Merge master into haskell-updates

2021-10-18 00:07:22 +00:00 · 2021-10-18 00:07:22 +00:00 · f5e1fc6ad5
parent e3b2d60b23 e7c8c949f1
commit f5e1fc6ad5
75 changed files with 1392 additions and 392 deletions
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -153,6 +153,11 @@ in mkLicense lset) ({
    free = false;
  };

+  capec = {
+    fullName = "Common Attack Pattern Enumeration and Classification";
+    url = "https://capec.mitre.org/about/termsofuse.html";
+  };
+
  clArtistic = {
    spdxId = "ClArtistic";
    fullName = "Clarified Artistic License";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -10513,6 +10513,13 @@
    githubId = 4477729;
    name = "Sergey Mironov";
  };
+  smitop = {
+    name = "Smitty van Bodegom";
+    email = "me@smitop.com";
+    matrix = "@smitop:kde.org";
+    github = "Smittyvb";
+    githubId = 10530973;
+  };
  sna = {
    email = "abouzahra.9@wright.edu";
    github = "s-na";
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -1535,6 +1535,25 @@ Superuser created successfully.
          release notes</link> for changes and upgrade instructions.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>systemd.network</literal> module has gained
+          support for the FooOverUDP link type.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>networking</literal> module has a new
+          <literal>networking.fooOverUDP</literal> option to configure
+          Foo-over-UDP encapsulations.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>networking.sits</literal> now supports Foo-over-UDP
+          encapsulation.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
 </section>
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -443,3 +443,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 - Three new options, [xdg.mime.addedAssociations](#opt-xdg.mime.addedAssociations), [xdg.mime.defaultApplications](#opt-xdg.mime.defaultApplications), and [xdg.mime.removedAssociations](#opt-xdg.mime.removedAssociations) have been added to the [xdg.mime](#opt-xdg.mime.enable) module to allow the configuration of `/etc/xdg/mimeapps.list`.

 - Kopia was upgraded from 0.8.x to 0.9.x. Please read the [upstream release notes](https://github.com/kopia/kopia/releases/tag/v0.9.0) for changes and upgrade instructions.
+
+- The `systemd.network` module has gained support for the FooOverUDP link type.
+
+- The `networking` module has a new `networking.fooOverUDP` option to configure Foo-over-UDP encapsulations.
+
+- `networking.sits` now supports Foo-over-UDP encapsulation.
--- a/nixos/modules/programs/evince.nix
+++ b/nixos/modules/programs/evince.nix
@ -4,7 +4,9 @@

 with lib;

-{
+let cfg = config.programs.evince;
+
+in {

  # Added 2019-08-09
  imports = [
@ -22,6 +24,13 @@ with lib;
      enable = mkEnableOption
        "Evince, the GNOME document viewer";

+      package = mkOption {
+        type = types.package;
+        default = pkgs.evince;
+        defaultText = literalExpression "pkgs.evince";
+        description = "Evince derivation to use.";
+      };
+
    };

  };
@ -31,11 +40,11 @@ with lib;

  config = mkIf config.programs.evince.enable {

-    environment.systemPackages = [ pkgs.evince ];
+    environment.systemPackages = [ cfg.package ];

-    services.dbus.packages = [ pkgs.evince ];
+    services.dbus.packages = [ cfg.package ];

-    systemd.packages = [ pkgs.evince ];
+    systemd.packages = [ cfg.package ];

  };

--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -219,6 +219,7 @@ in
      ] config.environment.pantheon.excludePackages);

      programs.evince.enable = mkDefault true;
+      programs.evince.package = pkgs.pantheon.evince;
      programs.file-roller.enable = mkDefault true;

      # Settings from elementary-default-settings
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -250,6 +250,16 @@ let
        (assertRange "ERSPANIndex" 1 1048575)
      ];

+      sectionFooOverUDP = checkUnitConfig "FooOverUDP" [
+        (assertOnlyFields [
+          "Port"
+          "Encapsulation"
+          "Protocol"
+        ])
+        (assertPort "Port")
+        (assertValueOneOf "Encapsulation" ["FooOverUDP" "GenericUDPEncapsulation"])
+      ];
+
      sectionPeer = checkUnitConfig "Peer" [
        (assertOnlyFields [
          "Name"
@ -919,6 +929,18 @@ let
      '';
    };

+    fooOverUDPConfig = mkOption {
+      default = { };
+      example = { Port = 9001; };
+      type = types.addCheck (types.attrsOf unitOption) check.netdev.sectionFooOverUDP;
+      description = ''
+        Each attribute in this set specifies an option in the
+        <literal>[FooOverUDP]</literal> section of the unit.  See
+        <citerefentry><refentrytitle>systemd.netdev</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+      '';
+    };
+
    peerConfig = mkOption {
      default = {};
      example = { Name = "veth2"; };
@ -1449,6 +1471,10 @@ let
          [Tunnel]
          ${attrsToSection def.tunnelConfig}
        ''
+        + optionalString (def.fooOverUDPConfig != { }) ''
+          [FooOverUDP]
+          ${attrsToSection def.fooOverUDPConfig}
+        ''
        + optionalString (def.peerConfig != { }) ''
          [Peer]
          ${attrsToSection def.peerConfig}
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@ -466,6 +466,39 @@ let
            '';
          });

+        createFouEncapsulation = n: v: nameValuePair "${n}-fou-encap"
+          (let
+            # if we have a device to bind to we can wait for its addresses to be
+            # configured, otherwise external sequencing is required.
+            deps = optionals (v.local != null && v.local.dev != null)
+              (deviceDependency v.local.dev ++ [ "network-addresses-${v.local.dev}.service" ]);
+            fouSpec = "port ${toString v.port} ${
+              if v.protocol != null then "ipproto ${toString v.protocol}" else "gue"
+            } ${
+              optionalString (v.local != null) "local ${escapeShellArg v.local.address} ${
+                optionalString (v.local.dev != null) "dev ${escapeShellArg v.local.dev}"
+              }"
+            }";
+          in
+          { description = "FOU endpoint ${n}";
+            wantedBy = [ "network-setup.service" (subsystemDevice n) ];
+            bindsTo = deps;
+            partOf = [ "network-setup.service" ];
+            after = [ "network-pre.target" ] ++ deps;
+            before = [ "network-setup.service" ];
+            serviceConfig.Type = "oneshot";
+            serviceConfig.RemainAfterExit = true;
+            path = [ pkgs.iproute2 ];
+            script = ''
+              # always remove previous incarnation since show can't filter
+              ip fou del ${fouSpec} >/dev/null 2>&1 || true
+              ip fou add ${fouSpec}
+            '';
+            postStop = ''
+              ip fou del ${fouSpec} || true
+            '';
+          });
+
        createSitDevice = n: v: nameValuePair "${n}-netdev"
          (let
            deps = deviceDependency v.dev;
@ -486,7 +519,12 @@ let
                ${optionalString (v.remote != null) "remote \"${v.remote}\""} \
                ${optionalString (v.local != null) "local \"${v.local}\""} \
                ${optionalString (v.ttl != null) "ttl ${toString v.ttl}"} \
-                ${optionalString (v.dev != null) "dev \"${v.dev}\""}
+                ${optionalString (v.dev != null) "dev \"${v.dev}\""} \
+                ${optionalString (v.encapsulation != null)
+                  "encap ${v.encapsulation.type} encap-dport ${toString v.encapsulation.port} ${
+                    optionalString (v.encapsulation.sourcePort != null)
+                      "encap-sport ${toString v.encapsulation.sourcePort}"
+                  }"}
              ip link set "${n}" up
            '';
            postStop = ''
@ -530,6 +568,7 @@ let
         // mapAttrs' createVswitchDevice cfg.vswitches
         // mapAttrs' createBondDevice cfg.bonds
         // mapAttrs' createMacvlanDevice cfg.macvlans
+         // mapAttrs' createFouEncapsulation cfg.fooOverUDP
         // mapAttrs' createSitDevice cfg.sits
         // mapAttrs' createVlanDevice cfg.vlans
         // {
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@ -47,6 +47,9 @@ in
    } ] ++ flip mapAttrsToList cfg.bridges (n: { rstp, ... }: {
      assertion = !rstp;
      message = "networking.bridges.${n}.rstp is not supported by networkd.";
+    }) ++ flip mapAttrsToList cfg.fooOverUDP (n: { local, ... }: {
+      assertion = local == null;
+      message = "networking.fooOverUDP.${n}.local is not supported by networkd.";
    });

    networking.dhcpcd.enable = mkDefault false;
@ -194,6 +197,23 @@ in
          macvlan = [ name ];
        } ]);
      })))
+      (mkMerge (flip mapAttrsToList cfg.fooOverUDP (name: fou: {
+        netdevs."40-${name}" = {
+          netdevConfig = {
+            Name = name;
+            Kind = "fou";
+          };
+          # unfortunately networkd cannot encode dependencies of netdevs on addresses/routes,
+          # so we cannot specify Local=, Peer=, PeerPort=. this looks like a missing feature
+          # in networkd.
+          fooOverUDPConfig = {
+            Port = fou.port;
+            Encapsulation = if fou.protocol != null then "FooOverUDP" else "GenericUDPEncapsulation";
+          } // (optionalAttrs (fou.protocol != null) {
+            Protocol = fou.protocol;
+          });
+        };
+      })))
      (mkMerge (flip mapAttrsToList cfg.sits (name: sit: {
        netdevs."40-${name}" = {
          netdevConfig = {
@ -207,7 +227,17 @@ in
              Local = sit.local;
            }) // (optionalAttrs (sit.ttl != null) {
              TTL = sit.ttl;
-            });
+            }) // (optionalAttrs (sit.encapsulation != null) (
+              {
+                FooOverUDP = true;
+                Encapsulation =
+                  if sit.encapsulation.type == "fou"
+                  then "FooOverUDP"
+                  else "GenericUDPEncapsulation";
+                FOUDestinationPort = sit.encapsulation.port;
+              } // (optionalAttrs (sit.encapsulation.sourcePort != null) {
+                FOUSourcePort = sit.encapsulation.sourcePort;
+              })));
        };
        networks = mkIf (sit.dev != null) {
          "40-${sit.dev}" = (mkMerge [ (genericNetwork (mkOverride 999)) {
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -10,6 +10,8 @@ let
  hasVirtuals = any (i: i.virtual) interfaces;
  hasSits = cfg.sits != { };
  hasBonds = cfg.bonds != { };
+  hasFous = cfg.fooOverUDP != { }
+    || filterAttrs (_: s: s.encapsulation != null) cfg.sits != { };

  slaves = concatMap (i: i.interfaces) (attrValues cfg.bonds)
    ++ concatMap (i: i.interfaces) (attrValues cfg.bridges)
@ -823,6 +825,71 @@ in
      });
    };

+    networking.fooOverUDP = mkOption {
+      default = { };
+      example =
+        {
+          primary = { port = 9001; local = { address = "192.0.2.1"; dev = "eth0"; }; };
+          backup =  { port = 9002; };
+        };
+      description = ''
+        This option allows you to configure Foo Over UDP and Generic UDP Encapsulation
+        endpoints. See <citerefentry><refentrytitle>ip-fou</refentrytitle>
+        <manvolnum>8</manvolnum></citerefentry> for details.
+      '';
+      type = with types; attrsOf (submodule {
+        options = {
+          port = mkOption {
+            type = port;
+            description = ''
+              Local port of the encapsulation UDP socket.
+            '';
+          };
+
+          protocol = mkOption {
+            type = nullOr (ints.between 1 255);
+            default = null;
+            description = ''
+              Protocol number of the encapsulated packets. Specifying <literal>null</literal>
+              (the default) creates a GUE endpoint, specifying a protocol number will create
+              a FOU endpoint.
+            '';
+          };
+
+          local = mkOption {
+            type = nullOr (submodule {
+              options = {
+                address = mkOption {
+                  type = types.str;
+                  description = ''
+                    Local address to bind to. The address must be available when the FOU
+                    endpoint is created, using the scripted network setup this can be achieved
+                    either by setting <literal>dev</literal> or adding dependency information to
+                    <literal>systemd.services.&lt;name&gt;-fou-encap</literal>; it isn't supported
+                    when using networkd.
+                  '';
+                };
+
+                dev = mkOption {
+                  type = nullOr str;
+                  default = null;
+                  example = "eth0";
+                  description = ''
+                    Network device to bind to.
+                  '';
+                };
+              };
+            });
+            default = null;
+            example = { address = "203.0.113.22"; };
+            description = ''
+              Local address (and optionally device) to bind to using the given port.
+            '';
+          };
+        };
+      });
+    };
+
    networking.sits = mkOption {
      default = { };
      example = literalExpression ''
@ -882,6 +949,44 @@ in
            '';
          };

+          encapsulation = with types; mkOption {
+            type = nullOr (submodule {
+              options = {
+                type = mkOption {
+                  type = enum [ "fou" "gue" ];
+                  description = ''
+                    Selects encapsulation type. See
+                    <citerefentry><refentrytitle>ip-link</refentrytitle>
+                    <manvolnum>8</manvolnum></citerefentry> for details.
+                  '';
+                };
+
+                port = mkOption {
+                  type = port;
+                  example = 9001;
+                  description = ''
+                    Destination port for encapsulated packets.
+                  '';
+                };
+
+                sourcePort = mkOption {
+                  type = nullOr types.port;
+                  default = null;
+                  example = 9002;
+                  description = ''
+                    Source port for encapsulated packets. Will be chosen automatically by
+                    the kernel if unset.
+                  '';
+                };
+              };
+            });
+            default = null;
+            example = { type = "fou"; port = 9001; };
+            description = ''
+              Configures encapsulation in UDP packets.
+            '';
+          };
+
        };

      });
@ -1116,7 +1221,8 @@ in
    boot.kernelModules = [ ]
      ++ optional hasVirtuals "tun"
      ++ optional hasSits "sit"
-      ++ optional hasBonds "bonding";
+      ++ optional hasBonds "bonding"
+      ++ optional hasFous "fou";

    boot.extraModprobeConfig =
      # This setting is intentional as it prevents default bond devices
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@ -109,6 +109,23 @@ in {
      '';
    };

+    qemuOvmfPackage = mkOption {
+      type = types.package;
+      default = pkgs.OVMF;
+      defaultText = literalExpression "pkgs.OVMF";
+      example = literalExpression "pkgs.OVMFFull";
+      description = ''
+        OVMF package to use.
+      '';
+    };
+    qemuSwtpm = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Allows libvirtd to use swtpm to create an emulated TPM.
+      '';
+    };
+
    extraOptions = mkOption {
      type = types.listOf types.str;
      default = [ ];
@ -161,6 +178,10 @@ in {
        assertion = config.security.polkit.enable;
        message = "The libvirtd module currently requires Polkit to be enabled ('security.polkit.enable = true').";
      }
+      {
+        assertion = builtins.elem "fd" cfg.qemuOvmfPackage.outputs;
+        message = "The option 'virtualisation.libvirtd.qemuOvmfPackage' needs a package that has an 'fd' output.";
+      }
    ];

    environment = {
@ -218,8 +239,8 @@ in {
        done

        ${optionalString cfg.qemuOvmf ''
-          ln -s --force ${pkgs.OVMF.fd}/FV/${ovmfFilePrefix}_CODE.fd /run/${dirName}/nix-ovmf/
-          ln -s --force ${pkgs.OVMF.fd}/FV/${ovmfFilePrefix}_VARS.fd /run/${dirName}/nix-ovmf/
+          ln -s --force ${cfg.qemuOvmfPackage.fd}/FV/${ovmfFilePrefix}_CODE.fd /run/${dirName}/nix-ovmf/
+          ln -s --force ${cfg.qemuOvmfPackage.fd}/FV/${ovmfFilePrefix}_VARS.fd /run/${dirName}/nix-ovmf/
        ''}
      '';

@ -243,7 +264,8 @@ in {
        ] ++ cfg.extraOptions);

      path = [ cfg.qemuPackage ] # libvirtd requires qemu-img to manage disk images
-             ++ optional vswitch.enable vswitch.package;
+             ++ optional vswitch.enable vswitch.package
+             ++ optional cfg.qemuSwtpm pkgs.swtpm;

      serviceConfig = {
        Type = "notify";
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@ -380,12 +380,57 @@ let
              router.wait_until_succeeds("ping -c 1 192.168.1.3")
        '';
    };
+    fou = {
+      name = "foo-over-udp";
+      nodes.machine = { ... }: {
+        virtualisation.vlans = [ 1 ];
+        networking = {
+          useNetworkd = networkd;
+          useDHCP = false;
+          interfaces.eth1.ipv4.addresses = mkOverride 0
+            [ { address = "192.168.1.1"; prefixLength = 24; } ];
+          fooOverUDP = {
+            fou1 = { port = 9001; };
+            fou2 = { port = 9002; protocol = 41; };
+            fou3 = mkIf (!networkd)
+              { port = 9003; local.address = "192.168.1.1"; };
+            fou4 = mkIf (!networkd)
+              { port = 9004; local = { address = "192.168.1.1"; dev = "eth1"; }; };
+          };
+        };
+        systemd.services = {
+          fou3-fou-encap.after = optional (!networkd) "network-addresses-eth1.service";
+        };
+      };
+      testScript = { ... }:
+        ''
+          import json
+
+          machine.wait_for_unit("network.target")
+          fous = json.loads(machine.succeed("ip -json fou show"))
+          assert {"port": 9001, "gue": None, "family": "inet"} in fous, "fou1 exists"
+          assert {"port": 9002, "ipproto": 41, "family": "inet"} in fous, "fou2 exists"
+        '' + optionalString (!networkd) ''
+          assert {
+              "port": 9003,
+              "gue": None,
+              "family": "inet",
+              "local": "192.168.1.1",
+          } in fous, "fou3 exists"
+          assert {
+              "port": 9004,
+              "gue": None,
+              "family": "inet",
+              "local": "192.168.1.1",
+              "dev": "eth1",
+          } in fous, "fou4 exists"
+        '';
+    };
    sit = let
      node = { address4, remote, address6 }: { pkgs, ... }: with pkgs.lib; {
        virtualisation.vlans = [ 1 ];
        networking = {
          useNetworkd = networkd;
-          firewall.enable = false;
          useDHCP = false;
          sits.sit = {
            inherit remote;
@ -400,8 +445,30 @@ let
      };
    in {
      name = "Sit";
-      nodes.client1 = node { address4 = "192.168.1.1"; remote = "192.168.1.2"; address6 = "fc00::1"; };
-      nodes.client2 = node { address4 = "192.168.1.2"; remote = "192.168.1.1"; address6 = "fc00::2"; };
+      # note on firewalling: the two nodes are explicitly asymmetric.
+      # client1 sends SIT packets in UDP, but accepts only proto-41 incoming.
+      # client2 does the reverse, sending in proto-41 and accepting only UDP incoming.
+      # that way we'll notice when either SIT itself or FOU breaks.
+      nodes.client1 = args@{ pkgs, ... }:
+        mkMerge [
+          (node { address4 = "192.168.1.1"; remote = "192.168.1.2"; address6 = "fc00::1"; } args)
+          {
+            networking = {
+              firewall.extraCommands = "iptables -A INPUT -p 41 -j ACCEPT";
+              sits.sit.encapsulation = { type = "fou"; port = 9001; };
+            };
+          }
+        ];
+      nodes.client2 = args@{ pkgs, ... }:
+        mkMerge [
+          (node { address4 = "192.168.1.2"; remote = "192.168.1.1"; address6 = "fc00::2"; } args)
+          {
+            networking = {
+              firewall.allowedUDPPorts = [ 9001 ];
+              fooOverUDP.fou1 = { port = 9001; protocol = 41; };
+            };
+          }
+        ];
      testScript = { ... }:
        ''
          start_all()
--- a/pkgs/applications/audio/mimic/default.nix
+++ b/pkgs/applications/audio/mimic/default.nix
@ -7,9 +7,9 @@ stdenv.mkDerivation rec {
  version = "1.3.0.1";

  src = fetchFromGitHub {
-    rev = version;
-    repo = "mimic1";
    owner = "MycroftAI";
+    repo = "mimic1";
+    rev = version;
    sha256 = "1agwgby9ql8r3x5rd1rgx3xp9y4cdg4pi3kqlz3vanv9na8nf3id";
  };

--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -242,12 +242,12 @@ in

  clion = buildClion rec {
    name = "clion-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "0knl0ca15cj0nggyfhd7s0szxr2vp7xvvp3nna3mplssfn59zf9d"; /* updated by script */
+      sha256 = "09qbzkxyk435s4n04s12ncjyri024wj9pwz8wgjjsswpfa69dhr5"; /* updated by script */
    };
    wmClass = "jetbrains-clion";
    update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@ -255,12 +255,12 @@ in

  datagrip = buildDataGrip rec {
    name = "datagrip-${version}";
-    version = "2021.2.2"; /* updated by script */
+    version = "2021.2.4"; /* updated by script */
    description = "Your Swiss Army Knife for Databases and SQL";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "18dammsvd43x8cx0plzwgankmzfv7j79z0nsdagd540v99c2r2v3"; /* updated by script */
+      sha256 = "1vj9ihzw07bh30ngy8mj027ljq9zzd904k61f8jbfpw75vknh8f6"; /* updated by script */
    };
    wmClass = "jetbrains-datagrip";
    update-channel = "DataGrip RELEASE";
@ -268,12 +268,12 @@ in

  goland = buildGoland rec {
    name = "goland-${version}";
-    version = "2021.2.2"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
    description = "Up and Coming Go IDE";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0ayqvyd24klafm09kls4fdp2acqsvh0zhm4wsrmrshlpmdqd5vjk"; /* updated by script */
+      sha256 = "1n0yrk05xv4pard82b6z349ksiw8k75s9525pnpa2ny1ay1klhdg"; /* updated by script */
    };
    wmClass = "jetbrains-goland";
    update-channel = "GoLand RELEASE";
@ -281,12 +281,12 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "1af43c51ryvqc7c9r3kz2266j0nvz50xw1vhfjbd74c3ycj8a1zz"; /* updated by script */
+      sha256 = "166rhssyizn40rlar7ym7gkwz2aawp58qqvrs60w3cwwvjvb0bjq"; /* updated by script */
    };
    wmClass = "jetbrains-idea-ce";
    update-channel = "IntelliJ IDEA RELEASE";
@ -294,12 +294,12 @@ in

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "1257a9d9h3ybdsnm74jmgzp1rfi1629gv9kr0w2nhmxj7ghhbx4w"; /* updated by script */
+      sha256 = "1d0kk2yydrbzvdy6dy9jqr182panidmbf2hy80gvi5ph2r5rv1qd"; /* updated by script */
    };
    wmClass = "jetbrains-idea";
    update-channel = "IntelliJ IDEA RELEASE";
@ -307,13 +307,13 @@ in

  mps = buildMps rec {
    name = "mps-${version}";
-    version = "2021.1.3"; /* updated by script */
-    versionMajorMinor = "2021.1"; /* updated by script */
+    version = "2021.2.1"; /* updated by script */
+    versionMajorMinor = "2021.2"; /* updated by script */
    description = "Create your own domain-specific language";
    license = lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/mps/${versionMajorMinor}/MPS-${version}.tar.gz";
-      sha256 = "0w1nchaa2d3z3mdp43mvifnbibl1ribyc98dm7grnwvrqk72pabf"; /* updated by script */
+      sha256 = "1yawjc5xwga1mmlsl3068ml532941mq08i9ji3dhj1nwdkyav2jz"; /* updated by script */
    };
    wmClass = "jetbrains-mps";
    update-channel = "MPS RELEASE";
@ -321,12 +321,12 @@ in

  phpstorm = buildPhpStorm rec {
    name = "phpstorm-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
    description = "Professional IDE for Web and PHP developers";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "1iqnq38d71wbl1iqhqr5as1802s53m3220vq4g42mdjgdj296bdk"; /* updated by script */
+      sha256 = "1avcm4fnkn0jkw85s505yz5kjbxzk038463sjdsca04pv5yhsdp0"; /* updated by script */
    };
    wmClass = "jetbrains-phpstorm";
    update-channel = "PhpStorm RELEASE";
@ -334,12 +334,12 @@ in

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.2"; /* updated by script */
    description = "PyCharm Community Edition";
    license = lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1z59yvk3wrqn0c9581vvv62wxf4fyybha426ipyqml8c405z27y4"; /* updated by script */
+      sha256 = "0s9kk3n5ac6lvqi2yw9gvvm45865jchiwyrs8pq2dgdkgaligrjv"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm-ce";
    update-channel = "PyCharm RELEASE";
@ -347,12 +347,12 @@ in

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.2"; /* updated by script */
    description = "PyCharm Professional Edition";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0sh9kdr53dhhq171p9lmsvci3qzlds4vzyqx12mzfvfs7svri1w2"; /* updated by script */
+      sha256 = "0mgmmf926n3ipr8fxn6f9hsa5vkil8yrw5qlixi8nwnx7chmkp56"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm";
    update-channel = "PyCharm RELEASE";
@ -360,12 +360,12 @@ in

  rider = buildRider rec {
    name = "rider-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.2"; /* updated by script */
    description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "1b5ih6q8kyds8px7gldfz1m9ap3kk27yswwxy1735c83094l2nlm"; /* updated by script */
+      sha256 = "17xx8mz3dr5iqlr0lsiy8a6cxz3wp5vg8z955cdv0hf8b5rncqfa"; /* updated by script */
    };
    wmClass = "jetbrains-rider";
    update-channel = "Rider RELEASE";
@ -373,12 +373,12 @@ in

  ruby-mine = buildRubyMine rec {
    name = "ruby-mine-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
    description = "The Most Intelligent Ruby and Rails IDE";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "09blnm6han2rmdvjbr1va081zndzvjr1i0m3njaiwcb9rf2axm32"; /* updated by script */
+      sha256 = "0bbq5ya1dxrgaqqqsc4in4rgv7v292hww3bb0vpzwz6dmc2jly1i"; /* updated by script */
    };
    wmClass = "jetbrains-rubymine";
    update-channel = "RubyMine RELEASE";
@ -386,12 +386,12 @@ in

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.2"; /* updated by script */
    description = "Professional IDE for Web and JavaScript development";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "12i9f5sw02gcgviflfs6gwmnxvzhgmm4v4447am0syl4nq8nyv1s"; /* updated by script */
+      sha256 = "1a3vlqza9nbc4a2qxrzdckmq003zx1db9dy7wx462amc8sbh6v92"; /* updated by script */
    };
    wmClass = "jetbrains-webstorm";
    update-channel = "WebStorm RELEASE";
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -42,7 +42,7 @@ let
  src = fetchFromGitHub {
    owner = "rstudio";
    repo = "rstudio";
-    rev = version;
+    rev = "v${version}";
    sha256 = "sha256-9c1bNsf8kJjpcZ2cMV/pPNtXQkFOntX29a1cdnXpllE=";
  };

--- a/pkgs/applications/misc/zettlr/default.nix
+++ b/pkgs/applications/misc/zettlr/default.nix
@ -10,11 +10,11 @@
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
 let
  pname = "zettlr";
-  version = "1.8.9";
+  version = "2.0.0";
  name = "${pname}-${version}";
  src = fetchurl {
    url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
-    sha256 = "sha256-1cU9HdPXrJ4ibSjOitO8iJfMIaGub/jjlb2lssYFfcU=";
+    sha256 = "sha256-MIFgNUuuneIIkPRVRarbx6UMoB/3sdJtKvbacUnwHX8=";
  };
  appimageContents = appimageTools.extractType2 {
    inherit name src;
--- a/pkgs/applications/networking/cluster/kn/default.nix
+++ b/pkgs/applications/networking/cluster/kn/default.nix
@ -0,0 +1,44 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "kn";
+  version = "0.26.0";
+
+  src = fetchFromGitHub {
+    owner = "knative";
+    repo = "client";
+    rev = "v${version}";
+    sha256 = "sha256-hquxv1BluR535WvMtJlVyP7JuARDNGDjPAbdSSj2juo=";
+  };
+
+  vendorSha256 = null;
+
+  subPackages = [ "cmd/kn" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-X knative.dev/client/pkg/kn/commands/version.Version=v${version}"
+    "-X knative.dev/client/pkg/kn/commands/version.VersionEventing=v${version}"
+    "-X knative.dev/client/pkg/kn/commands/version.VersionServing=v${version}"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd kn \
+      --bash <($out/bin/kn completion bash) \
+      --zsh <($out/bin/kn completion zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/kn version | grep ${version} > /dev/null
+  '';
+
+  meta = with lib; {
+    description = "The Knative client kn is your door to the Knative world. It allows you to create Knative resources interactively from the command line or from within scripts";
+    homepage = "https://github.com/knative/client";
+    changelog = "https://github.com/knative/client/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bryanasdev000 ];
+  };
+}
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.33.0";
+  version = "0.35.1";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-FvgB0jG6PEvhrT9Au/Uv9XSgKx+zNw8zETpg2dJ6QX4=";
+    sha256 = "sha256-DCum3vCrN530Z0VW0WEoLtjN+kre/mU9O+sJxckZgfc=";
  };

  vendorSha256 = "sha256-y84EFmoJS4SeA5YFIVFU0iWa5NnjU5yvOj7OFE+jGN0=";
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -23,7 +23,7 @@ let
      --set LC_MESSAGES "${spellcheckerLanguage}"'');
 in stdenv.mkDerivation rec {
  pname = "signal-desktop";
-  version = "5.19.0"; # Please backport all updates to the stable channel.
+  version = "5.20.0"; # Please backport all updates to the stable channel.
  # All releases have a limited lifetime and "expire" 90 days after the release.
  # When releases "expire" the application becomes unusable until an update is
  # applied. The expiration date for the current release can be extracted with:
@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0avns5axcfs8x9sv7hyjxi1cr7gag00avfj0h99wgn251b313g1a";
+    sha256 = "0a57gajxjqkp7zcmjc3iiys06b7v53nd81gkwrsfn2gmshihlzkd";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/mailreaders/meli/default.nix
+++ b/pkgs/applications/networking/mailreaders/meli/default.nix
@ -15,15 +15,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "meli";
-  version = "alpha-0.7.1";
+  version = "alpha-0.7.2";

  src = fetchgit {
    url = "https://git.meli.delivery/meli/meli.git";
    rev = version;
-    sha256 = "00iai2z5zydx9bw0ii0n6d7zwm5rrkj03b4ymic0ybwjahqzvyfq";
+    sha256 = "sha256-cbigEJhX6vL+gHa40cxplmPsDhsqujkzQxe0Dr6+SK0=";
  };

-  cargoSha256 = "1r54a51j91iv0ziasjygzw30vqqvqibcnwnkih5xv0ijbaly61n0";
+  cargoSha256 = "sha256-ZE653OtXyZ9454bKPApmuL2kVko/hGBWEAya1L1KIoc=";

  cargoBuildFlags = lib.optional withNotmuch "--features=notmuch";

--- a/pkgs/applications/video/clapper/default.nix
+++ b/pkgs/applications/video/clapper/default.nix
@ -18,6 +18,8 @@
 , gtk4
 , gst_all_1
 , libadwaita
+, appstream-glib
+, libsoup
 }:

 stdenv.mkDerivation rec {
@ -32,6 +34,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
+    appstream-glib
    desktop-file-utils # for update-desktop-database
    glib
    gobject-introspection
@ -53,6 +56,7 @@ stdenv.mkDerivation rec {
    gst_all_1.gst-plugins-ugly
    gtk4
    libadwaita
+    libsoup
    wayland
    wayland-protocols
  ];
--- a/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome/core/epiphany/default.nix
@ -47,9 +47,11 @@ stdenv.mkDerivation rec {
  };

  patches = lib.optionals withPantheon [
+    # Make this respect dark mode settings from Pantheon
    # https://github.com/elementary/browser
-    ./dark-style.patch
-    ./navigation-buttons.patch
+    # The patch currently differs from upstream (updated for epiphany 40 and 41).
+    ./pantheon-dark-style.patch
+    ./pantheon-navigation-buttons.patch
  ];

  nativeBuildInputs = [
@ -95,7 +97,9 @@ stdenv.mkDerivation rec {
    p11-kit
    sqlite
    webkitgtk
-  ] ++ lib.optional withPantheon pantheon.granite;
+  ] ++ lib.optionals withPantheon [
+    pantheon.granite
+  ];

  # Tests need an X display
  mesonFlags = [
--- a/pkgs/desktops/gnome/core/epiphany/pantheon-dark-style.patch
+++ b/pkgs/desktops/gnome/core/epiphany/pantheon-dark-style.patch
--- a/pkgs/desktops/gnome/core/epiphany/pantheon-navigation-buttons.patch
+++ b/pkgs/desktops/gnome/core/epiphany/pantheon-navigation-buttons.patch
--- a/pkgs/desktops/gnome/core/evince/default.nix
+++ b/pkgs/desktops/gnome/core/evince/default.nix
@ -30,6 +30,7 @@
 , gsettings-desktop-schemas
 , gnome-desktop
 , dbus
+, pantheon
 , python3
 , texlive
 , t1lib
@ -40,6 +41,7 @@
 , supportMultimedia ? true # PDF multimedia
 , libgxps
 , supportXPS ? true # Open XML Paper Specification via libgxps
+, withPantheon ? false
 }:

 stdenv.mkDerivation rec {
@ -53,6 +55,13 @@ stdenv.mkDerivation rec {
    sha256 = "lautDW/urJVg2zq4C6fF6rsf3xyg47PJMzmvBUU6JNg=";
  };

+  patches = lib.optionals withPantheon [
+    # Make this respect dark mode settings from Pantheon
+    # https://github.com/elementary/evince
+    # The patch currently differs from upstream (updated for evince 41).
+    ./pantheon-dark-style.patch
+  ];
+
  postPatch = ''
    chmod +x meson_post_install.py
    patchShebangs meson_post_install.py
@ -96,9 +105,18 @@ stdenv.mkDerivation rec {
    poppler
    t1lib
    texlive.bin.core # kpathsea for DVI support
-  ] ++ lib.optional supportXPS libgxps
-    ++ lib.optionals supportMultimedia (with gst_all_1; [
-      gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav ]);
+  ] ++ lib.optionals supportXPS [
+    libgxps
+  ] ++ lib.optionals supportMultimedia (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-bad
+    gst-plugins-ugly
+    gst-libav
+  ]) ++ lib.optionals withPantheon [
+    pantheon.granite
+  ];

  mesonFlags = [
    "-Dnautilus=false"
@ -128,8 +146,8 @@ stdenv.mkDerivation rec {
      on the GNOME Desktop with a single simple application.
    '';

-    license = lib.licenses.gpl2Plus;
+    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = teams.gnome.members;
+    maintainers = teams.gnome.members ++ teams.pantheon.members;
  };
 }
--- a/pkgs/desktops/gnome/core/evince/pantheon-dark-style.patch
+++ b/pkgs/desktops/gnome/core/evince/pantheon-dark-style.patch
@ -0,0 +1,86 @@
+diff --git a/meson.build b/meson.build
+index bcb69cf7..4a18c08c 100644
+--- a/meson.build
+++ b/meson.build
+@@ -162,6 +162,7 @@ gmodule_dep = dependency('gmodule-2.0')
+ gmodule_no_export_dep = dependency('gmodule-no-export-2.0', version: glib_req_version)
+ gtk_dep = dependency('gtk+-3.0', version: gtk_req_version)
+ gthread_dep = dependency('gthread-2.0', version: glib_req_version)
+granite_dep = dependency('granite')
+ # Keep the version here synchronised with subprojects/libhandy.wrap
+ hdy_dep = dependency('libhandy-1', version: hdy_req_version, fallback: ['libhandy', 'libhandy_dep'])
+ 
+diff --git a/shell/ev-application.c b/shell/ev-application.c
+index e704bda2..d705328c 100644
+--- a/shell/ev-application.c
+++ b/shell/ev-application.c
+@@ -30,6 +30,7 @@
+ #include <glib/gi18n.h>
+ #include <glib/gstdio.h>
+ #include <gtk/gtk.h>
+#include <granite.h>
+ #include <handy.h>
+ #ifdef GDK_WINDOWING_X11
+ #include <gdk/gdkx.h>
+@@ -176,7 +177,7 @@ ev_spawn (const char     *uri,
+ 
+ 	g_string_append_printf (cmd, " %s", path);
+ 	g_free (path);
+-	
+
+ 	/* Page label */
+ 	if (dest) {
+                 switch (ev_link_dest_get_dest_type (dest)) {
+@@ -940,6 +941,20 @@ ev_application_migrate_config_dir (EvApplication *application)
+         g_free (old_accels);
+ }
+ 
+static void
+ev_application_set_prefers_color_scheme ()
+{
+        GtkSettings* gtk_settings = gtk_settings_get_default ();
+        GraniteSettings* granite_settings = granite_settings_get_default ();
+
+        g_object_set (
+          gtk_settings,
+          "gtk-application-prefer-dark-theme",
+          granite_settings_get_prefers_color_scheme (granite_settings) == GRANITE_SETTINGS_COLOR_SCHEME_DARK,
+          NULL
+        );
+}
+
+ static void
+ ev_application_startup (GApplication *gapplication)
+ {
+@@ -992,6 +1007,7 @@ ev_application_startup (GApplication *gapplication)
+ 
+         EvApplication *application = EV_APPLICATION (gapplication);
+         const gchar **it;
+        GraniteSettings* granite_settings = granite_settings_get_default ();
+ 
+ 	g_application_set_resource_base_path (gapplication, "/org/gnome/evince");
+ 
+@@ -999,6 +1015,11 @@ ev_application_startup (GApplication *gapplication)
+ 
+         hdy_init ();
+ 
+        ev_application_set_prefers_color_scheme ();
+
+        g_signal_connect (granite_settings, "notify::prefers-color-scheme",
+          G_CALLBACK(ev_application_set_prefers_color_scheme), NULL);
+
+         for (it = action_accels; it[0]; it += g_strv_length ((gchar **)it) + 1)
+                 gtk_application_set_accels_for_action (GTK_APPLICATION (application), it[0], &it[1]);
+ }
+diff --git a/shell/meson.build b/shell/meson.build
+index 7cbc48f2..a3089b13 100644
+--- a/shell/meson.build
+++ b/shell/meson.build
+@@ -52,6 +52,7 @@ sources += gnome.compile_resources(
+ deps = [
+   gdk_pixbuf_dep,
+   gnome_desktop_dep,
+  granite_dep,
+   hdy_dep,
+   libevmisc_dep,
+   libevproperties_dep,
--- a/pkgs/desktops/gnome/misc/pomodoro/default.nix
+++ b/pkgs/desktops/gnome/misc/pomodoro/default.nix
@ -1,9 +1,13 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, autoconf-archive
-, appstream-glib
+, substituteAll
+, fetchpatch
+, meson
+, ninja
 , pkg-config
 , wrapGAppsHook
+, desktop-file-utils
 , libcanberra
 , gst_all_1
 , vala
@ -11,43 +15,54 @@
 , gom
 , sqlite
 , libxml2
-, autoreconfHook
 , glib
 , gobject-introspection
 , libpeas
-, gnome-shell
 , gsettings-desktop-schemas
-, adwaita-icon-theme
 , gettext
 }:

 stdenv.mkDerivation rec {
  pname = "gnome-shell-pomodoro";
-  version = "0.19.1";
+  version = "0.20.0";

  src = fetchFromGitHub {
-    owner = "codito";
+    owner = "gnome-pomodoro";
    repo = "gnome-pomodoro";
    rev = version;
-    sha256 = "sha256-im66QUzz6PcX0vkf4cN57ttRLB4KKPFky1pwUa4V7kQ=";
+    sha256 = "sha256-USzLHoBM0QbBPtbTzJJY02cOSDtmlxPGYhMj7M1FJic=";
  };

+  patches = [
+    # Our glib setup hooks moves GSettings schemas to a subdirectory to prevent conflicts.
+    # We need to patch the build script so that the extension can find them.
+    (substituteAll {
+      src = ./fix-schema-path.patch;
+      inherit pname version;
+    })
+
+    # Fix error reporting code.
+    # https://github.com/gnome-pomodoro/gnome-pomodoro/pull/591
+    (fetchpatch {
+      url = "https://github.com/gnome-pomodoro/gnome-pomodoro/commit/133bd62f15653856d9705b66188b42c20d81719e.patch";
+      sha256 = "A20K+57A6/lYH2Buri2+wrCQgz6EGBdYg2xQbHPSkYc=";
+    })
+  ];
+
  nativeBuildInputs = [
-    appstream-glib
-    autoconf-archive
-    autoreconfHook
+    meson
+    ninja
    gettext
    gobject-introspection
    libxml2
    pkg-config
    vala
    wrapGAppsHook
+    desktop-file-utils
  ];

  buildInputs = [
-    adwaita-icon-theme
    glib
-    gnome-shell
    gom
    gsettings-desktop-schemas
    gst_all_1.gst-plugins-base
--- a/pkgs/desktops/gnome/misc/pomodoro/fix-schema-path.patch
+++ b/pkgs/desktops/gnome/misc/pomodoro/fix-schema-path.patch
@ -0,0 +1,40 @@
+diff --git a/data/meson.build b/data/meson.build
+index 5e4ce69..982b3c9 100644
+--- a/data/meson.build
+++ b/data/meson.build
+@@ -31,7 +31,7 @@ i18n.merge_file(
+ 
+ install_data(
+   'org.gnome.pomodoro.gschema.xml',
+-  install_dir: get_option('datadir') / 'glib-2.0' / 'schemas',
+  install_dir: gschema_dir,
+ )
+ 
+ subdir('icons')
+diff --git a/meson-post-install.sh b/meson-post-install.sh
+index bf4013a..c87fba4 100644
+--- a/meson-post-install.sh
+++ b/meson-post-install.sh
+@@ -7,7 +7,7 @@ datadir="${prefix}/$1"
+ # want/need us to do the below
+ if [ -z "${DESTDIR}" ]; then
+     echo "Compiling GSchema..."
+-    glib-compile-schemas "${datadir}/glib-2.0/schemas"
+    glib-compile-schemas "${datadir}/gsettings-schemas/@pname@-@version@/glib-2.0/schemas"
+ 
+     echo "Updating icon cache..."
+     gtk-update-icon-cache -f -t "${datadir}/icons/hicolor"
+diff --git a/meson.build b/meson.build
+index 09857a1..a07d27c 100644
+--- a/meson.build
+++ b/meson.build
+@@ -40,7 +40,8 @@ add_project_arguments(
+ )
+ 
+ # We are going to use these variables later on for the plugins
+-gschema_dir = get_option('prefix') / get_option('datadir') / 'glib-2.0' / 'schemas'
+nix_package_name = '@pname@' + '-' + '@version@'
+gschema_dir = get_option('prefix') / get_option('datadir') / 'gsettings-schemas' / nix_package_name / 'glib-2.0' / 'schemas'
+ plugin_libdir = get_option('prefix') / get_option('libdir') / meson.project_name() / 'plugins'
+ extension_dir = get_option('prefix') / get_option('datadir') / 'gnome-shell' / 'extensions' / 'pomodoro@arun.codito.in'
+ 
--- a/pkgs/desktops/pantheon/default.nix
+++ b/pkgs/desktops/pantheon/default.nix
@ -71,6 +71,8 @@ lib.makeScope pkgs.newScope (self: with self; {

  epiphany = pkgs.epiphany.override { withPantheon = true; };

+  evince = pkgs.evince.override { withPantheon = true; };
+
  sideload = callPackage ./apps/sideload { };

  #### DESKTOP
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@ -19,12 +19,15 @@ stdenv.mkDerivation rec {
  '';

  configureFlags = [
-    "--cc=cc"
+    "--cc=$CC"
+    "--ar=$AR"
    "--crtprefix=${lib.getLib stdenv.cc.libc}/lib"
    "--sysincludepaths=${lib.getDev stdenv.cc.libc}/include:{B}/include"
    "--libpaths=${lib.getLib stdenv.cc.libc}/lib"
    # build cross compilers
    "--enable-cross"
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    "--config-musl"
  ];

  preConfigure = ''
--- a/pkgs/development/embedded/fpga/trellis/default.nix
+++ b/pkgs/development/embedded/fpga/trellis/default.nix
@ -31,6 +31,8 @@ in stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake python3 ];
  cmakeFlags = [
    "-DCURRENT_GIT_VERSION=${realVersion}"
+    # TODO: should this be in stdenv instead?
+    "-DCMAKE_INSTALL_DATADIR=${placeholder "out"}/share"
  ];

  preConfigure = ''
@ -39,6 +41,12 @@ in stdenv.mkDerivation rec {
    cd libtrellis
  '';

+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    $out/bin/ecppack $out/share/trellis/misc/basecfgs/empty_lfe5u-85f.config /tmp/test.bin
+  '';
+
  meta = with lib; {
    description     = "Documentation and bitstream tools for Lattice ECP5 FPGAs";
    longDescription = ''
@ -49,7 +57,7 @@ in stdenv.mkDerivation rec {
    '';
    homepage    = "https://github.com/YosysHQ/prjtrellis";
    license     = licenses.isc;
-    maintainers = with maintainers; [ q3k thoughtpolice emily ];
+    maintainers = with maintainers; [ q3k thoughtpolice emily rowanG077 ];
    platforms   = platforms.all;
  };
 }
--- a/pkgs/development/interpreters/bqn/dzaima-bqn/default.nix
+++ b/pkgs/development/interpreters/bqn/dzaima-bqn/default.nix
@ -8,31 +8,34 @@

 stdenv.mkDerivation rec {
  pname = "dbqn" + lib.optionalString buildNativeImage "-native";
-  version = "0.pre+unstable=2021-10-05";
+  version = "0.pre+date=2021-10-08";

  src = fetchFromGitHub {
    owner = "dzaima";
    repo = "BQN";
-    rev = "c31ceef52bbf380e747723f5ffd09c5f006b21c5";
-    sha256 = "1nzqgwpjawcky85mfrz5izs9lfb3aqlm96dc8syrxhgg20xrziwx";
+    rev = "0001109a1c5a420421b368c79d34b1e93bfe606e";
+    hash = "sha256-riHHclTLkrVbtzmcz9ungAIc7kaoFHS77+SNatsfNhc=";
  };

  nativeBuildInputs = [
-    makeWrapper
    jdk
+    makeWrapper
  ];

  dontConfigure = true;

+  postPatch = ''
+    patchShebangs --build ./build8
+  '';
+
  buildPhase = ''
    runHook preBuild

-    patchShebangs --build ./build8
    ./build8
  '' + lib.optionalString buildNativeImage ''
    native-image --report-unsupported-elements-at-runtime \
-      -H:CLibraryPath=${lib.getLib jdk}/lib \
-      -J-Dfile.encoding=UTF-8 -jar BQN.jar dbqn
+      -H:CLibraryPath=${lib.getLib jdk}/lib -J-Dfile.encoding=UTF-8 \
+      -jar BQN.jar dbqn
  '' + ''
    runHook postBuild
  '';
--- a/pkgs/development/interpreters/dzaima-apl/default.nix
+++ b/pkgs/development/interpreters/dzaima-apl/default.nix
@ -8,32 +8,34 @@

 stdenv.mkDerivation rec {
  pname = "dapl" + lib.optionalString buildNativeImage "-native";
-  version = "0.2.0+unstable=2021-06-30";
+  version = "0.2.0+date=2021-10-16";

  src = fetchFromGitHub {
    owner = "dzaima";
    repo = "APL";
-    rev = "28b3667beb23c6472266bb2b6eb701708fa421c6";
-    hash = "sha256-2kM9XDMclxJNOZngwLvoDQG23UZQQ6ePK/j215UumCg=";
+    rev = "5eb0a4205e27afa6122096a25008474eec562dc0";
+    hash = "sha256-UdumMytqT909JRpNqzhYPuKPw644m/vRUsEbIVF2a7U=";
  };

  nativeBuildInputs = [
-    makeWrapper
    jdk
+    makeWrapper
  ];

  dontConfigure = true;

+  postPatch = ''
+    patchShebangs --build ./build
+  '';
+
  buildPhase = ''
    runHook preBuild

-    patchShebangs --build ./build
-    substituteInPlace ./build \
-      --replace "javac" "javac -encoding utf8"
    ./build
  '' + lib.optionalString buildNativeImage ''
    native-image --report-unsupported-elements-at-runtime \
-      -H:CLibraryPath=${lib.getLib jdk}/lib -jar APL.jar dapl
+      -H:CLibraryPath=${lib.getLib jdk}/lib -J-Dfile.encoding=UTF-8 \
+      -jar APL.jar dapl
  '' + ''
    runHook postBuild
  '';
--- a/pkgs/development/interpreters/gnudatalanguage/default.nix
+++ b/pkgs/development/interpreters/gnudatalanguage/default.nix
@ -0,0 +1,203 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, wrapGAppsHook
+, readline
+, ncurses
+, zlib
+, gsl
+, openmp
+, graphicsmagick
+, fftw
+, fftwFloat
+, fftwLongDouble
+, proj
+, shapelib
+, expat
+, udunits
+, eigen
+, pslib
+, eccodes
+, glpk
+, libpng
+, plplot
+, libtiff
+, libgeotiff
+, libjpeg
+  # We enable it in hdf4 and use libtirpc as a dependency here from the passthru
+  # of hdf4
+, enableLibtirpc ? stdenv.isLinux
+, libtirpc
+, python3
+, enableMPI ? (stdenv.isLinux || stdenv.isDarwin)
+  # Choose MPICH over OpenMPI because it currently builds on AArch and Darwin
+, mpi
+  # Unfree optional dependency for hdf4 and hdf5
+, enableSzip ? false
+, szip
+, enableHDF4 ? true
+, hdf4
+, hdf4-forced ? null
+, enableHDF5 ? true
+  # HDF5 format version (API version) 1.10 and 1.12 is not fully compatible
+  # Specify if the API version should default to 1.10
+  # netcdf currently depends on hdf5 with `usev110Api=true`
+  # If you wish to use HDF5 API version 1.12 (`useHdf5v110Api=false`),
+  # you will need to turn NetCDF off.
+, useHdf5v110Api ? true
+, hdf5
+, hdf5-forced ? null
+, enableNetCDF ? true
+, netcdf
+, netcdf-forced ? null
+, plplot-forced ? null
+  # wxWidgets is preferred over X11 for this project but we only have it on Linux
+  # and Darwin. Also, we use the wxWidgets dependency here from the passthru of
+  # plplot.
+, enableWX ? (stdenv.isLinux || stdenv.isDarwin)
+  # X11: OFF by default for platform consistency. Use X where WX is not available
+, enableXWin ? (!stdenv.isLinux && !stdenv.isDarwin)
+}:
+
+let
+  hdf4-custom =
+    if hdf4-forced != null
+    then hdf4-forced
+    else
+      hdf4.override {
+        uselibtirpc = enableLibtirpc;
+        szipSupport = enableSzip;
+        inherit szip;
+      };
+  hdf5-custom =
+    if hdf5-forced != null
+    then hdf5-forced
+    else
+      hdf5.override {
+        usev110Api = useHdf5v110Api;
+        mpiSupport = enableMPI;
+        inherit mpi;
+        szipSupport = enableSzip;
+        inherit szip;
+      };
+  netcdf-custom =
+    if netcdf-forced != null
+    then netcdf-forced
+    else
+      netcdf.override {
+        hdf5 = hdf5-custom;
+      };
+  enablePlplotDrivers = enableWX || enableXWin;
+  plplot-with-drivers =
+    if plplot-forced != null
+    then plplot-forced
+    else
+      plplot.override {
+        inherit
+          enableWX
+          enableXWin
+          ;
+      };
+in
+stdenv.mkDerivation rec {
+  pname = "gnudatalanguage";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = "gdl";
+    rev = "v${version}";
+    sha256 = "sha256-Y9LVRaWjQqpWqjNngxB406PE/rl/9S8rs0u0CK5ivUA=";
+  };
+
+  buildInputs = [
+    readline
+    ncurses
+    zlib
+    gsl
+    openmp
+    graphicsmagick
+    fftw
+    fftwFloat
+    fftwLongDouble
+    proj
+    shapelib
+    expat
+    mpi
+    udunits
+    eigen
+    pslib
+    eccodes
+    glpk
+    libpng
+    libtiff
+    libgeotiff
+    libjpeg
+    hdf4-custom
+    hdf5-custom
+    netcdf-custom
+    plplot-with-drivers
+  ] ++ lib.optional enableXWin plplot-with-drivers.libX11
+  ++ lib.optional enableWX plplot-with-drivers.wxWidgets
+  ++ lib.optional enableMPI mpi
+  ++ lib.optional enableLibtirpc hdf4-custom.libtirpc
+  ++ lib.optional enableSzip szip;
+
+  propagatedBuildInputs = [
+    (python3.withPackages (ps: with ps; [ numpy ]))
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ] ++ lib.optional enableWX wrapGAppsHook;
+
+  cmakeFlags = lib.optional (!enableHDF4) "-DHDF=OFF"
+    ++ [ (if enableHDF5 then "-DHDF5DIR=${hdf5-custom}" else "-DHDF5=OFF") ]
+    ++ lib.optional (!enableNetCDF) "-DNETCDF=OFF"
+    ++ lib.optional (!enablePlplotDrivers) "-DINTERACTIVE_GRAPHICS=OFF"
+    ++ lib.optional (!enableWX) "-DWXWIDGETS=OFF"
+    ++ lib.optional enableSzip "-DSZIPDIR=${szip}"
+    ++ lib.optionals enableXWin [ "-DX11=ON" "-DX11DIR=${plplot-with-drivers.libX11}" ]
+    ++ lib.optionals enableMPI [ "-DMPI=ON" "-DMPIDIR=${mpi}" ];
+
+  doCheck = true;
+
+  # Opt-out unstable tests
+  # https://github.com/gnudatalanguage/gdl/issues/482
+  # https://github.com/gnudatalanguage/gdl/issues/1079
+  # https://github.com/gnudatalanguage/gdl/issues/460
+  preCheck = ''
+    checkFlagsArray+=("ARGS=-E 'test_tic_toc.pro|test_byte_conversion.pro|test_bytscl.pro|test_call_external.pro'")
+  '';
+
+  passthru = {
+    hdf4 = hdf4-custom;
+    hdf5 = hdf5-custom;
+    netcdf = netcdf-custom;
+    plplot = plplot-with-drivers;
+    python = python3;
+    inherit
+      enableMPI
+      mpi
+      useHdf5v110Api
+      enableSzip
+      enableWX
+      enableXWin
+      ;
+  };
+
+  meta = with lib; {
+    description = "Free incremental compiler of IDL";
+    longDescription = ''
+      GDL (GNU Data Language) is a free/libre/open source incremental compiler
+      compatible with IDL (Interactive Data Language) and to some extent with PV-WAVE.
+      GDL is aimed as a drop-in replacement for IDL.
+    '';
+    homepage = "https://github.com/gnudatalanguage/gdl";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ ShamrockLee ];
+    platforms = platforms.all;
+    mainProgram = "gdl";
+  };
+}
--- a/pkgs/development/libraries/aml/default.nix
+++ b/pkgs/development/libraries/aml/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "aml";
-  version = "0.2.0";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "any1";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0mxmzlhiv88hm4sf8kyawyrml8qy1xis019hdyb5skl9g95z9yyf";
+    sha256 = "1m911n3rd41ch4yk3k9k1lz29xp3h54k6jx122abq5kmngy9znqw";
  };

  nativeBuildInputs = [ meson pkg-config ninja ];
--- a/pkgs/development/libraries/flatpak/bubblewrap-paths.patch
+++ b/pkgs/development/libraries/flatpak/bubblewrap-paths.patch
@ -7,7 +7,7 @@ index 9e885070..d02eeb8c 100644
             "--unshare-net",
             "--unshare-pid",
 -            "--ro-bind", "/usr", "/usr",
-            "--ro-bind", "/etc/ld.so.cache", "/etc/ld.so.cache",
+-            "--ro-bind-try", "/etc/ld.so.cache", "/etc/ld.so.cache",
 +            "--ro-bind", "@storeDir@", "@storeDir@",
 +            "--ro-bind", "/run/current-system", "/run/current-system",
             "--ro-bind", validate_icon, validate_icon,
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@ -49,18 +49,19 @@
 , dconf
 , gsettings-desktop-schemas
 , librsvg
+, makeWrapper
 }:

 stdenv.mkDerivation rec {
  pname = "flatpak";
-  version = "1.10.2";
+  version = "1.12.2";

  # TODO: split out lib once we figure out what to do with triggerdir
  outputs = [ "out" "dev" "man" "doc" "devdoc" "installedTests" ];

  src = fetchurl {
    url = "https://github.com/flatpak/flatpak/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-2xUnOdBy+P8pnk6IjYljobRTjaexDguGUlvkOPLh3eQ=";
+    sha256 = "df1eb464f9142c11627f99f04f6a5c02c868bbb145489b8902cb6c105e774b75"; # Taken from https://github.com/flatpak/flatpak/releases/
  };

  patches = [
@ -90,25 +91,19 @@ stdenv.mkDerivation rec {
    # Patch taken from gtk-doc expression.
    ./respect-xml-catalog-files-var.patch

-    # Don’t hardcode flatpak binary path in launchers stored under user’s profile otherwise they will break after Flatpak update.
-    # https://github.com/NixOS/nixpkgs/issues/43581
-    ./use-flatpak-from-path.patch
-
-    # Hardcode flatpak binary path for flatpak-spawn.
-    # When calling the portal’s Spawn command with FLATPAK_SPAWN_FLAGS_CLEAR_ENV flag,
-    # it will clear environment, including PATH, making the flatpak run fail.
-    # https://github.com/flatpak/flatpak/pull/4174
-    (fetchpatch {
-      url = "https://github.com/flatpak/flatpak/commit/495449daf6d3c072519a36c9e4bc6cc1da4d31db.patch";
-      sha256 = "gOX/sGupAE7Yg3MVrMhFXzWHpFn+izVyjtkuPzIckuY=";
-    })
-
    # Nix environment hacks should not leak into the apps.
    # https://github.com/NixOS/nixpkgs/issues/53441
    ./unset-env-vars.patch

    # But we want the GDK_PIXBUF_MODULE_FILE from the wrapper affect the icon validator.
    ./validate-icon-pixbuf.patch
+
+    # Tests don't respect the FLATPAK_BINARY override that was added, this is a workaround.
+    # https://github.com/flatpak/flatpak/pull/4496 (Can be removed once included).
+    (fetchpatch {
+      url = "https://github.com/flatpak/flatpak/commit/96dbe28cfa96e80b23fa1d8072eb36edad41279c.patch";
+      sha256 = "1jczk06ymfs98h3nsg245g0jwxvml7wg2x6pb7mrfpsdmrpz2czd";
+    })
  ];

  nativeBuildInputs = [
@ -189,7 +184,14 @@ stdenv.mkDerivation rec {
  in ''
    patchShebangs buildutil
    patchShebangs tests
-    PATH=${lib.makeBinPath [vsc-py]}:$PATH patchShebangs --build variant-schema-compiler/variant-schema-compiler
+    PATH=${lib.makeBinPath [vsc-py]}:$PATH patchShebangs --build subprojects/variant-schema-compiler/variant-schema-compiler
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # Use flatpak from PATH in exported assets (e.g. desktop files).
+      --set FLATPAK_BINARY flatpak
+    )
  '';

  passthru = {
--- a/pkgs/development/libraries/flatpak/use-flatpak-from-path.patch
+++ b/pkgs/development/libraries/flatpak/use-flatpak-from-path.patch
@ -1,50 +0,0 @@
-diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
-index 52b222ea..9489441f 100644
--- a/common/flatpak-dir.c
-+++ b/common/flatpak-dir.c
-@@ -6956,7 +6956,7 @@ export_desktop_file (const char         *app,
- 
-       new_exec = g_string_new ("");
-       g_string_append_printf (new_exec,
-                              FLATPAK_BINDIR "/flatpak run --branch=%s --arch=%s",
-+                              "flatpak run --branch=%s --arch=%s",
-                               escaped_branch,
-                               escaped_arch);
- 
-@@ -8290,8 +8290,8 @@ flatpak_dir_deploy (FlatpakDir          *self,
-                                        error))
-         return FALSE;
- 
-      bin_data = g_strdup_printf ("#!/bin/sh\nexec %s/flatpak run --branch=%s --arch=%s %s \"$@\"\n",
-                                  FLATPAK_BINDIR, escaped_branch, escaped_arch, escaped_app);
-+      bin_data = g_strdup_printf ("#!/bin/sh\nexec flatpak run --branch=%s --arch=%s %s \"$@\"\n",
-+                                  escaped_branch, escaped_arch, escaped_app);
-       if (!g_file_replace_contents (wrapper, bin_data, strlen (bin_data), NULL, FALSE,
-                                     G_FILE_CREATE_REPLACE_DESTINATION, NULL, cancellable, error))
-         return FALSE;
-diff --git a/tests/test-bundle.sh b/tests/test-bundle.sh
-index d1682344..5e2b9a97 100755
--- a/tests/test-bundle.sh
-+++ b/tests/test-bundle.sh
-@@ -67,7 +67,7 @@ assert_has_dir $FL_DIR/app/org.test.Hello/$ARCH/master/active/files
- assert_has_dir $FL_DIR/app/org.test.Hello/$ARCH/master/active/export
- assert_has_file $FL_DIR/exports/share/applications/org.test.Hello.desktop
- # Ensure Exec key is rewritten
-assert_file_has_content $FL_DIR/exports/share/applications/org.test.Hello.desktop "^Exec=.*/flatpak run --branch=master --arch=$ARCH --command=hello\.sh org\.test\.Hello$"
-+assert_file_has_content $FL_DIR/exports/share/applications/org.test.Hello.desktop "^Exec=flatpak run --branch=master --arch=$ARCH --command=hello\.sh org\.test\.Hello$"
- assert_has_file $FL_DIR/exports/share/icons/hicolor/64x64/apps/org.test.Hello.png
- assert_has_file $FL_DIR/exports/share/icons/HighContrast/64x64/apps/org.test.Hello.png
- 
-diff --git a/tests/test-run.sh b/tests/test-run.sh
-index fecb756e..64043281 100644
--- a/tests/test-run.sh
-+++ b/tests/test-run.sh
-@@ -45,7 +45,7 @@ assert_has_dir $FL_DIR/app/org.test.Hello/$ARCH/stable/active/files
- assert_has_dir $FL_DIR/app/org.test.Hello/$ARCH/stable/active/export
- assert_has_file $FL_DIR/exports/share/applications/org.test.Hello.desktop
- # Ensure Exec key is rewritten
-assert_file_has_content $FL_DIR/exports/share/applications/org.test.Hello.desktop "^Exec=.*/flatpak run --branch=stable --arch=$ARCH --command=hello\.sh org\.test\.Hello$"
-+assert_file_has_content $FL_DIR/exports/share/applications/org.test.Hello.desktop "^Exec=flatpak run --branch=stable --arch=$ARCH --command=hello\.sh org\.test\.Hello$"
- assert_has_file $FL_DIR/exports/share/gnome-shell/search-providers/org.test.Hello.search-provider.ini
- assert_file_has_content $FL_DIR/exports/share/gnome-shell/search-providers/org.test.Hello.search-provider.ini "^DefaultDisabled=true$"
- assert_has_file $FL_DIR/exports/share/icons/hicolor/64x64/apps/org.test.Hello.png
--- a/pkgs/development/libraries/libressl/CVE-2021-41581.patch
+++ b/pkgs/development/libraries/libressl/CVE-2021-41581.patch
@ -0,0 +1,53 @@
+Based on upstream https://github.com/openbsd/src/commit/62ceddea5b1d64a1a362bbb7071d9e15adcde6b1
+with paths switched to apply to libressl-portable and CVS header
+hunk removed.
+
+--- a/crypto/x509/x509_constraints.c
+++ b/crypto/x509/x509_constraints.c
+@@ -339,16 +339,16 @@
+ 			if (c == '.')
+ 				goto bad;
+ 		}
+-		if (wi > DOMAIN_PART_MAX_LEN)
+-			goto bad;
+ 		if (accept) {
+			if (wi >= DOMAIN_PART_MAX_LEN)
+				goto bad;
+ 			working[wi++] = c;
+ 			accept = 0;
+ 			continue;
+ 		}
+ 		if (candidate_local != NULL) {
+ 			/* We are looking for the domain part */
+-			if (wi > DOMAIN_PART_MAX_LEN)
+			if (wi >= DOMAIN_PART_MAX_LEN)
+ 				goto bad;
+ 			working[wi++] = c;
+ 			if (i == len - 1) {
+@@ -363,7 +363,7 @@
+ 			continue;
+ 		}
+ 		/* We are looking for the local part */
+-		if (wi > LOCAL_PART_MAX_LEN)
+		if (wi >= LOCAL_PART_MAX_LEN)
+ 			break;
+ 
+ 		if (quoted) {
+@@ -383,6 +383,8 @@
+ 			 */
+ 			if (c == 9)
+ 				goto bad;
+			if (wi >= LOCAL_PART_MAX_LEN)
+				goto bad;
+ 			working[wi++] = c;
+ 			continue; /* all's good inside our quoted string */
+ 		}
+@@ -412,6 +414,8 @@
+ 		}
+ 		if (!local_part_ok(c))
+ 			goto bad;
+		if (wi >= LOCAL_PART_MAX_LEN)
+			goto bad;
+ 		working[wi++] = c;
+ 	}
+ 	if (candidate_local == NULL || candidate_domain == NULL)
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@ -1,8 +1,16 @@
-{ stdenv, fetchurl, lib, cmake, cacert, fetchpatch
+{ stdenv
+, fetchurl
+, lib
+, cmake
+, cacert
+, fetchpatch
 , buildShared ? !stdenv.hostPlatform.isStatic
 }:

 let
+  ldLibPathEnvName = if stdenv.isDarwin
+    then "DYLD_LIBRARY_PATH"
+    else "LD_LIBRARY_PATH";

  generic = { version, sha256, patches ? [] }: stdenv.mkDerivation rec {
    pname = "libressl";
@ -42,6 +50,15 @@ let
      substituteInPlace ./tls/tls_config.c --replace '"/etc/ssl/cert.pem"' '"${cacert}/etc/ssl/certs/ca-bundle.crt"'
    '';

+    doCheck = true;
+    preCheck = ''
+      export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
+      export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
+    '';
+    postCheck = ''
+      export ${ldLibPathEnvName}=$PREVIOUS_${ldLibPathEnvName}
+    '';
+
    outputs = [ "bin" "dev" "out" "man" "nc" ];

    postFixup = ''
@ -66,5 +83,15 @@ in {
  libressl_3_2 = generic {
    version = "3.2.5";
    sha256 = "1zkwrs3b19s1ybz4q9hrb7pqsbsi8vxcs44qanfy11fkc7ynb2kr";
+    patches = [
+      ./CVE-2021-41581.patch
+    ];
+  };
+  libressl_3_4 = generic {
+    version = "3.4.0";
+    sha256 = "1lhn76nd59p1dfd27b4636zj6wh3f5xsi8b3sxqnl820imsswbp5";
+    patches = [
+      ./CVE-2021-41581.patch
+    ];
  };
 }
--- a/pkgs/development/libraries/netcdf/default.nix
+++ b/pkgs/development/libraries/netcdf/default.nix
@ -8,8 +8,7 @@
 }:

 let
-  mpiSupport = hdf5.mpiSupport;
-  mpi = hdf5.mpi;
+  inherit (hdf5) mpiSupport mpi;
 in stdenv.mkDerivation rec {
  pname = "netcdf";
  version = "4.8.0"; # Remove patch mentioned below on upgrade
@ -44,8 +43,7 @@ in stdenv.mkDerivation rec {
  buildInputs = [ hdf5 curl mpi ];

  passthru = {
-    mpiSupport = mpiSupport;
-    inherit mpi;
+    inherit mpiSupport mpi;
  };

  configureFlags = [
--- a/pkgs/development/libraries/plplot/default.nix
+++ b/pkgs/development/libraries/plplot/default.nix
@ -1,6 +1,16 @@
-{ lib, stdenv, fetchurl, cmake }:
+{ lib
+, stdenv
+, fetchurl
+, cmake
+, enableWX ? false
+, wxGTK31, wxmac
+, enableXWin ? false
+, libX11
+}:

-stdenv.mkDerivation rec {
+let
+  wxWidgets = (if stdenv.isDarwin then wxmac else wxGTK31);
+in stdenv.mkDerivation rec {
  pname   = "plplot";
  version = "5.15.0";

@ -11,6 +21,18 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake ];

+  buildInputs = lib.optional enableWX wxWidgets
+    ++ lib.optional enableXWin libX11;
+
+  passthru = {
+    inherit
+      enableWX
+      wxWidgets
+      enableXWin
+      libX11
+    ;
+  };
+
  cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=OFF" "-DBUILD_TEST=ON" ];

  doCheck = true;
--- a/pkgs/development/libraries/qcoro/default.nix
+++ b/pkgs/development/libraries/qcoro/default.nix
@ -0,0 +1,38 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, libpthreadstubs
+, qtbase
+}:
+
+mkDerivation rec {
+  pname = "qcoro";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "danvratil";
+    repo = "qcoro";
+    rev = "v${version}";
+    sha256 = "09543hpy590dndmlxmcm8c58m97blhaii4wbjr655qxdanhhxgzi";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    qtbase
+    libpthreadstubs
+  ];
+
+  meta = with lib; {
+    description = "Library for using C++20 coroutines in connection with certain asynchronous Qt actions";
+    homepage = "https://github.com/danvratil/qcoro";
+    license = licenses.mit;
+    maintainers = with maintainers; [ smitop ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/randomx/default.nix
+++ b/pkgs/development/libraries/randomx/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "randomX";
-  version = "1.1.8";
+  version = "1.1.9";

  nativeBuildInputs = [ cmake ];

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    owner = "tevador";
    repo = pname;
    rev = "v${version}";
-    sha256 = "13h2cw8drq7xn3v8fbpxrlsl8zq3fs8gd2pc1pv28ahr9qqjz1gc";
+    sha256 = "188fh4l8wda1y9vxa9asbk8nw35gyapw7gyn4w2p2qspdjhi5mnq";
  };

  meta = with lib; {
--- a/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
@ -22,13 +22,13 @@ else
 stdenv.mkDerivation rec {
  name = "ocaml${ocaml.version}-${pname}-${version}";
  inherit pname;
-  version = "0.6.4";
+  version = "0.6.5";

  src = fetchFromGitHub {
    owner = "mirage";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0w3x2wfd04qr6mci4cp1gfqw33yysp8gamgkpgbgwslr0skryiq5";
+    sha256 = "sha256:1mbyjzwcs64n7i3xkkyaxgl3r46drbl0gkqf3fqgm2kh3q03638l";
  };

  postUnpack = ''
@ -55,15 +55,6 @@ stdenv.mkDerivation rec {
    runHook postConfigure
  '';

-  preBuild = ''
-    # perform substitutions, so opam isn't needed
-    for flags in flags/cflags.tmp flags/libs.tmp; do
-      substitute "$flags.in" "$flags" \
-        --replace "%{prefix}%" "$out" \
-        --replace "%{ocaml-freestanding:lib}%" "$out/lib"
-    done
-  '';
-
  installPhase = ''
    runHook preInstall
    ./install.sh "$out"
--- a/pkgs/development/ocaml-modules/ocaml-freestanding/no-opam.patch
+++ b/pkgs/development/ocaml-modules/ocaml-freestanding/no-opam.patch
@ -22,43 +22,6 @@ Date:   Thu Mar 18 01:07:49 2021 +0100
    nice bonus). The Makefile needs no fix since the target ocaml/Makefile
    won't be built if it's already present.

-diff --git a/Makefile b/Makefile
-index b07b8c6..a68b31d 100644
--- a/Makefile
-+++ b/Makefile
-@@ -2,6 +2,12 @@
- 
- include Makeconf
- 
-+ifneq ($(shell command -v opam),)
-+	# only set if opam is available and PKG_CONFIG_PATH isn't
-+	# already set in the environment or on the command line
-+	PKG_CONFIG_PATH ?= $(shell opam config var prefix)/lib/pkgconfig
-+endif
-+
- FREESTANDING_LIBS=openlibm/libopenlibm.a \
- 		  ocaml/runtime/libasmrun.a \
- 		  nolibc/libnolibc.a
-@@ -73,8 +79,7 @@ flags/libs.tmp: flags/libs.tmp.in
- 	opam config subst $@
- 
- flags/libs: flags/libs.tmp Makeconf
-	env PKG_CONFIG_PATH="$(shell opam config var prefix)/lib/pkgconfig" \
-	    pkg-config $(PKG_CONFIG_DEPS) --libs >> $<
-+	pkg-config $(PKG_CONFIG_DEPS) --libs >> $<
- 	awk -v RS= -- '{ \
- 	    sub("@@PKG_CONFIG_EXTRA_LIBS@@", "$(PKG_CONFIG_EXTRA_LIBS)", $$0); \
- 	    print "(", $$0, ")" \
-@@ -84,8 +89,7 @@ flags/cflags.tmp: flags/cflags.tmp.in
- 	opam config subst $@
- 
- flags/cflags: flags/cflags.tmp Makeconf
-	env PKG_CONFIG_PATH="$(shell opam config var prefix)/lib/pkgconfig" \
-	    pkg-config $(PKG_CONFIG_DEPS) --cflags >> $<
-+	pkg-config $(PKG_CONFIG_DEPS) --cflags >> $<
- 	awk -v RS= -- '{ \
- 	    print "(", $$0, ")" \
- 	    }' $< >$@
 diff --git a/configure.sh b/configure.sh
 index 4d154ed..c254f7b 100755
 --- a/configure.sh
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@ -59,6 +59,11 @@ buildPythonPackage rec {
    "tests/sspi_stub.py"
  ];

+  disabledTests = [
+    # No PIN set
+    "TestSKAuthCTAP2"
+  ];
+
  pythonImportsCheck = [ "asyncssh" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/bond-api/default.nix
+++ b/pkgs/development/python-modules/bond-api/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "bond-api";
-  version = "0.1.13";
+  version = "0.1.14";

  src = fetchFromGitHub {
    owner = "prystupa";
    repo = "bond-api";
    rev = "v${version}";
-    sha256 = "0v3bwbpn98fjm8gza2k7fb7w5ps3982kfvbck5x0fh2xq2825b80";
+    sha256 = "0s7an6kbib1immrbwrh4pzj812zwf8kj3kgky5k3qwxzrj0iv6ak";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/browser-cookie3/default.nix
+++ b/pkgs/development/python-modules/browser-cookie3/default.nix
@ -1,25 +1,44 @@
-{ lib, fetchPypi, buildPythonPackage, isPy3k, lz4, keyring, pbkdf2, pycryptodome, pyaes}:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, isPy3k
+, lz4
+, keyring
+, pbkdf2
+, pycryptodome
+, pyaes
+}:

 buildPythonPackage rec {
  pname = "browser-cookie3";
-  version = "0.12.1";
+  version = "0.13.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "72c1e6aa6a98adab3a6797b889664bdbfddc287474dd8e774da37a854ec32185";
+    sha256 = "9f8e5ddf5a6641a1fdca12d82b0923777ba59a988b68c9bcf358bfb7c42ef25b";
  };

  disabled = !isPy3k;

-  propagatedBuildInputs = [ lz4 keyring pbkdf2 pyaes pycryptodome ];
+  propagatedBuildInputs = [
+    lz4
+    keyring
+    pbkdf2
+    pyaes
+    pycryptodome
+  ];

  # No tests implemented
  doCheck = false;

+  pythonImportsCheck = [
+    "browser_cookie3"
+  ];
+
  meta = with lib; {
    description = "Loads cookies from your browser into a cookiejar object";
-    maintainers = with maintainers; [ borisbabic ];
    homepage = "https://github.com/borisbabic/browser_cookie3";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ borisbabic ];
  };
 }
--- a/pkgs/development/python-modules/frozenlist/default.nix
+++ b/pkgs/development/python-modules/frozenlist/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "frozenlist";
-  version = "1.1.1";
+  version = "1.2.0";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "aio-libs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "07z33vid7s8fjwvybyn8357yvs0f6nlhizv1l3qj1bczi3jbdkbh";
+    sha256 = "sha256-rTbekdceC5QK0aiySi/4QUwaEoDfTlLrx2t6Kb9bH7U=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/libusb1/default.nix
+++ b/pkgs/development/python-modules/libusb1/default.nix
@ -2,15 +2,15 @@

 buildPythonPackage rec {
  pname = "libusb1";
-  version = "1.9.3";
+  version = "2.0.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "60e6ce37be064f6e51d02b25da44230ecc9c0b1fdb6f14568c71457d963c1749";
+    sha256 = "d3ba82ecf7ab6a48d21dac6697e26504670cc3522b8e5941bd28fb56cf3f6c46";
  };

  postPatch = ''
-    substituteInPlace usb1/libusb1.py --replace \
+    substituteInPlace usb1/_libusb1.py --replace \
      "ctypes.util.find_library(base_name)" \
      "'${libusb1}/lib/libusb-1.0${stdenv.hostPlatform.extensions.sharedLibrary}'"
  '';
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "mypy-boto3-s3";
-  version = "1.18.62";
+  version = "1.18.63";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "a12c44b1a1a9653d6f9148f174a9b7b71785481374ef43d962bd580967b6bca8";
+    sha256 = "cf676b3d36677382429a3ed29e17edfdd342c1879db37868723b2a0761640d62";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pulsectl/default.nix
+++ b/pkgs/development/python-modules/pulsectl/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "pulsectl";
-  version = "21.10.4";
+  version = "21.10.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "c9593a54d01dc1ab47ef20464aa7d00433690c86ae840c58f458fe6dedd6b41a";
+    sha256 = "b347983fb78baab168f4dc4804ab2c59ca5b813bf62f8146dfb5fcb6ab6c8ba2";
  };

  patches = [
--- a/pkgs/development/python-modules/pyintesishome/default.nix
+++ b/pkgs/development/python-modules/pyintesishome/default.nix
@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "pyintesishome";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "jnimmo";
    repo = "pyIntesisHome";
    rev = version;
-    sha256 = "1y1agdr32p7m4dbb6kzchh0vb49gy0rqp8hq9zadwrq2vp70k5sn";
+    sha256 = "sha256-+bad3VIoP0sVw0blK9YIot2GfK5de4HTXv5/ipV2Nds=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sqlfluff";
-  version = "0.6.8";
+  version = "0.7.0";
  disabled = python3.pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    sha256 = "sha256-Aistr85doKEOD0/uTS/7iRzYggb+hC3njVi4mWt8ndM=";
+    sha256 = "sha256-Cqbo1L3z3bTDIXZ90GXdAulTpGhWLoTc/kYRNghZ/SE=";
  };

  propagatedBuildInputs = with python3.pkgs; [
@ -39,10 +39,9 @@ python3.pkgs.buildPythonApplication rec {
  ];

  disabledTestPaths = [
-    # dbt is not available yet
-    "test/core/templaters/dbt_test.py"
    # Don't run the plugin related tests
    "test/core/plugin_test.py"
+    "plugins/sqlfluff-templater-dbt"
    "plugins/sqlfluff-plugin-example/test/rules/rule_test_cases_test.py"
  ];

--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@ -327,6 +327,18 @@ final: prev:
    meta.homepage = "https://github.com/rbgrouleff/bclose.vim/";
  };

+  better-escape-nvim = buildVimPluginFrom2Nix {
+    pname = "better-escape.nvim";
+    version = "2021-10-09";
+    src = fetchFromGitHub {
+      owner = "max397574";
+      repo = "better-escape.nvim";
+      rev = "a644df43e4607df2e645cb7b6f50ede79fffe477";
+      sha256 = "1kjc1h35xfqgsqbg00hsvg52wkjskfilxxsxnnlimcsv9v8iadmh";
+    };
+    meta.homepage = "https://github.com/max397574/better-escape.nvim/";
+  };
+
  BetterLua-vim = buildVimPluginFrom2Nix {
    pname = "BetterLua.vim";
    version = "2020-08-14";
@ -449,12 +461,12 @@ final: prev:

  chadtree = buildVimPluginFrom2Nix {
    pname = "chadtree";
-    version = "2021-10-16";
+    version = "2021-10-17";
    src = fetchFromGitHub {
      owner = "ms-jpq";
      repo = "chadtree";
-      rev = "949731d96f14872bb6764f305f38415d70c220a3";
-      sha256 = "1lq4c47i55gza7mdn1nzsfxq78vkl5hhsrfv2dk97sbmbyfmr83j";
+      rev = "63259154cae7c01a877cd493c7ff53d8bbaf36a8";
+      sha256 = "0072yqwcs23j1q5akybc9q933lg3davrbh10rjqs690b8p69rz0p";
    };
    meta.homepage = "https://github.com/ms-jpq/chadtree/";
  };
@ -617,12 +629,12 @@ final: prev:

  cmp-nvim-lsp = buildVimPluginFrom2Nix {
    pname = "cmp-nvim-lsp";
-    version = "2021-09-30";
+    version = "2021-10-17";
    src = fetchFromGitHub {
      owner = "hrsh7th";
      repo = "cmp-nvim-lsp";
-      rev = "f93a6cf9761b096ff2c28a4f0defe941a6ffffb5";
-      sha256 = "02x4jp79lll4fm34x7rjkimlx32gfp2jd1kl6zjwszbfg8wziwmx";
+      rev = "accbe6d97548d8d3471c04d512d36fa61d0e4be8";
+      sha256 = "1dqx6yrd60x9ncjnpja87wv5zgnij7qmzbyh5xfyslk67c0i6mwm";
    };
    meta.homepage = "https://github.com/hrsh7th/cmp-nvim-lsp/";
  };
@ -856,6 +868,18 @@ final: prev:
    meta.homepage = "https://github.com/wincent/command-t/";
  };

+  comment-nvim = buildVimPluginFrom2Nix {
+    pname = "comment.nvim";
+    version = "2021-10-17";
+    src = fetchFromGitHub {
+      owner = "numtostr";
+      repo = "comment.nvim";
+      rev = "a86384dc153e86a9a3cbec1436a8acfa4b07690d";
+      sha256 = "043nczs67sa7i2nmmadhrd52d3yzjr1kcm3bgb4q5zig1a7r4dcj";
+    };
+    meta.homepage = "https://github.com/numtostr/comment.nvim/";
+  };
+
  committia-vim = buildVimPluginFrom2Nix {
    pname = "committia.vim";
    version = "2020-08-27";
@ -2964,12 +2988,12 @@ final: prev:

  lir-nvim = buildVimPluginFrom2Nix {
    pname = "lir.nvim";
-    version = "2021-09-20";
+    version = "2021-10-17";
    src = fetchFromGitHub {
      owner = "tamago324";
      repo = "lir.nvim";
-      rev = "bc14ddcb173d332e62ce3712eb0ca3ac6d9fa59a";
-      sha256 = "1sh13m98dni9dspjiwsaafzvg3nlwd41v5ma5achpzla80hzm2h1";
+      rev = "5a7b21b0fdafe73719902b9848880fb3eb8500aa";
+      sha256 = "0pdswmrmc2nicii5szhig4qnmcx2cks6rc5g7s787cc0c458l98p";
    };
    meta.homepage = "https://github.com/tamago324/lir.nvim/";
  };
@ -3924,12 +3948,12 @@ final: prev:

  nvim-autopairs = buildVimPluginFrom2Nix {
    pname = "nvim-autopairs";
-    version = "2021-10-15";
+    version = "2021-10-17";
    src = fetchFromGitHub {
      owner = "windwp";
      repo = "nvim-autopairs";
-      rev = "2cab63437f05551d79ee959eb88fee1ba437a5a7";
-      sha256 = "14zrgri491jshg57wcw8nf5nzviw1b6a88qkx0km1v15knihbc68";
+      rev = "7becc6bc9d8baa62eb0dbf65305f8e7f1470ace7";
+      sha256 = "1ihz1kci00r93f52fzz5nx9byh7rrax1sknmj9q232z1wv7dxb06";
    };
    meta.homepage = "https://github.com/windwp/nvim-autopairs/";
  };
@ -4140,12 +4164,12 @@ final: prev:

  nvim-hlslens = buildVimPluginFrom2Nix {
    pname = "nvim-hlslens";
-    version = "2021-10-09";
+    version = "2021-10-17";
    src = fetchFromGitHub {
      owner = "kevinhwang91";
      repo = "nvim-hlslens";
-      rev = "0bbfcaf40b8c3fee758eda51e728a5b7aff08412";
-      sha256 = "07n8i6ggk4qnhr3zda2qpfvqfnilnnkymak1dw6f0wcjbfqdk8h6";
+      rev = "5217443bb675539d87b90133a91a7e36ad1e517d";
+      sha256 = "17p3x7s50r5fj1fhzx7nm7hk81h85hihk6svsgp99a1cjys6w9zk";
    };
    meta.homepage = "https://github.com/kevinhwang91/nvim-hlslens/";
  };
@ -4176,12 +4200,12 @@ final: prev:

  nvim-lightbulb = buildVimPluginFrom2Nix {
    pname = "nvim-lightbulb";
-    version = "2021-10-16";
+    version = "2021-10-17";
    src = fetchFromGitHub {
      owner = "kosayoda";
      repo = "nvim-lightbulb";
-      rev = "9838d3a0f9268d89c9f238c67928d3b6a0ceaaf5";
-      sha256 = "157x2i6paqz626bvbjly5k1yg2939v6j8riicrw8gxbb3s5z5fh5";
+      rev = "66223954d7bd7d4358c36d157c25503168d04319";
+      sha256 = "0jghq2fkvibilb1zglkckhpmq6dgi1q87fcwpvcv9slk1qlgw19d";
    };
    meta.homepage = "https://github.com/kosayoda/nvim-lightbulb/";
  };
@ -4200,12 +4224,12 @@ final: prev:

  nvim-lspconfig = buildVimPluginFrom2Nix {
    pname = "nvim-lspconfig";
-    version = "2021-10-16";
+    version = "2021-10-17";
    src = fetchFromGitHub {
      owner = "neovim";
      repo = "nvim-lspconfig";
-      rev = "28a8e5258cb8140cc50a030b9b3c15e39376028a";
-      sha256 = "02n5kacdb6my8mn0iayr5l1rm6nx4pqc6fx6a7l5minww9vh8na2";
+      rev = "9661d267f64a872a451dab0453b2b951e55cef27";
+      sha256 = "0hv77ridsxi5n2qibrp9a66kbmlw1c9yl8gpakr1iz2hhazq58x9";
    };
    meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
  };
@ -5069,8 +5093,8 @@ final: prev:
    src = fetchFromGitHub {
      owner = "simrat39";
      repo = "rust-tools.nvim";
-      rev = "e3b0ace51db01e6fbecae489645b911a8f4b3441";
-      sha256 = "0syshs383j1fhj381fy9d9chrqa11fk333c2kzak08j5l471z486";
+      rev = "441e0104648e1bae89e3eac6857590a64f17583d";
+      sha256 = "13g6vlg3r49vmzl0q6z2mqwz2p2chcjc74bfgn89c284bjri8x94";
    };
    meta.homepage = "https://github.com/simrat39/rust-tools.nvim/";
  };
@ -5644,12 +5668,12 @@ final: prev:

  tagalong-vim = buildVimPluginFrom2Nix {
    pname = "tagalong.vim";
-    version = "2021-10-15";
+    version = "2021-10-17";
    src = fetchFromGitHub {
      owner = "AndrewRadev";
      repo = "tagalong.vim";
-      rev = "9d37eeb2463bfa1150a9353d3bf9a4f6d7395ab9";
-      sha256 = "0i2vnd0rhp5ix0p78np0vk45pnpidi1y7z6b5z8pwh442ma8f86f";
+      rev = "18c010e0f28fea012f537bc1abd468a063c36b9c";
+      sha256 = "0qq1saqkk0cd09zppz469idzvl5d0aagq5gw908whz5dd72yl8al";
    };
    meta.homepage = "https://github.com/AndrewRadev/tagalong.vim/";
  };
@ -5714,6 +5738,18 @@ final: prev:
    meta.homepage = "https://github.com/tomtom/tcomment_vim/";
  };

+  telescope-cheat-nvim = buildVimPluginFrom2Nix {
+    pname = "telescope-cheat.nvim";
+    version = "2021-09-24";
+    src = fetchFromGitHub {
+      owner = "nvim-telescope";
+      repo = "telescope-cheat.nvim";
+      rev = "4a58b92fc70af622ddc115f843b0e552ca5bd6ea";
+      sha256 = "132drgpak97sbwjma6h7zwflg386xhqmdb3rqvzgxav36p9f0xsw";
+    };
+    meta.homepage = "https://github.com/nvim-telescope/telescope-cheat.nvim/";
+  };
+
  telescope-coc-nvim = buildVimPluginFrom2Nix {
    pname = "telescope-coc.nvim";
    version = "2021-10-13";
@ -7546,8 +7582,8 @@ final: prev:
    src = fetchFromGitHub {
      owner = "rbong";
      repo = "vim-flog";
-      rev = "1cb504538bf1e46b16d239cfc7fa22229dd1301b";
-      sha256 = "1z5dggdjfc7fi7q58rfbh5whw7qw6jzfxbf87mlnyr9vij72v53q";
+      rev = "d8e62cea4c57c9284a0d6bc92140deb1a7034a1d";
+      sha256 = "0a5yh0w143lvg934pwsln2n34zh7x2d6bxfp9cmw897nl6qlzrdj";
    };
    meta.homepage = "https://github.com/rbong/vim-flog/";
  };
@ -7602,12 +7638,12 @@ final: prev:

  vim-fugitive = buildVimPluginFrom2Nix {
    pname = "vim-fugitive";
-    version = "2021-10-16";
+    version = "2021-10-17";
    src = fetchFromGitHub {
      owner = "tpope";
      repo = "vim-fugitive";
-      rev = "0615cd2baf15ed0aebacd3546015a89d491553ef";
-      sha256 = "0j6hl5561jhhcbxwiwc1030ip4bzqypqnj1ycxhg3vl630d18kla";
+      rev = "93f41ace7dc068cf89314bcea23bdf8da686407a";
+      sha256 = "0hbif3hndmn7jll4w1kci6x3j7379wmpp9rnxg8rlbbnyxl2fpxj";
    };
    meta.homepage = "https://github.com/tpope/vim-fugitive/";
  };
@ -9705,12 +9741,12 @@ final: prev:

  vim-snippets = buildVimPluginFrom2Nix {
    pname = "vim-snippets";
-    version = "2021-10-07";
+    version = "2021-10-17";
    src = fetchFromGitHub {
      owner = "honza";
      repo = "vim-snippets";
-      rev = "be519f70ab806c290a7b3d2e38fc22da07834052";
-      sha256 = "0d22x0az6ca232x04mvkk9jphn3qfcz24a9wwvz0jdyy3pk8zfbi";
+      rev = "c28bef69fdb26825a93ac1e90ca6f5ba19116d88";
+      sha256 = "1fg60jfm5bw1m20133vl06nb8z9ckrwqq37jz493xi34j5fymi4w";
    };
    meta.homepage = "https://github.com/honza/vim-snippets/";
  };
--- a/pkgs/misc/vim-plugins/overrides.nix
+++ b/pkgs/misc/vim-plugins/overrides.nix
@ -560,6 +560,10 @@ self: super: {
      };
    });

+  telescope-cheat-nvim = super.telescope-cheat-nvim.overrideAttrs (old: {
+    dependencies = with self; [ sqlite-lua telescope-nvim ];
+  });
+
  telescope-frecency-nvim = super.telescope-frecency-nvim.overrideAttrs (old: {
    dependencies = with self; [ sqlite-lua telescope-nvim ];
  });
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@ -429,6 +429,7 @@ mattn/emmet-vim
 mattn/vim-gist
 mattn/webapi-vim
 matze/vim-move
+max397574/better-escape.nvim
 maximbaz/lightline-ale
 MaxMEllon/vim-jsx-pretty
 mbbill/undotree
@ -518,6 +519,7 @@ norcalli/nvim-terminal.lua
 norcalli/snippets.nvim
 ntpeters/vim-better-whitespace
 numirias/semshi
+numtostr/comment.nvim
 nvie/vim-flake8
 nvim-lua/completion-nvim
 nvim-lua/diagnostic-nvim
@ -526,6 +528,7 @@ nvim-lua/lsp_extensions.nvim
 nvim-lua/plenary.nvim
 nvim-lua/popup.nvim
 nvim-neorg/neorg@main
+nvim-telescope/telescope-cheat.nvim
 nvim-telescope/telescope-dap.nvim
 nvim-telescope/telescope-frecency.nvim
 nvim-telescope/telescope-fzf-native.nvim@main
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@ -140,6 +140,10 @@ let
        "INSTALL_MOD_PATH=\${out}"
      ];

+      postBuild = optionalString buildKernel ''
+         find . -name "*.ko" -print0 | xargs -0 -P$NIX_BUILD_CORES strip --strip-debug
+      '';
+
      postInstall = optionalString buildKernel ''
        # Add reference that cannot be detected due to compressed kernel module
        mkdir -p "$out/nix-support"
--- a/pkgs/servers/dns/pdns-recursor/default.nix
+++ b/pkgs/servers/dns/pdns-recursor/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "pdns-recursor";
-  version = "4.5.4";
+  version = "4.5.6";

  src = fetchurl {
    url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "0sl98ykk2bh0v2aw2hyak7wk9k3pbhvmfkb3i4a72jlsixm60p81";
+    sha256 = "004jwyg64ww6sfwlfpyfvh6vymildygwkjhkin2fsrq4h79wv2dv";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/tools/admin/pulumi/data.nix
+++ b/pkgs/tools/admin/pulumi/data.nix
@ -9,8 +9,8 @@
        sha256 = "02s759rm633h4v5a1s3jxwvkahfjrbkz561spijrp3mihrws3xhb";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.0-linux-amd64.tar.gz";
-        sha256 = "0ainrb9i14wcq64pg99kb0s41bpmczp1h4sz85kj1a4ic0yrfq14";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.1-linux-amd64.tar.gz";
+        sha256 = "0k67bsqiqalqrifd6r7nm6c2g4ckrfhh7a7nfgfmpvqs7cxx1kfm";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.5.0-linux-amd64.tar.gz";
@ -21,8 +21,8 @@
        sha256 = "1lmy0dmpspzflc9z8p4w1cz47lbqnbkq8dng3v40lpbs75pnprvs";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.21.0-linux-amd64.tar.gz";
-        sha256 = "1w7ppcqkhh9k9iw10f4d93glmphyvachrkj6p8b6i93n0k78rxv7";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.22.0-linux-amd64.tar.gz";
+        sha256 = "0jl4ic18kf0qcys5mhp6ar4p1bj6ndhi11b51dvzdj5lb39dv43q";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.4.0-linux-amd64.tar.gz";
@ -37,12 +37,12 @@
        sha256 = "1h5159y7xlslnijs8lpi4vqgvj2px6whxk9m17p9n7wiyqbmd5na";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.23.0-linux-amd64.tar.gz";
-        sha256 = "0kxwx1lk54kdfw49s719g4vwr2iv6fzr82cxi5siykzpf9gfk7bd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.24.1-linux-amd64.tar.gz";
+        sha256 = "0rmzb3wn5hmx8z8ly85spizinp6ja861k05fhw7l63zhqr8pnls2";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.2.0-linux-amd64.tar.gz";
-        sha256 = "02g59jaifyjfcx185ir79d8lqic38dgaa9cb8dpi3xhvv32z0b0q";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-linux-amd64.tar.gz";
+        sha256 = "1ixmsxawp0qbyjs37c74gcvj2icpbda6znl17yp9bhiyvnrdvxn7";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.3.0-linux-amd64.tar.gz";
@ -81,8 +81,8 @@
        sha256 = "0bp7ki3slszmy1vh4a5d4y4fhbvafrazj1cjf081xv91gi99xxz6";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.22.0-linux-amd64.tar.gz";
-        sha256 = "0ga794vwdggscl9lf57dg7cii91j4px0wyha4r43rhn0gbp1zk8y";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.24.0-linux-amd64.tar.gz";
+        sha256 = "1dznd4c8kpy6mwwb170nfl1m2dmrp6f4jalmk3bdfqscm4xhvk3q";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.0.0-linux-amd64.tar.gz";
@ -107,8 +107,8 @@
        sha256 = "1lisk9wr5p866x2hxvlz7nhz0xybhag7wgqk23x0lariln9z5na6";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.0-darwin-amd64.tar.gz";
-        sha256 = "0n5kgmcy4hsg4s4q7jd34z9hz6vcqs64j680jzsxw902cgrj5y9p";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.1-darwin-amd64.tar.gz";
+        sha256 = "103syjj8vla8lygyl5h7ilwm9kl6vxzyn6fdrkz0xcvlhqm1xr30";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.5.0-darwin-amd64.tar.gz";
@ -119,8 +119,8 @@
        sha256 = "1j7z5dbqzsdq1q8ks9g5pwzyc3ml6avhhp6xj94dzdhskl6pd8w5";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.21.0-darwin-amd64.tar.gz";
-        sha256 = "0sjh5wws6k90w2y5f5bm22c4qxamr658mww3zx11qakdygraijly";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.22.0-darwin-amd64.tar.gz";
+        sha256 = "15c5rh0ix7zxn128kangd5x2x1n61xv9d443a7cbriibwvdkvv0j";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.4.0-darwin-amd64.tar.gz";
@ -135,12 +135,12 @@
        sha256 = "0r2ykjwam5m2mfiibhq993s8n5pzmks837cwb57jwgwx8lc3ra4x";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.23.0-darwin-amd64.tar.gz";
-        sha256 = "0vpkwlihq6pj554qd3csgf25id2q0pjx4mwkpfj74y08lv6d3v83";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.24.1-darwin-amd64.tar.gz";
+        sha256 = "06lfimnlns1bfvks0kv5rjcnz6dvdk38npigyigsk9vqs0idcfi3";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.2.0-darwin-amd64.tar.gz";
-        sha256 = "0gd3xnl31892qp8ilz9lc1zdps77nf07jgvh0k37mink8f0ppy2z";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-darwin-amd64.tar.gz";
+        sha256 = "1dy4n03xvirg6fihiid786d88qlkyqkvk4fq6ggnxc92620x7342";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.3.0-darwin-amd64.tar.gz";
@ -179,8 +179,8 @@
        sha256 = "1i73sxh6vf6adg6as1q1mab3fcjm7ma7gixj2b0y0d2a5d78lhpa";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.22.0-darwin-amd64.tar.gz";
-        sha256 = "19w0m6rxf0i996s9hdjym4f1k0jwf8hrlsr0m9x23xzz5r2simar";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.24.0-darwin-amd64.tar.gz";
+        sha256 = "1jxrz82cadmqkd1d26bj5r3bphvzz5z20shjai351hlh9aa3bv2h";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.0.0-darwin-amd64.tar.gz";
@ -205,8 +205,8 @@
        sha256 = "041lmx5d1c8ls48mv56jchvk714rqw7jywywdgm6d6ipq7h5d67k";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.0-linux-arm64.tar.gz";
-        sha256 = "06hq79r35bcm7yn8qdvdiy19wsqq3ihbrmjakw2vf6xdglrxxxwr";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.1-linux-arm64.tar.gz";
+        sha256 = "0rijbqaw584b5c0kihrs80cv46s06yv3a68yz1dwa8sl7adi7n9p";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.5.0-linux-arm64.tar.gz";
@ -217,8 +217,8 @@
        sha256 = "0mddv37k87wiygh6x9bnxpcr721qbmbqf6l5zk3xl61n56j8qyb1";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.21.0-linux-arm64.tar.gz";
-        sha256 = "1zlkij96vr3vf071gwdqcwfxlkfvcnkj4q220l3gxzliix0zvfi4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.22.0-linux-arm64.tar.gz";
+        sha256 = "19aiksm4d4jxs9gw7rdr77ag58fy1v7gkk6r730imgq0d8vsacm1";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.4.0-linux-arm64.tar.gz";
@ -233,12 +233,12 @@
        sha256 = "1sc8rf930cz6nkyhqn6p0h7450iqzdsrlw2smhp8yyjjvcjmsksf";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.23.0-linux-arm64.tar.gz";
-        sha256 = "0j8dgbfdscp29zj0vd3ial1g87n72jj07afj5lxzgsh8jay1iz2r";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.24.1-linux-arm64.tar.gz";
+        sha256 = "1bvzazdis423vb1r30q15q1irh07kgymv5ikzmvrygf4hm3aph06";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.2.0-linux-arm64.tar.gz";
-        sha256 = "0y7wysd4j1dp73hrbydzj2bfvpgv8vxiza5m6dbg7nl66w9ng0rc";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-linux-arm64.tar.gz";
+        sha256 = "12iv8vjnal2ym70rxmdnvi02x6md7fxi8jbzhzfw526pzqs1dc47";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.3.0-linux-arm64.tar.gz";
@ -274,8 +274,8 @@
        sha256 = "0mwpbvv62k8fg07447wwfigs4li4n78fswpzwi4alsjrkqlmw9dj";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.22.0-linux-arm64.tar.gz";
-        sha256 = "0kp13hk57apvqmsn1zw1k7r395wdk1308m0kwx4hmcjy6dzifjsq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.24.0-linux-arm64.tar.gz";
+        sha256 = "1b8fi56wkk753w6ip1nkrksyk8qd5ypdbaq668pk60l3jb0c9mad";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.0.0-linux-arm64.tar.gz";
@ -300,8 +300,8 @@
        sha256 = "06qc42gb2w2qjy2mz5shh082607395jq0js34wlqq61jgjzpca5l";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.0-darwin-arm64.tar.gz";
-        sha256 = "0nwqrg5in05vvj7ln7gi50vp3bnhkwar8fifpi87b134hl50q935";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.1-darwin-arm64.tar.gz";
+        sha256 = "1wqkm32lkwff5gwn7dbznzx5rcbcysj2mx4ip77whba59ikfchsj";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.5.0-darwin-arm64.tar.gz";
@ -312,8 +312,8 @@
        sha256 = "0fj1ai1kv8xgmsvfbmy5gsinxag70rx9a9gkifqgcpn3r9mj48ks";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.21.0-darwin-arm64.tar.gz";
-        sha256 = "0nj8gin7ys63v235x8nywmx0vv2bdcqdmmp7z3lxlxp2hk4nm84g";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.22.0-darwin-arm64.tar.gz";
+        sha256 = "09v28dgrs5a4w8qn4v4zwrn7n7cn2475a2jh9qz3g2ljaj0086fd";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.4.0-darwin-arm64.tar.gz";
@ -328,12 +328,12 @@
        sha256 = "1c3pchbnk6dsnxsl02ypq7s4mmkxdgxszdhql1klpx5js7i1lv8k";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.23.0-darwin-arm64.tar.gz";
-        sha256 = "08gcvlfy7kmcx02nf3n4chf6g5lasr2g8gr20gndk0rvihqiwhjz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.24.1-darwin-arm64.tar.gz";
+        sha256 = "0fafl5zpnzkncvi52qw6f4898yia8p0whvr41m3g8cxcp6nyr0ij";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.2.0-darwin-arm64.tar.gz";
-        sha256 = "0waf4apw5bzn276s34yaxvm3xyk5333l3zcz2j52c56wkadzxvpg";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-darwin-arm64.tar.gz";
+        sha256 = "0jrihnwfh5wvc95nipqv7ak77kq9xj0pk5hlapv9w2ls5pwykv0r";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.3.0-darwin-arm64.tar.gz";
@ -369,8 +369,8 @@
        sha256 = "1hzhlxbwji4p8apx4rnqllsgf1k11w49rplz0syzmzb2fxpkif75";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.22.0-darwin-arm64.tar.gz";
-        sha256 = "038nk93mq59d8ynp1ggmhvmgnilrgqzcbg4hapb9pk7hpbwb269c";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.24.0-darwin-arm64.tar.gz";
+        sha256 = "0nh8305b6qlqr63xaacxs3v804dhrwdz179xlzdgzf9550zdqb39";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.0.0-darwin-arm64.tar.gz";
--- a/pkgs/tools/filesystems/catcli/default.nix
+++ b/pkgs/tools/filesystems/catcli/default.nix
@ -7,13 +7,13 @@
 buildPythonApplication rec {

  pname = "catcli";
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchFromGitHub {
    owner = "deadc0de6";
    repo = pname;
    rev = "v${version}";
-    sha256 = "03yf9sjqdg3xcbvkn1591zxd2d0r8wz1b749zrn55k3a03c7jzf5";
+    sha256 = "1mzhfcf67dc5m0i9b216m58qg36g63if6273ch5bsckd0yrwdk8x";
  };

  propagatedBuildInputs = [ docopt anytree ];
--- a/pkgs/tools/misc/flashrom/default.nix
+++ b/pkgs/tools/misc/flashrom/default.nix
@ -1,16 +1,16 @@
-{ lib
-, stdenv
-, fetchurl
-, meson
-, ninja
-, pkg-config
+{ fetchurl
+, gcc9Stdenv
+, installShellFiles
+, lib
 , libftdi1
+, libjaylink
 , libusb1
 , pciutils
-, installShellFiles
+, pkg-config
+, jlinkSupport ? false
 }:

-stdenv.mkDerivation rec {
+gcc9Stdenv.mkDerivation rec {
  pname = "flashrom";
  version = "1.2";

@ -19,29 +19,30 @@ stdenv.mkDerivation rec {
    sha256 = "0ax4kqnh7kd3z120ypgp73qy1knz47l6qxsqzrfkd97mh5cdky71";
  };

+  nativeBuildInputs = [ pkg-config installShellFiles ];
+  buildInputs = [ libftdi1 libusb1 ]
+    # https://github.com/flashrom/flashrom/issues/125
+    ++ lib.optional (!gcc9Stdenv.isAarch64) pciutils
+    ++ lib.optional jlinkSupport libjaylink;
+
  postPatch = ''
    substituteInPlace util/z60_flashrom.rules \
      --replace "plugdev" "flashrom"
  '';

-  # Meson build doesn't build and install manpage. Only Makefile can.
-  # Build manpage from source directory. Here we're inside the ./build subdirectory
+  makeFlags = [ "PREFIX=$(out)" "libinstall" ]
+    ++ lib.optional jlinkSupport "CONFIG_JLINK_SPI=yes";
+
  postInstall = ''
-    make flashrom.8 -C ..
-    installManPage ../flashrom.8
-    install -Dm644 ../util/z60_flashrom.rules $out/etc/udev/rules.d/flashrom.rules
+    install -Dm644 util/z60_flashrom.rules $out/lib/udev/rules.d/flashrom.rules
  '';

-  mesonFlags = lib.optionals stdenv.isAarch64 [ "-Dpciutils=false" ];
-  nativeBuildInputs = [ meson pkg-config ninja installShellFiles ];
-  buildInputs = [ libftdi1 libusb1 pciutils ];
-
  meta = with lib; {
-    homepage = "http://www.flashrom.org";
+    homepage = "https://www.flashrom.org";
    description = "Utility for reading, writing, erasing and verifying flash ROM chips";
    license = licenses.gpl2;
    maintainers = with maintainers; [ funfunctor fpletz felixsinger ];
    platforms = platforms.all;
-    broken = stdenv.isDarwin; # requires DirectHW
+    broken = gcc9Stdenv.isDarwin; # requires DirectHW
  };
 }
--- a/pkgs/tools/misc/hdf4/default.nix
+++ b/pkgs/tools/misc/hdf4/default.nix
@ -7,7 +7,8 @@
 , uselibtirpc ? stdenv.isLinux
 , libtirpc
 , zlib
-, szip ? null
+, szipSupport ? false
+, szip
 , javaSupport ? false
 , jdk
 }:
@ -55,10 +56,10 @@ stdenv.mkDerivation rec {

  buildInputs = [
    libjpeg
-    szip
    zlib
  ]
  ++ lib.optional javaSupport jdk
+  ++ lib.optional szipSupport szip
  ++ lib.optional uselibtirpc libtirpc;

  preConfigure = lib.optionalString uselibtirpc ''
@ -66,7 +67,7 @@ stdenv.mkDerivation rec {
    substituteInPlace config/cmake/FindXDR.cmake \
      --replace 'find_path(XDR_INCLUDE_DIR NAMES rpc/types.h PATHS "/usr/include" "/usr/include/tirpc")' \
                'find_path(XDR_INCLUDE_DIR NAMES rpc/types.h PATH_SUFFIXES include/tirpc)'
-  '' + lib.optionalString (szip != null) ''
+  '' + lib.optionalString szipSupport ''
    export SZIP_INSTALL=${szip}
  '';

@ -85,7 +86,7 @@ stdenv.mkDerivation rec {
    "-DJAVA_HOME=${jdk}"
    "-DJAVA_AWT_LIBRARY=${javabase}/libawt.so"
    "-DJAVA_JVM_LIBRARY=${javabase}/server/libjvm.so"
-  ] ++ lib.optionals (szip != null) [
+  ] ++ lib.optionals szipSupport [
    "-DHDF4_ENABLE_SZIP_ENCODING=ON"
    "-DHDF4_ENABLE_SZIP_SUPPORT=ON"
  ];
@ -119,6 +120,17 @@ stdenv.mkDerivation rec {
    moveToOutput bin "$bin"
  '';

+  passthru = {
+    inherit
+      uselibtirpc
+      libtirpc
+      szipSupport
+      szip
+      javaSupport
+      jdk
+    ;
+  };
+
  meta = with lib; {
    description = "Data model, library, and file format for storing and managing data";
    homepage = "https://support.hdfgroup.org/products/hdf4/";
--- a/pkgs/tools/misc/hdf5/1.10.nix
+++ b/pkgs/tools/misc/hdf5/1.10.nix
@ -1,7 +1,9 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , removeReferencesTo
-, zlib ? null
+, zlibSupport ? true
+, zlib
 , enableShared ? !stdenv.hostPlatform.isStatic
 , javaSupport ? false
 , jdk
@ -24,10 +26,9 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ removeReferencesTo ];

-  propagatedBuildInputs = optional (zlib != null) zlib;
+  propagatedBuildInputs = optional zlibSupport zlib;

-  configureFlags = []
-    ++ optional enableShared "--enable-shared"
+  configureFlags = optional enableShared "--enable-shared"
    ++ optional javaSupport "--enable-java";

  patches = [
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@ -1,10 +1,14 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , removeReferencesTo
-, cpp ? false
-, gfortran ? null
-, zlib ? null
-, szip ? null
+, cppSupport ? false
+, fortranSupport ? false
+, fortran
+, zlibSupport ? true
+, zlib
+, szipSupport ? false
+, szip
 , mpiSupport ? false
 , mpi
 , enableShared ? !stdenv.hostPlatform.isStatic
@ -15,7 +19,7 @@

 # cpp and mpi options are mutually exclusive
 # (--enable-unsupported could be used to force the build)
-assert !cpp || !mpiSupport;
+assert !cppSupport || !mpiSupport;

 let inherit (lib) optional optionals; in

@ -28,28 +32,35 @@ stdenv.mkDerivation rec {
  };

  passthru = {
-    inherit mpiSupport;
-    inherit mpi;
+    inherit
+      cppSupport
+      fortranSupport
+      fortran
+      zlibSupport
+      zlib
+      szipSupport
+      szip
+      mpiSupport
+      mpi
+      ;
  };

  outputs = [ "out" "dev" ];

  nativeBuildInputs = [ removeReferencesTo ]
-    ++ optional (gfortran != null) gfortran;
+    ++ optional fortranSupport fortran;

-  buildInputs = []
-    ++ optional (szip != null) szip
+  buildInputs = optional fortranSupport fortran
+    ++ optional szipSupport szip
    ++ optional javaSupport jdk;

-  propagatedBuildInputs = []
-    ++ optional (zlib != null) zlib
+  propagatedBuildInputs = optional zlibSupport zlib
    ++ optional mpiSupport mpi;

-  configureFlags = []
-    ++ optional cpp "--enable-cxx"
-    ++ optional (gfortran != null) "--enable-fortran"
-    ++ optional (szip != null) "--with-szlib=${szip}"
-    ++ optionals mpiSupport ["--enable-parallel" "CC=${mpi}/bin/mpicc"]
+  configureFlags = optional cppSupport "--enable-cxx"
+    ++ optional fortranSupport "--enable-fortran"
+    ++ optional szipSupport "--with-szlib=${szip}"
+    ++ optionals mpiSupport [ "--enable-parallel" "CC=${mpi}/bin/mpicc" ]
    ++ optional enableShared "--enable-shared"
    ++ optional javaSupport "--enable-java"
    ++ optional usev110Api "--with-default-api-version=v110";
--- a/pkgs/tools/misc/rates/default.nix
+++ b/pkgs/tools/misc/rates/default.nix
@ -0,0 +1,25 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rates";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "lunush";
+    repo = pname;
+    rev = version;
+    sha256 = "077qxs4kwfprsai07dninkhmj3ihnghdxan98iv8gmsl3pijbgwh";
+  };
+
+  cargoSha256 = "041sskiq152iywwqd8p7aqsqzbj359zl7ilnp8ahzdqprz3slk1w";
+
+  meta = with lib; {
+    description = "CLI tool that brings currency exchange rates right into your terminal";
+    homepage = "https://github.com/lunush/rates";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/tools/networking/tnat64/default.nix
+++ b/pkgs/tools/networking/tnat64/default.nix
@ -2,20 +2,15 @@

 stdenv.mkDerivation rec {
  pname = "tnat64";
-  version = "0.05";
+  version = "0.06";

  src = fetchFromGitHub {
    owner = "andrewshadura";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "07lmzidbrd3aahk2jvv93cic9gf36pwmgfd63gmy6hjkxf9a6fw9";
+    sha256 = "191j1fpr3bw6fk48npl99z7iq6m1g33f15xk5cay1gnk5f46i2j6";
  };

-  postPatch = ''
-    # Fix usage of deprecated sys_errlist
-    substituteInPlace tnat64.c --replace 'sys_errlist[errno]' 'strerror(errno)'
-  '';
-
  configureFlags = [ "--libdir=$(out)/lib" ];
  nativeBuildInputs = [ autoreconfHook ];

--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@ -5,9 +5,13 @@
 , nettle
 , expat
 , libevent
+, libsodium
+, protobufc
+, hiredis
 , dns-root-data
 , pkg-config
 , makeWrapper
+, symlinkJoin
  #
  # By default unbound will not be built with systemd support. Unbound is a very
  # commmon dependency. The transitive dependency closure of systemd also
@ -21,6 +25,11 @@
 , systemd ? null
  # optionally support DNS-over-HTTPS as a server
 , withDoH ? false
+, withECS ? false
+, withDNSCrypt ? false
+, withDNSTAP ? false
+, withTFO ? false
+, withRedis ? false
 , libnghttp2
 }:

@ -57,8 +66,24 @@ stdenv.mkDerivation rec {
    "--enable-systemd"
  ] ++ lib.optionals withDoH [
    "--with-libnghttp2=${libnghttp2.dev}"
+  ] ++ lib.optionals withECS [
+    "--enable-subnet"
+  ] ++ lib.optionals withDNSCrypt [
+    "--enable-dnscrypt"
+    "--with-libsodium=${symlinkJoin { name = "libsodium-full"; paths = [ libsodium.dev libsodium.out ]; }}"
+  ] ++ lib.optionals withDNSTAP [
+    "--enable-dnstap"
+    "--with-protobuf-c=${protobufc}"
+  ] ++ lib.optionals withTFO [
+    "--enable-tfo-client"
+    "--enable-tfo-server"
+  ] ++ lib.optionals withRedis [
+    "--enable-cachedb"
+    "--with-libhiredis=${hiredis}"
  ];

+  PROTOC_C = if withDNSTAP then "${protobufc}/bin/protoc-c" else null;
+
  # Remove references to compile-time dependencies that are included in the configure flags
  postConfigure = let
    inherit (builtins) storeDir;
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "exploitdb";
-  version = "2021-10-15";
+  version = "2021-10-16";

  src = fetchFromGitHub {
    owner = "offensive-security";
    repo = pname;
    rev = version;
-    sha256 = "sha256-7bQoBYPfePhanh7SCZ6MO/eWtyD8cfWaYjc9AWOT2rc=";
+    sha256 = "sha256-kzMMcipE9AKOWka2yAuljwNG/g+8fF2rYehTtxdQY+k=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/security/ike-scan/default.nix
+++ b/pkgs/tools/security/ike-scan/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "ike-scan";
-  version = "1.9.4";
+  version = "1.9.5";

  src = fetchFromGitHub {
    owner = "royhills";
    repo = pname;
    rev = version;
-    sha256 = "01a39bk9ma2lm59q320m9g11909if5gc3qynd8pzn6slqiq5r8kw";
+    sha256 = "sha256-mbfg8p3y4aKoXpmLuF9GXAMPEqV5CsvetwGCRDJ9UNY=";
  };

  nativeBuildInputs = [
@ -33,11 +33,6 @@ stdenv.mkDerivation rec {
      url = "https://github.com/royhills/ike-scan/pull/15/commits/d864811de08dcddd65ac9b8d0f2acf5d7ddb9dea.patch";
      sha256 = "0wbrq89dl8js7cdivd0c45hckmflan33cpgc3qm5s3az6r4mjljm";
    })
-    (fetchpatch {
-      # Unknown vendor IDs,  https://github.com/royhills/ike-scan/pull/18, was merged but not released
-      url = "https://github.com/royhills/ike-scan/pull/18/commits/e065ddbe471880275dc7975e7da235e7a2097c22.patch";
-      sha256 = "13ly01c96nnd5yh7rxrhv636csm264m5xf2a1inprrzxkkri5sls";
-    })
  ];

  meta = with lib; {
--- a/pkgs/tools/system/auto-cpufreq/default.nix
+++ b/pkgs/tools/system/auto-cpufreq/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonPackage rec {
  pname = "auto-cpufreq";
-  version = "1.6.9";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "AdnanHodzic";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1pri182cgbrhr0adq2784gpv6q8c8kjr0jsh8wpvd1wvfsbqywrm";
+    sha256 = "0b6j26glg1ffihdr2h7dlr1lrbhkclgp17dxmkjgg5gk4mhz799r";
  };

  propagatedBuildInputs = with python3Packages; [ click distro psutil ];
--- a/pkgs/tools/text/tidy-viewer/default.nix
+++ b/pkgs/tools/text/tidy-viewer/default.nix
@ -0,0 +1,29 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tidy-viewer";
+  version = "0.0.21";
+
+  src = fetchFromGitHub {
+    owner = "alexhallam";
+    repo = "tv";
+    rev = version;
+    sha256 = "1zjnc2b9y2f6x114svp31r1lzkak4xfn71qrxch30mq2aj4yzd2l";
+  };
+
+  cargoSha256 = "sha256-M6HInLevKvF4zBNe+Sg8fQK6koefRaO0l5AcrFhH+vI=";
+
+  # this test parses command line arguments
+  # error: Found argument '--test-threads' which wasn't expected, or isn't valid in this context
+  checkFlags = [
+    "--skip=build_reader_can_create_reader_without_file_specified"
+  ];
+
+  meta = with lib; {
+    description = "A cross-platform CLI csv pretty printer that uses column styling to maximize viewer enjoyment";
+    homepage = "https://github.com/alexhallam/tv";
+    changelog = "https://github.com/alexhallam/tv/blob/${version}/CHANGELOG.md";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -5998,7 +5998,9 @@ with pkgs;

  pixz = callPackage ../tools/compression/pixz { };

-  plplot = callPackage ../development/libraries/plplot { };
+  plplot = callPackage ../development/libraries/plplot {
+    inherit (xorg) libX11;
+  };

  pxattr = callPackage ../tools/archivers/pxattr { };

@ -6065,28 +6067,25 @@ with pkgs;

  hddtemp = callPackage ../tools/misc/hddtemp { };

-  hdf4 = callPackage ../tools/misc/hdf4 {
-    szip = null;
-  };
+  hdf4 = callPackage ../tools/misc/hdf4 { };

  hdf5 = callPackage ../tools/misc/hdf5 {
-    gfortran = null;
-    szip = null;
+    fortranSupport = false;
+    fortran = gfortran;
  };

  hdf5_1_10 = callPackage ../tools/misc/hdf5/1.10.nix { };

  hdf5-mpi = appendToName "mpi" (hdf5.override {
-    szip = null;
    mpiSupport = true;
  });

  hdf5-cpp = appendToName "cpp" (hdf5.override {
-    cpp = true;
+    cppSupport = true;
  });

  hdf5-fortran = appendToName "fortran" (hdf5.override {
-    inherit gfortran;
+    fortranSupport = true;
  });

  hdf5-threadsafe = appendToName "threadsafe" (hdf5.overrideAttrs (oldAttrs: {
@ -9776,6 +9775,8 @@ with pkgs;

  thinkpad-scripts = python3.pkgs.callPackage ../tools/misc/thinkpad-scripts { };

+  tidy-viewer = callPackage ../tools/text/tidy-viewer { };
+
  tiled = libsForQt5.callPackage ../applications/editors/tiled { };

  tiledb = callPackage ../development/libraries/tiledb { };
@ -10458,6 +10459,11 @@ with pkgs;
  unbound-full = unbound.override {
    withSystemd = true;
    withDoH = true;
+    withECS = true;
+    withDNSCrypt = true;
+    withDNSTAP = true;
+    withTFO = true;
+    withRedis = true;
  };

  unicorn = callPackage ../development/libraries/unicorn { };
@ -12260,7 +12266,10 @@ with pkgs;
      /**/ if platform.isDarwin then (if platform.isAarch64 then 11 else 7)
      else if platform.isFreeBSD then 7
      else if platform.isAndroid then 12
-      else if platform.isLinux then (if platform.isRiscV then 11 else 7)
+      else if platform.isLinux then
+        /**/ if platform.isRiscV then 11
+        else if platform.isMusl then 11
+        else 7
      else if platform.isWasm then 8
      else latest_version;
    # We take the "max of the mins". Why? Since those are lower bounds of the
@ -13082,6 +13091,12 @@ with pkgs;

  inherit (beam.packages.erlangR21) lfe lfe_1_3;

+  gnudatalanguage = callPackage ../development/interpreters/gnudatalanguage {
+    inherit (llvmPackages) openmp;
+    # MPICH currently build on Darwin
+    mpi = mpich;
+  };
+
  groovy = callPackage ../development/interpreters/groovy { };

  inherit (callPackages ../applications/networking/cluster/hadoop {
@ -18674,11 +18689,12 @@ with pkgs;
  openvdb = callPackage ../development/libraries/openvdb {};

  inherit (callPackages ../development/libraries/libressl { })
-    libressl_3_2;
+    libressl_3_2
+    libressl_3_4;

  # Please keep this pointed to the latest version. See also
  # https://discourse.nixos.org/t/nixpkgs-policy-regarding-libraries-available-in-multiple-versions/7026/2
-  libressl = libressl_3_2;
+  libressl = libressl_3_4;

  boringssl = callPackage ../development/libraries/boringssl { };

@ -25833,6 +25849,8 @@ with pkgs;

  kmymoney = libsForQt5.callPackage ../applications/office/kmymoney { };

+  kn = callPackage ../applications/networking/cluster/kn { };
+
  kodestudio = callPackage ../applications/editors/kodestudio { };

  kondo = callPackage ../applications/misc/kondo { };
@ -32360,6 +32378,8 @@ with pkgs;

  qdl = callPackage ../tools/misc/qdl { };

+  rates = callPackage ../tools/misc/rates { };
+
  rargs = callPackage ../tools/misc/rargs { };

  rancher = callPackage ../applications/networking/cluster/rancher { };
@ -32736,6 +32756,7 @@ with pkgs;

  wasm-pack = callPackage ../development/tools/wasm-pack {
    inherit (darwin.apple_sdk.frameworks) Security;
+    libressl = libressl_3_2;
  };

  wavegain = callPackage ../applications/audio/wavegain { };
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@ -174,6 +174,8 @@ in (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdParty // kdeGea

  qca-qt5 = callPackage ../development/libraries/qca-qt5 { };

+  qcoro = callPackage ../development/libraries/qcoro { };
+
  qcsxcad = callPackage ../development/libraries/science/electronics/qcsxcad { };

  qmltermwidget = callPackage ../development/libraries/qmltermwidget {