Merge branch 'staging-next' into staging

Conflicts:
	nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
	nixos/doc/manual/release-notes/rl-2205.section.md
	pkgs/development/python-modules/aioesphomeapi/default.nix
	pkgs/development/python-modules/mat2/default.nix
	pkgs/development/python-modules/pydevccu/default.nix
	pkgs/development/python-modules/pywlroots/default.nix
	pkgs/development/python-modules/rokuecp/default.nix

doc/builders/fetchers.chapter.md

@@ -40,6 +40,24 @@ Used with Git. Expects `url` to a Git repo, `rev`, and `sha256`. `rev` in this c
 
 Additionally the following optional arguments can be given: `fetchSubmodules = true` makes `fetchgit` also fetch the submodules of a repository. If `deepClone` is set to true, the entire repository is cloned as opposing to just creating a shallow clone. `deepClone = true` also implies `leaveDotGit = true` which means that the `.git` directory of the clone won't be removed after checkout.
 
+If only parts of the repository are needed, `sparseCheckout` can be used. This will prevent git from fetching unnecessary blobs from server, see [git sparse-checkout](https://git-scm.com/docs/git-sparse-checkout) and [git clone --filter](https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---filterltfilter-specgt) for more infomation:
+
+```nix
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation {
+  name = "hello";
+  src = fetchgit {
+    url = "https://...";
+    sparseCheckout = ''
+      path/to/be/included
+      another/path
+    '';
+    sha256 = "0000000000000000000000000000000000000000000000000000";
+  };
+}
+```
+
 ## `fetchfossil` {#fetchfossil}
 
 Used with Fossil. Expects `url` to a Fossil archive, `rev`, and `sha256`.

doc/languages-frameworks/ocaml.section.md

@@ -32,9 +32,9 @@ Given that most of the OCaml ecosystem is now built with dune, nixpkgs includes
 
 Here is a simple package example.
 
-- It defines an (optional) attribute `minimalOCamlVersion` that will be used to
-  throw a descriptive evaluation error if building with an older OCaml is
-  attempted.
+- It defines an (optional) attribute `minimalOCamlVersion` (see note below)
+  that will be used to throw a descriptive evaluation error if building with
+  an older OCaml is attempted.
 
 - It uses the `fetchFromGitHub` fetcher to get its source.
 
@@ -117,3 +117,11 @@ buildDunePackage rec {
   };
 }
 ```
+
+Note about `minimalOCamlVersion`.  A deprecated version of this argument was
+spelled `minimumOCamlVersion`; setting the old attribute wrongly modifies the
+derivation hash and is therefore inappropriate. As a technical dept, currently
+packaged libraries may still use the old spelling: maintainers are invited to
+fix this when updating packages. Massive renaming is strongly discouraged as it
+would be challenging to review, difficult to test, and will cause unnecessary
+rebuild.

lib/default.nix

@@ -122,8 +122,9 @@ let
       mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
       mkAliasOptionModule mkDerivedConfig doRename;
     inherit (self.options) isOption mkEnableOption mkSinkUndeclaredOptions
-      mergeDefaultOption mergeOneOption mergeEqualOption getValues
-      getFiles optionAttrSetToDocList optionAttrSetToDocList'
+      mergeDefaultOption mergeOneOption mergeEqualOption mergeUniqueOption
+      getValues getFiles
+      optionAttrSetToDocList optionAttrSetToDocList'
       scrubOptionValue literalExpression literalExample literalDocBook
       showOption showFiles unknownModule mkOption;
     inherit (self.types) isType setType defaultTypeMerge defaultFunctor

lib/options.nix

@@ -172,11 +172,13 @@ rec {
     else if all isInt list && all (x: x == head list) list then head list
     else throw "Cannot merge definitions of `${showOption loc}'. Definition values:${showDefs defs}";
 
-  mergeOneOption = loc: defs:
-    if defs == [] then abort "This case should never happen."
-    else if length defs != 1 then
-      throw "The unique option `${showOption loc}' is defined multiple times. Definition values:${showDefs defs}"
-    else (head defs).value;
+  mergeOneOption = mergeUniqueOption { message = ""; };
+
+  mergeUniqueOption = { message }: loc: defs:
+    if length defs == 1
+    then (head defs).value
+    else assert length defs > 1;
+      throw "The option `${showOption loc}' is defined multiple times.\n${message}\nDefinition values:${showDefs defs}";
 
   /* "Merge" option definitions by checking that they all have the same value. */
   mergeEqualOption = loc: defs:

lib/types.nix

@@ -32,7 +32,6 @@ let
     last
     length
     tail
-    unique
     ;
   inherit (lib.attrsets)
     attrNames
@@ -48,6 +47,7 @@ let
     mergeDefaultOption
     mergeEqualOption
     mergeOneOption
+    mergeUniqueOption
     showFiles
     showOption
     ;
@@ -470,6 +470,18 @@ rec {
       nestedTypes.elemType = elemType;
     };
 
+    unique = { message }: type: mkOptionType rec {
+      name = "unique";
+      inherit (type) description check;
+      merge = mergeUniqueOption { inherit message; };
+      emptyValue = type.emptyValue;
+      getSubOptions = type.getSubOptions;
+      getSubModules = type.getSubModules;
+      substSubModules = m: uniq (type.substSubModules m);
+      functor = (defaultFunctor name) // { wrapped = type; };
+      nestedTypes.elemType = type;
+    };
+
     # Null or value of ...
     nullOr = elemType: mkOptionType rec {
       name = "nullOr";
@@ -599,6 +611,7 @@ rec {
     # A value from a set of allowed ones.
     enum = values:
       let
+        inherit (lib.lists) unique;
         show = v:
                if builtins.isString v then ''"${v}"''
           else if builtins.isInt v then builtins.toString v

maintainers/maintainer-list.nix

@@ -3545,7 +3545,7 @@
     name = "Leo Maroni";
   };
   emmanuelrosa = {
-    email = "emmanuel_rosa@aol.com";
+    email = "emmanuelrosa@protonmail.com";
     matrix = "@emmanuelrosa:matrix.org";
     github = "emmanuelrosa";
     githubId = 13485450;
@@ -5984,6 +5984,13 @@
     githubId = 107689;
     name = "Josh Holland";
   };
+  jsierles = {
+    email = "joshua@hey.com";
+    matrix = "@jsierles:matrix.org";
+    name = "Joshua Sierles";
+    github = "jsierles";
+    githubId = 82;
+  };
   jtcoolen = {
     email = "jtcoolen@pm.me";
     name = "Julien Coolen";
@@ -6061,6 +6068,16 @@
     githubId = 2396926;
     name = "Justin Woo";
   };
+  jvanbruegge = {
+    email = "supermanitu@gmail.com";
+    github = "jvanbruegge";
+    githubId = 1529052;
+    name = "Jan van Brügge";
+    keys = [{
+      longkeyid = "rsa4096/0x366572BE7D6C78A2";
+      fingerprint = "3513 5CE5 77AD 711F 3825  9A99 3665 72BE 7D6C 78A2";
+    }];
+  };
   jwatt = {
     email = "jwatt@broken.watch";
     github = "jjwatt";
@@ -8588,6 +8605,12 @@
     githubId = 7845120;
     name = "Alex Martens";
   };
+  nialov = {
+    email = "nikolasovaskainen@gmail.com";
+    github = "nialov";
+    githubId = 47318483;
+    name = "Nikolas Ovaskainen";
+  };
   nikitavoloboev = {
     email = "nikita.voloboev@gmail.com";
     github = "nikitavoloboev";
@@ -12043,7 +12066,7 @@
     name = "Tiago Castro";
   };
   tilcreator = {
-    name = "Tilman Jackel";
+    name = "TilCreator";
     email = "contact.nixos@tc-j.de";
     matrix = "@tilcreator:matrix.org";
     github = "TilCreator";

nixos/doc/manual/development/option-types.section.md

@@ -250,6 +250,12 @@ Composed types are types that take a type as parameter. `listOf
 :   Ensures that type *`t`* cannot be merged. It is used to ensure option
     definitions are declared only once.
 
+`types.unique` `{ message = m }` *`t`*
+
+:   Ensures that type *`t`* cannot be merged. Prints the message *`m`*, after
+    the line `The option <option path> is defined multiple times.` and before
+    a list of definition locations.
+
 `types.either` *`t1 t2`*
 
 :   Type *`t1`* or type *`t2`*, e.g. `with types; either int str`.

nixos/doc/manual/development/running-nixos-tests-interactively.section.md

@@ -5,7 +5,7 @@ when developing or debugging a test:
 
 ```ShellSession
 $ nix-build . -A nixosTests.login.driverInteractive
-$ ./result/bin/nixos-test-driver --interactive
+$ ./result/bin/nixos-test-driver
 [...]
 >>>
 ```
@@ -28,7 +28,7 @@ You can re-use the VM states coming from a previous run by setting the
 `--keep-vm-state` flag.
 
 ```ShellSession
-$ ./result/bin/nixos-test-driver --interactive --keep-vm-state
+$ ./result/bin/nixos-test-driver --keep-vm-state
 ```
 
 The machine state is stored in the `$TMPDIR/vm-state-machinename`

nixos/doc/manual/from_md/development/option-types.section.xml

@@ -496,6 +496,22 @@
           </para>
         </listitem>
       </varlistentry>
+      <varlistentry>
+        <term>
+          <literal>types.unique</literal>
+          <literal>{ message = m }</literal>
+          <emphasis><literal>t</literal></emphasis>
+        </term>
+        <listitem>
+          <para>
+            Ensures that type <emphasis><literal>t</literal></emphasis>
+            cannot be merged. Prints the message
+            <emphasis><literal>m</literal></emphasis>, after the line
+            <literal>The option &lt;option path&gt; is defined multiple times.</literal>
+            and before a list of definition locations.
+          </para>
+        </listitem>
+      </varlistentry>
       <varlistentry>
         <term>
           <literal>types.either</literal>

nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml

@@ -6,7 +6,7 @@
   </para>
   <programlisting>
 $ nix-build . -A nixosTests.login.driverInteractive
-$ ./result/bin/nixos-test-driver --interactive
+$ ./result/bin/nixos-test-driver
 [...]
 &gt;&gt;&gt;
 </programlisting>
@@ -30,7 +30,7 @@ $ ./result/bin/nixos-test-driver --interactive
     the <literal>--keep-vm-state</literal> flag.
   </para>
   <programlisting>
-$ ./result/bin/nixos-test-driver --interactive --keep-vm-state
+$ ./result/bin/nixos-test-driver --keep-vm-state
 </programlisting>
   <para>
     The machine state is stored in the

nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -723,6 +723,15 @@
           docs</link> for more details.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>programs.tmux</literal> has a new option
+          <literal>plugins</literal> that accepts a list of packages
+          from the <literal>tmuxPlugins</literal> group. The specified
+          packages are added to the system and loaded by
+          <literal>tmux</literal>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -249,4 +249,6 @@ In addition to numerous new and upgraded packages, this release has the followin
   daemon no longer automatically performs the FCC unlock procedure by default. See
   [the docs](https://modemmanager.org/docs/modemmanager/fcc-unlock/) for more details.
 
+- `programs.tmux` has a new option `plugins` that accepts a list of packages from the `tmuxPlugins` group. The specified packages are added to the system and loaded by `tmux`.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/test-driver/test_driver/__init__.py

@@ -33,6 +33,22 @@ class EnvDefault(argparse.Action):
         setattr(namespace, self.dest, values)
 
 
+def writeable_dir(arg: str) -> Path:
+    """Raises an ArgumentTypeError if the given argument isn't a writeable directory
+    Note: We want to fail as early as possible if a directory isn't writeable,
+    since an executed nixos-test could fail (very late) because of the test-driver
+    writing in a directory without proper permissions.
+    """
+    path = Path(arg)
+    if not path.is_dir():
+        raise argparse.ArgumentTypeError("{0} is not a directory".format(path))
+    if not os.access(path, os.W_OK):
+        raise argparse.ArgumentTypeError(
+            "{0} is not a writeable directory".format(path)
+        )
+    return path
+
+
 def main() -> None:
     arg_parser = argparse.ArgumentParser(prog="nixos-test-driver")
     arg_parser.add_argument(
@@ -45,7 +61,7 @@ def main() -> None:
         "-I",
         "--interactive",
         help="drop into a python repl and run the tests interactively",
-        action="store_true",
+        action=argparse.BooleanOptionalAction,
     )
     arg_parser.add_argument(
         "--start-scripts",
@@ -63,6 +79,14 @@ def main() -> None:
         nargs="*",
         help="vlans to span by the driver",
     )
+    arg_parser.add_argument(
+        "-o",
+        "--output_directory",
+        help="""The path to the directory where outputs copied from the VM will be placed.
+                By e.g. Machine.copy_from_vm or Machine.screenshot""",
+        default=Path.cwd(),
+        type=writeable_dir,
+    )
     arg_parser.add_argument(
         "testscript",
         action=EnvDefault,
@@ -77,7 +101,11 @@ def main() -> None:
         rootlog.info("Machine state will be reset. To keep it, pass --keep-vm-state")
 
     with Driver(
-        args.start_scripts, args.vlans, args.testscript.read_text(), args.keep_vm_state
+        args.start_scripts,
+        args.vlans,
+        args.testscript.read_text(),
+        args.output_directory.resolve(),
+        args.keep_vm_state,
     ) as driver:
         if args.interactive:
             ptpython.repl.embed(driver.test_symbols(), {})
@@ -94,7 +122,7 @@ def generate_driver_symbols() -> None:
     in user's test scripts. That list is then used by pyflakes to lint those
     scripts.
     """
-    d = Driver([], [], "")
+    d = Driver([], [], "", Path())
     test_symbols = d.test_symbols()
     with open("driver-symbols", "w") as fp:
         fp.write(",".join(test_symbols.keys()))

nixos/lib/test-driver/test_driver/driver.py

@@ -10,6 +10,28 @@ from test_driver.vlan import VLan
 from test_driver.polling_condition import PollingCondition
 
 
+def get_tmp_dir() -> Path:
+    """Returns a temporary directory that is defined by TMPDIR, TEMP, TMP or CWD
+    Raises an exception in case the retrieved temporary directory is not writeable
+    See https://docs.python.org/3/library/tempfile.html#tempfile.gettempdir
+    """
+    tmp_dir = Path(tempfile.gettempdir())
+    tmp_dir.mkdir(mode=0o700, exist_ok=True)
+    if not tmp_dir.is_dir():
+        raise NotADirectoryError(
+            "The directory defined by TMPDIR, TEMP, TMP or CWD: {0} is not a directory".format(
+                tmp_dir
+            )
+        )
+    if not os.access(tmp_dir, os.W_OK):
+        raise PermissionError(
+            "The directory defined by TMPDIR, TEMP, TMP, or CWD: {0} is not writeable".format(
+                tmp_dir
+            )
+        )
+    return tmp_dir
+
+
 class Driver:
     """A handle to the driver that sets up the environment
     and runs the tests"""
@@ -24,12 +46,13 @@ class Driver:
         start_scripts: List[str],
         vlans: List[int],
         tests: str,
+        out_dir: Path,
         keep_vm_state: bool = False,
     ):
         self.tests = tests
+        self.out_dir = out_dir
 
-        tmp_dir = Path(os.environ.get("TMPDIR", tempfile.gettempdir()))
-        tmp_dir.mkdir(mode=0o700, exist_ok=True)
+        tmp_dir = get_tmp_dir()
 
         with rootlog.nested("start all VLans"):
             self.vlans = [VLan(nr, tmp_dir) for nr in vlans]
@@ -47,6 +70,7 @@ class Driver:
                 name=cmd.machine_name,
                 tmp_dir=tmp_dir,
                 callbacks=[self.check_polling_conditions],
+                out_dir=self.out_dir,
             )
             for cmd in cmd(start_scripts)
         ]
@@ -141,8 +165,8 @@ class Driver:
             "Using legacy create_machine(), please instantiate the"
             "Machine class directly, instead"
         )
-        tmp_dir = Path(os.environ.get("TMPDIR", tempfile.gettempdir()))
-        tmp_dir.mkdir(mode=0o700, exist_ok=True)
+
+        tmp_dir = get_tmp_dir()
 
         if args.get("startCommand"):
             start_command: str = args.get("startCommand", "")
@@ -154,6 +178,7 @@ class Driver:
 
         return Machine(
             tmp_dir=tmp_dir,
+            out_dir=self.out_dir,
             start_command=cmd,
             name=name,
             keep_vm_state=args.get("keep_vm_state", False),

nixos/lib/test-driver/test_driver/machine.py

@@ -297,6 +297,7 @@ class Machine:
     the machine lifecycle with the help of a start script / command."""
 
     name: str
+    out_dir: Path
     tmp_dir: Path
     shared_dir: Path
     state_dir: Path
@@ -325,6 +326,7 @@ class Machine:
 
     def __init__(
         self,
+        out_dir: Path,
         tmp_dir: Path,
         start_command: StartCommand,
         name: str = "machine",
@@ -332,6 +334,7 @@ class Machine:
         allow_reboot: bool = False,
         callbacks: Optional[List[Callable]] = None,
     ) -> None:
+        self.out_dir = out_dir
         self.tmp_dir = tmp_dir
         self.keep_vm_state = keep_vm_state
         self.allow_reboot = allow_reboot
@@ -702,10 +705,9 @@ class Machine:
             self.connected = True
 
     def screenshot(self, filename: str) -> None:
-        out_dir = os.environ.get("out", os.getcwd())
         word_pattern = re.compile(r"^\w+$")
         if word_pattern.match(filename):
-            filename = os.path.join(out_dir, "{}.png".format(filename))
+            filename = os.path.join(self.out_dir, "{}.png".format(filename))
         tmp = "{}.ppm".format(filename)
 
         with self.nested(
@@ -756,7 +758,6 @@ class Machine:
         all the VMs (using a temporary directory).
         """
         # Compute the source, target, and intermediate shared file names
-        out_dir = Path(os.environ.get("out", os.getcwd()))
         vm_src = Path(source)
         with tempfile.TemporaryDirectory(dir=self.shared_dir) as shared_td:
             shared_temp = Path(shared_td)
@@ -766,7 +767,7 @@ class Machine:
             # Copy the file to the shared directory inside VM
             self.succeed(make_command(["mkdir", "-p", vm_shared_temp]))
             self.succeed(make_command(["cp", "-r", vm_src, vm_intermediate]))
-            abs_target = out_dir / target_dir / vm_src.name
+            abs_target = self.out_dir / target_dir / vm_src.name
             abs_target.parent.mkdir(exist_ok=True, parents=True)
             # Copy the file from the shared directory outside VM
             if intermediate.is_dir():

nixos/lib/testing-python.nix

@@ -30,7 +30,7 @@ rec {
           # effectively mute the XMLLogger
           export LOGFILE=/dev/null
 
-          ${driver}/bin/nixos-test-driver
+          ${driver}/bin/nixos-test-driver -o $out
         '';
 
       passthru = driver.passthru // {
@@ -51,6 +51,7 @@ rec {
     , enableOCR ? false
     , skipLint ? false
     , passthru ? {}
+    , interactive ? false
   }:
     let
       # Reifies and correctly wraps the python test driver for
@@ -139,7 +140,8 @@ rec {
         wrapProgram $out/bin/nixos-test-driver \
           --set startScripts "''${vmStartScripts[*]}" \
           --set testScript "$out/test-script" \
-          --set vlans '${toString vlans}'
+          --set vlans '${toString vlans}' \
+          ${lib.optionalString (interactive) "--add-flags --interactive"}
       '');
 
   # Make a full-blown test
@@ -217,6 +219,7 @@ rec {
         testName = name;
         qemu_pkg = pkgs.qemu;
         nodes = nodes pkgs.qemu;
+        interactive = true;
       };
 
       test =

nixos/modules/config/xdg/portal.nix

@@ -1,4 +1,4 @@
-{ config, pkgs ,lib ,... }:
+{ config, pkgs, lib, ... }:
 
 with lib;
 
@@ -13,13 +13,13 @@ with lib;
 
   options.xdg.portal = {
     enable =
-      mkEnableOption "<link xlink:href='https://github.com/flatpak/xdg-desktop-portal'>xdg desktop integration</link>"//{
+      mkEnableOption "<link xlink:href='https://github.com/flatpak/xdg-desktop-portal'>xdg desktop integration</link>" // {
         default = false;
       };
 
     extraPortals = mkOption {
       type = types.listOf types.package;
-      default = [];
+      default = [ ];
       description = ''
         List of additional portals to add to path. Portals allow interaction
         with system, like choosing files or taking screenshots. At minimum,
@@ -46,25 +46,36 @@ with lib;
     let
       cfg = config.xdg.portal;
       packages = [ pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
-      joinedPortals = pkgs.symlinkJoin {
+      joinedPortals = pkgs.buildEnv {
         name = "xdg-portals";
-        paths = cfg.extraPortals;
+        paths = packages;
+        pathsToLink = [ "/share/xdg-desktop-portal/portals" "/share/applications" ];
       };
 
-    in mkIf cfg.enable {
+    in
+    mkIf cfg.enable {
 
       assertions = [
-        { assertion = (cfg.gtkUsePortal -> cfg.extraPortals != []);
-          message = "Setting xdg.portal.gtkUsePortal to true requires a portal implementation in xdg.portal.extraPortals such as xdg-desktop-portal-gtk or xdg-desktop-portal-kde.";
+        {
+          assertion = cfg.extraPortals != [ ];
+          message = "Setting xdg.portal.enable to true requires a portal implementation in xdg.portal.extraPortals such as xdg-desktop-portal-gtk or xdg-desktop-portal-kde.";
         }
       ];
 
-      services.dbus.packages  = packages;
+      services.dbus.packages = packages;
       systemd.packages = packages;
 
-      environment.sessionVariables = {
-        GTK_USE_PORTAL = mkIf cfg.gtkUsePortal "1";
-        XDG_DESKTOP_PORTAL_DIR = "${joinedPortals}/share/xdg-desktop-portal/portals";
+      environment = {
+        # fixes screen sharing on plasmawayland on non-chromium apps by linking
+        # share/applications/*.desktop files
+        # see https://github.com/NixOS/nixpkgs/issues/145174
+        systemPackages = [ joinedPortals ];
+        pathsToLink = [ "/share/applications" ];
+
+        sessionVariables = {
+          GTK_USE_PORTAL = mkIf cfg.gtkUsePortal "1";
+          XDG_DESKTOP_PORTAL_DIR = "${joinedPortals}/share/xdg-desktop-portal/portals";
+        };
       };
     };
 }

nixos/modules/module-list.nix

@@ -852,7 +852,6 @@
   ./services/networking/quassel.nix
   ./services/networking/quorum.nix
   ./services/networking/quicktun.nix
-  ./services/networking/racoon.nix
   ./services/networking/radicale.nix
   ./services/networking/radvd.nix
   ./services/networking/rdnssd.nix

nixos/modules/programs/tmux.nix

@@ -52,6 +52,12 @@ let
     set  -s escape-time       ${toString cfg.escapeTime}
     set  -g history-limit     ${toString cfg.historyLimit}
 
+    ${lib.optionalString (cfg.plugins != []) ''
+    # Run plugins
+    ${lib.concatMapStringsSep "\n" (x: "run-shell ${x.rtp}") cfg.plugins}
+
+    ''}
+
     ${cfg.extraConfig}
   '';
 
@@ -165,6 +171,13 @@ in {
           downside it doesn't survive user logout.
         '';
       };
+
+      plugins = mkOption {
+        default = [];
+        type = types.listOf types.package;
+        description = "List of plugins to install.";
+        example = lib.literalExpression "[ pkgs.tmuxPlugins.nord ]";
+      };
     };
   };
 
@@ -174,7 +187,7 @@ in {
     environment = {
       etc."tmux.conf".text = tmuxConf;
 
-      systemPackages = [ pkgs.tmux ];
+      systemPackages = [ pkgs.tmux ] ++ cfg.plugins;
 
       variables = {
         TMUX_TMPDIR = lib.optional cfg.secureSocket ''''${XDG_RUNTIME_DIR:-"/run/user/$(id -u)"}'';

nixos/modules/rename.nix

@@ -80,6 +80,9 @@ with lib;
       libinput and synaptics.
     '')
     (mkRemovedOptionModule [ "virtualisation" "rkt" ] "The rkt module has been removed, it was archived by upstream")
+    (mkRemovedOptionModule [ "services" "racoon" ] ''
+      The racoon module has been removed, because the software project was abandoned upstream.
+    '')
 
     # Do NOT add any option renames here, see top of the file
   ];

nixos/modules/services/hardware/triggerhappy.nix

@@ -70,7 +70,7 @@ in
         type = types.listOf (types.submodule bindingCfg);
         default = [];
         example = lib.literalExpression ''
-          [ { keys = ["PLAYPAUSE"];  cmd = "''${pkgs.mpc_cli}/bin/mpc -q toggle"; } ]
+          [ { keys = ["PLAYPAUSE"];  cmd = "''${pkgs.mpc-cli}/bin/mpc -q toggle"; } ]
         '';
         description = ''
           Key bindings for <command>triggerhappy</command>.

nixos/modules/services/misc/gitlab.nix

@@ -1099,7 +1099,9 @@ in {
       "d ${gitlabConfig.production.shared.path} 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/artifacts 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/lfs-objects 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/packages 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/pages 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/terraform_state 0750 ${cfg.user} ${cfg.group} -"
       "L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
       "L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
       "L+ /run/gitlab/tmp - - - - ${cfg.statePath}/tmp"

nixos/modules/services/misc/home-assistant.nix

@@ -278,6 +278,11 @@ in {
           "bluetooth_tracker"
           "bluetooth_le_tracker"
         ];
+        componentsUsingPing = [
+          # Components that require the capset syscall for the ping wrapper
+          "ping"
+          "wake_on_lan"
+        ];
         componentsUsingSerialDevices = [
           # Components that require access to serial devices (/dev/tty*)
           # List generated from home-assistant documentation:
@@ -382,6 +387,8 @@ in {
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
+        ] ++ optionals (any useComponent componentsUsingPing) [
+          "capset"
         ];
         UMask = "0077";
       };

nixos/modules/services/misc/matrix-synapse.nix

@@ -119,6 +119,30 @@ ${cfg.extraConfig}
 
   hasLocalPostgresDB = let args = cfg.database_args; in
     usePostgresql && (!(args ? host) || (elem args.host [ "localhost" "127.0.0.1" "::1" ]));
+
+  registerNewMatrixUser =
+    let
+      isIpv6 = x: lib.length (lib.splitString ":" x) > 1;
+      listener =
+        lib.findFirst (
+          listener: lib.any (
+            resource: lib.any (
+              name: name == "client"
+            ) resource.names
+          ) listener.resources
+        ) (lib.last cfg.listeners) cfg.listeners;
+    in
+    pkgs.writeShellScriptBin "matrix-synapse-register_new_matrix_user" ''
+      exec ${cfg.package}/bin/register_new_matrix_user \
+        $@ \
+        ${lib.concatMapStringsSep " " (x: "-c ${x}") ([ configFile ] ++ cfg.extraConfigFiles)} \
+        "${listener.type}://${
+          if (isIpv6 listener.bind_address) then
+            "[${listener.bind_address}]"
+          else
+            "${listener.bind_address}"
+        }:${builtins.toString listener.port}/"
+    '';
 in {
   options = {
     services.matrix-synapse = {
@@ -294,7 +318,7 @@ in {
                     description = ''
                       List of resources to host on this listener.
                     '';
-                    example = ["client" "webclient" "federation"];
+                    example = ["client" "federation"];
                   };
                   compress = mkOption {
                     type = types.bool;
@@ -319,7 +343,7 @@ in {
           tls = true;
           x_forwarded = false;
           resources = [
-            { names = ["client" "webclient"]; compress = true; }
+            { names = ["client"]; compress = true; }
             { names = ["federation"]; compress = false; }
           ];
         }];
@@ -792,6 +816,8 @@ in {
         UMask = "0077";
       };
     };
+
+    environment.systemPackages = [ registerNewMatrixUser ];
   };
 
   imports = [

nixos/modules/services/networking/bird.nix

@@ -31,7 +31,23 @@ let
             default = true;
             description = ''
               Whether the config should be checked at build time.
-              Disabling this might become necessary if the config includes files not present during build time.
+              When the config can't be checked during build time, for example when it includes
+              other files, either disable this option or use <code>preCheckConfig</code> to create
+              the included files before checking.
+            '';
+          };
+          preCheckConfig = mkOption {
+            type = types.lines;
+            default = "";
+            example = ''
+              echo "cost 100;" > include.conf
+            '';
+            description = ''
+              Commands to execute before the config file check. The file to be checked will be
+              available as <code>${variant}.conf</code> in the current directory.
+
+              Files created with this option will not be available at service runtime, only during
+              build time checking.
             '';
           };
         };
@@ -45,7 +61,9 @@ let
           name = "${variant}.conf";
           text = cfg.config;
           checkPhase = optionalString cfg.checkConfig ''
-            ${pkg}/bin/${birdBin} -d -p -c $out
+            ln -s $out ${variant}.conf
+            ${cfg.preCheckConfig}
+            ${pkg}/bin/${birdBin} -d -p -c ${variant}.conf
           '';
         };
 

nixos/modules/services/networking/kresd.nix

@@ -9,7 +9,7 @@ let
   # On Nix level we don't attempt to precisely validate the address specifications.
   # The optional IPv6 scope spec comes *after* port, perhaps surprisingly.
   mkListen = kind: addr: let
-    al_v4 = builtins.match "([0-9.]+):([0-9]+)()" addr;
+    al_v4 = builtins.match "([0-9.]+):([0-9]+)($)" addr;
     al_v6 = builtins.match "\\[(.+)]:([0-9]+)(%.*|$)" addr;
     al_portOnly = builtins.match "([0-9]+)" addr;
     al = findFirst (a: a != null)

nixos/modules/services/networking/racoon.nix

@@ -1,45 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.racoon;
-in {
-  options.services.racoon = {
-    enable = mkEnableOption "racoon";
-
-    config = mkOption {
-      description = "Contents of racoon configuration file.";
-      default = "";
-      type = types.str;
-    };
-
-    configPath = mkOption {
-      description = "Location of racoon config if config is not provided.";
-      default = "/etc/racoon/racoon.conf";
-      type = types.path;
-    };
-  };
-
-  config = mkIf cfg.enable {
-    systemd.services.racoon = {
-      description = "Racoon Daemon";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      serviceConfig = {
-        ExecStart = "${pkgs.ipsecTools}/bin/racoon -f ${
-          if (cfg.config != "") then pkgs.writeText "racoon.conf" cfg.config
-          else cfg.configPath
-        }";
-        ExecReload = "${pkgs.ipsecTools}/bin/racoonctl reload-config";
-        PIDFile = "/run/racoon.pid";
-        Type = "forking";
-        Restart = "always";
-      };
-      preStart = ''
-        rm /run/racoon.pid || true
-        mkdir -p /var/racoon
-      '';
-    };
-  };
-}

nixos/modules/services/security/tor.nix

@@ -794,6 +794,11 @@ in
               };
             }));
           };
+          options.ShutdownWaitLength = mkOption {
+            type = types.int;
+            default = 30;
+            description = descriptionGeneric "ShutdownWaitLength";
+          };
           options.SocksPolicy = optionStrings "SocksPolicy" // {
             example = ["accept *:*"];
           };
@@ -977,7 +982,7 @@ in
         ExecStart = "${cfg.package}/bin/tor -f ${torrc}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         KillSignal = "SIGINT";
-        TimeoutSec = 30;
+        TimeoutSec = cfg.settings.ShutdownWaitLength + 30; # Wait a bit longer than ShutdownWaitLength before actually timing out
         Restart = "on-failure";
         LimitNOFILE = 32768;
         RuntimeDirectory = [

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -394,7 +394,8 @@ in
 
       # Extra UDEV rules used by Solid
       services.udev.packages = [
-        pkgs.libmtp
+        # libmtp has "bin", "dev", "out" outputs. UDEV rules file is in "out".
+        pkgs.libmtp.out
         pkgs.media-player-info
       ];
 

nixos/modules/system/activation/top-level.nix

@@ -109,9 +109,7 @@ let
     utillinux = pkgs.util-linux;
 
     kernelParams = config.boot.kernelParams;
-    installBootLoader =
-      config.system.build.installBootLoader
-      or "echo 'Warning: do not know how to make this configuration bootable; please enable a boot loader.' 1>&2; true";
+    installBootLoader = config.system.build.installBootLoader;
     activationScript = config.system.activationScripts.script;
     dryActivationScript = config.system.dryActivationScript;
     nixosLabel = config.system.nixos.label;
@@ -135,25 +133,27 @@ let
       pkgs.replaceDependency { inherit oldDependency newDependency drv; }
     ) baseSystemAssertWarn config.system.replaceRuntimeDependencies;
 
+  /* Workaround until https://github.com/NixOS/nixpkgs/pull/156533
+     Call can be replaced by argument when that's merged.
+  */
+  tmpFixupSubmoduleBoundary = subopts:
+    lib.mkOption {
+      type = lib.types.submoduleWith {
+        modules = [ { options = subopts; } ];
+      };
+    };
+
 in
 
 {
   imports = [
+    ../build.nix
     (mkRemovedOptionModule [ "nesting" "clone" ] "Use `specialisation.«name» = { inheritParentConfig = true; configuration = { ... }; }` instead.")
     (mkRemovedOptionModule [ "nesting" "children" ] "Use `specialisation.«name».configuration = { ... }` instead.")
   ];
 
   options = {
 
-    system.build = mkOption {
-      internal = true;
-      default = {};
-      type = with types; lazyAttrsOf (uniq unspecified);
-      description = ''
-        Attribute set of derivations used to setup the system.
-      '';
-    };
-
     specialisation = mkOption {
       default = {};
       example = lib.literalExpression "{ fewJobsManyCores.configuration = { nix.buildCores = 0; nix.maxJobs = 1; }; }";
@@ -224,6 +224,39 @@ in
       '';
     };
 
+    system.build = tmpFixupSubmoduleBoundary {
+      installBootLoader = mkOption {
+        internal = true;
+        # "; true" => make the `$out` argument from switch-to-configuration.pl
+        #             go to `true` instead of `echo`, hiding the useless path
+        #             from the log.
+        default = "echo 'Warning: do not know how to make this configuration bootable; please enable a boot loader.' 1>&2; true";
+        description = ''
+          A program that writes a bootloader installation script to the path passed in the first command line argument.
+
+          See <literal>nixos/modules/system/activation/switch-to-configuration.pl</literal>.
+        '';
+        type = types.unique {
+          message = ''
+            Only one bootloader can be enabled at a time. This requirement has not
+            been checked until NixOS 22.05. Earlier versions defaulted to the last
+            definition. Change your configuration to enable only one bootloader.
+          '';
+        } (types.either types.str types.package);
+      };
+
+      toplevel = mkOption {
+        type = types.package;
+        readOnly = true;
+        description = ''
+          This option contains the store path that typically represents a NixOS system.
+
+          You can read this path in a custom deployment tool for example.
+        '';
+      };
+    };
+
+
     system.copySystemConfiguration = mkOption {
       type = types.bool;
       default = false;

nixos/modules/system/build.nix

@@ -0,0 +1,21 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+in
+{
+  options = {
+
+    system.build = mkOption {
+      default = {};
+      description = ''
+        Attribute set of derivations used to set up the system.
+      '';
+      type = types.submoduleWith {
+        modules = [{
+          freeformType = with types; lazyAttrsOf (uniq unspecified);
+        }];
+      };
+    };
+
+  };
+}

nixos/modules/virtualisation/openvswitch.nix

@@ -36,17 +36,6 @@ in {
         Open vSwitch package to use.
       '';
     };
-
-    ipsec = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether to start racoon service for openvswitch.
-        Supported only if openvswitch version is less than 2.6.0.
-        Use <literal>virtualisation.vswitch.package = pkgs.openvswitch-lts</literal>
-        for a version that supports ipsec over GRE.
-      '';
-    };
   };
 
   config = mkIf cfg.enable (let
@@ -65,7 +54,7 @@ in {
       installPhase = "mkdir -p $out";
     };
 
-  in (mkMerge [{
+  in {
     environment.systemPackages = [ cfg.package ];
     boot.kernelModules = [ "tun" "openvswitch" ];
 
@@ -142,48 +131,14 @@ in {
       };
     };
 
-  }
-  (mkIf (cfg.ipsec && (versionOlder cfg.package.version "2.6.0")) {
-    environment.systemPackages = [ pkgs.ipsecTools ];
+  });
 
-    services.racoon.enable = true;
-    services.racoon.configPath = "${runDir}/ipsec/etc/racoon/racoon.conf";
-
-    networking.firewall.extraCommands = ''
-      iptables -I INPUT -t mangle -p esp -j MARK --set-mark 1/1
-      iptables -I INPUT -t mangle -p udp --dport 4500 -j MARK --set-mark 1/1
-    '';
-
-    systemd.services.ovs-monitor-ipsec = {
-      description = "Open_vSwitch Ipsec Daemon";
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "ovsdb.service" ];
-      before = [ "vswitchd.service" "racoon.service" ];
-      environment.UNIXCTLPATH = "/tmp/ovsdb.ctl.sock";
-      serviceConfig = {
-        ExecStart = ''
-          ${cfg.package}/bin/ovs-monitor-ipsec \
-            --root-prefix ${runDir}/ipsec \
-            --pidfile /run/openvswitch/ovs-monitor-ipsec.pid \
-            --monitor --detach \
-            unix:/run/openvswitch/db.sock
-        '';
-        PIDFile = "/run/openvswitch/ovs-monitor-ipsec.pid";
-        # Use service type 'forking' to correctly determine when ovs-monitor-ipsec is ready.
-        Type = "forking";
-      };
-
-      preStart = ''
-        rm -r ${runDir}/ipsec/etc/racoon/certs || true
-        mkdir -p ${runDir}/ipsec/{etc/racoon,etc/init.d/,usr/sbin/}
-        ln -fs ${pkgs.ipsecTools}/bin/setkey ${runDir}/ipsec/usr/sbin/setkey
-        ln -fs ${pkgs.writeScript "racoon-restart" ''
-        #!${pkgs.runtimeShell}
-        /run/current-system/sw/bin/systemctl $1 racoon
-        ''} ${runDir}/ipsec/etc/init.d/racoon
-      '';
-    };
-  })]));
+  imports = [
+    (mkRemovedOptionModule [ "virtualisation" "vswitch" "ipsec" ] ''
+      OpenVSwitch IPSec functionality has been removed, because it depended on racoon,
+      which was removed from nixpkgs, because it was abanoded upstream.
+    '')
+  ];
 
   meta.maintainers = with maintainers; [ netixx ];
 

nixos/tests/all-tests.nix

@@ -46,6 +46,7 @@ in
   beanstalkd = handleTest ./beanstalkd.nix {};
   bees = handleTest ./bees.nix {};
   bind = handleTest ./bind.nix {};
+  bird = handleTest ./bird.nix {};
   bitcoind = handleTest ./bitcoind.nix {};
   bittorrent = handleTest ./bittorrent.nix {};
   blockbook-frontend = handleTest ./blockbook-frontend.nix {};

nixos/tests/bird.nix

@@ -0,0 +1,205 @@
+# This test does a basic functionality check for all bird variants and demonstrates a use
+# of the preCheckConfig option.
+
+{ system ? builtins.currentSystem
+, pkgs ? import ../.. { inherit system; config = { }; }
+}:
+
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+  inherit (pkgs.lib) optionalString;
+
+  hostShared = hostId: { pkgs, ... }: {
+    virtualisation.vlans = [ 1 ];
+
+    environment.systemPackages = with pkgs; [ jq ];
+
+    networking = {
+      useNetworkd = true;
+      useDHCP = false;
+      firewall.enable = false;
+    };
+
+    systemd.network.networks."01-eth1" = {
+      name = "eth1";
+      networkConfig.Address = "10.0.0.${hostId}/24";
+    };
+  };
+
+  birdTest = v4:
+    let variant = "bird${optionalString (!v4) "6"}"; in
+    makeTest {
+      name = variant;
+
+      nodes.host1 = makeBirdHost variant "1";
+      nodes.host2 = makeBirdHost variant "2";
+
+      testScript = makeTestScript variant v4 (!v4);
+    };
+
+  bird2Test = makeTest {
+    name = "bird2";
+
+    nodes.host1 = makeBird2Host "1";
+    nodes.host2 = makeBird2Host "2";
+
+    testScript = makeTestScript "bird2" true true;
+  };
+
+  makeTestScript = variant: v4: v6: ''
+    start_all()
+
+    host1.wait_for_unit("${variant}.service")
+    host2.wait_for_unit("${variant}.service")
+
+    ${optionalString v4 ''
+    with subtest("Waiting for advertised IPv4 routes"):
+      host1.wait_until_succeeds("ip --json r | jq -e 'map(select(.dst == \"10.10.0.2\")) | any'")
+      host2.wait_until_succeeds("ip --json r | jq -e 'map(select(.dst == \"10.10.0.1\")) | any'")
+    ''}
+    ${optionalString v6 ''
+    with subtest("Waiting for advertised IPv6 routes"):
+      host1.wait_until_succeeds("ip --json -6 r | jq -e 'map(select(.dst == \"fdff::2\")) | any'")
+      host2.wait_until_succeeds("ip --json -6 r | jq -e 'map(select(.dst == \"fdff::1\")) | any'")
+    ''}
+
+    with subtest("Check fake routes in preCheckConfig do not exists"):
+      ${optionalString v4 ''host1.fail("ip --json r | jq -e 'map(select(.dst == \"1.2.3.4\")) | any'")''}
+      ${optionalString v4 ''host2.fail("ip --json r | jq -e 'map(select(.dst == \"1.2.3.4\")) | any'")''}
+
+      ${optionalString v6 ''host1.fail("ip --json -6 r | jq -e 'map(select(.dst == \"fd00::\")) | any'")''}
+      ${optionalString v6 ''host2.fail("ip --json -6 r | jq -e 'map(select(.dst == \"fd00::\")) | any'")''}
+  '';
+
+  makeBirdHost = variant: hostId: { pkgs, ... }: {
+    imports = [ (hostShared hostId) ];
+
+    services.${variant} = {
+      enable = true;
+
+      config = ''
+        log syslog all;
+
+        debug protocols all;
+
+        router id 10.0.0.${hostId};
+
+        protocol device {
+        }
+
+        protocol kernel {
+          import none;
+          export all;
+        }
+
+        protocol static {
+          include "static.conf";
+        }
+
+        protocol ospf {
+          export all;
+          area 0 {
+            interface "eth1" {
+              hello 5;
+              wait 5;
+            };
+          };
+        }
+      '';
+
+      preCheckConfig =
+        let
+          route = { bird = "1.2.3.4/32"; bird6 = "fd00::/128"; }.${variant};
+        in
+        ''echo "route ${route} blackhole;" > static.conf'';
+    };
+
+    systemd.tmpfiles.rules =
+      let
+        route = { bird = "10.10.0.${hostId}/32"; bird6 = "fdff::${hostId}/128"; }.${variant};
+      in
+      [ "f /etc/bird/static.conf - - - - route ${route} blackhole;" ];
+  };
+
+  makeBird2Host = hostId: { pkgs, ... }: {
+    imports = [ (hostShared hostId) ];
+
+    services.bird2 = {
+      enable = true;
+
+      config = ''
+        log syslog all;
+
+        debug protocols all;
+
+        router id 10.0.0.${hostId};
+
+        protocol device {
+        }
+
+        protocol kernel kernel4 {
+          ipv4 {
+            import none;
+            export all;
+          };
+        }
+
+        protocol static static4 {
+          ipv4;
+          include "static4.conf";
+        }
+
+        protocol ospf v2 ospf4 {
+          ipv4 {
+            export all;
+          };
+          area 0 {
+            interface "eth1" {
+              hello 5;
+              wait 5;
+            };
+          };
+        }
+
+        protocol kernel kernel6 {
+          ipv6 {
+            import none;
+            export all;
+          };
+        }
+
+        protocol static static6 {
+          ipv6;
+          include "static6.conf";
+        }
+
+        protocol ospf v3 ospf6 {
+          ipv6 {
+            export all;
+          };
+          area 0 {
+            interface "eth1" {
+              hello 5;
+              wait 5;
+            };
+          };
+        }
+      '';
+
+      preCheckConfig = ''
+        echo "route 1.2.3.4/32 blackhole;" > static4.conf
+        echo "route fd00::/128 blackhole;" > static6.conf
+      '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "f /etc/bird/static4.conf - - - - route 10.10.0.${hostId}/32 blackhole;"
+      "f /etc/bird/static6.conf - - - - route fdff::${hostId}/128 blackhole;"
+    ];
+  };
+in
+{
+  bird = birdTest true;
+  bird6 = birdTest false;
+  bird2 = bird2Test;
+}

nixos/tests/geth.nix

@@ -31,7 +31,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     machine.wait_for_open_port(18545)
 
     machine.succeed(
-        'geth attach --exec "eth.chainId()" http://localhost:8545 | grep \'"0x0"\' '
+        'geth attach --exec eth.blockNumber http://localhost:8545 | grep \'^0$\' '
     )
 
     machine.succeed(

nixos/tests/home-assistant.nix

@@ -49,6 +49,12 @@ in {
           payload_on = "let_there_be_light";
           payload_off = "off";
         }];
+        wake_on_lan = {};
+        switch = [{
+          platform = "wake_on_lan";
+          mac = "00:11:22:33:44:55";
+          host = "127.0.0.1";
+        }];
         # tests component-based capability assignment (CAP_NET_BIND_SERVICE)
         emulated_hue = {
           host_ip = "127.0.0.1";
@@ -99,6 +105,10 @@ in {
         print("\n### home-assistant.log ###\n")
         print(output_log + "\n")
 
+    # wait for home-assistant to fully boot
+    hass.sleep(30)
+    hass.wait_for_unit("home-assistant.service")
+
     with subtest("Check that no errors were logged"):
         assert "ERROR" not in output_log
 

nixos/tests/mpd.nix

@@ -96,7 +96,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
     };
 
   testScript = ''
-    mpc = "${pkgs.mpc_cli}/bin/mpc --wait"
+    mpc = "${pkgs.mpc-cli}/bin/mpc --wait"
 
     # Connects to the given server and attempts to play a tune.
     def play_some_music(server):

nixos/tests/teeworlds.nix

@@ -36,12 +36,12 @@ in {
       client1.wait_for_x()
       client2.wait_for_x()
 
-      client1.execute("teeworlds 'player_name Alice;connect server'&")
+      client1.execute("teeworlds 'player_name Alice;connect server' >&2 &")
       server.wait_until_succeeds(
           'journalctl -u teeworlds -e | grep --extended-regexp -q "team_join player=\'[0-9]:Alice"'
       )
 
-      client2.execute("teeworlds 'player_name Bob;connect server'&")
+      client2.execute("teeworlds 'player_name Bob;connect server' >&2 &")
       server.wait_until_succeeds(
           'journalctl -u teeworlds -e | grep --extended-regexp -q "team_join player=\'[0-9]:Bob"'
       )

pkgs/applications/audio/clerk/default.nix

@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , makeWrapper
 , rofi
-, mpc_cli
+, mpc-cli
 , perl
 , util-linux
 , python3Packages
@@ -28,11 +28,24 @@ stdenv.mkDerivation {
 
   strictDeps = true;
 
-  installPhase = ''
-    DESTDIR=$out PREFIX=/ make install
-    wrapProgram $out/bin/clerk \
-      --prefix PATH : "${lib.makeBinPath [ rofi mpc_cli perl util-linux libnotify ]}"
-  '';
+  installPhase =
+    let
+      binPath = lib.makeBinPath [
+        libnotify
+        mpc-cli
+        perl
+        rofi
+        util-linux
+      ];
+    in
+      ''
+        runHook preInstall
+
+        DESTDIR=$out PREFIX=/ make install
+        wrapProgram $out/bin/clerk --prefix PATH : "${binPath}"
+
+        runHook postInstall
+      '';
 
   meta = with lib; {
     description = "An MPD client built on top of rofi";

pkgs/applications/audio/cyanrip/default.nix

@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "cyanrip";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "cyanreg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0lgb92sfpf4w3nj5vlj6j7931mj2q3cmcx1app9snf853jk9ahmw";
+    sha256 = "1aip52bwkq8cb1d8ifyv2m6m5dz7jk6qmbhyb97yyf4nhxv445ky";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/cyanreg/cyanrip";
     description = "Bule-ish CD ripper";
-    license = licenses.lgpl3Plus;
+    license = licenses.lgpl21Plus;
     platforms = platforms.all;
     maintainers = [ maintainers.zane ];
   };

pkgs/applications/audio/mpc/default.nix

@@ -2,12 +2,13 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
+, installShellFiles
+, libiconv
+, libmpdclient
 , meson
 , ninja
 , pkg-config
-, libmpdclient
 , sphinx
-, libiconv
 }:
 
 stdenv.mkDerivation rec {
@@ -15,10 +16,10 @@ stdenv.mkDerivation rec {
   version = "0.34";
 
   src = fetchFromGitHub {
-    owner  = "MusicPlayerDaemon";
-    repo   = "mpc";
-    rev    = "v${version}";
-    sha256 = "sha256-2FjYBfak0IjibuU+CNQ0y9Ei8hTZhynS/BK2DNerhVw=";
+    owner = "MusicPlayerDaemon";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-2FjYBfak0IjibuU+CNQ0y9Ei8hTZhynS/BK2DNerhVw=";
   };
 
   patches = [
@@ -29,15 +30,33 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [ libmpdclient ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
+  buildInputs = [
+    libmpdclient
+  ]
+  ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
-  nativeBuildInputs = [ meson ninja pkg-config sphinx ];
+  nativeBuildInputs = [
+    installShellFiles
+    meson
+    ninja
+    pkg-config
+    sphinx
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd mpc --bash $out/share/doc/mpc/contrib/mpc-completion.bash
+  '';
+
+  postFixup = ''
+    rm $out/share/doc/mpc/contrib/mpc-completion.bash
+  '';
 
   meta = with lib; {
-    description = "A minimalist command line interface to MPD";
     homepage = "https://www.musicpd.org/clients/mpc/";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ algorith ncfavier ];
-    platforms = with platforms; linux ++ darwin;
+    description = "A minimalist command line interface to MPD";
+    changelog = "https://raw.githubusercontent.com/MusicPlayerDaemon/mpc/v${version}/NEWS";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = with platforms; unix;
   };
 }

pkgs/applications/audio/spotify/default.nix

@@ -10,14 +10,14 @@ let
   # If an update breaks things, one of those might have valuable info:
   # https://aur.archlinux.org/packages/spotify/
   # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.1.72.439.gc253025e";
+  version = "1.1.77.643.g3c4c6fc6";
   # To get the latest stable revision:
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
   # To get general information:
   # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
   # More examples of api usage:
   # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "56";
+  rev = "57";
 
   deps = [
     alsa-lib
@@ -80,7 +80,7 @@ stdenv.mkDerivation {
   # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
   src = fetchurl {
     url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    sha512 = "b2bd3d49a18dfebaa4660f9c39d11d57fb80a4ef15ec7b7973e3cc07be74f74aebd2d8c66360d79fe778244c533ed02f9dfca4085f99aae0e5faae7c003ba4ef";
+    sha512 = "d9f8fe692db479bcce1f47c87b65c5ac6d62e16b76a0f9b2d693d82d2b9ed2c7cf370cb091ce8ecd291c47d1efdbaa897c9bffb210edd901dc3d5425995229f7";
   };
 
   nativeBuildInputs = [ makeWrapper wrapGAppsHook squashfsTools ];

pkgs/applications/editors/neovim/default.nix

@@ -113,8 +113,10 @@ in
       substituteInPlace src/nvim/CMakeLists.txt --replace "    util" ""
     '';
 
-    # For treesitter plugins, libstdc++.so.6 will be needed
-    NIX_LDFLAGS = [ "-lstdc++"];
+    # For treesitter plugins, libstdc++.so.6, or equivalent will be needed
+    NIX_LDFLAGS =
+      lib.optionals stdenv.cc.isGNU [ "-lstdc++"]
+      ++ lib.optionals stdenv.cc.isClang [ "-lc++" ];
 
     # export PATH=$PWD/build/bin:${PATH}
     shellHook=''

pkgs/applications/gis/grass/default.nix

@@ -1,24 +1,25 @@
 { lib, stdenv, fetchFromGitHub, flex, bison, pkg-config, zlib, libtiff, libpng, fftw
-, cairo, readline, ffmpeg_3, makeWrapper, wxGTK30, netcdf, blas
-, proj, gdal, geos, sqlite, postgresql, libmysqlclient, python2Packages, libLAS, proj-datumgrid
+, cairo, readline, ffmpeg, makeWrapper, wxGTK30, netcdf, blas
+, proj, gdal, geos, sqlite, postgresql, libmysqlclient, python3Packages, libLAS, proj-datumgrid
+, zstd, pdal, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
   name = "grass";
-  version = "7.6.1";
+  version = "7.8.6";
 
   src = with lib; fetchFromGitHub {
     owner = "OSGeo";
     repo = "grass";
-    rev = "${name}_${replaceStrings ["."] ["_"] version}";
-    sha256 = "1amjk9rz7vw5ha7nyl5j2bfwj5if9w62nlwx5qbp1x7spldimlll";
+    rev = version;
+    sha256 = "sha256-zvZqFWuxNyA+hu+NMiRbQVdzzrQPsZrdGdfVB17+SbM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ flex bison zlib proj gdal libtiff libpng fftw sqlite cairo proj
-  readline ffmpeg_3 makeWrapper wxGTK30 netcdf geos postgresql libmysqlclient blas
-  libLAS proj-datumgrid ]
-    ++ (with python2Packages; [ python python-dateutil wxPython30 numpy ]);
+  buildInputs = [ flex bison zlib proj gdal libtiff libpng fftw sqlite cairo
+  readline ffmpeg makeWrapper wxGTK30 netcdf geos postgresql libmysqlclient blas
+  libLAS proj-datumgrid zstd pdal wrapGAppsHook ]
+    ++ (with python3Packages; [ python python-dateutil wxPython_4_1 numpy ]);
 
   # On Darwin the installer tries to symlink the help files into a system
   # directory
@@ -37,6 +38,7 @@ stdenv.mkDerivation rec {
     "--with-readline"
     "--with-wxwidgets"
     "--with-netcdf"
+    "--with-pdal"
     "--with-geos"
     "--with-postgres"
     "--with-postgres-libs=${postgresql.lib}/lib/"
@@ -46,6 +48,9 @@ stdenv.mkDerivation rec {
     "--with-mysql-libs=${libmysqlclient}/lib/mysql"
     "--with-blas"
     "--with-liblas=${libLAS}/bin/liblas-config"
+    "--with-zstd"
+    "--with-fftw"
+    "--with-pthread"
   ];
 
   # Otherwise a very confusing "Can't load GDAL library" error
@@ -62,6 +67,7 @@ stdenv.mkDerivation rec {
       scripts/g.extension.all/g.extension.all.py \
       scripts/r.drain/r.drain.py \
       scripts/r.pack/r.pack.py \
+      scripts/r.import/r.import.py \
       scripts/r.tileset/r.tileset.py \
       scripts/r.unpack/r.unpack.py \
       scripts/v.clip/v.clip.py \
@@ -79,18 +85,17 @@ stdenv.mkDerivation rec {
       temporal/t.rast.algebra/t.rast.algebra.py \
       temporal/t.rast3d.algebra/t.rast3d.algebra.py \
       temporal/t.vect.algebra/t.vect.algebra.py \
+      temporal/t.downgrade/t.downgrade.py \
       temporal/t.select/t.select.py
     for d in gui lib scripts temporal tools; do
       patchShebangs $d
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
-
   postInstall = ''
-    wrapProgram $out/bin/grass76 \
+    wrapProgram $out/bin/grass78 \
     --set PYTHONPATH $PYTHONPATH \
-    --set GRASS_PYTHON ${python2Packages.python}/bin/${python2Packages.python.executable} \
+    --set GRASS_PYTHON ${python3Packages.python.interpreter} \
     --suffix LD_LIBRARY_PATH ':' '${gdal}/lib'
     ln -s $out/grass*/lib $out/lib
     ln -s $out/grass*/include $out/include

pkgs/applications/gis/qgis/default.nix

@@ -1,17 +1,21 @@
 { lib, makeWrapper, symlinkJoin
-, qgis-unwrapped, extraPythonPackages ? (ps: [ ])
+, extraPythonPackages ? (ps: [ ])
+, libsForQt5
 }:
 with lib;
-symlinkJoin rec {
+let
+  qgis-unwrapped = libsForQt5.callPackage ./unwrapped.nix {  };
+in symlinkJoin rec {
+
   inherit (qgis-unwrapped) version;
   name = "qgis-${version}";
 
   paths = [ qgis-unwrapped ];
 
-  nativeBuildInputs = [ makeWrapper qgis-unwrapped.python3Packages.wrapPython ];
+  nativeBuildInputs = [ makeWrapper qgis-unwrapped.py.pkgs.wrapPython ];
 
   # extend to add to the python environment of QGIS without rebuilding QGIS application.
-  pythonInputs = qgis-unwrapped.pythonBuildInputs ++ (extraPythonPackages qgis-unwrapped.python3Packages);
+  pythonInputs = qgis-unwrapped.pythonBuildInputs ++ (extraPythonPackages qgis-unwrapped.py.pkgs);
 
   postBuild = ''
     # unpackPhase
@@ -23,5 +27,7 @@ symlinkJoin rec {
       --set PYTHONPATH $program_PYTHONPATH
   '';
 
+  passthru.unwrapped = qgis-unwrapped;
+
   meta = qgis-unwrapped.meta;
 }

pkgs/applications/gis/qgis/ltr.nix

@@ -0,0 +1,32 @@
+{ lib, makeWrapper, symlinkJoin
+, extraPythonPackages ? (ps: [ ])
+, libsForQt5
+}:
+with lib;
+let
+  qgis-ltr-unwrapped = libsForQt5.callPackage ./unwrapped-ltr.nix {  };
+in symlinkJoin rec {
+
+  inherit (qgis-ltr-unwrapped) version;
+  name = "qgis-${version}";
+
+  paths = [ qgis-ltr-unwrapped ];
+
+  nativeBuildInputs = [ makeWrapper qgis-ltr-unwrapped.py.pkgs.wrapPython ];
+
+  # extend to add to the python environment of QGIS without rebuilding QGIS application.
+  pythonInputs = qgis-ltr-unwrapped.pythonBuildInputs ++ (extraPythonPackages qgis-ltr-unwrapped.py.pkgs);
+
+  postBuild = ''
+
+    buildPythonPath "$pythonInputs"
+
+    wrapProgram $out/bin/qgis \
+      --prefix PATH : $program_PATH \
+      --set PYTHONPATH $program_PYTHONPATH
+  '';
+
+  passthru.unwrapped = qgis-ltr-unwrapped;
+
+  inherit (qgis-ltr-unwrapped) meta;
+}

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -0,0 +1,148 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, ninja
+, flex
+, bison
+, proj
+, geos
+, xlibsWrapper
+, sqlite
+, gsl
+, qwt
+, fcgi
+, python3
+, libspatialindex
+, libspatialite
+, postgresql
+, txt2tags
+, openssl
+, libzip
+, hdf5
+, netcdf
+, exiv2
+, protobuf
+, qtbase
+, qtsensors
+, qca-qt5
+, qtkeychain
+, qt3d
+, qscintilla
+, qtserialport
+, qtxmlpatterns
+, withGrass ? true
+, grass
+, withWebKit ? true
+, qtwebkit
+, makeWrapper
+}:
+
+let
+
+  py = python3.override {
+    packageOverrides = self: super: {
+      pyqt5 = super.pyqt5.override {
+        withLocation = true;
+      };
+    };
+  };
+
+  pythonBuildInputs = with py.pkgs; [
+    qscintilla-qt5
+    gdal
+    jinja2
+    numpy
+    psycopg2
+    chardet
+    python-dateutil
+    pyyaml
+    pytz
+    requests
+    urllib3
+    pygments
+    pyqt5
+    sip_4
+    owslib
+    six
+  ];
+in mkDerivation rec {
+  version = "3.16.16";
+  pname = "qgis-ltr-unwrapped";
+
+  src = fetchFromGitHub {
+    owner = "qgis";
+    repo = "QGIS";
+    rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
+    sha256 = "85RlV1Ik1BeN9B7UE51ktTWMiGkMga2E/fnhyiVwjIs=";
+  };
+
+  passthru = {
+    inherit pythonBuildInputs;
+    inherit py;
+  };
+
+  buildInputs = [
+    openssl
+    proj
+    geos
+    xlibsWrapper
+    sqlite
+    gsl
+    qwt
+    exiv2
+    protobuf
+    fcgi
+    libspatialindex
+    libspatialite
+    postgresql
+    txt2tags
+    libzip
+    hdf5
+    netcdf
+    qtbase
+    qtsensors
+    qca-qt5
+    qtkeychain
+    qscintilla
+    qtserialport
+    qtxmlpatterns
+    qt3d
+  ] ++ lib.optional withGrass grass
+    ++ lib.optional withWebKit qtwebkit
+    ++ pythonBuildInputs;
+
+  nativeBuildInputs = [ makeWrapper cmake flex bison ninja ];
+
+  # Force this pyqt_sip_dir variable to point to the sip dir in PyQt5
+  #
+  # TODO: Correct PyQt5 to provide the expected directory and fix
+  # build to use PYQT5_SIP_DIR consistently.
+  postPatch = ''
+    substituteInPlace cmake/FindPyQt5.py \
+      --replace 'sip_dir = cfg.default_sip_dir' 'sip_dir = "${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}/PyQt5/bindings"'
+  '';
+
+  cmakeFlags = [
+    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
+    "-DWITH_3D=True"
+    "-DPYQT5_SIP_DIR=${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}/PyQt5/bindings"
+    "-DQSCI_SIP_DIR=${py.pkgs.qscintilla-qt5}/${py.pkgs.python.sitePackages}/PyQt5/bindings"
+  ] ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
+    ++ lib.optional withGrass "-DGRASS_PREFIX7=${grass}/grass78";
+
+  postFixup = lib.optionalString withGrass ''
+    # grass has to be availble on the command line even though we baked in
+    # the path at build time using GRASS_PREFIX
+    wrapProgram $out/bin/qgis \
+      --prefix PATH : ${lib.makeBinPath [ grass ]}
+  '';
+
+  meta = with lib; {
+    description = "A Free and Open Source Geographic Information System";
+    homepage = "https://www.qgis.org";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lsix sikmir erictapen ];
+  };
+}

pkgs/applications/gis/qgis/unwrapped.nix

@@ -12,7 +12,7 @@
 , gsl
 , qwt
 , fcgi
-, python3Packages
+, python3
 , libspatialindex
 , libspatialite
 , postgresql
@@ -27,6 +27,7 @@
 , qtsensors
 , qca-qt5
 , qtkeychain
+, qt3d
 , qscintilla
 , qtserialport
 , qtxmlpatterns
@@ -34,10 +35,22 @@
 , grass
 , withWebKit ? true
 , qtwebkit
+, pdal
+, zstd
+, makeWrapper
 }:
 
 let
-  pythonBuildInputs = with python3Packages; [
+
+  py = python3.override {
+    packageOverrides = self: super: {
+      pyqt5 = super.pyqt5.override {
+        withLocation = true;
+      };
+    };
+  };
+
+  pythonBuildInputs = with py.pkgs; [
     qscintilla-qt5
     gdal
     jinja2
@@ -56,19 +69,19 @@ let
     six
   ];
 in mkDerivation rec {
-  version = "3.16.14";
+  version = "3.22.3";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-3FUGSBdlhJhhpTPtYuzKOznsC7PJV3kRL9Il2Yryi1Q=";
+    sha256 = "TLXhXHU0dp0MnKHFw/+1rQnJbebnwje21Oasy0qWctk=";
   };
 
   passthru = {
     inherit pythonBuildInputs;
-    inherit python3Packages;
+    inherit py;
   };
 
   buildInputs = [
@@ -96,11 +109,14 @@ in mkDerivation rec {
     qscintilla
     qtserialport
     qtxmlpatterns
+    qt3d
+    pdal
+    zstd
   ] ++ lib.optional withGrass grass
     ++ lib.optional withWebKit qtwebkit
     ++ pythonBuildInputs;
 
-  nativeBuildInputs = [ cmake flex bison ninja ];
+  nativeBuildInputs = [ makeWrapper cmake flex bison ninja ];
 
   # Force this pyqt_sip_dir variable to point to the sip dir in PyQt5
   #
@@ -108,15 +124,24 @@ in mkDerivation rec {
   # build to use PYQT5_SIP_DIR consistently.
   postPatch = ''
     substituteInPlace cmake/FindPyQt5.py \
-      --replace 'sip_dir = cfg.default_sip_dir' 'sip_dir = "${python3Packages.pyqt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"'
+      --replace 'sip_dir = cfg.default_sip_dir' 'sip_dir = "${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}/PyQt5/bindings"'
   '';
 
   cmakeFlags = [
     "-DCMAKE_SKIP_BUILD_RPATH=OFF"
-    "-DPYQT5_SIP_DIR=${python3Packages.pyqt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"
-    "-DQSCI_SIP_DIR=${python3Packages.qscintilla-qt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"
+    "-DWITH_3D=True"
+    "-DWITH_PDAL=TRUE"
+    "-DPYQT5_SIP_DIR=${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}/PyQt5/bindings"
+    "-DQSCI_SIP_DIR=${py.pkgs.qscintilla-qt5}/${py.pkgs.python.sitePackages}/PyQt5/bindings"
   ] ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
-    ++ lib.optional withGrass "-DGRASS_PREFIX7=${grass}/${grass.name}";
+    ++ lib.optional withGrass "-DGRASS_PREFIX7=${grass}/grass78";
+
+  postFixup = lib.optionalString withGrass ''
+    # grass has to be availble on the command line even though we baked in
+    # the path at build time using GRASS_PREFIX
+    wrapProgram $out/bin/qgis \
+      --prefix PATH : ${lib.makeBinPath [ grass ]}
+  '';
 
   meta = {
     description = "A Free and Open Source Geographic Information System";

pkgs/applications/kde/kio-extras.nix

@@ -19,5 +19,12 @@ mkDerivation {
     kpty syntax-highlighting libmtp libssh openexr openslp
     phonon qtsvg samba solid gperf
   ];
+
+  # org.kde.kmtpd5 DBUS service launches kiod5 binary from kio derivation, not from kio-extras
+  postInstall = ''
+    substituteInPlace $out/share/dbus-1/services/org.kde.kmtpd5.service \
+      --replace Exec=$out Exec=${kio}
+  '';
+
   CXXFLAGS = [ "-I${ilmbase.dev}/include/OpenEXR" ];
 }

pkgs/applications/misc/cherrytree/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cherrytree";
-  version = "0.99.44";
+  version = "0.99.45";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = version;
-    sha256 = "sha256-13wZb+PxeCrQ3MpewMnqBHO8QnoCRFhKU4awTdYtFd4=";
+    sha256 = "sha256-DGhzqv7huFVgCdXy3DuIBT+7s2q6FB7+gFPd4zEXi2M=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/fme/default.nix

@@ -1,59 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, autoconf
-, automake
-, bc
-, fluxbox
-, gettext
-, glibmm
-, gtkmm2
-, libglademm
-, libsigcxx
-, pkg-config
-}:
-
-stdenv.mkDerivation rec {
-  pname = "fme";
-  version = "1.1.3";
-
-  src = fetchFromGitHub {
-    owner = "rdehouss";
-    repo = "fme";
-    rev = "v${version}";
-    sha256 = "sha256-P67OmExBdWM6NZhDyYceVJOZiy8RC+njk/QvgQcWZeQ=";
-  };
-
-  nativeBuildInputs = [
-    autoconf
-    automake
-    gettext
-    pkg-config
-  ];
-  buildInputs = [
-    bc
-    fluxbox
-    glibmm
-    gtkmm2
-    libglademm
-    libsigcxx
-  ];
-
-  preConfigure = ''
-    ./autogen.sh
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/rdehouss/fme/";
-    description = "Editor for Fluxbox menus";
-    longDescription = ''
-      Fluxbox Menu Editor is a menu editor for the Window Manager Fluxbox
-      written in C++ with the libraries Gtkmm, Glibmm, libglademm and gettext
-      for internationalization.  Its user-friendly interface will help you to
-      edit, delete, move (Drag and Drop) a row, a submenu, etc very easily.
-    '';
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
-  };
-}

pkgs/applications/misc/metadata-cleaner/default.nix

@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "metadata-cleaner";
-  version = "2.1.3";
+  version = "2.1.4";
 
   format = "other";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "rmnvgr";
     repo = "metadata-cleaner";
     rev = "v${version}";
-    hash = "sha256-9sLjgqqQBXcudlBRmqAwWcWMUXoIUyAK272zaNKbJNY=";
+    hash = "sha256-46J0iLXzZX5tww4CK8WhrADql023rauO0fpW7Asn5ZY=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/mob/default.nix

@@ -9,13 +9,13 @@
 
 buildGoPackage rec {
   pname = "mob";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "remotemobprogramming";
     repo = pname;
-    sha256 = "sha256-nf0FSaUi8qX1f4Luo0cP4ZLoOKbyvgmpilMOWXbzzIM=";
+    sha256 = "sha256-1yE3KFGY51m6OL4LYrz+BSCHQSnbQRSpB3EUqAzSr+M=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/nwg-wrapper/default.nix

@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "nwg-wrapper";
-  version = "0.1.0";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0xkxyfbj8zljx7k5wbniz3x9jg0l4jnbbjv8hy5y5p4l10m0vpjs";
+    sha256 = "114y55mv2rgnp75a3c7rk46v5v84d1zqb6wkha7x16ab6xa9phzl";
   };
 
   nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];

pkgs/applications/misc/rivercarro/default.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rivercarro";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromSourcehut {
     owner = "~novakane";
     repo = pname;
     fetchSubmodules = true;
     rev = "v${version}";
-    sha256 = "0h1wvl6rlrpr67zl51x71hy7nwkfd5kfv5p2mql6w5fybxxyqnpm";
+    sha256 = "07md837ki0yln464w8vgwyl3yjrvkz1p8alxlmwqfn4w45nqhw77";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/blocky/default.nix

@@ -0,0 +1,30 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "blocky";
+  version = "0.17";
+
+  src = fetchFromGitHub {
+    owner = "0xERR0R";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-vG6QAI8gBI2nLRQ0nOFWQHihyzgmJu69rgkWlg3iW3E=";
+  };
+
+  # needs network connection and fails at
+  # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
+  doCheck = false;
+
+  vendorSha256 = "sha256-+mpNPDejK9Trhw41SUXJPL/OX5wQR0QfA2+BXSlE0Jk=";
+
+  meta = with lib; {
+    description = "Fast and lightweight DNS proxy as ad-blocker for local network with many features.";
+    homepage = "https://0xerr0r.github.io/blocky";
+    changelog = "https://github.com/0xERR0R/blocky/releases";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ratsclub ];
+  };
+}

pkgs/applications/networking/cluster/fluxcd/default.nix

@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.24.1";
-  sha256 = "18jzf5kd06c10f45y4crvaqa5r10dhq2ashlhppzrmhigiyavxac";
-  manifestsSha256 = "0qbdik65irnwgw7klj5w0z00jxflm855gikpnqb9gsxd7rbw8ysk";
+  version = "0.25.3";
+  sha256 = "1j7jw6vfki67dz9lkx3f94b9hi6d2bc504yy3nfppp3hx8nwxb37";
+  manifestsSha256 = "1akp1i3xasfjq6zqbk7mnbkhnzmq7if7v82q6zdp2678xrg6xps5";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-HoAVdY+kZLpUEl3mE7obbTzAJUyt5MBPjGhs6ZDSnzU=";
+  vendorSha256 = "sha256-/VeJq6l3kSZ9qcYf2ypyyoXVKME+rig6aDdWDoRqNzA=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests

pkgs/applications/networking/cluster/helm/default.nix

@@ -1,23 +1,24 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ lib, buildGo117Module, fetchFromGitHub, installShellFiles }:
 
-buildGoModule rec {
+buildGo117Module rec {
   pname = "helm";
-  version = "3.7.2";
-  gitCommit = "663a896f4a815053445eec4153677ddc24a0a361";
+  version = "3.8.0";
+  gitCommit = "d14138609b01886f544b2025f5000351c9eb092e";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-MhBuwpgF1PBAZ5QwF7t4J1gqam2cMX+hkdZs7KoSD6I=";
+    sha256 = "sha256-/vxf3YfBP1WHFpqll6iq4m+X4NA16qHnuGA0wvrVRsg=";
   };
-  vendorSha256 = "sha256-YDdpeVh9rG3MF1HgG7uuRvjXDr9Fcjuhrj16kpK8tsI=";
+  vendorSha256 = "sha256-M7XId+2HIh1mFzU54qQZEisWdVq67RlGJjlw+2dpiDc=";
 
   doCheck = false;
 
   subPackages = [ "cmd/helm" ];
   ldflags = [
-    "-w" "-s"
+    "-w"
+    "-s"
     "-X helm.sh/helm/v3/internal/version.version=v${version}"
     "-X helm.sh/helm/v3/internal/version.gitCommit=${gitCommit}"
   ];

pkgs/applications/networking/cluster/istioctl/default.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    sha256 = "sha256-oMf60mxreBSlgxVInTFM8kozYVZz5RdgzV3rYUnadnA=";
+    sha256 = "sha256-6eVFyGVvOUr5RA5jeavKcLJedv4jOGXAg3aa4N3cNx8=";
   };
-  vendorSha256 = "sha256-e8qh8J745TXUo6c1uMS8GyawEG9YFlMYl/nHpWIFK1Q=";
+  vendorSha256 = "sha256-ie7XRu+2+NmhMNtJEL2OgZH6wuTPJX9O2+cZBnI04JA=";
 
   doCheck = false;
 

pkgs/applications/networking/cluster/lens/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, appimageTools }:
+{ lib, fetchurl, appimageTools, wrapGAppsHook, gsettings-desktop-schemas, gtk3 }:
 
 let
   pname = "lens";
@@ -19,6 +19,10 @@ let
 in appimageTools.wrapType2 {
   inherit name src;
 
+  profile = ''
+    export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
+  '';
+
   extraInstallCommands =
     ''
       mv $out/bin/${name} $out/bin/${pname}

pkgs/applications/networking/cluster/minikube/default.nix

@@ -11,9 +11,9 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.24.0";
+  version = "1.25.1";
 
-  vendorSha256 = "sha256-jFE4aHHgVmVcQu8eH97h9P3zchtmKv/KUIfv7f2ws3I=";
+  vendorSha256 = "sha256-MnyXePsnhb1Tl76uAtVW/DLacE0etXREGsapgNiZbMo=";
 
   doCheck = false;
 
@@ -21,7 +21,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "sha256-WW5VVjm7cq/3/RGiIE2nn8O+VK0RHCtKkrlboIzhqC4=";
+    sha256 = "sha256-pRNOVN9u27im9fkUawJYjuGHTW0N7L5oJa3fQ6DUO+4=";
   };
 
   nativeBuildInputs = [ installShellFiles pkg-config which ];

pkgs/applications/networking/cluster/sonobuoy/default.nix

@@ -1,11 +1,11 @@
 { lib, buildGoModule, fetchFromGitHub }:
 
 # SHA of ${version} for the tool's help output. Unfortunately this is needed in build flags.
-let rev = "237bd35906f5c4bed1f4de4aa58cc6a6a676d4fd";
+let rev = "0665cd322b11bb40c2774776de765c38d8104bed";
 in
 buildGoModule rec {
   pname = "sonobuoy";
-  version = "0.55.1"; # Do not forget to update `rev` above
+  version = "0.56.0"; # Do not forget to update `rev` above
 
   ldflags =
     let t = "github.com/vmware-tanzu/sonobuoy";
@@ -20,10 +20,10 @@ buildGoModule rec {
     owner = "vmware-tanzu";
     repo = "sonobuoy";
     rev = "v${version}";
-    sha256 = "sha256-pHpnh+6O9yjnDA8u0jyLvqNQbXC+xz8fRn47aQNdOAo=";
+    sha256 = "sha256-78skqo3sq567s3/XN54xtC0mefDY3Io3BD0d+JP7k5Q=";
   };
 
-  vendorSha256 = "sha256-jPKCWTFABKRZCg6X5VVdrmOU/ZFc7yGD7R8RJrpcITg=";
+  vendorSha256 = "sha256-qKXm39CwrTcXENIMh2BBS3MUlhJvmTTA3UzZNpF0PCc=";
 
   subPackages = [ "." ];
 

pkgs/applications/networking/cluster/talosctl/default.nix

@@ -0,0 +1,44 @@
+{ lib, buildGo117Module, fetchFromGitHub }:
+
+buildGo117Module rec {
+  pname = "talosctl";
+  version = "0.14.1";
+
+  src = fetchFromGitHub {
+    owner = "talos-systems";
+    repo = "talos";
+    rev = "v${version}";
+    sha256 = "sha256-JeZ+Q6LTDJtoxfu4mJNc3wv3Y6OPcIUvgnozj9mWwLw=";
+  };
+
+  vendorSha256 = "sha256-ujbEWvcNJJOUegVgAGEPwYF02TiqD1lZELvqc/Gmb4A=";
+
+  # look for GO_LDFLAGS getting set in the Makefile
+  ldflags =
+    let
+      versionPkg = "github.com/talos-systems/talos/pkg/version"; # VERSION_PKG
+      imagesPkgs = "github.com/talos-systems/talos/pkg/images"; # IMAGES_PKGS
+      mgmtHelpersPkg = "github.com/talos-systems/talos/cmd/talosctl/pkg/mgmt/helpers"; #MGMT_HELPERS_PKG
+    in
+    [
+      "-X ${versionPkg}.Name=Talos"
+      "-X ${versionPkg}.SHA=${src.rev}" # should be the hash, but as we build from tags, this needs to do
+      "-X ${versionPkg}.Tag=${src.rev}"
+      "-X ${versionPkg}.PkgsVersion=v0.9.0-2-g447ce75" # PKGS
+      "-X ${versionPkg}.ExtrasVersion=v0.7.0-1-gd6b73a7" # EXTRAS
+      "-X ${imagesPkgs}.Username=talos-systems" # USERNAME
+      "-X ${imagesPkgs}.Registry=ghcr.io" # REGISTRY
+      "-X ${mgmtHelpersPkg}.ArtifactsPath=_out" # ARTIFACTS
+    ];
+
+  subPackages = [ "cmd/talosctl" ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A CLI for out-of-band management of Kubernetes nodes created by Talos";
+    homepage = "https://github.com/talos-systems/talos";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ flokli ];
+  };
+}

pkgs/applications/networking/ids/zeek/default.nix

@@ -21,16 +21,33 @@
 
 stdenv.mkDerivation rec {
   pname = "zeek";
-  version = "4.1.1";
+  version = "4.2.0";
 
   src = fetchurl {
     url = "https://download.zeek.org/zeek-${version}.tar.gz";
-    sha256 = "0wq3kjc3zc5ikzwix7k7gr92v75rg6283kx5fzvc3lcdkaczq2lc";
+    sha256 = "sha256-jZoCjKn+x61KnkinY+KWBSOEz0AupM03FXe/8YPCdFE=";
   };
 
-  nativeBuildInputs = [ cmake flex bison file ];
-  buildInputs = [ openssl libpcap zlib curl libmaxminddb gperftools python3 swig ncurses ]
-    ++ lib.optionals stdenv.isDarwin [ gettext ];
+  nativeBuildInputs = [
+    bison
+    cmake
+    file
+    flex
+  ];
+
+  buildInputs = [
+    curl
+    gperftools
+    libmaxminddb
+    libpcap
+    ncurses
+    openssl
+    python3
+    swig
+    zlib
+  ] ++ lib.optionals stdenv.isDarwin [
+    gettext
+  ];
 
   outputs = [ "out" "lib" "py" ];
 
@@ -54,7 +71,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Powerful network analysis framework much different from a typical IDS";
+    description = "Network analysis framework much different from a typical IDS";
     homepage = "https://www.zeek.org";
     changelog = "https://github.com/zeek/zeek/blob/v${version}/CHANGES";
     license = licenses.bsd3;

pkgs/applications/networking/instant-messengers/kdeltachat/default.nix

@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "kdeltachat";
-  version = "unstable-2021-12-26";
+  version = "unstable-2022-01-02";
 
   src = fetchFromSourcehut {
     owner = "~link2xt";
     repo = "kdeltachat";
-    rev = "aabe9421cb26f8e2537d49df5392e428bca8d72d";
-    hash = "sha256-5ql4KGMie9EbhHbPSNHIUQrvNpO//WgpTDIK6ETwdkg=";
+    rev = "ec545c8208c870c44312558f91c79e6ffce4444e";
+    hash = "sha256-s/dJ2ahdUK7ODKsna+tl81e+VQLkCAELb/iEXf9WlIM=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -28,11 +28,11 @@
 }:
 
 let
-  version = "5.9.1.1380";
+  version = "5.9.3.1911";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${version}/zoom_x86_64.pkg.tar.xz";
-      sha256 = "0r1w13y3ks377hdyil9s68vn09vh22zl6ni4693fm7cf6q49ayyw";
+      sha256 = "0pamn028k96z0j9xzv56szk7sy0czd9myqm4p3hps1gkczc9wzs4";
     };
   };
 

pkgs/applications/networking/irc/wraith/configure.patch

@@ -1,8 +1,8 @@
 --- a/configure
 +++ b/configure
-@@ -6029,53 +6029,8 @@
+@@ -6143,53 +6143,8 @@ rm -f confcache
+ #AC_CHECK_HEADERS(openssl/ssl.h openssl/crypto.h)
  #AC_CHECK_HEADERS(zlib.h)
- #EGG_CHECK_ZLIB
  
 -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for path to OpenSSL" >&5
 -$as_echo_n "checking for path to OpenSSL... " >&6; }

pkgs/applications/networking/irc/wraith/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "wraith";
-  version = "1.4.7";
+  version = "1.4.10";
   src = fetchurl {
     url = "mirror://sourceforge/wraithbotpack/wraith-v${version}.tar.gz";
-    sha256 = "0h6liac5y7im0jfm2sj18mibvib7d1l727fjs82irsjj1v9kif3j";
+    sha256 = "1h8159g6wh1hi69cnhqkgwwwa95fa6z1zrzjl219mynbf6vjjzkw";
   };
   hardeningDisable = [ "format" ];
   buildInputs = [ openssl ];

pkgs/applications/networking/irc/wraith/dlopen.patch

@@ -1,15 +1,15 @@
 diff --git a/src/libcrypto.cc b/src/libcrypto.cc
-index 0339258..68746c8 100644
+index 5139f66..517103f 100644
 --- a/src/libcrypto.cc
 +++ b/src/libcrypto.cc
-@@ -95,17 +95,9 @@ int load_libcrypto() {
+@@ -100,17 +100,9 @@ int load_libcrypto() {
    }
  
    sdprintf("Loading libcrypto");
 +  dlerror(); // Clear Errors
 +  libcrypto_handle = dlopen("@openssl@/lib/libcrypto.so", RTLD_LAZY|RTLD_GLOBAL);
  
--  bd::Array<bd::String> libs_list(bd::String("libcrypto.so." SHLIB_VERSION_NUMBER " libcrypto.so libcrypto.so.0.9.8 libcrypto.so.7 libcrypto.so.6").split(' '));
+-  bd::Array<bd::String> libs_list(bd::String("libcrypto.so." SHLIB_VERSION_NUMBER " libcrypto.so libcrypto.so.1.1 libcrypto.so.1.0.0 libcrypto.so.0.9.8 libcrypto.so.10 libcrypto.so.9 libcrypto.so.8 libcrypto.so.7 libcrypto.so.6").split(' '));
 -
 -  for (size_t i = 0; i < libs_list.length(); ++i) {
 -    dlerror(); // Clear Errors
@@ -23,17 +23,17 @@ index 0339258..68746c8 100644
      fprintf(stderr, STR("Unable to find libcrypto\n"));
      return(1);
 diff --git a/src/libssl.cc b/src/libssl.cc
-index b432c7b..8940998 100644
+index 6010abc..86e29fc 100644
 --- a/src/libssl.cc
 +++ b/src/libssl.cc
-@@ -68,17 +68,9 @@ int load_libssl() {
+@@ -78,17 +78,9 @@ int load_libssl() {
    }
  
    sdprintf("Loading libssl");
 +  dlerror(); // Clear Errors
 +  libssl_handle = dlopen("@openssl@/lib/libssl.so", RTLD_LAZY);
  
--  bd::Array<bd::String> libs_list(bd::String("libssl.so." SHLIB_VERSION_NUMBER " libssl.so libssl.so.0.9.8 libssl.so.7 libssl.so.6").split(' '));
+-  bd::Array<bd::String> libs_list(bd::String("libssl.so." SHLIB_VERSION_NUMBER " libssl.so libssl.so.1.1 libssl.so.1.0.0 libssl.so.0.9.8 libssl.so.10 libssl.so.9 libssl.so.8 libssl.so.7 libssl.so.6").split(' '));
 -
 -  for (size_t i = 0; i < libs_list.length(); ++i) {
 -    dlerror(); // Clear Errors

pkgs/applications/networking/mailreaders/alot/default.nix

@@ -1,16 +1,29 @@
-{ lib, python3, fetchFromGitHub, file, gnupg, gawk, notmuch, procps, withManpage ? false
+{ lib
+, python3
+, fetchFromGitHub
+, file
+, gnupg
+, gawk
+, notmuch
+, procps
+, withManpage ? false
 }:
 
 with python3.pkgs;
-
 let
   notmuch2 = callPackage ./notmuch.nix {
     inherit notmuch;
   };
-in buildPythonApplication rec {
+in
+buildPythonApplication rec {
   pname = "alot";
   version = "0.10";
-  outputs = [ "out" ] ++ lib.optional withManpage "man";
+
+  outputs = [
+    "out"
+  ] ++ lib.optional withManpage [
+    "man"
+  ];
 
   disabled = !isPy3k;
 
@@ -22,48 +35,63 @@ in buildPythonApplication rec {
   };
 
   postPatch = ''
-    substituteInPlace alot/settings/manager.py --replace /usr/share "$out/share"
+    substituteInPlace alot/settings/manager.py \
+      --replace /usr/share "$out/share"
   '';
 
   nativeBuildInputs = lib.optional withManpage sphinx;
 
   propagatedBuildInputs = [
-    notmuch2
-    urwid
-    urwidtrees
-    twisted
-    python_magic
     configobj
-    service-identity
     file
     gpgme
+    notmuch2
+    python_magic
+    service-identity
+    twisted
+    urwid
+    urwidtrees
   ];
 
-  postBuild = lib.optionalString withManpage "make -C docs man";
+  checkInputs = [
+    future
+    gawk
+    gnupg
+    mock
+    procps
+    pytestCheckHook
+  ];
+
+  postBuild = lib.optionalString withManpage [
+    "make -C docs man"
+  ];
 
-  checkInputs = [ gawk future mock gnupg procps pytestCheckHook ];
-  # some twisted tests need internet access
   disabledTests = [
+    # Some twisted tests need internet access
     "test_env_set"
     "test_no_spawn_no_stdin_attached"
+    # DatabaseLockedError
+    "test_save_named_query"
   ];
 
-  postInstall = let
-    completionPython = python.withPackages (ps: [ ps.configobj ]);
-  in lib.optionalString withManpage ''
-    mkdir -p $out/man
-    cp -r docs/build/man $out/man
-  ''
-  + ''
-    mkdir -p $out/share/{applications,alot}
-    cp -r extra/themes $out/share/alot
+  postInstall =
+    let
+      completionPython = python.withPackages (ps: [ ps.configobj ]);
+    in
+    lib.optionalString withManpage ''
+      mkdir -p $out/man
+      cp -r docs/build/man $out/man
+    ''
+    + ''
+      mkdir -p $out/share/{applications,alot}
+      cp -r extra/themes $out/share/alot
 
-    substituteInPlace extra/completion/alot-completion.zsh \
-      --replace "python3" "${completionPython.interpreter}"
-    install -D extra/completion/alot-completion.zsh $out/share/zsh/site-functions/_alot
+      substituteInPlace extra/completion/alot-completion.zsh \
+        --replace "python3" "${completionPython.interpreter}"
+      install -D extra/completion/alot-completion.zsh $out/share/zsh/site-functions/_alot
 
-    sed "s,/usr/bin,$out/bin,g" extra/alot.desktop > $out/share/applications/alot.desktop
-  '';
+      sed "s,/usr/bin,$out/bin,g" extra/alot.desktop > $out/share/applications/alot.desktop
+    '';
 
   meta = with lib; {
     homepage = "https://github.com/pazz/alot";

pkgs/applications/networking/mullvad-vpn/default.nix

@@ -2,6 +2,7 @@
 , alsa-lib, atk, cairo, cups, dbus, expat, fontconfig, freetype
 , gdk-pixbuf, glib, gnome2, pango, nspr, nss, gtk3, mesa
 , xorg, autoPatchelfHook, systemd, libnotify, libappindicator
+, makeWrapper
 }:
 
 let deps = [
@@ -53,6 +54,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoPatchelfHook
     dpkg
+    makeWrapper
   ];
 
   buildInputs = deps;
@@ -73,12 +75,14 @@ stdenv.mkDerivation rec {
     mv usr/bin/* $out/bin
     mv opt/Mullvad\ VPN/* $out/share/mullvad
 
-    sed -i 's|"\/opt\/Mullvad.*VPN|env MULLVAD_DISABLE_UPDATE_NOTIFICATION=1 "'$out'/bin|g' $out/share/applications/mullvad-vpn.desktop
-
     ln -s $out/share/mullvad/mullvad-{gui,vpn} $out/bin/
     ln -s $out/share/mullvad/resources/mullvad-daemon $out/bin/mullvad-daemon
     ln -sf $out/share/mullvad/resources/mullvad-problem-report $out/bin/mullvad-problem-report
 
+    wrapProgram $out/bin/mullvad-vpn --set MULLVAD_DISABLE_UPDATE_NOTIFICATION 1
+
+    sed -i "s|Exec.*$|Exec=$out/bin/mullvad-vpn $U|" $out/share/applications/mullvad-vpn.desktop
+
     runHook postInstall
   '';
 

pkgs/applications/science/logic/isabelle/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, nettools, java, polyml, z3, veriT, vampire, eprover-ho, rlwrap, makeDesktopItem }:
+{ lib, stdenv, fetchurl, coreutils, nettools, java, polyml, z3, veriT, vampire, eprover-ho, rlwrap, makeDesktopItem }:
 # nettools needed for hostname
 
 stdenv.mkDerivation rec {
@@ -73,6 +73,11 @@ stdenv.mkDerivation rec {
     for comp in contrib/jdk* contrib/polyml-* contrib/z3-* contrib/verit-* contrib/vampire-* contrib/e-*; do
       rm -rf $comp/x86*
     done
+
+    substituteInPlace lib/Tools/env \
+      --replace /usr/bin/env ${coreutils}/bin/env
+
+    rm -r heaps
   '' + (if ! stdenv.isLinux then "" else ''
     arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
     for f in contrib/*/$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
@@ -83,6 +88,11 @@ stdenv.mkDerivation rec {
     done
   '');
 
+  buildPhase = ''
+    export HOME=$TMP # The build fails if home is not set
+    bin/isabelle build -v -o system_heaps -b HOL
+  '';
+
   installPhase = ''
     mkdir -p $out/bin
     mv $TMP/$dirname $out
@@ -117,7 +127,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://isabelle.in.tum.de/";
     license = licenses.bsd3;
-    maintainers = [ maintainers.jwiegley ];
+    maintainers = [ maintainers.jwiegley maintainers.jvanbruegge ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/science/logic/tamarin-prover/default.nix

@@ -79,6 +79,8 @@ mkDerivation (common "tamarin-prover" src // {
     # so that the package can be used as a vim plugin to install syntax coloration
     install -Dt $out/share/vim-plugins/tamarin-prover/syntax/ etc/syntax/spthy.vim
     install etc/filetype.vim -D $out/share/vim-plugins/tamarin-prover/ftdetect/tamarin.vim
+    # Emacs SPTHY major mode
+    install -Dt $out/share/emacs/site-lisp etc/spthy-mode.el
   '';
 
   checkPhase = "./dist/build/tamarin-prover/tamarin-prover test";

pkgs/applications/science/machine-learning/shogun/default.nix

@@ -6,7 +6,7 @@
   # build
 , cmake
 , ctags
-, python2Packages
+, python3Packages
 , swig
   # math
 , eigen
@@ -30,13 +30,13 @@
 , lp_solve
 , colpack
   # extra support
-, pythonSupport ? true
+, pythonSupport ? false
 , opencvSupport ? false
 , opencv ? null
 , withSvmLight ? false
 }:
 
-assert pythonSupport -> python2Packages != null;
+assert pythonSupport -> python3Packages != null;
 assert opencvSupport -> opencv != null;
 
 assert (!blas.isILP64) && (!lapack.isILP64);
@@ -101,7 +101,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (!withSvmLight) ./svmlight-scrubber.patch;
 
   nativeBuildInputs = [ cmake swig ctags ]
-    ++ (with python2Packages; [ python jinja2 ply ]);
+    ++ (with python3Packages; [ python jinja2 ply ]);
 
   buildInputs = [
     eigen
@@ -121,7 +121,7 @@ stdenv.mkDerivation rec {
     nlopt
     lp_solve
     colpack
-  ] ++ lib.optionals pythonSupport (with python2Packages; [ python numpy ])
+  ] ++ lib.optionals pythonSupport (with python3Packages; [ python numpy ])
     ++ lib.optional opencvSupport opencv;
 
   cmakeFlags = let
@@ -139,7 +139,7 @@ stdenv.mkDerivation rec {
     "-DENABLE_TESTING=${enableIf doCheck}"
     "-DDISABLE_META_INTEGRATION_TESTS=ON"
     "-DTRAVIS_DISABLE_META_CPP=ON"
-    "-DPythonModular=${enableIf pythonSupport}"
+    "-DINTERFACE_PYTHON=${enableIf pythonSupport}"
     "-DOpenCV=${enableIf opencvSupport}"
     "-DUSE_SVMLIGHT=${enableIf withSvmLight}"
   ];
@@ -177,6 +177,12 @@ stdenv.mkDerivation rec {
     rm -r $out/share
   '';
 
+  postFixup = ''
+    # CMake incorrectly calculates library path from dev prefix
+    substituteInPlace $dev/lib/cmake/shogun/ShogunTargets-release.cmake \
+      --replace "\''${_IMPORT_PREFIX}/lib/" "$out/lib/"
+  '';
+
   meta = with lib; {
     description = "A toolbox which offers a wide range of efficient and unified machine learning methods";
     homepage = "http://shogun-toolbox.org/";

pkgs/applications/science/misc/cwltool/default.nix

@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cwltool";
-  version = "3.1.20220119140128";
+  version = "3.1.20220124184855";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "common-workflow-language";
     repo = pname;
     rev = version;
-    sha256 = "1jmrm0qrqgka79avc1kq63fgh20gx6g07fc8p3iih4k85vhdyl3f";
+    sha256 = "0b0mxminfijbi3d9sslhwhs8awnagdsx8d2wh9x9ipdpwipihpmb";
   };
 
   postPatch = ''

pkgs/applications/science/misc/tulip/default.nix

@@ -1,19 +1,20 @@
-{ fetchurl, lib, stdenv, libxml2, freetype, libGLU, libGL, glew, qt4
-, cmake, makeWrapper, libjpeg, python2 }:
+{ fetchurl, lib, stdenv, libxml2, freetype, libGLU, libGL, glew
+, qtbase, wrapQtAppsHook, python3
+, cmake, libjpeg }:
 
-let version = "5.2.1"; in
 stdenv.mkDerivation rec {
   pname = "tulip";
-  inherit version;
+  version = "5.6.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/auber/${pname}-${version}_src.tar.gz";
-    sha256 = "0bqmqy6sri87a8xv5xf7ffaq5zin4hiaa13g0l64b84i7yckfwky";
+    sha256 = "1fy3nvgxv3igwc1d23zailcgigj1d0f2kkh7a5j24c0dyqz5zxmw";
   };
 
-  buildInputs = [ libxml2 freetype glew libGLU libGL qt4 libjpeg python2 ];
+  buildInputs = [ libxml2 freetype glew libGLU libGL libjpeg qtbase python3 ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
 
-  nativeBuildInputs = [ cmake makeWrapper ];
+  qtWrapperArgs = [ ''--prefix PATH : ${lib.makeBinPath [ python3 ]}'' ];
 
   # FIXME: "make check" needs Docbook's DTD 4.4, among other things.
   doCheck = false;

pkgs/applications/terminal-emulators/mlterm/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "arakiken";
     repo = pname;
-    rev = "rel-${lib.replaceStrings [ "." ] [ "_" ] version}"; # 3.9.1 -> rel-3_9_1
+    rev = version;
     sha256 = "sha256-DvGR3rDegInpnLp3H+rXNXktCGhpjsBBPTRMwodeTro=";
   };
 

pkgs/applications/version-management/commitizen/default.nix

@@ -11,17 +11,24 @@
 , pyyaml
 , argcomplete
 , typing-extensions
+, packaging
+, pytestCheckHook
+, pytest-freezegun
+, pytest-mock
+, pytest-regressions
+, git
 }:
 
 buildPythonApplication rec {
   pname = "commitizen";
-  version = "2.20.3";
+  version = "2.20.4";
 
   src = fetchFromGitHub {
     owner = "commitizen-tools";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rAm2GTRxZIHQmn/FM0IwwH/2h+oOvzGmeVr5xkvD/zA=";
+    sha256 = "sha256-2DhWiUAkAkyNxYB1CGzUB2nGZeCWvFqSztrxasUPSXw=";
+    deepClone = true;
   };
 
   format = "pyproject";
@@ -38,6 +45,59 @@ buildPythonApplication rec {
     pyyaml
     argcomplete
     typing-extensions
+    packaging
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    pytestCheckHook
+    pytest-freezegun
+    pytest-mock
+    pytest-regressions
+    argcomplete
+    git
+  ];
+
+  # NB: These require full git history
+  disabledTests = [
+    "test_breaking_change_content_v1"
+    "test_breaking_change_content_v1_beta"
+    "test_breaking_change_content_v1_multiline"
+    "test_bump_command_prelease"
+    "test_bump_dry_run"
+    "test_bump_files_only"
+    "test_bump_local_version"
+    "test_bump_major_increment"
+    "test_bump_minor_increment"
+    "test_bump_on_git_with_hooks_no_verify_disabled"
+    "test_bump_on_git_with_hooks_no_verify_enabled"
+    "test_bump_patch_increment"
+    "test_bump_tag_exists_raises_exception"
+    "test_bump_when_bumpping_is_not_support"
+    "test_bump_when_version_inconsistent_in_version_files"
+    "test_bump_with_changelog_arg"
+    "test_bump_with_changelog_config"
+    "test_bump_with_changelog_to_stdout_arg"
+    "test_changelog_config_flag_increment"
+    "test_changelog_config_start_rev_option"
+    "test_changelog_from_start"
+    "test_changelog_from_version_zero_point_two"
+    "test_changelog_hook"
+    "test_changelog_incremental_angular_sample"
+    "test_changelog_incremental_keep_a_changelog_sample"
+    "test_changelog_incremental_keep_a_changelog_sample_with_annotated_tag"
+    "test_changelog_incremental_with_release_candidate_version"
+    "test_changelog_is_persisted_using_incremental"
+    "test_changelog_multiple_incremental_do_not_add_new_lines"
+    "test_changelog_replacing_unreleased_using_incremental"
+    "test_changelog_with_different_cz"
+    "test_get_commits"
+    "test_get_commits_author_and_email"
+    "test_get_commits_with_signature"
+    "test_get_latest_tag_name"
+    "test_is_staging_clean_when_updating_file"
+    "test_none_increment_should_not_call_git_tag_and_error_code_is_not_zero"
+    "test_prevent_prerelease_when_no_increment_detected"
   ];
 
   meta = with lib; {

pkgs/applications/version-management/git-lfs/default.nix

@@ -19,6 +19,12 @@ buildGoPackage rec {
 
   subPackages = [ "." ];
 
+  preBuild = ''
+    pushd go/src/github.com/git-lfs/git-lfs
+      go generate ./commands
+    popd
+  '';
+
   postBuild = ''
     make -C go/src/${goPackagePath} man
   '';

pkgs/applications/version-management/gitlab/data.json

@@ -1,14 +1,14 @@
 {
-  "version": "14.6.3",
-  "repo_hash": "sha256-M8A6ZF1t+N48OTBhVwvOweITmavrl9+Z1Yqw4lxLk38=",
-  "yarn_hash": "1kcjbf8xn3bwac2s9i2i7dpgbkwcjh09wvgbgysm5yffpdswg6nl",
+  "version": "14.7.0",
+  "repo_hash": "0jam4krhwkbri99642vz4gjlnr7zfgd6mq7pgjyf00f6pggvhq79",
+  "yarn_hash": "1cv3lxfw4i9snlw5x6bcip1n97wg72v5zpz9mjxdpzd2i1bwp6da",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v14.6.3-ee",
+  "rev": "v14.7.0-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "14.6.3",
-    "GITLAB_PAGES_VERSION": "1.49.0",
-    "GITLAB_SHELL_VERSION": "13.22.1",
-    "GITLAB_WORKHORSE_VERSION": "14.6.3"
+    "GITALY_SERVER_VERSION": "14.7.0",
+    "GITLAB_PAGES_VERSION": "1.51.0",
+    "GITLAB_SHELL_VERSION": "13.22.2",
+    "GITLAB_WORKHORSE_VERSION": "14.7.0"
   }
 }

pkgs/applications/version-management/gitlab/default.nix

@@ -22,12 +22,6 @@ let
     gemset =
       let x = import (gemdir + "/gemset.nix");
       in x // {
-        # grpc expects the AR environment variable to contain `ar rpc`. See the
-        # discussion in nixpkgs #63056.
-        grpc = x.grpc // {
-          patches = [ ./fix-grpc-ar.patch ];
-          dontBuild = false;
-        };
         # the openssl needs the openssl include files
         openssl = x.openssl // {
           buildInputs = [ openssl ];

pkgs/applications/version-management/gitlab/fix-grpc-ar.patch

@@ -1,10 +0,0 @@
---- a/src/ruby/ext/grpc/extconf.rb
-+++ b/src/ruby/ext/grpc/extconf.rb
-@@ -27,6 +27,7 @@ ENV['MACOSX_DEPLOYMENT_TARGET'] = '10.7'
- if ENV['AR'].nil? || ENV['AR'].size == 0
-     ENV['AR'] = RbConfig::CONFIG['AR'] + ' rcs'
- end
-+ENV['AR'] = ENV['AR'] + ' rcs'
- if ENV['CC'].nil? || ENV['CC'].size == 0
-     ENV['CC'] = RbConfig::CONFIG['CC']
- end

pkgs/applications/version-management/gitlab/gitaly/Gemfile

@@ -3,11 +3,11 @@ source 'https://rubygems.org'
 gem 'rugged', '~> 1.2'
 gem 'github-linguist', '~> 7.12', require: 'linguist'
 gem 'gitlab-markup', '~> 1.7.1'
-gem 'activesupport', '~> 6.1.4.1'
+gem 'activesupport', '~> 6.1.4.4'
 gem 'rdoc', '~> 6.0'
-gem 'gitlab-gollum-lib', '~> 4.2.7.10.gitlab.1', require: false
+gem 'gitlab-gollum-lib', '~> 4.2.7.10.gitlab.2', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4.4.gitlab.1', require: false
-gem 'grpc', '~> 1.30.2'
+gem 'grpc', '~> 1.42.0' # keep in lock-step with grpc-tools
 gem 'sentry-raven', '~> 3.0', require: false
 gem 'faraday', '~> 1.0'
 gem 'rbtrace', require: false
@@ -19,7 +19,7 @@ gem 'gitlab-labkit', '~> 0.21.1'
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 9.14.1'
 
-gem 'google-protobuf', '~> 3.17.0'
+gem 'google-protobuf', '~> 3.19.0'
 
 group :development, :test do
   gem 'rubocop', '~> 0.69', require: false
@@ -29,7 +29,7 @@ group :development, :test do
   gem 'factory_bot', require: false
   gem 'pry', '~> 0.12.2', require: false
 
-  gem 'grpc-tools', '= 1.30.2'
+  gem 'grpc-tools', '~> 1.42.0'
 end
 
 # Gems required in omnibus-gitlab pipeline

pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock

@@ -2,20 +2,20 @@ GEM
   remote: https://rubygems.org/
   specs:
     abstract_type (0.0.7)
-    actionpack (6.1.4.1)
-      actionview (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionpack (6.1.4.4)
+      actionview (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionview (6.1.4.4)
+      activesupport (= 6.1.4.4)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activesupport (6.1.4.1)
+    activesupport (6.1.4.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -54,13 +54,13 @@ GEM
       mini_mime (~> 1.0)
       rugged (>= 0.25.1)
     github-markup (1.7.0)
-    gitlab-gollum-lib (4.2.7.10.gitlab.1)
+    gitlab-gollum-lib (4.2.7.10.gitlab.2)
       gemojione (~> 3.2)
       github-markup (~> 1.6)
-      gitlab-gollum-rugged_adapter (~> 0.4.4.3.gitlab.1)
+      gitlab-gollum-rugged_adapter (~> 0.4.4.4.gitlab.1)
       nokogiri (>= 1.6.1, < 2.0)
       rouge (~> 3.1)
-      sanitize (~> 4.6.4)
+      sanitize (~> 6.0)
       stringex (~> 2.6)
     gitlab-gollum-rugged_adapter (0.4.4.4.gitlab.1)
       mime-types (>= 1.15)
@@ -81,27 +81,27 @@ GEM
       with_env (= 1.1.0)
       xml-simple (~> 1.1.5)
     gitlab-markup (1.7.1)
-    google-protobuf (3.17.3)
-    googleapis-common-protos-types (1.1.0)
+    google-protobuf (3.19.1)
+    googleapis-common-protos-types (1.3.0)
       google-protobuf (~> 3.14)
-    grpc (1.30.2)
-      google-protobuf (~> 3.12)
+    grpc (1.42.0)
+      google-protobuf (~> 3.18)
       googleapis-common-protos-types (~> 1.0)
-    grpc-tools (1.30.2)
-    i18n (1.8.10)
+    grpc-tools (1.42.0)
+    i18n (1.8.11)
       concurrent-ruby (~> 1.0)
     ice_nine (0.11.2)
     jaeger-client (1.1.0)
       opentracing (~> 0.3)
       thrift
-    json (2.5.1)
+    json (2.6.1)
     licensee (9.14.1)
       dotenv (~> 2.0)
       octokit (~> 4.17)
       reverse_markdown (~> 1.0)
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
-    loofah (2.12.0)
+    loofah (2.13.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     memoizable (0.4.2)
@@ -111,15 +111,13 @@ GEM
       mime-types-data (~> 3.2015)
     mime-types-data (3.2020.1104)
     mini_mime (1.0.2)
-    mini_portile2 (2.5.1)
-    minitest (5.14.4)
+    mini_portile2 (2.6.1)
+    minitest (5.15.0)
     msgpack (1.3.3)
     multipart-post (2.1.1)
-    nokogiri (1.11.7)
-      mini_portile2 (~> 2.5.0)
+    nokogiri (1.12.5)
+      mini_portile2 (~> 2.6.1)
       racc (~> 1.4)
-    nokogumbo (1.5.0)
-      nokogiri
     octokit (4.20.0)
       faraday (>= 0.9)
       sawyer (~> 0.8.0, >= 0.5.3)
@@ -139,7 +137,7 @@ GEM
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
     public_suffix (4.0.6)
-    racc (1.5.2)
+    racc (1.6.0)
     rack (2.2.3)
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
@@ -158,8 +156,8 @@ GEM
     regexp_parser (1.8.1)
     reverse_markdown (1.4.0)
       nokogiri
-    rexml (3.2.4)
-    rouge (3.26.0)
+    rexml (3.2.5)
+    rouge (3.27.0)
     rspec (3.8.0)
       rspec-core (~> 3.8.0)
       rspec-expectations (~> 3.8.0)
@@ -193,10 +191,9 @@ GEM
     ruby-progressbar (1.10.1)
     rubyzip (2.3.2)
     rugged (1.2.0)
-    sanitize (4.6.6)
+    sanitize (6.0.0)
       crass (~> 1.0.2)
-      nokogiri (>= 1.4.4)
-      nokogumbo (~> 1.4)
+      nokogiri (>= 1.12.0)
     sawyer (0.8.2)
       addressable (>= 2.3.5)
       faraday (> 0.8, < 2.0)
@@ -222,24 +219,24 @@ GEM
     with_env (1.1.0)
     xml-simple (1.1.9)
       rexml
-    zeitwerk (2.4.2)
+    zeitwerk (2.5.3)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  activesupport (~> 6.1.4.1)
+  activesupport (~> 6.1.4.4)
   factory_bot
   faraday (~> 1.0)
   github-linguist (~> 7.12)
-  gitlab-gollum-lib (~> 4.2.7.10.gitlab.1)
+  gitlab-gollum-lib (~> 4.2.7.10.gitlab.2)
   gitlab-gollum-rugged_adapter (~> 0.4.4.4.gitlab.1)
   gitlab-labkit (~> 0.21.1)
   gitlab-license_finder
   gitlab-markup (~> 1.7.1)
-  google-protobuf (~> 3.17.0)
-  grpc (~> 1.30.2)
-  grpc-tools (= 1.30.2)
+  google-protobuf (~> 3.19.0)
+  grpc (~> 1.42.0)
+  grpc-tools (~> 1.42.0)
   licensee (~> 9.14.1)
   pry (~> 0.12.2)
   rbtrace

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -21,19 +21,9 @@ let
     inherit ruby;
     copyGemFiles = true;
     gemdir = ./.;
-    gemset =
-      let x = import (gemdir + "/gemset.nix");
-      in x // {
-        # grpc expects the AR environment variable to contain `ar rpc`. See the
-        # discussion in nixpkgs #63056.
-        grpc = x.grpc // {
-          patches = [ ../fix-grpc-ar.patch ];
-          dontBuild = false;
-        };
-      };
   };
 
-  version = "14.6.3";
+  version = "14.7.0";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in
 
@@ -45,10 +35,10 @@ buildGoModule {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-b4gNIYMtwsV2qv3mjKYDnCCGGmQseoqaTGN7k9mR1B8=";
+    sha256 = "sha256-hOtdeJSjZLGcPCZpu42lGtCtQoLE0/AQqfQWLUJ6Hf8=";
   };
 
-  vendorSha256 = "sha256-ZLd4E3+e25Hqmd6ZyF3X6BveMEg7OF0FX9IvNBWn3v0=";
+  vendorSha256 = "sha256-eapqtSstc7d3R7A/5krKV0uVr9GhGkHHMrmsBOpWAbo=";
 
   passthru = {
     inherit rubyEnv;

pkgs/applications/version-management/gitlab/gitaly/gemset.nix

@@ -13,10 +13,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xgysqnibjsy6kdz10x2xb3kwa6lssiqhh0zggrbgs31ypwhlpia";
+      sha256 = "171ida68hrk21cq1zz1kfl9h94a3qw5p3afviqzsirl0kx6qjyv9";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -24,10 +24,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1yf4ic5kl324rs0raralpwx24s6hvvdzxfhinafylf8f3x7jj23z";
+      sha256 = "1lm2pf35p6q4ff78z175h6ihmzfg2j7ssn41374rb9iy9gpiiidm";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@@ -35,10 +35,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19gx1jcq46x9d1pi1w8xq0bgvvfw239y4lalr8asm291gj3q3ds4";
+      sha256 = "0rvnz9lsf9mrkpji748sf51f54m027snkw6rm8flyvf7fq18rm98";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   adamantium = {
     dependencies = ["ice_nine" "memoizable"];
@@ -247,10 +247,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r6smbqnh0m84fxwb2g11qjfbcsljfin4vhnf43nmmbql2l1i3ah";
+      sha256 = "1vs6frgnhhfnyicsjck39xibmn7xc6ji7wvznvfmr53f4smqjk40";
       type = "gem";
     };
-    version = "4.2.7.10.gitlab.1";
+    version = "4.2.7.10.gitlab.2";
   };
   gitlab-gollum-rugged_adapter = {
     dependencies = ["mime-types" "rugged"];
@@ -300,10 +300,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vmll4nnkha3vsqj1g76pwni6x7mp2i81pka4wdwq8qfhn210108";
+      sha256 = "1dwx4ns39bpmzmhglyip9d68i117zspf5lp865pf6hrsmmdf2k53";
       type = "gem";
     };
-    version = "3.17.3";
+    version = "3.19.1";
   };
   googleapis-common-protos-types = {
     dependencies = ["google-protobuf"];
@@ -311,10 +311,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1949w1lcd3iyiy4n6zgnrhdp78k9khbh2pbkrpkv263bbpmw8llg";
+      sha256 = "0w860lqs5j6n58a8qn4wr16hp0qz7cq5h67dgma04gncjwqiyhf5";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.3.0";
   };
   grpc = {
     dependencies = ["google-protobuf" "googleapis-common-protos-types"];
@@ -322,20 +322,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rsglf7ag17n465iff7vlw83pn2rpl4kv9sb1rpf17nx6xpi7yl5";
+      sha256 = "0jjq2ing7px4zvdrg9xcq5a9qsciq6g3v14n95a3d9n6cyg69lmk";
       type = "gem";
     };
-    version = "1.30.2";
+    version = "1.42.0";
   };
   grpc-tools = {
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k9zhsqhamp02ryzgfb4y2bbick151vlhrhj0kqbbz9lyhms0bd4";
+      sha256 = "0xipvw8zcm1c3pna6fgmy83x0yvffii8d7wafwcxmszxa647brw1";
       type = "gem";
     };
-    version = "1.30.2";
+    version = "1.42.0";
   };
   i18n = {
     dependencies = ["concurrent-ruby"];
@@ -343,10 +343,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a";
+      sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf";
       type = "gem";
     };
-    version = "1.8.10";
+    version = "1.8.11";
   };
   ice_nine = {
     source = {
@@ -372,10 +372,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lrirj0gw420kw71bjjlqkqhqbrplla61gbv1jzgsz6bv90qr3ci";
+      sha256 = "1z9grvjyfz16ag55hg522d3q4dh07hf391sf9s96npc0vfi85xkz";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.6.1";
   };
   licensee = {
     dependencies = ["dotenv" "octokit" "reverse_markdown" "rugged" "thor"];
@@ -394,10 +394,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nqcya57x2n58y1dify60i0dpla40n4yir928khp4nj5jrn9mgmw";
+      sha256 = "17rvbrqcci1579d7dpbsfmz1f9g7msk82lyh9ip5h29dkrnixcgg";
       type = "gem";
     };
-    version = "2.12.0";
+    version = "2.13.0";
   };
   memoizable = {
     dependencies = ["thread_safe"];
@@ -452,20 +452,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xg1x4708a4pn2wk8qs2d8kfzzdyv9kjjachg2f1phsx62ap2rx2";
+      sha256 = "1lvxm91hi0pabnkkg47wh1siv56s6slm2mdq1idfm86dyfidfprq";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.6.1";
   };
   minitest = {
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19z7wkhg59y8abginfrm2wzplz7py3va8fyngiigngqvsws6cwgl";
+      sha256 = "06xf558gid4w8lwx13jwfdafsch9maz8m0g85wnfymqj63x5nbbd";
       type = "gem";
     };
-    version = "5.14.4";
+    version = "5.15.0";
   };
   msgpack = {
     groups = ["default"];
@@ -493,19 +493,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vrn31385ix5k9b0yalnlzv360isv6dincbcvi8psllnwz4sjxj9";
+      sha256 = "1v02g7k7cxiwdcahvlxrmizn3avj2q6nsjccgilq1idc89cr081b";
       type = "gem";
     };
-    version = "1.11.7";
-  };
-  nokogumbo = {
-    dependencies = ["nokogiri"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "09qc1c7acv9qm48vk2kzvnrq4ij8jrql1cv33nmv2nwmlggy0jyj";
-      type = "gem";
-    };
-    version = "1.5.0";
+    version = "1.12.5";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];
@@ -611,10 +602,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
+      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
       type = "gem";
     };
-    version = "1.5.2";
+    version = "1.6.0";
   };
   rack = {
     groups = ["default"];
@@ -720,24 +711,24 @@
     version = "1.4.0";
   };
   rexml = {
-    groups = ["default" "development" "test"];
+    groups = ["default" "development" "omnibus" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mkvkcw9fhpaizrhca0pdgjcrbns48rlz4g6lavl5gjjq3rk2sq3";
+      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.2.5";
   };
   rouge = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0b4b300i3m4m4kw7w1n9wgxwy16zccnb7271miksyzd0wq5b9pm3";
+      sha256 = "0530ri0p60km0bg0ib6swkhfnas427cva7vcdmnwl8df52a10y1k";
       type = "gem";
     };
-    version = "3.26.0";
+    version = "3.27.0";
   };
   rspec = {
     dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
@@ -857,13 +848,15 @@
     version = "1.2.0";
   };
   sanitize = {
-    dependencies = ["crass" "nokogiri" "nokogumbo"];
+    dependencies = ["crass" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0j4j2a2mkk1a70vbx959pvx0gvr1zb9snjwvsppwj28bp0p0b2bv";
+      sha256 = "1zq8pxmsd1abw18zz6mazsm2jfpwmbgdxbpawb7bmwvkb2c5yyc1";
       type = "gem";
     };
-    version = "4.6.6";
+    version = "6.0.0";
   };
   sawyer = {
     dependencies = ["addressable" "faraday"];
@@ -1001,9 +994,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1746czsjarixq0x05f7p3hpzi38ldg6wxnxxw74kbjzh1sdjgmpl";
+      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
       type = "gem";
     };
-    version = "2.4.2";
+    version = "2.5.3";
   };
 }

pkgs/applications/version-management/gitlab/gitlab-shell/default.nix

@@ -2,12 +2,12 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "13.22.1";
+  version = "13.22.2";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-uqdKiBZ290mG0JNi17EjimfES6bN3q1hF6LXs3URTZ8=";
+    sha256 = "sha256-jAH/MKmCIybLXsypHehQJaKf+mK9ko5XqWoDH/XKE5w=";
   };
 
   buildInputs = [ ruby ];

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "14.6.3";
+  version = "14.7.0";
 
   src = fetchFromGitLab {
     owner = data.owner;

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile

@@ -2,7 +2,7 @@
 
 source 'https://rubygems.org'
 
-gem 'rails', '~> 6.1.4.1'
+gem 'rails', '~> 6.1.4.4'
 
 gem 'bootsnap', '~> 1.9.1', require: false
 
@@ -50,7 +50,7 @@ gem 'omniauth-shibboleth', '~> 1.3.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.4.0'
 gem 'omniauth-authentiq', '~> 0.3.3'
-gem 'gitlab-omniauth-openid-connect', '~> 0.8.0', require: 'omniauth_openid_connect'
+gem 'gitlab-omniauth-openid-connect', '~> 0.9.0', require: 'omniauth_openid_connect'
 gem 'omniauth-salesforce', '~> 1.0.5'
 gem 'omniauth-atlassian-oauth2', '~> 0.2.0'
 gem 'rack-oauth2', '~> 1.16.0'
@@ -74,7 +74,7 @@ gem 'u2f', '~> 0.2.1'
 gem 'validates_hostname', '~> 1.0.11'
 gem 'rubyzip', '~> 2.0.0', require: 'zip'
 # GitLab Pages letsencrypt support
-gem 'acme-client', '~> 2.0', '>= 2.0.6'
+gem 'acme-client', '~> 2.0', '>= 2.0.9'
 
 # Browser detection
 gem 'browser', '~> 4.2'
@@ -98,10 +98,7 @@ gem 'rack-cors', '~> 1.0.6', require: 'rack/cors'
 
 # GraphQL API
 gem 'graphql', '~> 1.11.10'
-# NOTE: graphiql-rails v1.5+ doesn't work: https://gitlab.com/gitlab-org/gitlab/issues/31771
-# TODO: remove app/views/graphiql/rails/editors/show.html.erb when https://github.com/rmosolgo/graphiql-rails/pull/71 is released:
-# https://gitlab.com/gitlab-org/gitlab/issues/31747
-gem 'graphiql-rails', '~> 1.4.10'
+gem 'graphiql-rails', '~> 1.8'
 gem 'apollo_upload_server', '~> 2.1.0'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
 gem 'graphlient', '~> 0.4.0' # Used by BulkImport feature (group::import)
@@ -149,6 +146,7 @@ gem 'aws-sdk-core', '~> 3'
 gem 'aws-sdk-cloudformation', '~> 1'
 gem 'aws-sdk-s3', '~> 1'
 gem 'faraday_middleware-aws-sigv4', '~>0.3.0'
+gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections
 
 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.13.2'
@@ -166,10 +164,10 @@ gem 'asciidoctor', '~> 2.0.10'
 gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
 gem 'asciidoctor-plantuml', '~> 0.0.12'
 gem 'asciidoctor-kroki', '~> 0.5.0', require: false
-gem 'rouge', '~> 3.26.1'
+gem 'rouge', '~> 3.27.0'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
-gem 'nokogiri', '~> 1.11.4'
+gem 'nokogiri', '~> 1.12'
 gem 'escape_utils', '~> 1.1'
 
 # Calendar rendering
@@ -193,12 +191,12 @@ end
 # State machine
 gem 'state_machines-activerecord', '~> 0.8.0'
 
-# Issue tags
-gem 'acts-as-taggable-on', '~> 8.1'
+# CI domain tags
+gem 'acts-as-taggable-on', '~> 9.0'
 
 # Background jobs
 gem 'sidekiq', '~> 6.3'
-gem 'sidekiq-cron', '~> 1.0'
+gem 'sidekiq-cron', '~> 1.2'
 gem 'redis-namespace', '~> 1.8.1'
 gem 'gitlab-sidekiq-fetcher', '0.8.0', require: 'sidekiq-reliable-fetch'
 
@@ -263,7 +261,7 @@ gem 'ruby-fogbugz', '~> 0.2.1'
 gem 'kubeclient', '~> 4.9.2'
 
 # Sanitize user input
-gem 'sanitize', '~> 5.2.1'
+gem 'sanitize', '~> 6.0'
 gem 'babosa', '~> 1.0.4'
 
 # Sanitizes SVG input
@@ -276,7 +274,7 @@ gem 'licensee', '~> 9.14.1'
 gem 'charlock_holmes', '~> 0.7.7'
 
 # Detect mime content type from content
-gem 'ruby-magic', '~> 0.4'
+gem 'ruby-magic', '~> 0.5'
 
 # Faster blank
 gem 'fast_blank'
@@ -312,7 +310,7 @@ gem 'pg_query', '~> 2.1'
 gem 'premailer-rails', '~> 1.10.3'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.21.1'
+gem 'gitlab-labkit', '~> 0.21.3'
 # Thrift is a dependency of gitlab-labkit, we want a version higher than 0.14.0
 # because of https://gitlab.com/gitlab-org/gitlab/-/issues/321900
 gem 'thrift', '>= 0.14.0'
@@ -394,8 +392,6 @@ group :development, :test do
 
   gem 'parallel', '~> 1.19', require: false
 
-  gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false
-
   gem 'test_file_finder', '~> 0.1.3'
 end
 
@@ -443,7 +439,8 @@ end
 
 gem 'octokit', '~> 4.15'
 
-# https://gitlab.com/gitlab-org/gitlab/issues/207207
+# Updating this gem version here is deprecated. See:
+# https://docs.gitlab.com/ee/development/emails.html#mailroom-gem-updates
 gem 'gitlab-mail_room', '~> 0.0.9', require: 'mail_room'
 
 gem 'email_reply_trimmer', '~> 0.1'
@@ -483,14 +480,14 @@ end
 gem 'spamcheck', '~> 0.1.0'
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 14.4.0.pre.rc43'
+gem 'gitaly', '~> 14.6.0.pre.rc1'
 
 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.0.2'
 
-gem 'grpc', '~> 1.30.2'
+gem 'grpc', '~> 1.42.0'
 
-gem 'google-protobuf', '~> 3.17.1'
+gem 'google-protobuf', '~> 3.19.0'
 
 gem 'toml-rb', '~> 2.0'
 

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock

@@ -2,72 +2,72 @@ GEM
   remote: https://rubygems.org/
   specs:
     RedCloth (4.3.2)
-    acme-client (2.0.6)
+    acme-client (2.0.9)
       faraday (>= 0.17, < 2.0.0)
-    actioncable (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actioncable (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activestorage (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionmailbox (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activestorage (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       mail (>= 2.7.1)
-    actionmailer (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      actionview (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionmailer (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      actionview (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.1.4.1)
-      actionview (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionpack (6.1.4.4)
+      actionview (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activestorage (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actiontext (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activestorage (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       nokogiri (>= 1.8.5)
-    actionview (6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionview (6.1.4.4)
+      activesupport (= 6.1.4.4)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.1.4.1)
-      activesupport (= 6.1.4.1)
+    activejob (6.1.4.4)
+      activesupport (= 6.1.4.4)
       globalid (>= 0.3.6)
-    activemodel (6.1.4.1)
-      activesupport (= 6.1.4.1)
-    activerecord (6.1.4.1)
-      activemodel (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    activemodel (6.1.4.4)
+      activesupport (= 6.1.4.4)
+    activerecord (6.1.4.4)
+      activemodel (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
     activerecord-explain-analyze (0.1.0)
       activerecord (>= 4)
       pg
-    activestorage (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    activestorage (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       marcel (~> 1.0.0)
       mini_mime (>= 1.1.0)
-    activesupport (6.1.4.1)
+    activesupport (6.1.4.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
       zeitwerk (~> 2.3)
-    acts-as-taggable-on (8.1.0)
-      activerecord (>= 5.0, < 6.2)
+    acts-as-taggable-on (9.0.0)
+      activerecord (>= 6.0, < 7.1)
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
     aes_key_wrap (1.1.0)
@@ -117,14 +117,14 @@ GEM
       aws-sigv4 (~> 1.1)
     aws-sigv4 (1.2.1)
       aws-eventstream (~> 1, >= 1.0.2)
-    azure-storage-blob (2.0.1)
+    azure-storage-blob (2.0.3)
       azure-storage-common (~> 2.0)
-      nokogiri (~> 1.11.0.rc2)
-    azure-storage-common (2.0.2)
+      nokogiri (~> 1, >= 1.10.8)
+    azure-storage-common (2.0.4)
       faraday (~> 1.0)
-      faraday_middleware (~> 1.0.0.rc1)
+      faraday_middleware (~> 1.0, >= 1.0.0.rc1)
       net-http-persistent (~> 4.0)
-      nokogiri (~> 1.11.0.rc2)
+      nokogiri (~> 1, >= 1.10.8)
     babosa (1.0.4)
     backport (1.2.0)
     base32 (0.3.2)
@@ -232,7 +232,6 @@ GEM
       danger
       gitlab (~> 4.2, >= 4.2.0)
     database_cleaner (1.7.0)
-    debugger-ruby_core_source (1.3.8)
     deckar01-task_list (2.3.1)
       html-pipeline
     declarative (0.0.20)
@@ -326,8 +325,10 @@ GEM
     escape_utils (1.2.1)
     et-orbi (1.2.1)
       tzinfo
+    ethon (0.15.0)
+      ffi (>= 1.15.0)
     eventmachine (1.2.7)
-    excon (0.71.1)
+    excon (0.90.0)
     execjs (2.8.1)
     expression_parser (0.9.0)
     extended-markdown-filter (0.6.0)
@@ -443,7 +444,7 @@ GEM
       rails (>= 3.2.0)
     git (1.7.0)
       rchardet (~> 1.8)
-    gitaly (14.4.0.pre.rc43)
+    gitaly (14.6.0.pre.rc1)
       grpc (~> 1.0)
     github-markup (1.7.0)
     gitlab (4.16.1)
@@ -465,10 +466,10 @@ GEM
       fog-json (~> 1.2.0)
       mime-types
       ms_rest_azure (~> 0.12.0)
-    gitlab-labkit (0.21.1)
+    gitlab-labkit (0.21.3)
       actionpack (>= 5.0.0, < 7.0.0)
       activesupport (>= 5.0.0, < 7.0.0)
-      grpc (~> 1.30.2)
+      grpc (>= 1.37)
       jaeger-client (~> 1.1)
       opentracing (~> 0.4)
       pg_query (~> 2.1)
@@ -484,7 +485,7 @@ GEM
     gitlab-mail_room (0.0.9)
     gitlab-markup (1.8.0)
     gitlab-net-dns (0.9.1)
-    gitlab-omniauth-openid-connect (0.8.0)
+    gitlab-omniauth-openid-connect (0.9.1)
       addressable (~> 2.7)
       omniauth (~> 1.9)
       openid_connect (~> 1.2)
@@ -504,7 +505,7 @@ GEM
       omniauth (~> 1.3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
-    globalid (0.5.2)
+    globalid (1.0.0)
       activesupport (>= 5.0)
     gon (6.4.0)
       actionpack (>= 3.0.20)
@@ -522,8 +523,8 @@ GEM
       signet (~> 0.12)
     google-cloud-env (1.5.0)
       faraday (>= 0.17.3, < 2.0)
-    google-protobuf (3.17.3)
-    googleapis-common-protos-types (1.1.0)
+    google-protobuf (3.19.1)
+    googleapis-common-protos-types (1.3.0)
       google-protobuf (~> 3.14)
     googleauth (0.14.0)
       faraday (>= 0.17.3, < 2.0)
@@ -552,7 +553,7 @@ GEM
     grape_logging (1.8.3)
       grape
       rack
-    graphiql-rails (1.4.10)
+    graphiql-rails (1.8.0)
       railties
       sprockets-rails
     graphlient (0.4.0)
@@ -571,8 +572,8 @@ GEM
       graphql (~> 1.6)
       html-pipeline (~> 2.8)
       sass (~> 3.4)
-    grpc (1.30.2)
-      google-protobuf (~> 3.12)
+    grpc (1.42.0)
+      google-protobuf (~> 3.18)
       googleapis-common-protos-types (~> 1.0)
     gssapi (1.2.0)
       ffi (>= 1.0.1)
@@ -732,7 +733,7 @@ GEM
     lumberjack (1.2.7)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
-    marcel (1.0.1)
+    marcel (1.0.2)
     marginalia (1.10.0)
       actionpack (>= 2.3)
       activerecord (>= 2.3)
@@ -745,7 +746,7 @@ GEM
     mini_histogram (0.3.1)
     mini_magick (4.10.1)
     mini_mime (1.1.1)
-    mini_portile2 (2.5.3)
+    mini_portile2 (2.6.1)
     minitest (5.11.3)
     mixlib-cli (2.1.8)
     mixlib-config (3.0.9)
@@ -783,11 +784,9 @@ GEM
     netrc (0.11.0)
     nio4r (2.5.8)
     no_proxy_fix (0.1.2)
-    nokogiri (1.11.7)
-      mini_portile2 (~> 2.5.0)
+    nokogiri (1.12.5)
+      mini_portile2 (~> 2.6.1)
       racc (~> 1.4)
-    nokogumbo (2.0.2)
-      nokogiri (~> 1.8, >= 1.8.4)
     notiffany (0.1.3)
       nenv (~> 0.1)
       shellany (~> 0.0)
@@ -880,7 +879,7 @@ GEM
       nokogiri (>= 1.4.4)
       omniauth (~> 1.0)
     open4 (1.3.4)
-    openid_connect (1.2.0)
+    openid_connect (1.3.0)
       activemodel
       attr_required (>= 1.0.0)
       json-jwt (>= 1.5.0)
@@ -945,7 +944,7 @@ GEM
       puma (>= 2.7)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.1.6)
-    racc (1.5.2)
+    racc (1.6.0)
     rack (2.2.3)
     rack-accept (0.4.5)
       rack (>= 0.4)
@@ -964,20 +963,20 @@ GEM
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
     rack-timeout (0.5.2)
-    rails (6.1.4.1)
-      actioncable (= 6.1.4.1)
-      actionmailbox (= 6.1.4.1)
-      actionmailer (= 6.1.4.1)
-      actionpack (= 6.1.4.1)
-      actiontext (= 6.1.4.1)
-      actionview (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activemodel (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activestorage (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    rails (6.1.4.4)
+      actioncable (= 6.1.4.4)
+      actionmailbox (= 6.1.4.4)
+      actionmailer (= 6.1.4.4)
+      actionpack (= 6.1.4.4)
+      actiontext (= 6.1.4.4)
+      actionview (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activemodel (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activestorage (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       bundler (>= 1.15.0)
-      railties (= 6.1.4.1)
+      railties (= 6.1.4.4)
       sprockets-rails (>= 2.0.0)
     rails-controller-testing (1.0.5)
       actionpack (>= 5.0.1.rc1)
@@ -991,9 +990,9 @@ GEM
     rails-i18n (6.0.0)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 7)
-    railties (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    railties (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       method_source
       rake (>= 0.13)
       thor (~> 1.0)
@@ -1002,8 +1001,6 @@ GEM
     rb-fsevent (0.10.4)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rblineprof (0.3.6)
-      debugger-ruby_core_source (~> 1.3)
     rbtrace (0.4.14)
       ffi (>= 1.0.6)
       msgpack (>= 0.4.3)
@@ -1049,7 +1046,7 @@ GEM
     rexml (3.2.5)
     rinku (2.0.0)
     rotp (6.2.0)
-    rouge (3.26.1)
+    rouge (3.27.0)
     rqrcode (0.7.0)
       chunky_png
     rqrcode-rails3 (0.1.7)
@@ -1117,8 +1114,8 @@ GEM
       rubocop-ast (>= 0.7.1)
     ruby-fogbugz (0.2.1)
       crack (~> 0.4)
-    ruby-magic (0.4.0)
-      mini_portile2 (~> 2.5.0)
+    ruby-magic (0.5.3)
+      mini_portile2 (~> 2.6)
     ruby-prof (1.3.1)
     ruby-progressbar (1.11.0)
     ruby-saml (1.13.0)
@@ -1135,10 +1132,9 @@ GEM
     safe_yaml (1.0.4)
     safety_net_attestation (0.4.0)
       jwt (~> 2.0)
-    sanitize (5.2.1)
+    sanitize (6.0.0)
       crass (~> 1.0.2)
-      nokogiri (>= 1.8.0)
-      nokogumbo (~> 2.0)
+      nokogiri (>= 1.12.0)
     sass (3.5.5)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
@@ -1177,7 +1173,7 @@ GEM
       connection_pool (>= 2.2.2)
       rack (~> 2.0)
       redis (>= 4.2.0)
-    sidekiq-cron (1.0.4)
+    sidekiq-cron (1.2.0)
       fugit (~> 1.1)
       sidekiq (>= 4.2.1)
     signet (0.14.0)
@@ -1244,7 +1240,7 @@ GEM
       unicode-display_width (>= 1.5, < 3.0)
       unicode_utils (~> 1.4)
     strings-ansi (0.2.0)
-    swd (1.2.0)
+    swd (1.3.0)
       activesupport (>= 3)
       attr_required (>= 0.0.5)
       httpclient (>= 2.4)
@@ -1304,6 +1300,8 @@ GEM
       tty-screen (~> 0.8)
       wisper (~> 2.0)
     tty-screen (0.8.1)
+    typhoeus (1.4.0)
+      ethon (>= 0.9.0)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
     u2f (0.2.1)
@@ -1351,7 +1349,7 @@ GEM
       safety_net_attestation (~> 0.4.0)
       securecompare (~> 1.0)
       tpm-key_attestation (~> 0.9.0)
-    webfinger (1.1.0)
+    webfinger (1.2.0)
       activesupport
       httpclient (>= 2.4)
     webmock (3.9.1)
@@ -1374,16 +1372,16 @@ GEM
       nokogiri (~> 1.8)
     yajl-ruby (1.4.1)
     yard (0.9.26)
-    zeitwerk (2.5.1)
+    zeitwerk (2.5.3)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   RedCloth (~> 4.3.2)
-  acme-client (~> 2.0, >= 2.0.6)
+  acme-client (~> 2.0, >= 2.0.9)
   activerecord-explain-analyze (~> 0.1)
-  acts-as-taggable-on (~> 8.1)
+  acts-as-taggable-on (~> 9.0)
   addressable (~> 2.8)
   akismet (~> 3.0)
   apollo_upload_server (~> 2.1.0)
@@ -1465,36 +1463,36 @@ DEPENDENCIES
   gettext (~> 3.3)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 14.4.0.pre.rc43)
+  gitaly (~> 14.6.0.pre.rc1)
   github-markup (~> 1.7.0)
   gitlab-chronic (~> 0.10.5)
   gitlab-dangerfiles (~> 2.6.1)
   gitlab-experiment (~> 0.6.5)
   gitlab-fog-azure-rm (~> 1.2.0)
-  gitlab-labkit (~> 0.21.1)
+  gitlab-labkit (~> 0.21.3)
   gitlab-license (~> 2.0)
   gitlab-license_finder (~> 6.0)
   gitlab-mail_room (~> 0.0.9)
   gitlab-markup (~> 1.8.0)
   gitlab-net-dns (~> 0.9.1)
-  gitlab-omniauth-openid-connect (~> 0.8.0)
+  gitlab-omniauth-openid-connect (~> 0.9.0)
   gitlab-sidekiq-fetcher (= 0.8.0)
   gitlab-styles (~> 6.6.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.1.1)
   gon (~> 6.4.0)
   google-api-client (~> 0.33)
-  google-protobuf (~> 3.17.1)
+  google-protobuf (~> 3.19.0)
   gpgme (~> 2.0.19)
   grape (~> 1.5.2)
   grape-entity (~> 0.10.0)
   grape-path-helpers (~> 1.7.0)
   grape_logging (~> 1.7)
-  graphiql-rails (~> 1.4.10)
+  graphiql-rails (~> 1.8)
   graphlient (~> 0.4.0)
   graphql (~> 1.11.10)
   graphql-docs (~> 1.6.0)
-  grpc (~> 1.30.2)
+  grpc (~> 1.42.0)
   gssapi
   guard-rspec
   haml_lint (~> 0.36.0)
@@ -1537,7 +1535,7 @@ DEPENDENCIES
   net-ldap (~> 0.16.3)
   net-ntp
   net-ssh (~> 6.0)
-  nokogiri (~> 1.11.4)
+  nokogiri (~> 1.12)
   oauth2 (~> 1.4)
   octokit (~> 4.15)
   ohai (~> 16.10)
@@ -1581,11 +1579,10 @@ DEPENDENCIES
   rack-oauth2 (~> 1.16.0)
   rack-proxy (~> 0.6.0)
   rack-timeout (~> 0.5.1)
-  rails (~> 6.1.4.1)
+  rails (~> 6.1.4.4)
   rails-controller-testing
   rails-i18n (~> 6.0)
   rainbow (~> 3.0)
-  rblineprof (~> 0.3.6)
   rbtrace (~> 0.4)
   rdoc (~> 6.3.2)
   re2 (~> 1.2.0)
@@ -1597,7 +1594,7 @@ DEPENDENCIES
   responders (~> 3.0)
   retriable (~> 3.1.2)
   rexml (~> 3.2.5)
-  rouge (~> 3.26.1)
+  rouge (~> 3.27.0)
   rqrcode-rails3 (~> 0.1.7)
   rspec-parameterized
   rspec-rails (~> 5.0.1)
@@ -1605,14 +1602,14 @@ DEPENDENCIES
   rspec_junit_formatter
   rspec_profiling (~> 0.0.6)
   ruby-fogbugz (~> 0.2.1)
-  ruby-magic (~> 0.4)
+  ruby-magic (~> 0.5)
   ruby-prof (~> 1.3.0)
   ruby-progressbar (~> 1.10)
   ruby-saml (~> 1.13.0)
   ruby_parser (~> 3.15)
   rubyzip (~> 2.0.0)
   rugged (~> 1.2)
-  sanitize (~> 5.2.1)
+  sanitize (~> 6.0)
   sassc-rails (~> 2.1.0)
   sd_notify (~> 0.1.0)
   seed-fu (~> 2.3.7)
@@ -1621,7 +1618,7 @@ DEPENDENCIES
   settingslogic (~> 2.0.9)
   shoulda-matchers (~> 4.0.1)
   sidekiq (~> 6.3)
-  sidekiq-cron (~> 1.0)
+  sidekiq-cron (~> 1.2)
   simple_po_parser (~> 1.1.2)
   simplecov (~> 0.18.5)
   simplecov-cobertura (~> 1.3.1)
@@ -1647,6 +1644,7 @@ DEPENDENCIES
   timecop (~> 0.9.1)
   toml-rb (~> 2.0)
   truncato (~> 0.7.11)
+  typhoeus (~> 1.4.0)
   u2f (~> 0.2.1)
   undercover (~> 0.4.4)
   unf (~> 0.1.4)

pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix

@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nwkzjamvg946xh2pv82hkwxb7vqq6gakig014gflss0cwx7bbxp";
+      sha256 = "1c4g3rl1bvcb8frh5061hwaxkxglkj8i888j5gww5qapn5sp2czq";
       type = "gem";
     };
-    version = "2.0.6";
+    version = "2.0.9";
   };
   actioncable = {
     dependencies = ["actionpack" "activesupport" "nio4r" "websocket-driver"];
@@ -16,10 +16,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ilq5mniarm0zlvnkagqj9n9p73ljrhphciz02aymrpfxxxclz2x";
+      sha256 = "0z3ab9n901craqd3p1yl87kawci0vfw1xlh4d0zkj7lx8hpk10sn";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actionmailbox = {
     dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail"];
@@ -27,10 +27,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16azdnjws215clb056b9mabglx4b8f61hr82hv7hm80dmn89zqq6";
+      sha256 = "0q94js7ifm0a76xcwxin98bhr8nz0zqcsqi4y7j2mfwm3hq3bh0i";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actionmailer = {
     dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "rails-dom-testing"];
@@ -38,10 +38,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00s07l2ac5igch1g2rpa0linmiq7mhgk6v6wxkckg8gbiqijb592";
+      sha256 = "1gncnc5xl1ff70mfnqcys2qy65201yjrkwxx0hb5hl7jlamgvz9h";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@@ -49,10 +49,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xgysqnibjsy6kdz10x2xb3kwa6lssiqhh0zggrbgs31ypwhlpia";
+      sha256 = "171ida68hrk21cq1zz1kfl9h94a3qw5p3afviqzsirl0kx6qjyv9";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actiontext = {
     dependencies = ["actionpack" "activerecord" "activestorage" "activesupport" "nokogiri"];
@@ -60,10 +60,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0m4fy4qqh09vnzbhx383vjdfid6fzbs49bzzg415x05nmmjkx582";
+      sha256 = "1j9591z8lsp9lx3l75699prw6rgkhhlrfaj4lh5klcdffvxzkvi3";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -71,10 +71,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1yf4ic5kl324rs0raralpwx24s6hvvdzxfhinafylf8f3x7jj23z";
+      sha256 = "1lm2pf35p6q4ff78z175h6ihmzfg2j7ssn41374rb9iy9gpiiidm";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
@@ -82,10 +82,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1q7c0i0kwarxgcbxk71wa9jnlg45grbxmhlrh7dk9bgcv7r7r7hn";
+      sha256 = "0sf0nfjcj1na4v6zaxz6hjglax99yznaymjzpk1fi7mk71qf5hx4";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activemodel = {
     dependencies = ["activesupport"];
@@ -93,10 +93,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16ixam4lni8b5lgx0whnax0imzh1dh10fy5r9pxs52n83yz5nbq3";
+      sha256 = "0g3qdz8dw6zkgz45jd13lwfdnm7rhgczv1pssw63g9k6qj3bkxjm";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport"];
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ccgvlj767ybps3pxlaa4iw77n7wbriw2sr8754id3ngjfap08ja";
+      sha256 = "090d4wl1pq06m9mibpck0m5nm8h45fwhs3fjx27297kjmnv4gzik";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activerecord-explain-analyze = {
     dependencies = ["activerecord" "pg"];
@@ -126,10 +126,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17knzz9fvqg4x582vy0xmlgjkxfb13xyzl2rgw19qfma86hxsvvi";
+      sha256 = "0a6mmm1s8abv11ycqs6cq55kr6j89jpclkcnra9w2k47rl047vk4";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@@ -137,10 +137,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19gx1jcq46x9d1pi1w8xq0bgvvfw239y4lalr8asm291gj3q3ds4";
+      sha256 = "0rvnz9lsf9mrkpji748sf51f54m027snkw6rm8flyvf7fq18rm98";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   acts-as-taggable-on = {
     dependencies = ["activerecord"];
@@ -148,10 +148,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kfnyix173bazjswab21bx7hmqmik71awj2kz090fsa2nv58c4mw";
+      sha256 = "11hv6pdsr0kd9bmd84sab21sbm209ck1cwqs5jqbf9g1xbh9nh2s";
       type = "gem";
     };
-    version = "8.1.0";
+    version = "9.0.0";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -413,10 +413,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01psx005lkrfk3zm816z76fa2pv4hd8jk7hxrjyy4hbvgcqi6rfy";
+      sha256 = "0qq3knsy7nj7a0r8m19spg2bgzns9b3j5vjbs9mpg49whhc63dv1";
       type = "gem";
     };
-    version = "2.0.1";
+    version = "2.0.3";
   };
   azure-storage-common = {
     dependencies = ["faraday" "faraday_middleware" "net-http-persistent" "nokogiri"];
@@ -424,10 +424,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h5bwswc5768hblcxsschjz3y0lf9kvz3k7qqwypdhy8sr1lfxg8";
+      sha256 = "0swmsvvpmy8cdcl305p3dl2pi7m3dqjd7zywfcxmhsz0n2m4v3v0";
       type = "gem";
     };
-    version = "2.0.2";
+    version = "2.0.4";
   };
   babosa = {
     groups = ["default"];
@@ -957,20 +957,6 @@
     };
     version = "1.7.0";
   };
-  debugger-ruby_core_source = {
-    groups = ["default" "development"];
-    platforms = [{
-      engine = "maglev";
-    } {
-      engine = "ruby";
-    }];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1lp5dmm8a8dpwymv6r1y6yr24wxsj0gvgb2b8i7qq9rcv414snwd";
-      type = "gem";
-    };
-    version = "1.3.8";
-  };
   deckar01-task_list = {
     dependencies = ["html-pipeline"];
     groups = ["default"];
@@ -1393,6 +1379,17 @@
     };
     version = "1.2.1";
   };
+  ethon = {
+    dependencies = ["ffi"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0kd7c61f28f810fgxg480j7457nlvqarza9c2ra0zhav0dd80288";
+      type = "gem";
+    };
+    version = "0.15.0";
+  };
   eventmachine = {
     groups = ["default" "development"];
     platforms = [];
@@ -1408,10 +1405,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nn8wk7j22ly4lzdp5pnm7qsrjxbgspiyxkw70g1qf9bn6pslmxr";
+      sha256 = "1bkh80zzjpfglm14rhz116qgz0nb5gvk3ydfjpg14av5407srgh1";
       type = "gem";
     };
-    version = "0.71.1";
+    version = "0.90.0";
   };
   execjs = {
     groups = ["default"];
@@ -1899,10 +1896,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "022amhic8rs09qmp3hy1zz5inxbxnrvg8j82bq4l2s8ml9hqfs3a";
+      sha256 = "175whfk08jrmvssh5lgk0zgsaksbnhv6p5fg3picknrw4v05vw85";
       type = "gem";
     };
-    version = "14.4.0.pre.rc43";
+    version = "14.6.0.pre.rc1";
   };
   github-markup = {
     groups = ["default"];
@@ -1975,10 +1972,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09xci7jw5sckagnwfjlglz4cywylrf16r83f82asnnngvxadvvmq";
+      sha256 = "05fs11wpqn801dsscs845629hbgwbgs94qhig45jmalw4h9rira4";
       type = "gem";
     };
-    version = "0.21.1";
+    version = "0.21.3";
   };
   gitlab-license = {
     groups = ["default"];
@@ -2037,10 +2034,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bzblypm1d5bxn8a15l90vx4ad099i5nhnislr7fhs2axy3ssfr1";
+      sha256 = "1nxak6q0m0nd3m5a7vp9xqww9w5fqx97viv5g6pg3q62q9binm0j";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.9.1";
   };
   gitlab-sidekiq-fetcher = {
     dependencies = ["sidekiq"];
@@ -2092,10 +2089,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k6ww3shk3mv119xvr9m99l6ql0czq91xhd66hm8hqssb18r2lvm";
+      sha256 = "1n5yc058i8xhi1fwcp1w7mfi6xaxfmrifdb4r4hjfff33ldn8lqj";
       type = "gem";
     };
-    version = "0.5.2";
+    version = "1.0.0";
   };
   gon = {
     dependencies = ["actionpack" "i18n" "multi_json" "request_store"];
@@ -2135,10 +2132,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vmll4nnkha3vsqj1g76pwni6x7mp2i81pka4wdwq8qfhn210108";
+      sha256 = "1dwx4ns39bpmzmhglyip9d68i117zspf5lp865pf6hrsmmdf2k53";
       type = "gem";
     };
-    version = "3.17.3";
+    version = "3.19.1";
   };
   googleapis-common-protos-types = {
     dependencies = ["google-protobuf"];
@@ -2146,10 +2143,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1949w1lcd3iyiy4n6zgnrhdp78k9khbh2pbkrpkv263bbpmw8llg";
+      sha256 = "0w860lqs5j6n58a8qn4wr16hp0qz7cq5h67dgma04gncjwqiyhf5";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.3.0";
   };
   googleauth = {
     dependencies = ["faraday" "jwt" "memoist" "multi_json" "os" "signet"];
@@ -2223,10 +2220,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10q5zipwgjgaan9lfqakdkm5ry8afgkq79bkimgksn6jyyvpz6w8";
+      sha256 = "1lcf0gc88i3wk8cs71qm62ac9lrc1a8v5sd0369c5ip2ic4wbqh2";
       type = "gem";
     };
-    version = "1.4.10";
+    version = "1.8.0";
   };
   graphlient = {
     dependencies = ["faraday" "faraday_middleware" "graphql-client"];
@@ -2277,10 +2274,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rsglf7ag17n465iff7vlw83pn2rpl4kv9sb1rpf17nx6xpi7yl5";
+      sha256 = "0jjq2ing7px4zvdrg9xcq5a9qsciq6g3v14n95a3d9n6cyg69lmk";
       type = "gem";
     };
-    version = "1.30.2";
+    version = "1.42.0";
   };
   gssapi = {
     dependencies = ["ffi"];
@@ -2968,10 +2965,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bp001p687nsa4a8sp3q1iv8pfhs24w7s3avychjp64sdkg6jxq3";
+      sha256 = "0kky3yiwagsk8gfbzn3mvl2fxlh3b39v6nawzm4wpjs6xxvvc4x0";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.0.2";
   };
   marginalia = {
     dependencies = ["actionpack" "activerecord"];
@@ -3074,10 +3071,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ad0mli9rc0f17zw4ibp24dbj1y39zkykijsjmnzl4gwpg5s0j6k";
+      sha256 = "1lvxm91hi0pabnkkg47wh1siv56s6slm2mdq1idfm86dyfidfprq";
       type = "gem";
     };
-    version = "2.5.3";
+    version = "2.6.1";
   };
   minitest = {
     groups = ["development" "test"];
@@ -3333,21 +3330,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vrn31385ix5k9b0yalnlzv360isv6dincbcvi8psllnwz4sjxj9";
+      sha256 = "1v02g7k7cxiwdcahvlxrmizn3avj2q6nsjccgilq1idc89cr081b";
       type = "gem";
     };
-    version = "1.11.7";
-  };
-  nokogumbo = {
-    dependencies = ["nokogiri"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0sxjnpjvrn10gdmfw2dimhch861lz00f28hvkkz0b1gc2rb65k9s";
-      type = "gem";
-    };
-    version = "2.0.2";
+    version = "1.12.5";
   };
   notiffany = {
     dependencies = ["nenv" "shellany"];
@@ -3681,10 +3667,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nqhgvq006h6crbp8lffw66ll46zf319c2637g4sybdclglismma";
+      sha256 = "0w474bz3s1hqhilvrddr33l2nkyikypaczp3808w0345jr88b5m7";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.3.0";
   };
   openssl = {
     groups = ["default"];
@@ -4010,10 +3996,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
+      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
       type = "gem";
     };
-    version = "1.5.2";
+    version = "1.6.0";
   };
   rack = {
     groups = ["default" "development" "kerberos" "test"];
@@ -4107,10 +4093,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y59m2x8rdc581bjgyyr9dabi3vk3frqhhpbb5ldpbj622kxfpbz";
+      sha256 = "10vylypjzfp6c34zx175x7ql7h27llmjdhgjxp5bn2zmrx3lac8l";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   rails-controller-testing = {
     dependencies = ["actionpack" "actionview" "activesupport"];
@@ -4162,10 +4148,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kwpm068cqys34p2g0j3l1g0cd5f3kxnsay5v7lmbd0sgarac0vy";
+      sha256 = "1nmyds2www6dmqbbd5ggq31gxxb9mwxd5llzmb3iyczssk6l7lla";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   rainbow = {
     groups = ["default" "development" "test"];
@@ -4208,21 +4194,6 @@
     };
     version = "0.10.1";
   };
-  rblineprof = {
-    dependencies = ["debugger-ruby_core_source"];
-    groups = ["development"];
-    platforms = [{
-      engine = "maglev";
-    } {
-      engine = "ruby";
-    }];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0m58kdjgncwf0h1qry3qk5h4bg8sj0idykqqijqcrr09mxfd9yc6";
-      type = "gem";
-    };
-    version = "0.3.6";
-  };
   rbtrace = {
     dependencies = ["ffi" "msgpack" "optimist"];
     groups = ["default"];
@@ -4479,10 +4450,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "197k0vskf72wxx0gzwld2jzg27bb7982xlvnzy9adlvkzp7nh8vf";
+      sha256 = "0530ri0p60km0bg0ib6swkhfnas427cva7vcdmnwl8df52a10y1k";
       type = "gem";
     };
-    version = "3.26.1";
+    version = "3.27.0";
   };
   rqrcode = {
     dependencies = ["chunky_png"];
@@ -4709,10 +4680,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mn1m682l6hv54afh1an5lh623zbllgl2aqjz2f62v892slzkq57";
+      sha256 = "192bc7a4jgqcjgsp8jzkb2f355k5shy133zbvfcrjb7rjla7n9l9";
       type = "gem";
     };
-    version = "0.4.0";
+    version = "0.5.3";
   };
   ruby-prof = {
     groups = ["default"];
@@ -4838,15 +4809,15 @@
     version = "0.4.0";
   };
   sanitize = {
-    dependencies = ["crass" "nokogiri" "nokogumbo"];
+    dependencies = ["crass" "nokogiri"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18m3zcf207gcrmghx288w3n2kpphc22lbmbc1wdx1nzcn8g2yddh";
+      sha256 = "1zq8pxmsd1abw18zz6mazsm2jfpwmbgdxbpawb7bmwvkb2c5yyc1";
       type = "gem";
     };
-    version = "5.2.1";
+    version = "6.0.0";
   };
   sass = {
     dependencies = ["sass-listen"];
@@ -5034,10 +5005,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1aliswahmpxn1ib2brn4126gk97ac3zdnwr71mn8vzbr3vdd7fl0";
+      sha256 = "0hxvm42zbr27k40jvdba5v8ich2ys8q7a2wbia9sxb0mmcy8v2aj";
       type = "gem";
     };
-    version = "1.0.4";
+    version = "1.2.0";
   };
   signet = {
     dependencies = ["addressable" "faraday" "jwt" "multi_json"];
@@ -5318,10 +5289,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0c5cdpykx2h4jx8q01hjhv8f0plw5r9iqm2i1m0ijiyk7dqm824w";
+      sha256 = "12b3q2sw42nnilfb51nlqdv07f31vdv2j595kd99asnkw4cjlf5w";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.3.0";
   };
   sys-filesystem = {
     dependencies = ["ffi"];
@@ -5605,6 +5576,17 @@
     };
     version = "0.8.1";
   };
+  typhoeus = {
+    dependencies = ["ethon"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1m22yrkmbj81rzhlny81j427qdvz57yk5wbcf3km0nf3bl6qiygz";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
   tzinfo = {
     dependencies = ["concurrent-ruby"];
     groups = ["default" "development" "test"];
@@ -5832,10 +5814,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0m0jh8k7c0ifh2jhbn7ihqrmn5fi754wflva97zgy70hpdvxyjar";
+      sha256 = "18jj50b44a471ig7hw1ax90wxaaz40acmrf6cm7m2iyshlffy53q";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.0";
   };
   webmock = {
     dependencies = ["addressable" "crack" "hashdiff"];
@@ -5966,9 +5948,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18l4r6layck0d80ydc692mv1lxak5xbf6w2paj1x7m2ggbggzxgj";
+      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.5.3";
   };
 }

pkgs/applications/version-management/gitless/default.nix

@@ -1,27 +1,42 @@
-{ fetchFromGitHub, python, lib }:
+{ lib
+, fetchFromGitHub
+, python3
+}:
 
-with python.pkgs;
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "gitless";
   version = "0.8.8";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "gitless-vcs";
-    repo = "gitless";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xo5EWtP2aN8YzP8ro3bnxZwUGUp0PHD0g8hk+Y+gExE=";
+    hash = "sha256-xo5EWtP2aN8YzP8ro3bnxZwUGUp0PHD0g8hk+Y+gExE=";
   };
 
-  propagatedBuildInputs = with pythonPackages; [ sh pygit2 clint ];
+  propagatedBuildInputs = with python3.pkgs; [
+    sh
+    pygit2
+    clint
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pygit2==0.28.2" "pygit2>=0.28.2"
+  '';
 
   doCheck = false;
 
+  pythonImportsCheck = [
+    "gitless"
+  ];
+
   meta = with lib; {
+    description = "Version control system built on top of Git";
     homepage = "https://gitless.com/";
-    description = "A version control system built on top of Git";
-    license = licenses.gpl2;
+    license = licenses.mit;
+    maintainers = with maintainers; [ cransom ];
     platforms = platforms.all;
-    maintainers = [ maintainers.cransom ];
   };
 }
-

pkgs/applications/video/lbry/default.nix

@@ -2,7 +2,7 @@
 
 let
   pname = "lbry-desktop";
-  version = "0.50.2";
+  version = "0.52.0";
 in appimageTools.wrapAppImage rec {
   name = "${pname}-${version}";
 
@@ -12,7 +12,7 @@ in appimageTools.wrapAppImage rec {
     src = fetchurl {
       url = "https://github.com/lbryio/lbry-desktop/releases/download/v${version}/LBRY_${version}.AppImage";
       # Gotten from latest-linux.yml
-      sha512 = "br6HvVRz+ybmAhmQh3vOC5wgLmOCVrGHDn59ueWk6rFoKOCbm8WdmdadOZvHeN1ld2nlvPzEy+KXMOEfF1LeQg==";
+      sha512 = "FMsO1tUhym11hxot/0S4pXwjvt1YhOUahwiQU+HhOxrZhcrOwwyXUzMy3sAzKdZjidKpA5DbLjkgwPlg2kGWwg==";
     };
   };
 

pkgs/applications/video/plex-mpv-shim/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildPythonApplication, fetchFromGitHub, mpv, requests, python-mpv-jsonipc }:
+{ lib, buildPythonApplication, fetchFromGitHub, mpv, requests, python-mpv-jsonipc, pystray, tkinter }:
 
 buildPythonApplication rec {
   pname = "plex-mpv-shim";
@@ -11,7 +11,7 @@ buildPythonApplication rec {
     sha256 = "0hgv9g17dkrh3zbsx27n80yvkgix9j2x0rgg6d3qsf7hp5j3xw4r";
   };
 
-  propagatedBuildInputs = [ mpv requests python-mpv-jsonipc ];
+  propagatedBuildInputs = [ mpv requests python-mpv-jsonipc pystray tkinter ];
 
   # does not contain tests
   doCheck = false;

pkgs/applications/video/srtrelay/default.nix

@@ -1,17 +1,17 @@
 { lib, buildGoModule, fetchFromGitHub, srt, ffmpeg }:
 
 buildGoModule rec {
-  pname = "srtrelay-unstable";
-  version = "2021-07-28";
+  pname = "srtrelay";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "voc";
     repo = "srtrelay";
-    rev = "c4f02ff2e9637b01a0679b29e5a76f4521eeeef3";
-    sha256 = "06zbl97bjjyv51zp27qk37ffpbh1ylm9bsr0s5qlyd73pyavcj1g";
+    rev = "v${version}";
+    sha256 = "sha256-CA+UuFOWjZjSBDWM62rda3IKO1fwC3X52mP4tg1uoO4=";
   };
 
-  vendorSha256 = "1pdpb0my7gdvjjkka6jhj19b9nx575k6117hg536b106ij2n4zd2";
+  vendorSha256 = "sha256-xTYlfdijSo99ei+ZMX6N9gl+yw0DrPQ2wOhn6SS9S/E=";
 
   buildInputs = [ srt ];
   checkInputs = [ ffmpeg ];

pkgs/applications/video/streamlink/default.nix

@@ -6,11 +6,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "streamlink";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "sha256-T2M0vg+BYIdr21CcdrrBf7bVVlZU+tKJWG2xfBMoMlg=";
+    sha256 = "sha256-hVzTHpAOOuHVMoo3Ejv//irsUBoddLzdEvDSonWAYOQ=";
   };
 
   checkInputs = with python3Packages; [

pkgs/applications/video/vlc/default.nix

@@ -155,7 +155,7 @@ stdenv.mkDerivation rec {
     xcbutilkeysyms
     xlibsWrapper
   ])
-  ++ optional (!hostIsAarch) live555
+  ++ optional (!hostIsAarch && !onlyLibVLC) live555
   ++ optional jackSupport libjack2
   ++ optionals chromecastSupport [ libmicrodns protobuf ]
   ++ optionals skins2Support (with xorg; [
@@ -192,6 +192,16 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/4250fe8f28c220d883db454cec2b2c76a07473eb/trunk/vlc-3.0.11.1-srt_1.4.2.patch";
       sha256 = "53poWjZfwq/6l316sqiCp0AtcGweyXBntcLDFPSokHQ=";
     })
+    # patches to build with recent live555
+    # upstream issue: https://code.videolan.org/videolan/vlc/-/issues/25473
+    (fetchpatch {
+      url = "https://code.videolan.org/videolan/vlc/uploads/3c84ea58d7b94d7a8d354eaffe4b7d55/0001-Get-addr-by-ref.-from-getConnectionEndpointAddress.patch";
+      sha256 = "171d3qjl9a4dm13sqig3ra8s2zcr76wfnqz4ba4asg139cyc1axd";
+    })
+    (fetchpatch {
+      url = "https://code.videolan.org/videolan/vlc/uploads/eb1c313d2d499b8a777314f789794f9d/0001-Add-lssl-and-lcrypto-to-liblive555_plugin_la_LIBADD.patch";
+      sha256 = "0kyi8q2zn2ww148ngbia9c7qjgdrijf4jlvxyxgrj29cb5iy1kda";
+    })
   ];
 
   postPatch = ''

pkgs/applications/virtualization/crun/default.nix

@@ -37,13 +37,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    sha256 = "sha256-j2+ga+jnKnjnFGmrOOym99keLALg7wR7Jk+jjesiMc4=";
+    sha256 = "sha256-zGtHO8CgpbXTh8nZ6WA0ocakzLjL/PW2IULI5QSEPVI=";
     fetchSubmodules = true;
   };
 

pkgs/applications/virtualization/xen/generic.nix

@@ -254,5 +254,9 @@ stdenv.mkDerivation (rec {
     platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ eelco tstrobel oxij ];
     license = lib.licenses.gpl2;
+    # https://xenbits.xen.org/docs/unstable/support-matrix.html
+    knownVulnerabilities = lib.optionals (lib.versionOlder version "4.13") [
+      "This version of Xen has reached its end of life. See https://xenbits.xen.org/docs/unstable/support-matrix.html"
+    ];
   } // (config.meta or {});
 } // removeAttrs config [ "xenfiles" "buildInputs" "patches" "postPatch" "meta" ])

pkgs/applications/window-managers/qtile/default.nix

@@ -1,23 +1,15 @@
-{ lib, fetchFromGitHub, python3, mypy, glib, cairo, pango, pkg-config, libxcb, xcbutilcursor }:
+{ lib, fetchFromGitHub, python3, python3Packages, mypy, glib, pango, pkg-config, xcbutilcursor }:
 
 let
-  enabled-xcffib = cairocffi-xcffib: cairocffi-xcffib.override {
-    withXcffib = true;
-  };
-
-  # make it easier to reference python
-  python = python3;
-  pythonPackages = python.pkgs;
-
-  unwrapped = pythonPackages.buildPythonPackage rec {
+  unwrapped = python3Packages.buildPythonPackage rec {
     pname = "qtile";
-    version = "0.19.0";
+    version = "0.20.0";
 
     src = fetchFromGitHub {
       owner = "qtile";
       repo = "qtile";
       rev = "v${version}";
-      sha256 = "BLHGVPMQd8O4h5TVx/F/klzSra+FZYogp22V6Yq04T0=";
+      sha256 = "TRmul3t//izJRdViTvxFz29JZeGYsWc7WsJjagQ35nw=";
     };
 
     postPatch = ''
@@ -33,13 +25,13 @@ let
 
     nativeBuildInputs = [
       pkg-config
-    ] ++ (with pythonPackages; [
+    ] ++ (with python3Packages; [
       setuptools-scm
     ]);
 
-    propagatedBuildInputs = with pythonPackages; [
+    propagatedBuildInputs = with python3Packages; [
       xcffib
-      (enabled-xcffib cairocffi)
+      (cairocffi.override { withXcffib = true; })
       setuptools
       python-dateutil
       dbus-python
@@ -68,9 +60,9 @@ let
     };
   };
 in
-  (python.withPackages (ps: [ unwrapped ])).overrideAttrs (_: {
-    # otherwise will be exported as "env", this restores `nix search` behavior
-    name = "${unwrapped.pname}-${unwrapped.version}";
-    # export underlying qtile package
-    passthru = { inherit unwrapped; };
-  })
+(python3.withPackages (_: [ unwrapped ])).overrideAttrs (_: {
+  # otherwise will be exported as "env", this restores `nix search` behavior
+  name = "${unwrapped.pname}-${unwrapped.version}";
+  # export underlying qtile package
+  passthru = { inherit unwrapped; };
+})