Merge master into haskell-updates

.git-blame-ignore-revs

@@ -0,0 +1,32 @@
+# This file contains a list of commits that are not likely what you
+# are looking for in a blame, such as mass reformatting or renaming.
+# You can set this file as a default ignore file for blame by running
+# the following command.
+#
+# $ git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# To temporarily not use this file add
+# --ignore-revs-file=""
+# to your blame command.
+#
+# The ignoreRevsFile can't be set globally due to blame failing if the file isn't present.
+# To not have to set the option in every repository it is needed in,
+# save the following script in your path with the name "git-bblame"
+# now you can run
+# $ git bblame $FILE
+# to use the .git-blame-ignore-revs file if it is present.
+#
+# #!/usr/bin/env bash
+# repo_root=$(git rev-parse --show-toplevel)
+# if [[ -e $repo_root/.git-blame-ignore-revs ]]; then
+#     git blame --ignore-revs-file="$repo_root/.git-blame-ignore-revs" $@
+# else
+#     git blame $@
+# fi
+
+
+# nixos/modules/rename: Sort alphabetically
+1f71224fe86605ef4cd23ed327b3da7882dad382
+
+# nixos: fix module paths in rename.nix
+d08ede042b74b8199dc748323768227b88efcf7c

.github/workflows/backport.yml

@@ -8,7 +8,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           # required to find all branches
           fetch-depth: 0

.github/workflows/basic-eval.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: cachix/install-nix-action@v16
     # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset
     - run: nix-build pkgs/top-level/release.nix -A tarball.nixpkgs-basic-release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'

.github/workflows/editorconfig.yml

@@ -24,7 +24,7 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/labels.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/labeler@v3
+    - uses: actions/labeler@v4
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         sync-labels: true

.github/workflows/manual-nixos.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/manual-nixpkgs.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/nixos-manual.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/periodic-merge-24h.yml

@@ -38,7 +38,7 @@ jobs:
             into: staging-21.11
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@1.4.0

.github/workflows/periodic-merge-6h.yml

@@ -32,7 +32,7 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@1.4.0

.github/workflows/update-terraform-providers.yml

@@ -10,7 +10,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: cachix/install-nix-action@v16
       - name: setup
         id: setup

doc/builders/packages/steam.section.md

@@ -56,7 +56,7 @@ Use `programs.steam.enable = true;` if you want to add steam to systemPackages a
 
 ## steam-run {#sec-steam-run}
 
-The FHS-compatible chroot used for Steam can also be used to run other Linux games that expect a FHS environment. To use it, install the `steam-run-native` package and run the game with
+The FHS-compatible chroot used for Steam can also be used to run other Linux games that expect a FHS environment. To use it, install the `steam-run` package and run the game with
 
 ```
 steam-run ./foo

lib/modules.nix

@@ -151,8 +151,7 @@ rec {
           };
 
           _module.freeformType = mkOption {
-            # Disallow merging for now, but could be implemented nicely with a `types.optionType`
-            type = types.nullOr (types.uniq types.attrs);
+            type = types.nullOr types.optionType;
             internal = true;
             default = null;
             description = ''

lib/tests/modules.sh

@@ -240,6 +240,11 @@ checkConfigOutput '^"24"$' config.foo ./freeform-attrsOf.nix ./freeform-str-dep-
 checkConfigError 'infinite recursion encountered' config.foo ./freeform-attrsOf.nix ./freeform-unstr-dep-str.nix
 checkConfigError 'The option .* is used but not defined' config.foo ./freeform-lazyAttrsOf.nix ./freeform-unstr-dep-str.nix
 checkConfigOutput '^"24"$' config.foo ./freeform-lazyAttrsOf.nix ./freeform-unstr-dep-str.nix ./define-value-string.nix
+# submodules in freeformTypes should have their locations annotated
+checkConfigOutput '/freeform-submodules.nix"$' config.fooDeclarations.0 ./freeform-submodules.nix
+# freeformTypes can get merged using `types.type`, including submodules
+checkConfigOutput '^10$' config.free.xxx.foo ./freeform-submodules.nix
+checkConfigOutput '^10$' config.free.yyy.bar ./freeform-submodules.nix
 
 ## types.anything
 # Check that attribute sets are merged recursively
@@ -299,6 +304,13 @@ checkConfigOutput "10" config.processedToplevel ./raw.nix
 checkConfigError "The option .multiple. is defined multiple times" config.multiple ./raw.nix
 checkConfigOutput "bar" config.priorities ./raw.nix
 
+# Test that types.optionType merges types correctly
+checkConfigOutput '^10$' config.theOption.int ./optionTypeMerging.nix
+checkConfigOutput '^"hello"$' config.theOption.str ./optionTypeMerging.nix
+
+# Test that types.optionType correctly annotates option locations
+checkConfigError 'The option .theOption.nested. in .other.nix. is already declared in .optionTypeFile.nix.' config.theOption.nested ./optionTypeFile.nix
+
 cat <<EOF
 ====== module tests ======
 $pass Pass

lib/tests/modules/freeform-submodules.nix

@@ -0,0 +1,22 @@
+{ lib, options, ... }: with lib.types; {
+
+  options.fooDeclarations = lib.mkOption {
+    default = (options.free.type.getSubOptions [])._freeformOptions.foo.declarations;
+  };
+
+  options.free = lib.mkOption {
+    type = submodule {
+      config._module.freeformType = lib.mkMerge [
+        (attrsOf (submodule {
+          options.foo = lib.mkOption {};
+        }))
+        (attrsOf (submodule {
+          options.bar = lib.mkOption {};
+        }))
+      ];
+    };
+  };
+
+  config.free.xxx.foo = 10;
+  config.free.yyy.bar = 10;
+}

lib/tests/modules/optionTypeFile.nix

@@ -0,0 +1,28 @@
+{ config, lib, ... }: {
+
+  _file = "optionTypeFile.nix";
+
+  options.theType = lib.mkOption {
+    type = lib.types.optionType;
+  };
+
+  options.theOption = lib.mkOption {
+    type = config.theType;
+    default = {};
+  };
+
+  config.theType = lib.mkMerge [
+    (lib.types.submodule {
+      options.nested = lib.mkOption {
+        type = lib.types.int;
+      };
+    })
+    (lib.types.submodule {
+      _file = "other.nix";
+      options.nested = lib.mkOption {
+        type = lib.types.str;
+      };
+    })
+  ];
+
+}

lib/tests/modules/optionTypeMerging.nix

@@ -0,0 +1,27 @@
+{ config, lib, ... }: {
+
+  options.theType = lib.mkOption {
+    type = lib.types.optionType;
+  };
+
+  options.theOption = lib.mkOption {
+    type = config.theType;
+  };
+
+  config.theType = lib.mkMerge [
+    (lib.types.submodule {
+      options.int = lib.mkOption {
+        type = lib.types.int;
+        default = 10;
+      };
+    })
+    (lib.types.submodule {
+      options.str = lib.mkOption {
+        type = lib.types.str;
+      };
+    })
+  ];
+
+  config.theOption.str = "hello";
+
+}

lib/types.nix

@@ -61,7 +61,11 @@ let
     boolToString
     ;
 
-  inherit (lib.modules) mergeDefinitions;
+  inherit (lib.modules)
+    mergeDefinitions
+    fixupOptionType
+    mergeOptionDecls
+    ;
   outer_types =
 rec {
   isType = type: x: (x._type or "") == type;
@@ -510,7 +514,7 @@ rec {
 
     functionTo = elemType: mkOptionType {
       name = "functionTo";
-      description = "function that evaluates to a(n) ${elemType.name}";
+      description = "function that evaluates to a(n) ${elemType.description}";
       check = isFunction;
       merge = loc: defs:
         fnArgs: (mergeDefinitions (loc ++ [ "[function body]" ]) elemType (map (fn: { inherit (fn) file; value = fn.value fnArgs; }) defs)).mergedValue;
@@ -525,6 +529,31 @@ rec {
       modules = toList modules;
     };
 
+    # The type of a type!
+    optionType = mkOptionType {
+      name = "optionType";
+      description = "optionType";
+      check = value: value._type or null == "option-type";
+      merge = loc: defs:
+        let
+          # Prepares the type definitions for mergeOptionDecls, which
+          # annotates submodules types with file locations
+          optionModules = map ({ value, file }:
+            {
+              _file = file;
+              # There's no way to merge types directly from the module system,
+              # but we can cheat a bit by just declaring an option with the type
+              options = lib.mkOption {
+                type = value;
+              };
+            }
+          ) defs;
+          # Merges all the types into a single one, including submodule merging.
+          # This also propagates file information to all submodules
+          mergedOption = fixupOptionType loc (mergeOptionDecls loc optionModules);
+        in mergedOption.type;
+    };
+
     submoduleWith =
       { modules
       , specialArgs ? {}

maintainers/maintainer-list.nix

@@ -2418,6 +2418,23 @@
     githubId = 5510514;
     name = "Conrad Mearns";
   };
+  corbanr = {
+    email = "corban@raunco.co";
+    github = "CorbanR";
+    githubId = 1918683;
+    matrix = "@corbansolo:matrix.org";
+    name = "Corban Raun";
+    keys = [
+      {
+        longkeyid = "rsa4096/0xA697A56F1F151189";
+        fingerprint = "6607 0B24 8CE5 64ED 22CE  0950 A697 A56F 1F15 1189";
+      }
+      {
+        longkeyid = "ed25519/0x230F4AC153F90F29";
+        fingerprint = "D8CB 816A B678 A4E6 1EC7  5325 230F 4AC1 53F9 0F29";
+      }
+    ];
+  };
   couchemar = {
     email = "couchemar@yandex.ru";
     github = "couchemar";
@@ -10276,6 +10293,13 @@
     githubId = 6047658;
     name = "Ryan Horiguchi";
   };
+  rhysmdnz = {
+    email = "rhys@memes.nz";
+    matrix = "@rhys:memes.nz";
+    github = "rhysmdnz";
+    githubId = 2162021;
+    name = "Rhys Davies";
+  };
   ribose-jeffreylau = {
     name = "Jeffrey Lau";
     email = "jeffrey.lau@ribose.com";

nixos/doc/manual/development/option-types.section.md

@@ -74,6 +74,13 @@ merging is handled.
     should only be used when checking, merging and nested evaluation are not
     desirable.
 
+`types.optionType`
+
+:   The type of an option's type. Its merging operation ensures that nested
+    options have the correct file location annotated, and that if possible,
+    multiple option definitions are correctly merged together. The main use
+    case is as the type of the `_module.freeformType` option.
+
 `types.attrs`
 
 :   A free-form attribute set.

nixos/doc/manual/from_md/development/option-types.section.xml

@@ -111,6 +111,20 @@
           </para>
         </listitem>
       </varlistentry>
+      <varlistentry>
+        <term>
+          <literal>types.optionType</literal>
+        </term>
+        <listitem>
+          <para>
+            The type of an option’s type. Its merging operation ensures
+            that nested options have the correct file location
+            annotated, and that if possible, multiple option definitions
+            are correctly merged together. The main use case is as the
+            type of the <literal>_module.freeformType</literal> option.
+          </para>
+        </listitem>
+      </varlistentry>
       <varlistentry>
         <term>
           <literal>types.attrs</literal>

nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -553,6 +553,13 @@
           <literal>tilp2</literal> was removed together with its module
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The F-PROT antivirus (<literal>fprot</literal> package) and
+          its service module were removed because it reached
+          <link xlink:href="https://kb.cyren.com/av-support/index.php?/Knowledgebase/Article/View/434/0/end-of-sale--end-of-life-for-f-prot-and-csam">end-of-life</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <literal>bird1</literal> and its modules

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -180,6 +180,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `tilp2` was removed together with its module
 
+- The F-PROT antivirus (`fprot` package) and its service module were removed because it
+  reached [end-of-life](https://kb.cyren.com/av-support/index.php?/Knowledgebase/Article/View/434/0/end-of-sale--end-of-life-for-f-prot-and-csam).
+
 - `bird1` and its modules `services.bird` as well as `services.bird6` have been removed. Upgrade to `services.bird2`.
 
 - The options `networking.interfaces.<name>.ipv4.routes` and `networking.interfaces.<name>.ipv6.routes` are no longer ignored when using networkd instead of the default scripted network backend by setting `networking.useNetworkd` to `true`.

nixos/modules/hardware/all-firmware.nix

@@ -83,6 +83,7 @@ in {
         b43Firmware_5_1_138
         b43Firmware_6_30_163_46
         b43FirmwareCutter
+        xow_dongle-firmware
       ] ++ optional pkgs.stdenv.hostPlatform.isx86 facetimehd-firmware;
     })
     (mkIf cfg.wirelessRegulatoryDatabase {

nixos/modules/hardware/xone.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.hardware.xone;
+in
+{
+  options.hardware.xone = {
+    enable = mkEnableOption "the xone driver for Xbox One and Xbobx Series X|S accessories";
+  };
+
+  config = mkIf cfg.enable {
+    boot = {
+      blacklistedKernelModules = [ "xpad" "mt76x2u" ];
+      extraModulePackages = with config.boot.kernelPackages; [ xone ];
+    };
+    hardware.firmware = [ pkgs.xow_dongle-firmware ];
+  };
+
+  meta = {
+    maintainers = with maintainers; [ rhysmdnz ];
+  };
+}

nixos/modules/misc/ids.nix

@@ -89,7 +89,7 @@ in
       prayer = 49;
       mpd = 50;
       clamav = 51;
-      fprot = 52;
+      #fprot = 52; # unused
       # bind = 53; #dynamically allocated as of 2021-09-03
       wwwrun = 54;
       #adm = 55; # unused
@@ -412,7 +412,7 @@ in
       prayer = 49;
       mpd = 50;
       clamav = 51;
-      fprot = 52;
+      #fprot = 52; # unused
       #bind = 53; # unused
       wwwrun = 54;
       adm = 55;

nixos/modules/module-list.nix

@@ -91,6 +91,7 @@
   ./hardware/video/switcheroo-control.nix
   ./hardware/video/uvcvideo/default.nix
   ./hardware/video/webcam/facetimehd.nix
+  ./hardware/xone.nix
   ./hardware/xpadneo.nix
   ./i18n/input-method/default.nix
   ./i18n/input-method/fcitx.nix
@@ -950,7 +951,6 @@
   ./services/security/clamav.nix
   ./services/security/fail2ban.nix
   ./services/security/fprintd.nix
-  ./services/security/fprot.nix
   ./services/security/haka.nix
   ./services/security/haveged.nix
   ./services/security/hockeypuck.nix

nixos/modules/rename.nix

@@ -50,6 +50,7 @@ with lib;
     (mkRemovedOptionModule [ "services" "flashpolicyd" ] "The flashpolicyd module has been removed. Adobe Flash Player is deprecated.")
     (mkRemovedOptionModule [ "services" "fourStore" ] "The fourStore module has been removed")
     (mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
+    (mkRemovedOptionModule [ "services" "fprot" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed")
     (mkRemovedOptionModule [ "services" "kippo" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "mailpile" ] "The corresponding package was removed from nixpkgs.")

nixos/modules/security/systemd-confinement.nix

@@ -175,8 +175,8 @@ in {
       serviceName = "${name}.service";
       excludedPath = rootPaths;
     } ''
-      mkdir -p "$out/lib/systemd/system"
-      serviceFile="$out/lib/systemd/system/$serviceName"
+      mkdir -p "$out/lib/systemd/system/$serviceName.d"
+      serviceFile="$out/lib/systemd/system/$serviceName.d/confinement.conf"
 
       echo '[Service]' > "$serviceFile"
 

nixos/modules/services/security/fprot.nix

@@ -1,82 +0,0 @@
-{ config, lib, pkgs, ... }:
-with lib;
-let
-  fprotUser = "fprot";
-  stateDir = "/var/lib/fprot";
-  fprotGroup = fprotUser;
-  cfg = config.services.fprot;
-in {
-  options = {
-
-    services.fprot = {
-      updater = {
-        enable = mkEnableOption "automatic F-Prot virus definitions database updates";
-
-        productData = mkOption {
-          description = ''
-            product.data file. Defaults to the one supplied with installation package.
-          '';
-          type = types.path;
-        };
-
-        frequency = mkOption {
-          default = 30;
-          type = types.int;
-          description = ''
-            Update virus definitions every X minutes.
-          '';
-        };
-
-        licenseKeyfile = mkOption {
-          type = types.path;
-          description = ''
-            License keyfile. Defaults to the one supplied with installation package.
-          '';
-        };
-
-      };
-    };
-  };
-
-  ###### implementation
-
-  config = mkIf cfg.updater.enable {
-
-    services.fprot.updater.productData = mkDefault "${pkgs.fprot}/opt/f-prot/product.data";
-    services.fprot.updater.licenseKeyfile = mkDefault "${pkgs.fprot}/opt/f-prot/license.key";
-
-    environment.systemPackages = [ pkgs.fprot ];
-    environment.etc."f-prot.conf" = {
-      source = "${pkgs.fprot}/opt/f-prot/f-prot.conf";
-    };
-
-    users.users.${fprotUser} =
-      { uid = config.ids.uids.fprot;
-        description = "F-Prot daemon user";
-        home = stateDir;
-      };
-
-    users.groups.${fprotGroup} =
-      { gid = config.ids.gids.fprot; };
-
-    services.cron.systemCronJobs = [ "*/${toString cfg.updater.frequency} * * * * root start fprot-updater" ];
-
-    systemd.services.fprot-updater = {
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = false;
-      };
-      wantedBy = [ "multi-user.target" ];
-
-      # have to copy fpupdate executable because it insists on storing the virus database in the same dir
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-        chown ${fprotUser}:${fprotGroup} ${stateDir}
-        cp ${pkgs.fprot}/opt/f-prot/fpupdate ${stateDir}
-        ln -sf ${cfg.updater.productData} ${stateDir}/product.data
-      '';
-
-      script = "/var/lib/fprot/fpupdate --keyfile ${cfg.updater.licenseKeyfile}";
-    };
- };
-}

nixos/modules/services/security/opensnitch.nix

@@ -3,22 +3,123 @@
 with lib;
 
 let
-  name = "opensnitch";
   cfg = config.services.opensnitch;
+  format = pkgs.formats.json {};
 in {
   options = {
     services.opensnitch = {
       enable = mkEnableOption "Opensnitch application firewall";
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = format.type;
+
+          options = {
+            Server = {
+
+              Address = mkOption {
+                type = types.str;
+                description = ''
+                  Unix socket path (unix:///tmp/osui.sock, the "unix:///" part is
+                  mandatory) or TCP socket (192.168.1.100:50051).
+                '';
+              };
+
+              LogFile = mkOption {
+                type = types.path;
+                description = ''
+                  File to write logs to (use /dev/stdout to write logs to standard
+                  output).
+                '';
+              };
+
+            };
+
+            DefaultAction = mkOption {
+              type = types.enum [ "allow" "deny" ];
+              description = ''
+                Default action whether to block or allow application internet
+                access.
+              '';
+            };
+
+            DefaultDuration = mkOption {
+              type = types.enum [
+                "once" "always" "until restart" "30s" "5m" "15m" "30m" "1h"
+              ];
+              description = ''
+                Default duration of firewall rule.
+              '';
+            };
+
+            InterceptUnknown = mkOption {
+              type = types.bool;
+              description = ''
+                Wheter to intercept spare connections.
+              '';
+            };
+
+            ProcMonitorMethod = mkOption {
+              type = types.enum [ "ebpf" "proc" "ftrace" "audit" ];
+              description = ''
+                Which process monitoring method to use.
+              '';
+            };
+
+            LogLevel = mkOption {
+              type = types.enum [ 0 1 2 3 4 ];
+              description = ''
+                Default log level from 0 to 4 (debug, info, important, warning,
+                error).
+              '';
+            };
+
+            Firewall = mkOption {
+              type = types.enum [ "iptables" "nftables" ];
+              description = ''
+                Which firewall backend to use.
+              '';
+            };
+
+            Stats = {
+
+              MaxEvents = mkOption {
+                type = types.int;
+                description = ''
+                  Max events to send to the GUI.
+                '';
+              };
+
+              MaxStats = mkOption {
+                type = types.int;
+                description = ''
+                  Max stats per item to keep in backlog.
+                '';
+              };
+
+            };
+          };
+        };
+        description = ''
+          opensnitchd configuration. Refer to
+          <link xlink:href="https://github.com/evilsocket/opensnitch/wiki/Configurations"/>
+          for details on supported values.
+        '';
+      };
     };
   };
 
   config = mkIf cfg.enable {
 
+    # pkg.opensnitch is referred to elsewhere in the module so we don't need to worry about it being garbage collected
+    services.opensnitch.settings = mapAttrs (_: v: mkDefault v) (builtins.fromJSON (builtins.unsafeDiscardStringContext (builtins.readFile "${pkgs.opensnitch}/etc/default-config.json")));
+
     systemd = {
       packages = [ pkgs.opensnitch ];
       services.opensnitchd.wantedBy = [ "multi-user.target" ];
     };
 
+    environment.etc."opensnitchd/default-config.json".source = format.generate "default-config.json" cfg.settings;
+
   };
 }
 

nixos/release-small.nix

@@ -38,7 +38,8 @@ in rec {
         login
         misc
         nat
-        nfs3
+        # fails with kernel >= 5.15 https://github.com/NixOS/nixpkgs/pull/152505#issuecomment-1005049314
+        #nfs3
         openssh
         php
         predictable-interface-names

nixos/tests/systemd-confinement.nix

@@ -17,15 +17,19 @@ import ./make-test-python.nix {
       exit "''${ret:-1}"
     '';
 
-    mkTestStep = num: { config ? {}, testScript }: {
-      systemd.sockets."test${toString num}" = {
+    mkTestStep = num: {
+      testScript,
+      config ? {},
+      serviceName ? "test${toString num}",
+    }: {
+      systemd.sockets.${serviceName} = {
         description = "Socket for Test Service ${toString num}";
         wantedBy = [ "sockets.target" ];
         socketConfig.ListenStream = "/run/test${toString num}.sock";
         socketConfig.Accept = true;
       };
 
-      systemd.services."test${toString num}@" = {
+      systemd.services."${serviceName}@" = {
         description = "Confined Test Service ${toString num}";
         confinement = (config.confinement or {}) // { enable = true; };
         serviceConfig = (config.serviceConfig or {}) // {
@@ -135,6 +139,16 @@ import ./make-test-python.nix {
               machine.succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" = eek')
         '';
       }
+      { serviceName = "shipped-unitfile";
+        config.confinement.mode = "chroot-only";
+        testScript = ''
+          with subtest("check if shipped unit file still works"):
+              machine.succeed(
+                  'chroot-exec \'kill -9 $$ 2>&1 || :\' | '
+                  'grep -q "Too many levels of symbolic links"'
+              )
+        '';
+      }
     ];
 
     options.__testSteps = lib.mkOption {
@@ -143,6 +157,15 @@ import ./make-test-python.nix {
     };
 
     config.environment.systemPackages = lib.singleton testClient;
+    config.systemd.packages = lib.singleton (pkgs.writeTextFile {
+      name = "shipped-unitfile";
+      destination = "/etc/systemd/system/shipped-unitfile@.service";
+      text = ''
+        [Service]
+        SystemCallFilter=~kill
+        SystemCallErrorNumber=ELOOP
+      '';
+    });
 
     config.users.groups.chroot-testgroup = {};
     config.users.users.chroot-testuser = {

pkgs/applications/editors/eclipse/build-eclipse.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, makeDesktopItem, freetype, fontconfig, libX11, libXrender
-, zlib, jdk, glib, gtk, libXtst, libsecret, gsettings-desktop-schemas, webkitgtk
+, zlib, jdk, glib, glib-networking, gtk, libXtst, libsecret, gsettings-desktop-schemas, webkitgtk
 , makeWrapper, perl, ... }:
 
 { name, src ? builtins.getAttr stdenv.hostPlatform.system sources, sources ? null, description, productVersion }:
@@ -41,6 +41,7 @@ stdenv.mkDerivation rec {
     makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
       --prefix PATH : ${jdk}/bin \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ glib gtk libXtst libsecret ] ++ lib.optional (webkitgtk != null) webkitgtk)} \
+      --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
       --add-flags "-configuration \$HOME/.eclipse/''${productId}_${productVersion}/configuration"
 

pkgs/applications/editors/emacs/generic.nix

@@ -53,7 +53,8 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
   NATIVE_FULL_AOT = "1";
   LIBRARY_PATH = "${lib.getLib stdenv.cc.libc}/lib";
 } // {
-  inherit pname version;
+  pname = pname + lib.optionalString ( !withX && !withNS && !withGTK2 && !withGTK3 ) "-nox";
+  inherit version;
 
   patches = patches fetchpatch;
 

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1857,8 +1857,8 @@ let
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "2.1.5";
-          sha256 = "sha256-nIR3PtbtnSbAU0rS+qVtPsj++Dbfp/k86dWkx4xYcno=";
+          version = "2.1.7";
+          sha256 = "sha256-C0jYDIDBK1JH8eFaFmCUilBXCbU5y2TRF3OZAw9ijoY=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";

pkgs/applications/misc/electrum-grs/default.nix

@@ -42,7 +42,7 @@ python3.pkgs.buildPythonApplication {
   src = fetchFromGitHub {
     owner = "Groestlcoin";
     repo = "electrum-grs";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     sha256 = "0wvbjj80r1zxpz24adkicxsdjnv3nciga6rl1wfmky463w03rca2";
   };
 

pkgs/applications/misc/klayout/default.nix

@@ -1,17 +1,17 @@
-{ lib, mkDerivation, fetchFromGitHub, fetchpatch
+{ lib, mkDerivation, fetchFromGitHub
 , python3, ruby, qtbase, qtmultimedia, qttools, qtxmlpatterns
-, which, perl, makeWrapper
+, which, perl
 }:
 
 mkDerivation rec {
   pname = "klayout";
-  version = "0.27.3";
+  version = "0.27.8";
 
   src = fetchFromGitHub {
     owner = "KLayout";
     repo = "klayout";
     rev = "v${version}";
-    sha256 = "sha256-6g/QoR16rhUfxhH4JxL6EERcoPVG/6MOxUlo6K/WoE0=";
+    hash = "sha256-t/nd7m8XpB026q/kyH16rKkw3qza19ISalB0Juzx4NU=";
   };
 
   postPatch = ''
@@ -21,6 +21,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [
     which
+    perl
     python3
     ruby
   ];
@@ -35,7 +36,7 @@ mkDerivation rec {
   buildPhase = ''
     runHook preBuild
     mkdir -p $out/lib
-    ./build.sh -qt5 -prefix $out/lib -j$NIX_BUILD_CORES
+    ./build.sh -qt5 -prefix $out/lib -option -j$NIX_BUILD_CORES
     runHook postBuild
   '';
 
@@ -54,8 +55,9 @@ mkDerivation rec {
 
   meta = with lib; {
     description = "High performance layout viewer and editor with support for GDS and OASIS";
-    license = with licenses; [ gpl3 ];
+    license = with licenses; [ gpl2Plus ];
     homepage = "https://www.klayout.de/";
+    changelog = "https://www.klayout.de/development.html#${version}";
     platforms = platforms.linux;
     maintainers = with maintainers; [ knedlsepp ];
   };

pkgs/applications/misc/minigalaxy/default.nix

@@ -8,7 +8,7 @@
 , gtk3
 , python3
 , python3Packages
-, steam-run-native
+, steam-run
 , unzip
 , webkitgtk
 , wrapGAppsHook
@@ -54,14 +54,14 @@ python3Packages.buildPythonApplication rec {
     python3.pkgs.requests
     python3.pkgs.setuptools
     python3.pkgs.simplejson
-    steam-run-native
+    steam-run
     unzip
     webkitgtk
   ];
 
   # Run Linux games using the Steam Runtime by using steam-run in the wrapper
   postFixup = ''
-    sed -e 's#exec -a "$0"#exec -a "$0" ${steam-run-native}/bin/steam-run#' -i $out/bin/minigalaxy
+    sed -e 's#exec -a "$0"#exec -a "$0" ${steam-run}/bin/steam-run#' -i $out/bin/minigalaxy
   '';
 
   meta = with lib; {

pkgs/applications/misc/playonlinux/default.nix

@@ -22,11 +22,12 @@
 , jq
 , xorg
 , libGL
-, steam-run-native
+, steam-run
 # needed for avoiding crash on file selector
 , gsettings-desktop-schemas
 , glib
 , wrapGAppsHook
+, hicolor-icon-theme
 }:
 
 let
@@ -89,6 +90,8 @@ in stdenv.mkDerivation {
     xorg.libX11
     libGL
     python
+    gsettings-desktop-schemas
+    hicolor-icon-theme
   ];
 
   postPatch = ''
@@ -110,7 +113,7 @@ in stdenv.mkDerivation {
     mkdir -p $out/bin
     cat > $out/bin/playonlinux <<EOF
     #!${stdenv.shell} -e
-    exec ${steam-run-native}/bin/steam-run $out/share/playonlinux/playonlinux-wrapper "\$@"
+    exec ${steam-run}/bin/steam-run $out/share/playonlinux/playonlinux-wrapper "\$@"
     EOF
     chmod a+x $out/bin/playonlinux
 
@@ -127,6 +130,15 @@ in stdenv.mkDerivation {
     done
   '';
 
+  dontWrapGApps = true;
+  postFixup = ''
+    makeWrapper $out/share/playonlinux/playonlinux{,-wrapped} \
+      --prefix PATH : ${binpath} \
+      ''${gappsWrapperArgs[@]}
+    makeWrapper ${steam-run}/bin/steam-run $out/bin/playonlinux \
+      --add-flags $out/share/playonlinux/playonlinux-wrapped
+  '';
+
   meta = with lib; {
     description = "GUI for managing Windows programs under linux";
     homepage = "https://www.playonlinux.com/";

pkgs/applications/misc/whalebird/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "whalebird";
-  version = "4.5.1";
+  version = "4.5.2";
 
   src = fetchurl {
     url = "https://github.com/h3poteto/whalebird-desktop/releases/download/${version}/Whalebird-${version}-linux-x64.deb";
-    sha256 = "sha256-70fCyxiM4CiNuG4Lqr4Tq0FHak3wDcp8G93EKYj+0kc=";
+    sha256 = "sha256-4ksKXVeUGICHfx014s5g9mapS751dbexBjzyqNvk02M=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -19,11 +19,11 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "5.1.2567.39-1";
+  version = "5.1.2567.49-1";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "140idghryk132nyb8np011xiwzgh518n0fxrkjnnvi3c67shq7qc";
+    sha256 = "1cyd789apjh71vzry2zjxb0c215yarfryb9jzxjmkfvrqg4g23xr";
   };
 
   unpackPhase = ''

pkgs/applications/networking/cluster/octant/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "octant";
-  version = "0.25.0";
+  version = "0.25.1";
 
   src =
     let
@@ -19,10 +19,10 @@ stdenv.mkDerivation rec {
       };
     in
     fetchsrc version {
-      x86_64-linux = "sha256-woBmYDOOh3AQH0RZJtMCrOfjFBrpMPzv22cVZ2/xHZo=";
-      aarch64-linux = "sha256-3YUUdOZULjJZqVJP0aO/d1WulXlpwf012NYJ6Mc2qp8=";
-      x86_64-darwin = "sha256-9lbMyEid4I1fRLkLwGbmrB2OkycnGBPUU5wEdVZoTLo=";
-      aarch64-darwin = "sha256-Q0ZkQX9FpzEc6WC3mRoYfg9oW3fvLB1/Ksa64TDlSgo=";
+      x86_64-linux = "sha256-bYqycTB036J8trojySPNkC+jrw76F7+N4I4puGCyalU=";
+      aarch64-linux = "sha256-DlzSIZCAASPnflXQ8ndPU7/0jXA18U4bGGOfmgLXPr0=";
+      x86_64-darwin = "sha256-FaPyrPzO7AzC6LHQP5c58NjLTqU+ei8vFffT8x6mUhQ=";
+      aarch64-darwin = "sha256-31CYhAsHYIVAenp8hFHYj8LhFf3lSiOTw7gULBu3gio=";
     };
 
   dontConfigure = true;

pkgs/applications/networking/cluster/terraform/default.nix

@@ -191,9 +191,9 @@ rec {
   };
 
   terraform_1 = mkTerraform {
-    version = "1.1.6";
-    sha256 = "sha256-Y1ARRCzqYBUQqpqwVrH0PPOZ9IWnw51yfyGFD/6P/ro=";
-    vendorSha256 = "sha256-RhGiY/APd12v0Hoqw381Wlk4oDx7aZt5zZvqkR99rd0=";
+    version = "1.1.7";
+    sha256 = "sha256-E8qY17MSdA7fQW4wGSDiPzbndBP5SZwelAJAWzka/io=";
+    vendorSha256 = "sha256-lyy/hcr00ix6qZoxzSfCbXvDC8dRB2ZjrONywpqbVZ8=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = { inherit plugins; };
   };

pkgs/applications/networking/cluster/werf/default.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.71";
+  version = "1.2.72";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-bDaxxeHeswuoEU7YACa3tU80DFnmuFvEPfAq+pANSWY=";
+    sha256 = "sha256-svnZBzFYKj9hIjv4SqPSP65rKIeWQqs2qwnx8J7dUIg=";
   };
   vendorSha256 = "sha256-75uCGxW6Gqfhk5oImz26fUR8BeGHkikXHGJcCH32MxQ=";
   proxyVendor = true;

pkgs/applications/networking/flexget/default.nix

@@ -1,4 +1,7 @@
-{ lib, python3Packages, fetchFromGitHub }:
+{ lib
+, python3Packages
+, fetchFromGitHub
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
@@ -9,7 +12,7 @@ python3Packages.buildPythonApplication rec {
     owner = "flexget";
     repo = "flexget";
     rev = "v${version}";
-    sha256 = "sha256-68tD7I7MI/Cp94tp6c4lQx+8xwRnJTKTF/3SWz4Ddgg=";
+    hash = "sha256-68tD7I7MI/Cp94tp6c4lQx+8xwRnJTKTF/3SWz4Ddgg=";
   };
 
   postPatch = ''
@@ -18,7 +21,7 @@ python3Packages.buildPythonApplication rec {
     ln -sf requirements.in requirements.txt
 
     # remove dependency constraints
-    sed 's/==\([0-9]\.\?\)\+//' -i requirements.txt
+    sed 's/[>=]=.*//' -i requirements.txt
 
     # "zxcvbn-python" was renamed to "zxcvbn", and we don't have the former in
     # nixpkgs. See: https://github.com/NixOS/nixpkgs/issues/62110

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -3,7 +3,7 @@ let
   inherit (pkgs) callPackage fetchurl;
   versions = if stdenv.isLinux then {
     stable = "0.0.17";
-    ptb = "0.0.27";
+    ptb = "0.0.29";
     canary = "0.0.133";
   } else {
     stable = "0.0.264";
@@ -26,7 +26,7 @@ let
       ptb = fetchurl {
         url =
           "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        sha256 = "0yphs65wpyr0ap6y24b0nbhq7sm02dg5c1yiym1fxjbynm1mdvqb";
+        sha256 = "d78NnQZ3MkLje8mHrI6noH2iD2oEvSJ3cDnsmzQsUYc=";
       };
       canary = fetchurl {
         url =

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -24,7 +24,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.31.1"; # Please backport all updates to the stable channel.
+  version = "5.33.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-6w6znIIN5TFXTLLhazWyBXiqS5882zMNRZxYxnZjRHA=";
+    sha256 = "03c7pw6cmv8ryw2wqsfc27d953950jc8nxs58mgk08g62v4qa672";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/teamspeak/client.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, makeWrapper, makeDesktopItem, zlib, glib, libpng, freetype, openssl
 , xorg, fontconfig, qtbase, qtwebengine, qtwebchannel, qtsvg, qtwebsockets, xkeyboard_config
-, alsa-lib, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages, writeShellScriptBin
+, alsa-lib, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages_10, writeShellScriptBin
 }:
 
 let
@@ -13,7 +13,7 @@ let
     [ zlib glib libpng freetype xorg.libSM xorg.libICE xorg.libXrender openssl
       xorg.libXrandr xorg.libXfixes xorg.libXcursor xorg.libXinerama
       xorg.libxcb fontconfig xorg.libXext xorg.libX11 alsa-lib qtbase qtwebengine qtwebchannel qtsvg
-      qtwebsockets libpulseaudio quazip llvmPackages.libcxx llvmPackages.libcxxabi
+      qtwebsockets libpulseaudio quazip llvmPackages_10.libcxx llvmPackages_10.libcxxabi # llvmPackages_11 and higher crash https://github.com/NixOS/nixpkgs/issues/161395
     ];
 
   desktopItem = makeDesktopItem {

pkgs/applications/office/softmaker/desktop_items.nix

@@ -25,7 +25,9 @@
       "application/vnd.openxmlformats-officedocument.spreadsheetml.template"
       "application/vnd.ms-excel.sheet.macroenabled.12"
       "application/vnd.ms-excel.template.macroEnabled.12"
-      "application/x-dif;text/spreadsheet;text/csv"
+      "application/x-dif"
+      "text/spreadsheet"
+      "text/csv"
       "application/x-prn"
       "application/vnd.ms-excel.sheet.binary.macroenabled.12"
     ];

pkgs/applications/office/wpsoffice/default.nix

@@ -142,7 +142,6 @@ stdenv.mkDerivation rec {
   installPhase = let
     steam-run = (steam.override {
       extraPkgs = p: buildInputs;
-      nativeOnly = true;
     }).run;
   in ''
     prefix=$out/opt/kingsoft/wps-office

pkgs/applications/science/biology/last/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1260";
+  version = "1268";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = version;
-    sha256 = "sha256-bJNvoHr2sQYtiC3tr1GA0T0kRhDyx6hU3OOSTvKUSCs=";
+    sha256 = "sha256-9yzeLg3xporl32sZ1Ks8s63jXJNGUiI64XyQmhbQF4M=";
   };
 
   nativeBuildInputs = [ unzip ];
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Genomic sequence aligner";
-    homepage = "http://last.cbrc.jp/";
-    license = licenses.gpl3;
+    homepage = "https://gitlab.com/mcfrith/last";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ jbedo ];
     platforms = platforms.x86_64;
   };

pkgs/applications/terminal-emulators/alacritty/default.nix

@@ -54,16 +54,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "alacritty";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-eVPy47T2wcsN7NxtwMoyuC6loBVXsoJjJ/2q31i3vxQ=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Q/ulRgU6zNLRZUjL83O/Krx85voPWZPZDo65CLp/aOg=";
   };
 
-  cargoSha256 = "sha256-RY+qidm7NZFKq6P8qVaMpxYfTfHpZac2YJwuNbOJwoM=";
+  cargoSha256 = "sha256-S1V8hDuzp4sf6945gqs8QNVdu8jwPGVYjVbV6EY28Hk=";
 
   nativeBuildInputs = [
     cmake

pkgs/build-support/dotnet/build-dotnet-module/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenvNoCC, linkFarmFromDrvs, callPackage, nuget-to-nix, writeScript, makeWrapper, fetchurl, xml2, dotnetCorePackages, dotnetPackages, cacert }:
+{ lib, stdenvNoCC, linkFarmFromDrvs, callPackage, nuget-to-nix, writeScript, makeWrapper, fetchurl, xml2, dotnetCorePackages, dotnetPackages, mkNugetSource, mkNugetDeps, cacert }:
 
 { name ? "${args.pname}-${args.version}"
 , pname ? name
@@ -74,40 +74,13 @@ let
     inherit dotnet-sdk dotnet-test-sdk disabledTests nuget-source dotnet-runtime runtimeDeps buildType;
   }) dotnetConfigureHook dotnetBuildHook dotnetCheckHook dotnetInstallHook dotnetFixupHook;
 
-  _nugetDeps = linkFarmFromDrvs "${name}-nuget-deps" (import nugetDeps {
-    fetchNuGet = { pname, version, sha256 }: fetchurl {
-      name = "${pname}-${version}.nupkg";
-      url = "https://www.nuget.org/api/v2/package/${pname}/${version}";
-      inherit sha256;
-    };
-  });
+  _nugetDeps = mkNugetDeps { name = "${name}-nuget-deps"; nugetDeps = import nugetDeps; };
   _localDeps = linkFarmFromDrvs "${name}-local-nuget-deps" projectReferences;
 
-  nuget-source = stdenvNoCC.mkDerivation rec {
-    name = "${pname}-nuget-source";
-    meta.description = "A Nuget source with the dependencies for ${pname}";
-
-    nativeBuildInputs = [ dotnetPackages.Nuget xml2 ];
-    buildCommand = ''
-      export HOME=$(mktemp -d)
-      mkdir -p $out/{lib,share}
-
-      nuget sources Add -Name nixos -Source "$out/lib"
-      nuget init "${_nugetDeps}" "$out/lib"
-      ${lib.optionalString (projectReferences != [])
-        "nuget init \"${_localDeps}\" \"$out/lib\""}
-
-      # Generates a list of all unique licenses' spdx ids.
-      find "$out/lib" -name "*.nuspec" -exec sh -c \
-        "xml2 < {} | grep "license=" | cut -d'=' -f2" \; | sort -u > $out/share/licenses
-    '';
-  } // { # This is done because we need data from `$out` for `meta`. We have to use overrides as to not hit infinite recursion.
-    meta.licence = let
-      depLicenses = lib.splitString "\n" (builtins.readFile "${nuget-source}/share/licenses");
-      getLicence = spdx: lib.filter (license: license.spdxId or null == spdx) (builtins.attrValues lib.licenses);
-    in (lib.flatten (lib.forEach depLicenses (spdx:
-      if (getLicence spdx) != [] then (getLicence spdx) else [] ++ lib.optional (spdx != "") spdx
-    )));
+  nuget-source = mkNugetSource {
+    name = "${args.pname}-nuget-source";
+    description = "A Nuget source with the dependencies for ${args.pname}";
+    deps = [ _nugetDeps _localDeps ];
   };
 
 in stdenvNoCC.mkDerivation (args // {
@@ -158,7 +131,6 @@ in stdenvNoCC.mkDerivation (args // {
           ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
           -p:ContinuousIntegrationBuild=true \
           -p:Deterministic=true \
-          -p:RestoreUseStaticGraphEvaluation=true \
           --packages "$HOME/nuget_pkgs" \
           ${lib.optionalString (dotnetRestoreFlags != []) (builtins.toString dotnetRestoreFlags)} \
           ${lib.optionalString (dotnetFlags != []) (builtins.toString dotnetFlags)}

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh

@@ -16,7 +16,6 @@ dotnetConfigureHook() {
             dotnet restore "$project" \
                 -p:ContinuousIntegrationBuild=true \
                 -p:Deterministic=true \
-                -p:RestoreUseStaticGraphEvaluation=true \
                 --source "@nugetSource@/lib" \
                 ${parallelFlag-} \
                 "${dotnetRestoreFlags[@]}" \

pkgs/build-support/dotnet/make-nuget-deps/default.nix

@@ -0,0 +1,9 @@
+{ linkFarmFromDrvs, fetchurl }:
+{ name, nugetDeps }:
+  linkFarmFromDrvs "${name}-nuget-deps" (nugetDeps {
+    fetchNuGet = { pname, version, sha256 }: fetchurl {
+      name = "${pname}-${version}.nupkg";
+      url = "https://www.nuget.org/api/v2/package/${pname}/${version}";
+      inherit sha256;
+    };
+  })

pkgs/build-support/dotnet/make-nuget-source/default.nix

@@ -0,0 +1,30 @@
+{ dotnetPackages, lib, xml2, stdenvNoCC }:
+{ name, description ? "", deps ? [] }:
+let
+  _nuget-source = stdenvNoCC.mkDerivation rec {
+    inherit name;
+    meta.description = description;
+
+    nativeBuildInputs = [ dotnetPackages.Nuget xml2 ];
+    buildCommand = ''
+      export HOME=$(mktemp -d)
+      mkdir -p $out/{lib,share}
+
+      nuget sources Add -Name nixos -Source "$out/lib"
+      ${ lib.concatMapStringsSep "\n" (dep:
+          ''nuget init "${dep}" "$out/lib"''
+        ) deps }
+
+      # Generates a list of all unique licenses' spdx ids.
+      find "$out/lib" -name "*.nuspec" -exec sh -c \
+        "xml2 < {} | grep "license=" | cut -d'=' -f2" \; | sort -u > $out/share/licenses
+    '';
+} // { # This is done because we need data from `$out` for `meta`. We have to use overrides as to not hit infinite recursion.
+  meta.licence = let
+    depLicenses = lib.splitString "\n" (builtins.readFile "${_nuget-source}/share/licenses");
+    getLicence = spdx: lib.filter (license: license.spdxId or null == spdx) (builtins.attrValues lib.licenses);
+  in (lib.flatten (lib.forEach depLicenses (spdx:
+    if (getLicence spdx) != [] then (getLicence spdx) else [] ++ lib.optional (spdx != "") spdx
+  )));
+};
+in _nuget-source

pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix

@@ -4,33 +4,34 @@ let
   pListText = lib.generators.toPlist { } {
     CFBundleDevelopmentRegion = "English";
     CFBundleExecutable = "$name";
-    CFBundleIconFiles = [ "$iconPlistArray" ];
+    CFBundleIconFile = "$icon";
     CFBundleIdentifier = "org.nixos.$name";
     CFBundleInfoDictionaryVersion = "6.0";
     CFBundleName = "$name";
     CFBundlePackageType = "APPL";
     CFBundleSignature = "???";
   };
-
-# The generation of the CFBundleIconFiles array is a bit of a hack, since we
-# will always end up with an empty first element (<string></string>) but macOS
-# appears to ignore this which allows us to use the nix PList generator.
 in writeScriptBin "write-darwin-bundle" ''
     shopt -s nullglob
 
-    readonly prefix="$1"
-    readonly name="$2"
-    readonly exec="$3"
-    iconPlistArray=""
+    readonly prefix=$1
+    readonly name=$2
+    readonly exec=$3
+    readonly icon=$4.icns
+    readonly squircle=''${5:-1}
+    readonly plist=$prefix/Applications/$name.app/Contents/Info.plist
 
-    for icon in "$prefix/Applications/$name.app/Contents/Resources"/*; do
-        iconPlistArray="$iconPlistArray</string><string>"$(basename "$icon")""
-    done
-
-    cat > "$prefix/Applications/$name.app/Contents/Info.plist" <<EOF
+    cat > "$plist" <<EOF
 ${pListText}
 EOF
 
+  if [[ $squircle != 0 && $squircle != "false" ]]; then
+    sed  "
+      s|CFBundleIconFile|CFBundleIconFiles|;
+      s|<string>$icon</string>|<array><string>$icon</string></array>|
+    " -i "$plist"
+  fi
+
     cat > "$prefix/Applications/$name.app/Contents/MacOS/$name" <<EOF
 #!/bin/bash
 exec $prefix/bin/$exec

pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh

@@ -10,31 +10,156 @@ getDesktopParam() {
     awk -F "=" "/${pattern}/ {print \$2}" "${file}"
 }
 
+# Convert a freedesktop.org icon theme for a given app to a .icns file. When possible, missing
+# icons are synthesized from SVG or rescaled from existing ones (when within the size threshold).
+convertIconTheme() {
+    local -r out=$1
+    local -r sharePath=$2
+    local -r iconName=$3
+    local -r theme=${4:-hicolor}
+
+    local -ra iconSizes=(16 32 48 128 256 512)
+    local -ra scales=([1]="" [2]="@2")
+
+    # Based loosely on the algorithm at:
+    # https://specifications.freedesktop.org/icon-theme-spec/icon-theme-spec-latest.html#icon_lookup
+    # Assumes threshold = 2 for ease of implementation.
+    function findIcon() {
+        local -r iconSize=$1
+        local -r scale=$2
+
+        local scaleSuffix=${scales[$scale]}
+        local exactSize=${iconSize}x${iconSize}${scaleSuffix}
+
+        if [[ $exactSize = '48x48@2' ]]; then
+            # macOS does not support a 2x scale variant of 48x48 icons
+            # See: https://en.wikipedia.org/wiki/Apple_Icon_Image_format#Icon_types
+            echo "unsupported"
+            return 0
+        fi
+
+        local -a validSizes=(
+            ${exactSize}
+            $((iconSize + 1))x$((iconSize + 1))${scaleSuffix}
+            $((iconSize + 2))x$((iconSize + 2))${scaleSuffix}
+            $((iconSize - 1))x$((iconSize - 1))${scaleSuffix}
+            $((iconSize - 2))x$((iconSize - 2))${scaleSuffix}
+        )
+
+        for iconIndex in "${!candidateIcons[@]}"; do
+            for maybeSize in "${validSizes[@]}"; do
+                icon=${candidateIcons[$iconIndex]}
+                if [[ $icon = */$maybeSize/* ]]; then
+                    if [[ $maybeSize = $exactSize ]]; then
+                        echo "fixed $icon"
+                    else
+                        echo "threshold $icon"
+                    fi
+                    return 0
+                fi
+            done
+        done
+        echo "scalable"
+    }
+
+    function resizeIcon() {
+        local -r in=$1
+        local -r out=$2
+        local -r iconSize=$3
+        local -r scale=$4
+
+        local density=$((72 * scale))x$((72 * scale))
+        local dim=$((iconSize * scale))
+
+        magick convert -scale "${dim}x${dim}" -density "$density" -units PixelsPerInch "$in" "$out"
+    }
+
+    function synthesizeIcon() {
+        local -r in=$1
+        local -r out=$2
+        local -r iconSize=$3
+        local -r scale=$4
+
+        if [[ $in != '-' ]]; then
+            local density=$((72 * scale))x$((72 * scale))
+            local dim=$((iconSize * scale))
+            rsvg-convert --keep-aspect-ratio --width "$dim" --height "$dim" "$in" --output "$out"
+            magick convert -density "$density" -units PixelsPerInch "$out" "$out"
+        else
+            return 1
+        fi
+    }
+
+    function getIcons() {
+        local -r sharePath=$1
+        local -r iconname=$2
+        local -r theme=$3
+        local -r resultdir=$(mktemp -d)
+
+        local -ar candidateIcons=(
+            "${sharePath}/icons/${theme}/"*"/${iconname}.png"
+            "${sharePath}/icons/${theme}/"*"/${iconname}.xpm"
+        )
+
+        local -a scalableIcon=("${sharePath}/icons/${theme}/scalable/${iconname}.svg"*)
+        if [[ ${#scalableIcon[@]} = 0 ]]; then
+            scalableIcon=('-')
+        fi
+
+        for iconSize in "${iconSizes[@]}"; do
+            for scale in "${!scales[@]}"; do
+                local iconResult=$(findIcon $iconSize $scale)
+                local type=${iconResult%% *}
+                local icon=${iconResult#* }
+                local scaleSuffix=${scales[$scale]}
+                local result=${resultdir}/${iconSize}x${iconSize}${scales[$scale]}${scaleSuffix:+x}.png
+                case $type in
+                    fixed)
+                        local density=$((72 * scale))x$((72 * scale))
+                        magick convert -density "$density" -units PixelsPerInch "$icon" "$result"
+                        ;;
+                    threshold)
+                        # Synthesize an icon of the exact size if a scalable icon is available
+                        # instead of scaling one and ending up with a fuzzy icon.
+                        if ! synthesizeIcon "${scalableIcon[0]}" "$result" "$iconSize" "$scale"; then
+                            resizeIcon "$icon" "$result" "$iconSize" "$scale"
+                        fi
+                        ;;
+                    scalable)
+                        synthesizeIcon "${scalableIcon[0]}" "$result" "$iconSize" "$scale" || true
+                        ;;
+                    *)
+                        ;;
+                esac
+            done
+        done
+        echo "$resultdir"
+    }
+
+    iconsdir=$(getIcons "$sharePath" "apps/${iconName}" "$theme")
+    if [[ ! -z "$(ls -1 "$iconsdir/"*)" ]]; then
+        icnsutil compose "$out/${iconName}.icns" "$iconsdir/"*
+    else
+        echo "Warning: no icons were found. Creating an empty icon for ${iconName}.icns."
+        touch "$out/${iconName}.icns"
+    fi
+}
+
 # For a given .desktop file, generate a darwin '.app' bundle for it.
 convertDesktopFile() {
-    local -r file="$1"
+    local -r file=$1
+    local -r sharePath=$(dirname "$(dirname "$file")")
     local -r name=$(getDesktopParam "${file}" "^Name")
     local -r exec=$(getDesktopParam "${file}" "Exec")
-    local -r iconName=$(getDesktopParam "${file}" "Icon")
-    local -r iconFiles=$(find "$out/share/icons/" -name "${iconName}.*" 2>/dev/null);
-    local -r pixMaps=$(find "$out/share/pixmaps/" -name "${iconName}.xpm" 2>/dev/null);
+    local -r iconName=$(getDesktopParam "${file}" "^Icon")
+    local -r squircle=$(getDesktopParam "${file}" "X-macOS-SquircleIcon")
 
     mkdir -p "$out/Applications/${name}.app/Contents/MacOS"
     mkdir -p "$out/Applications/${name}.app/Contents/Resources"
 
-    local i=0;
-    for icon in $iconFiles; do
-      ln -s "$icon" "$out/Applications/${name}.app/Contents/Resources/$i-$(basename "$icon")"
-      (( i +=1 ));
-    done
+    convertIconTheme "$out/Applications/${name}.app/Contents/Resources" "$sharePath" "$iconName"
 
-    for pixmap in $pixMaps; do
-      local newIconName="$i-$(basename "$pixmap")";
-      convert "$pixmap" "$out/Applications/${name}.app/Contents/Resources/${newIconName%.xpm}.png"
-      (( i +=1 ));
-    done
-
-    write-darwin-bundle "$out" "$name" "$exec"
+    write-darwin-bundle "$out" "$name" "$exec" "$iconName" "$squircle"
 }
 
 convertDesktopFiles() {

pkgs/build-support/writers/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, buildPackages, lib, stdenv, libiconv, gawk, gnused, gixy }:
+{ pkgs, config, buildPackages, lib, stdenv, libiconv, mkNugetDeps, mkNugetSource, gawk, gnused, gixy }:
 
 let
   aliases = if (config.allowAliases or true) then (import ./aliases.nix lib) else prev: {};
@@ -301,6 +301,42 @@ let
   writePyPy3Bin = name:
     writePyPy3 "/bin/${name}";
 
+
+  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [] }: nameOrPath:
+  let
+    fname = last (builtins.split "/" nameOrPath);
+    path = if strings.hasSuffix ".fsx" nameOrPath then nameOrPath else "${nameOrPath}.fsx";
+    _nugetDeps = mkNugetDeps { name = "${fname}-nuget-deps"; nugetDeps = libraries; };
+
+    nuget-source = mkNugetSource {
+      name = "${fname}-nuget-source";
+      description = "A Nuget source with the dependencies for ${fname}";
+      deps = [ _nugetDeps ];
+    };
+
+    fsi = writeBash "fsi" ''
+      export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
+      export DOTNET_CLI_TELEMETRY_OPTOUT=1
+      export DOTNET_NOLOGO=1
+      script="$1"; shift
+      ${dotnet-sdk}/bin/dotnet fsi --quiet --nologo --readline- ${fsi-flags} "$@" < "$script"
+    '';
+
+  in content: writers.makeScriptWriter {
+    interpreter = fsi;
+  } path
+  ''
+    #i "nuget: ${nuget-source}/lib"
+    ${ content }
+    exit 0
+  '';
+
+  writeFSharp =
+    makeFSharpWriter {};
+
+  writeFSharpBin = name:
+    writeFSharp "/bin/${name}";
+
 };
 in
 writers // (aliases writers)

pkgs/build-support/writers/test.nix

@@ -150,6 +150,29 @@ let
       print(y[0]['test'])
     '';
 
+    fsharp = makeFSharpWriter {
+      libraries = { fetchNuGet }: [
+        (fetchNuGet { pname = "FSharp.SystemTextJson"; version = "0.17.4"; sha256 = "1bplzc9ybdqspii4q28l8gmfvzpkmgq5l1hlsiyg2h46w881lwg2"; })
+      ];
+    } "test-writers-fsharp" ''
+      #r "nuget: FSharp.SystemTextJson, 0.17.4"
+
+      module Json =
+          open System.Text.Json
+          open System.Text.Json.Serialization
+          let options = JsonSerializerOptions()
+          options.Converters.Add(JsonFSharpConverter())
+          let serialize<'a> (o: 'a) = JsonSerializer.Serialize<'a>(o, options)
+          let deserialize<'a> (str: string) = JsonSerializer.Deserialize<'a>(str, options)
+
+      type Letter = A | B
+      let a = {| Hello = Some "World"; Letter = A |}
+      if a |> Json.serialize |> Json.deserialize |> (=) a
+      then "success"
+      else "failed"
+      |> printfn "%s"
+    '';
+
     pypy2NoLibs = writePyPy2 "test-writers-pypy2-no-libs" {} ''
       print("success")
     '';
@@ -161,6 +184,10 @@ let
     pypy3NoLibs = writePyPy3 "test-writers-pypy3-no-libs" {} ''
       print("success")
     '';
+
+    fsharpNoNugetDeps = writeFSharp "test-writers-fsharp-no-nuget-deps" ''
+      printfn "success"
+    '';
   };
 
 

pkgs/desktops/pantheon/apps/appcenter/default.nix

@@ -7,6 +7,7 @@
 , desktop-file-utils
 , elementary-icon-theme
 , fetchFromGitHub
+, fetchpatch
 , flatpak
 , gettext
 , glib
@@ -38,6 +39,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-xktIHQHmz5gh72NEz9UQ9fMvBlj1BihWxHgxsHmTIB0=";
   };
 
+  patches = [
+    # Fix AppStream.PoolFlags being renamed
+    # Though the API break has been fixed in latest appstream,
+    # let's use the non-deprecated version anyway.
+    # https://github.com/elementary/appcenter/pull/1794
+    (fetchpatch {
+      url = "https://github.com/elementary/appcenter/commit/84bc6400713484aa9365f0ba73f59c495da3f08b.patch";
+      sha256 = "sha256-HNRCJ/5mRbEVjCq9nrXtdQOOk1Jj5jalApkghD8ecpk=";
+    })
+  ];
+
   nativeBuildInputs = [
     appstream-glib
     dbus # for pkg-config

pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , linkFarm
 , substituteAll
@@ -31,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-greeter";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "greeter";
     rev = version;
-    sha256 = "1f606ds56sp1c58q8dblfpaq9pwwkqw9i4gkwksw45m2xkwlbflq";
+    sha256 = "sha256-0chBM8JuCYgZXHneiSxSICZwBVm2Vgx+bas9wUjbnyg=";
   };
 
   patches = [
@@ -47,15 +46,6 @@ stdenv.mkDerivation rec {
       src = ./hardcode-fallback-background.patch;
       default_wallpaper = "${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}";
     })
-    # https://github.com/NixOS/nixpkgs/issues/151609
-    # https://github.com/elementary/greeter/issues/578#issuecomment-1030746697
-    ./fix-crash.patch
-    # Fix build with meson 0.61
-    # https://github.com/elementary/greeter/pull/590
-    (fetchpatch {
-      url = "https://github.com/elementary/greeter/commit/a4b25244058fce794a9f13f6b22a8ff7735ebde9.patch";
-      sha256 = "sha256-qPXhdvmYG8YMDU/CjbEkfZ0glgRzxnu0TsOPtvWHxLY=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -80,7 +70,6 @@ stdenv.mkDerivation rec {
     libhandy
     lightdm
     mutter
-    wingpanel-with-indicators
   ];
 
   mesonFlags = [

pkgs/desktops/pantheon/desktop/elementary-greeter/fix-crash.patch

@@ -1,21 +0,0 @@
-diff --git a/src/Cards/UserCard.vala b/src/Cards/UserCard.vala
-index 83df22c..8cd917e 100644
---- a/src/Cards/UserCard.vala
-+++ b/src/Cards/UserCard.vala
-@@ -42,6 +42,7 @@ public class Greeter.UserCard : Greeter.BaseCard {
-     private Gtk.Stack login_stack;
-     private Greeter.PasswordEntry password_entry;
- 
-+    private SelectionCheck logged_in;
-     private unowned Gtk.StyleContext logged_in_context;
-     private weak Gtk.StyleContext main_grid_style_context;
-     private weak Gtk.StyleContext password_entry_context;
-@@ -214,7 +215,7 @@ public class Greeter.UserCard : Greeter.BaseCard {
-         };
-         avatar_overlay.add (avatar);
- 
--        var logged_in = new SelectionCheck () {
-+        logged_in = new SelectionCheck () {
-             halign = Gtk.Align.END,
-             valign = Gtk.Align.END
-         };

pkgs/development/interpreters/clisp/default.nix

@@ -24,11 +24,11 @@ assert x11Support -> (libX11 != null && libXau != null && libXt != null
   && libXpm != null && xorgproto != null && libXext != null);
 
 stdenv.mkDerivation rec {
-  v = "2.49";
-  name = "clisp-${v}";
+  version = "2.49";
+  pname = "clisp";
 
   src = fetchurl {
-    url = "mirror://gnu/clisp/release/${v}/${name}.tar.bz2";
+    url = "mirror://gnu/clisp/release/${version}/clisp-${version}.tar.bz2";
     sha256 = "8132ff353afaa70e6b19367a25ae3d5a43627279c25647c220641fed00f8e890";
   };
 

pkgs/development/interpreters/clisp/hg.nix

@@ -23,8 +23,8 @@ assert x11Support -> (libX11 != null && libXau != null && libXt != null
   && libXpm != null && xorgproto != null && libXext != null);
 
 stdenv.mkDerivation rec {
-  v = "2.50pre20171114";
-  name = "clisp-${v}";
+  version = "2.50pre20171114";
+  pname = "clisp";
 
   src = fetchhg {
     url = "http://hg.code.sf.net/p/clisp/clisp";

pkgs/development/libraries/febio/default.nix

@@ -0,0 +1,55 @@
+{ lib, stdenv, fetchFromGitHub, cmake, boost, eigen, libxml2, mpi, python3
+, mklSupport ? true, mkl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "FEBio";
+  version = "3.6";
+
+  src = fetchFromGitHub {
+    owner = "febiosoftware";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "187s4lyzr806xla3smq3lsvj3f6wxlhfkban89w0fnyfmfb8w9am";
+  };
+
+  patches = [
+    ./fix-cmake.patch  # cannot find mkl libraries without this
+  ];
+
+  cmakeFlags = lib.optional mklSupport "-DUSE_MKL=On"
+    ++ lib.optional mklSupport "-DMKLROOT=${mkl}"
+  ;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/include
+    cp -R lib bin $out/
+    cp -R ../FECore \
+      ../FEBioFluid \
+      ../FEBioLib \
+      ../FEBioMech \
+      ../FEBioMix \
+      ../FEBioOpt \
+      ../FEBioPlot \
+      ../FEBioXML \
+      ../NumCore \
+      $out/include
+
+    runHook postInstall
+  '';
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ boost eigen libxml2 mpi python3 python3.pkgs.numpy ]
+   ++ lib.optional mklSupport mkl
+  ;
+
+  meta = {
+    description = "FEBio Suite Solver";
+    license = with lib.licenses; [ mit ];
+    homepage = "https://febio.org/";
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ Scriptkiddi ];
+  };
+}

pkgs/development/libraries/febio/fix-cmake.patch

@@ -0,0 +1,26 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -47,7 +47,7 @@ function(findLib libName libDir libOut)
+         find_library(TEMP NAMES ${libName}.lib ${ARGV3}.lib ${ARGV4}.lib ${ARGV5}.lib ${ARGV6}.lib
+             PATHS ${${libDir}} NO_DEFAULT_PATH)
+     else()
+-        find_library(TEMP NAMES lib${libName}.a lib${ARGV3}.a lib${ARGV4}.a lib${ARGV5}.a lib${ARGV6}.a
++        find_library(TEMP NAMES lib${libName}.a lib${ARGV3}.a lib${ARGV4}.a lib${ARGV5}.a lib${ARGV6}.a lib${libName}.so lib${ARGV3}.so lib${ARGV4}.so lib${ARGV5}.so lib${ARGV6}.so
+             PATHS ${${libDir}} NO_DEFAULT_PATH)
+     endif()
+     
+diff --git a/FindDependencies.cmake b/FindDependencies.cmake
+index 2d644005f..7261ba923 100644
+--- a/FindDependencies.cmake
++++ b/FindDependencies.cmake
+@@ -46,8 +46,8 @@ if(MKLROOT)
+             NO_DEFAULT_PATH)
+             
+         find_library(MKL_OMP_LIB 
+-            NAMES iomp5 iomp5md libiomp5md.lib
+-            PATHS ${MKLROOT}/../lib ${MKLROOT}/../compiler/lib
++            NAMES libiomp5.so libiomp5 iomp5 iomp5md libiomp5md.lib
++            PATHS ${MKLROOT}/lib ${MKLROOT}/../lib ${MKLROOT}/../compiler/lib
+             PATH_SUFFIXES "intel64" "intel32"
+             NO_DEFAULT_PATH
+             DOC "MKL OMP Library")

pkgs/development/libraries/libpulsar/default.nix

@@ -0,0 +1,102 @@
+{ lib
+, clang-tools
+, llvmPackages
+, boost17x
+, protobuf
+, python3Support ? false
+, python3
+, log4cxxSupport ? false
+, log4cxx
+, snappySupport ? false
+, snappy
+, zlibSupport ? true
+, zlib
+, zstdSupport ? true
+, zstd
+, gtest
+, gtestSupport ? false
+, cmake
+, curl
+, fetchurl
+, jsoncpp
+, openssl
+, pkg-config
+, stdenv
+}:
+
+let
+  /*
+    Check if null or false
+    Example:
+    let result = enableFeature null
+    => "OFF"
+    let result = enableFeature false
+    => "OFF"
+    let result = enableFeature «derivation»
+    => "ON"
+  */
+  enableCmakeFeature = p: if (p == null || p == false) then "OFF" else "ON";
+
+  # Not really sure why I need to do this.. If I call clang-tools without the override it defaults to a different version and fails
+  clangTools = clang-tools.override { inherit stdenv llvmPackages; };
+  # If boost has python enabled, then boost-python package will be installed which is used by libpulsars python wrapper
+  boost = if python3Support then boost17x.override { inherit stdenv; enablePython = python3Support; python = python3; } else boost17x;
+  defaultOptionals = [ boost protobuf ]
+    ++ lib.optional python3Support python3
+    ++ lib.optional snappySupport snappy.dev
+    ++ lib.optional zlibSupport zlib
+    ++ lib.optional zstdSupport zstd
+    ++ lib.optional log4cxxSupport log4cxx;
+
+in
+stdenv.mkDerivation rec {
+  pname = "libpulsar";
+  version = "2.9.1";
+
+  src = fetchurl {
+    hash = "sha512-NKHiL7D/Lmnn6ICpQyUmmQYQETz4nZPJU9/4LMRDUQ3Pck6qDh+t6CRk+b9UQ2Vb0jvPIGTjEsSp2nC7TJk3ug==";
+    url = "mirror://apache/pulsar/pulsar-${version}/apache-pulsar-${version}-src.tar.gz";
+  };
+
+  sourceRoot = "apache-pulsar-${version}-src/pulsar-client-cpp";
+
+  # clang-tools needed for clang-format
+  nativeBuildInputs = [ cmake pkg-config clangTools ]
+    ++ defaultOptionals
+    ++ lib.optional gtestSupport gtest.dev;
+
+  buildInputs = [ jsoncpp openssl curl ]
+    ++ defaultOptionals;
+
+  # Needed for GCC on Linux
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=return-type" ];
+
+  cmakeFlags = [
+    "-DBUILD_TESTS=${enableCmakeFeature gtestSupport}"
+    "-DBUILD_PYTHON_WRAPPER=${enableCmakeFeature python3Support}"
+    "-DUSE_LOG4CXX=${enableCmakeFeature log4cxxSupport}"
+    "-DClangTools_PATH=${clangTools}/bin"
+  ];
+
+  enableParallelBuilding = true;
+  doInstallCheck = true;
+  installCheckPhase = ''
+    echo ${lib.escapeShellArg ''
+      #include <pulsar/Client.h>
+      int main (int argc, char **argv) {
+        pulsar::Client client("pulsar://localhost:6650");
+        return 0;
+      }
+    ''} > test.cc
+    $CXX test.cc -L $out/lib -I $out/include -lpulsar -o test
+  '';
+
+  meta = with lib; {
+    homepage = "https://pulsar.apache.org/docs/en/client-libraries-cpp";
+    description = "Apache Pulsar C++ library";
+
+    platforms = platforms.all;
+    license = licenses.asl20;
+    maintainers = [ maintainers.corbanr ];
+  };
+}

pkgs/development/libraries/mimalloc/default.nix

@@ -1,4 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, ninja
+, fetchpatch
 , secureBuild ? false
 }:
 
@@ -7,14 +8,28 @@ let
 in
 stdenv.mkDerivation rec {
   pname   = "mimalloc";
-  version = "2.0.2";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner  = "microsoft";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-n4FGld3bq6ZOSLTzXcVlucCGbQ5/eSFbijU0dfBD/T0=";
+    sha256 = "sha256-q3W/w1Ofqt6EbKF/Jf9wcC+7jAxh59B3cOGxudWQXlA=";
   };
+  patches = [
+    (fetchpatch {
+      name = "older-macos-fixes.patch";
+      url = "https://github.com/microsoft/mimalloc/commit/40e0507a5959ee218f308d33aec212c3ebeef3bb.patch";
+      sha256 = "15qx2a3axhhwbfzxdis98b8j14y9cfgca0i484aj2pjpqnm0pb8c";
+    })
+  ];
+
+  doCheck = true;
+  preCheck = let
+    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+  in ''
+    export ${ldLibraryPathEnv}="$(pwd)/build:''${${ldLibraryPathEnv}}"
+  '';
 
   nativeBuildInputs = [ cmake ninja ];
   cmakeFlags = [ "-DMI_INSTALL_TOPLEVEL=ON" ] ++ lib.optional secureBuild [ "-DMI_SECURE=ON" ];
@@ -25,10 +40,9 @@ stdenv.mkDerivation rec {
   in ''
     # first, move headers and cmake files, that's easy
     mkdir -p $dev/lib
-    mv $out/include $dev/include
-    mv $out/cmake $dev/lib/
+    mv $out/lib/cmake $dev/lib/
 
-    find $out/lib
+    find $dev $out -type f
   '' + (lib.optionalString secureBuild ''
     # pretend we're normal mimalloc
     ln -sfv $out/lib/libmimalloc-secure${suffix} $out/lib/libmimalloc${suffix}
@@ -44,6 +58,6 @@ stdenv.mkDerivation rec {
     homepage    = "https://github.com/microsoft/mimalloc";
     license     = licenses.bsd2;
     platforms   = platforms.unix;
-    maintainers = with maintainers; [ thoughtpolice ];
+    maintainers = with maintainers; [ kamadorueda thoughtpolice ];
   };
 }

pkgs/development/php-packages/swoole/default.nix

@@ -3,8 +3,8 @@
 buildPecl {
   pname = "swoole";
 
-  version = "4.8.6";
-  sha256 = "sha256-4ot8LXpWcjMmD3e/EzrYNMxqUPPupQQkv2ibLkZoWxs=";
+  version = "4.8.7";
+  sha256 = "sha256-yoiMuIbIgwkuvoeIJT1gC8UsOE504nEQ+XsE7Oprb9o=";
 
   buildInputs = [ pcre2 ] ++ lib.optionals (!stdenv.isDarwin) [ valgrind ];
   internalDeps = lib.optionals (lib.versionOlder php.version "7.4") [ php.extensions.hash ];

pkgs/development/python-modules/adafruit-io/default.nix

@@ -0,0 +1,57 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, paho-mqtt
+, pytestCheckHook
+, pythonOlder
+, requests
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "adafruit-io";
+  version = "2.6.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "adafruit";
+    repo = "Adafruit_IO_Python";
+    rev = version;
+    hash = "sha256-tjm+HvUuLK3IxXwuxPidJaBetj+n0BzKOuLj75bM7a8=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    paho-mqtt
+    requests
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "Adafruit_IO"
+  ];
+
+  disabledTestPaths = [
+    # Tests requires valid credentials
+    "tests/test_client.py"
+    "tests/test_errors.py"
+    "tests/test_mqtt_client.py"
+  ];
+
+  meta = with lib; {
+    description = "Module for interacting with Adafruit IO";
+    homepage = "https://github.com/adafruit/Adafruit_IO_Python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/adafruit-platformdetect/default.nix

@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.20.0";
+  version = "3.20.1";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    sha256 = "sha256-bbzEI/Ig7yQn4/fRmX8tIe6UL+J8iV1TbrCXBU+oLms=";
+    sha256 = "sha256-P5OWPsbRsTEMcvw7/uq0rj9p/4beVj/2OdWkllVMKMw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/fleep/0001-Fixing-paths-on-tests.patch

@@ -0,0 +1,48 @@
+From 716fcfa3203bc881b543916bdb9a17460951cd26 Mon Sep 17 00:00:00 2001
+From: "P. R. d. O" <d.ol.rod@protonmail.com>
+Date: Fri, 26 Nov 2021 07:13:32 -0600
+Subject: [PATCH] Fixing paths on tests
+
+---
+ tests/maintest.py  | 7 ++++++-
+ tests/speedtest.py | 7 ++++++-
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/tests/maintest.py b/tests/maintest.py
+index 0e24ca4..3484437 100644
+--- a/tests/maintest.py
++++ b/tests/maintest.py
+@@ -1,6 +1,11 @@
+ import fleep
++import os
+ 
+-with open("testfile", "rb") as file:
++current_dir = os.path.realpath(os.path.join(os.getcwd(),
++                                            os.path.dirname(__file__)))
++
++with open(os.path.join(current_dir, "./testfile"),
++          "rb") as file:
+     info = fleep.get(file.read(128))
+ 
+ assert info.type == ["raster-image"]
+diff --git a/tests/speedtest.py b/tests/speedtest.py
+index 89338ab..829d563 100644
+--- a/tests/speedtest.py
++++ b/tests/speedtest.py
+@@ -1,7 +1,12 @@
+ import time
+ import fleep
++import os
+ 
+-with open("testfile", "rb") as file:
++current_dir = os.path.realpath(os.path.join(os.getcwd(),
++                                            os.path.dirname(__file__)))
++
++with open(os.path.join(current_dir, "./testfile"),
++          "rb") as file:
+     stream = file.read(128)
+ 
+ times = []
+-- 
+2.33.1
+

pkgs/development/python-modules/fleep/default.nix

@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "fleep";
+  version = "1.0.1";
+
+  # Pypi version does not have tests
+  src = fetchFromGitHub {
+    owner = "floyernick";
+    repo = "fleep-py";
+    rev = "994bc2c274482d80ab13d89d8f7343eb316d3e44";
+    sha256 = "sha256-TaU7njx98nxkhZawGMFqWj4g+yCtIX9aPWQHoamzfMY=";
+  };
+
+  patches = [
+    ./0001-Fixing-paths-on-tests.patch
+  ];
+
+  checkPhase = ''
+    ${python.interpreter} tests/maintest.py
+    ${python.interpreter} tests/speedtest.py
+  '';
+
+  pythonImportsCheck = [ "fleep" ];
+
+  meta = with lib; {
+    description = "File format determination library";
+    homepage = "https://github.com/floyernick/fleep-py";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wolfangaukang ];
+  };
+}

pkgs/development/python-modules/graphql-subscription-manager/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "graphql-subscription-manager";
-  version = "0.5.0";
+  version = "0.5.1";
 
   disabled = pythonOlder "3.7";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "PyGraphqlWebsocketManager";
     rev = version;
-    sha256 = "sha256-18GR0OZeEh6EQT0kKCJyq7ckvKYKDJn/lugN5xlRg64=";
+    sha256 = "sha256-PVQa6JmBnToXuL/wNkYO0b+K1e9yrQgRUzWNUbFN5mM=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/icnsutil/default.nix

@@ -0,0 +1,31 @@
+{ lib
+, python
+, fetchFromGitHub
+, buildPythonPackage
+}:
+
+buildPythonPackage rec {
+  pname = "icnsutil";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "relikd";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-TfQvAbP7iCpRQg2G+ejl245NCYo9DpYwMgiwY2BuJnY=";
+  };
+
+  doCheck = true;
+
+  checkPhase = ''
+    ${python.interpreter} tests/test_icnsutil.py
+    ${python.interpreter} tests/test_cli.py
+  '';
+
+  meta = {
+    homepage = "https://github.com/relikd/icnsutil";
+    description = "Create and extract .icns files.";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.reckenrode ];
+  };
+}

pkgs/development/python-modules/jschema-to-python/default.nix

@@ -15,13 +15,10 @@ buildPythonPackage rec {
     sha256 = "76ff14fe5d304708ccad1284e4b11f96a658949a31ee7faed9e0995279549b91";
   };
 
-  nativeBuildInputs = [
-    pbr
-  ];
-
   propagatedBuildInputs = [
     attrs
     jsonpickle
+    pbr
   ];
 
   checkInputs =[

pkgs/development/python-modules/meshtastic/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "1.2.87";
+  version = "1.2.88";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = version;
-    sha256 = "sha256-W56nTTbRcSRkT15xn24ywkIVNHRUavV5Z8EST3BFkjk=";
+    sha256 = "sha256-iNDS1QjlDiXb89g7Gut+5ShbgtCCHBSJuQmXfHaTXB8=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/mypy-boto3-builder/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.1.2";
+  version = "7.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "vemel";
     repo = "mypy_boto3_builder";
     rev = version;
-    hash = "sha256-p81Dk6Kv0MzHvexhM8Su5/yIpB+ZGBFqOtm0D18l26s=";
+    hash = "sha256-jovvSNw2ahCwhA+9zOrn9bR2siXJetZPymQVG4EC9Us=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/nextcord/default.nix

@@ -0,0 +1,64 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, substituteAll
+, ffmpeg
+, libopus
+, aiohttp
+, aiodns
+, brotli
+, cchardet
+, orjson
+, pynacl
+}:
+
+buildPythonPackage rec {
+  pname = "nextcord";
+  version = "2.0.0a8";
+
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "nextcord";
+    repo = "nextcord";
+    rev = version;
+    hash = "sha256-aYFY58zWZlZwW3xwa1iAK4w29AofKIkTyCjQ2nR8JrY=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./paths.patch;
+      ffmpeg = "${ffmpeg}/bin/ffmpeg";
+      libopus = "${libopus}/lib/libopus${stdenv.hostPlatform.extensions.sharedLibrary}";
+    })
+  ];
+
+  propagatedBuildInputs = [
+    aiodns
+    aiohttp
+    brotli
+    cchardet
+    orjson
+    pynacl
+  ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "nextcord"
+    "nextcord.ext.commands"
+    "nextcord.ext.tasks"
+  ];
+
+  meta = with lib; {
+    description = "Python wrapper for the Discord API forked from discord.py";
+    homepage = "https://github.com/nextcord/nextcord";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

pkgs/development/python-modules/nextcord/paths.patch

@@ -0,0 +1,26 @@
+diff --git a/nextcord/opus.py b/nextcord/opus.py
+index 97d437a3..755e1a5c 100644
+--- a/nextcord/opus.py
++++ b/nextcord/opus.py
+@@ -213,7 +213,7 @@ def _load_default() -> bool:
+             _filename = os.path.join(_basedir, 'bin', f'libopus-0.{_target}.dll')
+             _lib = libopus_loader(_filename)
+         else:
+-            _lib = libopus_loader(ctypes.util.find_library('opus'))
++            _lib = libopus_loader('@libopus@')
+     except Exception:
+         _lib = None
+ 
+diff --git a/nextcord/player.py b/nextcord/player.py
+index bedefc5a..34de0459 100644
+--- a/nextcord/player.py
++++ b/nextcord/player.py
+@@ -140,7 +140,7 @@ class FFmpegAudio(AudioSource):
+     .. versionadded:: 1.3
+     """
+ 
+-    def __init__(self, source: Union[str, io.BufferedIOBase], *, executable: str = 'ffmpeg', args: Any, **subprocess_kwargs: Any):
++    def __init__(self, source: Union[str, io.BufferedIOBase], *, executable: str = '@ffmpeg@', args: Any, **subprocess_kwargs: Any):
+         piping = subprocess_kwargs.get('stdin') == subprocess.PIPE
+         if piping and isinstance(source, str):
+             raise TypeError("parameter conflict: 'source' parameter cannot be a string when piping to stdin")

pkgs/development/python-modules/opensfm/0002-cmake-find-system-distributed-gtest.patch

@@ -0,0 +1,57 @@
+From 79577371be21df40f1f6d4a4fe3453be6df9e93c Mon Sep 17 00:00:00 2001
+From: Someone Serge <sergei.kozlukov@aalto.fi>
+Date: Fri, 31 Dec 2021 10:03:25 +0200
+Subject: [PATCH 2/4] cmake: find system-distributed gtest
+
+---
+ opensfm/src/CMakeLists.txt | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+diff --git a/opensfm/src/CMakeLists.txt b/opensfm/src/CMakeLists.txt
+index c85aa6fb..640d47a6 100644
+--- a/opensfm/src/CMakeLists.txt
++++ b/opensfm/src/CMakeLists.txt
+@@ -52,12 +52,14 @@ if (OPENMP_FOUND)
+   set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${OpenMP_CXX_FLAGS}")
+ endif()
+ 
++find_package(gflags REQUIRED)
++
+ find_package(LAPACK)
+ find_package(SuiteSparse)
+ find_package(Eigen3 REQUIRED)
+ find_package(Ceres)
+-find_package(Gflags REQUIRED)
+-find_package(Glog REQUIRED)
++find_package(glog REQUIRED)
++find_package(GTest REQUIRED)
+ 
+ # Ceres2 exposes Ceres::ceres target.
+ # Ceres1 exposes just ceres.
+@@ -100,20 +102,13 @@ option(OPENSFM_BUILD_TESTS "Build OpenSfM unit tests." on)
+ 
+ if (OPENSFM_BUILD_TESTS)
+   enable_testing()
+-  include_directories(third_party/gtest)
+-  add_definitions(-DCERES_GFLAGS_NAMESPACE=${GFLAGS_NAMESPACE})
+-
+-  add_library(gtest
+-              third_party/gtest/gmock_gtest_all.cc
+-              third_party/gtest/gmock_main.cc)
+-  target_include_directories(gtest PRIVATE ${GFLAGS_INCLUDE_DIR})
+ 
+   set(TEST_MAIN test_main)
+   add_library(${TEST_MAIN} testing_main.cc)
+   target_link_libraries(${TEST_MAIN}
+-                        ${GFLAGS_LIBRARY}
+-                        ${GLOG_LIBRARY}
+-                        gtest)
++      gflags
++      glog::glog
++      GTest::gtest)
+ endif()
+ 
+ ####### OpenSfM libraries #######
+-- 
+2.33.1
+

pkgs/development/python-modules/opensfm/0003-cmake-use-system-pybind11.patch

@@ -0,0 +1,161 @@
+From 36820fbab1abeeebd99f14e368093e0e3f934ca7 Mon Sep 17 00:00:00 2001
+From: Someone Serge <sergei.kozlukov@aalto.fi>
+Date: Sat, 19 Feb 2022 02:37:54 +0200
+Subject: [PATCH 3/4] cmake: use system pybind11
+
+---
+ opensfm/src/CMakeLists.txt            | 3 ++-
+ opensfm/src/bundle/CMakeLists.txt     | 2 +-
+ opensfm/src/dense/CMakeLists.txt      | 2 +-
+ opensfm/src/features/CMakeLists.txt   | 1 -
+ opensfm/src/foundation/CMakeLists.txt | 1 -
+ opensfm/src/geo/CMakeLists.txt        | 1 -
+ opensfm/src/geometry/CMakeLists.txt   | 1 -
+ opensfm/src/map/CMakeLists.txt        | 3 +--
+ opensfm/src/robust/CMakeLists.txt     | 1 -
+ opensfm/src/sfm/CMakeLists.txt        | 1 -
+ 10 files changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/opensfm/src/CMakeLists.txt b/opensfm/src/CMakeLists.txt
+index 640d47a6..6e391ffa 100644
+--- a/opensfm/src/CMakeLists.txt
++++ b/opensfm/src/CMakeLists.txt
+@@ -54,6 +54,8 @@ endif()
+ 
+ find_package(gflags REQUIRED)
+ 
++find_package(pybind11 REQUIRED)
++
+ find_package(LAPACK)
+ find_package(SuiteSparse)
+ find_package(Eigen3 REQUIRED)
+@@ -82,7 +84,6 @@ else()
+ endif()
+ 
+ ####### Third party libraries #######
+-add_subdirectory(third_party/pybind11)
+ add_subdirectory(third_party/akaze)
+ add_subdirectory(third_party/vlfeat)
+ 
+diff --git a/opensfm/src/bundle/CMakeLists.txt b/opensfm/src/bundle/CMakeLists.txt
+index 7cd9cf74..307e963a 100644
+--- a/opensfm/src/bundle/CMakeLists.txt
++++ b/opensfm/src/bundle/CMakeLists.txt
+@@ -52,7 +52,7 @@ target_link_libraries(pybundle PRIVATE
+   bundle
+   geometry
+   foundation
+-  pybind11)
++)
+ set_target_properties(pybundle PROPERTIES
+     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
+ )
+diff --git a/opensfm/src/dense/CMakeLists.txt b/opensfm/src/dense/CMakeLists.txt
+index cbebb5ea..2728749d 100644
+--- a/opensfm/src/dense/CMakeLists.txt
++++ b/opensfm/src/dense/CMakeLists.txt
+@@ -23,7 +23,7 @@ endif()
+ 
+ pybind11_add_module(pydense python/pybind.cc)
+ target_include_directories(pydense PRIVATE ${GLOG_INCLUDE_DIR})
+-target_link_libraries(pydense PRIVATE dense foundation pybind11)
++target_link_libraries(pydense PRIVATE dense foundation)
+ set_target_properties(pydense PROPERTIES
+     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
+ )
+diff --git a/opensfm/src/features/CMakeLists.txt b/opensfm/src/features/CMakeLists.txt
+index b131d30a..6db5b3f1 100644
+--- a/opensfm/src/features/CMakeLists.txt
++++ b/opensfm/src/features/CMakeLists.txt
+@@ -22,7 +22,6 @@ target_link_libraries(pyfeatures
+   PRIVATE
+     features
+     foundation
+-    pybind11
+     akaze
+ )
+ set_target_properties(pyfeatures PROPERTIES
+diff --git a/opensfm/src/foundation/CMakeLists.txt b/opensfm/src/foundation/CMakeLists.txt
+index 40185227..9e0e45e7 100644
+--- a/opensfm/src/foundation/CMakeLists.txt
++++ b/opensfm/src/foundation/CMakeLists.txt
+@@ -12,7 +12,6 @@ set(FOUNDATION_FILES
+ add_library(foundation ${FOUNDATION_FILES})
+ target_link_libraries(foundation
+   PUBLIC
+-    pybind11
+     ${OpenCV_LIBS}
+     ${OpenMP_libomp_LIBRARY}
+     Eigen3::Eigen
+diff --git a/opensfm/src/geo/CMakeLists.txt b/opensfm/src/geo/CMakeLists.txt
+index a9cbae02..75620d06 100644
+--- a/opensfm/src/geo/CMakeLists.txt
++++ b/opensfm/src/geo/CMakeLists.txt
+@@ -29,7 +29,6 @@ target_link_libraries(pygeo
+   PRIVATE
+     geo
+     foundation
+-    pybind11
+ )
+ set_target_properties(pygeo PROPERTIES
+     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
+diff --git a/opensfm/src/geometry/CMakeLists.txt b/opensfm/src/geometry/CMakeLists.txt
+index e6dda2c2..51bfd6c5 100644
+--- a/opensfm/src/geometry/CMakeLists.txt
++++ b/opensfm/src/geometry/CMakeLists.txt
+@@ -48,7 +48,6 @@ target_link_libraries(pygeometry
+   PRIVATE
+     geometry
+     foundation
+-    pybind11
+ )
+ set_target_properties(pygeometry PROPERTIES
+     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
+diff --git a/opensfm/src/map/CMakeLists.txt b/opensfm/src/map/CMakeLists.txt
+index b6f67bcd..f869aa4c 100644
+--- a/opensfm/src/map/CMakeLists.txt
++++ b/opensfm/src/map/CMakeLists.txt
+@@ -20,7 +20,7 @@ set(MAP_FILES
+ add_library(map ${MAP_FILES})
+ target_link_libraries(map
+   PUBLIC
+-    pybind11
++    pybind11::module
+     Eigen3::Eigen
+   PRIVATE
+     geo
+@@ -39,7 +39,6 @@ target_link_libraries(pymap
+     map
+     geometry
+     bundle
+-    pybind11
+ )
+ 
+ if (OPENSFM_BUILD_TESTS)
+diff --git a/opensfm/src/robust/CMakeLists.txt b/opensfm/src/robust/CMakeLists.txt
+index ce70749f..40bdf7a4 100644
+--- a/opensfm/src/robust/CMakeLists.txt
++++ b/opensfm/src/robust/CMakeLists.txt
+@@ -29,7 +29,6 @@ target_link_libraries(pyrobust
+   PRIVATE
+     robust
+     foundation
+-    pybind11
+ )
+ set_target_properties(pyrobust PROPERTIES
+     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
+diff --git a/opensfm/src/sfm/CMakeLists.txt b/opensfm/src/sfm/CMakeLists.txt
+index 98c28f41..7f56b791 100644
+--- a/opensfm/src/sfm/CMakeLists.txt
++++ b/opensfm/src/sfm/CMakeLists.txt
+@@ -35,7 +35,6 @@ target_include_directories(pysfm PRIVATE ${GLOG_INCLUDE_DIR})
+ target_link_libraries(pysfm
+   PRIVATE
+     foundation
+-    pybind11
+     sfm
+ )
+ set_target_properties(pysfm PROPERTIES
+-- 
+2.33.1
+

pkgs/development/python-modules/opensfm/0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch

@@ -0,0 +1,86 @@
+From c35b110a83286e7413d7309eb218eb43b52f7d48 Mon Sep 17 00:00:00 2001
+From: Someone Serge <sergei.kozlukov@aalto.fi>
+Date: Sat, 19 Feb 2022 14:36:12 +0200
+Subject: [PATCH 4/4] pybind_utils.h: conflicts with nixpkgs' pybind
+
+---
+ opensfm/src/map/pybind_utils.h | 45 +++-------------------------------
+ 1 file changed, 3 insertions(+), 42 deletions(-)
+
+diff --git a/opensfm/src/map/pybind_utils.h b/opensfm/src/map/pybind_utils.h
+index 817d1a16..3f98a2ab 100644
+--- a/opensfm/src/map/pybind_utils.h
++++ b/opensfm/src/map/pybind_utils.h
+@@ -52,38 +52,6 @@ struct sfm_iterator_state {
+ };
+ PYBIND11_NAMESPACE_END_(detail)
+ 
+-/// Makes an python iterator over the keys (`.first`) of a iterator over pairs
+-/// from a first and past-the-end InputIterator.
+-template <return_value_policy Policy = return_value_policy::reference_internal,
+-          typename Iterator, typename Sentinel,
+-          typename KeyType = decltype((*std::declval<Iterator>()).second),
+-          typename... Extra>
+-iterator make_value_iterator(Iterator first, Sentinel last, Extra &&... extra) {
+-  typedef detail::sfm_iterator_state<Iterator, Sentinel, detail::RefIterator,
+-                                     Policy>
+-      state;
+-
+-  if (!detail::get_type_info(typeid(state), false)) {
+-    class_<state>(handle(), "iterator", pybind11::module_local())
+-        .def("__iter__", [](state &s) -> state & { return s; })
+-        .def("__next__",
+-             [](state &s) -> KeyType {
+-               if (!s.first_or_done)
+-                 ++s.it;
+-               else
+-                 s.first_or_done = false;
+-               if (s.it == s.end) {
+-                 s.first_or_done = true;
+-                 throw stop_iteration();
+-               }
+-               return (*s.it).second;
+-             },
+-             std::forward<Extra>(extra)..., Policy);
+-  }
+-
+-  return cast(state{first, last, true});
+-}
+-
+ template <return_value_policy Policy = return_value_policy::reference_internal,
+           typename Iterator, typename Sentinel,
+           typename KeyType = decltype(&((*std::declval<Iterator>()).second)),
+@@ -148,12 +116,13 @@ iterator make_ref_iterator(Iterator first, Sentinel last, Extra &&... extra) {
+ }
+ 
+ /// Makes a python iterator from a first and past-the-end C++ InputIterator.
+-template <return_value_policy Policy = return_value_policy::reference_internal,
++template <typename Access,
++          return_value_policy Policy = return_value_policy::reference_internal,
+           typename Iterator, typename Sentinel,
+           typename ValueType = decltype(std::declval<Iterator>()),
+           typename... Extra>
+ iterator make_ptr_iterator(Iterator first, Sentinel last, Extra &&... extra) {
+-  typedef detail::iterator_state<Iterator, Sentinel, false, Policy> state;
++  typedef detail::iterator_state<Access, Policy, Iterator, Sentinel, ValueType, Extra...> state;
+ 
+   if (!detail::get_type_info(typeid(state), false)) {
+     class_<state>(handle(), "iterator", pybind11::module_local())
+@@ -176,14 +145,6 @@ iterator make_ptr_iterator(Iterator first, Sentinel last, Extra &&... extra) {
+   return cast(state{first, last, true});
+ }
+ 
+-/// Makes an iterator over the keys (`.first`) of a stl map-like container
+-/// supporting `std::begin()`/`std::end()`
+-template <return_value_policy Policy = return_value_policy::reference_internal,
+-          typename Type, typename... Extra>
+-iterator make_value_iterator(Type &value, Extra &&... extra) {
+-  return make_value_iterator<Policy>(std::begin(value), std::end(value),
+-                                     extra...);
+-}
+ template <return_value_policy Policy = return_value_policy::reference_internal,
+           typename Type, typename... Extra>
+ iterator make_unique_ptr_value_iterator(Type &value, Extra &&... extra) {
+-- 
+2.33.1
+

pkgs/development/python-modules/opensfm/default.nix

@@ -0,0 +1,127 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, opencv4
+, ceres-solver
+, suitesparse
+, metis
+, eigen
+, pkg-config
+, pybind11
+, numpy
+, pyyaml
+, lapack
+, gtest
+, gflags
+, glog
+, pytestCheckHook
+, networkx
+, pillow
+, exifread
+, gpxpy
+, pyproj
+, python-dateutil
+, joblib
+, repoze_lru
+, xmltodict
+, cloudpickle
+, scipy
+, sphinx
+, matplotlib
+, fpdf
+,
+}:
+
+let
+  ceresSplit = (builtins.length ceres-solver.outputs) > 1;
+  ceres' =
+    if ceresSplit
+    then ceres-solver.dev
+    else ceres-solver;
+in
+buildPythonPackage rec {
+  pname = "OpenSfM";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "mapillary";
+    repo = pname;
+    rev = "79aa4bdd8bd08dc0cd9e3086d170cedb29ac9760";
+    sha256 = "sha256-dHBrkYwLA1OUxUSoe7DysyeEm9Yy70tIJvAsXivdjrM=";
+  };
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mapillary/OpenSfM/pull/872/commits/a76671db11038f3f4dfe5b8f17582fb447ad7dd5.patch";
+      sha256 = "sha256-4nizQiZIjucdydOLrETvs1xdV3qiYqAQ7x1HECKvlHs=";
+    })
+    ./0002-cmake-find-system-distributed-gtest.patch
+    ./0003-cmake-use-system-pybind11.patch
+    ./0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch
+    ./fix-scripts.patch
+  ];
+  postPatch = ''
+    rm opensfm/src/cmake/FindGlog.cmake
+    rm opensfm/src/cmake/FindGflags.cmake
+
+    # HAHOG is the default descriptor.
+    # We'll test both HAHOG and SIFT because this is
+    # where segfaults might be introduced in future
+    echo 'feature_type: SIFT' >> data/berlin/config.yaml
+    echo 'feature_type: HAHOG' >> data/lund/config.yaml
+  '';
+
+  nativeBuildInputs = [ cmake pkg-config sphinx ];
+  buildInputs = [
+    ceres'
+    suitesparse
+    metis
+    eigen
+    lapack
+    gflags
+    gtest
+    glog
+    pybind11
+  ];
+  propagatedBuildInputs = [
+    numpy
+    scipy
+    pyyaml
+    opencv4
+    networkx
+    pillow
+    matplotlib
+    fpdf
+    exifread
+    gpxpy
+    pyproj
+    python-dateutil
+    joblib
+    repoze_lru
+    xmltodict
+    cloudpickle
+  ];
+  checkInputs = [ pytestCheckHook ];
+
+  dontUseCmakeBuildDir = true;
+  cmakeFlags = [
+    "-Bcmake_build"
+    "-Sopensfm/src"
+  ];
+
+  disabledTests = lib.optionals stdenv.isDarwin [
+    "test_reconstruction_incremental"
+    "test_reconstruction_triangulation"
+  ];
+
+  pythonImportsCheck = [ "opensfm" ];
+
+  meta = {
+    maintainers = [ lib.maintainers.SomeoneSerge ];
+    license = lib.licenses.bsd2;
+    description = "Open source Structure-from-Motion pipeline from Mapillary";
+    homepage = "https://opensfm.org/";
+  };
+}

pkgs/development/python-modules/opensfm/fix-scripts.patch

@@ -0,0 +1,41 @@
+diff --git a/bin/opensfm b/bin/opensfm
+index b5ee4b15..f05c0d1c 100755
+--- a/bin/opensfm
++++ b/bin/opensfm
+@@ -1,12 +1,6 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ set -e
+ 
+ DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+ 
+-if [ -x "$(command -v python3)" ]; then
+-    PYTHON=python3
+-else
+-    PYTHON=python
+-fi
+-
+-"$PYTHON" "$DIR"/opensfm_main.py "$@"
++exec "$DIR"/opensfm_main.py "$@"
+diff --git a/bin/opensfm_main.py b/bin/opensfm_main.py
+index 31249e12..cc71560c 100755
+--- a/bin/opensfm_main.py
++++ b/bin/opensfm_main.py
+@@ -1,3 +1,5 @@
++#!/usr/bin/env python
++
+ import sys
+ from os.path import abspath, join, dirname
+ 
+diff --git a/setup.py b/setup.py
+index 1120717f..438a16db 100644
+--- a/setup.py
++++ b/setup.py
+@@ -71,6 +71,7 @@ setuptools.setup(
+     scripts=[
+         "bin/opensfm_run_all",
+         "bin/opensfm",
++        "bin/opensfm_main.py",
+     ],
+     package_data={
+         "opensfm": [

pkgs/development/python-modules/pex/default.nix

@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pex";
-  version = "2.1.68";
+  version = "2.1.69";
   format = "flit";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-IuYEDKK4sQQ9xVBfHWtya/t9pLNX2gYcXMBpn72FDyo=";
+    sha256 = "sha256-JbQ8yn/uALjjVSRgqKXsQOC4rOCGkMPxb50KqWg89kM=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/plaid-python/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "plaid-python";
-  version = "8.11.0";
+  version = "9.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zvwqMpI/aufZLf9dSVEDY2Letiyso8oSf9o5kanXW7U=";
+    hash = "sha256-jZRfJVBSUOrfaPx8yGCwigfDghUgO0dK8aUKrOf9G1E=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pycfmodel/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pycfmodel";
-  version = "0.16.3";
+  version = "0.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Skyscanner";
     repo = pname;
     rev = version;
-    hash = "sha256-/0JSnJy/OUbYX26wTZ3RloVy74bU2D4Z6NOLq6IkI7o=";
+    hash = "sha256-IfeGNAgVCnrzipQpGiEqfWWNkUNmeH7TInl8kje52js=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pychromecast/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pychromecast";
-  version = "10.2.3";
+  version = "10.3.0";
   format = "setuptools";
 
   disabled = !isPy3k;
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyChromecast";
     inherit version;
-    sha256 = "ddb86c5acdc13e8bdadd2b7f5738fda36b32c1750548f7b629ca8d178f05e0da";
+    sha256 = "sha256-TrEHRG/b7YdvSMgyArYhKyIShhaKVcFrPrjt9CAPEKE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pyprecice/default.nix

@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchFromGitHub, precice, numpy, mpi4py, cython }:
+
+buildPythonPackage rec {
+  pname = "pyprecice";
+  version = "2.3.0.1";
+
+  src = fetchFromGitHub {
+    owner = "precice";
+    repo = "python-bindings";
+    rev = "v${version}";
+    sha256 = "1yz96pif63ms797bzxbfrjba4mgz7cz5dqrqghn5sg0g1b9qxnn5";
+  };
+
+  nativeBuildInputs = [ cython ];
+  propagatedBuildInputs = [ numpy mpi4py precice ];
+
+  doCheck = false; # Disable Test because everything depends on open mpi which requires network.
+  pythonImportChecks = [ "precice" ];
+
+  meta = with lib; {
+    description = "Python language bindings for preCICE";
+    homepage = "https://github.com/precice/python-bindings";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ Scriptkiddi ];
+  };
+}

pkgs/development/python-modules/pyskyqremote/default.nix

@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pycountry
 , pythonOlder
 , requests
 , websocket-client
@@ -10,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyskyqremote";
-  version = "0.3.2";
+  version = "0.3.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,11 +18,10 @@ buildPythonPackage rec {
     owner = "RogerSelwyn";
     repo = "skyq_remote";
     rev = version;
-    sha256 = "sha256-R/HmkVbVKbO54lDSw1tLYs2mXi/XqZX9GGXozv+96iI=";
+    sha256 = "sha256-/BhNoU1dnZj07ZvG126srSb6eW00n8htFuDttq006QE=";
   };
 
   propagatedBuildInputs = [
-    pycountry
     requests
     websocket-client
     xmltodict

pkgs/development/python-modules/soco/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "soco";
-  version = "0.26.3";
+  version = "0.26.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "SoCo";
     repo = "SoCo";
     rev = "v${version}";
-    hash = "sha256-tMW5SCsO1XMQdbasMw3qIMwj+Y6wTQHAmTZ+9r8Mffs=";
+    hash = "sha256-DoONq6Iqi8t47jtqggKYMHSNJAf/Kha3tszR6mYeB9Y=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/tifffile/python2-regex-compat.patch

@@ -1,23 +0,0 @@
---- a/setup.py	2019-02-20 18:52:12.000000000 +0100
-+++ b/setup.py	2019-03-02 13:55:39.014019260 +0100
-@@ -20,12 +20,6 @@
- 
- description = re.search(r'"""(.*)\.(?:\r\n|\r|\n)', code).groups()[0]
- 
--readme = re.search(r'(?:\r\n|\r|\n){2}"""(.*)"""(?:\r\n|\r|\n){2}from', code,
--                   re.MULTILINE | re.DOTALL).groups()[0]
--
--readme = '\n'.join([description, '=' * len(description)]
--                   + readme.splitlines()[1:])
--
- license = re.search(r'(# Copyright.*?(?:\r\n|\r|\n))(?:\r\n|\r|\n)+""', code,
-                     re.MULTILINE | re.DOTALL).groups()[0]
- 
-@@ -41,7 +35,6 @@
-     name='tifffile',
-     version=version,
-     description=description,
--    long_description=readme,
-     author='Christoph Gohlke',
-     author_email='cgohlke@uci.edu',
-     url='https://www.lfd.uci.edu/~gohlke/',

pkgs/development/python-modules/torch-tb-profiler/default.nix

@@ -0,0 +1,48 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, pandas
+, pytestCheckHook
+, pytorch
+, tensorflow-tensorboard
+, torchvision
+}:
+
+let
+  version = "0.3.1";
+  repo = fetchFromGitHub {
+    owner = "pytorch";
+    repo = "kineto";
+    rev = "v${version}";
+    hash = "sha256-Yg001XzOPDmz9wEP2b7Ggz/uU6x5PFzaaBeUBwWKFS0=";
+  };
+in
+buildPythonPackage rec {
+  pname = "torch_tb_profiler";
+  inherit version;
+  format = "setuptools";
+
+  # See https://discourse.nixos.org/t/extracting-sub-directory-from-fetchgit-or-fetchurl-or-any-derivation/8830.
+  src = "${repo}/tb_plugin";
+
+  propagatedBuildInputs = [ pandas tensorflow-tensorboard ];
+
+  checkInputs = [ pytestCheckHook pytorch torchvision ];
+
+  disabledTests = [
+    # Tests that attempt to access the filesystem in naughty ways.
+    "test_profiler_api_without_gpu"
+    "test_tensorboard_end2end"
+    "test_tensorboard_with_path_prefix"
+    "test_tensorboard_with_symlinks"
+  ];
+
+  pythonImportsCheck = [ "torch_tb_profiler" ];
+
+  meta = with lib; {
+    description = "PyTorch Profiler TensorBoard Plugin";
+    homepage = "https://github.com/pytorch/kineto";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ samuela ];
+  };
+}

pkgs/development/python-modules/twitchapi/default.nix

@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, aiohttp
+, python-dateutil
+, requests
+, typing-extensions
+, websockets
+}:
+
+buildPythonPackage rec {
+  pname = "twitchapi";
+  version = "2.5.2";
+
+  format = "setuptools";
+
+  src = fetchPypi {
+    pname = "twitchAPI";
+    inherit version;
+    sha256 = "f0ee5388911154375170a83df9a18e8a698fe382cea5d94a3e33ad27a7ce9133";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    python-dateutil
+    requests
+    typing-extensions
+    websockets
+  ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "twitchAPI.eventsub"
+    "twitchAPI.oauth"
+    "twitchAPI.pubsub"
+    "twitchAPI.twitch"
+    "twitchAPI.types"
+  ];
+
+  meta = with lib; {
+    description = "Python implementation of the Twitch Helix API, its Webhook, PubSub and EventSub";
+    homepage = "https://github.com/Teekeks/pyTwitchAPI";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

pkgs/development/python-modules/wandb/default.nix

@@ -28,6 +28,7 @@
 , requests
 , scikit-learn
 , sentry-sdk
+, setproctitle
 , setuptools
 , shortuuid
 , stdenv
@@ -37,13 +38,13 @@
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.12.10";
+  version = "0.12.11";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "client";
     rev = "v${version}";
-    sha256 = "198c6zx7xih74cw0dwfqw7s7b7whik7wv4nfq6x6xw0kw86r6hby";
+    sha256 = "0av4vv4llan40678bw0vlah0gn6hjg5pdqwq0c5cv15lqrdb8g32";
   };
 
   # The wandb requirements.txt does not distinguish python2/3 dependencies. We
@@ -70,6 +71,7 @@ buildPythonPackage rec {
     pyyaml
     requests
     sentry-sdk
+    setproctitle
     setuptools
     shortuuid
     yaspin
@@ -99,11 +101,11 @@ buildPythonPackage rec {
     "tests/test_telemetry_full.py"
     "tests/wandb_agent_test.py"
     "tests/wandb_artifacts_test.py"
-    "tests/wandb_history_test.py"
     "tests/wandb_integration_test.py"
     "tests/wandb_run_test.py"
     "tests/wandb_settings_test.py"
     "tests/wandb_sweep_test.py"
+    "tests/wandb_verify_test.py"
 
     # Fails and borks the pytest runner as well.
     "tests/wandb_test.py"

pkgs/development/python-modules/weasyprint/default.nix

@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "weasyprint";
-  version = "54.1";
+  version = "54.2";
   disabled = !isPy3k;
 
   format = "pyproject";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "weasyprint";
-    sha256 = "sha256-+lfbhi4GvQHF59gtrTmbO5lSo5gnAjwXvumxwGH/G70=";
+    sha256 = "sha256-1eiqguPiokd6RUPwZG2fsUCAybo0oIWXUesjdXzABGY=";
   };
 
   patches = [

pkgs/development/tools/analysis/checkov/default.nix

@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.908";
+  version = "2.0.913";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-2ssVFnRd8TIxZSUUq9jOmiNHY1yuDv7mMqpKtJ3vq24=";
+    hash = "sha256-gSWD3Y7yySJvWicL5zgCGvMWfk98mBdTXB+Xwo4fork=";
   };
 
   nativeBuildInputs = with py.pkgs; [