Merge master into haskell-updates

doc/builders/images/dockertools.section.md

@@ -36,6 +36,9 @@ buildImage {
     WorkingDir = "/data";
     Volumes = { "/data" = { }; };
   };
+
+  diskSize = 1024;
+  buildVMMemorySize = 512;
 }
 ```
 
@@ -59,6 +62,10 @@ The above example will build a Docker image `redis/latest` from the given base i
 
 - `config` is used to specify the configuration of the containers that will be started off the built image in Docker. The available options are listed in the [Docker Image Specification v1.2.0](https://github.com/moby/moby/blob/master/image/spec/v1.2.md#image-json-field-descriptions).
 
+- `diskSize` is used to specify the disk size of the VM used to build the image in megabytes. By default it's 1024 MiB.
+
+- `buildVMMemorySize` is used to specify the memory size of the VM to build the image in megabytes. By default it's 512 MiB.
+
 After the new layer has been created, its closure (to which `contents`, `config` and `runAsRoot` contribute) will be copied in the layer itself. Only new dependencies that are not already in the existing layers will be copied.
 
 At the end of the process, only one new single layer will be produced and added to the resulting image.

maintainers/maintainer-list.nix

@@ -1778,7 +1778,7 @@
   };
   booklearner = {
     name = "booklearner";
-    email = "hey@booklearner.org";
+    email = "booklearner@proton.me";
     matrix = "@booklearner:matrix.org";
     github = "booklearner";
     githubId = 103979114;
@@ -7956,6 +7956,12 @@
     githubId = 31056089;
     name = "Tom Ho";
   };
+  majewsky = {
+    email = "majewsky@gmx.net";
+    github = "majewsky";
+    githubId = 24696;
+    name = "Stefan Majewsky";
+  };
   majiir = {
     email = "majiir@nabaal.net";
     github = "Majiir";
@@ -14068,6 +14074,15 @@
     github = "wr0belj";
     githubId = 40501814;
   };
+  wrmilling = {
+    name = "Winston R. Milling";
+    email = "Winston@Milli.ng";
+    github = "WRMilling";
+    githubId = 6162814;
+    keys = [{
+      fingerprint = "21E1 6B8D 2EE8 7530 6A6C  9968 D830 77B9 9F8C 6643";
+    }];
+  };
   wscott = {
     email = "wsc9tt@gmail.com";
     github = "wscott";

nixos/modules/module-list.nix

@@ -620,6 +620,7 @@
   ./services/misc/plikd.nix
   ./services/misc/podgrab.nix
   ./services/misc/polaris.nix
+  ./services/misc/portunus.nix
   ./services/misc/prowlarr.nix
   ./services/misc/tautulli.nix
   ./services/misc/pinnwand.nix
@@ -639,6 +640,7 @@
   ./services/misc/sonarr.nix
   ./services/misc/sourcehut
   ./services/misc/spice-vdagentd.nix
+  ./services/misc/spice-webdavd.nix
   ./services/misc/ssm-agent.nix
   ./services/misc/sssd.nix
   ./services/misc/subsonic.nix

nixos/modules/services/desktops/system-config-printer.nix

@@ -34,7 +34,8 @@ with lib;
     ];
 
     # for $out/bin/install-printer-driver
-    services.packagekit.enable = true;
+    # TODO: Enable once #177946 is resolved
+    # services.packagekit.enable = true;
 
   };
 

nixos/modules/services/hardware/fwupd.nix

@@ -125,6 +125,8 @@ in {
 
     services.udev.packages = [ cfg.package ];
 
+    services.udisks2.enable = true;
+
     systemd.packages = [ cfg.package ];
   };
 

nixos/modules/services/misc/portunus.nix

@@ -0,0 +1,288 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.portunus;
+
+in
+{
+  options.services.portunus = {
+    enable = mkEnableOption "Portunus, a self-contained user/group management and authentication service for LDAP";
+
+    domain = mkOption {
+      type = types.str;
+      example = "sso.example.com";
+      description = "Subdomain which gets reverse proxied to Portunus webserver.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8080;
+      description = ''
+        Port where the Portunus webserver should listen on.
+
+        This must be put behind a TLS-capable reverse proxy because Portunus only listens on localhost.
+      '';
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.portunus;
+      defaultText = "pkgs.portunus";
+      description = "The Portunus package to use.";
+    };
+
+    seedPath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to a portunus seed file in json format.
+        See <link xlink:href="https://github.com/majewsky/portunus#seeding-users-and-groups-from-static-configuration"/> for available options.
+      '';
+    };
+
+    stateDir = mkOption {
+      type = types.path;
+      default = "/var/lib/portunus";
+      description = "Path where Portunus stores its state.";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "portunus";
+      description = "User account under which Portunus runs its webserver.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "portunus";
+      description = "Group account under which Portunus runs its webserver.";
+    };
+
+    dex = {
+      enable = mkEnableOption ''
+        Dex ldap connector.
+
+        To activate dex, first a search user must be created in the Portunus web ui
+        and then the password must to be set as the <literal>DEX_SEARCH_USER_PASSWORD</literal> environment variable
+        in the <xref linkend="opt-services.dex.environmentFile"/> setting.
+      '';
+
+      oidcClients = mkOption {
+        type = types.listOf (types.submodule {
+          options = {
+            callbackURL = mkOption {
+              type = types.str;
+              description = "URL where the OIDC client should redirect";
+            };
+            id = mkOption {
+              type = types.str;
+              description = "ID of the OIDC client";
+            };
+          };
+        });
+        default = [ ];
+        example = [
+          {
+            callbackURL = "https://example.com/client/oidc/callback";
+            id = "service";
+          }
+        ];
+        description = ''
+          List of OIDC clients.
+
+          The OIDC secret must be set as the <literal>DEX_CLIENT_''${id}</literal> environment variable
+          in the <xref linkend="opt-services.dex.environmentFile"/> setting.
+        '';
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 5556;
+        description = "Port where dex should listen on.";
+      };
+    };
+
+    ldap = {
+      package = mkOption {
+        type = types.package;
+        default = pkgs.openldap;
+        defaultText = "pkgs.openldap";
+        description = "The OpenLDAP package to use.";
+      };
+
+      searchUserName = mkOption {
+        type = types.str;
+        default = "";
+        example = "admin";
+        description = ''
+          The login name of the search user.
+          This user account must be configured in Portunus either manually or via seeding.
+        '';
+      };
+
+      suffix = mkOption {
+        type = types.str;
+        example = "dc=example,dc=org";
+        description = ''
+          The DN of the topmost entry in your LDAP directory.
+          Please refer to the Portunus documentation for more information on how this impacts the structure of the LDAP directory.
+        '';
+      };
+
+      tls = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Wether to enable LDAPS protocol.
+          This also adds two entries to the <literal>/etc/hosts</literal> file to point <xref linkend="opt-services.portunus.domain"/> to localhost,
+          so that CLIs and programs can use ldaps protocol and verify the certificate without opening the firewall port for the protocol.
+
+          This requires a TLS certificate for <xref linkend="opt-services.portunus.domain"/> to be configured via <xref linkend="opt-security.acme.certs"/>.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "openldap";
+        description = "User account under which Portunus runs its LDAP server.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "openldap";
+        description = "Group account under which Portunus runs its LDAP server.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.dex.enable -> cfg.ldap.searchUserName != "";
+        message = "services.portunus.dex.enable requires services.portunus.ldap.searchUserName to be set.";
+      }
+    ];
+
+    # add ldapsearch(1) etc. to interactive shells
+    environment.systemPackages = [ cfg.ldap.package ];
+
+    # allow connecting via ldaps /w certificate without opening ports
+    networking.hosts = mkIf cfg.ldap.tls {
+      "::1" = [ cfg.domain ];
+      "127.0.0.1" = [ cfg.domain ];
+    };
+
+    services.dex = mkIf cfg.dex.enable {
+      enable = true;
+      settings = {
+        issuer = "https://${cfg.domain}/dex";
+        web.http = "127.0.0.1:${toString cfg.dex.port}";
+        storage = {
+          type = "sqlite3";
+          config.file = "/var/lib/dex/dex.db";
+        };
+        enablePasswordDB = false;
+        connectors = [{
+          type = "ldap";
+          id = "ldap";
+          name = "LDAP";
+          config = {
+            host = "${cfg.domain}:636";
+            bindDN = "uid=${cfg.ldap.searchUserName},ou=users,${cfg.ldap.suffix}";
+            bindPW = "$DEX_SEARCH_USER_PASSWORD";
+            userSearch = {
+              baseDN = "ou=users,${cfg.ldap.suffix}";
+              filter = "(objectclass=person)";
+              username = "uid";
+              idAttr = "uid";
+              emailAttr = "mail";
+              nameAttr = "cn";
+              preferredUsernameAttr = "uid";
+            };
+            groupSearch = {
+              baseDN = "ou=groups,${cfg.ldap.suffix}";
+              filter = "(objectclass=groupOfNames)";
+              nameAttr = "cn";
+              userMatchers = [{ userAttr = "DN"; groupAttr = "member"; }];
+            };
+          };
+        }];
+
+        staticClients = forEach cfg.dex.oidcClients (client: {
+          inherit (client) id;
+          redirectURIs = [ client.callbackURI ];
+          name = "OIDC for ${client.id}";
+          secret = "$DEX_CLIENT_${client.id}";
+        });
+      };
+    };
+
+    systemd.services = {
+      dex.serviceConfig = mkIf cfg.dex.enable {
+        # `dex.service` is super locked down out of the box, but we need some
+        # place to write the SQLite database. This creates $STATE_DIRECTORY below
+        # /var/lib/private because DynamicUser=true, but it gets symlinked into
+        # /var/lib/dex inside the unit
+        StateDirectory = "dex";
+      };
+
+      portunus = {
+        description = "Self-contained authentication service";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig.ExecStart = "${cfg.package.out}/bin/portunus-orchestrator";
+        environment = {
+          PORTUNUS_LDAP_SUFFIX = cfg.ldap.suffix;
+          PORTUNUS_SERVER_BINARY = "${cfg.package}/bin/portunus-server";
+          PORTUNUS_SERVER_GROUP = cfg.group;
+          PORTUNUS_SERVER_USER = cfg.user;
+          PORTUNUS_SERVER_HTTP_LISTEN = "[::]:${toString cfg.port}";
+          PORTUNUS_SERVER_STATE_DIR = cfg.stateDir;
+          PORTUNUS_SLAPD_BINARY = "${cfg.ldap.package}/libexec/slapd";
+          PORTUNUS_SLAPD_GROUP = cfg.ldap.group;
+          PORTUNUS_SLAPD_USER = cfg.ldap.user;
+          PORTUNUS_SLAPD_SCHEMA_DIR = "${cfg.ldap.package}/etc/schema";
+        } // (optionalAttrs (cfg.seedPath != null) ({
+          PORTUNUS_SEED_PATH = cfg.seedPath;
+        })) // (optionalAttrs cfg.ldap.tls (
+          let
+            acmeDirectory = config.security.acme.certs."${cfg.domain}".directory;
+          in
+          {
+            PORTUNUS_SLAPD_TLS_CA_CERTIFICATE = "/etc/ssl/certs/ca-certificates.crt";
+            PORTUNUS_SLAPD_TLS_CERTIFICATE = "${acmeDirectory}/cert.pem";
+            PORTUNUS_SLAPD_TLS_DOMAIN_NAME = cfg.domain;
+            PORTUNUS_SLAPD_TLS_PRIVATE_KEY = "${acmeDirectory}/key.pem";
+          }));
+      };
+    };
+
+    users.users = mkMerge [
+      (mkIf (cfg.ldap.user == "openldap") {
+        openldap = {
+          group = cfg.ldap.group;
+          isSystemUser = true;
+        };
+      })
+      (mkIf (cfg.user == "portunus") {
+        portunus = {
+          group = cfg.group;
+          isSystemUser = true;
+        };
+      })
+    ];
+
+    users.groups = mkMerge [
+      (mkIf (cfg.ldap.user == "openldap") {
+        openldap = { };
+      })
+      (mkIf (cfg.user == "portunus") {
+        portunus = { };
+      })
+    ];
+  };
+
+  meta.maintainers = [ majewsky ] ++ teams.c3d2.members;
+}

nixos/modules/services/misc/spice-webdavd.nix

@@ -0,0 +1,38 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+let
+  cfg = config.services.spice-webdavd;
+in
+{
+  options = {
+    services.spice-webdavd = {
+      enable = mkEnableOption "the spice guest webdav proxy daemon";
+
+      package = mkOption {
+        default = pkgs.phodav;
+        defaultText = literalExpression "pkgs.phodav";
+        type = types.package;
+        description = "spice-webdavd provider package to use.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # ensure the webdav fs this exposes can actually be mounted
+    services.davfs2.enable = true;
+
+    # add the udev rule which starts the proxy when the spice socket is present
+    services.udev.packages = [ cfg.package ];
+
+    systemd.services.spice-webdavd = {
+      description = "spice-webdav proxy daemon";
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${cfg.package}/bin/spice-webdavd -p 9843";
+        Restart = "on-success";
+      };
+    };
+  };
+}

nixos/modules/services/web-apps/dex.nix

@@ -11,15 +11,26 @@ let
   settingsFormat = pkgs.formats.yaml {};
   configFile = settingsFormat.generate "config.yaml" filteredSettings;
 
-  startPreScript = pkgs.writeShellScript "dex-start-pre" (''
-  '' + (concatStringsSep "\n" (builtins.map (file: ''
-    ${pkgs.replace-secret}/bin/replace-secret '${file}' '${file}' /run/dex/config.yaml
-  '') secretFiles)));
+  startPreScript = pkgs.writeShellScript "dex-start-pre"
+    (concatStringsSep "\n" (map (file: ''
+      replace-secret '${file}' '${file}' /run/dex/config.yaml
+    '')
+    secretFiles));
 in
 {
   options.services.dex = {
     enable = mkEnableOption "the OpenID Connect and OAuth2 identity provider";
 
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Environment file (see <literal>systemd.exec(5)</literal>
+        "EnvironmentFile=" section for the syntax) to define variables for dex.
+        This option can be used to safely include secret keys into the dex configuration.
+      '';
+    };
+
     settings = mkOption {
       type = settingsFormat.type;
       default = {};
@@ -48,6 +59,9 @@ in
       description = lib.mdDoc ''
         The available options can be found in
         [the example configuration](https://github.com/dexidp/dex/blob/v${pkgs.dex.version}/config.yaml.dist).
+
+        It's also possible to refer to environment variables (defined in [services.dex.environmentFile](#opt-services.dex.environmentFile))
+        using the syntax `$VARIABLE_NAME`.
       '';
     };
   };
@@ -57,15 +71,15 @@ in
       description = "dex identity provider";
       wantedBy = [ "multi-user.target" ];
       after = [ "networking.target" ] ++ (optional (cfg.settings.storage.type == "postgres") "postgresql.service");
-
+      path = with pkgs; [ replace-secret ];
       serviceConfig = {
         ExecStart = "${pkgs.dex-oidc}/bin/dex serve /run/dex/config.yaml";
         ExecStartPre = [
           "${pkgs.coreutils}/bin/install -m 600 ${configFile} /run/dex/config.yaml"
           "+${startPreScript}"
         ];
-        RuntimeDirectory = "dex";
 
+        RuntimeDirectory = "dex";
         AmbientCapabilities = "CAP_NET_BIND_SERVICE";
         BindReadOnlyPaths = [
           "/nix/store"
@@ -109,6 +123,8 @@ in
         TemporaryFileSystem = "/:ro";
         # Does not work well with the temporary root
         #UMask = "0066";
+      } // optionalAttrs (cfg.environmentFile != null) {
+        EnvironmentFile = cfg.environmentFile;
       };
     };
   };

nixos/modules/services/web-apps/discourse.nix

@@ -6,7 +6,7 @@ let
   cfg = config.services.discourse;
   opt = options.services.discourse;
 
-  # Keep in sync with https://github.com/discourse/discourse_docker/blob/master/image/base/Dockerfile#L5
+  # Keep in sync with https://github.com/discourse/discourse_docker/blob/main/image/base/slim.Dockerfile#L5
   upstreamPostgresqlVersion = lib.getVersion pkgs.postgresql_13;
 
   postgresqlPackage = if config.services.postgresql.enable then
@@ -604,7 +604,6 @@ in
       cors_origin = "";
       serve_static_assets = false;
       sidekiq_workers = 5;
-      rtl_css = false;
       connection_reaper_age = 30;
       connection_reaper_interval = 30;
       relative_url_root = null;
@@ -940,7 +939,6 @@ in
                   proxy_cache discourse;
                   proxy_cache_key "$scheme,$host,$request_uri";
                   proxy_cache_valid 200 301 302 7d;
-                  proxy_cache_valid any 1m;
                 '';
               };
               "/message-bus/" = proxy {

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -361,7 +361,8 @@ in
       services.gnome.tracker-miners.enable = mkDefault true;
       services.gnome.tracker.enable = mkDefault true;
       services.hardware.bolt.enable = mkDefault true;
-      services.packagekit.enable = mkDefault true;
+      # TODO: Enable once #177946 is resolved
+      # services.packagekit.enable = mkDefault true;
       services.udisks2.enable = true;
       services.upower.enable = config.powerManagement.enable;
       services.xserver.libinput.enable = mkDefault true; # for controlling touchpad settings via gnome control center

nixos/modules/services/x11/desktop-managers/pantheon.nix

@@ -134,7 +134,8 @@ in
       services.bamf.enable = true;
       services.colord.enable = mkDefault true;
       services.fwupd.enable = mkDefault true;
-      services.packagekit.enable = mkDefault true;
+      # TODO: Enable once #177946 is resolved
+      # services.packagekit.enable = mkDefault true;
       services.power-profiles-daemon.enable = mkDefault true;
       services.touchegg.enable = mkDefault true;
       services.touchegg.package = pkgs.pantheon.touchegg;

nixos/modules/services/x11/display-managers/default.nix

@@ -35,6 +35,10 @@ let
       # Shared environment setup for graphical sessions.
 
       . /etc/profile
+      if test -f ~/.profile; then
+          source ~/.profile
+      fi
+
       cd "$HOME"
 
       # Allow the user to execute commands at the beginning of the X session.

pkgs/applications/blockchains/exodus/default.nix

@@ -4,11 +4,11 @@ cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core, libxkbcommon, mesa }:
 
 stdenv.mkDerivation rec {
   pname = "exodus";
-  version = "22.7.29";
+  version = "22.8.12";
 
   src = fetchzip {
     url = "https://downloads.exodus.io/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "sha256-vshcXuFuOuXlmdgqK+pj6dAbeYGNR2YA79AzkeUzNtk=";
+    sha256 = "sha256-jNzHh4zYhFzpFZAC9rHmwjTdFkbpROSEN3qpL7geiOU=";
   };
 
   installPhase = ''

pkgs/applications/editors/jupyter/kernel.nix

@@ -15,8 +15,8 @@ let
         "{connection_file}"
       ];
       language = "python";
-      logo32 = "${env.sitePackages}/ipykernel/resources/logo-32x32.png";
-      logo64 = "${env.sitePackages}/ipykernel/resources/logo-64x64.png";
+      logo32 = "${env}/${env.sitePackages}/ipykernel/resources/logo-32x32.png";
+      logo64 = "${env}/${env.sitePackages}/ipykernel/resources/logo-64x64.png";
     };
   };
 

pkgs/applications/editors/o/default.nix

@@ -0,0 +1,43 @@
+{ lib, stdenv, buildGoModule, fetchFromGitHub, installShellFiles, makeWrapper, pkg-config
+, tcsh
+, withGui ? stdenv.isLinux, vte # vte is broken on darwin
+}:
+
+buildGoModule rec {
+  pname = "o";
+  version = "2.55.1";
+
+  src = fetchFromGitHub {
+    owner = "xyproto";
+    repo = "o";
+    rev = "v${version}";
+    hash = "sha256-owueLd6kR/bDFxKI9QOUgriH63XRsEEpIFfp5aRTSbI=";
+  };
+
+  postPatch = ''
+    substituteInPlace ko/main.cpp --replace '/bin/csh' '${tcsh}/bin/tcsh'
+  '';
+
+  vendorSha256 = null;
+
+  nativeBuildInputs = [ installShellFiles makeWrapper pkg-config ];
+
+  buildInputs = lib.optional withGui vte;
+
+  preBuild = "cd v2";
+
+  postInstall = ''
+    cd ..
+    installManPage o.1
+  '' + lib.optionalString withGui ''
+    make install-gui PREFIX=$out
+    wrapProgram $out/bin/ko --prefix PATH : $out/bin
+  '';
+
+  meta = with lib; {
+    description = "Config-free text editor and IDE limited to VT100";
+    homepage = "https://github.com/xyproto/o";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ sikmir ];
+  };
+}

pkgs/applications/editors/vscode/vscodium.nix

@@ -15,11 +15,11 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1jvi34ym7d6j5zl9d7wg3rcy34f4ji907mixfmvs7g0z1vlra2sv";
-    x86_64-darwin = "19nnkx2l4rvm23r8ii2a0jn8lvanmshwsjrsgmi7dcnf68143601";
-    aarch64-linux = "17rx5v3kzwzkzhckly8s413370mrh7rcyhpnppmn39gkvy68ydhs";
-    aarch64-darwin = "0ff0yn3kcb35s775w0k2l3szs137ph593qa7y3p2h4sbfsrgljxz";
-    armv7l-linux = "0qhik2qhbwpjrbkpdc8cblvrh1hqld69il78zmayq1bbkqzhhmp5";
+    x86_64-linux = "04jmp9z9b8gqq1nxfw186fnyd0glcp0s8iiy5g2zy2y7jsllm5qi";
+    x86_64-darwin = "119k1q1dnnhzdyv3wx13ghpwvsrmb1s8ira50ldlac3dr54rhjc9";
+    aarch64-linux = "0sr9q4rm63p6lgg3qq86hmkcyg4i6znijw1k5h0sv1qc9hrlq6gv";
+    aarch64-darwin = "0n742ka8ap35klx5yiba08fyqfq5077l8f8b8r5if91rcdwmkwm1";
+    armv7l-linux = "0a5wd91ksdgabalgmk9pwjjl2haxdidyxz3bnrmrvr1hnlylq1mh";
   }.${system} or throwSystem;
 
   sourceRoot = if stdenv.isDarwin then "" else ".";
@@ -29,7 +29,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.70.1";
+    version = "1.70.1.22228";
     pname = "vscodium";
 
     executableName = "codium";

pkgs/applications/misc/mupdf/default.nix

@@ -35,12 +35,12 @@ let
 
 in
 stdenv.mkDerivation rec {
-  version = "1.19.0";
+  version = "1.20.3";
   pname = "mupdf";
 
   src = fetchurl {
     url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    sha256 = "1vfyhlqq1a0k0drcggly4bgsjasmf6lmpfbdi5xcrwdbzkagrbr1";
+    sha256 = "sha256-a2AHD27sIOjYfStc0iz0kCAxGjzxXuEJmOPl9fmEses=";
   };
 
   patches = [ ./0001-Use-command-v-in-favor-of-which.patch

pkgs/applications/networking/browsers/elinks/default.nix

@@ -13,13 +13,13 @@ assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
   pname = "elinks";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "rkd77";
     repo = "felinks";
     rev = "v${version}";
-    sha256 = "sha256-2TF0rbmjwhwV2AVUXjfzoprzpeqrETis3AFhMftpaZQ=";
+    sha256 = "sha256-9OEi4UF/4/IRtccJou3QuevQzWjA6PuU5IVlT7qqGZ0=";
   };
 
   buildInputs = [

pkgs/applications/networking/cluster/terraform-providers/default.nix

@@ -70,6 +70,8 @@ let
     in
     lib.optionalAttrs config.allowAliases {
       b2 = removed "b2" "2022/06";
+      dome9 = removed "dome9" "2022/08";
+      ncloud = removed "ncloud" "2022/08";
       opc = archived "opc" "2022/05";
       oraclepaas = archived "oraclepaas" "2022/05";
       template = archived "template" "2022/05";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -32,10 +32,10 @@
     "owner": "aiven",
     "provider-source-address": "registry.terraform.io/aiven/aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v3.5.0",
-    "sha256": "sha256-MLcC3fGQaXdtB+4/is30mn9+jbq7UUULFs7DxKE2jxM=",
-    "vendorSha256": "sha256-mnj8AlVKrTgCOexA9CZELxB1rYtOflXg+dBrSu++enI=",
-    "version": "3.5.0"
+    "rev": "v3.5.1",
+    "sha256": "sha256-EJPf8jDANrjg+XPhFn6L7GPUya2WbrSUX8/hQldQmnQ=",
+    "vendorSha256": "sha256-X9AJM4OsJ2/zl2Mm6gaz5wA6hk9AfOlUFYYN9Ojirrc=",
+    "version": "3.5.1"
   },
   "akamai": {
     "owner": "akamai",
@@ -51,10 +51,10 @@
     "owner": "aliyun",
     "provider-source-address": "registry.terraform.io/aliyun/alicloud",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.180.0",
-    "sha256": "sha256-vBRik7iS9hUCdj4RfiwXswuIGOHlCMt0QHV2k9yIiGs=",
+    "rev": "v1.181.0",
+    "sha256": "sha256-zJagnn/nfueGwevgQaaiB5Y3DF6214JPa/fD/XctLHU=",
     "vendorSha256": "sha256-kjr93pVmMZgeJgeG8hG86CDWr95gCIAhf93OQ4tJ9kw=",
-    "version": "1.180.0"
+    "version": "1.181.0"
   },
   "ansible": {
     "owner": "nbering",
@@ -307,10 +307,10 @@
     "owner": "digitalocean",
     "provider-source-address": "registry.terraform.io/digitalocean/digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.21.0",
-    "sha256": "sha256-ei3nr3SAxQBXQikzPtRs9Y6VyOavTg9GXnLVfAI7QvU=",
+    "rev": "v2.22.1",
+    "sha256": "sha256-Sc2altZo/8Y1UYpZjT8beq3VUljJAdzyXexB9Yi5WQI=",
     "vendorSha256": null,
-    "version": "2.21.0"
+    "version": "2.22.1"
   },
   "dme": {
     "owner": "DNSMadeEasy",
@@ -348,15 +348,6 @@
     "vendorSha256": "sha256-aPt1y7UEL+Y4aRm0rfHr/yJ393NP2oAqgz7+fo/msQo=",
     "version": "2.20.2"
   },
-  "dome9": {
-    "owner": "dome9",
-    "provider-source-address": "registry.terraform.io/dome9/dome9",
-    "repo": "terraform-provider-dome9",
-    "rev": "v1.27.4",
-    "sha256": "sha256-+3jIq7f21CkuF3UZYV3o+ZIdoQi0hFgO/qXwdhkcaPI=",
-    "vendorSha256": null,
-    "version": "1.27.4"
-  },
   "elasticsearch": {
     "owner": "phillbaker",
     "provider-source-address": "registry.terraform.io/phillbaker/elasticsearch",
@@ -406,10 +397,10 @@
     "owner": "FlexibleEngineCloud",
     "provider-source-address": "registry.terraform.io/FlexibleEngineCloud/flexibleengine",
     "repo": "terraform-provider-flexibleengine",
-    "rev": "v1.31.1",
-    "sha256": "sha256-QB3O9Ez+hFgBE1yYi1kqtC3WW//Ueg/Ij4p2WbQz/AE=",
-    "vendorSha256": "sha256-P2/yK6aLNdmC8g5dMKK0hpAdj76KtewzVVHQsVgr3J4=",
-    "version": "1.31.1"
+    "rev": "v1.32.0",
+    "sha256": "sha256-zO5bt17cwMnv6kk1McRPOrs4UJ15MBpTRT2WoDovXG4=",
+    "vendorSha256": "sha256-jX98VUNTOa0C9WiAiFUiFQ9W7vhRdXCgmmxz84CmEpw=",
+    "version": "1.32.0"
   },
   "fortios": {
     "deleteVendor": true,
@@ -435,10 +426,10 @@
     "owner": "integrations",
     "provider-source-address": "registry.terraform.io/integrations/github",
     "repo": "terraform-provider-github",
-    "rev": "v4.28.0",
-    "sha256": "sha256-Pu8I+tAcrEN8ZtBv/gH1VguO1GVk3tnqeJ50cLh7/HQ=",
+    "rev": "v4.29.0",
+    "sha256": "sha256-on43tlkPxtQFwjbr5zOvzgO8RfcGc8XbUXZURa81Kkc=",
     "vendorSha256": null,
-    "version": "4.28.0"
+    "version": "4.29.0"
   },
   "gitlab": {
     "owner": "gitlabhq",
@@ -454,20 +445,20 @@
     "provider-source-address": "registry.terraform.io/hashicorp/google",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.31.0",
-    "sha256": "sha256-Y9iyWjC+XLkselVIhaM0N7iNelbdlF9jV7AjTYiD8RM=",
-    "vendorSha256": "sha256-hu1uK1yW07NlV3/DnKQxdGhbrzpq6MADmgkRr4+VQ1w=",
-    "version": "4.31.0"
+    "rev": "v4.32.0",
+    "sha256": "sha256-idekFsYnrQ4wHjAIPlZn8dSEqOP9KWQvaqImIN/mJA8=",
+    "vendorSha256": "sha256-LvWKVuHWOsMwucCQtrRMQ3wRnbGMid7jBG47wvBCvmY=",
+    "version": "4.32.0"
   },
   "google-beta": {
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.31.0",
-    "sha256": "sha256-5Ieq8LvhrlFevMgr7JKeGCkWWejjOvKhKfXpPvsNzRU=",
-    "vendorSha256": "sha256-hu1uK1yW07NlV3/DnKQxdGhbrzpq6MADmgkRr4+VQ1w=",
-    "version": "4.31.0"
+    "rev": "v4.32.0",
+    "sha256": "sha256-9iYS8lc4+QPnwMMscU/5mcDlaQrKV8Srhn9o64hZq6k=",
+    "vendorSha256": "sha256-LvWKVuHWOsMwucCQtrRMQ3wRnbGMid7jBG47wvBCvmY=",
+    "version": "4.32.0"
   },
   "googleworkspace": {
     "owner": "hashicorp",
@@ -554,10 +545,10 @@
     "owner": "huaweicloud",
     "provider-source-address": "registry.terraform.io/huaweicloud/huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.38.2",
-    "sha256": "sha256-ZbfSpno3yEJ7u6g1dBWMza2uLS1FXEzvSKi+mMLbVGQ=",
+    "rev": "v1.39.0",
+    "sha256": "sha256-ckjCINqaW8taEzmBEjje3s15OmaAi9LWcSd7vgJyDug=",
     "vendorSha256": null,
-    "version": "1.38.2"
+    "version": "1.39.0"
   },
   "huaweicloudstack": {
     "owner": "huaweicloud",
@@ -662,10 +653,10 @@
     "owner": "launchdarkly",
     "provider-source-address": "registry.terraform.io/launchdarkly/launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.8.0",
-    "sha256": "sha256-H/oKgylo8LLmx2v0BTj6Vb7JQbf9JCooFmsziog6r4E=",
+    "rev": "v2.9.0",
+    "sha256": "sha256-/9J0c79zm3s0i1Um+w+etlpsd37svtovqmBXnGZ1tog=",
     "vendorSha256": "sha256-Ef07RvkqXR/7qf8gHayxczBJ/ChHDmxR6+/wzaokkzk=",
-    "version": "2.8.0"
+    "version": "2.9.0"
   },
   "libvirt": {
     "owner": "dmacvicar",
@@ -776,15 +767,6 @@
     "vendorSha256": null,
     "version": "2.1.0"
   },
-  "ncloud": {
-    "owner": "NaverCloudPlatform",
-    "provider-source-address": "registry.terraform.io/NaverCloudPlatform/ncloud",
-    "repo": "terraform-provider-ncloud",
-    "rev": "v2.2.9",
-    "sha256": "sha256-D9B3IJZZOCR/kzFee3sBPEbDcAL33kIef/NAYDuJv7U=",
-    "vendorSha256": "sha256-DPK/RF63rz5AQY/LybT8I6z6vSvqrFqypslhquRrgfg=",
-    "version": "2.2.9"
-  },
   "netlify": {
     "owner": "AegirHealth",
     "provider-source-address": "registry.terraform.io/AegirHealth/netlify",
@@ -907,10 +889,10 @@
     "owner": "opsgenie",
     "provider-source-address": "registry.terraform.io/opsgenie/opsgenie",
     "repo": "terraform-provider-opsgenie",
-    "rev": "v0.6.11",
-    "sha256": "sha256-R+IKAI86DhQ2E74VpswqG75p7PRzSV77at2+dAyI5RI=",
+    "rev": "v0.6.14",
+    "sha256": "sha256-IoN7z8/ZPEr6pW7vnDjY65+gAtncV1fr+YsnggSZuZA=",
     "vendorSha256": null,
-    "version": "0.6.11"
+    "version": "0.6.14"
   },
   "ovh": {
     "owner": "ovh",
@@ -1042,10 +1024,10 @@
     "owner": "jianyuan",
     "provider-source-address": "registry.terraform.io/jianyuan/sentry",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.9.3",
-    "sha256": "sha256-FTwJ0H5k5zeglgjur3O6b4GybWAmVF4K7QmNMlvHnlY=",
-    "vendorSha256": "sha256-lmnZLgCTpKGhk+rUWwL2GQoBAXlU006Sk1GZrcEvhD4=",
-    "version": "0.9.3"
+    "rev": "v0.9.4",
+    "sha256": "sha256-dNyUp+gXrOvMQu5tEnv2dOsXihyd19gdYakIo7+h3pY=",
+    "vendorSha256": "sha256-ohPZpFCjawaymVHZoCstPeu+p0erRnfnpbjipT6Sp20=",
+    "version": "0.9.4"
   },
   "shell": {
     "owner": "scottwinkler",
@@ -1132,19 +1114,19 @@
     "owner": "tencentcloudstack",
     "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.77.1",
-    "sha256": "sha256-U/gmvLHu/Gt7pfxXAQYEQdpS1r7Epees2VkaHdnK1VI=",
+    "rev": "v1.77.3",
+    "sha256": "sha256-OHE8o4KJ2dsSS/Erl7MrRrAl8DTIxotEg69S9fuh7iY=",
     "vendorSha256": null,
-    "version": "1.77.1"
+    "version": "1.77.3"
   },
   "tfe": {
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/tfe",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.35.0",
-    "sha256": "sha256-YSQrDiaADEi8eTnFaXfsX3wz4bst/h/gVts4YjWbVzI=",
-    "vendorSha256": "sha256-Qa0EKVaMFpSpTc5z4KhAeK8bhDNPeac1QzeTSNkUwA0=",
-    "version": "0.35.0"
+    "rev": "v0.36.0",
+    "sha256": "sha256-xMIrEkjcYkM/LXdu/0gNX6iMJKZhGs9z2vQBbDHdelo=",
+    "vendorSha256": "sha256-ck6H22N5IXJVa0KeXM0Ntv+16l97v8GaT7xfGme57QE=",
+    "version": "0.36.0"
   },
   "thunder": {
     "owner": "a10networks",

pkgs/applications/networking/dnscontrol/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "3.18.1";
+  version = "3.19.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-G4FfKTlMuJ0YKsNQnMFjXq6ZBuLJjlCg7GqFPHcsHFM=";
+    sha256 = "sha256-bP9tksdP/hNjC4opACLYHad8jj137+WQfb3bM8A6tVQ=";
   };
 
-  vendorSha256 = "sha256-g2T3TmwkF1ft5XRimZLrTmm0Km5HcX/0aQtUjA5TZzw=";
+  vendorSha256 = "sha256-/lFH/4fQgK0LAqLIn39r+hi0pqNlJuupWlLhOhDh0TU=";
 
   ldflags = [ "-s" "-w" ];
 

pkgs/applications/networking/instant-messengers/armcord/default.nix

@@ -0,0 +1,129 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, makeWrapper
+, alsa-lib
+, at-spi2-atk
+, at-spi2-core
+, atk
+, cairo
+, cups
+, dbus
+, expat
+, ffmpeg
+, fontconfig
+, freetype
+, gdk-pixbuf
+, glib
+, gtk3
+, libappindicator-gtk3
+, libdbusmenu
+, libdrm
+, libnotify
+, libpulseaudio
+, libsecret
+, libuuid
+, libxkbcommon
+, mesa
+, nss
+, pango
+, systemd
+, xdg-utils
+, xorg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "armcord";
+  version = "3.0.7";
+
+  src = let
+    base = "https://github.com/ArmCord/ArmCord/releases/download";
+  in {
+    x86_64-linux = fetchurl {
+      url = "${base}/v${version}/ArmCord_${version}_amd64.deb";
+      sha256 = "b2a583e6abbc6e5dc3f7370a33f21fc4e7963c6cbe7555e954156c77e9577261";
+    };
+    aarch64-linux = fetchurl {
+      url = "${base}/v${version}/ArmCord_${version}_arm64.deb";
+      sha256 = "8c32a14ab8e5bdf865a6523cb4b5cec8f3f870b95f99be9661a4dd0df33aae1d";
+    };
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];
+
+  buildInputs = [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    ffmpeg
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    gtk3
+    pango
+    systemd
+    mesa # for libgbm
+    nss
+    libuuid
+    libdrm
+    libnotify
+    libsecret
+    libpulseaudio
+    libxkbcommon
+    libappindicator-gtk3
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXScrnSaver
+    xorg.libxshmfence
+    xorg.libXtst
+  ];
+
+  sourceRoot = ".";
+  unpackCmd = "dpkg-deb -x $src .";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin"
+    cp -R "opt" "$out"
+    cp -R "usr/share" "$out/share"
+    chmod -R g-w "$out"
+
+    # Wrap the startup command
+    makeWrapper $out/opt/ArmCord/armcord $out/bin/armcord \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath buildInputs}" \
+      --prefix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+      "''${gappsWrapperArgs[@]}"
+
+    # Fix desktop link
+    substituteInPlace $out/share/applications/armcord.desktop \
+      --replace /opt/ArmCord/ $out/bin/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Lightweight, alternative desktop client for Discord";
+    homepage = "https://github.com/ArmCord/ArmCord";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.osl3;
+    maintainers = with maintainers; [ wrmilling ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
+}

pkgs/applications/networking/msmtp/default.nix

@@ -24,13 +24,13 @@
 let
   inherit (lib) getBin getExe optionals;
 
-  version = "1.8.20";
+  version = "1.8.22";
 
   src = fetchFromGitHub {
     owner = "marlam";
     repo = "msmtp-mirror";
     rev = "msmtp-${version}";
-    hash = "sha256-RcQZ7Vm8UjJJoogkmUmZ+/2fz7C4AcVYY/kTOlfz7+I=";
+    hash = "sha256-Jt/uvGBrYYr6ua6LVPiP0nuRiIkxBJASdgHBNHivzxQ=";
   };
 
   meta = with lib; {

pkgs/applications/networking/msmtp/paths.patch

@@ -1,31 +1,30 @@
+35cab741af069571cf4c55e0ce1ae96617d5778c nixify
 diff --git a/scripts/msmtpq/msmtpq b/scripts/msmtpq/msmtpq
-index 1b39fc6..4baa19b 100755
+index d8b4039..1ab89f8 100755
 --- a/scripts/msmtpq/msmtpq
 +++ b/scripts/msmtpq/msmtpq
-@@ -70,8 +70,8 @@ MSMTP=msmtp
+@@ -71,7 +71,7 @@ fi
  ##            ( chmod 0700 msmtp.queue )
  ##
- ## the queue dir - modify this to reflect where you'd like it to be  (no quotes !!)
--Q=~/.msmtp.queue
--[ -d "$Q" ] || mkdir -m 0700 "$Q" || \
+ ## the queue dir - export this variable to reflect where you'd like it to be  (no quotes !!)
+-Q=${Q:-~/.msmtp.queue}
 +Q=${MSMTP_QUEUE:-~/.msmtp.queue}
-+[ -d "$Q" ] || mkdir -m 0700 -p "$Q" || \
+ [ -d "$Q" ] || mkdir -m 0700 -p "$Q" || \
    err '' "msmtpq : can't find or create msmtp queue directory [ $Q ]" ''     # if not present - complain ; quit
  ##
- ## set the queue log file var to the location of the msmtp queue log file
-@@ -84,7 +84,10 @@ Q=~/.msmtp.queue
- ##     (doing so would be inadvisable under most conditions, however)
+@@ -85,8 +85,10 @@ Q=${Q:-~/.msmtp.queue}
  ##
- ## the queue log file - modify (or comment out) to taste  (but no quotes !!)
--LOG=~/log/msmtp.queue.log
+ ## the queue log file - export this variable to change where logs are stored  (but no quotes !!)
+ ##                      Set it to "" (empty string) to disable logging.
+-[ -v LOG ] || LOG=~/log/msmtp.queue.log
 +LOG=${MSMTP_LOG:-~/log/msmtp.queue.log}
-+[ -d "$(dirname "$LOG")" ] || mkdir -p "$(dirname "$LOG")"
+ [ -d "$(dirname "$LOG")" ] || mkdir -p "$(dirname "$LOG")"
 +
 +JOURNAL=@journal@
  ## ======================================================================================
  
  ## msmtpq can use the following environment variables :
-@@ -138,6 +141,7 @@ on_exit() {                          # unlock the queue on exit if the lock was
+@@ -139,6 +141,7 @@ on_exit() {                          # unlock the queue on exit if the lock was
  ## display msg to user, as well
  ##
  log() {
@@ -33,14 +32,14 @@ index 1b39fc6..4baa19b 100755
    local ARG RC PFX
    PFX="$('date' +'%Y %d %b %H:%M:%S')"
                                       # time stamp prefix - "2008 13 Mar 03:59:45 "
-@@ -155,10 +159,19 @@ log() {
+@@ -156,10 +159,19 @@ log() {
      done
    fi
  
-+  if [ "$JOURNAL" == "Y" ]; then
-+    for ARG ; do
-+      [ -n "$ARG" ] && \
-+        echo "$ARG" | systemd-cat -t $NAME -p info
++  if [ "$JOURNAL" = "Y" ]; then
++    for ARG; do
++      [ -n "$ARG" ] &&
++        echo "$ARG" | systemd-cat -t "$NAME" -p info
 +    done
 +  fi
 +
@@ -48,8 +47,8 @@ index 1b39fc6..4baa19b 100755
      [ -n "$LKD" ] && lock_queue -u   # unlock here (if locked)
      [ -n "$LOG" ] && \
        echo "    exit code = $RC" >> "$LOG" # logging ok ; send exit code to log
-+    [ "$JOURNAL" == "Y" ] && \
-+      echo "exit code= $RC" | systemd-cat -t $NAME -p emerg
++    [ "$JOURNAL" = "Y" ] && \
++      echo "exit code= $RC" | systemd-cat -t "$NAME" -p emerg
      exit "$RC"                       # exit w/return code
    fi
  }

pkgs/applications/networking/n8n/node-packages.nix

@@ -94,6 +94,15 @@ let
         sha512 = "Lx7A3k2JIXpIbixfUaOOG79WNSo/Y7dhZ0LaLhaayyZ6PwQdVsEQXAR+oIPqPSfgPzv7RtwPSVviJ2APrsQKvQ==";
       };
     };
+    "@azure/core-http-compat-1.3.0" = {
+      name = "_at_azure_slash_core-http-compat";
+      packageName = "@azure/core-http-compat";
+      version = "1.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@azure/core-http-compat/-/core-http-compat-1.3.0.tgz";
+        sha512 = "ZN9avruqbQ5TxopzG3ih3KRy52n8OAbitX3fnZT5go4hzu0J+KVPSzkL+Wt3hpJpdG8WIfg1sBD1tWkgUdEpBA==";
+      };
+    };
     "@azure/core-lro-2.2.5" = {
       name = "_at_azure_slash_core-lro";
       packageName = "@azure/core-lro";
@@ -157,13 +166,13 @@ let
         sha512 = "BPDz1sK7Ul9t0l9YKLEa8PHqWU4iCfhGJ+ELJl6c8CP3TpJt2urNCbm0ZHsthmxRsYoMPbz2Dvzj30zXZVmAFw==";
       };
     };
-    "@azure/keyvault-keys-4.4.0" = {
+    "@azure/keyvault-keys-4.5.0" = {
       name = "_at_azure_slash_keyvault-keys";
       packageName = "@azure/keyvault-keys";
-      version = "4.4.0";
+      version = "4.5.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@azure/keyvault-keys/-/keyvault-keys-4.4.0.tgz";
-        sha512 = "W9sPZebXYa3aar7BGIA+fAsq/sy1nf2TZAETbkv7DRawzVLrWv8QoVVceqNHjy3cigT4HNxXjaPYCI49ez5CUA==";
+        url = "https://registry.npmjs.org/@azure/keyvault-keys/-/keyvault-keys-4.5.0.tgz";
+        sha512 = "F+0qpUrIxp1/uuQ3sFsAf4rTXErFwmuVLoXlD2e3ebrONrmYjqszwmlN4tBqAag1W9wGuZTL0jE8X8b+LB83ow==";
       };
     };
     "@azure/logger-1.0.3" = {
@@ -283,13 +292,13 @@ let
         sha512 = "RxSa9VjcDWgWCYsaLdZItdCnJj7p4LxggaEk+Y3MP0dHKoxez8ioG07DVekVbZZqccsrL+oPB/N9AzVPxj4blg==";
       };
     };
-    "@js-joda/core-5.2.0" = {
+    "@js-joda/core-5.3.0" = {
       name = "_at_js-joda_slash_core";
       packageName = "@js-joda/core";
-      version = "5.2.0";
+      version = "5.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@js-joda/core/-/core-5.2.0.tgz";
-        sha512 = "0OriPYIaMLB3XiLQMe0BXKVIqeriTn3H7JMOzTsHEtt7Zqq+TetCu97KnAhU3ckiQZKBxfZshft+H1OC4D1lXw==";
+        url = "https://registry.npmjs.org/@js-joda/core/-/core-5.3.0.tgz";
+        sha512 = "3uObVJ08i0vSbtsTWQ8omy8XUlVDnoest5MOLp6delLUZev8bu++S+3Aua7xWPPWzQt9pcuwDqjEOKslQVDj8g==";
       };
     };
     "@jsdevtools/ono-7.1.3" = {
@@ -400,13 +409,13 @@ let
         sha512 = "sBpko86IrTscc39EvHUhL+c++81BVTsIZ3ETu/vG+cCdi0N6vb2DoahR67A9FI2CGnxRRHjnTfa3m6LulwNATA==";
       };
     };
-    "@oclif/core-1.13.10" = {
+    "@oclif/core-1.14.1" = {
       name = "_at_oclif_slash_core";
       packageName = "@oclif/core";
-      version = "1.13.10";
+      version = "1.14.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@oclif/core/-/core-1.13.10.tgz";
-        sha512 = "nwpjXwWscETdvO+/z94V1zd95vnzmCB6VRaobR4BdBllwWU6jHF/eCi1Ud2Tk9RSedChoLneZuDCkKnRCmxyng==";
+        url = "https://registry.npmjs.org/@oclif/core/-/core-1.14.1.tgz";
+        sha512 = "FgAjfY3Cvzj+i8j08WiD/8adJhZvclFESXAE8Kcp7qglErFKUFK9XY9BS2NyIzLN1NCKc52A64pWunVvPv8g3w==";
       };
     };
     "@oclif/errors-1.3.5" = {
@@ -688,13 +697,13 @@ let
         sha512 = "zm6xBQpFDIDM6o9r6HSgDeIcLy82TKWctCXEPbJJcXb5AKmi5BNNdLXneixK4lplX3PqIVcwLBCGE/kAGnlD4A==";
       };
     };
-    "@types/lodash-4.14.182" = {
+    "@types/lodash-4.14.183" = {
       name = "_at_types_slash_lodash";
       packageName = "@types/lodash";
-      version = "4.14.182";
+      version = "4.14.183";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/lodash/-/lodash-4.14.182.tgz";
-        sha512 = "/THyiqyQAP9AfARo4pF+aCGcyiQ94tX/Is2I7HofNRqoYLgN1PBoOWu2/zTA5zMxzP5EFutMtWtGAFRKUe961Q==";
+        url = "https://registry.npmjs.org/@types/lodash/-/lodash-4.14.183.tgz";
+        sha512 = "UXavyuxzXKMqJPEpFPri6Ku5F9af6ZJXUneHhvQJxavrEjuHkFp2YnDWHcxJiG7hk8ZkWqjcyNeW1s/smZv5cw==";
       };
     };
     "@types/lodash.intersection-4.4.7" = {
@@ -742,13 +751,13 @@ let
         sha512 = "/SNsDidUFCvqqcWDwxv2feww/yqhNeTRL5CVoL3jU4Goc4kKEL10T7Eye65ZqPNi4HRx8sAEX59pV1aEH7drNA==";
       };
     };
-    "@types/node-18.6.5" = {
+    "@types/node-18.7.6" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "18.6.5";
+      version = "18.7.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-18.6.5.tgz";
-        sha512 = "Xjt5ZGUa5WusGZJ4WJPbOT8QOqp6nDynVFRKcUt32bOgvXEoc6o085WNkYTMO7ifAj2isEfQQ2cseE+wT6jsRw==";
+        url = "https://registry.npmjs.org/@types/node/-/node-18.7.6.tgz";
+        sha512 = "EdxgKRXgYsNITy5mjjXjVE/CS8YENSdhiagGrLqjG0pvA2owgJ6i4l7wy/PFZGC0B1/H20lWKN7ONVDNYDZm7A==";
       };
     };
     "@types/node-fetch-2.6.2" = {
@@ -1030,13 +1039,13 @@ let
         sha512 = "P43ePfOAIupkguHUycrc4qJ9kz8ZiuOUijaETwX7THt0Y/GNK7v0aa8rY816xWjZ7rJdA5XdMcpVFTKMq+RvWg==";
       };
     };
-    "app-root-path-3.0.0" = {
+    "app-root-path-3.1.0" = {
       name = "app-root-path";
       packageName = "app-root-path";
-      version = "3.0.0";
+      version = "3.1.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/app-root-path/-/app-root-path-3.0.0.tgz";
-        sha512 = "qMcx+Gy2UZynHjOHOIXPNvpf+9cjvk3cWrBBK7zg4gH9+clobJRb9NGzcT7mQTcV/6Gm/1WelUtqxVXnNlrwcw==";
+        url = "https://registry.npmjs.org/app-root-path/-/app-root-path-3.1.0.tgz";
+        sha512 = "biN3PwB2gUtjaYy/isrU3aNWI5w+fAfvHkSvCKeQGxhmYpwKFUxudR3Yya+KqVRHBmEDYh+/lTozYCFbmzX4nA==";
       };
     };
     "append-field-1.0.0" = {
@@ -1246,22 +1255,22 @@ let
         sha512 = "DMD0KiN46eipeziST1LPP/STfDU0sufISXmjSgvVsoU2tqxctQeASejWcfNtxYKqETM1UxQ8sp2OrSBWpHY6sw==";
       };
     };
-    "avsc-5.7.4" = {
+    "avsc-5.7.5" = {
       name = "avsc";
       packageName = "avsc";
-      version = "5.7.4";
+      version = "5.7.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/avsc/-/avsc-5.7.4.tgz";
-        sha512 = "z4oo33lmnvvNRqfUe3YjDGGpqu/L2+wXBIhMtwq6oqZ+exOUAkQYM6zd2VWKF7AIlajOF8ZZuPFfryTG9iLC/w==";
+        url = "https://registry.npmjs.org/avsc/-/avsc-5.7.5.tgz";
+        sha512 = "vkyt1+sj6qaD9oMtqqLE2pZ2IcHI66kFx8lpnVuXp55SnNPjKghfOhVfZpaDwDPpY0oVWP3Qu1uHZWxF3E856A==";
       };
     };
-    "aws-sdk-2.1191.0" = {
+    "aws-sdk-2.1196.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.1191.0";
+      version = "2.1196.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1191.0.tgz";
-        sha512 = "G8hWvuc+3rxTfHqsnUwGx/fy8zlnVPtlNesXMHlwU/l4oBx3+Weg0Nhng6HvLGzUJifzlnSKDXrOsWVkHtuZ1w==";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1196.0.tgz";
+        sha512 = "iOGhCY5IqGfHCJ70p0H/uxkXDh/96KanAMfhnGGbIKbpVliuEV7SYxTfsWORaaUHey+N8FE6OMKfzo7F4X+wQg==";
       };
     };
     "aws-sign2-0.7.0" = {
@@ -4621,13 +4630,13 @@ let
         sha512 = "xOqorG21Va+3CjpFOfFTU7SWohHH2uIX9ZY4Byz6J+lvpfvc486tOAT/G9GfbrKtJ9O7NCX9o0aC2lxqbnZ9EA==";
       };
     };
-    "libphonenumber-js-1.10.11" = {
+    "libphonenumber-js-1.10.12" = {
       name = "libphonenumber-js";
       packageName = "libphonenumber-js";
-      version = "1.10.11";
+      version = "1.10.12";
       src = fetchurl {
-        url = "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.10.11.tgz";
-        sha512 = "ehoihx4HpRXO6FH/uJ0EnaEV4dVU+FDny+jv0S6k9JPyPsAIr0eXDAFvGRMBKE1daCtyHAaFSKCiuCxrOjVAzQ==";
+        url = "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.10.12.tgz";
+        sha512 = "xTFBs3ipFQNmjCUkDj6ZzRJvs97IyazFHBKWtrQrLiYs0Zk0GANob1hkMRlQUQXbJrpQGwnI+/yU4oyD4ohvpw==";
       };
     };
     "libqp-1.1.0" = {
@@ -5386,49 +5395,49 @@ let
         sha512 = "z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==";
       };
     };
-    "n8n-core-0.130.0" = {
+    "n8n-core-0.131.0" = {
       name = "n8n-core";
       packageName = "n8n-core";
-      version = "0.130.0";
+      version = "0.131.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.130.0.tgz";
-        sha512 = "fWqLRMOZ2aXuMrVns6kVX5eWTJVbrrslgQA9aZESMysR/P6eVVnBAcB948YMDHAZB9EeFGBzxCJCdCGdF3VVUQ==";
+        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.131.0.tgz";
+        sha512 = "XDR0udjVD1t16DZKT3Bx0oFa/qnDjv9KSJRmzUxcTzU2QzcLJ3nv3mi/E7AObUGOvXsKgKRSdsFyWoMcPGb5cQ==";
       };
     };
-    "n8n-design-system-0.30.0" = {
+    "n8n-design-system-0.31.0" = {
       name = "n8n-design-system";
       packageName = "n8n-design-system";
-      version = "0.30.0";
+      version = "0.31.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-design-system/-/n8n-design-system-0.30.0.tgz";
-        sha512 = "ZZRGms10PjTGzw7W8UPe5MXKuJ9eMZr+z9+mO7jywQg1ADzG+JCIgAcdad2II/V46nM4hkilGk0EI+IaBg0R/g==";
+        url = "https://registry.npmjs.org/n8n-design-system/-/n8n-design-system-0.31.0.tgz";
+        sha512 = "RvE18Fv4tzvsuDZwszWuEodzVoHcKVxYdAA57qIKZyxLbwtLYe2MoBtmOeKlQBvYaZBIwxLFbPnm2fZvIfMdsA==";
       };
     };
-    "n8n-editor-ui-0.156.0" = {
+    "n8n-editor-ui-0.157.0" = {
       name = "n8n-editor-ui";
       packageName = "n8n-editor-ui";
-      version = "0.156.0";
+      version = "0.157.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.156.0.tgz";
-        sha512 = "otgW18usDm9pD4Zz6JADNFhb3iMRjcHHcgv897uvk7oZC9nHr9VAQry0bOCMvO4bm3oJug37KkM6eNm02EY+tg==";
+        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.157.0.tgz";
+        sha512 = "SzS6xCIa7D1nDnvV0p6OOOc2s9gxuJNkQ3UzWw3VG6C5vtsBhpKDsUZ2BKlCLip2jLZgeNAFHCmttSmXHmm9Lg==";
       };
     };
-    "n8n-nodes-base-0.188.0" = {
+    "n8n-nodes-base-0.189.0" = {
       name = "n8n-nodes-base";
       packageName = "n8n-nodes-base";
-      version = "0.188.0";
+      version = "0.189.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.188.0.tgz";
-        sha512 = "+R15NaRM9H767h7D/kwsQCpXhxmNQDMr3LMwhwPrUAXKGTZbk9YLZWhMlQaewhjGgQV69qo94OS9/Wb2FkvzMg==";
+        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.189.0.tgz";
+        sha512 = "8Xdbtz26wpvO5MguARdc/vOflmKyOCazV9rt9OMsT6HJLTFq1U4xgEw85VWB9GQJPbDvXPRPqilTedKgM9POlw==";
       };
     };
-    "n8n-workflow-0.112.0" = {
+    "n8n-workflow-0.113.0" = {
       name = "n8n-workflow";
       packageName = "n8n-workflow";
-      version = "0.112.0";
+      version = "0.113.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.112.0.tgz";
-        sha512 = "6HE3WP4kMdifNJ0plmcye1VU4PKbxlUXr5wIF/74M5M+yLusoMJn2kSLEQ4KO50WYwByl8qttXBbBIjrkM8lNw==";
+        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.113.0.tgz";
+        sha512 = "ajeZR9etpx9Tjy10X/bbmKYEBp8edUMUrUTL5qLmQLEODoua/NV7C7NCZwlVUtsTbIeTq9Osas2tYhDI74Cubw==";
       };
     };
     "named-placeholders-1.1.2" = {
@@ -5611,13 +5620,13 @@ let
         sha512 = "KUdDsspqx89sD4UUyUKzdlUOper3hRkDVkrKh/89G+d9WKsU5ox51NWS4tB1XR5dPUdR4SP0E3molyEfOvSa3g==";
       };
     };
-    "nodemailer-6.7.7" = {
+    "nodemailer-6.7.8" = {
       name = "nodemailer";
       packageName = "nodemailer";
-      version = "6.7.7";
+      version = "6.7.8";
       src = fetchurl {
-        url = "https://registry.npmjs.org/nodemailer/-/nodemailer-6.7.7.tgz";
-        sha512 = "pOLC/s+2I1EXuSqO5Wa34i3kXZG3gugDssH+ZNCevHad65tc8vQlCQpOLaUjopvkRQKm2Cki2aME7fEOPRy3bA==";
+        url = "https://registry.npmjs.org/nodemailer/-/nodemailer-6.7.8.tgz";
+        sha512 = "2zaTFGqZixVmTxpJRCFC+Vk5eGRd/fYtvIR+dl5u9QXLTQWGIf48x/JXvo58g9sa0bU6To04XUv554Paykum3g==";
       };
     };
     "nopt-5.0.0" = {
@@ -5728,13 +5737,13 @@ let
         sha512 = "EFVjAYfzWqWsBMRHPMAXLCDIJnpMhdWAqR7xG6M6a2cs6PMFpl/+Z20w9zDW4vkxOFfddegBKq9Rehd0bxWE7A==";
       };
     };
-    "object.assign-4.1.3" = {
+    "object.assign-4.1.4" = {
       name = "object.assign";
       packageName = "object.assign";
-      version = "4.1.3";
+      version = "4.1.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/object.assign/-/object.assign-4.1.3.tgz";
-        sha512 = "ZFJnX3zltyjcYJL0RoCJuzb+11zWGyaDbjgxZbdV7rFEcHQuYxrZqhow67aA7xpes6LhojyFDaBKAFfogQrikA==";
+        url = "https://registry.npmjs.org/object.assign/-/object.assign-4.1.4.tgz";
+        sha512 = "1mxKf0e58bvyjSCtKYY4sRe9itRk3PJpquJOjeIkz885CczcI4IvJJDLPS72oowuSh+pBxUFROpX+TU++hxhZQ==";
       };
     };
     "object.getownpropertydescriptors-2.1.4" = {
@@ -8752,13 +8761,13 @@ let
         sha512 = "xl/50/Cf32VsGq/1R8jJE5ajH1yMCQkpmoS10QbFZWl2Oor4H0Me64Pu2yxvsRWK3m6soJbmGfzSR7BYmDcWAA==";
       };
     };
-    "xss-1.0.13" = {
+    "xss-1.0.14" = {
       name = "xss";
       packageName = "xss";
-      version = "1.0.13";
+      version = "1.0.14";
       src = fetchurl {
-        url = "https://registry.npmjs.org/xss/-/xss-1.0.13.tgz";
-        sha512 = "clu7dxTm1e8Mo5fz3n/oW3UCXBfV89xZ72jM8yzo1vR/pIS0w3sgB3XV2H8Vm6zfGnHL0FzvLJPJEBhd86/z4Q==";
+        url = "https://registry.npmjs.org/xss/-/xss-1.0.14.tgz";
+        sha512 = "og7TEJhXvn1a7kzZGQ7ETjdQVS2UfZyTlsEdDOqvQF7GoxNfY+0YLCzBy1kPdsDDx4QuNAonQPddpsn6Xl/7sw==";
       };
     };
     "xtend-4.0.2" = {
@@ -8929,10 +8938,10 @@ in
   n8n = nodeEnv.buildNodePackage {
     name = "n8n";
     packageName = "n8n";
-    version = "0.190.0";
+    version = "0.191.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/n8n/-/n8n-0.190.0.tgz";
-      sha512 = "FsvOBZL1FsFuZp9ut6+s97t/Oz5MAIpqNsS/Pdh4ZmJz5XoiTYn1UchlGF4NziUYzvWmdEV96uxo1IU/i8VtSw==";
+      url = "https://registry.npmjs.org/n8n/-/n8n-0.191.0.tgz";
+      sha512 = "HnnhsQqWcx4azUB9DZHtdT+nJBr7gWEr5c/sr7PFrcZwLoF1fW8ydxTGj6weyl62GggrE+RBR4MuKRVRNY7hcg==";
     };
     dependencies = [
       sources."@apidevtools/json-schema-ref-parser-8.0.0"
@@ -8967,6 +8976,7 @@ in
           sources."universalify-0.1.2"
         ];
       })
+      sources."@azure/core-http-compat-1.3.0"
       (sources."@azure/core-lro-2.2.5" // {
         dependencies = [
           sources."tslib-2.4.0"
@@ -9002,9 +9012,8 @@ in
           sources."tslib-2.4.0"
         ];
       })
-      (sources."@azure/keyvault-keys-4.4.0" // {
+      (sources."@azure/keyvault-keys-4.5.0" // {
         dependencies = [
-          sources."@azure/core-tracing-1.0.0-preview.13"
           sources."tslib-2.4.0"
         ];
       })
@@ -9041,7 +9050,7 @@ in
           sources."string_decoder-0.10.31"
         ];
       })
-      sources."@js-joda/core-5.2.0"
+      sources."@js-joda/core-5.3.0"
       sources."@jsdevtools/ono-7.1.3"
       sources."@kafkajs/confluent-schema-registry-1.0.6"
       sources."@kwsites/file-exists-1.1.1"
@@ -9057,7 +9066,7 @@ in
           sources."tslib-2.4.0"
         ];
       })
-      (sources."@oclif/core-1.13.10" // {
+      (sources."@oclif/core-1.14.1" // {
         dependencies = [
           (sources."chalk-4.1.2" // {
             dependencies = [
@@ -9116,13 +9125,13 @@ in
       sources."@types/json-diff-0.5.2"
       sources."@types/json-schema-7.0.11"
       sources."@types/jsonwebtoken-8.5.8"
-      sources."@types/lodash-4.14.182"
+      sources."@types/lodash-4.14.183"
       sources."@types/lodash.intersection-4.4.7"
       sources."@types/lossless-json-1.0.1"
       sources."@types/mime-3.0.1"
       sources."@types/minimatch-3.0.5"
       sources."@types/multer-1.4.7"
-      sources."@types/node-18.6.5"
+      sources."@types/node-18.7.6"
       (sources."@types/node-fetch-2.6.2" // {
         dependencies = [
           sources."form-data-3.0.1"
@@ -9162,7 +9171,7 @@ in
       sources."ansicolors-0.3.2"
       sources."any-promise-1.3.0"
       sources."anymatch-3.1.2"
-      sources."app-root-path-3.0.0"
+      sources."app-root-path-3.1.0"
       sources."append-field-1.0.0"
       sources."aproba-2.0.0"
       (sources."are-we-there-yet-2.0.0" // {
@@ -9197,8 +9206,8 @@ in
         ];
       })
       sources."available-typed-arrays-1.0.5"
-      sources."avsc-5.7.4"
-      (sources."aws-sdk-2.1191.0" // {
+      sources."avsc-5.7.5"
+      (sources."aws-sdk-2.1196.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."events-1.1.1"
@@ -9705,7 +9714,7 @@ in
           sources."iconv-lite-0.6.3"
         ];
       })
-      sources."libphonenumber-js-1.10.11"
+      sources."libphonenumber-js-1.10.12"
       sources."libqp-1.1.0"
       sources."limiter-1.1.5"
       sources."linkify-it-4.0.0"
@@ -9836,15 +9845,15 @@ in
         ];
       })
       sources."mz-2.7.0"
-      sources."n8n-core-0.130.0"
-      sources."n8n-design-system-0.30.0"
-      sources."n8n-editor-ui-0.156.0"
-      (sources."n8n-nodes-base-0.188.0" // {
+      sources."n8n-core-0.131.0"
+      sources."n8n-design-system-0.31.0"
+      sources."n8n-editor-ui-0.157.0"
+      (sources."n8n-nodes-base-0.189.0" // {
         dependencies = [
           sources."iconv-lite-0.6.3"
         ];
       })
-      sources."n8n-workflow-0.112.0"
+      sources."n8n-workflow-0.113.0"
       (sources."named-placeholders-1.1.2" // {
         dependencies = [
           sources."lru-cache-4.1.5"
@@ -9877,7 +9886,7 @@ in
       sources."node-html-parser-5.4.1"
       sources."node-ssh-12.0.5"
       sources."nodeify-1.0.1"
-      sources."nodemailer-6.7.7"
+      sources."nodemailer-6.7.8"
       sources."nopt-5.0.0"
       sources."normalize-path-3.0.0"
       sources."normalize-wheel-1.0.1"
@@ -9889,7 +9898,7 @@ in
       sources."object-inspect-1.12.2"
       sources."object-keys-1.1.1"
       sources."object-treeify-1.1.33"
-      sources."object.assign-4.1.3"
+      sources."object.assign-4.1.4"
       sources."object.getownpropertydescriptors-2.1.4"
       sources."on-finished-2.4.1"
       sources."on-headers-1.0.2"
@@ -10375,7 +10384,7 @@ in
       sources."xml2js-0.4.23"
       sources."xmlbuilder-11.0.1"
       sources."xregexp-2.0.0"
-      (sources."xss-1.0.13" // {
+      (sources."xss-1.0.14" // {
         dependencies = [
           sources."commander-2.20.3"
         ];

pkgs/applications/science/chemistry/jmol/default.nix

@@ -25,14 +25,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "14.32.66";
+  version = "14.32.68";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-6L5hsJKiLnFKBtLJZnNxmnVcZTdu8Pmj5Md5QIoRxdU=";
+    sha256 = "sha256-CCVy+24O5rlAxnd01TeYqcOhDoSrxebfR1Ez7VDDrW4=";
   };
 
   patchPhase = ''

pkgs/applications/science/electronics/pulseview/default.nix

@@ -1,15 +1,15 @@
 { mkDerivation, lib, fetchurl, fetchpatch, pkg-config, cmake, glib, boost, libsigrok
 , libsigrokdecode, libserialport, libzip, udev, libusb1, libftdi1, glibmm
-, pcre, librevisa, python3, qtbase, qtsvg
+, pcre, librevisa, python3, qtbase, qtsvg, qttools
 }:
 
 mkDerivation rec {
   pname = "pulseview";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchurl {
     url = "https://sigrok.org/download/source/pulseview/${pname}-${version}.tar.gz";
-    sha256 = "0bvgmkgz37n2bi9niskpl05hf7rsj1lj972fbrgnlz25s4ywxrwy";
+    sha256 = "1jxbpz1h3m1mgrxw74rnihj8vawgqdpf6c33cqqbyd8v7rxgfhph";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -17,7 +17,7 @@ mkDerivation rec {
   buildInputs = [
     glib boost libsigrok libsigrokdecode libserialport libzip udev libusb1 libftdi1 glibmm
     pcre librevisa python3
-    qtbase qtsvg
+    qtbase qtsvg qttools
   ];
 
   patches = [

pkgs/applications/science/logic/alt-ergo/default.nix

@@ -2,28 +2,30 @@
 
 let
   pname = "alt-ergo";
-  version = "2.4.1";
+  version = "2.4.2";
+
+  configureScript = "ocaml unix.cma configure.ml";
 
   src = fetchFromGitHub {
     owner = "OCamlPro";
     repo = pname;
     rev = version;
-    sha256 = "0hglj1p0753w2isds01h90knraxa42d2jghr35dpwf9g8a1sm9d3";
+    sha256 = "sha256-8pJ/1UAbheQaLFs5Uubmmf5D0oFJiPxF6e2WTZgRyAc=";
   };
 in
 
 let alt-ergo-lib = ocamlPackages.buildDunePackage rec {
   pname = "alt-ergo-lib";
-  inherit version src;
+  inherit version src configureScript;
   configureFlags = [ pname ];
   nativeBuildInputs = [ which ];
   buildInputs = with ocamlPackages; [ dune-configurator ];
-  propagatedBuildInputs = with ocamlPackages; [ num ocplib-simplex stdlib-shims zarith ];
+  propagatedBuildInputs = with ocamlPackages; [ num ocplib-simplex seq stdlib-shims zarith ];
 }; in
 
 let alt-ergo-parsers = ocamlPackages.buildDunePackage rec {
   pname = "alt-ergo-parsers";
-  inherit version src;
+  inherit version src configureScript;
   configureFlags = [ pname ];
   nativeBuildInputs = [ which ocamlPackages.menhir ];
   propagatedBuildInputs = [ alt-ergo-lib ] ++ (with ocamlPackages; [ camlzip psmt2-frontend ]);
@@ -31,18 +33,12 @@ let alt-ergo-parsers = ocamlPackages.buildDunePackage rec {
 
 ocamlPackages.buildDunePackage {
 
-  inherit pname version src;
-
-  # Ensure compatibility with Menhir ≥ 20211215
-  patches = fetchpatch {
-    url = "https://github.com/OCamlPro/alt-ergo/commit/0f9c45af352657c3aec32fca63d11d44f5126df8.patch";
-    sha256 = "sha256:0zaj3xbk2s8k8jl0id3nrhdfq9mv0n378cbawwx3sziiizq7djbg";
-  };
+  inherit pname version src configureScript;
 
   configureFlags = [ pname ];
 
   nativeBuildInputs = [ which ocamlPackages.menhir ];
-  buildInputs = [ alt-ergo-parsers ocamlPackages.cmdliner ];
+  buildInputs = [ alt-ergo-parsers ocamlPackages.cmdliner_1_1 ];
 
   meta = {
     description = "High-performance theorem prover and SMT solver";

pkgs/applications/search/recoll/default.nix

@@ -35,11 +35,11 @@
 
 mkDerivation rec {
   pname = "recoll";
-  version = "1.32.5";
+  version = "1.32.7";
 
   src = fetchurl {
     url = "https://www.lesbonscomptes.com/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-UvRpJkapN9nXHy3TY7SVdZ/sy8f3QCHkg3/FM0oP9VY=";
+    sha256 = "sha256-ygim9LsLUZv5FaBiqbeq3E80NHPMHweJVwggjWYzfbo=";
   };
 
   configureFlags = [ "--enable-recollq" "--disable-webkit" "--without-systemd" ]

pkgs/applications/version-management/git-and-tools/git-cliff/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-cliff";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "git-cliff";
     rev = "v${version}";
-    sha256 = "sha256-lRONRLTByhMalN9BKilCcQn2c9f4cxOnHJLL0l0jaOs=";
+    sha256 = "sha256-xmpT4xzajarc/1Iu0GqLthQlh0N9tJ1LdqJXrB4EN9Q=";
   };
 
-  cargoSha256 = "sha256-1r/k3DQ/vjIjMpOHYCRRosbZ22iAFkuq4EbZUcZoWn0=";
+  cargoSha256 = "sha256-f4tB37WiHompXjXqdVy+dNEIn5rhNqda8JTSVUOOlcE=";
 
   # attempts to run the program on .git in src which is not deterministic
   doCheck = false;

pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-vkcapture";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchFromGitHub {
     owner = "nowrep";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-eZbZBff/M0S9VASiKoGJAqZ6NMADH7uH8J0m6XGY3jY=";
+    hash = "sha256-TNXoeNktMde7GfFhZRHXlARdnkJTY4oNZTKA4hu7e3Q=";
   };
 
   nativeBuildInputs = [ cmake ninja ];

pkgs/applications/virtualization/docker/buildx.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-buildx";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "buildx";
     rev = "v${version}";
-    sha256 = "sha256-AGRdmYKd76k5tmBTTqsSHj3yOU8QSd11G5ito0O/dWY=";
+    sha256 = "sha256-fWtPoOUI5tgY9Xsf/FAZPlaagC5FR5FBHysWv788Pik=";
   };
 
   vendorSha256 = null;

pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix

@@ -22,8 +22,10 @@
 # /lib will link to /lib32
 
 let
-  is64Bit = stdenv.hostPlatform.parsed.cpu.bits == 64;
-  isMultiBuild  = multiPkgs != null && is64Bit;
+  inherit (stdenv) is64bit;
+
+  # use of glibc_multi is only supported on x86_64-linux
+  isMultiBuild  = multiPkgs != null && stdenv.isx86_64 && stdenv.isLinux;
   isTargetBuild = !isMultiBuild;
 
   # list of packages (usually programs) which are only be installed for the
@@ -139,7 +141,7 @@ let
   setupLibDirsTarget = ''
     # link content of targetPaths
     cp -rsHf ${staticUsrProfileTarget}/lib lib
-    ln -s lib lib${if is64Bit then "64" else "32"}
+    ln -s lib lib${if is64bit then "64" else "32"}
   '';
 
   # setup /lib, /lib32 and /lib64

pkgs/build-support/docker/default.nix

@@ -205,6 +205,7 @@ rec {
     , fromImageName ? null
     , fromImageTag ? null
     , diskSize ? 1024
+    , buildVMMemorySize ? 512
     , preMount ? ""
     , postMount ? ""
     , postUmount ? ""
@@ -218,6 +219,7 @@ rec {
               destination = "./image";
             };
             inherit fromImage fromImageName fromImageTag;
+            memSize = buildVMMemorySize;
 
             nativeBuildInputs = [ util-linux e2fsprogs jshon rsync jq ];
           } ''
@@ -407,6 +409,8 @@ rec {
       fromImageTag ? null
     , # How much disk to allocate for the temporary virtual machine.
       diskSize ? 1024
+    , # How much memory to allocate for the temporary virtual machine.
+      buildVMMemorySize ? 512
     , # Commands (bash) to run on the layer; these do not require sudo.
       extraCommands ? ""
     }:
@@ -418,7 +422,7 @@ rec {
     runWithOverlay {
       name = "docker-layer-${name}";
 
-      inherit fromImage fromImageName fromImageTag diskSize;
+      inherit fromImage fromImageName fromImageTag diskSize buildVMMemorySize;
 
       preMount = lib.optionalString (copyToRoot != null && copyToRoot != [ ]) ''
         echo "Adding contents..."
@@ -517,6 +521,8 @@ rec {
       runAsRoot ? null
     , # Size of the virtual machine disk to provision when building the image.
       diskSize ? 1024
+    , # Size of the virtual machine memory to provision when building the image.
+      buildVMMemorySize ? 512
     , # Time of creation of the image.
       created ? "1970-01-01T00:00:01Z"
     , # Deprecated.
@@ -563,7 +569,7 @@ rec {
           mkRootLayer {
             name = baseName;
             inherit baseJson fromImage fromImageName fromImageTag
-              keepContentsDirlinks runAsRoot diskSize
+              keepContentsDirlinks runAsRoot diskSize buildVMMemorySize
               extraCommands;
             copyToRoot = rootContents;
           };

pkgs/data/icons/numix-icon-theme-circle/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "22.08.07";
+  version = "22.08.15";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nYRiAp8cHDyWGlb/s6ysiI2w2Oo7yj1HnKPo0EOqvhY=";
+    sha256 = "sha256-2Ay5wykXuXKwcGFvFKu6SIFKdWFMdBvHwgSrqNCszMM=";
   };
 
   nativeBuildInputs = [ gtk3 ];

pkgs/data/icons/numix-icon-theme-square/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-square";
-  version = "22.08.07";
+  version = "22.08.15";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-AWDahl9DUAEYY7OW9E323LOdM37INcAbEXA19FYRObE=";
+    sha256 = "sha256-VJsxZFzraCQPNr/zS7ElPk52Tq5YHrFxaQJMUuHcnLw=";
   };
 
   nativeBuildInputs = [ gtk3 ];

pkgs/data/misc/wireless-regdb/default.nix

@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenvNoCC, fetchurl }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "wireless-regdb";
-  version = "2022.06.06";
+  version = "2022.08.12";
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-rAD5fv7M5QRu0GnR2T8zZf35lMfHhUqPxQgx6VlTcjA=";
+    sha256 = "sha256-Wcj30Xlm23Gyf5DnNe6PW0LKNSdpSoxebptWvTecO4Q=";
   };
 
   dontBuild = true;

pkgs/development/compilers/hip/default.nix

@@ -1,9 +1,7 @@
 { stdenv
 , binutils-unwrapped
 , clang
-, clang-unwrapped
 , cmake
-, compiler-rt
 , fetchFromGitHub
 , fetchpatch
 , file
@@ -11,7 +9,6 @@
 , libglvnd
 , libX11
 , libxml2
-, lld
 , llvm
 , makeWrapper
 , numactl
@@ -31,13 +28,13 @@
 let
   hip = stdenv.mkDerivation rec {
     pname = "hip";
-    version = "5.1.1";
+    version = "5.2.1";
 
     src = fetchFromGitHub {
       owner = "ROCm-Developer-Tools";
       repo = "HIP";
       rev = "rocm-${version}";
-      hash = "sha256-/kIZrbzq1u1pIs1jlmRYZNUGteqVQTI4TlXsHsVIUKE=";
+      hash = "sha256-aXI55bdhAuPUEdQZukKAdtLWA+8UIxjPJ4LTamR/ENk=";
     };
 
     # - fix bash paths
@@ -63,8 +60,9 @@ let
           -e 's,^\($HIP_COMPILER=\).*$,\1"clang";,' \
           -e 's,^\($HIP_RUNTIME=\).*$,\1"ROCclr";,' \
           -e 's,^\([[:space:]]*$HSA_PATH=\).*$,\1"${rocm-runtime}";,'g \
-          -e 's,^\([[:space:]]*\)$HIP_CLANG_INCLUDE_PATH = abs_path("$HIP_CLANG_PATH/../lib/clang/$HIP_CLANG_VERSION/include");,\1$HIP_CLANG_INCLUDE_PATH = "${clang-unwrapped}/lib/clang/$HIP_CLANG_VERSION/include";,' \
+          -e 's,^\([[:space:]]*\)$HIP_CLANG_INCLUDE_PATH = abs_path("$HIP_CLANG_PATH/../lib/clang/$HIP_CLANG_VERSION/include");,\1$HIP_CLANG_INCLUDE_PATH = "${llvm}/lib/clang/$HIP_CLANG_VERSION/include";,' \
           -e 's,^\([[:space:]]*$HIPCXXFLAGS .= " -isystem \\"$HIP_CLANG_INCLUDE_PATH/..\\"\)";,\1 -isystem ${rocm-runtime}/include";,' \
+          -e 's,$HIP_CLANG_PATH/../lib/clang/$HIP_CLANG_VERSION,$HIP_CLANG_PATH/../resource-root,g' \
           -e 's,`file,`${file}/bin/file,g' \
           -e 's,`readelf,`${binutils-unwrapped}/bin/readelf,' \
           -e 's, ar , ${binutils-unwrapped}/bin/ar ,g' \
@@ -102,21 +100,19 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "hip";
-  version = "5.1.1";
+  version = "5.2.1";
 
   src = fetchFromGitHub {
     owner = "ROCm-Developer-Tools";
     repo = "hipamd";
     rev = "rocm-${version}";
-    hash = "sha256-TuCMRJb6G/bhD8hG6Ot7MIkgBoShjVboeXrlGh9eYpQ=";
+    hash = "sha256-YsvM+HjoBiukXAMCdE/dpQNMnpP6XRXDuxV1487rok0=";
   };
 
   nativeBuildInputs = [ cmake python3 makeWrapper perl ];
   buildInputs = [ libxml2 numactl libglvnd libX11 ];
   propagatedBuildInputs = [
     clang
-    compiler-rt
-    lld
     llvm
     rocm-comgr
     rocm-device-libs
@@ -139,15 +135,37 @@ stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    wrapProgram $out/bin/hipcc --set HIP_PATH $out --set HSA_PATH ${rocm-runtime} --set HIP_CLANG_PATH ${clang}/bin --prefix PATH : ${lld}/bin --set NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt} 1 --prefix NIX_LDFLAGS ' ' -L${compiler-rt}/lib --prefix NIX_LDFLAGS_FOR_TARGET ' ' -L${compiler-rt}/lib --add-flags "-nogpuinc"
+    patchShebangs $out/bin
+    wrapProgram $out/bin/hipcc --set HIP_PATH $out --set HSA_PATH ${rocm-runtime} --set HIP_CLANG_PATH ${clang}/bin --prefix PATH : ${llvm}/bin --set ROCM_PATH $out
     wrapProgram $out/bin/hipconfig --set HIP_PATH $out --set HSA_PATH ${rocm-runtime} --set HIP_CLANG_PATH ${clang}/bin
   '';
 
   passthru.updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl jq common-updater-scripts
+    #!nix-shell -i bash -p curl jq common-updater-scripts nix-prefetch-github
+    version="$(curl -sL "https://api.github.com/repos/ROCm-Developer-Tools/HIP/tags" | jq '.[].name | split("-") | .[1] | select( . != null )' --raw-output | sort -n | tail -1)"
+    current_version="$(grep "version =" pkgs/development/compilers/hip/default.nix | head -n1 | cut -d'"' -f2)"
+    if [[ "$version" != "$current_version" ]]; then
+      tarball_meta="$(nix-prefetch-github ROCm-Developer-Tools HIP --rev "rocm-$version")"
+      tarball_hash="$(nix to-base64 sha256-$(jq -r '.sha256' <<< "$tarball_meta"))"
+      sed -i -z "pkgs/development/compilers/hip/default.nix" \
+        -e 's,version = "[^'"'"'"]*",version = "'"$version"'",1' \
+        -e 's,hash = "[^'"'"'"]*",hash = "sha256-'"$tarball_hash"'",1'
+    else
+      echo hip already up-to-date
+    fi
+
     version="$(curl -sL "https://api.github.com/repos/ROCm-Developer-Tools/hipamd/tags" | jq '.[].name | split("-") | .[1] | select( . != null )' --raw-output | sort -n | tail -1)"
-    update-source-version hip "$version"
+    current_version="$(grep "version =" pkgs/development/compilers/hip/default.nix | tail -n1 | cut -d'"' -f2)"
+    if [[ "$version" != "$current_version" ]]; then
+      tarball_meta="$(nix-prefetch-github ROCm-Developer-Tools hipamd --rev "rocm-$version")"
+      tarball_hash="$(nix to-base64 sha256-$(jq -r '.sha256' <<< "$tarball_meta"))"
+      sed -i -z "pkgs/development/compilers/hip/default.nix" \
+        -e 's,version = "[^'"'"'"]*",version = "'"$version"'",2' \
+        -e 's,hash = "[^'"'"'"]*",hash = "sha256-'"$tarball_hash"'",2'
+    else
+      echo hipamd already up-to-date
+    fi
   '';
 
   meta = with lib; {

pkgs/development/compilers/llvm/rocm/clang.nix

@@ -1,72 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, cmake
-, python3
-, llvm
-, clang-tools-extra_src ? null
-, lld
-
-, version
-, src
-}:
-
-stdenv.mkDerivation rec {
-  inherit version src;
-
-  pname = "clang";
-
-  nativeBuildInputs = [ cmake python3 ];
-
-  buildInputs = [ llvm ];
-
-  hardeningDisable = [ "all" ];
-
-  cmakeFlags = [
-    "-DLLVM_CMAKE_PATH=${llvm}/lib/cmake/llvm"
-    "-DLLVM_MAIN_SRC_DIR=${llvm.src}"
-    "-DCLANG_SOURCE_DIR=${src}"
-    "-DLLVM_ENABLE_RTTI=ON"
-  ];
-
-  VCSVersion = ''
-    #undef LLVM_REVISION
-    #undef LLVM_REPOSITORY
-    #undef CLANG_REVISION
-    #undef CLANG_REPOSITORY
-  '';
-
-  postUnpack = lib.optionalString (!(isNull clang-tools-extra_src)) ''
-    ln -s ${clang-tools-extra_src} $sourceRoot/tools/extra
-  '';
-
-  # Rather than let cmake extract version information from LLVM or
-  # clang source control repositories, we generate the wanted
-  # `VCSVersion.inc` file ourselves and remove it from the
-  # depencencies of the `clangBasic` target.
-  preConfigure = ''
-    sed 's/  ''${version_inc}//' -i lib/Basic/CMakeLists.txt
-    sed 's|sys::path::parent_path(BundlerExecutable)|StringRef("${llvm}/bin")|' -i tools/clang-offload-bundler/ClangOffloadBundler.cpp
-    sed 's|\([[:space:]]*std::string Linker = \)getToolChain().GetProgramPath(getShortName())|\1"${lld}/bin/ld.lld"|' -i lib/Driver/ToolChains/AMDGPU.cpp
-    substituteInPlace lib/Driver/ToolChains/AMDGPU.h --replace ld.lld ${lld}/bin/ld.lld
-    sed 's|configure_file(AST/gen_ast_dump_json_test.py ''${LLVM_TOOLS_BINARY_DIR}/gen_ast_dump_json_test.py COPYONLY)||' -i test/CMakeLists.txt
-  '';
-
-  postConfigure = ''
-    mkdir -p lib/Basic
-    echo "$VCSVersion" > lib/Basic/VCSVersion.inc
-  '';
-
-  passthru = {
-    isClang = true;
-    inherit llvm;
-  };
-
-  meta = with lib; {
-    description = "ROCm fork of the clang C/C++/Objective-C/Objective-C++ LLVM compiler frontend";
-    homepage = "https://llvm.org/";
-    license = with licenses; [ ncsa ];
-    maintainers = with maintainers; [ acowley lovesegfault ];
-    platforms = platforms.linux;
-  };
-}

pkgs/development/compilers/llvm/rocm/compiler-rt/default.nix

@@ -1,64 +0,0 @@
-{ stdenv, lib, version, src, cmake, python3, llvm, libcxxabi, fetchpatch }:
-stdenv.mkDerivation rec {
-  pname = "compiler-rt";
-  inherit version src;
-
-  nativeBuildInputs = [ cmake python3 llvm ];
-
-  NIX_CFLAGS_COMPILE = [
-    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-  ];
-
-  cmakeFlags = [
-    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
-    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
-    "-DCOMPILER_RT_BUILD_XRAY=OFF"
-    "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
-    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
-    "-DCMAKE_C_COMPILER_WORKS=ON"
-    "-DCMAKE_CXX_COMPILER_WORKS=ON"
-    "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
-    "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-    "-DCOMPILER_RT_BUILD_BUILTINS=ON"
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
-    #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
-    "-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY"
-  ];
-
-  outputs = [ "out" "dev" ];
-
-  prePatch = ''
-    cd compiler-rt
-  '';
-
-  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
-  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
-  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
-  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
-  # a flag and turn the flag off during the stdenv build.
-  postPatch = lib.optionalString (!stdenv.isDarwin) ''
-    substituteInPlace cmake/builtin-config-ix.cmake \
-      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
-  '';
-
-  # Hack around weird upsream RPATH bug
-  postInstall = ''
-    ln -s "$out/lib"/*/* "$out/lib"
-    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbegin.o
-    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtend.o
-    ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/crtbeginS.o
-    ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/crtendS.o
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "ROCm fork of the LLVM Compiler runtime libraries";
-    homepage = "https://github.com/RadeonOpenCompute/llvm-project";
-    license = licenses.ncsa;
-    maintainers = with maintainers; [ acowley lovesegfault ];
-    platforms = platforms.linux;
-  };
-}

pkgs/development/compilers/llvm/rocm/default.nix

@@ -1,32 +1,36 @@
 { stdenv, lib, buildPackages, fetchFromGitHub, callPackage, wrapCCWith, overrideCC }:
 
 let
-  version = "5.1.1";
+  version = "5.2.1";
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "llvm-project";
     rev = "rocm-${version}";
-    hash = "sha256-5SGIWiyfHvfwIUc4bhdWrlhBfK5ssA7tm5r3zKdr3kg=";
+    hash = "sha256-sudH8hnjReyuCFm2CBEPd8W88SjAARgCd1MTIJaDjTI=";
   };
 in rec {
   clang = wrapCCWith rec {
-    cc = clang-unwrapped;
+    cc = llvm;
     extraBuildCommands = ''
       clang_version=`${cc}/bin/clang -v 2>&1 | grep "clang version " | grep -E -o "[0-9.-]+"`
       rsrc="$out/resource-root"
       mkdir "$rsrc"
       ln -s "${cc}/lib/clang/$clang_version/include" "$rsrc"
-      ln -s "${compiler-rt}/lib" "$rsrc/lib"
+      ln -s "${cc}/lib/clang/$clang_version/lib" "$rsrc/lib"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
       echo "--gcc-toolchain=${stdenv.cc.cc}" >> $out/nix-support/cc-cflags
-      echo "-Wno-unused-command-line-argument" >> $out/nix-support/cc-cflags
       rm $out/nix-support/add-hardening.sh
       touch $out/nix-support/add-hardening.sh
+      # GPU compilation uses builtin lld
+      substituteInPlace $out/bin/clang \
+        --replace '-MM) dontLink=1 ;;' $'-MM | --cuda-device-only) dontLink=1 ;;\n--cuda-host-only | --cuda-compile-host-device) dontLink=0 ;;'
+      substituteInPlace $out/bin/clang++ \
+        --replace '-MM) dontLink=1 ;;' $'-MM | --cuda-device-only) dontLink=1 ;;\n--cuda-host-only | --cuda-compile-host-device) dontLink=0 ;;'
     '';
   };
 
   clangNoCompilerRt = wrapCCWith rec {
-    cc = clang-unwrapped;
+    cc = llvm;
     extraBuildCommands = ''
       clang_version=`${cc}/bin/clang -v 2>&1 | grep "clang version " | grep -E -o "[0-9.-]+"`
       rsrc="$out/resource-root"
@@ -34,28 +38,17 @@ in rec {
       ln -s "${cc}/lib/clang/$clang_version/include" "$rsrc"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
       echo "--gcc-toolchain=${stdenv.cc.cc}" >> $out/nix-support/cc-cflags
-      echo "-Wno-unused-command-line-argument" >> $out/nix-support/cc-cflags
       rm $out/nix-support/add-hardening.sh
       touch $out/nix-support/add-hardening.sh
+      # GPU compilation uses builtin lld
+      substituteInPlace $out/bin/clang \
+        --replace '-MM) dontLink=1 ;;' $'-MM | --cuda-device-only) dontLink=1 ;;\n--cuda-host-only | --cuda-compile-host-device) dontLink=0 ;;'
+      substituteInPlace $out/bin/clang++ \
+        --replace '-MM) dontLink=1 ;;' $'-MM | --cuda-device-only) dontLink=1 ;;\n--cuda-host-only | --cuda-compile-host-device) dontLink=0 ;;'
     '';
   };
 
-  clang-unwrapped = callPackage ./clang.nix {
-    inherit lld llvm version;
-    src = "${src}/clang";
-  };
-
-  compiler-rt = callPackage ./compiler-rt {
-    inherit version llvm;
-    inherit src;
-    stdenv = overrideCC stdenv clangNoCompilerRt;
-  };
-
-  lld = callPackage ./lld.nix {
-    inherit llvm src version;
-  };
-
-  llvm = callPackage ./llvm {
+  llvm = callPackage ./llvm.nix {
     inherit src version;
   };
 }

pkgs/development/compilers/llvm/rocm/install-symlinks.patch

@@ -0,0 +1,23 @@
+diff --git a/llvm/cmake/modules/LLVMInstallSymlink.cmake b/llvm/cmake/modules/LLVMInstallSymlink.cmake
+index b5c35f706cb7..ac25e40b1436 100644
+--- a/cmake/modules/LLVMInstallSymlink.cmake
++++ b/cmake/modules/LLVMInstallSymlink.cmake
+@@ -4,11 +4,16 @@
+ 
+ include(GNUInstallDirs)
+ 
++set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_LIST_DIR}/../../../cmake/Modules" ${CMAKE_MODULE_PATH})
++include(ExtendPath)
++
+ function(install_symlink name target outdir)
+   set(DESTDIR $ENV{DESTDIR})
+-  set(bindir "${DESTDIR}${CMAKE_INSTALL_PREFIX}/${outdir}")
++  message(STATUS "Creating ${name} at ${bindir} (${CMAKE_MODULE_PATH})")
++  extend_path(prefixed_outdir "${CMAKE_INSTALL_PREFIX}" "${outdir}")
++  set(bindir "${DESTDIR}${prefixed_outdir}")
+ 
+-  message(STATUS "Creating ${name}")
++  message(STATUS "Creating ${name} at ${bindir}")
+ 
+   execute_process(
+     COMMAND "${CMAKE_COMMAND}" -E create_symlink "${target}" "${name}"

pkgs/development/compilers/llvm/rocm/lld.nix

@@ -1,43 +0,0 @@
-{ stdenv
-, lib
-, cmake
-, libxml2
-, llvm
-, ninja
-
-, version
-, src
-}:
-
-stdenv.mkDerivation rec {
-  inherit version src;
-
-  sourceRoot = "${src.name}/lld";
-
-  pname = "lld";
-
-  nativeBuildInputs = [ cmake ninja ];
-
-  buildInputs = [ libxml2 llvm ];
-
-  outputs = [ "out" "dev" ];
-
-  cmakeFlags = [ "-DLLVM_MAIN_SRC_DIR=${src}/llvm" ];
-
-  postInstall = ''
-    moveToOutput include "$dev"
-    moveToOutput lib "$dev"
-
-    # Fix lld binary path for CMake.
-    substituteInPlace "$dev/lib/cmake/lld/LLDTargets-release.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/bin/lld" "$out/bin/lld"
-  '';
-
-  meta = with lib; {
-    description = "ROCm fork of the LLVM Linker";
-    homepage = "https://github.com/RadeonOpenCompute/llvm-project";
-    license = licenses.ncsa;
-    maintainers = with maintainers; [ acowley lovesegfault ];
-    platforms = platforms.linux;
-  };
-}

pkgs/development/compilers/llvm/rocm/llvm.nix

@@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchgit
 , fetchFromGitHub
 , writeScript
 , cmake
@@ -12,7 +13,6 @@
 , zlib
 , debugVersion ? false
 , enableManpages ? false
-, enableSharedLibraries ? false
 
 , version
 , src
@@ -30,28 +30,18 @@ in stdenv.mkDerivation rec {
 
   sourceRoot = "${src.name}/llvm";
 
-  outputs = [ "out" "python" ]
-    ++ lib.optional enableSharedLibraries "lib";
-
   nativeBuildInputs = [ cmake ninja python3 ];
 
-  buildInputs = [ libxml2 libffi ];
+  buildInputs = [ libxml2 ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
   cmakeFlags = with stdenv; [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON" # Needed by rustc
-    "-DLLVM_BUILD_TESTS=OFF"
-    "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
-    "-DLLVM_ENABLE_DUMP=ON"
     "-DLLVM_TARGETS_TO_BUILD=AMDGPU;${llvmNativeTarget}"
+    "-DLLVM_ENABLE_PROJECTS=clang;lld;compiler-rt"
   ]
-  ++
-  lib.optional
-    enableSharedLibraries
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ++ lib.optionals enableManpages [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
     "-DLLVM_BUILD_DOCS=ON"
@@ -61,39 +51,16 @@ in stdenv.mkDerivation rec {
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
   ];
 
+  patches = [
+    ./install-symlinks.patch
+  ];
+
   postPatch = ''
     patchShebangs lib/OffloadArch/make_generated_offload_arch_h.sh
-  '' + lib.optionalString enableSharedLibraries ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
+    substituteInPlace ../clang/cmake/modules/CMakeLists.txt \
+      --replace 'FILES_MATCHING' 'NO_SOURCE_PERMISSIONS FILES_MATCHING'
   '';
 
-  # hacky fix: created binaries need to be run before installation
-  preBuild = ''
-    mkdir -p $out/
-    ln -sv $PWD/lib $out
-  '';
-
-  postBuild = ''
-    rm -fR $out
-  '';
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
-  '';
-
-  postInstall = ''
-    moveToOutput share/opt-viewer "$python"
-  ''
-  + lib.optionalString enableSharedLibraries ''
-    moveToOutput "lib/libLLVM-*" "$lib"
-    moveToOutput "lib/libLLVM${stdenv.hostPlatform.extensions.sharedLibrary}" "$lib"
-    substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/libLLVM-" "$lib/lib/libLLVM-"
-  '';
-
-  passthru.src = src;
-
   updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell
     #!nix-shell -i bash -p curl jq common-updater-scripts nix-prefetch-github
@@ -111,11 +78,13 @@ in stdenv.mkDerivation rec {
     fi
   '';
 
+  passthru.isClang = true;
+
   meta = with lib; {
     description = "ROCm fork of the LLVM compiler infrastructure";
     homepage = "https://github.com/RadeonOpenCompute/llvm-project";
     license = with licenses; [ ncsa ];
-    maintainers = with maintainers; [ acowley lovesegfault ];
+    maintainers = with maintainers; [ acowley lovesegfault Flakebi ];
     platforms = platforms.linux;
   };
 }

pkgs/development/compilers/llvm/rocm/llvm/outputs.patch

@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,

pkgs/development/coq-modules/coq-ext-lib/default.nix

@@ -5,6 +5,7 @@ with lib; mkCoqDerivation rec {
   owner = "coq-ext-lib";
   inherit version;
   defaultVersion = with versions; switch coq.coq-version [
+    { case = range "8.11" "8.16"; out = "0.11.7"; }
     { case = range "8.8" "8.16"; out = "0.11.6"; }
     { case = range "8.8" "8.14"; out = "0.11.4"; }
     { case = range "8.8" "8.13"; out = "0.11.3"; }
@@ -12,6 +13,7 @@ with lib; mkCoqDerivation rec {
     { case = "8.6";              out = "0.9.5"; }
     { case = "8.5";              out = "0.9.4"; }
   ] null;
+  release."0.11.7".sha256 = "sha256-HkxUny0mxDDT4VouBBh8btwxGZgsb459kBufTLLnuEY=";
   release."0.11.6".sha256 = "0w6iyrdszz7zc8kaybhy3mwjain2d2f83q79xfd5di0hgdayh7q7";
   release."0.11.4".sha256 = "0yp8mhrhkc498nblvhq1x4j6i9aiidkjza4wzvrkp9p8rgx5g5y3";
   release."0.11.3".sha256 = "1w99nzpk72lffxis97k235axss5lmzhy5z3lga2i0si95mbpil42";

pkgs/development/embedded/pyocd/default.nix

@@ -0,0 +1,72 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, capstone
+, cmsis-pack-manager
+, colorama
+, intelhex
+, intervaltree
+, natsort
+, prettytable
+, pyelftools
+, pylink-square
+, pyusb
+, pyyaml
+, typing-extensions
+, stdenv
+, hidapi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pyocd";
+  version = "0.34.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-Fpa2IEsLOQ8ylGI/5D6h+22j1pvrvE9IMIyhCtyM6qU=";
+  };
+
+  patches = [
+    # https://github.com/pyocd/pyOCD/pull/1332
+    (fetchpatch {
+      name = "libusb-package-optional.patch";
+      url = "https://github.com/pyocd/pyOCD/commit/0b980cf253e3714dd2eaf0bddeb7172d14089649.patch";
+      sha256 = "sha256-B2+50VntcQELeakJbCeJdgI1iBU+h2NkXqba+LRYa/0=";
+    })
+  ];
+
+  propagatedBuildInputs = [
+    capstone
+    cmsis-pack-manager
+    colorama
+    intelhex
+    intervaltree
+    natsort
+    prettytable
+    pyelftools
+    pylink-square
+    pyusb
+    pyyaml
+    typing-extensions
+  ] ++ lib.optionals (!stdenv.isLinux) [
+    hidapi
+  ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pyocd" ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+        --replace "libusb-package>=1.0,<2.0" ""
+  '';
+
+  meta = with lib; {
+    description = "Python library for programming and debugging Arm Cortex-M microcontrollers";
+    homepage = "https://pyocd.io/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ frogamic sbruder ];
+  };
+}

pkgs/development/libraries/gtk-layer-shell/default.nix

@@ -13,15 +13,16 @@
 
 stdenv.mkDerivation rec {
   pname = "gtk-layer-shell";
-  version = "0.6.0";
+  version = "0.7.0";
 
   outputs = [ "out" "dev" "devdoc" ];
+  outputBin = "devdoc"; # for demo
 
   src = fetchFromGitHub {
     owner = "wmww";
     repo = "gtk-layer-shell";
     rev = "v${version}";
-    sha256 = "sha256-jLWXBoYcVoUSzw4OIYVM5iPvsmpy+Wg5TbDpo8cll80=";
+    sha256 = "sha256-0S1WBpxXpWoMOecJQS6FKEXRZdw4E5hrjURPyhkxiMc=";
   };
 
   nativeBuildInputs = [
@@ -41,6 +42,7 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Ddocs=true"
+    "-Dexamples=true"
   ];
 
   meta = with lib; {

pkgs/development/libraries/hpx/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hpx";
-  version = "1.7.1";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "STEllAR-GROUP";
     repo = "hpx";
     rev = version;
-    sha256 = "1knx7kr8iw4b7nh116ygd00y68y84jjb4fj58jkay7n5qlrxh604";
+    sha256 = "sha256-YJ4wHaPE5E6ngUAYrQB1SkW4IoHW71tUDKKNANVA9Xw=";
   };
 
   buildInputs = [ asio boost hwloc gperftools ];

pkgs/development/libraries/java/lombok/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lombok";
-  version = "1.18.22";
+  version = "1.18.24";
 
   src = fetchurl {
     url = "https://projectlombok.org/downloads/lombok-${version}.jar";
-    sha256 = "sha256-7O8VgUEdeoLMBCgWZ+4LrF18ClqudM/DhDA5bJHDGDE=";
+    sha256 = "sha256-01hLwtsD8Fn5hPsKnBGarB+g2leKRI5p/D9os2WEx0k=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/libraries/libjaylink/default.nix

@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libjaylink";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.zapb.de";
     owner = "libjaylink";
     repo = "libjaylink";
     rev = version;
-    sha256 = "0ndyfh51hiqyv2yscpj6qd091w7myxxjid3a6rx8f6k233vy826q";
+    sha256 = "sha256-90obLaSE3oxrocyJWZ4+j4U4GuPIZEiiIQqenu4vsJg=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];

pkgs/development/libraries/libnbd/default.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libnbd";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchurl {
     url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-stable/${pname}-${version}.tar.gz";
-    hash = "sha256-fwVAMqZGX1HZMA/81qb67K5gwSqtcT1HnLBLdqDr4Cc=";
+    hash = "sha256-LwgXVWOWwyc9OUJEKHkDQEfGBy41XsdbRuG+zluFc3E=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libp11/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libp11";
-  version = "0.4.11";
+  version = "0.4.12";
 
   src = fetchFromGitHub {
     owner = "OpenSC";
     repo = "libp11";
     rev = "${pname}-${version}";
-    sha256 = "0hcl706i04nw5c1sj7l6sj6m0yjq6qijz345v498jll58fp5wif8";
+    sha256 = "sha256-Xqjl12xT30ZXWYzPWNN3jWY9pxojhd7Kq0OC7rABt4M=";
   };
 
   configureFlags = [

pkgs/development/libraries/libusbsio/default.nix

@@ -0,0 +1,37 @@
+{ lib, stdenv, fetchzip, pkg-config, libusb1, systemdMinimal }:
+let
+  binDirPrefix = if stdenv.isDarwin then "osx_" else "linux_";
+in
+stdenv.mkDerivation rec {
+  pname = "libusbsio";
+  version = "2.1.11";
+
+  src = fetchzip {
+    url = "https://www.nxp.com/downloads/en/libraries/libusbsio-${version}-src.zip";
+    sha256 = "sha256-qgoeaGWTWdTk5XpJwoauckEQlqB9lp5x2+TN09vQttI=";
+  };
+
+  postPatch = ''
+    rm -r bin/*
+  '';
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    libusb1
+    systemdMinimal # libudev
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D bin/${binDirPrefix}${stdenv.hostPlatform.parsed.cpu.name}/libusbsio${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libusbsio${stdenv.hostPlatform.extensions.sharedLibrary}
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.nxp.com/design/software/development-software/library-for-windows-macos-and-ubuntu-linux:LIBUSBSIO";
+    description = "Library for communicating with devices connected via the USB bridge on LPC-Link2 and MCU-Link debug probes on supported NXP microcontroller evaluation boards";
+    platforms = platforms.all;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ frogamic sbruder ];
+  };
+}

pkgs/development/libraries/log4cplus/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "log4cplus";
-  version = "2.0.7";
+  version = "2.0.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/log4cplus/log4cplus-${version}.tar.bz2";
-    sha256 = "sha256-j626/uK6TlWKD3iEJhPJ+yOcd12D8jNA0JEITA4bEqs=";
+    sha256 = "sha256-yjaqNmA20cYfwDZqn/vPMrrVXXSHiyw2qcNNzAC4oMo=";
   };
 
   meta = {

pkgs/development/libraries/oneDNN/default.nix

@@ -5,13 +5,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation rec {
   pname = "oneDNN";
-  version = "2.3.2";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneDNN";
     rev = "v${version}";
-    sha256 = "sha256-sfTcBthrnt7m9AnzdwWl9yLu1jRpwUp8i9s9DlA3IJo=";
+    sha256 = "sha256-cO8hT5ZrA9VegxOFH9fHm3YKK4A6XmaWIAfPTytNu6I=";
   };
 
   outputs = [ "out" "dev" "doc" ];
@@ -21,12 +21,6 @@ stdenv.mkDerivation rec {
   # Tests fail on some Hydra builders, because they do not support SSE4.2.
   doCheck = false;
 
-  # The cmake install gets tripped up and installs a nix tree into $out, in
-  # addition to the correct install; clean it up.
-  postInstall = ''
-    rm -r $out/nix
-  '';
-
   meta = with lib; {
     description = "oneAPI Deep Neural Network Library (oneDNN)";
     homepage = "https://01.org/oneDNN";

pkgs/development/libraries/onnxruntime/default.nix

@@ -0,0 +1,117 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, fetchurl
+, pkg-config
+, cmake
+, python3
+, libpng
+, zlib
+, eigen
+, protobuf
+, howard-hinnant-date
+, nlohmann_json
+, boost
+, oneDNN
+, gtest
+}:
+
+let
+  # prefetch abseil
+  # Note: keep URL in sync with `cmake/external/abseil-cpp.cmake`
+  abseil = fetchurl {
+    url = "https://github.com/abseil/abseil-cpp/archive/refs/tags/20211102.0.zip";
+    sha256 = "sha256-pFZ/8C+spnG5XjHTFbqxi0K2xvGmDpHG6oTlohQhEsI=";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "onnxruntime";
+  version = "1.12.1";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "onnxruntime";
+    rev = "v${version}";
+    sha256 = "sha256-wwllEemiHTp9aJcCd1gsTS4WUVMp5wW+4i/+6DzmAeM=";
+    fetchSubmodules = true;
+  };
+
+  patches = [
+    # Use dnnl from nixpkgs instead of submodules
+    (fetchpatch {
+      name = "system-dnnl.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/system-dnnl.diff?h=python-onnxruntime&id=0185531906bda3a9aba93bbb0f3dcfeb0ae671ad";
+      sha256 = "sha256-58RBrQnAWNtc/1pmFs+PkZ6qCsL1LfMY3P0exMKzotA=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    python3
+    gtest
+  ];
+
+  buildInputs = [
+    libpng
+    zlib
+    protobuf
+    howard-hinnant-date
+    nlohmann_json
+    boost
+    oneDNN
+  ];
+
+  # TODO: build server, and move .so's to lib output
+  outputs = [ "out" "dev" ];
+
+  enableParallelBuilding = true;
+
+  cmakeDir = "../cmake";
+
+  cmakeFlags = [
+    "-Donnxruntime_PREFER_SYSTEM_LIB=ON"
+    "-Donnxruntime_BUILD_SHARED_LIB=ON"
+    "-Donnxruntime_ENABLE_LTO=ON"
+    "-Donnxruntime_BUILD_UNIT_TESTS=ON"
+    "-Donnxruntime_USE_PREINSTALLED_EIGEN=ON"
+    "-Donnxruntime_USE_MPI=ON"
+    "-Deigen_SOURCE_PATH=${eigen.src}"
+    "-Donnxruntime_USE_DNNL=YES"
+  ];
+
+  doCheck = true;
+
+  postPatch = ''
+    substituteInPlace cmake/external/abseil-cpp.cmake \
+      --replace "${abseil.url}" "${abseil}"
+  '';
+
+  postInstall = ''
+    # perform parts of `tools/ci_build/github/linux/copy_strip_binary.sh`
+    install -m644 -Dt $out/include \
+      ../include/onnxruntime/core/framework/provider_options.h \
+      ../include/onnxruntime/core/providers/cpu/cpu_provider_factory.h \
+      ../include/onnxruntime/core/session/onnxruntime_*.h
+  '';
+
+  meta = with lib; {
+    description = "Cross-platform, high performance scoring engine for ML models";
+    longDescription = ''
+      ONNX Runtime is a performance-focused complete scoring engine
+      for Open Neural Network Exchange (ONNX) models, with an open
+      extensible architecture to continually address the latest developments
+      in AI and Deep Learning. ONNX Runtime stays up to date with the ONNX
+      standard with complete implementation of all ONNX operators, and
+      supports all ONNX releases (1.2+) with both future and backwards
+      compatibility.
+    '';
+    homepage = "https://github.com/microsoft/onnxruntime";
+    changelog = "https://github.com/microsoft/onnxruntime/releases/tag/v${version}";
+    # https://github.com/microsoft/onnxruntime/blob/master/BUILD.md#architectures
+    platforms = platforms.unix;
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer puffnfresh ck3d ];
+  };
+}

pkgs/development/libraries/pkcs11helper/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pkcs11-helper";
-  version = "1.28";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "OpenSC";
     repo = "pkcs11-helper";
     rev = "${pname}-${version}";
-    sha256 = "sha256-gy04f62TX42mW4hKD/jTZXTpz9v6gQXNrY/pv8Ie4p0=";
+    sha256 = "sha256-HPaPmsCJ81NaS7mgRGbR7KFG6AM3s6HXdWKdfREhcLc=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];

pkgs/development/libraries/rocclr/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocclr";
-  version = "5.1.0";
+  version = "5.2.1";
 
   src = fetchFromGitHub {
     owner = "ROCm-Developer-Tools";
     repo = "ROCclr";
     rev = "rocm-${version}";
-    hash = "sha256-SFWEGKffhuiTE7ICbkElVV5cldXu4Xbwvjb6LiNmijA=";
+    hash = "sha256-bNIc1JF8f88xC18BheKZCZYjWb4gUZOMWlt/5198iGE=";
   };
 
   patches = [

pkgs/development/libraries/rocm-comgr/cmake.patch

@@ -0,0 +1,224 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index eac270a..27610ec 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -53,10 +53,6 @@ set(SOURCES
+ 
+ if(COMGR_BUILD_SHARED_LIBS)
+   add_library(amd_comgr SHARED ${SOURCES})
+-  # Windows doesn't have a strip utility, so CMAKE_STRIP won't be set.
+-  if((CMAKE_BUILD_TYPE STREQUAL "Release") AND NOT ("${CMAKE_STRIP}" STREQUAL ""))
+-    add_custom_command(TARGET amd_comgr POST_BUILD COMMAND ${CMAKE_STRIP} $<TARGET_FILE:amd_comgr>)
+-  endif()
+ else()
+   add_library(amd_comgr STATIC ${SOURCES})
+ endif()
+@@ -141,8 +137,8 @@ if (UNIX)
+   list(APPEND AMD_COMGR_PUBLIC_LINKER_OPTIONS -pthread)
+   if (NOT APPLE AND COMGR_BUILD_SHARED_LIBS)
+     configure_file(
+-      ${CMAKE_CURRENT_SOURCE_DIR}/src/exportmap.in
+-      ${CMAKE_CURRENT_BINARY_DIR}/src/exportmap @ONLY)
++      src/exportmap.in
++      src/exportmap @ONLY)
+     list(APPEND AMD_COMGR_PRIVATE_LINKER_OPTIONS
+       "-Wl,--version-script=${CMAKE_CURRENT_BINARY_DIR}/src/exportmap")
+     # When building a shared library with -fsanitize=address we can't be
+@@ -154,6 +150,9 @@ if (UNIX)
+         -Wl,--no-undefined)
+     endif()
+   endif()
++
++  # Strip in release build
++  set_target_properties(amd_comgr PROPERTIES LINK_FLAGS_RELEASE -s)
+ elseif (CMAKE_CXX_COMPILER_ID STREQUAL "MSVC")
+   list(APPEND AMD_COMGR_PRIVATE_COMPILE_OPTIONS
+     "/wd4244" #[[Suppress 'argument' : conversion from 'type1' to 'type2', possible loss of data]]
+@@ -169,10 +168,6 @@ endif()
+ # the shared header.
+ list(APPEND AMD_COMGR_PRIVATE_COMPILE_DEFINITIONS AMD_COMGR_EXPORT)
+ 
+-configure_file(
+-  ${CMAKE_CURRENT_SOURCE_DIR}/include/amd_comgr.h.in
+-  ${CMAKE_CURRENT_BINARY_DIR}/include/amd_comgr.h @ONLY)
+-
+ include(bc2h)
+ include(opencl_pch)
+ include(DeviceLibs)
+@@ -203,8 +198,11 @@ target_compile_definitions(amd_comgr
+   PRIVATE "${AMD_COMGR_PRIVATE_COMPILE_DEFINITIONS}")
+ target_include_directories(amd_comgr
+   PUBLIC
+-    $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>
+-    $<INSTALL_INTERFACE:include>)
++    $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>)
++
++configure_file(
++  include/amd_comgr.h.in
++  include/amd_comgr.h @ONLY)
+ 
+ set(AMD_COMGR_CONFIG_NAME amd_comgr-config.cmake)
+ set(AMD_COMGR_TARGETS_NAME amd_comgr-targets.cmake)
+@@ -220,29 +218,30 @@ if (NOT COMGR_BUILD_SHARED_LIBS)
+ endif()
+ 
+ set(AMD_COMGR_TARGETS_PATH
+-  "${CMAKE_CURRENT_BINARY_DIR}/${AMD_COMGR_PACKAGE_PREFIX}/${AMD_COMGR_TARGETS_NAME}")
+-set(AMD_COMGR_VERSION_PATH
+-  "${CMAKE_CURRENT_BINARY_DIR}/${AMD_COMGR_PACKAGE_PREFIX}/${AMD_COMGR_VERSION_NAME}")
+-export(TARGETS amd_comgr
+-  FILE "${AMD_COMGR_PACKAGE_PREFIX}/${AMD_COMGR_TARGETS_NAME}")
++  "${AMD_COMGR_PACKAGE_PREFIX}/${AMD_COMGR_TARGETS_NAME}")
+ configure_file("cmake/${AMD_COMGR_CONFIG_NAME}.in"
+-  "${AMD_COMGR_PACKAGE_PREFIX}/${AMD_COMGR_CONFIG_NAME}"
++  ${AMD_COMGR_CONFIG_NAME}
+   @ONLY)
+-write_basic_package_version_file("${AMD_COMGR_VERSION_PATH}"
++write_basic_package_version_file("${CMAKE_CURRENT_BINARY_DIR}/${AMD_COMGR_VERSION_NAME}"
+   VERSION "${amd_comgr_VERSION}"
+   COMPATIBILITY SameMajorVersion)
+ 
+ install(TARGETS amd_comgr
+   EXPORT amd_comgr_export
+-  COMPONENT amd-comgr
+-  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+-  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+-  ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR})
++  COMPONENT amd-comgr)
++install(EXPORT amd_comgr_export
++  DESTINATION "${AMD_COMGR_PACKAGE_PREFIX}"
++  FILE "${AMD_COMGR_TARGETS_NAME}")
+ 
+ install(FILES
+   "${CMAKE_CURRENT_BINARY_DIR}/include/amd_comgr.h"
+   COMPONENT amd-comgr
+   DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
++install(FILES
++  "${CMAKE_CURRENT_BINARY_DIR}/${AMD_COMGR_CONFIG_NAME}"
++  "${CMAKE_CURRENT_BINARY_DIR}/${AMD_COMGR_VERSION_NAME}"
++  COMPONENT amd-comgr
++  DESTINATION ${AMD_COMGR_PACKAGE_PREFIX})
+ 
+ install(FILES
+   "README.md"
+@@ -251,37 +250,6 @@ install(FILES
+   COMPONENT amd-comgr
+   DESTINATION ${CMAKE_INSTALL_DATADIR}/amd_comgr)
+ 
+-# Generate the install-tree package.
+-set(AMD_COMGR_PREFIX_CODE "
+-# Derive absolute install prefix from config file path.
+-get_filename_component(AMD_COMGR_PREFIX \"\${CMAKE_CURRENT_LIST_FILE}\" PATH)")
+-string(REGEX REPLACE "/" ";" count "${AMD_COMGR_PACKAGE_PREFIX}")
+-foreach(p ${count})
+-  set(AMD_COMGR_PREFIX_CODE "${AMD_COMGR_PREFIX_CODE}
+-get_filename_component(AMD_COMGR_PREFIX \"\${AMD_COMGR_PREFIX}\" PATH)")
+-endforeach()
+-
+-if (NOT COMGR_BUILD_SHARED_LIBS)
+-  string(APPEND AMD_COMGR_PREFIX_CODE "\ninclude(CMakeFindDependencyMacro)\n")
+-  string(APPEND AMD_COMGR_PREFIX_CODE "find_dependency(Clang REQUIRED)\n")
+-  string(APPEND AMD_COMGR_PREFIX_CODE "find_dependency(LLD REQUIRED)\n")
+-endif()
+-
+-set(AMD_COMGR_TARGETS_PATH "\${AMD_COMGR_PREFIX}/${AMD_COMGR_PACKAGE_PREFIX}/${AMD_COMGR_TARGETS_NAME}")
+-configure_file("cmake/${AMD_COMGR_CONFIG_NAME}.in"
+-  "${CMAKE_CURRENT_BINARY_DIR}/${AMD_COMGR_CONFIG_NAME}.install"
+-  @ONLY)
+-install(FILES
+-  "${CMAKE_CURRENT_BINARY_DIR}/${AMD_COMGR_CONFIG_NAME}.install"
+-  DESTINATION "${AMD_COMGR_PACKAGE_PREFIX}"
+-  RENAME "${AMD_COMGR_CONFIG_NAME}")
+-install(EXPORT amd_comgr_export
+-  DESTINATION "${AMD_COMGR_PACKAGE_PREFIX}"
+-  FILE "${AMD_COMGR_TARGETS_NAME}")
+-install(FILES
+-  "${AMD_COMGR_VERSION_PATH}"
+-  DESTINATION "${AMD_COMGR_PACKAGE_PREFIX}")
+-
+ set(CLANG_LIBS
+   clangFrontendTool)
+ 
+diff --git a/cmake/bc2h.cmake b/cmake/bc2h.cmake
+index 146fe2b..9134985 100644
+--- a/cmake/bc2h.cmake
++++ b/cmake/bc2h.cmake
+@@ -1,40 +1,41 @@
+-file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/bc2h.c
+-"#include <stdio.h>\n"
+-"int main(int argc, char **argv){\n"
+-"    FILE *ifp, *ofp;\n"
+-"    int c, i, l;\n"
+-"    if (argc != 4) return 1;\n"
+-"    ifp = fopen(argv[1], \"rb\");\n"
+-"    if (!ifp) return 1;\n"
+-"    i = fseek(ifp, 0, SEEK_END);\n"
+-"    if (i < 0) return 1;\n"
+-"    l = ftell(ifp);\n"
+-"    if (l < 0) return 1;\n"
+-"    i = fseek(ifp, 0, SEEK_SET);\n"
+-"    if (i < 0) return 1;\n"
+-"    ofp = fopen(argv[2], \"wb+\");\n"
+-"    if (!ofp) return 1;\n"
+-"    fprintf(ofp, \"#define %s_size %d\\n\\n\"\n"
+-"                 \"#if defined __GNUC__\\n\"\n"
+-"                 \"__attribute__((aligned (4096)))\\n\"\n"
+-"                 \"#elif defined _MSC_VER\\n\"\n"
+-"                 \"__declspec(align(4096))\\n\"\n"
+-"                 \"#endif\\n\"\n"
+-"                 \"static const unsigned char %s[%s_size+1] = {\",\n"
+-"                 argv[3], l,\n"
+-"                 argv[3], argv[3]);\n"
+-"    i = 0;\n"
+-"    while ((c = getc(ifp)) != EOF) {\n"
+-"        if (0 == (i&7)) fprintf(ofp, \"\\n   \");\n"
+-"        fprintf(ofp, \" 0x%02x,\", c);\n"
+-"        ++i;\n"
+-"    }\n"
+-"    fprintf(ofp, \" 0x00\\n};\\n\\n\");\n"
+-"    fclose(ifp);\n"
+-"    fclose(ofp);\n"
+-"    return 0;\n"
+-"}\n"
+-)
++file(GENERATE OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/bc2h.c
++  CONTENT
++"#include <stdio.h>
++int main(int argc, char **argv){
++    FILE *ifp, *ofp;
++    int c, i, l;
++    if (argc != 4) return 1;
++    ifp = fopen(argv[1], \"rb\");
++    if (!ifp) return 1;
++    i = fseek(ifp, 0, SEEK_END);
++    if (i < 0) return 1;
++    l = ftell(ifp);
++    if (l < 0) return 1;
++    i = fseek(ifp, 0, SEEK_SET);
++    if (i < 0) return 1;
++    ofp = fopen(argv[2], \"wb+\");
++    if (!ofp) return 1;
++    fprintf(ofp, \"#define %s_size %d\\n\\n\"
++                 \"#if defined __GNUC__\\n\"
++                 \"__attribute__((aligned (4096)))\\n\"
++                 \"#elif defined _MSC_VER\\n\"
++                 \"__declspec(align(4096))\\n\"
++                 \"#endif\\n\"
++                 \"static const unsigned char %s[%s_size+1] = {\",
++                 argv[3], l,
++                 argv[3], argv[3]);
++    i = 0;
++    while ((c = getc(ifp)) != EOF) {
++        if (0 == (i&7)) fprintf(ofp, \"\\n   \");
++        fprintf(ofp, \" 0x%02x,\", c);
++        ++i;
++    }
++    fprintf(ofp, \" 0x00\\n};\\n\\n\");
++    fclose(ifp);
++    fclose(ofp);
++    return 0;
++}
++")
+ 
+ add_executable(bc2h ${CMAKE_CURRENT_BINARY_DIR}/bc2h.c)
+ if (CMAKE_CXX_COMPILER_ID STREQUAL "MSVC")

pkgs/development/libraries/rocm-comgr/default.nix

@@ -1,32 +1,33 @@
-{ lib, stdenv, fetchFromGitHub, writeScript, cmake, clang, rocm-device-libs, lld, llvm }:
+{ lib, stdenv, fetchFromGitHub, writeScript, cmake, clang, rocm-device-libs, llvm }:
 
 stdenv.mkDerivation rec {
   pname = "rocm-comgr";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCm-CompilerSupport";
     rev = "rocm-${version}";
-    hash = "sha256-zlCM3Zue7MEhL1c0gUPwRNgdjzyyF9BEP3UxE8RYkKk=";
+    hash = "sha256-5C5bRdrt3xZAlRgtiIRTMAuwsFvVM4Win96P5+Pf5ZM=";
   };
 
   sourceRoot = "source/lib/comgr";
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ clang rocm-device-libs lld llvm ];
+  buildInputs = [ clang rocm-device-libs llvm ];
 
   cmakeFlags = [
-    "-DCLANG=${clang}/bin/clang"
     "-DCMAKE_BUILD_TYPE=Release"
     "-DCMAKE_C_COMPILER=${clang}/bin/clang"
     "-DCMAKE_CXX_COMPILER=${clang}/bin/clang++"
     "-DCMAKE_PREFIX_PATH=${llvm}/lib/cmake/llvm"
-    "-DLLD_INCLUDE_DIRS=${lld.src}/include"
+    "-DLLD_INCLUDE_DIRS=${llvm}/include"
     "-DLLVM_TARGETS_TO_BUILD=\"AMDGPU;X86\""
   ];
 
+  patches = [ ./cmake.patch ];
+
   passthru.updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell
     #!nix-shell -i bash -p curl jq common-updater-scripts

pkgs/development/libraries/rocm-device-libs/default.nix

@@ -3,28 +3,26 @@
 , writeScript
 , cmake
 , clang
-, clang-unwrapped
-, lld
 , llvm
 }:
 
 stdenv.mkDerivation rec {
   pname = "rocm-device-libs";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCm-Device-Libs";
     rev = "rocm-${version}";
-    hash = "sha256-kmCk+BpM1QCJzEAkru2LK3CGwVXNUEZBFicmwnrPcx8=";
+    hash = "sha256-TBCSznHyiaiOcBR9irybCnOgfqPiNNn4679PCQwrLhA=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ clang lld llvm ];
+  buildInputs = [ clang llvm ];
 
   cmakeFlags = [
-    "-DCMAKE_PREFIX_PATH=${llvm}/lib/cmake/llvm;${clang-unwrapped}/lib/cmake/clang"
+    "-DCMAKE_PREFIX_PATH=${llvm}/lib/cmake/llvm;${llvm}/lib/cmake/clang"
     "-DLLVM_TARGETS_TO_BUILD='AMDGPU;X86'"
     "-DCLANG=${clang}/bin/clang"
   ];

pkgs/development/libraries/rocm-opencl-runtime/default.nix

@@ -6,11 +6,9 @@
 , cmake
 , rocm-cmake
 , clang
-, clang-unwrapped
 , glew
 , libglvnd
 , libX11
-, lld
 , llvm
 , mesa
 , numactl
@@ -24,24 +22,22 @@
 
 stdenv.mkDerivation rec {
   pname = "rocm-opencl-runtime";
-  version = "5.1.1";
+  version = "5.2.1";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCm-OpenCL-Runtime";
     rev = "rocm-${version}";
-    hash = "sha256-O7q3uTjspO/rZ2+8+g7pRfBXsCRaEr4DZxEqABHbOeY=";
+    hash = "sha256-Mk7Wssz34Uxtb9PRIEGrTn/tXtqxLMrq0damA/p/DsY=";
   };
 
   nativeBuildInputs = [ cmake rocm-cmake ];
 
   buildInputs = [
     clang
-    clang-unwrapped
     glew
     libglvnd
     libX11
-    lld
     llvm
     mesa
     numactl

pkgs/development/libraries/rocm-runtime/default.nix

@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , writeScript
 , addOpenGLRunpath
-, clang-unwrapped
 , cmake
 , xxd
 , elfutils
@@ -14,20 +13,20 @@
 
 stdenv.mkDerivation rec {
   pname = "rocm-runtime";
-  version = "5.1.1";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCR-Runtime";
     rev = "rocm-${version}";
-    hash = "sha256-IP5ylfUXOFkw9+Frfh+tNaZ83ozAbOK9kO2AzFVzzWk=";
+    hash = "sha256-TY0YPgNzxBLXAj7fncLQ01cSJyydveOLHrimCmLS32o=";
   };
 
   sourceRoot = "source/src";
 
   nativeBuildInputs = [ cmake xxd ];
 
-  buildInputs = [ clang-unwrapped elfutils llvm numactl ];
+  buildInputs = [ elfutils llvm numactl ];
 
   cmakeFlags = [
    "-DBITCODE_DIR=${rocm-device-libs}/amdgcn/bitcode"

pkgs/development/libraries/rocm-thunk/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocm-thunk";
-  version = "5.1.0";
+  version = "5.2.1";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCT-Thunk-Interface";
     rev = "rocm-${version}";
-    hash = "sha256-Qvbvfe1fhoLTkDnzG0WzfAxbyDoEJwkzVvlBGTBkq0w=";
+    hash = "sha256-iXhlEofPAQNxeZzDgdF1DdflIKfSI7rHGTqOybHnnHM=";
   };
 
   preConfigure = ''

pkgs/development/libraries/science/astronomy/stellarsolver/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "stellarsolver";
-  version = "2.3";
+  version = "2.4";
 
   src = fetchFromGitHub {
     owner = "rlancaste";
     repo = pname;
     rev = version;
-    sha256 = "sha256-DSydgn9brVQlVNfW8Lnw/ZNs7aftokkCuJshgqmegpY=";
+    sha256 = "sha256-HYNkpgkiRtA1ZsiFkmYk3MT3fKgs2d2neSExVXBbsPc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/mobile/androidenv/build-tools.nix

@@ -14,8 +14,10 @@ deployAndroidPackage {
       autoPatchelf --no-recurse $packageBaseDir
     ''}
 
-    wrapProgram $PWD/mainDexClasses \
-      --prefix PATH : ${pkgs.jdk8}/bin
+    ${lib.optionalString (lib.toInt (lib.versions.major package.revision) < 33) ''
+      wrapProgram $PWD/mainDexClasses \
+        --prefix PATH : ${pkgs.jdk8}/bin
+    ''}
   '';
   noAuditTmpdir = true; # The checker script gets confused by the build-tools path that is incorrectly identified as a reference to /build
 }

pkgs/development/ocaml-modules/graphql/default.nix

@@ -3,7 +3,7 @@
 buildDunePackage rec {
   pname = "graphql";
 
-  inherit (graphql_parser) version useDune2 src;
+  inherit (graphql_parser) version src;
 
   propagatedBuildInputs = [ graphql_parser rresult yojson ];
 

pkgs/development/ocaml-modules/graphql/lwt.nix

@@ -3,7 +3,7 @@
 buildDunePackage rec {
   pname = "graphql-lwt";
 
-  inherit (graphql) version useDune2 src;
+  inherit (graphql) version src;
 
   propagatedBuildInputs = [ graphql ocaml_lwt ];
 

pkgs/development/ocaml-modules/graphql/parser.nix

@@ -1,16 +1,14 @@
-{ lib, buildDunePackage, fetchurl, alcotest, fmt, menhir, re }:
+{ lib, buildDunePackage, ocaml, fetchurl, alcotest, fmt, menhir, re }:
 
 buildDunePackage rec {
   pname = "graphql_parser";
-  version = "0.13.0";
+  version = "0.14.0";
 
-  useDune2 = true;
-
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.05";
 
   src = fetchurl {
     url = "https://github.com/andreas/ocaml-graphql-server/releases/download/${version}/graphql-${version}.tbz";
-    sha256 = "0gb5y99ph0nz5y3pc1gxq1py4wji2hyf2ydbp0hv23v00n50hpsm";
+    sha256 = "sha256-v4v1ueF+NV7LvYIVinaf4rE450Z1P9OiMAito6/NHAY=";
   };
 
   nativeBuildInputs = [ menhir ];
@@ -18,7 +16,7 @@ buildDunePackage rec {
 
   checkInputs = [ alcotest ];
 
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     homepage = "https://github.com/andreas/ocaml-graphql-server";

pkgs/development/ocaml-modules/irmin/graphql.nix

@@ -24,6 +24,7 @@ buildDunePackage rec {
 
   meta = irmin.meta // {
     description = "GraphQL server for Irmin";
+    broken = true; # Not compatible with graphql 0.14
   };
 
 }

pkgs/development/python-modules/ailment/default.nix

@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.13";
+  version = "9.2.14";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fnCeNW0Rccu6e1WrmLeHgUnlxMHh9t1q10DtzyVymP8=";
+    hash = "sha256-Axjyqn1TtZbYdgaC6hOhIQM3FBs0a1oHNK8wLuWQLHM=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/aiolifx-connection/default.nix

@@ -0,0 +1,38 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, pythonOlder
+, aiolifx
+}:
+
+buildPythonPackage rec {
+  pname = "aiolifx-connection";
+  version = "1.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    pname = "aiolifx_connection";
+    inherit version;
+    hash = "sha256:09fydp5fqqh1s0vav39mw98i1la6qcgk17gch0m5ihyl9q50ks13";
+  };
+
+  propagatedBuildInputs = [
+    aiolifx
+  ];
+
+  # tests are not implemented
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "aiolifx_connection"
+  ];
+
+  meta = with lib; {
+    description = "Wrapper for aiolifx to connect to a single LIFX device";
+    homepage = "https://github.com/bdraco/aiolifx_connection";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ lukegb ];
+  };
+}

pkgs/development/python-modules/angr/default.nix

@@ -46,7 +46,7 @@ in
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.13";
+  version = "9.2.14";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-yEYqwyRJ/LN9q0f5vJIVMnVXQxRht73zDifWeevGc80=";
+    hash = "sha256-lxquiow2hI0xqdPLyZTZtxIo5nR60OtJV/kf6ukGF4c=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/ansible-lint/default.nix

@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "ansible-lint";
-  version = "6.3.0";
+  version = "6.4.0";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-9X9SCuXYEM4GIVfcfWM5kK0vvsgbu7NMzEzjoMIfzTg=";
+    sha256 = "sha256-xadjBsrpBqJgz3KGyofE0DukSSsu17/qIa0R/fPH6NE=";
   };
 
   postPatch = ''

pkgs/development/python-modules/archinfo/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.13";
+  version = "9.2.14";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ili+jbrCKQCRD5eIWZBZqlX8wRaHiY6fC1QFEE2YOng=";
+    hash = "sha256-kWZ5z9Tn0SAqrGP4gtGfPny+kj/2ibSdTwp+0RCx40s=";
   };
 
   checkInputs = [

pkgs/development/python-modules/argparse-addons/default.nix

@@ -0,0 +1,21 @@
+{ lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "argparse-addons";
+  version = "0.8.0";
+
+  src = fetchPypi {
+    pname = "argparse_addons";
+    inherit version;
+    sha256 = "sha256-uwiBB5RNM56NLnCnYwXd41FUTixb3rrxwttWrS5tzeg=";
+  };
+
+  pythonImportsCheck = [ "argparse_addons" ];
+
+  meta = with lib; {
+    description = "Additional Python argparse types and actions";
+    homepage = "https://github.com/eerimoq/argparse_addons";
+    license = licenses.mit;
+    maintainers = with maintainers; [ frogamic sbruder ];
+  };
+}

pkgs/development/python-modules/bincopy/default.nix

@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi, argparse-addons, humanfriendly, pyelftools }:
+
+buildPythonPackage rec {
+  pname = "bincopy";
+  version = "17.10.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-d1l+kqyGkBvctfKRHxCpve/8mLa7nTfDwXzxgJznce4=";
+  };
+
+  propagatedBuildInputs = [
+    argparse-addons
+    humanfriendly
+    pyelftools
+  ];
+
+  pythonImportsCheck = [ "bincopy" ];
+
+  meta = with lib; {
+    description = "Mangling of various file formats that conveys binary information (Motorola S-Record, Intel HEX, TI-TXT, ELF and binary files)";
+    homepage = "https://github.com/eerimoq/bincopy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ frogamic sbruder ];
+  };
+}

pkgs/development/python-modules/chalice/default.nix

@@ -24,15 +24,22 @@
 
 buildPythonPackage rec {
   pname = "chalice";
-  version = "1.26.6";
+  version = "1.27.1";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = version;
-    sha256 = "sha256-6Y5pJg6N/F97zvkyo4r6MoThi79kI53AvlHNOmOCpFA=";
+    sha256 = "sha256-Qz8kYXu2NmcgtW8GbmLPfB4BOearEycE6EMmQRXmWeI=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "attrs>=19.3.0,<21.5.0" "attrs" \
+      --replace "pip>=9,<22.2" "pip" \
+      --replace "typing==3.6.4" "typing"
+  '';
+
   propagatedBuildInputs = [
     attrs
     botocore
@@ -58,13 +65,6 @@ buildPythonPackage rec {
     websocket-client
   ];
 
-  postPatch = ''
-    sed -i setup.py -e "/pip>=/c\'pip',"
-    substituteInPlace setup.py \
-      --replace "typing==3.6.4" "typing" \
-      --replace "jmespath>=0.9.3,<1.0.0" "jmespath>=0.9.3,<2.0.0"
-  '';
-
   disabledTestPaths = [
     # Don't check the templates and the sample app
     "chalice/templates"

pkgs/development/python-modules/claripy/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.13";
+  version = "9.2.14";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kZs2BYVfXCqi1v/cnJCDtLsEKc7xh8nG59G4N1RVSjs=";
+    hash = "sha256-802ToJGxwJSFcnl3suQMPNz0/7HnqvqxCpy9u7iU6EE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/cle/default.nix

@@ -15,7 +15,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.13";
+  version = "9.2.14";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-mgEDYUh3ZYvlcj8u3M3Rpfi57CA0MYuf2C3eZ4ElAzA=";
+    hash = "sha256-ueR5reEmaI9drFMQn/CBHCW7DmsTWWYi1zCNaUQ2y7g=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/cmsis-pack-manager/default.nix

@@ -0,0 +1,77 @@
+{ lib
+, fetchPypi
+, rustPlatform
+, stdenv
+, Security
+, writeShellScriptBin
+, buildPythonPackage
+, setuptools-scm
+, appdirs
+, milksnake
+, pyyaml
+, hypothesis
+, jinja2
+, mock
+, pytestCheckHook
+}:
+let
+  pname = "cmsis-pack-manager";
+  version = "0.4.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-NeUG6PFI2eTwq5SNtAB6ZMA1M3z1JmMND29V9/O5sgw=";
+  };
+
+  native = rustPlatform.buildRustPackage {
+    name = "${pname}-${version}-native";
+
+    inherit src;
+
+    buildInputs = lib.optionals stdenv.isDarwin [
+      Security
+    ];
+
+    sourceRoot = "${pname}-${version}/rust";
+    cargoLock.lockFile = ./Cargo.lock;
+
+    postPatch = ''
+      cp ${./Cargo.lock} Cargo.lock
+    '';
+
+    cargoBuildFlags = [ "--lib" ];
+  };
+in
+buildPythonPackage rec {
+  inherit pname version src;
+
+  # The cargo build is already run in a separate derivation
+  postPatch = ''
+    substituteInPlace setup.py \
+        --replace "'cargo', 'build'," "'true',"
+  '';
+
+  nativeBuildInputs = [ setuptools-scm ];
+  propagatedBuildInputs = [ appdirs milksnake pyyaml ];
+
+  checkInputs = [ hypothesis jinja2 mock pytestCheckHook ];
+
+  preBuild = ''
+    mkdir -p rust/target/release/deps
+    ln -s ${native}/lib/libcmsis_cffi${stdenv.hostPlatform.extensions.sharedLibrary} rust/target/release/deps/
+  '';
+
+  preCheck = ''
+    # Otherwise the test uses a dummy library (missing all symbols)
+    ln -sf ../build/lib/cmsis_pack_manager/_native__lib${stdenv.hostPlatform.extensions.sharedLibrary} cmsis_pack_manager/_native__lib${stdenv.hostPlatform.extensions.sharedLibrary}
+  '';
+
+  pythonImportsCheck = [ "cmsis_pack_manager" ];
+
+  meta = with lib; {
+    description = "A Rust and Python module for handling CMSIS Pack files";
+    homepage = "https://github.com/pyocd/cmsis-pack-manager";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ frogamic sbruder ];
+  };
+}

pkgs/development/python-modules/debuglater/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "debuglater";
-  version = "1.4.1";
+  version = "1.4.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "ploomber";
     repo = pname;
     rev = version;
-    hash = "sha256-n/Q6yt3q/+6QCGWNmaFrUK/phba6IVu42DMcvVj4vb0=";
+    hash = "sha256-6XIBPnH2LWc3GpSS8Eh2VG21v8+Em7cmvmQIJKzFi6M=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/debugpy/default.nix

@@ -4,7 +4,6 @@
 , pythonOlder
 , fetchFromGitHub
 , substituteAll
-, fetchpatch
 , gdb
 , django
 , flask
@@ -18,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "debugpy";
-  version = "1.6.2";
+  version = "1.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +26,7 @@ buildPythonPackage rec {
     owner = "Microsoft";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-jcokiAZ2WwyIvsXNIUzvMIrRttR76RwDSE7gk0xHExc=";
+    sha256 = "sha256-ERsqs+pCJfYQInOWPBhM/7hC5TTfQAksYJwFCcd+vlk=";
   };
 
   patches = [
@@ -52,13 +51,6 @@ buildPythonPackage rec {
     # To avoid this issue, debugpy should be installed using python.withPackages:
     # python.withPackages (ps: with ps; [ debugpy ])
     ./fix-test-pythonpath.patch
-
-    # Fix compiling attach library from source
-    # https://github.com/microsoft/debugpy/pull/978
-    (fetchpatch {
-      url = "https://github.com/microsoft/debugpy/commit/08b3b13cba9035f4ab3308153aef26e3cc9275f9.patch";
-      sha256 = "sha256-8E+Y40mYQou9T1ozWslEK2XNQtuy5+MBvPvDLt4eQak=";
-    })
   ];
 
   # Remove pre-compiled "attach" libraries and recompile for host platform

pkgs/development/python-modules/flake8/default.nix

@@ -1,62 +1,49 @@
 { lib
 , buildPythonPackage
-, fetchPypi
 , pythonOlder
-, configparser
-, enum34
+, fetchFromGitHub
 , mccabe
 , pycodestyle
 , pyflakes
-, functools32
-, typing
 , importlib-metadata
-, mock
+, pythonAtLeast
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "flake8";
-  version = "4.0.1";
+  version = "5.0.4";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "03c7mnk34wfz7a0m5zq0273y94awz69fy5iww8alh4a4v96h6vl0";
+  disabled = pythonOlder "3.6";
+
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "PyCQA";
+    repo = "flake8";
+    rev = version;
+    hash = "sha256-Os8HIoM07/iOBMm+0WxdQj32pJJOJ8mkh+yLHpqkLXg=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "mccabe>=0.6.0,<0.7.0" "mccabe>=0.7.0,<0.8.0"
-  '';
-
   propagatedBuildInputs = [
-    pyflakes
-    pycodestyle
     mccabe
-  ] ++ lib.optionals (pythonOlder "3.2") [
-    configparser
-    functools32
-  ] ++ lib.optionals (pythonOlder "3.4") [
-    enum34
-  ] ++ lib.optionals (pythonOlder "3.5") [
-    typing
+    pycodestyle
+    pyflakes
   ] ++ lib.optionals (pythonOlder "3.8") [
     importlib-metadata
   ];
 
   # Tests fail on Python 3.7 due to importlib using a deprecated interface
-  doCheck = !(pythonOlder "3.8");
+  doCheck = pythonAtLeast "3.7";
 
   checkInputs = [
-    mock
     pytestCheckHook
   ];
 
-  disabled = pythonOlder "3.6";
-
   meta = with lib; {
     description = "Flake8 is a wrapper around pyflakes, pycodestyle and mccabe.";
     homepage = "https://github.com/pycqa/flake8";
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }

pkgs/development/python-modules/hahomematic/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2022.8.7";
+  version = "2022.8.10";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-HSxGCytQ099GCG3LanExOEp9DYeboQ2fS0QxHbtSI3s=";
+    sha256 = "sha256-JyHIX0G6REIRJDxSrGwZr0mMvAE0R1/zkullh/SXAXA=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/hcloud/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "hcloud";
-  version = "1.17.0";
+  version = "1.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+BQuBDi+J3xvod3uE67NXaFStIxt7H/Ulw3vG13CGeI=";
+    hash = "sha256-oh2UDN6PDB/RCgWBsGGOuECm9ZJAT6r9tgcBAfRSX/Y=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/hexdump/default.nix

@@ -0,0 +1,32 @@
+{ lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "hexdump";
+  version = "3.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-14GkOwwWrOP5Nmqt5z6K06e9UTfVjwtFqy0/VIdvINs=";
+    extension = "zip";
+  };
+
+  # the source zip has no prefix, so everything gets unpacked to /build otherwise
+  sourceRoot = "source";
+  unpackPhase = ''
+    runHook preUnpack
+    mkdir source
+    pushd source
+    unzip $src
+    popd
+    runHook postUnpack
+  '';
+
+  pythonImportsCheck = [ "hexdump" ];
+
+  meta = with lib; {
+    description = "Library to dump binary data to hex format and restore from there";
+    homepage = "https://pypi.org/project/hexdump/"; # BitBucket site returns 404
+    license = licenses.publicDomain;
+    maintainers = with maintainers; [ frogamic sbruder ];
+  };
+}

pkgs/development/python-modules/iminuit/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "iminuit";
-  version = "2.15.2";
+  version = "2.16.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YKx9L+lAXJIGZ1IpJz9AFhHT9d+iKUJUFkbEYltZ8eo=";
+    hash = "sha256-ECSlGdvI/VLV/So3ef1IWwm8J8QFVt74tvkWlUIxmdY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/jupyterlab-lsp/default.nix

@@ -1,5 +1,4 @@
-{ stdenv
-, lib
+{ lib
 , buildPythonPackage
 , fetchPypi
 , jupyterlab

pkgs/development/python-modules/libusbsio/default.nix

@@ -0,0 +1,34 @@
+{ lib, buildPythonPackage, libusbsio }:
+
+buildPythonPackage rec {
+  pname = "libusbsio";
+  inherit (libusbsio) version;
+
+  src = "${libusbsio.src}/python";
+
+  # The source includes both the python module directly and also a source tarball for it.
+  # The direct files lack setup information, the tarball includes unwanted binaries.
+  # This takes only the setup files from the tarball.
+  postUnpack = ''
+    tar -C python --strip-components=1 -xf python/dist/libusbsio-${version}.tar.gz libusbsio-${version}/{setup.py,setup.cfg,pyproject.toml}
+    rm -r python/dist
+  '';
+
+  postPatch = ''
+    substituteInPlace libusbsio/libusbsio.py \
+        --replace "dllpath = LIBUSBSIO._lookup_dll_path(dfltdir, dllname)" 'dllpath = "${libusbsio}/lib/" + dllname'
+  '';
+
+  buildInputs = [ libusbsio ];
+
+  doCheck = false; # they require a device to be connected over USB
+
+  pythonImportsCheck = [ "libusbsio" ];
+
+  meta = with lib; {
+    description = "NXP Secure Provisioning SDK";
+    homepage = "https://github.com/NXPmicro/spsdk";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ frogamic sbruder ];
+  };
+}

pkgs/development/python-modules/marshmallow-enum/default.nix

@@ -5,7 +5,6 @@
 , pytestCheckHook
 , isPy27
 , enum34
-, pytest-flake8
 }:
 
 buildPythonPackage rec {
@@ -19,13 +18,16 @@ buildPythonPackage rec {
     sha256 = "1ihrcmyfjabivg6hc44i59hnw5ijlg1byv3zs1rqxfynp8xr7398";
   };
 
+  postPatch = ''
+    sed -i '/addopts/d' tox.ini
+  '';
+
   propagatedBuildInputs = [
     marshmallow
   ] ++ lib.optionals isPy27 [ enum34 ];
 
   checkInputs = [
     pytestCheckHook
-    pytest-flake8
   ];
 
   disabledTests = [

pkgs/development/python-modules/nbconvert/default.nix

@@ -3,6 +3,7 @@
 , buildPythonPackage
 , defusedxml
 , fetchPypi
+, fetchpatch
 , ipywidgets
 , jinja2
 , jupyterlab-pygments
@@ -30,10 +31,22 @@ buildPythonPackage rec {
   # various exporter templates
   patches = [
     ./templates.patch
+
+    # Use mistune 2.x
+    (fetchpatch {
+      name = "support-mistune-2.x.patch";
+      url = "https://github.com/jupyter/nbconvert/commit/e870d9a4a61432a65bee5466c5fa80c9ee28966e.patch";
+      hash = "sha256-kdOmE7BnkRy2lsNQ2OVrEXXZntJUPJ//b139kSsfKmI=";
+      excludes = [ "pyproject.toml" ];
+    })
   ];
 
   postPatch = ''
     substituteAllInPlace ./nbconvert/exporters/templateexporter.py
+
+    # Use mistune 2.x
+    substituteInPlace setup.py \
+        --replace "mistune>=0.8.1,<2" "mistune>=2.0.3,<3"
   '';
 
   propagatedBuildInputs = [

pkgs/development/python-modules/netmiko/default.nix

@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "netmiko";
-  version = "4.1.1";
+  version = "4.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ZSmxHaFm0wCarBEzp+7bL7r2EQxRm7tLT0j4ZdjarJo=";
+    sha256 = "sha256-9e3iooZw09/TRwBhRoZl+A+bSQbtIOaw+02eHJvmevw=";
   };
 
   buildInputs = [ setuptools ];

pkgs/development/python-modules/openapi-schema-validator/default.nix

@@ -5,7 +5,6 @@
 , pytestCheckHook
 , isodate
 , jsonschema
-, pytest-flake8
 , pytest-cov
 , rfc3339-validator
 , six
@@ -30,7 +29,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ isodate jsonschema six strict-rfc3339 rfc3339-validator ];
 
-  checkInputs = [ pytestCheckHook pytest-cov pytest-flake8 ];
+  checkInputs = [ pytestCheckHook pytest-cov ];
   pythonImportsCheck = [ "openapi_schema_validator" ];
 
   meta = with lib; {

pkgs/development/python-modules/oscrypto/default.nix

@@ -22,9 +22,16 @@ buildPythonPackage rec {
     hash = "sha256-CmDypmlc/kb6ONCUggjT1Iqd29xNSLRaGh5Hz36dvOw=";
   };
 
+  postPatch = ''
+    for file in oscrypto/_openssl/_lib{crypto,ssl}_c{ffi,types}.py; do
+      substituteInPlace $file \
+        --replace "get_library('crypto', 'libcrypto.dylib', '42')" "'${openssl.out}/lib/libcrypto${stdenv.hostPlatform.extensions.sharedLibrary}'" \
+        --replace "get_library('ssl', 'libssl', '44')" "'${openssl.out}/lib/libssl${stdenv.hostPlatform.extensions.sharedLibrary}'"
+    done
+  '';
+
   propagatedBuildInputs = [
     asn1crypto
-    openssl
   ];
 
   checkInputs = [

pkgs/development/python-modules/pycodestyle/default.nix

@@ -1,4 +1,5 @@
 { buildPythonPackage
+, pythonOlder
 , fetchPypi
 , lib
 , python
@@ -6,26 +7,30 @@
 
 buildPythonPackage rec {
   pname = "pycodestyle";
-  version = "2.8.0";
+  version = "2.9.1";
+
+  disabled = pythonOlder "3.6";
+
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0zxyrg8029lzjhima6l5nk6y0z6lm5wfp9qchz3s33j3xx3mipgd";
+    sha256 = "2c9607871d58c76354b697b42f5d57e1ada7d261c261efac224b664affdc5785";
   };
 
-  dontUseSetuptoolsCheck = true;
-
-  # https://github.com/PyCQA/pycodestyle/blob/2.5.0/tox.ini#L14
+  # https://github.com/PyCQA/pycodestyle/blob/2.9.1/tox.ini#L13
   checkPhase = ''
-    ${python.interpreter} pycodestyle.py --max-doc-length=72 --testsuite testsuite
-    ${python.interpreter} pycodestyle.py --statistics pycodestyle.py
-    ${python.interpreter} pycodestyle.py --max-doc-length=72 --doctest
+    ${python.interpreter} -m pycodestyle --statistics pycodestyle.py
+    ${python.interpreter} -m pycodestyle --max-doc-length=72 --testsuite testsuite
+    ${python.interpreter} -m pycodestyle --max-doc-length=72 --doctest
     ${python.interpreter} -m unittest discover testsuite -vv
   '';
 
+  pythonImportsCheck = [ "pycodestyle" ];
+
   meta = with lib; {
-    description = "Python style guide checker (formerly called pep8)";
-    homepage = "https://pycodestyle.readthedocs.io";
+    description = "Python style guide checker";
+    homepage = "https://pycodestyle.pycqa.org/";
     license = licenses.mit;
     maintainers = with maintainers; [
       kamadorueda

pkgs/development/python-modules/pyflakes/default.nix

@@ -1,23 +1,34 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, unittest2 }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pyflakes";
-  version = "2.4.0";
+  version = "2.5.0";
+
+  disabled = pythonOlder "3.6";
+
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05a85c2872edf37a4ed30b0cce2f6093e1d0581f8c19d7393122da7e25b2b24c";
+    sha256 = "491feb020dca48ccc562a8c0cbe8df07ee13078df59813b83959cbdada312ea3";
   };
 
-  checkInputs = [ unittest2 ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  # some tests are output dependent, which have changed slightly
-  doCheck = pythonOlder "3.9";
+  pythonImportsCheck = [ "pyflakes" ];
 
   meta = with lib; {
-    homepage = "https://launchpad.net/pyflakes";
+    homepage = "https://github.com/PyCQA/pyflakes";
+    changelog = "https://github.com/PyCQA/pyflakes/blob/${version}/NEWS.rst";
     description = "A simple program which checks Python source files for errors";
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }

pkgs/development/python-modules/pylama/default.nix

@@ -17,7 +17,7 @@
 
 let pylama = buildPythonPackage rec {
   pname = "pylama";
-  version = "8.3.8";
+  version = "8.4.1";
 
   format = "setuptools";
 
@@ -26,7 +26,7 @@ let pylama = buildPythonPackage rec {
     owner = "klen";
     repo = "pylama";
     rev = version;
-    hash = "sha256-g6Lq5NaieUI/alxqoVFfL5VaCHwB/jLcp02/N1W69yE=";
+    hash = "sha256-WOGtZ412tX3YH42JCd5HIngunluwtMmQrOSUZp23LPU=";
   };
 
   patches = [