Merge master into haskell-updates

lib/licenses.nix

···
     free = false;
   };
 
+  capec = {
+    fullName = "Common Attack Pattern Enumeration and Classification";
+    url = "https://capec.mitre.org/about/termsofuse.html";
+  };
+
   clArtistic = {
     spdxId = "ClArtistic";
     fullName = "Clarified Artistic License";

maintainers/maintainer-list.nix

···
     githubId = 4477729;
     name = "Sergey Mironov";
   };
+  smitop = {
+    name = "Smitty van Bodegom";
+    email = "[e-mail]";
+    matrix = "@smitop:kde.org";
+    github = "Smittyvb";
+    githubId = 10530973;
+  };
   sna = {
     email = "[e-mail]";
     github = "s-na";

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

···
           release notes</link> for changes and upgrade instructions.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>systemd.network</literal> module has gained
+          support for the FooOverUDP link type.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>networking</literal> module has a new
+          <literal>networking.fooOverUDP</literal> option to configure
+          Foo-over-UDP encapsulations.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>networking.sits</literal> now supports Foo-over-UDP
+          encapsulation.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>

nixos/doc/manual/release-notes/rl-2111.section.md

···
 - Three new options, [xdg.mime.addedAssociations](#opt-xdg.mime.addedAssociations), [xdg.mime.defaultApplications](#opt-xdg.mime.defaultApplications), and [xdg.mime.removedAssociations](#opt-xdg.mime.removedAssociations) have been added to the [xdg.mime](#opt-xdg.mime.enable) module to allow the configuration of `/etc/xdg/mimeapps.list`.
 
 - Kopia was upgraded from 0.8.x to 0.9.x. Please read the [upstream release notes](https://github.com/kopia/kopia/releases/tag/v0.9.0) for changes and upgrade instructions.
+
+- The `systemd.network` module has gained support for the FooOverUDP link type.
+
+- The `networking` module has a new `networking.fooOverUDP` option to configure Foo-over-UDP encapsulations.
+
+- `networking.sits` now supports Foo-over-UDP encapsulation.

nixos/modules/programs/evince.nix

···
 
 with lib;
 
-{
+let cfg = config.programs.evince;
+
+in {
 
   # Added 2019-08-09
   imports = [
···
       enable = mkEnableOption
         "Evince, the GNOME document viewer";
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.evince;
+        defaultText = literalExpression "pkgs.evince";
+        description = "Evince derivation to use.";
+      };
+
     };
 
   };
···
 
   config = mkIf config.programs.evince.enable {
 
-    environment.systemPackages = [ pkgs.evince ];
+    environment.systemPackages = [ cfg.package ];
 
-    services.dbus.packages = [ pkgs.evince ];
+    services.dbus.packages = [ cfg.package ];
 
-    systemd.packages = [ pkgs.evince ];
+    systemd.packages = [ cfg.package ];
 
   };
 

nixos/modules/services/x11/desktop-managers/pantheon.nix

···
       ] config.environment.pantheon.excludePackages);
 
       programs.evince.enable = mkDefault true;
+      programs.evince.package = pkgs.pantheon.evince;
       programs.file-roller.enable = mkDefault true;
 
       # Settings from elementary-default-settings

nixos/modules/system/boot/networkd.nix

···
         (assertRange "ERSPANIndex" 1 1048575)
       ];
 
+      sectionFooOverUDP = checkUnitConfig "FooOverUDP" [
+        (assertOnlyFields [
+          "Port"
+          "Encapsulation"
+          "Protocol"
+        ])
+        (assertPort "Port")
+        (assertValueOneOf "Encapsulation" ["FooOverUDP" "GenericUDPEncapsulation"])
+      ];
+
       sectionPeer = checkUnitConfig "Peer" [
         (assertOnlyFields [
           "Name"
···
       '';
     };
 
+    fooOverUDPConfig = mkOption {
+      default = { };
+      example = { Port = 9001; };
+      type = types.addCheck (types.attrsOf unitOption) check.netdev.sectionFooOverUDP;
+      description = ''
+        Each attribute in this set specifies an option in the
+        <literal>[FooOverUDP]</literal> section of the unit.  See
+        <citerefentry><refentrytitle>systemd.netdev</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+      '';
+    };
+
     peerConfig = mkOption {
       default = {};
       example = { Name = "veth2"; };
···
         + optionalString (def.tunnelConfig != { }) ''
           [Tunnel]
           ${attrsToSection def.tunnelConfig}
+        ''
+        + optionalString (def.fooOverUDPConfig != { }) ''
+          [FooOverUDP]
+          ${attrsToSection def.fooOverUDPConfig}
         ''
         + optionalString (def.peerConfig != { }) ''
           [Peer]

nixos/modules/tasks/network-interfaces-scripted.nix

···
             '';
           });
 
+        createFouEncapsulation = n: v: nameValuePair "${n}-fou-encap"
+          (let
+            # if we have a device to bind to we can wait for its addresses to be
+            # configured, otherwise external sequencing is required.
+            deps = optionals (v.local != null && v.local.dev != null)
+              (deviceDependency v.local.dev ++ [ "network-addresses-${v.local.dev}.service" ]);
+            fouSpec = "port ${toString v.port} ${
+              if v.protocol != null then "ipproto ${toString v.protocol}" else "gue"
+            } ${
+              optionalString (v.local != null) "local ${escapeShellArg v.local.address} ${
+                optionalString (v.local.dev != null) "dev ${escapeShellArg v.local.dev}"
+              }"
+            }";
+          in
+          { description = "FOU endpoint ${n}";
+            wantedBy = [ "network-setup.service" (subsystemDevice n) ];
+            bindsTo = deps;
+            partOf = [ "network-setup.service" ];
+            after = [ "network-pre.target" ] ++ deps;
+            before = [ "network-setup.service" ];
+            serviceConfig.Type = "oneshot";
+            serviceConfig.RemainAfterExit = true;
+            path = [ pkgs.iproute2 ];
+            script = ''
+              # always remove previous incarnation since show can't filter
+              ip fou del ${fouSpec} >/dev/null 2>&1 || true
+              ip fou add ${fouSpec}
+            '';
+            postStop = ''
+              ip fou del ${fouSpec} || true
+            '';
+          });
+
         createSitDevice = n: v: nameValuePair "${n}-netdev"
           (let
             deps = deviceDependency v.dev;
···
                 ${optionalString (v.remote != null) "remote \"${v.remote}\""} \
                 ${optionalString (v.local != null) "local \"${v.local}\""} \
                 ${optionalString (v.ttl != null) "ttl ${toString v.ttl}"} \
-                ${optionalString (v.dev != null) "dev \"${v.dev}\""}
+                ${optionalString (v.dev != null) "dev \"${v.dev}\""} \
+                ${optionalString (v.encapsulation != null)
+                  "encap ${v.encapsulation.type} encap-dport ${toString v.encapsulation.port} ${
+                    optionalString (v.encapsulation.sourcePort != null)
+                      "encap-sport ${toString v.encapsulation.sourcePort}"
+                  }"}
               ip link set "${n}" up
             '';
             postStop = ''
···
          // mapAttrs' createVswitchDevice cfg.vswitches
          // mapAttrs' createBondDevice cfg.bonds
          // mapAttrs' createMacvlanDevice cfg.macvlans
+         // mapAttrs' createFouEncapsulation cfg.fooOverUDP
          // mapAttrs' createSitDevice cfg.sits
          // mapAttrs' createVlanDevice cfg.vlans
          // {

nixos/modules/tasks/network-interfaces-systemd.nix

···
     } ] ++ flip mapAttrsToList cfg.bridges (n: { rstp, ... }: {
       assertion = !rstp;
       message = "networking.bridges.${n}.rstp is not supported by networkd.";
+    }) ++ flip mapAttrsToList cfg.fooOverUDP (n: { local, ... }: {
+      assertion = local == null;
+      message = "networking.fooOverUDP.${n}.local is not supported by networkd.";
     });
 
     networking.dhcpcd.enable = mkDefault false;
···
           macvlan = [ name ];
         } ]);
       })))
+      (mkMerge (flip mapAttrsToList cfg.fooOverUDP (name: fou: {
+        netdevs."40-${name}" = {
+          netdevConfig = {
+            Name = name;
+            Kind = "fou";
+          };
+          # unfortunately networkd cannot encode dependencies of netdevs on addresses/routes,
+          # so we cannot specify Local=, Peer=, PeerPort=. this looks like a missing feature
+          # in networkd.
+          fooOverUDPConfig = {
+            Port = fou.port;
+            Encapsulation = if fou.protocol != null then "FooOverUDP" else "GenericUDPEncapsulation";
+          } // (optionalAttrs (fou.protocol != null) {
+            Protocol = fou.protocol;
+          });
+        };
+      })))
       (mkMerge (flip mapAttrsToList cfg.sits (name: sit: {
         netdevs."40-${name}" = {
           netdevConfig = {
···
               Local = sit.local;
             }) // (optionalAttrs (sit.ttl != null) {
               TTL = sit.ttl;
-            });
+            }) // (optionalAttrs (sit.encapsulation != null) (
+              {
+                FooOverUDP = true;
+                Encapsulation =
+                  if sit.encapsulation.type == "fou"
+                  then "FooOverUDP"
+                  else "GenericUDPEncapsulation";
+                FOUDestinationPort = sit.encapsulation.port;
+              } // (optionalAttrs (sit.encapsulation.sourcePort != null) {
+                FOUSourcePort = sit.encapsulation.sourcePort;
+              })));
         };
         networks = mkIf (sit.dev != null) {
           "40-${sit.dev}" = (mkMerge [ (genericNetwork (mkOverride 999)) {

nixos/modules/tasks/network-interfaces.nix

···
   hasVirtuals = any (i: i.virtual) interfaces;
   hasSits = cfg.sits != { };
   hasBonds = cfg.bonds != { };
+  hasFous = cfg.fooOverUDP != { }
+    || filterAttrs (_: s: s.encapsulation != null) cfg.sits != { };
 
   slaves = concatMap (i: i.interfaces) (attrValues cfg.bonds)
     ++ concatMap (i: i.interfaces) (attrValues cfg.bridges)
···
       });
     };
 
+    networking.fooOverUDP = mkOption {
+      default = { };
+      example =
+        {
+          primary = { port = 9001; local = { address = "192.0.2.1"; dev = "eth0"; }; };
+          backup =  { port = 9002; };
+        };
+      description = ''
+        This option allows you to configure Foo Over UDP and Generic UDP Encapsulation
+        endpoints. See <citerefentry><refentrytitle>ip-fou</refentrytitle>
+        <manvolnum>8</manvolnum></citerefentry> for details.
+      '';
+      type = with types; attrsOf (submodule {
+        options = {
+          port = mkOption {
+            type = port;
+            description = ''
+              Local port of the encapsulation UDP socket.
+            '';
+          };
+
+          protocol = mkOption {
+            type = nullOr (ints.between 1 255);
+            default = null;
+            description = ''
+              Protocol number of the encapsulated packets. Specifying <literal>null</literal>
+              (the default) creates a GUE endpoint, specifying a protocol number will create
+              a FOU endpoint.
+            '';
+          };
+
+          local = mkOption {
+            type = nullOr (submodule {
+              options = {
+                address = mkOption {
+                  type = types.str;
+                  description = ''
+                    Local address to bind to. The address must be available when the FOU
+                    endpoint is created, using the scripted network setup this can be achieved
+                    either by setting <literal>dev</literal> or adding dependency information to
+                    <literal>systemd.services.&lt;name&gt;-fou-encap</literal>; it isn't supported
+                    when using networkd.
+                  '';
+                };
+
+                dev = mkOption {
+                  type = nullOr str;
+                  default = null;
+                  example = "eth0";
+                  description = ''
+                    Network device to bind to.
+                  '';
+                };
+              };
+            });
+            default = null;
+            example = { address = "203.0.113.22"; };
+            description = ''
+              Local address (and optionally device) to bind to using the given port.
+            '';
+          };
+        };
+      });
+    };
+
     networking.sits = mkOption {
       default = { };
       example = literalExpression ''
···
             example = "enp4s0f0";
             description = ''
               The underlying network device on which the tunnel resides.
+            '';
+          };
+
+          encapsulation = with types; mkOption {
+            type = nullOr (submodule {
+              options = {
+                type = mkOption {
+                  type = enum [ "fou" "gue" ];
+                  description = ''
+                    Selects encapsulation type. See
+                    <citerefentry><refentrytitle>ip-link</refentrytitle>
+                    <manvolnum>8</manvolnum></citerefentry> for details.
+                  '';
+                };
+
+                port = mkOption {
+                  type = port;
+                  example = 9001;
+                  description = ''
+                    Destination port for encapsulated packets.
+                  '';
+                };
+
+                sourcePort = mkOption {
+                  type = nullOr types.port;
+                  default = null;
+                  example = 9002;
+                  description = ''
+                    Source port for encapsulated packets. Will be chosen automatically by
+                    the kernel if unset.
+                  '';
+                };
+              };
+            });
+            default = null;
+            example = { type = "fou"; port = 9001; };
+            description = ''
+              Configures encapsulation in UDP packets.
             '';
           };
 
···
     boot.kernelModules = [ ]
       ++ optional hasVirtuals "tun"
       ++ optional hasSits "sit"
-      ++ optional hasBonds "bonding";
+      ++ optional hasBonds "bonding"
+      ++ optional hasFous "fou";
 
     boot.extraModprobeConfig =
       # This setting is intentional as it prevents default bond devices

nixos/modules/virtualisation/libvirtd.nix

···
       '';
     };
 
+    qemuOvmfPackage = mkOption {
+      type = types.package;
+      default = pkgs.OVMF;
+      defaultText = literalExpression "pkgs.OVMF";
+      example = literalExpression "pkgs.OVMFFull";
+      description = ''
+        OVMF package to use.
+      '';
+    };
+    qemuSwtpm = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Allows libvirtd to use swtpm to create an emulated TPM.
+      '';
+    };
+
     extraOptions = mkOption {
       type = types.listOf types.str;
       default = [ ];
···
       {
         assertion = config.security.polkit.enable;
         message = "The libvirtd module currently requires Polkit to be enabled ('security.polkit.enable = true').";
+      }
+      {
+        assertion = builtins.elem "fd" cfg.qemuOvmfPackage.outputs;
+        message = "The option 'virtualisation.libvirtd.qemuOvmfPackage' needs a package that has an 'fd' output.";
       }
     ];
 
···
         done
 
         ${optionalString cfg.qemuOvmf ''
-          ln -s --force ${pkgs.OVMF.fd}/FV/${ovmfFilePrefix}_CODE.fd /run/${dirName}/nix-ovmf/
-          ln -s --force ${pkgs.OVMF.fd}/FV/${ovmfFilePrefix}_VARS.fd /run/${dirName}/nix-ovmf/
+          ln -s --force ${cfg.qemuOvmfPackage.fd}/FV/${ovmfFilePrefix}_CODE.fd /run/${dirName}/nix-ovmf/
+          ln -s --force ${cfg.qemuOvmfPackage.fd}/FV/${ovmfFilePrefix}_VARS.fd /run/${dirName}/nix-ovmf/
         ''}
       '';
 
···
         ] ++ cfg.extraOptions);
 
       path = [ cfg.qemuPackage ] # libvirtd requires qemu-img to manage disk images
-             ++ optional vswitch.enable vswitch.package;
+             ++ optional vswitch.enable vswitch.package
+             ++ optional cfg.qemuSwtpm pkgs.swtpm;
 
       serviceConfig = {
         Type = "notify";

nixos/tests/networking.nix

···
               router.wait_until_succeeds("ping -c 1 192.168.1.3")
         '';
     };
+    fou = {
+      name = "foo-over-udp";
+      nodes.machine = { ... }: {
+        virtualisation.vlans = [ 1 ];
+        networking = {
+          useNetworkd = networkd;
+          useDHCP = false;
+          interfaces.eth1.ipv4.addresses = mkOverride 0
+            [ { address = "192.168.1.1"; prefixLength = 24; } ];
+          fooOverUDP = {
+            fou1 = { port = 9001; };
+            fou2 = { port = 9002; protocol = 41; };
+            fou3 = mkIf (!networkd)
+              { port = 9003; local.address = "192.168.1.1"; };
+            fou4 = mkIf (!networkd)
+              { port = 9004; local = { address = "192.168.1.1"; dev = "eth1"; }; };
+          };
+        };
+        systemd.services = {
+          fou3-fou-encap.after = optional (!networkd) "network-addresses-eth1.service";
+        };
+      };
+      testScript = { ... }:
+        ''
+          import json
+
+          machine.wait_for_unit("network.target")
+          fous = json.loads(machine.succeed("ip -json fou show"))
+          assert {"port": 9001, "gue": None, "family": "inet"} in fous, "fou1 exists"
+          assert {"port": 9002, "ipproto": 41, "family": "inet"} in fous, "fou2 exists"
+        '' + optionalString (!networkd) ''
+          assert {
+              "port": 9003,
+              "gue": None,
+              "family": "inet",
+              "local": "192.168.1.1",
+          } in fous, "fou3 exists"
+          assert {
+              "port": 9004,
+              "gue": None,
+              "family": "inet",
+              "local": "192.168.1.1",
+              "dev": "eth1",
+          } in fous, "fou4 exists"
+        '';
+    };
     sit = let
       node = { address4, remote, address6 }: { pkgs, ... }: with pkgs.lib; {
         virtualisation.vlans = [ 1 ];
         networking = {
           useNetworkd = networkd;
-          firewall.enable = false;
           useDHCP = false;
           sits.sit = {
             inherit remote;
···
       };
     in {
       name = "Sit";
-      nodes.client1 = node { address4 = "192.168.1.1"; remote = "192.168.1.2"; address6 = "fc00::1"; };
-      nodes.client2 = node { address4 = "192.168.1.2"; remote = "192.168.1.1"; address6 = "fc00::2"; };
+      # note on firewalling: the two nodes are explicitly asymmetric.
+      # client1 sends SIT packets in UDP, but accepts only proto-41 incoming.
+      # client2 does the reverse, sending in proto-41 and accepting only UDP incoming.
+      # that way we'll notice when either SIT itself or FOU breaks.
+      nodes.client1 = args@{ pkgs, ... }:
+        mkMerge [
+          (node { address4 = "192.168.1.1"; remote = "192.168.1.2"; address6 = "fc00::1"; } args)
+          {
+            networking = {
+              firewall.extraCommands = "iptables -A INPUT -p 41 -j ACCEPT";
+              sits.sit.encapsulation = { type = "fou"; port = 9001; };
+            };
+          }
+        ];
+      nodes.client2 = args@{ pkgs, ... }:
+        mkMerge [
+          (node { address4 = "192.168.1.2"; remote = "192.168.1.1"; address6 = "fc00::2"; } args)
+          {
+            networking = {
+              firewall.allowedUDPPorts = [ 9001 ];
+              fooOverUDP.fou1 = { port = 9001; protocol = 41; };
+            };
+          }
+        ];
       testScript = { ... }:
         ''
           start_all()

pkgs/applications/audio/mimic/default.nix

···
   version = "1.3.0.1";
 
   src = fetchFromGitHub {
-    rev = version;
-    repo = "mimic1";
     owner = "MycroftAI";
+    repo = "mimic1";
+    rev = version;
     sha256 = "1agwgby9ql8r3x5rd1rgx3xp9y4cdg4pi3kqlz3vanv9na8nf3id";
   };
 

pkgs/applications/editors/jetbrains/default.nix

···
 
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "0knl0ca15cj0nggyfhd7s0szxr2vp7xvvp3nna3mplssfn59zf9d"; /* updated by script */
+      sha256 = "09qbzkxyk435s4n04s12ncjyri024wj9pwz8wgjjsswpfa69dhr5"; /* updated by script */
     };
     wmClass = "jetbrains-clion";
     update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
···
 
   datagrip = buildDataGrip rec {
     name = "datagrip-${version}";
-    version = "2021.2.2"; /* updated by script */
+    version = "2021.2.4"; /* updated by script */
     description = "Your Swiss Army Knife for Databases and SQL";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "18dammsvd43x8cx0plzwgankmzfv7j79z0nsdagd540v99c2r2v3"; /* updated by script */
+      sha256 = "1vj9ihzw07bh30ngy8mj027ljq9zzd904k61f8jbfpw75vknh8f6"; /* updated by script */
     };
     wmClass = "jetbrains-datagrip";
     update-channel = "DataGrip RELEASE";
···
 
   goland = buildGoland rec {
     name = "goland-${version}";
-    version = "2021.2.2"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0ayqvyd24klafm09kls4fdp2acqsvh0zhm4wsrmrshlpmdqd5vjk"; /* updated by script */
+      sha256 = "1n0yrk05xv4pard82b6z349ksiw8k75s9525pnpa2ny1ay1klhdg"; /* updated by script */
     };
     wmClass = "jetbrains-goland";
     update-channel = "GoLand RELEASE";
···
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "1af43c51ryvqc7c9r3kz2266j0nvz50xw1vhfjbd74c3ycj8a1zz"; /* updated by script */
+      sha256 = "166rhssyizn40rlar7ym7gkwz2aawp58qqvrs60w3cwwvjvb0bjq"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IntelliJ IDEA RELEASE";
···
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "1257a9d9h3ybdsnm74jmgzp1rfi1629gv9kr0w2nhmxj7ghhbx4w"; /* updated by script */
+      sha256 = "1d0kk2yydrbzvdy6dy9jqr182panidmbf2hy80gvi5ph2r5rv1qd"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IntelliJ IDEA RELEASE";
···
 
   mps = buildMps rec {
     name = "mps-${version}";
-    version = "2021.1.3"; /* updated by script */
-    versionMajorMinor = "2021.1"; /* updated by script */
+    version = "2021.2.1"; /* updated by script */
+    versionMajorMinor = "2021.2"; /* updated by script */
     description = "Create your own domain-specific language";
     license = lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/mps/${versionMajorMinor}/MPS-${version}.tar.gz";
-      sha256 = "0w1nchaa2d3z3mdp43mvifnbibl1ribyc98dm7grnwvrqk72pabf"; /* updated by script */
+      sha256 = "1yawjc5xwga1mmlsl3068ml532941mq08i9ji3dhj1nwdkyav2jz"; /* updated by script */
     };
     wmClass = "jetbrains-mps";
     update-channel = "MPS RELEASE";
···
 
   phpstorm = buildPhpStorm rec {
     name = "phpstorm-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
     description = "Professional IDE for Web and PHP developers";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "1iqnq38d71wbl1iqhqr5as1802s53m3220vq4g42mdjgdj296bdk"; /* updated by script */
+      sha256 = "1avcm4fnkn0jkw85s505yz5kjbxzk038463sjdsca04pv5yhsdp0"; /* updated by script */
     };
     wmClass = "jetbrains-phpstorm";
     update-channel = "PhpStorm RELEASE";
···
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.2"; /* updated by script */
     description = "PyCharm Community Edition";
     license = lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1z59yvk3wrqn0c9581vvv62wxf4fyybha426ipyqml8c405z27y4"; /* updated by script */
+      sha256 = "0s9kk3n5ac6lvqi2yw9gvvm45865jchiwyrs8pq2dgdkgaligrjv"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm RELEASE";
···
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.2"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0sh9kdr53dhhq171p9lmsvci3qzlds4vzyqx12mzfvfs7svri1w2"; /* updated by script */
+      sha256 = "0mgmmf926n3ipr8fxn6f9hsa5vkil8yrw5qlixi8nwnx7chmkp56"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm RELEASE";
···
 
   rider = buildRider rec {
     name = "rider-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.2"; /* updated by script */
     description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "1b5ih6q8kyds8px7gldfz1m9ap3kk27yswwxy1735c83094l2nlm"; /* updated by script */
+      sha256 = "17xx8mz3dr5iqlr0lsiy8a6cxz3wp5vg8z955cdv0hf8b5rncqfa"; /* updated by script */
     };
     wmClass = "jetbrains-rider";
     update-channel = "Rider RELEASE";
···
 
   ruby-mine = buildRubyMine rec {
     name = "ruby-mine-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.3"; /* updated by script */
     description = "The Most Intelligent Ruby and Rails IDE";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "09blnm6han2rmdvjbr1va081zndzvjr1i0m3njaiwcb9rf2axm32"; /* updated by script */
+      sha256 = "0bbq5ya1dxrgaqqqsc4in4rgv7v292hww3bb0vpzwz6dmc2jly1i"; /* updated by script */
     };
     wmClass = "jetbrains-rubymine";
     update-channel = "RubyMine RELEASE";
···
 
   webstorm = buildWebStorm rec {
     name = "webstorm-${version}";
-    version = "2021.2.1"; /* updated by script */
+    version = "2021.2.2"; /* updated by script */
     description = "Professional IDE for Web and JavaScript development";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "12i9f5sw02gcgviflfs6gwmnxvzhgmm4v4447am0syl4nq8nyv1s"; /* updated by script */
+      sha256 = "1a3vlqza9nbc4a2qxrzdckmq003zx1db9dy7wx462amc8sbh6v92"; /* updated by script */
     };
     wmClass = "jetbrains-webstorm";
     update-channel = "WebStorm RELEASE";

pkgs/applications/editors/rstudio/default.nix

···
   src = fetchFromGitHub {
     owner = "rstudio";
     repo = "rstudio";
-    rev = version;
+    rev = "v${version}";
     sha256 = "sha256-9c1bNsf8kJjpcZ2cMV/pPNtXQkFOntX29a1cdnXpllE=";
   };
 

pkgs/applications/misc/zettlr/default.nix

···
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
 let
   pname = "zettlr";
-  version = "1.8.9";
+  version = "2.0.0";
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
-    sha256 = "sha256-1cU9HdPXrJ4ibSjOitO8iJfMIaGub/jjlb2lssYFfcU=";
+    sha256 = "sha256-MIFgNUuuneIIkPRVRarbx6UMoB/3sdJtKvbacUnwHX8=";
   };
   appimageContents = appimageTools.extractType2 {
     inherit name src;

pkgs/applications/networking/cluster/kn/default.nix

···
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "kn";
+  version = "0.26.0";
+
+  src = fetchFromGitHub {
+    owner = "knative";
+    repo = "client";
+    rev = "v${version}";
+    sha256 = "sha256-hquxv1BluR535WvMtJlVyP7JuARDNGDjPAbdSSj2juo=";
+  };
+
+  vendorSha256 = null;
+
+  subPackages = [ "cmd/kn" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-X knative.dev/client/pkg/kn/commands/version.Version=v${version}"
+    "-X knative.dev/client/pkg/kn/commands/version.VersionEventing=v${version}"
+    "-X knative.dev/client/pkg/kn/commands/version.VersionServing=v${version}"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd kn \
+      --bash <($out/bin/kn completion bash) \
+      --zsh <($out/bin/kn completion zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/kn version | grep ${version} > /dev/null
+  '';
+
+  meta = with lib; {
+    description = "The Knative client kn is your door to the Knative world. It allows you to create Knative resources interactively from the command line or from within scripts";
+    homepage = "https://github.com/knative/client";
+    changelog = "https://github.com/knative/client/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bryanasdev000 ];
+  };
+}

pkgs/applications/networking/cluster/terragrunt/default.nix

···
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.33.0";
+  version = "0.35.1";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FvgB0jG6PEvhrT9Au/Uv9XSgKx+zNw8zETpg2dJ6QX4=";
+    sha256 = "sha256-DCum3vCrN530Z0VW0WEoLtjN+kre/mU9O+sJxckZgfc=";
   };
 
   vendorSha256 = "sha256-y84EFmoJS4SeA5YFIVFU0iWa5NnjU5yvOj7OFE+jGN0=";

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

···
       --set LC_MESSAGES "${spellcheckerLanguage}"'');
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.19.0"; # Please backport all updates to the stable channel.
+  version = "5.20.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
···
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0avns5axcfs8x9sv7hyjxi1cr7gag00avfj0h99wgn251b313g1a";
+    sha256 = "0a57gajxjqkp7zcmjc3iiys06b7v53nd81gkwrsfn2gmshihlzkd";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/mailreaders/meli/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "meli";
-  version = "alpha-0.7.1";
+  version = "alpha-0.7.2";
 
   src = fetchgit {
     url = "https://git.meli.delivery/meli/meli.git";
     rev = version;
-    sha256 = "00iai2z5zydx9bw0ii0n6d7zwm5rrkj03b4ymic0ybwjahqzvyfq";
+    sha256 = "sha256-cbigEJhX6vL+gHa40cxplmPsDhsqujkzQxe0Dr6+SK0=";
   };
 
-  cargoSha256 = "1r54a51j91iv0ziasjygzw30vqqvqibcnwnkih5xv0ijbaly61n0";
+  cargoSha256 = "sha256-ZE653OtXyZ9454bKPApmuL2kVko/hGBWEAya1L1KIoc=";
 
   cargoBuildFlags = lib.optional withNotmuch "--features=notmuch";
 

pkgs/applications/video/clapper/default.nix

···
 , gtk4
 , gst_all_1
 , libadwaita
+, appstream-glib
+, libsoup
 }:
 
 stdenv.mkDerivation rec {
···
   };
 
   nativeBuildInputs = [
+    appstream-glib
     desktop-file-utils # for update-desktop-database
     glib
     gobject-introspection
···
     gst_all_1.gst-plugins-ugly
     gtk4
     libadwaita
+    libsoup
     wayland
     wayland-protocols
   ];

pkgs/desktops/gnome/core/epiphany/default.nix

···
   };
 
   patches = lib.optionals withPantheon [
+    # Make this respect dark mode settings from Pantheon
     # https://github.com/elementary/browser
-    ./dark-style.patch
-    ./navigation-buttons.patch
+    # The patch currently differs from upstream (updated for epiphany 40 and 41).
+    ./pantheon-dark-style.patch
+    ./pantheon-navigation-buttons.patch
   ];
 
   nativeBuildInputs = [
···
     p11-kit
     sqlite
     webkitgtk
-  ] ++ lib.optional withPantheon pantheon.granite;
+  ] ++ lib.optionals withPantheon [
+    pantheon.granite
+  ];
 
   # Tests need an X display
   mesonFlags = [

pkgs/desktops/gnome/core/evince/default.nix

···
 , gsettings-desktop-schemas
 , gnome-desktop
 , dbus
+, pantheon
 , python3
 , texlive
 , t1lib
···
 , supportMultimedia ? true # PDF multimedia
 , libgxps
 , supportXPS ? true # Open XML Paper Specification via libgxps
+, withPantheon ? false
 }:
 
 stdenv.mkDerivation rec {
···
     url = "mirror://gnome/sources/evince/${lib.versions.major version}/${pname}-${version}.tar.xz";
     sha256 = "lautDW/urJVg2zq4C6fF6rsf3xyg47PJMzmvBUU6JNg=";
   };
+
+  patches = lib.optionals withPantheon [
+    # Make this respect dark mode settings from Pantheon
+    # https://github.com/elementary/evince
+    # The patch currently differs from upstream (updated for evince 41).
+    ./pantheon-dark-style.patch
+  ];
 
   postPatch = ''
     chmod +x meson_post_install.py
···
     poppler
     t1lib
     texlive.bin.core # kpathsea for DVI support
-  ] ++ lib.optional supportXPS libgxps
-    ++ lib.optionals supportMultimedia (with gst_all_1; [
-      gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav ]);
+  ] ++ lib.optionals supportXPS [
+    libgxps
+  ] ++ lib.optionals supportMultimedia (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-bad
+    gst-plugins-ugly
+    gst-libav
+  ]) ++ lib.optionals withPantheon [
+    pantheon.granite
+  ];
 
   mesonFlags = [
     "-Dnautilus=false"
···
       on the GNOME Desktop with a single simple application.
     '';
 
-    license = lib.licenses.gpl2Plus;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = teams.gnome.members;
+    maintainers = teams.gnome.members ++ teams.pantheon.members;
   };
 }

pkgs/desktops/gnome/core/evince/pantheon-dark-style.patch

···
+diff --git a/meson.build b/meson.build
+index bcb69cf7..4a18c08c 100644
+--- a/meson.build
++++ b/meson.build
+@@ -162,6 +162,7 @@ gmodule_dep = dependency('gmodule-2.0')
+ gmodule_no_export_dep = dependency('gmodule-no-export-2.0', version: glib_req_version)
+ gtk_dep = dependency('gtk+-3.0', version: gtk_req_version)
+ gthread_dep = dependency('gthread-2.0', version: glib_req_version)
++granite_dep = dependency('granite')
+ # Keep the version here synchronised with subprojects/libhandy.wrap
+ hdy_dep = dependency('libhandy-1', version: hdy_req_version, fallback: ['libhandy', 'libhandy_dep'])
+ 
+diff --git a/shell/ev-application.c b/shell/ev-application.c
+index e704bda2..d705328c 100644
+--- a/shell/ev-application.c
++++ b/shell/ev-application.c
+@@ -30,6 +30,7 @@
+ #include <glib/gi18n.h>
+ #include <glib/gstdio.h>
+ #include <gtk/gtk.h>
++#include <granite.h>
+ #include <handy.h>
+ #ifdef GDK_WINDOWING_X11
+ #include <gdk/gdkx.h>
+@@ -176,7 +177,7 @@ ev_spawn (const char     *uri,
+ 
+ 	g_string_append_printf (cmd, " %s", path);
+ 	g_free (path);
+-	
++
+ 	/* Page label */
+ 	if (dest) {
+                 switch (ev_link_dest_get_dest_type (dest)) {
+@@ -940,6 +941,20 @@ ev_application_migrate_config_dir (EvApplication *application)
+         g_free (old_accels);
+ }
+ 
++static void
++ev_application_set_prefers_color_scheme ()
++{
++        GtkSettings* gtk_settings = gtk_settings_get_default ();
++        GraniteSettings* granite_settings = granite_settings_get_default ();
++
++        g_object_set (
++          gtk_settings,
++          "gtk-application-prefer-dark-theme",
++          granite_settings_get_prefers_color_scheme (granite_settings) == GRANITE_SETTINGS_COLOR_SCHEME_DARK,
++          NULL
++        );
++}
++
+ static void
+ ev_application_startup (GApplication *gapplication)
+ {
+@@ -992,6 +1007,7 @@ ev_application_startup (GApplication *gapplication)
+ 
+         EvApplication *application = EV_APPLICATION (gapplication);
+         const gchar **it;
++        GraniteSettings* granite_settings = granite_settings_get_default ();
+ 
+ 	g_application_set_resource_base_path (gapplication, "/org/gnome/evince");
+ 
+@@ -999,6 +1015,11 @@ ev_application_startup (GApplication *gapplication)
+ 
+         hdy_init ();
+ 
++        ev_application_set_prefers_color_scheme ();
++
++        g_signal_connect (granite_settings, "notify::prefers-color-scheme",
++          G_CALLBACK(ev_application_set_prefers_color_scheme), NULL);
++
+         for (it = action_accels; it[0]; it += g_strv_length ((gchar **)it) + 1)
+                 gtk_application_set_accels_for_action (GTK_APPLICATION (application), it[0], &it[1]);
+ }
+diff --git a/shell/meson.build b/shell/meson.build
+index 7cbc48f2..a3089b13 100644
+--- a/shell/meson.build
++++ b/shell/meson.build
+@@ -52,6 +52,7 @@ sources += gnome.compile_resources(
+ deps = [
+   gdk_pixbuf_dep,
+   gnome_desktop_dep,
++  granite_dep,
+   hdy_dep,
+   libevmisc_dep,
+   libevproperties_dep,

pkgs/desktops/gnome/misc/pomodoro/default.nix

···
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, autoconf-archive
-, appstream-glib
+, substituteAll
+, fetchpatch
+, meson
+, ninja
 , pkg-config
 , wrapGAppsHook
+, desktop-file-utils
 , libcanberra
 , gst_all_1
 , vala
···
 , gom
 , sqlite
 , libxml2
-, autoreconfHook
 , glib
 , gobject-introspection
 , libpeas
-, gnome-shell
 , gsettings-desktop-schemas
-, adwaita-icon-theme
 , gettext
 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-pomodoro";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
-    owner = "codito";
+    owner = "gnome-pomodoro";
     repo = "gnome-pomodoro";
     rev = version;
-    sha256 = "sha256-im66QUzz6PcX0vkf4cN57ttRLB4KKPFky1pwUa4V7kQ=";
+    sha256 = "sha256-USzLHoBM0QbBPtbTzJJY02cOSDtmlxPGYhMj7M1FJic=";
   };
 
+  patches = [
+    # Our glib setup hooks moves GSettings schemas to a subdirectory to prevent conflicts.
+    # We need to patch the build script so that the extension can find them.
+    (substituteAll {
+      src = ./fix-schema-path.patch;
+      inherit pname version;
+    })
+
+    # Fix error reporting code.
+    # https://github.com/gnome-pomodoro/gnome-pomodoro/pull/591
+    (fetchpatch {
+      url = "https://github.com/gnome-pomodoro/gnome-pomodoro/commit/133bd62f15653856d9705b66188b42c20d81719e.patch";
+      sha256 = "A20K+57A6/lYH2Buri2+wrCQgz6EGBdYg2xQbHPSkYc=";
+    })
+  ];
+
   nativeBuildInputs = [
-    appstream-glib
-    autoconf-archive
-    autoreconfHook
+    meson
+    ninja
     gettext
     gobject-introspection
     libxml2
     pkg-config
     vala
     wrapGAppsHook
+    desktop-file-utils
   ];
 
   buildInputs = [
-    adwaita-icon-theme
     glib
-    gnome-shell
     gom
     gsettings-desktop-schemas
     gst_all_1.gst-plugins-base

pkgs/desktops/gnome/misc/pomodoro/fix-schema-path.patch

···
+diff --git a/data/meson.build b/data/meson.build
+index 5e4ce69..982b3c9 100644
+--- a/data/meson.build
++++ b/data/meson.build
+@@ -31,7 +31,7 @@ i18n.merge_file(
+ 
+ install_data(
+   'org.gnome.pomodoro.gschema.xml',
+-  install_dir: get_option('datadir') / 'glib-2.0' / 'schemas',
++  install_dir: gschema_dir,
+ )
+ 
+ subdir('icons')
+diff --git a/meson-post-install.sh b/meson-post-install.sh
+index bf4013a..c87fba4 100644
+--- a/meson-post-install.sh
++++ b/meson-post-install.sh
+@@ -7,7 +7,7 @@ datadir="${prefix}/$1"
+ # want/need us to do the below
+ if [ -z "${DESTDIR}" ]; then
+     echo "Compiling GSchema..."
+-    glib-compile-schemas "${datadir}/glib-2.0/schemas"
++    glib-compile-schemas "${datadir}/gsettings-schemas/@pname@-@version@/glib-2.0/schemas"
+ 
+     echo "Updating icon cache..."
+     gtk-update-icon-cache -f -t "${datadir}/icons/hicolor"
+diff --git a/meson.build b/meson.build
+index 09857a1..a07d27c 100644
+--- a/meson.build
++++ b/meson.build
+@@ -40,7 +40,8 @@ add_project_arguments(
+ )
+ 
+ # We are going to use these variables later on for the plugins
+-gschema_dir = get_option('prefix') / get_option('datadir') / 'glib-2.0' / 'schemas'
++nix_package_name = '@pname@' + '-' + '@version@'
++gschema_dir = get_option('prefix') / get_option('datadir') / 'gsettings-schemas' / nix_package_name / 'glib-2.0' / 'schemas'
+ plugin_libdir = get_option('prefix') / get_option('libdir') / meson.project_name() / 'plugins'
+ extension_dir = get_option('prefix') / get_option('datadir') / 'gnome-shell' / 'extensions' / '[e-mail]'
+ 

pkgs/desktops/pantheon/default.nix

···
 
   epiphany = pkgs.epiphany.override { withPantheon = true; };
 
+  evince = pkgs.evince.override { withPantheon = true; };
+
   sideload = callPackage ./apps/sideload { };
 
   #### DESKTOP

pkgs/development/compilers/tinycc/default.nix

···
   '';
 
   configureFlags = [
-    "--cc=cc"
+    "--cc=$CC"
+    "--ar=$AR"
     "--crtprefix=${lib.getLib stdenv.cc.libc}/lib"
     "--sysincludepaths=${lib.getDev stdenv.cc.libc}/include:{B}/include"
     "--libpaths=${lib.getLib stdenv.cc.libc}/lib"
     # build cross compilers
     "--enable-cross"
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    "--config-musl"
   ];
 
   preConfigure = ''

pkgs/development/embedded/fpga/trellis/default.nix

···
   nativeBuildInputs = [ cmake python3 ];
   cmakeFlags = [
     "-DCURRENT_GIT_VERSION=${realVersion}"
+    # TODO: should this be in stdenv instead?
+    "-DCMAKE_INSTALL_DATADIR=${placeholder "out"}/share"
   ];
 
   preConfigure = ''
···
     cd libtrellis
   '';
 
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    $out/bin/ecppack $out/share/trellis/misc/basecfgs/empty_lfe5u-85f.config /tmp/test.bin
+  '';
+
   meta = with lib; {
     description     = "Documentation and bitstream tools for Lattice ECP5 FPGAs";
     longDescription = ''
···
     '';
     homepage    = "https://github.com/YosysHQ/prjtrellis";
     license     = licenses.isc;
-    maintainers = with maintainers; [ q3k thoughtpolice emily ];
+    maintainers = with maintainers; [ q3k thoughtpolice emily rowanG077 ];
     platforms   = platforms.all;
   };
 }

pkgs/development/interpreters/bqn/dzaima-bqn/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "dbqn" + lib.optionalString buildNativeImage "-native";
-  version = "0.pre+unstable=2021-10-05";
+  version = "0.pre+date=2021-10-08";
 
   src = fetchFromGitHub {
     owner = "dzaima";
     repo = "BQN";
-    rev = "c31ceef52bbf380e747723f5ffd09c5f006b21c5";
-    sha256 = "1nzqgwpjawcky85mfrz5izs9lfb3aqlm96dc8syrxhgg20xrziwx";
+    rev = "0001109a1c5a420421b368c79d34b1e93bfe606e";
+    hash = "sha256-riHHclTLkrVbtzmcz9ungAIc7kaoFHS77+SNatsfNhc=";
   };
 
   nativeBuildInputs = [
-    makeWrapper
     jdk
+    makeWrapper
   ];
 
   dontConfigure = true;
 
+  postPatch = ''
+    patchShebangs --build ./build8
+  '';
+
   buildPhase = ''
     runHook preBuild
 
-    patchShebangs --build ./build8
     ./build8
   '' + lib.optionalString buildNativeImage ''
     native-image --report-unsupported-elements-at-runtime \
-      -H:CLibraryPath=${lib.getLib jdk}/lib \
-      -J-Dfile.encoding=UTF-8 -jar BQN.jar dbqn
+      -H:CLibraryPath=${lib.getLib jdk}/lib -J-Dfile.encoding=UTF-8 \
+      -jar BQN.jar dbqn
   '' + ''
     runHook postBuild
   '';

pkgs/development/interpreters/dzaima-apl/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "dapl" + lib.optionalString buildNativeImage "-native";
-  version = "0.2.0+unstable=2021-06-30";
+  version = "0.2.0+date=2021-10-16";
 
   src = fetchFromGitHub {
     owner = "dzaima";
     repo = "APL";
-    rev = "28b3667beb23c6472266bb2b6eb701708fa421c6";
-    hash = "sha256-2kM9XDMclxJNOZngwLvoDQG23UZQQ6ePK/j215UumCg=";
+    rev = "5eb0a4205e27afa6122096a25008474eec562dc0";
+    hash = "sha256-UdumMytqT909JRpNqzhYPuKPw644m/vRUsEbIVF2a7U=";
   };
 
   nativeBuildInputs = [
-    makeWrapper
     jdk
+    makeWrapper
   ];
 
   dontConfigure = true;
 
+  postPatch = ''
+    patchShebangs --build ./build
+  '';
+
   buildPhase = ''
     runHook preBuild
 
-    patchShebangs --build ./build
-    substituteInPlace ./build \
-      --replace "javac" "javac -encoding utf8"
     ./build
   '' + lib.optionalString buildNativeImage ''
     native-image --report-unsupported-elements-at-runtime \
-      -H:CLibraryPath=${lib.getLib jdk}/lib -jar APL.jar dapl
+      -H:CLibraryPath=${lib.getLib jdk}/lib -J-Dfile.encoding=UTF-8 \
+      -jar APL.jar dapl
   '' + ''
     runHook postBuild
   '';

pkgs/development/interpreters/gnudatalanguage/default.nix

···
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, wrapGAppsHook
+, readline
+, ncurses
+, zlib
+, gsl
+, openmp
+, graphicsmagick
+, fftw
+, fftwFloat
+, fftwLongDouble
+, proj
+, shapelib
+, expat
+, udunits
+, eigen
+, pslib
+, eccodes
+, glpk
+, libpng
+, plplot
+, libtiff
+, libgeotiff
+, libjpeg
+  # We enable it in hdf4 and use libtirpc as a dependency here from the passthru
+  # of hdf4
+, enableLibtirpc ? stdenv.isLinux
+, libtirpc
+, python3
+, enableMPI ? (stdenv.isLinux || stdenv.isDarwin)
+  # Choose MPICH over OpenMPI because it currently builds on AArch and Darwin
+, mpi
+  # Unfree optional dependency for hdf4 and hdf5
+, enableSzip ? false
+, szip
+, enableHDF4 ? true
+, hdf4
+, hdf4-forced ? null
+, enableHDF5 ? true
+  # HDF5 format version (API version) 1.10 and 1.12 is not fully compatible
+  # Specify if the API version should default to 1.10
+  # netcdf currently depends on hdf5 with `usev110Api=true`
+  # If you wish to use HDF5 API version 1.12 (`useHdf5v110Api=false`),
+  # you will need to turn NetCDF off.
+, useHdf5v110Api ? true
+, hdf5
+, hdf5-forced ? null
+, enableNetCDF ? true
+, netcdf
+, netcdf-forced ? null
+, plplot-forced ? null
+  # wxWidgets is preferred over X11 for this project but we only have it on Linux
+  # and Darwin. Also, we use the wxWidgets dependency here from the passthru of
+  # plplot.
+, enableWX ? (stdenv.isLinux || stdenv.isDarwin)
+  # X11: OFF by default for platform consistency. Use X where WX is not available
+, enableXWin ? (!stdenv.isLinux && !stdenv.isDarwin)
+}:
+
+let
+  hdf4-custom =
+    if hdf4-forced != null
+    then hdf4-forced
+    else
+      hdf4.override {
+        uselibtirpc = enableLibtirpc;
+        szipSupport = enableSzip;
+        inherit szip;
+      };
+  hdf5-custom =
+    if hdf5-forced != null
+    then hdf5-forced
+    else
+      hdf5.override {
+        usev110Api = useHdf5v110Api;
+        mpiSupport = enableMPI;
+        inherit mpi;
+        szipSupport = enableSzip;
+        inherit szip;
+      };
+  netcdf-custom =
+    if netcdf-forced != null
+    then netcdf-forced
+    else
+      netcdf.override {
+        hdf5 = hdf5-custom;
+      };
+  enablePlplotDrivers = enableWX || enableXWin;
+  plplot-with-drivers =
+    if plplot-forced != null
+    then plplot-forced
+    else
+      plplot.override {
+        inherit
+          enableWX
+          enableXWin
+          ;
+      };
+in
+stdenv.mkDerivation rec {
+  pname = "gnudatalanguage";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = "gdl";
+    rev = "v${version}";
+    sha256 = "sha256-Y9LVRaWjQqpWqjNngxB406PE/rl/9S8rs0u0CK5ivUA=";
+  };
+
+  buildInputs = [
+    readline
+    ncurses
+    zlib
+    gsl
+    openmp
+    graphicsmagick
+    fftw
+    fftwFloat
+    fftwLongDouble
+    proj
+    shapelib
+    expat
+    mpi
+    udunits
+    eigen
+    pslib
+    eccodes
+    glpk
+    libpng
+    libtiff
+    libgeotiff
+    libjpeg
+    hdf4-custom
+    hdf5-custom
+    netcdf-custom
+    plplot-with-drivers
+  ] ++ lib.optional enableXWin plplot-with-drivers.libX11
+  ++ lib.optional enableWX plplot-with-drivers.wxWidgets
+  ++ lib.optional enableMPI mpi
+  ++ lib.optional enableLibtirpc hdf4-custom.libtirpc
+  ++ lib.optional enableSzip szip;
+
+  propagatedBuildInputs = [
+    (python3.withPackages (ps: with ps; [ numpy ]))
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ] ++ lib.optional enableWX wrapGAppsHook;
+
+  cmakeFlags = lib.optional (!enableHDF4) "-DHDF=OFF"
+    ++ [ (if enableHDF5 then "-DHDF5DIR=${hdf5-custom}" else "-DHDF5=OFF") ]
+    ++ lib.optional (!enableNetCDF) "-DNETCDF=OFF"
+    ++ lib.optional (!enablePlplotDrivers) "-DINTERACTIVE_GRAPHICS=OFF"
+    ++ lib.optional (!enableWX) "-DWXWIDGETS=OFF"
+    ++ lib.optional enableSzip "-DSZIPDIR=${szip}"
+    ++ lib.optionals enableXWin [ "-DX11=ON" "-DX11DIR=${plplot-with-drivers.libX11}" ]
+    ++ lib.optionals enableMPI [ "-DMPI=ON" "-DMPIDIR=${mpi}" ];
+
+  doCheck = true;
+
+  # Opt-out unstable tests
+  # https://github.com/gnudatalanguage/gdl/issues/482
+  # https://github.com/gnudatalanguage/gdl/issues/1079
+  # https://github.com/gnudatalanguage/gdl/issues/460
+  preCheck = ''
+    checkFlagsArray+=("ARGS=-E 'test_tic_toc.pro|test_byte_conversion.pro|test_bytscl.pro|test_call_external.pro'")
+  '';
+
+  passthru = {
+    hdf4 = hdf4-custom;
+    hdf5 = hdf5-custom;
+    netcdf = netcdf-custom;
+    plplot = plplot-with-drivers;
+    python = python3;
+    inherit
+      enableMPI
+      mpi
+      useHdf5v110Api
+      enableSzip
+      enableWX
+      enableXWin
+      ;
+  };
+
+  meta = with lib; {
+    description = "Free incremental compiler of IDL";
+    longDescription = ''
+      GDL (GNU Data Language) is a free/libre/open source incremental compiler
+      compatible with IDL (Interactive Data Language) and to some extent with PV-WAVE.
+      GDL is aimed as a drop-in replacement for IDL.
+    '';
+    homepage = "https://github.com/gnudatalanguage/gdl";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ ShamrockLee ];
+    platforms = platforms.all;
+    mainProgram = "gdl";
+  };
+}

pkgs/development/libraries/aml/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "aml";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0mxmzlhiv88hm4sf8kyawyrml8qy1xis019hdyb5skl9g95z9yyf";
+    sha256 = "1m911n3rd41ch4yk3k9k1lz29xp3h54k6jx122abq5kmngy9znqw";
   };
 
   nativeBuildInputs = [ meson pkg-config ninja ];

pkgs/development/libraries/flatpak/bubblewrap-paths.patch

···
              "--unshare-net",
              "--unshare-pid",
 -            "--ro-bind", "/usr", "/usr",
--            "--ro-bind", "/etc/ld.so.cache", "/etc/ld.so.cache",
+-            "--ro-bind-try", "/etc/ld.so.cache", "/etc/ld.so.cache",
 +            "--ro-bind", "@storeDir@", "@storeDir@",
 +            "--ro-bind", "/run/current-system", "/run/current-system",
              "--ro-bind", validate_icon, validate_icon,

pkgs/development/libraries/flatpak/default.nix

···
 , dconf
 , gsettings-desktop-schemas
 , librsvg
+, makeWrapper
 }:
 
 stdenv.mkDerivation rec {
   pname = "flatpak";
-  version = "1.10.2";
+  version = "1.12.2";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [ "out" "dev" "man" "doc" "devdoc" "installedTests" ];
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-2xUnOdBy+P8pnk6IjYljobRTjaexDguGUlvkOPLh3eQ=";
+    sha256 = "df1eb464f9142c11627f99f04f6a5c02c868bbb145489b8902cb6c105e774b75"; # Taken from https://github.com/flatpak/flatpak/releases/
   };
 
   patches = [
···
     # Patch taken from gtk-doc expression.
     ./respect-xml-catalog-files-var.patch
 
-    # Don’t hardcode flatpak binary path in launchers stored under user’s profile otherwise they will break after Flatpak update.
-    # https://github.com/NixOS/nixpkgs/issues/43581
-    ./use-flatpak-from-path.patch
-
-    # Hardcode flatpak binary path for flatpak-spawn.
-    # When calling the portal’s Spawn command with FLATPAK_SPAWN_FLAGS_CLEAR_ENV flag,
-    # it will clear environment, including PATH, making the flatpak run fail.
-    # https://github.com/flatpak/flatpak/pull/4174
-    (fetchpatch {
-      url = "https://github.com/flatpak/flatpak/commit/495449daf6d3c072519a36c9e4bc6cc1da4d31db.patch";
-      sha256 = "gOX/sGupAE7Yg3MVrMhFXzWHpFn+izVyjtkuPzIckuY=";
-    })
-
     # Nix environment hacks should not leak into the apps.
     # https://github.com/NixOS/nixpkgs/issues/53441
     ./unset-env-vars.patch
 
     # But we want the GDK_PIXBUF_MODULE_FILE from the wrapper affect the icon validator.
     ./validate-icon-pixbuf.patch
+
+    # Tests don't respect the FLATPAK_BINARY override that was added, this is a workaround.
+    # https://github.com/flatpak/flatpak/pull/4496 (Can be removed once included).
+    (fetchpatch {
+      url = "https://github.com/flatpak/flatpak/commit/96dbe28cfa96e80b23fa1d8072eb36edad41279c.patch";
+      sha256 = "1jczk06ymfs98h3nsg245g0jwxvml7wg2x6pb7mrfpsdmrpz2czd";
+    })
   ];
 
   nativeBuildInputs = [
···
   in ''
     patchShebangs buildutil
     patchShebangs tests
-    PATH=${lib.makeBinPath [vsc-py]}:$PATH patchShebangs --build variant-schema-compiler/variant-schema-compiler
+    PATH=${lib.makeBinPath [vsc-py]}:$PATH patchShebangs --build subprojects/variant-schema-compiler/variant-schema-compiler
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # Use flatpak from PATH in exported assets (e.g. desktop files).
+      --set FLATPAK_BINARY flatpak
+    )
   '';
 
   passthru = {

pkgs/development/libraries/flatpak/use-flatpak-from-path.patch

···
-diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
-index 52b222ea..9489441f 100644
---- a/common/flatpak-dir.c
-+++ b/common/flatpak-dir.c
-@@ -6956,7 +6956,7 @@ export_desktop_file (const char         *app,
- 
-       new_exec = g_string_new ("");
-       g_string_append_printf (new_exec,
--                              FLATPAK_BINDIR "/flatpak run --branch=%s --arch=%s",
-+                              "flatpak run --branch=%s --arch=%s",
-                               escaped_branch,
-                               escaped_arch);
- 
-@@ -8290,8 +8290,8 @@ flatpak_dir_deploy (FlatpakDir          *self,
-                                        error))
-         return FALSE;
- 
--      bin_data = g_strdup_printf ("#!/bin/sh\nexec %s/flatpak run --branch=%s --arch=%s %s \"$@\"\n",
--                                  FLATPAK_BINDIR, escaped_branch, escaped_arch, escaped_app);
-+      bin_data = g_strdup_printf ("#!/bin/sh\nexec flatpak run --branch=%s --arch=%s %s \"$@\"\n",
-+                                  escaped_branch, escaped_arch, escaped_app);
-       if (!g_file_replace_contents (wrapper, bin_data, strlen (bin_data), NULL, FALSE,
-                                     G_FILE_CREATE_REPLACE_DESTINATION, NULL, cancellable, error))
-         return FALSE;
-diff --git a/tests/test-bundle.sh b/tests/test-bundle.sh
-index d1682344..5e2b9a97 100755
---- a/tests/test-bundle.sh
-+++ b/tests/test-bundle.sh
-@@ -67,7 +67,7 @@ assert_has_dir $FL_DIR/app/org.test.Hello/$ARCH/master/active/files
- assert_has_dir $FL_DIR/app/org.test.Hello/$ARCH/master/active/export
- assert_has_file $FL_DIR/exports/share/applications/org.test.Hello.desktop
- # Ensure Exec key is rewritten
--assert_file_has_content $FL_DIR/exports/share/applications/org.test.Hello.desktop "^Exec=.*/flatpak run --branch=master --arch=$ARCH --command=hello\.sh org\.test\.Hello$"
-+assert_file_has_content $FL_DIR/exports/share/applications/org.test.Hello.desktop "^Exec=flatpak run --branch=master --arch=$ARCH --command=hello\.sh org\.test\.Hello$"
- assert_has_file $FL_DIR/exports/share/icons/hicolor/64x64/apps/org.test.Hello.png
- assert_has_file $FL_DIR/exports/share/icons/HighContrast/64x64/apps/org.test.Hello.png
- 
-diff --git a/tests/test-run.sh b/tests/test-run.sh
-index fecb756e..64043281 100644
---- a/tests/test-run.sh
-+++ b/tests/test-run.sh
-@@ -45,7 +45,7 @@ assert_has_dir $FL_DIR/app/org.test.Hello/$ARCH/stable/active/files
- assert_has_dir $FL_DIR/app/org.test.Hello/$ARCH/stable/active/export
- assert_has_file $FL_DIR/exports/share/applications/org.test.Hello.desktop
- # Ensure Exec key is rewritten
--assert_file_has_content $FL_DIR/exports/share/applications/org.test.Hello.desktop "^Exec=.*/flatpak run --branch=stable --arch=$ARCH --command=hello\.sh org\.test\.Hello$"
-+assert_file_has_content $FL_DIR/exports/share/applications/org.test.Hello.desktop "^Exec=flatpak run --branch=stable --arch=$ARCH --command=hello\.sh org\.test\.Hello$"
- assert_has_file $FL_DIR/exports/share/gnome-shell/search-providers/org.test.Hello.search-provider.ini
- assert_file_has_content $FL_DIR/exports/share/gnome-shell/search-providers/org.test.Hello.search-provider.ini "^DefaultDisabled=true$"
- assert_has_file $FL_DIR/exports/share/icons/hicolor/64x64/apps/org.test.Hello.png

pkgs/development/libraries/libressl/CVE-2021-41581.patch

···
+Based on upstream https://github.com/openbsd/src/commit/62ceddea5b1d64a1a362bbb7071d9e15adcde6b1
+with paths switched to apply to libressl-portable and CVS header
+hunk removed.
+
+--- a/crypto/x509/x509_constraints.c
++++ b/crypto/x509/x509_constraints.c
+@@ -339,16 +339,16 @@
+ 			if (c == '.')
+ 				goto bad;
+ 		}
+-		if (wi > DOMAIN_PART_MAX_LEN)
+-			goto bad;
+ 		if (accept) {
++			if (wi >= DOMAIN_PART_MAX_LEN)
++				goto bad;
+ 			working[wi++] = c;
+ 			accept = 0;
+ 			continue;
+ 		}
+ 		if (candidate_local != NULL) {
+ 			/* We are looking for the domain part */
+-			if (wi > DOMAIN_PART_MAX_LEN)
++			if (wi >= DOMAIN_PART_MAX_LEN)
+ 				goto bad;
+ 			working[wi++] = c;
+ 			if (i == len - 1) {
+@@ -363,7 +363,7 @@
+ 			continue;
+ 		}
+ 		/* We are looking for the local part */
+-		if (wi > LOCAL_PART_MAX_LEN)
++		if (wi >= LOCAL_PART_MAX_LEN)
+ 			break;
+ 
+ 		if (quoted) {
+@@ -383,6 +383,8 @@
+ 			 */
+ 			if (c == 9)
+ 				goto bad;
++			if (wi >= LOCAL_PART_MAX_LEN)
++				goto bad;
+ 			working[wi++] = c;
+ 			continue; /* all's good inside our quoted string */
+ 		}
+@@ -412,6 +414,8 @@
+ 		}
+ 		if (!local_part_ok(c))
+ 			goto bad;
++		if (wi >= LOCAL_PART_MAX_LEN)
++			goto bad;
+ 		working[wi++] = c;
+ 	}
+ 	if (candidate_local == NULL || candidate_domain == NULL)

pkgs/development/libraries/libressl/default.nix

···
-{ stdenv, fetchurl, lib, cmake, cacert, fetchpatch
+{ stdenv
+, fetchurl
+, lib
+, cmake
+, cacert
+, fetchpatch
 , buildShared ? !stdenv.hostPlatform.isStatic
 }:
 
 let
+  ldLibPathEnvName = if stdenv.isDarwin
+    then "DYLD_LIBRARY_PATH"
+    else "LD_LIBRARY_PATH";
 
   generic = { version, sha256, patches ? [] }: stdenv.mkDerivation rec {
     pname = "libressl";
···
       substituteInPlace ./tls/tls_config.c --replace '"/etc/ssl/cert.pem"' '"${cacert}/etc/ssl/certs/ca-bundle.crt"'
     '';
 
+    doCheck = true;
+    preCheck = ''
+      export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
+      export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
+    '';
+    postCheck = ''
+      export ${ldLibPathEnvName}=$PREVIOUS_${ldLibPathEnvName}
+    '';
+
     outputs = [ "bin" "dev" "out" "man" "nc" ];
 
     postFixup = ''
···
   libressl_3_2 = generic {
     version = "3.2.5";
     sha256 = "1zkwrs3b19s1ybz4q9hrb7pqsbsi8vxcs44qanfy11fkc7ynb2kr";
+    patches = [
+      ./CVE-2021-41581.patch
+    ];
+  };
+  libressl_3_4 = generic {
+    version = "3.4.0";
+    sha256 = "1lhn76nd59p1dfd27b4636zj6wh3f5xsi8b3sxqnl820imsswbp5";
+    patches = [
+      ./CVE-2021-41581.patch
+    ];
   };
 }

pkgs/development/libraries/netcdf/default.nix

···
 }:
 
 let
-  mpiSupport = hdf5.mpiSupport;
-  mpi = hdf5.mpi;
+  inherit (hdf5) mpiSupport mpi;
 in stdenv.mkDerivation rec {
   pname = "netcdf";
   version = "4.8.0"; # Remove patch mentioned below on upgrade
···
   buildInputs = [ hdf5 curl mpi ];
 
   passthru = {
-    mpiSupport = mpiSupport;
-    inherit mpi;
+    inherit mpiSupport mpi;
   };
 
   configureFlags = [

pkgs/development/libraries/plplot/default.nix

···
-{ lib, stdenv, fetchurl, cmake }:
+{ lib
+, stdenv
+, fetchurl
+, cmake
+, enableWX ? false
+, wxGTK31, wxmac
+, enableXWin ? false
+, libX11
+}:
 
-stdenv.mkDerivation rec {
+let
+  wxWidgets = (if stdenv.isDarwin then wxmac else wxGTK31);
+in stdenv.mkDerivation rec {
   pname   = "plplot";
   version = "5.15.0";
 
···
   };
 
   nativeBuildInputs = [ cmake ];
+
+  buildInputs = lib.optional enableWX wxWidgets
+    ++ lib.optional enableXWin libX11;
+
+  passthru = {
+    inherit
+      enableWX
+      wxWidgets
+      enableXWin
+      libX11
+    ;
+  };
 
   cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=OFF" "-DBUILD_TEST=ON" ];
 

pkgs/development/libraries/qcoro/default.nix

···
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, libpthreadstubs
+, qtbase
+}:
+
+mkDerivation rec {
+  pname = "qcoro";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "danvratil";
+    repo = "qcoro";
+    rev = "v${version}";
+    sha256 = "09543hpy590dndmlxmcm8c58m97blhaii4wbjr655qxdanhhxgzi";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    qtbase
+    libpthreadstubs
+  ];
+
+  meta = with lib; {
+    description = "Library for using C++20 coroutines in connection with certain asynchronous Qt actions";
+    homepage = "https://github.com/danvratil/qcoro";
+    license = licenses.mit;
+    maintainers = with maintainers; [ smitop ];
+    platforms = platforms.linux;
+  };
+}

pkgs/development/libraries/randomx/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "randomX";
-  version = "1.1.8";
+  version = "1.1.9";
 
   nativeBuildInputs = [ cmake ];
 
···
     owner = "tevador";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13h2cw8drq7xn3v8fbpxrlsl8zq3fs8gd2pc1pv28ahr9qqjz1gc";
+    sha256 = "188fh4l8wda1y9vxa9asbk8nw35gyapw7gyn4w2p2qspdjhi5mnq";
   };
 
   meta = with lib; {

pkgs/development/ocaml-modules/ocaml-freestanding/default.nix

···
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-${pname}-${version}";
   inherit pname;
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "mirage";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0w3x2wfd04qr6mci4cp1gfqw33yysp8gamgkpgbgwslr0skryiq5";
+    sha256 = "sha256:1mbyjzwcs64n7i3xkkyaxgl3r46drbl0gkqf3fqgm2kh3q03638l";
   };
 
   postUnpack = ''
···
     runHook preConfigure
     env PKG_CONFIG_DEPS=solo5-bindings-${target} sh configure.sh
     runHook postConfigure
-  '';
-
-  preBuild = ''
-    # perform substitutions, so opam isn't needed
-    for flags in flags/cflags.tmp flags/libs.tmp; do
-      substitute "$flags.in" "$flags" \
-        --replace "%{prefix}%" "$out" \
-        --replace "%{ocaml-freestanding:lib}%" "$out/lib"
-    done
   '';
 
   installPhase = ''

pkgs/development/ocaml-modules/ocaml-freestanding/no-opam.patch

···
     nice bonus). The Makefile needs no fix since the target ocaml/Makefile
     won't be built if it's already present.
 
-diff --git a/Makefile b/Makefile
-index b07b8c6..a68b31d 100644
---- a/Makefile
-+++ b/Makefile
-@@ -2,6 +2,12 @@
- 
- include Makeconf
- 
-+ifneq ($(shell command -v opam),)
-+	# only set if opam is available and PKG_CONFIG_PATH isn't
-+	# already set in the environment or on the command line
-+	PKG_CONFIG_PATH ?= $(shell opam config var prefix)/lib/pkgconfig
-+endif
-+
- FREESTANDING_LIBS=openlibm/libopenlibm.a \
- 		  ocaml/runtime/libasmrun.a \
- 		  nolibc/libnolibc.a
-@@ -73,8 +79,7 @@ flags/libs.tmp: flags/libs.tmp.in
- 	opam config subst $@
- 
- flags/libs: flags/libs.tmp Makeconf
--	env PKG_CONFIG_PATH="$(shell opam config var prefix)/lib/pkgconfig" \
--	    pkg-config $(PKG_CONFIG_DEPS) --libs >> $<
-+	pkg-config $(PKG_CONFIG_DEPS) --libs >> $<
- 	awk -v RS= -- '{ \
- 	    sub("@@PKG_CONFIG_EXTRA_LIBS@@", "$(PKG_CONFIG_EXTRA_LIBS)", $$0); \
- 	    print "(", $$0, ")" \
-@@ -84,8 +89,7 @@ flags/cflags.tmp: flags/cflags.tmp.in
- 	opam config subst $@
- 
- flags/cflags: flags/cflags.tmp Makeconf
--	env PKG_CONFIG_PATH="$(shell opam config var prefix)/lib/pkgconfig" \
--	    pkg-config $(PKG_CONFIG_DEPS) --cflags >> $<
-+	pkg-config $(PKG_CONFIG_DEPS) --cflags >> $<
- 	awk -v RS= -- '{ \
- 	    print "(", $$0, ")" \
- 	    }' $< >$@
 diff --git a/configure.sh b/configure.sh
 index 4d154ed..c254f7b 100755
 --- a/configure.sh

pkgs/development/python-modules/asyncssh/default.nix

···
     "tests/sspi_stub.py"
   ];
 
+  disabledTests = [
+    # No PIN set
+    "TestSKAuthCTAP2"
+  ];
+
   pythonImportsCheck = [ "asyncssh" ];
 
   meta = with lib; {

pkgs/development/python-modules/bond-api/default.nix

···
 
 buildPythonPackage rec {
   pname = "bond-api";
-  version = "0.1.13";
+  version = "0.1.14";
 
   src = fetchFromGitHub {
     owner = "prystupa";
     repo = "bond-api";
     rev = "v${version}";
-    sha256 = "0v3bwbpn98fjm8gza2k7fb7w5ps3982kfvbck5x0fh2xq2825b80";
+    sha256 = "0s7an6kbib1immrbwrh4pzj812zwf8kj3kgky5k3qwxzrj0iv6ak";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/browser-cookie3/default.nix

···
-{ lib, fetchPypi, buildPythonPackage, isPy3k, lz4, keyring, pbkdf2, pycryptodome, pyaes}:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, isPy3k
+, lz4
+, keyring
+, pbkdf2
+, pycryptodome
+, pyaes
+}:
 
 buildPythonPackage rec {
   pname = "browser-cookie3";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "72c1e6aa6a98adab3a6797b889664bdbfddc287474dd8e774da37a854ec32185";
+    sha256 = "9f8e5ddf5a6641a1fdca12d82b0923777ba59a988b68c9bcf358bfb7c42ef25b";
   };
 
   disabled = !isPy3k;
 
-  propagatedBuildInputs = [ lz4 keyring pbkdf2 pyaes pycryptodome ];
+  propagatedBuildInputs = [
+    lz4
+    keyring
+    pbkdf2
+    pyaes
+    pycryptodome
+  ];
 
   # No tests implemented
   doCheck = false;
 
+  pythonImportsCheck = [
+    "browser_cookie3"
+  ];
+
   meta = with lib; {
     description = "Loads cookies from your browser into a cookiejar object";
+    homepage = "https://github.com/borisbabic/browser_cookie3";
+    license = licenses.gpl3Only;
     maintainers = with maintainers; [ borisbabic ];
-    homepage = "https://github.com/borisbabic/browser_cookie3";
-    license = licenses.gpl3;
   };
 }

pkgs/development/python-modules/frozenlist/default.nix

···
 
 buildPythonPackage rec {
   pname = "frozenlist";
-  version = "1.1.1";
+  version = "1.2.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "07z33vid7s8fjwvybyn8357yvs0f6nlhizv1l3qj1bczi3jbdkbh";
+    sha256 = "sha256-rTbekdceC5QK0aiySi/4QUwaEoDfTlLrx2t6Kb9bH7U=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/libusb1/default.nix

···
 
 buildPythonPackage rec {
   pname = "libusb1";
-  version = "1.9.3";
+  version = "2.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "60e6ce37be064f6e51d02b25da44230ecc9c0b1fdb6f14568c71457d963c1749";
+    sha256 = "d3ba82ecf7ab6a48d21dac6697e26504670cc3522b8e5941bd28fb56cf3f6c46";
   };
 
   postPatch = ''
-    substituteInPlace usb1/libusb1.py --replace \
+    substituteInPlace usb1/_libusb1.py --replace \
       "ctypes.util.find_library(base_name)" \
       "'${libusb1}/lib/libusb-1.0${stdenv.hostPlatform.extensions.sharedLibrary}'"
   '';

pkgs/development/python-modules/mypy-boto3-s3/default.nix

···
 
 buildPythonPackage rec {
   pname = "mypy-boto3-s3";
-  version = "1.18.62";
+  version = "1.18.63";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a12c44b1a1a9653d6f9148f174a9b7b71785481374ef43d962bd580967b6bca8";
+    sha256 = "cf676b3d36677382429a3ed29e17edfdd342c1879db37868723b2a0761640d62";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pulsectl/default.nix

···
 
 buildPythonPackage rec {
   pname = "pulsectl";
-  version = "21.10.4";
+  version = "21.10.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c9593a54d01dc1ab47ef20464aa7d00433690c86ae840c58f458fe6dedd6b41a";
+    sha256 = "b347983fb78baab168f4dc4804ab2c59ca5b813bf62f8146dfb5fcb6ab6c8ba2";
   };
 
   patches = [

pkgs/development/python-modules/pyintesishome/default.nix

···
 
 buildPythonPackage rec {
   pname = "pyintesishome";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "jnimmo";
     repo = "pyIntesisHome";
     rev = version;
-    sha256 = "1y1agdr32p7m4dbb6kzchh0vb49gy0rqp8hq9zadwrq2vp70k5sn";
+    sha256 = "sha256-+bad3VIoP0sVw0blK9YIot2GfK5de4HTXv5/ipV2Nds=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/database/sqlfluff/default.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "0.6.8";
+  version = "0.7.0";
   disabled = python3.pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-Aistr85doKEOD0/uTS/7iRzYggb+hC3njVi4mWt8ndM=";
+    sha256 = "sha256-Cqbo1L3z3bTDIXZ90GXdAulTpGhWLoTc/kYRNghZ/SE=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
···
   ];
 
   disabledTestPaths = [
-    # dbt is not available yet
-    "test/core/templaters/dbt_test.py"
     # Don't run the plugin related tests
     "test/core/plugin_test.py"
+    "plugins/sqlfluff-templater-dbt"
     "plugins/sqlfluff-plugin-example/test/rules/rule_test_cases_test.py"
   ];
 

pkgs/misc/vim-plugins/generated.nix

···
     meta.homepage = "https://github.com/rbgrouleff/bclose.vim/";
   };
 
+  better-escape-nvim = buildVimPluginFrom2Nix {
+    pname = "better-escape.nvim";
+    version = "2021-10-09";
+    src = fetchFromGitHub {
+      owner = "max397574";
+      repo = "better-escape.nvim";
+      rev = "a644df43e4607df2e645cb7b6f50ede79fffe477";
+      sha256 = "1kjc1h35xfqgsqbg00hsvg52wkjskfilxxsxnnlimcsv9v8iadmh";
+    };
+    meta.homepage = "https://github.com/max397574/better-escape.nvim/";
+  };
+
   BetterLua-vim = buildVimPluginFrom2Nix {
     pname = "BetterLua.vim";
     version = "2020-08-14";
···
 
   chadtree = buildVimPluginFrom2Nix {
     pname = "chadtree";
-    version = "2021-10-16";
+    version = "2021-10-17";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "949731d96f14872bb6764f305f38415d70c220a3";
-      sha256 = "1lq4c47i55gza7mdn1nzsfxq78vkl5hhsrfv2dk97sbmbyfmr83j";
+      rev = "63259154cae7c01a877cd493c7ff53d8bbaf36a8";
+      sha256 = "0072yqwcs23j1q5akybc9q933lg3davrbh10rjqs690b8p69rz0p";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
···
 
   cmp-nvim-lsp = buildVimPluginFrom2Nix {
     pname = "cmp-nvim-lsp";
-    version = "2021-09-30";
+    version = "2021-10-17";
     src = fetchFromGitHub {
       owner = "hrsh7th";
       repo = "cmp-nvim-lsp";
-      rev = "f93a6cf9761b096ff2c28a4f0defe941a6ffffb5";
-      sha256 = "02x4jp79lll4fm34x7rjkimlx32gfp2jd1kl6zjwszbfg8wziwmx";
+      rev = "accbe6d97548d8d3471c04d512d36fa61d0e4be8";
+      sha256 = "1dqx6yrd60x9ncjnpja87wv5zgnij7qmzbyh5xfyslk67c0i6mwm";
     };
     meta.homepage = "https://github.com/hrsh7th/cmp-nvim-lsp/";
   };
···
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/wincent/command-t/";
+  };
+
+  comment-nvim = buildVimPluginFrom2Nix {
+    pname = "comment.nvim";
+    version = "2021-10-17";
+    src = fetchFromGitHub {
+      owner = "numtostr";
+      repo = "comment.nvim";
+      rev = "a86384dc153e86a9a3cbec1436a8acfa4b07690d";
+      sha256 = "043nczs67sa7i2nmmadhrd52d3yzjr1kcm3bgb4q5zig1a7r4dcj";
+    };
+    meta.homepage = "https://github.com/numtostr/comment.nvim/";
   };
 
   committia-vim = buildVimPluginFrom2Nix {
···
 
   lir-nvim = buildVimPluginFrom2Nix {
     pname = "lir.nvim";
-    version = "2021-09-20";
+    version = "2021-10-17";
     src = fetchFromGitHub {
       owner = "tamago324";
       repo = "lir.nvim";
-      rev = "bc14ddcb173d332e62ce3712eb0ca3ac6d9fa59a";
-      sha256 = "1sh13m98dni9dspjiwsaafzvg3nlwd41v5ma5achpzla80hzm2h1";
+      rev = "5a7b21b0fdafe73719902b9848880fb3eb8500aa";
+      sha256 = "0pdswmrmc2nicii5szhig4qnmcx2cks6rc5g7s787cc0c458l98p";
     };
     meta.homepage = "https://github.com/tamago324/lir.nvim/";
   };
···
 
   nvim-autopairs = buildVimPluginFrom2Nix {
     pname = "nvim-autopairs";
-    version = "2021-10-15";
+    version = "2021-10-17";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "2cab63437f05551d79ee959eb88fee1ba437a5a7";
-      sha256 = "14zrgri491jshg57wcw8nf5nzviw1b6a88qkx0km1v15knihbc68";
+      rev = "7becc6bc9d8baa62eb0dbf65305f8e7f1470ace7";
+      sha256 = "1ihz1kci00r93f52fzz5nx9byh7rrax1sknmj9q232z1wv7dxb06";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
   };
···
 
   nvim-hlslens = buildVimPluginFrom2Nix {
     pname = "nvim-hlslens";
-    version = "2021-10-09";
+    version = "2021-10-17";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-hlslens";
-      rev = "0bbfcaf40b8c3fee758eda51e728a5b7aff08412";
-      sha256 = "07n8i6ggk4qnhr3zda2qpfvqfnilnnkymak1dw6f0wcjbfqdk8h6";
+      rev = "5217443bb675539d87b90133a91a7e36ad1e517d";
+      sha256 = "17p3x7s50r5fj1fhzx7nm7hk81h85hihk6svsgp99a1cjys6w9zk";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-hlslens/";
   };
···
 
   nvim-lightbulb = buildVimPluginFrom2Nix {
     pname = "nvim-lightbulb";
-    version = "2021-10-16";
+    version = "2021-10-17";
     src = fetchFromGitHub {
       owner = "kosayoda";
       repo = "nvim-lightbulb";
-      rev = "9838d3a0f9268d89c9f238c67928d3b6a0ceaaf5";
-      sha256 = "157x2i6paqz626bvbjly5k1yg2939v6j8riicrw8gxbb3s5z5fh5";
+      rev = "66223954d7bd7d4358c36d157c25503168d04319";
+      sha256 = "0jghq2fkvibilb1zglkckhpmq6dgi1q87fcwpvcv9slk1qlgw19d";
     };
     meta.homepage = "https://github.com/kosayoda/nvim-lightbulb/";
   };
···
 
   nvim-lspconfig = buildVimPluginFrom2Nix {
     pname = "nvim-lspconfig";
-    version = "2021-10-16";
+    version = "2021-10-17";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "28a8e5258cb8140cc50a030b9b3c15e39376028a";
-      sha256 = "02n5kacdb6my8mn0iayr5l1rm6nx4pqc6fx6a7l5minww9vh8na2";
+      rev = "9661d267f64a872a451dab0453b2b951e55cef27";
+      sha256 = "0hv77ridsxi5n2qibrp9a66kbmlw1c9yl8gpakr1iz2hhazq58x9";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
···
     src = fetchFromGitHub {
       owner = "simrat39";
       repo = "rust-tools.nvim";
-      rev = "e3b0ace51db01e6fbecae489645b911a8f4b3441";
-      sha256 = "0syshs383j1fhj381fy9d9chrqa11fk333c2kzak08j5l471z486";
+      rev = "441e0104648e1bae89e3eac6857590a64f17583d";
+      sha256 = "13g6vlg3r49vmzl0q6z2mqwz2p2chcjc74bfgn89c284bjri8x94";
     };
     meta.homepage = "https://github.com/simrat39/rust-tools.nvim/";
   };
···
 
   tagalong-vim = buildVimPluginFrom2Nix {
     pname = "tagalong.vim";
-    version = "2021-10-15";
+    version = "2021-10-17";
     src = fetchFromGitHub {
       owner = "AndrewRadev";
       repo = "tagalong.vim";
-      rev = "9d37eeb2463bfa1150a9353d3bf9a4f6d7395ab9";
-      sha256 = "0i2vnd0rhp5ix0p78np0vk45pnpidi1y7z6b5z8pwh442ma8f86f";
+      rev = "18c010e0f28fea012f537bc1abd468a063c36b9c";
+      sha256 = "0qq1saqkk0cd09zppz469idzvl5d0aagq5gw908whz5dd72yl8al";
     };
     meta.homepage = "https://github.com/AndrewRadev/tagalong.vim/";
   };
···
     meta.homepage = "https://github.com/tomtom/tcomment_vim/";
   };
 
+  telescope-cheat-nvim = buildVimPluginFrom2Nix {
+    pname = "telescope-cheat.nvim";
+    version = "2021-09-24";
+    src = fetchFromGitHub {
+      owner = "nvim-telescope";
+      repo = "telescope-cheat.nvim";
+      rev = "4a58b92fc70af622ddc115f843b0e552ca5bd6ea";
+      sha256 = "132drgpak97sbwjma6h7zwflg386xhqmdb3rqvzgxav36p9f0xsw";
+    };
+    meta.homepage = "https://github.com/nvim-telescope/telescope-cheat.nvim/";
+  };
+
   telescope-coc-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-coc.nvim";
     version = "2021-10-13";
···
     src = fetchFromGitHub {
       owner = "rbong";
       repo = "vim-flog";
-      rev = "1cb504538bf1e46b16d239cfc7fa22229dd1301b";
-      sha256 = "1z5dggdjfc7fi7q58rfbh5whw7qw6jzfxbf87mlnyr9vij72v53q";
+      rev = "d8e62cea4c57c9284a0d6bc92140deb1a7034a1d";
+      sha256 = "0a5yh0w143lvg934pwsln2n34zh7x2d6bxfp9cmw897nl6qlzrdj";
     };
     meta.homepage = "https://github.com/rbong/vim-flog/";
   };
···
 
   vim-fugitive = buildVimPluginFrom2Nix {
     pname = "vim-fugitive";
-    version = "2021-10-16";
+    version = "2021-10-17";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fugitive";
-      rev = "0615cd2baf15ed0aebacd3546015a89d491553ef";
-      sha256 = "0j6hl5561jhhcbxwiwc1030ip4bzqypqnj1ycxhg3vl630d18kla";
+      rev = "93f41ace7dc068cf89314bcea23bdf8da686407a";
+      sha256 = "0hbif3hndmn7jll4w1kci6x3j7379wmpp9rnxg8rlbbnyxl2fpxj";
     };
     meta.homepage = "https://github.com/tpope/vim-fugitive/";
   };
···
 
   vim-snippets = buildVimPluginFrom2Nix {
     pname = "vim-snippets";
-    version = "2021-10-07";
+    version = "2021-10-17";
     src = fetchFromGitHub {
       owner = "honza";
       repo = "vim-snippets";
-      rev = "be519f70ab806c290a7b3d2e38fc22da07834052";
-      sha256 = "0d22x0az6ca232x04mvkk9jphn3qfcz24a9wwvz0jdyy3pk8zfbi";
+      rev = "c28bef69fdb26825a93ac1e90ca6f5ba19116d88";
+      sha256 = "1fg60jfm5bw1m20133vl06nb8z9ckrwqq37jz493xi34j5fymi4w";
     };
     meta.homepage = "https://github.com/honza/vim-snippets/";
   };

pkgs/misc/vim-plugins/overrides.nix

···
       };
     });
 
+  telescope-cheat-nvim = super.telescope-cheat-nvim.overrideAttrs (old: {
+    dependencies = with self; [ sqlite-lua telescope-nvim ];
+  });
+
   telescope-frecency-nvim = super.telescope-frecency-nvim.overrideAttrs (old: {
     dependencies = with self; [ sqlite-lua telescope-nvim ];
   });

pkgs/misc/vim-plugins/vim-plugin-names

···
 mattn/vim-gist
 mattn/webapi-vim
 matze/vim-move
+max397574/better-escape.nvim
 maximbaz/lightline-ale
 MaxMEllon/vim-jsx-pretty
 mbbill/undotree
···
 norcalli/snippets.nvim
 ntpeters/vim-better-whitespace
 numirias/semshi
+numtostr/comment.nvim
 nvie/vim-flake8
 nvim-lua/completion-nvim
 nvim-lua/diagnostic-nvim
···
 nvim-lua/plenary.nvim
 nvim-lua/popup.nvim
 nvim-neorg/neorg@main
+nvim-telescope/telescope-cheat.nvim
 nvim-telescope/telescope-dap.nvim
 nvim-telescope/telescope-frecency.nvim
 nvim-telescope/telescope-fzf-native.nvim@main

pkgs/os-specific/linux/zfs/default.nix

···
         "INSTALL_MOD_PATH=\${out}"
       ];
 
+      postBuild = optionalString buildKernel ''
+         find . -name "*.ko" -print0 | xargs -0 -P$NIX_BUILD_CORES strip --strip-debug
+      '';
+
       postInstall = optionalString buildKernel ''
         # Add reference that cannot be detected due to compressed kernel module
         mkdir -p "$out/nix-support"

pkgs/servers/dns/pdns-recursor/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "pdns-recursor";
-  version = "4.5.4";
+  version = "4.5.6";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "0sl98ykk2bh0v2aw2hyak7wk9k3pbhvmfkb3i4a72jlsixm60p81";
+    sha256 = "004jwyg64ww6sfwlfpyfvh6vymildygwkjhkin2fsrq4h79wv2dv";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/tools/admin/pulumi/data.nix

···
         sha256 = "02s759rm633h4v5a1s3jxwvkahfjrbkz561spijrp3mihrws3xhb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.0-linux-amd64.tar.gz";
-        sha256 = "0ainrb9i14wcq64pg99kb0s41bpmczp1h4sz85kj1a4ic0yrfq14";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.1-linux-amd64.tar.gz";
+        sha256 = "0k67bsqiqalqrifd6r7nm6c2g4ckrfhh7a7nfgfmpvqs7cxx1kfm";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.5.0-linux-amd64.tar.gz";
···
         sha256 = "1lmy0dmpspzflc9z8p4w1cz47lbqnbkq8dng3v40lpbs75pnprvs";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.21.0-linux-amd64.tar.gz";
-        sha256 = "1w7ppcqkhh9k9iw10f4d93glmphyvachrkj6p8b6i93n0k78rxv7";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.22.0-linux-amd64.tar.gz";
+        sha256 = "0jl4ic18kf0qcys5mhp6ar4p1bj6ndhi11b51dvzdj5lb39dv43q";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.4.0-linux-amd64.tar.gz";
···
         sha256 = "1h5159y7xlslnijs8lpi4vqgvj2px6whxk9m17p9n7wiyqbmd5na";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.23.0-linux-amd64.tar.gz";
-        sha256 = "0kxwx1lk54kdfw49s719g4vwr2iv6fzr82cxi5siykzpf9gfk7bd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.24.1-linux-amd64.tar.gz";
+        sha256 = "0rmzb3wn5hmx8z8ly85spizinp6ja861k05fhw7l63zhqr8pnls2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.2.0-linux-amd64.tar.gz";
-        sha256 = "02g59jaifyjfcx185ir79d8lqic38dgaa9cb8dpi3xhvv32z0b0q";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-linux-amd64.tar.gz";
+        sha256 = "1ixmsxawp0qbyjs37c74gcvj2icpbda6znl17yp9bhiyvnrdvxn7";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.3.0-linux-amd64.tar.gz";
···
         sha256 = "0bp7ki3slszmy1vh4a5d4y4fhbvafrazj1cjf081xv91gi99xxz6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.22.0-linux-amd64.tar.gz";
-        sha256 = "0ga794vwdggscl9lf57dg7cii91j4px0wyha4r43rhn0gbp1zk8y";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.24.0-linux-amd64.tar.gz";
+        sha256 = "1dznd4c8kpy6mwwb170nfl1m2dmrp6f4jalmk3bdfqscm4xhvk3q";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.0.0-linux-amd64.tar.gz";
···
         sha256 = "1lisk9wr5p866x2hxvlz7nhz0xybhag7wgqk23x0lariln9z5na6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.0-darwin-amd64.tar.gz";
-        sha256 = "0n5kgmcy4hsg4s4q7jd34z9hz6vcqs64j680jzsxw902cgrj5y9p";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.1-darwin-amd64.tar.gz";
+        sha256 = "103syjj8vla8lygyl5h7ilwm9kl6vxzyn6fdrkz0xcvlhqm1xr30";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.5.0-darwin-amd64.tar.gz";
···
         sha256 = "1j7z5dbqzsdq1q8ks9g5pwzyc3ml6avhhp6xj94dzdhskl6pd8w5";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.21.0-darwin-amd64.tar.gz";
-        sha256 = "0sjh5wws6k90w2y5f5bm22c4qxamr658mww3zx11qakdygraijly";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.22.0-darwin-amd64.tar.gz";
+        sha256 = "15c5rh0ix7zxn128kangd5x2x1n61xv9d443a7cbriibwvdkvv0j";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.4.0-darwin-amd64.tar.gz";
···
         sha256 = "0r2ykjwam5m2mfiibhq993s8n5pzmks837cwb57jwgwx8lc3ra4x";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.23.0-darwin-amd64.tar.gz";
-        sha256 = "0vpkwlihq6pj554qd3csgf25id2q0pjx4mwkpfj74y08lv6d3v83";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.24.1-darwin-amd64.tar.gz";
+        sha256 = "06lfimnlns1bfvks0kv5rjcnz6dvdk38npigyigsk9vqs0idcfi3";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.2.0-darwin-amd64.tar.gz";
-        sha256 = "0gd3xnl31892qp8ilz9lc1zdps77nf07jgvh0k37mink8f0ppy2z";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-darwin-amd64.tar.gz";
+        sha256 = "1dy4n03xvirg6fihiid786d88qlkyqkvk4fq6ggnxc92620x7342";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.3.0-darwin-amd64.tar.gz";
···
         sha256 = "1i73sxh6vf6adg6as1q1mab3fcjm7ma7gixj2b0y0d2a5d78lhpa";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.22.0-darwin-amd64.tar.gz";
-        sha256 = "19w0m6rxf0i996s9hdjym4f1k0jwf8hrlsr0m9x23xzz5r2simar";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.24.0-darwin-amd64.tar.gz";
+        sha256 = "1jxrz82cadmqkd1d26bj5r3bphvzz5z20shjai351hlh9aa3bv2h";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.0.0-darwin-amd64.tar.gz";
···
         sha256 = "041lmx5d1c8ls48mv56jchvk714rqw7jywywdgm6d6ipq7h5d67k";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.0-linux-arm64.tar.gz";
-        sha256 = "06hq79r35bcm7yn8qdvdiy19wsqq3ihbrmjakw2vf6xdglrxxxwr";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.1-linux-arm64.tar.gz";
+        sha256 = "0rijbqaw584b5c0kihrs80cv46s06yv3a68yz1dwa8sl7adi7n9p";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.5.0-linux-arm64.tar.gz";
···
         sha256 = "0mddv37k87wiygh6x9bnxpcr721qbmbqf6l5zk3xl61n56j8qyb1";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.21.0-linux-arm64.tar.gz";
-        sha256 = "1zlkij96vr3vf071gwdqcwfxlkfvcnkj4q220l3gxzliix0zvfi4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.22.0-linux-arm64.tar.gz";
+        sha256 = "19aiksm4d4jxs9gw7rdr77ag58fy1v7gkk6r730imgq0d8vsacm1";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.4.0-linux-arm64.tar.gz";
···
         sha256 = "1sc8rf930cz6nkyhqn6p0h7450iqzdsrlw2smhp8yyjjvcjmsksf";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.23.0-linux-arm64.tar.gz";
-        sha256 = "0j8dgbfdscp29zj0vd3ial1g87n72jj07afj5lxzgsh8jay1iz2r";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.24.1-linux-arm64.tar.gz";
+        sha256 = "1bvzazdis423vb1r30q15q1irh07kgymv5ikzmvrygf4hm3aph06";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.2.0-linux-arm64.tar.gz";
-        sha256 = "0y7wysd4j1dp73hrbydzj2bfvpgv8vxiza5m6dbg7nl66w9ng0rc";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-linux-arm64.tar.gz";
+        sha256 = "12iv8vjnal2ym70rxmdnvi02x6md7fxi8jbzhzfw526pzqs1dc47";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.3.0-linux-arm64.tar.gz";
···
         sha256 = "0mwpbvv62k8fg07447wwfigs4li4n78fswpzwi4alsjrkqlmw9dj";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.22.0-linux-arm64.tar.gz";
-        sha256 = "0kp13hk57apvqmsn1zw1k7r395wdk1308m0kwx4hmcjy6dzifjsq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.24.0-linux-arm64.tar.gz";
+        sha256 = "1b8fi56wkk753w6ip1nkrksyk8qd5ypdbaq668pk60l3jb0c9mad";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.0.0-linux-arm64.tar.gz";
···
         sha256 = "06qc42gb2w2qjy2mz5shh082607395jq0js34wlqq61jgjzpca5l";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.0-darwin-arm64.tar.gz";
-        sha256 = "0nwqrg5in05vvj7ln7gi50vp3bnhkwar8fifpi87b134hl50q935";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.8.1-darwin-arm64.tar.gz";
+        sha256 = "1wqkm32lkwff5gwn7dbznzx5rcbcysj2mx4ip77whba59ikfchsj";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.5.0-darwin-arm64.tar.gz";
···
         sha256 = "0fj1ai1kv8xgmsvfbmy5gsinxag70rx9a9gkifqgcpn3r9mj48ks";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.21.0-darwin-arm64.tar.gz";
-        sha256 = "0nj8gin7ys63v235x8nywmx0vv2bdcqdmmp7z3lxlxp2hk4nm84g";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.22.0-darwin-arm64.tar.gz";
+        sha256 = "09v28dgrs5a4w8qn4v4zwrn7n7cn2475a2jh9qz3g2ljaj0086fd";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.4.0-darwin-arm64.tar.gz";
···
         sha256 = "1c3pchbnk6dsnxsl02ypq7s4mmkxdgxszdhql1klpx5js7i1lv8k";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.23.0-darwin-arm64.tar.gz";
-        sha256 = "08gcvlfy7kmcx02nf3n4chf6g5lasr2g8gr20gndk0rvihqiwhjz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.24.1-darwin-arm64.tar.gz";
+        sha256 = "0fafl5zpnzkncvi52qw6f4898yia8p0whvr41m3g8cxcp6nyr0ij";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.2.0-darwin-arm64.tar.gz";
-        sha256 = "0waf4apw5bzn276s34yaxvm3xyk5333l3zcz2j52c56wkadzxvpg";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-darwin-arm64.tar.gz";
+        sha256 = "0jrihnwfh5wvc95nipqv7ak77kq9xj0pk5hlapv9w2ls5pwykv0r";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.3.0-darwin-arm64.tar.gz";
···
         sha256 = "1hzhlxbwji4p8apx4rnqllsgf1k11w49rplz0syzmzb2fxpkif75";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.22.0-darwin-arm64.tar.gz";
-        sha256 = "038nk93mq59d8ynp1ggmhvmgnilrgqzcbg4hapb9pk7hpbwb269c";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.24.0-darwin-arm64.tar.gz";
+        sha256 = "0nh8305b6qlqr63xaacxs3v804dhrwdz179xlzdgzf9550zdqb39";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.0.0-darwin-arm64.tar.gz";

pkgs/tools/filesystems/catcli/default.nix

···
 buildPythonApplication rec {
 
   pname = "catcli";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "deadc0de6";
     repo = pname;
     rev = "v${version}";
-    sha256 = "03yf9sjqdg3xcbvkn1591zxd2d0r8wz1b749zrn55k3a03c7jzf5";
+    sha256 = "1mzhfcf67dc5m0i9b216m58qg36g63if6273ch5bsckd0yrwdk8x";
   };
 
   propagatedBuildInputs = [ docopt anytree ];

pkgs/tools/misc/flashrom/default.nix

···
-{ lib
-, stdenv
-, fetchurl
-, meson
-, ninja
-, pkg-config
+{ fetchurl
+, gcc9Stdenv
+, installShellFiles
+, lib
 , libftdi1
+, libjaylink
 , libusb1
 , pciutils
-, installShellFiles
+, pkg-config
+, jlinkSupport ? false
 }:
 
-stdenv.mkDerivation rec {
+gcc9Stdenv.mkDerivation rec {
   pname = "flashrom";
   version = "1.2";
 
···
     sha256 = "0ax4kqnh7kd3z120ypgp73qy1knz47l6qxsqzrfkd97mh5cdky71";
   };
 
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+  buildInputs = [ libftdi1 libusb1 ]
+    # https://github.com/flashrom/flashrom/issues/125
+    ++ lib.optional (!gcc9Stdenv.isAarch64) pciutils
+    ++ lib.optional jlinkSupport libjaylink;
+
   postPatch = ''
     substituteInPlace util/z60_flashrom.rules \
       --replace "plugdev" "flashrom"
   '';
 
-  # Meson build doesn't build and install manpage. Only Makefile can.
-  # Build manpage from source directory. Here we're inside the ./build subdirectory
+  makeFlags = [ "PREFIX=$(out)" "libinstall" ]
+    ++ lib.optional jlinkSupport "CONFIG_JLINK_SPI=yes";
+
   postInstall = ''
-    make flashrom.8 -C ..
-    installManPage ../flashrom.8
-    install -Dm644 ../util/z60_flashrom.rules $out/etc/udev/rules.d/flashrom.rules
+    install -Dm644 util/z60_flashrom.rules $out/lib/udev/rules.d/flashrom.rules
   '';
-
-  mesonFlags = lib.optionals stdenv.isAarch64 [ "-Dpciutils=false" ];
-  nativeBuildInputs = [ meson pkg-config ninja installShellFiles ];
-  buildInputs = [ libftdi1 libusb1 pciutils ];
 
   meta = with lib; {
-    homepage = "http://www.flashrom.org";
+    homepage = "https://www.flashrom.org";
     description = "Utility for reading, writing, erasing and verifying flash ROM chips";
     license = licenses.gpl2;
     maintainers = with maintainers; [ funfunctor fpletz felixsinger ];
     platforms = platforms.all;
-    broken = stdenv.isDarwin; # requires DirectHW
+    broken = gcc9Stdenv.isDarwin; # requires DirectHW
   };
 }

pkgs/tools/misc/hdf4/default.nix

···
 , uselibtirpc ? stdenv.isLinux
 , libtirpc
 , zlib
-, szip ? null
+, szipSupport ? false
+, szip
 , javaSupport ? false
 , jdk
 }:
···
 
   buildInputs = [
     libjpeg
-    szip
     zlib
   ]
   ++ lib.optional javaSupport jdk
+  ++ lib.optional szipSupport szip
   ++ lib.optional uselibtirpc libtirpc;
 
   preConfigure = lib.optionalString uselibtirpc ''
···
     substituteInPlace config/cmake/FindXDR.cmake \
       --replace 'find_path(XDR_INCLUDE_DIR NAMES rpc/types.h PATHS "/usr/include" "/usr/include/tirpc")' \
                 'find_path(XDR_INCLUDE_DIR NAMES rpc/types.h PATH_SUFFIXES include/tirpc)'
-  '' + lib.optionalString (szip != null) ''
+  '' + lib.optionalString szipSupport ''
     export SZIP_INSTALL=${szip}
   '';
 
···
     "-DJAVA_HOME=${jdk}"
     "-DJAVA_AWT_LIBRARY=${javabase}/libawt.so"
     "-DJAVA_JVM_LIBRARY=${javabase}/server/libjvm.so"
-  ] ++ lib.optionals (szip != null) [
+  ] ++ lib.optionals szipSupport [
     "-DHDF4_ENABLE_SZIP_ENCODING=ON"
     "-DHDF4_ENABLE_SZIP_SUPPORT=ON"
   ];
···
   postInstall = ''
     moveToOutput bin "$bin"
   '';
+
+  passthru = {
+    inherit
+      uselibtirpc
+      libtirpc
+      szipSupport
+      szip
+      javaSupport
+      jdk
+    ;
+  };
 
   meta = with lib; {
     description = "Data model, library, and file format for storing and managing data";

pkgs/tools/misc/hdf5/1.10.nix

···
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , removeReferencesTo
-, zlib ? null
+, zlibSupport ? true
+, zlib
 , enableShared ? !stdenv.hostPlatform.isStatic
 , javaSupport ? false
 , jdk
···
 
   nativeBuildInputs = [ removeReferencesTo ];
 
-  propagatedBuildInputs = optional (zlib != null) zlib;
+  propagatedBuildInputs = optional zlibSupport zlib;
 
-  configureFlags = []
-    ++ optional enableShared "--enable-shared"
+  configureFlags = optional enableShared "--enable-shared"
     ++ optional javaSupport "--enable-java";
 
   patches = [

pkgs/tools/misc/hdf5/default.nix

···
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , removeReferencesTo
-, cpp ? false
-, gfortran ? null
-, zlib ? null
-, szip ? null
+, cppSupport ? false
+, fortranSupport ? false
+, fortran
+, zlibSupport ? true
+, zlib
+, szipSupport ? false
+, szip
 , mpiSupport ? false
 , mpi
 , enableShared ? !stdenv.hostPlatform.isStatic
···
 
 # cpp and mpi options are mutually exclusive
 # (--enable-unsupported could be used to force the build)
-assert !cpp || !mpiSupport;
+assert !cppSupport || !mpiSupport;
 
 let inherit (lib) optional optionals; in
 
···
   };
 
   passthru = {
-    inherit mpiSupport;
-    inherit mpi;
+    inherit
+      cppSupport
+      fortranSupport
+      fortran
+      zlibSupport
+      zlib
+      szipSupport
+      szip
+      mpiSupport
+      mpi
+      ;
   };
 
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ removeReferencesTo ]
-    ++ optional (gfortran != null) gfortran;
+    ++ optional fortranSupport fortran;
 
-  buildInputs = []
-    ++ optional (szip != null) szip
+  buildInputs = optional fortranSupport fortran
+    ++ optional szipSupport szip
     ++ optional javaSupport jdk;
 
-  propagatedBuildInputs = []
-    ++ optional (zlib != null) zlib
+  propagatedBuildInputs = optional zlibSupport zlib
     ++ optional mpiSupport mpi;
 
-  configureFlags = []
-    ++ optional cpp "--enable-cxx"
-    ++ optional (gfortran != null) "--enable-fortran"
-    ++ optional (szip != null) "--with-szlib=${szip}"
-    ++ optionals mpiSupport ["--enable-parallel" "CC=${mpi}/bin/mpicc"]
+  configureFlags = optional cppSupport "--enable-cxx"
+    ++ optional fortranSupport "--enable-fortran"
+    ++ optional szipSupport "--with-szlib=${szip}"
+    ++ optionals mpiSupport [ "--enable-parallel" "CC=${mpi}/bin/mpicc" ]
     ++ optional enableShared "--enable-shared"
     ++ optional javaSupport "--enable-java"
     ++ optional usev110Api "--with-default-api-version=v110";

pkgs/tools/misc/rates/default.nix

···
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rates";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "lunush";
+    repo = pname;
+    rev = version;
+    sha256 = "077qxs4kwfprsai07dninkhmj3ihnghdxan98iv8gmsl3pijbgwh";
+  };
+
+  cargoSha256 = "041sskiq152iywwqd8p7aqsqzbj359zl7ilnp8ahzdqprz3slk1w";
+
+  meta = with lib; {
+    description = "CLI tool that brings currency exchange rates right into your terminal";
+    homepage = "https://github.com/lunush/rates";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/tools/networking/tnat64/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "tnat64";
-  version = "0.05";
+  version = "0.06";
 
   src = fetchFromGitHub {
     owner = "andrewshadura";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "07lmzidbrd3aahk2jvv93cic9gf36pwmgfd63gmy6hjkxf9a6fw9";
+    sha256 = "191j1fpr3bw6fk48npl99z7iq6m1g33f15xk5cay1gnk5f46i2j6";
   };
-
-  postPatch = ''
-    # Fix usage of deprecated sys_errlist
-    substituteInPlace tnat64.c --replace 'sys_errlist[errno]' 'strerror(errno)'
-  '';
 
   configureFlags = [ "--libdir=$(out)/lib" ];
   nativeBuildInputs = [ autoreconfHook ];

pkgs/tools/networking/unbound/default.nix

···
 , nettle
 , expat
 , libevent
+, libsodium
+, protobufc
+, hiredis
 , dns-root-data
 , pkg-config
 , makeWrapper
+, symlinkJoin
   #
   # By default unbound will not be built with systemd support. Unbound is a very
   # commmon dependency. The transitive dependency closure of systemd also
···
 , systemd ? null
   # optionally support DNS-over-HTTPS as a server
 , withDoH ? false
+, withECS ? false
+, withDNSCrypt ? false
+, withDNSTAP ? false
+, withTFO ? false
+, withRedis ? false
 , libnghttp2
 }:
 
···
     "--enable-systemd"
   ] ++ lib.optionals withDoH [
     "--with-libnghttp2=${libnghttp2.dev}"
+  ] ++ lib.optionals withECS [
+    "--enable-subnet"
+  ] ++ lib.optionals withDNSCrypt [
+    "--enable-dnscrypt"
+    "--with-libsodium=${symlinkJoin { name = "libsodium-full"; paths = [ libsodium.dev libsodium.out ]; }}"
+  ] ++ lib.optionals withDNSTAP [
+    "--enable-dnstap"
+    "--with-protobuf-c=${protobufc}"
+  ] ++ lib.optionals withTFO [
+    "--enable-tfo-client"
+    "--enable-tfo-server"
+  ] ++ lib.optionals withRedis [
+    "--enable-cachedb"
+    "--with-libhiredis=${hiredis}"
   ];
+
+  PROTOC_C = if withDNSTAP then "${protobufc}/bin/protoc-c" else null;
 
   # Remove references to compile-time dependencies that are included in the configure flags
   postConfigure = let

pkgs/tools/security/exploitdb/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2021-10-15";
+  version = "2021-10-16";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-7bQoBYPfePhanh7SCZ6MO/eWtyD8cfWaYjc9AWOT2rc=";
+    sha256 = "sha256-kzMMcipE9AKOWka2yAuljwNG/g+8fF2rYehTtxdQY+k=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/tools/security/ike-scan/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "ike-scan";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "royhills";
     repo = pname;
     rev = version;
-    sha256 = "01a39bk9ma2lm59q320m9g11909if5gc3qynd8pzn6slqiq5r8kw";
+    sha256 = "sha256-mbfg8p3y4aKoXpmLuF9GXAMPEqV5CsvetwGCRDJ9UNY=";
   };
 
   nativeBuildInputs = [
···
       # Memory leaks, https://github.com/royhills/ike-scan/pull/15
       url = "https://github.com/royhills/ike-scan/pull/15/commits/d864811de08dcddd65ac9b8d0f2acf5d7ddb9dea.patch";
       sha256 = "0wbrq89dl8js7cdivd0c45hckmflan33cpgc3qm5s3az6r4mjljm";
-    })
-    (fetchpatch {
-      # Unknown vendor IDs,  https://github.com/royhills/ike-scan/pull/18, was merged but not released
-      url = "https://github.com/royhills/ike-scan/pull/18/commits/e065ddbe471880275dc7975e7da235e7a2097c22.patch";
-      sha256 = "13ly01c96nnd5yh7rxrhv636csm264m5xf2a1inprrzxkkri5sls";
     })
   ];
 

pkgs/tools/system/auto-cpufreq/default.nix

···
 
 python3Packages.buildPythonPackage rec {
   pname = "auto-cpufreq";
-  version = "1.6.9";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "AdnanHodzic";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pri182cgbrhr0adq2784gpv6q8c8kjr0jsh8wpvd1wvfsbqywrm";
+    sha256 = "0b6j26glg1ffihdr2h7dlr1lrbhkclgp17dxmkjgg5gk4mhz799r";
   };
 
   propagatedBuildInputs = with python3Packages; [ click distro psutil ];

pkgs/tools/text/tidy-viewer/default.nix

···
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tidy-viewer";
+  version = "0.0.21";
+
+  src = fetchFromGitHub {
+    owner = "alexhallam";
+    repo = "tv";
+    rev = version;
+    sha256 = "1zjnc2b9y2f6x114svp31r1lzkak4xfn71qrxch30mq2aj4yzd2l";
+  };
+
+  cargoSha256 = "sha256-M6HInLevKvF4zBNe+Sg8fQK6koefRaO0l5AcrFhH+vI=";
+
+  # this test parses command line arguments
+  # error: Found argument '--test-threads' which wasn't expected, or isn't valid in this context
+  checkFlags = [
+    "--skip=build_reader_can_create_reader_without_file_specified"
+  ];
+
+  meta = with lib; {
+    description = "A cross-platform CLI csv pretty printer that uses column styling to maximize viewer enjoyment";
+    homepage = "https://github.com/alexhallam/tv";
+    changelog = "https://github.com/alexhallam/tv/blob/${version}/CHANGELOG.md";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}

pkgs/top-level/all-packages.nix

···
 
   pixz = callPackage ../tools/compression/pixz { };
 
-  plplot = callPackage ../development/libraries/plplot { };
+  plplot = callPackage ../development/libraries/plplot {
+    inherit (xorg) libX11;
+  };
 
   pxattr = callPackage ../tools/archivers/pxattr { };
 
···
 
   hddtemp = callPackage ../tools/misc/hddtemp { };
 
-  hdf4 = callPackage ../tools/misc/hdf4 {
-    szip = null;
-  };
+  hdf4 = callPackage ../tools/misc/hdf4 { };
 
   hdf5 = callPackage ../tools/misc/hdf5 {
-    gfortran = null;
-    szip = null;
+    fortranSupport = false;
+    fortran = gfortran;
   };
 
   hdf5_1_10 = callPackage ../tools/misc/hdf5/1.10.nix { };
 
   hdf5-mpi = appendToName "mpi" (hdf5.override {
-    szip = null;
     mpiSupport = true;
   });
 
   hdf5-cpp = appendToName "cpp" (hdf5.override {
-    cpp = true;
+    cppSupport = true;
   });
 
   hdf5-fortran = appendToName "fortran" (hdf5.override {
-    inherit gfortran;
+    fortranSupport = true;
   });
 
   hdf5-threadsafe = appendToName "threadsafe" (hdf5.overrideAttrs (oldAttrs: {
···
 
   thinkpad-scripts = python3.pkgs.callPackage ../tools/misc/thinkpad-scripts { };
 
+  tidy-viewer = callPackage ../tools/text/tidy-viewer { };
+
   tiled = libsForQt5.callPackage ../applications/editors/tiled { };
 
   tiledb = callPackage ../development/libraries/tiledb { };
···
   unbound-full = unbound.override {
     withSystemd = true;
     withDoH = true;
+    withECS = true;
+    withDNSCrypt = true;
+    withDNSTAP = true;
+    withTFO = true;
+    withRedis = true;
   };
 
   unicorn = callPackage ../development/libraries/unicorn { };
···
       /**/ if platform.isDarwin then (if platform.isAarch64 then 11 else 7)
       else if platform.isFreeBSD then 7
       else if platform.isAndroid then 12
-      else if platform.isLinux then (if platform.isRiscV then 11 else 7)
+      else if platform.isLinux then
+        /**/ if platform.isRiscV then 11
+        else if platform.isMusl then 11
+        else 7
       else if platform.isWasm then 8
       else latest_version;
     # We take the "max of the mins". Why? Since those are lower bounds of the
···
 
   inherit (beam.packages.erlangR21) lfe lfe_1_3;
 
+  gnudatalanguage = callPackage ../development/interpreters/gnudatalanguage {
+    inherit (llvmPackages) openmp;
+    # MPICH currently build on Darwin
+    mpi = mpich;
+  };
+
   groovy = callPackage ../development/interpreters/groovy { };
 
   inherit (callPackages ../applications/networking/cluster/hadoop {
···
   openvdb = callPackage ../development/libraries/openvdb {};
 
   inherit (callPackages ../development/libraries/libressl { })
-    libressl_3_2;
+    libressl_3_2
+    libressl_3_4;
 
   # Please keep this pointed to the latest version. See also
   # https://discourse.nixos.org/t/nixpkgs-policy-regarding-libraries-available-in-multiple-versions/7026/2
-  libressl = libressl_3_2;
+  libressl = libressl_3_4;
 
   boringssl = callPackage ../development/libraries/boringssl { };
 
···
 
   kmymoney = libsForQt5.callPackage ../applications/office/kmymoney { };
 
+  kn = callPackage ../applications/networking/cluster/kn { };
+
   kodestudio = callPackage ../applications/editors/kodestudio { };
 
   kondo = callPackage ../applications/misc/kondo { };
···
 
   qdl = callPackage ../tools/misc/qdl { };
 
+  rates = callPackage ../tools/misc/rates { };
+
   rargs = callPackage ../tools/misc/rargs { };
 
   rancher = callPackage ../applications/networking/cluster/rancher { };
···
 
   wasm-pack = callPackage ../development/tools/wasm-pack {
     inherit (darwin.apple_sdk.frameworks) Security;
+    libressl = libressl_3_2;
   };
 
   wavegain = callPackage ../applications/audio/wavegain { };

pkgs/top-level/qt5-packages.nix

···
 
   qca-qt5 = callPackage ../development/libraries/qca-qt5 { };
 
+  qcoro = callPackage ../development/libraries/qcoro { };
+
   qcsxcad = callPackage ../development/libraries/science/electronics/qcsxcad { };
 
   qmltermwidget = callPackage ../development/libraries/qmltermwidget {