yywhzfmkkrqi9xxwi0h6fy9miz5ihl8j4hd0psqc8wil3"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x64"; version = "6.0.5"; sha256 = "1wl227mbbda039dznl2lvd65kh3k978qa88pa2ayqjx3vb6394q9"; })
  (fetchNuGet { pname = "Microsoft.AspNetCore.JsonPatch"; version = "6.0.0-rc.1.21452.15"; sha256 = "0c3vnaag8gxlxij77n18m3hawpjkjjamsnq5kfjz5cvc7sfg3fwh"; })
  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.NewtonsoftJson"; version = "6.0.0-rc.1.21452.15"; sha256 = "1xyx358w4fqzxr9cy358agnm86rjijbnvikiqlngz2msgmldxi2z"; })
  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
@ -77,17 +77,17 @@
  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "5.0.0"; sha256 = "1rdmgpg770x8qwaaa6ryc27zh93p697fcyvn5vkxp0wimlhqkbay"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "5.0.0"; sha256 = "0swqcknyh87ns82w539z1mvy804pfwhgzs97cr3nwqk6g5s42gd6"; })
  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.2.0"; sha256 = "0ncnq378pk1immy2dyf75xjf2xn72r4m5gma1njhc4rvhzx9qz11"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm"; version = "6.0.4"; sha256 = "1zm9q9yvglsn5w786c9cjdfj1a8z4sipmvn9rhg3ps23rllxwmcc"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.4"; sha256 = "1x1g3jhd57z1w3js7f6qa72vwvvjayvxzc2xxcqyscm9xy1fb3d4"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-arm64"; version = "6.0.4"; sha256 = "08mrvb71kldzla2j7v10ifxrc6bwsrd4bms2rqfb7rmx00qs6yj0"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "6.0.4"; sha256 = "0vgjwpy55mf6x22a634cdidckyq5hi941i9p10jqyrbnc637frv2"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "6.0.4"; sha256 = "1qasm6j25lmcc4xn7f7s3jli1pypz1kfnj7j9dkjlx9mc8r356zp"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm"; version = "6.0.4"; sha256 = "026kl3cdbk35rjcnbj92bv7pvx20jd80hxxrnz1s4kzlm4rsp0bv"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.4"; sha256 = "09i8ca56szmvyp1xlddyv3124rrcar8vgsq3pmprcylfdjarck6x"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.4"; sha256 = "1gibwhplbanv6bz3l71w8vhzlgqsh21bms30dbf1n60v7p02fl3h"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-arm64"; version = "6.0.4"; sha256 = "0h7vkcxaqjll65qka6hsz2hi0vmsizg4ys38a0qg76r0blsnk2yr"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "6.0.4"; sha256 = "0gkzqsmj12wwdh548rb9drjgmyzvqalmwwq0fzvgj9c7zm1gdndi"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x64"; version = "6.0.4"; sha256 = "1x4ysack9n57h8w1ybfyczkf3w6jsgz7ila0czm2011w4sjnyqj0"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm"; version = "6.0.5"; sha256 = "0bxrmv89018gsmhggxmyfyb1xmdn2p9mz1n8gg9lrf448d0ahqax"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.5"; sha256 = "0jgz59npwawkivlzw27zwn7qf5y58i3vd9981j0lfwz6qhcknb8r"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-arm64"; version = "6.0.5"; sha256 = "10q7irxzzph0ijv0j9xax6sy3ahlkply5p49b8dk2718x3bmaj0p"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "6.0.5"; sha256 = "1bx0bbzwnbp7r7dcxcq5222zbhmgirs75lcm6azqw5f5qxrvv5x8"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "6.0.5"; sha256 = "19lfp3lbvsvc51q46jwy5l39skx5rfiyhk6f6djdc3g5l55kb871"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm"; version = "6.0.5"; sha256 = "1l67hb5gzmd1b26rficg9jb6bkjgh0zi262bynia2dqpph2x07sx"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.5"; sha256 = "0x1jhv7h17kwxigrwlcs13kf4xlfy0977hdajj96kl6vbcd7256d"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.5"; sha256 = "0hzsvhk5hzk0iav7cc2i8dgyx02a5jks2g0jljychw18ck9s2ilg"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-arm64"; version = "6.0.5"; sha256 = "1xd89kws1bpdml4wfcjbwy4ydxdzvki0dbsw1v58b3l6ih4mz6ry"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "6.0.5"; sha256 = "0xyvhhksdxjdwn1bfkhvxrgyd92p01r9mdjsand05dmba4q7gxqq"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x64"; version = "6.0.5"; sha256 = "1ihlnzp7zclc76d1ig3dc71l0gm7z5lqqwppjj06aa4yhrsa2baj"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.0.0"; sha256 = "1fk2fk2639i7nzy58m9dvpdnzql4vb8yl8vr19r2fp8lmj9w2jr0"; })
--- a/pkgs/applications/misc/ArchiSteamFarm/deps-x86_64-linux.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps-x86_64-linux.nix
@ -55,12 +55,12 @@
  (fetchNuGet { pname = "Humanizer.Core.zh-Hant"; version = "2.14.1"; sha256 = "0qxjnbdj645l5sd6y3100yyrq1jy5misswg6xcch06x8jv7zaw1p"; })
  (fetchNuGet { pname = "JetBrains.Annotations"; version = "2022.1.0"; sha256 = "0lsqpssain0v9i3jhpi1c42r5s329y31cvqk5x7gqvy17f29y002"; })
  (fetchNuGet { pname = "Markdig.Signed"; version = "0.30.2"; sha256 = "094yy2hfwvnlzap919zmnbfc915v86gd1zb9hfcbfvzbly11rd7s"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm"; version = "6.0.4"; sha256 = "195yldf6ws9qbb2aqrrr9bbaq9f8i0dvyb8jgrvg7jhay8j775ay"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.4"; sha256 = "0s1hkanhfv7virdynxxx28kp3w596iiplvi0jqv3dsr63gl0m0m7"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.4"; sha256 = "1fvv5ri32pbl43628zqnim6fbv6hjxf66p0v793xdh57dzkdyh0j"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-arm64"; version = "6.0.4"; sha256 = "0244kxk61hddbgwkg7d7b3lf3w545w31m7hkmdb09b6jhk0kdf16"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-x64"; version = "6.0.4"; sha256 = "1m8iaq78kii0z4lxwq1igm8f4yv010blrifab4zp491b0j0qg1d4"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x64"; version = "6.0.4"; sha256 = "1sqv7vhkm4j11rl7mfvs4mmmclcdps2n4pf31ck2mcx54nr4d2kj"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm"; version = "6.0.5"; sha256 = "1lmi0jl63377gbrjicfh06jcvgxc3q6x4k7545cby38fbkwnbgic"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.5"; sha256 = "0mjv5w9gia3bb2qg7ahh6j1mgb3fwlr3famxssdy8vq8qgfd1h4h"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.5"; sha256 = "0br5ms806jsgc2jghcjb6lm2h1ifq8wa3cgxp5ginrhzzj3p145i"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-arm64"; version = "6.0.5"; sha256 = "0ns6ibghr8silf6pxd8ibwyflyrpjy3z8yqh4w2sr8yrhmv32d3j"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-x64"; version = "6.0.5"; sha256 = "15fbzv7yywhzfmkkrqi9xxwi0h6fy9miz5ihl8j4hd0psqc8wil3"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x64"; version = "6.0.5"; sha256 = "1wl227mbbda039dznl2lvd65kh3k978qa88pa2ayqjx3vb6394q9"; })
  (fetchNuGet { pname = "Microsoft.AspNetCore.JsonPatch"; version = "6.0.0-rc.1.21452.15"; sha256 = "0c3vnaag8gxlxij77n18m3hawpjkjjamsnq5kfjz5cvc7sfg3fwh"; })
  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.NewtonsoftJson"; version = "6.0.0-rc.1.21452.15"; sha256 = "1xyx358w4fqzxr9cy358agnm86rjijbnvikiqlngz2msgmldxi2z"; })
  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
@ -77,17 +77,17 @@
  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "5.0.0"; sha256 = "1rdmgpg770x8qwaaa6ryc27zh93p697fcyvn5vkxp0wimlhqkbay"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "5.0.0"; sha256 = "0swqcknyh87ns82w539z1mvy804pfwhgzs97cr3nwqk6g5s42gd6"; })
  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.2.0"; sha256 = "0ncnq378pk1immy2dyf75xjf2xn72r4m5gma1njhc4rvhzx9qz11"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm"; version = "6.0.4"; sha256 = "1zm9q9yvglsn5w786c9cjdfj1a8z4sipmvn9rhg3ps23rllxwmcc"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "6.0.4"; sha256 = "0g1vw0wr88zlfpdg2gz8c0mriasci1kzvjia4nj19j7b0zaga7f0"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-arm64"; version = "6.0.4"; sha256 = "08mrvb71kldzla2j7v10ifxrc6bwsrd4bms2rqfb7rmx00qs6yj0"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "6.0.4"; sha256 = "0vgjwpy55mf6x22a634cdidckyq5hi941i9p10jqyrbnc637frv2"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "6.0.4"; sha256 = "1qasm6j25lmcc4xn7f7s3jli1pypz1kfnj7j9dkjlx9mc8r356zp"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm"; version = "6.0.4"; sha256 = "026kl3cdbk35rjcnbj92bv7pvx20jd80hxxrnz1s4kzlm4rsp0bv"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.4"; sha256 = "09i8ca56szmvyp1xlddyv3124rrcar8vgsq3pmprcylfdjarck6x"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.4"; sha256 = "1gibwhplbanv6bz3l71w8vhzlgqsh21bms30dbf1n60v7p02fl3h"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-arm64"; version = "6.0.4"; sha256 = "0h7vkcxaqjll65qka6hsz2hi0vmsizg4ys38a0qg76r0blsnk2yr"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "6.0.4"; sha256 = "0gkzqsmj12wwdh548rb9drjgmyzvqalmwwq0fzvgj9c7zm1gdndi"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x64"; version = "6.0.4"; sha256 = "1x4ysack9n57h8w1ybfyczkf3w6jsgz7ila0czm2011w4sjnyqj0"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm"; version = "6.0.5"; sha256 = "0bxrmv89018gsmhggxmyfyb1xmdn2p9mz1n8gg9lrf448d0ahqax"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "6.0.5"; sha256 = "0q9wswwnwdi2y9ca2h072anb2m8mjs01hqg6p9kyxlsgfmvcaxmw"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-arm64"; version = "6.0.5"; sha256 = "10q7irxzzph0ijv0j9xax6sy3ahlkply5p49b8dk2718x3bmaj0p"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "6.0.5"; sha256 = "1bx0bbzwnbp7r7dcxcq5222zbhmgirs75lcm6azqw5f5qxrvv5x8"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "6.0.5"; sha256 = "19lfp3lbvsvc51q46jwy5l39skx5rfiyhk6f6djdc3g5l55kb871"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm"; version = "6.0.5"; sha256 = "1l67hb5gzmd1b26rficg9jb6bkjgh0zi262bynia2dqpph2x07sx"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.5"; sha256 = "0x1jhv7h17kwxigrwlcs13kf4xlfy0977hdajj96kl6vbcd7256d"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.5"; sha256 = "0hzsvhk5hzk0iav7cc2i8dgyx02a5jks2g0jljychw18ck9s2ilg"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-arm64"; version = "6.0.5"; sha256 = "1xd89kws1bpdml4wfcjbwy4ydxdzvki0dbsw1v58b3l6ih4mz6ry"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "6.0.5"; sha256 = "0xyvhhksdxjdwn1bfkhvxrgyd92p01r9mdjsand05dmba4q7gxqq"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x64"; version = "6.0.5"; sha256 = "1ihlnzp7zclc76d1ig3dc71l0gm7z5lqqwppjj06aa4yhrsa2baj"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.0.0"; sha256 = "1fk2fk2639i7nzy58m9dvpdnzql4vb8yl8vr19r2fp8lmj9w2jr0"; })
--- a/pkgs/applications/misc/ArchiSteamFarm/updater.sh
+++ b/pkgs/applications/misc/ArchiSteamFarm/updater.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused jq common-updater-scripts nuget-to-nix
+#!nix-shell -I nixpkgs=../../../.. -i bash -p curl gnused jq common-updater-scripts nuget-to-nix
 set -exo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"

@ -10,11 +10,17 @@ old_version="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"

 if [[ "$new_version" == "$old_version" ]]; then
  echo "Already up to date!"
-  exit 0
+  if [[ "$1" != "--deps-only" ]]; then
+    exit 0
+  fi
 fi

 cd ../../../..
-update-source-version ArchiSteamFarm "$new_version"
+
+nixpkgs_path=$(pwd)
+if [[ "$1" != "--deps-only" ]]; then
+    update-source-version ArchiSteamFarm "$new_version"
+fi
 store_src="$(nix-build -A ArchiSteamFarm.src --no-out-link)"
 platforms="$(nix-instantiate --strict --eval --json -A ArchiSteamFarm.meta.platforms | jq -r .[])"
 src="$(mktemp -d /tmp/ArchiSteamFarm-src.XXX)"
@ -27,7 +33,7 @@ export DOTNET_NOLOGO=1
 export DOTNET_CLI_TELEMETRY_OPTOUT=1

 for i in $platforms; do
-  nix-shell -p dotnet-sdk_6 --argstr system $i --run "
+  nix-shell -I nixpkgs="$nixpkgs_path" -p dotnet-sdk_6 --argstr system $i --run "
     mkdir ./nuget_pkgs-$i
     for project in ArchiSteamFarm/ArchiSteamFarm.csproj ArchiSteamFarm.Tests/ArchiSteamFarm.Tests.csproj; do
       dotnet restore $project --packages ./nuget_pkgs-$i
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -39,7 +39,7 @@ let
    rev = version;
    sha256 = "sha256-BoikYSsQZAv8WswIr5nmBsGmjZbTXaLAbdO2QtPvc7c=";

-    extraPostFetch = ''
+    postFetch = ''
      mv $out ./all
      mv ./all/electrum/tests $out
    '';
--- a/pkgs/applications/misc/electrum/ltc.nix
+++ b/pkgs/applications/misc/electrum/ltc.nix
@ -38,7 +38,7 @@ let
    rev = version;
    sha256 = "sha256-oZjQnrnj8nCaQjrIz8bWNt6Ib8Wu2ZMXHEPfCCy2fjk=";

-    extraPostFetch = ''
+    postFetch = ''
      mv $out ./all
      mv ./all/electrum_ltc/tests $out
    '';
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@ -10,13 +10,13 @@

 mkDerivation rec {
  pname = "pgmodeler";
-  version = "0.9.3";
+  version = "0.9.4";

  src = fetchFromGitHub {
    owner = "pgmodeler";
    repo = "pgmodeler";
    rev = "v${version}";
-    sha256 = "1bci5x418dbnkny7hn0b5q5lxyajrgl3frv41ji0hcw9vivrds2g";
+    sha256 = "sha256-FwLPhIc2ofaB8Z2ZUYMFFt5XdoosEfEOwoIaI7pSxa0=";
  };

  nativeBuildInputs = [ pkg-config qmake ];
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -104,7 +104,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    dpkg
-    (wrapGAppsHook.override { makeBinaryWrapper = makeWrapper; })
+    (wrapGAppsHook.override { inherit makeWrapper; })
  ];

  buildInputs = [
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -68,6 +68,7 @@
 , xorg
 , zip
 , zlib
+, pkgsBuildBuild

 # optionals

@ -142,16 +143,21 @@ let

  # Target the LLVM version that rustc is built with for LTO.
  llvmPackages0 = rustc.llvmPackages;
+  llvmPackagesBuildBuild0 = pkgsBuildBuild.rustc.llvmPackages;

  # Force the use of lld and other llvm tools for LTO
  llvmPackages = llvmPackages0.override {
    bootBintoolsNoLibc = null;
    bootBintools = null;
  };
+  llvmPackagesBuildBuild = llvmPackagesBuildBuild0.override {
+    bootBintoolsNoLibc = null;
+    bootBintools = null;
+  };

  # LTO requires LLVM bintools including ld.lld and llvm-ar.
  buildStdenv = overrideCC llvmPackages.stdenv (llvmPackages.stdenv.cc.override {
-    inherit (llvmPackages) bintools;
+    bintools = if ltoSupport then buildPackages.rustc.llvmPackages.bintools else stdenv.cc.bintools;
  });

  # Compile the wasm32 sysroot to build the RLBox Sandbox
@ -217,10 +223,15 @@ buildStdenv.mkDerivation ({
  # two patches.
  patchFlags = [ "-p1" "-l" ];

+  # if not explicitly set, wrong cc from buildStdenv would be used
+  HOST_CC = "${llvmPackagesBuildBuild.stdenv.cc}/bin/cc";
+  HOST_CXX = "${llvmPackagesBuildBuild.stdenv.cc}/bin/c++";
+
  nativeBuildInputs = [
    autoconf
    cargo
-    llvmPackages.llvm # llvm-objdump
+    gnum4
+    llvmPackagesBuildBuild.bintools
    makeWrapper
    nodejs
    perl
@ -302,6 +313,9 @@ buildStdenv.mkDerivation ({
    export MOZILLA_OFFICIAL=1
  '';

+  # firefox has a different definition of configurePlatforms from nixpkgs, see configureFlags
+  configurePlatforms = [ ];
+
  configureFlags = [
    "--disable-tests"
    "--disable-updater"
@ -309,7 +323,7 @@ buildStdenv.mkDerivation ({
    "--enable-default-toolkit=cairo-gtk3${lib.optionalString waylandSupport "-wayland"}"
    "--enable-system-pixman"
    "--with-distribution-id=org.nixos"
-    "--with-libclang-path=${llvmPackages.libclang.lib}/lib"
+    "--with-libclang-path=${llvmPackagesBuildBuild.libclang.lib}/lib"
    "--with-system-ffi"
    "--with-system-icu"
    "--with-system-jpeg"
@ -320,6 +334,9 @@ buildStdenv.mkDerivation ({
    "--with-system-png" # needs APNG support
    "--with-system-webp"
    "--with-system-zlib"
+    # for firefox, host is buildPlatform, target is hostPlatform
+    "--host=${buildStdenv.buildPlatform.config}"
+    "--target=${buildStdenv.hostPlatform.config}"
  ]
  # LTO is done using clang and lld on Linux.
  ++ lib.optionals ltoSupport [
@ -362,7 +379,6 @@ buildStdenv.mkDerivation ({
    fontconfig
    freetype
    glib
-    gnum4
    gtk3
    icu
    libffi
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, makeDesktopItem, makeWrapper, lndir, config
+{ stdenv, lib, makeDesktopItem, makeWrapper, makeBinaryWrapper, lndir, config
 , fetchurl, zip, unzip, jq, xdg-utils, writeText

 ## various stuff that can be plugged in
@ -231,7 +231,7 @@ let
          # Symbolic link: wrap the link's target.
          oldExe="$(readlink -v --canonicalize-existing "$executablePath")"
          rm "$executablePath"
-        elif wrapperCmd=$(strings -dw "$executablePath" | sed -n '/^makeCWrapper/,/^$/ p'); [[ $wrapperCmd ]]; then
+        elif wrapperCmd=$(${makeBinaryWrapper.extractCmd} "$executablePath"); [[ $wrapperCmd ]]; then
          # If the executable is a binary wrapper, we need to update its target to
          # point to $out, but we can't just edit the binary in-place because of length
          # issues. So we extract the command used to create the wrapper and add the
@ -239,10 +239,7 @@ let
          parseMakeCWrapperCall() {
            shift # makeCWrapper
            oldExe=$1; shift
-            for arg do case $arg in
-              --inherit-argv0) oldWrapperArgs+=(--argv0 '$0');; # makeWrapper doesn't understand --inherit-argv0
-              *) oldWrapperArgs+=("$arg");;
-            esac done
+            oldWrapperArgs=("$@")
          }
          eval "parseMakeCWrapperCall ''${wrapperCmd//"${browser}"/"$out"}"
          rm "$executablePath"
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -49,10 +49,10 @@
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.167.0",
-    "sha256": "sha256-l2wCcYcAlKQTKkD+3yFi4zBkMVpq27Ygld1UjeD6IHM=",
+    "rev": "v1.168.0",
+    "sha256": "sha256-NN4dqEywcoP4tk2J6RfWqoGw+95bIEoxb4YpwPtoTZ0=",
    "vendorSha256": "sha256-qZNYfSlUkCu7FudbKF4IOgK1xWM5LqUghclOeGOxYXg=",
-    "version": "1.167.0"
+    "version": "1.168.0"
  },
  "ansible": {
    "owner": "nbering",
@ -103,10 +103,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v4.14.0",
-    "sha256": "sha256-9xJVJw2kIutmmiKGvRBKS+/oyGSq0dipeCn2Gmtk1AU=",
-    "vendorSha256": "sha256-+YINrbj52ionuQbcgck6Dp2h88+LS5tXPmoVHXCAXOk=",
-    "version": "4.14.0"
+    "rev": "v4.15.1",
+    "sha256": "sha256-o8yUcjw4X+Vx49hV+0guccueWoHvpxSs+sMsbAoAw9o=",
+    "vendorSha256": "sha256-l7Fe5hhEvJ5DiZ3t79sZYIt+6eZkjjf7Npmr8p2/e/4=",
+    "version": "4.15.1"
  },
  "azuread": {
    "owner": "hashicorp",
@ -121,10 +121,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
    "repo": "terraform-provider-azurerm",
-    "rev": "v3.6.0",
-    "sha256": "sha256-brC9HZbyettgvwuFjrPxeRg/msQ1leD7F/h9aUxXAYo=",
+    "rev": "v3.7.0",
+    "sha256": "sha256-dvkR2nEtf4HvLTIoa++4PI5oNOPuJzI4obxdI4meKG4=",
    "vendorSha256": null,
-    "version": "3.6.0"
+    "version": "3.7.0"
  },
  "azurestack": {
    "owner": "hashicorp",
@ -203,10 +203,10 @@
    "owner": "CheckPointSW",
    "provider-source-address": "registry.terraform.io/CheckPointSW/checkpoint",
    "repo": "terraform-provider-checkpoint",
-    "rev": "v1.7.0",
-    "sha256": "1msd3qjrrhl0v3m7n9ybkwxki5wpchzjswd2dcifbif4k8pcs470",
-    "vendorSha256": "0yaxgyzwja5dl4p7w8q77ash75xwsf05kq88nvmdf94lvspfnwlq",
-    "version": "1.7.0"
+    "rev": "v1.8.0",
+    "sha256": "sha256-+lcJr7C7FsvSzkfFwEfTrJedx6vMvOrTjNA+JTWBI4c=",
+    "vendorSha256": "sha256-mHLrrt6UJNfqtgjhWYDTvJcDtToHI34uoa0oyb9/XXk=",
+    "version": "1.8.0"
  },
  "ciscoasa": {
    "owner": "CiscoDevNet",
@ -230,10 +230,10 @@
    "owner": "cloudflare",
    "provider-source-address": "registry.terraform.io/cloudflare/cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v3.14.0",
-    "sha256": "sha256-WjtAqL4gzr7NdRLf7mr6OULee35kyyZpr5crR514Mak=",
-    "vendorSha256": "sha256-xqjhSu1bUSpQ1A2Ga2IS2fdyIXcnt/nbQNXhcxVi22Q=",
-    "version": "3.14.0"
+    "rev": "v3.15.0",
+    "sha256": "sha256-y1UbirPJG9Behsr/VdILoVHIM2z9pF6iyEwXgDKbDaw=",
+    "vendorSha256": "sha256-R8B5fmjRBB2q12tzWbzOzzSOC0mNJNV1JiVjddDa11c=",
+    "version": "3.15.0"
  },
  "cloudfoundry": {
    "owner": "cloudfoundry-community",
@ -257,10 +257,10 @@
    "owner": "cloudscale-ch",
    "provider-source-address": "registry.terraform.io/cloudscale-ch/cloudscale",
    "repo": "terraform-provider-cloudscale",
-    "rev": "v3.2.0",
-    "sha256": "1bczibhv2jr2h5mrqs41s6dlsi7i2pbrlbxv4m49q2xlq9lza4yk",
+    "rev": "v4.0.0",
+    "sha256": "sha256-Eo7zT/KiJdzo7fhAcCg6EV29ENM/XSBumAHmL9J8agU=",
    "vendorSha256": null,
-    "version": "3.2.0"
+    "version": "4.0.0"
  },
  "constellix": {
    "deleteVendor": true,
@ -429,10 +429,10 @@
    "owner": "integrations",
    "provider-source-address": "registry.terraform.io/integrations/github",
    "repo": "terraform-provider-github",
-    "rev": "v4.24.1",
-    "sha256": "sha256-1fwHMN2HIVl+8ZL7OtP1U5ORc41e7Tm3qEpMqIgWL20=",
+    "rev": "v4.25.0",
+    "sha256": "sha256-9sZYg/gpCq2qpUhhFQjLVZLlNnYWaCz5K4/+TvCD/qk=",
    "vendorSha256": null,
-    "version": "4.24.1"
+    "version": "4.25.0"
  },
  "gitlab": {
    "owner": "gitlabhq",
@ -448,20 +448,20 @@
    "provider-source-address": "registry.terraform.io/hashicorp/google",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.20.0",
-    "sha256": "sha256-eZNa6V3aVtEgTZgTNgB4EUK3S6iKfk9qI7OnAQ5Mbp4=",
-    "vendorSha256": "sha256-l2OviwplP/Sg2ShaEA88pMwVTkREnLkFAzterjr2kvU=",
-    "version": "4.20.0"
+    "rev": "v4.21.0",
+    "sha256": "sha256-xintCclIhM2FqmbYoWTPGq/twkUH3M2ebc/b0SZ/hXY=",
+    "vendorSha256": "sha256-B3JiVeCzeCtsAvQiHayZY3pahN4bwizE6d99Qw2VYK8=",
+    "version": "4.21.0"
  },
  "google-beta": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.20.0",
-    "sha256": "sha256-Dr3G7KskfL+4WNOPL3SZCKf+Lo6wP3XS1JrlC6Mv3O8=",
-    "vendorSha256": "sha256-l2OviwplP/Sg2ShaEA88pMwVTkREnLkFAzterjr2kvU=",
-    "version": "4.20.0"
+    "rev": "v4.21.0",
+    "sha256": "sha256-3oViGAFwUTBC4tMUlnjUDHdmk+sxtCeVZNbYGGwHhwU=",
+    "vendorSha256": "sha256-B3JiVeCzeCtsAvQiHayZY3pahN4bwizE6d99Qw2VYK8=",
+    "version": "4.21.0"
  },
  "googleworkspace": {
    "owner": "hashicorp",
@ -566,10 +566,10 @@
    "owner": "IBM-Cloud",
    "provider-source-address": "registry.terraform.io/IBM-Cloud/ibm",
    "repo": "terraform-provider-ibm",
-    "rev": "v1.41.0",
-    "sha256": "sha256-5kHoTmQlEzTSjDnAJPdEN2y+DF9gB2BHJFHEYLh6h48=",
+    "rev": "v1.41.1",
+    "sha256": "sha256-eTwv7dtuFe7oEFFqnmpJMN2d/P5ow8HH1rXCE6xBEi4=",
    "vendorSha256": "sha256-8s32A0qgODZZy3rSrHnnBkQyKLBj0fcCBJ9ja9gXc5Q=",
-    "version": "1.41.0"
+    "version": "1.41.1"
  },
  "icinga2": {
    "owner": "Icinga",
@ -593,10 +593,10 @@
    "owner": "Mongey",
    "provider-source-address": "registry.terraform.io/Mongey/kafka",
    "repo": "terraform-provider-kafka",
-    "rev": "v0.5.0",
-    "sha256": "sha256-1SZkCuAmYlfzYVpS+qrNN+vl3zrFZGUgdrrgKj0VRUE=",
-    "vendorSha256": "sha256-6wccODr/eJUh5eeDGDCuuK2pCFmvPlXWmdAUnjBHJ5E=",
-    "version": "0.5.0"
+    "rev": "v0.5.1",
+    "sha256": "sha256-bKbY2cOIORy3D9yCBqVuKUZb650sx+87d4wtUB3dPdg=",
+    "vendorSha256": "sha256-03QV6C2DEN5xwMwABwSvv5Ts6pTHQDBP2zUUqIcOtVQ=",
+    "version": "0.5.1"
  },
  "kafka-connect": {
    "owner": "Mongey",
@ -683,10 +683,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/local",
    "repo": "terraform-provider-local",
-    "rev": "v2.2.2",
-    "sha256": "sha256-JpTdRi9EagrnhYnlq6sl6+t4SE6i7T7YrGTsYCDync8=",
-    "vendorSha256": "sha256-Ha/MGbXwwhbVxaHbkU2xBhyNcDxLivk7vYQjfVzWOcY=",
-    "version": "2.2.2"
+    "rev": "v2.2.3",
+    "sha256": "sha256-l9XQpIMMar7ForZuBcGOmqrRuSnthIrilr4CHJ5SiaU=",
+    "vendorSha256": "sha256-5rqn9/NE7Q0VI6SRd2VFKJl4npz9Y0Qp1pEpfj9KxrQ=",
+    "version": "2.2.3"
  },
  "logicmonitor": {
    "owner": "logicmonitor",
@ -764,10 +764,10 @@
    "owner": "NaverCloudPlatform",
    "provider-source-address": "registry.terraform.io/NaverCloudPlatform/ncloud",
    "repo": "terraform-provider-ncloud",
-    "rev": "v2.2.8",
-    "sha256": "sha256-G12/+tNSMEPCPCJH//MhRKJoRSex3mS7BZt0C2o0pF0=",
-    "vendorSha256": "sha256-ovHg4GcbMzjEi+qJBpdqhR0YUakZCdnpc10SCu8FP8I=",
-    "version": "2.2.8"
+    "rev": "v2.2.9",
+    "sha256": "sha256-D9B3IJZZOCR/kzFee3sBPEbDcAL33kIef/NAYDuJv7U=",
+    "vendorSha256": "sha256-DPK/RF63rz5AQY/LybT8I6z6vSvqrFqypslhquRrgfg=",
+    "version": "2.2.9"
  },
  "netlify": {
    "owner": "AegirHealth",
@ -837,19 +837,19 @@
    "owner": "oracle",
    "provider-source-address": "registry.terraform.io/oracle/oci",
    "repo": "terraform-provider-oci",
-    "rev": "v4.75.0",
-    "sha256": "sha256-tcDo7yvlobHf4+0BuPdifrkA8UPhI0txRCBgToTjIcw=",
+    "rev": "v4.76.0",
+    "sha256": "sha256-sJ837jK/iYOC3dPFHoix1fiiSFMCNSqYEus9VlhXqMg=",
    "vendorSha256": null,
-    "version": "4.75.0"
+    "version": "4.76.0"
  },
  "okta": {
    "owner": "okta",
    "provider-source-address": "registry.terraform.io/okta/okta",
    "repo": "terraform-provider-okta",
-    "rev": "v3.26.0",
-    "sha256": "sha256-Mnc3JZtKNOB9VpsjXq8WiZz0+zmTmFRfOY23F186tw4=",
-    "vendorSha256": "sha256-LHiOQNFkMajqytrv387yIhAyCQCaG2Kw5OCI8Xe7u2k=",
-    "version": "3.26.0"
+    "rev": "v3.27.0",
+    "sha256": "sha256-DDNq4Yvx45ynNePg8bW8tQ6LuyvUfudxY+M88+pIXMQ=",
+    "vendorSha256": "sha256-but/2CF3OW2aefUIy5XnDvhtXYqfCkHIrS1EDQoD9jM=",
+    "version": "3.27.0"
  },
  "oktaasa": {
    "owner": "oktadeveloper",
@ -891,10 +891,10 @@
    "owner": "opentelekomcloud",
    "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.29.2",
-    "sha256": "sha256-V5EGRd5/JmCDaF1fQkpwHA4DNVFKwvGnMR/AyKvgLtk=",
+    "rev": "v1.29.3",
+    "sha256": "sha256-rFaryW9yibw5whTYOb7kDF45l5NI9bdZvVQezIqudE8=",
    "vendorSha256": "sha256-FOcddb1+uG5avqYZMvzR1UXDvtDDwtxBzf7FsN6ZROM=",
-    "version": "1.29.2"
+    "version": "1.29.3"
  },
  "opsgenie": {
    "owner": "opsgenie",
@ -927,10 +927,10 @@
    "owner": "PagerDuty",
    "provider-source-address": "registry.terraform.io/PagerDuty/pagerduty",
    "repo": "terraform-provider-pagerduty",
-    "rev": "v2.4.1",
-    "sha256": "sha256-2Ot6TxWN+t33EfT5wmkkPjj9DUrPum9whl5wimgjAp0=",
+    "rev": "v2.4.2",
+    "sha256": "sha256-xCmfykHQvQ/O+8ZGe2s5Ic4n9aZvlQ34bpnVbJDCn98=",
    "vendorSha256": null,
-    "version": "2.4.1"
+    "version": "2.4.2"
  },
  "panos": {
    "owner": "PaloAltoNetworks",
@ -990,10 +990,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/random",
    "repo": "terraform-provider-random",
-    "rev": "v3.1.3",
-    "sha256": "sha256-q4j3DXbLiVeSyWGywwLiJspmE08ip3zL8vabfVDWnUo=",
-    "vendorSha256": "sha256-sg89QS0ncCrBGoLvsWFlyCYwNZHNG6iadNJIHWRmhXE=",
-    "version": "3.1.3"
+    "rev": "v3.2.0",
+    "sha256": "sha256-acB1BHGxquiK137OfTe31pUGHdWp7xxlv5BINNzNLSs=",
+    "vendorSha256": "sha256-MMUit5RxsymBNX9fH8B6D2gJ/k5zaN6FCyP9N/+TV+E=",
+    "version": "3.2.0"
  },
  "rundeck": {
    "owner": "rundeck",
@ -1026,10 +1026,10 @@
    "owner": "selectel",
    "provider-source-address": "registry.terraform.io/selectel/selectel",
    "repo": "terraform-provider-selectel",
-    "rev": "v3.8.2",
-    "sha256": "sha256-Lp2ptLuN/+/fcqeSbIMmL4dmOCoplyZeA10wAsCnYlg=",
+    "rev": "v3.8.4",
+    "sha256": "sha256-27Sdez4coJ4Enc1zTg4lr1SzlW3r6wCjciC5ID8vo0w=",
    "vendorSha256": "sha256-kmsO9jFoR/93PkOeIo0pkS/OjE+m3QbIspobAv/9+KI=",
-    "version": "3.8.2"
+    "version": "3.8.4"
  },
  "sentry": {
    "owner": "jianyuan",
@ -1089,10 +1089,10 @@
    "owner": "spotinst",
    "provider-source-address": "registry.terraform.io/spotinst/spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.73.3",
-    "sha256": "sha256-J7hswjjyWOZrsqnhMGAyXnvrVwLRY9jGIdtwN7Dympc=",
-    "vendorSha256": "sha256-szdzI/42RExYQlHnm178RM3wlKOLax+nwgRVzonxXoI=",
-    "version": "1.73.3"
+    "rev": "v1.74.0",
+    "sha256": "sha256-wdhpkQM7J4WO4nN+0R8XfgbuusK0zDzSDy/DyOB8GcI=",
+    "vendorSha256": "sha256-OT5YuAlZNRCvwvZpCrhtKj4YiosEuHrTLQkWFYuKZrw=",
+    "version": "1.74.0"
  },
  "stackpath": {
    "owner": "stackpath",
@ -1116,10 +1116,10 @@
    "owner": "SumoLogic",
    "provider-source-address": "registry.terraform.io/SumoLogic/sumologic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v2.15.0",
-    "sha256": "sha256-VAYU1v5uCIcbeLri6tG5RIAgDP4SzZxQDtK9P5gdSPc=",
+    "rev": "v2.16.0",
+    "sha256": "sha256-27+ofT5p073s2kEk87P/Witw5x9sVKOYrlBXp6/xKxk=",
    "vendorSha256": "sha256-7DGY+L41bJJrtLwdWgu2aMCefgcmtR6tmH12foi68Kc=",
-    "version": "2.15.0"
+    "version": "2.16.0"
  },
  "template": {
    "owner": "hashicorp",
@ -1134,10 +1134,10 @@
    "owner": "tencentcloudstack",
    "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.72.3",
-    "sha256": "sha256-NfrLaKPIAMWeRNVdWEg4wn7pFoLO1Hv3HsxFKkVewPc=",
+    "rev": "v1.72.5",
+    "sha256": "sha256-4ZnhE2Woy+CquDsqJvJMUib48eRJ9OWTrO/14NkI6iM=",
    "vendorSha256": null,
-    "version": "1.72.3"
+    "version": "1.72.5"
  },
  "tfe": {
    "owner": "hashicorp",
@ -1170,10 +1170,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/tls",
    "repo": "terraform-provider-tls",
-    "rev": "v3.3.0",
-    "sha256": "sha256-7A9AXZxTIltZdXXIpMpQGYKwgSdU6kRRNuvVaNtMFGw=",
-    "vendorSha256": "sha256-bj2KpPFFnev5DAND9/HyUC4kOORAvnnpSihUECcHB/8=",
-    "version": "3.3.0"
+    "rev": "v3.4.0",
+    "sha256": "sha256-14sKHnmUfDbXceH+bfSPuA1TKo6Q6kkazYwHC15D4vY=",
+    "vendorSha256": "sha256-o7QvF6Z/HCyb/EBr0m90B63AVKqxteQEBXe+OuovnYg=",
+    "version": "3.4.0"
  },
  "triton": {
    "deleteVendor": true,
@ -1207,19 +1207,19 @@
    "owner": "cloudposse",
    "provider-source-address": "registry.terraform.io/cloudposse/utils",
    "repo": "terraform-provider-utils",
-    "rev": "0.17.23",
-    "sha256": "sha256-/m2K91I1BtzfKTO6sbYL6r0N6GGtd4Ux+GSL0Ut4GUg=",
-    "vendorSha256": "sha256-Rmv3B8Sczvohlfwu248a1pi1VmFGNCB77/IFTBKKeiM=",
-    "version": "0.17.23"
+    "rev": "0.17.24",
+    "sha256": "sha256-/pM6PuvFsmRpBz5pqOy6mVlkbq+9IRlHug/DdoKjt4U=",
+    "vendorSha256": "sha256-4/Djmg6cONkJg1wH7M4Y2mZccbwyUXEvZ2bdBYEnV9w=",
+    "version": "0.17.24"
  },
  "vault": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/vault",
    "repo": "terraform-provider-vault",
-    "rev": "v3.5.0",
-    "sha256": "sha256-Ap96unJFTJ8HKcIs3LYSHfTXszh1gAcZSTEWpS2W2AQ=",
-    "vendorSha256": "sha256-UvczG/31YPIxPBZhwoBC3QS+QA8PRtRqgA/0W8tcXD0=",
-    "version": "3.5.0"
+    "rev": "v3.6.0",
+    "sha256": "sha256-eeE6ThAz7RwePS65RZXbz+PUfm/KlE+f+nJWvLTCSmA=",
+    "vendorSha256": "sha256-KSGhIoUKadAuiMQkJEyYCDt7GXZ9deiV14LV4gEOpVg=",
+    "version": "3.6.0"
  },
  "vcd": {
    "owner": "vmware",
@ -1234,10 +1234,10 @@
    "owner": "Venafi",
    "provider-source-address": "registry.terraform.io/Venafi/venafi",
    "repo": "terraform-provider-venafi",
-    "rev": "v0.15.5",
-    "sha256": "sha256-aNh9P7QqhmdywP47mddcGSDRxkwkrus14tku/xrQcz8=",
-    "vendorSha256": "sha256-SKdSjBXLX344zt0GeGBLNp8cFw+PO9ObT9jC+dHp/h8=",
-    "version": "0.15.5"
+    "rev": "v0.16.0",
+    "sha256": "sha256-oGpIa+Up1bv6tf5ibna0DEwIxrZyAefqA8LSAy57QrE=",
+    "vendorSha256": "sha256-F0lMZVMNJ/1SHX8e5v4waQPqZjan/Ll+db+dseZ+dsc=",
+    "version": "0.16.0"
  },
  "vercel": {
    "owner": "ondrejsika",
@ -1261,10 +1261,10 @@
    "owner": "vmware",
    "provider-source-address": "registry.terraform.io/vmware/vra7",
    "repo": "terraform-provider-vra7",
-    "rev": "v3.0.4",
-    "sha256": "1w16cl27fqpzy1v6cdp61shgrmj787fdfjwhr719n57hqax4pck5",
+    "rev": "v3.0.5",
+    "sha256": "sha256-4YhaABbuG4GhWYEiGrUvf4H/8dd7wWHY08CkTWCqgr8=",
    "vendorSha256": null,
-    "version": "3.0.4"
+    "version": "3.0.5"
  },
  "vsphere": {
    "owner": "hashicorp",
@ -1279,10 +1279,10 @@
    "owner": "vultr",
    "provider-source-address": "registry.terraform.io/vultr/vultr",
    "repo": "terraform-provider-vultr",
-    "rev": "v2.11.0",
-    "sha256": "sha256-5TtrjWQ6AXYCjOi6Qe3oJVp011s87XyU2CYnXb7hFII=",
+    "rev": "v2.11.1",
+    "sha256": "sha256-EAkFlmQFPq9pSQ591GkX7um8tcBEGIJuiLuL5d9A8Ag=",
    "vendorSha256": null,
-    "version": "2.11.0"
+    "version": "2.11.1"
  },
  "wavefront": {
    "owner": "vmware",
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -5,14 +5,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.3.11";
+  version = "3.3.12";

  # Fetch from GitHub in order to use `requirements.in`
  src = fetchFromGitHub {
    owner = "flexget";
    repo = "flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nmGGGzqsce9agAPmE+xJ6/jv2avWlSDhaQr2PxptYcQ=";
+    hash = "sha256-DrM2925PcNuwJooq9qGHgIq64JWHb7byDeaeVsWgEjc=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@ -1,5 +1,5 @@
 { pname, version, src, meta, binaryName, desktopName, autoPatchelfHook
-, makeDesktopItem, lib, stdenv, wrapGAppsHook, makeWrapper, alsa-lib, at-spi2-atk
+, makeDesktopItem, lib, stdenv, wrapGAppsHook, makeShellWrapper, alsa-lib, at-spi2-atk
 , at-spi2-core, atk, cairo, cups, dbus, expat, fontconfig, freetype, gdk-pixbuf
 , glib, gtk3, libcxx, libdrm, libnotify, libpulseaudio, libuuid, libX11
 , libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext, libXfixes
@ -24,7 +24,8 @@ stdenv.mkDerivation rec {
    libxshmfence
    mesa
    nss
-    (wrapGAppsHook.override { makeBinaryWrapper = makeWrapper; })
+    wrapGAppsHook
+    makeShellWrapper
  ];

  dontWrapGApps = true;
@ -78,7 +79,7 @@ stdenv.mkDerivation rec {
    patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} \
        $out/opt/${binaryName}/${binaryName}

-    wrapProgram $out/opt/${binaryName}/${binaryName} \
+    wrapProgramShell $out/opt/${binaryName}/${binaryName} \
        "''${gappsWrapperArgs[@]}" \
        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}" \
        --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@ -15,7 +15,7 @@ rec {
    sha256 = "1zw9azwmxr4991nq5kl527lbwlj7psrissgvrkl1kxxbfbdncbhh";

    stripRoot = false;
-    extraPostFetch = ''
+    postFetch = ''
      cd $out
      mv ring-project/* ./
      rm -r ring-project.rst ring-project client-android client-ios client-macosx client-uwp
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -40,7 +40,7 @@ in stdenv.mkDerivation rec {
  nativeBuildInputs = [
    autoPatchelfHook
    dpkg
-    (wrapGAppsHook.override { makeBinaryWrapper = makeWrapper; })
+    (wrapGAppsHook.override { inherit makeWrapper; })
  ];

  buildInputs = [
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@ -1,5 +1,4 @@
-{ mkDerivation
-, lib
+{ lib
 , fetchFromGitHub
 , callPackage
 , pkg-config
@ -10,9 +9,10 @@
 , wrapQtAppsHook
 , extra-cmake-modules
 , qtbase
+, qtsvg
 , qtimageformats
+, qt5compat
 , gtk3
-, kwayland
 , libdbusmenu
 , lz4
 , xxHash
@ -70,7 +70,7 @@ let
 in
 env.mkDerivation rec {
  pname = "telegram-desktop";
-  version = "3.6.0";
+  version = "3.7.3";
  # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py

  # Telegram-Desktop with submodules
@ -79,17 +79,9 @@ env.mkDerivation rec {
    repo = "tdesktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "0zcjm08nfdlxrsv0fi6dqg3lk52bcvsxnsf6jm5fv6gf5v9ia3hq";
+    sha256 = "01b3nrhfbxhq4w63nsjnrhyfsdq3fm4l7sfkasbh8ib4qk3c9vwz";
  };

-  patches = [
-    # fix build with KWayland 5.94+
-    # cf. https://invent.kde.org/frameworks/kwayland/-/commit/de442e4a94e249a29cf2e005db8e0a5e4a6a13ed
-    # upstream bug: https://github.com/telegramdesktop/tdesktop/issues/24375
-    # FIXME remove when no longer necessary
-    ./kf594.diff
-  ];
-
  postPatch = ''
    substituteInPlace Telegram/CMakeLists.txt \
      --replace '"''${TDESKTOP_LAUNCHER_BASENAME}.appdata.xml"' '"''${TDESKTOP_LAUNCHER_BASENAME}.metainfo.xml"'
@ -120,9 +112,10 @@ env.mkDerivation rec {

  buildInputs = [
    qtbase
+    qtsvg
    qtimageformats
+    qt5compat
    gtk3
-    kwayland
    libdbusmenu
    lz4
    xxHash
@ -166,8 +159,6 @@ env.mkDerivation rec {
    "-DTDESKTOP_API_HASH=d524b414d21f4d37f08684c1df41ac9c"
    # See: https://github.com/NixOS/nixpkgs/pull/130827#issuecomment-885212649
    "-DDESKTOP_APP_USE_PACKAGED_FONTS=OFF"
-    # TODO: Remove once QT6 is available in nixpkgs
-    "-DDESKTOP_APP_QT6=OFF"
  ];

  postFixup = ''
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/kf594.diff
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/kf594.diff
@ -1,57 +0,0 @@
-diff --git a/Telegram/SourceFiles/platform/linux/linux_wayland_integration.cpp b/Telegram/SourceFiles/platform/linux/linux_wayland_integration.cpp
-index 7641579aa..3c195e397 100644
--- a/Telegram/SourceFiles/platform/linux/linux_wayland_integration.cpp
-+++ b/Telegram/SourceFiles/platform/linux/linux_wayland_integration.cpp
-@@ -9,10 +9,10 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
- 
- #include "base/platform/base_platform_info.h"
- 
-#include <connection_thread.h>
-#include <registry.h>
-#include <surface.h>
-#include <plasmashell.h>
-+#include <KWayland/Client/connection_thread.h>
-+#include <KWayland/Client/registry.h>
-+#include <KWayland/Client/surface.h>
-+#include <KWayland/Client/plasmashell.h>
- 
- using namespace KWayland::Client;
- 
-Submodule Telegram/lib_base contains modified content
-diff --git a/Telegram/lib_base/base/platform/linux/base_linux_wayland_integration.cpp b/Telegram/lib_base/base/platform/linux/base_linux_wayland_integration.cpp
-index 32f0de6..30a087f 100644
--- a/Telegram/lib_base/base/platform/linux/base_linux_wayland_integration.cpp
-+++ b/Telegram/lib_base/base/platform/linux/base_linux_wayland_integration.cpp
-@@ -13,11 +13,11 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
- #include <QtCore/QPointer>
- #include <QtGui/QWindow>
- 
-#include <connection_thread.h>
-#include <registry.h>
-#include <surface.h>
-#include <xdgforeign.h>
-#include <idleinhibit.h>
-+#include <KWayland/Client/connection_thread.h>
-+#include <KWayland/Client/registry.h>
-+#include <KWayland/Client/surface.h>
-+#include <KWayland/Client/xdgforeign.h>
-+#include <KWayland/Client/idleinhibit.h>
- 
- using namespace KWayland::Client;
- 
-Submodule Telegram/lib_ui contains modified content
-diff --git a/Telegram/lib_ui/ui/platform/linux/ui_linux_wayland_integration.cpp b/Telegram/lib_ui/ui/platform/linux/ui_linux_wayland_integration.cpp
-index 01f1e80..163cb6a 100644
--- a/Telegram/lib_ui/ui/platform/linux/ui_linux_wayland_integration.cpp
-+++ b/Telegram/lib_ui/ui/platform/linux/ui_linux_wayland_integration.cpp
-@@ -24,8 +24,8 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
- #include <private/qwaylandwindow_p.h>
- #include <private/qwaylandshellsurface_p.h>
- 
-#include <connection_thread.h>
-#include <registry.h>
-+#include <KWayland/Client/connection_thread.h>
-+#include <KWayland/Client/registry.h>
- 
- Q_DECLARE_METATYPE(QMargins);
- 
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation {
  pname = "tg_owt";
-  version = "unstable-2022-02-25";
+  version = "unstable-2022-04-14";

  src = fetchFromGitHub {
    owner = "desktop-app";
    repo = "tg_owt";
-    rev = "a264028ec71d9096e0aa629113c49c25db89d260";
-    sha256 = "10p3x8z3ps8s1ivi9y8px2gsg4pvsvz6g9wbgh5w8hilikxqq7r5";
+    rev = "63a934db1ed212ebf8aaaa20f0010dd7b0d7b396";
+    sha256 = "sha256-WddSsQ9KW1zYyYckzdUOvfFZArYAbyvXmABQNMtK6cM=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/science/logic/tlaplus/toolbox.nix
+++ b/pkgs/applications/science/logic/tlaplus/toolbox.nix
@ -1,6 +1,6 @@
 { lib
 , fetchzip
-, makeWrapper
+, makeShellWrapper
 , makeDesktopItem
 , stdenv
 , gtk3
@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
  buildInputs = [ gtk3 ];

  nativeBuildInputs = [
-    makeWrapper
-    (wrapGAppsHook.override { makeBinaryWrapper = makeWrapper; })
+    makeShellWrapper
+    wrapGAppsHook
  ];

  dontWrapGApps = true;
@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
      "$(find "$out/toolbox" -name jspawnhelper)"

-    makeWrapper $out/toolbox/toolbox $out/bin/tla-toolbox \
+    makeShellWrapper $out/toolbox/toolbox $out/bin/tla-toolbox \
      --chdir "$out/toolbox" \
      --add-flags "-data ~/.tla-toolbox" \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ gtk3 libXtst glib zlib ]}"  \
--- a/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
@ -6,7 +6,7 @@ let
    owner = "kogakure";
    repo = "gitweb-theme";
    rev = "049b88e664a359f8ec25dc6f531b7e2aa60dd1a2";
-    extraPostFetch = ''
+    postFetch = ''
      mkdir -p "$TMPDIR/gitwebTheme"
      mv "$out"/* "$TMPDIR/gitwebTheme/"
      mkdir "$out/static"
--- a/pkgs/applications/video/mpv/wrapper.nix
+++ b/pkgs/applications/video/mpv/wrapper.nix
@ -32,7 +32,7 @@ let
    # All arguments besides the input and output binaries (${mpv}/bin/mpv and
    # $out/bin/mpv). These are used by the darwin specific makeWrapper call
    # used to wrap $out/Applications/mpv.app/Contents/MacOS/mpv as well.
-    mostMakeWrapperArgs = lib.strings.escapeShellArgs ([ "--argv0" "'$0'"
+    mostMakeWrapperArgs = lib.strings.escapeShellArgs ([ "--inherit-argv0"
      # These are always needed (TODO: Explain why)
      "--prefix" "LUA_CPATH" ";" "${mpv.luaEnv}/lib/lua/${mpv.lua.luaversion}/?.so"
      "--prefix" "LUA_PATH" ";" "${mpv.luaEnv}/share/lua/${mpv.lua.luaversion}/?.lua"
@ -53,7 +53,7 @@ let
    )) ++ extraMakeWrapperArgs)
    ;
    umpvWrapperArgs = lib.strings.escapeShellArgs ([
-      "--argv0" "'$0'"
+      "--inherit-argv0"
      "--set" "MPV" "${placeholder "out"}/bin/mpv"
    ] ++ extraUmpvWrapperArgs)
    ;
--- a/pkgs/applications/virtualization/gvisor/default.nix
+++ b/pkgs/applications/virtualization/gvisor/default.nix
@ -43,7 +43,7 @@ let
    repo = "rules_proto";
    rev = "f7a30f6f80006b591fa7c437fe5a951eb10bcbcf";
    sha256 = "10bcw0ir0skk7h33lmqm38n9w4nfs24mwajnngkbs6jb5wsvkqv8";
-    extraPostFetch = ''
+    postFetch = ''
      sed -i 's|name = "protoc"|name = "_protoc_original"|' $out/proto/private/BUILD.release
      cat <<EOF >>$out/proto/private/BUILD.release
      alias(name = "protoc", actual = "@com_github_protocolbuffers_protobuf//:protoc", visibility = ["//visibility:public"])
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@ -184,39 +184,6 @@ stdenv.mkDerivation {
      done
    '';

-  emulation = let
-    fmt =
-      /**/ if targetPlatform.isDarwin  then "mach-o"
-      else if targetPlatform.isWindows then "pe"
-      else "elf" + toString targetPlatform.parsed.cpu.bits;
-    endianPrefix = if targetPlatform.isBigEndian then "big" else "little";
-    sep = optionalString (!targetPlatform.isMips && !targetPlatform.isPower && !targetPlatform.isRiscV) "-";
-    arch =
-      /**/ if targetPlatform.isAarch64 then endianPrefix + "aarch64"
-      else if targetPlatform.isAarch32     then endianPrefix + "arm"
-      else if targetPlatform.isx86_64  then "x86-64"
-      else if targetPlatform.isx86_32  then "i386"
-      else if targetPlatform.isMips    then {
-          mips     = "btsmipn32"; # n32 variant
-          mipsel   = "ltsmipn32"; # n32 variant
-          mips64   = "btsmip";
-          mips64el = "ltsmip";
-        }.${targetPlatform.parsed.cpu.name}
-      else if targetPlatform.isMmix then "mmix"
-      else if targetPlatform.isPower then if targetPlatform.isBigEndian then "ppc" else "lppc"
-      else if targetPlatform.isSparc then "sparc"
-      else if targetPlatform.isMsp430 then "msp430"
-      else if targetPlatform.isAvr then "avr"
-      else if targetPlatform.isAlpha then "alpha"
-      else if targetPlatform.isVc4 then "vc4"
-      else if targetPlatform.isOr1k then "or1k"
-      else if targetPlatform.isM68k then "m68k"
-      else if targetPlatform.isS390 then "s390"
-      else if targetPlatform.isRiscV then "lriscv"
-      else throw "unknown emulation for platform: ${targetPlatform.config}";
-    in if targetPlatform.useLLVM or false then ""
-       else targetPlatform.bfdEmulation or (fmt + sep + arch);
-
  strictDeps = true;
  depsTargetTargetPropagated = extraPackages;

--- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@ -93,11 +93,6 @@ if [ -e @out@/nix-support/add-local-ldflags-before.sh ]; then
 fi


-# Specify the target emulation if nothing is passed in ("-m" overrides this
-# environment variable). Ensures we never blindly fallback on targeting the host
-# platform.
-: ${LDEMULATION:=@emulation@}
-
 # Three tasks:
 #
 #   1. Find all -L... switches for rpath
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -14,6 +14,7 @@
 , nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
 , propagateDoc ? cc != null && cc ? man
 , extraTools ? [], extraPackages ? [], extraBuildCommands ? ""
+, nixSupport ? {}
 , isGNU ? false, isClang ? cc.isClang or false, gnugrep ? null
 , buildPackages ? {}
 , libcxx ? null
@ -155,6 +156,8 @@ stdenv.mkDerivation {
            (setenv "NIX_CFLAGS_COMPILE_${suffixSalt}" (concat (getenv "NIX_CFLAGS_COMPILE_${suffixSalt}") " -isystem " arg "/include"))))
        '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
    '';
+
+    inherit nixSupport;
  };

  dontBuild = true;
@ -521,7 +524,11 @@ stdenv.mkDerivation {
    ##
    ## Extra custom steps
    ##
-    + extraBuildCommands;
+    + extraBuildCommands
+    + lib.strings.concatStringsSep "; "
+      (lib.attrsets.mapAttrsToList
+        (name: value: "echo ${toString value} >> $out/nix-support/${name}")
+        nixSupport);

  inherit expand-response-params;

--- a/pkgs/build-support/fetchsourcehut/default.nix
+++ b/pkgs/build-support/fetchsourcehut/default.nix
@ -38,7 +38,7 @@ let
      fetch = fetchzip;
      arguments = baseArgs // {
        url = "${baseUrl}/archive/${rev}.tar.gz";
-        extraPostFetch = optionalString (vc == "hg") ''
+        postFetch = optionalString (vc == "hg") ''
          rm -f "$out/.hg_archival.txt"
        ''; # impure file; see #12002
      };
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@ -165,6 +165,11 @@
    "https://ftp.postgresql.org/pub/"
  ];

+  # Qt
+  qt = [
+    "https://download.qt.io/"
+  ];
+
  # Roy marples mirrors
  roy = [
    "https://roy.marples.name/downloads/"
--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@ -12,6 +12,7 @@
 , url ? ""
 , urls ? []
 , extraPostFetch ? ""
+, postFetch ? ""
 , name ? "source"
 , nativeBuildInputs ? [ ]
 , # Allows to set the extension for the intermediate downloaded
@ -20,6 +21,8 @@
  extension ? null
 , ... } @ args:

+
+lib.warnIf (extraPostFetch != "") "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub'."
 (fetchurl (let
  tmpFilename =
    if extension != null
@ -60,11 +63,14 @@ in {
      mv "$unpackDir" "$out"
    '')
    + ''
+      ${postFetch}
+    '' + ''
      ${extraPostFetch}
    ''
+
    # Remove non-owner write permissions
    # Fixes https://github.com/NixOS/nixpkgs/issues/38649
    + ''
      chmod 755 "$out"
    '';
-} // removeAttrs args [ "stripRoot" "extraPostFetch" "extension" "nativeBuildInputs" ]))
+} // removeAttrs args [ "stripRoot" "extraPostFetch" "postFetch" "extension" "nativeBuildInputs" ]))
--- a/pkgs/build-support/fetchzip/tests.nix
+++ b/pkgs/build-support/fetchzip/tests.nix
@ -0,0 +1,17 @@
+{ testers, fetchzip, ... }:
+
+let
+  url = "https://gist.github.com/glandium/01d54cefdb70561b5f6675e08f2990f2/archive/2f430f0c136a69b0886281d0c76708997d8878af.zip";
+in
+{
+  simple = testers.invalidateFetcherByDrvHash fetchzip {
+    inherit url;
+    sha256 = "sha256-0ecwgL8qUavSj1+WkaxpmRBmu7cvj53V5eXQV71fddU=";
+  };
+
+  postFetch = testers.invalidateFetcherByDrvHash fetchzip {
+    inherit url;
+    sha256 = "sha256-7sAOzKa+9vYx5XyndHxeY2ffWAjOsgCkXC9anK6cuV0=";
+    postFetch = ''touch $out/filee'';
+  };
+}
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@ -0,0 +1,26 @@
+{ stdenv
+, lib
+, makeSetupHook
+, dieHook
+, writeShellScript
+, tests
+, cc ? stdenv.cc
+, sanitizers ? []
+}:
+
+makeSetupHook {
+  deps = [ dieHook ]
+    # https://github.com/NixOS/nixpkgs/issues/148189
+    ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) cc;
+
+  substitutions = {
+    cc = "${cc}/bin/cc ${lib.escapeShellArgs (map (s: "-fsanitize=${s}") sanitizers)}";
+
+    # Extract the function call used to create a binary wrapper from its embedded docstring
+    passthru.extractCmd = writeShellScript "extract-binary-wrapper-cmd" ''
+      strings -dw "$1" | sed -n '/^makeCWrapper/,/^$/ p'
+    '';
+
+    passthru.tests = tests.makeBinaryWrapper;
+  };
+} ./make-binary-wrapper.sh
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh
@ -15,24 +15,25 @@ assertExecutable() {
 # makeWrapper EXECUTABLE OUT_PATH ARGS

 # ARGS:
-# --argv0       NAME    : set name of executed process to NAME
-#                         (otherwise it’s called …-wrapped)
+# --argv0       NAME    : set the name of the executed process to NAME
+#                         (if unset or empty, defaults to EXECUTABLE)
 # --inherit-argv0       : the executable inherits argv0 from the wrapper.
 #                         (use instead of --argv0 '$0')
-# --set         VAR VAL : add VAR with value VAL to the executable’s
-#                         environment
+# --set         VAR VAL : add VAR with value VAL to the executable's environment
 # --set-default VAR VAL : like --set, but only adds VAR if not already set in
 #                         the environment
 # --unset       VAR     : remove VAR from the environment
 # --chdir       DIR     : change working directory (use instead of --run "cd DIR")
 # --add-flags   FLAGS   : add FLAGS to invocation of executable
+# TODO(@ncfavier): --append-flags

 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix

 # To troubleshoot a binary wrapper after you compiled it,
 # use the `strings` command or open the binary file in a text editor.
-makeWrapper() {
+makeWrapper() { makeBinaryWrapper "$@"; }
+makeBinaryWrapper() {
    local NIX_CFLAGS_COMPILE= NIX_CFLAGS_LINK=
    local original="$1"
    local wrapper="$2"
@ -43,7 +44,7 @@ makeWrapper() {
    mkdir -p "$(dirname "$wrapper")"

    makeDocumentedCWrapper "$original" "$@" | \
-      @CC@ \
+      @cc@ \
        -Wall -Werror -Wpedantic \
        -Wno-overlength-strings \
        -Os \
@ -52,7 +53,8 @@ makeWrapper() {
 }

 # Syntax: wrapProgram <PROGRAM> <MAKE-WRAPPER FLAGS...>
-wrapProgram() {
+wrapProgram() { wrapProgramBinary "$@"; }
+wrapProgramBinary() {
    local prog="$1"
    local hidden

@ -63,8 +65,6 @@ wrapProgram() {
      hidden="${hidden}_"
    done
    mv "$prog" "$hidden"
-    # Silence warning about unexpanded $0:
-    # shellcheck disable=SC2016
    makeWrapper "$hidden" "$prog" --inherit-argv0 "${@:2}"
 }

@ -311,8 +311,9 @@ void set_env_suffix(char *env, char *sep, char *suffix) {
 "
 }

-# Embed a C string which shows up as readable text in the compiled binary wrapper
-# documentationString ARGS
+# Embed a C string which shows up as readable text in the compiled binary wrapper,
+# giving instructions for recreating the wrapper.
+# Keep in sync with makeBinaryWrapper.extractCmd
 docstring() {
    printf '%s' "const char * DOCSTRING = \"$(escapeStringLiteral "

@ -333,7 +334,7 @@ makeCWrapper $(formatArgs "$@")

 # formatArgs EXECUTABLE ARGS
 formatArgs() {
-    printf '%s' "$1"
+    printf '%s' "${1@Q}"
    shift
    while [ $# -gt 0 ]; do
        case "$1" in
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@ -11,16 +11,18 @@ assertExecutable() {
 # makeWrapper EXECUTABLE OUT_PATH ARGS

 # ARGS:
-# --argv0       NAME    : set name of executed process to NAME
-#                         (otherwise it’s called …-wrapped)
-# --set         VAR VAL : add VAR with value VAL to the executable’s
-#                         environment
+# --argv0       NAME    : set the name of the executed process to NAME
+#                         (if unset or empty, defaults to EXECUTABLE)
+# --inherit-argv0       : the executable inherits argv0 from the wrapper.
+#                         (use instead of --argv0 '$0')
+# --set         VAR VAL : add VAR with value VAL to the executable's environment
 # --set-default VAR VAL : like --set, but only adds VAR if not already set in
 #                         the environment
 # --unset       VAR     : remove VAR from the environment
 # --chdir       DIR     : change working directory (use instead of --run "cd DIR")
 # --run         COMMAND : run command before the executable
 # --add-flags   FLAGS   : add FLAGS to invocation of executable
+# TODO(@ncfavier): --append-flags

 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix
@ -29,7 +31,8 @@ assertExecutable() {
 # --prefix-contents ENV SEP FILES : like --suffix-each, but contents of FILES
 #                                   are read first and used as VALS
 # --suffix-contents
-makeWrapper() {
+makeWrapper() { makeShellWrapper "$@"; }
+makeShellWrapper() {
    local original="$1"
    local wrapper="$2"
    local params varName value command separator n fileNames
@ -165,6 +168,9 @@ makeWrapper() {
        elif [[ "$p" == "--argv0" ]]; then
            argv0="${params[$((n + 1))]}"
            n=$((n + 1))
+        elif [[ "$p" == "--inherit-argv0" ]]; then
+            # Whichever comes last of --argv0 and --inherit-argv0 wins
+            argv0='$0'
        else
            die "makeWrapper doesn't understand the arg $p"
        fi
@ -193,7 +199,8 @@ filterExisting() {
 }

 # Syntax: wrapProgram <PROGRAM> <MAKE-WRAPPER FLAGS...>
-wrapProgram() {
+wrapProgram() { wrapProgramShell "$@"; }
+wrapProgramShell() {
    local prog="$1"
    local hidden

@ -204,7 +211,5 @@ wrapProgram() {
      hidden="${hidden}_"
    done
    mv "$prog" "$hidden"
-    # Silence warning about unexpanded $0:
-    # shellcheck disable=SC2016
-    makeWrapper "$hidden" "$prog" --argv0 '$0' "${@:2}"
+    makeWrapper "$hidden" "$prog" --inherit-argv0 "${@:2}"
 }
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@ -1,7 +1,7 @@
 { stdenv
 , lib
 , makeSetupHook
-, makeBinaryWrapper
+, makeWrapper
 , gobject-introspection
 , isGraphical ? true
 , gtk3
@ -34,7 +34,7 @@ makeSetupHook {
  ] ++ [

    # We use the wrapProgram function.
-    makeBinaryWrapper
+    makeWrapper
  ];
  substitutions = {
    passthru.tests = let
--- a/pkgs/data/fonts/input-fonts/default.nix
+++ b/pkgs/data/fonts/input-fonts/default.nix
@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
      sha256 = "BESZ4Bjgm2hvQ7oPpMvYSlE8EqvQjqHZtXWIovqyIzA=";
      stripRoot = false;

-      extraPostFetch = ''
+      postFetch = ''
        # Reset the timestamp to release date for determinism.
        PATH=${lib.makeBinPath [ python3.pkgs.fonttools ]}:$PATH
        for ttf_file in $out/Input_Fonts/*/*/*.ttf; do
--- a/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
+++ b/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
@ -32,7 +32,7 @@ let
      # without making a new release. We simply substitute the possibly changed fields
      # with their content from when we last updated, and thus get a deterministic output
      # hash.
-      extraPostFetch = ''
+      postFetch = ''
        echo "${metadata}" | base64 --decode > $out/metadata.json
      '';
    };
--- a/pkgs/development/compilers/dmd/default.nix
+++ b/pkgs/development/compilers/dmd/default.nix
@ -60,24 +60,46 @@ stdenv.mkDerivation rec {
  # Not using patches option to make it easy to patch, for example, dmd and
  # Phobos at same time if that's required
  patchPhase =
-  lib.optionalString (builtins.compareVersions version "2.092.1" <= 0) ''
+
+  # Migrates D1-style operator overloads in DMD source, to allow building with
+  # a newer DMD
+  lib.optionalString (lib.versionOlder version "2.088.0") ''
+    patch -p1 -F3 --directory=dmd -i ${(fetchpatch {
+      url = "https://github.com/dlang/dmd/commit/c4d33e5eb46c123761ac501e8c52f33850483a8a.patch";
+      sha256 = "0rhl9h3hsi6d0qrz24f4zx960cirad1h8mm383q6n21jzcw71cp5";
+    })}
+  ''
+
+  # Fixes C++ tests that compiled on older C++ but not on the current one
+  + lib.optionalString (lib.versionOlder version "2.092.2") ''
    patch -p1 -F3 --directory=druntime -i ${(fetchpatch {
      url = "https://github.com/dlang/druntime/commit/438990def7e377ca1f87b6d28246673bb38022ab.patch";
      sha256 = "0nxzkrd1rzj44l83j7jj90yz2cv01na8vn9d116ijnm85jl007b4";
    })}
+  ''
+
+  + postPatch;

-  '' + postPatch;

  postPatch =
  ''
    patchShebangs .
+  ''

-  '' + lib.optionalString (version == "2.092.1") ''
+  # This one has tested against a hardcoded year, then against a current year on
+  # and off again. It just isn't worth it to patch all the historical versions
+  # of it, so just remove it until the most recent change.
+  + lib.optionalString (lib.versionOlder version "2.091.0") ''
+    rm dmd/test/compilable/ddocYear.d
+  ''
+
+  + lib.optionalString (version == "2.092.1") ''
    rm dmd/test/dshell/test6952.d
-  '' + lib.optionalString (builtins.compareVersions "2.092.1" version < 0) ''
+  '' + lib.optionalString (lib.versionAtLeast version "2.092.2") ''
    substituteInPlace dmd/test/dshell/test6952.d --replace "/usr/bin/env bash" "${bash}/bin/bash"
+  ''

-  '' + ''
+  + ''
    rm dmd/test/runnable/gdb1.d
    rm dmd/test/runnable/gdb10311.d
    rm dmd/test/runnable/gdb14225.d
@ -87,8 +109,9 @@ stdenv.mkDerivation rec {
    rm dmd/test/runnable/gdb15729.sh
    rm dmd/test/runnable/gdb4149.d
    rm dmd/test/runnable/gdb4181.d
+  ''

-  '' + lib.optionalString stdenv.isLinux ''
+  + lib.optionalString stdenv.isLinux ''
    substituteInPlace phobos/std/socket.d --replace "assert(ih.addrList[0] == 0x7F_00_00_01);" ""
  '' + lib.optionalString stdenv.isDarwin ''
    substituteInPlace phobos/std/socket.d --replace "foreach (name; names)" "names = []; foreach (name; names)"
@ -178,7 +201,7 @@ stdenv.mkDerivation rec {
    # Everything is now Boost licensed, even the backend.
    # https://github.com/dlang/dmd/pull/6680
    license = licenses.boost;
-    maintainers = with maintainers; [ ThomasMader lionello ];
+    maintainers = with maintainers; [ ThomasMader lionello dukc ];
    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
  };
 }
--- a/pkgs/development/compilers/dotnet/build-dotnet.nix
+++ b/pkgs/development/compilers/dotnet/build-dotnet.nix
@ -89,7 +89,7 @@ in stdenv.mkDerivation rec {
    description = builtins.getAttr type descriptions;
    homepage = "https://dotnet.github.io/";
    license = licenses.mit;
-    maintainers = with maintainers; [ kuznero ];
+    maintainers = with maintainers; [ kuznero mdarocha ];
    mainProgram = "dotnet";
    platforms = builtins.attrNames srcs;
  };
--- a/pkgs/development/compilers/dotnet/default.nix
+++ b/pkgs/development/compilers/dotnet/default.nix
@ -141,69 +141,69 @@ rec {
  # v6.0 (lts)
  aspnetcore_6_0 = buildAspNetCore {
    inherit icu;
-    version = "6.0.4";
+    version = "6.0.5";
    srcs = {
      x86_64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/de3f6658-5d5b-4986-aeb1-7efdf5818437/7df572051df15117a0f52be1b79e1823/aspnetcore-runtime-6.0.4-linux-x64.tar.gz";
-        sha512  = "eaff93db0a4cc0adc2fc54de5e9a6e4b0844398451c06bcf6b2867471b8ed4fd0528ad04fe7150aa5ed306d5e08a5e4219c6029b96da03ad2d1c58e7a0ddacaf";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/a0e9ceb8-04eb-4510-876c-795a6a123dda/6141e57558eddc2d4629c7c14c2c6fa1/aspnetcore-runtime-6.0.5-linux-x64.tar.gz";
+        sha512  = "3a2169051da22f3faebba319101c3fb86b1cf8575e3715ebfb82b673e14417370d00b958a252c740a6b0e11a8624e4d4ee41fbfd29a4e73af79752dbbeb1477b";
      };
      aarch64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/ba1662bf-50e6-451a-957f-0d55bc6e5713/921fe0e68428ac47c098e97418d3126a/aspnetcore-runtime-6.0.4-linux-arm64.tar.gz";
-        sha512  = "18ffa72b38dcd01bbfd9f656996e994dbcdb7b6b196771fc498bbaea774ad844f7fd5418487d0a5a7f83a76b3683f8913e22275bc25d66ee0c0d84ea4e279971";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/8ba7087e-4513-41e5-8359-a4bcd2a3661f/e6828f0d8cf1ecc63074c9ff57685e27/aspnetcore-runtime-6.0.5-linux-arm64.tar.gz";
+        sha512  = "fecc864acff305550944fc20c18570d8323b56eefafd07cacf7f03169700265af7c3b5024fffb5a1742b8a7e792a849319e9180a92e04b79644d674f883e7578";
      };
      x86_64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/b39aa0b4-27e2-4fce-bf36-fb6d46f89e5e/6b8ca3b4c7026db460df1d49f5366f1b/aspnetcore-runtime-6.0.4-osx-x64.tar.gz";
-        sha512  = "33b1b24496296242dd78714564e52e6be575f46d681a5093a0aca842aff5e29778cbf31259f11ce395fc9a2368fa6bfde2e12a074ccf310f9b661c0bdaf39d2d";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/ec3ae29d-ea2a-44ec-8ef4-a114a0efc818/401eca540c50187f8da95c430099ea2e/aspnetcore-runtime-6.0.5-osx-x64.tar.gz";
+        sha512  = "44985a9c47d63d2b9cadae66bd81f73775301a7d1708786cc3b7ac31b7ad2164dc5cb40682836c2e5e7d1a28bbf199c9418d0024b576962dd4f220db238e82e9";
      };
      aarch64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/d7b60e75-6901-4f68-8943-ce32cadeaf29/f14e40b3e9a69cbd79d47375b16a76e7/aspnetcore-runtime-6.0.4-osx-arm64.tar.gz";
-        sha512  = "9ff8ecc60f70d8cfa53396761610282358aa7bcbd3f013aedc639be7b8f502a8cb121777c7e8a0a7d64d74b99211751ea8a8c1819861b72ad11d80590ba9ed2b";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/dc366dc7-c30a-4c75-868d-9d7dad64f7db/05ee16d359acd131b4c8ef41bb62ebaf/aspnetcore-runtime-6.0.5-osx-arm64.tar.gz";
+        sha512  = "862afb12e3755adf7db3c774ac5fbc6b5fe0c005c8b46378c12120a0604492fa17a226e21fe1b542601c15543644442438b9a0a7b1a756e495bff823e45dde6d";
      };
    };
  };

  runtime_6_0 = buildNetRuntime {
    inherit icu;
-    version = "6.0.4";
+    version = "6.0.5";
    srcs = {
      x86_64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/5b08d331-15ac-4a53-82a5-522fa45b1b99/65ae300dd160ae0b88b91dd78834ce3e/dotnet-runtime-6.0.4-linux-x64.tar.gz";
-        sha512  = "001487bfb337d0f737c4e3dedc4bc41b3185922c07c07e8f1d47e4578914fdeeed7421d7af2c4bb5e17ebddd05fde4cb9aea1e8145018dcffeaca70c1fa49bbb";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/56d9250f-97df-4786-b33e-a8e34b349e86/dcf054ca00899a70a80aa1a7d3072b52/dotnet-runtime-6.0.5-linux-x64.tar.gz";
+        sha512  = "c228f0ba0ecc4ccda708e97529b248dd6d70f7f747ead6453623be77e8e1529b54db52f5df1b5e00b5b7f92b73389560832f80607fc07e50879d55ce905afcf7";
      };
      aarch64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/3641affa-8bb0-486f-93d9-68adff4f4af7/1e3df9fb86cba7299b9e575233975734/dotnet-runtime-6.0.4-linux-arm64.tar.gz";
-        sha512  = "acbb50f2a1cde2bb8f59ec2059cd90f669748ce0da519ddbb831d8f279c4b896cc7a8f4275fb2c4726c5caf3d6430ee6d9823baa6f65238c7017ecbc2b8a6444";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/b7bfeef6-3df9-46a1-8cc9-5b2a3121a1d7/44287ecada25d3f0bd8610550e08246d/dotnet-runtime-6.0.5-linux-arm64.tar.gz";
+        sha512  = "bed49b74ad60d2701ddd638c61c215ad48f5c6eb88df140545d29901df60c6667474ca9d3bed6583dba605282ec64989ff2b431f098f0afc6ed155af59f7126d";
      };
      x86_64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/c0bc0428-852d-4884-b536-3d0969a400ba/fe0a9a221c3e665e88b7020633f2cf8e/dotnet-runtime-6.0.4-osx-x64.tar.gz";
-        sha512  = "7a798ce54880533151cc9290129e1a6224e81e657026e5be580ee24742d54e8e8e5f8f3bdee2cb94d5129082e3a2ffd1460f490abb848aaf3558e584e2e2df43";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/8796f054-9724-4783-838d-90fec5a178d5/9ee66f0b62f19d765a1332c03823c490/dotnet-runtime-6.0.5-osx-x64.tar.gz";
+        sha512  = "fc26668071b989739fc139a06db9895602c179779f5051a01dc3543285239b0c50da0003f0daac2215b502c8a91170f55b748440fe711817ef3cad08266af9d1";
      };
      aarch64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/dd2f6b72-bf47-4ae5-8a3d-4d394569cc34/87d408439ac5feffe2abf622dbfa5084/dotnet-runtime-6.0.4-osx-arm64.tar.gz";
-        sha512  = "3070af5d9dc44820dc93ca89489f1dfa8024958f64a9d62fafddb49fa16325f0845cc53027703495dc524515e613f3e7701ef148da06653070cb2e3928fb0aca";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/2f9e7817-fe7f-4f68-ada2-171d4907190b/a579270395021e1d42c79761000c64d1/dotnet-runtime-6.0.5-osx-arm64.tar.gz";
+        sha512  = "3222c366e7da30e39f00eb27c7ac75094b7f294daf105a5ba85cc7f046eb35bdda1c561f3234da3ea2aefbbd1701940557d4e3b31a1e03eda890c9b0b49effde";
      };
    };
  };

  sdk_6_0 = buildNetSdk {
    inherit icu;
-    version = "6.0.202";
+    version = "6.0.300";
    srcs = {
      x86_64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/9d8c7137-2091-4fc6-a419-60ba59c8b9de/db0c5cda94f31d2260d369123de32d59/dotnet-sdk-6.0.202-linux-x64.tar.gz";
-        sha512  = "81e9c368d445d9e92e3af471d52dc2aa05e3ecb75ce95c13a2ed1d117852dae43d23d913bbe92eab730aef7f38a14488a1ac65c3b79444026a629647322c5798";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/dc930bff-ef3d-4f6f-8799-6eb60390f5b4/1efee2a8ea0180c94aff8f15eb3af981/dotnet-sdk-6.0.300-linux-x64.tar.gz";
+        sha512  = "52d720e90cfb889a92d605d64e6d0e90b96209e1bd7eab00dab1d567017d7a5a4ff4adbc55aff4cffcea4b1bf92bb8d351859d00d8eb65059eec5e449886c938";
      };
      aarch64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/952f5525-7227-496f-85e5-09cadfb44629/eefd0f6eb8f809bfaf4f0661809ed826/dotnet-sdk-6.0.202-linux-arm64.tar.gz";
-        sha512  = "2d0021bb4cd221ffba6888dbd6300e459f45f4f9d3cf7323f3b97ee0f093ef678f5a36d1c982296f4e15bbcbd7275ced72c3e9b2fc754039ba663d0612ffd866";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/7c62b503-4ede-4ff2-bc38-50f250a86d89/3b5e9db04cbe0169e852cb050a0dffce/dotnet-sdk-6.0.300-linux-arm64.tar.gz";
+        sha512  = "67eb088ccad197a39f104af60f3e6d12ea9b17560e059c0f7c8e956005d919d00bf0f3e487b06280be63ad57aa8895f16ebc8c92107c5019c9cf47bd620ea925";
      };
      x86_64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/1a014dee-ff5f-48e3-a817-82b9bd536b56/fed3a710f5e0add13844a6ce400775a1/dotnet-sdk-6.0.202-osx-x64.tar.gz";
-        sha512  = "ff7df20ce9054ed50d521eba88e063422efa4d48cb3117cf733cc6ecea24012c2ac34f6df10d88f64fe7a952bb96455a3c2eb877f1d50c0b7bcaedf11f98ce82";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/5c55a0f8-8f53-4b62-8fc5-9f428b8679a5/af7a2e2804c6cad414e6a686866baad7/dotnet-sdk-6.0.300-osx-x64.tar.gz";
+        sha512  = "36118673ce1a49cf31658444f29b67dfc338b78eb46847a43f38de0ae68cf2e4d72039b1813a8972de31cd8cfea13a9861d075384e67b86f98ff6abb90f4bd2e";
      };
      aarch64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/032fc69b-f437-4d17-9e6c-c204ce18a0b0/76386390762a9ba205666a6e45a2ac47/dotnet-sdk-6.0.202-osx-arm64.tar.gz";
-        sha512  = "8bf9ff3f89ac0f2d04b09d3f5df72efeac8007b9e33980c9c80eb735d050275a5594b11d902d0304ac9967111971bcd690be3adf34d4acbef6d247e8f2071f60";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/da2f2a2c-df3a-4866-a248-a8ff14d1c515/5136a4e95ecbbe2c8a44c07a7043edaa/dotnet-sdk-6.0.300-osx-arm64.tar.gz";
+        sha512  = "174cecbfdfcd1187ca71e5b741eadacc0e103cea75262f7dd15fdab6845226cec8def75cf4cbec3dc07bd085d003ac456670115b2f2a4a88f902be8a5c3bb3ae";
      };
    };
  };
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@ -3,6 +3,7 @@
 , langAda ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
+, langD ? false
 , langGo ? false
 , reproducibleBuild ? true
 , profiledCompiler ? false
@ -65,6 +66,7 @@ let majorVersion = "10";
        sha256 = ""; # TODO: uncomment and check hash when available.
      }) */
      ++ optional langAda ../gnat-cflags.patch
+      ++ optional langD ../libphobos.patch
      ++ optional langFortran ../gfortran-driving.patch
      ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch

@ -214,6 +216,7 @@ stdenv.mkDerivation ({
      enableShared

      langC
+      langD
      langCC
      langFortran
      langAda
@ -254,14 +257,14 @@ stdenv.mkDerivation ({

  inherit
    (import ../common/extra-target-flags.nix {
-      inherit lib stdenv crossStageStatic libcCross threadsCross;
+      inherit lib stdenv crossStageStatic langD libcCross threadsCross;
    })
    EXTRA_FLAGS_FOR_TARGET
    EXTRA_LDFLAGS_FOR_TARGET
    ;

  passthru = {
-    inherit langC langCC langObjC langObjCpp langAda langFortran langGo version;
+    inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD version;
    isGNU = true;
  };

--- a/pkgs/development/compilers/inklecate/deps-darwin.nix
+++ b/pkgs/development/compilers/inklecate/deps-darwin.nix
@ -1,6 +1,6 @@
 { fetchNuGet }: [
  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "3.1.10"; sha256 = "0xn4zh7shvijqlr03fqsmps6gz856isd9bg9rk4z2c4599ggal77"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "3.1.24"; sha256 = "0a4ra58nhh8q8r9lmzihjabx3dwyzh0wpdjlz4qxvjjbr6cqnhy9"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "3.1.25"; sha256 = "1b4wphq3ipah78a4ifrkslqsb76d34xnq6z3zcr41py0y76synyi"; })
  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "3.1.0"; sha256 = "08svsiilx9spvjamcnjswv0dlpdrgryhr3asdz7cvnl914gjzq4y"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
--- a/pkgs/development/compilers/inklecate/deps-linux.nix
+++ b/pkgs/development/compilers/inklecate/deps-linux.nix
@ -1,6 +1,6 @@
 { fetchNuGet }: [
  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "3.1.10"; sha256 = "0xn4zh7shvijqlr03fqsmps6gz856isd9bg9rk4z2c4599ggal77"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "3.1.24"; sha256 = "16wn8f3aswbbp1ivh0rdmhq99924ba8jmgaw964h23ncy6xyh2ip"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "3.1.25"; sha256 = "1dxk7v29wr736hlz8nfm2xv8dxmdl59w8w56kqjrvdw1lvgm411v"; })
  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "3.1.0"; sha256 = "08svsiilx9spvjamcnjswv0dlpdrgryhr3asdz7cvnl914gjzq4y"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
--- a/pkgs/development/compilers/lingua-franca/default.nix
+++ b/pkgs/development/compilers/lingua-franca/default.nix
@ -1,24 +1,22 @@
-{ lib, pkgs, stdenv, fetchFromGitHub, jdk11_headless }:
+{ lib, pkgs, stdenv, fetchzip, jdk17_headless }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "lfc";
-  version = "0.1.0";
+  version = "0.2.0";

-  src = fetchFromGitHub {
-    owner = "revol-xut";
-    repo = "lingua-franca-nix-releases";
-    rev = "d37bbfa530f0189c3e86ce0191134cdf42c6aec7";
-    sha256 = "/qMBOjffvShCPcbh9rJ7aVgdgZQ1hilHakjLyEhSmgs=";
+  src = fetchzip {
+    url = "https://github.com/lf-lang/lingua-franca/releases/download/v${version}/lfc_${version}.zip";
+    sha256 = "rBx7UnPLufZBO7lG0In5upHqYCyRtI4kQv0V83CZHew=";
  };

-  buildInputs = [ jdk11_headless ];
+  buildInputs = [ jdk17_headless ];

-  _JAVA_HOME = "${jdk11_headless}/";
+  _JAVA_HOME = "${jdk17_headless}/";

  postPatch = ''
    substituteInPlace bin/lfc \
      --replace 'base=`dirname $(dirname ''${abs_path})`' "base='$out'" \
-      --replace "run_lfc_with_args" "${jdk11_headless}/bin/java -jar $out/lib/jars/org.lflang.lfc-0.1.0-SNAPSHOT-all.jar"
+      --replace "run_lfc_with_args" "${jdk17_headless}/bin/java -jar $out/lib/jars/org.lflang.lfc-${version}-SNAPSHOT-all.jar"
  '';

  installPhase = ''
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@ -158,16 +158,17 @@ let
      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
        targetLlvmLibraries.libunwind
      ];
-      extraBuildCommands = ''
-        echo "-rtlib=compiler-rt -Wno-unused-command-line-argument" >> $out/nix-support/cc-cflags
-        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
-        echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
-        echo "-lunwind" >> $out/nix-support/cc-ldflags
-      '' + lib.optionalString stdenv.targetPlatform.isWasm ''
-        echo "-fno-exceptions" >> $out/nix-support/cc-cflags
-      '' + mkExtraBuildCommands cc;
+      extraBuildCommands = mkExtraBuildCommands cc;
+      nixSupport.cc-cflags =
+        [ "-rtlib=compiler-rt"
+          "-Wno-unused-command-line-argument"
+          "-B${targetLlvmLibraries.compiler-rt}/lib"
+        ]
+        ++ lib.optional (!stdenv.targetPlatform.isWasm) "--unwindlib=libunwind"
+        ++ lib.optional
+          (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
+          "-lunwind"
+        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
    };

    clangNoLibcxx = wrapCCWith rec {
@ -177,11 +178,12 @@ let
      extraPackages = [
        targetLlvmLibraries.compiler-rt
      ];
-      extraBuildCommands = ''
-        echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
-        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
-        echo "-nostdlib++" >> $out/nix-support/cc-cflags
-      '' + mkExtraBuildCommands cc;
+      extraBuildCommands = mkExtraBuildCommands cc;
+      nixSupport.cc-cflags = [
+        "-rtlib=compiler-rt"
+        "-B${targetLlvmLibraries.compiler-rt}/lib"
+        "-nostdlib++"
+      ];
    };

    clangNoLibc = wrapCCWith rec {
@ -191,10 +193,11 @@ let
      extraPackages = [
        targetLlvmLibraries.compiler-rt
      ];
-      extraBuildCommands = ''
-        echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
-        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
-      '' + mkExtraBuildCommands cc;
+      extraBuildCommands = mkExtraBuildCommands cc;
+      nixSupport.cc-cflags = [
+        "-rtlib=compiler-rt"
+        "-B${targetLlvmLibraries.compiler-rt}/lib"
+      ];
    };

    clangNoCompilerRt = wrapCCWith rec {
@ -202,9 +205,8 @@ let
      libcxx = null;
      bintools = bintoolsNoLibc';
      extraPackages = [ ];
-      extraBuildCommands = ''
-        echo "-nostartfiles" >> $out/nix-support/cc-cflags
-      '' + mkExtraBuildCommands0 cc;
+      extraBuildCommands = mkExtraBuildCommands0 cc;
+      nixSupport.cc-cflags = [ "-nostartfiles" ];
    };

    clangNoCompilerRtWithLibc = wrapCCWith rec {
--- a/pkgs/development/compilers/nextpnr/default.nix
+++ b/pkgs/development/compilers/nextpnr/default.nix
@ -14,21 +14,21 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "nextpnr";
-  version = "2022.01.03";
+  version = "0.3";

  srcs = [
    (fetchFromGitHub {
      owner = "YosysHQ";
      repo  = "nextpnr";
-      rev   = "089ca8258e6f4dc93f8d39594c1109a8578cdc98";
-      hash  = "sha256-N8kX/+fN8Qe+qme8RFlZyYQ/3p1WBkt0ztUwjJIQCIw=";
+      rev   = "${pname}-${version}";
+      hash  = "sha256-q4h1TNAn66fJou8abNFowRbGXZTBfz5x+H5Q/psMvIw=";
      name  = "nextpnr";
    })
    (fetchFromGitHub {
      owner  = "YosysHQ";
      repo   = "nextpnr-tests";
-      rev    = "ccc61e5ec7cc04410462ec3196ad467354787afb";
-      sha256 = "sha256-VT0JfpRLgfo2WG+eoMdE0scPM5nKZZ/v1XlkeDNcQCU=";
+      rev    = "00c55a9eb9ea2e062b51fe0d64741412b185d95d";
+      sha256 = "sha256-83suMftMtnaRFq3T2/I7Uahb11WZlXhwYt6Q/rqi2Yo=";
      name   = "nextpnr-tests";
    })
  ];
--- a/pkgs/development/compilers/rust/1_60.nix
+++ b/pkgs/development/compilers/rust/1_60.nix
@ -33,7 +33,7 @@ import ./default.nix {
  llvmShared = llvm_14.override { enableSharedLibraries = true; };

  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackagesForBuild = pkgsBuildBuild.llvmPackages_14;
+  llvmPackages = llvmPackages_14;

  # Note: the version MUST be one version prior to the version we're
  # building
--- a/pkgs/development/compilers/rust/default.nix
+++ b/pkgs/development/compilers/rust/default.nix
@ -10,7 +10,7 @@
 , llvmSharedForBuild
 , llvmSharedForHost
 , llvmSharedForTarget
-, llvmPackagesForBuild # Exposed through rustc for LTO in Firefox
+, llvmPackages # Exposed through rustc for LTO in Firefox
 }:
 { stdenv, lib
 , buildPackages
@ -64,7 +64,7 @@ in
        version = rustcVersion;
        sha256 = rustcSha256;
        inherit enableRustcDev;
-        inherit llvmShared llvmSharedForBuild llvmSharedForHost llvmSharedForTarget llvmPackagesForBuild;
+        inherit llvmShared llvmSharedForBuild llvmSharedForHost llvmSharedForTarget llvmPackages;

        patches = rustcPatches;

--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@ -1,5 +1,5 @@
 { lib, stdenv, removeReferencesTo, pkgsBuildBuild, pkgsBuildHost, pkgsBuildTarget
-, llvmShared, llvmSharedForBuild, llvmSharedForHost, llvmSharedForTarget, llvmPackagesForBuild
+, llvmShared, llvmSharedForBuild, llvmSharedForHost, llvmSharedForTarget, llvmPackages
 , fetchurl, file, python3
 , darwin, cmake, rust, rustPlatform
 , pkg-config, openssl
@ -179,7 +179,7 @@ in stdenv.mkDerivation rec {

  passthru = {
    llvm = llvmShared;
-    llvmPackages = llvmPackagesForBuild;
+    inherit llvmPackages;
  };

  meta = with lib; {
--- a/pkgs/development/compilers/zasm/default.nix
+++ b/pkgs/development/compilers/zasm/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    repo = "zasm";
    rev = version;
    sha256 = "sha256-Zbno8kmzss1H2FjwzHB4U7UXxa6oDfsPV80MVVFfM68=";
-    extraPostFetch = ''
+    postFetch = ''
      # remove folder containing files with weird names (causes the hash to turn out differently under macOS vs. Linux)
      rm -rv $out/Test
    '';
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@ -1,10 +1,11 @@
 # similar to interpreters/python/default.nix
-{ stdenv, lib, callPackage, fetchurl, fetchpatch }:
+{ stdenv, lib, callPackage, fetchurl, fetchpatch, makeBinaryWrapper }:

 rec {
  lua5_4 = callPackage ./interpreter.nix {
    sourceVersion = { major = "5"; minor = "4"; patch = "3"; };
    hash = "1yxvjvnbg4nyrdv10bq42gz6dr66pyan28lgzfygqfwy2rv24qgq";
+    makeWrapper = makeBinaryWrapper;

    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch;
  };
@ -16,6 +17,7 @@ rec {
  lua5_3 = callPackage ./interpreter.nix {
    sourceVersion = { major = "5"; minor = "3"; patch = "6"; };
    hash = "0q3d8qhd7p0b7a4mh9g7fxqksqfs6mr1nav74vq26qvkp2dxcpzw";
+    makeWrapper = makeBinaryWrapper;

    patches =
      lib.optionals stdenv.isDarwin [ ./5.2.darwin.patch ];
@ -29,6 +31,7 @@ rec {
  lua5_2 = callPackage ./interpreter.nix {
    sourceVersion = { major = "5"; minor = "2"; patch = "4"; };
    hash = "0jwznq0l8qg9wh5grwg07b5cy3lzngvl5m2nl1ikp6vqssmf9qmr";
+    makeWrapper = makeBinaryWrapper;
    patches = lib.optional stdenv.isDarwin ./5.2.darwin.patch;
  };

@ -40,6 +43,7 @@ rec {
  lua5_1 = callPackage ./interpreter.nix {
    sourceVersion = { major = "5"; minor = "1"; patch = "5"; };
    hash = "2640fc56a795f29d28ef15e13c34a47e223960b0240e8cb0a82d9b0738695333";
+    makeWrapper = makeBinaryWrapper;
    patches = (lib.optional stdenv.isDarwin ./5.1.darwin.patch)
      ++ [ ./CVE-2014-5461.patch ];
  };
--- a/Show more
+++ b/Show more
 @ -1 +1 @@
 .05
 .11