Merge branch 'master' into haskell-updates

2022-01-31 21:09:56 +01:00 · 2022-01-31 21:09:56 +01:00 · b73e03f9ba
parent 74eaf2bc93 d5ddafd0fa
commit b73e03f9ba
225 changed files with 1522 additions and 1465 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -67,10 +67,6 @@ indent_style = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset

-[pkgs/build-support/upstream-updater/**]
-indent_style = unset
-trim_trailing_whitespace = unset
-
 [pkgs/development/compilers/elm/registry.dat]
 end_of_line = unset
 insert_final_newline = unset
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -235,6 +235,23 @@
          removed due to it being an outdated version.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The DHCP server (<literal>services.dhcpd4</literal>,
+          <literal>services.dhcpd6</literal>) has been hardened. The
+          service is now using the systemd’s
+          <literal>DynamicUser</literal> mechanism to run as an
+          unprivileged dynamically-allocated user with limited
+          capabilities. The dhcpd state files are now always stored in
+          <literal>/var/lib/dhcpd{4,6}</literal> and the
+          <literal>services.dhcpd4.stateDir</literal> and
+          <literal>service.dhcpd6.stateDir</literal> options have been
+          removed. If you were depending on root privileges or
+          set{uid,gid,cap} binaries in dhcpd shell hooks, you may give
+          dhcpd more capabilities with e.g.
+          <literal>systemd.services.dhcpd6.serviceConfig.AmbientCapabilities</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>mailpile</literal> email webclient
@ -435,6 +452,20 @@
          directly.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The existing <literal>pkgs.opentelemetry-collector</literal>
+          has been moved to
+          <literal>pkgs.opentelemetry-collector-contrib</literal> to
+          match the actual source being the <quote>contrib</quote>
+          edition. <literal>pkgs.opentelemetry-collector</literal> is
+          now the actual core release of opentelemetry-collector. If you
+          use the community contributions you should change the package
+          you refer to. If you don’t need them update your commands from
+          <literal>otelcontribcol</literal> to
+          <literal>otelcorecol</literal> and enjoy a 7x smaller binary.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>pkgs.noto-fonts-cjk</literal> is now deprecated in
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -81,6 +81,11 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `services.kubernetes.addons.dashboard` was removed due to it being an outdated version.

+- The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
+  The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
+  The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
+  If you were depending on root privileges or set{uid,gid,cap} binaries in dhcpd shell hooks, you may give dhcpd more capabilities with e.g. `systemd.services.dhcpd6.serviceConfig.AmbientCapabilities`.
+
 - The `mailpile` email webclient (`services.mailpile`) has been removed due to its reliance on python2.

 - The MoinMoin wiki engine (`services.moinmoin`) has been removed, because Python 2 is being retired from nixpkgs.
@ -133,11 +138,20 @@ In addition to numerous new and upgraded packages, this release has the followin

 - MultiMC has been replaced with the fork PolyMC due to upstream developers being hostile to 3rd party package maintainers. PolyMC removes all MultiMC branding and is aimed at providing proper 3rd party packages like the one contained in Nixpkgs. This change affects the data folder where game instances and other save and configuration files are stored. Users with existing installations should rename `~/.local/share/multimc` to `~/.local/share/polymc`. The main config file's path has also moved from `~/.local/share/multimc/multimc.cfg` to `~/.local/share/polymc/polymc.cfg`.

+
 - The terraform 0.12 compatibility has been removed and the `terraform.withPlugins` and `terraform-providers.mkProvider` implementations simplified. Providers now need to be stored under
 `$out/libexec/terraform-providers/<registry>/<owner>/<name>/<version>/<os>_<arch>/terraform-provider-<name>_v<version>` (which mkProvider does).

  This breaks back-compat so it's not possible to mix-and-match with previous versions of nixpkgs. In exchange, it now becomes possible to use the providers from [nixpkgs-terraform-providers-bin](https://github.com/numtide/nixpkgs-terraform-providers-bin) directly.

+- The existing `pkgs.opentelemetry-collector` has been moved to
+  `pkgs.opentelemetry-collector-contrib` to match the actual source being the
+  "contrib" edition. `pkgs.opentelemetry-collector` is now the actual core
+  release of opentelemetry-collector. If you use the community contributions
+  you should change the package you refer to. If you don't need them update your
+  commands from `otelcontribcol` to `otelcorecol` and enjoy a 7x smaller binary.
+
+
 - `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans`
  and `pkgs.noto-fonts-cjk-serif` because they each have different release
  schedules. To maintain compatibility with prior releases of Nixpkgs,
--- a/nixos/modules/hardware/all-firmware.nix
+++ b/nixos/modules/hardware/all-firmware.nix
@ -57,7 +57,6 @@ in {
        rtl8723bs-firmware
        rtl8761b-firmware
        rtw88-firmware
-        rtw89-firmware
        zd1211fw
        alsa-firmware
        sof-firmware
@ -65,6 +64,8 @@ in {
      ] ++ optional (pkgs.stdenv.hostPlatform.isAarch32 || pkgs.stdenv.hostPlatform.isAarch64) raspberrypiWirelessFirmware
        ++ optionals (versionOlder config.boot.kernelPackages.kernel.version "4.13") [
        rtl8723bs-firmware
+      ] ++ optionals (versionOlder config.boot.kernelPackages.kernel.version "5.16") [
+        rtw89-firmware
      ];
      hardware.wirelessRegulatoryDatabase = true;
    })
--- a/nixos/modules/services/networking/dhcpd.nix
+++ b/nixos/modules/services/networking/dhcpd.nix
@ -28,38 +28,45 @@ let
      }
    '';

-  dhcpdService = postfix: cfg: optionalAttrs cfg.enable {
-    "dhcpd${postfix}" = {
-      description = "DHCPv${postfix} server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+  dhcpdService = postfix: cfg:
+    let
+      configFile =
+        if cfg.configFile != null
+          then cfg.configFile
+          else writeConfig cfg;
+      leaseFile = "/var/lib/dhcpd${postfix}/dhcpd.leases";
+      args = [
+        "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
+        "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
+        "-cf" configFile
+        "-lf" leaseFile
+      ] ++ cfg.extraFlags
+        ++ cfg.interfaces;
+    in
+      optionalAttrs cfg.enable {
+        "dhcpd${postfix}" = {
+          description = "DHCPv${postfix} server";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];

-      preStart = ''
-        mkdir -m 755 -p ${cfg.stateDir}
-        chown dhcpd:nogroup ${cfg.stateDir}
-        touch ${cfg.stateDir}/dhcpd.leases
-      '';
-
-      serviceConfig =
-        let
-          configFile = if cfg.configFile != null then cfg.configFile else writeConfig cfg;
-          args = [ "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
-                   "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
-                   "-cf" "${configFile}"
-                   "-lf" "${cfg.stateDir}/dhcpd.leases"
-                   "-user" "dhcpd" "-group" "nogroup"
-                 ] ++ cfg.extraFlags
-                   ++ cfg.interfaces;
-
-        in {
-          ExecStart = concatMapStringsSep " " escapeShellArg args;
-          Type = "forking";
-          Restart = "always";
-          RuntimeDirectory = [ "dhcpd${postfix}" ];
-          PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
+          preStart = "touch ${leaseFile}";
+          serviceConfig = {
+            ExecStart = concatMapStringsSep " " escapeShellArg args;
+            Type = "forking";
+            Restart = "always";
+            DynamicUser = true;
+            User = "dhcpd";
+            Group = "dhcpd";
+            AmbientCapabilities = [
+              "CAP_NET_RAW"          # to send ICMP messages
+              "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67)
+            ];
+            StateDirectory   = "dhcpd${postfix}";
+            RuntimeDirectory = "dhcpd${postfix}";
+            PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
+          };
        };
-    };
-  };
+      };

  machineOpts = { ... }: {

@ -102,15 +109,6 @@ let
      '';
    };

-    stateDir = mkOption {
-      type = types.path;
-      # We use /var/lib/dhcp for DHCPv4 to save backwards compatibility.
-      default = "/var/lib/dhcp${if postfix == "4" then "" else postfix}";
-      description = ''
-        State directory for the DHCP server.
-      '';
-    };
-
    extraConfig = mkOption {
      type = types.lines;
      default = "";
@ -194,7 +192,13 @@ in

  imports = [
    (mkRenamedOptionModule [ "services" "dhcpd" ] [ "services" "dhcpd4" ])
-  ];
+  ] ++ flip map [ "4" "6" ] (postfix:
+    mkRemovedOptionModule [ "services" "dhcpd${postfix}" "stateDir" ] ''
+      The DHCP server state directory is now managed with the systemd's DynamicUser mechanism.
+      This means the directory is named after the service (dhcpd${postfix}), created under
+      /var/lib/private/ and symlinked to /var/lib/.
+    ''
+  );

  ###### interface

@ -210,15 +214,6 @@ in

  config = mkIf (cfg4.enable || cfg6.enable) {

-    users = {
-      users.dhcpd = {
-        isSystemUser = true;
-        group = "dhcpd";
-        description = "DHCP daemon user";
-      };
-      groups.dhcpd = {};
-    };
-
    systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6;

  };
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@ -4,6 +4,8 @@ with lib;
 let
  cfg = config.services.miniflux;

+  defaultAddress = "localhost:8080";
+
  dbUser = "miniflux";
  dbPassword = "miniflux";
  dbHost = "localhost";
@ -31,7 +33,7 @@ in
 {
  options = {
    services.miniflux = {
-      enable = mkEnableOption "miniflux";
+      enable = mkEnableOption "miniflux and creates a local postgres database for it";

      config = mkOption {
        type = types.attrsOf types.str;
@ -45,6 +47,9 @@ in
          Configuration for Miniflux, refer to
          <link xlink:href="https://miniflux.app/docs/configuration.html"/>
          for documentation on the supported values.
+
+          Correct configuration for the database is already provided.
+          By default, listens on ${defaultAddress}.
        '';
      };

@ -64,7 +69,7 @@ in
  config = mkIf cfg.enable {

    services.miniflux.config =  {
-      LISTEN_ADDR = mkDefault "localhost:8080";
+      LISTEN_ADDR = mkDefault defaultAddress;
      DATABASE_URL = "postgresql://${dbUser}:${dbPassword}@${dbHost}/${dbName}?sslmode=disable";
      RUN_MIGRATIONS = "1";
      CREATE_ADMIN = "1";
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -924,7 +924,7 @@ in
        PrivateMounts = true;
        # System Call Filtering
        SystemCallArchitectures = "native";
-        SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid @mincore" ] ++ optionals (cfg.package != pkgs.tengine) [ "~@ipc" ];
+        SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] ++ optionals (cfg.package != pkgs.tengine) [ "~@ipc" ];
      };
    };

--- a/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix
+++ b/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix
@ -36,19 +36,10 @@ import ./make-test-python.nix ({pkgs, ...}: {
      };

      # Since we want to program the routes that we delegate to the "customer"
-      # into our routing table we must have a way to gain the required privs.
-      # This security wrapper will do in our test setup.
-      #
-      # DO NOT COPY THIS TO PRODUCTION AS IS. Think about it at least twice.
-      # Everyone on the "isp" machine will be able to add routes to the kernel.
-      security.wrappers.add-dhcpd-lease = {
-        owner = "root";
-        group = "root";
-        source = pkgs.writeShellScript "add-dhcpd-lease" ''
-          exec ${pkgs.iproute2}/bin/ip -6 route replace "$1" via "$2"
-        '';
-        capabilities = "cap_net_admin+ep";
-      };
+      # into our routing table we must give dhcpd the required privs.
+      systemd.services.dhcpd6.serviceConfig.AmbientCapabilities =
+        [ "CAP_NET_ADMIN" ];
+
      services = {
        # Configure the DHCPv6 server
        #
@ -80,7 +71,7 @@ import ./make-test-python.nix ({pkgs, ...}: {
              set Prefix = pick-first-value(binary-to-ascii(16, 16, ":", suffix(option dhcp6.ia-pd, 16)), "n/a");
              set PrefixLength = pick-first-value(binary-to-ascii(10, 8, ":", substring(suffix(option dhcp6.ia-pd, 17), 0, 1)), "n/a");
              log(concat(IP, " ", Prefix, " ", PrefixLength));
-              execute("/run/wrappers/bin/add-dhcpd-lease", concat(Prefix,"/",PrefixLength), IP);
+              execute("${pkgs.iproute2}/bin/ip", "-6", "route", "replace", concat(Prefix,"/",PrefixLength), "via", IP);
            }
          '';
        };
--- a/pkgs/applications/audio/cozy/default.nix
+++ b/pkgs/applications/audio/cozy/default.nix
@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
  format = "other"; # no setup.py

  pname = "cozy";
-  version = "1.1.2";
+  version = "1.2.0";

  # Temporary fix
  # See https://github.com/NixOS/nixpkgs/issues/57029
@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
    owner = "geigi";
    repo = pname;
    rev = version;
-    sha256 = "sha256-QENn8mFMk06/Uj8QJo0mJQ7frJNcv5RVNJwDB+H/LkI=";
+    sha256 = "0igqf9b77i13sxlk4ziw549h379hmz1slrb3vvf8irk94gxabsaw";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/cyanrip/default.nix
+++ b/pkgs/applications/audio/cyanrip/default.nix
@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "cyanrip";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "cyanreg";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1aip52bwkq8cb1d8ifyv2m6m5dz7jk6qmbhyb97yyf4nhxv445ky";
+    sha256 = "17bi2xhjv3f3i870whkyqckvjlg32wqkspash87zi0jw7m7jm229";
  };

  nativeBuildInputs = [ meson ninja pkg-config ];
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@ -72,6 +72,7 @@ mkDerivation rec {
    gstreamer
    gst-plugins-base
    gst-plugins-good
+    gst-plugins-bad
    gst-plugins-ugly
  ]) ++ lib.optional withVlc libvlc;

--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergo";
-  version = "4.0.16.2";
+  version = "4.0.20.1";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-nAaNT5Rt/oLBA2pSJSinoLKMYJ0VZmuC0zoMYbMSAJQ=";
+    sha256 = "sha256-uKt0TNKcqiXiT5MnsguU5fTdUyFgV7Km5KjrFS/7tws=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/blockchains/erigon.nix
+++ b/pkgs/applications/blockchains/erigon.nix
@ -11,7 +11,7 @@ buildGoModule rec {
    sha256 = "0l0w1badhvlh1rgqzvlmy5k7xhb1nf4f5dmhkl935a5ila08aak3";
  };

-  vendorSha256 = "sha256-kA7pOSP4wkzKuFmUqhZmjXJ0ao64cIgZMrQtQ0bQ++U=";
+  vendorSha256 = "sha256-i8BaT9C39tmHU3GGgd0hUB1PHXnoAdNYRIqZA1ggbjQ=";
  proxyVendor = true;

  # Build errors in mdbx when format hardening is enabled:
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, libtool
+{ lib, stdenv, fetchFromGitHub, pkg-config, libtool
 , bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg, djvulibre
 , lcms2, openexr, libjxl, libpng, liblqr1, libraw, librsvg, libtiff, libxml2, openjpeg, libwebp, libheif
 , potrace, ApplicationServices
@ -18,23 +18,15 @@ in

 stdenv.mkDerivation rec {
  pname = "imagemagick";
-  version = "7.1.0-20";
+  version = "7.1.0-22";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = version;
-    sha256 = "0r8zmk2cfmf09l94hqzfz4aspnzn178ggdbgm7w4hr0p864cbvc3";
+    sha256 = "sha256-Pd/b3lmFpOis8z+ITFScBUNALIKJY4ZOx2VOBwM0Bh4=";
  };

-  patches = [
-    # fix a type confusion bug introduced in 7.1.0-20 with commit 075565e93c71bcaaabf0ce70b7d1060bccdf0020
-    (fetchpatch {
-      url = "https://github.com/ImageMagick/ImageMagick/commit/62845d5672eca4446b952dd0ab2e3e0dab0309d4.patch";
-      sha256 = "1kni5i8b5hl69niypidm90mhir8cafi6r9i857fxdlv045h3dg4p";
-    })
-  ];
-
  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
  outputMan = "out"; # it's tiny

--- a/pkgs/applications/misc/charm/default.nix
+++ b/pkgs/applications/misc/charm/default.nix
@ -11,7 +11,7 @@ buildGoModule rec {
    sha256 = "sha256-5WNkD+YfmQHGAWWfD9/ZEHnHPT0Ejm9Nz+/mn8xvU4U=";
  };

-  vendorSha256 = "sha256-TncVMDeZ8+Wuv1o0Cjks3Ve1OsO+WXH9mClC6GNaSas=";
+  vendorSha256 = "sha256-r0mYrtWllKOvKQJmW0ie4l+1nsCwU8O+CV6ESXNoETk=";

  doCheck = false;

--- a/pkgs/applications/misc/clight/clightd.nix
+++ b/pkgs/applications/misc/clight/clightd.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "clightd";
-  version = "5.4";
+  version = "5.5";

  src = fetchFromGitHub {
    owner = "FedeDP";
    repo = "Clightd";
    rev = version;
-    sha256 = "sha256-ppaxfnZB3+aOzvc/wk1f8D2mFYngQspEOl9XArNMdBE=";
+    sha256 = "sha256-uygMc4SPYBk+G+ENp+KsgDhkm+oq9ZMvWX4wF6iohPM=";
  };

  # dbus-1.pc has datadir=/etc
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "dbeaver";
-  version = "21.3.2"; # When updating also update fetchedMavenDeps.sha256
+  version = "21.3.3"; # When updating also update fetchedMavenDeps.sha256

  src = fetchFromGitHub {
    owner = "dbeaver";
    repo = "dbeaver";
    rev = version;
-    sha256 = "SifnnzuETFKtnEwLjJtB7CV2QZaToex3MjKGuiShlwo=";
+    sha256 = "sha256-WycjNxPa4hkxBtT8Pq7ayUu8pNV0DvaJ+29GDKNJNWE=";
  };

  fetchedMavenDeps = stdenv.mkDerivation {
@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
    dontFixup = true;
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
-    outputHash = "grSFtkohTlLtK8qE4A4wVppC6UHcyaXRQlGnrOmQDC4=";
+    outputHash = "sha256-pfYNHue7tZKYgU16kypZEfr2bXuDoPc4KorIAVjSylo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/expenses/default.nix
+++ b/pkgs/applications/misc/expenses/default.nix
@ -16,7 +16,7 @@ buildGoModule rec {
    sha256 = "sha256-sqsogF2swMvYZL7Kj+ealrB1AAgIe7ZXXDLRdHL6Q+0=";
  };

-  vendorSha256 = "sha256-Ac3f17Ws3Ne8Zo0vT+qlaMm/rhak9ua2jh5jlT6jF2Y=";
+  vendorSha256 = "sha256-rIcwZUOi6bdfiWZEsRF4kl1reNPPQNuBPHDOo7RQgYo=";

  # package does not contain any tests as of v0.2.3
  doCheck = false;
--- a/pkgs/applications/misc/mepo/default.nix
+++ b/pkgs/applications/misc/mepo/default.nix
@ -5,32 +5,28 @@
 , zig
 , curl
 , SDL2
+, SDL2_gfx
 , SDL2_image
 , SDL2_ttf
 }:

 stdenv.mkDerivation rec {
  pname = "mepo";
-  version = "0.2";
+  version = "0.3";

  src = fetchFromSourcehut {
    owner = "~mil";
    repo = pname;
    rev = version;
-    hash = "sha256-ECq748GpjOjvchzAWlGA7H7HBvKNxY9d43+PTOWopiM=";
+    hash = "sha256-B7BOAFhiOTILUdzh49hTMrNNHZpCNRDLW2uekXyptqQ=";
  };

  nativeBuildInputs = [ pkg-config zig ];

-  buildInputs = [ curl SDL2 SDL2_image SDL2_ttf ];
-
-  buildPhase = ''
-    runHook preBuild
+  buildInputs = [ curl SDL2 SDL2_gfx SDL2_image SDL2_ttf ];

+  preBuild = ''
    export HOME=$TMPDIR
-    zig build -Drelease-safe=true -Dcpu=baseline
-
-    runHook postBuild
  '';

  doCheck = true;
@ -45,8 +41,7 @@ stdenv.mkDerivation rec {
  installPhase = ''
    runHook preInstall

-    install -Dm755 zig-out/bin/mepo -t $out/bin
-    install -Dm755 scripts/mepo_* $out/bin
+    zig build -Drelease-safe=true -Dcpu=baseline --prefix $out install

    runHook postInstall
  '';
--- a/pkgs/applications/misc/neo4j-desktop/default.nix
+++ b/pkgs/applications/misc/neo4j-desktop/default.nix
@ -1,12 +1,12 @@
 { appimageTools, lib, fetchurl }:
 let
  pname = "neo4j-desktop";
-  version = "1.4.7";
+  version = "1.4.12";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://s3-eu-west-1.amazonaws.com/dist.neo4j.org/${pname}/linux-offline/${name}-x86_64.AppImage";
-    hash = "sha256-oEcSW7UIeiGY2fCPJQ5EtDBRtd73Q04HaSk+7ObLKJc=";
+    hash = "sha256-CfdXus9Zj6Tx6wAXpV2tRdqvJqowgE+NIL04v3fwtJE=";
  };

  appimageContents = appimageTools.extract { inherit name src; };
--- a/pkgs/applications/misc/nwg-panel/default.nix
+++ b/pkgs/applications/misc/nwg-panel/default.nix
@ -13,13 +13,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "nwg-panel";
-  version = "0.5.4";
+  version = "0.5.7";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = "nwg-panel";
    rev = "v${version}";
-    sha256 = "0vl9vfgpa1byf9vxn03j58h9zcbjd1y83b0kgv97cxm2mhqz12dg";
+    sha256 = "1d3qh42cwayb5d9ymhfs2vrbg5x5x6x73hw77m3xb9y4vyhji85x";
  };

  # No tests
--- a/pkgs/applications/misc/remarkable/rmapi/default.nix
+++ b/pkgs/applications/misc/remarkable/rmapi/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "rmapi";
-  version = "0.0.18";
+  version = "0.0.19";

  src = fetchFromGitHub {
    owner = "juruen";
    repo = "rmapi";
    rev = "v${version}";
-    sha256 = "sha256-Yrq21eiyNem9P219FxuQMHpagKQDaNsASwi2REaDAgk=";
+    sha256 = "sha256-HXWE6688jhRQQEiZuPfuJStSQeueqoWwwa+PfneHprw=";
  };

  vendorSha256 = "sha256-gu+BU2tL/xZ7D6lZ1ueO/9IB9H3NNm4mloCZaGqZskU=";
--- a/pkgs/applications/misc/snapmaker-luban/default.nix
+++ b/pkgs/applications/misc/snapmaker-luban/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "snapmaker-luban";
-  version = "4.1.3";
+  version = "4.1.4";

  src = fetchurl {
    url = "https://github.com/Snapmaker/Luban/releases/download/v${version}/snapmaker-luban-${version}-linux-x64.tar.gz";
-    sha256 = "sha256-GXpM5dJ3JPf2HgrgTONyeCG6JjK4JhbcGP5ck7v4cqk=";
+    sha256 = "sha256-hbqIwX6YCrUQAjvKKWFAUjHvcZycnIA6v6l6qmAMuUI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.8.4";
+  version = "2.8.5";

  src = fetchFromGitHub {
    owner = "khanhas";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-WsNiMlqr9ya06Urvw/m3yPsGLCTOvYFaO0oNHuVKNTs=";
+    sha256 = "sha256-cCIlKTHo+LyhIZkN6ncggBvZMwDBgXqDJVAfGWbUtj8=";
  };

  vendorSha256 = "sha256-g0RYIVIq4oMXdRZDBDnVYg7ombN5WEo/6O9hChQvOYs=";
--- a/pkgs/applications/misc/todoist-electron/default.nix
+++ b/pkgs/applications/misc/todoist-electron/default.nix
@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, appimageTools, makeWrapper, electron, libsecret }:
+{ lib, stdenv, fetchurl, appimageTools, makeWrapper, electron_15, libsecret }:

 stdenv.mkDerivation rec {
  pname = "todoist-electron";
-  version = "1.0.1";
+  version = "1.0.3";

  src = fetchurl {
    url = "https://electron-dl.todoist.com/linux/Todoist-${version}.AppImage";
-    sha256 = "1c4qmfyfi4hm3fs5bkxjbq1hxs5sgyp531xi5z5vpnzzi5z7dw0k";
+    sha256 = "sha256-bHX/RWDfe+ht66U7xg4HBZxeWlNBu4gYlIVd+9OuMNU=";
  };

  appimageContents = appimageTools.extractType2 {
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  '';

  postFixup = ''
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
+    makeWrapper ${electron_15}/bin/electron $out/bin/${pname} \
      --add-flags $out/share/${pname}/resources/app.asar \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc libsecret ]}"
  '';
--- a/pkgs/applications/misc/wtf/default.nix
+++ b/pkgs/applications/misc/wtf/default.nix
@ -17,7 +17,7 @@ buildGoModule rec {
    sha256 = "0hd5gnydxfncsmm7c58lvhkpnyxknvicc8f58xfh74azf363wcvm";
  };

-  vendorSha256 = "1pkdfg042kg3b6m5rf044gz5yg6vp3bbsay1mrrbaysnb3gs51dq";
+  vendorSha256 = "166dpxli2qyls4b9s0nv9vbwiwkp7jh32lkm35qz6s5w9zp6yjfb";

  doCheck = false;

--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "xmrig";
-  version = "6.16.2";
+  version = "6.16.3";

  src = fetchFromGitHub {
    owner = "xmrig";
    repo = "xmrig";
    rev = "v${version}";
-    sha256 = "sha256-RbpvEPjRwwGbjt4+A4tbnvEdLc+hH1VszE36xXnIxPE=";
+    sha256 = "sha256-YR/8ApkuZtO2vJA/VlZ06JdQnGDbTzQ5fNqHgBpFZjQ=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/networking/aether/default.nix
+++ b/pkgs/applications/networking/aether/default.nix
@ -9,31 +9,27 @@

 let
  binaryName = "AetherP2P";
+  aether-app-git = fetchFromGitHub {
+    owner = "aethereans";
+    repo = "aether-app";
+    rev = "53b6c8b2a9253cbf056ea3ebb077e0e08cbc5b1d";
+    sha256 = "1kgkzh7ih2q9dsckdkinh5dbzvr7gdykf8yz6h8pyhvzyjhk1v0r";
+  };
 in
 stdenv.mkDerivation rec {
  pname = "aether";
  version = "2.0.0-dev.15";

-  srcs = [
-    (fetchurl {
-      url = "https://static.getaether.net/Releases/Aether-${version}/2011262249.19338c93/linux/Aether-${version}%2B2011262249.19338c93.tar.gz";
-      sha256 = "1hi8w83zal3ciyzg2m62shkbyh6hj7gwsidg3dn88mhfy68himf7";
-      # % in the url / canonical filename causes an error
-      name = "aether-tarball.tar.gz";
-    })
-    (fetchFromGitHub {
-      owner = "aethereans";
-      repo = "aether-app";
-      rev = "53b6c8b2a9253cbf056ea3ebb077e0e08cbc5b1d";
-      sha256 = "1kgkzh7ih2q9dsckdkinh5dbzvr7gdykf8yz6h8pyhvzyjhk1v0r";
-    })
-  ];
-
-  sourceRoot = "Aether-${version}+2011262249.19338c93";
+  src = fetchurl {
+    url = "https://static.getaether.net/Releases/Aether-${version}/2011262249.19338c93/linux/Aether-${version}%2B2011262249.19338c93.tar.gz";
+    sha256 = "1hi8w83zal3ciyzg2m62shkbyh6hj7gwsidg3dn88mhfy68himf7";
+    # % in the url / canonical filename causes an error
+    name = "aether-tarball.tar.gz";
+  };

  # there is no logo in the tarball so we grab it from github and convert it in the build phase
  buildPhase = ''
-    convert ../source/aether-core/aether/client/src/app/ext_dep/images/Linux-Windows-App-Icon.png -resize 512x512 aether.png
+    convert ${aether-app-git}/aether-core/aether/client/src/app/ext_dep/images/Linux-Windows-App-Icon.png -resize 512x512 aether.png
  '';

  dontWrapGApps = true;
--- a/pkgs/applications/networking/browsers/lagrange/default.nix
+++ b/pkgs/applications/networking/browsers/lagrange/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "lagrange";
-  version = "1.10.1";
+  version = "1.10.3";

  src = fetchFromGitHub {
    owner = "skyjake";
    repo = "lagrange";
    rev = "v${version}";
-    sha256 = "sha256-HwrIdQv4LDVLLuvukzp28AuKKbEMQeHSb0ZW+a9q4ug=";
+    sha256 = "sha256-4Xjm4P4uK0aZxUT0WzcSDdY6rEeh5YFwsMfVtFB14No=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/cluster/driftctl/default.nix
+++ b/pkgs/applications/networking/cluster/driftctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "driftctl";
-  version = "0.18.3";
+  version = "0.18.5";

  src = fetchFromGitHub {
    owner = "cloudskiff";
    repo = "driftctl";
    rev = "v${version}";
-    sha256 = "sha256-JD3T0dCRg0UQlG0pWnI8RJZuRrIFfSMVHMoaEIymdWE=";
+    sha256 = "sha256-Qz/yObF1Df62Hqwl6fPHGkWcsifvgO5EfeiyU3aql3Q=";
  };

-  vendorSha256 = "sha256-g3+g+mPXEO2ZcVraKuVYZCMBD5zEr1l8ogcYt3r4UjU=";
+  vendorSha256 = "sha256-wOk4IXD9qHG8R4iddlc4TLH39jVSof9bwTDU1kyAmuA=";

  postUnpack = ''
    # Without this, tests fail to locate aws/3.19.0.json
--- a/pkgs/applications/networking/cluster/starboard/default.nix
+++ b/pkgs/applications/networking/cluster/starboard/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "starboard";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-/k9lQS3oPOYxhaaXuaDwPnai7byDkge4yBu7/9g4RUE=";
+    sha256 = "sha256-sB7C0IKadgpQ2h6HuH4D6ku/GXnFfFS+fGCW/RBSc10=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -22,7 +22,7 @@ buildGoModule rec {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorSha256 = "sha256-7SVEyyJRE7oYIhuENraZy0aieIAoFFWtq4mrSXxURlQ=";
+  vendorSha256 = "sha256-R7tF724y5WNIByE+9nRoNSZDZzfLtPfK/9tSBkARaN0=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -956,10 +956,10 @@
    "owner": "selectel",
    "provider-source-address": "registry.terraform.io/selectel/selectel",
    "repo": "terraform-provider-selectel",
-    "rev": "v3.7.1",
-    "sha256": "02sfzrs3k907djcyjz7qn42b21wccykw0fw65ms34h5vz5ld73mx",
-    "vendorSha256": null,
-    "version": "3.7.1"
+    "rev": "v3.8.0",
+    "sha256": "0qc08v217cv2i43cxcx854rvhihrlhlakfark37vcdrh9z6swf1n",
+    "vendorSha256": "1mjp5yqwl1nya82yf5v6l3sq7iv0m94xy5w7y5avn8h40dl1wfnf",
+    "version": "3.8.0"
  },
  "sentry": {
    "owner": "jianyuan",
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@ -5,13 +5,13 @@ buildGoModule rec {
  /* Do not use "dev" as a version. If you do, Tilt will consider itself
    running in development environment and try to serve assets from the
    source tree, which is not there once build completes.  */
-  version = "0.23.4";
+  version = "0.23.5";

  src = fetchFromGitHub {
    owner  = "tilt-dev";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "sha256-SWofXsbkuirPvqgU639W8IQklafLKbThoZUzOzfYwdQ=";
+    sha256 = "sha256-qVybS+gRuTezX89NMWYQVWtUH6wnjB11HImejrzVHAc=";
  };
  vendorSha256 = null;

--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@ -44,11 +44,11 @@ in

 stdenv.mkDerivation rec {
  pname = "bluejeans";
-  version = "2.25.0.78";
+  version = "2.26.0.136";

  src = fetchurl {
    url = "https://swdl.bluejeans.com/desktop-app/linux/${getFirst 3 version}/BlueJeans_${version}.rpm";
-    sha256 = "sha256-Xk9iU7mNm3YlXKsmf6yPqd1YAklsFOWu+04Llb+2yWQ=";
+    sha256 = "sha256-9QiE7CjCepDXQCzduqGzNUGqUgYS+PWBS71ouzHa83o=";
  };

  nativeBuildInputs = [ rpmextract makeWrapper ];
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -7,11 +7,16 @@ let
    canary = "0.0.132";
  } else {
    stable = "0.0.264";
-    ptb = "0.0.58";
+    ptb = "0.0.59";
    canary = "0.0.280";
  };
  version = versions.${branch};
-  srcs = {
+  srcs = let
+    darwin-ptb = fetchurl {
+      url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
+      sha256 = "sha256-LS7KExVXkOv8O/GrisPMbBxg/pwoDXIOo1dK9wk1yB8=";
+    };
+  in {
    x86_64-linux = {
      stable = fetchurl {
        url =
@ -34,11 +39,7 @@ let
        url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
        sha256 = "1jvlxmbfqhslsr16prsgbki77kq7i3ipbkbn67pnwlnis40y9s7p";
      };
-      ptb = fetchurl {
-        url =
-          "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        sha256 = "sha256-GwYUoPBbx9lSaRP1JwzI0UE9gEU+rV4a9BNPVSxHki0=";
-      };
+      ptb = darwin-ptb;
      canary = fetchurl {
        url =
          "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
@ -46,13 +47,7 @@ let
      };
    };
    # Only PTB bundles a MachO Universal binary with ARM support.
-    aarch64-darwin = {
-      ptb = fetchurl {
-        url =
-          "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        sha256 = "sha256-GwYUoPBbx9lSaRP1JwzI0UE9gEU+rV4a9BNPVSxHki0=";
-      };
-    };
+    aarch64-darwin = { ptb = darwin-ptb; };
  };
  src = srcs.${stdenv.hostPlatform.system}.${branch};

--- a/pkgs/applications/networking/remote/teamviewer/default.nix
+++ b/pkgs/applications/networking/remote/teamviewer/default.nix
@ -6,11 +6,11 @@

 mkDerivation rec {
  pname = "teamviewer";
-  version = "15.25.5";
+  version = "15.26.4";

  src = fetchurl {
    url = "https://dl.tvcdn.de/download/linux/version_15x/teamviewer_${version}_amd64.deb";
-    sha256 = "sha256-LtITPS0bLy85dv/zdOo8JcsEZ0ZgtVmM+CcggaYJxXA=";
+    sha256 = "sha256-2CprtdKHHTLxS8jA4bRVoHvj/8zyVUV0aGPzU7mNxM8=";
  };

  unpackPhase = ''
--- a/pkgs/applications/office/foliate/default.nix
+++ b/pkgs/applications/office/foliate/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "foliate";
-  version = "2.6.3";
+  version = "2.6.4";

  src = fetchFromGitHub {
    owner = "johnfactotum";
    repo = pname;
    rev = version;
-    sha256 = "0ribqaxl8g1i83fxbn288afwbzzls48ni57xqi07d19p9ka892mr";
+    sha256 = "sha256-Pr2YA2MHXD4W7lyCxGAVLKyoZarZ8t92RSkWle3LNuc=";
  };

  nativeBuildInputs = [ meson ninja python3 wrapGAppsHook ];
--- a/pkgs/applications/office/jabref/default.nix
+++ b/pkgs/applications/office/jabref/default.nix
@ -2,12 +2,12 @@
 , zlib , libX11, libXext, libXi, libXrender, libXtst, libGL, alsa-lib, cairo, freetype, pango, gdk-pixbuf, glib }:

 stdenv.mkDerivation rec {
-  version = "5.1";
+  version = "5.5";
  pname = "jabref";

  src = fetchurl {
    url = "https://github.com/JabRef/jabref/releases/download/v${version}/JabRef-${version}-portable_linux.tar.gz";
-    sha256 = "04f612byrq3agzy26byg1sgrjyhcpa8xfj0ssh8dl8d8vnhx9742";
+    sha256 = "sha256-9MHNehyAmu7CiBp1rgb4zTkSqmjXm2tcmiGKFBFapKI=";
  };

  preferLocalBuild = true;
--- a/pkgs/applications/office/libreoffice/darwin.nix
+++ b/pkgs/applications/office/libreoffice/darwin.nix
@ -0,0 +1,51 @@
+{ stdenv
+, lib
+, fetchurl
+, undmg
+}:
+
+let
+  appName = "LibreOffice.app";
+  version = "7.2.5";
+  dist = {
+    aarch64-darwin = {
+      arch = "aarch64";
+      sha256 = "bdbcb9a98211f866ca089d440aebcd1d313aa99e8ab4104aae4e65ea3cee74ca";
+    };
+
+    x86_64-darwin = {
+      arch = "x86_64";
+      sha256 = "0b7ef18ed08341ac6c15339fe9a161ad17f6b469009d987cfc7d50c628d12a4e";
+    };
+  }."${stdenv.hostPlatform.system}";
+in
+stdenv.mkDerivation {
+  inherit version;
+  pname = "libreoffice";
+  src = fetchurl {
+    url = "https://download.documentfoundation.org/libreoffice/stable/${version}/mac/${dist.arch}/LibreOffice_${version}_MacOS_${dist.arch}.dmg";
+    inherit (dist) sha256;
+  };
+
+  nativeBuildInputs = [ undmg ];
+  sourceRoot = "${appName}";
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstallPhase
+    mkdir -p $out/{Applications/${appName},bin}
+    cp -R . $out/Applications/${appName}
+    ln -s $out/Applications/${appName}/Contents/MacOS/soffice $out/bin
+    runHook postInstallPhase
+  '';
+
+  meta = with lib; {
+    description = "Comprehensive, professional-quality productivity suite, a variant of openoffice.org";
+    homepage = "https://libreoffice.org/";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ tricktron ];
+    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
+  };
+}
--- a/pkgs/applications/office/morgen/default.nix
+++ b/pkgs/applications/office/morgen/default.nix
@ -0,0 +1,59 @@
+{ lib, stdenv, fetchurl, dpkg, autoPatchelfHook, makeWrapper, electron
+, nodePackages, alsa-lib, gtk3, libxshmfence, mesa, nss }:
+
+stdenv.mkDerivation rec {
+  pname = "morgen";
+  version = "2.4.3";
+
+  src = fetchurl {
+    url = "https://download.todesktop.com/210203cqcj00tw1/morgen-${version}.deb";
+    sha256 = "sha256-IWGeb0+IiFNYJ+jQAzGYfQ5FnrbR6HIpynS9jgd5/mY=";
+  };
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+    makeWrapper
+    nodePackages.asar
+  ];
+
+  buildInputs = [ alsa-lib gtk3 libxshmfence mesa nss ];
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  unpackCmd = ''
+    dpkg-deb -x ${src} ./morgen-${pname}
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mv usr $out
+    mv opt $out
+
+    asar extract $out/opt/Morgen/resources/app.asar "$TMP/work"
+    # 1. Fixes path for todesktop-runtime-config.json
+    # 2. Fixes startup script
+    substituteInPlace $TMP/work/dist/main.js \
+      --replace "process.resourcesPath,\"todesktop-runtime-config.json" "\"$out/opt/Morgen/resources/todesktop-runtime-config.json" \
+      --replace "Exec=\"+process.execPath+\"" "Exec=$out/bin/morgen"
+    asar pack --unpack='{*.node,*.ftz,rect-overlay}' "$TMP/work" $out/opt/Morgen/resources/app.asar
+
+    substituteInPlace $out/share/applications/morgen.desktop \
+      --replace '/opt/Morgen' $out/bin
+
+    makeWrapper ${electron}/bin/electron $out/bin/morgen \
+      --add-flags $out/opt/Morgen/resources/app.asar
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "All-in-one Calendars, Tasks and Scheduler";
+    homepage = "https://morgen.so/download";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/office/skrooge/default.nix
+++ b/pkgs/applications/office/skrooge/default.nix
@ -7,11 +7,11 @@

 mkDerivation rec {
  pname = "skrooge";
-  version = "2.26.1";
+  version = "2.27.0";

  src = fetchurl {
    url = "https://download.kde.org/stable/skrooge/${pname}-${version}.tar.xz";
-    sha256 = "sha256-66hoA+FDTeMbNAInr9TlTSnwUywJQjTRz87MkdNYn5Q=";
+    sha256 = "sha256-xkl0UyJEDOeYOqqXf3woCDMb8ZyC2c5ChQdDFFERZxE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/zanshin/default.nix
+++ b/pkgs/applications/office/zanshin/default.nix
@ -10,11 +10,11 @@

 mkDerivation rec {
  pname = "zanshin";
-  version = "21.12.0";
+  version = "21.12.1";

  src = fetchurl {
    url = "mirror://kde/stable/release-service/${version}/src/zanshin-${version}.tar.xz";
-    sha256 = "sha256-l8W47tS7q747fkSAH3HJdwPsqjMfCyxzl3xJEeAXeh0=";
+    sha256 = "sha256-hYbJwmnD9i/SL5ET2t9YgPxJHJUpAbMZ4a62WljhpHw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@ -48,13 +48,13 @@
 , pname ? "gnuradio"
 , versionAttr ? {
  major = "3.10";
-  minor = "0";
+  minor = "1";
  patch = "0";
 }
 }:

 let
-  sourceSha256 = "sha256-1K8nlNiirks3MJ+9cH9bkILVFtu5OxhKkNhetGqojn4=";
+  sourceSha256 = "sha256-bU6z7H08G8QIToogAMI2P5tHBtVZezlBDqSbnEsqAjE=";
  featuresInfo = {
    # Needed always
    basic = {
--- a/pkgs/applications/science/biology/kallisto/default.nix
+++ b/pkgs/applications/science/biology/kallisto/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "kallisto";
-  version = "0.46.2";
+  version = "0.48.0";

  src = fetchFromGitHub {
    repo = "kallisto";
    owner = "pachterlab";
    rev = "v${version}";
-    sha256 = "0m0r2820ca3rch99md1zzbgkilmlfkhdkpys2lfnb87qxmf1jnmb";
+    sha256 = "sha256-r0cdR0jTRa1wu/LDKW6NdxI3XaKj6wcIVbIlct0fFvI=";
  };

  nativeBuildInputs = [ autoconf cmake ];
--- a/pkgs/applications/science/biology/repseek/default.nix
+++ b/pkgs/applications/science/biology/repseek/default.nix
@ -0,0 +1,27 @@
+{ lib, stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "repseek";
+  version = "9Sep2014";
+  src = fetchurl {
+    url = "https://bioinfo.mnhn.fr/abi/public/RepSeek/RepSeek.${version}.tgz";
+    sha256 = "1jiknji3ivrv7zmrfbf2mccfpdwhin3lfxfsciaqwf69b3sda8nf";
+  };
+
+  preConfigure = ''
+    mkdir -p $out/bin
+    substituteInPlace Makefile \
+      --replace "INSTALLDIR = \$\$HOME/bin" "INSTALLDIR = $out/bin/" \
+      --replace "CC= gcc" "CC = $CC"
+  '' + lib.optionalString stdenv.isLinux ''
+    substituteInPlace Makefile --replace "MACHINE = MACOSX" "MACHINE = LINUX"
+  '';
+
+  meta = {
+    description = "Tool to retrieve approximate repeats from large DNA sequences";
+    homepage = "https://bioinfo.mnhn.fr/abi/public/RepSeek";
+    maintainers = [ lib.maintainers.bzizou ];
+    license = lib.licenses.lgpl21;
+  };
+
+}
--- a/pkgs/applications/science/math/sage/default.nix
+++ b/pkgs/applications/science/math/sage/default.nix
@ -14,13 +14,17 @@ let
      # `sagelib`, i.e. all of sage except some wrappers and runtime dependencies
      sagelib = self.callPackage ./sagelib.nix {
        inherit flint arb;
-        inherit sage-src env-locations pynac singular;
+        inherit sage-src env-locations singular;
        inherit (maxima) lisp-compiler;
        linbox = pkgs.linbox.override { withSage = true; };
        pkg-config = pkgs.pkg-config; # not to confuse with pythonPackages.pkg-config
      };

-      sage_docbuild = self.callPackage ./sage_docbuild.nix {
+      sage-docbuild = self.callPackage ./python-modules/sage-docbuild.nix {
+        inherit sage-src;
+      };
+
+      sage-setup = self.callPackage ./python-modules/sage-setup.nix {
        inherit sage-src;
      };
    };
@ -58,9 +62,9 @@ let
  # the env-locations file.
  sage-env = callPackage ./sage-env.nix {
    sagelib = python3.pkgs.sagelib;
-    sage_docbuild = python3.pkgs.sage_docbuild;
+    sage-docbuild = python3.pkgs.sage-docbuild;
    inherit env-locations;
-    inherit python3 singular palp flint pynac pythonEnv maxima;
+    inherit python3 singular palp flint pythonEnv maxima;
    pkg-config = pkgs.pkg-config; # not to confuse with pythonPackages.pkg-config
  };

@ -74,7 +78,7 @@ let
  sage-with-env = callPackage ./sage-with-env.nix {
    inherit python3 pythonEnv;
    inherit sage-env;
-    inherit pynac singular maxima;
+    inherit singular maxima;
    inherit three;
    pkg-config = pkgs.pkg-config; # not to confuse with pythonPackages.pkg-config
  };
@ -91,7 +95,7 @@ let

  pythonRuntimeDeps = with python3.pkgs; [
    sagelib
-    sage_docbuild
+    sage-docbuild
    cvxopt
    networkx
    service-identity
@ -132,9 +136,6 @@ let
    };
  };

-  # *not* to confuse with the python package "pynac"
-  pynac = pkgs.pynac.override { inherit singular flint; };
-
  # With openblas (64 bit), the tests fail the same way as when sage is build with
  # openblas instead of openblasCompat. Apparently other packages somehow use flints
  # blas when it is available. Alternative would be to override flint to use
--- a/pkgs/applications/science/math/sage/patches/Only-test-external-software-when-all-of-sage-is.patch
+++ b/pkgs/applications/science/math/sage/patches/Only-test-external-software-when-all-of-sage-is.patch
@ -0,0 +1,46 @@
+diff --git a/src/sage/doctest/control.py b/src/sage/doctest/control.py
+index 01f32fb8e4..4d83dc7b47 100644
+--- a/src/sage/doctest/control.py
+++ b/src/sage/doctest/control.py
+@@ -1253,6 +1253,7 @@ class DocTestController(SageObject):
+ 
+             self.log("Using --optional=" + self._optional_tags_string())
+             available_software._allow_external = self.options.optional is True or 'external' in self.options.optional
+            available_software._autodetect_safe = self.options.optional is True or 'sage' in self.options.optional
+             self.log("Features to be detected: " + ','.join(available_software.detectable()))
+             self.add_files()
+             self.expand_files_into_sources()
+diff --git a/src/sage/doctest/external.py b/src/sage/doctest/external.py
+index 84dae19ea5..badc61466e 100644
+--- a/src/sage/doctest/external.py
+++ b/src/sage/doctest/external.py
+@@ -409,6 +409,7 @@ class AvailableSoftware(object):
+             []
+         """
+         self._allow_external = True
+        self._autodetect_safe = True
+         # For multiprocessing of doctests, the data self._seen should be
+         # shared among subprocesses. Thus we use Array class from the
+         # multiprocessing module.
+@@ -430,6 +431,8 @@ class AvailableSoftware(object):
+             sage: 'internet' in available_software # random, optional - internet
+             True
+         """
+        if not self._autodetect_safe:
+            return False
+         try:
+             idx = self._indices[item]
+         except KeyError:
+diff --git a/src/sage/features/sagemath.py b/src/sage/features/sagemath.py
+index 433338766d..233623b14a 100644
+--- a/src/sage/features/sagemath.py
+++ b/src/sage/features/sagemath.py
+@@ -12,7 +12,7 @@ class sagemath_doc_html(StaticFile):
+ 
+     EXAMPLES::
+ 
+-        sage: from sage.features.sagemath import sagemath_doc_html
+        sage: from sage.features.sagemath import sagemath_doc_html  # optional - sagemath_doc_html
+         sage: sagemath_doc_html().is_present()  # optional - sagemath_doc_html
+         FeatureTestResult('sagemath_doc_html', True)
+     """
--- a/pkgs/applications/science/math/sage/patches/Only-test-py2-py3-optional-tests-when-all-of-sage-is.patch
+++ b/pkgs/applications/science/math/sage/patches/Only-test-py2-py3-optional-tests-when-all-of-sage-is.patch
@ -1,26 +0,0 @@
-From f5ea42a7aaed7611fb55b65897b9fcf2b7bcf97e Mon Sep 17 00:00:00 2001
-From: Timo Kaufmann <timokau@zoho.com>
-Date: Sun, 21 Oct 2018 17:52:40 +0200
-Subject: [PATCH] Only test py2/py3 optional tests when all of sage is tested
-
---
- src/sage/doctest/control.py | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/sage/doctest/control.py b/src/sage/doctest/control.py
-index 2d93841e50..6d156e29a1 100644
--- a/src/sage/doctest/control.py
-+++ b/src/sage/doctest/control.py
-@@ -375,7 +375,8 @@ class DocTestController(SageObject):
-                     if not optionaltag_regex.search(o):
-                         raise ValueError('invalid optional tag {!r}'.format(o))
- 
-                options.optional |= auto_optional_tags
-+                if "sage" in options.optional:
-+                    options.optional |= auto_optional_tags
- 
-         self.options = options
- 
-- 
-2.28.0
-
--- a/pkgs/applications/science/math/sage/patches/do-not-test-find-library.patch
+++ b/pkgs/applications/science/math/sage/patches/do-not-test-find-library.patch
@ -1,8 +1,8 @@
 diff --git a/src/sage/env.py b/src/sage/env.py
-index 95980cc2df..37107a30e1 100644
+index c4953cfa65..47b880f9ad 100644
 --- a/src/sage/env.py
 +++ b/src/sage/env.py
-@@ -227,93 +227,12 @@ OPENMP_CXXFLAGS = var("OPENMP_CXXFLAGS", "")
+@@ -244,81 +244,8 @@ os.environ['MPMATH_SAGE'] = '1'
 SAGE_BANNER = var("SAGE_BANNER", "")
 SAGE_IMPORTALL = var("SAGE_IMPORTALL", "yes")
 
@ -29,20 +29,12 @@ index 95980cc2df..37107a30e1 100644
 -
 -    EXAMPLES::
 -
-        sage: import sys
-        sage: from fnmatch import fnmatch
 -        sage: from sage.env import _get_shared_lib_path
-        sage: lib_filename = _get_shared_lib_path("Singular", "singular-Singular")
-        sage: if sys.platform == 'cygwin':
-        ....:     pattern = "*/cygSingular-*.dll"
-        ....: elif sys.platform == 'darwin':
-        ....:     pattern = "*/libSingular-*.dylib"
-        ....: else:
-        ....:     pattern = "*/lib*Singular-*.so"
-        sage: fnmatch(str(lib_filename), pattern)
+-        sage: "gap" in _get_shared_lib_path("gap")
 -        True
 -        sage: _get_shared_lib_path("an_absurd_lib") is None
 -        True
+-
 -    """
 -
 -    for libname in libnames:
@ -87,11 +79,6 @@ index 95980cc2df..37107a30e1 100644
 -    # Just return None if no files were found
 -    return None
 -
- # locate singular shared object
- # On Debian it's libsingular-Singular so try that as well
-SINGULAR_SO = var("SINGULAR_SO", _get_shared_lib_path("Singular", "singular-Singular"))
-+SINGULAR_SO = var("SINGULAR_SO", '/default')
- 
 # locate libgap shared object
 -GAP_SO = var("GAP_SO", _get_shared_lib_path("gap", ""))
 +GAP_SO = var("GAP_SO", '/default')
--- a/pkgs/applications/science/math/sage/patches/linbox-1.7-upgrade.patch
+++ b/pkgs/applications/science/math/sage/patches/linbox-1.7-upgrade.patch
@ -0,0 +1,58 @@
+diff --git a/src/sage/libs/linbox/conversion.pxd b/src/sage/libs/linbox/conversion.pxd
+index 7794c9edc3..1753277b1f 100644
+--- a/src/sage/libs/linbox/conversion.pxd
+++ b/src/sage/libs/linbox/conversion.pxd
+@@ -177,9 +177,8 @@ cdef inline Vector_integer_dense new_sage_vector_integer_dense(P, DenseVector_in
+     - v -- linbox vector
+     """
+     cdef Vector_integer_dense res = P()
+-    cdef cppvector[Integer] * vec = &v.refRep()
+     cdef size_t i
+     for i in range(<size_t> res._degree):
+-        mpz_set(res._entries[i], vec[0][i].get_mpz_const())
+        mpz_set(res._entries[i], v.getEntry(i).get_mpz_const())
+ 
+     return res
+diff --git a/src/sage/libs/linbox/linbox.pxd b/src/sage/libs/linbox/linbox.pxd
+index 9112d151f8..dcc482960c 100644
+--- a/src/sage/libs/linbox/linbox.pxd
+++ b/src/sage/libs/linbox/linbox.pxd
+@@ -32,7 +32,7 @@ cdef extern from "linbox/matrix/dense-matrix.h":
+         ctypedef Modular_double Field
+         ctypedef double Element
+         DenseMatrix_Modular_double(Field F, size_t m, size_t n)
+-        DenseMatrix_Modular_double(Field F, Element*, size_t m, size_t n)
+        DenseMatrix_Modular_double(Field F, size_t m, size_t n, Element*)
+         void setEntry(size_t i, size_t j, Element& a)
+         Element &getEntry(size_t i, size_t j)
+ 
+@@ -42,7 +42,7 @@ cdef extern from "linbox/matrix/dense-matrix.h":
+         ctypedef Modular_float Field
+         ctypedef float Element
+         DenseMatrix_Modular_float(Field F, size_t m, size_t n)
+-        DenseMatrix_Modular_float(Field F, Element*, size_t m, size_t n)
+        DenseMatrix_Modular_float(Field F, size_t m, size_t n, Element*)
+         void setEntry(size_t i, size_t j, Element& a)
+         Element &getEntry(size_t i, size_t j)
+ 
+@@ -101,7 +101,6 @@ cdef extern from "linbox/vector/vector.h":
+         DenseVector_integer (Field &F)
+         DenseVector_integer (Field &F, long& m)
+         DenseVector_integer (Field &F, cppvector[Integer]&)
+-        cppvector[Element]& refRep()
+         size_t size()
+         void resize(size_t)
+         void resize(size_t n, const Element&)
+diff --git a/src/sage/matrix/matrix_modn_dense_template.pxi b/src/sage/matrix/matrix_modn_dense_template.pxi
+index 010365d76f..3d60726ff9 100644
+--- a/src/sage/matrix/matrix_modn_dense_template.pxi
+++ b/src/sage/matrix/matrix_modn_dense_template.pxi
+@@ -219,7 +219,7 @@ cdef inline linbox_echelonize_efd(celement modulus, celement* entries, Py_ssize_
+         return 0,[]
+ 
+     cdef ModField *F = new ModField(<long>modulus)
+-    cdef DenseMatrix *A = new DenseMatrix(F[0], <ModField.Element*>entries,<Py_ssize_t>nrows, <Py_ssize_t>ncols)
+    cdef DenseMatrix *A = new DenseMatrix(F[0], <Py_ssize_t>nrows, <Py_ssize_t>ncols, <ModField.Element*>entries)
+     cdef Py_ssize_t r = reducedRowEchelonize(A[0])
+     cdef Py_ssize_t i,j
+     for i in range(nrows):
--- a/pkgs/applications/science/math/sage/patches/sphinx-docbuild-subprocesses.patch
+++ b/pkgs/applications/science/math/sage/patches/sphinx-docbuild-subprocesses.patch
@ -1,8 +1,8 @@
 diff --git a/src/sage_docbuild/__init__.py b/src/sage_docbuild/__init__.py
-index 79005b903a..fbe6fe2595 100644
+index 8a5c1a19d2..21fd192642 100644
 --- a/src/sage_docbuild/__init__.py
 +++ b/src/sage_docbuild/__init__.py
-@@ -85,27 +85,6 @@ def builder_helper(type):
+@@ -89,27 +89,6 @@ def builder_helper(type):
     """
     Returns a function which builds the documentation for
     output type ``type``.
@ -12,7 +12,7 @@ index 79005b903a..fbe6fe2595 100644
 -    Check that :trac:`25161` has been resolved::
 -
 -        sage: from sage_docbuild import DocBuilder, setup_parser
-        sage: DocBuilder._options = setup_parser().parse_args([])[0] # builder_helper needs _options to be set
+-        sage: DocBuilder._options = setup_parser().parse_args([]) # builder_helper needs _options to be set
 -
 -        sage: import sage_docbuild.sphinxbuild
 -        sage: def raiseBaseException():
@ -30,7 +30,7 @@ index 79005b903a..fbe6fe2595 100644
     """
     def f(self, *args, **kwds):
         output_dir = self._output_dir(type)
-@@ -127,10 +106,9 @@ def builder_helper(type):
+@@ -131,10 +110,9 @@ def builder_helper(type):
         logger.debug(build_command)
 
         # Run Sphinx with Sage's special logger
@ -44,10 +44,10 @@ index 79005b903a..fbe6fe2595 100644
             if ABORT_ON_ERROR:
                 raise
 diff --git a/src/sage_docbuild/sphinxbuild.py b/src/sage_docbuild/sphinxbuild.py
-index f58f6c61d7..ef51a55411 100644
+index d917c3e9d4..551cc8028a 100644
 --- a/src/sage_docbuild/sphinxbuild.py
 +++ b/src/sage_docbuild/sphinxbuild.py
-@@ -326,3 +326,8 @@ def runsphinx():
+@@ -327,3 +327,8 @@ def runsphinx():
         sys.stderr = saved_stderr
         sys.stdout.flush()
         sys.stderr.flush()
--- a/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix
+++ b/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix
@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, sage-src
+, sphinx
+}:
+
+buildPythonPackage rec {
+  version = src.version;
+  pname = "sage-docbuild";
+  src = sage-src;
+
+  propagatedBuildInputs = [
+    sphinx
+  ];
+
+  preBuild = ''
+    cd pkgs/sage-docbuild
+  '';
+
+  doCheck = false; # we will run tests in sagedoc.nix
+
+  meta = with lib; {
+    description = "Build system of the Sage documentation";
+    homepage = "https://www.sagemath.org";
+    license = licenses.gpl2Plus;
+    maintainers = teams.sage.members;
+  };
+}
--- a/pkgs/applications/science/math/sage/python-modules/sage-setup.nix
+++ b/pkgs/applications/science/math/sage/python-modules/sage-setup.nix
@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, sage-src
+, pkgconfig # the python module, not the pkg-config alias
+}:
+
+buildPythonPackage rec {
+  version = src.version;
+  pname = "sage-setup";
+  src = sage-src;
+
+  buildInputs = [
+    pkgconfig
+  ];
+
+  preBuild = ''
+    cd pkgs/sage-setup
+  '';
+
+  doCheck = false; # sagelib depends on sage-setup, but sage-setup's tests depend on sagelib
+
+  meta = with lib; {
+    description = "Build system of the Sage library";
+    homepage = "https://www.sagemath.org";
+    license = licenses.gpl2Plus;
+    maintainers = teams.sage.members;
+  };
+}
--- a/pkgs/applications/science/math/sage/sage-env.nix
+++ b/pkgs/applications/science/math/sage/sage-env.nix
@ -2,7 +2,7 @@
 , lib
 , writeTextFile
 , sagelib
-, sage_docbuild
+, sage-docbuild
 , env-locations
 , gfortran
 , bash
@ -45,11 +45,10 @@
 , flint
 , gmp
 , mpfr
-, pynac
 , zlib
 , gsl
 , ntl
-, jdk8
+, jdk
 , less
 }:

@ -60,8 +59,6 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 # dependencies.

 let
-  jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
-
  runtimepath = (lib.makeBinPath ([
    "@sage-local@"
    "@sage-local@/build"
@ -163,7 +160,6 @@ writeTextFile rec {
        gmp
        mpfr
        pari
-        pynac
        zlib
        eclib
        gsl
@ -179,7 +175,6 @@ writeTextFile rec {
        glpk
        flint
        gap
-        pynac
        mpfr.dev
      ])
    }'
@ -193,5 +188,5 @@ writeTextFile rec {
  '';
 } // { # equivalent of `passthru`, which `writeTextFile` doesn't support
  lib = sagelib;
-  docbuild = sage_docbuild;
+  docbuild = sage-docbuild;
 }
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -57,24 +57,29 @@ let
  );
 in
 stdenv.mkDerivation rec {
-  version = "9.4";
+  version = "9.5";
  pname = "sage-src";

  src = fetchFromGitHub {
    owner = "sagemath";
    repo = "sage";
    rev = version;
-    sha256 = "sha256-jqkr4meG02KbTCMsGvyr1UbosS4ZuUJhPXU/InuS+9A=";
+    sha256 = "sha256-uOsLpsGpcIGs8Xr82X82MElnTB2E908gytyNJ8WVD5w=";
  };

  # Patches needed because of particularities of nix or the way this is packaged.
  # The goal is to upstream all of them and get rid of this list.
  nixPatches = [
-    # Make sure py2/py3 tests are only run when their expected context (all "sage"
-    # tests) are also run. That is necessary to test dochtml individually. See
-    # https://trac.sagemath.org/ticket/26110 for an upstream discussion.
-    # TODO: Determine if it is still necessary.
-    ./patches/Only-test-py2-py3-optional-tests-when-all-of-sage-is.patch
+    # Since https://trac.sagemath.org/ticket/32174, some external features are
+    # marked as "safe" and get auto-detected, in which case the corresponding
+    # optional tests are executed. We disable auto-detection of safe features if
+    # we are doctesting with an "--optional" argument which does not include
+    # "sage", because tests from autodetected features expect context provided
+    # by running basic sage tests. This is necessary to test sagemath_doc_html
+    # separately. See https://trac.sagemath.org/ticket/26110 for a related
+    # upstream discussion (from the time when Sage still had optional py2/py3
+    # tags).
+    ./patches/Only-test-external-software-when-all-of-sage-is.patch

    # Fixes a potential race condition which can lead to transient doctest failures.
    ./patches/fix-ecl-race.patch
@ -117,46 +122,6 @@ stdenv.mkDerivation rec {
    # Let's just assume warnings are expected until we update to 4.27.0.
    ./patches/fonttools-deprecation-warnings.patch

-    # https://trac.sagemath.org/ticket/32305
-    (fetchSageDiff {
-      base = "9.4";
-      name = "networkx-2.6-upgrade.patch";
-      rev = "9808325853ba9eb035115e5b056305a1c9d362a0";
-      sha256 = "sha256-gJSqycCtbAVr5qnVEbHFUvIuTOvaxFIeffpzd6nH4DE=";
-    })
-
-    # https://trac.sagemath.org/ticket/32420
-    (fetchSageDiff {
-      base = "9.5.beta2";
-      name = "sympy-1.9-update.patch";
-      rev = "beed4e16aff32e47d0c3b1c58cb1e2f4c38590f8";
-      sha256 = "sha256-3eJPfWfCrCAQ5filIn7FbzjRQeO9QyTIVl/HyRuqFtE=";
-    })
-
-    # https://trac.sagemath.org/ticket/32567
-    (fetchSageDiff {
-      base = "9.5.beta2";
-      name = "arb-2.21.0-update.patch";
-      rev = "eb3304dd521a3d5a9334e747a08e234bbf16b4eb";
-      sha256 = "sha256-XDkaY4VQGyESXI6zuD7nCNzyQOl/fmBFvAESH9+RRvk=";
-    })
-
-    # https://trac.sagemath.org/ticket/32797
-    (fetchSageDiff {
-      base = "9.5.beta7";
-      name = "pari-2.13.3-update.patch";
-      rev = "f5f7a86908daf60b25e66e6a189c51ada7e0a732";
-      sha256 = "sha256-H/caGx3q4KcdsyGe+ojV9bUTQ5y0siqM+QHgDbeEnbw=";
-    })
-
-    # https://trac.sagemath.org/ticket/32909
-    (fetchSageDiff {
-      base = "9.5.beta7";
-      name = "matplotlib-3.5-deprecation-warnings.patch";
-      rev = "a5127dc56fdf5c2e82f6bc781cfe78dbd04e97b7";
-      sha256 = "sha256-p23qUu9mgEUbdbX6cy7ArxZAtpcFjCKbgyxN4jWvj1o=";
-    })
-
    # https://trac.sagemath.org/ticket/32968
    (fetchSageDiff {
      base = "9.5.beta8";
@ -164,6 +129,11 @@ stdenv.mkDerivation rec {
      rev = "fc84f82f52b6f05f512cb359ec7c100f93cf8841";
      sha256 = "sha256-bBbfdcnw/9LUOlY8rHJRbFJEdMXK4shosqTNaobTS1Q=";
    })
+
+    # Upstream has not upgraded to linbox 1.7 yet because it conflicts with
+    # pre-4.2.1p3 versions of Singular, but we don't have this problem.
+    # https://trac.sagemath.org/ticket/32959
+    ./patches/linbox-1.7-upgrade.patch
  ];

  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
--- a/pkgs/applications/science/math/sage/sage-with-env.nix
+++ b/pkgs/applications/science/math/sage/sage-with-env.nix
@ -18,7 +18,6 @@
 , eclib
 , ntl
 , ecm
-, pynac
 , pythonEnv
 }:

@ -36,7 +35,6 @@ let
    blas lapack
    singular
    three
-    pynac
    giac
    gap
    pari
@ -126,6 +124,10 @@ stdenv.mkDerivation rec {
    cp -r src/bin "$out/bin"
    cp -r build/bin "$out/build/bin"

+    # sage assumes the existence of sage-src-env-config.in means it's being executed in-tree. in this case, it
+    # adds SAGE_SRC/bin to PATH, breaking our wrappers
+    rm "$out/bin"/*.in "$out/build/bin"/*.in
+
    cp -f '${sage-env}/sage-env' "$out/bin/sage-env"
    substituteInPlace "$out/bin/sage-env" \
      --subst-var-by sage-local "$out"
--- a/pkgs/applications/science/math/sage/sage.nix
+++ b/pkgs/applications/science/math/sage/sage.nix
@ -62,7 +62,8 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Open Source Mathematics Software, free alternative to Magma, Maple, Mathematica, and Matlab";
-    license = licenses.gpl2;
+    homepage = "https://www.sagemath.org";
+    license = licenses.gpl2Plus;
    maintainers = teams.sage.members;
  };
 }
--- a/pkgs/applications/science/math/sage/sage_docbuild.nix
+++ b/pkgs/applications/science/math/sage/sage_docbuild.nix
@ -1,20 +0,0 @@
-{ buildPythonPackage
-, sage-src
-, sphinx
-}:
-
-buildPythonPackage rec {
-  version = src.version;
-  pname = "sage_docbuild";
-  src = sage-src;
-
-  propagatedBuildInputs = [
-    sphinx
-  ];
-
-  preBuild = ''
-    cd build/pkgs/sage_docbuild/src
-  '';
-
-  doCheck = false; # we will run tests in sagedoc.nix
-}
--- a/pkgs/applications/science/math/sage/sagedoc.nix
+++ b/pkgs/applications/science/math/sage/sagedoc.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    jmol
    cddlib
  ] ++ (with python3.pkgs; [
-    sage_docbuild
+    sage-docbuild
    psutil
    future
    sphinx
@ -83,6 +83,6 @@ stdenv.mkDerivation rec {

  doCheck = true;
  checkPhase = ''
-    ${sage-with-env}/bin/sage -t --optional=dochtml --all
+    ${sage-with-env}/bin/sage -t --optional=sagemath_doc_html --all
  '';
 }
--- a/pkgs/applications/science/math/sage/sagelib.nix
+++ b/pkgs/applications/science/math/sage/sagelib.nix
@ -2,6 +2,7 @@
 , env-locations
 , perl
 , buildPythonPackage
+, m4
 , arb
 , blas
 , lapack
@ -37,7 +38,7 @@
 , pkg-config
 , planarity
 , ppl
-, pynac
+, primecountpy
 , python
 , ratpoints
 , readline
@ -49,11 +50,24 @@
 , singular
 , pip
 , jupyter_core
+, sage-setup
 , libhomfly
 , libbraiding
 , gmpy2
 , pplpy
 , sqlite
+, jupyter-client
+, ipywidgets
+, mpmath
+, rpy2
+, fpylll
+, scipy
+, sympy
+, matplotlib
+, pillow
+, ipykernel
+, networkx
+, sphinx # TODO: this is in setup.cfg, bug should we override it?
 }:

 assert (!blas.isILP64) && (!lapack.isILP64);
@ -73,8 +87,10 @@ buildPythonPackage rec {
    perl
    jupyter_core
    pkg-config
+    sage-setup
    pip # needed to query installed packages
    lisp-compiler
+    m4
  ];

  buildInputs = [
@ -116,7 +132,7 @@ buildPythonPackage rec {
    pari
    planarity
    ppl
-    pynac
+    primecountpy
    rankwidth
    ratpoints
    singular
@ -130,6 +146,18 @@ buildPythonPackage rec {
    gmpy2
    pplpy
    sqlite
+    mpmath
+    rpy2
+    scipy
+    sympy
+    matplotlib
+    pillow
+    ipykernel
+    fpylll
+    networkx
+    jupyter-client
+    ipywidgets
+    sphinx
  ];

  preBuild = ''
@ -148,8 +176,24 @@ buildPythonPackage rec {
    mkdir -p "$SAGE_SHARE/sage/ext/notebook-ipython"
    mkdir -p "var/lib/sage/installed"

-    # src/setup.py should not be used, see https://trac.sagemath.org/ticket/31377#comment:124
-    cd build/pkgs/sagelib/src
+    cd build/pkgs/sagelib
+
+    # some files, like Pipfile, pyproject.toml, requirements.txt and setup.cfg
+    # are generated by the bootstrap script using m4. these can fetch data from
+    # build/pkgs, either directly or via sage-get-system-packages.
+    sed -i 's/==2.1.0rc1/>=2.1.1/' ../gmpy2/install-requires.txt
+    sed -i 's/, <3.4//' ../rpy2/install-requires.txt
+    sed -i 's/, <4.3//' ../sphinx/install-requires.txt
+    sed -i '/sage_conf/d' src/setup.cfg.m4
+    sed -i '/sage_conf/d' src/requirements.txt.m4
+    for infile in src/*.m4; do
+        if [ -f "$infile" ]; then
+            outfile="src/$(basename $infile .m4)"
+            m4 "$infile" > "$outfile"
+        fi
+    done
+
+    cd src
  '';

  postInstall = ''
--- a/pkgs/applications/science/math/singular/default.nix
+++ b/pkgs/applications/science/math/singular/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, gmp, bison, perl, ncurses, readline, coreutils, pkg-config
 , lib
-, fetchpatch
 , autoreconfHook
+, buildPackages
 , sharutils
 , file
 , flint
@ -11,6 +11,7 @@
 , lrcalc
 , doxygen
 , graphviz
+, latex2html
 # upstream generates docs with texinfo 4. later versions of texinfo
 # use letters instead of numbers for post-appendix chapters, and we
 # want it to match the upstream format because sage depends on it.
@ -22,66 +23,25 @@

 stdenv.mkDerivation rec {
  pname = "singular";
-  version = "4.2.0p2";
+  version = "4.3.0";

-  # since the tarball does not contain tests or documentation (and
-  # there is no separate tests tarball for 4.2.0), we fetch from
-  # GitHub.
+  # since the tarball does not contain tests, we fetch from GitHub.
  src = fetchFromGitHub {
    owner = "Singular";
    repo = "Singular";

-    # 4.2.0p2 is not tagged, but the tarball matches the commit below.
-    rev = "6f68939ddf612d96e3caaaaa8275f77613ac1da8";
-    sha256 = "sha256-BJNzYylzDqD/5YjzjxPRb/c96tYiuGy9Y+A7qf3ZSG8=";
-
-    # if a release is tagged it will be in the format below.
-    # rev = "Release${lib.replaceStrings ["."] ["-"] version}";
+    # if a release is tagged (which sometimes does not happen), it will
+    # be in the format below.
+    # rev = "Release-${lib.replaceStrings ["."] ["-"] version}";
+    rev = "d895b0f1f543c61eb03adddad20f08655a419d4e";
+    sha256 = "sha256-c5Qr6VUuPKjfw8fowjJJz3oGAyUwo/K0WeMvU5djzVA=";

    # the repository's .gitattributes file contains the lines "/Tst/
    # export-ignore" and "/doc/ export-ignore" so some directories are
-    # not included in the tarball downloaded by fetchzip. setting
-    # fetchSubmodules works around this by using fetchgit instead of
-    # fetchzip.
-    fetchSubmodules = true;
+    # not included in the tarball downloaded by fetchzip.
+    forceFetchGit = true;
  };

-  patches = [
-    # fix timeouts when docbuilding with >= 64 cpus
-    # https://github.com/Singular/Singular/issues/1117
-    ./vspace-MAX_PROCESS.patch
-
-    # add aarch64 support to cpu-check.m4. copied from redhat.
-    ./redhat-aarch64.patch
-
-    # the newest version of ax-prog-cc-for-build.m4 seems to trigger
-    # linker errors. see
-    # https://github.com/alsa-project/alsa-firmware/issues/3 for a
-    # related issue.
-    ./use-older-ax-prog-cc-for-build.patch
-
-    # https://github.com/Singular/Singular/issues/1086
-    (fetchpatch {
-      name = "schubert-lib-fails-with-too-many-cpus.patch";
-      url = "https://github.com/Singular/Singular/commit/3cda50c00a849455efa2502e56596955491a353a.patch";
-      sha256 = "sha256-fgYd+2vT32w5Ki8kKx6PfZn2e4QSJcYWOwEFXtc+lSA=";
-    })
-  ] ++ lib.optionals enableDocs [
-    # singular supports building without 4ti2, bertini, normaliz or
-    # topcom just fine, but the docbuilding does not skip manual pages
-    # tagged as depending on those binaries (probably a bug in
-    # doc2tex.pl::HandleLib, since it seems to ignore "-exclude"
-    # argumens). skip them manually.
-    ./disable-docs-for-optional-unpackaged-deps.patch
-
-    # fix some non-ascii characters in doc/decodegb.doc
-    (fetchpatch {
-      name = "decodegb-ascii.patch";
-      url = "https://github.com/Singular/Singular/commit/36966d9009de572ee4dbc487f3e5744098fe91be.patch";
-      sha256 = "sha256-9WcEov/oOQRC584ag6WVHFwY2aCjbM75HWyvZoEwppw=";
-    })
-  ];
-
  configureFlags = [
    "--with-ntl=${ntl}"
    "--disable-pyobject-module"
@ -114,6 +74,7 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals enableGfanlib [
    cddlib
  ];
+
  nativeBuildInputs = [
    bison
    perl
@ -123,9 +84,11 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals enableDocs [
    doxygen
    graphviz
+    latex2html
    texinfo4
    texlive.combined.scheme-small
  ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];

  preAutoreconf = ''
    find . -type f -readable -writable -exec sed \
@ -137,21 +100,14 @@ stdenv.mkDerivation rec {

  hardeningDisable = lib.optional stdenv.isi686 "stackprotector";

-  # The Makefile actually defaults to `make install` anyway
-  buildPhase = ''
-    # do nothing
-  '';
-
  doCheck = true; # very basic checks, does not test any libraries

  installPhase = ''
-    mkdir -p "$out"
-    cp -r Singular/LIB "$out/lib"
    make install
  '' + lib.optionalString enableDocs ''
-    # Sage uses singular.hlp (which is not in the tarball)
+    # Sage uses singular.info, which is not installed by default
    mkdir -p $out/share/info
-    cp doc/singular.hlp $out/share/info
+    cp doc/singular.info $out/share/info
  '' + ''
    # Make sure patchelf picks up the right libraries
    rm -rf libpolys factory resources omalloc Singular
@ -211,5 +167,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3; # Or GPLv2 at your option - but not GPLv4
    homepage = "http://www.singular.uni-kl.de";
    downloadPage = "http://www.mathematik.uni-kl.de/ftp/pub/Math/Singular/SOURCES/";
+    mainProgram = "Singular";
  };
 }
--- a/pkgs/applications/science/math/singular/disable-docs-for-optional-unpackaged-deps.patch
+++ b/pkgs/applications/science/math/singular/disable-docs-for-optional-unpackaged-deps.patch
@ -1,112 +0,0 @@
-commit 9e8b044d982e132cf35a106a1cc0cf7e77b27f7c
-Author: Mauricio Collares <mauricio@collares.org>
-Date:   Thu Apr 15 20:33:21 2021 -0300
-
-    Disable manual sections using optional packages not yet in Nixpkgs
-
-        * normaliz.lib depends on normaliz.
-        * polymake.lib depends on topcom.
-        * recover.lib depends on bertini.
-        * sing4ti2.lib depends on 4ti2.
-        * tateProdCplxNegGrad.lib uses multigrading.lib, which depends on 4ti2.
-
-diff --git a/doc/singular.doc b/doc/singular.doc
-index 64b969d39..e704f95f0 100644
--- a/doc/singular.doc
-+++ b/doc/singular.doc
-@@ -407,7 +407,6 @@ LIB "all.lib";
- * nfmodsyz_lib:: Syzygy modules of submodules of free modules over algebraic number fields
- * noether_lib:: Noether normalization of an ideal
- * normal_lib:: procedure for normalization
-* normaliz_lib:: integral closure, normalization for monomial ideals, toric ideals
- * pointid_lib:: factorized lex GB of the vanishing ideal of a set of points
- * primdec_lib:: procedures for primary decomposition
- * primdecint_lib:: primary decomposition over the integers
-@@ -416,7 +415,6 @@ LIB "all.lib";
- * reesclos_lib:: Rees Algebra and integral closure of an ideal
- * rstandard_lib:: Janet bases and border bases for ideals
- * sagbi_lib:: Subalgebras bases Analogous to Groebner bases for ideals
-* sing4ti2_lib:: interface to program 4ti2
- * symodstd_lib:: Groebner bases for symmetric ideals
- * toric_lib:: toric ideals
- @end menu
-@@ -521,10 +519,6 @@ LIB "all.lib";
- @node normal_lib
- @subsection normal_lib
- @c lib normal.lib
-@c ---------------------------------------------------------
-@node normaliz_lib
-@subsection normaliz_lib
-@c lib normaliz.lib tag:normaliz
- @c ----------------------------------------------------------
- @node pointid_lib
- @subsection pointid_lib
-@@ -558,10 +552,6 @@ LIB "all.lib";
- @subsection sagbi_lib
- @c lib sagbi.lib
- @c ---------------------------------------------------------
-@node sing4ti2_lib
-@subsection sing4ti2_lib
-@c lib sing4ti2.lib tag:sing4ti2
-@c ----------------------------------------------------------
- @node symodstd_lib
- @subsection symodstd_lib
- @c lib symodstd.lib
-@@ -873,7 +863,6 @@ iniD, reslist, sumlist, dividelist, createlist
- * solve_lib:: procedures to solve polynomial systems
- * triang_lib:: procedures for decomposing zero-dimensional ideals
- * ntsolve_lib:: one real solution of polynomial systems (Newton iteration)
-* recover_lib:: Hybrid numerical/symbolical algorithms
- * rootisolation_lib:: real root isolation with intervals
- * signcond_lib:: computing realizable sign conditions
- * zeroset_lib:: procedures for roots and factorization
-@@ -904,10 +893,6 @@ iniD, reslist, sumlist, dividelist, createlist
- @subsection ntsolve_lib
- @c lib ntsolve.lib
- @c ---------------------------------------------------------
-@node recover_lib
-@subsection recover_lib
-@c lib recover.lib tag:bertini
-@c ----------------------------------------------------------
- @node rootisolation_lib
- @subsection rootisolation_lib
- @c lib rootisolation.lib
-@@ -1108,7 +1093,6 @@ but not for serious computations.
- * cimonom_lib:: complete intersection for toric ideals
- * gfan_lib:: A gfanlib interface for Singular
- * gitfan_lib:: Compute GIT-fans
-* polymake_lib:: interface to TOPCOM
- * realizationMatroids_lib:: Realizability for Tropical Fan Curves
- * tropical_lib:: interface to gfan
- * tropicalNewton_lib:: Newton polygons in tropical geometry
-@@ -1125,10 +1109,7 @@ but not for serious computations.
- @node gitfan_lib
- @subsection gitfan_lib
- @c lib gitfan.lib
-@c ----------------------------------------------------------
-@node polymake_lib
-@subsection polymake_lib
-@c lib polymake.lib tag:topcom
-+
- @c ----------------------------------------------------------
- @node realizationMatroids_lib
- @subsection realizationMatroids_lib
-@@ -1219,7 +1200,6 @@ Comments should be send to the author of the library directly.
- * stanleyreisner_lib:: T1 and T2 for a general Stanley-Reiser ring
- * swalk_lib:: Sagbi Walk Conversion Algorithm
- * systhreads_lib:: multi-threaded objects
-* tateProdCplxNegGrad_lib:: sheaf cohomology on product of projective spaces
- * VecField_lib:: vector fields
- @end menu
- @c ----------------------------------------------------------
-@@ -1310,10 +1290,6 @@ Todos/Issues:
- @subsection systhreads_lib
- @c lib systhreads.lib
- @c ---------------------------------------------------------
-@node tateProdCplxNegGrad_lib
-@subsection tateProdCplxNegGrad_lib
-@c lib tateProdCplxNegGrad.lib
-@c ---------------------------------------------------------
- @node VecField_lib
- @subsection VecField_lib
- @c lib VecField.lib
--- a/pkgs/applications/science/math/singular/redhat-aarch64.patch
+++ b/pkgs/applications/science/math/singular/redhat-aarch64.patch
@ -1,38 +0,0 @@
-diff --git a/m4/cpu-check.m4 b/m4/cpu-check.m4
-index 3cf0a7f08..12bb926ac 100644
--- a/m4/cpu-check.m4
-+++ b/m4/cpu-check.m4
-@@ -37,6 +37,18 @@ if test "$ac_cv_singcpuname" = ppc; then
-   AC_DEFINE(SI_CPU_PPC,1,"PPC")
-   AC_SUBST(SI_CPU_PPC)
- fi
-+if test "$ac_cv_singcpuname" = arm -o "$ac_cv_singcpuname" = armel; then
-+  AC_DEFINE(SI_CPU_ARM,1,"ARM")
-+  AC_SUBST(SI_CPU_ARM)
-+fi
-+if test "$ac_cv_singcpuname" = aarch64; then
-+  AC_DEFINE(SI_CPU_AARCH64,1,"AARCH64")
-+  AC_SUBST(SI_CPU_AARCH64)
-+fi
-+if test "$ac_cv_singcpuname" = s390; then
-+  AC_DEFINE(SI_CPU_S390,1,"S390")
-+  AC_SUBST(SI_CPU_S390)
-+fi
- 
- # UNAME and PATH
- AC_MSG_CHECKING(uname for Singular)
-@@ -65,6 +77,14 @@ dnl testet on: ppc_Linux, 740/750 PowerMac G3, 512k L2 cache
-   [powerpc*|ppc*], [AC_DEFINE(HAVE_GENERIC_MULT,1,multiplication is fast on the cpu: a*b is with mod otherwise using tables of logartihms)],
- dnl the following settings seems to be better on arm processors
-   [arm*], [],
-+dnl FIXME: need to run some tests
-+  [aarch64*], [
-+            AC_DEFINE(HAVE_MULT_MOD,1,multiplication is fast on the cpu: a*b is with mod otherwise using tables of logartihms)
-+            AC_DEFINE(HAVE_GENERIC_ADD,1,use branch for addition in Z/p otherwise it uses a generic add)
-+            AC_DEFINE(HAVE_DIV_MOD,1,division using extend euclidian algorithm otherwise using tables of logartihms)
-+            ],
-+dnl FIXME: need to run some tests
-+  [s390*], [AC_DEFINE(HAVE_GENERIC_ADD,1,use branch for addition in Z/p otherwise it uses a generic add)],
-   []
- )
- 
--- a/pkgs/applications/science/math/singular/use-older-ax-prog-cc-for-build.patch
+++ b/pkgs/applications/science/math/singular/use-older-ax-prog-cc-for-build.patch
@ -1,194 +0,0 @@
-diff --git a/m4/ax_prog_cc_for_build.m4 b/m4/ax_prog_cc_for_build.m4
-index f7410d74b..12cb005a5 100644
--- a/m4/ax_prog_cc_for_build.m4
-+++ b/m4/ax_prog_cc_for_build.m4
-@@ -32,35 +32,31 @@
- #   and this notice are preserved. This file is offered as-is, without any
- #   warranty.
- 
-#serial 18
-+#serial 9
- 
- AU_ALIAS([AC_PROG_CC_FOR_BUILD], [AX_PROG_CC_FOR_BUILD])
- AC_DEFUN([AX_PROG_CC_FOR_BUILD], [dnl
- AC_REQUIRE([AC_PROG_CC])dnl
- AC_REQUIRE([AC_PROG_CPP])dnl
-AC_REQUIRE([AC_CANONICAL_BUILD])dnl
-+AC_REQUIRE([AC_EXEEXT])dnl
-+AC_REQUIRE([AC_CANONICAL_HOST])dnl
- 
- dnl Use the standard macros, but make them use other variable names
- dnl
- pushdef([ac_cv_prog_CPP], ac_cv_build_prog_CPP)dnl
-pushdef([ac_cv_prog_cc_c89], ac_cv_build_prog_cc_c89)dnl
- pushdef([ac_cv_prog_gcc], ac_cv_build_prog_gcc)dnl
- pushdef([ac_cv_prog_cc_works], ac_cv_build_prog_cc_works)dnl
- pushdef([ac_cv_prog_cc_cross], ac_cv_build_prog_cc_cross)dnl
- pushdef([ac_cv_prog_cc_g], ac_cv_build_prog_cc_g)dnl
-pushdef([ac_cv_c_compiler_gnu], ac_cv_build_c_compiler_gnu)dnl
- pushdef([ac_cv_exeext], ac_cv_build_exeext)dnl
- pushdef([ac_cv_objext], ac_cv_build_objext)dnl
- pushdef([ac_exeext], ac_build_exeext)dnl
- pushdef([ac_objext], ac_build_objext)dnl
- pushdef([CC], CC_FOR_BUILD)dnl
- pushdef([CPP], CPP_FOR_BUILD)dnl
-pushdef([GCC], GCC_FOR_BUILD)dnl
- pushdef([CFLAGS], CFLAGS_FOR_BUILD)dnl
- pushdef([CPPFLAGS], CPPFLAGS_FOR_BUILD)dnl
-pushdef([EXEEXT], BUILD_EXEEXT)dnl
- pushdef([LDFLAGS], LDFLAGS_FOR_BUILD)dnl
-pushdef([OBJEXT], BUILD_OBJEXT)dnl
- pushdef([host], build)dnl
- pushdef([host_alias], build_alias)dnl
- pushdef([host_cpu], build_cpu)dnl
-@@ -71,29 +67,27 @@ pushdef([ac_cv_host_alias], ac_cv_build_alias)dnl
- pushdef([ac_cv_host_cpu], ac_cv_build_cpu)dnl
- pushdef([ac_cv_host_vendor], ac_cv_build_vendor)dnl
- pushdef([ac_cv_host_os], ac_cv_build_os)dnl
-pushdef([ac_tool_prefix], ac_build_tool_prefix)dnl
-pushdef([am_cv_CC_dependencies_compiler_type], am_cv_build_CC_dependencies_compiler_type)dnl
-pushdef([am_cv_prog_cc_c_o], am_cv_build_prog_cc_c_o)dnl
-pushdef([cross_compiling], cross_compiling_build)dnl
-+pushdef([ac_cpp], ac_build_cpp)dnl
-+pushdef([ac_compile], ac_build_compile)dnl
-+pushdef([ac_link], ac_build_link)dnl
- 
-cross_compiling_build=no
-+save_cross_compiling=$cross_compiling
-+save_ac_tool_prefix=$ac_tool_prefix
-+cross_compiling=no
-+ac_tool_prefix=
- 
-ac_build_tool_prefix=
-AS_IF([test -n "$build"],      [ac_build_tool_prefix="$build-"],
-      [test -n "$build_alias"],[ac_build_tool_prefix="$build_alias-"])
-
-AC_LANG_PUSH([C])
- AC_PROG_CC
-_AC_COMPILER_EXEEXT
-_AC_COMPILER_OBJEXT
- AC_PROG_CPP
-+AC_EXEEXT
-+
-+ac_tool_prefix=$save_ac_tool_prefix
-+cross_compiling=$save_cross_compiling
- 
- dnl Restore the old definitions
- dnl
-popdef([cross_compiling])dnl
-popdef([am_cv_prog_cc_c_o])dnl
-popdef([am_cv_CC_dependencies_compiler_type])dnl
-popdef([ac_tool_prefix])dnl
-+popdef([ac_link])dnl
-+popdef([ac_compile])dnl
-+popdef([ac_cpp])dnl
- popdef([ac_cv_host_os])dnl
- popdef([ac_cv_host_vendor])dnl
- popdef([ac_cv_host_cpu])dnl
-@@ -104,33 +98,25 @@ popdef([host_vendor])dnl
- popdef([host_cpu])dnl
- popdef([host_alias])dnl
- popdef([host])dnl
-popdef([OBJEXT])dnl
- popdef([LDFLAGS])dnl
-popdef([EXEEXT])dnl
- popdef([CPPFLAGS])dnl
- popdef([CFLAGS])dnl
-popdef([GCC])dnl
- popdef([CPP])dnl
- popdef([CC])dnl
- popdef([ac_objext])dnl
- popdef([ac_exeext])dnl
- popdef([ac_cv_objext])dnl
- popdef([ac_cv_exeext])dnl
-popdef([ac_cv_c_compiler_gnu])dnl
- popdef([ac_cv_prog_cc_g])dnl
- popdef([ac_cv_prog_cc_cross])dnl
- popdef([ac_cv_prog_cc_works])dnl
-popdef([ac_cv_prog_cc_c89])dnl
- popdef([ac_cv_prog_gcc])dnl
- popdef([ac_cv_prog_CPP])dnl
- 
-dnl restore global variables ac_ext, ac_cpp, ac_compile,
-dnl ac_link, ac_compiler_gnu (dependant on the current
-dnl language after popping):
-AC_LANG_POP([C])
-
- dnl Finally, set Makefile variables
- dnl
-+BUILD_EXEEXT=$ac_build_exeext
-+BUILD_OBJEXT=$ac_build_objext
- AC_SUBST(BUILD_EXEEXT)dnl
- AC_SUBST(BUILD_OBJEXT)dnl
- AC_SUBST([CFLAGS_FOR_BUILD])dnl
-diff --git a/m4/ax_prog_cxx_for_build.m4 b/m4/ax_prog_cxx_for_build.m4
-index 4d976769f..17c19a89f 100644
--- a/m4/ax_prog_cxx_for_build.m4
-+++ b/m4/ax_prog_cxx_for_build.m4
-@@ -31,7 +31,7 @@
- #   and this notice are preserved. This file is offered as-is, without any
- #   warranty.
- 
-#serial 4
-+#serial 3
- 
- AU_ALIAS([AC_PROG_CXX_FOR_BUILD], [AX_PROG_CXX_FOR_BUILD])
- AC_DEFUN([AX_PROG_CXX_FOR_BUILD], [dnl
-@@ -49,7 +49,6 @@ pushdef([ac_cv_prog_cxx_cross], ac_cv_build_prog_cxx_cross)dnl
- pushdef([ac_cv_prog_cxx_g], ac_cv_build_prog_cxx_g)dnl
- pushdef([CXX], CXX_FOR_BUILD)dnl
- pushdef([CXXCPP], CXXCPP_FOR_BUILD)dnl
-pushdef([GXX], GXX_FOR_BUILD)dnl
- pushdef([CXXFLAGS], CXXFLAGS_FOR_BUILD)dnl
- pushdef([CPPFLAGS], CPPFLAGS_FOR_BUILD)dnl
- pushdef([CXXCPPFLAGS], CXXCPPFLAGS_FOR_BUILD)dnl
-@@ -63,25 +62,26 @@ pushdef([ac_cv_host_alias], ac_cv_build_alias)dnl
- pushdef([ac_cv_host_cpu], ac_cv_build_cpu)dnl
- pushdef([ac_cv_host_vendor], ac_cv_build_vendor)dnl
- pushdef([ac_cv_host_os], ac_cv_build_os)dnl
-pushdef([ac_tool_prefix], ac_build_tool_prefix)dnl
-pushdef([am_cv_CXX_dependencies_compiler_type], am_cv_build_CXX_dependencies_compiler_type)dnl
-pushdef([cross_compiling], cross_compiling_build)dnl
-+pushdef([ac_cxxcpp], ac_build_cxxcpp)dnl
-+pushdef([ac_compile], ac_build_compile)dnl
-+pushdef([ac_link], ac_build_link)dnl
- 
-cross_compiling_build=no
-+save_cross_compiling=$cross_compiling
-+save_ac_tool_prefix=$ac_tool_prefix
-+cross_compiling=no
-+ac_tool_prefix=
- 
-ac_build_tool_prefix=
-AS_IF([test -n "$build"],      [ac_build_tool_prefix="$build-"],
-      [test -n "$build_alias"],[ac_build_tool_prefix="$build_alias-"])
-
-AC_LANG_PUSH([C++])
- AC_PROG_CXX
- AC_PROG_CXXCPP
- 
-+ac_tool_prefix=$save_ac_tool_prefix
-+cross_compiling=$save_cross_compiling
-+
- dnl Restore the old definitions
- dnl
-popdef([cross_compiling])dnl
-popdef([am_cv_CXX_dependencies_compiler_type])dnl
-popdef([ac_tool_prefix])dnl
-+popdef([ac_link])dnl
-+popdef([ac_compile])dnl
-+popdef([ac_cxxcpp])dnl
- popdef([ac_cv_host_os])dnl
- popdef([ac_cv_host_vendor])dnl
- popdef([ac_cv_host_cpu])dnl
-@@ -103,10 +103,6 @@ popdef([ac_cv_prog_cxx_works])dnl
- popdef([ac_cv_prog_gxx])dnl
- popdef([ac_cv_prog_CXXCPP])dnl
- 
-dnl restore global variables (dependant on the current
-dnl language after popping):
-AC_LANG_POP([C++])
-
- dnl Finally, set Makefile variables
- dnl
- AC_SUBST([CXXFLAGS_FOR_BUILD])dnl
--- a/pkgs/applications/science/math/singular/vspace-MAX_PROCESS.patch
+++ b/pkgs/applications/science/math/singular/vspace-MAX_PROCESS.patch
@ -1,35 +0,0 @@
-diff --git a/kernel/GBEngine/kChinese.cc b/kernel/GBEngine/kChinese.cc
-index 829a66609..84655caf2 100644
--- a/kernel/GBEngine/kChinese.cc
-+++ b/kernel/GBEngine/kChinese.cc
-@@ -209,6 +209,8 @@ ideal id_ChineseRemainder_0(ideal *xx, number *q, int rl, const ring r)
-     return NULL;
-   }
-   int cpus=(int)(long)feOptValue(FE_OPT_CPUS);
-+  if (cpus>=vspace::internals::MAX_PROCESS)
-+    cpus=vspace::internals::MAX_PROCESS-1;
-   if ((cpus==1) || (2*cpus>=cnt))
-     /* at least 2 polys for each process, or switch to seriell version */
-     return id_ChineseRemainder(xx,q,rl,r);
-@@ -295,6 +297,8 @@ ideal id_Farey_0(ideal x, number N, const ring r)
- {
-   int cnt=IDELEMS(x)*x->nrows;
-   int cpus=(int)(long)feOptValue(FE_OPT_CPUS);
-+  if (cpus>=vspace::internals::MAX_PROCESS)
-+    cpus=vspace::internals::MAX_PROCESS-1;
-   if (2*cpus>=cnt) /* at least 2 polys for each process, 
-                      or switch to seriell version */
-     return id_Farey(x,N,r);
-diff --git a/kernel/GBEngine/kverify.cc b/kernel/GBEngine/kverify.cc
-index 909d84994..aa06d6624 100644
--- a/kernel/GBEngine/kverify.cc
-+++ b/kernel/GBEngine/kverify.cc
-@@ -176,6 +176,8 @@ BOOLEAN kVerify2(ideal F, ideal Q)
-   /*---------------------------------------------------------------------*/
-   BOOLEAN all_okay=TRUE;
-   int cpus=(int)(long)feOptValue(FE_OPT_CPUS);
-+  if (cpus>=vspace::internals::MAX_PROCESS)
-+    cpus=vspace::internals::MAX_PROCESS-1;
-   int parent_pid=getpid();
-   using namespace vspace;
-   vmem_init();
--- a/pkgs/applications/version-management/git-and-tools/glab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/glab/default.nix
@ -11,7 +11,7 @@ buildGoModule rec {
    sha256 = "sha256-7w6cbeZYhmV0EXXcWlXFq2pQGGxc5Ok4bba0g3fcgmE=";
  };

-  vendorSha256 = "sha256-P7gHCyFafjWOYLEtK9Eh2S2KA0e2hzc1G/ZqVaEWWB0=";
+  vendorSha256 = "sha256-hGpJXCs5lZ6QQHr6LW1fCT+CVtOaUpYXJPchDPDdbaM=";

  ldflags = [
    "-X main.version=${version}"
--- a/pkgs/applications/version-management/git-and-tools/glitter/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/glitter/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "glitter";
-  version = "1.5.12";
+  version = "1.5.13";

  src = fetchFromGitHub {
    owner = "milo123459";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-XQ3HLmT3sWjoHTxnOU9FSHbnCwitFH0tOOpT7WwTEPE=";
+    sha256 = "sha256-arHwIQXZYxwnFbyLoKQiv3gYHEN80DxbdaO4dM9ZBs8=";
  };

-  cargoSha256 = "sha256-V54Itj7/zUO1bp0y30TjV1mSo/oNJOxEofpSqrYz6xk=";
+  cargoSha256 = "sha256-d+DERHE8Nzre1MXNj4Cp9fcRkLPEC8hzh0SeTpS2C5A=";

  # tests require it to be in a git repository
  preCheck = ''
--- a/pkgs/applications/version-management/gogs/default.nix
+++ b/pkgs/applications/version-management/gogs/default.nix
@ -8,16 +8,16 @@ with lib;

 buildGoModule rec {
  pname = "gogs";
-  version = "0.12.3";
+  version = "0.12.4";

  src = fetchFromGitHub {
    owner = "gogs";
    repo = "gogs";
    rev = "v${version}";
-    sha256 = "0ix3mxy8cpqbx24qffbzyf5z88x7605icm7rk5n54r8bdsr7cckd";
+    sha256 = "sha256-t2aXRYCr54sqXwv6cJHDf1z1z94SqJM0WQRd2ejc7XY=";
  };

-  vendorSha256 = "0m0g4dsiq8p2ngsbjxfi3wff7x4xpm67qlhgcgf8b48mqai4d2gc";
+  vendorSha256 = "sha256-3dT5D+oDd0mpJp/cP53TQcRUkmqh6g3sRBWWAUqhaAo=";

  subPackages = [ "." ];

--- a/pkgs/applications/version-management/got/default.nix
+++ b/pkgs/applications/version-management/got/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "got";
-  version = "0.64";
+  version = "0.66";

  src = fetchurl {
    url =
      "https://gameoftrees.org/releases/portable/got-portable-${version}.tar.gz";
-    sha256 = "1qigv8fnmiynrx6qrg28n2981a30n56nh3xbhmlpihl7fqxmg1sq";
+    sha256 = "13xrwndj80jix210fxkadivxyd1f5qavdrhxyl32n68xyv5xmkgg";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/video/plex-media-player/default.nix
+++ b/pkgs/applications/video/plex-media-player/default.nix
@ -36,12 +36,16 @@ in mkDerivation rec {

  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=RelWithDebInfo" "-DQTROOT=${qtbase}" ];

+  # plexmediaplayer currently segfaults under wayland
+  qtWrapperArgs = [ "--set" "QT_QPA_PLATFORM" "xcb" ];
+
  passthru.updateScript = ./update.sh;

  meta = with lib; {
    description = "Streaming media player for Plex";
    license = licenses.gpl2;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ b4dm4n ];
    homepage = "https://plex.tv";
+    mainProgram = "plexmediaplayer";
  };
 }
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@ -2,19 +2,22 @@

 rustPlatform.buildRustPackage rec {
  pname = "cloud-hypervisor";
-  version = "20.2";
+  version = "21.0";

  src = fetchFromGitHub {
    owner = "cloud-hypervisor";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-yIp1p8GyBojWKmvFRZ/OeyF2bjlqYsuXUrYTVunYV8Y=";
+    sha256 = "00b0ij9sfv7zsrgwrcj2rzpy1z8bp0m0lmzjp433xzpcgcnzw3w5";
  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ] ++ lib.optional stdenv.isAarch64 dtc;

-  cargoSha256 = "sha256-s2u6e2JbukPo3pXYzQJXP5d2G213u1+1ke9gZFnB+5g=";
+  cargoSha256 = "0lf7bb468s2ic9vabx954i46605gf7c6064vvwqvz7djk30z0y0d";
+
+  # Integration tests require root.
+  cargoTestFlags = [ "--bins" ];

  meta = with lib; {
    homepage = "https://github.com/cloud-hypervisor/cloud-hypervisor";
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -827,6 +827,8 @@ rec {
      # this on, but tooling may disable this to insert the store paths more
      # efficiently via other means, such as bind mounting the host store.
      includeStorePaths ? true
+    , # Passthru arguments for the underlying derivation.
+      passthru ? {}
    ,
    }:
      assert
@ -987,7 +989,7 @@ rec {
        result = runCommand "stream-${baseName}"
          {
            inherit (conf) imageName;
-            passthru = {
+            passthru = passthru // {
              inherit (conf) imageTag;

              # Distinguish tarballs and exes at the Nix level so functions that
--- a/pkgs/data/misc/ddccontrol-db/default.nix
+++ b/pkgs/data/misc/ddccontrol-db/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "ddccontrol-db";
-  version = "20210812";
+  version = "20220119";

  src = fetchFromGitHub {
    owner = "ddccontrol";
    repo = "ddccontrol-db";
    rev = version;
-    sha256 = "sha256-dRqyjDC9yNkNOnYQ9fkWPlnyzSqIZ4zxZ2T7t8Bu9FE=";
+    sha256 = "sha256-8JJ6RG7yA1ssoYsvgDYp3/r+h1+rKnOwwoDhRx2brY8=";
  };

  preConfigure = ''
--- a/pkgs/data/themes/kwin-decorations/kde-rounded-corners/default.nix
+++ b/pkgs/data/themes/kwin-decorations/kde-rounded-corners/default.nix
@ -0,0 +1,38 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+, extra-cmake-modules
+, wrapQtAppsHook
+, kwin
+, kdelibs4support
+, libepoxy
+, libXdmcp
+, lib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "kde-rounded-corners";
+  version = "unstable-2021-11-06";
+
+  src = fetchFromGitHub {
+    owner = "matinlotfali";
+    repo = "KDE-Rounded-Corners";
+    rev = "8ad8f5f5eff9d1625abc57cb24dc484d51f0e1bd";
+    sha256 = "0xbskf7jd03d2invfz1nnfc82klzvc784snw539n4kn6c6rc381p";
+  };
+
+  postConfigure = ''
+    substituteInPlace cmake_install.cmake \
+      --replace "${kdelibs4support}" "$out"
+  '';
+
+  nativeBuildInputs = [ cmake extra-cmake-modules wrapQtAppsHook ];
+  buildInputs = [ kwin kdelibs4support libepoxy libXdmcp ];
+
+  meta = with lib; {
+    description = "Rounds the corners of your windows";
+    homepage = "https://github.com/matinlotfali/KDE-Rounded-Corners";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ flexagoon ];
+  };
+}
--- a/pkgs/desktops/gnome/games/tali/default.nix
+++ b/pkgs/desktops/gnome/games/tali/default.nix
@ -20,11 +20,11 @@

 stdenv.mkDerivation rec {
  pname = "tali";
-  version = "40.4";
+  version = "40.5";

  src = fetchurl {
    url = "mirror://gnome/sources/tali/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "AsrMdvTuQjD2eqAK2hlOnFSPidJ6DnLyANi9U67nGhc=";
+    sha256 = "Y6CcVeRqGhl1a/XglXyvmUMA+tq9umvaYC5mjfzfcSI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/interpreters/lunatic/default.nix
+++ b/pkgs/development/interpreters/lunatic/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "lunatic";
-  version = "0.7.4";
+  version = "0.7.5";

  src = fetchFromGitHub {
    owner = "lunatic-solutions";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-RX8JarGpY6dhPGpvOX1FuUjirEPff0wGqLkGFxOa+bc=";
+    sha256 = "sha256-HqDrGoyYzdx8OTanlRd95L1wAtFeew7Xs2rZ7nK2Zus=";
  };

-  cargoSha256 = "sha256-UvrDqxaZSgUJ/a6abigTuiUOfw+C7UolBApt5kVR+yo=";
+  cargoSha256 = "sha256-t3EwVYrKx7dvUcSp0B1iUAklg7WdQDld/T0O1HgHw54=";

  nativeBuildInputs = [ cmake ];

--- a/pkgs/development/interpreters/rakudo/zef.nix
+++ b/pkgs/development/interpreters/rakudo/zef.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "zef";
-  version = "0.13.4";
+  version = "0.13.6";

  src = fetchFromGitHub {
    owner = "ugexe";
    repo = "zef";
    rev = "v${version}";
-    sha256 = "sha256-zTgXMICuLn612bmL5e6GP5aBQ4uOcSLfce0PCRYGob0=";
+    sha256 = "sha256-Bios3h2bcR6PntFt6JWF7l5u6gjKaljS8HsKfTf+0X8=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/libraries/fflas-ffpack/default.nix
+++ b/pkgs/development/libraries/fflas-ffpack/default.nix
@ -6,13 +6,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation rec {
  pname = "fflas-ffpack";
-  version = "2.4.3";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "linbox-team";
    repo = pname;
-    rev = version;
-    sha256 = "1ynbjd72qrwp0b4kpn0p5d7gddpvj8dlb5fwdxajr5pvkvi3if74";
+    rev = "v${version}";
+    sha256 = "sha256-Eztc2jUyKRVUiZkYEh+IFHkDuPIy+Gx3ZW/MsuOVaMc=";
  };

  checkInputs = [
--- a/pkgs/development/libraries/fplll/default.nix
+++ b/pkgs/development/libraries/fplll/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
+, pkg-config
 , gettext
 , autoreconfHook
 , gmp
@ -9,16 +9,17 @@

 stdenv.mkDerivation rec {
  pname = "fplll";
-  version = "5.3.2";
+  version = "5.4.1";

  src = fetchFromGitHub {
    owner = "fplll";
    repo = "fplll";
    rev = version;
-    sha256 = "00iyz218ywspizjiimrjdcqvdqmrsb2367zyy3vkmypnf9i9l680";
+    sha256 = "sha256-6Zde8/bPOQQ16DqhqrQuGXDrf5HQEn5lwxauvyBr4XQ=";
  };

  nativeBuildInputs = [
+    pkg-config
    gettext
    autoreconfHook
  ];
--- a/pkgs/development/libraries/givaro/default.nix
+++ b/pkgs/development/libraries/givaro/default.nix
@ -1,12 +1,12 @@
 { lib, stdenv, fetchFromGitHub, automake, autoconf, libtool, autoreconfHook, gmpxx }:
 stdenv.mkDerivation rec {
  pname = "givaro";
-  version = "4.1.1";
+  version = "4.2.0";
  src = fetchFromGitHub {
    owner = "linbox-team";
    repo = pname;
    rev = "v${version}";
-    sha256 = "11wz57q6ijsvfs5r82masxgr319as92syi78lnl9lgdblpc6xigk";
+    sha256 = "sha256-KR0WJc0CSvaBnPRott4hQJhWNBb/Wi6MIhcTExtVobQ=";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "leatherman";
-  version = "1.12.6";
+  version = "1.12.7";

  src = fetchFromGitHub {
-    sha256 = "sha256-k5Lt/NCSlBaTGhpR4T3Q4Ih+RR1xKROxz+RNYor7zaQ=";
+    sha256 = "sha256-a79/seKO6Efn6g4RWdqsP83pL5AIBAp1InjnMdOs3Qk=";
    rev = version;
    repo = "leatherman";
    owner = "puppetlabs";
--- a/pkgs/development/libraries/libamqpcpp/default.nix
+++ b/pkgs/development/libraries/libamqpcpp/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libamqpcpp";
-  version = "4.3.15";
+  version = "4.3.16";

  src = fetchFromGitHub {
    owner = "CopernicaMarketingSoftware";
    repo = "AMQP-CPP";
    rev = "v${version}";
-    sha256 = "sha256-S2/ecWC78Q4ihVLtDQ6DD8/qX1cDslnTjqd5IkKCjc4=";
+    sha256 = "sha256-aBLNdw9LhHFwnIt70vIYlX1/j2IUTmpm5Ub+ZImF8FI=";
  };

  buildInputs = [ openssl ];
--- a/pkgs/development/libraries/libtorrent-rasterbar/1.1.nix
+++ b/pkgs/development/libraries/libtorrent-rasterbar/1.1.nix
@ -46,5 +46,6 @@ in stdenv.mkDerivation {
    license = licenses.bsd3;
    maintainers = [ ];
    platforms = platforms.unix;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/libtorrent-rasterbar-1_1_x.x86_64-darwin
  };
 }
--- a/pkgs/development/libraries/linbox/default.nix
+++ b/pkgs/development/libraries/linbox/default.nix
@ -14,13 +14,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation rec {
  pname = "linbox";
-  version = "1.6.3"; # TODO: Check postPatch script on update
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "linbox-team";
    repo = pname;
    rev = "v${version}";
-    sha256 = "10j6dspbsq7d2l4q3y0c1l1xwmaqqba2fxg59q5bhgk9h5d7q571";
+    sha256 = "sha256-mW84a98KPLqcHMjX3LIYTmVe0ngUdz6RJLpoDaAqKU8=";
  };

  nativeBuildInputs = [
@ -35,20 +35,6 @@ stdenv.mkDerivation rec {
    fflas-ffpack
  ];

-  patches = [
-    # Remove inappropriate `const &` qualifiers on data members that can be
-    # modified via member functions.
-    # See also: https://github.com/linbox-team/linbox/pull/256
-    ./patches/linbox-pr256-part2.patch # TODO: Remove on 1.7.0 update
-  ];
-
-  postPatch = ''
-    # Remove @LINBOXSAGE_LIBS@ that is actually undefined.
-    # See also: https://github.com/linbox-team/linbox/pull/249
-    # TODO: Remove on 1.7.0 update
-    find . -type f -exec sed -e 's/@LINBOXSAGE_LIBS@//' -i {} \;
-  '';
-
  configureFlags = [
    "--with-blas-libs=-lblas"
    "--disable-optimization"
--- a/pkgs/development/libraries/linbox/patches/linbox-pr256-part2.patch
+++ b/pkgs/development/libraries/linbox/patches/linbox-pr256-part2.patch
@ -1,13 +0,0 @@
--- a/linbox/algorithms/det-rational.h
-+++ b/linbox/algorithms/det-rational.h
-@@ -79,8 +79,8 @@
- 	struct MyRationalModularDet {
- 		const Blackbox &A;
- 		const MyMethod &M;
-		const Integer &mul;//multiplicative prec;
-		const Integer &div;
-+		Integer mul;//multiplicative prec;
-+		Integer div;
- 
- 		MyRationalModularDet(const Blackbox& b, const MyMethod& n,
- 				     const Integer & p1, const Integer & p2) :
--- a/pkgs/development/libraries/science/astronomy/indilib/default.nix
+++ b/pkgs/development/libraries/science/astronomy/indilib/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "indilib";
-  version = "1.9.3";
+  version = "1.9.4";

  src = fetchFromGitHub {
    owner = "indilib";
    repo = "indi";
    rev = "v${version}";
-    sha256 = "sha256-Ik62kbOetA2vSMpnwrSiNRNJqOgmqlCB2+KNhpBo9TA=";
+    sha256 = "sha256-U3Q0WUEDRn0zfBIdHXFp5Zcaf+M6HrSFnpeu5aAkjks=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/science/math/lcalc/default.nix
+++ b/pkgs/development/libraries/science/math/lcalc/default.nix
@ -1,94 +1,38 @@
 { lib, stdenv
-, fetchurl
-, fetchpatch
+, autoreconfHook
+, gengetopt
+, pkg-config
+, fetchFromGitLab
 , pari
 }:

 stdenv.mkDerivation rec {
-  version = "1.23";
+  version = "2.0.5";
  pname = "lcalc";

-  src = fetchurl {
-    # original at http://oto.math.uwaterloo.ca/~mrubinst/L_function_public/CODE/L-${version}.tar.gz, no longer available
-    # "newer" version at google code https://code.google.com/archive/p/l-calc/source/default/source
-    url = "mirror://sageupstream/lcalc/lcalc-${version}.tar.bz2";
-    sha256 = "1c6dsdshgxhqppjxvxhp8yhpxaqvnz3d1mlh26r571gkq8z2bm43";
+  src = fetchFromGitLab {
+    owner = "sagemath";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-RxWZ7T0I9zV7jUVnL6jV/PxEoU32KY7Q1UsOL5Lonuc=";
  };

-  preConfigure = "cd src";
+  nativeBuildInputs = [
+    autoreconfHook
+    gengetopt
+    pkg-config
+  ];

  buildInputs = [
    pari
  ];

-  patches = [
-    # Port to newer pari
-    (fetchpatch {
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/lcalc/patches/pari-2.7.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
-      sha256 = "1x3aslldm8njjm7p9g9s9w2c91kphnci2vpkxkrcxfihw3ayss6c";
-    })
-
-    # Uncomment the definition of lcalc_to_double(const long double& x).
-    # (Necessary for GCC >= 4.6.0, cf. https://trac.sagemath.org/ticket/10892)
-    (fetchpatch {
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/lcalc/patches/Lcommon.h.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
-      sha256 = "0g4ybvsrcv48rmlh1xjnkms19jp25k58azv6ds1f2cm34hxs8fdx";
-    })
-
-    # Include also <time.h> in Lcommandline_numbertheory.h (at least required
-    # on Cygwin, cf. https://trac.sagemath.org/ticket/9845)
-    (fetchpatch {
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/lcalc/patches/time.h.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
-      sha256 = "1brf04n11kkc43ylagf8dm32j5r2g9zv51dp5wag1mpm4p04l7cl";
-    })
-
-    # Fix for gcc >4.6
-    (fetchpatch {
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/lcalc/patches/lcalc-1.23_default_parameters_1.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
-      sha256 = "0i2yvxm5fx4z0v6m4srgh8rj98kijmlvyirlxf1ky0bp2si6bpka";
-    })
-
-    # gcc 5.1
-    (fetchpatch {
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/lcalc/patches/lcalc-1.23_default_parameters_2.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
-      sha256 = "0dqwmxpm9wb53qbypsyfkgsvk2f8nf67sydphd4dkc2vw4yz6vlh";
-    })
-
-    # based on gentoos makefile patch -- fix paths, adhere to flags
-    ./makefile.patch
-
-    # (fetchpatch {
-    #   name = "default-double.patch";
-    #   url = "https://github.com/dimpase/lcalc/pull/1/commits/0500c67b6aa1f492715591669f6647c8f7a3ea59.patch";
-    #   sha256 = "0dqwmxpm9wb53qbypsyfkgsvk2f8nf67sydphd4dkc2vw4yz6vla";
-    # })
-
-    (fetchpatch {
-      name = "c++11.patch";
-      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/3607b97df5a8c231191115b0cb5c62426b339e71/trunk/lcalc-c++11.patch";
-      sha256 = "1ccrl61lv2vvx8ggldq54m5d0n1iy6mym7qz0i8nj6yj0dshnpk3";
-    })
-  ] ++ lib.optional stdenv.isDarwin
-  (fetchpatch {
-    url = "https://git.sagemath.org/sage.git/plain/build/pkgs/lcalc/patches/clang.patch";
-    sha256 = "0bb7656z6cp6i4p2qj745cmq0lhh52v2akl9whi760dynfdxbl18";
-  });
-
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace src/Makefile --replace g++ c++
-  '';
-
-  installFlags = [
-    "DESTDIR=$(out)"
-  ];
-
-  makeFlags = [
-    "PARI_DEFINE=-DINCLUDE_PARI"
-    "PARI_PREFIX=${pari}"
+  configureFlags = [
+    "--with-pari"
  ];

  meta = with lib; {
-    homepage = "http://oto.math.uwaterloo.ca/~mrubinst/L_function_public/L.html";
+    homepage = "https://gitlab.com/sagemath/lcalc";
    description = "A program for calculating with L-functions";
    license = with licenses; [ gpl2 ];
    maintainers = teams.sage.members;
--- a/pkgs/development/libraries/science/math/lcalc/makefile.patch
+++ b/pkgs/development/libraries/science/math/lcalc/makefile.patch
@ -1,113 +0,0 @@
-diff --git a/src/Makefile b/src/Makefile
-index 84e4e88..56ca676 100644
--- a/src/Makefile
-+++ b/src/Makefile
-@@ -58,7 +58,7 @@ ifeq ($(G5),TRUE)
-    #MACHINE_SPECIFIC_FLAGS = -mpowerpc -mpowerpc64 -m64
- endif
- 
-CCFLAGS =  -Wa,-W -O3 $(OPENMP_FLAG) -Wno-deprecated $(PREPROCESSOR_DEFINE) $(MACHINE_SPECIFIC_FLAGS) $(EXTRA)
-+CCFLAGS = $(CXXFLAGS) $(OPENMP_FLAG) $(PREPROCESSOR_DEFINE) $(MACHINE_SPECIFIC_FLAGS)
- #CCFLAGS =  -Wa,-W -O3 $(OPENMP_FLAG)  $(PREPROCESSOR_DEFINE) $(MACHINE_SPECIFIC_FLAGS) $(EXTRA)
- #CCFLAGS =  -Wa,-W -O2 -fno-exceptions -Wno-deprecated $(PREPROCESSOR_DEFINE) $(MACHINE_SPECIFIC_FLAGS) $(EXTRA)
- 
-@@ -68,12 +68,12 @@ CCFLAGS =  -Wa,-W -O3 $(OPENMP_FLAG) -Wno-deprecated $(PREPROCESSOR_DEFINE) $(MA
- 
- ifeq ($(PARI_DEFINE),-DINCLUDE_PARI)
-     #location of pari.h.
-    LOCATION_PARI_H = /usr/local/include/pari #usual location
-+    LOCATION_PARI_H = $(PARI_PREFIX)/include/pari #usual location
- 
-     #location of libpari.a or of libpari.so
-     #depending on whether static or dynamic libraries are being used.
-     #On mac os x it's the former, on linux I think usually the latter.
-    LOCATION_PARI_LIBRARY = /usr/local/lib #usual location
-+    LOCATION_PARI_LIBRARY = $(PARI_PREFIX)/lib #usual location
- else
-     #supplied as a dummy so as to avoid more ifeq's below
-     LOCATION_PARI_H = .
-@@ -89,24 +89,24 @@ INCLUDEFILES= -I../include
- 
- ifeq ($(OS_NAME),Darwin)
-     LDFLAGS2 =
-    DYN_OPTION=dynamiclib
-+    DYN_OPTION=-dynamiclib
- else
-    LDFLAGS1 = -Xlinker -export-dynamic #not sure why pari calls these when linking but on the web I found
-+    LDFLAGS1 = #not sure why pari calls these when linking but on the web I found
-     #'Libtool provides the `-export-dynamic' link flag (see section Link mode), which does this declaration.
-     #You need to use this flag if you are linking a shared library that will be dlopened'
-     #see notes below
-     #ifeq ($(PARI_DEFINE),-DINCLUDE_PARI)
-       LDFLAGS2 = $(LDFLAGS1) -Xlinker -rpath -Xlinker $(LOCATION_PARI_LIBRARY)
-+       LDFLAGS2 = $(LDFLAGS)
-     #else
-     #    LDFLAGS2 = $(LDFLAGS1)
-     #endif
-    DYN_OPTION=shared
-+    DYN_OPTION=$(LDFLAGS) -shared -Wl,-soname,libLfunction.so
- endif
- 
- ifeq ($(PARI_DEFINE),-DINCLUDE_PARI)
-    LDFLAGS = $(LDFLAGS2) -L$(LOCATION_PARI_LIBRARY) -lpari
-+    MYLDFLAGS = $(LDFLAGS2) -L$(LOCATION_PARI_LIBRARY) -lpari
- else
-    LDFLAGS = $(LDFLAGS2)
-+    MYLDFLAGS = $(LDFLAGS2)
- endif
- 
- 
-@@ -129,7 +129,8 @@ endif
- #become clear which libraries the computer can find.
- 
- 
-INSTALL_DIR= /usr/local
-+INSTALL_DIR= $(DESTDIR)
-+LIB_DIR ?=lib
- 
- #object files for the libLfunction library
- OBJ_L = Lglobals.o Lgamma.o Lriemannsiegel.o Lriemannsiegel_blfi.o Ldokchitser.o
-@@ -141,9 +142,8 @@ OBJECTS = $(OBJ3)
- 
- all:
- #	make print_vars
-	make libLfunction.so
-	make lcalc
-	make examples
-+	${MAKE} libLfunction.so
-+	${MAKE} lcalc
- #	make find_L
- #	make test
- 
-@@ -151,7 +151,7 @@ print_vars:
- 	@echo OS_NAME = $(OS_NAME)
- 
- lcalc: $(OBJECTS)
-	$(CC) $(CCFLAGS) $(INCLUDEFILES) $(OBJECTS) $(LDFLAGS) -o lcalc $(GMP_FLAGS)
-+	$(CC) $(CCFLAGS) $(INCLUDEFILES) $(OBJECTS) $(MYLDFLAGS) -o lcalc $(GMP_FLAGS)
- 
- examples:
- 	$(CC) $(CCFLAGS) $(INCLUDEFILES) example_programs/example.cc libLfunction.so -o example_programs/example $(GMP_FLAGS)
-@@ -262,15 +262,18 @@ Lcommandline.o: ../include/Lcommandline_values_zeros.h
- 
- 
- libLfunction.so: $(OBJ_L)
-	g++ -$(DYN_OPTION)  -o libLfunction.so $(OBJ_L)
-+	g++ $(DYN_OPTION) -o libLfunction.so $(OBJ_L)
- 
- clean:
- 	rm -f *.o lcalc libLfunction.so example_programs/example
- 
- install:
-	cp -f lcalc $(INSTALL_DIR)/bin/.
-	cp -f libLfunction.so $(INSTALL_DIR)/lib/.
-	cp -rf ../include $(INSTALL_DIR)/include/Lfunction
-+	install -d $(INSTALL_DIR)/bin
-+	install -d $(INSTALL_DIR)/$(LIB_DIR)
-+	install -d $(INSTALL_DIR)/include/Lfunction
-+	install lcalc $(INSTALL_DIR)/bin
-+	install libLfunction.so $(INSTALL_DIR)/$(LIB_DIR)
-+	install -m 644 -t $(INSTALL_DIR)/include/Lfunction ../include/*.h
- 
- 
- SRCS = Lcommandline.cc Lcommandline_elliptic.cc Lcommandline_globals.cc Lcommandline_misc.cc Lcommandline_numbertheory.cc Lcommandline_twist.cc Lcommandline_values_zeros.cc Lgamma.cc Lglobals.cc Lmisc.cc Lriemannsiegel.cc Lriemannsiegel_blfi.cc cmdline.c
--- a/pkgs/development/libraries/science/math/primecount/default.nix
+++ b/pkgs/development/libraries/science/math/primecount/default.nix
@ -15,6 +15,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-/Cb/HkD4UQ9gXsRpvRiEuQBoRd0THxNHsBaAAa+CqQo=";
  };

+  cmakeFlags = [
+    "-DBUILD_STATIC_LIBS=OFF"
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DBUILD_TESTS=ON"
+    "-DBUILD_PRIMECOUNT=ON"
+    "-DBUILD_LIBPRIMESIEVE=ON"
+  ];
+
  meta = with lib; {
    description = "Fast prime counting function implementations";
    homepage = "https://github.com/kimwalisch/primecount";
--- a/pkgs/development/libraries/smarty3/default.nix
+++ b/pkgs/development/libraries/smarty3/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "smarty3";
-  version = "3.1.39";
+  version = "3.1.44";

  src = fetchFromGitHub {
    owner = "smarty-php";
    repo = "smarty";
    rev = "v${version}";
-    sha256 = "0n5hmnw66gxqikp6frgfd9ywsvr2azyg5nl7ix89digqlzcljkbg";
+    sha256 = "sha256-9a9OC18jyFpmFXffYOYHZ0j01j4NCF5zwrSYr1fZwqo=";
  };

  installPhase = ''
--- a/pkgs/development/libraries/soci/default.nix
+++ b/pkgs/development/libraries/soci/default.nix
@ -1,5 +1,6 @@
 { cmake
 , fetchFromGitHub
+, fetchpatch
 , sqlite
 , postgresql
 , boost
@ -17,6 +18,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-NE0ApbX8HG2VAQ9cg9+kX3kJQ4PR1XvWL9BlT8NphmE=";
  };

+  patches = [
+    (fetchpatch {
+      name = "fix-backend-search-path.patch";
+      url = "https://github.com/SOCI/soci/commit/56c93afc467bdba8ffbe68739eea76059ea62f7a.patch";
+      sha256 = "sha256-nC/39pn3Cv5e65GgIfF3l64/AbCsfZHPUPIWETZFZAY=";
+    })
+  ];
+
  # Do not build static libraries
  cmakeFlags = [ "-DSOCI_STATIC=OFF" "-DCMAKE_CXX_STANDARD=11" ];

--- a/pkgs/development/libraries/sofia-sip/default.nix
+++ b/pkgs/development/libraries/sofia-sip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "sofia-sip";
-  version = "1.13.6";
+  version = "1.13.7";

  src = fetchFromGitHub {
    owner = "freeswitch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0b1gq499ksgsi16f5nf3dzbj6s8knwkiak5j810jzdfm7vkm0vvm";
+    sha256 = "sha256-gBejwt5YAkCKQh0vzN00J4y1ifcdc4TglA+SqEevaGQ=";
  };

  buildInputs = [ glib openssl ] ++ lib.optional stdenv.isDarwin SystemConfiguration;
--- a/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh
+++ b/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh
@ -51,7 +51,7 @@ url="${ql_src##* }"
 [ "$ql_src_type" = github ] && {
  ql_src_type=git
  url="https://github.com/$url";
-  version="$("$(dirname "$0")/../../../build-support/upstream-updater/urls-from-page.sh" "$url/releases/" | grep /tag/ | head -n 1 | xargs -l1 basename)"
+  version="$("$(dirname "$0")/urls-from-page.sh" "$url/releases/" | grep /tag/ | head -n 1 | xargs -l1 basename)"
  rev="refs/tags/$version";
 }

@ -62,7 +62,7 @@ url="${ql_src##* }"
    ) && {
    url="${url/git:/https:}"
    url="${url%.git}"
-    [ -z "$rev" ] && rev=$("$(dirname "$0")/../../../build-support/upstream-updater/urls-from-page.sh" "$url/commits" | grep /commit/ | head -n 1 | xargs basename)
+    [ -z "$rev" ] && rev=$("$(dirname "$0")/urls-from-page.sh" "$url/commits" | grep /commit/ | head -n 1 | xargs basename)
    hash=$("$(dirname "$0")/../../../build-support/fetchgit/nix-prefetch-git" "$url" "$rev" | grep . | tail -n 1)
    [ -z "$version" ] && version="git-$(date +%Y%m%d)";
  }
@ -131,7 +131,7 @@ url="${ql_src##* }"

 [ "$ql_src_type" = froydware-http ] && {
  dirurl="http://method-combination.net/lisp/files/";
-  url="$("$(dirname "$0")/../../../build-support/upstream-updater/urls-from-page.sh" "$dirurl" |
+  url="$("$(dirname "$0")/urls-from-page.sh" "$dirurl" |
    grep "/${url}_" | grep -v "[.]asc\$" | tail -n 1)"
  ql_src_type=http
 }
--- a/pkgs/development/lisp-modules/from-quicklisp/urls-from-page.sh
+++ b/pkgs/development/lisp-modules/from-quicklisp/urls-from-page.sh
@ -6,7 +6,7 @@ path="${url#$protocol://}"
 server="${path%%/*}"
 basepath="${path%/*}"
 relpath="${path#$server}"
- 
+
 echo "URL: $url" >&2

 curl -A 'text/html; text/xhtml; text/xml; */*' -L -k "$url" | sed -re 's/^/-/;s/[^a-zA-Z][hH][rR][eE][fF]=("([^"]*)"|'\''([^'\'']*)'\''|([^"'\'' <>&]+)[ <>&])/\n+\2\3\4\n-/g' | \
--- a/pkgs/development/python-modules/afsapi/default.nix
+++ b/pkgs/development/python-modules/afsapi/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "afsapi";
-  version = "0.2.1";
+  version = "0.2.2";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "wlcrs";
    repo = "python-afsapi";
    rev = version;
-    hash = "sha256-LBK32CwiYEa+R5VhcpVzMYklPAgombxl05rM/KWRyIU=";
+    hash = "sha256-C4rxlkylWGsDsnMPuecrC2ELj1PvP6EelZ/kzTn4Brk=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/breathe/default.nix
+++ b/pkgs/development/python-modules/breathe/default.nix
@ -1,24 +1,44 @@
-{ lib, fetchPypi, buildPythonPackage, docutils, six, sphinx, isPy3k, isPy27 }:
+{ lib
+, buildPythonPackage
+, docutils
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, sphinx
+}:

 buildPythonPackage rec {
-  version = "4.31.0";
  pname = "breathe";
-  disabled = isPy27;
+  version = "4.32.0";
+  format = "setuptools";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "925eeff96c6640cd857e4ddeae6f75464a1d5e2e08ee56dccce4043583ae2050";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "michaeljones";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-U85iLVS6bmA2Ty0AC4z2qODy9u4rWg6Nb42/k2Ix+kk=";
  };

-  propagatedBuildInputs = [ docutils six sphinx ];
+  propagatedBuildInputs = [
+    docutils
+    sphinx
+  ];

-  doCheck = !isPy3k;
+  checkInputs = [
+    pytestCheckHook
+  ];

-  meta = {
-    homepage = "https://github.com/michaeljones/breathe";
-    license = lib.licenses.bsd3;
+  pythonImportsCheck = [
+    "breathe"
+  ];
+
+  meta = with lib; {
    description = "Sphinx Doxygen renderer";
+    homepage = "https://github.com/michaeljones/breathe";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
    inherit (sphinx.meta) platforms;
  };
 }
-
--- a/pkgs/development/python-modules/django_reversion/default.nix
+++ b/pkgs/development/python-modules/django_reversion/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "django-reversion";
-  version = "4.0.1";
+  version = "4.0.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "6991f16e5d3a972912db3d56e3a714d10b07becd566ab87f85f2e9b671981339";
+    sha256 = "sha256-XTO6lE2/GccDDJ5w43MSSK40Nozyr+3hDg0I+/ieb4w=";
  };

  # tests assume the availability of a mysql/postgresql database
--- a/pkgs/development/python-modules/environs/default.nix
+++ b/pkgs/development/python-modules/environs/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "environs";
-  version = "9.4.0";
+  version = "9.5.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "sloria";
    repo = pname;
    rev = version;
-    sha256 = "sha256-LPD46kxzQ/oTC7XjJn/SXaLQgX613ZoCrJuaRng57Gw=";
+    sha256 = "sha256-hucApIn7ul7+MC2W811VTxZNO8Pqb6HDXz9VRcEdmIc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/exchangelib/default.nix
+++ b/pkgs/development/python-modules/exchangelib/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "exchangelib";
-  version = "4.7.1";
+  version = "4.7.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "ecederstrand";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1kwb5ixlmxg0xxm4wms5r4kym220vbncr9afi9qc25g8npkbs860";
+    sha256 = "sha256-fdYc+fJEePgCzAkUWz7pmL/CI/O9zm5G9xh1f4bhrH4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/flask-paginate/default.nix
+++ b/pkgs/development/python-modules/flask-paginate/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "flask-paginate";
-  version = "2021.12.28";
+  version = "2022.1.8";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "c722a25067d722483e24cde16ed987a822292ca758a213299e445694d2b5b587";
+    sha256 = "a32996ec07ca004c45b768b0d50829728ab8f3986c0650ef538e42852c7aeba2";
  };

  propagatedBuildInputs = [ flask ];
--- a/Show more
+++ b/Show more