Merge master into haskell-updates

2022-08-12 00:13:10 +00:00 · 2022-08-12 00:13:10 +00:00 · 9b94af387d
parent c0804e6f21 f21380675f
commit 9b94af387d
148 changed files with 2120 additions and 508 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1273,6 +1273,12 @@
    githubId = 1217745;
    name = "Aldwin Vlasblom";
  };
+  aveltras = {
+    email = "romain.viallard@outlook.fr";
+    github = "aveltras";
+    githubId = 790607;
+    name = "Romain Viallard";
+  };
  avery = {
    email = "averyl+nixos@protonmail.com";
    github = "AveryLychee";
@ -2314,6 +2320,12 @@
    githubId = 811527;
    name = "Christopher Jefferson";
  };
+  chrispattison = {
+    email = "chpattison@gmail.com";
+    github = "ChrisPattison";
+    githubId = 641627;
+    name = "Chris Pattison";
+  };
  chrispickard = {
    email = "chrispickard9@gmail.com";
    github = "chrispickard";
@ -6434,13 +6446,6 @@
    githubId = 3267697;
    name = "Joshua Potter";
  };
-  jschievink = {
-    email = "jonasschievink@gmail.com";
-    matrix = "@jschievink:matrix.org";
-    github = "jonas-schievink";
-    githubId = 1786438;
-    name = "Jonas Schievink";
-  };
  jshcmpbll = {
    email = "me@joshuadcampbell.com";
    github = "jshcmpbll";
@ -11463,6 +11468,12 @@
    githubId = 107703;
    name = "Samuel Rivas";
  };
+  samw = {
+    email = "sam@wlcx.cc";
+    github = "wlcx";
+    githubId = 3065381;
+    name = "Sam Willcocks";
+  };
  samyak = {
    name = "Samyak Sarnayak";
    email = "samyak201@gmail.com";
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -124,6 +124,13 @@
          <link xlink:href="options.html#opt-virtualisation.appvm.enable">virtualisation.appvm</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/mozilla-services/syncstorage-rs">syncstorage-rs</link>,
+          a self-hostable sync server for Firefox. Available as
+          <link xlink:href="options.html#opt-services.firefox-syncserver.enable">services.firefox-syncserver</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://dragonflydb.io/">dragonflydb</link>,
@ -392,6 +399,18 @@
          as coreboot’s fork is no longer available.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The udisks2 service, available at
+          <literal>services.udisks2.enable</literal>, is now disabled by
+          default. It will automatically be enabled through services and
+          desktop environments as needed. This also means that polkit
+          will now actually be disabled by default. The default for
+          <literal>security.polkit.enable</literal> was already flipped
+          in the previous release, but udisks2 being enabled by default
+          re-enabled it.
+        </para>
+      </listitem>
      <listitem>
        <para>
          Add udev rules for the Teensy family of microcontrollers.
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -55,6 +55,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 ## New Services {#sec-release-22.11-new-services}

 - [appvm](https://github.com/jollheef/appvm), Nix based app VMs. Available as [virtualisation.appvm](options.html#opt-virtualisation.appvm.enable).
+- [syncstorage-rs](https://github.com/mozilla-services/syncstorage-rs), a self-hostable sync server for Firefox. Available as [services.firefox-syncserver](options.html#opt-services.firefox-syncserver.enable).

 - [dragonflydb](https://dragonflydb.io/), a modern replacement for Redis and Memcached. Available as [services.dragonflydb](#opt-services.dragonflydb.enable).

@ -145,6 +146,9 @@ Use `configure.packages` instead.

 - memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. It is now the upstream version from https://www.memtest.org/, as coreboot's fork is no longer available.

+- The udisks2 service, available at `services.udisks2.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed.
+  This also means that polkit will now actually be disabled by default. The default for `security.polkit.enable` was already flipped in the previous release, but udisks2 being enabled by default re-enabled it.
+
 - Add udev rules for the Teensy family of microcontrollers.

 - The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -783,6 +783,7 @@
  ./services/networking/expressvpn.nix
  ./services/networking/fakeroute.nix
  ./services/networking/ferm.nix
+  ./services/networking/firefox-syncserver.nix
  ./services/networking/fireqos.nix
  ./services/networking/firewall.nix
  ./services/networking/flannel.nix
--- a/nixos/modules/services/desktops/gvfs.nix
+++ b/nixos/modules/services/desktops/gvfs.nix
@ -56,6 +56,8 @@ in

    services.udev.packages = [ pkgs.libmtp.out ];

+    services.udisks2.enable = true;
+
    # Needed for unwrapped applications
    environment.sessionVariables.GIO_EXTRA_MODULES = [ "${cfg.package}/lib/gio/modules" ];

--- a/nixos/modules/services/hardware/udisks2.nix
+++ b/nixos/modules/services/hardware/udisks2.nix
@ -19,14 +19,7 @@ in

    services.udisks2 = {

-      enable = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to enable Udisks, a DBus service that allows
-          applications to query and manipulate storage devices.
-        '';
-      };
+      enable = mkEnableOption "udisks2, a DBus service that allows applications to query and manipulate storage devices.";

      settings = mkOption rec {
        type = types.attrsOf settingsFormat.type;
--- a/nixos/modules/services/networking/firefox-syncserver.md
+++ b/nixos/modules/services/networking/firefox-syncserver.md
@ -0,0 +1,55 @@
+# Firefox Sync server {#module-services-firefox-syncserver}
+
+A storage server for Firefox Sync that you can easily host yourself.
+
+## Quickstart {#module-services-firefox-syncserver-quickstart}
+
+The absolute minimal configuration for the sync server looks like this:
+
+```nix
+services.mysql.package = pkgs.mariadb;
+
+services.firefox-syncserver = {
+  enable = true;
+  secrets = builtins.toFile "sync-secrets" ''
+    SYNC_MASTER_SECRET=this-secret-is-actually-leaked-to-/nix/store
+  '';
+  singleNode = {
+    enable = true;
+    hostname = "localhost";
+    url = "http://localhost:5000";
+  };
+};
+```
+
+This will start a sync server that is only accessible locally. Once the services is
+running you can navigate to `about:config` in your Firefox profile and set
+`identity.sync.tokenserver.uri` to `http://localhost:5000/1.0/sync/1.5`. Your browser
+will now use your local sync server for data storage.
+
+::: {.warning}
+This configuration should never be used in production. It is not encrypted and
+stores its secrets in a world-readable location.
+:::
+
+## More detailed setup {#module-services-firefox-syncserver-configuration}
+
+The `firefox-syncserver` service provides a number of options to make setting up
+small deployment easier. These are grouped under the `singleNode` element of the
+option tree and allow simple configuration of the most important parameters.
+
+Single node setup is split into two kinds of options: those that affect the sync
+server itself, and those that affect its surroundings. Options that affect the
+sync server are `capacity`, which configures how many accounts may be active on
+this instance, and `url`, which holds the URL under which the sync server can be
+accessed. The `url` can be configured automatically when using nginx.
+
+Options that affect the surroundings of the sync server are `enableNginx`,
+`enableTLS` and `hostnam`. If `enableNginx` is set the sync server module will
+automatically add an nginx virtual host to the system using `hostname` as the
+domain and set `url` accordingly. If `enableTLS` is set the module will also
+enable ACME certificates on the new virtual host and force all connections to
+be made via TLS.
+
+For actual deployment it is also recommended to store the `secrets` file in a
+secure location.
--- a/nixos/modules/services/networking/firefox-syncserver.nix
+++ b/nixos/modules/services/networking/firefox-syncserver.nix
@ -0,0 +1,328 @@
+{ config, pkgs, lib, options, ... }:
+
+let
+  cfg = config.services.firefox-syncserver;
+  opt = options.services.firefox-syncserver;
+  defaultDatabase = "firefox_syncserver";
+  defaultUser = "firefox-syncserver";
+
+  dbIsLocal = cfg.database.host == "localhost";
+  dbURL = "mysql://${cfg.database.user}@${cfg.database.host}/${cfg.database.name}";
+
+  format = pkgs.formats.toml {};
+  settings = {
+    database_url = dbURL;
+    human_logs = true;
+    tokenserver = {
+      node_type = "mysql";
+      database_url = dbURL;
+      fxa_email_domain = "api.accounts.firefox.com";
+      fxa_oauth_server_url = "https://oauth.accounts.firefox.com/v1";
+      run_migrations = true;
+    } // lib.optionalAttrs cfg.singleNode.enable {
+      # Single-node mode is likely to be used on small instances with little
+      # capacity. The default value (0.1) can only ever release capacity when
+      # accounts are removed if the total capacity is 10 or larger to begin
+      # with.
+      # https://github.com/mozilla-services/syncstorage-rs/issues/1313#issuecomment-1145293375
+      node_capacity_release_rate = 1;
+    };
+  };
+  configFile = format.generate "syncstorage.toml" (lib.recursiveUpdate settings cfg.settings);
+in
+
+{
+  options = {
+    services.firefox-syncserver = {
+      enable = lib.mkEnableOption ''
+        the Firefox Sync storage service.
+
+        Out of the box this will not be very useful unless you also configure at least
+        one service and one nodes by inserting them into the mysql database manually, e.g.
+        by running
+
+        <programlisting>
+          INSERT INTO `services` (`id`, `service`, `pattern`) VALUES ('1', 'sync-1.5', '{node}/1.5/{uid}');
+          INSERT INTO `nodes` (`id`, `service`, `node`, `available`, `current_load`,
+              `capacity`, `downed`, `backoff`)
+            VALUES ('1', '1', 'https://mydomain.tld', '1', '0', '10', '0', '0');
+        </programlisting>
+
+        <option>${opt.singleNode.enable}</option> does this automatically when enabled
+      '';
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.syncstorage-rs;
+        defaultText = lib.literalExpression "pkgs.syncstorage-rs";
+        description = ''
+          Package to use.
+        '';
+      };
+
+      database.name = lib.mkOption {
+        # the mysql module does not allow `-quoting without resorting to shell
+        # escaping, so we restrict db names for forward compaitiblity should this
+        # behavior ever change.
+        type = lib.types.strMatching "[a-z_][a-z0-9_]*";
+        default = defaultDatabase;
+        description = ''
+          Database to use for storage. Will be created automatically if it does not exist
+          and <literal>config.${opt.database.createLocally}</literal> is set.
+        '';
+      };
+
+      database.user = lib.mkOption {
+        type = lib.types.str;
+        default = defaultUser;
+        description = ''
+          Username for database connections.
+        '';
+      };
+
+      database.host = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost";
+        description = ''
+          Database host name. <literal>localhost</literal> is treated specially and inserts
+          systemd dependencies, other hostnames or IP addresses of the local machine do not.
+        '';
+      };
+
+      database.createLocally = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to create database and user on the local machine if they do not exist.
+          This includes enabling unix domain socket authentication for the configured user.
+        '';
+      };
+
+      logLevel = lib.mkOption {
+        type = lib.types.str;
+        default = "error";
+        description = ''
+          Log level to run with. This can be a simple log level like <literal>error</literal>
+          or <literal>trace</literal>, or a more complicated logging expression.
+        '';
+      };
+
+      secrets = lib.mkOption {
+        type = lib.types.path;
+        description = ''
+          A file containing the various secrets. Should be in the format expected by systemd's
+          <literal>EnvironmentFile</literal> directory. Two secrets are currently available:
+          <literal>SYNC_MASTER_SECRET</literal> and
+          <literal>SYNC_TOKENSERVER__FXA_METRICS_HASH_SECRET</literal>.
+        '';
+      };
+
+      singleNode = {
+        enable = lib.mkEnableOption "auto-configuration for a simple single-node setup";
+
+        enableTLS = lib.mkEnableOption "automatic TLS setup";
+
+        enableNginx = lib.mkEnableOption "nginx virtualhost definitions";
+
+        hostname = lib.mkOption {
+          type = lib.types.str;
+          description = ''
+            Host name to use for this service.
+          '';
+        };
+
+        capacity = lib.mkOption {
+          type = lib.types.ints.unsigned;
+          default = 10;
+          description = ''
+            How many sync accounts are allowed on this server. Setting this value
+            equal to or less than the number of currently active accounts will
+            effectively deny service to accounts not yet registered here.
+          '';
+        };
+
+        url = lib.mkOption {
+          type = lib.types.str;
+          default = "${if cfg.singleNode.enableTLS then "https" else "http"}://${cfg.singleNode.hostname}";
+          defaultText = lib.literalExpression ''
+            ''${if cfg.singleNode.enableTLS then "https" else "http"}://''${config.${opt.singleNode.hostname}}
+          '';
+          description = ''
+            URL of the host. If you are not using the automatic webserver proxy setup you will have
+            to change this setting or your sync server may not be functional.
+          '';
+        };
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = format.type;
+
+          options = {
+            port = lib.mkOption {
+              type = lib.types.port;
+              default = 5000;
+              description = ''
+                Port to bind to.
+              '';
+            };
+
+            tokenserver.enabled = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Whether to enable the token service as well.
+              '';
+            };
+          };
+        };
+        default = { };
+        description = ''
+          Settings for the sync server. These take priority over values computed
+          from NixOS options.
+
+          See the doc comments on the <literal>Settings</literal> structs in
+          <link xlink:href="https://github.com/mozilla-services/syncstorage-rs/blob/master/syncstorage/src/settings.rs" />
+          and
+          <link xlink:href="https://github.com/mozilla-services/syncstorage-rs/blob/master/syncstorage/src/tokenserver/settings.rs" />
+          for available options.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.mysql = lib.mkIf cfg.database.createLocally {
+      enable = true;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [{
+        name = cfg.database.user;
+        ensurePermissions = {
+          "${cfg.database.name}.*" = "all privileges";
+        };
+      }];
+    };
+
+    systemd.services.firefox-syncserver = {
+      wantedBy = [ "multi-user.target" ];
+      requires = lib.mkIf dbIsLocal [ "mysql.service" ];
+      after = lib.mkIf dbIsLocal [ "mysql.service" ];
+      environment.RUST_LOG = cfg.logLevel;
+      serviceConfig = {
+        User = defaultUser;
+        Group = defaultUser;
+        ExecStart = "${cfg.package}/bin/syncstorage --config ${configFile}";
+        Stderr = "journal";
+        EnvironmentFile = lib.mkIf (cfg.secrets != null) "${cfg.secrets}";
+
+        # hardening
+        RemoveIPC = true;
+        CapabilityBoundingSet = [ "" ];
+        DynamicUser = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        SystemCallArchitectures = "native";
+        # syncstorage-rs uses python-cffi internally, and python-cffi does not
+        # work with MemoryDenyWriteExecute=true
+        MemoryDenyWriteExecute = false;
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictRealtime = true;
+        ProtectSystem = "strict";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectHome = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        SystemCallFilter = [ "@system-service" "~ @privileged @resources" ];
+        UMask = "0077";
+      };
+    };
+
+    systemd.services.firefox-syncserver-setup = lib.mkIf cfg.singleNode.enable {
+      wantedBy = [ "firefox-syncserver.service" ];
+      requires = [ "firefox-syncserver.service" ] ++ lib.optional dbIsLocal "mysql.service";
+      after = [ "firefox-syncserver.service" ] ++ lib.optional dbIsLocal "mysql.service";
+      path = [ config.services.mysql.package ];
+      script = ''
+        set -euo pipefail
+        shopt -s inherit_errexit
+
+        schema_configured() {
+          mysql ${cfg.database.name} -Ne 'SHOW TABLES' | grep -q services
+        }
+
+        services_configured() {
+          [ 1 != $(mysql ${cfg.database.name} -Ne 'SELECT COUNT(*) < 1 FROM `services`') ]
+        }
+
+        create_services() {
+          mysql ${cfg.database.name} <<"EOF"
+            BEGIN;
+
+            INSERT INTO `services` (`id`, `service`, `pattern`)
+              VALUES (1, 'sync-1.5', '{node}/1.5/{uid}');
+            INSERT INTO `nodes` (`id`, `service`, `node`, `available`, `current_load`,
+                                 `capacity`, `downed`, `backoff`)
+              VALUES (1, 1, '${cfg.singleNode.url}', ${toString cfg.singleNode.capacity},
+                      0, ${toString cfg.singleNode.capacity}, 0, 0);
+
+            COMMIT;
+        EOF
+        }
+
+        update_nodes() {
+          mysql ${cfg.database.name} <<"EOF"
+            UPDATE `nodes`
+              SET `capacity` = ${toString cfg.singleNode.capacity}
+              WHERE `id` = 1;
+        EOF
+        }
+
+        for (( try = 0; try < 60; try++ )); do
+          if ! schema_configured; then
+            sleep 2
+          elif services_configured; then
+            update_nodes
+            exit 0
+          else
+            create_services
+            exit 0
+          fi
+        done
+
+        echo "Single-node setup failed"
+        exit 1
+      '';
+    };
+
+    services.nginx.virtualHosts = lib.mkIf cfg.singleNode.enableNginx {
+      ${cfg.singleNode.hostname} = {
+        enableACME = cfg.singleNode.enableTLS;
+        forceSSL = cfg.singleNode.enableTLS;
+        locations."/" = {
+          proxyPass = "http://localhost:${toString cfg.settings.port}";
+          # source mentions that this header should be set
+          extraConfig = ''
+            add_header X-Content-Type-Options nosniff;
+          '';
+        };
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ pennae ];
+    # Don't edit the docbook xml directly, edit the md and generate it:
+    # `pandoc firefox-syncserver.md -t docbook --top-level-division=chapter --extract-media=media -f markdown+smart > firefox-syncserver.xml`
+    doc = ./firefox-syncserver.xml;
+  };
+}
--- a/nixos/modules/services/networking/firefox-syncserver.xml
+++ b/nixos/modules/services/networking/firefox-syncserver.xml
@ -0,0 +1,77 @@
+<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="module-services-firefox-syncserver">
+  <title>Firefox Sync server</title>
+  <para>
+    A storage server for Firefox Sync that you can easily host yourself.
+  </para>
+  <section xml:id="module-services-firefox-syncserver-quickstart">
+    <title>Quickstart</title>
+    <para>
+      The absolute minimal configuration for the sync server looks like
+      this:
+    </para>
+    <programlisting language="nix">
+services.mysql.package = pkgs.mariadb;
+
+services.firefox-syncserver = {
+  enable = true;
+  secrets = builtins.toFile &quot;sync-secrets&quot; ''
+    SYNC_MASTER_SECRET=this-secret-is-actually-leaked-to-/nix/store
+  '';
+  singleNode = {
+    enable = true;
+    hostname = &quot;localhost&quot;;
+    url = &quot;http://localhost:5000&quot;;
+  };
+};
+</programlisting>
+    <para>
+      This will start a sync server that is only accessible locally.
+      Once the services is running you can navigate to
+      <literal>about:config</literal> in your Firefox profile and set
+      <literal>identity.sync.tokenserver.uri</literal> to
+      <literal>http://localhost:5000/1.0/sync/1.5</literal>. Your
+      browser will now use your local sync server for data storage.
+    </para>
+    <warning>
+      <para>
+        This configuration should never be used in production. It is not
+        encrypted and stores its secrets in a world-readable location.
+      </para>
+    </warning>
+  </section>
+  <section xml:id="module-services-firefox-syncserver-configuration">
+    <title>More detailed setup</title>
+    <para>
+      The <literal>firefox-syncserver</literal> service provides a
+      number of options to make setting up small deployment easier.
+      These are grouped under the <literal>singleNode</literal> element
+      of the option tree and allow simple configuration of the most
+      important parameters.
+    </para>
+    <para>
+      Single node setup is split into two kinds of options: those that
+      affect the sync server itself, and those that affect its
+      surroundings. Options that affect the sync server are
+      <literal>capacity</literal>, which configures how many accounts
+      may be active on this instance, and <literal>url</literal>, which
+      holds the URL under which the sync server can be accessed. The
+      <literal>url</literal> can be configured automatically when using
+      nginx.
+    </para>
+    <para>
+      Options that affect the surroundings of the sync server are
+      <literal>enableNginx</literal>, <literal>enableTLS</literal> and
+      <literal>hostnam</literal>. If <literal>enableNginx</literal> is
+      set the sync server module will automatically add an nginx virtual
+      host to the system using <literal>hostname</literal> as the domain
+      and set <literal>url</literal> accordingly. If
+      <literal>enableTLS</literal> is set the module will also enable
+      ACME certificates on the new virtual host and force all
+      connections to be made via TLS.
+    </para>
+    <para>
+      For actual deployment it is also recommended to store the
+      <literal>secrets</literal> file in a secure location.
+    </para>
+  </section>
+</chapter>
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@ -435,13 +435,12 @@ in
                # socket activation, it goes to the remote side (#19589).
                exec >&2

-                mkdir -m 0755 -p /etc/ssh
-
                ${flip concatMapStrings cfg.hostKeys (k: ''
                  if ! [ -s "${k.path}" ]; then
                      if ! [ -h "${k.path}" ]; then
                          rm -f "${k.path}"
                      fi
+                      mkdir -m 0755 -p "$(dirname '${k.path}')"
                      ssh-keygen \
                        -t "${k.type}" \
                        ${if k ? bits then "-b ${toString k.bits}" else ""} \
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@ -4,16 +4,23 @@ let
  keysPath = "/var/lib/yggdrasil/keys.json";

  cfg = config.services.yggdrasil;
-  configProvided = cfg.config != { };
+  settingsProvided = cfg.settings != { };
  configFileProvided = cfg.configFile != null;

+  format = pkgs.formats.json { };
 in {
+  imports = [
+    (mkRenamedOptionModule
+      [ "services" "yggdrasil" "config" ]
+      [ "services" "yggdrasil" "settings" ])
+  ];
+
  options = with types; {
    services.yggdrasil = {
      enable = mkEnableOption "the yggdrasil system service";

-      config = mkOption {
-        type = attrs;
+      settings = mkOption {
+        type = format.type;
        default = {};
        example = {
          Peers = [
@ -138,11 +145,11 @@ in {
      wantedBy = [ "multi-user.target" ];

      preStart =
-        (if configProvided || configFileProvided || cfg.persistentKeys then
+        (if settingsProvided || configFileProvided || cfg.persistentKeys then
          "echo "

-          + (lib.optionalString configProvided
-            "'${builtins.toJSON cfg.config}'")
+          + (lib.optionalString settingsProvided
+            "'${builtins.toJSON cfg.settings}'")
          + (lib.optionalString configFileProvided "$(cat ${cfg.configFile})")
          + (lib.optionalString cfg.persistentKeys "$(cat ${keysPath})")
          + " | ${pkgs.jq}/bin/jq -s add | ${binYggdrasil} -normaliseconf -useconf"
--- a/nixos/modules/system/boot/plymouth.nix
+++ b/nixos/modules/system/boot/plymouth.nix
@ -184,9 +184,14 @@ in
          mkdir $out
          cp -r ${themesEnv}/share/plymouth/themes/${cfg.theme} $out
          # Copy more themes if the theme depends on others
-          for theme in $(grep -hRo '/etc/plymouth/themes/.*$' ${themesEnv} | xargs -n1 basename); do
-              if [[ -d "${themesEnv}/theme" ]]; then
-                  cp -r "${themesEnv}/theme" $out
+          for theme in $(grep -hRo '/etc/plymouth/themes/.*$' $out | xargs -n1 basename); do
+              if [[ -d "${themesEnv}/share/plymouth/themes/$theme" ]]; then
+                  if [[ ! -d "$out/$theme" ]]; then
+                    echo "Adding dependent theme: $theme"
+                    cp -r "${themesEnv}/share/plymouth/themes/$theme" $out
+                  fi
+              else
+                echo "Missing theme dependency: $theme"
              fi
          done
        '';
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -219,7 +219,7 @@ let

      # Strip binaries further than normal.
      chmod -R u+w $out
-      stripDirs "$STRIP" "lib bin" "-s"
+      stripDirs "$STRIP" "$RANLIB" "lib bin" "-s"

      # Run patchelf to make the programs refer to the copied libraries.
      find $out/bin $out/lib -type f | while read i; do
--- a/nixos/modules/virtualisation/container-config.nix
+++ b/nixos/modules/virtualisation/container-config.nix
@ -8,7 +8,6 @@ with lib;

    # Disable some features that are not useful in a container.
    nix.optimise.automatic = mkDefault false; # the store is host managed
-    services.udisks2.enable = mkDefault false;
    powerManagement.enable = mkDefault false;
    documentation.nixos.enable = mkDefault false;

--- a/nixos/tests/yggdrasil.nix
+++ b/nixos/tests/yggdrasil.nix
@ -42,7 +42,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : {

        services.yggdrasil = {
          enable = true;
-          config = {
+          settings = {
            Listen = ["tcp://0.0.0.0:12345"];
            MulticastInterfaces = [ ];
          };
@ -112,7 +112,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : {
        services.yggdrasil = {
          enable = true;
          denyDhcpcdInterfaces = [ "ygg0" ];
-          config = {
+          settings = {
            IfTAPMode = true;
            IfName = "ygg0";
            MulticastInterfaces = [ "eth1" ];
--- a/pkgs/applications/blockchains/bisq-desktop/default.nix
+++ b/pkgs/applications/blockchains/bisq-desktop/default.nix
@ -34,11 +34,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "bisq-desktop";
-  version = "1.9.1";
+  version = "1.9.4";

  src = fetchurl {
    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
-    sha256 = "0gzfcp255z542adk1g6gsmfpp5zpivv6n1f5kzqgwgm5qmr24049";
+    sha256 = "sha256-8CgbJ5gfzIEh5ppwvQxYz1IES7Dd4MZCac0uVLh/YaY=";
  };

  nativeBuildInputs = [ makeWrapper copyDesktopItems imagemagick dpkg zip xz ];
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@ -49,13 +49,13 @@

 mkDerivation rec {
  pname = "freecad";
-  version = "0.20";
+  version = "0.20.1";

  src = fetchFromGitHub {
    owner = "FreeCAD";
    repo = "FreeCAD";
    rev = version;
-    hash = "sha256-Em4XVxDfvVG1Kf7q+6uHNA/VcMGLKMTv5TCh2XF/BtQ=";
+    hash = "sha256-r2lhFv4ReASteoVxwwiW9TdSckpaju6QE8UegxeY4rE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@ -48,6 +48,7 @@ let
      cachecontrol
      numpy
      lxml
+      packaging
      pillow
      scour
      pyserial
--- a/pkgs/applications/misc/lscolors/default.nix
+++ b/pkgs/applications/misc/lscolors/default.nix
@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "lscolors";
-  version = "0.11.1";
+  version = "0.12.0";

  src = fetchCrate {
    inherit version pname;
-    sha256 = "sha256-RU5DhrfB4XlrI4fHUw0/88Ib6H6xvDlRwUNPPwgVKE0=";
+    sha256 = "sha256-1tLI+M2hpXWsiO/x27ncs8zn8dBDx18AgsSbN/YE2Ic=";
  };

-  cargoSha256 = "sha256-COWvR7B9tXGuPaD311bFzuoqkISDlIOD6GDQdFa6wT4=";
+  cargoSha256 = "sha256-4bFzFztaD9jV3GXpZwCowAhvszedM5ion5/h3D26EY8=";

  # setid is not allowed in the sandbox
  checkFlags = [ "--skip=tests::style_for_setid" ];
--- a/pkgs/applications/misc/masterpdfeditor/default.nix
+++ b/pkgs/applications/misc/masterpdfeditor/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "masterpdfeditor";
-  version = "5.8.46";
+  version = "5.8.70";

  src = fetchurl {
    url = "https://code-industry.net/public/master-pdf-editor-${version}-qt5.x86_64.tar.gz";
-    sha256 = "sha256-xms4aqIxYXR6v226RMf+abrFU1xz2aDIL6iQ+Yfff1k=";
+    sha256 = "sha256-mheHvHU7Z1jUxFWEEfXv2kVO51t/edTK3xV82iteUXM=";
  };

  nativeBuildInputs = [ autoPatchelfHook wrapQtAppsHook ];
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@ -87,11 +87,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "appgate-sdp";
-  version = "5.5.5";
+  version = "6.0.1";

  src = fetchurl {
    url = "https://bin.appgate-sdp.com/${versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
-    sha256 = "sha256-eXcGHd3TGNFqjFQ+wSg4+1hF/6DJTPOs0ldjegFktGo=";
+    sha256 = "sha256-dVVOUdGJDmStS1ZXqPOFpeWhLgimv4lHBS/OOEDrtM0=";
  };

  # just patch interpreter
--- a/pkgs/applications/networking/cluster/openshift/default.nix
+++ b/pkgs/applications/networking/cluster/openshift/default.nix
@ -10,14 +10,14 @@

 buildGoModule rec {
  pname = "openshift";
-  version = "4.10.0";
-  gitCommit = "346b183";
+  version = "4.11.0";
+  gitCommit = "20dd77d5";

  src = fetchFromGitHub {
    owner = "openshift";
    repo = "oc";
-    rev = "release-4.10";
-    sha256 = "Pdq3OwT5P7vvB70X+GVglT9CdJbhkm35nvEGurO1HPc=";
+    rev = "20dd77d5c889f86b05e2bdd182853ae702852c63";
+    sha256 = "wqLo/CKGzeMDJUoI9PUEjJER5hSPu+FmUCJLPZ9PJuw=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.146";
+  version = "1.2.151";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    sha256 = "sha256-6OIV9vs0XWlhosWrKX/GL5q2REYzX5UMd1IHEiM1/qA=";
+    sha256 = "sha256-YgyR3BVkfQcluTamXlsCHHfqxbM1wqdmGsHPYDyMk8I=";
  };

-  vendorSha256 = "sha256-yWKIaH0KXiJR1EVu/htqeDi7qEGu8IvD6m1GcMUdgJo=";
+  vendorSha256 = "sha256-XpSAFiweD2oUKleD6ztDp1+3PpfUWXfGaaE/9mzRrUQ=";

  proxyVendor = true;

--- a/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
@ -0,0 +1,46 @@
+{ stdenv
+, lib
+, dpkg
+, fetchurl
+, autoPatchelfHook
+, glib-networking
+, openssl
+, webkitgtk
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  name = "cinny-desktop";
+  version = "2.1.1";
+
+  src = fetchurl {
+    url = "https://github.com/cinnyapp/cinny-desktop/releases/download/v${version}/Cinny_desktop-x86_64.deb";
+    sha256 = "sha256-4jd+N3a+u+c+XLwgr8BvvdkVLzo+xTBKFdjiQeu7NJU=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+  ];
+
+  buildInputs = [
+    glib-networking
+    openssl
+    webkitgtk
+    wrapGAppsHook
+  ];
+
+  unpackCmd = "dpkg-deb -x $curSrc source";
+
+  installPhase = "mv usr $out";
+
+  meta = with lib; {
+    description = "Yet another matrix client for desktop";
+    homepage = "https://github.com/cinnyapp/cinny-desktop";
+    maintainers = [ maintainers.aveltras ];
+    license = licenses.mit;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    platforms = platforms.linux;
+    mainProgram = "cinny";
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -1,7 +1,7 @@
 { branch ? "stable", callPackage, fetchurl, lib, stdenv }:
 let
  versions = if stdenv.isLinux then {
-    stable = "0.0.18";
+    stable = "0.0.19";
    ptb = "0.0.29";
    canary = "0.0.136";
  } else {
@ -14,7 +14,7 @@ let
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        sha256 = "1hl01rf3l6kblx5v7rwnwms30iz8zw6dwlkjsx2f1iipljgkh5q4";
+        sha256 = "GfSyddbGF8WA6JmHo4tUM27cyHV5kRAyrEiZe1jbA5A=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
--- a/pkgs/applications/networking/instant-messengers/zulip-term/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zulip-term/default.nix
@ -17,6 +17,10 @@ python3.pkgs.buildPythonApplication rec {
    sha256 = "sha256-ZouUU4p1FSGMxPuzDo5P971R+rDXpBdJn2MqvkJO+Fw=";
  };

+  patches = [
+    ./pytest-executable-name.patch
+  ];
+
  propagatedBuildInputs = with python3.pkgs; [
    beautifulsoup4
    lxml
@ -43,12 +47,6 @@ python3.pkgs.buildPythonApplication rec {
    "--prefix" "PATH" ":" (lib.makeBinPath [ libnotify ])
  ];

-  disabledTests = [
-    # IndexError: list index out of range
-    "test_main_multiple_notify_options"
-    "test_main_multiple_autohide_options"
-  ];
-
  meta = with lib; {
    description = "Zulip's official terminal client";
    homepage = "https://github.com/zulip/zulip-terminal";
--- a/pkgs/applications/networking/instant-messengers/zulip-term/pytest-executable-name.patch
+++ b/pkgs/applications/networking/instant-messengers/zulip-term/pytest-executable-name.patch
@ -0,0 +1,22 @@
+diff --git a/tests/cli/test_run.py b/tests/cli/test_run.py
+index 1452cfd..0a21c09 100644
+--- a/tests/cli/test_run.py
+++ b/tests/cli/test_run.py
+@@ -240,7 +240,7 @@ def test_main_multiple_autohide_options(
+ 
+     captured = capsys.readouterr()
+     lines = captured.err.strip("\n")
+-    lines = lines.split("pytest: ", 1)[1]
+    lines = lines.split("__main__.py: ", 1)[1]
+     expected = f"error: argument {options[1]}: not allowed with argument {options[0]}"
+     assert lines == expected
+ 
+@@ -277,7 +277,7 @@ def test_main_multiple_notify_options(
+ 
+     captured = capsys.readouterr()
+     lines = captured.err.strip("\n")
+-    lines = lines.split("pytest: ", 1)[1]
+    lines = lines.split("__main__.py: ", 1)[1]
+     expected = f"error: argument {options[1]}: not allowed with argument {options[0]}"
+     assert lines == expected
+ 
--- a/pkgs/applications/networking/mailreaders/imapfilter.nix
+++ b/pkgs/applications/networking/mailreaders/imapfilter.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "imapfilter";
-  version = "2.7.5";
+  version = "2.7.6";

  src = fetchFromGitHub {
    owner = "lefcha";
    repo = "imapfilter";
    rev = "v${version}";
-    sha256 = "nbVwbPkNbJz4GHhvOp+QVgiBqKA/HR34p4x3NXJB7ig=";
+    sha256 = "sha256-7B3ebY2QAk+64NycptoMmAo7GxUFOo3a7CH7txV/KTY=";
  };
  makeFlags = [
    "SSLCAFILE=/etc/ssl/certs/ca-bundle.crt"
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@ -21,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "mailspring";
-  version = "1.10.3";
+  version = "1.10.5";

  src = fetchurl {
    url = "https://github.com/Foundry376/Mailspring/releases/download/${version}/mailspring-${version}-amd64.deb";
-    sha256 = "sha256-+H2KeaRBApveUG6Vz+Z8LWpmNpZ4lwyeX1LK0AKx/bw=";
+    sha256 = "sha256-eVwb7E04DzGdqfH4T+gkvmBtvN7ja4o8u7LvHk/581I=";
  };

  nativeBuildInputs = [
@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
    '';
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ toschmidt doronbehar ];
+    maintainers = with maintainers; [ toschmidt ];
    homepage = "https://getmailspring.com";
    downloadPage = "https://github.com/Foundry376/Mailspring";
    platforms = [ "x86_64-linux" ];
--- a/pkgs/applications/networking/mpop/default.nix
+++ b/pkgs/applications/networking/mpop/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "mpop";
-  version = "1.4.16";
+  version = "1.4.17";

  src = fetchurl {
    url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-hw61cerm0j+5KtDITXnenDjF9iTjYUk31XS/5Jumh/k=";
+    sha256 = "sha256-Qq5JS60pQdn2R8SMPtmMOLqapc8/5I+w/gblttrfi9U=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "rclone";
-  version = "1.59.0";
+  version = "1.59.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-SHUAEjdcqzNiIxSsmYb71JiOhWPoi8Z2nJAReRw2M5k=";
+    sha256 = "sha256-eblCMe9ywJztjsWmngUkB/IE2ePI9Yin2jkxBW0tTbQ=";
  };

-  vendorSha256 = "sha256-ajOUvZ/0D8QL4MY6xO+hZziyUtIB0WQERU6Ov06K9I8=";
+  vendorSha256 = "sha256-MZ5RtB4UGHPlMxyQ0VbX5iPpZw98oUuEhuMBDZcYiw8=";

  subPackages = [ "." ];

--- a/pkgs/applications/office/beamerpresenter/default.nix
+++ b/pkgs/applications/office/beamerpresenter/default.nix
@ -1,39 +1,28 @@
-{ lib,
-  stdenv,
-  fetchFromGitHub,
-  installShellFiles,
-  pkg-config,
-  cmake,
-  qtbase,
-  qtmultimedia,
-  qttools,
-  wrapQtAppsHook,
-  bash,
-  zlib,
-  gcc,
-  gnumake,
-  coreutils,
-  # only required when using poppler
-  poppler,
-  # only required when using mupdf
-  mupdf,
-  freetype,
-  jbig2dec,
-  openjpeg,
-  gumbo,
-  # choose renderer: mupdf or poppler or both (not recommended)
-  renderer ? "mupdf",
-  # choose major Qt version: "5" or "6" (only 5 is tested)
-  qt_version ? "5"}:
-
-let
-  renderers = {
-    mupdf.buildInputs = [ mupdf freetype jbig2dec openjpeg gumbo ];
-    poppler.buildInputs = [ poppler ];
-  };
-  use_poppler = if "${renderer}" == "poppler" || "${renderer}" == "both" then "ON" else "OFF";
-  use_mupdf = if "${renderer}" == "mupdf" || "${renderer}" == "both" then "ON" else "OFF";
-in
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, wrapGAppsHook
+, wrapQtAppsHook
+, gst_all_1
+, qtbase
+, qtmultimedia
+, qttools
+, qtwayland
+, zlib
+# only required when using poppler
+, poppler
+# only required when using mupdf
+, freetype
+, gumbo
+, jbig2dec
+, mupdf
+, openjpeg
+# choose renderer: mupdf or poppler or both (not recommended)
+, usePoppler ? false
+, useMupdf ? true
+}:

 stdenv.mkDerivation rec {
  pname = "beamerpresenter";
@ -46,25 +35,53 @@ stdenv.mkDerivation rec {
    sha256 = "16v263nnnipih3lxg95rmwz0ihnvpl4n1wlj9r6zavnspzlp9dvb";
  };

-  nativeBuildInputs = [ pkg-config installShellFiles wrapQtAppsHook ];
-  buildInputs = [ gcc cmake coreutils gnumake bash zlib qtbase qtmultimedia qttools ] ++ renderers.${renderer}.buildInputs;
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapGAppsHook
+    wrapQtAppsHook
+  ];
+
+  dontWrapGApps = true;
+
+  buildInputs = [
+    gst_all_1.gst-libav
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    zlib
+    qtbase
+    qtmultimedia
+    qttools
+    qtwayland
+  ] ++ lib.optionals useMupdf [
+    freetype
+    gumbo
+    jbig2dec
+    mupdf
+    openjpeg
+  ] ++ lib.optionals usePoppler [
+    poppler
+  ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE='Release'"
    "-DGIT_VERSION=OFF"
-    "-DUSE_POPPLER=${use_poppler}"
-    "-DUSE_MUPDF=${use_mupdf}"
+    "-DUSE_POPPLER=${if usePoppler then "ON" else "OFF"}"
+    "-DUSE_MUPDF=${if useMupdf then "ON" else "OFF"}"
    "-DUSE_MUJS=OFF"
    "-DUSE_GUMBO=ON"
    "-DUSE_TRANSLATIONS=ON"
-    "-DQT_VERSION_MAJOR=${qt_version}"
+    "-DQT_VERSION_MAJOR=${lib.versions.major qtbase.version}"
  ];

+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
  meta = with lib; {
    description = "Modular multi screen pdf presentation viewer";
    homepage = "https://github.com/stiglers-eponym/BeamerPresenter";
    license = with licenses; [ agpl3 gpl3Plus ];
    platforms = platforms.all;
-    maintainers = with maintainers; [ pacien ];
+    maintainers = with maintainers; [ pacien dotlambda ];
  };
 }
--- a/pkgs/applications/version-management/github-desktop/default.nix
+++ b/pkgs/applications/version-management/github-desktop/default.nix
@ -19,11 +19,11 @@

 stdenv.mkDerivation rec {
  pname = "github-desktop";
-  version = "3.0.3";
+  version = "3.0.5";

  src = fetchurl {
    url = "https://github.com/shiftkey/desktop/releases/download/release-${version}-linux1/GitHubDesktop-linux-${version}-linux1.deb";
-    sha256 = "sha256-KC+D4epjEhZPIN6LutRRo2ViX6YVyol3UUEA56ymyfM=";
+    sha256 = "sha256-7Sk2jDNZtOA04hkl/J+Up2yMGT8+FcXGPiUMcHhb7iY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/video/xplayer/default.nix
+++ b/pkgs/applications/video/xplayer/default.nix
@ -34,13 +34,13 @@ in

 stdenv.mkDerivation rec {
  pname = "xplayer";
-  version = "2.4.3";
+  version = "2.4.4";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "sha256-0hQHhf2me28YTTKOzEkzoxRoSoHLwtiaHPKNPJ/Fg+0=";
+    sha256 = "sha256-o2vLNIELd1EYWG26t5gOpnamJrBJeg4P6fcLirkcmfM=";
  };

  # configure wants to find gst-inspect-1.0 via pkgconfig but
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -17,13 +17,13 @@

 buildGoModule rec {
  pname = "podman";
-  version = "4.1.1";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    sha256 = "sha256-+lwq4WTPeELjugTg9l1wvoe0VTqRK2lC1jaFIwXMrL0=";
+    sha256 = "sha256-crlOF8FoLlDulJJ8t8M1kk6JhSZdJU1VtR+G0O6VngM=";
  };

  vendorSha256 = null;
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh
@ -15,9 +15,9 @@ dotnetBuildHook() {
    fi

    if [ "${selfContainedBuild-}" ]; then
-        dotnetBuildFlags+=("--self-contained")
+        dotnetBuildFlags+=("-p:SelfContained=true")
    else
-        dotnetBuildFlags+=("--no-self-contained")
+        dotnetBuildFlags+=("-p:SelfContained=false")
    fi

    if [ "${version-}" ]; then
--- a/pkgs/data/icons/kora-icon-theme/default.nix
+++ b/pkgs/data/icons/kora-icon-theme/default.nix
@ -1,14 +1,22 @@
-{ lib, stdenvNoCC, fetchFromGitHub , gtk3, adwaita-icon-theme, breeze-icons, hicolor-icon-theme }:
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gtk3
+, adwaita-icon-theme
+, breeze-icons
+, hicolor-icon-theme
+, gitUpdater
+}:

 stdenvNoCC.mkDerivation rec  {
  pname = "kora-icon-theme";
-  version = "1.5.2";
+  version = "1.5.3";

  src = fetchFromGitHub  {
    owner = "bikass";
    repo = "kora";
    rev = "v${version}";
-    sha256 = "sha256-OwuePPn4seHbzv81pnTEP1Q0Tp1ywZIEmw+dx3bDoXw=";
+    sha256 = "sha256-j4W9w/icGjfkbbb0xYF3NfSFsp5RkNCc805E089JaFQ=";
  };

  nativeBuildInputs = [
@ -27,7 +35,8 @@ stdenvNoCC.mkDerivation rec  {
    runHook preInstall

    mkdir -p $out/share/icons
-    mv kora* $out/share/icons/
+    cp -a kora* $out/share/icons/
+    rm $out/share/icons/kora*/create-new-icon-theme.cache.sh

    for theme in $out/share/icons/*; do
      gtk-update-icon-cache -f $theme
@ -36,11 +45,16 @@ stdenvNoCC.mkDerivation rec  {
    runHook postInstall
  '';

+  passthru.updateScript = gitUpdater {
+    inherit pname version;
+    rev-prefix = "v";
+  };
+
  meta = with lib; {
    description = "An SVG icon theme in four variants";
    homepage = "https://github.com/bikass/kora";
    license = with licenses; [ gpl3Only ];
    platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ romildo ];
  };
 }
--- a/pkgs/data/icons/oranchelo-icon-theme/default.nix
+++ b/pkgs/data/icons/oranchelo-icon-theme/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "oranchelo-icon-theme";
-  version = "0.8.0.1";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "OrancheloTeam";
    repo = pname;
-    rev = "096c8c8d550ac9a85f5f34f3f30243e6f198df2d";
-    sha256 = "sha256-TKi42SA33pGKdrPtGTpvxFbOP+5N93Y4BvO4CRTveLM=";
+    rev = "v${version}";
+    sha256 = "sha256-IDsZj/X9rFSdDpa3bL6IPEPCRe5GustPteDxSbfz+SA=";
  };

  nativeBuildInputs = [
@ -22,9 +22,18 @@ stdenvNoCC.mkDerivation rec {

  dontDropIconThemeCache = true;

-  installPhase = ''
-    mkdir -p $out/share/icons
-    cp -r $Oranchelo* $out/share/icons/
+  makeFlags = [
+    "DESTDIR=$(out)"
+    "PREFIX="
+  ];
+
+  postInstall = ''
+    # space in icon name causes gtk-update-icon-cache to fail
+    mv "$out/share/icons/Oranchelo/apps/scalable/ grsync.svg" "$out/share/icons/Oranchelo/apps/scalable/grsync.svg"
+
+    for theme in $out/share/icons/*; do
+      gtk-update-icon-cache "$theme"
+    done
  '';

  meta = with lib; {
--- a/pkgs/data/themes/catppuccin-gtk/default.nix
+++ b/pkgs/data/themes/catppuccin-gtk/default.nix
@ -6,22 +6,22 @@
 , gtk-engine-murrine
 , sassc
 , which
-, tweaks ? [ ]         # can be "nord" "black" "rimless". cannot mix "nord" and "black"
-, size ? "standard"    # can be "standard" "compact"
+, tweaks ? [ ]
+, size ? "standard"
 }:
 let
  validSizes = [ "standard" "compact" ];
-  validTweaks = [ "nord" "black" "rimless" ];
+  validTweaks = [ "nord" "dracula" "black" "rimless" "normal" ];

  unknownTweaks = lib.subtractLists validTweaks tweaks;
-  illegalMix = !(lib.elem "nord" tweaks) && !(lib.elem "black" tweaks);
+  illegalMix = !(lib.elem "nord" tweaks) && !(lib.elem "dracula" tweaks);

  assertIllegal = lib.assertMsg illegalMix ''
-    Tweaks "nord" and "black" cannot be mixed. Tweaks: ${toString tweaks}
+    Tweaks "nord" and "dracula" cannot be mixed. Tweaks: ${toString tweaks}
  '';

  assertSize = lib.assertMsg (lib.elem size validSizes) ''
-    You entered wrong size: ${size}
+    You entered a wrong size: ${size}
    Valid sizes are: ${toString validSizes}
  '';

@ -37,13 +37,13 @@ assert assertUnknown;

 stdenvNoCC.mkDerivation rec {
  pname = "catppuccin-gtk";
-  version = "unstable-2022-02-24";
+  version = "unstable-2022-08-01";

  src = fetchFromGitHub {
    repo = "gtk";
    owner = "catppuccin";
-    rev = "359c584f607c021fcc657ce77b81c181ebaff6de";
-    sha256 = "sha256-AVhFw1XTnkU0hoM+UyjT7ZevLkePybBATJUMLqRytpk=";
+    rev = "87a79fd2bf07accc694455df30a32a82b1b31f4f";
+    sha256 = "sha256-dKHTQva0BYkO6VPNfY/pzRn/V1ghX+tYqbnM9hTAMeE=";
  };

  nativeBuildInputs = [ gtk3 sassc which ];
@ -52,25 +52,17 @@ stdenvNoCC.mkDerivation rec {

  propagatedUserEnvPkgs = [ gtk-engine-murrine ];

-  patches = [
-    # Allows installing with `-t all`. Works around missing grey assets.
-    # https://github.com/catppuccin/gtk/issues/17
-    ./grey-fix.patch
-  ];
-
  postPatch = ''
-    patchShebangs --build scripts/*
-    substituteInPlace Makefile \
-      --replace '$(shell git rev-parse --show-toplevel)' "$PWD"
-    substituteInPlace 'scripts/install.sh' \
-      --replace '$(git rev-parse --show-toplevel)' "$PWD"
+    patchShebangs --build clean-old-theme.sh install.sh
  '';

  installPhase = ''
    runHook preInstall

+    export HOME=$(mktemp -d)
+
    mkdir -p $out/share/themes
-    bash scripts/install.sh -d $out/share/themes -t all \
+    bash install.sh -d $out/share/themes -t all \
      ${lib.optionalString (size != "") "-s ${size}"} \
      ${lib.optionalString (tweaks != []) "--tweaks " + builtins.toString tweaks}

@ -78,7 +70,7 @@ stdenvNoCC.mkDerivation rec {
  '';

  meta = with lib; {
-    description = "Soothing pastel theme for GTK3";
+    description = "Soothing pastel theme for GTK";
    homepage = "https://github.com/catppuccin/gtk";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
--- a/pkgs/data/themes/catppuccin-gtk/grey-fix.patch
+++ b/pkgs/data/themes/catppuccin-gtk/grey-fix.patch
@ -1,12 +0,0 @@
-diff --git a/scripts/install.sh b/scripts/install.sh
-index d2a2b86..bd05c93 100755
--- a/scripts/install.sh
-+++ b/scripts/install.sh
-@@ -20,7 +20,7 @@ fi
- SASSC_OPT="-M -t expanded"
- 
- THEME_NAME=Catppuccin
-THEME_VARIANTS=('' '-purple' '-pink' '-red' '-orange' '-yellow' '-green' '-teal' '-grey')
-+THEME_VARIANTS=('' '-purple' '-pink' '-red' '-orange' '-yellow' '-green' '-teal')
- COLOR_VARIANTS=('' '-light' '-dark')
- SIZE_VARIANTS=('' '-compact')
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@ -53,13 +53,13 @@

 stdenv.mkDerivation rec {
  pname = "cinnamon-common";
-  version = "5.4.8";
+  version = "5.4.9";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "cinnamon";
    rev = version;
-    hash = "sha256-Z+BbvLgH4gOsLMSC0r5Hp9yDZz4XMH7NR/A9to+/djA=";
+    hash = "sha256-nM87NO/dwOd+hN5/3zX7XUjyKvXh4uDhLcGFcKE9ccA=";
  };

  patches = [
--- a/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , pkg-config
 , glib
 , gettext
@ -18,6 +17,7 @@
 , libgnomekbd
 , libxklavier
 , networkmanager
+, libgudev
 , libwacom
 , gnome
 , wrapGAppsHook
@ -36,22 +36,13 @@

 stdenv.mkDerivation rec {
  pname = "cinnamon-control-center";
-  version = "5.4.4";
-
-  patches = [
-    # Add missing gio-unix-2.0 dependency, can be removed on next update
-    # https://github.com/linuxmint/cinnamon-control-center/pull/294
-    (fetchpatch {
-      url = "https://github.com/linuxmint/cinnamon-control-center/commit/7f5ba6e7a691547840f8482445c09c729e10a397.patch";
-      sha256 = "sha256-xcf/O/DfhOvCpWJl0XZD+xAwWs4STAeCaFMZ9Lftv2w=";
-    })
-  ];
+  version = "5.4.6";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-c2JbRAMcTnqaqt8MXQl4AxnENVmfYyHcCteWBWQUSO0=";
+    hash = "sha256-8BDmQT/xDnpwR2YC0TGaqWPnZ61IBmVvft2Mcf6YN+A=";
  };

  buildInputs = [
@ -66,6 +57,7 @@ stdenv.mkDerivation rec {
    libxklavier
    colord
    cinnamon-settings-daemon
+    libgudev
    libwacom
    gnome-online-accounts
    tzdata
@ -98,6 +90,8 @@ stdenv.mkDerivation rec {
  '';

  mesonFlags = [
+    # TODO: https://github.com/NixOS/nixpkgs/issues/36468
+    "-Dc_args=-I${glib.dev}/include/gio-unix-2.0"
    # use locales from cinnamon-translations
    "--localedir=${cinnamon-translations}/share/locale"
  ];
--- a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , pkg-config
 , meson
 , ninja
@ -30,22 +29,13 @@

 stdenv.mkDerivation rec {
  pname = "cinnamon-screensaver";
-  version = "5.4.1";
-
-  patches = [
-    # Add missing gio-unix-2.0 dependency, can be removed on next update
-    # https://github.com/linuxmint/cinnamon-screensaver/pull/411
-    (fetchpatch {
-      url = "https://github.com/linuxmint/cinnamon-screensaver/commit/8d658e7f313879579322dce666551f132795540b.patch";
-      sha256 = "sha256-HjVQSX2yYqgZVIio2I8GBWLYOddvaFiqZzf0zaYf+OE=";
-    })
-  ];
+  version = "5.4.2";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-PpBtLAIboXMnX5V/u06aoZ6WfPrn4mdCu0NXTGb6pAE=";
+    hash = "sha256-GRa3ChUCL/AFDg1F01DNwkC4tmrNaOWoOXwFvwpvSck=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
@ -21,7 +21,6 @@
 , polkit
 , librsvg
 , libwacom
-, xf86_input_wacom
 , xorg
 , fontconfig
 , tzdata
@ -33,13 +32,13 @@

 stdenv.mkDerivation rec {
  pname = "cinnamon-settings-daemon";
-  version = "5.4.3";
+  version = "5.4.5";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-3ELsb0hH7GjMjwjsIg2m8k/EBCHIQGW3O7eDaqT2V7I=";
+    hash = "sha256-qjI1z1MuaI5JFqjHap/+aYDQ0YuP9VNnnY6vy/AaKqs=";
  };

  patches = [
@ -65,11 +64,9 @@ stdenv.mkDerivation rec {
    polkit
    librsvg
    libwacom
-    xf86_input_wacom
    xorg.libXext
    xorg.libX11
    xorg.libXi
-    xorg.libXtst
    xorg.libXfixes
    fontconfig
    nss
--- a/pkgs/desktops/cinnamon/mint-themes/default.nix
+++ b/pkgs/desktops/cinnamon/mint-themes/default.nix
@ -8,14 +8,14 @@

 stdenv.mkDerivation rec {
  pname = "mint-themes";
-  version = "2.0.3";
+  version = "2.0.4";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    # they don't exactly do tags, it's just a named commit
-    rev = "38b5606c3889a9a0bac0e2ab39196f675496982c";
-    hash = "sha256-Cc5p9WWLFPQ8K0CpL236LilAgBuO6HdfGt/rb0wiVpc=";
+    rev = "73d6cfea807ea84a645f43424c60916cb6214693";
+    hash = "sha256-WyEabE3K7xuBzXuLqJO0N4nxrc67bKT5YD9yn/bELl0=";
  };

  nativeBuildInputs = [
@ -29,8 +29,10 @@ stdenv.mkDerivation rec {
  '';

  installPhase = ''
+    runHook preInstall
    mkdir -p $out
    mv usr/share $out
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/desktops/cinnamon/mint-y-icons/default.nix
+++ b/pkgs/desktops/cinnamon/mint-y-icons/default.nix
@ -9,14 +9,14 @@

 stdenv.mkDerivation rec {
  pname = "mint-y-icons";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    # they don't exactly do tags, it's just a named commit
-    rev = "6294c4538a08a2a6c5fd68e223472d9c144ff8b0";
-    hash = "sha256-6tR3OFvU1ID61n4gr0R6pJyo3CjKvu8mgtXzMOINgq0=";
+    rev = "57d16eb85f2af40be17e2232d279bb65b689f5b7";
+    hash = "sha256-voFYz0MiuqyNSngi4QZUJKDIjggQWOAV5B30zMP8iTk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/desktops/cinnamon/muffin/default.nix
+++ b/pkgs/desktops/cinnamon/muffin/default.nix
@ -35,7 +35,7 @@

 stdenv.mkDerivation rec {
  pname = "muffin";
-  version = "5.4.4";
+  version = "5.4.5";

  outputs = [ "out" "dev" "man" ];

@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-u3PNSyjxtPLFdA+2Iz+NuqlcQC9IwsFb7Tb5eVAJunY=";
+    hash = "sha256-gtki0MTIMI1JggtVn0dAhkq364hkTuH7Zf7CF32Lc8E=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/cinnamon/xviewer/default.nix
+++ b/pkgs/desktops/cinnamon/xviewer/default.nix
@ -27,13 +27,13 @@

 stdenv.mkDerivation rec {
  pname = "xviewer";
-  version = "3.2.9";
+  version = "3.2.10";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "sha256-sDDQ/LGhHH13gRjVfpTyHYsYhelp80KNE75I8AlskoU=";
+    sha256 = "sha256-c3K9yjeaAlyXqgxzHgnLXgqwaB5Fdw+mS9jricy8QA8=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@ -184,6 +184,7 @@ stdenv.mkDerivation rec {

    # We can generate it ourselves.
    rm -f man/gnome-shell.1
+    rm data/theme/gnome-shell.css
  '';

  preFixup = ''
--- a/pkgs/development/compilers/hare/default.nix
+++ b/pkgs/development/compilers/hare/default.nix
@ -0,0 +1,7 @@
+{ config, lib, pkgs }:
+
+lib.makeScope pkgs.newScope (self: with self; {
+
+  harec = callPackage ./harec { };
+  hare = callPackage ./hare { };
+})
--- a/pkgs/development/compilers/hare/hare/config-template.mk
+++ b/pkgs/development/compilers/hare/hare/config-template.mk
--- a/pkgs/development/compilers/hare/hare/default.nix
+++ b/pkgs/development/compilers/hare/hare/default.nix
@ -9,16 +9,15 @@
 , substituteAll
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "hare";
-  version = "unstable-2022-06-18";
+  version = "unstable-2022-07-30";

  src = fetchFromSourcehut {
-    name = pname + "-src";
    owner = "~sircmpwn";
-    repo = pname;
-    rev = "ac9b2c35c09d555e09dbd81c5ed95bdfa14313ba";
-    hash = "sha256-eeS14LGkbi9IamvKzK+HF0Rvk9NFp4QVYcrHwNSNBx4=";
+    repo = "hare";
+    rev = "296925c91d79362d6b8ac94e0336a38e9af0f1c9";
+    hash = "sha256-LeIUnpTMZ6vxgAy/LPm9/IMit41RgezdVESIv+gQFHc=";
  };

  patches = [ ./disable-failing-test-cases.patch ];
@ -37,7 +36,6 @@ stdenv.mkDerivation rec {
    qbe
  ];

-  setupHook = ./setup-hook.sh;
  strictDeps = true;

  configurePhase =
@ -86,6 +84,8 @@ stdenv.mkDerivation rec {
        wrapProgram $out/bin/hare --prefix PATH : ${binPath}
      '';

+  setupHook = ./setup-hook.sh;
+
  meta = with lib; {
    homepage = "http://harelang.org/";
    description =
@ -94,4 +94,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ AndersonTorres ];
    inherit (harec.meta) platforms badPlatforms;
  };
-}
+})
--- a/pkgs/development/compilers/hare/hare/disable-failing-test-cases.patch
+++ b/pkgs/development/compilers/hare/hare/disable-failing-test-cases.patch
--- a/pkgs/development/compilers/hare/hare/setup-hook.sh
+++ b/pkgs/development/compilers/hare/hare/setup-hook.sh
@ -1,5 +1,3 @@
-export HARECACHE="$NIX_BUILD_TOP/.harecache"
-
 addHarepath () {
    for haredir in third-party stdlib; do
        if [[ -d "$1/src/hare/$haredir" ]]; then
--- a/pkgs/development/compilers/hare/harec/default.nix
+++ b/pkgs/development/compilers/hare/harec/default.nix
@ -4,16 +4,15 @@
 , qbe
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "harec";
-  version = "unstable-2022-06-20";
+  version = "unstable-2022-07-02";

  src = fetchFromSourcehut {
-    name = pname + "-src";
    owner = "~sircmpwn";
-    repo = pname;
-    rev = "2eccbc4b959a590dda91143c8487edda841106d9";
-    hash = "sha256-pwy7cNxAqIbhx9kpcjfgk7sCEns9oA6zhKSQJdHLZCM=";
+    repo = "harec";
+    rev = "56359312644f76941de1878d33a1a0b840be8056";
+    hash = "sha256-8SFYRJSvX8hmsHBgaLUfhLUV7d54im22ETZds1eASc4=";
  };

  nativeBuildInputs = [
@ -42,4 +41,4 @@ stdenv.mkDerivation rec {
      lib.intersectLists (freebsd ++ linux) (aarch64 ++ x86_64 ++ riscv64);
    badPlatforms = with platforms; darwin;
  };
-}
+})
--- a/pkgs/development/libraries/botan/2.0.nix
+++ b/pkgs/development/libraries/botan/2.0.nix
@ -1,19 +1,10 @@
 { callPackage, fetchpatch, ... } @ args:

 callPackage ./generic.nix (args // {
-  baseVersion = "2.18";
-  revision = "1";
-  sha256 = "0adf53drhk1hlpfih0175c9081bqpclw6p2afn51cmx849ib9izq";
+  baseVersion = "2.19";
+  revision = "2";
+  sha256 = "sha256-OvXxdhXGtc2Lgy0mn7bLTVTsZPnrCd2/Gt1Qk5QbTXU=";
  postPatch = ''
    sed -e 's@lang_flags "@&--std=c++11 @' -i src/build-data/cc/{gcc,clang}.txt
  '';
-  extraPatches = [
-    (fetchpatch {
-      name = "CVE-2021-40529.patch";
-      url = "https://github.com/randombit/botan/commit/9a23e4e3bc3966340531f2ff608fa9d33b5185a2.patch";
-      sha256 = "1ax1n2l9zh0hk35vkkywgkhzpdk76xb9apz2wm3h9kjvjs9acr3y";
-      # our source tarball doesn't include the tests
-      excludes = [ "src/tests/*" ];
-    })
-  ];
 })
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python3, bzip2, zlib, gmp, openssl, boost
+{ lib, stdenv, fetchurl, python3, bzip2, zlib, gmp, boost
 # Passed by version specific builders
 , baseVersion, revision, sha256
 , sourceExtension ? "tar.xz"
@ -26,11 +26,11 @@ stdenv.mkDerivation rec {
  patches = extraPatches;
  inherit postPatch;

-  buildInputs = [ python3 bzip2 zlib gmp openssl boost ]
+  buildInputs = [ python3 bzip2 zlib gmp boost ]
    ++ lib.optionals stdenv.isDarwin [ CoreServices Security ];

  configurePhase = ''
-    python configure.py --prefix=$out --with-bzip2 --with-zlib ${if openssl != null then "--with-openssl" else ""} ${extraConfigureFlags}${if stdenv.cc.isClang then " --cc=clang" else "" }
+    python configure.py --prefix=$out --with-bzip2 --with-zlib ${extraConfigureFlags}${if stdenv.cc.isClang then " --cc=clang" else "" }
  '';

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/crc32c/default.nix
+++ b/pkgs/development/libraries/crc32c/default.nix
@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
    "-DCRC32C_BUILD_TESTS=1"
    "-DCRC32C_BUILD_BENCHMARKS=0"
    "-DCRC32C_USE_GLOG=0"
+    "-DINSTALL_GTEST=0"
    "-DBUILD_SHARED_LIBS=${if staticOnly then "0" else "1"}"
  ];

@ -42,20 +43,7 @@ stdenv.mkDerivation rec {
    runHook postInstallCheck
  '';

-  postInstallCheck = ''
-    # without removing these libraries, dependents will look for
-    # libgtest/libgmock etc here, which can result in link time errors
-    rm $out/lib/libg*
-  '';
-
  postFixup = ''
-    # dependents shouldn't be able to find gtest libraries as dependencies of
-    # this package
-    rm -r $out/lib/pkgconfig
-
-    # remove GTest cmake config files
-    rm -r $out/lib/cmake/GTest
-
    # fix bogus include paths
    for f in $(find $out/lib/cmake -name '*.cmake'); do
      substituteInPlace "$f" --replace "\''${_IMPORT_PREFIX}/$out/include" "\''${_IMPORT_PREFIX}/include"
--- a/pkgs/development/libraries/imgui/default.nix
+++ b/pkgs/development/libraries/imgui/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "imgui";
-  version = "1.87";
+  version = "1.88";

  src = fetchFromGitHub {
    owner = "ocornut";
    repo = "imgui";
    rev = "v${version}";
-    sha256 = "sha256-H5rqXZFw+2PfVMsYvAK+K+pxxI8HnUC0GlPhooWgEYM=";
+    sha256 = "sha256-scG47rRE2qZuYYkgDiA3xnxn/9kQlZLRMb/4UjoknI0=";
  };

  dontBuild = true;
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-media-sdk";
-  version = "22.3.0";
+  version = "22.5.1";

  src = fetchFromGitHub {
    owner = "Intel-Media-SDK";
    repo = "MediaSDK";
    rev = "intel-mediasdk-${version}";
-    sha256 = "sha256-6/MOjISfLsrsocdeFC148hRwl2os5dvJV1eYq/jIMr4=";
+    sha256 = "sha256-HTCqJG//byTTlTRdE8IyFGuUaLiNVDfl9swbH6d5gCk=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@ -8,8 +8,14 @@
 , ninja
 , pkg-config
 , gcc
+, mesa
+, gtk3
+, glfw
+, libGLU
+, curl
 , cudaSupport ? config.cudaSupport or false, cudaPackages ? {}
 , enablePython ? false, pythonPackages ? null
+, enableGUI ? false,
 }:

 assert cudaSupport -> (cudaPackages?cudatoolkit && cudaPackages.cudatoolkit != null);
@ -32,7 +38,8 @@ stdenv.mkDerivation rec {
    libusb1
    gcc.cc.lib
  ] ++ lib.optional cudaSupport cudaPackages.cudatoolkit
-    ++ lib.optionals enablePython (with pythonPackages; [python pybind11 ]);
+    ++ lib.optionals enablePython (with pythonPackages; [ python pybind11 ])
+    ++ lib.optionals enableGUI [ mesa gtk3 glfw libGLU curl ];

  patches = [
    # fix build on aarch64-darwin
@ -53,8 +60,9 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DBUILD_EXAMPLES=ON"
-    "-DBUILD_GRAPHICAL_EXAMPLES=OFF"
-    "-DBUILD_GLSL_EXTENSIONS=OFF"
+    "-DBUILD_GRAPHICAL_EXAMPLES=${lib.boolToString enableGUI}"
+    "-DBUILD_GLSL_EXTENSIONS=${lib.boolToString enableGUI}"
+    "-DCHECK_FOR_UPDATES=OFF" # activated by BUILD_GRAPHICAL_EXAMPLES, will make it download and compile libcurl
  ] ++ lib.optionals enablePython [
    "-DBUILD_PYTHON_BINDINGS:bool=true"
    "-DXXNIX_PYTHON_SITEPACKAGES=${placeholder "out"}/${pythonPackages.python.sitePackages}"
@ -72,7 +80,7 @@ stdenv.mkDerivation rec {
    description = "A cross-platform library for Intel® RealSense™ depth cameras (D400 series and the SR300)";
    homepage = "https://github.com/IntelRealSense/librealsense";
    license = licenses.asl20;
-    maintainers = with maintainers; [ brian-dawn ];
+    maintainers = with maintainers; [ brian-dawn pbsds ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/pc-ble-driver/default.nix
+++ b/pkgs/development/libraries/pc-ble-driver/default.nix
@ -43,6 +43,5 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/NordicSemiconductor/pc-ble-driver";
    license = licenses.unfreeRedistributable;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ jschievink ];
  };
 }
--- a/pkgs/development/libraries/science/math/faiss/default.nix
+++ b/pkgs/development/libraries/science/math/faiss/default.nix
@ -0,0 +1,123 @@
+{ lib
+, config
+, fetchFromGitHub
+, stdenv
+, cmake
+, cudaPackages
+, cudaSupport ? config.cudaSupport or false
+, cudaCapabilities ? [ "60" "70" "80" "86" ]
+, pythonSupport ? true
+, pythonPackages
+, blas
+, swig
+, addOpenGLRunpath
+, optLevel ? let
+    optLevels =
+      lib.optional stdenv.hostPlatform.avx2Support "avx2"
+      ++ lib.optional stdenv.hostPlatform.sse4_1Support "sse4"
+      ++ [ "generic" ];
+  in
+  # Choose the maximum available optimization level
+  builtins.head optLevels
+, faiss # To run demos in the tests
+, runCommand
+}:
+
+let
+  pname = "faiss";
+  version = "1.7.2";
+  inherit (cudaPackages) cudatoolkit;
+in
+stdenv.mkDerivation {
+  inherit pname version;
+
+  outputs = [ "out" "demos" ];
+
+  src = fetchFromGitHub {
+    owner = "facebookresearch";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-Tklf5AaqJbOs9qtBZVcxXPLAp+K54EViZLSOvEhmswg=";
+  };
+
+  buildInputs = [
+    blas
+    swig
+  ] ++ lib.optionals pythonSupport [
+    pythonPackages.setuptools
+    pythonPackages.pip
+    pythonPackages.wheel
+  ];
+
+  propagatedBuildInputs = lib.optionals pythonSupport [
+    pythonPackages.numpy
+  ];
+
+  nativeBuildInputs = [ cmake ] ++ lib.optionals cudaSupport [
+    cudatoolkit
+    addOpenGLRunpath
+  ] ++ lib.optional pythonSupport [
+    pythonPackages.python
+  ];
+
+  passthru.extra-requires.all = [
+    pythonPackages.numpy
+  ];
+
+  cmakeFlags = [
+    "-DFAISS_ENABLE_GPU=${if cudaSupport then "ON" else "OFF"}"
+    "-DFAISS_ENABLE_PYTHON=${if pythonSupport then "ON" else "OFF"}"
+    "-DFAISS_OPT_LEVEL=${optLevel}"
+  ] ++ lib.optionals cudaSupport [
+    "-DCMAKE_CUDA_ARCHITECTURES=${lib.concatStringsSep ";" cudaCapabilities}"
+  ];
+
+
+  # pip wheel->pip install commands copied over from opencv4
+
+  buildPhase = ''
+    make -j faiss
+    make demo_ivfpq_indexing
+  '' + lib.optionalString pythonSupport ''
+    make -j swigfaiss
+    (cd faiss/python &&
+     python -m pip wheel --verbose --no-index --no-deps --no-clean --no-build-isolation --wheel-dir dist .)
+  '';
+
+  installPhase = ''
+    make install
+    mkdir -p $demos/bin
+    cp ./demos/demo_ivfpq_indexing $demos/bin/
+  '' + lib.optionalString pythonSupport ''
+    mkdir -p $out/${pythonPackages.python.sitePackages}
+    (cd faiss/python && python -m pip install dist/*.whl --no-index --no-warn-script-location --prefix="$out" --no-cache)
+  '';
+
+  fixupPhase = lib.optionalString (pythonSupport && cudaSupport) ''
+    addOpenGLRunpath $out/${pythonPackages.python.sitePackages}/faiss/*.so
+    addOpenGLRunpath $demos/bin/*
+  '';
+
+  passthru = {
+    inherit cudaSupport cudaPackages pythonSupport;
+
+    tests = {
+      runDemos = runCommand "${pname}-run-demos"
+        { buildInputs = [ faiss.demos ]; }
+        # There are more demos, we run just the one that documentation mentions
+        ''
+          demo_ivfpq_indexing && touch $out
+        '';
+    } // lib.optionalAttrs pythonSupport {
+      pytest = pythonPackages.callPackage ./tests.nix { };
+    };
+  };
+
+  meta = with lib; {
+    description = "A library for efficient similarity search and clustering of dense vectors by Facebook Research";
+    homepage = "https://github.com/facebookresearch/faiss";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ SomeoneSerge ];
+  };
+}
--- a/pkgs/development/libraries/science/math/faiss/tests.nix
+++ b/pkgs/development/libraries/science/math/faiss/tests.nix
@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, faiss
+, scipy
+, pytestCheckHook
+}:
+
+assert faiss.pythonSupport;
+
+buildPythonPackage {
+  pname = "faiss-pytest-suite";
+  inherit (faiss) version;
+
+  src = "${faiss.src}/tests";
+
+  dontBuild = true;
+  dontInstall = true;
+
+  # Tests that need GPUs and would fail in the sandbox
+  disabledTestPaths = lib.optionals faiss.cudaSupport [
+    "test_contrib.py"
+  ];
+
+  checkInputs = [
+    faiss
+    pytestCheckHook
+    scipy
+  ] ++
+  faiss.extra-requires.all;
+}
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@ -118873,10 +118873,10 @@ in
  pnpm = nodeEnv.buildNodePackage {
    name = "pnpm";
    packageName = "pnpm";
-    version = "7.8.0";
+    version = "7.9.1";
    src = fetchurl {
-      url = "https://registry.npmjs.org/pnpm/-/pnpm-7.8.0.tgz";
-      sha512 = "jzb9/gto4nwuVA2itTRk0PJhuaZcA1NBRB298UzXhqKZQMjtHCS+KLzh7RWk5n3g+KnMg5FHr6Mwg1L62dBz1A==";
+      url = "https://registry.npmjs.org/pnpm/-/pnpm-7.9.1.tgz";
+      sha512 = "5vyV+FwZj5y31UDDsiq9xcVzF+mvS+IPdgAgkZ9rVxYPNKCCVwVn5LsHh9jcfuApiKYVgpyisAMcuSDbe1/C0Q==";
    };
    buildInputs = globalBuildInputs;
    meta = {
--- a/pkgs/development/ocaml-modules/faraday/async.nix
+++ b/pkgs/development/ocaml-modules/faraday/async.nix
@ -1,15 +1,15 @@
-{ buildDunePackage, fetchpatch, faraday, core, async }:
+{ buildDunePackage, lib, fetchpatch, faraday, core, async }:

 buildDunePackage rec {
  pname = "faraday-async";
-  inherit (faraday) version src useDune2;
+  inherit (faraday) version src;

-  patches = fetchpatch {
+  patches = lib.optional (lib.versionAtLeast async.version "0.15") (fetchpatch {
    url = "https://github.com/inhabitedtype/faraday/commit/31c3fc7f91ecca0f1deea10b40fd5e33bcd35f75.patch";
    sha256 = "05z5gk7hxq7qvwg6f73hdhfcnx19p1dq6wqh8prx667y8zsaq2zj";
-  };
+  });

-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.08";

  propagatedBuildInputs = [ faraday core async ];

--- a/pkgs/development/python-modules/aardwolf/default.nix
+++ b/pkgs/development/python-modules/aardwolf/default.nix
@ -0,0 +1,57 @@
+{ lib
+, arc4
+, asn1crypto
+, asn1tools
+, asysocks
+, buildPythonPackage
+, colorama
+, fetchPypi
+, minikerberos
+, pillow
+, pyperclip
+, pythonOlder
+, tqdm
+, unicrypto
+, winsspi
+}:
+
+buildPythonPackage rec {
+  pname = "aardwolf";
+  version = "0.0.8";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-plz1D+Lr5rV8iJo7IUmuXfjxLvVxX9lgyxyYXUlPH0k=";
+  };
+
+  propagatedBuildInputs = [
+    arc4
+    asn1crypto
+    asn1tools
+    asysocks
+    colorama
+    minikerberos
+    pillow
+    pyperclip
+    tqdm
+    unicrypto
+    winsspi
+  ];
+
+  # Module doesn't have tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "aardwolf"
+  ];
+
+  meta = with lib; {
+    description = "Asynchronous RDP protocol implementation";
+    homepage = "https://github.com/skelsec/aardwolf";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/aiobiketrax/default.nix
+++ b/pkgs/development/python-modules/aiobiketrax/default.nix
@ -0,0 +1,53 @@
+{ lib
+, aiohttp
+, auth0-python
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pyjwt
+, pytest-aiohttp
+, pytestCheckHook
+, python-dateutil
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aiobiketrax";
+  version = "0.2.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "basilfx";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-zaHetU0ZG3xkYrO6qA4o+NX8V5td/E08tPEohEwMjh0=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    auth0-python
+    python-dateutil
+    pyjwt
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "aiobiketrax"
+  ];
+
+  meta = with lib; {
+    description = "Library for interacting with the PowUnity BikeTrax GPS tracker";
+    homepage = "https://github.com/basilfx/aiobiketrax";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/aiomysensors/default.nix
+++ b/pkgs/development/python-modules/aiomysensors/default.nix
@ -0,0 +1,64 @@
+{ lib
+, aiofiles
+, asyncio-mqtt
+, awesomeversion
+, buildPythonPackage
+, click
+, fetchFromGitHub
+, marshmallow
+, poetry-core
+, pyserial-asyncio
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aiomysensors";
+  version = "0.3.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "MartinHjelmare";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-EGVoHEJrpGtp8OrhQhRZVaN1GhL4QCo/azp6pzgYYcs=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiofiles
+    asyncio-mqtt
+    awesomeversion
+    click
+    marshmallow
+    pyserial-asyncio
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=src --cov-report=term-missing:skip-covered" "" \
+      --replace 'marshmallow = "^3.17"' 'marshmallow = "*"'
+  '';
+
+  pythonImportsCheck = [
+    "aiomysensors"
+  ];
+
+  meta = with lib; {
+    description = "Library to connect to MySensors gateways";
+    homepage = "https://github.com/MartinHjelmare/aiomysensors";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/aioopenexchangerates/default.nix
+++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix
@ -0,0 +1,57 @@
+{ lib
+, aiohttp
+, aioresponses
+, pydantic
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytest-aiohttp
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aioopenexchangerates";
+  version = "0.4.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "MartinHjelmare";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-qm9B4m5CLhfqnZj+sdHZ+iA0+YnDR9Dh3lCy/YADkEI=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    pydantic
+  ];
+
+  checkInputs = [
+    aioresponses
+    pytest-aiohttp
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=aioopenexchangerates --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "aioopenexchangerates"
+  ];
+
+  meta = with lib; {
+    description = "Library for the Openexchangerates API";
+    homepage = "https://github.com/MartinHjelmare/aioopenexchangerates";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/aiortm/default.nix
+++ b/pkgs/development/python-modules/aiortm/default.nix
@ -0,0 +1,55 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, click
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, yarl
+}:
+
+buildPythonPackage rec {
+  pname = "aiortm";
+  version = "0.3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "MartinHjelmare";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-DTFynPFf0NUBieXDiMKhCNwBqx3s/xzggNmnz/IKjbU=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    click
+    yarl
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=aiortm --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "aiortm"
+  ];
+
+  meta = with lib; {
+    description = "Library for the Remember the Milk API";
+    homepage = "https://github.com/MartinHjelmare/aiortm";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/arc4/default.nix
+++ b/pkgs/development/python-modules/arc4/default.nix
@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "arc4";
+  version = "0.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "manicmaniac";
+    repo = pname;
+    rev = version;
+    hash = "sha256-1VgPYLyBQkxyuUO7KZv5sqYIEieV1RkBtlLVkLUUO4w=";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "arc4"
+  ];
+
+  meta = with lib; {
+    description = "ARCFOUR (RC4) cipher implementation";
+    homepage = "https://github.com/manicmaniac/arc4";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage rec {
  pname = "asyncssh";
-  version = "2.11.0";
+  version = "2.12.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-WcNs53up3ajdV62HV3bnEF3bH6hRvAObs66t6sT2e1Y=";
+    sha256 = "sha256-J0EBMixLlBgjru2OGrbnvlGRaGxtstK9Na/rowUF54A=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@ -1,5 +1,8 @@
 { lib
+, aiohttp
+, aioresponses
 , buildPythonPackage
+, callee
 , fetchPypi
 , mock
 , pyjwt
@ -17,7 +20,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-sXEWg6zrwMs8pCSloJtLL3o7ZAXTTiMXEgI7sDaogr4=";
+    hash = "sha256-sXEWg6zrwMs8pCSloJtLL3o7ZAXTTiMXEgI7sDaogr4=";
  };

  propagatedBuildInputs = [
@ -26,12 +29,15 @@ buildPythonPackage rec {
  ];

  checkInputs = [
+    aiohttp
+    aioresponses
+    callee
    mock
    pytestCheckHook
  ];

  disabledTests = [
-    # tries to ping websites (e.g. google.com)
+    # Tries to ping websites (e.g. google.com)
    "can_timeout"
    "test_options_are_created_by_default"
    "test_options_are_used_and_override"
--- a/pkgs/development/python-modules/automat/default.nix
+++ b/pkgs/development/python-modules/automat/default.nix
@ -1,8 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , attrs
-, m2r
 , pytest-benchmark
 , pytestCheckHook
 , setuptools-scm
@ -19,8 +19,17 @@ let automat = buildPythonPackage rec {
    sha256 = "7979803c74610e11ef0c0d68a2942b152df52da55336e0c9d58daf1831cbdf33";
  };

+  patches = [
+    # don't depend on m2r
+    (fetchpatch {
+      name = "dont-depend-on-m2r.patch";
+      url = "https://github.com/glyph/automat/compare/v20.2.0..2562fa4ddeba5b5945d9482baa4c26a414f5e831.patch";
+      includes = [ "setup.py" ];
+      hash = "sha256-jlPLJMu1QbBpiVYHDiqPydrXjEoZgYZTVVGNxSA0NxY=";
+    })
+  ];
+
  nativeBuildInputs = [
-    m2r
    setuptools-scm
  ];

--- a/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-keyvault";
-  version = "10.0.0";
+  version = "10.1.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-ALaVll2198a6DjOpzaHobE22N78Qe5koYYLxCtFiwaM=";
+    hash = "sha256-DpO+6FvsNwjjcz2ImhHpColHVNpPUMgCtEMrfUzfAaA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/colormath/default.nix
+++ b/pkgs/development/python-modules/colormath/default.nix
@ -8,20 +8,26 @@

 buildPythonPackage rec {
  pname = "colormath";
-  version = "3.0.0";
+  # Switch to unstable which fixes an deprecation issue with newer numpy
+  # versions, should be included in versions > 3.0
+  # https://github.com/gtaylor/python-colormath/issues/104
+  version = "unstable-2021-04-17";

  src = fetchFromGitHub {
    owner = "gtaylor";
-    rev = "3.0.0";
    repo = "python-colormath";
-    sha256 = "1nqf5wy8ikx2g684khzvjc4iagkslmbsxxwilbv4jpaznr9lahdl";
+    rev = "4a076831fd5136f685aa7143db81eba27b2cd19a";
+    sha256 = "sha256-eACVPIQFgiGiVmQ/PjUxP/UH/hBOsCywz5PlgpA4dk4=";
  };

  propagatedBuildInputs = [ networkx numpy ];

  checkInputs = [ nose ];
+
  checkPhase = "nosetests";

+  pythonImportsCheck = [ "colormath" ];
+
  meta = with lib; {
    description = "Color math and conversion library";
    homepage = "https://github.com/gtaylor/python-colormath";
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@ -25,14 +25,14 @@

 buildPythonPackage rec {
  pname = "datashader";
-  version = "0.14.1";
+  version = "0.14.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-VGF6351lVCBat68EY9IY9lHk1hDMcjBcrVdPSliFq4Y=";
+    hash = "sha256-q8aOpuJD6aX9m9jPm9PY5vZGBJL6Jpf+pPHbcQVOJLg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "db-dtypes";
-  version = "1.0.2";
+  version = "1.0.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,14 +20,9 @@ buildPythonPackage rec {
    owner = "googleapis";
    repo = "python-db-dtypes-pandas";
    rev = "refs/tags/v${version}";
-    hash = "sha256-LLKhYLzGUQRx4ciWv1TilYvTOO0sj6rdkPlJLPZ8VXA=";
+    hash = "sha256-KkwXmJ9KwmslBPhBApm+bcY7Tu/J2ZK4sszBaMMDcpY=";
  };

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace 'pyarrow>=3.0.0, <9.0dev' 'pyarrow>=3.0.0, <10.0dev'
-  '';
-
  propagatedBuildInputs = [
    numpy
    packaging
--- a/pkgs/development/python-modules/django-storages/default.nix
+++ b/pkgs/development/python-modules/django-storages/default.nix
@ -11,11 +11,11 @@

 buildPythonPackage rec {
  pname = "django-storages";
-  version = "1.13";
+  version = "1.13.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-1P7Zi7+1NHCW3frCpmZdUTPHiLnsMsFW7F9/sCrlczU=";
+    sha256 = "sha256-s9mOzAnxsWJ8Kyz0MJZDIs5OCGF9v5tCNsFqModaHgs=";
  };

  propagatedBuildInputs = [ django ];
--- a/pkgs/development/python-modules/elastic-apm/default.nix
+++ b/pkgs/development/python-modules/elastic-apm/default.nix
@ -28,7 +28,7 @@

 buildPythonPackage rec {
  pname = "elastic-apm";
-  version = "6.10.2";
+  version = "6.11.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -37,7 +37,7 @@ buildPythonPackage rec {
    owner = "elastic";
    repo = "apm-agent-python";
    rev = "v${version}";
-    hash = "sha256-Ru/yGND7xkpO3QH/cTMu4rxWUXSMsFx5u/V/rHY8k1E=";
+    hash = "sha256-ZmvOyEkXp0PEDHWcuGT91mhXwV2E6SPlrWBY/sNiRmc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/galois/default.nix
+++ b/pkgs/development/python-modules/galois/default.nix
@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, pytestCheckHook
+, pytest-xdist
+, numpy
+, numba
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "galois";
+  version = "0.0.32";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "mhostetter";
+    repo = "galois";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-+cxRLrfqk3N9pWKCVsTxruZwMYZ5dQyKJRnrb8y+ECM=";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+    numba
+    typing-extensions
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-xdist
+  ];
+
+  postPatch = ''
+     substituteInPlace setup.cfg \
+       --replace "numpy >= 1.18.4, < 1.23" "numpy >= 1.18.4"
+    '';
+
+  pythonImportsCheck = [ "galois" ];
+
+  meta = {
+    description = "A Python 3 package that extends NumPy arrays to operate over finite fields";
+    homepage = "https://github.com/mhostetter/galois";
+    downloadPage = "https://github.com/mhostetter/galois/releases";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ chrispattison ];
+  };
+}
--- a/pkgs/development/python-modules/levenshtein/default.nix
+++ b/pkgs/development/python-modules/levenshtein/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "levenshtein";
-  version = "0.19.3";
+  version = "0.20.2";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "maxbachmann";
    repo = "Levenshtein";
    rev = "refs/tags/v${version}";
-    hash = "sha256-4Oc1n/ZgLdq57ZeyZHzTQOjar9Ligeb4yqKeT0s5dHY=";
+    hash = "sha256-zVYfErh9tts3yPgXqqeX6xp8o+gLd7nN64+Ml6YZfjE=";
  };

  nativeBuildInputs = [
@ -51,6 +51,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Functions for fast computation of Levenshtein distance and string similarity";
    homepage = "https://github.com/maxbachmann/Levenshtein";
+    changelog = "https://github.com/maxbachmann/Levenshtein/blob/${src.rev}/HISTORY.md";
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/mistune/common.nix
+++ b/pkgs/development/python-modules/mistune/common.nix
@ -1,4 +1,12 @@
-{ lib, buildPythonPackage, fetchPypi, nose, version, sha256, format ? "setuptools" }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, nose
+, version
+, sha256
+, format ? "setuptools"
+, extraMeta ? {}
+}:

 buildPythonPackage rec {
  inherit version format;
@ -15,5 +23,5 @@ buildPythonPackage rec {
    description = "The fastest markdown parser in pure Python";
    homepage = "https://github.com/lepture/mistune";
    license = licenses.bsd3;
-  };
+  } // extraMeta;
 }
--- a/pkgs/development/python-modules/mistune/default.nix
+++ b/pkgs/development/python-modules/mistune/default.nix
@ -2,6 +2,9 @@ self: rec {
  mistune_0_8 = self.callPackage ./common.nix {
    version = "0.8.4";
    sha256 = "59a3429db53c50b5c6bcc8a07f8848cb00d7dc8bdb431a4ab41920d201d4756e";
+    extraMeta = {
+      knownVulnerabilities = [ "CVE-2022-34749" ];
+    };
  };
  mistune_2_0 = self.callPackage ./common.nix {
    version = "2.0.4";
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@ -32,14 +32,14 @@

 buildPythonPackage rec {
  pname = "mlflow";
-  version = "1.27.0";
+  version = "1.28.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ah401r4mZyXkHUVHVyqEJdhtZiPhyIiM8/IrkAGb4Ko=";
+    hash = "sha256-aXZp4eQuiHwzBQKuTw7WROgUvgas2pDOpEU57M4zSmQ=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@ -27,7 +27,7 @@

 buildPythonPackage rec {
  pname = "ocrmypdf";
-  version = "13.6.0";
+  version = "13.7.0";

  src = fetchFromGitHub {
    owner = "ocrmypdf";
@ -39,7 +39,7 @@ buildPythonPackage rec {
    postFetch = ''
      rm "$out/.git_archival.txt"
    '';
-    hash = "sha256-EY0dXma6tyXLT8XogS5iFdVgJPrtwB9YVrplhDT4gWw=";
+    hash = "sha256-cw2wZMPhWzxRpeM90g9NmuYBYpU13R2iDzs7a8SS/CY=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/ocrmypdf/paths.patch
+++ b/pkgs/development/python-modules/ocrmypdf/paths.patch
@ -1,8 +1,8 @@
 diff --git a/src/ocrmypdf/_exec/ghostscript.py b/src/ocrmypdf/_exec/ghostscript.py
-index 4da65483..af750249 100644
+index 9e21c33c..21f134b3 100644
 --- a/src/ocrmypdf/_exec/ghostscript.py
 +++ b/src/ocrmypdf/_exec/ghostscript.py
-@@ -35,15 +35,7 @@ log = logging.getLogger(__name__)
+@@ -32,15 +32,7 @@ log = logging.getLogger(__name__)
 # Most reliable what to get the bitness of Python interpreter, according to Python docs
 _IS_64BIT = sys.maxsize > 2**32
 
@ -20,10 +20,10 @@ index 4da65483..af750249 100644
 
 def version():
 diff --git a/src/ocrmypdf/_exec/jbig2enc.py b/src/ocrmypdf/_exec/jbig2enc.py
-index 2e8a058b..65a09088 100644
+index 0f8f7392..db792b10 100644
 --- a/src/ocrmypdf/_exec/jbig2enc.py
 +++ b/src/ocrmypdf/_exec/jbig2enc.py
-@@ -14,7 +14,7 @@ from ocrmypdf.subprocess import get_version, run
+@@ -12,7 +12,7 @@ from ocrmypdf.subprocess import get_version, run
 
 
 def version():
@ -32,7 +32,7 @@ index 2e8a058b..65a09088 100644
 
 
 def available():
-@@ -27,7 +27,7 @@ def available():
+@@ -25,7 +25,7 @@ def available():
 
 def convert_group(*, cwd, infiles, out_prefix):
     args = [
@ -41,7 +41,7 @@ index 2e8a058b..65a09088 100644
         '-b',
         out_prefix,
         '-s',  # symbol mode (lossy)
-@@ -46,7 +46,7 @@ def convert_group_mp(args):
+@@ -44,7 +44,7 @@ def convert_group_mp(args):
 
 
 def convert_single(*, cwd, infile, outfile):
@ -51,10 +51,10 @@ index 2e8a058b..65a09088 100644
         proc = run(args, cwd=cwd, stdout=fstdout, stderr=PIPE)
     proc.check_returncode()
 diff --git a/src/ocrmypdf/_exec/pngquant.py b/src/ocrmypdf/_exec/pngquant.py
-index ca8a4542..d0544174 100644
+index 64e91139..ab5b9c49 100644
 --- a/src/ocrmypdf/_exec/pngquant.py
 +++ b/src/ocrmypdf/_exec/pngquant.py
-@@ -19,7 +19,7 @@ from ocrmypdf.subprocess import get_version, run
+@@ -17,7 +17,7 @@ from ocrmypdf.subprocess import get_version, run
 
 
 def version():
@ -63,7 +63,7 @@ index ca8a4542..d0544174 100644
 
 
 def available():
-@@ -46,7 +46,7 @@ def input_as_png(input_file: Path):
+@@ -44,7 +44,7 @@ def input_as_png(input_file: Path):
 def quantize(input_file: Path, output_file: Path, quality_min: int, quality_max: int):
     with input_as_png(input_file) as input_stream:
         args = [
@ -73,10 +73,10 @@ index ca8a4542..d0544174 100644
             '--skip-if-larger',
             '--quality',
 diff --git a/src/ocrmypdf/_exec/tesseract.py b/src/ocrmypdf/_exec/tesseract.py
-index 01177cac..665f1145 100644
+index ad98836a..a12d3002 100644
 --- a/src/ocrmypdf/_exec/tesseract.py
 +++ b/src/ocrmypdf/_exec/tesseract.py
-@@ -114,7 +114,7 @@ class TesseractVersion(Version):
+@@ -111,7 +111,7 @@ class TesseractVersion(Version):
 
 
 def version() -> str:
@ -84,8 +84,8 @@ index 01177cac..665f1145 100644
 +    return get_version('@tesseract@', regex=r'tesseract\s(.+)')
 
 
- def has_user_words():
-@@ -141,7 +141,7 @@ def get_languages():
+ def has_user_words() -> bool:
+@@ -138,7 +138,7 @@ def get_languages() -> set[str]:
         msg += output
         return msg
 
@ -94,20 +94,20 @@ index 01177cac..665f1145 100644
     try:
         proc = run(
             args_tess,
-@@ -163,7 +163,7 @@ def get_languages():
+@@ -160,7 +160,7 @@ def get_languages() -> set[str]:
 
 
- def tess_base_args(langs: List[str], engine_mode: Optional[int]) -> List[str]:
+ def tess_base_args(langs: list[str], engine_mode: int | None) -> list[str]:
 -    args = ['tesseract']
 +    args = ['@tesseract@']
     if langs:
         args.extend(['-l', '+'.join(langs)])
     if engine_mode is not None:
 diff --git a/src/ocrmypdf/_exec/unpaper.py b/src/ocrmypdf/_exec/unpaper.py
-index 479959ef..cc15fdec 100644
+index d7f24265..d14f85de 100644
 --- a/src/ocrmypdf/_exec/unpaper.py
 +++ b/src/ocrmypdf/_exec/unpaper.py
-@@ -69,7 +69,7 @@ class UnpaperImageTooLargeError(Exception):
+@@ -66,7 +66,7 @@ class UnpaperImageTooLargeError(Exception):
 
 
 def version() -> str:
@ -115,13 +115,13 @@ index 479959ef..cc15fdec 100644
 +    return get_version('@unpaper@')
 
 
- SUFFIXES = {'1': '.pbm', 'L': '.pgm', 'RGB': '.ppm'}
-@@ -123,7 +123,7 @@ def _setup_unpaper_io(input_file: Path) -> Iterator[Tuple[Path, Path, Path]]:
+ SUPPORTED_MODES = {'1', 'L', 'RGB'}
+@@ -120,7 +120,7 @@ def _setup_unpaper_io(input_file: Path) -> Iterator[tuple[Path, Path, Path]]:
 def run_unpaper(
-     input_file: Path, output_file: Path, *, dpi: DecFloat, mode_args: List[str]
+     input_file: Path, output_file: Path, *, dpi: DecFloat, mode_args: list[str]
 ) -> None:
 -    args_unpaper = ['unpaper', '-v', '--dpi', str(round(dpi, 6))] + mode_args
 +    args_unpaper = ['@unpaper@', '-v', '--dpi', str(round(dpi, 6))] + mode_args
 
-     with _setup_unpaper_io(input_file) as (input_pnm, output_pnm, tmpdir):
+     with _setup_unpaper_io(input_file) as (input_png, output_pnm, tmpdir):
         # To prevent any shenanigans from accepting arbitrary parameters in
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "openai";
-  version = "0.22.0";
+  version = "0.22.1";

  disabled = pythonOlder "3.7.1";

@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "openai";
    repo = "openai-python";
    rev = "v${version}";
-    sha256 = "sha256-4FKFcUiY17hEiOGFP1fPBtcvcM19hFrHXX3ZLxgdJHI=";
+    sha256 = "sha256-QUnsm0ui1BFlLqAlH1bp7uDbhiRigePrAPAkSRjftM4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@ -24,7 +24,7 @@

 buildPythonPackage rec {
  pname = "pikepdf";
-  version = "5.3.1";
+  version = "5.4.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -39,7 +39,7 @@ buildPythonPackage rec {
    postFetch = ''
      rm "$out/.git_archival.txt"
    '';
-    hash = "sha256-QYSI0oWuDw19EF8pwh3t1+VOY3Xe/AZxL1uARufg/nE=";
+    hash = "sha256-b4QUn+wfkk6Yx74ViBg6yaE1+bXtxidoyXYgBaJ9iiM=";
  };

  patches = [
--- a/pkgs/development/python-modules/pymicrobot/default.nix
+++ b/pkgs/development/python-modules/pymicrobot/default.nix
@ -0,0 +1,40 @@
+{ lib
+, bleak
+, bleak-retry-connector
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pymicrobot";
+  version = "0.0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchPypi {
+    pname = "PyMicroBot";
+    inherit version;
+    hash = "sha256-I43a75jEU/jvjAEUBXeTZGGBy0pne1P3DA9Gbzy+c34=";
+  };
+
+  propagatedBuildInputs = [
+    bleak
+    bleak-retry-connector
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "microbot"
+  ];
+
+  meta = with lib; {
+    description = "Library to communicate with MicroBot";
+    homepage = "https://github.com/spycle/pyMicroBot/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pytorch-metric-learning/default.nix
+++ b/pkgs/development/python-modules/pytorch-metric-learning/default.nix
@ -8,11 +8,12 @@
 , pytorch
 , torchvision
 , tqdm
+, faiss
 }:

 buildPythonPackage rec {
  pname   = "pytorch-metric-learning";
-  version = "1.5.0";
+  version = "1.5.1";

  disabled = isPy27;

@ -20,7 +21,7 @@ buildPythonPackage rec {
    owner = "KevinMusgrave";
    repo = pname;
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-ge6y5n1N/+nymgD4La3ger7N4vvcoo1Bxa+etirNFNI=";
+    sha256 = "sha256-d7Ngd4SzGTJXtpgs2Jqb+y1aeMt9YUqIOft5ByDtRsc=";
  };

  propagatedBuildInputs = [
@ -36,14 +37,18 @@ buildPythonPackage rec {
    export TEST_DEVICE=cpu
    export TEST_DTYPES=float32,float64  # half-precision tests fail on CPU
  '';
+
  # package only requires `unittest`, but use `pytest` to exclude tests
-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    faiss
+    pytestCheckHook
+  ];
+
  disabledTests = [
-    # requires FAISS (not in Nixpkgs)
-    "test_accuracy_calculator_and_faiss"
-    "test_global_embedding_space_tester"
-    "test_with_same_parent_label_tester"
+    # TypeError: setup() missing 1 required positional argument: 'world_size'
+    "TestDistributedLossWrapper"
    # require network access:
+    "TestInference"
    "test_get_nearest_neighbors"
    "test_tuplestoweights_sampler"
    "test_untrained_indexer"
@ -59,6 +64,5 @@ buildPythonPackage rec {
    changelog = "https://github.com/KevinMusgrave/pytorch-metric-learning/releases/tag/v${version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ bcdarwin ];
-    broken = true;  # requires faiss which is unpackaged
  };
 }
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ b/pkgs/development/python-modules/pyunifiprotect/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "pyunifiprotect";
-  version = "4.0.12";
+  version = "4.1.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "briis";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-xbODjgJHd1e3NdnoB/srlOdeuhOj2JeN8b8MQh3D4+A=";
+    hash = "sha256-ID3KSKPtgslS1Z+BZprMcTSQUnQbiHKgGQQipOSER9g=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/qingping-ble/default.nix
+++ b/pkgs/development/python-modules/qingping-ble/default.nix
@ -0,0 +1,53 @@
+{ lib
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "qingping-ble";
+  version = "0.2.3";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "bluetooth-devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-+iUZIsaSYgptHXtNSc9sJiBU8CUEFPDsLVGuFR5WvDw=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-sensor-state-data
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=qingping_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "qingping_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Qingping BLE devices";
+    homepage = "https://github.com/bluetooth-devices/qingping-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "rapidfuzz";
-  version = "2.4.2";
+  version = "2.4.3";

  disabled = pythonOlder "3.6";

@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "maxbachmann";
    repo = "RapidFuzz";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nLYxPGK+7ThvpsmvF2zlo+DqykY8bW1j2si3Lnyq7oo=";
+    hash = "sha256-KKRqSMU1AzXYDB50CBQ1ZcL87KgG2/tL+cmR1jnrTVk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/sensor-state-data/default.nix
+++ b/pkgs/development/python-modules/sensor-state-data/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "sensor-state-data";
-  version = "2.0.2";
+  version = "2.1.2";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-EywNH6REtopJoowsKQNNyJNYYyBR7L2pcrvmZAr5PZg=";
+    hash = "sha256-Z4sHrj0APoCfPhdSKB9guRrPo4TD47+GcQ0KoFgb268=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/sphinx-fortran/default.nix
+++ b/pkgs/development/python-modules/sphinx-fortran/default.nix
@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, future
+, numpy
+, sphinx
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-fortran";
+  version = "unstable-2022-03-02";
+
+  src = fetchFromGitHub {
+    owner = "VACUMM";
+    repo = pname;
+    rev = "394ae990b43ed43fcff8beb048632f5e99794264";
+    sha256 = "sha256-IVKu5u9gqs7/9EZrf4ZYd12K6J31u+/B8kk4+8yfohM=";
+  };
+
+  propagatedBuildInputs = [
+    future
+    numpy
+    sphinx
+    six
+  ];
+
+  pythonImportsCheck = [ "sphinxfortran" ];
+
+  # Tests are failing because reference files are not updated
+  doCheck = false;
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Fortran domain and autodoc extensions to Sphinx";
+    homepage = "http://sphinx-fortran.readthedocs.org/";
+    license = licenses.cecill21;
+    maintainers = with maintainers; [ loicreynier ];
+  };
+}
--- a/pkgs/development/python-modules/streamz/default.nix
+++ b/pkgs/development/python-modules/streamz/default.nix
@ -20,28 +20,16 @@

 buildPythonPackage rec {
  pname = "streamz";
-  version = "0.6.3";
+  version = "0.6.4";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-0wZ1ldLFRAIL9R+gLfwsFbL+gvdORAkYWNjnDmeafm8=";
+    hash = "sha256-VXfWkEwuxInBQVQJV3IQXgGVRkiBmYfUZCBMbjyWNPM=";
  };

-  patches = [
-    # remove with next bump
-    (fetchpatch {
-      name = "fix-tests-against-distributed-2021.10.0.patch";
-      url = "https://github.com/python-streamz/streamz/commit/5bd3bc4d305ff40c740bc2550c8491be9162778a.patch";
-      sha256 = "1xzxcbf7yninkyizrwm3ahqk6ij2fmh0454iqjx2n7mmzx3sazx7";
-      includes = [
-        "streamz/tests/test_dask.py"
-      ];
-    })
-  ];
-
  propagatedBuildInputs = [
    networkx
    six
@ -65,6 +53,12 @@ buildPythonPackage rec {
  ];

  disabledTests = [
+    # Error with distutils version: fixture 'cleanup' not found
+    "test_separate_thread_without_time"
+    "test_await_syntax"
+    "test_partition_then_scatter_sync"
+    "test_sync"
+    "test_sync_2"
    # Test fail in the sandbox
    "test_tcp_async"
    "test_tcp"
--- a/pkgs/development/python-modules/xml2rfc/default.nix
+++ b/pkgs/development/python-modules/xml2rfc/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "xml2rfc";
-  version = "3.13.1";
+  version = "3.14.0";

  disabled = pythonOlder "3.6";

@ -34,7 +34,7 @@ buildPythonPackage rec {
    owner = "ietf-tools";
    repo = "xml2rfc";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-DRHhcMPLBr1SM6e3BCB8gfvadd8CeMIOsPT+uzcET+4=";
+    sha256 = "sha256-BuOHQ6LnfjdlE9+wdJbl6wdD/oddKIklabVBx1IJJBA=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/xsdata/default.nix
+++ b/pkgs/development/python-modules/xsdata/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "xsdata";
-  version = "22.5";
+  version = "22.7";

  disabled = pythonOlder "3.6";

@ -22,7 +22,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "701dcda5a4a07df3a642f8fb6f73f0e2e18224d359bcb7f4212b3c29d7af72c2";
+    sha256 = "sha256-2EpbTNYdjcHOQQqe+bEpMzGxD2Jh34P+eI+uK4SJPdo=";
  };

  postPatch = ''
--- a/Show more
+++ b/Show more