Merge staging-next into staging

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -100,6 +100,25 @@
           Notes</link> for details.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          LXD support was greatly improved:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              building LXD images from configurations is now directly
+              possible with just nixpkgs
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              hydra is now building nixOS LXD images that can be used
+              standalone with full nixos-rebuild support
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-new-services">

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -35,6 +35,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - GNOME has been upgraded to 41. Please take a look at their [Release Notes](https://help.gnome.org/misc/release-notes/41.0/) for details.
 
+- LXD support was greatly improved:
+  - building LXD images from configurations is now directly possible with just nixpkgs
+  - hydra is now building nixOS LXD images that can be used standalone with full nixos-rebuild support
+
 ## New Services {#sec-release-21.11-new-services}
 
 - [btrbk](https://digint.ch/btrbk/index.html), a backup tool for btrfs subvolumes, taking advantage of btrfs specific capabilities to create atomic snapshots and transfer them incrementally to your backup locations. Available as [services.btrbk](options.html#opt-services.brtbk.instances).

nixos/maintainers/scripts/lxd/lxd-image-inner.nix

@@ -0,0 +1,102 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+{
+  imports =
+    [ # Include the default lxd configuration.
+      ../../../modules/virtualisation/lxc-container.nix
+      # Include the container-specific autogenerated configuration.
+      ./lxd.nix
+    ];
+
+  # networking.hostName = mkForce "nixos"; # Overwrite the hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Set your time zone.
+  # time.timeZone = "Europe/Amsterdam";
+
+  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+  # Per-interface useDHCP will be mandatory in the future, so this generated config
+  # replicates the default behaviour.
+  networking.useDHCP = false;
+  networking.interfaces.eth0.useDHCP = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+  # Configure keymap in X11
+  # services.xserver.layout = "us";
+  # services.xserver.xkbOptions = "eurosign:e";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # sound.enable = true;
+  # hardware.pulseaudio.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # users.users.jane = {
+  #   isNormalUser = true;
+  #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+  # };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  # environment.systemPackages = with pkgs; [
+  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #   wget
+  #   firefox
+  # ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.05"; # Did you read the comment?
+
+  # As this is intended as a stadalone image, undo some of the minimal profile stuff
+  documentation.enable = true;
+  documentation.nixos.enable = true;
+  environment.noXlibs = false;
+}

nixos/maintainers/scripts/lxd/lxd-image.nix

@@ -0,0 +1,34 @@
+{ lib, config, pkgs, ... }:
+
+with lib;
+
+{
+  imports = [
+    ../../../modules/virtualisation/lxc-container.nix
+  ];
+
+  virtualisation.lxc.templates.nix = {
+    enable = true;
+    target = "/etc/nixos/lxd.nix";
+    template = ./nix.tpl;
+    when = [ "create" "copy" ];
+  };
+
+  # copy the config for nixos-rebuild
+  system.activationScripts.config = ''
+    if [ ! -e /etc/nixos/configuration.nix ]; then
+      mkdir -p /etc/nixos
+      cat ${./lxd-image-inner.nix} > /etc/nixos/configuration.nix
+      sed 's|../../../modules/virtualisation/lxc-container.nix|<nixpkgs/nixos/modules/virtualisation/lxc-container.nix>|g' -i /etc/nixos/configuration.nix
+    fi
+  '';
+
+  # Network
+  networking.useDHCP = false;
+  networking.interfaces.eth0.useDHCP = true;
+
+  # As this is intended as a stadalone image, undo some of the minimal profile stuff
+  documentation.enable = true;
+  documentation.nixos.enable = true;
+  environment.noXlibs = false;
+}

nixos/maintainers/scripts/lxd/nix.tpl

@@ -0,0 +1,9 @@
+{ lib, config, pkgs, ... }:
+
+with lib;
+
+# WARNING: THIS CONFIGURATION IS AUTOGENERATED AND WILL BE OVERWRITTEN AUTOMATICALLY
+
+{
+  networking.hostName = "{{ container.name }}";
+}

nixos/modules/services/finance/odoo.nix

@@ -22,14 +22,14 @@ in
         type = with types; listOf package;
         default = [];
         example = literalExpression "[ pkgs.odoo_enterprise ]";
-        description = "Odoo addons";
+        description = "Odoo addons.";
       };
 
       settings = mkOption {
         type = format.type;
         default = {};
         description = ''
-          Odoo configuration settings. For more details see https://www.odoo.com/documentation/15.0/administration/install/deploy.html
+          Odoo configuration settings. For more details see <link xlink:href="https://www.odoo.com/documentation/15.0/administration/install/deploy.html"/>
         '';
       };
 

nixos/modules/services/monitoring/unifi-poller.nix

@@ -6,7 +6,7 @@ let
   cfg = config.services.unifi-poller;
 
   configFile = pkgs.writeText "unifi-poller.json" (generators.toJSON {} {
-    inherit (cfg) poller influxdb prometheus unifi;
+    inherit (cfg) poller influxdb loki prometheus unifi;
   });
 
 in {
@@ -118,6 +118,61 @@ in {
       };
     };
 
+    loki = {
+      url = mkOption {
+        type = types.str;
+        default = "";
+        description = ''
+          URL of the Loki host.
+        '';
+      };
+      user = mkOption {
+        type = types.str;
+        default = "";
+        description = ''
+          Username for Loki.
+        '';
+      };
+      pass = mkOption {
+        type = types.path;
+        default = pkgs.writeText "unifi-poller-loki-default.password" "";
+        defaultText = "unifi-poller-influxdb-default.password";
+        description = ''
+          Path of a file containing the password for Loki.
+          This file needs to be readable by the unifi-poller user.
+        '';
+        apply = v: "file://${v}";
+      };
+      verify_ssl = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Verify Loki's certificate.
+        '';
+      };
+      tenant_id = mkOption {
+        type = types.str;
+        default = "";
+        description = ''
+          Tenant ID to use in Loki.
+        '';
+      };
+      interval = mkOption {
+        type = types.str;
+        default = "2m";
+        description = ''
+          How often the events are polled and pushed to Loki.
+        '';
+      };
+      timeout = mkOption {
+        type = types.str;
+        default = "10s";
+        description = ''
+          Should be increased in case of timeout errors.
+        '';
+      };
+    };
+
     unifi = let
       controllerOptions = {
         user = mkOption {
@@ -157,7 +212,28 @@ in {
           type = types.bool;
           default = false;
           description = ''
-            Collect and save data from the intrusion detection system to influxdb.
+            Collect and save data from the intrusion detection system to influxdb and Loki.
+          '';
+        };
+        save_events = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Collect and save data from UniFi events to influxdb and Loki.
+          '';
+        };
+        save_alarms = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Collect and save data from UniFi alarms to influxdb and Loki.
+          '';
+        };
+        save_anomalies = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Collect and save data from UniFi anomalies to influxdb and Loki.
           '';
         };
         save_dpi = mkOption {

nixos/modules/system/boot/systemd.nix

@@ -42,7 +42,7 @@ let
       "systemd-udevd-kernel.socket"
       "systemd-udevd.service"
       "systemd-udev-settle.service"
-      "systemd-udev-trigger.service"
+      ] ++ (optional (!config.boot.isContainer) "systemd-udev-trigger.service") ++ [
       # hwdb.bin is managed by NixOS
       # "systemd-hwdb-update.service"
 

nixos/modules/tasks/filesystems/zfs.nix

@@ -561,7 +561,8 @@ in
                                   then cfgZfs.requestEncryptionCredentials
                                   else cfgZfs.requestEncryptionCredentials != []) ''
                   ${cfgZfs.package}/sbin/zfs list -rHo name,keylocation ${pool} | while IFS=$'\t' read ds kl; do
-                    (${optionalString (!isBool cfgZfs.requestEncryptionCredentials) ''
+                    {
+                      ${optionalString (!isBool cfgZfs.requestEncryptionCredentials) ''
                          if ! echo '${concatStringsSep "\n" cfgZfs.requestEncryptionCredentials}' | grep -qFx "$ds"; then
                            continue
                          fi
@@ -575,7 +576,8 @@ in
                       * )
                         ${cfgZfs.package}/sbin/zfs load-key "$ds"
                         ;;
-                    esac) < /dev/null # To protect while read ds kl in case anything reads stdin
+                    esac
+                    } < /dev/null # To protect while read ds kl in case anything reads stdin
                   done
                 ''}
                 echo "Successfully imported ${pool}"

nixos/modules/virtualisation/lxc-container.nix

@@ -1,26 +1,174 @@
-{ lib, ... }:
+{ lib, config, pkgs, ... }:
 
 with lib;
 
+let
+  templateSubmodule = { ... }: {
+    options = {
+      enable = mkEnableOption "this template";
+
+      target = mkOption {
+        description = "Path in the container";
+        type = types.path;
+      };
+      template = mkOption {
+        description = ".tpl file for rendering the target";
+        type = types.path;
+      };
+      when = mkOption {
+        description = "Events which trigger a rewrite (create, copy)";
+        type = types.listOf (types.str);
+      };
+      properties = mkOption {
+        description = "Additional properties";
+        type = types.attrs;
+        default = {};
+      };
+    };
+  };
+
+  toYAML = name: data: pkgs.writeText name (generators.toYAML {} data);
+
+  cfg = config.virtualisation.lxc;
+  templates = if cfg.templates != {} then let
+    list = mapAttrsToList (name: value: { inherit name; } // value)
+      (filterAttrs (name: value: value.enable) cfg.templates);
+  in
+    {
+      files = map (tpl: {
+        source = tpl.template;
+        target = "/templates/${tpl.name}.tpl";
+      }) list;
+      properties = listToAttrs (map (tpl: nameValuePair tpl.target {
+        when = tpl.when;
+        template = "${tpl.name}.tpl";
+        properties = tpl.properties;
+      }) list);
+    }
+  else { files = []; properties = {}; };
+
+in
 {
   imports = [
-    ../profiles/docker-container.nix # FIXME, shouldn't include something from profiles/
+    ../installer/cd-dvd/channel.nix
+    ../profiles/minimal.nix
+    ../profiles/clone-config.nix
   ];
 
-  # Allow the user to login as root without password.
-  users.users.root.initialHashedPassword = mkOverride 150 "";
+  options = {
+    virtualisation.lxc = {
+      templates = mkOption {
+        description = "Templates for LXD";
+        type = types.attrsOf (types.submodule (templateSubmodule));
+        default = {};
+        example = literalExample ''
+          {
+            # create /etc/hostname on container creation
+            "hostname" = {
+              enable = true;
+              target = "/etc/hostname";
+              template = builtins.writeFile "hostname.tpl" "{{ container.name }}";
+              when = [ "create" ];
+            };
+            # create /etc/nixos/hostname.nix with a configuration for keeping the hostname applied
+            "hostname-nix" = {
+              enable = true;
+              target = "/etc/nixos/hostname.nix";
+              template = builtins.writeFile "hostname-nix.tpl" "{ ... }: { networking.hostName = "{{ container.name }}"; }";
+              # copy keeps the file updated when the container is changed
+              when = [ "create" "copy" ];
+            };
+            # copy allow the user to specify a custom configuration.nix
+            "configuration-nix" = {
+              enable = true;
+              target = "/etc/nixos/configuration.nix";
+              template = builtins.writeFile "configuration-nix" "{{ config_get(\"user.user-data\", properties.default) }}";
+              when = [ "create" ];
+            };
+          };
+        '';
+      };
+    };
+  };
 
-  # Some more help text.
-  services.getty.helpLine =
-    ''
+  config = {
+    boot.isContainer = true;
+    boot.postBootCommands =
+      ''
+        # After booting, register the contents of the Nix store in the Nix
+        # database.
+        if [ -f /nix-path-registration ]; then
+          ${config.nix.package.out}/bin/nix-store --load-db < /nix-path-registration &&
+          rm /nix-path-registration
+        fi
 
-      Log in as "root" with an empty password.
+        # nixos-rebuild also requires a "system" profile
+        ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
+      '';
+
+    system.build.metadata = pkgs.callPackage ../../lib/make-system-tarball.nix {
+      contents = [
+        {
+          source = toYAML "metadata.yaml" {
+            architecture = builtins.elemAt (builtins.match "^([a-z0-9_]+).+" (toString pkgs.system)) 0;
+            creation_date = 1;
+            properties = {
+              description = "NixOS ${config.system.nixos.codeName} ${config.system.nixos.label} ${pkgs.system}";
+              os = "nixos";
+              release = "${config.system.nixos.codeName}";
+            };
+            templates = templates.properties;
+          };
+          target = "/metadata.yaml";
+        }
+      ] ++ templates.files;
+    };
+
+    # TODO: build rootfs as squashfs for faster unpack
+    system.build.tarball = pkgs.callPackage ../../lib/make-system-tarball.nix {
+      extraArgs = "--owner=0";
+
+      storeContents = [
+        {
+          object = config.system.build.toplevel;
+          symlink = "none";
+        }
+      ];
+
+      contents = [
+        {
+          source = config.system.build.toplevel + "/init";
+          target = "/sbin/init";
+        }
+      ];
+
+      extraCommands = "mkdir -p proc sys dev";
+    };
+
+    # Add the overrides from lxd distrobuilder
+    systemd.extraConfig = ''
+      [Service]
+      ProtectProc=default
+      ProtectControlGroups=no
+      ProtectKernelTunables=no
     '';
 
-  # Containers should be light-weight, so start sshd on demand.
-  services.openssh.enable = mkDefault true;
-  services.openssh.startWhenNeeded = mkDefault true;
+    # Allow the user to login as root without password.
+    users.users.root.initialHashedPassword = mkOverride 150 "";
 
-  # Allow ssh connections
-  networking.firewall.allowedTCPPorts = [ 22 ];
+    system.activationScripts.installInitScript = mkForce ''
+      ln -fs $systemConfig/init /sbin/init
+    '';
+
+    # Some more help text.
+    services.getty.helpLine =
+      ''
+
+        Log in as "root" with an empty password.
+      '';
+
+    # Containers should be light-weight, so start sshd on demand.
+    services.openssh.enable = mkDefault true;
+    services.openssh.startWhenNeeded = mkDefault true;
+  };
 }

nixos/modules/virtualisation/lxd.nix

@@ -34,7 +34,7 @@ in {
 
       package = mkOption {
         type = types.package;
-        default = pkgs.lxd.override { nftablesSupport = config.networking.nftables.enable; };
+        default = pkgs.lxd;
         defaultText = literalExpression "pkgs.lxd";
         description = ''
           The LXD package to use.

nixos/release.nix

@@ -251,6 +251,37 @@ in rec {
 
   );
 
+  # An image that can be imported into lxd and used for container creation
+  lxdImage = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system:
+
+    with import ./.. { inherit system; };
+
+    hydraJob ((import lib/eval-config.nix {
+      inherit system;
+      modules =
+        [ configuration
+          versionModule
+          ./maintainers/scripts/lxd/lxd-image.nix
+        ];
+    }).config.system.build.tarball)
+
+  );
+
+  # Metadata for the lxd image
+  lxdMeta = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system:
+
+    with import ./.. { inherit system; };
+
+    hydraJob ((import lib/eval-config.nix {
+      inherit system;
+      modules =
+        [ configuration
+          versionModule
+          ./maintainers/scripts/lxd/lxd-image.nix
+        ];
+    }).config.system.build.metadata)
+
+  );
 
   # Ensure that all packages used by the minimal NixOS config end up in the channel.
   dummy = forAllSystems (system: pkgs.runCommand "dummy"

nixos/tests/all-tests.nix

@@ -237,6 +237,7 @@ in
   login = handleTest ./login.nix {};
   loki = handleTest ./loki.nix {};
   lxd = handleTest ./lxd.nix {};
+  lxd-image = handleTest ./lxd-image.nix {};
   lxd-nftables = handleTest ./lxd-nftables.nix {};
   #logstash = handleTest ./logstash.nix {};
   lorri = handleTest ./lorri/default.nix {};

nixos/tests/lxd-image.nix

@@ -0,0 +1,91 @@
+# This test ensures that the nixOS lxd images builds and functions properly
+# It has been extracted from `lxd.nix` to seperate failures of just the image and the lxd software
+
+import ./make-test-python.nix ({ pkgs, ...} : let
+  release = import ../release.nix {
+    /* configuration = {
+      environment.systemPackages = with pkgs; [ stdenv ]; # inject stdenv so rebuild test works
+    }; */
+  };
+
+  metadata = release.lxdMeta.${pkgs.system};
+  image = release.lxdImage.${pkgs.system};
+
+  lxd-config = pkgs.writeText "config.yaml" ''
+    storage_pools:
+      - name: default
+        driver: dir
+        config:
+          source: /var/lxd-pool
+
+    networks:
+      - name: lxdbr0
+        type: bridge
+        config:
+          ipv4.address: auto
+          ipv6.address: none
+
+    profiles:
+      - name: default
+        devices:
+          eth0:
+            name: eth0
+            network: lxdbr0
+            type: nic
+          root:
+            path: /
+            pool: default
+            type: disk
+  '';
+in {
+  name = "lxd-image";
+
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ mkg20001 ];
+  };
+
+  machine = { lib, ... }: {
+    virtualisation = {
+      # OOMs otherwise
+      memorySize = 1024;
+      # disk full otherwise
+      diskSize = 2048;
+
+      lxc.lxcfs.enable = true;
+      lxd.enable = true;
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("sockets.target")
+    machine.wait_for_unit("lxd.service")
+    machine.wait_for_file("/var/lib/lxd/unix.socket")
+
+    # It takes additional second for lxd to settle
+    machine.sleep(1)
+
+    # lxd expects the pool's directory to already exist
+    machine.succeed("mkdir /var/lxd-pool")
+
+    machine.succeed(
+        "cat ${lxd-config} | lxd init --preseed"
+    )
+
+    # TODO: test custom built container aswell
+
+    with subtest("importing container works"):
+        machine.succeed("lxc image import ${metadata}/*/*.tar.xz ${image}/*/*.tar.xz --alias nixos")
+
+    with subtest("launching container works"):
+        machine.succeed("lxc launch nixos machine -c security.nesting=true")
+        # make sure machine boots up properly
+        machine.sleep(5)
+
+    with subtest("container shell works"):
+        machine.succeed("echo true | lxc exec machine /run/current-system/sw/bin/bash -")
+        machine.succeed("lxc exec machine /run/current-system/sw/bin/true")
+
+    # with subtest("rebuilding works"):
+    #     machine.succeed("lxc exec machine /run/current-system/sw/bin/nixos-rebuild switch")
+  '';
+})

pkgs/applications/finance/odoo/default.nix

@@ -3,19 +3,12 @@
 , fetchurl
 , python3
 , python3Packages
+, nodePackages
 , wkhtmltopdf
 }:
 
 with python3Packages;
 
-/*
-
-TODO:
-  For languages with right-to-left interface (such as Arabic or Hebrew), the package rtlcss is needed:
-  $ sudo npm install -g rtlcss
-
-*/
-
 buildPythonApplication rec {
   pname = "odoo";
 
@@ -40,12 +33,13 @@ buildPythonApplication rec {
 
   buildInputs = [
     wkhtmltopdf
+    nodePackages.rtlcss
   ];
 
   # needs some investigation
   doCheck = false;
 
-  makeWrapperArgs = [ "--prefix" "PATH" ":" "${wkhtmltopdf}/bin" ];
+  makeWrapperArgs = [ "--prefix" "PATH" ":" "${lib.makeBinPath [ wkhtmltopdf nodePackages.rtlcss ]}" ];
 
   propagatedBuildInputs = [
     Babel

pkgs/applications/graphics/graphicsmagick/default.nix

@@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
     description = "Swiss army knife of image processing";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
+    mainProgram = "gm";
   };
 }

pkgs/applications/misc/barrier/default.nix

@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "barrier";
-  version = "2.3.3";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "debauchee";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11vqkzpcjiv3pq6ps022223j6skgm1d23dj18n4a5nsf53wsvvp4";
+    sha256 = "sha256-2tHqLF3zS3C4UnOVIZfpcuzaemC9++nC7lXgFnFSfKU=";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/seatd/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "seatd";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromSourcehut {
     owner = "~kennylevinsen";
     repo = "seatd";
     rev = version;
-    sha256 = "0c07i1nq0k60xmcsnr37ryqs7nzbg4qfq6fzbnzwbh1yhr8kypcm";
+    sha256 = "sha256-LLRGi3IACqaIHExLhALnUeiPyUnlhAJzsMFE2p+QSp4=";
   };
 
   outputs = [ "bin" "out" "dev" "man" ];

pkgs/applications/networking/cluster/k0sctl/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "k0sctl";
-  version = "0.10.4";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "k0sproject";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-22jZWRnymIYN1LlGOo8abVx8DTUe9VK1xAHddLknt6A=";
+    sha256 = "sha256-Fk1aYSa3LqzxiHtlzH5pcNtodOprjfnCFh4UMqCa6Rc=";
   };
 
   vendorSha256 = "sha256-N4cU9wzBRZn71mZHkNDXKgSXvlN2QFS6K4MtlR25DJc=";

pkgs/applications/networking/cluster/kubernetes/default.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kubernetes";
-  version = "1.22.2";
+  version = "1.22.3";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "sha256-O+FY9wJ0fztO7i5qJfw+cfhfBgaMWKX7IBBXJV4uuCk=";
+    sha256 = "sha256-yXis1nq36MO/RnYLxOYBs6xnaTf9lk+VJBzSamrHcEU=";
   };
 
   nativeBuildInputs = [ removeReferencesTo makeWrapper which go rsync installShellFiles ];

pkgs/applications/networking/instant-messengers/signal-cli/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.9.0";
+  version = "0.9.2";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    sha256 = "sha256-wk8kk+PG0nw2OE7mccGjP435SEytStRy1unxg6EqP/8=";
+    sha256 = "sha256-CumrIlOPmvQ3x7Ua5I2G7ZlTSAbhLgAQMPUg4I5WCeQ=";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];

pkgs/applications/networking/sync/rclone/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "rclone";
-  version = "1.56.2";
+  version = "1.57.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cEh1SgIOgX04ECEF0K2pvwJdugapoUzh8xbboRaMdTs=";
+    sha256 = "0pwbprbkx5y0c93b61k8znan4aimk7dkssapjhkhzw4c38xd4lza";
   };
 
-  vendorSha256 = "sha256-wQYVn8yGDIYlnlVTS7tiLEMwkNLF6p3OcY35nw1mvA8=";
+  vendorSha256 = "0353pff07lwpa1jmi095kb2izcw09z73x6nninnnpyqppwzas6ha";
 
   subPackages = [ "." ];
 

pkgs/applications/radio/sdrangel/default.nix

@@ -33,13 +33,13 @@
 
 mkDerivation rec {
   pname = "sdrangel";
-  version = "6.17.1";
+  version = "6.17.2";
 
   src = fetchFromGitHub {
     owner = "f4exb";
     repo = "sdrangel";
     rev = "v${version}";
-    sha256 = "sha256-VWHFrgJVyI3CtLXUiG3/4/cRTD8jSdunbrro34yLKvs=";
+    sha256 = "sha256-sMD2JTJJlssMdXCUHdFYjEqGknhGGuG4szfnvFFN7t4=";
     fetchSubmodules = false;
   };
 

pkgs/applications/science/biology/obitools/obitools3.nix

@@ -1,10 +1,6 @@
-{ lib, fetchurl, python3Packages, cmake, python3 }:
+{ stdenv, lib, fetchurl, python3Packages, cmake, python3 }:
 
-let
-  pythonPackages = python3Packages;
-in
-
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "obitools3";
   version = "3.0.1b11";
 
@@ -13,15 +9,20 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "1x7a0nrr9agg1pfgq8i1j8r1p6c0jpyxsv196ylix1dd2iivmas1";
   };
 
+  disabled = python3Packages.pythonOlder "3.5";
+
+  nativeBuildInputs = [ python3Packages.cython cmake ];
+
+  postPatch = lib.optionalString stdenv.isAarch64 ''
+      substituteInPlace setup.py \
+      --replace "'-msse2'," ""
+  '';
+
   preBuild = ''
     substituteInPlace src/CMakeLists.txt --replace \$'{PYTHONLIB}' "$out/lib/${python3.libPrefix}/site-packages";
     export NIX_CFLAGS_COMPILE="-L $out/lib/${python3.libPrefix}/site-packages $NIX_CFLAGS_COMPILE"
   '';
 
-  disabled = !pythonPackages.isPy3k;
-
-  nativeBuildInputs = [ pythonPackages.cython cmake ];
-
   dontConfigure = true;
 
   doCheck = true;

pkgs/applications/system/pantheon-tweaks/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pantheon-tweaks";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "pantheon-tweaks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-tAfDxX/RD7pO5PN/LaZ92Cj/iZtBI/EHb0+pORfYnPM=";
+    sha256 = "sha256-2spZ6RQ5PhBNrv/xG1TNbYsJrmuRpaZ72CeH2s8+P8g=";
   };
 
   patches = [
@@ -38,9 +38,12 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gtk3
     libgee
-    pantheon.granite
-    pantheon.switchboard
-  ];
+  ] ++ (with pantheon; [
+    elementary-files # settings schemas
+    elementary-terminal # settings schemas
+    granite
+    switchboard
+  ]);
 
   postPatch = ''
     chmod +x meson/post_install.py

pkgs/applications/version-management/git-and-tools/stgit/default.nix

@@ -12,13 +12,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "stgit";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "stacked-git";
     repo = "stgit";
     rev = "v${version}";
-    sha256 = "0wa3ba7afnbb1h08n9xr0cqsg93rx0qd9jv8a34mmpp0lpijmjw6";
+    sha256 = "0yx81d61kp33h7n0c14wvcrh8vvjjjq4xjh1qwq2sdbmqc43p3hg";
   };
 
   nativeBuildInputs = [ installShellFiles asciidoc xmlto docbook_xsl docbook_xml_dtd_45 ];

pkgs/applications/version-management/mercurial/default.nix

@@ -13,11 +13,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial";
-    version = "5.9.1";
+    version = "5.9.3";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "09wzyhyajy1dbp5kxkmvs9x8jk964wri19p5jgf83mv27i1zkvrj";
+      sha256 = "sha256-O0P2iXetD6dap/HlyPCoO6k1YhqyOWEpq7SY5W0b4I4=";
     };
 
     format = "other";
@@ -27,7 +27,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "${pname}-${version}";
-      sha256 = "1f7q0kmp46rphw38rlzh1yvpn3rdjdnzzbxzjkrjks8n1gm8baca";
+      sha256 = "sha256:1d911jaawdrcv2mdhlp2ylr10791zj7dhb69aiw5yy7vn7gry82n";
       sourceRoot = "${pname}-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;

pkgs/applications/virtualization/catatonit/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catatonit";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hokG6o7toZxU984EvIlne33Aa2EZVZ3qu1jTZMm5nt4=";
+    sha256 = "sha256-jX4fYC/rpfd3ro2UZ6OEu4kU5wpusOwmEVPWEjxwlW4=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/applications/window-managers/river/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "river";
-  version = "unstable-2021-11-01";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "ifreund";
     repo = pname;
-    rev = "363fd3f6a466004eec157a40e51684e56992b857";
-    sha256 = "sha256-RzReUo1p2z4UQaO5n6PKQlEv0vTBGg+1Wq1UIYii0Mo=";
+    rev = "v${version}";
+    sha256 = "03pdgrcpj8db9s14249815z76dyjwwma8xv6p9hpw79flk6rk7v7";
     fetchSubmodules = true;
   };
 
@@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     wayland-protocols
     wlroots
-    pixman
     libxkbcommon
     pixman
     udev

pkgs/data/documentation/execline-man-pages/default.nix

@@ -2,8 +2,8 @@
 
 buildManPages {
   pname = "execline-man-pages";
-  version = "2.8.1.0.2";
-  sha256 = "1fl3pyjh9328l1h2b6s08j048jl4pfyyc24mjs45qx545kcp65q4";
+  version = "2.8.1.0.3";
+  sha256 = "1n7c75lmyrjzzcbwjl6fxhfs4k29qlr66r1q35799h942cn4li7v";
   description = "Port of the documentation for the execline suite to mdoc";
   maintainers = [ lib.maintainers.sternenseemann ];
 }

pkgs/data/fonts/public-sans/default.nix

@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "1.008";
+  version = "2.000";
 in fetchzip {
   name = "public-sans-${version}";
 
@@ -9,14 +9,11 @@ in fetchzip {
 
   postFetch = ''
     mkdir -p $out/share/fonts
-    unzip -j $downloadedFile binaries/otf/\*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile binaries/variable/\*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile binaries/webfonts/\*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile binaries/webfonts/\*.woff -d $out/share/fonts/woff
-    unzip -j $downloadedFile binaries/webfonts/\*.woff2 -d $out/share/fonts/woff2
+    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
+    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
   '';
 
-  sha256 = "1s4xmliri3r1gcn1ws3wa6davj6giliqjdbcv0bh9ryg3dfpjz74";
+  sha256 = "0r34h9mim5c3h48cpq2m2ixkdqhv3i594pip10pavkmskldpbha5";
 
   meta = with lib; {
     description = "A strong, neutral, principles-driven, open source typeface for text or display";

pkgs/development/libraries/libpg_query/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libpg_query";
-  version = "13-2.0.7";
+  version = "13-2.1.0";
 
   src = fetchFromGitHub {
     owner = "pganalyze";
     repo = "libpg_query";
     rev = version;
-    sha256 = "sha256-xplp7Z17NlYbXIbBdN7EWDN4numdZUBIIVg5EowFMPA=";
+    sha256 = "sha256-DpvPmBvpx5pWDlx6T3Kp82ALi6FjOO549Exd8tWXDIk=";
   };
 
   nativeBuildInputs = [ which ];

pkgs/development/libraries/libqalculate/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libqalculate";
-  version = "3.20.1";
+  version = "3.21.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "libqalculate";
     rev = "v${version}";
-    sha256 = "sha256-8SYI8CoeTfZXX0CgLnfl0rHwUZbYM7OGYzFQ41jm5Qs=";
+    sha256 = "sha256-aKNoLkqpnC+jOvqs7S7SYBu+5VZ+hHHzBkwccg+kYMQ=";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/development/libraries/libsixel/default.nix

@@ -3,33 +3,24 @@
 , fetchFromGitHub
 , meson
 , ninja
-, libbsd
 , gdk-pixbuf
 , gd
 , libjpeg
 , pkg-config
-, fetchpatch
 }:
 stdenv.mkDerivation rec {
   pname = "libsixel";
-  version = "1.10.1";
+  version = "1.10.3";
 
   src = fetchFromGitHub {
     owner = "libsixel";
     repo = "libsixel";
     rev = "v${version}";
-    sha256 = "sha256-ACypJTFjXSzBjo4hQzUiJOqnaRaZnYX+/NublN9sbBo=";
+    sha256 = "1nny4295ipy4ajcxmmh04c796hcds0y7z7rv3qd17mj70y8j0r2d";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/libsixel/libsixel/commit/4d3e53ee007f3b71f638875f9fabbba658b2ca8a.patch";
-      sha256 = "sha256-iDfsTyUczjtzV3pt1ZErbhVO2rMm2ZYKWSBl+ru+5HA=";
-    })
-  ];
-
   buildInputs = [
-    libbsd gdk-pixbuf gd
+    gdk-pixbuf gd
   ];
 
   nativeBuildInputs = [

pkgs/development/node-packages/node-packages.json

@@ -79,6 +79,7 @@
 , "code-theme-converter"
 , "coffee-script"
 , "coinmon"
+, "concurrently"
 , "configurable-http-proxy"
 , "conventional-changelog-cli"
 , "cordova"
@@ -177,6 +178,7 @@
 , "lua-fmt"
 , "madoko"
 , "markdownlint-cli"
+, "markdownlint-cli2"
 , "markdown-link-check"
 , {"markdown-preview-nvim": "../../misc/vim-plugins/markdown-preview-nvim"}
 , "mastodon-bot"

pkgs/development/node-packages/node-packages.nix

@@ -9832,13 +9832,13 @@ let
         sha512 = "2PK+p6dRFuQQM8F4JbBivGetnJxvb8ggQkY7XLeCSl4qVkBeBjX+mRtsiudk28NUTH3JEll7AgmKj2fHfxYpGQ==";
       };
     };
-    "apollo-graphql-0.9.4" = {
+    "apollo-graphql-0.9.5" = {
       name = "apollo-graphql";
       packageName = "apollo-graphql";
-      version = "0.9.4";
+      version = "0.9.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/apollo-graphql/-/apollo-graphql-0.9.4.tgz";
-        sha512 = "0X2sZxfmn7lJrRknUPBG+L0LP1B0SKX1qtULIWrDbIpyl9LuSyjnDaGtmvc4IQtyKvmQXtAhEHBnprRokkjkyw==";
+        url = "https://registry.npmjs.org/apollo-graphql/-/apollo-graphql-0.9.5.tgz";
+        sha512 = "RGt5k2JeBqrmnwRM0VOgWFiGKlGJMfmiif/4JvdaEqhMJ+xqe/9cfDYzXfn33ke2eWixsAbjEbRfy8XbaN9nTw==";
       };
     };
     "apollo-link-1.2.1" = {
@@ -14999,13 +14999,13 @@ let
         sha512 = "bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==";
       };
     };
-    "caniuse-lite-1.0.30001274" = {
+    "caniuse-lite-1.0.30001275" = {
       name = "caniuse-lite";
       packageName = "caniuse-lite";
-      version = "1.0.30001274";
+      version = "1.0.30001275";
       src = fetchurl {
-        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001274.tgz";
-        sha512 = "+Nkvv0fHyhISkiMIjnyjmf5YJcQ1IQHZN6U9TLUMroWR38FNwpsC51Gb68yueafX1V6ifOisInSgP9WJFS13ew==";
+        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001275.tgz";
+        sha512 = "ihJVvj8RX0kn9GgP43HKhb5q9s2XQn4nEQhdldEJvZhCsuiB2XOq6fAMYQZaN6FPWfsr2qU0cdL0CSbETwbJAg==";
       };
     };
     "canvas-2.8.0" = {
@@ -15161,22 +15161,22 @@ let
         sha512 = "vlNK021QdI7PNeiUh/lKkC/mNHHfV0m/Ad5JoI0TYtlBnJAslM/JIkm/tGC88bkLIwO6OQ5uV6ztS6kVAtCDlg==";
       };
     };
-    "cdk8s-1.1.21" = {
+    "cdk8s-1.1.22" = {
       name = "cdk8s";
       packageName = "cdk8s";
-      version = "1.1.21";
+      version = "1.1.22";
       src = fetchurl {
-        url = "https://registry.npmjs.org/cdk8s/-/cdk8s-1.1.21.tgz";
-        sha512 = "jgPspKVy08Tccc2MioscI0aKU3JmlHlKiYTETvDYtONoitRW76ylK5Im+mX/Zy0nCF0Kwuxs6383RYKjwPaecQ==";
+        url = "https://registry.npmjs.org/cdk8s/-/cdk8s-1.1.22.tgz";
+        sha512 = "Mzhm2kj+z93QrSTH6yzq4M9tDXVsqM5HXnXKaLoDisDcRwjiF3rrqqRHoNhDUKX0wtoYWKy3+o3fyCkzEhVejQ==";
       };
     };
-    "cdk8s-plus-22-1.0.0-beta.28" = {
+    "cdk8s-plus-22-1.0.0-beta.29" = {
       name = "cdk8s-plus-22";
       packageName = "cdk8s-plus-22";
-      version = "1.0.0-beta.28";
+      version = "1.0.0-beta.29";
       src = fetchurl {
-        url = "https://registry.npmjs.org/cdk8s-plus-22/-/cdk8s-plus-22-1.0.0-beta.28.tgz";
-        sha512 = "14QKJGI1PTtf9l5n+r03pDLPerxlS49xGPz2nerGIczUpfFVed5PdoeXWtWRDWjfBjPN2IcGPCy/8gdsmDTVEg==";
+        url = "https://registry.npmjs.org/cdk8s-plus-22/-/cdk8s-plus-22-1.0.0-beta.29.tgz";
+        sha512 = "FgucgLJJujYWYa9KhpSAapCbGn+cpXUyd7n4wZI6vKsai0Pq2fYTid/9iYKOoDbM+Hq4W81T0ythQlVx+HqUeg==";
       };
     };
     "cdktf-0.7.0" = {
@@ -34724,13 +34724,13 @@ let
         sha512 = "F7GLNdoHBAYN4eqw7c6Tv12lqGOoMazsjuXDJRubjjbbwZ0tM6a78rHhrZwE4w1XV7mIkTxKmkj4DnbSIPW8wg==";
       };
     };
-    "jsii-srcmak-0.1.386" = {
+    "jsii-srcmak-0.1.387" = {
       name = "jsii-srcmak";
       packageName = "jsii-srcmak";
-      version = "0.1.386";
+      version = "0.1.387";
       src = fetchurl {
-        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.386.tgz";
-        sha512 = "cKGLruiv9J6dB8g2PEem2OQtpxG4HsUU5rhaon9J4H58rVaPIEskXVpeUn3/9DJ8hLQSMCV0QUM7JtzG/SeOyg==";
+        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.387.tgz";
+        sha512 = "c9KlJZRHlBBZa8v46Hw/fMZBrjXyiVQvnRe8//6T8lkBC2gUAys0j3su2pxiIiuX/FxT1r5Zae+oc5VdTGNVlQ==";
       };
     };
     "json-bigint-1.0.0" = {
@@ -39198,6 +39198,15 @@ let
         sha512 = "OJIGsGFV/rC9irI5E1FMy6v9hdACSwaa+EN3224Y5KG8zj2EYzdHOw0pOJovIYmjNfEZ9BtxUY4P7uYHTSNnbQ==";
       };
     };
+    "markdownlint-cli2-formatter-default-0.0.2" = {
+      name = "markdownlint-cli2-formatter-default";
+      packageName = "markdownlint-cli2-formatter-default";
+      version = "0.0.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/markdownlint-cli2-formatter-default/-/markdownlint-cli2-formatter-default-0.0.2.tgz";
+        sha512 = "jIz1X3SIC8sX4NDFqQFUXL+JEtfnDoN4i+xocEu+etcxGX455pHb6sx86f/yVk4mKJ2o7aNe2ydSx9an22BfBg==";
+      };
+    };
     "markdownlint-rule-helpers-0.15.0" = {
       name = "markdownlint-rule-helpers";
       packageName = "markdownlint-rule-helpers";
@@ -57004,6 +57013,15 @@ let
         sha1 = "ff4ae6e68656056ba4b3e792ab3334d38273ca11";
       };
     };
+    "spawn-command-0.0.2" = {
+      name = "spawn-command";
+      packageName = "spawn-command";
+      version = "0.0.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/spawn-command/-/spawn-command-0.0.2.tgz";
+        sha1 = "9544e1a43ca045f8531aac1a48cb29bdae62338e";
+      };
+    };
     "spawn-please-1.0.0" = {
       name = "spawn-please";
       packageName = "spawn-please";
@@ -57760,13 +57778,13 @@ let
         sha512 = "zZ/Q1M+9ZWlrchgh4QauD/MEUFa6eC6H6FYq6T8Of/y82JqsQBLwN6YlzbO09evE7Rx6x0oliXDCnQSjwGwQRA==";
       };
     };
-    "sscaff-1.2.115" = {
+    "sscaff-1.2.116" = {
       name = "sscaff";
       packageName = "sscaff";
-      version = "1.2.115";
+      version = "1.2.116";
       src = fetchurl {
-        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.115.tgz";
-        sha512 = "bEjTWtrXR+fOgJ9Oak+zP4DXUBWl3GmZ03QVLkL+/LC8SkfC+1p/+wcMWo2fij9HVTXlhsEgDnDyL7x0BFXf4A==";
+        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.116.tgz";
+        sha512 = "ecCtXu5ZXFn4VjrDLTWGIOo/2E8qqso1H5JmwV3eLiuYtl+KUi9DtpwkPqi0tqzXnT48dSUkkaH5s92CW+Q3bw==";
       };
     };
     "ssh-config-1.1.6" = {
@@ -71283,7 +71301,7 @@ in
       sources."buffer-5.7.1"
       sources."buffer-from-1.1.2"
       sources."callsites-3.1.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."chalk-3.0.0"
       sources."chardet-0.7.0"
       sources."chokidar-3.5.2"
@@ -71817,7 +71835,7 @@ in
       sources."ansi-styles-3.2.1"
       sources."apollo-cache-control-0.14.0"
       sources."apollo-datasource-0.9.0"
-      sources."apollo-graphql-0.9.4"
+      sources."apollo-graphql-0.9.5"
       sources."apollo-link-1.2.14"
       sources."apollo-reporting-protobuf-0.8.0"
       (sources."apollo-server-caching-0.7.0" // {
@@ -71919,7 +71937,7 @@ in
       sources."call-bind-1.0.2"
       sources."call-me-maybe-1.0.1"
       sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."caseless-0.12.0"
       sources."caw-2.0.1"
       sources."chalk-2.4.2"
@@ -73061,7 +73079,7 @@ in
       sources."balanced-match-1.0.2"
       sources."brace-expansion-1.1.11"
       sources."browserslist-4.17.6"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."chalk-2.4.2"
       sources."color-convert-1.9.3"
       sources."color-name-1.1.3"
@@ -73201,7 +73219,7 @@ in
     };
     dependencies = [
       sources."browserslist-4.17.6"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."electron-to-chromium-1.3.887"
       sources."escalade-3.1.1"
       sources."fraction.js-4.1.1"
@@ -76588,8 +76606,8 @@ in
       sources."call-bind-1.0.2"
       sources."camelcase-6.2.0"
       sources."case-1.6.3"
-      sources."cdk8s-1.1.21"
-      sources."cdk8s-plus-22-1.0.0-beta.28"
+      sources."cdk8s-1.1.22"
+      sources."cdk8s-plus-22-1.0.0-beta.29"
       sources."chalk-4.1.2"
       sources."cliui-7.0.4"
       sources."clone-2.1.2"
@@ -76682,7 +76700,7 @@ in
           sources."yargs-16.2.0"
         ];
       })
-      (sources."jsii-srcmak-0.1.386" // {
+      (sources."jsii-srcmak-0.1.387" // {
         dependencies = [
           sources."fs-extra-9.1.0"
         ];
@@ -76727,7 +76745,7 @@ in
       sources."snake-case-3.0.4"
       sources."sort-json-2.0.0"
       sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.115"
+      sources."sscaff-1.2.116"
       (sources."streamroller-2.2.4" // {
         dependencies = [
           sources."date-format-2.1.0"
@@ -76917,7 +76935,7 @@ in
         ];
       })
       sources."apollo-datasource-3.2.0"
-      sources."apollo-graphql-0.9.4"
+      sources."apollo-graphql-0.9.5"
       sources."apollo-reporting-protobuf-3.1.0"
       sources."apollo-server-caching-3.2.0"
       (sources."apollo-server-core-3.4.0" // {
@@ -77369,7 +77387,7 @@ in
       sources."sort-json-2.0.0"
       sources."source-map-0.5.7"
       sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.115"
+      sources."sscaff-1.2.116"
       (sources."stack-utils-2.0.5" // {
         dependencies = [
           sources."escape-string-regexp-2.0.0"
@@ -78390,7 +78408,7 @@ in
       sources."callsites-3.1.0"
       sources."camelcase-2.1.1"
       sources."camelcase-keys-2.1.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."capture-stack-trace-1.0.1"
       sources."ccount-1.1.0"
       (sources."chalk-4.1.2" // {
@@ -79503,7 +79521,7 @@ in
       sources."callsites-3.1.0"
       sources."camelcase-5.3.1"
       sources."camelcase-keys-6.2.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       (sources."chalk-4.1.2" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
@@ -80496,6 +80514,55 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  concurrently = nodeEnv.buildNodePackage {
+    name = "concurrently";
+    packageName = "concurrently";
+    version = "6.3.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/concurrently/-/concurrently-6.3.0.tgz";
+      sha512 = "k4k1jQGHHKsfbqzkUszVf29qECBrkvBKkcPJEUDTyVR7tZd1G/JOfnst4g1sYbFvJ4UjHZisj1aWQR8yLKpGPw==";
+    };
+    dependencies = [
+      sources."ansi-regex-5.0.1"
+      sources."ansi-styles-4.3.0"
+      (sources."chalk-4.1.2" // {
+        dependencies = [
+          sources."supports-color-7.2.0"
+        ];
+      })
+      sources."cliui-7.0.4"
+      sources."color-convert-2.0.1"
+      sources."color-name-1.1.4"
+      sources."date-fns-2.25.0"
+      sources."emoji-regex-8.0.0"
+      sources."escalade-3.1.1"
+      sources."get-caller-file-2.0.5"
+      sources."has-flag-4.0.0"
+      sources."is-fullwidth-code-point-3.0.0"
+      sources."lodash-4.17.21"
+      sources."require-directory-2.1.1"
+      sources."rxjs-6.6.7"
+      sources."spawn-command-0.0.2"
+      sources."string-width-4.2.3"
+      sources."strip-ansi-6.0.1"
+      sources."supports-color-8.1.1"
+      sources."tree-kill-1.2.2"
+      sources."tslib-1.14.1"
+      sources."wrap-ansi-7.0.0"
+      sources."y18n-5.0.8"
+      sources."yargs-16.2.0"
+      sources."yargs-parser-20.2.9"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "Run commands concurrently";
+      homepage = "https://github.com/open-cli-tools/concurrently#readme";
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   configurable-http-proxy = nodeEnv.buildNodePackage {
     name = "configurable-http-proxy";
     packageName = "configurable-http-proxy";
@@ -82949,7 +83016,7 @@ in
         ];
       })
       sources."call-bind-1.0.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."chalk-2.4.2"
       sources."chokidar-2.1.8"
       (sources."class-utils-0.3.6" // {
@@ -84469,7 +84536,7 @@ in
       sources."callsites-2.0.0"
       sources."camelcase-5.3.1"
       sources."camelcase-keys-6.2.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."chalk-2.4.2"
       sources."ci-info-2.0.0"
       sources."cli-boxes-2.2.1"
@@ -87103,7 +87170,7 @@ in
       })
       sources."camelcase-6.2.0"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."caseless-0.12.0"
       (sources."chalk-4.1.2" // {
         dependencies = [
@@ -89023,7 +89090,7 @@ in
       sources."callsites-2.0.0"
       sources."camelcase-5.3.1"
       sources."camelcase-keys-6.2.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."chalk-2.4.2"
       sources."chownr-1.1.4"
       sources."ci-info-2.0.0"
@@ -91971,7 +92038,7 @@ in
       sources."call-bind-1.0.2"
       sources."camel-case-4.1.2"
       sources."camelcase-6.2.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."ccount-1.1.0"
       (sources."chalk-4.1.2" // {
         dependencies = [
@@ -99421,7 +99488,7 @@ in
       sources."bytes-3.1.0"
       sources."bytesish-0.4.4"
       sources."call-bind-1.0.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."caseless-0.12.0"
       sources."chalk-2.4.2"
       sources."chardet-1.4.0"
@@ -102323,7 +102390,7 @@ in
       sources."cached-path-relative-1.0.2"
       sources."call-bind-1.0.2"
       sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."capture-exit-2.0.0"
       sources."caseless-0.12.0"
       (sources."chalk-3.0.0" // {
@@ -103285,6 +103352,61 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  markdownlint-cli2 = nodeEnv.buildNodePackage {
+    name = "markdownlint-cli2";
+    packageName = "markdownlint-cli2";
+    version = "0.3.2";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/markdownlint-cli2/-/markdownlint-cli2-0.3.2.tgz";
+      sha512 = "Wj4iQy2J49m9CVkWkLTdFxMTPDqD3AyL3NbLQgz/nUnTu8LnDguFCbQtFhdzQPvncHVjrKT2vYqg7DifzVP4tA==";
+    };
+    dependencies = [
+      sources."@nodelib/fs.scandir-2.1.5"
+      sources."@nodelib/fs.stat-2.0.5"
+      sources."@nodelib/fs.walk-1.2.8"
+      sources."argparse-2.0.1"
+      sources."array-union-2.1.0"
+      sources."braces-3.0.2"
+      sources."dir-glob-3.0.1"
+      sources."entities-2.1.0"
+      sources."fast-glob-3.2.7"
+      sources."fastq-1.13.0"
+      sources."fill-range-7.0.1"
+      sources."glob-parent-5.1.2"
+      sources."globby-11.0.4"
+      sources."ignore-5.1.8"
+      sources."is-extglob-2.1.1"
+      sources."is-glob-4.0.3"
+      sources."is-number-7.0.0"
+      sources."linkify-it-3.0.3"
+      sources."markdown-it-12.2.0"
+      sources."markdownlint-0.24.0"
+      sources."markdownlint-cli2-formatter-default-0.0.2"
+      sources."markdownlint-rule-helpers-0.15.0"
+      sources."mdurl-1.0.1"
+      sources."merge2-1.4.1"
+      sources."micromatch-4.0.4"
+      sources."path-type-4.0.0"
+      sources."picomatch-2.3.0"
+      sources."queue-microtask-1.2.3"
+      sources."reusify-1.0.4"
+      sources."run-parallel-1.2.0"
+      sources."slash-3.0.0"
+      sources."strip-json-comments-3.1.1"
+      sources."to-regex-range-5.0.1"
+      sources."uc.micro-1.0.6"
+      sources."yaml-1.10.2"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "A fast, flexible, configuration-based command-line interface for linting Markdown/CommonMark files with the `markdownlint` library";
+      homepage = "https://github.com/DavidAnson/markdownlint-cli2";
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   markdown-link-check = nodeEnv.buildNodePackage {
     name = "markdown-link-check";
     packageName = "markdown-link-check";
@@ -106999,7 +107121,7 @@ in
       sources."caller-path-2.0.0"
       sources."callsites-2.0.0"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."caseless-0.12.0"
       sources."chalk-2.4.2"
       sources."chokidar-2.1.8"
@@ -110785,7 +110907,7 @@ in
       sources."camel-case-3.0.0"
       sources."camelcase-5.3.1"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."case-sensitive-paths-webpack-plugin-2.4.0"
       sources."caw-2.0.1"
       sources."chalk-2.4.2"
@@ -113339,6 +113461,37 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  rtlcss = nodeEnv.buildNodePackage {
+    name = "rtlcss";
+    packageName = "rtlcss";
+    version = "3.5.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/rtlcss/-/rtlcss-3.5.0.tgz";
+      sha512 = "wzgMaMFHQTnyi9YOwsx9LjOxYXJPzS8sYnFaKm6R5ysvTkwzHiB0vxnbHwchHQT65PTdBjDG21/kQBWI7q9O7A==";
+    };
+    dependencies = [
+      sources."find-up-5.0.0"
+      sources."locate-path-6.0.0"
+      sources."nanoid-3.1.30"
+      sources."p-limit-3.1.0"
+      sources."p-locate-5.0.0"
+      sources."path-exists-4.0.0"
+      sources."picocolors-1.0.0"
+      sources."postcss-8.3.11"
+      sources."source-map-js-0.6.2"
+      sources."strip-json-comments-3.1.1"
+      sources."yocto-queue-0.1.0"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "Framework for transforming cascading style sheets (CSS) from left-to-right (LTR) to right-to-left (RTL)";
+      homepage = "https://rtlcss.com/";
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   s3http = nodeEnv.buildNodePackage {
     name = "s3http";
     packageName = "s3http";
@@ -121847,7 +122000,7 @@ in
       sources."buffer-from-1.1.2"
       sources."call-bind-1.0.2"
       sources."camelcase-6.2.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       (sources."chalk-4.1.2" // {
         dependencies = [
           sources."supports-color-7.2.0"
@@ -124227,7 +124380,7 @@ in
       sources."ajv-keywords-3.5.2"
       sources."browserslist-4.17.6"
       sources."buffer-from-1.1.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
       sources."chrome-trace-event-1.0.3"
       sources."commander-2.20.3"
       sources."electron-to-chromium-1.3.887"

pkgs/development/python-modules/lightgbm/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "lightgbm";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "107ae7babbbda2c2f0e07484f0c53cdeb455e9219235f79dc4e1685d7541e505";
+    sha256 = "5b9f31759ab4e94d9409deb03104c55b0a40058a6ccea804022046d926bc4904";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/stashy/default.nix

@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, decorator
+, fetchPypi
+, pythonOlder
+, requests
+ }:
+
+buildPythonPackage rec {
+  pname = "stashy";
+  version = "0.7";
+  disabled = pythonOlder "3.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1x89zazwxnsx6rdfw8nfr372hj4sk8nrcs5hsjxpcxcva0calrcr";
+  };
+
+  propagatedBuildInputs = [ decorator requests ];
+
+  # Tests require internet connection
+  doCheck = false;
+  pythonImportsCheck = [ "stashy" ];
+
+  meta = with lib; {
+    description = "Python client for the Atlassian Bitbucket Server (formerly known as Stash) REST API.";
+    homepage = "https://github.com/cosmin/stashy";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mupdt ];
+  };
+}

pkgs/development/tools/analysis/cargo-tarpaulin/default.nix

@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tarpaulin";
-  version = "0.18.2";
+  version = "0.18.3";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     rev = version;
-    sha256 = "sha256-3ep90G6LW83XGyS9b465u8/SznJRZBhEV/YQU8fua1s=";
+    sha256 = "sha256-n43n9rmLWmGF7JXz/jspT6Stn0fQnkbkxqbuqXiZLHA=";
   };
 
   nativeBuildInputs = [
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ curl Security ];
 
-  cargoSha256 = "sha256-UtFGuJ6HEUtonH43iuum1hrhnYesQpkyqPTVcqWAoiA=";
+  cargoSha256 = "sha256-dJey7z0gRUu5MRKOfR909eQNTt3zpZnoWYvRhHzZlGs=";
   #checkFlags = [ "--test-threads" "1" ];
   doCheck = false;
 

pkgs/development/tools/analysis/tflint/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.33.0";
+  version = "0.33.1";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1cq84ggp32xx79sgrxyqysqs34lhzyv8jdg7d46d9hdvjcwjb5af";
+    sha256 = "1n1xw2h544r6bap2drgrip9i8nl5zg5gcdic8qj3y93ppisgzqml";
   };
 
-  vendorSha256 = "1ay3vf4dqlbizq98nxz2cgi67ck1c6lw7wi28w56607qzbx0yvmg";
+  vendorSha256 = "0fq4nbd0w1nb98g321mns76a60dwwhf4w7g589qz87z29vdy0jbk";
 
   doCheck = false;
 

pkgs/development/tools/azcopy/default.nix

@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
-  version = "10.12.2";
+  version = "10.13.0";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-azcopy";
     rev = "v${version}";
-    sha256 = "sha256-NmWCaTmQlCAKaVDumDlubHQhUjhY7uYawkjrP2ggczk=";
+    sha256 = "sha256-L5gfS2hwk1uaWEygn+liupdANL9qizHAjxNz25KBwaY=";
   };
 
   subPackages = [ "." ];
 
-  vendorSha256 = "sha256-4Jz57VjdQX+LJexEZau4pd8nIQPt0HGzCjHRj7uPox4=";
+  vendorSha256 = "sha256-ePEpc18Y99Moe/aj8n1+no6D70vZoIEjC023Uup98Uo=";
 
   doCheck = false;
 

pkgs/development/tools/bazel-gazelle/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "bazel-gazelle";
-  version = "0.21.1";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "12ffrildgx4lah7bdnhr7i8z5jp05lll6gmmpzshmzz8dsgf39y4";
+    sha256 = "sha256-WWAOhV1H/OnARjhoWQYNmd9/y8pD3bRkhncmzt/36mA=";
   };
 
   vendorSha256 = null;

pkgs/development/tools/continuous-integration/github-runner/default.nix

@@ -37,13 +37,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "github-runner";
-  version = "2.283.3";
+  version = "2.284.0";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    sha256 = "sha256-B2dn3AIGk+xMFqRsKv4pvlZ6K4xySsS0klk8vN8giso=";
+    sha256 = "sha256-JR0OzbT5gGhO/dxb/eSjP/d/VxW/aLmTs/oPwN8b8Rc=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/krew/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "krew";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "krew";
     rev = "v${version}";
-    sha256 = "sha256-+YwBkXrj5sWlMA01GfBhu12st+es5YygkD16jc+blt8=";
+    sha256 = "sha256-P4b8HMkqxzYKz9OgI4pNCjR9Wakh+kIIAnUAkayzGEo=";
   };
 
-  vendorSha256 = "sha256-49kWaU5dYqd86DvHi3mh5jYUQVmFlI8zsWtAFseYriE=";
+  vendorSha256 = "sha256-FQQCHq9f0yY8vSsvWIR7WKq+0c+dgGEnoQmXtoN6Ep0=";
 
   subPackages = [ "cmd/krew" ];
 

pkgs/development/tools/lazygit/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lazygit";
-  version = "0.29";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rw03K21Ay/+XKs06cUBybXLp8Rxrlz8T8YKrSGroyDU=";
+    sha256 = "sha256-8oyUI8jqJOJT1bZE25HlFA39gs3dcZbTL/vrL40K1IM=";
   };
 
   vendorSha256 = null;

pkgs/development/tools/misc/saleae-logic-2/default.nix

@@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools, gtk3 }:
 let
   name = "saleae-logic-2";
-  version = "2.3.38";
+  version = "2.3.39";
   src = fetchurl {
     url = "https://downloads.saleae.com/logic2/Logic-${version}-master.AppImage";
-    sha256 = "0y3ys3q6gd9fxgaf36q5av0kgvy7jv5anyjxb4cva8d95l4k3ask";
+    sha256 = "1p31i8xillc5vrl2nli74b7p7cv2yz2qafp2gnyjfn0nbx5ij52g";
   };
   desktopItem = makeDesktopItem {
     inherit name;

pkgs/development/tools/skaffold/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "skaffold";
-  version = "1.32.0";
+  version = "1.34.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    sha256 = "sha256-LvTAM3uYzSEhX7zz7Z+VcMYV5p80EnyaEIu0CmAUaSg=";
+    sha256 = "sha256-y9y1aUy2fDvMuYCKU2g2lBSmX53NDy9v0XImHXqdJqM=";
   };
 
-  vendorSha256 = "sha256-TUpHg4yvZ0WKcUFXjWh4Q4/gRtJ93xNa/gLkj5PYo/w=";
+  vendorSha256 = "sha256-h5UybTcvr9Zxpfw7zBCeSAG2oAZzFWpuYugqXUCMtjs=";
 
   subPackages = ["cmd/skaffold"];
 

pkgs/misc/emulators/citra/default.nix

@@ -1,27 +1,76 @@
-{ mkDerivation, lib, fetchgit, cmake, SDL2, qtbase, qtmultimedia, boost
-, wrapQtAppsHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, wrapQtAppsHook
+, SDL2
+, qtbase
+, qtmultimedia
+, boost17x
+, libpulseaudio
+, pkg-config
+, libusb1
+, zstd
+, libressl
+, alsa-lib
+, rapidjson
+, aacHleDecoding ? true
+, fdk_aac
+, ffmpeg-full
+}:
 
-mkDerivation {
+stdenv.mkDerivation {
   pname = "citra";
   version = "2021-11-01";
 
-  # Submodules
-  src = fetchgit {
-    url = "https://github.com/citra-emu/citra";
+  src = fetchFromGitHub {
+    owner = "citra-emu";
+    repo = "citra";
     rev = "5a7d80172dd115ad9bc6e8e85cee6ed9511c48d0";
     sha256 = "sha256-vy2JMizBsnRK9NBEZ1dxT7fP/HFhOZSsC+5P+Dzi27s=";
+    fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ cmake wrapQtAppsHook ];
-  buildInputs = [ SDL2 qtbase qtmultimedia boost ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook pkg-config ];
+  buildInputs = [
+    SDL2
+    qtbase
+    qtmultimedia
+    libpulseaudio
+    boost17x
+    libusb1
+    alsa-lib
+    rapidjson # for discord-rpc
+  ] ++ lib.optional aacHleDecoding [ fdk_aac ffmpeg-full ];
+
+  cmakeFlags = [
+    "-DUSE_SYSTEM_BOOST=ON"
+    "-DUSE_DISCORD_PRESENCE=ON"
+  ] ++ lib.optionals aacHleDecoding [
+    "-DENABLE_FFMPEG_AUDIO_DECODER=ON"
+    "-DCITRA_USE_BUNDLED_FFMPEG=OFF"
+  ];
+
+  postPatch = ''
+    # we already know the submodules are present
+    substituteInPlace CMakeLists.txt \
+      --replace "check_submodules_present()" ""
 
-  preConfigure = ''
     # Trick configure system.
     sed -n 's,^ *path = \(.*\),\1,p' .gitmodules | while read path; do
-      mkdir "$path/.git"
+    mkdir "$path/.git"
     done
+
+    rm -rf externals/zstd externals/libressl
+    cp -r ${zstd.src} externals/zstd
+    tar xf ${libressl.src} -C externals/
+    mv externals/${libressl.name} externals/libressl
+    chmod -R a+w externals/zstd
   '';
 
+  # Todo: cubeb audio backend (the default one) doesn't work on the SDL interface.
+  # Note that the two interfaces have two separate configuration files.
+
   meta = with lib; {
     homepage = "https://citra-emu.org";
     description = "An open-source emulator for the Nintendo 3DS";

pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch

@@ -1,11 +0,0 @@
-diff --git a/libbridge/libbridge.h b/libbridge/libbridge.h
-index 39964f2..dd14bae 100644
---- a/libbridge/libbridge.h
-+++ b/libbridge/libbridge.h
-@@ -20,6 +20,7 @@
- #define _LIBBRIDGE_H
-
- #include <sys/socket.h>
-+#include <netinet/in.h>
- #include <linux/if.h>
- #include <linux/if_bridge.h>

pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch

@@ -1,7 +1,5 @@
-diff --git a/configure.in b/configure.in
-index 5e3f89b..19be6d9 100644
---- a/configure.in
-+++ b/configure.in
+--- a/configure.ac
++++ b/configure.ac
 @@ -9,6 +9,7 @@ dnl Checks for programs.
  AC_PROG_CC
  AC_PROG_INSTALL
@@ -10,8 +8,6 @@ index 5e3f89b..19be6d9 100644
  
  dnl Checks for header files.
  AC_HEADER_STDC
-diff --git a/libbridge/Makefile.in b/libbridge/Makefile.in
-index 20512c4..83c802b 100644
 --- a/libbridge/Makefile.in
 +++ b/libbridge/Makefile.in
 @@ -1,7 +1,7 @@

pkgs/os-specific/linux/bridge-utils/default.nix

@@ -2,29 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "bridge-utils";
-  version = "1.5";
+  version = "1.7.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/bridge/bridge-utils-${version}.tar.gz";
-    sha256 = "42f9e5fb8f6c52e63a98a43b81bd281c227c529f194913e1c51ec48a393b6688";
+    url = "https://kernel.org/pub/linux/utils/net/bridge-utils/bridge-utils-${version}.tar.xz";
+    sha256 = "sha256-ph2L5PGhQFxgyO841UTwwYwFszubB+W0sxAzU2Fl5g4=";
   };
 
-  patches = [
-    ./autoconf-ar.patch
-    ./add-ip6-header.patch # Remove patch once the kernel headers are updated
-  ];
+  patches = [ ./autoconf-ar.patch ];
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  postInstall = ''
-    # The bridge utils build does not fail even if the brctl binary
-    # is not build. This test ensures that we fail if we don't produce a brctl
-    # binary.
-    test -f $out/sbin/brctl
-  '';
-
   meta = {
-    description = "https://sourceforge.net/projects/bridge/";
+    description = "An userspace tool to configure linux bridges (deprecated in favour or iproute2).";
     homepage = "https://wiki.linuxfoundation.org/networking/bridge";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;

pkgs/os-specific/linux/iotop-c/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iotop-c";
-  version = "1.19";
+  version = "1.20";
 
   src = fetchFromGitHub {
     owner = "Tomas-M";
     repo = "iotop";
     rev = "v${version}";
-    sha256 = "sha256-CuZwOIhjl6fpEvfw/4CTjKQkxazLL/NGujmNcx1Jrbc=";
+    sha256 = "sha256-6Pg2CLWzsD6EPRKD2xMMgKFkpbSheiMMkd0BvHh9onA=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/shells/zsh/spaceship-prompt/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "spaceship-prompt";
-  version = "3.14.1";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "denysdovhan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/Q2vsCIDsHUSBavJoHX3L0NQ7REoQmaiRgHVGiLtNPE=";
+    sha256 = "sha256-/9c4o9tdXtDefZ1fA62Y9Sg2cv54YVZGlZ1n6EfQWC4=";
   };
 
   dontBuild = true;

pkgs/tools/admin/exoscale-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "exoscale-cli";
-  version = "1.45.2";
+  version = "1.46.0";
 
   src = fetchFromGitHub {
     owner  = "exoscale";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-bzm8UNFWAXHBdarovNMyARW2xA4tSXIgIHpxROx4nOI=";
+    sha256 = "sha256-dWbuzzFCBJuSUUQFXY3axK+T9rsMaIMOCKa0ig96bJE=";
   };
 
   goPackagePath = "github.com/exoscale/cli";

pkgs/tools/admin/stripe-cli/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.7.3";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Hlh2nfqQD+HMoJ2n1vfffn5ieEKSMtXpdoM0ydFQqrc=";
+    sha256 = "sha256-2wiry3bBrxrhyyPT/81VpAS34XBZgZsz8Wlq8Qeybgk=";
   };
 
-  vendorSha256 = "sha256-DTNwgerJ7qZxH4imdrST7TaR20oevDluEDgAlubg5hw=";
+  vendorSha256 = "sha256-Lgd1vGXlZw0s4dVC0TlGEYoGOLrJPc/bZ75Mzke4rrg=";
 
   subPackages = [
     "cmd/stripe"

pkgs/tools/package-management/cargo-edit/default.nix

@@ -1,26 +1,26 @@
-{ stdenv
-, lib
+{ lib
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
 , openssl
+, zlib
+, stdenv
 , libiconv
 , Security
-, zlib
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-edit";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "killercup";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256:0fh1lq793k4ddpqsf2av447hcb74vcq53afkm3g4672k48mjjw1y";
+    hash = "sha256-n9Ei1kpbDqOogNJJVvg9DRAPMVGNChCGGiuCVsuK3/8=";
   };
 
-  cargoSha256 = "0ah3zjx36ibax4gi66g13finh4m2k0aidxkg2nxx1c2aqj847mm1";
+  cargoSha256 = "sha256-6546jD+zDoScrJmpw5xtNdWeIPJ9Ma0bcIdnI1kFmu8=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -34,7 +34,8 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A utility for managing cargo dependencies from the command line";
     homepage = "https://github.com/killercup/cargo-edit";
+    changelog = "https://github.com/killercup/cargo-edit/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ gerschtli jb55 Br1ght0ne killercup ];
+    maintainers = with maintainers; [ Br1ght0ne figsoda gerschtli jb55 killercup ];
   };
 }

pkgs/tools/security/keybase/default.nix

@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "keybase";
-  version = "5.7.1";
+  version = "5.8.1";
 
   goPackagePath = "github.com/keybase/client";
   subPackages = [ "go/kbnm" "go/keybase" ];
@@ -17,7 +17,7 @@ buildGoPackage rec {
     owner = "keybase";
     repo = "client";
     rev = "v${version}";
-    sha256 = "sha256-72rVk8pYIQFESQqBu4bmFBPpAOB0oG2Iu36TbAdecBw=";
+    sha256 = "sha256-SeBZtrRsWTv5yBBsp18daKCNAr70OalH3shlKf+aiEU=";
   };
 
   patches = [

pkgs/tools/security/rbw/default.nix

@@ -22,19 +22,22 @@
   # pass-import
 , withPass ? false
 , pass
+
+  # git-credential-helper
+, withGitCredential ? false
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rbw";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchCrate {
     inherit version;
     crateName = pname;
-    sha256 = "sha256-6O33rn/MTo7Dymwh57xQJ5v7n4yNSoICyR9gRwF4AH4=";
+    sha256 = "sha256-RNdxAp3Q/xNrK1XcKZPMfuqxWzDtdhwT+nqG25SjJhI=";
   };
 
-  cargoSha256 = "sha256-BrjKUovVV6BDZXtILVC0qaAF5xzE3715u9w9OYIJFbk=";
+  cargoSha256 = "sha256-I0KwHCmfYxgSF5IMHiPooaf2bypd6eYCOPSB+qnEBJY=";
 
   nativeBuildInputs = [
     pkg-config
@@ -58,6 +61,10 @@ rustPlatform.buildRustPackage rec {
     patchShebangs bin/pass-import
     substituteInPlace bin/pass-import \
         --replace pass ${pass}/bin/pass
+  '' + lib.optionalString withGitCredential ''
+    patchShebangs bin/git-credential-rbw
+    substituteInPlace bin/git-credential-rbw \
+        --replace rbw $out/bin/rbw
   '';
 
   preConfigure = ''
@@ -76,6 +83,8 @@ rustPlatform.buildRustPackage rec {
     cp bin/rbw-rofi $out/bin
   '' + lib.optionalString withPass ''
     cp bin/pass-import $out/bin
+  '' + lib.optionalString withGitCredential ''
+    cp bin/git-credential-rbw $out/bin
   '';
 
   meta = with lib; {

pkgs/tools/system/rsyslog/default.nix

@@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "rsyslog";
-  version = "8.2108.0";
+  version = "8.2110.0";
 
   src = fetchurl {
     url = "https://www.rsyslog.com/files/download/rsyslog/${pname}-${version}.tar.gz";
-    sha256 = "sha256-SCbCttCBqclfRp+wEVvj+VEgZSl9PeAOxRN1jNswsdk=";
+    sha256 = "sha256-P5BOwTfKZBLoJz94ltli7LWJ99DFib3xaxcJ7CfiTzE=";
   };
 
   #patches = [ ./fix-gnutls-detection.patch ];

pkgs/tools/system/syslog-ng/default.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "syslog-ng";
-  version = "3.33.2";
+  version = "3.34.1";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-C3hqBgd7kVAZHXFPRaG0s3kpUstYFjo68zbwdNqfsUs=";
+    sha256 = "sha256-zs457BxoyI1JNwXgpSi4PQONo4TonUg4OTzMdfYqLUw=";
   };
 
   nativeBuildInputs = [ pkg-config which ];

pkgs/tools/text/chroma/default.nix

@@ -1,37 +1,32 @@
 { lib, buildGoModule, fetchFromGitHub }:
 
+let
+  srcInfo = builtins.fromJSON (builtins.readFile ./src.json);
+in
+
 buildGoModule rec {
   pname = "chroma";
-  version = "0.9.2";
+  version = "0.9.4";
 
+  # To update:
+  # nix-prefetch-git --rev v${version} https://github.com/alecthomas/chroma.git > src.json
   src = fetchFromGitHub {
     owner  = "alecthomas";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "19d7yr6q8kwrm91yyglmw9n7wa861sgi6dbwn8sl6dp55czfwvaq";
-    # populate values otherwise taken care of by goreleaser,
-    # unfortunately these require us to use git. By doing
-    # this in postFetch we can delete .git afterwards and
-    # maintain better reproducibility of the src.
-    leaveDotGit = true;
-    postFetch = ''
-      cd "$out"
-
-      commit="$(git rev-parse HEAD)"
-      date=$(git show -s --format=%aI "$commit")
-
-      substituteInPlace "$out/cmd/chroma/main.go" \
-        --replace 'version = "?"' 'version = "${version}"' \
-        --replace 'commit  = "?"' "commit = \"$commit\"" \
-        --replace 'date    = "?"' "date = \"$date\""
-
-      find "$out" -name .git -print0 | xargs -0 rm -rf
-    '';
+    inherit (srcInfo) sha256;
   };
 
-  vendorSha256 = "0y8mp08zccn9qxrsj9j7vambz8dwzsxbbgrlppzam53rg8rpxhrg";
+  vendorSha256 = "1l5ryhwifhff41r4z1d2lifpvjcc4yi1vzrzlvkx3iy9dmxqcssl";
 
-  subPackages = [ "cmd/chroma" ];
+  modRoot = "./cmd/chroma";
+
+  # substitute version info as done in goreleaser builds
+  ldflags = [
+    "-X" "main.version=${version}"
+    "-X" "main.commit=${srcInfo.rev}"
+    "-X" "main.date=${srcInfo.date}"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/alecthomas/chroma";

pkgs/tools/text/chroma/src.json

@@ -0,0 +1,11 @@
+{
+  "url": "https://github.com/alecthomas/chroma.git",
+  "rev": "6520148857c2ae3106ff371e527abea815b23915",
+  "date": "2021-10-17T08:46:20+11:00",
+  "path": "/nix/store/0s8a46d1nyjl3yhsgni2jz5vdv95cka8-chroma",
+  "sha256": "1iy6mymdjxbl5wbll1mivv7gqdyqhl6xpfqps99z307m7y38r1ni",
+  "fetchLFS": false,
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}

pkgs/tools/text/crowdin-cli/default.nix

@@ -7,6 +7,8 @@
 , installShellFiles
 , jre
 , makeWrapper
+, crowdin-cli
+, testVersion
 , unzip
 }:
 
@@ -36,7 +38,10 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.tests.version = testVersion { package = crowdin-cli; };
+
   meta = with lib; {
+    mainProgram = "crowdin";
     homepage = "https://github.com/crowdin/crowdin-cli/";
     description = "A command-line client for the Crowdin API";
     license = licenses.mit;

pkgs/top-level/all-packages.nix

@@ -1469,6 +1469,8 @@ with pkgs;
 
   inherit (nodePackages) bitwarden-cli;
 
+  inherit (nodePackages) concurrently;
+
   inherit (nodePackages) hyperspace-cli;
 
   bklk = callPackage ../applications/misc/bklk { };

pkgs/top-level/python-packages.nix

@@ -8879,6 +8879,8 @@ in {
 
   starline = callPackage ../development/python-modules/starline { };
 
+  stashy = callPackage ../development/python-modules/stashy { };
+
   staticjinja = callPackage ../development/python-modules/staticjinja { };
 
   statistics = callPackage ../development/python-modules/statistics { };