Merge master into haskell-updates

2022-04-19 00:11:02 +00:00 · 2022-04-19 00:11:02 +00:00 · 26f575c4a5
commit 26f575c4a5
parent ce26585db5 a035e679a7
104 changed files with 1598 additions and 641 deletions
--- a/doc/hooks/index.xml
+++ b/doc/hooks/index.xml
@ -0,0 +1,10 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         xml:id="chap-hooks">
+ <title>Hooks reference</title>
+ <para>
+  Nixpkgs has several hook packages that augment the stdenv phases.
+ </para>
+ <xi:include href="./postgresql-test-hook.section.xml" />
+</chapter>
--- a/doc/hooks/postgresql-test-hook.section.md
+++ b/doc/hooks/postgresql-test-hook.section.md
@ -0,0 +1,59 @@
+
+# `postgresqlTestHook` {#sec-postgresqlTestHook}
+
+This hook starts a PostgreSQL server during the `checkPhase`. Example:
+
+```nix
+{ stdenv, postgresql, postgresqlTestHook }:
+stdenv.mkDerivation {
+
+  # ...
+
+  checkInputs = [
+    postgresql
+    postgresqlTestHook
+  ];
+}
+```
+
+If you use a custom `checkPhase`, remember to add the `runHook` calls:
+```nix
+  checkPhase ''
+    runHook preCheck
+
+    # ... your tests
+
+    runHook postCheck
+  ''
+```
+
+## Variables {#sec-postgresqlTestHook-variables}
+
+The hook logic will read a number of variables and set them to a default value if unset or empty.
+
+Exported variables:
+
+ - `PGDATA`: location of server files.
+ - `PGHOST`: location of UNIX domain socket directory; the default `host` in a connection string.
+ - `PGUSER`: user to create / log in with, default: `test_user`.
+ - `PGDATABASE`: database name, default: `test_db`.
+
+Bash-only variables:
+
+ - `postgresqlTestUserOptions`: SQL options to use when creating the `$PGUSER` role, default: `LOGIN`.
+ - `postgresqlTestSetupSQL`: SQL commands to run as database administrator after startup, default: statements that create `$PGUSER` and `$PGDATABASE`.
+ - `postgresqlTestSetupCommands`: bash commands to run after database start, defaults to running `$postgresqlTestSetupSQL` as database administrator.
+ - `postgresqlEnableTCP`: set to `1` to enable TCP listening. Flaky; not recommended.
+ - `postgresqlStartCommands`: defaults to `pg_ctl start`.
+
+## TCP and the Nix sandbox {#sec-postgresqlTestHook-tcp}
+
+`postgresqlEnableTCP` relies on network sandboxing, which is not available on macOS and some custom Nix installations, resulting in flaky tests.
+For this reason, it is disabled by default.
+
+The preferred solution is to make the test suite use a UNIX domain socket connection. This is the default behavior when no `host` connection parameter is provided.
+Some test suites hardcode a value for `host` though, so a patch may be required. If you can upstream the patch, you can make `host` default to the `PGHOST` environment variable when set. Otherwise, you can patch it locally to omit the `host` connection string parameter altogether.
+
+::: {.note}
+The error `libpq: failed (could not receive data from server: Connection refused` is generally an indication that the test suite is trying to connect through TCP.
+:::
--- a/doc/manual.xml
+++ b/doc/manual.xml
@ -27,6 +27,7 @@
  <xi:include href="builders/trivial-builders.chapter.xml" />
  <xi:include href="builders/special.xml" />
  <xi:include href="builders/images.xml" />
+  <xi:include href="hooks/index.xml" />
  <xi:include href="languages-frameworks/index.xml" />
  <xi:include href="builders/packages/index.xml" />
 </part>
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -73,6 +73,13 @@
          Systemd has been upgraded to the version 250.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The new
+          <link xlink:href="https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook"><literal>postgresqlTestHook</literal></link>
+          runs a PostgreSQL server for the duration of package checks.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://kops.sigs.k8s.io"><literal>kops</literal></link>
@ -1238,6 +1245,14 @@
          <literal>systemd.nspawn.&lt;name&gt;.execConfig.PrivateUsers = false</literal>
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>systemd-shutdown</literal> is now properly linked on
+          shutdown to unmount all filesystems and device mapper devices
+          cleanly. This can be disabled using
+          <literal>boot.systemd.shutdown.enable</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The Tor SOCKS proxy is now actually disabled if
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -27,6 +27,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - Systemd has been upgraded to the version 250.

+- The new [`postgresqlTestHook`](https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook) runs a PostgreSQL server for the duration of package checks.
+
 - [`kops`](https://kops.sigs.k8s.io) defaults to 1.22.4, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes 1.22. This will increase security by default, but may break some types of workloads. See the [release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) for details.

 - Module authors can use `mkRenamedOptionModuleWith` to automate the deprecation cycle without annoying out-of-tree module authors and their users.
@ -492,6 +494,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `systemd-nspawn@.service` settings have been reverted to the default systemd behaviour. User namespaces are now activated by default. If you want to keep running nspawn containers without user namespaces you need to set `systemd.nspawn.<name>.execConfig.PrivateUsers = false`

+- `systemd-shutdown` is now properly linked on shutdown to unmount all filesystems and device mapper devices cleanly. This can be disabled using `boot.systemd.shutdown.enable`.
+
 - The Tor SOCKS proxy is now actually disabled if `services.tor.client.enable` is set to `false` (the default). If you are using this functionality but didn't change the setting or set it to `false`, you now need to set it to `true`.

 - The terraform 0.12 compatibility has been removed and the `terraform.withPlugins` and `terraform-providers.mkProvider` implementations simplified. Providers now need to be stored under
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1183,6 +1183,7 @@
  ./system/boot/systemd/journald.nix
  ./system/boot/systemd/logind.nix
  ./system/boot/systemd/nspawn.nix
+  ./system/boot/systemd/shutdown.nix
  ./system/boot/systemd/tmpfiles.nix
  ./system/boot/systemd/user.nix
  ./system/boot/systemd/initrd.nix
--- a/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
@ -58,7 +58,7 @@ in {
            Configuration for the media session core. For details see
            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/media-session.conf
          '';
-          default = {};
+          default = defaults.media-session;
        };

        alsa-monitor = mkOption {
@ -67,7 +67,7 @@ in {
            Configuration for the alsa monitor. For details see
            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/alsa-monitor.conf
          '';
-          default = {};
+          default = defaults.alsa-monitor;
        };

        bluez-monitor = mkOption {
@ -76,7 +76,7 @@ in {
            Configuration for the bluez5 monitor. For details see
            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/bluez-monitor.conf
          '';
-          default = {};
+          default = defaults.bluez-monitor;
        };

        v4l2-monitor = mkOption {
@ -85,7 +85,7 @@ in {
            Configuration for the V4L2 monitor. For details see
            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/v4l2-monitor.conf
          '';
-          default = {};
+          default = defaults.v4l2-monitor;
        };
      };
    };
--- a/nixos/modules/services/monitoring/prometheus/exporters.xml
+++ b/nixos/modules/services/monitoring/prometheus/exporters.xml
@ -19,6 +19,7 @@
 <programlisting>
  services.prometheus.exporters.node = {
    enable = true;
+    port = 9100;
    enabledCollectors = [
      "logind"
      "systemd"
@ -42,6 +43,26 @@
   <link xlink:href="https://nixos.org/nixos/options.html#prometheus.exporters">available
   options</link>.
  </para>
+
+  <para>
+    Prometheus can now be configured to consume the metrics produced by the exporter:
+    <programlisting>
+    services.prometheus = {
+      # ...
+
+      scrapeConfigs = [
+        {
+          job_name = "node";
+          static_configs = [{
+            targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
+          }];
+        }
+      ];
+
+      # ...
+    }
+    </programlisting>
+  </para>
 </section>
 <section xml:id="module-services-prometheus-exporters-new-exporter">
  <title>Adding a new exporter</title>
--- a/nixos/modules/services/networking/nbd.nix
+++ b/nixos/modules/services/networking/nbd.nix
@ -4,28 +4,34 @@ with lib;

 let
  cfg = config.services.nbd;
-  configFormat = pkgs.formats.ini { };
  iniFields = with types; attrsOf (oneOf [ bool int float str ]);
-  serverConfig = configFormat.generate "nbd-server-config"
-    ({
-      generic =
-        (cfg.server.extraOptions // {
-          user = "root";
-          group = "root";
-          port = cfg.server.listenPort;
-        } // (optionalAttrs (cfg.server.listenAddress != null) {
-          listenaddr = cfg.server.listenAddress;
-        }));
-    }
-    // (mapAttrs
+  # The `[generic]` section must come before all the others in the
+  # config file.  This means we can't just dump an attrset to INI
+  # because that sorts the sections by name.  Instead, we serialize it
+  # on its own first.
+  genericSection = {
+    generic = (cfg.server.extraOptions // {
+      user = "root";
+      group = "root";
+      port = cfg.server.listenPort;
+    } // (optionalAttrs (cfg.server.listenAddress != null) {
+      listenaddr = cfg.server.listenAddress;
+    }));
+  };
+  exportSections =
+    mapAttrs
      (_: { path, allowAddresses, extraOptions }:
        extraOptions // {
          exportname = path;
        } // (optionalAttrs (allowAddresses != null) {
          authfile = pkgs.writeText "authfile" (concatStringsSep "\n" allowAddresses);
        }))
-      cfg.server.exports)
-    );
+      cfg.server.exports;
+  serverConfig =
+    pkgs.writeText "nbd-server-config" ''
+      ${lib.generators.toINI {} genericSection}
+      ${lib.generators.toINI {} exportSections}
+    '';
  splitLists =
    partition
      (path: hasPrefix "/dev/" path)
@ -103,6 +109,13 @@ in
  };

  config = mkIf cfg.server.enable {
+    assertions = [
+      {
+        assertion = !(cfg.server.exports ? "generic");
+        message = "services.nbd.server exports must not be named 'generic'";
+      }
+    ];
+
    boot.kernelModules = [ "nbd" ];

    systemd.services.nbd-server = {
--- a/nixos/modules/services/system/nscd.nix
+++ b/nixos/modules/services/system/nscd.nix
@ -7,10 +7,6 @@ let
  nssModulesPath = config.system.nssModules.path;
  cfg = config.services.nscd;

-  nscd = if pkgs.stdenv.hostPlatform.libc == "glibc"
-         then pkgs.stdenv.cc.libc.bin
-         else pkgs.glibc.bin;
-
 in

 {
@ -37,6 +33,19 @@ in
        description = "Configuration to use for Name Service Cache Daemon.";
      };

+      package = mkOption {
+        type = types.package;
+        default = if pkgs.stdenv.hostPlatform.libc == "glibc"
+          then pkgs.stdenv.cc.libc.bin
+          else pkgs.glibc.bin;
+        defaultText = literalExample ''
+          if pkgs.stdenv.hostPlatform.libc == "glibc"
+            then pkgs.stdenv.cc.libc.bin
+            else pkgs.glibc.bin;
+        '';
+        description = "package containing the nscd binary to be used by the service";
+      };
+
    };

  };
@ -69,16 +78,16 @@ in
        # files. So prefix the ExecStart command with "!" to prevent systemd
        # from dropping privileges early. See ExecStart in systemd.service(5).
        serviceConfig =
-          { ExecStart = "!@${nscd}/sbin/nscd nscd";
+          { ExecStart = "!@${cfg.package}/bin/nscd nscd";
            Type = "forking";
            DynamicUser = true;
            RuntimeDirectory = "nscd";
            PIDFile = "/run/nscd/nscd.pid";
            Restart = "always";
            ExecReload =
-              [ "${nscd}/sbin/nscd --invalidate passwd"
-                "${nscd}/sbin/nscd --invalidate group"
-                "${nscd}/sbin/nscd --invalidate hosts"
+              [ "${cfg.package}/bin/nscd --invalidate passwd"
+                "${cfg.package}/bin/nscd --invalidate group"
+                "${cfg.package}/bin/nscd --invalidate hosts"
              ];
          };
      };
--- a/nixos/modules/system/boot/systemd/shutdown.nix
+++ b/nixos/modules/system/boot/systemd/shutdown.nix
@ -0,0 +1,32 @@
+{ config, lib, ... }: let
+
+  cfg = config.boot.systemd.shutdown;
+
+in {
+  options.boot.systemd.shutdown = {
+    enable = lib.mkEnableOption "pivoting back to an initramfs for shutdown" // { default = true; };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.generate-shutdown-ramfs = {
+      description = "Generate shutdown ramfs";
+      before = [ "shutdown.target" ];
+      unitConfig = {
+        DefaultDependencies = false;
+        ConditionFileIsExecutable = [
+          "!/run/initramfs/shutdown"
+          "/run/current-system/systemd/lib/systemd/systemd-shutdown"
+        ];
+      };
+
+      serviceConfig.Type = "oneshot";
+      script = ''
+        mkdir -p /run/initramfs
+        if ! mountpoint -q /run/initramfs; then
+          mount -t tmpfs tmpfs /run/initramfs
+        fi
+        cp /run/current-system/systemd/lib/systemd/systemd-shutdown /run/initramfs/shutdown
+      '';
+    };
+  };
+}
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -403,6 +403,15 @@ let
    </itemizedlist>
  '';

+  hostidFile = pkgs.runCommand "gen-hostid" { preferLocalBuild = true; } ''
+      hi="${cfg.hostId}"
+      ${if pkgs.stdenv.isBigEndian then ''
+        echo -ne "\x''${hi:0:2}\x''${hi:2:2}\x''${hi:4:2}\x''${hi:6:2}" > $out
+      '' else ''
+        echo -ne "\x''${hi:6:2}\x''${hi:4:2}\x''${hi:2:2}\x''${hi:0:2}" > $out
+      ''}
+    '';
+
 in

 {
@ -1383,16 +1392,8 @@ in
        domainname "${cfg.domain}"
      '';

-    environment.etc.hostid = mkIf (cfg.hostId != null)
-      { source = pkgs.runCommand "gen-hostid" { preferLocalBuild = true; } ''
-          hi="${cfg.hostId}"
-          ${if pkgs.stdenv.isBigEndian then ''
-            echo -ne "\x''${hi:0:2}\x''${hi:2:2}\x''${hi:4:2}\x''${hi:6:2}" > $out
-          '' else ''
-            echo -ne "\x''${hi:6:2}\x''${hi:4:2}\x''${hi:2:2}\x''${hi:0:2}" > $out
-          ''}
-        '';
-      };
+    environment.etc.hostid = mkIf (cfg.hostId != null) { source = hostidFile; };
+    boot.initrd.systemd.contents."/etc/hostid" = mkIf (cfg.hostId != null) { source = hostidFile; };

    # static hostname configuration needed for hostnamectl and the
    # org.freedesktop.hostname1 dbus service (both provided by systemd)
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -524,6 +524,7 @@ in
  systemd-confinement = handleTest ./systemd-confinement.nix {};
  systemd-cryptenroll = handleTest ./systemd-cryptenroll.nix {};
  systemd-escaping = handleTest ./systemd-escaping.nix {};
+  systemd-initrd-shutdown = handleTest ./systemd-shutdown.nix { systemdStage1 = true; };
  systemd-initrd-simple = handleTest ./systemd-initrd-simple.nix {};
  systemd-initrd-swraid = handleTest ./systemd-initrd-swraid.nix {};
  systemd-journal = handleTest ./systemd-journal.nix {};
@ -534,6 +535,7 @@ in
  systemd-networkd-ipv6-prefix-delegation = handleTest ./systemd-networkd-ipv6-prefix-delegation.nix {};
  systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
  systemd-nspawn = handleTest ./systemd-nspawn.nix {};
+  systemd-shutdown = handleTest ./systemd-shutdown.nix {};
  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
  systemd-misc = handleTest ./systemd-misc.nix {};
  taskserver = handleTest ./taskserver.nix {};
--- a/nixos/tests/nbd.nix
+++ b/nixos/tests/nbd.nix
@ -28,6 +28,11 @@ import ./make-test-python.nix ({ pkgs, ... }:
        ## It's also a loopback device to test exporting /dev/...
        systemd.services.create-priv-file =
          mkCreateSmallFileService { path = "/vault-priv.disk"; loop = true; };
+        ## `aaa.disk` is just here because "[aaa]" sorts before
+        ## "[generic]" lexicographically, and nbd-server breaks if
+        ## "[generic]" isn't the first section.
+        systemd.services.create-aaa-file =
+          mkCreateSmallFileService { path = "/aaa.disk"; };

        # Needed only for nbd-client used in the tests.
        environment.systemPackages = [ pkgs.nbd ];
@ -39,6 +44,9 @@ import ./make-test-python.nix ({ pkgs, ... }:
        services.nbd.server = {
          enable = true;
          exports = {
+            aaa = {
+              path = "/aaa.disk";
+            };
            vault-pub = {
              path = "/vault-pub.disk";
            };
@ -83,5 +91,13 @@ import ./make-test-python.nix ({ pkgs, ... }:
      if foundString != testString:
         raise Exception(f"Read the wrong string from nbd disk. Expected: '{testString}'. Found: '{foundString}'")
      server.succeed("nbd-client -d /dev/nbd0")
+
+      # Server: Successfully connect to the aaa disk
+      server.succeed("nbd-client localhost ${toString listenPort} /dev/nbd0 -name aaa -persist")
+      server.succeed(f"echo '{testString}' | dd of=/dev/nbd0 conv=notrunc")
+      foundString = server.succeed(f"dd status=none if=/aaa.disk count={len(testString)}")[:len(testString)]
+      if foundString != testString:
+         raise Exception(f"Read the wrong string from nbd disk. Expected: '{testString}'. Found: '{foundString}'")
+      server.succeed("nbd-client -d /dev/nbd0")
    '';
  })
--- a/nixos/tests/systemd-shutdown.nix
+++ b/nixos/tests/systemd-shutdown.nix
@ -0,0 +1,21 @@
+import ./make-test-python.nix ({ pkgs, systemdStage1 ? false, ...} : {
+  name = "systemd-shutdown";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ das_j ];
+  };
+
+  nodes.machine = {
+    imports = [ ../modules/profiles/minimal.nix ];
+    boot.initrd.systemd.enable = systemdStage1;
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    # .shutdown() would wait for the machine to power off
+    machine.succeed("systemctl poweroff")
+    # Message printed by systemd-shutdown
+    machine.wait_for_console_text("All filesystems, swaps, loop devices, MD devices and DM devices detached.")
+    # Don't try to sync filesystems
+    machine.booted = False
+  '';
+})
--- a/pkgs/applications/audio/helio-workstation/default.nix
+++ b/pkgs/applications/audio/helio-workstation/default.nix
@ -5,14 +5,14 @@

 stdenv.mkDerivation rec {
  pname = "helio-workstation";
-  version = "3.8";
+  version = "3.9";

  src = fetchFromGitHub {
    owner = "helio-fm";
    repo = pname;
    rev = version;
    fetchSubmodules = true;
-    sha256 = "sha256-uwRSOJ5WvDH4mfL9pCTCGzuSRT8SIBrI+Wsbumzejv0=";
+    sha256 = "sha256-AtgKgw+F5lc0Ma3zOxmk3iaZQp2KZb2FP5F8QvvYTT4=";
  };

  buildInputs = [
--- a/pkgs/applications/audio/qpwgraph/default.nix
+++ b/pkgs/applications/audio/qpwgraph/default.nix
@ -5,14 +5,14 @@

 mkDerivation rec {
  pname = "qpwgraph";
-  version = "0.2.2";
+  version = "0.2.5";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "rncbc";
    repo = "qpwgraph";
    rev = "v${version}";
-    sha256 = "sha256-BBvF1L3IqkYqSghHxcbwOBizdu6GtxaWof3Q/bc+aTY=";
+    sha256 = "sha256-OYIBlTO1vXmmY4/ZacvsEQ5EnOfetBvnG2v5xL44czY=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
@ -29,6 +29,6 @@ mkDerivation rec {
    homepage = "https://gitlab.freedesktop.org/rncbc/qpwgraph";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ kanashimia ];
+    maintainers = with maintainers; [ kanashimia exi ];
  };
 }
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@ -8,7 +8,7 @@
 }:
 { stdenv, lib, fetchurl, fetchpatch, ncurses, xlibsWrapper, libXaw, libXpm
 , Xaw3d, libXcursor,  pkg-config, gettext, libXft, dbus, libpng, libjpeg, giflib
-, libtiff, librsvg, gconf, libxml2, imagemagick, gnutls, libselinux
+, libtiff, librsvg, libwebp, gconf, libxml2, imagemagick, gnutls, libselinux
 , alsa-lib, cairo, acl, gpm, AppKit, GSS, ImageIO, m17n_lib, libotf
 , sigtool, jansson, harfbuzz, sqlite, nixosTests
 , dontRecurseIntoAttrs, emacsPackagesFor
@ -22,6 +22,7 @@
 , withMotif ? false, motif ? null
 , withSQLite3 ? false
 , withCsrc ? true
+, withWebP ? false
 , srcRepo ? false, autoreconfHook ? null, texinfo ? null
 , siteStart ? ./site-start.el
 , nativeComp ? false
@ -134,6 +135,7 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
    ++ lib.optionals (withX && withGTK3) [ gtk3-x11 gsettings-desktop-schemas ]
    ++ lib.optional (withX && withMotif) motif
    ++ lib.optional withSQLite3 sqlite
+    ++ lib.optional withWebP libwebp
    ++ lib.optionals (withX && withXwidgets) [ webkitgtk glib-networking ]
    ++ lib.optionals withNS [ AppKit GSS ImageIO ]
    ++ lib.optionals stdenv.isDarwin [ sigtool ]
--- a/pkgs/applications/editors/pinegrow/default.nix
+++ b/pkgs/applications/editors/pinegrow/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
  version = "6.5";

  src = fetchurl {
-    url = "https://download.pinegrow.com/PinegrowLinux64.${version}.zip";
+    url = "https://github.com/Pinegrow/PinegrowReleases/releases/download/pg${version}/PinegrowLinux64.${version}.zip";
    sha256 = "1l7cf5jgidpykaf68mzf92kywl1vxwl3fg43ibgr2rg4cnl1g82b";
  };

--- a/pkgs/applications/emulators/bsnes/ares/default.nix
+++ b/pkgs/applications/emulators/bsnes/ares/default.nix
--- a/pkgs/applications/emulators/bsnes/ares/fix-ruby.patch
+++ b/pkgs/applications/emulators/bsnes/ares/fix-ruby.patch
--- a/pkgs/applications/emulators/bsnes/bsnes-hd/default.nix
+++ b/pkgs/applications/emulators/bsnes/bsnes-hd/default.nix
--- a/pkgs/applications/emulators/bsnes/bsnes-hd/macos-copy-app-to-prefix.patch
+++ b/pkgs/applications/emulators/bsnes/bsnes-hd/macos-copy-app-to-prefix.patch
--- a/pkgs/applications/emulators/bsnes/bsnes-hd/macos-replace-sips-with-png2icns.patch
+++ b/pkgs/applications/emulators/bsnes/bsnes-hd/macos-replace-sips-with-png2icns.patch
--- a/pkgs/applications/emulators/bsnes/higan/001-include-cmath.patch
+++ b/pkgs/applications/emulators/bsnes/higan/001-include-cmath.patch
--- a/pkgs/applications/emulators/bsnes/higan/002-sips-to-png2icns.patch
+++ b/pkgs/applications/emulators/bsnes/higan/002-sips-to-png2icns.patch
--- a/pkgs/applications/emulators/bsnes/higan/default.nix
+++ b/pkgs/applications/emulators/bsnes/higan/default.nix
--- a/pkgs/applications/finance/irpf/default.nix
+++ b/pkgs/applications/finance/irpf/default.nix
@ -10,13 +10,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "irpf";
-  version = "2022-1.0";
+  version = "2022-1.3";

  src = let
    year = lib.head (lib.splitVersion version);
  in fetchzip {
    url = "https://downloadirpf.receita.fazenda.gov.br/irpf/${year}/irpf/arquivos/IRPF${version}.zip";
-    sha256 = "0h8f51ilvg7m6hlx0y5mpxhac90p32ksbrffw0hxdqbilgjz1s68";
+    sha256 = "sha256-nAmcVPSnMIWuq2zj1xq/657RmzaSmdtxlI9cp9v5P0A=";
  };

  nativeBuildInputs = [ unzip makeWrapper copyDesktopItems ];
@ -57,7 +57,12 @@ stdenvNoCC.mkDerivation rec {
  '';

  meta = with lib; {
-    description = "Programa Oficial da Receita para elaboração do IRPF";
+    description = "Brazillian government application for reporting income tax";
+    longDescription = ''
+      Brazillian government application for reporting income tax.
+
+      IRFP - Imposto de Renda Pessoa Física - Receita Federal do Brasil.
+    '';
    homepage = "https://www.gov.br/receitafederal/pt-br";
    license = licenses.unfree;
    platforms = platforms.all;
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@ -5,7 +5,7 @@
 { config, lib, pkgs }:

 let
-  inherit (pkgs) stdenv fetchurl pkg-config intltool glib fetchFromGitHub;
+  inherit (pkgs) stdenv fetchurl fetchpatch pkg-config intltool glib fetchFromGitHub;
 in

 lib.makeScope pkgs.newScope (self:
@ -66,6 +66,45 @@ in
  # Allow overriding GIMP package in the scope.
  inherit (pkgs) gimp;

+  bimp = pluginDerivation rec {
+    /* menu:
+       File/Batch Image Manipulation...
+    */
+    pname = "bimp";
+    version = "2.6";
+
+    src = fetchFromGitHub {
+      owner = "alessandrofrancesconi";
+      repo = "gimp-plugin-bimp";
+      rev = "v${version}";
+      hash = "sha256-IJ3+/9UwxJTRo0hUdzlOndOHwso1wGv7Q4UuhbsFkco=";
+    };
+
+    patches = [
+      # Allow overriding installation path
+      # https://github.com/alessandrofrancesconi/gimp-plugin-bimp/pull/311
+      (fetchpatch {
+        url = "https://github.com/alessandrofrancesconi/gimp-plugin-bimp/commit/098edb5f70a151a3f377478fd6e0d08ed56b8ef7.patch";
+        sha256 = "2Afx9fmdn6ztbsll2f2j7mfffMWYWyr4BuBy9ySV6vM=";
+      })
+    ];
+
+    nativeBuildInputs = with pkgs; [ which ];
+
+    installFlags = [
+      "SYSTEM_INSTALL_DIR=${placeholder "out"}/${gimp.targetPluginDir}/bimp"
+    ];
+
+    installTargets = [ "install-admin" ];
+
+    meta = with lib; {
+      description = "Batch Image Manipulation Plugin for GIMP";
+      homepage = "https://github.com/alessandrofrancesconi/gimp-plugin-bimp";
+      license = licenses.gpl2Plus;
+      maintainers = with maintainers; [ samuelgrf ];
+    };
+  };
+
  gap = pluginDerivation {
    /* menu:
       Video
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -10,14 +10,14 @@

 python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "480";
+  version = "481";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
-    rev = "v${version}";
-    sha256 = "sha256-TZQY9wFXJFJtMAw2N+mlfVymewL96rn0Lza9jnDOGNA=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-6I4vLJj5WzC2bCtQYnoLGOL6N6pKFU+PZQqaOqhZhWU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/bottles/default.nix
+++ b/pkgs/applications/misc/bottles/default.nix
@ -20,8 +20,8 @@ let
 in
 python3Packages.buildPythonApplication rec {
  pname = "bottles";
-  version = "2022.4.14-trento";
-  sha256 = "0kjc1w8x4d6g2lx8x8isa2vnwacyjlh9lldf14wn4b118hsw85zs";
+  version = "2022.4.14-trento-1";
+  sha256 = "16cb01fhxa64f8fadwpr0mawfmchig6xlbx20mz4q9yh5fnagywj";
  # Note: Update via pkgs/applications/misc/bottles/update.py
  # mostly copypasted from pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py

--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@ -3,20 +3,20 @@
 }:
 let
  pname = "josm";
-  version = "18387";
+  version = "18427";
  srcs = {
    jar = fetchurl {
      url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      sha256 = "sha256-zkEWZjjSy0ajG5X1/dIgLPZ7zr0BiaJJcHaN8sv/3yc=";
+      sha256 = "sha256-SsoeKfpWi41sd77LfaQW0OcHnyf8iLolKWF74dhalpY=";
    };
    macosx = fetchurl {
      url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java17.zip";
-      sha256 = "sha256-xOVnnQ+eUkboT8Tq5F4QJEou1wAaHwiEdyiEKDR/fUk=";
+      sha256 = "sha256-cz3OT03StvJy9XYBiPxx+nz36O0cg+XrL/uc52/G/1c=";
    };
    pkg = fetchsvn {
      url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
      rev = version;
-      sha256 = "sha256-GbIWZTJmmUT8r9L63/6mcnRt7dvavqGAVbozxlbF89g=";
+      sha256 = "sha256-AyfUFE0y8d8FtgfhxSscQGE1IVNwYYNymH6jTnrUBTs=";
    };
  };
 in
--- a/pkgs/applications/misc/pdfstudio/default.nix
+++ b/pkgs/applications/misc/pdfstudio/default.nix
@ -12,7 +12,7 @@ in
  pdfstudio = callPackage ./common.nix rec {
    pname = program;
    year = "2021";
-    version = "${year}.1.2";
+    version = "${year}.1.3";
    desktopName = "PDF Studio";
    longDescription = ''
      PDF Studio is an easy to use, full-featured PDF editing software. This is the standard/pro edition, which requires a license. For the free PDF Studio Viewer see the package pdfstudioviewer.
@ -22,21 +22,21 @@ in
    ];
    src = fetchurl {
      url = makeurl { inherit pname year version; };
-      sha256 = "1188ll2qz58rr2slavqxisbz4q3fdzidpasb1p33926z0ym3rk45";
+      sha256 = "sha256-2az8/slWeLY7l7dCwyTaT18KFfvsO71vJFDZEvbDHGM=";
    };
  };

  pdfstudioviewer = callPackage ./common.nix rec {
    pname = program;
    year = "2021";
-    version = "${year}.1.2";
+    version = "${year}.1.3";
    desktopName = "PDF Studio Viewer";
    longDescription = ''
      PDF Studio Viewer is an easy to use, full-featured PDF editing software. This is the free edition. For the standard/pro edition, see the package pdfstudio.
    '';
    src = fetchurl {
      url = makeurl { inherit pname year version; };
-      sha256 = "128k3fm8m8zdykx4s30g5m2zl7cgmvs4qinf1w525zh84v56agz6";
+      sha256 = "sha256-kd+rQruBL0fudmc30agRO/XV97l/6unqU0GK25yhOzI=";
    };
  };
 }.${program}
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -40,10 +40,10 @@
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.163.0",
-    "sha256": "sha256-lSg8jAzQfRc++U6zAhkfbVf/+hIW/1Nov35o6M8mRrw=",
-    "vendorSha256": "sha256-8dAk23ISxYuYKj5s0W6g93RBW1++NuZEPva5MaNBSyw=",
-    "version": "1.163.0"
+    "rev": "v1.164.0",
+    "sha256": "sha256-UZ+/l8eBpzo0KBW6x8koLzBt0QniHjP73zdjKIw8ByI=",
+    "vendorSha256": "sha256-xxq+VOG6FkX1perAcXOiFtL/bjsHl9IWIJb5dfaIkpY=",
+    "version": "1.164.0"
  },
  "ansible": {
    "owner": "nbering",
@ -94,10 +94,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v4.9.0",
-    "sha256": "sha256-VLw2bqL6VEKwqzXYkNJGJtIi8gg+3/oCwbBf9UtATE4=",
-    "vendorSha256": "sha256-7pwwQHgtHO3GfcEAOHALo01i1pt9WsriZZkJjFzjwRE=",
-    "version": "4.9.0"
+    "rev": "v4.10.0",
+    "sha256": "sha256-FhW7+Ot1cVxTdDFuwP+Xq9LCfogRTJ7wlTU5TR98UPA=",
+    "vendorSha256": "sha256-91SSNiWHFcNWg6Ssr8XA+uiOoAbuBpivDPmkzWlFvPk=",
+    "version": "4.10.0"
  },
  "azuread": {
    "owner": "hashicorp",
@ -112,10 +112,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
    "repo": "terraform-provider-azurerm",
-    "rev": "v3.1.0",
-    "sha256": "sha256-idrGxmfhnMKvxtKJtjLs321D008Mcv27cHyhAjwCZfA=",
+    "rev": "v3.2.0",
+    "sha256": "sha256-GKI6d2zSaaEaKnt6MLqzEbLjLYdrIOa+aeIlFPa5hM4=",
    "vendorSha256": null,
-    "version": "3.1.0"
+    "version": "3.2.0"
  },
  "azurestack": {
    "owner": "hashicorp",
@ -139,19 +139,19 @@
    "owner": "F5Networks",
    "provider-source-address": "registry.terraform.io/F5Networks/bigip",
    "repo": "terraform-provider-bigip",
-    "rev": "v1.13.0",
-    "sha256": "0l1fgbzv3zjsgmnkg96ac299plx9zi4j54cjxrl27csvf87wi4lv",
+    "rev": "v1.13.1",
+    "sha256": "sha256-nNcOHTFJrvvjKAZUsb1IVTp71/Xk5OuSzihPyi08anw=",
    "vendorSha256": null,
-    "version": "1.13.0"
+    "version": "1.13.1"
  },
  "bitbucket": {
    "owner": "DrFaust92",
    "provider-source-address": "registry.terraform.io/DrFaust92/bitbucket",
    "repo": "terraform-provider-bitbucket",
-    "rev": "v2.14.0",
-    "sha256": "sha256-tF1Q55mxwPU6dziiNzdacNtHvemd9ciQHE2E6een1WY=",
+    "rev": "v2.15.0",
+    "sha256": "sha256-m9LNW73CZHfOHX7qIn5Xm5JbMoV6ADGpxL9HNn8E+kA=",
    "vendorSha256": "sha256-L8QYz1xgw8ZQjrU33uP18XxNUjImPYATZ02h46G4aXs=",
-    "version": "2.14.0"
+    "version": "2.15.0"
  },
  "brightbox": {
    "owner": "brightbox",
@ -194,10 +194,10 @@
    "owner": "cloudflare",
    "provider-source-address": "registry.terraform.io/cloudflare/cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v3.12.1",
-    "sha256": "sha256-8l6+hyjW+N3N5OGj/cviH97EFqouSrnJULk/SXrYCTk=",
+    "rev": "v3.12.2",
+    "sha256": "sha256-vshZlMLfyRxbzsk6H34PZb5+RowpEJEvWhNVYzrySeg=",
    "vendorSha256": "sha256-v6fUzYwrYt4rk5LT0LyNd8e9X79r3dwtd3s1QIV/w/s=",
-    "version": "3.12.1"
+    "version": "3.12.2"
  },
  "cloudfoundry": {
    "owner": "cloudfoundry-community",
@ -227,22 +227,23 @@
    "version": "3.2.0"
  },
  "constellix": {
+    "deleteVendor": true,
    "owner": "Constellix",
    "provider-source-address": "registry.terraform.io/Constellix/constellix",
    "repo": "terraform-provider-constellix",
-    "rev": "v0.4.3",
-    "sha256": "sha256-U5jQVa4dJTqH06psx/vNLSlL8muV15SgkyoM820PwjI=",
-    "vendorSha256": null,
-    "version": "0.4.3"
+    "rev": "v0.4.5",
+    "sha256": "sha256-ecwXWYrs7XJM1web+kia2ccpvTjxAVFPzav6lLal4e4=",
+    "vendorSha256": "sha256-UJHDX/vx3n/RTuQ50Y6TAhpEEFk9yBoaz8yK02E8Fhw=",
+    "version": "0.4.5"
  },
  "consul": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/consul",
    "repo": "terraform-provider-consul",
-    "rev": "v2.15.0",
-    "sha256": "sha256-6NQL1ZlHZsxfoRV0zMOXApuCR+nj8CPWjpxj7BAJivY=",
+    "rev": "v2.15.1",
+    "sha256": "sha256-QX0f9yM408HfdGNIpmkAKFUz0RfH90V4WBt1Hnwzoy8=",
    "vendorSha256": null,
-    "version": "2.15.0"
+    "version": "2.15.1"
  },
  "ct": {
    "owner": "poseidon",
@ -302,10 +303,10 @@
    "owner": "dnsimple",
    "provider-source-address": "registry.terraform.io/dnsimple/dnsimple",
    "repo": "terraform-provider-dnsimple",
-    "rev": "v0.11.1",
-    "sha256": "0jzw1kjykbka59kx30xm3qicjb6fdmm5l4f2dr8g7nxdaqnxri0s",
-    "vendorSha256": "06wggchs5khzyg6fd9s0qj76awnw28s7l278awanqimqgqajijkj",
-    "version": "0.11.1"
+    "rev": "v0.11.3",
+    "sha256": "sha256-fUs54xIecPgeQucuQmlpF2iHGonx4OsqFbhkMnO7d0c=",
+    "vendorSha256": "sha256-csooFX64RmwVV+gIejQS3HJljsRAp+bM8x/OoiF7jxs=",
+    "version": "0.11.3"
  },
  "docker": {
    "owner": "kreuzwerker",
@ -383,10 +384,10 @@
    "owner": "go-gandi",
    "provider-source-address": "registry.terraform.io/go-gandi/gandi",
    "repo": "terraform-provider-gandi",
-    "rev": "v2.0.0",
-    "sha256": "0xvdnjadcddrrfhhp198mraf2bm01xfy7gapjay441dbzffynw1m",
-    "vendorSha256": "1yccjnz6xw3b51xqmiaw78m87y2xmlp9z5z3gx5dbzz0lkj1k523",
-    "version": "2.0.0"
+    "rev": "v2.0.1",
+    "sha256": "sha256-lcJoDBVoNvNbB5V1rSk09d7pnfVN+FHROtyZCNmZfBk=",
+    "vendorSha256": "sha256-sloRWqk8j8UWM7gVFaiJ3SmBgnWN/BbFfATQWzpXI7k=",
+    "version": "2.0.1"
  },
  "github": {
    "owner": "integrations",
@ -411,20 +412,20 @@
    "provider-source-address": "registry.terraform.io/hashicorp/google",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.16.0",
-    "sha256": "sha256-kp6AldlkjiNd3R3hz+wB2uBQ37TyZ0hoEhxQYiFmO7g=",
+    "rev": "v4.17.0",
+    "sha256": "sha256-7yGZpCErpriLrqHpCnXmkJkrGMQPkD70NmzuZ0ghF7o=",
    "vendorSha256": "sha256-l2OviwplP/Sg2ShaEA88pMwVTkREnLkFAzterjr2kvU=",
-    "version": "4.16.0"
+    "version": "4.17.0"
  },
  "google-beta": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.16.0",
-    "sha256": "sha256-m5K2q83WbWVfjG7vhlh71k14GEXNs+2JfK/S1GnC5c0=",
+    "rev": "v4.17.0",
+    "sha256": "sha256-JaZZRjQR9+aH9KTJrazLXlbQ1drIOfE8sOVYi29F1fs=",
    "vendorSha256": "sha256-l2OviwplP/Sg2ShaEA88pMwVTkREnLkFAzterjr2kvU=",
-    "version": "4.16.0"
+    "version": "4.17.0"
  },
  "grafana": {
    "owner": "grafana",
@ -457,10 +458,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/helm",
    "repo": "terraform-provider-helm",
-    "rev": "v2.5.0",
-    "sha256": "sha256-stJO23B/DNOvAU71S/N3iML1PVQrpmbhoh7e31MI+BY=",
+    "rev": "v2.5.1",
+    "sha256": "sha256-PX8mls0m/7B5WULEDVHutzvjAr0a54vg734mBbRQZNA=",
    "vendorSha256": null,
-    "version": "2.5.0"
+    "version": "2.5.1"
  },
  "heroku": {
    "owner": "heroku",
@ -493,10 +494,10 @@
    "owner": "huaweicloud",
    "provider-source-address": "registry.terraform.io/huaweicloud/huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.35.0",
-    "sha256": "sha256-OQGrxnXeYSGLnfD8NuWncag1sSGlSZCipe0CykzzupU=",
+    "rev": "v1.35.1",
+    "sha256": "sha256-EC2o+olQaGCAX/0JGlXNMF8QE1k6BjC/4SttbGOxFFw=",
    "vendorSha256": null,
-    "version": "1.35.0"
+    "version": "1.35.1"
  },
  "huaweicloudstack": {
    "owner": "huaweicloud",
@ -601,10 +602,10 @@
    "owner": "launchdarkly",
    "provider-source-address": "registry.terraform.io/launchdarkly/launchdarkly",
    "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.6.0",
-    "sha256": "sha256-Mf7oV5G5XjnE+3m8EDczDvrtn2s4nrNCTdAJz1n9v2Y=",
+    "rev": "v2.6.1",
+    "sha256": "sha256-pdANr7W4d6+8WdAxcqSTpyEIshd6FVYy0+25wfDt4d8=",
    "vendorSha256": "sha256-HKea86ck97uc/Gv6geJm9TTRfG6bnpB+q8cuU/jubI8=",
-    "version": "2.6.0"
+    "version": "2.6.1"
  },
  "libvirt": {
    "owner": "dmacvicar",
@ -682,10 +683,10 @@
    "owner": "equinix",
    "provider-source-address": "registry.terraform.io/equinix/metal",
    "repo": "terraform-provider-metal",
-    "rev": "v3.3.0-alpha.2",
-    "sha256": "sha256-RUD4BJy0/s23+OWlQfFEh59BEhhtobW7zDOOcosC0l4=",
+    "rev": "v3.3.0-alpha.3",
+    "sha256": "sha256-wuZp0Be8a84y7JqpCGnBDPXgNG8JJcNWsIICP3ZjSVk=",
    "vendorSha256": "sha256-Ln9EyycPduVuj+JefH9f+Q5KlNGvbcwcEDgaqH2M0So=",
-    "version": "3.3.0-alpha.2"
+    "version": "3.3.0-alpha.3"
  },
  "minio": {
    "owner": "aminueza",
@ -736,10 +737,10 @@
    "owner": "newrelic",
    "provider-source-address": "registry.terraform.io/newrelic/newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v2.42.0",
-    "sha256": "sha256-OD0wahsEw86E7TbUxIqEhoZ85An9yRwgTENtdoYnFB0=",
+    "rev": "v2.42.1",
+    "sha256": "sha256-3lrO3BOP3X6Pr9wPnWsuQenesRTEDHzlkenIia6YiS8=",
    "vendorSha256": "sha256-G/GWIE+XeLiHW0xxyjbIpncAnpBmC/+iZnI8MFmi80k=",
-    "version": "2.42.0"
+    "version": "2.42.1"
  },
  "nomad": {
    "owner": "hashicorp",
@ -754,10 +755,10 @@
    "owner": "ns1-terraform",
    "provider-source-address": "registry.terraform.io/ns1-terraform/ns1",
    "repo": "terraform-provider-ns1",
-    "rev": "v1.12.5",
-    "sha256": "0g69jr96ns2h578cmh5zz27m5dkgygrfr6shvx79wal26fpr8413",
-    "vendorSha256": "0s70626ng7pvqxnx0a4rp22b8spy45y011bvvm77fndm8fc1w9zn",
-    "version": "1.12.5"
+    "rev": "v1.12.6",
+    "sha256": "sha256-nP951YipGzsweJvV2PE0UlWGP+cAM6s18F5MCcxTxeo=",
+    "vendorSha256": "sha256-MaJHCxvD9BM5G8wJbSo06+TIPvJTlXzQ+l9Kdbg0QQw=",
+    "version": "1.12.6"
  },
  "nsxt": {
    "owner": "vmware",
@ -782,19 +783,19 @@
    "owner": "nutanix",
    "provider-source-address": "registry.terraform.io/nutanix/nutanix",
    "repo": "terraform-provider-nutanix",
-    "rev": "v1.5.0-beta",
-    "sha256": "sha256-Luu0myRCzlVpKouFnE7MXESzkxCXxNe2ZfxFUCpGpiU=",
+    "rev": "v1.5.0-beta.2",
+    "sha256": "sha256-eC42HXh8Tk3TXWtdeVbv4UGMss3lh4vYyGPypB353X0=",
    "vendorSha256": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI=",
-    "version": "1.5.0-beta"
+    "version": "1.5.0-beta.2"
  },
  "oci": {
    "owner": "oracle",
    "provider-source-address": "registry.terraform.io/oracle/oci",
    "repo": "terraform-provider-oci",
-    "rev": "v4.70.0",
-    "sha256": "sha256-KgpYl1DllCkpXbxYp8cqKE28l4digmaB75BoL6CpkQA=",
+    "rev": "v4.71.0",
+    "sha256": "sha256-8v9zfYlWqeKQlk1hNL7iif/AfEjI5lC0clUwgpA132U=",
    "vendorSha256": null,
-    "version": "4.70.0"
+    "version": "4.71.0"
  },
  "okta": {
    "owner": "okta",
@ -845,10 +846,10 @@
    "owner": "opentelekomcloud",
    "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.29.0",
-    "sha256": "sha256-jhG2TyinnlPPIVA2K+ckOcxlqxeUFkp+WFJcJqYQ13k=",
-    "vendorSha256": "sha256-qNJ1jkbGgFUxvHYUMPX9kBAwQSx4vfOr7eS0Z6J7X8Q=",
-    "version": "1.29.0"
+    "rev": "v1.29.1",
+    "sha256": "sha256-c7kRS3c+n/5oN3PDKsJzkiK8ravRjBTJHhhqLHy9nhQ=",
+    "vendorSha256": "sha256-kSZvxbovF2/oCqFY/0zpGmAhLFuCw6nWG3B4ppyxzLY=",
+    "version": "1.29.1"
  },
  "opsgenie": {
    "owner": "opsgenie",
@ -962,10 +963,10 @@
    "owner": "scaleway",
    "provider-source-address": "registry.terraform.io/scaleway/scaleway",
    "repo": "terraform-provider-scaleway",
-    "rev": "v2.2.1-rc.2",
-    "sha256": "sha256-7T+J4T0qm7QMGWWjIT0nKHkHzd6wfFNP3suF7GitErc=",
-    "vendorSha256": "sha256-kfr8YqLr8CXntkiMEHA5kosZqkloV4rGjEmdXosT7WU=",
-    "version": "2.2.1-rc.2"
+    "rev": "v2.2.1-rc.3",
+    "sha256": "sha256-XprfY4Zy3PIrIJA2F1tnwafg4wYuzrm9nwVZULdX1D0=",
+    "vendorSha256": "sha256-H5KAo2rpgFGYmOgGOx9Z5LuApmftuYA6PfYCjnr7zC0=",
+    "version": "2.2.1-rc.3"
  },
  "secret": {
    "owner": "numtide",
@ -980,10 +981,10 @@
    "owner": "selectel",
    "provider-source-address": "registry.terraform.io/selectel/selectel",
    "repo": "terraform-provider-selectel",
-    "rev": "v3.8.0",
-    "sha256": "0qc08v217cv2i43cxcx854rvhihrlhlakfark37vcdrh9z6swf1n",
-    "vendorSha256": "1mjp5yqwl1nya82yf5v6l3sq7iv0m94xy5w7y5avn8h40dl1wfnf",
-    "version": "3.8.0"
+    "rev": "v3.8.1",
+    "sha256": "sha256-542fWLMJ9nO3Pu/QpUFZtu2eQoQOaAjaaK3aqtyoJPQ=",
+    "vendorSha256": "sha256-kmsO9jFoR/93PkOeIo0pkS/OjE+m3QbIspobAv/9+KI=",
+    "version": "3.8.1"
  },
  "sentry": {
    "owner": "jianyuan",
@ -1007,10 +1008,10 @@
    "owner": "splunk-terraform",
    "provider-source-address": "registry.terraform.io/splunk-terraform/signalfx",
    "repo": "terraform-provider-signalfx",
-    "rev": "v6.11.1",
-    "sha256": "sha256-37D4nblpGK8duohDiyY4UR0jn+T6QX7LnCfGtPdYQ3k=",
-    "vendorSha256": "sha256-PVbqS37MBkIrr8CO6LxB0NjWWiTI5NFDipX6GvokrnY=",
-    "version": "6.11.1"
+    "rev": "v6.12.0",
+    "sha256": "sha256-mTPiJc2AbtSAHM5J9Wr9fb/M/GDFMCIHod0DAT9DDvI=",
+    "vendorSha256": "sha256-hI0yz796+xxAFQg+O/2g5ueNx/wrx/40DlQyxtx11aQ=",
+    "version": "6.12.0"
  },
  "skytap": {
    "owner": "skytap",
@ -1025,10 +1026,10 @@
    "owner": "chanzuckerberg",
    "provider-source-address": "registry.terraform.io/chanzuckerberg/snowflake",
    "repo": "terraform-provider-snowflake",
-    "rev": "v0.30.0",
-    "sha256": "sha256-JHpwqMyt/oMZv6P4xEOlyV0pL32HQselDg+dP9JGRpg=",
-    "vendorSha256": "sha256-G/UIKuKtolLY7RIQF06wzn/ZYTMihEmJZ1DqVcHFGdg=",
-    "version": "0.30.0"
+    "rev": "v0.31.0",
+    "sha256": "sha256-KYgvtdGkzju1qpECVX5vtY7U8JNa8anSmaTq8PwJEl8=",
+    "vendorSha256": "sha256-l++IzY3/W4qsdFJY7ik0xF6tZWluLb4EcW5KQtBVY5s=",
+    "version": "0.31.0"
  },
  "sops": {
    "owner": "carlpett",
@ -1043,10 +1044,10 @@
    "owner": "spotinst",
    "provider-source-address": "registry.terraform.io/spotinst/spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.71.0",
-    "sha256": "sha256-Fcx0KHTAAOQE/Qa+84p5l5ve5nrWXZHgRyc3xNYBJoQ=",
+    "rev": "v1.72.0",
+    "sha256": "sha256-h70Tcp+VODMgUDBBcR4Vhqvln76rhwgnfKjIK2+hphw=",
    "vendorSha256": "sha256-pI9jX/Wp6Nu1ix82ZE2CBZYu0j4S+HH2+dD5G679VrE=",
-    "version": "1.71.0"
+    "version": "1.72.0"
  },
  "stackpath": {
    "owner": "stackpath",
@ -1088,10 +1089,10 @@
    "owner": "tencentcloudstack",
    "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.67.0",
-    "sha256": "sha256-61Fhh/BW1Iv/7wMU0lDMxPdB86Wqf43F90ZoWM990K0=",
+    "rev": "v1.69.0",
+    "sha256": "sha256-GArlBMlQdEjITqvAAcnhurJtYjs03U8pAzcdbuXzbss=",
    "vendorSha256": null,
-    "version": "1.67.0"
+    "version": "1.69.0"
  },
  "tfe": {
    "owner": "hashicorp",
@ -1161,10 +1162,10 @@
    "owner": "cloudposse",
    "provider-source-address": "registry.terraform.io/cloudposse/utils",
    "repo": "terraform-provider-utils",
-    "rev": "0.17.19",
-    "sha256": "sha256-FTZyri4/6QWkLKKectzx3av8fnoDkOIyAkAPasFU8sU=",
-    "vendorSha256": "sha256-FA2Hev7RS3ZJ/cDTgyZ7uMFlQB/VdJ19GZUpkWTEPV8=",
-    "version": "0.17.19"
+    "rev": "0.17.20",
+    "sha256": "sha256-+pk2cUmYzQsa40iMvbdkYmZtoXOb5ALU/p0EEZx2AIw=",
+    "vendorSha256": "sha256-cb8Hqe3lGfjNpGmhrJ64x6w/iFW22Ma4AJo2w29kjR0=",
+    "version": "0.17.20"
  },
  "vault": {
    "owner": "hashicorp",
@ -1179,19 +1180,19 @@
    "owner": "vmware",
    "provider-source-address": "registry.terraform.io/vmware/vcd",
    "repo": "terraform-provider-vcd",
-    "rev": "v3.5.1",
-    "sha256": "1fwkbsgnxn0jl84nji57grasdsbw0ydd7vzcllpv7r1z3jpa545q",
-    "vendorSha256": "0bzp6807l4hspk1c1pmgnzk0axk0nir3v0lqmw9xvkij4c5rnz9s",
-    "version": "3.5.1"
+    "rev": "v3.6.0",
+    "sha256": "sha256-vtqlT3cfrEsbTmsKY6SVYUgyo+zIiX0cK080H03C1d0=",
+    "vendorSha256": "sha256-g5qcT4xaXQMih4WN3ysk+xGwd3ux8XjMceXgmw8gYB0=",
+    "version": "3.6.0"
  },
  "venafi": {
    "owner": "Venafi",
    "provider-source-address": "registry.terraform.io/Venafi/venafi",
    "repo": "terraform-provider-venafi",
-    "rev": "v0.15.3",
-    "sha256": "sha256-qucPKnzUNYnnEe0rJoe3RhzBYIJJJroz3qTo8VlQBAE=",
-    "vendorSha256": "sha256-lj8cuv9jR+3P7OiO/eW8poHcX+LsQo+kOyspiqdMXRY=",
-    "version": "0.15.3"
+    "rev": "v0.15.5",
+    "sha256": "sha256-aNh9P7QqhmdywP47mddcGSDRxkwkrus14tku/xrQcz8=",
+    "vendorSha256": "sha256-SKdSjBXLX344zt0GeGBLNp8cFw+PO9ObT9jC+dHp/h8=",
+    "version": "0.15.5"
  },
  "vercel": {
    "owner": "ondrejsika",
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@ -29,7 +29,7 @@

 stdenv.mkDerivation rec {
  pname = "chatty";
-  version = "0.6.1";
+  version = "0.6.3";

  src = fetchFromGitLab {
    domain = "source.puri.sm";
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
    repo = "chatty";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-AufxwuOibTx5OvLBVbJqay/mYLmcDpE2BgwVv6Y5IlY=";
+    hash = "sha256-BILi3+i7SCiK7dVbckv3cNMNyEwgKMf0ct0z/J1xysI=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@ -82,6 +82,14 @@ env.mkDerivation rec {
    sha256 = "0zcjm08nfdlxrsv0fi6dqg3lk52bcvsxnsf6jm5fv6gf5v9ia3hq";
  };

+  patches = [
+    # fix build with KWayland 5.94+
+    # cf. https://invent.kde.org/frameworks/kwayland/-/commit/de442e4a94e249a29cf2e005db8e0a5e4a6a13ed
+    # upstream bug: https://github.com/telegramdesktop/tdesktop/issues/24375
+    # FIXME remove when no longer necessary
+    ./kf594.diff
+  ];
+
  postPatch = ''
    substituteInPlace Telegram/CMakeLists.txt \
      --replace '"''${TDESKTOP_LAUNCHER_BASENAME}.appdata.xml"' '"''${TDESKTOP_LAUNCHER_BASENAME}.metainfo.xml"'
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/kf594.diff
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/kf594.diff
@ -0,0 +1,57 @@
+diff --git a/Telegram/SourceFiles/platform/linux/linux_wayland_integration.cpp b/Telegram/SourceFiles/platform/linux/linux_wayland_integration.cpp
+index 7641579aa..3c195e397 100644
+--- a/Telegram/SourceFiles/platform/linux/linux_wayland_integration.cpp
+++ b/Telegram/SourceFiles/platform/linux/linux_wayland_integration.cpp
+@@ -9,10 +9,10 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
+ 
+ #include "base/platform/base_platform_info.h"
+ 
+-#include <connection_thread.h>
+-#include <registry.h>
+-#include <surface.h>
+-#include <plasmashell.h>
+#include <KWayland/Client/connection_thread.h>
+#include <KWayland/Client/registry.h>
+#include <KWayland/Client/surface.h>
+#include <KWayland/Client/plasmashell.h>
+ 
+ using namespace KWayland::Client;
+ 
+Submodule Telegram/lib_base contains modified content
+diff --git a/Telegram/lib_base/base/platform/linux/base_linux_wayland_integration.cpp b/Telegram/lib_base/base/platform/linux/base_linux_wayland_integration.cpp
+index 32f0de6..30a087f 100644
+--- a/Telegram/lib_base/base/platform/linux/base_linux_wayland_integration.cpp
+++ b/Telegram/lib_base/base/platform/linux/base_linux_wayland_integration.cpp
+@@ -13,11 +13,11 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
+ #include <QtCore/QPointer>
+ #include <QtGui/QWindow>
+ 
+-#include <connection_thread.h>
+-#include <registry.h>
+-#include <surface.h>
+-#include <xdgforeign.h>
+-#include <idleinhibit.h>
+#include <KWayland/Client/connection_thread.h>
+#include <KWayland/Client/registry.h>
+#include <KWayland/Client/surface.h>
+#include <KWayland/Client/xdgforeign.h>
+#include <KWayland/Client/idleinhibit.h>
+ 
+ using namespace KWayland::Client;
+ 
+Submodule Telegram/lib_ui contains modified content
+diff --git a/Telegram/lib_ui/ui/platform/linux/ui_linux_wayland_integration.cpp b/Telegram/lib_ui/ui/platform/linux/ui_linux_wayland_integration.cpp
+index 01f1e80..163cb6a 100644
+--- a/Telegram/lib_ui/ui/platform/linux/ui_linux_wayland_integration.cpp
+++ b/Telegram/lib_ui/ui/platform/linux/ui_linux_wayland_integration.cpp
+@@ -24,8 +24,8 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
+ #include <private/qwaylandwindow_p.h>
+ #include <private/qwaylandshellsurface_p.h>
+ 
+-#include <connection_thread.h>
+-#include <registry.h>
+#include <KWayland/Client/connection_thread.h>
+#include <KWayland/Client/registry.h>
+ 
+ Q_DECLARE_METATYPE(QMargins);
+ 
--- a/pkgs/applications/networking/pjsip/default.nix
+++ b/pkgs/applications/networking/pjsip/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, openssl, libsamplerate, alsa-lib, AppKit }:
+{ lib, stdenv, fetchFromGitHub, openssl, libsamplerate, alsa-lib, AppKit, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "pjsip";
@ -13,6 +13,11 @@ stdenv.mkDerivation rec {

  patches = [
    ./fix-aarch64.patch
+    (fetchpatch {
+      name = "CVE-2022-24764.patch";
+      url = "https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00.patch";
+      sha256 = "1fy78v3clm0gby7qcq3ny6f7d7f4qnn01lkqq67bf2s85k2phisg";
+    })
  ];

  buildInputs = [ openssl libsamplerate ]
--- a/pkgs/applications/video/ffmpeg-normalize/default.nix
+++ b/pkgs/applications/video/ffmpeg-normalize/default.nix
@ -7,11 +7,11 @@

 buildPythonApplication rec {
  pname = "ffmpeg-normalize";
-  version = "1.22.8";
+  version = "1.22.9";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-vxiq6q8fPh8ZLKnxYdIN591UQW73FWsoke1PvKTkko8=";
+    sha256 = "sha256-RBrCIDinPXbXKqrrhqVf3rV4rfi+2PttIaYxUKOk7hs=";
  };

  propagatedBuildInputs = [ ffmpeg ffmpeg-progress-yield ];
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@ -46,13 +46,13 @@ let
 in
 mkDerivation rec {
  pname = "obs-studio";
-  version = "27.2.2";
+  version = "27.2.4";

  src = fetchFromGitHub {
    owner = "obsproject";
    repo = "obs-studio";
    rev = version;
-    sha256 = "sha256-iZekhsqvtlMeKX2bQ+w/womkOTDLbbP0MmoTzbvpNtU=";
+    sha256 = "sha256-OiSejQovSmhItrnrQlcVp9PCDRgAhuxTinSpXbH8bo0=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@ -1,7 +1,7 @@
 { lib, fetchFromGitHub, python3, intltool, file, wrapGAppsHook, gtk-vnc
 , vte, avahi, dconf, gobject-introspection, libvirt-glib, system-libvirt
 , gsettings-desktop-schemas, libosinfo, gnome, gtksourceview4, docutils, cpio
-, e2fsprogs, findutils, gzip, cdrtools, xorriso
+, e2fsprogs, findutils, gzip, cdrtools, xorriso, fetchpatch
 , spiceSupport ? true, spice-gtk ? null
 }:

@ -35,11 +35,21 @@ python3.pkgs.buildPythonApplication rec {
    pygobject3 ipaddress libvirt libxml2 requests cdrtools
  ];

-  patchPhase = ''
+  prePatch = ''
    sed -i 's|/usr/share/libvirt/cpu_map.xml|${system-libvirt}/share/libvirt/cpu_map.xml|g' virtinst/capabilities.py
    sed -i "/'install_egg_info'/d" setup.py
  '';

+   patches = [
+     # due to a recent change in setuptools-61, "packages=[]" needs to be included
+     # this patch can hopefully be removed, once virt-manager has an upstream version bump
+    (fetchpatch {
+      name = "fix-for-setuptools-61.patch";
+      url = "https://github.com/virt-manager/virt-manager/commit/46dc0616308a73d1ce3ccc6d716cf8bbcaac6474.patch";
+      sha256 = "sha256-/RZG+7Pmd7rmxMZf8Fvg09dUggs2MqXZahfRQ5cLcuM=";
+    })
+  ];
+
  postConfigure = ''
    ${python3.interpreter} setup.py configure --prefix=$out
  '';
--- a/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
@ -0,0 +1,9 @@
+{ callPackage, makeSetupHook }:
+
+(makeSetupHook {
+  name = "postgresql-test-hook";
+} ./postgresql-test-hook.sh).overrideAttrs (o: {
+  passthru.tests = {
+    simple = callPackage ./test.nix { };
+  };
+})
--- a/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
+++ b/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
@ -0,0 +1,79 @@
+preCheckHooks+=('postgresqlStart')
+postCheckHooks+=('postgresqlStop')
+
+
+postgresqlStart() {
+
+  # Add default environment variable values
+  #
+  # Client variables:
+  #  - https://www.postgresql.org/docs/current/libpq-envars.html
+  #
+  # Server variables:
+  #  - only PGDATA: https://www.postgresql.org/docs/current/creating-cluster.html
+
+  if [[ "${PGDATA:-}" == "" ]]; then
+    PGDATA="$NIX_BUILD_TOP/postgresql"
+  fi
+  export PGDATA
+
+  if [[ "${PGHOST:-}" == "" ]]; then
+    mkdir -p "$NIX_BUILD_TOP/run/postgresql"
+    PGHOST="$NIX_BUILD_TOP/run/postgresql"
+  fi
+  export PGHOST
+
+  if [[ "${PGUSER:-}" == "" ]]; then
+    PGUSER="test_user"
+  fi
+  export PGUSER
+
+  if [[ "${PGDATABASE:-}" == "" ]]; then
+    PGDATABASE="test_db"
+  fi
+  export PGDATABASE
+
+  if [[ "${postgresqlTestUserOptions:-}" == "" ]]; then
+    postgresqlTestUserOptions="LOGIN"
+  fi
+
+  if [[ "${postgresqlTestSetupSQL:-}" == "" ]]; then
+    postgresqlTestSetupSQL="$(cat <<EOF
+      CREATE ROLE "$PGUSER" $postgresqlTestUserOptions;
+      CREATE DATABASE "$PGDATABASE" OWNER '$PGUSER';
+EOF
+    )"
+  fi
+
+  if [[ "${postgresqlTestSetupCommands:-}" == "" ]]; then
+    postgresqlTestSetupCommands='echo "$postgresqlTestSetupSQL" | PGUSER=postgres psql postgres'
+  fi
+
+  if ! type initdb >/dev/null; then
+    echo >&2 'initdb not found. Did you add postgresql to the checkInputs?'
+    false
+  fi
+  header 'initializing postgresql'
+  initdb -U postgres
+
+  # Move the socket
+  echo "unix_socket_directories = '$NIX_BUILD_TOP/run/postgresql'" >>"$PGDATA/postgresql.conf"
+
+  # TCP ports can be a problem in some sandboxes,
+  # so we disable tcp listening by default
+  if ! [[ "${postgresqlEnableTCP:-}" = 1 ]]; then
+    echo "listen_addresses = ''" >>"$PGDATA/postgresql.conf"
+  fi
+
+  header 'starting postgresql'
+  eval "${postgresqlStartCommands:-pg_ctl start}"
+
+  header 'setting up postgresql'
+  eval "$postgresqlTestSetupCommands"
+
+}
+
+postgresqlStop() {
+  header 'stopping postgresql'
+  pg_ctl stop
+}
--- a/pkgs/build-support/setup-hooks/postgresql-test-hook/test.nix
+++ b/pkgs/build-support/setup-hooks/postgresql-test-hook/test.nix
@ -0,0 +1,27 @@
+{ postgresql, postgresqlTestHook, stdenv }:
+
+stdenv.mkDerivation {
+  name = "postgresql-test-hook-test";
+  buildInputs = [ postgresqlTestHook ];
+  checkInputs = [ postgresql ];
+  dontUnpack = true;
+  doCheck = true;
+  passAsFile = ["sql"];
+  sql = ''
+    CREATE TABLE hello (
+      message text
+    );
+    INSERT INTO hello VALUES ('it '||'worked');
+    SELECT * FROM hello;
+  '';
+  checkPhase = ''
+    runHook preCheck
+    psql <$sqlPath | grep 'it worked'
+    TEST_RAN=1
+    runHook postCheck
+  '';
+  installPhase = ''
+    [[ $TEST_RAN == 1 ]]
+    touch $out
+  '';
+}
--- a/pkgs/desktops/gnome/core/evince/default.nix
+++ b/pkgs/desktops/gnome/core/evince/default.nix
@ -43,13 +43,13 @@

 stdenv.mkDerivation rec {
  pname = "evince";
-  version = "42.1";
+  version = "42.2";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/evince/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "skdnuz1RA7TjWw4VzwM9viSI+IcAzdiC0ipDre7C6Ao=";
+    sha256 = "/3+B8wjPjUlW7Zf7ckp+SUSMIUvuq5mIEu+e+7ON+K4=";
  };

  postPatch = ''
--- a/pkgs/development/compilers/open-watcom/v2.nix
+++ b/pkgs/development/compilers/open-watcom/v2.nix
@ -12,14 +12,14 @@

 stdenv.mkDerivation rec {
  pname = "open-watcom-v2";
-  version = "unstable-2022-03-14";
+  version = "unstable-2022-04-18";
  name = "${pname}-unwrapped-${version}";

  src = fetchFromGitHub {
    owner = "open-watcom";
    repo = "open-watcom-v2";
-    rev = "22627ccc1bd3de70aff9ac056e0dc9ecf7f7b6ec";
-    sha256 = "khy/fhmQjTGKfx6iOUBt+ySwpEx0df/7meyNvBnJAPY=";
+    rev = "3e762ff7342f9d82b7d8df54db9558158332ac02";
+    sha256 = "KMFvLIUqor2wxeO03Uh/jycvnCTOd1ySxYTq4PJ0tHk=";
  };

  postPatch = ''
--- a/pkgs/development/compilers/uasm/default.nix
+++ b/pkgs/development/compilers/uasm/default.nix
@ -2,31 +2,18 @@

 stdenv.mkDerivation rec {
  pname = "uasm";
-  version = "2.53";
+  version = "2.55";

  src = fetchFromGitHub {
    owner = "Terraspace";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-Aohwrcb/KTKUFFpfmqVDPNjJh1dMYSNnBJ2eFaP20pM=";
+    # Specifying only the tag results in the following error during download:
+    # the given path has multiple possibilities: #<Git::Ref:0x00007f618689c378>, #<Git::Ref:0x00007f618689c1e8>
+    # Probably because upstream has both a tag and a branch with the same name
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-CIbHPKJa60SyJeFgF1Tux7RfJZBChhUVXR7HGa+gCtQ=";
  };

-  # https://github.com/Terraspace/UASM/pull/154
-  patches = [
-    # fix `invalid operands to binary - (have 'char *' and 'uint_8 *' {aka 'unsigned char *'})`
-    (fetchpatch {
-      name = "fix_pointers_compare.patch";
-      url = "https://github.com/clouds56/UASM/commit/9cd3a400990e230571e06d4c758bd3bd35f90ab6.patch";
-      sha256 = "sha256-8mY36dn+g2QNJ1JbWt/y4p0Ha9RSABnOE3vlWANuhsA=";
-    })
-    # fix `dbgcv.c:*:*: fatal error: direct.h: No such file or directory`
-    (fetchpatch {
-      name = "fix_build_dbgcv_c_on_unix.patch";
-      url = "https://github.com/clouds56/UASM/commit/806d54cf778246c96dcbe61a4649bf0aebcb0eba.patch";
-      sha256 = "sha256-uc1LaizdYEh1Ry55Cq+6wrCa1OeBPFo74H5iBpmteAE=";
-    })
-  ];
-
  enableParallelBuilding = true;

  makefile = "gccLinux64.mak";
@ -43,7 +30,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "http://www.terraspace.co.uk/uasm.html";
    description = "A free MASM-compatible assembler based on JWasm";
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.linux;
    maintainers = with maintainers; [ thiagokokada ];
    license = licenses.watcom;
  };
--- a/pkgs/development/embedded/stm32/stm32flash/default.nix
+++ b/pkgs/development/embedded/stm32/stm32flash/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "stm32flash";
-  version = "0.6";
+  version = "0.7";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-7ptA1NPlzSi5k+CK4qLDxVm2vqhzDNfh1Acn3tsd2gk=";
+    sha256 = "sha256-xMnNi+x52mOxEdFXE+9cws2UfeykEdNdbjBl4ifcQUo=";
  };

  buildFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -1190,8 +1190,29 @@ self: super: {
  # Fix build with attr-2.4.48 (see #53716)
  xattr = appendPatch ./patches/xattr-fix-build.patch super.xattr;

-  # Some tests depend on a postgresql instance
-  esqueleto = dontCheck super.esqueleto;
+  esqueleto =
+    overrideCabal
+      (drv: {
+        postPatch = drv.postPatch or "" + ''
+          # patch out TCP usage: https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook-tcp
+          sed -i test/PostgreSQL/Test.hs \
+            -e s^host=localhost^^
+        '';
+        # Match the test suite defaults (or hardcoded values?)
+        preCheck = drv.preCheck or "" + ''
+          PGUSER=esqutest
+          PGDATABASE=esqutest
+        '';
+        testFlags = drv.testFlags or [] ++ [
+          # We don't have a MySQL test hook yet
+          "--skip=/Esqueleto/MySQL"
+        ];
+        testToolDepends = drv.testToolDepends or [] ++ [
+          pkgs.postgresql
+          pkgs.postgresqlTestHook
+        ];
+      })
+      super.esqueleto;

  # Requires API keys to run tests
  algolia = dontCheck super.algolia;
@ -1310,7 +1331,25 @@ self: super: {

  # Test suite requires database
  persistent-mysql = dontCheck super.persistent-mysql;
-  persistent-postgresql = dontCheck super.persistent-postgresql;
+  persistent-postgresql =
+    overrideCabal
+      (drv: {
+        postPatch = drv.postPath or "" + ''
+          # patch out TCP usage: https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook-tcp
+          # NOTE: upstream host variable takes only two values...
+          sed -i test/PgInit.hs \
+            -e s^'host=" <> host <> "'^^
+        '';
+        preCheck = drv.preCheck or "" + ''
+          PGDATABASE=test
+          PGUSER=test
+        '';
+        testToolDepends = drv.testToolDepends or [] ++ [
+          pkgs.postgresql
+          pkgs.postgresqlTestHook
+        ];
+      })
+      super.persistent-postgresql;

  # Fix EdisonAPI and EdisonCore for GHC 8.8:
  # https://github.com/robdockins/edison/pull/16
@ -1515,8 +1554,13 @@ self: super: {
  };
  pg-client = overrideCabal (drv: {
    librarySystemDepends = with pkgs; [ postgresql krb5.dev openssl.dev ];
-    # wants a running DB to check against
-    doCheck = false;
+    testToolDepends = drv.testToolDepends or [] ++ [
+      pkgs.postgresql pkgs.postgresqlTestHook
+    ];
+    preCheck = drv.preCheck or "" + ''
+      # empty string means use default connection
+      export DATABASE_URL=""
+    '';
  }) (super.pg-client.override {
    resource-pool = self.hasura-resource-pool;
    ekg-core = self.hasura-ekg-core;
--- a/pkgs/development/libraries/argagg/0001-catch.diff
+++ b/pkgs/development/libraries/argagg/0001-catch.diff
@ -0,0 +1,20 @@
+--- old/test/doctest.h	2019-03-05 18:04:06.143740733 +0300
+++ new/test/doctest.h	2019-03-05 18:04:43.577284916 +0300
+@@ -1307,7 +1307,7 @@
+                                                        __FILE__, __LINE__, #expr, #as);            \
+             try {                                                                                  \
+                 expr;                                                                              \
+-            } catch(as) {                                                                          \
+            } catch(as e) {                                                                          \
+                 _DOCTEST_RB.m_threw    = true;                                                     \
+                 _DOCTEST_RB.m_threw_as = true;                                                     \
+             } catch(...) { _DOCTEST_RB.m_threw = true; }                                           \
+@@ -1332,7 +1332,7 @@
+ #define DOCTEST_REQUIRE_THROWS(expr) DOCTEST_ASSERT_THROWS(expr, DT_REQUIRE_THROWS)
+ 
+ #define DOCTEST_WARN_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, ex, DT_WARN_THROWS_AS)
+-#define DOCTEST_CHECK_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, ex, DT_CHECK_THROWS_AS)
+#define DOCTEST_CHECK_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, const ex &, DT_CHECK_THROWS_AS)
+ #define DOCTEST_REQUIRE_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, ex, DT_REQUIRE_THROWS_AS)
+ 
+ #define DOCTEST_WARN_NOTHROW(expr) DOCTEST_ASSERT_NOTHROW(expr, DT_WARN_NOTHROW)
--- a/pkgs/development/libraries/argagg/default.nix
+++ b/pkgs/development/libraries/argagg/default.nix
@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "argagg";
+  version = "0.4.6";
+
+  src = fetchFromGitHub {
+    owner = "vietjtnguyen";
+    repo = pname;
+    rev = version;
+    hash = "sha256-MCtlAPfwdJpgfS8IH+zlcgaaxZ5AsP4hJvbZAFtOa4o=";
+  };
+
+  patches = [
+    # Fix compilation of macro catch statement
+    ./0001-catch.diff
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/vietjtnguyen/argagg";
+    description = "Argument Aggregator";
+    longDescription = ''
+      argagg is yet another C++ command line argument/option parser. It was
+      written as a simple and idiomatic alternative to other frameworks like
+      getopt, Boost program options, TCLAP, and others. The goal is to achieve
+      the majority of argument parsing needs in a simple manner with an easy to
+      use API. It operates as a single pass over all arguments, recognizing
+      flags prefixed by - (short) or -- (long) and aggregating them into easy to
+      access structures with lots of convenience functions. It defers processing
+      types until you access them, so the result structures end up just being
+      pointers into the original command line argument C-strings.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = with platforms; all;
+    badPlatforms = [ "aarch64-darwin" ];
+  };
+}
--- a/pkgs/development/libraries/hunspell/dictionaries.nix
+++ b/pkgs/development/libraries/hunspell/dictionaries.nix
@ -45,8 +45,7 @@ let
        maintainers = with maintainers; [ renzo ];
        platforms = platforms.all;
      };
-      nativeBuildInputs = [ unzip ];
-      buildInputs = [ bash coreutils which zip ];
+      nativeBuildInputs = [ bash coreutils which zip unzip ];
      patchPhase = ''
        substituteInPlace ortograf/herramientas/make_dict.sh \
           --replace /bin/bash bash \
@ -234,7 +233,7 @@ let
        sha256 = "1a3055hp2bc4q4nlg3gmg0147p3a1zlfnc65xiv2v9pyql1nya8p";
      };

-      buildInputs = [ ispell perl hunspell ];
+      nativeBuildInputs = [ ispell perl hunspell ];

      dontBuild = true;

--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libxcrypt";
-  version = "4.4.18";
+  version = "4.4.28";

  src = fetchFromGitHub {
    owner = "besser82";
    repo = "libxcrypt";
    rev = "v${version}";
-    sha256 = "4015bf1b3a2aab31da5a544424be36c1a0f0ffc1eaa219c0e7b048e4cdcbbfe1";
+    sha256 = "sha256-Ohf+RCOXnoCxAFnXXV9e2TCqpfZziQl+FGJTGDSQTF0=";
  };

  preConfigure = ''
--- a/pkgs/development/ocaml-modules/bap/default.nix
+++ b/pkgs/development/ocaml-modules/bap/default.nix
@ -16,12 +16,12 @@ else

 stdenv.mkDerivation rec {
  pname = "ocaml${ocaml.version}-bap";
-  version = "2.2.0";
+  version = "2.4.0";
  src = fetchFromGitHub {
    owner = "BinaryAnalysisPlatform";
    repo = "bap";
    rev = "v${version}";
-    sha256 = "0c53sps6ba9n5cjdmapi8ylzlpcc11pksijp9swzlwgxyz5d276f";
+    sha256 = "1xc8zfcwm40zihs3ajcrh2x32xd08qnygay03qy3qxhybr5hqngr";
  };

  sigs = fetchurl {
@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
  '';

  disableIda = "--disable-ida";
+  disableGhidra = "--disable-ghidra";

  patches = [ ./curses_is_ncurses.patch ];

@ -69,7 +70,7 @@ stdenv.mkDerivation rec {
    substituteInPlace oasis/elf-loader --replace bitstring.ppx ppx_bitstring
  '';

-  configureFlags = [ "--enable-everything ${disableIda}" "--with-llvm-config=${llvm.dev}/bin/llvm-config" ];
+  configureFlags = [ "--enable-everything ${disableIda} ${disableGhidra}" "--with-llvm-config=${llvm.dev}/bin/llvm-config" ];

  meta = with lib; {
    description = "Platform for binary analysis. It is written in OCaml, but can be used from other languages.";
--- a/pkgs/development/ocaml-modules/bjack/default.nix
+++ b/pkgs/development/ocaml-modules/bjack/default.nix
@ -0,0 +1,25 @@
+{ lib, buildDunePackage, fetchFromGitHub, dune-configurator, libsamplerate, libjack2 }:
+
+buildDunePackage rec {
+  pname = "bjack";
+  version = "0.1.6";
+
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "savonet";
+    repo = "ocaml-bjack";
+    rev = "v${version}";
+    sha256 = "1gf31a8i9byp6npn0x6gydcickn6sf5dnzmqr2c1b9jn2nl7334c";
+  };
+
+  buildInputs = [ dune-configurator ];
+  propagatedBuildInputs = [ libsamplerate libjack2 ];
+
+  meta = with lib; {
+    homepage = "https://github.com/savonet/ocaml-bjack";
+    description = "Blocking API for the jack audio connection kit";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
--- a/pkgs/development/ocaml-modules/coin/default.nix
+++ b/pkgs/development/ocaml-modules/coin/default.nix
@ -1,20 +1,19 @@
 { buildDunePackage
-, fetchzip
+, fetchurl
 , findlib
 , lib
-, menhir
 , ocaml
 , re
 }:

 buildDunePackage rec {
  pname = "coin";
-  version = "0.1.3";
+  version = "0.1.4";
  minimalOCamlVersion = "4.03";

-  src = fetchzip {
-    url = "https://github.com/mirage/coin/releases/download/v${version}/coin-v${version}.tbz";
-    sha256 = "06bfidvglyp9hzvr2xwbdx8wf26is2xrzc31fldzjf5ab0vd076p";
+  src = fetchurl {
+    url = "https://github.com/mirage/coin/releases/download/v${version}/coin-${version}.tbz";
+    sha256 = "sha256:0069qqswd1ik5ay3d5q1v1pz0ql31kblfsnv0ax0z8jwvacp3ack";
  };

  postPatch = ''
@ -22,9 +21,7 @@ buildDunePackage rec {
      'ocaml} -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib '
  '';

-  useDune2 = true;
-
-  nativeBuildInputs = [ menhir findlib ];
+  nativeBuildInputs = [ findlib ];
  buildInputs = [ re ];

  strictDeps = true;
--- a/pkgs/development/ocaml-modules/dssi/default.nix
+++ b/pkgs/development/ocaml-modules/dssi/default.nix
@ -0,0 +1,25 @@
+{ lib, buildDunePackage, fetchFromGitHub, dune-configurator, ladspa, alsa-lib }:
+
+buildDunePackage rec {
+  pname = "dssi";
+  version = "0.1.5";
+
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "savonet";
+    repo = "ocaml-dssi";
+    rev = "v${version}";
+    sha256 = "1frbmx1aznwp60r6bkx1whqyr6mkflvd9ysmjg7s7b80mh0s4ix6";
+  };
+
+  buildInputs = [ dune-configurator ];
+  propagatedBuildInputs = [ ladspa alsa-lib ];
+
+  meta = with lib; {
+    homepage = "https://github.com/savonet/ocaml-dssi";
+    description = "Bindings for the DSSI API which provides audio synthesizers";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
--- a/pkgs/development/ocaml-modules/ffmpeg/base.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/base.nix
@ -1,7 +1,7 @@
 { lib, fetchFromGitHub }:

 rec {
-  version = "1.1.0";
+  version = "1.1.3";

  useDune2 = true;

@ -9,7 +9,7 @@ rec {
    owner = "savonet";
    repo = "ocaml-ffmpeg";
    rev = "v${version}";
-    sha256 = "13rc3d0n963a28my5ahv78r82rh450hvbsc74mb6ld0r9v210r0p";
+    sha256 = "1l40dfc0v3wn2drfq0mclrc1lrlpycdjrkrw4knkwpsg0za68v4c";
  };

  meta = with lib; {
--- a/pkgs/development/ocaml-modules/frontc/default.nix
+++ b/pkgs/development/ocaml-modules/frontc/default.nix
@ -1,26 +1,19 @@
-{ stdenv, lib, fetchurl, fetchpatch, fetchFromGitHub, ocaml, findlib }:
+{ lib, buildDunePackage, fetchFromGitHub, ocaml, menhir }:

-let
-  meta_file = fetchurl {
-    url = "https://raw.githubusercontent.com/ocaml/opam-repository/3c191ae9356ca7b3b628f2707cfcb863db42480f/packages/FrontC/FrontC.3.4.1/files/META";
-    sha256 = "0s2wsinycldk8y5p09xd0hsgbhckhy7bkghzl63bph6mwv64kq2d";
-  };
-in
-
-stdenv.mkDerivation rec {
-  pname = "ocaml${ocaml.version}-FrontC";
-  version = "3.4.1";
+buildDunePackage rec {
+  pname = "FrontC";
+  version = "4.1.0";

  src = fetchFromGitHub {
    owner = "BinaryAnalysisPlatform";
    repo = "FrontC";
-    rev = "V_${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "1dq5nks0c9gsbr1m8k39m1bniawr5hqcy1r8x5px7naa95ch06ak";
+    rev = "v${version}";
+    sha256 = "1mi1vh4qgscnb470qwidccaqd068j1bqlz6pf6wddk21paliwnqb";
  };

-  nativeBuildInputs = [ ocaml findlib ];
+  minimalOCamlVersion = "4.08";

-  strictDeps = true;
+  nativeBuildInputs = [ menhir ];

  meta = with lib; {
    inherit (src.meta) homepage;
@ -29,14 +22,4 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl21;
    maintainers = [ maintainers.maurer ];
  };
-
-  patches = [ (fetchpatch {
-      url = "https://raw.githubusercontent.com/ocaml/opam-repository/3c191ae9356ca7b3b628f2707cfcb863db42480f/packages/FrontC/FrontC.3.4.1/files/opam.patch";
-      sha256 = "0v4f6740jbj1kxg1y03dzfa3x3gsrhv06wpzdj30gl4ki5fvj4hs";
-    })
-  ];
-
-  makeFlags = [ "PREFIX=$(out)" "OCAML_SITE=$(OCAMLFIND_DESTDIR)" ];
-
-  postInstall = "cp ${meta_file} $OCAMLFIND_DESTDIR/FrontC/META";
 }
--- a/pkgs/development/ocaml-modules/gen_js_api/default.nix
+++ b/pkgs/development/ocaml-modules/gen_js_api/default.nix
@ -0,0 +1,41 @@
+{ buildDunePackage
+, lib
+, ppxlib
+, fetchFromGitHub
+, ojs
+, js_of_ocaml-compiler
+, nodejs
+}:
+
+buildDunePackage rec {
+  pname = "gen_js_api";
+  version = "1.0.9";
+
+  src = fetchFromGitHub {
+    owner = "LexiFi";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1qx6if1avr484bl9x1h0cksdc6gqw5i4pwzdr27h46hppnnvi8y8";
+  };
+
+  minimalOCamlVersion = "4.08";
+
+  propagatedBuildInputs = [ ojs ppxlib ];
+  checkInputs = [ js_of_ocaml-compiler nodejs ];
+  doCheck = true;
+
+  meta = {
+    homepage = "https://github.com/LexiFi/gen_js_api";
+    description = "Easy OCaml bindings for JavaScript libraries";
+    longDescription = ''
+      gen_js_api aims at simplifying the creation of OCaml bindings for
+      JavaScript libraries. Authors of bindings write OCaml signatures for
+      JavaScript libraries and the tool generates the actual binding code with a
+      combination of implicit conventions and explicit annotations.
+
+      gen_js_api is to be used with the js_of_ocaml compiler.
+    '';
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.bcc32 ];
+  };
+}
--- a/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
+++ b/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
@ -0,0 +1,21 @@
+{ buildDunePackage
+, gen_js_api
+}:
+
+buildDunePackage rec {
+  pname = "ojs";
+
+  inherit (gen_js_api) version src;
+
+  doCheck = false; # checks depend on gen_js_api, which is a cycle
+
+  minimalOCamlVersion = "4.08";
+
+  meta = {
+    inherit (gen_js_api.meta) homepage license maintainers;
+    description = "Runtime Library for gen_js_api generated libraries";
+    longDescription = ''
+      To be used in conjunction with gen_js_api
+    '';
+  };
+}
--- a/pkgs/development/ocaml-modules/ladspa/default.nix
+++ b/pkgs/development/ocaml-modules/ladspa/default.nix
@ -0,0 +1,25 @@
+{ lib, buildDunePackage, fetchFromGitHub, dune-configurator, ladspaH }:
+
+buildDunePackage rec {
+  pname = "ladspa";
+  version = "0.2.2";
+
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "savonet";
+    repo = "ocaml-ladspa";
+    rev = "v${version}";
+    sha256 = "1y83infjaz9apzyvaaqw331zqdysmn3bpidfab061v3bczv4jzbz";
+  };
+
+  buildInputs = [ dune-configurator ];
+  propagatedBuildInputs = [ ladspaH ];
+
+  meta = with lib; {
+    homepage = "https://github.com/savonet/ocaml-alsa";
+    description = "Bindings for the LADSPA API which provides audio effects";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
--- a/pkgs/development/ocaml-modules/lastfm/default.nix
+++ b/pkgs/development/ocaml-modules/lastfm/default.nix
@ -0,0 +1,32 @@
+{ lib
+, buildDunePackage
+, fetchFromGitHub
+, pkg-config
+, dune-configurator
+, xmlplaylist
+, ocaml_pcre
+, ocamlnet
+}:
+
+buildDunePackage rec {
+  pname = "lastfm";
+  version = "0.3.3";
+
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "savonet";
+    repo = "ocaml-lastfm";
+    rev = "v${version}";
+    sha256 = "1sz400ny9h7fs20k7600q475q164x49ba30ls3q9y35rhm3g2y2b";
+  };
+
+  propagatedBuildInputs = [ xmlplaylist ocaml_pcre ocamlnet ];
+
+  meta = with lib; {
+    homepage = "https://github.com/savonet/ocaml-lastfm";
+    description = "OCaml API to lastfm radio and audioscrobbler";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
--- a/pkgs/development/ocaml-modules/samplerate/default.nix
+++ b/pkgs/development/ocaml-modules/samplerate/default.nix
@ -0,0 +1,25 @@
+{ lib, buildDunePackage, fetchFromGitHub, dune-configurator, libsamplerate }:
+
+buildDunePackage rec {
+  pname = "samplerate";
+  version = "0.1.6";
+
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "savonet";
+    repo = "ocaml-samplerate";
+    rev = "v${version}";
+    sha256 = "0h0i9v9p9n2givv3wys8qrfi1i7vp8kq7lnkf14s7d3m4r8x4wrp";
+  };
+
+  buildInputs = [ dune-configurator ];
+  propagatedBuildInputs = [ libsamplerate ];
+
+  meta = with lib; {
+    homepage = "https://github.com/savonet/ocaml-samplerate";
+    description = "Interface for libsamplerate";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
--- a/pkgs/development/ocaml-modules/xmlplaylist/default.nix
+++ b/pkgs/development/ocaml-modules/xmlplaylist/default.nix
@ -0,0 +1,25 @@
+{ lib, buildDunePackage, fetchFromGitHub, dune-configurator, xmlm }:
+
+buildDunePackage rec {
+  pname = "xmlplaylist";
+  version = "0.1.5";
+
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "savonet";
+    repo = "ocaml-xmlplaylist";
+    rev = "v${version}";
+    sha256 = "1x5lbwkr2ip00x8vyfbl8936yy79j138vx8a16ix7g9p2j5qsfcq";
+  };
+
+  buildInputs = [ dune-configurator ];
+  propagatedBuildInputs = [ xmlm ];
+
+  meta = with lib; {
+    homepage = "https://github.com/savonet/ocaml-xmlplaylist";
+    description = "Module to parse various RSS playlist formats";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
--- a/pkgs/development/python-modules/add-trailing-comma/default.nix
+++ b/pkgs/development/python-modules/add-trailing-comma/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "add-trailing-comma";
-  version = "2.2.1";
+  version = "2.2.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "asottile";
    repo = pname;
    rev = "v${version}";
-    sha256 = "RBOL4mM9VciHHNmCTlRBIoXqeln19MKYxgv9p6GCNvU=";
+    sha256 = "sha256-hJVVRhaElroZ1GVlbGK49gzts2tozLqp9xfoaPdbb3I=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-containerservice";
-  version = "18.0.0";
+  version = "19.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    sha256 = "sha256-b4AwcnSp6JOtG8VaBbUN7d/NIhHN2TPnyjzCUVhMOzg=";
+    sha256 = "sha256-UHkSUoNzXWomr4vczGRRXVJplVRfqDjwFczkOP2Jwsc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
@ -5,18 +5,20 @@
 , msrestazure
 , azure-common
 , azure-mgmt-core
-, azure-mgmt-nspkg
-, isPy3k
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "azure-mgmt-datafactory";
-  version = "2.3.0";
+  version = "2.4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    sha256 = "sha256-pjBjFPkKhKd8XI6wmzX/rAssHINMzDAZa+XRqG/pLYo=";
+    hash = "sha256-oCDh7tWsBA6z/auQm3AtkRzT9IUrq8HJ+R//HDJ+1nw=";
  };

  propagatedBuildInputs = [
@ -24,8 +26,6 @@ buildPythonPackage rec {
    msrestazure
    azure-common
    azure-mgmt-core
-  ] ++ lib.optionals (!isPy3k) [
-    azure-mgmt-nspkg
  ];

  # has no tests
--- a/pkgs/development/python-modules/enaml/default.nix
+++ b/pkgs/development/python-modules/enaml/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools-scm
 , atom
 , ply
 , kiwisolver
@ -12,13 +13,13 @@

 buildPythonPackage rec {
  pname = "enaml";
-  version = "0.14.1";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "nucleic";
    repo = pname;
-    rev = version;
-    sha256 = "sha256-QfI7cwl2c5HOlFNNdG+oOv48X9jJZnZNU/kWgutWe6k=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-xSMgT8VooDS5kvf4BCcVbv/MNfRDTVnPKU3Ou+/Gq7I=";
  };

  # qt bindings cannot be found during tests
@ -39,6 +40,7 @@ buildPythonPackage rec {
    "enaml.workbench"
  ];

+  nativeBuildInputs = [ setuptools-scm ];
  propagatedBuildInputs = [
    atom
    ply
@ -48,6 +50,7 @@ buildPythonPackage rec {
    cppy
    bytecode
  ];
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;

  meta = with lib; {
    homepage = "https://github.com/nucleic/enaml";
--- a/pkgs/development/python-modules/findpython/default.nix
+++ b/pkgs/development/python-modules/findpython/default.nix
@ -15,7 +15,7 @@

 let
  pname = "findpython";
-  version = "0.1.4";
+  version = "0.1.5";
 in
 buildPythonPackage {
  inherit pname version;
@ -25,7 +25,7 @@ buildPythonPackage {

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-TOGYRUaW7lOcp5kNTq3NBHHKXvA7XE7y+SWJGsZPgok=";
+    hash = "sha256-AjTmTKIhWhl39O18S2XRVxeDiIzCpKH2qdjkY2h+i8M=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/imap-tools/default.nix
+++ b/pkgs/development/python-modules/imap-tools/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "imap-tools";
-  version = "0.52.0";
+  version = "0.54.0";

  disabled = isPy27;

@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "ikvk";
    repo = "imap_tools";
    rev = "v${version}";
-    hash = "sha256-la2+cpTnHZQn/FXtySp+3zDCBTONiLC16Tm+hDiIERc=";
+    hash = "sha256-RiKGxyCPYlAJ5YbxvEKxCYgUg1D9s29YSCT4tY3FIEE=";
  };

  checkInputs = [
@ -39,6 +39,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Work with email and mailbox by IMAP";
    homepage = "https://github.com/ikvk/imap_tools";
+    changelog = "https://github.com/ikvk/imap_tools/blob/v${version}/docs/release_notes.rst";
    license = licenses.asl20;
    maintainers = with maintainers; [ dotlambda ];
  };
--- a/pkgs/development/python-modules/lightwave2/default.nix
+++ b/pkgs/development/python-modules/lightwave2/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "lightwave2";
-  version = "0.8.1";
+  version = "0.8.4";
  format = "setuptools";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-UULOQawsY2N0xxYlgIZKs8Xyl0XDqC6fSSKvo8ZBEcY=";
+    sha256 = "sha256-WB5U8VjUKx2hCcJX2JeFgEiwzweGzROEK3pox3l/wrE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/nextcord/default.nix
+++ b/pkgs/development/python-modules/nextcord/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "nextcord";
-  version = "2.0.0a9";
+  version = "2.0.0a10";

  format = "setuptools";

@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "nextcord";
    repo = "nextcord";
    rev = version;
-    hash = "sha256-9UJLfSYud/pIkIkJ75jE3pxsYm5bKNNRCwjDerDHp9c=";
+    hash = "sha256-p99WJ4y2iJQTI3wHbh+jwJyLnE3aBXnHxrehDYYek/4=";
  };

  patches = [
--- a/pkgs/development/python-modules/pg8000/default.nix
+++ b/pkgs/development/python-modules/pg8000/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pg8000";
-  version = "1.24.2";
+  version = "1.25.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-q3/ASKVvysTZwkeyKoNW5gjdmgPUg18ch/ui5PJihKU=";
+    sha256 = "sha256-i8/HmxxqoFj1OEwtXjF/u+yOmQ33RJbVHYmx78/d9Ng=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
+++ b/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
@ -1,20 +1,36 @@
-{ lib, buildPythonPackage, fetchPypi, aiohttp, requests }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, aiohttp
+, requests
+, pythonOlder
+}:

 buildPythonPackage rec {
  pname = "pyTelegramBotAPI";
-  version = "4.4.0";
+  version = "4.4.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-5vIjVqvr/+Cok9z3L+CaDIve2tb0mMVaMMPdMs5Ijmo=";
+    hash = "sha256-3Qppp/UDKiGChnvMOgW8EKygI75gYzv37c0ctExmK+g=";
  };

-  propagatedBuildInputs = [ aiohttp requests ];
+  propagatedBuildInputs = [
+    aiohttp
+    requests
+  ];
+
+  pythonImportsCheck = [
+    "telebot"
+  ];

  meta = with lib; {
    homepage = "https://github.com/eternnoir/pyTelegramBotAPI";
    description = "A simple, but extensible Python implementation for the Telegram Bot API";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
    maintainers = with maintainers; [ das_j ];
  };
 }
--- a/pkgs/development/python-modules/pyrogram/default.nix
+++ b/pkgs/development/python-modules/pyrogram/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "pyrogram";
-  version = "1.4.12";
+  version = "1.4.16";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    pname = "Pyrogram";
    inherit version;
-    hash = "sha256-rNGdWnZuhCU0Kg/CkeNjazKb76h8/VanZdF4yi0KWGU=";
+    hash = "sha256-ZYAPaAa92z3KtciVHOexdZf9bwZjKQ9WKg6+We0dW+Q=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/svg-path/default.nix
+++ b/pkgs/development/python-modules/svg-path/default.nix
@ -3,15 +3,19 @@
 , fetchPypi
 , pillow
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "svg.path";
-  version = "5.1";
+  version = "6.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-CltSq7BGQNmC/3EI5N0wx4QDu0zZWMJLovCUdtXZIws=";
+    hash = "sha256-X78HaJFzywl3aA4Sl58wHQu2r1NVyjlsww0+ESx5TdU=";
  };

  checkInputs = [
@ -24,7 +28,9 @@ buildPythonPackage rec {
    "test_image"
  ];

-  pythonImportsCheck = [ "svg.path" ];
+  pythonImportsCheck = [
+    "svg.path"
+  ];

  meta = with lib; {
    description = "SVG path objects and parser";
--- a/pkgs/development/python-modules/umap-learn/default.nix
+++ b/pkgs/development/python-modules/umap-learn/default.nix
@ -15,13 +15,13 @@

 buildPythonPackage rec {
  pname = "umap-learn";
-  version = "0.5.2";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "lmcinnes";
    repo = "umap";
    rev = version;
-    sha256 = "sha256-JfYuuE1BP+HdiEl7l01sZ/XXlEwHyAsLjK9nqhRd/3o=";
+    sha256 = "sha256-S2+k7Ec4AxsN6d0GUGnU81oLnBgmlZp8OmUFCNaUJYw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/wallbox/default.nix
+++ b/pkgs/development/python-modules/wallbox/default.nix
@ -2,22 +2,24 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, aenum
 , requests
 , simplejson
 }:

 buildPythonPackage rec {
  pname = "wallbox";
-  version = "0.4.6";
+  version = "0.4.8";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "651c61e2264258382d1f54c4f0bf6bcd198482a744d8f1db3dd73084c240d9bb";
+    sha256 = "f8965b0ae3a873f570986e712a4e667d0b6634c9e3afb51fbd5596856412878c";
  };

  propagatedBuildInputs = [
+    aenum
    requests
    simplejson
  ];
--- a/pkgs/development/python-modules/zulip/default.nix
+++ b/pkgs/development/python-modules/zulip/default.nix
@ -1,28 +1,27 @@
 { lib
 , buildPythonPackage
-, isPy3k
+, pythonOlder
 , fetchFromGitHub
 , requests
 , matrix-client
 , distro
 , click
-, cryptography
-, pyopenssl
+, typing-extensions
 , pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "zulip";
-  version = "0.8.1";
+  version = "0.8.2";

-  disabled = !isPy3k;
+  disabled = pythonOlder "3.6";

  # no sdist on PyPI
  src = fetchFromGitHub {
    owner = "zulip";
    repo = "python-zulip-api";
    rev = version;
-    sha256 = "sha256-vYeZEz8nuZYL1stHLa595IbhyNbqqxH4mx7ISbqRAlA=";
+    hash = "sha256-Z5WrV/RDQwdKUBF86M5/xWhXn3fGNqJtqO5PTd7s5ME=";
  };
  sourceRoot = "${src.name}/zulip";

@ -31,20 +30,13 @@ buildPythonPackage rec {
    matrix-client
    distro
    click
-
-    # from requests[security]
-    cryptography
-    pyopenssl
+    typing-extensions
  ];

  checkInputs = [
    pytestCheckHook
  ];

-  preCheck = ''
-    export COLUMNS=80
-  '';
-
  pythonImportsCheck = [ "zulip" ];

  meta = with lib; {
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -32,13 +32,13 @@ with py.pkgs;

 buildPythonApplication rec {
  pname = "checkov";
-  version = "2.0.1065";
+  version = "2.0.1067";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = version;
-    hash = "sha256-q51do9Kbl85p+wOMnFM4QpjezHll8sTmw8vffWcQrRE=";
+    hash = "sha256-WK6fot5YAC5l/0EiJuIQ5Xvz5NiEWnU+BfzsKv+caJ8=";
  };

  nativeBuildInputs = with py.pkgs; [
--- a/pkgs/development/tools/build-managers/conan/default.nix
+++ b/pkgs/development/tools/build-managers/conan/default.nix
@ -48,6 +48,13 @@ let newPython = python3.override {
        sha256 = "29872e92839765e546828bb7754a68c418d927cd064fd4708fab9fe9c8bb116b";
      };
    });
+    distro = super.distro.overridePythonAttrs (oldAttrs: rec {
+      version = "1.5.0";
+      src = oldAttrs.src.override {
+        inherit version;
+        sha256 = "14nz51cqlnxmgfqqilxyvjwwa5xfivdvlm0d0b1qzgcgwdm7an0f";
+      };
+    });
  };
 };

--- a/pkgs/development/tools/git-series/default.nix
+++ b/pkgs/development/tools/git-series/default.nix
@ -1,54 +1,36 @@
-{ lib, fetchFromGitHub, fetchpatch, rustPlatform
-, openssl, cmake, perl, pkg-config, zlib, curl, libgit2, libssh2
+{ lib, rustPlatform, fetchFromGitHub
+, pkg-config, openssl, zlib, curl, libgit2, libssh2
 }:

-with rustPlatform;
-
-buildRustPackage rec {
-  version = "0.9.1";
+rustPlatform.buildRustPackage rec {
  pname = "git-series";
+  version = "unstable-2019-10-15";

  src = fetchFromGitHub {
    owner = "git-series";
    repo = "git-series";
-    rev = version;
-    sha256 = "07mgq5h6r1gf3jflbv2khcz32bdazw7z1s8xcsafdarnm13ps014";
+    rev = "c570a015e15214be46a7fd06ba08526622738e20";
+    sha256 = "1i0m2b7ma6xvkg95k57gaj1wpc1rfvka6h8jr5hglxmqqbz6cb6w";
  };

-  cargoSha256 = "0870f4rd98fbmyl8524ivfg3xf4qpzb1x68q1idnl47mmf68pyx8";
+  cargoSha256 = "1hmx14z3098c98achgii0jkcm4474iw762rmib77amcsxj73zzdh";

-  cargoPatches = [
-    (fetchpatch {
-      url = "https://github.com/Mic92/git-series/commit/3aa30a47d74ebf90b444dccdf8c153f07f119483.patch";
-      sha256 = "06v8br9skvy75kcw2zgbswxyk82sqzc8smkbqpzmivxlc2i9rnh0";
-    })
-    # Update Cargo.lock to allow using OpenSSL 1.1
-    (fetchpatch {
-      url = "https://github.com/edef1c/git-series/commit/11fe70ffcc18200e5f2a159c36aab070e8ff4228.patch";
-      sha256 = "0clwllf9mrhq86dhzyyhkw1q2ggpgqpw7s05dvp3gj9zhfsyya4s";
-    })
-    # Cargo.lock: Update url, which fixes incompatibility with NLL
-    (fetchpatch {
-      url = "https://github.com/edef1c/git-series/commit/27ff2ecf2d615dae1113709eca0e43596de12ac4.patch";
-      sha256 = "1byjbdcx56nd0bbwz078bl340rk334mb34cvaa58h76byvhpkw10";
-    })
-  ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl zlib curl libgit2 libssh2 ];

  LIBGIT2_SYS_USE_PKG_CONFIG = true;
  LIBSSH2_SYS_USE_PKG_CONFIG = true;
-  nativeBuildInputs = [ cmake pkg-config perl ];
-  buildInputs = [ openssl zlib curl libgit2 libssh2 ];

-  postBuild = ''
+  postInstall = ''
    install -D "$src/git-series.1" "$out/man/man1/git-series.1"
  '';

  meta = with lib; {
    description = "A tool to help with formatting git patches for review on mailing lists";
    longDescription = ''
-          git series tracks changes to a patch series over time. git
-          series also tracks a cover letter for the patch series,
-          formats the series for email, and prepares pull requests.
+      git series tracks changes to a patch series over time. git
+      series also tracks a cover letter for the patch series,
+      formats the series for email, and prepares pull requests.
    '';
    homepage = "https://github.com/git-series/git-series";

--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@ -6,11 +6,11 @@ else

 stdenv.mkDerivation rec {
  pname = "dune";
-  version = "3.0.3";
+  version = "3.1.0";

  src = fetchurl {
    url = "https://github.com/ocaml/dune/releases/download/${version}/fiber-${version}.tbz";
-    sha256 = "sha256-1QRJmhZY8Nmcrvv/1zhvLjHUbOynMWcVf+RobEHlcy8=";
+    sha256 = "sha256-B31SCwhFxW4Q7FhW18ZuvnofG+pKMCfRgvRLJSlRnYE=";
  };

  nativeBuildInputs = [ ocaml findlib ];
--- a/pkgs/development/web/cypress/default.nix
+++ b/pkgs/development/web/cypress/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "cypress";
-  version = "9.5.3";
+  version = "9.5.4";

  src = fetchzip {
    url = "https://cdn.cypress.io/desktop/${version}/linux-x64/cypress.zip";
-    sha256 = "qK1TvAGiTVmEQ4MpqICDSP9swnpAcE6iGkGJOrPQ1bI=";
+    sha256 = "F4BSIA3ImXwmmki8/FK0t08Gf5S8KMpXNNBIPPJQNsM=";
  };

  # don't remove runtime deps
--- a/pkgs/games/quake3/quake3e/default.nix
+++ b/pkgs/games/quake3/quake3e/default.nix
@ -1,31 +1,44 @@
-{ lib, stdenv, curl, libGL, libX11, libXxf86dga, alsa-lib, libXrandr, libXxf86vm, libXext, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper
+, curl, libGL, libX11, libXxf86dga, alsa-lib, libXrandr, libXxf86vm, libXext, SDL2, glibc
+}:

 stdenv.mkDerivation rec {
  pname = "Quake3e";
-  version = "2020-04-04";
+  version = "2022-04-01-dev";

  src = fetchFromGitHub {
    owner = "ec-";
    repo = pname;
-    rev = version;
-    sha256 = "1jvk8qd0mi0x8lslknhkfd8h6ridwca34c6qahsbmmpcgsvdv16s";
+    rev = "c6cec00b858aa5955eb1d6eb65b9bfd41fd869cb";
+    sha256 = "0qd13fndbhgkkmhxbprpzmj2l2v9ihacxagpdqi9sg9nrzvahr9h";
  };

-  buildInputs = [ curl libGL libX11 libXxf86dga alsa-lib libXrandr libXxf86vm libXext ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ curl libGL libX11 libXxf86dga alsa-lib libXrandr libXxf86vm libXext SDL2 glibc ];
+  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2";
  enableParallelBuilding = true;

  postPatch = ''
    sed -i -e 's#OpenGLLib = dlopen( dllname#OpenGLLib = dlopen( "${libGL}/lib/libGL.so"#' code/unix/linux_qgl.c
+    sed -i -e 's#Sys_LoadLibrary( "libpthread.so.0" )#Sys_LoadLibrary( "${glibc}/lib/libpthread.so.0" )#' code/unix/linux_snd.c
    sed -i -e 's#Sys_LoadLibrary( "libasound.so.2" )#Sys_LoadLibrary( "${alsa-lib}/lib/libasound.so.2" )#' code/unix/linux_snd.c
+    sed -i -e 's#Sys_LoadLibrary( "libXxf86dga.so.1" )#Sys_LoadLibrary( "${libXxf86dga}/lib/libXxf86dga.so.1" )#' code/unix/x11_dga.c
    sed -i -e 's#Sys_LoadLibrary( "libXrandr.so.2" )#Sys_LoadLibrary( "${libXrandr}/lib/libXrandr.so.2" )#' code/unix/x11_randr.c
    sed -i -e 's#Sys_LoadLibrary( "libXxf86vm.so.1" )#Sys_LoadLibrary( "${libXxf86vm}/lib/libXxf86vm.so.1" )#' code/unix/x11_randr.c
-    sed -i -e 's#Sys_LoadLibrary( "libXxf86dga.so.1" )#Sys_LoadLibrary( "${libXxf86dga}/lib/libXxf86dga.so.1" )#' code/unix/x11_dga.c
+    sed -i -e 's#Sys_LoadLibrary( "libXxf86vm.so.1" )#Sys_LoadLibrary( "${libXxf86vm}/lib/libXxf86vm.so.1" )#' code/unix/x11_vidmode.c
    sed -i -e 's#"libcurl.so.4"#"${curl.out}/lib/libcurl.so.4"#' code/client/cl_curl.h
  '';

+  # Default value for `USE_SDL` changed (from 0 to 1) in 5f8ce6d (2020-12-26)
+  # Setting `USE_SDL=0` in `makeFlags` doesn't work
+  preConfigure = ''
+    sed -i 's/USE_SDL *= 1/USE_SDL = 0/' Makefile
+  '';
+
  installPhase = ''
-    mkdir -p $out/bin
-    cp build/*/*x64 $out/bin
+    make install DESTDIR=$out/lib
+    makeWrapper $out/lib/quake3e.x64 $out/bin/quake3e
+    makeWrapper $out/lib/quake3e.ded.x64 $out/bin/quake3e.ded
  '';

  meta = with lib; {
--- a/pkgs/games/rare/default.nix
+++ b/pkgs/games/rare/default.nix
@ -3,12 +3,12 @@

 buildPythonApplication rec {
  pname = "rare";
-  version = "1.8.8";
+  version = "1.8.9";

  src = fetchPypi {
    inherit version;
    pname = "Rare";
-    sha256 = "sha256-00CtvBqSrT9yJUHZ5529VrIQtCOYkHRc8+rJHmrTSpg=";
+    sha256 = "sha256-UEvGwWjr4FCsvyFz6Db3VnhVS6MS3FYzYSucumzOoEA=";
  };

  nativeBuildInputs = [
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@ -1,4 +1,9 @@
-{ lib, stdenv, fetchurl, kernel }:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, kernel
+}:

 let cfg = import ./version.nix; in

@ -11,6 +16,19 @@ stdenv.mkDerivation rec {
    sha256 = cfg.sha256.${pname};
  };

+  patches = [
+    #  batman-adv: make mc_forwarding atomic
+    (fetchpatch {
+      url = "https://git.open-mesh.org/batman-adv.git/blobdiff_plain/c142c00f6b1a2ad5f5d74202fb1249e6a6575407..56db7c0540e733a1f063ccd6bab1b537a80857eb:/net/batman-adv/multicast.c";
+      hash = "sha256-2zXg8mZ3/iK9E/kyn+wHSrlLq87HuK72xuXojQ9KjkI=";
+    })
+    #  batman-adv: compat: Add atomic mc_fowarding support for stable kernels
+    (fetchpatch {
+      url = "https://git.open-mesh.org/batman-adv.git/blobdiff_plain/f07a0c37ab278fb6a9e95cad89429b1282f1ab59..350adcaec82fbaa358a2406343b6130ac8dad126:/net/batman-adv/multicast.c";
+      hash = "sha256-r/Xp5bmDo9GVfAF6bn2Xq+cOq5ddQe+D5s/h37uI6bM=";
+    })
+  ];
+
  nativeBuildInputs = kernel.moduleBuildDependencies;
  makeFlags = kernel.makeFlags ++ [
    "KERNELPATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
--- a/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/pkgs/os-specific/linux/batman-adv/version.nix
@ -1,9 +1,9 @@
 {
-  version = "2021.4";
+  version = "2022.0";

  sha256 = {
-    batman-adv = "06zbyf8s7njn6wdm1fdq3kl8kx1vx4spxkgiy7dx0pq4c3qs5xyg";
-    alfred = "15fbw80ix95zy8i4c6acm1631vxlz2hakjv4zv5wig74bp2bcyac";
-    batctl = "1ryqz90av2p5pgmmpi1afmycd18zhpwz1i4f7r0s359jis86xndn";
+    batman-adv = "sha256-STOHBbwgdwmshNdmaI5wJXEAnIJ8CjIHiOpR+4h3FKo=";
+    alfred = "sha256-q7odrGHsz81jKeczHQVV/syTd2D7NsbPVc5sHXUc/Zg=";
+    batctl = "sha256-iTlm+aLWpQch3hJM5i2l096cIOBVdspIK8VwTMWm9z0=";
  };
 }
--- a/pkgs/os-specific/linux/unscd/0001-adjust-socket-paths-for-nixos.patch
+++ b/pkgs/os-specific/linux/unscd/0001-adjust-socket-paths-for-nixos.patch
@ -0,0 +1,41 @@
+From 9d76d183a97cb667a1ab6d95af69d6db745215df Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Milan=20P=C3=A4ssler?= <milan@petabyte.dev>
+Date: Tue, 1 Jun 2021 16:55:45 +0200
+Subject: [PATCH] adjust socket paths for nixos
+
+The original unscd would crash, because it is not allowed to create its
+legacy socket at /var/run/.nscd_socket.
+
+This socket is only required for very old glibc versions, but removing it
+is currently non-trivial, so we just move it somewhere, where it is
+allowed to be created. A patch has been submitted upstream to make this
+hack unnecessary.
+
+Also change /var/run to /run, since we shouldn't be using /var/run
+anymore.
+---
+ nscd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/nscd.c b/nscd.c
+index a71e474..0cd7106 100644
+--- a/nscd.c
+++ b/nscd.c
+@@ -2100,10 +2100,10 @@ static void main_loop(void)
+ ** Initialization
+ */
+ 
+-#define NSCD_PIDFILE    "/var/run/nscd/nscd.pid"
+-#define NSCD_DIR        "/var/run/nscd"
+-#define NSCD_SOCKET     "/var/run/nscd/socket"
+-#define NSCD_SOCKET_OLD "/var/run/.nscd_socket"
+#define NSCD_PIDFILE    "/run/nscd/nscd.pid"
+#define NSCD_DIR        "/run/nscd"
+#define NSCD_SOCKET     "/run/nscd/socket"
+#define NSCD_SOCKET_OLD "/run/nscd/socket_legacy"
+ 
+ static smallint wrote_pidfile;
+ 
+-- 
+2.31.1
+
--- a/pkgs/os-specific/linux/unscd/default.nix
+++ b/pkgs/os-specific/linux/unscd/default.nix
@ -0,0 +1,76 @@
+{ fetchurl, fetchpatch, stdenv, systemd, lib }:
+
+stdenv.mkDerivation rec {
+  pname = "unscd";
+  version = "0.54";
+
+  src = fetchurl {
+    url = "https://busybox.net/~vda/unscd/nscd-${version}.c";
+    sha256 = "0iv4iwgs3sjnqnwd7dpcw6s7i4ar9q89vgsms32clx14fdqjrqch";
+  };
+
+  unpackPhase = ''
+    runHook preUnpack
+    cp $src nscd.c
+    chmod u+w nscd.c
+    runHook postUnpack
+  '';
+
+  patches = [
+    # Patches from Debian that have not (yet) been included upstream, but are useful to us
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/u/${pname}/${version}-1/debian/patches/change_invalidate_request_info_output";
+      sha256 = "17whakazpisiq9nnw3zybaf7v3lqkww7n6jkx0igxv4z2r3mby6l";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/u/${pname}/${version}-1/debian/patches/support_large_numbers_in_config";
+      sha256 = "0jrqb4cwclwirpqfb6cvnmiff3sm2jhxnjwxa7h0wx78sg0y3bpp";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/u/${pname}/${version}-1/debian/patches/no_debug_on_invalidate";
+      sha256 = "0znwzb522zgikb0mm7awzpvvmy0wf5z7l3jgjlkdpgj0scxgz86w";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/u/${pname}/${version}-1/debian/patches/notify_systemd_about_successful_startup";
+      sha256 = "1ipwmbfwm65yisy74nig9960vxpjx683l3skgxfgssfx1jb9z2mc";
+    })
+
+    # The original unscd would crash, because it is not allowed to create its
+    # legacy socket at /var/run/.nscd_socket.
+    # This socket is only required for very old glibc versions, but removing it
+    # is currently non-trivial, so we just move it somewhere, where it is
+    # allowed to be created. A patch has been submitted upstream to make this
+    # hack unnecessary.
+    # Also change /var/run to /run, since we shouldn't be using /var/run
+    # anymore.
+    # See also: http://lists.busybox.net/pipermail/busybox/2021-June/088866.html
+    ./0001-adjust-socket-paths-for-nixos.patch
+  ];
+
+  buildInputs = [ systemd ];
+
+  buildPhase = ''
+    runHook preBuild
+    gcc -Wall \
+      -Wl,--sort-section -Wl,alignment \
+      -Wl,--sort-common \
+      -fomit-frame-pointer \
+      -lsystemd \
+      -o nscd nscd.c
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 -t $out/bin nscd
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://busybox.net/~vda/unscd/";
+    description = "Less buggy replacement for the glibc name service cache daemon";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ petabyteboy ];
+  };
+}
--- a/pkgs/pkgs-lib/tests/formats.nix
+++ b/pkgs/pkgs-lib/tests/formats.nix
@ -165,6 +165,7 @@ in runBuildTests {

      [attrs]
      foo = "foo"
+
      [level1.level2.level3]
      level4 = "deep"
    '';
--- a/pkgs/servers/hqplayerd/default.nix
+++ b/pkgs/servers/hqplayerd/default.nix
@ -21,36 +21,13 @@
 , meson
 , ninja
 }:
-let
-  # hqplayerd relies on some package versions available for the fc34 release,
-  # which has out-of-date pkgs compared to nixpkgs. The following drvs
-  # can/should be removed when the fc35 hqplayer rpm is made available.
-  gupnp_1_2 = gupnp.overrideAttrs (old: rec {
-    pname = "gupnp";
-    version = "1.2.7";
-    src = fetchurl {
-      url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-      sha256 = "sha256-hEEnbxr9AXbm9ZUCajpQfu0YCav6BAJrrT8hYis1I+w=";
-    };
-  });
-
-  gupnp-av_0_12 = gupnp-av.overrideAttrs (old: rec {
-    pname = "gupnp-av";
-    version = "0.12.11";
-    src = fetchurl {
-      url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-      sha256 = "sha256-aJ3PFJKriZHa6ikTZaMlSKd9GiKU2FszYitVzKnOb9w=";
-    };
-    nativeBuildInputs = lib.subtractLists [ meson ninja ] old.nativeBuildInputs;
-  });
-in
 stdenv.mkDerivation rec {
  pname = "hqplayerd";
  version = "4.30.3-87";

  src = fetchurl {
-    url = "https://www.signalyst.eu/bins/${pname}/fc34/${pname}-${version}sse42.fc34.x86_64.rpm";
-    hash = "sha256-RX9KI+4HGDUJ3y3An1zTMJTz28Of2Awn7COeX6EQc38=";
+    url = "https://www.signalyst.eu/bins/${pname}/fc35/${pname}-${version}.fc35.x86_64.rpm";
+    hash = "sha256-fEze4aScWDwHDTXU0GatdopQf6FWcywWCGhR/7zXK7A=";
  };

  unpackPhase = ''
@ -66,8 +43,8 @@ stdenv.mkDerivation rec {
    gcc11.cc.lib
    gnome.rygel
    gssdp
-    gupnp_1_2
-    gupnp-av_0_12
+    gupnp
+    gupnp-av
    lame
    libgmpris
    llvmPackages_10.openmp
--- a/pkgs/servers/roundcube/plugins/persistent_login/default.nix
+++ b/pkgs/servers/roundcube/plugins/persistent_login/default.nix
@ -2,12 +2,12 @@

 roundcubePlugin rec {
  pname = "persistent_login";
-  version = "5.2.0";
+  version = "5.3.0";

  src = fetchFromGitHub {
    owner = "mfreiholz";
    repo = pname;
    rev = "version-${version}";
-    sha256 = "0aasc2ns318s1g8vf2hhqwsplchhrhv5cd725rnfldim1y8k0n1i";
+    sha256 = "1qf7q1sypwa800pgxa3bg6ngcpkf4dqgg6jqx8cnd6cb7ikbfldb";
  };
 }
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@ -5,15 +5,15 @@
 , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert }:

 stdenv.mkDerivation rec {
-  version = "2022-04-13";
+  version = "2022-04-14";
  pname = "oh-my-zsh";
-  rev = "7ea6ff8d04acd665ebcd151d183ec67af5be1281";
+  rev = "eb00b95d26e8f264af80f508d50ac32e50619027";

  src = fetchFromGitHub {
    inherit rev;
    owner = "ohmyzsh";
    repo = "ohmyzsh";
-    sha256 = "xi/jhaOLYggoI/xkfcX1f+1/puWtcZ4WqlC105oYvF8=";
+    sha256 = "kEyvSBVgHuTaBQu2X9OJ+eu2serHq9IyfJHxTmpv2BU=";
  };

  installPhase = ''
--- a/pkgs/tools/archivers/7zz/default.nix
+++ b/pkgs/tools/archivers/7zz/default.nix
@ -3,7 +3,7 @@
 , fetchurl

 , uasm
-, useUasm ? stdenv.isx86_64
+, useUasm ? stdenv.isLinux

  # RAR code is under non-free unRAR license
  # see the meta.license section below for more details
@ -13,11 +13,12 @@
 let
  inherit (stdenv.hostPlatform) system;
  platformSuffix =
-    if useUasm then
-      {
-        x86_64-linux = "_x64";
-      }.${system} or (throw "`useUasm` is not supported for system ${system}")
-    else "";
+    lib.optionalString useUasm {
+      aarch64-linux = "_arm64";
+      i686-linux = "_x86";
+      x86_64-linux = "_x64";
+    }.${system} or
+      (builtins.trace "7zz's ASM optimizations not available for `${system}`. Building without optimizations." "");
 in
 stdenv.mkDerivation rec {
  pname = "7zz";
--- a/pkgs/tools/graphics/cuneiform/default.nix
+++ b/pkgs/tools/graphics/cuneiform/default.nix
@ -14,6 +14,10 @@ stdenv.mkDerivation {
    url = "https://raw.githubusercontent.com/archlinux/svntogit-community/a2ec92f05de006b56d16ac6a6c370d54a554861a/cuneiform/trunk/build-fix.patch";
    sha256 = "19cmrlx4khn30qqrpyayn7bicg8yi0wpz1x1bvqqrbvr3kwldxyj";
  })
+  (fetchurl {
+    url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-text/cuneiform/files/cuneiform-1.1.0-gcc11.patch";
+    sha256 = "14bp2f4dvlgxnpdza1rgszhkbxhp6p7lhgnb1s7c1x7vwdrx0ri7";
+  })
  ];

  postPatch = ''
--- a/pkgs/tools/misc/cht.sh/default.nix
+++ b/pkgs/tools/misc/cht.sh/default.nix
@ -10,15 +10,15 @@

 stdenv.mkDerivation {
  pname = "cht.sh";
-  version = "unstable-2022-01-01";
+  version = "unstable-2022-04-17";

  nativeBuildInputs = [ makeWrapper ];

  src = fetchFromGitHub {
    owner = "chubin";
    repo = "cheat.sh";
-    rev = "46d1a5f73c6b88da15d809154245dbf234e9479e";
-    sha256 = "6uEbxkkNV5EGhiCSoWJgfRUUqUS3OFTVOZFlVyMp/x8=";
+    rev = "7f769d6f3697541e55fd3ea9b71f190296529e48";
+    sha256 = "+V3q71neW9X0JPJHqvNGopvIJfUv0VD9GKkz7YqN6Eo=";
  };

  # Fix ".cht.sh-wrapped" in the help message
--- a/pkgs/tools/misc/edid-decode/default.nix
+++ b/pkgs/tools/misc/edid-decode/default.nix
@ -1,8 +1,8 @@
 { lib, stdenv, fetchgit }:

 stdenv.mkDerivation rec {
-  pname = "edid-decode-unstable";
-  version = "unstable-2018-12-06";
+  pname = "edid-decode";
+  version = "unstable-2022-04-06";

  src = fetchgit {
    url = "git://linuxtv.org/edid-decode.git";
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "EDID decoder and conformance tester";
-    homepage = "https://cgit.freedesktop.org/xorg/app/edid-decode/";
+    homepage = "https://git.linuxtv.org/edid-decode.git";
    license = licenses.mit;
    maintainers = with maintainers; [ Madouura ];
    platforms = lib.platforms.all;
--- a/pkgs/tools/misc/f2/default.nix
+++ b/pkgs/tools/misc/f2/default.nix
@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "f2";
+  version = "1.8.0";
+
+  src = fetchFromGitHub {
+    owner = "ayoisaiah";
+    repo = "f2";
+    rev = "v${version}";
+    sha256 = "sha256-bNcPzvjVBH7x60kNjlUILiQGG3GDmqIB5T2WP3+nZ+s=";
+  };
+
+  vendorSha256 = "sha256-Cahqk+7jDMUtZq0zhBll1Tfryu2zSPBN7JKscV38360=";
+
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
+
+  # has no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Command-line batch renaming tool";
+    homepage = "https://github.com/ayoisaiah/f2";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zendo ];
+  };
+}
--- a/Show More
+++ b/Show More