Merge staging-next into staging

maintainers/maintainer-list.nix

···
     githubId = 12386805;
     name = "Chua Hou";
   };
+  chuangzhu = {
+    name = "Chuang Zhu";
+    email = "[e-mail]";
+    matrix = "@chuangzhu:matrix.org";
+    github = "chuangzhu";
+    githubId = 31200881;
+    keys = [{
+      longkeyid = "rsa4096/E838CED81CFFD3F9";
+      fingerprint = "5D03 A5E6 0754 A3E3 CA57 5037 E838 CED8 1CFF D3F9";
+    }];
+  };
   chvp = {
     email = "[e-mail]";
     matrix = "@charlotte:vanpetegem.me";
···
   kkallio = {
     email = "[e-mail]";
     name = "Karn Kallio";
+  };
+  klden = {
+    name = "Kenzyme Le";
+    email = "[e-mail]";
+    github = "klDen";
+    githubId = 5478260;
   };
   klntsky = {
     email = "[e-mail]";

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

···
           <link linkend="opt-services.ananicy.enable">services.ananicy</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/prometheus-community/smartctl_exporter">smartctl_exporter</link>,
+          a Prometheus exporter for
+          <link xlink:href="https://en.wikipedia.org/wiki/S.M.A.R.T.">S.M.A.R.T.</link>
+          data. Available as
+          <link xlink:href="options.html#opt-services.prometheus.exporters.smartctl.enable">services.prometheus.exporters.smartctl</link>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-incompatibilities">

nixos/doc/manual/release-notes/rl-2111.section.md

···
 
 - Auto nice daemons [ananicy](https://github.com/Nefelim4ag/Ananicy) and [ananicy-cpp](https://gitlab.com/ananicy-cpp/ananicy-cpp/). Available as [services.ananicy](#opt-services.ananicy.enable).
 
+- [smartctl_exporter](https://github.com/prometheus-community/smartctl_exporter), a Prometheus exporter for [S.M.A.R.T.](https://en.wikipedia.org/wiki/S.M.A.R.T.) data. Available as [services.prometheus.exporters.smartctl](options.html#opt-services.prometheus.exporters.smartctl.enable).
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
 
 - The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix`, now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.

nixos/modules/services/monitoring/prometheus/exporters.nix

···
     "rtl_433"
     "script"
     "snmp"
+    "smartctl"
     "smokeping"
     "sql"
     "surfboard"

nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix

···
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.smartctl;
+  format = pkgs.formats.yaml {};
+  configFile = format.generate "smartctl-exporter.yml" {
+    smartctl_exporter = {
+      bind_to = "${cfg.listenAddress}:${toString cfg.port}";
+      url_path = "/metrics";
+      smartctl_location = "${pkgs.smartmontools}/bin/smartctl";
+      collect_not_more_than_period = cfg.maxInterval;
+      devices = cfg.devices;
+    };
+  };
+in {
+  port = 9633;
+
+  extraOpts = {
+    devices = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = literalExpression ''
+        [ "/dev/sda", "/dev/nvme0n1" ];
+      '';
+      description = ''
+        Paths to disks that will be monitored.
+      '';
+    };
+    maxInterval = mkOption {
+      type = types.str;
+      default = "60s";
+      example = "2m";
+      description = ''
+        Interval that limits how often a disk can be queried.
+      '';
+    };
+  };
+
+  serviceOpts = {
+    serviceConfig = {
+      AmbientCapabilities = [
+        "CAP_SYS_ADMIN"
+      ];
+      CapabilityBoundingSet = [
+        "CAP_SYS_ADMIN"
+      ];
+      DevicePolicy = "closed";
+      DeviceAllow = lib.mkForce cfg.devices;
+      ExecStart = ''
+        ${pkgs.prometheus-smartctl-exporter}/bin/smartctl_exporter -config ${configFile}
+      '';
+      PrivateDevices = lib.mkForce false;
+      ProtectProc = "invisible";
+      ProcSubset = "pid";
+      SupplementaryGroups = [ "disk" ];
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged @resources"
+      ];
+    };
+  };
+}

nixos/modules/services/networking/ddclient.nix

···
   configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
 
   preStart = ''
-    install ${configFile} /run/${RuntimeDirectory}/ddclient.conf
+    install --mode=0400 ${configFile} /run/${RuntimeDirectory}/ddclient.conf
     ${lib.optionalString (cfg.configFile == null) (if (cfg.passwordFile != null) then ''
       password=$(printf "%q" "$(head -n 1 "${cfg.passwordFile}")")
       sed -i "s|^password=$|password=$password|" /run/${RuntimeDirectory}/ddclient.conf

nixos/modules/services/networking/knot.nix

···
   };
 
   config = mkIf config.services.knot.enable {
+    users.groups.knot = {};
     users.users.knot = {
       isSystemUser = true;
       group = "knot";
       description = "Knot daemon user";
     };
 
-    users.groups.knot.gid = null;
     systemd.services.knot = {
       unitConfig.Documentation = "man:knotd(8) man:knot.conf(5) man:knotc(8) https://www.knot-dns.cz/docs/${cfg.package.version}/html/";
       description = cfg.package.meta.description;
···
         Type = "notify";
         ExecStart = "${cfg.package}/bin/knotd --config=${configFile} --socket=${socketFile} ${concatStringsSep " " cfg.extraArgs}";
         ExecReload = "${knot-cli-wrappers}/bin/knotc reload";
-        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE CAP_SETPCAP";
-        AmbientCapabilities = "CAP_NET_BIND_SERVICE CAP_SETPCAP";
+        User = "knot";
+        Group = "knot";
+
+        AmbientCapabilities = [
+          "CAP_NET_BIND_SERVICE"
+        ];
+        CapabilityBoundingSet = [
+          "CAP_NET_BIND_SERVICE"
+        ];
+        DeviceAllow = "";
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
         NoNewPrivileges = true;
-        User = "knot";
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = false; # breaks capability passing
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        Restart = "on-abort";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime =true;
+        RestrictSUIDSGID = true;
         RuntimeDirectory = "knot";
         StateDirectory = "knot";
         StateDirectoryMode = "0700";
-        PrivateDevices = true;
-        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
         SystemCallArchitectures = "native";
-        Restart = "on-abort";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        UMask = "0077";
       };
     };
 

nixos/modules/services/x11/desktop-managers/pantheon.nix

···
     })
 
     (mkIf serviceCfg.contractor.enable {
-      environment.systemPackages = with  pkgs.pantheon; [
+      environment.systemPackages = with pkgs.pantheon; [
         contractor
-        extra-elementary-contracts
+        file-roller-contract
+        gnome-bluetooth-contract
       ];
 
       environment.pathsToLink = [

nixos/tests/knot.nix

···
   nodes = {
     master = { lib, ... }: {
       imports = [ common ];
+
+      # trigger sched_setaffinity syscall
+      virtualisation.cores = 2;
+
       networking.interfaces.eth1 = {
         ipv4.addresses = lib.mkForce [
           { address = "192.168.0.1"; prefixLength = 24; }
···
 
             test(host, "RRSIG", "www.example.com", r"RR set signature is")
             test(host, "DNSKEY", "example.com", r"DNSSEC key is")
+
+    master.log(master.succeed("systemd-analyze security knot.service | grep -v '✓'"))
   '';
 })

nixos/tests/prometheus-exporters.nix

···
       '';
     };
 
+    smartctl = {
+      exporterConfig = {
+        enable = true;
+        devices = [
+          "/dev/vda"
+        ];
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-smartctl-exporter.service")
+        wait_for_open_port("9633")
+        wait_until_succeeds(
+          "curl -sSf 'localhost:9633/metrics'"
+        )
+        wait_until_succeeds(
+            'journalctl -eu prometheus-smartctl-exporter.service -o cat | grep "/dev/vda: Unable to detect device type"'
+        )
+      '';
+    };
+
     smokeping = {
       exporterConfig = {
         enable = true;

pkgs/applications/audio/ocenaudio/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "ocenaudio";
-  version = "3.10.6";
+  version = "3.11.0";
 
   src = fetchurl {
     url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    sha256 = "0fgvm1xw2kgrqj3w6slpfxbb3pw9k8i0dz16q9d5d8gyyvr2mh8g";
+    sha256 = "1yflpyl0d1mi0zxdyrlbg0px95s2c945ahy0agc8rha01ccf7jwy";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/lite-xl/0001-replace-unpack-with-table-unpack.patch

···
+diff --git a/data/core/commands/findreplace.lua b/data/core/commands/findreplace.lua
+index 5d27aa6..db6a2dd 100644
+--- a/data/core/commands/findreplace.lua
++++ b/data/core/commands/findreplace.lua
+@@ -37,7 +37,7 @@ local function update_preview(sel, search_fn, text)
+     last_view:scroll_to_line(line2, true)
+     found_expression = true
+   else
+-    last_view.doc:set_selection(unpack(sel))
++    last_view.doc:set_selection(table.unpack(sel))
+     found_expression = false
+   end
+ end
+@@ -55,7 +55,7 @@ end
+ local function find(label, search_fn)
+   last_view, last_sel = core.active_view,
+     { core.active_view.doc:get_selection() }
+-  local text = last_view.doc:get_text(unpack(last_sel))
++  local text = last_view.doc:get_text(table.unpack(last_sel))
+   found_expression = false
+ 
+   core.command_view:set_text(text, true)
+@@ -69,8 +69,8 @@ local function find(label, search_fn)
+       last_fn, last_text = search_fn, text
+     else
+       core.error("Couldn't find %q", text)
+-      last_view.doc:set_selection(unpack(last_sel))
+-      last_view:scroll_to_make_visible(unpack(last_sel))
++      last_view.doc:set_selection(table.unpack(last_sel))
++      last_view:scroll_to_make_visible(table.unpack(last_sel))
+     end
+   end, function(text)
+     update_preview(last_sel, search_fn, text)
+@@ -79,8 +79,8 @@ local function find(label, search_fn)
+   end, function(explicit)
+     core.status_view:remove_tooltip()
+     if explicit then
+-      last_view.doc:set_selection(unpack(last_sel))
+-      last_view:scroll_to_make_visible(unpack(last_sel))
++      last_view.doc:set_selection(table.unpack(last_sel))
++      last_view:scroll_to_make_visible(table.unpack(last_sel))
+     end
+   end)
+ end
+diff --git a/data/core/doc/init.lua b/data/core/doc/init.lua
+index 2e72907..0e61ffb 100644
+--- a/data/core/doc/init.lua
++++ b/data/core/doc/init.lua
+@@ -198,9 +198,9 @@ local function selection_iterator(invariant, idx)
+   local target = invariant[3] and (idx*4 - 7) or (idx*4 + 1)
+   if target > #invariant[1] or target <= 0 or (type(invariant[3]) == "number" and invariant[3] ~= idx - 1) then return end
+   if invariant[2] then
+-    return idx+(invariant[3] and -1 or 1), sort_positions(unpack(invariant[1], target, target+4))
++    return idx+(invariant[3] and -1 or 1), sort_positions(table.unpack(invariant[1], target, target+4))
+   else
+-    return idx+(invariant[3] and -1 or 1), unpack(invariant[1], target, target+4)
++    return idx+(invariant[3] and -1 or 1), table.unpack(invariant[1], target, target+4)
+   end
+ end
+ 
+@@ -345,7 +345,7 @@ function Doc:raw_insert(line, col, text, undo_stack, time)
+ 
+   -- push undo
+   local line2, col2 = self:position_offset(line, col, #text)
+-  push_undo(undo_stack, time, "selection", unpack(self.selections))
++  push_undo(undo_stack, time, "selection", table.unpack(self.selections))
+   push_undo(undo_stack, time, "remove", line, col, line2, col2)
+ 
+   -- update highlighter and assure selection is in bounds
+@@ -357,7 +357,7 @@ end
+ function Doc:raw_remove(line1, col1, line2, col2, undo_stack, time)
+   -- push undo
+   local text = self:get_text(line1, col1, line2, col2)
+-  push_undo(undo_stack, time, "selection", unpack(self.selections))
++  push_undo(undo_stack, time, "selection", table.unpack(self.selections))
+   push_undo(undo_stack, time, "insert", line1, col1, text)
+ 
+   -- get line content before/after removed text
+diff --git a/data/core/tokenizer.lua b/data/core/tokenizer.lua
+index d95baeb..f77fed4 100644
+--- a/data/core/tokenizer.lua
++++ b/data/core/tokenizer.lua
+@@ -161,7 +161,7 @@ function tokenizer.tokenize(incoming_syntax, text, state)
+         if count % 2 == 0 then break end
+       end
+     until not res[1] or not close or not target[3]
+-    return unpack(res)
++    return table.unpack(res)
+   end
+   
+   while i <= #text do

pkgs/applications/editors/lite-xl/default.nix

···
 { agg
 , fetchFromGitHub
-, fetchpatch
 , Foundation
 , freetype
 , lib
···
 
 stdenv.mkDerivation rec {
   pname = "lite-xl";
-  version = "2.0.1";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "lite-xl";
     repo = "lite-xl";
     rev = "v${version}";
-    sha256 = "sha256-+RbmT6H/5Ldhv3qOClxMjCSGMudbkGtkjo2SpGqExao=";
+    sha256 = "sha256-8Hw2zDYynWG/NwxtWgbEVUCzrtRVkOhwtsisURNqUn8=";
   };
 
   patches = [
-    # Fixes compatibility with Lua5.2, remove patch when PR merged
-    # https://github.com/lite-xl/lite-xl/pull/435
-    (fetchpatch {
-      name = "0001-replace-unpack-with-table.unpack.patch";
-      url = "https://github.com/lite-xl/lite-xl/commit/30ccde896d1ffe37cbd8990e9b8aaef275e18935.patch";
-      sha256 = "sha256-IAe3jIyD3OtZtu1V7MtPR4QzFKvU/aV/nLQ4U9nHyIQ=";
-    })
-    # Lets meson fallback to the system reproc if available.
-    # remove patch when 2.0.2 is proposed.
-    (fetchpatch {
-      name = "0002-use-dependency-fallbacks-use-system-reproc-if-available.patch";
-      url = "https://github.com/lite-xl/lite-xl/commit/973acb787aacb0164b2f4ae6fe335d250ba80a7b.patch";
-      sha256 = "sha256-GmgATsRlj1FePmw3+AoWEMZIo2eujHYewKQCx583qbU=";
-    })
+    # Fixes compatibility with Lua5.2, remove patch when a new release covers this
+    ./0001-replace-unpack-with-table-unpack.patch
   ];
 
   nativeBuildInputs = [ meson ninja pkg-config ];

pkgs/applications/editors/netbeans/default.nix

···
 }:
 
 let
-  version = "12.5";
+  version = "12.6";
   desktopItem = makeDesktopItem {
     name = "netbeans";
     exec = "netbeans";
···
   inherit version;
   src = fetchurl {
     url = "mirror://apache/netbeans/netbeans/${version}/netbeans-${version}-bin.zip";
-    sha512 = "3yagspb2clcvd87a9vnpwd64w3afm4kyprqyjccpckysh4php5vhf7dfza3zhs4yzmkikc2pfs7470w54mxz9rcmaixh23h3hlgd1ii";
+    hash = "sha512-K0HjEO/yw9h+2+Y5CvxyYG1+kx+KH9NSn+QsKCsvh/rG/ilYLYyy93iZfx+wzwrgEfRtfMpZGtDAxd6nyUSnCA==";
   };
 
   buildCommand = ''

pkgs/applications/graphics/gimp/plugins/default.nix

···
   };
 
   texturize = pluginDerivation {
-    name = "texturize-2.2.2017-07-28";
+    pname = "texturize";
+    version = "2.2+unstable=2021-12-03";
     src = fetchFromGitHub {
       owner = "lmanul";
       repo = "gimp-texturize";
-      rev = "de4367f71e40fe6d82387eaee68611a80a87e0e1";
-      sha256 = "1zzvbczly7k456c0y6s92a1i8ph4ywmbvdl8i4rcc29l4qd2z8fw";
+      rev = "9ceff0d411cda018108e5477320669b8d00d811e";
+      sha256 = "haYS0K3oAPlHtHB8phOCX5/gtWq9uiVQhG5ZhAFX0t0=";
     };
-    installPhase = "installPlugin src/texturize";
-    meta.broken = true; # https://github.com/lmanul/gimp-texturize/issues/1
+    nativeBuildInputs = with pkgs; [
+      meson
+      ninja
+      gettext
+    ];
   };
 
   waveletSharpen = pluginDerivation {

pkgs/applications/misc/fspy/default.nix

···
+{ appimageTools, lib, fetchurl }:
+let
+  pname = "fspy";
+  version = "1.0.3";
+  name = "${pname}-v${version}";
+
+  src = fetchurl {
+    url = "https://github.com/stuffmatic/fSpy/releases/download/v${version}/${pname}-${version}-x86_64.AppImage";
+    sha256 = "sha256-L+qsSExuEkzZkjnV/J6rrZ3BXqWQd+IfsN6a3kvQF3A=";
+  };
+
+in appimageTools.wrapType2 {
+  inherit name src;
+
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/${pname}
+  '';
+
+  meta = with lib; {
+    description = "A cross platform app for quick and easy still image camera matching";
+    license = licenses.gpl3;
+    homepage = "https://fspy.io/";
+    maintainers = with maintainers; [ polygon ];
+    platforms = platforms.linux;
+    mainProgram = "fspy";
+  };
+}

pkgs/applications/misc/mobilecoin-wallet/default.nix

···
+{ lib, fetchurl, appimageTools }:
+
+let
+  pname = "mobilecoin-wallet";
+  version = "1.4.1";
+  name = "${pname}-${version}";
+  src = fetchurl {
+    url = "https://github.com/mobilecoinofficial/desktop-wallet/releases/download/v${version}/MobileCoin-Wallet-${version}.AppImage";
+    sha256 = "sha256-x5frHgkEz77pqSB6YANRtZmCzaK/RxRzMElLu49lxPk=";
+  };
+  appimageContents = appimageTools.extractType2 { inherit name src; };
+
+in appimageTools.wrapType2 {
+  inherit name src;
+
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libsecret ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/${pname}
+
+    mkdir -p $out/share/${pname}
+    cp -a ${appimageContents}/locales $out/share/${pname}
+    cp -a ${appimageContents}/resources $out/share/${pname}
+    cp -a ${appimageContents}/usr/share/icons $out/share/
+
+    install -Dm 644 ${appimageContents}/${pname}.desktop -t $out/share/applications/
+
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace "AppRun" "${pname}"
+  '';
+
+  meta = with lib; {
+    description = "A user-friendly desktop wallet with support for transaction history, encrypted contact book, gift codes, and payments";
+    homepage = "https://github.com/mobilecoinofficial/desktop-wallet";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/applications/misc/remarkable/restream/default.nix

···
 , ffmpeg-full
 , fetchFromGitHub
 , openssh
+, netcat
 , makeWrapper
 }:
 
 stdenv.mkDerivation rec {
   pname = "restream";
-  version = "1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "rien";
     repo = pname;
     rev = version;
-    sha256 = "18z17chl7r5dg12xmr3f9gbgv97nslm8nijigd03iysaj6dhymp3";
+    sha256 = "0vyj0kng8c9inv2rbw1qdr43ic15s5x8fvk9mbw0vpc6g723x99g";
   };
-
-  nativeBuildInputs = [ makeWrapper ];
 
   dontConfigure = true;
   dontBuild = true;
···
     runHook postInstall
   '';
 
-  postInstall = ''
-    # `ffmpeg-full` is used here to bring in `ffplay`, which is used to display
-    # the reMarkable framebuffer
-    wrapProgram "$out/bin/restream" --suffix PATH ":" "${lib.makeBinPath [ ffmpeg-full lz4 openssh ]}"
+  postInstall = let
+    deps = [
+      # `ffmpeg-full` is used here to bring in `ffplay`, which is used
+      # to display the reMarkable framebuffer
+      ffmpeg-full
+      lz4
+      openssh
+      # Libressl netcat brings in `nc` which used for --uncompressed mode.
+      netcat
+    ];
+  in ''
+    # This `sed` command has the same effect as `wrapProgram`, except
+    # without .restream-wrapped store paths appearing everywhere.
+    sed -i \
+      '2i export PATH=$PATH''${PATH:+':'}${lib.makeBinPath deps}' \
+      "$out/bin/restream"
   '';
 
   meta = with lib; {

pkgs/applications/misc/terminal-typeracer/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "terminal-typeracer";
-  version = "2.0.4";
+  version = "2.0.8";
 
   src = fetchFromGitLab {
     owner = "ttyperacer";
     repo = pname;
     rev = "v${version}";
-    sha256 = "RjGHY6KN6thxbg9W5FRwaAmUeD+5/WCeMCvzFHqZ+J4=";
+    sha256 = "Fb2MCQaQaJseXa8Csesz1s5Yel4wcSMxfMeKSW7rlU4=";
   };
 
-  cargoSha256 = "sha256-A7O/e8PAcW36i8pT71SkWoWDIiMuEhSS9SmASNzNCjk=";
+  cargoSha256 = "sha256-SAVDSUm2jpDwTfwo4L6MVUKzBxZvCfjn4UNIGUJziSY=";
 
   buildInputs = [ openssl sqlite ] ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
   nativeBuildInputs = [ pkg-config ];
···
     homepage = "https://gitlab.com/ttyperacer/terminal-typeracer";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ yoctocell ];
-    platforms = platforms.x86_64;
+    platforms = platforms.unix;
   };
 }

pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "rocketchat-desktop";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchurl {
     url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat_${version}_amd64.deb";
-    sha256 = "1691mzg52hkvkzm4pvmjyc3n04ppxk36rjk7zxh8682ciszz9pl3";
+    sha256 = "1z6crwb7svg7iw59gm88d29yknhk84hwcps9f565c3mabjdxzhw2";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/sniffers/wireshark/default.nix

···
 with lib;
 
 let
-  version = "3.4.9";
+  version = "3.4.10";
   variant = if withQt then "qt" else "cli";
 
 in stdenv.mkDerivation {
···
 
   src = fetchurl {
     url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "084nv4fbgpxsf6b6cfi6cinn8l3wsbn0g8lsd7p2aifjkf15wln6";
+    sha256 = "sha256-iqfvSkSuYruNtGPPdh4swDuXMF4Od+1b5T+oNykYfO8=";
   };
 
   cmakeFlags = [

pkgs/applications/office/kalendar/default.nix

···
+{ lib
+, mkDerivation
+, fetchFromGitLab
+, cmake
+, extra-cmake-modules
+, makeWrapper
+
+, qtbase
+, qtquickcontrols2
+, qtsvg
+, qtlocation
+, qtdeclarative
+
+, kirigami2
+, kdbusaddons
+, ki18n
+, kcalendarcore
+, kconfigwidgets
+, kwindowsystem
+, kcoreaddons
+, kcontacts
+, kitemmodels
+, kxmlgui
+, knotifications
+, kiconthemes
+, kservice
+, kmime
+, kpackage
+, eventviews
+, calendarsupport
+
+, akonadi
+, akonadi-contacts
+, akonadi-calendar-tools
+, kdepim-runtime
+}:
+
+mkDerivation rec {
+  pname = "kalendar";
+  version = "0.3.1";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "pim";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-foG8j/MRbDZyzM9KmxEARfWUQXMz8ylQgersE1/gtnQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    makeWrapper
+  ];
+
+  buildInputs = [
+    qtbase
+    qtquickcontrols2
+    qtsvg
+    qtlocation
+    qtdeclarative
+
+    kirigami2
+    kdbusaddons
+    ki18n
+    kcalendarcore
+    kconfigwidgets
+    kwindowsystem
+    kcoreaddons
+    kcontacts
+    kitemmodels
+    kxmlgui
+    knotifications
+    kiconthemes
+    kservice
+    kmime
+    kpackage
+    eventviews
+    calendarsupport
+
+    akonadi-contacts
+    akonadi-calendar-tools
+  ];
+
+  propagatedUserEnvPkgs = [ akonadi kdepim-runtime ];
+
+  meta = with lib; {
+    description = "A calendar application using Akonadi to sync with external services (Nextcloud, GMail, ...)";
+    homepage = "https://invent.kde.org/pim/kalendar/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ chuangzhu ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/version-management/git-and-tools/glitter/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "glitter";
-  version = "1.5.9";
+  version = "1.5.10";
 
   src = fetchFromGitHub {
     owner = "milo123459";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jznlGPRYzWND5qdopD4iMz1IgduP8hXV4T+IGkSI3Qg=";
+    sha256 = "sha256-4d1zMCQ4rYU5kL7Qhwibt6+IfKHUjYndHHeX7JT9zwU=";
   };
 
-  cargoSha256 = "sha256-HAEyb2iVGRxaHQhy3zUgmRiBtXHmyxgmmh1R8wwoBs0=";
+  cargoSha256 = "sha256-eaSQGbsvAas7CLMtgSNWCqdrYU5Kc/0GY10rkNK05Uo=";
 
   # tests require it to be in a git repository
   preCheck = ''

pkgs/applications/version-management/gitea/default.nix

···
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.15.6";
+  version = "1.15.7";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "sha256-FMM/iQAxJcymv4jYBzaBXG0Uy8UxHh9gFWB5gzV9cn0=";
+    sha256 = "sha256-Ckg8XKCPnyp4a0kXJrqju2jAJvD4tzjomaeJxlFwYzg=";
   };
 
   unpackPhase = ''

pkgs/data/fonts/junicode/default.nix

···
-{ lib, fetchzip }:
+{ lib, fetchFromGitHub }:
 
 let
   pname = "junicode";
-  version = "1.002";
-in fetchzip {
+  version = "1.003";
+in
+fetchFromGitHub {
   name = "${pname}-${version}";
 
-  url = "mirror://sourceforge/junicode/junicode/junicode-${version}/junicode-${version}.zip";
+  owner = "psb1558";
+  repo = "Junicode-font";
+  rev = "55d816d91a5e19795d9b66edec478379ee2b9ddb";
 
   postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/junicode-ttf
+    local out_ttf=$out/share/fonts/junicode-ttf
+    mkdir -p $out_ttf
+    tar -f $downloadedFile -C $out_ttf --wildcards -x '*.ttf' --strip=2
   '';
 
-  sha256 = "1n170gw41lr0zr5958z5cgpg6i1aa7kj7iq9s6gdh1cqq7hhgd08";
+  sha256 = "1v334gljmidh58kmrarz5pf348b0ac7vh25f1xs3gyvn78khh5nw";
 
   meta = {
-    homepage = "http://junicode.sourceforge.net/";
+    homepage = "https://github.com/psb1558/Junicode-font";
     description = "A Unicode font for medievalists";
     maintainers = with lib.maintainers; [ ivan-timokhin ];
     license = lib.licenses.ofl;

pkgs/data/themes/adwaita-qt/default.nix

···
 
 mkDerivation rec {
   pname = "adwaita-qt";
-  version = "1.4.0";
+  version = "1.4.1";
 
   outputs = [ "out" "dev" ];
 
···
     owner = "FedoraQt";
     repo = pname;
     rev = version;
-    sha256 = "sha256-KkqLUhS0JMwJsgu8fv5iGozH3Xv+cXumxx5IewZTTPc=";
+    sha256 = "sha256-t9vv1KcMUg8Qe7lhVMN4GO+VPoT7QzeoQ6hV4fesA8U=";
   };
 
   nativeBuildInputs = [

pkgs/data/themes/material-kwin-decoration/default.nix

···
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, extra-cmake-modules
+, qtx11extras
+, kcoreaddons
+, kguiaddons
+, kconfig
+, kdecoration
+, kconfigwidgets
+, kwindowsystem
+, kiconthemes
+, kwayland
+}:
+
+mkDerivation rec {
+  pname = "material-kwin-decoration";
+  version = "unstable-20211028";
+
+  src = fetchFromGitHub {
+    owner = "Zren";
+    repo = "material-decoration";
+    rev = "cc5cc399a546b66907629b28c339693423c894c8";
+    sha256 = "sha256-aYlnPFhf+ISVe5Ycryu5BSXY8Lb5OoueMqnWQZiv6Lc=";
+  };
+
+  nativeBuildInputs = [ cmake extra-cmake-modules ];
+
+  buildInputs = [
+    qtx11extras
+    kcoreaddons
+    kguiaddons
+    kdecoration
+    kconfig
+    kconfigwidgets
+    kwindowsystem
+    kiconthemes
+    kwayland
+  ];
+
+  meta = with lib; {
+    description = "Material-ish window decoration theme for KWin";
+    homepage = "https://github.com/Zren/material-decoration";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.nickcao ];
+  };
+}

pkgs/desktops/pantheon/default.nix

···
 
   elementary-shortcut-overlay = callPackage ./desktop/elementary-shortcut-overlay { };
 
-  extra-elementary-contracts = callPackage ./desktop/extra-elementary-contracts {
-    inherit (gnome) file-roller gnome-bluetooth;
+  file-roller-contract = callPackage ./desktop/file-roller-contract {
+    inherit (gnome) file-roller;
   };
 
   gala = callPackage ./desktop/gala {
     inherit (gnome) gnome-desktop;
+  };
+
+  gnome-bluetooth-contract = callPackage ./desktop/gnome-bluetooth-contract {
+    inherit (gnome) gnome-bluetooth;
   };
 
   wingpanel = callPackage ./desktop/wingpanel { };
···
   cerbere = throw "Cerbere is now obsolete https://github.com/elementary/cerbere/releases/tag/2.5.1.";
 
   elementary-screenshot-tool = elementary-screenshot; # added 2021-07-21
+
+  extra-elementary-contracts = throw "extra-elementary-contracts has been removed as all contracts have been upstreamed."; # added 2021-12-01
 
 })

pkgs/desktops/pantheon/desktop/extra-elementary-contracts/default.nix

···
-{ lib
-, stdenv
-, substituteAll
-, fetchFromGitHub
-, file-roller
-, gnome-bluetooth
-}:
-
-stdenv.mkDerivation rec {
-  pname = "extra-elementary-contracts";
-  version = "2018-08-21";
-
-  src = fetchFromGitHub {
-    owner = "worldofpeace";
-    repo = pname;
-    rev = "a05dfb00695854163805b666185e3e9f31b6eb83";
-    sha256 = "0fkaf2w4xg0n9faj74rgzy7gvd3yz112l058b157a3pr39vpci7g";
-  };
-
-  patches = [
-    (substituteAll {
-      src = ./exec-path.patch;
-      file_roller = file-roller;
-      gnome_bluetooth = gnome-bluetooth;
-    })
-  ];
-
-  dontBuild = true;
-  dontConfigure = true;
-
-  installPhase = ''
-    mkdir -p $out/share/contractor
-
-    cp *.contract $out/share/contractor/
-  '';
-
-  meta = with lib; {
-    description = "Extra contractor files for elementary";
-    homepage = "https://github.com/worldofpeace/extra-elementary-contracts";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ worldofpeace ];
-    platforms = platforms.linux;
-  };
-}

pkgs/desktops/pantheon/desktop/extra-elementary-contracts/exec-path.patch pkgs/desktops/pantheon/desktop/file-roller-contract/exec-path.patch

···
-diff --git a/file-roller-compress.contract b/file-roller-compress.contract
-index 8de5396..de7e939 100644
---- a/file-roller-compress.contract
-+++ b/file-roller-compress.contract
-@@ -3,6 +3,6 @@ Name=Compress
+diff --git a/io.elementary.contractor.file-roller-compress.contract b/io.elementary.contractor.file-roller-compress.contract
+index 11e4da3..d58549f 100644
+--- a/io.elementary.contractor.file-roller-compress.contract
++++ b/io.elementary.contractor.file-roller-compress.contract
+@@ -3,5 +3,5 @@ Name=Compress
  Icon=add-files-to-archive
  Description=Create a compressed archive with the selected objects
  MimeType=!archive;inode/blockdevice;inode/chardevice;inode/fifo;inode/socket;
 -Exec=file-roller --add %U
 +Exec=@file_roller@/bin/file-roller --add %U
  Gettext-Domain=file-roller
- 
-diff --git a/file-roller-extract-here.contract b/file-roller-extract-here.contract
+diff --git a/io.elementary.contractor.file-roller-extract-here.contract b/io.elementary.contractor.file-roller-extract-here.contract
 index 184a6f2..345f4e7 100644
---- a/file-roller-extract-here.contract
-+++ b/file-roller-extract-here.contract
+--- a/io.elementary.contractor.file-roller-extract-here.contract
++++ b/io.elementary.contractor.file-roller-extract-here.contract
 @@ -3,5 +3,5 @@ Name=Extract Here
  Icon=extract-archive
  Description=Extract the contents of the archives in the archive folder and quit the program
···
 -Exec=file-roller --extract-here %U
 +Exec=@file_roller@/bin/file-roller --extract-here %U
  Gettext-Domain=file-roller
-diff --git a/gnome-bluetooth.contract b/gnome-bluetooth.contract
-index 745dbbe..8cc0102 100644
---- a/gnome-bluetooth.contract
-+++ b/gnome-bluetooth.contract
-@@ -3,5 +3,5 @@ Name=Send files via Bluetooth
- Icon=bluetooth
- Description=Send files to device...
- MimeType=!inode;
--Exec=bluetooth-sendto %F
-+Exec=@gnome_bluetooth@/bin/bluetooth-sendto %F
- Gettext-Domain=gnome-bluetooth2

pkgs/desktops/pantheon/desktop/file-roller-contract/default.nix

···
+{ lib
+, stdenv
+, fetchFromGitHub
+, substituteAll
+, file-roller
+}:
+
+stdenv.mkDerivation rec {
+  pname = "file-roller-contract";
+  version = "unstable-2021-02-23";
+
+  src = fetchFromGitHub {
+    owner = "elementary";
+    repo = pname;
+    rev = "cf001d84a7e2ddcfbee2cfdb19885798a869833e";
+    sha256 = "sha256-jnXq44NiQiSYsvaBF828TklLg9d6z6n+gCZKgbFiERI=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./exec-path.patch;
+      file_roller = file-roller;
+    })
+  ];
+
+  dontConfigure = true;
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/contractor
+    cp *.contract $out/share/contractor/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Contractor extension for File Roller";
+    homepage = "https://github.com/elementary/file-roller-contract";
+    license = licenses.gpl3Plus;
+    maintainers = teams.pantheon.members;
+    platforms = platforms.linux;
+  };
+}

pkgs/desktops/pantheon/desktop/gnome-bluetooth-contract/default.nix

···
+{ lib
+, stdenv
+, fetchFromGitHub
+, substituteAll
+, gnome-bluetooth
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gnome-bluetooth-contract";
+  version = "unstable-2021-02-23";
+
+  src = fetchFromGitHub {
+    owner = "elementary";
+    repo = pname;
+    rev = "8dcd4d03dc7a7d487980fd8bc95af985dc4fff5c";
+    sha256 = "sha256-9eX6j/cvN/CoqrHrh9mZEsUJ8viDWIGxIva1xFwIK7c=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./exec-path.patch;
+      gnome_bluetooth = gnome-bluetooth;
+    })
+  ];
+
+  dontConfigure = true;
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/contractor
+    cp *.contract $out/share/contractor/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Contractor extension for GNOME Bluetooth";
+    homepage = "https://github.com/elementary/gnome-bluetooth-contract";
+    license = licenses.gpl3Plus;
+    maintainers = teams.pantheon.members;
+    platforms = platforms.linux;
+  };
+}

pkgs/desktops/pantheon/desktop/gnome-bluetooth-contract/exec-path.patch

···
+diff --git a/io.elementary.contracter.gnome-bluetooth.contract b/io.elementary.contracter.gnome-bluetooth.contract
+index 3eb2334..ce0e5f5 100644
+--- a/io.elementary.contracter.gnome-bluetooth.contract
++++ b/io.elementary.contracter.gnome-bluetooth.contract
+@@ -3,5 +3,5 @@ Name=Send Files via Bluetooth
+ Icon=bluetooth
+ Description=Send files to device...
+ MimeType=!inode;
+-Exec=bluetooth-sendto %F
++Exec=@gnome_bluetooth@/bin/bluetooth-sendto %F
+ Gettext-Domain=gnome-bluetooth2

pkgs/development/libraries/intel-media-driver/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
-  version = "21.4.2";
+  version = "21.4.3";
 
   outputs = [ "out" "dev" ];
 
···
     owner = "intel";
     repo = "media-driver";
     rev = "intel-media-${version}";
-    sha256 = "0hphpv3n2cdxmbyiwly7v9r0ijdq6hfnw604xz42jqgh9idi6h55";
+    sha256 = "04r03f48j1nly0j6aq8017va9m3yrnscv6lbrvf3a98fpwk9gc1l";
   };
 
   patches = [

pkgs/development/libraries/libdeltachat/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.69.0";
+  version = "1.70.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = version;
-    hash = "sha256-yW6MXDb7kiI24akJrEPHeb4bI8jEldBcPYx+5+dwJR0=";
+    hash = "sha256-702XhFWvFG+g++3X97sy6C5DMNWogv1Xbr8QPR8QyLo=";
   };
 
   patches = [
···
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-76TraZCJhppPhkdQfAf1XqOoK7RS+VoYIp2keTn4es4=";
+    hash = "sha256-MiSGJMXe8vouv4XEHXq274FHEvBMtd7IX6DyNJIWYeU=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/liboping/default.nix

···
-{ stdenv, fetchurl, ncurses ? null, perl ? null, lib }:
+{ stdenv, fetchurl, fetchpatch, ncurses ? null, perl ? null, lib }:
 
 stdenv.mkDerivation rec {
   pname = "liboping";
···
     # Add support for ncurses-6.3. A backport of patch pending upstream
     # inclusion: https://github.com/octo/liboping/pull/61
     ./ncurses-6.3.patch
+
+    # Pull pending fix for format arguments mismatch:
+    #  https://github.com/octo/liboping/pull/60
+    (fetchpatch {
+      name = "format-args.patch";
+      url = "https://github.com/octo/liboping/commit/7a50e33f2a686564aa43e4920141e6f64e042df1.patch";
+      sha256 = "118fl3k84m3iqwfp49g5qil4lw1gcznzmyxnfna0h7za2nm50cxw";
+    })
   ];
 
   NIX_CFLAGS_COMPILE = lib.optionalString

pkgs/development/libraries/rdkafka/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "rdkafka";
-  version = "1.8.0";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "edenhill";
     repo = "librdkafka";
     rev = "v${version}";
-    sha256 = "sha256-LTO27UQqGHOEOXaw2Aln1i37ZaXIAKK8r7P2WAx8nIQ=";
+    sha256 = "sha256-YagvXeusHThUo5/1mMs+r+Nr03vAagdnFMkwX3hJsq4=";
   };
 
   nativeBuildInputs = [ pkg-config python3 ];

pkgs/development/python-modules/aiomusiccast/default.nix

···
 
 buildPythonPackage rec {
   pname = "aiomusiccast";
-  version = "0.14.0";
+  version = "0.14.2";
 
   format = "pyproject";
 
···
     owner = "vigonotion";
     repo = "aiomusiccast";
     rev = version;
-    sha256 = "sha256-Zb2wwqKXtXlPvfmDNOlTHho9zHFFJOQxqoeqL//Z69M=";
+    sha256 = "sha256-5xIz36FgNwcaesmkYp3EWTxCe/8RaUJOJW9dqK+eang=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/django-redis/default.nix

···
 , fetchFromGitHub
 , pythonOlder
 , buildPythonPackage
+
+# propagated
 , django
+, hiredis
+, lz4
+, msgpack
 , redis
+
+# testing
+, pkgs
+, pytest-django
+, pytest-mock
 , pytestCheckHook
 }:
 
-buildPythonPackage rec {
+let
   pname = "django-redis";
-  version = "5.0.0";
+  version = "5.1.0";
+in
+buildPythonPackage {
+  inherit pname version;
   format = "setuptools";
   disabled = pythonOlder "3.6";
 
···
     owner = "jazzband";
     repo = "django-redis";
     rev = version;
-    sha256 = "1np10hfyg4aamlz7vav9fy80gynb1lhl2drqkbckr3gg1gbz6crj";
+    sha256 = "sha256-S94qH2W5e65yzGfPxpwBUKhvvVS0Uc/zSyo66bnvzf4=";
   };
 
   postPatch = ''
···
 
   propagatedBuildInputs = [
     django
+    hiredis
+    lz4
+    msgpack
     redis
   ];
 
···
     "django_redis"
   ];
 
+  DJANGO_SETTINGS_MODULE = "tests.settings.sqlite";
+
+  preCheck = ''
+    ${pkgs.redis}/bin/redis-server &
+  '';
+
   checkInputs = [
+    pytest-django
+    pytest-mock
     pytestCheckHook
   ];
 
-  disabledTestPaths = [
-    "tests/test_backend.py"  # django.core.exceptions.ImproperlyConfigured: Requested setting DJANGO_REDIS_SCAN_ITERSIZE, but settings are not configured.
+  disabledTests = [
+    # ModuleNotFoundError: No module named 'test_cache_options'
+    "test_custom_key_function"
+    # ModuleNotFoundError: No module named 'test_client'
+    "test_delete_pattern_calls_get_client_given_no_client"
+    "test_delete_pattern_calls_make_pattern"
+    "test_delete_pattern_calls_scan_iter_with_count_if_itersize_given"
+    "test_delete_pattern_calls_scan_iter_with_count_if_itersize_given"
+    "test_delete_pattern_calls_scan_iter"
+    "test_delete_pattern_calls_delete_for_given_keys"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/ocrmypdf/default.nix

···
 , importlib-metadata
 , importlib-resources
 , jbig2enc
-, leptonica
 , pdfminer
 , pikepdf
 , pillow
···
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "12.7.2";
+  version = "13.0.0";
 
   src = fetchFromGitHub {
     owner = "jbarlow83";
···
     extraPostFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    sha256 = "sha256-+mh7NgAk7R/94FXjRV+SLy478pZwYLLS8HwCazEbMf4=";
+    sha256 = "sha256-W5RFCWKDIRrsgHZL8uSOQWvEltLbqYAweZkgIZZrSIo=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
···
       src = ./paths.patch;
       gs = "${lib.getBin ghostscript}/bin/gs";
       jbig2 = "${lib.getBin jbig2enc}/bin/jbig2";
-      liblept = "${lib.getLib leptonica}/lib/liblept${stdenv.hostPlatform.extensions.sharedLibrary}";
       pngquant = "${lib.getBin pngquant}/bin/pngquant";
       tesseract = "${lib.getBin tesseract4}/bin/tesseract";
       unpaper = "${lib.getBin unpaper}/bin/unpaper";

pkgs/development/python-modules/ocrmypdf/paths.patch

···
 diff --git a/src/ocrmypdf/_exec/ghostscript.py b/src/ocrmypdf/_exec/ghostscript.py
-index 5c357f1b..f459763a 100644
+index 1146cc5f..43f3915c 100644
 --- a/src/ocrmypdf/_exec/ghostscript.py
 +++ b/src/ocrmypdf/_exec/ghostscript.py
-@@ -25,28 +25,7 @@ from ocrmypdf.subprocess import get_version, run, run_polling_stderr
- 
- log = logging.getLogger(__name__)
+@@ -40,15 +40,7 @@ For details see:
+ # Most reliable what to get the bitness of Python interpreter, according to Python docs
+ _is_64bit = sys.maxsize > 2 ** 32
  
--missing_gs_error = """
-----------------------------------------------------------------------
--This error normally occurs when ocrmypdf find can't Ghostscript.
--Please ensure Ghostscript is installed and its location is added to
--the system PATH environment variable.
--
--For details see:
--    https://ocrmypdf.readthedocs.io/en/latest/installation.html
-----------------------------------------------------------------------
--"""
--
 -_gswin = None
 -if os.name == 'nt':
--    _gswin = which('gswin64c')
--    if not _gswin:
--        _gswin = which('gswin32c')
--        if not _gswin:
--            raise MissingDependencyError(missing_gs_error)
--    _gswin = Path(_gswin).stem
+-    if _is_64bit:
+-        _gswin = 'gswin64c'
+-    else:
+-        _gswin = 'gswin32c'
 -
 -GS = _gswin if _gswin else 'gs'
 -del _gswin
···
              '--skip-if-larger',
              '--quality',
 diff --git a/src/ocrmypdf/_exec/tesseract.py b/src/ocrmypdf/_exec/tesseract.py
-index 33ead41e..5840f7c1 100644
+index a3688f65..61f54465 100644
 --- a/src/ocrmypdf/_exec/tesseract.py
 +++ b/src/ocrmypdf/_exec/tesseract.py
-@@ -78,7 +78,7 @@ class TesseractVersion(StrictVersion):
+@@ -75,7 +75,7 @@ class TesseractVersion(StrictVersion):
  
  
- def version():
+ def version() -> str:
 -    return get_version('tesseract', regex=r'tesseract\s(.+)')
 +    return get_version('@tesseract@', regex=r'tesseract\s(.+)')
  
  
  def has_user_words():
-@@ -100,7 +100,7 @@ def get_languages():
+@@ -97,7 +97,7 @@ def get_languages():
          msg += output
          return msg
  
···
      try:
          proc = run(
              args_tess,
-@@ -122,7 +122,7 @@ def get_languages():
+@@ -119,7 +119,7 @@ def get_languages():
  
  
  def tess_base_args(langs: List[str], engine_mode: Optional[int]) -> List[str]:
···
          args.extend(['-l', '+'.join(langs)])
      if engine_mode is not None:
 diff --git a/src/ocrmypdf/_exec/unpaper.py b/src/ocrmypdf/_exec/unpaper.py
-index 3c3ae72c..d269966a 100644
+index aec365c2..cc5cb7e4 100644
 --- a/src/ocrmypdf/_exec/unpaper.py
 +++ b/src/ocrmypdf/_exec/unpaper.py
 @@ -31,7 +31,7 @@ log = logging.getLogger(__name__)
···
  
      with TemporaryDirectory() as tmpdir:
          input_pnm, output_pnm = _setup_unpaper_io(Path(tmpdir), input_file)
-diff --git a/src/ocrmypdf/leptonica.py b/src/ocrmypdf/leptonica.py
-index e4814f1a..fdaf7ea4 100644
---- a/src/ocrmypdf/leptonica.py
-+++ b/src/ocrmypdf/leptonica.py
-@@ -33,14 +33,7 @@ from ocrmypdf.lib._leptonica import ffi
- 
- logger = logging.getLogger(__name__)
- 
--if os.name == 'nt':
--    from ocrmypdf.subprocess._windows import shim_env_path
--
--    libname = 'liblept-5'
--    os.environ['PATH'] = shim_env_path()
--else:
--    libname = 'lept'
--_libpath = find_library(libname)
-+_libpath = '@liblept@'
- if not _libpath:
-     raise MissingDependencyError(
-         """

pkgs/development/python-modules/paste/default.nix

···
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, six
 }:
 
 buildPythonPackage rec {
···
     patchShebangs tests/cgiapp_data/
   '';
 
-  # propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [ six ];
 
   checkInputs = [ pytestCheckHook ];
 

pkgs/development/python-modules/pikepdf/default.nix

···
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "4.0.2";
+  version = "4.1.0";
   disabled = ! isPy3k;
 
   src = fetchFromGitHub {
···
     extraPostFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    sha256 = "sha256-bUf9fef/YQsSj78kwoKl5a3zOjpeKWla9YY0azk0lIQ=";
+    sha256 = "sha256-8l3IDC2EhoNTImaTTjkBYhwbSBDC3PVLbdgs4txZOKc=";
   };
 
   patches = [

pkgs/development/python-modules/poetry/default.nix

···
 
 buildPythonPackage rec {
   pname = "poetry";
-  version = "1.1.11";
+  version = "1.1.12";
   format = "pyproject";
   disabled = isPy27;
 
···
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    sha256 = "1f3y3gav2snvcf2h9mbkinvnlcyl9kndf6bh6j0vxkxzlmb4zilx";
+    sha256 = "1fm4yj6wxr24v7b77gmf63j7xsgszhbhzw2i9fvlfi0p9l0q34pm";
   };
 
   postPatch = ''

pkgs/development/python-modules/xdot/default.nix

···
   propagatedBuildInputs = [ gobject-introspection pygobject3 graphviz gtk3 numpy ];
   checkInputs = [ xvfb-run ];
 
+  postInstall = ''
+    wrapProgram "$out/bin/xdot" --prefix PATH : "${lib.makeBinPath [ graphviz ]}"
+  '';
+
   checkPhase = ''
     xvfb-run -s '-screen 0 800x600x24' ${python3.interpreter} nix_run_setup test
   '';

pkgs/development/python-modules/ytmusicapi/default.nix

···
 
 buildPythonPackage rec {
   pname = "ytmusicapi";
-  version = "0.19.4";
+  version = "0.19.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-AAGUfa91f9aquPLQZs9kQDbZXrBrxjSBFdWIrxB5D/I=";
+    sha256 = "sha256-haZe5afwkU8wD8s2lrmHJuVo6TO3CcQ/0TuJbHPmqvU=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/fnm/default.nix

···
-{ lib, stdenv, fetchFromGitHub, rustPlatform, installShellFiles, Security }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, installShellFiles
+, DiskArbitration
+, Foundation
+, Security
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "fnm";
-  version = "1.27.0";
+  version = "1.28.1";
 
   src = fetchFromGitHub {
     owner = "Schniz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4qnisgWhdAWZda8iy9nkph7//bVKJuUeEDS1GaAx+FQ=";
+    sha256 = "sha256-EH3M5wg+BfTZLvch4jL7AGWwywoSxo+8marzdUgAitg=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.isDarwin [ DiskArbitration Foundation Security ];
 
-  cargoSha256 = "sha256-f3wzuXH2ByXHHOq3zLaMtYm2HJ4BzmZe2e6DQ3V7qVo=";
+  cargoSha256 = "sha256-Mq1SzAZa05tglcwW6fvT1khVwqA3hRzFjouWLNMWgOk=";
 
   doCheck = false;
 

pkgs/development/tools/turbogit/default.nix

···
 { fetchFromGitHub, buildGoModule, lib, installShellFiles, libgit2, pkg-config }:
 buildGoModule rec {
   pname = "turbogit";
-  version = "3.0.1";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "b4nst";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-A1hVpapp6yIpUVnDQ1yLLHiYdLcQlr/JcTOmt5sr3Oo=";
+    sha256 = "sha256-BHgVJlitRUX/9zYPoK5XfRpzzTZRbLhQVZJcx8KVshk=";
   };
 
-  vendorSha256 = "sha256-1AEcBq7wiENWQ5HZEEXpIgA6Bf2T28zm/MwYTke/f9s=";
+  vendorSha256 = "sha256-280OcGXZQJD4G6z0b2WnWAS+v7XVptyf2WnlPjG99/0=";
 
   subPackages = [ "." ];
 

pkgs/development/web/insomnia/default.nix

···
   ];
 in stdenv.mkDerivation rec {
   pname = "insomnia";
-  version = "2021.4.1";
+  version = "2021.6.0";
 
   src = fetchurl {
     url =
       "https://github.com/Kong/insomnia/releases/download/core%40${version}/Insomnia.Core-${version}.deb";
-    sha256 = "sha256-74du6UQB1LfsnYF9tmx41KJNmlEVVL5H2W+YQR720FY=";
+    sha256 = "sha256-YvAzO5oxeq7bnYHzKTXqRVjfJXnwrTr0DNrdWS3yrX4=";
   };
 
   nativeBuildInputs =

pkgs/games/eternity-engine/default.nix

···
-{ lib, stdenv, cmake, libGL, SDL, SDL_mixer, SDL_net, fetchFromGitHub, makeWrapper }:
+{ lib, stdenv, cmake, libGL, SDL2, SDL2_mixer, SDL2_net, fetchFromGitHub, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "eternity-engine";
-  version = "3.42.02";
+  version = "4.02.00";
   src = fetchFromGitHub {
     owner = "team-eternity";
     repo = "eternity";
     rev = version;
-    sha256 = "00kpq4k23hjmzjaymw3sdda7mqk8fjq6dzf7fmdal9fm7lfmj41k";
+    sha256 = "0dlz7axbiw003bgwk2hl43w8r2bwnxhi042i1xwdiwaja0cpnf5y";
+    fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake makeWrapper ];
-  buildInputs = [ libGL SDL SDL_mixer SDL_net ];
+  buildInputs = [ libGL SDL2 SDL2_mixer SDL2_net ];
 
   installPhase = ''
-    install -Dm755 source/eternity $out/lib/eternity/eternity
+    install -Dm755 eternity/eternity $out/lib/eternity/eternity
     cp -r $src/base $out/lib/eternity/base
     mkdir $out/bin
     makeWrapper $out/lib/eternity/eternity $out/bin/eternity
   '';
 
   meta = {
-    homepage = "http://doomworld.com/eternity";
+    homepage = "https://doomworld.com/eternity";
     description = "New school Doom port by James Haley";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.linux;

pkgs/games/heroic/default.nix

···
+{ lib, fetchurl, appimageTools, python }:
+
+let
+  pname = "heroic";
+  version = "1.10.3";
+  name = "${pname}-${version}";
+  src = fetchurl {
+    url = "https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher/releases/download/v${version}/Heroic-${version}.AppImage";
+    sha256 = "sha256-0VQ5rSGGsEAsOLB4H/Hn2w7wCOrCSoVFzCBqNV5NyVE=";
+  };
+  appimageContents = appimageTools.extractType2 { inherit name src; };
+
+in appimageTools.wrapType2 {
+  inherit name src;
+
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/${pname}
+
+    mkdir -p $out/share/${pname}
+    cp -a ${appimageContents}/locales $out/share/${pname}
+    cp -a ${appimageContents}/resources $out/share/${pname}
+
+    install -m 444 -D ${appimageContents}/heroic.desktop -t $out/share/applications
+
+    cp -a ${appimageContents}/usr/share/icons $out/share/
+
+    substituteInPlace $out/share/applications/heroic.desktop \
+      --replace 'Exec=AppRun' 'Exec=heroic'
+  '';
+
+  meta = with lib; {
+    description = "A Native GUI Epic Games Launcher for Linux, Windows and Mac";
+    homepage = "https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/games/warzone2100/default.nix

···
     freetype
     harfbuzz
     sqlite
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     vulkan-headers
     vulkan-loader
   ];
···
     #
     # Alternatively, we could have set CMAKE_INSTALL_BINDIR to "bin".
     "-DCMAKE_INSTALL_DATAROOTDIR=${placeholder "out"}/share"
-  ];
+  ] ++ lib.optional stdenv.isDarwin "-P../configure_mac.cmake";
 
   postInstall = lib.optionalString withVideos ''
     cp ${sequences_src} $out/share/warzone2100/sequences.wz
···
     homepage = "http://wz2100.net";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ astsmtl fgaz ];
-    platforms = platforms.linux;
+    platforms = platforms.all;
+    # configure_mac.cmake tries to download stuff
+    # https://github.com/Warzone2100/warzone2100/blob/master/macosx/README.md
+    broken = stdenv.isDarwin;
   };
 }

pkgs/servers/http/dave/default.nix

···
+{ lib, buildGoPackage, fetchFromGitHub, mage }:
+
+buildGoPackage rec {
+  pname = "dave";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "micromata";
+    repo = "dave";
+    rev = "v${version}";
+    sha256 = "sha256-wvsW4EwMWAgEV+LPeMhHL4AsuyS5TDMmpD9D4F1nVM4=";
+  };
+
+  goPackagePath = "github.com/micromata/dave";
+
+  subPackages = [ "cmd/dave" "cmd/davecli" ];
+
+  ldflags =
+    [ "-s" "-w" "-X main.version=${version}" "-X main.builtBy=nixpkgs" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/micromata/dave";
+    description =
+      "A totally simple and very easy to configure stand alone webdav server";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lunik1 ];
+  };
+}

pkgs/servers/monitoring/prometheus/smartctl-exporter/0001-Return-the-cached-value-if-it-s-not-time-to-scan-aga.patch

···
+From e81b06df67b1d42ef915615fafa0b56ef956673b Mon Sep 17 00:00:00 2001
+From: Andreas Fuchs <[e-mail]>
+Date: Thu, 11 Feb 2021 17:30:44 -0500
+Subject: [PATCH] Return the cached value if it's not time to scan again yet
+
+This should ensure that if we have a valid value cached (which ought
+to be every time after the first scan), we return it as metrics.
+
+This fixes the crashes that would happen if queries happened earlier
+than the re-scan interval allowed.
+
+Address review feedback: Shorten the time-to-scan logic
+
+We can express this in a single if statement, so it takes fewer lines
+to do the "should we check again" check.
+---
+ readjson.go | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/readjson.go b/readjson.go
+index da35448..c9996fd 100644
+--- a/readjson.go
++++ b/readjson.go
+@@ -78,14 +78,7 @@ func readData(device string) (gjson.Result, error) {
+ 
+ 	if _, err := os.Stat(device); err == nil {
+ 		cacheValue, cacheOk := jsonCache[device]
+-		timeToScan := false
+-		if cacheOk {
+-			timeToScan = time.Now().After(cacheValue.LastCollect.Add(options.SMARTctl.CollectPeriodDuration))
+-		} else {
+-			timeToScan = true
+-		}
+-
+-		if timeToScan {
++		if !cacheOk || time.Now().After(cacheValue.LastCollect.Add(options.SMARTctl.CollectPeriodDuration)) {
+ 			json, ok := readSMARTctl(device)
+ 			if ok {
+ 				jsonCache[device] = JSONCache{JSON: json, LastCollect: time.Now()}
+@@ -93,7 +86,7 @@ func readData(device string) (gjson.Result, error) {
+ 			}
+ 			return gjson.Parse(DEFAULT_EMPTY_JSON), fmt.Errorf("smartctl returned bad data for device %s", device)
+ 		}
+-		return gjson.Parse(DEFAULT_EMPTY_JSON), fmt.Errorf("Too early collect called for device %s", device)
++		return cacheValue.JSON, nil
+ 	}
+ 	return gjson.Parse(DEFAULT_EMPTY_JSON), fmt.Errorf("Device %s unavialable", device)
+ }
+-- 
+2.33.1
+

pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix

···
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, buildGoModule
+}:
+
+buildGoModule rec {
+  pname = "smartctl_exporter";
+  version = "unstable-2020-11-14";
+
+  src = fetchFromGitHub {
+    owner = "prometheus-community";
+    repo = pname;
+    rev = "e27581d56ad80340fb076d3ce22cef337ed76679";
+    sha256 = "sha256-iWaFDjVLBIAA9zGe0utbuvmEdA3R5lge0iCh3j2JfE8=";
+  };
+
+  patches = [
+    # Fixes out of range panic (https://github.com/prometheus-community/smartctl_exporter/issues/19)
+    (fetchpatch {
+      url = "https://github.com/prometheus-community/smartctl_exporter/commit/15575301a8e2fe5802a8c066c6fa9765d50b8cfa.patch";
+      sha256 = "sha256-HLUrGXNz3uKpuQBUgQBSw6EGbGl23hQnimTGl64M5bQ=";
+    })
+    # Fix validation on empty smartctl response (https://github.com/prometheus-community/smartctl_exporter/pull/31)
+    (fetchpatch {
+      url = "https://github.com/prometheus-community/smartctl_exporter/commit/744b4e5f6a46e029d31d5aa46642e85f429c2cfa.patch";
+      sha256 = "sha256-MgLtYR1SpM6XrZQQ3AgQRmNF3OnaBCqXMJRV9BOzKPc=";
+    })
+    # Fixes missing metrics if outside of query interval (https://github.com/prometheus-community/smartctl_exporter/pull/18)
+    ./0001-Return-the-cached-value-if-it-s-not-time-to-scan-aga.patch
+  ];
+
+  vendorSha256 = "1xhrzkfm2p20k7prgdfax4408g4qpa4wbxigmcmfz7kjg2zi88ld";
+
+  meta = with lib; {
+    description = "Export smartctl statistics for Prometheus";
+    homepage = "https://github.com/prometheus-community/smartctl_exporter";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ hexa ];
+  };
+}

pkgs/servers/neard/default.nix

···
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, systemd, glib, dbus, libnl, python3Packages }:
+{ stdenv
+, lib
+, fetchurl
+, autoreconfHook
+, autoconf-archive
+, pkg-config
+, systemd
+, glib
+, dbus
+, libnl
+, python2Packages
+}:
 
 stdenv.mkDerivation rec {
   pname = "neard";
-  version = "0.16";
+  version = "0.18";
+
+  outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/network/nfc/neard.git/snapshot/neard-${version}.tar.gz";
-    sha256 = "0bpdmyxvd3z54p95apz4bjb5jp8hbc04sicjapcryjwa8mh6pbil";
+    sha256 = "wBPjEVMV4uEdFrXw8cjOmvvNuiaACq2RJF/ZtKXck4s=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config python3Packages.wrapPython ];
-  buildInputs = [ systemd glib dbus libnl ] ++ (with python3Packages; [ python ]);
-  pythonPath = with python3Packages; [ pygobject3 dbus-python ];
+  nativeBuildInputs = [
+    autoreconfHook
+    autoconf-archive
+    pkg-config
+    python2Packages.wrapPython
+  ];
+
+  buildInputs = [
+    systemd
+    glib
+    dbus
+    libnl
+  ] ++ (with python2Packages; [
+    python
+  ]);
+
+  pythonPath = with python2Packages; [
+    pygobject2
+    dbus-python
+    pygtk
+  ];
 
   strictDeps = true;
 
-  configureFlags = [ "--disable-debug" "--enable-tools" "--enable-ese" "--with-systemdsystemunitdir=$out/lib/systemd/system" ];
+  enableParallelBuilding = true;
+
+  configureFlags = [
+    "--disable-debug"
+    "--enable-tools"
+    "--enable-ese"
+    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+  ];
 
   postInstall = ''
     install -m 0755 tools/snep-send $out/bin/
 
-    install -D -m644 src/neard.service $out/lib/systemd/system/neard.service
     install -D -m644 src/main.conf $out/etc/neard/main.conf
 
     # INFO: the config option "--enable-test" would copy the apps to $out/lib/neard/test/ instead
···
 
   meta = with lib; {
     description = "Near Field Communication manager";
-    homepage    = "https://01.org/linux-nfc";
-    license     = licenses.gpl2;
-    maintainers = with maintainers; [ tstrobel ];
-    platforms   = platforms.unix;
+    homepage = "https://01.org/linux-nfc";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ jtojnar tstrobel ];
+    platforms = platforms.unix;
   };
 }

pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix

···
-{ lib, stdenv, fetchFromGitHub, postgresql, openssl, zlib, readline, libkrb5 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, postgresql, openssl, zlib, readline, libkrb5 }:
 
 stdenv.mkDerivation rec {
   pname = "pg_auto_failover";
···
     rev = "v${version}";
     sha256 = "sha256-hGpcHV4ai9mxaJ/u/o9LNFWPGsW22W7ak2pbvAUgmwU=";
   };
+
+  patches = [
+    # Pull upstream fix for ncurses-6.3 support:
+    #  https://github.com/citusdata/pg_auto_failover/pull/830
+    (fetchpatch {
+      name = "ncurses-6.3.patch";
+      url = "https://github.com/citusdata/pg_auto_failover/commit/fc92546965437a6d5f82ed9a6bdc8204a3bca725.patch";
+      sha256 = "sha256-t4DC/d/2s/Mc44rpFxBMOWGhACG0s5wAWyeDD7Mefo8=";
+    })
+  ];
 
   buildInputs = [ postgresql openssl zlib readline libkrb5 ];
 

pkgs/shells/fish/plugins/fzf-fish.nix

···
 
 buildFishPlugin rec {
   pname = "fzf.fish";
-  version = "7.3";
+  version = "7.4";
 
   src = fetchFromGitHub {
     owner = "PatrickF1";
     repo = "fzf.fish";
     rev = "v${version}";
-    sha256 = "16mdfyznxjhv7x561srl559misn37a35d2q9fspxa7qg1d0sc3x9";
+    sha256 = "sha256-dngAKzyD+lmqmxsCSOMViyCgA/+Ve35gLtPS+Lgs8Pc=";
   };
 
   checkInputs = [ fzf fd util-linux ];

pkgs/tools/misc/clickclack/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "clickclack";
-  version = "0.1.1";
+  version = "0.2";
 
   src = fetchFromSourcehut {
     owner = "~proycon";
     repo = "clickclack";
     rev = version;
-    sha256 = "1q8r0ng1bld5n82gh7my7ck90f4plf8vf019hm2wz475dl38izd5";
+    sha256 = "sha256-hldtHSRdw6yP9lUFna5yvJ3mOTbQbbQNnGM7fMQmmtM=";
   };
 
   buildInputs = [

pkgs/tools/misc/gitlint/default.nix

···
 , python3
 }:
 
-let
-  py = python3.override {
-    packageOverrides = self: super: {
-
-      click = super.click.overridePythonAttrs (oldAttrs: rec {
-        version = "8.0.1";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "0ymdyf37acq4qxh038q0xx44qgj6y2kf0jd0ivvix6qij88w214c";
-        };
-      });
-
-      arrow = super.arrow.overridePythonAttrs (oldAttrs: rec {
-        version = "1.2.0";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "0x70a057dqki2z1ny491ixbg980hg4lihc7g1zmy69g4v6xjkz0n";
-        };
-      });
-
-    };
-  };
-in
-with py.pkgs;
-
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "gitlint";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "jorisroovers";
     repo = "gitlint";
     rev = "v${version}";
-    sha256 = "1j6gfgqin5dmqd2qq0vib55d2r07s9sy4hwrvwlichxx5jjwncly";
+    sha256 = "sha256-RXBMb43BBiJ23X0eKC1kqgLw8iFKJnP5iejY0AWcUrU=";
   };
 
-  nativeBuildInputs = [
-    wheel
-  ];
+  # Upstream splitted the project into gitlint and gitlint-core to
+  # simplify the dependency handling
+  sourceRoot = "source/gitlint-core";
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3.pkgs; [
     arrow
     click
     sh
   ];
 
-  preCheck = ''
-    export PATH="$out/bin:$PATH"
+  checkInputs = with python3.pkgs; [
+    gitMinimal
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    # We don't need gitlint-core
+    substituteInPlace setup.py \
+      --replace "'gitlint-core[trusted-deps]==' + version," ""
   '';
 
-  checkInputs = [
-    gitMinimal
+  pythonImportsCheck = [
+    "gitlint"
   ];
 
   meta = with lib; {

pkgs/tools/misc/steampipe/default.nix

···
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-asAqRCJdy8HmzWzuE9nSvxqo6EVY8tkljzEFAClogrs=";
+    sha256 = "sha256-Hg9GvHB2eTcOUUC/WLpks9TUWivoV6KxXcWWBWne5Lg=";
   };
 
-  vendorSha256 = "sha256-3JBCiF1gxGCVn81s7abGvNIAy+eP7orAnSBOXUNImao=";
+  vendorSha256 = "sha256-akMUJcAoUGHz3FzDJlMUYtHXrtvU0JMiRfqhTm4IEpA=";
 
   # tests are failing for no obvious reasons
   doCheck = false;

pkgs/tools/misc/trillian/default.nix

···
 
 buildGoModule rec {
   pname = "trillian";
-  version = "1.3.13";
-  vendorSha256 = "1ad0vaw0k57njzk9x233iqjbplyvw66qjk8r9j7sx87pdc6a4lpb";
+  version = "1.4.0";
+  vendorSha256 = "sha256-n5PD3CGgNGrqSYLJS+3joGFNue2fF/tdimC6CtO15yU=";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ns394yd4js9g1psd1dkrffidyzixqvjp5lhw2x2iycrxbnm3y44";
+    sha256 = "sha256-c7Sii6GMWZOeD46OwdkXU/wt9zY+EyPSnahYPJQKJcA=";
   };
 
   subPackages = [

pkgs/tools/networking/ytcc/default.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "ytcc";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "woefe";
     repo = "ytcc";
     rev = "v${version}";
-    sha256 = "1skhg8ca2bjjfi02pjsi3w7v3f4xhzg7bqyy0cajxsymzqzqp7lm";
+    sha256 = "sha256-nYHfmksZnIZGMSSFDhW7ajvv1F5h3aJo8IXw6yYOEw0=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py --replace "youtube_dl" "yt_dlp"
-  '';
-
   nativeBuildInputs = [ gettext installShellFiles ];
 
   propagatedBuildInputs = with python3Packages; [
-    click
-    feedparser
-    lxml
-    sqlalchemy
     yt-dlp
+    click
     wcwidth
   ];
 

pkgs/tools/package-management/apk-tools/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "apk-tools";
-  version = "2.12.7";
+  version = "2.12.8";
 
   src = fetchFromGitLab {
     domain = "gitlab.alpinelinux.org";
     owner = "alpine";
     repo = "apk-tools";
     rev = "v${version}";
-    sha256 = "sha256-sGAsC5HZV5jaaUXgaPDUf4+vDL4zSGldzhykpdZlFS4=";
+    sha256 = "1bqrvdyqqllzsyx9gdkqmd17wxcmli6ljwxxa8wj9gzg9pqhlhqz";
   };
 
   nativeBuildInputs = [ pkg-config scdoc ]

pkgs/tools/security/beyond-identity/default.nix

···
+{ lib, stdenv, fetchurl, dpkg, buildFHSUserEnv
+, glibc, glib, openssl, tpm2-tss
+, gtk3, gnome, polkit, polkit_gnome
+}:
+
+let
+  pname = "beyond-identity";
+  version = "2.45.0-0";
+  libPath = lib.makeLibraryPath ([ glib glibc openssl tpm2-tss gtk3 gnome.gnome-keyring polkit polkit_gnome ]);
+  meta = with lib; {
+    description = "Passwordless MFA identities for workforces, customers, and developers";
+    homepage = "https://www.beyondidentity.com";
+    downloadPage = "https://app.byndid.com/downloads";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ klden ];
+    platforms = [ "x86_64-linux" ];
+  };
+
+  beyond-identity = stdenv.mkDerivation {
+    inherit pname version meta;
+
+    src = fetchurl {
+      url = "https://packages.beyondidentity.com/public/linux-authenticator/deb/ubuntu/pool/focal/main/b/be/${pname}_${version}/${pname}_${version}_amd64.deb";
+      sha512 = "852689d473b7538cdca60d264295f39972491b5505accad897fd924504189f0a6d8b6481cc0520ee762d4642e0f4fd664a03b5741f9ea513ec46ab16b05158f2";
+    };
+
+    nativeBuildInputs = [
+      dpkg
+    ];
+
+    unpackPhase = ''
+      dpkg -x $src .
+    '';
+
+    installPhase = ''
+      mkdir -p $out/opt/beyond-identity
+
+      rm -rf usr/share/doc
+
+      # https://github.com/NixOS/nixpkgs/issues/42117
+      sed -i -e 's/auth_self/yes/g' usr/share/polkit-1/actions/com.beyondidentity.endpoint.stepup.policy
+
+      cp -ar usr/{bin,share} $out
+      cp -ar opt/beyond-identity/bin $out/opt/beyond-identity
+
+      ln -s $out/opt/beyond-identity/bin/* $out/bin/
+    '';
+
+    postFixup = ''
+      substituteInPlace \
+        $out/share/applications/com.beyondidentity.endpoint.BeyondIdentity.desktop \
+        --replace /usr/bin/ $out/bin/
+      substituteInPlace \
+        $out/share/applications/com.beyondidentity.endpoint.webserver.BeyondIdentity.desktop \
+        --replace /opt/ $out/opt/
+      substituteInPlace \
+        $out/opt/beyond-identity/bin/byndid-web \
+        --replace /opt/ $out/opt/
+      substituteInPlace \
+        $out/bin/beyond-identity \
+        --replace /opt/ $out/opt/ \
+        --replace /usr/bin/gtk-launch ${gtk3}/bin/gtk-launch
+
+      patchelf \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "${libPath}" \
+        --force-rpath \
+        $out/bin/byndid
+    '';
+  };
+# /usr/bin/pkcheck is hardcoded in binary - we need FHS
+in buildFHSUserEnv {
+   inherit meta;
+   name = pname;
+
+   targetPkgs = pkgs: [
+     beyond-identity
+     glib glibc openssl tpm2-tss
+     gtk3 gnome.gnome-keyring
+     polkit polkit_gnome
+   ];
+
+   extraInstallCommands = ''
+     ln -s ${beyond-identity}/share $out
+   '';
+
+   runScript = "beyond-identity";
+}
+

pkgs/tools/security/kubeaudit/default.nix

···
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "kubeaudit";
+  version = "0.16.0";
+
+  src = fetchFromGitHub {
+    owner = "Shopify";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-AIvH9HF0Ha1b+NZiJmiT6beYuKnCqJMXKzDFUzV9J4c=";
+  };
+
+  vendorSha256 = "sha256-XrEzkhQU/KPElQNgCX6yWDMQXZSd3lRXmUDJpsj5ACY=";
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/$pname
+  '';
+
+  # Tests require a running Kubernetes instance
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Audit tool for Kubernetes";
+    homepage = "https://github.com/Shopify/kubeaudit";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/tools/virtualization/alpine-make-vm-image/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "alpine-make-vm-image";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "alpinelinux";
     repo = "alpine-make-vm-image";
     rev = "v${version}";
-    sha256 = "0cjcwq957nsml06kdnnvgzki84agjfvqw3mpyiix4i4q5by91lcl";
+    sha256 = "14rkqlg319h8agiydgknjfv2f7vl6rdj848xfkngvydrf1rr38j6";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/tools/wayland/wl-clipboard-x11/default.nix

···
+{ lib, stdenv, fetchFromGitHub, wl-clipboard }:
+
+stdenv.mkDerivation rec {
+  pname = "wl-clipboard-x11";
+  version = "5";
+
+  src = fetchFromGitHub {
+    owner = "brunelli";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-i+oF1Mu72O5WPTWzqsvo4l2CERWWp4Jq/U0DffPZ8vg=";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  postPatch = ''
+    substituteInPlace src/wl-clipboard-x11 \
+      --replace '$(command -v wl-copy)' ${wl-clipboard}/bin/wl-copy \
+      --replace '$(command -v wl-paste)' ${wl-clipboard}/bin/wl-paste
+  '';
+
+  meta = with lib; {
+    description = "A wrapper to use wl-clipboard as a drop-in replacement for X11 clipboard tools";
+    homepage = "https://github.com/brunelli/wl-clipboard-x11";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ samuelgrf ];
+    mainProgram = "xclip";
+  };
+}

pkgs/top-level/all-packages.nix

···
 
   bakelite = callPackage ../tools/backup/bakelite { };
 
+  beyond-identity = callPackage ../tools/security/beyond-identity {};
+
   breakpad = callPackage ../development/misc/breakpad { };
 
   buf = callPackage ../development/tools/buf { };
···
 
   foxdot = with python3Packages; toPythonApplication foxdot;
 
+  fspy = callPackage ../applications/misc/fspy { };
+
   fxlinuxprintutil = callPackage ../tools/misc/fxlinuxprintutil { };
 
   genann = callPackage ../development/libraries/genann { };
···
   lsix = callPackage ../tools/graphics/lsix { };
 
   mdr = callPackage ../tools/misc/mdr { };
+
+  mobilecoin-wallet = callPackage ../applications/misc/mobilecoin-wallet { };
 
   mpdevil = callPackage ../applications/audio/mpdevil { };
 
···
 
   wl-clipboard = callPackage ../tools/wayland/wl-clipboard { };
 
+  wl-clipboard-x11 = callPackage ../tools/wayland/wl-clipboard-x11 { };
+
   wl-mirror = callPackage ../tools/wayland/wl-mirror { };
 
   wlogout = callPackage ../tools/wayland/wlogout { };
···
   dateutils = callPackage ../tools/misc/dateutils { };
 
   datovka = libsForQt5.callPackage ../applications/networking/datovka { };
+
+  dave = callPackage ../servers/http/dave { };
 
   dconf = callPackage ../development/libraries/dconf { };
 
···
   heatseeker = callPackage ../tools/misc/heatseeker { };
 
   hebcal = callPackage ../tools/misc/hebcal {};
+
+  heroic = callPackage ../games/heroic {};
 
   hexio = callPackage ../development/tools/hexio { };
 
···
   flutter = flutterPackages.stable;
 
   fnm = callPackage ../development/tools/fnm {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation Security;
   };
 
   fnlfmt = callPackage ../development/tools/fnlfmt { };
···
 
   kube-aws = callPackage ../development/tools/kube-aws { };
 
+  kubeaudit = callPackage ../tools/security/kubeaudit { };
+
   kubectx = callPackage ../development/tools/kubectx { };
 
   kube-prompt = callPackage ../development/tools/kube-prompt { };
···
 
   ttyd = callPackage ../servers/ttyd { };
 
-  turbogit = callPackage ../development/tools/turbogit {
-    libgit2 = libgit2_1_1; # git2go only supports v1.1.x
-  };
+  turbogit = callPackage ../development/tools/turbogit { };
 
   tweak = callPackage ../applications/editors/tweak { };
 
···
   prometheus-rabbitmq-exporter = callPackage ../servers/monitoring/prometheus/rabbitmq-exporter.nix { };
   prometheus-rtl_433-exporter = callPackage ../servers/monitoring/prometheus/rtl_433-exporter.nix { };
   prometheus-script-exporter = callPackage ../servers/monitoring/prometheus/script-exporter.nix { };
+  prometheus-smartctl-exporter = callPackage ../servers/monitoring/prometheus/smartctl-exporter { };
   prometheus-smokeping-prober = callPackage ../servers/monitoring/prometheus/smokeping-prober.nix { };
   prometheus-snmp-exporter = callPackage ../servers/monitoring/prometheus/snmp-exporter.nix { };
   prometheus-statsd-exporter = callPackage ../servers/monitoring/prometheus/statsd-exporter.nix { };
···
 
   material-icons = callPackage ../data/fonts/material-icons { };
 
+  material-kwin-decoration = libsForQt5.callPackage ../data/themes/material-kwin-decoration { };
+
   meslo-lg = callPackage ../data/fonts/meslo-lg {};
 
   meslo-lgs-nf = callPackage ../data/fonts/meslo-lgs-nf {};
···
   helix = callPackage ../applications/editors/helix { };
 
   icesl = callPackage ../applications/misc/icesl { };
+
+  kalendar = libsForQt5.callPackage ../applications/office/kalendar { };
 
   keepassx = callPackage ../applications/misc/keepassx { };
   keepassx2 = callPackage ../applications/misc/keepassx/2.0.nix { };

pkgs/top-level/python-packages.nix

···
 
   xdis = callPackage ../development/python-modules/xdis { };
 
-  xdot = callPackage ../development/python-modules/xdot { };
+  xdot = callPackage ../development/python-modules/xdot {
+    inherit (pkgs) graphviz;
+  };
 
   xenomapper = callPackage ../applications/science/biology/xenomapper { };